Exports: What a DLL Offers

DLLs export functions for other modules to import.

• The Export Directory (a DataDirectory entry) describes the EAT (Export Address Table).
• Functions can be exported by name or by ordinal (a small integer index).
• Parallel arrays link names to ordinals to RVAs of the code.

Why analysts look at exports:

• Malicious DLLs reveal their interface (e.g. ServiceMain, a single cryptic export, or an export named to match a hijack target).
• Ordinal-only exports hide intent — no readable names.
• DLL side-loading abuse: a malicious DLL mimics the exports of a legitimate one so a trusted EXE loads it.