Rework calculation of imphash to match pefile/yara

[metthal]

Right now we calculate our own imphash which differs from the one generated by pefile or YARA.

The difference is in how we handle imports by ordinals. We just convert the ordinal to the number and append it to the hashed bytes, but both pefile and YARA create string ord<ordinal> [1]. On top of that, imports by ordinals from WS2_32, wsock2 and oleaut32 are translated into their names using lookup tables [2].

We should generate our imphash the same way as they do.

[1] https://github.com/VirusTotal/yara/blob/master/libyara/modules/pe_utils.c#L1926
[2] https://github.com/VirusTotal/yara/blob/master/libyara/modules/pe_utils.c#L357

[mbandzi]

Fixed in commit c1e94cb.