ngioweb - step2 - [x32dbg] resolve obfuscated API calls.py

__result__ = list()

for item in __extern__:
    ref = item['ref']
    push_args_list = item['push_args_list']

    # prepare stack
    for i in range(len(push_args_list), 0, -1):
        ll.api.Register_SetEIP(push_args_list[i - 1])
        ll.api.Debug_StepOver()

    # call the API resolver routine
    ll.api.Register_SetEIP(ref)
    ll.api.Debug_StepOver()
    # get the address of resolved function from EAX
    eax = ll.api.Register_GetEAX()

    # something went wrong
    if not eax:
        continue

    api_name = ll.api.DbgGetLabelAt(eax, ll.api.SEG_DEFAULT)
    if api_name:
        __result__.append({'ref': ref, 'api_name': api_name})