I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like
GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a breakpoint on
GetProcAddress() and I ran it. Then I saw decoded API names like
But I could not find its location in malware I'm analyzing. So, I cannot identify API parameters.
How can I do this?