more malformations explained. pe header location check in coffheaderscanning added.