The order in which PE files are executed

When a PE file is executed, the PE loader first checks the offset of the PE header in the DOS MZ header. If found, jumps directly to the location of the PE header.

When the PE loader jumps to the PE header, the second step is to check if the PE header is valid. If the PE header is valid, jump to the tail of the PE header.

The section table follows the end of the PE header. The PE loader begins reading the section information in the section table after the second step, and uses the file mapping method to map the sections to memory, along with the read and write properties of the specified section in the section.

After the PE file is mapped into memory, the PE loader will continue to process the logical portion of the PE file similar to import table (input tables).

The order in which PE files are executed