filenameWowhead_Client.exe
size454656 (0x6f000)
md5e8224b528d2f50aa21652751bee0facd
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
131210228
171303198
152201152
1584021928
1714021960
17040219151
131307294
1473072927
10254
1754021918
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4f6bab15
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion10.0
SizeOfCode0x4ee00
SizeOfInitializedData0x1fe00
SizeOfUninitializedData0
AddressOfEntryPoint0x2e055
BaseOfCode0x1000
BaseOfData0x50000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x74000
SizeOfHeaders0x400
CheckSum0x792d7
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x4ed1c0x4ee00R-X CODE
.rdata0x500000x164a20x16600R-- IDATA
.data0x670000x5c840x3800RW- IDATA
.tls0x6d00020x200RW- IDATA
.rsrc0x6e0000x5cfc0x5e00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x651340x104
RESOURCE0x6e0000x5cfc
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x50a100x1c
ARCHITECTURE00
GLOBALPTR00
TLS0x5c0e00x18
LOAD_CONFIG0x5c0980x40
Bound_IAT00
IAT0x500000x3b4
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x46d0000x46d0010x46b65c0x4509e400
typenamesizecp
ICON#122161252
ICON#213841252
ICON#396401252
ICON#442641252
ICON#511281252
ICON#613841252
ICON#711281252
GROUP_ICON#101761252
GROUP_ICON#102341252
VERSION#112001252
MANIFEST#17061252
module_namehintordfunction_name
KERNEL32.dll211DeleteFileA
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll586GetProcessHeap
KERNEL32.dll715HeapAlloc
KERNEL32.dll130CreateEventA
KERNEL32.dll82CloseHandle
KERNEL32.dll719HeapFree
KERNEL32.dll702GlobalLock
KERNEL32.dll691GlobalAlloc
KERNEL32.dll709GlobalUnlock
KERNEL32.dll698GlobalFree
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll1223TlsGetValue
KERNEL32.dll1196SetWaitableTimer
KERNEL32.dll606GetQueuedCompletionStatus
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1205SleepEx
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1217TerminateThread
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll659GetTickCount
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll1113SetEvent
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll1139SetLastError
KERNEL32.dll581GetProcAddress
KERNEL32.dll943QueueUserAPC
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll910PostQueuedCompletionStatus
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll148CreateIoCompletionPort
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll390GetCommandLineA
KERNEL32.dll612GetStdHandle
KERNEL32.dll675GetVersionExA
KERNEL32.dll515GetLocalTime
KERNEL32.dll1357lstrlenA
KERNEL32.dll349FormatMessageA
KERNEL32.dll840LocalFree
KERNEL32.dll191CreateWaitableTimerA
KERNEL32.dll1213SystemTimeToFileTime
KERNEL32.dll1043ResumeThread
KERNEL32.dll1039ResetEvent
KERNEL32.dll884OpenEventA
KERNEL32.dll1110SetEnvironmentVariableA
KERNEL32.dll100CompareStringW
KERNEL32.dll143CreateFileW
KERNEL32.dll281ExitProcess
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll1018ReleaseMutex
KERNEL32.dll136CreateFileA
KERNEL32.dll831LoadLibraryW
KERNEL32.dll722HeapReAlloc
KERNEL32.dll780IsValidLocale
KERNEL32.dll269EnumSystemLocalesA
KERNEL32.dll516GetLocaleInfoA
KERNEL32.dll667GetUserDefaultLCID
KERNEL32.dll617GetStringTypeW
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll664GetTimeZoneInformation
KERNEL32.dll1126SetFilePointer
KERNEL32.dll428GetConsoleMode
KERNEL32.dll410GetConsoleCP
KERNEL32.dll960ReadFile
KERNEL32.dll778IsValidCodePage
KERNEL32.dll567GetOEMCP
KERNEL32.dll360GetACP
KERNEL32.dll499GetFileType
KERNEL32.dll1135SetHandleCount
KERNEL32.dll717HeapCreate
KERNEL32.dll518GetLocaleInfoW
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll1317WriteFile
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll724HeapSize
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll813LCMapStringW
KERNEL32.dll370GetCPInfo
KERNEL32.dll1048RtlUnwind
KERNEL32.dll945RaiseException
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll723HeapSetInformation
KERNEL32.dll181CreateThread
KERNEL32.dll155CreateMutexA
KERNEL32.dll323FindNextFileA
KERNEL32.dll302FindClose
KERNEL32.dll306FindFirstFileA
KERNEL32.dll1202Sleep
KERNEL32.dll862MoveFileA
KERNEL32.dll1118SetFileAttributesA
KERNEL32.dll112CopyFileA
KERNEL32.dll1222TlsFree
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1221TlsAlloc
KERNEL32.dll749InterlockedExchangeAdd
KERNEL32.dll514GetLastError
KERNEL32.dll748InterlockedExchange
KERNEL32.dll282ExitThread
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll124CreateDirectoryA
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll202DecodePointer
KERNEL32.dll234EncodePointer
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll1159SetStdHandle
KERNEL32.dll863MoveFileExA
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll1107SetEndOfFile
USER32.dll537MonitorFromRect
USER32.dll168DialogBoxIndirectParamA
USER32.dll494LoadImageA
USER32.dll714SetWindowTextA
USER32.dll768UnhookWindowsHookEx
USER32.dll3AdjustWindowRectEx
USER32.dll735ShowWindow
USER32.dll110CreateWindowExW
USER32.dll710SetWindowPos
USER32.dll718SetWindowsHookExA
USER32.dll659SetForegroundWindow
USER32.dll109CreateWindowExA
USER32.dll405GetWindowLongA
USER32.dll707SetWindowLongA
USER32.dll331GetMenu
USER32.dll95CreateDialogIndirectParamA
USER32.dll764TranslateMessage
USER32.dll350GetMonitorInfoA
USER32.dll276GetClientRect
USER32.dll28CallNextHookEx
USER32.dll218EndDialog
USER32.dll526MessageBoxA
USER32.dll492LoadIconA
USER32.dll247FindWindowA
USER32.dll631SendMessageA
USER32.dll565PostMessageA
USER32.dll480IsWindowVisible
USER32.dll416GetWindowTextA
USER32.dll174DispatchMessageA
USER32.dll819wsprintfW
USER32.dll263GetAsyncKeyState
USER32.dll636SendMessageW
USER32.dll295GetDlgItem
USER32.dll533MessageBoxW
USER32.dll715SetWindowTextW
USER32.dll483KillTimer
USER32.dll699SetTimer
USER32.dll440InsertMenuItemA
USER32.dll567PostQuitMessage
USER32.dll758TrackPopupMenu
USER32.dll378GetSubMenu
USER32.dll106CreateMenu
USER32.dll288GetCursorPos
USER32.dll668SetMenu
USER32.dll107CreatePopupMenu
USER32.dll216EnableWindow
USER32.dll164DestroyMenu
USER32.dll63CheckMenuItem
USER32.dll417GetWindowTextLengthA
USER32.dll29CallWindowProcA
USER32.dll166DestroyWindow
USER32.dll345GetMessageA
USER32.dll412GetWindowRect
USER32.dll465IsIconic
USER32.dll356GetParent
GDI32.dll525GetStockObject
GDI32.dll61CreateFontIndirectA
GDI32.dll230DeleteObject
GDI32.dll507GetObjectA
COMDLG32.dll11GetOpenFileNameA
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll621RegQueryValueExA
SHELL32.dll224SHGetSpecialFolderPathA
SHELL32.dll300Shell_NotifyIconA
SHELL32.dll286ShellExecuteA
ole32.dll99CoSetProxyBlanket
ole32.dll108CoUninitialize
ole32.dll16CoCreateInstance
ole32.dll64CoInitializeSecurity
ole32.dll63CoInitializeEx
ole32.dll62CoInitialize
OLEAUT32.dll2
OLEAUT32.dll9
OLEAUT32.dll6
COMCTL32.dll123InitCommonControlsEx
WS2_32.dll1
WS2_32.dll115
WS2_32.dll22
WS2_32.dll10
WS2_32.dll85WSAStringToAddressA
WS2_32.dll4
WS2_32.dll11
WS2_32.dll68WSARecv
WS2_32.dll73WSASend
WS2_32.dll18
WS2_32.dll111
WS2_32.dll9
WS2_32.dll6
WS2_32.dll13
WS2_32.dll21
WS2_32.dll2
WS2_32.dll55
WS2_32.dll151
WS2_32.dll112
WS2_32.dll3
WS2_32.dll52
WS2_32.dll7
WS2_32.dll82WSASocketA
WS2_32.dll116
VERSION.dll3GetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA
VERSION.dll13VerQueryValueA
SHLWAPI.dll182SHDeleteValueA

StringTable 000904b0

Commentshttp://www.wowhead.com/client
CompanyNameWowhead
FileDescriptionThe Wowhead Client installs and maintains an addon called the Wowhead Looter, which collects data as you play the game. It also uploads the collected data and your characters' information to the Wowhead website!
FileVersion1.8.18.0
InternalNameWowhead Client
LegalCopyright© 2012 Wowhead
OriginalFilenameWowhead_Client.exe
ProductNameWowhead Client
ProductVersion1.8.18.0

VS_FIXEDFILEINFO

FileVersion1.8.18.0
ProductVersion1.8.18.0
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0454656EXE03/22/2012 22:43:33#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x6b65c