in nightMARE/src/nightmare/malware/icedid/custom_pe.py [0:0]
def __load_imports(self, library: ctypes.c_void_p, thunks: ctypes.POINTER) -> None:
i = 0
while True:
if not thunks[i].AddressOfData:
break
ordinal_bit = 2 ** (31 if self.__custom_pe.is_32 else 63)
if ordinal_bit & thunks[i].AddressOfData:
import_name = thunks[i].AddressOfData & (ordinal_bit - 1)
else:
import_name = ctypes.cast(
self.__base_address + thunks[i].AddressOfData + OFFSET_TO_NAME,
ctypes.c_char_p,
)
function = win32.get_GetProcAddress()(library, import_name)
if not function:
raise RuntimeError(
"GetProcAddress of {} Failed. GLE={}".format(
import_name, win32.get_GetLastError()()
)
)
thunks[i].Function = function
i += 1