mirror of
https://github.com/mandiant/capa.git
synced 2026-07-03 19:35:04 -07:00
5e19574ba9
The previous implementation rebuilt a `defaultdict` mapping byte prefixes to extracted feature values inside `_match()`, which is called per function/basic-block/instruction. Moving the rule-side index build to `_index_rules_by_feature()` (called once at RuleSet construction) eliminates this per-call allocation and O(R) rule iteration from the hot path. `_match()` now looks up candidate rules via the pre-built `bytes_prefix_index` stored in `_RuleFeatureIndex`, iterating only extracted byte features to compute their prefixes.