struc IMAGE_DOS_HEADER { .e_magic dw ? .e_cblp dw ? .e_cp dw ? .e_crlc dw ? .e_cparhdr dw ? .e_minalloc dw ? .e_maxalloc dw ? .e_ss dw ? .e_sp dw ? .e_csum dw ? .e_ip dw ? .e_cs dw ? .e_lfarlc dw ? .e_ovno dw ? .e_res dd ? ; e_res[4] 1 ellement size WORD .e_oemid dw ? .e_oeminfo dw ? .e_res2 dd ? ; e_res2[10] 1 ellement size WORD .e_lfanew dd ? } IMAGE_DIRECTORY_ENTRY_EXPORT equ 0 IMAGE_DIRECTORY_ENTRY_IMPORT equ 8 IMAGE_DIRECTORY_ENTRY_RESOURCE equ 16 IMAGE_DIRECTORY_ENTRY_EXCEPTION equ 24 IMAGE_DIRECTORY_ENTRY_SECURITY equ 32 IMAGE_DIRECTORY_ENTRY_BASERELOC equ 40 IMAGE_DIRECTORY_ENTRY_DEBUG equ 48 IMAGE_DIRECTORY_ENTRY_COPYRIGHT equ 56 IMAGE_DIRECTORY_ENTRY_GLOBALPTR equ 64 IMAGE_DIRECTORY_ENTRY_TLS equ 72 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG equ 80 IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG equ 88 IMAGE_DIRECTORY_ENTRY_IAT equ 96 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT equ 104 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORTc equ 112 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR equ 120 struc IMAGE_DATA_DIRECTORY { .VirtualAddress dd ? .Size dd ? } struc IMAGE_FILE_HEADER { .Machine dw ? .NumberOfSections dw ? .TimeDateStamp dd ? .PointerToSymbolTable dd ? .NumberOfSymbols dd ? .SizeOfOptionalHeader dw ? .Characteristics dw ? } struc IMAGE_OPTIONAL_HEADER { .Magic dw ?; .MajorLinkerVersion db ?; .MinorLinkerVersion db ?; .SizeOfCode dd ?; .SizeOfInitializedData dd ?; .SizeOfUninitializedData dd ?; .AddressOfEntryPoint dd ?; .BaseOfCode dd ?; .BaseOfData dd ?; .ImageBase dd ?; .SectionAlignment dd ?; .FileAlignment dd ?; .MajorOperatingSystemVersion dw ?; .MinorOperatingSystemVersion dw ?; .MajorImageVersion dw ?; .MinorImageVersion dw ?; .MajorSubsystemVersion dw ?; .MinorSubsystemVersion dw ?; .Win32VersionValue dd ?; .SizeOfImage dd ?; .SizeOfHeaders dd ?; .CheckSum dd ?; .Subsystem dw ?; .DllCharacteristics dw ?; .SizeOfStackReserve dd ?; .SizeOfStackCommit dd ?; .SizeOfHeapReserve dd ?; .SizeOfHeapCommit dd ?; .LoaderFlags dd ?; .NumberOfRvaAndSizes dd ?; .DataDirectory IMAGE_DATA_DIRECTORY ; DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; } struc IMAGE_NT_HEADERS { .Signature dd ? .FileHeader IMAGE_FILE_HEADER .OptionalHeader IMAGE_OPTIONAL_HEADER } struc IMAGE_THUNK_DATA { .Function dd ? } struc IMAGE_IMPORT_DESCRIPTOR { .OriginalFirstThunk IMAGE_THUNK_DATA .TimeDateStamp dd ? .ForwarderChain dd ? .Name dd ? .FirstThunk IMAGE_THUNK_DATA } struc IMAGE_SECTION_HEADER { .Name dd ? ; Name[IMAGE_SIZEOF_SHORT_NAME] 1 ellement size 1 byte .PhysicalAddress_or_VirtualSize dd ?; .VirtualAddress dd ?; .SizeOfRawData dd ?; .PointerToRawData dd ?; .PointerToRelocations dd ?; .PointerToLinenumbers dd ?; .NumberOfRelocations dw ?; .NumberOfLinenumbers dw ?; .Characteristics dd ?; };