PESCAN.IO - Analysis Report Basic |
|||||
| File Structure |
|
| Information |
Icon: Size: 5,75 MBSHA-256 Hash: 244A024FA29FAD26065488E58EC76B3BDAC2295C884B6A92154F85F2B2C3F0AB SHA-1 Hash: 9D064812DC275D677B2B262462846D227056E799 MD5 Hash: 5669901F5844971E7F1EDF96A1C25F66 Imphash: E569E6F445D32BA23766AD67D1E3787F MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 005C66FD EntryPoint (rva): B5EEC SizeOfHeaders: 400 SizeOfImage: DF000 ImageBase: 400000 Architecture: x86 ExportTable: C4000 ImportTable: C2000 Characteristics: 818F TimeDateStamp: 63ECF218 Date: 15/02/2023 14:54:16 File Type: EXE Number Of Sections: 10 ASLR: Enabled Section Names: .text, .itext, .data, .bss, .idata, .didata, .edata, .tls, .rdata, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize |
|---|---|---|---|---|---|
| .text | 60000020 (Executable) | 400 | B3A00 | 1000 | B39E4 |
| .itext | 60000020 (Executable) | B3E00 | 1800 | B5000 | 1688 |
| .data | C0000040 (Writeable) | B5600 | 3800 | B7000 | 37A4 |
| .bss | C0000000 (Writeable) | 0 | 0 | BB000 | 6DE8 |
| .idata | C0000040 (Writeable) | B8E00 | 1000 | C2000 | FDC |
| .didata | C0000040 (Writeable) | B9E00 | 200 | C3000 | 1A4 |
| .edata | 40000040 | BA000 | 200 | C4000 | 9A |
| .tls | C0000000 (Writeable) | 0 | 0 | C5000 | 18 |
| .rdata | 40000040 | BA200 | 200 | C6000 | 5D |
| .rsrc | 40000040 | BA400 | 17200 | C7000 | 171CC |
| Description |
| CompanyName: Crystal Dew World LegalCopyright: Crystal Dew World ProductName: CrystalDiskInfo 9.7.2 FileVersion: 9.7.2 FileDescription: CrystalDiskInfo Setup ProductVersion: 9.7.2 Comments: This installation was built with Inno Setup. Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 4,87 MB |
| Entry Point |
| The section number (2) - (.itext) have the Entry Point Information -> EntryPoint (calculated) - B4CEC Code -> 558BEC83C4A453565733C08945C48945C08945A48945D08945C88945CC8945D48945D88945ECB8B8144B00E8B072F5FF33C0 • PUSH EBP • MOV EBP, ESP • ADD ESP, -0X5C • PUSH EBX • PUSH ESI • PUSH EDI • XOR EAX, EAX • MOV DWORD PTR [EBP - 0X3C], EAX • MOV DWORD PTR [EBP - 0X40], EAX • MOV DWORD PTR [EBP - 0X5C], EAX • MOV DWORD PTR [EBP - 0X30], EAX • MOV DWORD PTR [EBP - 0X38], EAX • MOV DWORD PTR [EBP - 0X34], EAX • MOV DWORD PTR [EBP - 0X2C], EAX • MOV DWORD PTR [EBP - 0X28], EAX • MOV DWORD PTR [EBP - 0X14], EAX • MOV EAX, 0X4B14B8 • CALL 0XFFF582E0 • XOR EAX, EAX |
| Signatures |
| Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Detect It Easy (die) • PE: installer: Inno Setup Module(6.1.0)[unicode] • PE: compiler: Embarcadero Delphi(10.3 Rio)[-] • PE: linker: Turbo Linker(2.25*,Delphi)[-] • PE: overlay: Inno Setup Installer data(-)[-] • Entropy: 7.93054 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| Windows REG (UNICODE) |
| Software\Embarcadero\Locales Software\CodeGear\Locales Software\Borland\Locales Software\Borland\Delphi\Locales |
| File Access |
| SetupLdr.exe kernel32.dll user32.dll advapi32.dll netapi32.dll oleaut32.dll version.dll comctl32.dll .Wsf dSystem.Sys System.Sys Int64EmSystem.SysUtilsSystemSystem.Internal.ExcUtilsSystem.Sys Int64EmSystem.Sys System.Sys ?System.Sys Temp |
| File Access (UNICODE) |
| kernel32.dll GetLogicalProcessorInformationkernel32.dll NTDLL.DLL oleaut32.dll uxtheme.dll userenv.dll setupapi.dll apphelp.dll propsys.dll dwmapi.dll cryptbase.dll oleacc.dll version.dll profapi.dll comres.dll clbcatq.dll ntmarta.dll shell32.dll Temp UserProfile |
| Interest's Words |
| PADDINGX PassWord exec attrib start shutdown systeminfo ping expand |
| Interest's Words (UNICODE) |
| PassWord exec start shutdown ping expand |
| URLs |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings http://ocsp.globalsign.com/codesigningrootr450F http://secure.globalsign.com/cacert/codesigningrootr45.crt http://crl.globalsign.com/codesigningrootr45.crl http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt http://ocsp.globalsign.com/gsgccr45evcodesignca20200U http://crl.globalsign.com/gsgccr45evcodesignca2020.crl http://ocsp.globalsign.com/ca/gstsacasha384g40C http://secure.globalsign.com/cacert/gstsacasha384g4.crt http://crl.globalsign.com/ca/gstsacasha384g4.crl http://ocsp2.globalsign.com/rootr606 http://crl.globalsign.com/root-r6.crl https://www.globalsign.com/repository/ https://www.globalsign.com/repository/0 |
| URLs (UNICODE) |
| https://jrsoftware.org/ishelp/index.php?topic=setupcmdline |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | WinAPI Sockets (accept) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Text | Ascii | Process of gathering information about network resources (Enumeration) |
| Text | Ascii | Malware that monitors and collects user data (Spy) |
| Text | Unicode | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Text | Ascii | Technique used to capture communications between systems (Intercept) |
| Entry Point | Hex Pattern | Borland Delphi 4.0 |
| Entry Point | Hex Pattern | fasm -> Tomasz Grysztar |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\100\1033 | C75E8 | 668 | BA9E8 | 2800000030000000600000000100040000000000800400000000000000000000000000000000000000000000000080000080 | (...0............................................ |
| \ICON\101\1033 | C7C50 | 2E8 | BB050 | 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\102\1033 | C7F38 | 128 | BB338 | 2800000010000000200000000100040000000000800000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \ICON\103\1033 | C8060 | EA8 | BB460 | 2800000030000000600000000100080000000000000900000000000000000000000100000001000000000000161617001D1D | (...0............................................ |
| \ICON\104\1033 | C8F08 | 8A8 | BC308 | 28000000200000004000000001000800000000000004000000000000000000000001000000010000000000004B4A49005051 | (... ...@...................................KJI.PQ |
| \ICON\105\1033 | C97B0 | 568 | BCBB0 | 280000001000000020000000010008000000000000010000000000000000000000010000000100000000000049494B005B5B | (....... ...................................IIK.[[ |
| \ICON\106\1033 | C9D18 | D9D2 | BD118 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A8660000200049444154789CECBD79AC2CD97D | .PNG........IHDR.............\r.f.. .IDATx...y.,.} |
| \ICON\107\1033 | D76EC | 25A8 | CAAEC | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\108\1033 | D9C94 | 10A8 | CD094 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\109\1033 | DAD3C | 468 | CE13C | 28000000100000002000000001002000000000004004000000000000000000000000000000000000000000FF7E7E7EFF7E7E | (....... ..... .....@.......................~~~.~~ |
| \STRING\4086\0 | DB1A4 | 360 | CE5A4 | 0B00570069006E0064006F0077007300200038002E0031000A00570069006E0064006F007700730020003100300019004F00 | ..W.i.n.d.o.w.s. .8...1...W.i.n.d.o.w.s. .1.0...O. |
| \STRING\4087\0 | DB504 | 260 | CE904 | 3A00250073002000530065007200760069006300650020005000610063006B002000250034003A0064002000280056006500 | :.%.s. .S.e.r.v.i.c.e. .P.a.c.k. .%.4.:.d. .(.V.e. |
| \STRING\4088\0 | DB764 | 45C | CEB64 | 1500500072006F0070006500720074007900200069007300200072006500610064002D006F006E006C007900170025007300 | ..P.r.o.p.e.r.t.y. .i.s. .r.e.a.d.-.o.n.l.y...%.s. |
| \STRING\4089\0 | DBBC0 | 40C | CEFC0 | 1A00430061006E006E006F0074002000610073007300690067006E0020006100200025007300200074006F00200061002000 | ..C.a.n.n.o.t. .a.s.s.i.g.n. .a. .%.s. .t.o. .a. . |
| \STRING\4090\0 | DBFCC | 2D4 | CF3CC | 06004D006F006E006400610079000700540075006500730064006100790009005700650064006E0065007300640061007900 | ..M.o.n.d.a.y...T.u.e.s.d.a.y...W.e.d.n.e.s.d.a.y. |
| \STRING\4091\0 | DC2A0 | B8 | CF6A0 | 03004D006100790004004A0075006E00650004004A0075006C00790006004100750067007500730074000900530065007000 | ..M.a.y...J.u.n.e...J.u.l.y...A.u.g.u.s.t...S.e.p. |
| \STRING\4092\0 | DC358 | 9C | CF758 | 03004A0061006E00030046006500620003004D0061007200030041007000720003004D006100790003004A0075006E000300 | ..J.a.n...F.e.b...M.a.r...A.p.r...M.a.y...J.u.n... |
| \STRING\4093\0 | DC3F4 | 374 | CF7F4 | 140049006E00760061006C00690064002000760061007200690061006E0074002000740079007000650017004F0070006500 | ..I.n.v.a.l.i.d. .v.a.r.i.a.n.t. .t.y.p.e...O.p.e. |
| \STRING\4094\0 | DC768 | 398 | CFB68 | 2200560061007200690061006E00740020006D006500740068006F0064002000630061006C006C00730020006E006F007400 | ".V.a.r.i.a.n.t. .m.e.t.h.o.d. .c.a.l.l.s. .n.o.t. |
| \STRING\4095\0 | DCB00 | 368 | CFF00 | 200049006E00760061006C0069006400200066006C006F006100740069006E006700200070006F0069006E00740020006F00 | .I.n.v.a.l.i.d. .f.l.o.a.t.i.n.g. .p.o.i.n.t. .o. |
| \STRING\4096\0 | DCE68 | 2A4 | D0268 | 2100270025007300270020006900730020006E006F007400200061002000760061006C0069006400200069006E0074006500 | !.'.%.s.'. .i.s. .n.o.t. .a. .v.a.l.i.d. .i.n.t.e. |
| \RCDATA\DVCLAL\0 | DD10C | 10 | D050C | A28CDF987B3C3A7926713F090F2A2517 | ....{<:y&q?..*%. |
| \RCDATA\PACKAGEINFO\0 | DD11C | 2C4 | D051C | 000010CC000000002F000000010A53657475704C64720010574D4435000081537973496E69740000C753797374656D001C0F | ......../.....SetupLdr..WMD5...SysInit...System... |
| \RCDATA\11111\0 | DD3E0 | 2C | D07E0 | 72446C507453CDE6D77B0B2A010000002C9D5B0037214E00B00D3100C626F621C8EF4A0000160D0069E95CDF | rDlPtS...{.*....,.[.7!N...1..&.!..J.....i.\. |
| \GROUP_ICON\MAINICON\1033 | DD40C | 92 | D080C | 000001000A0030301000010004006806000064002020100001000400E8020000650010101000010004002801000066003030 | ......00......h...d. ..........e.........(...f.00 |
| \VERSION\1\1033 | DD4A0 | 584 | D08A0 | 840534000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000700 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | DDA24 | 7A8 | D0E24 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • kernel32.dll • version.dll • .tmp • oleaut32.dll • .bss • @.tls • NTDLL.DLL • x:\dirname" • For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline • uxtheme.dll • userenv.dll • setupapi.dll • apphelp.dll • propsys.dll • dwmapi.dll • cryptbase.dll • oleacc.dll • profapi.dll • comres.dll • clbcatq.dll • ntmarta.dll • shell32.dll • GetThreadLocalecomctl32.dll • SafeArrayCreatenetapi32.dll • advapi32.dll • user32.dll • MessageBoxAkernel32.dll • <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware> • q.wCo |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| BB3 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| BBB | N/A | .text | CALL DWORD PTR [EAX+1Ah] | Displacement form |
| BFB | 4200401C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A40 | 4C2300 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A48 | 4C2328 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A50 | 4C2440 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A58 | 4C2414 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A60 | 4C23F8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A68 | 4C23B4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A70 | 4C2394 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A78 | 4C23D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A80 | 4C2448 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A88 | 4C2350 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A90 | 4C2380 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2A98 | 4C236C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AA0 | 4C2444 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AA8 | 4C2314 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AB0 | 4C2364 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AB8 | 4C2320 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AC0 | 4C2384 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AC8 | 4C2340 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AD0 | 4C2330 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AD8 | 4C24D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AE0 | 4C23D0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AE8 | 4C2344 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AF0 | 4C232C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AF8 | 4C23D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B00 | 4C23AC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B08 | 4C2378 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B10 | 4C22F4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B18 | 4C2418 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B20 | 4C2410 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B28 | 4C2428 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B30 | 4C23FC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B38 | 4C2464 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B40 | 4C247C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B48 | 4C2458 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B50 | 4C24CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B58 | 4C2354 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B80 | 4C3094 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B88 | 4C2538 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B90 | 4C2540 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B98 | 4C2524 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BA0 | 4C2360 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BA8 | 4C23CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BB0 | 4C23A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BB8 | 4C2404 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BC0 | 4C2388 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BC8 | 4C24E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BD0 | 4C2504 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BD8 | 4C2500 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BE0 | 4C2400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C08 | 4C3090 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C3C | 4C23C8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C44 | 4C230C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C4C | 4C2390 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C54 | 4C2440 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2FBA | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 31B2 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 3AC8 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 449C | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 47DC | 4B776C | .text | CALL [static] | Indirect call to absolute memory address |
| 47F4 | 4B7760 | .text | CALL [static] | Indirect call to absolute memory address |
| 4810 | 4B7764 | .text | CALL [static] | Indirect call to absolute memory address |
| 4831 | 4B7768 | .text | CALL [static] | Indirect call to absolute memory address |
| 484A | 4B7764 | .text | CALL [static] | Indirect call to absolute memory address |
| 4863 | 4B7760 | .text | CALL [static] | Indirect call to absolute memory address |
| 48D7 | 4BB028 | .text | CALL [static] | Indirect call to absolute memory address |
| 4916 | 4BB010 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B03 | 4B7040 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B21 | 4B703C | .text | CALL [static] | Indirect call to absolute memory address |
| 4BC0 | 4BB03C | .text | CALL [static] | Indirect call to absolute memory address |
| 4F90 | N/A | .text | CALL DWORD PTR [ESI-73h] | Displacement form |
| 4FBE | FFC0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 50F0 | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 56EE | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 5B84 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 5CC5 | N/A | .text | CALL DWORD PTR [EBP+4h] | Displacement form |
| 5D77 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 5FD5 | N/A | .text | CALL DWORD PTR [EDI+10h] | Displacement form |
| 600E | N/A | .text | CALL DWORD PTR [EBX+Ch] | Displacement form |
| 6098 | 4BB01C | .text | CALL [static] | Indirect call to absolute memory address |
| 60B6 | 4BB01C | .text | CALL [static] | Indirect call to absolute memory address |
| 60CE | 4BB01C | .text | CALL [static] | Indirect call to absolute memory address |
| 6134 | N/A | .text | CALL DWORD PTR [ECX+54h] | Displacement form |
| 6140 | 4BB01C | .text | CALL [static] | Indirect call to absolute memory address |
| 6160 | 4BB01C | .text | CALL [static] | Indirect call to absolute memory address |
| 617D | 4BB01C | .text | CALL [static] | Indirect call to absolute memory address |
| 625A | 4BB020 | .text | CALL [static] | Indirect call to absolute memory address |
| 635F | 4BB018 | .text | CALL [static] | Indirect call to absolute memory address |
| 63E2 | 4BB020 | .text | CALL [static] | Indirect call to absolute memory address |
| 6582 | 4BB01C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6708 | 4BB020 | .text | CALL [static] | Indirect call to absolute memory address |
| 6ADB | 4BB35C | .text | CALL [static] | Indirect call to absolute memory address |
| 6C3A | N/A | .text | CALL DWORD PTR [ESI+24h] | Displacement form |
| 6C58 | 4BB038 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D01 | 4B7034 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D66 | 4B7038 | .text | CALL [static] | Indirect call to absolute memory address |
| 703C | N/A | .text | CALL DWORD PTR [EAX-7Dh] | Displacement form |
| 70E0 | N/A | .text | CALL DWORD PTR [EAX-7Dh] | Displacement form |
| 728A | N/A | .text | CALL DWORD PTR [ECX+52h] | Displacement form |
| 80F9 | 4B7010 | .text | CALL [static] | Indirect call to absolute memory address |
| 8265 | 4B7014 | .text | CALL [static] | Indirect call to absolute memory address |
| 8348 | 4B7018 | .text | CALL [static] | Indirect call to absolute memory address |
| 9667 | FF | .text | JMP [static] | Indirect jump to absolute memory address |
| 9A9B | 4BDC00 | .text | CALL [static] | Indirect call to absolute memory address |
| 9AB8 | 4BDC00 | .text | CALL [static] | Indirect call to absolute memory address |
| 9AD9 | 4BDC08 | .text | CALL [static] | Indirect call to absolute memory address |
| 9B37 | 4BDC04 | .text | CALL [static] | Indirect call to absolute memory address |
| 9B94 | 4BDC04 | .text | CALL [static] | Indirect call to absolute memory address |
| 9BC7 | 4BDC04 | .text | CALL [static] | Indirect call to absolute memory address |
| 9D30 | N/A | .text | CALL DWORD PTR [EBX+56h] | Displacement form |
| 9D6B | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 9F20 | N/A | .text | CALL DWORD PTR [EBX-75h] | Displacement form |
| A06E | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| A099 | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| A66C | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| A7BA | N/A | .text | CALL DWORD PTR [EBX+4h] | Displacement form |
| A89D | N/A | .text | CALL DWORD PTR [EAX+4h] | Displacement form |
| A8AD | N/A | .text | CALL DWORD PTR [EAX+8h] | Displacement form |
| A8C7 | N/A | .text | CALL DWORD PTR [EDI-77h] | Displacement form |
| A8D2 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| A8E8 | N/A | .text | CALL DWORD PTR [EAX+8h] | Displacement form |
| A8F7 | N/A | .text | CALL DWORD PTR [EAX+4h] | Displacement form |
| BA8D | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| BFB0 | 4C2330 | .text | JMP [static] | Indirect jump to absolute memory address |
| BFB8 | 4C232C | .text | JMP [static] | Indirect jump to absolute memory address |
| BFC0 | 4C246C | .text | JMP [static] | Indirect jump to absolute memory address |
| BFC8 | 4C22FC | .text | JMP [static] | Indirect jump to absolute memory address |
| BFD0 | 4C244C | .text | JMP [static] | Indirect jump to absolute memory address |
| BFD8 | 4C245C | .text | JMP [static] | Indirect jump to absolute memory address |
| BFE0 | 4C2340 | .text | JMP [static] | Indirect jump to absolute memory address |
| BFE8 | 4C2358 | .text | JMP [static] | Indirect jump to absolute memory address |
| BFF0 | 4C2364 | .text | JMP [static] | Indirect jump to absolute memory address |
| BFF8 | 4C23D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| C000 | 4B7C1C | .text | JMP [static] | Indirect jump to absolute memory address |
| C73D | 4BE640 | .text | CALL [static] | Indirect call to absolute memory address |
| C765 | 4BE640 | .text | CALL [static] | Indirect call to absolute memory address |
| C797 | 4BE644 | .text | CALL [static] | Indirect call to absolute memory address |
| C824 | 4BE640 | .text | CALL [static] | Indirect call to absolute memory address |
| C896 | 4BE644 | .text | CALL [static] | Indirect call to absolute memory address |
| C8E4 | 4BE640 | .text | CALL [static] | Indirect call to absolute memory address |
| D371 | N/A | .text | CALL DWORD PTR [EDX+28h] | Displacement form |
| D468 | 4C2530 | .text | JMP [static] | Indirect jump to absolute memory address |
| D470 | 4C252C | .text | JMP [static] | Indirect jump to absolute memory address |
| D478 | 4C2534 | .text | JMP [static] | Indirect jump to absolute memory address |
| D480 | 4C253C | .text | JMP [static] | Indirect jump to absolute memory address |
| D488 | 4C2538 | .text | JMP [static] | Indirect jump to absolute memory address |
| D490 | 4C2540 | .text | JMP [static] | Indirect jump to absolute memory address |
| D498 | 4C2524 | .text | JMP [static] | Indirect jump to absolute memory address |
| D4A0 | 4C2300 | .text | JMP [static] | Indirect jump to absolute memory address |
| D4A8 | 4C2354 | .text | JMP [static] | Indirect jump to absolute memory address |
| D4B0 | 4C2354 | .text | JMP [static] | Indirect jump to absolute memory address |
| D4C8 | 4C2460 | .text | JMP [static] | Indirect jump to absolute memory address |
| D4D0 | 4C2478 | .text | JMP [static] | Indirect jump to absolute memory address |
| D4D8 | 4C2424 | .text | JMP [static] | Indirect jump to absolute memory address |
| D4E0 | 4C233C | .text | JMP [static] | Indirect jump to absolute memory address |
| D4E8 | 4C2430 | .text | JMP [static] | Indirect jump to absolute memory address |
| D4F0 | 4C2468 | .text | JMP [static] | Indirect jump to absolute memory address |
| D4F8 | 4C234C | .text | JMP [static] | Indirect jump to absolute memory address |
| D500 | 4C2368 | .text | JMP [static] | Indirect jump to absolute memory address |
| D508 | 4C2330 | .text | JMP [static] | Indirect jump to absolute memory address |
| D510 | 4C22F4 | .text | JMP [static] | Indirect jump to absolute memory address |
| D518 | 4C2324 | .text | JMP [static] | Indirect jump to absolute memory address |
| D520 | 4C231C | .text | JMP [static] | Indirect jump to absolute memory address |
| D528 | 4C23D0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D530 | 4C23C4 | .text | JMP [static] | Indirect jump to absolute memory address |
| D538 | 4C2374 | .text | JMP [static] | Indirect jump to absolute memory address |
| D540 | 4C2380 | .text | JMP [static] | Indirect jump to absolute memory address |
| D548 | 4C2450 | .text | JMP [static] | Indirect jump to absolute memory address |
| D550 | 4C23F4 | .text | JMP [static] | Indirect jump to absolute memory address |
| D558 | 4C2438 | .text | JMP [static] | Indirect jump to absolute memory address |
| D560 | 4C22F8 | .text | JMP [static] | Indirect jump to absolute memory address |
| D568 | 4C2370 | .text | JMP [static] | Indirect jump to absolute memory address |
| D570 | 4C23B0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D578 | 4C23A8 | .text | JMP [static] | Indirect jump to absolute memory address |
| D580 | 4C2310 | .text | JMP [static] | Indirect jump to absolute memory address |
| D588 | 4C2340 | .text | JMP [static] | Indirect jump to absolute memory address |
| D590 | 4C2434 | .text | JMP [static] | Indirect jump to absolute memory address |
| D598 | 4C2428 | .text | JMP [static] | Indirect jump to absolute memory address |
| D5A0 | 4C2344 | .text | JMP [static] | Indirect jump to absolute memory address |
| D5A8 | 4C232C | .text | JMP [static] | Indirect jump to absolute memory address |
| D5B0 | 4C23D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| D668 | 4C2328 | .text | JMP [static] | Indirect jump to absolute memory address |
| D670 | 4C242C | .text | JMP [static] | Indirect jump to absolute memory address |
| D688 | 4C3098 | .text | JMP [static] | Indirect jump to absolute memory address |
| D690 | 4C23CC | .text | JMP [static] | Indirect jump to absolute memory address |
| D698 | 4C2480 | .text | JMP [static] | Indirect jump to absolute memory address |
| D6A0 | 4C23BC | .text | JMP [static] | Indirect jump to absolute memory address |
| D6A8 | 4C23A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| D6B0 | 4C2470 | .text | JMP [static] | Indirect jump to absolute memory address |
| D6B8 | 4C2360 | .text | JMP [static] | Indirect jump to absolute memory address |
| D6C0 | 4C23E0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D6C8 | 4C23E0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D6D0 | 4C23EC | .text | JMP [static] | Indirect jump to absolute memory address |
| D6D8 | 4C2318 | .text | JMP [static] | Indirect jump to absolute memory address |
| D6E0 | 4C23E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| D6E8 | 4C2334 | .text | JMP [static] | Indirect jump to absolute memory address |
| D6F0 | 4C240C | .text | JMP [static] | Indirect jump to absolute memory address |
| D6F8 | 4C2458 | .text | JMP [static] | Indirect jump to absolute memory address |
| D700 | 4C241C | .text | JMP [static] | Indirect jump to absolute memory address |
| D708 | 4C239C | .text | JMP [static] | Indirect jump to absolute memory address |
| D710 | 4C22FC | .text | JMP [static] | Indirect jump to absolute memory address |
| D718 | 4C22FC | .text | JMP [static] | Indirect jump to absolute memory address |
| D720 | 4C237C | .text | JMP [static] | Indirect jump to absolute memory address |
| D728 | 4C2338 | .text | JMP [static] | Indirect jump to absolute memory address |
| D730 | 4C2474 | .text | JMP [static] | Indirect jump to absolute memory address |
| D738 | 4C235C | .text | JMP [static] | Indirect jump to absolute memory address |
| D740 | 4C23DC | .text | JMP [static] | Indirect jump to absolute memory address |
| D748 | 4C2408 | .text | JMP [static] | Indirect jump to absolute memory address |
| D750 | 4C2454 | .text | JMP [static] | Indirect jump to absolute memory address |
| D758 | 4C2420 | .text | JMP [static] | Indirect jump to absolute memory address |
| D760 | 4C2398 | .text | JMP [static] | Indirect jump to absolute memory address |
| D768 | 4C2348 | .text | JMP [static] | Indirect jump to absolute memory address |
| D770 | 4C23C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D778 | 4C2304 | .text | JMP [static] | Indirect jump to absolute memory address |
| D780 | 4C23A0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D788 | 4C236C | .text | JMP [static] | Indirect jump to absolute memory address |
| D790 | 4C23E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| D798 | 4C23F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D7A0 | 4C23C8 | .text | JMP [static] | Indirect jump to absolute memory address |
| D7A8 | 4C230C | .text | JMP [static] | Indirect jump to absolute memory address |
| D7B0 | 4C2308 | .text | JMP [static] | Indirect jump to absolute memory address |
| D7B8 | 4C2388 | .text | JMP [static] | Indirect jump to absolute memory address |
| D7C0 | 4C238C | .text | JMP [static] | Indirect jump to absolute memory address |
| D7C8 | 4C243C | .text | JMP [static] | Indirect jump to absolute memory address |
| D7D0 | 4C2410 | .text | JMP [static] | Indirect jump to absolute memory address |
| D7D8 | 4C2440 | .text | JMP [static] | Indirect jump to absolute memory address |
| D7E0 | 4C2498 | .text | JMP [static] | Indirect jump to absolute memory address |
| D7E8 | 4C2490 | .text | JMP [static] | Indirect jump to absolute memory address |
| D7F0 | 4C2494 | .text | JMP [static] | Indirect jump to absolute memory address |
| D7F8 | 4C24AC | .text | JMP [static] | Indirect jump to absolute memory address |
| D800 | 4C24A8 | .text | JMP [static] | Indirect jump to absolute memory address |
| D808 | 4C24B0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D810 | 4C24C8 | .text | JMP [static] | Indirect jump to absolute memory address |
| D818 | 4C24C4 | .text | JMP [static] | Indirect jump to absolute memory address |
| D820 | 4C24DC | .text | JMP [static] | Indirect jump to absolute memory address |
| D828 | 4C24D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| D830 | 4C24B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| D838 | 4C24D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| D840 | 4C24C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D848 | 4C24D0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D850 | 4C24B4 | .text | JMP [static] | Indirect jump to absolute memory address |
| D858 | 4C24A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| D860 | 4C24A0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D8C0 | 4C24BC | .text | JMP [static] | Indirect jump to absolute memory address |
| DA30 | 4C2488 | .text | JMP [static] | Indirect jump to absolute memory address |
| F3FA | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 142E4 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 16BBD | N/A | .text | CALL DWORD PTR [EDX+78h] | Displacement form |
| 16F44 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 16F84 | N/A | .text | CALL DWORD PTR [EDI-80h] | Displacement form |
| 16F9C | N/A | .text | CALL DWORD PTR [EAX-7Fh] | Displacement form |
| 16FAC | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 16FCC | N/A | .text | CALL DWORD PTR [ECX-7Dh] | Displacement form |
| 17084 | N/A | .text | CALL DWORD PTR [ESI-75h] | Displacement form |
| 18CDE | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 18E07 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1AECE | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 1B1AC | N/A | .text | CALL DWORD PTR [EBX-75h] | Displacement form |
| 1B1EC | N/A | .text | CALL DWORD PTR [EBX-75h] | Displacement form |
| 1BA9C | N/A | .text | CALL DWORD PTR [EAX-73h] | Displacement form |
| 1BC26 | N/A | .text | CALL DWORD PTR [EAX-73h] | Displacement form |
| 1D466 | N/A | .text | CALL DWORD PTR [ECX+52h] | Displacement form |
| 1DC8C | N/A | .text | CALL DWORD PTR [EAX+68h] | Displacement form |
| 1DCCC | N/A | .text | CALL DWORD PTR [EAX+68h] | Displacement form |
| 1DD68 | N/A | .text | CALL DWORD PTR [EAX+68h] | Displacement form |
| 1DDAA | N/A | .text | CALL DWORD PTR [EAX+68h] | Displacement form |
| 1E2D2 | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 1E37E | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 1E40B | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 1E567 | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 1E59A | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 1E5E0 | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 1E60C | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 1E827 | 4BE6AC | .text | CALL [static] | Indirect call to absolute memory address |
| 1E86C | 4BE6A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E898 | 4BE6A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1EC7E | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 1EE8D | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 1F234 | 4C2514 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1F23C | 4C2518 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1F8ED | 4BE914 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FED8 | 4C2390 | .text | JMP [static] | Indirect jump to absolute memory address |
| 20091 | 4B7E30 | .text | CALL [static] | Indirect call to absolute memory address |
| 2053B | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 20D19 | N/A | .text | CALL DWORD PTR [EDI-2h] | Displacement form |
| 20D35 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 20D7B | N/A | .text | CALL DWORD PTR [EBX+4h] | Displacement form |
| 20F4D | N/A | .text | CALL DWORD PTR [EBX-75h] | Displacement form |
| 20FA0 | N/A | .text | CALL DWORD PTR [EBX+Ch] | Displacement form |
| 2122C | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 21EE1 | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 22170 | 4C23B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2239D | N/A | .text | CALL DWORD PTR [EAX-73h] | Displacement form |
| 22807 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 22A2B | N/A | .text | CALL DWORD PTR [ECX+37h] | Displacement form |
| 22D9C | N/A | .text | CALL DWORD PTR [EBP+3Ah] | Displacement form |
| 23120 | N/A | .text | CALL DWORD PTR [ECX+4h] | Displacement form |
| 231CB | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 23219 | N/A | .text | CALL DWORD PTR [EDI+8h] | Displacement form |
| 2327E | N/A | .text | CALL DWORD PTR [ESI+14h] | Displacement form |
| 23CC4 | N/A | .text | CALL DWORD PTR [EDI+8h] | Displacement form |
| 23CD8 | N/A | .text | CALL DWORD PTR [EDI+8h] | Displacement form |
| 23E22 | N/A | .text | CALL DWORD PTR [ECX+Ch] | Displacement form |
| 244F7 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 2461E | N/A | .text | CALL DWORD PTR [EBX+8h] | Displacement form |
| 2475B | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 248B2 | FF | .text | JMP [static] | Indirect jump to absolute memory address |
| 24B2C | N/A | .text | CALL DWORD PTR [EBX+56h] | Displacement form |
| 2666B | 4C1128 | .text | CALL [static] | Indirect call to absolute memory address |
| 26695 | 4C112C | .text | CALL [static] | Indirect call to absolute memory address |
| 2678C | 4C24F8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 26794 | 4C24FC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2679C | 4C24EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 267A4 | 4C2508 | .text | JMP [static] | Indirect jump to absolute memory address |
| 26D70 | 4C250C | .text | JMP [static] | Indirect jump to absolute memory address |
| 26D78 | 4C24F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 26D80 | 4C24F4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 26D88 | 4C24E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 27140 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 28778 | 4C1194 | .text | CALL [static] | Indirect call to absolute memory address |
| 28928 | N/A | .text | CALL DWORD PTR [EAX-73h] | Displacement form |
| 28B24 | 4C119C | .text | CALL [static] | Indirect call to absolute memory address |
| 28BF4 | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 291C8 | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 292EE | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2935E | N/A | .text | CALL DWORD PTR [EDI+1Ch] | Displacement form |
| 29491 | N/A | .text | CALL DWORD PTR [EAX-3Fh] | Displacement form |
| 294B2 | N/A | .text | CALL DWORD PTR [EAX-3Fh] | Displacement form |
| 294D9 | N/A | .text | CALL DWORD PTR [EAX-3Fh] | Displacement form |
| 294FA | N/A | .text | CALL DWORD PTR [EAX-3Fh] | Displacement form |
| 296AB | N/A | .text | CALL DWORD PTR [EAX-3Fh] | Displacement form |
| 296CE | N/A | .text | CALL DWORD PTR [EAX-3Fh] | Displacement form |
| 296F7 | N/A | .text | CALL DWORD PTR [EAX-3Fh] | Displacement form |
| 2971A | N/A | .text | CALL DWORD PTR [EAX-3Fh] | Displacement form |
| 29D7A | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 29DAC | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 29E92 | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 29F0A | N/A | .text | CALL DWORD PTR [EDI+1Ch] | Displacement form |
| 2A5E2 | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 2A68D | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 2A7DE | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2A84E | N/A | .text | CALL DWORD PTR [EDI+1Ch] | Displacement form |
| 2AD2C | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 2AE4A | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AEBA | N/A | .text | CALL DWORD PTR [EDI+1Ch] | Displacement form |
| 2B59F | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 2B746 | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B7B6 | N/A | .text | CALL DWORD PTR [EDI+1Ch] | Displacement form |
| 2BCAC | N/A | .text | CALL DWORD PTR [EAX-5Fh] | Displacement form |
| 2BE1E | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2BE8E | N/A | .text | CALL DWORD PTR [EDI+1Ch] | Displacement form |
| 2C3D8 | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 2C410 | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 2C85D | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D221 | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2DB41 | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E111 | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E74D | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E9E6 | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2EA1B | 4C1198 | .text | CALL [static] | Indirect call to absolute memory address |
| 2EDE1 | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 2EDFF | N/A | .text | CALL DWORD PTR [EDX+50h] | Displacement form |
| 2EE1F | N/A | .text | CALL DWORD PTR [EDX+50h] | Displacement form |
| 2EF87 | N/A | .text | CALL DWORD PTR [EBX+4h] | Displacement form |
| 2EFE6 | N/A | .text | CALL DWORD PTR [EBX+34h] | Displacement form |
| 2F02A | N/A | .text | CALL DWORD PTR [EBX+34h] | Displacement form |
| 2F111 | N/A | .text | CALL DWORD PTR [EBX+8h] | Displacement form |
| 2F16C | N/A | .text | CALL DWORD PTR [EBX+34h] | Displacement form |
| 2F1B0 | N/A | .text | CALL DWORD PTR [EBX+34h] | Displacement form |
| 2F26F | N/A | .text | CALL DWORD PTR [EBX+4h] | Displacement form |
| 2F2CA | N/A | .text | CALL DWORD PTR [EBX+34h] | Displacement form |
| 2F30E | N/A | .text | CALL DWORD PTR [EBX+34h] | Displacement form |
| 2F88F | N/A | .text | CALL DWORD PTR [ECX+14h] | Displacement form |
| 2FCA9 | N/A | .text | CALL DWORD PTR [EBX+38h] | Displacement form |
| 2FCE0 | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 2FFD6 | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 3004A | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 30511 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 30521 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 3056B | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 305B3 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 3069A | N/A | .text | CALL DWORD PTR [EDI+14h] | Displacement form |
| 30746 | N/A | .text | CALL DWORD PTR [EDI+14h] | Displacement form |
| 307F6 | N/A | .text | CALL DWORD PTR [EDI+14h] | Displacement form |
| 308F7 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 3095E | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 309A9 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 30A24 | N/A | .text | CALL DWORD PTR [EDI+10h] | Displacement form |
| 30ACF | N/A | .text | CALL DWORD PTR [EDI+10h] | Displacement form |
| 30C31 | N/A | .text | CALL DWORD PTR [EDI+10h] | Displacement form |
| 30DBD | N/A | .text | CALL DWORD PTR [EDI+10h] | Displacement form |
| 30DF8 | N/A | .text | CALL DWORD PTR [EBX+56h] | Displacement form |
| 31126 | N/A | .text | CALL DWORD PTR [EDI+10h] | Displacement form |
| 312B5 | N/A | .text | CALL DWORD PTR [EDI+10h] | Displacement form |
| 31369 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 313FF | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 314C8 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 3156D | N/A | .text | CALL DWORD PTR [EDI+10h] | Displacement form |
| 31654 | N/A | .text | CALL DWORD PTR [ECX+Ch] | Displacement form |
| 3167F | N/A | .text | CALL DWORD PTR [ECX+Ch] | Displacement form |
| 32E7F | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 35075 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 357E1 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 35A69 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 35E2F | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 35F86 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 3605F | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 3650B | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 36B9F | 52540E00 | .text | CALL [static] | Indirect call to absolute memory address |
| 36C5E | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 36E6B | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 373C4 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 37E7A | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 37E82 | N/A | .text | CALL DWORD PTR [EDX-73h] | Displacement form |
| 37EDA | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 37F62 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 37F82 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 3A4DC | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 3AB56 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 3B74A | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 3B77A | N/A | .text | CALL DWORD PTR [EDX+Ch] | Displacement form |
| 3B7E8 | N/A | .text | CALL DWORD PTR [EDX+Ch] | Displacement form |
| 3B7F7 | N/A | .text | CALL DWORD PTR [EDX+Ch] | Displacement form |
| 3BA87 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 3BF85 | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 3CB0B | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 3D28A | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 40FA4 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 40FAC | N/A | .text | CALL DWORD PTR [EBP+1Fh] | Displacement form |
| 415FA | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 42498 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 4275C | N/A | .text | CALL DWORD PTR [EAX+35h] | Displacement form |
| 42784 | N/A | .text | CALL DWORD PTR [ECX+36h] | Displacement form |
| 427C4 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 427CC | N/A | .text | CALL DWORD PTR [EAX+EDI*1+44h] | ModRM/SIB parsed |
| 42DE6 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 43CEB | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 43D74 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 43D89 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 43DBC | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 43E36 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 43E9B | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 43EF9 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 43F55 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 43FBD | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 4467C | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 4488C | N/A | .text | CALL DWORD PTR [ESP+EAX*2] | ModRM/SIB parsed |
| 44B36 | N/A | .text | CALL DWORD PTR [ESI+5Ah] | Displacement form |
| 44B66 | 4200445C | .text | CALL [static] | Indirect call to absolute memory address |
| 45A5F | N/A | .text | CALL DWORD PTR [ECX+Ch] | Displacement form |
| 46935 | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 46FBE | N/A | .text | CALL DWORD PTR [EDX+Ch] | Displacement form |
| 470C5 | N/A | .text | CALL DWORD PTR [ECX+38h] | Displacement form |
| 4710B | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 47142 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 47155 | N/A | .text | CALL DWORD PTR [EDX+2Ch] | Displacement form |
| 472D1 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 472E4 | N/A | .text | CALL DWORD PTR [EDX+2Ch] | Displacement form |
| 473E9 | N/A | .text | CALL DWORD PTR [EDX+1Ch] | Displacement form |
| 47425 | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 47445 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4748F | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 47523 | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 4753F | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 4754E | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 4789A | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 478AE | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 478E9 | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 478F5 | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 47933 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4799D | N/A | .text | CALL DWORD PTR [EDX+28h] | Displacement form |
| 47A6A | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 47AB0 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 47C9B | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 47D05 | N/A | .text | CALL DWORD PTR [EDX+2Ch] | Displacement form |
| 47D22 | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 47D68 | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 47E22 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 47E31 | N/A | .text | CALL DWORD PTR [EDX+28h] | Displacement form |
| 47E44 | N/A | .text | CALL DWORD PTR [EDX+1Ch] | Displacement form |
| 47E98 | N/A | .text | CALL DWORD PTR [EDX+28h] | Displacement form |
| 47EB4 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 47FD7 | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 48003 | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 48023 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4806D | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 48122 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 491D7 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 491E7 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4921B | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 49243 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 49257 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 49294 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 492F4 | N/A | .text | CALL DWORD PTR [EDX+28h] | Displacement form |
| 4933C | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 493B5 | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 49445 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 494A7 | N/A | .text | CALL DWORD PTR [EDX+28h] | Displacement form |
| 4956C | N/A | .text | CALL DWORD PTR [EDX+28h] | Displacement form |
| 49596 | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 495D2 | N/A | .text | CALL DWORD PTR [EAX+33h] | Displacement form |
| 4A432 | N/A | .text | CALL DWORD PTR [EBX+ESI*4+44h] | ModRM/SIB parsed |
| 4A462 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 4A48A | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 4A4D2 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 4A542 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 4B8E2 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 4B912 | N/A | .text | CALL DWORD PTR [ESI-33h] | Displacement form |
| 4B932 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 4C430 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 4CCC6 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 4CCEE | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 4CD16 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 4CD5E | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 4E3D3 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 4E3EF | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 4E4BD | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4E5B4 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4E605 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4E61B | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 4E656 | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 4E686 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4E69C | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 4E6C1 | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 4E6CC | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 4E6D3 | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 4E6D9 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4E712 | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 4E718 | N/A | .text | CALL DWORD PTR [EDX+30h] | Displacement form |
| 4EAAC | N/A | .text | CALL DWORD PTR [ECX+24h] | Displacement form |
| 4F2F8 | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 4F540 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 4F596 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 4F59D | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 4F5F6 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 4F643 | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 50246 | 42004514 | .text | JMP [static] | Indirect jump to absolute memory address |
| 50DD6 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 5106D | N/A | .text | CALL DWORD PTR [EBP-75h] | Displacement form |
| 5137F | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 5138A | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 513A3 | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 513AE | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 513C7 | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 513D2 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 51430 | N/A | .text | CALL DWORD PTR [EBX+34h] | Displacement form |
| 514A4 | N/A | .text | CALL DWORD PTR [EBX+34h] | Displacement form |
| 5154A | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 51575 | N/A | .text | CALL DWORD PTR [EDX+2Ch] | Displacement form |
| 515EE | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 5161F | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 516D6 | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 51743 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 5185F | N/A | .text | CALL DWORD PTR [EDX+Ch] | Displacement form |
| 51878 | N/A | .text | CALL DWORD PTR [EDX+Ch] | Displacement form |
| 51891 | N/A | .text | CALL DWORD PTR [EDX+Ch] | Displacement form |
| 518C5 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 51AB1 | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 51ABD | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 51B3E | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 52603 | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 52796 | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 527D1 | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 52813 | N/A | .text | CALL DWORD PTR [EDX+14h] | Displacement form |
| 52838 | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 52843 | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 5284A | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 5297B | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 52CCA | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 53643 | N/A | .text | CALL DWORD PTR [EBX+Ch] | Displacement form |
| 537F8 | N/A | .text | CALL DWORD PTR [ECX+44h] | Displacement form |
| 53B87 | N/A | .text | CALL DWORD PTR [EDX+18h] | Displacement form |
| 53D1D | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 53D39 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 54128 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 541E9 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 54205 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 54457 | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 54527 | N/A | .text | CALL DWORD PTR [EBX+Ch] | Displacement form |
| 547FA | N/A | .text | CALL DWORD PTR [ESI-75h] | Displacement form |
| 548F5 | N/A | .text | CALL DWORD PTR [EDI+8h] | Displacement form |
| 54908 | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 54A11 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 54A2B | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 54AC6 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 54B16 | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 54C91 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 54CAB | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 54CE0 | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 54D46 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 55674 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 556D2 | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 55775 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 557C7 | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 55A07 | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 55AE0 | N/A | .text | CALL DWORD PTR [EBX+Ch] | Displacement form |
| 55C86 | N/A | .text | CALL DWORD PTR [ESI-75h] | Displacement form |
| 55D31 | N/A | .text | CALL DWORD PTR [EDI+8h] | Displacement form |
| 55D44 | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 55E8D | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 55EA7 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 55EDC | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 55F42 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 5611F | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 5620C | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 564F4 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 565F5 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 56887 | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 56960 | N/A | .text | CALL DWORD PTR [EBX+Ch] | Displacement form |
| 56B06 | N/A | .text | CALL DWORD PTR [ESI-75h] | Displacement form |
| 56BB1 | N/A | .text | CALL DWORD PTR [EDI+8h] | Displacement form |
| 56BC4 | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 570DA | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 5712A | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 577AE | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 577FE | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 57C36 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 580BE | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 5810E | N/A | .text | CALL DWORD PTR [ECX-4h] | Displacement form |
| 58546 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 5A92C | N/A | .text | CALL DWORD PTR [EBX+Ch] | Displacement form |
| 5A985 | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 5A99D | N/A | .text | CALL DWORD PTR [EDI+Ch] | Displacement form |
| 5B8F6 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 5B8FE | N/A | .text | CALL DWORD PTR [EBP-36h] | Displacement form |
| 5B916 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 5B956 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 5B986 | N/A | .text | CALL DWORD PTR [EDX-32h] | Displacement form |
| 5B9A6 | N/A | .text | CALL DWORD PTR [EDX-31h] | Displacement form |
| 5C5A4 | N/A | .text | CALL DWORD PTR [EAX-68h] | Displacement form |
| 5C97E | 440045D7 | .text | CALL [static] | Indirect call to absolute memory address |
| 5C9C6 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 5C9CE | N/A | .text | CALL DWORD PTR [EBP-27h] | Displacement form |
| 5CA06 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 5CAB6 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 5DA12 | 4D0045E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5DA3A | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 5DA72 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 5E628 | N/A | .text | CALL DWORD PTR [EAX-62h] | Displacement form |
| 5EA8A | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 5EDAA | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 5EDB2 | N/A | .text | CALL DWORD PTR [EAX+1h] | Displacement form |
| 5EDDA | N/A | .text | CALL DWORD PTR [EBP+2h] | Displacement form |
| 5EDFA | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 5FED6 | N/A | .text | CALL DWORD PTR [EBX+11h] | Displacement form |
| 5FEFE | N/A | .text | CALL DWORD PTR [ECX+12h] | Displacement form |
| 5FF6E | N/A | .text | CALL DWORD PTR [ECX+15h] | Displacement form |
| 60DFE | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 60E3E | 4200461E | .text | CALL [static] | Indirect call to absolute memory address |
| 60E66 | N/A | .text | CALL DWORD PTR [EDI+EBX*1+46h] | ModRM/SIB parsed |
| 60E86 | N/A | .text | CALL DWORD PTR [EBP+20h] | Displacement form |
| 60EBE | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 60EE6 | 42004623 | .text | JMP [static] | Indirect jump to absolute memory address |
| 60F36 | N/A | .text | CALL DWORD PTR [EAX+25h] | Displacement form |
| 62102 | N/A | .text | CALL DWORD PTR [ESI+2Fh] | Displacement form |
| 62142 | N/A | .text | CALL DWORD PTR [EBP+31h] | Displacement form |
| 6217A | 42004633 | .text | CALL [static] | Indirect call to absolute memory address |
| 6220A | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 635EF | N/A | .text | CALL DWORD PTR [EDI+42h] | Displacement form |
| 68EC7 | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 68F46 | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 68FCB | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 6904A | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 690CF | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 6914E | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 691B8 | N/A | .text | CALL DWORD PTR [ESP+4h] | ModRM/SIB parsed |
| 691C8 | N/A | .text | CALL DWORD PTR [ESP+4h] | ModRM/SIB parsed |
| 69248 | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 692B7 | N/A | .text | CALL DWORD PTR [ESP+8h] | ModRM/SIB parsed |
| 692C7 | N/A | .text | CALL DWORD PTR [ESP+8h] | ModRM/SIB parsed |
| 69350 | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 693C8 | N/A | .text | CALL DWORD PTR [ESP+Ch] | ModRM/SIB parsed |
| 693D8 | N/A | .text | CALL DWORD PTR [ESP+Ch] | ModRM/SIB parsed |
| 69461 | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 69476 | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 694E7 | N/A | .text | CALL DWORD PTR [ESP+8h] | ModRM/SIB parsed |
| 694F7 | N/A | .text | CALL DWORD PTR [ESP+8h] | ModRM/SIB parsed |
| 69580 | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 695EF | N/A | .text | CALL DWORD PTR [ESP+8h] | ModRM/SIB parsed |
| 695FF | N/A | .text | CALL DWORD PTR [ESP+8h] | ModRM/SIB parsed |
| 69688 | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 6970B | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 6978A | N/A | .text | CALL DWORD PTR [EBP-8h] | Displacement form |
| 6C295 | N/A | .text | CALL DWORD PTR [EDX+EAX*8+48h] | ModRM/SIB parsed |
| 6C70C | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 6CFA1 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 6DA2F | N/A | .text | CALL DWORD PTR [EAX-6h] | Displacement form |
| 6DA7F | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 6DB4F | 42004704 | .text | JMP [static] | Indirect jump to absolute memory address |
| 70094 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 70B2C | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 7157F | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 7235D | N/A | .text | CALL DWORD PTR [EAX] | Displacement form |
| 72399 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 723C6 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 72421 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 72783 | N/A | .text | CALL DWORD PTR [EAX+38h] | Displacement form |
| 7279B | 42004739 | .text | JMP [static] | Indirect jump to absolute memory address |
| 7281B | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 72863 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 7286B | N/A | .text | CALL DWORD PTR [ECX+3Fh] | Displacement form |
| 734E1 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 734FA | N/A | .text | CALL DWORD PTR [EAX] | Displacement form |
| 7350C | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 73978 | N/A | .text | CALL DWORD PTR [ECX+47h] | Displacement form |
| 7430B | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 743BF | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 75275 | N/A | .text | CALL DWORD PTR [EBP+62h] | Displacement form |
| 752DD | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 75D31 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 76B36 | N/A | .text | CALL DWORD PTR [EAX+7Ah] | Displacement form |
| 76C3E | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 782EA | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 7832A | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 78352 | N/A | .text | CALL DWORD PTR [ECX-6Ch] | Displacement form |
| 78372 | N/A | .text | CALL DWORD PTR [EDX-6Bh] | Displacement form |
| 78392 | N/A | .text | CALL DWORD PTR [EBP-6Ah] | Displacement form |
| 783DA | 42004798 | .text | JMP [static] | Indirect jump to absolute memory address |
| 794F2 | N/A | .text | CALL DWORD PTR [ECX+47h] | ModRM/SIB parsed |
| 7970A | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 797BA | N/A | .text | CALL DWORD PTR [EAX-55h] | Displacement form |
| 7A38E | N/A | .text | CALL DWORD PTR [EAX+67h] | Displacement form |
| 7A6A6 | N/A | .text | CALL DWORD PTR [EAX+67h] | Displacement form |
| 7AB62 | N/A | .text | CALL DWORD PTR [EAX-46h] | Displacement form |
| 7ABBA | 420047BD | .text | JMP [static] | Indirect jump to absolute memory address |
| 7ABFA | 420047BF | .text | CALL [static] | Indirect call to absolute memory address |
| 7D7B0 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 7D80C | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 7DB44 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 7E02E | N/A | .text | CALL DWORD PTR [ESI-11h] | Displacement form |
| 7E05E | 420047F1 | .text | CALL [static] | Indirect call to absolute memory address |
| 7EE0F | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 7F162 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 7F222 | 420047FF | .text | CALL [static] | Indirect call to absolute memory address |
| 7F76D | N/A | .text | CALL DWORD PTR [EAX+2h] | Displacement form |
| 812A1 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 8171E | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 8173E | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 8179E | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 817C6 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 81836 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 82C06 | 4200483E | .text | JMP [static] | Indirect jump to absolute memory address |
| 82C26 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 8449B | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 84A8E | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 84A96 | N/A | .text | CALL DWORD PTR [EBX+59h] | Displacement form |
| 84B36 | N/A | .text | CALL DWORD PTR [EAX+5Eh] | Displacement form |
| 857D8 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 85E7F | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 8619F | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 861A7 | N/A | .text | CALL DWORD PTR [ESI+EBP*2+48h] | ModRM/SIB parsed |
| 86FD4 | N/A | .text | CALL DWORD PTR [EBP+7Ch] | Displacement form |
| 87280 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 87901 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 87C77 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 899AD | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 89A6A | N/A | .text | CALL DWORD PTR [EDI+48h] | ModRM/SIB parsed |
| 8A73E | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 8B3A3 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 8B3AC | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 8B3C0 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 8B44B | N/A | .text | CALL DWORD PTR [EDX+8h] | Displacement form |
| 8B492 | N/A | .text | CALL DWORD PTR [EBX+4h] | Displacement form |
| 8B515 | N/A | .text | CALL DWORD PTR [EBX+4h] | Displacement form |
| 8B711 | N/A | .text | CALL DWORD PTR [EDI+4h] | Displacement form |
| 8BCAB | N/A | .text | CALL DWORD PTR [EAX+Ch] | Displacement form |
| 8C0D7 | N/A | .text | CALL DWORD PTR [EAX+68h] | Displacement form |
| 8C14C | N/A | .text | CALL DWORD PTR [EAX+68h] | Displacement form |
| 8C156 | N/A | .text | CALL DWORD PTR [EAX+38h] | Displacement form |
| 8C1AC | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 8C221 | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 8C244 | N/A | .text | CALL DWORD PTR [ECX+10h] | Displacement form |
| 8C423 | N/A | .text | CALL DWORD PTR [EAX+1Ch] | Displacement form |
| 8C42F | N/A | .text | CALL DWORD PTR [ECX+Ch] | Displacement form |
| 8C462 | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 8C4CE | N/A | .text | CALL DWORD PTR [ECX+8h] | Displacement form |
| 8C4E9 | N/A | .text | CALL DWORD PTR [EDX+24h] | Displacement form |
| 8C537 | N/A | .text | CALL DWORD PTR [EDX+20h] | Displacement form |
| 8C5CF | N/A | .text | CALL DWORD PTR [ECX+Ch] | Displacement form |
| 8C87F | N/A | .text | CALL DWORD PTR [EDI+14h] | Displacement form |
| 8C9A7 | N/A | .text | CALL DWORD PTR [ECX+28h] | Displacement form |
| 8C9C9 | N/A | .text | CALL DWORD PTR [ECX+28h] | Displacement form |
| 8C9E0 | N/A | .text | CALL DWORD PTR [ECX+28h] | Displacement form |
| 8C9F5 | N/A | .text | CALL DWORD PTR [ECX+28h] | Displacement form |
| 8CA0D | N/A | .text | CALL DWORD PTR [ECX+28h] | Displacement form |
| 8CA2B | N/A | .text | CALL DWORD PTR [EDX+8h] | Displacement form |
| 8CA7F | N/A | .text | CALL DWORD PTR [ECX+4h] | Displacement form |
| 8CBD5 | N/A | .text | CALL DWORD PTR [EBX+24h] | Displacement form |
| 8CC28 | N/A | .text | CALL DWORD PTR [EBX+Ch] | Displacement form |
| 8CCB4 | N/A | .text | CALL DWORD PTR [ESI+Ch] | Displacement form |
| 8CD0C | N/A | .text | CALL DWORD PTR [EBX+Ch] | Displacement form |
| 8CD7C | N/A | .text | CALL DWORD PTR [EDI+10h] | Displacement form |
| 8CDD2 | N/A | .text | CALL DWORD PTR [EBX+10h] | Displacement form |
| 8D0E0 | N/A | .text | CALL DWORD PTR [ECX+30h] | Displacement form |
| 8D101 | N/A | .text | CALL DWORD PTR [ECX+28h] | Displacement form |
| 8D1ED | N/A | .text | CALL DWORD PTR [ECX+30h] | Displacement form |
| 8DE4E | N/A | .text | CALL DWORD PTR [EBX-14h] | Displacement form |
| 8DE8E | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| D1600 | N/A | *Overlay* | 7A6C621A16E4E6EBE0045D0015033D52222D14B8 | zlb.......]...=R"-.. |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 4073659 | 67,6134% |
| Null Byte Code | 184532 | 3,0628% |
© 2025 All rights reserved.