Sample details: da11d9d6ecbdf0f93436a4b7c13f7bec --

Hashes
MD5: da11d9d6ecbdf0f93436a4b7c13f7bec
SHA1: fdc70e30df3602a663d23ffa5ba8bf0476c00f45
SHA256: 8c12becdb3a245cf5e02fe7c26a175984df6e62a53d3a9e3e6c4bd533a2a9cd1
SSDEEP: 6144:L8ksPfagVlk4UKn02FQA1vnG8R+XAjIVHPQu1Yw75op6Cq740hJzLzcRq0YCmxIh:LQ6gVl9lnQ6zj/OYMBLrj42pZoo
Details
File Type: PE32
Yara Hits
YRP/possible_includes_base64_packed_functions | YRP/Visual_Cpp_2005_DLL_Microsoft | YRP/Visual_Cpp_2003_DLL_Microsoft | YRP/IsPE32 | YRP/IsDLL | YRP/IsConsole | YRP/HasDebugData | YRP/IsBeyondImageSize | YRP/HasRichSignature | YRP/domain | YRP/IP | YRP/contentis_base64 | YRP/Dropper_Strings | YRP/DebuggerCheck__QueryInfo | YRP/DebuggerCheck__RemoteAPI | YRP/DebuggerHiding__Thread | YRP/DebuggerHiding__Active | YRP/DebuggerException__ConsoleCtrl | YRP/DebuggerException__SetConsoleCtrl | YRP/ThreadControl__Context | YRP/SEH__vectored | YRP/anti_dbg | YRP/disable_dep | YRP/inject_thread | YRP/network_http | YRP/network_dropper | YRP/network_ftp | YRP/network_tcp_socket | YRP/network_dns | YRP/network_dga | YRP/escalate_priv | YRP/screenshot | YRP/cred_local | YRP/sniff_audio | YRP/migrate_apc | YRP/spreading_share | YRP/win_mutex | YRP/win_registry | YRP/win_token | YRP/win_private_profile | YRP/win_files_operation | YRP/win_hook | YRP/Big_Numbers0 | YRP/Advapi_Hash_API | YRP/BASE64_table | YRP/Str_Win32_Winsock2_Library | YRP/Str_Win32_Wininet_Library | YRP/Str_Win32_Internet_API | YRP/Str_Win32_Http_API | YRP/suspicious_packer_section |
Source
http://103.68.190.250/Sources//Advance/BJWJ/Builds/Bin/Release/kernel32.dll
Strings
		!This program cannot be run in DOS mode.
`.data
@.reloc
KERNEL32.dll
ActivateActCtx
AddAtomA
AddAtomW
AddConsoleAliasA
AddConsoleAliasW
AddLocalAlternateComputerNameA
AddLocalAlternateComputerNameW
AddRefActCtx
AddVectoredExceptionHandler
AllocConsole
AllocateUserPhysicalPages
AreFileApisANSI
AssignProcessToJobObject
AttachConsole
BackupRead
BackupSeek
BackupWrite
BaseCheckAppcompatCache
BaseCleanupAppcompatCache
BaseCleanupAppcompatCacheSupport
BaseDumpAppcompatCache
BaseFlushAppcompatCache
BaseInitAppcompatCache
BaseInitAppcompatCacheSupport
BaseProcessInitPostImport
BaseQueryModuleData
BaseUpdateAppcompatCache
BasepCheckWinSaferRestrictions
BeginUpdateResourceA
BeginUpdateResourceW
BindIoCompletionCallback
BuildCommDCBA
BuildCommDCBAndTimeoutsA
BuildCommDCBAndTimeoutsW
BuildCommDCBW
CallNamedPipeA
CallNamedPipeW
CancelDeviceWakeupRequest
CancelIo
CancelTimerQueueTimer
CancelWaitableTimer
ChangeTimerQueueTimer
CheckNameLegalDOS8Dot3A
CheckNameLegalDOS8Dot3W
CheckRemoteDebuggerPresent
ClearCommBreak
ClearCommError
CloseConsoleHandle
CloseHandle
CloseProfileUserMapping
CmdBatNotification
CommConfigDialogA
CommConfigDialogW
CompareFileTime
CompareStringA
CompareStringW
ConnectNamedPipe
ConsoleMenuControl
ContinueDebugEvent
ConvertDefaultLocale
ConvertFiberToThread
ConvertThreadToFiber
CopyFileA
CopyFileExA
CopyFileExW
CopyFileW
CopyLZFile
CreateActCtxA
CreateActCtxW
CreateConsoleScreenBuffer
CreateDirectoryA
CreateDirectoryExA
CreateDirectoryExW
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiber
CreateFiberEx
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateHardLinkA
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectA
CreateJobObjectW
CreateJobSet
CreateMailslotA
CreateMailslotW
CreateMemoryResourceNotification
CreateMutexA
CreateMutexW
CreateNamedPipeA
CreateNamedPipeW
CreateNlsSecurityDescriptor
CreatePipe
CreateProcessA
CreateProcessInternalA
CreateProcessInternalW
CreateProcessInternalWSecure
CreateProcessW
CreateRemoteThread
CreateSemaphoreA
CreateSemaphoreW
CreateSocketHandle
CreateTapePartition
CreateThread
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
CreateVirtualBuffer
CreateWaitableTimerA
CreateWaitableTimerW
DeactivateActCtx
DebugActiveProcess
DebugActiveProcessStop
DebugBreak
DebugBreakProcess
DebugSetProcessKillOnExit
DecodePointer
DecodeSystemPointer
DefineDosDeviceA
DefineDosDeviceW
DelayLoadFailureHook
DeleteAtom
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileW
DeleteTimerQueue
DeleteTimerQueueEx
DeleteTimerQueueTimer
DeleteVolumeMountPointA
DeleteVolumeMountPointW
DeviceIoControl
DisableThreadLibraryCalls
DisconnectNamedPipe
DnsHostnameToComputerNameA
DnsHostnameToComputerNameW
DosDateTimeToFileTime
DosPathToSessionPathA
DosPathToSessionPathW
DuplicateConsoleHandle
DuplicateHandle
EncodePointer
EncodeSystemPointer
EndUpdateResourceA
EndUpdateResourceW
EnterCriticalSection
EnumCalendarInfoA
EnumCalendarInfoExA
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsA
EnumDateFormatsExA
EnumDateFormatsExW
EnumDateFormatsW
EnumLanguageGroupLocalesA
EnumLanguageGroupLocalesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceNamesA
EnumResourceNamesW
EnumResourceTypesA
EnumResourceTypesW
EnumSystemCodePagesA
EnumSystemCodePagesW
EnumSystemGeoID
EnumSystemLanguageGroupsA
EnumSystemLanguageGroupsW
EnumSystemLocalesA
EnumSystemLocalesW
EnumTimeFormatsA
EnumTimeFormatsW
EnumUILanguagesA
EnumUILanguagesW
EnumerateLocalComputerNamesA
EnumerateLocalComputerNamesW
EraseTape
EscapeCommFunction
ExitProcess
ExitThread
ExitVDM
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
ExpungeConsoleCommandHistoryA
ExpungeConsoleCommandHistoryW
ExtendVirtualBuffer
FatalAppExitA
FatalAppExitW
FatalExit
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FindActCtxSectionGuid
FindActCtxSectionStringA
FindActCtxSectionStringW
FindAtomA
FindAtomW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstVolumeA
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextFileW
FindNextVolumeA
FindNextVolumeMountPointA
FindNextVolumeMountPointW
FindNextVolumeW
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FindVolumeClose
FindVolumeMountPointClose
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FlushViewOfFile
FoldStringA
FoldStringW
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
FreeResource
FreeUserPhysicalPages
FreeVirtualBuffer
GenerateConsoleCtrlEvent
GetACP
GetAtomNameA
GetAtomNameW
GetBinaryType
GetBinaryTypeA
GetBinaryTypeW
GetCPFileNameFromRegistry
GetCPInfo
GetCPInfoExA
GetCPInfoExW
GetCalendarInfoA
GetCalendarInfoW
GetComPlusPackageInstallStatus
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeA
GetCompressedFileSizeW
GetComputerNameA
GetComputerNameExA
GetComputerNameExW
GetComputerNameW
GetConsoleAliasA
GetConsoleAliasExesA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthW
GetConsoleAliasExesW
GetConsoleAliasW
GetConsoleAliasesA
GetConsoleAliasesLengthA
GetConsoleAliasesLengthW
GetConsoleAliasesW
GetConsoleCP
GetConsoleCharType
GetConsoleCommandHistoryA
GetConsoleCommandHistoryLengthA
GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryW
GetConsoleCursorInfo
GetConsoleCursorMode
GetConsoleDisplayMode
GetConsoleFontInfo
GetConsoleFontSize
GetConsoleHardwareState
GetConsoleInputExeNameA
GetConsoleInputExeNameW
GetConsoleInputWaitHandle
GetConsoleKeyboardLayoutNameA
GetConsoleKeyboardLayoutNameW
GetConsoleMode
GetConsoleNlsMode
GetConsoleOutputCP
GetConsoleProcessList
GetConsoleScreenBufferInfo
GetConsoleSelectionInfo
GetConsoleTitleA
GetConsoleTitleW
GetConsoleWindow
GetCurrencyFormatA
GetCurrencyFormatW
GetCurrentActCtx
GetCurrentConsoleFont
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetDateFormatW
GetDefaultCommConfigA
GetDefaultCommConfigW
GetDefaultSortkeySize
GetDevicePowerState
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetDllDirectoryA
GetDllDirectoryW
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStrings
GetEnvironmentStringsA
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetExpandedNameA
GetExpandedNameW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetFileType
GetFirmwareEnvironmentVariableA
GetFirmwareEnvironmentVariableW
GetFullPathNameA
GetFullPathNameW
GetGeoInfoA
GetGeoInfoW
GetHandleContext
GetHandleInformation
GetLargestConsoleWindowSize
GetLastError
GetLinguistLangSize
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetLogicalDriveStringsA
GetLogicalDriveStringsW
GetLogicalDrives
GetLogicalProcessorInformation
GetLongPathNameA
GetLongPathNameW
GetMailslotInfo
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNamedPipeHandleStateA
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetNativeSystemInfo
GetNextVDMCommand
GetNlsSectionName
GetNumaAvailableMemory
GetNumaAvailableMemoryNode
GetNumaHighestNodeNumber
GetNumaNodeProcessorMask
GetNumaProcessorMap
GetNumaProcessorNode
GetNumberFormatA
GetNumberFormatW
GetNumberOfConsoleFonts
GetNumberOfConsoleInputEvents
GetNumberOfConsoleMouseButtons
GetOEMCP
GetOverlappedResult
GetPriorityClass
GetPrivateProfileIntA
GetPrivateProfileIntW
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetPrivateProfileStringA
GetPrivateProfileStringW
GetPrivateProfileStructA
GetPrivateProfileStructW
GetProcAddress
GetProcessAffinityMask
GetProcessDEPPolicy
GetProcessHandleCount
GetProcessHeap
GetProcessHeaps
GetProcessId
GetProcessIoCounters
GetProcessPriorityBoost
GetProcessShutdownParameters
GetProcessTimes
GetProcessVersion
GetProcessWorkingSetSize
GetProfileIntA
GetProfileIntW
GetProfileSectionA
GetProfileSectionW
GetProfileStringA
GetProfileStringW
GetQueuedCompletionStatus
GetShortPathNameA
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeExA
GetStringTypeExW
GetStringTypeW
GetSystemDEPPolicy
GetSystemDefaultLCID
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemPowerStatus
GetSystemRegistryQuota
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetSystemTimes
GetSystemWindowsDirectoryA
GetSystemWindowsDirectoryW
GetSystemWow64DirectoryA
GetSystemWow64DirectoryW
GetTapeParameters
GetTapePosition
GetTapeStatus
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadIOPendingFlag
GetThreadLocale
GetThreadPriority
GetThreadPriorityBoost
GetThreadSelectorEntry
GetThreadTimes
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultUILanguage
GetUserGeoID
GetVDMCurrentDirectories
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationA
GetVolumeInformationW
GetVolumeNameForVolumeMountPointA
GetVolumeNameForVolumeMountPointW
GetVolumePathNameA
GetVolumePathNameW
GetVolumePathNamesForVolumeNameA
GetVolumePathNamesForVolumeNameW
GetWindowsDirectoryA
GetWindowsDirectoryW
GetWriteWatch
GlobalAddAtomA
GlobalAddAtomW
GlobalAlloc
GlobalCompact
GlobalDeleteAtom
GlobalFindAtomA
GlobalFindAtomW
GlobalFix
GlobalFlags
GlobalFree
GlobalGetAtomNameA
GlobalGetAtomNameW
GlobalHandle
GlobalLock
GlobalMemoryStatus
GlobalMemoryStatusEx
GlobalReAlloc
GlobalSize
GlobalUnWire
GlobalUnfix
GlobalUnlock
GlobalWire
Heap32First
Heap32ListFirst
Heap32ListNext
Heap32Next
HeapAlloc
HeapCompact
HeapCreate
HeapCreateTagsW
HeapDestroy
HeapExtend
HeapFree
HeapLock
HeapQueryInformation
HeapQueryTagW
HeapReAlloc
HeapSetInformation
HeapSize
HeapSummary
HeapUnlock
HeapUsage
HeapValidate
HeapWalk
InitAtomTable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedFlushSList
InterlockedIncrement
InterlockedPopEntrySList
InterlockedPushEntrySList
InvalidateConsoleDIBits
IsBadCodePtr
IsBadHugeReadPtr
IsBadHugeWritePtr
IsBadReadPtr
IsBadStringPtrA
IsBadStringPtrW
IsBadWritePtr
IsDBCSLeadByte
IsDBCSLeadByteEx
IsDebuggerPresent
IsProcessInJob
IsProcessorFeaturePresent
IsSystemResumeAutomatic
IsValidCodePage
IsValidLanguageGroup
IsValidLocale
IsValidUILanguage
IsWow64Process
LCMapStringA
LCMapStringW
LZClose
LZCloseFile
LZCopy
LZCreateFileW
LZDone
LZInit
LZOpenFileA
LZOpenFileW
LZRead
LZSeek
LZStart
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadModule
LoadResource
LocalAlloc
LocalCompact
LocalFileTimeToFileTime
LocalFlags
LocalFree
LocalHandle
LocalLock
LocalReAlloc
LocalShrink
LocalSize
LocalUnlock
LockFile
LockFileEx
LockResource
MapUserPhysicalPages
MapUserPhysicalPagesScatter
MapViewOfFile
MapViewOfFileEx
Module32First
Module32FirstW
Module32Next
Module32NextW
MoveFileA
MoveFileExA
MoveFileExW
MoveFileW
MoveFileWithProgressA
MoveFileWithProgressW
MulDiv
MultiByteToWideChar
NlsConvertIntegerToString
NlsGetCacheUpdateCount
NlsResetProcessLocale
NumaVirtualQueryNode
OpenConsoleW
OpenDataFile
OpenEventA
OpenEventW
OpenFile
OpenFileMappingA
OpenFileMappingW
OpenJobObjectA
OpenJobObjectW
OpenMutexA
OpenMutexW
OpenProcess
OpenProfileUserMapping
OpenSemaphoreA
OpenSemaphoreW
OpenThread
OpenWaitableTimerA
OpenWaitableTimerW
OutputDebugStringA
OutputDebugStringW
PeekConsoleInputA
PeekConsoleInputW
PeekNamedPipe
PostQueuedCompletionStatus
PrepareTape
PrivCopyFileExW
PrivMoveFileIdentityW
Process32First
Process32FirstW
Process32Next
Process32NextW
ProcessIdToSessionId
PulseEvent
PurgeComm
QueryActCtxW
QueryDepthSList
QueryDosDeviceA
QueryDosDeviceW
QueryInformationJobObject
QueryMemoryResourceNotification
QueryPerformanceCounter
QueryPerformanceFrequency
QueryWin31IniFilesMappedToRegistry
QueueUserAPC
QueueUserWorkItem
RaiseException
ReadConsoleA
ReadConsoleInputA
ReadConsoleInputExA
ReadConsoleInputExW
ReadConsoleInputW
ReadConsoleOutputA
ReadConsoleOutputAttribute
ReadConsoleOutputCharacterA
ReadConsoleOutputCharacterW
ReadConsoleOutputW
ReadConsoleW
ReadDirectoryChangesW
ReadFile
ReadFileEx
ReadFileScatter
ReadProcessMemory
RegisterConsoleIME
RegisterConsoleOS2
RegisterConsoleVDM
RegisterWaitForInputIdle
RegisterWaitForSingleObject
RegisterWaitForSingleObjectEx
RegisterWowBaseHandlers
RegisterWowExec
ReleaseActCtx
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryA
RemoveDirectoryW
RemoveLocalAlternateComputerNameA
RemoveLocalAlternateComputerNameW
RemoveVectoredExceptionHandler
ReplaceFile
ReplaceFileA
ReplaceFileW
RequestDeviceWakeup
RequestWakeupLatency
ResetEvent
ResetWriteWatch
RestoreLastError
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlFillMemory
RtlMoveMemory
RtlUnwind
RtlZeroMemory
ScrollConsoleScreenBufferA
ScrollConsoleScreenBufferW
SearchPathA
SearchPathW
SetCPGlobal
SetCalendarInfoA
SetCalendarInfoW
SetClientTimeZoneInformation
SetComPlusPackageInstallStatus
SetCommBreak
SetCommConfig
SetCommMask
SetCommState
SetCommTimeouts
SetComputerNameA
SetComputerNameExA
SetComputerNameExW
SetComputerNameW
SetConsoleActiveScreenBuffer
SetConsoleCP
SetConsoleCommandHistoryMode
SetConsoleCtrlHandler
SetConsoleCursor
SetConsoleCursorInfo
SetConsoleCursorMode
SetConsoleCursorPosition
SetConsoleDisplayMode
SetConsoleFont
SetConsoleHardwareState
SetConsoleIcon
SetConsoleInputExeNameA
SetConsoleInputExeNameW
SetConsoleKeyShortcuts
SetConsoleLocalEUDC
SetConsoleMaximumWindowSize
SetConsoleMenuClose
SetConsoleMode
SetConsoleNlsMode
SetConsoleNumberOfCommandsA
SetConsoleNumberOfCommandsW
SetConsoleOS2OemFormat
SetConsoleOutputCP
SetConsolePalette
SetConsoleScreenBufferSize
SetConsoleTextAttribute
SetConsoleTitleA
SetConsoleTitleW
SetConsoleWindowInfo
SetCriticalSectionSpinCount
SetCurrentDirectoryA
SetCurrentDirectoryW
SetDefaultCommConfigA
SetDefaultCommConfigW
SetDllDirectoryA
SetDllDirectoryW
SetEndOfFile
SetEnvironmentVariableA
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileApisToANSI
SetFileApisToOEM
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileShortNameA
SetFileShortNameW
SetFileTime
SetFileValidData
SetFirmwareEnvironmentVariableA
SetFirmwareEnvironmentVariableW
SetHandleContext
SetHandleCount
SetHandleInformation
SetInformationJobObject
SetLastConsoleEventActive
SetLastError
SetLocalPrimaryComputerNameA
SetLocalPrimaryComputerNameW
SetLocalTime
SetLocaleInfoA
SetLocaleInfoW
SetMailslotInfo
SetMessageWaitingIndicator
SetNamedPipeHandleState
SetPriorityClass
SetProcessAffinityMask
SetProcessDEPPolicy
SetProcessPriorityBoost
SetProcessShutdownParameters
SetProcessWorkingSetSize
SetSearchPathMode
SetStdHandle
SetSystemPowerState
SetSystemTime
SetSystemTimeAdjustment
SetTapeParameters
SetTapePosition
SetTermsrvAppInstallMode
SetThreadAffinityMask
SetThreadContext
SetThreadExecutionState
SetThreadIdealProcessor
SetThreadLocale
SetThreadPriority
SetThreadPriorityBoost
SetThreadUILanguage
SetTimeZoneInformation
SetTimerQueueTimer
SetUnhandledExceptionFilter
SetUserGeoID
SetVDMCurrentDirectories
SetVolumeLabelA
SetVolumeLabelW
SetVolumeMountPointA
SetVolumeMountPointW
SetWaitableTimer
SetupComm
ShowConsoleCursor
SignalObjectAndWait
SizeofResource
SleepEx
SuspendThread
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateJobObject
TerminateProcess
TerminateThread
TermsrvAppInstallMode
Thread32First
Thread32Next
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
Toolhelp32ReadProcessMemory
TransactNamedPipe
TransmitCommChar
TrimVirtualBuffer
TryEnterCriticalSection
TzSpecificLocalTimeToSystemTime
UTRegister
UTUnRegister
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
UnregisterConsoleIME
UnregisterWait
UnregisterWaitEx
UpdateResourceA
UpdateResourceW
VDMConsoleOperation
VDMOperationStarted
ValidateLCType
ValidateLocale
VerLanguageNameA
VerLanguageNameW
VerSetConditionMask
VerifyConsoleIoHandle
VerifyVersionInfoA
VerifyVersionInfoW
VirtualAlloc
VirtualAllocEx
VirtualBufferExceptionHandler
VirtualFree
VirtualFreeEx
VirtualLock
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
VirtualUnlock
WTSGetActiveConsoleSessionId
WaitCommEvent
WaitForDebugEvent
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeA
WaitNamedPipeW
WideCharToMultiByte
WinExec
WriteConsoleA
WriteConsoleInputA
WriteConsoleInputVDMA
WriteConsoleInputVDMW
WriteConsoleInputW
WriteConsoleOutputA
WriteConsoleOutputAttribute
WriteConsoleOutputCharacterA
WriteConsoleOutputCharacterW
WriteConsoleOutputW
WriteConsoleW
WriteFile
WriteFileEx
WriteFileGather
WritePrivateProfileSectionA
WritePrivateProfileSectionW
WritePrivateProfileStringA
WritePrivateProfileStringW
WritePrivateProfileStructA
WritePrivateProfileStructW
WriteProcessMemory
WriteProfileSectionA
WriteProfileSectionW
WriteProfileStringA
WriteProfileStringW
WriteTapemark
ZombifyActCtx
_hread
_hwrite
_lclose
_lcreat
_llseek
_lopen
_lread
_lwrite
lstrcat
lstrcatA
lstrcatW
lstrcmp
lstrcmpA
lstrcmpW
lstrcmpi
lstrcmpiA
lstrcmpiW
lstrcpy
lstrcpyA
lstrcpyW
lstrcpyn
lstrcpynA
lstrcpynW
lstrlen
lstrlenA
lstrlenW
NTDLL.RtlAddVectoredExceptionHandler
NTDLL.RtlDecodePointer
NTDLL.RtlDecodeSystemPointer
NTDLL.RtlDeleteCriticalSection
NTDLL.RtlEncodePointer
NTDLL.RtlEncodeSystemPointer
NTDLL.RtlEnterCriticalSection
NTDLL.RtlGetLastWin32Error
NTDLL.RtlAllocateHeap
NTDLL.RtlFreeHeap
NTDLL.RtlReAllocateHeap
NTDLL.RtlSizeHeap
NTDLL.RtlInitializeSListHead
NTDLL.RtlInterlockedFlushSList
NTDLL.RtlInterlockedPopEntrySList
NTDLL.RtlInterlockedPushEntrySList
NTDLL.RtlLeaveCriticalSection
NTDLL.RtlQueryDepthSList
NTDLL.RtlRemoveVectoredExceptionHandler
NTDLL.RtlRestoreLastWin32Error
NTDLL.RtlCaptureContext
NTDLL.RtlCaptureStackBackTrace
NTDLL.RtlFillMemory
NTDLL.RtlMoveMemory
NTDLL.RtlUnwind
NTDLL.RtlZeroMemory
NTDLL.RtlSetCriticalSectionSpinCount
NTDLL.RtlSetLastWin32Error
NTDLL.RtlTryEnterCriticalSection
NTDLL.VerSetConditionMask
9z$u	9M
|fNullUuid
UpdateDSPerfStats
UnImpersonateAnyClient
TrimDSNameBy
THSave
THRestore
THQuery
THFree
THDestroy
THCreate
THClearErrors
THAlloc
SampVerifySids
SampSignalStart
SampSetSam
SampSetIndexRanges
SampSetDsa
SampSamObjectTypeFromDsClass
SampSamAttrFromDsAttr
SampNetlogonPing
SampMaybeEndDsTransaction
SampMaybeBeginDsTransaction
SampIsWriteLockHeldByDs
SampIsSecureLdapConnection
SampGetServerRoleFromFSMO
SampGetQDIRestart
SampGetMemberships
SampGetLoopbackObjectClassId
SampGetGroupsForToken
SampGetEnterpriseSidList
SampGetDsAttrIdByName
SampGetDisplayEnumerationIndex
SampGetClassAttribute
SampGetAccountCounts
SampGCLookupSids
SampGCLookupNames
SampExistsDsTransaction
SampExistsDsLoopback
SampDsClassFromSamObjectType
SampDsAttrFromSamAttr
SampDeriveMostBasicDsClass
SampComputeGroupType
SampAmIGC
SampAddLoopbackTask
QuoteRDNValue
NameMatched
InitCommarg
ImpersonateAnyClient
GetRDNInfoExternal
GetConfigurationName
GetConfigParamW
GetConfigParamAllocW
GetConfigParam
GCVerifyCacheLookup
DsaWaitUntilServiceIsRunning
DsUninitialize
DsInitialize
DsGetBootOptions
DsCheckConstraint
DsChangeBootOptions
DirSearch
DirRemoveEntry
DirRead
DirProtectEntry
DirOperationControl
DirNotifyUnRegister
DirNotifyRegister
DirModifyEntry
DirModifyDN
DirGetDomainHandle
DirFindEntry
DirErrorToWinError
DirErrorToNtStatus
DirAddEntry
AppendRDN
|wvnsprintfW
wnsprintfW
wnsprintfA
UrlCanonicalizeW
StrTrimW
StrStrW
StrStrIW
StrStrA
StrRetToBufW
StrRChrA
StrDupW
StrCpyNW
StrCatW
SHLoadIndirectString
SHDeleteKeyW
SHCreateShellPalette
SHAutoComplete
PathSetDlgItemPathW
PathRemoveFileSpecW
PathRemoveBackslashW
PathIsUNCW
PathIsRootW
PathFindFileNameW
PathCreateFromUrlW
PathCombineW
PathCanonicalizeW
PathAppendW
PathAddBackslashW
9FAAJu
|wsprintfW
wsprintfA
mouse_event
WindowFromDC
ValidateRect
TranslateMessage
SystemParametersInfoW
ShowWindow
ShowCursor
SetWindowLongA
SetThreadDesktop
SetSystemCursor
SetRect
SetProcessWindowStation
SetForegroundWindow
SendMessageW
ReleaseDC
RegisterWindowMessageW
RegisterClassA
PostMessageA
PeekMessageA
OpenWindowStationA
OpenDesktopA
OemToCharBuffA
LoadStringW
LoadStringA
LoadCursorW
IsWindowVisible
IsWindow
IsCharAlphaA
InvalidateRect
IntersectRect
GetWindowTextA
GetWindowRect
GetWindowLongW
GetWindowLongA
GetUpdateRect
GetThreadDesktop
GetSystemMetrics
GetProcessWindowStation
GetForegroundWindow
GetClientRect
GetClassInfoA
GetActiveWindow
FindWindowA
FillRect
EqualRect
EnumDisplaySettingsW
EnumDisplaySettingsA
EnumDesktopWindows
EndPaint
DispatchMessageA
DestroyWindow
DestroyCursor
DefWindowProcW
DefWindowProcA
CreateWindowExA
CopyIcon
CloseWindowStation
CloseDesktop
CharToOemBuffA
CharNextA
ChangeDisplaySettingsExW
ChangeDisplaySettingsA
CallWindowProcA
CallNextHookEx
BeginPaint
;t$(v(
UQPXY]Y[
twain_32.dll
Jt.HH;
|WriteClassStm
StringFromGUID2
StringFromCLSID
StgOpenStorageOnILockBytes
StgOpenStorageEx
StgOpenStorage
StgOpenPropStg
StgCreatePropStg
StgCreatePropSetStg
StgCreateDocfileOnILockBytes
StgCreateDocfile
RevokeDragDrop
ReleaseStgMedium
RegisterDragDrop
PropVariantCopy
PropVariantClear
ProgIDFromCLSID
OleUninitialize
OleSetMenuDescriptor
OleSetClipboard
OleSaveToStream
OleSave
OleRun
OleRegGetUserType
OleRegGetMiscStatus
OleRegEnumVerbs
OleQueryLinkFromData
OleQueryCreateFromData
OleLockRunning
OleLoadFromStream
OleIsCurrentClipboard
OleInitialize
OleGetClipboard
OleFlushClipboard
OleDraw
OleCreateFromData
MkParseDisplayName
GetRunningObjectTable
GetHGlobalFromStream
GetHGlobalFromILockBytes
GetClassFile
FreePropVariantArray
DoDragDrop
CreateStreamOnHGlobal
CreateOleAdviseHolder
CreateItemMoniker
CreateILockBytesOnHGlobal
CreateFileMoniker
CreateDataAdviseHolder
CreateClassMoniker
CreateBindCtx
CoWaitForMultipleHandles
CoUnmarshalInterface
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoSwitchCallContext
CoSuspendClassObjects
CoSetProxyBlanket
CoRevokeClassObject
CoRevertToSelf
CoResumeClassObjects
CoReleaseMarshalData
CoRegisterMessageFilter
CoRegisterClassObject
CoMarshalInterface
CoMarshalInterThreadInterfaceInStream
CoLoadLibrary
CoInitializeSecurity
CoInitializeEx
CoInitialize
CoImpersonateClient
CoGetTreatAsClass
CoGetMalloc
CoGetInterfaceAndReleaseStream
CoGetClassObject
CoFreeUnusedLibraries
CoFreeLibrary
CoFileTimeNow
CoEnableCallCancellation
CoDisconnectObject
CoDisableCallCancellation
CoCreateInstance
CoCreateGuid
CoCreateFreeThreadedMarshaler
CoCopyProxy
CoCancelCall
CoAllowSetForegroundWindow
CLSIDFromString
CLSIDFromProgID
|waveOutWrite
waveOutUnprepareHeader
waveOutReset
waveOutPrepareHeader
waveOutOpen
waveOutMessage
waveOutGetNumDevs
waveOutClose
waveInOpen
waveInGetNumDevs
waveInClose
timeGetTime
timeEndPeriod
timeBeginPeriod
sndPlaySoundW
mmioSeek
mmioRead
mmioOpenW
mmioDescend
mmioClose
mmioAscend
mixerSetControlDetails
mixerOpen
mixerMessage
mixerGetLineInfoW
mixerGetLineControlsW
mixerGetID
mixerGetDevCapsW
mixerGetControlDetailsW
mixerClose
midiOutShortMsg
midiOutOpen
midiOutGetNumDevs
midiOutClose
mciSendStringW
mciSendCommandW
WinmmLogon
WinmmLogoff
PlaySoundW
PlaySoundA
MigrateSoundEvents
MigrateAllDrivers
t#9u$t
SXS: %s() LdrFindOutOfProcessResource failed; nt status = %08lx
KFFGGf;
QVVVPj
CreateProcessAsUserSecure
BasepSxsCreateResourceStream
advapi32.dll
O,uz9U,
|SaferCloseLevel
SaferComputeTokenFromLevel
SaferIdentifyLevel
SaferSetPolicyInformation
SaferSetLevelInformation
SaferGetPolicyInformation
SaferGetLevelInformation
SaferCreateLevel
ReportEventW
RegisterEventSourceW
RegSetValueExW
RegSetValueExA
RegSaveKeyW
RegSaveKeyExW
RegSaveKeyA
RegRestoreKeyW
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExA
RegOpenKeyA
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyExW
RegCloseKey
QueryServiceStatus
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
LookupPrivilegeValueA
GetTokenInformation
FreeSid
ElfReportEventW
ElfRegisterEventSourceW
ElfDeregisterEventSource
DeregisterEventSource
CryptReleaseContext
CryptHashData
CryptGetHashParam
CryptExportKey
CryptDestroyKey
CryptDestroyHash
CryptCreateHash
CryptAcquireContextW
AllocateAndInitializeSid
AdjustTokenPrivileges
VVVj j
\Device\NamedPipe\Win32Pipes.%08x.%08x
|ApphelpCheckRunApp
F$PSWj
j-Yf9H&
GetUserNameW
CheckTokenMembership
CM_Open_DevNode_Key
|GetSignalStrengthForAdapter
GetSSIDForAdapter
GetModeForAdapter
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAddCatalog
|WritePrinter
WaitForPrinterChange
StartPagePrinter
StartDocPrinterW
SpoolerInit
SetPrinterW
SetPrinterDataW
SetPrinterDataExW
SetPortW
SetJobW
SetFormW
ScheduleJob
ResetPrinterW
ReadPrinter
OpenPrinterW
GetPrinterW
GetPrinterDriverW
GetPrinterDriverDirectoryW
GetPrinterDataW
GetPrinterDataExW
GetPrintProcessorDirectoryW
GetJobW
GetFormW
FlushPrinter
FindClosePrinterChangeNotification
ExtDeviceMode
EnumPrintersW
EnumPrinterKeyW
EnumPrinterDriversW
EnumPrinterDataW
EnumPrinterDataExW
EnumPrintProcessorsW
EnumPrintProcessorDatatypesW
EnumPortsW
EnumMonitorsW
EnumJobsW
EnumFormsW
EndPagePrinter
EndDocPrinter
DocumentPropertiesW
DeviceCapabilitiesW
DeletePrinterKeyW
DeletePrinterDriverW
DeletePrinterDriverExW
DeletePrinterDataW
DeletePrinterDataExW
DeletePrinterConnectionW
DeletePrinter
DeletePrintProvidorW
DeletePrintProcessorW
DeletePortW
DeleteMonitorW
DeleteFormW
ConnectToPrinterDlg
ConfigurePortW
ClosePrinter
AdvancedDocumentPropertiesW
AddPrinterW
AddPrinterDriverW
AddPrinterDriverExW
AddPrinterConnectionW
AddPrintProvidorW
AddPrintProcessorW
AddPortW
AddMonitorW
AddJobW
AddFormW
AbortPrinter
|SetWindowTheme
SetThemeAppProperties
SetSystemVisualStyle
ServiceClearStockObjects
OpenThemeData
IsThemePartDefined
IsThemeDialogTextureEnabled
IsThemeBackgroundPartiallyTransparent
IsThemeActive
IsAppThemed
HitTestThemeBackground
GetWindowTheme
GetThemeTextMetrics
GetThemeTextExtent
GetThemeSysString
GetThemeSysSize
GetThemeSysInt
GetThemeSysFont
GetThemeSysColorBrush
GetThemeSysColor
GetThemeSysBool
GetThemeString
GetThemeRect
GetThemePropertyOrigin
GetThemePosition
GetThemePartSize
GetThemeMetric
GetThemeMargins
GetThemeIntList
GetThemeInt
GetThemeFont
GetThemeFilename
GetThemeEnumValue
GetThemeDocumentationProperty
GetThemeColor
GetThemeBool
GetThemeBackgroundRegion
GetThemeBackgroundExtent
GetThemeBackgroundContentRect
GetThemeAppProperties
GetCurrentThemeName
EnableTheming
EnableThemeDialogTexture
DrawThemeText
DrawThemeParentBackground
DrawThemeIcon
DrawThemeEdge
DrawThemeBackground
CloseThemeData
|EnumerateMultiUserServers
CurrentDateTimeString
CachedGetUserFromSid
|ScriptString_pSize
ScriptStringOut
ScriptStringFree
ScriptStringAnalyse
|UnregisterGPNotification
UnloadUserProfile
RegisterGPNotification
LoadUserProfileW
GetUserProfileDirectoryW
GetProfilesDirectoryW
GetProfileType
GetDefaultUserProfileDirectoryW
GetAllUsersProfileDirectoryW
ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock
DeleteProfileW
CreateEnvironmentBlock
|Shell_NotifyIconW
ShellExecuteW
ShellExecuteExW
ShellExecuteExA
ShellExecuteA
ShellAboutW
ShellAboutA
SHSetLocalizedName
SHPathPrepareForWriteW
SHParseDisplayName
SHLoadInProc
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetPathFromIDListA
SHGetMalloc
SHGetInstanceExplorer
SHGetFolderPathW
SHGetFolderPathA
SHGetFolderLocation
SHGetFileInfoW
SHGetFileInfoA
SHGetDesktopFolder
SHGetDataFromIDListW
SHGetDataFromIDListA
SHFormatDrive
SHFileOperationW
SHFileOperationA
SHExtractIconsW
SHChangeNotify
SHBrowseForFolderW
SHBrowseForFolderA
SHBindToParent
SHAppBarMessage
FindExecutableW
FindExecutableA
ExtractIconW
ExtractIconExW
ExtractIconExA
ExtractIconA
ExtractAssociatedIconW
ExtractAssociatedIconExW
DragQueryFileW
DragQueryFileA
|SoftwareUpdateMessageBox
SetQueryNetSessionCount
SHGetIDispatchForFolder
ImportPrivacySettings
IEWriteErrorLog
DoOrganizeFavDlgW
DoFileDownload
DllRegisterWindowClasses
|TraceVprintfExW
TraceVprintfExA
TraceRegisterExW
TraceDeregisterW
RouterLogRegisterW
RouterLogEventW
RouterLogDeregisterW
|OcTerminate
OcSubComponentsPresent
OcRememberWizardDialogHandle
OcInitialize
OcGetWizardPages
OcCreateSetupPage
OcCreateOcPage
|RapTotalSize
RapStructureSize
RapStructureAlignment
RapParmNumDescriptor
RapIsValidDescriptorSmb
RapGetFieldSize
RapConvertSingleEntryEx
RapConvertSingleEntry
RapAuxDataCountOffset
RapAuxDataCount
RapAsciiToDecimal
RapArrayLength
|RatingObtainQuery
RatingObtainCancel
RatingFreeDetails
RatingEnabledQuery
RatingCustomDeleteCrackedData
RatingCustomCrackData
RatingCheckUserAccess
RatingAccessDeniedDialog2
|MprSetupIpInIpInterfaceFriendlyNameFree
MprSetupIpInIpInterfaceFriendlyNameEnum
MprConfigTransportGetInfo
MprConfigTransportGetHandle
MprConfigTransportDelete
MprConfigTransportCreate
MprConfigServerDisconnect
MprConfigServerConnect
MprConfigInterfaceTransportRemove
MprConfigInterfaceTransportGetInfo
MprConfigInterfaceTransportGetHandle
MprConfigInterfaceTransportEnum
MprConfigInterfaceTransportAdd
MprConfigInterfaceGetHandle
MprConfigInterfaceEnum
MprConfigInterfaceDelete
MprConfigInterfaceCreate
MprConfigBufferFree
MprAdminUpgradeUsers
MprAdminTransportCreate
MprAdminServerDisconnect
MprAdminServerConnect
MprAdminRegisterConnectionNotification
MprAdminPortGetInfo
MprAdminPortEnum
MprAdminMIBServerDisconnect
MprAdminMIBServerConnect
MprAdminMIBEntrySet
MprAdminMIBEntryGet
MprAdminMIBEntryDelete
MprAdminMIBEntryCreate
MprAdminMIBBufferFree
MprAdminIsServiceRunning
MprAdminInterfaceTransportAdd
MprAdminInterfaceGetHandle
MprAdminInterfaceEnum
MprAdminInterfaceDelete
MprAdminInterfaceCreate
MprAdminDeregisterConnectionNotification
MprAdminConnectionGetInfo
MprAdminConnectionEnum
MprAdminBufferFree
|ResolveLinkInfoW
IsValidLinkInfo
GetLinkInfoData
DestroyLinkInfo
CreateLinkInfoW
|MimeOleSetCompatMode
MimeOleParseMhtmlUrl
MimeOleCreateVirtualStream
MimeOleCreateMessage
|ImmUnlockIMC
ImmSetOpenStatus
ImmSetConversionStatus
ImmSetCompositionWindow
ImmSetCompositionStringW
ImmSetCompositionStringA
ImmSetCompositionFontW
ImmSetCandidateWindow
ImmReleaseContext
ImmNotifyIME
ImmLockIMC
ImmIsIME
ImmGetVirtualKey
ImmGetProperty
ImmGetOpenStatus
ImmGetGuideLineW
ImmGetDefaultIMEWnd
ImmGetConversionStatus
ImmGetContext
ImmGetCompositionWindow
ImmGetCompositionStringW
ImmGetCompositionStringA
ImmEscapeW
ImmEscapeA
ImmEnumInputContext
ImmAssociateContext
|UnMapAndLoad
UnDecorateSymbolName
SymUnDName64
SymUnDName
SymSetOptions
SymLoadModuleEx
SymLoadModule64
SymLoadModule
SymInitialize
SymGetSymFromAddr64
SymGetSymFromAddr
SymGetOptions
SymGetModuleInfo64
SymGetModuleInfo
SymFunctionTableAccess64
SymFunctionTableAccess
StackWalk64
StackWalk
MapAndLoad
ImageGetDigestStream
ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates
|GdiplusStartup
GdiplusShutdown
GdipTranslateRegionI
GdipSetWorldTransform
GdipSetTextRenderingHint
GdipSetTextContrast
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipSetClipRegion
GdipSetClipRect
GdipSaveImageToStream
GdipSaveGraphics
GdipRestoreGraphics
GdipResetWorldTransform
GdipReleaseDC
GdipMeasureString
GdipIsClipEmpty
GdipGetWorldTransform
GdipGetTextRenderingHint
GdipGetTextContrast
GdipGetSmoothingMode
GdipGetPixelOffsetMode
GdipGetInterpolationMode
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageGraphicsContext
GdipGetImageFlags
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetGenericFontFamilySansSerif
GdipGetFontSize
GdipGetDC
GdipGetCompositingQuality
GdipGetCompositingMode
GdipGetClip
GdipFree
GdipFillRectanglesI
GdipFillRectangleI
GdipFillRectangle
GdipDrawString
GdipDrawRectangle
GdipDrawLine
GdipDrawImageRectI
GdipDisposeImage
GdipDeleteRegion
GdipDeletePen
GdipDeleteMatrix
GdipDeleteGraphics
GdipDeleteFontFamily
GdipDeleteFont
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateRegion
GdipCreatePen1
GdipCreateMatrix2
GdipCreateMatrix
GdipCreateHBITMAPFromBitmap
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipCreateFromHDC
GdipCreateFontFamilyFromName
GdipCreateFont
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipCloneImage
GdipCloneBrush
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipAlloc
|PropertySheetW
PropertySheetA
InitCommonControlsEx
ImageList_SetOverlayImage
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Remove
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_GetIconSize
ImageList_GetIcon
ImageList_Duplicate
ImageList_DrawIndirect
ImageList_Draw
ImageList_Destroy
ImageList_Create
ImageList_Add
DestroyPropertySheetPage
CreatePropertySheetPageW
|CAGetCertTypePropertyEx
CAGetCertTypeProperty
CAGetCertTypeKeySpec
CAGetCertTypeFlagsEx
CAGetCertTypeFlags
CAGetCertTypeExtensionsEx
CAGetCertTypeExtensions
CAGetCertTypeExpiration
CAGetCAProperty
CAGetCACertificate
CAFreeCertTypeProperty
CAFreeCertTypeExtensions
CAFreeCAProperty
CAFindCertTypeByName
CAFindByName
CAFindByIssuerDN
CAEnumNextCertType
CAEnumNextCA
CAEnumFirstCA
CAEnumCertTypesForCAEx
CAEnumCertTypesForCA
CACountCertTypes
CACountCAs
CACloseCertType
CACloseCA
CACertTypeAccessCheck
CAAccessCheck
|AuthzInitializeResourceManager
AuthzInitializeContextFromSid
AuthzGetInformationFromContext
AuthzFreeResourceManager
AuthzFreeContext
AuthzAccessCheck
|SdbReleaseDatabase
SdbReadEntryInformation
SdbQueryData
SdbQueryApphelpInformation
SdbOpenApphelpInformation
SdbInitDatabase
SdbGetStandardDatabaseGUID
SdbGetDatabaseMatch
SdbCloseApphelpInformation
ApphelpCheckShellObject
ApphelpCheckExe
|PrintDlgW
PrintDlgA
PageSetupDlgW
PageSetupDlgA
GetSaveFileNameW
GetSaveFileNameA
GetOpenFileNameW
GetOpenFileNameA
GetFileTitleW
CommDlgExtendedError
ChooseFontW
ChooseFontA
ChooseColorW
ChooseColorA
|WZCSetInterface
WZCSetEapUserInfo
WZCRefreshInterface
WZCQueryInterface
WZCProviderDeleteWirelessProfile
WZCProviderCreateWirelessProfile
WZCProviderCreateUserProperties
WZCProviderCreateConnectionProperties
WZCPassword2Key
WZCGetSPResModule
WZCGetEapUserInfo
WZCGetDlgResModule
WZCEapolSetInterfaceParams
WZCEapolSetCustomAuthData
WZCEapolReAuthenticate
WZCEapolQueryState
WZCEapolGetInterfaceParams
WZCEapolGetCustomAuthData
WZCDeleteIntfObj
ReadEapcfgList
EapcfgNodeFromKey
DtlDestroyList
DestroyEapcfgNode
GetEncryptionForAdapter
|WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminResolveCatalogPath
CryptCATAdminRemoveCatalog
CryptCATAdminAcquireContext
|pSetupSetQueueFlags
pSetupIsUserAdmin
pSetupInstallCatalog
pSetupGetQueueFlags
pSetupConcatenatePaths
SetupTermDefaultQueueCallback
SetupSetDirectoryIdExW
SetupScanFileQueueW
SetupQueueCopyW
SetupQueueCopyIndirectW
SetupQueryInfVersionInformationW
SetupOpenMasterInf
SetupOpenLog
SetupOpenInfFileW
SetupOpenFileQueue
SetupOpenAppendInfFileW
SetupLogErrorW
SetupLogErrorA
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupInstallFilesFromInfSectionW
SetupInstallFileExW
SetupInitDefaultQueueCallbackEx
SetupGetStringFieldW
SetupGetSourceInfoW
SetupGetSourceFileLocationW
SetupGetMultiSzFieldW
SetupGetLineTextW
SetupGetLineCountW
SetupGetLineByIndexW
SetupGetIntField
SetupGetInfInformationW
SetupGetFileCompressionInfoW
SetupGetFieldCount
SetupGetBinaryField
SetupFindNextMatchLineW
SetupFindNextLine
SetupFindFirstLineW
SetupDiSetSelectedDriverW
SetupDiSetSelectedDevice
SetupDiSetDriverInstallParamsW
SetupDiSetDeviceRegistryPropertyW
SetupDiSetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiSelectBestCompatDrv
SetupDiRemoveDevice
SetupDiRegisterDeviceInfo
SetupDiOpenDeviceInterfaceW
SetupDiOpenDeviceInfoW
SetupDiOpenDevRegKey
SetupDiInstallDevice
SetupDiGetSelectedDriverW
SetupDiGetSelectedDevice
SetupDiGetDriverInstallParamsW
SetupDiGetDriverInfoDetailW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceInstallParamsW
SetupDiGetDeviceInfoListClass
SetupDiGetClassInstallParamsW
SetupDiGetClassImageList
SetupDiGetClassImageIndex
SetupDiGetClassDevsW
SetupDiGetClassDevsA
SetupDiGetActualSectionToInstallW
SetupDiEnumDriverInfoW
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiDestroyClassImageList
SetupDiDeleteDeviceInterfaceData
SetupDiDeleteDeviceInfo
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiCreateDevRegKeyW
SetupDiClassGuidsFromNameW
SetupDiCallClassInstaller
SetupDiBuildDriverInfoList
SetupDefaultQueueCallbackW
SetupDecompressOrCopyFileW
SetupCopyOEMInfW
SetupCommitFileQueueW
SetupCloseLog
SetupCloseInfFile
SetupCloseFileQueue
CM_Request_Eject_PC
CM_Is_Dock_Station_Present
CM_Get_Sibling
CM_Get_Res_Des_Data_Size
CM_Get_Res_Des_Data
CM_Get_Parent_Ex
CM_Get_Next_Res_Des
CM_Get_Next_Log_Conf
CM_Get_First_Log_Conf
CM_Get_Device_Interface_List_Size_ExW
CM_Get_Device_Interface_List_ExW
CM_Get_Device_ID_Size
CM_Get_Device_ID_ExW
CM_Get_Device_IDW
CM_Get_DevNode_Status_Ex
CM_Get_DevNode_Status
CM_Get_DevNode_Registry_Property_ExW
CM_Get_DevNode_Custom_PropertyW
CM_Get_Child
CM_Free_Log_Conf_Handle
CM_Add_Res_Des
CM_Add_Empty_Log_Conf
CM_Locate_DevNodeW
|DnsValidateName_UTF8
DnsValidateName_A
DnsSetConfigDword
DnsRecordSetDetach
DnsRecordSetCopyEx
DnsRecordSetCompare
DnsRecordListFree
DnsRecordCopyEx
DnsRecordCompare
DnsQuery_W
DnsQuery_UTF8
DnsQuery_A
DnsQueryConfigDword
DnsQueryConfigAllocEx
DnsQueryConfig
DnsNameCompare_W
DnsNameCompare_UTF8
DnsNameCompare_A
DnsFreeConfigStructure
DnsFree
DnsFlushResolverCache
DnsApiSetDebugGlobals
DnsApiRealloc
DnsApiFree
DnsApiAlloc
DnsValidateName_W
F@;F<u
?"u(GG
PSSSSSSSSj
HtJHt>Ht2Ht&
|Yjd@[@+
PSSSSSSSSj
|twjdP
|t!j`SP
PSSSSSSSj
SXS: %s() BasepSxsCreateStreams() failed
BasepCreateActCtx
QQSVWj
j-Zf9P&
{uvj-Zf9P&umf9P0ugf9P:uaf9PDu[f
x^}uTf
winlogon.EXE
|VSj(j
PWVSSh
SVVh!@
9X0t"d
GWSVh@
WWWWWP
_WinStationBeepOpen
VC20XC00U
csrsrv
CsrCreateRemoteThread
SXS: %s - Failing thread create because RtlActivateActivationContextEx() failed with status %08lx
SXS: %s - Failing thread create because RtlQueryInformationActivationContext() failed with status %08lx
SXS: %s - Failing thread create becuase NtQueryInformationThread() failed with status %08lx
CreateRemoteThread
PVSQQh
j-Yf9H&
@@BBIu
@@BBIu
@@AAJu
BroadcastSystemMessageW
Ht$Ht+Ht
E(#E,%
u\SSh 
@9]4t-
ImageOkToRunOnEmbeddedNT
|tVhdt
It*It II
kernel32: No mapping for ImageInformation.Machine == %04x
TermsrvLogInstallIniFile
TermsrvGetString
TermsrvCopyIniFile
TermsrvBuildSysIniPath
GetTermsrCompatFlags
TermsrvCORIniFile
TermsrvBuildIniFileName
TermsrvConvertSysRootToUserDir
TermsrvGetWindowsDirectoryW
TermsrvGetWindowsDirectoryA
TermsrvAdjustPhyMemLimits
TermsrvGetComputerName
TermsrvFormatObjectName
SXS: %s failing because RtlQueryInformationActivationContext() returned status %08lx
QueueUserAPC
?ulf9S
{u5j-Xf9C&u,f9C0u&f9C:u f9CDu
SXS: %s - Failure getting active activation context; ntstatus %08lx
BasepAllocateActivationContextActivationBlock
SXS: %s() LdrAccessOutOfProcessResource failed; nt status = %08lx
SXS: %s() LdrCreateOutOfProcessImage failed
SXS: %s() NtQueryInformationFile failed
BasepSxsCreateFileStream
SXS: %s() empty lpSource %ls
SXS: %s() Calling csrss server failed
SXS: %s() RtlMultiAppendUnicodeStringBuffer failed
SXS: %s() NtMapViewOfSection failed
SXS: %s() AssemblyDirectory is not null terminated
SXS: RtlCreateActivationContext() failed 0x%08lx
SXS: %s() BaseDllMapResourceIdW failed
SXS: %s() ACTCTX_FLAG_RESOURCE_NAME_VALID set but lpResourceName == 0
SXS: %s() Bad lpAssemblyDirectory %ls
SXS: %s() Bad lpSource PathType %ls, 0x%lx
SXS: %s() Bad lpAssemblyDirectory PathType %ls, 0x%lx
SXS: %s() bad wProcessorArchitecture 0x%x
CreateActCtxW
SXS: Invalid parameter(s) passed to FindActCtxSection*()
   dwFlags = 0x%08lx
   ReturnedData = %p
      ->cbSize = %u
SXS: %s() CsrCaptureMessageMultiUnicodeStringsInPlace failed
CsrBasepCreateActCtx
7KFFf;
zuKSSW
zuKWWWWV
Ht9Ht$Ht
8f;;u.f
8f;;u.f
OtuOtaOt/O
VVVPVW
u>9]8t
u<SSVSW
E(srf9
uH9]8t
f9<^t$
M$FF;u
M$FF;u
QSSSSh
u_9U ua9U$u\9U
t/HHt!
dt.@@f
f90u"P
DecryptFileW
EncryptFileW
\twain_32.dll
SaferiReplaceProcessThreadTokens
SaferRecordEventLogEntry
ReportFault
SXS: %s() NtCreateSection() failed
SXS: %s() NtOpenFile(%wZ) failed
SXS: %s() Null %p or size 0x%lx too small
SXS: %s() Bad flags/size 0x%lx/0x%lx
PADDINGXXPADDING
.debug
.reloc
.rsrc1
CPlApplet
|wzcsapi.dll
wzcdlg.dll
wtsapi32.dll
ws2_32.dll
wmvcore.dll
wmi.dll
wldap32.dll
wintrust.dll
winsta.dll
winspool.drv
winscard.dll
winmm.dll
wininet.dll
winhttp.dll
version.dll
uxtheme.dll
utildll.dll
usp10.dll
userenv.dll
user32.dll
urlmon.dll
tapi32.dll
syssetup.dll
sti.dll
shsvcs.dll
shlwapi.dll
shell32.dll
shdocvw.dll
sfc.dll
setupapi.dll
secur32.dll
scecli.dll
samlib.dll
rtutils.dll
rpcrt4.dll
regapi.dll
rasman.dll
rasdlg.dll
rasapi32.dll
query.dll
pstorec.dll
psapi.dll
printui.dll
powrprof.dll
pidgen.dll
pautoenr.dll
oleaut32.dll
oleacc.dll
ole32.dll
odbc32.dll
ocmanage.dll
ntmarta.dll
ntlsapi.dll
ntlanman.dll
ntdsapi.dll
ntdsa.dll
netshell.dll
netrap.dll
netplwiz.dll
netman.dll
netcfgx.dll
netapi32.dll
mswsock.dll
mssign32.dll
msrating.dll
msimg32.dll
msi.dll
mshtml.dll
msgina.dll
mscat32.dll
msacm32.dll
mprui.dll
mprapi.dll
mpr.dll
mobsync.dll
mlang.dll
lz32.dll
linkinfo.dll
keymgr.dll
kdcsvc.dll
iphlpapi.dll
inetcomm.dll
imm32.dll
imgutil.dll
imagehlp.dll
hnetcfg.dll
gdiplus.dll
gdi32.dll
esent.dll
efsadu.dll
duser.dll
dnsapi.dll
dhcpcsvc.dll
devmgr.dll
ddraw.dll
d3dxof.dll
cscdll.dll
cryptui.dll
crypt32.dll
credui.dll
comdlg32.dll
comctl32.dll
certcli.dll
cdfview.dll
cabinet.dll
browseui.dll
authz.dll
apphelp.dll
advpack.dll
activeds.dll
|WZCQueryConnectionStatusText
WZCOnBalloonClick
WZCIsVanRunning
WZCCanShowBalloon
WZCCanDestroyBalloon
|WTSVirtualChannelWrite
WTSVirtualChannelOpen
WTSVirtualChannelClose
WTSUnRegisterSessionNotification
WTSSendMessageW
WTSRegisterSessionNotification
WTSQueryUserToken
WTSQuerySessionInformationW
WTSLogoffSession
WTSFreeMemory
WTSEnumerateSessionsW
WTSDisconnectSession
|WSCUnInstallNameSpace32
WSCUnInstallNameSpace
WSCInstallProvider64_32
WSCInstallProvider
WSCInstallNameSpace32
WSCInstallNameSpace
WSCEnumProtocols
WSCDeinstallProvider32
WSCDeinstallProvider
WSAStringToAddressW
WSASocketW
WSALookupServiceNextW
WSALookupServiceEnd
WSALookupServiceBeginW
WSAIoctl
WSAEnumProtocolsW
WSAAddressToStringW
WSAAddressToStringA
|WMCreateReaderPriv
WMCreateEditor
|WmiNotificationRegistrationW
WmiNotificationRegistrationA
|_WinStationShadowTargetSetup
_WinStationShadowTarget
_WinStationNotifyLogoff
WinStationUnRegisterConsoleNotification
WinStationShadow
WinStationSetInformationW
WinStationSendMessageW
WinStationRegisterConsoleNotification
WinStationQueryInformationW
WinStationQueryInformationA
WinStationOpenServerW
WinStationIsHelpAssistantSession
WinStationGetTermSrvCountersValue
WinStationGetProcessSid
WinStationFreeMemory
WinStationEnumerate_IndexedW
WinStationEnumerateW
WinStationConnectW
WinStationCloseServer
|SCardReleaseContext
SCardListReadersW
SCardListReadersA
SCardListCardsW
SCardGetStatusChangeW
SCardGetCardTypeProviderNameW
SCardFreeMemory
SCardEstablishContext
SCardCancel
|UnlockUrlCacheEntryStream
UnlockUrlCacheEntryFileW
UnlockUrlCacheEntryFileA
SetUrlCacheEntryInfoW
SetUrlCacheEntryGroupW
SetUrlCacheConfigInfoA
RetrieveUrlCacheEntryStreamW
RetrieveUrlCacheEntryFileW
RetrieveUrlCacheEntryFileA
ResumeSuspendedDownload
RegisterUrlCacheNotification
ReadUrlCacheEntryStream
PrivacySetZonePreferenceW
LoadUrlCacheContent
IsHostInProxyBypassList
InternetWriteFile
InternetUnlockRequestFile
InternetTimeToSystemTimeW
InternetTimeToSystemTimeA
InternetTimeFromSystemTimeW
InternetTimeFromSystemTimeA
InternetShowSecurityInfoByURLW
InternetSetStatusCallbackW
InternetSetStatusCallbackA
InternetSetPerSiteCookieDecisionW
InternetSetOptionW
InternetSetOptionA
InternetSetFilePointer
InternetReadFileExA
InternetReadFile
InternetQueryOptionW
InternetQueryOptionA
InternetQueryFortezzaStatus
InternetQueryDataAvailable
InternetOpenW
InternetOpenUrlW
InternetOpenUrlA
InternetOpenA
InternetLockRequestFile
InternetInitializeAutoProxyDll
InternetGoOnlineW
InternetGetPerSiteCookieDecisionW
InternetGetLastResponseInfoW
InternetGetLastResponseInfoA
InternetGetConnectedStateExW
InternetGetConnectedStateExA
InternetGetConnectedState
InternetFortezzaCommand
InternetFindNextFileW
InternetFindNextFileA
InternetErrorDlg
InternetEnumPerSiteCookieDecisionW
InternetEnumPerSiteCookieDecisionA
InternetCreateUrlW
InternetCreateUrlA
InternetCrackUrlW
InternetCrackUrlA
InternetConnectW
InternetConnectA
InternetConfirmZoneCrossingW
InternetCombineUrlW
InternetCloseHandle
InternetClearAllPerSiteCookieDecisions
InternetCheckConnectionW
InternetCanonicalizeUrlW
InternetCanonicalizeUrlA
InternetAutodialHangup
InternetAutodialCallback
InternetAutodial
InternetAttemptConnect
HttpSendRequestW
HttpSendRequestExW
HttpSendRequestExA
HttpSendRequestA
HttpQueryInfoW
HttpQueryInfoA
HttpOpenRequestW
HttpOpenRequestA
HttpEndRequestW
HttpEndRequestA
HttpAddRequestHeadersW
HttpAddRequestHeadersA
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoExW
GetUrlCacheEntryInfoExA
GetUrlCacheEntryInfoA
GetUrlCacheConfigInfoW
GetUrlCacheConfigInfoA
FtpSetCurrentDirectoryW
FtpSetCurrentDirectoryA
FtpRenameFileA
FtpRemoveDirectoryA
FtpPutFileEx
FtpOpenFileW
FtpOpenFileA
FtpGetFileSize
FtpGetFileEx
FtpGetCurrentDirectoryW
FtpGetCurrentDirectoryA
FtpFindFirstFileW
FtpFindFirstFileA
FtpDeleteFileW
FtpDeleteFileA
FtpCreateDirectoryW
FtpCreateDirectoryA
FtpCommandA
FreeUrlCacheSpaceW
FindNextUrlCacheEntryW
FindNextUrlCacheEntryExW
FindNextUrlCacheEntryExA
FindNextUrlCacheEntryA
FindNextUrlCacheContainerW
FindNextUrlCacheContainerA
FindFirstUrlCacheEntryW
FindFirstUrlCacheEntryExW
FindFirstUrlCacheEntryExA
FindFirstUrlCacheEntryA
FindFirstUrlCacheContainerW
FindFirstUrlCacheContainerA
FindCloseUrlCache
DeleteUrlCacheGroup
DeleteUrlCacheEntryW
DeleteUrlCacheEntryA
DeleteUrlCacheContainerA
CreateUrlCacheGroup
CreateUrlCacheEntryW
CreateUrlCacheEntryA
CreateUrlCacheContainerW
CreateUrlCacheContainerA
CommitUrlCacheEntryW
CommitUrlCacheEntryA
|WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpOpen
WinHttpCrackUrl
WinHttpConnect
WinHttpCloseHandle
|VerQueryValueW
VerQueryValueIndexW
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA
|UrlMkSetSessionOption
UrlMkGetSessionOption
URLOpenBlockingStreamW
URLDownloadToFileW
URLDownloadToCacheFileW
SetSoftwareUpdateAdvertisementState
RevokeFormatEnumerator
RevokeBindStatusCallback
ReleaseBindInfo
RegisterMediaTypeClass
RegisterFormatEnumerator
RegisterBindStatusCallback
ObtainUserAgentString
IsValidURL
HlinkNavigateString
GetSoftwareUpdateInfo
GetMarkOfTheWeb
FindMimeFromData
FaultInIEFeature
CreateURLMoniker
CreateFormatEnumerator
CreateAsyncBindCtxEx
CoInternetSetFeatureEnabled
CoInternetQueryInfo
CoInternetParseUrl
CoInternetIsFeatureZoneElevationEnabled
CoInternetIsFeatureEnabledForUrl
CoInternetIsFeatureEnabled
CoInternetGetSession
CoInternetGetSecurityUrl
CoInternetCreateSecurityManager
CoInternetCombineUrl
|lineTranslateAddress
lineInitialize
|SfpVerifyFile
SfcWLEventLogon
SfcWLEventLogoff
SfcIsFileProtected
SfcGetNextProtectedFile
|TranslateNameW
SetContextAttributesW
QueryContextAttributesW
LsaUnregisterPolicyChangeNotification
LsaRegisterPolicyChangeNotification
LsaRegisterLogonProcess
LsaLookupAuthenticationPackage
LsaLogonUser
LsaFreeReturnBuffer
LsaDeregisterLogonProcess
LsaConnectUntrusted
LsaCallAuthenticationPackage
GetUserNameExW
GetUserNameExA
|SceSvcConvertTextToSD
SceSvcConvertSDToText
SceSetupUpdateSecurityService
SceSetupUpdateSecurityKey
SceSetupUpdateSecurityFile
SceSetupUnwindSecurityFile
SceSetupMoveSecurityFile
|SamSetSecurityObject
SamSetMemberAttributesOfGroup
SamSetInformationUser
SamSetInformationGroup
SamSetInformationDomain
SamSetInformationAlias
SamRidToSid
SamRemoveMemberFromGroup
SamRemoveMemberFromForeignDomain
SamRemoveMemberFromAlias
SamQuerySecurityObject
SamQueryInformationUser
SamQueryInformationGroup
SamQueryInformationDomain
SamQueryInformationAlias
SamQueryDisplayInformation
SamOpenUser
SamOpenGroup
SamOpenDomain
SamOpenAlias
SamLookupNamesInDomain
SamLookupIdsInDomain
SamLookupDomainInSamServer
SamGetMembersInGroup
SamGetMembersInAlias
SamGetGroupsForUser
SamGetDisplayEnumerationIndex
SamGetCompatibilityMode
SamGetAliasMembership
SamFreeMemory
SamEnumerateUsersInDomain
SamEnumerateGroupsInDomain
SamEnumerateDomainsInSamServer
SamEnumerateAliasesInDomain
SamDeleteUser
SamDeleteGroup
SamDeleteAlias
SamCreateUser2InDomain
SamCreateGroupInDomain
SamCreateAliasInDomain
SamConnect
SamCloseHandle
SamAddMemberToGroup
SamAddMemberToAlias
|UuidToStringA
UuidCreate
RpcStringFreeA
|WaitForTSConnectionsPolicyChanges
RegWinStationQueryValueW
RegWinStationQueryNumValueW
RegWinStationQueryEx
RegUserConfigSet
RegUserConfigQuery
RegPdEnumerateW
RegIsMachinePolicyAllowHelp
RegIsMachineInHelpMode
RegGetUserPolicy
RegGetMachinePolicyEx
RegDenyTSConnectionsPolicy
RegDefaultUserConfigQueryW
RegConsoleShadowQueryW
|RasReferenceRasman
RasInitialize
|RasWizSetEntryName
RasWizQueryMaxPageCount
RasWizIsEntryRenamable
RasWizGetUserInputConnectionName
RasWizGetSuggestedEntryName
RasWizGetNCCFlags
RasWizCreateNewEntry
RasUserPrefsDlg
RasUserGetManualDial
RasUserEnableManualDial
RasSrvQueryShowIcon
RasSrvIsConnectionConnected
RasSrvInitializeService
RasSrvHangupConnection
RasSrvEnumConnections
RasSrvCleanupService
RasSrvAllowConnectionsConfig
RasSrvAddWizPages
RasSrvAddPropPages
RasPhonebookDlgW
RasEntryDlgW
RasDialDlgW
|RasValidateEntryNameW
RasUnshareConnection
RasShareConnection
RasSetSharedAutoDial
RasSetEntryPropertiesW
RasSetAutodialAddressW
RasRenameEntryW
RasQuerySharedConnection
RasQuerySharedAutoDial
RasQueryLanConnTable
RasIsSharedConnection
RasHangUpW
RasGetSubEntryPropertiesW
RasGetSubEntryHandleW
RasGetProjectionInfoW
RasGetErrorStringW
RasGetEntryPropertiesW
RasGetEntryDialParamsW
RasGetCredentialsW
RasGetConnectionStatistics
RasGetConnectStatusW
RasGetAutodialAddressW
RasEnumEntriesW
RasEnumConnectionsW
RasDialW
RasDeleteEntryW
RasConnectionNotificationW
DwRasUninitialize
DwEnumEntryDetails
DwCloneEntry
|LocateCatalogsW
LoadIFilter
CITextToFullTreeEx
CIState
CIMakeICommand
|GetModuleInformation
GetModuleFileNameExW
GetModuleBaseNameW
EnumProcessModules
|vServerPropPages
vQueueCreate
vPrinterPropPages
vDocumentDefaults
bPrinterSetup
bFolderRefresh
bFolderGetPrinter
bFolderEnumPrinters
UnregisterPrintNotify
ShowErrorMessageSC
ShowErrorMessageHR
RegisterPrintNotify
|SetSuspendState
SetActivePwrScheme
ReadPwrScheme
IsPwrSuspendAllowed
IsPwrShutdownAllowed
IsPwrHibernateAllowed
GetActivePwrScheme
|LresultFromObject
GetRoleTextW
CreateStdAccessibleProxyW
CreateStdAccessibleObject
AccessibleObjectFromWindow
|NtLicenseRequestW
NtLSFreeHandle
|NPCancelConnectionForCSCAgent
NPAddConnection3ForCSCAgent
|DsWriteAccountSpnW
DsUnquoteRdnValueW
DsUnBindW
DsMakeSpnW
DsMakePasswordCredentialsW
DsGetRdnW
DsFreePasswordCredentials
DsFreeNameResultW
DsCrackNamesW
DsBindWithCredW
DsBindW
|NcFreeNetconProperties
HrOemUpgrade
HrGetAnswerFileParametersForNetCard
|SHDisconnectNetDrives
NetPlacesWizardDoModal
|UpdateLanaConfigUsingAnswerfile
HrDiAddComponentToINetCfg
|NetpUpgradePreNT5JoinInfo
NetpIsRemote
Netbios
NetWkstaUserGetInfo
NetWkstaGetInfo
NetValidateName
NetUserSetInfo
NetUserModalsGet
NetUserGetLocalGroups
NetUserGetInfo
NetUserGetGroups
NetUserDel
NetUserChangePassword
NetUserAdd
NetUnjoinDomain
NetShareSetInfo
NetShareGetInfo
NetSessionEnum
NetServerSetInfo
NetServerGetInfo
NetRenameMachineInDomain
NetQueryDisplayInformation
NetMessageBufferSend
NetLocalGroupGetMembers
NetJoinDomain
NetGetJoinInformation
NetEnumerateTrustedDomains
NetDfsGetInfo
NetDfsGetClientInfo
NetApiBufferFree
NetApiBufferAllocate
NetAlertRaiseEx
I_NetNameValidate
I_NetNameCanonicalize
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
DsGetDcSiteCoverageW
DsGetDcNameWithAccountW
DsGetDcNameW
DsEnumerateDomainTrustsW
DsAddressToSiteNamesW
|SpcGetCertFromKey
SignerTimeStampEx
SignerSignEx
SignerFreeSignerContext
PvkGetCryptProv
PvkFreeCryptProv
GetCryptProvFromCert
FreeCryptProvFromCert
|TransparentBlt
GradientFill
AlphaBlend
|ShowModelessHTMLDialog
ShowHTMLDialogEx
ShowHTMLDialog
|acmStreamUnprepareHeader
acmStreamSize
acmStreamPrepareHeader
acmStreamOpen
acmStreamConvert
acmStreamClose
acmFormatTagDetailsW
acmFormatSuggest
|MPRUI_WNetDisconnectDialog1W
MPRUI_WNetDisconnectDialog1A
MPRUI_WNetDisconnectDialog
MPRUI_WNetConnectionDialog1W
MPRUI_WNetConnectionDialog1A
MPRUI_WNetConnectionDialog
MPRUI_WNetClearConnections
MPRUI_ShowReconnectDialog
MPRUI_DoProfileErrorDialog
MPRUI_DoPasswordDialog
|WNetUseConnectionW
WNetRestoreConnectionW
WNetRestoreConnectionA
WNetRestoreConnection2W
WNetOpenEnumW
WNetGetUserW
WNetGetUniversalNameW
WNetGetResourceParentW
WNetGetResourceInformationW
WNetGetResourceInformationA
WNetGetProviderTypeW
WNetGetProviderNameW
WNetGetNetworkInformationW
WNetGetLastErrorW
WNetGetLastErrorA
WNetGetConnectionW
WNetGetConnectionA
WNetGetConnection3W
WNetFormatNetworkNameW
WNetEnumResourceW
WNetDisconnectDialog1W
WNetDisconnectDialog
WNetConnectionDialog1W
WNetConnectionDialog
WNetCloseEnum
WNetClearConnections
WNetCancelConnection2W
WNetAddConnection3W
WNetAddConnection2W
MultinetGetErrorTextW
MultinetGetConnectionPerformanceW
|LZOpenFileW
LZCopy
LZClose
|PRShowSaveWizardW
PRShowSaveWizardExW
PRShowSaveFromMsginaW
PRShowRestoreWizardW
PRShowRestoreWizardExW
PRShowRestoreFromMsginaW
KRShowKeyMgr
|SetAdapterIpAddress
NotifyRouteChange
NotifyAddrChange
NhGetInterfaceNameFromDeviceGuid
GetUdpStatistics
GetTcpStatistics
GetRTTAndHopCount
GetPerAdapterInfo
GetNumberOfInterfaces
GetIpStatistics
GetIpNetTable
GetIpForwardTable
GetIpAddrTable
GetInterfaceInfo
GetIfTable
GetIfEntry
GetIcmpStatistics
GetFriendlyIfIndex
GetBestRoute
GetBestInterface
GetAdaptersInfo
GetAdaptersAddresses
AllocateAndGetIpAddrTableFromStack
|IcfGetOperationalMode
IcfDisconnect
IcfConnect
|SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
SetSystemPaletteUse
SetMapMode
SelectPalette
SelectObject
RealizePalette
GetSystemPaletteEntries
GetStockObject
GetObjectType
GetDeviceCaps
DeleteObject
DeleteDC
CreatePalette
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
|JetUpdate
JetTerm2
JetTerm
JetSetSystemParameter
JetSetSessionContext
JetSetIndexRange
JetSetCurrentIndex
JetSetColumn
JetSeek
JetRollback
JetRetrieveColumn
JetResetSessionContext
JetPrepareUpdate
JetOpenTable
JetOpenDatabase
JetMove
JetMakeKey
JetInit
JetIndexRecordCount
JetGetTableColumnInfo
JetGetDatabaseInfo
JetEndSession
JetDetachDatabase
JetDeleteTable
JetDelete
JetCreateTableColumnIndex
JetCreateDatabase
JetCommitTransaction
JetCloseTable
JetCloseDatabase
JetBeginTransaction
JetBeginSession
JetAttachDatabase
JetAddColumn
|UtilDrawBlendRect
SetGadgetStyle
SetGadgetRootInfo
SetGadgetRect
SetGadgetParent
SetGadgetMessageFilter
SetGadgetFocus
SetGadgetFillI
SetGadgetBufferInfo
MapGadgetPoints
LookupGadgetTicket
InvalidateGadget
InitGadgets
GetStdColorI
GetStdColorBrushI
GetMessageExW
GetGadgetTicket
GetGadgetSize
GetGadgetRgn
GetGadgetRect
GetGadgetFocus
GetGadgetAnimation
GetDebug
ForwardGadgetMessage
FindStdColor
FindGadgetFromPoint
DetachWndProc
DeleteHandle
DUserSendEvent
DUserPostEvent
CreateGadget
CreateAction
BuildInterpolation
BuildDropTarget
BuildAnimation
AutoTrace
AttachWndProcW
|DhcpStaticRefreshParams
DhcpRequestParams
DhcpReleaseParameters
DhcpNotifyConfigChange
DhcpCApiInitialize
DhcpCApiCleanup
DhcpAcquireParametersByBroadcast
DhcpAcquireParameters
|DirectDrawEnumerateExW
DirectDrawEnumerateExA
DirectDrawCreateEx
DirectDrawCreate
|LocalEnrollNoDS
LocalEnroll
CryptUIDlgViewCertificateW
CryptUIDlgViewCTLW
CryptUIDlgViewCRLW
|CryptVerifyMessageSignature
CryptVerifyCertificateSignature
CryptUnprotectData
CryptSignMessage
CryptSignAndEncodeCertificate
CryptQueryObject
CryptProtectData
CryptMsgGetParam
CryptMsgGetAndVerifySigner
CryptMsgClose
CryptImportPublicKeyInfoEx
CryptImportPublicKeyInfo
CryptHashPublicKeyInfo
CryptFormatObject
CryptExportPublicKeyInfo
CryptEncryptMessage
CryptEncodeObjectEx
CryptEncodeObject
CryptDecryptMessage
CryptDecodeObjectEx
CryptDecodeObject
CertVerifySubjectCertificateContext
CertVerifyCertificateChainPolicy
CertStrToNameW
CertSetCertificateContextProperty
CertRegisterPhysicalStore
CertRDNValueToStrW
CertOpenSystemStoreW
CertOpenStore
CertNameToStrW
CertGetPublicKeyLength
CertGetNameStringW
CertGetIssuerCertificateFromStore
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertGetCertificateChain
CertFreeCertificateContext
CertFreeCertificateChain
CertFreeCTLContext
CertFindSubjectInCTL
CertFindExtension
CertFindCertificateInStore
CertFindCTLInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCTLContext
CertDeleteCertificateFromStore
CertCreateCertificateContext
CertCreateCTLContext
CertControlStore
CertCompareCertificateName
CertCloseStore
CertAddCertificateContextToStore
|CredUIStoreSSOCredW
CredUIPromptForCredentialsW
CredUIParseUserNameW
CredUIInitControls
CredUIFlushAllCredentials
CredUICmdLinePromptForCredentialsW
|SubscribeToCDF
ParseDesktopComponent
|RunSetupCommand
RegInstall
tyItgItUItC
f9;t3h
uU9>w}VS
jWX_^[]
|jWX_^[
u4SVWj
HT;JTu
PSSSSSSSj
PSSSSSSh 
PSSSSSSSSj
DBWinMutex
tBWWWj
OutputDebugString faulted during output
DBWIN_DATA_READY
DBWIN_BUFFER_READY
DBWIN_BUFFER
SSSSWP
j-Yf9H&
f98t PVS
8@@BBIu
jWX_^[]
DuplicateEncryptionInfoFile
j-Yf9H&
Ht1Ht#Ht
QQSVWd
GetSecurityDescriptorControl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetMemory
mem16.dll
Ht1Ht+
ImpersonateNamedPipeClient
RevertToSelf
E	Ht-HHt"Ht
CreateProcessNotify
PVVVVVV
PVVVVVVSVV
hypertrm.exe"
hypertrm.exe
6SSSSW
HHt\Ht
PSSSSSSh 
TermsrvUpdateAllUserMenu
[VVj`j
WWWWWWWWh
invalid handle exception for current stack trace
access violation exception for current stack trace
Invalid address being accessed
Code performing invalid access
.exr (exception record)
.cxr (context record)
t]VVVVW
j@Yt3+
t7Ht0Ht'Ht
serialui.dll
CM_Get_Device_ID_ListW
CM_Get_Device_ID_List_SizeW
drvCommConfigDialogW
drvGetDefaultCommConfigW
drvSetDefaultCommConfigW
9w(tlVVj
9~,tH;
mekr386.exe
 -i%lx
\system32\ntvdm
{u/j-Yf9H&u&f9H0u f9H:u
j-Yf9H&
PVWSSh
j-Xf9F&u}f9F0uwf9F:uqf9FDukf
~^}udf
td< t`
OCTS=OFF
OCTS=ON
IDSR=OFF
IDSR=ON
ODSR=OFF
ODSR=ON
XON=OFF
XON=ON
TO=OFF
STOP=#
STOP=1.5
DATA=#
PARITY=@
BAUD=#
PPPPh$@
SXS: %s() BaseDllMapResourceIdA failed
CreateActCtxA
 %2d.  "%ls" %ld
(LRU)   (Exe Name) (FileSize)
Total Entries = 0x%x
---------------------------------------------
Can't get ShimCacheLock
SVWsGd
f;G up
f;~ v	
f;~ u{
GdiConvertPalette
uoWShP
uWWShH
RRVRQS
FFf9>u
VVVVVP
KVVVVVh4
VVVVVh(
<{f;>u.
f9<Fu+
f9<Ft.
U u1f;y
9](urj
tXVQQQQh
xpsp2res.dll
xpsp3res.dll
9w9@@f
f;2u{f
f;2ujf
f;2uYf
f;2uHf
f;2u7f
f;2u&f
1f;2u}f
1f;2uif
1f;2uUf
1f;2uAf
1f;2u-f
(tnHtU
't:Ht!-
taHHtJHt4
2BBCC3
cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
cccccccccccccccccccc
NlsDllCodePageTranslation
f98u!P
?-t	jz
?456789:;<=
 !"#$%&'()*+,-./0123
;+ut;E
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
|MigrateWinsockConfiguration
|AccRewriteSetNamedRights
|SetupChangeFontSize
|StiCreateInstanceW
|CertAutoEnrollment
|DecodeImage
|DirectXFileCreate
|KdcAccountChangeNotification
|PStoreCreateInstance
HrLanConnectionNameFromGuidOrPath
|EfsDetail
|SyncMgrRasProc
F,@Pj@
F(;~,u
ntdll.dll
_wcsnicmp
NtFsControlFile
NtCreateFile
RtlAllocateHeap
RtlFreeHeap
NtOpenFile
NtQueryInformationFile
NtQueryEaFile
RtlLengthSecurityDescriptor
NtQuerySecurityObject
NtSetEaFile
NtSetSecurityObject
NtSetInformationFile
CsrClientCallServer
NtDeviceIoControlFile
NtClose
RtlInitUnicodeString
wcscspn
RtlUnicodeToMultiByteSize
wcslen
_memicmp
memmove
NtQueryValueKey
NtOpenKey
NtFlushKey
NtSetValueKey
NtCreateKey
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlDnsHostNameToComputerName
wcsncpy
RtlUnicodeStringToAnsiString
RtlxUnicodeStringToAnsiSize
NlsMbCodePageTag
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlCreateUnicodeStringFromAsciiz
wcschr
wcsstr
RtlPrefixString
_wcsicmp
RtlGetFullPathName_U
RtlGetCurrentDirectory_U
NtQueryInformationProcess
RtlUnicodeStringToOemString
RtlReleasePebLock
RtlEqualUnicodeString
RtlAcquirePebLock
RtlFreeAnsiString
RtlSetCurrentDirectory_U
RtlTimeToTimeFields
RtlTimeFieldsToTime
NtQuerySystemInformation
RtlInitializeCriticalSection
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtSetSystemTime
RtlSetTimeZoneInformation
NtSetSystemInformation
RtlCutoverTimeToSystemTime
_allmul
wcscmp
NtEnumerateKey
RtlOpenCurrentUser
RtlQueryRegistryValues
DbgBreakPoint
RtlFreeSid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
DbgPrint
NtOpenProcess
CsrGetProcessId
DbgUiDebugActiveProcess
DbgUiConnectToDbg
DbgUiIssueRemoteBreakin
NtSetInformationDebugObject
DbgUiGetThreadDebugObject
NtQueryInformationThread
DbgUiConvertStateChangeStructure
DbgUiWaitStateChange
DbgUiContinue
DbgUiStopDebugging
RtlDosPathNameToNtPathName_U
RtlIsDosDeviceName_U
RtlCreateAtomTable
NtAddAtom
RtlAddAtomToAtomTable
NtFindAtom
RtlLookupAtomInAtomTable
NtDeleteAtom
RtlDeleteAtomFromAtomTable
NtQueryInformationAtom
RtlQueryAtomInAtomTable
RtlOemStringToUnicodeString
RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteN
RtlMultiByteToUnicodeSize
RtlPrefixUnicodeString
NtEnumerateValueKey
RtlIsTextUnicode
NtReadFile
NtAllocateVirtualMemory
NtUnlockFile
NtLockFile
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlCopyUnicodeString
NtFreeVirtualMemory
NtWriteFile
RtlCreateUnicodeString
RtlFormatCurrentUserKeyPath
RtlGetLongestNtPathLength
NtDuplicateObject
NtQueryKey
NtDeleteValueKey
RtlEqualString
CsrFreeCaptureBuffer
CsrCaptureMessageString
CsrAllocateCaptureBuffer
strncpy
RtlCharToInteger
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeString
CsrAllocateMessagePointer
NtQueryObject
RtlCompareMemory
NtQueryDirectoryObject
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
NtOpenDirectoryObject
NtCreateIoCompletion
NtSetIoCompletion
NtRemoveIoCompletion
NtSetInformationProcess
NtQueryDirectoryFile
RtlDeleteCriticalSection
NtNotifyChangeDirectoryFile
NtWaitForSingleObject
NtQueryVolumeInformationFile
NtFlushBuffersFile
RtlDeactivateActivationContextUnsafeFast
RtlActivateActivationContextUnsafeFast
NtCancelIoFile
NtReadFileScatter
NtWriteFileGather
wcscpy
NtOpenSection
NtMapViewOfSection
NtFlushVirtualMemory
RtlFlushSecureMemoryCache
NtUnmapViewOfSection
NtCreateSection
NtQueryFullAttributesFile
swprintf
NtQueryAttributesFile
RtlDetermineDosPathNameType_U
NtRaiseHardError
NtQuerySystemEnvironmentValueEx
RtlGUIDFromString
NtSetSystemEnvironmentValueEx
RtlInitString
RtlUnlockHeap
RtlSetUserValueHeap
RtlFreeHandle
RtlAllocateHandle
RtlLockHeap
RtlSizeHeap
RtlGetUserInfoHeap
RtlReAllocateHeap
RtlIsValidHandle
RtlCompactHeap
RtlImageNtHeader
NtProtectVirtualMemory
NtQueryVirtualMemory
NtLockVirtualMemory
NtUnlockVirtualMemory
NtFlushInstructionCache
NtAllocateUserPhysicalPages
NtFreeUserPhysicalPages
NtMapUserPhysicalPages
NtMapUserPhysicalPagesScatter
NtGetWriteWatch
NtResetWriteWatch
NtSetInformationObject
LdrQueryImageFileExecutionOptions
CsrNewThread
CsrClientConnectToServer
RtlCreateTagHeap
LdrSetDllManifestProber
RtlSetThreadPoolStartFunc
RtlEncodePointer
_stricmp
wcscat
RtlCreateHeap
RtlDestroyHeap
RtlExtendHeap
RtlQueryTagHeap
RtlUsageHeap
RtlValidateHeap
RtlGetProcessHeaps
RtlWalkHeap
RtlSetHeapInformation
RtlQueryHeapInformation
RtlInitializeHandleTable
RtlExtendedLargeIntegerDivide
NtCreateMailslotFile
RtlFormatMessage
RtlFindMessage
LdrUnloadDll
LdrUnloadAlternateResourceModule
LdrDisableThreadCalloutsForDll
strchr
LdrGetDllHandle
LdrUnlockLoaderLock
LdrAddRefDll
RtlComputePrivatizedDllName_U
RtlPcToFileHeader
LdrLockLoaderLock
RtlGetVersion
LdrEnumerateLoadedModules
RtlVerifyVersionInfo
RtlUnicodeStringToInteger
LdrLoadAlternateResourceModule
RtlDosApplyFileIsolationRedirection_Ustr
LdrLoadDll
LdrGetProcedureAddress
LdrFindResource_U
LdrAccessResource
LdrFindResourceDirectory_U
RtlImageDirectoryEntryToData
_strcmpi
NtSetInformationThread
NtOpenThreadToken
NtCreateNamedPipeFile
RtlDefaultNpAcl
RtlDosSearchPath_Ustr
RtlInitUnicodeStringEx
RtlQueryEnvironmentVariable_U
RtlAnsiCharToUnicodeChar
RtlIntegerToChar
NtSetVolumeInformationFile
RtlIsNameLegalDOS8Dot3
NtQueryPerformanceCounter
sprintf
NtPowerInformation
NtInitiatePowerAction
NtSetThreadExecutionState
NtRequestWakeupLatency
NtGetDevicePowerState
NtIsSystemResumeAutomatic
NtRequestDeviceWakeup
NtCancelDeviceWakeupRequest
NtWriteVirtualMemory
LdrShutdownProcess
NtTerminateProcess
RtlRaiseStatus
RtlSetEnvironmentVariable
RtlExpandEnvironmentStrings_U
NtReadVirtualMemory
RtlCompareUnicodeString
NtCreateJobSet
NtCreateJobObject
NtIsProcessInJob
RtlEqualSid
RtlSubAuthoritySid
RtlInitializeSid
NtQueryInformationToken
NtOpenProcessToken
NtResumeThread
NtAssignProcessToJobObject
CsrCaptureMessageMultiUnicodeStringsInPlace
NtCreateThread
NtCreateProcessEx
RtlDestroyEnvironment
NtQuerySection
NtQueryInformationJobObject
RtlGetNativeSystemInformation
RtlxAnsiStringToUnicodeSize
NtOpenEvent
NtQueryEvent
NtTerminateThread
wcsrchr
NlsMbOemCodePageTag
RtlxUnicodeStringToOemSize
NtAdjustPrivilegesToken
RtlImpersonateSelf
wcsncmp
RtlDestroyProcessParameters
RtlCreateProcessParameters
RtlInitializeCriticalSectionAndSpinCount
NtSetEvent
NtClearEvent
NtPulseEvent
NtCreateSemaphore
NtOpenSemaphore
NtReleaseSemaphore
NtCreateMutant
NtOpenMutant
NtReleaseMutant
NtSignalAndWaitForSingleObject
NtWaitForMultipleObjects
NtDelayExecution
NtCreateTimer
NtOpenTimer
NtSetTimer
NtCancelTimer
NtCreateEvent
RtlCopyLuid
strrchr
_vsnwprintf
RtlReleaseActivationContext
RtlActivateActivationContextEx
RtlQueryInformationActivationContext
NtOpenThread
LdrShutdownThread
RtlFreeThreadActivationContextStack
NtGetContextThread
NtSetContextThread
NtSuspendThread
RtlRaiseException
RtlDecodePointer
towlower
RtlClearBits
RtlFindClearBitsAndSet
RtlAreBitsSet
NtQueueApcThread
NtYieldExecution
RtlRegisterWait
RtlDeregisterWait
RtlDeregisterWaitEx
RtlQueueWorkItem
RtlSetIoCompletionCallback
RtlCreateTimerQueue
RtlCreateTimer
RtlUpdateTimer
RtlDeleteTimer
RtlDeleteTimerQueueEx
CsrIdentifyAlertableThread
RtlApplicationVerifierStop
_alloca_probe
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlCreateQueryDebugBuffer
RtlCreateEnvironment
RtlFreeOemString
strstr
toupper
isdigit
tolower
NtOpenJobObject
NtTerminateJobObject
NtSetInformationJobObject
RtlAddRefActivationContext
RtlZombifyActivationContext
RtlActivateActivationContext
RtlDeactivateActivationContext
RtlGetActiveActivationContext
DbgPrintEx
LdrDestroyOutOfProcessImage
LdrAccessOutOfProcessResource
LdrFindCreateProcessManifest
LdrCreateOutOfProcessImage
RtlNtStatusToDosErrorNoTeb
RtlpApplyLengthFunction
RtlGetLengthWithoutLastFullDosOrNtPathElement
RtlpEnsureBufferSize
RtlMultiAppendUnicodeStringBuffer
_snwprintf
RtlCreateActivationContext
RtlFindActivationContextSectionString
RtlFindActivationContextSectionGuid
_allshl
RtlNtPathNameToDosPathName
RtlUnhandledExceptionFilter
CsrCaptureMessageBuffer
NtQueryInstallUILanguage
NtQueryDefaultUILanguage
wcspbrk
RtlGetDaclSecurityDescriptor
NtCreateDirectoryObject
_wcslwr
RtlIntegerToUnicodeString
NtQueryDefaultLocale
_strlwr
RtlUnwind
kernel32.pdb
0123456789ABCDEF
?+?8?D?P?\?h?t?
0'03080K0W0c0o0{0
111P1o1
: :$:0:f:u:{:
;>;d;h;n;
;'<L<P<X<\<
A0L0X0
<T<X<u<
>!>7>`>!?2?
;=<J<q<
=T=X=Y>
1-1O1h1s1
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
4$4,444<4D4L4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=|=
>$>,>4><>D>L>T>\>d>l>t>|>
0G0U0b0h0v0|0
11171K1
3 4,4>4J4
5L5P5_5i5
?0?E?h?
1E1_1r1
2L3r3}3
5^7i7L8W8l8
=4=E=K=]=c=|=
>>>M>S>l>r>|>
?%???E?V?\?
'0-0D0H0T0
0<1Q1w1
2(242A2l2
=N=~=*>
0/0:0K0a0
0$1(1v1~1
>:>>>B>F>J>N>R>V>Z>^>b>f>j>n>r>v>z>~>
?"?&?*?.?2?6?:?>?B?F?J?N?R?V?Z?^?b?f?j?n?r?v?z?~?
0"0&0*0.02060:0>0i0
0Z1a1f1r1
5"5(5K5Q5d5h506
9/989`9#:K:
; <6<`<
>B>_>p>
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
7$7,747<7D7L7T7\7d7l7t7|7
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
1,202N2
4H5p5z5
6#7V7`7
7S8_8z8
0$070W0p0
464=4B4O4Y4
5I5O5v5
8/8:8T8Z8a8
999A9I9N9U9Z9f9n9t9
:B:I:i:q:
;	<#<9<O<e<{<
=^=t=~=
>5>D>b>q>
???P?m?~?
1!1P1V1k1r1
2/262E2U2a2j2
3)3@3]3o3~3
6 6*6/656@6F6M6^6q6
7&7.7E7M7R7W7]7k7x7~7
969f9k9p9u9
9-:5:;:X:b:h:
;%;6;H;W;
<*=[=m=
3U4^4s4
556;6@6o6u6
{081>1X1
:$:,:Y:a:}:
: ;;;|;
;+<V<`<
<1=;=m=
>%>:>U>v>
*0K0S0
3#393I3P3[3_3m3t3}3
839>9i9s9
1#2*20252@2M2R2W2m2y2
2"3R3h3
70777=7I7W7i7z7
:":=:G:Q:r:|:
:2;R;p;z;
;D<H<P<T<
=B=b=n=w=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
5`6h6l6t6x6
:3:9:c:q:~:
:%;5;L;Y;};
;A<L<b<k<v<
=0=T=[=|=
>$>@>L>P>_>e>k>v>|>
0,1=1j1
202D2L2T2
4-4S4d4
<<<T<\<v<
333F3_3
9H9\9s9
 0.0N0b0
102_2f2k2
4=6B6a6
<(=6>?>
3$393B3T3i3
777R7|7
<)<W<c<
<(=K=i=p={=
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;x;|;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
0H1L1P1T1X1\1`1d1
2$2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
4$4,444<4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
: :$:(:,:0:4:8:<:@:D:H:L:P:T:
;$;,;4;<;D;L;T;\;d;l;t;|;
<$<,<4<<<D<L<T<\<d<l<t<|<
=$=,=4=<=D=L=T=\=d=l=t=|=
>$>,>4><>D>L>T>X>\>`>d>h>l>p>t>x>|>
> ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
2$2,242<2D2L2T2X2\2`2d2h2l2p2t2x2|2
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
3<8@8D8H8L8P8T8X8\8`8
8@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0\7d7l7t7|7
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
88:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
;@=D=H=L=P=T=X=\=`=d=h=l=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>h?l?p?t?x?|?
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
4 4$4(4,40444
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
8 8$8(8,8084888<8@8D8H8L8P8T8
`3d3h3l3p3t3x3|3
4 4$4(4,4
9	:[:c:
1>1Q1n1v1
2#292c2z2
6$7[7s7
< <&< =O=f=
233>5]5
:0<4<8<<<@<D<H<L<P<T<X<u<
>%?5?k?
0#111[1
434F4[4h4
5!555\5p5
839A9t9
0.1X1g1p1
2<2^2q2x2
8	949z9
:%:T:i:~:
4-676f6
9,949p9
0	252|2-393
3=4F4W4n4
7B8N8w8
9C9I9h9v9|9
; ;,;s;
<C<l<p<|<
3D3H3P3T3
787`7p7w8
?%?P?w?
0 0+0q0
1$1)181
4A5b5n5z5
656;6\6`6
7E8c8p8
:E:N:o:
< >7>=>N>T>
?%?<?@?U?[?w?}?
0b0h0{0
2$2*2:2C2X2e2l2q2x2
233:3A3w3
5?5K5l6
=4=8=D=
>4>8>>>
,0@0b0x0
6$6=6M6~6
;,;3;:;N;
= >B>W>
0"0n0|0
425B5d5
6 7P7_7u7
9k:B<L<
 090D0
1w1&2|2
7y8%9P9
9I:^:n:
<@<Y<c<
=H=N=W=c=n={=
3#3L3N4
5,6b6m6
7-7S7t7
,0T0q071e1
2<3[364
7@7g7u7
8!8)8.8:8G8
9$9J9{9
2j5;7A7f7t7z7
:.;l;q;
>#?4?P?
	0O0k0
2B2K2l2
3K4Q4i4
8C9S9n9
:!;]=i=
1&131t2
5M5[5d5
8.9;9l9~9
2]3?4H4g4
8"959^;j;
<G=h="?_?
4.4?4h4
4:5$6v6
=N>Z>{>
4T4`4x4
0#1)1K1R1j1p1
526T6_6f6t6{6
7!707C7P7V7R8
202?2L2U2
555E5O5m6
9V9b9n9
>	? ?h?o?
0!0W0`0r0
3=3J3W3
4+4>4I4O4h4o4u4
555H5u5
6 7(70787P8=9G9
4!5-5S5
6!6/6T6`6
6b7h7q7w7
9%999R9[9
91:8:T:
:2;:;T;^;j;
1$1.141>1D1N1T1^1
4D4]4x4
92:B:[:
<0=6=>=
=)=y>~>
1	2!2?2c2R4?5D5
9=9::D:g:~:
979T9q9
2t3M4,5
:H<Q<j<
5/7N;i;p;
1 6<6@6
> >(>,>4>8>@>H>L>P>X>\>d>l>p>t>|>
?$?(?0?4?<?D?H?L?T?X?`?d?l?p?x?|?
0 0$0,00080<0D0H0P0T0\0`0h0l0t0|0
1 1(1,14181@1D1L1P1X1\1d1h1p1t1x1|1
2$2(2024282<2@2H2L2T2X2\2`2d2l2p2x2
2L8T8\8d8l8t8|8
9$9,949<9D9L9T9\9d9l9t9|9
:$:,:4:<:D:L:T:\:d:l:t:|:
;$;,;4;<;D;L;T;\;d;l;t;|;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<
= =$=(=,=0=4=X>\>`>d>h>l>p>t>x>|>
`0d0h0l0
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l94:8:<:@:D:H:L:P:T:X:\:`:d:h:
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;
?@?D?H?L?P?T?X?\?`?d?
0 0$0(0,00040
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
7(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
P0T0X0\0`0d0h0l0p0t0
081<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
2D3H3L3P3T3X3\3`3d3h3
4$4,44484<4@4D4l4p4t4x4
54686<6@6t6x6|6
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
8P;T;X;\;`;d;h;l;p;t;x;|;
;4<8<<<@<D<H<|<
= =$=(=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0P3X3`3h3p3t3x3|3
5 5$5(5,5054585<5
7 7$7`7d7h7l7p7t7x7|7
7@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
: :$:(:,:0:4:8:<:@:D:H:L:
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0<1@1D1H1L1P1T1X1
1P2T2X2\2`2d2h2l2p2t2x2|2
3 3$3(3,3034383<3@3D3H3L3P3T3X3\3`3d3h3l3p3t3x3|3
9 9$9(9,9094989<9@9D9H9
:<:D:L:T:\:d:l:t:x:|:
>I?O?d?h?s?
21363b3g3
464;4n4s4
6'6J6a6j6
6/7?7`7
818A8g8
=2=f=q=
001P1V1{1
1)222j2
3"31393n3w3
3g4l4x4
9%9<9T9v9<:W:
1#1_1j1
5"6/6<6
6^7j7)8L8
4.4J4.5t5
5\6`6h6l6
>,>8>f>
2C2L2d2
5)555|5
:6;V;	<
<'=$?-?
0L1/2Y2'3
7N7p7|7
:-;3;L;u;};
;	<=<o<
>2>F>]>
8 959Q9
0&0/0J0S0Y0b0x0
0(111G1v1
1 4,4}4
=(>.>>>D>c>
3%3@3F3M3R3Z3e3n3t3~3
4(4/464W4o4~4
4?5P5e5
647S7_7
7@8d8h8t8
8H9g9s9
:D;d;p;
;J<l<p<|<
>Z?r?~?
9 :&:A:X:
=">C>P>b>
1#2*22292L2R2b2j2u2
3"3]3j3
3,4h4x4
<E<Q<\<
'0Q0t0x0
203D3t3
536g6w6
7*757D7N7e7
:1:@:M:
223N3[3
=%=D=V=k=
>"?S?c?
5/5K5X5e5k5y5
5N6Y6_6h6s6y6
6|7C8Z8
;';A;O;];k;
;J<`<}<
<"=*=8=B=W=c=
0R0`0l0
1X1d1v1
1"202<2
2(343M3b3n3
4k4{4p5
7"717I7d7
7P9l9d:v:M;`;
>5?\?`?o?y?
111L1v1
5"505l5
5	6=6J6^6l6
?,?P?h?
555>5c5q5
5B6s6|6
7	8(818M8
3"3b3n3
3!404<4
4O5`5l5
8a9p9|9
0C0H0s0
1!262_2u2
383T3p3
=%>Z>s>
1"1m1r1~1
353>3I3b3
4!434_4w475G5L5\5c5h5o5{5
7 8G8_8~8
::;	<"<y<
8/9a9t9
<?='>:>
6$7H7|7
; ;k;u;
<?<S<_<
=;=P=W=
>)>0>J>
011b1|1
1$2(242@2Z2`2j2
4%525k5u5
6Y7h7}7
7'838L8h8n8
9Z:h:w:
<8<><P<_<i<y<
=<=B=P=Z=j=t=
> >5>r>
181d1h1p1t1
3<4@4U4
585R5]5r5
9 929;9E9b9q9~9
1!2A2t2x2
5+5f5q5
8\9`9h9l9{9
94:8:G:Q:
:$;g;|;
>4>8>G>Q>
>	?M?s?
0-0d0~0
1R1t1x1
233M3v3
565t5x5
626t6x6
939?9j9
;+;5;};
<+<T<X<m<
>(?B?e?o?
0 050f0{0
6?7J7k7
8,808E8}8
; ;&;,;Q;t;
; <5<J<T<
9@;[;z;
<g<n<w<
>$>\>x>
2.3<4N4
182W2|3
505`5w5
617<7X7
:3;I;{;
<N<[<b<h<t<y<~<
3 3$3(3,3]3w3
8;9,?2?
818B8`8f8
>!>+>C>N>X>
2$2:2P2f2|2
3,3B3X3n3
4 4O4b4u4
>!>6>p>
2$2\2o2
7!7&7<7b7g7
8"949>9s9
:H:V:n:
< =E=V=l=
>#>7>W>
+0;0x0
051U1}2
4)6Y6p6
728V8z8
>\?`?d?
H0L0l0T1X1
3 5$5(5,5
5t8x8(9,9
0*050@0K0V0a0l0w0
686D6P6\6h6
3,3H3T3`3t3|3
4 4$4(4,4044484