The windows loader assumes that every valid binary will import KERNEL32.DLL. Once the loader, which resides in NTDLL.DLL, has loaded all the required modules, execution jumps to an address that resides inside KERNEL32.DLL. This code does the final setup before reaching an instruction that passes execution through to the binaries entry point. On Window 2000 ...

When an executable is first loaded, the Windows loader is responsible for reading in the files PE structure and loading the executable image into memory. One of the other key processes it handles, is to load all of the dlls that the application uses and map them into the process address space. Within a ...