WORD   e_magic;                     // Magic number
    WORD   e_cblp;                      // Bytes on last page of file
    WORD   e_cp;                        // Pages in file
    WORD   e_crlc;                      // Relocations
    WORD   e_cparhdr;                   // Size of header in paragraphs
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
    WORD   e_ss;                        // Initial (relative) SS value
    WORD   e_sp;                        // Initial SP value
    WORD   e_csum;                      // Checksum
    WORD   e_ip;                        // Initial IP value
    WORD   e_cs;                        // Initial (relative) CS value
    WORD   e_lfarlc;                    // File address of relocation table
    WORD   e_ovno;                      // Overlay number
    WORD   e_res[4];                    // Reserved words
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
    WORD   e_res2[10];                  // Reserved words
    LONG   e_lfanew;                    // File address of new exe header
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

    WORD    Machine;
    WORD    NumberOfSections;
    DWORD   TimeDateStamp;
    DWORD   PointerToSymbolTable;
    DWORD   NumberOfSymbols;
    WORD    SizeOfOptionalHeader;
    WORD    Characteristics;

} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

define IMAGE_NT_SIGNATURE 0x00004550 // PE00 define IMAGE_FILE_MACHINE_I386 0x014c // Intel 386. define IMAGE_FILE_MACHINE_IA64 0x0200 // Intel 64 define IMAGE_FILE_MACHINE_ALPHA64 0x0284 // ALPHA64 define IMAGE_FILE_MACHINE_AMD64 0x8664 // AMD64 (K8) define IMAGE_SIZEOF_FILE_HEADER 20

    union {
        DWORD   Characteristics;            // 0 for terminating null import descriptor
        DWORD   OriginalFirstThunk;         // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
    };
    DWORD   TimeDateStamp;                  // 0 if not bound,
                                            // -1 if bound, and real date\time stamp
                                            //     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
                                            // O.W. date/time stamp of DLL bound to (Old BIND)

    DWORD   ForwarderChain;                 // -1 if no forwarders
    DWORD   Name;
    DWORD   FirstThunk;                     // RVA to IAT (if bound this IAT has actual addresses)

} IMAGE_IMPORT_DESCRIPTOR;

    DWORD   Characteristics;
    DWORD   TimeDateStamp;
    WORD    MajorVersion;
    WORD    MinorVersion;
    DWORD   Name;
    DWORD   Base;
    DWORD   NumberOfFunctions;
    DWORD   NumberOfNames;
    DWORD   AddressOfFunctions;     // RVA from base of image
    DWORD   AddressOfNames;         // RVA from base of image
    DWORD   AddressOfNameOrdinals;  // RVA from base of image

} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

    DWORD   VirtualAddress;
    DWORD   Size;

} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;

    //
    // Standard fields.
    //

    WORD    Magic;
    BYTE    MajorLinkerVersion;
    BYTE    MinorLinkerVersion;
    DWORD   SizeOfCode;
    DWORD   SizeOfInitializedData;
    DWORD   SizeOfUninitializedData;
    DWORD   AddressOfEntryPoint;
    DWORD   BaseOfCode;
    DWORD   BaseOfData;

    //
    // NT additional fields.
    //

    DWORD   ImageBase;
    DWORD   SectionAlignment;
    DWORD   FileAlignment;
    WORD    MajorOperatingSystemVersion;
    WORD    MinorOperatingSystemVersion;
    WORD    MajorImageVersion;
    WORD    MinorImageVersion;
    WORD    MajorSubsystemVersion;
    WORD    MinorSubsystemVersion;
    DWORD   Win32VersionValue;
    DWORD   SizeOfImage;
    DWORD   SizeOfHeaders;
    DWORD   CheckSum;
    WORD    Subsystem;
    WORD    DllCharacteristics;
    DWORD   SizeOfStackReserve;
    DWORD   SizeOfStackCommit;
    DWORD   SizeOfHeapReserve;
    DWORD   SizeOfHeapCommit;
    DWORD   LoaderFlags;
    DWORD   NumberOfRvaAndSizes;
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];

} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;

define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b define IMAGE_SIZEOF_NT_OPTIONAL32_HEADER 224

      USHORT      Magic;
      UCHAR       MajorLinkerVersion;
      UCHAR       MinorLinkerVersion;
      ULONG       SizeOfCode;
      ULONG       SizeOfInitializedData;
      ULONG       SizeOfUninitializedData;
      ULONG       AddressOfEntryPoint;
      ULONG       BaseOfCode;
      ULONGLONG   ImageBase;
      ULONG       SectionAlignment;
      ULONG       FileAlignment;
      USHORT      MajorOperatingSystemVersion;
      USHORT      MinorOperatingSystemVersion;
      USHORT      MajorImageVersion;
      USHORT      MinorImageVersion;
      USHORT      MajorSubsystemVersion;
      USHORT      MinorSubsystemVersion;
      ULONG       Win32VersionValue;
      ULONG       SizeOfImage;
      ULONG       SizeOfHeaders;
      ULONG       CheckSum;
      USHORT      Subsystem;
      USHORT      DllCharacteristics;
      ULONGLONG   SizeOfStackReserve;
      ULONGLONG   SizeOfStackCommit;
      ULONGLONG   SizeOfHeapReserve;
      ULONGLONG   SizeOfHeapCommit;
      ULONG       LoaderFlags;
      ULONG       NumberOfRvaAndSizes;
      IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];

} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;

define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b define IMAGE_SIZEOF_NT_OPTIONAL64_HEADER 240

    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
    union {
            DWORD   PhysicalAddress;
            DWORD   VirtualSize;
    } Misc;
    DWORD   VirtualAddress;
    DWORD   SizeOfRawData;
    DWORD   PointerToRawData;
    DWORD   PointerToRelocations;
    DWORD   PointerToLinenumbers;
    WORD    NumberOfRelocations;
    WORD    NumberOfLinenumbers;
    DWORD   Characteristics;

} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;

define IMAGE_SIZEOF_SECTION_HEADER 40

    DWORD   VirtualAddress;
    DWORD   SizeOfBlock;

// WORD TypeOffset[1]; } IMAGE_BASE_RELOCATION; typedef IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION;

define IMAGE_SIZEOF_BASE_RELOCATION 8

    DWORD   Size;
    DWORD   TimeDateStamp;
    WORD    MajorVersion;
    WORD    MinorVersion;
    DWORD   GlobalFlagsClear;
    DWORD   GlobalFlagsSet;
    DWORD   CriticalSectionDefaultTimeout;
    DWORD   DeCommitFreeBlockThreshold;
    DWORD   DeCommitTotalFreeThreshold;
    DWORD   LockPrefixTable;            // VA
    DWORD   MaximumAllocationSize;
    DWORD   VirtualMemoryThreshold;
    DWORD   ProcessHeapFlags;
    DWORD   ProcessAffinityMask;
    WORD    CSDVersion;
    WORD    Reserved1;
    DWORD   EditList;                   // VA
    DWORD   SecurityCookie;             // VA
    DWORD   SEHandlerTable;             // VA
    DWORD   SEHandlerCount;

} IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32;

      ULONG      Size;
      ULONG      TimeDateStamp;
      USHORT     MajorVersion;
      USHORT     MinorVersion;
      ULONG      GlobalFlagsClear;
      ULONG      GlobalFlagsSet;
      ULONG      CriticalSectionDefaultTimeout;
      ULONGLONG  DeCommitFreeBlockThreshold;
      ULONGLONG  DeCommitTotalFreeThreshold;
      ULONGLONG  LockPrefixTable;         // VA
      ULONGLONG  MaximumAllocationSize;
      ULONGLONG  VirtualMemoryThreshold;
      ULONGLONG  ProcessAffinityMask;
      ULONG      ProcessHeapFlags;
      USHORT     CSDVersion;
      USHORT     Reserved1;
      ULONGLONG  EditList;                // VA
      ULONGLONG  SecurityCookie;          // VA
      ULONGLONG  SEHandlerTable;          // VA
      ULONGLONG  SEHandlerCount;

} IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;

    DWORD BeginAddress;
    DWORD EndAddress;
    DWORD UnwindInfoAddress;

} _IMAGE_RUNTIME_FUNCTION_ENTRY, *_PIMAGE_RUNTIME_FUNCTION_ENTRY;