I'm disassembling a shellcode and I found that it resolves adress of some function manually using the hash to find function in kernel32.dll. example :
call findKernel32Base .... push 0EC0E4E8Eh call findSymbolByHash mov [ebp-4], eax
For this example the function resolved is LoadLibraryA, I found it by searching the hash on google but what if I don't find it on google ? How can I find the function related to the hash value without debugging the shellcode ( some manually resolve failed when I debug it so it crash ) ?
Thank you !