PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 292,00 KB SHA-256 Hash: 09F54265A3D2B1062AA2B3F6A5A51551E1EFD518CF8944BFDB58E651D141A605 SHA-1 Hash: C3158DD05E08B3193C7FF136B8C3885563550B1C MD5 Hash: 72A301001175E4436B583454E5A871CB Imphash: DDEDCE17C7C760FBDB1E5DF5068A4CED MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 0004AFE7 EntryPoint (rva): C4A4 SizeOfHeaders: 400 SizeOfImage: 4E000 ImageBase: 0000000180000000 Architecture: x64 ExportTable: 422E0 ImportTable: 42390 IAT: 2B000 Characteristics: 2022 TimeDateStamp: 69ECBDCC Date: 25/04/2026 13:12:44 File Type: DLL Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, _RDATA, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 29E00 | 1000 | 29D30 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
2A200 | 18200 | 2B000 | 18026 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
42400 | 3800 | 44000 | 4EB4 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
45C00 | 2400 | 49000 | 23AC |
|
|
| _RDATA | 0x40000040 Initialized Data Readable |
48000 | 200 | 4C000 | F4 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
48200 | E00 | 4D000 | C24 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - B8A4 Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8230700004C8BC78BD3488BCE488B5C2430488B7424 Assembler |MOV QWORD PTR [RSP + 8], RBX |MOV QWORD PTR [RSP + 0X10], RSI |PUSH RDI |SUB RSP, 0X20 |MOV RDI, R8 |MOV EBX, EDX |MOV RSI, RCX |CMP EDX, 1 |JNE 0X18000C4C5 |CALL 0X18000CBE8 |MOV R8, RDI |MOV EDX, EBX |MOV RCX, RSI |MOV RBX, QWORD PTR [RSP + 0X30] |
| Signatures |
| Rich Signature Analyzer: Code -> 5F65041D1B046A4E1B046A4E1B046A4EFF74694F11046A4EFF746F4F82046A4E49716E4F15046A4E4971694F11046A4E49716F4F53046A4E1B046A4E19046A4E127CF94E19046A4EFF746E4F08046A4EFF746B4F16046A4E1B046B4E61046A4ED671634F19046A4ED6716A4F1A046A4ED671684F1A046A4E526963681B046A4E Footprint md5 Hash -> 3DC9D89392D23F928A114305DA961853 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.29**)[-] • Entropy: 6.17646 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| ADVAPI32.DLL | RegCreateKeyExW | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| ET Functions (carving) |
| Original Name -> WebViewVideoPreview.dll DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer |
| Windows REG (UNICODE) |
| SOFTWARE\Microsoft\Windows\CurrentVersion\PreviewHandlers |
| File Access |
| KERNEL32.dll WebView2Loader.dll api-ms-win-core-winrt-error-l1-1-0.dll GDI32.dll ADVAPI32.dll SHELL32.dll USER32.dll ole32.dll WebViewVideoPreview.dll .dat @.dat |
| File Access (UNICODE) |
| mscoree.dll |
| Interest's Words |
| exec start |
| Interest's Words (UNICODE) |
| <html <body <script pause |
| URLs (UNICODE) |
| http://preview.local/ |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Intelligent String |
| • mscoree.dll • .ini • .bss • USER32.dll • api-ms-win-core-winrt-error-l1-1-0.dll • WebView2Loader.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 418 | N/A | .text | CALL QWORD PTR [RIP+0x2A08A] |
| 580 | N/A | .text | CALL QWORD PTR [RIP+0x29F52] |
| 59D | N/A | .text | CALL QWORD PTR [RIP+0x29F25] |
| 5B0 | N/A | .text | CALL QWORD PTR [RIP+0x29F12] |
| 5B9 | N/A | .text | CALL QWORD PTR [RIP+0x29F29] |
| 15DE | N/A | .text | CALL QWORD PTR [RIP+0x28EEC] |
| 162C | N/A | .text | CALL QWORD PTR [RIP+0x28E76] |
| 1678 | N/A | .text | CALL QWORD PTR [RIP+0x28E2A] |
| 171D | N/A | .text | CALL QWORD PTR [RIP+0x28D8D] |
| 1977 | N/A | .text | CALL QWORD PTR [RIP+0x28B43] |
| 1F26 | N/A | .text | CALL QWORD PTR [RIP+0x28584] |
| 203E | N/A | .text | CALL QWORD PTR [RIP+0x283CC] |
| 2076 | N/A | .text | CALL QWORD PTR [RIP+0x283A4] |
| 20A5 | N/A | .text | CALL QWORD PTR [RIP+0x28375] |
| 20B0 | N/A | .text | CALL QWORD PTR [RIP+0x28352] |
| 221D | N/A | .text | CALL QWORD PTR [RIP+0x281ED] |
| 226C | N/A | .text | CALL QWORD PTR [RIP+0x281AE] |
| 229B | N/A | .text | CALL QWORD PTR [RIP+0x2817F] |
| 22A6 | N/A | .text | CALL QWORD PTR [RIP+0x2815C] |
| 22E1 | N/A | .text | CALL QWORD PTR [RIP+0x28129] |
| 2329 | N/A | .text | CALL QWORD PTR [RIP+0x280E1] |
| 235F | N/A | .text | CALL QWORD PTR [RIP+0x280BB] |
| 236A | N/A | .text | CALL QWORD PTR [RIP+0x28098] |
| 24D0 | N/A | .text | CALL QWORD PTR [RIP+0x27F3A] |
| 24F5 | N/A | .text | CALL QWORD PTR [RIP+0x27F25] |
| 2500 | N/A | .text | CALL QWORD PTR [RIP+0x27F02] |
| 2560 | N/A | .text | CALL QWORD PTR [RIP+0x281AA] |
| 28D9 | N/A | .text | CALL QWORD PTR [RIP+0x27B39] |
| 294C | N/A | .text | CALL QWORD PTR [RIP+0x27AAE] |
| 2961 | N/A | .text | CALL QWORD PTR [RIP+0x27AC1] |
| 296B | N/A | .text | CALL QWORD PTR [RIP+0x27A97] |
| 2991 | N/A | .text | CALL QWORD PTR [RIP+0x27A69] |
| 29A6 | N/A | .text | CALL QWORD PTR [RIP+0x27A7C] |
| 29B0 | N/A | .text | CALL QWORD PTR [RIP+0x27A52] |
| 2A3E | N/A | .text | CALL QWORD PTR [RIP+0x279D4] |
| 2A51 | N/A | .text | CALL QWORD PTR [RIP+0x27CB9] |
| 37DB | N/A | .text | CALL QWORD PTR [RIP+0x26F7F] |
| 4631 | N/A | .text | CALL QWORD PTR [RIP+0x34011] |
| 4ACB | N/A | .text | CALL QWORD PTR [RIP+0x25A1F] |
| 4ADD | N/A | .text | CALL QWORD PTR [RIP+0x25A05] |
| 4B08 | N/A | .text | CALL QWORD PTR [RIP+0x259D2] |
| 4B1B | N/A | .text | CALL QWORD PTR [RIP+0x259BF] |
| 4B58 | N/A | .text | CALL QWORD PTR [RIP+0x2597A] |
| 4B6F | N/A | .text | CALL QWORD PTR [RIP+0x25943] |
| 4B7E | N/A | .text | CALL QWORD PTR [RIP+0x25964] |
| 4B98 | N/A | .text | CALL QWORD PTR [RIP+0x2592A] |
| 4F4A | N/A | .text | CALL QWORD PTR [RIP+0x25810] |
| 50D7 | N/A | .text | CALL QWORD PTR [RIP+0x25683] |
| 678D | N/A | .text | CALL QWORD PTR [RIP+0x23F95] |
| 6805 | N/A | .text | CALL QWORD PTR [RIP+0x23F1D] |
| 686C | N/A | .text | CALL QWORD PTR [RIP+0x23ECE] |
| 68B9 | N/A | .text | CALL QWORD PTR [RIP+0x23E79] |
| 6A3D | N/A | .text | CALL QWORD PTR [RIP+0x23CC5] |
| 6B69 | N/A | .text | CALL QWORD PTR [RIP+0x23C01] |
| 6DA4 | N/A | .text | CALL QWORD PTR [RIP+0x239A6] |
| 87E6 | N/A | .text | CALL QWORD PTR [RIP+0x21CC4] |
| 89BD | N/A | .text | CALL QWORD PTR [RIP+0x21B35] |
| 8A1E | N/A | .text | CALL QWORD PTR [RIP+0x21A9C] |
| 8D35 | N/A | .text | CALL QWORD PTR [RIP+0x217CD] |
| 8DB7 | N/A | .text | CALL QWORD PTR [RIP+0x2174B] |
| 90B5 | N/A | .text | CALL QWORD PTR [RIP+0x21665] |
| 910B | N/A | .text | CALL QWORD PTR [RIP+0x21327] |
| 911F | N/A | .text | CALL QWORD PTR [RIP+0x2160B] |
| 936B | N/A | .text | CALL QWORD PTR [RIP+0x213FF] |
| 9383 | N/A | .text | CALL QWORD PTR [RIP+0x213EF] |
| 9392 | N/A | .text | CALL QWORD PTR [RIP+0x21168] |
| 944D | N/A | .text | CALL QWORD PTR [RIP+0x21325] |
| 945B | N/A | .text | CALL QWORD PTR [RIP+0x2109F] |
| 9579 | N/A | .text | CALL QWORD PTR [RIP+0x211F1] |
| 959E | N/A | .text | CALL QWORD PTR [RIP+0x20F5C] |
| 9626 | N/A | .text | CALL QWORD PTR [RIP+0x20ED4] |
| 9669 | N/A | .text | CALL QWORD PTR [RIP+0x21101] |
| 968E | N/A | .text | CALL QWORD PTR [RIP+0x20E6C] |
| 9716 | N/A | .text | CALL QWORD PTR [RIP+0x20DE4] |
| 9759 | N/A | .text | CALL QWORD PTR [RIP+0x21011] |
| 977E | N/A | .text | CALL QWORD PTR [RIP+0x20D7C] |
| 9806 | N/A | .text | CALL QWORD PTR [RIP+0x20CF4] |
| 99CB | N/A | .text | CALL QWORD PTR [RIP+0x20D9F] |
| 99E1 | N/A | .text | CALL QWORD PTR [RIP+0x20D89] |
| 99F4 | N/A | .text | CALL QWORD PTR [RIP+0x20D76] |
| 9A07 | N/A | .text | CALL QWORD PTR [RIP+0x20D63] |
| 9BE6 | N/A | .text | CALL QWORD PTR [RIP+0x20B8C] |
| A41C | N/A | .text | CALL QWORD PTR [RIP+0x200EE] |
| A447 | N/A | .text | CALL QWORD PTR [RIP+0x200C3] |
| A9F0 | N/A | .text | CALL QWORD PTR [RIP+0x1FDA2] |
| AA13 | N/A | .text | CALL QWORD PTR [RIP+0x1FD7F] |
| AA72 | N/A | .text | CALL QWORD PTR [RIP+0x1FD20] |
| AA8E | N/A | .text | CALL QWORD PTR [RIP+0x1FD04] |
| ABB7 | N/A | .text | CALL QWORD PTR [RIP+0x1FBDB] |
| ABD3 | N/A | .text | CALL QWORD PTR [RIP+0x1FBBF] |
| AC5F | N/A | .text | CALL QWORD PTR [RIP+0x1FB33] |
| AC78 | N/A | .text | CALL QWORD PTR [RIP+0x1FB1A] |
| ACB4 | N/A | .text | CALL QWORD PTR [RIP+0x1FADE] |
| AD57 | N/A | .text | CALL QWORD PTR [RIP+0x1F7BB] |
| AD8C | N/A | .text | CALL QWORD PTR [RIP+0x1F786] |
| AFC0 | N/A | .text | CALL QWORD PTR [RIP+0x1F542] |
| B05D | N/A | .text | JMP QWORD PTR [RIP+0x1F4D5] |
| B06D | N/A | .text | JMP QWORD PTR [RIP+0x1F4BD] |
| B075 | N/A | .text | JMP QWORD PTR [RIP+0x1F4A5] |
| B07D | N/A | .text | JMP QWORD PTR [RIP+0x1F4A5] |
| 45C00 | 180001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 45C0C | 18000104C | .pdata | ExceptionHook | Pointer to 104C - 0x44C .text + UnwindInfo: .rdata |
| 45C18 | 180001084 | .pdata | ExceptionHook | Pointer to 1084 - 0x484 .text + UnwindInfo: .rdata |
| 45C24 | 180001100 | .pdata | ExceptionHook | Pointer to 1100 - 0x500 .text + UnwindInfo: .rdata |
| 45C30 | 180001210 | .pdata | ExceptionHook | Pointer to 1210 - 0x610 .text + UnwindInfo: .rdata |
| 45C3C | 180001270 | .pdata | ExceptionHook | Pointer to 1270 - 0x670 .text + UnwindInfo: .rdata |
| 45C48 | 180001310 | .pdata | ExceptionHook | Pointer to 1310 - 0x710 .text + UnwindInfo: .rdata |
| 45C54 | 180001330 | .pdata | ExceptionHook | Pointer to 1330 - 0x730 .text + UnwindInfo: .rdata |
| 45C60 | 180001370 | .pdata | ExceptionHook | Pointer to 1370 - 0x770 .text + UnwindInfo: .rdata |
| 45C6C | 1800013B0 | .pdata | ExceptionHook | Pointer to 13B0 - 0x7B0 .text + UnwindInfo: .rdata |
| 45C78 | 1800013D0 | .pdata | ExceptionHook | Pointer to 13D0 - 0x7D0 .text + UnwindInfo: .rdata |
| 45C84 | 180001420 | .pdata | ExceptionHook | Pointer to 1420 - 0x820 .text + UnwindInfo: .rdata |
| 45C90 | 1800014A0 | .pdata | ExceptionHook | Pointer to 14A0 - 0x8A0 .text + UnwindInfo: .rdata |
| 45C9C | 180001740 | .pdata | ExceptionHook | Pointer to 1740 - 0xB40 .text + UnwindInfo: .rdata |
| 45CA8 | 180001790 | .pdata | ExceptionHook | Pointer to 1790 - 0xB90 .text + UnwindInfo: .rdata |
| 45CB4 | 1800017F0 | .pdata | ExceptionHook | Pointer to 17F0 - 0xBF0 .text + UnwindInfo: .rdata |
| 45CC0 | 180001850 | .pdata | ExceptionHook | Pointer to 1850 - 0xC50 .text + UnwindInfo: .rdata |
| 45CCC | 180001900 | .pdata | ExceptionHook | Pointer to 1900 - 0xD00 .text + UnwindInfo: .rdata |
| 45CD8 | 180001960 | .pdata | ExceptionHook | Pointer to 1960 - 0xD60 .text + UnwindInfo: .rdata |
| 45CE4 | 180001980 | .pdata | ExceptionHook | Pointer to 1980 - 0xD80 .text + UnwindInfo: .rdata |
| 45CF0 | 1800019C0 | .pdata | ExceptionHook | Pointer to 19C0 - 0xDC0 .text + UnwindInfo: .rdata |
| 45CFC | 180001A10 | .pdata | ExceptionHook | Pointer to 1A10 - 0xE10 .text + UnwindInfo: .rdata |
| 45D08 | 180001A40 | .pdata | ExceptionHook | Pointer to 1A40 - 0xE40 .text + UnwindInfo: .rdata |
| 45D14 | 180001C00 | .pdata | ExceptionHook | Pointer to 1C00 - 0x1000 .text + UnwindInfo: .rdata |
| 45D20 | 180001C50 | .pdata | ExceptionHook | Pointer to 1C50 - 0x1050 .text + UnwindInfo: .rdata |
| 45D2C | 180001CC0 | .pdata | ExceptionHook | Pointer to 1CC0 - 0x10C0 .text + UnwindInfo: .rdata |
| 45D38 | 180001D40 | .pdata | ExceptionHook | Pointer to 1D40 - 0x1140 .text + UnwindInfo: .rdata |
| 45D44 | 180001D55 | .pdata | ExceptionHook | Pointer to 1D55 - 0x1155 .text + UnwindInfo: .rdata |
| 45D50 | 180001D7C | .pdata | ExceptionHook | Pointer to 1D7C - 0x117C .text + UnwindInfo: .rdata |
| 45D5C | 180001DA0 | .pdata | ExceptionHook | Pointer to 1DA0 - 0x11A0 .text + UnwindInfo: .rdata |
| 45D68 | 180001DB5 | .pdata | ExceptionHook | Pointer to 1DB5 - 0x11B5 .text + UnwindInfo: .rdata |
| 45D74 | 180001DDC | .pdata | ExceptionHook | Pointer to 1DDC - 0x11DC .text + UnwindInfo: .rdata |
| 45D80 | 180001DF0 | .pdata | ExceptionHook | Pointer to 1DF0 - 0x11F0 .text + UnwindInfo: .rdata |
| 45D8C | 180001E40 | .pdata | ExceptionHook | Pointer to 1E40 - 0x1240 .text + UnwindInfo: .rdata |
| 45D98 | 180001E56 | .pdata | ExceptionHook | Pointer to 1E56 - 0x1256 .text + UnwindInfo: .rdata |
| 45DA4 | 180001ECE | .pdata | ExceptionHook | Pointer to 1ECE - 0x12CE .text + UnwindInfo: .rdata |
| 45DB0 | 180001EE0 | .pdata | ExceptionHook | Pointer to 1EE0 - 0x12E0 .text + UnwindInfo: .rdata |
| 45DBC | 180001F40 | .pdata | ExceptionHook | Pointer to 1F40 - 0x1340 .text + UnwindInfo: .rdata |
| 45DC8 | 180001F70 | .pdata | ExceptionHook | Pointer to 1F70 - 0x1370 .text + UnwindInfo: .rdata |
| 45DD4 | 180001FD3 | .pdata | ExceptionHook | Pointer to 1FD3 - 0x13D3 .text + UnwindInfo: .rdata |
| 45DE0 | 180001FF0 | .pdata | ExceptionHook | Pointer to 1FF0 - 0x13F0 .text + UnwindInfo: .rdata |
| 45DEC | 180002050 | .pdata | ExceptionHook | Pointer to 2050 - 0x1450 .text + UnwindInfo: .rdata |
| 45DF8 | 180002130 | .pdata | ExceptionHook | Pointer to 2130 - 0x1530 .text + UnwindInfo: .rdata |
| 45E04 | 180002190 | .pdata | ExceptionHook | Pointer to 2190 - 0x1590 .text + UnwindInfo: .rdata |
| 45E10 | 1800021D0 | .pdata | ExceptionHook | Pointer to 21D0 - 0x15D0 .text + UnwindInfo: .rdata |
| 45E1C | 180002200 | .pdata | ExceptionHook | Pointer to 2200 - 0x1600 .text + UnwindInfo: .rdata |
| 45E28 | 180002260 | .pdata | ExceptionHook | Pointer to 2260 - 0x1660 .text + UnwindInfo: .rdata |
| 45E34 | 1800022B0 | .pdata | ExceptionHook | Pointer to 22B0 - 0x16B0 .text + UnwindInfo: .rdata |
| 45E40 | 1800029F0 | .pdata | ExceptionHook | Pointer to 29F0 - 0x1DF0 .text + UnwindInfo: .rdata |
| 45E4C | 180002AF0 | .pdata | ExceptionHook | Pointer to 2AF0 - 0x1EF0 .text + UnwindInfo: .rdata |
| 45E58 | 180002BE4 | .pdata | ExceptionHook | Pointer to 2BE4 - 0x1FE4 .text + UnwindInfo: .rdata |
| 45E64 | 18000334A | .pdata | ExceptionHook | Pointer to 334A - 0x274A .text + UnwindInfo: .rdata |
| 45E70 | 180003350 | .pdata | ExceptionHook | Pointer to 3350 - 0x2750 .text + UnwindInfo: .rdata |
| 45E7C | 180003356 | .pdata | ExceptionHook | Pointer to 3356 - 0x2756 .text + UnwindInfo: .rdata |
| 45E88 | 180003370 | .pdata | ExceptionHook | Pointer to 3370 - 0x2770 .text + UnwindInfo: .rdata |
| 45E94 | 1800037A0 | .pdata | ExceptionHook | Pointer to 37A0 - 0x2BA0 .text + UnwindInfo: .rdata |
| 45EA0 | 180003818 | .pdata | ExceptionHook | Pointer to 3818 - 0x2C18 .text + UnwindInfo: .rdata |
| 45EAC | 18000387D | .pdata | ExceptionHook | Pointer to 387D - 0x2C7D .text + UnwindInfo: .rdata |
| 45EB8 | 1800038B0 | .pdata | ExceptionHook | Pointer to 38B0 - 0x2CB0 .text + UnwindInfo: .rdata |
| 45EC4 | 180003B00 | .pdata | ExceptionHook | Pointer to 3B00 - 0x2F00 .text + UnwindInfo: .rdata |
| 45ED0 | 180003BDF | .pdata | ExceptionHook | Pointer to 3BDF - 0x2FDF .text + UnwindInfo: .rdata |
| 45EDC | 180003C89 | .pdata | ExceptionHook | Pointer to 3C89 - 0x3089 .text + UnwindInfo: .rdata |
| 45EE8 | 180003CF0 | .pdata | ExceptionHook | Pointer to 3CF0 - 0x30F0 .text + UnwindInfo: .rdata |
| 45EF4 | 180003E50 | .pdata | ExceptionHook | Pointer to 3E50 - 0x3250 .text + UnwindInfo: .rdata |
| 45F00 | 180003E73 | .pdata | ExceptionHook | Pointer to 3E73 - 0x3273 .text + UnwindInfo: .rdata |
| 45F0C | 180003EFE | .pdata | ExceptionHook | Pointer to 3EFE - 0x32FE .text + UnwindInfo: .rdata |
| 45F18 | 180003F20 | .pdata | ExceptionHook | Pointer to 3F20 - 0x3320 .text + UnwindInfo: .rdata |
| 45F24 | 180003F43 | .pdata | ExceptionHook | Pointer to 3F43 - 0x3343 .text + UnwindInfo: .rdata |
| 45F30 | 180003FCE | .pdata | ExceptionHook | Pointer to 3FCE - 0x33CE .text + UnwindInfo: .rdata |
| 45F3C | 180003FF0 | .pdata | ExceptionHook | Pointer to 3FF0 - 0x33F0 .text + UnwindInfo: .rdata |
| 45F48 | 180004040 | .pdata | ExceptionHook | Pointer to 4040 - 0x3440 .text + UnwindInfo: .rdata |
| 45F54 | 1800040A0 | .pdata | ExceptionHook | Pointer to 40A0 - 0x34A0 .text + UnwindInfo: .rdata |
| 45F60 | 180004340 | .pdata | ExceptionHook | Pointer to 4340 - 0x3740 .text + UnwindInfo: .rdata |
| 45F6C | 180004360 | .pdata | ExceptionHook | Pointer to 4360 - 0x3760 .text + UnwindInfo: .rdata |
| 45F78 | 1800043D0 | .pdata | ExceptionHook | Pointer to 43D0 - 0x37D0 .text + UnwindInfo: .rdata |
| 45F84 | 180004410 | .pdata | ExceptionHook | Pointer to 4410 - 0x3810 .text + UnwindInfo: .rdata |
| 45F90 | 1800044C0 | .pdata | ExceptionHook | Pointer to 44C0 - 0x38C0 .text + UnwindInfo: .rdata |
| 45F9C | 180004600 | .pdata | ExceptionHook | Pointer to 4600 - 0x3A00 .text + UnwindInfo: .rdata |
| 45FA8 | 180004630 | .pdata | ExceptionHook | Pointer to 4630 - 0x3A30 .text + UnwindInfo: .rdata |
| 45FB4 | 180004790 | .pdata | ExceptionHook | Pointer to 4790 - 0x3B90 .text + UnwindInfo: .rdata |
| 45FC0 | 180004800 | .pdata | ExceptionHook | Pointer to 4800 - 0x3C00 .text + UnwindInfo: .rdata |
| 45FCC | 180004860 | .pdata | ExceptionHook | Pointer to 4860 - 0x3C60 .text + UnwindInfo: .rdata |
| 45FD8 | 1800048A0 | .pdata | ExceptionHook | Pointer to 48A0 - 0x3CA0 .text + UnwindInfo: .rdata |
| 45FE4 | 180004920 | .pdata | ExceptionHook | Pointer to 4920 - 0x3D20 .text + UnwindInfo: .rdata |
| 45FF0 | 180004960 | .pdata | ExceptionHook | Pointer to 4960 - 0x3D60 .text + UnwindInfo: .rdata |
| 45FFC | 180004A10 | .pdata | ExceptionHook | Pointer to 4A10 - 0x3E10 .text + UnwindInfo: .rdata |
| 46008 | 180004A80 | .pdata | ExceptionHook | Pointer to 4A80 - 0x3E80 .text + UnwindInfo: .rdata |
| 46014 | 180004AF0 | .pdata | ExceptionHook | Pointer to 4AF0 - 0x3EF0 .text + UnwindInfo: .rdata |
| 46020 | 180004B30 | .pdata | ExceptionHook | Pointer to 4B30 - 0x3F30 .text + UnwindInfo: .rdata |
| 4602C | 180004C00 | .pdata | ExceptionHook | Pointer to 4C00 - 0x4000 .text + UnwindInfo: .rdata |
| 46038 | 180004DA0 | .pdata | ExceptionHook | Pointer to 4DA0 - 0x41A0 .text + UnwindInfo: .rdata |
| 46044 | 180004E10 | .pdata | ExceptionHook | Pointer to 4E10 - 0x4210 .text + UnwindInfo: .rdata |
| 46050 | 180004E6B | .pdata | ExceptionHook | Pointer to 4E6B - 0x426B .text + UnwindInfo: .rdata |
| 4605C | 180004F44 | .pdata | ExceptionHook | Pointer to 4F44 - 0x4344 .text + UnwindInfo: .rdata |
| 46068 | 180004F60 | .pdata | ExceptionHook | Pointer to 4F60 - 0x4360 .text + UnwindInfo: .rdata |
| 46074 | 180004F70 | .pdata | ExceptionHook | Pointer to 4F70 - 0x4370 .text + UnwindInfo: .rdata |
| 46080 | 180004F93 | .pdata | ExceptionHook | Pointer to 4F93 - 0x4393 .text + UnwindInfo: .rdata |
| 4608C | 180004FD2 | .pdata | ExceptionHook | Pointer to 4FD2 - 0x43D2 .text + UnwindInfo: .rdata |
| 46098 | 180004FF0 | .pdata | ExceptionHook | Pointer to 4FF0 - 0x43F0 .text + UnwindInfo: .rdata |
| 460A4 | 180005170 | .pdata | ExceptionHook | Pointer to 5170 - 0x4570 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 167124 | 55,8928% |
| Null Byte Code | 73045 | 24,4291% |
© 2026 All rights reserved.