API Call Limiting in report.json

[cccs-kevin]

Thanks for contributing! But first: did you read our community guidelines?
https://cuckoo.sh/docs/introduction/community.html

What I have added/changed is:

Configuration option and ability to limit the number of calls a process makes included in the report.json.

The goal of my change is:

There are certain samples that use an unusually high amount of native API calls, which can be indicative of an anti-sandbox technique called API Hammering (ex. 9d4997249a633b7488270a550eafe4576362f7a9128eb20901669283f4746958). This causes the report.json to get very large >1Gb for some samples, all because a sample used FindResourceExW 500,000 times. I think it's fair to say that there should be an option to limit the number of calls included in the report.json, albeit it lossy, at least it allows for the configuration option to exist. Depending on the setup that consumes Cuckoo output, report.json is required to be loaded into memory in order to be parsed, and by setting a limit on the number of high-volume calls being made, this consumption is easier/possible for samples that use this technique and allows for most calls that we care about to be included in the report.json as well.

There were older issues and PRs created to address this: #1942, #365, #366.

I wrote a Cuckoo signature that hits on API Hammering as well: cuckoosandbox/community#484

What I have tested about my change is:

Manual testing using a variety of samples.