数据结构
利用qiling 分析 httpstager shellcode
import os
from typing import Dict
from qiling import *
from qiling.const import *
from unicorn import *
from unicorn.x86_const import*
from binascii import hexlify
from capstone import *
X32BASE = 0
DLLHASH: Dict[str, int] = {}
FUNCHASH: Dict[str, int] = {}
ADDHASH: Dict[str, int] = {}
TARGETHASH: Dict[int, str] = {}
MDISA = Cs(CS_ARCH_X86, CS_MODE_32)
def spaced_hex(data):
return b' '.join(hexlify(data)[i:i + 2] for i in range(0, len(hexlify(data)), 2)).decode('utf-8')
def trace_code(ql: Qiling, address: int, size: int):
buf = ql.mem.read(address, size)
try:
for i in MDISA.disasm(buf, address):
# Disassembly
disassem = "{:08X}: {:24s} {:10s} {:16s}".format(
i.address-X32BASE, spaced_hex(buf), i.mnemonic, i.op_str)
print(disassem)
except:
import traceback
print(traceback.format_exc())
'''
seg000:00000015 020 8B 72 28 mov esi, [edx+28h] ; BaseDllName buffer
seg000:00000018 020 0F B7 4A 26 movzx ecx, word ptr [edx+26h] ; size
seg000:0000001C 020 31 FF xor edi, edi
'''
newdllname = ''
def hook_getdllname(ql: Qiling, *args, **kw):
global newdllname
mesi = ql.reg.esi
mecx = ql.reg.ecx
bdllname = ql.mem.read(mesi, mecx)
# print(bdllname)
s = bdllname.decode('utf16')
newdllname = s
if s not in DLLHASH.keys():
DLLHASH[s] = 0
print('dllname:', s)
'''
seg000:00000027 020 C1 CF 0D ror edi, 0Dh
seg000:0000002A 020 01 C7 add edi, eax
seg000:0000002C 020 E2 F0 loop loop_modname
seg000:0000002E 020 52 push edx
'''
def hook_getdllnamehash(ql: Qiling, *args, **kw): # 0000002Eh
# ctx = ql.arch.context_save()
# medi = ctx.reg_read(UC_X86_REG_EDI)
if DLLHASH[newdllname] == 0:
medi = ql.reg.edi
DLLHASH[newdllname] = medi
# print('hash(%s):%#x' % (newdllname.upper(), medi))
'''
seg000:0000004D 02C 8B 34 8B mov esi, [ebx+ecx*4] ; 函数名字符串
seg000:00000050 02C 01 D6 add esi, edx
seg000:00000052 02C 31 FF xor edi, edi
'''
newfuncname = ''
def hook_getfuncname(ql: Qiling, *args, **kw): # 00000052h
global newfuncname
mesi = ql.reg.esi
index = 0
bfuncname = b''
while True:
x = ql.mem.read(mesi+index, 1)
if x == b'\x00':
break
bfuncname += x
index += 1
s = bfuncname.decode()
newfuncname = s
if s not in FUNCHASH.keys():
FUNCHASH[newdllname+'.'+s] = 0
# print('funcname:', s)
'''
seg000:0000005E 02C 75 F4 jnz short ror13_54
seg000:00000060 02C 03 7D F8 add edi, [ebp-8] ; ==== Hash1(module) + Hash2(ApiName) ====
'''
def hook_getfuncnamehash(ql: Qiling, *args, **kw): # 60h
if FUNCHASH[newdllname+'.'+newfuncname]==0:
medi = ql.reg.edi
FUNCHASH[newdllname+'.'+newfuncname]=medi
# print('funcnamehash:%#x' % medi)
mebp = ql.reg.ebp
# bs = ql.mem.read(mebp-8, 4)
# dllnamehash = int.from_bytes(bs, 'little')
dllnamehash=ql.mem.read_ptr(mebp-8, 4)
addhash=medi+dllnamehash
ADDHASH[newdllname+'.'+newfuncname]=addhash
# print('dllnamehash:%#x' % dllnamehash)
# print('addhash:%#x' % (addhash))
'''
seg000:000002FD 084 8B 07 mov eax, [edi] ; edi-->lpdwNumberOfBytesRead
seg000:000002FF 084 01 C3 add ebx, eax ; ebx-->lpBuffer[lpdwNumberOfBytesRead:]
seg000:00000301 084 85 C0 test eax, eax
seg000:00000303 084 75 E5 jnz short InternetReadFile_2EA ; &lpdwNumberOfBytesRead
seg000:00000305 084 58 pop eax
seg000:00000306 080 C3 retn ; jmp lpBuffer
'''
def retncall(ql: Qiling, *args, **kw): # 0x306
meax = ql.reg.eax
print('next will call:%#x' % meax)
ql.stop()
def hook_hashfind_and_call(ql: Qiling, *args, **kw): # 6
mesp = ql.reg.esp
arg1 = ql.mem.read_ptr(mesp+4, 4)#esp+0-->retaddr esp+4-->arg1
if arg1 not in TARGETHASH.keys():
TARGETHASH[arg1]=''
print('[#]hashfind_and_call arg1_hash-->addhash:%#x' % arg1)
'''
seg000:00000060 02C 03 7D F8 add edi, [ebp-8] ; ==== Hash2(ApiName)-->EDI + Hash1(module)[ebp-8]-->hash(DLLNAME) ====
seg000:00000063 02C 3B 7D 24 cmp edi, [ebp+24h] ; arg1 funchash
seg000:00000066 02C 75 E2 jnz short next_funcname_4A ; ECX 为 0 则跳转
seg000:00000068 02C 58 pop eax ; IMAGE_DATA_DIRECTORY 还原当前模块的 EAT 的 VA
'''
def hook_cmphash(ql: Qiling, *args, **kw): # 68
medi=ql.reg.edi
if TARGETHASH[medi]=='':
TARGETHASH[medi]=newdllname+'.'+newfuncname
'''
seg000:000002F9 084 85 C0 test eax, eax
seg000:000002FB 084 74 C6 jz short exit_2C3 ; c4 Exit ExitOffset 708
'''
def patch_exit():
pass
def my_shellcode_emu(path, rootfs):
global X32BASE
# setup Qiling engine
shellcode = b''
with open(path, 'rb') as f:
shellcode = f.read()
ql = Qiling(code=shellcode, rootfs=rootfs, verbose=QL_VERBOSE.DEFAULT,
archtype='x86', ostype='windows') # archtype='x86', ostype='Windows' , profile='E:\\python_project\\windows.ql'
X32BASE = int(ql.profile.get("OS32", "entry_point"), 16)
# ql.hook_code(trace_code)
ql.hook_address(hook_hashfind_and_call, X32BASE + 0x6)
ql.hook_address(hook_cmphash, X32BASE + 0x68)
ql.hook_address(hook_getdllname, X32BASE + 0x1c)
ql.hook_address(hook_getdllnamehash, X32BASE + 0x2e)
ql.hook_address(hook_getfuncname, X32BASE + 0x52)
ql.hook_address(hook_getfuncnamehash, X32BASE + 0x60)
ql.patch(X32BASE+0x303, b'\x90\x90')
# ql.hook_address(hook_getlpbuffer, X32BASE + 0x2f1)
ql.hook_address(retncall, X32BASE + 0x306)
ql.run()
if __name__ == "__main__":
my_shellcode_emu("MEM_001A0000_00000320.bin",
"../qiling/examples/rootfs/x86_windows")
if os.path.exists('dllhash.txt'):
exit(0)
with open('dllhash.txt','w',encoding='utf8') as f:
for k,v in DLLHASH.items():
s=k+'|0x%08x'%(v&0xffffffff)+'\n'
f.write(s)
with open('funchash.txt','w',encoding='utf8') as f:
for k,v in FUNCHASH.items():
s=k+'|0x%08x'%(v&0xffffffff)+'\n'
f.write(s)
with open('addhash.txt','w',encoding='utf8') as f:
for k,v in ADDHASH.items():
s=k+'|0x%08x'%(v&0xffffffff)+'\n'
f.write(s)
with open('hash.txt','w',encoding='utf8') as f:
for k,v in TARGETHASH.items():
s='0x%08x|'%(k&0xffffffff)+v+'\n'
f.write(s)
hashfind
hashs
ntdll.dll.wcstoul|0xa18d83a9
ntdll.dll.wcstombs|0x95052c6a
ntdll.dll.wcstol|0xabdd6341
ntdll.dll.wcstok_s|0x91052baa
ntdll.dll.wcsstr|0xaa0d6481
ntdll.dll.wcsspn|0xa9ed6381
ntdll.dll.wcsrchr|0x89bd6069
ntdll.dll.wcspbrk|0x878542e9
ntdll.dll.wcsnlen|0x9b9d1fa9
ntdll.dll.wcsncpy_s|0x18f4f5a1
ntdll.dll.wcsncpy|0x89f52269
ntdll.dll.wcsncmp|0x89ad21a9
ntdll.dll.wcsncat_s|0x0ef405a1
ntdll.dll.wcsncat|0x89cd1ea9
ntdll.dll.wcslen|0x9bed60c1
ntdll.dll.wcscspn|0xa99c7269
ntdll.dll.wcscpy_s|0x2d053ba1
ntdll.dll.wcscpy|0x8a456381
ntdll.dll.wcscmp|0x89fd62c1
ntdll.dll.wcschr|0x8a0d6181
ntdll.dll.wcscat_s|0x23044ba1
ntdll.dll.wcscat|0x8a1d5fc1
ntdll.dll.vswprintf_s|0x40cd35a4
ntdll.dll.vsprintf_s|0xffe115a4
ntdll.dll.vsprintf|0x9590d2e9
ntdll.dll.vDbgPrintExWithPrefix|0xf90359c0
ntdll.dll.vDbgPrintEx|0x141822d5
ntdll.dll.towupper|0x180d3eaa
ntdll.dll.towlower|0xa60d2ea6
ntdll.dll.toupper|0xa3ed3f4a
ntdll.dll.tolower|0x31ed2f45
ntdll.dll.tan|0x2a0a2f8f
ntdll.dll.swscanf_s|0x06c8b5a0
ntdll.dll.swprintf_s|0x3fe135a4
ntdll.dll.swprintf|0x9290d369
ntdll.dll.strtoul|0x21d18328
ntdll.dll.strtol|0x2bcd5349
ntdll.dll.strtok_s|0x8d012dca
ntdll.dll.strstr|0x29fd5489
ntdll.dll.strspn|0x29dd5389
ntdll.dll.strrchr|0x0a015fe8
ntdll.dll.strpbrk|0x07c94268
ntdll.dll.strnlen|0x1be11f28
ntdll.dll.strncpy_s|0x29f4d581
ntdll.dll.strncpy|0x0a3921e8
ntdll.dll.strncmp|0x09f12128
ntdll.dll.strncat_s|0x1ff3e581
ntdll.dll.strncat|0x0a111e28
ntdll.dll.strlen|0x1bdd50c9
ntdll.dll.strcspn|0x29e071e8
ntdll.dll.strcpy_s|0x29013dc1
ntdll.dll.strcpy|0x0a355389
ntdll.dll.strcmp|0x09ed52c9
ntdll.dll.strchr|0x09fd5189
ntdll.dll.strcat_s|0x1f004dc1
ntdll.dll.strcat|0x0a0d4fc9
ntdll.dll.sscanf_s|0x02c51da0
ntdll.dll.sscanf|0x859c6309
ntdll.dll.sqrt|0x244163cf
ntdll.dll.sprintf_s|0x7fe11587
ntdll.dll.sprintf|0x1f90d2e8
ntdll.dll.sin|0x280a318f
ntdll.dll.qsort_s|0xac055d67
ntdll.dll.qsort|0xa0416408
ntdll.dll.pow|0x2252330f
ntdll.dll.memset|0xa9f500c2
ntdll.dll.memmove_s|0xf2f104e7
ntdll.dll.memmove|0xa15d12a6
ntdll.dll.memcpy_s|0x22ed3be1
ntdll.dll.memcpy|0x8a1d0382
ntdll.dll.memcmp|0x89d502c2
ntdll.dll.memchr|0x89e50182
ntdll.dll.mbstowcs|0x9f052c8a
ntdll.dll.log|0x19d2330f
ntdll.dll.labs|0x0438efcf
ntdll.dll.isxdigit|0x7b20d022
ntdll.dll.iswxdigit|0x852418a2
ntdll.dll.iswspace|0xeea53ea9
ntdll.dll.iswprint|0x7f1d6168
ntdll.dll.iswlower|0x9b0d2f26
ntdll.dll.iswgraph|0xeebd61e3
ntdll.dll.iswdigit|0x7b1cd022
ntdll.dll.iswctype|0x1ea581e1
ntdll.dll.iswascii|0xf2c57020
ntdll.dll.iswalpha|0x0c84ffe0
ntdll.dll.iswalnum|0x08e50320
ntdll.dll.isupper|0xa3fd3dea
ntdll.dll.isspace|0x85953d69
ntdll.dll.ispunct|0x200d8d67
ntdll.dll.isprint|0x160d6027
ntdll.dll.islower|0x31fd2de5
ntdll.dll.isgraph|0x85ad60a3
ntdll.dll.isdigit|0x120ccee1
ntdll.dll.iscntrl|0xabcd2121
ntdll.dll.isalpha|0xa374fea0
ntdll.dll.isalnum|0x9fd501e0
ntdll.dll.floor|0x2030f342
ntdll.dll.fabs|0x04388fcf
ntdll.dll.cos|0x0832330f
ntdll.dll.ceil|0x0c00618f
ntdll.dll.bsearch_s|0x86bf7be9
ntdll.dll.bsearch|0xa7ac4c82
ntdll.dll.atol|0x2a00430f
ntdll.dll.atoi|0x29e8430f
ntdll.dll.atan2|0x82317300
ntdll.dll.atan|0x2a103f8f
ntdll.dll.abs|0x04322fcf
ntdll.dll._wtol|0xaa01a33f
ntdll.dll._wtoi64|0x141d20e9
ntdll.dll._wtoi|0xa9e9a33f
ntdll.dll._wsplitpath_s|0x2d62e54c
ntdll.dll._wmakepath_s|0x3fea89ec
ntdll.dll._wcsupr_s|0x1f0833aa
ntdll.dll._wcsupr|0xae0d6f61
ntdll.dll._wcstoui64|0xb7153b7f
ntdll.dll._wcstoi64|0x8b10196a
ntdll.dll._wcsset_s|0x230783a9
ntdll.dll._wcsnset_s|0xcef445c1
ntdll.dll._wcsnicmp|0x80efc727
ntdll.dll._wcslwr_s|0x9f08a3a6
ntdll.dll._wcslwr|0x9c0d7121
ntdll.dll._wcsicmp|0xe8acd1a9
ntdll.dll._vswprintf|0x52948381
ntdll.dll._vsnwprintf_s|0x30473d02
ntdll.dll._vsnwprintf|0x0e526b86
ntdll.dll._vsnprintf_s|0x40ccf394
ntdll.dll._vsnprintf|0x52948261
ntdll.dll._vscwprintf|0x03526b86
ntdll.dll._vscprintf|0x52948101
ntdll.dll._ultow_s|0x90e92dea
ntdll.dll._ultow|0xabd4f34a
ntdll.dll._ultoa_s|0x64e92dea
ntdll.dll._ultoa|0xab24f34a
ntdll.dll._ui64tow_s|0x5a0cce22
ntdll.dll._ui64tow|0x8af981cb
ntdll.dll._ui64toa_s|0x2e0cce21
ntdll.dll._ui64toa|0x8a4981cb
ntdll.dll._swprintf|0x9293cb69
ntdll.dll._strupr_s|0x1b0435ca
ntdll.dll._strupr|0x2dfd5f69
ntdll.dll._strset_s|0x1f0385c9
ntdll.dll._strnset_s|0xdff425a1
ntdll.dll._strnicmp|0x7cebc947
ntdll.dll._strlwr_s|0x9b04a5c6
ntdll.dll._strlwr|0x1bfd6129
ntdll.dll._stricmp|0x68f0d129
ntdll.dll._strcmpi|0x7cb871e9
ntdll.dll._splitpath_s|0xfde2e3cc
ntdll.dll._splitpath|0x3588da21
ntdll.dll._snwscanf_s|0xc7868dbd
ntdll.dll._snwprintf_s|0x00c73b92
ntdll.dll._snwprintf|0x4d946b81
ntdll.dll._snscanf_s|0xbdc8b5b8
ntdll.dll._snprintf_s|0x409eeda4
ntdll.dll._snprintf|0x9293ca49
ntdll.dll._memicmp|0xe8b4d066
ntdll.dll._memccpy|0xe8fc7126
ntdll.dll._makepath_s|0x3fba83fc
ntdll.dll._ltow_s|0x31e92b29
ntdll.dll._ltow|0xaa58f33f
ntdll.dll._ltoa_s|0x05e92b29
ntdll.dll._ltoa|0xa9a8f33f
ntdll.dll._local_unwind4|0x73c3b234
ntdll.dll._lfind|0x153c9305
ntdll.dll._itow_s|0x31dd2b29
ntdll.dll._itow|0xaa58c33f
ntdll.dll._itoa_s|0x05dd2b29
ntdll.dll._itoa|0xa9a8c33f
ntdll.dll._i64tow_s|0x9a0c1e0a
ntdll.dll._i64tow|0x2bf97f0a
ntdll.dll._i64toa_s|0x6e0c1e0a
ntdll.dll._i64toa|0x2b497f0a
ntdll.dll._ftol2_sse|0x5d7b6221
ntdll.dll._ftol2|0x1fad7282
ntdll.dll._ftol|0xaa00933f
ntdll.dll._fltused|0x88718d8a
ntdll.dll._except_handler4_common|0xa1f5f8c8
ntdll.dll._errno|0xa7955302
ntdll.dll._chkstk|0x2984f063
ntdll.dll._aullshr|0x8904fda6
ntdll.dll._aullrem|0x86dcfce6
ntdll.dll._aulldvrm|0x90bb7aa6
ntdll.dll._aulldiv|0x6b24fde6
ntdll.dll._atoi64|0x13c520e9
ntdll.dll._allshr|0x29b4fd65
ntdll.dll._allshl|0x2984fd65
ntdll.dll._allrem|0x278cfca5
ntdll.dll._alloca_probe_8|0xc20af02c
ntdll.dll._alloca_probe_16|0x07363115
ntdll.dll._alloca_probe|0xb4a0da53
ntdll.dll._allmul|0x1d8500a5
ntdll.dll._alldvrm|0x8eb88026
ntdll.dll._alldiv|0x0bd4fda5
ntdll.dll.__toascii|0xe8a86840
ntdll.dll.__iscsymf|0x14a067e1
ntdll.dll.__iscsym|0x08ac71a9
ntdll.dll.__isascii|0xe8b866e0
ntdll.dll._CIsqrt|0xa54d6fd4
ntdll.dll._CIsin|0xa98ac1b1
ntdll.dll._CIpow|0xa3d2c331
ntdll.dll._CIlog|0x9b52c331
ntdll.dll._CIcos|0x89b2c331
ntdll.dll.ZwYieldExecution|0x23531262
ntdll.dll.ZwWriteVirtualMemory|0x64b045d4
ntdll.dll.ZwWriteRequestData|0x4bf2b75a
ntdll.dll.ZwWriteFileGather|0x9513978d
ntdll.dll.ZwWriteFile|0xc84d57c0
ntdll.dll.ZwWow64WriteVirtualMemory64|0x8ca2753f
ntdll.dll.ZwWow64ReadVirtualMemory64|0x5a9adcf6
ntdll.dll.ZwWow64QueryInformationProcess64|0x170b5c2a
ntdll.dll.ZwWow64IsProcessorFeaturePresent|0xa969f5ee
ntdll.dll.ZwWow64GetNativeSystemInformation|0xb5ddc901
ntdll.dll.ZwWow64GetCurrentProcessorNumberEx|0x48eb2074
ntdll.dll.ZwWow64DebuggerCall|0x0590aa88
ntdll.dll.ZwWow64CsrVerifyRegion|0xa3582d05
ntdll.dll.ZwWow64CsrIdentifyAlertableThread|0x6ad6ded0
ntdll.dll.ZwWow64CsrGetProcessId|0x434c1956
ntdll.dll.ZwWow64CsrFreeCaptureBuffer|0xd7a8f867
ntdll.dll.ZwWow64CsrClientConnectToServer|0xc68c4854
ntdll.dll.ZwWow64CsrClientCallServer|0xb1ff73b4
ntdll.dll.ZwWow64CsrCaptureMessageString|0x162cf9f6
ntdll.dll.ZwWow64CsrCaptureMessageBuffer|0x904037b7
ntdll.dll.ZwWow64CsrAllocateMessagePointer|0x878efb76
ntdll.dll.ZwWow64CsrAllocateCaptureBuffer|0x11496bfe
ntdll.dll.ZwWow64CallFunction64|0xc9918dfc
ntdll.dll.ZwWow64AllocateVirtualMemory64|0x696e58c3
ntdll.dll.ZwWorkerFactoryWorkerReady|0x12f420ad
ntdll.dll.ZwWaitLowEventPair|0xada0130c
ntdll.dll.ZwWaitHighEventPair|0xdedaf3d9
ntdll.dll.ZwWaitForWorkViaWorkerFactory|0x05aef4a4
ntdll.dll.ZwWaitForSingleObject|0x7c358785
ntdll.dll.ZwWaitForMultipleObjects32|0x408879bd
ntdll.dll.ZwWaitForMultipleObjects|0xf69b90a5
ntdll.dll.ZwWaitForKeyedEvent|0x28dc555a
ntdll.dll.ZwWaitForDebugEvent|0x51e85759
ntdll.dll.ZwWaitForAlertByThreadId|0x63f98cd6
ntdll.dll.ZwVdmControl|0x15aea15c
ntdll.dll.ZwUpdateWnfStateData|0x827bdfbe
ntdll.dll.ZwUnsubscribeWnfStateChange|0x6e10b248
ntdll.dll.ZwUnmapViewOfSectionEx|0xe43fc92e
ntdll.dll.ZwUnmapViewOfSection|0xbd21add1
ntdll.dll.ZwUnlockVirtualMemory|0x1aa319a3
ntdll.dll.ZwUnlockFile|0x4244161b
ntdll.dll.ZwUnloadKeyEx|0xd29dec61
ntdll.dll.ZwUnloadKey2|0xb8a46957
ntdll.dll.ZwUnloadKey|0x88db265e
ntdll.dll.ZwUnloadDriver|0xcca1b2b4
ntdll.dll.ZwUmsThreadYield|0x09d7b9f5
ntdll.dll.ZwTranslateFilePath|0x4408df2c
ntdll.dll.ZwTraceEvent|0xefc73507
ntdll.dll.ZwTraceControl|0x092600ff
ntdll.dll.ZwThawTransactions|0x2801cc47
ntdll.dll.ZwThawRegistry|0x7a5a95fd
ntdll.dll.ZwTestAlert|0xb3c7a26e
ntdll.dll.ZwTerminateThread|0xbb5f022a
ntdll.dll.ZwTerminateProcess|0x2135e0b4
ntdll.dll.ZwTerminateJobObject|0x49dbc7e6
ntdll.dll.ZwTerminateEnclave|0x18b6700e
ntdll.dll.ZwSystemDebugControl|0x7b40addc
ntdll.dll.ZwSuspendThread|0xe57c67bb
ntdll.dll.ZwSuspendProcess|0x4dbf31a0
ntdll.dll.ZwSubscribeWnfStateChange|0x91f2fa94
ntdll.dll.ZwStopProfile|0x333a1c14
ntdll.dll.ZwStartProfile|0x85fd99d0
ntdll.dll.ZwSinglePhaseReject|0x15573df2
ntdll.dll.ZwSignalAndWaitForSingleObject|0x3709e5de
ntdll.dll.ZwShutdownWorkerFactory|0x892fd2de
ntdll.dll.ZwShutdownSystem|0x379c3a04
ntdll.dll.ZwSetWnfProcessNotificationEvent|0xe9d13948
ntdll.dll.ZwSetVolumeInformationFile|0xeff316fe
ntdll.dll.ZwSetValueKey|0x1dc23473
ntdll.dll.ZwSetUuidSeed|0xd00d16eb
ntdll.dll.ZwSetTimerResolution|0xf55f44c7
ntdll.dll.ZwSetTimerEx|0xdcf5b0fb
ntdll.dll.ZwSetTimer2|0xb137aaa2
ntdll.dll.ZwSetTimer|0xf1048570
ntdll.dll.ZwSetThreadExecutionState|0x22c88897
ntdll.dll.ZwSetSystemTime|0x32c92bb6
ntdll.dll.ZwSetSystemPowerState|0xe1317534
ntdll.dll.ZwSetSystemInformation|0x6591d680
ntdll.dll.ZwSetSystemEnvironmentValueEx|0x32df6278
ntdll.dll.ZwSetSystemEnvironmentValue|0xe65c2c36
ntdll.dll.ZwSetSecurityObject|0xd3113054
ntdll.dll.ZwSetQuotaInformationFile|0x2427ccf7
ntdll.dll.ZwSetLowWaitHighEventPair|0x79759675
ntdll.dll.ZwSetLowEventPair|0xd7400222
ntdll.dll.ZwSetLdtEntries|0xf45e5bd8
ntdll.dll.ZwSetIoCompletionEx|0x22b98456
ntdll.dll.ZwSetIoCompletion|0x5e1b94be
ntdll.dll.ZwSetIntervalProfile|0x91ae542c
ntdll.dll.ZwSetInformationWorkerFactory|0xce8179c3
ntdll.dll.ZwSetInformationVirtualMemory|0xfcb18e26
ntdll.dll.ZwSetInformationTransactionManager|0x2d98ff4a
ntdll.dll.ZwSetInformationTransaction|0x5f793cf6
ntdll.dll.ZwSetInformationToken|0x44df1788
ntdll.dll.ZwSetInformationThread|0xc382b633
ntdll.dll.ZwSetInformationSymbolicLink|0xdf4eef92
ntdll.dll.ZwSetInformationResourceManager|0xfc567b31
ntdll.dll.ZwSetInformationProcess|0xc17e21d2
ntdll.dll.ZwSetInformationObject|0xc3ee36b0
ntdll.dll.ZwSetInformationKey|0x1115686a
ntdll.dll.ZwSetInformationJobObject|0x5bec0f4e
ntdll.dll.ZwSetInformationFile|0xd2a057e9
ntdll.dll.ZwSetInformationEnlistment|0xd0777ba2
ntdll.dll.ZwSetInformationDebugObject|0x9e40a072
ntdll.dll.ZwSetIRTimer|0x5269f78f
ntdll.dll.ZwSetHighWaitLowEventPair|0x0b7b5d2f
ntdll.dll.ZwSetHighEventPair|0x578c40d9
ntdll.dll.ZwSetEventBoostPriority|0xf5004774
ntdll.dll.ZwSetEvent|0x611557a9
ntdll.dll.ZwSetEaFile|0xba91391e
ntdll.dll.ZwSetDriverEntryOrder|0x45b0230f
ntdll.dll.ZwSetDefaultUILanguage|0x5a8eadd3
ntdll.dll.ZwSetDefaultLocale|0x0a9cf334
ntdll.dll.ZwSetDefaultHardErrorPort|0x6d738623
ntdll.dll.ZwSetDebugFilterState|0x9e541958
ntdll.dll.ZwSetContextThread|0x5e456116
ntdll.dll.ZwSetCachedSigningLevel2|0xab6fe286
ntdll.dll.ZwSetCachedSigningLevel|0xf80104b7
ntdll.dll.ZwSetBootOptions|0x695b9855
ntdll.dll.ZwSetBootEntryOrder|0x16a7949f
ntdll.dll.ZwSerializeBoot|0xb88f4ad8
ntdll.dll.ZwSecureConnectPort|0x077c41ba
ntdll.dll.ZwSaveMergedKeys|0xd1736e24
ntdll.dll.ZwSaveKeyEx|0xd7ab1f93
ntdll.dll.ZwSaveKey|0x50ef5b2b
ntdll.dll.ZwRollforwardTransactionManager|0x080abb0f
ntdll.dll.ZwRollbackTransaction|0x821bbbe2
ntdll.dll.ZwRollbackRegistryTransaction|0x5ae9e3c7
ntdll.dll.ZwRollbackEnlistment|0x2054fff6
ntdll.dll.ZwRollbackComplete|0x3e161466
ntdll.dll.ZwRevertContainerImpersonation|0xaad37ac0
ntdll.dll.ZwResumeThread|0x766071a1
ntdll.dll.ZwResumeProcess|0x9cebb8c0
ntdll.dll.ZwRestoreKey|0xce15bcfd
ntdll.dll.ZwResetWriteWatch|0x4f587bfc
ntdll.dll.ZwResetEvent|0x8202cd47
ntdll.dll.ZwRequestWaitReplyPort|0xd026f75d
ntdll.dll.ZwRequestPort|0x04b2d033
ntdll.dll.ZwReplyWaitReplyPort|0x6836ad75
ntdll.dll.ZwReplyWaitReceivePortEx|0xd92129e5
ntdll.dll.ZwReplyWaitReceivePort|0x98f53354
ntdll.dll.ZwReplyPort|0xc7a5d22a
ntdll.dll.ZwReplacePartitionUnit|0x5981bfee
ntdll.dll.ZwReplaceKey|0x4addbbf6
ntdll.dll.ZwRenameTransactionManager|0x5b6ab612
ntdll.dll.ZwRenameKey|0x7fa31ea4
ntdll.dll.ZwRemoveProcessDebug|0xf4fb7969
ntdll.dll.ZwRemoveIoCompletionEx|0x60861ca2
ntdll.dll.ZwRemoveIoCompletion|0x8b12c71f
ntdll.dll.ZwReleaseWorkerFactoryWorker|0x7612c62d
ntdll.dll.ZwReleaseSemaphore|0xb0891396
ntdll.dll.ZwReleaseMutant|0xa2526a1f
ntdll.dll.ZwReleaseKeyedEvent|0x96461973
ntdll.dll.ZwRegisterThreadTerminatePort|0x237a22a8
ntdll.dll.ZwRegisterProtocolAddressInformation|0x61d2288f
ntdll.dll.ZwRecoverTransactionManager|0xb33ca3c8
ntdll.dll.ZwRecoverResourceManager|0xce28b9f4
ntdll.dll.ZwRecoverEnlistment|0x741bf928
ntdll.dll.ZwReadVirtualMemory|0x6cac06cc
ntdll.dll.ZwReadRequestData|0x2c12a65d
ntdll.dll.ZwReadOnlyEnlistment|0x26e5b435
ntdll.dll.ZwReadFileScatter|0xc2457855
ntdll.dll.ZwReadFile|0xe74e5738
ntdll.dll.ZwRaiseHardError|0x5a84f02b
ntdll.dll.ZwRaiseException|0xdf68f660
ntdll.dll.ZwQueueApcThreadEx|0xd1fffbf5
ntdll.dll.ZwQueueApcThread|0xd8d8ae9c
ntdll.dll.ZwQueryWnfStateNameInformation|0xccbf1ec2
ntdll.dll.ZwQueryWnfStateData|0x750c9cc1
ntdll.dll.ZwQueryVolumeInformationFile|0xe730ea00
ntdll.dll.ZwQueryVirtualMemory|0x232c95eb
ntdll.dll.ZwQueryValueKey|0x99683862
ntdll.dll.ZwQueryTimerResolution|0x6a1fc297
ntdll.dll.ZwQueryTimer|0xc4067cae
ntdll.dll.ZwQuerySystemTime|0x1c4a2755
ntdll.dll.ZwQuerySystemInformationEx|0x0826ec24
ntdll.dll.ZwQuerySystemInformation|0x95b14a5d
ntdll.dll.ZwQuerySystemEnvironmentValueEx|0x36cdde1e
ntdll.dll.ZwQuerySystemEnvironmentValue|0x7e6be625
ntdll.dll.ZwQuerySymbolicLinkObject|0x01c8d6f6
ntdll.dll.ZwQuerySemaphore|0xe20ea425
ntdll.dll.ZwQuerySecurityPolicy|0x6af73ef3
ntdll.dll.ZwQuerySecurityObject|0xe2cb1eec
ntdll.dll.ZwQuerySecurityAttributesToken|0xdb2a0b45
ntdll.dll.ZwQuerySection|0x8b147acb
ntdll.dll.ZwQueryQuotaInformationFile|0xde880bdf
ntdll.dll.ZwQueryPortInformationProcess|0xc4fa00dc
ntdll.dll.ZwQueryPerformanceCounter|0x9979e229
ntdll.dll.ZwQueryOpenSubKeysEx|0xbb8239da
ntdll.dll.ZwQueryOpenSubKeys|0x6c7eb794
ntdll.dll.ZwQueryObject|0xed220eee
ntdll.dll.ZwQueryMutant|0x651ab1b8
ntdll.dll.ZwQueryMultipleValueKey|0x0333bb4f
ntdll.dll.ZwQueryLicenseValue|0x44e8fe89
ntdll.dll.ZwQueryKey|0xab01877f
ntdll.dll.ZwQueryIoCompletion|0xbe5a7c78
ntdll.dll.ZwQueryIntervalProfile|0x066ed1fb
ntdll.dll.ZwQueryInstallUILanguage|0x20a76dd9
ntdll.dll.ZwQueryInformationWorkerFactory|0xd26ff569
ntdll.dll.ZwQueryInformationTransactionManager|0x2f903d1d
ntdll.dll.ZwQueryInformationTransaction|0xf788f6e4
ntdll.dll.ZwQueryInformationToken|0x335abd8b
ntdll.dll.ZwQueryInformationThread|0xf3a22a10
ntdll.dll.ZwQueryInformationResourceManager|0xf7f564b2
ntdll.dll.ZwQueryInformationProcess|0x6067a2ce
ntdll.dll.ZwQueryInformationPort|0x53d97739
ntdll.dll.ZwQueryInformationJobObject|0x164c4e35
ntdll.dll.ZwQueryInformationFile|0x4760d5b9
ntdll.dll.ZwQueryInformationEnlistment|0xc7b54ea4
ntdll.dll.ZwQueryInformationByName|0x6b5fed19
ntdll.dll.ZwQueryInformationAtom|0x5da08679
ntdll.dll.ZwQueryFullAttributesFile|0x1182aaf7
ntdll.dll.ZwQueryEvent|0x34174ee6
ntdll.dll.ZwQueryEaFile|0x747fd12e
ntdll.dll.ZwQueryDriverEntryOrder|0x342bc912
ntdll.dll.ZwQueryDirectoryObject|0x633d70d4
ntdll.dll.ZwQueryDirectoryFileEx|0xe3398957
ntdll.dll.ZwQueryDirectoryFile|0x611d94d2
ntdll.dll.ZwQueryDefaultUILanguage|0x8aae21b0
ntdll.dll.ZwQueryDefaultLocale|0x486ff52c
ntdll.dll.ZwQueryDebugFilterState|0x8ccfbf5c
ntdll.dll.ZwQueryBootOptions|0x4652e45d
ntdll.dll.ZwQueryBootEntryOrder|0x26618337
ntdll.dll.ZwQueryAuxiliaryCounterFrequency|0xb8723089
ntdll.dll.ZwQueryAttributesFile|0x332261a2
ntdll.dll.ZwPulseEvent|0xfac74f06
ntdll.dll.ZwProtectVirtualMemory|0xaae7f949
ntdll.dll.ZwPropagationFailed|0x3952939b
ntdll.dll.ZwPropagationComplete|0xeef1b94f
ntdll.dll.ZwPrivilegedServiceAuditAlarm|0x856df951
ntdll.dll.ZwPrivilegeObjectAuditAlarm|0x04c8d91a
ntdll.dll.ZwPrivilegeCheck|0x4cd763cb
ntdll.dll.ZwPrepareEnlistment|0xa98efde8
ntdll.dll.ZwPrepareComplete|0x043afc5e
ntdll.dll.ZwPrePrepareEnlistment|0xa54aaf55
ntdll.dll.ZwPrePrepareComplete|0xb829eb24
ntdll.dll.ZwPowerInformation|0xaeac9882
ntdll.dll.ZwPlugPlayControl|0xdc593d0c
ntdll.dll.ZwOpenTransactionManager|0x259bcf91
ntdll.dll.ZwOpenTransaction|0x97395378
ntdll.dll.ZwOpenTimer|0x4e9f4578
ntdll.dll.ZwOpenThreadTokenEx|0x2d360063
ntdll.dll.ZwOpenThreadToken|0x924586ae
ntdll.dll.ZwOpenThread|0x3302e337
ntdll.dll.ZwOpenSymbolicLinkObject|0x668e235b
ntdll.dll.ZwOpenSession|0x31469d35
ntdll.dll.ZwOpenSemaphore|0x6e9b3ccf
ntdll.dll.ZwOpenSection|0x3146ad2d
ntdll.dll.ZwOpenResourceManager|0xfdbe9ead
ntdll.dll.ZwOpenRegistryTransaction|0xf0ff015e
ntdll.dll.ZwOpenProcessTokenEx|0x010d53e2
ntdll.dll.ZwOpenProcessToken|0x8d94e3fc
ntdll.dll.ZwOpenProcess|0x29a19dd3
ntdll.dll.ZwOpenPrivateNamespace|0xac15bcfe
ntdll.dll.ZwOpenPartition|0xdf2fe4ab
ntdll.dll.ZwOpenObjectAuditAlarm|0xa711bc3a
ntdll.dll.ZwOpenMutant|0xab67067e
ntdll.dll.ZwOpenKeyedEvent|0xe00c0a04
ntdll.dll.ZwOpenKeyTransactedEx|0xe8f12f7b
ntdll.dll.ZwOpenKeyTransacted|0xf134736a
ntdll.dll.ZwOpenKeyEx|0xe6cefd73
ntdll.dll.ZwOpenKey|0xd12beaa2
ntdll.dll.ZwOpenJobObject|0x64cb0fa8
ntdll.dll.ZwOpenIoCompletion|0x117395a9
ntdll.dll.ZwOpenFile|0xe45e589d
ntdll.dll.ZwOpenEventPair|0x64354991
ntdll.dll.ZwOpenEvent|0xbeb017b0
ntdll.dll.ZwOpenEnlistment|0xd347c29a
ntdll.dll.ZwOpenDirectoryObject|0xc5e3a306
ntdll.dll.ZwNotifyChangeSession|0xe9432ff9
ntdll.dll.ZwNotifyChangeMultipleKeys|0x21a379d5
ntdll.dll.ZwNotifyChangeKey|0xfd676a6b
ntdll.dll.ZwNotifyChangeDirectoryFileEx|0x0997b81c
ntdll.dll.ZwNotifyChangeDirectoryFile|0x75b70d8d
ntdll.dll.ZwModifyDriverEntry|0x73edcab4
ntdll.dll.ZwModifyBootEntry|0x2e7ff75a
ntdll.dll.ZwMapViewOfSectionEx|0x2c0459c6
ntdll.dll.ZwMapViewOfSection|0x1e40c013
ntdll.dll.ZwMapUserPhysicalPagesScatter|0x2a4fc415
ntdll.dll.ZwMapUserPhysicalPages|0xea8ea996
ntdll.dll.ZwMapCMFModule|0x36420033
ntdll.dll.ZwManagePartition|0x0f2a8e87
ntdll.dll.ZwManageHotPatch|0x4550b121
ntdll.dll.ZwMakeTemporaryObject|0x3fb21fe8
ntdll.dll.ZwMakePermanentObject|0xbe163f16
ntdll.dll.ZwLockVirtualMemory|0xacb6229c
ntdll.dll.ZwLockRegistryKey|0x35d9cccb
ntdll.dll.ZwLockProductActivationKeys|0x5a531965
ntdll.dll.ZwLockFile|0x6156587c
ntdll.dll.ZwLoadKeyEx|0xe5a6e4f3
ntdll.dll.ZwLoadKey2|0xd7b6abb8
ntdll.dll.ZwLoadKey|0xd1274a40
ntdll.dll.ZwLoadEnclaveData|0x23045dd7
ntdll.dll.ZwLoadDriver|0x91324afc
ntdll.dll.ZwListenPort|0x95c4903a
ntdll.dll.ZwIsUILanguageComitted|0xa884cfcf
ntdll.dll.ZwIsSystemResumeAutomatic|0x6189d5b9
ntdll.dll.ZwIsProcessInJob|0x973f62bf
ntdll.dll.ZwInitiatePowerAction|0xa0dc594a
ntdll.dll.ZwInitializeRegistry|0xe2063507
ntdll.dll.ZwInitializeNlsFiles|0x4e059296
ntdll.dll.ZwInitializeEnclave|0x9e0d5a21
ntdll.dll.ZwImpersonateThread|0x5921b606
ntdll.dll.ZwImpersonateClientOfPort|0x695f9f0f
ntdll.dll.ZwImpersonateAnonymousToken|0x4309b2cf
ntdll.dll.ZwGetWriteWatch|0x38e1c12c
ntdll.dll.ZwGetNotificationResourceManager|0x6c2ea71b
ntdll.dll.ZwGetNlsSectionPtr|0x658725a1
ntdll.dll.ZwGetNextThread|0x697e68b3
ntdll.dll.ZwGetNextProcess|0x557b51b0
ntdll.dll.ZwGetMUIRegistryInfo|0x4a6261fe
ntdll.dll.ZwGetDevicePowerState|0x5b926912
ntdll.dll.ZwGetCurrentProcessorNumberEx|0x6d553b9b
ntdll.dll.ZwGetCurrentProcessorNumber|0x6f46039b
ntdll.dll.ZwGetContextThread|0x5e396116
ntdll.dll.ZwGetCompleteWnfStateSubscription|0xfe1116a4
ntdll.dll.ZwGetCachedSigningLevel|0xf7fb04b7
ntdll.dll.ZwFsControlFile|0xad0df41d
ntdll.dll.ZwFreezeTransactions|0x5a141e25
ntdll.dll.ZwFreezeRegistry|0x982db722
ntdll.dll.ZwFreeVirtualMemory|0xecb90a6c
ntdll.dll.ZwFreeUserPhysicalPages|0x42f6320d
ntdll.dll.ZwFlushWriteBuffer|0x5431c3cd
ntdll.dll.ZwFlushVirtualMemory|0x407c51a4
ntdll.dll.ZwFlushProcessWriteBuffers|0xf029f930
ntdll.dll.ZwFlushKey|0x2040765f
ntdll.dll.ZwFlushInstructionCache|0x95dcb1bb
ntdll.dll.ZwFlushInstallUILanguage|0x1c62efae
ntdll.dll.ZwFlushBuffersFileEx|0xb33fb802
ntdll.dll.ZwFlushBuffersFile|0x0c5dad8c
ntdll.dll.ZwFindAtom|0xf1c20878
ntdll.dll.ZwFilterTokenEx|0x75f98dfe
ntdll.dll.ZwFilterToken|0xfb6894e4
ntdll.dll.ZwFilterBootOption|0x75fcb3ee
ntdll.dll.ZwExtendSection|0x9d12d146
ntdll.dll.ZwEnumerateValueKey|0xa18e265e
ntdll.dll.ZwEnumerateTransactionObject|0x84058666
ntdll.dll.ZwEnumerateSystemEnvironmentValuesEx|0x16093c0d
ntdll.dll.ZwEnumerateKey|0xbb4d6377
ntdll.dll.ZwEnumerateDriverEntries|0x23815561
ntdll.dll.ZwEnumerateBootEntries|0x325bbcb8
ntdll.dll.ZwEnableLastKnownGood|0xc2943071
ntdll.dll.ZwDuplicateToken|0xd65b5e63
ntdll.dll.ZwDuplicateObject|0xfacac292
ntdll.dll.ZwDrawText|0x51c73be2
ntdll.dll.ZwDisplayString|0xd910a4e1
ntdll.dll.ZwDisableLastKnownGood|0x93e2f9d6
ntdll.dll.ZwDeviceIoControlFile|0x58643796
ntdll.dll.ZwDeleteWnfStateName|0xfe647da6
ntdll.dll.ZwDeleteWnfStateData|0xfe43df66
ntdll.dll.ZwDeleteValueKey|0xc3c0cbd6
ntdll.dll.ZwDeletePrivateNamespace|0x8ead0060
ntdll.dll.ZwDeleteObjectAuditAlarm|0x89a8ff9c
ntdll.dll.ZwDeleteKey|0xffb2ae67
ntdll.dll.ZwDeleteFile|0x0287ccd3
ntdll.dll.ZwDeleteDriverEntry|0x7ae3b92d
ntdll.dll.ZwDeleteBootEntry|0x129bcf14
ntdll.dll.ZwDeleteAtom|0x18c77d93
ntdll.dll.ZwDelayExecution|0x613cbed8
ntdll.dll.ZwDebugContinue|0x0549ed22
ntdll.dll.ZwDebugActiveProcess|0xa5d0b1ce
ntdll.dll.ZwCreateWorkerFactory|0x0d64c90a
ntdll.dll.ZwCreateWnfStateName|0x7e1d7e0e
ntdll.dll.ZwCreateWaitablePort|0x475ca76f
ntdll.dll.ZwCreateWaitCompletionPacket|0x4dd6ded3
ntdll.dll.ZwCreateUserProcess|0xb8e1d6d9
ntdll.dll.ZwCreateTransactionManager|0xcd0aa6ee
ntdll.dll.ZwCreateTransaction|0x7c74ca33
ntdll.dll.ZwCreateTokenEx|0xa76c0689
ntdll.dll.ZwCreateToken|0x282e5ec6
ntdll.dll.ZwCreateTimer2|0x7be984ee
ntdll.dll.ZwCreateTimer|0x2c4dfec6
ntdll.dll.ZwCreateThreadEx|0xfa48803e
ntdll.dll.ZwCreateThread|0xfd79d0ad
ntdll.dll.ZwCreateSymbolicLinkObject|0x0dfcfab7
ntdll.dll.ZwCreateSemaphore|0x5a302aaa
ntdll.dll.ZwCreateSectionEx|0xd9148e26
ntdll.dll.ZwCreateSection|0x9cf500e5
ntdll.dll.ZwCreateResourceManager|0xb52a4d01
ntdll.dll.ZwCreateRegistryTransaction|0xabe43cd5
ntdll.dll.ZwCreateProfileEx|0xd3dc47a6
ntdll.dll.ZwCreateProfile|0x9ce01fcb
ntdll.dll.ZwCreateProcessEx|0xefd0b7a4
ntdll.dll.ZwCreateProcess|0x954ff18b
ntdll.dll.ZwCreatePrivateNamespace|0x1eb3785b
ntdll.dll.ZwCreatePort|0xc800d5d3
ntdll.dll.ZwCreatePartition|0xcac4d286
ntdll.dll.ZwCreatePagingFile|0x849046be
ntdll.dll.ZwCreateNamedPipeFile|0x5a73e30a
ntdll.dll.ZwCreateMutant|0x75ddf3f4
ntdll.dll.ZwCreateMailslotFile|0xccefc696
ntdll.dll.ZwCreateLowBoxToken|0x14c1272a
ntdll.dll.ZwCreateKeyedEvent|0x4ee366ac
ntdll.dll.ZwCreateKeyTransacted|0x40122224
ntdll.dll.ZwCreateKey|0x0ca2a587
ntdll.dll.ZwCreateJobSet|0x59d0d1b1
ntdll.dll.ZwCreateJobObject|0x505ffd83
ntdll.dll.ZwCreateIoCompletion|0xc74abf85
ntdll.dll.ZwCreateIRTimer|0x24c84d1d
ntdll.dll.ZwCreateFile|0xbb883453
ntdll.dll.ZwCreateEventPair|0x4fca376c
ntdll.dll.ZwCreateEvent|0x9c5ed0ff
ntdll.dll.ZwCreateEnlistment|0x421f1f42
ntdll.dll.ZwCreateEnclave|0x8cd080e5
ntdll.dll.ZwCreateDirectoryObjectEx|0xefa8ab5e
ntdll.dll.ZwCreateDirectoryObject|0x7d4f515a
ntdll.dll.ZwCreateDebugObject|0xbb3c2daf
ntdll.dll.ZwCreateCrossVmEvent|0xc584fba0
ntdll.dll.ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter|0x0993d7a9
ntdll.dll.ZwContinue|0xe2848ac0
ntdll.dll.ZwConnectPort|0x7d54b836
ntdll.dll.ZwCompressKey|0xb786de95
ntdll.dll.ZwCompleteConnectPort|0x96b3d493
ntdll.dll.ZwCompareTokens|0x61e7dabf
ntdll.dll.ZwCompareSigningLevels|0x3199e508
ntdll.dll.ZwCompareObjects|0xc77f315c
ntdll.dll.ZwCompactKeys|0x6b4c6176
ntdll.dll.ZwCommitTransaction|0x76f1fb24
ntdll.dll.ZwCommitRegistryTransaction|0x9cdeba06
ntdll.dll.ZwCommitEnlistment|0xe83d3e91
ntdll.dll.ZwCommitComplete|0xa935b561
ntdll.dll.ZwCloseObjectAuditAlarm|0x85b7ba68
ntdll.dll.ZwClose|0xa1a4ff71
ntdll.dll.ZwClearEvent|0xb3fb04c3
ntdll.dll.ZwCancelWaitCompletionPacket|0xc61a6796
ntdll.dll.ZwCancelTimer2|0xacc795d0
ntdll.dll.ZwCancelTimer|0xee6a44e2
ntdll.dll.ZwCancelSynchronousIoFile|0xa2def156
ntdll.dll.ZwCancelIoFileEx|0x281d69ac
ntdll.dll.ZwCancelIoFile|0xb6312453
ntdll.dll.ZwCallbackReturn|0xa20f9c4a
ntdll.dll.ZwCallEnclave|0x5f0a652a
ntdll.dll.ZwAssociateWaitCompletionPacket|0xb37d434c
ntdll.dll.ZwAssignProcessToJobObject|0x21c3ea3f
ntdll.dll.ZwAreMappedFilesTheSame|0x6a4f7cb7
ntdll.dll.ZwApphelpCacheControl|0xb219f584
ntdll.dll.ZwAlpcSetInformation|0xc88cf64e
ntdll.dll.ZwAlpcSendWaitReceivePort|0x7e3d06b0
ntdll.dll.ZwAlpcRevokeSecurityContext|0xdbd3d6fc
ntdll.dll.ZwAlpcQueryInformationMessage|0x0f4fb8f2
ntdll.dll.ZwAlpcQueryInformation|0x8ae9a9bf
ntdll.dll.ZwAlpcOpenSenderThread|0x566b73e2
ntdll.dll.ZwAlpcOpenSenderProcess|0xaef2b918
ntdll.dll.ZwAlpcImpersonateClientOfPort|0x20eab891
ntdll.dll.ZwAlpcImpersonateClientContainerOfPort|0xda66eda1
ntdll.dll.ZwAlpcDisconnectPort|0x95c6b968
ntdll.dll.ZwAlpcDeleteSecurityContext|0xd94cc344
ntdll.dll.ZwAlpcDeleteSectionView|0x6944b461
ntdll.dll.ZwAlpcDeleteResourceReserve|0x86b14c49
ntdll.dll.ZwAlpcDeletePortSection|0x68d10c1e
ntdll.dll.ZwAlpcCreateSecurityContext|0xa84c3545
ntdll.dll.ZwAlpcCreateSectionView|0x8951a458
ntdll.dll.ZwAlpcCreateResourceReserve|0x55b0be4a
ntdll.dll.ZwAlpcCreatePortSection|0x88ddfc15
ntdll.dll.ZwAlpcCreatePort|0xde33db42
ntdll.dll.ZwAlpcConnectPortEx|0xcf2ec869
ntdll.dll.ZwAlpcConnectPort|0xa8cd69ce
ntdll.dll.ZwAlpcCancelMessage|0xf1eadb28
ntdll.dll.ZwAlpcAcceptConnectPort|0xccdaaffd
ntdll.dll.ZwAllocateVirtualMemoryEx|0x1e00a324
ntdll.dll.ZwAllocateVirtualMemory|0x9608b139
ntdll.dll.ZwAllocateUuids|0x182a89e1
ntdll.dll.ZwAllocateUserPhysicalPages|0x3d62fca1
ntdll.dll.ZwAllocateReserveObject|0x54ea6454
ntdll.dll.ZwAllocateLocallyUniqueId|0x75bf5417
ntdll.dll.ZwAlertThreadByThreadId|0x7b0b2c73
ntdll.dll.ZwAlertThread|0xac968dcf
ntdll.dll.ZwAlertResumeThread|0x330d87b5
ntdll.dll.ZwAdjustTokenClaimsAndDeviceGroups|0x75a3b8e4
ntdll.dll.ZwAdjustPrivilegesToken|0x1f497e59
ntdll.dll.ZwAdjustGroupsToken|0xa715382c
ntdll.dll.ZwAddDriverEntry|0xb51772fe
ntdll.dll.ZwAddBootEntry|0x57849dfc
ntdll.dll.ZwAddAtomEx|0x421b2d68
ntdll.dll.ZwAddAtom|0xa2991b62
ntdll.dll.ZwAcquireProcessActivityReference|0xba235b5e
ntdll.dll.ZwAccessCheckByTypeResultListAndAuditAlarmByHandle|0x052d2391
ntdll.dll.ZwAccessCheckByTypeResultListAndAuditAlarm|0x829c0887
ntdll.dll.ZwAccessCheckByTypeResultList|0x2d4b23bd
ntdll.dll.ZwAccessCheckByTypeAndAuditAlarm|0xc96d61f2
ntdll.dll.ZwAccessCheckByType|0xcffdfa4b
ntdll.dll.ZwAccessCheckAndAuditAlarm|0xb0f587e4
ntdll.dll.ZwAccessCheck|0xe049de1a
ntdll.dll.ZwAcceptConnectPort|0x067a021a
ntdll.dll.Wow64Transition|0x12cad084
ntdll.dll.WinSqmStartSqmOptinListener|0xcfa1941f
ntdll.dll.WinSqmStartSessionForPartner|0x7fe29f98
ntdll.dll.WinSqmStartSession|0xf740ca44
ntdll.dll.WinSqmSetString|0xd20ba2e0
ntdll.dll.WinSqmSetIfMinDWORD|0xd27844f2
ntdll.dll.WinSqmSetIfMaxDWORD|0xd2a043f2
ntdll.dll.WinSqmSetEscalationInfo|0xa4d5d6c2
ntdll.dll.WinSqmSetDWORD64|0xc85134a9
ntdll.dll.WinSqmSetDWORD|0xa8ba738e
ntdll.dll.WinSqmIsSessionDisabled|0x90ae4f28
ntdll.dll.WinSqmIsOptedInEx|0x497194f5
ntdll.dll.WinSqmIsOptedIn|0xd6b67500
ntdll.dll.WinSqmIncrementDWORD|0xe96a10a6
ntdll.dll.WinSqmGetInstrumentationProperty|0x77aac20f
ntdll.dll.WinSqmGetEscalationRuleStatus|0x6dd2147b
ntdll.dll.WinSqmEventWrite|0x854fd16a
ntdll.dll.WinSqmEventEnabled|0xfd17951c
ntdll.dll.WinSqmEndSession|0x845b9cd8
ntdll.dll.WinSqmCommonDatapointSetString|0xad0dd931
ntdll.dll.WinSqmCommonDatapointSetStreamEx|0xeb49d128
ntdll.dll.WinSqmCommonDatapointSetDWORD64|0x7ad80cbb
ntdll.dll.WinSqmCommonDatapointSetDWORD|0xef848eee
ntdll.dll.WinSqmCommonDatapointDelete|0xffc8c81b
ntdll.dll.WinSqmCheckEscalationSetString|0x5a574b21
ntdll.dll.WinSqmCheckEscalationSetDWORD64|0x0a557706
ntdll.dll.WinSqmCheckEscalationSetDWORD|0x1dc28497
ntdll.dll.WinSqmCheckEscalationAddToStreamEx|0x078d339a
ntdll.dll.WinSqmAddToStreamEx|0x4d092b16
ntdll.dll.WinSqmAddToStream|0x5ac4d359
ntdll.dll.WinSqmAddToAverageDWORD|0x908072b9
ntdll.dll.WerReportSQMEvent|0xd43d8ef5
ntdll.dll.WerReportExceptionWorker|0x53f0c95c
ntdll.dll.VerSetConditionMask|0x55a7e00d
ntdll.dll.TpWaitForWork|0x0064fbe1
ntdll.dll.TpWaitForWait|0xe4acf9a1
ntdll.dll.TpWaitForTimer|0xdcbfc424
ntdll.dll.TpWaitForJobNotification|0x1da44a41
ntdll.dll.TpWaitForIoCompletion|0xd5836b3b
ntdll.dll.TpWaitForAlpcCompletion|0x71a75a58
ntdll.dll.TpTrimPools|0x9497cfb4
ntdll.dll.TpTimerOutstandingCallbackCount|0xb2c16261
ntdll.dll.TpStartAsyncIoOperation|0xc4db29a2
ntdll.dll.TpSimpleTryPost|0xb1666583
ntdll.dll.TpSetWaitEx|0x11675f5c
ntdll.dll.TpSetWait|0x75d64c2a
ntdll.dll.TpSetTimerEx|0xdce7b09b
ntdll.dll.TpSetTimer|0x71044d6f
ntdll.dll.TpSetPoolWorkerThreadIdleTimeout|0x1b67b789
ntdll.dll.TpSetPoolThreadCpuSets|0x8a87f967
ntdll.dll.TpSetPoolThreadBasePriority|0x251ad542
ntdll.dll.TpSetPoolStackInformation|0xfd8a8f56
ntdll.dll.TpSetPoolMinThreads|0x889ac4b3
ntdll.dll.TpSetPoolMaxThreadsSoftLimit|0x907e8916
ntdll.dll.TpSetPoolMaxThreads|0x929a84b3
ntdll.dll.TpSetDefaultPoolStackInformation|0xe531f3d0
ntdll.dll.TpSetDefaultPoolMaxThreads|0x6bb8fe9d
ntdll.dll.TpReleaseWork|0x716b173c
ntdll.dll.TpReleaseWait|0x55b314fc
ntdll.dll.TpReleaseTimer|0xb7934c55
ntdll.dll.TpReleasePool|0x7172a67c
ntdll.dll.TpReleaseJobNotification|0x54592c4e
ntdll.dll.TpReleaseIoCompletion|0x2ff47156
ntdll.dll.TpReleaseCleanupGroupMembers|0x5c45d5d6
ntdll.dll.TpReleaseCleanupGroup|0xbd0de310
ntdll.dll.TpReleaseAlpcCompletion|0x0de8e12e
ntdll.dll.TpQueryPoolStackInformation|0xe7e91532
ntdll.dll.TpPostWork|0x71c731ff
ntdll.dll.TpIsTimerSet|0xfed8fb34
ntdll.dll.TpDisassociateCallback|0x385b1d7d
ntdll.dll.TpDisablePoolCallbackChecks|0xa0bde337
ntdll.dll.TpDbgSetLogRoutine|0x7c369b3a
ntdll.dll.TpDbgDumpHeapUsage|0x62ab5453
ntdll.dll.TpCheckTerminateWorker|0x9147d4ca
ntdll.dll.TpCaptureCaller|0xafa26b98
ntdll.dll.TpCancelAsyncIoOperation|0x652280ae
ntdll.dll.TpCallbackUnloadDllOnCompletion|0x58880e64
ntdll.dll.TpCallbackSetEventOnCompletion|0xabba9ed0
ntdll.dll.TpCallbackSendPendingAlpcMessage|0xbcccf6ac
ntdll.dll.TpCallbackSendAlpcMessageOnCompletion|0xec6b689f
ntdll.dll.TpCallbackReleaseSemaphoreOnCompletion|0xcd512855
ntdll.dll.TpCallbackReleaseMutexOnCompletion|0xc7f07a7a
ntdll.dll.TpCallbackMayRunLong|0xdd3276a5
ntdll.dll.TpCallbackLeaveCriticalSectionOnCompletion|0xde3379fe
ntdll.dll.TpCallbackIndependent|0x7dc1b546
ntdll.dll.TpCallbackDetectedUnrecoverableError|0x6dfd3fc6
ntdll.dll.TpAlpcUnregisterCompletionList|0x09a421ab
ntdll.dll.TpAlpcRegisterCompletionList|0x01684432
ntdll.dll.TpAllocWork|0x0e5db99d
ntdll.dll.TpAllocWait|0xf2a5b75d
ntdll.dll.TpAllocTimer|0xcaa033ea
ntdll.dll.TpAllocPool|0x0e6548dd
ntdll.dll.TpAllocJobNotification|0x991c6633
ntdll.dll.TpAllocIoCompletion|0x919163f9
ntdll.dll.TpAllocCleanupGroup|0x1eaad5b2
ntdll.dll.TpAllocAlpcCompletionEx|0xe536c69c
ntdll.dll.TpAllocAlpcCompletion|0x752589c7
ntdll.dll.ShipAssertMsgW|0x1103f88a
ntdll.dll.ShipAssertMsgA|0x1053f88a
ntdll.dll.ShipAssertGetBufferInfo|0x91d25377
ntdll.dll.ShipAssert|0xb648b21e
ntdll.dll.SbSelectProcedure|0xb6809ef2
ntdll.dll.SbExecuteProcedure|0xa6c5a06b
ntdll.dll.RtlxUnicodeStringToOemSize|0xb9ad9d19
ntdll.dll.RtlxUnicodeStringToAnsiSize|0x402c9656
ntdll.dll.RtlxOemStringToUnicodeSize|0xffb775d2
ntdll.dll.RtlxAnsiStringToUnicodeSize|0x78e702f2
ntdll.dll.RtlpWaitForCriticalSection|0xa734ade1
ntdll.dll.RtlpVerifyAndCommitUILanguageSettings|0xe164b478
ntdll.dll.RtlpUnWaitCriticalSection|0xed5bfc14
ntdll.dll.RtlpTimeToTimeFields|0x97087a0c
ntdll.dll.RtlpTimeFieldsToTime|0xc7c38533
ntdll.dll.RtlpSetUserPreferredUILanguages|0x45657160
ntdll.dll.RtlpSetPreferredUILanguages|0x2a5fd65b
ntdll.dll.RtlpSetInstallLanguage|0x0137913e
ntdll.dll.RtlpRefreshCachedUILanguage|0x0de1a757
ntdll.dll.RtlpQueryProcessDebugInformationRemote|0x4ad7fb5e
ntdll.dll.RtlpQueryDefaultUILanguage|0x29e2b3b3
ntdll.dll.RtlpNtSetValueKey|0x9837f6e1
ntdll.dll.RtlpNtQueryValueKey|0x36d8d3c0
ntdll.dll.RtlpNtOpenKey|0xf80391fe
ntdll.dll.RtlpNtMakeTemporaryKey|0xb044e55f
ntdll.dll.RtlpNtEnumerateSubKey|0x85a0fed7
ntdll.dll.RtlpNtCreateKey|0xc28c7c91
ntdll.dll.RtlpNotOwnerCriticalSection|0xcd06b893
ntdll.dll.RtlpMuiRegLoadRegistryInfo|0x3d89b54a
ntdll.dll.RtlpMuiRegFreeRegistryInfo|0x9e03c54b
ntdll.dll.RtlpMuiRegCreateRegistryInfo|0x1b580df8
ntdll.dll.RtlpMuiFreeLangRegistryInfo|0x0aacae7a
ntdll.dll.RtlpMergeSecurityAttributeInformation|0x5de9fb3b
ntdll.dll.RtlpLoadUserUIByPolicy|0xa5ac86a0
ntdll.dll.RtlpLoadMachineUIByPolicy|0x53ff289b
ntdll.dll.RtlpIsQualifiedLanguage|0x8e83fa48
ntdll.dll.RtlpInitializeLangRegistryInfo|0xd37e0f8a
ntdll.dll.RtlpGetUserOrMachineUILanguage4NLS|0x9c98ccbb
ntdll.dll.RtlpGetSystemDefaultUILanguage|0xe9ff1d35
ntdll.dll.RtlpGetNameFromLangInfoNode|0x46644e9a
ntdll.dll.RtlpGetLCIDFromLangInfoNode|0x1d641191
ntdll.dll.RtlpGetDeviceFamilyInfoEnum|0x8110b907
ntdll.dll.RtlpFreezeTimeBias|0xb8a4a6ff
ntdll.dll.RtlpEnsureBufferSize|0x31f0d98c
ntdll.dll.RtlpCreateProcessRegistryInfo|0x464829b0
ntdll.dll.RtlpConvertRelativeToAbsoluteSecurityAttribute|0x38133f32
ntdll.dll.RtlpConvertLCIDsToCultureNames|0x520a4819
ntdll.dll.RtlpConvertCultureNamesToLCIDs|0x8fb84be0
ntdll.dll.RtlpConvertAbsoluteToRelativeSecurityAttribute|0x0d6e4448
ntdll.dll.RtlpCleanupRegistryKeys|0xdfa5a093
ntdll.dll.RtlpCheckDynamicTimeZoneInformation|0x6900bfe6
ntdll.dll.RtlpApplyLengthFunction|0x55fe8045
ntdll.dll.RtlZombifyActivationContext|0x94bcca8a
ntdll.dll.RtlZeroMemory|0xbd784139
ntdll.dll.RtlZeroHeap|0xe88e1c84
ntdll.dll.RtlWriteRegistryValue|0xcfd2610b
ntdll.dll.RtlWriteMemoryStream|0x4e1796a0
ntdll.dll.RtlWow64LogMessageInEventLogger|0x00dd2c8c
ntdll.dll.RtlWow64IsWowGuestMachineSupported|0x8b90a0da
ntdll.dll.RtlWow64GetSharedInfoProcess|0x29b5aa0e
ntdll.dll.RtlWow64GetProcessMachines|0x82790c26
ntdll.dll.RtlWow64GetEquivalentMachineCHPE|0x408dff53
ntdll.dll.RtlWow64GetCurrentMachine|0x1fd2a387
ntdll.dll.RtlWow64EnableFsRedirectionEx|0xae1d2eaa
ntdll.dll.RtlWow64EnableFsRedirection|0xac492367
ntdll.dll.RtlWow64CallFunction64|0x199e8f43
ntdll.dll.RtlWnfDllUnloadCallback|0xd4edb741
ntdll.dll.RtlWnfCompareChangeStamp|0x2d19b540
ntdll.dll.RtlWerpReportException|0xe077f59e
ntdll.dll.RtlWeaklyEnumerateEntryHashTable|0x8c98e0a5
ntdll.dll.RtlWalkHeap|0xe5761c02
ntdll.dll.RtlWalkFrameChain|0x1873b4c0
ntdll.dll.RtlWakeConditionVariable|0xcb4301dc
ntdll.dll.RtlWakeAllConditionVariable|0x2ac7097d
ntdll.dll.RtlWakeAddressSingleNoFence|0x64bb6193
ntdll.dll.RtlWakeAddressSingle|0x40c3ce0c
ntdll.dll.RtlWakeAddressAllNoFence|0xb74064fe
ntdll.dll.RtlWakeAddressAll|0x9b57f627
ntdll.dll.RtlWaitOnAddress|0x28718a9d
ntdll.dll.RtlWaitForWnfMetaNotification|0x26dc2294
ntdll.dll.RtlVerifyVersionInfo|0x81e9f494
ntdll.dll.RtlValidateUnicodeString|0x1dc9a187
ntdll.dll.RtlValidateProcessHeaps|0x04484619
ntdll.dll.RtlValidateHeap|0x68b5d968
ntdll.dll.RtlValidateCorrelationVector|0x7a6cd59b
ntdll.dll.RtlValidSid|0xc017de01
ntdll.dll.RtlValidSecurityDescriptor|0x449eefbb
ntdll.dll.RtlValidRelativeSecurityDescriptor|0x2c387dbc
ntdll.dll.RtlValidProcessProtection|0x8f346ef5
ntdll.dll.RtlValidAcl|0x9c57dc81
ntdll.dll.RtlUshortByteSwap|0x2ec66c1c
ntdll.dll.RtlUserThreadStart|0xd2eae6fe
ntdll.dll.RtlUserFiberStart|0x22e62598
ntdll.dll.RtlUpperString|0xb4d43026
ntdll.dll.RtlUpperChar|0x84ad1b04
ntdll.dll.RtlUpdateTimer|0xb9733e16
ntdll.dll.RtlUpdateClonedSRWLock|0x043d6bf4
ntdll.dll.RtlUpdateClonedCriticalSection|0xb05f5374
ntdll.dll.RtlUpcaseUnicodeToOemN|0x1851f0d5
ntdll.dll.RtlUpcaseUnicodeToMultiByteN|0x0fd1ac4f
ntdll.dll.RtlUpcaseUnicodeToCustomCPN|0xc484890a
ntdll.dll.RtlUpcaseUnicodeStringToOemString|0x4e629dc2
ntdll.dll.RtlUpcaseUnicodeStringToCountedOemString|0x198f570b
ntdll.dll.RtlUpcaseUnicodeStringToAnsiString|0xf0e77210
ntdll.dll.RtlUpcaseUnicodeString|0xa1182118
ntdll.dll.RtlUpcaseUnicodeChar|0x4c5e2ac8
ntdll.dll.RtlUnwind|0x89184087
ntdll.dll.RtlUnsubscribeWnfStateChangeNotification|0x45bc8031
ntdll.dll.RtlUnsubscribeWnfNotificationWithCompletionCallback|0x1450a6f9
ntdll.dll.RtlUnsubscribeWnfNotificationWaitForCompletion|0x14e96fa5
ntdll.dll.RtlUnlockModuleSection|0x9e1c3f6a
ntdll.dll.RtlUnlockMemoryZone|0x6440669e
ntdll.dll.RtlUnlockMemoryStreamRegion|0x458856c3
ntdll.dll.RtlUnlockMemoryBlockLookaside|0x8c5d025f
ntdll.dll.RtlUnlockHeap|0x638634fb
ntdll.dll.RtlUnlockCurrentThread|0x59a3e86c
ntdll.dll.RtlUnlockBootStatusData|0xb4c11369
ntdll.dll.RtlUniform|0x8dc43eb9
ntdll.dll.RtlUnicodeToUTF8N|0x2c09ed43
ntdll.dll.RtlUnicodeToOemN|0x5c085e6f
ntdll.dll.RtlUnicodeToMultiByteSize|0xc8d1bf17
ntdll.dll.RtlUnicodeToMultiByteN|0xc636bb29
ntdll.dll.RtlUnicodeToCustomCPN|0x665fbfd7
ntdll.dll.RtlUnicodeStringToOemString|0x2995252e
ntdll.dll.RtlUnicodeStringToOemSize|0xa8192518
ntdll.dll.RtlUnicodeStringToInteger|0x24a63f1b
ntdll.dll.RtlUnicodeStringToCountedOemString|0x7fe044a7
ntdll.dll.RtlUnicodeStringToAnsiString|0x2c4e4ba4
ntdll.dll.RtlUnicodeStringToAnsiSize|0x802409b2
ntdll.dll.RtlUnhandledExceptionFilter2|0x013ad384
ntdll.dll.RtlUnhandledExceptionFilter|0x5620cf71
ntdll.dll.RtlUlonglongByteSwap|0xc3bf5079
ntdll.dll.RtlUlongByteSwap|0x1fa45dcc
ntdll.dll.RtlUdiv128|0x0ff52eb8
ntdll.dll.RtlUTF8ToUnicodeN|0x8a9e0194
ntdll.dll.RtlTryEnterCriticalSection|0x6f40a1fb
ntdll.dll.RtlTryConvertSRWLockSharedToExclusiveOrRelease|0x2e36903b
ntdll.dll.RtlTryAcquireSRWLockShared|0xcbba96dd
ntdll.dll.RtlTryAcquireSRWLockExclusive|0x40c4f617
ntdll.dll.RtlTryAcquirePebLock|0x546c8020
ntdll.dll.RtlTraceDatabaseValidate|0x346e97cc
ntdll.dll.RtlTraceDatabaseUnlock|0xc2b0c8a3
ntdll.dll.RtlTraceDatabaseLock|0x927c7f71
ntdll.dll.RtlTraceDatabaseFind|0x86442231
ntdll.dll.RtlTraceDatabaseEnumerate|0xacc252d3
ntdll.dll.RtlTraceDatabaseDestroy|0x6ae286e8
ntdll.dll.RtlTraceDatabaseCreate|0xa6385ce5
ntdll.dll.RtlTraceDatabaseAdd|0x75a65ea0
ntdll.dll.RtlTimeToTimeFields|0x790835e7
ntdll.dll.RtlTimeToSecondsSince1980|0xb7fe311d
ntdll.dll.RtlTimeToSecondsSince1970|0xb7fe30dd
ntdll.dll.RtlTimeToElapsedTimeFields|0x7995b36c
ntdll.dll.RtlTimeFieldsToTime|0xa9c3410e
ntdll.dll.RtlTestProtectedAccess|0xc47a8d0b
ntdll.dll.RtlTestBit|0x33d91c5d
ntdll.dll.RtlTestAndPublishWnfStateData|0x6a102b2f
ntdll.dll.RtlSystemTimeToLocalTime|0xb78f467c
ntdll.dll.RtlSwitchedVVI|0xdd331040
ntdll.dll.RtlSubtreeSuccessor|0x56df3e4b
ntdll.dll.RtlSubtreePredecessor|0x962e420d
ntdll.dll.RtlSubscribeWnfStateChangeNotification|0x335451bf
ntdll.dll.RtlSubAuthoritySid|0xff40ebe1
ntdll.dll.RtlSubAuthorityCountSid|0x3858dccf
ntdll.dll.RtlStronglyEnumerateEntryHashTable|0xb0d3e2d9
ntdll.dll.RtlStringFromGUIDEx|0x0d21ccba
ntdll.dll.RtlStringFromGUID|0xedc535df
ntdll.dll.RtlStatMemoryStream|0x97780744
ntdll.dll.RtlStartRXact|0x50eb65ce
ntdll.dll.RtlSplay|0xee193e39
ntdll.dll.RtlSleepConditionVariableSRW|0x400f12d0
ntdll.dll.RtlSleepConditionVariableCS|0xde123326
ntdll.dll.RtlSizeHeap|0xe1ae1cff
ntdll.dll.RtlSidIsHigherLevel|0x3a31040d
ntdll.dll.RtlSidHashLookup|0xb6eff078
ntdll.dll.RtlSidHashInitialize|0x2b2b866c
ntdll.dll.RtlSidEqualLevel|0x8f4fcb86
ntdll.dll.RtlSidDominatesForTrust|0xdfdc7a46
ntdll.dll.RtlSidDominates|0x11b243ba
ntdll.dll.RtlSetUserValueHeap|0x5794ebfc
ntdll.dll.RtlSetUserFlagsHeap|0x625c6aa3
ntdll.dll.RtlSetUserCallbackExceptionFilter|0x4beadb40
ntdll.dll.RtlSetUnhandledExceptionFilter|0xe4dd4974
ntdll.dll.RtlSetTimer|0x71a82d77
ntdll.dll.RtlSetTimeZoneInformation|0xf4b514b5
ntdll.dll.RtlSetThreadWorkOnBehalfTicket|0xbf9dd1bd
ntdll.dll.RtlSetThreadSubProcessTag|0x1ccf347f
ntdll.dll.RtlSetThreadPreferredUILanguages|0xc2ee8263
ntdll.dll.RtlSetThreadPoolStartFunc|0xe2796f27
ntdll.dll.RtlSetThreadPlaceholderCompatibilityMode|0x292fd6e6
ntdll.dll.RtlSetThreadIsCritical|0x99c0df28
ntdll.dll.RtlSetThreadErrorMode|0xa2a6b86c
ntdll.dll.RtlSetSystemBootStatusEx|0x68267f13
ntdll.dll.RtlSetSystemBootStatus|0x4f3148a9
ntdll.dll.RtlSetSecurityObjectEx|0xb02d6b3b
ntdll.dll.RtlSetSecurityObject|0xf0516459
ntdll.dll.RtlSetSecurityDescriptorRMControl|0x93b4acf4
ntdll.dll.RtlSetSearchPathMode|0x20658978
ntdll.dll.RtlSetSaclSecurityDescriptor|0xe57ff969
ntdll.dll.RtlSetProxiedProcessId|0x71e65549
ntdll.dll.RtlSetProtectedPolicy|0x4856475a
ntdll.dll.RtlSetProcessPreferredUILanguages|0x9a7c7c85
ntdll.dll.RtlSetProcessPlaceholderCompatibilityMode|0x4b0764e1
ntdll.dll.RtlSetProcessIsCritical|0xf7f8c7af
ntdll.dll.RtlSetProcessDebugInformation|0xe66ded5a
ntdll.dll.RtlSetPortableOperatingSystem|0xbf10a1f2
ntdll.dll.RtlSetOwnerSecurityDescriptor|0x93007dea
ntdll.dll.RtlSetMemoryStreamSize|0x798a78d7
ntdll.dll.RtlSetLastWin32ErrorAndNtStatusFromNtStatus|0x7811e767
ntdll.dll.RtlSetLastWin32Error|0xc1cbc384
ntdll.dll.RtlSetIoCompletionCallback|0x87dc52e4
ntdll.dll.RtlSetInformationAcl|0x19ed9bef
ntdll.dll.RtlSetImageMitigationPolicy|0xb0dfb748
ntdll.dll.RtlSetHeapInformation|0x0b3a27d4
ntdll.dll.RtlSetGroupSecurityDescriptor|0x9200f9d7
ntdll.dll.RtlSetExtendedFeaturesMask|0x05782bd2
ntdll.dll.RtlSetEnvironmentVariable|0xcefc34a4
ntdll.dll.RtlSetEnvironmentVar|0xd101fb8f
ntdll.dll.RtlSetEnvironmentStrings|0x9cc8c9d6
ntdll.dll.RtlSetDynamicTimeZoneInformation|0xd1c6b9d9
ntdll.dll.RtlSetDaclSecurityDescriptor|0xe57ff92d
ntdll.dll.RtlSetCurrentTransaction|0x6b1ee46b
ntdll.dll.RtlSetCurrentEnvironment|0xde691c0f
ntdll.dll.RtlSetCurrentDirectory_U|0x4183466f
ntdll.dll.RtlSetCriticalSectionSpinCount|0x1ec2e37f
ntdll.dll.RtlSetControlSecurityDescriptor|0xf4e4f9d1
ntdll.dll.RtlSetBits|0x01cdfefe
ntdll.dll.RtlSetBit|0xbb900f42
ntdll.dll.RtlSetAttributesSecurityDescriptor|0x91e63ae0
ntdll.dll.RtlSetAllBits|0x73c18bfb
ntdll.dll.RtlSendMsgToSm|0x807e34bd
ntdll.dll.RtlSelfRelativeToAbsoluteSD2|0xd519fc4a
ntdll.dll.RtlSelfRelativeToAbsoluteSD|0x3b3989ec
ntdll.dll.RtlSeekMemoryStream|0xb2f81742
ntdll.dll.RtlSecondsSince1980ToTime|0x8e8bc183
ntdll.dll.RtlSecondsSince1970ToTime|0x8d8bc183
ntdll.dll.RtlRunOnceInitialize|0x71b1a166
ntdll.dll.RtlRunOnceExecuteOnce|0x69bdf10a
ntdll.dll.RtlRunOnceComplete|0x9d4a071b
ntdll.dll.RtlRunOnceBeginInitialize|0x4c6ea595
ntdll.dll.RtlRunEncodeUnicodeString|0x7e26f519
ntdll.dll.RtlRunDecodeUnicodeString|0x7be6f319
ntdll.dll.RtlRevertMemoryStream|0xef447f11
ntdll.dll.RtlRetrieveNtUserPfn|0x08b384af
ntdll.dll.RtlRestoreSystemBootStatusDefaults|0x120fbcf5
ntdll.dll.RtlRestoreLastWin32Error|0x22821613
ntdll.dll.RtlRestoreBootStatusDefaults|0xaf813096
ntdll.dll.RtlResetRtlTranslations|0x9350e4ea
ntdll.dll.RtlResetNtUserPfn|0x8b9f1d8d
ntdll.dll.RtlResetMemoryZone|0xdde8a6fa
ntdll.dll.RtlResetMemoryBlockLookaside|0xaac71276
ntdll.dll.RtlReportSqmEscalation|0x7d0a975f
ntdll.dll.RtlReportSilentProcessExit|0x06a6760a
ntdll.dll.RtlReportExceptionEx|0x7a25ecc6
ntdll.dll.RtlReportException|0x1b79465f
ntdll.dll.RtlReplaceSystemDirectoryInPath|0x200ca8af
ntdll.dll.RtlReplaceSidInSd|0x78333058
ntdll.dll.RtlRemoveVectoredExceptionHandler|0x8d0cf77a
ntdll.dll.RtlRemoveVectoredContinueHandler|0x66dd1720
ntdll.dll.RtlRemovePrivileges|0x707e8267
ntdll.dll.RtlRemoveEntryHashTable|0xc67c7b92
ntdll.dll.RtlRemoteCall|0x9ca99fb7
ntdll.dll.RtlReleaseSRWLockShared|0x5a172e63
ntdll.dll.RtlReleaseSRWLockExclusive|0x4be1af46
ntdll.dll.RtlReleaseResource|0x454852ff
ntdll.dll.RtlReleaseRelativeName|0x26cda1d8
ntdll.dll.RtlReleasePrivilege|0x305ddbfa
ntdll.dll.RtlReleasePebLock|0x7a4de3b7
ntdll.dll.RtlReleasePath|0x6553ef7c
ntdll.dll.RtlReleaseMemoryStream|0xec845090
ntdll.dll.RtlReleaseActivationContext|0x0e7e5c85
ntdll.dll.RtlRegisterWait|0xafa2cd8d
ntdll.dll.RtlRegisterThreadWithCsrss|0x229b27eb
ntdll.dll.RtlRegisterSecureMemoryCacheCallback|0x4f3b4895
ntdll.dll.RtlRegisterForWnfMetaNotification|0x0870a884
ntdll.dll.RtlRealSuccessor|0xc8d5be1c
ntdll.dll.RtlRealPredecessor|0x13ce3669
ntdll.dll.RtlReadThreadProfilingData|0xbf2c7a17
ntdll.dll.RtlReadOutOfProcessMemoryStream|0x1a92d2ff
ntdll.dll.RtlReadMemoryStream|0xaf770742
ntdll.dll.RtlReAllocateHeap|0xa4bf82ab
ntdll.dll.RtlRbRemoveNode|0x05681ba1
ntdll.dll.RtlRbInsertNodeEx|0x71ecee92
ntdll.dll.RtlRandomEx|0x70c084ff
ntdll.dll.RtlRandom|0xff53b0c0
ntdll.dll.RtlRaiseStatus|0x192ce842
ntdll.dll.RtlRaiseException|0x7f82f8ef
ntdll.dll.RtlRaiseCustomSystemEventTrigger|0xefb34080
ntdll.dll.RtlQueueWorkItem|0xec6fae21
ntdll.dll.RtlQueueApcWow64Thread|0xb9b3bf13
ntdll.dll.RtlQueryWnfStateDataWithExplicitScope|0x45fc2eb6
ntdll.dll.RtlQueryWnfStateData|0x924cd0c6
ntdll.dll.RtlQueryWnfMetaNotification|0xe7c4a1dd
ntdll.dll.RtlQueryValidationRunlevel|0x7363f9b6
ntdll.dll.RtlQueryUnbiasedInterruptTime|0x4567c03f
ntdll.dll.RtlQueryTokenHostIdAsUlong64|0x324db3e9
ntdll.dll.RtlQueryTimeZoneInformation|0x15f872a2
ntdll.dll.RtlQueryThreadProfiling|0xf56716bd
ntdll.dll.RtlQueryThreadPlaceholderCompatibilityMode|0xcd5842a4
ntdll.dll.RtlQueryTagHeap|0xbd921f77
ntdll.dll.RtlQuerySecurityObject|0x32d82033
ntdll.dll.RtlQueryResourcePolicy|0x69f882bb
ntdll.dll.RtlQueryRegistryValuesEx|0xd0f991c3
ntdll.dll.RtlQueryRegistryValues|0x10d494f3
ntdll.dll.RtlQueryRegistryValueWithFallback|0x47c73f38
ntdll.dll.RtlQueryProtectedPolicy|0x27285b8f
ntdll.dll.RtlQueryProcessPlaceholderCompatibilityMode|0xa8f48624
ntdll.dll.RtlQueryProcessLockInformation|0xc6c72bdb
ntdll.dll.RtlQueryProcessHeapInformation|0x45c7042b
ntdll.dll.RtlQueryProcessDebugInformation|0x1c4cbf6e
ntdll.dll.RtlQueryProcessBackTraceInformation|0xf7e65d19
ntdll.dll.RtlQueryPerformanceFrequency|0x7a7e3cda
ntdll.dll.RtlQueryPerformanceCounter|0x698e572a
ntdll.dll.RtlQueryPackageIdentityEx|0xf8dd24e0
ntdll.dll.RtlQueryPackageIdentity|0x85742340
ntdll.dll.RtlQueryPackageClaims|0xf9de1d4e
ntdll.dll.RtlQueryModuleInformation|0x47c767ae
ntdll.dll.RtlQueryInterfaceMemoryStream|0xca04a438
ntdll.dll.RtlQueryInformationActiveActivationContext|0xd3703236
ntdll.dll.RtlQueryInformationActivationContext|0x60ec8c8a
ntdll.dll.RtlQueryInformationAcl|0x5c7457ca
ntdll.dll.RtlQueryImageMitigationPolicy|0x01b73290
ntdll.dll.RtlQueryHeapInformation|0xea0c3c0a
ntdll.dll.RtlQueryEnvironmentVariable_U|0xaaa0ffbb
ntdll.dll.RtlQueryEnvironmentVariable|0xf03f9291
ntdll.dll.RtlQueryElevationFlags|0xe3ce6001
ntdll.dll.RtlQueryDynamicTimeZoneInformation|0xfa32777d
ntdll.dll.RtlQueryDepthSList|0x6e420995
ntdll.dll.RtlQueryCriticalSectionOwner|0x447ab744
ntdll.dll.RtlQueryAtomInAtomTable|0x87c21eb3
ntdll.dll.RtlQueryActivationContextApplicationSettings|0xff94a35e
ntdll.dll.RtlPushFrame|0x7b53e64e
ntdll.dll.RtlPublishWnfStateData|0xac3d8e98
ntdll.dll.RtlProtectHeap|0x3c4f8346
ntdll.dll.RtlProcessFlsData|0xf2955ef0
ntdll.dll.RtlPrefixUnicodeString|0x619d6327
ntdll.dll.RtlPrefixString|0x350e672d
ntdll.dll.RtlPopFrame|0x5630c0b0
ntdll.dll.RtlPinAtomInAtomTable|0xa82a0a9d
ntdll.dll.RtlPcToFileHeader|0x2a26dd51
ntdll.dll.RtlOwnerAcesPresent|0xf15ffbaa
ntdll.dll.RtlOsDeploymentState|0x1ef06f9d
ntdll.dll.RtlOpenCurrentUser|0x03dee811
ntdll.dll.RtlOemToUnicodeN|0x88665cf5
ntdll.dll.RtlOemStringToUnicodeString|0xac0b5380
ntdll.dll.RtlOemStringToUnicodeSize|0xee22fdd1
ntdll.dll.RtlNumberOfSetBitsUlongPtr|0xbab61ca4
ntdll.dll.RtlNumberOfSetBitsInRange|0x4cd3fa92
ntdll.dll.RtlNumberOfSetBits|0x0804b4d0
ntdll.dll.RtlNumberOfClearBitsInRange|0x567bbd33
ntdll.dll.RtlNumberOfClearBits|0x1051f2e5
ntdll.dll.RtlNumberGenericTableElementsAvl|0xdc6bab04
ntdll.dll.RtlNumberGenericTableElements|0x775531db
ntdll.dll.RtlNtStatusToDosErrorNoTeb|0x47d6b526
ntdll.dll.RtlNtStatusToDosError|0xfae5402d
ntdll.dll.RtlNtPathNameToDosPathName|0xb4832a47
ntdll.dll.RtlNormalizeString|0x9dd86e3f
ntdll.dll.RtlNormalizeProcessParams|0xf7bdf70a
ntdll.dll.RtlNewSecurityObjectWithMultipleInheritance|0xa0342af7
ntdll.dll.RtlNewSecurityObjectEx|0xb02d6153
ntdll.dll.RtlNewSecurityObject|0x50516432
ntdll.dll.RtlNewSecurityGrantedAccess|0xf1149625
ntdll.dll.RtlNewInstanceSecurityObject|0xa1e1cc40
ntdll.dll.RtlMultipleFreeHeap|0xcbe5441c
ntdll.dll.RtlMultipleAllocateHeap|0x1a2bd790
ntdll.dll.RtlMultiByteToUnicodeSize|0x9b7b364a
ntdll.dll.RtlMultiByteToUnicodeN|0x1af25492
ntdll.dll.RtlMultiAppendUnicodeStringBuffer|0x403895c7
ntdll.dll.RtlMoveMemory|0x81788ff6
ntdll.dll.RtlMapSecurityErrorToNtStatus|0xd80cdd6e
ntdll.dll.RtlMapGenericMask|0xdc21c038
ntdll.dll.RtlMakeSelfRelativeSD|0x9fb6ee55
ntdll.dll.RtlLookupFirstMatchingElementGenericTableAvl|0xecd2cf77
ntdll.dll.RtlLookupEntryHashTable|0xc6fb8f73
ntdll.dll.RtlLookupElementGenericTableFullAvl|0x4f6872ea
ntdll.dll.RtlLookupElementGenericTableFull|0xf5b92494
ntdll.dll.RtlLookupElementGenericTableAvl|0x1642ce06
ntdll.dll.RtlLookupElementGenericTable|0x62e6b2f8
ntdll.dll.RtlLookupAtomInAtomTable|0x6d6964ad
ntdll.dll.RtlLogStackBackTrace|0x7caea937
ntdll.dll.RtlLockModuleSection|0xfd627b20
ntdll.dll.RtlLockMemoryZone|0x075e41cd
ntdll.dll.RtlLockMemoryStreamRegion|0x752b749e
ntdll.dll.RtlLockMemoryBlockLookaside|0x7524792b
ntdll.dll.RtlLockHeap|0xda521dc2
ntdll.dll.RtlLockCurrentThread|0xb8ea2422
ntdll.dll.RtlLockBootStatusData|0x92740d9b
ntdll.dll.RtlLocateLegacyContext|0x4a2bccc5
ntdll.dll.RtlLocateExtendedFeature2|0xca003ed3
ntdll.dll.RtlLocateExtendedFeature|0x038aa889
ntdll.dll.RtlLocaleNameToLcid|0xa4aa40a9
ntdll.dll.RtlLocalTimeToSystemTime|0x32fa1fbf
ntdll.dll.RtlLoadString|0xa000dedd
ntdll.dll.RtlLengthSidAsUnicodeString|0x46924c5a
ntdll.dll.RtlLengthSid|0x4f4724c5
ntdll.dll.RtlLengthSecurityDescriptor|0xb684d893
ntdll.dll.RtlLengthRequiredSid|0x549793ef
ntdll.dll.RtlLeaveCriticalSection|0x3a182487
ntdll.dll.RtlLcidToLocaleName|0x98a6e7a2
ntdll.dll.RtlLargeIntegerToChar|0x91871c1d
ntdll.dll.RtlLargeIntegerSubtract|0xdaf87469
ntdll.dll.RtlLargeIntegerShiftRight|0xc6d96e2e
ntdll.dll.RtlLargeIntegerShiftLeft|0x21d5a7a2
ntdll.dll.RtlLargeIntegerNegate|0x830960d8
ntdll.dll.RtlLargeIntegerDivide|0x92e24cda
ntdll.dll.RtlLargeIntegerArithmeticShift|0xe504656d
ntdll.dll.RtlLargeIntegerAdd|0xc8185b4e
ntdll.dll.RtlLCIDToCultureName|0xbf5d82de
ntdll.dll.RtlKnownExceptionFilter|0xc3530e87
ntdll.dll.RtlIsValidProcessTrustLabelSid|0x28edb584
ntdll.dll.RtlIsValidLocaleName|0x1ab80bdd
ntdll.dll.RtlIsValidIndexHandle|0x17bfd387
ntdll.dll.RtlIsValidHandle|0xd96c3657
ntdll.dll.RtlIsUntrustedObject|0x48e02656
ntdll.dll.RtlIsThreadWithinLoaderCallout|0x32827a0c
ntdll.dll.RtlIsTextUnicode|0xfaffe27c
ntdll.dll.RtlIsStateSeparationEnabled|0x1bc2912a
ntdll.dll.RtlIsProcessorFeaturePresent|0x4b18de8f
ntdll.dll.RtlIsPartialPlaceholderFileInfo|0xc4d712a6
ntdll.dll.RtlIsPartialPlaceholderFileHandle|0x3afd8829
ntdll.dll.RtlIsPartialPlaceholder|0x4ede9b2e
ntdll.dll.RtlIsParentOfChildAppContainer|0x99219803
ntdll.dll.RtlIsPackageSid|0x432f6bd2
ntdll.dll.RtlIsNormalizedString|0x243ad961
ntdll.dll.RtlIsNonEmptyDirectoryReparsePointAllowed|0xe2edcd51
ntdll.dll.RtlIsNameLegalDOS8Dot3|0x47b10e81
ntdll.dll.RtlIsNameInUnUpcasedExpression|0xa88545d0
ntdll.dll.RtlIsNameInExpression|0xebbec5d6
ntdll.dll.RtlIsMultiUsersInSessionSku|0xc0b9cae3
ntdll.dll.RtlIsMultiSessionSku|0xaf380e53
ntdll.dll.RtlIsGenericTableEmptyAvl|0x7f374f35
ntdll.dll.RtlIsGenericTableEmpty|0xdd274a2c
ntdll.dll.RtlIsElevatedRid|0x82f15d3c
ntdll.dll.RtlIsDosDeviceName_U|0x6543fe94
ntdll.dll.RtlIsCurrentThreadAttachExempt|0xbe03fd6a
ntdll.dll.RtlIsCurrentThread|0x52665d5a
ntdll.dll.RtlIsCurrentProcess|0xfab298ef
ntdll.dll.RtlIsCriticalSectionLockedByThread|0x200bba7c
ntdll.dll.RtlIsCriticalSectionLocked|0x38f5b01f
ntdll.dll.RtlIsCloudFilesPlaceholder|0xc8d30bb6
ntdll.dll.RtlIsCapabilitySid|0xe9b6b51b
ntdll.dll.RtlIsActivationContextActive|0x0d6dcfb9
ntdll.dll.RtlIpv6StringToAddressW|0xd785bb51
ntdll.dll.RtlIpv6StringToAddressExW|0x583b35f5
ntdll.dll.RtlIpv6StringToAddressExA|0x578b35f5
ntdll.dll.RtlIpv6StringToAddressA|0xd6d5bb51
ntdll.dll.RtlIpv6AddressToStringW|0xc04ae5a7
ntdll.dll.RtlIpv6AddressToStringExW|0x8985cb6f
ntdll.dll.RtlIpv6AddressToStringExA|0x88d5cb6f
ntdll.dll.RtlIpv6AddressToStringA|0xbf9ae5a7
ntdll.dll.RtlIpv4StringToAddressW|0xd785bb41
ntdll.dll.RtlIpv4StringToAddressExW|0x583b31f5
ntdll.dll.RtlIpv4StringToAddressExA|0x578b31f5
ntdll.dll.RtlIpv4StringToAddressA|0xd6d5bb41
ntdll.dll.RtlIpv4AddressToStringW|0xc04ae597
ntdll.dll.RtlIpv4AddressToStringExW|0x8985c76f
ntdll.dll.RtlIpv4AddressToStringExA|0x88d5c76f
ntdll.dll.RtlIpv4AddressToStringA|0xbf9ae597
ntdll.dll.RtlIoEncodeMemIoResource|0xfb890025
ntdll.dll.RtlIoDecodeMemIoResource|0xf948fe25
ntdll.dll.RtlInterlockedSetBitRun|0x3650bf17
ntdll.dll.RtlInterlockedPushListSListEx|0x28fc7e9b
ntdll.dll.RtlInterlockedPushListSList|0x7234a0a7
ntdll.dll.RtlInterlockedPushEntrySList|0x3a920ba4
ntdll.dll.RtlInterlockedPopEntrySList|0xbd43b01e
ntdll.dll.RtlInterlockedFlushSList|0xa97db450
ntdll.dll.RtlInterlockedCompareExchange64|0x53ed6002
ntdll.dll.RtlInterlockedClearBitRun|0x55cb9ffa
ntdll.dll.RtlIntegerToUnicodeString|0xdc66dd03
ntdll.dll.RtlIntegerToChar|0xde3d5d0f
ntdll.dll.RtlInt64ToUnicodeString|0x9c277a32
ntdll.dll.RtlInsertEntryHashTable|0x17f88d43
ntdll.dll.RtlInsertElementGenericTableFullAvl|0x5f384fef
ntdll.dll.RtlInsertElementGenericTableFull|0xdda7a71c
ntdll.dll.RtlInsertElementGenericTableAvl|0xe693cb04
ntdll.dll.RtlInsertElementGenericTable|0x8b6531e0
ntdll.dll.RtlInitializeSidEx|0x9f37eafb
ntdll.dll.RtlInitializeSid|0xf00d8e58
ntdll.dll.RtlInitializeSRWLock|0xd70b8b20
ntdll.dll.RtlInitializeSListHead|0xccb17637
ntdll.dll.RtlInitializeResource|0x7dbf3b4c
ntdll.dll.RtlInitializeRXact|0x1916e27a
ntdll.dll.RtlInitializeNtUserPfn|0x4b03ecf0
ntdll.dll.RtlInitializeHandleTable|0x74f8136f
ntdll.dll.RtlInitializeGenericTableAvl|0xf6a71029
ntdll.dll.RtlInitializeGenericTable|0x9507c468
ntdll.dll.RtlInitializeExtendedContext2|0x4cfeb321
ntdll.dll.RtlInitializeExtendedContext|0xd21458e9
ntdll.dll.RtlInitializeExceptionChain|0xe5298a84
ntdll.dll.RtlInitializeCriticalSectionEx|0xa85cb9b6
ntdll.dll.RtlInitializeCriticalSectionAndSpinCount|0xf8587084
ntdll.dll.RtlInitializeCriticalSection|0xdc322193
ntdll.dll.RtlInitializeCorrelationVector|0xdbb1ae27
ntdll.dll.RtlInitializeContext|0x43ca0e6c
ntdll.dll.RtlInitializeConditionVariable|0xe0c97c47
ntdll.dll.RtlInitializeBitMap|0xef3a167d
ntdll.dll.RtlInitializeAtomPackage|0xbbdab6bb
ntdll.dll.RtlInitWeakEnumerationHashTable|0x527a8a66
ntdll.dll.RtlInitUnicodeStringEx|0x96ba942f
ntdll.dll.RtlInitUnicodeString|0xbfeb98fd
ntdll.dll.RtlInitStrongEnumerationHashTable|0xac466719
ntdll.dll.RtlInitStringEx|0x9c0a8bf9
ntdll.dll.RtlInitString|0xe800d8dc
ntdll.dll.RtlInitOutOfProcessMemoryStream|0x9a04d312
ntdll.dll.RtlInitNlsTables|0xad30862c
ntdll.dll.RtlInitMemoryStream|0xd76e2743
ntdll.dll.RtlInitEnumerationHashTable|0x3f07464c
ntdll.dll.RtlInitCodePageTable|0x261790bd
ntdll.dll.RtlInitBarrier|0x444befe5
ntdll.dll.RtlInitAnsiStringEx|0xbd53aedf
ntdll.dll.RtlInitAnsiString|0x8085fd68
ntdll.dll.RtlIncrementCorrelationVector|0x8108b47c
ntdll.dll.RtlImpersonateSelfEx|0xf8fd8309
ntdll.dll.RtlImpersonateSelf|0x2974a4b8
ntdll.dll.RtlImageRvaToVa|0xbd5e83f3
ntdll.dll.RtlImageRvaToSection|0xd383a933
ntdll.dll.RtlImageNtHeaderEx|0x561fe38f
ntdll.dll.RtlImageNtHeader|0x3ee92e3b
ntdll.dll.RtlImageDirectoryEntryToData|0xe6f7ac14
ntdll.dll.RtlIdnToUnicode|0x074cdfda
ntdll.dll.RtlIdnToNameprepUnicode|0x3f4aea10
ntdll.dll.RtlIdnToAscii|0x61809383
ntdll.dll.RtlIdentifierAuthoritySid|0xbd6dfcb9
ntdll.dll.RtlHeapTrkInitialize|0xc4ae2604
ntdll.dll.RtlHashUnicodeString|0xffde68f6
ntdll.dll.RtlGuardCheckLongJumpTarget|0xe03e101a
ntdll.dll.RtlGetVersion|0x73809d5b
ntdll.dll.RtlGetUserPreferredUILanguages|0xbd1b3547
ntdll.dll.RtlGetUserInfoHeap|0x468dea9a
ntdll.dll.RtlGetUnloadEventTraceEx|0xc96a1ade
ntdll.dll.RtlGetUnloadEventTrace|0x7cb65718
ntdll.dll.RtlGetUILanguageInfo|0x755f484a
ntdll.dll.RtlGetTokenNamedObjectPath|0x2b15aa5c
ntdll.dll.RtlGetThreadWorkOnBehalfTicket|0xbf9dd1a5
ntdll.dll.RtlGetThreadPreferredUILanguages|0xc2ee7c63
ntdll.dll.RtlGetThreadLangIdByIndex|0xef3d97e0
ntdll.dll.RtlGetThreadErrorMode|0x9fa6b86c
ntdll.dll.RtlGetSystemTimePrecise|0x65ad7ba8
ntdll.dll.RtlGetSystemPreferredUILanguages|0x4cd2bd74
ntdll.dll.RtlGetSystemBootStatusEx|0x68207f13
ntdll.dll.RtlGetSystemBootStatus|0x4f3130a9
ntdll.dll.RtlGetSuiteMask|0x71957dfa
ntdll.dll.RtlGetSetBootStatusData|0xf6c30089
ntdll.dll.RtlGetSessionProperties|0xb20ab048
ntdll.dll.RtlGetSecurityDescriptorRMControl|0x63b4acf4
ntdll.dll.RtlGetSearchPath|0xcb2a2137
ntdll.dll.RtlGetSaclSecurityDescriptor|0x857ff969
ntdll.dll.RtlGetProductInfo|0xb73b6da4
ntdll.dll.RtlGetProcessPreferredUILanguages|0x6a7c7c85
ntdll.dll.RtlGetProcessHeaps|0x5ad94699
ntdll.dll.RtlGetPersistedStateLocation|0x32871153
ntdll.dll.RtlGetParentLocaleName|0x15aef8d0
ntdll.dll.RtlGetOwnerSecurityDescriptor|0x92fd7dea
ntdll.dll.RtlGetNtVersionNumbers|0xc93fc7fe
ntdll.dll.RtlGetNtSystemRoot|0x04acc664
ntdll.dll.RtlGetNtProductType|0xfe4078f3
ntdll.dll.RtlGetNtGlobalFlags|0x4cc3f41b
ntdll.dll.RtlGetNextEntryHashTable|0xd2ec6b25
ntdll.dll.RtlGetNativeSystemInformation|0xfae2d678
ntdll.dll.RtlGetMultiTimePrecise|0xef051fea
ntdll.dll.RtlGetLongestNtPathLength|0xd9d88b19
ntdll.dll.RtlGetLocaleFileMappingAddress|0x55051cf7
ntdll.dll.RtlGetLengthWithoutTrailingPathSeperators|0xccccdf68
ntdll.dll.RtlGetLengthWithoutLastFullDosOrNtPathElement|0x1764c67b
ntdll.dll.RtlGetLastWin32Error|0xc1cbc324
ntdll.dll.RtlGetLastNtStatus|0x69378fd0
ntdll.dll.RtlGetInterruptTimePrecise|0x09df7e6f
ntdll.dll.RtlGetIntegerAtom|0xc4251622
ntdll.dll.RtlGetGroupSecurityDescriptor|0x91fdf9d7
ntdll.dll.RtlGetFullPathName_UstrEx|0x82b5ebd2
ntdll.dll.RtlGetFullPathName_UEx|0x6c9bacfd
ntdll.dll.RtlGetFullPathName_U|0xf7431d60
ntdll.dll.RtlGetFrame|0x4d40bf70
ntdll.dll.RtlGetFileMUIPath|0xddb7c40c
ntdll.dll.RtlGetExtendedFeaturesMask|0x03f82bd2
ntdll.dll.RtlGetExtendedContextLength2|0x3e0eb232
ntdll.dll.RtlGetExtendedContextLength|0xd1f6970b
ntdll.dll.RtlGetExePath|0xe39a6c74
ntdll.dll.RtlGetEnabledExtendedFeatures|0x52b33f2c
ntdll.dll.RtlGetElementGenericTableAvl|0x2717880d
ntdll.dll.RtlGetElementGenericTable|0xcd43b680
ntdll.dll.RtlGetDeviceFamilyInfoEnum|0xc1083463
ntdll.dll.RtlGetDaclSecurityDescriptor|0x857ff92d
ntdll.dll.RtlGetCurrentTransaction|0x6b18e46b
ntdll.dll.RtlGetCurrentServiceSessionId|0x9416bc31
ntdll.dll.RtlGetCurrentProcessorNumberEx|0xb4a5489c
ntdll.dll.RtlGetCurrentProcessorNumber|0x746343cf
ntdll.dll.RtlGetCurrentPeb|0xba04dd76
ntdll.dll.RtlGetCurrentDirectory_U|0x417d466f
ntdll.dll.RtlGetCriticalSectionRecursionCount|0xcacba4c9
ntdll.dll.RtlGetControlSecurityDescriptor|0xf424f9d1
ntdll.dll.RtlGetConsoleSessionForegroundProcessId|0x073a8b88
ntdll.dll.RtlGetCompressionWorkSpaceSize|0x0bd75621
ntdll.dll.RtlGetCallersAddress|0xad8be987
ntdll.dll.RtlGetAppContainerSidType|0x3c38dec1
ntdll.dll.RtlGetAppContainerParent|0x399d53d9
ntdll.dll.RtlGetAppContainerNamedObjectPath|0x06bea8f8
ntdll.dll.RtlGetActiveConsoleId|0xe9da7d68
ntdll.dll.RtlGetActiveActivationContext|0x593aed96
ntdll.dll.RtlGetAce|0xb8e80dc2
ntdll.dll.RtlGenerate8dot3Name|0x5ee864fe
ntdll.dll.RtlGUIDFromString|0xafa613e9
ntdll.dll.RtlFreeUserStack|0xdce1dc21
ntdll.dll.RtlFreeUnicodeString|0x3fef5ce5
ntdll.dll.RtlFreeThreadActivationContextStack|0x961ea741
ntdll.dll.RtlFreeSid|0x558c2a97
ntdll.dll.RtlFreeOemString|0x5e458ff2
ntdll.dll.RtlFreeMemoryBlockLookaside|0x75817333
ntdll.dll.RtlFreeHeap|0xd45a1e1f
ntdll.dll.RtlFreeHandle|0x99c4b672
ntdll.dll.RtlFreeAnsiString|0x8267f128
ntdll.dll.RtlFreeActivationContextStack|0xc4c54481
ntdll.dll.RtlFormatMessageEx|0x01ded5b6
ntdll.dll.RtlFormatMessage|0xdd982a03
ntdll.dll.RtlFormatCurrentUserKeyPath|0xbe88b575
ntdll.dll.RtlFlushSecureMemoryCache|0xda67efe1
ntdll.dll.RtlFlushHeaps|0x24b3f925
ntdll.dll.RtlFlsSetValue|0xa9293836
ntdll.dll.RtlFlsGetValue|0x9d293836
ntdll.dll.RtlFlsFree|0x937a399e
ntdll.dll.RtlFlsAlloc|0xe22c60cd
ntdll.dll.RtlFirstFreeAce|0xb067f589
ntdll.dll.RtlFirstEntrySList|0x58fc2164
ntdll.dll.RtlFindUnicodeSubstring|0x433d7956
ntdll.dll.RtlFindSetBitsAndClear|0x4476be78
ntdll.dll.RtlFindSetBits|0xf45b1dc4
ntdll.dll.RtlFindNextForwardRunClear|0x5c706f55
ntdll.dll.RtlFindMostSignificantBit|0xb78ec159
ntdll.dll.RtlFindMessage|0x63ee29c4
ntdll.dll.RtlFindLongestRunClear|0x3296f1a6
ntdll.dll.RtlFindLeastSignificantBit|0x28e58975
ntdll.dll.RtlFindLastBackwardRunClear|0x00a1bfee
ntdll.dll.RtlFindExportedRoutineByName|0x9c10cd98
ntdll.dll.RtlFindClosestEncodableLength|0x751af2ba
ntdll.dll.RtlFindClearRuns|0x3ded2e60
ntdll.dll.RtlFindClearBitsAndSet|0x4b8c0e0f
ntdll.dll.RtlFindClearBits|0x25ec2fe0
ntdll.dll.RtlFindCharInUnicodeString|0x87fb0d62
ntdll.dll.RtlFindActivationContextSectionString|0xf6675b14
ntdll.dll.RtlFindActivationContextSectionGuid|0x5743a9b0
ntdll.dll.RtlFindAceByType|0xbc013ee4
ntdll.dll.RtlFinalReleaseOutOfProcessMemoryStream|0xbea3d95a
ntdll.dll.RtlFillMemoryUlonglong|0xffdfd4aa
ntdll.dll.RtlFillMemoryUlong|0x5c4817bd
ntdll.dll.RtlFillMemory|0xb77860d4
ntdll.dll.RtlExtractBitMap|0xe3e83def
ntdll.dll.RtlExtendedMagicDivide|0x0f97fa39
ntdll.dll.RtlExtendedLargeIntegerDivide|0x76dd1c6d
ntdll.dll.RtlExtendedIntegerMultiply|0x1e3fecae
ntdll.dll.RtlExtendMemoryZone|0x9f22874f
ntdll.dll.RtlExtendMemoryBlockLookaside|0xdb158a8b
ntdll.dll.RtlExtendCorrelationVector|0xa02e53f0
ntdll.dll.RtlExpandHashTable|0x56347aac
ntdll.dll.RtlExpandEnvironmentStrings_U|0xf5e3bee2
ntdll.dll.RtlExpandEnvironmentStrings|0x8d6c9d8e
ntdll.dll.RtlExitUserThread|0x6f721347
ntdll.dll.RtlExitUserProcess|0xaa1b814d
ntdll.dll.RtlEthernetStringToAddressW|0xc79f7ebb
ntdll.dll.RtlEthernetStringToAddressA|0xc6ef7ebb
ntdll.dll.RtlEthernetAddressToStringW|0xb064a911
ntdll.dll.RtlEthernetAddressToStringA|0xafb4a911
ntdll.dll.RtlEraseUnicodeString|0x16474e48
ntdll.dll.RtlEqualWnfChangeStamps|0x507c635a
ntdll.dll.RtlEqualUnicodeString|0xd65b6a3e
ntdll.dll.RtlEqualString|0xf0b45766
ntdll.dll.RtlEqualSid|0xaf3c5ffd
ntdll.dll.RtlEqualPrefixSid|0x95135c6d
ntdll.dll.RtlEqualLuid|0x9f2d2da1
ntdll.dll.RtlEqualDomainName|0x62b464b1
ntdll.dll.RtlEqualComputerName|0xccb013d0
ntdll.dll.RtlEnumerateGenericTableWithoutSplayingAvl|0xe889f295
ntdll.dll.RtlEnumerateGenericTableWithoutSplaying|0x8678fa61
ntdll.dll.RtlEnumerateGenericTableLikeADirectory|0xfc21e163
ntdll.dll.RtlEnumerateGenericTableAvl|0x482af2bb
ntdll.dll.RtlEnumerateGenericTable|0x56f90d11
ntdll.dll.RtlEnumerateEntryHashTable|0x1633e70f
ntdll.dll.RtlEnumProcessHeaps|0x3fb32a5e
ntdll.dll.RtlEnterCriticalSection|0xcee535ff
ntdll.dll.RtlEnlargedUnsignedMultiply|0x4e1d5c40
ntdll.dll.RtlEnlargedIntegerMultiply|0xdefbf486
ntdll.dll.RtlEndWeakEnumerationHashTable|0x4ca18e13
ntdll.dll.RtlEndStrongEnumerationHashTable|0x36075257
ntdll.dll.RtlEndEnumerationHashTable|0x79d6e8bc
ntdll.dll.RtlEncodeSystemPointer|0x9f816ce5
ntdll.dll.RtlEncodeRemotePointer|0x56f5e3a4
ntdll.dll.RtlEncodePointer|0x7489f1cf
ntdll.dll.RtlEnableThreadProfiling|0xc8bfc06f
ntdll.dll.RtlEnableEarlyCriticalSectionEventCreation|0x4df7b924
ntdll.dll.RtlEmptyAtomTable|0x735b7616
ntdll.dll.RtlDuplicateUnicodeString|0x9cd942e3
ntdll.dll.RtlDumpResource|0xb084e14d
ntdll.dll.RtlDowncaseUnicodeString|0xdf00b780
ntdll.dll.RtlDowncaseUnicodeChar|0xed55cd21
ntdll.dll.RtlDosSearchPath_Ustr|0xedb689c3
ntdll.dll.RtlDosSearchPath_U|0x04c4d131
ntdll.dll.RtlDosPathNameToRelativeNtPathName_U_WithStatus|0x246ec82f
ntdll.dll.RtlDosPathNameToRelativeNtPathName_U|0xd5c1f963
ntdll.dll.RtlDosPathNameToNtPathName_U_WithStatus|0x8c9dddfa
ntdll.dll.RtlDosPathNameToNtPathName_U|0x60a72d7b
ntdll.dll.RtlDosLongPathNameToRelativeNtPathName_U_WithStatus|0xd1b16e40
ntdll.dll.RtlDosLongPathNameToNtPathName_U_WithStatus|0xcf43eea7
ntdll.dll.RtlDosApplyFileIsolationRedirection_Ustr|0x824886fc
ntdll.dll.RtlDoesNameContainWildCards|0x15594f93
ntdll.dll.RtlDoesFileExists_U|0x2588e632
ntdll.dll.RtlDnsHostNameToComputerName|0x0a7ed0ba
ntdll.dll.RtlDllShutdownInProgress|0xba2e990b
ntdll.dll.RtlDispatchAPC|0x2f159e7b
ntdll.dll.RtlDisableThreadProfiling|0xa7d1e1d2
ntdll.dll.RtlDetermineDosPathNameType_U|0xf0c58918
ntdll.dll.RtlDetectHeapLeaks|0x3aae6c6b
ntdll.dll.RtlDestroyQueryDebugBuffer|0x22a59ec9
ntdll.dll.RtlDestroyProcessParameters|0xbf02426f
ntdll.dll.RtlDestroyMemoryZone|0x23ecca23
ntdll.dll.RtlDestroyMemoryBlockLookaside|0xfc481b40
ntdll.dll.RtlDestroyHeap|0x7c67a4e6
ntdll.dll.RtlDestroyHandleTable|0xb50e6ae0
ntdll.dll.RtlDestroyEnvironment|0x00a96c30
ntdll.dll.RtlDestroyAtomTable|0xb3a2d305
ntdll.dll.RtlDeriveCapabilitySidsFromName|0x6aff4187
ntdll.dll.RtlDeregisterWaitEx|0xc158dcfa
ntdll.dll.RtlDeregisterWait|0xec961220
ntdll.dll.RtlDeregisterSecureMemoryCacheCallback|0xf184e70e
ntdll.dll.RtlDeleteTimerQueueEx|0x65225b7a
ntdll.dll.RtlDeleteTimerQueue|0xeb25381a
ntdll.dll.RtlDeleteTimer|0xfd517e13
ntdll.dll.RtlDeleteSecurityObject|0x3ad648b6
ntdll.dll.RtlDeleteResource|0xad57ce62
ntdll.dll.RtlDeleteRegistryValue|0x535f1223
ntdll.dll.RtlDeleteNoSplay|0xe4548ff1
ntdll.dll.RtlDeleteHashTable|0x74402eec
ntdll.dll.RtlDeleteElementGenericTableAvlEx|0xb4579178
ntdll.dll.RtlDeleteElementGenericTableAvl|0xe4620cf2
ntdll.dll.RtlDeleteElementGenericTable|0x728628df
ntdll.dll.RtlDeleteCriticalSection|0xcf448459
ntdll.dll.RtlDeleteBoundaryDescriptor|0xce5592ba
ntdll.dll.RtlDeleteBarrier|0x5de4af81
ntdll.dll.RtlDeleteAtomFromAtomTable|0xd1ddeb49
ntdll.dll.RtlDeleteAce|0x2b46b304
ntdll.dll.RtlDelete|0x00db9202
ntdll.dll.RtlDefaultNpAcl|0x31a01a1a
ntdll.dll.RtlDecompressFragment|0xfe213fbd
ntdll.dll.RtlDecompressBufferEx|0x9454b5dd
ntdll.dll.RtlDecompressBuffer|0x77e20184
ntdll.dll.RtlDecodeSystemPointer|0x9d416ae5
ntdll.dll.RtlDecodeRemotePointer|0x54b5e1a4
ntdll.dll.RtlDecodePointer|0x7409f13f
ntdll.dll.RtlDebugPrintTimes|0x4dc7fd87
ntdll.dll.RtlDeactivateActivationContextUnsafeFast|0x2afc64fb
ntdll.dll.RtlDeactivateActivationContext|0x0723695e
ntdll.dll.RtlDeNormalizeProcessParams|0xc6fac7af
ntdll.dll.RtlDeCommitDebugInfo|0xd7a69a5e
ntdll.dll.RtlCutoverTimeToSystemTime|0xce02e017
ntdll.dll.RtlCustomCPToUnicodeN|0xe8374284
ntdll.dll.RtlCultureNameToLCID|0x2bd3bfc5
ntdll.dll.RtlCreateVirtualAccountSid|0xda43c657
ntdll.dll.RtlCreateUserThread|0x40a438c8
ntdll.dll.RtlCreateUserStack|0xe119f6ab
ntdll.dll.RtlCreateUserSecurityObject|0x391f0c96
ntdll.dll.RtlCreateUserProcessEx|0x24570c74
ntdll.dll.RtlCreateUserProcess|0xd6220ade
ntdll.dll.RtlCreateUnicodeStringFromAsciiz|0xe53778f1
ntdll.dll.RtlCreateUnicodeString|0xc197fd28
ntdll.dll.RtlCreateTimerQueue|0x89241c1c
ntdll.dll.RtlCreateTimer|0x394f4616
ntdll.dll.RtlCreateTagHeap|0xd544118a
ntdll.dll.RtlCreateSystemVolumeInformationFolder|0xb6e7dc13
ntdll.dll.RtlCreateServiceSid|0x29f6fb44
ntdll.dll.RtlCreateSecurityDescriptor|0xb821c96f
ntdll.dll.RtlCreateRegistryKey|0x99557bbc
ntdll.dll.RtlCreateQueryDebugBuffer|0x28d0839f
ntdll.dll.RtlCreateProcessReflection|0x616a9466
ntdll.dll.RtlCreateProcessParametersWithTemplate|0xcbd80e2f
ntdll.dll.RtlCreateProcessParametersEx|0x08714678
ntdll.dll.RtlCreateProcessParameters|0xe5b273c6
ntdll.dll.RtlCreateMemoryZone|0xdd224bae
ntdll.dll.RtlCreateMemoryBlockLookaside|0xaa957ba3
ntdll.dll.RtlCreateHeap|0xdcca5333
ntdll.dll.RtlCreateHashTableEx|0xcbecffd3
ntdll.dll.RtlCreateHashTable|0x50c062ac
ntdll.dll.RtlCreateEnvironmentEx|0xdba1cc02
ntdll.dll.RtlCreateEnvironment|0x0cff35dc
ntdll.dll.RtlCreateBoundaryDescriptor|0xcff3919e
ntdll.dll.RtlCreateBootStatusDataFile|0x94011b97
ntdll.dll.RtlCreateAtomTable|0x63d42a2c
ntdll.dll.RtlCreateAndSetSD|0xa58ac704
ntdll.dll.RtlCreateActivationContext|0x4a35f7fa
ntdll.dll.RtlCreateAcl|0x386eaa24
ntdll.dll.RtlCrc64|0xd9f15371
ntdll.dll.RtlCrc32|0xd9e152b1
ntdll.dll.RtlCopyUnicodeString|0x9fecacce
ntdll.dll.RtlCopyString|0x6f00e17b
ntdll.dll.RtlCopySidAndAttributesArray|0xc31698d6
ntdll.dll.RtlCopySid|0xd5816a3c
ntdll.dll.RtlCopySecurityDescriptor|0xa74c2142
ntdll.dll.RtlCopyOutOfProcessMemoryStreamTo|0x05311daf
ntdll.dll.RtlCopyMemoryStreamTo|0x159d297d
ntdll.dll.RtlCopyMappedMemory|0x4127fcdd
ntdll.dll.RtlCopyLuidAndAttributesArray|0x265d8213
ntdll.dll.RtlCopyLuid|0xf1265fc9
ntdll.dll.RtlCopyExtendedContext|0x29521727
ntdll.dll.RtlCopyContext|0x81884cc3
ntdll.dll.RtlCopyBitMap|0xb704fe35
ntdll.dll.RtlConvertUlongToLargeInteger|0xf8e81dc2
ntdll.dll.RtlConvertToAutoInheritSecurityObject|0x3c244f12
ntdll.dll.RtlConvertSidToUnicodeString|0x44cf77bf
ntdll.dll.RtlConvertSharedToExclusive|0xfc4693d0
ntdll.dll.RtlConvertSRWLockExclusiveToShared|0x13277744
ntdll.dll.RtlConvertLongToLargeInteger|0x6dcbf415
ntdll.dll.RtlConvertLCIDToString|0x601fd888
ntdll.dll.RtlConvertExclusiveToShared|0x7214598c
ntdll.dll.RtlConvertDeviceFamilyInfoToString|0xfc6e4d42
ntdll.dll.RtlContractHashTable|0x9da25132
ntdll.dll.RtlConstructCrossVmEventPath|0x9a008be1
ntdll.dll.RtlConsoleMultiByteToUnicodeN|0x389face1
ntdll.dll.RtlConnectToSm|0x8a1e37c6
ntdll.dll.RtlComputePrivatizedDllName_U|0x48510084
ntdll.dll.RtlComputeImportTableHash|0xcad4f44e
ntdll.dll.RtlComputeCrc32|0xb3a8a707
ntdll.dll.RtlCompressBuffer|0x3b10dcb4
ntdll.dll.RtlCompareUnicodeStrings|0x37e7f720
ntdll.dll.RtlCompareUnicodeString|0xfa945605
ntdll.dll.RtlCompareString|0x29d61ec4
ntdll.dll.RtlCompareMemoryUlong|0xdbb2cf31
ntdll.dll.RtlCompareMemory|0xb64dcfbd
ntdll.dll.RtlCompareAltitudes|0xee08f8e1
ntdll.dll.RtlCompactHeap|0x783572c6
ntdll.dll.RtlCommitMemoryStream|0xeb7b5b62
ntdll.dll.RtlCommitDebugInfo|0xb12cb3d9
ntdll.dll.RtlCmEncodeMemIoResource|0xdb860025
ntdll.dll.RtlCmDecodeMemIoResource|0xd945fe25
ntdll.dll.RtlCloneUserProcess|0x94f30022
ntdll.dll.RtlCloneMemoryStream|0x0e117e00
ntdll.dll.RtlClearThreadWorkOnBehalfTicket|0x17ab39b3
ntdll.dll.RtlClearBits|0x82a47e64
ntdll.dll.RtlClearBit|0x8b7cbf5d
ntdll.dll.RtlClearAllBits|0x3ec338fa
ntdll.dll.RtlCleanUpTEBLangLists|0xdefe160b
ntdll.dll.RtlCheckTokenMembershipEx|0x69dfadb2
ntdll.dll.RtlCheckTokenMembership|0xcb382d63
ntdll.dll.RtlCheckTokenCapability|0xd0739ffc
ntdll.dll.RtlCheckSystemBootStatusIntegrity|0xfd3b79f7
ntdll.dll.RtlCheckSandboxedToken|0x7d8b82d7
ntdll.dll.RtlCheckRegistryKey|0xd2a6495f
ntdll.dll.RtlCheckPortableOperatingSystem|0x7c0f65ec
ntdll.dll.RtlCheckForOrphanedCriticalSections|0x39c1199b
ntdll.dll.RtlCheckBootStatusIntegrity|0x8eeecf25
ntdll.dll.RtlCharToInteger|0xa380e095
ntdll.dll.RtlCaptureStackContext|0x6558ee0d
ntdll.dll.RtlCaptureStackBackTrace|0x3d53762f
ntdll.dll.RtlCaptureContext|0x64de23a2
ntdll.dll.RtlCapabilityCheckForSingleSessionSku|0xfc7a0265
ntdll.dll.RtlCapabilityCheck|0xe491ac84
ntdll.dll.RtlCanonicalizeDomainName|0x614f2502
ntdll.dll.RtlCancelTimer|0xfb6b8c32
ntdll.dll.RtlBarrierForDelete|0xf2e9a8db
ntdll.dll.RtlBarrier|0x01b8f91d
ntdll.dll.RtlAvlRemoveNode|0x304dfde5
ntdll.dll.RtlAvlInsertNodeEx|0x2b657f9c
ntdll.dll.RtlAssert|0x01480189
ntdll.dll.RtlAreLongPathsEnabled|0xffc5dd02
ntdll.dll.RtlAreBitsSet|0xb8c1005a
ntdll.dll.RtlAreBitsClear|0xade4e265
ntdll.dll.RtlAreAnyAccessesGranted|0x704e753d
ntdll.dll.RtlAreAllAccessesGranted|0x7041752d
ntdll.dll.RtlAppxIsFileOwnedByTrustedInstaller|0x20a0f5b4
ntdll.dll.RtlApplyRXactNoFlush|0x5a42b547
ntdll.dll.RtlApplyRXact|0xdfff4509
ntdll.dll.RtlApplicationVerifierStop|0xeb243cc5
ntdll.dll.RtlAppendUnicodeToString|0x66cdfe65
ntdll.dll.RtlAppendUnicodeStringToString|0x99e7e2c8
ntdll.dll.RtlAppendStringToString|0xdae0d12e
ntdll.dll.RtlAppendPathElement|0xa9073016
ntdll.dll.RtlAppendAsciizToString|0x9a61203d
ntdll.dll.RtlAnsiStringToUnicodeString|0x5ae972b3
ntdll.dll.RtlAnsiStringToUnicodeSize|0xb8de764e
ntdll.dll.RtlAnsiCharToUnicodeChar|0xcab74089
ntdll.dll.RtlAllocateWnfSerializationGroup|0x749ba0bb
ntdll.dll.RtlAllocateMemoryZone|0xb0b477b5
ntdll.dll.RtlAllocateMemoryBlockLookaside|0x5f7a06a5
ntdll.dll.RtlAllocateHeap|0x67cc0818
ntdll.dll.RtlAllocateHandle|0x763f3497
ntdll.dll.RtlAllocateAndInitializeSidEx|0x50520c3a
ntdll.dll.RtlAllocateAndInitializeSid|0xead1f6dd
ntdll.dll.RtlAllocateActivationContextStack|0x42ea20fc
ntdll.dll.RtlAdjustPrivilege|0x6a77197a
ntdll.dll.RtlAddressInSectionTable|0x33e3b88f
ntdll.dll.RtlAddVectoredExceptionHandler|0x825afe2a
ntdll.dll.RtlAddVectoredContinueHandler|0x27b315c9
ntdll.dll.RtlAddScopedPolicyIDAce|0xb5a96f6a
ntdll.dll.RtlAddSIDToBoundaryDescriptor|0x9338af60
ntdll.dll.RtlAddResourceAttributeAce|0x87a667d6
ntdll.dll.RtlAddRefMemoryStream|0x83f24b07
ntdll.dll.RtlAddRefActivationContext|0x5a3559c1
ntdll.dll.RtlAddProcessTrustLabelAce|0xa0cd445e
ntdll.dll.RtlAddMandatoryAce|0x0e38875c
ntdll.dll.RtlAddIntegrityLabelToBoundaryDescriptor|0x0fbdbe36
ntdll.dll.RtlAddCompoundAce|0xa89af320
ntdll.dll.RtlAddAuditAccessObjectAce|0x8ba362d6
ntdll.dll.RtlAddAuditAccessAceEx|0x61ae9ce7
ntdll.dll.RtlAddAuditAccessAce|0x9f176920
ntdll.dll.RtlAddAttributeActionToRXact|0xca141a17
ntdll.dll.RtlAddAtomToAtomTable|0xe4760a75
ntdll.dll.RtlAddActionToRXact|0x72aa7070
ntdll.dll.RtlAddAce|0x38cf0dc1
ntdll.dll.RtlAddAccessFilterAce|0x11d0fb5e
ntdll.dll.RtlAddAccessDeniedObjectAce|0x159d1d08
ntdll.dll.RtlAddAccessDeniedAceEx|0x04d73c82
ntdll.dll.RtlAddAccessDeniedAce|0x0da40b9e
ntdll.dll.RtlAddAccessAllowedObjectAce|0xc69a60a4
ntdll.dll.RtlAddAccessAllowedAceEx|0x3e924c56
ntdll.dll.RtlAddAccessAllowedAce|0x5e8af7de
ntdll.dll.RtlActivateActivationContextUnsafeFast|0x9894c693
ntdll.dll.RtlActivateActivationContextEx|0xfd1043ee
ntdll.dll.RtlActivateActivationContext|0xbd84efbc
ntdll.dll.RtlAcquireSRWLockShared|0x2b5f2ae1
ntdll.dll.RtlAcquireSRWLockExclusive|0x49843f3f
ntdll.dll.RtlAcquireResourceShared|0xf9c2e5bc
ntdll.dll.RtlAcquireResourceExclusive|0xff2106b4
ntdll.dll.RtlAcquireReleaseSRWLockExclusive|0x49951b25
ntdll.dll.RtlAcquirePrivilege|0xf84af07a
ntdll.dll.RtlAcquirePebLock|0x796d9809
ntdll.dll.RtlAbsoluteToSelfRelativeSD|0xd5cbc3e9
ntdll.dll.RtlAbortRXact|0xdeead5c9
ntdll.dll.PssNtWalkSnapshot|0x01ff0921
ntdll.dll.PssNtValidateDescriptor|0x706e6bdc
ntdll.dll.PssNtQuerySnapshot|0xe4881416
ntdll.dll.PssNtFreeWalkMarker|0x9c42282d
ntdll.dll.PssNtFreeSnapshot|0x4220d810
ntdll.dll.PssNtFreeRemoteSnapshot|0x36475562
ntdll.dll.PssNtDuplicateSnapshot|0xe9bb6eca
ntdll.dll.PssNtCaptureSnapshot|0x9ce90ce2
ntdll.dll.PfxRemovePrefix|0x026fa3ae
ntdll.dll.PfxInsertPrefix|0x7e815500
ntdll.dll.PfxInitialize|0x67607af3
ntdll.dll.PfxFindPrefix|0x2693dcba
ntdll.dll.NtdllDialogWndProc_W|0xe1687a10
ntdll.dll.NtdllDialogWndProc_A|0xe0b87a10
ntdll.dll.NtdllDefWindowProc_W|0xa4dcd322
ntdll.dll.NtdllDefWindowProc_A|0xa42cd322
ntdll.dll.NtYieldExecution|0xc3471262
ntdll.dll.NtWriteVirtualMemory|0xa4b03fd3
ntdll.dll.NtWriteRequestData|0x48f2b742
ntdll.dll.NtWriteFileGather|0x9510972d
ntdll.dll.NtWriteFile|0x083557bf
ntdll.dll.NtWow64WriteVirtualMemory64|0x8ca1b527
ntdll.dll.NtWow64ReadVirtualMemory64|0x4297dcf6
ntdll.dll.NtWow64QueryInformationProcess64|0x170afc1e
ntdll.dll.NtWow64IsProcessorFeaturePresent|0xa96995e2
ntdll.dll.NtWow64GetNativeSystemInformation|0xb57dc8fe
ntdll.dll.NtWow64GetCurrentProcessorNumberEx|0x48d31d74
ntdll.dll.NtWow64DebuggerCall|0x04d09288
ntdll.dll.NtWow64CsrVerifyRegion|0xa356acd5
ntdll.dll.NtWow64CsrIdentifyAlertableThread|0x6a76decd
ntdll.dll.NtWow64CsrGetProcessId|0x434a9926
ntdll.dll.NtWow64CsrFreeCaptureBuffer|0xd7a8384f
ntdll.dll.NtWow64CsrClientConnectToServer|0xba8ac854
ntdll.dll.NtWow64CsrClientCallServer|0x99fc73b4
ntdll.dll.NtWow64CsrCaptureMessageString|0xe62cf876
ntdll.dll.NtWow64CsrCaptureMessageBuffer|0x60403637
ntdll.dll.NtWow64CsrAllocateMessagePointer|0x878e9b6a
ntdll.dll.NtWow64CsrAllocateCaptureBuffer|0x0547ebfe
ntdll.dll.NtWow64CallFunction64|0x998b8dfc
ntdll.dll.NtWow64AllocateVirtualMemory64|0x396e5742
ntdll.dll.NtWorkerFactoryWorkerReady|0xfaf120ad
ntdll.dll.NtWaitLowEventPair|0xaaa012f4
ntdll.dll.NtWaitHighEventPair|0xde1adbd9
ntdll.dll.NtWaitForWorkViaWorkerFactory|0x057eeea4
ntdll.dll.NtWaitForSingleObject|0x4c2f8785
ntdll.dll.NtWaitForMultipleObjects32|0x288579bc
ntdll.dll.NtWaitForMultipleObjects|0xf63b84a5
ntdll.dll.NtWaitForKeyedEvent|0x281c3d5a
ntdll.dll.NtWaitForDebugEvent|0x51283f59
ntdll.dll.NtWaitForAlertByThreadId|0x639980d6
ntdll.dll.NtVdmControl|0x15a8a09c
ntdll.dll.NtUpdateWnfStateData|0xc27bd9bd
ntdll.dll.NtUnsubscribeWnfStateChange|0x6e0ff230
ntdll.dll.NtUnmapViewOfSectionEx|0xe43e48fe
ntdll.dll.NtUnmapViewOfSection|0xfd21a7d0
ntdll.dll.NtUnlockVirtualMemory|0xea9d19a3
ntdll.dll.NtUnlockFile|0x423e155b
ntdll.dll.NtUnloadKeyEx|0xcc9dec31
ntdll.dll.NtUnloadKey2|0xb89e6897
ntdll.dll.NtUnloadKey|0xc8c3265d
ntdll.dll.NtUnloadDriver|0xcb2182b4
ntdll.dll.NtUmsThreadYield|0xa9cbb9f5
ntdll.dll.NtTranslateFilePath|0x4348c72c
ntdll.dll.NtTraceEvent|0xefc13447
ntdll.dll.NtTraceControl|0x07a5d0ff
ntdll.dll.NtThawTransactions|0x2501cc2f
ntdll.dll.NtThawRegistry|0x78da65fd
ntdll.dll.NtTestAlert|0xf3afa26d
ntdll.dll.NtTerminateThread|0xbb5c01ca
ntdll.dll.NtTerminateProcess|0x1e35e09c
ntdll.dll.NtTerminateJobObject|0x89dbc1e5
ntdll.dll.NtTerminateEnclave|0x15b66ff6
ntdll.dll.NtSystemDebugControl|0xbb40a7db
ntdll.dll.NtSuspendThread|0x657c5bba
ntdll.dll.NtSuspendProcess|0xedb3319f
ntdll.dll.NtSubscribeWnfStateChange|0x31f2f793
ntdll.dll.NtStopProfile|0x2d3a1be4
ntdll.dll.NtStartProfile|0x847d69d0
ntdll.dll.NtSinglePhaseReject|0x149725f2
ntdll.dll.NtSignalAndWaitForSingleObject|0x0709e45e
ntdll.dll.NtShutdownWorkerFactory|0x87afd2d2
ntdll.dll.NtShutdownSystem|0xd7903a04
ntdll.dll.NtSetWnfProcessNotificationEvent|0xe9d0d93c
ntdll.dll.NtSetVolumeInformationFile|0xd7f016fe
ntdll.dll.NtSetValueKey|0x17c23443
ntdll.dll.NtSetUuidSeed|0xca0d16bb
ntdll.dll.NtSetTimerResolution|0x355f3ec6
ntdll.dll.NtSetTimerEx|0xdcefb03b
ntdll.dll.NtSetTimer2|0xf11faaa1
ntdll.dll.NtSetTimer|0xf1046d6d
ntdll.dll.NtSetThreadExecutionState|0xc2c88597
ntdll.dll.NtSetSystemTime|0xb2c91fb5
ntdll.dll.NtSetSystemPowerState|0xb12b7534
ntdll.dll.NtSetSystemInformation|0x65905650
ntdll.dll.NtSetSystemEnvironmentValueEx|0x32af5c78
ntdll.dll.NtSetSystemEnvironmentValue|0xe65b6c1e
ntdll.dll.NtSetSecurityObject|0xd2511854
ntdll.dll.NtSetQuotaInformationFile|0xc427c9f7
ntdll.dll.NtSetLowWaitHighEventPair|0x19759374
ntdll.dll.NtSetLowEventPair|0xd73d01c2
ntdll.dll.NtSetLdtEntries|0x745e4fd7
ntdll.dll.NtSetIoCompletionEx|0x21f96c56
ntdll.dll.NtSetIoCompletion|0x5e18945e
ntdll.dll.NtSetIntervalProfile|0xd1ae4e2b
ntdll.dll.NtSetInformationWorkerFactory|0xce5173c3
ntdll.dll.NtSetInformationVirtualMemory|0xfc818826
ntdll.dll.NtSetInformationTransactionManager|0x2d80fc4a
ntdll.dll.NtSetInformationTransaction|0x5f787cde
ntdll.dll.NtSetInformationToken|0x14d91787
ntdll.dll.NtSetInformationThread|0xc3813603
ntdll.dll.NtSetInformationSymbolicLink|0xde8eef8c
ntdll.dll.NtSetInformationResourceManager|0xf054fb31
ntdll.dll.NtSetInformationProcess|0xbffe21c6
ntdll.dll.NtSetInformationObject|0xc3ecb680
ntdll.dll.NtSetInformationKey|0x1055506a
ntdll.dll.NtSetInformationJobObject|0xfbec0c4d
ntdll.dll.NtSetInformationFile|0x12a051e8
ntdll.dll.NtSetInformationEnlistment|0xb8747ba2
ntdll.dll.NtSetInformationDebugObject|0x9e3fe05a
ntdll.dll.NtSetIRTimer|0x5263f6cf
ntdll.dll.NtSetHighWaitLowEventPair|0xab7b5a2f
ntdll.dll.NtSetHighEventPair|0x548c40c1
ntdll.dll.NtSetEventBoostPriority|0xf3804768
ntdll.dll.NtSetEvent|0x61153fa6
ntdll.dll.NtSetEaFile|0xfa79391d
ntdll.dll.NtSetDriverEntryOrder|0x15aa230e
ntdll.dll.NtSetDefaultUILanguage|0x5a8d2da3
ntdll.dll.NtSetDefaultLocale|0x079cf31c
ntdll.dll.NtSetDefaultHardErrorPort|0x0d738322
ntdll.dll.NtSetDebugFilterState|0x6e4e1958
ntdll.dll.NtSetContextThread|0x5b4560fe
ntdll.dll.NtSetCachedSigningLevel2|0xab0fd686
ntdll.dll.NtSetCachedSigningLevel|0xf68104ab
ntdll.dll.NtSetBootOptions|0x094f9854
ntdll.dll.NtSetBootEntryOrder|0x15e77c9f
ntdll.dll.NtSerializeBoot|0x388f3ed6
ntdll.dll.NtSecureConnectPort|0x06bc29ba
ntdll.dll.NtSaveMergedKeys|0x71676e24
ntdll.dll.NtSaveKeyEx|0x17931f92
ntdll.dll.NtSaveKey|0x4deefb2b
ntdll.dll.NtRollforwardTransactionManager|0xfc093b0f
ntdll.dll.NtRollbackTransaction|0x5215bbe2
ntdll.dll.NtRollbackRegistryTransaction|0x5ab9ddc7
ntdll.dll.NtRollbackEnlistment|0x6054f9f6
ntdll.dll.NtRollbackComplete|0x3b16144e
ntdll.dll.NtRevertContainerImpersonation|0x7ad37940
ntdll.dll.NtResumeThread|0x74e041a1
ntdll.dll.NtResumeProcess|0x1cebacbe
ntdll.dll.NtRestoreKey|0xce0fbc3d
ntdll.dll.NtResetWriteWatch|0x4f557b9c
ntdll.dll.NtResetEvent|0x81fccc87
ntdll.dll.NtRequestWaitReplyPort|0xd025772d
ntdll.dll.NtRequestPort|0xfeb2d003
ntdll.dll.NtReplyWaitReplyPort|0xa836a774
ntdll.dll.NtReplyWaitReceivePortEx|0xd8c11de5
ntdll.dll.NtReplyWaitReceivePort|0x98f3b324
ntdll.dll.NtReplyPort|0x078dd229
ntdll.dll.NtReplacePartitionUnit|0x59803fbe
ntdll.dll.NtReplaceKey|0x4ad7bb36
ntdll.dll.NtRenameTransactionManager|0x4367b612
ntdll.dll.NtRenameKey|0xbf8b1ea3
ntdll.dll.NtRemoveProcessDebug|0x34fb7368
ntdll.dll.NtRemoveIoCompletionEx|0x60849c72
ntdll.dll.NtRemoveIoCompletion|0xcb12c11e
ntdll.dll.NtReleaseWorkerFactoryWorker|0x7552c627
ntdll.dll.NtReleaseSemaphore|0xad89137e
ntdll.dll.NtReleaseMutant|0x22525e1d
ntdll.dll.NtReleaseKeyedEvent|0x95860173
ntdll.dll.NtRegisterThreadTerminatePort|0x234a1ca8
ntdll.dll.NtRegisterProtocolAddressInformation|0x5bd1688f
ntdll.dll.NtRecoverTransactionManager|0xb33be3b0
ntdll.dll.NtRecoverResourceManager|0xcdc8adf4
ntdll.dll.NtRecoverEnlistment|0x735be128
ntdll.dll.NtReadVirtualMemory|0x6bebeecc
ntdll.dll.NtReadRequestData|0x2c0fa5fd
ntdll.dll.NtReadOnlyEnlistment|0x66e5ae35
ntdll.dll.NtReadFileScatter|0xc24277f5
ntdll.dll.NtReadFile|0xe74e3f35
ntdll.dll.NtRaiseHardError|0xfa78f02a
ntdll.dll.NtRaiseException|0x7f5cf660
ntdll.dll.NtQueueApcThreadEx|0xcefffbdd
ntdll.dll.NtQueueApcThread|0x78ccae9c
ntdll.dll.NtQueryWnfStateNameInformation|0x9cbf1d42
ntdll.dll.NtQueryWnfStateData|0x744c84c1
ntdll.dll.NtQueryVolumeInformationFile|0xe670e9fa
ntdll.dll.NtQueryVirtualMemory|0x632c8feb
ntdll.dll.NtQueryValueKey|0x19682c60
ntdll.dll.NtQueryTimerResolution|0x6a1e4267
ntdll.dll.NtQueryTimer|0xc4007bee
ntdll.dll.NtQuerySystemTime|0x1c4726f5
ntdll.dll.NtQuerySystemInformationEx|0xf023ec24
ntdll.dll.NtQuerySystemInformation|0x95513e5d
ntdll.dll.NtQuerySystemEnvironmentValueEx|0x2acc5e1e
ntdll.dll.NtQuerySystemEnvironmentValue|0x7e3be025
ntdll.dll.NtQuerySymbolicLinkObject|0xa1c8d3f6
ntdll.dll.NtQuerySemaphore|0x8202a425
ntdll.dll.NtQuerySecurityPolicy|0x3af13ef2
ntdll.dll.NtQuerySecurityObject|0xb2c51eec
ntdll.dll.NtQuerySecurityAttributesToken|0xab2a09c5
ntdll.dll.NtQuerySection|0x89944acb
ntdll.dll.NtQueryQuotaInformationFile|0xde874bc7
ntdll.dll.NtQueryPortInformationProcess|0xc4c9fadc
ntdll.dll.NtQueryPerformanceCounter|0x3979df28
ntdll.dll.NtQueryOpenSubKeysEx|0xfb8233d9
ntdll.dll.NtQueryOpenSubKeys|0x697eb77c
ntdll.dll.NtQueryObject|0xe7220ebe
ntdll.dll.NtQueryMutant|0x5f1ab188
ntdll.dll.NtQueryMultipleValueKey|0x01b3bb43
ntdll.dll.NtQueryLicenseValue|0x4428e689
ntdll.dll.NtQueryKey|0xab016f7c
ntdll.dll.NtQueryIoCompletion|0xbd9a6478
ntdll.dll.NtQueryIntervalProfile|0x066d51cb
ntdll.dll.NtQueryInstallUILanguage|0x204761d9
ntdll.dll.NtQueryInformationWorkerFactory|0xc66e7569
ntdll.dll.NtQueryInformationTransactionManager|0x298f7d1d
ntdll.dll.NtQueryInformationTransaction|0xf758f0e4
ntdll.dll.NtQueryInformationToken|0x31dabd7f
ntdll.dll.NtQueryInformationThread|0xf3421e10
ntdll.dll.NtQueryInformationResourceManager|0xf79564af
ntdll.dll.NtQueryInformationProcess|0x00679fcd
ntdll.dll.NtQueryInformationPort|0x53d7f709
ntdll.dll.NtQueryInformationJobObject|0x164b8e1d
ntdll.dll.NtQueryInformationFile|0x475f5589
ntdll.dll.NtQueryInformationEnlistment|0xc6f54e9e
ntdll.dll.NtQueryInformationByName|0x6affe119
ntdll.dll.NtQueryInformationAtom|0x5d9f0649
ntdll.dll.NtQueryFullAttributesFile|0xb182a7f7
ntdll.dll.NtQueryEvent|0x34114e26
ntdll.dll.NtQueryEaFile|0x6e7fd0fe
ntdll.dll.NtQueryDriverEntryOrder|0x32abc906
ntdll.dll.NtQueryDirectoryObject|0x633bf0a4
ntdll.dll.NtQueryDirectoryFileEx|0xe3380927
ntdll.dll.NtQueryDirectoryFile|0xa11d8ed1
ntdll.dll.NtQueryDefaultUILanguage|0x8a4e15b0
ntdll.dll.NtQueryDefaultLocale|0x886fef2b
ntdll.dll.NtQueryDebugFilterState|0x8b4fbf50
ntdll.dll.NtQueryBootOptions|0x4352e445
ntdll.dll.NtQueryBootEntryOrder|0xf65b8337
ntdll.dll.NtQueryAuxiliaryCounterFrequency|0xb871d07d
ntdll.dll.NtQueryAttributesFile|0x031c61a2
ntdll.dll.NtPulseEvent|0xfac14e46
ntdll.dll.NtProtectVirtualMemory|0xaae67919
ntdll.dll.NtPropagationFailed|0x38927b9b
ntdll.dll.NtPropagationComplete|0xbeebb94f
ntdll.dll.NtPrivilegedServiceAuditAlarm|0x853df351
ntdll.dll.NtPrivilegeObjectAuditAlarm|0x04c81902
ntdll.dll.NtPrivilegeCheck|0xeccb63ca
ntdll.dll.NtPrepareEnlistment|0xa8cee5e8
ntdll.dll.NtPrepareComplete|0x0437fbfe
ntdll.dll.NtPrePrepareEnlistment|0xa5492f25
ntdll.dll.NtPrePrepareComplete|0xf829e523
ntdll.dll.NtPowerInformation|0xabac986a
ntdll.dll.NtPlugPlayControl|0xdc563cac
ntdll.dll.NtOpenTransactionManager|0x253bc391
ntdll.dll.NtOpenTransaction|0x97365318
ntdll.dll.NtOpenTimer|0x8e874577
ntdll.dll.NtOpenThreadTokenEx|0x2c75e863
ntdll.dll.NtOpenThreadToken|0x9242864e
ntdll.dll.NtOpenThread|0x32fce277
ntdll.dll.NtOpenSymbolicLinkObject|0x662e175b
ntdll.dll.NtOpenSession|0x2b469d05
ntdll.dll.NtOpenSemaphore|0xee9b30cd
ntdll.dll.NtOpenSection|0x2b46acfd
ntdll.dll.NtOpenResourceManager|0xcdb89ead
ntdll.dll.NtOpenRegistryTransaction|0x90fefe5e
ntdll.dll.NtOpenProcessTokenEx|0x410d4de2
ntdll.dll.NtOpenProcessToken|0x8a94e3e4
ntdll.dll.NtOpenProcess|0x23a19da3
ntdll.dll.NtOpenPrivateNamespace|0xac143cce
ntdll.dll.NtOpenPartition|0x5f2fd8aa
ntdll.dll.NtOpenObjectAuditAlarm|0xa7103c0a
ntdll.dll.NtOpenMutant|0xab6105be
ntdll.dll.NtOpenKeyedEvent|0x80000a04
ntdll.dll.NtOpenKeyTransactedEx|0xb8eb2f7b
ntdll.dll.NtOpenKeyTransacted|0xf0745b6a
ntdll.dll.NtOpenKeyEx|0x26b6fd72
ntdll.dll.NtOpenKey|0xce2b8aa2
ntdll.dll.NtOpenJobObject|0xe4cb03a6
ntdll.dll.NtOpenIoCompletion|0x0e739591
ntdll.dll.NtOpenFile|0xe45e409a
ntdll.dll.NtOpenEventPair|0xe4353d8f
ntdll.dll.NtOpenEvent|0xfe9817af
ntdll.dll.NtOpenEnlistment|0x733bc29a
ntdll.dll.NtOpenDirectoryObject|0x95dda306
ntdll.dll.NtNotifyChangeSession|0xb93d2ff9
ntdll.dll.NtNotifyChangeMultipleKeys|0x09a079d5
ntdll.dll.NtNotifyChangeKey|0xfd646a0b
ntdll.dll.NtNotifyChangeDirectoryFileEx|0x0967b21c
ntdll.dll.NtNotifyChangeDirectoryFile|0x75b64d75
ntdll.dll.NtModifyDriverEntry|0x732db2b4
ntdll.dll.NtModifyBootEntry|0x2e7cf6fa
ntdll.dll.NtMapViewOfSectionEx|0x6c0453c6
ntdll.dll.NtMapViewOfSection|0x1b40bffb
ntdll.dll.NtMapUserPhysicalPagesScatter|0x2a1fbe15
ntdll.dll.NtMapUserPhysicalPages|0xea8d2966
ntdll.dll.NtMapCMFModule|0x34c1d033
ntdll.dll.NtManagePartition|0x0f278e27
ntdll.dll.NtManageHotPatch|0xe544b120
ntdll.dll.NtMakeTemporaryObject|0x0fac1fe7
ntdll.dll.NtMakePermanentObject|0x8e103f16
ntdll.dll.NtLockVirtualMemory|0xabf60a9c
ntdll.dll.NtLockRegistryKey|0x35d6cc6b
ntdll.dll.NtLockProductActivationKeys|0x5a52594d
ntdll.dll.NtLockFile|0x61564079
ntdll.dll.NtLoadKeyEx|0x258ee4f2
ntdll.dll.NtLoadKey2|0xd7b693b5
ntdll.dll.NtLoadKey|0xce26ea40
ntdll.dll.NtLoadEnclaveData|0x23015d77
ntdll.dll.NtLoadDriver|0x912c4a3c
ntdll.dll.NtListenPort|0x95be8f7a
ntdll.dll.NtIsUILanguageComitted|0xa8834f9f
ntdll.dll.NtIsSystemResumeAutomatic|0x0189d2b8
ntdll.dll.NtIsProcessInJob|0x373362be
ntdll.dll.NtInitiatePowerAction|0x70d6594a
ntdll.dll.NtInitializeRegistry|0x22062f06
ntdll.dll.NtInitializeNlsFiles|0x8e058c95
ntdll.dll.NtInitializeEnclave|0x9d4d4221
ntdll.dll.NtImpersonateThread|0x58619e06
ntdll.dll.NtImpersonateClientOfPort|0x095f9c0e
ntdll.dll.NtImpersonateAnonymousToken|0x4308f2b7
ntdll.dll.NtGetWriteWatch|0xb8e1b52b
ntdll.dll.NtGetTickCount|0x51bb0bdf
ntdll.dll.NtGetNotificationResourceManager|0x6c2e470f
ntdll.dll.NtGetNlsSectionPtr|0x62872589
ntdll.dll.NtGetNextThread|0xe97e5cb1
ntdll.dll.NtGetNextProcess|0xf56f51af
ntdll.dll.NtGetMUIRegistryInfo|0x8a625bfd
ntdll.dll.NtGetDevicePowerState|0x2b8c6911
ntdll.dll.NtGetCurrentProcessorNumberEx|0x6d25359b
ntdll.dll.NtGetCurrentProcessorNumber|0x6f454383
ntdll.dll.NtGetContextThread|0x5b3960fe
ntdll.dll.NtGetCompleteWnfStateSubscription|0xfdb116a1
ntdll.dll.NtGetCachedSigningLevel|0xf67b04ab
ntdll.dll.NtFsControlFile|0x2d0de81b
ntdll.dll.NtFreezeTransactions|0x9a141824
ntdll.dll.NtFreezeRegistry|0x3821b721
ntdll.dll.NtFreeVirtualMemory|0xebf8f26c
ntdll.dll.NtFreeUserPhysicalPages|0x41763201
ntdll.dll.NtFlushWriteBuffer|0x5131c3b5
ntdll.dll.NtFlushVirtualMemory|0x807c4ba3
ntdll.dll.NtFlushProcessWriteBuffers|0xd826f930
ntdll.dll.NtFlushKey|0x20405e5c
ntdll.dll.NtFlushInstructionCache|0x945cb1af
ntdll.dll.NtFlushInstallUILanguage|0x1c02e3ae
ntdll.dll.NtFlushBuffersFileEx|0xf33fb201
ntdll.dll.NtFlushBuffersFile|0x095dad74
ntdll.dll.NtFindAtom|0xf1c1f075
ntdll.dll.NtFilterTokenEx|0xf5f981fc
ntdll.dll.NtFilterToken|0xf56894b4
ntdll.dll.NtFilterBootOption|0x72fcb3d6
ntdll.dll.NtExtendSection|0x1d12c544
ntdll.dll.NtEnumerateValueKey|0xa0ce0e5e
ntdll.dll.NtEnumerateTransactionObject|0x83458660
ntdll.dll.NtEnumerateSystemEnvironmentValuesEx|0x10087c0d
ntdll.dll.NtEnumerateKey|0xb9cd3377
ntdll.dll.NtEnumerateDriverEntries|0x23214961
ntdll.dll.NtEnumerateBootEntries|0x325a3c88
ntdll.dll.NtEnableLastKnownGood|0x928e3071
ntdll.dll.NtDuplicateToken|0x764f5e63
ntdll.dll.NtDuplicateObject|0xfac7c232
ntdll.dll.NtDrawText|0x51c723df
ntdll.dll.NtDisplayString|0x591098e0
ntdll.dll.NtDisableLastKnownGood|0x93e179a6
ntdll.dll.NtDeviceIoControlFile|0x285e3795
ntdll.dll.NtDeleteWnfStateName|0x3e6477a5
ntdll.dll.NtDeleteWnfStateData|0x3e43d965
ntdll.dll.NtDeleteValueKey|0x63b4cbd6
ntdll.dll.NtDeletePrivateNamespace|0x8e4cf460
ntdll.dll.NtDeleteObjectAuditAlarm|0x8948f39c
ntdll.dll.NtDeleteKey|0x3f9aae67
ntdll.dll.NtDeleteFile|0x0281cc13
ntdll.dll.NtDeleteDriverEntry|0x7a23a12d
ntdll.dll.NtDeleteBootEntry|0x1298ceb4
ntdll.dll.NtDeleteAtom|0x18c17cd3
ntdll.dll.NtDelayExecution|0x0130bed7
ntdll.dll.NtDebugContinue|0x8549e121
ntdll.dll.NtDebugActiveProcess|0xe5d0abcd
ntdll.dll.NtCurrentTeb|0x1e312bf7
ntdll.dll.NtCreateWorkerFactory|0xdd5ec90a
ntdll.dll.NtCreateWnfStateName|0xbe1d780d
ntdll.dll.NtCreateWaitablePort|0x875ca16e
ntdll.dll.NtCreateWaitCompletionPacket|0x4d16decd
ntdll.dll.NtCreateUserProcess|0xb821bed9
ntdll.dll.NtCreateTransactionManager|0xb507a6ee
ntdll.dll.NtCreateTransaction|0x7bb4b233
ntdll.dll.NtCreateTokenEx|0x276bfa87
ntdll.dll.NtCreateToken|0x222e5e96
ntdll.dll.NtCreateTimer2|0x7a6954ee
ntdll.dll.NtCreateTimer|0x264dfe96
ntdll.dll.NtCreateThreadEx|0x9a3c803e
ntdll.dll.NtCreateThread|0xfbf9a0ad
ntdll.dll.NtCreateSymbolicLinkObject|0xf5f9fab7
ntdll.dll.NtCreateSemaphore|0x5a2d2a4a
ntdll.dll.NtCreateSectionEx|0xd9118dc6
ntdll.dll.NtCreateSection|0x1cf4f4e3
ntdll.dll.NtCreateResourceManager|0xb3aa4cf5
ntdll.dll.NtCreateRegistryTransaction|0xabe37cbd
ntdll.dll.NtCreateProfileEx|0xd3d94746
ntdll.dll.NtCreateProfile|0x1ce013c9
ntdll.dll.NtCreateProcessEx|0xefcdb744
ntdll.dll.NtCreateProcess|0x154fe589
ntdll.dll.NtCreatePrivateNamespace|0x1e536c5b
ntdll.dll.NtCreatePort|0xc7fad513
ntdll.dll.NtCreatePartition|0xcac1d226
ntdll.dll.NtCreatePagingFile|0x819046a6
ntdll.dll.NtCreateNamedPipeFile|0x2a6de309
ntdll.dll.NtCreateMutant|0x745dc3f4
ntdll.dll.NtCreateMailslotFile|0x0cefc095
ntdll.dll.NtCreateLowBoxToken|0x14010f2a
ntdll.dll.NtCreateKeyedEvent|0x4be36694
ntdll.dll.NtCreateKeyTransacted|0x100c2223
ntdll.dll.NtCreateKey|0x4c8aa587
ntdll.dll.NtCreateJobSet|0x5850a1b1
ntdll.dll.NtCreateJobObject|0x505cfd23
ntdll.dll.NtCreateIoCompletion|0x074ab984
ntdll.dll.NtCreateIRTimer|0xa4c8411c
ntdll.dll.NtCreateFile|0xbb823393
ntdll.dll.NtCreateEventPair|0x4fc7370c
ntdll.dll.NtCreateEvent|0x965ed0cf
ntdll.dll.NtCreateEnlistment|0x3f1f1f2a
ntdll.dll.NtCreateEnclave|0x0cd074e3
ntdll.dll.NtCreateDirectoryObjectEx|0x8fa8a85e
ntdll.dll.NtCreateDirectoryObject|0x7bcf514e
ntdll.dll.NtCreateDebugObject|0xba7c15af
ntdll.dll.NtCreateCrossVmEvent|0x0584f59f
ntdll.dll.NtConvertBetweenAuxiliaryCounterAndPerformanceCounter|0xd98dd7a9
ntdll.dll.NtContinue|0xe28472bd
ntdll.dll.NtConnectPort|0x7754b806
ntdll.dll.NtCompressKey|0xb186de65
ntdll.dll.NtCompleteConnectPort|0x66add493
ntdll.dll.NtCompareTokens|0xe1e7cebd
ntdll.dll.NtCompareSigningLevels|0x319864d8
ntdll.dll.NtCompareObjects|0x6773315c
ntdll.dll.NtCompactKeys|0x654c6146
ntdll.dll.NtCommitTransaction|0x7631e324
ntdll.dll.NtCommitRegistryTransaction|0x9cddf9ee
ntdll.dll.NtCommitEnlistment|0xe53d3e79
ntdll.dll.NtCommitComplete|0x4929b561
ntdll.dll.NtCloseObjectAuditAlarm|0x8437ba5c
ntdll.dll.NtClose|0xa198fdf1
ntdll.dll.NtClearEvent|0xb3f50403
ntdll.dll.NtCancelWaitCompletionPacket|0xc55a6790
ntdll.dll.NtCancelTimer2|0xab4765d0
ntdll.dll.NtCancelTimer|0xe86a44b2
ntdll.dll.NtCancelSynchronousIoFile|0x42deee56
ntdll.dll.NtCancelIoFileEx|0xc81169ac
ntdll.dll.NtCancelIoFile|0xb4b0f453
ntdll.dll.NtCallbackReturn|0x42039c4a
ntdll.dll.NtCallEnclave|0x590a64fa
ntdll.dll.NtAssociateWaitCompletionPacket|0xa77bc34c
ntdll.dll.NtAssignProcessToJobObject|0x09c0ea3f
ntdll.dll.NtAreMappedFilesTheSame|0x68cf7cab
ntdll.dll.NtApphelpCacheControl|0x8213f584
ntdll.dll.NtAlpcSetInformation|0x088cf04d
ntdll.dll.NtAlpcSendWaitReceivePort|0x1e3d03af
ntdll.dll.NtAlpcRevokeSecurityContext|0xdbd316e4
ntdll.dll.NtAlpcQueryInformationMessage|0x0f1fb2f2
ntdll.dll.NtAlpcQueryInformation|0x8ae8298f
ntdll.dll.NtAlpcOpenSenderThread|0x5669f3b2
ntdll.dll.NtAlpcOpenSenderProcess|0xad72b90c
ntdll.dll.NtAlpcImpersonateClientOfPort|0x20bab291
ntdll.dll.NtAlpcImpersonateClientContainerOfPort|0x5a36eda0
ntdll.dll.NtAlpcDisconnectPort|0xd5c6b367
ntdll.dll.NtAlpcDeleteSecurityContext|0xd94c032c
ntdll.dll.NtAlpcDeleteSectionView|0x67c4b455
ntdll.dll.NtAlpcDeleteResourceReserve|0x86b08c31
ntdll.dll.NtAlpcDeletePortSection|0x67510c12
ntdll.dll.NtAlpcCreateSecurityContext|0xa84b752d
ntdll.dll.NtAlpcCreateSectionView|0x87d1a44c
ntdll.dll.NtAlpcCreateResourceReserve|0x55affe32
ntdll.dll.NtAlpcCreatePortSection|0x875dfc09
ntdll.dll.NtAlpcCreatePort|0x7e27db42
ntdll.dll.NtAlpcConnectPortEx|0xce6eb069
ntdll.dll.NtAlpcConnectPort|0xa8ca696e
ntdll.dll.NtAlpcCancelMessage|0xf12ac328
ntdll.dll.NtAlpcAcceptConnectPort|0xcb5aaff1
ntdll.dll.NtAllocateVirtualMemoryEx|0xbe00a024
ntdll.dll.NtAllocateVirtualMemory|0x9488b12d
ntdll.dll.NtAllocateUuids|0x982a7de0
ntdll.dll.NtAllocateUserPhysicalPages|0x3d623c89
ntdll.dll.NtAllocateReserveObject|0x536a6448
ntdll.dll.NtAllocateLocallyUniqueId|0x15bf5116
ntdll.dll.NtAlertThreadByThreadId|0x798b2c67
ntdll.dll.NtAlertThread|0xa6968d9f
ntdll.dll.NtAlertResumeThread|0x324d6fb5
ntdll.dll.NtAdjustTokenClaimsAndDeviceGroups|0x758bb5e4
ntdll.dll.NtAdjustPrivilegesToken|0x1dc97e4d
ntdll.dll.NtAdjustGroupsToken|0xa655202c
ntdll.dll.NtAddDriverEntry|0x550b72fe
ntdll.dll.NtAddBootEntry|0x56046dfc
ntdll.dll.NtAddAtomEx|0x82032d67
ntdll.dll.NtAddAtom|0x9f98bb62
ntdll.dll.NtAcquireProcessActivityReference|0xb9c35b5b
ntdll.dll.NtAccessCheckByTypeResultListAndAuditAlarmByHandle|0x022d2379
ntdll.dll.NtAccessCheckByTypeResultListAndAuditAlarm|0x829bf084
ntdll.dll.NtAccessCheckByTypeResultList|0x2d1b1dbd
ntdll.dll.NtAccessCheckByTypeAndAuditAlarm|0xc96d01e6
ntdll.dll.NtAccessCheckByType|0xcf3de24b
ntdll.dll.NtAccessCheckAndAuditAlarm|0x98f287e4
ntdll.dll.NtAccessCheck|0xda49ddea
ntdll.dll.NtAcceptConnectPort|0x05b9ea1a
ntdll.dll.NlsMbOemCodePageTag|0x1eb48c53
ntdll.dll.NlsMbCodePageTag|0x37b57c0c
ntdll.dll.NlsAnsiCodePage|0x82b83b59
ntdll.dll.MD5Update|0x491ee328
ntdll.dll.MD5Init|0x9f4ecb4a
ntdll.dll.MD5Final|0x6bd4c833
ntdll.dll.MD4Update|0x491ee308
ntdll.dll.MD4Init|0x1f4ecb49
ntdll.dll.MD4Final|0x6bd0c833
ntdll.dll.LdrpResGetResourceDirectory|0x0e40244d
ntdll.dll.LdrpResGetMappingSize|0x3529fd20
ntdll.dll.LdrpChildNtdll|0x6775f728
ntdll.dll.LdrVerifyImageMatchesChecksumEx|0x8e7748fa
ntdll.dll.LdrVerifyImageMatchesChecksum|0xebca8bd0
ntdll.dll.LdrUpdatePackageSearchPath|0x0c417b9e
ntdll.dll.LdrUnregisterDllNotification|0x1b43d6f3
ntdll.dll.LdrUnlockLoaderLock|0x943bc6aa
ntdll.dll.LdrUnloadDll|0x3a872cdc
ntdll.dll.LdrUnloadAlternateResourceModuleEx|0x499a0f1b
ntdll.dll.LdrUnloadAlternateResourceModule|0x6eb716e9
ntdll.dll.LdrSystemDllInitBlock|0x9c7ec589
ntdll.dll.LdrStandardizeSystemPath|0x964e35b9
ntdll.dll.LdrShutdownThread|0xf9622b5b
ntdll.dll.LdrShutdownProcess|0x6abfd0ce
ntdll.dll.LdrSetMUICacheType|0x048733ef
ntdll.dll.LdrSetImplicitPathOptions|0xe93d7b25
ntdll.dll.LdrSetDllManifestProber|0x02ed6005
ntdll.dll.LdrSetDllDirectory|0xb94b3dc7
ntdll.dll.LdrSetDefaultDllDirectories|0xf71e292a
ntdll.dll.LdrSetAppCompatDllRedirectionCallback|0x8ee15f45
ntdll.dll.LdrRscIsTypeExist|0x494fb2ee
ntdll.dll.LdrResolveDelayLoadsFromDll|0x32c276bb
ntdll.dll.LdrResolveDelayLoadedAPI|0x3f9e25bc
ntdll.dll.LdrResSearchResource|0x29e3e9b3
ntdll.dll.LdrResRelease|0x1f43bcda
ntdll.dll.LdrResGetRCConfig|0x945c0bdf
ntdll.dll.LdrResFindResourceDirectory|0x2c899887
ntdll.dll.LdrResFindResource|0x075e488d
ntdll.dll.LdrRemoveLoadAsDataTable|0x52215edf
ntdll.dll.LdrRemoveDllDirectory|0x736d65d9
ntdll.dll.LdrRegisterDllNotification|0x8a7a5a2c
ntdll.dll.LdrQueryProcessModuleInformation|0x4e776fbf
ntdll.dll.LdrQueryOptionalDelayLoadedAPI|0x7175a9e8
ntdll.dll.LdrQueryModuleServiceTags|0xcf99b48d
ntdll.dll.LdrQueryImageFileKeyOption|0x1b315e64
ntdll.dll.LdrQueryImageFileExecutionOptionsEx|0x52ac52c7
ntdll.dll.LdrQueryImageFileExecutionOptions|0x1edb5ff7
ntdll.dll.LdrProcessRelocationBlockEx|0x062e562d
ntdll.dll.LdrProcessRelocationBlock|0xb9a96805
ntdll.dll.LdrParentRtlRetrieveNtUserPfn|0x23e21f4e
ntdll.dll.LdrParentRtlResetNtUserPfn|0x22ec6d1a
ntdll.dll.LdrParentRtlInitializeNtUserPfn|0x16aa94b6
ntdll.dll.LdrParentInterlockedPopEntrySList|0x46d0a12a
ntdll.dll.LdrOpenImageFileOptionsKey|0x09419599
ntdll.dll.LdrLockLoaderLock|0xfb49ad7a
ntdll.dll.LdrLoadEnclaveModule|0x4336e894
ntdll.dll.LdrLoadDll|0xbdbf9c13
ntdll.dll.LdrLoadAlternateResourceModuleEx|0x567bcbf5
ntdll.dll.LdrLoadAlternateResourceModule|0xd6ea9ddc
ntdll.dll.LdrIsModuleSxsRedirected|0x92cd9c74
ntdll.dll.LdrInitializeThunk|0x3f55e4bc
ntdll.dll.LdrInitializeEnclave|0x5ccd6e26
ntdll.dll.LdrInitShimEngineDynamic|0x0ffd17b5
ntdll.dll.LdrGetProcedureAddressForCaller|0x03926002
ntdll.dll.LdrGetProcedureAddressEx|0x5224c217
ntdll.dll.LdrGetProcedureAddress|0x5ed941b5
ntdll.dll.LdrGetFileNameFromLoadAsDataTable|0xd5ff5cd7
ntdll.dll.LdrGetFailureData|0xa4e2f0e9
ntdll.dll.LdrGetDllPath|0x60766b58
ntdll.dll.LdrGetDllHandleEx|0xc9897aab
ntdll.dll.LdrGetDllHandleByName|0x79f0db3f
ntdll.dll.LdrGetDllHandleByMapping|0x74499039
ntdll.dll.LdrGetDllHandle|0xb0b6d497
ntdll.dll.LdrGetDllFullName|0xbee7a72f
ntdll.dll.LdrGetDllDirectory|0x394b3dc5
ntdll.dll.LdrFlushAlternateResourceModules|0xd0a6442b
ntdll.dll.LdrFindResource_U|0x75ccb68c
ntdll.dll.LdrFindResourceEx_U|0x53e85e5d
ntdll.dll.LdrFindResourceDirectory_U|0xaee0d566
ntdll.dll.LdrFindEntryForAddress|0x15972443
ntdll.dll.LdrFastFailInLoaderCallout|0x5c45670f
ntdll.dll.LdrEnumerateLoadedModules|0xfed59027
ntdll.dll.LdrEnumResources|0xd2afbe32
ntdll.dll.LdrDisableThreadCalloutsForDll|0x6905443a
ntdll.dll.LdrDeleteEnclave|0xcdaa6c17
ntdll.dll.LdrCreateEnclave|0xcd1c6ce6
ntdll.dll.LdrControlFlowGuardEnforced|0x2c40878c
ntdll.dll.LdrCallEnclave|0x640b94da
ntdll.dll.LdrAppxHandleIntegrityFailure|0xea819693
ntdll.dll.LdrAddRefDll|0x3012abde
ntdll.dll.LdrAddLoadAsDataTable|0x2a1d1a86
ntdll.dll.LdrAddDllDirectory|0x714b39c5
ntdll.dll.LdrAccessResource|0x2c4831a2
ntdll.dll.KiUserExceptionDispatcher|0x5d4e05c7
ntdll.dll.KiUserCallbackDispatcher|0xa695f87b
ntdll.dll.KiUserApcDispatcher|0x62b31e90
ntdll.dll.KiRaiseUserExceptionDispatcher|0xce88770b
ntdll.dll.KiIntSystemCall|0x3dffe404
ntdll.dll.KiFastSystemCallRet|0xf9d19111
ntdll.dll.KiFastSystemCall|0x0a4a5858
ntdll.dll.EvtIntReportEventAndSourceAsync|0x77d5f087
ntdll.dll.EvtIntReportAuthzEventAndSourceAsync|0x4932928d
ntdll.dll.EtwpGetCpuSpeed|0xeca8b5db
ntdll.dll.EtwpCreateEtwThread|0x71ede28e
ntdll.dll.EtwWriteUMSecurityEvent|0x94f1d560
ntdll.dll.EtwUnregisterTraceGuids|0xc77a5043
ntdll.dll.EtwTraceMessageVa|0x4cb26bc1
ntdll.dll.EtwTraceMessage|0x06c6584a
ntdll.dll.EtwTraceEventInstance|0xc167fb29
ntdll.dll.EtwSetMark|0xbc8eae7b
ntdll.dll.EtwSendNotification|0xebd41322
ntdll.dll.EtwReplyNotification|0xa7266800
ntdll.dll.EtwRegisterTraceGuidsW|0x8a855889
ntdll.dll.EtwRegisterTraceGuidsA|0x89d55889
ntdll.dll.EtwRegisterSecurityProvider|0x45c9ea16
ntdll.dll.EtwProcessPrivateLoggerRequest|0x21b0d8c6
ntdll.dll.EtwNotificationUnregister|0x442a7f00
ntdll.dll.EtwNotificationRegister|0x1566d3ea
ntdll.dll.EtwLogTraceEvent|0x95ee1266
ntdll.dll.EtwGetTraceLoggerHandle|0x999a381b
ntdll.dll.EtwGetTraceEnableLevel|0x0d71b36b
ntdll.dll.EtwGetTraceEnableFlags|0xe3aa23e8
ntdll.dll.EtwEventWriteTransfer|0xa1d4e009
ntdll.dll.EtwEventWriteString|0x1e1dd0cd
ntdll.dll.EtwEventWriteStartScenario|0x4401ae05
ntdll.dll.EtwEventWriteNoRegistration|0xc530ff78
ntdll.dll.EtwEventWriteFull|0x3c227446
ntdll.dll.EtwEventWriteEx|0x1e9ab816
ntdll.dll.EtwEventWriteEndScenario|0xffb5ad24
ntdll.dll.EtwEventWrite|0x5e0b198d
ntdll.dll.EtwEventUnregister|0x42f1c003
ntdll.dll.EtwEventSetInformation|0xc604932e
ntdll.dll.EtwEventRegister|0x2161f0ee
ntdll.dll.EtwEventProviderEnabled|0xb85fc228
ntdll.dll.EtwEventEnabled|0x2be99dd2
ntdll.dll.EtwEventActivityIdControl|0x2c28c188
ntdll.dll.EtwEnumerateProcessRegGuids|0x0edea272
ntdll.dll.EtwDeliverDataBlock|0xf50f63f2
ntdll.dll.EtwCreateTraceInstanceId|0xb8db3b17
ntdll.dll.EtwCheckCoverage|0x2b3599c9
ntdll.dll.DbgUserBreakPoint|0x15b81ba5
ntdll.dll.DbgUiWaitStateChange|0x0228a7f8
ntdll.dll.DbgUiStopDebugging|0xd6757dba
ntdll.dll.DbgUiSetThreadDebugObject|0xae073784
ntdll.dll.DbgUiRemoteBreakin|0x9a1e9789
ntdll.dll.DbgUiIssueRemoteBreakin|0xf41edba2
ntdll.dll.DbgUiGetThreadDebugObject|0xee073783
ntdll.dll.DbgUiDebugActiveProcess|0x5e841756
ntdll.dll.DbgUiConvertStateChangeStructureEx|0x65e854d6
ntdll.dll.DbgUiConvertStateChangeStructure|0x5b285000
ntdll.dll.DbgUiContinue|0xc55220df
ntdll.dll.DbgUiConnectToDbg|0xc66df6d2
ntdll.dll.DbgSetDebugFilterState|0x9e581a67
ntdll.dll.DbgQueryDebugFilterState|0x8dd0031c
ntdll.dll.DbgPrompt|0x7f835069
ntdll.dll.DbgPrintReturnControlC|0x23ffc433
ntdll.dll.DbgPrintEx|0x132c22d5
ntdll.dll.DbgPrint|0x59dd5f38
ntdll.dll.DbgBreakPoint|0x1dbec548
ntdll.dll.CsrVerifyRegion|0x1527cbe7
ntdll.dll.CsrSetPriorityClass|0x9507f38a
ntdll.dll.CsrIdentifyAlertableThread|0xa89bc26f
ntdll.dll.CsrGetProcessId|0xb51bb838
ntdll.dll.CsrFreeCaptureBuffer|0x1090c7d8
ntdll.dll.CsrClientConnectToServer|0x43835be3
ntdll.dll.CsrClientCallServer|0xabed9ad1
ntdll.dll.CsrCaptureTimeout|0xb8c4348a
ntdll.dll.CsrCaptureMessageString|0xf89ec995
ntdll.dll.CsrCaptureMessageMultiUnicodeStringsInPlace|0x41721f30
ntdll.dll.CsrCaptureMessageBuffer|0x72b20756
ntdll.dll.CsrAllocateMessagePointer|0x2402e32e
ntdll.dll.CsrAllocateCaptureBuffer|0x8e407f8d
ntdll.dll.ApiSetQueryApiSetPresenceEx|0x5f0844be
ntdll.dll.ApiSetQueryApiSetPresence|0xfb0ccfbf
ntdll.dll.AlpcUnregisterCompletionListWorkerThread|0xa38fe148
ntdll.dll.AlpcUnregisterCompletionList|0xb9a3e9aa
ntdll.dll.AlpcRundownCompletionList|0x0200896d
ntdll.dll.AlpcRegisterCompletionListWorkerThread|0xcbd57bcc
ntdll.dll.AlpcRegisterCompletionList|0xfc284352
ntdll.dll.AlpcMaxAllowedMessageLength|0x34eb0021
ntdll.dll.AlpcInitializeMessageAttribute|0xa47373d8
ntdll.dll.AlpcGetOutstandingCompletionListMessageCount|0x5835a85c
ntdll.dll.AlpcGetMessageFromCompletionList|0x1f7aa351
ntdll.dll.AlpcGetMessageAttribute|0x8dc7d091
ntdll.dll.AlpcGetHeaderSize|0x9b342f01
ntdll.dll.AlpcGetCompletionListMessageAttributes|0x59ee3e7f
ntdll.dll.AlpcGetCompletionListLastMessageInformation|0xd0eec59d
ntdll.dll.AlpcFreeCompletionListMessage|0x417b6050
ntdll.dll.AlpcAdjustCompletionListConcurrencyCount|0x624f5337
ntdll.dll.A_SHAUpdate|0x0da114bf
ntdll.dll.A_SHAInit|0xfe60d410
ntdll.dll.A_SHAFinal|0xb207c0c3
kernel32.dll.timeGetTime|0x0f5be34f
kernel32.dll.timeGetSystemTime|0xe146e6e4
kernel32.dll.timeGetDevCaps|0xc32e6a78
kernel32.dll.timeEndPeriod|0xd1f28df7
kernel32.dll.timeBeginPeriod|0x491f4305
kernel32.dll.lstrlenW|0xcd3e00f4
kernel32.dll.lstrlenA|0xcc8e00f4
kernel32.dll.lstrlen|0x6ff25dd4
kernel32.dll.lstrcpynW|0x7c39a10c
kernel32.dll.lstrcpynA|0x7b89a10c
kernel32.dll.lstrcpyn|0xe3f573b4
kernel32.dll.lstrcpyW|0xe33d73b4
kernel32.dll.lstrcpyA|0xe28d73b4
kernel32.dll.lstrcpy|0x5e4a6094
kernel32.dll.lstrcmpiW|0x6a396fcc
kernel32.dll.lstrcmpiA|0x69896fcc
kernel32.dll.lstrcmpi|0xddcd7174
kernel32.dll.lstrcmpW|0xdd3d7174
kernel32.dll.lstrcmpA|0xdc8d7174
kernel32.dll.lstrcmp|0x5e025fd4
kernel32.dll.lstrcatW|0xc53d7274
kernel32.dll.lstrcatA|0xc48d7274
kernel32.dll.lstrcat|0x5e225cd4
kernel32.dll._lwrite|0xe98e5ff6
kernel32.dll._lread|0x61524f50
kernel32.dll._lopen|0x77a22050
kernel32.dll._llseek|0x61be6c30
kernel32.dll._lcreat|0xe2065b2c
kernel32.dll._lclose|0xf58dffac
kernel32.dll._hwrite|0xe97e5ff6
kernel32.dll._hread|0x61524f4e
kernel32.dll.ZombifyActCtxWorker|0xdb0ecaf5
kernel32.dll.ZombifyActCtx|0xb157d235
kernel32.dll.WriteTapemark|0x5a233eea
kernel32.dll.WriteProfileStringW|0x0f032393
kernel32.dll.WriteProfileStringA|0x0e532393
kernel32.dll.WriteProfileSectionW|0x8af6ad5f
kernel32.dll.WriteProfileSectionA|0x8a46ad5f
kernel32.dll.WriteProcessMemory|0xe7bdd8c5
kernel32.dll.WritePrivateProfileStructW|0xb8c23532
kernel32.dll.WritePrivateProfileStructA|0xb8123532
kernel32.dll.WritePrivateProfileStringW|0xcec171f2
kernel32.dll.WritePrivateProfileStringA|0xce1171f2
kernel32.dll.WritePrivateProfileSectionW|0xfdecab52
kernel32.dll.WritePrivateProfileSectionA|0xfd3cab52
kernel32.dll.WriteFileGather|0xe8b19448
kernel32.dll.WriteFileEx|0xd63f3d0c
kernel32.dll.WriteFile|0x5bae572d
kernel32.dll.WriteConsoleW|0x5e7b5d71
kernel32.dll.WriteConsoleOutputW|0x9ba16246
kernel32.dll.WriteConsoleOutputCharacterW|0xd451220f
kernel32.dll.WriteConsoleOutputCharacterA|0xd3a1220f
kernel32.dll.WriteConsoleOutputAttribute|0xe1ada4db
kernel32.dll.WriteConsoleOutputA|0x9af16246
kernel32.dll.WriteConsoleInputW|0x651c575d
kernel32.dll.WriteConsoleInputVDMW|0x250bf49b
kernel32.dll.WriteConsoleInputVDMA|0x245bf49b
kernel32.dll.WriteConsoleInputA|0x646c575d
kernel32.dll.WriteConsoleA|0x5dcb5d71
kernel32.dll.Wow64Transition|0x66dfd00f
kernel32.dll.Wow64SuspendThread|0xcfc75eba
kernel32.dll.Wow64SetThreadContext|0xcefacbbf
kernel32.dll.Wow64RevertWow64FsRedirection|0x606ae423
kernel32.dll.Wow64GetThreadSelectorEntry|0x17d6f338
kernel32.dll.Wow64GetThreadContext|0xceeecbbf
kernel32.dll.Wow64EnableWow64FsRedirection|0x018938cf
kernel32.dll.Wow64DisableWow64FsRedirection|0xdea8e84f
kernel32.dll.WinExec|0x876f8b31
kernel32.dll.WideCharToMultiByte|0xea7d21f4
kernel32.dll.WerpNotifyUseStringResourceWorker|0xf597cab8
kernel32.dll.WerpNotifyLoadStringResourceWorker|0x099643a7
kernel32.dll.WerpLaunchAeDebug|0xaad56d4f
kernel32.dll.WerpInitiateRemoteRecovery|0xe86f3562
kernel32.dll.WerpGetDebugger|0x8360e819
kernel32.dll.WerUnregisterRuntimeExceptionModuleWorker|0xc5edb49f
kernel32.dll.WerUnregisterRuntimeExceptionModule|0x6bc24cec
kernel32.dll.WerUnregisterMemoryBlockWorker|0x8766ffad
kernel32.dll.WerUnregisterMemoryBlock|0xbe85fd4b
kernel32.dll.WerUnregisterFileWorker|0xac8c5823
kernel32.dll.WerUnregisterFile|0x14a34694
kernel32.dll.WerUnregisterExcludedMemoryBlock|0x4c168013
kernel32.dll.WerUnregisterCustomMetadata|0x8d2be925
kernel32.dll.WerUnregisterAppLocalDump|0xab46aa92
kernel32.dll.WerUnregisterAdditionalProcess|0xe632866d
kernel32.dll.WerSetFlagsWorker|0xc817bcd4
kernel32.dll.WerSetFlags|0xedcf8d77
kernel32.dll.WerRegisterRuntimeExceptionModuleWorker|0x6128f940
kernel32.dll.WerRegisterRuntimeExceptionModule|0x3ceab3bb
kernel32.dll.WerRegisterMemoryBlockWorker|0x29b7cd4b
kernel32.dll.WerRegisterMemoryBlock|0xf1ed65df
kernel32.dll.WerRegisterFileWorker|0x999ede90
kernel32.dll.WerRegisterFile|0xb63e81d9
kernel32.dll.WerRegisterExcludedMemoryBlock|0xe049e77c
kernel32.dll.WerRegisterCustomMetadata|0xb592b7f7
kernel32.dll.WerRegisterAppLocalDump|0xefe845cd
kernel32.dll.WerRegisterAdditionalProcess|0x8883540a
kernel32.dll.WerGetFlagsWorker|0xc8178cd4
kernel32.dll.WerGetFlags|0xe1cf8d77
kernel32.dll.WakeConditionVariable|0x10d7adb7
kernel32.dll.WakeAllConditionVariable|0x1ebf0861
kernel32.dll.WaitNamedPipeW|0x956a3787
kernel32.dll.WaitNamedPipeA|0x94ba3787
kernel32.dll.WaitForThreadpoolWorkCallbacks|0xda3008f8
kernel32.dll.WaitForThreadpoolWaitCallbacks|0x1a1e081a
kernel32.dll.WaitForThreadpoolTimerCallbacks|0x4954349d
kernel32.dll.WaitForThreadpoolIoCallbacks|0x044c99d2
kernel32.dll.WaitForSingleObjectEx|0xf20b33cd
kernel32.dll.WaitForSingleObject|0x601d8708
kernel32.dll.WaitForMultipleObjectsEx|0xdeb6fdc4
kernel32.dll.WaitForMultipleObjects|0x3bd03630
kernel32.dll.WaitForDebugEventEx|0xf9d22a97
kernel32.dll.WaitForDebugEvent|0x883ca2e3
kernel32.dll.WaitCommEvent|0x7d5ebe4a
kernel32.dll.WTSGetActiveConsoleSessionId|0x5cf8faa4
kernel32.dll.VirtualUnlock|0x0249abff
kernel32.dll.VirtualQueryEx|0xebb6b9ab
kernel32.dll.VirtualQuery|0xd8043520
kernel32.dll.VirtualProtectEx|0xcd61b5a6
kernel32.dll.VirtualProtect|0xc38ae110
kernel32.dll.VirtualLock|0x2a3f8e8b
kernel32.dll.VirtualFreeEx|0xee753481
kernel32.dll.VirtualFree|0x300f2f0b
kernel32.dll.VirtualAllocExNuma|0xb6c95ce9
kernel32.dll.VirtualAllocEx|0x3f9287ae
kernel32.dll.VirtualAlloc|0xe553a458
kernel32.dll.VerifyVersionInfoW|0x3f675951
kernel32.dll.VerifyVersionInfoA|0x3eb75951
kernel32.dll.VerifyScripts|0x5cc104de
kernel32.dll.VerifyConsoleIoHandle|0x2ac5f275
kernel32.dll.VerSetConditionMask|0xa9bcdf98
kernel32.dll.VerLanguageNameW|0x5938c358
kernel32.dll.VerLanguageNameA|0x5888c358
kernel32.dll.VDMOperationStarted|0xf8e31b4c
kernel32.dll.VDMConsoleOperation|0xc58e64eb
kernel32.dll.UpdateResourceW|0x5516b4e9
kernel32.dll.UpdateResourceA|0x5466b4e9
kernel32.dll.UpdateProcThreadAttribute|0x51092608
kernel32.dll.UpdateCalendarDayOfWeek|0x2e8255b6
kernel32.dll.UnregisterWaitUntilOOBECompleted|0x995de07f
kernel32.dll.UnregisterWaitEx|0x187e3526
kernel32.dll.UnregisterWait|0xc4b7530e
kernel32.dll.UnregisterConsoleIME|0x1e6ab24c
kernel32.dll.UnregisterBadMemoryNotification|0xf3f9efc0
kernel32.dll.UnregisterApplicationRestart|0xd5cf713e
kernel32.dll.UnregisterApplicationRecoveryCallback|0x1cfa0759
kernel32.dll.UnmapViewOfFileEx|0x49d3393e
kernel32.dll.UnmapViewOfFile|0x257ca71e
kernel32.dll.UnlockFileEx|0x456d731a
kernel32.dll.UnlockFile|0x956b1006
kernel32.dll.UnhandledExceptionFilter|0x4a18ce54
kernel32.dll.UTUnRegister|0x928de254
kernel32.dll.UTRegister|0x91e50d04
kernel32.dll.TzSpecificLocalTimeToSystemTimeEx|0x1f50cf24
kernel32.dll.TzSpecificLocalTimeToSystemTime|0xbcd29d76
kernel32.dll.TrySubmitThreadpoolCallback|0xac068794
kernel32.dll.TryEnterCriticalSection|0x2340b582
kernel32.dll.TryAcquireSRWLockShared|0x7fbaaa64
kernel32.dll.TryAcquireSRWLockExclusive|0x8d99cbc9
kernel32.dll.TransmitCommChar|0xe32a988a
kernel32.dll.TransactNamedPipe|0x252c7186
kernel32.dll.Toolhelp32ReadProcessMemory|0x03cc6809
kernel32.dll.TlsSetValue|0xc358e901
kernel32.dll.TlsGetValue|0xb758e901
kernel32.dll.TlsFree|0xfb8b9ad4
kernel32.dll.TlsAlloc|0x439a003b
kernel32.dll.Thread32Next|0x42f34ed0
kernel32.dll.Thread32First|0x4a04d8b7
kernel32.dll.TermsrvSyncUserIniFileExt|0x490b2ec5
kernel32.dll.TermsrvSetValueKey|0x334b0324
kernel32.dll.TermsrvSetKeySecurity|0xdc0263bc
kernel32.dll.TermsrvRestoreKey|0x9c0f74b7
kernel32.dll.TermsrvOpenUserClasses|0x8096b699
kernel32.dll.TermsrvOpenRegEntry|0x47ad08c5
kernel32.dll.TermsrvGetWindowsDirectoryW|0x11838db4
kernel32.dll.TermsrvGetWindowsDirectoryA|0x10d38db4
kernel32.dll.TermsrvGetPreSetValue|0xa1ae83f0
kernel32.dll.TermsrvDeleteValue|0x03708975
kernel32.dll.TermsrvDeleteKey|0xeacd7d2f
kernel32.dll.TermsrvCreateRegEntry|0xb7bd4238
kernel32.dll.TermsrvConvertSysRootToUserDir|0xc59d07cc
kernel32.dll.TermsrvAppInstallMode|0xcdff96fa
kernel32.dll.TerminateThread|0x0efcfee5
kernel32.dll.TerminateProcess|0x5ecadc87
kernel32.dll.TerminateJobObject|0xfdefd96b
kernel32.dll.SystemTimeToTzSpecificLocalTimeEx|0x60819fba
kernel32.dll.SystemTimeToTzSpecificLocalTime|0x15d760b8
kernel32.dll.SystemTimeToFileTime|0x52014405
kernel32.dll.SwitchToThread|0xb192efd8
kernel32.dll.SwitchToFiber|0xee56ea4b
kernel32.dll.SuspendThread|0xf98f8b3b
kernel32.dll.SubmitThreadpoolWork|0x23811625
kernel32.dll.StartThreadpoolIo|0x2c371dd3
kernel32.dll.SortGetHandle|0x6e645f98
kernel32.dll.SortCloseHandle|0xeb895a11
kernel32.dll.SleepEx|0xf82582ad
kernel32.dll.SleepConditionVariableSRW|0x8ee91172
kernel32.dll.SleepConditionVariableCS|0xd20a320a
kernel32.dll.Sleep|0xe035f044
kernel32.dll.SizeofResource|0x42f9102e
kernel32.dll.SignalObjectAndWait|0x711420ea
kernel32.dll.ShowConsoleCursor|0x2c1bbd28
kernel32.dll.SetupComm|0xdaf208d3
kernel32.dll.SetXStateFeaturesMask|0x488df137
kernel32.dll.SetWaitableTimerEx|0x0b94715d
kernel32.dll.SetWaitableTimer|0xa083abff
kernel32.dll.SetVolumeMountPointWStub|0x5e72dd43
kernel32.dll.SetVolumeMountPointW|0x253d21c1
kernel32.dll.SetVolumeMountPointA|0x248d21c1
kernel32.dll.SetVolumeLabelW|0xe880a031
kernel32.dll.SetVolumeLabelA|0xe7d0a031
kernel32.dll.SetVDMCurrentDirectories|0x64a97a97
kernel32.dll.SetUserGeoName|0x3e9e968f
kernel32.dll.SetUserGeoID|0x686a332b
kernel32.dll.SetUnhandledExceptionFilter|0xea320efe
kernel32.dll.SetTimerQueueTimer|0xe377247c
kernel32.dll.SetTimeZoneInformation|0xab49a03e
kernel32.dll.SetThreadpoolWaitEx|0xbbb3b5a5
kernel32.dll.SetThreadpoolWait|0xbf442910
kernel32.dll.SetThreadpoolTimerEx|0xe6e761e1
kernel32.dll.SetThreadpoolTimer|0xaff0f7c1
kernel32.dll.SetThreadpoolThreadMinimum|0xbce887c3
kernel32.dll.SetThreadpoolThreadMaximum|0xbcc887c8
kernel32.dll.SetThreadpoolStackInformation|0xfa3cbb3c
kernel32.dll.SetThreadUILanguage|0xb2774cc1
kernel32.dll.SetThreadToken|0x05e30fbf
kernel32.dll.SetThreadStackGuarantee|0x56eb7b64
kernel32.dll.SetThreadSelectedCpuSets|0x83466acb
kernel32.dll.SetThreadPriorityBoost|0x42a98667
kernel32.dll.SetThreadPriority|0x2f55dc31
kernel32.dll.SetThreadPreferredUILanguages|0x66f5019a
kernel32.dll.SetThreadLocale|0x54e22ff9
kernel32.dll.SetThreadInformation|0x975a181b
kernel32.dll.SetThreadIdealProcessorEx|0x6fa56b57
kernel32.dll.SetThreadIdealProcessor|0x8a13efe6
kernel32.dll.SetThreadGroupAffinity|0x0a1164fc
kernel32.dll.SetThreadExecutionState|0xa6dd1120
kernel32.dll.SetThreadErrorMode|0xb691dff0
kernel32.dll.SetThreadDescription|0xcb408020
kernel32.dll.SetThreadContext|0xd14e5c18
kernel32.dll.SetThreadAffinityMask|0x00494c74
kernel32.dll.SetTermsrvAppInstallMode|0xda9febca
kernel32.dll.SetTapePosition|0xd4b94216
kernel32.dll.SetTapeParameters|0x05b5e168
kernel32.dll.SetSystemTimeAdjustment|0x39307f5c
kernel32.dll.SetSystemTime|0x46dc4f36
kernel32.dll.SetSystemPowerState|0xc51974b8
kernel32.dll.SetSystemFileCacheSize|0xad3f6f8f
kernel32.dll.SetStdHandleEx|0xdd5867ca
kernel32.dll.SetStdHandle|0x53cabbd8
kernel32.dll.SetSearchPathMode|0x3979a0fe
kernel32.dll.SetProtectedPolicy|0x5c416edd
kernel32.dll.SetProcessWorkingSetSizeEx|0x9c87c0f1
kernel32.dll.SetProcessWorkingSetSize|0xeec7793d
kernel32.dll.SetProcessShutdownParameters|0xe4f8fce0
kernel32.dll.SetProcessPriorityBoost|0x4ed17e37
kernel32.dll.SetProcessPreferredUILanguages|0xebf3fb9c
kernel32.dll.SetProcessMitigationPolicy|0x2d5f9f96
kernel32.dll.SetProcessInformation|0xd78ab7fa
kernel32.dll.SetProcessDefaultCpuSets|0x6f4f1900
kernel32.dll.SetProcessDEPPolicy|0x7ab885ed
kernel32.dll.SetProcessAffinityUpdateMode|0xc32a2920
kernel32.dll.SetProcessAffinityMask|0xff434df9
kernel32.dll.SetPriorityClass|0xcc5c6985
kernel32.dll.SetNamedPipeHandleState|0xbc4662b8
kernel32.dll.SetNamedPipeAttribute|0xe2a06c54
kernel32.dll.SetMessageWaitingIndicator|0x04cfbcc9
kernel32.dll.SetMailslotInfo|0xc1aec70a
kernel32.dll.SetLocaleInfoW|0x371e8b9b
kernel32.dll.SetLocaleInfoA|0x366e8b9b
kernel32.dll.SetLocalTime|0xd92ce3fe
kernel32.dll.SetLocalPrimaryComputerNameW|0xd41a38ba
kernel32.dll.SetLocalPrimaryComputerNameA|0xd36a38ba
kernel32.dll.SetLastError|0x5de2c66a
kernel32.dll.SetLastConsoleEventActive|0x55513f3a
kernel32.dll.SetIoRateControlInformationJobObject|0xaaa093f9
kernel32.dll.SetInformationJobObject|0xe00097d6
kernel32.dll.SetHandleInformation|0x1cd313ca
kernel32.dll.SetHandleCount|0xd8fef355
kernel32.dll.SetHandleContext|0x8c46b3a7
kernel32.dll.SetFirmwareEnvironmentVariableW|0xe23ebff2
kernel32.dll.SetFirmwareEnvironmentVariableExW|0x55517aed
kernel32.dll.SetFirmwareEnvironmentVariableExA|0x54a17aed
kernel32.dll.SetFirmwareEnvironmentVariableA|0xe18ebff2
kernel32.dll.SetFileValidData|0xbe8f0843
kernel32.dll.SetFileTime|0x70361f86
kernel32.dll.SetFileShortNameW|0x55f0affd
kernel32.dll.SetFileShortNameA|0x5540affd
kernel32.dll.SetFilePointerEx|0xef5cdc2b
kernel32.dll.SetFilePointer|0xd812cdaa
kernel32.dll.SetFileIoOverlappedRange|0xed3ddbc5
kernel32.dll.SetFileInformationByHandle|0xef501773
kernel32.dll.SetFileCompletionNotificationModes|0x0c1896a2
kernel32.dll.SetFileBandwidthReservation|0xd30b7d30
kernel32.dll.SetFileAttributesW|0x5eb1ce93
kernel32.dll.SetFileAttributesTransactedW|0x41f03477
kernel32.dll.SetFileAttributesTransactedA|0x41403477
kernel32.dll.SetFileAttributesA|0x5e01ce93
kernel32.dll.SetFileApisToOEM|0xa919041b
kernel32.dll.SetFileApisToANSI|0x10feeba9
kernel32.dll.SetEventWhenCallbackReturns|0xc72a6823
kernel32.dll.SetEvent|0x35269f1d
kernel32.dll.SetErrorMode|0xe8643ba1
kernel32.dll.SetEnvironmentVariableW|0xdffeade7
kernel32.dll.SetEnvironmentVariableA|0xdf4eade7
kernel32.dll.SetEnvironmentStringsW|0x8c21944c
kernel32.dll.SetEnvironmentStringsA|0x8b71944c
kernel32.dll.SetEndOfFile|0xd7e3cbdb
kernel32.dll.SetDynamicTimeZoneInformation|0x75cd3910
kernel32.dll.SetDllDirectoryW|0xb02a50d3
kernel32.dll.SetDllDirectoryA|0xaf7a50d3
kernel32.dll.SetDefaultDllDirectories|0xbb1a281a
kernel32.dll.SetDefaultCommConfigW|0x4e4547c8
kernel32.dll.SetDefaultCommConfigA|0x4d9547c8
kernel32.dll.SetCurrentDirectoryW|0xaddd1512
kernel32.dll.SetCurrentDirectoryA|0xad2d1512
kernel32.dll.SetCurrentConsoleFontEx|0x656f5335
kernel32.dll.SetCriticalSectionSpinCount|0x2417a909
kernel32.dll.SetConsoleWindowInfo|0x67a6b417
kernel32.dll.SetConsoleTitleW|0xdd72cc09
kernel32.dll.SetConsoleTitleA|0xdcc2cc09
kernel32.dll.SetConsoleTextAttribute|0x7722e83a
kernel32.dll.SetConsoleScreenBufferSize|0x5ed1ffaf
kernel32.dll.SetConsoleScreenBufferInfoEx|0x33001d8f
kernel32.dll.SetConsolePalette|0x5d3103b3
kernel32.dll.SetConsoleOutputCP|0x7b1d74ee
kernel32.dll.SetConsoleOS2OemFormat|0x45fe94c0
kernel32.dll.SetConsoleNumberOfCommandsW|0x592ca88b
kernel32.dll.SetConsoleNumberOfCommandsA|0x587ca88b
kernel32.dll.SetConsoleNlsMode|0xd35b7f77
kernel32.dll.SetConsoleMode|0x5b96d149
kernel32.dll.SetConsoleMenuClose|0xce91d234
kernel32.dll.SetConsoleMaximumWindowSize|0x06cc455c
kernel32.dll.SetConsoleLocalEUDC|0x232f4d28
kernel32.dll.SetConsoleKeyShortcuts|0x99c9c995
kernel32.dll.SetConsoleInputExeNameW|0xf1f06d7d
kernel32.dll.SetConsoleInputExeNameA|0xf1406d7d
kernel32.dll.SetConsoleIcon|0x43de9409
kernel32.dll.SetConsoleHistoryInfo|0x9fe1946f
kernel32.dll.SetConsoleHardwareState|0x35e5b7ab
kernel32.dll.SetConsoleFont|0x5c0e63c9
kernel32.dll.SetConsoleDisplayMode|0x9d45d38f
kernel32.dll.SetConsoleCursorPosition|0xef4bd847
kernel32.dll.SetConsoleCursorMode|0xed575570
kernel32.dll.SetConsoleCursorInfo|0xeba715f0
kernel32.dll.SetConsoleCursor|0xec06ae8f
kernel32.dll.SetConsoleCtrlHandler|0xd3ad374c
kernel32.dll.SetConsoleCP|0x50ce12df
kernel32.dll.SetConsoleActiveScreenBuffer|0x17926226
kernel32.dll.SetComputerNameW|0xa7e7cbfb
kernel32.dll.SetComputerNameExW|0xbf947d1f
kernel32.dll.SetComputerNameExA|0xbee47d1f
kernel32.dll.SetComputerNameEx2W|0xc79074c5
kernel32.dll.SetComputerNameA|0xa737cbfb
kernel32.dll.SetCommTimeouts|0x30e53183
kernel32.dll.SetCommState|0x495e9ef1
kernel32.dll.SetCommMask|0x5d69b1ca
kernel32.dll.SetCommConfig|0x3a659d53
kernel32.dll.SetCommBreak|0xd18e7a29
kernel32.dll.SetComPlusPackageInstallStatus|0xd33b7f1b
kernel32.dll.SetCalendarInfoW|0x49e66515
kernel32.dll.SetCalendarInfoA|0x49366515
kernel32.dll.SetCachedSigningLevel|0x40d60266
kernel32.dll.SearchPathW|0x31b6557c
kernel32.dll.SearchPathA|0x3106557c
kernel32.dll.ScrollConsoleScreenBufferW|0x2bc57374
kernel32.dll.ScrollConsoleScreenBufferA|0x2b157374
kernel32.dll.RtlZeroMemory|0x118d40c4
kernel32.dll.RtlUnwind|0xdd2d4012
kernel32.dll.RtlPcToFileHeader|0x7e3bdcdc
kernel32.dll.RtlMoveMemory|0xd58d8f81
kernel32.dll.RtlFillMemory|0x0b8d605f
kernel32.dll.RtlCaptureStackBackTrace|0x916875ba
kernel32.dll.RtlCaptureContext|0xb8f3232d
kernel32.dll.ResumeThread|0x8ef4092b
kernel32.dll.RestoreLastError|0x78509433
kernel32.dll.ResolveLocaleName|0xd3c05c7f
kernel32.dll.ResolveDelayLoadsFromDll|0xf6be75ab
kernel32.dll.ResolveDelayLoadedAPI|0x8732d77e
kernel32.dll.ResizePseudoConsole|0xa712cd67
kernel32.dll.ResetWriteWatch|0xa2f678b7
kernel32.dll.ResetEvent|0xd529c732
kernel32.dll.RequestWakeupLatency|0xed02d53a
kernel32.dll.RequestDeviceWakeup|0xb916b0de
kernel32.dll.ReplacePartitionUnit|0xad5b3e11
kernel32.dll.ReplaceFileW|0xd0cf31da
kernel32.dll.ReplaceFileA|0xd01f31da
kernel32.dll.ReplaceFile|0x960f1e47
kernel32.dll.RemoveVectoredExceptionHandler|0xde847691
kernel32.dll.RemoveVectoredContinueHandler|0x0ae39657
kernel32.dll.RemoveSecureMemoryCacheCallback|0xa86529dc
kernel32.dll.RemoveLocalAlternateComputerNameW|0xcf365b7a
kernel32.dll.RemoveLocalAlternateComputerNameA|0xce865b7a
kernel32.dll.RemoveDllDirectory|0x875b815d
kernel32.dll.RemoveDirectoryW|0xc59b3573
kernel32.dll.RemoveDirectoryTransactedW|0x1baa8e2f
kernel32.dll.RemoveDirectoryTransactedA|0x1afa8e2f
kernel32.dll.RemoveDirectoryA|0xc4eb3573
kernel32.dll.ReleaseSemaphoreWhenCallbackReturns|0xb60aff95
kernel32.dll.ReleaseSemaphore|0xee1e0f69
kernel32.dll.ReleaseSRWLockShared|0xa3b62c1e
kernel32.dll.ReleaseSRWLockExclusive|0xffe1c2cd
kernel32.dll.ReleaseMutexWhenCallbackReturns|0x2963e67c
kernel32.dll.ReleaseMutex|0x61d7bbdc
kernel32.dll.ReleaseActCtxWorker|0xce91eeec
kernel32.dll.ReleaseActCtx|0x7a558f15
kernel32.dll.RegisterWowExec|0xedf24dee
kernel32.dll.RegisterWowBaseHandlers|0x3e3352b7
kernel32.dll.RegisterWaitUntilOOBECompleted|0x19502029
kernel32.dll.RegisterWaitForSingleObjectEx|0x9d161367
kernel32.dll.RegisterWaitForSingleObject|0xc6c9b287
kernel32.dll.RegisterWaitForInputIdle|0xfefe7fd1
kernel32.dll.RegisterConsoleVDM|0xe0a9d407
kernel32.dll.RegisterConsoleOS2|0xd1d1d7c7
kernel32.dll.RegisterConsoleIME|0xc669d647
kernel32.dll.RegisterBadMemoryNotification|0x3bef3fbe
kernel32.dll.RegisterApplicationRestart|0xd0777062
kernel32.dll.RegisterApplicationRecoveryCallback|0x5cf3272e
kernel32.dll.RegUnLoadKeyW|0x16c16992
kernel32.dll.RegUnLoadKeyA|0x16116992
kernel32.dll.RegSetValueExW|0x6a487fbe
kernel32.dll.RegSetValueExA|0x69987fbe
kernel32.dll.RegSetKeySecurity|0x908a7eab
kernel32.dll.RegSaveKeyExW|0x006be012
kernel32.dll.RegSaveKeyExA|0xffbbe012
kernel32.dll.RegRestoreKeyW|0xc85cd9b7
kernel32.dll.RegRestoreKeyA|0xc7acd9b7
kernel32.dll.RegQueryValueExW|0x40befcae
kernel32.dll.RegQueryValueExA|0x400efcae
kernel32.dll.RegQueryInfoKeyW|0x73a55e8b
kernel32.dll.RegQueryInfoKeyA|0x72f55e8b
kernel32.dll.RegOpenUserClassesRoot|0xc8945ef1
kernel32.dll.RegOpenKeyExW|0xef6c5931
kernel32.dll.RegOpenKeyExA|0xeebc5931
kernel32.dll.RegOpenCurrentUser|0x57eee724
kernel32.dll.RegNotifyChangeKeyValue|0xd77bee00
kernel32.dll.RegLoadMUIStringW|0x14eeabf4
kernel32.dll.RegLoadMUIStringA|0x143eabf4
kernel32.dll.RegLoadKeyW|0xed972b46
kernel32.dll.RegLoadKeyA|0xece72b46
kernel32.dll.RegGetValueW|0x26923c05
kernel32.dll.RegGetValueA|0x25e23c05
kernel32.dll.RegGetKeySecurity|0x908a4eab
kernel32.dll.RegFlushKey|0x34f8f5ed
kernel32.dll.RegEnumValueW|0xdf97744d
kernel32.dll.RegEnumValueA|0xdee7744d
kernel32.dll.RegEnumKeyExW|0x7f6c490e
kernel32.dll.RegEnumKeyExA|0x7ebc490e
kernel32.dll.RegDisablePredefinedCacheEx|0x186d502e
kernel32.dll.RegDeleteValueW|0xe914bd51
kernel32.dll.RegDeleteValueA|0xe864bd51
kernel32.dll.RegDeleteTreeW|0x390f0d4e
kernel32.dll.RegDeleteTreeA|0x385f0d4e
kernel32.dll.RegDeleteKeyExW|0x88e99212
kernel32.dll.RegDeleteKeyExA|0x88399212
kernel32.dll.RegCreateKeyExW|0xc9037201
kernel32.dll.RegCreateKeyExA|0xc8537201
kernel32.dll.RegCopyTreeW|0x911e7b7e
kernel32.dll.RegCloseKey|0x31e0c5ed
kernel32.dll.ReclaimVirtualMemory|0xdbbd412d
kernel32.dll.ReadThreadProfilingData|0x732c8d9e
kernel32.dll.ReadProcessMemory|0x71f9d3c2
kernel32.dll.ReadFileScatter|0x15e37510
kernel32.dll.ReadFileEx|0xc2911ce4
kernel32.dll.ReadFile|0xbb5f9ead
kernel32.dll.ReadDirectoryChangesW|0xffe7d863
kernel32.dll.ReadDirectoryChangesExW|0xbf979735
kernel32.dll.ReadConsoleW|0x72f3536c
kernel32.dll.ReadConsoleOutputW|0x738db425
kernel32.dll.ReadConsoleOutputCharacterW|0x36e020ce
kernel32.dll.ReadConsoleOutputCharacterA|0x363020ce
kernel32.dll.ReadConsoleOutputAttribute|0xc185912d
kernel32.dll.ReadConsoleOutputA|0x72ddb425
kernel32.dll.ReadConsoleInputW|0xef58525b
kernel32.dll.ReadConsoleInputExW|0x9bb61531
kernel32.dll.ReadConsoleInputExA|0x9b061531
kernel32.dll.ReadConsoleInputA|0xeea8525b
kernel32.dll.ReadConsoleA|0x7243536c
kernel32.dll.ReOpenFile|0x3872c826
kernel32.dll.RaiseInvalid16BitExeError|0x05235720
kernel32.dll.RaiseFailFastException|0xcf76c6ec
kernel32.dll.RaiseException|0x5323f5dc
kernel32.dll.QuirkIsEnabledWorker|0x40957d69
kernel32.dll.QuirkIsEnabledForProcessWorker|0xfe88213f
kernel32.dll.QuirkIsEnabledForPackageWorker|0xf26ffe71
kernel32.dll.QuirkIsEnabledForPackage4Worker|0x5e9a7d3f
kernel32.dll.QuirkIsEnabledForPackage3Worker|0x5e9a7d1f
kernel32.dll.QuirkIsEnabledForPackage2Worker|0x5e9a7cff
kernel32.dll.QuirkIsEnabled3Worker|0x565cee4b
kernel32.dll.QuirkIsEnabled2Worker|0x565cee2b
kernel32.dll.QuirkGetDataWorker|0xdab81a8a
kernel32.dll.QuirkGetData2Worker|0x3f61bf40
kernel32.dll.QueueUserWorkItem|0x6ac43a2e
kernel32.dll.QueueUserAPC|0x3e8802d6
kernel32.dll.QueryUnbiasedInterruptTime|0x923c95f1
kernel32.dll.QueryThreadpoolStackInformation|0xcf16e448
kernel32.dll.QueryThreadProfiling|0x3f061478
kernel32.dll.QueryThreadCycleTime|0x460c2ab6
kernel32.dll.QueryProtectedPolicy|0x70c7594a
kernel32.dll.QueryProcessCycleTime|0x01efa6f8
kernel32.dll.QueryProcessAffinityUpdateMode|0x084ba3bb
kernel32.dll.QueryPerformanceFrequency|0xc9583b7d
kernel32.dll.QueryPerformanceCounter|0x1d8e6ab1
kernel32.dll.QueryMemoryResourceNotification|0x11a5a8b3
kernel32.dll.QueryIoRateControlInformationJobObject|0x45e5b573
kernel32.dll.QueryInformationJobObject|0x6a438d0c
kernel32.dll.QueryIdleProcessorCycleTimeEx|0x1e164b57
kernel32.dll.QueryIdleProcessorCycleTime|0x88cdb366
kernel32.dll.QueryFullProcessImageNameW|0x4756c9e1
kernel32.dll.QueryFullProcessImageNameA|0x46a6c9e1
kernel32.dll.QueryDosDeviceW|0x23791c11
kernel32.dll.QueryDosDeviceA|0x22c91c11
kernel32.dll.QueryDepthSList|0xad6b0580
kernel32.dll.QueryActCtxWWorker|0x9bb4e92a
kernel32.dll.QueryActCtxW|0x38e5025e
kernel32.dll.QueryActCtxSettingsWWorker|0x73274126
kernel32.dll.QueryActCtxSettingsW|0xcee4383b
kernel32.dll.PurgeComm|0x6ab9f08d
kernel32.dll.PulseEvent|0x4dee48f1
kernel32.dll.PssWalkSnapshot|0xf5219a28
kernel32.dll.PssWalkMarkerTell|0xa575ecd6
kernel32.dll.PssWalkMarkerSetPosition|0x26cb8031
kernel32.dll.PssWalkMarkerSeekToBeginning|0x17b4550b
kernel32.dll.PssWalkMarkerSeek|0xa56ddb16
kernel32.dll.PssWalkMarkerRewind|0x417d615e
kernel32.dll.PssWalkMarkerGetPosition|0x26b38031
kernel32.dll.PssWalkMarkerFree|0xbf3d0b16
kernel32.dll.PssWalkMarkerCreate|0xb14842e5
kernel32.dll.PssQuerySnapshot|0xc47a0c0e
kernel32.dll.PssFreeSnapshot|0x35436916
kernel32.dll.PssDuplicateSnapshot|0x0d573713
kernel32.dll.PssCaptureSnapshot|0xe83c2790
kernel32.dll.ProcessIdToSessionId|0xb9f47937
kernel32.dll.Process32NextW|0x7300696b
kernel32.dll.Process32Next|0xbd01528d
kernel32.dll.Process32FirstW|0x27d5c0a6
kernel32.dll.Process32First|0x67e8a927
kernel32.dll.PrivMoveFileIdentityW|0x4519891c
kernel32.dll.PrivCopyFileExW|0x8f1cdd56
kernel32.dll.PrepareTape|0xca47a74a
kernel32.dll.PrefetchVirtualMemory|0x1cb82cf6
kernel32.dll.PowerSetRequest|0x52537882
kernel32.dll.PowerCreateRequest|0x5db100d0
kernel32.dll.PowerClearRequest|0xae3630ec
kernel32.dll.PostQueuedCompletionStatus|0xf7bb366e
kernel32.dll.PeekNamedPipe|0xb33cb718
kernel32.dll.PeekConsoleInputW|0x6f586e4b
kernel32.dll.PeekConsoleInputA|0x6ea86e4b
kernel32.dll.ParseApplicationUserModelId|0x1152e5bf
kernel32.dll.PackageNameAndPublisherIdFromFamilyName|0x5551386d
kernel32.dll.PackageIdFromFullName|0x5dc47a87
kernel32.dll.PackageFullNameFromId|0x649a15e2
kernel32.dll.PackageFamilyNameFromId|0x879d2f86
kernel32.dll.PackageFamilyNameFromFullName|0xb93fe829
kernel32.dll.OutputDebugStringW|0xa9414f43
kernel32.dll.OutputDebugStringA|0xa8914f43
kernel32.dll.OpenWaitableTimerW|0x924f8665
kernel32.dll.OpenWaitableTimerA|0x919f8665
kernel32.dll.OpenThreadToken|0xe5e38369
kernel32.dll.OpenThread|0x8629dd22
kernel32.dll.OpenStateExplicit|0x6dccba32
kernel32.dll.OpenState|0x4998f8a4
kernel32.dll.OpenSemaphoreW|0xe10e96d4
kernel32.dll.OpenSemaphoreA|0xe05e96d4
kernel32.dll.OpenProfileUserMapping|0xf6c8ef7f
kernel32.dll.OpenProcessToken|0xcb29dfcf
kernel32.dll.OpenProcess|0x50b695ee
kernel32.dll.OpenPrivateNamespaceW|0xb7a280db
kernel32.dll.OpenPrivateNamespaceA|0xb6f280db
kernel32.dll.OpenPackageInfoByFullName|0xa75f4e37
kernel32.dll.OpenMutexW|0x05a602e9
kernel32.dll.OpenMutexA|0x04f602e9
kernel32.dll.OpenJobObjectW|0x77d64852
kernel32.dll.OpenJobObjectA|0x77264852
kernel32.dll.OpenFileMappingW|0xf8538d7c
kernel32.dll.OpenFileMappingA|0xf7a38d7c
kernel32.dll.OpenFileById|0x9066cb76
kernel32.dll.OpenFile|0xb86fa012
kernel32.dll.OpenEventW|0x978511ea
kernel32.dll.OpenEventA|0x96d511ea
kernel32.dll.OpenConsoleWStub|0x268aa220
kernel32.dll.OpenConsoleW|0x7309a33d
kernel32.dll.OfferVirtualMemory|0x36c18af7
kernel32.dll.OOBEComplete|0x25322ef3
kernel32.dll.NtVdm64CreateProcessInternalW|0xdccf4ef9
kernel32.dll.NotifyUILanguageChange|0xc548e37d
kernel32.dll.NotifyMountMgr|0x3771860b
kernel32.dll.NormalizeString|0xdd016a2a
kernel32.dll.NlsWriteEtwEvent|0xd3d79c48
kernel32.dll.NlsUpdateSystemLocale|0x2750ce92
kernel32.dll.NlsUpdateLocale|0x47722c25
kernel32.dll.NlsGetCacheUpdateCount|0x01527654
kernel32.dll.NlsEventDataDescCreate|0xcb545e3b
kernel32.dll.NlsCheckPolicy|0x8348647c
kernel32.dll.NeedCurrentDirectoryForExePathW|0xd1b81fad
kernel32.dll.NeedCurrentDirectoryForExePathA|0xd1081fad
kernel32.dll.MultiByteToWideChar|0xb9d69130
kernel32.dll.MulDiv|0x9f99f155
kernel32.dll.MoveFileWithProgressW|0xa5461aa3
kernel32.dll.MoveFileWithProgressA|0xa4961aa3
kernel32.dll.MoveFileW|0xde0436fe
kernel32.dll.MoveFileTransactedW|0xe1c4ce92
kernel32.dll.MoveFileTransactedA|0xe114ce92
kernel32.dll.MoveFileExW|0x46af3dec
kernel32.dll.MoveFileExA|0x45ff3dec
kernel32.dll.MoveFileA|0xdd5436fe
kernel32.dll.Module32NextW|0x5280f16f
kernel32.dll.Module32Next|0xce01ce7d
kernel32.dll.Module32FirstW|0x67f4bcaa
kernel32.dll.Module32First|0x4769312b
kernel32.dll.MapViewOfFileFromApp|0xf379130e
kernel32.dll.MapViewOfFileExNuma|0xe1b79d86
kernel32.dll.MapViewOfFileEx|0x49653692
kernel32.dll.MapViewOfFile|0x757aef13
kernel32.dll.MapUserPhysicalPagesScatter|0x76f496a0
kernel32.dll.MapUserPhysicalPages|0x3e6827b9
kernel32.dll.LockResource|0x0e8be94b
kernel32.dll.LockFileEx|0x44916dc2
kernel32.dll.LockFile|0x35679ff0
kernel32.dll.LocateXStateFeature|0x6f8150ba
kernel32.dll.LocaleNameToLCID|0x9abe90d4
kernel32.dll.LocalUnlock|0x96fd156e
kernel32.dll.LocalSystemTimeToLocalFileTime|0xdddb8105
kernel32.dll.LocalSize|0xd862d1f1
kernel32.dll.LocalShrink|0x8af5782a
kernel32.dll.LocalReAlloc|0x1c4309d4
kernel32.dll.LocalLock|0xe4925c31
kernel32.dll.LocalHandle|0x009937a7
kernel32.dll.LocalFree|0xea61fcb1
kernel32.dll.LocalFlags|0xbd0174f1
kernel32.dll.LocalFileTimeToLocalSystemTime|0xec738a80
kernel32.dll.LocalFileTimeToFileTime|0x3079ab69
kernel32.dll.LocalCompact|0x06f3450a
kernel32.dll.LocalAlloc|0x528176ee
kernel32.dll.LoadStringBaseW|0x9734a063
kernel32.dll.LoadStringBaseExW|0x92c9971b
kernel32.dll.LoadResource|0x8e8bb14a
kernel32.dll.LoadPackagedLibrary|0xcc8daae8
kernel32.dll.LoadModule|0x6214f6a5
kernel32.dll.LoadLibraryW|0x07d6774c
kernel32.dll.LoadLibraryExW|0xbb3f5177
kernel32.dll.LoadLibraryExA|0xba8f5177
kernel32.dll.LoadLibraryA|0x0726774c
kernel32.dll.LoadEnclaveData|0x76a25a92
kernel32.dll.LoadAppInitDlls|0x69f6c23a
kernel32.dll.LeaveCriticalSectionWhenCallbackReturns|0xe830b2c0
kernel32.dll.LeaveCriticalSection|0x83b72242
kernel32.dll.LZStart|0xd9be7d04
kernel32.dll.LZSeek|0x613c6047
kernel32.dll.LZRead|0x61044f47
kernel32.dll.LZOpenFileW|0x5fc044f4
kernel32.dll.LZOpenFileA|0x5f1044f4
kernel32.dll.LZInit|0x7383c147
kernel32.dll.LZDone|0x750b7287
kernel32.dll.LZCreateFileW|0x768afc7a
kernel32.dll.LZCopy|0x75ab6307
kernel32.dll.LZCloseFile|0xd641b804
kernel32.dll.LZClose|0xf545fd3c
kernel32.dll.LCMapStringW|0x23c6d807
kernel32.dll.LCMapStringEx|0x9fdb9b18
kernel32.dll.LCMapStringA|0x2316d807
kernel32.dll.LCIDToLocaleName|0xbfbabfc9
kernel32.dll.K32QueryWorkingSetEx|0x836a142a
kernel32.dll.K32QueryWorkingSet|0xd663028a
kernel32.dll.K32InitializeProcessForWsWatch|0x33715c17
kernel32.dll.K32GetWsChangesEx|0x9991c22a
kernel32.dll.K32GetWsChanges|0xd2bba142
kernel32.dll.K32GetProcessMemoryInfo|0x4b4a5719
kernel32.dll.K32GetProcessImageFileNameW|0x875b9290
kernel32.dll.K32GetProcessImageFileNameA|0x86ab9290
kernel32.dll.K32GetPerformanceInfo|0x50f4b7ff
kernel32.dll.K32GetModuleInformation|0x265a58bc
kernel32.dll.K32GetModuleFileNameExW|0x936b9681
kernel32.dll.K32GetModuleFileNameExA|0x92bb9681
kernel32.dll.K32GetModuleBaseNameW|0x27370940
kernel32.dll.K32GetModuleBaseNameA|0x26870940
kernel32.dll.K32GetMappedFileNameW|0xf528f010
kernel32.dll.K32GetMappedFileNameA|0xf478f010
kernel32.dll.K32GetDeviceDriverFileNameW|0x16c445cd
kernel32.dll.K32GetDeviceDriverFileNameA|0x161445cd
kernel32.dll.K32GetDeviceDriverBaseNameW|0x0ec426ad
kernel32.dll.K32GetDeviceDriverBaseNameA|0x0e1426ad
kernel32.dll.K32EnumProcesses|0x3392bd2f
kernel32.dll.K32EnumProcessModulesEx|0x96bd8f85
kernel32.dll.K32EnumProcessModules|0x3eb05077
kernel32.dll.K32EnumPageFilesW|0xbf972632
kernel32.dll.K32EnumPageFilesA|0xbee72632
kernel32.dll.K32EnumDeviceDrivers|0x06f5d6b5
kernel32.dll.K32EmptyWorkingSet|0x5be2e2a8
kernel32.dll.IsWow64Process2|0x18730513
kernel32.dll.IsWow64Process|0x10764760
kernel32.dll.IsWow64GuestMachineSupported|0xfa0e0f69
kernel32.dll.IsValidNLSVersion|0x33f95a8a
kernel32.dll.IsValidLocaleName|0x33cc2363
kernel32.dll.IsValidLocale|0xa73cd5db
kernel32.dll.IsValidLanguageGroup|0x03988862
kernel32.dll.IsValidCodePage|0xa84930e1
kernel32.dll.IsValidCalDateTime|0xd54d986a
kernel32.dll.IsThreadpoolTimerSet|0x4a6031da
kernel32.dll.IsThreadAFiber|0x769e1e1a
kernel32.dll.IsSystemResumeAutomatic|0xe59e5e41
kernel32.dll.IsProcessorFeaturePresent|0x99f2dd32
kernel32.dll.IsProcessInJob|0x0afa623b
kernel32.dll.IsProcessCritical|0x997c3634
kernel32.dll.IsNormalizedString|0x382600e5
kernel32.dll.IsNativeVhdBoot|0x62e0dfc0
kernel32.dll.IsNLSDefinedString|0xc3992521
kernel32.dll.IsEnclaveTypeSupported|0x08d5f293
kernel32.dll.IsDebuggerPresent|0xc6643248
kernel32.dll.IsDBCSLeadByteEx|0xc471b129
kernel32.dll.IsDBCSLeadByte|0xcf6720fe
kernel32.dll.IsCalendarLeapYear|0x5399168f
kernel32.dll.IsCalendarLeapMonth|0xad9dbea4
kernel32.dll.IsCalendarLeapDay|0xa965cd85
kernel32.dll.IsBadWritePtr|0xf3f0b99d
kernel32.dll.IsBadStringPtrW|0x72f1b2dc
kernel32.dll.IsBadStringPtrA|0x7241b2dc
kernel32.dll.IsBadReadPtr|0x9cc28aec
kernel32.dll.IsBadHugeWritePtr|0xc24b453f
kernel32.dll.IsBadHugeReadPtr|0xee36c4b7
kernel32.dll.IsBadCodePtr|0x1cea990d
kernel32.dll.InvalidateConsoleDIBits|0xebb95099
kernel32.dll.InterlockedPushListSListEx|0x75d1544e
kernel32.dll.InterlockedPushListSList|0x662c9f8a
kernel32.dll.InterlockedPushEntrySList|0x896c0a47
kernel32.dll.InterlockedPopEntrySList|0xb13baf02
kernel32.dll.InterlockedIncrement|0xafdef8f1
kernel32.dll.InterlockedFlushSList|0xef12602b
kernel32.dll.InterlockedExchangeAdd|0xf1c32524
kernel32.dll.InterlockedExchange|0x8ca9bbc6
kernel32.dll.InterlockedDecrement|0xa6ded0f1
kernel32.dll.InterlockedCompareExchange64|0xd7f7e98b
kernel32.dll.InterlockedCompareExchange|0x57bdb9ee
kernel32.dll.InstallELAMCertificateInfo|0xc2e8f0a6
kernel32.dll.InitializeSynchronizationBarrier|0x0fbd3abf
kernel32.dll.InitializeSRWLock|0xf01fa2a6
kernel32.dll.InitializeSListHead|0x608c7473
kernel32.dll.InitializeProcThreadAttributeList|0x0aae0a00
kernel32.dll.InitializeEnclave|0xd461a5ac
kernel32.dll.InitializeCriticalSectionEx|0xadb17f40
kernel32.dll.InitializeCriticalSectionAndSpinCount|0xf8bd618f
kernel32.dll.InitializeCriticalSection|0x2b0c2036
kernel32.dll.InitializeContext2|0x0cfd6852
kernel32.dll.InitializeContext|0x5cde25f1
kernel32.dll.InitializeConditionVariable|0xe61e41d1
kernel32.dll.InitOnceInitialize|0x5cf9b9cc
kernel32.dll.InitOnceExecuteOnce|0x84afaa2d
kernel32.dll.InitOnceComplete|0x5fbbd309
kernel32.dll.InitOnceBeginInitialize|0x6c1d318d
kernel32.dll.InitAtomTable|0xf4e55ee2
kernel32.dll.IdnToUnicode|0xe5600f5b
kernel32.dll.IdnToNameprepUnicode|0x88e9e7ca
kernel32.dll.IdnToAscii|0x8bbd8bcd
kernel32.dll.HeapWalk|0xa190aeb3
kernel32.dll.HeapValidate|0x705b04c7
kernel32.dll.HeapUnlock|0xd66525e4
kernel32.dll.HeapSummary|0x8ae5160a
kernel32.dll.HeapSize|0xb1607233
kernel32.dll.HeapSetInformation|0x1e52079d
kernel32.dll.HeapReAlloc|0x9ff50515
kernel32.dll.HeapQueryInformation|0x4b031a4a
kernel32.dll.HeapLock|0xbd8ffc73
kernel32.dll.HeapFree|0xc35f9cf3
kernel32.dll.HeapDestroy|0xaca5836e
kernel32.dll.HeapCreate|0xb9ecba26
kernel32.dll.HeapCompact|0x8aa5404a
kernel32.dll.HeapAlloc|0x54903edb
kernel32.dll.Heap32Next|0xc2234b06
kernel32.dll.Heap32ListNext|0xa182d852
kernel32.dll.Heap32ListFirst|0x960fcd34
kernel32.dll.Heap32First|0x2bb0d237
kernel32.dll.GlobalWire|0x98640fe3
kernel32.dll.GlobalUnlock|0x973d11de
kernel32.dll.GlobalUnfix|0x46b79580
kernel32.dll.GlobalUnWire|0x8b0bc59d
kernel32.dll.GlobalSize|0x9863d1e3
kernel32.dll.GlobalReAlloc|0xffc30bd4
kernel32.dll.GlobalMemoryStatusEx|0x907f64e3
kernel32.dll.GlobalMemoryStatus|0xba9757cd
kernel32.dll.GlobalLock|0xa4935c23
kernel32.dll.GlobalHandle|0x00d93417
kernel32.dll.GlobalGetAtomNameW|0x6e1de21b
kernel32.dll.GlobalGetAtomNameA|0x6d6de21b
kernel32.dll.GlobalFree|0xaa62fca3
kernel32.dll.GlobalFlags|0xbc8f74f9
kernel32.dll.GlobalFix|0x1000372b
kernel32.dll.GlobalFindAtomW|0x7644663f
kernel32.dll.GlobalFindAtomA|0x7594663f
kernel32.dll.GlobalDeleteAtom|0x1e0f399c
kernel32.dll.GlobalCompact|0xea73470a
kernel32.dll.GlobalAlloc|0x520f76f6
kernel32.dll.GlobalAddAtomW|0xacc701c4
kernel32.dll.GlobalAddAtomExW|0xf761ef60
kernel32.dll.GlobalAddAtomExA|0xf6b1ef60
kernel32.dll.GlobalAddAtomA|0xac1701c4
kernel32.dll.GetXStateFeaturesMask|0x4887f137
kernel32.dll.GetWriteWatch|0x4cf4e4ac
kernel32.dll.GetWindowsDirectoryW|0x72cede40
kernel32.dll.GetWindowsDirectoryA|0x721ede40
kernel32.dll.GetVolumePathNamesForVolumeNameW|0x202bdf43
kernel32.dll.GetVolumePathNamesForVolumeNameA|0x1f7bdf43
kernel32.dll.GetVolumePathNameW|0x1b1f955e
kernel32.dll.GetVolumePathNameA|0x1a6f955e
kernel32.dll.GetVolumeNameForVolumeMountPointW|0xea31fe48
kernel32.dll.GetVolumeNameForVolumeMountPointA|0xe981fe48
kernel32.dll.GetVolumeInformationW|0xa0636c6c
kernel32.dll.GetVolumeInformationByHandleW|0x79fe85a7
kernel32.dll.GetVolumeInformationA|0x9fb36c6c
kernel32.dll.GetVersionExW|0xb77d51d8
kernel32.dll.GetVersionExA|0xb6cd51d8
kernel32.dll.GetVersion|0x9dbd95a6
kernel32.dll.GetVDMCurrentDirectories|0x64a96e97
kernel32.dll.GetUserPreferredUILanguages|0xc26ffad1
kernel32.dll.GetUserGeoID|0x686a326b
kernel32.dll.GetUserDefaultUILanguage|0xbab2f4c8
kernel32.dll.GetUserDefaultLocaleName|0x91a9b644
kernel32.dll.GetUserDefaultLangID|0xe04b5aed
kernel32.dll.GetUserDefaultLCID|0xa2c4fe61
kernel32.dll.GetUserDefaultGeoName|0x667ffd5c
kernel32.dll.GetUILanguageInfo|0x8e735fcf
kernel32.dll.GetTimeZoneInformationForYear|0x7551ee96
kernel32.dll.GetTimeZoneInformation|0xab49a00e
kernel32.dll.GetTimeFormatWWorker|0xf2f4caf0
kernel32.dll.GetTimeFormatW|0x3156982e
kernel32.dll.GetTimeFormatEx|0xa1140796
kernel32.dll.GetTimeFormatAWorker|0xf2f4c830
kernel32.dll.GetTimeFormatA|0x30a6982e
kernel32.dll.GetTickCount64|0xdc3e4850
kernel32.dll.GetTickCount|0x6bced369
kernel32.dll.GetThreadUILanguage|0xb27734c1
kernel32.dll.GetThreadTimes|0x0a0a7fbf
kernel32.dll.GetThreadSelectorEntry|0x593afc86
kernel32.dll.GetThreadSelectedCpuSets|0x83465ecb
kernel32.dll.GetThreadPriorityBoost|0x42a98637
kernel32.dll.GetThreadPriority|0x2f55dbd1
kernel32.dll.GetThreadPreferredUILanguages|0x66f4fb9a
kernel32.dll.GetThreadLocale|0xd4e22ff8
kernel32.dll.GetThreadInformation|0xd75a181a
kernel32.dll.GetThreadIdealProcessorEx|0x0fa56b57
kernel32.dll.GetThreadId|0x742ee666
kernel32.dll.GetThreadIOPendingFlag|0x3360ce37
kernel32.dll.GetThreadGroupAffinity|0x0a1164cc
kernel32.dll.GetThreadErrorMode|0xb391dff0
kernel32.dll.GetThreadDescription|0x0b40801f
kernel32.dll.GetThreadContext|0xd1425c18
kernel32.dll.GetTempPathW|0xe4f9f330
kernel32.dll.GetTempPathA|0xe449f330
kernel32.dll.GetTempFileNameW|0xa526543b
kernel32.dll.GetTempFileNameA|0xa476543b
kernel32.dll.GetTapeStatus|0x14045f5a
kernel32.dll.GetTapePosition|0x54b94214
kernel32.dll.GetTapeParameters|0x05b5e108
kernel32.dll.GetSystemWow64DirectoryW|0xc31eeb71
kernel32.dll.GetSystemWow64DirectoryA|0xc26eeb71
kernel32.dll.GetSystemWindowsDirectoryW|0x73ba942a
kernel32.dll.GetSystemWindowsDirectoryA|0x730a942a
kernel32.dll.GetSystemTimes|0x592c8843
kernel32.dll.GetSystemTimePreciseAsFileTime|0xb6b77020
kernel32.dll.GetSystemTimeAsFileTime|0x9b1b6595
kernel32.dll.GetSystemTimeAdjustment|0x37b07f5c
kernel32.dll.GetSystemTime|0x40dc4f36
kernel32.dll.GetSystemRegistryQuota|0xd25d0f76
kernel32.dll.GetSystemPreferredUILanguages|0xf0d93cab
kernel32.dll.GetSystemPowerStatus|0xc538ae2c
kernel32.dll.GetSystemInfo|0x4b2b9d76
kernel32.dll.GetSystemFirmwareTable|0x1f41edb8
kernel32.dll.GetSystemFileCacheSize|0xad3f6f5f
kernel32.dll.GetSystemDirectoryW|0x616cde05
kernel32.dll.GetSystemDirectoryA|0x60bcde05
kernel32.dll.GetSystemDefaultUILanguage|0xef53e1df
kernel32.dll.GetSystemDefaultLocaleName|0xc64aa35c
kernel32.dll.GetSystemDefaultLangID|0xb1bea4fc
kernel32.dll.GetSystemDefaultLCID|0xde0acb89
kernel32.dll.GetSystemDEPPolicy|0x1b400860
kernel32.dll.GetSystemCpuSetInformation|0x3a4d867c
kernel32.dll.GetSystemAppDataKey|0x52742ce4
kernel32.dll.GetStringTypeW|0x13358162
kernel32.dll.GetStringTypeExW|0x9301d6fa
kernel32.dll.GetStringTypeExA|0x9251d6f9
kernel32.dll.GetStringTypeA|0x12858162
kernel32.dll.GetStringScripts|0xe98a15db
kernel32.dll.GetStdHandle|0x53cabb18
kernel32.dll.GetStateFolder|0x8688284f
kernel32.dll.GetStartupInfoW|0xb21b4ab1
kernel32.dll.GetStartupInfoA|0xb16b4ab1
kernel32.dll.GetStagedPackagePathByFullName|0x542e9516
kernel32.dll.GetShortPathNameW|0x875a2415
kernel32.dll.GetShortPathNameA|0x86aa2415
kernel32.dll.GetQueuedCompletionStatusEx|0xd4738ce3
kernel32.dll.GetQueuedCompletionStatus|0xb7a7286d
kernel32.dll.GetProfileStringW|0xd2737485
kernel32.dll.GetProfileStringA|0xd1c37485
kernel32.dll.GetProfileSectionW|0x1284c8e2
kernel32.dll.GetProfileSectionA|0x11d4c8e2
kernel32.dll.GetProfileIntW|0x0c406c8a
kernel32.dll.GetProfileIntA|0x0b906c8a
kernel32.dll.GetProductInfo|0x8adc6a91
kernel32.dll.GetProcessorSystemCycleTime|0x58987ddf
kernel32.dll.GetProcessWorkingSetSizeEx|0x9c84c0f1
kernel32.dll.GetProcessWorkingSetSize|0xeec76d3d
kernel32.dll.GetProcessVersion|0xd6ea4ee4
kernel32.dll.GetProcessTimes|0xb2027fca
kernel32.dll.GetProcessShutdownParameters|0xe438fce0
kernel32.dll.GetProcessPriorityBoost|0x4d517e37
kernel32.dll.GetProcessPreferredUILanguages|0xbbf3fb9c
kernel32.dll.GetProcessMitigationPolicy|0x2d5c9f96
kernel32.dll.GetProcessIoCounters|0x86005946
kernel32.dll.GetProcessInformation|0xd784b7fa
kernel32.dll.GetProcessIdOfThread|0x9103dbe3
kernel32.dll.GetProcessId|0x702eebba
kernel32.dll.GetProcessHeaps|0x9a024284
kernel32.dll.GetProcessHeap|0xf8245751
kernel32.dll.GetProcessHandleCount|0xa492a6e8
kernel32.dll.GetProcessGroupAffinity|0x14b95ccc
kernel32.dll.GetProcessDefaultCpuSets|0x6f4f0d00
kernel32.dll.GetProcessDEPPolicy|0x7ab86ded
kernel32.dll.GetProcessAffinityMask|0xff434dc9
kernel32.dll.GetProcAddress|0x7802f749
kernel32.dll.GetPrivateProfileStructW|0x26cc536a
kernel32.dll.GetPrivateProfileStructA|0x261c536a
kernel32.dll.GetPrivateProfileStringW|0x3ccb902a
kernel32.dll.GetPrivateProfileStringA|0x3c1b902a
kernel32.dll.GetPrivateProfileSectionW|0xefb01ba3
kernel32.dll.GetPrivateProfileSectionNamesW|0x8dca862f
kernel32.dll.GetPrivateProfileSectionNamesA|0x8d1a862f
kernel32.dll.GetPrivateProfileSectionA|0xef001ba3
kernel32.dll.GetPrivateProfileIntW|0x384e3f3f
kernel32.dll.GetPrivateProfileIntA|0x379e3f3f
kernel32.dll.GetPriorityClass|0xcc506985
kernel32.dll.GetPhysicallyInstalledSystemMemory|0x8b363105
kernel32.dll.GetPackagesByPackageFamily|0x75d87b94
kernel32.dll.GetPackagePathByFullName|0x28d1422c
kernel32.dll.GetPackagePath|0xb7b47b86
kernel32.dll.GetPackageInfo|0xd1ec0806
kernel32.dll.GetPackageId|0x434e2a38
kernel32.dll.GetPackageFullName|0xa406d6ed
kernel32.dll.GetPackageFamilyName|0xe53ca68a
kernel32.dll.GetPackageApplicationIds|0x5bbe5397
kernel32.dll.GetOverlappedResultEx|0x67f037d3
kernel32.dll.GetOverlappedResult|0x79f51b18
kernel32.dll.GetOEMCP|0xf8038462
kernel32.dll.GetNumberOfConsoleMouseButtons|0x42dea82f
kernel32.dll.GetNumberOfConsoleInputEvents|0xbb04b78d
kernel32.dll.GetNumberOfConsoleFonts|0xdb84f881
kernel32.dll.GetNumberFormatW|0x13500c49
kernel32.dll.GetNumberFormatEx|0x41eb1761
kernel32.dll.GetNumberFormatA|0x12a00c49
kernel32.dll.GetNumaProximityNodeEx|0x2bd8afa3
kernel32.dll.GetNumaProximityNode|0xb904bcf8
kernel32.dll.GetNumaProcessorNodeEx|0xa6d0fd75
kernel32.dll.GetNumaProcessorNode|0xfef09e2f
kernel32.dll.GetNumaNodeProcessorMaskEx|0xb32821e0
kernel32.dll.GetNumaNodeProcessorMask|0xab21fac1
kernel32.dll.GetNumaNodeNumberFromHandle|0x48205b8e
kernel32.dll.GetNumaHighestNodeNumber|0x485c515d
kernel32.dll.GetNumaAvailableMemoryNodeEx|0x03ec6122
kernel32.dll.GetNumaAvailableMemoryNode|0xb4650bbe
kernel32.dll.GetNextVDMCommand|0x5a626ccd
kernel32.dll.GetNativeSystemInfo|0x959e0033
kernel32.dll.GetNamedPipeServerSessionId|0x79820f02
kernel32.dll.GetNamedPipeServerProcessId|0x90423680
kernel32.dll.GetNamedPipeInfo|0x4c11c3e3
kernel32.dll.GetNamedPipeHandleStateW|0xf4585794
kernel32.dll.GetNamedPipeHandleStateA|0xf3a85794
kernel32.dll.GetNamedPipeClientSessionId|0xf51429f1
kernel32.dll.GetNamedPipeClientProcessId|0x0bd4516f
kernel32.dll.GetNamedPipeClientComputerNameW|0xfe3715b5
kernel32.dll.GetNamedPipeClientComputerNameA|0xfd8715b5
kernel32.dll.GetNamedPipeAttribute|0xe29a6c54
kernel32.dll.GetNLSVersionEx|0x33de6f8d
kernel32.dll.GetNLSVersion|0x6124d3f7
kernel32.dll.GetModuleHandleW|0xdb85b06c
kernel32.dll.GetModuleHandleExW|0xa70d996c
kernel32.dll.GetModuleHandleExA|0xa65d996c
kernel32.dll.GetModuleHandleA|0xdad5b06c
kernel32.dll.GetModuleFileNameW|0xff11445d
kernel32.dll.GetModuleFileNameA|0xfe61445d
kernel32.dll.GetMemoryErrorHandlingCapabilities|0x10eba445
kernel32.dll.GetMaximumProcessorGroupCount|0x142195c9
kernel32.dll.GetMaximumProcessorCount|0xc665cbb2
kernel32.dll.GetMailslotInfo|0x41aec708
kernel32.dll.GetLongPathNameW|0x5934a5d8
kernel32.dll.GetLongPathNameTransactedW|0x8090ea48
kernel32.dll.GetLongPathNameTransactedA|0x7fe0ea48
kernel32.dll.GetLongPathNameA|0x5884a5d8
kernel32.dll.GetLogicalProcessorInformationEx|0x2d1bb672
kernel32.dll.GetLogicalProcessorInformation|0xf509c913
kernel32.dll.GetLogicalDrives|0xeb77bceb
kernel32.dll.GetLogicalDriveStringsW|0xde4ae47a
kernel32.dll.GetLogicalDriveStringsA|0xdd9ae47a
kernel32.dll.GetLocaleInfoW|0x371e5b9b
kernel32.dll.GetLocaleInfoEx|0xbc7c35d4
kernel32.dll.GetLocaleInfoA|0x366e5b9b
kernel32.dll.GetLocalTime|0xd92ce33e
kernel32.dll.GetLastError|0x5de2c5aa
kernel32.dll.GetLargestConsoleWindowSize|0x29c48372
kernel32.dll.GetLargePageMinimum|0x84736606
kernel32.dll.GetHandleInformation|0x5cd313c9
kernel32.dll.GetHandleContext|0x8c3ab3a7
kernel32.dll.GetGeoInfoW|0x6abbbf78
kernel32.dll.GetGeoInfoEx|0xdb65d2bf
kernel32.dll.GetGeoInfoA|0x6a0bbf78
kernel32.dll.GetFullPathNameW|0x9630a63a
kernel32.dll.GetFullPathNameTransactedW|0xcfcfea61
kernel32.dll.GetFullPathNameTransactedA|0xcf1fea61
kernel32.dll.GetFullPathNameA|0x9580a63a
kernel32.dll.GetFirmwareType|0x1b7b7fb3
kernel32.dll.GetFirmwareEnvironmentVariableW|0xe23d3ff2
kernel32.dll.GetFirmwareEnvironmentVariableExW|0x54f17aed
kernel32.dll.GetFirmwareEnvironmentVariableExA|0x54417aed
kernel32.dll.GetFirmwareEnvironmentVariableA|0xe18d3ff2
kernel32.dll.GetFinalPathNameByHandleW|0x11e5da2b
kernel32.dll.GetFinalPathNameByHandleA|0x1135da2b
kernel32.dll.GetFileType|0x901e2046
kernel32.dll.GetFileTime|0x701e1f86
kernel32.dll.GetFileSizeEx|0xf22e2351
kernel32.dll.GetFileSize|0x701e12c6
kernel32.dll.GetFileMUIPath|0xb158c0fa
kernel32.dll.GetFileMUIInfo|0xcb904d7a
kernel32.dll.GetFileInformationByHandleEx|0xbdef4e71
kernel32.dll.GetFileInformationByHandle|0xef4d1773
kernel32.dll.GetFileBandwidthReservation|0xd30b7d18
kernel32.dll.GetFileAttributesW|0x5bb1ce93
kernel32.dll.GetFileAttributesTransactedW|0x41303477
kernel32.dll.GetFileAttributesTransactedA|0x40803477
kernel32.dll.GetFileAttributesExW|0xb215234c
kernel32.dll.GetFileAttributesExA|0xb165234c
kernel32.dll.GetFileAttributesA|0x5b01ce93
kernel32.dll.GetExpandedNameW|0xd8a99487
kernel32.dll.GetExpandedNameA|0xd7f99487
kernel32.dll.GetExitCodeThread|0x4277f0d6
kernel32.dll.GetExitCodeProcess|0xee54785f
kernel32.dll.GetErrorMode|0xe8643ae1
kernel32.dll.GetEraNameCountedString|0x82658236
kernel32.dll.GetEnvironmentVariableW|0xde7eade7
kernel32.dll.GetEnvironmentVariableA|0xddceade7
kernel32.dll.GetEnvironmentStringsW|0x8c21941c
kernel32.dll.GetEnvironmentStringsA|0x8b71941c
kernel32.dll.GetEnvironmentStrings|0xe25775b1
kernel32.dll.GetEncryptedFileVersionExt|0xb69215b7
kernel32.dll.GetEnabledXStateFeatures|0x71c1aa95
kernel32.dll.GetDynamicTimeZoneInformation|0x75cd3310
kernel32.dll.GetDurationFormatEx|0xf119173c
kernel32.dll.GetDurationFormat|0x1c19be96
kernel32.dll.GetDriveTypeW|0x046e6566
kernel32.dll.GetDriveTypeA|0x03be6566
kernel32.dll.GetDllDirectoryW|0xb01e50d3
kernel32.dll.GetDllDirectoryA|0xaf6e50d3
kernel32.dll.GetDiskSpaceInformationW|0x72460a59
kernel32.dll.GetDiskSpaceInformationA|0x71960a59
kernel32.dll.GetDiskFreeSpaceW|0xf778f67b
kernel32.dll.GetDiskFreeSpaceExW|0xa3df1d33
kernel32.dll.GetDiskFreeSpaceExA|0xa32f1d33
kernel32.dll.GetDiskFreeSpaceA|0xf6c8f67b
kernel32.dll.GetDevicePowerState|0x3f7a6895
kernel32.dll.GetDefaultCommConfigW|0x4e3f47c8
kernel32.dll.GetDefaultCommConfigA|0x4d8f47c8
kernel32.dll.GetDateFormatWWorker|0xd2ecca71
kernel32.dll.GetDateFormatW|0x3136d02c
kernel32.dll.GetDateFormatEx|0x61040697
kernel32.dll.GetDateFormatAWorker|0xd2ecc7b1
kernel32.dll.GetDateFormatA|0x3086d02c
kernel32.dll.GetCurrentThreadStackLimits|0xda0417db
kernel32.dll.GetCurrentThreadId|0x5fa0c4b9
kernel32.dll.GetCurrentThread|0x11d65d48
kernel32.dll.GetCurrentProcessorNumberEx|0xb9fa0e26
kernel32.dll.GetCurrentProcessorNumber|0xc33d4272
kernel32.dll.GetCurrentProcessId|0x62c64749
kernel32.dll.GetCurrentProcess|0x51e2f352
kernel32.dll.GetCurrentPackagePath|0x5d8b5f42
kernel32.dll.GetCurrentPackageInfo|0x77c2ebc2
kernel32.dll.GetCurrentPackageId|0x35e585c7
kernel32.dll.GetCurrentPackageFullName|0x1242a14a
kernel32.dll.GetCurrentPackageFamilyName|0x742f3de5
kernel32.dll.GetCurrentDirectoryW|0xeddd1511
kernel32.dll.GetCurrentDirectoryA|0xed2d1511
kernel32.dll.GetCurrentConsoleFontEx|0x63ef5335
kernel32.dll.GetCurrentConsoleFont|0x01e51786
kernel32.dll.GetCurrentApplicationUserModelId|0x8293e2cb
kernel32.dll.GetCurrentActCtxWorker|0x9a513e40
kernel32.dll.GetCurrentActCtx|0x4e2a8205
kernel32.dll.GetCurrencyFormatW|0xfe2d0340
kernel32.dll.GetCurrencyFormatEx|0xf9a26e49
kernel32.dll.GetCurrencyFormatA|0xfd7d0340
kernel32.dll.GetConsoleWindow|0xce726e89
kernel32.dll.GetConsoleTitleW|0xdd66cc09
kernel32.dll.GetConsoleTitleA|0xdcb6cc09
kernel32.dll.GetConsoleSelectionInfo|0x274e6359
kernel32.dll.GetConsoleScreenBufferInfoEx|0x32401d8f
kernel32.dll.GetConsoleScreenBufferInfo|0x691e5aaf
kernel32.dll.GetConsoleProcessList|0xc517a66e
kernel32.dll.GetConsoleOutputCP|0x781d74ee
kernel32.dll.GetConsoleOriginalTitleW|0x837fd8d5
kernel32.dll.GetConsoleOriginalTitleA|0x82cfd8d5
kernel32.dll.GetConsoleNlsMode|0xd35b7f17
kernel32.dll.GetConsoleMode|0x5b96a149
kernel32.dll.GetConsoleKeyboardLayoutNameW|0x30748f3e
kernel32.dll.GetConsoleKeyboardLayoutNameA|0x2fc48f3e
kernel32.dll.GetConsoleInputWaitHandle|0xa3c8b770
kernel32.dll.GetConsoleInputExeNameW|0xf0706d7d
kernel32.dll.GetConsoleInputExeNameA|0xefc06d7d
kernel32.dll.GetConsoleHistoryInfo|0x9fdb946f
kernel32.dll.GetConsoleHardwareState|0x3465b7ab
kernel32.dll.GetConsoleFontSize|0x59ab61f0
kernel32.dll.GetConsoleFontInfo|0x63fabcf0
kernel32.dll.GetConsoleDisplayMode|0x9d3fd38f
kernel32.dll.GetConsoleCursorMode|0x2d57556f
kernel32.dll.GetConsoleCursorInfo|0x2ba715ef
kernel32.dll.GetConsoleCommandHistoryW|0x1d5ee4de
kernel32.dll.GetConsoleCommandHistoryLengthW|0xb713ca71
kernel32.dll.GetConsoleCommandHistoryLengthA|0xb663ca71
kernel32.dll.GetConsoleCommandHistoryA|0x1caee4de
kernel32.dll.GetConsoleCharType|0x76776e8f
kernel32.dll.GetConsoleCP|0x50ce121f
kernel32.dll.GetConsoleAliasesW|0xcc295fc7
kernel32.dll.GetConsoleAliasesLengthW|0xa2b6859b
kernel32.dll.GetConsoleAliasesLengthA|0xa206859b
kernel32.dll.GetConsoleAliasesA|0xcb795fc7
kernel32.dll.GetConsoleAliasW|0x471a1f8a
kernel32.dll.GetConsoleAliasExesW|0x0ff9bed8
kernel32.dll.GetConsoleAliasExesLengthW|0x1efb94dc
kernel32.dll.GetConsoleAliasExesLengthA|0x1e4b94dc
kernel32.dll.GetConsoleAliasExesA|0x0f49bed8
kernel32.dll.GetConsoleAliasA|0x466a1f8a
kernel32.dll.GetComputerNameW|0xa7dbcbfb
kernel32.dll.GetComputerNameExW|0xbc947d1f
kernel32.dll.GetComputerNameExA|0xbbe47d1f
kernel32.dll.GetComputerNameA|0xa72bcbfb
kernel32.dll.GetCompressedFileSizeW|0x4ab2a3a7
kernel32.dll.GetCompressedFileSizeTransactedW|0x3cf069bc
kernel32.dll.GetCompressedFileSizeTransactedA|0x3c4069bc
kernel32.dll.GetCompressedFileSizeA|0x4a02a3a7
kernel32.dll.GetCommandLineW|0x2ee0ce55
kernel32.dll.GetCommandLineA|0x2e30ce55
kernel32.dll.GetCommTimeouts|0xb0e53182
kernel32.dll.GetCommState|0x495e9e31
kernel32.dll.GetCommProperties|0x91a6237e
kernel32.dll.GetCommModemStatus|0x4dec3811
kernel32.dll.GetCommMask|0x5d51b1ca
kernel32.dll.GetCommConfig|0x34659d53
kernel32.dll.GetComPlusPackageInstallStatus|0xa33b7f1b
kernel32.dll.GetCalendarWeekNumber|0x34b75ef6
kernel32.dll.GetCalendarSupportedDateRange|0x4ea36c7c
kernel32.dll.GetCalendarMonthsInYear|0x57d4bd6a
kernel32.dll.GetCalendarInfoW|0x49da6515
kernel32.dll.GetCalendarInfoEx|0x084ccbb4
kernel32.dll.GetCalendarInfoA|0x492a6515
kernel32.dll.GetCalendarDifferenceInDays|0xf5496141
kernel32.dll.GetCalendarDaysInMonth|0xf09396eb
kernel32.dll.GetCalendarDateFormatEx|0x548cbd5b
kernel32.dll.GetCalendarDateFormat|0x99a78d2f
kernel32.dll.GetCachedSigningLevel|0x40d00266
kernel32.dll.GetCPInfoExW|0x71f24aba
kernel32.dll.GetCPInfoExA|0x71424aba
kernel32.dll.GetCPInfo|0xd83a0703
kernel32.dll.GetBinaryTypeW|0x4b5b61df
kernel32.dll.GetBinaryTypeA|0x4aab61df
kernel32.dll.GetBinaryType|0x1c0fcd98
kernel32.dll.GetAtomNameW|0xe5ed5aaf
kernel32.dll.GetAtomNameA|0xe53d5aaf
kernel32.dll.GetApplicationUserModelId|0xbb1a971e
kernel32.dll.GetApplicationRestartSettingsWorker|0xbbe2062f
kernel32.dll.GetApplicationRestartSettings|0x80264a69
kernel32.dll.GetApplicationRecoveryCallbackWorker|0x484c0cc8
kernel32.dll.GetApplicationRecoveryCallback|0x01ccad84
kernel32.dll.GetAppContainerNamedObjectPath|0x5836280f
kernel32.dll.GetAppContainerAce|0xe5adc469
kernel32.dll.GetActiveProcessorGroupCount|0x93ab9d1a
kernel32.dll.GetActiveProcessorCount|0xc579da53
kernel32.dll.GetACP|0x985267cd
kernel32.dll.GenerateConsoleCtrlEvent|0xfa7905bc
kernel32.dll.FreeUserPhysicalPages|0x8bcb2fbb
kernel32.dll.FreeResource|0x8e91b8eb
kernel32.dll.FreeMemoryJobObject|0x04df564c
kernel32.dll.FreeLibraryWhenCallbackReturns|0xdcf67e38
kernel32.dll.FreeLibraryAndExitThread|0x52c8a5f7
kernel32.dll.FreeLibrary|0x3fb18528
kernel32.dll.FreeEnvironmentStringsW|0xa4e194c8
kernel32.dll.FreeEnvironmentStringsA|0xa43194c8
kernel32.dll.FreeConsole|0x5b29928e
kernel32.dll.FormatMessageW|0xaa980c2d
kernel32.dll.FormatMessageA|0xa9e80c2d
kernel32.dll.FormatApplicationUserModelId|0xef9713fd
kernel32.dll.FoldStringW|0x97cd2b50
kernel32.dll.FoldStringA|0x971d2b50
kernel32.dll.FlushViewOfFile|0x496ca03c
kernel32.dll.FlushProcessWriteBuffers|0x8c2878b7
kernel32.dll.FlushInstructionCache|0xdeb1af6a
kernel32.dll.FlushFileBuffers|0xc178d676
kernel32.dll.FlushConsoleInputBuffer|0xb90e367f
kernel32.dll.FlsSetValue|0xc33ce901
kernel32.dll.FlsGetValue|0xb73ce901
kernel32.dll.FlsFree|0xfb8b9914
kernel32.dll.FlsAlloc|0x359a003b
kernel32.dll.FindVolumeMountPointClose|0x85ac827b
kernel32.dll.FindVolumeClose|0x22230bc1
kernel32.dll.FindStringOrdinal|0x05afd2c5
kernel32.dll.FindResourceW|0x6608f55e
kernel32.dll.FindResourceExW|0x47ded60e
kernel32.dll.FindResourceExA|0x472ed60e
kernel32.dll.FindResourceA|0x6558f55e
kernel32.dll.FindPackagesByPackageFamily|0xbde0ec21
kernel32.dll.FindNextVolumeW|0x1ccbf573
kernel32.dll.FindNextVolumeMountPointW|0x8324b254
kernel32.dll.FindNextVolumeMountPointA|0x8274b254
kernel32.dll.FindNextVolumeA|0x1c1bf573
kernel32.dll.FindNextStreamW|0x04def716
kernel32.dll.FindNextFileW|0xf81c45e7
kernel32.dll.FindNextFileNameW|0xc25e166d
kernel32.dll.FindNextFileA|0xf76c45e7
kernel32.dll.FindNextChangeNotification|0x28fbc379
kernel32.dll.FindNLSStringEx|0x30de592b
kernel32.dll.FindNLSString|0xd918d39e
kernel32.dll.FindFirstVolumeW|0xb847df9b
kernel32.dll.FindFirstVolumeMountPointW|0x6a03acde
kernel32.dll.FindFirstVolumeMountPointA|0x6953acde
kernel32.dll.FindFirstVolumeA|0xb797df9b
kernel32.dll.FindFirstStreamW|0xa05ae13e
kernel32.dll.FindFirstStreamTransactedW|0xd25a7922
kernel32.dll.FindFirstFileW|0x968a3590
kernel32.dll.FindFirstFileTransactedW|0x4fe64e36
kernel32.dll.FindFirstFileTransactedA|0x4f364e36
kernel32.dll.FindFirstFileNameW|0xa158a054
kernel32.dll.FindFirstFileNameTransactedW|0x5299e8e7
kernel32.dll.FindFirstFileExW|0x682ee25a
kernel32.dll.FindFirstFileExA|0x677ee25a
kernel32.dll.FindFirstFileA|0x95da3590
kernel32.dll.FindFirstChangeNotificationW|0xb2226bb9
kernel32.dll.FindFirstChangeNotificationA|0xb1726bb9
kernel32.dll.FindCloseChangeNotification|0xfce95c7d
kernel32.dll.FindClose|0x5e70317c
kernel32.dll.FindAtomW|0x5e00affb
kernel32.dll.FindAtomA|0x5d50affb
kernel32.dll.FindActCtxSectionStringWWorker|0x27c2435c
kernel32.dll.FindActCtxSectionStringW|0x8f71a561
kernel32.dll.FindActCtxSectionStringA|0x8ec1a561
kernel32.dll.FindActCtxSectionGuidWorker|0x72de6c98
kernel32.dll.FindActCtxSectionGuid|0x99c0b829
kernel32.dll.FillConsoleOutputCharacterW|0x8ee128b6
kernel32.dll.FillConsoleOutputCharacterA|0x8e3128b6
kernel32.dll.FillConsoleOutputAttribute|0xe2829c2d
kernel32.dll.FileTimeToSystemTime|0xeb28d760
kernel32.dll.FileTimeToLocalFileTime|0x89f34f92
kernel32.dll.FileTimeToDosDateTime|0x62068c2d
kernel32.dll.FatalExit|0xe8d9bfd1
kernel32.dll.FatalAppExitW|0x8e1a2825
kernel32.dll.FatalAppExitA|0x8d6a2825
kernel32.dll.ExpungeConsoleCommandHistoryW|0x5b1c4a3f
kernel32.dll.ExpungeConsoleCommandHistoryA|0x5a6c4a3f
kernel32.dll.ExpandEnvironmentStringsW|0xc2268c86
kernel32.dll.ExpandEnvironmentStringsA|0xc1768c86
kernel32.dll.ExitVDM|0xc2fe70af
kernel32.dll.ExitThread|0x0a2a1de0
kernel32.dll.ExitProcess|0x56a2b5f0
kernel32.dll.EscapeCommFunction|0xd4e4b15c
kernel32.dll.EraseTape|0x4baaa72d
kernel32.dll.EnumerateLocalComputerNamesW|0x25140788
kernel32.dll.EnumerateLocalComputerNamesA|0x24640788
kernel32.dll.EnumUILanguagesW|0x469d921c
kernel32.dll.EnumUILanguagesA|0x45ed921c
kernel32.dll.EnumTimeFormatsW|0x7cd1531a
kernel32.dll.EnumTimeFormatsEx|0x7876636b
kernel32.dll.EnumTimeFormatsA|0x7c21531a
kernel32.dll.EnumSystemLocalesW|0x5c1bc072
kernel32.dll.EnumSystemLocalesEx|0xe3355dbf
kernel32.dll.EnumSystemLocalesA|0x5b6bc072
kernel32.dll.EnumSystemLanguageGroupsW|0x385d282a
kernel32.dll.EnumSystemLanguageGroupsA|0x37ad282a
kernel32.dll.EnumSystemGeoNames|0xe82b0ba9
kernel32.dll.EnumSystemGeoID|0x83b4dcd5
kernel32.dll.EnumSystemFirmwareTables|0x521840b0
kernel32.dll.EnumSystemCodePagesW|0xcd20da48
kernel32.dll.EnumSystemCodePagesA|0xcc70da48
kernel32.dll.EnumResourceTypesW|0x68d62342
kernel32.dll.EnumResourceTypesExW|0xfb2a4f0f
kernel32.dll.EnumResourceTypesExA|0xfa7a4f0f
kernel32.dll.EnumResourceTypesA|0x68262342
kernel32.dll.EnumResourceNamesW|0x68bdf336
kernel32.dll.EnumResourceNamesExW|0xf51e4c0f
kernel32.dll.EnumResourceNamesExA|0xf46e4c0f
kernel32.dll.EnumResourceNamesA|0x680df336
kernel32.dll.EnumResourceLanguagesW|0xce3b7140
kernel32.dll.EnumResourceLanguagesExW|0x547dce68
kernel32.dll.EnumResourceLanguagesExA|0x53cdce68
kernel32.dll.EnumResourceLanguagesA|0xcd8b7140
kernel32.dll.EnumLanguageGroupLocalesW|0xd2456c5a
kernel32.dll.EnumLanguageGroupLocalesA|0xd1956c5a
kernel32.dll.EnumDateFormatsW|0x3cc1521c
kernel32.dll.EnumDateFormatsExW|0xf5f60584
kernel32.dll.EnumDateFormatsExEx|0x0bc22c91
kernel32.dll.EnumDateFormatsExA|0xf5460584
kernel32.dll.EnumDateFormatsA|0x3c11521c
kernel32.dll.EnumCalendarInfoW|0x4a014b3f
kernel32.dll.EnumCalendarInfoExW|0x45f44e47
kernel32.dll.EnumCalendarInfoExEx|0x51dcac83
kernel32.dll.EnumCalendarInfoExA|0x45444e47
kernel32.dll.EnumCalendarInfoA|0x49514b3f
kernel32.dll.EnterSynchronizationBarrier|0xbebfab3d
kernel32.dll.EnterCriticalSection|0x188433ba
kernel32.dll.EndUpdateResourceW|0x66bab859
kernel32.dll.EndUpdateResourceA|0x660ab859
kernel32.dll.EncodeSystemPointer|0x335c6b21
kernel32.dll.EncodePointer|0x484b414b
kernel32.dll.EnableThreadProfiling|0x0e546c4a
kernel32.dll.DuplicateHandle|0xcbd5018d
kernel32.dll.DuplicateEncryptionInfoFileExt|0x03be909a
kernel32.dll.DuplicateConsoleHandle|0xc83b8df6
kernel32.dll.DosPathToSessionPathW|0xe50b254c
kernel32.dll.DosPathToSessionPathA|0xe45b254c
kernel32.dll.DosDateTimeToFileTime|0x0672376e
kernel32.dll.DnsHostnameToComputerNameW|0x59858c27
kernel32.dll.DnsHostnameToComputerNameExW|0x2704884b
kernel32.dll.DnsHostnameToComputerNameA|0x58d58c27
kernel32.dll.DisconnectNamedPipe|0xfcddfac0
kernel32.dll.DiscardVirtualMemory|0x1fbd24e5
kernel32.dll.DisassociateCurrentThreadFromCallback|0xc7622cca
kernel32.dll.DisableThreadProfiling|0x5e666d5a
kernel32.dll.DisableThreadLibraryCalls|0xa80ca0ef
kernel32.dll.DeviceIoControl|0xe69c5de4
kernel32.dll.DeleteVolumeMountPointW|0x4a334156
kernel32.dll.DeleteVolumeMountPointA|0x49834156
kernel32.dll.DeleteTimerQueueTimer|0x380afcfa
kernel32.dll.DeleteTimerQueueEx|0x790d82fd
kernel32.dll.DeleteTimerQueue|0x22399045
kernel32.dll.DeleteSynchronizationBarrier|0x495f3a7c
kernel32.dll.DeleteProcThreadAttributeList|0x0897d710
kernel32.dll.DeleteFileW|0x148d2ed7
kernel32.dll.DeleteFileTransactedW|0x2f670c88
kernel32.dll.DeleteFileTransactedA|0x2eb70c88
kernel32.dll.DeleteFileA|0x13dd2ed7
kernel32.dll.DeleteFiber|0x01652ed7
kernel32.dll.DeleteCriticalSection|0x14d93034
kernel32.dll.DeleteBoundaryDescriptor|0xc24d919e
kernel32.dll.DeleteAtom|0x6bee777e
kernel32.dll.DelayLoadFailureHook|0xae5e98dc
kernel32.dll.DefineDosDeviceW|0xa594dfd4
kernel32.dll.DefineDosDeviceA|0xa4e4dfd4
kernel32.dll.DecodeSystemPointer|0x311c6921
kernel32.dll.DecodePointer|0x47cb40bb
kernel32.dll.DebugSetProcessKillOnExit|0x40e11d7e
kernel32.dll.DebugBreakProcess|0x01e35038
kernel32.dll.DebugBreak|0xc3ad85ed
kernel32.dll.DebugActiveProcessStop|0xd8fbff0e
kernel32.dll.DebugActiveProcess|0x59e4c353
kernel32.dll.DeactivateActCtxWorker|0xe29595ea
kernel32.dll.DeactivateActCtx|0x64151416
kernel32.dll.CtrlRoutine|0x56240cf2
kernel32.dll.CreateWaitableTimerW|0xa7df69f1
kernel32.dll.CreateWaitableTimerExW|0xbd7bfa9f
kernel32.dll.CreateWaitableTimerExA|0xbccbfa9f
kernel32.dll.CreateWaitableTimerA|0xa72f69f1
kernel32.dll.CreateToolhelp32Snapshot|0x921e3980
kernel32.dll.CreateTimerQueueTimer|0x070a6efb
kernel32.dll.CreateTimerQueue|0xc0387447
kernel32.dll.CreateThreadpoolWork|0x444c0fc2
kernel32.dll.CreateThreadpoolWait|0x28940d82
kernel32.dll.CreateThreadpoolTimer|0xd3844240
kernel32.dll.CreateThreadpoolIo|0x356826cb
kernel32.dll.CreateThreadpoolCleanupGroup|0x0ca1ae94
kernel32.dll.CreateThreadpool|0x592c1ad0
kernel32.dll.CreateThread|0x160d6838
kernel32.dll.CreateTapePartition|0x52bc246f
kernel32.dll.CreateSymbolicLinkW|0x263a6bc0
kernel32.dll.CreateSymbolicLinkTransactedW|0x73d25bc2
kernel32.dll.CreateSymbolicLinkTransactedA|0x73225bc2
kernel32.dll.CreateSymbolicLinkA|0x258a6bc0
kernel32.dll.CreateSocketHandle|0x68865170
kernel32.dll.CreateSemaphoreW|0x19bfefd2
kernel32.dll.CreateSemaphoreExW|0x359d72fb
kernel32.dll.CreateSemaphoreExA|0x34ed72fb
kernel32.dll.CreateSemaphoreA|0x190fefd2
kernel32.dll.CreateRemoteThreadEx|0x5154a353
kernel32.dll.CreateRemoteThread|0x799aacc6
kernel32.dll.CreatePseudoConsole|0xea4aaef6
kernel32.dll.CreateProcessW|0x86efcc79
kernel32.dll.CreateProcessInternalW|0x66f5f149
kernel32.dll.CreateProcessInternalA|0x6645f149
kernel32.dll.CreateProcessAsUserW|0xb7ba31c8
kernel32.dll.CreateProcessAsUserA|0xb70a31c8
kernel32.dll.CreateProcessA|0x863fcc79
kernel32.dll.CreatePrivateNamespaceW|0xcdcda0a2
kernel32.dll.CreatePrivateNamespaceA|0xcd1da0a2
kernel32.dll.CreatePipe|0x0eafcf3e
kernel32.dll.CreateNamedPipeW|0xd58f7045
kernel32.dll.CreateNamedPipeA|0xd4df7045
kernel32.dll.CreateMutexW|0x95898dff
kernel32.dll.CreateMutexExW|0x2804fe1a
kernel32.dll.CreateMutexExA|0x2754fe1a
kernel32.dll.CreateMutexA|0x94d98dff
kernel32.dll.CreateMemoryResourceNotification|0xd1c9c6ce
kernel32.dll.CreateMailslotW|0x298a3766
kernel32.dll.CreateMailslotA|0x28da3766
kernel32.dll.CreateJobSet|0x7264693b
kernel32.dll.CreateJobObjectW|0xb087a151
kernel32.dll.CreateJobObjectA|0xafd7a151
kernel32.dll.CreateIoCompletionPort|0x6ff741e5
kernel32.dll.CreateHardLinkW|0xa769de33
kernel32.dll.CreateHardLinkTransactedW|0x141e385f
kernel32.dll.CreateHardLinkTransactedA|0x136e385f
kernel32.dll.CreateHardLinkA|0xa6b9de33
kernel32.dll.CreateFileW|0x508af6da
kernel32.dll.CreateFileTransactedW|0xfe667e89
kernel32.dll.CreateFileTransactedA|0xfdb67e89
kernel32.dll.CreateFileMappingW|0x24a9cd0a
kernel32.dll.CreateFileMappingNumaW|0x9ad18836
kernel32.dll.CreateFileMappingNumaA|0x9a218836
kernel32.dll.CreateFileMappingFromApp|0x72c048dc
kernel32.dll.CreateFileMappingA|0x23f9cd0a
kernel32.dll.CreateFileA|0x4fdaf6da
kernel32.dll.CreateFile2|0x4f62f6da
kernel32.dll.CreateFiberEx|0x43672844
kernel32.dll.CreateFiber|0x3d62f6da
kernel32.dll.CreateEventW|0x27689cff
kernel32.dll.CreateEventExW|0x9fc8be3f
kernel32.dll.CreateEventExA|0x9f18be3f
kernel32.dll.CreateEventA|0x26b89cff
kernel32.dll.CreateEnclave|0xa0e3a465
kernel32.dll.CreateDirectoryW|0x5e8c1554
kernel32.dll.CreateDirectoryTransactedW|0x81e6c627
kernel32.dll.CreateDirectoryTransactedA|0x8136c627
kernel32.dll.CreateDirectoryExW|0x68a6d38c
kernel32.dll.CreateDirectoryExA|0x67f6d38c
kernel32.dll.CreateDirectoryA|0x5ddc1554
kernel32.dll.CreateConsoleScreenBuffer|0x6ca6786c
kernel32.dll.CreateBoundaryDescriptorW|0x62a8a0bd
kernel32.dll.CreateBoundaryDescriptorA|0x61f8a0bd
kernel32.dll.CreateActCtxWWorker|0xe3f11eaa
kernel32.dll.CreateActCtxW|0x4645146d
kernel32.dll.CreateActCtxA|0x4595146d
kernel32.dll.CopyLZFile|0x990f1939
kernel32.dll.CopyFileW|0xde53e63e
kernel32.dll.CopyFileTransactedW|0xe1d8ba62
kernel32.dll.CopyFileTransactedA|0xe128ba62
kernel32.dll.CopyFileExW|0x5a9b0dec
kernel32.dll.CopyFileExA|0x59eb0dec
kernel32.dll.CopyFileA|0xdda3e63e
kernel32.dll.CopyFile2|0xdd2be63e
kernel32.dll.CopyContext|0x9b9bfd8e
kernel32.dll.ConvertThreadToFiberEx|0x9ecc3823
kernel32.dll.ConvertThreadToFiber|0xb6d08b1a
kernel32.dll.ConvertSystemTimeToCalDateTime|0x4174b47f
kernel32.dll.ConvertNLSDayOfWeekToWin32DayOfWeek|0x668c18d4
kernel32.dll.ConvertFiberToThread|0xa4d5a59b
kernel32.dll.ConvertDefaultLocale|0x33c4d0bd
kernel32.dll.ConvertCalDateTimeToSystemTime|0x78b8b554
kernel32.dll.ContinueDebugEvent|0x0cef7805
kernel32.dll.ConsoleMenuControl|0xd89fb122
kernel32.dll.ConnectNamedPipe|0xe27d6f28
kernel32.dll.CompareStringW|0x50a26e1c
kernel32.dll.CompareStringOrdinal|0xd0e8b61a
kernel32.dll.CompareStringEx|0x508501f4
kernel32.dll.CompareStringA|0x4ff26e1c
kernel32.dll.CompareFileTime|0x46d36a92
kernel32.dll.CompareCalendarDates|0xd2143819
kernel32.dll.CommConfigDialogW|0x9ee1fe7b
kernel32.dll.CommConfigDialogA|0x9e31fe7b
kernel32.dll.CmdBatNotification|0xdbb95459
kernel32.dll.CloseThreadpoolWork|0x160ab22e
kernel32.dll.CloseThreadpoolWait|0xfa52afee
kernel32.dll.CloseThreadpoolTimer|0xe6e2d035
kernel32.dll.CloseThreadpoolIo|0xe4af2155
kernel32.dll.CloseThreadpoolCleanupGroupMembers|0x9a6c28ce
kernel32.dll.CloseThreadpoolCleanupGroup|0x78736d36
kernel32.dll.CloseThreadpool|0x7fe936ba
kernel32.dll.CloseState|0x0875e275
kernel32.dll.ClosePseudoConsole|0xbe98292e
kernel32.dll.CloseProfileUserMapping|0xdf285df4
kernel32.dll.ClosePrivateNamespace|0xd390b8db
kernel32.dll.ClosePackageInfo|0x592fa723
kernel32.dll.CloseHandle|0x528796c6
kernel32.dll.CloseConsoleHandle|0x9e8e3527
kernel32.dll.ClearCommError|0x21bf8aca
kernel32.dll.ClearCommBreak|0x87878748
kernel32.dll.CheckTokenMembershipEx|0x2074393a
kernel32.dll.CheckTokenCapability|0x1a129db7
kernel32.dll.CheckRemoteDebuggerPresent|0x7eb13455
kernel32.dll.CheckNameLegalDOS8Dot3W|0xed13cf63
kernel32.dll.CheckNameLegalDOS8Dot3A|0xec63cf63
kernel32.dll.CheckForReadOnlyResourceFilter|0x6acb8cd3
kernel32.dll.CheckForReadOnlyResource|0xf9d031b5
kernel32.dll.CheckElevationEnabled|0xf2a1b882
kernel32.dll.CheckElevation|0x4ac7b9d6
kernel32.dll.CheckAllowDecryptedRemoteDestinationPolicy|0x4049eed4
kernel32.dll.ChangeTimerQueueTimer|0x6a4a6692
kernel32.dll.CeipIsOptedIn|0xf539d1a1
kernel32.dll.CancelWaitableTimer|0xb8d4156f
kernel32.dll.CancelTimerQueueTimer|0xf7918082
kernel32.dll.CancelThreadpoolIo|0x78f0ea43
kernel32.dll.CancelSynchronousIo|0x12eb0858
kernel32.dll.CancelIoEx|0xa40accc2
kernel32.dll.CancelIo|0x32e5856c
kernel32.dll.CancelDeviceWakeupRequest|0x1de23e8e
kernel32.dll.CallbackMayRunLong|0xf146962b
kernel32.dll.CallNamedPipeW|0x9559e7b7
kernel32.dll.CallNamedPipeA|0x94a9e7b7
kernel32.dll.BuildCommDCBW|0x01f49cdc
kernel32.dll.BuildCommDCBAndTimeoutsW|0x74e60eb6
kernel32.dll.BuildCommDCBAndTimeoutsA|0x74360eb6
kernel32.dll.BuildCommDCBA|0x01449cdc
kernel32.dll.BindIoCompletionCallback|0x3e94a88f
kernel32.dll.BeginUpdateResourceW|0x8f458235
kernel32.dll.BeginUpdateResourceA|0x8e958235
kernel32.dll.Beep|0x6033501a
kernel32.dll.BasepSetFileEncryptionCompression|0xa7c4d1b1
kernel32.dll.BasepReportFault|0x8490a363
kernel32.dll.BasepReleaseSxsCreateProcessUtilityStruct|0x04d4ecb1
kernel32.dll.BasepReleaseAppXContext|0x017fec9d
kernel32.dll.BasepQueryModuleChpeSettings|0x04a751e8
kernel32.dll.BasepQueryAppCompat|0xfb6ee767
kernel32.dll.BasepProcessInvalidImage|0xc9054de5
kernel32.dll.BasepPostSuccessAppXExtension|0x40880d49
kernel32.dll.BasepNotifyLoadStringResource|0x90213ef2
kernel32.dll.BasepMapModuleHandle|0x611214ca
kernel32.dll.BasepIsProcessAllowed|0xfbfbf10f
kernel32.dll.BasepInitAppCompatData|0x14441e8a
kernel32.dll.BasepGetExeArchType|0x161c5453
kernel32.dll.BasepGetComputerNameFromNtPath|0xfd250ba5
kernel32.dll.BasepGetAppCompatData|0x714dbab8
kernel32.dll.BasepFreeAppCompatData|0x9447e272
kernel32.dll.BasepFreeActivationContextActivationBlock|0xeab03981
kernel32.dll.BasepCopyEncryption|0x5e268bca
kernel32.dll.BasepConstructSxsCreateProcessMessage|0x7b7daa84
kernel32.dll.BasepCheckWinSaferRestrictions|0x61acf875
kernel32.dll.BasepCheckWebBladeHashes|0x052d242f
kernel32.dll.BasepCheckAppCompat|0x74d0af63
kernel32.dll.BasepAppXExtension|0xb411637d
kernel32.dll.BasepAppContainerEnvironmentExtension|0x2da7edb1
kernel32.dll.BasepAnsiStringToDynamicUnicodeString|0x4477eda7
kernel32.dll.BasepAllocateActivationContextActivationBlock|0x8ab58289
kernel32.dll.Basep8BitStringToDynamicUnicodeString|0x1c72731e
kernel32.dll.BaseWriteErrorElevationRequiredEvent|0x14953cfa
kernel32.dll.BaseVerifyUnicodeString|0xeab4f355
kernel32.dll.BaseUpdateVDMEntry|0x3f6ba16f
kernel32.dll.BaseUpdateAppcompatCacheWorker|0x2eb57693
kernel32.dll.BaseUpdateAppcompatCache|0x5c3f671e
kernel32.dll.BaseThreadInitThunk|0xc24935b1
kernel32.dll.BaseSetLastNTError|0x93a64aeb
kernel32.dll.BaseReadAppCompatDataForProcessWorker|0x8cb9b4b5
kernel32.dll.BaseQueryModuleData|0xe9885d83
kernel32.dll.BaseIsDosApplication|0x2ac2dc72
kernel32.dll.BaseIsAppcompatInfrastructureDisabledWorker|0x477f760f
kernel32.dll.BaseIsAppcompatInfrastructureDisabled|0xdc1e6d51
kernel32.dll.BaseInitAppcompatCacheSupportWorker|0x80412fba
kernel32.dll.BaseInitAppcompatCacheSupport|0x4a893b81
kernel32.dll.BaseGetNamedObjectDirectory|0x11b39c8c
kernel32.dll.BaseGenerateAppCompatData|0xafca5761
kernel32.dll.BaseFreeAppCompatDataForProcessWorker|0x905a34c2
kernel32.dll.BaseFormatTimeOut|0xee4333fb
kernel32.dll.BaseFormatObjectAttributes|0xf4d82e9b
kernel32.dll.BaseFlushAppcompatCacheWorker|0xd81aef29
kernel32.dll.BaseFlushAppcompatCache|0xba64d178
kernel32.dll.BaseElevationPostProcessing|0x6f4a32cd
kernel32.dll.BaseDumpAppcompatCacheWorker|0xce3225ee
kernel32.dll.BaseDumpAppcompatCache|0x88160efd
kernel32.dll.BaseDllReadWriteIniFile|0xd548d1b1
kernel32.dll.BaseDestroyVDMEnvironment|0x199369f9
kernel32.dll.BaseCleanupAppcompatCacheSupportWorker|0x46db5e6b
kernel32.dll.BaseCleanupAppcompatCacheSupport|0xd6356d28
kernel32.dll.BaseCheckElevation|0xfbbabceb
kernel32.dll.BaseCheckAppcompatCacheWorker|0xbe1c6ae9
kernel32.dll.BaseCheckAppcompatCacheExWorker|0x51290506
kernel32.dll.BaseCheckAppcompatCacheEx|0x3fdc2fbb
kernel32.dll.BaseCheckAppcompatCache|0x1954caf8
kernel32.dll.BackupWrite|0x95257abf
kernel32.dll.BackupSeek|0x44e375c3
kernel32.dll.BackupRead|0x44ab64c3
kernel32.dll.AttachConsole|0x3f0589ca
kernel32.dll.AssignProcessToJobObject|0xbdc269c7
kernel32.dll.AreFileApisANSI|0x46f63e57
kernel32.dll.ApplicationRecoveryInProgress|0xe5d596b1
kernel32.dll.ApplicationRecoveryFinished|0x6f5d8c81
kernel32.dll.AppXGetOSMaxVersionTested|0xf4417887
kernel32.dll.AppPolicyGetWindowingModel|0xf6ebc30a
kernel32.dll.AppPolicyGetThreadInitializationType|0x8d06f2e0
kernel32.dll.AppPolicyGetShowDeveloperDiagnostic|0x117cebc0
kernel32.dll.AppPolicyGetProcessTerminationMethod|0x75245c7e
kernel32.dll.AppPolicyGetMediaFoundationCodecLoading|0x40cee463
kernel32.dll.AppPolicyGetLifecycleManagement|0x995cd9c4
kernel32.dll.AppPolicyGetCreateFileAccess|0x7a01d6fa
kernel32.dll.AppPolicyGetClrCompat|0xd53d19ac
kernel32.dll.AllocateUserPhysicalPagesNuma|0x32060205
kernel32.dll.AllocateUserPhysicalPages|0x915a3b78
kernel32.dll.AllocConsole|0xd975e69d
kernel32.dll.AdjustCalendarDate|0xb2d07c0e
kernel32.dll.AddVectoredExceptionHandler|0x87afc3b3
kernel32.dll.AddVectoredContinueHandler|0x7487eb7c
kernel32.dll.AddSecureMemoryCacheCallback|0x117a7336
kernel32.dll.AddScopedPolicyIDAce|0xff486d25
kernel32.dll.AddSIDToBoundaryDescriptor|0xe00d8513
kernel32.dll.AddResourceAttributeAce|0x3ba67b5d
kernel32.dll.AddRefActCtxWorker|0xe61012aa
kernel32.dll.AddRefActCtx|0x034514f5
kernel32.dll.AddLocalAlternateComputerNameW|0x1488b214
kernel32.dll.AddLocalAlternateComputerNameA|0x13d8b214
kernel32.dll.AddIntegrityLabelToBoundaryDescriptor|0x1022af41
kernel32.dll.AddDllDirectory|0xb1ee3630
kernel32.dll.AddConsoleAliasW|0x2713df8a
kernel32.dll.AddConsoleAliasA|0x2663df8a
kernel32.dll.AddAtomW|0x35fe7ebb
kernel32.dll.AddAtomA|0x354e7ebb
kernel32.dll.ActivateActCtxWorker|0xe26314d8
kernel32.dll.ActivateActCtx|0xc3d0940a
kernel32.dll.AcquireSRWLockShared|0x74fe289c
kernel32.dll.AcquireSRWLockExclusive|0xfd8452c6
user32.dll.wvsprintfW|0x919b58ab
user32.dll.wvsprintfA|0x90eb58ab
user32.dll.wsprintfW|0xd19b608d
user32.dll.wsprintfA|0xd0eb608d
user32.dll.mouse_event|0x7511d147
user32.dll.keybd_event|0xe40df124
user32.dll.gapfnScSendMessage|0xe12f25d0
user32.dll.gSharedInfo|0xf4f298e0
user32.dll._UserTestTokenForInteractive|0xbac72bb4
user32.dll.Wow64Transition|0xc6415a0d
user32.dll.WindowFromPoint|0x134d94ca
user32.dll.WindowFromPhysicalPoint|0x5ea89d26
user32.dll.WindowFromDC|0xbf1cd67d
user32.dll.WinHelpW|0x25871a1d
user32.dll.WinHelpA|0x24d71a1d
user32.dll.WaitMessage|0xed853c8a
user32.dll.WaitForRedirectionStartComplete|0xefa061a3
user32.dll.WaitForInputIdle|0x084a4a9c
user32.dll.WINNLSGetIMEHotkey|0x9a5b81cf
user32.dll.WINNLSGetEnableStatus|0x49daa1c9
user32.dll.WINNLSEnableIME|0xbd62616e
user32.dll.WCSToMBEx|0x3e2844b0
user32.dll.VkKeyScanW|0x03b65138
user32.dll.VkKeyScanExW|0x3a34d6dc
user32.dll.VkKeyScanExA|0x3984d6dc
user32.dll.VkKeyScanA|0x03065138
user32.dll.ValidateRgn|0x44ba776b
user32.dll.ValidateRect|0xa64b3366
user32.dll.VTagOutput|0x37f6ab49
user32.dll.VRipOutput|0x3ff69c69
user32.dll.UserRegisterWowHandlers|0xa1174200
user32.dll.UserRealizePalette|0x0cc539e0
user32.dll.UserLpkTabbedTextOut|0x0da1cca1
user32.dll.UserLpkPSMTextOut|0xa999729d
user32.dll.UserHandleGrantAccess|0x7251e70c
user32.dll.UserClientDllInitialize|0x1af8e005
user32.dll.User32InitializeImmEntryTable|0xd5cd199e
user32.dll.UpdateWindowInputSinkHints|0x6ca119e2
user32.dll.UpdateWindow|0xb40eb6d6
user32.dll.UpdatePerUserSystemParameters|0x29289f94
user32.dll.UpdateLayeredWindowIndirect|0x57fd5b6d
user32.dll.UpdateLayeredWindow|0xa78480a5
user32.dll.UpdateDefaultDesktopThumbnail|0xd29edcd8
user32.dll.UnregisterUserApiHook|0x1430ab78
user32.dll.UnregisterTouchWindow|0xef2d9056
user32.dll.UnregisterSuspendResumeNotification|0x76f78318
user32.dll.UnregisterSessionPort|0x1571a137
user32.dll.UnregisterPowerSettingNotification|0x8204b596
user32.dll.UnregisterPointerInputTargetEx|0x85accb4e
user32.dll.UnregisterPointerInputTarget|0xcc50113c
user32.dll.UnregisterMessagePumpHook|0x234ee78a
user32.dll.UnregisterHotKey|0x25ac772b
user32.dll.UnregisterDeviceNotification|0x9eb4b3cd
user32.dll.UnregisterClassW|0xf4874aaa
user32.dll.UnregisterClassA|0xf3d74aaa
user32.dll.UnpackDDElParam|0xb7f8b016
user32.dll.UnlockWindowStation|0x68a8df3f
user32.dll.UnloadKeyboardLayout|0xa59275ff
user32.dll.UnionRect|0x2f748ef0
user32.dll.UnhookWindowsHookEx|0xec4888a7
user32.dll.UnhookWindowsHook|0x31ea8032
user32.dll.UnhookWinEvent|0x9052dc37
user32.dll.UndelegateInput|0xcb28a331
user32.dll.TranslateMessageEx|0xf2f06e71
user32.dll.TranslateMessage|0x56051fc9
user32.dll.TranslateMDISysAccel|0xa394b33d
user32.dll.TranslateAcceleratorW|0x0ff9cbfe
user32.dll.TranslateAcceleratorA|0x0f49cbfe
user32.dll.TranslateAccelerator|0x1775643e
user32.dll.TrackPopupMenuEx|0x0884ab26
user32.dll.TrackPopupMenu|0x2a5b70bc
user32.dll.TrackMouseEvent|0xa7a77129
user32.dll.ToUnicodeEx|0x700da78c
user32.dll.ToUnicode|0xc3f994ad
user32.dll.ToAsciiEx|0xb8a5ea6a
user32.dll.ToAscii|0x3d1bf5b9
user32.dll.TileWindows|0x7afe69ca
user32.dll.TileChildWindows|0xccfc1e07
user32.dll.TabbedTextOutW|0xa5f630ec
user32.dll.TabbedTextOutA|0xa54630ec
user32.dll.SystemParametersInfoW|0xcf123e60
user32.dll.SystemParametersInfoForDpi|0x6b9cabd4
user32.dll.SystemParametersInfoA|0xce623e60
user32.dll.SwitchToThisWindow|0x72378049
user32.dll.SwitchDesktopWithFade|0x180c9721
user32.dll.SwitchDesktop|0xf18094df
user32.dll.SwapMouseButton|0x22af949a
user32.dll.SubtractRect|0xb42f8b3b
user32.dll.SoundSentry|0x8dd55227
user32.dll.SoftModalMessageBox|0x9d6cae89
user32.dll.SkipPointerFrameMessages|0xbe8f0453
user32.dll.SignalRedirectionStartComplete|0x86c201f3
user32.dll.ShutdownBlockReasonQuery|0x11fe1c83
user32.dll.ShutdownBlockReasonDestroy|0xe2f7c5c6
user32.dll.ShutdownBlockReasonCreate|0x30599f02
user32.dll.ShowWindowAsync|0xa53f11ee
user32.dll.ShowWindow|0x6e2eebc2
user32.dll.ShowSystemCursor|0xbe7e4bcd
user32.dll.ShowStartGlass|0x8f727f01
user32.dll.ShowScrollBar|0xc8c4262c
user32.dll.ShowOwnedPopups|0x1e12e129
user32.dll.ShowCursor|0x8bb72bc8
user32.dll.ShowCaret|0xc395701a
user32.dll.SetWindowsHookW|0x5e727433
user32.dll.SetWindowsHookExW|0xe93d95b2
user32.dll.SetWindowsHookExA|0xe88d95b2
user32.dll.SetWindowsHookA|0x5dc27433
user32.dll.SetWindowWord|0xad5d887a
user32.dll.SetWindowTextW|0xbddddf3d
user32.dll.SetWindowTextA|0xbd2ddf3d
user32.dll.SetWindowStationUser|0x96f683c8
user32.dll.SetWindowRgnEx|0xaae5f37c
user32.dll.SetWindowRgn|0x84e4f5dd
user32.dll.SetWindowPos|0x810cf7dd
user32.dll.SetWindowPlacement|0x9a59c63c
user32.dll.SetWindowLongW|0xa9de7bf9
user32.dll.SetWindowLongA|0xa92e7bf9
user32.dll.SetWindowFeedbackSetting|0x1d706da3
user32.dll.SetWindowDisplayAffinity|0x3b18d23d
user32.dll.SetWindowContextHelpId|0x2b8fbfaa
user32.dll.SetWindowCompositionTransition|0xdd85a82d
user32.dll.SetWindowCompositionAttribute|0x96ba5af3
user32.dll.SetWindowBand|0x915c377a
user32.dll.SetWinEventHook|0x65fb0b09
user32.dll.SetUserObjectSecurity|0x340a3919
user32.dll.SetUserObjectInformationW|0xac193056
user32.dll.SetUserObjectInformationA|0xab693056
user32.dll.SetTimer|0x247756e3
user32.dll.SetThreadInputBlocked|0xf9648e90
user32.dll.SetThreadDpiHostingBehavior|0x145506c6
user32.dll.SetThreadDpiAwarenessContext|0x9e549f97
user32.dll.SetThreadDesktop|0xce6753f8
user32.dll.SetTaskmanWindow|0x2b69e8c5
user32.dll.SetSystemMenu|0x9ebd6974
user32.dll.SetSystemCursor|0x1cab23cb
user32.dll.SetSysColorsTemp|0x381c59e0
user32.dll.SetSysColors|0xce88293d
user32.dll.SetShellWindowEx|0x0731e613
user32.dll.SetShellWindow|0xde5625a7
user32.dll.SetShellChangeNotifyWindow|0x9c5825e2
user32.dll.SetScrollRange|0x3519bb9b
user32.dll.SetScrollPos|0xfb38285c
user32.dll.SetScrollInfo|0x2fa876d4
user32.dll.SetRectEmpty|0xbd7c2fa8
user32.dll.SetRect|0xc149e432
user32.dll.SetPropW|0x279fe9a1
user32.dll.SetPropA|0x26efe9a1
user32.dll.SetProgmanWindow|0x2961e9d4
user32.dll.SetProcessWindowStation|0x73793a92
user32.dll.SetProcessRestrictionExemption|0x318729c0
user32.dll.SetProcessDpiAwarenessInternal|0xe285c811
user32.dll.SetProcessDpiAwarenessContext|0x7d94d037
user32.dll.SetProcessDefaultLayout|0xaa79bff1
user32.dll.SetProcessDPIAware|0x89e7a0f8
user32.dll.SetPointerDeviceInputSpace|0xea2db807
user32.dll.SetPhysicalCursorPos|0x2f2aa1f0
user32.dll.SetParent|0xa5fa8309
user32.dll.SetMirrorRendering|0x1cf628ba
user32.dll.SetMessageQueue|0xfca34c19
user32.dll.SetMessageExtraInfo|0xff34fce0
user32.dll.SetMenuItemInfoW|0xbe36c7d7
user32.dll.SetMenuItemInfoA|0xbd86c7d7
user32.dll.SetMenuItemBitmaps|0x131e5bf2
user32.dll.SetMenuInfo|0xe0eef74c
user32.dll.SetMenuDefaultItem|0x6cee278e
user32.dll.SetMenuContextHelpId|0xfe1e5154
user32.dll.SetMenu|0xc15196f2
user32.dll.SetMagnificationLensCtxInformation|0xb8c17c3d
user32.dll.SetMagnificationDesktopSamplingMode|0x2676f828
user32.dll.SetMagnificationDesktopMagnifierOffsetsDWMUpdated|0xd1bd9601
user32.dll.SetMagnificationDesktopMagnification|0x33e67df4
user32.dll.SetMagnificationDesktopColorEffect|0x6bca8cbf
user32.dll.SetLayeredWindowAttributes|0x81b11445
user32.dll.SetLastErrorEx|0xc2bc964a
user32.dll.SetKeyboardState|0xe09a5ab7
user32.dll.SetInternalWindowPos|0x877559e7
user32.dll.SetGestureConfig|0x791a266a
user32.dll.SetForegroundWindow|0x9a1bc987
user32.dll.SetFocus|0x107fbadc
user32.dll.SetFeatureReportResponse|0xf2a4c419
user32.dll.SetDoubleClickTime|0xc559e6d8
user32.dll.SetDlgItemTextW|0xb55efb07
user32.dll.SetDlgItemTextA|0xb4aefb07
user32.dll.SetDlgItemInt|0x9af2fc0c
user32.dll.SetDisplayConfig|0x6699e129
user32.dll.SetDisplayAutoRotationPreferences|0x120a523b
user32.dll.SetDialogDpiChangeBehavior|0xab1ef96e
user32.dll.SetDialogControlDpiChangeBehavior|0x3a85fe41
user32.dll.SetDesktopColorTransform|0xf78b1b14
user32.dll.SetDeskWallpaper|0xbb946648
user32.dll.SetDebugErrorLevel|0x5c4646b1
user32.dll.SetCursorPos|0x8d48085d
user32.dll.SetCursorContents|0x9236c1d5
user32.dll.SetCursor|0xc1b68353
user32.dll.SetCoreWindow|0x9b9727ce
user32.dll.SetCoalescableTimer|0x23a993da
user32.dll.SetClipboardViewer|0x417bd91a
user32.dll.SetClipboardData|0xea8ef113
user32.dll.SetClassWord|0xc1ce56ff
user32.dll.SetClassLongW|0x1e071f80
user32.dll.SetClassLongA|0x1d571f80
user32.dll.SetCaretPos|0x9b21a904
user32.dll.SetCaretBlinkTime|0x66a82f52
user32.dll.SetCapture|0x14c72e06
user32.dll.SetActiveWindow|0x4ff689a5
user32.dll.SendNotifyMessageW|0xdf1fe180
user32.dll.SendNotifyMessageA|0xde6fe180
user32.dll.SendMessageW|0x1267fc3e
user32.dll.SendMessageTimeoutW|0x686f27ef
user32.dll.SendMessageTimeoutA|0x67bf27ef
user32.dll.SendMessageCallbackW|0x839e90a5
user32.dll.SendMessageCallbackA|0x82ee90a5
user32.dll.SendMessageA|0x11b7fc3e
user32.dll.SendInput|0xbc4a43fd
user32.dll.SendIMEMessageExW|0x98c6dcf5
user32.dll.SendIMEMessageExA|0x9816dcf5
user32.dll.SendDlgItemMessageW|0x9fac9d14
user32.dll.SendDlgItemMessageA|0x9efc9d14
user32.dll.ScrollWindowEx|0x6ef262a6
user32.dll.ScrollWindow|0x2bf5279a
user32.dll.ScrollDC|0xa0f77e70
user32.dll.ScrollChildren|0x508dba8a
user32.dll.ScreenToClient|0x87121da8
user32.dll.ReuseDDElParam|0x9298414a
user32.dll.ResolveDesktopForWOW|0x72ffeac7
user32.dll.ReportInertia|0xbcbb7ad7
user32.dll.ReplyMessage|0xb2a159ae
user32.dll.RemoveVisualIdentifier|0x37dd7cb4
user32.dll.RemoveThreadTSFEventAwareness|0xdecfe185
user32.dll.RemovePropW|0x840b53da
user32.dll.RemovePropA|0x835b53da
user32.dll.RemoveMenu|0x2e98c280
user32.dll.RemoveInjectionDevice|0x796a0bb8
user32.dll.RemoveClipboardFormatListener|0xf3056e55
user32.dll.ReleaseDwmHitTestWaiters|0x00eb83ab
user32.dll.ReleaseDC|0xa4c67f89
user32.dll.ReleaseCapture|0xb912ecc9
user32.dll.RegisterWindowMessageW|0x544048eb
user32.dll.RegisterWindowMessageA|0x539048eb
user32.dll.RegisterUserApiHook|0x3405eb71
user32.dll.RegisterTouchWindow|0x0f02d050
user32.dll.RegisterTouchHitTestingWindow|0xac549508
user32.dll.RegisterTasklist|0xb342bd44
user32.dll.RegisterSystemThread|0xd9b2ed95
user32.dll.RegisterSuspendResumeNotification|0xcbf76797
user32.dll.RegisterShellHookWindow|0xf96f33cd
user32.dll.RegisterSessionPort|0x3546e130
user32.dll.RegisterServicesProcess|0xc6342616
user32.dll.RegisterRawInputDevices|0x658aee4d
user32.dll.RegisterPowerSettingNotification|0x7e94a036
user32.dll.RegisterPointerInputTargetEx|0x2fac944d
user32.dll.RegisterPointerInputTarget|0xc6f81060
user32.dll.RegisterPointerDeviceNotifications|0x9b560a61
user32.dll.RegisterMessagePumpHook|0x774e7987
user32.dll.RegisterLogonProcess|0x638dd606
user32.dll.RegisterHotKey|0x6556f71d
user32.dll.RegisterGhostWindow|0x5ee8a1ce
user32.dll.RegisterFrostWindow|0xdee6a1d0
user32.dll.RegisterErrorReportingDialog|0xfe2dd9a3
user32.dll.RegisterDeviceNotificationW|0x8595db38
user32.dll.RegisterDeviceNotificationA|0x84e5db38
user32.dll.RegisterDManipHook|0xa5e08827
user32.dll.RegisterClipboardFormatW|0x6bc7904b
user32.dll.RegisterClipboardFormatA|0x6b17904b
user32.dll.RegisterClassW|0x3431ca9c
user32.dll.RegisterClassExW|0x59132fe8
user32.dll.RegisterClassExA|0x58632fe8
user32.dll.RegisterClassA|0x3381ca9c
user32.dll.RegisterBSDRWindow|0x72fb14a3
user32.dll.RedrawWindow|0xa0f940e6
user32.dll.RecordShutdownReason|0xc1ee737e
user32.dll.ReasonCodeNeedsComment|0x33f8b4b5
user32.dll.ReasonCodeNeedsBugID|0xda0217b8
user32.dll.RealGetWindowClassW|0xff5e3d4c
user32.dll.RealGetWindowClassA|0xfeae3d4c
user32.dll.RealGetWindowClass|0xa59f222a
user32.dll.RealChildWindowFromPoint|0x6ac8bbb2
user32.dll.RIMUpdateInputObserverRegistration|0xa2084b4c
user32.dll.RIMUnregisterForInput|0x58c87ce8
user32.dll.RIMSetTestModeStatus|0x6a0d3ee2
user32.dll.RIMSetExtendedDeviceProperty|0xa6c6cfa6
user32.dll.RIMRemoveInputObserver|0xc1ad4a4c
user32.dll.RIMRegisterForInput|0xc57f85db
user32.dll.RIMReadInput|0xfcdc3f91
user32.dll.RIMOnTimerNotification|0x75050ce1
user32.dll.RIMOnPnpNotification|0x1ba5a36e
user32.dll.RIMObserveNextInput|0x828796eb
user32.dll.RIMGetSourceProcessId|0x4c6bd19c
user32.dll.RIMGetPhysicalDeviceRect|0xb75c7795
user32.dll.RIMGetDevicePropertiesLockfree|0x5ed05417
user32.dll.RIMGetDeviceProperties|0xf73c8990
user32.dll.RIMGetDevicePreparsedDataLockfree|0x58801393
user32.dll.RIMGetDevicePreparsedData|0xa6fc0589
user32.dll.RIMFreeInputBuffer|0x3f937990
user32.dll.RIMEnableMonitorMappingForDevice|0x211734ad
user32.dll.RIMDeviceIoControl|0x5acaea2a
user32.dll.RIMAreSiblingDevices|0x6d52a928
user32.dll.RIMAddInputObserver|0xaa5ac3fd
user32.dll.QuerySendMessage|0xb6d0002a
user32.dll.QueryDisplayConfig|0x1aebf8d3
user32.dll.QueryBSDRWindow|0x56a21a48
user32.dll.PtInRect|0x10d9e850
user32.dll.PrivateRegisterICSProc|0xe9837980
user32.dll.PrivateExtractIconsW|0xf30247ab
user32.dll.PrivateExtractIconsA|0xf25247ab
user32.dll.PrivateExtractIconExW|0xcf60b0a4
user32.dll.PrivateExtractIconExA|0xceb0b0a4
user32.dll.PrintWindow|0x2dcef36a
user32.dll.PostThreadMessageW|0x9adc51b1
user32.dll.PostThreadMessageA|0x9a2c51b1
user32.dll.PostQuitMessage|0x26faffda
user32.dll.PostMessageW|0x527c7c0f
user32.dll.PostMessageA|0x51cc7c0f
user32.dll.PhysicalToLogicalPointForPerMonitorDPI|0x546f8631
user32.dll.PhysicalToLogicalPoint|0x4fa03fe8
user32.dll.PeekMessageW|0xd268340b
user32.dll.PeekMessageA|0xd1b8340b
user32.dll.PaintMonitor|0x9428cb8a
user32.dll.PaintMenuBar|0x3001880a
user32.dll.PaintDesktop|0x13f0ea6d
user32.dll.PackTouchHitTestingProximityEvaluation|0x04f3585e
user32.dll.PackDDElParam|0x07f6f80c
user32.dll.OpenWindowStationW|0xf0c5799c
user32.dll.OpenWindowStationA|0xf015799c
user32.dll.OpenThreadDesktop|0xce843e70
user32.dll.OpenInputDesktop|0x0b5bb60d
user32.dll.OpenIcon|0x0c195ad0
user32.dll.OpenDesktopW|0xd97f7eb7
user32.dll.OpenDesktopA|0xd8cf7eb7
user32.dll.OpenClipboard|0xcd43d9c5
user32.dll.OffsetRect|0xe74d1846
user32.dll.OemToCharW|0x658e700e
user32.dll.OemToCharBuffW|0x1dc37186
user32.dll.OemToCharBuffA|0x1d137186
user32.dll.OemToCharA|0x64de700e
user32.dll.OemKeyScan|0x6a1d1ac9
user32.dll.NotifyWinEvent|0x50c730f5
user32.dll.NotifyOverlayWindow|0x24a49717
user32.dll.MsgWaitForMultipleObjectsEx|0x7635485f
user32.dll.MsgWaitForMultipleObjects|0x10123331
user32.dll.MoveWindow|0xf52f2181
user32.dll.MonitorFromWindow|0x2983e7e5
user32.dll.MonitorFromRect|0x1f5f3ac5
user32.dll.MonitorFromPoint|0xd11aa9cb
user32.dll.ModifyMenuW|0x7c503b1b
user32.dll.ModifyMenuA|0x7ba03b1b
user32.dll.MessageBoxW|0x08068345
user32.dll.MessageBoxTimeoutW|0x1c4008ce
user32.dll.MessageBoxTimeoutA|0x1b9008ce
user32.dll.MessageBoxIndirectW|0x9788a074
user32.dll.MessageBoxIndirectA|0x96d8a074
user32.dll.MessageBoxExW|0x4e415a1d
user32.dll.MessageBoxExA|0x4d915a1d
user32.dll.MessageBoxA|0x07568345
user32.dll.MessageBeep|0xf4ce7e85
user32.dll.MenuWindowProcW|0x505ef315
user32.dll.MenuWindowProcA|0x4faef315
user32.dll.MenuItemFromPoint|0x611ec832
user32.dll.MapWindowPoints|0x1ac60686
user32.dll.MapVisualRelativePoints|0x032fc8cd
user32.dll.MapVirtualKeyW|0xa5824909
user32.dll.MapVirtualKeyExW|0xad32cb44
user32.dll.MapVirtualKeyExA|0xac82cb44
user32.dll.MapVirtualKeyA|0xa4d24909
user32.dll.MapPointsByVisualIdentifier|0x28da964e
user32.dll.MapDialogRect|0xc9d5356d
user32.dll.MakeThreadTSFEventAware|0x9cdcada1
user32.dll.MITSynthesizeTouchInput|0xf759ed29
user32.dll.MITSetLastInputRecipient|0x4b06cd7b
user32.dll.MITSetInputDelegationMode|0x8af015ee
user32.dll.MITSetForegroundRoutingInfo|0x557756c2
user32.dll.MITGetCursorUpdateHandle|0xb6bb2c1f
user32.dll.MB_GetString|0xee2227fa
user32.dll.MBToWCSExt|0x95140ced
user32.dll.MBToWCSEx|0x5f9354c4
user32.dll.LookupIconIdFromDirectoryEx|0xd97acb4d
user32.dll.LookupIconIdFromDirectory|0xc99f493c
user32.dll.LogicalToPhysicalPointForPerMonitorDPI|0x2e0e5554
user32.dll.LogicalToPhysicalPoint|0x1ec31987
user32.dll.LockWorkStation|0x268b59ff
user32.dll.LockWindowUpdate|0xbe35be8a
user32.dll.LockWindowStation|0x4d28343f
user32.dll.LockSetForegroundWindow|0x53cd4b4a
user32.dll.LoadStringW|0xf73a5d4e
user32.dll.LoadStringA|0xf68a5d4e
user32.dll.LoadRemoteFonts|0x336ce6df
user32.dll.LoadMenuW|0xc1617a5f
user32.dll.LoadMenuIndirectW|0xb241fb6b
user32.dll.LoadMenuIndirectA|0xb191fb6b
user32.dll.LoadMenuA|0xc0b17a5f
user32.dll.LoadLocalFonts|0x6eac683f
user32.dll.LoadKeyboardLayoutW|0xbddb7cdf
user32.dll.LoadKeyboardLayoutEx|0xd60efaae
user32.dll.LoadKeyboardLayoutA|0xbd2b7cdf
user32.dll.LoadImageW|0xa4f64ee2
user32.dll.LoadImageA|0xa4464ee2
user32.dll.LoadIconW|0xc361589d
user32.dll.LoadIconA|0xc2b1589d
user32.dll.LoadCursorW|0xf93efe0e
user32.dll.LoadCursorFromFileW|0x7689fe79
user32.dll.LoadCursorFromFileA|0x75d9fe79
user32.dll.LoadCursorA|0xf88efe0e
user32.dll.LoadBitmapW|0xdd0e9d6e
user32.dll.LoadBitmapA|0xdc5e9d6e
user32.dll.LoadAcceleratorsW|0xc10db4c8
user32.dll.LoadAcceleratorsA|0xc05db4c8
user32.dll.KillTimer|0x3a59afc3
user32.dll.IsZoomed|0x999fb8b0
user32.dll.IsWow64Message|0x6734ce00
user32.dll.IsWindowVisible|0xfe44a185
user32.dll.IsWindowUnicode|0x18583f60
user32.dll.IsWindowRedirectedForPrint|0x4d3662a2
user32.dll.IsWindowInDestroy|0xa1c8fa03
user32.dll.IsWindowEnabled|0x12502d9c
user32.dll.IsWindowArranged|0xdb95c393
user32.dll.IsWindow|0x882bab2d
user32.dll.IsWinEventHookInstalled|0x0cdb0945
user32.dll.IsValidDpiAwarenessContext|0x8efdccea
user32.dll.IsTouchWindow|0x87575919
user32.dll.IsTopLevelWindow|0x7c91b175
user32.dll.IsThreadTSFEventAware|0x732bac1e
user32.dll.IsThreadMessageQueueAttached|0x0feefe4e
user32.dll.IsThreadDesktopComposited|0xe2f7bc2a
user32.dll.IsServerSideWindow|0x51a7c377
user32.dll.IsSETEnabled|0x63d70f8e
user32.dll.IsRectEmpty|0x7d442a78
user32.dll.IsQueueAttached|0x1155f440
user32.dll.IsProcessDPIAware|0x7526a018
user32.dll.IsOneCoreTransformMode|0xafb62a7a
user32.dll.IsMouseInPointerEnabled|0xcf9fc09f
user32.dll.IsMenu|0x40e18c92
user32.dll.IsInDesktopWindowBand|0x4ddff850
user32.dll.IsImmersiveProcess|0xcc6b66b0
user32.dll.IsIconic|0x9b53b9aa
user32.dll.IsHungAppWindow|0xb40b8640
user32.dll.IsGUIThread|0xd61c1a89
user32.dll.IsDlgButtonChecked|0x6f4811be
user32.dll.IsDialogMessageW|0xe740252c
user32.dll.IsDialogMessageA|0xe690252c
user32.dll.IsDialogMessage|0xe29b3f26
user32.dll.IsClipboardFormatAvailable|0x09180963
user32.dll.IsChild|0x4903451a
user32.dll.IsCharUpperW|0xe20d1071
user32.dll.IsCharUpperA|0xe15d1071
user32.dll.IsCharLowerW|0x61e98071
user32.dll.IsCharLowerA|0x61398071
user32.dll.IsCharAlphaW|0xe7bd0c2f
user32.dll.IsCharAlphaNumericW|0xf511536a
user32.dll.IsCharAlphaNumericA|0xf461536a
user32.dll.IsCharAlphaA|0xe70d0c2f
user32.dll.InvertRect|0x77815685
user32.dll.InvalidateRgn|0x697a7e4b
user32.dll.InvalidateRect|0xdd4c5966
user32.dll.IntersectRect|0x99ad7d6c
user32.dll.InternalGetWindowText|0xadb2759d
user32.dll.InternalGetWindowIcon|0xa981c35d
user32.dll.InsertMenuW|0x3834b49b
user32.dll.InsertMenuItemW|0x000c3074
user32.dll.InsertMenuItemA|0xff5c3074
user32.dll.InsertMenuA|0x3784b49b
user32.dll.InjectTouchInput|0xc00dd0f0
user32.dll.InjectSyntheticPointerInput|0xc7ee0ab3
user32.dll.InjectPointerInput|0xf90caf75
user32.dll.InjectMouseInput|0x0001d2ef
user32.dll.InjectKeyboardInput|0xdaa49042
user32.dll.InjectGenericHidInput|0xf109b4ef
user32.dll.InjectDeviceInput|0x72c6f84c
user32.dll.InitializeTouchInjection|0x48dab974
user32.dll.InitializePointerDeviceInjectionEx|0x6c190af3
user32.dll.InitializePointerDeviceInjection|0x5fe9c23b
user32.dll.InitializeLpkHooks|0x655b901a
user32.dll.InitializeInputDeviceInjection|0x9f58323d
user32.dll.InitializeGenericHidInjection|0xefd21421
user32.dll.InitDManipHook|0x6dfcdd32
user32.dll.InheritWindowMonitor|0x4d378453
user32.dll.InflateRect|0x2e1b1607
user32.dll.InSendMessageEx|0xf103571b
user32.dll.InSendMessage|0x01fd6b6c
user32.dll.ImpersonateDdeClientWindow|0x1e1a7913
user32.dll.IMPSetIMEW|0x2063b4c5
user32.dll.IMPSetIMEA|0x1fb3b4c5
user32.dll.IMPQueryIMEW|0x8631db99
user32.dll.IMPQueryIMEA|0x8581db99
user32.dll.IMPGetIMEW|0x2063b345
user32.dll.IMPGetIMEA|0x1fb3b345
user32.dll.HungWindowFromGhostWindow|0xa1a2c85d
user32.dll.HiliteMenuItem|0xe18ba5d0
user32.dll.HideCaret|0xc44d16ba
user32.dll.HandleDelegatedInput|0xfa828ee9
user32.dll.GrayStringW|0xcc305d4e
user32.dll.GrayStringA|0xcb805d4e
user32.dll.GhostWindowFromHungWindow|0x9914afb2
user32.dll.GetWindowWord|0xa75d887a
user32.dll.GetWindowThreadProcessId|0x3ecdbfee
user32.dll.GetWindowTextW|0xbdddaf3d
user32.dll.GetWindowTextLengthW|0x17fa58e4
user32.dll.GetWindowTextLengthA|0x174a58e4
user32.dll.GetWindowTextA|0xbd2daf3d
user32.dll.GetWindowRgnEx|0xaae5c37c
user32.dll.GetWindowRgnBox|0x04f66541
user32.dll.GetWindowRgn|0x84e4f51d
user32.dll.GetWindowRect|0x93dd34ba
user32.dll.GetWindowProcessHandle|0xd519e843
user32.dll.GetWindowPlacement|0x9759c63c
user32.dll.GetWindowModuleFileNameW|0x02827382
user32.dll.GetWindowModuleFileNameA|0x01d27382
user32.dll.GetWindowModuleFileName|0x2c65e28f
user32.dll.GetWindowMinimizeRect|0x51475b32
user32.dll.GetWindowLongW|0xa9de4bf9
user32.dll.GetWindowLongA|0xa92e4bf9
user32.dll.GetWindowInfo|0xa5b4a57a
user32.dll.GetWindowFeedbackSetting|0x1d7061a3
user32.dll.GetWindowDpiHostingBehavior|0xf474af9f
user32.dll.GetWindowDpiAwarenessContext|0xe51ba094
user32.dll.GetWindowDisplayAffinity|0x3b18c63d
user32.dll.GetWindowDC|0x7b794f44
user32.dll.GetWindowContextHelpId|0x2b8fbf7a
user32.dll.GetWindowCompositionInfo|0x54f00b24
user32.dll.GetWindowCompositionAttribute|0x96ba54f3
user32.dll.GetWindowBand|0x8b5c377a
user32.dll.GetWindow|0xa42de34d
user32.dll.GetWinStationInfo|0xfcd8c4f4
user32.dll.GetUserObjectSecurity|0x34043919
user32.dll.GetUserObjectInformationW|0x4c193056
user32.dll.GetUserObjectInformationA|0x4b693056
user32.dll.GetUpdatedClipboardFormats|0x72b6f201
user32.dll.GetUpdateRgn|0x0bd7c3e0
user32.dll.GetUpdateRect|0x09f16c51
user32.dll.GetUnpredictedMessagePos|0x2eaf819c
user32.dll.GetTouchInputInfo|0xfa0ffa44
user32.dll.GetTopWindow|0xaef84f5a
user32.dll.GetTopLevelWindow|0x9cadb3ad
user32.dll.GetTitleBarInfo|0x52e84c38
user32.dll.GetThreadDpiHostingBehavior|0x145506ae
user32.dll.GetThreadDpiAwarenessContext|0x9d949f97
user32.dll.GetThreadDesktop|0xce5b53f8
user32.dll.GetTaskmanWindow|0x2b5de8c5
user32.dll.GetTabbedTextExtentW|0x873e31bd
user32.dll.GetTabbedTextExtentA|0x868e31bd
user32.dll.GetSystemMetricsForDpi|0x07cc18a5
user32.dll.GetSystemMetrics|0x00f5e32d
user32.dll.GetSystemMenu|0x98bd6974
user32.dll.GetSystemDpiForProcess|0x553555aa
user32.dll.GetSysColorBrush|0xd7d23b47
user32.dll.GetSysColor|0xe3055bf3
user32.dll.GetSubMenu|0xf594befc
user32.dll.GetShellWindow|0xde55f5a7
user32.dll.GetShellChangeNotifyWindow|0x9c5525e2
user32.dll.GetSendMessageReceiver|0xa95144d2
user32.dll.GetScrollRange|0x35198b9b
user32.dll.GetScrollPos|0xfb38279c
user32.dll.GetScrollInfo|0x29a876d4
user32.dll.GetScrollBarInfo|0xc9c1892a
user32.dll.GetRegisteredRawInputDevices|0xac30382a
user32.dll.GetReasonTitleFromReasonCode|0x2b68d2c1
user32.dll.GetRawPointerDeviceData|0x50dbb7b3
user32.dll.GetRawInputDeviceList|0x7d49dd64
user32.dll.GetRawInputDeviceInfoW|0x3f2d4960
user32.dll.GetRawInputDeviceInfoA|0x3e7d4960
user32.dll.GetRawInputData|0x01b6ed5a
user32.dll.GetRawInputBuffer|0xe92afaa5
user32.dll.GetQueueStatus|0xc7212650
user32.dll.GetPropW|0x1b9fe9a1
user32.dll.GetPropA|0x1aefe9a1
user32.dll.GetProgmanWindow|0x2955e9d4
user32.dll.GetProcessWindowStation|0x71f93a92
user32.dll.GetProcessUIContextInformation|0xfe3803e2
user32.dll.GetProcessDpiAwarenessInternal|0xb285c811
user32.dll.GetProcessDefaultLayout|0xa8f9bff1
user32.dll.GetPriorityClipboardFormat|0x55194267
user32.dll.GetPointerType|0x49f676ee
user32.dll.GetPointerTouchInfoHistory|0x8276b292
user32.dll.GetPointerTouchInfo|0xf3783638
user32.dll.GetPointerPenInfoHistory|0xd0489c13
user32.dll.GetPointerPenInfo|0xfde6c584
user32.dll.GetPointerInputTransform|0x57d31355
user32.dll.GetPointerInfoHistory|0x9c28795a
user32.dll.GetPointerInfo|0x3445c46e
user32.dll.GetPointerFrameTouchInfoHistory|0xa816a716
user32.dll.GetPointerFrameTouchInfo|0x14a535dc
user32.dll.GetPointerFrameTimes|0x9a9c72d6
user32.dll.GetPointerFramePenInfoHistory|0xe0df1be5
user32.dll.GetPointerFramePenInfo|0x8e6b7982
user32.dll.GetPointerFrameInfoHistory|0xe7686262
user32.dll.GetPointerFrameInfo|0x769fc3b6
user32.dll.GetPointerFrameArrivalTimes|0x25ebb509
user32.dll.GetPointerDevices|0xe808c3c7
user32.dll.GetPointerDeviceRects|0xbdde0d27
user32.dll.GetPointerDeviceProperties|0x395f17f9
user32.dll.GetPointerDeviceOrientation|0x2b915b62
user32.dll.GetPointerDeviceCursors|0x6143bf72
user32.dll.GetPointerDevice|0xf66e9f24
user32.dll.GetPointerCursorId|0x25a1081e
user32.dll.GetPhysicalCursorPos|0x6f2aa1ef
user32.dll.GetParent|0xa5fa2309
user32.dll.GetOpenClipboardWindow|0x63158abd
user32.dll.GetNextDlgTabItem|0xf9d2f6a2
user32.dll.GetNextDlgGroupItem|0x05bc0638
user32.dll.GetMouseMovePointsEx|0x0e4ec599
user32.dll.GetMonitorInfoW|0x517a8b92
user32.dll.GetMonitorInfoA|0x50ca8b92
user32.dll.GetMessageW|0xd22c770b
user32.dll.GetMessageTime|0x2ef8c3c5
user32.dll.GetMessagePos|0xee9e498f
user32.dll.GetMessageExtraInfo|0xff34e4e0
user32.dll.GetMessageA|0xd17c770b
user32.dll.GetMenuStringW|0xbabde88b
user32.dll.GetMenuStringA|0xba0de88b
user32.dll.GetMenuState|0x9ee0784f
user32.dll.GetMenuItemRect|0x25192944
user32.dll.GetMenuItemInfoW|0xbe2ac7d7
user32.dll.GetMenuItemInfoA|0xbd7ac7d7
user32.dll.GetMenuItemID|0xa1c64056
user32.dll.GetMenuItemCount|0xdd12d794
user32.dll.GetMenuInfo|0xe0d6f74c
user32.dll.GetMenuDefaultItem|0x69ee278e
user32.dll.GetMenuContextHelpId|0x3e1e5153
user32.dll.GetMenuCheckMarkDimensions|0xf00e9b37
user32.dll.GetMenuBarInfo|0xbb2fe62b
user32.dll.GetMenu|0xc1519572
user32.dll.GetMagnificationLensCtxInformation|0xb8c1793d
user32.dll.GetMagnificationDesktopSamplingMode|0x0e76f828
user32.dll.GetMagnificationDesktopMagnification|0x33e5bdf4
user32.dll.GetMagnificationDesktopColorEffect|0x6bca89bf
user32.dll.GetListBoxInfo|0xba660e2f
user32.dll.GetLayeredWindowAttributes|0x81ae1445
user32.dll.GetLastInputInfo|0x089276cd
user32.dll.GetLastActivePopup|0xcc66eb8b
user32.dll.GetKeyboardType|0xb2d4b202
user32.dll.GetKeyboardState|0xe08e5ab7
user32.dll.GetKeyboardLayoutNameW|0xf3114632
user32.dll.GetKeyboardLayoutNameA|0xf2614632
user32.dll.GetKeyboardLayoutList|0x1733c221
user32.dll.GetKeyboardLayout|0x3a9598bc
user32.dll.GetKeyState|0xc4b5aabb
user32.dll.GetKeyNameTextW|0xa231247a
user32.dll.GetKeyNameTextA|0xa181247a
user32.dll.GetKBCodePage|0x6037df0e
user32.dll.GetInternalWindowPos|0xc77559e6
user32.dll.GetInputState|0x0d7b8305
user32.dll.GetInputLocaleInfo|0x215e9140
user32.dll.GetInputDesktop|0xee0cb607
user32.dll.GetIconInfoExW|0xe19e5384
user32.dll.GetIconInfoExA|0xe0ee5384
user32.dll.GetIconInfo|0x5cdaf709
user32.dll.GetGuiResources|0xfd5a1147
user32.dll.GetGestureInfo|0x3a681485
user32.dll.GetGestureExtraArgs|0x07e46660
user32.dll.GetGestureConfig|0x790e266a
user32.dll.GetGUIThreadInfo|0x096f6c9d
user32.dll.GetForegroundWindow|0x9a1bb187
user32.dll.GetFocus|0x047fbadc
user32.dll.GetExtendedPointerDeviceProperty|0xbf459ac3
user32.dll.GetDpiFromDpiAwarenessContext|0x09efc46b
user32.dll.GetDpiForWindow|0x090f7371
user32.dll.GetDpiForSystem|0x28afc0f9
user32.dll.GetDpiForMonitorInternal|0x52ea5810
user32.dll.GetDpiAwarenessContextForProcess|0x31a89541
user32.dll.GetDoubleClickTime|0xc259e6d8
user32.dll.GetDlgItemTextW|0x355efb06
user32.dll.GetDlgItemTextA|0x34aefb06
user32.dll.GetDlgItemInt|0x94f2fc0c
user32.dll.GetDlgItem|0x93307ade
user32.dll.GetDlgCtrlID|0x3a1004c0
user32.dll.GetDisplayConfigBufferSizes|0x92a16ffa
user32.dll.GetDisplayAutoRotationPreferences|0x11aa523b
user32.dll.GetDialogDpiChangeBehavior|0xab1bf96e
user32.dll.GetDialogControlDpiChangeBehavior|0x3a25fe41
user32.dll.GetDialogBaseUnits|0x2dd96a6e
user32.dll.GetDesktopWindow|0x315e2145
user32.dll.GetDesktopID|0x3bafd640
user32.dll.GetDCEx|0x7d68fb32
user32.dll.GetDC|0x5c2f01fc
user32.dll.GetCursorPos|0x8d48079d
user32.dll.GetCursorInfo|0x29b50753
user32.dll.GetCursorFrameInfo|0xf1576528
user32.dll.GetCursor|0xc1b62353
user32.dll.GetCurrentInputMessageSource|0x66a7d7f7
user32.dll.GetComboBoxInfo|0x9d2bfb29
user32.dll.GetClipboardViewer|0x3e7bd91a
user32.dll.GetClipboardSequenceNumber|0xde27d6eb
user32.dll.GetClipboardOwner|0xeb81c56f
user32.dll.GetClipboardFormatNameW|0x6aeccde2
user32.dll.GetClipboardFormatNameA|0x6a3ccde2
user32.dll.GetClipboardData|0xea82f113
user32.dll.GetClipboardAccessToken|0x5f973822
user32.dll.GetClipCursor|0xaa1f5134
user32.dll.GetClientRect|0x0ed94cd4
user32.dll.GetClassWord|0xc1ce563f
user32.dll.GetClassNameW|0x16063f01
user32.dll.GetClassNameA|0x15563f01
user32.dll.GetClassLongW|0x18071f80
user32.dll.GetClassLongA|0x17571f80
user32.dll.GetClassInfoW|0x8807117e
user32.dll.GetClassInfoExW|0x4e64e87d
user32.dll.GetClassInfoExA|0x4db4e87d
user32.dll.GetClassInfoA|0x8757117e
user32.dll.GetCaretPos|0x9b09a904
user32.dll.GetCaretBlinkTime|0x66a82ef2
user32.dll.GetCapture|0x14c72e03
user32.dll.GetCIMSSM|0x808bcc3d
user32.dll.GetAwarenessFromDpiAwarenessContext|0x37a71d62
user32.dll.GetAutoRotationState|0x195b3b06
user32.dll.GetAsyncKeyState|0xc5e1f9fa
user32.dll.GetAppCompatFlags2|0xced623ca
user32.dll.GetAppCompatFlags|0xa26efc3e
user32.dll.GetAncestor|0xe0c59aa4
user32.dll.GetAltTabInfoW|0xc95e6c38
user32.dll.GetAltTabInfoA|0xc8ae6c38
user32.dll.GetAltTabInfo|0xab7cbb6a
user32.dll.GetActiveWindow|0xcff689a3
user32.dll.FrostCrashedWindow|0xf861c429
user32.dll.FreeDDElParam|0x82faf91a
user32.dll.FrameRect|0xb36c15eb
user32.dll.FlashWindowEx|0x2054f648
user32.dll.FlashWindow|0xb2bab1e8
user32.dll.FindWindowW|0x790279ca
user32.dll.FindWindowExW|0x8d3efb79
user32.dll.FindWindowExA|0x8c8efb79
user32.dll.FindWindowA|0x785279ca
user32.dll.FillRect|0x0765e6ef
user32.dll.ExitWindowsEx|0xe9bcefad
user32.dll.ExcludeUpdateRgn|0x821c52cb
user32.dll.EvaluateProximityToRect|0x0ed37015
user32.dll.EvaluateProximityToPolygon|0xbde291fb
user32.dll.EqualRect|0x323c106f
user32.dll.EnumWindows|0xc2e0b1cb
user32.dll.EnumWindowStationsW|0xba6f89fe
user32.dll.EnumWindowStationsA|0xb9bf89fe
user32.dll.EnumThreadWindows|0x44a9ce80
user32.dll.EnumPropsW|0x8b132b83
user32.dll.EnumPropsExW|0x116b69be
user32.dll.EnumPropsExA|0x10bb69be
user32.dll.EnumPropsA|0x8a632b83
user32.dll.EnumDisplaySettingsW|0xafeaf6a5
user32.dll.EnumDisplaySettingsExW|0x475e3247
user32.dll.EnumDisplaySettingsExA|0x46ae3247
user32.dll.EnumDisplaySettingsA|0xaf3af6a5
user32.dll.EnumDisplayMonitors|0xb8b30c36
user32.dll.EnumDisplayDevicesW|0x9af1fb36
user32.dll.EnumDisplayDevicesA|0x9a41fb36
user32.dll.EnumDesktopsW|0x9ee7e32e
user32.dll.EnumDesktopsA|0x9e37e32e
user32.dll.EnumDesktopWindows|0x2a629c7b
user32.dll.EnumClipboardFormats|0x83d2b084
user32.dll.EnumChildWindows|0x70ed4208
user32.dll.EnterReaderModeHelper|0xc765f4f2
user32.dll.EndTask|0xb926066a
user32.dll.EndPaint|0x0e46da41
user32.dll.EndMenu|0xc175952a
user32.dll.EndDialog|0xbc61014d
user32.dll.EndDeferWindowPosEx|0x70ab4c88
user32.dll.EndDeferWindowPos|0xb3fc0b41
user32.dll.EnableWindow|0xec0abdd5
user32.dll.EnableSessionForMMCSS|0x95d4e45c
user32.dll.EnableScrollBar|0xefbfddd0
user32.dll.EnableOneCoreTransformMode|0x2c00cc0a
user32.dll.EnableNonClientDpiScaling|0x05a2c0e9
user32.dll.EnableMouseInPointer|0x4e7a06d8
user32.dll.EnableMenuItem|0xe3fd991e
user32.dll.EmptyClipboard|0x9c62edc8
user32.dll.EditWndProc|0x4f730fc4
user32.dll.DwmValidateWindow|0x84f91274
user32.dll.DwmLockScreenUpdates|0x73879fa5
user32.dll.DwmKernelStartup|0x5214cb24
user32.dll.DwmKernelShutdown|0x3c32a13a
user32.dll.DwmGetRemoteSessionOcclusionState|0xddb5d3bf
user32.dll.DwmGetRemoteSessionOcclusionEvent|0xe62df238
user32.dll.DwmGetDxSharedSurface|0xc9b11006
user32.dll.DwmGetDxRgn|0xa2e3af78
user32.dll.DrawTextW|0x58ad3a23
user32.dll.DrawTextExW|0x77ef11b1
user32.dll.DrawTextExA|0x773f11b1
user32.dll.DrawTextA|0x57fd3a23
user32.dll.DrawStateW|0x3f1e6944
user32.dll.DrawStateA|0x3e6e6944
user32.dll.DrawMenuBarTemp|0x27394424
user32.dll.DrawMenuBar|0x72c71b0c
user32.dll.DrawIconEx|0xb3ff413b
user32.dll.DrawIcon|0x81095b14
user32.dll.DrawFrameControl|0xfce0f5b7
user32.dll.DrawFrame|0x2b1e085c
user32.dll.DrawFocusRect|0x934e1d70
user32.dll.DrawEdge|0x82c11914
user32.dll.DrawCaptionTempW|0xb612433d
user32.dll.DrawCaptionTempA|0xb562433d
user32.dll.DrawCaption|0xc0970d4d
user32.dll.DrawAnimatedRects|0xb30807c9
user32.dll.DragObject|0x21f6f6bb
user32.dll.DragDetect|0xa1cb96bc
user32.dll.DoSoundDisconnect|0xd02fb34b
user32.dll.DoSoundConnect|0x9dd6277d
user32.dll.DlgDirSelectExW|0x99ba58ef
user32.dll.DlgDirSelectExA|0x990a58ef
user32.dll.DlgDirSelectComboBoxExW|0x397ca6a6
user32.dll.DlgDirSelectComboBoxExA|0x38cca6a6
user32.dll.DlgDirListW|0x2122933a
user32.dll.DlgDirListComboBoxW|0x25835ea3
user32.dll.DlgDirListComboBoxA|0x24d35ea3
user32.dll.DlgDirListA|0x2072933a
user32.dll.DisplayExitWindowsWarnings|0x07111b5c
user32.dll.DisplayConfigSetDeviceInfo|0x15eea045
user32.dll.DisplayConfigGetDeviceInfo|0x0feea045
user32.dll.DispatchMessageW|0xaacbe928
user32.dll.DispatchMessageA|0xaa1be928
user32.dll.DisableProcessWindowsGhosting|0x9524e5c3
user32.dll.DialogBoxParamW|0x1871a62c
user32.dll.DialogBoxParamA|0x17c1a62c
user32.dll.DialogBoxIndirectParamW|0x35c69ef0
user32.dll.DialogBoxIndirectParamAorW|0x034ec955
user32.dll.DialogBoxIndirectParamA|0x35169ef0
user32.dll.DestroyWindow|0xd115425a
user32.dll.DestroySyntheticPointerDevice|0x16665989
user32.dll.DestroyReasons|0x81b08616
user32.dll.DestroyMenu|0xf60532ef
user32.dll.DestroyIcon|0xf1ccf32e
user32.dll.DestroyDCompositionHwndTarget|0xba8c6651
user32.dll.DestroyCursor|0xee9d8260
user32.dll.DestroyCaret|0x8e687c77
user32.dll.DestroyAcceleratorTable|0xa710de2f
user32.dll.DeregisterShellHookWindow|0x1d6f98cf
user32.dll.DeleteMenu|0xad90c13c
user32.dll.DelegateInput|0x1b26eb27
user32.dll.DeferWindowPosAndBand|0xe899eb52
user32.dll.DeferWindowPos|0x338e090d
user32.dll.DefWindowProcW|0xabde6e1b
user32.dll.DefWindowProcA|0xab2e6e1b
user32.dll.DefRawInputProc|0xbcc7ac19
user32.dll.DefMDIChildProcW|0xc4bac39e
user32.dll.DefMDIChildProcA|0xc40ac39e
user32.dll.DefFrameProcW|0xd8337dc2
user32.dll.DefFrameProcA|0xd7837dc2
user32.dll.DefDlgProcW|0x58f7175a
user32.dll.DefDlgProcA|0x5847175a
user32.dll.DdeUninitialize|0xa544937c
user32.dll.DdeUnaccessData|0x8f49b823
user32.dll.DdeSetUserHandle|0x8e10dcbb
user32.dll.DdeSetQualityOfService|0xaf83d1a5
user32.dll.DdeReconnect|0x673e3a89
user32.dll.DdeQueryStringW|0x3f0e7a64
user32.dll.DdeQueryStringA|0x3e5e7a64
user32.dll.DdeQueryNextServer|0xbfcfef29
user32.dll.DdeQueryConvInfo|0x3fd8bbed
user32.dll.DdePostAdvise|0x5e11aa9f
user32.dll.DdeNameService|0xa074a29a
user32.dll.DdeKeepStringHandle|0x1e98156b
user32.dll.DdeInitializeW|0x10e9b5db
user32.dll.DdeInitializeA|0x1039b5db
user32.dll.DdeImpersonateClient|0x4853c6d5
user32.dll.DdeGetQualityOfService|0xaf83b9a5
user32.dll.DdeGetLastError|0x6fc5dfb1
user32.dll.DdeGetData|0x1db42704
user32.dll.DdeFreeStringHandle|0xb913156c
user32.dll.DdeFreeDataHandle|0x8c91d0b7
user32.dll.DdeEnableCallback|0xd44b2a46
user32.dll.DdeDisconnectList|0xccf013eb
user32.dll.DdeDisconnect|0x5740f481
user32.dll.DdeCreateStringHandleW|0x8ccf98f7
user32.dll.DdeCreateStringHandleA|0x8c1f98f7
user32.dll.DdeCreateDataHandle|0x3cf1d6b1
user32.dll.DdeConnectList|0x29cc10df
user32.dll.DdeConnect|0x2676c241
user32.dll.DdeCmpStringHandles|0x59dfc5e0
user32.dll.DdeClientTransaction|0xe86578b0
user32.dll.DdeAddData|0x1db0263c
user32.dll.DdeAccessData|0xfeb62903
user32.dll.DdeAbandonTransaction|0x7ffc774b
user32.dll.CtxInitUser32|0x246e83a5
user32.dll.CsrBroadcastSystemMessageExW|0x7da4d1f1
user32.dll.CreateWindowStationW|0x06555d28
user32.dll.CreateWindowStationA|0x05a55d28
user32.dll.CreateWindowIndirect|0x6949e9a2
user32.dll.CreateWindowInBandEx|0x66e1a21e
user32.dll.CreateWindowInBand|0x0bd4e498
user32.dll.CreateWindowExW|0x3cccc302
user32.dll.CreateWindowExA|0x3c1cc302
user32.dll.CreateSystemThreads|0xed9b6175
user32.dll.CreateSyntheticPointerDevice|0x89c27c86
user32.dll.CreatePopupMenu|0x03fde8c3
user32.dll.CreateMenu|0x669128bc
user32.dll.CreateMDIWindowW|0xcf03c511
user32.dll.CreateMDIWindowA|0xce53c511
user32.dll.CreateIconIndirect|0xaeb82fd5
user32.dll.CreateIconFromResourceEx|0x0fa9c8f8
user32.dll.CreateIconFromResource|0x72780533
user32.dll.CreateIcon|0x6258e8fc
user32.dll.CreateDialogParamW|0x4b8c211e
user32.dll.CreateDialogParamA|0x4adc211e
user32.dll.CreateDialogIndirectParamW|0x27f9b96b
user32.dll.CreateDialogIndirectParamAorW|0xf9332f8a
user32.dll.CreateDialogIndirectParamA|0x2749b96b
user32.dll.CreateDesktopW|0xd262441b
user32.dll.CreateDesktopExW|0xe5318fcf
user32.dll.CreateDesktopExA|0xe4818fcf
user32.dll.CreateDesktopA|0xd1b2441b
user32.dll.CreateDCompositionHwndTarget|0x2de8894f
user32.dll.CreateCursor|0x119af5bd
user32.dll.CreateCaret|0x3cd400d7
user32.dll.CreateAcceleratorTableW|0xc63e8ed4
user32.dll.CreateAcceleratorTableA|0xc58e8ed4
user32.dll.CountClipboardFormats|0x22343ebf
user32.dll.CopyRect|0x8475e7b5
user32.dll.CopyImage|0xa825b0bd
user32.dll.CopyIcon|0x80455ab5
user32.dll.CopyAcceleratorTableW|0xa2cd850d
user32.dll.CopyAcceleratorTableA|0xa21d850d
user32.dll.ControlMagnification|0x8259e9c7
user32.dll.ConsoleControl|0x389e782c
user32.dll.CloseWindowStation|0x5de81d41
user32.dll.CloseWindow|0xb2b52188
user32.dll.CloseTouchInputHandle|0x22ad6662
user32.dll.CloseGestureInfoHandle|0x898ada75
user32.dll.CloseDesktop|0x8507119e
user32.dll.CloseClipboard|0x9be0e5b3
user32.dll.ClipCursor|0x85b74ae4
user32.dll.ClientToScreen|0x4ba29ad6
user32.dll.ClientThreadSetup|0x1c4047e2
user32.dll.CliImmSetHotKey|0x475e5584
user32.dll.ChildWindowFromPointEx|0xee4287b2
user32.dll.ChildWindowFromPoint|0x5df2682e
user32.dll.CheckWindowThreadDesktop|0xe5ead604
user32.dll.CheckRadioButton|0x39fbc589
user32.dll.CheckProcessSession|0xb04a5f71
user32.dll.CheckProcessForClipboardAccess|0xea6c8b43
user32.dll.CheckMenuRadioItem|0x98a69c8a
user32.dll.CheckMenuItem|0x8e82b58c
user32.dll.CheckDlgButton|0xbf593c1e
user32.dll.CheckDBCSEnabledExt|0x3e7518c2
user32.dll.CheckBannedOneCoreTransformApi|0xcba64fe7
user32.dll.CharUpperW|0xe1270be1
user32.dll.CharUpperBuffW|0xa780a93f
user32.dll.CharUpperBuffA|0xa6d0a93f
user32.dll.CharUpperA|0xe0770be1
user32.dll.CharToOemW|0x6120faa1
user32.dll.CharToOemBuffW|0x466ca13f
user32.dll.CharToOemBuffA|0x45bca13f
user32.dll.CharToOemA|0x6070faa1
user32.dll.CharPrevW|0x289a02a1
user32.dll.CharPrevExA|0x72713125
user32.dll.CharPrevA|0x27ea02a1
user32.dll.CharNextW|0x4e993220
user32.dll.CharNextExA|0xf23d10ef
user32.dll.CharNextA|0x4de93220
user32.dll.CharLowerW|0x61037be1
user32.dll.CharLowerBuffW|0x6e80a13d
user32.dll.CharLowerBuffA|0x6dd0a13d
user32.dll.CharLowerA|0x60537be1
user32.dll.ChangeWindowMessageFilterEx|0x7a6ba262
user32.dll.ChangeWindowMessageFilter|0x1c230c99
user32.dll.ChangeMenuW|0xc0ec2339
user32.dll.ChangeMenuA|0xc03c2339
user32.dll.ChangeDisplaySettingsW|0x6c9ef773
user32.dll.ChangeDisplaySettingsExW|0x745e65b6
user32.dll.ChangeDisplaySettingsExA|0x73ae65b6
user32.dll.ChangeDisplaySettingsA|0x6beef773
user32.dll.ChangeClipboardChain|0x39a3a7a4
user32.dll.CascadeWindows|0xab9d3cf8
user32.dll.CascadeChildWindows|0xe54b879e
user32.dll.CancelShutdown|0x99a57ecc
user32.dll.CallWindowProcW|0x0f5ee284
user32.dll.CallWindowProcA|0x0eaee284
user32.dll.CallNextHookEx|0x7653eba4
user32.dll.CallMsgFilterW|0x98d0b122
user32.dll.CallMsgFilterA|0x9820b122
user32.dll.CallMsgFilter|0xf419f559
user32.dll.CalculatePopupWindowPosition|0x24dc4087
user32.dll.CalcMenuBar|0x1ec57308
user32.dll.BuildReasonArray|0xe5829981
user32.dll.BroadcastSystemMessageW|0xc0b2df20
user32.dll.BroadcastSystemMessageExW|0x7958510b
user32.dll.BroadcastSystemMessageExA|0x78a8510b
user32.dll.BroadcastSystemMessageA|0xc002df20
user32.dll.BroadcastSystemMessage|0x39d9ba55
user32.dll.BringWindowToTop|0xbb68d53b
user32.dll.BlockInput|0x46670aae
user32.dll.BeginPaint|0xb07201b1
user32.dll.BeginDeferWindowPos|0x0d379053
user32.dll.AttachThreadInput|0x6ee8c70e
user32.dll.ArrangeIconicWindows|0xeaa4d314
user32.dll.AreDpiAwarenessContextsEqual|0xb6cfec37
user32.dll.AppendMenuW|0xb7e49c1b
user32.dll.AppendMenuA|0xb7349c1b
user32.dll.AnyPopup|0x187bbc01
user32.dll.AnimateWindow|0x1480b869
user32.dll.AllowSetForegroundWindow|0x17d38c3f
user32.dll.AllowForegroundActivation|0x0b50b3d3
user32.dll.AlignRects|0x666a7af2
user32.dll.AdjustWindowRectExForDpi|0x12b0fb4d
user32.dll.AdjustWindowRectEx|0x399fe5e6
user32.dll.AdjustWindowRect|0x2b1fdda7
user32.dll.AddVisualIdentifier|0x632a9f5d
user32.dll.AddClipboardFormatListener|0x5ca9c37a
user32.dll.ActivateKeyboardLayout|0xb856ec95
wininet.dll._GetFileExtensionFromUrl|0x1b29113a
wininet.dll.UrlZonesDetach|0x2b3ec927
wininet.dll.UrlCacheUpdateEntryExtraData|0xf05d0ca8
wininet.dll.UrlCacheSetGlobalLimit|0x7379a359
wininet.dll.UrlCacheServer|0xd89c4fe4
wininet.dll.UrlCacheRetrieveEntryStream|0x789c85eb
wininet.dll.UrlCacheRetrieveEntryFile|0x3fe9dcd2
wininet.dll.UrlCacheReloadSettings|0xa6e146eb
wininet.dll.UrlCacheReadEntryStream|0x0bf4e005
wininet.dll.UrlCacheGetGlobalLimit|0x73797359
wininet.dll.UrlCacheGetGlobalCacheSize|0x811dbb05
wininet.dll.UrlCacheGetEntryInfo|0x542301ec
wininet.dll.UrlCacheGetContentPaths|0xc77bce42
wininet.dll.UrlCacheFreeGlobalSpace|0x761cc982
wininet.dll.UrlCacheFreeEntryInfo|0xea8f6d8b
wininet.dll.UrlCacheFindNextEntry|0xadfc0861
wininet.dll.UrlCacheFindFirstEntry|0x93fb936d
wininet.dll.UrlCacheCreateContainer|0x7dfcfb67
wininet.dll.UrlCacheContainerSetEntryMaximumAge|0x416ce370
wininet.dll.UrlCacheCloseEntryHandle|0xb732a3a1
wininet.dll.UrlCacheCheckEntriesExist|0x1c5d2622
wininet.dll.UpdateUrlCacheContentPath|0xf734e238
wininet.dll.UnlockUrlCacheEntryStream|0x1deeae30
wininet.dll.UnlockUrlCacheEntryFileW|0xfcc4f97c
wininet.dll.UnlockUrlCacheEntryFileA|0xfc14f97c
wininet.dll.UnlockUrlCacheEntryFile|0x527f2573
wininet.dll.ShowX509EncodedCertificate|0xf4b33d8b
wininet.dll.ShowSecurityInfo|0x561db72b
wininet.dll.ShowClientAuthCerts|0x14447a88
wininet.dll.ShowCertificate|0x190028e1
wininet.dll.SetUrlCacheHeaderData|0xa5f41ee3
wininet.dll.SetUrlCacheGroupAttributeW|0xbb087923
wininet.dll.SetUrlCacheGroupAttributeA|0xba587923
wininet.dll.SetUrlCacheEntryInfoW|0x82f7074d
wininet.dll.SetUrlCacheEntryInfoA|0x8247074d
wininet.dll.SetUrlCacheEntryGroupW|0x178f137d
wininet.dll.SetUrlCacheEntryGroupA|0x16df137d
wininet.dll.SetUrlCacheEntryGroup|0x95bf48cd
wininet.dll.SetUrlCacheConfigInfoW|0xae0ad129
wininet.dll.SetUrlCacheConfigInfoA|0xad5ad129
wininet.dll.RunOnceUrlCache|0x5dedd06d
wininet.dll.RetrieveUrlCacheEntryStreamW|0x6690130e
wininet.dll.RetrieveUrlCacheEntryStreamA|0x65e0130e
wininet.dll.RetrieveUrlCacheEntryFileW|0x55548c74
wininet.dll.RetrieveUrlCacheEntryFileA|0x54a48c74
wininet.dll.ResumeSuspendedDownload|0xf4adc28b
wininet.dll.RegisterUrlCacheNotification|0x9dea0892
wininet.dll.ReadUrlCacheEntryStreamEx|0xa998eb97
wininet.dll.ReadUrlCacheEntryStream|0x02ad4005
wininet.dll.PrivacySetZonePreferenceW|0x00e0708c
wininet.dll.PrivacyGetZonePreferenceW|0xfde0708c
wininet.dll.ParseX509EncodedCertificateForListBoxEntry|0x673e07c7
wininet.dll.LoadUrlCacheContent|0x6d7da26b
wininet.dll.IsUrlCacheEntryExpiredW|0xf7899f12
wininet.dll.IsUrlCacheEntryExpiredA|0xf6d99f12
wininet.dll.IsHostInProxyBypassList|0x1cca01c8
wininet.dll.InternetWriteFileExW|0x61ed26b3
wininet.dll.InternetWriteFileExA|0x613d26b3
wininet.dll.InternetWriteFile|0x0967749f
wininet.dll.InternetUnlockRequestFile|0x1878a5ef
wininet.dll.InternetTimeToSystemTimeW|0x376fbc5c
wininet.dll.InternetTimeToSystemTimeA|0x36bfbc5c
wininet.dll.InternetTimeToSystemTime|0xaadb2cc9
wininet.dll.InternetTimeFromSystemTimeW|0x1a00c6b7
wininet.dll.InternetTimeFromSystemTimeA|0x1950c6b7
wininet.dll.InternetTimeFromSystemTime|0xcc26891b
wininet.dll.InternetShowSecurityInfoByURLW|0xd8a056c0
wininet.dll.InternetShowSecurityInfoByURLA|0xd7f056c0
wininet.dll.InternetShowSecurityInfoByURL|0xbe27a0ef
wininet.dll.InternetSetStatusCallbackW|0xe5295fcb
wininet.dll.InternetSetStatusCallbackA|0xe4795fcb
wininet.dll.InternetSetStatusCallback|0xdf490280
wininet.dll.InternetSetPerSiteCookieDecisionW|0xa4937c08
wininet.dll.InternetSetPerSiteCookieDecisionA|0xa3e37c08
wininet.dll.InternetSetOptionW|0x874e4675
wininet.dll.InternetSetOptionExW|0xacd29438
wininet.dll.InternetSetOptionExA|0xac229438
wininet.dll.InternetSetOptionA|0x869e4675
wininet.dll.InternetSetFilePointer|0xa8af1c72
wininet.dll.InternetSetDialStateW|0x977957f8
wininet.dll.InternetSetDialStateA|0x96c957f8
wininet.dll.InternetSetDialState|0xde4e98ca
wininet.dll.InternetSetCookieW|0xfb4a62b2
wininet.dll.InternetSetCookieExW|0xabd9a395
wininet.dll.InternetSetCookieExA|0xab29a395
wininet.dll.InternetSetCookieEx2|0xaab1a395
wininet.dll.InternetSetCookieA|0xfa9a62b2
wininet.dll.InternetSecurityProtocolToStringW|0xdebfcd42
wininet.dll.InternetSecurityProtocolToStringA|0xde0fcd42
wininet.dll.InternetReadFileExW|0x479f6af6
wininet.dll.InternetReadFileExA|0x46ef6af6
wininet.dll.InternetReadFile|0xe2899612
wininet.dll.InternetQueryOptionW|0xca0f54f7
wininet.dll.InternetQueryOptionA|0xc95f54f7
wininet.dll.InternetQueryFortezzaStatus|0x91c6cc59
wininet.dll.InternetQueryDataAvailable|0x497c61ff
wininet.dll.InternetOpenW|0xa829563a
wininet.dll.InternetOpenUrlW|0xf12a8777
wininet.dll.InternetOpenUrlA|0xf07a8777
wininet.dll.InternetOpenA|0xa779563a
wininet.dll.InternetLockRequestFile|0x399f528c
wininet.dll.InternetInitializeAutoProxyDll|0x0b82bdb0
wininet.dll.InternetHangUp|0xf5a43646
wininet.dll.InternetGoOnlineW|0x8fe11fa3
wininet.dll.InternetGoOnlineA|0x8f311fa3
wininet.dll.InternetGoOnline|0xd743f7d7
wininet.dll.InternetGetSecurityInfoByURLW|0x324c87e0
wininet.dll.InternetGetSecurityInfoByURLA|0x319c87e0
wininet.dll.InternetGetSecurityInfoByURL|0x444bac24
wininet.dll.InternetGetProxyForUrl|0xbcef4cd7
wininet.dll.InternetGetPerSiteCookieDecisionW|0x44937c07
wininet.dll.InternetGetPerSiteCookieDecisionA|0x43e37c07
wininet.dll.InternetGetLastResponseInfoW|0x96763090
wininet.dll.InternetGetLastResponseInfoA|0x95c63090
wininet.dll.InternetGetCookieW|0xfb4a62af
wininet.dll.InternetGetCookieExW|0xabd9a2d5
wininet.dll.InternetGetCookieExA|0xab29a2d5
wininet.dll.InternetGetCookieEx2|0xaab1a2d5
wininet.dll.InternetGetCookieA|0xfa9a62af
wininet.dll.InternetGetConnectedStateExW|0x62f53299
wininet.dll.InternetGetConnectedStateExA|0x62453299
wininet.dll.InternetGetConnectedStateEx|0x59a2d239
wininet.dll.InternetGetConnectedState|0x8d6d67a0
wininet.dll.InternetGetCertByURLA|0x9d8472ba
wininet.dll.InternetGetCertByURL|0x41a6d9a1
wininet.dll.InternetFreeProxyInfoList|0x437b20c8
wininet.dll.InternetFreeCookies|0x517fe5db
wininet.dll.InternetFortezzaCommand|0x1d30075d
wininet.dll.InternetFindNextFileW|0x857101a8
wininet.dll.InternetFindNextFileA|0x84c101a8
wininet.dll.InternetErrorDlg|0x0be057b7
wininet.dll.InternetEnumPerSiteCookieDecisionW|0xb03dfc6d
wininet.dll.InternetEnumPerSiteCookieDecisionA|0xaf8dfc6d
wininet.dll.InternetDialW|0x2028e5b4
wininet.dll.InternetDialA|0x1f78e5b4
wininet.dll.InternetDial|0xd00629e0
wininet.dll.InternetCreateUrlW|0xfe5d7029
wininet.dll.InternetCreateUrlA|0xfdad7029
wininet.dll.InternetCrackUrlW|0x1ab3c3a2
wininet.dll.InternetCrackUrlA|0x1a03c3a2
wininet.dll.InternetConvertUrlFromWireToWideChar|0x6f82b28b
wininet.dll.InternetConnectW|0xc74f8957
wininet.dll.InternetConnectA|0xc69f8957
wininet.dll.InternetConfirmZoneCrossingW|0x8d2a7792
wininet.dll.InternetConfirmZoneCrossingA|0x8c7a7792
wininet.dll.InternetConfirmZoneCrossing|0x0241d780
wininet.dll.InternetCombineUrlW|0x9f94cc56
wininet.dll.InternetCombineUrlA|0x9ee4cc56
wininet.dll.InternetCloseHandle|0xd46e6bd3
wininet.dll.InternetClearAllPerSiteCookieDecisions|0x58365cad
wininet.dll.InternetCheckConnectionW|0x0ffb04a3
wininet.dll.InternetCheckConnectionA|0x0f4b04a3
wininet.dll.InternetCanonicalizeUrlW|0xbaa180c8
wininet.dll.InternetCanonicalizeUrlA|0xb9f180c8
wininet.dll.InternetAutodialHangup|0x5254c3ec
wininet.dll.InternetAutodialCallback|0xf008bced
wininet.dll.InternetAutodial|0x520f7557
wininet.dll.InternetAttemptConnect|0x217cf255
wininet.dll.InternetAlgIdToStringW|0xe96fc485
wininet.dll.InternetAlgIdToStringA|0xe8bfc485
wininet.dll.IncrementUrlCacheHeaderData|0x5ab9132c
wininet.dll.HttpWebSocketShutdown|0xd15ddf08
wininet.dll.HttpWebSocketSend|0x24a530c6
wininet.dll.HttpWebSocketReceive|0x7893b186
wininet.dll.HttpWebSocketQueryCloseStatus|0xd509c9aa
wininet.dll.HttpWebSocketCompleteUpgrade|0xa616e091
wininet.dll.HttpWebSocketClose|0x59cbfe64
wininet.dll.HttpSendRequestW|0x7bc8062d
wininet.dll.HttpSendRequestExW|0xcb428275
wininet.dll.HttpSendRequestExA|0xca928275
wininet.dll.HttpSendRequestA|0x7b18062d
wininet.dll.HttpQueryInfoW|0xb6b67072
wininet.dll.HttpQueryInfoA|0xb6067072
wininet.dll.HttpPushWait|0x9e8bb4aa
wininet.dll.HttpPushEnable|0xfc559e84
wininet.dll.HttpPushClose|0x82e80996
wininet.dll.HttpOpenRequestW|0x3bde55eb
wininet.dll.HttpOpenRequestA|0x3b2e55eb
