I was analyzing win32.ramnit's dropper for fun. Almost all the calls it uses are indirect calls. I have figured out the destination addresses using manual analysis. But how can I add this information to the database? The only option I have now is to add the target address as a comment since it simplifies navigation, but the target function's references won't come up in xrefs this way. And another drawback is, I have to correct all the comments if I change the name of the target function. Is there any right way to do this?

Browse other questions tagged or ask your own question.