bunch of FN in our current rules

[williballenthin]

• free user process memory
• read data from Internet
• copy file
• crypto
• allocate user process RWX memory i386: incorrect disassembly for 6A FF vivisect/vivisect#296
• modify service
• get MAC address
• reference processor manufacturer constants
• set global application hook
• enumerate services
• start TCP server
• get Program Files directory pe: parse imports from the delay import table vivisect/vivisect#297
• delay execution
• get session integrity level
• reference anti-VM strings
• check for unmoving mouse cursor
• get Program Files directory

[mr-tz]

I've double checked the above and fixed one example address in #815.