anchor.diff:  registry,mgmt,advapi32.dll!RegOpenKeyExW
   registry,mgmt,advapi32.dll!RegOpenKeyW
   registry,mgmt,advapi32.dll!RegOverridePredefKey
  +registry,mgmt,advapi32.dll!RegRestoreKeyA
   registry,mgmt,advapi32.dll!RegRestoreKeyW
   registry,mgmt,advapi32.dll!RegSetKeySecurity
   registry,mgmt,advapi32.dll!RegUnLoadKeyW
  +registry,mgmt,kernel32.dll!RegCloseKey
  +registry,mgmt,kernel32.dll!RegOpenKeyExW
   registry,mgmt,ntdll.dll!ZwFlushKey
   registry,mgmt,ntdll.dll!ZwLoadKey
   registry,mgmt,ntdll.dll!ZwLoadKey2
  
positive.code: system,shell,shell32.dll!SHFileOperationW
  system,shell,shell32.dll!SHGetMalloc
  system,shell,shell32.dll!SHGetSetSettings
  system,shell,shell32.dll!SHOpenFolderAndSelectItems
  system,shell,shell32.dll!SHParseDisplayName
  system,shell,shlwapi.dll!SHAutoComplete
  
negative.code: execution,process,msvcrt.dll!_exit
  execution,process,msvcrt.dll!_getpid
  execution,process,msvcrt.dll!_initterm
  execution,process,msvcrt.dll!longjmp
  execution,process,msvcrt.dll!_onexit
  execution,process,msvcrt.dll!__set_app_type
  execution,process,msvcrt.dll!system
  