I have memory dump of injected process. But the malware load libraries/functions dynamically and I need to resolve this. For example, If malware will use createThread, first get address of this function with getprocaddress then kept the pointer into a variable. To call function use variable.
So I need to resolve dynamic addresses to disassemble. How can I do it?