RCT.EXE

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	RCT.EXE
size	809908 (0xc5bb4)
md5	e6a47d88c0efc10bf379e06f69ab34c6

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
11	8797	1
14	7299	17
10	8797	67
29	8830	1
28	8830	2
37	8755	11
19	8034	17
1	0	204
10	8168	20
0	0	154
6	1720	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x3e6fb513
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x6000
SizeOfInitializedData	0x8000
SizeOfUninitializedData	0x83d000
AddressOfEntryPoint	0x84628a
BaseOfCode	0x846000
BaseOfData	0x1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x84c000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x10000
SizeOfStackCommit	0x10000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x195000	0x195000	RW- UDATA
CODESEG	0x196000	0x1f1000	0x1f1000	RW- UDATA
.rdata	0x387000	0x103000	0x103000	R-- UDATA
.data	0x48a000	0x3b3f58	0x36000	RW- UDATA
DATASEG	0x83e000	0x1000	0x1000	RW- IDATA
.rsrc	0x83f000	0x6d38	0x5000	R-- IDATA
.neolit	0x846000	0x528a	0x1bfa	RWX CODE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x846000	0xf0
RESOURCE	0x83f000	0x5000
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x8460f0	0x58
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	308
CURSOR	#9	308
CURSOR	#10	308
CURSOR	#11	308
CURSOR	#12	308
CURSOR	#13	308
CURSOR	#14	308
CURSOR	#15	308
CURSOR	#16	308
CURSOR	#17	308
CURSOR	#18	308
CURSOR	#19	308
CURSOR	#20	308
CURSOR	#21	308
CURSOR	#22	308
CURSOR	#23	308
CURSOR	#24	308
ICON	#25	744
ICON	#26	744
ICON	#27	2216
ICON	#28	296
ICON	#29	1384
ICON	#30	744
ICON	#31	2216
ICON	#32	296
ICON	#33	744
ICON	#34	2216
ICON	#35	296
ICON	#36	744
ICON	#37	2216
ICON	#38	296
ICON	#39	744
DIALOG	#101	194
GROUP_CURSOR	#109	20
GROUP_CURSOR	#110	20
GROUP_CURSOR	#112	20
GROUP_CURSOR	#116	20
GROUP_CURSOR	#119	20
GROUP_CURSOR	#120	20
GROUP_CURSOR	#124	20
GROUP_CURSOR	#127	20
GROUP_CURSOR	#128	20
GROUP_CURSOR	#129	20
GROUP_CURSOR	#130	20
GROUP_CURSOR	#131	20
GROUP_CURSOR	#132	20
GROUP_CURSOR	#133	20
GROUP_CURSOR	#137	20
GROUP_CURSOR	#138	20
GROUP_CURSOR	#139	20
GROUP_CURSOR	#141	20
GROUP_CURSOR	#142	20
GROUP_CURSOR	#143	20
GROUP_CURSOR	#144	20
GROUP_CURSOR	#145	20
GROUP_CURSOR	#158	20
GROUP_CURSOR	#159	20
GROUP_ICON	GSKAPPLICATIONICON	34
GROUP_ICON	#201	20
GROUP_ICON	#202	34
GROUP_ICON	#203	62
GROUP_ICON	#204	48
GROUP_ICON	#205	48

module_name	hint	ord	function_name
KERNEL32.dll	318		GetProcAddress
KERNEL32.dll	450		LoadLibraryA
USER32.dll	625		SystemParametersInfoA
GDI32.dll	215		GdiFlush
ADVAPI32.dll	351		RegCreateKeyExA
comdlg32.dll	9		GetOpenFileNameA
SHELL32.dll	121		Shell_NotifyIconA
ole32.dll	13		CoCreateInstance
WINMM.dll	152		timeGetTime
DINPUT.dll			DirectInputCreateA
DPLAYX.dll		2
DSOUND.dll		2

show previews

offset	size	type	comment
0	35834	EXE	03/12/2003 22:30:43	#
15c1	15	HTM		#
8bfa	774074	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x844038

[?] can't find file_offset of VA 0x844180

[?] can't find file_offset of VA 0x8442c8

[?] can't find file_offset of VA 0x844410

[?] can't find file_offset of VA 0x844558

[?] can't find file_offset of VA 0x8446a0

[?] can't find file_offset of VA 0x8447e8

[?] can't find file_offset of VA 0x844930

[?] can't find file_offset of VA 0x844a78

[?] can't find file_offset of VA 0x844bc0

[?] can't find file_offset of VA 0x844d08

[?] can't find file_offset of VA 0x844e50

[?] can't find file_offset of VA 0x844f98

[?] can't find file_offset of VA 0x8450e0

[?] can't find file_offset of VA 0x845228

[?] can't find file_offset of VA 0x845370

[?] can't find file_offset of VA 0x8454b8

[?] can't find file_offset of VA 0x845600

[?] can't find file_offset of VA 0x845748

[?] can't find file_offset of VA 0x845890

[?] can't find file_offset of VA 0x8459d8

[?] can't find file_offset of VA 0x845b20

[?] can't find file_offset of VA 0x844024

[?] can't find file_offset of VA 0x8442b4

[?] can't find file_offset of VA 0x84416c

[?] can't find file_offset of VA 0x8443fc

[?] can't find file_offset of VA 0x844544

[?] can't find file_offset of VA 0x84468c

[?] can't find file_offset of VA 0x8447d4

[?] can't find file_offset of VA 0x84491c

[?] can't find file_offset of VA 0x844a64

[?] can't find file_offset of VA 0x844bac

[?] can't find file_offset of VA 0x844cf4

[?] can't find file_offset of VA 0x844e3c

[?] can't find file_offset of VA 0x844f84

[?] can't find file_offset of VA 0x8450cc

[?] can't find file_offset of VA 0x845214

[?] can't find file_offset of VA 0x84535c

[?] can't find file_offset of VA 0x8454a4

[?] can't find file_offset of VA 0x8455ec

[?] can't find file_offset of VA 0x845734

[?] can't find file_offset of VA 0x84587c

[?] can't find file_offset of VA 0x8459c4

[?] can't find file_offset of VA 0x845b0c

[?] can't find file_offset of VA 0x845c54