anchor.diff:  memory,search,msvcrt.dll!memcmp
   memory,search,msvcrt.dll!_memicmp
   memory,search,ntdll.dll!_chkstk
  +memory,search,ntdll.dll!memchr
   memory,search,ntdll.dll!memcmp
  +memory,search,ntdll.dll!_memicmp
   memory,search,ntdll.dll!RtlCompareMemory
   memory,search,ntdll.dll!RtlGetProcessHeaps
   memory,search,ntdll.dll!ZwQueryVirtualMemory
  
positive.code: execution,thread,kernel32.dll!GetCurrentThreadId
  execution,thread,kernel32.dll!GetExitCodeThread
  execution,thread,kernel32.dll!GetThreadContext
  execution,thread,kernel32.dll!GetThreadIOPendingFlag
  execution,thread,kernel32.dll!GetThreadLocale
  execution,thread,kernel32.dll!GetThreadPreferredUILanguages
  
negative.code: network,ldap,Wldap32.dll!ldap_search_sA
  network,ldap,wldap32.dll!ldap_set_optionA
  network,ldap,Wldap32.dll!ldap_set_optionA
  network,ldap,wldap32.dll!ldap_simple_bind
  network,ldap,wldap32.dll!ldap_simple_bind_sA
  network,ldap,Wldap32.dll!ldap_simple_bind_sA
  network,ldap,wldap32.dll!ldap_unbind_s
  network,ldap,Wldap32.dll!ldap_unbind_s
  network,ldap,wldap32.dll!ldap_value_free_len
  network,ldap,Wldap32.dll!ldap_value_free_len
  network,mgmt,dsrole.dll!DsRoleGetDcOperationResults
  network,mgmt,dsrole.dll!DsRoleUpgradeDownlevelServer
  network,mgmt,iphlpapi.dll!AllocateAndGetTcpExTableFromStack
  network,mgmt,iphlpapi.dll!AllocateAndGetUdpExTableFromStack
  network,mgmt,iphlpapi.dll!CreateIpNetEntry
  