PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 181,50 KBSHA-256 Hash: 552A24C4C210A87DD3D6494A88A1A707CBEDF6E50DDD2604CAA5719C5C63A05E SHA-1 Hash: AB30116805FEB4765B596577AEA770CBA6EF3702 MD5 Hash: 5A768C3BD531FFF496E6DD170DC1BE74 Imphash: 5465054D9921605A83369A86A1556456 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 1000 SizeOfHeaders: 400 SizeOfImage: 146000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 90C0 IAT: 9680 Characteristics: 22 TimeDateStamp: 6AF3CE37 Date: 11/11/2026 2:08:55 File Type: EXE Number Of Sections: 14 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .buildid, .data, .pdata, .rsrc, .reloc, /4, /18, /58, /70, /82, /33, /47 Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker [Incomplete Binary or Compressor Packer - 1,10 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 5E00 | 1000 | 5C46 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
6200 | 3800 | 7000 | 36B4 |
|
|
| .buildid | 0x40000040 Initialized Data Readable |
9A00 | 200 | B000 | 35 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
9C00 | 200 | C000 | 111918 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
9E00 | 200 | 11E000 | 1B0 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
A000 | 12600 | 11F000 | 12418 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
1C600 | 200 | 132000 | 5C |
|
|
| /4 | 0x42000040 Initialized Data GP-Relative Readable |
1C800 | 1A00 | 133000 | 1886 |
|
|
| /18 | 0x42000040 Initialized Data GP-Relative Readable |
1E200 | 200 | 135000 | 30 |
|
|
| /58 | 0x42000040 Initialized Data GP-Relative Readable |
1E400 | 4400 | 136000 | 43D0 |
|
|
| /70 | 0x42000040 Initialized Data GP-Relative Readable |
22800 | 2800 | 13B000 | 26A0 |
|
|
| /82 | 0x42000040 Initialized Data GP-Relative Readable |
25000 | 1800 | 13E000 | 16BA |
|
|
| /33 | 0x42000040 Initialized Data GP-Relative Readable |
26800 | 200 | 140000 | 120 |
|
|
| /47 | 0x42000040 Initialized Data GP-Relative Readable |
26A00 | 4200 | 141000 | 4159 |
|
|
| Description |
| OriginalFilename: HookshotBuilder-Setup.exe CompanyName: Hookshot ProductName: Hookshot Builder FileVersion: 1.0.0 FileDescription: Hookshot Builder setup Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 400 Code -> 488B0511600000C70001000000E90E00000066666666662E0F1F8400000000004157415641554154565755534883EC386548 Assembler |MOV RAX, QWORD PTR [RIP + 0X6011] |MOV DWORD PTR [RAX], 1 |JMP 0X140001020 |NOP WORD PTR CS:[RAX + RAX] |PUSH R15 |PUSH R14 |PUSH R13 |PUSH R12 |PUSH RSI |PUSH RDI |PUSH RBP |PUSH RBX |SUB RSP, 0X38 |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): linker: Microsoft Linker(14.0)[-] • Entropy: 6.84951 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| File Access |
| api-ms-win-crt-math-l1-1-0.dll KERNEL32.dll USER32.dll GDI32.dll api-ms-win-crt-private-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-environment-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll SHELL32.dll COMCTL32.dll bcrypt.dll WINHTTP.dll @.dat //github.com/NotRexed/Hookshot/releases/latest/download/hookshot-setup.txt //github.com/NotRexed/Hookshot/releases/download/%s/hookshot-setup.txt __main.ini |
| File Access (UNICODE) |
| %ls\bin\hookshot.exe tar.exe HookshotBuilder-Setup.exe %ls\tar.exe run HookshotBuilder.exe %ls\HookshotBuilder.exe The game (bin\hookshot.exe hookshot.exe %ls\previous.txt %ls\%hs\parts.txt %ls\current.txt %ls\parts.txt %ls\installed.txt %ls\HookshotBuilder\versions\current.txt %ls\*.zip %ls\%ls.zip Download HookshotBuilder.zip |
| Interest's Words |
| exec attrib start expand |
| Interest's Words (UNICODE) |
| Virus start dism |
| URLs |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings https://github.com/NotRexed/Hookshot/releases/download/%s/hookshot-setup.txt https://github.com/NotRexed/Hookshot/releases/latest/download/hookshot-setup.txt https://github.com/ https://api.github.com/repos/%s/releases/tags/%s https://api.github.com/repos/%s/releases/latest https://api.github.com/ https://github.com/llvm/llvm-project.git |
| URLs (UNICODE) |
| https://github.com/NotRexed/Hookshot/releases/latest |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 11F250 | 29F | A250 | 89504E470D0A1A0A0000000D49484452000000100000001008060000001FF3FF61000002664944415478DABD935D48537118 | .PNG........IHDR................a...fIDATx...]HSq. |
| \ICON\2\1033 | 11F4F0 | 4BD | A4F0 | 89504E470D0A1A0A0000000D4948445200000018000000180806000000E0773DF8000004844944415478DAE555596C545518 | .PNG........IHDR..............w=.....IDATx..UYlTU. |
| \ICON\3\1033 | 11F9B0 | 760 | A9B0 | 89504E470D0A1A0A0000000D4948445200000020000000200806000000737A7AF4000007274944415478DAED975B6C14D719 | .PNG........IHDR... ... .....szz....’IDATx...[l... |
| \ICON\4\1033 | 120110 | D8C | B110 | 89504E470D0A1A0A0000000D49484452000000300000003008060000005702F98700000D534944415478DAED5969905CD575 | .PNG........IHDR...0...0.....W......SIDATx..Yi.\.u |
| \ICON\5\1033 | 120EA0 | 14FC | BEA0 | 89504E470D0A1A0A0000000D4948445200000040000000400806000000AA6971DE000014C34944415478DAED9B69945D5595 | .PNG........IHDR...@...@......iq.....IDATx...i.]U. |
| \ICON\6\1033 | 1223A0 | 3D04 | D3A0 | 89504E470D0A1A0A0000000D4948445200000080000000800806000000C33E61CB00003CCB4944415478DAEDBD7798655779 | .PNG........IHDR..............>a...<.IDATx...w.eWy |
| \ICON\7\1033 | 1260A8 | AD88 | 110A8 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A8660000AD4F4944415478DAECBD779C64D959 | .PNG........IHDR.............\r.f...OIDATx...w.d.Y |
| \GROUP_ICON\1\1033 | 130E30 | 68 | 1BE30 | 00000100070010100000010020009F02000001001818000001002000BD040000020020200000010020006007000003003030 | ............ ............. ....... .... ......00 |
| \VERSION\1\1033 | 1311E0 | 234 | 1C1E0 | 340234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | 4.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 130E98 | 348 | 1BE98 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • hookshot.exe • %ls\bin\hookshot.exe • %ls\HookshotBuilder\versions\current.txt • %ls\HookshotBuilder.exe • The latest Hookshot release has no setup files yet. Download HookshotBuilder.zip from the releases page for now: https://github.com/NotRexed/Hookshot/releases/latest • 0123456789abcdefhttps://The releases setup list has a name this setup does not accept. Try again later. • %ls\installed.txt • %ls\%ls.zip • Downloading part %d of %d failed: GitHubs download servers are failing right now (tried 8 times over 3 minutes). This is on GitHubs side. The parts already downloaded are kept: run HookshotBuilder.exe again in a few minutes and it carries on from here. • Windows tar.exe was not found (Windows error 2). • DISM /Online /Cleanup-Image /RestoreHealth • Could not start Windows tar.exe (Windows error %lu). • Could not read Windows tar.exe exit status (Windows error %lu). • Unpacking part %d of %d failed: Windows tar.exe exited with code %lu. • %ls\parts.txt • https://github.com/NotRexed/Hookshot/releases/download/%s/hookshot-setup.txthttps://github.com/NotRexed/Hookshot/releases/latest/download/hookshot-setup.txt • https://github.com//releases/latest/download//releases/download//?https://api.github.com/repos/%s/releases/tags/%shttps://api.github.com/repos/%s/releases/latestapplication/vnd.github+json • %ls\current.txt • %ls\%hs\parts.txt • %ls\previous.txt • %ls\*.zip • <application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware></windowsSettings></application> • HookshotBuilder-Setup.exe • ../cfguard/guard_dispatch.S/home/runner/work/llvm-mingw/llvm-mingw/mingw-w64/mingw-w64-crt/build-x86_64clang version 23.1.5 (https://github.com/llvm/llvm-project.git 392dfff97d29b59d77e5cac6d4b6ef2585fe7117) |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 4CD | N/A | .text | CALL QWORD PTR [RIP+0x7FA5] |
| 4DF | N/A | .text | CALL QWORD PTR [RIP+0x7F93] |
| 734 | N/A | .text | CALL QWORD PTR [RIP+0x8776] |
| 893 | N/A | .text | CALL QWORD PTR [RIP+0x85FF] |
| 92E | N/A | .text | CALL QWORD PTR [RIP+0x851C] |
| 952 | N/A | .text | CALL QWORD PTR [RIP+0x8238] |
| 9B7 | N/A | .text | CALL QWORD PTR [RIP+0x815B] |
| A0E | N/A | .text | CALL QWORD PTR [RIP+0x8374] |
| A23 | N/A | .text | CALL QWORD PTR [RIP+0x8357] |
| A45 | N/A | .text | CALL QWORD PTR [RIP+0x835D] |
| BF1 | N/A | .text | CALL QWORD PTR [RIP+0x8149] |
| C38 | N/A | .text | CALL QWORD PTR [RIP+0x8182] |
| C5D | N/A | .text | CALL QWORD PTR [RIP+0x819D] |
| C66 | N/A | .text | CALL QWORD PTR [RIP+0x816C] |
| C7C | N/A | .text | CALL QWORD PTR [RIP+0x80EE] |
| EF0 | N/A | .text | CALL QWORD PTR [RIP+0x7F02] |
| F63 | N/A | .text | CALL QWORD PTR [RIP+0x7CB7] |
| 100C | N/A | .text | CALL QWORD PTR [RIP+0x7DE6] |
| 1023 | N/A | .text | CALL QWORD PTR [RIP+0x7EA7] |
| 1036 | N/A | .text | CALL QWORD PTR [RIP+0x7DFC] |
| 10A1 | N/A | .text | CALL QWORD PTR [RIP+0x7CE9] |
| 10DC | N/A | .text | CALL QWORD PTR [RIP+0x7A46] |
| 1188 | N/A | .text | CALL QWORD PTR [RIP+0x7C5A] |
| 11C8 | N/A | .text | CALL QWORD PTR [RIP+0x7CBA] |
| 11D1 | N/A | .text | CALL QWORD PTR [RIP+0x7C01] |
| 123D | N/A | .text | CALL QWORD PTR [RIP+0x7C3D] |
| 128E | N/A | .text | CALL QWORD PTR [RIP+0x7BAC] |
| 1359 | N/A | .text | CALL QWORD PTR [RIP+0x7A99] |
| 13B9 | N/A | .text | CALL QWORD PTR [RIP+0x79F9] |
| 13FC | N/A | .text | CALL QWORD PTR [RIP+0x795E] |
| 1406 | N/A | .text | CALL QWORD PTR [RIP+0x7994] |
| 1415 | N/A | .text | JMP QWORD PTR [RIP+0x793D] |
| 142C | N/A | .text | CALL QWORD PTR [RIP+0x797E] |
| 14A0 | N/A | .text | CALL QWORD PTR [RIP+0x7A12] |
| 14C0 | N/A | .text | CALL QWORD PTR [RIP+0x7662] |
| 14EE | N/A | .text | CALL QWORD PTR [RIP+0x7724] |
| 157A | N/A | .text | CALL QWORD PTR [RIP+0x7860] |
| 159F | N/A | .text | CALL QWORD PTR [RIP+0x783B] |
| 1774 | N/A | .text | CALL QWORD PTR [RIP+0x773E] |
| 1F1E | N/A | .text | CALL QWORD PTR [RIP+0x6EBC] |
| 1FF2 | N/A | .text | CALL QWORD PTR [RIP+0x6E48] |
| 204B | N/A | .text | CALL QWORD PTR [RIP+0x6E2F] |
| 20E5 | N/A | .text | CALL QWORD PTR [RIP+0x6CFD] |
| 2123 | N/A | .text | CALL QWORD PTR [RIP+0x6D5F] |
| 212C | N/A | .text | CALL QWORD PTR [RIP+0x6CA6] |
| 21FA | N/A | .text | CALL QWORD PTR [RIP+0x6BE8] |
| 2235 | N/A | .text | CALL QWORD PTR [RIP+0x6C4D] |
| 223E | N/A | .text | CALL QWORD PTR [RIP+0x6B94] |
| 22CE | N/A | .text | CALL QWORD PTR [RIP+0x6B6C] |
| 2382 | N/A | .text | CALL QWORD PTR [RIP+0x6AF0] |
| 23F0 | N/A | .text | CALL QWORD PTR [RIP+0x6A4A] |
| 24AE | N/A | .text | CALL QWORD PTR [RIP+0x6A04] |
| 24F9 | N/A | .text | CALL QWORD PTR [RIP+0x68E9] |
| 25CF | N/A | .text | CALL QWORD PTR [RIP+0x6803] |
| 26DB | N/A | .text | CALL QWORD PTR [RIP+0x678F] |
| 272C | N/A | .text | CALL QWORD PTR [RIP+0x674E] |
| 27F8 | N/A | .text | CALL QWORD PTR [RIP+0x666A] |
| 28EA | N/A | .text | CALL QWORD PTR [RIP+0x6500] |
| 2905 | N/A | .text | CALL QWORD PTR [RIP+0x659D] |
| 2942 | N/A | .text | CALL QWORD PTR [RIP+0x64A0] |
| 2980 | N/A | .text | CALL QWORD PTR [RIP+0x64C2] |
| 29C0 | N/A | .text | CALL QWORD PTR [RIP+0x6482] |
| 2A2D | N/A | .text | CALL QWORD PTR [RIP+0x63C5] |
| 2A45 | N/A | .text | CALL QWORD PTR [RIP+0x638D] |
| 2A54 | N/A | .text | CALL QWORD PTR [RIP+0x637E] |
| 2A7F | N/A | .text | CALL QWORD PTR [RIP+0x6403] |
| 2AE4 | N/A | .text | CALL QWORD PTR [RIP+0x639E] |
| 2AFE | N/A | .text | CALL QWORD PTR [RIP+0x62D4] |
| 2B18 | N/A | .text | CALL QWORD PTR [RIP+0x63B2] |
| 2B2E | N/A | .text | CALL QWORD PTR [RIP+0x6304] |
| 2B38 | N/A | .text | CALL QWORD PTR [RIP+0x630A] |
| 2B4D | N/A | .text | CALL QWORD PTR [RIP+0x6285] |
| 2B60 | N/A | .text | CALL QWORD PTR [RIP+0x62E2] |
| 2B77 | N/A | .text | CALL QWORD PTR [RIP+0x625B] |
| 2B87 | N/A | .text | CALL QWORD PTR [RIP+0x624B] |
| 2B96 | N/A | .text | CALL QWORD PTR [RIP+0x623C] |
| 2C1B | N/A | .text | CALL QWORD PTR [RIP+0x6257] |
| 2C93 | N/A | .text | CALL QWORD PTR [RIP+0x614F] |
| 2CCD | N/A | .text | CALL QWORD PTR [RIP+0x61B5] |
| 2D20 | N/A | .text | CALL QWORD PTR [RIP+0x6162] |
| 2D3A | N/A | .text | CALL QWORD PTR [RIP+0x6098] |
| 2E6F | N/A | .text | CALL QWORD PTR [RIP+0x5FCB] |
| 2E8E | N/A | .text | CALL QWORD PTR [RIP+0x5FE4] |
| 2EDD | N/A | .text | CALL QWORD PTR [RIP+0x5F05] |
| 2F16 | N/A | .text | CALL QWORD PTR [RIP+0x5FC4] |
| 2F1F | N/A | .text | CALL QWORD PTR [RIP+0x5EB3] |
| 2F64 | N/A | .text | CALL QWORD PTR [RIP+0x5ED6] |
| 2FFC | N/A | .text | CALL QWORD PTR [RIP+0x5DE6] |
| 303B | N/A | .text | CALL QWORD PTR [RIP+0x5E47] |
| 3044 | N/A | .text | CALL QWORD PTR [RIP+0x5D8E] |
| 30CC | N/A | .text | CALL QWORD PTR [RIP+0x5D16] |
| 3105 | N/A | .text | CALL QWORD PTR [RIP+0x5DD5] |
| 310E | N/A | .text | CALL QWORD PTR [RIP+0x5CC4] |
| 3140 | N/A | .text | CALL QWORD PTR [RIP+0x5CA2] |
| 3179 | N/A | .text | CALL QWORD PTR [RIP+0x5D61] |
| 3182 | N/A | .text | CALL QWORD PTR [RIP+0x5C50] |
| 31BF | N/A | .text | CALL QWORD PTR [RIP+0x5C23] |
| 31FE | N/A | .text | CALL QWORD PTR [RIP+0x5C84] |
| 3207 | N/A | .text | CALL QWORD PTR [RIP+0x5BCB] |
| 3268 | N/A | .text | CALL QWORD PTR [RIP+0x5BBA] |
| 6046-61FF | N/A | .text | Unusual BP Cave, count: 442 |
| 9E00 | 140001020 | .pdata | ExceptionHook | Pointer to 1020 - 0x420 .text + UnwindInfo: .rdata |
| 9E0C | 1400013E0 | .pdata | ExceptionHook | Pointer to 13E0 - 0x7E0 .text + UnwindInfo: .rdata |
| 9E18 | 140001470 | .pdata | ExceptionHook | Pointer to 1470 - 0x870 .text + UnwindInfo: .rdata |
| 9E24 | 140001CB0 | .pdata | ExceptionHook | Pointer to 1CB0 - 0x10B0 .text + UnwindInfo: .rdata |
| 9E30 | 140001F90 | .pdata | ExceptionHook | Pointer to 1F90 - 0x1390 .text + UnwindInfo: .rdata |
| 9E3C | 140002040 | .pdata | ExceptionHook | Pointer to 2040 - 0x1440 .text + UnwindInfo: .rdata |
| 9E48 | 1400046D0 | .pdata | ExceptionHook | Pointer to 46D0 - 0x3AD0 .text + UnwindInfo: .rdata |
| 9E54 | 1400047B0 | .pdata | ExceptionHook | Pointer to 47B0 - 0x3BB0 .text + UnwindInfo: .rdata |
| 9E60 | 140004860 | .pdata | ExceptionHook | Pointer to 4860 - 0x3C60 .text + UnwindInfo: .rdata |
| 9E6C | 1400048C0 | .pdata | ExceptionHook | Pointer to 48C0 - 0x3CC0 .text + UnwindInfo: .rdata |
| 9E78 | 140004C80 | .pdata | ExceptionHook | Pointer to 4C80 - 0x4080 .text + UnwindInfo: .rdata |
| 9E84 | 140004E00 | .pdata | ExceptionHook | Pointer to 4E00 - 0x4200 .text + UnwindInfo: .rdata |
| 9E90 | 140004E70 | .pdata | ExceptionHook | Pointer to 4E70 - 0x4270 .text + UnwindInfo: .rdata |
| 9E9C | 140005000 | .pdata | ExceptionHook | Pointer to 5000 - 0x4400 .text + UnwindInfo: .rdata |
| 9EA8 | 140005150 | .pdata | ExceptionHook | Pointer to 5150 - 0x4550 .text + UnwindInfo: .rdata |
| 9EB4 | 140005290 | .pdata | ExceptionHook | Pointer to 5290 - 0x4690 .text + UnwindInfo: .rdata |
| 9EC0 | 1400052F0 | .pdata | ExceptionHook | Pointer to 52F0 - 0x46F0 .text + UnwindInfo: .rdata |
| 9ECC | 140005400 | .pdata | ExceptionHook | Pointer to 5400 - 0x4800 .text + UnwindInfo: .rdata |
| 9ED8 | 140005750 | .pdata | ExceptionHook | Pointer to 5750 - 0x4B50 .text + UnwindInfo: .rdata |
| 9EE4 | 140005940 | .pdata | ExceptionHook | Pointer to 5940 - 0x4D40 .text + UnwindInfo: .rdata |
| 9EF0 | 140005980 | .pdata | ExceptionHook | Pointer to 5980 - 0x4D80 .text + UnwindInfo: .rdata |
| 9EFC | 1400059F0 | .pdata | ExceptionHook | Pointer to 59F0 - 0x4DF0 .text + UnwindInfo: .rdata |
| 9F08 | 140005A90 | .pdata | ExceptionHook | Pointer to 5A90 - 0x4E90 .text + UnwindInfo: .rdata |
| 9F14 | 140005DA0 | .pdata | ExceptionHook | Pointer to 5DA0 - 0x51A0 .text + UnwindInfo: .rdata |
| 9F20 | 140005F60 | .pdata | ExceptionHook | Pointer to 5F60 - 0x5360 .text + UnwindInfo: .rdata |
| 9F2C | 140005FD0 | .pdata | ExceptionHook | Pointer to 5FD0 - 0x53D0 .text + UnwindInfo: .rdata |
| 9F38 | 1400060D0 | .pdata | ExceptionHook | Pointer to 60D0 - 0x54D0 .text + UnwindInfo: .rdata |
| 9F44 | 140006100 | .pdata | ExceptionHook | Pointer to 6100 - 0x5500 .text + UnwindInfo: .rdata |
| 9F50 | 140006170 | .pdata | ExceptionHook | Pointer to 6170 - 0x5570 .text + UnwindInfo: .rdata |
| 9F5C | 1400061A0 | .pdata | ExceptionHook | Pointer to 61A0 - 0x55A0 .text + UnwindInfo: .rdata |
| 9F68 | 140006200 | .pdata | ExceptionHook | Pointer to 6200 - 0x5600 .text + UnwindInfo: .rdata |
| 9F74 | 140006260 | .pdata | ExceptionHook | Pointer to 6260 - 0x5660 .text + UnwindInfo: .rdata |
| 9F80 | 1400062C0 | .pdata | ExceptionHook | Pointer to 62C0 - 0x56C0 .text + UnwindInfo: .rdata |
| 9F8C | 140006330 | .pdata | ExceptionHook | Pointer to 6330 - 0x5730 .text + UnwindInfo: .rdata |
| 9F98 | 140006390 | .pdata | ExceptionHook | Pointer to 6390 - 0x5790 .text + UnwindInfo: .rdata |
| 9FA4 | 1400063E0 | .pdata | ExceptionHook | Pointer to 63E0 - 0x57E0 .text + UnwindInfo: .rdata |
| 40A | 14000101D | .text | Entry Point Backward Redirect | Score=1/7 - Redirects=1 - PreJumpInstructions=2 - JumpType=JMP_NEAR - TargetOffset=0x41D - TargetSection=.text - Confidence=Low |
| 2AC00 | N/A | *Overlay* | 00000000580B0000080000000200000002000000 | ....X............... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 112401 | 60,4775% |
| Null Byte Code | 37481 | 20,1667% |
© 2026 All rights reserved.