filenameDriftCity.exe
size2484736 (0x25ea00)
md5ffc3f5b53ca2736b4675e7c55e5773c5
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number5
reserved00
oem_id0
oem_info0
reserved20x381618f4
reserved30xcbdb15dd
reserved40
reserved50x8238f059
reserved60xc095c7de
lfanew0x130

Rich Header

lib idversiontimes used
9640351
1181689
123507274
484474
15307712
9320672
2592104
93217928
9340358
93307727
102062
105206744
95217939
95307730
963077708
9230771
9430521
9030771

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x52bd9363
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x52d000
SizeOfInitializedData0x197000
SizeOfUninitializedData0
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x52e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x73a800
SizeOfHeaders0x1000
CheckSum0x5c5fd1
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

ASProtect 1.33 - 2.1 Registered (Alexey Solodovnikov)

Sections

namevavsizeraw sizeflags
0x10000x52d0000x1b4e00RWX IDATA
0x52e0000x760000x32000RWX IDATA
0x5a40000x11e0000x3e00RWX IDATA
.rsrc0x6c20000x30000x200RWX IDATA
0x6c50000x10000x200RWX IDATA
.data0x6c60000x730000x72200RWX IDATA
.adata0x7390000x20000x800RWX IDATA

Data Directory

typevasize
EXPORT0x6c50000x51
IMPORT0x6c6c4c0xa28
RESOURCE0x6c20000x2e60
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x52fd800x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
00x100000
typenamesizecp
ICON#132400
ICON#273360
ICON#38720
STRING#7360
GROUP_ICON#100480
module_namehintordfunction_name
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleA
kernel32.dllLoadLibraryA
nisystem20vc71.dllunsigned int __cdecl NiMessageBox(char const *, char const *, void *)

?NiMessageBox@@YAIPBD0PAX@Z

nimain20vc71.dllpublic: void __thiscall NiZBufferProperty::SetTestFunction(enum NiZBufferProperty::TestFunction)

?SetTestFunction@NiZBufferProperty@@QAEXW4TestFunction@1@@Z

nianimation20vc71.dllpublic: void __thiscall NiFloatData::SetAnim(class NiFloatKey *, unsigned int, enum NiAnimationKey::KeyType)

?SetAnim@NiFloatData@@QAEXPAVNiFloatKey@@IW4KeyType@NiAnimationKey@@@Z

nicollision20vc71.dllpublic: class NiBoundingVolume const * __thiscall NiUnionBV::GetBoundingVolume(unsigned int)const

?GetBoundingVolume@NiUnionBV@@QBEPBVNiBoundingVolume@@I@Z

niinput20vc71.dllpublic: void __thiscall NiInputSystem::CreateParams::SetRenderer(class NiRenderer *)

?SetRenderer@CreateParams@NiInputSystem@@QAEXPAVNiRenderer@@@Z

nidx9renderer20vc71.dllpublic: bool __thiscall NiDX9Renderer::Recreate(void)

?Recreate@NiDX9Renderer@@QAE_NXZ

niplugintoolkit20vc71.dllbool __cdecl operator==(class NiString const &, class NiString const &)

??8@YA_NABVNiString@@0@Z

d3d9.dllDirect3DCreate9
d3dx9_30.dllD3DXIntersectTri
winmm.dlltimeGetTime
version.dllGetFileVersionInfoA
shlwapi.dllPathFileExistsA
user32.dllMoveWindow
gdi32.dllSelectObject
comdlg32.dllGetOpenFileNameA
advapi32.dllCryptAcquireContextA
shell32.dllSHGetSpecialFolderPathA
ole32.dllCoUninitialize
oleaut32.dll6
niparticle20vc71.dllpublic: static float __cdecl NiParticleSystem::GetMinBeginKeyTime(class NiAVObject *)

?GetMinBeginKeyTime@NiParticleSystem@@SAMPAVNiAVObject@@@Z

nishadertoolkit20vc71.dllpublic: static void __cdecl NiShaderToolkit::DestroyToolkit(void)

?DestroyToolkit@NiShaderToolkit@@SAXXZ

nimilesaudio20vc71.dllpublic: class NiProviderInfo * __thiscall NiMilesAudioSystem::GetFirstProvider(void * &)

?GetFirstProvider@NiMilesAudioSystem@@QAEPAVNiProviderInfo@@AAPAX@Z

dx9envchk.dllclass IDX9EnvChk * g_pDX9EnvChk

?g_pDX9EnvChk@@3PAVIDX9EnvChk@@A

msvcp71.dllpublic: __thiscall std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >::basic_string<char, struct std::char_traits<char>, class std::allocator<char> >(class std::basic_string<char, struct std::char_traits<char>, class std::allocator<char> > const &)

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

msvcr71.dll_vsnprintf
handxwebforclient.dllHanDxWebInit
ddraw.dllDirectDrawCreateEx
psapi.dllGetModuleBaseNameA
libeay32.dll294
ws2_32.dll116
dsound.dll11
wininet.dllHttpSendRequestExA
dbghelp.dllSymGetSymFromAddr64
imm32.dllImmSetConversionStatus
oleaut32.dllVariantChangeTypeEx
kernel32.dllRaiseException
ordentry_vafunction_name
module_name
flags0x90810212
timestamp0
version28322.8828
ordinal_base859826331
nFunctions4201147170
nNames448817448
Names(448817448)0x2b00271b
Functions(4201147170)0x5f8ab36d
NameOrdinals(448817448)0x664b3d97
offsetsizetypecomment
02484736EXE12/27/2013 14:49:07#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x6c4e38
[?] can't find file_offset of VA 0xa80848ed
[?] can't find file_offset of VA 0x5f8ab36d
[?] can't find file_offset of VA 0x664b3d97
[?] can't find file_offset of VA 0x2b00271b
[?] can't find file_offset of VA 0x0
[?] can't find file_offset of VA 0x2b00271b
[?] can't find file_offset of VA 0x5f8ab36d
[?] can't find file_offset of VA 0x664b3d97