InitSguilData

decompiled_code:
__int64 __fastcall InitSguilData(__int64 a1)
{
__int64 v1; // r12

v1 = SnortAlloc(48LL);
if ( !a1 )
{
ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
FatalError(&unk_15E2);
}
*(_QWORD *)(v1 + 40) = SnortStrdup(a1);
return v1;
}

canonical_decompiled_code:
__int64 __fastcall func9(__int64 a1)
{
__int64 v1; // r12

v1 = SnortAlloc(48LL);
if ( !a1 )
{
ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
FatalError(&unk_15E2);
}
*(_QWORD *)(v1 + 40) = SnortStrdup(a1);
return v1;
}

original_code:
SpoSguilData *InitSguilData(char *args)
{
 SpoSguilData *data;
    data = (SpoSguilData *)SnortAlloc(sizeof(SpoSguilData));
 if (args == ((void *)0))
 {
  ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
  FatalError("");
 }
 data->args = SnortStrdup(args);
 return data;
}

canonical_original_code:
struct _SpoSguilData *InitSguilData(char *args)
{
 struct _SpoSguilData *data;
    data = (struct _SpoSguilData *)SnortAlloc(sizeof(SpoSguilData));
 if (args == ((void *)0))
 {
  ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
  FatalError("");
 }
 data->args = SnortStrdup(args);
 return data;
}

variable_types:
args
char *

return_type: struct _SpoSguilData { char *sensor_name; char *tag_path; char *passwd; unsigned int sensor_id; unsigned int event_id; unsigned int agent_port; int agent_sock; char *args; } *


SguilInit

decompiled_code:
__int64 __fastcall SguilInit(__int64 a1)
{
__int64 v1; // rax

DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 136;
DebugMessageFunc(4LL, "Output: Sguil initialized\n");
ErrorMessage("sguil: Tcl support is not compiled into this build of barnyard2\n\n");
FatalError(
"If this build of barnyard was obtained as a binary distribution (e.g., rpm,\n"
"or Windows), then check for alternate builds that contains the necessary Tcl\n"
"support.\n"
"\n"
"If this build of barnyard was compiled by you, then re-run the ./configure\n"
"script using the '--with-tcl' switch to specify the location of the\n"
"tclConfig.sh for your system.\n"
"\n");
v1 = InitSguilData(a1);
return AddFuncToPostConfigList(SguilInitFinalize, v1);
}

canonical_decompiled_code:
__int64 __fastcall func10(__int64 a1)
{
__int64 v1; // rax

DebugMessageFile = "spo_sguil.c";
DebugMessageLine = 136;
DebugMessageFunc(4LL, "Output: Sguil initialized\n");
ErrorMessage("sguil: Tcl support is not compiled into this build of barnyard2\n\n");
FatalError(
"If this build of barnyard was obtained as a binary distribution (e.g., rpm,\n"
"or Windows), then check for alternate builds that contains the necessary Tcl\n"
"support.\n"
"\n"
"If this build of barnyard was compiled by you, then re-run the ./configure\n"
"script using the '--with-tcl' switch to specify the location of the\n"
"tclConfig.sh for your system.\n"
"\n");
v1 = func9(a1);
return AddFuncToPostConfigList(SguilInitFinalize, v1);
}

original_code:
void SguilInit(char *args)
{
 SpoSguilData *ssd_data;
    DebugMessageFile = "spo_sguil.c"; DebugMessageLine = 136; DebugMessageFunc(0x00000004, "Output: Sguil initialized\n");;
    ErrorMessage("sguil: Tcl support is not compiled into this build of barnyard2\n\n");
    FatalError("If this build of barnyard was obtained as a binary distribution (e.g., rpm,\n"
               "or Windows), then check for alternate builds that contains the necessary Tcl\n"
               "support.\n\n"
               "If this build of barnyard was compiled by you, then re-run the ./configure\n"
               "script using the '--with-tcl' switch to specify the location of the\n"
      "tclConfig.sh for your system.\n\n");
 ssd_data = InitSguilData(args);
 AddFuncToPostConfigList(SguilInitFinalize, ssd_data);
}

canonical_original_code:
void SguilInit(char *args)
{
 struct _SpoSguilData *ssd_data;
    DebugMessageFile = "spo_sguil.c"; DebugMessageLine = 136; DebugMessageFunc(0x00000004, "Output: Sguil initialized\n");;
    ErrorMessage("sguil: Tcl support is not compiled into this build of barnyard2\n\n");
    FatalError("If this build of barnyard was obtained as a binary distribution (e.g., rpm,\n"
               "or Windows), then check for alternate builds that contains the necessary Tcl\n"
               "support.\n\n"
               "If this build of barnyard was compiled by you, then re-run the ./configure\n"
               "script using the '--with-tcl' switch to specify the location of the\n"
      "tclConfig.sh for your system.\n\n");
 ssd_data = InitSguilData(args);
 AddFuncToPostConfigList(SguilInitFinalize, ssd_data);
}

variable_types: struct _SpoSguilData { char *sensor_name; char *tag_path; char *passwd; unsigned int sensor_id; unsigned int event_id; unsigned int agent_port; int agent_sock; char *args; } *

return_type: void


ParseSguilArgs

decompiled_code:
__int64 __fastcall ParseSguilArgs(__int64 a1)
{
__int64 v2; // rdi
__int64 v3; // rax
__int64 v4; // rsi
__int64 v5; // rbp
__int64 v6; // rbx
const unsigned __int16 **v7; // r13
const char *i; // rbp
const char *v9; // r15
const char **v10; // r14
unsigned int v11; // ebp
__int64 result; // rax
__int64 v13; // rax
__int64 v14; // rax
__int64 v15; // rax
int v16; // [rsp+8h] [rbp-50h] BYREF
int v17; // [rsp+Ch] [rbp-4Ch] BYREF
__int64 v18; // [rsp+10h] [rbp-48h] BYREF
const char **v19; // [rsp+18h] [rbp-40h] BYREF

v2 = *(_QWORD *)(a1 + 40);
if ( !v2 )
{
ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
FatalError(&unk_15E2);
v2 = *(_QWORD *)(a1 + 40);
}
*(_WORD *)(a1 + 32) = 0;
v3 = mSplit(v2, ", ", 31LL, &v16, 92LL);
v4 = (unsigned int)v16;
v18 = v3;
v5 = v3;
if ( v16 > 0 )
{
v6 = 0LL;
v7 = _ctype_b_loc();
while ( 1 )
{
for ( i = *(const char **)(v5 + 8 * v6); ((*v7)[*i] & 0x2000) != 0; ++i )
;
v19 = (const char **)mSplit(i, "=", 2LL, &v17, 0LL);
v9 = *v19;
v10 = v19;
if ( !strncasecmp(*v19, "agent_port", 0xAuLL) )
{
v11 = v17;
if ( v17 <= 1 )
{
LogMessage("sguil: agent_port error\n");
v11 = v17;
}
else
{
*(_WORD *)(a1 + 32) = atoi(v10[1]);
}
}
else if ( !strncasecmp(v9, "tag_path", 8uLL) )
{
if ( v17 <= 1 || *(_QWORD *)(a1 + 8) )
{
LogMessage("sguil: tag_path error\n");
v11 = v17;
}
else
{
v13 = SnortStrdup(v10[1]);
v11 = v17;
*(_QWORD *)(a1 + 8) = v13;
}
}
else if ( !strncasecmp(v9, "sensor_name", 0xBuLL) )
{
if ( v17 <= 1 || *(_QWORD *)a1 )
{
LogMessage("sguil: sensor_name error\n");
v11 = v17;
}
else
{
v15 = SnortStrdup(v10[1]);
v11 = v17;
*(_QWORD *)a1 = v15;
}
}
else if ( !strncasecmp(v9, "passwd", 6uLL) )
{
if ( v17 <= 1 || *(_QWORD *)(a1 + 16) )
{
LogMessage("sguil: passwd error\n");
v11 = v17;
}
else
{
v14 = SnortStrdup(v10[1]);
v11 = v17;
*(_QWORD *)(a1 + 16) = v14;
}
}
else
{
LogMessage("sguil: unrecognised argument = %s\n", i);
v11 = v17;
}
++v6;
mSplitFree(&v19, v11);
v4 = (unsigned int)v16;
if ( v16 <= (int)v6 )
break;
v5 = v18;
}
}
result = mSplitFree(&v18, v4);
if ( !*(_WORD *)(a1 + 32) )
{
result = 7735LL;
*(_WORD *)(a1 + 32) = 7735;
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func11(__int64 a1)
{
__int64 v2; // rdi
__int64 v3; // rax
__int64 v4; // rsi
__int64 v5; // rbp
__int64 v6; // rbx
const unsigned __int16 **v7; // r13
const char *i; // rbp
const char *v9; // r15
const char **v10; // r14
unsigned int v11; // ebp
__int64 result; // rax
__int64 v13; // rax
__int64 v14; // rax
__int64 v15; // rax
int v16; // [rsp+8h] [rbp-50h] BYREF
int v17; // [rsp+Ch] [rbp-4Ch] BYREF
__int64 v18; // [rsp+10h] [rbp-48h] BYREF
const char **v19; // [rsp+18h] [rbp-40h] BYREF

v2 = *(_QWORD *)(a1 + 40);
if ( !v2 )
{
ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
FatalError(&unk_15E2);
v2 = *(_QWORD *)(a1 + 40);
}
*(_WORD *)(a1 + 32) = 0;
v3 = mSplit(v2, ", ", 31LL, &v16, 92LL);
v4 = (unsigned int)v16;
v18 = v3;
v5 = v3;
if ( v16 > 0 )
{
v6 = 0LL;
v7 = _ctype_b_loc();
while ( 1 )
{
for ( i = *(const char **)(v5 + 8 * v6); ((*v7)[*i] & 0x2000) != 0; ++i )
;
v19 = (const char **)mSplit(i, "=", 2LL, &v17, 0LL);
v9 = *v19;
v10 = v19;
if ( !strncasecmp(*v19, "agent_port", 0xAuLL) )
{
v11 = v17;
if ( v17 <= 1 )
{
LogMessage("sguil: agent_port error\n");
v11 = v17;
}
else
{
*(_WORD *)(a1 + 32) = atoi(v10[1]);
}
}
else if ( !strncasecmp(v9, "tag_path", 8uLL) )
{
if ( v17 <= 1 || *(_QWORD *)(a1 + 8) )
{
LogMessage("sguil: tag_path error\n");
v11 = v17;
}
else
{
v13 = SnortStrdup(v10[1]);
v11 = v17;
*(_QWORD *)(a1 + 8) = v13;
}
}
else if ( !strncasecmp(v9, "sensor_name", 0xBuLL) )
{
if ( v17 <= 1 || *(_QWORD *)a1 )
{
LogMessage("sguil: sensor_name error\n");
v11 = v17;
}
else
{
v15 = SnortStrdup(v10[1]);
v11 = v17;
*(_QWORD *)a1 = v15;
}
}
else if ( !strncasecmp(v9, "passwd", 6uLL) )
{
if ( v17 <= 1 || *(_QWORD *)(a1 + 16) )
{
LogMessage("sguil: passwd error\n");
v11 = v17;
}
else
{
v14 = SnortStrdup(v10[1]);
v11 = v17;
*(_QWORD *)(a1 + 16) = v14;
}
}
else
{
LogMessage("sguil: unrecognised argument = %s\n", i);
v11 = v17;
}
++v6;
mSplitFree(&v19, v11);
v4 = (unsigned int)v16;
if ( v16 <= (int)v6 )
break;
v5 = v18;
}
}
result = mSplitFree(&v18, v4);
if ( !*(_WORD *)(a1 + 32) )
{
result = 7735LL;
*(_WORD *)(a1 + 32) = 7735;
}
return result;
}

original_code:
void ParseSguilArgs(SpoSguilData *ssd_data)
{
    char **toks;
    int num_toks;
    int i;
    if(ssd_data->args == ((void *)0))
    {
  ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
  FatalError("");
 }
 ssd_data->agent_port = 0;
    toks = mSplit(ssd_data->args, ", ", 31, &num_toks, '\\');
    for(i = 0; i < num_toks; ++i)
    {
        char **stoks;
        int num_stoks;
        char *index = toks[i];
        while(((*__ctype_b_loc ())[(int) (((int)*index))] & (unsigned short int) _ISspace))
            ++index;
        stoks = mSplit(index, "=", 2, &num_stoks, 0);
        if ( !strncasecmp(stoks[0], "agent_port", strlen("agent_port")) )
        {
            if(num_stoks > 1)
                ssd_data->agent_port = atoi(stoks[1]);
            else
                LogMessage("sguil: agent_port error\n");
        }
        else if ( !strncasecmp(stoks[0], "tag_path", strlen("tag_path")) )
        {
            if(num_stoks > 1 && ssd_data->tag_path == ((void *)0))
                ssd_data->tag_path = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: tag_path error\n");
        }
        else if ( !strncasecmp(stoks[0], "sensor_name", strlen("sensor_name")) )
        {
            if(num_stoks > 1 && ssd_data->sensor_name == ((void *)0))
                ssd_data->sensor_name = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: sensor_name error\n");
  }
        else if ( !strncasecmp(stoks[0], "passwd", strlen("passwd")) )
        {
            if(num_stoks > 1 && ssd_data->passwd == ((void *)0))
                ssd_data->passwd = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: passwd error\n");
        }
        else
        {
   LogMessage("sguil: unrecognised argument = %s\n", index);
  }
        mSplitFree(&stoks, num_stoks);
    }
    mSplitFree(&toks, num_toks);
 if (ssd_data->agent_port == 0)
  ssd_data->agent_port = 7735;
}

canonical_original_code:
void ParseSguilArgs(struct _SpoSguilData *ssd_data)
{
    char **toks;
    int num_toks;
    int i;
    if(ssd_data->args == ((void *)0))
    {
  ErrorMessage("sguil: you must supply arguments for sguil plugin\n");
  FatalError("");
 }
 ssd_data->agent_port = 0;
    toks = mSplit(ssd_data->args, ", ", 31, &num_toks, '\\');
    for(i = 0; i < num_toks; ++i)
    {
        char **stoks;
        int num_stoks;
        char *index = toks[i];
        while(((*__ctype_b_loc ())[(int) (((int)*index))] & (unsigned short) _ISspace))
            ++index;
        stoks = mSplit(index, "=", 2, &num_stoks, 0);
        if ( !strncasecmp(stoks[0], "agent_port", strlen("agent_port")) )
        {
            if(num_stoks > 1)
                ssd_data->agent_port = atoi(stoks[1]);
            else
                LogMessage("sguil: agent_port error\n");
        }
        else if ( !strncasecmp(stoks[0], "tag_path", strlen("tag_path")) )
        {
            if(num_stoks > 1 && ssd_data->tag_path == ((void *)0))
                ssd_data->tag_path = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: tag_path error\n");
        }
        else if ( !strncasecmp(stoks[0], "sensor_name", strlen("sensor_name")) )
        {
            if(num_stoks > 1 && ssd_data->sensor_name == ((void *)0))
                ssd_data->sensor_name = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: sensor_name error\n");
  }
        else if ( !strncasecmp(stoks[0], "passwd", strlen("passwd")) )
        {
            if(num_stoks > 1 && ssd_data->passwd == ((void *)0))
                ssd_data->passwd = SnortStrdup(stoks[1]);
            else
                LogMessage("sguil: passwd error\n");
        }
        else
        {
   LogMessage("sguil: unrecognised argument = %s\n", index);
  }
        mSplitFree(&stoks, num_stoks);
    }
    mSplitFree(&toks, num_toks);
 if (ssd_data->agent_port == 0)
  ssd_data->agent_port = 7735;
}

variable_types:
toks
char **

variable_types: i int

variable_types:
stoks
char **

variable_types:
index
char *

user_defined_types: struct _SpoSguilData { char *sensor_name; char *tag_path; char *passwd; unsigned int sensor_id; unsigned int event_id; unsigned int agent_port; int agent_sock; char *args; }


SguilSensorAgentConnect

decompiled_code:
__int64 __fastcall SguilSensorAgentConnect(__int64 a1)
{
char v1; // r12
unsigned int v3; // er13
int v4; // ebp
__int16 v5; // di
struct sockaddr v7; // [rsp+0h] [rbp-38h] BYREF

v1 = 4;
v3 = exit_signal;
if ( exit_signal )
return 1LL;
while ( 1 )
{
v4 = socket(2, 1, 0);
if ( v4 < 0 )
{
FatalError("sguil: Can't open a local socket.\n");
return 1LL;
}
v5 = *(_WORD *)(a1 + 32);
v7.sa_family = 2;
*(_WORD *)v7.sa_data = _bswap_16(v5);
*(_DWORD *)&v7.sa_data[2] = inet_addr("127.0.0.1");
*(_QWORD *)&v7.sa_data[6] = 0LL;
if ( connect(v4, &v7, 0x10u) >= 0 )
break;
LogMessage("sguil: Can't connect to localhost on TCP port %u.\n", *(unsigned __int16 *)(a1 + 32));
close(v4);
if ( BcTestMode() )
{
if ( v1 )
{
--v1;
}
else
{
v1 = -1;
FatalError("sguil: Unable to connect after 4 attempts\n");
}
}
LogMessage("sguil: Waiting 15 secs to try again.\n");
sleep(0xFu);
if ( exit_signal )
return 1LL;
}
*(_DWORD *)(a1 + 36) = v4;
LogMessage("sguil: Connected to localhost on %u.\n", *(unsigned __int16 *)(a1 + 32));
return v3;
}

canonical_decompiled_code:
__int64 __fastcall func12(__int64 a1)
{
char v1; // r12
unsigned int v3; // er13
int v4; // ebp
__int16 v5; // di
struct sockaddr v7; // [rsp+0h] [rbp-38h] BYREF

v1 = 4;
v3 = exit_signal;
if ( exit_signal )
return 1LL;
while ( 1 )
{
v4 = socket(2, 1, 0);
if ( v4 < 0 )
{
FatalError("sguil: Can't open a local socket.\n");
return 1LL;
}
v5 = *(_WORD *)(a1 + 32);
v7.sa_family = 2;
*(_WORD *)v7.sa_data = func5(v5);
*(_DWORD *)&v7.sa_data[2] = inet_addr("127.0.0.1");
*(_QWORD *)&v7.sa_data[6] = 0LL;
if ( connect(v4, &v7, 0x10u) >= 0 )
break;
LogMessage("sguil: Can't connect to localhost on TCP port %u.\n", *(unsigned __int16 *)(a1 + 32));
close(v4);
if ( func0() )
{
if ( v1 )
{
--v1;
}
else
{
v1 = -1;
FatalError("sguil: Unable to connect after 4 attempts\n");
}
}
LogMessage("sguil: Waiting 15 secs to try again.\n");
sleep(0xFu);
if ( exit_signal )
return 1LL;
}
*(_DWORD *)(a1 + 36) = v4;
LogMessage("sguil: Connected to localhost on %u.\n", *(unsigned __int16 *)(a1 + 32));
return v3;
}

original_code:
int SguilSensorAgentConnect(SpoSguilData *ssd_data)
{
    int sockfd;
    struct sockaddr_in my_addr;
 u_int8_t tries = 4;
 while (exit_signal == 0)
    {
        if ( (sockfd = socket(2, SOCK_STREAM, 0)) < 0 )
        {
            FatalError("sguil:  Can't open a local socket.\n");
            return 1;
        }
        my_addr.sin_family = 2;
        my_addr.sin_port = htons(ssd_data->agent_port);
        my_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
        memset(&(my_addr.sin_zero), '\0', 8);
        if (connect(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) < 0)
        {
            LogMessage("sguil:  Can't connect to localhost on TCP port %u.\n",
                        ssd_data->agent_port);
            close(sockfd);
   if ((BcTestMode()) && (tries-- == 0))
   {
    FatalError("sguil:  Unable to connect after 4 attempts\n");
         }
   LogMessage("sguil:  Waiting 15 secs to try again.\n");
      if (sleep(15))
   {
         }
        }
        else
        {
            ssd_data->agent_sock = sockfd;
            LogMessage("sguil:  Connected to localhost on %u.\n",
                        ssd_data->agent_port);
            return 0;
        }
    }
 return 1;
}

canonical_original_code:
int SguilSensorAgentConnect(struct _SpoSguilData *ssd_data)
{
    int sockfd;
    struct sockaddr_in my_addr;
 unsigned int tries = 4;
 while (exit_signal == 0)
    {
        if ( (sockfd = socket(2, SOCK_STREAM, 0)) < 0 )
        {
            FatalError("sguil:  Can't open a local socket.\n");
            return 1;
        }
        my_addr.sin_family = 2;
        my_addr.sin_port = htons(ssd_data->agent_port);
        my_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
        memset(&(my_addr.sin_zero), '\0', 8);
        if (connect(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) < 0)
        {
            LogMessage("sguil:  Can't connect to localhost on TCP port %u.\n",
                        ssd_data->agent_port);
            close(sockfd);
   if ((BcTestMode()) && (tries-- == 0))
   {
    FatalError("sguil:  Unable to connect after 4 attempts\n");
         }
   LogMessage("sguil:  Waiting 15 secs to try again.\n");
      if (sleep(15))
   {
         }
        }
        else
        {
            ssd_data->agent_sock = sockfd;
            LogMessage("sguil:  Connected to localhost on %u.\n",
                        ssd_data->agent_port);
            return 0;
        }
    }
 return 1;
}

variable_types: sockfd int

variable_types: struct sockaddr_in { unsigned short sin_family; unsigned short sin_port; struct in_addr { unsigned int s_addr; } sin_addr; unsigned char sin_zero[-1]; }

variable_types:
tries
unsigned int

return_type: int

user_defined_types: struct sockaddr_in { unsigned short sin_family; unsigned short sin_port; struct in_addr sin_addr; unsigned char sin_zero[-1]; }

user_defined_types: struct sockaddr { unsigned short sa_family; char sa_data[14]; }


SguilSendAgentMsg

decompiled_code:
__int64 __fastcall SguilSendAgentMsg(__int64 a1, const char *a2)
{
size_t v2; // r13
char *v3; // rbp
size_t v4; // rax

v2 = strlen(a2) + 2;
v3 = (char *)SnortAlloc(v2);
snprintf(v3, v2, "%s\n", a2);
v4 = strlen(v3);
if ( (int)send(*(_DWORD *)(a1 + 36), v3, v4, 0) >= 0 )
{
if ( !(unsigned int)BcLogVerbose() )
goto LABEL_3;
LABEL_7:
LogMessage("sguil: sending \"%s\"", v3);
goto LABEL_3;
}
if ( (unsigned int)BcLogVerbose() )
LogMessage("sguil: Lost connection to sensor_agent.\n");
SguilSendAgentMsg(a1, a2);
if ( (unsigned int)BcLogVerbose() )
goto LABEL_7;
LABEL_3:
free(v3);
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func13(__int64 a1, const char *a2)
{
size_t v2; // r13
char *v3; // rbp
size_t v4; // rax

v2 = strlen(a2) + 2;
v3 = (char *)SnortAlloc(v2);
snprintf(v3, v2, "%s\n", a2);
v4 = strlen(v3);
if ( (int)send(*(_DWORD *)(a1 + 36), v3, v4, 0) >= 0 )
{
if ( !(unsigned int)func1() )
goto LABEL_3;
LABEL_7:
LogMessage("sguil: sending \"%s\"", v3);
goto LABEL_3;
}
if ( (unsigned int)func1() )
LogMessage("sguil: Lost connection to sensor_agent.\n");
func13(a1, a2);
if ( (unsigned int)func1() )
goto LABEL_7;
LABEL_3:
free(v3);
return 0LL;
}

original_code:
int SguilSendAgentMsg(SpoSguilData *data, char *msg)
{
    int schars;
    size_t len;
    char *tmpMsg;
    len = strlen(msg)+2;
    tmpMsg = SnortAlloc(len);
    snprintf(tmpMsg, len, "%s\n", msg);
    if ( (schars = send(data->agent_sock, tmpMsg, sizeof(char)*strlen(tmpMsg), 0)) < 0 )
    {
        if(BcLogVerbose())
      LogMessage("sguil: Lost connection to sensor_agent.\n");
        SguilSendAgentMsg(data, msg);
    }
    if (BcLogVerbose())
     LogMessage("sguil: sending \"%s\"", tmpMsg);
    free(tmpMsg);
    return 0;
}

canonical_original_code:
int SguilSendAgentMsg(struct _SpoSguilData *data, char *msg)
{
    int schars;
    unsigned long len;
    char *tmpMsg;
    len = strlen(msg)+2;
    tmpMsg = SnortAlloc(len);
    snprintf(tmpMsg, len, "%s\n", msg);
    if ( (schars = send(data->agent_sock, tmpMsg, sizeof(char)*strlen(tmpMsg), 0)) < 0 )
    {
        if(BcLogVerbose())
      LogMessage("sguil: Lost connection to sensor_agent.\n");
        SguilSendAgentMsg(data, msg);
    }
    if (BcLogVerbose())
     LogMessage("sguil: sending \"%s\"", tmpMsg);
    free(tmpMsg);
    return 0;
}

variable_types:
msg
char *

variable_types: schars int

variable_types:
len
unsigned long

variable_types:
tmpMsg
char *


SguilRecvAgentMsg

decompiled_code:
__int64 __fastcall SguilRecvAgentMsg(__int64 a1, __int64 a2)
{
int v3; // edi
int v4; // ebx
__int64 v6; // rdi
int v7; // eax
int v8; // edx
int v9; // ecx
int v10; // er8
__int64 v11; // rax
char v12; // r9
char v13; // dl
int v14; // esi
__int64 v15; // rdi
bool v16; // cc
unsigned int v17; // er12
int v18; // eax
__int64 v19; // rdx
__int64 v20; // rcx
struct timeval v22; // [rsp+0h] [rbp-C8h] BYREF
fd_set readfds; // [rsp+10h] [rbp-B8h] BYREF

v22.tv_sec = 15LL;
v22.tv_usec = 0LL;
memset(&readfds, 0, sizeof(readfds));
v3 = *(_DWORD *)(a1 + 36);
v4 = exit_signal;
readfds.fds_bits[v3 / 64] |= 1LL << (v3 % 64);
if ( v4 )
return 0;
while ( 1 )
{
v6 = (unsigned int)(v3 + 1);
select(v6, &readfds, 0LL, 0LL, &v22);
v7 = *(_DWORD *)(a1 + 36);
v8 = v7 + 63;
if ( v7 >= 0 )
v8 = *(_DWORD *)(a1 + 36);
if ( (readfds.fds_bits[v8 >> 6] & (1LL << (*(_DWORD *)(a1 + 36) % 64))) == 0 )
break;
v9 = rcv_ptr_2;
v10 = n_0;
if ( !rcv_ptr_2 )
{
memset(rcv_msg_1, 0, 0x800uLL);
v18 = recv(*(_DWORD *)(a1 + 36), rcv_msg_1, 0x800uLL, 0);
n_0 = v18;
v10 = v18;
if ( v18 < 0 )
{
LogMessage("ERROR: Unable to read data.\n", rcv_msg_1, v19, v20, (unsigned int)v18);
SguilSensorAgentConnect(a1);
v10 = n_0;
v9 = rcv_ptr_2;
}
else
{
if ( !v18 )
{
LogMessage("ERROR: Connecton closed by client\n", rcv_msg_1, v19, v20, 0LL);
close(*(_DWORD *)(a1 + 36));
SguilSensorAgentConnect(a1);
v10 = n_0;
}
v9 = rcv_ptr_2;
}
}
v11 = v9;
v12 = 0;
v13 = rcv_msg_1[v9];
v14 = v4;
v15 = a2 + v4 - (__int64)v9;
if ( v13 != 10 )
{
do
{
v9 = v11;
if ( v10 <= (int)v11 )
{
if ( v12 )
rcv_ptr_2 = v11;
v4 = v14;
goto LABEL_13;
}
*(_BYTE *)(v15 + v11) = v13;
v9 = v11 + 1;
v13 = byte_DA1[v11];
++v14;
++v11;
v12 = 1;
}
while ( v13 != 10 );
rcv_ptr_2 = v9;
v4 = v14;
v16 = v10 - 1 <= v9;
if ( v10 - 1 != v9 )
goto LABEL_14;
LABEL_20:
v17 = v4 + 1;
rcv_ptr_2 = 0;
*(_BYTE *)(a2 + v4) = 10;
return v17;
}
LABEL_13:
v16 = v10 - 1 <= v9;
if ( v10 - 1 == v9 )
goto LABEL_20;
LABEL_14:
if ( !v16 )
{
v17 = v4 + 1;
*(_BYTE *)(a2 + v4) = 10;
rcv_ptr_2 = v9 + 1;
return v17;
}
if ( v9 == v10 )
rcv_ptr_2 = 0;
if ( exit_signal )
return 0;
v3 = *(_DWORD *)(a1 + 36);
}
v17 = 1;
if ( (unsigned int)BcLogVerbose(v6, (unsigned int)(*(int *)(a1 + 36) >> 31) >> 26) )
LogMessage("sguil: Timed out waiting for response.\n");
return v17;
}

original_code:
int SguilRecvAgentMsg(SpoSguilData *ssd_data, char *line_to_return)
{
 static int rcv_ptr=0;
 static char rcv_msg[2048];
 static int n;
 struct timeval tv;
 fd_set read_fds;
 int offset;
 offset=0;
 tv.tv_sec = 15;
 tv.tv_usec = 0;
 do { int __d0, __d1; __asm__ __volatile__ ("cld; rep; " "stosq" : "=c" (__d0), "=D" (__d1) : "a" (0), "0" (sizeof (fd_set) / sizeof (__fd_mask)), "1" (&((&read_fds)->__fds_bits)[0]) : "memory"); } while (0);
 ((void) (((&read_fds)->__fds_bits)[((ssd_data->agent_sock) / (8 * (int) sizeof (__fd_mask)))] |= ((__fd_mask) (1UL << ((ssd_data->agent_sock) % (8 * (int) sizeof (__fd_mask)))))));
 while (exit_signal == 0)
 {
  select(ssd_data->agent_sock+1, &read_fds, ((void *)0), ((void *)0), &tv);
  if ( !(((((&read_fds)->__fds_bits)[((ssd_data->agent_sock) / (8 * (int) sizeof (__fd_mask)))] & ((__fd_mask) (1UL << ((ssd_data->agent_sock) % (8 * (int) sizeof (__fd_mask)))))) != 0)) )
  {
   if(BcLogVerbose())
    LogMessage("sguil: Timed out waiting for response.\n");
   return 1;
  }
  else
  {
   if (rcv_ptr==0)
   {
    memset(rcv_msg,0x0,2048);
    n = recv(ssd_data->agent_sock, rcv_msg, 2048, 0);
    if (n<0)
    {
     LogMessage("ERROR: Unable to read data.\n");
     SguilSensorAgentConnect(ssd_data);
    }
    else if (n==0)
    {
     LogMessage("ERROR: Connecton closed by client\n");
     close(ssd_data->agent_sock);
     SguilSensorAgentConnect(ssd_data);
    }
   }
   while( *(rcv_msg+rcv_ptr)!=0x0A && rcv_ptr<n )
   {
    memcpy(line_to_return+offset,rcv_msg+rcv_ptr,1);
    offset++;
    rcv_ptr++;
   }
   if (rcv_ptr==n-1)
   {
    *(line_to_return+offset)=0x0A;
    rcv_ptr=0;
    return ++offset;
   }
   if (rcv_ptr <n-1)
   {
          *(line_to_return+offset)=0x0A;
       rcv_ptr++;
    return ++offset;
   }
   if (rcv_ptr == n)
   {
    rcv_ptr = 0;
   }
  }
 }
 return 0;
}

canonical_original_code:
int SguilRecvAgentMsg(struct _SpoSguilData *ssd_data, char *line_to_return)
{
 static int rcv_ptr = 0;
 static char rcv_msg[2048];
 static int n;
 struct timeval tv;
 struct fd_set read_fds;
 int offset;
 offset=0;
 tv.tv_sec = 15;
 tv.tv_usec = 0;
 do { int __d0; int __d1; __asm__ __volatile__ ("cld; rep; " "stosq" : "=c" (__d0), "=D" (__d1) : "a" (0), "0" (sizeof (fd_set) / sizeof (__fd_mask)), "1" (&((&read_fds)->__fds_bits)[0]) : "memory"); } while (0);
 ((void) (((&read_fds)->__fds_bits)[((ssd_data->agent_sock) / (8 * (int) sizeof (__fd_mask)))] |= ((__fd_mask) (1UL << ((ssd_data->agent_sock) % (8 * (int) sizeof (__fd_mask)))))));
 while (exit_signal == 0)
 {
  select(ssd_data->agent_sock+1, &read_fds, ((void *)0), ((void *)0), &tv);
  if ( !(((((&read_fds)->__fds_bits)[((ssd_data->agent_sock) / (8 * (int) sizeof (__fd_mask)))] & ((__fd_mask) (1UL << ((ssd_data->agent_sock) % (8 * (int) sizeof (__fd_mask)))))) != 0)) )
  {
   if(BcLogVerbose())
    LogMessage("sguil: Timed out waiting for response.\n");
   return 1;
  }
  else
  {
   if (rcv_ptr==0)
   {
    memset(rcv_msg,0x0,2048);
    n = recv(ssd_data->agent_sock, rcv_msg, 2048, 0);
    if (n<0)
    {
     LogMessage("ERROR: Unable to read data.\n");
     SguilSensorAgentConnect(ssd_data);
    }
    else if (n==0)
    {
     LogMessage("ERROR: Connecton closed by client\n");
     close(ssd_data->agent_sock);
     SguilSensorAgentConnect(ssd_data);
    }
   }
   while( *(rcv_msg+rcv_ptr)!=0x0A && rcv_ptr<n )
   {
    memcpy(line_to_return+offset,rcv_msg+rcv_ptr,1);
    offset++;
    rcv_ptr++;
   }
   if (rcv_ptr==n-1)
   {
    *(line_to_return+offset)=0x0A;
    rcv_ptr=0;
    return ++offset;
   }
   if (rcv_ptr <n-1)
   {
          *(line_to_return+offset)=0x0A;
       rcv_ptr++;
    return ++offset;
   }
   if (rcv_ptr == n)
   {
    rcv_ptr = 0;
   }
  }
 }
 return 0;
}

variable_types: n int

variable_types: struct timeval { long tv_sec; long tv_usec; }

variable_types: offset int


SguilRTEventMsg

decompiled_code:
__int64 __fastcall SguilRTEventMsg(__int64 a1, const char *a2)
{
const char **v2; // r13
int v3; // eax
__int64 v4; // rsi
unsigned int v6; // [rsp+4h] [rbp-824h] BYREF
const char **v7; // [rsp+8h] [rbp-820h] BYREF
char v8[2072]; // [rsp+10h] [rbp-818h] BYREF

SguilSendAgentMsg(a1, a2);
memset(v8, 0, 0x800uLL);
if ( (unsigned int)SguilRecvAgentMsg(a1, (__int64)v8) != 1 )
{
if ( (unsigned int)BcLogVerbose(a1, v8) )
LogMessage("sguil: Received: %s", v8);
v7 = (const char **)mSplit(v8, " ", 2LL, &v6, 0LL);
v2 = v7;
if ( !strcasecmp("Confirm", *v7) )
{
v3 = atoi(v2[1]);
v4 = *(unsigned int *)(a1 + 28);
if ( v3 == (_DWORD)v4 )
{
LABEL_7:
mSplitFree(&v7, v6);
return 0LL;
}
}
else
{
v4 = *(unsigned int *)(a1 + 28);
}
FatalError("sguil: Expected Confirm %u and got: %s\n", v4, v8);
goto LABEL_7;
}
if ( (unsigned int)BcLogVerbose(a1, v8) )
LogMessage("sguil: Retrying\n");
SguilRTEventMsg(a1, a2);
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func15(__int64 a1, const char *a2)
{
const char **v2; // r13
int v3; // eax
__int64 v4; // rsi
unsigned int v6; // [rsp+4h] [rbp-824h] BYREF
const char **v7; // [rsp+8h] [rbp-820h] BYREF
char v8[2072]; // [rsp+10h] [rbp-818h] BYREF

func13(a1, a2);
memset(v8, 0, 0x800uLL);
if ( (unsigned int)func14(a1, (__int64)v8) != 1 )
{
if ( (unsigned int)func1(a1, v8) )
LogMessage("sguil: Received: %s", v8);
v7 = (const char **)mSplit(v8, " ", 2LL, &v6, 0LL);
v2 = v7;
if ( !strcasecmp("Confirm", *v7) )
{
v3 = atoi(v2[1]);
v4 = *(unsigned int *)(a1 + 28);
if ( v3 == (_DWORD)v4 )
{
LABEL_7:
mSplitFree(&v7, v6);
return 0LL;
}
}
else
{
v4 = *(unsigned int *)(a1 + 28);
}
FatalError("sguil: Expected Confirm %u and got: %s\n", v4, v8);
goto LABEL_7;
}
if ( (unsigned int)func1(a1, v8) )
LogMessage("sguil: Retrying\n");
func15(a1, a2);
return 0LL;
}

original_code:
int SguilRTEventMsg(SpoSguilData *data, char *msg)
{
    char tmpRecvMsg[2048];
    SguilSendAgentMsg(data, msg);
    memset(tmpRecvMsg, 0x0, 2048);
    if(SguilRecvAgentMsg(data, tmpRecvMsg) == 1)
    {
        if(BcLogVerbose())
         LogMessage("sguil: Retrying\n");
        SguilRTEventMsg(data, msg);
    }
    else
    {
        char **toks;
        int num_toks;
        if(BcLogVerbose())
            LogMessage("sguil: Received: %s", tmpRecvMsg);
        toks = mSplit(tmpRecvMsg, " ", 2, &num_toks, 0);
        if(strcasecmp("Confirm", toks[0]) != 0 || atoi(toks[1]) != data->event_id )
        {
            FatalError("sguil: Expected Confirm %u and got: %s\n", data->event_id, tmpRecvMsg);
        }
        mSplitFree(&toks, num_toks);
    }
    return 0;
}

canonical_original_code:
int SguilRTEventMsg(struct _SpoSguilData *data, char *msg)
{
    char tmpRecvMsg[2048];
    SguilSendAgentMsg(data, msg);
    memset(tmpRecvMsg, 0x0, 2048);
    if(SguilRecvAgentMsg(data, tmpRecvMsg) == 1)
    {
        if(BcLogVerbose())
         LogMessage("sguil: Retrying\n");
        SguilRTEventMsg(data, msg);
    }
    else
    {
        char **toks;
        int num_toks;
        if(BcLogVerbose())
            LogMessage("sguil: Received: %s", tmpRecvMsg);
        toks = mSplit(tmpRecvMsg, " ", 2, &num_toks, 0);
        if(strcasecmp("Confirm", toks[0]) != 0 || atoi(toks[1]) != data->event_id )
        {
            FatalError("sguil: Expected Confirm %u and got: %s\n", data->event_id, tmpRecvMsg);
        }
        mSplitFree(&toks, num_toks);
    }
    return 0;
}

variable_types:
tmpRecvMsg
char [2048]


SguilSensorAgentInit

decompiled_code:
__int64 __fastcall SguilSensorAgentInit(__int64 a1)
{
const char **v1; // rbx
__int64 v2; // rsi
__int64 result; // rax
unsigned int v4; // [rsp+4h] [rbp-1024h] BYREF
const char **v5; // [rsp+8h] [rbp-1020h] BYREF
char s[2048]; // [rsp+10h] [rbp-1018h] BYREF
char v7[2072]; // [rsp+810h] [rbp-818h] BYREF

snprintf(s, 0x800uLL, "SidCidRequest %s", *(const char **)a1);
SguilSendAgentMsg(a1, s);
memset(v7, 0, 0x800uLL);
if ( (unsigned int)SguilRecvAgentMsg(a1, (__int64)v7) == 1 )
{
SguilSensorAgentInit(a1);
result = 0LL;
}
else
{
if ( (unsigned int)BcLogVerbose(a1, v7) )
LogMessage("sguil: received \"%s\"", v7);
v5 = (const char **)mSplit(v7, " ", 3LL, &v4, 0LL);
v1 = v5;
if ( !strcasecmp("SidCidResponse", *v5) )
{
*(_WORD *)(a1 + 24) = atoi(v1[1]);
*(_DWORD *)(a1 + 28) = atoi(v1[2]);
}
else
{
FatalError("sguil: Expected SidCidResponse and got '%s'\n", v7);
}
v2 = v4;
mSplitFree(&v5, v4);
if ( (unsigned int)BcLogVerbose(&v5, v2) )
LogMessage(
"sguil: sensor ID = %u\nsguil: last cid = %u\n",
*(unsigned __int16 *)(a1 + 24),
*(unsigned int *)(a1 + 28));
++*(_DWORD *)(a1 + 28);
result = 0LL;
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func16(__int64 a1)
{
const char **v1; // rbx
__int64 v2; // rsi
__int64 result; // rax
unsigned int v4; // [rsp+4h] [rbp-1024h] BYREF
const char **v5; // [rsp+8h] [rbp-1020h] BYREF
char s[2048]; // [rsp+10h] [rbp-1018h] BYREF
char v7[2072]; // [rsp+810h] [rbp-818h] BYREF

snprintf(s, 0x800uLL, "SidCidRequest %s", *(const char **)a1);
func13(a1, s);
memset(v7, 0, 0x800uLL);
if ( (unsigned int)func14(a1, (__int64)v7) == 1 )
{
func16(a1);
result = 0LL;
}
else
{
if ( (unsigned int)func1(a1, v7) )
LogMessage("sguil: received \"%s\"", v7);
v5 = (const char **)mSplit(v7, " ", 3LL, &v4, 0LL);
v1 = v5;
if ( !strcasecmp("SidCidResponse", *v5) )
{
*(_WORD *)(a1 + 24) = atoi(v1[1]);
*(_DWORD *)(a1 + 28) = atoi(v1[2]);
}
else
{
FatalError("sguil: Expected SidCidResponse and got '%s'\n", v7);
}
v2 = v4;
mSplitFree(&v5, v4);
if ( (unsigned int)func1(&v5, v2) )
LogMessage(
"sguil: sensor ID = %u\nsguil: last cid = %u\n",
*(unsigned __int16 *)(a1 + 24),
*(unsigned int *)(a1 + 28));
++*(_DWORD *)(a1 + 28);
result = 0LL;
}
return result;
}

original_code:
int SguilSensorAgentInit(SpoSguilData *ssd_data)
{
    char tmpSendMsg[2048];
    char tmpRecvMsg[2048];
    snprintf(tmpSendMsg, 2048, "SidCidRequest %s", ssd_data->sensor_name);
    SguilSendAgentMsg(ssd_data, tmpSendMsg);
    memset(tmpRecvMsg,0x0,2048);
    if ( SguilRecvAgentMsg(ssd_data, tmpRecvMsg) == 1 )
    {
        SguilSensorAgentInit(ssd_data);
    }
    else
    {
        char **toks;
        int num_toks;
        if (BcLogVerbose())
            LogMessage("sguil: received \"%s\"", tmpRecvMsg);
        toks = mSplit(tmpRecvMsg, " ", 3, &num_toks, 0);
        if ( strcasecmp("SidCidResponse", toks[0]) == 0 )
        {
            ssd_data->sensor_id = atoi(toks[1]);
            ssd_data->event_id = atoi(toks[2]);
        }
        else
        {
            FatalError("sguil: Expected SidCidResponse and got '%s'\n", tmpRecvMsg);
        }
        mSplitFree(&toks, num_toks);
        if (BcLogVerbose())
         LogMessage("sguil: sensor ID = %u\nsguil: last cid = %u\n",
     ssd_data->sensor_id, ssd_data->event_id);
        ssd_data->event_id++;
    }
    return 0;
}

canonical_original_code:
int SguilSensorAgentInit(struct _SpoSguilData *ssd_data)
{
    char tmpSendMsg[2048];
    char tmpRecvMsg[2048];
    snprintf(tmpSendMsg, 2048, "SidCidRequest %s", ssd_data->sensor_name);
    SguilSendAgentMsg(ssd_data, tmpSendMsg);
    memset(tmpRecvMsg,0x0,2048);
    if ( SguilRecvAgentMsg(ssd_data, tmpRecvMsg) == 1 )
    {
        SguilSensorAgentInit(ssd_data);
    }
    else
    {
        char **toks;
        int num_toks;
        if (BcLogVerbose())
            LogMessage("sguil: received \"%s\"", tmpRecvMsg);
        toks = mSplit(tmpRecvMsg, " ", 3, &num_toks, 0);
        if ( strcasecmp("SidCidResponse", toks[0]) == 0 )
        {
            ssd_data->sensor_id = atoi(toks[1]);
            ssd_data->event_id = atoi(toks[2]);
        }
        else
        {
            FatalError("sguil: Expected SidCidResponse and got '%s'\n", tmpRecvMsg);
        }
        mSplitFree(&toks, num_toks);
        if (BcLogVerbose())
         LogMessage("sguil: sensor ID = %u\nsguil: last cid = %u\n",
     ssd_data->sensor_id, ssd_data->event_id);
        ssd_data->event_id++;
    }
    return 0;
}

variable_types:
tmpSendMsg
char [2048]


SguilInitFinalize

decompiled_code:
__int64 __fastcall SguilInitFinalize(__int64 a1, __int64 a2)
{
__int64 v2; // rbp
const char *v4; // rdi
__int64 v5; // rdi
const char *v6; // rax
const char *v7; // rax

v2 = a2;
if ( !a2 )
FatalError("sguil: data uninitialized\n");
ParseSguilArgs(a2);
if ( !*(_QWORD *)a2 )
{
v4 = *(const char **)(barnyard2_conf + 65600LL);
if ( !v4 )
v4 = "NULL";
v5 = GetUniqueName(v4);
v6 = (const char *)SnortStrdup(v5);
*(_QWORD *)a2 = v6;
if ( v6 )
{
v7 = &v6[strlen(v6) - 1];
if ( *v7 == 10 )
*v7 = 0;
}
}
if ( !(unsigned int)BcLogQuiet() )
{
LogMessage("sguil: sensor name = %s\n", *(const char **)a2);
a2 = *(unsigned __int16 *)(a2 + 32);
LogMessage("sguil: agent port = %u\n", a2);
}
SguilSensorAgentConnect(v2);
if ( (unsigned int)BcLogVerbose(v2, a2) )
LogMessage("sguil: Waiting for sid and cid from sensor_agent.\n");
SguilSensorAgentInit(v2);
AddFuncToOutputList(Sguil, 1LL, v2);
AddFuncToCleanExitList(SguilCleanExitFunc, v2);
return AddFuncToRestartList(SguilRestartFunc, v2);
}

canonical_decompiled_code:
__int64 __fastcall func17(__int64 a1, __int64 a2)
{
__int64 v2; // rbp
const char *v4; // rdi
__int64 v5; // rdi
const char *v6; // rax
const char *v7; // rax

v2 = a2;
if ( !a2 )
FatalError("sguil: data uninitialized\n");
func11(a2);
if ( !*(_QWORD *)a2 )
{
v4 = *(const char **)(barnyard2_conf + 65600LL);
if ( !v4 )
v4 = "NULL";
v5 = GetUniqueName(v4);
v6 = (const char *)SnortStrdup(v5);
*(_QWORD *)a2 = v6;
if ( v6 )
{
v7 = &v6[strlen(v6) - 1];
if ( *v7 == 10 )
*v7 = 0;
}
}
if ( !(unsigned int)func2() )
{
LogMessage("sguil: sensor name = %s\n", *(const char **)a2);
a2 = *(unsigned __int16 *)(a2 + 32);
LogMessage("sguil: agent port = %u\n", a2);
}
func12(v2);
if ( (unsigned int)func1(v2, a2) )
LogMessage("sguil: Waiting for sid and cid from sensor_agent.\n");
func16(v2);
AddFuncToOutputList(Sguil, 1LL, v2);
AddFuncToCleanExitList(SguilCleanExitFunc, v2);
return AddFuncToRestartList(SguilRestartFunc, v2);
}

original_code:
void SguilInitFinalize(int unused, void *arg)
{
 SpoSguilData *ssd_data = (SpoSguilData *)arg;
 if (!ssd_data)
 {
  FatalError("sguil:  data uninitialized\n");
 }
 ParseSguilArgs(ssd_data);
    if(ssd_data->sensor_name == ((void *)0))
    {
  ssd_data->sensor_name = SnortStrdup(GetUniqueName((barnyard2_conf->interface ? barnyard2_conf->interface : "NULL")));
         if(ssd_data->sensor_name)
         {
            if( ssd_data->sensor_name[strlen(ssd_data->sensor_name)-1] == '\n' )
            {
                ssd_data->sensor_name[strlen(ssd_data->sensor_name)-1] = '\0';
            }
   }
    }
 if (!BcLogQuiet())
    {
        LogMessage("sguil:  sensor name = %s\n", ssd_data->sensor_name);
        LogMessage("sguil:  agent port =  %u\n", ssd_data->agent_port);
    }
    SguilSensorAgentConnect(ssd_data);
    if(BcLogVerbose())
        LogMessage("sguil: Waiting for sid and cid from sensor_agent.\n");
    SguilSensorAgentInit(ssd_data);
    AddFuncToOutputList(Sguil, OUTPUT_TYPE__ALERT, ssd_data);
    AddFuncToCleanExitList(SguilCleanExitFunc, ssd_data);
    AddFuncToRestartList(SguilRestartFunc, ssd_data);
}

canonical_original_code:
void SguilInitFinalize(int unused, void *arg)
{
 struct _SpoSguilData *ssd_data = (SpoSguilData *)arg;
 if (!ssd_data)
 {
  FatalError("sguil:  data uninitialized\n");
 }
 ParseSguilArgs(ssd_data);
    if(ssd_data->sensor_name == ((void *)0))
    {
  ssd_data->sensor_name = SnortStrdup(GetUniqueName((barnyard2_conf->interface ? barnyard2_conf->interface : "NULL")));
         if(ssd_data->sensor_name)
         {
            if( ssd_data->sensor_name[strlen(ssd_data->sensor_name)-1] == '\n' )
            {
                ssd_data->sensor_name[strlen(ssd_data->sensor_name)-1] = '\0';
            }
   }
    }
 if (!BcLogQuiet())
    {
        LogMessage("sguil:  sensor name = %s\n", ssd_data->sensor_name);
        LogMessage("sguil:  agent port =  %u\n", ssd_data->agent_port);
    }
    SguilSensorAgentConnect(ssd_data);
    if(BcLogVerbose())
        LogMessage("sguil: Waiting for sid and cid from sensor_agent.\n");
    SguilSensorAgentInit(ssd_data);
    AddFuncToOutputList(Sguil, OUTPUT_TYPE__ALERT, ssd_data);
    AddFuncToCleanExitList(SguilCleanExitFunc, ssd_data);
    AddFuncToRestartList(SguilRestartFunc, ssd_data);
}

variable_types: unused int

variable_types:
arg
void *

variable_types: struct _SpoSguilData { char *sensor_name; char *tag_path; char *passwd; unsigned int sensor_id; unsigned int event_id; unsigned int agent_port; int agent_sock; char *args; } *


SguilTimestamp

decompiled_code:
__int64 __fastcall SguilTimestamp(unsigned int a1)
{
__int64 v1; // r12
struct tm *v2; // rax
time_t timer[2]; // [rsp+8h] [rbp-10h] BYREF

timer[0] = a1;
v1 = SnortAlloc(128LL);
if ( (unsigned int)BcOutputUseUtc(timer) )
v2 = gmtime(timer);
else
v2 = localtime(timer);
SnortSnprintf(
v1,
128LL,
"%04i-%02i-%02i %02i:%02i:%02i",
(unsigned int)(v2->tm_year + 1900),
(unsigned int)(v2->tm_mon + 1),
(unsigned int)v2->tm_mday,
(unsigned int)v2->tm_hour,
(unsigned int)v2->tm_min,
(unsigned int)v2->tm_sec);
return v1;
}

canonical_decompiled_code:
__int64 __fastcall func18(unsigned int a1)
{
__int64 v1; // r12
struct tm *v2; // rax
time_t timer[2]; // [rsp+8h] [rbp-10h] BYREF

timer[0] = a1;
v1 = SnortAlloc(128LL);
if ( (unsigned int)func3(timer) )
v2 = gmtime(timer);
else
v2 = localtime(timer);
SnortSnprintf(
v1,
128LL,
"%04i-%02i-%02i %02i:%02i:%02i",
(unsigned int)(v2->tm_year + 1900),
(unsigned int)(v2->tm_mon + 1),
(unsigned int)v2->tm_mday,
(unsigned int)v2->tm_hour,
(unsigned int)v2->tm_min,
(unsigned int)v2->tm_sec);
return v1;
}

original_code:
char *SguilTimestamp(u_int32_t sec)
{
    struct tm *lt;
    char *buf;
    time_t Time = sec;
    buf = (char *)SnortAlloc(128 * sizeof(char));
 if (BcOutputUseUtc())
  lt = gmtime(&Time);
 else
  lt = localtime(&Time);
    SnortSnprintf(buf, 128, "%04i-%02i-%02i %02i:%02i:%02i",
     1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday,
     lt->tm_hour, lt->tm_min, lt->tm_sec);
  return buf;
}

canonical_original_code:
char *SguilTimestamp(unsigned int sec)
{
    struct tm *lt;
    char *buf;
    long Time = sec;
    buf = (char *)SnortAlloc(128 * sizeof(char));
 if (BcOutputUseUtc())
  lt = gmtime(&Time);
 else
  lt = localtime(&Time);
    SnortSnprintf(buf, 128, "%04i-%02i-%02i %02i:%02i:%02i",
     1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday,
     lt->tm_hour, lt->tm_min, lt->tm_sec);
  return buf;
}

variable_types:
sec
unsigned int

variable_types: struct tm { int tm_sec; int tm_min; int tm_hour; int tm_mday; int tm_mon; int tm_year; int tm_wday; int tm_yday; int tm_isdst; long tm_gmtoff; char *tm_zone; } *

variable_types:
buf
char *

variable_types: Time long

return_type: char *


BcTestMode

decompiled_code:
_BOOL8 BcTestMode()
{
return *barnyard2_conf == 4;
}

canonical_decompiled_code:
_BOOL8 func0()
{
return *barnyard2_conf == 4;
}

original_code:
static inline int BcTestMode(void)
{
    return barnyard2_conf->run_mode == RUN_MODE__TEST;
}

canonical_original_code:
static inline int BcTestMode()
{
    return barnyard2_conf->run_mode == RUN_MODE__TEST;
}


BcNoOutputTimestamp

decompiled_code:
__int64 BcNoOutputTimestamp()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x400;
}

canonical_decompiled_code:
__int64 func1()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 0x400;
}

original_code:
static inline int BcNoOutputTimestamp(void)
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__NO_TIMESTAMP;
}

canonical_original_code:
static inline int BcNoOutputTimestamp()
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__NO_TIMESTAMP;
}


BcLineBufferedLogging

decompiled_code:
__int64 BcLineBufferedLogging()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 1;
}

canonical_decompiled_code:
__int64 func2()
{
return *(_DWORD *)(barnyard2_conf + 12LL) & 1;
}

original_code:
static inline int BcLineBufferedLogging(void)
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__LINE_BUFFER;
}

canonical_original_code:
static inline int BcLineBufferedLogging()
{
    return barnyard2_conf->output_flags & OUTPUT_FLAG__LINE_BUFFER;
}


SpoLogTcpdumpCleanExitFunc

decompiled_code:
void __fastcall SpoLogTcpdumpCleanExitFunc(__int64 a1, void *a2)
{
SpoLogTcpdumpCleanup_constprop_0(a2, "SpoLogTcpdumpCleanExitFunc");
}

canonical_decompiled_code:
void __fastcall func9(__int64 a1, void *a2)
{
func8(a2, "SpoLogTcpdumpCleanExitFunc");
}

original_code:
static void SpoLogTcpdumpCleanExitFunc(int signal, void *arg)
{
    SpoLogTcpdumpCleanup(signal, arg, "SpoLogTcpdumpCleanExitFunc");
}

variable_types: signal int


SpoLogTcpdumpRestartFunc

decompiled_code:
void __fastcall SpoLogTcpdumpRestartFunc(__int64 a1, void *a2)
{
SpoLogTcpdumpCleanup_constprop_0(a2, "SpoLogTcpdumpRestartFunc");
}

canonical_decompiled_code:
void __fastcall func10(__int64 a1, void *a2)
{
func8(a2, "SpoLogTcpdumpRestartFunc");
}

original_code:
static void SpoLogTcpdumpRestartFunc(int signal, void *arg)
{
    SpoLogTcpdumpCleanup(signal, arg, "SpoLogTcpdumpRestartFunc");
}


LogTcpdump

decompiled_code:
int __fastcall LogTcpdump(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
int result; // eax

if ( a1 )
{
if ( (*(_BYTE *)(a1 + 816) & 2) != 0 )
result = LogTcpdumpStream_constprop_0(a4);
else
result = LogTcpdumpSingle_constprop_0((__int64 *)a1, a4);
}
return result;
}

canonical_decompiled_code:
int __fastcall func14(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
int result; // eax

if ( a1 )
{
if ( (*(_BYTE *)(a1 + 816) & 2) != 0 )
result = func11(a4);
else
result = func13((__int64 *)a1, a4);
}
return result;
}

original_code:
static void LogTcpdump(Packet *p, void *event, uint32_t event_type, void *arg)
{
    if(p)
    {
        if(p->packet_flags & 0x00000002)
        {
            LogTcpdumpStream(p, event, event_type, arg);
        }
        else
        {
            LogTcpdumpSingle(p, event, event_type, arg);
        }
    }
}

canonical_original_code:
static void LogTcpdump(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
    if(p)
    {
        if(p->packet_flags & 0x00000002)
        {
            LogTcpdumpStream(p, event, event_type, arg);
        }
        else
        {
            LogTcpdumpSingle(p, event, event_type, arg);
        }
    }
}

variable_types: struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *

variable_types:
event
void *

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }

user_defined_types: struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip ip_src; struct _ip ip_dst; }


LogTcpdumpSetup

decompiled_code:
__int64 LogTcpdumpSetup()
{
RegisterOutputPlugin("log_tcpdump", 2LL, LogTcpdumpInit);
DebugMessageFile = "spo_log_tcpdump.c";
DebugMessageLine = 137;
return DebugMessageFunc(1LL, "Output plugin: Log-Tcpdump is setup...\n");
}

canonical_decompiled_code:
__int64 func15()
{
RegisterOutputPlugin("log_tcpdump", 2LL, LogTcpdumpInit);
DebugMessageFile = "spo_log_tcpdump.c";
DebugMessageLine = 137;
return DebugMessageFunc(1LL, "Output plugin: Log-Tcpdump is setup...\n");
}

original_code:
void LogTcpdumpSetup(void)
{
    RegisterOutputPlugin("log_tcpdump", OUTPUT_TYPE_FLAG__LOG, LogTcpdumpInit);
    DebugMessageFile = "spo_log_tcpdump.c"; DebugMessageLine = 137; DebugMessageFunc(0x00000001,"Output plugin: Log-Tcpdump is setup...\n");;
}

canonical_original_code:
void LogTcpdumpSetup()
{
    RegisterOutputPlugin("log_tcpdump", OUTPUT_TYPE_FLAG__LOG, LogTcpdumpInit);
    DebugMessageFile = "spo_log_tcpdump.c"; DebugMessageLine = 137; DebugMessageFunc(0x00000001,"Output plugin: Log-Tcpdump is setup...\n");;
}


LogTcpdumpReset

decompiled_code:
time_t LogTcpdumpReset()
{
return TcpdumpRollLogFile(log_tcpdump_ptr);
}

canonical_decompiled_code:
time_t func16()
{
return func4(log_tcpdump_ptr);
}

original_code:
void LogTcpdumpReset(void)
{
    TcpdumpRollLogFile(log_tcpdump_ptr);
}

canonical_original_code:
void LogTcpdumpReset()
{
    TcpdumpRollLogFile(log_tcpdump_ptr);
}


DirectLogTcpdump

decompiled_code:
__int64 __fastcall DirectLogTcpdump(__int64 a1, __int64 a2)
{
__int64 v3; // rax
__int64 v4; // rdi
__int64 v5; // rbx
__int64 result; // rax

v3 = SizeOf_isra_0(*(_DWORD *)(a1 + 16));
v4 = log_tcpdump_ptr;
v5 = v3;
if ( (unsigned __int64)(*(_QWORD *)(log_tcpdump_ptr + 32) + v3) > *(_QWORD *)(log_tcpdump_ptr + 40) )
{
TcpdumpRollLogFile(log_tcpdump_ptr);
v4 = log_tcpdump_ptr;
}
++pc[37];
pcap_dump(*(_QWORD *)(v4 + 16), a1, a2);
result = log_tcpdump_ptr;
*(_QWORD *)(log_tcpdump_ptr + 32) += v5;
return result;
}

canonical_decompiled_code:
__int64 __fastcall func17(__int64 a1, __int64 a2)
{
__int64 v3; // rax
__int64 v4; // rdi
__int64 v5; // rbx
__int64 result; // rax

v3 = func12(*(_DWORD *)(a1 + 16));
v4 = log_tcpdump_ptr;
v5 = v3;
if ( (unsigned __int64)(*(_QWORD *)(log_tcpdump_ptr + 32) + v3) > *(_QWORD *)(log_tcpdump_ptr + 40) )
{
func4(log_tcpdump_ptr);
v4 = log_tcpdump_ptr;
}
++pc[37];
pcap_dump(*(_QWORD *)(v4 + 16), a1, a2);
result = log_tcpdump_ptr;
*(_QWORD *)(log_tcpdump_ptr + 32) += v5;
return result;
}

original_code:
void DirectLogTcpdump(struct pcap_pkthdr *ph, uint8_t *pkt)
{
    size_t dumpSize = SizeOf(ph);
    if ( log_tcpdump_ptr->size + dumpSize > log_tcpdump_ptr->limit )
        TcpdumpRollLogFile(log_tcpdump_ptr);
    pc.log_pkts++;
    pcap_dump((u_char *)log_tcpdump_ptr->dumpd, ph, pkt);
    log_tcpdump_ptr->size += dumpSize;
}

canonical_original_code:
void DirectLogTcpdump(struct pcap_pkthdr *ph, unsigned char *pkt)
{
    unsigned long dumpSize = SizeOf(ph);
    if ( log_tcpdump_ptr->size + dumpSize > log_tcpdump_ptr->limit )
        TcpdumpRollLogFile(log_tcpdump_ptr);
    pc.log_pkts++;
    pcap_dump((unsigned char *)log_tcpdump_ptr->dumpd, ph, pkt);
    log_tcpdump_ptr->size += dumpSize;
}

variable_types: struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *

variable_types:
pkt
unsigned char *

variable_types:
dumpSize
unsigned long


BcDaemonMode

decompiled_code:
__int64 BcDaemonMode()
{
return *(_DWORD *)(barnyard2_conf + 8LL) & 2;
}

canonical_decompiled_code:
__int64 func0()
{
return *(_DWORD *)(barnyard2_conf + 8LL) & 2;
}

original_code:
static inline int BcDaemonMode(void)
{
    return barnyard2_conf->run_flags & RUN_FLAG__DAEMON;
}

canonical_original_code:
static inline int BcDaemonMode()
{
    return barnyard2_conf->run_flags & RUN_FLAG__DAEMON;
}


AlertCEF

decompiled_code:
void __fastcall AlertCEF(__int64 a1, unsigned int *a2, __int64 a3, __int64 a4)
{
unsigned int v7; // eax
unsigned int v8; // edi
__int64 v9; // rsi
unsigned int v10; // eax
unsigned int v11; // eax
unsigned int v12; // eax
__int64 v13; // rdx
char v14; // si
char *v15; // rax
char *v16; // rax
char v17[1080]; // [rsp+0h] [rbp-438h] BYREF

if ( a4 != 0 && a2 != 0LL )
{
if ( a1 )
{
v7 = _bswap_32(a2[4]);
v8 = a2[5];
v9 = v7;
v10 = _bswap_32(v8);
GetSigByGidSid(v10, v9);
v11 = _bswap_32(a2[7]);
ClassTypeLookupById(barnyard2_conf, v11);
SnortSnprintf(v17, 1024LL, "CEF:0|snort|barnyard2|%s", "1.9");
if ( *(_QWORD *)(a1 + 72) )
{
_bswap_32(a2[8]);
_bswap_32(a2[6]);
_bswap_32(a2[4]);
v12 = _bswap_32(a2[5]);
if ( !(unsigned int)SnortSnprintfAppend(v17, 1024LL, "%lu:%lu:%lu|%s|%d|", v12) )
{
v13 = *(_QWORD *)(a1 + 72);
v14 = *(_BYTE *)(v13 + 9);
if ( (v14 == 6 || v14 == 17) && !*(_BYTE *)(a1 + 852) )
{
inet_ntoa(*(struct in_addr *)(v13 + 16));
v16 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
if ( (unsigned int)SnortSnprintfAppend(v17, 1024LL, "src=%s dst=%s spt=%i dpt=%i proto=%s", v16) )
return;
}
else
{
inet_ntoa(*(struct in_addr *)(v13 + 16));
v15 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
if ( (unsigned int)SnortSnprintfAppend(v17, 1024LL, "src=%s dst=%s proto=%s", v15) )
return;
}
syslog(*(_DWORD *)(a4 + 4), "%s", v17);
}
}
}
}
}

canonical_decompiled_code:
void __fastcall func2(__int64 a1, unsigned int *a2, __int64 a3, __int64 a4)
{
unsigned int v7; // eax
unsigned int v8; // edi
__int64 v9; // rsi
unsigned int v10; // eax
unsigned int v11; // eax
unsigned int v12; // eax
__int64 v13; // rdx
char v14; // si
char *v15; // rax
char *v16; // rax
char v17[1080]; // [rsp+0h] [rbp-438h] BYREF

if ( a4 != 0 && a2 != 0LL )
{
if ( a1 )
{
v7 = func1(a2[4]);
v8 = a2[5];
v9 = v7;
v10 = func1(v8);
GetSigByGidSid(v10, v9);
v11 = func1(a2[7]);
ClassTypeLookupById(barnyard2_conf, v11);
SnortSnprintf(v17, 1024LL, "CEF:0|snort|barnyard2|%s", "1.9");
if ( *(_QWORD *)(a1 + 72) )
{
func1(a2[8]);
func1(a2[6]);
func1(a2[4]);
v12 = func1(a2[5]);
if ( !(unsigned int)SnortSnprintfAppend(v17, 1024LL, "%lu:%lu:%lu|%s|%d|", v12) )
{
v13 = *(_QWORD *)(a1 + 72);
v14 = *(_BYTE *)(v13 + 9);
if ( (v14 == 6 || v14 == 17) && !*(_BYTE *)(a1 + 852) )
{
inet_ntoa(*(struct in_addr *)(v13 + 16));
v16 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
if ( (unsigned int)SnortSnprintfAppend(v17, 1024LL, "src=%s dst=%s spt=%i dpt=%i proto=%s", v16) )
return;
}
else
{
inet_ntoa(*(struct in_addr *)(v13 + 16));
v15 = inet_ntoa(*(struct in_addr *)(*(_QWORD *)(a1 + 72) + 12LL));
if ( (unsigned int)SnortSnprintfAppend(v17, 1024LL, "src=%s dst=%s proto=%s", v15) )
return;
}
syslog(*(_DWORD *)(a4 + 4), "%s", v17);
}
}
}
}
}

original_code:
void AlertCEF(Packet *p, void *event, u_int32_t event_type, void *arg)
{
    char cef_message[1024];
    CEFData *data;
 SigNode *sn;
 ClassType *cn;
    int cef_severity;
 if ( p == ((void *)0) || event == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 data = (CEFData *)arg;
 sn = GetSigByGidSid(ntohl(((Unified2EventCommon *)event)->generator_id),
      ntohl(((Unified2EventCommon *)event)->signature_id));
 cn = ClassTypeLookupById(barnyard2_conf, ntohl(((Unified2EventCommon *)event)->classification_id));
    if (!1)
    {
        return;
    }
    SnortSnprintf(cef_message, 1024, "CEF:0|snort|barnyard2|%s", "1.9");
    if(p && p->iph)
    {
        cef_severity = (11 - ntohl(((Unified2EventCommon *)event)->priority_id));
        if ( cef_severity < 0 )
            cef_severity = 0;
        else if ( cef_severity > 10 )
            cef_severity = 10;
        if( SnortSnprintfAppend(cef_message, 1024, "%lu:%lu:%lu|%s|%d|",
                          (unsigned long) ntohl(((Unified2EventCommon *)event)->generator_id),
                          (unsigned long) ntohl(((Unified2EventCommon *)event)->signature_id),
                          (unsigned long) ntohl(((Unified2EventCommon *)event)->signature_revision),
                          sn == ((void *)0) ? "ALERT" : sn->msg, cef_severity) != 0 )
                return ;
        if( (p->iph->ip_proto != IPPROTO_TCP && p->iph->ip_proto != IPPROTO_UDP) || p->frag_flag )
        {
            if( SnortSnprintfAppend(cef_message, 1024, "src=%s dst=%s proto=%s",
                                    inet_ntoa(p->iph->ip_src), inet_ntoa(p->iph->ip_dst),
                                    protocol_names[p->iph->ip_proto]) != 0 )
                return;
        }
        else
        {
            if( SnortSnprintfAppend(cef_message, 1024, "src=%s dst=%s spt=%i dpt=%i proto=%s",
                                 inet_ntoa(p->iph->ip_src), inet_ntoa(p->iph->ip_dst), p->sp, p->dp,
                                 protocol_names[p->iph->ip_proto]) != 0 )
                return ;
        }
        syslog(data->priority, "%s", cef_message);
    }
    return;
}

canonical_original_code:
void AlertCEF(struct _Packet *p, void *event, unsigned int event_type, void *arg)
{
    char cef_message[1024];
    struct _CEFData *data;
 struct _SigNode *sn;
 struct _ClassType *cn;
    int cef_severity;
 if ( p == ((void *)0) || event == ((void *)0) || arg == ((void *)0) )
 {
  return;
 }
 data = (struct _CEFData *)arg;
 sn = GetSigByGidSid(ntohl(((struct _Unified2EventCommon *)event)->generator_id),
      ntohl(((struct _Unified2EventCommon *)event)->signature_id));
 cn = ClassTypeLookupById(barnyard2_conf, ntohl(((struct _Unified2EventCommon *)event)->classification_id));
    if (!1)
    {
        return;
    }
    SnortSnprintf(cef_message, 1024, "CEF:0|snort|barnyard2|%s", "1.9");
    if(p && p->iph)
    {
        cef_severity = (11 - ntohl(((struct _Unified2EventCommon *)event)->priority_id));
        if ( cef_severity < 0 )
            cef_severity = 0;
        else if ( cef_severity > 10 )
            cef_severity = 10;
        if( SnortSnprintfAppend(cef_message, 1024, "%lu:%lu:%lu|%s|%d|",
                          (unsigned long) ntohl(((struct _Unified2EventCommon *)event)->generator_id),
                          (unsigned long) ntohl(((struct _Unified2EventCommon *)event)->signature_id),
                          (unsigned long) ntohl(((struct _Unified2EventCommon *)event)->signature_revision),
                          sn == ((void *)0) ? "ALERT" : sn->msg, cef_severity) != 0 )
                return ;
        if( (p->iph->ip_proto != IPPROTO_TCP && p->iph->ip_proto != IPPROTO_UDP) || p->frag_flag )
        {
            if( SnortSnprintfAppend(cef_message, 1024, "src=%s dst=%s proto=%s",
                                    inet_ntoa(p->iph->ip_src), inet_ntoa(p->iph->ip_dst),
                                    protocol_names[p->iph->ip_proto]) != 0 )
                return;
        }
        else
        {
            if( SnortSnprintfAppend(cef_message, 1024, "src=%s dst=%s spt=%i dpt=%i proto=%s",
                                 inet_ntoa(p->iph->ip_src), inet_ntoa(p->iph->ip_dst), p->sp, p->dp,
                                 protocol_names[p->iph->ip_proto]) != 0 )
                return ;
        }
        syslog(data->priority, "%s", cef_message);
    }
    return;
}

variable_types: struct _CEFData { int facility; int priority; int options; } *

variable_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType { char *type; unsigned int id; char *name; unsigned int priority; struct _ClassType *next; } *classType; unsigned int priority; char *msg; struct _ReferenceNode { char *id; struct _ReferenceSystemNode { char *name; char *url; struct _ReferenceSystemNode *next; } *system; struct _ReferenceNode *next; } *refs; struct _SigNode *next; } *

user_defined_types: struct _SigNode { unsigned int generator; unsigned int id; unsigned int rev; unsigned int class_id; struct _ClassType *classType; unsigned int priority; char *msg; struct _ReferenceNode *refs; struct _SigNode *next; }

user_defined_types: struct _Unified2EventCommon { unsigned int sensor_id; unsigned int event_id; unsigned int event_second; unsigned int event_microsecond; unsigned int signature_id; unsigned int generator_id; unsigned int signature_revision; unsigned int classification_id; unsigned int priority_id; }

user_defined_types: struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; }

user_defined_types: struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; }

user_defined_types: struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; }

user_defined_types: struct _EthLlc { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; }

user_defined_types: struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; }

user_defined_types: struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; }

user_defined_types: struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; }

user_defined_types: struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; }

user_defined_types: struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; }

user_defined_types: struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; }

user_defined_types: struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Fddi_llc_other { unsigned char ctrl_fld[1]; }

user_defined_types: struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; }

user_defined_types: struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; }

user_defined_types: struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; }

user_defined_types: struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; }

user_defined_types: struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; }

user_defined_types: struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; }

user_defined_types: struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; }

user_defined_types: struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; }

user_defined_types: struct _Options { unsigned char code; unsigned char len; unsigned char *data; }

user_defined_types: struct _IP6Option { unsigned char type; unsigned char *data; }

user_defined_types: struct _ReferenceNode { char *id; struct _ReferenceSystemNode *system; struct _ReferenceNode *next; }

user_defined_types: struct timeval { long tv_sec; long tv_usec; }

user_defined_types: struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; }

user_defined_types: struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; }

user_defined_types: struct idseq { unsigned short id; unsigned short seq; }

user_defined_types: struct pmtu { unsigned short ipm_void; unsigned short nextmtu; }

user_defined_types: struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; }

user_defined_types: struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; }

user_defined_types: struct ra_addr { unsigned int addr; unsigned int preference; }


AlertCEFCleanExit

decompiled_code:
void __fastcall AlertCEFCleanExit(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 560;
DebugMessageFunc(32LL, "AlertCEFCleanExit\n");
if ( a2 )
free(a2);
}

canonical_decompiled_code:
void __fastcall func3(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 560;
DebugMessageFunc(32LL, "AlertCEFCleanExit\n");
if ( a2 )
free(a2);
}

original_code:
void AlertCEFCleanExit(int signal, void *arg)
{
    CEFData *data = (CEFData *)arg;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 560; DebugMessageFunc(0x00000020, "AlertCEFCleanExit\n");;
    if(data)
        free(data);
}

canonical_original_code:
void AlertCEFCleanExit(int signal, void *arg)
{
    struct _CEFData *data = (CEFData *)arg;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 560; DebugMessageFunc(0x00000020, "AlertCEFCleanExit\n");;
    if(data)
        free(data);
}

user_defined_types: struct _CEFData { int facility; int priority; int options; }


AlertCEFRestart

decompiled_code:
void __fastcall AlertCEFRestart(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 569;
DebugMessageFunc(32LL, "AlertCEFRestartFunc\n");
if ( a2 )
free(a2);
}

canonical_decompiled_code:
void __fastcall func4(__int64 a1, void *a2)
{
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 569;
DebugMessageFunc(32LL, "AlertCEFRestartFunc\n");
if ( a2 )
free(a2);
}

original_code:
void AlertCEFRestart(int signal, void *arg)
{
    CEFData *data = (CEFData *)arg;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 569; DebugMessageFunc(0x00000020, "AlertCEFRestartFunc\n");;
    if(data)
        free(data);
}

canonical_original_code:
void AlertCEFRestart(int signal, void *arg)
{
    struct _CEFData *data = (CEFData *)arg;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 569; DebugMessageFunc(0x00000020, "AlertCEFRestartFunc\n");;
    if(data)
        free(data);
}


AlertCEFSetup

decompiled_code:
__int64 AlertCEFSetup()
{
RegisterOutputPlugin("alert_cef", 1LL, AlertCEFInit);
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 104;
return DebugMessageFunc(1LL, "Output plugin: Alert-CEF is setup...\n");
}

canonical_decompiled_code:
__int64 func5()
{
RegisterOutputPlugin("alert_cef", 1LL, AlertCEFInit);
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 104;
return DebugMessageFunc(1LL, "Output plugin: Alert-CEF is setup...\n");
}

original_code:
void AlertCEFSetup(void)
{
    RegisterOutputPlugin("alert_cef", OUTPUT_TYPE_FLAG__ALERT, AlertCEFInit);
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 104; DebugMessageFunc(0x00000001,"Output plugin: Alert-CEF is setup...\n");;
}

canonical_original_code:
void AlertCEFSetup()
{
    RegisterOutputPlugin("alert_cef", OUTPUT_TYPE_FLAG__ALERT, AlertCEFInit);
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 104; DebugMessageFunc(0x00000001,"Output plugin: Alert-CEF is setup...\n");;
}


AlertCEFInit

decompiled_code:
__int64 __fastcall AlertCEFInit(__int64 a1)
{
int *v1; // rbp
int v2; // eax
int v3; // esi

DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 122;
DebugMessageFunc(1LL, "Output: Alert-CEF Initialized\n");
v1 = (int *)ParseCEFArgs(a1);
v2 = BcDaemonMode();
v3 = v1[2];
if ( v2 )
{
v3 |= 1u;
v1[2] = v3;
}
openlog("barnyard2", v3, *v1);
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 132;
DebugMessageFunc(1LL, "Linking CEF alert function to call list...\n");
AddFuncToOutputList(AlertCEF, 1LL, v1);
AddFuncToCleanExitList(AlertCEFCleanExit, v1);
return AddFuncToRestartList(AlertCEFRestart, v1);
}

canonical_decompiled_code:
__int64 __fastcall func7(__int64 a1)
{
int *v1; // rbp
int v2; // eax
int v3; // esi

DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 122;
DebugMessageFunc(1LL, "Output: Alert-CEF Initialized\n");
v1 = (int *)func6(a1);
v2 = func0();
v3 = v1[2];
if ( v2 )
{
v3 |= 1u;
v1[2] = v3;
}
openlog("barnyard2", v3, *v1);
DebugMessageFile = "spo_alert_cef.c";
DebugMessageLine = 132;
DebugMessageFunc(1LL, "Linking CEF alert function to call list...\n");
AddFuncToOutputList(AlertCEF, 1LL, v1);
AddFuncToCleanExitList(AlertCEFCleanExit, v1);
return AddFuncToRestartList(AlertCEFRestart, v1);
}

original_code:
void AlertCEFInit(char *args)
{
    CEFData *data;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 122; DebugMessageFunc(0x00000001, "Output: Alert-CEF Initialized\n");;
    data = ParseCEFArgs(args);
    if (BcDaemonMode())
        data->options |= 0x01;
    openlog("barnyard2", data->options, data->facility);
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 132; DebugMessageFunc(0x00000001,"Linking CEF alert function to call list...\n");;
    AddFuncToOutputList(AlertCEF, OUTPUT_TYPE__ALERT, data);
    AddFuncToCleanExitList(AlertCEFCleanExit, data);
    AddFuncToRestartList(AlertCEFRestart, data);
}

canonical_original_code:
void AlertCEFInit(char *args)
{
    struct _CEFData *data;
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 122; DebugMessageFunc(0x00000001, "Output: Alert-CEF Initialized\n");;
    data = ParseCEFArgs(args);
    if (BcDaemonMode())
        data->options |= 0x01;
    openlog("barnyard2", data->options, data->facility);
    DebugMessageFile = "spo_alert_cef.c"; DebugMessageLine = 132; DebugMessageFunc(0x00000001,"Linking CEF alert function to call list...\n");;
    AddFuncToOutputList(AlertCEF, OUTPUT_TYPE__ALERT, data);
    AddFuncToCleanExitList(AlertCEFCleanExit, data);
    AddFuncToRestartList(AlertCEFRestart, data);
}

variable_types:
args
char *