1. The check of first two bytes was wrong for PE files.
2. Limit the search to the first 1024 bytes of the files, which
   should be sufficient to match on section names.