PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 3,59 MBSHA-256 Hash: 4D182D6A4535FFD2F10EE1E3CCD8307A2F78F6399170EDD7E8FEF218AA19C3B5 SHA-1 Hash: 3A5888189AFF0BF097E8518FDEF3355E5F228B30 MD5 Hash: 0040A5921F6759711B11EB9C73A69A84 Imphash: A07542BE81403294AA519244BBAD866E MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 30E8 SizeOfHeaders: 400 SizeOfImage: 39C000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 19314 IAT: 10000 Characteristics: 22 TimeDateStamp: 2D3E21F5 Date: 20/01/1994 6:17:25 File Type: EXE Number Of Sections: 7 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .fptable, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | EE00 | 1000 | EC50 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
F200 | 9C00 | 10000 | 9B48 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
18E00 | E00 | 1A000 | 1EE0 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
19C00 | 1000 | 1C000 | FCC |
|
|
| .fptable | 0xC0000040 Initialized Data Readable Writeable |
1AC00 | 200 | 1D000 | 100 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1AE00 | 37C800 | 1E000 | 37C698 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
397600 | 800 | 39B000 | 660 |
|
|
| Description |
| OriginalFilename: vir.exe CompanyName: UltraVnc LegalCopyright: Copyright (C) UltraVnc ProductName: UltraVncSC FileDescription: UltraVnc Self-Extract Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 24E8 Code -> 4883EC28E84B0200004883C428E97AFEFFFFCCCC4883EC28E8CF08000085C0742165488B042530000000488B4808EB05483B Assembler |SUB RSP, 0X28 |CALL 0X14000333C |ADD RSP, 0X28 |JMP 0X140002F74 |INT3 |INT3 |SUB RSP, 0X28 |CALL 0X1400039D4 |TEST EAX, EAX |JE 0X14000312A |MOV RAX, QWORD PTR GS:[0X30] |MOV RCX, QWORD PTR [RAX + 8] |JMP 0X14000311D |
| Signatures |
| Rich Signature Analyzer: Code -> 6E0DE5892A6C8BDA2A6C8BDA2A6C8BDA53ED8EDBA46C8BDA53ED8FDB266C8BDA53ED88DB226C8BDAADE588DB236C8BDAADE58FDB3A6C8BDAADE58EDB026C8BDA53ED8ADB296C8BDA2A6C8ADA4A6C8BDAB7E58FDB2B6C8BDAB7E588DB2B6C8BDAB7E574DA2B6C8BDAB7E589DB2B6C8BDA526963682A6C8BDA Footprint md5 Hash -> C96DF805261CE02E83899ECBC0837529 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.44**)[-] • Entropy: 7.96958 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| File Access |
| KERNEL32.dll .dat @.dat |
| File Access (UNICODE) |
| vir.exe mscoree.dll |
| Interest's Words |
| start |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 35A830 | 468 | 357630 | 28000000100000002000000001002000000000000004000000000000000000000000000000000000040303FF040203FF0403 | (....... ..... ................................... |
| \ICON\2\1033 | 35AC98 | 988 | 357A98 | 28000000180000003000000001002000000000000009000000000000000000000000000000000000040203FF040303FF0402 | (.......0..... ................................... |
| \ICON\3\1033 | 35B620 | 10A8 | 358420 | 28000000200000004000000001002000000000000010000000000000000000000000000000000000040203FF040203FF0403 | (... ...@..... ................................... |
| \ICON\4\1033 | 35C6C8 | 25A8 | 3594C8 | 28000000300000006000000001002000000000000024000000000000000000000000000000000000040202FF040203FF0402 | (...0........ ......$............................ |
| \ICON\5\1033 | 35EC70 | 4228 | 35BA70 | 28000000400000008000000001002000000000000040000000000000000000000000000000000000040202FF040203FF0402 | (...@......... ......@............................ |
| \ICON\6\1033 | 362E98 | 5488 | 35FC98 | 28000000480000009000000001002000000000000051000000000000000000000000000000000000040202FF040203FF0402 | (...H......... ......Q............................ |
| \ICON\7\1033 | 368320 | 94A8 | 365120 | 2800000060000000C000000001002000000000000090000000000000000000000000000000000000040202FF040203FF0402 | (............ ................................... |
| \ICON\8\1033 | 3717C8 | 10828 | 36E5C8 | 28000000800000000001000001002000000000000000010000000000000000000000000000000000030202FF040202FF0402 | (............. ................................... |
| \ICON\9\1033 | 381FF0 | 18373 | 37EDF0 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000016F724E5401CFA2779A00008000 | .PNG........IHDR.............\r.f....orNT...w..... |
| \RCDATA\101\1033 | 1E2B0 | 33C580 | 1B0B0 | 33A529635782E8EFC6E610781D69543A8AC1E7A06B19A3AB1097B8CA644FB7B900F26C58BEF50A70E13DBD9F649D636BA79F | 3.)cW......x.iT:....k.......dO....lX...p.=..d.ck.. |
| \GROUP_ICON\1\1033 | 39A368 | 84 | 397168 | 000001000900101000000100200068040000010018180000010020008809000002002020000001002000A810000003003030 | ............ .h........... ....... .... .......00 |
| \VERSION\1\1033 | 39A3F0 | 2A4 | 3971F0 | A40234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • mscoree.dll • .bss • vir.exe |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 482 | N/A | .text | CALL QWORD PTR [RIP+0xEF90] |
| 499 | N/A | .text | CALL QWORD PTR [RIP+0xEF61] |
| 4AB | N/A | .text | CALL QWORD PTR [RIP+0xEF57] |
| 4B9 | N/A | .text | CALL QWORD PTR [RIP+0xEF51] |
| 50F | N/A | .text | CALL QWORD PTR [RIP+0x19D1B] |
| 53E | N/A | .text | CALL QWORD PTR [RIP+0x19CEC] |
| 6A9 | N/A | .text | CALL QWORD PTR [RIP+0x19B09] |
| 6E4 | N/A | .text | CALL QWORD PTR [RIP+0x19ACE] |
| 71F | N/A | .text | CALL QWORD PTR [RIP+0x19A93] |
| 779 | N/A | .text | CALL QWORD PTR [RIP+0x19A39] |
| 7C8 | N/A | .text | CALL QWORD PTR [RIP+0x199EA] |
| 7F8 | N/A | .text | CALL QWORD PTR [RIP+0x199BA] |
| 859 | N/A | .text | CALL QWORD PTR [RIP+0x19959] |
| 9D8 | N/A | .text | CALL QWORD PTR [RIP+0x1984A] |
| A40 | N/A | .text | CALL QWORD PTR [RIP+0x197EA] |
| BD9 | N/A | .text | CALL QWORD PTR [RIP+0x195D9] |
| C38 | N/A | .text | CALL QWORD PTR [RIP+0x1957A] |
| C71 | N/A | .text | CALL QWORD PTR [RIP+0x19541] |
| CC0 | N/A | .text | CALL QWORD PTR [RIP+0x19562] |
| D1B | N/A | .text | CALL QWORD PTR [RIP+0x1950F] |
| EE0 | N/A | .text | CALL QWORD PTR [RIP+0x1933A] |
| F06 | N/A | .text | CALL QWORD PTR [RIP+0x1930C] |
| 1076 | N/A | .text | CALL QWORD PTR [RIP+0x19144] |
| 10B7 | N/A | .text | CALL QWORD PTR [RIP+0x1910B] |
| 10DD | N/A | .text | CALL QWORD PTR [RIP+0x190E5] |
| 110B | N/A | .text | CALL QWORD PTR [RIP+0x19117] |
| 1220 | N/A | .text | CALL QWORD PTR [RIP+0x18FB2] |
| 1231 | N/A | .text | CALL QWORD PTR [RIP+0x18FF9] |
| 12D7 | N/A | .text | CALL QWORD PTR [RIP+0x18EF3] |
| 1311 | N/A | .text | CALL QWORD PTR [RIP+0x18EC9] |
| 1322 | N/A | .text | CALL QWORD PTR [RIP+0x18ED0] |
| 132D | N/A | .text | CALL QWORD PTR [RIP+0x18ECD] |
| 1338 | N/A | .text | CALL QWORD PTR [RIP+0x18EC2] |
| 1391 | N/A | .text | CALL QWORD PTR [RIP+0x18E41] |
| 13B0 | N/A | .text | CALL QWORD PTR [RIP+0x18E32] |
| 14EC | N/A | .text | CALL QWORD PTR [RIP+0x18CD6] |
| 1514 | N/A | .text | CALL QWORD PTR [RIP+0x18CBE] |
| 153A | N/A | .text | CALL QWORD PTR [RIP+0x18CC8] |
| 1550 | N/A | .text | CALL QWORD PTR [RIP+0x18CBA] |
| 1559 | N/A | .text | CALL QWORD PTR [RIP+0x18CA1] |
| 156A | N/A | .text | CALL QWORD PTR [RIP+0x18CC0] |
| 1597 | N/A | .text | CALL QWORD PTR [RIP+0x18C33] |
| 15B7 | N/A | .text | CALL QWORD PTR [RIP+0x18C1B] |
| 15DE | N/A | .text | CALL QWORD PTR [RIP+0x18BEC] |
| 15E9 | N/A | .text | CALL QWORD PTR [RIP+0x18C01] |
| 15F4 | N/A | .text | CALL QWORD PTR [RIP+0x18C06] |
| 15FF | N/A | .text | CALL QWORD PTR [RIP+0x18BFB] |
| 1F4B | N/A | .text | CALL QWORD PTR [RIP+0xD4F7] |
| 1F54 | N/A | .text | CALL QWORD PTR [RIP+0xD4E6] |
| 1F5A | N/A | .text | CALL QWORD PTR [RIP+0xD4F0] |
| 1F6E | N/A | .text | JMP QWORD PTR [RIP+0xD4E4] |
| 1F82 | N/A | .text | CALL QWORD PTR [RIP+0xD4D8] |
| 2069 | N/A | .text | CALL QWORD PTR [RIP+0xD3F1] |
| 2109 | N/A | .text | CALL QWORD PTR [RIP+0xD319] |
| 2121 | N/A | .text | CALL QWORD PTR [RIP+0xD309] |
| 215B | N/A | .text | CALL QWORD PTR [RIP+0xD2D7] |
| 2177 | N/A | .text | CALL QWORD PTR [RIP+0xD2AB] |
| 2191 | N/A | .text | CALL QWORD PTR [RIP+0xD299] |
| 21CB | N/A | .text | CALL QWORD PTR [RIP+0xD267] |
| 2431 | N/A | .text | CALL QWORD PTR [RIP+0xD249] |
| 276B | N/A | .text | CALL QWORD PTR [RIP+0xCD0F] |
| 2779 | N/A | .text | CALL QWORD PTR [RIP+0xCCF9] |
| 2785 | N/A | .text | CALL QWORD PTR [RIP+0xCCE5] |
| 2795 | N/A | .text | CALL QWORD PTR [RIP+0xCCCD] |
| 2808 | N/A | .text | JMP QWORD PTR [RIP+0xCC7A] |
| 2888 | N/A | .text | CALL QWORD PTR [RIP+0xCBD2] |
| 28B5 | N/A | .text | CALL QWORD PTR [RIP+0xCB6D] |
| 28CF | N/A | .text | CALL QWORD PTR [RIP+0xCB5B] |
| 2913 | N/A | .text | CALL QWORD PTR [RIP+0xCB1F] |
| 2967 | N/A | .text | CALL QWORD PTR [RIP+0xCB23] |
| 2984 | N/A | .text | CALL QWORD PTR [RIP+0xCABE] |
| 298F | N/A | .text | CALL QWORD PTR [RIP+0xCAAB] |
| 29D4 | N/A | .text | CALL QWORD PTR [RIP+0xCABE] |
| 2A02 | N/A | .text | CALL QWORD PTR [RIP+0xCA98] |
| 2A58 | N/A | .text | JMP QWORD PTR [RIP+0xC9EA] |
| 2AE6 | N/A | .text | CALL QWORD PTR [RIP+0xCB94] |
| 2B22 | N/A | .text | CALL QWORD PTR [RIP+0xCB58] |
| 2EB3 | N/A | .text | CALL QWORD PTR [RIP+0xCA67] |
| 2EFC | N/A | .text | CALL QWORD PTR [RIP+0xC5A6] |
| 30BD | N/A | .text | CALL QWORD PTR [RIP+0xC5BD] |
| 32BC | N/A | .text | CALL QWORD PTR [RIP+0xC1EE] |
| 3343 | N/A | .text | CALL QWORD PTR [RIP+0xC16F] |
| 343B | N/A | .text | CALL QWORD PTR [RIP+0xC08F] |
| 34D9 | N/A | .text | CALL QWORD PTR [RIP+0xC031] |
| 34E7 | N/A | .text | CALL QWORD PTR [RIP+0xBFC3] |
| 3511 | N/A | .text | CALL QWORD PTR [RIP+0xBFF9] |
| 357F | N/A | .text | CALL QWORD PTR [RIP+0xBF7B] |
| 358B | N/A | .text | CALL QWORD PTR [RIP+0xBF77] |
| 35D7 | N/A | .text | JMP QWORD PTR [RIP+0xC0A3] |
| 35E3 | N/A | .text | JMP QWORD PTR [RIP+0xBEF7] |
| 3620 | N/A | .text | JMP QWORD PTR [RIP+0xC05A] |
| 362C | N/A | .text | JMP QWORD PTR [RIP+0xBEC6] |
| 3668 | N/A | .text | JMP QWORD PTR [RIP+0xC012] |
| 3674 | N/A | .text | JMP QWORD PTR [RIP+0xBE6E] |
| 36B4 | N/A | .text | CALL QWORD PTR [RIP+0xBFC6] |
| 36BC | N/A | .text | CALL QWORD PTR [RIP+0xBE2E] |
| 3713 | N/A | .text | CALL QWORD PTR [RIP+0xBF67] |
| 371B | N/A | .text | CALL QWORD PTR [RIP+0xBDB7] |
| 376E | N/A | .text | CALL QWORD PTR [RIP+0xBF0C] |
| 38EC | N/A | .text | CALL QWORD PTR [RIP+0xBB3E] |
| 19C00 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 19C0C | 140001170 | .pdata | ExceptionHook | Pointer to 1170 - 0x570 .text + UnwindInfo: .rdata |
| 19C18 | 14000127B | .pdata | ExceptionHook | Pointer to 127B - 0x67B .text + UnwindInfo: .rdata |
| 19C24 | 140001440 | .pdata | ExceptionHook | Pointer to 1440 - 0x840 .text + UnwindInfo: .rdata |
| 19C30 | 1400016B0 | .pdata | ExceptionHook | Pointer to 16B0 - 0xAB0 .text + UnwindInfo: .rdata |
| 19C3C | 140001950 | .pdata | ExceptionHook | Pointer to 1950 - 0xD50 .text + UnwindInfo: .rdata |
| 19C48 | 140001C8F | .pdata | ExceptionHook | Pointer to 1C8F - 0x108F .text + UnwindInfo: .rdata |
| 19C54 | 140001F50 | .pdata | ExceptionHook | Pointer to 1F50 - 0x1350 .text + UnwindInfo: .rdata |
| 19C60 | 140001F77 | .pdata | ExceptionHook | Pointer to 1F77 - 0x1377 .text + UnwindInfo: .rdata |
| 19C6C | 14000220F | .pdata | ExceptionHook | Pointer to 220F - 0x160F .text + UnwindInfo: .rdata |
| 19C78 | 140002220 | .pdata | ExceptionHook | Pointer to 2220 - 0x1620 .text + UnwindInfo: .rdata |
| 19C84 | 140002290 | .pdata | ExceptionHook | Pointer to 2290 - 0x1690 .text + UnwindInfo: .rdata |
| 19C90 | 140002350 | .pdata | ExceptionHook | Pointer to 2350 - 0x1750 .text + UnwindInfo: .rdata |
| 19C9C | 1400023BE | .pdata | ExceptionHook | Pointer to 23BE - 0x17BE .text + UnwindInfo: .rdata |
| 19CA8 | 14000298B | .pdata | ExceptionHook | Pointer to 298B - 0x1D8B .text + UnwindInfo: .rdata |
| 19CB4 | 1400029A7 | .pdata | ExceptionHook | Pointer to 29A7 - 0x1DA7 .text + UnwindInfo: .rdata |
| 19CC0 | 140002B40 | .pdata | ExceptionHook | Pointer to 2B40 - 0x1F40 .text + UnwindInfo: .rdata |
| 19CCC | 140002B74 | .pdata | ExceptionHook | Pointer to 2B74 - 0x1F74 .text + UnwindInfo: .rdata |
| 19CD8 | 140002C48 | .pdata | ExceptionHook | Pointer to 2C48 - 0x2048 .text + UnwindInfo: .rdata |
| 19CE4 | 140002C5C | .pdata | ExceptionHook | Pointer to 2C5C - 0x205C .text + UnwindInfo: .rdata |
| 19CF0 | 140002CFC | .pdata | ExceptionHook | Pointer to 2CFC - 0x20FC .text + UnwindInfo: .rdata |
| 19CFC | 140002D6C | .pdata | ExceptionHook | Pointer to 2D6C - 0x216C .text + UnwindInfo: .rdata |
| 19D08 | 140002DE0 | .pdata | ExceptionHook | Pointer to 2DE0 - 0x21E0 .text + UnwindInfo: .rdata |
| 19D14 | 140002E00 | .pdata | ExceptionHook | Pointer to 2E00 - 0x2200 .text + UnwindInfo: .rdata |
| 19D20 | 140002E70 | .pdata | ExceptionHook | Pointer to 2E70 - 0x2270 .text + UnwindInfo: .rdata |
| 19D2C | 140002E90 | .pdata | ExceptionHook | Pointer to 2E90 - 0x2290 .text + UnwindInfo: .rdata |
| 19D38 | 140002F48 | .pdata | ExceptionHook | Pointer to 2F48 - 0x2348 .text + UnwindInfo: .rdata |
| 19D44 | 140002F58 | .pdata | ExceptionHook | Pointer to 2F58 - 0x2358 .text + UnwindInfo: .rdata |
| 19D50 | 140002F74 | .pdata | ExceptionHook | Pointer to 2F74 - 0x2374 .text + UnwindInfo: .rdata |
| 19D5C | 1400030E8 | .pdata | ExceptionHook | Pointer to 30E8 - 0x24E8 .text + UnwindInfo: .rdata |
| 19D68 | 1400030FC | .pdata | ExceptionHook | Pointer to 30FC - 0x24FC .text + UnwindInfo: .rdata |
| 19D74 | 140003138 | .pdata | ExceptionHook | Pointer to 3138 - 0x2538 .text + UnwindInfo: .rdata |
| 19D80 | 140003174 | .pdata | ExceptionHook | Pointer to 3174 - 0x2574 .text + UnwindInfo: .rdata |
| 19D8C | 140003200 | .pdata | ExceptionHook | Pointer to 3200 - 0x2600 .text + UnwindInfo: .rdata |
| 19D98 | 140003298 | .pdata | ExceptionHook | Pointer to 3298 - 0x2698 .text + UnwindInfo: .rdata |
| 19DA4 | 1400032BC | .pdata | ExceptionHook | Pointer to 32BC - 0x26BC .text + UnwindInfo: .rdata |
| 19DB0 | 1400032E8 | .pdata | ExceptionHook | Pointer to 32E8 - 0x26E8 .text + UnwindInfo: .rdata |
| 19DBC | 140003324 | .pdata | ExceptionHook | Pointer to 3324 - 0x2724 .text + UnwindInfo: .rdata |
| 19DC8 | 14000333C | .pdata | ExceptionHook | Pointer to 333C - 0x273C .text + UnwindInfo: .rdata |
| 19DD4 | 140003428 | .pdata | ExceptionHook | Pointer to 3428 - 0x2828 .text + UnwindInfo: .rdata |
| 19DE0 | 14000346C | .pdata | ExceptionHook | Pointer to 346C - 0x286C .text + UnwindInfo: .rdata |
| 19DEC | 1400035B8 | .pdata | ExceptionHook | Pointer to 35B8 - 0x29B8 .text + UnwindInfo: .rdata |
| 19DF8 | 1400035FC | .pdata | ExceptionHook | Pointer to 35FC - 0x29FC .text + UnwindInfo: .rdata |
| 19E04 | 140003660 | .pdata | ExceptionHook | Pointer to 3660 - 0x2A60 .text + UnwindInfo: .rdata |
| 19E10 | 1400036C4 | .pdata | ExceptionHook | Pointer to 36C4 - 0x2AC4 .text + UnwindInfo: .rdata |
| 19E1C | 140003700 | .pdata | ExceptionHook | Pointer to 3700 - 0x2B00 .text + UnwindInfo: .rdata |
| 19E28 | 14000373C | .pdata | ExceptionHook | Pointer to 373C - 0x2B3C .text + UnwindInfo: .rdata |
| 19E34 | 1400039E0 | .pdata | ExceptionHook | Pointer to 39E0 - 0x2DE0 .text + UnwindInfo: .rdata |
| 19E40 | 140003BF8 | .pdata | ExceptionHook | Pointer to 3BF8 - 0x2FF8 .text + UnwindInfo: .rdata |
| 19E4C | 140003C20 | .pdata | ExceptionHook | Pointer to 3C20 - 0x3020 .text + UnwindInfo: .rdata |
| 19E58 | 140003C54 | .pdata | ExceptionHook | Pointer to 3C54 - 0x3054 .text + UnwindInfo: .rdata |
| 19E64 | 140003CCC | .pdata | ExceptionHook | Pointer to 3CCC - 0x30CC .text + UnwindInfo: .rdata |
| 19E70 | 140003D20 | .pdata | ExceptionHook | Pointer to 3D20 - 0x3120 .text + UnwindInfo: .rdata |
| 19E7C | 140003D88 | .pdata | ExceptionHook | Pointer to 3D88 - 0x3188 .text + UnwindInfo: .rdata |
| 19E88 | 140003D9C | .pdata | ExceptionHook | Pointer to 3D9C - 0x319C .text + UnwindInfo: .rdata |
| 19E94 | 140003DB0 | .pdata | ExceptionHook | Pointer to 3DB0 - 0x31B0 .text + UnwindInfo: .rdata |
| 19EA0 | 140003DF0 | .pdata | ExceptionHook | Pointer to 3DF0 - 0x31F0 .text + UnwindInfo: .rdata |
| 19EAC | 140003E10 | .pdata | ExceptionHook | Pointer to 3E10 - 0x3210 .text + UnwindInfo: .rdata |
| 19EB8 | 140003E20 | .pdata | ExceptionHook | Pointer to 3E20 - 0x3220 .text + UnwindInfo: .rdata |
| 19EC4 | 140003E5C | .pdata | ExceptionHook | Pointer to 3E5C - 0x325C .text + UnwindInfo: .rdata |
| 19ED0 | 140003E7C | .pdata | ExceptionHook | Pointer to 3E7C - 0x327C .text + UnwindInfo: .rdata |
| 19EDC | 140003E98 | .pdata | ExceptionHook | Pointer to 3E98 - 0x3298 .text + UnwindInfo: .rdata |
| 19EE8 | 140003F64 | .pdata | ExceptionHook | Pointer to 3F64 - 0x3364 .text + UnwindInfo: .rdata |
| 19EF4 | 140003FAC | .pdata | ExceptionHook | Pointer to 3FAC - 0x33AC .text + UnwindInfo: .rdata |
| 19F00 | 140003FD4 | .pdata | ExceptionHook | Pointer to 3FD4 - 0x33D4 .text + UnwindInfo: .rdata |
| 19F0C | 14000401C | .pdata | ExceptionHook | Pointer to 401C - 0x341C .text + UnwindInfo: .rdata |
| 19F18 | 140004054 | .pdata | ExceptionHook | Pointer to 4054 - 0x3454 .text + UnwindInfo: .rdata |
| 19F24 | 1400041A4 | .pdata | ExceptionHook | Pointer to 41A4 - 0x35A4 .text + UnwindInfo: .rdata |
| 19F30 | 1400041EC | .pdata | ExceptionHook | Pointer to 41EC - 0x35EC .text + UnwindInfo: .rdata |
| 19F3C | 140004234 | .pdata | ExceptionHook | Pointer to 4234 - 0x3634 .text + UnwindInfo: .rdata |
| 19F48 | 14000427C | .pdata | ExceptionHook | Pointer to 427C - 0x367C .text + UnwindInfo: .rdata |
| 19F54 | 1400042D0 | .pdata | ExceptionHook | Pointer to 42D0 - 0x36D0 .text + UnwindInfo: .rdata |
| 19F60 | 140004334 | .pdata | ExceptionHook | Pointer to 4334 - 0x3734 .text + UnwindInfo: .rdata |
| 19F6C | 140004388 | .pdata | ExceptionHook | Pointer to 4388 - 0x3788 .text + UnwindInfo: .rdata |
| 19F78 | 1400043EC | .pdata | ExceptionHook | Pointer to 43EC - 0x37EC .text + UnwindInfo: .rdata |
| 19F84 | 140004418 | .pdata | ExceptionHook | Pointer to 4418 - 0x3818 .text + UnwindInfo: .rdata |
| 19F90 | 14000447C | .pdata | ExceptionHook | Pointer to 447C - 0x387C .text + UnwindInfo: .rdata |
| 19F9C | 140004564 | .pdata | ExceptionHook | Pointer to 4564 - 0x3964 .text + UnwindInfo: .rdata |
| 19FA8 | 14000469C | .pdata | ExceptionHook | Pointer to 469C - 0x3A9C .text + UnwindInfo: .rdata |
| 19FB4 | 1400047A0 | .pdata | ExceptionHook | Pointer to 47A0 - 0x3BA0 .text + UnwindInfo: .rdata |
| 19FC0 | 1400047DC | .pdata | ExceptionHook | Pointer to 47DC - 0x3BDC .text + UnwindInfo: .rdata |
| 19FCC | 140004830 | .pdata | ExceptionHook | Pointer to 4830 - 0x3C30 .text + UnwindInfo: .rdata |
| 19FD8 | 140004844 | .pdata | ExceptionHook | Pointer to 4844 - 0x3C44 .text + UnwindInfo: .rdata |
| 19FE4 | 140004858 | .pdata | ExceptionHook | Pointer to 4858 - 0x3C58 .text + UnwindInfo: .rdata |
| 19FF0 | 140004870 | .pdata | ExceptionHook | Pointer to 4870 - 0x3C70 .text + UnwindInfo: .rdata |
| 19FFC | 140004888 | .pdata | ExceptionHook | Pointer to 4888 - 0x3C88 .text + UnwindInfo: .rdata |
| 1A008 | 140004910 | .pdata | ExceptionHook | Pointer to 4910 - 0x3D10 .text + UnwindInfo: .rdata |
| 1A014 | 140004938 | .pdata | ExceptionHook | Pointer to 4938 - 0x3D38 .text + UnwindInfo: .rdata |
| 1A020 | 140004970 | .pdata | ExceptionHook | Pointer to 4970 - 0x3D70 .text + UnwindInfo: .rdata |
| 1A02C | 1400049B4 | .pdata | ExceptionHook | Pointer to 49B4 - 0x3DB4 .text + UnwindInfo: .rdata |
| 1A038 | 140004A1C | .pdata | ExceptionHook | Pointer to 4A1C - 0x3E1C .text + UnwindInfo: .rdata |
| 1A044 | 140004C10 | .pdata | ExceptionHook | Pointer to 4C10 - 0x4010 .text + UnwindInfo: .rdata |
| 1A050 | 140004CD0 | .pdata | ExceptionHook | Pointer to 4CD0 - 0x40D0 .text + UnwindInfo: .rdata |
| 1A05C | 140004DA8 | .pdata | ExceptionHook | Pointer to 4DA8 - 0x41A8 .text + UnwindInfo: .rdata |
| 1A068 | 140005298 | .pdata | ExceptionHook | Pointer to 5298 - 0x4698 .text + UnwindInfo: .rdata |
| 1A074 | 1400054FC | .pdata | ExceptionHook | Pointer to 54FC - 0x48FC .text + UnwindInfo: .rdata |
| 1A080 | 14000561C | .pdata | ExceptionHook | Pointer to 561C - 0x4A1C .text + UnwindInfo: .rdata |
| 1A08C | 140005854 | .pdata | ExceptionHook | Pointer to 5854 - 0x4C54 .text + UnwindInfo: .rdata |
| 1A098 | 1400058B4 | .pdata | ExceptionHook | Pointer to 58B4 - 0x4CB4 .text + UnwindInfo: .rdata |
| 1A0A4 | 1400058FC | .pdata | ExceptionHook | Pointer to 58FC - 0x4CFC .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 2534730 | 67,2733% |
| Null Byte Code | 52478 | 1,3928% |
© 2026 All rights reserved.