PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 124,14 KB SHA-256 Hash: C3D660FB270EBBCB9D1E2B0658453384793A7E48CBEBD4BAD0D8A37ECF6526CD SHA-1 Hash: A6E4C5B7831EBB1EA1FC6D320CC4F7D532A55FA2 MD5 Hash: F9B71E0401679740C47168BF121638A2 Imphash: 196C1E20BD079ED960FE445E4F799AA6 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 000202A3 EntryPoint (rva): 1440 SizeOfHeaders: 400 SizeOfImage: 29000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 24000 IAT: 24478 Characteristics: 226 TimeDateStamp: 69CC9E4E Date: 01/04/2026 4:25:50 File Type: EXE Number Of Sections: 10 ASLR: Disabled Section Names (Optional Header): .text, .data, .rdata, .pdata, .xdata, .bss, .idata, .tls, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows Console UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 13800 | 1000 | 13630 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
13C00 | 400 | 15000 | 3D0 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
14000 | 5E00 | 16000 | 5DD0 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
19E00 | C00 | 1C000 | B40 |
|
|
| .xdata | 0x40000040 Initialized Data Readable |
1AA00 | C00 | 1D000 | A58 |
|
|
| .bss | 0xC0000080 Uninitialized Data Readable Writeable |
0 | 0 | 1E000 | 5680 |
|
|
| .idata | 0x40000040 Initialized Data Readable |
1B600 | 1400 | 24000 | 1360 |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
1CA00 | 200 | 26000 | 10 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1CC00 | E00 | 27000 | DA8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
1DA00 | 200 | 28000 | 1D4 |
|
|
| Description |
| OriginalFilename: xz.exe CompanyName: The Tukaani Project <https://tukaani.org ProductName: XZ Utils <https://tukaani.org/xz FileVersion: 5.8.3 FileDescription: xz data compression tool for .xz and .lzma files ProductVersion: 5.8.3 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 840 Code -> 4883EC28488B0575970100C70000000000E8CAFBFFFF90904883C428C30F1F00E9B32A01009090909090909090909090488D Assembler |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0X19775] |MOV DWORD PTR [RAX], 0 |CALL 0X140001020 |NOP |NOP |ADD RSP, 0X28 |RET |NOP DWORD PTR [RAX] |JMP 0X140013F18 |NOP |NOP |NOP |NOP |NOP |NOP |NOP |NOP |NOP |NOP |NOP |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • Entropy: 6.12027 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| File Access |
| msvcrt.dll KERNEL32.dll liblzma-5.dll .dat |
| File Access (UNICODE) |
| xz.exe msvcrt.dllrand_sadvapi32.dll |
| Interest's Words |
| exec start ping |
| URLs |
| http://schemas.microsoft.com/SMI/2016/WindowsSettings http://schemas.microsoft.com/SMI/2019/WindowsSettings https://tukaani.org/xz/ |
| URLs (UNICODE) |
| https://tukaani.org https://tukaani.org/xz |
| Emails |
| input.xz@tukaani.org |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | CAN (Crunched ANsi) file |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\1033 | 270A0 | 304 | 1CCA0 | 040334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000800 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 273A8 | 513 | 1CFA8 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • msvcrt.dll • @.bss • @.tls • use the suffix .SUF on compressed files.SUF • With no FILE, or when FILE is -, read standard input.xz@tukaani.org • rand_sadvapi32.dll • liblzma-5.dll • KERNEL32.dll • The Tukaani Project <https://tukaani.org • xz.exe • XZ Utils <https://tukaani.org/xz • <longPathAware xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">true</longPathAware> • <activeCodePage xmlns="http://schemas.microsoft.com/SMI/2019/WindowsSettings">UTF-8</activeCodePage> |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 586 | N/A | .text | CALL QWORD PTR [RIP+0x234BC] |
| 8D6 | N/A | .text | JMP QWORD PTR [RIP+0x894C4674] |
| DAB | N/A | .text | CALL QWORD PTR [RIP+0x22D3F] |
| DB3 | N/A | .text | CALL QWORD PTR [RIP+0x22E9F] |
| EE3 | N/A | .text | CALL QWORD PTR [RIP+0x22D3F] |
| 126E | N/A | .text | CALL QWORD PTR [RIP+0x1352C] |
| 34A0 | N/A | .text | CALL QWORD PTR [RIP+0x2064A] |
| 34D2 | N/A | .text | CALL QWORD PTR [RIP+0x20618] |
| 34E3 | N/A | .text | CALL QWORD PTR [RIP+0x20607] |
| 34EE | N/A | .text | CALL QWORD PTR [RIP+0x205FC] |
| 34F6 | N/A | .text | CALL QWORD PTR [RIP+0x2075C] |
| 3560 | N/A | .text | CALL QWORD PTR [RIP+0x2058A] |
| 3568 | N/A | .text | CALL QWORD PTR [RIP+0x206EA] |
| 3618 | N/A | .text | CALL QWORD PTR [RIP+0x20512] |
| 3670 | N/A | .text | CALL QWORD PTR [RIP+0x2047A] |
| 3678 | N/A | .text | CALL QWORD PTR [RIP+0x205DA] |
| 3710 | N/A | .text | CALL QWORD PTR [RIP+0x203DA] |
| 3718 | N/A | .text | CALL QWORD PTR [RIP+0x2053A] |
| 3830 | N/A | .text | CALL QWORD PTR [RIP+0x202FA] |
| 3844 | N/A | .text | CALL QWORD PTR [RIP+0x202A6] |
| 384C | N/A | .text | CALL QWORD PTR [RIP+0x20406] |
| 38E0 | N/A | .text | CALL QWORD PTR [RIP+0x20372] |
| 3B24 | N/A | .text | CALL QWORD PTR [RIP+0x1FFB6] |
| 3BDF | N/A | .text | CALL QWORD PTR [RIP+0x1FF0B] |
| 3BE7 | N/A | .text | CALL QWORD PTR [RIP+0x2006B] |
| 3CC0 | N/A | .text | CALL QWORD PTR [RIP+0x1FE2A] |
| 3D05 | N/A | .text | CALL QWORD PTR [RIP+0x1FDE5] |
| 3D0D | N/A | .text | CALL QWORD PTR [RIP+0x1FF45] |
| 3D70 | N/A | .text | CALL QWORD PTR [RIP+0x1FD7A] |
| 3D78 | N/A | .text | CALL QWORD PTR [RIP+0x1FEDA] |
| 3F09 | N/A | .text | CALL QWORD PTR [RIP+0x1FBE1] |
| 3F11 | N/A | .text | CALL QWORD PTR [RIP+0x1FD41] |
| 441E | N/A | .text | CALL QWORD PTR [RIP+0x1F5AC] |
| 4440 | N/A | .text | JMP QWORD PTR [RIP+0x1F5E2] |
| 4A0B | N/A | .text | CALL QWORD PTR [RIP+0xFD8F] |
| 4AA5 | N/A | .text | CALL QWORD PTR [RIP+0xFCF5] |
| 4DC1 | N/A | .text | CALL QWORD PTR [RIP+0xF9D9] |
| 54C6 | N/A | .text | CALL QWORD PTR [RIP+0xF2D4] |
| 57F6 | N/A | .text | JMP QWORD PTR [RIP+0x1E45C] |
| 5A2D | N/A | .text | CALL QWORD PTR [RIP+0xED6D] |
| 5C0D | N/A | .text | CALL QWORD PTR [RIP+0x89480001] |
| 64C4 | N/A | .text | CALL QWORD PTR [RIP+0x1D546] |
| 64E4 | N/A | .text | CALL QWORD PTR [RIP+0x1D526] |
| 6504 | N/A | .text | CALL QWORD PTR [RIP+0x1D506] |
| 653B | N/A | .text | CALL QWORD PTR [RIP+0x1D4CF] |
| 6A50 | N/A | .text | CALL QWORD PTR [RIP+0x1CFEA] |
| 6E49 | N/A | .text | CALL QWORD PTR [RIP+0x1CCA1] |
| 6E5B | N/A | .text | CALL QWORD PTR [RIP+0x1CDF7] |
| 73F5 | N/A | .text | CALL QWORD PTR [RIP+0x1C715] |
| 7403 | N/A | .text | CALL QWORD PTR [RIP+0x1C5D7] |
| 7447 | N/A | .text | CALL QWORD PTR [RIP+0x1C6C3] |
| 7455 | N/A | .text | CALL QWORD PTR [RIP+0x1C585] |
| 74BA | N/A | .text | CALL QWORD PTR [RIP+0x1C650] |
| 74C8 | N/A | .text | CALL QWORD PTR [RIP+0x1C512] |
| 7673 | N/A | .text | CALL QWORD PTR [RIP+0x1C477] |
| 767B | N/A | .text | CALL QWORD PTR [RIP+0x1C5D7] |
| 7775 | N/A | .text | CALL QWORD PTR [RIP+0xCF05] |
| 7895 | N/A | .text | CALL QWORD PTR [RIP+0xCDE5] |
| 795A | N/A | .text | CALL QWORD PTR [RIP+0xCD20] |
| A9C0 | N/A | .text | JMP QWORD PTR [RIP+0x18FF2] |
| A9C8 | N/A | .text | JMP QWORD PTR [RIP+0x18FE2] |
| A9D0 | N/A | .text | JMP QWORD PTR [RIP+0x18FD2] |
| A9D8 | N/A | .text | JMP QWORD PTR [RIP+0x18FC2] |
| A9E0 | N/A | .text | JMP QWORD PTR [RIP+0x18FB2] |
| A9E8 | N/A | .text | JMP QWORD PTR [RIP+0x18FA2] |
| A9F0 | N/A | .text | JMP QWORD PTR [RIP+0x18F92] |
| A9F8 | N/A | .text | JMP QWORD PTR [RIP+0x18F82] |
| AA00 | N/A | .text | JMP QWORD PTR [RIP+0x18F72] |
| AA08 | N/A | .text | JMP QWORD PTR [RIP+0x18F62] |
| AA10 | N/A | .text | JMP QWORD PTR [RIP+0x18F52] |
| AA18 | N/A | .text | JMP QWORD PTR [RIP+0x18F42] |
| AA20 | N/A | .text | JMP QWORD PTR [RIP+0x18F32] |
| AA28 | N/A | .text | JMP QWORD PTR [RIP+0x18F22] |
| AA30 | N/A | .text | JMP QWORD PTR [RIP+0x18F12] |
| AA38 | N/A | .text | JMP QWORD PTR [RIP+0x18F02] |
| AA40 | N/A | .text | JMP QWORD PTR [RIP+0x18EF2] |
| AA48 | N/A | .text | JMP QWORD PTR [RIP+0x18EE2] |
| AA50 | N/A | .text | JMP QWORD PTR [RIP+0x18ED2] |
| AA58 | N/A | .text | JMP QWORD PTR [RIP+0x18EC2] |
| AA60 | N/A | .text | JMP QWORD PTR [RIP+0x18EB2] |
| AA68 | N/A | .text | JMP QWORD PTR [RIP+0x18EA2] |
| AA70 | N/A | .text | JMP QWORD PTR [RIP+0x18E92] |
| AA78 | N/A | .text | JMP QWORD PTR [RIP+0x18E82] |
| AA80 | N/A | .text | JMP QWORD PTR [RIP+0x18E72] |
| AA88 | N/A | .text | JMP QWORD PTR [RIP+0x18E62] |
| AA90 | N/A | .text | JMP QWORD PTR [RIP+0x18E52] |
| AA98 | N/A | .text | JMP QWORD PTR [RIP+0x18E42] |
| AAA0 | N/A | .text | JMP QWORD PTR [RIP+0x18E32] |
| AAA8 | N/A | .text | JMP QWORD PTR [RIP+0x18E22] |
| AAB0 | N/A | .text | JMP QWORD PTR [RIP+0x18E12] |
| AAB8 | N/A | .text | JMP QWORD PTR [RIP+0x18E02] |
| AAC0 | N/A | .text | JMP QWORD PTR [RIP+0x18DF2] |
| AAC8 | N/A | .text | JMP QWORD PTR [RIP+0x18DE2] |
| AAD0 | N/A | .text | JMP QWORD PTR [RIP+0x18DD2] |
| AAD8 | N/A | .text | JMP QWORD PTR [RIP+0x18DC2] |
| AAE0 | N/A | .text | JMP QWORD PTR [RIP+0x18DB2] |
| AAE8 | N/A | .text | JMP QWORD PTR [RIP+0x18DA2] |
| AAF0 | N/A | .text | JMP QWORD PTR [RIP+0x18D92] |
| AAF8 | N/A | .text | JMP QWORD PTR [RIP+0x18D82] |
| AB00 | N/A | .text | JMP QWORD PTR [RIP+0x18D72] |
| CB60-CB7F | N/A | .text | Unusual NOPS Space, count: 32 |
| 11962-1197F | N/A | .text | Unusual NOPS Space, count: 30 |
| 19DA8 | 14000B830 | .rdata | TLS Callback | Pointer to B830 - 0xAC30 .text |
| 19DB0 | 14000B810 | .rdata | TLS Callback | Pointer to B810 - 0xAC10 .text |
| 19E00 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .xdata |
| 19E0C | 140001010 | .pdata | ExceptionHook | Pointer to 1010 - 0x410 .text + UnwindInfo: .xdata |
| 19E18 | 140001020 | .pdata | ExceptionHook | Pointer to 1020 - 0x420 .text + UnwindInfo: .xdata |
| 19E24 | 140001420 | .pdata | ExceptionHook | Pointer to 1420 - 0x820 .text + UnwindInfo: .xdata |
| 19E30 | 140001440 | .pdata | ExceptionHook | Pointer to 1440 - 0x840 .text + UnwindInfo: .xdata |
| 19E3C | 140001460 | .pdata | ExceptionHook | Pointer to 1460 - 0x860 .text + UnwindInfo: .xdata |
| 19E48 | 140001470 | .pdata | ExceptionHook | Pointer to 1470 - 0x870 .text + UnwindInfo: .xdata |
| 19E54 | 140001480 | .pdata | ExceptionHook | Pointer to 1480 - 0x880 .text + UnwindInfo: .xdata |
| 19E60 | 1400014A0 | .pdata | ExceptionHook | Pointer to 14A0 - 0x8A0 .text + UnwindInfo: .xdata |
| 19E6C | 140001570 | .pdata | ExceptionHook | Pointer to 1570 - 0x970 .text + UnwindInfo: .xdata |
| 19E78 | 140001F50 | .pdata | ExceptionHook | Pointer to 1F50 - 0x1350 .text + UnwindInfo: .xdata |
| 19E84 | 1400020E0 | .pdata | ExceptionHook | Pointer to 20E0 - 0x14E0 .text + UnwindInfo: .xdata |
| 19E90 | 1400024A0 | .pdata | ExceptionHook | Pointer to 24A0 - 0x18A0 .text + UnwindInfo: .xdata |
| 19E9C | 1400024E0 | .pdata | ExceptionHook | Pointer to 24E0 - 0x18E0 .text + UnwindInfo: .xdata |
| 19EA8 | 140002600 | .pdata | ExceptionHook | Pointer to 2600 - 0x1A00 .text + UnwindInfo: .xdata |
| 19EB4 | 140002610 | .pdata | ExceptionHook | Pointer to 2610 - 0x1A10 .text + UnwindInfo: .xdata |
| 19EC0 | 140002670 | .pdata | ExceptionHook | Pointer to 2670 - 0x1A70 .text + UnwindInfo: .xdata |
| 19ECC | 1400026C0 | .pdata | ExceptionHook | Pointer to 26C0 - 0x1AC0 .text + UnwindInfo: .xdata |
| 19ED8 | 140002780 | .pdata | ExceptionHook | Pointer to 2780 - 0x1B80 .text + UnwindInfo: .xdata |
| 19EE4 | 1400028C0 | .pdata | ExceptionHook | Pointer to 28C0 - 0x1CC0 .text + UnwindInfo: .xdata |
| 19EF0 | 1400029E0 | .pdata | ExceptionHook | Pointer to 29E0 - 0x1DE0 .text + UnwindInfo: .xdata |
| 19EFC | 140003510 | .pdata | ExceptionHook | Pointer to 3510 - 0x2910 .text + UnwindInfo: .xdata |
| 19F08 | 140004060 | .pdata | ExceptionHook | Pointer to 4060 - 0x3460 .text + UnwindInfo: .xdata |
| 19F14 | 140004140 | .pdata | ExceptionHook | Pointer to 4140 - 0x3540 .text + UnwindInfo: .xdata |
| 19F20 | 1400041A0 | .pdata | ExceptionHook | Pointer to 41A0 - 0x35A0 .text + UnwindInfo: .xdata |
| 19F2C | 1400041B0 | .pdata | ExceptionHook | Pointer to 41B0 - 0x35B0 .text + UnwindInfo: .xdata |
| 19F38 | 1400041C0 | .pdata | ExceptionHook | Pointer to 41C0 - 0x35C0 .text + UnwindInfo: .xdata |
| 19F44 | 140004370 | .pdata | ExceptionHook | Pointer to 4370 - 0x3770 .text + UnwindInfo: .xdata |
| 19F50 | 140004510 | .pdata | ExceptionHook | Pointer to 4510 - 0x3910 .text + UnwindInfo: .xdata |
| 19F5C | 140004820 | .pdata | ExceptionHook | Pointer to 4820 - 0x3C20 .text + UnwindInfo: .xdata |
| 19F68 | 140004850 | .pdata | ExceptionHook | Pointer to 4850 - 0x3C50 .text + UnwindInfo: .xdata |
| 19F74 | 140004940 | .pdata | ExceptionHook | Pointer to 4940 - 0x3D40 .text + UnwindInfo: .xdata |
| 19F80 | 1400049B0 | .pdata | ExceptionHook | Pointer to 49B0 - 0x3DB0 .text + UnwindInfo: .xdata |
| 19F8C | 140004A20 | .pdata | ExceptionHook | Pointer to 4A20 - 0x3E20 .text + UnwindInfo: .xdata |
| 19F98 | 140004B50 | .pdata | ExceptionHook | Pointer to 4B50 - 0x3F50 .text + UnwindInfo: .xdata |
| 19FA4 | 140004BE0 | .pdata | ExceptionHook | Pointer to 4BE0 - 0x3FE0 .text + UnwindInfo: .xdata |
| 19FB0 | 140004C60 | .pdata | ExceptionHook | Pointer to 4C60 - 0x4060 .text + UnwindInfo: .xdata |
| 19FBC | 140004C70 | .pdata | ExceptionHook | Pointer to 4C70 - 0x4070 .text + UnwindInfo: .xdata |
| 19FC8 | 140004C90 | .pdata | ExceptionHook | Pointer to 4C90 - 0x4090 .text + UnwindInfo: .xdata |
| 19FD4 | 140004CF0 | .pdata | ExceptionHook | Pointer to 4CF0 - 0x40F0 .text + UnwindInfo: .xdata |
| 19FE0 | 140004D30 | .pdata | ExceptionHook | Pointer to 4D30 - 0x4130 .text + UnwindInfo: .xdata |
| 19FEC | 140004D60 | .pdata | ExceptionHook | Pointer to 4D60 - 0x4160 .text + UnwindInfo: .xdata |
| 19FF8 | 140004D80 | .pdata | ExceptionHook | Pointer to 4D80 - 0x4180 .text + UnwindInfo: .xdata |
| 1A004 | 140004DB0 | .pdata | ExceptionHook | Pointer to 4DB0 - 0x41B0 .text + UnwindInfo: .xdata |
| 1A010 | 140004FB0 | .pdata | ExceptionHook | Pointer to 4FB0 - 0x43B0 .text + UnwindInfo: .xdata |
| 1A01C | 140005010 | .pdata | ExceptionHook | Pointer to 5010 - 0x4410 .text + UnwindInfo: .xdata |
| 1A028 | 140005050 | .pdata | ExceptionHook | Pointer to 5050 - 0x4450 .text + UnwindInfo: .xdata |
| 1A034 | 140005060 | .pdata | ExceptionHook | Pointer to 5060 - 0x4460 .text + UnwindInfo: .xdata |
| 1A040 | 140005120 | .pdata | ExceptionHook | Pointer to 5120 - 0x4520 .text + UnwindInfo: .xdata |
| 1A04C | 140005470 | .pdata | ExceptionHook | Pointer to 5470 - 0x4870 .text + UnwindInfo: .xdata |
| 1A058 | 1400055F0 | .pdata | ExceptionHook | Pointer to 55F0 - 0x49F0 .text + UnwindInfo: .xdata |
| 1A064 | 1400056D0 | .pdata | ExceptionHook | Pointer to 56D0 - 0x4AD0 .text + UnwindInfo: .xdata |
| 1A070 | 1400057E0 | .pdata | ExceptionHook | Pointer to 57E0 - 0x4BE0 .text + UnwindInfo: .xdata |
| 1A07C | 140005D20 | .pdata | ExceptionHook | Pointer to 5D20 - 0x5120 .text + UnwindInfo: .xdata |
| 1A088 | 140005DB0 | .pdata | ExceptionHook | Pointer to 5DB0 - 0x51B0 .text + UnwindInfo: .xdata |
| 1A094 | 140005DD0 | .pdata | ExceptionHook | Pointer to 5DD0 - 0x51D0 .text + UnwindInfo: .xdata |
| 1A0A0 | 140005DF0 | .pdata | ExceptionHook | Pointer to 5DF0 - 0x51F0 .text + UnwindInfo: .xdata |
| 1A0AC | 140005E10 | .pdata | ExceptionHook | Pointer to 5E10 - 0x5210 .text + UnwindInfo: .xdata |
| 1A0B8 | 140005E20 | .pdata | ExceptionHook | Pointer to 5E20 - 0x5220 .text + UnwindInfo: .xdata |
| 1A0C4 | 140005E30 | .pdata | ExceptionHook | Pointer to 5E30 - 0x5230 .text + UnwindInfo: .xdata |
| 1A0D0 | 140005E90 | .pdata | ExceptionHook | Pointer to 5E90 - 0x5290 .text + UnwindInfo: .xdata |
| 1A0DC | 140005ED0 | .pdata | ExceptionHook | Pointer to 5ED0 - 0x52D0 .text + UnwindInfo: .xdata |
| 1A0E8 | 1400061B0 | .pdata | ExceptionHook | Pointer to 61B0 - 0x55B0 .text + UnwindInfo: .xdata |
| 1A0F4 | 1400061F0 | .pdata | ExceptionHook | Pointer to 61F0 - 0x55F0 .text + UnwindInfo: .xdata |
| 1A100 | 140006250 | .pdata | ExceptionHook | Pointer to 6250 - 0x5650 .text + UnwindInfo: .xdata |
| 1A10C | 1400062C0 | .pdata | ExceptionHook | Pointer to 62C0 - 0x56C0 .text + UnwindInfo: .xdata |
| 1A118 | 140006330 | .pdata | ExceptionHook | Pointer to 6330 - 0x5730 .text + UnwindInfo: .xdata |
| 1A124 | 140006380 | .pdata | ExceptionHook | Pointer to 6380 - 0x5780 .text + UnwindInfo: .xdata |
| 1A130 | 1400063A0 | .pdata | ExceptionHook | Pointer to 63A0 - 0x57A0 .text + UnwindInfo: .xdata |
| 1A13C | 1400063C0 | .pdata | ExceptionHook | Pointer to 63C0 - 0x57C0 .text + UnwindInfo: .xdata |
| 1A148 | 140006470 | .pdata | ExceptionHook | Pointer to 6470 - 0x5870 .text + UnwindInfo: .xdata |
| 1A154 | 1400065C0 | .pdata | ExceptionHook | Pointer to 65C0 - 0x59C0 .text + UnwindInfo: .xdata |
| 1A160 | 140006680 | .pdata | ExceptionHook | Pointer to 6680 - 0x5A80 .text + UnwindInfo: .xdata |
| 1A16C | 1400066A0 | .pdata | ExceptionHook | Pointer to 66A0 - 0x5AA0 .text + UnwindInfo: .xdata |
| 1A178 | 140006710 | .pdata | ExceptionHook | Pointer to 6710 - 0x5B10 .text + UnwindInfo: .xdata |
| 1A184 | 140006FE0 | .pdata | ExceptionHook | Pointer to 6FE0 - 0x63E0 .text + UnwindInfo: .xdata |
| 1A190 | 1400070C0 | .pdata | ExceptionHook | Pointer to 70C0 - 0x64C0 .text + UnwindInfo: .xdata |
| 1A19C | 1400070E0 | .pdata | ExceptionHook | Pointer to 70E0 - 0x64E0 .text + UnwindInfo: .xdata |
| 1A1A8 | 140007100 | .pdata | ExceptionHook | Pointer to 7100 - 0x6500 .text + UnwindInfo: .xdata |
| 1A1B4 | 140007120 | .pdata | ExceptionHook | Pointer to 7120 - 0x6520 .text + UnwindInfo: .xdata |
| 1A1C0 | 140007180 | .pdata | ExceptionHook | Pointer to 7180 - 0x6580 .text + UnwindInfo: .xdata |
| 1A1CC | 140007190 | .pdata | ExceptionHook | Pointer to 7190 - 0x6590 .text + UnwindInfo: .xdata |
| 1A1D8 | 1400071A0 | .pdata | ExceptionHook | Pointer to 71A0 - 0x65A0 .text + UnwindInfo: .xdata |
| 1A1E4 | 1400071C0 | .pdata | ExceptionHook | Pointer to 71C0 - 0x65C0 .text + UnwindInfo: .xdata |
| 1A1F0 | 1400072C0 | .pdata | ExceptionHook | Pointer to 72C0 - 0x66C0 .text + UnwindInfo: .xdata |
| 1A1FC | 1400074C0 | .pdata | ExceptionHook | Pointer to 74C0 - 0x68C0 .text + UnwindInfo: .xdata |
| 1A208 | 140007530 | .pdata | ExceptionHook | Pointer to 7530 - 0x6930 .text + UnwindInfo: .xdata |
| 1A214 | 140007590 | .pdata | ExceptionHook | Pointer to 7590 - 0x6990 .text + UnwindInfo: .xdata |
| 1A220 | 140007610 | .pdata | ExceptionHook | Pointer to 7610 - 0x6A10 .text + UnwindInfo: .xdata |
| 1A22C | 140007640 | .pdata | ExceptionHook | Pointer to 7640 - 0x6A40 .text + UnwindInfo: .xdata |
| 1A238 | 140007670 | .pdata | ExceptionHook | Pointer to 7670 - 0x6A70 .text + UnwindInfo: .xdata |
| 1A244 | 1400076F0 | .pdata | ExceptionHook | Pointer to 76F0 - 0x6AF0 .text + UnwindInfo: .xdata |
| 1A250 | 140007970 | .pdata | ExceptionHook | Pointer to 7970 - 0x6D70 .text + UnwindInfo: .xdata |
| 1A25C | 1400079D0 | .pdata | ExceptionHook | Pointer to 79D0 - 0x6DD0 .text + UnwindInfo: .xdata |
| 1A268 | 1400079E0 | .pdata | ExceptionHook | Pointer to 79E0 - 0x6DE0 .text + UnwindInfo: .xdata |
| 1A274 | 140007A40 | .pdata | ExceptionHook | Pointer to 7A40 - 0x6E40 .text + UnwindInfo: .xdata |
| 1A280 | 140007A80 | .pdata | ExceptionHook | Pointer to 7A80 - 0x6E80 .text + UnwindInfo: .xdata |
| 1A28C | 140007AB0 | .pdata | ExceptionHook | Pointer to 7AB0 - 0x6EB0 .text + UnwindInfo: .xdata |
| 1A298 | 140007AF0 | .pdata | ExceptionHook | Pointer to 7AF0 - 0x6EF0 .text + UnwindInfo: .xdata |
| 1A2A4 | 140007D00 | .pdata | ExceptionHook | Pointer to 7D00 - 0x7100 .text + UnwindInfo: .xdata |
| 1DC00 | N/A | *Overlay* | 0000000004000000A00500000700000002000000 | .................... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 73454 | 57,7814% |
| Null Byte Code | 29287 | 23,0381% |
| NOP Cave Found | 0x9090909090 | Block Count: 104 | Total: 0,2045% |
© 2026 All rights reserved.