RAW file offset to RVA convertion (4gb max)

Calculates aligned raw section size

Returns basic .NET information If image is not native, throws an exception

Returns starting address of function, affected by exception unwinding

Returns checksum of PE file from header

Returns company name

Returns critical section default timeout

Returns debug information list

Get the size of the minimum block that must be freed before it is freed (de-committed), in bytes

Returns the size of the minimum total memory that must be freed in the process heap before it is freed (de-committed), in bytes

Returns ending address of function, affected by exception unwinding

Returns entry point RVA (if entry point is native) Returns entry point managed token (if entry point is managed)

Returns exception directory data (exists on PE+ only) Unwind opcodes are not listed, because their format and list are subject to change

Helper export functions Returns pair: <ordinal base for supplied functions; maximum ordinal value for supplied functions>

Returns file date least significant DWORD

Returns file date most significant DWORD

Returns file description

Retuens file flags (raw DWORD)

Returns file subtype (usually non-zero for drivers and fonts)

Returns file version

Returns file version least significant DWORD

Returns file version most significant DWORD

Number of the nonvolatile register used as the frame pointer, using the same encoding for the operation info field of UNWIND_CODE nodes

Returns clear global flags

Returns set global flags

Returns heap size commit for PE32

Returns heap size reserve for PE32

Returns symbol index

Returns internal file name

Returns relocation item (rrva + type)

Returns legal copyright

Returns virtual address of the first line-number entry

Returns virtual address of the first symbol

Returns Machine field value of PE file from header

Returns magic value

Returns required operation system version (major word)

Returns major runtime version

Returns required subsystem version (major word)

Returns the maximum allocation size, in bytes

Returns required operation system version (minor word)

Returns minor runtime version

Returns required subsystem version (minor word)

Returns bound references cound

Who knows, what these fields mean...

Returns number of line-number entries

Returns number of symbols

Returns number of unwind slots

Returns PE headers start position (e_lfanew)

Returns pointer to raw section data in PE file

Returns process affinity mask

Returns process heap flags

Returns product name

Returns product version

Returns product version least significant DWORD

Returns product version most significant DWORD

Returns resource count by type

Returns MSVC rich data

Returns RVA of function

Returns RVA of function address table

Returns RVA of metadata (symbol table and startup information)

Returns RVA of name ordinals table

Returns RVA of function name address table

Returns RVA of debug info when mapped to memory or zero, if info is not mapped

Returns RVA of managed resources

Returns relative virtual address of the first byte of code

Returns relative virtual address of the first byte of data

Returns relative virtual address of the last byte of code

Returns relative virtual address of the last byte of data

The scaled offset from RSP that is applied to the FP reg when it is established. The actual FP reg is set to RSP + 16 * this number, allowing offsets

Returns the count of unique handlers in the table

Returns section number

Returns service pack version (CSDVersion)

Returns size of metadata (symbol table and startup information)

Returns size of optional header

Returns size of function prolog

Returns size of managed resources

Returns sizeof() nt headers

Returns stack size commit for PE32

Returns stack size reserve for PE32

Returns storage class

Returns string table data by ID and language

Returns timestamp of PE file from header

Returns bound import date and time stamp

Returns list of translations in string representation

Returns type of relocation

Returns unwind info address