Learning Malware Analysis

5.2.1 Checking The Presence Of CreateFile API

If you recall, upon disassembly, IDA tries to identify whether the disassembled function is a library function or an import function by using pattern matching algorithms. It also derives the list of names from the symbol table; such derived names can be accessed by using the Names window (via View | Open subview | Names or Shift + F4). The Names window contains the list of imported, exported, and library functions, and named data locations. The following screenshot displays the CreateFileA API functions in the Names window:

You can also programmatically access the named items. The following IDAPython ...