diff --git a/capa/features/extractors/helpers.py b/capa/features/extractors/helpers.py index f6d91333b..24eee27bd 100644 --- a/capa/features/extractors/helpers.py +++ b/capa/features/extractors/helpers.py @@ -52,6 +52,9 @@ def generate_symbols(dll: str, symbol: str) -> Iterator[str]: - CreateFileA - CreateFile """ + # normalize dll name + dll = dll.lower() + # kernel32.CreateFileA yield "%s.%s" % (dll, symbol) diff --git a/capa/features/insn.py b/capa/features/insn.py index 85ef9a399..4843d95c4 100644 --- a/capa/features/insn.py +++ b/capa/features/insn.py @@ -12,11 +12,6 @@ class API(Feature): def __init__(self, name: str, description=None): - # Downcase library name if given - if "." in name: - modname, _, impname = name.rpartition(".") - name = modname.lower() + "." + impname - super(API, self).__init__(name, description=description)