sequence: better collect sequence-related addresses from Range statem…

…ents
mandiant · Jan 16, 2025 · 55d2049 · 55d2049
1 parent f54cc7e
commit 55d2049
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/capa/render/vverbose.py b/capa/render/vverbose.py
@@ -328,6 +328,13 @@ def collect_sequence_locations(
             child_mode = MODE_FAILURE if mode == MODE_SUCCESS else MODE_SUCCESS
             for child in match.children:
                 yield from collect_sequence_locations(child, child_mode)
+        elif isinstance(match.node.statement, rd.RangeStatement):
+            for location in match.locations:
+                if location.type not in (frz.AddressType.CALL, ):
+                    continue
+                if mode == MODE_FAILURE:
+                    continue
+                yield location
         else:
             for child in match.children:
                 yield from collect_sequence_locations(child, mode)