Having identified the reference to the CreateFileA function, let's try to identify cross-references to (Xrefs to) the CreateFileA function; this will give us all the addresses where CreateFileA is called from. The following script builds on the previous script and identifies the cross-references to the CreateFileA function:
import idcimport idautilsea = idc.get_name_ea_simple("CreateFileA")if ea != idaapi.BADADDR: for ref in idautils.CodeRefsTo(ea, 1): print hex(ref), idc.generate_disasm_line(ref,0)
The following is the output generated as a result of running the preceding script. The output displays all of the instructions that call the CreateFileA API function:
0x401161 call ds:CreateFileA ...