I have a list full of Windows API calls:
listOfSequences =
['GetSystemDirectoryA',
'IsDBCSLeadByte',
'LocalAlloc',
'CreateSemaphoreW',
'CreateSemaphoreA',
'GlobalAddAtomW',
'lstrcpynW',
'LoadLibraryExW',
'SearchPathW',
'CreateFileW',
'CreateFileMappingW',
'MapViewOfFileEx',
'GetSystemMetrics',
'RegisterClipboardFormatW',
'SystemParametersInfoW',
'GetDC',
'GetDeviceCaps',
'ReleaseDC', ...... and so on .....]
Since some of them occurs several times, I wanted to collected their number of occurences. Thus, I used collections.Counter. But it concatenates some APIs together:
lCountedAPIs = Counter(listOfSequences)
when I print the lCountedAPIs I get the folowing:
Counter({'IsRectEmptyLocalAlloc': 2,
'DdePostAdvise': 3,
'DispatchMessageWGetModuleFileNameA': 2,
'FindResourceExW': 50318,
'ReleaseDCGetModuleFileNameW': 7,
'DefWindowProcAGetThreadLocale': 1,
'CoGetCallContext': 40,
'CoGetTreatAsClassGetCommandLineA': 1,
'GetForegroundWindowGetSystemDirectoryW': 1,
'GetModuleHandleWGetSystemTimeAsFileTime': 2,
'WaitForSingleObjectExIsChild': 1,
'LoadIconAGetWindowsDirectoryW': 2,
'GlobalFreeLocalAlloc': 10,
'GetMapModeCreateSemaphoreW': 1,
'HeapLock': 11494, <---------- A
'CharNextAGetCurrentProcessId': 11, <---------- B
'RemovePropWGetStartupInfoA': 1,
'GetTickCountGetVersionExW': 55,
So for ex.: HeapLock (see A) was not merged with another API But CharNextA was concatenated with GetCurrentProcessId (see B)
Can somebody tell me why this happens and how to fix that ?
Thanks in advcance & best regards :)