search

KuechA / pestudio-cli

Python tool to analyze PE file for patterns used by malware
21 stars 12 forks source link

Dynamically loaded functions #5

Open Osherz5 opened 8 months ago

Osherz5 commented 8 months ago

https://github.com/KuechA/pestudio-cli/blob/638b2a720e4927c214a5e2b52104d35bd7b203f9/xml/functions.xml#L3044

Some of the functions in the list can only be dynamically loaded (ZwQueryInformationProcess for example), does it still make sense to look them up in the import table?