Fixing the import table

Now, you may be wondering: what happens to the import table that needs to be fixed? The answer is: when the PE file gets loaded in the process memory or the unpacker stub loads the import table, the loader goes through the Import Table header from the Data Directory (you may need to read Chapter 2, Basic Static and Dynamic Analysis for x86/x64, again to fully understand this) and populates it with the actual addresses of API functions from DLLs that are available on the machine:

Figure 18: Import table before and after PE loading

After this, these API addresses are used to acccess these APIs throughout the application code, usually by using call and jmp instructions:

Figure 19: Examples of different API calls

To unload the import table, we need to find this list of API addresses, find which API each address represents (we need to go through each library list of addresses and their corresponding API names for this), and then replace each of these addresses with...