- DOS Header
- NT Header
- Rich Header
- Sections
- Imports
- Resource
- Exceptions
- Relocations
- Debugs
- Load config
- IAT
IAT
| # | rva | value | meaning |
|---|---|---|---|
| 0 | 0x4000 | 0x53a8 | KERNEL32.dll!InitializeCriticalSectionEx |
| 1 | 0x4008 | 0x53b8 | KERNEL32.dll!DeleteCriticalSection |
| 2 | 0x4010 | 0x53d6 | KERNEL32.dll!CreateThread |
| 3 | 0x4018 | 0x53ee | KERNEL32.dll!CreateToolhelp32Snapshot |
| 4 | 0x4020 | 0x53fe | KERNEL32.dll!Process32First |
| 5 | 0x4028 | 0x541a | KERNEL32.dll!Process32Next |
| 6 | 0x4030 | 0x542c | KERNEL32.dll!OpenProcess |
| 7 | 0x4038 | 0x543c | KERNEL32.dll!VirtualQueryEx |
| 8 | 0x4040 | 0x544a | KERNEL32.dll!ReadProcessMemory |
| 9 | 0x4048 | 0x545c | KERNEL32.dll!WriteProcessMemory |
| 10 | 0x4050 | 0x5470 | KERNEL32.dll!GetSystemInfo |
| 11 | 0x4058 | 0x5486 | KERNEL32.dll!Beep |
| 12 | 0x4060 | 0x5496 | KERNEL32.dll!Sleep |
| 13 | 0x4068 | 0x549e | KERNEL32.dll!OutputDebugStringW |
| 14 | 0x4070 | 0x5778 | KERNEL32.dll!RtlCaptureContext |
| 15 | 0x4078 | 0x578e | KERNEL32.dll!RtlLookupFunctionEntry |
| 16 | 0x4080 | 0x57a2 | KERNEL32.dll!InitializeSListHead |
| 17 | 0x4088 | 0x58ae | KERNEL32.dll!RtlVirtualUnwind |
| 18 | 0x4090 | 0x57bc | KERNEL32.dll!UnhandledExceptionFilter |
| 19 | 0x4098 | 0x57d0 | KERNEL32.dll!SetUnhandledExceptionFilter |