Handle API versions sandboxes vs. rules

[mr-tz]

I've noticed we run into issues since CAPE reports only list the api (like CreateFileA), however:

• rules often include the DLL (which we won't get easily here)
• use the generic name (like CreateFile [not A/W])

This is one way/part of handling this, maybe we can come up with a more generic way.

Originally posted by @mr-tz in #1809 (comment)

Statically, we always have all data. For dynamic we need to handle this differently.

[mr-tz]

CAPE sandbox output apis:

• no DLL names included (but could be possible?)
• A/W suffix for functions that have string arguments: e.g. RegOpenKeyExW / RegOpenKeyExA

See here for traced APIs: https://github.com/kevoreilly/CAPEv2/blob/3ac733c6d32fa0cdbe45f74920b21fa4c28203a3/lib/cuckoo/common/logtbl.py
Sidebar: We'll also have to double check which APIs (at which level, e.g. ntdll vs. kernel32) are traced and potentially update various rules.

capa rules apis:

• DLL name often included
• no rule with A/W suffix currently for functions that have string arguments: always use RegOpenKeyEx

So to make this work for dynamic analysis we'll have to:

• remove DLL names from rule apis (during rule loading)
• trim A/W suffix from sandbox trace (during CAPE feature extraction) - done in improve and fix various dynamic parts #1809

[mr-tz]

Question on "remove DLL names from rule apis (during rule loading)":

1. do this only for dynamic matching - would require to pass down static/dynamic flavor into get_rules, static stays unaffected
2. do this always (for both static and dynamic)

For the second option we could even reduce the overall extracted features. We loose some exactness but I see little practical impact.

[williballenthin]

agree that there's probably not a practical impact here. in theory there could be colliding API names, but i dont think i've ever seen this.

i like having the DLL names in the rules because it provides a hint to humans about where to find the routine. but i think we can very reasonably update the documentation to indicate that the DLL name is just used for documentation and not used during matching.

[mr-tz]

closed via #1824