PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 404,00 KB SHA-256 Hash: FB1E55AA81CF0271A2ABF545477B5ED4EA3665B09F7DE0EC626DE7A65E0BFECE SHA-1 Hash: 96DC4962EAC57B7945F18416F8B0C3DEA5F88ABF MD5 Hash: 1C4E943DC10C10CAF967375283E7E5B6 Imphash: 65FCE18521A35AF73DB7BD2F57300D61 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 48D48 SizeOfHeaders: 400 SizeOfImage: 6B000 ImageBase: 0000000180000000 Architecture: x64 ImportTable: 61C04 IAT: 4B000 Characteristics: 2022 TimeDateStamp: 6949C8BF Date: 22/12/2025 22:39:59 File Type: DLL Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 49200 | 1000 | 491E9 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
49600 | 18800 | 4B000 | 18666 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
61E00 | 800 | 64000 | 1940 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
62600 | 2400 | 66000 | 2238 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
64A00 | 200 | 69000 | 1E0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
64C00 | 400 | 6A000 | 398 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 48148 Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8770300004C8BC78BD3488BCE488B5C2430488B7424 Assembler |MOV QWORD PTR [RSP + 8], RBX |MOV QWORD PTR [RSP + 0X10], RSI |PUSH RDI |SUB RSP, 0X20 |MOV RDI, R8 |MOV EBX, EDX |MOV RSI, RCX |CMP EDX, 1 |JNE 0X180048D69 |CALL 0X1800490E0 |MOV R8, RDI |MOV EDX, EBX |MOV RCX, RSI |MOV RBX, QWORD PTR [RSP + 0X30] |
| Signatures |
| Rich Signature Analyzer: Code -> A4EA1242E08B7C11E08B7C11E08B7C11E9F3EF11EE8B7C11220A7810E78B7C11220A7F10E48B7C11220A7910F48B7C11220A7D10E68B7C11940A7D10EC8B7C11D60B7D10E38B7C11E08B7D11018B7C1113097510FB8B7C1113098311E18B7C1113097E10E18B7C1152696368E08B7C11 Footprint md5 Hash -> F842D5B561D4378EB41561BA22FAB92A • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.39**)[-] • Entropy: 6.75122 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetThreadContext | Retrieves a thread execution context. |
| KERNEL32.DLL | SetThreadContext | Modifies a thread execution context. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| USER32.DLL | CallWindowProcA | Invokes the window procedure for the specified window and messages. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| File Access |
| api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-utility-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll VCRUNTIME140.dll VCRUNTIME140_1.dll IMM32.dll MSVCP140.dll SHELL32.dll USER32.dll KERNEL32.dll jvm.dll xinput1_1.dll xinput1_2.dll xinput9_1_0.dll xinput1_3.dll xinput1_4.dll opengl32.dll .dat @.dat imgui_log.txt imgui.ini |
| Interest's Words |
| exec attrib start pause shutdown systeminfo expand route |
| URLs |
| https://fontbundles.net/ https://github.com/ocornut/imgui/blob/master/docs/FAQ.mdqa-usage |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Keyboard Key (Alt+) |
| Text | Ascii | Keyboard Key (Right Shift) |
| Text | Ascii | Keyboard Key (Page Down) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (DownArrow) |
| Text | Ascii | Keyboard Key (RightArrow) |
| Text | Ascii | Keyboard Key (UpArrow) |
| Text | Ascii | Keyboard Key (LeftArrow) |
| Text | Ascii | Keyboard Key (PageDown) |
| Text | Ascii | Keyboard Key (PageUp) |
| Text | Ascii | Keyboard Key (CapsLock) |
| Text | Ascii | Keyboard Key (Backspace) |
| Text | Ascii | Keyboard Key (Ctrl+S) |
| Text | Ascii | Software that records user activity (Logger) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\2\1033 | 69060 | 17D | 64A60 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • api-ms-win-crt-string-l1-1-0.dll • 6_initterm7_initterm_eapi-ms-win-crt-runtime-l1-1-0.dll • xinput1_2.dll • xinput9_1_0.dll • opengl32.dll • imgui.ini • imgui_log.txt • https://github.com/ocornut/imgui/blob/master/docs/FAQ.mdqa-usage • xinput1_4.dll • xinput1_3.dll • xinput1_1.dll • .tls • .bss • KERNEL32.dll • MSVCP140.dll • VCRUNTIME140_1.dll • VCRUNTIME140.dll • api-ms-win-crt-math-l1-1-0.dll • api-ms-win-crt-stdio-l1-1-0.dll • api-ms-win-crt-utility-l1-1-0.dll • api-ms-win-crt-heap-l1-1-0.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 65A | N/A | .text | CALL QWORD PTR [RIP+0x4A308] |
| 682 | N/A | .text | CALL QWORD PTR [RIP+0x4A400] |
| 734 | N/A | .text | CALL QWORD PTR [RIP+0x49E06] |
| 770 | N/A | .text | CALL QWORD PTR [RIP+0x4A1E2] |
| 797 | N/A | .text | CALL QWORD PTR [RIP+0x49EE3] |
| 7B0 | N/A | .text | CALL QWORD PTR [RIP+0x49EBA] |
| 7C1 | N/A | .text | CALL QWORD PTR [RIP+0x49EA9] |
| 7EF | N/A | .text | CALL QWORD PTR [RIP+0x49E83] |
| 880 | N/A | .text | CALL QWORD PTR [RIP+0x49C72] |
| 898 | N/A | .text | CALL QWORD PTR [RIP+0x49C5A] |
| 8C1 | N/A | .text | CALL QWORD PTR [RIP+0x49C31] |
| 9CA | N/A | .text | CALL QWORD PTR [RIP+0x49BF8] |
| AA8 | N/A | .text | CALL QWORD PTR [RIP+0x49D42] |
| AB1 | N/A | .text | CALL QWORD PTR [RIP+0x49B19] |
| AF2 | N/A | .text | CALL QWORD PTR [RIP+0x49CF8] |
| AFD | N/A | .text | CALL QWORD PTR [RIP+0x49ACD] |
| B2E | N/A | .text | CALL QWORD PTR [RIP+0x49CBC] |
| B37 | N/A | .text | CALL QWORD PTR [RIP+0x49A93] |
| B78 | N/A | .text | CALL QWORD PTR [RIP+0x49C72] |
| B83 | N/A | .text | CALL QWORD PTR [RIP+0x49A47] |
| BB4 | N/A | .text | CALL QWORD PTR [RIP+0x49C36] |
| BBD | N/A | .text | CALL QWORD PTR [RIP+0x49A0D] |
| BF4 | N/A | .text | CALL QWORD PTR [RIP+0x49BF6] |
| BFD | N/A | .text | CALL QWORD PTR [RIP+0x499CD] |
| C41 | N/A | .text | CALL QWORD PTR [RIP+0x49BA9] |
| C4B | N/A | .text | CALL QWORD PTR [RIP+0x4997F] |
| CA7 | N/A | .text | CALL QWORD PTR [RIP+0x49B43] |
| CB2 | N/A | .text | CALL QWORD PTR [RIP+0x49918] |
| CFC | N/A | .text | CALL QWORD PTR [RIP+0x49AEE] |
| D06 | N/A | .text | CALL QWORD PTR [RIP+0x498C4] |
| D47 | N/A | .text | CALL QWORD PTR [RIP+0x49AA3] |
| D52 | N/A | .text | CALL QWORD PTR [RIP+0x49878] |
| DAF | N/A | .text | CALL QWORD PTR [RIP+0x49A3B] |
| DB8 | N/A | .text | CALL QWORD PTR [RIP+0x49812] |
| E26 | N/A | .text | CALL QWORD PTR [RIP+0x49C2C] |
| E69 | N/A | .text | CALL QWORD PTR [RIP+0x49981] |
| E74 | N/A | .text | CALL QWORD PTR [RIP+0x49756] |
| EBC | N/A | .text | CALL QWORD PTR [RIP+0x4992E] |
| EC7 | N/A | .text | CALL QWORD PTR [RIP+0x49703] |
| EF8 | N/A | .text | CALL QWORD PTR [RIP+0x498F2] |
| F03 | N/A | .text | CALL QWORD PTR [RIP+0x496C7] |
| F36 | N/A | .text | CALL QWORD PTR [RIP+0x498B4] |
| F41 | N/A | .text | CALL QWORD PTR [RIP+0x49689] |
| F78 | N/A | .text | CALL QWORD PTR [RIP+0x49872] |
| F83 | N/A | .text | CALL QWORD PTR [RIP+0x49647] |
| FC4 | N/A | .text | CALL QWORD PTR [RIP+0x49826] |
| FCF | N/A | .text | CALL QWORD PTR [RIP+0x495FB] |
| 1020 | N/A | .text | CALL QWORD PTR [RIP+0x49882] |
| 1061 | N/A | .text | CALL QWORD PTR [RIP+0x49869] |
| 1097 | N/A | .text | JMP QWORD PTR [RIP+0x49833] |
| 1104 | N/A | .text | CALL QWORD PTR [RIP+0x4979E] |
| 1144 | N/A | .text | CALL QWORD PTR [RIP+0x4975E] |
| 116B | N/A | .text | CALL QWORD PTR [RIP+0x4951F] |
| 11D4 | N/A | .text | CALL QWORD PTR [RIP+0x49786] |
| 123C | N/A | .text | CALL QWORD PTR [RIP+0x4971E] |
| 12A4 | N/A | .text | CALL QWORD PTR [RIP+0x496B6] |
| 1442 | N/A | .text | CALL QWORD PTR [RIP+0x49470] |
| 1510 | N/A | .text | CALL QWORD PTR [RIP+0x4944A] |
| 1587 | N/A | .text | CALL QWORD PTR [RIP+0x493D3] |
| 176B | N/A | .text | CALL QWORD PTR [RIP+0x4914F] |
| 17A1 | N/A | .text | CALL QWORD PTR [RIP+0x49119] |
| 17C4 | N/A | .text | CALL QWORD PTR [RIP+0x490F6] |
| 17E4 | N/A | .text | CALL QWORD PTR [RIP+0x490D6] |
| 1879 | N/A | .text | CALL QWORD PTR [RIP+0x49099] |
| 18D1 | N/A | .text | CALL QWORD PTR [RIP+0x49041] |
| 1B65 | N/A | .text | CALL QWORD PTR [RIP+0x48DF5] |
| 1C16 | N/A | .text | CALL QWORD PTR [RIP+0x48CA4] |
| 1C53 | N/A | .text | CALL QWORD PTR [RIP+0x48C67] |
| 1C76 | N/A | .text | CALL QWORD PTR [RIP+0x48C44] |
| 1C96 | N/A | .text | CALL QWORD PTR [RIP+0x48C24] |
| 1D30 | N/A | .text | CALL QWORD PTR [RIP+0x48BE2] |
| 1D88 | N/A | .text | CALL QWORD PTR [RIP+0x48B8A] |
| 2006 | N/A | .text | CALL QWORD PTR [RIP+0x48954] |
| 200D | N/A | .text | CALL QWORD PTR [RIP+0x4894D] |
| 2014 | N/A | .text | CALL QWORD PTR [RIP+0x48946] |
| 213C | N/A | .text | CALL QWORD PTR [RIP+0x4881E] |
| 2258 | N/A | .text | CALL QWORD PTR [RIP+0x48642] |
| 227B | N/A | .text | CALL QWORD PTR [RIP+0x4861F] |
| 2379 | N/A | .text | CALL QWORD PTR [RIP+0x485E1] |
| 252A | N/A | .text | CALL QWORD PTR [RIP+0x48430] |
| 2608 | N/A | .text | CALL QWORD PTR [RIP+0x48352] |
| 26B6 | N/A | .text | CALL QWORD PTR [RIP+0x4839C] |
| 26C7 | N/A | .text | CALL QWORD PTR [RIP+0x4838B] |
| 27B6 | N/A | .text | CALL QWORD PTR [RIP+0x4829C] |
| 27C7 | N/A | .text | CALL QWORD PTR [RIP+0x4828B] |
| 284E | N/A | .text | CALL QWORD PTR [RIP+0x4810C] |
| 28F9 | N/A | .text | CALL QWORD PTR [RIP+0x48061] |
| 296C | N/A | .text | CALL QWORD PTR [RIP+0x47FEE] |
| 2CD5 | N/A | .text | CALL QWORD PTR [RIP+0x47C85] |
| 2D31 | N/A | .text | CALL QWORD PTR [RIP+0x47C29] |
| 32C7 | N/A | .text | CALL QWORD PTR [RIP+0x47693] |
| 33BB | N/A | .text | CALL QWORD PTR [RIP+0x4759F] |
| 3459 | N/A | .text | CALL QWORD PTR [RIP+0x47231] |
| 3670 | N/A | .text | CALL QWORD PTR [RIP+0x472EA] |
| 3683 | N/A | .text | CALL QWORD PTR [RIP+0x46FFF] |
| 36E9 | N/A | .text | CALL QWORD PTR [RIP+0x471D1] |
| 3725 | N/A | .text | CALL QWORD PTR [RIP+0x4718D] |
| 37F3 | N/A | .text | CALL QWORD PTR [RIP+0x46E97] |
| 387D | N/A | .text | CALL QWORD PTR [RIP+0x47095] |
| 39E2 | N/A | .text | CALL QWORD PTR [RIP+0x46F78] |
| 62600 | 180001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 6260C | 180001074 | .pdata | ExceptionHook | Pointer to 1074 - 0x474 .text + UnwindInfo: .rdata |
| 62618 | 1800010E8 | .pdata | ExceptionHook | Pointer to 10E8 - 0x4E8 .text + UnwindInfo: .rdata |
| 62624 | 18000115C | .pdata | ExceptionHook | Pointer to 115C - 0x55C .text + UnwindInfo: .rdata |
| 62630 | 1800011D0 | .pdata | ExceptionHook | Pointer to 11D0 - 0x5D0 .text + UnwindInfo: .rdata |
| 6263C | 180001250 | .pdata | ExceptionHook | Pointer to 1250 - 0x650 .text + UnwindInfo: .rdata |
| 62648 | 180001268 | .pdata | ExceptionHook | Pointer to 1268 - 0x668 .text + UnwindInfo: .rdata |
| 62654 | 180001324 | .pdata | ExceptionHook | Pointer to 1324 - 0x724 .text + UnwindInfo: .rdata |
| 62660 | 1800013C8 | .pdata | ExceptionHook | Pointer to 13C8 - 0x7C8 .text + UnwindInfo: .rdata |
| 6266C | 1800013E4 | .pdata | ExceptionHook | Pointer to 13E4 - 0x7E4 .text + UnwindInfo: .rdata |
| 62678 | 18000140C | .pdata | ExceptionHook | Pointer to 140C - 0x80C .text + UnwindInfo: .rdata |
| 62684 | 1800015E4 | .pdata | ExceptionHook | Pointer to 15E4 - 0x9E4 .text + UnwindInfo: .rdata |
| 62690 | 18000160C | .pdata | ExceptionHook | Pointer to 160C - 0xA0C .text + UnwindInfo: .rdata |
| 6269C | 180001634 | .pdata | ExceptionHook | Pointer to 1634 - 0xA34 .text + UnwindInfo: .rdata |
| 626A8 | 18000165C | .pdata | ExceptionHook | Pointer to 165C - 0xA5C .text + UnwindInfo: .rdata |
| 626B4 | 180001BFC | .pdata | ExceptionHook | Pointer to 1BFC - 0xFFC .text + UnwindInfo: .rdata |
| 626C0 | 180001C44 | .pdata | ExceptionHook | Pointer to 1C44 - 0x1044 .text + UnwindInfo: .rdata |
| 626CC | 180001CC0 | .pdata | ExceptionHook | Pointer to 1CC0 - 0x10C0 .text + UnwindInfo: .rdata |
| 626D8 | 180001CE0 | .pdata | ExceptionHook | Pointer to 1CE0 - 0x10E0 .text + UnwindInfo: .rdata |
| 626E4 | 180001D20 | .pdata | ExceptionHook | Pointer to 1D20 - 0x1120 .text + UnwindInfo: .rdata |
| 626F0 | 180001D60 | .pdata | ExceptionHook | Pointer to 1D60 - 0x1160 .text + UnwindInfo: .rdata |
| 626FC | 180001D74 | .pdata | ExceptionHook | Pointer to 1D74 - 0x1174 .text + UnwindInfo: .rdata |
| 62708 | 180001DDC | .pdata | ExceptionHook | Pointer to 1DDC - 0x11DC .text + UnwindInfo: .rdata |
| 62714 | 180001E44 | .pdata | ExceptionHook | Pointer to 1E44 - 0x1244 .text + UnwindInfo: .rdata |
| 62720 | 180001EAC | .pdata | ExceptionHook | Pointer to 1EAC - 0x12AC .text + UnwindInfo: .rdata |
| 6272C | 180002194 | .pdata | ExceptionHook | Pointer to 2194 - 0x1594 .text + UnwindInfo: .rdata |
| 62738 | 180002C24 | .pdata | ExceptionHook | Pointer to 2C24 - 0x2024 .text + UnwindInfo: .rdata |
| 62744 | 180002D68 | .pdata | ExceptionHook | Pointer to 2D68 - 0x2168 .text + UnwindInfo: .rdata |
| 62750 | 180002EA4 | .pdata | ExceptionHook | Pointer to 2EA4 - 0x22A4 .text + UnwindInfo: .rdata |
| 6275C | 180002FC4 | .pdata | ExceptionHook | Pointer to 2FC4 - 0x23C4 .text + UnwindInfo: .rdata |
| 62768 | 180003300 | .pdata | ExceptionHook | Pointer to 3300 - 0x2700 .text + UnwindInfo: .rdata |
| 62774 | 1800033F8 | .pdata | ExceptionHook | Pointer to 33F8 - 0x27F8 .text + UnwindInfo: .rdata |
| 62780 | 180003458 | .pdata | ExceptionHook | Pointer to 3458 - 0x2858 .text + UnwindInfo: .rdata |
| 6278C | 180003500 | .pdata | ExceptionHook | Pointer to 3500 - 0x2900 .text + UnwindInfo: .rdata |
| 62798 | 180003574 | .pdata | ExceptionHook | Pointer to 3574 - 0x2974 .text + UnwindInfo: .rdata |
| 627A4 | 18000363C | .pdata | ExceptionHook | Pointer to 363C - 0x2A3C .text + UnwindInfo: .rdata |
| 627B0 | 1800036A0 | .pdata | ExceptionHook | Pointer to 36A0 - 0x2AA0 .text + UnwindInfo: .rdata |
| 627BC | 180003768 | .pdata | ExceptionHook | Pointer to 3768 - 0x2B68 .text + UnwindInfo: .rdata |
| 627C8 | 1800037CC | .pdata | ExceptionHook | Pointer to 37CC - 0x2BCC .text + UnwindInfo: .rdata |
| 627D4 | 1800038DC | .pdata | ExceptionHook | Pointer to 38DC - 0x2CDC .text + UnwindInfo: .rdata |
| 627E0 | 180003938 | .pdata | ExceptionHook | Pointer to 3938 - 0x2D38 .text + UnwindInfo: .rdata |
| 627EC | 180003AE0 | .pdata | ExceptionHook | Pointer to 3AE0 - 0x2EE0 .text + UnwindInfo: .rdata |
| 627F8 | 180003C88 | .pdata | ExceptionHook | Pointer to 3C88 - 0x3088 .text + UnwindInfo: .rdata |
| 62804 | 180003E48 | .pdata | ExceptionHook | Pointer to 3E48 - 0x3248 .text + UnwindInfo: .rdata |
| 62810 | 180003ED0 | .pdata | ExceptionHook | Pointer to 3ED0 - 0x32D0 .text + UnwindInfo: .rdata |
| 6281C | 180004010 | .pdata | ExceptionHook | Pointer to 4010 - 0x3410 .text + UnwindInfo: .rdata |
| 62828 | 180004234 | .pdata | ExceptionHook | Pointer to 4234 - 0x3634 .text + UnwindInfo: .rdata |
| 62834 | 180004278 | .pdata | ExceptionHook | Pointer to 4278 - 0x3678 .text + UnwindInfo: .rdata |
| 62840 | 18000428C | .pdata | ExceptionHook | Pointer to 428C - 0x368C .text + UnwindInfo: .rdata |
| 6284C | 180004354 | .pdata | ExceptionHook | Pointer to 4354 - 0x3754 .text + UnwindInfo: .rdata |
| 62858 | 1800045EC | .pdata | ExceptionHook | Pointer to 45EC - 0x39EC .text + UnwindInfo: .rdata |
| 62864 | 18000485C | .pdata | ExceptionHook | Pointer to 485C - 0x3C5C .text + UnwindInfo: .rdata |
| 62870 | 180004B10 | .pdata | ExceptionHook | Pointer to 4B10 - 0x3F10 .text + UnwindInfo: .rdata |
| 6287C | 180004DC4 | .pdata | ExceptionHook | Pointer to 4DC4 - 0x41C4 .text + UnwindInfo: .rdata |
| 62888 | 180005030 | .pdata | ExceptionHook | Pointer to 5030 - 0x4430 .text + UnwindInfo: .rdata |
| 62894 | 18000529C | .pdata | ExceptionHook | Pointer to 529C - 0x469C .text + UnwindInfo: .rdata |
| 628A0 | 180005524 | .pdata | ExceptionHook | Pointer to 5524 - 0x4924 .text + UnwindInfo: .rdata |
| 628AC | 180005634 | .pdata | ExceptionHook | Pointer to 5634 - 0x4A34 .text + UnwindInfo: .rdata |
| 628B8 | 1800056B8 | .pdata | ExceptionHook | Pointer to 56B8 - 0x4AB8 .text + UnwindInfo: .rdata |
| 628C4 | 1800056EC | .pdata | ExceptionHook | Pointer to 56EC - 0x4AEC .text + UnwindInfo: .rdata |
| 628D0 | 180005720 | .pdata | ExceptionHook | Pointer to 5720 - 0x4B20 .text + UnwindInfo: .rdata |
| 628DC | 18000584C | .pdata | ExceptionHook | Pointer to 584C - 0x4C4C .text + UnwindInfo: .rdata |
| 628E8 | 180005A70 | .pdata | ExceptionHook | Pointer to 5A70 - 0x4E70 .text + UnwindInfo: .rdata |
| 628F4 | 180005C94 | .pdata | ExceptionHook | Pointer to 5C94 - 0x5094 .text + UnwindInfo: .rdata |
| 62900 | 180005EB8 | .pdata | ExceptionHook | Pointer to 5EB8 - 0x52B8 .text + UnwindInfo: .rdata |
| 6290C | 1800060DC | .pdata | ExceptionHook | Pointer to 60DC - 0x54DC .text + UnwindInfo: .rdata |
| 62918 | 1800060F8 | .pdata | ExceptionHook | Pointer to 60F8 - 0x54F8 .text + UnwindInfo: .rdata |
| 62924 | 180006114 | .pdata | ExceptionHook | Pointer to 6114 - 0x5514 .text + UnwindInfo: .rdata |
| 62930 | 180006130 | .pdata | ExceptionHook | Pointer to 6130 - 0x5530 .text + UnwindInfo: .rdata |
| 6293C | 180006144 | .pdata | ExceptionHook | Pointer to 6144 - 0x5544 .text + UnwindInfo: .rdata |
| 62948 | 180006368 | .pdata | ExceptionHook | Pointer to 6368 - 0x5768 .text + UnwindInfo: .rdata |
| 62954 | 180006410 | .pdata | ExceptionHook | Pointer to 6410 - 0x5810 .text + UnwindInfo: .rdata |
| 62960 | 180006554 | .pdata | ExceptionHook | Pointer to 6554 - 0x5954 .text + UnwindInfo: .rdata |
| 6296C | 180006748 | .pdata | ExceptionHook | Pointer to 6748 - 0x5B48 .text + UnwindInfo: .rdata |
| 62978 | 1800067FC | .pdata | ExceptionHook | Pointer to 67FC - 0x5BFC .text + UnwindInfo: .rdata |
| 62984 | 180006990 | .pdata | ExceptionHook | Pointer to 6990 - 0x5D90 .text + UnwindInfo: .rdata |
| 62990 | 180006A18 | .pdata | ExceptionHook | Pointer to 6A18 - 0x5E18 .text + UnwindInfo: .rdata |
| 6299C | 180006AC8 | .pdata | ExceptionHook | Pointer to 6AC8 - 0x5EC8 .text + UnwindInfo: .rdata |
| 629A8 | 180006C80 | .pdata | ExceptionHook | Pointer to 6C80 - 0x6080 .text + UnwindInfo: .rdata |
| 629B4 | 180006E90 | .pdata | ExceptionHook | Pointer to 6E90 - 0x6290 .text + UnwindInfo: .rdata |
| 629C0 | 180007190 | .pdata | ExceptionHook | Pointer to 7190 - 0x6590 .text + UnwindInfo: .rdata |
| 629CC | 1800071FC | .pdata | ExceptionHook | Pointer to 71FC - 0x65FC .text + UnwindInfo: .rdata |
| 629D8 | 180007290 | .pdata | ExceptionHook | Pointer to 7290 - 0x6690 .text + UnwindInfo: .rdata |
| 629E4 | 180007464 | .pdata | ExceptionHook | Pointer to 7464 - 0x6864 .text + UnwindInfo: .rdata |
| 629F0 | 180007514 | .pdata | ExceptionHook | Pointer to 7514 - 0x6914 .text + UnwindInfo: .rdata |
| 629FC | 1800077E8 | .pdata | ExceptionHook | Pointer to 77E8 - 0x6BE8 .text + UnwindInfo: .rdata |
| 62A08 | 180007A48 | .pdata | ExceptionHook | Pointer to 7A48 - 0x6E48 .text + UnwindInfo: .rdata |
| 62A14 | 180007C4C | .pdata | ExceptionHook | Pointer to 7C4C - 0x704C .text + UnwindInfo: .rdata |
| 62A20 | 180007F80 | .pdata | ExceptionHook | Pointer to 7F80 - 0x7380 .text + UnwindInfo: .rdata |
| 62A2C | 180007F90 | .pdata | ExceptionHook | Pointer to 7F90 - 0x7390 .text + UnwindInfo: .rdata |
| 62A38 | 180008588 | .pdata | ExceptionHook | Pointer to 8588 - 0x7988 .text + UnwindInfo: .rdata |
| 62A44 | 1800085FC | .pdata | ExceptionHook | Pointer to 85FC - 0x79FC .text + UnwindInfo: .rdata |
| 62A50 | 180008D20 | .pdata | ExceptionHook | Pointer to 8D20 - 0x8120 .text + UnwindInfo: .rdata |
| 62A5C | 180008D44 | .pdata | ExceptionHook | Pointer to 8D44 - 0x8144 .text + UnwindInfo: .rdata |
| 62A68 | 180008D94 | .pdata | ExceptionHook | Pointer to 8D94 - 0x8194 .text + UnwindInfo: .rdata |
| 62A74 | 180008DE0 | .pdata | ExceptionHook | Pointer to 8DE0 - 0x81E0 .text + UnwindInfo: .rdata |
| 62A80 | 180008F40 | .pdata | ExceptionHook | Pointer to 8F40 - 0x8340 .text + UnwindInfo: .rdata |
| 62A8C | 180008FAC | .pdata | ExceptionHook | Pointer to 8FAC - 0x83AC .text + UnwindInfo: .rdata |
| 62A98 | 180008FD4 | .pdata | ExceptionHook | Pointer to 8FD4 - 0x83D4 .text + UnwindInfo: .rdata |
| 62AA4 | 180009190 | .pdata | ExceptionHook | Pointer to 9190 - 0x8590 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 267444 | 64,6475% |
| Null Byte Code | 54569 | 13,1906% |
© 2026 All rights reserved.