| filename | rohanclient.exe | |
|---|---|---|
| size | 4518912 (0x44f400) | |
| md5 | feb99b4a8f8086099ff7ba088281c257 | |
| type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | |
| mimetype | application/x-dosexec | |
| clamav | OK | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x90 |
| blocks_in_file | 3 |
| num_relocs | 0 |
| header_paragraphs | 4 |
| min_extra_paragraphs | 0 |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0xb8 |
| checksum | 0 |
| ip | 0 |
| cs | 0 |
| reloc_table_offset | 0x40 |
| overlay_number | 2 |
| reserved0 | 0 |
| oem_id | 0 |
| oem_info | 0 |
| reserved2 | 0x381ee0f4 |
| reserved3 | 0xdf027e43 |
| reserved4 | 0 |
| reserved5 | 0x82f3f059 |
| reserved6 | 0xa9609b63 |
| lfanew | 0x138 |
Rich Header
| lib id | version | times used |
|---|---|---|
| 11 | 8168 | 9 |
| 105 | 2067 | 7 |
| 15 | 3077 | 57 |
| 95 | 2179 | 10 |
| 93 | 2067 | 2 |
| 95 | 3077 | 255 |
| 4 | 8168 | 2 |
| 4 | 8447 | 4 |
| 95 | 2067 | 12 |
| 18 | 8444 | 6 |
| 29 | 9178 | 132 |
| 28 | 9178 | 4 |
| 25 | 9210 | 8 |
| 1 | 0 | 552 |
| 93 | 2179 | 29 |
| 96 | 3077 | 1545 |
| 94 | 3052 | 1 |
| 90 | 3077 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
UPX v0.89.6 - v1.02 / v1.05 - v1.22 This file is packed with UPX. Analysis will be incomplete without unpacking. |
Sections
| name | va | vsize | raw size | flags | |
|---|---|---|---|---|---|
| UPX0 | 0x1000 | 0x6cb000 | 0 | RWX UDATA | |
| UPX1 | 0x6cc000 | 0x44e000 | 0x44da00 | RWX IDATA | |
| .rsrc | 0xb1a000 | 0x2000 | 0x1600 | RW- IDATA |
Data Directory
| type | va | size | |
|---|---|---|---|
| EXPORT | 0 | 0 | |
| IMPORT | 0xb1b114 | 0x4b4 | |
| RESOURCE | 0xb1a000 | 0x1114 | |
| EXCEPTION | 0 | 0 | |
| SECURITY | 0 | 0 | |
| BASERELOC | 0 | 0 | |
| DEBUG | 0 | 0 | |
| ARCHITECTURE | 0 | 0 | |
| GLOBALPTR | 0 | 0 | |
| TLS | 0 | 0 | |
| LOAD_CONFIG | 0 | 0 | |
| Bound_IAT | 0 | 0 | |
| IAT | 0 | 0 | |
| Delay_IAT | 0 | 0 | |
| CLR_Header | 0 | 0 | |
| 0 | 0x100000 |
| type | name | size | cp | |
|---|---|---|---|---|
| ICON | #1 | 2216 | 0 | |
| STRING | #1251 | 52 | 0 | |
| STRING | #1257 | 92 | 0 | |
| STRING | #1263 | 46 | 0 | |
| STRING | #1876 | 86 | 0 | |
| STRING | #1938 | 72 | 0 | |
| STRING | #2007 | 60 | 0 | |
| STRING | #2013 | 106 | 0 | |
| STRING | #2014 | 80 | 0 | |
| STRING | #2019 | 36 | 0 | |
| GROUP_ICON | #102 | 20 | 0 | |
| VERSION | #1 | 712 | 0 | |
| MANIFEST | #1 | 648 | 0 |
| id | lang | string |
|---|---|---|
| 20000 | 1042 | ꏰꘪ婼ꫨ㿢ි늷㥞㶃섫꫶슓栀뼕悸ැᨰ䥧櫠봈൚ |
| 20096 | 1042 | 窉堄쀹㪭赇푽ꁟ疍䟬螃ꊊ⇬䣰榏䩘鿼Ѿ䁗˼ᳫ侼৽䇹酂ﾅ盿雵띱뿪猪呂鍚뀲竀Đ黛㛸幫悇룆 |
| 20192 | 1042 | 胓ቁ藴價샃胘ࡀ緐ᚗ讦妘腓﹁ᖀ‟ᓨल |
| 30000 | 1042 | ee 09 c3 a0 06 b2 c6 46 84 28 ac 20 87 7e 19 be |.......F.(. .~..| b1 c1 e3 30 38 71 b8 59 f5 92 7c 40 70 a5 02 c1 |...08q.Y..|@p...| ea 65 8a 40 4a 27 ba 48 94 75 db dd 8a 20 c3 c0 |.e.@J'.H.u... ..| 2e fe 68 6c d1 50 78 31 1d 74 08 05 74 7e 66 8b |..hl.Px1.t..t~f.| 4e a5 0b c1 8e 81 9f 97 42 c1 76 d4 a3 cb 4a a8 |N.......B.v...J.| e8 39 0c f0 0f 41 |.9...A | |
| 30992 | 1042 | 먘駿芎孫༦㪌蜅ꨣด卓繚㕝…誃뿛䁀쪂ཎ냑憯ਲ⹅쌻ਲ㗗樐借쵭譂悁欆꦳ |
| 32096 | 1042 | 攏箸䓧疘ᓖ얅偻缢蔅罧℩ﱵⰮ晘ू棅盧胖ર锡겅큧︖藀㚘␋송蓡灴 |
| 32192 | 1042 | 脀퐄䫊清ᘴ⩁ⵋ鏯秓컝Ꮆ㲣蜈嫣䄽蘥꽛⍖퀃㇆枭獶썀⠗⣭郀訐圄ꁁ⑶嘇䴈ڎ퐘孞䘫뺍橼fl뫜쉭㽌䐐蔄祤尢惑黿 |
| 32208 | 1042 | a7 bb db e5 89 34 8b aa fe 86 8c 10 79 c2 53 19 |.....4......y.S.| 80 03 64 dd 82 58 0d f5 40 94 46 1c 45 38 f1 a1 |..d..X..@.F.E8..| 18 22 fe 6e 85 26 c7 75 86 fd 89 10 2a 83 66 1c |.".n.&.u....*.f.| 00 33 25 0b 3a 6a 49 2c 20 88 c3 ee 47 47 0c 8b |.3%.:jI, ...GG..| c0 aa 76 12 fe 88 c5 a7 4d dd 7d 24 80 b8 11 00 |..v.....M.}$....| |
| 32288 | 1042 | 7f 1c a6 0c de 95 ba bf 76 da 0e 1a 73 de e9 2d |........v...s..-| aa 68 fe 12 d6 7f 1f bd 40 9b 3f 0c 82 38 e4 45 |.h......@.?..8.E| 5b 87 e9 64 |[..d | |
| module_name | hint | ord | function_name |
|---|---|---|---|
| advapi32.dll | RegCloseKey | ||
| avifil32.dll | AVIFileInit | ||
| d3d9.dll | Direct3DCreate9 | ||
| dbghelp.dll | MiniDumpWriteDump | ||
| dinput8.dll | DirectInput8Create | ||
| fmod.dll | _FSOUND_Init@12 | ||
| gdi32.dll | BitBlt | ||
| imm32.dll | ImmNotifyIME | ||
| iphlpapi.dll | GetAdaptersInfo | ||
| KERNEL32.DLL | LoadLibraryA | ||
| KERNEL32.DLL | ExitProcess | ||
| KERNEL32.DLL | GetProcAddress | ||
| KERNEL32.DLL | VirtualProtect | ||
| libeay32.dll | RC4 | ||
| npkcrypt.dll | NPKCloseDriver | ||
| ole32.dll | CoInitialize | ||
| oleaut32.dll | VariantInit | ||
| shell32.dll | ShellExecuteA | ||
| shlwapi.dll | wnsprintfA | ||
| user32.dll | GetDC | ||
| version.dll | VerQueryValueA | ||
| wininet.dll | FtpPutFileA | ||
| winmm.dll | mmioRead | ||
| ws2_32.dll | recv |
StringTable 040904b0
| CompanyName | YNK Games |
| FileDescription | Rohan Online Game |
| FileVersion | 1, 0, 4, 905 |
| InternalName | RohanClient |
| LegalCopyright | Copyright (C) 2005 |
| OriginalFilename | RohanClient |
| ProductName | Rohan |
| ProductVersion | 1, 0, 4, 905 |
VS_FIXEDFILEINFO
| FileVersion | 1.0.4.905 |
| ProductVersion | 1.0.4.905 |
| StrucVersion | 0x10000 |
| FileFlagsMask | 0x17 |
| FileFlags | 0 |
| FileOS | 4 |
| FileType | 0 |
| FileSubtype | 0 |
 |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
[!] string size(38152) > stringtable size(52). truncated to 50
[!] string size(35354) > stringtable size(92). truncated to 90
[!] string size(33808) > stringtable size(46). truncated to 44
[!] string size(5084) > stringtable size(86). truncated to 84
[!] cannot convert "\xC3\xA0\x06\xB2\xC6F\x84(\xAC \x87~\x19\xBE\xB1\xC1"... to UTF-16
[!] string size(23912) > stringtable size(72). truncated to 70
[!] string size(70718) > stringtable size(60). truncated to 58
[!] string size(32632) > stringtable size(106). truncated to 104
[!] string size(96078) > stringtable size(80). truncated to 78
[!] cannot convert "\xDB\xE5\x894\x8B\xAA\xFE\x86\x8C\x10y\xC2S\x19\x80\x03"... to UTF-16
[!] string size(14590) > stringtable size(36). truncated to 34
[!] cannot convert "\xA6\f\xDE\x95\xBA\xBFv\xDA\x0E\x1As\xDE\xE9-\xAAh"... to UTF-16
[?] can't find file_offset of VA 0x0