PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,81 MB SHA-256 Hash: 4EB1FBF29F86031E47808CBCAC92DFB4370FC4C0B63153F564AFCCEB9AC60578 SHA-1 Hash: F3BD28406010D371D0DCE5857B9A4FFF292AA822 MD5 Hash: 9EC7FECB849002A069D0C80B3DEC8396 Imphash: 5443E468F74CCCE9D330A54441FAD8D8 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 19D598 SizeOfHeaders: 400 SizeOfImage: 1DE000 ImageBase: 400000 Architecture: x86 ExportTable: 1B2000 ImportTable: 1AF000 IAT: 1AF3FC Characteristics: 2102 TimeDateStamp: 6A0FE9FA Date: 22/05/2026 5:30:34 File Type: DLL Number Of Sections: 10 ASLR: Enabled Section Names: .text, .itext, .data, .bss, .idata, .didata, .edata, .rdata, .reloc, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 19A200 | 1000 | 19A0C4 |
|
|
| .itext | 0x60000020 Code Executable Readable |
19A600 | 1600 | 19C000 | 15D4 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
19BC00 | 9400 | 19E000 | 9328 |
|
|
| .bss | 0xC0000000 Readable Writeable |
0 | 0 | 1A8000 | 6A90 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
1A5000 | 1800 | 1AF000 | 168A |
|
|
| .didata | 0xC0000040 Initialized Data Readable Writeable |
1A6800 | 600 | 1B1000 | 4F0 |
|
|
| .edata | 0x40000040 Initialized Data Readable |
1A6E00 | 200 | 1B2000 | 8B |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
1A7000 | 200 | 1B3000 | 45 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
1A7200 | 23400 | 1B4000 | 2335C |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1CA600 | 5600 | 1D8000 | 5600 |
|
|
| Description |
| ProductName: Project1 FileVersion: 1.0.0.0 FileDescription: Project1 ProductVersion: 1.0.0.0 Language: English (United States) (ID=0x409) CodePage: Western European (Windows 1252) (0x4E4) |
| Entry Point |
The section number (2) - (.itext) have the Entry Point Information -> EntryPoint (calculated) - 19BB98 Code -> 558BEC83C4C0B854595900E80C46E7FF33C05568C6D5590064FF3064892033C05A595964891068CDD5590058FFE0E9B1C2E6 Assembler |PUSH EBP |MOV EBP, ESP |ADD ESP, -0X40 |MOV EAX, 0X595954 |CALL 0XFFE7561C |XOR EAX, EAX |PUSH EBP |PUSH 0X59D5C6 |PUSH DWORD PTR FS:[EAX] |MOV DWORD PTR FS:[EAX], ESP |XOR EAX, EAX |POP EDX |POP ECX |POP ECX |MOV DWORD PTR FS:[EAX], EDX |PUSH 0X59D5CD |POP EAX |JMP EAX |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: compiler: Embarcadero Delphi(XE2-XE6)[-] • PE: linker: Turbo Linker(2.25*,Delphi)[-] • Entropy: 6.59505 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | WriteProcessMemory | Writes data to an area of memory in a specified process. |
| KERNEL32.DLL | ReadProcessMemory | Reads data from an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| Windows REG (UNICODE) |
| Software\HWiNFO32\Sens SOFTWARE\Microsoft\Windows NT\CurrentVersion Software\Embarcadero\Locales Software\CodeGear\Locales Software\Borland\Locales Software\Borland\Delphi\Locales |
| File Access |
| TTask.Exe TTask.Exe Project1.dll Crypt32.dll advapi32.dll kernel32.dll user32.dll winhttp.dll msvcrt.dll oleaut32.dll ole32.dll shell32.dll dSystem.Sys System.Sys SysInitSystemSystem.UITypesSystem.TypesSystem.SysConstSystem.Sys SysInitSystemSystem.UITypesSystem.TypesSystem.Sys System.Sys ?System.Sys &System.Dat System.Word,System.Dat System.Dat System.Dat lttInvalidSystem.Dat AddStrings(Strings.dat .dat System.Ini System.Zip System.Zip System.Zip.TStreamConstructor,System.Zip Temp |
| File Access (UNICODE) |
| GetLogicalProcessorInformationkernel32.dll kernel32.dll NTDLL.DLL %SystemRoot%\System32\attrib.exe winhttp.dll oleaut32.dll KERNEL32.dll PSAPI.dll opendocument.dat n-gage.dat dece.dat application/vnd.dat source.zip dece.zip Temp |
| SQL Queries |
| SELECT Manufacturer, Model FROM Win32_ComputerSystem SELECT Version FROM Win32_BIOS |
| Interest's Words |
| Encrypt Decrypt Encryption PassWord exec attrib start hostname shutdown systeminfo ping expand replace |
| Interest's Words (UNICODE) |
| Encrypt Encryption PassWord exec attrib start certreq ping expand route |
| URLs (UNICODE) |
| http://direct:80 https://api.cloudflare.com/client/v4/zones?per_page=1000 https://api.cloudflare.com/client/v4/ |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | WinAPI Sockets (bind) |
| Text | Unicode | WinAPI Sockets (accept) |
| Text | Unicode | WinAPI Sockets (connect) |
| Text | Unicode | WinAPI Sockets (send) |
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | Registry (RegDeleteKeyEx) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Reconnaissance (FindFirstFileW) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (GetThreadContext) |
| Text | Ascii | Stealth (SetThreadContext) |
| Text | Ascii | Stealth (ExitThread) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (UnmapViewOfFile) |
| Text | Ascii | Stealth (MapViewOfFile) |
| Text | Ascii | Stealth (CreateFileMappingW) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (ReadProcessMemory) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (CreateEventW) |
| Text | Unicode | Antivirus Software (etrust) |
| Text | Unicode | WMI execution (WbemScripting.SWbemLocator) |
| Text | Ascii | Ability of malware to remain on a system after a reboot (Persistence) |
| Text | Ascii | Process of gathering information about network resources (Enumeration) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Unicode | Information used for user authentication (Credential) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Text | Ascii | Technique used to capture communications between systems (Intercept) |
| Entry Point | Hex Pattern | Borland Delphi 4.0 |
| Entry Point | Hex Pattern | Borland Delphi v3.0 |
| Entry Point | Hex Pattern | Borland Delphi v6.0 - v7.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 - Debug |
| Entry Point | Hex Pattern | TrueVision Targa Graphics format |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \STRING\4077\0 | 1D8520 | 444 | 1CAB20 | 1E004500720072006F00720020006F00700065006E0069006E006700200072006500710075006500730074003A0020002800 | ..E.r.r.o.r. .o.p.e.n.i.n.g. .r.e.q.u.e.s.t.:. .(. |
| \STRING\4078\0 | 1D8964 | 414 | 1CAF64 | 110049006E00760061006C00690064002000550052004C003A0020002200250073002200180050006100720061006D006500 | ..I.n.v.a.l.i.d. .U.R.L.:. .".%.s."...P.a.r.a.m.e. |
| \STRING\4079\0 | 1D8D78 | 454 | 1CB378 | 1400560061006C00750065002000270025007300270020006E006F007400200066006F0075006E0064001E00560061006C00 | ..V.a.l.u.e. .'.%.s.'. .n.o.t. .f.o.u.n.d...V.a.l. |
| \STRING\4080\0 | 1D91CC | 5C0 | 1CB7CC | 1E0049006E00760061006C00690064002000740069006D00650020004F006600660073006500740020007300740072006900 | ..I.n.v.a.l.i.d. .t.i.m.e. .O.f.f.s.e.t. .s.t.r.i. |
| \STRING\4081\0 | 1D978C | 4FC | 1CBD8C | 21002E0020004F006E006C00790020006400650063006F006D007000720065007300730069006F006E002000690073002000 | !... .O.n.l.y. .d.e.c.o.m.p.r.e.s.s.i.o.n. .i.s. . |
| \STRING\4082\0 | 1D9C88 | 2CC | 1CC288 | 1300570069006E0064006F00770073002000530065007200760065007200200032003000300033001600570069006E006400 | ..W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3...W.i.n.d. |
| \STRING\4083\0 | 1D9F54 | 394 | 1CC554 | 3C0054007900700065002000270025007300270020006900730020006E006F00740020006400650063006C00610072006500 | <.T.y.p.e. .'.%.s.'. .i.s. .n.o.t. .d.e.c.l.a.r.e. |
| \STRING\4084\0 | 1DA2E8 | 498 | 1CC8E8 | 4400440065006300720065006D0065006E007400200061006D006F0075006E0074002000770069006C006C00200063006100 | D.D.e.c.r.e.m.e.n.t. .a.m.o.u.n.t. .w.i.l.l. .c.a. |
| \STRING\4085\0 | 1DA780 | 49C | 1CCD80 | 200054006800650020007300700065006300690066006900650064002000660069006C006500200077006100730020006E00 | .T.h.e. .s.p.e.c.i.f.i.e.d. .f.i.l.e. .w.a.s. .n. |
| \STRING\4086\0 | 1DAC1C | 49C | 1CD21C | 150054006800720065006100640020004500720072006F0072003A00200025007300200028002500640029002D0043006100 | ..T.h.r.e.a.d. .E.r.r.o.r.:. .%.s. .(.%.d.).-.C.a. |
| \STRING\4087\0 | 1DB0B8 | 36C | 1CD6B8 | 14002E0020002000250073002000720061006E0067006500200069007300200030002E002E00250064000E002E0020002000 | .... . .%.s. .r.a.n.g.e. .i.s. .0.....%.d..... . . |
| \STRING\4088\0 | 1DB424 | 3BC | 1CDA24 | 1F004100200063006C0061007300730020006E0061006D0065006400200025007300200061006C0072006500610064007900 | ..A. .c.l.a.s.s. .n.a.m.e.d. .%.s. .a.l.r.e.a.d.y. |
| \STRING\4089\0 | 1DB7E0 | 404 | 1CDDE0 | 140049006E00760061006C0069006400200073006F007500720063006500200061007200720061007900190049006E007600 | ..I.n.v.a.l.i.d. .s.o.u.r.c.e. .a.r.r.a.y...I.n.v. |
| \STRING\4090\0 | 1DBBE4 | F4 | 1CE1E4 | 080044006500630065006D006200650072000300530075006E0003004D006F006E0003005400750065000300570065006400 | ..D.e.c.e.m.b.e.r...S.u.n...M.o.n...T.u.e...W.e.d. |
| \STRING\4091\0 | 1DBCD8 | C4 | 1CE2D8 | 0300410075006700030053006500700003004F006300740003004E006F007600030044006500630007004A0061006E007500 | ..A.u.g...S.e.p...O.c.t...N.o.v...D.e.c...J.a.n.u. |
| \STRING\4092\0 | 1DBD9C | 25C | 1CE39C | 28004D006F006E00690074006F007200200073007500700070006F00720074002000660075006E006300740069006F006E00 | (.M.o.n.i.t.o.r. .s.u.p.p.o.r.t. .f.u.n.c.t.i.o.n. |
| \STRING\4093\0 | 1DBFF8 | 414 | 1CE5F8 | 2C0043007500730074006F006D002000760061007200690061006E0074002000740079007000650020002800250073002500 | ,.C.u.s.t.o.m. .v.a.r.i.a.n.t. .t.y.p.e. .(.%.s.%. |
| \STRING\4094\0 | 1DC40C | 37C | 1CEA0C | 280045007800630065007000740069006F006E00200025007300200069006E0020006D006F00640075006C00650020002500 | (.E.x.c.e.p.t.i.o.n. .%.s. .i.n. .m.o.d.u.l.e. .%. |
| \STRING\4095\0 | 1DC788 | 2DC | 1CED88 | 09004400690073006B002000660075006C006C00150049006E00760061006C006900640020006E0075006D00650072006900 | ..D.i.s.k. .f.u.l.l...I.n.v.a.l.i.d. .n.u.m.e.r.i. |
| \STRING\4096\0 | 1DCA64 | 344 | 1CF064 | 09003C0075006E006B006E006F0077006E003E002100270025007300270020006900730020006E006F007400200061002000 | ..<.u.n.k.n.o.w.n.>.!.'.%.s.'. .i.s. .n.o.t. .a. . |
| \RCDATA\DVCLAL\0 | 1DCDA8 | 10 | 1CF3A8 | 263D4F38C28237B8F3244203179B3A83 | &=O8..7..$B...:. |
| \RCDATA\PACKAGEINFO\0 | 1DCDB8 | 508 | 1CF3B8 | 0000108C0000000045000000013750726F6A65637431001C2A57696E6170692E57696E48545450001CF257696E6170692E57 | ........E....7Project1..*Winapi.WinHTTP...Winapi.W |
| \RCDATA\PLATFORMTARGETS\1033 | 1DD2C0 | 2 | 1CF8C0 | 0100 | .. |
| \VERSION\1\1033 | 1DD2C4 | 200 | 1CF8C4 | 000234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • 1.0.0.0 • advapi32.dll • kernel32.dll • winhttp.dll • ole32.dll • d3dx9_43.bin • System.Net.HttpClient.Win • System.Zip • NTDLL.DLL • .bss • PSAPI.dll • KERNEL32.dll • oleaut32.dll • dump • application/prs.cww • application/vnd.accpac.simply.aso • application/vnd.accpac.simply.imp • application/vnd.adobe.fxp • application/vnd.airzip.filesecure.azf • application/vnd.airzip.filesecure.azs • application/vnd.americandynamics.acc • application/vnd.amiga.ami • application/vnd.aristanetworks.swi • application/vnd.bmi • application/vnd.curl.car • application/vnd.data-vision.rdz • application/vnd.dece.zip • application/vnd.dna • application/vnd.dolby.mlp • application/vnd.dvb.ait • application/vnd.epson.esf • application/vnd.epson.msf • application/vnd.epson.ssf • application/vnd.fdf • application/vnd.frogans.fnc • application/vnd.frogans.ltf • application/vnd.fujixerox.ddd • application/vnd.gmx • application/vnd.google-earth.kmz • application/vnd.insors.igm • application/vnd.intu.qbo • application/vnd.intu.qfx • application/vnd.isac.fcs • application/vnd.jam • application/vnd.mcd • application/vnd.micrografx.flo • application/vnd.micrografx.igx • application/vnd.mif • application/vnd.mobius.daf • application/vnd.mobius.dis • application/vnd.mobius.mbk • application/vnd.mobius.mqy • application/vnd.mobius.msl • application/vnd.mobius.plc • application/vnd.mobius.txf • application/vnd.ms-pki.stl • application/vnd.neurolanguage.nlu • application/vnd.novadigm.edm • application/vnd.novadigm.edx • application/vnd.previewsystems.box • application/vnd.realvnc.bed • application/vnd.rim.cod • application/vnd.spotfire.dxp • application/vnd.spotfire.sfs • application/vnd.svd • application/vnd.tcpdump.pcap • application/vnd.trid.tpt • application/vnd.triscape.mxs • application/vnd.vcx • application/vnd.vsf • application/vnd.wqd • application/vnd.wt.stf • application/vnd.zul • audio/vnd.dra • audio/vnd.dts • audio/vnd.ms-playready.media.pya • audio/vnd.rip • image/vnd.dwg • image/vnd.dxf • image/vnd.fpx • image/vnd.fst • image/x-xwindowdump • model/vnd.dwf • model/vnd.gdl • model/vnd.gtw • model/vnd.mts • model/vnd.vtu • text/prs.lines.tag • text/vnd.fly • text/vnd.wap.wml • video/vnd.fvt • video/vnd.ms-playready.media.pyv • http://direct:80 • https://api.cloudflare.com/client/v4/zones?per_page=1000 • source.zip • %SystemRoot%\System32\attrib.exe • .exe • .ico • .lnk • SetThreadLocaleshell32.dll • MessageBoxWoleaut32.dll • VariantChangeTypemsvcrt.dll • user32.dll • MessageBoxAkernel32.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 462C | 5AF410 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4634 | 5AF464 | .text | JMP [static] | Indirect jump to absolute memory address |
| 463C | 5AF5C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4644 | 5AF51C | .text | JMP [static] | Indirect jump to absolute memory address |
| 464C | 5AF520 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4654 | 5AF590 | .text | JMP [static] | Indirect jump to absolute memory address |
| 465C | 5AF56C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4664 | 5AF524 | .text | JMP [static] | Indirect jump to absolute memory address |
| 466C | 5AF500 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4674 | 5AF540 | .text | JMP [static] | Indirect jump to absolute memory address |
| 467C | 5AF5CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 4684 | 5AF49C | .text | JMP [static] | Indirect jump to absolute memory address |
| 468C | 5AF4E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4694 | 5AF4C4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 469C | 5AF5C8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46A4 | 5AF448 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46AC | 5AF4BC | .text | JMP [static] | Indirect jump to absolute memory address |
| 46B4 | 5AF458 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BC | 5AF4EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 46C4 | 5AF490 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46CC | 5AF478 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46D4 | 5AF644 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46DC | 5AF538 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46E4 | 5AF494 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46EC | 5AF474 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46F4 | 5AF544 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46FC | 5AF514 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4704 | 5AF4DC | .text | JMP [static] | Indirect jump to absolute memory address |
| 470C | 5AF408 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4714 | 5AF594 | .text | JMP [static] | Indirect jump to absolute memory address |
| 471C | 5AF58C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4724 | 5AF5A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 472C | 5AF570 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4734 | 5AF5EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 473C | 5AF604 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4744 | 5AF5E0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 474C | 5AF638 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4754 | 5AF4A0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 477C | 5B10DC | .text | JMP [static] | Indirect jump to absolute memory address |
| 4784 | 5AF6E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 478C | 5AF6C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4794 | 5AF6DC | .text | JMP [static] | Indirect jump to absolute memory address |
| 479C | 5AF4B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47A4 | 5AF53C | .text | JMP [static] | Indirect jump to absolute memory address |
| 47AC | 5AF50C | .text | JMP [static] | Indirect jump to absolute memory address |
| 47B4 | 5AF580 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47BC | 5AF4F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47C4 | 5AF680 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47CC | 5AF674 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47D4 | 5AF66C | .text | JMP [static] | Indirect jump to absolute memory address |
| 47DC | 5AF57C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4804 | 5B10D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 480C | 5AF444 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4814 | 5AF44C | .text | JMP [static] | Indirect jump to absolute memory address |
| 481C | 5AF588 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4824 | 5AF568 | .text | JMP [static] | Indirect jump to absolute memory address |
| 482C | 5AF558 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4860 | 5AF534 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4868 | 5AF43C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4870 | 5AF4FC | .text | JMP [static] | Indirect jump to absolute memory address |
| 4878 | 5AF5C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6278 | 59E778 | .text | CALL [static] | Indirect call to absolute memory address |
| 6290 | 59E76C | .text | CALL [static] | Indirect call to absolute memory address |
| 62AC | 59E770 | .text | CALL [static] | Indirect call to absolute memory address |
| 62CD | 59E774 | .text | CALL [static] | Indirect call to absolute memory address |
| 62E6 | 59E770 | .text | CALL [static] | Indirect call to absolute memory address |
| 62FF | 59E76C | .text | CALL [static] | Indirect call to absolute memory address |
| 6373 | 5A8028 | .text | CALL [static] | Indirect call to absolute memory address |
| 63B2 | 5A8010 | .text | CALL [static] | Indirect call to absolute memory address |
| 6A47 | 59E048 | .text | CALL [static] | Indirect call to absolute memory address |
| 6A65 | 59E044 | .text | CALL [static] | Indirect call to absolute memory address |
| 6FE8 | 5A803C | .text | CALL [static] | Indirect call to absolute memory address |
| 74A2 | FFC0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 88D8 | 5A801C | .text | CALL [static] | Indirect call to absolute memory address |
| 88F6 | 5A801C | .text | CALL [static] | Indirect call to absolute memory address |
| 890E | 5A801C | .text | CALL [static] | Indirect call to absolute memory address |
| 8980 | 5A801C | .text | CALL [static] | Indirect call to absolute memory address |
| 89A0 | 5A801C | .text | CALL [static] | Indirect call to absolute memory address |
| 89BD | 5A801C | .text | CALL [static] | Indirect call to absolute memory address |
| 8A9A | 5A8020 | .text | CALL [static] | Indirect call to absolute memory address |
| 8B9F | 5A8018 | .text | CALL [static] | Indirect call to absolute memory address |
| 8C22 | 5A8020 | .text | CALL [static] | Indirect call to absolute memory address |
| 8DC2 | 5A801C | .text | JMP [static] | Indirect jump to absolute memory address |
| 8F48 | 5A8020 | .text | CALL [static] | Indirect call to absolute memory address |
| 93AF | 5A8364 | .text | CALL [static] | Indirect call to absolute memory address |
| 952C | 5A8038 | .text | CALL [static] | Indirect call to absolute memory address |
| 95D5 | 59E03C | .text | CALL [static] | Indirect call to absolute memory address |
| 963A | 59E040 | .text | CALL [static] | Indirect call to absolute memory address |
| AD81 | 59E010 | .text | CALL [static] | Indirect call to absolute memory address |
| B439 | 59E014 | .text | CALL [static] | Indirect call to absolute memory address |
| B520 | 59E018 | .text | CALL [static] | Indirect call to absolute memory address |
| D32B | FF | .text | JMP [static] | Indirect jump to absolute memory address |
| D763 | 5AAC08 | .text | CALL [static] | Indirect call to absolute memory address |
| D780 | 5AAC08 | .text | CALL [static] | Indirect call to absolute memory address |
| D7A1 | 5AAC10 | .text | CALL [static] | Indirect call to absolute memory address |
| D7FF | 5AAC0C | .text | CALL [static] | Indirect call to absolute memory address |
| D85C | 5AAC0C | .text | CALL [static] | Indirect call to absolute memory address |
| D88F | 5AAC0C | .text | CALL [static] | Indirect call to absolute memory address |
| FD2D | 59E054 | .text | CALL [static] | Indirect call to absolute memory address |
| 10908 | 5AF478 | .text | JMP [static] | Indirect jump to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1183944 | 62,3286% |
| Null Byte Code | 325371 | 17,1291% |
© 2026 All rights reserved.