- DOS Header
- NT Header
- Rich Header
- Sections
- Export
- Imports
- Resource
- Exceptions
- Relocations
- Debugs
- Load config
- IAT
IAT
| # | rva | value | meaning |
|---|---|---|---|
| 0 | 0x2a000 | 0x5cf2a | ADVAPI32.dll!RegOpenKeyExW |
| 1 | 0x2a008 | 0x5cf1a | ADVAPI32.dll!RegCloseKey |
| 2 | 0x2a010 | 0x5cf3e | |
| 3 | 0x2a018 | 0x0 | KERNEL32.dll!GetModuleHandleW |
| 4 | 0x2a020 | 0x5cd44 | KERNEL32.dll!FindResourceW |
| 5 | 0x2a028 | 0x5cd58 | KERNEL32.dll!LoadResource |
| 6 | 0x2a030 | 0x5cd68 | KERNEL32.dll!LockResource |
| 7 | 0x2a038 | 0x5cd78 | KERNEL32.dll!SizeofResource |
| 8 | 0x2a040 | 0x5cd88 | KERNEL32.dll!SetLastError |
| 9 | 0x2a048 | 0x5cd9a | KERNEL32.dll!GetCurrentProcessId |
| 10 | 0x2a050 | 0x5cdaa | KERNEL32.dll!LocalFree |
| 11 | 0x2a058 | 0x5cdc0 | KERNEL32.dll!LocalAlloc |
| 12 | 0x2a060 | 0x5cdcc | KERNEL32.dll!FormatMessageW |
| 13 | 0x2a068 | 0x5cdda | KERNEL32.dll!GetModuleFileNameW |
| 14 | 0x2a070 | 0x5cdec | KERNEL32.dll!GetTempPathW |
| 15 | 0x2a078 | 0x5ce02 | KERNEL32.dll!GetTempFileNameW |
| 16 | 0x2a080 | 0x5ce12 | KERNEL32.dll!GetProcAddress |
| 17 | 0x2a088 | 0x5cd32 | KERNEL32.dll!WriteFile |
| 18 | 0x2a090 | 0x5ce34 | KERNEL32.dll!CloseHandle |
| 19 | 0x2a098 | 0x5ce40 | KERNEL32.dll!DeleteFileW |