Dynamic API calling is a famous anti-disassembling trick used by many malware families. The main reason behind using it is that this way, they hide API names from static analysis tools and make it harder to understand what each function inside the malware does.
For a malware author to implement this trick, they need to pre-calculate a checksum for this API name and push this value as an argument to a function that scans export tables of different libraries and searching for an API by this checksum. An example of this is shown in the following screenshot:
The code for resolving the function actually goes through the PE header of the library, loops through the import table, and calculates the checksum of each API to compare it with the given checksum (or hash) that's provided as an argument.
The solution to this approach could require scripting to loop through all known API names and calculate...
