I'm trying to understand how Windows is resolving functions with the IAT.
I have noticed that when a call is made to a Win API function, the structure of that call is not always the same (it's still consistent inside a binary, but not between two differents binary).
Sometime, if i follow the target address of that call, i find a jump to the resolved Win API function. And sometime, it's directly a call to the resolved function.
the binary A is using call like :
the binary B is calling like that:
call GetSystemDirectoryW -> jmp ds:__imp_GetSystemDirectoryW
Can someone explain me the this difference in the calling procedure ?