PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 774,00 KBSHA-256 Hash: 57CACBF670C8053E3B65969FA079217EBB7D0A3BBDACD75A3B0C9A3FE250052D SHA-1 Hash: 004C199E60BB55AC15C62617405917162AA8DCFC MD5 Hash: C9727EC4FBA8A9E44445BB1E631A6FBA Imphash: 400D3C06F1A21768A2C75BF3C81D2F6B MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 000AA99D EntryPoint (rva): 13D0 SizeOfHeaders: 400 SizeOfImage: C8000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: A3000 IAT: A3728 Characteristics: 22E TimeDateStamp: 6A2D3142 Date: 13/06/2026 10:30:26 File Type: EXE Number Of Sections: 11 ASLR: Disabled Section Names (Optional Header): .text, .data, .rdata, .pdata, .xdata, .bss, .idata, .CRT, .tls, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 5B000 | 1000 | 5AFD0 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
5B400 | C00 | 5C000 | AB0 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
5C000 | 3C200 | 5D000 | 3C168 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
98200 | 2600 | 9A000 | 2574 |
|
|
| .xdata | 0x40000040 Initialized Data Readable |
9A800 | 4800 | 9D000 | 4690 |
|
|
| .bss | 0xC0000080 Uninitialized Data Readable Writeable |
0 | 0 | A2000 | 1E0 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
9F000 | 1E00 | A3000 | 1DD4 |
|
|
| .CRT | 0xC0000040 Initialized Data Readable Writeable |
A0E00 | 200 | A5000 | 68 |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
A1000 | 200 | A6000 | 10 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
A1200 | 20000 | A7000 | 1FFC8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
C1200 | 600 | C7000 | 4C4 |
|
|
| Description |
| OriginalFilename: yami-wisp.exe CompanyName: Yami LegalCopyright: Yami LauncherGPL-3.0-only ProductName: Yami Launcher FileVersion: 1.1.3.0 FileDescription: Yami Launcher ProductVersion: 1.1.3.0 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 7D0 Code -> 4883EC28488B05757C0900C70001000000E89AFDFFFF90904883C428C30F1F004883EC28488B05557C0900C70000000000E8 Assembler |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0X97C75] |MOV DWORD PTR [RAX], 1 |CALL 0X140001180 |NOP |NOP |ADD RSP, 0X28 |RET |NOP DWORD PTR [RAX] |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0X97C55] |MOV DWORD PTR [RAX], 0 |
| Signatures |
| CheckSum Integrity Problem: • Header: 698781 • Calculated: 850618 Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • Entropy: 6.70028 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexW | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | SleepEx | Pauses the execution of the current thread, optionally allowing the thread to be awakened by a kernel object or upon expiration of a timeout. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| Windows REG |
| System\mod.rs |
| File Access |
| \cmd.exe cmd.exe .exe api-ms-win-core-synch-l1-2-0.dll ntdll.dll msvcrt.dll KERNEL32.dll user32.dll shell32.dll oleaut32.dll msimg32.dll gdiplus.dll gdi32.dll ~ntdll.dll .dat Temp |
| File Access (UNICODE) |
| yami-wisp.exe NTDLL.DLL |
| Interest's Words |
| PADDINGX exec attrib start ping |
| URLs (UNICODE) |
| https://indiantypefoundry.comThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: https://scripts.sil.org/OFL |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Unicode escape - \u00 - (Common Unicode escape sequences) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | A71D8 | 468 | A13D8 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000090000 | (....... ..... .....@............................. |
| \ICON\2\1033 | A7640 | 10A8 | A1840 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\3\1033 | A86E8 | 25A8 | A28E8 | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\4\1033 | AAC90 | 4228 | A4E90 | 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000 | (...@......... ......B............................ |
| \ICON\5\1033 | AEEB8 | 10828 | A90B8 | 2800000080000000000100000100200000000000000801000000000000000000000000000000000000000000000000000000 | (............. ................................... |
| \ICON\6\1033 | BF6E0 | 75BF | B98E0 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A86600001000494441547801EC9D07BC2C4595 | .PNG........IHDR.............\r.f....IDATx.....,E. |
| \GROUP_ICON\0\1033 | C6CA0 | 5A | C0EA0 | 00000100060010100000010020006804000001002020000001002000A810000002003030000001002000A82500000300404000000100200028420000040080800000010020002808000005000000000001002000BF7500000600 | ............ .h..... .... .......00.... ..%....@@.... .(B.......... .(........... ..u.... |
| \VERSION\1\1033 | C6CFC | 2CC | C0EFC | CC0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000100 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • 1.1.3.0 • ntdll.dll • @.bss • .CRT • .tls • C:\Users\clohir\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.150\src\de.rs • C:\Users\clohir\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\windows-0.58.0\src\Windows\Win32\Storage\FileSystem\mod.rs • C:\Users\clohir\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\windows-0.58.0\src\Windows\Win32\Graphics\Gdi\mod.rs • C:\Users\clohir\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.150\src\value\ser.rsserialize_value called before serialize_key • E65EE75D • dSquare dots in punctuation marksDouble-storey aAlternative ampersandAlternative 2, 3, 6, 9 • dvLL_YAdvmII.aLongdvReph_AnusvaradvAnusvara.amI • src\pipe.rs\\.\pipe\yami-wisp • C:\Users\clohir\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.150\src\ser.rs • C:\Users\clohir\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.150\src\error.rs at line • C:\Users\clohir\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs • %%cd:~,cmd.exe /e:ON /v:OFF /d /c "batch file arguments are invalid • NTDLL.DLL • gdi32.dll • kernel32.dll • oleaut32.dll • user32.dll • KERNEL32.dll • msvcrt.dll • api-ms-win-core-synch-l1-2-0.dll • yami-wisp.exe |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 62F | N/A | .text | CALL QWORD PTR [RIP+0xA27FB] |
| 2DFD9 | N/A | .text | CALL QWORD PTR [RIP+0xE0830F] |
| 5953C | N/A | .text | JMP QWORD PTR [RIP+0x49BF6] |
| 59544 | N/A | .text | JMP QWORD PTR [RIP+0x49BE6] |
| 5954C | N/A | .text | JMP QWORD PTR [RIP+0x49BD6] |
| 59554 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 5955C | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 59564 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 5956C | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 59574 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 5957C | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 59584 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 5958C | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 59594 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 5959C | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595A4 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595AC | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595B4 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595BC | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595C4 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595CC | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595D4 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595DC | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595E4 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595EC | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595F4 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 595FC | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 59604 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 5960C | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 59614 | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 5961C | N/A | .text | JMP QWORD PTR [RIP+0x499AE] |
| 59624 | N/A | .text | JMP QWORD PTR [RIP+0x498CE] |
| 5962C | N/A | .text | JMP QWORD PTR [RIP+0x498AE] |
| 59634 | N/A | .text | JMP QWORD PTR [RIP+0x498AE] |
| 5963C | N/A | .text | JMP QWORD PTR [RIP+0x49876] |
| 59644 | N/A | .text | JMP QWORD PTR [RIP+0x49876] |
| 5964C | N/A | .text | JMP QWORD PTR [RIP+0x49876] |
| 59654 | N/A | .text | JMP QWORD PTR [RIP+0x49876] |
| 5965C | N/A | .text | JMP QWORD PTR [RIP+0x49846] |
| 59664 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5966C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59674 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5967C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59684 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5968C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59694 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5969C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596A4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596AC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596B4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596BC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596C4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596CC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596D4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596DC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596E4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596EC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596F4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 596FC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59704 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5970C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59714 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5971C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59724 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5972C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59734 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5973C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59744 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5974C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59754 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5975C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59764 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5976C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59774 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5977C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59784 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5978C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59794 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5979C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597A4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597AC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597B4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597BC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597C4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597CC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597D4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597DC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597E4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597EC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597F4 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 597FC | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59804 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5980C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59814 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5981C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59824 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5982C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59834 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 5983C | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| 59844 | N/A | .text | JMP QWORD PTR [RIP+0x495B6] |
| A0E38 | 14002A600 | .CRT | TLS Callback | Pointer to 2A600 - 0x29A00 .text |
| A0E40 | 14005AFA0 | .CRT | TLS Callback | Pointer to 5AFA0 - 0x5A3A0 .text |
| A0E48 | 14005AF70 | .CRT | TLS Callback | Pointer to 5AF70 - 0x5A370 .text |
| 98200 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .xdata |
| 9820C | 140001010 | .pdata | ExceptionHook | Pointer to 1010 - 0x410 .text + UnwindInfo: .xdata |
| 98218 | 140001130 | .pdata | ExceptionHook | Pointer to 1130 - 0x530 .text + UnwindInfo: .xdata |
| 98224 | 140001180 | .pdata | ExceptionHook | Pointer to 1180 - 0x580 .text + UnwindInfo: .xdata |
| 98230 | 1400013D0 | .pdata | ExceptionHook | Pointer to 13D0 - 0x7D0 .text + UnwindInfo: .xdata |
| 9823C | 1400013F0 | .pdata | ExceptionHook | Pointer to 13F0 - 0x7F0 .text + UnwindInfo: .xdata |
| 98248 | 140001410 | .pdata | ExceptionHook | Pointer to 1410 - 0x810 .text + UnwindInfo: .xdata |
| 98254 | 140001430 | .pdata | ExceptionHook | Pointer to 1430 - 0x830 .text + UnwindInfo: .xdata |
| 98260 | 14000153E | .pdata | ExceptionHook | Pointer to 153E - 0x93E .text + UnwindInfo: .xdata |
| 9826C | 1400015A4 | .pdata | ExceptionHook | Pointer to 15A4 - 0x9A4 .text + UnwindInfo: .xdata |
| 98278 | 1400015D4 | .pdata | ExceptionHook | Pointer to 15D4 - 0x9D4 .text + UnwindInfo: .xdata |
| 98284 | 140001606 | .pdata | ExceptionHook | Pointer to 1606 - 0xA06 .text + UnwindInfo: .xdata |
| 98290 | 14000166C | .pdata | ExceptionHook | Pointer to 166C - 0xA6C .text + UnwindInfo: .xdata |
| 9829C | 1400017EF | .pdata | ExceptionHook | Pointer to 17EF - 0xBEF .text + UnwindInfo: .xdata |
| 982A8 | 1400018CA | .pdata | ExceptionHook | Pointer to 18CA - 0xCCA .text + UnwindInfo: .xdata |
| 982B4 | 140001A67 | .pdata | ExceptionHook | Pointer to 1A67 - 0xE67 .text + UnwindInfo: .xdata |
| 982C0 | 140001AFA | .pdata | ExceptionHook | Pointer to 1AFA - 0xEFA .text + UnwindInfo: .xdata |
| 982CC | 140001BAE | .pdata | ExceptionHook | Pointer to 1BAE - 0xFAE .text + UnwindInfo: .xdata |
| 982D8 | 140001C86 | .pdata | ExceptionHook | Pointer to 1C86 - 0x1086 .text + UnwindInfo: .xdata |
| 982E4 | 140001D3E | .pdata | ExceptionHook | Pointer to 1D3E - 0x113E .text + UnwindInfo: .xdata |
| 982F0 | 140001E71 | .pdata | ExceptionHook | Pointer to 1E71 - 0x1271 .text + UnwindInfo: .xdata |
| 982FC | 140001EA1 | .pdata | ExceptionHook | Pointer to 1EA1 - 0x12A1 .text + UnwindInfo: .xdata |
| 98308 | 140001F55 | .pdata | ExceptionHook | Pointer to 1F55 - 0x1355 .text + UnwindInfo: .xdata |
| 98314 | 140001FDA | .pdata | ExceptionHook | Pointer to 1FDA - 0x13DA .text + UnwindInfo: .xdata |
| 98320 | 14000202B | .pdata | ExceptionHook | Pointer to 202B - 0x142B .text + UnwindInfo: .xdata |
| 9832C | 1400020C9 | .pdata | ExceptionHook | Pointer to 20C9 - 0x14C9 .text + UnwindInfo: .xdata |
| 98338 | 1400020D9 | .pdata | ExceptionHook | Pointer to 20D9 - 0x14D9 .text + UnwindInfo: .xdata |
| 98344 | 140002121 | .pdata | ExceptionHook | Pointer to 2121 - 0x1521 .text + UnwindInfo: .xdata |
| 98350 | 140002159 | .pdata | ExceptionHook | Pointer to 2159 - 0x1559 .text + UnwindInfo: .xdata |
| 9835C | 140002196 | .pdata | ExceptionHook | Pointer to 2196 - 0x1596 .text + UnwindInfo: .xdata |
| 98368 | 1400021E1 | .pdata | ExceptionHook | Pointer to 21E1 - 0x15E1 .text + UnwindInfo: .xdata |
| 98374 | 140002316 | .pdata | ExceptionHook | Pointer to 2316 - 0x1716 .text + UnwindInfo: .xdata |
| 98380 | 140002359 | .pdata | ExceptionHook | Pointer to 2359 - 0x1759 .text + UnwindInfo: .xdata |
| 9838C | 1400023F1 | .pdata | ExceptionHook | Pointer to 23F1 - 0x17F1 .text + UnwindInfo: .xdata |
| 98398 | 140002444 | .pdata | ExceptionHook | Pointer to 2444 - 0x1844 .text + UnwindInfo: .xdata |
| 983A4 | 140002479 | .pdata | ExceptionHook | Pointer to 2479 - 0x1879 .text + UnwindInfo: .xdata |
| 983B0 | 14000257D | .pdata | ExceptionHook | Pointer to 257D - 0x197D .text + UnwindInfo: .xdata |
| 983BC | 140002681 | .pdata | ExceptionHook | Pointer to 2681 - 0x1A81 .text + UnwindInfo: .xdata |
| 983C8 | 1400026C3 | .pdata | ExceptionHook | Pointer to 26C3 - 0x1AC3 .text + UnwindInfo: .xdata |
| 983D4 | 1400029AB | .pdata | ExceptionHook | Pointer to 29AB - 0x1DAB .text + UnwindInfo: .xdata |
| 983E0 | 1400029E6 | .pdata | ExceptionHook | Pointer to 29E6 - 0x1DE6 .text + UnwindInfo: .xdata |
| 983EC | 140002A13 | .pdata | ExceptionHook | Pointer to 2A13 - 0x1E13 .text + UnwindInfo: .xdata |
| 983F8 | 140002CFB | .pdata | ExceptionHook | Pointer to 2CFB - 0x20FB .text + UnwindInfo: .xdata |
| 98404 | 140002D28 | .pdata | ExceptionHook | Pointer to 2D28 - 0x2128 .text + UnwindInfo: .xdata |
| 98410 | 140002D63 | .pdata | ExceptionHook | Pointer to 2D63 - 0x2163 .text + UnwindInfo: .xdata |
| 9841C | 140002DA5 | .pdata | ExceptionHook | Pointer to 2DA5 - 0x21A5 .text + UnwindInfo: .xdata |
| 98428 | 140002DE7 | .pdata | ExceptionHook | Pointer to 2DE7 - 0x21E7 .text + UnwindInfo: .xdata |
| 98434 | 140002E29 | .pdata | ExceptionHook | Pointer to 2E29 - 0x2229 .text + UnwindInfo: .xdata |
| 98440 | 140002E8E | .pdata | ExceptionHook | Pointer to 2E8E - 0x228E .text + UnwindInfo: .xdata |
| 9844C | 140002F03 | .pdata | ExceptionHook | Pointer to 2F03 - 0x2303 .text + UnwindInfo: .xdata |
| 98458 | 140002F71 | .pdata | ExceptionHook | Pointer to 2F71 - 0x2371 .text + UnwindInfo: .xdata |
| 98464 | 140002FE6 | .pdata | ExceptionHook | Pointer to 2FE6 - 0x23E6 .text + UnwindInfo: .xdata |
| 98470 | 14000304B | .pdata | ExceptionHook | Pointer to 304B - 0x244B .text + UnwindInfo: .xdata |
| 9847C | 1400030C0 | .pdata | ExceptionHook | Pointer to 30C0 - 0x24C0 .text + UnwindInfo: .xdata |
| 98488 | 14000312E | .pdata | ExceptionHook | Pointer to 312E - 0x252E .text + UnwindInfo: .xdata |
| 98494 | 1400031A8 | .pdata | ExceptionHook | Pointer to 31A8 - 0x25A8 .text + UnwindInfo: .xdata |
| 984A0 | 140003240 | .pdata | ExceptionHook | Pointer to 3240 - 0x2640 .text + UnwindInfo: .xdata |
| 984AC | 1400032B4 | .pdata | ExceptionHook | Pointer to 32B4 - 0x26B4 .text + UnwindInfo: .xdata |
| 984B8 | 140003326 | .pdata | ExceptionHook | Pointer to 3326 - 0x2726 .text + UnwindInfo: .xdata |
| 984C4 | 1400033B0 | .pdata | ExceptionHook | Pointer to 33B0 - 0x27B0 .text + UnwindInfo: .xdata |
| 984D0 | 1400033E2 | .pdata | ExceptionHook | Pointer to 33E2 - 0x27E2 .text + UnwindInfo: .xdata |
| 984DC | 1400034A1 | .pdata | ExceptionHook | Pointer to 34A1 - 0x28A1 .text + UnwindInfo: .xdata |
| 984E8 | 14000359E | .pdata | ExceptionHook | Pointer to 359E - 0x299E .text + UnwindInfo: .xdata |
| 984F4 | 140003712 | .pdata | ExceptionHook | Pointer to 3712 - 0x2B12 .text + UnwindInfo: .xdata |
| 98500 | 1400037DC | .pdata | ExceptionHook | Pointer to 37DC - 0x2BDC .text + UnwindInfo: .xdata |
| 9850C | 140003914 | .pdata | ExceptionHook | Pointer to 3914 - 0x2D14 .text + UnwindInfo: .xdata |
| 98518 | 140003A41 | .pdata | ExceptionHook | Pointer to 3A41 - 0x2E41 .text + UnwindInfo: .xdata |
| 98524 | 140003BB2 | .pdata | ExceptionHook | Pointer to 3BB2 - 0x2FB2 .text + UnwindInfo: .xdata |
| 98530 | 140003C52 | .pdata | ExceptionHook | Pointer to 3C52 - 0x3052 .text + UnwindInfo: .xdata |
| 9853C | 140003D36 | .pdata | ExceptionHook | Pointer to 3D36 - 0x3136 .text + UnwindInfo: .xdata |
| 98548 | 140003D7D | .pdata | ExceptionHook | Pointer to 3D7D - 0x317D .text + UnwindInfo: .xdata |
| 98554 | 140003DC0 | .pdata | ExceptionHook | Pointer to 3DC0 - 0x31C0 .text + UnwindInfo: .xdata |
| 98560 | 140003FA6 | .pdata | ExceptionHook | Pointer to 3FA6 - 0x33A6 .text + UnwindInfo: .xdata |
| 9856C | 14000400F | .pdata | ExceptionHook | Pointer to 400F - 0x340F .text + UnwindInfo: .xdata |
| 98578 | 140004073 | .pdata | ExceptionHook | Pointer to 4073 - 0x3473 .text + UnwindInfo: .xdata |
| 98584 | 1400040CB | .pdata | ExceptionHook | Pointer to 40CB - 0x34CB .text + UnwindInfo: .xdata |
| 98590 | 14000414A | .pdata | ExceptionHook | Pointer to 414A - 0x354A .text + UnwindInfo: .xdata |
| 9859C | 1400041BF | .pdata | ExceptionHook | Pointer to 41BF - 0x35BF .text + UnwindInfo: .xdata |
| 985A8 | 1400042F7 | .pdata | ExceptionHook | Pointer to 42F7 - 0x36F7 .text + UnwindInfo: .xdata |
| 985B4 | 14000472A | .pdata | ExceptionHook | Pointer to 472A - 0x3B2A .text + UnwindInfo: .xdata |
| 985C0 | 140004943 | .pdata | ExceptionHook | Pointer to 4943 - 0x3D43 .text + UnwindInfo: .xdata |
| 985CC | 1400049A6 | .pdata | ExceptionHook | Pointer to 49A6 - 0x3DA6 .text + UnwindInfo: .xdata |
| 985D8 | 140004A72 | .pdata | ExceptionHook | Pointer to 4A72 - 0x3E72 .text + UnwindInfo: .xdata |
| 985E4 | 140004AB5 | .pdata | ExceptionHook | Pointer to 4AB5 - 0x3EB5 .text + UnwindInfo: .xdata |
| 985F0 | 140004AF5 | .pdata | ExceptionHook | Pointer to 4AF5 - 0x3EF5 .text + UnwindInfo: .xdata |
| 985FC | 140004B38 | .pdata | ExceptionHook | Pointer to 4B38 - 0x3F38 .text + UnwindInfo: .xdata |
| 98608 | 140004D52 | .pdata | ExceptionHook | Pointer to 4D52 - 0x4152 .text + UnwindInfo: .xdata |
| 98614 | 140006059 | .pdata | ExceptionHook | Pointer to 6059 - 0x5459 .text + UnwindInfo: .xdata |
| 98620 | 140006068 | .pdata | ExceptionHook | Pointer to 6068 - 0x5468 .text + UnwindInfo: .xdata |
| 9862C | 140008648 | .pdata | ExceptionHook | Pointer to 8648 - 0x7A48 .text + UnwindInfo: .xdata |
| 98638 | 140008654 | .pdata | ExceptionHook | Pointer to 8654 - 0x7A54 .text + UnwindInfo: .xdata |
| 98644 | 1400086A6 | .pdata | ExceptionHook | Pointer to 86A6 - 0x7AA6 .text + UnwindInfo: .xdata |
| 98650 | 1400086CF | .pdata | ExceptionHook | Pointer to 86CF - 0x7ACF .text + UnwindInfo: .xdata |
| 9865C | 1400086FD | .pdata | ExceptionHook | Pointer to 86FD - 0x7AFD .text + UnwindInfo: .xdata |
| 98668 | 140008951 | .pdata | ExceptionHook | Pointer to 8951 - 0x7D51 .text + UnwindInfo: .xdata |
| 98674 | 140008A36 | .pdata | ExceptionHook | Pointer to 8A36 - 0x7E36 .text + UnwindInfo: .xdata |
| 98680 | 140008A5F | .pdata | ExceptionHook | Pointer to 8A5F - 0x7E5F .text + UnwindInfo: .xdata |
| 9868C | 140008AEA | .pdata | ExceptionHook | Pointer to 8AEA - 0x7EEA .text + UnwindInfo: .xdata |
| 98698 | 140008D2F | .pdata | ExceptionHook | Pointer to 8D2F - 0x812F .text + UnwindInfo: .xdata |
| 986A4 | 140008F47 | .pdata | ExceptionHook | Pointer to 8F47 - 0x8347 .text + UnwindInfo: .xdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 480811 | 60,6643% |
| Null Byte Code | 127484 | 16,0848% |
| NOP Cave Found | 0x9090909090 | Block Count: 22 | Total: 0,0069% |
© 2026 All rights reserved.