Support Parsing VMRay Log flog.txt for capa

[r0ny123]

Following up on the recent discussion, I suggest adding support for capa to parse the flog.txt file from the VMRay sandbox output. Since this file is freely available for download, it would help make capa more accessible to those who can’t get the full ZIP archive. While XML is easier to parse, supporting flog.txt would be a great addition.

[williballenthin]

Example of accessing a free log: VMRay website -> threat feed -> select entry -> full report -> Download Function Log

I'm not sure if these reports are indexed and easy to search for without a subscription.

the flog.txt file contains a list of process entries, each with a bunch of Region entries, like:

and then Thread entries, that look like an API trace:

its pretty unstructured, but can probably be parsed somewhat easily. The first example file I pulled was 11MB and 120k lines.

[williballenthin]

initial experiments over here: https://github.com/mandiant/capa/compare/feat/vmray-flog