Sample details: 52eac742fabc7f16c1d5a5811ab2669d --

Hashes
MD5: 52eac742fabc7f16c1d5a5811ab2669d
SHA1: 123f15d2d52a8a82ef8b55edc8bbcf23767d3500
SHA256: 8704d923b7d9c1335b692837497f5d56f3fd655602214c7089345ba8259e4726
SSDEEP: 1536:xyNikaDwrcDm5XVeEI54bYKthS2Cn9ebqg+4ws/ueRixQrwyWvU0uDLn3zjcCt:cgyHHeEI54bYKLPNUCi5Ct
Details
File Type: data
Added: 2018-03-07 03:47:04
Yara Hits
CuckooSandbox/embedded_win_api | YRP/domain | YRP/contentis_base64 | YRP/DebuggerCheck__GlobalFlags | YRP/DebuggerCheck__QueryInfo | YRP/DebuggerHiding__Thread | YRP/DebuggerHiding__Active | YRP/SEH__vectored | YRP/disable_dep |
Parent Files
942231b40dc83fcea08505c19d791012
Source
Strings
		??_C@_13CGOKJPIL@?$AA?1?$AA?$AA@
??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
??_C@_15MNCACJLI@?$AA?2?$AA?1?$AA?$AA@
?PropertyLengthAsVariant@@YGKPBUtagSERIALIZEDPROPERTYVALUE@@KGE@Z
?RtlConvertPropertyToVariant@@YGEPBUtagSERIALIZEDPROPERTYVALUE@@GPAUtagPROPVARIANT@@PAVPMemoryAllocator@@@Z
?RtlConvertVariantToProperty@@YGPAUtagSERIALIZEDPROPERTYVALUE@@PBUtagPROPVARIANT@@GPAU1@PAKKE2@Z
@RtlInterlockedPushListSList@16
@RtlUlongByteSwap@4
@RtlUlonglongByteSwap@8
@RtlUshortByteSwap@4
_CsrAllocateCaptureBuffer@8
_CsrAllocateMessagePointer@12
_CsrCaptureMessageBuffer@16
_CsrCaptureMessageMultiUnicodeStringsInPlace@12
_CsrCaptureMessageString@20
_CsrCaptureTimeout@8
_CsrClientCallServer@16
_CsrClientConnectToServer@20
_CsrFreeCaptureBuffer@4
_CsrGetProcessId@0
_CsrIdentifyAlertableThread@0
_CsrNewThread@0
_CsrProbeForRead@12
_CsrProbeForWrite@12
_CsrSetPriorityClass@8
_DbgBreakPoint@0
_DbgPrint
_DbgPrintEx
_DbgPrintReturnControlC
_DbgPrompt@12
_DbgQueryDebugFilterState@8
_DbgSetDebugFilterState@12
_DbgUiConnectToDbg@0
_DbgUiContinue@8
_DbgUiConvertStateChangeStructure@8
_DbgUiDebugActiveProcess@4
_DbgUiGetThreadDebugObject@0
_DbgUiIssueRemoteBreakin@4
_DbgUiRemoteBreakin@4
_DbgUiSetThreadDebugObject@4
_DbgUiStopDebugging@4
_DbgUiWaitStateChange@8
_DbgUserBreakPoint@0
_EH_VirtualQuery@12
_KiFastSystemCall@0
_KiFastSystemCallRet@0
_KiIntSystemCall@0
_KiRaiseUserExceptionDispatcher@0
_KiUserApcDispatcher@20
_KiUserCallbackDispatcher@12
_KiUserExceptionDispatcher@8
_LdrAccessOutOfProcessResource@20
_LdrAccessResource@16
_LdrAddRefDll@8
_LdrAlternateResourcesEnabled@0
_LdrCreateOutOfProcessImage@16
_LdrDestroyOutOfProcessImage@4
_LdrDisableThreadCalloutsForDll@4
_LdrEnumResources@20
_LdrEnumerateLoadedModules@12
_LdrFindCreateProcessManifest@20
_LdrFindEntryForAddress@8
_LdrFindResourceDirectory_U@16
_LdrFindResourceEx_U@20
_LdrFindResource_U@16
_LdrFlushAlternateResourceModules@0
_LdrGetDllHandle@16
_LdrGetDllHandleEx@20
_LdrGetProcedureAddress@16
_LdrHotPatchRoutine@4
_LdrInitShimEngineDynamic@4
_LdrInitializeThunk@16
_LdrLoadAlternateResourceModule@8
_LdrLoadDll@16
_LdrLockLoaderLock@12
_LdrProcessRelocationBlock@16
_LdrQueryImageFileExecutionOptions@24
_LdrQueryProcessModuleInformation@12
_LdrSetAppCompatDllRedirectionCallback@12
_LdrSetDllManifestProber@4
_LdrShutdownProcess@0
_LdrShutdownThread@0
_LdrUnloadAlternateResourceModule@4
_LdrUnloadDll@4
_LdrUnlockLoaderLock@8
_LdrVerifyImageMatchesChecksum@16
_NlsAnsiCodePage
_NlsMbCodePageTag
_NlsMbOemCodePageTag
_NtAcceptConnectPort@24
_NtAccessCheck@32
_NtAccessCheckAndAuditAlarm@44
_NtAccessCheckByType@44
_NtAccessCheckByTypeAndAuditAlarm@64
_NtAccessCheckByTypeResultList@44
_NtAccessCheckByTypeResultListAndAuditAlarm@64
_NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
_NtAddAtom@12
_NtAddBootEntry@8
_NtAdjustGroupsToken@24
_NtAdjustPrivilegesToken@24
_NtAlertResumeThread@8
_NtAlertThread@4
_NtAllocateLocallyUniqueId@4
_NtAllocateUserPhysicalPages@12
_NtAllocateUuids@16
_NtAllocateVirtualMemory@24
_NtAreMappedFilesTheSame@8
_NtAssignProcessToJobObject@8
_NtCallbackReturn@12
_NtCancelDeviceWakeupRequest@4
_NtCancelIoFile@8
_NtCancelTimer@8
_NtClearEvent@4
_NtClose@4
_NtCloseObjectAuditAlarm@12
_NtCompactKeys@8
_NtCompareTokens@12
_NtCompleteConnectPort@4
_NtCompressKey@4
_NtConnectPort@32
_NtContinue@8
_NtCreateDebugObject@16
_NtCreateDirectoryObject@12
_NtCreateEvent@20
_NtCreateEventPair@12
_NtCreateFile@44
_NtCreateIoCompletion@16
_NtCreateJobObject@12
_NtCreateJobSet@12
_NtCreateKey@28
_NtCreateKeyedEvent@16
_NtCreateMailslotFile@32
_NtCreateMutant@16
_NtCreateNamedPipeFile@56
_NtCreatePagingFile@16
_NtCreatePort@20
_NtCreateProcess@32
_NtCreateProcessEx@36
_NtCreateProfile@36
_NtCreateSection@28
_NtCreateSemaphore@20
_NtCreateSymbolicLinkObject@16
_NtCreateThread@32
_NtCreateTimer@16
_NtCreateToken@52
_NtCreateWaitablePort@20
_NtCurrentTeb@0
_NtDebugActiveProcess@8
_NtDebugContinue@12
_NtDelayExecution@8
_NtDeleteAtom@4
_NtDeleteBootEntry@4
_NtDeleteFile@4
_NtDeleteKey@4
_NtDeleteObjectAuditAlarm@12
_NtDeleteValueKey@8
_NtDeviceIoControlFile@40
_NtDisplayString@4
_NtDuplicateObject@28
_NtDuplicateToken@24
_NtEnumerateBootEntries@8
_NtEnumerateKey@24
_NtEnumerateSystemEnvironmentValuesEx@12
_NtEnumerateValueKey@24
_NtExtendSection@8
_NtFilterToken@24
_NtFindAtom@12
_NtFlushBuffersFile@8
_NtFlushInstructionCache@12
_NtFlushKey@4
_NtFlushVirtualMemory@16
_NtFlushWriteBuffer@0
_NtFreeUserPhysicalPages@12
_NtFreeVirtualMemory@16
_NtFsControlFile@40
_NtGetContextThread@8
_NtGetDevicePowerState@8
_NtGetPlugPlayEvent@16
_NtGetWriteWatch@28
_NtImpersonateAnonymousToken@4
_NtImpersonateClientOfPort@8
_NtImpersonateThread@12
_NtInitializeRegistry@4
_NtInitiatePowerAction@16
_NtIsProcessInJob@8
_NtIsSystemResumeAutomatic@0
_NtListenPort@8
_NtLoadDriver@4
_NtLoadKey2@12
_NtLoadKey@8
_NtLockFile@40
_NtLockProductActivationKeys@8
_NtLockRegistryKey@4
_NtLockVirtualMemory@16
_NtMakePermanentObject@4
_NtMakeTemporaryObject@4
_NtMapUserPhysicalPages@12
_NtMapUserPhysicalPagesScatter@12
_NtMapViewOfSection@40
_NtModifyBootEntry@4
_NtNotifyChangeDirectoryFile@36
_NtNotifyChangeKey@40
_NtNotifyChangeMultipleKeys@48
_NtOpenDirectoryObject@12
_NtOpenEvent@12
_NtOpenEventPair@12
_NtOpenFile@24
_NtOpenIoCompletion@12
_NtOpenJobObject@12
_NtOpenKey@12
_NtOpenKeyedEvent@12
_NtOpenMutant@12
_NtOpenObjectAuditAlarm@48
_NtOpenProcess@16
_NtOpenProcessToken@12
_NtOpenProcessTokenEx@16
_NtOpenSection@12
_NtOpenSemaphore@12
_NtOpenSymbolicLinkObject@12
_NtOpenThread@16
_NtOpenThreadToken@16
_NtOpenThreadTokenEx@20
_NtOpenTimer@12
_NtPlugPlayControl@12
_NtPowerInformation@20
_NtPrivilegeCheck@12
_NtPrivilegeObjectAuditAlarm@24
_NtPrivilegedServiceAuditAlarm@20
_NtProtectVirtualMemory@20
_NtPulseEvent@8
_NtQueryAttributesFile@8
_NtQueryBootEntryOrder@8
_NtQueryBootOptions@8
_NtQueryDebugFilterState@8
_NtQueryDefaultLocale@8
_NtQueryDefaultUILanguage@4
_NtQueryDirectoryFile@44
_NtQueryDirectoryObject@28
_NtQueryEaFile@36
_NtQueryEvent@20
_NtQueryFullAttributesFile@8
_NtQueryInformationAtom@20
_NtQueryInformationFile@20
_NtQueryInformationJobObject@20
_NtQueryInformationPort@20
_NtQueryInformationProcess@20
_NtQueryInformationThread@20
_NtQueryInformationToken@20
_NtQueryInstallUILanguage@4
_NtQueryIntervalProfile@8
_NtQueryIoCompletion@20
_NtQueryKey@20
_NtQueryMultipleValueKey@24
_NtQueryMutant@20
_NtQueryObject@20
_NtQueryOpenSubKeys@8
_NtQueryPerformanceCounter@8
_NtQueryPortInformationProcess@0
_NtQueryQuotaInformationFile@36
_NtQuerySection@20
_NtQuerySecurityObject@20
_NtQuerySemaphore@20
_NtQuerySymbolicLinkObject@12
_NtQuerySystemEnvironmentValue@16
_NtQuerySystemEnvironmentValueEx@20
_NtQuerySystemInformation@16
_NtQuerySystemTime@4
_NtQueryTimer@20
_NtQueryTimerResolution@12
_NtQueryValueKey@24
_NtQueryVirtualMemory@24
_NtQueryVolumeInformationFile@20
_NtQueueApcThread@20
_NtRaiseException@12
_NtRaiseHardError@24
_NtReadFile@36
_NtReadFileScatter@36
_NtReadRequestData@24
_NtReadVirtualMemory@20
_NtRegisterThreadTerminatePort@4
_NtReleaseKeyedEvent@16
_NtReleaseMutant@8
_NtReleaseSemaphore@12
_NtRemoveIoCompletion@20
_NtRemoveProcessDebug@8
_NtRenameKey@8
_NtReplaceKey@12
_NtReplyPort@8
_NtReplyWaitReceivePort@16
_NtReplyWaitReceivePortEx@20
_NtReplyWaitReplyPort@8
_NtRequestDeviceWakeup@4
_NtRequestPort@8
_NtRequestWaitReplyPort@12
_NtRequestWakeupLatency@4
_NtResetEvent@8
_NtResetWriteWatch@12
_NtRestoreKey@12
_NtResumeProcess@4
_NtResumeThread@8
_NtSaveKey@8
_NtSaveKeyEx@12
_NtSaveMergedKeys@12
_NtSecureConnectPort@36
_NtSetBootEntryOrder@8
_NtSetBootOptions@8
_NtSetContextThread@8
_NtSetDebugFilterState@12
_NtSetDefaultHardErrorPort@4
_NtSetDefaultLocale@8
_NtSetDefaultUILanguage@4
_NtSetEaFile@16
_NtSetEvent@8
_NtSetEventBoostPriority@4
_NtSetHighEventPair@4
_NtSetHighWaitLowEventPair@4
_NtSetInformationDebugObject@20
_NtSetInformationFile@20
_NtSetInformationJobObject@16
_NtSetInformationKey@16
_NtSetInformationObject@16
_NtSetInformationProcess@16
_NtSetInformationThread@16
_NtSetInformationToken@16
_NtSetIntervalProfile@8
_NtSetIoCompletion@20
_NtSetLdtEntries@24
_NtSetLowEventPair@4
_NtSetLowWaitHighEventPair@4
_NtSetQuotaInformationFile@16
_NtSetSecurityObject@12
_NtSetSystemEnvironmentValue@8
_NtSetSystemEnvironmentValueEx@20
_NtSetSystemInformation@12
_NtSetSystemPowerState@12
_NtSetSystemTime@8
_NtSetThreadExecutionState@8
_NtSetTimer@28
_NtSetTimerResolution@12
_NtSetUuidSeed@4
_NtSetValueKey@24
_NtSetVolumeInformationFile@20
_NtShutdownSystem@4
_NtSignalAndWaitForSingleObject@16
_NtStartProfile@4
_NtStopProfile@4
_NtSuspendProcess@4
_NtSuspendThread@8
_NtSystemDebugControl@24
_NtTerminateJobObject@8
_NtTerminateProcess@8
_NtTerminateThread@8
_NtTestAlert@0
_NtTraceEvent@16
_NtTranslateFilePath@16
_NtUnloadDriver@4
_NtUnloadKey@4
_NtUnloadKeyEx@8
_NtUnlockFile@20
_NtUnlockVirtualMemory@16
_NtUnmapViewOfSection@8
_NtVdmControl@8
_NtWaitForDebugEvent@16
_NtWaitForKeyedEvent@16
_NtWaitForMultipleObjects@20
_NtWaitForSingleObject@12
_NtWaitHighEventPair@4
_NtWaitLowEventPair@4
_NtWriteFile@36
_NtWriteFileGather@36
_NtWriteRequestData@24
_NtWriteVirtualMemory@20
_NtYieldExecution@0
_PfxFindPrefix@8
_PfxInitialize@4
_PfxInsertPrefix@12
_PfxRemovePrefix@8
_RtlAbortRXact@4
_RtlAbsoluteToSelfRelativeSD@12
_RtlAcquirePebLock@0
_RtlAcquireResourceExclusive@8
_RtlAcquireResourceShared@8
_RtlActivateActivationContext@12
_RtlActivateActivationContextEx@16
_RtlActivateActivationContextUnsafeFast@8
_RtlAddAccessAllowedAce@16
_RtlAddAccessAllowedAceEx@20
_RtlAddAccessAllowedObjectAce@28
_RtlAddAccessDeniedAce@16
_RtlAddAccessDeniedAceEx@20
_RtlAddAccessDeniedObjectAce@28
_RtlAddAce@20
_RtlAddActionToRXact@24
_RtlAddAtomToAtomTable@12
_RtlAddAttributeActionToRXact@32
_RtlAddAuditAccessAce@24
_RtlAddAuditAccessAceEx@28
_RtlAddAuditAccessObjectAce@36
_RtlAddCompoundAce@24
_RtlAddRange@36
_RtlAddRefActivationContext@4
_RtlAddRefMemoryStream@4
_RtlAddVectoredExceptionHandler@8
_RtlAddressInSectionTable@12
_RtlAdjustPrivilege@16
_RtlAllocateAndInitializeSid@44
_RtlAllocateHandle@8
_RtlAllocateHeap@12
_RtlAlternateDosPathSeperatorString
_RtlAnsiCharToUnicodeChar@4
_RtlAnsiStringToUnicodeSize@4
_RtlAnsiStringToUnicodeString@12
_RtlAppendAsciizToString@8
_RtlAppendPathElement@12
_RtlAppendStringToString@8
_RtlAppendUnicodeStringToString@8
_RtlAppendUnicodeToString@8
_RtlApplicationVerifierStop@40
_RtlApplyRXact@4
_RtlApplyRXactNoFlush@4
_RtlAreAllAccessesGranted@8
_RtlAreAnyAccessesGranted@8
_RtlAreBitsClear@12
_RtlAreBitsSet@12
_RtlAssert2@20
_RtlAssert@16
_RtlCancelTimer@8
_RtlCaptureContext@4
_RtlCaptureStackBackTrace@16
_RtlCaptureStackContext@12
_RtlCharToInteger@12
_RtlCheckForOrphanedCriticalSections@4
_RtlCheckProcessParameters@16
_RtlCheckRegistryKey@8
_RtlClearAllBits@4
_RtlClearBits@12
_RtlCloneMemoryStream@8
_RtlCommitMemoryStream@8
_RtlCompactHeap@8
_RtlCompareMemory@12
_RtlCompareMemoryUlong@12
_RtlCompareString@12
_RtlCompareUnicodeString@12
_RtlCompressBuffer@32
_RtlComputeCrc32@12
_RtlComputeImportTableHash@12
_RtlComputePrivatizedDllName_U@12
_RtlConsoleMultiByteToUnicodeN@24
_RtlConvertExclusiveToShared@4
_RtlConvertLongToLargeInteger@4
_RtlConvertSharedToExclusive@4
_RtlConvertSidToUnicodeString@12
_RtlConvertToAutoInheritSecurityObject@24
_RtlConvertUiListToApiList@12
_RtlConvertUlongToLargeInteger@4
_RtlCopyLuid@8
_RtlCopyLuidAndAttributesArray@12
_RtlCopyMemoryStreamTo@24
_RtlCopyOutOfProcessMemoryStreamTo@24
_RtlCopyRangeList@8
_RtlCopySecurityDescriptor@8
_RtlCopySid@12
_RtlCopySidAndAttributesArray@28
_RtlCopyString@8
_RtlCopyUnicodeString@8
_RtlCreateAcl@12
_RtlCreateActivationContext@24
_RtlCreateAndSetSD@20
_RtlCreateAtomTable@8
_RtlCreateBootStatusDataFile@0
_RtlCreateEnvironment@8
_RtlCreateHeap@24
_RtlCreateProcessParameters@40
_RtlCreateQueryDebugBuffer@8
_RtlCreateRegistryKey@8
_RtlCreateSecurityDescriptor@8
_RtlCreateSystemVolumeInformationFolder@4
_RtlCreateTagHeap@16
_RtlCreateTimer@28
_RtlCreateTimerQueue@4
_RtlCreateUnicodeString@8
_RtlCreateUnicodeStringFromAsciiz@8
_RtlCreateUserProcess@40
_RtlCreateUserSecurityObject@28
_RtlCreateUserThread@40
_RtlCustomCPToUnicodeN@24
_RtlCutoverTimeToSystemTime@16
_RtlDeNormalizeProcessParams@4
_RtlDeactivateActivationContext@8
_RtlDeactivateActivationContextUnsafeFast@4
_RtlDebugPrintTimes@0
_RtlDecodePointer@4
_RtlDecodeSystemPointer@4
_RtlDecompressBuffer@24
_RtlDecompressFragment@32
_RtlDefaultNpAcl@4
_RtlDelete@4
_RtlDeleteAce@8
_RtlDeleteAtomFromAtomTable@8
_RtlDeleteCriticalSection@4
_RtlDeleteElementGenericTable@8
_RtlDeleteElementGenericTableAvl@8
_RtlDeleteNoSplay@8
_RtlDeleteOwnersRanges@8
_RtlDeleteRange@24
_RtlDeleteRegistryValue@12
_RtlDeleteResource@4
_RtlDeleteSecurityObject@4
_RtlDeleteTimer@12
_RtlDeleteTimerQueue@4
_RtlDeleteTimerQueueEx@8
_RtlDeregisterWait@4
_RtlDeregisterWaitEx@8
_RtlDestroyAtomTable@4
_RtlDestroyEnvironment@4
_RtlDestroyHandleTable@4
_RtlDestroyHeap@4
_RtlDestroyProcessParameters@4
_RtlDestroyQueryDebugBuffer@4
_RtlDetermineDosPathNameType_U@4
_RtlDllShutdownInProgress@0
_RtlDnsHostNameToComputerName@12
_RtlDoesFileExists_U@4
_RtlDosApplyFileIsolationRedirection_Ustr@36
_RtlDosPathNameToNtPathName_U@16
_RtlDosPathSeperatorsString
_RtlDosSearchPath_U@24
_RtlDosSearchPath_Ustr@36
_RtlDowncaseUnicodeChar@4
_RtlDowncaseUnicodeString@12
_RtlDumpResource@4
_RtlDuplicateUnicodeString@12
_RtlEmptyAtomTable@8
_RtlEnableEarlyCriticalSectionEventCreation@0
_RtlEncodePointer@4
_RtlEncodeSystemPointer@4
_RtlEnlargedIntegerMultiply@8
_RtlEnlargedUnsignedDivide@16
_RtlEnlargedUnsignedMultiply@8
_RtlEnterCriticalSection@4
_RtlEnumProcessHeaps@8
_RtlEnumerateGenericTable@8
_RtlEnumerateGenericTableAvl@8
_RtlEnumerateGenericTableLikeADirectory@28
_RtlEnumerateGenericTableWithoutSplaying@8
_RtlEnumerateGenericTableWithoutSplayingAvl@8
_RtlEqualComputerName@8
_RtlEqualDomainName@8
_RtlEqualLuid@8
_RtlEqualPrefixSid@8
_RtlEqualSid@8
_RtlEqualString@12
_RtlEqualUnicodeString@12
_RtlEraseUnicodeString@4
_RtlExitUserThread@4
_RtlExpandEnvironmentStrings_U@16
_RtlExtendHeap@16
_RtlExtendedIntegerMultiply@12
_RtlExtendedLargeIntegerDivide@16
_RtlExtendedMagicDivide@20
_RtlFillMemory@12
_RtlFillMemoryUlong@12
_RtlFinalReleaseOutOfProcessMemoryStream@4
_RtlFindActivationContextSectionGuid@20
_RtlFindActivationContextSectionString@20
_RtlFindCharInUnicodeString@16
_RtlFindClearBits@12
_RtlFindClearBitsAndSet@12
_RtlFindClearRuns@16
_RtlFindLastBackwardRunClear@12
_RtlFindLeastSignificantBit@8
_RtlFindLongestRunClear@8
_RtlFindMessage@20
_RtlFindMostSignificantBit@8
_RtlFindNextForwardRunClear@12
_RtlFindRange@48
_RtlFindSetBits@12
_RtlFindSetBitsAndClear@12
_RtlFirstEntrySList@4
_RtlFirstFreeAce@8
_RtlFlushSecureMemoryCache@8
_RtlFormatCurrentUserKeyPath@4
_RtlFormatMessage@36
_RtlFreeAnsiString@4
_RtlFreeHandle@8
_RtlFreeHeap@12
_RtlFreeOemString@4
_RtlFreeRangeList@4
_RtlFreeSid@4
_RtlFreeThreadActivationContextStack@0
_RtlFreeUnicodeString@4
_RtlFreeUserThreadStack@8
_RtlGUIDFromString@8
_RtlGenerate8dot3Name@16
_RtlGetAce@12
_RtlGetActiveActivationContext@4
_RtlGetCallersAddress@8
_RtlGetCompressionWorkSpaceSize@12
_RtlGetControlSecurityDescriptor@12
_RtlGetCurrentDirectory_U@8
_RtlGetCurrentPeb@0
_RtlGetDaclSecurityDescriptor@16
_RtlGetElementGenericTable@8
_RtlGetElementGenericTableAvl@8
_RtlGetFirstRange@12
_RtlGetFrame@0
_RtlGetFullPathName_U@16
_RtlGetGroupSecurityDescriptor@12
_RtlGetLastNtStatus@0
_RtlGetLastWin32Error@0
_RtlGetLengthWithoutLastFullDosOrNtPathElement@12
_RtlGetLengthWithoutTrailingPathSeperators@12
_RtlGetLongestNtPathLength@0
_RtlGetNativeSystemInformation@16
_RtlGetNextRange@12
_RtlGetNtGlobalFlags@0
_RtlGetNtProductType@4
_RtlGetNtVersionNumbers@12
_RtlGetOwnerSecurityDescriptor@12
_RtlGetProcessHeaps@8
_RtlGetSaclSecurityDescriptor@16
_RtlGetSecurityDescriptorRMControl@8
_RtlGetSetBootStatusData@24
_RtlGetUnloadEventTrace@0
_RtlGetUserInfoHeap@20
_RtlGetVersion@4
_RtlHashUnicodeString@16
_RtlIdentifierAuthoritySid@4
_RtlImageDirectoryEntryToData@16
_RtlImageNtHeader@4
_RtlImageRvaToSection@12
_RtlImageRvaToVa@16
_RtlImpersonateSelf@4
_RtlInitAnsiString@8
_RtlInitCodePageTable@8
_RtlInitMemoryStream@4
_RtlInitNlsTables@16
_RtlInitOutOfProcessMemoryStream@4
_RtlInitString@8
_RtlInitUnicodeString@8
_RtlInitUnicodeStringEx@8
_RtlInitializeAtomPackage@4
_RtlInitializeBitMap@12
_RtlInitializeContext@20
_RtlInitializeCriticalSection@4
_RtlInitializeCriticalSectionAndSpinCount@8
_RtlInitializeGenericTable@20
_RtlInitializeGenericTableAvl@20
_RtlInitializeHandleTable@12
_RtlInitializeRXact@12
_RtlInitializeRangeList@4
_RtlInitializeResource@4
_RtlInitializeSListHead@4
_RtlInitializeSid@12
_RtlInitializeStackTraceDataBase@12
_RtlInsertElementGenericTable@16
_RtlInsertElementGenericTableAvl@16
_RtlInt64ToUnicodeString@16
_RtlIntegerToChar@16
_RtlIntegerToUnicodeString@12
_RtlInterlockedFlushSList@4
_RtlInterlockedPopEntrySList@4
_RtlInterlockedPushEntrySList@8
_RtlInvertRangeList@8
_RtlIpv4AddressToStringA@8
_RtlIpv4AddressToStringExA@16
_RtlIpv4AddressToStringExW@16
_RtlIpv4AddressToStringW@8
_RtlIpv4StringToAddressA@16
_RtlIpv4StringToAddressExA@16
_RtlIpv4StringToAddressExW@16
_RtlIpv4StringToAddressW@16
_RtlIpv6AddressToStringA@8
_RtlIpv6AddressToStringExA@20
_RtlIpv6AddressToStringExW@20
_RtlIpv6AddressToStringW@8
_RtlIpv6StringToAddressA@12
_RtlIpv6StringToAddressExA@16
_RtlIpv6StringToAddressExW@16
_RtlIpv6StringToAddressW@12
_RtlIsActivationContextActive@4
_RtlIsDosDeviceName_U@4
_RtlIsGenericTableEmpty@4
_RtlIsGenericTableEmptyAvl@4
_RtlIsNameLegalDOS8Dot3@12
_RtlIsRangeAvailable@40
_RtlIsTextUnicode@12
_RtlIsThreadWithinLoaderCallout@0
_RtlIsValidHandle@8
_RtlIsValidIndexHandle@12
_RtlLargeIntegerAdd@16
_RtlLargeIntegerArithmeticShift@12
_RtlLargeIntegerDivide@20
_RtlLargeIntegerNegate@8
_RtlLargeIntegerShiftLeft@12
_RtlLargeIntegerShiftRight@12
_RtlLargeIntegerSubtract@16
_RtlLargeIntegerToChar@16
_RtlLeaveCriticalSection@4
_RtlLengthRequiredSid@4
_RtlLengthSecurityDescriptor@4
_RtlLengthSid@4
_RtlLocalTimeToSystemTime@8
_RtlLockBootStatusData@4
_RtlLockHeap@4
_RtlLockMemoryStreamRegion@24
_RtlLogStackBackTrace@0
_RtlLookupAtomInAtomTable@12
_RtlLookupElementGenericTable@8
_RtlLookupElementGenericTableAvl@8
_RtlMakeSelfRelativeSD@12
_RtlMapGenericMask@8
_RtlMapSecurityErrorToNtStatus@4
_RtlMergeRangeLists@16
_RtlMoveMemory@12
_RtlMultiAppendUnicodeStringBuffer@12
_RtlMultiByteToUnicodeN@20
_RtlMultiByteToUnicodeSize@12
_RtlNewInstanceSecurityObject@40
_RtlNewSecurityGrantedAccess@24
_RtlNewSecurityObject@24
_RtlNewSecurityObjectEx@32
_RtlNewSecurityObjectWithMultipleInheritance@36
_RtlNormalizeProcessParams@4
_RtlNtPathNameToDosPathName@16
_RtlNtPathSeperatorString
_RtlNtStatusToDosError@4
_RtlNtStatusToDosErrorNoTeb@4
_RtlNumberGenericTableElements@4
_RtlNumberGenericTableElementsAvl@4
_RtlNumberOfClearBits@4
_RtlNumberOfSetBits@4
_RtlOemStringToUnicodeSize@4
_RtlOemStringToUnicodeString@12
_RtlOemToUnicodeN@20
_RtlOpenCurrentUser@8
_RtlPcToFileHeader@8
_RtlPinAtomInAtomTable@8
_RtlPopFrame@4
_RtlPrefixString@12
_RtlPrefixUnicodeString@12
_RtlProtectHeap@8
_RtlPushFrame@4
_RtlQueryAtomInAtomTable@24
_RtlQueryDepthSList@4
_RtlQueryEnvironmentVariable_U@12
_RtlQueryHeapInformation@20
_RtlQueryInformationAcl@16
_RtlQueryInformationActivationContext@28
_RtlQueryInformationActiveActivationContext@16
_RtlQueryInterfaceMemoryStream@12
_RtlQueryProcessBackTraceInformation@4
_RtlQueryProcessDebugInformation@12
_RtlQueryProcessHeapInformation@4
_RtlQueryProcessLockInformation@4
_RtlQueryRegistryValues@20
_RtlQuerySecurityObject@20
_RtlQueryTagHeap@20
_RtlQueryTimeZoneInformation@4
_RtlQueueApcWow64Thread@20
_RtlQueueWorkItem@12
_RtlRaiseException@4
_RtlRaiseStatus@4
_RtlRandom@4
_RtlRandomEx@4
_RtlReAllocateHeap@16
_RtlReadMemoryStream@16
_RtlReadOutOfProcessMemoryStream@16
_RtlRealPredecessor@4
_RtlRealSuccessor@4
_RtlRegisterSecureMemoryCacheCallback@4
_RtlRegisterWait@24
_RtlReleaseActivationContext@4
_RtlReleaseMemoryStream@4
_RtlReleasePebLock@0
_RtlReleaseResource@4
_RtlRemoteCall@28
_RtlRemoveVectoredExceptionHandler@4
_RtlResetRtlTranslations@4
_RtlRestoreLastWin32Error@4
_RtlRevertMemoryStream@4
_RtlRunDecodeUnicodeString@8
_RtlRunEncodeUnicodeString@8
_RtlSecondsSince1970ToTime@8
_RtlSecondsSince1980ToTime@8
_RtlSeekMemoryStream@20
_RtlSelfRelativeToAbsoluteSD2@8
_RtlSelfRelativeToAbsoluteSD@44
_RtlSetAllBits@4
_RtlSetAttributesSecurityDescriptor@12
_RtlSetBits@12
_RtlSetControlSecurityDescriptor@12
_RtlSetCriticalSectionSpinCount@8
_RtlSetCurrentDirectory_U@4
_RtlSetCurrentEnvironment@8
_RtlSetDaclSecurityDescriptor@16
_RtlSetEnvironmentVariable@12
_RtlSetGroupSecurityDescriptor@12
_RtlSetHeapInformation@16
_RtlSetInformationAcl@16
_RtlSetIoCompletionCallback@12
_RtlSetLastWin32Error@4
_RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
_RtlSetMemoryStreamSize@12
_RtlSetOwnerSecurityDescriptor@12
_RtlSetProcessIsCritical
_RtlSetSaclSecurityDescriptor@16
_RtlSetSecurityDescriptorRMControl@8
_RtlSetSecurityObject@20
_RtlSetSecurityObjectEx@24
_RtlSetThreadIsCritical
_RtlSetThreadPoolStartFunc@8
_RtlSetTimeZoneInformation@4
_RtlSetTimer@28
_RtlSetUnicodeCallouts@4
_RtlSetUserFlagsHeap@20
_RtlSetUserValueHeap@16
_RtlSizeHeap@12
_RtlSplay@4
_RtlStartRXact@4
_RtlStatMemoryStream@12
_RtlStringFromGUID@8
_RtlSubAuthorityCountSid@4
_RtlSubAuthoritySid@8
_RtlSubtreePredecessor@4
_RtlSubtreeSuccessor@4
_RtlSystemTimeToLocalTime@8
_RtlTimeFieldsToTime@8
_RtlTimeToElapsedTimeFields@8
_RtlTimeToSecondsSince1970@8
_RtlTimeToSecondsSince1980@8
_RtlTimeToTimeFields@8
_RtlTraceDatabaseAdd@16
_RtlTraceDatabaseCreate@20
_RtlTraceDatabaseDestroy@4
_RtlTraceDatabaseEnumerate@12
_RtlTraceDatabaseFind@16
_RtlTraceDatabaseLock@4
_RtlTraceDatabaseUnlock@4
_RtlTraceDatabaseValidate@4
_RtlTryEnterCriticalSection@4
_RtlUnhandledExceptionFilter2@8
_RtlUnhandledExceptionFilter@4
_RtlUnicodeStringToAnsiSize@4
_RtlUnicodeStringToAnsiString@12
_RtlUnicodeStringToCountedOemString@12
_RtlUnicodeStringToInteger@12
_RtlUnicodeStringToOemSize@4
_RtlUnicodeStringToOemString@12
_RtlUnicodeToCustomCPN@24
_RtlUnicodeToMultiByteN@20
_RtlUnicodeToMultiByteSize@12
_RtlUnicodeToOemN@20
_RtlUniform@4
_RtlUnlockBootStatusData@4
_RtlUnlockHeap@4
_RtlUnlockMemoryStreamRegion@24
_RtlUnwind@16
_RtlUpcaseUnicodeChar@4
_RtlUpcaseUnicodeString@12
_RtlUpcaseUnicodeStringToAnsiString@12
_RtlUpcaseUnicodeStringToCountedOemString@12
_RtlUpcaseUnicodeStringToOemString@12
_RtlUpcaseUnicodeToCustomCPN@24
_RtlUpcaseUnicodeToMultiByteN@20
_RtlUpcaseUnicodeToOemN@20
_RtlUpdateTimer@16
_RtlUpperChar@4
_RtlUpperString@8
_RtlUsageHeap@12
_RtlValidAcl@4
_RtlValidRelativeSecurityDescriptor@12
_RtlValidSecurityDescriptor@4
_RtlValidSid@4
_RtlValidateHeap@12
_RtlValidateProcessHeaps@0
_RtlValidateUnicodeString@8
_RtlVerifyVersionInfo@16
_RtlWalkFrameChain@12
_RtlWalkHeap@8
_RtlWriteMemoryStream@16
_RtlWriteRegistryValue@24
_RtlZeroHeap@8
_RtlZeroMemory@8
_RtlZombifyActivationContext@4
_RtlpApplyLengthFunction@16
_RtlpEnsureBufferSize@12
_RtlpNotOwnerCriticalSection@4
_RtlpNtCreateKey@24
_RtlpNtEnumerateSubKey@16
_RtlpNtMakeTemporaryKey@4
_RtlpNtOpenKey@16
_RtlpNtQueryValueKey@20
_RtlpNtSetValueKey@16
_RtlpUnWaitCriticalSection@4
_RtlpWaitForCriticalSection@4
_RtlxAnsiStringToUnicodeSize@4
_RtlxOemStringToUnicodeSize@4
_RtlxUnicodeStringToAnsiSize@4
_RtlxUnicodeStringToOemSize@4
_VerSetConditionMask@16
_ZwAcceptConnectPort@24
_ZwAccessCheck@32
_ZwAccessCheckAndAuditAlarm@44
_ZwAccessCheckByType@44
_ZwAccessCheckByTypeAndAuditAlarm@64
_ZwAccessCheckByTypeResultList@44
_ZwAccessCheckByTypeResultListAndAuditAlarm@64
_ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
_ZwAddAtom@12
_ZwAddBootEntry@8
_ZwAdjustGroupsToken@24
_ZwAdjustPrivilegesToken@24
_ZwAlertResumeThread@8
_ZwAlertThread@4
_ZwAllocateLocallyUniqueId@4
_ZwAllocateUserPhysicalPages@12
_ZwAllocateUuids@16
_ZwAllocateVirtualMemory@24
_ZwAreMappedFilesTheSame@8
_ZwAssignProcessToJobObject@8
_ZwCallbackReturn@12
_ZwCancelDeviceWakeupRequest@4
_ZwCancelIoFile@8
_ZwCancelTimer@8
_ZwClearEvent@4
_ZwClose@4
_ZwCloseObjectAuditAlarm@12
_ZwCompactKeys@8
_ZwCompareTokens@12
_ZwCompleteConnectPort@4
_ZwCompressKey@4
_ZwConnectPort@32
_ZwContinue@8
_ZwCreateDebugObject@16
_ZwCreateDirectoryObject@12
_ZwCreateEvent@20
_ZwCreateEventPair@12
_ZwCreateFile@44
_ZwCreateIoCompletion@16
_ZwCreateJobObject@12
_ZwCreateJobSet@12
_ZwCreateKey@28
_ZwCreateKeyedEvent@16
_ZwCreateMailslotFile@32
_ZwCreateMutant@16
_ZwCreateNamedPipeFile@56
_ZwCreatePagingFile@16
_ZwCreatePort@20
_ZwCreateProcess@32
_ZwCreateProcessEx@36
_ZwCreateProfile@36
_ZwCreateSection@28
_ZwCreateSemaphore@20
_ZwCreateSymbolicLinkObject@16
_ZwCreateThread@32
_ZwCreateTimer@16
_ZwCreateToken@52
_ZwCreateWaitablePort@20
_ZwDebugActiveProcess@8
_ZwDebugContinue@12
_ZwDelayExecution@8
_ZwDeleteAtom@4
_ZwDeleteBootEntry@4
_ZwDeleteFile@4
_ZwDeleteKey@4
_ZwDeleteObjectAuditAlarm@12
_ZwDeleteValueKey@8
_ZwDeviceIoControlFile@40
_ZwDisplayString@4
_ZwDuplicateObject@28
_ZwDuplicateToken@24
_ZwEnumerateBootEntries@8
_ZwEnumerateKey@24
_ZwEnumerateSystemEnvironmentValuesEx@12
_ZwEnumerateValueKey@24
_ZwExtendSection@8
_ZwFilterToken@24
_ZwFindAtom@12
_ZwFlushBuffersFile@8
_ZwFlushInstructionCache@12
_ZwFlushKey@4
_ZwFlushVirtualMemory@16
_ZwFlushWriteBuffer@0
_ZwFreeUserPhysicalPages@12
_ZwFreeVirtualMemory@16
_ZwFsControlFile@40
_ZwGetContextThread@8
_ZwGetDevicePowerState@8
_ZwGetPlugPlayEvent@16
_ZwGetWriteWatch@28
_ZwImpersonateAnonymousToken@4
_ZwImpersonateClientOfPort@8
_ZwImpersonateThread@12
_ZwInitializeRegistry@4
_ZwInitiatePowerAction@16
_ZwIsProcessInJob@8
_ZwIsSystemResumeAutomatic@0
_ZwListenPort@8
_ZwLoadDriver@4
_ZwLoadKey2@12
_ZwLoadKey@8
_ZwLockFile@40
_ZwLockProductActivationKeys@8
_ZwLockRegistryKey@4
_ZwLockVirtualMemory@16
_ZwMakePermanentObject@4
_ZwMakeTemporaryObject@4
_ZwMapUserPhysicalPages@12
_ZwMapUserPhysicalPagesScatter@12
_ZwMapViewOfSection@40
_ZwModifyBootEntry@4
_ZwNotifyChangeDirectoryFile@36
_ZwNotifyChangeKey@40
_ZwNotifyChangeMultipleKeys@48
_ZwOpenDirectoryObject@12
_ZwOpenEvent@12
_ZwOpenEventPair@12
_ZwOpenFile@24
_ZwOpenIoCompletion@12
_ZwOpenJobObject@12
_ZwOpenKey@12
_ZwOpenKeyedEvent@12
_ZwOpenMutant@12
_ZwOpenObjectAuditAlarm@48
_ZwOpenProcess@16
_ZwOpenProcessToken@12
_ZwOpenProcessTokenEx@16
_ZwOpenSection@12
_ZwOpenSemaphore@12
_ZwOpenSymbolicLinkObject@12
_ZwOpenThread@16
_ZwOpenThreadToken@16
_ZwOpenThreadTokenEx@20
_ZwOpenTimer@12
_ZwPlugPlayControl@12
_ZwPowerInformation@20
_ZwPrivilegeCheck@12
_ZwPrivilegeObjectAuditAlarm@24
_ZwPrivilegedServiceAuditAlarm@20
_ZwProtectVirtualMemory@20
_ZwPulseEvent@8
_ZwQueryAttributesFile@8
_ZwQueryBootEntryOrder@8
_ZwQueryBootOptions@8
_ZwQueryDebugFilterState@8
_ZwQueryDefaultLocale@8
_ZwQueryDefaultUILanguage@4
_ZwQueryDirectoryFile@44
_ZwQueryDirectoryObject@28
_ZwQueryEaFile@36
_ZwQueryEvent@20
_ZwQueryFullAttributesFile@8
_ZwQueryInformationAtom@20
_ZwQueryInformationFile@20
_ZwQueryInformationJobObject@20
_ZwQueryInformationPort@20
_ZwQueryInformationProcess@20
_ZwQueryInformationThread@20
_ZwQueryInformationToken@20
_ZwQueryInstallUILanguage@4
_ZwQueryIntervalProfile@8
_ZwQueryIoCompletion@20
_ZwQueryKey@20
_ZwQueryMultipleValueKey@24
_ZwQueryMutant@20
_ZwQueryObject@20
_ZwQueryOpenSubKeys@8
_ZwQueryPerformanceCounter@8
_ZwQueryPortInformationProcess@0
_ZwQueryQuotaInformationFile@36
_ZwQuerySection@20
_ZwQuerySecurityObject@20
_ZwQuerySemaphore@20
_ZwQuerySymbolicLinkObject@12
_ZwQuerySystemEnvironmentValue@16
_ZwQuerySystemEnvironmentValueEx@20
_ZwQuerySystemInformation@16
_ZwQuerySystemTime@4
_ZwQueryTimer@20
_ZwQueryTimerResolution@12
_ZwQueryValueKey@24
_ZwQueryVirtualMemory@24
_ZwQueryVolumeInformationFile@20
_ZwQueueApcThread@20
_ZwRaiseException@12
_ZwRaiseHardError@24
_ZwReadFile@36
_ZwReadFileScatter@36
_ZwReadRequestData@24
_ZwReadVirtualMemory@20
_ZwRegisterThreadTerminatePort@4
_ZwReleaseKeyedEvent@16
_ZwReleaseMutant@8
_ZwReleaseSemaphore@12
_ZwRemoveIoCompletion@20
_ZwRemoveProcessDebug@8
_ZwRenameKey@8
_ZwReplaceKey@12
_ZwReplyPort@8
_ZwReplyWaitReceivePort@16
_ZwReplyWaitReceivePortEx@20
_ZwReplyWaitReplyPort@8
_ZwRequestDeviceWakeup@4
_ZwRequestPort@8
_ZwRequestWaitReplyPort@12
_ZwRequestWakeupLatency@4
_ZwResetEvent@8
_ZwResetWriteWatch@12
_ZwRestoreKey@12
_ZwResumeProcess@4
_ZwResumeThread@8
_ZwSaveKey@8
_ZwSaveKeyEx@12
_ZwSaveMergedKeys@12
_ZwSecureConnectPort@36
_ZwSetBootEntryOrder@8
_ZwSetBootOptions@8
_ZwSetContextThread@8
_ZwSetDebugFilterState@12
_ZwSetDefaultHardErrorPort@4
_ZwSetDefaultLocale@8
_ZwSetDefaultUILanguage@4
_ZwSetEaFile@16
_ZwSetEvent@8
_ZwSetEventBoostPriority@4
_ZwSetHighEventPair@4
_ZwSetHighWaitLowEventPair@4
_ZwSetInformationDebugObject@20
_ZwSetInformationFile@20
_ZwSetInformationJobObject@16
_ZwSetInformationKey@16
_ZwSetInformationObject@16
_ZwSetInformationProcess@16
_ZwSetInformationThread@16
_ZwSetInformationToken@16
_ZwSetIntervalProfile@8
_ZwSetIoCompletion@20
_ZwSetLdtEntries@24
_ZwSetLowEventPair@4
_ZwSetLowWaitHighEventPair@4
_ZwSetQuotaInformationFile@16
_ZwSetSecurityObject@12
_ZwSetSystemEnvironmentValue@8
_ZwSetSystemEnvironmentValueEx@20
_ZwSetSystemInformation@12
_ZwSetSystemPowerState@12
_ZwSetSystemTime@8
_ZwSetThreadExecutionState@8
_ZwSetTimer@28
_ZwSetTimerResolution@12
_ZwSetUuidSeed@4
_ZwSetValueKey@24
_ZwSetVolumeInformationFile@20
_ZwShutdownSystem@4
_ZwSignalAndWaitForSingleObject@16
_ZwStartProfile@4
_ZwStopProfile@4
_ZwSuspendProcess@4
_ZwSuspendThread@8
_ZwSystemDebugControl@24
_ZwTerminateJobObject@8
_ZwTerminateProcess@8
_ZwTerminateThread@8
_ZwTestAlert@0
_ZwTraceEvent@16
_ZwTranslateFilePath@16
_ZwUnloadDriver@4
_ZwUnloadKey@4
_ZwUnloadKeyEx@8
_ZwUnlockFile@20
_ZwUnlockVirtualMemory@16
_ZwUnmapViewOfSection@8
_ZwVdmControl@8
_ZwWaitForDebugEvent@16
_ZwWaitForKeyedEvent@16
_ZwWaitForMultipleObjects@20
_ZwWaitForSingleObject@12
_ZwWaitHighEventPair@4
_ZwWaitLowEventPair@4
_ZwWriteFile@36
_ZwWriteFileGather@36
_ZwWriteRequestData@24
_ZwWriteVirtualMemory@20
_ZwYieldExecution@0
__CIcos
__CIlog
__CIpow
__CIsin
__CIsqrt
__IMPORT_DESCRIPTOR_ntdll
__NLG_Destination
__NLG_Dispatch
__NLG_Dispatch2
__NLG_Notify
__NLG_Notify1
__NLG_Return2
__NULL_IMPORT_DESCRIPTOR
__SEH_epilog
__SEH_prolog
__ValidateEH3RN
___isascii
___iscsym
___iscsymf
___security_cookie
___toascii
__abnormal_termination
__alldiv
__alldvrm
__allmul
__alloca_probe
__allrem
__allshl
__allshr
__atoi64
__aulldiv
__aulldvrm
__aullrem
__aullshr
__chkstk
__except_handler2
__except_handler3
__except_list
__fltused
__ftol
__global_unwind2
__i64toa
__i64tow
__imp_?PropertyLengthAsVariant@@YGKPBUtagSERIALIZEDPROPERTYVALUE@@KGE@Z
__imp_?RtlConvertPropertyToVariant@@YGEPBUtagSERIALIZEDPROPERTYVALUE@@GPAUtagPROPVARIANT@@PAVPMemoryAllocator@@@Z
__imp_?RtlConvertVariantToProperty@@YGPAUtagSERIALIZEDPROPERTYVALUE@@PBUtagPROPVARIANT@@GPAU1@PAKKE2@Z
__imp_@RtlInterlockedPushListSList@16
__imp_@RtlUlongByteSwap@4
__imp_@RtlUlonglongByteSwap@8
__imp_@RtlUshortByteSwap@4
__imp__CsrAllocateCaptureBuffer@8
__imp__CsrAllocateMessagePointer@12
__imp__CsrCaptureMessageBuffer@16
__imp__CsrCaptureMessageMultiUnicodeStringsInPlace@12
__imp__CsrCaptureMessageString@20
__imp__CsrCaptureTimeout@8
__imp__CsrClientCallServer@16
__imp__CsrClientConnectToServer@20
__imp__CsrFreeCaptureBuffer@4
__imp__CsrGetProcessId@0
__imp__CsrIdentifyAlertableThread@0
__imp__CsrNewThread@0
__imp__CsrProbeForRead@12
__imp__CsrProbeForWrite@12
__imp__CsrSetPriorityClass@8
__imp__DbgBreakPoint@0
__imp__DbgPrint
__imp__DbgPrintEx
__imp__DbgPrintReturnControlC
__imp__DbgPrompt@12
__imp__DbgQueryDebugFilterState@8
__imp__DbgSetDebugFilterState@12
__imp__DbgUiConnectToDbg@0
__imp__DbgUiContinue@8
__imp__DbgUiConvertStateChangeStructure@8
__imp__DbgUiDebugActiveProcess@4
__imp__DbgUiGetThreadDebugObject@0
__imp__DbgUiIssueRemoteBreakin@4
__imp__DbgUiRemoteBreakin@4
__imp__DbgUiSetThreadDebugObject@4
__imp__DbgUiStopDebugging@4
__imp__DbgUiWaitStateChange@8
__imp__DbgUserBreakPoint@0
__imp__KiFastSystemCall@0
__imp__KiFastSystemCallRet@0
__imp__KiIntSystemCall@0
__imp__KiRaiseUserExceptionDispatcher@0
__imp__KiUserApcDispatcher@20
__imp__KiUserCallbackDispatcher@12
__imp__KiUserExceptionDispatcher@8
__imp__LdrAccessOutOfProcessResource@20
__imp__LdrAccessResource@16
__imp__LdrAddRefDll@8
__imp__LdrAlternateResourcesEnabled@0
__imp__LdrCreateOutOfProcessImage@16
__imp__LdrDestroyOutOfProcessImage@4
__imp__LdrDisableThreadCalloutsForDll@4
__imp__LdrEnumResources@20
__imp__LdrEnumerateLoadedModules@12
__imp__LdrFindCreateProcessManifest@20
__imp__LdrFindEntryForAddress@8
__imp__LdrFindResourceDirectory_U@16
__imp__LdrFindResourceEx_U@20
__imp__LdrFindResource_U@16
__imp__LdrFlushAlternateResourceModules@0
__imp__LdrGetDllHandle@16
__imp__LdrGetDllHandleEx@20
__imp__LdrGetProcedureAddress@16
__imp__LdrHotPatchRoutine@4
__imp__LdrInitShimEngineDynamic@4
__imp__LdrInitializeThunk@16
__imp__LdrLoadAlternateResourceModule@8
__imp__LdrLoadDll@16
__imp__LdrLockLoaderLock@12
__imp__LdrProcessRelocationBlock@16
__imp__LdrQueryImageFileExecutionOptions@24
__imp__LdrQueryProcessModuleInformation@12
__imp__LdrSetAppCompatDllRedirectionCallback@12
__imp__LdrSetDllManifestProber@4
__imp__LdrShutdownProcess@0
__imp__LdrShutdownThread@0
__imp__LdrUnloadAlternateResourceModule@4
__imp__LdrUnloadDll@4
__imp__LdrUnlockLoaderLock@8
__imp__LdrVerifyImageMatchesChecksum@16
__imp__NlsAnsiCodePage
__imp__NlsMbCodePageTag
__imp__NlsMbOemCodePageTag
__imp__NtAcceptConnectPort@24
__imp__NtAccessCheck@32
__imp__NtAccessCheckAndAuditAlarm@44
__imp__NtAccessCheckByType@44
__imp__NtAccessCheckByTypeAndAuditAlarm@64
__imp__NtAccessCheckByTypeResultList@44
__imp__NtAccessCheckByTypeResultListAndAuditAlarm@64
__imp__NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
__imp__NtAddAtom@12
__imp__NtAddBootEntry@8
__imp__NtAdjustGroupsToken@24
__imp__NtAdjustPrivilegesToken@24
__imp__NtAlertResumeThread@8
__imp__NtAlertThread@4
__imp__NtAllocateLocallyUniqueId@4
__imp__NtAllocateUserPhysicalPages@12
__imp__NtAllocateUuids@16
__imp__NtAllocateVirtualMemory@24
__imp__NtAreMappedFilesTheSame@8
__imp__NtAssignProcessToJobObject@8
__imp__NtCallbackReturn@12
__imp__NtCancelDeviceWakeupRequest@4
__imp__NtCancelIoFile@8
__imp__NtCancelTimer@8
__imp__NtClearEvent@4
__imp__NtClose@4
__imp__NtCloseObjectAuditAlarm@12
__imp__NtCompactKeys@8
__imp__NtCompareTokens@12
__imp__NtCompleteConnectPort@4
__imp__NtCompressKey@4
__imp__NtConnectPort@32
__imp__NtContinue@8
__imp__NtCreateDebugObject@16
__imp__NtCreateDirectoryObject@12
__imp__NtCreateEvent@20
__imp__NtCreateEventPair@12
__imp__NtCreateFile@44
__imp__NtCreateIoCompletion@16
__imp__NtCreateJobObject@12
__imp__NtCreateJobSet@12
__imp__NtCreateKey@28
__imp__NtCreateKeyedEvent@16
__imp__NtCreateMailslotFile@32
__imp__NtCreateMutant@16
__imp__NtCreateNamedPipeFile@56
__imp__NtCreatePagingFile@16
__imp__NtCreatePort@20
__imp__NtCreateProcess@32
__imp__NtCreateProcessEx@36
__imp__NtCreateProfile@36
__imp__NtCreateSection@28
__imp__NtCreateSemaphore@20
__imp__NtCreateSymbolicLinkObject@16
__imp__NtCreateThread@32
__imp__NtCreateTimer@16
__imp__NtCreateToken@52
__imp__NtCreateWaitablePort@20
__imp__NtCurrentTeb@0
__imp__NtDebugActiveProcess@8
__imp__NtDebugContinue@12
__imp__NtDelayExecution@8
__imp__NtDeleteAtom@4
__imp__NtDeleteBootEntry@4
__imp__NtDeleteFile@4
__imp__NtDeleteKey@4
__imp__NtDeleteObjectAuditAlarm@12
__imp__NtDeleteValueKey@8
__imp__NtDeviceIoControlFile@40
__imp__NtDisplayString@4
__imp__NtDuplicateObject@28
__imp__NtDuplicateToken@24
__imp__NtEnumerateBootEntries@8
__imp__NtEnumerateKey@24
__imp__NtEnumerateSystemEnvironmentValuesEx@12
__imp__NtEnumerateValueKey@24
__imp__NtExtendSection@8
__imp__NtFilterToken@24
__imp__NtFindAtom@12
__imp__NtFlushBuffersFile@8
__imp__NtFlushInstructionCache@12
__imp__NtFlushKey@4
__imp__NtFlushVirtualMemory@16
__imp__NtFlushWriteBuffer@0
__imp__NtFreeUserPhysicalPages@12
__imp__NtFreeVirtualMemory@16
__imp__NtFsControlFile@40
__imp__NtGetContextThread@8
__imp__NtGetDevicePowerState@8
__imp__NtGetPlugPlayEvent@16
__imp__NtGetWriteWatch@28
__imp__NtImpersonateAnonymousToken@4
__imp__NtImpersonateClientOfPort@8
__imp__NtImpersonateThread@12
__imp__NtInitializeRegistry@4
__imp__NtInitiatePowerAction@16
__imp__NtIsProcessInJob@8
__imp__NtIsSystemResumeAutomatic@0
__imp__NtListenPort@8
__imp__NtLoadDriver@4
__imp__NtLoadKey2@12
__imp__NtLoadKey@8
__imp__NtLockFile@40
__imp__NtLockProductActivationKeys@8
__imp__NtLockRegistryKey@4
__imp__NtLockVirtualMemory@16
__imp__NtMakePermanentObject@4
__imp__NtMakeTemporaryObject@4
__imp__NtMapUserPhysicalPages@12
__imp__NtMapUserPhysicalPagesScatter@12
__imp__NtMapViewOfSection@40
__imp__NtModifyBootEntry@4
__imp__NtNotifyChangeDirectoryFile@36
__imp__NtNotifyChangeKey@40
__imp__NtNotifyChangeMultipleKeys@48
__imp__NtOpenDirectoryObject@12
__imp__NtOpenEvent@12
__imp__NtOpenEventPair@12
__imp__NtOpenFile@24
__imp__NtOpenIoCompletion@12
__imp__NtOpenJobObject@12
__imp__NtOpenKey@12
__imp__NtOpenKeyedEvent@12
__imp__NtOpenMutant@12
__imp__NtOpenObjectAuditAlarm@48
__imp__NtOpenProcess@16
__imp__NtOpenProcessToken@12
__imp__NtOpenProcessTokenEx@16
__imp__NtOpenSection@12
__imp__NtOpenSemaphore@12
__imp__NtOpenSymbolicLinkObject@12
__imp__NtOpenThread@16
__imp__NtOpenThreadToken@16
__imp__NtOpenThreadTokenEx@20
__imp__NtOpenTimer@12
__imp__NtPlugPlayControl@12
__imp__NtPowerInformation@20
__imp__NtPrivilegeCheck@12
__imp__NtPrivilegeObjectAuditAlarm@24
__imp__NtPrivilegedServiceAuditAlarm@20
__imp__NtProtectVirtualMemory@20
__imp__NtPulseEvent@8
__imp__NtQueryAttributesFile@8
__imp__NtQueryBootEntryOrder@8
__imp__NtQueryBootOptions@8
__imp__NtQueryDebugFilterState@8
__imp__NtQueryDefaultLocale@8
__imp__NtQueryDefaultUILanguage@4
__imp__NtQueryDirectoryFile@44
__imp__NtQueryDirectoryObject@28
__imp__NtQueryEaFile@36
__imp__NtQueryEvent@20
__imp__NtQueryFullAttributesFile@8
__imp__NtQueryInformationAtom@20
__imp__NtQueryInformationFile@20
__imp__NtQueryInformationJobObject@20
__imp__NtQueryInformationPort@20
__imp__NtQueryInformationProcess@20
__imp__NtQueryInformationThread@20
__imp__NtQueryInformationToken@20
__imp__NtQueryInstallUILanguage@4
__imp__NtQueryIntervalProfile@8
__imp__NtQueryIoCompletion@20
__imp__NtQueryKey@20
__imp__NtQueryMultipleValueKey@24
__imp__NtQueryMutant@20
__imp__NtQueryObject@20
__imp__NtQueryOpenSubKeys@8
__imp__NtQueryPerformanceCounter@8
__imp__NtQueryPortInformationProcess@0
__imp__NtQueryQuotaInformationFile@36
__imp__NtQuerySection@20
__imp__NtQuerySecurityObject@20
__imp__NtQuerySemaphore@20
__imp__NtQuerySymbolicLinkObject@12
__imp__NtQuerySystemEnvironmentValue@16
__imp__NtQuerySystemEnvironmentValueEx@20
__imp__NtQuerySystemInformation@16
__imp__NtQuerySystemTime@4
__imp__NtQueryTimer@20
__imp__NtQueryTimerResolution@12
__imp__NtQueryValueKey@24
__imp__NtQueryVirtualMemory@24
__imp__NtQueryVolumeInformationFile@20
__imp__NtQueueApcThread@20
__imp__NtRaiseException@12
__imp__NtRaiseHardError@24
__imp__NtReadFile@36
__imp__NtReadFileScatter@36
__imp__NtReadRequestData@24
__imp__NtReadVirtualMemory@20
__imp__NtRegisterThreadTerminatePort@4
__imp__NtReleaseKeyedEvent@16
__imp__NtReleaseMutant@8
__imp__NtReleaseSemaphore@12
__imp__NtRemoveIoCompletion@20
__imp__NtRemoveProcessDebug@8
__imp__NtRenameKey@8
__imp__NtReplaceKey@12
__imp__NtReplyPort@8
__imp__NtReplyWaitReceivePort@16
__imp__NtReplyWaitReceivePortEx@20
__imp__NtReplyWaitReplyPort@8
__imp__NtRequestDeviceWakeup@4
__imp__NtRequestPort@8
__imp__NtRequestWaitReplyPort@12
__imp__NtRequestWakeupLatency@4
__imp__NtResetEvent@8
__imp__NtResetWriteWatch@12
__imp__NtRestoreKey@12
__imp__NtResumeProcess@4
__imp__NtResumeThread@8
__imp__NtSaveKey@8
__imp__NtSaveKeyEx@12
__imp__NtSaveMergedKeys@12
__imp__NtSecureConnectPort@36
__imp__NtSetBootEntryOrder@8
__imp__NtSetBootOptions@8
__imp__NtSetContextThread@8
__imp__NtSetDebugFilterState@12
__imp__NtSetDefaultHardErrorPort@4
__imp__NtSetDefaultLocale@8
__imp__NtSetDefaultUILanguage@4
__imp__NtSetEaFile@16
__imp__NtSetEvent@8
__imp__NtSetEventBoostPriority@4
__imp__NtSetHighEventPair@4
__imp__NtSetHighWaitLowEventPair@4
__imp__NtSetInformationDebugObject@20
__imp__NtSetInformationFile@20
__imp__NtSetInformationJobObject@16
__imp__NtSetInformationKey@16
__imp__NtSetInformationObject@16
__imp__NtSetInformationProcess@16
__imp__NtSetInformationThread@16
__imp__NtSetInformationToken@16
__imp__NtSetIntervalProfile@8
__imp__NtSetIoCompletion@20
__imp__NtSetLdtEntries@24
__imp__NtSetLowEventPair@4
__imp__NtSetLowWaitHighEventPair@4
__imp__NtSetQuotaInformationFile@16
__imp__NtSetSecurityObject@12
__imp__NtSetSystemEnvironmentValue@8
__imp__NtSetSystemEnvironmentValueEx@20
__imp__NtSetSystemInformation@12
__imp__NtSetSystemPowerState@12
__imp__NtSetSystemTime@8
__imp__NtSetThreadExecutionState@8
__imp__NtSetTimer@28
__imp__NtSetTimerResolution@12
__imp__NtSetUuidSeed@4
__imp__NtSetValueKey@24
__imp__NtSetVolumeInformationFile@20
__imp__NtShutdownSystem@4
__imp__NtSignalAndWaitForSingleObject@16
__imp__NtStartProfile@4
__imp__NtStopProfile@4
__imp__NtSuspendProcess@4
__imp__NtSuspendThread@8
__imp__NtSystemDebugControl@24
__imp__NtTerminateJobObject@8
__imp__NtTerminateProcess@8
__imp__NtTerminateThread@8
__imp__NtTestAlert@0
__imp__NtTraceEvent@16
__imp__NtTranslateFilePath@16
__imp__NtUnloadDriver@4
__imp__NtUnloadKey@4
__imp__NtUnloadKeyEx@8
__imp__NtUnlockFile@20
__imp__NtUnlockVirtualMemory@16
__imp__NtUnmapViewOfSection@8
__imp__NtVdmControl@8
__imp__NtWaitForDebugEvent@16
__imp__NtWaitForKeyedEvent@16
__imp__NtWaitForMultipleObjects@20
__imp__NtWaitForSingleObject@12
__imp__NtWaitHighEventPair@4
__imp__NtWaitLowEventPair@4
__imp__NtWriteFile@36
__imp__NtWriteFileGather@36
__imp__NtWriteRequestData@24
__imp__NtWriteVirtualMemory@20
__imp__NtYieldExecution@0
__imp__PfxFindPrefix@8
__imp__PfxInitialize@4
__imp__PfxInsertPrefix@12
__imp__PfxRemovePrefix@8
__imp__RtlAbortRXact@4
__imp__RtlAbsoluteToSelfRelativeSD@12
__imp__RtlAcquirePebLock@0
__imp__RtlAcquireResourceExclusive@8
__imp__RtlAcquireResourceShared@8
__imp__RtlActivateActivationContext@12
__imp__RtlActivateActivationContextEx@16
__imp__RtlActivateActivationContextUnsafeFast@8
__imp__RtlAddAccessAllowedAce@16
__imp__RtlAddAccessAllowedAceEx@20
__imp__RtlAddAccessAllowedObjectAce@28
__imp__RtlAddAccessDeniedAce@16
__imp__RtlAddAccessDeniedAceEx@20
__imp__RtlAddAccessDeniedObjectAce@28
__imp__RtlAddAce@20
__imp__RtlAddActionToRXact@24
__imp__RtlAddAtomToAtomTable@12
__imp__RtlAddAttributeActionToRXact@32
__imp__RtlAddAuditAccessAce@24
__imp__RtlAddAuditAccessAceEx@28
__imp__RtlAddAuditAccessObjectAce@36
__imp__RtlAddCompoundAce@24
__imp__RtlAddRange@36
__imp__RtlAddRefActivationContext@4
__imp__RtlAddRefMemoryStream@4
__imp__RtlAddVectoredExceptionHandler@8
__imp__RtlAddressInSectionTable@12
__imp__RtlAdjustPrivilege@16
__imp__RtlAllocateAndInitializeSid@44
__imp__RtlAllocateHandle@8
__imp__RtlAllocateHeap@12
__imp__RtlAnsiCharToUnicodeChar@4
__imp__RtlAnsiStringToUnicodeSize@4
__imp__RtlAnsiStringToUnicodeString@12
__imp__RtlAppendAsciizToString@8
__imp__RtlAppendPathElement@12
__imp__RtlAppendStringToString@8
__imp__RtlAppendUnicodeStringToString@8
__imp__RtlAppendUnicodeToString@8
__imp__RtlApplicationVerifierStop@40
__imp__RtlApplyRXact@4
__imp__RtlApplyRXactNoFlush@4
__imp__RtlAreAllAccessesGranted@8
__imp__RtlAreAnyAccessesGranted@8
__imp__RtlAreBitsClear@12
__imp__RtlAreBitsSet@12
__imp__RtlAssert2@20
__imp__RtlAssert@16
__imp__RtlCancelTimer@8
__imp__RtlCaptureContext@4
__imp__RtlCaptureStackBackTrace@16
__imp__RtlCaptureStackContext@12
__imp__RtlCharToInteger@12
__imp__RtlCheckForOrphanedCriticalSections@4
__imp__RtlCheckProcessParameters@16
__imp__RtlCheckRegistryKey@8
__imp__RtlClearAllBits@4
__imp__RtlClearBits@12
__imp__RtlCloneMemoryStream@8
__imp__RtlCommitMemoryStream@8
__imp__RtlCompactHeap@8
__imp__RtlCompareMemory@12
__imp__RtlCompareMemoryUlong@12
__imp__RtlCompareString@12
__imp__RtlCompareUnicodeString@12
__imp__RtlCompressBuffer@32
__imp__RtlComputeCrc32@12
__imp__RtlComputeImportTableHash@12
__imp__RtlComputePrivatizedDllName_U@12
__imp__RtlConsoleMultiByteToUnicodeN@24
__imp__RtlConvertExclusiveToShared@4
__imp__RtlConvertLongToLargeInteger@4
__imp__RtlConvertSharedToExclusive@4
__imp__RtlConvertSidToUnicodeString@12
__imp__RtlConvertToAutoInheritSecurityObject@24
__imp__RtlConvertUiListToApiList@12
__imp__RtlConvertUlongToLargeInteger@4
__imp__RtlCopyLuid@8
__imp__RtlCopyLuidAndAttributesArray@12
__imp__RtlCopyMemoryStreamTo@24
__imp__RtlCopyOutOfProcessMemoryStreamTo@24
__imp__RtlCopyRangeList@8
__imp__RtlCopySecurityDescriptor@8
__imp__RtlCopySid@12
__imp__RtlCopySidAndAttributesArray@28
__imp__RtlCopyString@8
__imp__RtlCopyUnicodeString@8
__imp__RtlCreateAcl@12
__imp__RtlCreateActivationContext@24
__imp__RtlCreateAndSetSD@20
__imp__RtlCreateAtomTable@8
__imp__RtlCreateBootStatusDataFile@0
__imp__RtlCreateEnvironment@8
__imp__RtlCreateHeap@24
__imp__RtlCreateProcessParameters@40
__imp__RtlCreateQueryDebugBuffer@8
__imp__RtlCreateRegistryKey@8
__imp__RtlCreateSecurityDescriptor@8
__imp__RtlCreateSystemVolumeInformationFolder@4
__imp__RtlCreateTagHeap@16
__imp__RtlCreateTimer@28
__imp__RtlCreateTimerQueue@4
__imp__RtlCreateUnicodeString@8
__imp__RtlCreateUnicodeStringFromAsciiz@8
__imp__RtlCreateUserProcess@40
__imp__RtlCreateUserSecurityObject@28
__imp__RtlCreateUserThread@40
__imp__RtlCustomCPToUnicodeN@24
__imp__RtlCutoverTimeToSystemTime@16
__imp__RtlDeNormalizeProcessParams@4
__imp__RtlDeactivateActivationContext@8
__imp__RtlDeactivateActivationContextUnsafeFast@4
__imp__RtlDebugPrintTimes@0
__imp__RtlDecodePointer@4
__imp__RtlDecodeSystemPointer@4
__imp__RtlDecompressBuffer@24
__imp__RtlDecompressFragment@32
__imp__RtlDefaultNpAcl@4
__imp__RtlDelete@4
__imp__RtlDeleteAce@8
__imp__RtlDeleteAtomFromAtomTable@8
__imp__RtlDeleteCriticalSection@4
__imp__RtlDeleteElementGenericTable@8
__imp__RtlDeleteElementGenericTableAvl@8
__imp__RtlDeleteNoSplay@8
__imp__RtlDeleteOwnersRanges@8
__imp__RtlDeleteRange@24
__imp__RtlDeleteRegistryValue@12
__imp__RtlDeleteResource@4
__imp__RtlDeleteSecurityObject@4
__imp__RtlDeleteTimer@12
__imp__RtlDeleteTimerQueue@4
__imp__RtlDeleteTimerQueueEx@8
__imp__RtlDeregisterWait@4
__imp__RtlDeregisterWaitEx@8
__imp__RtlDestroyAtomTable@4
__imp__RtlDestroyEnvironment@4
__imp__RtlDestroyHandleTable@4
__imp__RtlDestroyHeap@4
__imp__RtlDestroyProcessParameters@4
__imp__RtlDestroyQueryDebugBuffer@4
__imp__RtlDetermineDosPathNameType_U@4
__imp__RtlDllShutdownInProgress@0
__imp__RtlDnsHostNameToComputerName@12
__imp__RtlDoesFileExists_U@4
__imp__RtlDosApplyFileIsolationRedirection_Ustr@36
__imp__RtlDosPathNameToNtPathName_U@16
__imp__RtlDosSearchPath_U@24
__imp__RtlDosSearchPath_Ustr@36
__imp__RtlDowncaseUnicodeChar@4
__imp__RtlDowncaseUnicodeString@12
__imp__RtlDumpResource@4
__imp__RtlDuplicateUnicodeString@12
__imp__RtlEmptyAtomTable@8
__imp__RtlEnableEarlyCriticalSectionEventCreation@0
__imp__RtlEncodePointer@4
__imp__RtlEncodeSystemPointer@4
__imp__RtlEnlargedIntegerMultiply@8
__imp__RtlEnlargedUnsignedDivide@16
__imp__RtlEnlargedUnsignedMultiply@8
__imp__RtlEnterCriticalSection@4
__imp__RtlEnumProcessHeaps@8
__imp__RtlEnumerateGenericTable@8
__imp__RtlEnumerateGenericTableAvl@8
__imp__RtlEnumerateGenericTableLikeADirectory@28
__imp__RtlEnumerateGenericTableWithoutSplaying@8
__imp__RtlEnumerateGenericTableWithoutSplayingAvl@8
__imp__RtlEqualComputerName@8
__imp__RtlEqualDomainName@8
__imp__RtlEqualLuid@8
__imp__RtlEqualPrefixSid@8
__imp__RtlEqualSid@8
__imp__RtlEqualString@12
__imp__RtlEqualUnicodeString@12
__imp__RtlEraseUnicodeString@4
__imp__RtlExitUserThread@4
__imp__RtlExpandEnvironmentStrings_U@16
__imp__RtlExtendHeap@16
__imp__RtlExtendedIntegerMultiply@12
__imp__RtlExtendedLargeIntegerDivide@16
__imp__RtlExtendedMagicDivide@20
__imp__RtlFillMemory@12
__imp__RtlFillMemoryUlong@12
__imp__RtlFinalReleaseOutOfProcessMemoryStream@4
__imp__RtlFindActivationContextSectionGuid@20
__imp__RtlFindActivationContextSectionString@20
__imp__RtlFindCharInUnicodeString@16
__imp__RtlFindClearBits@12
__imp__RtlFindClearBitsAndSet@12
__imp__RtlFindClearRuns@16
__imp__RtlFindLastBackwardRunClear@12
__imp__RtlFindLeastSignificantBit@8
__imp__RtlFindLongestRunClear@8
__imp__RtlFindMessage@20
__imp__RtlFindMostSignificantBit@8
__imp__RtlFindNextForwardRunClear@12
__imp__RtlFindRange@48
__imp__RtlFindSetBits@12
__imp__RtlFindSetBitsAndClear@12
__imp__RtlFirstEntrySList@4
__imp__RtlFirstFreeAce@8
__imp__RtlFlushSecureMemoryCache@8
__imp__RtlFormatCurrentUserKeyPath@4
__imp__RtlFormatMessage@36
__imp__RtlFreeAnsiString@4
__imp__RtlFreeHandle@8
__imp__RtlFreeHeap@12
__imp__RtlFreeOemString@4
__imp__RtlFreeRangeList@4
__imp__RtlFreeSid@4
__imp__RtlFreeThreadActivationContextStack@0
__imp__RtlFreeUnicodeString@4
__imp__RtlFreeUserThreadStack@8
__imp__RtlGUIDFromString@8
__imp__RtlGenerate8dot3Name@16
__imp__RtlGetAce@12
__imp__RtlGetActiveActivationContext@4
__imp__RtlGetCallersAddress@8
__imp__RtlGetCompressionWorkSpaceSize@12
__imp__RtlGetControlSecurityDescriptor@12
__imp__RtlGetCurrentDirectory_U@8
__imp__RtlGetCurrentPeb@0
__imp__RtlGetDaclSecurityDescriptor@16
__imp__RtlGetElementGenericTable@8
__imp__RtlGetElementGenericTableAvl@8
__imp__RtlGetFirstRange@12
__imp__RtlGetFrame@0
__imp__RtlGetFullPathName_U@16
__imp__RtlGetGroupSecurityDescriptor@12
__imp__RtlGetLastNtStatus@0
__imp__RtlGetLastWin32Error@0
__imp__RtlGetLengthWithoutLastFullDosOrNtPathElement@12
__imp__RtlGetLengthWithoutTrailingPathSeperators@12
__imp__RtlGetLongestNtPathLength@0
__imp__RtlGetNativeSystemInformation@16
__imp__RtlGetNextRange@12
__imp__RtlGetNtGlobalFlags@0
__imp__RtlGetNtProductType@4
__imp__RtlGetNtVersionNumbers@12
__imp__RtlGetOwnerSecurityDescriptor@12
__imp__RtlGetProcessHeaps@8
__imp__RtlGetSaclSecurityDescriptor@16
__imp__RtlGetSecurityDescriptorRMControl@8
__imp__RtlGetSetBootStatusData@24
__imp__RtlGetUnloadEventTrace@0
__imp__RtlGetUserInfoHeap@20
__imp__RtlGetVersion@4
__imp__RtlHashUnicodeString@16
__imp__RtlIdentifierAuthoritySid@4
__imp__RtlImageDirectoryEntryToData@16
__imp__RtlImageNtHeader@4
__imp__RtlImageRvaToSection@12
__imp__RtlImageRvaToVa@16
__imp__RtlImpersonateSelf@4
__imp__RtlInitAnsiString@8
__imp__RtlInitCodePageTable@8
__imp__RtlInitMemoryStream@4
__imp__RtlInitNlsTables@16
__imp__RtlInitOutOfProcessMemoryStream@4
__imp__RtlInitString@8
__imp__RtlInitUnicodeString@8
__imp__RtlInitUnicodeStringEx@8
__imp__RtlInitializeAtomPackage@4
__imp__RtlInitializeBitMap@12
__imp__RtlInitializeContext@20
__imp__RtlInitializeCriticalSection@4
__imp__RtlInitializeCriticalSectionAndSpinCount@8
__imp__RtlInitializeGenericTable@20
__imp__RtlInitializeGenericTableAvl@20
__imp__RtlInitializeHandleTable@12
__imp__RtlInitializeRXact@12
__imp__RtlInitializeRangeList@4
__imp__RtlInitializeResource@4
__imp__RtlInitializeSListHead@4
__imp__RtlInitializeSid@12
__imp__RtlInitializeStackTraceDataBase@12
__imp__RtlInsertElementGenericTable@16
__imp__RtlInsertElementGenericTableAvl@16
__imp__RtlInt64ToUnicodeString@16
__imp__RtlIntegerToChar@16
__imp__RtlIntegerToUnicodeString@12
__imp__RtlInterlockedFlushSList@4
__imp__RtlInterlockedPopEntrySList@4
__imp__RtlInterlockedPushEntrySList@8
__imp__RtlInvertRangeList@8
__imp__RtlIpv4AddressToStringA@8
__imp__RtlIpv4AddressToStringExA@16
__imp__RtlIpv4AddressToStringExW@16
__imp__RtlIpv4AddressToStringW@8
__imp__RtlIpv4StringToAddressA@16
__imp__RtlIpv4StringToAddressExA@16
__imp__RtlIpv4StringToAddressExW@16
__imp__RtlIpv4StringToAddressW@16
__imp__RtlIpv6AddressToStringA@8
__imp__RtlIpv6AddressToStringExA@20
__imp__RtlIpv6AddressToStringExW@20
__imp__RtlIpv6AddressToStringW@8
__imp__RtlIpv6StringToAddressA@12
__imp__RtlIpv6StringToAddressExA@16
__imp__RtlIpv6StringToAddressExW@16
__imp__RtlIpv6StringToAddressW@12
__imp__RtlIsActivationContextActive@4
__imp__RtlIsDosDeviceName_U@4
__imp__RtlIsGenericTableEmpty@4
__imp__RtlIsGenericTableEmptyAvl@4
__imp__RtlIsNameLegalDOS8Dot3@12
__imp__RtlIsRangeAvailable@40
__imp__RtlIsTextUnicode@12
__imp__RtlIsThreadWithinLoaderCallout@0
__imp__RtlIsValidHandle@8
__imp__RtlIsValidIndexHandle@12
__imp__RtlLargeIntegerAdd@16
__imp__RtlLargeIntegerArithmeticShift@12
__imp__RtlLargeIntegerDivide@20
__imp__RtlLargeIntegerNegate@8
__imp__RtlLargeIntegerShiftLeft@12
__imp__RtlLargeIntegerShiftRight@12
__imp__RtlLargeIntegerSubtract@16
__imp__RtlLargeIntegerToChar@16
__imp__RtlLeaveCriticalSection@4
__imp__RtlLengthRequiredSid@4
__imp__RtlLengthSecurityDescriptor@4
__imp__RtlLengthSid@4
__imp__RtlLocalTimeToSystemTime@8
__imp__RtlLockBootStatusData@4
__imp__RtlLockHeap@4
__imp__RtlLockMemoryStreamRegion@24
__imp__RtlLogStackBackTrace@0
__imp__RtlLookupAtomInAtomTable@12
__imp__RtlLookupElementGenericTable@8
__imp__RtlLookupElementGenericTableAvl@8
__imp__RtlMakeSelfRelativeSD@12
__imp__RtlMapGenericMask@8
__imp__RtlMapSecurityErrorToNtStatus@4
__imp__RtlMergeRangeLists@16
__imp__RtlMoveMemory@12
__imp__RtlMultiAppendUnicodeStringBuffer@12
__imp__RtlMultiByteToUnicodeN@20
__imp__RtlMultiByteToUnicodeSize@12
__imp__RtlNewInstanceSecurityObject@40
__imp__RtlNewSecurityGrantedAccess@24
__imp__RtlNewSecurityObject@24
__imp__RtlNewSecurityObjectEx@32
__imp__RtlNewSecurityObjectWithMultipleInheritance@36
__imp__RtlNormalizeProcessParams@4
__imp__RtlNtPathNameToDosPathName@16
__imp__RtlNtStatusToDosError@4
__imp__RtlNtStatusToDosErrorNoTeb@4
__imp__RtlNumberGenericTableElements@4
__imp__RtlNumberGenericTableElementsAvl@4
__imp__RtlNumberOfClearBits@4
__imp__RtlNumberOfSetBits@4
__imp__RtlOemStringToUnicodeSize@4
__imp__RtlOemStringToUnicodeString@12
__imp__RtlOemToUnicodeN@20
__imp__RtlOpenCurrentUser@8
__imp__RtlPcToFileHeader@8
__imp__RtlPinAtomInAtomTable@8
__imp__RtlPopFrame@4
__imp__RtlPrefixString@12
__imp__RtlPrefixUnicodeString@12
__imp__RtlProtectHeap@8
__imp__RtlPushFrame@4
__imp__RtlQueryAtomInAtomTable@24
__imp__RtlQueryDepthSList@4
__imp__RtlQueryEnvironmentVariable_U@12
__imp__RtlQueryHeapInformation@20
__imp__RtlQueryInformationAcl@16
__imp__RtlQueryInformationActivationContext@28
__imp__RtlQueryInformationActiveActivationContext@16
__imp__RtlQueryInterfaceMemoryStream@12
__imp__RtlQueryProcessBackTraceInformation@4
__imp__RtlQueryProcessDebugInformation@12
__imp__RtlQueryProcessHeapInformation@4
__imp__RtlQueryProcessLockInformation@4
__imp__RtlQueryRegistryValues@20
__imp__RtlQuerySecurityObject@20
__imp__RtlQueryTagHeap@20
__imp__RtlQueryTimeZoneInformation@4
__imp__RtlQueueApcWow64Thread@20
__imp__RtlQueueWorkItem@12
__imp__RtlRaiseException@4
__imp__RtlRaiseStatus@4
__imp__RtlRandom@4
__imp__RtlRandomEx@4
__imp__RtlReAllocateHeap@16
__imp__RtlReadMemoryStream@16
__imp__RtlReadOutOfProcessMemoryStream@16
__imp__RtlRealPredecessor@4
__imp__RtlRealSuccessor@4
__imp__RtlRegisterSecureMemoryCacheCallback@4
__imp__RtlRegisterWait@24
__imp__RtlReleaseActivationContext@4
__imp__RtlReleaseMemoryStream@4
__imp__RtlReleasePebLock@0
__imp__RtlReleaseResource@4
__imp__RtlRemoteCall@28
__imp__RtlRemoveVectoredExceptionHandler@4
__imp__RtlResetRtlTranslations@4
__imp__RtlRestoreLastWin32Error@4
__imp__RtlRevertMemoryStream@4
__imp__RtlRunDecodeUnicodeString@8
__imp__RtlRunEncodeUnicodeString@8
__imp__RtlSecondsSince1970ToTime@8
__imp__RtlSecondsSince1980ToTime@8
__imp__RtlSeekMemoryStream@20
__imp__RtlSelfRelativeToAbsoluteSD2@8
__imp__RtlSelfRelativeToAbsoluteSD@44
__imp__RtlSetAllBits@4
__imp__RtlSetAttributesSecurityDescriptor@12
__imp__RtlSetBits@12
__imp__RtlSetControlSecurityDescriptor@12
__imp__RtlSetCriticalSectionSpinCount@8
__imp__RtlSetCurrentDirectory_U@4
__imp__RtlSetCurrentEnvironment@8
__imp__RtlSetDaclSecurityDescriptor@16
__imp__RtlSetEnvironmentVariable@12
__imp__RtlSetGroupSecurityDescriptor@12
__imp__RtlSetHeapInformation@16
__imp__RtlSetInformationAcl@16
__imp__RtlSetIoCompletionCallback@12
__imp__RtlSetLastWin32Error@4
__imp__RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
__imp__RtlSetMemoryStreamSize@12
__imp__RtlSetOwnerSecurityDescriptor@12
__imp__RtlSetProcessIsCritical
__imp__RtlSetSaclSecurityDescriptor@16
__imp__RtlSetSecurityDescriptorRMControl@8
__imp__RtlSetSecurityObject@20
__imp__RtlSetSecurityObjectEx@24
__imp__RtlSetThreadIsCritical
__imp__RtlSetThreadPoolStartFunc@8
__imp__RtlSetTimeZoneInformation@4
__imp__RtlSetTimer@28
__imp__RtlSetUnicodeCallouts@4
__imp__RtlSetUserFlagsHeap@20
__imp__RtlSetUserValueHeap@16
__imp__RtlSizeHeap@12
__imp__RtlSplay@4
__imp__RtlStartRXact@4
__imp__RtlStatMemoryStream@12
__imp__RtlStringFromGUID@8
__imp__RtlSubAuthorityCountSid@4
__imp__RtlSubAuthoritySid@8
__imp__RtlSubtreePredecessor@4
__imp__RtlSubtreeSuccessor@4
__imp__RtlSystemTimeToLocalTime@8
__imp__RtlTimeFieldsToTime@8
__imp__RtlTimeToElapsedTimeFields@8
__imp__RtlTimeToSecondsSince1970@8
__imp__RtlTimeToSecondsSince1980@8
__imp__RtlTimeToTimeFields@8
__imp__RtlTraceDatabaseAdd@16
__imp__RtlTraceDatabaseCreate@20
__imp__RtlTraceDatabaseDestroy@4
__imp__RtlTraceDatabaseEnumerate@12
__imp__RtlTraceDatabaseFind@16
__imp__RtlTraceDatabaseLock@4
__imp__RtlTraceDatabaseUnlock@4
__imp__RtlTraceDatabaseValidate@4
__imp__RtlTryEnterCriticalSection@4
__imp__RtlUnhandledExceptionFilter2@8
__imp__RtlUnhandledExceptionFilter@4
__imp__RtlUnicodeStringToAnsiSize@4
__imp__RtlUnicodeStringToAnsiString@12
__imp__RtlUnicodeStringToCountedOemString@12
__imp__RtlUnicodeStringToInteger@12
__imp__RtlUnicodeStringToOemSize@4
__imp__RtlUnicodeStringToOemString@12
__imp__RtlUnicodeToCustomCPN@24
__imp__RtlUnicodeToMultiByteN@20
__imp__RtlUnicodeToMultiByteSize@12
__imp__RtlUnicodeToOemN@20
__imp__RtlUniform@4
__imp__RtlUnlockBootStatusData@4
__imp__RtlUnlockHeap@4
__imp__RtlUnlockMemoryStreamRegion@24
__imp__RtlUnwind@16
__imp__RtlUpcaseUnicodeChar@4
__imp__RtlUpcaseUnicodeString@12
__imp__RtlUpcaseUnicodeStringToAnsiString@12
__imp__RtlUpcaseUnicodeStringToCountedOemString@12
__imp__RtlUpcaseUnicodeStringToOemString@12
__imp__RtlUpcaseUnicodeToCustomCPN@24
__imp__RtlUpcaseUnicodeToMultiByteN@20
__imp__RtlUpcaseUnicodeToOemN@20
__imp__RtlUpdateTimer@16
__imp__RtlUpperChar@4
__imp__RtlUpperString@8
__imp__RtlUsageHeap@12
__imp__RtlValidAcl@4
__imp__RtlValidRelativeSecurityDescriptor@12
__imp__RtlValidSecurityDescriptor@4
__imp__RtlValidSid@4
__imp__RtlValidateHeap@12
__imp__RtlValidateProcessHeaps@0
__imp__RtlValidateUnicodeString@8
__imp__RtlVerifyVersionInfo@16
__imp__RtlWalkFrameChain@12
__imp__RtlWalkHeap@8
__imp__RtlWriteMemoryStream@16
__imp__RtlWriteRegistryValue@24
__imp__RtlZeroHeap@8
__imp__RtlZeroMemory@8
__imp__RtlZombifyActivationContext@4
__imp__RtlpApplyLengthFunction@16
__imp__RtlpEnsureBufferSize@12
__imp__RtlpNotOwnerCriticalSection@4
__imp__RtlpNtCreateKey@24
__imp__RtlpNtEnumerateSubKey@16
__imp__RtlpNtMakeTemporaryKey@4
__imp__RtlpNtOpenKey@16
__imp__RtlpNtQueryValueKey@20
__imp__RtlpNtSetValueKey@16
__imp__RtlpUnWaitCriticalSection@4
__imp__RtlpWaitForCriticalSection@4
__imp__RtlxAnsiStringToUnicodeSize@4
__imp__RtlxOemStringToUnicodeSize@4
__imp__RtlxUnicodeStringToAnsiSize@4
__imp__RtlxUnicodeStringToOemSize@4
__imp__VerSetConditionMask@16
__imp__ZwAcceptConnectPort@24
__imp__ZwAccessCheck@32
__imp__ZwAccessCheckAndAuditAlarm@44
__imp__ZwAccessCheckByType@44
__imp__ZwAccessCheckByTypeAndAuditAlarm@64
__imp__ZwAccessCheckByTypeResultList@44
__imp__ZwAccessCheckByTypeResultListAndAuditAlarm@64
__imp__ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
__imp__ZwAddAtom@12
__imp__ZwAddBootEntry@8
__imp__ZwAdjustGroupsToken@24
__imp__ZwAdjustPrivilegesToken@24
__imp__ZwAlertResumeThread@8
__imp__ZwAlertThread@4
__imp__ZwAllocateLocallyUniqueId@4
__imp__ZwAllocateUserPhysicalPages@12
__imp__ZwAllocateUuids@16
__imp__ZwAllocateVirtualMemory@24
__imp__ZwAreMappedFilesTheSame@8
__imp__ZwAssignProcessToJobObject@8
__imp__ZwCallbackReturn@12
__imp__ZwCancelDeviceWakeupRequest@4
__imp__ZwCancelIoFile@8
__imp__ZwCancelTimer@8
__imp__ZwClearEvent@4
__imp__ZwClose@4
__imp__ZwCloseObjectAuditAlarm@12
__imp__ZwCompactKeys@8
__imp__ZwCompareTokens@12
__imp__ZwCompleteConnectPort@4
__imp__ZwCompressKey@4
__imp__ZwConnectPort@32
__imp__ZwContinue@8
__imp__ZwCreateDebugObject@16
__imp__ZwCreateDirectoryObject@12
__imp__ZwCreateEvent@20
__imp__ZwCreateEventPair@12
__imp__ZwCreateFile@44
__imp__ZwCreateIoCompletion@16
__imp__ZwCreateJobObject@12
__imp__ZwCreateJobSet@12
__imp__ZwCreateKey@28
__imp__ZwCreateKeyedEvent@16
__imp__ZwCreateMailslotFile@32
__imp__ZwCreateMutant@16
__imp__ZwCreateNamedPipeFile@56
__imp__ZwCreatePagingFile@16
__imp__ZwCreatePort@20
__imp__ZwCreateProcess@32
__imp__ZwCreateProcessEx@36
__imp__ZwCreateProfile@36
__imp__ZwCreateSection@28
__imp__ZwCreateSemaphore@20
__imp__ZwCreateSymbolicLinkObject@16
__imp__ZwCreateThread@32
__imp__ZwCreateTimer@16
__imp__ZwCreateToken@52
__imp__ZwCreateWaitablePort@20
__imp__ZwDebugActiveProcess@8
__imp__ZwDebugContinue@12
__imp__ZwDelayExecution@8
__imp__ZwDeleteAtom@4
__imp__ZwDeleteBootEntry@4
__imp__ZwDeleteFile@4
__imp__ZwDeleteKey@4
__imp__ZwDeleteObjectAuditAlarm@12
__imp__ZwDeleteValueKey@8
__imp__ZwDeviceIoControlFile@40
__imp__ZwDisplayString@4
__imp__ZwDuplicateObject@28
__imp__ZwDuplicateToken@24
__imp__ZwEnumerateBootEntries@8
__imp__ZwEnumerateKey@24
__imp__ZwEnumerateSystemEnvironmentValuesEx@12
__imp__ZwEnumerateValueKey@24
__imp__ZwExtendSection@8
__imp__ZwFilterToken@24
__imp__ZwFindAtom@12
__imp__ZwFlushBuffersFile@8
__imp__ZwFlushInstructionCache@12
__imp__ZwFlushKey@4
__imp__ZwFlushVirtualMemory@16
__imp__ZwFlushWriteBuffer@0
__imp__ZwFreeUserPhysicalPages@12
__imp__ZwFreeVirtualMemory@16
__imp__ZwFsControlFile@40
__imp__ZwGetContextThread@8
__imp__ZwGetDevicePowerState@8
__imp__ZwGetPlugPlayEvent@16
__imp__ZwGetWriteWatch@28
__imp__ZwImpersonateAnonymousToken@4
__imp__ZwImpersonateClientOfPort@8
__imp__ZwImpersonateThread@12
__imp__ZwInitializeRegistry@4
__imp__ZwInitiatePowerAction@16
__imp__ZwIsProcessInJob@8
__imp__ZwIsSystemResumeAutomatic@0
__imp__ZwListenPort@8
__imp__ZwLoadDriver@4
__imp__ZwLoadKey2@12
__imp__ZwLoadKey@8
__imp__ZwLockFile@40
__imp__ZwLockProductActivationKeys@8
__imp__ZwLockRegistryKey@4
__imp__ZwLockVirtualMemory@16
__imp__ZwMakePermanentObject@4
__imp__ZwMakeTemporaryObject@4
__imp__ZwMapUserPhysicalPages@12
__imp__ZwMapUserPhysicalPagesScatter@12
__imp__ZwMapViewOfSection@40
__imp__ZwModifyBootEntry@4
__imp__ZwNotifyChangeDirectoryFile@36
__imp__ZwNotifyChangeKey@40
__imp__ZwNotifyChangeMultipleKeys@48
__imp__ZwOpenDirectoryObject@12
__imp__ZwOpenEvent@12
__imp__ZwOpenEventPair@12
__imp__ZwOpenFile@24
__imp__ZwOpenIoCompletion@12
__imp__ZwOpenJobObject@12
__imp__ZwOpenKey@12
__imp__ZwOpenKeyedEvent@12
__imp__ZwOpenMutant@12
__imp__ZwOpenObjectAuditAlarm@48
__imp__ZwOpenProcess@16
__imp__ZwOpenProcessToken@12
__imp__ZwOpenProcessTokenEx@16
__imp__ZwOpenSection@12
__imp__ZwOpenSemaphore@12
__imp__ZwOpenSymbolicLinkObject@12
__imp__ZwOpenThread@16
__imp__ZwOpenThreadToken@16
__imp__ZwOpenThreadTokenEx@20
__imp__ZwOpenTimer@12
__imp__ZwPlugPlayControl@12
__imp__ZwPowerInformation@20
__imp__ZwPrivilegeCheck@12
__imp__ZwPrivilegeObjectAuditAlarm@24
__imp__ZwPrivilegedServiceAuditAlarm@20
__imp__ZwProtectVirtualMemory@20
__imp__ZwPulseEvent@8
__imp__ZwQueryAttributesFile@8
__imp__ZwQueryBootEntryOrder@8
__imp__ZwQueryBootOptions@8
__imp__ZwQueryDebugFilterState@8
__imp__ZwQueryDefaultLocale@8
__imp__ZwQueryDefaultUILanguage@4
__imp__ZwQueryDirectoryFile@44
__imp__ZwQueryDirectoryObject@28
__imp__ZwQueryEaFile@36
__imp__ZwQueryEvent@20
__imp__ZwQueryFullAttributesFile@8
__imp__ZwQueryInformationAtom@20
__imp__ZwQueryInformationFile@20
__imp__ZwQueryInformationJobObject@20
__imp__ZwQueryInformationPort@20
__imp__ZwQueryInformationProcess@20
__imp__ZwQueryInformationThread@20
__imp__ZwQueryInformationToken@20
__imp__ZwQueryInstallUILanguage@4
__imp__ZwQueryIntervalProfile@8
__imp__ZwQueryIoCompletion@20
__imp__ZwQueryKey@20
__imp__ZwQueryMultipleValueKey@24
__imp__ZwQueryMutant@20
__imp__ZwQueryObject@20
__imp__ZwQueryOpenSubKeys@8
__imp__ZwQueryPerformanceCounter@8
__imp__ZwQueryPortInformationProcess@0
__imp__ZwQueryQuotaInformationFile@36
__imp__ZwQuerySection@20
__imp__ZwQuerySecurityObject@20
__imp__ZwQuerySemaphore@20
__imp__ZwQuerySymbolicLinkObject@12
__imp__ZwQuerySystemEnvironmentValue@16
__imp__ZwQuerySystemEnvironmentValueEx@20
__imp__ZwQuerySystemInformation@16
__imp__ZwQuerySystemTime@4
__imp__ZwQueryTimer@20
__imp__ZwQueryTimerResolution@12
__imp__ZwQueryValueKey@24
__imp__ZwQueryVirtualMemory@24
__imp__ZwQueryVolumeInformationFile@20
__imp__ZwQueueApcThread@20
__imp__ZwRaiseException@12
__imp__ZwRaiseHardError@24
__imp__ZwReadFile@36
__imp__ZwReadFileScatter@36
__imp__ZwReadRequestData@24
__imp__ZwReadVirtualMemory@20
__imp__ZwRegisterThreadTerminatePort@4
__imp__ZwReleaseKeyedEvent@16
__imp__ZwReleaseMutant@8
__imp__ZwReleaseSemaphore@12
__imp__ZwRemoveIoCompletion@20
__imp__ZwRemoveProcessDebug@8
__imp__ZwRenameKey@8
__imp__ZwReplaceKey@12
__imp__ZwReplyPort@8
__imp__ZwReplyWaitReceivePort@16
__imp__ZwReplyWaitReceivePortEx@20
__imp__ZwReplyWaitReplyPort@8
__imp__ZwRequestDeviceWakeup@4
__imp__ZwRequestPort@8
__imp__ZwRequestWaitReplyPort@12
__imp__ZwRequestWakeupLatency@4
__imp__ZwResetEvent@8
__imp__ZwResetWriteWatch@12
__imp__ZwRestoreKey@12
__imp__ZwResumeProcess@4
__imp__ZwResumeThread@8
__imp__ZwSaveKey@8
__imp__ZwSaveKeyEx@12
__imp__ZwSaveMergedKeys@12
__imp__ZwSecureConnectPort@36
__imp__ZwSetBootEntryOrder@8
__imp__ZwSetBootOptions@8
__imp__ZwSetContextThread@8
__imp__ZwSetDebugFilterState@12
__imp__ZwSetDefaultHardErrorPort@4
__imp__ZwSetDefaultLocale@8
__imp__ZwSetDefaultUILanguage@4
__imp__ZwSetEaFile@16
__imp__ZwSetEvent@8
__imp__ZwSetEventBoostPriority@4
__imp__ZwSetHighEventPair@4
__imp__ZwSetHighWaitLowEventPair@4
__imp__ZwSetInformationDebugObject@20
__imp__ZwSetInformationFile@20
__imp__ZwSetInformationJobObject@16
__imp__ZwSetInformationKey@16
__imp__ZwSetInformationObject@16
__imp__ZwSetInformationProcess@16
__imp__ZwSetInformationThread@16
__imp__ZwSetInformationToken@16
__imp__ZwSetIntervalProfile@8
__imp__ZwSetIoCompletion@20
__imp__ZwSetLdtEntries@24
__imp__ZwSetLowEventPair@4
__imp__ZwSetLowWaitHighEventPair@4
__imp__ZwSetQuotaInformationFile@16
__imp__ZwSetSecurityObject@12
__imp__ZwSetSystemEnvironmentValue@8
__imp__ZwSetSystemEnvironmentValueEx@20
__imp__ZwSetSystemInformation@12
__imp__ZwSetSystemPowerState@12
__imp__ZwSetSystemTime@8
__imp__ZwSetThreadExecutionState@8
__imp__ZwSetTimer@28
__imp__ZwSetTimerResolution@12
__imp__ZwSetUuidSeed@4
__imp__ZwSetValueKey@24
__imp__ZwSetVolumeInformationFile@20
__imp__ZwShutdownSystem@4
__imp__ZwSignalAndWaitForSingleObject@16
__imp__ZwStartProfile@4
__imp__ZwStopProfile@4
__imp__ZwSuspendProcess@4
__imp__ZwSuspendThread@8
__imp__ZwSystemDebugControl@24
__imp__ZwTerminateJobObject@8
__imp__ZwTerminateProcess@8
__imp__ZwTerminateThread@8
__imp__ZwTestAlert@0
__imp__ZwTraceEvent@16
__imp__ZwTranslateFilePath@16
__imp__ZwUnloadDriver@4
__imp__ZwUnloadKey@4
__imp__ZwUnloadKeyEx@8
__imp__ZwUnlockFile@20
__imp__ZwUnlockVirtualMemory@16
__imp__ZwUnmapViewOfSection@8
__imp__ZwVdmControl@8
__imp__ZwWaitForDebugEvent@16
__imp__ZwWaitForKeyedEvent@16
__imp__ZwWaitForMultipleObjects@20
__imp__ZwWaitForSingleObject@12
__imp__ZwWaitHighEventPair@4
__imp__ZwWaitLowEventPair@4
__imp__ZwWriteFile@36
__imp__ZwWriteFileGather@36
__imp__ZwWriteRequestData@24
__imp__ZwWriteVirtualMemory@20
__imp__ZwYieldExecution@0
__imp___CIcos
__imp___CIlog
__imp___CIpow
__imp___CIsin
__imp___CIsqrt
__imp____isascii
__imp____iscsym
__imp____iscsymf
__imp____toascii
__imp___alldiv
__imp___alldvrm
__imp___allmul
__imp___alloca_probe
__imp___allrem
__imp___allshl
__imp___allshr
__imp___atoi64
__imp___aulldiv
__imp___aulldvrm
__imp___aullrem
__imp___aullshr
__imp___chkstk
__imp___fltused
__imp___ftol
__imp___i64toa
__imp___i64tow
__imp___itoa
__imp___itow
__imp___lfind
__imp___ltoa
__imp___ltow
__imp___memccpy
__imp___memicmp
__imp___snprintf
__imp___snwprintf
__imp___splitpath
__imp___strcmpi
__imp___stricmp
__imp___strlwr
__imp___strnicmp
__imp___strupr
__imp___tolower
__imp___toupper
__imp___ui64toa
__imp___ui64tow
__imp___ultoa
__imp___ultow
__imp___vsnprintf
__imp___vsnwprintf
__imp___wcsicmp
__imp___wcslwr
__imp___wcsnicmp
__imp___wcsupr
__imp___wtoi
__imp___wtoi64
__imp___wtol
__imp__abs
__imp__atan
__imp__atoi
__imp__atol
__imp__bsearch
__imp__ceil
__imp__cos
__imp__fabs
__imp__floor
__imp__isalnum
__imp__isalpha
__imp__iscntrl
__imp__isdigit
__imp__isgraph
__imp__islower
__imp__isprint
__imp__ispunct
__imp__isspace
__imp__isupper
__imp__iswalpha
__imp__iswctype
__imp__iswdigit
__imp__iswlower
__imp__iswspace
__imp__iswxdigit
__imp__isxdigit
__imp__labs
__imp__log
__imp__mbstowcs
__imp__memchr
__imp__memcmp
__imp__memcpy
__imp__memmove
__imp__memset
__imp__pow
__imp__qsort
__imp__sin
__imp__sprintf
__imp__sqrt
__imp__sscanf
__imp__strcat
__imp__strchr
__imp__strcmp
__imp__strcpy
__imp__strcspn
__imp__strlen
__imp__strncat
__imp__strncmp
__imp__strncpy
__imp__strpbrk
__imp__strrchr
__imp__strspn
__imp__strstr
__imp__strtol
__imp__strtoul
__imp__swprintf
__imp__tan
__imp__tolower
__imp__toupper
__imp__towlower
__imp__towupper
__imp__vDbgPrintEx@16
__imp__vDbgPrintExWithPrefix@20
__imp__vsprintf
__imp__wcscat
__imp__wcschr
__imp__wcscmp
__imp__wcscpy
__imp__wcscspn
__imp__wcslen
__imp__wcsncat
__imp__wcsncmp
__imp__wcsncpy
__imp__wcspbrk
__imp__wcsrchr
__imp__wcsspn
__imp__wcsstr
__imp__wcstol
__imp__wcstombs
__imp__wcstoul
__itoa
__itow
__lfind
__load_config_used
__local_unwind2
__longjmpex
__ltoa
__ltow
__memccpy
__memicmp
__rt_probe_read4@4
__seh_longjmp_unwind@4
__setjmp
__setjmp3
__setjmpexused
__snprintf
__snwprintf
__splitpath
__strcmpi
__stricmp
__strlwr
__strnicmp
__strupr
__tolower
__toupper
__ui64toa
__ui64tow
__ultoa
__ultow
__vsnprintf
__vsnwprintf
__wcsicmp
__wcslwr
__wcsnicmp
__wcsupr
__wtoi
__wtoi64
__wtol
_bsearch
_floor
_isalnum
_isalpha
_iscntrl
_isdigit
_isgraph
_islower
_isprint
_ispunct
_isspace
_isupper
_iswalpha
_iswctype
_iswdigit
_iswlower
_iswspace
_iswxdigit
_isxdigit
_longjmp
_mbstowcs
_memchr
_memcmp
_memcpy
_memmove
_memset
_qsort
_sprintf
_sscanf
_strcat
_strchr
_strcmp
_strcpy
_strcspn
_strlen
_strncat
_strncmp
_strncpy
_strpbrk
_strrchr
_strspn
_strstr
_strtol
_strtoul
_swprintf
_tolower
_toupper
_towlower
_towupper
_vDbgPrintEx@16
_vDbgPrintExWithPrefix@20
_vsprintf
_wcscat
_wcschr
_wcscmp
_wcscpy
_wcscspn
_wcslen
_wcsncat
_wcsncmp
_wcsncpy
_wcspbrk
_wcsrchr
_wcsspn
_wcsstr
_wcstol
_wcstombs
_wcstoul
ntdll_NULL_THUNK_DATA