https://github.com/kkent030315/kernel32-imports
import list of kernel32.dll in Win10 1909 18363.1139
https://github.com/kkent030315/kernel32-imports
Last synced: 7 months ago
JSON representation
import list of kernel32.dll in Win10 1909 18363.1139
- Host: GitHub
- URL: https://github.com/kkent030315/kernel32-imports
- Owner: kkent030315
- Created: 2020-11-03T09:12:17.000Z (almost 5 years ago)
- Default Branch: main
- Last Pushed: 2020-11-03T09:35:07.000Z (almost 5 years ago)
- Last Synced: 2025-02-28T22:18:21.046Z (7 months ago)
- Size: 32.2 KB
- Stars: 3
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# kernel32-imports
import list of kernel32.dll in Win10 1909 18363.1139
# Imports
This output is generated by [ida2md](https://github.com/kkent030315/ida2md)
|Address|Ordinal-Name|Library|
|----|----|----|
|180078F18|AccessCheck|api-ms-win-security-base-l1-1-0|
|180078A28|ActivateActCtx|api-ms-win-core-sidebyside-l1-1-0|
|180077750|AddConsoleAliasA|api-ms-win-core-console-l3-2-0|
|180077748|AddConsoleAliasW|api-ms-win-core-console-l3-2-0|
|180078A20|AddRefActCtx|api-ms-win-core-sidebyside-l1-1-0|
|180078F58|AddResourceAttributeAce|api-ms-win-security-base-l1-2-0|
|180078328|AddSIDToBoundaryDescriptor|api-ms-win-core-namespace-l1-1-0|
|180078F48|AddScopedPolicyIDAce|api-ms-win-security-base-l1-2-0|
|180077548|AllocConsole|api-ms-win-core-console-l1-1-0|
|180078F20|AllocateAndInitializeSid|api-ms-win-security-base-l1-1-0|
|180078280|AllocateUserPhysicalPages|api-ms-win-core-memory-l1-1-2|
|180078288|AllocateUserPhysicalPagesNuma|api-ms-win-core-memory-l1-1-2|
|180077258|AppContainerFreeMemory|KERNELBASE|
|180077260|AppContainerLookupMoniker|KERNELBASE|
|180077228|AppXGetOSMaxVersionTested|KERNELBASE|
|1800771D0|AppXPostSuccessExtension|KERNELBASE|
|1800771C8|AppXPreCreationExtension|KERNELBASE|
|1800771D8|AppXReleaseAppXContext|KERNELBASE|
|1800771E0|AreFileApisANSI|KERNELBASE|
|1800775A8|AttachConsole|api-ms-win-core-console-l1-2-0|
|180077460|BaseCheckAppcompatCache|api-ms-win-core-appcompat-l1-1-0|
|180077458|BaseCheckAppcompatCacheEx|api-ms-win-core-appcompat-l1-1-0|
|180077450|BaseCleanupAppcompatCacheSupport|api-ms-win-core-appcompat-l1-1-0|
|180077328|BaseDllFreeResourceId|KERNELBASE|
|180077330|BaseDllMapResourceIdW|KERNELBASE|
|180077440|BaseDumpAppcompatCache|api-ms-win-core-appcompat-l1-1-0|
|180077438|BaseFlushAppcompatCache|api-ms-win-core-appcompat-l1-1-0|
|180077168|BaseFormatObjectAttributes|KERNELBASE|
|180077480|BaseFreeAppCompatDataForProcess|api-ms-win-core-appcompat-l1-1-1|
|180077418|BaseGetNamedObjectDirectory|KERNELBASE|
|180077448|BaseInitAppcompatCacheSupport|api-ms-win-core-appcompat-l1-1-0|
|180077478|BaseReadAppCompatDataForProcess|api-ms-win-core-appcompat-l1-1-1|
|180077468|BaseUpdateAppcompatCache|api-ms-win-core-appcompat-l1-1-0|
|180077278|BasepAdjustObjectAttributesForPrivateNamespace|KERNELBASE|
|180077268|BasepNotifyTrackingService|KERNELBASE|
|180078DA8|Beep|api-ms-win-core-util-l1-1-0|
|180078318|CallNamedPipeW|api-ms-win-core-namedpipe-l1-2-2|
|180077DF8|CancelIo|api-ms-win-core-io-l1-1-1|
|180077DC8|CancelIoEx|api-ms-win-core-io-l1-1-0|
|180077DF0|CancelSynchronousIo|api-ms-win-core-io-l1-1-1|
|180078AC0|CancelWaitableTimer|api-ms-win-core-synch-l1-1-0|
|180078D10|ChangeTimerQueueTimer|api-ms-win-core-threadpool-legacy-l1-1-0|
|180077160|CheckAllowDecryptedRemoteDestinationPolicy|KERNELBASE|
|180077290|CheckGroupPolicyEnabled|KERNELBASE|
|180077218|CheckIsMSIXPackage|KERNELBASE|
|1800778C0|CheckRemoteDebuggerPresent|api-ms-win-core-debug-l1-1-1|
|180078F50|CheckTokenCapability|api-ms-win-security-base-l1-2-0|
|180078F70|CheckTokenMembershipEx|api-ms-win-security-base-l1-2-0|
|180077518|ClearCommBreak|api-ms-win-core-comm-l1-1-0|
|1800774D8|ClearCommError|api-ms-win-core-comm-l1-1-0|
|180077D18|CloseHandle|api-ms-win-core-handle-l1-1-0|
|180077220|ClosePackageInfo|KERNELBASE|
|180078338|ClosePrivateNamespace|api-ms-win-core-namespace-l1-1-0|
|1800775C8|ClosePseudoConsole|api-ms-win-core-console-l1-2-1|
|180077AD8|CompareFileTime|api-ms-win-core-file-l1-1-0|
|1800771B8|CompareStringA|KERNELBASE|
|180078A40|CompareStringEx|api-ms-win-core-string-l1-1-0|
|180078A70|CompareStringOrdinal|api-ms-win-core-string-l1-1-0|
|180078A78|CompareStringW|api-ms-win-core-string-l1-1-0|
|1800782F0|ConnectNamedPipe|api-ms-win-core-namedpipe-l1-1-0|
|1800778B8|ContinueDebugEvent|api-ms-win-core-debug-l1-1-1|
|180078038|ConvertDefaultLocale|api-ms-win-core-localization-l1-2-0|
|180077988|ConvertFiberToThread|api-ms-win-core-fibers-l2-1-0|
|180077980|ConvertThreadToFiber|api-ms-win-core-fibers-l2-1-0|
|180077998|ConvertThreadToFiberEx|api-ms-win-core-fibers-l2-1-1|
|180078EA0|CopyContext|api-ms-win-core-xstate-l2-1-0|
|180077CA0|CopyFile2|api-ms-win-core-file-l2-1-0|
|180077C78|CopyFileExW|api-ms-win-core-file-l2-1-0|
|180077CE0|CopyFileW|api-ms-win-core-file-l2-1-2|
|180078A10|CreateActCtxW|api-ms-win-core-sidebyside-l1-1-0|
|180078330|CreateBoundaryDescriptorW|api-ms-win-core-namespace-l1-1-0|
|180077638|CreateConsoleScreenBuffer|api-ms-win-core-console-l2-1-0|
|180077AD0|CreateDirectoryA|api-ms-win-core-file-l1-1-0|
|180077CB0|CreateDirectoryExW|api-ms-win-core-file-l2-1-0|
|180077AC8|CreateDirectoryW|api-ms-win-core-file-l1-1-0|
|180078AC8|CreateEventA|api-ms-win-core-synch-l1-1-0|
|180078B18|CreateEventExA|api-ms-win-core-synch-l1-1-0|
|180078B20|CreateEventExW|api-ms-win-core-synch-l1-1-0|
|180078B28|CreateEventW|api-ms-win-core-synch-l1-1-0|
|180077978|CreateFiber|api-ms-win-core-fibers-l2-1-0|
|1800779A0|CreateFiberEx|api-ms-win-core-fibers-l2-1-1|
|180077BF8|CreateFile2|api-ms-win-core-file-l1-2-0|
|180077AB0|CreateFileA|api-ms-win-core-file-l1-1-0|
|180078250|CreateFileMappingNumaW|api-ms-win-core-memory-l1-1-1|
|180078180|CreateFileMappingW|api-ms-win-core-memory-l1-1-0|
|180077A98|CreateFileW|api-ms-win-core-file-l1-1-0|
|180077CD8|CreateHardLinkA|api-ms-win-core-file-l2-1-2|
|180077C90|CreateHardLinkW|api-ms-win-core-file-l2-1-0|
|180077DC0|CreateIoCompletionPort|api-ms-win-core-io-l1-1-0|
|180078248|CreateMemoryResourceNotification|api-ms-win-core-memory-l1-1-1|
|180078B30|CreateMutexA|api-ms-win-core-synch-l1-1-0|
|180078B38|CreateMutexExA|api-ms-win-core-synch-l1-1-0|
|180078B40|CreateMutexExW|api-ms-win-core-synch-l1-1-0|
|180078B48|CreateMutexW|api-ms-win-core-synch-l1-1-0|
|1800782E8|CreateNamedPipeW|api-ms-win-core-namedpipe-l1-1-0|
|1800782D8|CreatePipe|api-ms-win-core-namedpipe-l1-1-0|
|180078348|CreatePrivateNamespaceW|api-ms-win-core-namespace-l1-1-0|
|1800785A8|CreateProcessA|api-ms-win-core-processthreads-l1-1-0|
|180077248|CreateProcessAsUserA|KERNELBASE|
|1800771F8|CreateProcessAsUserW|KERNELBASE|
|1800771E8|CreateProcessInternalA|KERNELBASE|
|1800771F0|CreateProcessInternalW|KERNELBASE|
|1800785A0|CreateProcessW|api-ms-win-core-processthreads-l1-1-0|
|1800775D0|CreatePseudoConsole|api-ms-win-core-console-l1-2-1|
|180078590|CreateRemoteThread|api-ms-win-core-processthreads-l1-1-0|
|180078598|CreateRemoteThreadEx|api-ms-win-core-processthreads-l1-1-0|
|180078B50|CreateSemaphoreExW|api-ms-win-core-synch-l1-1-0|
|180078BC0|CreateSemaphoreW|api-ms-win-core-synch-l1-2-1|
|180077C88|CreateSymbolicLinkW|api-ms-win-core-file-l2-1-0|
|180078D18|CreateTimerQueue|api-ms-win-core-threadpool-legacy-l1-1-0|
|180078D38|CreateTimerQueueTimer|api-ms-win-core-threadpool-legacy-l1-1-0|
|180078B60|CreateWaitableTimerExW|api-ms-win-core-synch-l1-1-0|
|1800792D8|CsrAllocateCaptureBuffer|ntdll|
|1800792D0|CsrAllocateMessagePointer|ntdll|
|180079968|CsrCaptureMessageMultiUnicodeStringsInPlace|ntdll|
|180079718|CsrCaptureMessageString|ntdll|
|180079518|CsrClientCallServer|ntdll|
|1800792C8|CsrFreeCaptureBuffer|ntdll|
|180079588|CsrVerifyRegion|ntdll|
|180079A00|DbgPrint|ntdll|
|1800791B0|DbgPrintEx|ntdll|
|1800794E0|DbgUiGetThreadDebugObject|ntdll|
|1800794E8|DbgUiIssueRemoteBreakin|ntdll|
|180078A08|DeactivateActCtx|api-ms-win-core-sidebyside-l1-1-0|
|1800778A8|DebugActiveProcess|api-ms-win-core-debug-l1-1-1|
|1800778C8|DebugActiveProcessStop|api-ms-win-core-debug-l1-1-1|
|180077898|DebugBreak|api-ms-win-core-debug-l1-1-0|
|180077A40|DefineDosDeviceW|api-ms-win-core-file-l1-1-0|
|1800778D8|DelayLoadFailureHook|api-ms-win-core-delayload-l1-1-0|
|180078340|DeleteBoundaryDescriptor|api-ms-win-core-namespace-l1-1-0|
|180078B10|DeleteCriticalSection|api-ms-win-core-synch-l1-1-0|
|180077970|DeleteFiber|api-ms-win-core-fibers-l2-1-0|
|180077A38|DeleteFileA|api-ms-win-core-file-l1-1-0|
|180077A30|DeleteFileW|api-ms-win-core-file-l1-1-0|
|180078578|DeleteProcThreadAttributeList|api-ms-win-core-processthreads-l1-1-0|
|180078B90|DeleteSynchronizationBarrier|api-ms-win-core-synch-l1-2-0|
|180078D20|DeleteTimerQueueEx|api-ms-win-core-threadpool-legacy-l1-1-0|
|180078D08|DeleteTimerQueueTimer|api-ms-win-core-threadpool-legacy-l1-1-0|
|180077A28|DeleteVolumeMountPointW|api-ms-win-core-file-l1-1-0|
|180077DB8|DeviceIoControl|api-ms-win-core-io-l1-1-0|
|180077EB8|DisableThreadLibraryCalls|api-ms-win-core-libraryloader-l1-2-0|
|1800782D0|DisconnectNamedPipe|api-ms-win-core-namedpipe-l1-1-0|
|180078CB0|DnsHostnameToComputerNameExW|api-ms-win-core-sysinfo-l1-2-1|
|180077D10|DuplicateHandle|api-ms-win-core-handle-l1-1-0|
|180078F38|DuplicateToken|api-ms-win-security-base-l1-1-0|
|180078B00|EnterCriticalSection|api-ms-win-core-synch-l1-1-0|
|180078BA0|EnterSynchronizationBarrier|api-ms-win-core-synch-l1-2-0|
|1800780F8|EnumCalendarInfoExEx|api-ms-win-core-localization-l2-1-0|
|180078120|EnumCalendarInfoExW|api-ms-win-core-localization-l2-1-0|
|180078128|EnumCalendarInfoW|api-ms-win-core-localization-l2-1-0|
|1800780F0|EnumDateFormatsExEx|api-ms-win-core-localization-l2-1-0|
|180078130|EnumDateFormatsExW|api-ms-win-core-localization-l2-1-0|
|180078138|EnumDateFormatsW|api-ms-win-core-localization-l2-1-0|
|180077250|EnumLanguageGroupLocalesW|KERNELBASE|
|180077EA8|EnumResourceLanguagesExA|api-ms-win-core-libraryloader-l1-2-0|
|180077EA0|EnumResourceLanguagesExW|api-ms-win-core-libraryloader-l1-2-0|
|180077E98|EnumResourceNamesExA|api-ms-win-core-libraryloader-l1-2-0|
|180077EC0|EnumResourceNamesExW|api-ms-win-core-libraryloader-l1-2-0|
|180077F10|EnumResourceNamesW|api-ms-win-core-libraryloader-l1-2-2|
|180077E90|EnumResourceTypesExA|api-ms-win-core-libraryloader-l1-2-0|
|180077E88|EnumResourceTypesExW|api-ms-win-core-libraryloader-l1-2-0|
|180078108|EnumSystemCodePagesW|api-ms-win-core-localization-l2-1-0|
|180078C78|EnumSystemFirmwareTables|api-ms-win-core-sysinfo-l1-2-0|
|180077338|EnumSystemLanguageGroupsW|KERNELBASE|
|180078088|EnumSystemLocalesA|api-ms-win-core-localization-l1-2-0|
|180077428|EnumSystemLocalesEx|KERNELBASE|
|180078090|EnumSystemLocalesW|api-ms-win-core-localization-l1-2-0|
|1800780E8|EnumTimeFormatsEx|api-ms-win-core-localization-l2-1-0|
|180078110|EnumTimeFormatsW|api-ms-win-core-localization-l2-1-0|
|180077420|EnumUILanguagesW|KERNELBASE|
|180078F28|EqualSid|api-ms-win-security-base-l1-1-0|
|1800774D0|EscapeCommFunction|api-ms-win-core-comm-l1-1-0|
|180078FB0|EtwEventEnabled|ntdll|
|180079108|EtwEventRegister|ntdll|
|1800790F8|EtwEventUnregister|ntdll|
|180079100|EtwEventWrite|ntdll|
|180079348|EtwEventWriteNoRegistration|ntdll|
|180078EE0|EventRegister|api-ms-win-eventing-provider-l1-1-0|
|180078EF0|EventSetInformation|api-ms-win-eventing-provider-l1-1-0|
|180078EE8|EventUnregister|api-ms-win-eventing-provider-l1-1-0|
|180078EF8|EventWriteTransfer|api-ms-win-eventing-provider-l1-1-0|
|180078390|ExpandEnvironmentStringsA|api-ms-win-core-processenvironment-l1-1-0|
|180078398|ExpandEnvironmentStringsW|api-ms-win-core-processenvironment-l1-1-0|
|180077740|ExpungeConsoleCommandHistoryA|api-ms-win-core-console-l3-2-0|
|180077738|ExpungeConsoleCommandHistoryW|api-ms-win-core-console-l3-2-0|
|180077378|FatalAppExitA|KERNELBASE|
|180077370|FatalAppExitW|KERNELBASE|
|180077A20|FileTimeToLocalFileTime|api-ms-win-core-file-l1-1-0|
|180078D70|FileTimeToSystemTime|api-ms-win-core-timezone-l1-1-0|
|180077630|FillConsoleOutputAttribute|api-ms-win-core-console-l2-1-0|
|180077628|FillConsoleOutputCharacterA|api-ms-win-core-console-l2-1-0|
|180077620|FillConsoleOutputCharacterW|api-ms-win-core-console-l2-1-0|
|180078A00|FindActCtxSectionGuid|api-ms-win-core-sidebyside-l1-1-0|
|1800789F8|FindActCtxSectionStringW|api-ms-win-core-sidebyside-l1-1-0|
|180077A18|FindClose|api-ms-win-core-file-l1-1-0|
|180077A10|FindCloseChangeNotification|api-ms-win-core-file-l1-1-0|
|180077A80|FindFirstChangeNotificationA|api-ms-win-core-file-l1-1-0|
|180077A00|FindFirstChangeNotificationW|api-ms-win-core-file-l1-1-0|
|1800779F8|FindFirstFileA|api-ms-win-core-file-l1-1-0|
|1800779F0|FindFirstFileExA|api-ms-win-core-file-l1-1-0|
|1800779E8|FindFirstFileExW|api-ms-win-core-file-l1-1-0|
|180077C50|FindFirstFileNameW|api-ms-win-core-file-l1-2-2|
|1800779D8|FindFirstFileW|api-ms-win-core-file-l1-1-0|
|180077C58|FindFirstStreamW|api-ms-win-core-file-l1-2-2|
|1800779D0|FindFirstVolumeW|api-ms-win-core-file-l1-1-0|
|180078098|FindNLSString|api-ms-win-core-localization-l1-2-0|
|180078028|FindNLSStringEx|api-ms-win-core-localization-l1-2-0|
|1800779C8|FindNextChangeNotification|api-ms-win-core-file-l1-1-0|
|1800779C0|FindNextFileA|api-ms-win-core-file-l1-1-0|
|180077C48|FindNextFileNameW|api-ms-win-core-file-l1-2-2|
|1800779B0|FindNextFileW|api-ms-win-core-file-l1-1-0|
|180077A08|FindNextVolumeW|api-ms-win-core-file-l1-1-0|
|180077EC8|FindResourceExW|api-ms-win-core-libraryloader-l1-2-0|
|180077EF8|FindResourceW|api-ms-win-core-libraryloader-l1-2-1|
|180077E50|FindStringOrdinal|api-ms-win-core-libraryloader-l1-2-0|
|180077A58|FindVolumeClose|api-ms-win-core-file-l1-1-0|
|180077948|FlsAlloc|api-ms-win-core-fibers-l1-1-0|
|180077940|FlsFree|api-ms-win-core-fibers-l1-1-0|
|180077958|FlsGetValue|api-ms-win-core-fibers-l1-1-0|
|180077950|FlsSetValue|api-ms-win-core-fibers-l1-1-0|
|1800775F8|FlushConsoleInputBuffer|api-ms-win-core-console-l2-1-0|
|180077A68|FlushFileBuffers|api-ms-win-core-file-l1-1-0|
|180078600|FlushInstructionCache|api-ms-win-core-processthreads-l1-1-1|
|180078198|FlushViewOfFile|api-ms-win-core-memory-l1-1-0|
|180078A68|FoldStringW|api-ms-win-core-string-l1-1-0|
|1800780A0|FormatMessageA|api-ms-win-core-localization-l1-2-0|
|1800780A8|FormatMessageW|api-ms-win-core-localization-l1-2-0|
|180077598|FreeConsole|api-ms-win-core-console-l1-2-0|
|180078430|FreeEnvironmentStringsA|api-ms-win-core-processenvironment-l1-1-0|
|180078428|FreeEnvironmentStringsW|api-ms-win-core-processenvironment-l1-1-0|
|180077E80|FreeLibrary|api-ms-win-core-libraryloader-l1-2-0|
|180077E48|FreeLibraryAndExitThread|api-ms-win-core-libraryloader-l1-2-0|
|180077E40|FreeResource|api-ms-win-core-libraryloader-l1-2-0|
|180078F30|FreeSid|api-ms-win-security-base-l1-1-0|
|180078290|FreeUserPhysicalPages|api-ms-win-core-memory-l1-1-2|
|1800776C0|GenerateConsoleCtrlEvent|api-ms-win-core-console-l2-1-0|
|1800780B0|GetACP|api-ms-win-core-localization-l1-2-0|
|180078F78|GetAppContainerAce|api-ms-win-security-base-l1-2-0|
|180078F08|GetAppContainerNamedObjectPath|api-ms-win-security-appcontainer-l1-1-0|
|180078DD0|GetApplicationRecoveryCallback|api-ms-win-core-windowserrorreporting-l1-1-0|
|180078DC0|GetApplicationRestartSettings|api-ms-win-core-windowserrorreporting-l1-1-0|
|1800780B8|GetCPInfo|api-ms-win-core-localization-l1-2-0|
|1800780C0|GetCPInfoExW|api-ms-win-core-localization-l1-2-0|
|180078F68|GetCachedSigningLevel|api-ms-win-security-base-l1-2-0|
|180077320|GetCalendar|KERNELBASE|
|180078078|GetCalendarInfoEx|api-ms-win-core-localization-l1-2-0|
|180078080|GetCalendarInfoW|api-ms-win-core-localization-l1-2-0|
|1800774C8|GetCommConfig|api-ms-win-core-comm-l1-1-0|
|1800774C0|GetCommMask|api-ms-win-core-comm-l1-1-0|
|1800774B8|GetCommModemStatus|api-ms-win-core-comm-l1-1-0|
|1800774E0|GetCommProperties|api-ms-win-core-comm-l1-1-0|
|180077508|GetCommState|api-ms-win-core-comm-l1-1-0|
|180077500|GetCommTimeouts|api-ms-win-core-comm-l1-1-0|
|180078420|GetCommandLineA|api-ms-win-core-processenvironment-l1-1-0|
|1800783D0|GetCommandLineW|api-ms-win-core-processenvironment-l1-1-0|
|180077C18|GetCompressedFileSizeA|api-ms-win-core-file-l1-2-1|
|180077C10|GetCompressedFileSizeW|api-ms-win-core-file-l1-2-1|
|180078C40|GetComputerNameExA|api-ms-win-core-sysinfo-l1-1-0|
|180078C28|GetComputerNameExW|api-ms-win-core-sysinfo-l1-1-0|
|180077758|GetConsoleAliasA|api-ms-win-core-console-l3-2-0|
|180077728|GetConsoleAliasExesA|api-ms-win-core-console-l3-2-0|
|180077730|GetConsoleAliasExesLengthA|api-ms-win-core-console-l3-2-0|
|180077760|GetConsoleAliasExesLengthW|api-ms-win-core-console-l3-2-0|
|180077768|GetConsoleAliasExesW|api-ms-win-core-console-l3-2-0|
|180077770|GetConsoleAliasW|api-ms-win-core-console-l3-2-0|
|180077778|GetConsoleAliasesA|api-ms-win-core-console-l3-2-0|
|180077780|GetConsoleAliasesLengthA|api-ms-win-core-console-l3-2-0|
|180077788|GetConsoleAliasesLengthW|api-ms-win-core-console-l3-2-0|
|180077820|GetConsoleAliasesW|api-ms-win-core-console-l3-2-0|
|180077528|GetConsoleCP|api-ms-win-core-console-l1-1-0|
|180077818|GetConsoleCommandHistoryA|api-ms-win-core-console-l3-2-0|
|180077810|GetConsoleCommandHistoryLengthA|api-ms-win-core-console-l3-2-0|
|180077808|GetConsoleCommandHistoryLengthW|api-ms-win-core-console-l3-2-0|
|180077800|GetConsoleCommandHistoryW|api-ms-win-core-console-l3-2-0|
|1800775E0|GetConsoleCursorInfo|api-ms-win-core-console-l2-1-0|
|1800777F8|GetConsoleDisplayMode|api-ms-win-core-console-l3-2-0|
|1800777F0|GetConsoleFontSize|api-ms-win-core-console-l3-2-0|
|1800777E8|GetConsoleHistoryInfo|api-ms-win-core-console-l3-2-0|
|180077530|GetConsoleMode|api-ms-win-core-console-l1-1-0|
|180077708|GetConsoleOriginalTitleA|api-ms-win-core-console-l2-2-0|
|180077700|GetConsoleOriginalTitleW|api-ms-win-core-console-l2-2-0|
|180077538|GetConsoleOutputCP|api-ms-win-core-console-l1-1-0|
|1800777E0|GetConsoleProcessList|api-ms-win-core-console-l3-2-0|
|180077600|GetConsoleScreenBufferInfo|api-ms-win-core-console-l2-1-0|
|180077608|GetConsoleScreenBufferInfoEx|api-ms-win-core-console-l2-1-0|
|1800777D8|GetConsoleSelectionInfo|api-ms-win-core-console-l3-2-0|
|1800776F8|GetConsoleTitleA|api-ms-win-core-console-l2-2-0|
|180077710|GetConsoleTitleW|api-ms-win-core-console-l2-2-0|
|1800777D0|GetConsoleWindow|api-ms-win-core-console-l3-2-0|
|180078118|GetCurrencyFormatEx|api-ms-win-core-localization-l2-1-0|
|1800789F0|GetCurrentActCtx|api-ms-win-core-sidebyside-l1-1-0|
|1800777C8|GetCurrentConsoleFont|api-ms-win-core-console-l3-2-0|
|1800777C0|GetCurrentConsoleFontEx|api-ms-win-core-console-l3-2-0|
|1800783C8|GetCurrentDirectoryA|api-ms-win-core-processenvironment-l1-1-0|
|1800783C0|GetCurrentDirectoryW|api-ms-win-core-processenvironment-l1-1-0|
|180077210|GetCurrentPackageFullName|KERNELBASE|
|1800785D8|GetCurrentProcess|api-ms-win-core-processthreads-l1-1-0|
|1800785E0|GetCurrentProcessId|api-ms-win-core-processthreads-l1-1-0|
|180077848|GetDateFormatA|api-ms-win-core-datetime-l1-1-0|
|180077860|GetDateFormatEx|api-ms-win-core-datetime-l1-1-1|
|180077830|GetDateFormatW|api-ms-win-core-datetime-l1-1-0|
|180077A88|GetDiskFreeSpaceA|api-ms-win-core-file-l1-1-0|
|180077A48|GetDiskFreeSpaceExA|api-ms-win-core-file-l1-1-0|
|180077A50|GetDiskFreeSpaceExW|api-ms-win-core-file-l1-1-0|
|180077A60|GetDiskFreeSpaceW|api-ms-win-core-file-l1-1-0|
|180077A70|GetDriveTypeA|api-ms-win-core-file-l1-1-0|
|180077A78|GetDriveTypeW|api-ms-win-core-file-l1-1-0|
|180077870|GetDurationFormatEx|api-ms-win-core-datetime-l1-1-2|
|180078D78|GetDynamicTimeZoneInformation|api-ms-win-core-timezone-l1-1-0|
|180077280|GetEightBitStringToUnicodeStringRoutine|KERNELBASE|
|180078E98|GetEnabledXStateFeatures|api-ms-win-core-xstate-l2-1-0|
|1800783E8|GetEnvironmentStrings|api-ms-win-core-processenvironment-l1-1-0|
|1800783B8|GetEnvironmentStringsW|api-ms-win-core-processenvironment-l1-1-0|
|1800783A8|GetEnvironmentVariableA|api-ms-win-core-processenvironment-l1-1-0|
|1800783B0|GetEnvironmentVariableW|api-ms-win-core-processenvironment-l1-1-0|
|180077368|GetEraNameCountedString|KERNELBASE|
|180077918|GetErrorMode|api-ms-win-core-errorhandling-l1-1-0|
|1800785D0|GetExitCodeProcess|api-ms-win-core-processthreads-l1-1-0|
|180078528|GetExitCodeThread|api-ms-win-core-processthreads-l1-1-0|
|180077AA0|GetFileAttributesA|api-ms-win-core-file-l1-1-0|
|180077AB8|GetFileAttributesExA|api-ms-win-core-file-l1-1-0|
|180077B70|GetFileAttributesExW|api-ms-win-core-file-l1-1-0|
|180077BE0|GetFileAttributesW|api-ms-win-core-file-l1-1-0|
|180077AE0|GetFileInformationByHandle|api-ms-win-core-file-l1-1-0|
|180077CA8|GetFileInformationByHandleEx|api-ms-win-core-file-l2-1-0|
|180078020|GetFileMUIInfo|api-ms-win-core-localization-l1-2-0|
|180078018|GetFileMUIPath|api-ms-win-core-localization-l1-2-0|
|180077AE8|GetFileSize|api-ms-win-core-file-l1-1-0|
|180077AF0|GetFileSizeEx|api-ms-win-core-file-l1-1-0|
|180077AF8|GetFileTime|api-ms-win-core-file-l1-1-0|
|180077B00|GetFileType|api-ms-win-core-file-l1-1-0|
|180077B08|GetFinalPathNameByHandleA|api-ms-win-core-file-l1-1-0|
|180077B10|GetFinalPathNameByHandleW|api-ms-win-core-file-l1-1-0|
|180077B18|GetFullPathNameA|api-ms-win-core-file-l1-1-0|
|180077B20|GetFullPathNameW|api-ms-win-core-file-l1-1-0|
|180077D00|GetHandleInformation|api-ms-win-core-handle-l1-1-0|
|180078240|GetLargePageMinimum|api-ms-win-core-memory-l1-1-1|
|180077640|GetLargestConsoleWindowSize|api-ms-win-core-console-l2-1-0|
|180077900|GetLastError|api-ms-win-core-errorhandling-l1-1-0|
|180078C20|GetLocalTime|api-ms-win-core-sysinfo-l1-1-0|
|180078068|GetLocaleInfoA|api-ms-win-core-localization-l1-2-0|
|180078010|GetLocaleInfoEx|api-ms-win-core-localization-l1-2-0|
|180077318|GetLocaleInfoHelper|KERNELBASE|
|180078060|GetLocaleInfoW|api-ms-win-core-localization-l1-2-0|
|180077B28|GetLogicalDriveStringsW|api-ms-win-core-file-l1-1-0|
|180078C00|GetLogicalProcessorInformation|api-ms-win-core-sysinfo-l1-1-0|
|180078C30|GetLogicalProcessorInformationEx|api-ms-win-core-sysinfo-l1-1-0|
|180078278|GetMemoryErrorHandlingCapabilities|api-ms-win-core-memory-l1-1-2|
|180077E38|GetModuleFileNameA|api-ms-win-core-libraryloader-l1-2-0|
|180077E58|GetModuleFileNameW|api-ms-win-core-libraryloader-l1-2-0|
|180077E28|GetModuleHandleA|api-ms-win-core-libraryloader-l1-2-0|
|180077E30|GetModuleHandleExA|api-ms-win-core-libraryloader-l1-2-0|
|180077E68|GetModuleHandleExW|api-ms-win-core-libraryloader-l1-2-0|
|180077E60|GetModuleHandleW|api-ms-win-core-libraryloader-l1-2-0|
|1800780C8|GetNLSVersion|api-ms-win-core-localization-l1-2-0|
|180078008|GetNLSVersionEx|api-ms-win-core-localization-l1-2-0|
|180077308|GetNamedLocaleHashNode|KERNELBASE|
|1800771C0|GetNamedPipeAttribute|KERNELBASE|
|1800782C8|GetNamedPipeClientComputerNameW|api-ms-win-core-namedpipe-l1-1-0|
|180078308|GetNamedPipeHandleStateW|api-ms-win-core-namedpipe-l1-2-1|
|180078C60|GetNativeSystemInfo|api-ms-win-core-sysinfo-l1-2-0|
|180078CE0|GetNumaHighestNodeNumber|api-ms-win-core-systemtopology-l1-1-0|
|180078CE8|GetNumaNodeProcessorMaskEx|api-ms-win-core-systemtopology-l1-1-0|
|180078CF8|GetNumaProximityNodeEx|api-ms-win-core-systemtopology-l1-1-1|
|180078100|GetNumberFormatEx|api-ms-win-core-localization-l2-1-0|
|180077540|GetNumberOfConsoleInputEvents|api-ms-win-core-console-l1-1-0|
|1800777B8|GetNumberOfConsoleMouseButtons|api-ms-win-core-console-l3-2-0|
|180078058|GetOEMCP|api-ms-win-core-localization-l1-2-0|
|180077DE0|GetOverlappedResult|api-ms-win-core-io-l1-1-0|
|180077208|GetPackageFullName|KERNELBASE|
|180077230|GetPackageTargetPlatformProperty|KERNELBASE|
|180078CA8|GetPhysicallyInstalledSystemMemory|api-ms-win-core-sysinfo-l1-2-1|
|180078518|GetPriorityClass|api-ms-win-core-processthreads-l1-1-0|
|180077E78|GetProcAddress|api-ms-win-core-libraryloader-l1-2-0|
|180077410|GetProcAddressForCaller|KERNELBASE|
|1800786C8|GetProcessGroupAffinity|api-ms-win-core-processtopology-l1-1-0|
|180078630|GetProcessHandleCount|api-ms-win-core-processthreads-l1-1-1|
|180077D78|GetProcessHeap|api-ms-win-core-heap-l1-1-0|
|180077D88|GetProcessHeaps|api-ms-win-core-heap-l1-1-0|
|180078508|GetProcessId|api-ms-win-core-processthreads-l1-1-0|
|180078510|GetProcessIdOfThread|api-ms-win-core-processthreads-l1-1-0|
|1800786A8|GetProcessInformation|api-ms-win-core-processthreads-l1-1-3|
|180078608|GetProcessMitigationPolicy|api-ms-win-core-processthreads-l1-1-1|
|180078050|GetProcessPreferredUILanguages|api-ms-win-core-localization-l1-2-0|
|180078668|GetProcessPriorityBoost|api-ms-win-core-processthreads-l1-1-2|
|180078698|GetProcessShutdownParameters|api-ms-win-core-processthreads-l1-1-3|
|180078500|GetProcessTimes|api-ms-win-core-processthreads-l1-1-0|
|1800785B0|GetProcessVersion|api-ms-win-core-processthreads-l1-1-0|
|180078238|GetProcessWorkingSetSizeEx|api-ms-win-core-memory-l1-1-1|
|180078C68|GetProductInfo|api-ms-win-core-sysinfo-l1-2-0|
|1800772C0|GetPtrCalData|KERNELBASE|
|1800772B0|GetPtrCalDataArray|KERNELBASE|
|180077DD8|GetQueuedCompletionStatus|api-ms-win-core-io-l1-1-0|
|180077DD0|GetQueuedCompletionStatusEx|api-ms-win-core-io-l1-1-0|
|180077188|GetRegistryExtensionFlags|KERNELBASE|
|180078550|GetStartupInfoW|api-ms-win-core-processthreads-l1-1-0|
|1800783A0|GetStdHandle|api-ms-win-core-processenvironment-l1-1-0|
|180078378|GetStringScripts|api-ms-win-core-normalization-l1-1-0|
|180077288|GetStringTableEntry|KERNELBASE|
|180077408|GetStringTypeA|KERNELBASE|
|180078A60|GetStringTypeExW|api-ms-win-core-string-l1-1-0|
|180078A58|GetStringTypeW|api-ms-win-core-string-l1-1-0|
|180077FF0|GetSystemDefaultLCID|api-ms-win-core-localization-l1-2-0|
|180077FF8|GetSystemDefaultLangID|api-ms-win-core-localization-l1-2-0|
|180077360|GetSystemDefaultLocaleName|KERNELBASE|
|180077400|GetSystemDefaultUILanguage|KERNELBASE|
|180078228|GetSystemFileCacheSize|api-ms-win-core-memory-l1-1-1|
|180078C90|GetSystemFirmwareTable|api-ms-win-core-sysinfo-l1-2-0|
|180078C18|GetSystemInfo|api-ms-win-core-sysinfo-l1-1-0|
|180078000|GetSystemPreferredUILanguages|api-ms-win-core-localization-l1-2-0|
|180078C10|GetSystemTime|api-ms-win-core-sysinfo-l1-1-0|
|180078C48|GetSystemTimeAdjustment|api-ms-win-core-sysinfo-l1-1-0|
|180078BE8|GetSystemTimeAsFileTime|api-ms-win-core-sysinfo-l1-1-0|
|180078C80|GetSystemTimePreciseAsFileTime|api-ms-win-core-sysinfo-l1-2-0|
|180078680|GetSystemTimes|api-ms-win-core-processthreads-l1-1-2|
|180078E78|GetSystemWow64Directory2W|api-ms-win-core-wow64-l1-1-1|
|180078E88|GetSystemWow64DirectoryA|api-ms-win-core-wow64-l1-1-1|
|180078E80|GetSystemWow64DirectoryW|api-ms-win-core-wow64-l1-1-1|
|180077238|GetTargetPlatformContext|KERNELBASE|
|180077C30|GetTempFileNameA|api-ms-win-core-file-l1-2-2|
|180077B38|GetTempFileNameW|api-ms-win-core-file-l1-1-0|
|180077C38|GetTempPathA|api-ms-win-core-file-l1-2-2|
|180077BF0|GetTempPathW|api-ms-win-core-file-l1-2-0|
|180078648|GetThreadContext|api-ms-win-core-processthreads-l1-1-1|
|180077930|GetThreadErrorMode|api-ms-win-core-errorhandling-l1-1-3|
|1800786C0|GetThreadGroupAffinity|api-ms-win-core-processtopology-l1-1-0|
|180078678|GetThreadIOPendingFlag|api-ms-win-core-processthreads-l1-1-2|
|1800784B8|GetThreadId|api-ms-win-core-processthreads-l1-1-0|
|180078618|GetThreadIdealProcessorEx|api-ms-win-core-processthreads-l1-1-1|
|180078658|GetThreadInformation|api-ms-win-core-processthreads-l1-1-2|
|180077FE8|GetThreadLocale|api-ms-win-core-localization-l1-2-0|
|180077FC0|GetThreadPreferredUILanguages|api-ms-win-core-localization-l1-2-0|
|1800784C0|GetThreadPriority|api-ms-win-core-processthreads-l1-1-0|
|1800784C8|GetThreadPriorityBoost|api-ms-win-core-processthreads-l1-1-0|
|180078610|GetThreadTimes|api-ms-win-core-processthreads-l1-1-1|
|180077F38|GetThreadUILanguage|api-ms-win-core-localization-l1-2-0|
|180078C38|GetTickCount|api-ms-win-core-sysinfo-l1-1-0|
|180077840|GetTimeFormatA|api-ms-win-core-datetime-l1-1-0|
|180077858|GetTimeFormatEx|api-ms-win-core-datetime-l1-1-1|
|180077838|GetTimeFormatW|api-ms-win-core-datetime-l1-1-0|
|180078D80|GetTimeZoneInformation|api-ms-win-core-timezone-l1-1-0|
|180078D60|GetTimeZoneInformationForYear|api-ms-win-core-timezone-l1-1-0|
|180077F40|GetUILanguageInfo|api-ms-win-core-localization-l1-2-0|
|1800771B0|GetUnicodeStringToEightBitSizeRoutine|KERNELBASE|
|1800771A8|GetUnicodeStringToEightBitStringRoutine|KERNELBASE|
|180077FD8|GetUserDefaultLCID|api-ms-win-core-localization-l1-2-0|
|180077FE0|GetUserDefaultLangID|api-ms-win-core-localization-l1-2-0|
|180077358|GetUserDefaultLocaleName|KERNELBASE|
|1800773F8|GetUserDefaultUILanguage|KERNELBASE|
|1800772B8|GetUserOverrideString|KERNELBASE|
|180077310|GetUserOverrideWord|KERNELBASE|
|180077F48|GetUserPreferredUILanguages|api-ms-win-core-localization-l1-2-0|
|180078C50|GetVersion|api-ms-win-core-sysinfo-l1-1-0|
|180078C08|GetVersionExA|api-ms-win-core-sysinfo-l1-1-0|
|180078BD0|GetVersionExW|api-ms-win-core-sysinfo-l1-1-0|
|180077C40|GetVolumeInformationA|api-ms-win-core-file-l1-2-2|
|180077B58|GetVolumeInformationByHandleW|api-ms-win-core-file-l1-1-0|
|180077B60|GetVolumeInformationW|api-ms-win-core-file-l1-1-0|
|180077170|GetVolumeNameForVolumeMountPointW|KERNELBASE|
|180077B68|GetVolumePathNameW|api-ms-win-core-file-l1-1-0|
|180077C00|GetVolumePathNamesForVolumeNameW|api-ms-win-core-file-l1-2-0|
|180078BD8|GetWindowsDirectoryA|api-ms-win-core-sysinfo-l1-1-0|
|180078BE0|GetWindowsDirectoryW|api-ms-win-core-sysinfo-l1-1-0|
|180078210|GetWriteWatch|api-ms-win-core-memory-l1-1-1|
|180078EB0|GetXStateFeaturesMask|api-ms-win-core-xstate-l2-1-0|
|1800773F0|GlobalAlloc|KERNELBASE|
|180077198|GlobalFree|KERNELBASE|
|180078BF0|GlobalMemoryStatusEx|api-ms-win-core-sysinfo-l1-1-0|
|180077D28|HeapAlloc|api-ms-win-core-heap-l1-1-0|
|180077D80|HeapCompact|api-ms-win-core-heap-l1-1-0|
|180077D48|HeapCreate|api-ms-win-core-heap-l1-1-0|
|180077D70|HeapDestroy|api-ms-win-core-heap-l1-1-0|
|180077D90|HeapFree|api-ms-win-core-heap-l1-1-0|
|180077D68|HeapLock|api-ms-win-core-heap-l1-1-0|
|180077D60|HeapQueryInformation|api-ms-win-core-heap-l1-1-0|
|180077D50|HeapReAlloc|api-ms-win-core-heap-l1-1-0|
|180077D58|HeapSetInformation|api-ms-win-core-heap-l1-1-0|
|1800773E8|HeapSummary|KERNELBASE|
|180077D40|HeapUnlock|api-ms-win-core-heap-l1-1-0|
|180077D38|HeapValidate|api-ms-win-core-heap-l1-1-0|
|180077D30|HeapWalk|api-ms-win-core-heap-l1-1-0|
|180077F50|IdnToAscii|api-ms-win-core-localization-l1-2-0|
|180078370|IdnToNameprepUnicode|api-ms-win-core-normalization-l1-1-0|
|180077F58|IdnToUnicode|api-ms-win-core-localization-l1-2-0|
|180078B88|InitOnceExecuteOnce|api-ms-win-core-synch-l1-2-0|
|180078EA8|InitializeContext|api-ms-win-core-xstate-l2-1-0|
|180078ED0|InitializeContext2|api-ms-win-core-xstate-l2-1-1|
|180078AD0|InitializeCriticalSection|api-ms-win-core-synch-l1-1-0|
|180078B68|InitializeCriticalSectionAndSpinCount|api-ms-win-core-synch-l1-1-0|
|180078B70|InitializeCriticalSectionEx|api-ms-win-core-synch-l1-1-0|
|180078588|InitializeProcThreadAttributeList|api-ms-win-core-processthreads-l1-1-0|
|180078B98|InitializeSynchronizationBarrier|api-ms-win-core-synch-l1-2-0|
|1800772A0|InternalLcidToName|KERNELBASE|
|1800772C8|Internal_EnumCalendarInfo|KERNELBASE|
|1800772E0|Internal_EnumDateFormats|KERNELBASE|
|1800772D0|Internal_EnumLanguageGroupLocales|KERNELBASE|
|1800772D8|Internal_EnumSystemCodePages|KERNELBASE|
|1800772F0|Internal_EnumSystemLanguageGroups|KERNELBASE|
|180077300|Internal_EnumTimeFormats|KERNELBASE|
|1800772E8|Internal_EnumUILanguages|KERNELBASE|
|180077FC8|IsDBCSLeadByte|api-ms-win-core-localization-l1-2-0|
|180077FB0|IsDBCSLeadByteEx|api-ms-win-core-localization-l1-2-0|
|180077880|IsDebuggerPresent|api-ms-win-core-debug-l1-1-0|
|180077FA8|IsNLSDefinedString|api-ms-win-core-localization-l1-2-0|
|180078368|IsNormalizedString|api-ms-win-core-normalization-l1-1-0|
|180077E08|IsProcessInJob|api-ms-win-core-job-l1-1-0|
|180078640|IsProcessorFeaturePresent|api-ms-win-core-processthreads-l1-1-1|
|180077FA0|IsValidCodePage|api-ms-win-core-localization-l1-2-0|
|180077F70|IsValidLanguageGroup|api-ms-win-core-localization-l1-2-0|
|180077F30|IsValidLocale|api-ms-win-core-localization-l1-2-0|
|180077F60|IsValidLocaleName|api-ms-win-core-localization-l1-2-0|
|1800780D0|IsValidNLSVersion|api-ms-win-core-localization-l1-2-0|
|180078E58|IsWow64Process|api-ms-win-core-wow64-l1-1-0|
|180078E70|IsWow64Process2|api-ms-win-core-wow64-l1-1-1|
|1800787B0|K32EmptyWorkingSet|api-ms-win-core-psapi-l1-1-0|
|180078770|K32EnumDeviceDrivers|api-ms-win-core-psapi-l1-1-0|
|180078710|K32EnumPageFilesA|api-ms-win-core-psapi-ansi-l1-1-0|
|180078738|K32EnumPageFilesW|api-ms-win-core-psapi-l1-1-0|
|180078760|K32EnumProcessModules|api-ms-win-core-psapi-l1-1-0|
|180078790|K32EnumProcessModulesEx|api-ms-win-core-psapi-l1-1-0|
|180078748|K32EnumProcesses|api-ms-win-core-psapi-l1-1-0|
|180078708|K32GetDeviceDriverBaseNameA|api-ms-win-core-psapi-ansi-l1-1-0|
|180078768|K32GetDeviceDriverBaseNameW|api-ms-win-core-psapi-l1-1-0|
|1800786F8|K32GetDeviceDriverFileNameA|api-ms-win-core-psapi-ansi-l1-1-0|
|180078758|K32GetDeviceDriverFileNameW|api-ms-win-core-psapi-l1-1-0|
|1800786F0|K32GetMappedFileNameA|api-ms-win-core-psapi-ansi-l1-1-0|
|1800787C8|K32GetMappedFileNameW|api-ms-win-core-psapi-l1-1-0|
|180078700|K32GetModuleBaseNameA|api-ms-win-core-psapi-ansi-l1-1-0|
|180078798|K32GetModuleBaseNameW|api-ms-win-core-psapi-l1-1-0|
|180078720|K32GetModuleFileNameExA|api-ms-win-core-psapi-ansi-l1-1-0|
|1800787A0|K32GetModuleFileNameExW|api-ms-win-core-psapi-l1-1-0|
|1800787A8|K32GetModuleInformation|api-ms-win-core-psapi-l1-1-0|
|180078740|K32GetPerformanceInfo|api-ms-win-core-psapi-l1-1-0|
|180078718|K32GetProcessImageFileNameA|api-ms-win-core-psapi-ansi-l1-1-0|
|1800787C0|K32GetProcessImageFileNameW|api-ms-win-core-psapi-l1-1-0|
|180078750|K32GetProcessMemoryInfo|api-ms-win-core-psapi-l1-1-0|
|180078780|K32GetWsChanges|api-ms-win-core-psapi-l1-1-0|
|180078778|K32GetWsChangesEx|api-ms-win-core-psapi-l1-1-0|
|180078788|K32InitializeProcessForWsWatch|api-ms-win-core-psapi-l1-1-0|
|1800787B8|K32QueryWorkingSet|api-ms-win-core-psapi-l1-1-0|
|1800787D0|K32QueryWorkingSetEx|api-ms-win-core-psapi-l1-1-0|
|180077190|KernelBaseGetGlobalData|KERNELBASE|
|180077350|LCIDToLocaleName|KERNELBASE|
|180077F80|LCMapStringA|api-ms-win-core-localization-l1-2-0|
|180077F68|LCMapStringEx|api-ms-win-core-localization-l1-2-0|
|180077F88|LCMapStringW|api-ms-win-core-localization-l1-2-0|
|180079488|LdrAddRefDll|ntdll|
|180079520|LdrDisableThreadCalloutsForDll|ntdll|
|180079000|LdrFindResourceEx_U|ntdll|
|180079838|LdrFindResource_U|ntdll|
|180079438|LdrGetDllDirectory|ntdll|
|180079360|LdrGetProcedureAddress|ntdll|
|180079368|LdrLoadDll|ntdll|
|1800796F8|LdrOpenImageFileOptionsKey|ntdll|
|180079530|LdrQueryImageFileExecutionOptions|ntdll|
|180079700|LdrQueryImageFileKeyOption|ntdll|
|180079068|LdrResFindResourceDirectory|ntdll|
|1800799B0|LdrResSearchResource|ntdll|
|180079828|LdrSetDllDirectory|ntdll|
|180079AB8|LdrSetDllManifestProber|ntdll|
|180079358|LdrUnloadDll|ntdll|
|180078B08|LeaveCriticalSection|api-ms-win-core-synch-l1-1-0|
|180077F00|LoadLibraryA|api-ms-win-core-libraryloader-l1-2-1|
|180077EE0|LoadLibraryExA|api-ms-win-core-libraryloader-l1-2-0|
|180077E70|LoadLibraryExW|api-ms-win-core-libraryloader-l1-2-0|
|180077EF0|LoadLibraryW|api-ms-win-core-libraryloader-l1-2-1|
|180077F20|LoadPackagedLibrary|api-ms-win-core-libraryloader-l2-1-0|
|180077EB0|LoadResource|api-ms-win-core-libraryloader-l1-2-0|
|1800771A0|LoadStringBaseExW|KERNELBASE|
|1800773E0|LocalAlloc|KERNELBASE|
|180077B78|LocalFileTimeToFileTime|api-ms-win-core-file-l1-1-0|
|180077DA0|LocalFree|api-ms-win-core-heap-l2-1-0|
|1800773D8|LocalLock|KERNELBASE|
|1800773D0|LocalReAlloc|KERNELBASE|
|1800773C8|LocalUnlock|KERNELBASE|
|180077FD0|LocaleNameToLCID|api-ms-win-core-localization-l1-2-0|
|180078EC0|LocateXStateFeature|api-ms-win-core-xstate-l2-1-0|
|180077B80|LockFile|api-ms-win-core-file-l1-1-0|
|180077B88|LockFileEx|api-ms-win-core-file-l1-1-0|
|180077ED0|LockResource|api-ms-win-core-libraryloader-l1-2-0|
|180078298|MapUserPhysicalPages|api-ms-win-core-memory-l1-1-2|
|1800781F8|MapViewOfFile|api-ms-win-core-memory-l1-1-0|
|1800781E0|MapViewOfFileEx|api-ms-win-core-memory-l1-1-0|
|1800773C0|MapViewOfFileExNuma|KERNELBASE|
|180077C98|MoveFileExW|api-ms-win-core-file-l2-1-0|
|180077270|MoveFileWithProgressTransactedW|KERNELBASE|
|180077CB8|MoveFileWithProgressW|api-ms-win-core-file-l2-1-0|
|180077E18|MulDiv|api-ms-win-core-largeinteger-l1-1-0|
|180078A50|MultiByteToWideChar|api-ms-win-core-string-l1-1-0|
|180078450|NeedCurrentDirectoryForExePathA|api-ms-win-core-processenvironment-l1-2-0|
|180078440|NeedCurrentDirectoryForExePathW|api-ms-win-core-processenvironment-l1-2-0|
|180078160|NlsCheckPolicy|api-ms-win-core-localization-private-l1-1-0|
|180078148|NlsEventDataDescCreate|api-ms-win-core-localization-private-l1-1-0|
|180078158|NlsGetCacheUpdateCount|api-ms-win-core-localization-private-l1-1-0|
|1800772A8|NlsIsUserDefaultLocale|KERNELBASE|
|180079988|NlsMbCodePageTag|ntdll|
|180078150|NlsUpdateLocale|api-ms-win-core-localization-private-l1-1-0|
|180078170|NlsUpdateSystemLocale|api-ms-win-core-localization-private-l1-1-0|
|1800772F8|NlsValidateLocale|KERNELBASE|
|180078168|NlsWriteEtwEvent|api-ms-win-core-localization-private-l1-1-0|
|180078360|NormalizeString|api-ms-win-core-normalization-l1-1-0|
|180077348|NotifyMountMgr|KERNELBASE|
|1800795C8|NtAddAtomEx|ntdll|
|180079770|NtAllocateVirtualMemory|ntdll|
|180079A18|NtApphelpCacheControl|ntdll|
|180079688|NtAssignProcessToJobObject|ntdll|
|1800799F0|NtClearEvent|ntdll|
|180079480|NtClose|ntdll|
|180079428|NtCreateEvent|ntdll|
|180079668|NtCreateFile|ntdll|
|180079678|NtCreateJobObject|ntdll|
|1800796B0|NtCreateJobSet|ntdll|
|180079600|NtCreateKey|ntdll|
|1800797F0|NtCreateMailslotFile|ntdll|
|1800790A0|NtCreateSection|ntdll|
|1800795E8|NtDeleteAtom|ntdll|
|1800790D8|NtDeleteValueKey|ntdll|
|180079880|NtDeviceIoControlFile|ntdll|
|180078FC0|NtEnumerateKey|ntdll|
|180079748|NtEnumerateValueKey|ntdll|
|1800795D8|NtFindAtom|ntdll|
|180079608|NtFlushKey|ntdll|
|180079790|NtFreeVirtualMemory|ntdll|
|180079470|NtFsControlFile|ntdll|
|180079840|NtGetDevicePowerState|ntdll|
|180079408|NtInitiatePowerAction|ntdll|
|180079400|NtIsSystemResumeAutomatic|ntdll|
|180079760|NtLockFile|ntdll|
|180079030|NtMapUserPhysicalPagesScatter|ntdll|
|180079098|NtMapViewOfSection|ntdll|
|180079478|NtOpenFile|ntdll|
|180079680|NtOpenJobObject|ntdll|
|1800793D8|NtOpenKey|ntdll|
|1800793B0|NtOpenProcessToken|ntdll|
|1800793C0|NtOpenThreadToken|ntdll|
|180079848|NtPowerInformation|ntdll|
|1800797D8|NtProtectVirtualMemory|ntdll|
|1800798F8|NtQueryAttributesFile|ntdll|
|180079810|NtQueryDirectoryFile|ntdll|
|1800796B8|NtQueryEaFile|ntdll|
|180079278|NtQueryEvent|ntdll|
|1800798F0|NtQueryFullAttributesFile|ntdll|
|1800795F8|NtQueryInformationAtom|ntdll|
|180079490|NtQueryInformationFile|ntdll|
|180079670|NtQueryInformationJobObject|ntdll|
|1800794F8|NtQueryInformationProcess|ntdll|
|1800791E8|NtQueryInformationThread|ntdll|
|1800793A8|NtQueryInformationToken|ntdll|
|1800790F0|NtQueryInstallUILanguage|ntdll|
|180079120|NtQueryLicenseValue|ntdll|
|1800796F0|NtQuerySection|ntdll|
|1800796C0|NtQuerySecurityObject|ntdll|
|180079868|NtQuerySystemEnvironmentValueEx|ntdll|
|180079AD0|NtQuerySystemInformation|ntdll|
|180079930|NtQueryTimerResolution|ntdll|
|180079388|NtQueryValueKey|ntdll|
|1800797C8|NtQueryVirtualMemory|ntdll|
|1800792C0|NtQueryVolumeInformationFile|ntdll|
|180079850|NtQueryWnfStateData|ntdll|
|180079288|NtRaiseHardError|ntdll|
|180079778|NtReadFile|ntdll|
|1800799A8|NtReadVirtualMemory|ntdll|
|180079320|NtReplacePartitionUnit|ntdll|
|1800796D0|NtSetEaFile|ntdll|
|1800794D8|NtSetInformationDebugObject|ntdll|
|180079498|NtSetInformationFile|ntdll|
|1800796A0|NtSetInformationJobObject|ntdll|
|1800796E0|NtSetInformationProcess|ntdll|
|1800793B8|NtSetInformationThread|ntdll|
|1800796D8|NtSetSecurityObject|ntdll|
|180079870|NtSetSystemEnvironmentValueEx|ntdll|
|1800794F0|NtSetSystemInformation|ntdll|
|180079858|NtSetThreadExecutionState|ntdll|
|180079938|NtSetTimerResolution|ntdll|
|1800790E0|NtSetValueKey|ntdll|
|180079878|NtSetVolumeInformationFile|ntdll|
|180079690|NtTerminateJobObject|ntdll|
|180078FE8|NtTerminateProcess|ntdll|
|180079768|NtUnlockFile|ntdll|
|1800791B8|NtUnmapViewOfSection|ntdll|
|1800799E8|NtWaitForMultipleObjects|ntdll|
|180079420|NtWaitForSingleObject|ntdll|
|180079788|NtWriteFile|ntdll|
|180078B78|OpenEventA|api-ms-win-core-synch-l1-1-0|
|180078B58|OpenEventW|api-ms-win-core-synch-l1-1-0|
|180077CC8|OpenFileById|api-ms-win-core-file-l2-1-1|
|1800781C8|OpenFileMappingW|api-ms-win-core-memory-l1-1-0|
|180078AB8|OpenMutexW|api-ms-win-core-synch-l1-1-0|
|180077240|OpenPackageInfoByFullNameForUser|KERNELBASE|
|180078350|OpenPrivateNamespaceW|api-ms-win-core-namespace-l1-1-0|
|1800785F8|OpenProcess|api-ms-win-core-processthreads-l1-1-1|
|1800785E8|OpenProcessToken|api-ms-win-core-processthreads-l1-1-0|
|180077298|OpenRegKey|KERNELBASE|
|180078AB0|OpenSemaphoreW|api-ms-win-core-synch-l1-1-0|
|1800784D0|OpenThread|api-ms-win-core-processthreads-l1-1-0|
|180078AA8|OpenWaitableTimerW|api-ms-win-core-synch-l1-1-0|
|180077888|OutputDebugStringA|api-ms-win-core-debug-l1-1-0|
|180077890|OutputDebugStringW|api-ms-win-core-debug-l1-1-0|
|180077200|PackageIdFromFullName|KERNELBASE|
|1800775B0|PeekConsoleInputA|api-ms-win-core-console-l1-2-0|
|1800775A0|PeekConsoleInputW|api-ms-win-core-console-l1-2-0|
|1800782E0|PeekNamedPipe|api-ms-win-core-namedpipe-l1-1-0|
|180077DB0|PostQueuedCompletionStatus|api-ms-win-core-io-l1-1-0|
|180077340|PrivCopyFileExW|KERNELBASE|
|1800784D8|ProcessIdToSessionId|api-ms-win-core-processthreads-l1-1-0|
|180078480|PssCaptureSnapshot|api-ms-win-core-processsnapshot-l1-1-0|
|1800784A0|PssDuplicateSnapshot|api-ms-win-core-processsnapshot-l1-1-0|
|180078488|PssFreeSnapshot|api-ms-win-core-processsnapshot-l1-1-0|
|180078490|PssQuerySnapshot|api-ms-win-core-processsnapshot-l1-1-0|
|180078470|PssWalkMarkerCreate|api-ms-win-core-processsnapshot-l1-1-0|
|180078478|PssWalkMarkerFree|api-ms-win-core-processsnapshot-l1-1-0|
|1800784A8|PssWalkMarkerGetPosition|api-ms-win-core-processsnapshot-l1-1-0|
|180078468|PssWalkMarkerSeekToBeginning|api-ms-win-core-processsnapshot-l1-1-0|
|180078460|PssWalkMarkerSetPosition|api-ms-win-core-processsnapshot-l1-1-0|
|180078498|PssWalkSnapshot|api-ms-win-core-processsnapshot-l1-1-0|
|1800773B8|PulseEvent|KERNELBASE|
|1800774F8|PurgeComm|api-ms-win-core-comm-l1-1-0|
|1800789E0|QueryActCtxSettingsW|api-ms-win-core-sidebyside-l1-1-0|
|1800789E8|QueryActCtxW|api-ms-win-core-sidebyside-l1-1-0|
|180077B90|QueryDosDeviceW|api-ms-win-core-file-l1-1-0|
|180078728|QueryFullProcessImageNameA|api-ms-win-core-psapi-ansi-l1-1-0|
|1800787D8|QueryFullProcessImageNameW|api-ms-win-core-psapi-l1-1-0|
|1800787F0|QueryIdleProcessorCycleTime|api-ms-win-core-realtime-l1-1-0|
|1800787F8|QueryIdleProcessorCycleTimeEx|api-ms-win-core-realtime-l1-1-0|
|180078220|QueryMemoryResourceNotification|api-ms-win-core-memory-l1-1-1|
|1800786D8|QueryPerformanceCounter|api-ms-win-core-profile-l1-1-0|
|1800786E0|QueryPerformanceFrequency|api-ms-win-core-profile-l1-1-0|
|1800785B8|QueryProcessAffinityUpdateMode|api-ms-win-core-processthreads-l1-1-0|
|180078800|QueryProcessCycleTime|api-ms-win-core-realtime-l1-1-0|
|180078808|QueryThreadCycleTime|api-ms-win-core-realtime-l1-1-0|
|1800787E8|QueryUnbiasedInterruptTime|api-ms-win-core-realtime-l1-1-0|
|1800784E0|QueueUserAPC|api-ms-win-core-processthreads-l1-1-0|
|180078D28|QueueUserWorkItem|api-ms-win-core-threadpool-legacy-l1-1-0|
|1800778F8|RaiseException|api-ms-win-core-errorhandling-l1-1-0|
|180077C68|ReOpenFile|api-ms-win-core-file-l2-1-0|
|180077550|ReadConsoleA|api-ms-win-core-console-l1-1-0|
|180077558|ReadConsoleInputA|api-ms-win-core-console-l1-1-0|
|180077560|ReadConsoleInputW|api-ms-win-core-console-l1-1-0|
|180077648|ReadConsoleOutputA|api-ms-win-core-console-l2-1-0|
|180077650|ReadConsoleOutputAttribute|api-ms-win-core-console-l2-1-0|
|180077658|ReadConsoleOutputCharacterA|api-ms-win-core-console-l2-1-0|
|180077660|ReadConsoleOutputCharacterW|api-ms-win-core-console-l2-1-0|
|180077668|ReadConsoleOutputW|api-ms-win-core-console-l2-1-0|
|180077568|ReadConsoleW|api-ms-win-core-console-l1-1-0|
|180077CF0|ReadDirectoryChangesExW|api-ms-win-core-file-l2-1-3|
|180077C70|ReadDirectoryChangesW|api-ms-win-core-file-l2-1-0|
|180077B98|ReadFile|api-ms-win-core-file-l1-1-0|
|180077BA0|ReadFileEx|api-ms-win-core-file-l1-1-0|
|180077BA8|ReadFileScatter|api-ms-win-core-file-l1-1-0|
|180078190|ReadProcessMemory|api-ms-win-core-memory-l1-1-0|
|1800788E0|RegCloseKey|api-ms-win-core-registry-l1-1-0|
|1800788E8|RegCopyTreeW|api-ms-win-core-registry-l1-1-0|
|180078818|RegCreateKeyExA|api-ms-win-core-registry-l1-1-0|
|1800788F8|RegCreateKeyExW|api-ms-win-core-registry-l1-1-0|
|180078930|RegDeleteKeyExA|api-ms-win-core-registry-l1-1-0|
|180078948|RegDeleteKeyExW|api-ms-win-core-registry-l1-1-0|
|180078950|RegDeleteTreeA|api-ms-win-core-registry-l1-1-0|
|180078958|RegDeleteTreeW|api-ms-win-core-registry-l1-1-0|
|180078960|RegDeleteValueA|api-ms-win-core-registry-l1-1-0|
|180078940|RegDeleteValueW|api-ms-win-core-registry-l1-1-0|
|180078938|RegDisablePredefinedCacheEx|api-ms-win-core-registry-l1-1-0|
|180078928|RegEnumKeyExA|api-ms-win-core-registry-l1-1-0|
|180078920|RegEnumKeyExW|api-ms-win-core-registry-l1-1-0|
|180078918|RegEnumValueA|api-ms-win-core-registry-l1-1-0|
|180078910|RegEnumValueW|api-ms-win-core-registry-l1-1-0|
|180078908|RegFlushKey|api-ms-win-core-registry-l1-1-0|
|180078900|RegGetKeySecurity|api-ms-win-core-registry-l1-1-0|
|180078820|RegGetValueA|api-ms-win-core-registry-l1-1-0|
|1800788D8|RegGetValueW|api-ms-win-core-registry-l1-1-0|
|180078828|RegLoadAppKeyW|api-ms-win-core-registry-l1-1-0|
|1800788F0|RegLoadKeyA|api-ms-win-core-registry-l1-1-0|
|1800788C8|RegLoadKeyW|api-ms-win-core-registry-l1-1-0|
|1800788C0|RegLoadMUIStringA|api-ms-win-core-registry-l1-1-0|
|1800788B8|RegLoadMUIStringW|api-ms-win-core-registry-l1-1-0|
|1800788B0|RegNotifyChangeKeyValue|api-ms-win-core-registry-l1-1-0|
|1800788A8|RegOpenCurrentUser|api-ms-win-core-registry-l1-1-0|
|1800788A0|RegOpenKeyExA|api-ms-win-core-registry-l1-1-0|
|1800788D0|RegOpenKeyExW|api-ms-win-core-registry-l1-1-0|
|180078898|RegOpenUserClassesRoot|api-ms-win-core-registry-l1-1-0|
|180078890|RegQueryInfoKeyA|api-ms-win-core-registry-l1-1-0|
|180078888|RegQueryInfoKeyW|api-ms-win-core-registry-l1-1-0|
|180078880|RegQueryValueExA|api-ms-win-core-registry-l1-1-0|
|180078878|RegQueryValueExW|api-ms-win-core-registry-l1-1-0|
|180078870|RegRestoreKeyA|api-ms-win-core-registry-l1-1-0|
|180078868|RegRestoreKeyW|api-ms-win-core-registry-l1-1-0|
|180078860|RegSaveKeyExA|api-ms-win-core-registry-l1-1-0|
|180078858|RegSaveKeyExW|api-ms-win-core-registry-l1-1-0|
|180078850|RegSetKeySecurity|api-ms-win-core-registry-l1-1-0|
|180078848|RegSetValueExA|api-ms-win-core-registry-l1-1-0|
|180078840|RegSetValueExW|api-ms-win-core-registry-l1-1-0|
|180078838|RegUnLoadKeyA|api-ms-win-core-registry-l1-1-0|
|180078830|RegUnLoadKeyW|api-ms-win-core-registry-l1-1-0|
|1800782A0|RegisterBadMemoryNotification|api-ms-win-core-memory-l1-1-2|
|180078D48|RegisterWaitForSingleObjectEx|api-ms-win-core-threadpool-private-l1-1-0|
|180078A30|ReleaseActCtx|api-ms-win-core-sidebyside-l1-1-0|
|180078AA0|ReleaseMutex|api-ms-win-core-synch-l1-1-0|
|180078A98|ReleaseSemaphore|api-ms-win-core-synch-l1-1-0|
|180077BB0|RemoveDirectoryA|api-ms-win-core-file-l1-1-0|
|180077BB8|RemoveDirectoryW|api-ms-win-core-file-l1-1-0|
|180077C80|ReplaceFileW|api-ms-win-core-file-l2-1-0|
|180078A90|ResetEvent|api-ms-win-core-synch-l1-1-0|
|180078218|ResetWriteWatch|api-ms-win-core-memory-l1-1-1|
|1800775C0|ResizePseudoConsole|api-ms-win-core-console-l1-2-1|
|180077F78|ResolveLocaleName|api-ms-win-core-localization-l1-2-0|
|1800784E8|ResumeThread|api-ms-win-core-processthreads-l1-1-0|
|180079698|RtlAcquirePrivilege|ntdll|
|1800793E0|RtlAcquireSRWLockExclusive|ntdll|
|180079158|RtlActivateActivationContext|ntdll|
|1800794B8|RtlActivateActivationContextUnsafeFast|ntdll|
|180079B00|RtlAddAccessAllowedAce|ntdll|
|1800795C0|RtlAddAtomToAtomTable|ntdll|
|1800789B0|RtlAddFunctionTable|api-ms-win-core-rtlsupport-l1-1-0|
|180079310|RtlAddIntegrityLabelToBoundaryDescriptor|ntdll|
|180079170|RtlAddRefActivationContext|ntdll|
|1800798E0|RtlAllocateAndInitializeSid|ntdll|
|1800798A0|RtlAllocateHandle|ntdll|
|180079B10|RtlAllocateHeap|ntdll|
|1800793E8|RtlAnsiStringToUnicodeString|ntdll|
|180079378|RtlAppendUnicodeStringToString|ntdll|
|180079370|RtlAppendUnicodeToString|ntdll|
|1800789D0|RtlCaptureContext|api-ms-win-core-rtlsupport-l1-1-0|
|1800789C8|RtlCaptureStackBackTrace|api-ms-win-core-rtlsupport-l1-1-0|
|180079590|RtlCharToInteger|ntdll|
|180079468|RtlCompactHeap|ntdll|
|180078970|RtlCompareMemory|api-ms-win-core-rtlsupport-l1-1-0|
|180079328|RtlCompareUnicodeString|ntdll|
|180079048|RtlComputeImportTableHash|ntdll|
|180079940|RtlConvertSidToUnicodeString|ntdll|
|180079750|RtlCopyUnicodeString|ntdll|
|180079B08|RtlCreateAcl|ntdll|
|180079178|RtlCreateActivationContext|ntdll|
|1800795B0|RtlCreateAtomTable|ntdll|
|1800797E0|RtlCreateBoundaryDescriptor|ntdll|
|180079270|RtlCreateEnvironment|ntdll|
|180079268|RtlCreateEnvironmentEx|ntdll|
|180079800|RtlCreateQueryDebugBuffer|ntdll|
|180079AF8|RtlCreateSecurityDescriptor|ntdll|
|180079258|RtlCreateUmsCompletionList|ntdll|
|1800791F8|RtlCreateUmsThreadContext|ntdll|
|180079280|RtlCreateUnicodeString|ntdll|
|180079648|RtlCreateUnicodeStringFromAsciiz|ntdll|
|180079150|RtlDeactivateActivationContext|ntdll|
|1800794B0|RtlDeactivateActivationContextUnsafeFast|ntdll|
|180079038|RtlDecodeSystemPointer|ntdll|
|1800795E0|RtlDeleteAtomFromAtomTable|ntdll|
|1800789A8|RtlDeleteFunctionTable|api-ms-win-core-rtlsupport-l1-1-0|
|180079228|RtlDeleteUmsCompletionList|ntdll|
|180079200|RtlDeleteUmsThreadContext|ntdll|
|180079248|RtlDequeueUmsCompletionListItems|ntdll|
|180079458|RtlDeregisterSecureMemoryCacheCallback|ntdll|
|1800797B8|RtlDeregisterWait|ntdll|
|1800795B8|RtlDestroyAtomTable|ntdll|
|180079260|RtlDestroyEnvironment|ntdll|
|1800797F8|RtlDestroyQueryDebugBuffer|ntdll|
|1800791A0|RtlDetermineDosPathNameType_U|ntdll|
|180079018|RtlDisableThreadProfiling|ntdll|
|180079640|RtlDnsHostNameToComputerName|ntdll|
|180079198|RtlDoesFileExists_U|ntdll|
|180079758|RtlDosPathNameToNtPathName_U|ntdll|
|1800790A8|RtlDosPathNameToNtPathName_U_WithStatus|ntdll|
|1800797A0|RtlDosPathNameToRelativeNtPathName_U|ntdll|
|180079028|RtlEnableThreadProfiling|ntdll|
|1800799D8|RtlEncodeSystemPointer|ntdll|
|180079628|RtlEnterCriticalSection|ntdll|
|1800791F0|RtlEnterUmsSchedulingMode|ntdll|
|180079390|RtlEqualSid|ntdll|
|180079798|RtlEqualString|ntdll|
|1800792E0|RtlEqualUnicodeString|ntdll|
|180079238|RtlExecuteUmsThread|ntdll|
|180079330|RtlExitUserProcess|ntdll|
|180079308|RtlExitUserThread|ntdll|
|180079110|RtlExpandEnvironmentStrings_U|ntdll|
|180079050|RtlFindActivationContextSectionGuid|ntdll|
|180079820|RtlFindActivationContextSectionString|ntdll|
|180079380|RtlFormatCurrentUserKeyPath|ntdll|
|180079290|RtlFreeAnsiString|ntdll|
|1800798A8|RtlFreeHandle|ntdll|
|180079AD8|RtlFreeHeap|ntdll|
|180079298|RtlFreeOemString|ntdll|
|1800798E8|RtlFreeSid|ntdll|
|1800794C8|RtlFreeUnicodeString|ntdll|
|180079140|RtlGUIDFromString|ntdll|
|1800790B0|RtlGetActiveActivationContext|ntdll|
|1800794A8|RtlGetActiveConsoleId|ntdll|
|180079958|RtlGetAppContainerParent|ntdll|
|180079948|RtlGetAppContainerSidType|ntdll|
|1800792A0|RtlGetCurrentDirectory_U|ntdll|
|180079418|RtlGetCurrentProcessorNumberEx|ntdll|
|180079AB0|RtlGetCurrentServiceSessionId|ntdll|
|180079508|RtlGetCurrentTransaction|ntdll|
|180079220|RtlGetCurrentUmsThread|ntdll|
|180079A08|RtlGetDeviceFamilyInfoEnum|ntdll|
|180079190|RtlGetFullPathName_U|ntdll|
|180079A20|RtlGetFullPathName_UEx|ntdll|
|180079180|RtlGetLengthWithoutLastFullDosOrNtPathElement|ntdll|
|180079720|RtlGetLongestNtPathLength|ntdll|
|180079A78|RtlGetNativeSystemInformation|ntdll|
|180079218|RtlGetNextUmsListItem|ntdll|
|1800799E0|RtlGetNtSystemRoot|ntdll|
|180079528|RtlGetSuiteMask|ntdll|
|1800797E8|RtlGetThreadErrorMode|ntdll|
|1800799A0|RtlGetThreadPreferredUILanguages|ntdll|
|180078FA8|RtlGetUILanguageInfo|ntdll|
|180079240|RtlGetUmsCompletionListEvent|ntdll|
|180079448|RtlGetUserInfoHeap|ntdll|
|180079AA8|RtlGetVersion|ntdll|
|180079A10|RtlHashUnicodeString|ntdll|
|1800797D0|RtlImageDirectoryEntryToData|ntdll|
|180079AC8|RtlImageNtHeader|ntdll|
|180079090|RtlImageNtHeaderEx|ntdll|
|180079598|RtlInitAnsiString|ntdll|
|1800793F8|RtlInitAnsiStringEx|ntdll|
|180079860|RtlInitString|ntdll|
|180079538|RtlInitUnicodeString|ntdll|
|180079338|RtlInitUnicodeStringEx|ntdll|
|180079998|RtlInitializeCriticalSection|ntdll|
|1800793A0|RtlInitializeSid|ntdll|
|180078978|RtlInstallFunctionTableCallback|api-ms-win-core-rtlsupport-l1-1-0|
|180078FC8|RtlIntegerToUnicodeString|ntdll|
|180079410|RtlIsNameLegalDOS8Dot3|ntdll|
|180079780|RtlIsTextUnicode|ntdll|
|180079888|RtlIsValidHandle|ntdll|
|180078F90|RtlLCIDToCultureName|ntdll|
|180079630|RtlLeaveCriticalSection|ntdll|
|1800796C8|RtlLengthSecurityDescriptor|ntdll|
|180079450|RtlLockHeap|ntdll|
|1800795D0|RtlLookupAtomInAtomTable|ntdll|
|180078980|RtlLookupFunctionEntry|api-ms-win-core-rtlsupport-l1-1-0|
|180079080|RtlMultiAppendUnicodeStringBuffer|ntdll|
|180079730|RtlMultiByteToUnicodeN|ntdll|
|180079738|RtlMultiByteToUnicodeSize|ntdll|
|180079A70|RtlNtPathNameToDosPathName|ntdll|
|1800794C0|RtlNtStatusToDosError|ntdll|
|180079020|RtlNtStatusToDosErrorNoTeb|ntdll|
|1800798D0|RtlOemStringToUnicodeString|ntdll|
|1800789B8|RtlPcToFileHeader|api-ms-win-core-rtlsupport-l1-1-0|
|180079650|RtlPrefixString|ntdll|
|180079740|RtlPrefixUnicodeString|ntdll|
|180079118|RtlPublishWnfStateData|ntdll|
|180079058|RtlQueryActivationContextApplicationSettings|ntdll|
|1800795F0|RtlQueryAtomInAtomTable|ntdll|
|1800796E8|RtlQueryElevationFlags|ntdll|
|180079950|RtlQueryEnvironmentVariable|ntdll|
|180079908|RtlQueryEnvironmentVariable_U|ntdll|
|180079070|RtlQueryInformationActivationContext|ntdll|
|1800791C0|RtlQueryPackageClaims|ntdll|
|180079340|RtlQueryPackageIdentity|ntdll|
|180079808|RtlQueryProcessDebugInformation|ntdll|
|180079318|RtlQueryProtectedPolicy|ntdll|
|1800793D0|RtlQueryRegistryValuesEx|ntdll|
|180079010|RtlQueryThreadProfiling|ntdll|
|180079210|RtlQueryUmsThreadInformation|ntdll|
|1800798B0|RtlQueryWnfStateData|ntdll|
|1800789A0|RtlRaiseException|api-ms-win-core-rtlsupport-l1-1-0|
|180079708|RtlRaiseStatus|ntdll|
|180079898|RtlReAllocateHeap|ntdll|
|180079008|RtlReadThreadProfilingData|ntdll|
|180079460|RtlRegisterSecureMemoryCacheCallback|ntdll|
|1800797B0|RtlRegisterWait|ntdll|
|180079168|RtlReleaseActivationContext|ntdll|
|1800799D0|RtlReleasePebLock|ntdll|
|1800796A8|RtlReleasePrivilege|ntdll|
|1800797A8|RtlReleaseRelativeName|ntdll|
|1800793C8|RtlReleaseSRWLockExclusive|ntdll|
|180078988|RtlRestoreContext|api-ms-win-core-rtlsupport-l1-1-0|
|180079990|RtlRunOnceExecuteOnce|ntdll|
|180079500|RtlSetCurrentTransaction|ntdll|
|180079AE0|RtlSetDaclSecurityDescriptor|ntdll|
|1800798D8|RtlSetEnvironmentStrings|ntdll|
|180079960|RtlSetEnvironmentVariable|ntdll|
|180079AE8|RtlSetGroupSecurityDescriptor|ntdll|
|1800797C0|RtlSetIoCompletionCallback|ntdll|
|180079510|RtlSetLastWin32Error|ntdll|
|180079250|RtlSetLastWin32ErrorAndNtStatusFromNtStatus|ntdll|
|180079AF0|RtlSetOwnerSecurityDescriptor|ntdll|
|180079548|RtlSetProtectedPolicy|ntdll|
|180079430|RtlSetSearchPathMode|ntdll|
|180079AC0|RtlSetThreadPoolStartFunc|ntdll|
|180079078|RtlSetThreadPreferredUILanguages|ntdll|
|180079208|RtlSetUmsThreadInformation|ntdll|
|180079890|RtlSetUserValueHeap|ntdll|
|180078F88|RtlSizeHeap|ntdll|
|180079060|RtlSubAuthorityCountSid|ntdll|
|180079398|RtlSubAuthoritySid|ntdll|
|1800798B8|RtlSubscribeWnfStateChangeNotification|ntdll|
|180079830|RtlSwitchedVVI|ntdll|
|180078FD8|RtlTimeFieldsToTime|ntdll|
|180078FD0|RtlTimeToTimeFields|ntdll|
|1800799C8|RtlTryAcquirePebLock|ntdll|
|180079578|RtlUmsThreadYield|ntdll|
|180078FE0|RtlUnhandledExceptionFilter|ntdll|
|1800792E8|RtlUnicodeStringToAnsiString|ntdll|
|180078F98|RtlUnicodeStringToInteger|ntdll|
|1800792B8|RtlUnicodeStringToOemString|ntdll|
|180079728|RtlUnicodeToMultiByteN|ntdll|
|1800795A8|RtlUnicodeToMultiByteSize|ntdll|
|180079440|RtlUnlockHeap|ntdll|
|1800798C0|RtlUnsubscribeWnfStateChangeNotification|ntdll|
|1800789C0|RtlUnwind|api-ms-win-core-rtlsupport-l1-1-0|
|180078990|RtlUnwindEx|api-ms-win-core-rtlsupport-l1-1-0|
|1800795A0|RtlUpcaseUnicodeChar|ntdll|
|180079AA0|RtlVerifyVersionInfo|ntdll|
|180078998|RtlVirtualUnwind|api-ms-win-core-rtlsupport-l1-1-0|
|1800799F8|RtlWerpReportException|ntdll|
|180079920|RtlWow64EnableFsRedirection|ntdll|
|180079300|RtlWow64GetThreadContext|ntdll|
|1800794D0|RtlWow64GetThreadSelectorEntry|ntdll|
|180079350|RtlWow64LogMessageInEventLogger|ntdll|
|1800792F8|RtlWow64SetThreadContext|ntdll|
|1800792F0|RtlWow64SuspendThread|ntdll|
|180079160|RtlZombifyActivationContext|ntdll|
|180079188|RtlpApplyLengthFunction|ntdll|
|180079128|RtlpConvertCultureNamesToLCIDs|ntdll|
|180078FB8|RtlpConvertLCIDsToCultureNames|ntdll|
|1800791A8|RtlpEnsureBufferSize|ntdll|
|1800793F0|RtlxAnsiStringToUnicodeSize|ntdll|
|180079638|RtlxUnicodeStringToAnsiSize|ntdll|
|180077670|ScrollConsoleScreenBufferA|api-ms-win-core-console-l2-1-0|
|180077678|ScrollConsoleScreenBufferW|api-ms-win-core-console-l2-1-0|
|180078448|SearchPathA|api-ms-win-core-processenvironment-l1-2-0|
|1800783F0|SearchPathW|api-ms-win-core-processenvironment-l1-1-0|
|180078F60|SetCachedSigningLevel|api-ms-win-security-base-l1-2-0|
|180077F90|SetCalendarInfoW|api-ms-win-core-localization-l1-2-0|
|1800774F0|SetCommBreak|api-ms-win-core-comm-l1-1-0|
|1800774E8|SetCommConfig|api-ms-win-core-comm-l1-1-0|
|1800774B0|SetCommMask|api-ms-win-core-comm-l1-1-0|
|1800774A0|SetCommState|api-ms-win-core-comm-l1-1-0|
|180077498|SetCommTimeouts|api-ms-win-core-comm-l1-1-0|
|180078CC0|SetComputerNameA|api-ms-win-core-sysinfo-l1-2-3|
|180078CA0|SetComputerNameEx2W|api-ms-win-core-sysinfo-l1-2-1|
|180078CC8|SetComputerNameExA|api-ms-win-core-sysinfo-l1-2-3|
|180078C70|SetComputerNameExW|api-ms-win-core-sysinfo-l1-2-0|
|180078CD0|SetComputerNameW|api-ms-win-core-sysinfo-l1-2-3|
|180077680|SetConsoleActiveScreenBuffer|api-ms-win-core-console-l2-1-0|
|1800776E0|SetConsoleCP|api-ms-win-core-console-l2-1-0|
|180077570|SetConsoleCtrlHandler|api-ms-win-core-console-l1-1-0|
|180077618|SetConsoleCursorInfo|api-ms-win-core-console-l2-1-0|
|180077610|SetConsoleCursorPosition|api-ms-win-core-console-l2-1-0|
|1800777B0|SetConsoleDisplayMode|api-ms-win-core-console-l3-2-0|
|1800777A8|SetConsoleHistoryInfo|api-ms-win-core-console-l3-2-0|
|180077578|SetConsoleMode|api-ms-win-core-console-l1-1-0|
|1800777A0|SetConsoleNumberOfCommandsA|api-ms-win-core-console-l3-2-0|
|180077798|SetConsoleNumberOfCommandsW|api-ms-win-core-console-l3-2-0|
|1800775F0|SetConsoleOutputCP|api-ms-win-core-console-l2-1-0|
|1800775E8|SetConsoleScreenBufferInfoEx|api-ms-win-core-console-l2-1-0|
|180077688|SetConsoleScreenBufferSize|api-ms-win-core-console-l2-1-0|
|180077690|SetConsoleTextAttribute|api-ms-win-core-console-l2-1-0|
|1800776F0|SetConsoleTitleA|api-ms-win-core-console-l2-2-0|
|180077718|SetConsoleTitleW|api-ms-win-core-console-l2-2-0|
|180077698|SetConsoleWindowInfo|api-ms-win-core-console-l2-1-0|
|180077790|SetCurrentConsoleFontEx|api-ms-win-core-console-l3-2-0|
|1800783E0|SetCurrentDirectoryA|api-ms-win-core-processenvironment-l1-1-0|
|1800783D8|SetCurrentDirectoryW|api-ms-win-core-processenvironment-l1-1-0|
|180078D90|SetDynamicTimeZoneInformation|api-ms-win-core-timezone-l1-1-0|
|180077B48|SetEndOfFile|api-ms-win-core-file-l1-1-0|
|1800783F8|SetEnvironmentStringsW|api-ms-win-core-processenvironment-l1-1-0|
|180078408|SetEnvironmentVariableA|api-ms-win-core-processenvironment-l1-1-0|
|180078400|SetEnvironmentVariableW|api-ms-win-core-processenvironment-l1-1-0|
|1800778F0|SetErrorMode|api-ms-win-core-errorhandling-l1-1-0|
|180078A88|SetEvent|api-ms-win-core-synch-l1-1-0|
|1800773B0|SetFileApisToANSI|KERNELBASE|
|1800773A8|SetFileApisToOEM|KERNELBASE|
|180077B40|SetFileAttributesA|api-ms-win-core-file-l1-1-0|
|180077B30|SetFileAttributesW|api-ms-win-core-file-l1-1-0|
|180077AC0|SetFileInformationByHandle|api-ms-win-core-file-l1-1-0|
|180077C20|SetFileIoOverlappedRange|api-ms-win-core-file-l1-2-1|
|1800779E0|SetFilePointer|api-ms-win-core-file-l1-1-0|
|1800779B8|SetFilePointerEx|api-ms-win-core-file-l1-1-0|
|180077A90|SetFileTime|api-ms-win-core-file-l1-1-0|
|180077AA8|SetFileValidData|api-ms-win-core-file-l1-1-0|
|180077D08|SetHandleInformation|api-ms-win-core-handle-l1-1-0|
|180077910|SetLastError|api-ms-win-core-errorhandling-l1-1-0|
|180078BF8|SetLocalTime|api-ms-win-core-sysinfo-l1-1-0|
|180077F98|SetLocaleInfoW|api-ms-win-core-localization-l1-2-0|
|1800782F8|SetNamedPipeHandleState|api-ms-win-core-namedpipe-l1-1-0|
|1800784F0|SetPriorityClass|api-ms-win-core-processthreads-l1-1-0|
|1800785C0|SetProcessAffinityUpdateMode|api-ms-win-core-processthreads-l1-1-0|
|180078690|SetProcessInformation|api-ms-win-core-processthreads-l1-1-3|
|180078620|SetProcessMitigationPolicy|api-ms-win-core-processthreads-l1-1-1|
|180077FB8|SetProcessPreferredUILanguages|api-ms-win-core-localization-l1-2-0|
|180078660|SetProcessPriorityBoost|api-ms-win-core-processthreads-l1-1-2|
|1800784F8|SetProcessShutdownParameters|api-ms-win-core-processthreads-l1-1-0|
|180078230|SetProcessWorkingSetSizeEx|api-ms-win-core-memory-l1-1-1|
|180078418|SetStdHandle|api-ms-win-core-processenvironment-l1-1-0|
|180078410|SetStdHandleEx|api-ms-win-core-processenvironment-l1-1-0|
|180078260|SetSystemFileCacheSize|api-ms-win-core-memory-l1-1-1|
|180078C88|SetSystemTime|api-ms-win-core-sysinfo-l1-2-0|
|180078638|SetThreadContext|api-ms-win-core-processthreads-l1-1-1|
|180077928|SetThreadErrorMode|api-ms-win-core-errorhandling-l1-1-3|
|1800786B8|SetThreadGroupAffinity|api-ms-win-core-processtopology-l1-1-0|
|1800786A0|SetThreadIdealProcessor|api-ms-win-core-processthreads-l1-1-3|
|180078628|SetThreadIdealProcessorEx|api-ms-win-core-processthreads-l1-1-1|
|180078670|SetThreadInformation|api-ms-win-core-processthreads-l1-1-2|
|180078030|SetThreadLocale|api-ms-win-core-localization-l1-2-0|
|1800780D8|SetThreadPreferredUILanguages|api-ms-win-core-localization-l1-2-0|
|180078530|SetThreadPriority|api-ms-win-core-processthreads-l1-1-0|
|180078538|SetThreadPriorityBoost|api-ms-win-core-processthreads-l1-1-0|
|180078540|SetThreadStackGuarantee|api-ms-win-core-processthreads-l1-1-0|
|180078070|SetThreadUILanguage|api-ms-win-core-localization-l1-2-0|
|180078D98|SetTimeZoneInformation|api-ms-win-core-timezone-l1-1-0|
|180077908|SetUnhandledExceptionFilter|api-ms-win-core-errorhandling-l1-1-0|
|180078AD8|SetWaitableTimer|api-ms-win-core-synch-l1-1-0|
|180078EB8|SetXStateFeaturesMask|api-ms-win-core-xstate-l2-1-0|
|180077490|SetupComm|api-ms-win-core-comm-l1-1-0|
|180078BA8|SignalObjectAndWait|api-ms-win-core-synch-l1-2-0|
|180077ED8|SizeofResource|api-ms-win-core-libraryloader-l1-2-0|
|1800773A0|Sleep|KERNELBASE|
|180078AE0|SleepEx|api-ms-win-core-synch-l1-1-0|
|180078548|SuspendThread|api-ms-win-core-processthreads-l1-1-0|
|180077968|SwitchToFiber|api-ms-win-core-fibers-l2-1-0|
|180078520|SwitchToThread|api-ms-win-core-processthreads-l1-1-0|
|180078D88|SystemTimeToFileTime|api-ms-win-core-timezone-l1-1-0|
|180078D58|SystemTimeToTzSpecificLocalTime|api-ms-win-core-timezone-l1-1-0|
|180078558|TerminateProcess|api-ms-win-core-processthreads-l1-1-0|
|180078560|TerminateThread|api-ms-win-core-processthreads-l1-1-0|
|180078568|TlsAlloc|api-ms-win-core-processthreads-l1-1-0|
|180078570|TlsFree|api-ms-win-core-processthreads-l1-1-0|
|1800785C8|TlsSetValue|api-ms-win-core-processthreads-l1-1-0|
|180079570|TpAllocCleanupGroup|ntdll|
|180079550|TpAllocIoCompletion|ntdll|
|1800790B8|TpAllocPool|ntdll|
|180079230|TpAllocTimer|ntdll|
|1800790D0|TpAllocWait|ntdll|
|180079558|TpAllocWork|ntdll|
|180079580|TpCallbackMayRunLong|ntdll|
|180079918|TpCaptureCaller|ntdll|
|180079560|TpQueryPoolStackInformation|ntdll|
|1800790C0|TpSetPoolMinThreads|ntdll|
|1800790C8|TpSetPoolStackInformation|ntdll|
|180079568|TpSimpleTryPost|ntdll|
|1800782B8|TransactNamedPipe|api-ms-win-core-namedpipe-l1-1-0|
|180077510|TransmitCommChar|api-ms-win-core-comm-l1-1-0|
|180078D68|TzSpecificLocalTimeToSystemTime|api-ms-win-core-timezone-l1-1-0|
|1800778E8|UnhandledExceptionFilter|api-ms-win-core-errorhandling-l1-1-0|
|180077B50|UnlockFile|api-ms-win-core-file-l1-1-0|
|180077BC0|UnlockFileEx|api-ms-win-core-file-l1-1-0|
|1800781A0|UnmapViewOfFile|api-ms-win-core-memory-l1-1-0|
|1800782A8|UnregisterBadMemoryNotification|api-ms-win-core-memory-l1-1-2|
|180078D30|UnregisterWaitEx|api-ms-win-core-threadpool-legacy-l1-1-0|
|180078580|UpdateProcThreadAttribute|api-ms-win-core-processthreads-l1-1-0|
|180078048|VerLanguageNameA|api-ms-win-core-localization-l1-2-0|
|180078040|VerLanguageNameW|api-ms-win-core-localization-l1-2-0|
|180079A98|VerSetConditionMask|ntdll|
|180078380|VerifyScripts|api-ms-win-core-normalization-l1-1-0|
|1800781F0|VirtualAlloc|api-ms-win-core-memory-l1-1-0|
|180078188|VirtualAllocEx|api-ms-win-core-memory-l1-1-0|
|180078270|VirtualAllocExNuma|api-ms-win-core-memory-l1-1-2|
|1800781D8|VirtualFree|api-ms-win-core-memory-l1-1-0|
|1800781D0|VirtualFreeEx|api-ms-win-core-memory-l1-1-0|
|180078208|VirtualLock|api-ms-win-core-memory-l1-1-1|
|1800781C0|VirtualProtect|api-ms-win-core-memory-l1-1-0|
|1800781B8|VirtualProtectEx|api-ms-win-core-memory-l1-1-0|
|1800781B0|VirtualQuery|api-ms-win-core-memory-l1-1-0|
|1800781A8|VirtualQueryEx|api-ms-win-core-memory-l1-1-0|
|180078258|VirtualUnlock|api-ms-win-core-memory-l1-1-1|
|1800774A8|WaitCommEvent|api-ms-win-core-comm-l1-1-0|
|1800778B0|WaitForDebugEvent|api-ms-win-core-debug-l1-1-1|
|180078BB8|WaitForMultipleObjects|api-ms-win-core-synch-l1-2-1|
|180078AE8|WaitForMultipleObjectsEx|api-ms-win-core-synch-l1-1-0|
|180078AF0|WaitForSingleObject|api-ms-win-core-synch-l1-1-0|
|180078AF8|WaitForSingleObjectEx|api-ms-win-core-synch-l1-1-0|
|1800782C0|WaitNamedPipeW|api-ms-win-core-namedpipe-l1-1-0|
|180078E08|WerRegisterAdditionalProcess|api-ms-win-core-windowserrorreporting-l1-1-1|
|180078E40|WerRegisterAppLocalDump|api-ms-win-core-windowserrorreporting-l1-1-2|
|180078E28|WerRegisterCustomMetadata|api-ms-win-core-windowserrorreporting-l1-1-1|
|180078E18|WerRegisterExcludedMemoryBlock|api-ms-win-core-windowserrorreporting-l1-1-1|
|180078DD8|WerRegisterFile|api-ms-win-core-windowserrorreporting-l1-1-0|
|180078DF0|WerRegisterMemoryBlock|api-ms-win-core-windowserrorreporting-l1-1-0|
|180078DE0|WerRegisterRuntimeExceptionModule|api-ms-win-core-windowserrorreporting-l1-1-0|
|180078E10|WerUnregisterAdditionalProcess|api-ms-win-core-windowserrorreporting-l1-1-1|
|180078E38|WerUnregisterAppLocalDump|api-ms-win-core-windowserrorreporting-l1-1-2|
|180078E00|WerUnregisterCustomMetadata|api-ms-win-core-windowserrorreporting-l1-1-1|
|180078E20|WerUnregisterExcludedMemoryBlock|api-ms-win-core-windowserrorreporting-l1-1-1|
|180078DE8|WerUnregisterFile|api-ms-win-core-windowserrorreporting-l1-1-0|
|180078DB8|WerUnregisterMemoryBlock|api-ms-win-core-windowserrorreporting-l1-1-0|
|180078DC8|WerUnregisterRuntimeExceptionModule|api-ms-win-core-windowserrorreporting-l1-1-0|
|180078A48|WideCharToMultiByte|api-ms-win-core-string-l1-1-0|
|180078E50|Wow64DisableWow64FsRedirection|api-ms-win-core-wow64-l1-1-0|
|180078E60|Wow64RevertWow64FsRedirection|api-ms-win-core-wow64-l1-1-0|
|180077580|WriteConsoleA|api-ms-win-core-console-l1-1-0|
|1800776A0|WriteConsoleInputA|api-ms-win-core-console-l2-1-0|
|1800776A8|WriteConsoleInputW|api-ms-win-core-console-l2-1-0|
|1800776B0|WriteConsoleOutputA|api-ms-win-core-console-l2-1-0|
|1800776B8|WriteConsoleOutputAttribute|api-ms-win-core-console-l2-1-0|
|1800776C8|WriteConsoleOutputCharacterA|api-ms-win-core-console-l2-1-0|
|1800776D8|WriteConsoleOutputCharacterW|api-ms-win-core-console-l2-1-0|
|1800776D0|WriteConsoleOutputW|api-ms-win-core-console-l2-1-0|
|180077588|WriteConsoleW|api-ms-win-core-console-l1-1-0|
|180077BC8|WriteFile|api-ms-win-core-file-l1-1-0|
|180077BD0|WriteFileEx|api-ms-win-core-file-l1-1-0|
|180077BD8|WriteFileGather|api-ms-win-core-file-l1-1-0|
|1800781E8|WriteProcessMemory|api-ms-win-core-memory-l1-1-0|
|180078A18|ZombifyActCtx|api-ms-win-core-sidebyside-l1-1-0|
|180079A28|ZwClose|ntdll|
|180079A50|ZwCreateFile|ntdll|
|180079A60|ZwCreateSection|ntdll|
|180079A40|ZwEnumerateKey|ntdll|
|180079A90|ZwMapViewOfSection|ntdll|
|180079A30|ZwOpenFile|ntdll|
|180079A38|ZwOpenKey|ntdll|
|180079A68|ZwQueryDirectoryFile|ntdll|
|180079A58|ZwQueryInformationFile|ntdll|
|180079A80|ZwQuerySystemInformation|ntdll|
|180079A48|ZwQueryValueKey|ntdll|
|180079A88|ZwUnmapViewOfSection|ntdll|
|180079B20|__C_specific_handler|ntdll|
|180079B30|_local_unwind|ntdll|
|180079610|_memicmp|ntdll|
|180079928|_stricmp|ntdll|
|1800799B8|_strnicmp|ntdll|
|180079540|_vsnwprintf|ntdll|
|180079B18|_wcsicmp|ntdll|
|180078FA0|_wcslwr|ntdll|
|1800792B0|_wcsnicmp|ntdll|
|180079130|_wtol|ntdll|
|1800791D0|atol|ntdll|
|180079040|bsearch|ntdll|
|180079B38|cos|ntdll|
|180079B40|floor|ntdll|
|1800791E0|isdigit|ntdll|
|180077178|lstrcmpW|KERNELBASE|
|180077180|lstrcmpiW|KERNELBASE|
|180077398|lstrcpynA|KERNELBASE|
|180077390|lstrcpynW|KERNELBASE|
|180077388|lstrlenA|KERNELBASE|
|180077380|lstrlenW|KERNELBASE|
|180079B48|memcmp|ntdll|
|180079B50|memcpy|ntdll|
|180079B28|memmove|ntdll|
|180079138|memmove_s|ntdll|
|180079B58|memset|ntdll|
|180079148|sin|ntdll|
|180079978|strcat_s|ntdll|
|1800798C8|strchr|ntdll|
|180079818|strcpy_s|ntdll|
|1800799C0|strncmp|ntdll|
|180079710|strncpy_s|ntdll|
|180079980|strnlen|ntdll|
|180079900|strrchr|ntdll|
|180079088|swprintf_s|ntdll|
|1800791C8|tolower|ntdll|
|1800791D8|toupper|ntdll|
|1800790E8|towlower|ntdll|
|180079910|wcscat_s|ntdll|
|180079660|wcschr|ntdll|
|180079B60|wcscmp|ntdll|
|1800794A0|wcscpy_s|ntdll|
|180079618|wcscspn|ntdll|
|180078FF0|wcsncmp|ntdll|
|180078FF8|wcsncpy|ntdll|
|180079620|wcsncpy_s|ntdll|
|180079970|wcsnlen|ntdll|
|1800792A8|wcsrchr|ntdll|
|180079658|wcsstr|ntdll|