During RCE of a piece of code, I have found this:
loc_40244F: mov eax, [ebx+20h] add ebx, 14h test eax, eax jnz loc_402397
What I know is that ebx points to the import directory structure of the considered PE file.
But when I look at it, I see the following:
Import Directory +0 DWORD OriginalFirstThunk; 4 DWORD TimeDateStamp; 8 DWORD ForwarderChain; c DWORD Name; 10 DWORD FirstThunk;
So, to which location is the [ebx+20h] expression pointing ? I hope somebody can help me.