I have a list full of Windows API calls:
 listOfSequences = 
    ['GetSystemDirectoryA',
     'IsDBCSLeadByte',
     'LocalAlloc',
     'CreateSemaphoreW',
     'CreateSemaphoreA',
     'GlobalAddAtomW',
     'lstrcpynW',
     'LoadLibraryExW',
     'SearchPathW',
     'CreateFileW',
     'CreateFileMappingW',
     'MapViewOfFileEx',
     'GetSystemMetrics',
     'RegisterClipboardFormatW',
     'SystemParametersInfoW',
     'GetDC',
     'GetDeviceCaps',
     'ReleaseDC', ...... and so on .....]
Since some of them occurs several times, I wanted to collected their number of occurences. Thus, I used collections.Counter. But it concatenates some APIs together:
lCountedAPIs = Counter(listOfSequences)
when I print the lCountedAPIs I get the folowing:
Counter({'IsRectEmptyLocalAlloc': 2,
         'DdePostAdvise': 3,
         'DispatchMessageWGetModuleFileNameA': 2,
         'FindResourceExW': 50318,
         'ReleaseDCGetModuleFileNameW': 7,
         'DefWindowProcAGetThreadLocale': 1,
         'CoGetCallContext': 40,
         'CoGetTreatAsClassGetCommandLineA': 1,
         'GetForegroundWindowGetSystemDirectoryW': 1,
         'GetModuleHandleWGetSystemTimeAsFileTime': 2,
         'WaitForSingleObjectExIsChild': 1,
         'LoadIconAGetWindowsDirectoryW': 2,
         'GlobalFreeLocalAlloc': 10,
         'GetMapModeCreateSemaphoreW': 1,
         'HeapLock': 11494,                  <---------- A
         'CharNextAGetCurrentProcessId': 11, <---------- B
         'RemovePropWGetStartupInfoA': 1,
         'GetTickCountGetVersionExW': 55,
So for ex.: HeapLock (see A) was not merged with another API But CharNextA was concatenated with GetCurrentProcessId (see B)
Can somebody tell me why this happens and how to fix that ?
Thanks in advcance & best regards :)
 
     
    