Other Directories Worth Knowing

The DataDirectory[] array points at several tables:

• Resources (.rsrc): icons, dialogs, version info, and often embedded payloads hidden as a "bitmap" or blob.
• TLS (Thread Local Storage): can register TLS callbacks — functions that run before the entry point. A classic anti-debug / early-execution trick.
• Base Relocations (.reloc): fixups applied if the image cannot load at its preferred ImageBase (needed for ASLR).
• Debug: may contain a PDB path — sometimes leaks the author's build folder / project name.
• Security (Digital Signature): an Authenticode signature. Check who signed it and whether it validates.

Watch out

Because TLS callbacks execute before main, a debugger that breaks

only at the entry point can miss malicious setup code entirely.