SO3D_original.exe - SO3D.exe

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	SO3D_original.exe
size	4278784 (0x414a00)
md5	edb895a6f9a2e097aa0a339a7960c937

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xfc

DOS stub

00000000: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000b0: 00 00 00 00 00 00 00 00  00 00 00 00              |............    |

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xe
TimeDateStamp	0
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x30c00
SizeOfInitializedData	0x96a800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x296b001
BaseOfCode	0x1000
BaseOfData	0x2000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x29bc000
SizeOfHeaders	0x1000
CheckSum	0x99fa92
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x200000
SizeOfHeapCommit	0x2000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.12

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1000	0xa00	RW- IDATA
.NewSec	0x2000	0x494000	0x1a3a00	RW- IDATA
.data	0x496000	0x95000	0x2bc00	RW- IDATA
	0x52b000	0xc92000	0xba00	RW- IDATA
.rsrc	0x11bd000	0x3bf000	0x223600	RW- IDATA
	0x157c000	0x4b000	0	RW- IDATA
.idata	0x15c7000	0x4000	0x1400	RW- IDATA
.zero	0x15cb000	0x975000	0	RW- IDATA
.as_0002	0x1f40000	0x1e000	0xba00	RW- IDATA
.zero	0x1f5e000	0x62000	0	RW- IDATA
.as_0003	0x1fc0000	0x10000	0x5000	RW- IDATA
.NewIT	0x1fd0000	0x99b000	0x200	RW- IDATA
.aspack	0x296b000	0x4000	0x3400	RW- IDATA
.adata	0x296f000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x296bfac	0x28
RESOURCE	0x11bd000	0x3be110
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x296bf54	8
DEBUG	0x2000	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

show previews

type	name	size	cp
EDT	#138	3907590	1252
EDT	#143	5472	1252
ICON	#1	4264	1252
ICON	#2	3240	1252
MENU	#109	74	1252
DIALOG	#103	234	1252
DIALOG	#144	1020	1252
STRING	#7	112	1252
ACCELERATORS	#109	16	1252
GROUP_ICON	#107	20	1252
GROUP_ICON	#133	20	1252
VERSION	#1	684	1252
MANIFEST	#1	624	1252

module_name	hint	ord	function_name
kernel32.dll			GetProcAddress
kernel32.dll			GetModuleHandleA
kernel32.dll			LoadLibraryA

StringTable 041204b0

CompanyName	Playwith Games
FileDescription	SO3D
FileVersion	0, 0, 0, 1
InternalName	SO3D
LegalCopyright	Copyright ⓒ 2003
OriginalFilename	SO3D.exe
ProductName	seal online
ProductVersion	0, 0, 0, 1

VS_FIXEDFILEINFO

FileVersion	0.0.0.1
ProductVersion	0.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	4273200	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 4278784 bytes (4179 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x1577368

[?] can't find file_offset of VA 0x157a618

[?] can't find file_offset of VA 0x157a664

[?] can't find file_offset of VA 0x157a750

[?] can't find file_offset of VA 0x157ab4c

[?] can't find file_offset of VA 0x157abbc

[?] can't find file_offset of VA 0x0

SO3D_original.exe-