Copy the existing import table's 50h bytes pointed to at offset @:00000140 giving us @:00001078 and paste them at offset @:00002250 We do not need to correct the pointers in the table as the pointers are VA's.

Change the Import Table's location pointer to point to our new location, so at offset @:00000140 we change it as follows:

RVA 2250 == VA 00405050
VA offset == VA 00405050 minus Imagebase == 00005050

and as we're adding one entry to the import table the size will increase with 20 bytes, and we correct the size as follows:
50h + 14h == 64h (Original size + 5DWords)

I decided to place my jump table at offset @:000022d8

First we find the address of the Original First thunk entry which shows to the API name, then we need to get the VA for the Thunk entry:

So for LoadLibraryA we get name entry at (remember to include the hint bytes)

 i. On program startup, my function "Initt", to write the recent files in a recent menu list if any recent files exist in the registry, I decided to have only three recent entries
 ii. Upon successfully opening of a file through the Load menu, my function "Load", to update the recent file list saved in registry
 iii. Upon selection of one of the recent menu tabs, my function "GetReg", to open the selected recent menu tab's file

i. With SI bpx GetModuleHandleA and start RVA. SI break, F11 till we are in RVA memory space then single step. I decided to update my menu just after the SetMenu call and jumped to our code as follows:

* Reference To: USER32.SetMenu, Ord:0231h
                                                                 |
:004010B0  E899090000		Call 00401A4E
:004010B5  E936400000		jmp 004050F0		;our code to call MRU.dll

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405124(U)

:004010BA  FF7508		 push [ebp+08]		;we return to this line

* Reference To: USER32.GetDlgItem, Ord:0100h
                                                                  |
:004010BD E85C090000		 Call 00401A1E

ii. With SI bpx GetOpenFileNameA and from the Load menu open a file. SI break, F11 select a file to open and enter, we are back in SI again. If we closely follow what happen here we see that there are tests done to see if the selected file is valid win32 file etc, I stepped through all the tests and decided to update the recent file list just after it was determined that the selected file is a valid file and then jump to our code as follows:

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401197(C)

:004011B1  E9793F0000			 jmp 0040512F	;our code to call the MRU.dll

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405163(U)

:004011B6  FF7508			 push [ebp+08]	;we return to this line

* Reference To: USER32.GetDlgItem, Ord:0100h
                                                                                   |
:004011B9  E860080000			 Call 00401A1E

iii. When we select a file from the recent menu tab we want to fake a GetOpenFileNameA but not execute the API. What I did here was first to see if the menu selected was the Load menu tab or one of our Recent tabs. When we see it was from the Load menu we proceed as normal and execute the GetOpenFileNameA API. When it was from one of our menu tabs then we need to execute the code right up to the API but retrieve the Menu's FileName from registry and copy the FileName to the position where GetOpenFileNameA would have done. Here follow my coding of the relevant routines:

  * Referenced by a CALL at Address:
|:0040116F
|
:004017AC C705213040004C000000	 mov dword ptr [00403021], 0000004C
:004017B6 FF3507304000		 push dword ptr [00403007]
:004017BC 8F0529304000		 pop dword ptr [00403029]

* Possible StringData Ref from Data Obj ->"EXE, DLL"
|
:004017C2  C7052D304000AD314000	 mov dword ptr [0040302D], 004031AD
:004017CC  C7053D30400054324000	 mov dword ptr [0040303D], 00403254 ;address of opened
 							;file's name
:004017D6  C7054130400004010000	 mov dword ptr [00403041], 00000104
:004017E0  C7055530400004182800	 mov dword ptr [00403055], 00281804
:004017EA  6821304000			 push 00403021
:004017EF  E9D5390000			 jmp 004051C9&	;jump to our code
:004017F4  83F801			 cmp eax, 00000001 ;was file open successfully
:004017F7  757B				 jne 00401874	;jump away if unsuccessful

My code in RVA.exe's .reloc section to call the MRU.dll and handle all recent menu entries and retrievals:

:004050F0  60				 pushad		;save all registers
:004050F1  6800504000			 push 00405000	;our dll's name
:004050F6  E8DDFFFFFF			 call LoadLibraryA
:004050FB  89C3				 mov ebx, eax	;save .dll's handle
:004050FD  6808504000			 push 00405008	;function "Initt"
:00405102  50				 push eax	;.dll's handle
:00405103  E8D6FFFFFF			 call GetProcAddress
:00405108  85C0				 test eax, eax	;test if function found
:0040510A  740F				 je 0040511B	;return if failed
:0040510C  8B7D08			 mov edi, dword ptr [ebp+08]  ;save our window
							;handle for use in .dll
:0040510F  FFD0				 call eax		;call our function
:00405111  53				 push ebx	;.dll's handle
:00405112  E8CDFFFFFF			 call FreeLibraryA
:00405117  85C0				 test eax, eax	;test if successful
:00405119  7400				 je 0040511B	;future error routine
:0040511B  83EC34			 sub esp, 00000034 ;correct the stack
:0040511E  61				 popad		;restore registers
:0040511F  68B90B0000			 push 00000BB9	;replace overwritten instruction
:00405124  E991BFFFFF			 jmp 004010BA	;and continue
:00405129  000000000000		 BYTE 6 DUP(0)

:0040512F  60			 pushad			;save all registers
:00405130  6800504000		 push 00405000		;.dll's name
:00405135  E89EFFFFFF		 call LoadLibraryA
:0040513A  89C3			 mov ebx, eax		;save .dll's handle
:0040513C  6845504000		 push 00405045		;"Load" function
:00405141  50			 push eax		;.dll's handle
:00405142  E897FFFFFF		 call GetProcAddress
:00405147  85C0			 test eax, eax		;test if successfull
:00405149  740F			 je 0040515A		;jump if failed
:0040514B  8B7D08		 mov edi, dword ptr [ebp+08] ;our window's handle for use in .dll
:0040514E  FFD0			 call eax			;function "Load"
:00405150  53			 push ebx		;.dll's handle
:00405151  E88EFFFFFF		 call FreeLibrary
:00405156  85C0			 test eax, eax		;test if failed
:00405158  7400			 je 0040515A		;future error routine
:0040515A  83EC34		 sub esp,00000034	;correct the stack
:0040515D  61			 popad			;restore registers
:0040515E  68B90B0000		 push 00000BB9		;replace overwritten instruction
:00405163  E94EC0FFFF		 jmp 004011B6		;and continue

Test to see if it was one of the tabs to invoke a GetOpenFileName

:00405168  663D007D		 cmp ax, 7D00		;check if Load menu
:0040516C  0F84FDBFFFFF	 je 0040116F		;continue if true
:00405172  663D7905		 cmp ax, 0579		;check if one of
:00405176  724C			 jb 004051C4		;our recent tabs
:00405178  663D7B05		 cmp ax, 057B		;and continue
:0040517C  7746			 ja 004051C4		;if not...
:0040517E  E9ECBFFFFF		 jmp 0040116F		;if one of our recent tabs, continue
							;towards GetOpenFileNameA API

:00405183 60			 pushad			;save all registers
:00405184 8BF8			 mov edi, eax		;eax contains menu ID
:00405186 6800504000		 push 00405000		;our dll's name
:0040518B E848FFFFFF		 call LoadLibraryA
:00405190 89C3			 mov ebx, eax		;save .dll's handle
:00405192 6810504000		 push 00405010		"GetReg" function
:00405197 50			 push eax		;dll's handle
:00405198 E841FFFFFF		 call GetProcAddress
:0040519D 85C0			 test eax, eax		;test if failed
:0040519F 740F			 je 004051B0		;jump away if failed
:004051A1 83EC00		 sub esp, 00000000	;unused bytes
:004051A4 FFD0			 call eax			;Call our function
:004051A6 50			 push eax		;eax contains address of retrieved
							;FileName from registry
:004051A7  6854324000		 push 00403254		;address of opened filename from
							;GetOpenFileNameA
:004051AC E8EBC8FFFF		 call lstrcpyA
:004051B1 53 			 push ebx		;our .dll's handle
:004051B2 E82DFFFFFF		 call FreeLibrary
:004051B7 85C0			 test eax, eax		;test if failed
:004051B9 7400			 je 004051BB		;future error routine
:004051BB 61			 popad			;restore registers
:004051BC 83C404		 add esp, 00000004	;correct stack
:004051BF E935C6FFFF		 jmp 004017F9		;and continue at the code right after the
							; original GetOpenFileNameA API
:004051C4 E970C0FFFF		 jmp 00401239

:004051C9 663D007D		 cmp ax, 7D00		;was it from Load menu
:004051CD 75B4			 jne 00405183		;if not then it was one of the recent tabs
:004051CF E8D4C8FFFF		 call GetOpenFileNameA
:004051D4 83F801		 cmp eax, 00000001	;test if failed
:004051D7 0F8597C6FFFF	 jne 00401874		;error message
:004051DD E917C6FFFF		 jmp 004017F9 		;success and continue

Proloque: Many thanx goes to Harlequin for all his patience and time, I really appreciate it brother...:)) and to all the guys spending time writing essays for us to learn and understand...:))