detect user code via entry points (main function name)

capa/analysis/libraries.py

@@ -50,6 +50,7 @@ class Method(str, Enum):
     FLIRT = "flirt"
     STRINGS = "strings"
     THUNK = "thunk"
+    ENTRYPOINT = "entrypoint"
 
 
 class FunctionClassification(BaseModel):
@@ -174,6 +175,20 @@ def main(argv=None):
                     )
                 )
 
+        for va in idautils.Functions():
+            name = idaapi.get_func_name(va)
+            if name not in {"WinMain", }:
+                continue
+
+            function_classifications.append(
+                FunctionClassification(
+                    va=va,
+                    name=name,
+                    classification=Classification.USER,
+                    method=Method.ENTRYPOINT,
+                )
+            )
+
         doc = FunctionIdResults(function_classifications=[])
         classifications_by_va = capa.analysis.strings.create_index(function_classifications, "va")
         for va in idautils.Functions():