PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 344,50 KBSHA-256 Hash: DC93B69BA2E3863E3C583CE5EFE856C11303C358C22AF3FD41539184153B15F1 SHA-1 Hash: 2F1A73A751802A728460295741E4B7FFEC73ACD4 MD5 Hash: DB306D43A6F092651312843E0293D9F2 Imphash: A8FF415D7B5164307CDBA18944AE4F5D MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00030044 EntryPoint (rva): 23A8 SizeOfHeaders: 400 SizeOfImage: 5C000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 208AC IAT: 16000 Characteristics: 22 TimeDateStamp: F279FF4B Date: 29/11/2098 6:38:03 File Type: EXE Number Of Sections: 7 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, _RDATA, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 14800 | 1000 | 146B0 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
14C00 | B400 | 16000 | B34E |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
20000 | C00 | 22000 | 1E20 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
20C00 | 1400 | 24000 | 12D8 |
|
|
| _RDATA | 0x40000040 Initialized Data Readable |
22000 | 200 | 26000 | 1F4 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
22200 | 33800 | 27000 | 33614 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
55A00 | 800 | 5B000 | 69C |
|
|
| Description |
| OriginalFilename: BootstrapPackagedGame-Win64-Shipping.exe CompanyName: Epic Games, Inc. LegalCopyright: Fill out your copyright notice in the Description page of Project Settings. ProductName: BootstrapPackagedGame FileVersion: ++UE5+Release-5.6-CL-44394996 FileDescription: BootstrapPackagedGame ProductVersion: ++UE5+Release-5.6-CL-44394996 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 17A8 Code -> 4883EC28E80B0400004883C428E97AFEFFFFCCCC40534883EC20488BD9EB0F488BCBE88976000085C07413488BCBE8A14200 Assembler |SUB RSP, 0X28 |CALL 0X1400027BC |ADD RSP, 0X28 |JMP 0X140002234 |INT3 |INT3 |PUSH RBX |SUB RSP, 0X20 |MOV RBX, RCX |JMP 0X1400023D6 |MOV RCX, RBX |CALL 0X140009A58 |TEST EAX, EAX |JE 0X1400023E6 |MOV RCX, RBX |
| Signatures |
| CheckSum Integrity Problem: • Header: 196676 • Calculated: 384831 Rich Signature Analyzer: Code -> 108CB49C54EDDACF54EDDACF54EDDACF1F95D9CE51EDDACF1F95DFCEDFEDDACF1F95DECE5EEDDACF54EDDACF55EDDACF526CDECE44EDDACF526CD9CE45EDDACF526CDFCE79EDDACF1F95DBCE59EDDACF54EDDBCF3BEDDACF3E6CDFCE55EDDACF3E6C25CF55EDDACF54ED4DCF55EDDACF3E6CD8CE55EDDACF5269636854EDDACF Footprint md5 Hash -> C098F48D4C73D3B2D74FE140D17C9899 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.38**)[-] • Entropy: 7.48243 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| SHELL32.DLL | ShellExecuteExW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\arm64 SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 |
| File Access |
| VERSION.dll SHLWAPI.dll SHELL32.dll ADVAPI32.dll USER32.dll KERNEL32.dll .dat @.dat |
| File Access (UNICODE) |
| BootstrapPackagedGame-Win64-Shipping.exe x64.exe arm64.exe mscoree.dll vcruntime140_1.dll IsWow64Process2msvcp140_2.dll kernel32.dll |
| Interest's Words |
| PADDINGX exec attrib start ping |
| Interest's Words (UNICODE) |
| start ping |
| URLs |
| http://www.w3.org/1999/02/22-rdf-syntax-ns http://ns.adobe.com/xap/1.0/ http://purl.org/dc/elements/1.1/ http://ns.adobe.com/photoshop/1.0/ http://ns.adobe.com/xap/1.0/mm/ http://ns.adobe.com/xap/1.0/sType/ResourceEvent http://schemas.microsoft.com/SMI/2016/WindowsSettings |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 272F8 | 2D3CA | 224F8 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000016F724E5401CFA2779A00008000 | .PNG........IHDR.............\r.f....orNT...w..... |
| \ICON\2\1033 | 546C4 | 98F | 4F8C4 | 89504E470D0A1A0A0000000D4948445200000018000000180806000000E0773DF8000000097048597300000B1300000B1301 | .PNG........IHDR..............w=.....pHYs......... |
| \ICON\3\1033 | 55054 | 9E7 | 50254 | 89504E470D0A1A0A0000000D4948445200000020000000200806000000737A7AF4000000097048597300000B1300000B1301 | .PNG........IHDR... ... .....szz.....pHYs......... |
| \ICON\4\1033 | 55A3C | BDD | 50C3C | 89504E470D0A1A0A0000000D49484452000000280000002808060000008CFEB86D000000097048597300000B1300000B1301 | .PNG........IHDR...(...(........m....pHYs......... |
| \ICON\5\1033 | 5661C | CAC | 5181C | 89504E470D0A1A0A0000000D49484452000000300000003008060000005702F987000000097048597300000B1300000B1301 | .PNG........IHDR...0...0.....W.......pHYs......... |
| \ICON\6\1033 | 572C8 | DCB | 524C8 | 89504E470D0A1A0A0000000D4948445200000040000000400806000000AA6971DE000000097048597300000B1300000B1301 | .PNG........IHDR...@...@......iq.....pHYs......... |
| \ICON\7\1033 | 58094 | 1B13 | 53294 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000097048597300000B1300000B1301 | .PNG........IHDR.............\r.f....pHYs......... |
| \RCDATA\201\1033 | 59BA8 | 6C | 54DA8 | 4C00750073007400430075007200730065005C00420069006E00610072006900650073005C00570069006E00360034005C00 | L.u.s.t.C.u.r.s.e.\.B.i.n.a.r.i.e.s.\.W.i.n.6.4.\. |
| \RCDATA\202\1033 | 59C14 | 14 | 54E14 | 4C00750073007400430075007200730065000000 | L.u.s.t.C.u.r.s.e... |
| \GROUP_ICON\101\1033 | 59C28 | 14 | 54E28 | 0000010001000000000001002000CAD302000100 | ............ ....... |
| \GROUP_ICON\123\1033 | 59C3C | 68 | 54E3C | 0000010007001010000001002000CC070000010018180000010020008F09000002002020000001002000E709000003002828 | ............ ............. ....... .... .......(( |
| \VERSION\1\1033 | 59CA4 | 3F0 | 54EA4 | F00334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000600 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 5A094 | 580 | 55294 | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone |
| Intelligent String |
| • iTXtXML:com.adobe.xmp • kernel32.dll • IsWow64Process2msvcp140_2.dll • vcruntime140_1.dll • Engine\Extras\Redist\en-us\vc_redist.arm64.exe • Engine\Extras\Redist\en-us\vc_redist.x64.exe • mscoree.dll • BootstrapPackagedGame-Win64-Shipping.pdb • .bss • KERNEL32.dll • ADVAPI32.dll • IENDBPLustCurse\Binaries\Win64\LustCurse-Win64-Shipping.exe • BootstrapPackagedGame-Win64-Shipping.exe |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 522 | N/A | .text | CALL QWORD PTR [RIP+0x14F28] |
| 53B | N/A | .text | CALL QWORD PTR [RIP+0x14F17] |
| 629 | N/A | .text | CALL QWORD PTR [RIP+0x14DD1] |
| 672 | N/A | .text | CALL QWORD PTR [RIP+0x14D98] |
| 6B5 | N/A | .text | CALL QWORD PTR [RIP+0x14D55] |
| 6F8 | N/A | .text | CALL QWORD PTR [RIP+0x14D12] |
| 73B | N/A | .text | CALL QWORD PTR [RIP+0x14CCF] |
| 746 | N/A | .text | CALL QWORD PTR [RIP+0x14CBC] |
| 795 | N/A | .text | CALL QWORD PTR [RIP+0x14D15] |
| 7BE | N/A | .text | CALL QWORD PTR [RIP+0x14F0C] |
| 7D6 | N/A | .text | CALL QWORD PTR [RIP+0x14EF4] |
| 8A7 | N/A | .text | CALL QWORD PTR [RIP+0x14E23] |
| 8BD | N/A | .text | CALL QWORD PTR [RIP+0x14BBD] |
| 8CF | N/A | .text | CALL QWORD PTR [RIP+0x14B6B] |
| 8E7 | N/A | .text | CALL QWORD PTR [RIP+0x14DE3] |
| 9B0 | N/A | .text | CALL QWORD PTR [RIP+0x14D1A] |
| 9C2 | N/A | .text | CALL QWORD PTR [RIP+0x14AB8] |
| 9D0 | N/A | .text | CALL QWORD PTR [RIP+0x14A6A] |
| B0D | N/A | .text | CALL QWORD PTR [RIP+0x14BD5] |
| B2D | N/A | .text | CALL QWORD PTR [RIP+0x14B9D] |
| B37 | N/A | .text | CALL QWORD PTR [RIP+0x14963] |
| B51 | N/A | .text | CALL QWORD PTR [RIP+0x14B89] |
| BA0 | N/A | .text | CALL QWORD PTR [RIP+0x14B3A] |
| C32 | N/A | .text | CALL QWORD PTR [RIP+0x14A78] |
| C51 | N/A | .text | CALL QWORD PTR [RIP+0x147C9] |
| C60 | N/A | .text | CALL QWORD PTR [RIP+0x147CA] |
| C6A | N/A | .text | CALL QWORD PTR [RIP+0x14828] |
| CBD | N/A | .text | CALL QWORD PTR [RIP+0x1478D] |
| CD2 | N/A | .text | CALL QWORD PTR [RIP+0x14780] |
| CE0 | N/A | .text | CALL QWORD PTR [RIP+0x14742] |
| D38 | N/A | .text | CALL QWORD PTR [RIP+0x1473A] |
| D50 | N/A | .text | CALL QWORD PTR [RIP+0x14752] |
| D63 | N/A | .text | CALL QWORD PTR [RIP+0x146FF] |
| D72 | N/A | .text | CALL QWORD PTR [RIP+0x146F8] |
| E0A | N/A | .text | CALL QWORD PTR [RIP+0x148C0] |
| F14 | N/A | .text | CALL QWORD PTR [RIP+0x147B6] |
| F24 | N/A | .text | CALL QWORD PTR [RIP+0x14556] |
| F32 | N/A | .text | CALL QWORD PTR [RIP+0x14508] |
| 1019 | N/A | .text | CALL QWORD PTR [RIP+0x14429] |
| 102A | N/A | .text | CALL QWORD PTR [RIP+0x14690] |
| 1034 | N/A | .text | CALL QWORD PTR [RIP+0x1468E] |
| 1071 | N/A | .text | CALL QWORD PTR [RIP+0x14671] |
| 107A | N/A | .text | CALL QWORD PTR [RIP+0x14420] |
| 10BB | N/A | .text | CALL QWORD PTR [RIP+0x14627] |
| 10C4 | N/A | .text | CALL QWORD PTR [RIP+0x143D6] |
| 10FB | N/A | .text | CALL QWORD PTR [RIP+0x145DF] |
| 117A | N/A | .text | CALL QWORD PTR [RIP+0x14568] |
| 118A | N/A | .text | CALL QWORD PTR [RIP+0x14530] |
| 119F | N/A | .text | CALL QWORD PTR [RIP+0x14523] |
| 12EB | N/A | .text | CALL QWORD PTR [RIP+0x14147] |
| 12F5 | N/A | .text | CALL QWORD PTR [RIP+0x14165] |
| 1335 | N/A | .text | CALL QWORD PTR [RIP+0x143AD] |
| 1346 | N/A | .text | CALL QWORD PTR [RIP+0x14394] |
| 136F | N/A | .text | CALL QWORD PTR [RIP+0x140AB] |
| 1387 | N/A | .text | CALL QWORD PTR [RIP+0x140A3] |
| 1392 | N/A | .text | CALL QWORD PTR [RIP+0x14100] |
| 139D | N/A | .text | CALL QWORD PTR [RIP+0x140F5] |
| 13ED | N/A | .text | JMP QWORD PTR [RIP+0x14315] |
| 13F3 | N/A | .text | JMP QWORD PTR [RIP+0x142FF] |
| 13F9 | N/A | .text | JMP QWORD PTR [RIP+0x14301] |
| 16F1 | N/A | .text | CALL QWORD PTR [RIP+0x14031] |
| 180B | N/A | .text | CALL QWORD PTR [RIP+0x13D07] |
| 1814 | N/A | .text | CALL QWORD PTR [RIP+0x13CF6] |
| 181A | N/A | .text | CALL QWORD PTR [RIP+0x13C08] |
| 182E | N/A | .text | JMP QWORD PTR [RIP+0x13CEC] |
| 1842 | N/A | .text | CALL QWORD PTR [RIP+0x13CE0] |
| 1913 | N/A | .text | CALL QWORD PTR [RIP+0x13BDF] |
| 192D | N/A | .text | CALL QWORD PTR [RIP+0x13BCD] |
| 1964 | N/A | .text | CALL QWORD PTR [RIP+0x13B9E] |
| 1BE8 | N/A | .text | CALL QWORD PTR [RIP+0x1395A] |
| 1BF6 | N/A | .text | CALL QWORD PTR [RIP+0x13944] |
| 1C02 | N/A | .text | CALL QWORD PTR [RIP+0x13930] |
| 1C12 | N/A | .text | CALL QWORD PTR [RIP+0x13918] |
| 1C84 | N/A | .text | JMP QWORD PTR [RIP+0x138C6] |
| 1CF0 | N/A | .text | CALL QWORD PTR [RIP+0x13832] |
| 1D1D | N/A | .text | CALL QWORD PTR [RIP+0x137D5] |
| 1D37 | N/A | .text | CALL QWORD PTR [RIP+0x137C3] |
| 1D78 | N/A | .text | CALL QWORD PTR [RIP+0x1378A] |
| 1DCC | N/A | .text | CALL QWORD PTR [RIP+0x13786] |
| 1DE9 | N/A | .text | CALL QWORD PTR [RIP+0x13729] |
| 1DF4 | N/A | .text | CALL QWORD PTR [RIP+0x13716] |
| 1E38 | N/A | .text | CALL QWORD PTR [RIP+0x13722] |
| 1E66 | N/A | .text | CALL QWORD PTR [RIP+0x135E4] |
| 1EBC | N/A | .text | JMP QWORD PTR [RIP+0x13656] |
| 1F42 | N/A | .text | CALL QWORD PTR [RIP+0x137E0] |
| 1F7E | N/A | .text | CALL QWORD PTR [RIP+0x137A4] |
| 2190 | N/A | .text | JMP QWORD PTR [RIP+0xFFF3FF0] |
| 23F3 | N/A | .text | CALL QWORD PTR [RIP+0x13A9F] |
| 243C | N/A | .text | CALL QWORD PTR [RIP+0x13126] |
| 2606 | N/A | .text | CALL QWORD PTR [RIP+0x1311C] |
| 27F6 | N/A | .text | CALL QWORD PTR [RIP+0x12F2C] |
| 2810 | N/A | .text | CALL QWORD PTR [RIP+0x12D5A] |
| 2851 | N/A | .text | CALL QWORD PTR [RIP+0x12D21] |
| 2967 | N/A | .text | CALL QWORD PTR [RIP+0x12AF3] |
| 29EE | N/A | .text | CALL QWORD PTR [RIP+0x12B8C] |
| 2ADB | N/A | .text | CALL QWORD PTR [RIP+0x12AB7] |
| 393D | N/A | .text | CALL QWORD PTR [RIP+0x11C85] |
| 394B | N/A | .text | CALL QWORD PTR [RIP+0x11B0F] |
| 3975 | N/A | .text | CALL QWORD PTR [RIP+0x11C4D] |
| 39E3 | N/A | .text | CALL QWORD PTR [RIP+0x11A57] |
| 20C00 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 20C0C | 14000102E | .pdata | ExceptionHook | Pointer to 102E - 0x42E .text + UnwindInfo: .rdata |
| 20C18 | 14000111A | .pdata | ExceptionHook | Pointer to 111A - 0x51A .text + UnwindInfo: .rdata |
| 20C24 | 14000122F | .pdata | ExceptionHook | Pointer to 122F - 0x62F .text + UnwindInfo: .rdata |
| 20C30 | 1400015DB | .pdata | ExceptionHook | Pointer to 15DB - 0x9DB .text + UnwindInfo: .rdata |
| 20C3C | 1400015E8 | .pdata | ExceptionHook | Pointer to 15E8 - 0x9E8 .text + UnwindInfo: .rdata |
| 20C48 | 1400016D2 | .pdata | ExceptionHook | Pointer to 16D2 - 0xAD2 .text + UnwindInfo: .rdata |
| 20C54 | 1400016DA | .pdata | ExceptionHook | Pointer to 16DA - 0xADA .text + UnwindInfo: .rdata |
| 20C60 | 1400016F8 | .pdata | ExceptionHook | Pointer to 16F8 - 0xAF8 .text + UnwindInfo: .rdata |
| 20C6C | 140001761 | .pdata | ExceptionHook | Pointer to 1761 - 0xB61 .text + UnwindInfo: .rdata |
| 20C78 | 140001776 | .pdata | ExceptionHook | Pointer to 1776 - 0xB76 .text + UnwindInfo: .rdata |
| 20C84 | 1400018B0 | .pdata | ExceptionHook | Pointer to 18B0 - 0xCB0 .text + UnwindInfo: .rdata |
| 20C90 | 140001920 | .pdata | ExceptionHook | Pointer to 1920 - 0xD20 .text + UnwindInfo: .rdata |
| 20C9C | 14000195E | .pdata | ExceptionHook | Pointer to 195E - 0xD5E .text + UnwindInfo: .rdata |
| 20CA8 | 1400019CA | .pdata | ExceptionHook | Pointer to 19CA - 0xDCA .text + UnwindInfo: .rdata |
| 20CB4 | 1400019E0 | .pdata | ExceptionHook | Pointer to 19E0 - 0xDE0 .text + UnwindInfo: .rdata |
| 20CC0 | 140001A31 | .pdata | ExceptionHook | Pointer to 1A31 - 0xE31 .text + UnwindInfo: .rdata |
| 20CCC | 140001AB7 | .pdata | ExceptionHook | Pointer to 1AB7 - 0xEB7 .text + UnwindInfo: .rdata |
| 20CD8 | 140001AD1 | .pdata | ExceptionHook | Pointer to 1AD1 - 0xED1 .text + UnwindInfo: .rdata |
| 20CE4 | 140001ADD | .pdata | ExceptionHook | Pointer to 1ADD - 0xEDD .text + UnwindInfo: .rdata |
| 20CF0 | 140001AF0 | .pdata | ExceptionHook | Pointer to 1AF0 - 0xEF0 .text + UnwindInfo: .rdata |
| 20CFC | 140001B80 | .pdata | ExceptionHook | Pointer to 1B80 - 0xF80 .text + UnwindInfo: .rdata |
| 20D08 | 140001BE0 | .pdata | ExceptionHook | Pointer to 1BE0 - 0xFE0 .text + UnwindInfo: .rdata |
| 20D14 | 140001D0B | .pdata | ExceptionHook | Pointer to 1D0B - 0x110B .text + UnwindInfo: .rdata |
| 20D20 | 140001D25 | .pdata | ExceptionHook | Pointer to 1D25 - 0x1125 .text + UnwindInfo: .rdata |
| 20D2C | 140001E81 | .pdata | ExceptionHook | Pointer to 1E81 - 0x1281 .text + UnwindInfo: .rdata |
| 20D38 | 140001FD1 | .pdata | ExceptionHook | Pointer to 1FD1 - 0x13D1 .text + UnwindInfo: .rdata |
| 20D44 | 140002000 | .pdata | ExceptionHook | Pointer to 2000 - 0x1400 .text + UnwindInfo: .rdata |
| 20D50 | 140002038 | .pdata | ExceptionHook | Pointer to 2038 - 0x1438 .text + UnwindInfo: .rdata |
| 20D5C | 140002058 | .pdata | ExceptionHook | Pointer to 2058 - 0x1458 .text + UnwindInfo: .rdata |
| 20D68 | 1400020D0 | .pdata | ExceptionHook | Pointer to 20D0 - 0x14D0 .text + UnwindInfo: .rdata |
| 20D74 | 140002130 | .pdata | ExceptionHook | Pointer to 2130 - 0x1530 .text + UnwindInfo: .rdata |
| 20D80 | 140002150 | .pdata | ExceptionHook | Pointer to 2150 - 0x1550 .text + UnwindInfo: .rdata |
| 20D8C | 140002208 | .pdata | ExceptionHook | Pointer to 2208 - 0x1608 .text + UnwindInfo: .rdata |
| 20D98 | 140002218 | .pdata | ExceptionHook | Pointer to 2218 - 0x1618 .text + UnwindInfo: .rdata |
| 20DA4 | 140002234 | .pdata | ExceptionHook | Pointer to 2234 - 0x1634 .text + UnwindInfo: .rdata |
| 20DB0 | 1400023A8 | .pdata | ExceptionHook | Pointer to 23A8 - 0x17A8 .text + UnwindInfo: .rdata |
| 20DBC | 1400023BC | .pdata | ExceptionHook | Pointer to 23BC - 0x17BC .text + UnwindInfo: .rdata |
| 20DC8 | 140002400 | .pdata | ExceptionHook | Pointer to 2400 - 0x1800 .text + UnwindInfo: .rdata |
| 20DD4 | 140002434 | .pdata | ExceptionHook | Pointer to 2434 - 0x1834 .text + UnwindInfo: .rdata |
| 20DE0 | 140002508 | .pdata | ExceptionHook | Pointer to 2508 - 0x1908 .text + UnwindInfo: .rdata |
| 20DEC | 14000257C | .pdata | ExceptionHook | Pointer to 257C - 0x197C .text + UnwindInfo: .rdata |
| 20DF8 | 1400025B8 | .pdata | ExceptionHook | Pointer to 25B8 - 0x19B8 .text + UnwindInfo: .rdata |
| 20E04 | 1400025F4 | .pdata | ExceptionHook | Pointer to 25F4 - 0x19F4 .text + UnwindInfo: .rdata |
| 20E10 | 140002680 | .pdata | ExceptionHook | Pointer to 2680 - 0x1A80 .text + UnwindInfo: .rdata |
| 20E1C | 140002718 | .pdata | ExceptionHook | Pointer to 2718 - 0x1B18 .text + UnwindInfo: .rdata |
| 20E28 | 14000273C | .pdata | ExceptionHook | Pointer to 273C - 0x1B3C .text + UnwindInfo: .rdata |
| 20E34 | 140002768 | .pdata | ExceptionHook | Pointer to 2768 - 0x1B68 .text + UnwindInfo: .rdata |
| 20E40 | 1400027A4 | .pdata | ExceptionHook | Pointer to 27A4 - 0x1BA4 .text + UnwindInfo: .rdata |
| 20E4C | 1400027BC | .pdata | ExceptionHook | Pointer to 27BC - 0x1BBC .text + UnwindInfo: .rdata |
| 20E58 | 140002894 | .pdata | ExceptionHook | Pointer to 2894 - 0x1C94 .text + UnwindInfo: .rdata |
| 20E64 | 1400028D4 | .pdata | ExceptionHook | Pointer to 28D4 - 0x1CD4 .text + UnwindInfo: .rdata |
| 20E70 | 140002A1C | .pdata | ExceptionHook | Pointer to 2A1C - 0x1E1C .text + UnwindInfo: .rdata |
| 20E7C | 140002A60 | .pdata | ExceptionHook | Pointer to 2A60 - 0x1E60 .text + UnwindInfo: .rdata |
| 20E88 | 140002AC4 | .pdata | ExceptionHook | Pointer to 2AC4 - 0x1EC4 .text + UnwindInfo: .rdata |
| 20E94 | 140002B20 | .pdata | ExceptionHook | Pointer to 2B20 - 0x1F20 .text + UnwindInfo: .rdata |
| 20EA0 | 140002B5C | .pdata | ExceptionHook | Pointer to 2B5C - 0x1F5C .text + UnwindInfo: .rdata |
| 20EAC | 140002B98 | .pdata | ExceptionHook | Pointer to 2B98 - 0x1F98 .text + UnwindInfo: .rdata |
| 20EB8 | 140002BF4 | .pdata | ExceptionHook | Pointer to 2BF4 - 0x1FF4 .text + UnwindInfo: .rdata |
| 20EC4 | 140002C50 | .pdata | ExceptionHook | Pointer to 2C50 - 0x2050 .text + UnwindInfo: .rdata |
| 20ED0 | 140002C98 | .pdata | ExceptionHook | Pointer to 2C98 - 0x2098 .text + UnwindInfo: .rdata |
| 20EDC | 140002CDC | .pdata | ExceptionHook | Pointer to 2CDC - 0x20DC .text + UnwindInfo: .rdata |
| 20EE8 | 140002CFC | .pdata | ExceptionHook | Pointer to 2CFC - 0x20FC .text + UnwindInfo: .rdata |
| 20EF4 | 140002D30 | .pdata | ExceptionHook | Pointer to 2D30 - 0x2130 .text + UnwindInfo: .rdata |
| 20F00 | 140002EF0 | .pdata | ExceptionHook | Pointer to 2EF0 - 0x22F0 .text + UnwindInfo: .rdata |
| 20F0C | 140002F20 | .pdata | ExceptionHook | Pointer to 2F20 - 0x2320 .text + UnwindInfo: .rdata |
| 20F18 | 140003138 | .pdata | ExceptionHook | Pointer to 3138 - 0x2538 .text + UnwindInfo: .rdata |
| 20F24 | 140003160 | .pdata | ExceptionHook | Pointer to 3160 - 0x2560 .text + UnwindInfo: .rdata |
| 20F30 | 1400031A4 | .pdata | ExceptionHook | Pointer to 31A4 - 0x25A4 .text + UnwindInfo: .rdata |
| 20F3C | 140003218 | .pdata | ExceptionHook | Pointer to 3218 - 0x2618 .text + UnwindInfo: .rdata |
| 20F48 | 14000326C | .pdata | ExceptionHook | Pointer to 326C - 0x266C .text + UnwindInfo: .rdata |
| 20F54 | 1400032D4 | .pdata | ExceptionHook | Pointer to 32D4 - 0x26D4 .text + UnwindInfo: .rdata |
| 20F60 | 1400032E8 | .pdata | ExceptionHook | Pointer to 32E8 - 0x26E8 .text + UnwindInfo: .rdata |
| 20F6C | 1400032FC | .pdata | ExceptionHook | Pointer to 32FC - 0x26FC .text + UnwindInfo: .rdata |
| 20F78 | 140003308 | .pdata | ExceptionHook | Pointer to 3308 - 0x2708 .text + UnwindInfo: .rdata |
| 20F84 | 140003398 | .pdata | ExceptionHook | Pointer to 3398 - 0x2798 .text + UnwindInfo: .rdata |
| 20F90 | 1400033C0 | .pdata | ExceptionHook | Pointer to 33C0 - 0x27C0 .text + UnwindInfo: .rdata |
| 20F9C | 1400034A0 | .pdata | ExceptionHook | Pointer to 34A0 - 0x28A0 .text + UnwindInfo: .rdata |
| 20FA8 | 1400034C0 | .pdata | ExceptionHook | Pointer to 34C0 - 0x28C0 .text + UnwindInfo: .rdata |
| 20FB4 | 1400034D0 | .pdata | ExceptionHook | Pointer to 34D0 - 0x28D0 .text + UnwindInfo: .rdata |
| 20FC0 | 14000350C | .pdata | ExceptionHook | Pointer to 350C - 0x290C .text + UnwindInfo: .rdata |
| 20FCC | 14000352C | .pdata | ExceptionHook | Pointer to 352C - 0x292C .text + UnwindInfo: .rdata |
| 20FD8 | 140003548 | .pdata | ExceptionHook | Pointer to 3548 - 0x2948 .text + UnwindInfo: .rdata |
| 20FE4 | 140003608 | .pdata | ExceptionHook | Pointer to 3608 - 0x2A08 .text + UnwindInfo: .rdata |
| 20FF0 | 140003650 | .pdata | ExceptionHook | Pointer to 3650 - 0x2A50 .text + UnwindInfo: .rdata |
| 20FFC | 140003674 | .pdata | ExceptionHook | Pointer to 3674 - 0x2A74 .text + UnwindInfo: .rdata |
| 21008 | 1400036BC | .pdata | ExceptionHook | Pointer to 36BC - 0x2ABC .text + UnwindInfo: .rdata |
| 21014 | 140003710 | .pdata | ExceptionHook | Pointer to 3710 - 0x2B10 .text + UnwindInfo: .rdata |
| 21020 | 140003B40 | .pdata | ExceptionHook | Pointer to 3B40 - 0x2F40 .text + UnwindInfo: .rdata |
| 2102C | 140003F70 | .pdata | ExceptionHook | Pointer to 3F70 - 0x3370 .text + UnwindInfo: .rdata |
| 21038 | 140004220 | .pdata | ExceptionHook | Pointer to 4220 - 0x3620 .text + UnwindInfo: .rdata |
| 21044 | 1400044B8 | .pdata | ExceptionHook | Pointer to 44B8 - 0x38B8 .text + UnwindInfo: .rdata |
| 21050 | 140004608 | .pdata | ExceptionHook | Pointer to 4608 - 0x3A08 .text + UnwindInfo: .rdata |
| 2105C | 140004650 | .pdata | ExceptionHook | Pointer to 4650 - 0x3A50 .text + UnwindInfo: .rdata |
| 21068 | 140004698 | .pdata | ExceptionHook | Pointer to 4698 - 0x3A98 .text + UnwindInfo: .rdata |
| 21074 | 1400046E0 | .pdata | ExceptionHook | Pointer to 46E0 - 0x3AE0 .text + UnwindInfo: .rdata |
| 21080 | 140004734 | .pdata | ExceptionHook | Pointer to 4734 - 0x3B34 .text + UnwindInfo: .rdata |
| 2108C | 140004798 | .pdata | ExceptionHook | Pointer to 4798 - 0x3B98 .text + UnwindInfo: .rdata |
| 21098 | 1400047EC | .pdata | ExceptionHook | Pointer to 47EC - 0x3BEC .text + UnwindInfo: .rdata |
| 210A4 | 140004850 | .pdata | ExceptionHook | Pointer to 4850 - 0x3C50 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 224232 | 63,5636% |
| Null Byte Code | 38079 | 10,7943% |
© 2026 All rights reserved.