PREMIUM PESCAN.IO - Analysis Report |
|||||
| File Structure |
|
| Information |
Icon: Size: 5,16 MBSHA-256 Hash: C376028AF619AEC083E473B00ABF62FE6BE3BB60D081B6479982388EE1664008 SHA-1 Hash: 697382ED9A10C708DFC3A314285839434E1CE453 MD5 Hash: F6B9D0E2906097DBC626997E6DDFC68B Imphash: D5D9D937853DB8B666BD4B525813D7BD MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 1AE1 SizeOfHeaders: 400 SizeOfImage: 538000 ImageBase: 400000 Architecture: x86 ImportTable: 20BC Characteristics: 10F TimeDateStamp: 51BC99EC Date: 15/06/2013 16:44:28 File Type: EXE Number Of Sections: 4 ASLR: Disabled Section Names: .text, .rdata, .data, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize |
|---|---|---|---|---|---|
| .text | 60000020 (Executable) | 400 | E00 | 1000 | C26 |
| .rdata | 40000040 | 1200 | 600 | 2000 | 4C0 |
| .data | C0000040 (Writeable) | 1800 | 600 | 3000 | D6F0 |
| .rsrc | C0000040 (Writeable) | 1E00 | 526C00 | 11000 | 526B64 |
| Description |
| OriginalFilename: XWorm V6.5.exe CompanyName: c3lestial.fun LegalCopyright: Copyright 2025 ProductName: XWorm V6.5 by c3lestial.fun FileVersion: 6.0.0.5 FileDescription: XWorm V6.5 by c3lestial.fun ProductVersion: 6.0.0.5 Comments: c3lestial.fun Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
| The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - EE1 Code -> E85C000000A30B3040006A00E868000000A313304000E86A000000A3703C40006A0AFF350B3040006A00FF3513304000E8EA • CALL 0X1061 • MOV DWORD PTR [0X40300B], EAX • PUSH 0 • CALL 0X1079 • MOV DWORD PTR [0X403013], EAX • CALL 0X1085 • MOV DWORD PTR [0X403C70], EAX • PUSH 0XA • PUSH DWORD PTR [0X40300B] • PUSH 0 • PUSH DWORD PTR [0X403013] |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: linker: Microsoft Linker(5.12)[-] • Entropy: 7.95011 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | RtlMoveMemory | Moves a block of memory to another location. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| Windows REG |
| Software\Microsoft\Windows\CurrentVersion\Run Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| File Access |
| ntdll.dll advapi32.dll shlwapi.dll Shell32.dll user32.dll kernel32.dll Temp AppData |
| File Access (UNICODE) |
| 5.exe |
| Interest's Words |
| PADDINGX exec attrib comspec ping |
| IP Addresses |
| 127.0.0.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Malware that monitors and collects user data (Spy) |
| Entry Point | Hex Pattern | MASM/TASM - sig1(h) |
| Entry Point | Hex Pattern | MASM/TASM - sig4 (h) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | PE Diminisher v0.1 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\0 | 11220 | 468 | 2020 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000 | (....... ..... .....@............................. |
| \ICON\2\0 | 11688 | 1128 | 2488 | 2800000020000000400000000100200000000000001100000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\3\0 | 127B0 | 2668 | 35B0 | 2800000030000000600000000100200000000000402600000000000000000000000000000000000000000000000000000000 | (...0........ .....@&............................ |
| \ICON\4\0 | 14E18 | A6B5 | 5C18 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000017352474200AECE1CE900000004 | .PNG........IHDR.............\r.f....sRGB......... |
| \RCDATA\1\0 | 1F4D0 | 170D0 | 102D0 | 01000000005E03006FAA4B3144C310D5501E6FBD0382B3F2B9104BC41E6B3DD7405E6B071EB2030D361E547CA45D106259D3 | .......o.K1D...P.o.......K..k=.@k.....6.T|.].bY. |
| \RCDATA\2\0 | 365A0 | 501144 | 273A0 | 0100000000F896005AA74B3144C310D5501E6FBD0382B3F2B9104BC41E6B3DD7405E6B071EB2030D361E547CA45D106259D3 | ........Z.K1D...P.o.......K..k=.@k.....6.T|.].bY. |
| \RCDATA\4097\0 | 5376E4 | A2 | 5284E4 | 46104B7C1E5310D6501E6F3F0782830D46104B7C1E5310D6501E6F3F0582830D53104B7C50055992195F4F7C68ECF76C2F7E | F.K|.S..P.o?....F.K|.S..P.o?....S.K|P.Y.._O|h..l/~ |
| \GROUP_ICON\32512\0 | 537788 | 3E | 528588 | 0000010004001010000001002000680400000100202000000100200028110000020030300000010020006826000003000000000001002000B5A600000400 | ............ .h..... .... .(.....00.... .h&.......... ....... |
| \VERSION\1\0 | 5377C8 | 39C | 5285C8 | 9C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • 6.0.0.5 • XWorm V6.5.exe • XWorm V6.5 by c3lestial.fun • c3lestial.fun • kernel32.dll • user32.dll • ComSpec/c ping -n 3 127.0.0.1 & copy /Y "" "" >> NUL/c del "Shell32.dllShellExecuteASHGetSpecialFolderPathAshlwapi.dllPathFindFileNameAPathAddBackslashAAPPDATAadvapi32.dllRegCreateKeyExARegSetValueExARegCloseKeyntdll.dllRtlDecompressBuffer\openSoftware\Microsoft\Windows\CurrentVersion\Run |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 596 | 4106C4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 71A | 4106DC | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 747 | 4106E0 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 750 | 4106E4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 775 | 4106D4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 78F | 4106D4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 7A9 | 4106D4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 7C5 | 4106D0 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 7E7 | 4106D4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 7F8 | 4106C8 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 803 | 4106D4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 814 | 4106C8 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 81F | 4106D4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 943 | 4106EC | .rsrc | CALL [static] | Indirect call to absolute memory address |
| A59 | 4106D4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| C60 | 4106C4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| D00 | 4106C4 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| F1E | 40207C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F24 | 402008 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F2A | 40200C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F30 | 402010 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F36 | 402014 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F3C | 402018 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F42 | 40201C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F48 | 402020 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F4E | 402024 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F54 | 402028 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F5A | 40202C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F60 | 402030 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F66 | 402034 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F6C | 402038 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F72 | 40203C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F78 | 402040 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F7E | 402044 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F84 | 402048 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F8A | 40204C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F90 | 402050 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F96 | 402054 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| F9C | 402058 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FA2 | 402000 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FA8 | 402060 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FAE | 402064 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FB4 | 402068 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FBA | 40206C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FC0 | 402070 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FC6 | 402074 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FCC | 40205C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FD2 | 402004 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FD8 | 402084 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FDE | 402088 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FE4 | 40208C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FEA | 402090 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FF0 | 402094 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FF6 | 402098 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| FFC | 40209C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 1002 | 4020A0 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 1008 | 4020A4 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 100E | 4020A8 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 1014 | 4020AC | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 101A | 4020B0 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 1020 | 4020B4 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 216C | N/A | .text | CALL DWORD PTR [ESI+65h] | Displacement form |
| 2174 | N/A | .text | CALL DWORD PTR [ESP+EBP*2-1h] | ModRM/SIB parsed |
| 2334 | N/A | .text | CALL DWORD PTR [EDI+58h] | Displacement form |
| 2370 | N/A | .text | CALL DWORD PTR [EDI+61h] | Displacement form |
| 23B4 | N/A | .text | CALL DWORD PTR [ECX+6Fh] | Displacement form |
| 23B8 | N/A | .text | CALL DWORD PTR [EBX+73h] | Displacement form |
| 271F | N/A | .text | CALL DWORD PTR [ECX+28h] | Displacement form |
| 2910 | N/A | .text | CALL DWORD PTR [EDI+69h] | Displacement form |
| 2974 | N/A | .text | CALL DWORD PTR [EBX+66h] | Displacement form |
| 298C | N/A | .text | CALL DWORD PTR [EAX+6Fh] | Displacement form |
| 2A8B | N/A | .text | CALL DWORD PTR [EBP+EDX*1+26h] | ModRM/SIB parsed |
| 300C | N/A | .text | CALL DWORD PTR [EBP+54h] | Displacement form |
| 3090 | N/A | .text | CALL DWORD PTR [EBP+5Ch] | Displacement form |
| 30FC | N/A | .text | CALL DWORD PTR [ESI+5Ah] | Displacement form |
| 3110 | N/A | .text | CALL DWORD PTR [EDI+EBX*2-1h] | ModRM/SIB parsed |
| 3180 | N/A | .text | CALL DWORD PTR [ESI+63h] | Displacement form |
| 3194 | N/A | .text | CALL DWORD PTR [EAX+EBP*2-1h] | ModRM/SIB parsed |
| 3204 | N/A | .text | CALL DWORD PTR [EAX+67h] | Displacement form |
| 3288 | N/A | .text | CALL DWORD PTR [EAX+71h] | Displacement form |
| 3298 | N/A | .text | CALL DWORD PTR [ECX+75h] | Displacement form |
| 3E63 | N/A | .text | CALL DWORD PTR [EDI+22h] | Displacement form |
| 3F6C | N/A | .text | CALL DWORD PTR [EDI+66h] | Displacement form |
| 4028 | N/A | .text | CALL DWORD PTR [EBP+EBP*2-1h] | ModRM/SIB parsed |
| 40BC | N/A | .text | CALL DWORD PTR [EDX+66h] | Displacement form |
| 4223 | N/A | .text | CALL DWORD PTR [EDI+1Bh] | Displacement form |
| 42F4 | N/A | .text | CALL DWORD PTR [EAX+68h] | Displacement form |
| 46D3 | N/A | .text | CALL DWORD PTR [ESP+EDX*1+27h] | ModRM/SIB parsed |
| 4FEB | N/A | .text | CALL DWORD PTR [EBX+1Ah] | Displacement form |
| 516C | N/A | .text | CALL DWORD PTR [ESI+61h] | Displacement form |
| 520C | N/A | .text | CALL DWORD PTR [EDI+5Eh] | Displacement form |
| 5230 | N/A | .text | CALL DWORD PTR [EBP-1h] | ModRM/SIB parsed |
| 52A3 | N/A | .text | CALL DWORD PTR [EBX+55h] | Displacement form |
| 52D0 | N/A | .text | CALL DWORD PTR [EBP+63h] | Displacement form |
| 53B4 | N/A | .text | CALL DWORD PTR [ECX+6Ah] | Displacement form |
| 5518 | N/A | .text | CALL DWORD PTR [ECX+72h] | Displacement form |
| 9958 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 9D26 | N/A | .text | CALL DWORD PTR [ECX-7Fh] | Displacement form |
| AF4C | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| B736 | 45E88C05 | .text | JMP [static] | Indirect jump to absolute memory address |
| C26E | N/A | .text | CALL DWORD PTR [ECX+6Bh] | Displacement form |
| F690 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| F71A | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| FB1E | N/A | .rsrc | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 10DEB | 5A433254 | .text | CALL [static] | Indirect call to absolute memory address |
| 12B6F | N/A | .text | CALL DWORD PTR [EDX+1Bh] | Displacement form |
| 167DF | N/A | .text | CALL DWORD PTR [ECX+1Eh] | Displacement form |
| 16FCC | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 172BA | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 175CC | N/A | .text | CALL DWORD PTR [ECX-10h] | Displacement form |
| 182E0 | N/A | .text | CALL DWORD PTR [EAX-75h] | Displacement form |
| 18544 | N/A | .text | CALL DWORD PTR [EBX+4Ah] | Displacement form |
| 1B901 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 1CA33 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 1E967 | N/A | .text | CALL DWORD PTR [EDI+47h] | Displacement form |
| 1F828 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1FB4C | N/A | .text | CALL DWORD PTR [EBX-7h] | Displacement form |
| 2121D | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 24261 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 24AB8 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 2554F | N/A | .text | CALL DWORD PTR [EAX+77h] | Displacement form |
| 25993 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 27B7B | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 29AFC | N/A | .text | CALL DWORD PTR [ECX-46h] | Displacement form |
| 2AF5F | N/A | .text | CALL DWORD PTR [EDX+Eh] | Displacement form |
| 2B79B | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 2ED03 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 30688 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 308CC | N/A | .text | CALL DWORD PTR [ECX+62h] | Displacement form |
| 30AE2 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 30B07 | N/A | .text | CALL DWORD PTR [EAX+41h] | Displacement form |
| 3293A | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 341BC | N/A | .text | CALL DWORD PTR [EDX+74h] | Displacement form |
| 34F41 | N/A | .text | CALL DWORD PTR [EDX-7Ah] | Displacement form |
| 370C7 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 37765 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 38F3D | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 395A8 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 39CD3 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 3B7AD | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 3BAFC | N/A | .text | CALL DWORD PTR [EDX+38h] | Displacement form |
| 3D788 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 3E1EF | N/A | .text | CALL DWORD PTR [ECX+1Ch] | Displacement form |
| 3E80A | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 3FEBD | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 3FFC3 | 40CC9A0C | .text | CALL [static] | Indirect call to absolute memory address |
| 4018F | N/A | .text | CALL DWORD PTR [EDX+1Dh] | Displacement form |
| 40F9D | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 42408 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 43124 | N/A | .text | CALL DWORD PTR [EDX-12h] | Displacement form |
| 434DF | N/A | .text | CALL DWORD PTR [EAX+16h] | Displacement form |
| 4428F | N/A | .text | CALL DWORD PTR [EAX-5Ah] | Displacement form |
| 44F73 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 45F25 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 45F35 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 47673 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 48252 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 49795 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 4E085 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 51EAB | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 5232C | N/A | .text | CALL DWORD PTR [EBX+26h] | Displacement form |
| 523CC | N/A | .text | CALL DWORD PTR [EBX+26h] | Displacement form |
| 542CC | N/A | .text | CALL DWORD PTR [EDI+3Fh] | Displacement form |
| 55FCF | N/A | .text | CALL DWORD PTR [EAX+1Eh] | Displacement form |
| 581A3 | 600A81F3 | .text | JMP [static] | Indirect jump to absolute memory address |
| 5871E | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 58B3B | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 58CEE | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 59054 | N/A | .text | CALL DWORD PTR [ESI-7Dh] | Displacement form |
| 59C2D | N/A | .text | CALL DWORD PTR [EBP+62h] | Displacement form |
| 5A7B4 | N/A | .text | CALL DWORD PTR [ESI-7Dh] | Displacement form |
| 5AA0F | N/A | .text | CALL DWORD PTR [ESI-26h] | Displacement form |
| 5B1B5 | N/A | .text | CALL DWORD PTR [EBX+Dh] | Displacement form |
| 5BB7D | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 5DF68 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 5E438 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 5EE98 | 21A77E79 | .text | CALL [static] | Indirect call to absolute memory address |
| 5EED2 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 5F15F | N/A | .text | CALL DWORD PTR [EBP-14h] | Displacement form |
| 602EC | N/A | .text | CALL DWORD PTR [EDX-10h] | Displacement form |
| 60341 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 60C61 | N/A | .text | CALL DWORD PTR [ECX+5Ch] | Displacement form |
| 610DC | N/A | .text | CALL DWORD PTR [EAX-Fh] | Displacement form |
| 611CC | N/A | .text | CALL DWORD PTR [EDI-Fh] | Displacement form |
| 6187C | N/A | .text | CALL DWORD PTR [EAX-Fh] | Displacement form |
| 6189C | N/A | .text | CALL DWORD PTR [EDX-10h] | Displacement form |
| 6196C | N/A | .text | CALL DWORD PTR [EAX-Fh] | Displacement form |
| 6198C | N/A | .text | CALL DWORD PTR [EDX-10h] | Displacement form |
| 620CC | N/A | .text | CALL DWORD PTR [EAX-Fh] | Displacement form |
| 621EC | N/A | .text | CALL DWORD PTR [EDX-33h] | Displacement form |
| 627CC | N/A | .text | CALL DWORD PTR [EAX-Fh] | Displacement form |
| 62EDC | N/A | .text | CALL DWORD PTR [EAX-Fh] | Displacement form |
| 62FFC | N/A | .text | CALL DWORD PTR [EAX-Fh] | Displacement form |
| 6361C | N/A | .text | CALL DWORD PTR [EBX-Fh] | Displacement form |
| 6363C | N/A | .text | CALL DWORD PTR [EDX-2Fh] | Displacement form |
| 64490 | 63CE3F8E | .text | JMP [static] | Indirect jump to absolute memory address |
| 647ED | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 67D8B | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 67DDB | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 69A13 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 6A82C | N/A | .text | CALL DWORD PTR [ESI+71h] | Displacement form |
| 6CAFC | N/A | .text | CALL DWORD PTR [EBX+71h] | Displacement form |
| 6F772 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 72512 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 7899F | N/A | .text | CALL DWORD PTR [ECX+1Eh] | Displacement form |
| 79EE3 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 7A8EC | N/A | .text | CALL DWORD PTR [ECX+10h] | Displacement form |
| 7BD4F | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 7FF95 | N/A | .text | CALL DWORD PTR [EAX+3Bh] | Displacement form |
| 80396 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 80A81 | N/A | .text | CALL DWORD PTR [EAX-2Eh] | Displacement form |
| 81D4E | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 8236B | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 827DF | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 82CED | N/A | .text | CALL DWORD PTR [EBP+EDI*8-80h] | ModRM/SIB parsed |
| 8364F | N/A | .text | CALL DWORD PTR [EDI+1Eh] | Displacement form |
| 862B1 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 86C13 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 87624 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 889BC | N/A | .text | CALL DWORD PTR [EBP+30h] | Displacement form |
| 89548 | N/A | .text | CALL DWORD PTR [EBX-69h] | Displacement form |
| 8A1A3 | 45395A82 | .text | CALL [static] | Indirect call to absolute memory address |
| 8B2BF | N/A | .text | CALL DWORD PTR [EBP+40h] | Displacement form |
| 8C3B8 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 8D5E0 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 8DCBF | N/A | .text | CALL DWORD PTR [EBX-19h] | Displacement form |
| 8E827 | N/A | .text | CALL DWORD PTR [ECX+50h] | Displacement form |
| 8EFF4 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 8FD43 | 461981AF | .text | JMP [static] | Indirect jump to absolute memory address |
| 906B7 | N/A | .text | CALL DWORD PTR [EBP-1Dh] | Displacement form |
| 92A1B | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 9A0D3 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 9B004 | N/A | .text | CALL DWORD PTR [ESI+35h] | Displacement form |
| 9C9CE | 44EC0302 | .text | JMP [static] | Indirect jump to absolute memory address |
| 9E592 | 76223E03 | .text | CALL [static] | Indirect call to absolute memory address |
| 9E903 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| A0368 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| A187F | N/A | .text | CALL DWORD PTR [EBX-5Fh] | Displacement form |
| A359C | N/A | .text | CALL DWORD PTR [EAX+10h] | Displacement form |
| A386B | N/A | .text | CALL DWORD PTR [EBX+4Eh] | Displacement form |
| A6158 | N/A | .text | CALL DWORD PTR [ECX-31h] | Displacement form |
| A7F23 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| A8021 | N/A | .text | CALL DWORD PTR [EDX+5Eh] | Displacement form |
| A8AB3 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| AD02C | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| AEAF5 | N/A | .text | CALL DWORD PTR [EBX-7h] | Displacement form |
| B0DEC | N/A | .text | CALL DWORD PTR [EBX-11h] | Displacement form |
| B2F4E | N/A | .text | CALL DWORD PTR [ESI-70h] | Displacement form |
| B35F3 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| B38DF | N/A | .text | CALL DWORD PTR [ESI+EDI*2+70h] | ModRM/SIB parsed |
| B4D38 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| B83B7 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| B90EC | N/A | .text | CALL DWORD PTR [EBX-65h] | Displacement form |
| BA567 | 7D057D10 | .text | JMP [static] | Indirect jump to absolute memory address |
| BABAF | N/A | .text | CALL DWORD PTR [ECX+50h] | ModRM/SIB parsed |
| BE4BF | N/A | .text | CALL DWORD PTR [ECX-76h] | ModRM/SIB parsed |
| C01C5 | N/A | .text | CALL DWORD PTR [EBX+13h] | Displacement form |
| C0FBC | N/A | .text | CALL DWORD PTR [EDI+50h] | Displacement form |
| C12F0 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| C26DB | N/A | .text | CALL DWORD PTR [ESI+6Ch] | Displacement form |
| C39AC | N/A | .text | CALL DWORD PTR [EBX-19h] | Displacement form |
| C4012 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| C44B3 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| C4618 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| C47AF | N/A | .text | CALL DWORD PTR [EAX+10h] | Displacement form |
| C5B50 | N/A | .text | CALL DWORD PTR [EBP+3Dh] | Displacement form |
| C7F4F | N/A | .text | CALL DWORD PTR [EAX-Ch] | Displacement form |
| C84D9 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| C87BD | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| CD87E | N/A | .text | CALL DWORD PTR [ESI-2Fh] | Displacement form |
| CFFEB | N/A | .text | CALL DWORD PTR [EBP+69h] | Displacement form |
| D0614 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| D12ED | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| D21BF | N/A | .text | CALL DWORD PTR [EAX-4Ch] | Displacement form |
| D4834 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| D6B66 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| D7711 | N/A | .text | CALL DWORD PTR [EDI+EDX*8-28h] | ModRM/SIB parsed |
| D843A | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| D87DD | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| D902D | N/A | .text | CALL DWORD PTR [EBP-48h] | Displacement form |
| D9122 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| DC779 | N/A | .text | CALL DWORD PTR [ESI+ECX*8-1Ch] | ModRM/SIB parsed |
| DCF3F | N/A | .text | CALL DWORD PTR [EAX-3Bh] | Displacement form |
| DF318 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| E2AB7 | 167DE10 | .text | JMP [static] | Indirect jump to absolute memory address |
| E376C | N/A | .text | CALL DWORD PTR [EBX+64h] | Displacement form |
| E72D3 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| E73C5 | N/A | .text | CALL DWORD PTR [ECX-2Eh] | Displacement form |
| E8ABD | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| EA0DF | N/A | .text | CALL DWORD PTR [EAX+1Eh] | Displacement form |
| ECE98 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| F2E84 | 7E829440 | .text | CALL [static] | Indirect call to absolute memory address |
| F45AB | N/A | .text | CALL DWORD PTR [EBX+14h] | Displacement form |
| F6E24 | N/A | .text | CALL DWORD PTR [EBP+4Ch] | Displacement form |
| F8899 | N/A | .text | CALL DWORD PTR [EDI+3Ch] | Displacement form |
| F97FE | N/A | .text | CALL DWORD PTR [EBX-16h] | Displacement form |
| FA3B7 | N/A | .text | CALL DWORD PTR [EBX+40h] | Displacement form |
| FBDEA | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| FD076 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| FDC21 | N/A | .text | CALL DWORD PTR [EDI+EDX*8-28h] | ModRM/SIB parsed |
| FE94A | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| FECED | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| FF53D | N/A | .text | CALL DWORD PTR [EBP-48h] | Displacement form |
| FF632 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 102C89 | N/A | .text | CALL DWORD PTR [ESI+ECX*8-1Ch] | ModRM/SIB parsed |
| 103923 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 106340 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 107AF3 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 107CE3 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 1081EF | N/A | .text | CALL DWORD PTR [EAX+Eh] | Displacement form |
| 108BCC | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 109EB2 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 10A24E | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 10B16D | N/A | .text | CALL DWORD PTR [ESI-24h] | Displacement form |
| 10EA9A | N/A | .text | CALL DWORD PTR [EBX-1Bh] | Displacement form |
| 11003F | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 11085D | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 1136B8 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 1183E6 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 11A279 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 11AFAE | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 11B3A4 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 11B3EA | N/A | .text | CALL DWORD PTR [EBP-46h] | Displacement form |
| 11BC0C | N/A | .text | CALL DWORD PTR [EBX+20h] | Displacement form |
| 11CFED | 1189B30B | .text | JMP [static] | Indirect jump to absolute memory address |
| 11EBDF | N/A | .text | CALL DWORD PTR [EDX+64h] | Displacement form |
| 12046C | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 123DEF | N/A | .text | CALL DWORD PTR [EDI+6Ah] | Displacement form |
| 124011 | N/A | .text | CALL DWORD PTR [EBX-5Dh] | Displacement form |
| 1251A5 | N/A | .text | CALL DWORD PTR [EBX+15h] | Displacement form |
| 1271B7 | N/A | .text | CALL DWORD PTR [EBP+55h] | Displacement form |
| 127544 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 12944D | N/A | .text | CALL DWORD PTR [ESI+47h] | Displacement form |
| 129EEF | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 12B3F1 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 12C58B | N/A | .text | CALL DWORD PTR [EDX+3Eh] | Displacement form |
| 12EC3C | N/A | .text | CALL DWORD PTR [EDI-3Ch] | Displacement form |
| 12F300 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1302B3 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 130468 | 742EBF46 | .text | JMP [static] | Indirect jump to absolute memory address |
| 130483 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 134AE9 | N/A | .text | CALL DWORD PTR [EDI+27h] | Displacement form |
| 136047 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 137FE3 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 13A12C | 5A15E1FE | .text | JMP [static] | Indirect jump to absolute memory address |
| 13A5F1 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 13BFE6 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 13CE97 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 13DF03 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 13E448 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 13E8E7 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 13FE71 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 141E93 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 145CDC | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 146478 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 147E93 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 14BCDC | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 14C478 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 14E5F4 | N/A | .text | CALL DWORD PTR [EDI+22h] | Displacement form |
| 14F6FD | N/A | .text | CALL DWORD PTR [ECX-6Ah] | Displacement form |
| 15197F | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 15223A | N/A | .text | CALL DWORD PTR [EDI+20h] | Displacement form |
| 152D59 | N/A | .text | CALL DWORD PTR [EDI-64h] | Displacement form |
| 153FE6 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 154E97 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 155F03 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 156448 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 1568E7 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 157E71 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 15A204 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 15B079 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 15B9F1 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 15CAA7 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 15D408 | N/A | .text | CALL DWORD PTR [ECX+33h] | Displacement form |
| 1601A1 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 16191D | N/A | .text | CALL DWORD PTR [EBX-Eh] | Displacement form |
| 16288C | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 164106 | N/A | .text | CALL DWORD PTR [EDI-1Dh] | Displacement form |
| 16505F | N/A | .text | CALL DWORD PTR [EDI-5Bh] | Displacement form |
| 166E4F | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 167285 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 16767B | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 167875 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 16795C | N/A | .text | CALL DWORD PTR [EBX-57h] | Displacement form |
| 168D78 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 16A02C | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 16C319 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 16CC91 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 16DD47 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 16E4CD | F79A969 | .text | CALL [static] | Indirect call to absolute memory address |
| 16E6A8 | N/A | .text | CALL DWORD PTR [ECX+33h] | Displacement form |
| 172BBD | N/A | .text | CALL DWORD PTR [EBX-Eh] | Displacement form |
| 178F02 | N/A | .text | CALL DWORD PTR [ECX+4Ch] | Displacement form |
| 17A163 | 54B06DD5 | .text | CALL [static] | Indirect call to absolute memory address |
| 17BCDF | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 17CC3F | N/A | .text | CALL DWORD PTR [EAX+2h] | Displacement form |
| 17EAA2 | N/A | .text | CALL DWORD PTR [EDX+11h] | Displacement form |
| 17EC47 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 17F074 | N/A | .text | CALL DWORD PTR [EDI-5Fh] | Displacement form |
| 17F17C | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 180684 | 305B927C | .text | CALL [static] | Indirect call to absolute memory address |
| 184069 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 18478F | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 1849D5 | N/A | .text | CALL DWORD PTR [EBX-57h] | Displacement form |
| 185A4F | N/A | .text | CALL DWORD PTR [EDX-5Eh] | Displacement form |
| 186D39 | 409D4314 | .text | CALL [static] | Indirect call to absolute memory address |
| 186EE0 | 2F4A1985 | .text | JMP [static] | Indirect jump to absolute memory address |
| 187AFF | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 18A0A8 | N/A | .text | CALL DWORD PTR [ESI-41h] | Displacement form |
| 18AA7E | 28C62FC5 | .text | CALL [static] | Indirect call to absolute memory address |
| 18B82E | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 18E2B5 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 18EF43 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 18F80C | 1641BAAB | .text | CALL [static] | Indirect call to absolute memory address |
| 18F902 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 1915D3 | N/A | .text | CALL DWORD PTR [ESI+32h] | Displacement form |
| 1927E3 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 194C8F | N/A | .text | CALL DWORD PTR [EDX+Ch] | Displacement form |
| 195736 | N/A | .text | CALL DWORD PTR [EBP+54h] | Displacement form |
| 195956 | N/A | .text | CALL DWORD PTR [EBP+4Eh] | Displacement form |
| 195C8F | 72198D53 | .text | JMP [static] | Indirect jump to absolute memory address |
| 19A1A3 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 19B27D | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 19C510 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 1A20FC | N/A | .text | CALL DWORD PTR [EBP+53h] | Displacement form |
| 1A4F19 | N/A | .text | CALL DWORD PTR [EBX+67h] | Displacement form |
| 1AE662 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 1AEA50 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 1AF3B2 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 1B1C4E | N/A | .text | CALL DWORD PTR [EBX-79h] | Displacement form |
| 1B475C | N/A | .text | CALL DWORD PTR [EBP+67h] | Displacement form |
| 1B4E17 | N/A | .text | CALL DWORD PTR [EAX+EDX*4+7Dh] | ModRM/SIB parsed |
| 1B5301 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 1B7A29 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 1B7B83 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 1B96F0 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 1BCC0B | N/A | .text | CALL DWORD PTR [ECX-5Bh] | Displacement form |
| 1BF236 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 1BF98D | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 1C18D1 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 1C26DD | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1C329F | N/A | .text | CALL DWORD PTR [ECX-70h] | Displacement form |
| 1C9C1E | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1CAAD8 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 1CAD84 | N/A | .text | CALL DWORD PTR [ECX+4Ah] | Displacement form |
| 1CAE47 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 1CBABF | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 1CCEA0 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 1CCED8 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1CCEE6 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 1CFA60 | 2BF8A09B | .text | JMP [static] | Indirect jump to absolute memory address |
| 1D00EA | N/A | .text | CALL DWORD PTR [EDX+46h] | Displacement form |
| 1D08E7 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 1D30E6 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1D3F97 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 1D47FD | N/A | .text | CALL DWORD PTR [ECX-6Ah] | Displacement form |
| 1D5003 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 1D5548 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 1D6A7F | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1D6F71 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 1D83B4 | N/A | .text | CALL DWORD PTR [EDI+18h] | Displacement form |
| 1D86FD | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1DB3E9 | 4B496E06 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1DC4ED | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1DE871 | N/A | .text | CALL DWORD PTR [EDI-3Bh] | ModRM/SIB parsed |
| 1DFA7A | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 1E0295 | N/A | .text | CALL DWORD PTR [EAX+Ah] | ModRM/SIB parsed |
| 1E0762 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1E0B88 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 1E3114 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 1E413F | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 1E46B0 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 1E4D75 | 1D5610D | .text | JMP [static] | Indirect jump to absolute memory address |
| 1E6883 | N/A | .text | CALL DWORD PTR [ECX+EAX*4+3h] | ModRM/SIB parsed |
| 1E6BF2 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 1E6CAE | N/A | .text | CALL DWORD PTR [ESI-49h] | Displacement form |
| 1E7825 | N/A | .text | CALL DWORD PTR [EBX+14h] | Displacement form |
| 1E7AE4 | N/A | .text | CALL DWORD PTR [EDI+4h] | Displacement form |
| 1E8FD9 | N/A | .text | CALL DWORD PTR [ESI+7Ch] | Displacement form |
| 1EBC0B | 50FC108C | .text | JMP [static] | Indirect jump to absolute memory address |
| 1ED163 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 1EDFE7 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 1F2E6D | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1F352F | N/A | .text | CALL DWORD PTR [EAX-23h] | Displacement form |
| 1F3738 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1F46FC | N/A | .text | CALL DWORD PTR [ECX+1h] | Displacement form |
| 1F47C2 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 1F697D | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1F7D87 | N/A | .text | CALL DWORD PTR [ESI-70h] | Displacement form |
| 1F84B7 | N/A | .text | CALL DWORD PTR [ESI-70h] | Displacement form |
| 1FAA41 | 6A9729F9 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1FBC58 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 1FE761 | 269F29F9 | .text | JMP [static] | Indirect jump to absolute memory address |
| 200783 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 200BC7 | N/A | .text | CALL DWORD PTR [EBX-1Eh] | Displacement form |
| 2010BB | N/A | .text | CALL DWORD PTR [EDX+2Fh] | Displacement form |
| 2011FF | N/A | .text | CALL DWORD PTR [EAX+6Ah] | Displacement form |
| 202EA8 | N/A | .text | CALL DWORD PTR [EDI+ESI*4+3Ah] | ModRM/SIB parsed |
| 202F25 | N/A | .text | CALL DWORD PTR [EBX-15h] | Displacement form |
| 2047A5 | N/A | .text | CALL DWORD PTR [EBX+3Fh] | Displacement form |
| 2086B3 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 2092CD | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 209B20 | 7F1D2F8F | .text | CALL [static] | Indirect call to absolute memory address |
| 20A509 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 20C333 | N/A | .text | CALL DWORD PTR [EDI+5h] | Displacement form |
| 20DDE7 | N/A | .text | CALL DWORD PTR [EDX-6h] | Displacement form |
| 20ED0C | N/A | .text | CALL DWORD PTR [EBX+3Ch] | Displacement form |
| 20F7EB | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 21091C | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 212FC2 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 213B62 | DF337FA | .text | CALL [static] | Indirect call to absolute memory address |
| 2147F3 | N/A | .text | CALL DWORD PTR [EBP-7Eh] | Displacement form |
| 215D4C | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 216712 | N/A | .text | CALL DWORD PTR [EAX+16h] | Displacement form |
| 2168A8 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 218CFC | N/A | .text | CALL DWORD PTR [EDX-3Ah] | Displacement form |
| 2194CC | N/A | .text | CALL DWORD PTR [ECX-Ch] | Displacement form |
| 21B6FC | N/A | .text | CALL DWORD PTR [ECX-66h] | Displacement form |
| 21B79B | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 21B7D2 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 21D2EF | N/A | .text | CALL DWORD PTR [EAX+1Fh] | Displacement form |
| 21D93D | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 21E90C | N/A | .text | CALL DWORD PTR [EAX-4Fh] | Displacement form |
| 21ED73 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 21ED83 | 33CE8142 | .text | CALL [static] | Indirect call to absolute memory address |
| 22034D | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 220CA2 | N/A | .text | CALL DWORD PTR [ESI+37h] | Displacement form |
| 220FDC | N/A | .text | CALL DWORD PTR [EBX-Ah] | Displacement form |
| 2215C3 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 222273 | 4B4D7C42 | .text | JMP [static] | Indirect jump to absolute memory address |
| 222E6E | N/A | .text | CALL DWORD PTR [ESI+53h] | Displacement form |
| 22425F | N/A | .text | CALL DWORD PTR [ECX-63h] | Displacement form |
| 2243A3 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 2243B3 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 225AD5 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 22785C | N/A | .text | CALL DWORD PTR [EBX+71h] | Displacement form |
| 2280AC | N/A | .text | CALL DWORD PTR [ECX-Fh] | Displacement form |
| 2285CD | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 228B6C | N/A | .text | CALL DWORD PTR [EBX-6Ch] | Displacement form |
| 228FE8 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 22AB1F | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 22B74D | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 22B959 | N/A | .text | CALL DWORD PTR [EBP+EDI*2+1h] | ModRM/SIB parsed |
| 22C214 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 22CD54 | N/A | .text | CALL DWORD PTR [EDI-7Dh] | Displacement form |
| 22CE8C | N/A | .text | CALL DWORD PTR [EBX-51h] | Displacement form |
| 22DA5C | N/A | .text | CALL DWORD PTR [EBX-Fh] | Displacement form |
| 22F7B2 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 22FCAF | N/A | .text | CALL DWORD PTR [EDX+7Dh] | Displacement form |
| 23065F | N/A | .text | CALL DWORD PTR [EAX-36h] | Displacement form |
| 23162D | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 2317FC | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 2331FC | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 2335D0 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 23369C | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 233AD2 | N/A | .text | CALL DWORD PTR [ESI-49h] | Displacement form |
| 233FF8 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 234902 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 2361A1 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 23684C | N/A | .text | CALL DWORD PTR [EBX+75h] | Displacement form |
| 237A9B | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 238E52 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 23974C | N/A | .text | CALL DWORD PTR [EBX+72h] | Displacement form |
| 23A3BC | N/A | .text | CALL DWORD PTR [EBX+1Eh] | Displacement form |
| 23A8B7 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 23AB3C | N/A | .text | CALL DWORD PTR [EBX-Bh] | Displacement form |
| 23C34F | 2E8B8E1E | .text | JMP [static] | Indirect jump to absolute memory address |
| 23C6FD | N/A | .text | CALL DWORD PTR [EAX-2Dh] | Displacement form |
| 23C770 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 23E6B2 | N/A | .text | CALL DWORD PTR [EBP-5Bh] | Displacement form |
| 23F7D2 | 29725956 | .text | CALL [static] | Indirect call to absolute memory address |
| 240972 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 240BAA | N/A | .text | CALL DWORD PTR [ESI+EAX*8-19h] | ModRM/SIB parsed |
| 240BDA | N/A | .text | CALL DWORD PTR [ESI-15h] | Displacement form |
| 2415E7 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 242DFE | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 242E5D | N/A | .text | CALL DWORD PTR [EDX+50h] | Displacement form |
| 243168 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 243A3F | N/A | .text | CALL DWORD PTR [EBX+61h] | Displacement form |
| 2447A4 | N/A | .text | CALL DWORD PTR [EDX-78h] | Displacement form |
| 245043 | N/A | .text | CALL DWORD PTR [EBX-24h] | Displacement form |
| 2459CD | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 245B4C | N/A | .text | CALL DWORD PTR [ESI-Bh] | Displacement form |
| 246A47 | N/A | .text | CALL DWORD PTR [ECX-3Dh] | Displacement form |
| 2471FC | N/A | .text | CALL DWORD PTR [EDX-Fh] | Displacement form |
| 24775C | N/A | .text | CALL DWORD PTR [ECX+70h] | Displacement form |
| 24815F | N/A | .text | CALL DWORD PTR [EAX-72h] | Displacement form |
| 24840C | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 2486B2 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 2493AC | N/A | .text | CALL DWORD PTR [ECX-Bh] | Displacement form |
| 249893 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 24B303 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 24D371 | N/A | .text | CALL DWORD PTR [EBP+3Eh] | Displacement form |
| 24D51E | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 24D98E | N/A | .text | CALL DWORD PTR [EDX+EDX*2-12h] | ModRM/SIB parsed |
| 2509CC | N/A | .text | CALL DWORD PTR [ECX+70h] | Displacement form |
| 251043 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 252481 | N/A | .text | CALL DWORD PTR [EBP+5h] | Displacement form |
| 25333D | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 256487 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 257687 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 258844 | N/A | .text | CALL DWORD PTR [ECX-16h] | Displacement form |
| 25CAEE | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 25DD9D | 427B6252 | .text | CALL [static] | Indirect call to absolute memory address |
| 25E239 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 25E563 | N/A | .text | CALL DWORD PTR [EAX-1Fh] | Displacement form |
| 261825 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 26278F | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 262C66 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 262DA6 | N/A | .text | CALL DWORD PTR [EDI+7Fh] | Displacement form |
| 262DD3 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 2631AE | N/A | .text | CALL DWORD PTR [EBP-76h] | Displacement form |
| 264396 | 729D6CDB | .text | JMP [static] | Indirect jump to absolute memory address |
| 264996 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 266BF0 | N/A | .text | CALL DWORD PTR [ESI+70h] | Displacement form |
| 266E14 | N/A | .text | CALL DWORD PTR [EDI+15h] | Displacement form |
| 2681EE | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 268BA6 | N/A | .text | CALL DWORD PTR [EDX+3Ah] | Displacement form |
| 26C223 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 26D18D | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 274A56 | N/A | .text | CALL DWORD PTR [EDX-61h] | Displacement form |
| 275328 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 2758CC | N/A | .text | CALL DWORD PTR [EBP+18h] | Displacement form |
| 276373 | N/A | .text | CALL DWORD PTR [ESP+EAX*2-7Dh] | ModRM/SIB parsed |
| 2783BC | N/A | .text | CALL DWORD PTR [EAX+10h] | Displacement form |
| 279CAC | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 279E1E | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 27CE4B | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 27E01F | N/A | .text | CALL DWORD PTR [ECX+10h] | ModRM/SIB parsed |
| 280A0D | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 281DE8 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 28468F | N/A | .text | CALL DWORD PTR [EAX+16h] | Displacement form |
| 284F94 | N/A | .text | CALL DWORD PTR [ESI-30h] | Displacement form |
| 2855C1 | N/A | .text | CALL DWORD PTR [ECX+EBP*2-58h] | ModRM/SIB parsed |
| 285630 | N/A | .text | CALL DWORD PTR [ECX+31h] | Displacement form |
| 2884FE | N/A | .text | CALL DWORD PTR [EDI-21h] | Displacement form |
| 288C3B | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 28A3C0 | N/A | .text | CALL DWORD PTR [EDX+40h] | Displacement form |
| 28B002 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 28B061 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 28B476 | N/A | .text | CALL DWORD PTR [EAX+53h] | Displacement form |
| 28C77E | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 28F81E | N/A | .text | CALL DWORD PTR [EBP-70h] | Displacement form |
| 2903BC | N/A | .text | CALL DWORD PTR [EDX-10h] | Displacement form |
| 29040C | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 2911E1 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 2913B8 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 293DCE | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 294A68 | N/A | .text | CALL DWORD PTR [EAX-64h] | Displacement form |
| 295C38 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 29B5E7 | N/A | .text | CALL DWORD PTR [EAX+4Ch] | Displacement form |
| 29C9E2 | N/A | .text | CALL DWORD PTR [ECX+EBP*2+5Dh] | ModRM/SIB parsed |
| 29F505 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 29FAD5 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 2A249C | N/A | .text | CALL DWORD PTR [ECX-30h] | Displacement form |
| 2A2951 | N/A | .text | CALL DWORD PTR [EBX-20h] | Displacement form |
| 2A2CB4 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 2A37A5 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 2A3DCC | N/A | .text | CALL DWORD PTR [EBP-1Eh] | Displacement form |
| 2A6134 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 2A9D4C | N/A | .text | CALL DWORD PTR [ECX+77h] | Displacement form |
| 2AA48F | N/A | .text | CALL DWORD PTR [EAX-5Ch] | Displacement form |
| 2AA516 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 2ABEED | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 2AC0DD | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 2AD499 | N/A | .text | CALL DWORD PTR [EBP+EDI*2+1h] | ModRM/SIB parsed |
| 2ADD0F | N/A | .text | CALL DWORD PTR [ESI+EDI*2+7Ah] | ModRM/SIB parsed |
| 2B22AC | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 2B377C | N/A | .text | CALL DWORD PTR [EBX-4Bh] | Displacement form |
| 2B4D49 | N/A | .text | CALL DWORD PTR [EBX+63h] | Displacement form |
| 2B6673 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 2B6BFC | N/A | .text | CALL DWORD PTR [ECX-2Eh] | Displacement form |
| 2BC01D | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 2BEFB9 | N/A | .text | CALL DWORD PTR [ECX-7Dh] | Displacement form |
| 2BFF83 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 2C1798 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 2C31D9 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 2C346E | N/A | .text | CALL DWORD PTR [EBP-30h] | Displacement form |
| 2C3691 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 2C3CD8 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 2C5123 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 2C61EA | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 2C6658 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 2C6AB9 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 2C83ED | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 2C8D44 | N/A | .text | CALL DWORD PTR [EDI-4Dh] | Displacement form |
| 2C9D4D | N/A | .text | CALL DWORD PTR [EDX-3Ch] | Displacement form |
| 2CA5E4 | N/A | .text | CALL DWORD PTR [EDX-11h] | Displacement form |
| 2CA656 | 71762D48 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CB7FC | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 2CCA78 | N/A | .text | CALL DWORD PTR [EBP+12h] | Displacement form |
| 2CE911 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 2D1E4C | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 2D1EE5 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 2D30D9 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 2D3AE5 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 2D3FCE | N/A | .text | CALL DWORD PTR [EDI-40h] | Displacement form |
| 2D742E | 44EC0302 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D787B | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 2D8851 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 2D8FF2 | 76223E03 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D9363 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 2DDCF7 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 2E026C | N/A | .text | CALL DWORD PTR [EBX-3Ch] | Displacement form |
| 2E14D3 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 2E1503 | 64CF5F80 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2E1A83 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 2E245B | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 2E3996 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 2E4361 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 2E46D1 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 2E52EA | 5E604A6B | .text | JMP [static] | Indirect jump to absolute memory address |
| 2E5E5D | N/A | .text | CALL DWORD PTR [EBP-48h] | Displacement form |
| 2E5F52 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 2E62FC | N/A | .text | CALL DWORD PTR [EBP+9h] | Displacement form |
| 2E8280 | N/A | .text | CALL DWORD PTR [EBP-7Bh] | Displacement form |
| 2ED41B | N/A | .text | CALL DWORD PTR [ECX+37h] | Displacement form |
| 2EDC6E | 1C055E61 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2F1484 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 2F4763 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 2F4D83 | 52CD86E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F529C | N/A | .text | CALL DWORD PTR [EDI+72h] | Displacement form |
| 2F533C | N/A | .text | CALL DWORD PTR [ESI-21h] | Displacement form |
| 2F586D | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 2F5F77 | N/A | .text | CALL DWORD PTR [ESI+70h] | Displacement form |
| 2FA6D9 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 2FB50D | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 2FE41B | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 2FF676 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 2FF69A | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 300BF0 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 302091 | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 3052CD | 66EFA470 | .text | CALL [static] | Indirect call to absolute memory address |
| 307EBB | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 30C93C | N/A | .text | JMP DWORD PTR [EDI] | Indirect jump via pointer at address in EDI |
| 30CAC9 | N/A | .text | CALL DWORD PTR [EDX-62h] | Displacement form |
| 30E2F9 | N/A | .text | CALL DWORD PTR [ESP+EDI*2-54h] | ModRM/SIB parsed |
| 31253C | N/A | .text | CALL DWORD PTR [EBP+18h] | Displacement form |
| 312D36 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 3179BC | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 319E2E | N/A | .text | CALL DWORD PTR [ECX+EDX*2-11h] | ModRM/SIB parsed |
| 31E27C | N/A | .text | CALL DWORD PTR [EBX-Fh] | Displacement form |
| 31E57C | N/A | .text | CALL DWORD PTR [EBX-Fh] | Displacement form |
| 32008B | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 321830 | N/A | .text | CALL DWORD PTR [EDI] | Indirect call via pointer at address in EDI |
| 322A65 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 3247F9 | N/A | .text | CALL DWORD PTR [ESI-58h] | Displacement form |
| 3252E9 | N/A | .text | CALL DWORD PTR [EDX-3Ch] | Displacement form |
| 325C22 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 32743C | 1EB635FF | .text | JMP [static] | Indirect jump to absolute memory address |
| 329008 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 32A4C8 | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 32C38E | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 32DFB2 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 32E125 | N/A | .text | CALL DWORD PTR [EBP-2Ah] | Displacement form |
| 32E3D8 | N/A | .text | CALL DWORD PTR [EAX+30h] | Displacement form |
| 3304B8 | N/A | .text | CALL DWORD PTR [ECX+4Bh] | Displacement form |
| 330608 | N/A | .text | CALL DWORD PTR [ECX+4Bh] | Displacement form |
| 333B78 | N/A | .text | CALL DWORD PTR [EBX+6Bh] | Displacement form |
| 333E3C | N/A | .text | CALL DWORD PTR [EDX+10h] | Displacement form |
| 3341CC | N/A | .text | CALL DWORD PTR [ECX+9h] | Displacement form |
| 3381AB | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 339930 | N/A | .text | CALL DWORD PTR [EDX+40h] | Displacement form |
| 33A572 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 33A5D1 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 33A9E6 | N/A | .text | CALL DWORD PTR [EAX+53h] | Displacement form |
| 33BE13 | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 340AE4 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 340F5D | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 341246 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 34225A | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 34363B | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 343A10 | N/A | .text | CALL DWORD PTR [ESI] | Indirect call via pointer at address in ESI |
| 348502 | N/A | .text | CALL DWORD PTR [EDX] | Indirect call via pointer at address in EDX |
| 34DACA | N/A | .text | CALL DWORD PTR [ESI+63h] | Displacement form |
| 34E079 | N/A | .text | CALL DWORD PTR [ESI-7Dh] | Displacement form |
| 351EFF | N/A | .text | CALL DWORD PTR [EAX-4Dh] | Displacement form |
| 353ADA | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 35627F | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 356DFC | N/A | .text | CALL DWORD PTR [EBX+7Ah] | Displacement form |
| 35E8B4 | N/A | .text | CALL DWORD PTR [EBX+3Dh] | Displacement form |
| 35EC42 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 3607AD | N/A | .text | CALL DWORD PTR [ECX+56h] | Displacement form |
| 360DCB | 4FBE7B44 | .text | JMP [static] | Indirect jump to absolute memory address |
| 367D3E | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 36BDA5 | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 36BEE6 | N/A | .text | CALL DWORD PTR [ESI+EAX*8+49h] | ModRM/SIB parsed |
| 36C7B5 | N/A | .text | CALL DWORD PTR [ESI+78h] | Displacement form |
| 36FEE6 | N/A | .text | JMP DWORD PTR [EAX] | Indirect jump via pointer at address in EAX |
| 371346 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 371EFF | 58096F7D | .text | JMP [static] | Indirect jump to absolute memory address |
| 375E3C | N/A | .text | CALL DWORD PTR [EDI+61h] | Displacement form |
| 376E36 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| 376E5A | N/A | .text | CALL DWORD PTR [EBX] | Indirect call via pointer at address in EBX |
| 3783B0 | N/A | .text | CALL DWORD PTR [EAX] | Indirect call via pointer at address in EAX |
| 378DC1 | N/A | .text | JMP DWORD PTR [ESI] | Indirect jump via pointer at address in ESI |
| 381D2B | N/A | .text | CALL DWORD PTR [ECX] | Indirect call via pointer at address in ECX |
| 38254A | N/A | .text | JMP DWORD PTR [EDX] | Indirect jump via pointer at address in EDX |
| 382D01 | N/A | .text | JMP DWORD PTR [ECX] | Indirect jump via pointer at address in ECX |
| 385483 | N/A | .text | JMP DWORD PTR [EBX] | Indirect jump via pointer at address in EBX |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 3755663 | 69,43% |
| Null Byte Code | 40960 | 0,7572% |
© 2025 All rights reserved.