PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,34 MB SHA-256 Hash: F7D67D6A8A49950B65A194E10BC64A7926EB5A746591DBBC988B6D0822F4BEA5 SHA-1 Hash: 058779C99047913EBA975D2F8EFD0528FA097E38 MD5 Hash: 98CE6A2868D7E4D478AD4BABE38642C5 Imphash: 7D043CC67477B403381754094E665A4F MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00158D50 EntryPoint (rva): 106880 SizeOfHeaders: 400 SizeOfImage: 15C000 ImageBase: 10000000 Architecture: x86 ExportTable: 13BA50 ImportTable: 1431EC IAT: 11B000 Characteristics: 2122 TimeDateStamp: 6742441F Date: 23/11/2024 21:07:43 File Type: DLL Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows Console UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 119600 | 1000 | 1195FD |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
119A00 | 29200 | 11B000 | 2912E |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
142C00 | 3E00 | 145000 | 6FC1 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
146A00 | 600 | 14C000 | 5A0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
147000 | E400 | 14D000 | E2BC |
|
|
| Description |
| OriginalFilename: git2-3f4182d.dll LegalCopyright: Copyright (C) the libgit2 contributors. All rights reserved. ProductName: libgit2 FileVersion: 1.8.4 FileDescription: libgit2 - the Git linkable library ProductVersion: 1.8.4 Comments: For more information visit https://libgit2.org/ Language: English (United States) (ID=0x409) CodePage: Western European (Windows 1252) (0x4E4) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 105C80 Code -> 558BEC837D0C017505E862000000FF7510FF750CFF7508E8AEFEFFFF83C40C5DC20C00558BEC83EC148365F4008D45F48365 Assembler |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X1010688E |CALL 0X101068F0 |PUSH DWORD PTR [EBP + 0X10] |PUSH DWORD PTR [EBP + 0XC] |PUSH DWORD PTR [EBP + 8] |CALL 0X1010674A |ADD ESP, 0XC |POP EBP |RET 0XC |PUSH EBP |MOV EBP, ESP |SUB ESP, 0X14 |AND DWORD PTR [EBP - 0XC], 0 |LEA EAX, [EBP - 0XC] |
| Signatures |
| CheckSum Integrity Problem: • Header: 1412432 • Calculated: 1410761 Rich Signature Analyzer: Code -> 407B1839041A766A041A766A041A766A617C756B0A1A766A617C736BA11A766A617C726B161A766A62758B6A071A766A566F736B1A1A766A566F726B0B1A766A566F756B131A766A617C776B0F1A766A041A776ABF1A766AC96F7E6BD81A766AC96F766B051A766AC96F896A051A766A041AE16A051A766AC96F746B051A766A52696368041A766A Footprint md5 Hash -> 869FD1D10C12DDEB3A88B8BF289AA816 • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed but has been modified |
| Packer/Compiler |
| Detect It Easy (die) • PE: linker: Microsoft Linker(14.29**)[-] • PE: Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 6.79667 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| ADVAPI32.DLL | CryptAcquireContextA | Acquires a cryptographic provider context. |
| ADVAPI32.DLL | CryptReleaseContext | Releases a cryptographic provider context. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ET Functions (carving) |
| git_annotated_commit_free git_annotated_commit_from_fetchhead git_annotated_commit_from_ref git_annotated_commit_from_revspec git_annotated_commit_id git_annotated_commit_lookup git_annotated_commit_ref git_apply git_apply_options_init git_apply_to_tree git_attr_add_macro git_attr_cache_flush git_attr_foreach git_attr_foreach_ext git_attr_get git_attr_get_ext git_attr_get_many git_attr_get_many_ext git_attr_value git_blame_buffer git_blame_file git_blame_free git_blame_get_hunk_byindex git_blame_get_hunk_byline git_blame_get_hunk_count git_blame_init_options git_blame_options_init git_blob_create_from_buffer git_blob_create_from_disk git_blob_create_from_stream git_blob_create_from_stream_commit git_blob_create_from_workdir git_blob_create_frombuffer git_blob_create_fromdisk git_blob_create_fromstream git_blob_create_fromstream_commit git_blob_create_fromworkdir git_blob_data_is_binary git_blob_dup git_blob_filter git_blob_filter_options_init git_blob_filtered_content git_blob_free git_blob_id git_blob_is_binary git_blob_lookup git_blob_lookup_prefix git_blob_owner git_blob_rawcontent git_blob_rawsize git_branch_create git_branch_create_from_annotated git_branch_delete git_branch_is_checked_out git_branch_is_head git_branch_iterator_free git_branch_iterator_new git_branch_lookup git_branch_move git_branch_name git_branch_name_is_valid git_branch_next git_branch_remote_name git_branch_set_upstream git_branch_upstream git_branch_upstream_merge git_branch_upstream_name git_branch_upstream_remote git_buf_contains_nul git_buf_dispose git_buf_free git_buf_grow git_buf_is_binary git_buf_set git_checkout_head git_checkout_index git_checkout_init_options git_checkout_options_init git_checkout_tree git_cherrypick git_cherrypick_commit git_cherrypick_init_options git_cherrypick_options_init git_clone git_clone_init_options git_clone_options_init git_commit_amend git_commit_author git_commit_author_with_mailmap git_commit_body git_commit_committer git_commit_committer_with_mailmap git_commit_create git_commit_create_buffer git_commit_create_from_callback git_commit_create_from_ids git_commit_create_from_stage git_commit_create_v git_commit_create_with_signature git_commit_dup git_commit_extract_signature git_commit_free git_commit_graph_free git_commit_graph_open git_commit_graph_writer_add_index_file git_commit_graph_writer_add_revwalk git_commit_graph_writer_commit git_commit_graph_writer_dump git_commit_graph_writer_free git_commit_graph_writer_new git_commit_graph_writer_options_init git_commit_header_field git_commit_id git_commit_lookup git_commit_lookup_prefix git_commit_message git_commit_message_encoding git_commit_message_raw git_commit_nth_gen_ancestor git_commit_owner git_commit_parent git_commit_parent_id git_commit_parentcount git_commit_raw_header git_commit_summary git_commit_time git_commit_time_offset git_commit_tree git_commit_tree_id git_commitarray_dispose git_config_add_backend git_config_add_file_ondisk git_config_backend_foreach_match git_config_delete_entry git_config_delete_multivar git_config_entry_free git_config_find_global git_config_find_programdata git_config_find_system git_config_find_xdg git_config_foreach git_config_foreach_match git_config_free git_config_get_bool git_config_get_entry git_config_get_int32 git_config_get_int64 git_config_get_mapped git_config_get_multivar_foreach git_config_get_path git_config_get_string git_config_get_string_buf git_config_init_backend git_config_iterator_free git_config_iterator_glob_new git_config_iterator_new git_config_lock git_config_lookup_map_value git_config_multivar_iterator_new git_config_new git_config_next git_config_open_default git_config_open_global git_config_open_level git_config_open_ondisk git_config_parse_bool git_config_parse_int32 git_config_parse_int64 git_config_parse_path git_config_set_bool git_config_set_int32 git_config_set_int64 git_config_set_multivar git_config_set_string git_config_set_writeorder git_config_snapshot git_config_unlock git_cred_default_new git_cred_free git_cred_get_username git_cred_has_username git_cred_ssh_custom_new git_cred_ssh_interactive_new git_cred_ssh_key_from_agent git_cred_ssh_key_memory_new git_cred_ssh_key_new git_cred_username_new git_cred_userpass git_cred_userpass_plaintext_new git_credential_default_new git_credential_free git_credential_get_username git_credential_has_username git_credential_ssh_custom_new git_credential_ssh_interactive_new git_credential_ssh_key_from_agent git_credential_ssh_key_memory_new git_credential_ssh_key_new git_credential_username_new git_credential_userpass git_credential_userpass_plaintext_new git_describe_commit git_describe_format git_describe_format_options_init git_describe_init_format_options git_describe_init_options git_describe_options_init git_describe_result_free git_describe_workdir git_diff_blob_to_buffer git_diff_blobs git_diff_buffers git_diff_commit_as_email git_diff_find_init_options git_diff_find_options_init git_diff_find_similar git_diff_foreach git_diff_format_email git_diff_format_email_init_options git_diff_format_email_options_init git_diff_free git_diff_from_buffer git_diff_get_delta git_diff_get_perfdata git_diff_get_stats git_diff_index_to_index git_diff_index_to_workdir git_diff_init_options git_diff_is_sorted_icase git_diff_merge git_diff_num_deltas git_diff_num_deltas_of_type git_diff_options_init git_diff_patchid git_diff_patchid_options_init git_diff_print git_diff_print_callback__to_buf git_diff_print_callback__to_file_handle git_diff_stats_deletions git_diff_stats_files_changed git_diff_stats_free git_diff_stats_insertions git_diff_stats_to_buf git_diff_status_char git_diff_to_buf git_diff_tree_to_index git_diff_tree_to_tree git_diff_tree_to_workdir git_diff_tree_to_workdir_with_index git_email_create_from_commit git_email_create_from_diff git_error_clear git_error_last git_error_set git_error_set_oom git_error_set_str git_fetch_init_options git_fetch_options_init git_filter_init git_filter_list_apply_to_blob git_filter_list_apply_to_buffer git_filter_list_apply_to_data git_filter_list_apply_to_file git_filter_list_contains git_filter_list_free git_filter_list_length git_filter_list_load git_filter_list_load_ext git_filter_list_new git_filter_list_push git_filter_list_stream_blob git_filter_list_stream_buffer git_filter_list_stream_data git_filter_list_stream_file git_filter_lookup git_filter_register git_filter_source_filemode git_filter_source_flags git_filter_source_id git_filter_source_mode git_filter_source_path git_filter_source_repo git_filter_unregister git_graph_ahead_behind git_graph_descendant_of git_graph_reachable_from_any git_hashsig_compare git_hashsig_create git_hashsig_create_fromfile git_hashsig_free git_ignore_add_rule git_ignore_clear_internal_rules git_ignore_path_is_ignored git_index_add git_index_add_all git_index_add_bypath git_index_add_from_buffer git_index_add_frombuffer git_index_caps git_index_checksum git_index_clear git_index_conflict_add git_index_conflict_cleanup git_index_conflict_get git_index_conflict_iterator_free git_index_conflict_iterator_new git_index_conflict_next git_index_conflict_remove git_index_entry_is_conflict git_index_entry_stage git_index_entrycount git_index_find git_index_find_prefix git_index_free git_index_get_byindex git_index_get_bypath git_index_has_conflicts git_index_iterator_free git_index_iterator_new git_index_iterator_next git_index_name_add git_index_name_clear git_index_name_entrycount git_index_name_get_byindex git_index_new git_index_open git_index_owner git_index_path git_index_read git_index_read_tree git_index_remove git_index_remove_all git_index_remove_bypath git_index_remove_directory git_index_reuc_add git_index_reuc_clear git_index_reuc_entrycount git_index_reuc_find git_index_reuc_get_byindex git_index_reuc_get_bypath git_index_reuc_remove git_index_set_caps git_index_set_version git_index_update_all git_index_version git_index_write git_index_write_tree git_index_write_tree_to git_indexer_append git_indexer_commit git_indexer_free git_indexer_hash git_indexer_init_options git_indexer_name git_indexer_new git_indexer_options_init git_libgit2_features git_libgit2_init git_libgit2_opts git_libgit2_prerelease git_libgit2_shutdown git_libgit2_version git_mailmap_add_entry git_mailmap_free git_mailmap_from_buffer git_mailmap_from_repository git_mailmap_new git_mailmap_resolve git_mailmap_resolve_signature git_mempack_dump git_mempack_new git_mempack_reset git_merge git_merge_analysis git_merge_analysis_for_ref git_merge_base git_merge_base_many git_merge_base_octopus git_merge_bases git_merge_bases_many git_merge_commits git_merge_driver_lookup git_merge_driver_register git_merge_driver_source_ancestor git_merge_driver_source_file_options git_merge_driver_source_ours git_merge_driver_source_repo git_merge_driver_source_theirs git_merge_driver_unregister git_merge_file git_merge_file_from_index git_merge_file_init_input git_merge_file_init_options git_merge_file_input_init git_merge_file_options_init git_merge_file_result_free git_merge_init_options git_merge_options_init git_merge_trees git_message_prettify git_message_trailer_array_free • EXPORT FUNCTIONS > 400 |
| Windows REG (UNICODE) |
| SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Git_is1 SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Git_is1 |
| File Access |
| ADVAPI32.dll KERNEL32.dll Secur32.dll WS2_32.dll CRYPT32.dll git2-3f4182d.dll bcrypt.dll .dat index_map.dat @.dat core.log file.txt Temp |
| File Access (UNICODE) |
| git2-3f4182d.dll git.exe mscoree.dll AppData UserProfile |
| Interest's Words |
| Encrypt Decrypt PassWord exec attrib start pause cipher hostname shutdown systeminfo ping expand replace |
| URLs |
| http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt http://www.microsoft.com/pkiops/docs/primarycps.htm http://www.microsoft.com http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt http://www.microsoft.com/pkiops/Docs/Repository.htm http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt |
| URLs (UNICODE) |
| https://libgit2.org/ |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Linux System Shell - (/bin/sh) |
| Text | Ascii | Information used to authenticate a user’s identity (Credential) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\1033 | 14C0A0 | 380 | 146AA0 | 800334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000800 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\2\1033 | 14C420 | 17D | 146E20 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • git2-3f4182d.dll • .git • mscoree.dll • D:\a\libgit2sharp.nativebinaries\libgit2sharp.nativebinaries\libgit2\src\util\alloc.h • D:\a\libgit2sharp.nativebinaries\libgit2sharp.nativebinaries\libgit2\src\util\errors.c • bcrypt.dll • core.eol • packfile is missing %Iu objects.idx • file.txt • remote.%s.url • .url • repository path %.*s is not owned by current user/.git • hooks/README.sample!/bin/sh • submodule.%s.url • submodule.%s.updateremote.origin.url • git.exe • git.cmd • .bss • resolver128.tmp |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 469 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E9 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 55C | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5C4 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 61A | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 155B | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B56 | 1011B0D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B72 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BC1 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BD6 | 1011B0D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C06 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C2E | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C48 | 1011B0D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C58 | 1011B0D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C7E | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CA6 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CB7 | 1011B0DC | .text | CALL [static] | Indirect call to absolute memory address |
| 1CC5 | 1011B0E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1DF0 | 1011B090 | .text | CALL [static] | Indirect call to absolute memory address |
| 1EBF | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1ECC | 1011B08C | .text | CALL [static] | Indirect call to absolute memory address |
| 2074 | 1011B08C | .text | CALL [static] | Indirect call to absolute memory address |
| 2097 | 1011B0D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2149 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2249 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 225D | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 22A2 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 22B6 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2311 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2632 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2650 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2675 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2690 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 26D6 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 29E7 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B09 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B30 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D59 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F81 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 301A | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 310E | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3162 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 322E | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 32C0 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 32F5 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 334B | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 33A9 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 35A2 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3672 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3D44 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3DA8 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E60 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F38 | 1011B094 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FC2 | 1011B0A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FD1 | 1011B0A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4299 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 45F3 | 1011B0A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4684 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 46E3 | 1011B090 | .text | CALL [static] | Indirect call to absolute memory address |
| 470C | 1011B0A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4721 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 47A9 | 1011B0B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 47B5 | 1011B0B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 47C1 | 1011B0B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 47CD | 1011B0B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 47DC | 1011B09C | .text | CALL [static] | Indirect call to absolute memory address |
| 492B | 1011B098 | .text | CALL [static] | Indirect call to absolute memory address |
| 49D7 | 1011B0A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CAF | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CE8 | 1011B0A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FB6 | 1011B004 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FCE | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FF8 | 1011B03C | .text | CALL [static] | Indirect call to absolute memory address |
| 501A | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 50A9 | 1011B040 | .text | CALL [static] | Indirect call to absolute memory address |
| 50D2 | 1011B048 | .text | CALL [static] | Indirect call to absolute memory address |
| 510E | 1011B0B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 519B | 1011B0A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 51A2 | 1011B00C | .text | CALL [static] | Indirect call to absolute memory address |
| 51C2 | 1011B02C | .text | CALL [static] | Indirect call to absolute memory address |
| 51CC | 1011B090 | .text | CALL [static] | Indirect call to absolute memory address |
| 51FE | 1011B02C | .text | CALL [static] | Indirect call to absolute memory address |
| 523A | 1011B0AC | .text | CALL [static] | Indirect call to absolute memory address |
| 5249 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 525D | 1011B038 | .text | CALL [static] | Indirect call to absolute memory address |
| 526F | 1011B044 | .text | CALL [static] | Indirect call to absolute memory address |
| 527C | 1011B044 | .text | CALL [static] | Indirect call to absolute memory address |
| 529A | 1011B008 | .text | CALL [static] | Indirect call to absolute memory address |
| 52B7 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 52CE | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 531A | 1011B164 | .text | CALL [static] | Indirect call to absolute memory address |
| 53EB | 1011B168 | .text | CALL [static] | Indirect call to absolute memory address |
| 5583 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5787 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 57DE | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 59C9 | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5A2F | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5ABD | 1011B2C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5C69 | 1011B0F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5C90 | 1011B0AC | .text | CALL [static] | Indirect call to absolute memory address |
| 593B2-593CF | N/A | .text | Unusual BP Cave, count: 30 |
| 6D142-6D15F | N/A | .text | Unusual BP Cave, count: 30 |
| 9C3D1-9C3EF | N/A | .text | Unusual BP Cave, count: 31 |
| C9ED2-C9EFF | N/A | .text | Unusual BP Cave, count: 46 |
| 155400 | N/A | *Overlay* | 30280000000202003082281F06092A864886F70D | 0(......0.(...*.H...) |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 921212 | 65,4248% |
| Null Byte Code | 142268 | 10,1039% |
© 2026 All rights reserved.