PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,44 MBSHA-256 Hash: 4C70267CA03A00EA761EC358498B990A7221DECB36EACE9B7DBE6A751BE0FB3B SHA-1 Hash: 01E87BF2EDE7F0442AAE780FE7E3BBCB13BFE477 MD5 Hash: DD1863B03E5997A1BE920BEE34E68D97 Imphash: DC22E17D7B3D3810F470E944518F828C MajorOSVersion: 5 MinorOSVersion: 1 CheckSum: 00173898 EntryPoint (rva): A2086 SizeOfHeaders: 400 SizeOfImage: 173000 ImageBase: 400000 Architecture: x86 ImportTable: 102590 IAT: 102BB4 Characteristics: 102 TimeDateStamp: 6A7EADE5 Date: 14/08/2026 5:55:49 File Type: EXE Number Of Sections: 8 ASLR: Enabled Section Names: .text, .rdata, .data, .00cfg, .tls, .voltbl, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | C9600 | 1000 | C95DA |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
C9A00 | 3A200 | CB000 | 3A174 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
103C00 | C00 | 106000 | 2EE8 |
|
|
| .00cfg | 0x40000040 Initialized Data Readable |
104800 | 200 | 109000 | 8 |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
104A00 | 200 | 10A000 | 9 |
|
|
| .voltbl | 0x None |
104C00 | 200 | 10B000 | 92 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
104E00 | 5C600 | 10C000 | 5C5F8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
161400 | 9C00 | 169000 | 9B4C |
|
|
| Description |
| OriginalFilename: PuTTY CompanyName: Simon Tatham LegalCopyright: Copyright 1997-2026 Simon Tatham. ProductName: PuTTY suite FileVersion: Release 0.85 (with embedded help) FileDescription: SSH, Telnet, Rlogin, and SUPDUP client ProductVersion: Release 0.85 Language: English (United Kingdom) (ID=0x809) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - A1486 Code -> E856020000E97AFEFFFF558BECFF7508E80A000000F7D8591BC0F7D8485DC3558BEC833DE8865000FFFF75087507E895E000 EP changed to another address -> (Address Of EntryPoint > Base Of Data) Assembler |CALL 0X4A22E1 |JMP 0X4A1F0A |PUSH EBP |MOV EBP, ESP |PUSH DWORD PTR [EBP + 8] |CALL 0X4A20A5 |NEG EAX |POP ECX |SBB EAX, EAX |NEG EAX |DEC EAX |POP EBP |RET |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [0X5086E8], -1 |PUSH DWORD PTR [EBP + 8] |JNE 0X4A20BB |
| Signatures |
| Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Compiler: Microsoft Visual C ++ Detect It Easy (die) • PE: compiler: EP:Microsoft Visual C/C++(2017 v.15.5-6)[EXE32] • PE: compiler: Microsoft Visual C/C++(2015 v.14.0)[-] • PE: linker: Microsoft Linker(14.0)[-] • PE: Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 7.11016 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| Ws2_32.DLL | socket | Possible Call API By Name | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Possible Call API By Name | Establish a connection to a specified socket. |
| ADVAPI32.DLL | CryptAcquireContextA | Acquires a cryptographic provider context. |
| ADVAPI32.DLL | CryptReleaseContext | Releases a cryptographic provider context. |
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | CreateProcessA | Creates and starts a new process. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | WSAStartup | Initializes the Winsock networking library. |
| Ws2_32.DLL | WSACleanup | Releases Winsock networking resources. |
| Ws2_32.DLL | bind | Associates a socket with a local address. |
| Ws2_32.DLL | listen | Puts a socket into listening mode. |
| Ws2_32.DLL | accept | Accepts an incoming network connection. |
| Ws2_32.DLL | recv | Receives data from a network socket. |
| Ws2_32.DLL | send | Sends data through a network socket. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegDeleteKeyA | Used to delete a subkey and its values from the Windows registry. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| Windows REG |
| Software\SimonTatham\PuTTY\Jumplist Software\SimonTatham\PuTTY\SshHostKeys SOFTWARE\MIT\Kerberos Software\SimonTatham\PuTTY\Sessions Software\SimonTatham\PuTTY\SshHostCAs Software\SimonTatham Software\SimonTatham\PuTTY\CHMPath Software\SimonTatham\PuTTY64\CHMPath Software\SimonTatham\PuTTY |
| File Access |
| PuTTYgen.exe Pageant.exe ADVAPI32.dll COMDLG32.dll SHELL32.dll KERNEL32.dll USER32.dll ole32.dll IMM32.dll GDI32.dll .dll Dynamic Library Files (*.dll Using GSSAPI from GSSAPI32.DLL MIT Kerberos GSSAPI32.DLL Microsoft SSPI SECUR32.DLL Using SSPI from SECUR32.DLL ws2_32.dll \gssapi32.dll wsock32.dll comctl32.dll secur32.dll crypt32.dll wship6.dll shcore.dll sspicli.dll dwmapi.dll winmm.dll spoolss.dll @.dat putty.log Temp |
| File Access (UNICODE) |
| mscoree.dll *.dll Dynamic Library Files (*.dll Temp |
| Interest's Words |
| Encrypt Decrypt Encryption PassWord exec attrib start pause cipher hostname sdelete shutdown ping route |
| Interest's Words (UNICODE) |
| zombie PassWord start cipher ping |
| URLs |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings http://schemas.microsoft.com/SMI/2016/WindowsSettings http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0 http://ocsp.sectigo.com http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl http://ocsp.usertrust.com http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0 http://crl.sectigo.com/SectigoPublicTimeStampingCAR41.crl http://crt.sectigo.com/SectigoPublicTimeStampingCAR41.crt https://www.chiark.greenend.org.uk/~sgtatham/putty/ https://sectigo.com/CPS0 https://sectigo.com/CPS0J |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Encryption (Blowfish) |
| Text | Ascii | Antivirus Software (f-prot) |
| Text | Ascii | Keyboard Key (Alt+) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (CapsLock) |
| Text | Ascii | Keyboard Key (Backspace) |
| Text | Ascii | Information used to authenticate a user’s identity (Credential) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Ascii | Technique used to circumvent security measures (Bypass) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ v7.0 |
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 10C520 | 128 | 105320 | 2800000010000000200000000100040000000000800000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \ICON\2\1033 | 10C648 | 2E8 | 105448 | 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\3\1033 | 10C930 | 668 | 105730 | 2800000030000000600000000100040000000000800400000000000000000000000000000000000000000000000080000080 | (...0............................................ |
| \ICON\4\1033 | 10CF98 | B0 | 105D98 | 2800000010000000200000000100010000000000400000000000000000000000000000000000000000000000FFFFFF000000 | (....... ...........@............................. |
| \ICON\5\1033 | 10D048 | 130 | 105E48 | 2800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFFFF000000 | (... ...@......................................... |
| \ICON\6\1033 | 10D178 | 330 | 105F78 | 2800000030000000600000000100010000000000800100000000000000000000000000000000000000000000FFFFFF000000 | (...0............................................ |
| \ICON\7\1033 | 10D508 | 128 | 106308 | 2800000010000000200000000100040000000000800000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \ICON\8\1033 | 10D630 | 2E8 | 106430 | 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\9\1033 | 10D918 | 668 | 106718 | 2800000030000000600000000100040000000000800400000000000000000000000000000000000000000000000080000080 | (...0............................................ |
| \ICON\10\1033 | 10DF80 | B0 | 106D80 | 2800000010000000200000000100010000000000400000000000000000000000000000000000000000000000FFFFFF000000 | (....... ...........@............................. |
| \ICON\11\1033 | 10E030 | 130 | 106E30 | 2800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFFFF000000 | (... ...@......................................... |
| \ICON\12\1033 | 10E160 | 330 | 106F60 | 2800000030000000600000000100010000000000800100000000000000000000000000000000000000000000FFFFFF000000 | (...0............................................ |
| \DIALOG\102\1033 | 167860 | 76 | 160660 | C000C880000000000000000000002C01FC0000005000750054005400590043006F006E0066006900670042006F0078000000 | ..............,.....P.u.T.T.Y.C.o.n.f.i.g.B.o.x... |
| \DIALOG\110\1033 | 1678D8 | BA | 1606D8 | C000C880000000000300640014002C017700000000005000750054005400590020004500760065006E00740020004C006F00 | ..........d...,.w.....P.u.T.T.Y. .E.v.e.n.t. .L.o. |
| \DIALOG\111\1033 | 167760 | FA | 160560 | C000C8800000000004008C0028000E01880000000000410062006F0075007400200050007500540054005900000008004D00 | ............(.........A.b.o.u.t. .P.u.T.T.Y.....M. |
| \DIALOG\113\1033 | 167998 | 8A | 160798 | C000C880000000000200320032004601EF00000000005000750054005400590020004C006900630065006E00630065000000 | ..........2.2.F.......P.u.T.T.Y. .L.i.c.e.n.c.e... |
| \DIALOG\114\1033 | 167A28 | 1AE | 160828 | C000C880000000000800320032005401F00000005000750054005400590048006F00730074004B0065007900440069006100 | ..........2.2.T.....P.u.T.T.Y.H.o.s.t.K.e.y.D.i.a. |
| \DIALOG\116\1033 | 167BD8 | DE | 1609D8 | C000C8800000000001008C00280090012C0100005000750054005400590048006F00730074004B00650079004D006F007200 | ............(...,...P.u.T.T.Y.H.o.s.t.K.e.y.M.o.r. |
| \DIALOG\117\1033 | 167CB8 | A8 | 160AB8 | C000C880000000000000000000005E01040100005000750054005400590043006F006E0066006900670042006F0078000000 | ...................P.u.T.T.Y.C.o.n.f.i.g.B.o.x... |
| \GROUP_ICON\200\1033 | 10D4A8 | 5A | 1062A8 | 00000100060010101000010004002801000001002020100001000400E8020000020030301000010004006806000003001010020001000100B0000000040020200200010001003001000005003030020001000100300300000600 | ..............(..... ............00......h................... ......0.....00......0..... |
| \GROUP_ICON\201\1033 | 10E490 | 5A | 107290 | 00000100060010101000010004002801000007002020100001000400E8020000080030301000010004006806000009001010020001000100B00000000A002020020001000100300100000B003030020001000100300300000C00 | ..............(..... ............00......h................... ......0.....00......0..... |
| \VERSION\1\1033 | 167D60 | 338 | 160B60 | 380334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001005500 | 8.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............U. |
| \24\1\1033 | 168098 | 559 | 160E98 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| \2000\2000\1033 | 10E4F0 | 5926B | 1072F0 | 49545346030000006000000001000000123456780908000010FD017CAA7BD0119E0C00A0C922E6EC11FD017CAA7BD0119E0C | ITSF............4Vx.......|.{.......".....|.{.... |
| Intelligent String |
| • @.tls • Version string did not have expected prefix • Pageant.exePuTTYgen.exe • .wav • part.ptr • .dll • .ppk • /putty/ssh/login1.c • ssh->gss_state.lib • strncmp(pipename, "\\\\.\\pipe\\", 9) == 0 • *.dll • *.ppk • *.WAV • mscoree.dll • contents.hhc • SSH, Telnet, Rlogin, and SUPDUP client • xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"> • xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings"> |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 4E2 | 502DC4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4F3 | 502DC0 | .text | CALL [static] | Indirect call to absolute memory address |
| 519 | 502E00 | .text | CALL [static] | Indirect call to absolute memory address |
| 560 | 502D80 | .text | CALL [static] | Indirect call to absolute memory address |
| 5F0 | 502E80 | .text | CALL [static] | Indirect call to absolute memory address |
| 681 | 502D28 | .text | CALL [static] | Indirect call to absolute memory address |
| 71F | 502E6C | .text | CALL [static] | Indirect call to absolute memory address |
| 72E | 502DF8 | .text | CALL [static] | Indirect call to absolute memory address |
| 7BC | 502C44 | .text | CALL [static] | Indirect call to absolute memory address |
| 7C7 | 502C7C | .text | CALL [static] | Indirect call to absolute memory address |
| 82D | 502D54 | .text | CALL [static] | Indirect call to absolute memory address |
| 83D | 502D58 | .text | CALL [static] | Indirect call to absolute memory address |
| A0C | 502D6C | .text | CALL [static] | Indirect call to absolute memory address |
| C45 | 502D88 | .text | CALL [static] | Indirect call to absolute memory address |
| D00 | 502CC4 | .text | CALL [static] | Indirect call to absolute memory address |
| D07 | 502E68 | .text | CALL [static] | Indirect call to absolute memory address |
| DAF | 502E6C | .text | CALL [static] | Indirect call to absolute memory address |
| DCC | 502CEC | .text | CALL [static] | Indirect call to absolute memory address |
| E07 | 502E6C | .text | CALL [static] | Indirect call to absolute memory address |
| E91 | 502DD4 | .text | CALL [static] | Indirect call to absolute memory address |
| E9D | 502CF4 | .text | CALL [static] | Indirect call to absolute memory address |
| F1A | 502F60 | .text | CALL [static] | Indirect call to absolute memory address |
| F39 | 502D9C | .text | CALL [static] | Indirect call to absolute memory address |
| F48 | 502CB0 | .text | CALL [static] | Indirect call to absolute memory address |
| F5E | 502C50 | .text | CALL [static] | Indirect call to absolute memory address |
| F65 | 502C44 | .text | CALL [static] | Indirect call to absolute memory address |
| 1087 | 502BD4 | .text | CALL [static] | Indirect call to absolute memory address |
| 10AD | 502BD0 | .text | CALL [static] | Indirect call to absolute memory address |
| 10D9 | 502C34 | .text | CALL [static] | Indirect call to absolute memory address |
| 110A | 502BE0 | .text | CALL [static] | Indirect call to absolute memory address |
| 112D | 502C48 | .text | CALL [static] | Indirect call to absolute memory address |
| 1185 | 502D1C | .text | CALL [static] | Indirect call to absolute memory address |
| 118C | 502E68 | .text | CALL [static] | Indirect call to absolute memory address |
| 11CC | 502C44 | .text | CALL [static] | Indirect call to absolute memory address |
| 11D7 | 502C7C | .text | CALL [static] | Indirect call to absolute memory address |
| 120C | 502FC4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1336 | 502D3C | .text | CALL [static] | Indirect call to absolute memory address |
| 1357 | 502E7C | .text | CALL [static] | Indirect call to absolute memory address |
| 13EC | 502DA4 | .text | CALL [static] | Indirect call to absolute memory address |
| 13FD | 502D30 | .text | CALL [static] | Indirect call to absolute memory address |
| 146E | 502DA4 | .text | CALL [static] | Indirect call to absolute memory address |
| 14E1 | 502E6C | .text | CALL [static] | Indirect call to absolute memory address |
| 14F3 | 502D3C | .text | CALL [static] | Indirect call to absolute memory address |
| 152F | 506C18 | .text | CALL [static] | Indirect call to absolute memory address |
| 1563 | 502DB8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1572 | 502D80 | .text | CALL [static] | Indirect call to absolute memory address |
| 15BD | 502D58 | .text | CALL [static] | Indirect call to absolute memory address |
| 15F0 | 502D58 | .text | CALL [static] | Indirect call to absolute memory address |
| 1940 | 502D60 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B43 | 502E0C | .text | CALL [static] | Indirect call to absolute memory address |
| 1B94 | 503030 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BBF | 503030 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C54 | 502D24 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C77 | 502D58 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E2D | 502E14 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E43 | 502D58 | .text | CALL [static] | Indirect call to absolute memory address |
| 1EEF | 502CE4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FD1 | 502EA8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FE9 | 503028 | .text | CALL [static] | Indirect call to absolute memory address |
| 2007 | 5030A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 21ED | 502E24 | .text | CALL [static] | Indirect call to absolute memory address |
| 22F1 | 502DA4 | .text | CALL [static] | Indirect call to absolute memory address |
| 23AF | 502E48 | .text | CALL [static] | Indirect call to absolute memory address |
| 26D2 | 502DF4 | .text | CALL [static] | Indirect call to absolute memory address |
| 27D3 | 502F68 | .text | CALL [static] | Indirect call to absolute memory address |
| 2827 | 502EBC | .text | CALL [static] | Indirect call to absolute memory address |
| 2844 | 502E94 | .text | CALL [static] | Indirect call to absolute memory address |
| 288F | 502E1C | .text | CALL [static] | Indirect call to absolute memory address |
| 290A | 502CE4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2BE1 | 502E78 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C66 | 503030 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E29 | 502E6C | .text | CALL [static] | Indirect call to absolute memory address |
| 2EB7 | 502DD0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F02 | 502E1C | .text | CALL [static] | Indirect call to absolute memory address |
| 2F7F | 502DB8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F99 | 502E70 | .text | CALL [static] | Indirect call to absolute memory address |
| 304C | 502BDC | .text | CALL [static] | Indirect call to absolute memory address |
| 3124 | 502DB8 | .text | CALL [static] | Indirect call to absolute memory address |
| 32AE | 502E5C | .text | CALL [static] | Indirect call to absolute memory address |
| 335A | 502E54 | .text | CALL [static] | Indirect call to absolute memory address |
| 336A | 502E54 | .text | CALL [static] | Indirect call to absolute memory address |
| 3380 | 502E5C | .text | CALL [static] | Indirect call to absolute memory address |
| 3393 | 502DB8 | .text | CALL [static] | Indirect call to absolute memory address |
| 34F5 | 502DA4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3637 | 502E1C | .text | CALL [static] | Indirect call to absolute memory address |
| 3CBD | 502E08 | .text | CALL [static] | Indirect call to absolute memory address |
| 3DB1 | 502F80 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E6C | 502CA0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E96 | 502DD4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F9C | 506C18 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FC4 | 502D44 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FD0 | 502D30 | .text | CALL [static] | Indirect call to absolute memory address |
| 40FA | 502CD8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4107 | 502F58 | .text | CALL [static] | Indirect call to absolute memory address |
| 4182 | 506C10 | .text | CALL [static] | Indirect call to absolute memory address |
| 41BA | 502D40 | .text | CALL [static] | Indirect call to absolute memory address |
| 41E2 | 502E10 | .text | CALL [static] | Indirect call to absolute memory address |
| 4203 | 502E54 | .text | CALL [static] | Indirect call to absolute memory address |
| 4386 | 502D88 | .text | CALL [static] | Indirect call to absolute memory address |
| 4394 | 502D30 | .text | CALL [static] | Indirect call to absolute memory address |
| C99DA-C99FF | N/A | .text | Unusual BP Cave, count: 38 |
| 16B000 | N/A | *Overlay* | 98680000000202003082688A06092A864886F70D | .h......0.h...*.H... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 956273 | 63,1777% |
| Null Byte Code | 193269 | 12,7686% |
| NOP Cave Found | 0x9090909090 | Block Count: 1815 | Total: 0,2998% |
© 2026 All rights reserved.