filenameUltima Ratio Regum v070b.exe
size11765400 (0xb38698)
md5ee4e52e9a95797338b261573bd5cac4f
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
150204132
147210222
149210221
132210222
123507275
1091
1312102225
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x49180193
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x2200
SizeOfInitializedData0x9d5e00
SizeOfUninitializedData0
AddressOfEntryPoint0x2c61
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x9dc000
SizeOfHeaders0x400
CheckSum0xb3adef
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x21b40x2200R-X CODE
.rdata0x40000x9d20xa00R-- IDATA
.data0x50000x16a80xc00RW- IDATA
.rsrc0x70000x9d46dc0x9d4800R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x426c0x50
RESOURCE0x70000x9d46dc
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x41a00x40
Bound_IAT00
IAT0x40000x178
Delay_IAT00
CLR_Header00
typenamesizecp
PYTHON27.DLL#122886401252
PYTHONSCRIPT#179568071252
ICON#1560480
ICON#232400
ICON#313840
GROUP_ICON#1481252
MANIFEST#15981252
module_namehintordfunction_name
USER32.dll292GetFocus
USER32.dll504MessageBoxA
MSVCR90.dll796_onexit
MSVCR90.dll352_decode_pointer
MSVCR90.dll630_lock
MSVCR90.dll523_invoke_watson
MSVCR90.dll918_strdup
MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll150__dllonexit
MSVCR90.dll998_unlock
MSVCR90.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90.dll224__set_app_type
MSVCR90.dll362_encode_pointer
MSVCR90.dll207__p__fmode
MSVCR90.dll203__p__commode
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll227__setusermatherr
MSVCR90.dll316_configthreadlocale
MSVCR90.dll517_initterm_e
MSVCR90.dll516_initterm
MSVCR90.dll253_acmdln
MSVCR90.dll1228exit
MSVCR90.dll549_ismbblead
MSVCR90.dll102_XcptFilter
MSVCR90.dll380_exit
MSVCR90.dll300_cexit
MSVCR90.dll159__getmainargs
MSVCR90.dll277_amsg_exit
MSVCR90.dll1338realloc
MSVCR90.dll1217bsearch
MSVCR90.dll1333qsort
MSVCR90.dll1322memset
MSVCR90.dll1318memcpy
MSVCR90.dll1244fprintf
MSVCR90.dll161__iob_func
MSVCR90.dll1344setbuf
MSVCR90.dll1268getenv
MSVCR90.dll1215atoi
MSVCR90.dll1307malloc
MSVCR90.dll1252free
MSVCR90.dll1370strncmp
MSVCR90.dll1375strrchr
MSVCR90.dll138__argv
MSVCR90.dll137__argc
MSVCR90.dll1371strncpy
MSVCR90.dll873_snprintf
MSVCR90.dll922_stricmp
MSVCR90.dll371_except_handler4_common
MSVCR90.dll319_controlfp_s
KERNEL32.dll726IsDebuggerPresent
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll1079TerminateProcess
KERNEL32.dll595GetSystemTimeAsFileTime
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll618GetTickCount
KERNEL32.dll857QueryPerformanceCounter
KERNEL32.dll1055SetUnhandledExceptionFilter
KERNEL32.dll572GetStartupInfoA
KERNEL32.dll703InterlockedCompareExchange
KERNEL32.dll1067Sleep
KERNEL32.dll706InterlockedExchange
KERNEL32.dll674HeapAlloc
KERNEL32.dll717IsBadReadPtr
KERNEL32.dll1012SetLastError
KERNEL32.dll550GetProcessHeap
KERNEL32.dll678HeapFree
KERNEL32.dll1121VirtualFree
KERNEL32.dll1124VirtualProtect
KERNEL32.dll1118VirtualAlloc
KERNEL32.dll333FreeLibrary
KERNEL32.dll503GetModuleHandleA
KERNEL32.dll831OutputDebugStringA
KERNEL32.dll477GetFullPathNameA
KERNEL32.dll758LoadLibraryA
KERNEL32.dll546GetProcAddress
KERNEL32.dll1099UnmapViewOfFile
KERNEL32.dll121CreateFileA
KERNEL32.dll469GetFileSize
KERNEL32.dll122CreateFileMappingA
KERNEL32.dll68CloseHandle
KERNEL32.dll783MapViewOfFile
KERNEL32.dll311FindResourceA
KERNEL32.dll763LoadResource
KERNEL32.dll780LockResource
KERNEL32.dll501GetModuleFileNameA
KERNEL32.dll487GetLastError
KERNEL32.dll328FormatMessageA
KERNEL32.dll770LocalFree
KERNEL32.dll1215lstrlenA
KERNEL32.dll1096UnhandledExceptionFilter
offsetsizetypecomment
15c115HTM#
3e0c2288640DLL11/27/2010 17:31:11#
9c935456048PNG(256 x 256)#
9d84001442456ZIP#
Scanning the drive for archives:
1 file, 11765400 bytes (12 MiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER