+000 WORD e_magic;
+002 WORD e_cblp;
+004 WORD e_cp;
+006 WORD e_crlc;
+008 WORD e_cparhdr;
+00A WORD e_minalloc;
+00C WORD e_maxalloc;
+00E WORD e_ss;
+010 WORD e_sp;
+012 WORD e_csum;
+014 WORD e_ip;
+016 WORD e_cs;
+018 WORD e_lfarlc;
+01A WORD e_ovno;
+01C WORD e_res[4];
+024 WORD e_oemid;
+026 WORD e_oeminfo;
+028 WORD e_res2[10];
+03C LONG e_lfanew;
IMAGE_NT_HEADERS
e_lfanew+000 DWORD Signature;
IMAGE_FILE_HEADER
e_lfanew+004 WORD Machine;
e_lfanew+006 WORD NumberOfSections;
e_lfanew+008 DWORD TimeDateStamp;
e_lfanew+00C DWORD PointerToSymbolTable;
e_lfanew+010 DWORD NumberOfSymbols;
e_lfanew+014 WORD SizeOfOptionalHeader;
e_lfanew+016 WORD Characteristics;
IMAGE_OPTIONAL_HEADER
e_lfanew+018 WORD Magic;
e_lfanew+01A BYTE MajorLinkerVersion;
e_lfanew+01B BYTE MinorLinkerVersion;
e_lfanew+01C DWORD SizeOfCode;
e_lfanew+020 DWORD SizeOfInitializedData;
e_lfanew+024 DWORD SizeOfUninitializedData;
e_lfanew+028 DWORD AddressOfEntryPoint;
e_lfanew+02C DWORD BaseOfCode;
e_lfanew+030 DWORD BaseOfData;
e_lfanew+034 DWORD ImageBase;
e_lfanew+038 DWORD SectionAlignment;
e_lfanew+03C DWORD FileAlignment;
e_lfanew+040 WORD MajorOperatingSystemVersion;
e_lfanew+042 WORD MinorOperatingSystemVersion;
e_lfanew+044 WORD MajorImageVersion;
e_lfanew+046 WORD MinorImageVersion;
e_lfanew+048 WORD MajorSubsystemVersion;
e_lfanew+04A WORD MinorSubsystemVersion;
e_lfanew+04C DWORD Win32VersionValue;
e_lfanew+050 DWORD SizeOfImage;
e_lfanew+054 DWORD SizeOfHeaders;
e_lfanew+058 DWORD CheckSum;
e_lfanew+05C WORD Subsystem;
e_lfanew+05E WORD DllCharacteristics;
e_lfanew+060 DWORD SizeOfStackReserve;
e_lfanew+064 DWORD SizeOfStackCommit;
e_lfanew+068 DWORD SizeOfHeapReserve;
e_lfanew+06C DWORD SizeOfHeapCommit;
e_lfanew+070 DWORD LoaderFlags;
e_lfanew+074 DWORD NumberOfRvaAndSizes;
