RCT2.EXE

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	RCT2.EXE
size	952780 (0xe89cc)
md5	f82a9cff1b512a965d65bca1fb2d6431

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
11	8797	1
14	7299	15
10	8797	61
28	8830	2
37	8755	13
29	8830	1
1	0	195
19	8034	15
10	8168	19
6	1720	1
0	0	141

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x3e4c073e
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x6000
SizeOfInitializedData	0x9000
SizeOfUninitializedData	0x1027000
AddressOfEntryPoint	0x1031280
BaseOfCode	0x1031000
BaseOfData	0x1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1037000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x10000
SizeOfStackCommit	0x10000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2f6000	0x2f6000	RW- UDATA
CODESEG	0x2f7000	0x1ad000	0x1ad000	RW- UDATA
.rdata	0x4a4000	0x102000	0x102000	R-- UDATA
.data	0x5a6000	0xa81c3c	0x3c000	RW- UDATA
DATASEG	0x1028000	0x1000	0x1000	RW- IDATA
.rsrc	0x1029000	0x76a0	0x6000	R-- IDATA
.neolit	0x1031000	0x5280	0x1bf0	RWX CODE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1031000	0xf0
RESOURCE	0x1029000	0x6000
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x10310f0	0x58
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	308
CURSOR	#9	308
CURSOR	#10	308
CURSOR	#11	308
CURSOR	#12	308
CURSOR	#13	308
CURSOR	#14	308
CURSOR	#15	308
CURSOR	#16	308
CURSOR	#17	308
CURSOR	#18	308
CURSOR	#19	308
CURSOR	#20	308
CURSOR	#21	308
CURSOR	#22	308
CURSOR	#23	308
CURSOR	#24	308
CURSOR	#25	308
CURSOR	#26	308
CURSOR	#27	308
ICON	#28	744
ICON	#29	744
ICON	#30	2216
ICON	#31	296
ICON	#32	1384
ICON	#33	744
ICON	#34	2216
ICON	#35	296
ICON	#36	744
ICON	#37	2216
ICON	#38	296
ICON	#39	744
ICON	#40	2216
ICON	#41	2216
DIALOG	#101	194
GROUP_CURSOR	#109	20
GROUP_CURSOR	#110	20
GROUP_CURSOR	#112	20
GROUP_CURSOR	#116	20
GROUP_CURSOR	#119	20
GROUP_CURSOR	#120	20
GROUP_CURSOR	#124	20
GROUP_CURSOR	#127	20
GROUP_CURSOR	#128	20
GROUP_CURSOR	#129	20
GROUP_CURSOR	#130	20
GROUP_CURSOR	#131	20
GROUP_CURSOR	#132	20
GROUP_CURSOR	#133	20
GROUP_CURSOR	#137	20
GROUP_CURSOR	#138	20
GROUP_CURSOR	#139	20
GROUP_CURSOR	#141	20
GROUP_CURSOR	#142	20
GROUP_CURSOR	#143	20
GROUP_CURSOR	#144	20
GROUP_CURSOR	#145	20
GROUP_CURSOR	#158	20
GROUP_CURSOR	#159	20
GROUP_CURSOR	#161	20
GROUP_CURSOR	#165	20
GROUP_CURSOR	#166	20
GROUP_ICON	GSKAPPLICATIONICON	20
GROUP_ICON	#201	20
GROUP_ICON	#202	34
GROUP_ICON	#203	62
GROUP_ICON	#204	48
GROUP_ICON	#205	48

module_name	hint	ord	function_name
WINMM.dll	138		mmioSetInfo
DDRAW.dll	8		DirectDrawCreateEx
KERNEL32.dll	318		GetProcAddress
KERNEL32.dll	450		LoadLibraryA
USER32.dll	480		PostQuitMessage
GDI32.dll	264		GetBkMode
comdlg32.dll	11		GetSaveFileNameA
ADVAPI32.dll	215		GetUserNameA
SHELL32.dll	20		DragQueryFileA
DINPUT.dll			DirectInputCreateA
DPLAYX.dll		1
DSOUND.dll		1

show previews

offset	size	type	comment
0	39920	EXE	02/13/2003 20:59:42	#
15c1	15	HTM		#
9bf0	912860	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x102f138

[?] can't find file_offset of VA 0x102f280

[?] can't find file_offset of VA 0x102f3c8

[?] can't find file_offset of VA 0x102f510

[?] can't find file_offset of VA 0x102f658

[?] can't find file_offset of VA 0x102f7a0

[?] can't find file_offset of VA 0x102f8e8

[?] can't find file_offset of VA 0x102fa30

[?] can't find file_offset of VA 0x102fb78

[?] can't find file_offset of VA 0x102fcc0

[?] can't find file_offset of VA 0x102fe08

[?] can't find file_offset of VA 0x102ff50

[?] can't find file_offset of VA 0x1030098

[?] can't find file_offset of VA 0x10301e0

[?] can't find file_offset of VA 0x1030328

[?] can't find file_offset of VA 0x1030470

[?] can't find file_offset of VA 0x102f124

[?] can't find file_offset of VA 0x102f26c

[?] can't find file_offset of VA 0x102f3b4

[?] can't find file_offset of VA 0x102f4fc

[?] can't find file_offset of VA 0x102f644

[?] can't find file_offset of VA 0x102f78c

[?] can't find file_offset of VA 0x102f8d4

[?] can't find file_offset of VA 0x102fa1c

[?] can't find file_offset of VA 0x102fb64

[?] can't find file_offset of VA 0x102fcac

[?] can't find file_offset of VA 0x102fdf4

[?] can't find file_offset of VA 0x102ff3c

[?] can't find file_offset of VA 0x1030084

[?] can't find file_offset of VA 0x10301cc

[?] can't find file_offset of VA 0x1030314

[?] can't find file_offset of VA 0x103045c

[?] can't find file_offset of VA 0x10305a4