ida: insn: ignore numbers when SIB present

capa/features/extractors/ida/helpers.py

@@ -382,3 +382,8 @@ def get_function_blocks(f):
 def is_basic_block_return(bb):
     """check if basic block is return block"""
     return bb.type == idaapi.fcb_ret
+
+
+def has_sib(oper) -> bool:
+    # via: https://reverseengineering.stackexchange.com/a/14300
+    return oper.specflag1 == 1

capa/features/extractors/ida/insn.py

@@ -218,7 +218,12 @@ def extract_insn_offset_features(f, bb, insn):
         yield Offset(op_off), insn.ea
         yield OperandOffset(i, op_off), insn.ea
 
-        if insn.itype == idaapi.NN_lea and i == 1 and op.type == idaapi.o_displ:
+        if (
+            insn.itype == idaapi.NN_lea
+            and i == 1
+            and op.type == idaapi.o_phrase
+            and not capa.features.extractors.ida.helpers.has_sib(op)
+        ):
             # for pattern like:
             #
             #     lea eax, [ebx + 1]