fix: omit trailing ' -> ' suffix in syscall call names when no return value

DrakvufExtractor.get_call_name always appended ' -> ' even for SystemCall
objects that have no return_value attribute, because f" -> {''}" still
produces the literal ' -> ' string. Conditionally build the suffix only
when a non-empty return value exists.

tests/test_drakvuf_models.py

@@ -14,7 +14,14 @@
 
 import json
 
-from capa.features.extractors.drakvuf.models import SystemCall, ConciseModel
+from capa.features.address import ThreadAddress, ProcessAddress, DynamicCallAddress
+from capa.features.extractors.base_extractor import (
+    CallHandle,
+    ThreadHandle,
+    ProcessHandle,
+)
+from capa.features.extractors.drakvuf.models import SystemCall, WinApiCall, ConciseModel, DrakvufReport
+from capa.features.extractors.drakvuf.extractor import DrakvufExtractor
 
 
 def test_concise_model_ignores_extra_fields():
@@ -60,3 +67,83 @@ def test_syscall_argument_construction():
     assert call.arguments["NumEntriesRemoved"] == "0xfffff506a02846bc"
     assert call.arguments["Timeout"] == "0xfffff506a02846d8"
     assert call.arguments["Alertable"] == "0x0"
+
+
+def _make_call_handle(call):
+    proc_addr = ProcessAddress(pid=1, ppid=0)
+    thread_addr = ThreadAddress(process=proc_addr, tid=1)
+    call_addr = DynamicCallAddress(thread=thread_addr, id=0)
+    return CallHandle(address=call_addr, inner=call)
+
+
+def _make_extractor():
+    return DrakvufExtractor(report=DrakvufReport())
+
+
+def _make_process_handle():
+    proc_addr = ProcessAddress(pid=1, ppid=0)
+    return ProcessHandle(address=proc_addr, inner={})
+
+
+def _make_thread_handle():
+    proc_addr = ProcessAddress(pid=1, ppid=0)
+    thread_addr = ThreadAddress(process=proc_addr, tid=1)
+    return ThreadHandle(address=thread_addr, inner={})
+
+
+def test_get_call_name_syscall_has_no_return_value_suffix():
+    call_dict = json.loads(r"""
+        {
+            "Plugin": "syscall",
+            "TimeStamp": "1716999134.581449",
+            "PID": 3888,
+            "PPID": 2852,
+            "TID": 368,
+            "UserName": "SessionID",
+            "UserId": 2,
+            "ProcessName": "\\Device\\HarddiskVolume2\\Windows\\explorer.exe",
+            "Method": "NtClose",
+            "EventUID": "0x1f",
+            "Module": "nt",
+            "vCPU": 0,
+            "CR3": "0x119b1002",
+            "Syscall": 15,
+            "NArgs": 1,
+            "Handle": "0xffffffff80001ac0"
+        }
+        """)
+    call = SystemCall(**call_dict)
+    extractor = _make_extractor()
+    ph = _make_process_handle()
+    th = _make_thread_handle()
+    ch = _make_call_handle(call)
+
+    name = extractor.get_call_name(ph, th, ch)
+
+    assert " -> " not in name
+    assert name == "NtClose(Handle=0xffffffff80001ac0)"
+
+
+def test_get_call_name_winapicall_includes_return_value():
+    call_dict = {
+        "Plugin": "apimon",
+        "TimeStamp": "1716999134.581449",
+        "PID": 3888,
+        "PPID": 2852,
+        "TID": 368,
+        "ProcessName": "explorer.exe",
+        "Method": "CreateFileW",
+        "Event": "api_called",
+        "Arguments": ["hFile=0x1234"],
+        "ReturnValue": "0x5678",
+    }
+    call = WinApiCall(**call_dict)  # type: ignore[arg-type]  # dict literal infers object values due to mixed str/list types
+    extractor = _make_extractor()
+    ph = _make_process_handle()
+    th = _make_thread_handle()
+    ch = _make_call_handle(call)
+
+    name = extractor.get_call_name(ph, th, ch)
+
+    assert " -> 0x5678" in name
+    assert name == "CreateFileW(hFile=0x1234) -> 0x5678"