Question

I have dumped a Windows SDK .lib file (kernel32.lib) with DUMPBIN, the output show me that there are two “versions” for every API name, for example:

_imp_ExitProcess@4

and

_ExitProcess@4

So, why there are two of the same with different name mangling? .
Let say i want to call ExitProcess from NASM, wich of them should i use when declare EXTERN?, mi practice shows me that i can call any of them but i don’t know which one is the “correct” or the “prefered” to stick with it.

Answer 1

I think the _imp_ version is meant to be used with __declspec(dllimport) on Visual C++ compilers to prevent potential conflicts with code in the same module.

You’re not supposed to use that fact explicitly in your code — just use the original function, i.e. _ExitProcess@4.