format pe gui 4.0

include 'win32ax.inc'

entry main

section '.txt' code readable executable writeable

struct DATA
       va   dd ?
       size dd ?
ends

struct IMAGE_IMPORT_DESCRIPTOR
    union
        Characteristics    dd ?            ; 0 for terminating null import descriptor
        OriginalFirstThunk dd ?         ; RVA to original unbound IAT (PIMAGE_THUNK_DATA)
    ends
       TimeDateStamp       dd ?           ; 0 if not bound,
                                            ; -1 if bound, and real date\time stamp
                                            ;     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
                                            ; O.W. date/time stamp of DLL bound to (Old BIND)

    ForwarderChain dd ?                ; -1 if no forwarders
    Name           dd ?
    FirstThunk     dd ?                ; RVA to IAT (if bound this IAT has actual addresses)
 ends


_t db 255 dup(0),0

dataDir DATA
id      IMAGE_IMPORT_DESCRIPTOR

proc main
     pushad

       push dword[00400100h]
       pop  dword[dataDir+0*4] ; Address

       push dword[00400104h]
       pop  dword[dataDir+1*4] ; Size

       cinvoke wsprintf,_t,'virtual size: 0x%p, virtual address: 0x%p',[dataDir.size],[dataDir.va]
       invoke MessageBox,0,_t,'My Optional Section--Import Table',MB_OK
       ;;;How can I read the location of the names, relative to the address 00400000h ?
      popad

     ret
endp

section '.idata' import data readable

library user32,'user32.dll',kernel32,'kernel32.dll'

include 'api/user32.inc'
include 'api/kernel32.inc'
    

     mov edx,[peh]
     mov ebx,[edx+0x80]
     add ebx,[nBase]
     virtual at ebx
     iides IMAGE_IMPORT_DESCRIPTOR
     end virtual
fill:
     mov esi,[iides.Name_]
     add esi,[nBase]
     invoke LoadLibrary,esi
     mov [DllHandle],eax
     mov edx,[iides.OriginalFirstThunk]
     add edx,[nBase]
     xor eax,eax
findapi:
     mov ecx,[edx]
     test ecx,ecx
     jz @f
     mov esi,[edx]
     add esi,2
     add esi,[nBase]
     push edx
     push eax
     invoke GetProcAddress,[DllHandle],esi
     mov [apiaddr],eax
     pop eax
     pop edx
     mov ecx,[iides.FirstThunk]
     add ecx,[nBase]
     mov edi,[apiaddr]
     mov [ecx+eax*4],edi
     add edx,4
     inc eax
     jmp findapi