adf1753f4f182e3c4287eeea19ceddb5b91f3386c73d1d17b8f0b8171a9c219f
Summary
| Architecture |
IMAGE_FILE_MACHINE_AMD64
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2026-Jul-24 19:49:05 |
| Detected languages |
English - United States
|
| TLS Callbacks | 1 callback(s) detected. |
| Debug artifacts |
W:\Depot\LoTRWarInTheNorth\Remaster\Day0_Cert_514686\trixie\bin\pc\SteamRelease\witn.pdb
|
| CompanyName | WB Games Inc. |
| FileDescription | The Lord of the Rings: War in the North |
| FileVersion | 1, 0, 0, 1 |
| InternalName | The Lord of the Rings: War in the North |
| LegalCopyright | TM & © New Line. THE LORD OF THE RINGS: WAR IN THE NORTH and the names of the characters, items, events and places therein are trademarks or registered trademarks of SZC under license to WBIE. (S11) |
| LegalTrademarks | TM & © New Line. THE LORD OF THE RINGS: WAR IN THE NORTH and the names of the characters, items, events and places therein are trademarks or registered trademarks of SZC under license to WBIE. (S11) |
| OriginalFilename | The Lord of the Rings: War in the North |
| ProductName | The Lord of the Rings: War in the North |
| ProductVersion | 1, 0, 0, 1 |
Plugin Output
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Tries to detect virtualized environments:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to CRC32 |
| Suspicious | The PE is possibly packed. | Unusual section name found: .fptable |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Safe | VirusTotal score: 0/71 (Scanned on 2026-08-11 17:50:03) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x158 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_AMD64
|
| NumberofSections | 8 |
| TimeDateStamp | 2026-Jul-24 19:49:05 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xf0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32+ |
|---|---|
| LinkerVersion | 14.0 |
| SizeOfCode | 0x9e4800 |
| SizeOfInitializedData | 0x1462200 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x00000000007CC2C0 (Section: .text) |
| BaseOfCode | 0x1000 |
| ImageBase | 0x140000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1e4c000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.pdata
_RDATA
.fptable
.rsrc
.reloc
Imports
| dbghelp.dll |
MiniDumpWriteDump
|
|---|---|
| steam_api64.dll |
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback SteamAPI_Shutdown SteamInternal_SteamAPI_Init SteamAPI_RegisterCallResult SteamAPI_UnregisterCallResult SteamAPI_RunCallbacks SteamInternal_CreateInterface SteamInternal_FindOrCreateUserInterface SteamInternal_ContextInit SteamAPI_GetHSteamUser SteamAPI_IsSteamRunning |
| KERNEL32.dll |
GetConsoleOutputCP
GetFileSizeEx HeapReAlloc HeapSize HeapQueryInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP ReadConsoleW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SetEndOfFile WriteConsoleW GetExitCodeThread LoadLibraryA GetOEMCP GetConsoleMode DeleteFileA GetCurrentThreadId GetCurrentProcessId GetCurrentProcess CloseHandle CreateFileW FindClose GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RtlPcToFileHeader TerminateProcess InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo GetStringTypeW TlsGetValue CreateDirectoryA FlushFileBuffers GetFileAttributesA GetFileAttributesExA GetFileSize ReadFile ReadFileEx SetFilePointer WriteFile WriteFileEx GetLastError GetOverlappedResult CopyFileA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS SetEvent WaitForSingleObject CreateEventA Sleep WaitForMultipleObjects CreateThread GetCurrentThread SetThreadPriority SuspendThread ResumeThread GetEnvironmentVariableA SetCurrentDirectoryA CompareFileTime CreateFileA RtlUnwind FindFirstFileA FindNextFileA GetFileTime QueryPerformanceCounter QueryPerformanceFrequency GetLocalTime GetTickCount SystemTimeToFileTime OutputDebugStringA ReleaseSemaphore VirtualAlloc GetModuleFileNameW GetModuleHandleA CreateSemaphoreA GetProcAddress LoadLibraryExA GetUserDefaultLangID GetFullPathNameW MultiByteToWideChar WideCharToMultiByte GetSystemInfo SetFilePointerEx GetCurrentDirectoryA GlobalAlloc GlobalUnlock GlobalLock GlobalFree HeapAlloc HeapFree GetProcessHeap CreateEventW CreateEventExW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW |
| SHELL32.dll |
SHGetSpecialFolderPathA
ShellExecuteA |
| WS2_32.dll |
getaddrinfo
WSAGetLastError WSACleanup WSAStartup socket shutdown setsockopt sendto select WSAAsyncSelect recv ntohs ntohl listen htons gethostname gethostbyname send __WSAFDIsSet inet_ntoa inet_addr accept bind closesocket connect ioctlsocket getsockname getsockopt htonl freeaddrinfo recvfrom |
| d3d12.dll |
#101
D3D12SerializeRootSignature |
| dxgi.dll |
CreateDXGIFactory2
|
| dxcompiler.dll |
DxcCreateInstance
|
| EOSSDK-Win64-Shipping.dll |
EOS_ByteArray_ToString
EOS_UI_HideFriends EOS_UI_ShowFriends EOS_LobbySearch_CopySearchResultByIndex EOS_P2P_RemoveNotifyPeerConnectionClosed EOS_LobbySearch_SetParameter EOS_P2P_RemoveNotifyPeerConnectionRequest EOS_P2P_AddNotifyPeerConnectionRequest EOS_P2P_SendPacket EOS_P2P_AddNotifyPeerConnectionClosed EOS_P2P_AcceptConnection EOS_P2P_CloseConnection EOS_P2P_GetPacketQueueInfo EOS_LobbySearch_GetSearchResultCount EOS_Connect_CreateUser EOS_LobbySearch_SetLobbyId EOS_LobbySearch_Find EOS_LobbyDetails_GetMemberByIndex EOS_LobbyDetails_GetMemberCount EOS_LobbyDetails_CopyAttributeByIndex EOS_LobbyDetails_GetAttributeCount EOS_LobbyDetails_CopyInfo EOS_LobbyDetails_GetLobbyOwner EOS_LobbyModification_AddAttribute EOS_Lobby_RemoveNotifyLeaveLobbyRequested EOS_Lobby_AddNotifyLeaveLobbyRequested EOS_Lobby_CopyLobbyDetailsHandle EOS_Lobby_CopyLobbyDetailsHandleByUiEventId EOS_Lobby_CopyLobbyDetailsHandleByInviteId EOS_Lobby_RemoveNotifyJoinLobbyAccepted EOS_Lobby_AddNotifyJoinLobbyAccepted EOS_Lobby_RemoveNotifyLobbyInviteAccepted EOS_Lobby_AddNotifyLobbyInviteAccepted EOS_Lobby_RemoveNotifyLobbyInviteReceived EOS_Lobby_AddNotifyLobbyInviteReceived EOS_Lobby_CreateLobbySearch EOS_Lobby_RemoveNotifyLobbyMemberStatusReceived EOS_Lobby_AddNotifyLobbyMemberStatusReceived EOS_Lobby_RemoveNotifyLobbyMemberUpdateReceived EOS_Lobby_AddNotifyLobbyMemberUpdateReceived EOS_Lobby_RemoveNotifyLobbyUpdateReceived EOS_EpicAccountId_IsValid EOS_UserInfo_BestDisplayName_Release EOS_Platform_GetUserInfoInterface EOS_UserInfo_QueryUserInfo EOS_UserInfo_CopyBestDisplayName EOS_UserInfo_CopyBestDisplayNameWithPlatform EOS_EResult_IsOperationComplete EOS_ProductUserId_IsValid EOS_ProductUserId_ToString EOS_IntegratedPlatformOptionsContainer_Release EOS_Initialize EOS_Shutdown EOS_Platform_Create EOS_Platform_Release EOS_Auth_Token_Release EOS_Connect_Login EOS_Lobby_UpdateLobby EOS_Connect_AddNotifyAuthExpiration EOS_Connect_RemoveNotifyAuthExpiration EOS_Platform_Tick EOS_Platform_GetAuthInterface EOS_Platform_GetConnectInterface EOS_Platform_GetP2PInterface EOS_Auth_Login EOS_Auth_Logout EOS_Auth_LinkAccount EOS_Auth_CopyUserAuthToken EOS_Logging_SetCallback EOS_Logging_SetLogLevel EOS_P2P_GetNextReceivedPacketSize EOS_P2P_ReceivePacket EOS_ProductUserId_FromString EOS_LobbyModification_Release EOS_LobbyDetails_Release EOS_LobbySearch_Release EOS_LobbyDetails_Info_Release EOS_Lobby_Attribute_Release EOS_Platform_GetUIInterface EOS_Platform_GetLobbyInterface EOS_Lobby_CreateLobby EOS_Lobby_DestroyLobby EOS_Lobby_JoinLobby EOS_Lobby_LeaveLobby EOS_Lobby_UpdateLobbyModification EOS_Lobby_AddNotifyLobbyUpdateReceived |
| XAudio2_9.dll |
#2
#6 |
| XINPUT1_4.dll |
#3
#2 |
| bink2w64.dll |
BinkNextFrame
BinkWait BinkShouldSkip BinkStartAsyncThread BinkDoFrameAsyncMulti BinkRequestStopAsyncThreadsMulti BinkWaitStopAsyncThreadsMulti BinkSetSoundSystem2 BinkSetVolume BinkGetRealtime BinkGetFrameBuffersInfo BinkRegisterFrameBuffers BinkUtilMalloc BinkUtilFree BinkGetTrackID BinkDoFrameAsyncWait BinkControlBackgroundIO BinkPause BinkClose BinkOpen BinkDoFrame BinkSetIOSize BinkSetMemory BinkSetSoundTrack BinkSetOSFileCallbacks BinkOpenXAudio2 BinkSetSpeakerVolumes BinkGetSummary |
| WTSAPI32.dll |
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification |
| USER32.dll |
AdjustWindowRectEx
GetWindowRect CreateDialogIndirectParamA SetWindowPos GetClassInfoA UnregisterClassA PostMessageA SetFocus MessageBoxA EnumDisplaySettingsA LoadIconA LockSetForegroundWindow SetForegroundWindow SetWindowLongPtrA RegisterClassExA PostQuitMessage RegisterRawInputDevices GetWindowInfo SystemParametersInfoA DestroyCursor LoadCursorA PtInRect ClipCursor MapWindowPoints ScreenToClient ClientToScreen GetCursorPos SetCursor MessageBoxW GetClientRect SetWindowTextW ToUnicode GetKeyboardState GetKeyState ShowWindow DestroyWindow PeekMessageA GetRawInputData CreateWindowExA DispatchMessageA TranslateMessage LoadStringW DefWindowProcA |
| GDI32.dll |
GetStockObject
|
| ADVAPI32.dll |
RegOpenKeyA
OpenSCManagerA OpenServiceA GetUserNameA CloseServiceHandle |
| ole32.dll |
CoUninitialize
CoInitializeEx |
| RawInput.dll |
?GetState@IGamepad@RawInput@@QEAA?BU_XINPUT_STATE@@XZ
?HasConnectedPads@GamepadsManager@RawInput@@SA_NXZ ?GetFreeGamepads@GamepadsManager@RawInput@@SAHPEAV?$shared_ptr@VIGamepad@RawInput@@@std@@I@Z WndProcRawInput SetFilter ?Assign@IGamepad@RawInput@@QEAAXPEAXP6AX0@Z@Z ?SetAxisDistributionValues@IGamepad@RawInput@@QEAAXHH@Z |
Delayed Imports
12
1
2
3
4
5
6
7
8
9
10
11
7 (#2)
112
101
1 (#2)
1 (#3)
String Table contents
| A game instance is already running. |
| Une instance de jeu est déjà en cours d'exécution. |
| Un'istanza del gioco è già in esecuzione. |
| Ein Spielvorgang läuft bereits. |
| Ya está funcionando una partida. |
| Uma instância do jogo já está sendo executada. |
| Игра уже запущена. |
| Gra jest już uruchomiona. |
| ゲームインスタンスが既に起動しています |
| 게임 인스턴스가 이미 실행 중입니다. |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.0.0.1 |
| ProductVersion | 1.0.0.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | WB Games Inc. |
| FileDescription | The Lord of the Rings: War in the North |
| FileVersion (#2) | 1, 0, 0, 1 |
| InternalName | The Lord of the Rings: War in the North |
| LegalCopyright | TM & © New Line. THE LORD OF THE RINGS: WAR IN THE NORTH and the names of the characters, items, events and places therein are trademarks or registered trademarks of SZC under license to WBIE. (S11) |
| LegalTrademarks | TM & © New Line. THE LORD OF THE RINGS: WAR IN THE NORTH and the names of the characters, items, events and places therein are trademarks or registered trademarks of SZC under license to WBIE. (S11) |
| OriginalFilename | The Lord of the Rings: War in the North |
| ProductName | The Lord of the Rings: War in the North |
| ProductVersion (#2) | 1, 0, 0, 1 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-24 19:49:05 |
| Version | 0.0 |
| SizeofData | 113 |
| AddressOfRawData | 0xaa0f1c |
| PointerToRawData | 0xa9fb1c |
| Referenced File | W:\Depot\LoTRWarInTheNorth\Remaster\Day0_Cert_514686\trixie\bin\pc\SteamRelease\witn.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-24 19:49:05 |
| Version | 0.0 |
| SizeofData | 20 |
| AddressOfRawData | 0xaa0f90 |
| PointerToRawData | 0xa9fb90 |
IMAGE_DEBUG_TYPE_POGO
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2026-Jul-24 19:49:05 |
| Version | 0.0 |
| SizeofData | 1148 |
| AddressOfRawData | 0xaa0fa4 |
| PointerToRawData | 0xa9fba4 |
TLS Callbacks
| StartAddressOfRawData | 0x140aa1478 |
|---|---|
| EndAddressOfRawData | 0x140aa14d0 |
| AddressOfIndex | 0x141d4e288 |
| AddressOfCallbacks | 0x1409f2210 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_ALIGN_8BYTES
|
| Callbacks |
0x00000001407CC2D4
|
Load Configuration
| Size | 0x140 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x140b80e80 |
RICH Header
| XOR Key | 0x27475e43 |
|---|---|
| Unmarked objects | 0 |
| C objects (33145) | 61 |
| ASM objects (33145) | 37 |
| 253 (35207) | 1 |
| ASM objects (35207) | 19 |
| C objects (35207) | 20 |
| C++ objects (35207) | 85 |
| Imports (35223) | 2 |
| C objects (35223) | 24 |
| Imports (30148) | 2 |
| Imports (VS2008 SP1 build 30729) | 2 |
| C++ objects (33523) | 27 |
| C++ objects (33522) | 656 |
| C++ objects (33145) | 194 |
| Imports (30154) | 2 |
| Imports (34808) | 2 |
| Total imports | 403 |
| Imports (33145) | 27 |
| C++ objects (35223) | 1581 |
| Resource objects (35223) | 1 |
| 151 | 1 |
| Linker (35223) | 1 |
Errors
Leave a comment
No comments yet.