PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,07 MBSHA-256 Hash: F0DEE73702531AA0F6CFCFC5E85D912ECDB8728C1DDA7DCE4EDE3143AC567755 SHA-1 Hash: B0D43285D92C4E4B9BE19185006FC63E6F0E729D MD5 Hash: E579C6EA3A7FF39954DB37EA2ECBC099 Imphash: 359C14F8F772E20080ADD3E91E47F7DA MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00120C94 EntryPoint (rva): FE200 SizeOfHeaders: 400 SizeOfImage: 11E000 ImageBase: 400000 Architecture: x86 ImportTable: FEB8C Characteristics: 818E TimeDateStamp: 595D2D15 Date: 05/07/2017 18:16:53 File Type: EXE Number Of Sections: 10 ASLR: Disabled Section Names: .text, .itext, .data, .bss, .idata, .tls, .rdata, .reloc, .rsrc, RY4SHL Number Of Executable Sections: 2 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0xE0000060 Code Initialized Data Executable Readable Writeable |
400 | A5600 | 1000 | A6000 |
|
|
| .itext | 0xE0000060 Code Initialized Data Executable Readable Writeable |
A5A00 | C00 | A7000 | 1000 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
A6600 | BE00 | A8000 | C000 |
|
|
| .bss | 0xC0000000 Readable Writeable |
B2400 | 0 | B4000 | 7000 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
B2400 | 2E00 | BB000 | 3000 |
|
|
| .tls | 0xC0000000 Readable Writeable |
B5200 | 0 | BE000 | 1000 |
|
|
| .rdata | 0xC0000040 Initialized Data Readable Writeable |
B5200 | 200 | BF000 | 1000 |
|
|
| .reloc | 0xC2000040 Initialized Data GP-Relative Readable Writeable |
B5400 | BA00 | C0000 | C000 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
C0E00 | E400 | CC000 | F000 |
|
|
| RY4SHL | 0xC0000040 Initialized Data Readable Writeable |
CF200 | 42A00 | DB000 | 43000 |
|
|
| Entry Point |
The section number (10) - (RY4SHL) have the Entry Point Information -> EntryPoint (calculated) - F2400 Code -> E8DE020000EB2280BA3038857F8A439B192AFDFBE18BCA237B58847AAAF84EBBAC795EE5561788FF1550C3196372713AF100 EP changed to another address -> (Address Of EntryPoint > Base Of Data) Assembler |CALL 0X12E3 |JMP 0X1029 |CMP BYTE PTR [EDX + 0X7F853830], 0X8A |INC EBX |WAIT |SBB DWORD PTR [EDX], EBP |STD |STI |LOOPE 0XFA1 |RETF 0X7B23 |POP EAX |TEST BYTE PTR [EDX - 0X56], BH |CLC |DEC ESI |MOV EBX, 0XE55E79AC |PUSH ESI |POP SS |MOV BH, BH |ADC EAX, 0X6319C350 |JB 0X10A0 |CMP DH, CL |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: compiler: Embarcadero Delphi(2009-2010)[-] • PE: protection: Rainbow Sentinel dongle reference(-)[-] • Entropy: 7.77003 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CopyFileA | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| USER32.DLL | CallWindowProcA | Invokes the window procedure for the specified window and messages. |
| File Access |
| ADVAPI32.dll USER32.dll KERNEL32.dll shell32.dll comctl32.dll ole32.dll version.dll gdi32.dll oleaut32.dll Glyph.Dat .dat SYSTEM.INI Temp |
| Interest's Words |
| PassWord exec attrib start ping |
| Interest's Words (UNICODE) |
| exec start hostname expand replace route |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Unicode | WinAPI Sockets (connect) |
| Text | Unicode | WinAPI Sockets (send) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CopyFile) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | Service (OpenSCManager) |
| Text | Ascii | Service (CreateService) |
| Text | Ascii | Encryption (Blowfish) |
| Text | Ascii | Encryption (Rijndael) |
| Text | Ascii | Encryption (Twofish) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Reconnaissance (FindFirstFileA) |
| Text | Ascii | Reconnaissance (FindNextFileA) |
| Text | Ascii | Stealth (ExitThread) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (IsBadReadPtr) |
| Text | Ascii | Stealth (UnmapViewOfFile) |
| Text | Ascii | Stealth (MapViewOfFile) |
| Text | Ascii | Stealth (CreateFileMappingA) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Unicode | Keyboard Key (Alt+) |
| Text | Ascii | Technique used to capture communications between systems (Intercept) |
| Entry Point | Hex Pattern | NE-Exe Executable Image |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \CURSOR\1\1033 | CCC78 | 134 | C1A78 | 070001002800000020000000400000000100010000000000000200000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\2\1033 | CCDAC | 134 | C1BAC | 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\3\1033 | CCEE0 | 134 | C1CE0 | 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\4\1033 | CD014 | 134 | C1E14 | 0E000C002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\5\1033 | CD148 | 134 | C1F48 | 10000E002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\6\1033 | CD27C | 134 | C207C | 000000002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\7\1033 | CD3B0 | 134 | C21B0 | 020002002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \BITMAP\BBABORT\1033 | CD4E4 | 1D0 | C22E4 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBALL\1033 | CD6B4 | 1E4 | C24B4 | 28000000240000001300000001000400000000007C0100000000000000000000100000000000000000000000000080000080 | (...$...............|............................. |
| \BITMAP\BBCANCEL\1033 | CD898 | 1D0 | C2698 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBCLOSE\1033 | CDA68 | 1D0 | C2868 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBHELP\1033 | CDC38 | 1D0 | C2A38 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBIGNORE\1033 | CDE08 | 1D0 | C2C08 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBNO\1033 | CDFD8 | 1D0 | C2DD8 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBOK\1033 | CE1A8 | 1D0 | C2FA8 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBRETRY\1033 | CE378 | 1D0 | C3178 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBYES\1033 | CE548 | 1D0 | C3348 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \ICON\1\1033 | CE718 | 25A8 | C3518 | 280000003000000060000000010020000000000080250000000000000000000000000000000000003030A6633030A59F3030 | (...0........ ......%..................00.c00..00 |
| \ICON\2\1033 | D0CC0 | 10A8 | C5AC0 | 280000002000000040000000010020000000000080100000000000000000000000000000000000003030A68F3030A5BF3030 | (... ...@..... .........................00..00..00 |
| \ICON\3\1033 | D1D68 | 988 | C6B68 | 280000001800000030000000010020000000000060090000000000000000000000000000000000003030A6A83030A5CF2F2F | (.......0..... ........................00..00..// |
| \ICON\4\1033 | D26F0 | 468 | C74F0 | 280000001000000020000000010020000000000040040000000000000000000000000000000000003030A6C33030A4DF3030 | (....... ..... .....@...................00..00..00 |
| \STRING\4075\0 | D2B58 | 164 | C7958 | 0E004F004C00450020006500720072006F007200200025002E00380078002E004D006500740068006F006400200027002500 | ..O.L.E. .e.r.r.o.r. .%...8.x...M.e.t.h.o.d. .'.%. |
| \STRING\4076\0 | D2CBC | 494 | C7ABC | 3B00430061006E006E006F0074002000630061006C006C0020005400650072006D0069006E0061007400650041006E006400 | ;.C.a.n.n.o.t. .c.a.l.l. .T.e.r.m.i.n.a.t.e.A.n.d. |
| \STRING\4077\0 | D3150 | 2B4 | C7F50 | 14004E006500740077006F0072006B00200075006E0072006500610063006800610062006C0065002E00110048006F007300 | ..N.e.t.w.o.r.k. .u.n.r.e.a.c.h.a.b.l.e.....H.o.s. |
| \STRING\4078\0 | D3404 | 46C | C8204 | 10004900500076003600200075006E0061007600610069006C00610062006C0065001E002500730020006900730020006E00 | ..I.P.v.6. .u.n.a.v.a.i.l.a.b.l.e...%.s. .i.s. .n. |
| \STRING\4079\0 | D3870 | 3A0 | C8670 | 130043006F006E006E0065006300740069006F006E00200072006500660075007300650064002E00220054006F006F002000 | ..C.o.n.n.e.c.t.i.o.n. .r.e.f.u.s.e.d...".T.o.o. . |
| \STRING\4080\0 | D3C10 | 3D8 | C8A10 | 22004F007000650072006100740069006F006E0020006E006F007400200073007500700070006F0072007400650064002000 | ".O.p.e.r.a.t.i.o.n. .n.o.t. .s.u.p.p.o.r.t.e.d. . |
| \STRING\4081\0 | D3FE8 | 2F0 | C8DE8 | 180049006E007400650072007200750070007400650064002000730079007300740065006D002000630061006C006C002E00 | ..I.n.t.e.r.r.u.p.t.e.d. .s.y.s.t.e.m. .c.a.l.l... |
| \STRING\4082\0 | D42D8 | 3C0 | C90D8 | 1B0020002D00200044006F0063006B0020007A006F006E006500200068006100730020006E006F00200063006F006E007400 | .. .-. .D.o.c.k. .z.o.n.e. .h.a.s. .n.o. .c.o.n.t. |
| \STRING\4083\0 | D4698 | 240 | C9498 | 020055007000050052006900670068007400040044006F0077006E00030049006E0073000300440065006C00060053006800 | ..U.p...R.i.g.h.t...D.o.w.n...I.n.s...D.e.l...S.h. |
| \STRING\4084\0 | D48D8 | C8 | C96D8 | 06002600410062006F0072007400060026005200650074007200790007002600490067006E006F0072006500040026004100 | ..&.A.b.o.r.t...&.R.e.t.r.y...&.I.g.n.o.r.e...&.A. |
| \STRING\4085\0 | D49A0 | 108 | C97A0 | 0500410062006F00720074000400260041006C006C001200430061006E006E006F0074002000640072006100670020006100 | ..A.b.o.r.t...&.A.l.l...C.a.n.n.o.t. .d.r.a.g. .a. |
| \STRING\4086\0 | D4AA8 | 2A8 | C98A8 | 2200430061006E006E006F00740020006D0061006B006500200061002000760069007300690062006C006500200077006900 | ".C.a.n.n.o.t. .m.a.k.e. .a. .v.i.s.i.b.l.e. .w.i. |
| \STRING\4087\0 | D4D50 | 3F0 | C9B50 | 1C0055006E0073007500700070006F007200740065006400200063006C006900700062006F00610072006400200066006F00 | ..U.n.s.u.p.p.o.r.t.e.d. .c.l.i.p.b.o.a.r.d. .f.o. |
| \STRING\4088\0 | D5140 | 38C | C9F40 | 1700250073002E005300650065006B0020006E006F007400200069006D0070006C0065006D0065006E007400650064002400 | ..%.s...S.e.e.k. .n.o.t. .i.m.p.l.e.m.e.n.t.e.d.$. |
| \STRING\4089\0 | D54CC | 370 | CA2CC | 240027002700250073002700270020006900730020006E006F007400200061002000760061006C0069006400200063006F00 | $.'.'.%.s.'.'. .i.s. .n.o.t. .a. .v.a.l.i.d. .c.o. |
| \STRING\4090\0 | D583C | 390 | CA63C | 0800540068007500720073006400610079000600460072006900640061007900080053006100740075007200640061007900 | ..T.h.u.r.s.d.a.y...F.r.i.d.a.y...S.a.t.u.r.d.a.y. |
| \STRING\4091\0 | D5BCC | D0 | CA9CC | 06004100750067007500730074000900530065007000740065006D0062006500720007004F00630074006F00620065007200 | ..A.u.g.u.s.t...S.e.p.t.e.m.b.e.r...O.c.t.o.b.e.r. |
| \STRING\4092\0 | D5C9C | A0 | CAA9C | 030041007000720003004D006100790003004A0075006E0003004A0075006C00030041007500670003005300650070000300 | ..A.p.r...M.a.y...J.u.n...J.u.l...A.u.g...S.e.p... |
| \STRING\4093\0 | D5D3C | 2B8 | CAB3C | 100049006E00760061006C0069006400200061007200670075006D0065006E007400140049006E00760061006C0069006400 | ..I.n.v.a.l.i.d. .a.r.g.u.m.e.n.t...I.n.v.a.l.i.d. |
| \STRING\4094\0 | D5FF4 | 47C | CADF4 | 2200560061007200690061006E00740020006D006500740068006F0064002000630061006C006C00730020006E006F007400 | ".V.a.r.i.a.n.t. .m.e.t.h.o.d. .c.a.l.l.s. .n.o.t. |
| \STRING\4095\0 | D6470 | 368 | CB270 | 200049006E00760061006C0069006400200066006C006F006100740069006E006700200070006F0069006E00740020006F00 | .I.n.v.a.l.i.d. .f.l.o.a.t.i.n.g. .p.o.i.n.t. .o. |
| \STRING\4096\0 | D67D8 | 2B4 | CB5D8 | 2100270025007300270020006900730020006E006F007400200061002000760061006C0069006400200069006E0074006500 | !.'.%.s.'. .i.s. .n.o.t. .a. .v.a.l.i.d. .i.n.t.e. |
| \RCDATA\DVCLAL\0 | D6A8C | 10 | CB88C | A28CDF987B3C3A7926713F090F2A2517 | ....{<:y&q?..*%. |
| \RCDATA\PACKAGEINFO\0 | D6A9C | 6E0 | CB89C | 000010CC000000009300000001E050726F53657276657200103154776F666973680010124443506372797074001005534841 | ..............ProServer..1Twofish...DCPcrypt...SHA |
| \RCDATA\TFORM1\0 | D717C | 244B | CBF7C | 545046300654466F726D3105466F726D31044C65667403020103546F7003D5000B426F726465725374796C65070862734469 | TPF0.TForm1.Form1.Left....Top....BorderStyle..bsDi |
| \RCDATA\TINFOFORM\0 | D95C8 | 712 | CE3C8 | 545046300954496E666F466F726D08496E666F466F726D044C65667403B40103546F70027C0B426F726465725374796C6507 | TPF0.TInfoForm.InfoForm.Left....Top.|.BorderStyle. |
| \RCDATA\TLOGBOX\0 | D9CDC | 233 | CEADC | 5450463007544C6F67426F78064C6F67426F78044C65667403D10103546F7002790B426F726465725374796C650708627344 | TPF0.TLogBox.LogBox.Left....Top.y.BorderStyle..bsD |
| \GROUP_CURSOR\32761\1033 | D9F10 | 14 | CED10 | 0000020001002000400001000100340100000100 | ...... .@.....4..... |
| \GROUP_CURSOR\32762\1033 | D9F24 | 14 | CED24 | 0000020001002000400001000100340100000200 | ...... .@.....4..... |
| \GROUP_CURSOR\32763\1033 | D9F38 | 14 | CED38 | 0000020001002000400001000100340100000300 | ...... .@.....4..... |
| \GROUP_CURSOR\32764\1033 | D9F4C | 14 | CED4C | 0000020001002000400001000100340100000400 | ...... .@.....4..... |
| \GROUP_CURSOR\32765\1033 | D9F60 | 14 | CED60 | 0000020001002000400001000100340100000500 | ...... .@.....4..... |
| \GROUP_CURSOR\32766\1033 | D9F74 | 14 | CED74 | 0000020001002000400001000100340100000600 | ...... .@.....4..... |
| \GROUP_CURSOR\32767\1033 | D9F88 | 14 | CED88 | 0000020001002000400001000100340100000700 | ...... .@.....4..... |
| \GROUP_ICON\MAINICON\1033 | D9F9C | 3E | CED9C | 0000010004003030000001002000A825000001002020000001002000A8100000020018180000010020008809000003001010000001002000680400000400 | ......00.... ..%.... .... ............. ............. .h..... |
| \24\1\3073 | D9FDC | 351 | CEDDC | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • oleaut32.dll • advapi32.dll • kernel32.dll • user32.dll • .bss • .tls • gdi32.dll • version.dll • ole32.dll • comctl32.dll • shell32.dll • CaptionLast Time Login • DEFAULT_CHARSET • KERNEL32.dll • KERNEL32.DLL • GetProcAddressoleaut32.dll • SysFreeStringadvapi32.dll • GetKeyboardTypekernel32.dll • UnrealizeObjectversion.dll • _TrackMouseEventshell32.dll • ADVAPI32.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 1EF6 | D9FDC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6752 | 58C52B4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 30DB9 | 58C52B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3D0AC | 5CA73E68 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3DE74 | 65839057 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4424C | 77B4246C | .text | CALL [static] | Indirect call to absolute memory address |
| 463D3 | 77B4246C | .text | JMP [static] | Indirect jump to absolute memory address |
| 508BE | 77B4246C | .text | CALL [static] | Indirect call to absolute memory address |
| 52E8F | 14865AE4 | .text | CALL [static] | Indirect call to absolute memory address |
| 55735 | 6B749993 | .text | CALL [static] | Indirect call to absolute memory address |
| 600CF | 7BDD4D29 | .text | CALL [static] | Indirect call to absolute memory address |
| 60377 | 563E921F | .text | JMP [static] | Indirect jump to absolute memory address |
| 629E0 | 637AA38 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6722A | 637AA38 | .text | CALL [static] | Indirect call to absolute memory address |
| 6C822 | 637AA38 | .text | JMP [static] | Indirect jump to absolute memory address |
| 77E99 | A67F89E | .text | CALL [static] | Indirect call to absolute memory address |
| 81D45 | A67F89E | .text | CALL [static] | Indirect call to absolute memory address |
| 98602 | 358B76D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 9BFE4 | 358B76D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 9DB2D | 358B76D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 9EE12 | 4A52D91C | .text | JMP [static] | Indirect jump to absolute memory address |
| 9FC0D | 4A52D91C | .text | JMP [static] | Indirect jump to absolute memory address |
| A5FFE | FF | .itext | JMP [static] | Indirect jump to absolute memory address |
| D40EF | 24B56C75 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| DC3E0 | 24B56C75 | RY4SHL | JMP [static] | Indirect jump to absolute memory address |
| E4553 | 24B56C75 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EC9C1 | 1D22AEAE | RY4SHL | JMP [static] | Indirect jump to absolute memory address |
| F2427 | 6319C350 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| F26DC | 1004 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| F2A40 | 100C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| F2A59 | 1010 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| F2A64 | 1000 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| F2A85 | 100C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| F2AA3 | 100C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| F2ABC | 1010 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| F2AC7 | 1000 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| 108428 | 16230007 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 719866 | 64,2004% |
| Null Byte Code | 80514 | 7,1805% |
© 2026 All rights reserved.