vverbose output duplicates some lines, sometimes

[williballenthin]

it seems that the vverbose output mode duplicates some lines, sometimes. see this screenshot when running against PMA 01-01:

[williballenthin]

the result document has multiple entries:

so its not that vverbose is wrong, the result document has duplicates.

[williballenthin]

this comes from the rule:

and the fact that we trim the DLL name from API features:

so we end up with logic that looks like:

- or:
  - api: recv
  - api: recv

which is correctly matched and rendered.

to fix, we should deduplicate these features that the rule wants to match.

[williballenthin]

the trimming was introduced here: c9df782
#1824 and #1815

[fariss]

Yeah, I noticed this as well while working on explorer:

Example: the first 2 socket api statements in "create TCP socket": https://mandiant.github.io/capa/explorer/#/?rdoc=https://raw.githubusercontent.com/mandiant/capa-testfiles/master/rd/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json.gz