PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 2,18 MBSHA-256 Hash: 5DF8DD0E2108F541E9AE564E9238E761A5E4FF13C461B4E5734798A8D72CC960 SHA-1 Hash: 776441A5C2999006A3B3F2B4D248B0E12FC927D2 MD5 Hash: 3CB1EFF35AEAB7CE8097A5ABBCCC7A99 Imphash: 95171B1F9B44557931F50B87C9370C1B MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00234095 EntryPoint (rva): DE073 SizeOfHeaders: 400 SizeOfImage: 230000 ImageBase: 400000 Architecture: x86 ImportTable: 1A49CC IAT: 13A000 Characteristics: 102 TimeDateStamp: 68FB3917 Date: 24/10/2025 8:30:15 File Type: EXE Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: requireAdministrator |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 138200 | 1000 | 1380D2 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
138600 | 6C400 | 13A000 | 6C2A2 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
1A4A00 | 2200 | 1A7000 | 5F98 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1A6C00 | 72400 | 1AD000 | 72360 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
219000 | F200 | 220000 | F0D0 |
|
|
| Description |
| OriginalFilename: 2m.exe CompanyName: Funplus.inc LegalCopyright: Copyright 2010-2025 Funplus.inc ProductName: Foundation Galactic Frontier FileVersion: 1.0.0.1 FileDescription: Foundation Galactic Frontier ProductVersion: 1.0.0.1 Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - DD473 Code -> E85A080000E97AFEFFFFCCCCCC568B4424140BC075288B4C24108B44240C33D2F7F18BD88B442408F7F18BF08BC3F7642410 Assembler |CALL 0X4DE8D2 |JMP 0X4DDEF7 |INT3 |INT3 |INT3 |PUSH ESI |MOV EAX, DWORD PTR [ESP + 0X14] |OR EAX, EAX |JNE 0X4DE0B1 |MOV ECX, DWORD PTR [ESP + 0X10] |MOV EAX, DWORD PTR [ESP + 0XC] |XOR EDX, EDX |DIV ECX |MOV EBX, EAX |MOV EAX, DWORD PTR [ESP + 8] |DIV ECX |MOV ESI, EAX |MOV EAX, EBX |MUL DWORD PTR [ESP + 0X10] |
| Signatures |
| Rich Signature Analyzer: Code -> CDF9790B899817588998175889981758C2E0145999981758C2E012594E981758C2E013599C9817584BED1359D89817584A1BEA588D9817584A1B1459909817584A1B13599D9817584A1B1259DA981758C2E016599C98175889981658AF99175834E41359719917589D1C12598C9817589D1C1359889817589D1CE85888981758899880588B9817589D1C1559889817585269636889981758 Footprint md5 Hash -> D3C58C715E5B1D0C60A73858E8F91504 • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Compiler: Microsoft Visual C ++ 6 DLL Detect It Easy (die) • PE: compiler: EP:Microsoft Visual C/C++(2017 v.15.5-6)[EXE32] • PE: compiler: Microsoft Visual C/C++(-)[-] • PE: linker: Microsoft Linker(14.40**)[-] • PE: Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 7.16087 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| ADVAPI32.DLL | CryptAcquireContextA | Acquires a cryptographic provider context. |
| ADVAPI32.DLL | CryptAcquireContextW | Acquires a cryptographic provider context. |
| ADVAPI32.DLL | CryptReleaseContext | Releases a cryptographic provider context. |
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | SleepEx | Pauses the execution of the current thread, optionally allowing the thread to be awakened by a kernel object or upon expiration of a timeout. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessA | Creates and starts a new process. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | WSAStartup | Initializes the Winsock networking library. |
| Ws2_32.DLL | bind | Associates a socket with a local address. |
| Ws2_32.DLL | listen | Puts a socket into listening mode. |
| Ws2_32.DLL | accept | Accepts an incoming network connection. |
| Ws2_32.DLL | recv | Receives data from a network socket. |
| Ws2_32.DLL | send | Sends data through a network socket. |
| ADVAPI32.DLL | CryptDecrypt | Performs a cryptographic operation on data in a data block. |
| ADVAPI32.DLL | RegCreateKeyExW | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| Windows REG (UNICODE) |
| Software\funplus.sdk SOFTWARE\Microsoft\Cryptography System\CentralProcessor\0 |
| File Access |
| //userplatform-download.akamaized.net/official-website/pc-launcher/foundation.exe //userplatform-download.akamaized.net/official-website/pc-launcher/dev/foundation.exe .exe bcrypt.dll CRYPT32.dll WS2_32.dll MSIMG32.dll gdiplus.dll ADVAPI32.dll ole32.dll GDI32.dll USER32.dll KERNEL32.dll secur32.dll security.dll iphlpapi.dll %s.dll .dat d.dat @.dat .txt Temp |
| File Access (UNICODE) |
| 2m.exe mscoree.dll %s.dllKERNEL32.DLL |
| Interest's Words |
| lockbit smtp Encrypt Decrypt Encryption PassWord exec attrib start pause cipher hostname shutdown systeminfo certreq ping expand replace route |
| URLs |
| http://ocsp.digicert.com http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl http://cacerts.digicert.com/DigiCertTrustedRootG4.crt http://crl3.digicert.com/DigiCertTrustedRootG4.crl http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://www.digicert.com/CPS0 http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt https://curl.se/docs/http-cookies.html https://curl.se/docs/alt-svc.html https://curl.se/docs/hsts.html https://logagent-global.kingsgroupgames.com/log https://userplatform-download.akamaized.net/official-website/pc-launcher/dev/foundation.exe https://userplatform-download.akamaized.net/official-website/pc-launcher/foundation.exe |
| IP Addresses |
| 127.0.0.1 2.5.29.17 2.5.4.11 2.5.4.12 2.5.4.13 2.5.4.17 2.5.4.41 2.5.4.42 2.5.4.43 2.5.4.44 2.5.4.45 2.5.4.46 2.5.4.65 2.5.4.72 2.5.29.18 2.5.29.19 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Unicode escape - \u00 - (Common Unicode escape sequences) |
| Text | Unicode | Encryption (Microsoft Enhanced Cryptographic Provider v1.0) |
| Text | Unicode | Encryption (Microsoft Enhanced RSA and AES Cryptographic Provider) |
| Text | Ascii | Encryption (Microsoft Unified Security Protocol Provider) |
| Hex | Hex Pattern | PEB AntiDebug (Flag BeingDebugged) |
| Text | Ascii | Information used to authenticate a user’s identity (Credential) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \PNG\BG\1033 | 20DFF0 | 10C53 | 207BF0 | 89504E470D0A1A0A0000000D4948445200000140000000700802000000E0FF3EE4000000017352474200AECE1CE900000044 | .PNG........IHDR...@...p.......>.....sRGB........D |
| \PNG\PB\1033 | 21EC48 | 102 | 218848 | 89504E470D0A1A0A0000000D49484452000000C00000000A08020000006DCDC682000000017352474200AECE1CE900000044 | .PNG........IHDR.............m.......sRGB........D |
| \PNG\PG\1033 | 21ED50 | C2 | 218950 | 89504E470D0A1A0A0000000D49484452000000570000000808020000000372F419000000017352474200AECE1CE900000044 | .PNG........IHDR...W..........r......sRGB........D |
| \SETUP\IDR_SETUP2\1033 | 21EE18 | 3BE | 218A18 | 7B0A202022636F6E666967223A207B0A202020202269735F646576223A2066616C73652C0A20202020226170705F6E616D65 | {. "config": {. "is_dev": false,. "app_name |
| \ICON\1\1033 | 1AD728 | 668 | 1A7328 | 2800000030000000600000000100040000000000800400000000000000000000000000000000000000000000000080000080 | (...0............................................ |
| \ICON\2\1033 | 1ADD90 | 2E8 | 1A7990 | 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\3\1033 | 1AE078 | 128 | 1A7C78 | 2800000010000000200000000100040000000000800000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \ICON\4\1033 | 1AE1A0 | 1812F | 1A7DA0 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000097048597300000EC300000EC301 | .PNG........IHDR.............\r.f....pHYs......... |
| \ICON\5\1033 | 1C62D0 | EA8 | 1BFED0 | 28000000300000006000000001000800000000000009000000000000000000000001000000010000000000000C0D18000C10 | (...0............................................ |
| \ICON\6\1033 | 1C7178 | 8A8 | 1C0D78 | 28000000200000004000000001000800000000000004000000000000000000000001000000010000000000000C0D18000E11 | (... ...@......................................... |
| \ICON\7\1033 | 1C7A20 | 568 | 1C1620 | 280000001000000020000000010008000000000000010000000000000000000000010000000100000000000013121D001F1F | (....... ......................................... |
| \ICON\8\1033 | 1C7F88 | 4250B | 1C1B88 | 89504E470D0A1A0A0000000D4948445200000200000002000806000000F478D4FA000000097048597300000EC300000EC301 | .PNG........IHDR..............x......pHYs......... |
| \ICON\9\1033 | 20A498 | 25A8 | 204098 | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\10\1033 | 20CA40 | 10A8 | 206640 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\11\1033 | 20DAE8 | 468 | 2076E8 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000573C305C6140 | (....... ..... .....@.......................W<0\a@ |
| \GROUP_ICON\IDI_ICON1\1033 | 20DF50 | A0 | 207B50 | 000001000B0030301000010004006806000001002020100001000400E8020000020010101000010004002801000003000000 | ......00......h..... ....................(....... |
| \VERSION\1\2052 | 1AD450 | 2D8 | 1A7050 | D80234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 21F1D8 | 188 | 218DD8 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • :060U00Uq]dL.g?O0U0E1-Q!m0U0y+m0k0$+0http://ocsp.digicert.com0C+07http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0EU>0<0:864http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0U • 1.0.0.1 • Kernel32.dll • invalid string: surrogate U+DC00..U+DFFF must follow U+D800..U+DBFFinvalid string: forbidden character after backslashinvalid string: control character U+0000 (NUL) must be escaped to \u0000 • invalid string: control character U+0001 (SOH) must be escaped to \u0001 • invalid string: control character U+0002 (STX) must be escaped to \u0002 • invalid string: control character U+0003 (ETX) must be escaped to \u0003 • invalid string: control character U+0004 (EOT) must be escaped to \u0004 • invalid string: control character U+0005 (ENQ) must be escaped to \u0005 • invalid string: control character U+0006 (ACK) must be escaped to \u0006 • invalid string: control character U+0007 (BEL) must be escaped to \u0007 • invalid string: control character U+0008 (BS) must be escaped to \u0008 or \b • invalid string: control character U+0009 (HT) must be escaped to \u0009 or \t • invalid string: control character U+000A (LF) must be escaped to \u000A or \n • invalid string: control character U+000B (VT) must be escaped to \u000Binvalid string: control character U+000C (FF) must be escaped to \u000C or \f • invalid string: control character U+000D (CR) must be escaped to \u000D or \r • invalid string: control character U+000E (SO) must be escaped to \u000Einvalid string: control character U+000F (SI) must be escaped to \u000Finvalid string: control character U+0010 (DLE) must be escaped to \u0010 • invalid string: control character U+0011 (DC1) must be escaped to \u0011 • invalid string: control character U+0012 (DC2) must be escaped to \u0012 • invalid string: control character U+0013 (DC3) must be escaped to \u0013 • invalid string: control character U+0014 (DC4) must be escaped to \u0014 • invalid string: control character U+0015 (NAK) must be escaped to \u0015 • invalid string: control character U+0016 (SYN) must be escaped to \u0016 • invalid string: control character U+0017 (ETB) must be escaped to \u0017 • invalid string: control character U+0018 (CAN) must be escaped to \u0018 • invalid string: control character U+0019 (EM) must be escaped to \u0019invalid string: control character U+001A (SUB) must be escaped to \u001A • invalid string: control character U+001B (ESC) must be escaped to \u001B • invalid string: control character U+001C (FS) must be escaped to \u001Cinvalid string: control character U+001D (GS) must be escaped to \u001Dinvalid string: control character U+001E (RS) must be escaped to \u001Einvalid string: control character U+001F (US) must be escaped to \u001Finvalid string: ill-formed UTF-8 byte • funplusSoftware\funplus.sdk • "is_login":0,"log_source":"pc","app_id":" • JOINT-ISO-ITU-Tjoint-iso-itu-tinternational-organizationsInternational OrganizationsmsSmartcardLogin • Microsoft Smartcard Login • D:\github\openssl\output\lib\engines-1_1 • C:\Program Files (x86)\Common Files\SSL • do_dumpdo_tcreate • CONF_dump_fp • NCONF_dump_bio • NCONF_dump_fp • cmd not executable • init failedinternal list errorinvalid cmd name • invalid cmd number • p.LgV • .dgV • .tgV • .DhV • .DiV • .LjV • .hjV • .xjV • .DlV • .dlV • .HmV • .lmV • .TnV • p.hnV • .pVm • .qVx • .cnf • %s.dll • KERNEL32.DLL • :%u[HEX DUMP]:00 • value.safesvalue.bag • d.crl • d.ori • %s%s.%s.tmp • https://curl.se/docs/http-cookies.html • .gif • .jpg • .png • .svg • .txt • .htm • application/pdf.xml • %s://%shttp • iphlpapi.dll • Your alt-svc cache. https://curl.se/docs/alt-svc.html • Your HSTS cache. https://curl.se/docs/hsts.html • Couldnt read a file:// file • Login denied • file://%s%s%s • machinelogin • security.dll • 2.5.29.17 • 2.5.4.11 • 2.5.4.12 • 2.5.4.13 • 2.5.4.17 • 2.5.4.41 • 2.5.4.42 • 2.5.4.43 • 2.5.4.44 • 2.5.4.45 • 2.5.4.46 • 2.5.4.65 • 2.5.4.72 • 2.5.29.18 • 2.5.29.19 • mscoree.dll • .exe • .cmd • .bat • .com • .tls • .bss • KERNEL32.dll • gdiplus.dll • WS2_32.dll • Funplus.inc • 2010-2025 Funplus.inc • 2m.exe |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 7C2 | 53A1F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 7CC | 53A1F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 7769 | 53A1F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 7773 | 53A1F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 854C | 53A0E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 855F | 53A1F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 856C | 53A1F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 8585 | 53A1F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 858C | 53A1F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 8DDE | 53A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 8DEA | 53A1CC | .text | CALL [static] | Indirect call to absolute memory address |
| 8E7F | 53A1EC | .text | CALL [static] | Indirect call to absolute memory address |
| 8E89 | 53A2A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 8ECC | 53A1EC | .text | CALL [static] | Indirect call to absolute memory address |
| B1F0 | 53A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| B1FC | 53A1CC | .text | CALL [static] | Indirect call to absolute memory address |
| B232 | 53A1BC | .text | CALL [static] | Indirect call to absolute memory address |
| B241 | 53A1C0 | .text | CALL [static] | Indirect call to absolute memory address |
| B251 | 53A1C8 | .text | CALL [static] | Indirect call to absolute memory address |
| B25E | 53A1C4 | .text | CALL [static] | Indirect call to absolute memory address |
| B2AE | 53A1D8 | .text | CALL [static] | Indirect call to absolute memory address |
| F017 | 53A35C | .text | CALL [static] | Indirect call to absolute memory address |
| F040 | 53A1D4 | .text | CALL [static] | Indirect call to absolute memory address |
| F45E | 53A1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| F464 | 53A2A8 | .text | CALL [static] | Indirect call to absolute memory address |
| F6BE | 53A2B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1005A | 53A1B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 10069 | 53A2B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 100C5 | 53A1DC | .text | CALL [static] | Indirect call to absolute memory address |
| 154E2 | 53A018 | .text | CALL [static] | Indirect call to absolute memory address |
| 15521 | 53A01C | .text | CALL [static] | Indirect call to absolute memory address |
| 155D1 | 53A01C | .text | CALL [static] | Indirect call to absolute memory address |
| 156C5 | 53A010 | .text | CALL [static] | Indirect call to absolute memory address |
| 16629 | 53A1E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 16A21 | 53A150 | .text | CALL [static] | Indirect call to absolute memory address |
| 16A4B | 53A150 | .text | CALL [static] | Indirect call to absolute memory address |
| 16DC6 | 53A018 | .text | CALL [static] | Indirect call to absolute memory address |
| 16DE8 | 53A01C | .text | CALL [static] | Indirect call to absolute memory address |
| 16E20 | 53A01C | .text | CALL [static] | Indirect call to absolute memory address |
| 16F91 | 53A010 | .text | CALL [static] | Indirect call to absolute memory address |
| 175F7 | 53A014 | .text | CALL [static] | Indirect call to absolute memory address |
| 1799F | 53A058 | .text | CALL [static] | Indirect call to absolute memory address |
| 179AB | 53A010 | .text | CALL [static] | Indirect call to absolute memory address |
| 17D64 | 53A14C | .text | CALL [static] | Indirect call to absolute memory address |
| 17D78 | 53A1CC | .text | CALL [static] | Indirect call to absolute memory address |
| 184D5 | 53A018 | .text | CALL [static] | Indirect call to absolute memory address |
| 186AD | 53A010 | .text | CALL [static] | Indirect call to absolute memory address |
| 18827 | 53A010 | .text | CALL [static] | Indirect call to absolute memory address |
| 18BBF | 53A010 | .text | CALL [static] | Indirect call to absolute memory address |
| 18DBB | 53A010 | .text | CALL [static] | Indirect call to absolute memory address |
| 19447 | 53A154 | .text | CALL [static] | Indirect call to absolute memory address |
| 19455 | 53A148 | .text | CALL [static] | Indirect call to absolute memory address |
| 199B4 | 53A0B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 19C53 | 53A0BC | .text | CALL [static] | Indirect call to absolute memory address |
| 19DD5 | 53A0B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 19FF8 | 53A328 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A02E | 53A0C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A069 | 53A32C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A0E2 | 53A0D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A0EE | 53A0CC | .text | CALL [static] | Indirect call to absolute memory address |
| 1A0F9 | 53A0C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A121 | 53A0C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A156 | 53A334 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A15D | 53A0E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A3B7 | 53A0D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A3C4 | 53A0CC | .text | CALL [static] | Indirect call to absolute memory address |
| 1A3F6 | 53A0B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A440 | 53A0CC | .text | CALL [static] | Indirect call to absolute memory address |
| 1A460 | 53A0E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A48C | 53A36C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A4AD | 53A350 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A4C0 | 53A370 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A4D1 | 53A370 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A5B3 | 53A0CC | .text | CALL [static] | Indirect call to absolute memory address |
| 1A5C3 | 53A0E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A5D8 | 53A0E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A5EC | 53A37C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A726 | 53A0CC | .text | CALL [static] | Indirect call to absolute memory address |
| 1A736 | 53A0E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A74B | 53A0E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A75F | 53A37C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A76D | 53A0D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A778 | 53A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A788 | 53A34C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A795 | 53A368 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A7D4 | 53A364 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A7F9 | 53A33C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A802 | 53A0D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A80E | 53A340 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A825 | 53A0BC | .text | CALL [static] | Indirect call to absolute memory address |
| 1A84E | 53A0CC | .text | CALL [static] | Indirect call to absolute memory address |
| 1A866 | 53A348 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A871 | 53A344 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A8CF | 53A358 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A8DD | 53A360 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A93C | 53A1A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A950 | 53A1C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A963 | 53A1C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A972 | 53A1C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A999 | 53A140 | .text | CALL [static] | Indirect call to absolute memory address |
| 228200 | N/A | *Overlay* | 80510000000202003082516E06092A864886F70D | .Q......0.Qn..*.H... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1446436 | 63,3744% |
| Null Byte Code | 267559 | 11,7229% |
© 2026 All rights reserved.