PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 128,00 KBSHA-256 Hash: 546AC746B3D6FA930F370A838EB1F868EC105C3778988759D50E9B72FD98A668 SHA-1 Hash: 1A61FDC4FB4FCD00C3FE392ABBF17D1176693B2B MD5 Hash: 38233904D0A27B745DB81D350B904612 Imphash: 6A9240E9E6A010A6698EF0E9641439BB MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 6CD4 SizeOfHeaders: 400 SizeOfImage: 24000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: E498 IAT: 9000 Characteristics: 22 TimeDateStamp: 6974F06F Date: 24/01/2026 16:16:47 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 7600 | 1000 | 74F0 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
7A00 | 6800 | 9000 | 6720 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
E200 | 800 | 10000 | D78 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
EA00 | A00 | 11000 | 834 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
F400 | 10A00 | 12000 | 10890 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
1FE00 | 200 | 23000 | 130 |
|
|
| Description |
| OriginalFilename: varmanager_flutter.exe CompanyName: com.example LegalCopyright: Copyright (C) 2026 com.example. All rights reserved. ProductName: varManager FileVersion: 2.0.3+0 FileDescription: varManager ProductVersion: 2.0.3+0 Language: English (United States) (ID=0x409) CodePage: Western European (Windows 1252) (0x4E4) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 60D4 Code -> 4883EC28E8070800004883C428E97AFEFFFFCCCC4883EC28E8E70B000085C0742165488B042530000000488B4808EB05483B Assembler |SUB RSP, 0X28 |CALL 0X1400074E4 |ADD RSP, 0X28 |JMP 0X140006B60 |INT3 |INT3 |SUB RSP, 0X28 |CALL 0X1400078D8 |TEST EAX, EAX |JE 0X140006D16 |MOV RAX, QWORD PTR GS:[0X30] |MOV RCX, QWORD PTR [RAX + 8] |JMP 0X140006D09 |
| Signatures |
| Rich Signature Analyzer: Code -> F847910CBC26FF5FBC26FF5FBC26FF5FB55E6C5FB026FF5F3BAFFC5EBF26FF5F3BAFFB5EB626FF5F3BAFFE5EBA26FF5F3BAFFA5E9E26FF5FC5A7FE5EB126FF5FBC26FE5F1426FF5F2AAFFA5EB526FF5F2AAF005FBD26FF5FBC26685FBD26FF5F2AAFFD5EBD26FF5F52696368BC26FF5F Footprint md5 Hash -> 3444EC56CB7DE47D5DBCA117FE22E9FB • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.44**)[-] • Entropy: 7.2605 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| ADVAPI32.DLL | RegGetValueW | Reads data from a registry value. |
| Windows REG (UNICODE) |
| Software\Microsoft\Windows\CurrentVersion\Themes\Personalize |
| File Access |
| api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll VCRUNTIME140.dll VCRUNTIME140_1.dll MSVCP140.dll ADVAPI32.dll ole32.dll SHELL32.dll USER32.dll KERNEL32.dll dwmapi.dll flutter_windows.dll window_manager_plugin.dll screen_retriever_windows_plugin.dll file_selector_windows_plugin.dll .dat @.dat |
| File Access (UNICODE) |
| varmanager_flutter.exe KERNEL32.DLL \icudtl.dat |
| Interest's Words |
| exec attrib start systeminfo |
| URLs |
| http://schemas.microsoft.com/SMI/2016/WindowsSettings |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 12130 | 10017 | F530 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000080004944415478DAECBD778025D755 | .PNG........IHDR.............\r.f....IDATx...w.%.U |
| \GROUP_ICON\101\1033 | 22148 | 14 | 1F548 | 0000010001000000000001002000170001000100 | ............ ....... |
| \VERSION\1\1033 | 22160 | 310 | 1F560 | 100334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 22470 | 41A | 1F870 | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone |
| Intelligent String |
| • api-ms-win-crt-string-l1-1-0.dll • api-ms-win-crt-runtime-l1-1-0.dll • \icudtl.dat • User32.dll • file_selector_windows_plugin.dll • screen_retriever_windows_plugin.dll • window_manager_plugin.dll • flutter_windows.dll • KERNEL32.DLL • .tls • .bss • KERNEL32.dll • USER32.dll • ADVAPI32.dll • MSVCP140.dll • VCRUNTIME140_1.dll • VCRUNTIME140.dll • api-ms-win-crt-stdio-l1-1-0.dll • api-ms-win-crt-heap-l1-1-0.dll • api-ms-win-crt-math-l1-1-0.dll • api-ms-win-crt-locale-l1-1-0.dll • varmanager_flutter.exe • <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2</dpiAwareness></windowsSettings></application><ms_compatibility:compatibility xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" xmlns="urn:schemas-microsoft-com:compatibility.v1"><ms_compatibility:application xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1"><ms_compatibility:supportedOS xmlns:ms_compatibility="urn:schemas-microsoft-com:compatibility.v1" Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></ms_compatibility:supportedOS></ms_compatibility:application></ms_compatibility:compatibility></assembly> |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 43F | N/A | .text | CALL QWORD PTR [RIP+0x8313] |
| 86B | N/A | .text | CALL QWORD PTR [RIP+0x7EE7] |
| B65 | N/A | .text | CALL QWORD PTR [RIP+0xEEBD] |
| C77 | N/A | .text | CALL QWORD PTR [RIP+0x7ADB] |
| CD6 | N/A | .text | CALL QWORD PTR [RIP+0x7A7C] |
| DA6 | N/A | .text | CALL QWORD PTR [RIP+0x79AC] |
| E1C | N/A | .text | CALL QWORD PTR [RIP+0x7936] |
| 120D | N/A | .text | CALL QWORD PTR [RIP+0x7545] |
| 12E8 | N/A | .text | CALL QWORD PTR [RIP+0x746A] |
| 13C1 | N/A | .text | CALL QWORD PTR [RIP+0x7391] |
| 1441 | N/A | .text | CALL QWORD PTR [RIP+0x6FE1] |
| 144B | N/A | .text | CALL QWORD PTR [RIP+0x6FBF] |
| 1471 | N/A | .text | CALL QWORD PTR [RIP+0x6FA1] |
| 1764 | N/A | .text | CALL QWORD PTR [RIP+0x6CB6] |
| 1771 | N/A | .text | CALL QWORD PTR [RIP+0x70B9] |
| 190E | N/A | .text | CALL QWORD PTR [RIP+0x6E44] |
| 1961 | N/A | .text | CALL QWORD PTR [RIP+0x6C81] |
| 1975 | N/A | .text | CALL QWORD PTR [RIP+0x6C75] |
| 1980 | N/A | .text | CALL QWORD PTR [RIP+0x6C7A] |
| 1993 | N/A | .text | CALL QWORD PTR [RIP+0x6C4F] |
| 199D | N/A | .text | CALL QWORD PTR [RIP+0x6E85] |
| 1B05 | N/A | .text | CALL QWORD PTR [RIP+0x6C4D] |
| 1CD4 | N/A | .text | CALL QWORD PTR [RIP+0x676E] |
| 1CE7 | N/A | .text | CALL QWORD PTR [RIP+0x6AF3] |
| 1D03 | N/A | .text | CALL QWORD PTR [RIP+0x6ACF] |
| 1D12 | N/A | .text | CALL QWORD PTR [RIP+0x6AC8] |
| 1D1B | N/A | .text | CALL QWORD PTR [RIP+0x6AAF] |
| 1D28 | N/A | .text | CALL QWORD PTR [RIP+0x6A9A] |
| 1D33 | N/A | .text | CALL QWORD PTR [RIP+0x6AA7] |
| 1D4F | N/A | .text | CALL QWORD PTR [RIP+0x6A83] |
| 1D5E | N/A | .text | CALL QWORD PTR [RIP+0x6A7C] |
| 1D67 | N/A | .text | CALL QWORD PTR [RIP+0x6A63] |
| 1D74 | N/A | .text | CALL QWORD PTR [RIP+0x6A4E] |
| 1D7C | N/A | .text | CALL QWORD PTR [RIP+0x67C6] |
| 1D82 | N/A | .text | CALL QWORD PTR [RIP+0xDCB0] |
| 1DC1 | N/A | .text | CALL QWORD PTR [RIP+0x6669] |
| 1DCE | N/A | .text | CALL QWORD PTR [RIP+0x67EC] |
| 20DF | N/A | .text | CALL QWORD PTR [RIP+0x6353] |
| 212F | N/A | .text | CALL QWORD PTR [RIP+0x6623] |
| 2145 | N/A | .text | CALL QWORD PTR [RIP+0x660D] |
| 21D8 | N/A | .text | CALL QWORD PTR [RIP+0x6262] |
| 2252 | N/A | .text | CALL QWORD PTR [RIP+0x61E8] |
| 22B3 | N/A | .text | CALL QWORD PTR [RIP+0x649F] |
| 2433 | N/A | .text | CALL QWORD PTR [RIP+0x631F] |
| 259F | N/A | .text | CALL QWORD PTR [RIP+0x602B] |
| 25C4 | N/A | .text | CALL QWORD PTR [RIP+0x5E8E] |
| 25D7 | N/A | .text | CALL QWORD PTR [RIP+0x5FFB] |
| 2602 | N/A | .text | CALL QWORD PTR [RIP+0x6010] |
| 262D | N/A | .text | CALL QWORD PTR [RIP+0x5FC5] |
| 2636 | N/A | .text | CALL QWORD PTR [RIP+0xD404] |
| 2650 | N/A | .text | CALL QWORD PTR [RIP+0x5E02] |
| 26DD | N/A | .text | CALL QWORD PTR [RIP+0x5F45] |
| 2738 | N/A | .text | CALL QWORD PTR [RIP+0x5EF2] |
| 2784 | N/A | .text | CALL QWORD PTR [RIP+0x5E96] |
| 27AD | N/A | .text | CALL QWORD PTR [RIP+0x5EA5] |
| 281D | N/A | .text | CALL QWORD PTR [RIP+0x5DE5] |
| 285F | N/A | .text | CALL QWORD PTR [RIP+0x5DE3] |
| 2877 | N/A | .text | CALL QWORD PTR [RIP+0x5DD3] |
| 288B | N/A | .text | CALL QWORD PTR [RIP+0x5DC7] |
| 28C2 | N/A | .text | CALL QWORD PTR [RIP+0x5D78] |
| 28DF | N/A | .text | CALL QWORD PTR [RIP+0x5D4B] |
| 2927 | N/A | .text | CALL QWORD PTR [RIP+0x5CF3] |
| 2938 | N/A | .text | CALL QWORD PTR [RIP+0x5CD2] |
| 299A | N/A | .text | CALL QWORD PTR [RIP+0x5C40] |
| 29A9 | N/A | .text | CALL QWORD PTR [RIP+0x5CA9] |
| 29D6 | N/A | .text | CALL QWORD PTR [RIP+0x5C64] |
| 29E0 | N/A | .text | CALL QWORD PTR [RIP+0x5C6A] |
| 2A1D | N/A | .text | CALL QWORD PTR [RIP+0x5C15] |
| 2A7B | N/A | .text | CALL QWORD PTR [RIP+0x597F] |
| 2AA3 | N/A | .text | CALL QWORD PTR [RIP+0x5D6F] |
| 2AF3 | N/A | .text | CALL QWORD PTR [RIP+0x5B67] |
| 2B03 | N/A | .text | CALL QWORD PTR [RIP+0x595F] |
| 2B1B | N/A | .text | CALL QWORD PTR [RIP+0x593F] |
| 2B2E | N/A | .text | CALL QWORD PTR [RIP+0x591C] |
| 2B43 | N/A | .text | CALL QWORD PTR [RIP+0x5ABF] |
| 2B63 | N/A | .text | CALL QWORD PTR [RIP+0x5AFF] |
| 2C11 | N/A | .text | CALL QWORD PTR [RIP+0xCDF1] |
| 2C5F | N/A | .text | CALL QWORD PTR [RIP+0x5AF3] |
| 2CC6 | N/A | .text | CALL QWORD PTR [RIP+0xCE0C] |
| 2D14 | N/A | .text | CALL QWORD PTR [RIP+0x5A3E] |
| 2D85 | N/A | .text | CALL QWORD PTR [RIP+0xCD5D] |
| 2DD3 | N/A | .text | CALL QWORD PTR [RIP+0x597F] |
| 2E85 | N/A | .text | CALL QWORD PTR [RIP+0x5695] |
| 2E9A | N/A | .text | CALL QWORD PTR [RIP+0x5680] |
| 2EAF | N/A | .text | CALL QWORD PTR [RIP+0x566B] |
| 2ECF | N/A | .text | CALL QWORD PTR [RIP+0x56BB] |
| 2EF1 | N/A | .text | CALL QWORD PTR [RIP+0x5661] |
| 2F0B | N/A | .text | CALL QWORD PTR [RIP+0x5677] |
| 2F1E | N/A | .text | CALL QWORD PTR [RIP+0x55F4] |
| 2F2E | N/A | .text | CALL QWORD PTR [RIP+0x5624] |
| 2F59 | N/A | .text | CALL QWORD PTR [RIP+0x5601] |
| 2F7A | N/A | .text | CALL QWORD PTR [RIP+0x5610] |
| 2F8D | N/A | .text | CALL QWORD PTR [RIP+0x5605] |
| 2F99 | N/A | .text | CALL QWORD PTR [RIP+0x55D1] |
| 2FB6 | N/A | .text | CALL QWORD PTR [RIP+0x55D4] |
| 2FC5 | N/A | .text | CALL QWORD PTR [RIP+0x55AD] |
| 2FEA | N/A | .text | CALL QWORD PTR [RIP+0x55A0] |
| 2FFD | N/A | .text | CALL QWORD PTR [RIP+0x5595] |
| 3009 | N/A | .text | CALL QWORD PTR [RIP+0x5561] |
| 302F | N/A | .text | CALL QWORD PTR [RIP+0x5533] |
| EA00 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| EA0C | 140001070 | .pdata | ExceptionHook | Pointer to 1070 - 0x470 .text + UnwindInfo: .rdata |
| EA18 | 140001130 | .pdata | ExceptionHook | Pointer to 1130 - 0x530 .text + UnwindInfo: .rdata |
| EA24 | 140001220 | .pdata | ExceptionHook | Pointer to 1220 - 0x620 .text + UnwindInfo: .rdata |
| EA30 | 1400013C0 | .pdata | ExceptionHook | Pointer to 13C0 - 0x7C0 .text + UnwindInfo: .rdata |
| EA3C | 140001400 | .pdata | ExceptionHook | Pointer to 1400 - 0x800 .text + UnwindInfo: .rdata |
| EA48 | 140001490 | .pdata | ExceptionHook | Pointer to 1490 - 0x890 .text + UnwindInfo: .rdata |
| EA54 | 140001520 | .pdata | ExceptionHook | Pointer to 1520 - 0x920 .text + UnwindInfo: .rdata |
| EA60 | 1400015C0 | .pdata | ExceptionHook | Pointer to 15C0 - 0x9C0 .text + UnwindInfo: .rdata |
| EA6C | 1400015F0 | .pdata | ExceptionHook | Pointer to 15F0 - 0x9F0 .text + UnwindInfo: .rdata |
| EA78 | 1400016A0 | .pdata | ExceptionHook | Pointer to 16A0 - 0xAA0 .text + UnwindInfo: .rdata |
| EA84 | 1400017E0 | .pdata | ExceptionHook | Pointer to 17E0 - 0xBE0 .text + UnwindInfo: .rdata |
| EA90 | 140001860 | .pdata | ExceptionHook | Pointer to 1860 - 0xC60 .text + UnwindInfo: .rdata |
| EA9C | 1400018A0 | .pdata | ExceptionHook | Pointer to 18A0 - 0xCA0 .text + UnwindInfo: .rdata |
| EAA8 | 1400018F0 | .pdata | ExceptionHook | Pointer to 18F0 - 0xCF0 .text + UnwindInfo: .rdata |
| EAB4 | 140001910 | .pdata | ExceptionHook | Pointer to 1910 - 0xD10 .text + UnwindInfo: .rdata |
| EAC0 | 140001925 | .pdata | ExceptionHook | Pointer to 1925 - 0xD25 .text + UnwindInfo: .rdata |
| EACC | 140001960 | .pdata | ExceptionHook | Pointer to 1960 - 0xD60 .text + UnwindInfo: .rdata |
| EAD8 | 1400019B0 | .pdata | ExceptionHook | Pointer to 19B0 - 0xDB0 .text + UnwindInfo: .rdata |
| EAE4 | 140001A30 | .pdata | ExceptionHook | Pointer to 1A30 - 0xE30 .text + UnwindInfo: .rdata |
| EAF0 | 140001A50 | .pdata | ExceptionHook | Pointer to 1A50 - 0xE50 .text + UnwindInfo: .rdata |
| EAFC | 140001A90 | .pdata | ExceptionHook | Pointer to 1A90 - 0xE90 .text + UnwindInfo: .rdata |
| EB08 | 140001AD9 | .pdata | ExceptionHook | Pointer to 1AD9 - 0xED9 .text + UnwindInfo: .rdata |
| EB14 | 140001B9F | .pdata | ExceptionHook | Pointer to 1B9F - 0xF9F .text + UnwindInfo: .rdata |
| EB20 | 140001BA5 | .pdata | ExceptionHook | Pointer to 1BA5 - 0xFA5 .text + UnwindInfo: .rdata |
| EB2C | 140001BB0 | .pdata | ExceptionHook | Pointer to 1BB0 - 0xFB0 .text + UnwindInfo: .rdata |
| EB38 | 140001C20 | .pdata | ExceptionHook | Pointer to 1C20 - 0x1020 .text + UnwindInfo: .rdata |
| EB44 | 140001C54 | .pdata | ExceptionHook | Pointer to 1C54 - 0x1054 .text + UnwindInfo: .rdata |
| EB50 | 140001CA0 | .pdata | ExceptionHook | Pointer to 1CA0 - 0x10A0 .text + UnwindInfo: .rdata |
| EB5C | 140002010 | .pdata | ExceptionHook | Pointer to 2010 - 0x1410 .text + UnwindInfo: .rdata |
| EB68 | 1400021CB | .pdata | ExceptionHook | Pointer to 21CB - 0x15CB .text + UnwindInfo: .rdata |
| EB74 | 140002760 | .pdata | ExceptionHook | Pointer to 2760 - 0x1B60 .text + UnwindInfo: .rdata |
| EB80 | 1400028D0 | .pdata | ExceptionHook | Pointer to 28D0 - 0x1CD0 .text + UnwindInfo: .rdata |
| EB8C | 140002990 | .pdata | ExceptionHook | Pointer to 2990 - 0x1D90 .text + UnwindInfo: .rdata |
| EB98 | 140002D60 | .pdata | ExceptionHook | Pointer to 2D60 - 0x2160 .text + UnwindInfo: .rdata |
| EBA4 | 140002F00 | .pdata | ExceptionHook | Pointer to 2F00 - 0x2300 .text + UnwindInfo: .rdata |
| EBB0 | 140002F76 | .pdata | ExceptionHook | Pointer to 2F76 - 0x2376 .text + UnwindInfo: .rdata |
| EBBC | 140003062 | .pdata | ExceptionHook | Pointer to 3062 - 0x2462 .text + UnwindInfo: .rdata |
| EBC8 | 1400030B0 | .pdata | ExceptionHook | Pointer to 30B0 - 0x24B0 .text + UnwindInfo: .rdata |
| EBD4 | 1400030D0 | .pdata | ExceptionHook | Pointer to 30D0 - 0x24D0 .text + UnwindInfo: .rdata |
| EBE0 | 140003120 | .pdata | ExceptionHook | Pointer to 3120 - 0x2520 .text + UnwindInfo: .rdata |
| EBEC | 140003320 | .pdata | ExceptionHook | Pointer to 3320 - 0x2720 .text + UnwindInfo: .rdata |
| EBF8 | 1400033A0 | .pdata | ExceptionHook | Pointer to 33A0 - 0x27A0 .text + UnwindInfo: .rdata |
| EC04 | 1400033C0 | .pdata | ExceptionHook | Pointer to 33C0 - 0x27C0 .text + UnwindInfo: .rdata |
| EC10 | 140003570 | .pdata | ExceptionHook | Pointer to 3570 - 0x2970 .text + UnwindInfo: .rdata |
| EC1C | 140003610 | .pdata | ExceptionHook | Pointer to 3610 - 0x2A10 .text + UnwindInfo: .rdata |
| EC28 | 140003630 | .pdata | ExceptionHook | Pointer to 3630 - 0x2A30 .text + UnwindInfo: .rdata |
| EC34 | 1400036C0 | .pdata | ExceptionHook | Pointer to 36C0 - 0x2AC0 .text + UnwindInfo: .rdata |
| EC40 | 140003790 | .pdata | ExceptionHook | Pointer to 3790 - 0x2B90 .text + UnwindInfo: .rdata |
| EC4C | 140003A00 | .pdata | ExceptionHook | Pointer to 3A00 - 0x2E00 .text + UnwindInfo: .rdata |
| EC58 | 140003A50 | .pdata | ExceptionHook | Pointer to 3A50 - 0x2E50 .text + UnwindInfo: .rdata |
| EC64 | 140003CA0 | .pdata | ExceptionHook | Pointer to 3CA0 - 0x30A0 .text + UnwindInfo: .rdata |
| EC70 | 140003CE5 | .pdata | ExceptionHook | Pointer to 3CE5 - 0x30E5 .text + UnwindInfo: .rdata |
| EC7C | 140003D06 | .pdata | ExceptionHook | Pointer to 3D06 - 0x3106 .text + UnwindInfo: .rdata |
| EC88 | 140003D48 | .pdata | ExceptionHook | Pointer to 3D48 - 0x3148 .text + UnwindInfo: .rdata |
| EC94 | 140003D61 | .pdata | ExceptionHook | Pointer to 3D61 - 0x3161 .text + UnwindInfo: .rdata |
| ECA0 | 140003DEC | .pdata | ExceptionHook | Pointer to 3DEC - 0x31EC .text + UnwindInfo: .rdata |
| ECAC | 140003E06 | .pdata | ExceptionHook | Pointer to 3E06 - 0x3206 .text + UnwindInfo: .rdata |
| ECB8 | 140003E0C | .pdata | ExceptionHook | Pointer to 3E0C - 0x320C .text + UnwindInfo: .rdata |
| ECC4 | 140003E20 | .pdata | ExceptionHook | Pointer to 3E20 - 0x3220 .text + UnwindInfo: .rdata |
| ECD0 | 140003E60 | .pdata | ExceptionHook | Pointer to 3E60 - 0x3260 .text + UnwindInfo: .rdata |
| ECDC | 140004050 | .pdata | ExceptionHook | Pointer to 4050 - 0x3450 .text + UnwindInfo: .rdata |
| ECE8 | 1400040A0 | .pdata | ExceptionHook | Pointer to 40A0 - 0x34A0 .text + UnwindInfo: .rdata |
| ECF4 | 140004110 | .pdata | ExceptionHook | Pointer to 4110 - 0x3510 .text + UnwindInfo: .rdata |
| ED00 | 140004140 | .pdata | ExceptionHook | Pointer to 4140 - 0x3540 .text + UnwindInfo: .rdata |
| ED0C | 140004180 | .pdata | ExceptionHook | Pointer to 4180 - 0x3580 .text + UnwindInfo: .rdata |
| ED18 | 140004220 | .pdata | ExceptionHook | Pointer to 4220 - 0x3620 .text + UnwindInfo: .rdata |
| ED24 | 140004290 | .pdata | ExceptionHook | Pointer to 4290 - 0x3690 .text + UnwindInfo: .rdata |
| ED30 | 140004340 | .pdata | ExceptionHook | Pointer to 4340 - 0x3740 .text + UnwindInfo: .rdata |
| ED3C | 1400044C0 | .pdata | ExceptionHook | Pointer to 44C0 - 0x38C0 .text + UnwindInfo: .rdata |
| ED48 | 1400044CF | .pdata | ExceptionHook | Pointer to 44CF - 0x38CF .text + UnwindInfo: .rdata |
| ED54 | 140004505 | .pdata | ExceptionHook | Pointer to 4505 - 0x3905 .text + UnwindInfo: .rdata |
| ED60 | 140004510 | .pdata | ExceptionHook | Pointer to 4510 - 0x3910 .text + UnwindInfo: .rdata |
| ED6C | 140004540 | .pdata | ExceptionHook | Pointer to 4540 - 0x3940 .text + UnwindInfo: .rdata |
| ED78 | 140004570 | .pdata | ExceptionHook | Pointer to 4570 - 0x3970 .text + UnwindInfo: .rdata |
| ED84 | 14000457D | .pdata | ExceptionHook | Pointer to 457D - 0x397D .text + UnwindInfo: .rdata |
| ED90 | 1400045BA | .pdata | ExceptionHook | Pointer to 45BA - 0x39BA .text + UnwindInfo: .rdata |
| ED9C | 1400045F0 | .pdata | ExceptionHook | Pointer to 45F0 - 0x39F0 .text + UnwindInfo: .rdata |
| EDA8 | 140004600 | .pdata | ExceptionHook | Pointer to 4600 - 0x3A00 .text + UnwindInfo: .rdata |
| EDB4 | 140004630 | .pdata | ExceptionHook | Pointer to 4630 - 0x3A30 .text + UnwindInfo: .rdata |
| EDC0 | 1400046F0 | .pdata | ExceptionHook | Pointer to 46F0 - 0x3AF0 .text + UnwindInfo: .rdata |
| EDCC | 140004760 | .pdata | ExceptionHook | Pointer to 4760 - 0x3B60 .text + UnwindInfo: .rdata |
| EDD8 | 140004980 | .pdata | ExceptionHook | Pointer to 4980 - 0x3D80 .text + UnwindInfo: .rdata |
| EDE4 | 14000499A | .pdata | ExceptionHook | Pointer to 499A - 0x3D9A .text + UnwindInfo: .rdata |
| EDF0 | 140004A13 | .pdata | ExceptionHook | Pointer to 4A13 - 0x3E13 .text + UnwindInfo: .rdata |
| EDFC | 140004A20 | .pdata | ExceptionHook | Pointer to 4A20 - 0x3E20 .text + UnwindInfo: .rdata |
| EE08 | 140004BB0 | .pdata | ExceptionHook | Pointer to 4BB0 - 0x3FB0 .text + UnwindInfo: .rdata |
| EE14 | 140004C30 | .pdata | ExceptionHook | Pointer to 4C30 - 0x4030 .text + UnwindInfo: .rdata |
| EE20 | 140004C50 | .pdata | ExceptionHook | Pointer to 4C50 - 0x4050 .text + UnwindInfo: .rdata |
| EE2C | 140004C70 | .pdata | ExceptionHook | Pointer to 4C70 - 0x4070 .text + UnwindInfo: .rdata |
| EE38 | 140004CF0 | .pdata | ExceptionHook | Pointer to 4CF0 - 0x40F0 .text + UnwindInfo: .rdata |
| EE44 | 140004D60 | .pdata | ExceptionHook | Pointer to 4D60 - 0x4160 .text + UnwindInfo: .rdata |
| EE50 | 140004D90 | .pdata | ExceptionHook | Pointer to 4D90 - 0x4190 .text + UnwindInfo: .rdata |
| EE5C | 140004E00 | .pdata | ExceptionHook | Pointer to 4E00 - 0x4200 .text + UnwindInfo: .rdata |
| EE68 | 140004FE0 | .pdata | ExceptionHook | Pointer to 4FE0 - 0x43E0 .text + UnwindInfo: .rdata |
| EE74 | 140005130 | .pdata | ExceptionHook | Pointer to 5130 - 0x4530 .text + UnwindInfo: .rdata |
| EE80 | 1400052F0 | .pdata | ExceptionHook | Pointer to 52F0 - 0x46F0 .text + UnwindInfo: .rdata |
| EE8C | 1400052F6 | .pdata | ExceptionHook | Pointer to 52F6 - 0x46F6 .text + UnwindInfo: .rdata |
| EE98 | 14000530F | .pdata | ExceptionHook | Pointer to 530F - 0x470F .text + UnwindInfo: .rdata |
| EEA4 | 140005345 | .pdata | ExceptionHook | Pointer to 5345 - 0x4745 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 80948 | 61,7584% |
| Null Byte Code | 17500 | 13,3514% |
© 2026 All rights reserved.