In case of import recovery, libPeConv is supposed to first search if the appropriate imports' names are already present in the binary, and if so, to use them and write them back to the destroyed thunks.
However, there is a bug that causes that sometimes the appropriate names are not found, although they are present.
The invalid situation:
The last thunk is filled with an ordinal (this happens if the name was not found).
The imported address belongs to the function WaitForSingleObject:
Looking into the binary, we can see that the proper record containing this name is present:
In case of import recovery, libPeConv is supposed to first search if the appropriate imports' names are already present in the binary, and if so, to use them and write them back to the destroyed thunks. However, there is a bug that causes that sometimes the appropriate names are not found, although they are present.
WaitForSingleObject
: Looking into the binary, we can see that the proper record containing this name is present: