anchor.diff:  registry,mgmt,advapi32.dll!RegOpenKeyW
   registry,mgmt,advapi32.dll!RegOverridePredefKey
   registry,mgmt,advapi32.dll!RegRestoreKeyW
  +registry,mgmt,advapi32.dll!RegSetKeySecurity
   registry,mgmt,advapi32.dll!RegUnLoadKeyW
  +registry,mgmt,ntdll.dll!ZwFlushKey
  +registry,mgmt,ntdll.dll!ZwLoadKey
  +registry,mgmt,ntdll.dll!ZwLoadKey2
  +registry,mgmt,ntdll.dll!ZwNotifyChangeKey
   registry,mgmt,ntdll.dll!ZwOpenKey
  +registry,mgmt,ntdll.dll!ZwReplaceKey
  +registry,mgmt,ntdll.dll!ZwRestoreKey
  +registry,mgmt,ntdll.dll!ZwSaveKey
  +registry,mgmt,ntdll.dll!ZwSetInformationKey
   registry,read,advapi32.dll!RegEnumKeyA
   registry,read,advapi32.dll!RegEnumKeyExA
   registry,read,advapi32.dll!RegEnumKeyExW
  
positive.code: system,clipboard,user32.dll!OpenClipboard
  system,clipboard,user32.dll!SetClipboardData
  system,clipboard,user32.dll!SetClipboardViewer
  system,console,kernel32.dll!AllocConsole
  system,console,kernel32.dll!AttachConsole
  system,console,kernel32.dll!FillConsoleOutputAttribute
  system,console,kernel32.dll!FillConsoleOutputCharacterA
  system,console,kernel32.dll!FillConsoleOutputCharacterW
  
negative.code: system,authorization,advapi32.dll!GetSidSubAuthority
  system,authorization,advapi32.dll!GetSidSubAuthorityCount
  system,authorization,advapi32.dll!GetTokenInformation
  system,authorization,advapi32.dll!ImpersonateAnonymousToken
  system,authorization,advapi32.dll!InitializeAcl
  system,authorization,advapi32.dll!InitializeSecurityDescriptor
  system,authorization,advapi32.dll!InitializeSid
  