- DOS Header
- NT Header
- Rich Header
- Sections
- Imports
- Resource
- Exceptions
- Relocations
- Debugs
- Load config
- IAT
IAT
| # | rva | value | meaning |
|---|---|---|---|
| 0 | 0x3150 | 0x3ad4 | ADVAPI32.dll!RegOpenKeyExA |
| 1 | 0x3158 | 0x3ae4 | ADVAPI32.dll!RegQueryValueExA |
| 2 | 0x3160 | 0x3af4 | ADVAPI32.dll!RegCloseKey |
| 3 | 0x3168 | 0x3b08 | ADVAPI32.dll!RegQueryValueExW |
| 4 | 0x3170 | 0x3ac0 | |
| 5 | 0x3178 | 0x0 | KERNEL32.dll!ExpandEnvironmentStringsA |
| 6 | 0x3180 | 0x3b24 | KERNEL32.dll!LoadLibraryA |
| 7 | 0x3188 | 0x3b40 | KERNEL32.dll!HeapSetInformation |
| 8 | 0x3190 | 0x3b50 | KERNEL32.dll!SetProcessDEPPolicy |
| 9 | 0x3198 | 0x3b66 | KERNEL32.dll!GetProcAddress |
| 10 | 0x31a0 | 0x3b7c | KERNEL32.dll!FreeLibrary |
| 11 | 0x31a8 | 0x3b8e | KERNEL32.dll!GetCurrentThreadId |
| 12 | 0x31b0 | 0x3d98 | KERNEL32.dll!GetCurrentProcessId |
| 13 | 0x31b8 | 0x3d82 | KERNEL32.dll!QueryPerformanceCounter |
| 14 | 0x31c0 | 0x3d68 | KERNEL32.dll!GetModuleHandleW |
| 15 | 0x31c8 | 0x3d54 | KERNEL32.dll!TerminateProcess |
| 16 | 0x31d0 | 0x3d40 | KERNEL32.dll!GetCurrentProcess |
| 17 | 0x31d8 | 0x3d2c | KERNEL32.dll!SetUnhandledExceptionFilter |
| 18 | 0x31e0 | 0x3d0e | KERNEL32.dll!UnhandledExceptionFilter |
| 19 | 0x31e8 | 0x3cf2 | KERNEL32.dll!RtlVirtualUnwind |