Actually, Windows (Update) is quite capable of hotpatching in-memory code. That why you can find two "mov eax, eax" instructions at the start of some functions.

Actually, Windows (Update) is quite capable of hotpatching in-memory code. That why you can find two "mov eax, eax" instructions at the start of some functions. They allow hotpatching a long jmp there.