don't use _failsafe_ winmain orig

    #define STRICT
    #define WIN32_LEAN_AND_MEAN
    #include <Windows.h>
    #include <winternl.h>
    #include <CommCtrl.h>
    #include <commdlg.h>
    #include <string>
    #include <strsafe.h>
    #include <sstream>
    #include <iomanip>
    #include <stdio.h>
    #include <vector>
    #include <shellapi.h>
    //#include "helpers.h"
    #include "resource.h"
    #pragma comment(lib, "comctl32.lib")

    //bool Is64BitPE(PIMAGE_NT_HEADERS pNtHeaders);

    namespace PEHelpers {
        // Add these new helper functions
        bool Is64BitPE(PIMAGE_NT_HEADERS pNtHeaders) {
            return pNtHeaders->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC;
        }

        DWORD_PTR GetImageBase(PIMAGE_NT_HEADERS pNtHeaders) {
            if (PEHelpers::Is64BitPE(pNtHeaders)) {
                auto pNtHeaders64 = reinterpret_cast<PIMAGE_NT_HEADERS64>(pNtHeaders);
                return static_cast<DWORD_PTR>(pNtHeaders64->OptionalHeader.ImageBase);
            }
            else {
                auto pNtHeaders32 = reinterpret_cast<PIMAGE_NT_HEADERS32>(pNtHeaders);
                return static_cast<DWORD_PTR>(pNtHeaders32->OptionalHeader.ImageBase);
            }
        }

        DWORD GetSizeOfImage(PIMAGE_NT_HEADERS pNtHeaders) {
            if (PEHelpers::Is64BitPE(pNtHeaders)) {
                auto pNtHeaders64 = reinterpret_cast<PIMAGE_NT_HEADERS64>(pNtHeaders);
                return pNtHeaders64->OptionalHeader.SizeOfImage;
            }
            else {
                auto pNtHeaders32 = reinterpret_cast<PIMAGE_NT_HEADERS32>(pNtHeaders);
                return pNtHeaders32->OptionalHeader.SizeOfImage;
            }
        }

        bool ValidateFileSize(DWORD expectedSize, DWORD fileSize) {
            // Validate against SizeOfHeaders instead of SizeOfImage
            return expectedSize > 0 && expectedSize <= fileSize;
        }
        //}

            // Replace the existing GetRvaPtr function in PEHelpers namespace with this:
        DWORD_PTR GetRvaPtr(DWORD rva, PIMAGE_SECTION_HEADER pSectionHeader, WORD numberOfSections, LPVOID baseAddress) {
            for (WORD i = 0; i < numberOfSections; i++) {
                if (rva >= pSectionHeader[i].VirtualAddress &&
                    rva < (pSectionHeader[i].VirtualAddress + pSectionHeader[i].SizeOfRawData)) {
                    DWORD_PTR delta = (DWORD_PTR)baseAddress + pSectionHeader[i].PointerToRawData;
                    return delta + (rva - pSectionHeader[i].VirtualAddress);
                }
            }
            return 0;
        }

        // Add to PEHelpers namespace:
        bool IsRvaValid(DWORD rva, DWORD fileSize, PIMAGE_NT_HEADERS pNtHeaders) {
            return rva < pNtHeaders->OptionalHeader.SizeOfImage&& rva < fileSize;
        }

        // Add this new helper function in PEHelpers namespace:
        PIMAGE_SECTION_HEADER GetEnclosingSectionHeader(DWORD rva, PIMAGE_SECTION_HEADER pSectionHeader, WORD numberOfSections) {
            for (WORD i = 0; i < numberOfSections; i++) {
                if ((rva >= pSectionHeader[i].VirtualAddress) &&
                    (rva < (pSectionHeader[i].VirtualAddress + pSectionHeader[i].SizeOfRawData))) {
                    return &pSectionHeader[i];
                }
            }
            return nullptr;
        }

        std::wstring GetImageCharacteristics(DWORD characteristics) {
            if (characteristics & IMAGE_FILE_DLL) return L"(DLL)";
            if (characteristics & IMAGE_FILE_SYSTEM) return L"(DRIVER)";
            if (characteristics & IMAGE_FILE_EXECUTABLE_IMAGE) return L"(EXE)";
            return L"(UNKNOWN)";
        }

        std::wstring GetSubsystem(WORD subsystem) {
            switch (subsystem) {
            case IMAGE_SUBSYSTEM_NATIVE: return L"(NATIVE/DRIVER)";
            case IMAGE_SUBSYSTEM_WINDOWS_GUI: return L"(GUI)";
            case IMAGE_SUBSYSTEM_WINDOWS_CUI: return L"(CONSOLE)";
            default: return L"(UNKNOWN)";
            }
        }

        std::wstring GetDataDirectoryName(int DirectoryNumber) {
            switch (DirectoryNumber) {
            case 0: return L"Export Table";
            case 1: return L"Import Table";
            case 2: return L"Resource Table";
            case 3: return L"Exception Entry";
            case 4: return L"Security Entry";
            case 5: return L"Relocation Table";
            case 6: return L"Debug Entry";
            case 7: return L"Copyright Entry";
            case 8: return L"Global PTR Entry";
            case 9: return L"TLS Entry";
            case 10: return L"Configuration Entry";
            case 11: return L"Bound Import Entry";
            case 12: return L"IAT";
            case 13: return L"Delay Import Descriptor";
            case 14: return L"COM Descriptor";
            default: return L"Unknown";
            }
        }

        std::wstring GetSectionProtection(DWORD characteristics) {
            std::wstring protection = L"(";
            bool needsSeparator = false;

            if (characteristics & IMAGE_SCN_MEM_EXECUTE) {
                protection += L"EXECUTE";
                needsSeparator = true;
            }

            if (characteristics & IMAGE_SCN_MEM_READ) {
                if (needsSeparator) protection += L" | ";
                protection += L"READ";
                needsSeparator = true;
            }

            if (characteristics & IMAGE_SCN_MEM_WRITE) {
                if (needsSeparator) protection += L" | ";
                protection += L"WRITE";
            }

            protection += L")";
            return protection;
        }

        PIMAGE_SECTION_HEADER GetExportSection(const PIMAGE_SECTION_HEADER pImageSectionHeader,
            const int NumberOfSections,
            const DWORD_PTR dExportAddress) {
            for (int i = 0; i < NumberOfSections; ++i) {
                const auto pCurrentSectionHeader =
                    (PIMAGE_SECTION_HEADER)((DWORD_PTR)pImageSectionHeader + i * sizeof(IMAGE_SECTION_HEADER));

                if (dExportAddress >= pCurrentSectionHeader->VirtualAddress &&
                    dExportAddress < pCurrentSectionHeader->VirtualAddress + pCurrentSectionHeader->Misc.VirtualSize)
                    return pCurrentSectionHeader;
            }
            return nullptr;
        }

        DWORD RvaToOffset(DWORD rva, PIMAGE_SECTION_HEADER pSectionHeader, WORD numberOfSections) {
            for (WORD i = 0; i < numberOfSections; i++) {
                if (rva >= pSectionHeader[i].VirtualAddress &&
                    rva < (pSectionHeader[i].VirtualAddress + pSectionHeader[i].SizeOfRawData)) {
                    return (rva - pSectionHeader[i].VirtualAddress) + pSectionHeader[i].PointerToRawData;
                }
            }
            return 0;
        }
    }

    namespace PEParser {
        using namespace std;
        struct PEAnalyzer {
            LPVOID lpFileContent;
            DWORD fileSize;
            bool is64Bit;
            PIMAGE_NT_HEADERS32 pNtHeaders32;
            PIMAGE_NT_HEADERS64 pNtHeaders64;
            PIMAGE_DOS_HEADER pDosHeader;

            PEAnalyzer() :
                lpFileContent(nullptr),
                fileSize(0),
                is64Bit(false),
                pNtHeaders32(nullptr),
                pNtHeaders64(nullptr),
                pDosHeader(nullptr) {}

            ~PEAnalyzer() {
                if (lpFileContent) {
                    UnmapViewOfFile(lpFileContent);
                    lpFileContent = nullptr;
                }
            }
        };

        // At the top of your file, change the window class name to wide string
    #define WINDOW_CLASS_NAME L"PEAnalyzerWindow"
    //const wchar_t* const WINDOW_CLASS_NAME = L"PEAnalyzerWindow";

    // Use ANSI versions explicitly
    //#undef CreateWindow
    //#undef CreateWindowEx
    //#define CreateWindow  CreateWindowW
    //#define CreateWindowEx CreateWindowExW

    // Helper function to replace printf with GUI output
    #define OUTPUT(format, ...) AppendToOutput(L##format, ##__VA_ARGS__)
    //#define OUTPUT(format, ...) AppendToOutput(format, ##__VA_ARGS__)
    //#define printf(format, ...) AppendToOutput(format, ##__VA_ARGS__)

    // Window dimensions
    #define WINDOW_WIDTH    1024
    #define WINDOW_HEIGHT   768
    #define EDIT_MARGIN    10

    // Global variables
        HWND g_hMainWindow = NULL;
        HWND g_hEditControl = NULL;
        HFONT g_hFont = NULL;
        std::wstringstream g_OutputText;
        WCHAR filePathW[MAX_PATH];
        std::vector<wchar_t> g_OutputBuffer;
        std::wstring tempBuffer; // Declare tempBuffer globally
        HWND g_hStatusBar = NULL;
        HWND g_hProgressBar = NULL;  // Add this with your other global variables
        //int virtualHeight = 100;  // Initialize with an appropriate value

        // Function declarations
        LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam);
        LRESULT CALLBACK EditSubclassProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam, UINT_PTR uIdSubclass, DWORD_PTR dwRefData);
        void CreateMainWindow(HINSTANCE hInstance);
        void InitializeControls(HWND hwnd);
        void AddMenus(HWND hwnd);
        void OpenFileDialog(HWND hwnd);
        //void AnalyzePEFile(const WCHAR* filePathW);
        void AnalyzePEFile(const wchar_t* filePathW);
        HANDLE GetFileContent(const wchar_t* lpFilePath);
        /*void GetDataDirectories(PIMAGE_DATA_DIRECTORY pImageDataDirectory);
        PIMAGE_SECTION_HEADER GetSections(const PIMAGE_SECTION_HEADER pImageSectionHeader,
            int NumberOfSections, DWORD dImportAddress);
        void GetImports32(PIMAGE_IMPORT_DESCRIPTOR pImageImportDescriptor,
            DWORD dRawOffset, const PIMAGE_SECTION_HEADER pImageImportSection);
        void GetImports64(PIMAGE_IMPORT_DESCRIPTOR pImageImportDescriptor,
            DWORD dRawOffset, const PIMAGE_SECTION_HEADER pImageImportSection);*/
        void AppendToOutput(const wchar_t* format, ...);
        //newfunctionshere (lateest fixes)
        void ParseSections(const PEAnalyzer& analyzer); //forwarddeclare parse+ bring namespace up
        void ParseImportDirectory(const PEAnalyzer& analyzer);
        void ParseExportDirectory(const PEAnalyzer& analyzer);
        void ParseResourceDirectory(const PEAnalyzer& analyzer);
        void ParseDebugDirectory(const PEAnalyzer& analyzer);
        void SetStatusText(const wchar_t* text);
        void ShowProgress(int percentage);
        void UpdateEditControl();
        bool InitializePEAnalyzer(PEAnalyzer& analyzer, const wchar_t* filePath);
        DWORD GetFileSizeCustom(const wchar_t* filePath);

        void ProcessResourceDirectory32(
            PIMAGE_RESOURCE_DIRECTORY resDir,
            int level,
            const wchar_t* type,
            PIMAGE_RESOURCE_DIRECTORY baseResourceDir,
            const wchar_t* resourceTypes[],
            const PEAnalyzer& analyzer);

        void ProcessResourceDirectory64(
            PIMAGE_RESOURCE_DIRECTORY resDir,
            int level,
            const wchar_t* type,
            PIMAGE_RESOURCE_DIRECTORY baseResourceDir,
            const wchar_t* resourceTypes[],
            const PEAnalyzer& analyzer);

        // Main window class name
        //const char* const WINDOW_CLASS_NAME = "PEAnalyzerWindow";

        //new inserted here >>


















        //here

























        int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {
            INITCOMMONCONTROLSEX icc = { sizeof(INITCOMMONCONTROLSEX), ICC_WIN95_CLASSES };
            InitCommonControlsEx(&icc);

            // Get command line parameters in Unicode
            int argc;
            LPWSTR* argv = CommandLineToArgvW(GetCommandLineW(), &argc);

            CreateMainWindow(hInstance);
            if (!g_hMainWindow) {
                LocalFree(argv);
                return -1;
            }

            ShowWindow(g_hMainWindow, nCmdShow);
            UpdateWindow(g_hMainWindow);

            // If there's a command line parameter, process it
            if (argc > 1) {
                // Process the first parameter as file path
                SetWindowTextW(g_hEditControl, L"");
                g_OutputText.str(L"");
                g_OutputText.clear();
                AnalyzePEFile(argv[1]);
                UpdateEditControl();
            }

            LocalFree(argv);

            MSG msg = {};
            while (GetMessage(&msg, NULL, 0, 0)) {
                TranslateMessage(&msg);
                DispatchMessage(&msg);
            }

            if (g_hFont) DeleteObject(g_hFont);
            return (int)msg.wParam;
        }

        void CreateMainWindow(HINSTANCE hInstance) {
            WNDCLASSEXW wc = { sizeof(WNDCLASSEXW), 0, WindowProc, 0, 0, hInstance,
                LoadIcon(hInstance, MAKEINTRESOURCE(IDI_ICON1)),
                LoadCursor(NULL, IDC_ARROW),
                (HBRUSH)(COLOR_WINDOW + 1),
                NULL, WINDOW_CLASS_NAME,
                LoadIcon(hInstance, MAKEINTRESOURCE(IDI_ICON1)) };
            RegisterClassExW(&wc);

            // Get screen dimensions
            int screenWidth = GetSystemMetrics(SM_CXSCREEN);
            int screenHeight = GetSystemMetrics(SM_CYSCREEN);

            // Calculate center position
            int windowX = (screenWidth - WINDOW_WIDTH) / 2;
            int windowY = (screenHeight - WINDOW_HEIGHT) / 2;

            // Remove WS_MAXIMIZEBOX and WS_THICKFRAME from the window style
            DWORD style = (WS_OVERLAPPEDWINDOW & ~WS_MAXIMIZEBOX) & ~WS_THICKFRAME;
            //WS_OVERLAPPEDWINDOW ~~> style
            g_hMainWindow = CreateWindowExW(0, WINDOW_CLASS_NAME, L"PE File Analyzer",
                style, windowX, windowY, WINDOW_WIDTH, WINDOW_HEIGHT,
                nullptr, nullptr, hInstance, nullptr);
        }

        void InitializeControls(HWND hwnd) {
            // Create status bar
            g_hStatusBar = CreateWindowEx(0, STATUSCLASSNAME, NULL,
                WS_CHILD | WS_VISIBLE,
                0, 0, 0, 0, hwnd, NULL,
                (HINSTANCE)GetWindowLongPtr(hwnd, GWLP_HINSTANCE), NULL);

            // Set up status bar parts
            RECT rcClient;
            GetClientRect(hwnd, &rcClient);
            int statusParts[2] = { 150, rcClient.right };
            SendMessage(g_hStatusBar, SB_SETPARTS, 2, (LPARAM)statusParts);

            // Create progress bar in the second part of status bar
            RECT rcPart;
            SendMessage(g_hStatusBar, SB_GETRECT, 1, (LPARAM)&rcPart);

            g_hProgressBar = CreateWindowEx(0, PROGRESS_CLASS, NULL,
                WS_CHILD | WS_VISIBLE | PBS_SMOOTH,
                rcPart.left + 5, rcPart.top + 2,
                rcPart.right - rcPart.left - 10, rcPart.bottom - rcPart.top - 4,
                g_hStatusBar, NULL,
                (HINSTANCE)GetWindowLongPtr(hwnd, GWLP_HINSTANCE), NULL);

            // Set blue color and range
            SendMessage(g_hProgressBar, PBM_SETBARCOLOR, 0, (LPARAM)RGB(0, 120, 215));  // Windows 10 blue
            SendMessage(g_hProgressBar, PBM_SETRANGE, 0, MAKELPARAM(0, 100));
            SendMessage(g_hProgressBar, PBM_SETSTEP, 1, 0);

            // Get status bar height for edit control positioning
            RECT rcStatus;
            GetWindowRect(g_hStatusBar, &rcStatus);
            int statusHeight = rcStatus.bottom - rcStatus.top;

            // Create edit control
            g_hEditControl = CreateWindowExW(WS_EX_CLIENTEDGE, L"EDIT", L"",
                WS_CHILD | WS_VISIBLE | WS_VSCROLL | WS_HSCROLL |
                ES_MULTILINE | ES_AUTOVSCROLL | ES_AUTOHSCROLL,
                EDIT_MARGIN, EDIT_MARGIN,
                rcClient.right - (2 * EDIT_MARGIN),
                rcClient.bottom - statusHeight - (2 * EDIT_MARGIN),
                hwnd, nullptr,
                (HINSTANCE)GetWindowLongPtr(hwnd, GWLP_HINSTANCE), nullptr);

            // Create and set font
            g_hFont = CreateFont(-14, 0, 0, 0, FW_NORMAL, FALSE, FALSE, 0,
                ANSI_CHARSET, OUT_DEFAULT_PRECIS, CLIP_DEFAULT_PRECIS,
                DEFAULT_QUALITY, DEFAULT_PITCH | FF_MODERN, L"Consolas");

            if (g_hFont)
                SendMessage(g_hEditControl, WM_SETFONT, (WPARAM)g_hFont, TRUE);

            SetWindowSubclass(g_hEditControl, EditSubclassProc, 0, 0);
        }

        void AddMenus(HWND hwnd) {
            HMENU hMenuBar = CreateMenu();
            HMENU hFileMenu = CreateMenu();
            AppendMenu(hMenuBar, MF_POPUP, (UINT_PTR)hFileMenu, L"&File");
            AppendMenu(hFileMenu, MF_STRING, 1, L"&Open\tCtrl+O");  // Updated to show shortcut
            AppendMenu(hFileMenu, MF_STRING, 2, L"E&xit");
            SetMenu(hwnd, hMenuBar);
        }


        // First, add this helper function to determine if the PE file is 64-bit
        bool Is64BitPE(PIMAGE_NT_HEADERS pNtHeaders) {
            return pNtHeaders->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC;
        }

        // Helper function to safely get file size
        DWORD GetFileSizeCustom(const wchar_t* filePath) {
            HANDLE hFile = CreateFileW(filePath, GENERIC_READ, FILE_SHARE_READ,
                nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);

            if (hFile == INVALID_HANDLE_VALUE) {
                return 0;
            }

            DWORD fileSize = ::GetFileSize(hFile, nullptr);
            CloseHandle(hFile);
            return fileSize;
        }

        // Add this helper function
        void SafeOutput(const std::wstring& text) {
            try {
                g_OutputText << text;
                UpdateEditControl();
            }
            catch (...) {
                SetStatusText(L"Error writing output");
            }
        }

        void UpdateStatusBar(const wchar_t* text, int progress = -1) {
            if (text) {
                SetStatusText(text);
            }
            if (progress >= 0) {
                ShowProgress(progress);
            }
        }

        void ClearProgress() {
            ShowWindow(g_hProgressBar, SW_HIDE);
            SetStatusText(L"Ready");
        }

        LRESULT CALLBACK EditSubclassProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam, UINT_PTR uIdSubclass, DWORD_PTR dwRefData) {
            if (uMsg == WM_KEYDOWN) {
                if ((GetKeyState(VK_CONTROL) & 0x8000) && wParam == 'O') {
                    SendMessage(GetParent(hwnd), WM_COMMAND, 1, 0);
                    return 0;
                }
                switch (wParam) {
                case VK_F1:
                    SendMessage(GetParent(hwnd), WM_KEYDOWN, VK_F1, 0);
                    return 0;
                case VK_ESCAPE:
                    SendMessage(GetParent(hwnd), WM_KEYDOWN, VK_ESCAPE, 0);
                    return 0;
                case VK_PRIOR:
                    // Scroll up
                    SendMessage(hwnd, WM_VSCROLL, MAKELONG(SB_PAGEUP, 0), 0);
                    return 0;
                case VK_NEXT:
                    // Scroll down
                    SendMessage(hwnd, WM_VSCROLL, MAKELONG(SB_PAGEDOWN, 0), 0);
                    return 0;
                case VK_UP:
                    // Scroll one line up
                    SendMessage(hwnd, WM_VSCROLL, MAKELONG(SB_LINEUP, 0), 0);
                    return 0;
                case VK_DOWN:
                    // Scroll one line down
                    SendMessage(hwnd, WM_VSCROLL, MAKELONG(SB_LINEDOWN, 0), 0);
                    return 0;
                }
            }
            if (uMsg == WM_MOUSEWHEEL) {
                int delta = GET_WHEEL_DELTA_WPARAM(wParam);
                if (delta > 0) {
                    // Scroll up
                    SendMessage(hwnd, WM_VSCROLL, MAKELONG(SB_PAGEUP, 0), 0);
                }
                else {
                    // Scroll down
                    SendMessage(hwnd, WM_VSCROLL, MAKELONG(SB_PAGEDOWN, 0), 0);
                }
                return 0;
            }
            return DefSubclassProc(hwnd, uMsg, wParam, lParam);
        }

        LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam) {
            switch (uMsg) {
            case WM_CREATE: InitializeControls(hwnd); AddMenus(hwnd); return 0;
            case WM_SIZE:
            {
                RECT rcClient;
                GetClientRect(hwnd, &rcClient);

                // Resize status bar
                SendMessage(g_hStatusBar, WM_SIZE, 0, 0);

                // Recalculate status bar parts
                int statusParts[2] = { 150, rcClient.right };
                SendMessage(g_hStatusBar, SB_SETPARTS, 2, (LPARAM)statusParts);

                // Reposition progress bar
                RECT rcPart;
                SendMessage(g_hStatusBar, SB_GETRECT, 1, (LPARAM)&rcPart);
                SetWindowPos(g_hProgressBar, NULL,
                    rcPart.left + 5, rcPart.top + 2,
                    rcPart.right - rcPart.left - 10, rcPart.bottom - rcPart.top - 4,
                    SWP_NOZORDER);

                // Get status bar height
                RECT rcStatus;
                GetWindowRect(g_hStatusBar, &rcStatus);
                int statusHeight = rcStatus.bottom - rcStatus.top;

                // Resize edit control
                SetWindowPos(g_hEditControl, NULL,
                    EDIT_MARGIN,
                    EDIT_MARGIN,
                    rcClient.right - (2 * EDIT_MARGIN),
                    rcClient.bottom - statusHeight - (2 * EDIT_MARGIN),
                    SWP_NOZORDER);
                return 0;
            }

            case WM_KEYDOWN:
            {
                if (GetKeyState(VK_CONTROL) & 0x8000) {
                    switch (wParam) {
                    case 'O':
                        OpenFileDialog(hwnd);
                        return 0;
                    }
                }
                switch (wParam) {
                case VK_F1:
                    MessageBoxW(hwnd,
                        L"PE Header Parser 4.3 GUI-based Programmed in C++ Win32 API (1546 lines of code) by Entisoft Software(c) Evans Thorpemorton",
                        L"About",
                        MB_OK | MB_ICONINFORMATION);
                    return 0;
                case VK_ESCAPE:
                    PostQuitMessage(0);
                    return 0;
                case VK_PRIOR:
                    // Scroll up
                    SendMessage(g_hEditControl, WM_VSCROLL, MAKELONG(SB_PAGEUP, 0), 0);
                    return 0;
                case VK_NEXT:
                    // Scroll down
                    SendMessage(g_hEditControl, WM_VSCROLL, MAKELONG(SB_PAGEDOWN, 0), 0);
                    return 0;
                case VK_UP:
                    // Scroll one line up
                    SendMessage(g_hEditControl, WM_VSCROLL, MAKELONG(SB_LINEUP, 0), 0);
                    return 0;
                case VK_DOWN:
                    // Scroll one line down
                    SendMessage(g_hEditControl, WM_VSCROLL, MAKELONG(SB_LINEDOWN, 0), 0);
                    return 0;
                }
                break;
            }
            case WM_MOUSEWHEEL:
            {
                int delta = GET_WHEEL_DELTA_WPARAM(wParam);
                if (delta > 0) {
                    // Scroll up
                    SendMessage(g_hEditControl, WM_VSCROLL, MAKELONG(SB_PAGEUP, 0), 0);
                }
                else {
                    // Scroll down
                    SendMessage(g_hEditControl, WM_VSCROLL, MAKELONG(SB_PAGEDOWN, 0), 0);
                }
                return 0;
            }
            case WM_COMMAND: if (LOWORD(wParam) == 1) OpenFileDialog(hwnd); if (LOWORD(wParam) == 2) PostQuitMessage(0); return 0;
            case WM_DESTROY:
                if (g_hStatusBar) DestroyWindow(g_hStatusBar);
                PostQuitMessage(0);
                return 0;
            }
            return DefWindowProc(hwnd, uMsg, wParam, lParam);
        }

        void SetStatusText(const wchar_t* text) {
            SendMessage(g_hStatusBar, SB_SETTEXT, 0, (LPARAM)text);
        }

        void ShowProgress(int percentage) {
            // Update progress bar
            SendMessage(g_hProgressBar, PBM_SETPOS, (WPARAM)percentage, 0);

            // Update status text in first part
            wchar_t status[256];
            swprintf_s(status, L"Analyzing... %d%%", percentage);
            //swprintf_s(status, L"Analyzing...");
            SetStatusText(status); //commented-out
            SendMessage(g_hStatusBar, SB_SETTEXT, 0, (LPARAM)status);
        }

        void OpenFileDialog(HWND hwnd) {
            WCHAR fileName[MAX_PATH] = L"";
            OPENFILENAMEW ofn = { sizeof(OPENFILENAMEW), hwnd, NULL, L"Executable Files (*.exe;*.dll)\0*.exe;*.dll\0All Files (*.*)\0*.*\0", NULL, 0, 1, fileName, MAX_PATH, NULL, 0, NULL, NULL, OFN_EXPLORER | OFN_FILEMUSTEXIST | OFN_HIDEREADONLY, 0, 0, L"exe", NULL, NULL, NULL };
            if (GetOpenFileNameW(&ofn)) {
                SetWindowTextW(g_hEditControl, L"");
                g_OutputText.str(L"");
                g_OutputText.clear();
                AnalyzePEFile(ofn.lpstrFile);
                UpdateEditControl();
            }
        }

        class FileMapper {
        private:
            HANDLE hFile;
            HANDLE hMapping;
            LPVOID lpView;

        public:
            FileMapper() : hFile(INVALID_HANDLE_VALUE), hMapping(nullptr), lpView(nullptr) {}

            ~FileMapper() {
                Cleanup();
            }

            void Cleanup() {
                if (lpView) {
                    UnmapViewOfFile(lpView);
                    lpView = nullptr;
                }
                if (hMapping) {
                    CloseHandle(hMapping);
                    hMapping = nullptr;
                }
                if (hFile != INVALID_HANDLE_VALUE) {
                    CloseHandle(hFile);
                    hFile = INVALID_HANDLE_VALUE;
                }
            }

            bool Initialize(const wchar_t* path) {
                Cleanup();  // Ensure clean state

                hFile = CreateFileW(path, GENERIC_READ, FILE_SHARE_READ,
                    nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
                if (hFile == INVALID_HANDLE_VALUE) return false;

                hMapping = CreateFileMappingW(hFile, nullptr, PAGE_READONLY, 0, 0, nullptr);
                if (!hMapping) {
                    Cleanup();
                    return false;
                }

                lpView = MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0);
                if (!lpView) {
                    Cleanup();
                    return false;
                }

                return true;
            }

            LPVOID GetView() const { return lpView; }
        };

        // Modified AppendToOutput to handle newlines properly:
        void AppendToOutput(const wchar_t* format, ...) {
            std::vector<wchar_t> buffer(1024);
            va_list args;
            va_start(args, format);

            while (true) {
                int result = _vsnwprintf(buffer.data(), buffer.size(), format, args);
                if (result >= 0) break;
                buffer.resize(buffer.size() * 2);
            }
            va_end(args);

            // Convert \n to \r\n
            std::wstring output = buffer.data();
            size_t pos = 0;
            while ((pos = output.find(L'\n', pos)) != std::wstring::npos) {
                if (pos == 0 || output[pos - 1] != L'\r') {
                    output.insert(pos, L"\r");
                    pos += 2;
                }
                else {
                    pos++;
                }
            }

            g_OutputText << output;
            UpdateEditControl();
        }


        //use vectors for unlimited size growth of buffer, use an alternative to editbox, check for fast loops overloading, in its primitive form it works properly! try w/o getimports3264 datadirectories getsections

        void ProcessResourceDirectory(
            PIMAGE_RESOURCE_DIRECTORY resDir,
            int level,
            const wchar_t* type,
            PIMAGE_RESOURCE_DIRECTORY pResourceDir,
            const wchar_t* resourceTypes[],
            PIMAGE_NT_HEADERS pNtHeaders,
            LPVOID lpFileContent)
        {
            if (IsBadReadPtr(resDir, sizeof(IMAGE_RESOURCE_DIRECTORY))) {
                return;
            }

            auto entry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(resDir + 1);
            WORD totalEntries = resDir->NumberOfNamedEntries + resDir->NumberOfIdEntries;

            for (WORD i = 0; i < totalEntries; i++) {
                if (IsBadReadPtr(entry + i, sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY))) {
                    break;
                }

                for (int indent = 0; indent < level; indent++) {
                    OUTPUT("\t");
                }

                if (entry[i].NameIsString) {
                    auto nameEntry = (PIMAGE_RESOURCE_DIR_STRING_U)((BYTE*)pResourceDir + entry[i].NameOffset);
                    if (!IsBadReadPtr(nameEntry, sizeof(IMAGE_RESOURCE_DIR_STRING_U))) {
                        std::vector<wchar_t> resourceName(nameEntry->Length + 1);
                        wcsncpy_s(resourceName.data(), nameEntry->Length + 1,
                            nameEntry->NameString, nameEntry->Length);
                        resourceName[nameEntry->Length] = L'\0';

                        if (level == 0) {
                            OUTPUT("Resource Type: Custom (%s)\n", resourceName.data());
                        }
                        else {
                            OUTPUT("Name: %s\n", resourceName.data());
                        }
                    }
                }
                else {
                    if (level == 0) {
                        DWORD resourceType = entry[i].Id;
                        if (resourceType < 16) {
                            OUTPUT("Resource Type: %s (ID: %d)\n", resourceTypes[resourceType], resourceType);
                        }
                        else {
                            OUTPUT("Resource Type: Custom (ID: %d)\n", resourceType);
                        }
                    }
                    else {
                        OUTPUT("ID: %d\n", entry[i].Id);
                    }
                }

                if (entry[i].DataIsDirectory) {
                    auto nextDir = (PIMAGE_RESOURCE_DIRECTORY)((BYTE*)pResourceDir + entry[i].OffsetToDirectory);
                    if (!IsBadReadPtr(nextDir, sizeof(IMAGE_RESOURCE_DIRECTORY))) {
                        ProcessResourceDirectory(nextDir, level + 1,
                            level == 0 ? resourceTypes[min(entry[i].Id, 15)] : type,
                            pResourceDir, resourceTypes, pNtHeaders, lpFileContent);
                    }
                }
                else {
                    auto dataEntry = (PIMAGE_RESOURCE_DATA_ENTRY)((BYTE*)pResourceDir + entry[i].OffsetToData);
                    if (!IsBadReadPtr(dataEntry, sizeof(IMAGE_RESOURCE_DATA_ENTRY))) {
                        for (int indent = 0; indent < level + 1; indent++) {
                            OUTPUT("\t");
                        }
                        OUTPUT("Size: %d bytes, RVA: 0x%X\n",
                            dataEntry->Size, dataEntry->OffsetToData);

                        if (type && wcscmp(type, L"Version") == 0) {
                            auto versionData = (BYTE*)PEHelpers::GetRvaPtr(
                                dataEntry->OffsetToData,
                                IMAGE_FIRST_SECTION(pNtHeaders),
                                pNtHeaders->FileHeader.NumberOfSections,
                                lpFileContent);

                            if (versionData && !IsBadReadPtr(versionData, sizeof(VS_FIXEDFILEINFO))) {
                                auto versionInfo = (VS_FIXEDFILEINFO*)(versionData + 40);
                                if (versionInfo->dwSignature == 0xFEEF04BD) {
                                    for (int indent = 0; indent < level + 2; indent++) {
                                        OUTPUT("\t");
                                    }
                                    OUTPUT("File Version: %d.%d.%d.%d\n",
                                        HIWORD(versionInfo->dwFileVersionMS),
                                        LOWORD(versionInfo->dwFileVersionMS),
                                        HIWORD(versionInfo->dwFileVersionLS),
                                        LOWORD(versionInfo->dwFileVersionLS));
                                }
                            }
                        }
                    }
                }
            }
        }

        //adding here
        //######################################################################################
        //######################################################################################
        //        ##    endroughxfer - urldump #1#
        //        ##    <EOF><EOF>
        //######################################################################################
        //######################################################################################
        //
        // new code below starting here vv

        bool InitializePEAnalyzer(PEAnalyzer& analyzer, const wchar_t* filePath) {
            FileMapper mapper;
            if (!mapper.Initialize(filePath)) {
                OUTPUT("[-] Failed to open file! Error: %d\n", GetLastError());
                return false;
            }

            analyzer.lpFileContent = mapper.GetView();
            analyzer.fileSize = GetFileSizeCustom(filePath);

            analyzer.pDosHeader = static_cast<PIMAGE_DOS_HEADER>(analyzer.lpFileContent);
            if (analyzer.pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
                OUTPUT("[-] Invalid DOS signature!\n");
                return false;
            }

            auto pNtHeaders = reinterpret_cast<PIMAGE_NT_HEADERS>(
                static_cast<BYTE*>(analyzer.lpFileContent) + analyzer.pDosHeader->e_lfanew);

            if (IsBadReadPtr(pNtHeaders, sizeof(IMAGE_NT_HEADERS)) ||
                pNtHeaders->Signature != IMAGE_NT_SIGNATURE) {
                OUTPUT("[-] Invalid NT signature!\n");
                return false;
            }

            analyzer.is64Bit = (pNtHeaders->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC);

            if (analyzer.is64Bit) {
                analyzer.pNtHeaders64 = reinterpret_cast<PIMAGE_NT_HEADERS64>(pNtHeaders);
                analyzer.pNtHeaders32 = nullptr;
            }
            else {
                analyzer.pNtHeaders32 = reinterpret_cast<PIMAGE_NT_HEADERS32>(pNtHeaders);
                analyzer.pNtHeaders64 = nullptr;
            }

            return true;
        }

        DWORD GetFileSize(const wchar_t* filePath) {
            HANDLE hFile = CreateFileW(filePath, GENERIC_READ, FILE_SHARE_READ,
                nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
            if (hFile == INVALID_HANDLE_VALUE) return 0;

            DWORD fileSize = ::GetFileSize(hFile, nullptr);
            CloseHandle(hFile);
            return fileSize;
        }
    //}

    void ParseImportDirectory32(const PEAnalyzer& analyzer) {
        const auto& importDir = analyzer.pNtHeaders32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
        if (!importDir.VirtualAddress || !importDir.Size) return;

        if (!PEHelpers::IsRvaValid(importDir.VirtualAddress, analyzer.fileSize,
            reinterpret_cast<PIMAGE_NT_HEADERS>(analyzer.pNtHeaders32))) {
            OUTPUT("[-] Invalid import directory RVA!\n");
            return;
        }

        OUTPUT("\n[+] IMPORT DIRECTORY (32-bit)\n");
        auto pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)PEHelpers::GetRvaPtr(
            importDir.VirtualAddress,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        if (!pImportDesc) return;

        while (pImportDesc->Name != 0) {
            if (IsBadReadPtr(pImportDesc, sizeof(IMAGE_IMPORT_DESCRIPTOR))) {
                OUTPUT("[-] Invalid import descriptor detected!\n");
                break;
            }

            const char* dllName = (const char*)PEHelpers::GetRvaPtr(
                pImportDesc->Name,
                IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
                analyzer.pNtHeaders32->FileHeader.NumberOfSections,
                analyzer.lpFileContent);

            if (dllName && !IsBadReadPtr(dllName, 1)) {
                std::vector<wchar_t> wideDllName(MAX_PATH);
                MultiByteToWideChar(CP_ACP, 0, dllName, -1, wideDllName.data(), MAX_PATH);

                OUTPUT("\n\tDLL NAME: %s\n", wideDllName.data());
                OUTPUT("\tCharacteristics: 0x%X\n", pImportDesc->Characteristics);
                OUTPUT("\tTimeDateStamp: 0x%X\n", pImportDesc->TimeDateStamp);
                OUTPUT("\tForwarderChain: 0x%X\n", pImportDesc->ForwarderChain);
                OUTPUT("\tFirstThunk: 0x%X\n", pImportDesc->FirstThunk);
                OUTPUT("\n\tImported Functions:\n");

                auto pThunk = (PIMAGE_THUNK_DATA32)PEHelpers::GetRvaPtr(
                    pImportDesc->OriginalFirstThunk ? pImportDesc->OriginalFirstThunk : pImportDesc->FirstThunk,
                    IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
                    analyzer.pNtHeaders32->FileHeader.NumberOfSections,
                    analyzer.lpFileContent);

                while (pThunk && pThunk->u1.AddressOfData) {
                    if (!(pThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32)) {
                        auto pImportByName = (PIMAGE_IMPORT_BY_NAME)PEHelpers::GetRvaPtr(
                            pThunk->u1.AddressOfData,
                            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
                            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
                            analyzer.lpFileContent);

                        if (pImportByName && !IsBadReadPtr(pImportByName, sizeof(IMAGE_IMPORT_BY_NAME))) {
                            std::vector<wchar_t> wideFuncName(MAX_PATH);
                            MultiByteToWideChar(CP_ACP, 0, (char*)pImportByName->Name, -1,
                                wideFuncName.data(), MAX_PATH);
                            OUTPUT("\t\t%s\n", wideFuncName.data());
                        }
                    }
                    else {
                        OUTPUT("\t\tOrdinal: %d\n", pThunk->u1.Ordinal & 0xFFFF);
                    }
                    pThunk++;
                }
            }
            pImportDesc++;
        }
    }

    void ParseImportDirectory64(const PEAnalyzer& analyzer) {
        const auto& importDir = analyzer.pNtHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
        if (!importDir.VirtualAddress || !importDir.Size) return;

        if (!PEHelpers::IsRvaValid(importDir.VirtualAddress, analyzer.fileSize,
            reinterpret_cast<PIMAGE_NT_HEADERS>(analyzer.pNtHeaders64))) {
            OUTPUT("[-] Invalid import directory RVA!\n");
            return;
        }

        OUTPUT("\n[+] IMPORT DIRECTORY (64-bit)\n");
        auto pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)PEHelpers::GetRvaPtr(
            importDir.VirtualAddress,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
            analyzer.pNtHeaders64->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        if (!pImportDesc) return;

        while (pImportDesc->Name != 0) {
            if (IsBadReadPtr(pImportDesc, sizeof(IMAGE_IMPORT_DESCRIPTOR))) {
                OUTPUT("[-] Invalid import descriptor detected!\n");
                break;
            }

            const char* dllName = (const char*)PEHelpers::GetRvaPtr(
                pImportDesc->Name,
                IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
                analyzer.pNtHeaders64->FileHeader.NumberOfSections,
                analyzer.lpFileContent);

            if (dllName && !IsBadReadPtr(dllName, 1)) {
                std::vector<wchar_t> wideDllName(MAX_PATH);
                MultiByteToWideChar(CP_ACP, 0, dllName, -1, wideDllName.data(), MAX_PATH);

                OUTPUT("\n\tDLL NAME: %s\n", wideDllName.data());
                OUTPUT("\tCharacteristics: 0x%X\n", pImportDesc->Characteristics);
                OUTPUT("\tTimeDateStamp: 0x%X\n", pImportDesc->TimeDateStamp);
                OUTPUT("\tForwarderChain: 0x%X\n", pImportDesc->ForwarderChain);
                OUTPUT("\tFirstThunk: 0x%X\n", pImportDesc->FirstThunk);
                OUTPUT("\n\tImported Functions:\n");

                auto pThunk = (PIMAGE_THUNK_DATA64)PEHelpers::GetRvaPtr(
                    pImportDesc->OriginalFirstThunk ? pImportDesc->OriginalFirstThunk : pImportDesc->FirstThunk,
                    IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
                    analyzer.pNtHeaders64->FileHeader.NumberOfSections,
                    analyzer.lpFileContent);

                while (pThunk && pThunk->u1.AddressOfData) {
                    if (!(pThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG64)) {
                        auto pImportByName = (PIMAGE_IMPORT_BY_NAME)PEHelpers::GetRvaPtr(
                            (DWORD)pThunk->u1.AddressOfData,
                            IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
                            analyzer.pNtHeaders64->FileHeader.NumberOfSections,
                            analyzer.lpFileContent);

                        if (pImportByName && !IsBadReadPtr(pImportByName, sizeof(IMAGE_IMPORT_BY_NAME))) {
                            std::vector<wchar_t> wideFuncName(MAX_PATH);
                            MultiByteToWideChar(CP_ACP, 0, (char*)pImportByName->Name, -1,
                                wideFuncName.data(), MAX_PATH);
                            OUTPUT("\t\t%s\n", wideFuncName.data());
                        }
                    }
                    else {
                        OUTPUT("\t\tOrdinal: %lld\n", pThunk->u1.Ordinal & 0xFFFF);
                    }
                    pThunk++;
                }
            }
            pImportDesc++;
        }
    }

    void ParseImportDirectory(const PEAnalyzer& analyzer) {
        if (analyzer.is64Bit) {
            ParseImportDirectory64(analyzer);
        }
        else {
            ParseImportDirectory32(analyzer);
        }
    }
    //}

    void ParseExportDirectory32(const PEAnalyzer& analyzer) {
        const auto& exportDir = analyzer.pNtHeaders32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
        if (!exportDir.VirtualAddress || !exportDir.Size) return;

        if (!PEHelpers::IsRvaValid(exportDir.VirtualAddress, analyzer.fileSize,
            reinterpret_cast<PIMAGE_NT_HEADERS>(analyzer.pNtHeaders32))) {
            OUTPUT("[-] Invalid export directory RVA!\n");
            return;
        }

        OUTPUT("\n[+] EXPORT DIRECTORY (32-bit)\n");
        auto pExportDir = (PIMAGE_EXPORT_DIRECTORY)PEHelpers::GetRvaPtr(
            exportDir.VirtualAddress,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        if (!pExportDir || IsBadReadPtr(pExportDir, sizeof(IMAGE_EXPORT_DIRECTORY))) {
            OUTPUT("[-] Invalid export directory structure!\n");
            return;
        }

        OUTPUT("\tCharacteristics: 0x%X\n", pExportDir->Characteristics);
        OUTPUT("\tTimeDateStamp: 0x%X\n", pExportDir->TimeDateStamp);
        OUTPUT("\tMajorVersion: %d\n", pExportDir->MajorVersion);
        OUTPUT("\tMinorVersion: %d\n", pExportDir->MinorVersion);
        OUTPUT("\tName: 0x%X\n", pExportDir->Name);
        OUTPUT("\tBase: %d\n", pExportDir->Base);
        OUTPUT("\tNumberOfFunctions: %d\n", pExportDir->NumberOfFunctions);
        OUTPUT("\tNumberOfNames: %d\n", pExportDir->NumberOfNames);
        OUTPUT("\tAddressOfFunctions: 0x%X\n", pExportDir->AddressOfFunctions);
        OUTPUT("\tAddressOfNames: 0x%X\n", pExportDir->AddressOfNames);
        OUTPUT("\tAddressOfNameOrdinals: 0x%X\n\n", pExportDir->AddressOfNameOrdinals);

        auto pFunctions = (PDWORD)PEHelpers::GetRvaPtr(
            pExportDir->AddressOfFunctions,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        auto pNames = (PDWORD)PEHelpers::GetRvaPtr(
            pExportDir->AddressOfNames,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        auto pNameOrdinals = (PWORD)PEHelpers::GetRvaPtr(
            pExportDir->AddressOfNameOrdinals,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        if (!pNames || !pNameOrdinals || !pFunctions) {
            OUTPUT("[-] Invalid export address tables!\n");
            return;
        }

        OUTPUT("\tExported Functions:\n\n");
        for (DWORD i = 0; i < pExportDir->NumberOfNames; i++) {
            if (IsBadReadPtr(pNames + i, sizeof(DWORD)) ||
                IsBadReadPtr(pNameOrdinals + i, sizeof(WORD))) {
                break;
            }

            const char* functionName = (const char*)PEHelpers::GetRvaPtr(
                pNames[i],
                IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
                analyzer.pNtHeaders32->FileHeader.NumberOfSections,
                analyzer.lpFileContent);

            if (functionName && !IsBadReadPtr(functionName, 1)) {
                WORD ordinal = pNameOrdinals[i];
                if (ordinal < pExportDir->NumberOfFunctions) {
                    DWORD functionRva = pFunctions[ordinal];

                    // Check for forwarded export
                    if (functionRva >= exportDir.VirtualAddress &&
                        functionRva < (exportDir.VirtualAddress + exportDir.Size)) {

                        const char* forwardName = (const char*)PEHelpers::GetRvaPtr(
                            functionRva,
                            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
                            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
                            analyzer.lpFileContent);

                        if (forwardName && !IsBadReadPtr(forwardName, 1)) {
                            std::vector<wchar_t> wideForwardName(MAX_PATH);
                            MultiByteToWideChar(CP_ACP, 0, forwardName, -1,
                                wideForwardName.data(), MAX_PATH);
                            OUTPUT("\t\t%s (Ordinal: %d) -> Forward to: %s\n",
                                functionName,
                                ordinal + pExportDir->Base,
                                wideForwardName.data());
                        }
                    }
                    else {
                        OUTPUT("\t\t%s (Ordinal: %d, RVA: 0x%08X)\n",
                            functionName,
                            ordinal + pExportDir->Base,
                            functionRva);
                    }
                }
            }
        }
    }

    void ParseExportDirectory64(const PEAnalyzer& analyzer) {
        const auto& exportDir = analyzer.pNtHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
        if (!exportDir.VirtualAddress || !exportDir.Size) return;

        if (!PEHelpers::IsRvaValid(exportDir.VirtualAddress, analyzer.fileSize,
            reinterpret_cast<PIMAGE_NT_HEADERS>(analyzer.pNtHeaders64))) {
            OUTPUT("[-] Invalid export directory RVA!\n");
            return;
        }

        OUTPUT("\n[+] EXPORT DIRECTORY (64-bit)\n");
        // Rest of the implementation is identical to 32-bit version
        // Just using pNtHeaders64 instead of pNtHeaders64
        auto pExportDir = (PIMAGE_EXPORT_DIRECTORY)PEHelpers::GetRvaPtr(
            exportDir.VirtualAddress,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
            analyzer.pNtHeaders64->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        if (!pExportDir || IsBadReadPtr(pExportDir, sizeof(IMAGE_EXPORT_DIRECTORY))) {
            OUTPUT("[-] Invalid export directory structure!\n");
            return;
        }

        OUTPUT("\tCharacteristics: 0x%X\n", pExportDir->Characteristics);
        OUTPUT("\tTimeDateStamp: 0x%X\n", pExportDir->TimeDateStamp);
        OUTPUT("\tMajorVersion: %d\n", pExportDir->MajorVersion);
        OUTPUT("\tMinorVersion: %d\n", pExportDir->MinorVersion);
        OUTPUT("\tName: 0x%X\n", pExportDir->Name);
        OUTPUT("\tBase: %d\n", pExportDir->Base);
        OUTPUT("\tNumberOfFunctions: %d\n", pExportDir->NumberOfFunctions);
        OUTPUT("\tNumberOfNames: %d\n", pExportDir->NumberOfNames);
        OUTPUT("\tAddressOfFunctions: 0x%X\n", pExportDir->AddressOfFunctions);
        OUTPUT("\tAddressOfNames: 0x%X\n", pExportDir->AddressOfNames);
        OUTPUT("\tAddressOfNameOrdinals: 0x%X\n\n", pExportDir->AddressOfNameOrdinals);

        auto pFunctions = (PDWORD)PEHelpers::GetRvaPtr(
            pExportDir->AddressOfFunctions,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
            analyzer.pNtHeaders64->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        auto pNames = (PDWORD)PEHelpers::GetRvaPtr(
            pExportDir->AddressOfNames,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
            analyzer.pNtHeaders64->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        auto pNameOrdinals = (PWORD)PEHelpers::GetRvaPtr(
            pExportDir->AddressOfNameOrdinals,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
            analyzer.pNtHeaders64->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        if (!pNames || !pNameOrdinals || !pFunctions) {
            OUTPUT("[-] Invalid export address tables!\n");
            return;
        }

        OUTPUT("\tExported Functions:\n\n");
        for (DWORD i = 0; i < pExportDir->NumberOfNames; i++) {
            if (IsBadReadPtr(pNames + i, sizeof(DWORD)) ||
                IsBadReadPtr(pNameOrdinals + i, sizeof(WORD))) {
                break;
            }

            const char* functionName = (const char*)PEHelpers::GetRvaPtr(
                pNames[i],
                IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
                analyzer.pNtHeaders64->FileHeader.NumberOfSections,
                analyzer.lpFileContent);

            if (functionName && !IsBadReadPtr(functionName, 1)) {
                WORD ordinal = pNameOrdinals[i];
                if (ordinal < pExportDir->NumberOfFunctions) {
                    DWORD functionRva = pFunctions[ordinal];

                    // Check for forwarded export
                    if (functionRva >= exportDir.VirtualAddress &&
                        functionRva < (exportDir.VirtualAddress + exportDir.Size)) {

                        const char* forwardName = (const char*)PEHelpers::GetRvaPtr(
                            functionRva,
                            IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
                            analyzer.pNtHeaders64->FileHeader.NumberOfSections,
                            analyzer.lpFileContent);

                        if (forwardName && !IsBadReadPtr(forwardName, 1)) {
                            std::vector<wchar_t> wideForwardName(MAX_PATH);
                            MultiByteToWideChar(CP_ACP, 0, forwardName, -1,
                                wideForwardName.data(), MAX_PATH);
                            OUTPUT("\t\t%s (Ordinal: %d) -> Forward to: %s\n",
                                functionName,
                                ordinal + pExportDir->Base,
                                wideForwardName.data());
                        }
                    }
                    else {
                        OUTPUT("\t\t%s (Ordinal: %d, RVA: 0x%08X)\n",
                            functionName,
                            ordinal + pExportDir->Base,
                            functionRva);
                    }
                }
            }
        }
    }
    // Copying the same logic as ParseExportDirectory32 but with 64-bit headers
    // ... [Same implementation as above, just using pNtHeaders64]

    void ParseExportDirectory(const PEAnalyzer& analyzer) {
        if (analyzer.is64Bit) {
            ParseExportDirectory64(analyzer);
        }
        else {
            ParseExportDirectory32(analyzer);
        }
    }

    void ProcessResourceDirectory32(
        PIMAGE_RESOURCE_DIRECTORY resDir,
        int level,
        const wchar_t* type,
        PIMAGE_RESOURCE_DIRECTORY baseResourceDir,
        const wchar_t* resourceTypes[],
        const PEAnalyzer& analyzer)
    {
        if (IsBadReadPtr(resDir, sizeof(IMAGE_RESOURCE_DIRECTORY))) {
            return;
        }

        auto entry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(resDir + 1);
        WORD totalEntries = resDir->NumberOfNamedEntries + resDir->NumberOfIdEntries;

        for (WORD i = 0; i < totalEntries; i++) {
            if (IsBadReadPtr(entry + i, sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY))) {
                break;
            }

            for (int indent = 0; indent < level; indent++) {
                OUTPUT("\t");
            }

            if (entry[i].NameIsString) {
                auto nameEntry = (PIMAGE_RESOURCE_DIR_STRING_U)((BYTE*)baseResourceDir + entry[i].NameOffset);
                if (!IsBadReadPtr(nameEntry, sizeof(IMAGE_RESOURCE_DIR_STRING_U))) {
                    std::vector<wchar_t> resourceName(nameEntry->Length + 1);
                    wcsncpy_s(resourceName.data(), nameEntry->Length + 1,
                        nameEntry->NameString, nameEntry->Length);
                    resourceName[nameEntry->Length] = L'\0';

                    if (level == 0) {
                        OUTPUT("Resource Type: Custom (%s)\n", resourceName.data());
                    }
                    else {
                        OUTPUT("Name: %s\n", resourceName.data());
                    }
                }
            }
            else {
                if (level == 0) {
                    DWORD resourceType = entry[i].Id;
                    if (resourceType < 16) {
                        OUTPUT("Resource Type: %s (ID: %d)\n", resourceTypes[resourceType], resourceType);
                    }
                    else {
                        OUTPUT("Resource Type: Custom (ID: %d)\n", resourceType);
                    }
                }
                else {
                    OUTPUT("ID: %d\n", entry[i].Id);
                }
            }

            if (entry[i].DataIsDirectory) {
                auto nextDir = (PIMAGE_RESOURCE_DIRECTORY)((BYTE*)baseResourceDir + entry[i].OffsetToDirectory);
                if (!IsBadReadPtr(nextDir, sizeof(IMAGE_RESOURCE_DIRECTORY))) {
                    ProcessResourceDirectory32(nextDir, level + 1,
                        level == 0 ? resourceTypes[min(entry[i].Id, 15)] : type,
                        baseResourceDir, resourceTypes, analyzer);
                }
            }
            else {
                auto dataEntry = (PIMAGE_RESOURCE_DATA_ENTRY)((BYTE*)baseResourceDir + entry[i].OffsetToData);
                if (!IsBadReadPtr(dataEntry, sizeof(IMAGE_RESOURCE_DATA_ENTRY))) {
                    for (int indent = 0; indent < level + 1; indent++) {
                        OUTPUT("\t");
                    }
                    OUTPUT("Size: %d bytes, RVA: 0x%X\n", dataEntry->Size, dataEntry->OffsetToData);

                    // Special handling for Version resources
                    if (type && wcscmp(type, L"Version") == 0) {
                        auto versionData = (BYTE*)PEHelpers::GetRvaPtr(
                            dataEntry->OffsetToData,
                            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
                            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
                            analyzer.lpFileContent);

                        if (versionData && !IsBadReadPtr(versionData, sizeof(VS_FIXEDFILEINFO))) {
                            auto versionInfo = (VS_FIXEDFILEINFO*)(versionData + 40);
                            if (versionInfo->dwSignature == 0xFEEF04BD) {
                                for (int indent = 0; indent < level + 2; indent++) {
                                    OUTPUT("\t");
                                }
                                OUTPUT("File Version: %d.%d.%d.%d\n",
                                    HIWORD(versionInfo->dwFileVersionMS),
                                    LOWORD(versionInfo->dwFileVersionMS),
                                    HIWORD(versionInfo->dwFileVersionLS),
                                    LOWORD(versionInfo->dwFileVersionLS));
                            }
                        }
                    }
                }
            }
        }
    }

    void ProcessResourceDirectory64(
        PIMAGE_RESOURCE_DIRECTORY resDir,
        int level,
        const wchar_t* type,
        PIMAGE_RESOURCE_DIRECTORY baseResourceDir,
        const wchar_t* resourceTypes[],
        const PEAnalyzer& analyzer)
    {
        // Similar to ProcessResourceDirectory32 but using 64-bit structures
        // Main difference is using analyzer.pNtHeaders64 instead of analyzer.pNtHeaders32
        if (IsBadReadPtr(resDir, sizeof(IMAGE_RESOURCE_DIRECTORY))) {
            return;
            // Rest of the implementation follows the same pattern
        }

        auto entry = (PIMAGE_RESOURCE_DIRECTORY_ENTRY)(resDir + 1);
        WORD totalEntries = resDir->NumberOfNamedEntries + resDir->NumberOfIdEntries;

        for (WORD i = 0; i < totalEntries; i++) {
            if (IsBadReadPtr(entry + i, sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY))) {
                break;
            }

            for (int indent = 0; indent < level; indent++) {
                OUTPUT("\t");
            }

            if (entry[i].NameIsString) {
                auto nameEntry = (PIMAGE_RESOURCE_DIR_STRING_U)((BYTE*)baseResourceDir + entry[i].NameOffset);
                if (!IsBadReadPtr(nameEntry, sizeof(IMAGE_RESOURCE_DIR_STRING_U))) {
                    std::vector<wchar_t> resourceName(nameEntry->Length + 1);
                    wcsncpy_s(resourceName.data(), nameEntry->Length + 1,
                        nameEntry->NameString, nameEntry->Length);
                    resourceName[nameEntry->Length] = L'\0';

                    if (level == 0) {
                        OUTPUT("Resource Type: Custom (%s)\n", resourceName.data());
                    }
                    else {
                        OUTPUT("Name: %s\n", resourceName.data());
                    }
                }
            }
            else {
                if (level == 0) {
                    DWORD resourceType = entry[i].Id;
                    if (resourceType < 16) {
                        OUTPUT("Resource Type: %s (ID: %d)\n", resourceTypes[resourceType], resourceType);
                    }
                    else {
                        OUTPUT("Resource Type: Custom (ID: %d)\n", resourceType);
                    }
                }
                else {
                    OUTPUT("ID: %d\n", entry[i].Id);
                }
            }

            if (entry[i].DataIsDirectory) {
                auto nextDir = (PIMAGE_RESOURCE_DIRECTORY)((BYTE*)baseResourceDir + entry[i].OffsetToDirectory);
                if (!IsBadReadPtr(nextDir, sizeof(IMAGE_RESOURCE_DIRECTORY))) {
                    ProcessResourceDirectory32(nextDir, level + 1,
                        level == 0 ? resourceTypes[min(entry[i].Id, 15)] : type,
                        baseResourceDir, resourceTypes, analyzer);
                }
            }
            else {
                auto dataEntry = (PIMAGE_RESOURCE_DATA_ENTRY)((BYTE*)baseResourceDir + entry[i].OffsetToData);
                if (!IsBadReadPtr(dataEntry, sizeof(IMAGE_RESOURCE_DATA_ENTRY))) {
                    for (int indent = 0; indent < level + 1; indent++) {
                        OUTPUT("\t");
                    }
                    OUTPUT("Size: %d bytes, RVA: 0x%X\n", dataEntry->Size, dataEntry->OffsetToData);

                    // Special handling for Version resources
                    if (type && wcscmp(type, L"Version") == 0) {
                        auto versionData = (BYTE*)PEHelpers::GetRvaPtr(
                            dataEntry->OffsetToData,
                            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
                            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
                            analyzer.lpFileContent);

                        if (versionData && !IsBadReadPtr(versionData, sizeof(VS_FIXEDFILEINFO))) {
                            auto versionInfo = (VS_FIXEDFILEINFO*)(versionData + 40);
                            if (versionInfo->dwSignature == 0xFEEF04BD) {
                                for (int indent = 0; indent < level + 2; indent++) {
                                    OUTPUT("\t");
                                }
                                OUTPUT("File Version: %d.%d.%d.%d\n",
                                    HIWORD(versionInfo->dwFileVersionMS),
                                    LOWORD(versionInfo->dwFileVersionMS),
                                    HIWORD(versionInfo->dwFileVersionLS),
                                    LOWORD(versionInfo->dwFileVersionLS));
                            }
                        }
                    }
                }
            }
        }
    }

    void ParseResourceDirectory32(const PEAnalyzer& analyzer) {
        const auto& resourceDir = analyzer.pNtHeaders32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE];
        if (!resourceDir.VirtualAddress || !resourceDir.Size) return;

        if (!PEHelpers::IsRvaValid(resourceDir.VirtualAddress, analyzer.fileSize,
            reinterpret_cast<PIMAGE_NT_HEADERS>(analyzer.pNtHeaders32))) {
            OUTPUT("[-] Invalid resource directory RVA!\n");
            return;
        }

        OUTPUT("\n[+] RESOURCE DIRECTORY (32-bit)\n");
        auto pResourceDir = (PIMAGE_RESOURCE_DIRECTORY)PEHelpers::GetRvaPtr(
            resourceDir.VirtualAddress,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        if (!pResourceDir || IsBadReadPtr(pResourceDir, sizeof(IMAGE_RESOURCE_DIRECTORY))) {
            OUTPUT("[-] Invalid or corrupted resource directory\n");
            return;
        }

        const wchar_t* resourceTypes[] = {
            L"Unknown",     L"Cursor",      L"Bitmap",      L"Icon",
            L"Menu",        L"Dialog",      L"String",      L"FontDir",
            L"Font",        L"Accelerator", L"RCData",      L"MessageTable",
            L"GroupCursor", L"GroupIcon",   L"Version",     L"DlgInclude"
        };

        ProcessResourceDirectory32(pResourceDir, 0, nullptr, pResourceDir, resourceTypes, analyzer);
    }

    void ParseResourceDirectory64(const PEAnalyzer& analyzer) {
        // Similar to ParseResourceDirectory32 but using 64-bit structures
        const auto& resourceDir = analyzer.pNtHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE];
        // Rest of implementation follows same pattern as 32-bit version
    }

    void ParseResourceDirectory(const PEAnalyzer& analyzer) {
        if (analyzer.is64Bit) {
            ParseResourceDirectory64(analyzer);
        }
        else {
            ParseResourceDirectory32(analyzer);
        }
    }

    void ParseDebugDirectory32(const PEAnalyzer& analyzer) {
        const auto& debugDir = analyzer.pNtHeaders32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG];
        if (!debugDir.VirtualAddress || !debugDir.Size) return;

        if (!PEHelpers::IsRvaValid(debugDir.VirtualAddress, analyzer.fileSize,
            reinterpret_cast<PIMAGE_NT_HEADERS>(analyzer.pNtHeaders32))) {
            OUTPUT("[-] Invalid debug directory RVA!\n");
            return;
        }

        OUTPUT("\n[+] DEBUG DIRECTORY (32-bit)\n");
        auto pDebugDir = (PIMAGE_DEBUG_DIRECTORY)PEHelpers::GetRvaPtr(
            debugDir.VirtualAddress,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders32),
            analyzer.pNtHeaders32->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        if (!pDebugDir || IsBadReadPtr(pDebugDir, sizeof(IMAGE_DEBUG_DIRECTORY))) {
            OUTPUT("[-] Invalid debug directory structure!\n");
            return;
        }

        DWORD numEntries = min(debugDir.Size / sizeof(IMAGE_DEBUG_DIRECTORY), 16);
        for (DWORD i = 0; i < numEntries; i++) {
            OUTPUT("\tDebug Entry %d:\n", i + 1);
            OUTPUT("\tCharacteristics: 0x%X\n", pDebugDir[i].Characteristics);
            OUTPUT("\tTimeDateStamp: 0x%X\n", pDebugDir[i].TimeDateStamp);
            OUTPUT("\tMajorVersion: %d\n", pDebugDir[i].MajorVersion);
            OUTPUT("\tMinorVersion: %d\n", pDebugDir[i].MinorVersion);
            OUTPUT("\tType: 0x%X", pDebugDir[i].Type);

            switch (pDebugDir[i].Type) {
            case IMAGE_DEBUG_TYPE_COFF:
                OUTPUT(" (COFF)\n"); break;
            case IMAGE_DEBUG_TYPE_CODEVIEW:
                OUTPUT(" (CodeView)\n"); break;
            case IMAGE_DEBUG_TYPE_FPO:
                OUTPUT(" (FPO)\n"); break;
            case IMAGE_DEBUG_TYPE_MISC:
                OUTPUT(" (Misc)\n"); break;
            case IMAGE_DEBUG_TYPE_EXCEPTION:
                OUTPUT(" (Exception)\n"); break;
            case IMAGE_DEBUG_TYPE_FIXUP:
                OUTPUT(" (Fixup)\n"); break;
            case IMAGE_DEBUG_TYPE_OMAP_TO_SRC:
                OUTPUT(" (OMAP to Src)\n"); break;
            case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC:
                OUTPUT(" (OMAP from Src)\n"); break;
            case IMAGE_DEBUG_TYPE_BORLAND:
                OUTPUT(" (Borland)\n"); break;
            default:
                OUTPUT(" (Unknown)\n"); break;
            }

            OUTPUT("\tSizeOfData: 0x%X\n", pDebugDir[i].SizeOfData);
            OUTPUT("\tAddressOfRawData: 0x%X\n", pDebugDir[i].AddressOfRawData);
            OUTPUT("\tPointerToRawData: 0x%X\n\n", pDebugDir[i].PointerToRawData);

            // Special handling for CodeView debug information
            if (pDebugDir[i].Type == IMAGE_DEBUG_TYPE_CODEVIEW &&
                pDebugDir[i].PointerToRawData != 0 &&
                pDebugDir[i].SizeOfData >= sizeof(DWORD)) {

                auto pCVHeader = (DWORD*)((BYTE*)analyzer.lpFileContent + pDebugDir[i].PointerToRawData);
                if (!IsBadReadPtr(pCVHeader, sizeof(DWORD))) {
                    switch (*pCVHeader) {
                    case 0x53445352: // 'RSDS'
                        if (pDebugDir[i].SizeOfData >= (sizeof(DWORD) + sizeof(GUID) + sizeof(DWORD) + 1)) {
                            auto pCVData = (char*)(pCVHeader + 1);
                            if (!IsBadReadPtr(pCVData + 16, 1)) {
                                auto guid = (GUID*)pCVData;
                                DWORD age = *(DWORD*)(pCVData + 16);
                                const char* pdbPath = pCVData + 20;

                                OUTPUT("\tPDB Information:\n");
                                OUTPUT("\tGUID: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}\n",
                                    guid->Data1, guid->Data2, guid->Data3,
                                    guid->Data4[0], guid->Data4[1], guid->Data4[2], guid->Data4[3],
                                    guid->Data4[4], guid->Data4[5], guid->Data4[6], guid->Data4[7]);
                                OUTPUT("\tAge: %d\n", age);
                                OUTPUT("\tPDB Path: %s\n\n", pdbPath);
                            }
                        }
                        break;

                    case 0x3031424E: // 'NB10'
                        if (pDebugDir[i].SizeOfData >= 16) {
                            auto pNB10Data = (char*)(pCVHeader + 1);
                            DWORD offset = *(DWORD*)pNB10Data;
                            DWORD timestamp = *(DWORD*)(pNB10Data + 4);
                            DWORD age = *(DWORD*)(pNB10Data + 8);
                            const char* pdbPath = pNB10Data + 12;

                            OUTPUT("\tPDB Information (NB10):\n");
                            OUTPUT("\tOffset: 0x%X\n", offset);
                            OUTPUT("\tTimestamp: 0x%X\n", timestamp);
                            OUTPUT("\tAge: %d\n", age);
                            OUTPUT("\tPDB Path: %s\n\n", pdbPath);
                        }
                        break;
                    }
                }
            }
        }
    }

    void ParseDebugDirectory64(const PEAnalyzer& analyzer) {
        const auto& debugDir = analyzer.pNtHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG];
        if (!debugDir.VirtualAddress || !debugDir.Size) return;

        if (!PEHelpers::IsRvaValid(debugDir.VirtualAddress, analyzer.fileSize,
            reinterpret_cast<PIMAGE_NT_HEADERS>(analyzer.pNtHeaders64))) {
            OUTPUT("[-] Invalid debug directory RVA!\n");
            return;
        }

        OUTPUT("\n[+] DEBUG DIRECTORY (64-bit)\n");
        // Rest of implementation follows same pattern as 32-bit version
        // Just using pNtHeaders64 instead of pNtHeaders32
        auto pDebugDir = (PIMAGE_DEBUG_DIRECTORY)PEHelpers::GetRvaPtr(
            debugDir.VirtualAddress,
            IMAGE_FIRST_SECTION(analyzer.pNtHeaders64),
            analyzer.pNtHeaders64->FileHeader.NumberOfSections,
            analyzer.lpFileContent);

        if (!pDebugDir || IsBadReadPtr(pDebugDir, sizeof(IMAGE_DEBUG_DIRECTORY))) {
            OUTPUT("[-] Invalid debug directory structure!\n");
            return;
        }

        DWORD numEntries = min(debugDir.Size / sizeof(IMAGE_DEBUG_DIRECTORY), 16);
        for (DWORD i = 0; i < numEntries; i++) {
            OUTPUT("\tDebug Entry %d:\n", i + 1);
            OUTPUT("\tCharacteristics: 0x%X\n", pDebugDir[i].Characteristics);
            OUTPUT("\tTimeDateStamp: 0x%X\n", pDebugDir[i].TimeDateStamp);
            OUTPUT("\tMajorVersion: %d\n", pDebugDir[i].MajorVersion);
            OUTPUT("\tMinorVersion: %d\n", pDebugDir[i].MinorVersion);
            OUTPUT("\tType: 0x%X", pDebugDir[i].Type);

            switch (pDebugDir[i].Type) {
            case IMAGE_DEBUG_TYPE_COFF:
                OUTPUT(" (COFF)\n"); break;
            case IMAGE_DEBUG_TYPE_CODEVIEW:
                OUTPUT(" (CodeView)\n"); break;
            case IMAGE_DEBUG_TYPE_FPO:
                OUTPUT(" (FPO)\n"); break;
            case IMAGE_DEBUG_TYPE_MISC:
                OUTPUT(" (Misc)\n"); break;
            case IMAGE_DEBUG_TYPE_EXCEPTION:
                OUTPUT(" (Exception)\n"); break;
            case IMAGE_DEBUG_TYPE_FIXUP:
                OUTPUT(" (Fixup)\n"); break;
            case IMAGE_DEBUG_TYPE_OMAP_TO_SRC:
                OUTPUT(" (OMAP to Src)\n"); break;
            case IMAGE_DEBUG_TYPE_OMAP_FROM_SRC:
                OUTPUT(" (OMAP from Src)\n"); break;
            case IMAGE_DEBUG_TYPE_BORLAND:
                OUTPUT(" (Borland)\n"); break;
            default:
                OUTPUT(" (Unknown)\n"); break;
            }

            OUTPUT("\tSizeOfData: 0x%X\n", pDebugDir[i].SizeOfData);
            OUTPUT("\tAddressOfRawData: 0x%X\n", pDebugDir[i].AddressOfRawData);
            OUTPUT("\tPointerToRawData: 0x%X\n\n", pDebugDir[i].PointerToRawData);

            // Special handling for CodeView debug information
            if (pDebugDir[i].Type == IMAGE_DEBUG_TYPE_CODEVIEW &&
                pDebugDir[i].PointerToRawData != 0 &&
                pDebugDir[i].SizeOfData >= sizeof(DWORD)) {

                auto pCVHeader = (DWORD*)((BYTE*)analyzer.lpFileContent + pDebugDir[i].PointerToRawData);
                if (!IsBadReadPtr(pCVHeader, sizeof(DWORD))) {
                    switch (*pCVHeader) {
                    case 0x53445352: // 'RSDS'
                        if (pDebugDir[i].SizeOfData >= (sizeof(DWORD) + sizeof(GUID) + sizeof(DWORD) + 1)) {
                            auto pCVData = (char*)(pCVHeader + 1);
                            if (!IsBadReadPtr(pCVData + 16, 1)) {
                                auto guid = (GUID*)pCVData;
                                DWORD age = *(DWORD*)(pCVData + 16);
                                const char* pdbPath = pCVData + 20;

                                OUTPUT("\tPDB Information:\n");
                                OUTPUT("\tGUID: {%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}\n",
                                    guid->Data1, guid->Data2, guid->Data3,
                                    guid->Data4[0], guid->Data4[1], guid->Data4[2], guid->Data4[3],
                                    guid->Data4[4], guid->Data4[5], guid->Data4[6], guid->Data4[7]);
                                OUTPUT("\tAge: %d\n", age);
                                OUTPUT("\tPDB Path: %s\n\n", pdbPath);
                            }
                        }
                        break;

                    case 0x3031424E: // 'NB10'
                        if (pDebugDir[i].SizeOfData >= 16) {
                            auto pNB10Data = (char*)(pCVHeader + 1);
                            DWORD offset = *(DWORD*)pNB10Data;
                            DWORD timestamp = *(DWORD*)(pNB10Data + 4);
                            DWORD age = *(DWORD*)(pNB10Data + 8);
                            const char* pdbPath = pNB10Data + 12;

                            OUTPUT("\tPDB Information (NB10):\n");
                            OUTPUT("\tOffset: 0x%X\n", offset);
                            OUTPUT("\tTimestamp: 0x%X\n", timestamp);
                            OUTPUT("\tAge: %d\n", age);
                            OUTPUT("\tPDB Path: %s\n\n", pdbPath);
                        }
                        break;
                    }
                }
            }
        }
    }
    // ... [Same implementation as ParseDebugDirectory32]

    void ParseDebugDirectory(const PEAnalyzer& analyzer) {
        if (analyzer.is64Bit) {
            ParseDebugDirectory64(analyzer);
        }
        else {
            ParseDebugDirectory32(analyzer);
        }
    }

    // Add Section Parser if not already defined
    void ParseSections(const PEAnalyzer& analyzer) {
        OUTPUT("[+] SECTION HEADERS\n");

        PIMAGE_SECTION_HEADER pSection = IMAGE_FIRST_SECTION(
            analyzer.is64Bit ?
            reinterpret_cast<PIMAGE_NT_HEADERS>(analyzer.pNtHeaders64) :
            reinterpret_cast<PIMAGE_NT_HEADERS>(analyzer.pNtHeaders32));

        WORD numberOfSections = analyzer.is64Bit ?
            analyzer.pNtHeaders64->FileHeader.NumberOfSections :
            analyzer.pNtHeaders32->FileHeader.NumberOfSections;

        for (WORD i = 0; i < numberOfSections; i++, pSection++) {
            if (IsBadReadPtr(pSection, sizeof(IMAGE_SECTION_HEADER))) {
                OUTPUT("[-] Invalid section header detected!\n");
                break;
            }

            char sectionName[IMAGE_SIZEOF_SHORT_NAME + 1] = {};
            memcpy(sectionName, pSection->Name, IMAGE_SIZEOF_SHORT_NAME);

            // Ensure section name is printable
            for (int j = 0; j < IMAGE_SIZEOF_SHORT_NAME; j++) {
                if (!isprint(static_cast<unsigned char>(sectionName[j]))) {
                    sectionName[j] = '\0';
                }
            }

            wchar_t wideSectionName[IMAGE_SIZEOF_SHORT_NAME + 1] = {};
            MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED,
                sectionName, -1,
                wideSectionName, IMAGE_SIZEOF_SHORT_NAME + 1);

            OUTPUT("\tSECTION: %s\n", wideSectionName);
            OUTPUT("\t\tVirtualSize: 0x%X\n", pSection->Misc.VirtualSize);
            OUTPUT("\t\tVirtualAddress: 0x%X\n", pSection->VirtualAddress);
            OUTPUT("\t\tSizeOfRawData: 0x%X\n", pSection->SizeOfRawData);
            OUTPUT("\t\tPointerToRawData: 0x%X\n", pSection->PointerToRawData);
            OUTPUT("\t\tPointerToRelocations: 0x%X\n", pSection->PointerToRelocations);
            OUTPUT("\t\tPointerToLinenumbers: 0x%X\n", pSection->PointerToLinenumbers);
            OUTPUT("\t\tNumberOfRelocations: 0x%X\n", pSection->NumberOfRelocations);
            OUTPUT("\t\tNumberOfLinenumbers: 0x%X\n", pSection->NumberOfLinenumbers);
            OUTPUT("\t\tCharacteristics: 0x%X %s\n\n",
                pSection->Characteristics,
                PEHelpers::GetSectionProtection(pSection->Characteristics).c_str());
        }
    } //end of parsesection here

    void AnalyzePEFile(const wchar_t* filePathW) {
        OUTPUT("[+] Starting PE Analysis for: %s\n\n", filePathW);
        ShowProgress(10);

        PEAnalyzer analyzer;
        if (!PEParser::InitializePEAnalyzer(analyzer, filePathW)) {
            SetStatusText(L"Failed to initialize PE analysis!");
            return;
        }

        ShowProgress(20);

        // Basic PE Information
        OUTPUT("[+] PE IMAGE INFORMATION\n\n");
        OUTPUT("[+] Architecture: %s\n\n", analyzer.is64Bit ? "x64" : "x86");

        // DOS Header
        OUTPUT("[+] DOS HEADER\n");
        OUTPUT("\te_magic    : 0x%X\n", analyzer.pDosHeader->e_magic);
        OUTPUT("\te_cblp     : 0x%X\n", analyzer.pDosHeader->e_cblp);
        OUTPUT("\te_cp       : 0x%X\n", analyzer.pDosHeader->e_cp);
        OUTPUT("\te_crlc     : 0x%X\n", analyzer.pDosHeader->e_crlc);
        OUTPUT("\te_cparhdr  : 0x%X\n", analyzer.pDosHeader->e_cparhdr);
        OUTPUT("\te_minalloc : 0x%X\n", analyzer.pDosHeader->e_minalloc);
        OUTPUT("\te_maxalloc : 0x%X\n", analyzer.pDosHeader->e_maxalloc);
        OUTPUT("\te_ss       : 0x%X\n", analyzer.pDosHeader->e_ss);
        OUTPUT("\te_sp       : 0x%X\n", analyzer.pDosHeader->e_sp);
        OUTPUT("\te_csum     : 0x%X\n", analyzer.pDosHeader->e_csum);
        OUTPUT("\te_ip       : 0x%X\n", analyzer.pDosHeader->e_ip);
        OUTPUT("\te_cs       : 0x%X\n", analyzer.pDosHeader->e_cs);
        OUTPUT("\te_lfarlc   : 0x%X\n", analyzer.pDosHeader->e_lfarlc);
        OUTPUT("\te_ovno     : 0x%X\n", analyzer.pDosHeader->e_ovno);
        OUTPUT("\te_oemid    : 0x%X\n", analyzer.pDosHeader->e_oemid);
        OUTPUT("\te_oeminfo  : 0x%X\n", analyzer.pDosHeader->e_oeminfo);
        OUTPUT("\te_lfanew   : 0x%X\n\n", analyzer.pDosHeader->e_lfanew);

        ShowProgress(30);

        // NT Headers
        if (analyzer.is64Bit) {
            OUTPUT("[+] NT HEADER (64-bit)\n");
            OUTPUT("\tSignature: 0x%X\n\n", analyzer.pNtHeaders64->Signature);

            OUTPUT("[+] FILE HEADER\n");
            OUTPUT("\tMachine: 0x%X\n", analyzer.pNtHeaders64->FileHeader.Machine);
            OUTPUT("\tNumberOfSections: 0x%X\n", analyzer.pNtHeaders64->FileHeader.NumberOfSections);
            OUTPUT("\tTimeDateStamp: 0x%X\n", analyzer.pNtHeaders64->FileHeader.TimeDateStamp);
            OUTPUT("\tPointerToSymbolTable: 0x%X\n", analyzer.pNtHeaders64->FileHeader.PointerToSymbolTable);
            OUTPUT("\tNumberOfSymbols: 0x%X\n", analyzer.pNtHeaders64->FileHeader.NumberOfSymbols);
            OUTPUT("\tSizeOfOptionalHeader: 0x%X\n", analyzer.pNtHeaders64->FileHeader.SizeOfOptionalHeader);
            OUTPUT("\tCharacteristics: 0x%X %s\n\n",
                analyzer.pNtHeaders64->FileHeader.Characteristics,
                PEHelpers::GetImageCharacteristics(analyzer.pNtHeaders64->FileHeader.Characteristics).c_str());

            OUTPUT("[+] OPTIONAL HEADER\n");
            OUTPUT("\tMagic: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.Magic);
            OUTPUT("\tAddressOfEntryPoint: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.AddressOfEntryPoint);
            OUTPUT("\tImageBase: 0x%llX\n", analyzer.pNtHeaders64->OptionalHeader.ImageBase);
            OUTPUT("\tSectionAlignment: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.SectionAlignment);
            OUTPUT("\tFileAlignment: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.FileAlignment);
            OUTPUT("\tMajorOperatingSystemVersion: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.MajorOperatingSystemVersion);
            OUTPUT("\tMinorOperatingSystemVersion: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.MinorOperatingSystemVersion);
            OUTPUT("\tMajorImageVersion: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.MajorImageVersion);
            OUTPUT("\tMinorImageVersion: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.MinorImageVersion);
            OUTPUT("\tMajorSubsystemVersion: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.MajorSubsystemVersion);
            OUTPUT("\tMinorSubsystemVersion: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.MinorSubsystemVersion);
            OUTPUT("\tWin32VersionValue: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.Win32VersionValue);
            OUTPUT("\tSizeOfImage: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.SizeOfImage);
            OUTPUT("\tSizeOfHeaders: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.SizeOfHeaders);
            OUTPUT("\tCheckSum: 0x%X\n", analyzer.pNtHeaders64->OptionalHeader.CheckSum);
            OUTPUT("\tSubsystem: 0x%X %s\n\n",
                analyzer.pNtHeaders64->OptionalHeader.Subsystem,
                PEHelpers::GetSubsystem(analyzer.pNtHeaders64->OptionalHeader.Subsystem).c_str());
        }
        else {
            // Similar output for 32-bit headers using analyzer.pNtHeaders32
            //if (analyzer.is64Bit) {
            OUTPUT("[+] NT HEADER (32-bit)\n");
            OUTPUT("\tSignature: 0x%X\n\n", analyzer.pNtHeaders32->Signature);

            OUTPUT("[+] FILE HEADER\n");
            OUTPUT("\tMachine: 0x%X\n", analyzer.pNtHeaders32->FileHeader.Machine);
            OUTPUT("\tNumberOfSections: 0x%X\n", analyzer.pNtHeaders32->FileHeader.NumberOfSections);
            OUTPUT("\tTimeDateStamp: 0x%X\n", analyzer.pNtHeaders32->FileHeader.TimeDateStamp);
            OUTPUT("\tPointerToSymbolTable: 0x%X\n", analyzer.pNtHeaders32->FileHeader.PointerToSymbolTable);
            OUTPUT("\tNumberOfSymbols: 0x%X\n", analyzer.pNtHeaders32->FileHeader.NumberOfSymbols);
            OUTPUT("\tSizeOfOptionalHeader: 0x%X\n", analyzer.pNtHeaders32->FileHeader.SizeOfOptionalHeader);
            OUTPUT("\tCharacteristics: 0x%X %s\n\n",
                analyzer.pNtHeaders32->FileHeader.Characteristics,
                PEHelpers::GetImageCharacteristics(analyzer.pNtHeaders32->FileHeader.Characteristics).c_str());

            OUTPUT("[+] OPTIONAL HEADER\n");
            OUTPUT("\tMagic: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.Magic);
            OUTPUT("\tAddressOfEntryPoint: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.AddressOfEntryPoint);
            OUTPUT("\tImageBase: 0x%llX\n", analyzer.pNtHeaders32->OptionalHeader.ImageBase);
            OUTPUT("\tSectionAlignment: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.SectionAlignment);
            OUTPUT("\tFileAlignment: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.FileAlignment);
            OUTPUT("\tMajorOperatingSystemVersion: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.MajorOperatingSystemVersion);
            OUTPUT("\tMinorOperatingSystemVersion: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.MinorOperatingSystemVersion);
            OUTPUT("\tMajorImageVersion: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.MajorImageVersion);
            OUTPUT("\tMinorImageVersion: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.MinorImageVersion);
            OUTPUT("\tMajorSubsystemVersion: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.MajorSubsystemVersion);
            OUTPUT("\tMinorSubsystemVersion: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.MinorSubsystemVersion);
            OUTPUT("\tWin32VersionValue: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.Win32VersionValue);
            OUTPUT("\tSizeOfImage: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.SizeOfImage);
            OUTPUT("\tSizeOfHeaders: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.SizeOfHeaders);
            OUTPUT("\tCheckSum: 0x%X\n", analyzer.pNtHeaders32->OptionalHeader.CheckSum);
            OUTPUT("\tSubsystem: 0x%X %s\n\n",
                analyzer.pNtHeaders32->OptionalHeader.Subsystem,
                PEHelpers::GetSubsystem(analyzer.pNtHeaders32->OptionalHeader.Subsystem).c_str());
            // ... [32-bit header output code]
        }

        ShowProgress(40);

        // Parse Data Directories
        OUTPUT("[+] DATA DIRECTORIES\n");
        const IMAGE_DATA_DIRECTORY* dataDirectories = analyzer.is64Bit ?
            analyzer.pNtHeaders64->OptionalHeader.DataDirectory :
            analyzer.pNtHeaders32->OptionalHeader.DataDirectory;

        for (int i = 0; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++) {
            if (dataDirectories[i].VirtualAddress != 0) {
                OUTPUT("\t%s:\n", PEHelpers::GetDataDirectoryName(i).c_str());
                OUTPUT("\t\tVirtualAddress: 0x%X\n", dataDirectories[i].VirtualAddress);
                OUTPUT("\t\tSize: 0x%X\n", dataDirectories[i].Size);
            }
        }
        OUTPUT("\n");

        ShowProgress(50);

        // Parse Sections
        PEParser::ParseSections(analyzer);
        ShowProgress(60);

        // Parse Import Directory
        PEParser::ParseImportDirectory(analyzer);
        ShowProgress(70);

        // Parse Export Directory
        PEParser::ParseExportDirectory(analyzer);
        ShowProgress(80);

        // Parse Resource Directory
        PEParser::ParseResourceDirectory(analyzer);
        ShowProgress(90);

        // Parse Debug Directory
        PEParser::ParseDebugDirectory(analyzer);

        ShowProgress(100);
        SetStatusText(L"Analysis complete");
        ShowWindow(g_hProgressBar, SW_HIDE);
    }


        //}

        //UpdateEditControl();
    //}

    // new code upto here ending here ^^
    //
    //######################################################################################
    //######################################################################################
    //        ##    endroughxfer - urldump #1#
    //        ##    <EOF><EOF>
    //######################################################################################
    //######################################################################################
        //end adding here



    //filePathW
    //lpFilePath
    HANDLE GetFileContent(const wchar_t* lpFilePath) {
        HANDLE hFile = CreateFileW(lpFilePath, GENERIC_READ, 0, nullptr, OPEN_EXISTING, 0, nullptr);
        if (hFile == INVALID_HANDLE_VALUE) return nullptr;
        DWORD fileSize = ::GetFileSize(hFile, nullptr);
        auto lpFileContent = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, fileSize);
        DWORD bytesRead;
        ReadFile(hFile, lpFileContent, fileSize, &bytesRead, nullptr);
        CloseHandle(hFile);
        return lpFileContent;
    }

    void UpdateEditControl() {
        SetWindowTextW(g_hEditControl, g_OutputText.str().c_str());
        SendMessage(g_hEditControl, EM_SETSEL, -1, -1);
        SendMessage(g_hEditControl, EM_SCROLLCARET, 0, 0);
        }
    }