insn.py: Get the symtab api extractor to yield FunctionName features …

…as well
mandiant · Apr 23, 2023 · b32a8ca · b32a8ca
1 parent b766d95
commit b32a8ca
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/capa/features/extractors/viv/insn.py b/capa/features/extractors/viv/insn.py
@@ -19,6 +19,7 @@
 
 import capa.features.extractors.helpers
 import capa.features.extractors.viv.helpers
+from capa.features.file import FunctionName
 from capa.features.insn import API, MAX_STRUCTURE_SIZE, Number, Offset, Mnemonic, OperandNumber, OperandOffset
 from capa.features.common import MAX_BYTES_FEATURE_SIZE, THUNK_CHAIN_DEPTH_DELTA, Bytes, String, Feature, Characteristic
 from capa.features.address import Address, AbsoluteVirtualAddress
@@ -148,6 +149,7 @@ def extract_insn_api_features(fh: FunctionHandle, bb, ih: InsnHandle) -> Iterato
                 STT_FUNC = 0x2
                 if sym_value == target and sym_info & STT_FUNC != 0:
                     yield API(sym_name), ih.address
+                    yield FunctionName(sym_name), ih.address
 
         for _ in range(THUNK_CHAIN_DEPTH_DELTA):
             if target in imports: