PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 554,00 KB SHA-256 Hash: 8A9710ED5301B8BF63069462797487D135DC24BEA673A8B8BCE02043BCE3CEC6 SHA-1 Hash: AC677181DC8661F911F47BD78A26F84A57CEB411 MD5 Hash: 66232DF0D41898AD130D4E357DDDA1EA Imphash: BB12BBEA6A8F4F528E6C4A5B7803EBC7 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 6F5A0 SizeOfHeaders: 400 SizeOfImage: 9A000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 84F94 IAT: 71000 Characteristics: 22 TimeDateStamp: 69E250B7 Date: 17/04/2026 15:24:39 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 6F800 | 1000 | 6F6C6 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
6FC00 | 15400 | 71000 | 152F4 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
85000 | A00 | 87000 | B6B8 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
85A00 | 4800 | 93000 | 477C |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
8A200 | 200 | 98000 | 1E0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
8A400 | 400 | 99000 | 28C |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 6E9A0 Code -> 4883EC28E80F0400004883C428E97AFEFFFFCCCC488D05C520000048C741100000000048894108488D05A220000048890148 Assembler |SUB RSP, 0X28 |CALL 0X1418 |ADD RSP, 0X28 |JMP 0XE8C |INT3 |INT3 |LEA RAX, [RIP + 0X20C5] |MOV QWORD PTR [RCX + 0X10], 0 |MOV QWORD PTR [RCX + 8], RAX |LEA RAX, [RIP + 0X20A2] |MOV QWORD PTR [RCX], RAX |
| Signatures |
| Rich Signature Analyzer: Code -> EA4B4AF8AE2A24ABAE2A24ABAE2A24ABA752B7ABBE2A24ABE5A027AAAA2A24ABE5A020AAA42A24ABE5A021AAB22A24ABE5A025AAA82A24ABD7AB25AABF2A24ABAE2A25AB1A2A24AB3FA12DAAB62A24AB3FA1DBABAF2A24AB3FA126AAAF2A24AB52696368AE2A24AB Footprint md5 Hash -> EBCC8580F37CEC3E354459534EB0DD53 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.50**)[-] • Entropy: 6.59629 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| File Access |
| api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-convert-l1-1-0.dll api-ms-win-crt-utility-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll VCRUNTIME140.dll VCRUNTIME140_1.dll d3d11.dll dwmapi.dll D3DCOMPILER_47.dll IMM32.dll MSVCP140.dll SHELL32.dll USER32.dll KERNEL32.dll engine2.dll client.dll +] engine2.dll +] client.dll ntdll.dll xinput1_1.dll xinput1_2.dll xinput9_1_0.dll xinput1_3.dll xinput1_4.dll .dat @.dat imgui_log.txt imgui.ini |
| Interest's Words |
| exec attrib start pause shutdown route |
| URLs |
| https://github.com/ocornut/imgui/blob/master/docs/FAQ.mdqa-usage |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Keyboard Key (Alt+) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (DownArrow) |
| Text | Ascii | Keyboard Key (RightArrow) |
| Text | Ascii | Keyboard Key (UpArrow) |
| Text | Ascii | Keyboard Key (LeftArrow) |
| Text | Ascii | Keyboard Key (PageDown) |
| Text | Ascii | Keyboard Key (PageUp) |
| Text | Ascii | Keyboard Key (CapsLock) |
| Text | Ascii | Keyboard Key (Backspace) |
| Text | Ascii | Keyboard Key (Ctrl+S) |
| Text | Ascii | Malicious code executed after exploiting a vulnerability (Payload) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\1\1033 | 98060 | 17D | 8A260 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version='1.0' encoding='UTF-8' standalone='y |
| Intelligent String |
| • api-ms-win-crt-string-l1-1-0.dll • api-ms-win-crt-convert-l1-1-0.dll • api-ms-win-crt-utility-l1-1-0.dll • api-ms-win-crt-stdio-l1-1-0.dll • xinput1_2.dll • xinput9_1_0.dll • imgui.ini • imgui_log.txt • (Hold Ctrl to: https://github.com/ocornut/imgui/blob/master/docs/FAQ.mdqa-usage • ProggyClean.ttfProggyForever.ttf • xinput1_4.dll • xinput1_3.dll • xinput1_1.dll • ntdll.dll • R:%0.3fG:%0.3fB:%0.3fA:%0.3fH:%0.3fS:%0.3fV:%0.3fM:0.000M:000 • C:\Windows\Fonts\segoeui.ttf • C:\Windows\Fonts\calibri.ttf • C:\Windows\Fonts\arial.ttf • C:\Windows\Fonts\seguisb.ttf • C:\Windows\Fonts\segoeuib.ttf • C:\Windows\Fonts\calibrib.ttf • C:\Windows\Fonts\arialbd.ttf • C:\Users\red\Desktop\CS2-External-Usermode-Cheat-main (2)\CS2-External-Usermode-Cheat-main\Spoof Call External\x64\Release\Spoof Call External.pdb • .tls • .bss • MSVCP140.dll • D3DCOMPILER_47.dll • dwmapi.dll • VCRUNTIME140_1.dll • VCRUNTIME140.dll • gterminateapi-ms-win-crt-heap-l1-1-0.dll • api-ms-win-crt-runtime-l1-1-0.dll • api-ms-win-crt-math-l1-1-0.dll • api-ms-win-crt-locale-l1-1-0.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 53D | N/A | .text | CALL QWORD PTR [RIP+0x7002D] |
| 546 | N/A | .text | CALL QWORD PTR [RIP+0x7001C] |
| 76F | N/A | .text | CALL QWORD PTR [RIP+0x6FDD3] |
| 830 | N/A | .text | CALL QWORD PTR [RIP+0x6FCE2] |
| 8FF | N/A | .text | CALL QWORD PTR [RIP+0x6FC43] |
| 9C0 | N/A | .text | CALL QWORD PTR [RIP+0x6FB52] |
| 20F7 | N/A | .text | CALL QWORD PTR [RIP+0x6E5AB] |
| 210E | N/A | .text | CALL QWORD PTR [RIP+0x6E594] |
| 21B5 | N/A | .text | CALL QWORD PTR [RIP+0x6E38D] |
| 2281 | N/A | .text | CALL QWORD PTR [RIP+0x6E291] |
| 232F | N/A | .text | CALL QWORD PTR [RIP+0x6E36B] |
| 234D | N/A | .text | CALL QWORD PTR [RIP+0x6E34D] |
| 23E3 | N/A | .text | CALL QWORD PTR [RIP+0x6E527] |
| 3C67 | N/A | .text | CALL QWORD PTR [RIP+0x6C8DB] |
| 3D30 | N/A | .text | CALL QWORD PTR [RIP+0x6C7E2] |
| 407D | N/A | .text | CALL QWORD PTR [RIP+0x6C4C5] |
| 4140 | N/A | .text | CALL QWORD PTR [RIP+0x6C3D2] |
| 42E5 | N/A | .text | CALL QWORD PTR [RIP+0x6C25D] |
| 43A3 | N/A | .text | CALL QWORD PTR [RIP+0x6C16F] |
| 44FA | N/A | .text | CALL QWORD PTR [RIP+0x6C288] |
| 4564 | N/A | .text | CALL QWORD PTR [RIP+0x6C35E] |
| 4585 | N/A | .text | CALL QWORD PTR [RIP+0x6C365] |
| 45E4 | N/A | .text | CALL QWORD PTR [RIP+0x6C2E6] |
| 467A | N/A | .text | CALL QWORD PTR [RIP+0x6C108] |
| 471B | N/A | .text | CALL QWORD PTR [RIP+0x6C067] |
| 47A0 | N/A | .text | CALL QWORD PTR [RIP+0x6BFE2] |
| 485F | N/A | .text | CALL QWORD PTR [RIP+0x6BF23] |
| 48DF | N/A | .text | CALL QWORD PTR [RIP+0x6BEA3] |
| 4960 | N/A | .text | CALL QWORD PTR [RIP+0x6BE22] |
| 4981 | N/A | .text | JMP QWORD PTR [RIP+0x6BE11] |
| 4991 | N/A | .text | JMP QWORD PTR [RIP+0x6BDF1] |
| 5A03 | N/A | .text | CALL QWORD PTR [RIP+0x6AF07] |
| 5B7C | N/A | .text | CALL QWORD PTR [RIP+0x6AD8E] |
| 5CEC | N/A | .text | CALL QWORD PTR [RIP+0x6A846] |
| 5D0F | N/A | .text | CALL QWORD PTR [RIP+0x6A823] |
| 5D67 | N/A | .text | CALL QWORD PTR [RIP+0x6A7CB] |
| 5D87 | N/A | .text | CALL QWORD PTR [RIP+0x6A7AB] |
| 5D93 | N/A | .text | CALL QWORD PTR [RIP+0x6AB47] |
| 5E0D | N/A | .text | CALL QWORD PTR [RIP+0x6A975] |
| 5E95 | N/A | .text | CALL QWORD PTR [RIP+0x6AA15] |
| 5EB1 | N/A | .text | CALL QWORD PTR [RIP+0x6AA41] |
| 5EC2 | N/A | .text | CALL QWORD PTR [RIP+0x6A9E8] |
| 5EDC | N/A | .text | CALL QWORD PTR [RIP+0x6AA16] |
| 5F16 | N/A | .text | CALL QWORD PTR [RIP+0x6A9BC] |
| 5F24 | N/A | .text | CALL QWORD PTR [RIP+0x6A9D6] |
| 5F97 | N/A | .text | CALL QWORD PTR [RIP+0x6A7EB] |
| 5F9F | N/A | .text | CALL QWORD PTR [RIP+0x6A95B] |
| 5FB5 | N/A | .text | CALL QWORD PTR [RIP+0x6A945] |
| 6712 | N/A | .text | CALL QWORD PTR [RIP+0x6A1F8] |
| 67BE | N/A | .text | CALL QWORD PTR [RIP+0x6A14C] |
| 688A | N/A | .text | CALL QWORD PTR [RIP+0x69EF8] |
| 91B6 | N/A | .text | CALL QWORD PTR [RIP+0x675DC] |
| 94BE | N/A | .text | CALL QWORD PTR [RIP+0x672D4] |
| 9B6A | N/A | .text | CALL QWORD PTR [RIP+0x66C18] |
| 9C52 | N/A | .text | CALL QWORD PTR [RIP+0x66B30] |
| 9DA7 | N/A | .text | CALL QWORD PTR [RIP+0x669DB] |
| 9E27 | N/A | .text | CALL QWORD PTR [RIP+0x6695B] |
| 9F60 | N/A | .text | CALL QWORD PTR [RIP+0x66822] |
| A0DE | N/A | .text | CALL QWORD PTR [RIP+0x666A4] |
| A15E | N/A | .text | CALL QWORD PTR [RIP+0x66624] |
| A1DF | N/A | .text | CALL QWORD PTR [RIP+0x665A3] |
| A4A3 | N/A | .text | CALL QWORD PTR [RIP+0x662EF] |
| A6D0 | N/A | .text | CALL QWORD PTR [RIP+0x660B2] |
| A99F | N/A | .text | CALL QWORD PTR [RIP+0x65DE3] |
| AABA | N/A | .text | CALL QWORD PTR [RIP+0x65CC8] |
| AB76 | N/A | .text | CALL QWORD PTR [RIP+0x65C0C] |
| AC5F | N/A | .text | CALL QWORD PTR [RIP+0x65B23] |
| ACE9 | N/A | .text | CALL QWORD PTR [RIP+0x65A99] |
| AD73 | N/A | .text | CALL QWORD PTR [RIP+0x65A0F] |
| AE15 | N/A | .text | CALL QWORD PTR [RIP+0x6596D] |
| AEB7 | N/A | .text | CALL QWORD PTR [RIP+0x658CB] |
| AF41 | N/A | .text | CALL QWORD PTR [RIP+0x65841] |
| AFFE | N/A | .text | CALL QWORD PTR [RIP+0x65784] |
| B0C0 | N/A | .text | CALL QWORD PTR [RIP+0x656C2] |
| B1D1 | N/A | .text | CALL QWORD PTR [RIP+0x655B1] |
| B1EF | N/A | .text | CALL QWORD PTR [RIP+0x656D3] |
| B1FD | N/A | .text | CALL QWORD PTR [RIP+0x656FD] |
| B6D2 | N/A | .text | CALL QWORD PTR [RIP+0x650B0] |
| B752 | N/A | .text | CALL QWORD PTR [RIP+0x65030] |
| B7D3 | N/A | .text | CALL QWORD PTR [RIP+0x64FAF] |
| B868 | N/A | .text | CALL QWORD PTR [RIP+0x64F1A] |
| B928 | N/A | .text | CALL QWORD PTR [RIP+0x64E5A] |
| B9BF | N/A | .text | CALL QWORD PTR [RIP+0x64DC3] |
| BA59 | N/A | .text | CALL QWORD PTR [RIP+0x64D29] |
| C3D9 | N/A | .text | CALL QWORD PTR [RIP+0x643B9] |
| C4B9 | N/A | .text | CALL QWORD PTR [RIP+0x642D9] |
| D2D2 | N/A | .text | CALL QWORD PTR [RIP+0x634B0] |
| DD67 | N/A | .text | CALL QWORD PTR [RIP+0x62A1B] |
| DEF5 | N/A | .text | CALL QWORD PTR [RIP+0x6288D] |
| E625 | N/A | .text | CALL QWORD PTR [RIP+0x6232D] |
| 1053F | N/A | .text | CALL QWORD PTR [RIP+0x60253] |
| 13D5D | N/A | .text | CALL QWORD PTR [RIP+0x5CA25] |
| 142E5 | N/A | .text | JMP QWORD PTR [RIP+0xC000000] |
| 1461B | N/A | .text | JMP QWORD PTR [RIP+0x5000000] |
| 15AE9 | N/A | .text | CALL QWORD PTR [RIP+0x5AE11] |
| 15AF8 | N/A | .text | CALL QWORD PTR [RIP+0x5AE0A] |
| 164FE | N/A | .text | CALL QWORD PTR [RIP+0x5A284] |
| 1660B | N/A | .text | CALL QWORD PTR [RIP+0x5A177] |
| 21FDF | N/A | .text | JMP QWORD PTR [RIP+0x4E903] |
| 2239E | N/A | .text | CALL QWORD PTR [RIP+0x4E3E4] |
| 85A00 | 1000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 85A0C | 1080 | .pdata | ExceptionHook | Pointer to 1080 - 0x480 .text + UnwindInfo: .rdata |
| 85A18 | 1130 | .pdata | ExceptionHook | Pointer to 1130 - 0x530 .text + UnwindInfo: .rdata |
| 85A24 | 1210 | .pdata | ExceptionHook | Pointer to 1210 - 0x610 .text + UnwindInfo: .rdata |
| 85A30 | 28D0 | .pdata | ExceptionHook | Pointer to 28D0 - 0x1CD0 .text + UnwindInfo: .rdata |
| 85A3C | 2900 | .pdata | ExceptionHook | Pointer to 2900 - 0x1D00 .text + UnwindInfo: .rdata |
| 85A48 | 2A70 | .pdata | ExceptionHook | Pointer to 2A70 - 0x1E70 .text + UnwindInfo: .rdata |
| 85A54 | 2C80 | .pdata | ExceptionHook | Pointer to 2C80 - 0x2080 .text + UnwindInfo: .rdata |
| 85A60 | 2FA0 | .pdata | ExceptionHook | Pointer to 2FA0 - 0x23A0 .text + UnwindInfo: .rdata |
| 85A6C | 3000 | .pdata | ExceptionHook | Pointer to 3000 - 0x2400 .text + UnwindInfo: .rdata |
| 85A78 | 303B | .pdata | ExceptionHook | Pointer to 303B - 0x243B .text + UnwindInfo: .rdata |
| 85A84 | 306B | .pdata | ExceptionHook | Pointer to 306B - 0x246B .text + UnwindInfo: .rdata |
| 85A90 | 3BDE | .pdata | ExceptionHook | Pointer to 3BDE - 0x2FDE .text + UnwindInfo: .rdata |
| 85A9C | 3BFE | .pdata | ExceptionHook | Pointer to 3BFE - 0x2FFE .text + UnwindInfo: .rdata |
| 85AA8 | 3C20 | .pdata | ExceptionHook | Pointer to 3C20 - 0x3020 .text + UnwindInfo: .rdata |
| 85AB4 | 3C53 | .pdata | ExceptionHook | Pointer to 3C53 - 0x3053 .text + UnwindInfo: .rdata |
| 85AC0 | 3CF2 | .pdata | ExceptionHook | Pointer to 3CF2 - 0x30F2 .text + UnwindInfo: .rdata |
| 85ACC | 410C | .pdata | ExceptionHook | Pointer to 410C - 0x350C .text + UnwindInfo: .rdata |
| 85AD8 | 412C | .pdata | ExceptionHook | Pointer to 412C - 0x352C .text + UnwindInfo: .rdata |
| 85AE4 | 4150 | .pdata | ExceptionHook | Pointer to 4150 - 0x3550 .text + UnwindInfo: .rdata |
| 85AF0 | 4440 | .pdata | ExceptionHook | Pointer to 4440 - 0x3840 .text + UnwindInfo: .rdata |
| 85AFC | 4484 | .pdata | ExceptionHook | Pointer to 4484 - 0x3884 .text + UnwindInfo: .rdata |
| 85B08 | 4530 | .pdata | ExceptionHook | Pointer to 4530 - 0x3930 .text + UnwindInfo: .rdata |
| 85B14 | 4780 | .pdata | ExceptionHook | Pointer to 4780 - 0x3B80 .text + UnwindInfo: .rdata |
| 85B20 | 4DC0 | .pdata | ExceptionHook | Pointer to 4DC0 - 0x41C0 .text + UnwindInfo: .rdata |
| 85B2C | 5020 | .pdata | ExceptionHook | Pointer to 5020 - 0x4420 .text + UnwindInfo: .rdata |
| 85B38 | 5070 | .pdata | ExceptionHook | Pointer to 5070 - 0x4470 .text + UnwindInfo: .rdata |
| 85B44 | 5110 | .pdata | ExceptionHook | Pointer to 5110 - 0x4510 .text + UnwindInfo: .rdata |
| 85B50 | 5140 | .pdata | ExceptionHook | Pointer to 5140 - 0x4540 .text + UnwindInfo: .rdata |
| 85B5C | 51A0 | .pdata | ExceptionHook | Pointer to 51A0 - 0x45A0 .text + UnwindInfo: .rdata |
| 85B68 | 5200 | .pdata | ExceptionHook | Pointer to 5200 - 0x4600 .text + UnwindInfo: .rdata |
| 85B74 | 5290 | .pdata | ExceptionHook | Pointer to 5290 - 0x4690 .text + UnwindInfo: .rdata |
| 85B80 | 53E0 | .pdata | ExceptionHook | Pointer to 53E0 - 0x47E0 .text + UnwindInfo: .rdata |
| 85B8C | 55A0 | .pdata | ExceptionHook | Pointer to 55A0 - 0x49A0 .text + UnwindInfo: .rdata |
| 85B98 | 5850 | .pdata | ExceptionHook | Pointer to 5850 - 0x4C50 .text + UnwindInfo: .rdata |
| 85BA4 | 5A60 | .pdata | ExceptionHook | Pointer to 5A60 - 0x4E60 .text + UnwindInfo: .rdata |
| 85BB0 | 5A8B | .pdata | ExceptionHook | Pointer to 5A8B - 0x4E8B .text + UnwindInfo: .rdata |
| 85BBC | 5B15 | .pdata | ExceptionHook | Pointer to 5B15 - 0x4F15 .text + UnwindInfo: .rdata |
| 85BC8 | 5B20 | .pdata | ExceptionHook | Pointer to 5B20 - 0x4F20 .text + UnwindInfo: .rdata |
| 85BD4 | 5BE0 | .pdata | ExceptionHook | Pointer to 5BE0 - 0x4FE0 .text + UnwindInfo: .rdata |
| 85BE0 | 5C70 | .pdata | ExceptionHook | Pointer to 5C70 - 0x5070 .text + UnwindInfo: .rdata |
| 85BEC | 5C95 | .pdata | ExceptionHook | Pointer to 5C95 - 0x5095 .text + UnwindInfo: .rdata |
| 85BF8 | 5E57 | .pdata | ExceptionHook | Pointer to 5E57 - 0x5257 .text + UnwindInfo: .rdata |
| 85C04 | 5E60 | .pdata | ExceptionHook | Pointer to 5E60 - 0x5260 .text + UnwindInfo: .rdata |
| 85C10 | 5E86 | .pdata | ExceptionHook | Pointer to 5E86 - 0x5286 .text + UnwindInfo: .rdata |
| 85C1C | 5FD8 | .pdata | ExceptionHook | Pointer to 5FD8 - 0x53D8 .text + UnwindInfo: .rdata |
| 85C28 | 5FE0 | .pdata | ExceptionHook | Pointer to 5FE0 - 0x53E0 .text + UnwindInfo: .rdata |
| 85C34 | 6005 | .pdata | ExceptionHook | Pointer to 6005 - 0x5405 .text + UnwindInfo: .rdata |
| 85C40 | 61FA | .pdata | ExceptionHook | Pointer to 61FA - 0x55FA .text + UnwindInfo: .rdata |
| 85C4C | 6210 | .pdata | ExceptionHook | Pointer to 6210 - 0x5610 .text + UnwindInfo: .rdata |
| 85C58 | 623D | .pdata | ExceptionHook | Pointer to 623D - 0x563D .text + UnwindInfo: .rdata |
| 85C64 | 62E1 | .pdata | ExceptionHook | Pointer to 62E1 - 0x56E1 .text + UnwindInfo: .rdata |
| 85C70 | 62F0 | .pdata | ExceptionHook | Pointer to 62F0 - 0x56F0 .text + UnwindInfo: .rdata |
| 85C7C | 65C0 | .pdata | ExceptionHook | Pointer to 65C0 - 0x59C0 .text + UnwindInfo: .rdata |
| 85C88 | 6640 | .pdata | ExceptionHook | Pointer to 6640 - 0x5A40 .text + UnwindInfo: .rdata |
| 85C94 | 6660 | .pdata | ExceptionHook | Pointer to 6660 - 0x5A60 .text + UnwindInfo: .rdata |
| 85CA0 | 6735 | .pdata | ExceptionHook | Pointer to 6735 - 0x5B35 .text + UnwindInfo: .rdata |
| 85CAC | 6741 | .pdata | ExceptionHook | Pointer to 6741 - 0x5B41 .text + UnwindInfo: .rdata |
| 85CB8 | 67C1 | .pdata | ExceptionHook | Pointer to 67C1 - 0x5BC1 .text + UnwindInfo: .rdata |
| 85CC4 | 67D3 | .pdata | ExceptionHook | Pointer to 67D3 - 0x5BD3 .text + UnwindInfo: .rdata |
| 85CD0 | 67E0 | .pdata | ExceptionHook | Pointer to 67E0 - 0x5BE0 .text + UnwindInfo: .rdata |
| 85CDC | 68A0 | .pdata | ExceptionHook | Pointer to 68A0 - 0x5CA0 .text + UnwindInfo: .rdata |
| 85CE8 | 6A50 | .pdata | ExceptionHook | Pointer to 6A50 - 0x5E50 .text + UnwindInfo: .rdata |
| 85CF4 | 6BE0 | .pdata | ExceptionHook | Pointer to 6BE0 - 0x5FE0 .text + UnwindInfo: .rdata |
| 85D00 | 6EF0 | .pdata | ExceptionHook | Pointer to 6EF0 - 0x62F0 .text + UnwindInfo: .rdata |
| 85D0C | 6FA0 | .pdata | ExceptionHook | Pointer to 6FA0 - 0x63A0 .text + UnwindInfo: .rdata |
| 85D18 | 6FF4 | .pdata | ExceptionHook | Pointer to 6FF4 - 0x63F4 .text + UnwindInfo: .rdata |
| 85D24 | 7140 | .pdata | ExceptionHook | Pointer to 7140 - 0x6540 .text + UnwindInfo: .rdata |
| 85D30 | 7160 | .pdata | ExceptionHook | Pointer to 7160 - 0x6560 .text + UnwindInfo: .rdata |
| 85D3C | 71F0 | .pdata | ExceptionHook | Pointer to 71F0 - 0x65F0 .text + UnwindInfo: .rdata |
| 85D48 | 72A0 | .pdata | ExceptionHook | Pointer to 72A0 - 0x66A0 .text + UnwindInfo: .rdata |
| 85D54 | 72D0 | .pdata | ExceptionHook | Pointer to 72D0 - 0x66D0 .text + UnwindInfo: .rdata |
| 85D60 | 7337 | .pdata | ExceptionHook | Pointer to 7337 - 0x6737 .text + UnwindInfo: .rdata |
| 85D6C | 733C | .pdata | ExceptionHook | Pointer to 733C - 0x673C .text + UnwindInfo: .rdata |
| 85D78 | 73D8 | .pdata | ExceptionHook | Pointer to 73D8 - 0x67D8 .text + UnwindInfo: .rdata |
| 85D84 | 73EE | .pdata | ExceptionHook | Pointer to 73EE - 0x67EE .text + UnwindInfo: .rdata |
| 85D90 | 7410 | .pdata | ExceptionHook | Pointer to 7410 - 0x6810 .text + UnwindInfo: .rdata |
| 85D9C | 74A0 | .pdata | ExceptionHook | Pointer to 74A0 - 0x68A0 .text + UnwindInfo: .rdata |
| 85DA8 | 7560 | .pdata | ExceptionHook | Pointer to 7560 - 0x6960 .text + UnwindInfo: .rdata |
| 85DB4 | 75D0 | .pdata | ExceptionHook | Pointer to 75D0 - 0x69D0 .text + UnwindInfo: .rdata |
| 85DC0 | 75F5 | .pdata | ExceptionHook | Pointer to 75F5 - 0x69F5 .text + UnwindInfo: .rdata |
| 85DCC | 764D | .pdata | ExceptionHook | Pointer to 764D - 0x6A4D .text + UnwindInfo: .rdata |
| 85DD8 | 7670 | .pdata | ExceptionHook | Pointer to 7670 - 0x6A70 .text + UnwindInfo: .rdata |
| 85DE4 | 7695 | .pdata | ExceptionHook | Pointer to 7695 - 0x6A95 .text + UnwindInfo: .rdata |
| 85DF0 | 76FC | .pdata | ExceptionHook | Pointer to 76FC - 0x6AFC .text + UnwindInfo: .rdata |
| 85DFC | 7720 | .pdata | ExceptionHook | Pointer to 7720 - 0x6B20 .text + UnwindInfo: .rdata |
| 85E08 | 7745 | .pdata | ExceptionHook | Pointer to 7745 - 0x6B45 .text + UnwindInfo: .rdata |
| 85E14 | 77AD | .pdata | ExceptionHook | Pointer to 77AD - 0x6BAD .text + UnwindInfo: .rdata |
| 85E20 | 77C0 | .pdata | ExceptionHook | Pointer to 77C0 - 0x6BC0 .text + UnwindInfo: .rdata |
| 85E2C | 7A30 | .pdata | ExceptionHook | Pointer to 7A30 - 0x6E30 .text + UnwindInfo: .rdata |
| 85E38 | 7A9B | .pdata | ExceptionHook | Pointer to 7A9B - 0x6E9B .text + UnwindInfo: .rdata |
| 85E44 | 7B89 | .pdata | ExceptionHook | Pointer to 7B89 - 0x6F89 .text + UnwindInfo: .rdata |
| 85E50 | 7D02 | .pdata | ExceptionHook | Pointer to 7D02 - 0x7102 .text + UnwindInfo: .rdata |
| 85E5C | 7D20 | .pdata | ExceptionHook | Pointer to 7D20 - 0x7120 .text + UnwindInfo: .rdata |
| 85E68 | 7D30 | .pdata | ExceptionHook | Pointer to 7D30 - 0x7130 .text + UnwindInfo: .rdata |
| 85E74 | 7D40 | .pdata | ExceptionHook | Pointer to 7D40 - 0x7140 .text + UnwindInfo: .rdata |
| 85E80 | 7D77 | .pdata | ExceptionHook | Pointer to 7D77 - 0x7177 .text + UnwindInfo: .rdata |
| 85E8C | 7E66 | .pdata | ExceptionHook | Pointer to 7E66 - 0x7266 .text + UnwindInfo: .rdata |
| 85E98 | 7FE5 | .pdata | ExceptionHook | Pointer to 7FE5 - 0x73E5 .text + UnwindInfo: .rdata |
| 85EA4 | 8006 | .pdata | ExceptionHook | Pointer to 8006 - 0x7406 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 364249 | 64,2079% |
| Null Byte Code | 84957 | 14,9758% |
© 2026 All rights reserved.