diff --git a/agent/go/README.md b/agent/go/README.md new file mode 100644 index 00000000000..fc08559cd0a --- /dev/null +++ b/agent/go/README.md @@ -0,0 +1,105 @@ +### Do not use it yet! +* Once it will be ready this header will be removed and changelog.md will be updated! + +# CAPE Agent (Go Port) + +This is a Golang port of the CAPE Sandbox Agent. It is designed to be a drop-in replacement for the Python agent, offering better performance, zero dependencies (no Python installation required to *run* the agent), and improved stealth. + +## Build Instructions + +### Prerequisites +- Go 1.21 or higher + +### Building for Windows (x86) +Most sandboxes use 32-bit Windows environments or require 32-bit compatibility. + +```bash +GOOS=windows GOARCH=386 go build -ldflags="-s -w" -trimpath -o agent.exe +``` + +### Optimized & Small Binaries +To produce the smallest possible binary with no local path leaks: +- `-s`: Omit the symbol table and debug information. +- `-w`: Omit the DWARF symbol table. +- `-trimpath`: Remove all file system paths from the compiled executable. + +#### (Optional) UPX Compression +If you need an extremely small binary (e.g., ~500KB), you can use UPX. +**Note:** UPX-packed binaries are often flagged by AV heuristics. +```bash +upx --best --lzma agent.exe +``` + +### Building for Windows (x64) + +```bash +GOOS=windows GOARCH=amd64 go build -ldflags="-s -w" -trimpath -o agent.exe +``` + +### Building for Linux + +```bash +GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o agent +``` + +## Usage + +In the VM, run the agent: + +```cmd +agent.exe +or specify host and port. Default is 0.0.0.0:8000 +agent.exe -host 0.0.0.0 -port 8000 +``` + +## Features +- **Zero Dependency**: Runs as a standalone binary. +- **Stealth**: Can be renamed to anything (e.g., `svchost.exe`). +- **Compatibility**: Implements the full CAPE Agent API (v0.20). +- **Python Execution**: executing `.py` analysis scripts requires `python.exe` to be in the system `PATH`. + +## Dev Notes +- **Mutexes**: Fully implemented using Windows syscalls. +- **ZipSlip Protection**: Built-in check against path traversal in zip extraction. + +## How to pull file from VM to Host +### Start Agent with Auth (Optional but Recommended): + +* `agent.exe -auth "my-secret-token-123"` + +### Pull a file to HOST (CAPE): +``` +# Host-side logic (e.g., in CAPE's auxiliary module) +requests.post( + "http://:8000/push", + data={"filepath": "C:\\malware_output.txt", "port": "8000"}, + headers={"Authorization": "Bearer my-secret-token-123"} +) +# The agent will POST the file back to http://:8000/upload +``` + +## Agent update +* Consider update on start of the analysis if version mismatch + +How it works (/update endpoint) + 1. Receive: The Host POSTs the new binary to the agent. + 2. Rename: The agent renames its own running executable to agent.exe.old. + 3. Save: It saves the new binary as agent.exe. + 4. Restart: It spawns the new agent.exe. + 5. Exit: The old agent process terminates, releasing port 8000. + * Reliability: A retry loop has been added to the main() function. If the new agent starts before the old one has fully released port 8000, it will retry for 10 seconds instead of crashing. + +Usage + To update the agent on a running VM (from the Host): + +``` +import requests +# Upload the new agent binary +with open("agent_v2.exe", "rb") as f: + requests.post( + "http://:8000/update", + files={"file": f}, + headers={"Authorization": "Bearer "} # If auth is enabled + ) +``` +The agent will respond with 200 OK and then restart itself immediately. diff --git a/agent/go/go.mod b/agent/go/go.mod new file mode 100644 index 00000000000..277a23c2cbd --- /dev/null +++ b/agent/go/go.mod @@ -0,0 +1,5 @@ +module cape-agent + +go 1.21 + +require github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect diff --git a/agent/go/go.sum b/agent/go/go.sum new file mode 100644 index 00000000000..0be91573c06 --- /dev/null +++ b/agent/go/go.sum @@ -0,0 +1,2 @@ +github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= +github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ= diff --git a/agent/go/main.go b/agent/go/main.go new file mode 100644 index 00000000000..a7d5ad66eaa --- /dev/null +++ b/agent/go/main.go @@ -0,0 +1,1161 @@ +package main + +import ( + "archive/zip" + "encoding/base64" + "encoding/json" + "flag" + "fmt" + "io" + "log" + "net" + "net/http" + "os" + "os/exec" + "path/filepath" + "runtime" + "strings" + "sync" + "time" + + "github.com/google/shlex" +) + +const ( + AgentVersion = "0.20" + Base64Encoding = "base64" +) + +var ( + AgentFeatures = []string{ + "execpy", + "execute", + "pinning", + "logs", + "largefile", + "unicodepath", + "push", + "update", + } +) + +var ( + authToken string +) + +func init() { + if runtime.GOOS == "windows" { + AgentFeatures = append(AgentFeatures, "mutex", "browser_extension") + } +} + +// Status enums +const ( + StatusInit = "init" + StatusRunning = "running" + StatusComplete = "complete" + StatusFailed = "failed" + StatusException = "exception" +) + +var TerminalStatuses = map[string]bool{ + StatusComplete: true, + StatusFailed: true, + StatusException: true, +} + +// State holds the agent state +type State struct { + sync.Mutex + Status string + Description string + AsyncSubprocess *exec.Cmd + ClientIP string +} + +var state = State{ + Status: StatusInit, +} + +// AgentMutexes holds handles to Windows mutexes +var agentMutexes = make(map[string]uintptr) +var agentMutexesLock sync.Mutex + +// Browser Extension +var agentBrowserExtPath string +var agentBrowserLock sync.Mutex + +// Stdout/Stderr capture (simple memory buffer for now, similar to Python's StringIO approach if not verbose) +// In a real service, we might want file-based logging or ring buffers. +// For this port, we'll keep it simple or write to a global buffer if we want to support /logs +// But capturing stdout/stderr of the *agent itself* is tricky if we are inside the process. +// The Python agent redirects sys.stdout. We can't easily redirect os.Stdout globally for the http handler to read +// without pipes. We'll stick to logging to os.Stdout/Stderr and maybe capturing if requested, +// but strictly speaking, /logs in the python agent returns the *agent's* internal logs. +// We will omit complex log capturing for this MVP and just return "Not implemented" or simple buffers if needed. +// Actually, let's implement a simple log buffer. + +type LogBuffer struct { + sync.Mutex + buf []byte +} + +func (l *LogBuffer) Write(p []byte) (n int, err error) { + l.Lock() + defer l.Unlock() + l.buf = append(l.buf, p...) + return len(p), nil +} + +func (l *LogBuffer) String() string { + l.Lock() + defer l.Unlock() + return string(l.buf) +} + +var agentLogOut = &LogBuffer{} +var agentLogErr = &LogBuffer{} + +func init() { + // If not verbose, we might want to capture. + // For now, let's just use standard log. +} + +func jsonResponse(w http.ResponseWriter, code int, message string, data map[string]interface{}) { + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(code) + resp := make(map[string]interface{}) + resp["message"] = message + resp["status_code"] = code + for k, v := range data { + resp[k] = v + } + if err := json.NewEncoder(w).Encode(resp); err != nil { + log.Printf("Error encoding JSON: %v", err) + } +} + +func jsonError(w http.ResponseWriter, code int, message string, args ...interface{}) { + data := make(map[string]interface{}) + if len(args) > 0 { + if m, ok := args[0].(map[string]interface{}); ok { + data = m + } + } + data["error_code"] = code + jsonResponse(w, code, message, data) +} + +func jsonSuccess(w http.ResponseWriter, message string, data map[string]interface{}) { + jsonResponse(w, 200, message, data) +} + +func main() { + host := flag.String("host", "0.0.0.0", "Host to bind to") + port := flag.Int("port", 8000, "Port to bind to") + verbose := flag.Bool("v", false, "Verbose logging") + flag.StringVar(&authToken, "auth", "", "Optional: Require this token for all requests (Authorization: Bearer )") + flag.Parse() + + if !*verbose { + // In a real scenario, redirect stdout/stderr to our buffers + // For now, we print to stdout. + } + + http.HandleFunc("/", handleIndex) + http.HandleFunc("/status", handleStatus) + http.HandleFunc("/logs", handleLogs) + http.HandleFunc("/system", handleSystem) + http.HandleFunc("/environ", handleEnviron) + http.HandleFunc("/path", handlePath) + http.HandleFunc("/mkdir", handleMkdir) + http.HandleFunc("/mktemp", handleMktemp) + http.HandleFunc("/mkdtemp", handleMkdtemp) + http.HandleFunc("/store", handleStore) + http.HandleFunc("/retrieve", handleRetrieve) + http.HandleFunc("/push", handlePush) + http.HandleFunc("/update", handleUpdate) + http.HandleFunc("/extract", handleExtract) + http.HandleFunc("/remove", handleRemove) + http.HandleFunc("/execute", handleExecute) + http.HandleFunc("/execpy", handleExecPy) + http.HandleFunc("/pinning", handlePinning) + http.HandleFunc("/kill", handleKill) + http.HandleFunc("/browser_extension", handleBrowserExtension) + http.HandleFunc("/mutex", handleMutex) + + addr := fmt.Sprintf("%s:%d", *host, *port) + fmt.Printf("Starting CAPE Agent on %s\n", addr) + if authToken != "" { + fmt.Println("Authentication enabled.") + } + + server := &http.Server{Addr: addr} + + // Handle graceful shutdown via /kill + // We can run server in a goroutine or just handle it. + + // Retry logic for binding port (useful during self-update restart) + var err error + for i := 0; i < 10; i++ { + err = server.ListenAndServe() + if err == http.ErrServerClosed { + break + } + if err != nil { + // Check for "Address already in use" + if strings.Contains(err.Error(), "address already in use") || strings.Contains(err.Error(), "Only one usage of each socket address") { + fmt.Printf("Port %d busy, retrying in 1s...\n", *port) + time.Sleep(1 * time.Second) + continue + } + log.Fatalf("ListenAndServe(): %v", err) + } + break + } +} + +// checkSecurity middleware-ish logic +func checkSecurity(w http.ResponseWriter, r *http.Request) bool { + // 1. IP Security (Block Localhost / Own IP) + // This prevents malware inside the VM from driving the agent. + clientIP, _, err := net.SplitHostPort(r.RemoteAddr) + if err != nil { + clientIP = r.RemoteAddr + } + + // Always block loopback + if clientIP == "127.0.0.1" || clientIP == "::1" { + // Exception: Status check might be useful locally? + // Python agent allowed status/browser_ext from localhost. + // Strict mode: Block all. + // "The check seems to be preventing *malware inside the VM* (localhost) from using the Agent to escalate?" + // Yes. + // However, for debugging, maybe we want it. But for security, block it. + // Let's stick to strict blocking unless specific minimal endpoints. + if r.URL.Path != "/status" { + http.Error(w, "Access Denied (Localhost)", http.StatusForbidden) + return false + } + } + + // Check against own IP (if we can detect it easily). + // GetLocalIP() gets the outbound IP. + // If clientIP == GetLocalIP(), it's also a self-call. + if clientIP == GetLocalIP() && r.URL.Path != "/status" { + http.Error(w, "Access Denied (Self)", http.StatusForbidden) + return false + } + + // 2. Auth Token (Defense in depth) + if authToken != "" { + authHeader := r.Header.Get("Authorization") + if authHeader == "" { + authHeader = r.FormValue("token") + } + + expected := "Bearer " + authToken + if authHeader != expected && authHeader != authToken { + jsonError(w, 403, "Unauthorized") + return false + } + } + + // 3. IP Pinning (Legacy/Standard Feature) + state.Lock() + defer state.Unlock() + + if state.ClientIP != "" && state.ClientIP != clientIP { + jsonError(w, 403, "Agent pinned to different IP") + return false + } + + return true +} + +func handleIndex(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + isAdmin := IsAdmin() + jsonSuccess(w, "CAPE Agent!", map[string]interface{}{ + "version": AgentVersion, + "features": AgentFeatures, + "is_user_admin": isAdmin, + }) +} + +func handleStatus(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + + if r.Method == "GET" { + state.Lock() + defer state.Unlock() + + // Check async process + if state.Status != StatusComplete && state.AsyncSubprocess != nil { + // Poll process + // In Go, os/exec.Cmd.Process.Signal(syscall.Signal(0)) checks existence, + // but waiting is the only way to get exit code. + // However, since we started it async, we should have a goroutine waiting on it + // that updates the state. + // Implementation Detail: When starting async, we'll spawn a goroutine to Wait() and update state. + + // So here we just return current state. + jsonSuccess(w, "Analysis status", map[string]interface{}{ + "status": state.Status, + "description": state.Description, + "process_id": 0, // We might store PID in state if needed + }) + return + } + + jsonSuccess(w, "Analysis status", map[string]interface{}{ + "status": state.Status, + "description": state.Description, + }) + return + } else if r.Method == "POST" { + status := r.FormValue("status") + if status == "" { + jsonError(w, 400, "No valid status has been provided") + return + } + + s := strings.ToLower(status) + switch s { + case StatusInit, StatusRunning, StatusComplete, StatusFailed, StatusException: + default: + jsonError(w, 400, "Invalid status value provided") + return + } + + state.Lock() + defer state.Unlock() + + if _, terminal := TerminalStatuses[strings.ToLower(status)]; terminal { + state.AsyncSubprocess = nil + } + + state.Status = strings.ToLower(status) + state.Description = r.FormValue("description") + + jsonSuccess(w, "Analysis status updated", nil) + } +} + +func handleLogs(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + jsonSuccess(w, "Agent logs", map[string]interface{}{ + "stdout": agentLogOut.String(), + "stderr": agentLogErr.String(), + }) +} + +func handleSystem(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + jsonSuccess(w, "System", map[string]interface{}{ + "system": runtime.GOOS, + }) +} + +func handleEnviron(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + envMap := make(map[string]string) + for _, e := range os.Environ() { + pair := strings.SplitN(e, "=", 2) + if len(pair) == 2 { + envMap[pair[0]] = pair[1] + } + } + jsonSuccess(w, "Environment variables", map[string]interface{}{ + "environ": envMap, + }) +} + +func handlePath(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + ex, err := os.Executable() + if err != nil { + ex = os.Args[0] + } + path, _ := filepath.Abs(ex) + jsonSuccess(w, "Agent path", map[string]interface{}{ + "filepath": path, + }) +} + +func handleMkdir(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + if r.Method != "POST" { + http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) + return + } + dirpath := r.FormValue("dirpath") + if dirpath == "" { + jsonError(w, 400, "No dirpath has been provided") + return + } + + // mode ignored for now, or we can parse it + err := os.MkdirAll(dirpath, 0777) + if err != nil { + jsonError(w, 500, "Error creating directory", map[string]interface{}{"traceback": err.Error()}) + return + } + jsonSuccess(w, "Successfully created directory", nil) +} + +func handleMktemp(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + suffix := r.FormValue("suffix") + prefix := r.FormValue("prefix") + dirpath := r.FormValue("dirpath") + if dirpath == "" { + dirpath = os.TempDir() + } + + f, err := os.CreateTemp(dirpath, prefix+"*"+suffix) + if err != nil { + jsonError(w, 500, "Error creating temporary file", map[string]interface{}{"traceback": err.Error()}) + return + } + f.Close() + jsonSuccess(w, "Successfully created temporary file", map[string]interface{}{"filepath": f.Name()}) +} + +func handleMkdtemp(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + suffix := r.FormValue("suffix") + prefix := r.FormValue("prefix") + dirpath := r.FormValue("dirpath") + if dirpath == "" { + dirpath = os.TempDir() + } + + d, err := os.MkdirTemp(dirpath, prefix+"*"+suffix) + if err != nil { + jsonError(w, 500, "Error creating temporary directory", map[string]interface{}{"traceback": err.Error()}) + return + } + + // Windows ICACLS equivalent + ApplyMkdtempPermissions(d) + + jsonSuccess(w, "Successfully created temporary directory", map[string]interface{}{"dirpath": d}) +} + +func handleStore(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + if r.Method != "POST" { + http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) + return + } + + filepathStr := r.FormValue("filepath") + if filepathStr == "" { + jsonError(w, 400, "No filepath has been provided") + return + } + + file, _, err := r.FormFile("file") + if err != nil { + jsonError(w, 400, "No file has been provided") + return + } + defer file.Close() + + out, err := os.Create(filepathStr) + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error storing file: %v", err)) + return + } + defer out.Close() + + _, err = io.Copy(out, file) + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error storing file: %v", err)) + return + } + + jsonSuccess(w, "Successfully stored file", nil) +} + +func handleRetrieve(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + if r.Method != "POST" { + http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) + return + } + + filepathStr := r.FormValue("filepath") + if filepathStr == "" { + jsonError(w, 400, "No filepath has been provided") + return + } + + // Check if file exists + if _, err := os.Stat(filepathStr); os.IsNotExist(err) { + jsonError(w, 404, "File not found") + return + } + + // Encoding + encoding := r.FormValue("encoding") + // Streaming + // streaming := r.FormValue("streaming") // Not implementing full streaming for now + + f, err := os.Open(filepathStr) + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error reading file: %v", err)) + return + } + defer f.Close() + + if encoding == Base64Encoding { + // Read all and encode + data, err := io.ReadAll(f) + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error reading file: %v", err)) + return + } + w.WriteHeader(200) + encoder := base64.NewEncoder(base64.StdEncoding, w) + encoder.Write(data) + encoder.Close() + } else { + // Just serve file + http.ServeFile(w, r, filepathStr) + } +} + +func handleUpdate(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + if r.Method != "POST" { + http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) + return + } + file, _, err := r.FormFile("file") + if err != nil { + jsonError(w, 400, "No file provided") + return + } + defer file.Close() + + // 1. Determine paths + currentExe, err := os.Executable() + if err != nil { + jsonError(w, 500, fmt.Sprintf("Cannot find own executable path: %v", err)) + return + } + + // Check permissions/directory + dir := filepath.Dir(currentExe) + newExe := currentExe + ".new" + oldExe := currentExe + ".old" + + // Clean up previous leftovers if any + os.Remove(newExe) + os.Remove(oldExe) + + // 2. Save new binary + out, err := os.Create(newExe) + if err != nil { + jsonError(w, 500, fmt.Sprintf("Cannot create new file: %v", err)) + return + } + _, err = io.Copy(out, file) + out.Close() + if err != nil { + jsonError(w, 500, fmt.Sprintf("Cannot save new file: %v", err)) + return + } + + // Make executable (Linux/Mac) + os.Chmod(newExe, 0755) + + // 3. Rename-Replace Dance + // Windows allows renaming the running binary. + if err := os.Rename(currentExe, oldExe); err != nil { + jsonError(w, 500, fmt.Sprintf("Failed to move current exe: %v", err)) + os.Remove(newExe) + return + } + + if err := os.Rename(newExe, currentExe); err != nil { + // Try to rollback + os.Rename(oldExe, currentExe) + jsonError(w, 500, fmt.Sprintf("Failed to replace exe: %v", err)) + return + } + + // 4. Spawn new process + // We pass the same arguments. + cmd := exec.Command(currentExe, os.Args[1:]...) + cmd.Dir = dir + + // Detach process logic varies by OS, but Start() usually leaves it running if we exit main. + // On Windows, it's fine. + if err := cmd.Start(); err != nil { + // Rollback attempt + os.Rename(oldExe, currentExe) // Might fail if locked now? + jsonError(w, 500, fmt.Sprintf("Failed to restart agent: %v", err)) + return + } + + jsonSuccess(w, "Agent updated and restarting", nil) + + // 5. Commit Suicide (Gracefully) + go func() { + time.Sleep(1 * time.Second) // Give the response time to flush + os.Exit(0) + }() +} + +func handlePush(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + + if r.Method != "POST" { + http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) + return + } + + filepathStr := r.FormValue("filepath") + + // Security: We only upload back to the Caller (Requestor). + // We ignore "target_url" if it points to a different IP. + // Actually, let's just use the Caller IP and a provided port (or default 8000). + + if filepathStr == "" { + jsonError(w, 400, "No filepath provided") + return + } + + // Open file + f, err := os.Open(filepathStr) + if err != nil { + jsonError(w, 404, fmt.Sprintf("File not found: %v", err)) + return + } + defer f.Close() + + // Determine target + clientIP, _, err := net.SplitHostPort(r.RemoteAddr) + if err != nil { + clientIP = r.RemoteAddr + } + + // Allow user to specify port? + // For simplicity, let's assume standard CAPE resultserver port or provided in "port" param. + targetPort := r.FormValue("port") + if targetPort == "" { + targetPort = "8000" + } // Default CAPE port? Usually 2042 or 8000. + + // Allow specific path? + uploadPath := r.FormValue("upload_path") + if uploadPath == "" { + uploadPath = "/upload" + } // Standard path + + targetURL := fmt.Sprintf("http://%s:%s%s", clientIP, targetPort, uploadPath) + + // Do upload + req, err := http.NewRequest("POST", targetURL, f) + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error creating request: %v", err)) + return + } + req.Header.Set("Content-Type", "application/octet-stream") + req.Header.Set("X-Filename", filepath.Base(filepathStr)) + + client := &http.Client{Timeout: 60 * time.Second} + resp, err := client.Do(req) + if err != nil { + jsonError(w, 502, fmt.Sprintf("Error uploading to %s: %v", targetURL, err)) + return + } + defer resp.Body.Close() + + respBody, _ := io.ReadAll(resp.Body) + if resp.StatusCode >= 400 { + jsonError(w, resp.StatusCode, fmt.Sprintf("Upload failed: %s", string(respBody))) + return + } + + jsonSuccess(w, "File uploaded successfully", nil) +} + +func handleExtract(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + if r.Method != "POST" { + http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) + return + } + + dirpath := r.FormValue("dirpath") + if dirpath == "" { + jsonError(w, 400, "No dirpath has been provided") + return + } + + file, _, err := r.FormFile("zipfile") + if err != nil { + jsonError(w, 400, "No zip file has been provided") + return + } + defer file.Close() + + // Create a temp file to store zip content because zip.NewReader needs ReaderAt + tmpZip, err := os.CreateTemp("", "capezip-*.zip") + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error creating temp zip: %v", err)) + return + } + defer os.Remove(tmpZip.Name()) + defer tmpZip.Close() + + _, err = io.Copy(tmpZip, file) + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error saving temp zip: %v", err)) + return + } + + // Re-open for reading + zipReader, err := zip.OpenReader(tmpZip.Name()) + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error opening zip: %v", err)) + return + } + defer zipReader.Close() + + for _, zf := range zipReader.File { + fpath := filepath.Join(dirpath, zf.Name) + + // Check for ZipSlip + if !strings.HasPrefix(fpath, filepath.Clean(dirpath)+string(os.PathSeparator)) { + continue // Invalid file path + } + + if zf.FileInfo().IsDir() { + os.MkdirAll(fpath, os.ModePerm) + continue + } + + if err := os.MkdirAll(filepath.Dir(fpath), os.ModePerm); err != nil { + jsonError(w, 500, fmt.Sprintf("Error creating dir: %v", err)) + return + } + + outFile, err := os.OpenFile(fpath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, zf.Mode()) + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error creating file: %v", err)) + return + } + + rc, err := zf.Open() + if err != nil { + outFile.Close() + jsonError(w, 500, fmt.Sprintf("Error extracting file: %v", err)) + return + } + + _, err = io.Copy(outFile, rc) + outFile.Close() + rc.Close() + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error writing file: %v", err)) + return + } + } + + jsonSuccess(w, "Successfully extracted zip file", nil) +} + +func handleRemove(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + path := r.FormValue("path") + if path == "" { + jsonError(w, 400, "No path has been provided") + return + } + + // Force remove + err := os.RemoveAll(path) + if err != nil { + jsonError(w, 500, "Error removing file or directory") + return + } + jsonSuccess(w, "Successfully deleted file/directory", nil) +} + +func handleExecute(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + if r.Method != "POST" { + http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) + return + } + + command := r.FormValue("command") + if command == "" { + jsonError(w, 400, "No command has been provided") + return + } + + // Security check for execute (same as Python) + localIP := GetLocalIP() + clientIP, _, _ := net.SplitHostPort(r.RemoteAddr) + if clientIP == "" { + clientIP = r.RemoteAddr + } + + allowedCommands := map[string]bool{"date": true, "cmd /c date /t": true} + + isLocal := (clientIP == "127.0.0.1" || clientIP == "::1" || clientIP == localIP) + if isLocal && !allowedCommands[command] { + // In Python agent: if request.client_ip in ("127.0.0.1", local_ip) and command not in allowed: return 500 + // Wait, this logic in python agent seems to restrict LOCALHOST from executing arbitrary commands? + // Ah, "only allow date command from localhost. Even this is just to let it be tested" + // So remote hosts CAN execute commands? + // Logic in python: + // if request.client_ip in ("127.0.0.1", local_ip) and request.form["command"] not in allowed_commands: + // return json_error(500, "Not allowed to execute commands") + // This implies remote IPs are fine? That's weird for a sandbox, usually it's the opposite. + // But in a sandbox, the controller (Host) calls the Agent (Guest). + // If the Agent is exposed to the internet, anyone can run commands. + // But usually Agent is on a private network. + // The check seems to be preventing *malware inside the VM* (localhost) from using the Agent to escalate? + // Yes, that makes sense. Malware running on localhost shouldn't be able to drive the agent. + + jsonError(w, 500, "Not allowed to execute commands") + return + } + + asyncExec := r.FormValue("async") != "" + // shell := r.FormValue("shell") != "" // Go exec.Command doesn't support "shell=True" directly like Python. + // We have to wrap in cmd /c or sh -c if we want shell features. + // But `shlex.split` in Python splits args. + // Here we should probably just execute directly if possible or split args. + // For simplicity, let's just attempt to split string. + + // Robust splitting for quoted arguments + parts, err := shlex.Split(command) + if err != nil { + jsonError(w, 400, fmt.Sprintf("Error parsing command: %v", err)) + return + } + if len(parts) == 0 { + jsonError(w, 400, "Empty command") + return + } + + cmd := exec.Command(parts[0], parts[1:]...) + cwd := r.FormValue("cwd") + if cwd != "" { + cmd.Dir = cwd + } + + if asyncExec { + err := cmd.Start() + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error executing command: %v", err)) + return + } + // We need to wait for it somewhere to avoid zombies, but "async" implies fire and forget? + // Python agent stores it in `state.async_subprocess`. + state.Lock() + state.Status = StatusRunning + state.Description = "" + state.AsyncSubprocess = cmd + state.Unlock() + + // Spawn waiter to clean up + go func() { + cmd.Wait() + // Update state on completion? + state.Lock() + if state.AsyncSubprocess == cmd { + state.Status = StatusComplete + if !cmd.ProcessState.Success() { + state.Status = StatusFailed + state.Description = fmt.Sprintf("Exited with code %d", cmd.ProcessState.ExitCode()) + } else { + state.Description = "" + } + state.AsyncSubprocess = nil + } + state.Unlock() + }() + + jsonSuccess(w, "Successfully executed command", nil) + return + } + + // Sync exec + // Re-create cmd to use separate buffers + cmd = exec.Command(parts[0], parts[1:]...) + if cwd != "" { + cmd.Dir = cwd + } + var stdoutBuf, stderrBuf strings.Builder + cmd.Stdout = &stdoutBuf + cmd.Stderr = &stderrBuf + + err = cmd.Run() + + stdoutBytes := []byte(stdoutBuf.String()) + stderrBytes := []byte(stderrBuf.String()) + + var data map[string]interface{} + if r.FormValue("encoding") == Base64Encoding { + data = map[string]interface{}{ + "stdout": base64.StdEncoding.EncodeToString(stdoutBytes), + "stderr": base64.StdEncoding.EncodeToString(stderrBytes), + } + } else { + data = map[string]interface{}{ + "stdout": string(stdoutBytes), + "stderr": string(stderrBytes), + } + } + + if err != nil { + state.Lock() + state.Status = StatusFailed + state.Description = "Error execute command" + state.Unlock() + jsonError(w, 500, fmt.Sprintf("Error executing command: %v", err), data) + return + } + + state.Lock() + state.Status = StatusComplete + state.Description = "" + state.Unlock() + + jsonSuccess(w, "Successfully executed command", data) +} + +func handleExecPy(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + if r.Method != "POST" { + http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) + return + } + + filepathStr := r.FormValue("filepath") + if filepathStr == "" { + jsonError(w, 400, "No Python file has been provided") + return + } + + asyncExec := r.FormValue("async") != "" + cwd := r.FormValue("cwd") + + // Determine python executable + pythonPath := "python" // Default + // Could use flag or env var + + cmd := exec.Command(pythonPath, filepathStr) + if cwd != "" { + cmd.Dir = cwd + } + + if asyncExec { + state.Lock() + if state.Status == StatusRunning && state.AsyncSubprocess != nil { + state.Unlock() + jsonError(w, 400, "Async process already running.") + return + } + state.Unlock() + + err := cmd.Start() + if err != nil { + jsonError(w, 500, fmt.Sprintf("Error spawning python: %v", err)) + return + } + + state.Lock() + state.Status = StatusRunning + state.Description = "" + state.AsyncSubprocess = cmd + state.Unlock() + + go func() { + cmd.Wait() + state.Lock() + if state.AsyncSubprocess == cmd { + state.Status = StatusComplete + if !cmd.ProcessState.Success() { + state.Status = StatusFailed + state.Description = "Error executing python command." + } + state.AsyncSubprocess = nil // Python clears it? + // Python: "Process completed; reset async subprocess state." in get_subprocess_status + } + state.Unlock() + }() + + jsonSuccess(w, "Successfully spawned command", map[string]interface{}{ + "process_id": cmd.Process.Pid, + }) + return + } + + // Sync + var stdoutBuf, stderrBuf strings.Builder + cmd.Stdout = &stdoutBuf + cmd.Stderr = &stderrBuf + + err := cmd.Run() + + stdout := stdoutBuf.String() + stderr := stderrBuf.String() + + if r.FormValue("encoding") == Base64Encoding { + stdout = base64.StdEncoding.EncodeToString([]byte(stdout)) + stderr = base64.StdEncoding.EncodeToString([]byte(stderr)) + } + + if err != nil { + state.Lock() + state.Status = StatusFailed + state.Description = "Error executing Python command" + state.Unlock() + + // Return error but with stdout/stderr + jsonError(w, 400, "Error executing python command.", map[string]interface{}{ + "stdout": stdout, + "stderr": stderr, + "exitcode": cmd.ProcessState.ExitCode(), + }) + return + } + + state.Lock() + state.Status = StatusComplete + state.Description = "" + state.Unlock() + + jsonSuccess(w, "Successfully executed command", map[string]interface{}{ + "stdout": stdout, + "stderr": stderr, + }) +} + +func handlePinning(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + state.Lock() + defer state.Unlock() + + if state.ClientIP != "" { + jsonError(w, 500, "Agent has already been pinned to an IP!") + return + } + + host, _, err := net.SplitHostPort(r.RemoteAddr) + if err != nil { + host = r.RemoteAddr + } + state.ClientIP = host + + jsonSuccess(w, "Successfully pinned Agent", map[string]interface{}{ + "client_ip": host, + }) +} + +func handleKill(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + jsonSuccess(w, "Quit the CAPE Agent", nil) + go func() { + time.Sleep(100 * time.Millisecond) + os.Exit(0) + }() +} + +func handleBrowserExtension(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + agentBrowserLock.Lock() + defer agentBrowserLock.Unlock() + + if agentBrowserExtPath == "" { + tmpDir, err := os.MkdirTemp("", "") + if err != nil { + jsonError(w, 500, "Error creating temp dir") + return + } + // Random name + agentBrowserExtPath = filepath.Join(tmpDir, "bext_random.json") + } + + data := r.FormValue("networkData") + if data != "" { + os.WriteFile(agentBrowserExtPath, []byte(data), 0644) + } + + jsonSuccess(w, "OK", nil) +} + +func handleMutex(w http.ResponseWriter, r *http.Request) { + if !checkSecurity(w, r) { + return + } + // Wrapper to call platform specific implementation + HandleMutexPlatform(w, r) +} + +// Helpers + +func GetLocalIP() string { + addrs, err := net.InterfaceAddrs() + if err != nil { + return "" + } + for _, address := range addrs { + if ipnet, ok := address.(*net.IPNet); ok && !ipnet.IP.IsLoopback() { + if ipnet.IP.To4() != nil { + return ipnet.IP.String() + } + } + } + return "" +} diff --git a/agent/go/platform_unix.go b/agent/go/platform_unix.go new file mode 100644 index 00000000000..b12e4943b58 --- /dev/null +++ b/agent/go/platform_unix.go @@ -0,0 +1,18 @@ +package main + +import ( + "net/http" + "runtime" +) + +func IsAdmin() bool { + return false // Simplification for non-windows or non-root +} + +func ApplyMkdtempPermissions(path string) { + // No-op for unix usually, or chmod +} + +func HandleMutexPlatform(w http.ResponseWriter, r *http.Request) { + jsonError(w, 400, "mutex feature not supported on "+runtime.GOOS) +} diff --git a/agent/go/platform_windows.go b/agent/go/platform_windows.go new file mode 100644 index 00000000000..8ccb57cf0a5 --- /dev/null +++ b/agent/go/platform_windows.go @@ -0,0 +1,147 @@ +package main + +import ( + "fmt" + "net/http" + "os/exec" + "sync" + "syscall" + "unsafe" +) + +var ( + kernel32 = syscall.NewLazyDLL("kernel32.dll") + procOpenMutexW = kernel32.NewProc("OpenMutexW") + procCreateMutexW = kernel32.NewProc("CreateMutexW") + procReleaseMutex = kernel32.NewProc("ReleaseMutex") + procWaitForSingleObject = kernel32.NewProc("WaitForSingleObject") + + shell32 = syscall.NewLazyDLL("shell32.dll") + procIsUserAnAdmin = shell32.NewProc("IsUserAnAdmin") +) + +const ( + SYNCHRONIZE = 0x00100000 + WAIT_ABANDONED = 0x00000080 + WAIT_OBJECT_0 = 0x00000000 + WAIT_TIMEOUT = 0x00000102 + WAIT_FAILED = 0xFFFFFFFF + ERROR_FILE_NOT_FOUND = 2 + MUTEX_TIMEOUT_MS = 500 +) + +func IsAdmin() bool { + ret, _, _ := procIsUserAnAdmin.Call() + return ret != 0 +} + +func ApplyMkdtempPermissions(path string) { + // subprocess.call(["icacls", dirpath, "/inheritance:e", "/grant", "*S-1-5-32-545:(OI)(CI)(RX)"]) + cmd := exec.Command("icacls", path, "/inheritance:e", "/grant", "*S-1-5-32-545:(OI)(CI)(RX)") + cmd.Run() +} + +func openMutex(name string) (uintptr, error) { + namePtr, _ := syscall.UTF16PtrFromString(name) + ret, _, err := procOpenMutexW.Call( + uintptr(SYNCHRONIZE), + 0, + uintptr(unsafe.Pointer(namePtr)), + ) + if ret == 0 { + return 0, err + } + return ret, nil +} + +func waitMutex(handle uintptr) (bool, error) { + ret, _, err := procWaitForSingleObject.Call(handle, uintptr(MUTEX_TIMEOUT_MS)) + if ret == WAIT_ABANDONED || ret == WAIT_OBJECT_0 { + return true, nil + } + if ret == WAIT_TIMEOUT { + return false, fmt.Errorf("timeout") + } + return false, err +} + +func releaseMutex(handle uintptr) (bool, error) { + ret, _, err := procReleaseMutex.Call(handle) + if ret == 0 { + return false, err + } + return true, nil +} + +func HandleMutexPlatform(w http.ResponseWriter, r *http.Request) { + if r.Method == "POST" { + mutexName := r.FormValue("mutex") + if mutexName == "" { + jsonError(w, 400, "no mutex provided") + return + } + + agentMutexesLock.Lock() + defer agentMutexesLock.Unlock() + + if _, ok := agentMutexes[mutexName]; ok { + jsonSuccess(w, fmt.Sprintf("have mutex: %s", mutexName), nil) + return + } + + h, err := openMutex(mutexName) + if err != nil { + // Windows error handling can be tricky to map exactly to "Not found" vs "Access denied" + // But for now: + jsonError(w, 404, fmt.Sprintf("mutex not found or error: %v", err)) + return + } + + ok, err := waitMutex(h) + if ok { + agentMutexes[mutexName] = h + // Success 201 + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(201) + fmt.Fprintf(w, `{"message": "got mutex: %s", "status_code": 201}`, mutexName) + return + } + + syscall.CloseHandle(syscall.Handle(h)) // Close if we didn't store it? + // Wait, if we failed to wait, we might not own it. + + jsonError(w, 408, fmt.Sprintf("timeout or error waiting for mutex: %v", err)) + return + } else if r.Method == "DELETE" { + mutexName := r.FormValue("mutex") + if mutexName == "" { + jsonError(w, 400, "no mutex provided") + return + } + + agentMutexesLock.Lock() + defer agentMutexesLock.Unlock() + + h, ok := agentMutexes[mutexName] + if !ok { + jsonError(w, 404, fmt.Sprintf("mutex does not exist: %s", mutexName)) + return + } + + delete(agentMutexes, mutexName) + + ok, err := releaseMutex(h) + syscall.CloseHandle(syscall.Handle(h)) // Always close handle after releasing? + // The python code just calls ReleaseMutex. It keeps the handle open? + // "hndl_mutex = agent_mutexes.pop(mutex_name); ok, error = release_mutex(hndl_mutex)" + // It doesn't seem to CloseHandle explicitly in the snippet provided, but Python might GC it or it just stays open? + // In Go/C, we must close it. + + if ok { + jsonSuccess(w, fmt.Sprintf("released mutex: %s", mutexName), nil) + } else { + jsonError(w, 500, fmt.Sprintf("failed releasing mutex: %v", err)) + } + return + } +} diff --git a/conf/default/distributed.conf.default b/conf/default/distributed.conf.default index 9d2afaccce7..f8f6f0ef4ed 100644 --- a/conf/default/distributed.conf.default +++ b/conf/default/distributed.conf.default @@ -22,6 +22,8 @@ nfs = no # Do not copy from workers following folders and files: ignore_patterns = binary, dump_sorted.pcap, memory.dmp, logs main_server_name = master +# When using "Go Fast-Fetcher". Change to yes! +submit_only = no [NFS] # Path will be $CAPE_ROOT/$nfs_mount_folder. Ex: /opt/CAPEv2/workers @@ -45,3 +47,4 @@ instance_name = cape-server [gcs] enabled = no +delete_after_upload = no diff --git a/report.html b/report.html index 459946975b0..7e9b17e1610 100644 --- a/report.html +++ b/report.html @@ -36,16 +36,16 @@
- + - - + +
- +
Detections

- - Formbook - + + Formbook +

@@ -98,24 +98,24 @@ Malware Config(s)
- - - + + + - + - + - + - +
Type Formbook Config
Extracted From - +
- - - + + +
CNCs www.9206mgrgr.one
raw @@ -188,15 +188,15 @@

- + - - - - - - - + + + + + + +
@@ -240,59 +240,59 @@

Analysis & Machine Summary

- +
- +

File Details - +

- - - + + +
- - + + - + - - + + - - - - - - - - - + + + + + + + + + @@ -309,127 +309,127 @@

File Details [Bazaar]

- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - + + + + + + + + + - - + + - - + +
Filename - +
binary
- +
File Type PE32 executable (GUI) Intel 80386, for MS Windows
File Size 721408 bytes
MD5 bc352a63e8fb9e42a955285345025e75
SHA3-384 ac08be96efb0469fef293a90aaa1af1701a05359822ec41c73a8118dfaf6a443188c388f5d149e82b22ee18b64929a72
CRC32 A442911F
TLSH T175E4235746C1E8A9D66173708836CCA05A743C705E06A62B876DF2BFAC32347DD2B71A
Ssdeep 12288:/z7hU5I5yuNHIgzSFKxWltRohBfSTso93U618R4nJk5a9RJ/jYyZc6NAYjLLO7:/f+iN57Gtene3xhMqsyjAYLL0
- - - - - + + + + + - - - - - - + + + + + +
- +

PE Information

- - - - - - - - + + + + + + + + - - - - + + + + - + - - + + - - + + - - + + - - + + - - - + + + - - + + - - + + - - + + - - + + - - + + - - + +
Image BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionCompile TimeImport HashImage BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionCompile TimeImport Hash IconIcon Exact HashIcon Similarity HashIcon DHashIcon Exact HashIcon Similarity HashIcon DHash
0x004000000x001386900x000000000x000baaa75.12025-11-24 12:30:4121371b611d91188d602926b15db6bd483d5dc4e5a911bee7292a914140092c8ca788a1c8239f81d6e401dd187d68f45eb2b2e3e3e3a3a200
- +

Version Infos

@@ -438,21 +438,21 @@

Version Infos
Translation 0x0809 0x04b0
- - - + + +

Sections

@@ -466,7 +466,7 @@

Sections

Characteristics Entropy - + UPX0 0x00000400 @@ -476,7 +476,7 @@

Sections

IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00 - + UPX1 0x00000400 @@ -486,7 +486,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 7.94 - + .rsrc 0x0005ce00 @@ -496,16 +496,16 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 7.92 - +
- - - + + +
@@ -527,7 +527,7 @@
Entropy File type - + RT_ICON 0x001395ac @@ -537,7 +537,7 @@
3.66 None - + RT_ICON 0x001396d8 @@ -547,7 +547,7 @@
2.06 None - + RT_ICON 0x00139804 @@ -557,7 +557,7 @@
2.25 None - + RT_ICON 0x00139930 @@ -567,7 +567,7 @@
3.65 None - + RT_ICON 0x00139c1c @@ -577,7 +577,7 @@
3.44 None - + RT_ICON 0x00139d48 @@ -587,7 +587,7 @@
4.16 None - + RT_ICON 0x0013abf4 @@ -597,7 +597,7 @@
4.07 None - + RT_ICON 0x0013b4a0 @@ -607,7 +607,7 @@
2.18 None - + RT_ICON 0x0013ba0c @@ -617,7 +617,7 @@
4.52 None - + RT_ICON 0x0013dfb8 @@ -627,7 +627,7 @@
4.65 None - + RT_ICON 0x0013f064 @@ -637,7 +637,7 @@
4.39 None - + RT_MENU 0x000da4a0 @@ -647,7 +647,7 @@
0.00 None - + RT_STRING 0x000da4f0 @@ -657,7 +657,7 @@
0.00 None - + RT_STRING 0x000daa84 @@ -667,7 +667,7 @@
0.00 None - + RT_STRING 0x000db110 @@ -677,7 +677,7 @@
0.00 None - + RT_STRING 0x000db5a0 @@ -687,7 +687,7 @@
0.00 None - + RT_STRING 0x000dbb9c @@ -697,7 +697,7 @@
0.00 None - + RT_STRING 0x000dc1f8 @@ -707,7 +707,7 @@
7.64 None - + RT_STRING 0x000dc660 @@ -717,7 +717,7 @@
7.15 None - + RT_RCDATA 0x0013f4d0 @@ -727,7 +727,7 @@
8.00 None - + RT_GROUP_ICON 0x0018b880 @@ -737,7 +737,7 @@
2.87 None - + RT_GROUP_ICON 0x0018b8fc @@ -747,7 +747,7 @@
2.02 None - + RT_GROUP_ICON 0x0018b914 @@ -757,7 +757,7 @@
1.84 None - + RT_GROUP_ICON 0x0018b92c @@ -767,7 +767,7 @@
2.02 None - + RT_VERSION 0x0018b944 @@ -777,7 +777,7 @@
2.78 None - + RT_MANIFEST 0x0018ba24 @@ -787,17 +787,17 @@
5.40 None - +
- - + +
- +
@@ -808,23 +808,23 @@
- +
• 0x58bf90 LoadLibraryA
- +
• 0x58bf94 GetProcAddress
- +
• 0x58bf98 VirtualProtect
- +
• 0x58bf9c VirtualAlloc
- +
• 0x58bfa0 VirtualFree
- +
• 0x58bfa4 ExitProcess
- +
- +
@@ -835,13 +835,13 @@
- +
• 0x58bfac GetAce
- +
- +
@@ -852,13 +852,13 @@
- +
• 0x58bfb4 ImageList_Remove
- +
- +
@@ -869,13 +869,13 @@
- +
• 0x58bfbc GetSaveFileNameW
- +
- +
@@ -886,13 +886,13 @@
- +
• 0x58bfc4 LineTo
- +
- +
@@ -903,13 +903,13 @@
- +
• 0x58bfcc IcmpSendEcho
- +
- +
@@ -920,13 +920,13 @@
- +
• 0x58bfd4 WNetGetConnectionW
- +
- +
@@ -937,13 +937,13 @@
- +
• 0x58bfdc CoGetObject
- +
- +
@@ -954,13 +954,13 @@
- +
• 0x58bfe4 OleLoadPicture
- +
- +
@@ -971,13 +971,13 @@
- + - +
- +
@@ -988,13 +988,13 @@
- +
• 0x58bff4 DragFinish
- +
- +
@@ -1005,13 +1005,13 @@
- +
• 0x58bffc GetDC
- +
- +
@@ -1022,13 +1022,13 @@
- +
• 0x58c004 LoadUserProfileW
- +
- +
@@ -1039,13 +1039,13 @@
- +
• 0x58c00c IsThemeActive
- +
- +
@@ -1056,13 +1056,13 @@
- +
• 0x58c014 VerQueryValueW
- +
- +
@@ -1073,13 +1073,13 @@
- +
• 0x58c01c FtpOpenFileW
- +
- +
@@ -1090,13 +1090,13 @@
- +
• 0x58c024 timeGetTime
- +
- +
@@ -1107,30 +1107,30 @@
- +
• 0x58c02c connect
- +
- +
- +
- - - + + +
- - - - - - - - + + + + + + + + @@ -1155,19 +1155,19 @@
- - @@ -1175,8 +1175,8 @@
- @@ -1187,39 +1187,39 @@
- - @@ -1240,76 +1240,76 @@
- - - - @@ -1333,75 +1333,75 @@
- - - @@ -1425,89 +1425,89 @@
- - - @@ -1531,33 +1531,33 @@
- @@ -1581,33 +1581,33 @@
- - @@ -1631,13 +1631,13 @@
- @@ -1661,34 +1661,34 @@
- @@ -1744,138 +1744,138 @@
- - - - - - - @@ -1897,8 +1897,8 @@
- @@ -1909,10 +1909,10 @@
- @@ -2001,81 +2001,81 @@
- - - - @@ -2092,46 +2092,46 @@
- - - - - @@ -2151,34 +2151,34 @@
- - @@ -2201,25 +2201,25 @@
- @@ -2234,66 +2234,66 @@
- - - @@ -2316,8 +2316,8 @@
- @@ -2335,725 +2335,725 @@
- - - - - - @@ -3062,8 +3062,8 @@
- @@ -3074,50 +3074,50 @@
- @@ -3204,29 +3204,29 @@
- - - - - @@ -3239,706 +3239,706 @@
- @@ -3950,89 +3950,89 @@
- + - - + + - +
Signatures
- +
    - - + +
  • Queries the keyboard layout
    • - - - + + +
  • Queries the computer locale (possible geofencing)
    • - - - + + +
  • SetUnhandledExceptionFilter detected (possible anti-debug)
    • - - - + + +
  • Possible date expiration check, exits too soon after checking local time
    • - - - + + +
  • Checks system language via registry key (possible geofencing)
    • - - - + + +
  • Resumed a thread in another process
    • - - - + + +
  • Writes to the memory another process
    • - - - + + +
  • Reads from the memory of another process
    • - - - + + +
  • Reads data out of its own binary image
    • - - - + + +
  • The binary contains an unknown PE section name indicative of packing
    • - - - + + +
  • The binary likely contains encrypted or compressed data
    • - - - + + +
  • Creates RWX memory
    • - - - + + +
  • Resolves a suspicious Top Level Domain (TLD)
    • - - - + + +
  • Installs itself for autorun at Windows startup
    • - - - + + +
  • Yara detections observed in process dumps, payloads or dropped files
    • - - + +
- +
@@ -4043,9 +4043,9 @@

Screenshots

- +

No screenshots available.

- +
@@ -4055,7 +4055,7 @@

Screenshots

Network Analysis

- +
- +

Nothing to display.

- + - + - + - + - + - + - + - + - + - + - + - +
Name Response
www.9206mgrgr.one - +
www.oi3tf2.vip - +
www.thisismy.gallery - +
www.fruitmyday.ie - +
www.lrme.xyz - +
www.qeltrbu.sbs - +
www.659965.com - +
www.desamiantage-expert.fr - +
www.melvix.life - +
www.esra-ozer.com - +
- +

Nothing to display.

- + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - +
IP Address Port
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
8.8.8.8 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
192.168.1.1 53
- +

No HTTP(s) requests performed.

- +

Nothing to display.

- +

Nothing to display.

- +

Nothing to display.

- +
@@ -4354,10 +4354,10 @@

Network Analysis

Dropped Files

- - + +
- +
@@ -4370,51 +4370,51 @@
- - + + - + - - + + - + - - - - - - - - - + + + + + + + + + @@ -4431,63 +4431,63 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - - - - - - - + + + + + + + + + + + + - +
Filename - +
neophobic
- +
File Type ASCII text, with very long lines (28674), with no line terminators
Associated Filenames - +
C:\Users\Louise\AppData\Local\Temp\neophobic
- +
File Size 28674 bytes
MD5 655ec08496bb51ccc34724c2fcc26a97
SHA3-384 0669c30793bf455b9444908275b1f98a767832294a529930564d8a4beccf3203618efa1a0edc303ff7446e5dafda33a5
CRC32 BDF65310
TLSH T123D2CB602C6F09E035ADC570F30CDB7CAE61D2553C9D6127CD872D738272A11A46ABEE
Ssdeep 192:aIU0YzxURqp0mXY+15jeDE49yry+a9ydK7esTlUlh2z3LD1LXVBvbcENwwZUU1ry:rYzxrp0fwaIzDaLXDXU8BdxWEXaU50d
- - - - - - + + + + + + - - - - + + + + - - - + + +
@@ -4497,18 +4497,18 @@
@@ -4533,19 +4533,19 @@
- - @@ -4553,8 +4553,8 @@
- @@ -4565,39 +4565,39 @@
- - @@ -4618,57 +4618,57 @@
- - @@ -4690,86 +4690,86 @@
- - - @@ -4792,75 +4792,75 @@
- - - @@ -4901,16 +4901,16 @@
- @@ -4951,28 +4951,28 @@
- @@ -5013,50 +5013,50 @@
- - @@ -5073,138 +5073,138 @@
- - - - - - - @@ -5226,8 +5226,8 @@
- @@ -5238,10 +5238,10 @@
- @@ -5330,95 +5330,95 @@
- - - - - @@ -5435,23 +5435,23 @@
- - - - @@ -5462,8 +5462,8 @@
- @@ -5481,716 +5481,716 @@
- @@ -6199,8 +6199,8 @@
- @@ -6211,50 +6211,50 @@
- @@ -6341,29 +6341,29 @@
- - - - - @@ -6376,9 +6376,9 @@
- @@ -6390,14 +6390,14 @@
- +
@@ -6410,51 +6410,51 @@
- - + + - + - - + + - + - - - - - - - - - + + + + + + + + + @@ -6471,72 +6471,72 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - +
Filename - +
autA9E9.tmp
- +
File Type data
Associated Filenames - +
C:\Users\Louise\AppData\Local\Temp\autA9E9.tmp
- +
File Size 9768 bytes
MD5 3febaa0fabb58095c1b76f3d6f2560c0
SHA3-384 73232742b5cf0d4b3a09b0fd0699240bcdb24e8be569b5e10407a26b9e0fe722c5773504212cbe2f34f8e76fcd1de5cb
CRC32 CD2A8047
TLSH T1C512BF3730149DE1B50BC15E6CA54DBB99349068CB1AC633A9EDE37C60640F4C39B769
Ssdeep 192:ZfyK3sxPgtaYWi9jwzbu2uje16VLbKzG8MVGBZaOTwmS:RyfxNYddAGL2z/MoBbTbS
- - - - - - + + + + + + - - - - - - + + + + + +
@@ -6561,19 +6561,19 @@
- - @@ -6581,8 +6581,8 @@
- @@ -6593,39 +6593,39 @@
- - @@ -6646,51 +6646,51 @@
- - @@ -6712,64 +6712,64 @@
- - @@ -6791,45 +6791,45 @@
- - @@ -6851,17 +6851,17 @@
- @@ -6884,42 +6884,42 @@
- - @@ -6942,18 +6942,18 @@
- @@ -6994,36 +6994,36 @@
- @@ -7040,150 +7040,150 @@
- - - - - - - - @@ -7205,8 +7205,8 @@
- @@ -7217,10 +7217,10 @@
- @@ -7309,81 +7309,81 @@
- - - - @@ -7400,23 +7400,23 @@
- - - - @@ -7427,8 +7427,8 @@
- @@ -7446,546 +7446,546 @@
- @@ -7994,8 +7994,8 @@
- @@ -8006,50 +8006,50 @@
- @@ -8136,29 +8136,29 @@
- - - - - @@ -8171,501 +8171,501 @@
- @@ -8677,14 +8677,14 @@
- +
@@ -8697,51 +8697,51 @@
- - + + - + - - + + - + - - - - - - - - - + + + + + + + + + @@ -8758,63 +8758,63 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - + + + + + + - - - - - - - - - - - - + + + + + + + + + + + + - +
Filename - +
spiketail.vbs
- +
File Type data
Associated Filenames - +
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spiketail.vbs
- +
File Size 276 bytes
MD5 7cb10edc01c7b544f7704d01b6186955
SHA3-384 190e30051694350c863b47835d75c9435a73ada2663874a3dd5986e7483cf2e170554359e68f0b49ff41dd4a576b2585
CRC32 90771FED
TLSH T1ECD05E4063D26120B3F73E80BC7A48251B77FA318C31D20D0040450E0871618CA70756
Ssdeep 6:DMM8lfm3OOQdUfclq5Ja1UEZ+lX1GlZlzOu6nriIM8lfQVn:DsO+vNlK01Q1GzJ4mA2n
- - - - - - + + + + + + - - - - + + + + - - - + + +
@@ -8827,18 +8827,18 @@
@@ -8863,19 +8863,19 @@
- - @@ -8883,8 +8883,8 @@
- @@ -8895,39 +8895,39 @@
- - @@ -8948,31 +8948,31 @@
- - @@ -8993,57 +8993,57 @@
- - @@ -9064,42 +9064,42 @@
- - @@ -9120,52 +9120,52 @@
- - @@ -9186,64 +9186,64 @@
- - @@ -9264,50 +9264,50 @@
- - @@ -9328,45 +9328,45 @@
- - @@ -9387,16 +9387,16 @@
- @@ -9428,138 +9428,138 @@
- - - - - - - @@ -9581,8 +9581,8 @@
- @@ -9593,10 +9593,10 @@
- @@ -9685,81 +9685,81 @@
- - - - @@ -9776,23 +9776,23 @@
- - - - @@ -9803,8 +9803,8 @@
- @@ -9822,9 +9822,9 @@
- @@ -9833,8 +9833,8 @@
- @@ -9845,50 +9845,50 @@
- @@ -9975,29 +9975,29 @@
- - - - - @@ -10010,283 +10010,283 @@
- @@ -10298,14 +10298,14 @@
- +
@@ -10318,51 +10318,51 @@
- - + + - + - - + + - + - - - - - - - - - + + + + + + + + + @@ -10379,72 +10379,72 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - +
Filename - +
reaffection
- +
File Type data
Associated Filenames - +
C:\Users\Louise\AppData\Local\Temp\reaffection
- +
File Size 295424 bytes
MD5 4b3ff29c3010b6f9823fd8862c6cb860
SHA3-384 936813a02bb12135d16c68179cf52163d5f6d91bddf55fa10acdd2b37d63bdcab490b3c63a86b21a36cee5ec460f8728
CRC32 12B0864A
TLSH T10654014E23260546D6ABDBECD93C14D5F6331ED89B58F1CDA9F8464AC28D4C22D7BE10
Ssdeep 6144:5ql05WuBRsHrEhzOyDIKA/+y+3sq1ROLlJ+LkeFYf8h1cnxocLqb:m39LEhz52/T+3sKqeFJoLs
- - - - - - + + + + + + - - - - - - + + + + + +
@@ -10469,19 +10469,19 @@
- - @@ -10489,8 +10489,8 @@
- @@ -10501,39 +10501,39 @@
- - @@ -10554,66 +10554,66 @@
- - - @@ -10636,63 +10636,63 @@
- - - @@ -10715,17 +10715,17 @@
- @@ -10749,78 +10749,78 @@
- - - @@ -10844,18 +10844,18 @@
- @@ -10898,77 +10898,77 @@
- - - @@ -10992,34 +10992,34 @@
- @@ -11056,138 +11056,138 @@
- - - - - - - @@ -11209,8 +11209,8 @@
- @@ -11221,10 +11221,10 @@
- @@ -11313,81 +11313,81 @@
- - - - @@ -11404,23 +11404,23 @@
- - - - @@ -11431,8 +11431,8 @@
- @@ -11450,716 +11450,716 @@
- @@ -12168,8 +12168,8 @@
- @@ -12180,50 +12180,50 @@
- @@ -12310,29 +12310,29 @@
- - - - - @@ -12345,660 +12345,660 @@
- @@ -13010,16 +13010,16 @@
- +
- +
@@ -13027,9 +13027,9 @@

Payloads

- +
- +
@@ -13042,42 +13042,42 @@
- - + + - + - + - - + + - - - - + + + + @@ -13102,8 +13102,8 @@
- - + + @@ -13120,104 +13120,104 @@
[Bazaar]
- + - - + + - + - + - - + + - - + + - - - - + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - +
Type Formbook Payload
Filename - +
c063d01e28c34dc31e3cc68d292a1592ebb72cd1fb1f532e262604bafaef912a
- +
File Type data
File Size 61087744 bytes
Target Process notepad.exePath C:\Windows\SysWOW64\svchost.exe
MD5 7808d82d9eb0d4cca7b0d7e0cb7ee847
SHA3-384 9693fcafdc1d1ca7679a0bf7de295e9004c8e9771ea4f0657f2a933284d1bb9d8bd502b6ea3478917c98f45c58437bd3
CRC32 9FBE5D5E
TLSH T1ABD733F47016A2F4EBBBA1BF52274BC478FE5E1242C8E4B2397870F49091C5A56A570F
Ssdeep 1572864:hw0gETD85litUXFIvHeIa9Agx3ArQTjWUoYYAMEzZG:PvTwytUX6vHrIxQrxUXYLCY
Yara
    - +
  • shellcode_stack_strings - Match x86 that appears to be stack string creation. - + - Author: William Ballenthin - +
    • - +
CAPE Yara
    - +
  • Formbook - Formbook Payload - + - Author: kevoreilly
    • - +
- - - - - - + + + + + + - - - - - - + + + + + +
@@ -13242,19 +13242,19 @@
- - @@ -13262,8 +13262,8 @@
- @@ -13274,39 +13274,39 @@
- - @@ -13327,92 +13327,92 @@
- - - - @@ -13437,53 +13437,53 @@
- - - @@ -13508,121 +13508,121 @@
- - - - - @@ -13648,33 +13648,33 @@
- @@ -13700,16 +13700,16 @@
- @@ -13735,34 +13735,34 @@
- @@ -13845,138 +13845,138 @@
- - - - - - - @@ -13998,8 +13998,8 @@
- @@ -14010,10 +14010,10 @@
- @@ -14102,81 +14102,81 @@
- - - - @@ -14193,23 +14193,23 @@
- - - - @@ -14220,8 +14220,8 @@
- @@ -14239,22 +14239,22 @@
- @@ -14263,8 +14263,8 @@
- @@ -14275,50 +14275,50 @@
- @@ -14405,29 +14405,29 @@
- - - - - @@ -14440,227 +14440,227 @@
- @@ -14672,14 +14672,14 @@
- +
@@ -14692,67 +14692,67 @@
- - + + - + - + - - + + - - + + - - - - + + + + - - + + - - + + - - - + + + @@ -14769,88 +14769,88 @@
[Bazaar]
- + - - + + - + - + - - + + - - - - - + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - +
Type Unpacked Shellcode
Filename - +
fb71bcf2eb604961ea69c7f13909a4e94c07af2c7e8e1e72f38c9c6586364879
- +
File Type data
File Size 14298 bytes
Virtual Address 0x04250000
Process spiketail.exe
PID 6044
Path C:\Users\Louise\AppData\Local\caprone\spiketail.exe
MD5 071607093f2a93cec56135ac367553cd
SHA3-384 8308afe1a14026296524a4eba59c323fe6080de5601e8353eacefe6af2fa1c96348d1b84a4d747964e8e5415a470bfa7
CRC32 D5C9090E
TLSH T149529810C24183EBE49241A0A39A1E399039DD347B9058DB73619F793A72EF57E352D7
Ssdeep 384:gH6dZ6Fho0c6LHH9lCJys1zDihSUwvzoZiw767K0i:gH6H640c6L9l6xXihSU5Zt7CW
Yara
    - +
  • HeavensGate - Heaven's Gate: Switch from 32-bit to 64-mode - + - Author: kevoreilly - +
    • - +
- - - - - - + + + + + + - - - - - - + + + + + +
@@ -14875,19 +14875,19 @@
- - @@ -14895,8 +14895,8 @@
- @@ -14907,39 +14907,39 @@
- - @@ -14960,51 +14960,51 @@
- - @@ -15026,64 +15026,64 @@
- - @@ -15105,41 +15105,41 @@
- - @@ -15162,34 +15162,34 @@
- @@ -15212,16 +15212,16 @@
- @@ -15244,28 +15244,28 @@
- @@ -15288,33 +15288,33 @@
- @@ -15337,36 +15337,36 @@
- @@ -15383,138 +15383,138 @@
- - - - - - - @@ -15536,8 +15536,8 @@
- @@ -15548,10 +15548,10 @@
- @@ -15640,95 +15640,95 @@
- - - - - @@ -15745,23 +15745,23 @@
- - - - @@ -15772,8 +15772,8 @@
- @@ -15791,707 +15791,707 @@
- @@ -16500,8 +16500,8 @@
- @@ -16512,50 +16512,50 @@
- @@ -16642,29 +16642,29 @@
- - - - - @@ -16677,574 +16677,574 @@
- @@ -17256,14 +17256,14 @@
- +
@@ -17276,57 +17276,57 @@
- - + + - + - - + + - - - - - + + + + + - - + + - - + + - - - + + + @@ -17343,121 +17343,121 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - + + + + + + + + + - - + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - + +
Filename - +
1a7aeed7f1251166f4b155d7d9c9aea71a4173c084f77f2545aa63385a1f90b4
- +
File Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
File Size 1672704 bytes
Process svchost.exe
PID 4012
Path C:\Windows\SysWOW64\svchost.exe
MD5 2fa27a46e6c5182332d0545ab9be2a60
SHA3-384 28f54282a84fd416a62c8e142f032cf94d17bd3295bd51a9da444b28c1fbc3e7168a06ad608a23dce9f91ce347582836
CRC32 C8888244
TLSH T1FB75B351A3F84615F6F73B7059B926300E7A7CA5AB78C2DF228015AE4EB1EC08D71763
Ssdeep 24576:jhe5jT9XyetZyhymfEHhHe3eP9w/ZceItH66i6Gv/12f0XHjX:N2ieto7EH5e3e+2eELc3j
- - - - - + + + + + - - - - - - + + + + + +
- +

PE Information

- - - - - - - - - - - - - + + + + + + + + + + + + + - + - - + + - - + + - - + + - - + + - - + + - - + + - - - - - - - + + + + + + + - +
Image BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionPDB PathCompile TimeExported DLL NameImage BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionPDB PathCompile TimeExported DLL Name
0x06f000000x000000000x001a61730x0019c57110.0wntdll.pdb1971-04-29 16:46:46ntdll.dll
- +

Version Infos

@@ -17466,77 +17466,77 @@

Version Infos
CompanyName Microsoft Corporation
FileDescription NT Layer DLL
FileVersion 10.0.19041.1288 (WinBuild.160101.0800)
InternalName ntdll.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename ntdll.dll
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.19041.1288
Translation 0x0409 0x04b0
- - - + + +

Sections

@@ -17550,7 +17550,7 @@

Sections

Characteristics Entropy - + .text 0x00000400 @@ -17560,7 +17560,7 @@

Sections

IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.83 - + PAGE 0x0011fc00 @@ -17570,7 +17570,7 @@

Sections

IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 5.09 - + RT 0x00120200 @@ -17580,7 +17580,7 @@

Sections

IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 5.24 - + .data 0x00120400 @@ -17590,7 +17590,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2.81 - + .mrdata 0x00121200 @@ -17600,7 +17600,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.28 - + .00cfg 0x00123600 @@ -17610,7 +17610,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0.00 - + .rsrc 0x00123600 @@ -17620,7 +17620,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3.35 - + .reloc 0x00193400 @@ -17630,16 +17630,16 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 6.71 - +
- - - + + +
@@ -17661,7 +17661,7 @@
Entropy File type - + MUI 0x0019cd00 @@ -17671,7 +17671,7 @@
2.73 None - + RT_MESSAGETABLE 0x0012d470 @@ -17681,7 +17681,7 @@
3.35 None - + RT_VERSION 0x0012d0f0 @@ -17691,18 +17691,18 @@
3.50 None - +
- - + +
- +

Exports

@@ -17712,14627 +17712,14627 @@

Exports

Address Name - + 15 0x6f67b30 A_SHAFinal - + 16 0x6f88b80 A_SHAInit - + 17 0x6f67c10 A_SHAUpdate - + 18 0x6fbeac0 AlpcAdjustCompletionListConcurrencyCount - + 19 0x6fbeaf0 AlpcFreeCompletionListMessage - + 20 0x6fbebe0 AlpcGetCompletionListLastMessageInformation - + 21 0x6fbec10 AlpcGetCompletionListMessageAttributes - + 22 0x6f69f30 AlpcGetHeaderSize - + 23 0x6f69ef0 AlpcGetMessageAttribute - + 24 0x6fbec50 AlpcGetMessageFromCompletionList - + 25 0x6fbeda0 AlpcGetOutstandingCompletionListMessageCount - + 26 0x6f69eb0 AlpcInitializeMessageAttribute - + 27 0x6fbedc0 AlpcMaxAllowedMessageLength - + 28 0x6fbedd0 AlpcRegisterCompletionList - + 29 0x6fbee20 AlpcRegisterCompletionListWorkerThread - + 30 0x6fbee90 AlpcRundownCompletionList - + 31 0x6fbeeb0 AlpcUnregisterCompletionList - + 32 0x6fbeed0 AlpcUnregisterCompletionListWorkerThread - + 33 0x6f66ce0 ApiSetQueryApiSetPresence - + 34 0x6f50250 ApiSetQueryApiSetPresenceEx - + 35 0x6fbe850 CsrAllocateCaptureBuffer - + 36 0x6fbe860 CsrAllocateMessagePointer - + 37 0x6fbe870 CsrCaptureMessageBuffer - + 38 0x6fbe880 CsrCaptureMessageMultiUnicodeStringsInPlace - + 39 0x6fbe910 CsrCaptureMessageString - + 40 0x6fbe960 CsrCaptureTimeout - + 41 0x6fbe990 CsrClientCallServer - + 42 0x6f6bc50 CsrClientConnectToServer - + 43 0x6fbe9a0 CsrFreeCaptureBuffer - + 44 0x6fbe9b0 CsrGetProcessId - + 45 0x6fbe9c0 CsrIdentifyAlertableThread - + 46 0x6fb4950 CsrSetPriorityClass - + 47 0x6fbe9d0 CsrVerifyRegion - + 48 0x6f74d30 DbgBreakPoint - + 49 0x6f2b920 DbgPrint - + 50 0x6fbef40 DbgPrintEx - + 51 0x6fbef70 DbgPrintReturnControlC - + 52 0x6fbefa0 DbgPrompt - + 53 0x6fbefe0 DbgQueryDebugFilterState - + 54 0x6fbeff0 DbgSetDebugFilterState - + 55 0x6fad930 DbgUiConnectToDbg - + 56 0x6fad990 DbgUiContinue - + 57 0x6fad9c0 DbgUiConvertStateChangeStructure - + 58 0x6fad9e0 DbgUiConvertStateChangeStructureEx - + 59 0x6fadbe0 DbgUiDebugActiveProcess - + 60 0x6fadc30 DbgUiGetThreadDebugObject - + 61 0x6fadc50 DbgUiIssueRemoteBreakin - + 62 0x6fadca0 DbgUiRemoteBreakin - + 63 0x6fadd00 DbgUiSetThreadDebugObject - + 64 0x6fadd20 DbgUiStopDebugging - + 65 0x6fadd50 DbgUiWaitStateChange - + 66 0x6f74d20 DbgUserBreakPoint - + 67 0x7000460 EtwCheckCoverage - + 68 0x7000c30 EtwCreateTraceInstanceId - + 69 0x6f2e500 EtwDeliverDataBlock - + 70 0x70004b0 EtwEnumerateProcessRegGuids - + 71 0x6f5c1b0 EtwEventActivityIdControl - + 72 0x6f66960 EtwEventEnabled - + 73 0x6f2b210 EtwEventProviderEnabled - + 74 0x6f2e0f0 EtwEventRegister - + 75 0x6f30ab0 EtwEventSetInformation - + 76 0x6f59a00 EtwEventUnregister - + 77 0x6f612a0 EtwEventWrite - + 78 0x7000c80 EtwEventWriteEndScenario - + 79 0x6f2bb40 EtwEventWriteEx - + 80 0x70005b0 EtwEventWriteFull - + 81 0x6f2bd80 EtwEventWriteNoRegistration - + 82 0x7000d60 EtwEventWriteStartScenario - + 83 0x70005f0 EtwEventWriteString - + 84 0x6f63cf0 EtwEventWriteTransfer - + 85 0x6f6c7d0 EtwGetTraceEnableFlags - + 86 0x6f6c7a0 EtwGetTraceEnableLevel - + 87 0x6f6c750 EtwGetTraceLoggerHandle - + 88 0x7000ec0 EtwLogTraceEvent - + 89 0x6f419b0 EtwNotificationRegister - + 90 0x6f59a20 EtwNotificationUnregister - + 91 0x6f6ff70 EtwProcessPrivateLoggerRequest - + 92 0x7000860 EtwRegisterSecurityProvider - + 93 0x6f643c0 EtwRegisterTraceGuidsA - + 94 0x6f643f0 EtwRegisterTraceGuidsW - + 95 0x70025d0 EtwReplyNotification - + 96 0x7002610 EtwSendNotification - + 97 0x6f2a720 EtwSetMark - + 98 0x7000f20 EtwTraceEventInstance - + 99 0x6f6a150 EtwTraceMessage - + 100 0x6f6a180 EtwTraceMessageVa - + 101 0x6f599b0 EtwUnregisterTraceGuids - + 102 0x70008a0 EtwWriteUMSecurityEvent - + 103 0x6f704f0 EtwpCreateEtwThread - + 104 0x6f87bf0 EtwpGetCpuSpeed - + 105 0x7002d10 EvtIntReportAuthzEventAndSourceAsync - + 106 0x7002d50 EvtIntReportEventAndSourceAsync - + 107 0x6f74fc0 KiFastSystemCall - + 108 0x6f74fd0 KiFastSystemCallRet - + 109 0x6f74fe0 KiIntSystemCall - + 110 0x6f74f30 KiRaiseUserExceptionDispatcher - + 111 0x6f74d60 KiUserApcDispatcher - + 112 0x6f74e50 KiUserCallbackDispatcher - + 113 0x6f74ec0 KiUserExceptionDispatcher - + 114 0x6f88c40 LdrAccessResource - + 115 0x6fbcb50 LdrAddDllDirectory - + 116 0x6f38b30 LdrAddLoadAsDataTable - + 117 0x6f52140 LdrAddRefDll - + 118 0x6fac3d0 LdrAppxHandleIntegrityFailure - + 119 0x6fadd80 LdrCallEnclave - + 120 0x6f50150 LdrControlFlowGuardEnforced - + 121 0x6fadd90 LdrCreateEnclave - + 122 0x6fade40 LdrDeleteEnclave - + 123 0x6f66a00 LdrDisableThreadCalloutsForDll - + 124 0x6fbf060 LdrEnumResources - + 125 0x6f297c0 LdrEnumerateLoadedModules - + 126 0x6fae9a0 LdrFastFailInLoaderCallout - + 127 0x6f4f250 LdrFindEntryForAddress - + 128 0x6fbf2a0 LdrFindResourceDirectory_U - + 129 0x6f6bbe0 LdrFindResourceEx_U - + 130 0x6f3b970 LdrFindResource_U - + 131 0x6fbf2d0 LdrFlushAlternateResourceModules - + 132 0x6f2ade0 LdrGetDllDirectory - + 133 0x6f4cc10 LdrGetDllFullName - + 134 0x6f4c870 LdrGetDllHandle - + 135 0x6f65860 LdrGetDllHandleByMapping - + 136 0x6f4f310 LdrGetDllHandleByName - + 137 0x6f4ac40 LdrGetDllHandleEx - + 138 0x6f32810 LdrGetDllPath - + 139 0x6fae9d0 LdrGetFailureData - + 140 0x6fbf3c0 LdrGetFileNameFromLoadAsDataTable - + 141 0x6f2b840 LdrGetProcedureAddress - + 142 0x6f26b30 LdrGetProcedureAddressEx - + 143 0x6f4cf20 LdrGetProcedureAddressForCaller - + 144 0x6fb14c0 LdrInitShimEngineDynamic - + 145 0x6fade70 LdrInitializeEnclave - + 146 0x6f66310 LdrInitializeThunk - + 147 0x6fae9e0 LdrIsModuleSxsRedirected - + 148 0x6f2a2a0 LdrLoadAlternateResourceModule - + 149 0x6f3be00 LdrLoadAlternateResourceModuleEx - + 150 0x6f4ddc0 LdrLoadDll - + 151 0x6fadd80 LdrLoadEnclaveModule - + 152 0x6f68600 LdrLockLoaderLock - + 153 0x6fbfed0 LdrOpenImageFileOptionsKey - + 154 0x70269d4 LdrParentInterlockedPopEntrySList - + 155 0x7026990 LdrParentRtlInitializeNtUserPfn - + 156 0x70269b0 LdrParentRtlResetNtUserPfn - + 157 0x70269a8 LdrParentRtlRetrieveNtUserPfn - + 158 0x6fc2890 LdrProcessRelocationBlock - + 159 0x6fc28c0 LdrProcessRelocationBlockEx - + 160 0x6f69710 LdrQueryImageFileExecutionOptions - + 161 0x6f69750 LdrQueryImageFileExecutionOptionsEx - + 162 0x6f26cd0 LdrQueryImageFileKeyOption - + 163 0x6faeb50 LdrQueryModuleServiceTags - + 164 0x6faf710 LdrQueryOptionalDelayLoadedAPI - + 165 0x6faebf0 LdrQueryProcessModuleInformation - + 166 0x6f2b380 LdrRegisterDllNotification - + 167 0x6fbcd30 LdrRemoveDllDirectory - + 168 0x6f389e0 LdrRemoveLoadAsDataTable - + 169 0x6fc2ef0 LdrResFindResource - + 170 0x6f39830 LdrResFindResourceDirectory - + 171 0x6f3b600 LdrResGetRCConfig - + 172 0x6fc2f40 LdrResRelease - + 173 0x6f3a910 LdrResSearchResource - + 174 0x6f4ca80 LdrResolveDelayLoadedAPI - + 175 0x6faf7b0 LdrResolveDelayLoadsFromDll - + 176 0x6f3e810 LdrRscIsTypeExist - + 177 0x6f6d850 LdrSetAppCompatDllRedirectionCallback - + 178 0x6fbcde0 LdrSetDefaultDllDirectories - + 179 0x6f6d470 LdrSetDllDirectory - + 180 0x6f6ccd0 LdrSetDllManifestProber - + 181 0x6faf0a0 LdrSetImplicitPathOptions - + 182 0x6fbf410 LdrSetMUICacheType - + 183 0x6f5d6f0 LdrShutdownProcess - + 184 0x6f4f660 LdrShutdownThread - + 185 0x6f3fd10 LdrStandardizeSystemPath - + 186 0x7029248 LdrSystemDllInitBlock - + 187 0x6f5a390 LdrUnloadAlternateResourceModule - + 188 0x6f5a3b0 LdrUnloadAlternateResourceModuleEx - + 189 0x6f4cda0 LdrUnloadDll - + 190 0x6f6a6f0 LdrUnlockLoaderLock - + 191 0x6faf100 LdrUnregisterDllNotification - + 192 0x6fbce20 LdrUpdatePackageSearchPath - + 193 0x6faf180 LdrVerifyImageMatchesChecksum - + 194 0x6faf1f0 LdrVerifyImageMatchesChecksumEx - + 195 0x70269b4 LdrpChildNtdll - + 196 0x6f3ab90 LdrpResGetMappingSize - + 197 0x6f3b380 LdrpResGetResourceDirectory - + 198 0x7000270 MD4Final - + 199 0x7000310 MD4Init - + 200 0x7000350 MD4Update - + 201 0x6f6f960 MD5Final - + 202 0x6f724c0 MD5Init - + 203 0x6f6fa00 MD5Update - + 204 0x7023948 NlsAnsiCodePage - + 205 0x7026930 NlsMbCodePageTag - + 206 0x7026918 NlsMbOemCodePageTag - + 207 0x6f729d0 NtAcceptConnectPort - + 208 0x6f729b0 NtAccessCheck - + 209 0x6f72c60 NtAccessCheckAndAuditAlarm - + 210 0x6f73000 NtAccessCheckByType - + 211 0x6f72f60 NtAccessCheckByTypeAndAuditAlarm - + 212 0x6f73010 NtAccessCheckByTypeResultList - + 213 0x6f73020 NtAccessCheckByTypeResultListAndAuditAlarm - + 214 0x6f73030 NtAccessCheckByTypeResultListAndAuditAlarmByHandle - + 215 0x6f73040 NtAcquireCrossVmMutant - + 216 0x6f73050 NtAcquireProcessActivityReference - + 217 0x6f72e40 NtAddAtom - + 218 0x6f73060 NtAddAtomEx - + 219 0x6f73070 NtAddBootEntry - + 220 0x6f73080 NtAddDriverEntry - + 221 0x6f73090 NtAdjustGroupsToken - + 222 0x6f72de0 NtAdjustPrivilegesToken - + 223 0x6f730a0 NtAdjustTokenClaimsAndDeviceGroups - + 224 0x6f730b0 NtAlertResumeThread - + 225 0x6f730c0 NtAlertThread - + 226 0x6f730d0 NtAlertThreadByThreadId - + 227 0x6f730e0 NtAllocateLocallyUniqueId - + 228 0x6f730f0 NtAllocateReserveObject - + 229 0x6f73100 NtAllocateUserPhysicalPages - + 230 0x6f73110 NtAllocateUserPhysicalPagesEx - + 231 0x6f73120 NtAllocateUuids - + 232 0x6f72b30 NtAllocateVirtualMemory - + 233 0x6f73130 NtAllocateVirtualMemoryEx - + 234 0x6f73140 NtAlpcAcceptConnectPort - + 235 0x6f73150 NtAlpcCancelMessage - + 236 0x6f73160 NtAlpcConnectPort - + 237 0x6f73170 NtAlpcConnectPortEx - + 238 0x6f73180 NtAlpcCreatePort - + 239 0x6f73190 NtAlpcCreatePortSection - + 240 0x6f731a0 NtAlpcCreateResourceReserve - + 241 0x6f731b0 NtAlpcCreateSectionView - + 242 0x6f731c0 NtAlpcCreateSecurityContext - + 243 0x6f731d0 NtAlpcDeletePortSection - + 244 0x6f731e0 NtAlpcDeleteResourceReserve - + 245 0x6f731f0 NtAlpcDeleteSectionView - + 246 0x6f73200 NtAlpcDeleteSecurityContext - + 247 0x6f73210 NtAlpcDisconnectPort - + 248 0x6f73220 NtAlpcImpersonateClientContainerOfPort - + 249 0x6f73230 NtAlpcImpersonateClientOfPort - + 250 0x6f73240 NtAlpcOpenSenderProcess - + 251 0x6f73250 NtAlpcOpenSenderThread - + 252 0x6f73260 NtAlpcQueryInformation - + 253 0x6f73270 NtAlpcQueryInformationMessage - + 254 0x6f73280 NtAlpcRevokeSecurityContext - + 255 0x6f73290 NtAlpcSendWaitReceivePort - + 256 0x6f732a0 NtAlpcSetInformation - + 257 0x6f72e90 NtApphelpCacheControl - + 258 0x6f732b0 NtAreMappedFilesTheSame - + 259 0x6f732c0 NtAssignProcessToJobObject - + 260 0x6f732d0 NtAssociateWaitCompletionPacket - + 261 0x6f732e0 NtCallEnclave - + 262 0x6f72a00 NtCallbackReturn - + 263 0x6f72fa0 NtCancelIoFile - + 264 0x6f732f0 NtCancelIoFileEx - + 265 0x6f73300 NtCancelSynchronousIoFile - + 267 0x6f72fe0 NtCancelTimer - + 266 0x6f73310 NtCancelTimer2 - + 268 0x6f73320 NtCancelWaitCompletionPacket - + 269 0x6f72db0 NtClearEvent - + 270 0x6f72aa0 NtClose - + 271 0x6f72d80 NtCloseObjectAuditAlarm - + 272 0x6f73330 NtCommitComplete - + 273 0x6f73340 NtCommitEnlistment - + 274 0x6f73350 NtCommitRegistryTransaction - + 275 0x6f73360 NtCommitTransaction - + 276 0x6f73370 NtCompactKeys - + 277 0x6f73380 NtCompareObjects - + 278 0x6f73390 NtCompareSigningLevels - + 279 0x6f733a0 NtCompareTokens - + 280 0x6f733b0 NtCompleteConnectPort - + 281 0x6f733c0 NtCompressKey - + 282 0x6f733d0 NtConnectPort - + 283 0x6f72e00 NtContinue - + 284 0x6f733e0 NtContinueEx - + 285 0x6f733f0 NtConvertBetweenAuxiliaryCounterAndPerformanceCounter - + 286 0x6f73400 NtCreateCrossVmEvent - + 287 0x6f73410 NtCreateCrossVmMutant - + 288 0x6f73420 NtCreateDebugObject - + 289 0x6f73430 NtCreateDirectoryObject - + 290 0x6f73440 NtCreateDirectoryObjectEx - + 291 0x6f73450 NtCreateEnclave - + 292 0x6f73460 NtCreateEnlistment - + 293 0x6f72e50 NtCreateEvent - + 294 0x6f73470 NtCreateEventPair - + 295 0x6f72f20 NtCreateFile - + 296 0x6f73480 NtCreateIRTimer - + 297 0x6f73490 NtCreateIoCompletion - + 298 0x6f734a0 NtCreateJobObject - + 299 0x6f734b0 NtCreateJobSet - + 300 0x6f72ba0 NtCreateKey - + 301 0x6f734c0 NtCreateKeyTransacted - + 302 0x6f734d0 NtCreateKeyedEvent - + 303 0x6f734e0 NtCreateLowBoxToken - + 304 0x6f734f0 NtCreateMailslotFile - + 305 0x6f73500 NtCreateMutant - + 306 0x6f73510 NtCreateNamedPipeFile - + 307 0x6f73520 NtCreatePagingFile - + 308 0x6f73530 NtCreatePartition - + 309 0x6f73540 NtCreatePort - + 310 0x6f73550 NtCreatePrivateNamespace - + 311 0x6f73560 NtCreateProcess - + 312 0x6f72ea0 NtCreateProcessEx - + 313 0x6f73570 NtCreateProfile - + 314 0x6f73580 NtCreateProfileEx - + 315 0x6f73590 NtCreateRegistryTransaction - + 316 0x6f735a0 NtCreateResourceManager - + 317 0x6f72e70 NtCreateSection - + 318 0x6f735b0 NtCreateSectionEx - + 319 0x6f735c0 NtCreateSemaphore - + 320 0x6f735d0 NtCreateSymbolicLinkObject - + 321 0x6f72eb0 NtCreateThread - + 322 0x6f735e0 NtCreateThreadEx - + 324 0x6f735f0 NtCreateTimer - + 323 0x6f73600 NtCreateTimer2 - + 325 0x6f73610 NtCreateToken - + 326 0x6f73620 NtCreateTokenEx - + 327 0x6f73630 NtCreateTransaction - + 328 0x6f73640 NtCreateTransactionManager - + 329 0x6f73650 NtCreateUserProcess - + 330 0x6f73660 NtCreateWaitCompletionPacket - + 331 0x6f73670 NtCreateWaitablePort - + 332 0x6f73680 NtCreateWnfStateName - + 333 0x6f73690 NtCreateWorkerFactory - + 334 0x6fb3c80 NtCurrentTeb - + 335 0x6f736a0 NtDebugActiveProcess - + 336 0x6f736b0 NtDebugContinue - + 337 0x6f72d10 NtDelayExecution - + 338 0x6f736c0 NtDeleteAtom - + 339 0x6f736d0 NtDeleteBootEntry - + 340 0x6f736e0 NtDeleteDriverEntry - + 341 0x6f736f0 NtDeleteFile - + 342 0x6f73700 NtDeleteKey - + 343 0x6f73710 NtDeleteObjectAuditAlarm - + 344 0x6f73720 NtDeletePrivateNamespace - + 345 0x6f73730 NtDeleteValueKey - + 346 0x6f73740 NtDeleteWnfStateData - + 347 0x6f73750 NtDeleteWnfStateName - + 348 0x6f72a20 NtDeviceIoControlFile - + 349 0x6f73760 NtDirectGraphicsCall - + 350 0x6f73770 NtDisableLastKnownGood - + 351 0x6f73780 NtDisplayString - + 352 0x6f73790 NtDrawText - + 353 0x6f72d90 NtDuplicateObject - + 354 0x6f72df0 NtDuplicateToken - + 355 0x6f737a0 NtEnableLastKnownGood - + 356 0x6f737b0 NtEnumerateBootEntries - + 357 0x6f737c0 NtEnumerateDriverEntries - + 358 0x6f72cf0 NtEnumerateKey - + 359 0x6f737d0 NtEnumerateSystemEnvironmentValuesEx - + 360 0x6f737e0 NtEnumerateTransactionObject - + 361 0x6f72ae0 NtEnumerateValueKey - + 362 0x6f737f0 NtExtendSection - + 363 0x6f73800 NtFilterBootOption - + 364 0x6f73810 NtFilterToken - + 365 0x6f73820 NtFilterTokenEx - + 366 0x6f72af0 NtFindAtom - + 367 0x6f72e80 NtFlushBuffersFile - + 368 0x6f73830 NtFlushBuffersFileEx - + 369 0x6f73840 NtFlushInstallUILanguage - + 370 0x6f73850 NtFlushInstructionCache - + 371 0x6f73860 NtFlushKey - + 372 0x6f73870 NtFlushProcessWriteBuffers - + 373 0x6f73880 NtFlushVirtualMemory - + 374 0x6f73890 NtFlushWriteBuffer - + 375 0x6f738a0 NtFreeUserPhysicalPages - + 376 0x6f72bb0 NtFreeVirtualMemory - + 377 0x6f738b0 NtFreezeRegistry - + 378 0x6f738c0 NtFreezeTransactions - + 379 0x6f72d60 NtFsControlFile - + 380 0x6f738d0 NtGetCachedSigningLevel - + 381 0x6f738e0 NtGetCompleteWnfStateSubscription - + 382 0x6f738f0 NtGetContextThread - + 383 0x6f73900 NtGetCurrentProcessorNumber - + 384 0x6f73910 NtGetCurrentProcessorNumberEx - + 385 0x6f73920 NtGetDevicePowerState - + 386 0x6f73930 NtGetMUIRegistryInfo - + 387 0x6f73940 NtGetNextProcess - + 388 0x6f73950 NtGetNextThread - + 389 0x6f73960 NtGetNlsSectionPtr - + 390 0x6f73970 NtGetNotificationResourceManager - + 391 0x6fc4df0 NtGetTickCount - + 392 0x6f73980 NtGetWriteWatch - + 393 0x6f73990 NtImpersonateAnonymousToken - + 394 0x6f72bc0 NtImpersonateClientOfPort - + 395 0x6f739a0 NtImpersonateThread - + 396 0x6f739b0 NtInitializeEnclave - + 397 0x6f739c0 NtInitializeNlsFiles - + 398 0x6f739d0 NtInitializeRegistry - + 399 0x6f739e0 NtInitiatePowerAction - + 400 0x6f72ec0 NtIsProcessInJob - + 401 0x6f739f0 NtIsSystemResumeAutomatic - + 402 0x6f73a00 NtIsUILanguageComitted - + 403 0x6f73a10 NtListenPort - + 404 0x6f73a20 NtLoadDriver - + 405 0x6f73a30 NtLoadEnclaveData - + 408 0x6f73a40 NtLoadKey - + 406 0x6f73a50 NtLoadKey2 - + 407 0x6f74730 NtLoadKey3 - + 409 0x6f73a60 NtLoadKeyEx - + 410 0x6f73a70 NtLockFile - + 411 0x6f73a80 NtLockProductActivationKeys - + 412 0x6f73a90 NtLockRegistryKey - + 413 0x6f73aa0 NtLockVirtualMemory - + 414 0x6f73ab0 NtMakePermanentObject - + 415 0x6f73ac0 NtMakeTemporaryObject - + 416 0x6f73ad0 NtManageHotPatch - + 417 0x6f73ae0 NtManagePartition - + 418 0x6f73af0 NtMapCMFModule - + 419 0x6f73b00 NtMapUserPhysicalPages - + 420 0x6f729e0 NtMapUserPhysicalPagesScatter - + 421 0x6f72c50 NtMapViewOfSection - + 422 0x6f73b10 NtMapViewOfSectionEx - + 423 0x6f73b20 NtModifyBootEntry - + 424 0x6f73b30 NtModifyDriverEntry - + 425 0x6f73b40 NtNotifyChangeDirectoryFile - + 426 0x6f73b50 NtNotifyChangeDirectoryFileEx - + 427 0x6f73b60 NtNotifyChangeKey - + 428 0x6f73b70 NtNotifyChangeMultipleKeys - + 429 0x6f73b80 NtNotifyChangeSession - + 430 0x6f72f50 NtOpenDirectoryObject - + 431 0x6f73b90 NtOpenEnlistment - + 432 0x6f72dd0 NtOpenEvent - + 433 0x6f73ba0 NtOpenEventPair - + 434 0x6f72d00 NtOpenFile - + 435 0x6f73bb0 NtOpenIoCompletion - + 436 0x6f73bc0 NtOpenJobObject - + 437 0x6f72ad0 NtOpenKey - + 438 0x6f73bd0 NtOpenKeyEx - + 439 0x6f73be0 NtOpenKeyTransacted - + 440 0x6f73bf0 NtOpenKeyTransactedEx - + 441 0x6f73c00 NtOpenKeyedEvent - + 442 0x6f73c10 NtOpenMutant - + 443 0x6f73c20 NtOpenObjectAuditAlarm - + 444 0x6f73c30 NtOpenPartition - + 445 0x6f73c40 NtOpenPrivateNamespace - + 446 0x6f72c30 NtOpenProcess - + 447 0x6f73c50 NtOpenProcessToken - + 448 0x6f72cd0 NtOpenProcessTokenEx - + 449 0x6f73c60 NtOpenRegistryTransaction - + 450 0x6f73c70 NtOpenResourceManager - + 451 0x6f72d40 NtOpenSection - + 452 0x6f73c80 NtOpenSemaphore - + 453 0x6f73c90 NtOpenSession - + 454 0x6f73ca0 NtOpenSymbolicLinkObject - + 455 0x6f73cb0 NtOpenThread - + 456 0x6f72c10 NtOpenThreadToken - + 457 0x6f72cc0 NtOpenThreadTokenEx - + 458 0x6f73cc0 NtOpenTimer - + 459 0x6f73cd0 NtOpenTransaction - + 460 0x6f73ce0 NtOpenTransactionManager - + 461 0x6f73cf0 NtPlugPlayControl - + 462 0x6f72fc0 NtPowerInformation - + 463 0x6f73d00 NtPrePrepareComplete - + 464 0x6f73d10 NtPrePrepareEnlistment - + 465 0x6f73d20 NtPrepareComplete - + 466 0x6f73d30 NtPrepareEnlistment - + 467 0x6f73d40 NtPrivilegeCheck - + 468 0x6f73d50 NtPrivilegeObjectAuditAlarm - + 469 0x6f73d60 NtPrivilegedServiceAuditAlarm - + 470 0x6f73d70 NtPropagationComplete - + 471 0x6f73d80 NtPropagationFailed - + 472 0x6f72ed0 NtProtectVirtualMemory - + 473 0x6f73d90 NtPssCaptureVaSpaceBulk - + 474 0x6f73da0 NtPulseEvent - + 475 0x6f72da0 NtQueryAttributesFile - + 476 0x6f73db0 NtQueryAuxiliaryCounterFrequency - + 477 0x6f73dc0 NtQueryBootEntryOrder - + 478 0x6f73dd0 NtQueryBootOptions - + 479 0x6f73de0 NtQueryDebugFilterState - + 480 0x6f72b00 NtQueryDefaultLocale - + 481 0x6f72e10 NtQueryDefaultUILanguage - + 482 0x6f72d20 NtQueryDirectoryFile - + 483 0x6f73df0 NtQueryDirectoryFileEx - + 484 0x6f73e00 NtQueryDirectoryObject - + 485 0x6f73e10 NtQueryDriverEntryOrder - + 486 0x6f73e20 NtQueryEaFile - + 487 0x6f72f30 NtQueryEvent - + 488 0x6f73e30 NtQueryFullAttributesFile - + 489 0x6f73e40 NtQueryInformationAtom - + 490 0x6f73e50 NtQueryInformationByName - + 491 0x6f73e60 NtQueryInformationEnlistment - + 492 0x6f72ac0 NtQueryInformationFile - + 493 0x6f73e70 NtQueryInformationJobObject - + 494 0x6f73e80 NtQueryInformationPort - + 495 0x6f72b40 NtQueryInformationProcess - + 496 0x6f73e90 NtQueryInformationResourceManager - + 497 0x6f72c20 NtQueryInformationThread - + 498 0x6f72be0 NtQueryInformationToken - + 499 0x6f73ea0 NtQueryInformationTransaction - + 500 0x6f73eb0 NtQueryInformationTransactionManager - + 501 0x6f73ec0 NtQueryInformationWorkerFactory - + 502 0x6f73ed0 NtQueryInstallUILanguage - + 503 0x6f73ee0 NtQueryIntervalProfile - + 504 0x6f73ef0 NtQueryIoCompletion - + 505 0x6f72b10 NtQueryKey - + 506 0x6f73f00 NtQueryLicenseValue - + 507 0x6f73f10 NtQueryMultipleValueKey - + 508 0x6f73f20 NtQueryMutant - + 509 0x6f72ab0 NtQueryObject - + 510 0x6f73f30 NtQueryOpenSubKeys - + 511 0x6f73f40 NtQueryOpenSubKeysEx - + 512 0x6f72ce0 NtQueryPerformanceCounter - + 513 0x6f73f50 NtQueryPortInformationProcess - + 514 0x6f73f60 NtQueryQuotaInformationFile - + 515 0x6f72ee0 NtQuerySection - + 516 0x6f73f70 NtQuerySecurityAttributesToken - + 517 0x6f73f80 NtQuerySecurityObject - + 518 0x6f73f90 NtQuerySecurityPolicy - + 519 0x6f73fa0 NtQuerySemaphore - + 520 0x6f73fb0 NtQuerySymbolicLinkObject - + 521 0x6f73fc0 NtQuerySystemEnvironmentValue - + 522 0x6f73fd0 NtQuerySystemEnvironmentValueEx - + 523 0x6f72d30 NtQuerySystemInformation - + 524 0x6f73fe0 NtQuerySystemInformationEx - + 525 0x6f72f70 NtQuerySystemTime - + 526 0x6f72d50 NtQueryTimer - + 527 0x6f73ff0 NtQueryTimerResolution - + 528 0x6f72b20 NtQueryValueKey - + 529 0x6f72c00 NtQueryVirtualMemory - + 530 0x6f72e60 NtQueryVolumeInformationFile - + 531 0x6f74000 NtQueryWnfStateData - + 532 0x6f74010 NtQueryWnfStateNameInformation - + 533 0x6f72e20 NtQueueApcThread - + 534 0x6f74020 NtQueueApcThreadEx - + 535 0x6f74030 NtRaiseException - + 536 0x6f74040 NtRaiseHardError - + 537 0x6f72a10 NtReadFile - + 538 0x6f72cb0 NtReadFileScatter - + 539 0x6f74050 NtReadOnlyEnlistment - + 540 0x6f72f10 NtReadRequestData - + 541 0x6f72dc0 NtReadVirtualMemory - + 542 0x6f74060 NtRecoverEnlistment - + 543 0x6f74070 NtRecoverResourceManager - + 544 0x6f74080 NtRecoverTransactionManager - + 545 0x6f74090 NtRegisterProtocolAddressInformation - + 546 0x6f740a0 NtRegisterThreadTerminatePort - + 547 0x6f740b0 NtReleaseKeyedEvent - + 548 0x6f72bd0 NtReleaseMutant - + 549 0x6f72a50 NtReleaseSemaphore - + 550 0x6f740c0 NtReleaseWorkerFactoryWorker - + 551 0x6f72a40 NtRemoveIoCompletion - + 552 0x6f740d0 NtRemoveIoCompletionEx - + 553 0x6f740e0 NtRemoveProcessDebug - + 554 0x6f740f0 NtRenameKey - + 555 0x6f74100 NtRenameTransactionManager - + 556 0x6f74110 NtReplaceKey - + 557 0x6f74120 NtReplacePartitionUnit - + 558 0x6f72a70 NtReplyPort - + 559 0x6f72a60 NtReplyWaitReceivePort - + 560 0x6f72c80 NtReplyWaitReceivePortEx - + 561 0x6f74130 NtReplyWaitReplyPort - + 562 0x6f74140 NtRequestPort - + 563 0x6f72bf0 NtRequestWaitReplyPort - + 564 0x6f74150 NtResetEvent - + 565 0x6f74160 NtResetWriteWatch - + 566 0x6f74170 NtRestoreKey - + 567 0x6f74180 NtResumeProcess - + 568 0x6f72ef0 NtResumeThread - + 569 0x6f74190 NtRevertContainerImpersonation - + 570 0x6f741a0 NtRollbackComplete - + 571 0x6f741b0 NtRollbackEnlistment - + 572 0x6f741c0 NtRollbackRegistryTransaction - + 573 0x6f741d0 NtRollbackTransaction - + 574 0x6f741e0 NtRollforwardTransactionManager - + 575 0x6f741f0 NtSaveKey - + 576 0x6f74200 NtSaveKeyEx - + 577 0x6f74210 NtSaveMergedKeys - + 578 0x6f74220 NtSecureConnectPort - + 579 0x6f74230 NtSerializeBoot - + 580 0x6f74240 NtSetBootEntryOrder - + 581 0x6f74250 NtSetBootOptions - + 583 0x6f74260 NtSetCachedSigningLevel - + 582 0x6f74270 NtSetCachedSigningLevel2 - + 584 0x6f74280 NtSetContextThread - + 585 0x6f74290 NtSetDebugFilterState - + 586 0x6f742a0 NtSetDefaultHardErrorPort - + 587 0x6f742b0 NtSetDefaultLocale - + 588 0x6f742c0 NtSetDefaultUILanguage - + 589 0x6f742d0 NtSetDriverEntryOrder - + 590 0x6f742e0 NtSetEaFile - + 591 0x6f72a90 NtSetEvent - + 592 0x6f72ca0 NtSetEventBoostPriority - + 593 0x6f742f0 NtSetHighEventPair - + 594 0x6f74300 NtSetHighWaitLowEventPair - + 595 0x6f74310 NtSetIRTimer - + 596 0x6f74320 NtSetInformationDebugObject - + 597 0x6f74330 NtSetInformationEnlistment - + 598 0x6f72c40 NtSetInformationFile - + 599 0x6f74340 NtSetInformationJobObject - + 600 0x6f74350 NtSetInformationKey - + 601 0x6f72f90 NtSetInformationObject - + 602 0x6f72b90 NtSetInformationProcess - + 603 0x6f74360 NtSetInformationResourceManager - + 604 0x6f74370 NtSetInformationSymbolicLink - + 605 0x6f72a80 NtSetInformationThread - + 606 0x6f74380 NtSetInformationToken - + 607 0x6f74390 NtSetInformationTransaction - + 608 0x6f743a0 NtSetInformationTransactionManager - + 609 0x6f743b0 NtSetInformationVirtualMemory - + 610 0x6f743c0 NtSetInformationWorkerFactory - + 611 0x6f743d0 NtSetIntervalProfile - + 612 0x6f743e0 NtSetIoCompletion - + 613 0x6f743f0 NtSetIoCompletionEx - + 614 0x6f74400 NtSetLdtEntries - + 615 0x6f74410 NtSetLowEventPair - + 616 0x6f74420 NtSetLowWaitHighEventPair - + 617 0x6f74430 NtSetQuotaInformationFile - + 618 0x6f74440 NtSetSecurityObject - + 619 0x6f74450 NtSetSystemEnvironmentValue - + 620 0x6f74460 NtSetSystemEnvironmentValueEx - + 621 0x6f74470 NtSetSystemInformation - + 622 0x6f74480 NtSetSystemPowerState - + 623 0x6f74490 NtSetSystemTime - + 624 0x6f744a0 NtSetThreadExecutionState - + 626 0x6f72ff0 NtSetTimer - + 625 0x6f744b0 NtSetTimer2 - + 627 0x6f744c0 NtSetTimerEx - + 628 0x6f744d0 NtSetTimerResolution - + 629 0x6f744e0 NtSetUuidSeed - + 630 0x6f72fd0 NtSetValueKey - + 631 0x6f744f0 NtSetVolumeInformationFile - + 632 0x6f74500 NtSetWnfProcessNotificationEvent - + 633 0x6f74510 NtShutdownSystem - + 634 0x6f74520 NtShutdownWorkerFactory - + 635 0x6f74530 NtSignalAndWaitForSingleObject - + 636 0x6f74540 NtSinglePhaseReject - + 637 0x6f74550 NtStartProfile - + 638 0x6f74560 NtStopProfile - + 639 0x6f74570 NtSubscribeWnfStateChange - + 640 0x6f74580 NtSuspendProcess - + 641 0x6f74590 NtSuspendThread - + 642 0x6f745a0 NtSystemDebugControl - + 643 0x6f745b0 NtTerminateEnclave - + 644 0x6f745c0 NtTerminateJobObject - + 645 0x6f72c90 NtTerminateProcess - + 646 0x6f72f00 NtTerminateThread - + 647 0x6f745d0 NtTestAlert - + 648 0x6f745e0 NtThawRegistry - + 649 0x6f745f0 NtThawTransactions - + 650 0x6f74600 NtTraceControl - + 651 0x6f72fb0 NtTraceEvent - + 652 0x6f74610 NtTranslateFilePath - + 653 0x6f74620 NtUmsThreadYield - + 654 0x6f74630 NtUnloadDriver - + 656 0x6f74640 NtUnloadKey - + 655 0x6f74650 NtUnloadKey2 - + 657 0x6f74660 NtUnloadKeyEx - + 658 0x6f74670 NtUnlockFile - + 659 0x6f74680 NtUnlockVirtualMemory - + 660 0x6f72c70 NtUnmapViewOfSection - + 661 0x6f74690 NtUnmapViewOfSectionEx - + 662 0x6f746a0 NtUnsubscribeWnfStateChange - + 663 0x6f746b0 NtUpdateWnfStateData - + 664 0x6f746c0 NtVdmControl - + 665 0x6f746d0 NtWaitForAlertByThreadId - + 666 0x6f746e0 NtWaitForDebugEvent - + 667 0x6f746f0 NtWaitForKeyedEvent - + 669 0x6f72f80 NtWaitForMultipleObjects - + 668 0x6f72b70 NtWaitForMultipleObjects32 - + 670 0x6f729f0 NtWaitForSingleObject - + 671 0x6f74700 NtWaitForWorkViaWorkerFactory - + 672 0x6f74710 NtWaitHighEventPair - + 673 0x6f74720 NtWaitLowEventPair - + 674 0x6f729c0 NtWorkerFactoryWorkerReady - + 675 0x6f74820 NtWow64AllocateVirtualMemory64 - + 676 0x6f74850 NtWow64CallFunction64 - + 677 0x6f74770 NtWow64CsrAllocateCaptureBuffer - + 678 0x6f74790 NtWow64CsrAllocateMessagePointer - + 679 0x6f747a0 NtWow64CsrCaptureMessageBuffer - + 680 0x6f747b0 NtWow64CsrCaptureMessageString - + 681 0x6f74760 NtWow64CsrClientCallServer - + 682 0x6f74740 NtWow64CsrClientConnectToServer - + 683 0x6f74780 NtWow64CsrFreeCaptureBuffer - + 684 0x6f747c0 NtWow64CsrGetProcessId - + 685 0x6f74750 NtWow64CsrIdentifyAlertableThread - + 686 0x6f747d0 NtWow64CsrVerifyRegion - + 687 0x6f747e0 NtWow64DebuggerCall - + 688 0x6f747f0 NtWow64GetCurrentProcessorNumberEx - + 689 0x6f74800 NtWow64GetNativeSystemInformation - + 690 0x6f74860 NtWow64IsProcessorFeaturePresent - + 691 0x6f74810 NtWow64QueryInformationProcess64 - + 692 0x6f74830 NtWow64ReadVirtualMemory64 - + 693 0x6f74840 NtWow64WriteVirtualMemory64 - + 694 0x6f72a30 NtWriteFile - + 695 0x6f72b80 NtWriteFileGather - + 696 0x6f72f40 NtWriteRequestData - + 697 0x6f72d70 NtWriteVirtualMemory - + 698 0x6f72e30 NtYieldExecution - + 699 0x6f87d40 NtdllDefWindowProc_A - + 700 0x6f87d50 NtdllDefWindowProc_W - + 701 0x6f87e00 NtdllDialogWndProc_A - + 702 0x6f87e10 NtdllDialogWndProc_W - + 703 0x6fc52a0 PfxFindPrefix - + 704 0x6fc5340 PfxInitialize - + 705 0x6fc5360 PfxInsertPrefix - + 706 0x6fc5450 PfxRemovePrefix - + 707 0x70064e0 PssNtCaptureSnapshot - + 708 0x7006ab0 PssNtDuplicateSnapshot - + 709 0x7006b20 PssNtFreeRemoteSnapshot - + 710 0x7006cc0 PssNtFreeSnapshot - + 711 0x7006e20 PssNtFreeWalkMarker - + 712 0x7006e50 PssNtQuerySnapshot - + 713 0x7006fe0 PssNtValidateDescriptor - + 714 0x70070b0 PssNtWalkSnapshot - + 715 0x6fc5690 RtlAbortRXact - + 716 0x6f66a50 RtlAbsoluteToSelfRelativeSD - + 717 0x6f6a890 RtlAcquirePebLock - + 718 0x6fc5e60 RtlAcquirePrivilege - + 719 0x6fca580 RtlAcquireReleaseSRWLockExclusive - + 720 0x6f6be10 RtlAcquireResourceExclusive - + 721 0x6f6b400 RtlAcquireResourceShared - + 722 0x6f42340 RtlAcquireSRWLockExclusive - + 723 0x6f353e0 RtlAcquireSRWLockShared - + 724 0x6f63500 RtlActivateActivationContext - + 725 0x6f63550 RtlActivateActivationContextEx - + 9 0x6f4dc60 RtlActivateActivationContextUnsafeFast - + 726 0x6f53670 RtlAddAccessAllowedAce - + 727 0x6f6d180 RtlAddAccessAllowedAceEx - + 728 0x6fcae30 RtlAddAccessAllowedObjectAce - + 729 0x6fcae80 RtlAddAccessDeniedAce - + 730 0x6fcaeb0 RtlAddAccessDeniedAceEx - + 731 0x6fcaee0 RtlAddAccessDeniedObjectAce - + 732 0x6fcaf30 RtlAddAccessFilterAce - + 733 0x6f2afe0 RtlAddAce - + 734 0x6fc56d0 RtlAddActionToRXact - + 735 0x6f60120 RtlAddAtomToAtomTable - + 736 0x6fc5710 RtlAddAttributeActionToRXact - + 737 0x6fcb110 RtlAddAuditAccessAce - + 738 0x6fcb150 RtlAddAuditAccessAceEx - + 739 0x6fcb190 RtlAddAuditAccessObjectAce - + 740 0x6fcb200 RtlAddCompoundAce - + 741 0x6fcd370 RtlAddIntegrityLabelToBoundaryDescriptor - + 742 0x6f56730 RtlAddMandatoryAce - + 743 0x6fcb330 RtlAddProcessTrustLabelAce - + 744 0x6f350f0 RtlAddRefActivationContext - + 745 0x6fb4f20 RtlAddRefMemoryStream - + 746 0x6fcb450 RtlAddResourceAttributeAce - + 747 0x6f29d40 RtlAddSIDToBoundaryDescriptor - + 748 0x6fcb7c0 RtlAddScopedPolicyIDAce - + 749 0x6fb8510 RtlAddVectoredContinueHandler - + 750 0x6f2b0d0 RtlAddVectoredExceptionHandler - + 751 0x6f39650 RtlAddressInSectionTable - + 752 0x6f66d90 RtlAdjustPrivilege - + 753 0x6f64910 RtlAllocateActivationContextStack - + 754 0x6f63760 RtlAllocateAndInitializeSid - + 755 0x6fc60c0 RtlAllocateAndInitializeSidEx - + 756 0x6f60650 RtlAllocateHandle - + 757 0x6f45da0 RtlAllocateHeap - + 758 0x7022010 RtlAllocateMemoryBlockLookaside - + 759 0x70220a0 RtlAllocateMemoryZone - + 760 0x6f6d700 RtlAllocateWnfSerializationGroup - + 761 0x6f61e40 RtlAnsiCharToUnicodeChar - + 762 0x6f2adb0 RtlAnsiStringToUnicodeSize - + 763 0x6f4c580 RtlAnsiStringToUnicodeString - + 764 0x6fce240 RtlAppendAsciizToString - + 765 0x6facff0 RtlAppendPathElement - + 766 0x6fce2a0 RtlAppendStringToString - + 767 0x6f510f0 RtlAppendUnicodeStringToString - + 768 0x6f3fe60 RtlAppendUnicodeToString - + 769 0x6fba160 RtlApplicationVerifierStop - + 770 0x6fc58b0 RtlApplyRXact - + 771 0x6fc5940 RtlApplyRXactNoFlush - + 772 0x6fac940 RtlAppxIsFileOwnedByTrustedInstaller - + 773 0x6fc6150 RtlAreAllAccessesGranted - + 774 0x6fc6170 RtlAreAnyAccessesGranted - + 775 0x6fce410 RtlAreBitsClear - + 776 0x6f67af0 RtlAreBitsSet - + 777 0x6f64d70 RtlAreLongPathsEnabled - + 778 0x6fcfd90 RtlAssert - + 779 0x6fcfea0 RtlAvlInsertNodeEx - + 780 0x6fd0010 RtlAvlRemoveNode - + 781 0x6fd0450 RtlBarrier - + 782 0x6fd0470 RtlBarrierForDelete - + 783 0x7005380 RtlCancelTimer - + 784 0x6fcda90 RtlCanonicalizeDomainName - + 785 0x6f6f260 RtlCapabilityCheck - + 786 0x6fc6190 RtlCapabilityCheckForSingleSessionSku - + 787 0x6f88960 RtlCaptureContext - + 788 0x6f5c020 RtlCaptureStackBackTrace - + 789 0x6f88c60 RtlCaptureStackContext - + 790 0x6f28e60 RtlCharToInteger - + 791 0x6fd09b0 RtlCheckBootStatusIntegrity - + 792 0x6f68540 RtlCheckForOrphanedCriticalSections - + 793 0x6fd1200 RtlCheckPortableOperatingSystem - + 794 0x6fd12c0 RtlCheckRegistryKey - + 795 0x6fb5c90 RtlCheckSandboxedToken - + 796 0x6fd0ac0 RtlCheckSystemBootStatusIntegrity - + 797 0x6f6f740 RtlCheckTokenCapability - + 798 0x6fc61d0 RtlCheckTokenMembership - + 799 0x6f55fa0 RtlCheckTokenMembershipEx - + 800 0x6f6bcf0 RtlCleanUpTEBLangLists - + 801 0x6fce4e0 RtlClearAllBits - + 802 0x6f870e0 RtlClearBit - + 803 0x6f61b30 RtlClearBits - + 804 0x6f66760 RtlClearThreadWorkOnBehalfTicket - + 805 0x6fb4f30 RtlCloneMemoryStream - + 806 0x6fb58a0 RtlCloneUserProcess - + 807 0x6fd6380 RtlCmDecodeMemIoResource - + 808 0x6fd6400 RtlCmEncodeMemIoResource - + 809 0x6fb6930 RtlCommitDebugInfo - + 810 0x6fb4f30 RtlCommitMemoryStream - + 811 0x6fd6990 RtlCompactHeap - + 812 0x6fda440 RtlCompareAltitudes - + 813 0x6f88070 RtlCompareMemory - + 814 0x6f880c0 RtlCompareMemoryUlong - + 815 0x6fce300 RtlCompareString - + 816 0x6f504e0 RtlCompareUnicodeString - + 817 0x6f50510 RtlCompareUnicodeStrings - + 818 0x6fda6c0 RtlCompressBuffer - + 819 0x6fda960 RtlComputeCrc32 - + 820 0x6fbe690 RtlComputeImportTableHash - + 821 0x6fb4bf0 RtlComputePrivatizedDllName_U - + 822 0x6fda9a0 RtlConnectToSm - + 823 0x6fc3eb0 RtlConsoleMultiByteToUnicodeN - + 824 0x6fdad50 RtlConstructCrossVmEventPath - + 825 0x6fdad50 RtlConstructCrossVmMutexPath - + 826 0x6fdaea0 RtlContractHashTable - + 827 0x6fb50e0 RtlConvertDeviceFamilyInfoToString - + 828 0x6fca6a0 RtlConvertExclusiveToShared - + 829 0x6fd1ae0 RtlConvertLCIDToString - + 830 0x6f886c0 RtlConvertLongToLargeInteger - + 831 0x6fca5b0 RtlConvertSRWLockExclusiveToShared - + 832 0x6fca700 RtlConvertSharedToExclusive - + 833 0x6f539e0 RtlConvertSidToUnicodeString - + 834 0x6fb5cd0 RtlConvertToAutoInheritSecurityObject - + 835 0x6f886d0 RtlConvertUlongToLargeInteger - + 836 0x6fce520 RtlCopyBitMap - + 837 0x6fdb7c0 RtlCopyContext - + 838 0x6fdb930 RtlCopyExtendedContext - + 839 0x6fc61f0 RtlCopyLuid - + 840 0x6fc6210 RtlCopyLuidAndAttributesArray - + 841 0x6fdc7a0 RtlCopyMappedMemory - + 842 0x6fb4f40 RtlCopyMemoryStreamTo - + 843 0x6fb4f40 RtlCopyOutOfProcessMemoryStreamTo - + 844 0x6fb5d00 RtlCopySecurityDescriptor - + 845 0x6f56870 RtlCopySid - + 846 0x6fc6250 RtlCopySidAndAttributesArray - + 847 0x6f2bb00 RtlCopyString - + 848 0x6f55f40 RtlCopyUnicodeString - + 849 0x6fdc880 RtlCrc32 - + 850 0x6fdc8b0 RtlCrc64 - + 851 0x6f57c40 RtlCreateAcl - + 852 0x6f632e0 RtlCreateActivationContext - + 853 0x6fb5d90 RtlCreateAndSetSD - + 854 0x6f60050 RtlCreateAtomTable - + 855 0x6fd0b10 RtlCreateBootStatusDataFile - + 856 0x6f2a210 RtlCreateBoundaryDescriptor - + 857 0x6f5ad10 RtlCreateEnvironment - + 858 0x6f5ad40 RtlCreateEnvironmentEx - + 859 0x6fdafb0 RtlCreateHashTable - + 860 0x6fdafe0 RtlCreateHashTableEx - + 861 0x6f40fa0 RtlCreateHeap - + 862 0x6f2a990 RtlCreateMemoryBlockLookaside - + 863 0x6f2aaf0 RtlCreateMemoryZone - + 864 0x6fb5a90 RtlCreateProcessParameters - + 865 0x6fb5ad0 RtlCreateProcessParametersEx - + 866 0x6f282c0 RtlCreateProcessParametersWithTemplate - + 867 0x6fb51a0 RtlCreateProcessReflection - + 868 0x6fb6950 RtlCreateQueryDebugBuffer - + 869 0x6fd1300 RtlCreateRegistryKey - + 870 0x6f58790 RtlCreateSecurityDescriptor - + 871 0x6f2c1e0 RtlCreateServiceSid - + 872 0x6fdda60 RtlCreateSystemVolumeInformationFolder - + 873 0x6f6a5a0 RtlCreateTagHeap - + 874 0x6f2a540 RtlCreateTimer - + 875 0x6f28fb0 RtlCreateTimerQueue - + 876 0x6f54110 RtlCreateUnicodeString - + 877 0x6f4d550 RtlCreateUnicodeStringFromAsciiz - + 878 0x6fbfd40 RtlCreateUserProcess - + 879 0x6fbfda0 RtlCreateUserProcessEx - + 880 0x6fb6070 RtlCreateUserSecurityObject - + 881 0x6f720a0 RtlCreateUserStack - + 882 0x6f70540 RtlCreateUserThread - + 883 0x6fc62e0 RtlCreateVirtualAccountSid - + 884 0x6f55700 RtlCultureNameToLCID - + 885 0x6fc4000 RtlCustomCPToUnicodeN - + 886 0x6f5cb30 RtlCutoverTimeToSystemTime - + 887 0x6fb6ae0 RtlDeCommitDebugInfo - + 888 0x6fb5b10 RtlDeNormalizeProcessParams - + 889 0x6f64ac0 RtlDeactivateActivationContext - + 10 0x6f4c720 RtlDeactivateActivationContextUnsafeFast - + 890 0x6f6d8a0 RtlDebugPrintTimes - + 891 0x6f64d90 RtlDecodePointer - + 892 0x6fba460 RtlDecodeRemotePointer - + 893 0x6f2bbf0 RtlDecodeSystemPointer - + 894 0x6fda720 RtlDecompressBuffer - + 895 0x6fda780 RtlDecompressBufferEx - + 896 0x6fda7e0 RtlDecompressFragment - + 897 0x6fb60d0 RtlDefaultNpAcl - + 898 0x6f28010 RtlDelete - + 899 0x6f29390 RtlDeleteAce - + 900 0x6f27870 RtlDeleteAtomFromAtomTable - + 901 0x6fd0490 RtlDeleteBarrier - + 902 0x6f2ba90 RtlDeleteBoundaryDescriptor - + 903 0x6f2fbe0 RtlDeleteCriticalSection - + 904 0x6f27eb0 RtlDeleteElementGenericTable - + 905 0x6f26e10 RtlDeleteElementGenericTableAvl - + 906 0x6f26e50 RtlDeleteElementGenericTableAvlEx - + 907 0x6fdb000 RtlDeleteHashTable - + 908 0x6f67800 RtlDeleteNoSplay - + 909 0x6fd1340 RtlDeleteRegistryValue - + 910 0x6f29e40 RtlDeleteResource - + 911 0x6f6c640 RtlDeleteSecurityObject - + 912 0x6f28c90 RtlDeleteTimer - + 913 0x70053a0 RtlDeleteTimerQueue - + 914 0x6f28b10 RtlDeleteTimerQueueEx - + 915 0x6fde610 RtlDeregisterSecureMemoryCacheCallback - + 916 0x7005620 RtlDeregisterWait - + 917 0x6f28060 RtlDeregisterWaitEx - + 918 0x6f6e540 RtlDeriveCapabilitySidsFromName - + 919 0x6fcd170 RtlDestroyAtomTable - + 920 0x6f2b9c0 RtlDestroyEnvironment - + 921 0x6f2bf80 RtlDestroyHandleTable - + 922 0x6f2f8c0 RtlDestroyHeap - + 923 0x6fcd6d0 RtlDestroyMemoryBlockLookaside - + 924 0x6fcd8f0 RtlDestroyMemoryZone - + 925 0x6f2b9c0 RtlDestroyProcessParameters - + 926 0x6fb6b00 RtlDestroyQueryDebugBuffer - + 927 0x6f5d910 RtlDetectHeapLeaks - + 928 0x6f334e0 RtlDetermineDosPathNameType_U - + 929 0x6facd10 RtlDisableThreadProfiling - + 930 0x6f6c1e0 RtlDisownModuleHeapAllocation - + 8 0x6f2c020 RtlDispatchAPC - + 931 0x6f5f4e0 RtlDllShutdownInProgress - + 932 0x6fcdc70 RtlDnsHostNameToComputerName - + 933 0x6fad200 RtlDoesFileExists_U - + 934 0x6fe14c0 RtlDoesNameContainWildCards - + 935 0x6f49890 RtlDosApplyFileIsolationRedirection_Ustr - + 936 0x6fad220 RtlDosLongPathNameToNtPathName_U_WithStatus - + 937 0x6fad250 RtlDosLongPathNameToRelativeNtPathName_U_WithStatus - + 938 0x6f51bc0 RtlDosPathNameToNtPathName_U - + 939 0x6f51de0 RtlDosPathNameToNtPathName_U_WithStatus - + 940 0x6f51c30 RtlDosPathNameToRelativeNtPathName_U - + 941 0x6f41e60 RtlDosPathNameToRelativeNtPathName_U_WithStatus - + 942 0x6fad280 RtlDosSearchPath_U - + 943 0x6f451d0 RtlDosSearchPath_Ustr - + 944 0x6fcdd30 RtlDowncaseUnicodeChar - + 945 0x6f2ab80 RtlDowncaseUnicodeString - + 946 0x6fca7d0 RtlDumpResource - + 947 0x6f6cf00 RtlDuplicateUnicodeString - + 948 0x6fcd220 RtlEmptyAtomTable - + 949 0x6fca820 RtlEnableEarlyCriticalSectionEventCreation - + 950 0x6facd60 RtlEnableThreadProfiling - + 951 0x6f65750 RtlEncodePointer - + 952 0x6fba4b0 RtlEncodeRemotePointer - + 953 0x6f6d660 RtlEncodeSystemPointer - + 954 0x6fdb090 RtlEndEnumerationHashTable - + 955 0x6fdb0e0 RtlEndStrongEnumerationHashTable - + 956 0x6fdb0f0 RtlEndWeakEnumerationHashTable - + 957 0x6f88460 RtlEnlargedIntegerMultiply - + 958 0x6f88470 RtlEnlargedUnsignedMultiply - + 959 0x6f3fef0 RtlEnterCriticalSection - + 960 0x6fd6af0 RtlEnumProcessHeaps - + 961 0x6fdb100 RtlEnumerateEntryHashTable - + 962 0x6fde270 RtlEnumerateGenericTable - + 963 0x6f2b870 RtlEnumerateGenericTableAvl - + 964 0x6fde380 RtlEnumerateGenericTableLikeADirectory - + 965 0x6f2b9f0 RtlEnumerateGenericTableWithoutSplaying - + 966 0x6f2b8a0 RtlEnumerateGenericTableWithoutSplayingAvl - + 967 0x6fcdd50 RtlEqualComputerName - + 968 0x6fcdd60 RtlEqualDomainName - + 969 0x6fc63c0 RtlEqualLuid - + 970 0x6f58350 RtlEqualPrefixSid - + 971 0x6f58620 RtlEqualSid - + 972 0x6f29440 RtlEqualString - + 973 0x6f512a0 RtlEqualUnicodeString - + 974 0x6f2c1b0 RtlEqualWnfChangeStamps - + 975 0x6fc63f0 RtlEraseUnicodeString - + 976 0x6fe1b90 RtlEthernetAddressToStringA - + 977 0x6fe1d70 RtlEthernetAddressToStringW - + 978 0x6fe21e0 RtlEthernetStringToAddressA - + 979 0x6fe2300 RtlEthernetStringToAddressW - + 980 0x6f5d620 RtlExitUserProcess - + 981 0x6f6b4b0 RtlExitUserThread - + 982 0x6f5c3f0 RtlExpandEnvironmentStrings - + 983 0x6f5c380 RtlExpandEnvironmentStrings_U - + 984 0x6fdb1a0 RtlExpandHashTable - + 985 0x6fe2420 RtlExtendCorrelationVector - + 986 0x6fcd720 RtlExtendMemoryBlockLookaside - + 987 0x6fcd950 RtlExtendMemoryZone - + 988 0x6f88590 RtlExtendedIntegerMultiply - + 989 0x6f884a0 RtlExtendedLargeIntegerDivide - + 990 0x6f88500 RtlExtendedMagicDivide - + 991 0x6fce6f0 RtlExtractBitMap - + 992 0x6f880f0 RtlFillMemory - + 993 0x6f88160 RtlFillMemoryUlong - + 994 0x6f88130 RtlFillMemoryUlonglong - + 995 0x6fb4f50 RtlFinalReleaseOutOfProcessMemoryStream - + 996 0x6f57ff0 RtlFindAceByType - + 997 0x6f4d6b0 RtlFindActivationContextSectionGuid - + 998 0x6f4a190 RtlFindActivationContextSectionString - + 999 0x6f4aa80 RtlFindCharInUnicodeString - + 1000 0x6fce870 RtlFindClearBits - + 1001 0x6f619e0 RtlFindClearBitsAndSet - + 1002 0x6fceb20 RtlFindClearRuns - + 1003 0x6fd6530 RtlFindClosestEncodableLength - + 1004 0x6fcd390 RtlFindExportedRoutineByName - + 1005 0x6fced60 RtlFindLastBackwardRunClear - + 1006 0x6fcee40 RtlFindLeastSignificantBit - + 1007 0x6fceee0 RtlFindLongestRunClear - + 1008 0x6f5ff70 RtlFindMessage - + 1009 0x6fcef20 RtlFindMostSignificantBit - + 1010 0x6fcefc0 RtlFindNextForwardRunClear - + 1011 0x6fcf0c0 RtlFindSetBits - + 1012 0x6fcf380 RtlFindSetBitsAndClear - + 1013 0x6f66240 RtlFindUnicodeSubstring - + 1014 0x6fbea60 RtlFirstEntrySList - + 1015 0x6f57f90 RtlFirstFreeAce - + 1016 0x6f65540 RtlFlsAlloc - + 1017 0x6f687e0 RtlFlsFree - + 1018 0x6f5ba80 RtlFlsGetValue - + 1019 0x6f5bea0 RtlFlsSetValue - + 1020 0x6fd6b10 RtlFlushHeaps - + 1021 0x6fde6a0 RtlFlushSecureMemoryCache - + 1022 0x6f538b0 RtlFormatCurrentUserKeyPath - + 1023 0x6fe27b0 RtlFormatMessage - + 1024 0x6f60e70 RtlFormatMessageEx - + 1025 0x6f64a10 RtlFreeActivationContextStack - + 1026 0x6f43ba0 RtlFreeAnsiString - + 1027 0x6f677d0 RtlFreeHandle - + 1028 0x6f43bd0 RtlFreeHeap - + 1029 0x7022190 RtlFreeMemoryBlockLookaside - + 1030 0x6fcddd0 RtlFreeOemString - + 1031 0x6f6a770 RtlFreeSid - + 1032 0x6f64960 RtlFreeThreadActivationContextStack - + 1033 0x6f43ba0 RtlFreeUTF8String - + 1034 0x6f43ba0 RtlFreeUnicodeString - + 1035 0x6fade40 RtlFreeUserStack - + 1036 0x6fe2810 RtlGUIDFromString - + 1037 0x6fe2ae0 RtlGenerate8dot3Name - + 1038 0x6f6a0f0 RtlGetAce - + 1039 0x6f667a0 RtlGetActiveActivationContext - + 1040 0x6f6c730 RtlGetActiveConsoleId - + 1041 0x6f67980 RtlGetAppContainerNamedObjectPath - + 1042 0x6fc6430 RtlGetAppContainerParent - + 1043 0x6fc64e0 RtlGetAppContainerSidType - + 1044 0x6fd05c0 RtlGetCallersAddress - + 1045 0x6fda840 RtlGetCompressionWorkSpaceSize - + 1046 0x6fe3160 RtlGetConsoleSessionForegroundProcessId - + 1047 0x6f6bdd0 RtlGetControlSecurityDescriptor - + 1048 0x6fca840 RtlGetCriticalSectionRecursionCount - + 1049 0x6f27c00 RtlGetCurrentDirectory_U - + 1050 0x6fe3190 RtlGetCurrentPeb - + 1051 0x6f67440 RtlGetCurrentProcessorNumber - + 1052 0x6f66150 RtlGetCurrentProcessorNumberEx - + 1053 0x6f43c50 RtlGetCurrentServiceSessionId - + 1054 0x6f60910 RtlGetCurrentTransaction - + 1055 0x6f656e0 RtlGetDaclSecurityDescriptor - + 1056 0x6f6b9c0 RtlGetDeviceFamilyInfoEnum - + 1057 0x6fde2c0 RtlGetElementGenericTable - + 1058 0x6fde460 RtlGetElementGenericTableAvl - + 1059 0x6f6c260 RtlGetEnabledExtendedFeatures - + 1060 0x6f2beb0 RtlGetExePath - + 1062 0x6fdba00 RtlGetExtendedContextLength - + 1061 0x6fdb950 RtlGetExtendedContextLength2 - + 1063 0x6fdba50 RtlGetExtendedFeaturesMask - + 1064 0x6fd1bb0 RtlGetFileMUIPath - + 1065 0x6fae650 RtlGetFrame - + 1066 0x6f6cb10 RtlGetFullPathName_U - + 1067 0x6f52340 RtlGetFullPathName_UEx - + 1068 0x6f496b0 RtlGetFullPathName_UstrEx - + 1069 0x6f6ce20 RtlGetGroupSecurityDescriptor - + 1070 0x6f60490 RtlGetIntegerAtom - + 1071 0x6fc4a00 RtlGetInterruptTimePrecise - + 1072 0x6f6caf0 RtlGetLastNtStatus - + 1073 0x6fe3280 RtlGetLastWin32Error - + 1074 0x6f63f50 RtlGetLengthWithoutLastFullDosOrNtPathElement - + 1075 0x6fad450 RtlGetLengthWithoutTrailingPathSeperators - + 1076 0x6f6a300 RtlGetLocaleFileMappingAddress - + 1077 0x6f6d5d0 RtlGetLongestNtPathLength - + 1078 0x6fc4b10 RtlGetMultiTimePrecise - + 1079 0x6f74800 RtlGetNativeSystemInformation - + 1080 0x6fdb340 RtlGetNextEntryHashTable - + 1081 0x6f87190 RtlGetNtGlobalFlags - + 1082 0x6f30640 RtlGetNtProductType - + 1083 0x6f401e0 RtlGetNtSystemRoot - + 1084 0x6fb3cb0 RtlGetNtVersionNumbers - + 1085 0x6f6aad0 RtlGetOwnerSecurityDescriptor - + 1086 0x6f541f0 RtlGetParentLocaleName - + 1087 0x6f65c00 RtlGetPersistedStateLocation - + 1088 0x6fd6b30 RtlGetProcessHeaps - + 1089 0x6fd2500 RtlGetProcessPreferredUILanguages - + 1090 0x6f6d270 RtlGetProductInfo - + 1091 0x6f306a0 RtlGetReturnAddressHijackTarget - + 1092 0x6f6c0a0 RtlGetSaclSecurityDescriptor - + 1093 0x6f2b630 RtlGetSearchPath - + 1094 0x6fc6550 RtlGetSecurityDescriptorRMControl - + 1095 0x6fc6580 RtlGetSessionProperties - + 1096 0x6fd0c40 RtlGetSetBootStatusData - + 1097 0x6f30680 RtlGetSuiteMask - + 1098 0x6fd0d40 RtlGetSystemBootStatus - + 1099 0x6fd0d80 RtlGetSystemBootStatusEx - + 1100 0x6fd25d0 RtlGetSystemPreferredUILanguages - + 1101 0x6f86f90 RtlGetSystemTimeAndBias - + 1102 0x6f5bb60 RtlGetSystemTimePrecise - + 1103 0x6fae5f0 RtlGetThreadErrorMode - + 1104 0x6fd2a40 RtlGetThreadLangIdByIndex - + 1105 0x6f52dd0 RtlGetThreadPreferredUILanguages - + 1106 0x6f27400 RtlGetThreadWorkOnBehalfTicket - + 1107 0x6fc6610 RtlGetTokenNamedObjectPath - + 1108 0x6fd2b10 RtlGetUILanguageInfo - + 1109 0x6faf660 RtlGetUnloadEventTrace - + 1110 0x6faf670 RtlGetUnloadEventTraceEx - + 1111 0x6f63830 RtlGetUserInfoHeap - + 1112 0x6f2a750 RtlGetUserPreferredUILanguages - + 1113 0x6f2ff40 RtlGetVersion - + 1114 0x6fe3b90 RtlGuardCheckLongJumpTarget - + 1115 0x6f279c0 RtlHashUnicodeString - + 1116 0x6fe4340 RtlHeapTrkInitialize - + 1117 0x6f6d5b0 RtlIdentifierAuthoritySid - + 1118 0x6f65920 RtlIdnToAscii - + 1119 0x6fe54a0 RtlIdnToNameprepUnicode - + 1120 0x6fe54d0 RtlIdnToUnicode - + 1121 0x6f3de40 RtlImageDirectoryEntryToData - + 1122 0x6f3b940 RtlImageNtHeader - + 1123 0x6f3e5a0 RtlImageNtHeaderEx - + 1124 0x6fcd490 RtlImageRvaToSection - + 1125 0x6fcd4e0 RtlImageRvaToVa - + 1126 0x6f6bfa0 RtlImpersonateSelf - + 1127 0x6f6bfc0 RtlImpersonateSelfEx - + 1128 0x6fe2470 RtlIncrementCorrelationVector - + 1129 0x6f75030 RtlInitAnsiString - + 1130 0x6f5ff20 RtlInitAnsiStringEx - + 1131 0x6fd04c0 RtlInitBarrier - + 1132 0x6fc4150 RtlInitCodePageTable - + 1133 0x6fdb390 RtlInitEnumerationHashTable - + 1134 0x6fb4f50 RtlInitMemoryStream - + 1135 0x6fc4250 RtlInitNlsTables - + 1136 0x6fb4f50 RtlInitOutOfProcessMemoryStream - + 1137 0x6f74ff0 RtlInitString - + 1138 0x6fce3a0 RtlInitStringEx - + 1139 0x6fdb3f0 RtlInitStrongEnumerationHashTable - + 1140 0x6fce3b0 RtlInitUTF8String - + 1141 0x6fce3a0 RtlInitUTF8StringEx - + 1142 0x6f75070 RtlInitUnicodeString - + 1143 0x6f51d30 RtlInitUnicodeStringEx - + 1144 0x6fdb430 RtlInitWeakEnumerationHashTable - + 1145 0x6fb4f20 RtlInitializeAtomPackage - + 1146 0x6f6d580 RtlInitializeBitMap - + 1147 0x6f64d50 RtlInitializeConditionVariable - + 1148 0x6fe6510 RtlInitializeContext - + 1149 0x6fe2540 RtlInitializeCorrelationVector - + 1150 0x6f5c330 RtlInitializeCriticalSection - + 1151 0x6f61ba0 RtlInitializeCriticalSectionAndSpinCount - + 1152 0x6f5fbe0 RtlInitializeCriticalSectionEx - + 1153 0x6f67ab0 RtlInitializeExceptionChain - + 1155 0x6fdbbf0 RtlInitializeExtendedContext - + 1154 0x6fdba70 RtlInitializeExtendedContext2 - + 1156 0x6f6b6b0 RtlInitializeGenericTable - + 1157 0x6f6d620 RtlInitializeGenericTableAvl - + 1158 0x6f6b460 RtlInitializeHandleTable - + 1159 0x6f748a0 RtlInitializeNtUserPfn - + 1160 0x6fc5960 RtlInitializeRXact - + 1161 0x6f5fac0 RtlInitializeResource - + 1162 0x6f685e0 RtlInitializeSListHead - + 1163 0x6f64d50 RtlInitializeSRWLock - + 1164 0x6f58310 RtlInitializeSid - + 1165 0x6f58880 RtlInitializeSidEx - + 1166 0x6f27db0 RtlInsertElementGenericTable - + 1167 0x6f26f30 RtlInsertElementGenericTableAvl - + 1168 0x6f27df0 RtlInsertElementGenericTableFull - + 1169 0x6f26f70 RtlInsertElementGenericTableFullAvl - + 1170 0x6fdb440 RtlInsertEntryHashTable - + 1171 0x6fd06e0 RtlInt64ToUnicodeString - + 1172 0x6f52b30 RtlIntegerToChar - + 1173 0x6f52ac0 RtlIntegerToUnicodeString - + 1174 0x6fcf660 RtlInterlockedClearBitRun - + 1175 0x6f88700 RtlInterlockedCompareExchange64 - + 1176 0x6f64df0 RtlInterlockedFlushSList - + 1177 0x6f42140 RtlInterlockedPopEntrySList - + 1178 0x6f42190 RtlInterlockedPushEntrySList - + 11 0x6fbe9e0 RtlInterlockedPushListSList - + 1179 0x6fe6960 RtlInterlockedPushListSListEx - + 1180 0x6fcf700 RtlInterlockedSetBitRun - + 1181 0x6fd6600 RtlIoDecodeMemIoResource - + 1182 0x6fd66c0 RtlIoEncodeMemIoResource - + 1183 0x6f72250 RtlIpv4AddressToStringA - + 1184 0x6fe1be0 RtlIpv4AddressToStringExA - + 1185 0x6fe1dc0 RtlIpv4AddressToStringExW - + 1186 0x6fe1e70 RtlIpv4AddressToStringW - + 1187 0x6f6ca30 RtlIpv4StringToAddressA - + 1188 0x6f6c9e0 RtlIpv4StringToAddressExA - + 1189 0x6f68a10 RtlIpv4StringToAddressExW - + 1190 0x6f68a60 RtlIpv4StringToAddressW - + 1191 0x6f727d0 RtlIpv6AddressToStringA - + 1192 0x6fe1c90 RtlIpv6AddressToStringExA - + 1193 0x6fe1eb0 RtlIpv6AddressToStringExW - + 1194 0x6fe1fc0 RtlIpv6AddressToStringW - + 1195 0x6f6c310 RtlIpv6StringToAddressA - + 1196 0x6f6c2a0 RtlIpv6StringToAddressExA - + 1197 0x6f68000 RtlIpv6StringToAddressExW - + 1198 0x6f68070 RtlIpv6StringToAddressW - + 1199 0x6fbdc50 RtlIsActivationContextActive - + 1200 0x6f59430 RtlIsCapabilitySid - + 1201 0x6f6c110 RtlIsCloudFilesPlaceholder - + 1202 0x6fca870 RtlIsCriticalSectionLocked - + 1203 0x6f521a0 RtlIsCriticalSectionLockedByThread - + 1204 0x6fe6ac0 RtlIsCurrentProcess - + 1205 0x6fe6af0 RtlIsCurrentThread - + 1206 0x6f861d0 RtlIsCurrentThreadAttachExempt - + 1207 0x6f51c00 RtlIsDosDeviceName_U - + 1208 0x6fc6640 RtlIsElevatedRid - + 1209 0x6fde360 RtlIsGenericTableEmpty - + 1210 0x6fde550 RtlIsGenericTableEmptyAvl - + 1211 0x6f2d810 RtlIsMultiSessionSku - + 1212 0x6f71da0 RtlIsMultiUsersInSessionSku - + 1213 0x6fe1510 RtlIsNameInExpression - + 1214 0x6fe15a0 RtlIsNameInUnUpcasedExpression - + 1215 0x6fe2f40 RtlIsNameLegalDOS8Dot3 - + 1216 0x6fe6b20 RtlIsNonEmptyDirectoryReparsePointAllowed - + 1217 0x6fe8720 RtlIsNormalizedString - + 1218 0x6f2afa0 RtlIsPackageSid - + 1219 0x6fc6690 RtlIsParentOfChildAppContainer - + 1220 0x6f6ab20 RtlIsPartialPlaceholder - + 1221 0x6fe6980 RtlIsPartialPlaceholderFileHandle - + 1222 0x6fe69d0 RtlIsPartialPlaceholderFileInfo - + 1223 0x6f6a5f0 RtlIsProcessorFeaturePresent - + 1224 0x6f660f0 RtlIsStateSeparationEnabled - + 1225 0x6f5c620 RtlIsTextUnicode - + 1226 0x6f6d0f0 RtlIsThreadWithinLoaderCallout - + 1227 0x6fc6700 RtlIsUntrustedObject - + 1228 0x6f605b0 RtlIsValidHandle - + 1229 0x6f60570 RtlIsValidIndexHandle - + 1230 0x6fe32c0 RtlIsValidLocaleName - + 1231 0x6fc6830 RtlIsValidProcessTrustLabelSid - + 1232 0x6fe6b50 RtlIsZeroMemory - + 1233 0x6fe8890 RtlKnownExceptionFilter - + 1234 0x6f54f60 RtlLCIDToCultureName - + 1235 0x6f88440 RtlLargeIntegerAdd - + 1236 0x6f88650 RtlLargeIntegerArithmeticShift - + 1237 0x6fe8d50 RtlLargeIntegerDivide - + 1238 0x6f88680 RtlLargeIntegerNegate - + 1239 0x6f885f0 RtlLargeIntegerShiftLeft - + 1240 0x6f88620 RtlLargeIntegerShiftRight - + 1241 0x6f886a0 RtlLargeIntegerSubtract - + 1242 0x6fd0760 RtlLargeIntegerToChar - + 1243 0x6f55a60 RtlLcidToLocaleName - + 1244 0x6f3e760 RtlLeaveCriticalSection - + 1245 0x6f6c1b0 RtlLengthRequiredSid - + 1246 0x6f68720 RtlLengthSecurityDescriptor - + 1247 0x6f648f0 RtlLengthSid - + 1248 0x6fc68a0 RtlLengthSidAsUnicodeString - + 1249 0x6f3a090 RtlLoadString - + 1250 0x6fc4e50 RtlLocalTimeToSystemTime - + 1251 0x6f558b0 RtlLocaleNameToLcid - + 1253 0x6fdbda0 RtlLocateExtendedFeature - + 1252 0x6fdbc40 RtlLocateExtendedFeature2 - + 1254 0x6fdbdd0 RtlLocateLegacyContext - + 1255 0x6fd0da0 RtlLockBootStatusData - + 1256 0x6fe8df0 RtlLockCurrentThread - + 1257 0x6f5dae0 RtlLockHeap - + 1258 0x6fcd740 RtlLockMemoryBlockLookaside - + 1259 0x6fb4f40 RtlLockMemoryStreamRegion - + 1260 0x6f29620 RtlLockMemoryZone - + 1261 0x6f296f0 RtlLockModuleSection - + 1262 0x6fe8ff0 RtlLogStackBackTrace - + 1263 0x6f602c0 RtlLookupAtomInAtomTable - + 1264 0x6f27f30 RtlLookupElementGenericTable - + 1265 0x6f27070 RtlLookupElementGenericTableAvl - + 1266 0x6f27f60 RtlLookupElementGenericTableFull - + 1267 0x6f270a0 RtlLookupElementGenericTableFullAvl - + 1268 0x6fdb4b0 RtlLookupEntryHashTable - + 1269 0x6fde570 RtlLookupFirstMatchingElementGenericTableAvl - + 1270 0x6f66a80 RtlMakeSelfRelativeSD - + 1271 0x6f58400 RtlMapGenericMask - + 1272 0x6fc68f0 RtlMapSecurityErrorToNtStatus - + 1273 0x6f881b0 RtlMoveMemory - + 1274 0x6f61400 RtlMultiAppendUnicodeStringBuffer - + 1275 0x6f61ea0 RtlMultiByteToUnicodeN - + 1276 0x6f4e9c0 RtlMultiByteToUnicodeSize - + 1277 0x6fd6ea0 RtlMultipleAllocateHeap - + 1278 0x6fd6ee0 RtlMultipleFreeHeap - + 1279 0x6fb63b0 RtlNewInstanceSecurityObject - + 1280 0x6fb6470 RtlNewSecurityGrantedAccess - + 1281 0x6f2c150 RtlNewSecurityObject - + 1282 0x6f593f0 RtlNewSecurityObjectEx - + 1283 0x6fb6570 RtlNewSecurityObjectWithMultipleInheritance - + 1284 0x6fbfe20 RtlNormalizeProcessParams - + 1285 0x6fc69e0 RtlNormalizeSecurityDescriptor - + 1286 0x6fe8790 RtlNormalizeString - + 1287 0x6fe97a0 RtlNotifyFeatureUsage - + 1288 0x6fad4b0 RtlNtPathNameToDosPathName - + 1289 0x6f5abc0 RtlNtStatusToDosError - + 1290 0x6f66030 RtlNtStatusToDosErrorNoTeb - + 1291 0x6f2b420 RtlNumberGenericTableElements - + 1292 0x6fde5f0 RtlNumberGenericTableElementsAvl - + 1293 0x6fcf840 RtlNumberOfClearBits - + 1294 0x6fcf860 RtlNumberOfClearBitsInRange - + 1295 0x6fcf890 RtlNumberOfSetBits - + 1296 0x6fcf9e0 RtlNumberOfSetBitsInRange - + 1297 0x6f87a30 RtlNumberOfSetBitsUlongPtr - + 1298 0x6f2adb0 RtlOemStringToUnicodeSize - + 1299 0x6f2ac40 RtlOemStringToUnicodeString - + 1300 0x6f2ad20 RtlOemToUnicodeN - + 1301 0x6f2d780 RtlOpenCurrentUser - + 1302 0x6fe9c00 RtlOsDeploymentState - + 1303 0x6fc6e40 RtlOwnerAcesPresent - + 1304 0x6f3c6b0 RtlPcToFileHeader - + 1305 0x6fcd2c0 RtlPinAtomInAtomTable - + 1306 0x6fae670 RtlPopFrame - + 1307 0x6f60ac0 RtlPrefixString - + 1308 0x6f64110 RtlPrefixUnicodeString - + 1309 0x6fbd740 RtlProcessFlsData - + 1310 0x6f29060 RtlProtectHeap - + 1311 0x6f72030 RtlPublishWnfStateData - + 1312 0x6fae6a0 RtlPushFrame - + 1313 0x6f342d0 RtlQueryActivationContextApplicationSettings - + 1314 0x6fe9810 RtlQueryAllFeatureConfigurations - + 1315 0x6f29ee0 RtlQueryAtomInAtomTable - + 1316 0x6fca890 RtlQueryCriticalSectionOwner - + 1317 0x6f66d70 RtlQueryDepthSList - + 1318 0x6fd13a0 RtlQueryDynamicTimeZoneInformation - + 1319 0x6f6c470 RtlQueryElevationFlags - + 1320 0x6f3f890 RtlQueryEnvironmentVariable - + 1321 0x6f5b150 RtlQueryEnvironmentVariable_U - + 1322 0x6f65220 RtlQueryFeatureConfiguration - + 1323 0x6fe9880 RtlQueryFeatureConfigurationChangeStamp - + 1324 0x6fe98b0 RtlQueryFeatureUsageNotificationSubscriptions - + 1325 0x6fd6f20 RtlQueryHeapInformation - + 1326 0x6fbff70 RtlQueryImageMitigationPolicy - + 1327 0x6f59670 RtlQueryInformationAcl - + 1328 0x6f34d20 RtlQueryInformationActivationContext - + 1329 0x6f33ee0 RtlQueryInformationActiveActivationContext - + 1330 0x6fb4f60 RtlQueryInterfaceMemoryStream - + 1331 0x6fc2d00 RtlQueryModuleInformation - + 1332 0x6f64ec0 RtlQueryPackageClaims - + 1333 0x6f64e30 RtlQueryPackageIdentity - + 1334 0x6f64e70 RtlQueryPackageIdentityEx - + 1335 0x6f5bc70 RtlQueryPerformanceCounter - + 1336 0x6f64dc0 RtlQueryPerformanceFrequency - + 1337 0x6fb6b40 RtlQueryProcessBackTraceInformation - + 1338 0x6fb6c90 RtlQueryProcessDebugInformation - + 1339 0x6fb70c0 RtlQueryProcessHeapInformation - + 1340 0x6fb73d0 RtlQueryProcessLockInformation - + 1341 0x6fe6a50 RtlQueryProcessPlaceholderCompatibilityMode - + 1342 0x6f6d080 RtlQueryProtectedPolicy - + 1343 0x6fd13c0 RtlQueryRegistryValueWithFallback - + 1344 0x6fd14c0 RtlQueryRegistryValues - + 1345 0x6fd14f0 RtlQueryRegistryValuesEx - + 1346 0x6f2fea0 RtlQueryResourcePolicy - + 1347 0x6fb65a0 RtlQuerySecurityObject - + 1348 0x6fd7060 RtlQueryTagHeap - + 1349 0x6f6b9a0 RtlQueryThreadPlaceholderCompatibilityMode - + 1350 0x6face40 RtlQueryThreadProfiling - + 1351 0x6fd1520 RtlQueryTimeZoneInformation - + 1352 0x6fe9ce0 RtlQueryTokenHostIdAsUlong64 - + 1353 0x6f5c560 RtlQueryUnbiasedInterruptTime - + 1354 0x6fe9d60 RtlQueryValidationRunlevel - + 1355 0x6fbbf90 RtlQueryWnfMetaNotification - + 1356 0x6f2e890 RtlQueryWnfStateData - + 1357 0x6fbbfe0 RtlQueryWnfStateDataWithExplicitScope - + 1358 0x6fba260 RtlQueueApcWow64Thread - + 1359 0x6f68b30 RtlQueueWorkItem - + 1360 0x6fe9df0 RtlRaiseCustomSystemEventTrigger - + 1361 0x6f88a80 RtlRaiseException - + 1362 0x6f88ac0 RtlRaiseStatus - + 1363 0x6f2ed10 RtlRandom - + 1364 0x6f2ed10 RtlRandomEx - + 1365 0x6f4eba0 RtlRbInsertNodeEx - + 1366 0x6f59b60 RtlRbRemoveNode - + 1367 0x6f42720 RtlReAllocateHeap - + 1368 0x6fb4f70 RtlReadMemoryStream - + 1369 0x6fb4f70 RtlReadOutOfProcessMemoryStream - + 1370 0x6face60 RtlReadThreadProfilingData - + 1371 0x6fde1c0 RtlRealPredecessor - + 1372 0x6fde200 RtlRealSuccessor - + 1373 0x6f32430 RtlRegisterFeatureConfigurationChangeNotification - + 1374 0x6fbc0c0 RtlRegisterForWnfMetaNotification - + 1375 0x6fde700 RtlRegisterSecureMemoryCacheCallback - + 1376 0x6f38140 RtlRegisterThreadWithCsrss - + 1377 0x6f32080 RtlRegisterWait - + 1378 0x6f326c0 RtlReleaseActivationContext - + 1379 0x6fb4f20 RtlReleaseMemoryStream - + 1380 0x6f5e800 RtlReleasePath - + 1381 0x6f69fa0 RtlReleasePebLock - + 1382 0x6fc6e60 RtlReleasePrivilege - + 1383 0x6f65500 RtlReleaseRelativeName - + 1384 0x6f6a8e0 RtlReleaseResource - + 1385 0x6f424e0 RtlReleaseSRWLockExclusive - + 1386 0x6f35310 RtlReleaseSRWLockShared - + 1387 0x6fe65d0 RtlRemoteCall - + 1388 0x6fdb4f0 RtlRemoveEntryHashTable - + 1389 0x6fc6ef0 RtlRemovePrivileges - + 1390 0x6fb8530 RtlRemoveVectoredContinueHandler - + 1391 0x6f2b270 RtlRemoveVectoredExceptionHandler - + 1392 0x6fc7020 RtlReplaceSidInSd - + 1393 0x6f66160 RtlReplaceSystemDirectoryInPath - + 1394 0x6fba610 RtlReportException - + 1395 0x6fba690 RtlReportExceptionEx - + 1396 0x6f5d960 RtlReportSilentProcessExit - + 1397 0x6fbac90 RtlReportSqmEscalation - + 1398 0x6fcd7b0 RtlResetMemoryBlockLookaside - + 1399 0x6fcda20 RtlResetMemoryZone - + 1400 0x6f749c0 RtlResetNtUserPfn - + 1401 0x6fc42a0 RtlResetRtlTranslations - + 1402 0x6fd0dc0 RtlRestoreBootStatusDefaults - + 1403 0x6f5ab50 RtlRestoreLastWin32Error - + 1404 0x6fd0e80 RtlRestoreSystemBootStatusDefaults - + 1405 0x6fd2f20 RtlRestoreThreadPreferredUILanguages - + 1406 0x6f74a70 RtlRetrieveNtUserPfn - + 1407 0x6fb4f80 RtlRevertMemoryStream - + 1408 0x6fc7310 RtlRunDecodeUnicodeString - + 1409 0x6fc7360 RtlRunEncodeUnicodeString - + 1410 0x6f32380 RtlRunOnceBeginInitialize - + 1411 0x6f311a0 RtlRunOnceComplete - + 1412 0x6f30fd0 RtlRunOnceExecuteOnce - + 1413 0x6f64d50 RtlRunOnceInitialize - + 1414 0x6fc4eb0 RtlSecondsSince1970ToTime - + 1415 0x6fc4ef0 RtlSecondsSince1980ToTime - + 1416 0x6fb4f90 RtlSeekMemoryStream - + 1418 0x6fc5cf0 RtlSelfRelativeToAbsoluteSD - + 1417 0x6fc5c50 RtlSelfRelativeToAbsoluteSD2 - + 1419 0x6fdab10 RtlSendMsgToSm - + 1420 0x6fcfbd0 RtlSetAllBits - + 1421 0x6fc73f0 RtlSetAttributesSecurityDescriptor - + 1422 0x6f87110 RtlSetBit - + 1423 0x6f61af0 RtlSetBits - + 1424 0x6f6d3c0 RtlSetControlSecurityDescriptor - + 1425 0x6f689d0 RtlSetCriticalSectionSpinCount - + 1426 0x6f27a40 RtlSetCurrentDirectory_U - + 1427 0x6fade80 RtlSetCurrentEnvironment - + 1428 0x6f5caa0 RtlSetCurrentTransaction - + 1429 0x6f58660 RtlSetDaclSecurityDescriptor - + 1430 0x6fd1540 RtlSetDynamicTimeZoneInformation - + 1431 0x6fadf20 RtlSetEnvironmentStrings - + 1432 0x6f5b200 RtlSetEnvironmentVar - + 1433 0x6f5b1c0 RtlSetEnvironmentVariable - + 1434 0x6fdbe10 RtlSetExtendedFeaturesMask - + 1435 0x6fe9910 RtlSetFeatureConfigurations - + 1436 0x6f586d0 RtlSetGroupSecurityDescriptor - + 1437 0x6f6cb40 RtlSetHeapInformation - + 1438 0x6fc0a30 RtlSetImageMitigationPolicy - + 1439 0x6fcb9e0 RtlSetInformationAcl - + 1440 0x7005640 RtlSetIoCompletionCallback - + 1441 0x6f5ab50 RtlSetLastWin32Error - + 1442 0x6f5ab30 RtlSetLastWin32ErrorAndNtStatusFromNtStatus - + 1443 0x6fb4f60 RtlSetMemoryStreamSize - + 1444 0x6f58730 RtlSetOwnerSecurityDescriptor - + 1445 0x6fd1290 RtlSetPortableOperatingSystem - + 1446 0x6fb7680 RtlSetProcessDebugInformation - + 1447 0x6fe31a0 RtlSetProcessIsCritical - + 1448 0x6fe6a70 RtlSetProcessPlaceholderCompatibilityMode - + 1449 0x6fd2fe0 RtlSetProcessPreferredUILanguages - + 1450 0x6f6a370 RtlSetProtectedPolicy - + 1451 0x6f72290 RtlSetProxiedProcessId - + 1452 0x6f67f90 RtlSetSaclSecurityDescriptor - + 1453 0x6fbcf00 RtlSetSearchPathMode - + 1454 0x6fc7430 RtlSetSecurityDescriptorRMControl - + 1455 0x6fb6820 RtlSetSecurityObject - + 1456 0x6fb6850 RtlSetSecurityObjectEx - + 1457 0x6fd0eb0 RtlSetSystemBootStatus - + 1458 0x6fd0ef0 RtlSetSystemBootStatusEx - + 1459 0x6f2b5b0 RtlSetThreadErrorMode - + 1460 0x6fe3210 RtlSetThreadIsCritical - + 1461 0x6f686c0 RtlSetThreadPlaceholderCompatibilityMode - + 1462 0x6f6d5a0 RtlSetThreadPoolStartFunc - + 1464 0x6f56500 RtlSetThreadPreferredUILanguages - + 1463 0x6f56700 RtlSetThreadPreferredUILanguages2 - + 1465 0x6f5f210 RtlSetThreadSubProcessTag - + 1466 0x6f371a0 RtlSetThreadWorkOnBehalfTicket - + 1467 0x6fd1560 RtlSetTimeZoneInformation - + 1468 0x70053c0 RtlSetTimer - + 1469 0x6f6c130 RtlSetUnhandledExceptionFilter - + 1470 0x6f6c4b0 RtlSetUserCallbackExceptionFilter - + 1471 0x6fd7330 RtlSetUserFlagsHeap - + 1472 0x6f639e0 RtlSetUserValueHeap - + 1473 0x6f59470 RtlSidDominates - + 1474 0x6f592e0 RtlSidDominatesForTrust - + 1475 0x6fc7470 RtlSidEqualLevel - + 1476 0x6fc74f0 RtlSidHashInitialize - + 1477 0x6fc7580 RtlSidHashLookup - + 1478 0x6fc7690 RtlSidIsHigherLevel - + 1479 0x6f5b890 RtlSizeHeap - + 1480 0x6fe61e0 RtlSleepConditionVariableCS - + 1481 0x6f421e0 RtlSleepConditionVariableSRW - + 1482 0x6f682a0 RtlSplay - + 1483 0x6fc5bf0 RtlStartRXact - + 1484 0x6fb4f60 RtlStatMemoryStream - + 1485 0x6f6d1b0 RtlStringFromGUID - + 1486 0x6f6d1d0 RtlStringFromGUIDEx - + 1487 0x6fdb550 RtlStronglyEnumerateEntryHashTable - + 1488 0x6f6ba70 RtlSubAuthorityCountSid - + 1489 0x6f68e20 RtlSubAuthoritySid - + 1490 0x6fe99e0 RtlSubscribeForFeatureUsageNotification - + 1491 0x6f306b0 RtlSubscribeWnfStateChangeNotification - + 1492 0x6f67950 RtlSubtreePredecessor - + 1493 0x6fde240 RtlSubtreeSuccessor - + 1494 0x6f300b0 RtlSwitchedVVI - + 1495 0x6fc4f30 RtlSystemTimeToLocalTime - + 1496 0x6fbc110 RtlTestAndPublishWnfStateData - + 1497 0x6f87140 RtlTestBit - + 1498 0x6fc2110 RtlTestProtectedAccess - + 1499 0x6f5cfb0 RtlTimeFieldsToTime - + 1500 0x6fc4f90 RtlTimeToElapsedTimeFields - + 1501 0x6fc5000 RtlTimeToSecondsSince1970 - + 1502 0x6fc5050 RtlTimeToSecondsSince1980 - + 1503 0x6f5cd10 RtlTimeToTimeFields - + 1504 0x6fea320 RtlTraceDatabaseAdd - + 1505 0x6fea370 RtlTraceDatabaseCreate - + 1506 0x6fea470 RtlTraceDatabaseDestroy - + 1507 0x6fea4d0 RtlTraceDatabaseEnumerate - + 1508 0x6fea570 RtlTraceDatabaseFind - + 1509 0x6fea5c0 RtlTraceDatabaseLock - + 1510 0x6fea5e0 RtlTraceDatabaseUnlock - + 1511 0x6fea600 RtlTraceDatabaseValidate - + 1512 0x6f60990 RtlTryAcquirePebLock - + 1513 0x6f727b0 RtlTryAcquireSRWLockExclusive - + 1514 0x6f6a8b0 RtlTryAcquireSRWLockShared - + 1515 0x6fca600 RtlTryConvertSRWLockSharedToExclusiveOrRelease - + 1516 0x6f609b0 RtlTryEnterCriticalSection - + 1517 0x6fea870 RtlUTF8StringToUnicodeString - + 1518 0x6f5d230 RtlUTF8ToUnicodeN - + 1519 0x6feaa20 RtlUdiv128 - + 12 0x6fbea80 RtlUlongByteSwap - + 13 0x6fbea90 RtlUlonglongByteSwap - + 1521 0x6f87a10 RtlUnhandledExceptionFilter - + 1520 0x6fe88b0 RtlUnhandledExceptionFilter2 - + 1522 0x6f60cb0 RtlUnicodeStringToAnsiSize - + 1523 0x6f60ce0 RtlUnicodeStringToAnsiString - + 1524 0x6fcddf0 RtlUnicodeStringToCountedOemString - + 1525 0x6f607f0 RtlUnicodeStringToInteger - + 1526 0x6f60cb0 RtlUnicodeStringToOemSize - + 1527 0x6f60a00 RtlUnicodeStringToOemString - + 1528 0x6fea940 RtlUnicodeStringToUTF8String - + 1529 0x6fc43f0 RtlUnicodeToCustomCPN - + 1530 0x6f60dc0 RtlUnicodeToMultiByteN - + 1531 0x6f60e30 RtlUnicodeToMultiByteSize - + 1532 0x6f60b40 RtlUnicodeToOemN - + 1533 0x6f64690 RtlUnicodeToUTF8N - + 1534 0x6fea190 RtlUniform - + 1535 0x6fd0f10 RtlUnlockBootStatusData - + 1536 0x6fe8e90 RtlUnlockCurrentThread - + 1537 0x6f5da40 RtlUnlockHeap - + 1538 0x6fcd800 RtlUnlockMemoryBlockLookaside - + 1539 0x6fb4f40 RtlUnlockMemoryStreamRegion - + 1540 0x6f29960 RtlUnlockMemoryZone - + 1541 0x6f29a00 RtlUnlockModuleSection - + 1542 0x6f2b4f0 RtlUnregisterFeatureConfigurationChangeNotification - + 1543 0x6fe9a00 RtlUnsubscribeFromFeatureUsageNotifications - + 1544 0x6f5ea00 RtlUnsubscribeWnfNotificationWaitForCompletion - + 1545 0x6fbc1a0 RtlUnsubscribeWnfNotificationWithCompletionCallback - + 1546 0x6f5e9e0 RtlUnsubscribeWnfStateChangeNotification - + 1547 0x6f68e80 RtlUnwind - + 1548 0x6f40200 RtlUpcaseUnicodeChar - + 1549 0x6f52c20 RtlUpcaseUnicodeString - + 1550 0x6fcdf00 RtlUpcaseUnicodeStringToAnsiString - + 1551 0x6fcdff0 RtlUpcaseUnicodeStringToCountedOemString - + 1552 0x6fce100 RtlUpcaseUnicodeStringToOemString - + 1553 0x6fc4500 RtlUpcaseUnicodeToCustomCPN - + 1554 0x6f60be0 RtlUpcaseUnicodeToMultiByteN - + 1555 0x6fc4630 RtlUpcaseUnicodeToOemN - + 1556 0x6f870a0 RtlUpdateClonedCriticalSection - + 1557 0x6fca680 RtlUpdateClonedSRWLock - + 1558 0x70053d0 RtlUpdateTimer - + 1559 0x6f60bc0 RtlUpperChar - + 1560 0x6fce3c0 RtlUpperString - + 1561 0x6f72780 RtlUserFiberStart - + 1562 0x6f74f90 RtlUserThreadStart - + 14 0x6fbeab0 RtlUshortByteSwap - + 1563 0x6f53790 RtlValidAcl - + 1564 0x6fc2160 RtlValidProcessProtection - + 1565 0x6f6b730 RtlValidRelativeSecurityDescriptor - + 1566 0x6f681c0 RtlValidSecurityDescriptor - + 1567 0x6f53d40 RtlValidSid - + 1568 0x6fe25b0 RtlValidateCorrelationVector - + 1569 0x6f27470 RtlValidateHeap - + 1570 0x6fd76c0 RtlValidateProcessHeaps - + 1571 0x6fce210 RtlValidateUnicodeString - + 1572 0x6fe3fc0 RtlVerifyVersionInfo - + 1573 0x6fbc1f0 RtlWaitForWnfMetaNotification - + 1574 0x6feaab0 RtlWaitOnAddress - + 1575 0x6f5f300 RtlWakeAddressAll - + 1576 0x6feaae0 RtlWakeAddressAllNoFence - + 1577 0x6feab00 RtlWakeAddressSingle - + 1578 0x6feab30 RtlWakeAddressSingleNoFence - + 1579 0x6f6a4b0 RtlWakeAllConditionVariable - + 1580 0x6f71bd0 RtlWakeConditionVariable - + 1581 0x6f5c0a0 RtlWalkFrameChain - + 1582 0x6fd77a0 RtlWalkHeap - + 1583 0x6fdb5b0 RtlWeaklyEnumerateEntryHashTable - + 1584 0x6fbaca0 RtlWerpReportException - + 1585 0x6fbc3a0 RtlWnfCompareChangeStamp - + 1586 0x6f2c1d0 RtlWnfDllUnloadCallback - + 1587 0x6fba270 RtlWow64CallFunction64 - + 1588 0x6fba280 RtlWow64EnableFsRedirection - + 1589 0x6f4c4c0 RtlWow64EnableFsRedirectionEx - + 1590 0x6fba330 RtlWow64GetCurrentMachine - + 1591 0x6feab50 RtlWow64GetEquivalentMachineCHPE - + 1592 0x6f5bdc0 RtlWow64GetProcessMachines - + 1593 0x6fba340 RtlWow64GetSharedInfoProcess - + 1594 0x6fba390 RtlWow64IsWowGuestMachineSupported - + 1595 0x6fb5bc0 RtlWow64LogMessageInEventLogger - + 1596 0x6fb4f70 RtlWriteMemoryStream - + 1597 0x6fd1580 RtlWriteRegistryValue - + 1598 0x6fdd2c0 RtlZeroHeap - + 1599 0x6f88180 RtlZeroMemory - + 1600 0x6fbdbe0 RtlZombifyActivationContext - + 1601 0x6f63ed0 RtlpApplyLengthFunction - + 1602 0x6f6ab40 RtlpCheckDynamicTimeZoneInformation - + 1603 0x6fd3710 RtlpCleanupRegistryKeys - + 1604 0x6fcbb70 RtlpConvertAbsoluteToRelativeSecurityAttribute - + 1605 0x6fd3b40 RtlpConvertCultureNamesToLCIDs - + 1606 0x6fd3d30 RtlpConvertLCIDsToCultureNames - + 1607 0x6fcbf80 RtlpConvertRelativeToAbsoluteSecurityAttribute - + 1608 0x6f540a0 RtlpCreateProcessRegistryInfo - + 1609 0x6f614d0 RtlpEnsureBufferSize - + 1610 0x70267f0 RtlpFreezeTimeBias - + 1611 0x6f6b9d0 RtlpGetDeviceFamilyInfoEnum - + 1612 0x6f2bf30 RtlpGetLCIDFromLangInfoNode - + 1613 0x6f2c6b0 RtlpGetNameFromLangInfoNode - + 1614 0x6f55de0 RtlpGetSystemDefaultUILanguage - + 1615 0x6feab70 RtlpGetUserOrMachineUILanguage4NLS - + 1616 0x6fd47c0 RtlpInitializeLangRegistryInfo - + 1617 0x6f29fe0 RtlpIsQualifiedLanguage - + 1618 0x6f27230 RtlpLoadMachineUIByPolicy - + 1619 0x6f2d8e0 RtlpLoadUserUIByPolicy - + 1620 0x6fcc7e0 RtlpMergeSecurityAttributeInformation - + 1621 0x6feaf70 RtlpMuiFreeLangRegistryInfo - + 1622 0x6f2dc50 RtlpMuiRegCreateRegistryInfo - + 1623 0x6f2cf00 RtlpMuiRegFreeRegistryInfo - + 1624 0x6f2ce00 RtlpMuiRegLoadRegistryInfo - + 1625 0x6fcaa70 RtlpNotOwnerCriticalSection - + 1626 0x6fed320 RtlpNtCreateKey - + 1627 0x6fed350 RtlpNtEnumerateSubKey - + 1628 0x6fed410 RtlpNtMakeTemporaryKey - + 1629 0x6fed420 RtlpNtOpenKey - + 1630 0x6fed450 RtlpNtQueryValueKey - + 1631 0x6fed520 RtlpNtSetValueKey - + 1632 0x6f697b0 RtlpQueryDefaultUILanguage - + 1633 0x6fb7ba0 RtlpQueryProcessDebugInformationRemote - + 1634 0x6fec1c0 RtlpRefreshCachedUILanguage - + 1635 0x6fd4c40 RtlpSetInstallLanguage - + 1636 0x6fd54c0 RtlpSetPreferredUILanguages - + 1637 0x6fd54c0 RtlpSetUserPreferredUILanguages - + 1638 0x6f5cfd0 RtlpTimeFieldsToTime - + 1639 0x6f5cd30 RtlpTimeToTimeFields - + 1640 0x6fcad90 RtlpUnWaitCriticalSection - + 1641 0x6fd6200 RtlpVerifyAndCommitUILanguageSettings - + 1642 0x6fb4f50 RtlpWaitForCriticalSection - + 1643 0x6f2adb0 RtlxAnsiStringToUnicodeSize - + 1644 0x6f2adb0 RtlxOemStringToUnicodeSize - + 1645 0x6f60cb0 RtlxUnicodeStringToAnsiSize - + 1646 0x6f60cb0 RtlxUnicodeStringToOemSize - + 1647 0x7006080 SbExecuteProcedure - + 1648 0x6f38300 SbSelectProcedure - + 1649 0x6fbb650 ShipAssert - + 1650 0x6fbb730 ShipAssertGetBufferInfo - + 1651 0x6fbb760 ShipAssertMsgA - + 1652 0x6fbb760 ShipAssertMsgW - + 1653 0x6f2c180 TpAllocAlpcCompletion - + 1654 0x6f69ac0 TpAllocAlpcCompletionEx - + 1655 0x6f6c8b0 TpAllocCleanupGroup - + 1656 0x6f66ea0 TpAllocIoCompletion - + 1657 0x7003720 TpAllocJobNotification - + 1658 0x6f31e90 TpAllocPool - + 1659 0x6f345d0 TpAllocTimer - + 1660 0x6f341a0 TpAllocWait - + 1661 0x6f33d10 TpAllocWork - + 1662 0x70035d0 TpAlpcRegisterCompletionList - + 1663 0x7003620 TpAlpcUnregisterCompletionList - + 1664 0x7004740 TpCallbackDetectedUnrecoverableError - + 1665 0x6f357c0 TpCallbackIndependent - + 1666 0x7004770 TpCallbackLeaveCriticalSectionOnCompletion - + 1667 0x6f69650 TpCallbackMayRunLong - + 1668 0x70047a0 TpCallbackReleaseMutexOnCompletion - + 1669 0x70047e0 TpCallbackReleaseSemaphoreOnCompletion - + 1670 0x6f272f0 TpCallbackSendAlpcMessageOnCompletion - + 1671 0x7004820 TpCallbackSendPendingAlpcMessage - + 1672 0x6f72720 TpCallbackSetEventOnCompletion - + 1673 0x6f6d5e0 TpCallbackUnloadDllOnCompletion - + 1674 0x6f67090 TpCancelAsyncIoOperation - + 1675 0x6f66c90 TpCaptureCaller - + 1676 0x6f6b520 TpCheckTerminateWorker - + 1677 0x70048d0 TpDbgDumpHeapUsage - + 1678 0x6fb4f50 TpDbgSetLogRoutine - + 1679 0x6f6d680 TpDisablePoolCallbackChecks - + 1680 0x7004860 TpDisassociateCallback - + 1681 0x6f34580 TpIsTimerSet - + 1682 0x6f41b90 TpPostWork - + 1683 0x7003d60 TpQueryPoolStackInformation - + 1684 0x6f699a0 TpReleaseAlpcCompletion - + 1685 0x6f2be70 TpReleaseCleanupGroup - + 1686 0x6f2bc50 TpReleaseCleanupGroupMembers - + 1687 0x6f66e50 TpReleaseIoCompletion - + 1688 0x70038f0 TpReleaseJobNotification - + 1689 0x6f2ae50 TpReleasePool - + 1690 0x6f33bf0 TpReleaseTimer - + 1691 0x6f31ed0 TpReleaseWait - + 1692 0x6f6c4e0 TpReleaseWork - + 1693 0x7003df0 TpSetDefaultPoolMaxThreads - + 1694 0x7003f10 TpSetDefaultPoolStackInformation - + 1695 0x6f31d70 TpSetPoolMaxThreads - + 1696 0x6f6bef0 TpSetPoolMaxThreadsSoftLimit - + 1697 0x6f6d110 TpSetPoolMinThreads - + 1698 0x6f6d6c0 TpSetPoolStackInformation - + 1699 0x6f2bac0 TpSetPoolThreadBasePriority - + 1700 0x7004020 TpSetPoolThreadCpuSets - + 1701 0x6f2ebd0 TpSetPoolWorkerThreadIdleTimeout - + 1702 0x6f345c0 TpSetTimer - + 1703 0x6f34680 TpSetTimerEx - + 1704 0x6f37af0 TpSetWait - + 1705 0x6f37b10 TpSetWaitEx - + 1706 0x6f67260 TpSimpleTryPost - + 1707 0x6f670f0 TpStartAsyncIoOperation - + 1708 0x6f28e20 TpTimerOutstandingCallbackCount - + 1709 0x70040a0 TpTrimPools - + 1710 0x7003660 TpWaitForAlpcCompletion - + 1711 0x6f2bfd0 TpWaitForIoCompletion - + 1712 0x7003950 TpWaitForJobNotification - + 1713 0x6f33c80 TpWaitForTimer - + 1714 0x6f31de0 TpWaitForWait - + 1715 0x6f2b550 TpWaitForWork - + 1716 0x6f66100 VerSetConditionMask - + 1717 0x6fbaf50 WerReportExceptionWorker - + 1718 0x6fbbbf0 WerReportSQMEvent - + 1719 0x6f2c2b0 WinSqmAddToAverageDWORD - + 1720 0x6fbbec0 WinSqmAddToStream - + 1721 0x6fbbed0 WinSqmAddToStreamEx - + 1722 0x6fbbee0 WinSqmCheckEscalationAddToStreamEx - + 1724 0x6fbbef0 WinSqmCheckEscalationSetDWORD - + 1723 0x6fbbee0 WinSqmCheckEscalationSetDWORD64 - + 1725 0x6fbbef0 WinSqmCheckEscalationSetString - + 1726 0x6fbbf00 WinSqmCommonDatapointDelete - + 1728 0x6fbbf20 WinSqmCommonDatapointSetDWORD - + 1727 0x6fbbf10 WinSqmCommonDatapointSetDWORD64 - + 1729 0x6fbbf30 WinSqmCommonDatapointSetStreamEx - + 1730 0x6fbbf20 WinSqmCommonDatapointSetString - + 1731 0x6fb4f50 WinSqmEndSession - + 1732 0x6f6d5a0 WinSqmEventEnabled - + 1733 0x6f6d850 WinSqmEventWrite - + 1734 0x6f6d5a0 WinSqmGetEscalationRuleStatus - + 1735 0x6fbbf40 WinSqmGetInstrumentationProperty - + 1736 0x6f2c2b0 WinSqmIncrementDWORD - + 1737 0x6f306a0 WinSqmIsOptedIn - + 1738 0x6fb4f20 WinSqmIsOptedInEx - + 1739 0x6fbbf00 WinSqmIsSessionDisabled - + 1741 0x6f2c2b0 WinSqmSetDWORD - + 1740 0x6fbbec0 WinSqmSetDWORD64 - + 1742 0x6fbbf10 WinSqmSetEscalationInfo - + 1743 0x6f2c2b0 WinSqmSetIfMaxDWORD - + 1744 0x6f2c2b0 WinSqmSetIfMinDWORD - + 1745 0x6f2c2b0 WinSqmSetString - + 1746 0x6fbbf70 WinSqmStartSession - + 1747 0x6fbbf80 WinSqmStartSessionForPartner - + 1748 0x6f306a0 WinSqmStartSqmOptinListener - + 1749 0x7029228 Wow64Transition - + 1750 0x6f729d0 ZwAcceptConnectPort - + 1751 0x6f729b0 ZwAccessCheck - + 1752 0x6f72c60 ZwAccessCheckAndAuditAlarm - + 1753 0x6f73000 ZwAccessCheckByType - + 1754 0x6f72f60 ZwAccessCheckByTypeAndAuditAlarm - + 1755 0x6f73010 ZwAccessCheckByTypeResultList - + 1756 0x6f73020 ZwAccessCheckByTypeResultListAndAuditAlarm - + 1757 0x6f73030 ZwAccessCheckByTypeResultListAndAuditAlarmByHandle - + 1758 0x6f73040 ZwAcquireCrossVmMutant - + 1759 0x6f73050 ZwAcquireProcessActivityReference - + 1760 0x6f72e40 ZwAddAtom - + 1761 0x6f73060 ZwAddAtomEx - + 1762 0x6f73070 ZwAddBootEntry - + 1763 0x6f73080 ZwAddDriverEntry - + 1764 0x6f73090 ZwAdjustGroupsToken - + 1765 0x6f72de0 ZwAdjustPrivilegesToken - + 1766 0x6f730a0 ZwAdjustTokenClaimsAndDeviceGroups - + 1767 0x6f730b0 ZwAlertResumeThread - + 1768 0x6f730c0 ZwAlertThread - + 1769 0x6f730d0 ZwAlertThreadByThreadId - + 1770 0x6f730e0 ZwAllocateLocallyUniqueId - + 1771 0x6f730f0 ZwAllocateReserveObject - + 1772 0x6f73100 ZwAllocateUserPhysicalPages - + 1773 0x6f73110 ZwAllocateUserPhysicalPagesEx - + 1774 0x6f73120 ZwAllocateUuids - + 1775 0x6f72b30 ZwAllocateVirtualMemory - + 1776 0x6f73130 ZwAllocateVirtualMemoryEx - + 1777 0x6f73140 ZwAlpcAcceptConnectPort - + 1778 0x6f73150 ZwAlpcCancelMessage - + 1779 0x6f73160 ZwAlpcConnectPort - + 1780 0x6f73170 ZwAlpcConnectPortEx - + 1781 0x6f73180 ZwAlpcCreatePort - + 1782 0x6f73190 ZwAlpcCreatePortSection - + 1783 0x6f731a0 ZwAlpcCreateResourceReserve - + 1784 0x6f731b0 ZwAlpcCreateSectionView - + 1785 0x6f731c0 ZwAlpcCreateSecurityContext - + 1786 0x6f731d0 ZwAlpcDeletePortSection - + 1787 0x6f731e0 ZwAlpcDeleteResourceReserve - + 1788 0x6f731f0 ZwAlpcDeleteSectionView - + 1789 0x6f73200 ZwAlpcDeleteSecurityContext - + 1790 0x6f73210 ZwAlpcDisconnectPort - + 1791 0x6f73220 ZwAlpcImpersonateClientContainerOfPort - + 1792 0x6f73230 ZwAlpcImpersonateClientOfPort - + 1793 0x6f73240 ZwAlpcOpenSenderProcess - + 1794 0x6f73250 ZwAlpcOpenSenderThread - + 1795 0x6f73260 ZwAlpcQueryInformation - + 1796 0x6f73270 ZwAlpcQueryInformationMessage - + 1797 0x6f73280 ZwAlpcRevokeSecurityContext - + 1798 0x6f73290 ZwAlpcSendWaitReceivePort - + 1799 0x6f732a0 ZwAlpcSetInformation - + 1800 0x6f72e90 ZwApphelpCacheControl - + 1801 0x6f732b0 ZwAreMappedFilesTheSame - + 1802 0x6f732c0 ZwAssignProcessToJobObject - + 1803 0x6f732d0 ZwAssociateWaitCompletionPacket - + 1804 0x6f732e0 ZwCallEnclave - + 1805 0x6f72a00 ZwCallbackReturn - + 1806 0x6f72fa0 ZwCancelIoFile - + 1807 0x6f732f0 ZwCancelIoFileEx - + 1808 0x6f73300 ZwCancelSynchronousIoFile - + 1810 0x6f72fe0 ZwCancelTimer - + 1809 0x6f73310 ZwCancelTimer2 - + 1811 0x6f73320 ZwCancelWaitCompletionPacket - + 1812 0x6f72db0 ZwClearEvent - + 1813 0x6f72aa0 ZwClose - + 1814 0x6f72d80 ZwCloseObjectAuditAlarm - + 1815 0x6f73330 ZwCommitComplete - + 1816 0x6f73340 ZwCommitEnlistment - + 1817 0x6f73350 ZwCommitRegistryTransaction - + 1818 0x6f73360 ZwCommitTransaction - + 1819 0x6f73370 ZwCompactKeys - + 1820 0x6f73380 ZwCompareObjects - + 1821 0x6f73390 ZwCompareSigningLevels - + 1822 0x6f733a0 ZwCompareTokens - + 1823 0x6f733b0 ZwCompleteConnectPort - + 1824 0x6f733c0 ZwCompressKey - + 1825 0x6f733d0 ZwConnectPort - + 1826 0x6f72e00 ZwContinue - + 1827 0x6f733e0 ZwContinueEx - + 1828 0x6f733f0 ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter - + 1829 0x6f73400 ZwCreateCrossVmEvent - + 1830 0x6f73410 ZwCreateCrossVmMutant - + 1831 0x6f73420 ZwCreateDebugObject - + 1832 0x6f73430 ZwCreateDirectoryObject - + 1833 0x6f73440 ZwCreateDirectoryObjectEx - + 1834 0x6f73450 ZwCreateEnclave - + 1835 0x6f73460 ZwCreateEnlistment - + 1836 0x6f72e50 ZwCreateEvent - + 1837 0x6f73470 ZwCreateEventPair - + 1838 0x6f72f20 ZwCreateFile - + 1839 0x6f73480 ZwCreateIRTimer - + 1840 0x6f73490 ZwCreateIoCompletion - + 1841 0x6f734a0 ZwCreateJobObject - + 1842 0x6f734b0 ZwCreateJobSet - + 1843 0x6f72ba0 ZwCreateKey - + 1844 0x6f734c0 ZwCreateKeyTransacted - + 1845 0x6f734d0 ZwCreateKeyedEvent - + 1846 0x6f734e0 ZwCreateLowBoxToken - + 1847 0x6f734f0 ZwCreateMailslotFile - + 1848 0x6f73500 ZwCreateMutant - + 1849 0x6f73510 ZwCreateNamedPipeFile - + 1850 0x6f73520 ZwCreatePagingFile - + 1851 0x6f73530 ZwCreatePartition - + 1852 0x6f73540 ZwCreatePort - + 1853 0x6f73550 ZwCreatePrivateNamespace - + 1854 0x6f73560 ZwCreateProcess - + 1855 0x6f72ea0 ZwCreateProcessEx - + 1856 0x6f73570 ZwCreateProfile - + 1857 0x6f73580 ZwCreateProfileEx - + 1858 0x6f73590 ZwCreateRegistryTransaction - + 1859 0x6f735a0 ZwCreateResourceManager - + 1860 0x6f72e70 ZwCreateSection - + 1861 0x6f735b0 ZwCreateSectionEx - + 1862 0x6f735c0 ZwCreateSemaphore - + 1863 0x6f735d0 ZwCreateSymbolicLinkObject - + 1864 0x6f72eb0 ZwCreateThread - + 1865 0x6f735e0 ZwCreateThreadEx - + 1867 0x6f735f0 ZwCreateTimer - + 1866 0x6f73600 ZwCreateTimer2 - + 1868 0x6f73610 ZwCreateToken - + 1869 0x6f73620 ZwCreateTokenEx - + 1870 0x6f73630 ZwCreateTransaction - + 1871 0x6f73640 ZwCreateTransactionManager - + 1872 0x6f73650 ZwCreateUserProcess - + 1873 0x6f73660 ZwCreateWaitCompletionPacket - + 1874 0x6f73670 ZwCreateWaitablePort - + 1875 0x6f73680 ZwCreateWnfStateName - + 1876 0x6f73690 ZwCreateWorkerFactory - + 1877 0x6f736a0 ZwDebugActiveProcess - + 1878 0x6f736b0 ZwDebugContinue - + 1879 0x6f72d10 ZwDelayExecution - + 1880 0x6f736c0 ZwDeleteAtom - + 1881 0x6f736d0 ZwDeleteBootEntry - + 1882 0x6f736e0 ZwDeleteDriverEntry - + 1883 0x6f736f0 ZwDeleteFile - + 1884 0x6f73700 ZwDeleteKey - + 1885 0x6f73710 ZwDeleteObjectAuditAlarm - + 1886 0x6f73720 ZwDeletePrivateNamespace - + 1887 0x6f73730 ZwDeleteValueKey - + 1888 0x6f73740 ZwDeleteWnfStateData - + 1889 0x6f73750 ZwDeleteWnfStateName - + 1890 0x6f72a20 ZwDeviceIoControlFile - + 1891 0x6f73760 ZwDirectGraphicsCall - + 1892 0x6f73770 ZwDisableLastKnownGood - + 1893 0x6f73780 ZwDisplayString - + 1894 0x6f73790 ZwDrawText - + 1895 0x6f72d90 ZwDuplicateObject - + 1896 0x6f72df0 ZwDuplicateToken - + 1897 0x6f737a0 ZwEnableLastKnownGood - + 1898 0x6f737b0 ZwEnumerateBootEntries - + 1899 0x6f737c0 ZwEnumerateDriverEntries - + 1900 0x6f72cf0 ZwEnumerateKey - + 1901 0x6f737d0 ZwEnumerateSystemEnvironmentValuesEx - + 1902 0x6f737e0 ZwEnumerateTransactionObject - + 1903 0x6f72ae0 ZwEnumerateValueKey - + 1904 0x6f737f0 ZwExtendSection - + 1905 0x6f73800 ZwFilterBootOption - + 1906 0x6f73810 ZwFilterToken - + 1907 0x6f73820 ZwFilterTokenEx - + 1908 0x6f72af0 ZwFindAtom - + 1909 0x6f72e80 ZwFlushBuffersFile - + 1910 0x6f73830 ZwFlushBuffersFileEx - + 1911 0x6f73840 ZwFlushInstallUILanguage - + 1912 0x6f73850 ZwFlushInstructionCache - + 1913 0x6f73860 ZwFlushKey - + 1914 0x6f73870 ZwFlushProcessWriteBuffers - + 1915 0x6f73880 ZwFlushVirtualMemory - + 1916 0x6f73890 ZwFlushWriteBuffer - + 1917 0x6f738a0 ZwFreeUserPhysicalPages - + 1918 0x6f72bb0 ZwFreeVirtualMemory - + 1919 0x6f738b0 ZwFreezeRegistry - + 1920 0x6f738c0 ZwFreezeTransactions - + 1921 0x6f72d60 ZwFsControlFile - + 1922 0x6f738d0 ZwGetCachedSigningLevel - + 1923 0x6f738e0 ZwGetCompleteWnfStateSubscription - + 1924 0x6f738f0 ZwGetContextThread - + 1925 0x6f73900 ZwGetCurrentProcessorNumber - + 1926 0x6f73910 ZwGetCurrentProcessorNumberEx - + 1927 0x6f73920 ZwGetDevicePowerState - + 1928 0x6f73930 ZwGetMUIRegistryInfo - + 1929 0x6f73940 ZwGetNextProcess - + 1930 0x6f73950 ZwGetNextThread - + 1931 0x6f73960 ZwGetNlsSectionPtr - + 1932 0x6f73970 ZwGetNotificationResourceManager - + 1933 0x6f73980 ZwGetWriteWatch - + 1934 0x6f73990 ZwImpersonateAnonymousToken - + 1935 0x6f72bc0 ZwImpersonateClientOfPort - + 1936 0x6f739a0 ZwImpersonateThread - + 1937 0x6f739b0 ZwInitializeEnclave - + 1938 0x6f739c0 ZwInitializeNlsFiles - + 1939 0x6f739d0 ZwInitializeRegistry - + 1940 0x6f739e0 ZwInitiatePowerAction - + 1941 0x6f72ec0 ZwIsProcessInJob - + 1942 0x6f739f0 ZwIsSystemResumeAutomatic - + 1943 0x6f73a00 ZwIsUILanguageComitted - + 1944 0x6f73a10 ZwListenPort - + 1945 0x6f73a20 ZwLoadDriver - + 1946 0x6f73a30 ZwLoadEnclaveData - + 1949 0x6f73a40 ZwLoadKey - + 1947 0x6f73a50 ZwLoadKey2 - + 1948 0x6f74730 ZwLoadKey3 - + 1950 0x6f73a60 ZwLoadKeyEx - + 1951 0x6f73a70 ZwLockFile - + 1952 0x6f73a80 ZwLockProductActivationKeys - + 1953 0x6f73a90 ZwLockRegistryKey - + 1954 0x6f73aa0 ZwLockVirtualMemory - + 1955 0x6f73ab0 ZwMakePermanentObject - + 1956 0x6f73ac0 ZwMakeTemporaryObject - + 1957 0x6f73ad0 ZwManageHotPatch - + 1958 0x6f73ae0 ZwManagePartition - + 1959 0x6f73af0 ZwMapCMFModule - + 1960 0x6f73b00 ZwMapUserPhysicalPages - + 1961 0x6f729e0 ZwMapUserPhysicalPagesScatter - + 1962 0x6f72c50 ZwMapViewOfSection - + 1963 0x6f73b10 ZwMapViewOfSectionEx - + 1964 0x6f73b20 ZwModifyBootEntry - + 1965 0x6f73b30 ZwModifyDriverEntry - + 1966 0x6f73b40 ZwNotifyChangeDirectoryFile - + 1967 0x6f73b50 ZwNotifyChangeDirectoryFileEx - + 1968 0x6f73b60 ZwNotifyChangeKey - + 1969 0x6f73b70 ZwNotifyChangeMultipleKeys - + 1970 0x6f73b80 ZwNotifyChangeSession - + 1971 0x6f72f50 ZwOpenDirectoryObject - + 1972 0x6f73b90 ZwOpenEnlistment - + 1973 0x6f72dd0 ZwOpenEvent - + 1974 0x6f73ba0 ZwOpenEventPair - + 1975 0x6f72d00 ZwOpenFile - + 1976 0x6f73bb0 ZwOpenIoCompletion - + 1977 0x6f73bc0 ZwOpenJobObject - + 1978 0x6f72ad0 ZwOpenKey - + 1979 0x6f73bd0 ZwOpenKeyEx - + 1980 0x6f73be0 ZwOpenKeyTransacted - + 1981 0x6f73bf0 ZwOpenKeyTransactedEx - + 1982 0x6f73c00 ZwOpenKeyedEvent - + 1983 0x6f73c10 ZwOpenMutant - + 1984 0x6f73c20 ZwOpenObjectAuditAlarm - + 1985 0x6f73c30 ZwOpenPartition - + 1986 0x6f73c40 ZwOpenPrivateNamespace - + 1987 0x6f72c30 ZwOpenProcess - + 1988 0x6f73c50 ZwOpenProcessToken - + 1989 0x6f72cd0 ZwOpenProcessTokenEx - + 1990 0x6f73c60 ZwOpenRegistryTransaction - + 1991 0x6f73c70 ZwOpenResourceManager - + 1992 0x6f72d40 ZwOpenSection - + 1993 0x6f73c80 ZwOpenSemaphore - + 1994 0x6f73c90 ZwOpenSession - + 1995 0x6f73ca0 ZwOpenSymbolicLinkObject - + 1996 0x6f73cb0 ZwOpenThread - + 1997 0x6f72c10 ZwOpenThreadToken - + 1998 0x6f72cc0 ZwOpenThreadTokenEx - + 1999 0x6f73cc0 ZwOpenTimer - + 2000 0x6f73cd0 ZwOpenTransaction - + 2001 0x6f73ce0 ZwOpenTransactionManager - + 2002 0x6f73cf0 ZwPlugPlayControl - + 2003 0x6f72fc0 ZwPowerInformation - + 2004 0x6f73d00 ZwPrePrepareComplete - + 2005 0x6f73d10 ZwPrePrepareEnlistment - + 2006 0x6f73d20 ZwPrepareComplete - + 2007 0x6f73d30 ZwPrepareEnlistment - + 2008 0x6f73d40 ZwPrivilegeCheck - + 2009 0x6f73d50 ZwPrivilegeObjectAuditAlarm - + 2010 0x6f73d60 ZwPrivilegedServiceAuditAlarm - + 2011 0x6f73d70 ZwPropagationComplete - + 2012 0x6f73d80 ZwPropagationFailed - + 2013 0x6f72ed0 ZwProtectVirtualMemory - + 2014 0x6f73d90 ZwPssCaptureVaSpaceBulk - + 2015 0x6f73da0 ZwPulseEvent - + 2016 0x6f72da0 ZwQueryAttributesFile - + 2017 0x6f73db0 ZwQueryAuxiliaryCounterFrequency - + 2018 0x6f73dc0 ZwQueryBootEntryOrder - + 2019 0x6f73dd0 ZwQueryBootOptions - + 2020 0x6f73de0 ZwQueryDebugFilterState - + 2021 0x6f72b00 ZwQueryDefaultLocale - + 2022 0x6f72e10 ZwQueryDefaultUILanguage - + 2023 0x6f72d20 ZwQueryDirectoryFile - + 2024 0x6f73df0 ZwQueryDirectoryFileEx - + 2025 0x6f73e00 ZwQueryDirectoryObject - + 2026 0x6f73e10 ZwQueryDriverEntryOrder - + 2027 0x6f73e20 ZwQueryEaFile - + 2028 0x6f72f30 ZwQueryEvent - + 2029 0x6f73e30 ZwQueryFullAttributesFile - + 2030 0x6f73e40 ZwQueryInformationAtom - + 2031 0x6f73e50 ZwQueryInformationByName - + 2032 0x6f73e60 ZwQueryInformationEnlistment - + 2033 0x6f72ac0 ZwQueryInformationFile - + 2034 0x6f73e70 ZwQueryInformationJobObject - + 2035 0x6f73e80 ZwQueryInformationPort - + 2036 0x6f72b40 ZwQueryInformationProcess - + 2037 0x6f73e90 ZwQueryInformationResourceManager - + 2038 0x6f72c20 ZwQueryInformationThread - + 2039 0x6f72be0 ZwQueryInformationToken - + 2040 0x6f73ea0 ZwQueryInformationTransaction - + 2041 0x6f73eb0 ZwQueryInformationTransactionManager - + 2042 0x6f73ec0 ZwQueryInformationWorkerFactory - + 2043 0x6f73ed0 ZwQueryInstallUILanguage - + 2044 0x6f73ee0 ZwQueryIntervalProfile - + 2045 0x6f73ef0 ZwQueryIoCompletion - + 2046 0x6f72b10 ZwQueryKey - + 2047 0x6f73f00 ZwQueryLicenseValue - + 2048 0x6f73f10 ZwQueryMultipleValueKey - + 2049 0x6f73f20 ZwQueryMutant - + 2050 0x6f72ab0 ZwQueryObject - + 2051 0x6f73f30 ZwQueryOpenSubKeys - + 2052 0x6f73f40 ZwQueryOpenSubKeysEx - + 2053 0x6f72ce0 ZwQueryPerformanceCounter - + 2054 0x6f73f50 ZwQueryPortInformationProcess - + 2055 0x6f73f60 ZwQueryQuotaInformationFile - + 2056 0x6f72ee0 ZwQuerySection - + 2057 0x6f73f70 ZwQuerySecurityAttributesToken - + 2058 0x6f73f80 ZwQuerySecurityObject - + 2059 0x6f73f90 ZwQuerySecurityPolicy - + 2060 0x6f73fa0 ZwQuerySemaphore - + 2061 0x6f73fb0 ZwQuerySymbolicLinkObject - + 2062 0x6f73fc0 ZwQuerySystemEnvironmentValue - + 2063 0x6f73fd0 ZwQuerySystemEnvironmentValueEx - + 2064 0x6f72d30 ZwQuerySystemInformation - + 2065 0x6f73fe0 ZwQuerySystemInformationEx - + 2066 0x6f72f70 ZwQuerySystemTime - + 2067 0x6f72d50 ZwQueryTimer - + 2068 0x6f73ff0 ZwQueryTimerResolution - + 2069 0x6f72b20 ZwQueryValueKey - + 2070 0x6f72c00 ZwQueryVirtualMemory - + 2071 0x6f72e60 ZwQueryVolumeInformationFile - + 2072 0x6f74000 ZwQueryWnfStateData - + 2073 0x6f74010 ZwQueryWnfStateNameInformation - + 2074 0x6f72e20 ZwQueueApcThread - + 2075 0x6f74020 ZwQueueApcThreadEx - + 2076 0x6f74030 ZwRaiseException - + 2077 0x6f74040 ZwRaiseHardError - + 2078 0x6f72a10 ZwReadFile - + 2079 0x6f72cb0 ZwReadFileScatter - + 2080 0x6f74050 ZwReadOnlyEnlistment - + 2081 0x6f72f10 ZwReadRequestData - + 2082 0x6f72dc0 ZwReadVirtualMemory - + 2083 0x6f74060 ZwRecoverEnlistment - + 2084 0x6f74070 ZwRecoverResourceManager - + 2085 0x6f74080 ZwRecoverTransactionManager - + 2086 0x6f74090 ZwRegisterProtocolAddressInformation - + 2087 0x6f740a0 ZwRegisterThreadTerminatePort - + 2088 0x6f740b0 ZwReleaseKeyedEvent - + 2089 0x6f72bd0 ZwReleaseMutant - + 2090 0x6f72a50 ZwReleaseSemaphore - + 2091 0x6f740c0 ZwReleaseWorkerFactoryWorker - + 2092 0x6f72a40 ZwRemoveIoCompletion - + 2093 0x6f740d0 ZwRemoveIoCompletionEx - + 2094 0x6f740e0 ZwRemoveProcessDebug - + 2095 0x6f740f0 ZwRenameKey - + 2096 0x6f74100 ZwRenameTransactionManager - + 2097 0x6f74110 ZwReplaceKey - + 2098 0x6f74120 ZwReplacePartitionUnit - + 2099 0x6f72a70 ZwReplyPort - + 2100 0x6f72a60 ZwReplyWaitReceivePort - + 2101 0x6f72c80 ZwReplyWaitReceivePortEx - + 2102 0x6f74130 ZwReplyWaitReplyPort - + 2103 0x6f74140 ZwRequestPort - + 2104 0x6f72bf0 ZwRequestWaitReplyPort - + 2105 0x6f74150 ZwResetEvent - + 2106 0x6f74160 ZwResetWriteWatch - + 2107 0x6f74170 ZwRestoreKey - + 2108 0x6f74180 ZwResumeProcess - + 2109 0x6f72ef0 ZwResumeThread - + 2110 0x6f74190 ZwRevertContainerImpersonation - + 2111 0x6f741a0 ZwRollbackComplete - + 2112 0x6f741b0 ZwRollbackEnlistment - + 2113 0x6f741c0 ZwRollbackRegistryTransaction - + 2114 0x6f741d0 ZwRollbackTransaction - + 2115 0x6f741e0 ZwRollforwardTransactionManager - + 2116 0x6f741f0 ZwSaveKey - + 2117 0x6f74200 ZwSaveKeyEx - + 2118 0x6f74210 ZwSaveMergedKeys - + 2119 0x6f74220 ZwSecureConnectPort - + 2120 0x6f74230 ZwSerializeBoot - + 2121 0x6f74240 ZwSetBootEntryOrder - + 2122 0x6f74250 ZwSetBootOptions - + 2124 0x6f74260 ZwSetCachedSigningLevel - + 2123 0x6f74270 ZwSetCachedSigningLevel2 - + 2125 0x6f74280 ZwSetContextThread - + 2126 0x6f74290 ZwSetDebugFilterState - + 2127 0x6f742a0 ZwSetDefaultHardErrorPort - + 2128 0x6f742b0 ZwSetDefaultLocale - + 2129 0x6f742c0 ZwSetDefaultUILanguage - + 2130 0x6f742d0 ZwSetDriverEntryOrder - + 2131 0x6f742e0 ZwSetEaFile - + 2132 0x6f72a90 ZwSetEvent - + 2133 0x6f72ca0 ZwSetEventBoostPriority - + 2134 0x6f742f0 ZwSetHighEventPair - + 2135 0x6f74300 ZwSetHighWaitLowEventPair - + 2136 0x6f74310 ZwSetIRTimer - + 2137 0x6f74320 ZwSetInformationDebugObject - + 2138 0x6f74330 ZwSetInformationEnlistment - + 2139 0x6f72c40 ZwSetInformationFile - + 2140 0x6f74340 ZwSetInformationJobObject - + 2141 0x6f74350 ZwSetInformationKey - + 2142 0x6f72f90 ZwSetInformationObject - + 2143 0x6f72b90 ZwSetInformationProcess - + 2144 0x6f74360 ZwSetInformationResourceManager - + 2145 0x6f74370 ZwSetInformationSymbolicLink - + 2146 0x6f72a80 ZwSetInformationThread - + 2147 0x6f74380 ZwSetInformationToken - + 2148 0x6f74390 ZwSetInformationTransaction - + 2149 0x6f743a0 ZwSetInformationTransactionManager - + 2150 0x6f743b0 ZwSetInformationVirtualMemory - + 2151 0x6f743c0 ZwSetInformationWorkerFactory - + 2152 0x6f743d0 ZwSetIntervalProfile - + 2153 0x6f743e0 ZwSetIoCompletion - + 2154 0x6f743f0 ZwSetIoCompletionEx - + 2155 0x6f74400 ZwSetLdtEntries - + 2156 0x6f74410 ZwSetLowEventPair - + 2157 0x6f74420 ZwSetLowWaitHighEventPair - + 2158 0x6f74430 ZwSetQuotaInformationFile - + 2159 0x6f74440 ZwSetSecurityObject - + 2160 0x6f74450 ZwSetSystemEnvironmentValue - + 2161 0x6f74460 ZwSetSystemEnvironmentValueEx - + 2162 0x6f74470 ZwSetSystemInformation - + 2163 0x6f74480 ZwSetSystemPowerState - + 2164 0x6f74490 ZwSetSystemTime - + 2165 0x6f744a0 ZwSetThreadExecutionState - + 2167 0x6f72ff0 ZwSetTimer - + 2166 0x6f744b0 ZwSetTimer2 - + 2168 0x6f744c0 ZwSetTimerEx - + 2169 0x6f744d0 ZwSetTimerResolution - + 2170 0x6f744e0 ZwSetUuidSeed - + 2171 0x6f72fd0 ZwSetValueKey - + 2172 0x6f744f0 ZwSetVolumeInformationFile - + 2173 0x6f74500 ZwSetWnfProcessNotificationEvent - + 2174 0x6f74510 ZwShutdownSystem - + 2175 0x6f74520 ZwShutdownWorkerFactory - + 2176 0x6f74530 ZwSignalAndWaitForSingleObject - + 2177 0x6f74540 ZwSinglePhaseReject - + 2178 0x6f74550 ZwStartProfile - + 2179 0x6f74560 ZwStopProfile - + 2180 0x6f74570 ZwSubscribeWnfStateChange - + 2181 0x6f74580 ZwSuspendProcess - + 2182 0x6f74590 ZwSuspendThread - + 2183 0x6f745a0 ZwSystemDebugControl - + 2184 0x6f745b0 ZwTerminateEnclave - + 2185 0x6f745c0 ZwTerminateJobObject - + 2186 0x6f72c90 ZwTerminateProcess - + 2187 0x6f72f00 ZwTerminateThread - + 2188 0x6f745d0 ZwTestAlert - + 2189 0x6f745e0 ZwThawRegistry - + 2190 0x6f745f0 ZwThawTransactions - + 2191 0x6f74600 ZwTraceControl - + 2192 0x6f72fb0 ZwTraceEvent - + 2193 0x6f74610 ZwTranslateFilePath - + 2194 0x6f74620 ZwUmsThreadYield - + 2195 0x6f74630 ZwUnloadDriver - + 2197 0x6f74640 ZwUnloadKey - + 2196 0x6f74650 ZwUnloadKey2 - + 2198 0x6f74660 ZwUnloadKeyEx - + 2199 0x6f74670 ZwUnlockFile - + 2200 0x6f74680 ZwUnlockVirtualMemory - + 2201 0x6f72c70 ZwUnmapViewOfSection - + 2202 0x6f74690 ZwUnmapViewOfSectionEx - + 2203 0x6f746a0 ZwUnsubscribeWnfStateChange - + 2204 0x6f746b0 ZwUpdateWnfStateData - + 2205 0x6f746c0 ZwVdmControl - + 2206 0x6f746d0 ZwWaitForAlertByThreadId - + 2207 0x6f746e0 ZwWaitForDebugEvent - + 2208 0x6f746f0 ZwWaitForKeyedEvent - + 2210 0x6f72f80 ZwWaitForMultipleObjects - + 2209 0x6f72b70 ZwWaitForMultipleObjects32 - + 2211 0x6f729f0 ZwWaitForSingleObject - + 2212 0x6f74700 ZwWaitForWorkViaWorkerFactory - + 2213 0x6f74710 ZwWaitHighEventPair - + 2214 0x6f74720 ZwWaitLowEventPair - + 2215 0x6f729c0 ZwWorkerFactoryWorkerReady - + 2216 0x6f74820 ZwWow64AllocateVirtualMemory64 - + 2217 0x6f74850 ZwWow64CallFunction64 - + 2218 0x6f74770 ZwWow64CsrAllocateCaptureBuffer - + 2219 0x6f74790 ZwWow64CsrAllocateMessagePointer - + 2220 0x6f747a0 ZwWow64CsrCaptureMessageBuffer - + 2221 0x6f747b0 ZwWow64CsrCaptureMessageString - + 2222 0x6f74760 ZwWow64CsrClientCallServer - + 2223 0x6f74740 ZwWow64CsrClientConnectToServer - + 2224 0x6f74780 ZwWow64CsrFreeCaptureBuffer - + 2225 0x6f747c0 ZwWow64CsrGetProcessId - + 2226 0x6f74750 ZwWow64CsrIdentifyAlertableThread - + 2227 0x6f747d0 ZwWow64CsrVerifyRegion - + 2228 0x6f747e0 ZwWow64DebuggerCall - + 2229 0x6f747f0 ZwWow64GetCurrentProcessorNumberEx - + 2230 0x6f74800 ZwWow64GetNativeSystemInformation - + 2231 0x6f74860 ZwWow64IsProcessorFeaturePresent - + 2232 0x6f74810 ZwWow64QueryInformationProcess64 - + 2233 0x6f74830 ZwWow64ReadVirtualMemory64 - + 2234 0x6f74840 ZwWow64WriteVirtualMemory64 - + 2235 0x6f72a30 ZwWriteFile - + 2236 0x6f72b80 ZwWriteFileGather - + 2237 0x6f72f40 ZwWriteRequestData - + 2238 0x6f72d70 ZwWriteVirtualMemory - + 2239 0x6f72e30 ZwYieldExecution - + 2240 0x6f75b10 _CIcos - + 2241 0x6f75bd0 _CIlog - + 2242 0x6f75cc0 _CIpow - + 2243 0x6f75ef0 _CIsin - + 2244 0x6f75fa0 _CIsqrt - + 2245 0x6f76060 __isascii - + 2246 0x6f76080 __iscsym - + 2247 0x6f760c0 __iscsymf - + 2248 0x6f76100 __toascii - + 2249 0x6f76330 _alldiv - + 2250 0x6f763e0 _alldvrm - + 2251 0x6f764c0 _allmul - + 2252 0x6f76500 _alloca_probe - + 2253 0x6f76530 _alloca_probe_16 - + 2254 0x6f76546 _alloca_probe_8 - + 2255 0x6f76560 _allrem - + 2256 0x6f76620 _allshl - + 2257 0x6f76640 _allshr - + 2258 0x6f76670 _atoi64 - + 2259 0x6f766e0 _aulldiv - + 2260 0x6f76750 _aulldvrm - + 2261 0x6f767f0 _aullrem - + 2262 0x6f76870 _aullshr - + 2263 0x6f76500 _chkstk - + 2264 0x6fbd560 _errno - + 2265 0x6f768e0 _except_handler4_common - + 2266 0x7023820 _fltused - + 2267 0x6f76a00 _ftol - + 2268 0x6f76a40 _ftol2 - + 2269 0x6f76a30 _ftol2_sse - + 2270 0x6f76b40 _i64toa - + 2271 0x6f7f0b0 _i64toa_s - + 2272 0x6f76d10 _i64tow - + 2273 0x6f7f3a0 _i64tow_s - + 2274 0x6f76b80 _itoa - + 2275 0x6f7f0f0 _itoa_s - + 2276 0x6f76d50 _itow - + 2277 0x6f7f3e0 _itow_s - + 2278 0x6f76e60 _lfind - + 2279 0x6f76ed0 _local_unwind4 - + 2280 0x6f76b80 _ltoa - + 2281 0x6f7f0f0 _ltoa_s - + 2282 0x6f76d50 _ltow - + 2283 0x6f7f3e0 _ltow_s - + 2284 0x6f7f580 _makepath_s - + 2285 0x6f77040 _memccpy - + 2286 0x6f770a0 _memicmp - + 2287 0x6f770b0 _snprintf - + 2288 0x6f7f680 _snprintf_s - + 2289 0x6f7f740 _snscanf_s - + 2290 0x6f77140 _snwprintf - + 2291 0x6f7f780 _snwprintf_s - + 2292 0x6f7f840 _snwscanf_s - + 2293 0x6f77200 _splitpath - + 2294 0x6f7f880 _splitpath_s - + 2295 0x6f77430 _strcmpi - + 2296 0x6f77430 _stricmp - + 2297 0x6f77440 _strlwr - + 2298 0x6f77470 _strlwr_s - + 2299 0x6f774d0 _strnicmp - + 2300 0x6f7fa60 _strnset_s - + 2301 0x6f7fae0 _strset_s - + 2302 0x6f774e0 _strupr - + 2303 0x6f77530 _strupr_s - + 2304 0x6f77590 _swprintf - + 2305 0x6f76bc0 _ui64toa - + 2306 0x6f7f130 _ui64toa_s - + 2307 0x6f76d90 _ui64tow - + 2308 0x6f7f420 _ui64tow_s - + 2309 0x6f76bf0 _ultoa - + 2310 0x6f7f160 _ultoa_s - + 2311 0x6f76dc0 _ultow - + 2312 0x6f7f450 _ultow_s - + 2313 0x6f77630 _vscprintf - + 2314 0x6f77740 _vscwprintf - + 2315 0x6f77830 _vsnprintf - + 2316 0x6f7f6b0 _vsnprintf_s - + 2317 0x6f778e0 _vsnwprintf - + 2318 0x6f7f7b0 _vsnwprintf_s - + 2319 0x6f77770 _vswprintf - + 2320 0x6f779c0 _wcsicmp - + 2321 0x6f77a20 _wcslwr - + 2322 0x6f77a80 _wcslwr_s - + 2323 0x6f77af0 _wcsnicmp - + 2324 0x6f77b60 _wcsnset_s - + 2325 0x6f77bf0 _wcsset_s - + 2326 0x6f77c50 _wcstoi64 - + 2327 0x6f77c80 _wcstoui64 - + 2328 0x6f77f80 _wcsupr - + 2329 0x6f77fc0 _wcsupr_s - + 2330 0x6f7fb40 _wmakepath_s - + 2331 0x6f7fc90 _wsplitpath_s - + 2332 0x6f78030 _wtoi - + 2333 0x6f78040 _wtoi64 - + 2334 0x6f78070 _wtol - + 2335 0x6f780a0 abs - + 2336 0x6f780b0 atan - + 2337 0x6f78170 atan2 - + 2338 0x6f766a0 atoi - + 2339 0x6f766b0 atol - + 2340 0x6f78190 bsearch - + 2341 0x6f78250 bsearch_s - + 2342 0x6f78320 ceil - + 2343 0x6f75b00 cos - + 2344 0x6f78420 fabs - + 2345 0x6f784e0 floor - + 2346 0x6f76120 isalnum - + 2347 0x6f76150 isalpha - + 2348 0x6f76180 iscntrl - + 2349 0x6f761b0 isdigit - + 2350 0x6f761e0 isgraph - + 2351 0x6f76210 islower - + 2352 0x6f76240 isprint - + 2353 0x6f76270 ispunct - + 2354 0x6f762a0 isspace - + 2355 0x6f762d0 isupper - + 2356 0x6f785f0 iswalnum - + 2357 0x6f78610 iswalpha - + 2358 0x6f78630 iswascii - + 2359 0x6f78720 iswctype - + 2360 0x6f78650 iswdigit - + 2361 0x6f78670 iswgraph - + 2362 0x6f78690 iswlower - + 2363 0x6f786b0 iswprint - + 2364 0x6f786d0 iswspace - + 2365 0x6f786f0 iswxdigit - + 2366 0x6f76300 isxdigit - + 2367 0x6f780a0 labs - + 2368 0x6f75bc0 log - + 2369 0x6f78750 mbstowcs - + 2370 0x6f787d0 memchr - + 2371 0x6f78890 memcmp - + 2372 0x6f788e0 memcpy - + 2373 0x6f7feb0 memcpy_s - + 2374 0x6f78c20 memmove - + 2375 0x6f7ff30 memmove_s - + 2376 0x6f78f60 memset - + 2377 0x6f75cb0 pow - + 2378 0x6f78fd0 qsort - + 2379 0x6f79470 qsort_s - + 2380 0x6f75ee0 sin - + 2381 0x6f79930 sprintf - + 2382 0x6f7ff90 sprintf_s - + 2383 0x6f75fb4 sqrt - + 2384 0x6f799b0 sscanf - + 2385 0x6f80010 sscanf_s - + 2386 0x6f79a60 strcat - + 2387 0x6f80060 strcat_s - + 2388 0x6f79b60 strchr - + 2389 0x6f79c20 strcmp - + 2390 0x6f79a50 strcpy - + 2391 0x6f800e0 strcpy_s - + 2392 0x6f79cb0 strcspn - + 2393 0x6f79d00 strlen - + 2394 0x6f79d90 strncat - + 2395 0x6f80150 strncat_s - + 2396 0x6f79ed0 strncmp - + 2397 0x6f79f80 strncpy - + 2398 0x6f80240 strncpy_s - + 2399 0x6f7a0b0 strnlen - + 2400 0x6f7a0d0 strpbrk - + 2401 0x6f7a110 strrchr - + 2402 0x6f7a140 strspn - + 2403 0x6f7a190 strstr - + 2404 0x6f80320 strtok_s - + 2405 0x6f7a410 strtol - + 2406 0x6f7a460 strtoul - + 2407 0x6f77590 swprintf - + 2408 0x6f80450 swprintf_s - + 2409 0x6f804e0 swscanf_s - + 2410 0x6f7a490 tan - + 2411 0x6f7a560 tolower - + 2412 0x6f7a590 toupper - + 2413 0x6f7a5f0 towlower - + 2414 0x6f7a620 towupper - + 2415 0x6fbf000 vDbgPrintEx - + 2416 0x6fbf030 vDbgPrintExWithPrefix - + 2417 0x6f77720 vsprintf - + 2418 0x6f7ffc0 vsprintf_s - + 2419 0x6f80480 vswprintf_s - + 2420 0x6f7a640 wcscat - + 2421 0x6f80530 wcscat_s - + 2422 0x6f7a6b0 wcschr - + 2423 0x6f7a6f0 wcscmp - + 2424 0x6f7a680 wcscpy - + 2425 0x6f805c0 wcscpy_s - + 2426 0x6f7a740 wcscspn - + 2427 0x6f7a7a0 wcslen - + 2428 0x6f7a7c0 wcsncat - + 2429 0x6f80640 wcsncat_s - + 2430 0x6f7a810 wcsncmp - + 2431 0x6f7a850 wcsncpy - + 2432 0x6f80740 wcsncpy_s - + 2433 0x6f7a8a0 wcsnlen - + 2434 0x6f7a8d0 wcspbrk - + 2435 0x6f7a930 wcsrchr - + 2436 0x6f7a970 wcsspn - + 2437 0x6f7a9e0 wcsstr - + 2438 0x6f80820 wcstok_s - + 2439 0x6f7ac50 wcstol - + 2440 0x6f7acd0 wcstombs - + 2441 0x6f7aca0 wcstoul - +
- - - + + +
- - - - - - - - + + + + + + + + @@ -32357,19 +32357,19 @@

Exports

- - @@ -32377,8 +32377,8 @@

Exports

- @@ -32389,39 +32389,39 @@

Exports

- - @@ -32442,119 +32442,119 @@

Exports

- - - - @@ -32578,67 +32578,67 @@

Exports

- - - @@ -32662,43 +32662,43 @@

Exports

- @@ -32722,70 +32722,70 @@

Exports

- - - - @@ -32809,33 +32809,33 @@

Exports

- - @@ -32859,17 +32859,17 @@

Exports

- @@ -32948,138 +32948,138 @@

Exports

- - - - - - - @@ -33101,8 +33101,8 @@

Exports

- @@ -33113,10 +33113,10 @@

Exports

- @@ -33205,81 +33205,81 @@

Exports

- - - - @@ -33296,23 +33296,23 @@

Exports

 - - - - @@ -33329,48 +33329,48 @@

Exports

- - @@ -33384,41 +33384,41 @@

Exports

- - @@ -33430,62 +33430,62 @@

Exports

- - @@ -33500,34 +33500,34 @@

Exports

- @@ -33544,58 +33544,58 @@

Exports

- - @@ -33632,34 +33632,34 @@

Exports

- - @@ -33682,8 +33682,8 @@

Exports

 - @@ -33701,782 +33701,782 @@

Exports

 - - - - - - - - - - @@ -34485,8 +34485,8 @@

Exports

- @@ -34497,50 +34497,50 @@

Exports

- @@ -34627,29 +34627,29 @@

Exports

 - - - - - @@ -34662,709 +34662,709 @@

Exports

 - @@ -35376,14 +35376,14 @@

Exports

- +
- +
@@ -35396,67 +35396,67 @@
- - + + - + - + - - + + - - + + - - - - + + + + - - + + - - + + - - - + + + @@ -35473,72 +35473,72 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - +
Type Unpacked Shellcode
Filename - +
7e33e15230f04ce44991c65b53d1190ef1750d7b76a69e2316c41d63607f6203
- +
File Type data
File Size 113369 bytes
Virtual Address 0x06B00000
Process svchost.exe
PID 4012
Path C:\Windows\SysWOW64\svchost.exe
MD5 41699c255893db15543eaed507318095
SHA3-384 ee0b0bf2a04732767c49ba587adc750aa43694b37e998a32d973648b0a038f42599d420d61fe2e00a32a48d1e6e309b6
CRC32 EEACC746
TLSH T1B9B34B35A56222F8D8BAE1BEC0674F6BEC72305940B0AF5947E446364F632B06D1F727
Ssdeep 1536:lGJiwKZ/PrQtqMeHfWNCHYK3tWTOTMdxJdnM/lfp4B6wLyuWnTym37kTEK:UJiwHqH2CHYzRdVnMdfp4QRrbK
- - - - - - + + + + + + - - - - - - + + + + + +
@@ -35563,19 +35563,19 @@
- - @@ -35583,8 +35583,8 @@
- @@ -35595,39 +35595,39 @@
- - @@ -35648,79 +35648,79 @@
- - - @@ -35743,28 +35743,28 @@
- @@ -35787,18 +35787,18 @@
- @@ -35821,33 +35821,33 @@
- @@ -35870,21 +35870,21 @@
- @@ -35907,17 +35907,17 @@
- @@ -35941,42 +35941,42 @@
- - @@ -36000,13 +36000,13 @@
- @@ -36030,18 +36030,18 @@
- @@ -36059,138 +36059,138 @@
- - - - - - - @@ -36212,8 +36212,8 @@
- @@ -36224,10 +36224,10 @@
- @@ -36277,34 +36277,34 @@
- @@ -36348,81 +36348,81 @@
- - - - @@ -36439,23 +36439,23 @@
- - - - @@ -36466,8 +36466,8 @@
- @@ -36485,609 +36485,609 @@
- @@ -37096,8 +37096,8 @@
- @@ -37108,50 +37108,50 @@
- @@ -37238,29 +37238,29 @@
- - - - - @@ -37273,548 +37273,548 @@
- @@ -37826,14 +37826,14 @@
- +
@@ -37846,67 +37846,67 @@
- - + + - + - + - - + + - - + + - - - - + + + + - - + + - - + + - - - + + + @@ -37923,72 +37923,72 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - +
Type Unpacked Shellcode
Filename - +
a19ef6806265c9e7029da86d2d725b5b2f3113812fbc321474611b7b451888c3
- +
File Type data
File Size 2481 bytes
Virtual Address 0x000000914EE7F000
Process notepad.exe
PID 4836
Path C:\Windows\System32\notepad.exe
MD5 3042ff0e5984a003a70a73bdabd3d88f
SHA3-384 48ca693fac76d7d7e6cd645e66d1f8ad34a54bdd2e88585e2ed9abfc8d0e663c0b424f0bc27a6741dddf9fdb6505ca27
CRC32 3CCCB2E8
TLSH T1E051AF8B328ABEDBEF08D13930E6665932D9D58502310B1B0FC0EEA96F275948853915
Ssdeep 12:fc/3oU+jeZ0GDklml8tXYlTxCpuQmkl6XfoHVHEpSXJClhyF6tatn8dxAzXraovE:+8HGDNlCYltCpmpvoH3Z1uGz7lcXZv
- - - - - - + + + + + + - - - - - - + + + + + +
@@ -38013,19 +38013,19 @@
- - @@ -38033,8 +38033,8 @@
- @@ -38045,39 +38045,39 @@
- - @@ -38098,34 +38098,34 @@
- - @@ -38147,67 +38147,67 @@
- - @@ -38229,57 +38229,57 @@
- - @@ -38301,28 +38301,28 @@
- @@ -38344,34 +38344,34 @@
- @@ -38393,13 +38393,13 @@
- @@ -38432,150 +38432,150 @@
- - - - - - - - @@ -38597,8 +38597,8 @@
- @@ -38609,10 +38609,10 @@
- @@ -38701,95 +38701,95 @@
- - - - - @@ -38806,23 +38806,23 @@
- - - - @@ -38833,8 +38833,8 @@
- @@ -38852,355 +38852,355 @@
- @@ -39209,8 +39209,8 @@
- @@ -39221,50 +39221,50 @@
- @@ -39351,29 +39351,29 @@
- - - - - @@ -39386,335 +39386,335 @@
- @@ -39726,14 +39726,14 @@
- +
@@ -39746,57 +39746,57 @@
- - + + - + - - + + - - - - - + + + + + - - + + - - + + - - - + + + @@ -39813,141 +39813,141 @@
[Bazaar]
- + - - + + - + - + - - + + - - - - - + + + + + - - - - - - - - - + + + + + + + + + - - + + - - + +
Filename - +
2c8ad5991f46be686c2dc7eac552c30fb7c4083bddc40b9992f93211fdf3df8f
- +
File Type PE32 executable (GUI) Intel 80386, for MS Windows
File Size 1618432 bytes
Process 728546301b7008b5a1fb3aea.exe
PID 4984
Path C:\Users\Louise\AppData\Local\Temp\728546301b7008b5a1fb3aea.exe
MD5 0f222008c89222a90e6e9060529a9391
SHA3-384 03257540274b0a639050951d2f1a71c5a1b4f52f3228f79be975cbd4de15e2f1d93105f8d46aff12717496918f172fa3
CRC32 8CBA889A
TLSH T1BC75C00277C1C076FF93A273476BEA1A5B7879220277896F139C1979FD70272422E762
Ssdeep 24576:Znj9EXE1+TDiGAhmsZ30v2M4VAKTGblgekMqsyjAYLL0:ZKXq+9A0842N9KbllVqsyjtL
Yara
    - +
  • AutoIT_Compiled - Identifies compiled AutoIT script (as EXE). - + - Author: @bartblaze - +
    • - +
- - - - - + + + + + - - - - - - + + + + + +
- +

PE Information

- - - - - - - - + + + + + + + + - - - - + + + + - + - - + + - - + + - - + + - - + + - - - + + + - - - + + + - - + + - - + + - - + + - - + +
Image BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionCompile TimeImage BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionCompile TimeIconIcon Exact HashIcon Similarity HashIcon DHashIcon Exact HashIcon Similarity HashIcon DHash
0x009700000x000204f70x000000000x001995565.12025-11-24 12:30:413d5dc4e5a911bee7292a914140092c8ca788a1c8239f81d6e401dd187d68f45eb2b2e3e3e3a3a200
- +

Version Infos

@@ -39956,21 +39956,21 @@

Version Infos
Translation 0x0809 0x04b0
- - - + + +

Sections

@@ -39984,7 +39984,7 @@

Sections

Characteristics Entropy - + UPX0 0x00000400 @@ -39994,7 +39994,7 @@

Sections

IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.29 - + UPX1 0x000db400 @@ -40004,7 +40004,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 0.81 - + .rsrc 0x00137e00 @@ -40014,16 +40014,16 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 7.92 - +
- - - + + +
@@ -40045,7 +40045,7 @@
Entropy File type - + RT_ICON 0x001395ac @@ -40055,7 +40055,7 @@
3.66 None - + RT_ICON 0x001396d8 @@ -40065,7 +40065,7 @@
2.06 None - + RT_ICON 0x00139804 @@ -40075,7 +40075,7 @@
2.25 None - + RT_ICON 0x00139930 @@ -40085,7 +40085,7 @@
3.65 None - + RT_ICON 0x00139c1c @@ -40095,7 +40095,7 @@
3.44 None - + RT_ICON 0x00139d48 @@ -40105,7 +40105,7 @@
4.16 None - + RT_ICON 0x0013abf4 @@ -40115,7 +40115,7 @@
4.07 None - + RT_ICON 0x0013b4a0 @@ -40125,7 +40125,7 @@
2.18 None - + RT_ICON 0x0013ba0c @@ -40135,7 +40135,7 @@
4.52 None - + RT_ICON 0x0013dfb8 @@ -40145,7 +40145,7 @@
4.65 None - + RT_ICON 0x0013f064 @@ -40155,7 +40155,7 @@
4.39 None - + RT_MENU 0x000da4a0 @@ -40165,7 +40165,7 @@
2.68 None - + RT_STRING 0x000da4f0 @@ -40175,7 +40175,7 @@
3.35 None - + RT_STRING 0x000daa84 @@ -40185,7 +40185,7 @@
3.28 None - + RT_STRING 0x000db110 @@ -40195,7 +40195,7 @@
3.29 None - + RT_STRING 0x000db5a0 @@ -40205,7 +40205,7 @@
3.28 None - + RT_STRING 0x000dbb9c @@ -40215,7 +40215,7 @@
3.28 None - + RT_STRING 0x000dc1f8 @@ -40225,7 +40225,7 @@
3.26 None - + RT_STRING 0x000dc660 @@ -40235,7 +40235,7 @@
3.09 None - + RT_RCDATA 0x0013f4d0 @@ -40245,7 +40245,7 @@
8.00 None - + RT_GROUP_ICON 0x0018b880 @@ -40255,7 +40255,7 @@
2.87 None - + RT_GROUP_ICON 0x0018b8fc @@ -40265,7 +40265,7 @@
2.02 None - + RT_GROUP_ICON 0x0018b914 @@ -40275,7 +40275,7 @@
1.84 None - + RT_GROUP_ICON 0x0018b92c @@ -40285,7 +40285,7 @@
2.02 None - + RT_VERSION 0x0018b944 @@ -40295,7 +40295,7 @@
2.78 None - + RT_MANIFEST 0x0018ba24 @@ -40305,30 +40305,30 @@
5.40 None - +
- - + +
- - - + + +
- - - - - - - - + + + + + + + + @@ -40353,19 +40353,19 @@
- - @@ -40373,8 +40373,8 @@
- @@ -40385,39 +40385,39 @@
- - @@ -40438,72 +40438,72 @@
- - - @@ -40527,66 +40527,66 @@
- - - @@ -40610,27 +40610,27 @@
- - @@ -40654,73 +40654,73 @@
- - @@ -40744,50 +40744,50 @@
- - @@ -40811,16 +40811,16 @@
- @@ -40844,17 +40844,17 @@
- @@ -40879,36 +40879,36 @@
- @@ -40947,138 +40947,138 @@
- - - - - - - @@ -41100,8 +41100,8 @@
- @@ -41112,10 +41112,10 @@
- @@ -41204,81 +41204,81 @@
- - - - @@ -41295,46 +41295,46 @@
- - - - - @@ -41354,34 +41354,34 @@
- - @@ -41404,25 +41404,25 @@
- @@ -41437,66 +41437,66 @@
- - - @@ -41519,8 +41519,8 @@
- @@ -41538,559 +41538,559 @@
- - - - - - @@ -42099,8 +42099,8 @@
- @@ -42111,50 +42111,50 @@
- @@ -42241,29 +42241,29 @@
- - - - - @@ -42276,536 +42276,536 @@
- @@ -42817,14 +42817,14 @@
- + - +
@@ -42837,67 +42837,67 @@
- - + + - + - + - - + + - - + + - - - - + + + + - - + + - - + + - - - + + + @@ -42914,72 +42914,72 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - +
Type Unpacked Shellcode
Filename - +
4a469ca8fd3189b869aa582fb44875f475e50fe8bec71c5e0ad327e4c98ecab9
- +
File Type data
File Size 113402 bytes
Virtual Address 0x05FA0000
Process rundll32.exe
PID 3240
Path C:\Windows\SysWOW64\rundll32.exe
MD5 7cbd166f3fb80d2f3ee5c4a9c7cd9a51
SHA3-384 b77c6e2109ebcfb85b85767dd49852c4a4db24a1b9b64f037aa954591f8083310cfa36e25663f52d985ef7671c179a2c
CRC32 93E5952D
TLSH T1F6B34B35A52222F8D8BAE1BEC0674F6BEC72305940B0AF5947E446324F632B06D1F727
Ssdeep 1536:lGJiwKZ/PrQtqMeHfWNCHYK3tWTOTMdxJdnM/lfp4B6wLyuWnTyK37kTEz:UJiwHqH2CHYzRdVnMdfp4Qxrbz
- - - - - - + + + + + + - - - - - - + + + + + +
@@ -43004,19 +43004,19 @@
- - @@ -43024,8 +43024,8 @@
- @@ -43036,39 +43036,39 @@
- - @@ -43089,79 +43089,79 @@
- - - @@ -43184,28 +43184,28 @@
- @@ -43228,18 +43228,18 @@
- @@ -43262,33 +43262,33 @@
- @@ -43311,21 +43311,21 @@
- @@ -43348,17 +43348,17 @@
- @@ -43382,42 +43382,42 @@
- - @@ -43441,13 +43441,13 @@
- @@ -43471,18 +43471,18 @@
- @@ -43500,138 +43500,138 @@
- - - - - - - @@ -43653,8 +43653,8 @@
- @@ -43665,10 +43665,10 @@
- @@ -43718,34 +43718,34 @@
- @@ -43789,81 +43789,81 @@
- - - - @@ -43880,23 +43880,23 @@
- - - - @@ -43907,8 +43907,8 @@
- @@ -43926,610 +43926,610 @@
- @@ -44538,8 +44538,8 @@
- @@ -44550,50 +44550,50 @@
- @@ -44680,29 +44680,29 @@
- - - - - @@ -44715,549 +44715,549 @@
- @@ -45269,14 +45269,14 @@
- +
@@ -45289,67 +45289,67 @@
- - + + - + - + - - + + - - + + - - - - + + + + - - + + - - + + - - - + + + @@ -45366,104 +45366,104 @@
[Bazaar]
- + - - + + - + - + - - + + - - + + - - - - + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - +
Type Formbook Payload
Filename - +
19a871f07f34b086deb056ce2b1fabb3b554fac1da2d29e73ab86d318f7b67de
- +
File Type data
File Size 280539 bytes
Virtual Address 0x00820000
Process rundll32.exe
PID 3240
Path C:\Windows\SysWOW64\rundll32.exe
MD5 da7248c7409f7883e031762a7d9bd800
SHA3-384 6ddb46fdecb8a374b5647560985c51280704272c722eff1dad8cd0dcd403452ed5093bcb6ba2109e8c2733ea3e4e9805
CRC32 E549E43E
TLSH T13B54D031D502DC74E2F350A5F1DE171BA53D1D344025A162FFEA5AEAAAE18EC313A31B
Ssdeep 6144:ZACz/NY5XvwFLZ8hrCtovdj4hvReCgmmqzFZh:ZACz/y2HKOKV4hvReTmFZh
Yara
    - +
  • shellcode_stack_strings - Match x86 that appears to be stack string creation. - + - Author: William Ballenthin - +
    • - +
CAPE Yara
    - +
  • Formbook - Formbook Payload - + - Author: kevoreilly
    • - +
- - - - - - + + + + + + - - - - - - + + + + + +
@@ -45488,19 +45488,19 @@
- - @@ -45508,8 +45508,8 @@
- @@ -45520,39 +45520,39 @@
- - @@ -45573,69 +45573,69 @@
- - - @@ -45658,62 +45658,62 @@
- - - @@ -45736,59 +45736,59 @@
- - - @@ -45812,59 +45812,59 @@
- - - @@ -45888,28 +45888,28 @@
- @@ -45933,33 +45933,33 @@
- @@ -46002,43 +46002,43 @@
- @@ -46075,138 +46075,138 @@
- - - - - - - @@ -46228,8 +46228,8 @@
- @@ -46240,10 +46240,10 @@
- @@ -46332,81 +46332,81 @@
- - - - @@ -46423,23 +46423,23 @@
- - - - @@ -46450,8 +46450,8 @@
- @@ -46469,735 +46469,735 @@
- @@ -47206,8 +47206,8 @@
- @@ -47218,50 +47218,50 @@
- @@ -47348,29 +47348,29 @@
- - - - - @@ -47383,697 +47383,697 @@
- @@ -48085,14 +48085,14 @@
- +
@@ -48105,42 +48105,42 @@
- - + + - + - + - - + + - - - - + + + + @@ -48165,8 +48165,8 @@
- - + + @@ -48183,119 +48183,119 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - + + + + + + + + + - + @@ -48319,33 +48319,33 @@

Sections

- +
Type Injected PE Image: 32-bit executable
Filename - +
9447a102eeedd3e9f9e5f50498a1b87c75ea750116f392e27125019d1870b3ee
- +
File Type PE32 executable (GUI) Intel 80386, for MS Windows
File Size 291840 bytes
Target Process svchost.exePath C:\Users\Louise\AppData\Local\caprone\spiketail.exe
MD5 5c18e9469a65ab34eceefce1f514971c
SHA3-384 d6b547439f4e855e58ee03171b52f23a3a8c38d3051b97b45fe6be6d19b019b7f6100b26244627062fdc914797604172
CRC32 B774883E
TLSH T17154129BAA116829D51C083EF1612A7E99E2BB6F26D55F50720D468B47303D793E033F
Ssdeep 6144:89YFqn4F8HSvP0+95p/PsMM+osxJz0wOsB3tv/YUrpA89UOcZCwK:8YqnZSvjphM0xt0wOsNdYUrpn7cZA
- - - - - + + + + + - - - - - - + + + + + +
- +

PE Information

- - - - - - - - - - - - - + + + + + + + + + + + + + - + - - + + - - + + - - + + - - + + - - - + + + - - - - - - - + + + + + + +
Image BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionCompile TimeImage BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionCompile Time
0x004000000x000014300x000000000x00049f196.02019-02-23 03:30:59
- - - + + +

Sections

@@ -48309,7 +48309,7 @@

Sections

Characteristics Entropy
.text 0x00000400 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 8.00
- - - - + + + +
- - - + + +
- - - - - - - - + + + + + + + + @@ -48370,19 +48370,19 @@

Sections

- - @@ -48390,8 +48390,8 @@

Sections

- @@ -48402,39 +48402,39 @@

Sections

- - @@ -48455,57 +48455,57 @@

Sections

- - - @@ -48528,69 +48528,69 @@

Sections

- - - @@ -48613,78 +48613,78 @@

Sections

- - - - @@ -48708,43 +48708,43 @@

Sections

- @@ -48768,28 +48768,28 @@

Sections

- @@ -48813,50 +48813,50 @@

Sections

- - @@ -48880,28 +48880,28 @@

Sections

- @@ -48957,138 +48957,138 @@

Sections

- - - - - - - @@ -49110,8 +49110,8 @@

Sections

- @@ -49122,10 +49122,10 @@

Sections

- @@ -49214,81 +49214,81 @@

Sections

- - - - @@ -49305,46 +49305,46 @@

Sections

 - - - - - @@ -49374,66 +49374,66 @@

Sections

- - - @@ -49456,8 +49456,8 @@

Sections

 - @@ -49475,729 +49475,729 @@

Sections

 - - - - @@ -50206,8 +50206,8 @@

Sections

- @@ -50218,50 +50218,50 @@

Sections

- @@ -50348,29 +50348,29 @@

Sections

 - - - - - @@ -50383,658 +50383,658 @@

Sections

 - @@ -51046,14 +51046,14 @@

Sections

- + - +
@@ -51066,42 +51066,42 @@
- - + + - + - + - - + + - - - - + + + + @@ -51126,8 +51126,8 @@
- - + + @@ -51144,72 +51144,72 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - +
Type Injected Shellcode/Data
Filename - +
cfb3580ed12305b4e55bfbf7c7ddcb4c4452fbfef149e8cc73d5fda0c79a3d30
- +
File Type data
File Size 83500 bytes
Target Process notepad.exePath C:\Windows\SysWOW64\rundll32.exe
MD5 291457aaa33817ceac857ef7433fbbc8
SHA3-384 04b80dc1449e043aaff61a00ca67f5d74f503bd6c07a5bb785ad515ec9b934c2b458a204a0a857c59e3bd2ddf42e0aff
CRC32 37EBA7D7
TLSH T1268322A0AEE10199E3BB6C7625F382103AB9F4121E75E3AE88099348A402824DD30B06
Ssdeep 6:btkKEen+SkyGkNlj66AtMAbdlr8H5Ja1UEZ+lX14nMlNl0jSx6At6N0SUP+7sDQA:btkNe+UN9Abdp8Z01Q14nkNuEFP+GzbJ
- - - - - - + + + + + + - - - - - - + + + + + +
@@ -51234,19 +51234,19 @@
- - @@ -51254,8 +51254,8 @@
- @@ -51266,39 +51266,39 @@
- - @@ -51319,60 +51319,60 @@
- - @@ -51395,51 +51395,51 @@
- - @@ -51462,34 +51462,34 @@
- @@ -51512,64 +51512,64 @@
- - @@ -51592,30 +51592,30 @@
- - @@ -51638,21 +51638,21 @@
- @@ -51675,28 +51675,28 @@
- @@ -51719,17 +51719,17 @@
- @@ -51753,33 +51753,33 @@
- @@ -51797,138 +51797,138 @@
- - - - - - - @@ -51950,8 +51950,8 @@
- @@ -51962,10 +51962,10 @@
- @@ -52054,95 +52054,95 @@
- - - - - @@ -52159,23 +52159,23 @@
- - - - @@ -52186,8 +52186,8 @@
- @@ -52205,28 +52205,28 @@
- @@ -52235,8 +52235,8 @@
- @@ -52247,50 +52247,50 @@
- @@ -52377,29 +52377,29 @@
- - - - - @@ -52412,28 +52412,28 @@
- @@ -52445,14 +52445,14 @@
- +
@@ -52465,67 +52465,67 @@
- - + + - + - + - - + + - - + + - - - - + + + + - - + + - - + + - - - + + + @@ -52542,121 +52542,121 @@
[Bazaar]
- + - - + + - + - + - - - - - - + + + + + + - - - - - - - - - + + + + + + + + + - - + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - + +
Type Unpacked PE Image: 32-bit DLL
Filename - +
77c3efe5785c40dadbba5326662464c27bf5a6ebc104a51729cec98817867bcd
- +
File Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
File Size 1692672 bytes
Virtual Address 0x06F00000
Process svchost.exe
PID 4012
Path C:\Windows\SysWOW64\svchost.exe
MD5 dda9a793d57f58a9cff4896f8bf45dbf
SHA3-384 04655184f30cb472aaf171b03c008d8b78cbb9968048d669c501c5e3ebf6c62f8487efeb6dbdf62e453934efaf12f47e
CRC32 0886C9C4
TLSH T1CD75B351A3F84615F6F73B7059B926300E7A7CA5AB78C2DF628015AE4EB1EC08D70763
Ssdeep 24576:1he5jT9XyetZyhymfEHhHe3eP9w/ZceItH66i6Gv/12f0XHjy:j2ieto7EH5e3e+2eELc3j
- - - - - + + + + + - - - - - - + + + + + +
- +

PE Information

- - - - - - - - - - - - - + + + + + + + + + + + + + - + - - + + - - + + - - + + - - + + - - + + - - + + - - - - - - - + + + + + + + - +
Image BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionPDB PathCompile TimeExported DLL NameImage BaseEntry PointReported ChecksumActual ChecksumMinimum OS VersionPDB PathCompile TimeExported DLL Name
0x06f000000x000000000x001a61730x0019e35410.0wntdll.pdb1971-04-29 16:46:46ntdll.dll
- +

Version Infos

@@ -52665,77 +52665,77 @@

Version Infos
CompanyName Microsoft Corporation
FileDescription NT Layer DLL
FileVersion 10.0.19041.1288 (WinBuild.160101.0800)
InternalName ntdll.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename ntdll.dll
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.19041.1288
Translation 0x0409 0x04b0
- - - + + +

Sections

@@ -52749,7 +52749,7 @@

Sections

Characteristics Entropy - + .text 0x00000400 @@ -52759,7 +52759,7 @@

Sections

IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.83 - + PAGE 0x0011fc00 @@ -52769,7 +52769,7 @@

Sections

IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 5.10 - + RT 0x00120200 @@ -52779,7 +52779,7 @@

Sections

IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 5.24 - + .data 0x00120400 @@ -52789,7 +52789,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 1.44 - + .mrdata 0x00126000 @@ -52799,7 +52799,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.71 - + .00cfg 0x00128400 @@ -52809,7 +52809,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0.00 - + .rsrc 0x00128400 @@ -52819,7 +52819,7 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3.35 - + .reloc 0x00198200 @@ -52829,16 +52829,16 @@

Sections

IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 6.71 - +
- - - + + +
@@ -52860,7 +52860,7 @@
Entropy File type - + MUI 0x0019cd00 @@ -52870,7 +52870,7 @@
2.73 None - + RT_MESSAGETABLE 0x0012d470 @@ -52880,7 +52880,7 @@
3.35 None - + RT_VERSION 0x0012d0f0 @@ -52890,18 +52890,18 @@
3.50 None - +
- - + +
- +

Exports

@@ -52911,14627 +52911,14627 @@

Exports

Address Name - + 15 0x724602a A_SHAFinal - + 16 0x7246030 A_SHAInit - + 17 0x7246036 A_SHAUpdate - + 18 0x724603c AlpcAdjustCompletionListConcurrencyCount - + 19 0x7246042 AlpcFreeCompletionListMessage - + 20 0x7246048 AlpcGetCompletionListLastMessageInformation - + 21 0x724604e AlpcGetCompletionListMessageAttributes - + 22 0x7246054 AlpcGetHeaderSize - + 23 0x724605a AlpcGetMessageAttribute - + 24 0x7246060 AlpcGetMessageFromCompletionList - + 25 0x7246066 AlpcGetOutstandingCompletionListMessageCount - + 26 0x724606c AlpcInitializeMessageAttribute - + 27 0x7246072 AlpcMaxAllowedMessageLength - + 28 0x7246078 AlpcRegisterCompletionList - + 29 0x724607e AlpcRegisterCompletionListWorkerThread - + 30 0x7246084 AlpcRundownCompletionList - + 31 0x724608a AlpcUnregisterCompletionList - + 32 0x7246090 AlpcUnregisterCompletionListWorkerThread - + 33 0x7246096 ApiSetQueryApiSetPresence - + 34 0x724609c ApiSetQueryApiSetPresenceEx - + 35 0x72460a2 CsrAllocateCaptureBuffer - + 36 0x72460a8 CsrAllocateMessagePointer - + 37 0x72460ae CsrCaptureMessageBuffer - + 38 0x72460b4 CsrCaptureMessageMultiUnicodeStringsInPlace - + 39 0x72460ba CsrCaptureMessageString - + 40 0x72460c0 CsrCaptureTimeout - + 41 0x72460c6 CsrClientCallServer - + 42 0x72460cc CsrClientConnectToServer - + 43 0x72460d2 CsrFreeCaptureBuffer - + 44 0x72460d8 CsrGetProcessId - + 45 0x72460de CsrIdentifyAlertableThread - + 46 0x72460e4 CsrSetPriorityClass - + 47 0x72460ea CsrVerifyRegion - + 48 0x72460f0 DbgBreakPoint - + 49 0x72460f6 DbgPrint - + 50 0x72460fc DbgPrintEx - + 51 0x7246102 DbgPrintReturnControlC - + 52 0x7246108 DbgPrompt - + 53 0x724610e DbgQueryDebugFilterState - + 54 0x7246114 DbgSetDebugFilterState - + 55 0x724611a DbgUiConnectToDbg - + 56 0x7246120 DbgUiContinue - + 57 0x7246126 DbgUiConvertStateChangeStructure - + 58 0x724612c DbgUiConvertStateChangeStructureEx - + 59 0x7246132 DbgUiDebugActiveProcess - + 60 0x7246138 DbgUiGetThreadDebugObject - + 61 0x724613e DbgUiIssueRemoteBreakin - + 62 0x7246144 DbgUiRemoteBreakin - + 63 0x724614a DbgUiSetThreadDebugObject - + 64 0x7246150 DbgUiStopDebugging - + 65 0x7246156 DbgUiWaitStateChange - + 66 0x724615c DbgUserBreakPoint - + 67 0x7246162 EtwCheckCoverage - + 68 0x7246168 EtwCreateTraceInstanceId - + 69 0x724616e EtwDeliverDataBlock - + 70 0x7246174 EtwEnumerateProcessRegGuids - + 71 0x724617a EtwEventActivityIdControl - + 72 0x7246180 EtwEventEnabled - + 73 0x7246186 EtwEventProviderEnabled - + 74 0x724618c EtwEventRegister - + 75 0x7246192 EtwEventSetInformation - + 76 0x7246198 EtwEventUnregister - + 77 0x724619e EtwEventWrite - + 78 0x72461a4 EtwEventWriteEndScenario - + 79 0x72461aa EtwEventWriteEx - + 80 0x72461b0 EtwEventWriteFull - + 81 0x72461b6 EtwEventWriteNoRegistration - + 82 0x72461bc EtwEventWriteStartScenario - + 83 0x72461c2 EtwEventWriteString - + 84 0x72461c8 EtwEventWriteTransfer - + 85 0x72461ce EtwGetTraceEnableFlags - + 86 0x72461d4 EtwGetTraceEnableLevel - + 87 0x72461da EtwGetTraceLoggerHandle - + 88 0x72461e0 EtwLogTraceEvent - + 89 0x72461e6 EtwNotificationRegister - + 90 0x72461ec EtwNotificationUnregister - + 91 0x72461f2 EtwProcessPrivateLoggerRequest - + 92 0x72461f8 EtwRegisterSecurityProvider - + 93 0x72461fe EtwRegisterTraceGuidsA - + 94 0x7246204 EtwRegisterTraceGuidsW - + 95 0x724620a EtwReplyNotification - + 96 0x7246210 EtwSendNotification - + 97 0x7246216 EtwSetMark - + 98 0x724621c EtwTraceEventInstance - + 99 0x7246222 EtwTraceMessage - + 100 0x7246228 EtwTraceMessageVa - + 101 0x724622e EtwUnregisterTraceGuids - + 102 0x7246234 EtwWriteUMSecurityEvent - + 103 0x724623a EtwpCreateEtwThread - + 104 0x7246240 EtwpGetCpuSpeed - + 105 0x7246246 EvtIntReportAuthzEventAndSourceAsync - + 106 0x724624c EvtIntReportEventAndSourceAsync - + 107 0x6f74fc0 KiFastSystemCall - + 108 0x7246258 KiFastSystemCallRet - + 109 0x724625e KiIntSystemCall - + 110 0x7246264 KiRaiseUserExceptionDispatcher - + 111 0x724626a KiUserApcDispatcher - + 112 0x7246270 KiUserCallbackDispatcher - + 113 0x7246276 KiUserExceptionDispatcher - + 114 0x724627c LdrAccessResource - + 115 0x7246282 LdrAddDllDirectory - + 116 0x7246288 LdrAddLoadAsDataTable - + 117 0x724628e LdrAddRefDll - + 118 0x7246294 LdrAppxHandleIntegrityFailure - + 119 0x724629a LdrCallEnclave - + 120 0x72462a0 LdrControlFlowGuardEnforced - + 121 0x72462a6 LdrCreateEnclave - + 122 0x72462ac LdrDeleteEnclave - + 123 0x72462b2 LdrDisableThreadCalloutsForDll - + 124 0x72462b8 LdrEnumResources - + 125 0x72462be LdrEnumerateLoadedModules - + 126 0x72462c4 LdrFastFailInLoaderCallout - + 127 0x72462ca LdrFindEntryForAddress - + 128 0x72462d0 LdrFindResourceDirectory_U - + 129 0x72462d6 LdrFindResourceEx_U - + 130 0x72462dc LdrFindResource_U - + 131 0x72462e2 LdrFlushAlternateResourceModules - + 132 0x72462e8 LdrGetDllDirectory - + 133 0x72462ee LdrGetDllFullName - + 134 0x72462f4 LdrGetDllHandle - + 135 0x72462fa LdrGetDllHandleByMapping - + 136 0x7246300 LdrGetDllHandleByName - + 137 0x7246306 LdrGetDllHandleEx - + 138 0x724630c LdrGetDllPath - + 139 0x7246312 LdrGetFailureData - + 140 0x7246318 LdrGetFileNameFromLoadAsDataTable - + 141 0x724631e LdrGetProcedureAddress - + 142 0x7246324 LdrGetProcedureAddressEx - + 143 0x724632a LdrGetProcedureAddressForCaller - + 144 0x7246330 LdrInitShimEngineDynamic - + 145 0x7246336 LdrInitializeEnclave - + 146 0x724633c LdrInitializeThunk - + 147 0x7246342 LdrIsModuleSxsRedirected - + 148 0x7246348 LdrLoadAlternateResourceModule - + 149 0x724634e LdrLoadAlternateResourceModuleEx - + 150 0x7246354 LdrLoadDll - + 151 0x724635a LdrLoadEnclaveModule - + 152 0x7246360 LdrLockLoaderLock - + 153 0x7246366 LdrOpenImageFileOptionsKey - + 154 0x724636c LdrParentInterlockedPopEntrySList - + 155 0x7246372 LdrParentRtlInitializeNtUserPfn - + 156 0x7246378 LdrParentRtlResetNtUserPfn - + 157 0x724637e LdrParentRtlRetrieveNtUserPfn - + 158 0x7246384 LdrProcessRelocationBlock - + 159 0x724638a LdrProcessRelocationBlockEx - + 160 0x7246390 LdrQueryImageFileExecutionOptions - + 161 0x7246396 LdrQueryImageFileExecutionOptionsEx - + 162 0x724639c LdrQueryImageFileKeyOption - + 163 0x72463a2 LdrQueryModuleServiceTags - + 164 0x72463a8 LdrQueryOptionalDelayLoadedAPI - + 165 0x72463ae LdrQueryProcessModuleInformation - + 166 0x72463b4 LdrRegisterDllNotification - + 167 0x72463ba LdrRemoveDllDirectory - + 168 0x72463c0 LdrRemoveLoadAsDataTable - + 169 0x72463c6 LdrResFindResource - + 170 0x72463cc LdrResFindResourceDirectory - + 171 0x72463d2 LdrResGetRCConfig - + 172 0x72463d8 LdrResRelease - + 173 0x72463de LdrResSearchResource - + 174 0x72463e4 LdrResolveDelayLoadedAPI - + 175 0x72463ea LdrResolveDelayLoadsFromDll - + 176 0x72463f0 LdrRscIsTypeExist - + 177 0x72463f6 LdrSetAppCompatDllRedirectionCallback - + 178 0x72463fc LdrSetDefaultDllDirectories - + 179 0x7246402 LdrSetDllDirectory - + 180 0x7246408 LdrSetDllManifestProber - + 181 0x724640e LdrSetImplicitPathOptions - + 182 0x7246414 LdrSetMUICacheType - + 183 0x724641a LdrShutdownProcess - + 184 0x7246420 LdrShutdownThread - + 185 0x7246426 LdrStandardizeSystemPath - + 186 0x724642c LdrSystemDllInitBlock - + 187 0x7246432 LdrUnloadAlternateResourceModule - + 188 0x7246438 LdrUnloadAlternateResourceModuleEx - + 189 0x724643e LdrUnloadDll - + 190 0x7246444 LdrUnlockLoaderLock - + 191 0x724644a LdrUnregisterDllNotification - + 192 0x7246450 LdrUpdatePackageSearchPath - + 193 0x7246456 LdrVerifyImageMatchesChecksum - + 194 0x724645c LdrVerifyImageMatchesChecksumEx - + 195 0x7246462 LdrpChildNtdll - + 196 0x7246468 LdrpResGetMappingSize - + 197 0x724646e LdrpResGetResourceDirectory - + 198 0x7246474 MD4Final - + 199 0x724647a MD4Init - + 200 0x7246480 MD4Update - + 201 0x7246486 MD5Final - + 202 0x724648c MD5Init - + 203 0x7246492 MD5Update - + 204 0x7246498 NlsAnsiCodePage - + 205 0x724649e NlsMbCodePageTag - + 206 0x72464a4 NlsMbOemCodePageTag - + 207 0x72464aa NtAcceptConnectPort - + 208 0x72464b0 NtAccessCheck - + 209 0x72464b6 NtAccessCheckAndAuditAlarm - + 210 0x72464bc NtAccessCheckByType - + 211 0x72464c2 NtAccessCheckByTypeAndAuditAlarm - + 212 0x72464c8 NtAccessCheckByTypeResultList - + 213 0x72464ce NtAccessCheckByTypeResultListAndAuditAlarm - + 214 0x72464d4 NtAccessCheckByTypeResultListAndAuditAlarmByHandle - + 215 0x72464da NtAcquireCrossVmMutant - + 216 0x72464e0 NtAcquireProcessActivityReference - + 217 0x72464e6 NtAddAtom - + 218 0x72464ec NtAddAtomEx - + 219 0x72464f2 NtAddBootEntry - + 220 0x72464f8 NtAddDriverEntry - + 221 0x72464fe NtAdjustGroupsToken - + 222 0x6f72de0 NtAdjustPrivilegesToken - + 223 0x724650a NtAdjustTokenClaimsAndDeviceGroups - + 224 0x7246510 NtAlertResumeThread - + 225 0x7246516 NtAlertThread - + 226 0x724651c NtAlertThreadByThreadId - + 227 0x7246522 NtAllocateLocallyUniqueId - + 228 0x7246528 NtAllocateReserveObject - + 229 0x724652e NtAllocateUserPhysicalPages - + 230 0x7246534 NtAllocateUserPhysicalPagesEx - + 231 0x724653a NtAllocateUuids - + 232 0x6f72b30 NtAllocateVirtualMemory - + 233 0x7246546 NtAllocateVirtualMemoryEx - + 234 0x724654c NtAlpcAcceptConnectPort - + 235 0x7246552 NtAlpcCancelMessage - + 236 0x7246558 NtAlpcConnectPort - + 237 0x724655e NtAlpcConnectPortEx - + 238 0x7246564 NtAlpcCreatePort - + 239 0x724656a NtAlpcCreatePortSection - + 240 0x7246570 NtAlpcCreateResourceReserve - + 241 0x7246576 NtAlpcCreateSectionView - + 242 0x724657c NtAlpcCreateSecurityContext - + 243 0x7246582 NtAlpcDeletePortSection - + 244 0x7246588 NtAlpcDeleteResourceReserve - + 245 0x724658e NtAlpcDeleteSectionView - + 246 0x7246594 NtAlpcDeleteSecurityContext - + 247 0x724659a NtAlpcDisconnectPort - + 248 0x72465a0 NtAlpcImpersonateClientContainerOfPort - + 249 0x72465a6 NtAlpcImpersonateClientOfPort - + 250 0x72465ac NtAlpcOpenSenderProcess - + 251 0x72465b2 NtAlpcOpenSenderThread - + 252 0x72465b8 NtAlpcQueryInformation - + 253 0x72465be NtAlpcQueryInformationMessage - + 254 0x72465c4 NtAlpcRevokeSecurityContext - + 255 0x72465ca NtAlpcSendWaitReceivePort - + 256 0x72465d0 NtAlpcSetInformation - + 257 0x72465d6 NtApphelpCacheControl - + 258 0x72465dc NtAreMappedFilesTheSame - + 259 0x72465e2 NtAssignProcessToJobObject - + 260 0x72465e8 NtAssociateWaitCompletionPacket - + 261 0x72465ee NtCallEnclave - + 262 0x72465f4 NtCallbackReturn - + 263 0x72465fa NtCancelIoFile - + 264 0x7246600 NtCancelIoFileEx - + 265 0x7246606 NtCancelSynchronousIoFile - + 267 0x7246612 NtCancelTimer - + 266 0x724660c NtCancelTimer2 - + 268 0x7246618 NtCancelWaitCompletionPacket - + 269 0x724661e NtClearEvent - + 270 0x6f72aa0 NtClose - + 271 0x724662a NtCloseObjectAuditAlarm - + 272 0x7246630 NtCommitComplete - + 273 0x7246636 NtCommitEnlistment - + 274 0x724663c NtCommitRegistryTransaction - + 275 0x7246642 NtCommitTransaction - + 276 0x7246648 NtCompactKeys - + 277 0x724664e NtCompareObjects - + 278 0x7246654 NtCompareSigningLevels - + 279 0x724665a NtCompareTokens - + 280 0x7246660 NtCompleteConnectPort - + 281 0x7246666 NtCompressKey - + 282 0x724666c NtConnectPort - + 283 0x7246672 NtContinue - + 284 0x7246678 NtContinueEx - + 285 0x724667e NtConvertBetweenAuxiliaryCounterAndPerformanceCounter - + 286 0x7246684 NtCreateCrossVmEvent - + 287 0x724668a NtCreateCrossVmMutant - + 288 0x7246690 NtCreateDebugObject - + 289 0x7246696 NtCreateDirectoryObject - + 290 0x724669c NtCreateDirectoryObjectEx - + 291 0x72466a2 NtCreateEnclave - + 292 0x72466a8 NtCreateEnlistment - + 293 0x72466ae NtCreateEvent - + 294 0x72466b4 NtCreateEventPair - + 295 0x6f72f20 NtCreateFile - + 296 0x72466c0 NtCreateIRTimer - + 297 0x72466c6 NtCreateIoCompletion - + 298 0x72466cc NtCreateJobObject - + 299 0x72466d2 NtCreateJobSet - + 300 0x6f72ba0 NtCreateKey - + 301 0x72466de NtCreateKeyTransacted - + 302 0x72466e4 NtCreateKeyedEvent - + 303 0x72466ea NtCreateLowBoxToken - + 304 0x72466f0 NtCreateMailslotFile - + 305 0x6f73500 NtCreateMutant - + 306 0x72466fc NtCreateNamedPipeFile - + 307 0x7246702 NtCreatePagingFile - + 308 0x7246708 NtCreatePartition - + 309 0x724670e NtCreatePort - + 310 0x7246714 NtCreatePrivateNamespace - + 311 0x724671a NtCreateProcess - + 312 0x6f72ea0 NtCreateProcessEx - + 313 0x7246726 NtCreateProfile - + 314 0x724672c NtCreateProfileEx - + 315 0x7246732 NtCreateRegistryTransaction - + 316 0x7246738 NtCreateResourceManager - + 317 0x6f72e70 NtCreateSection - + 318 0x7246744 NtCreateSectionEx - + 319 0x724674a NtCreateSemaphore - + 320 0x7246750 NtCreateSymbolicLinkObject - + 321 0x7246756 NtCreateThread - + 322 0x724675c NtCreateThreadEx - + 324 0x7246768 NtCreateTimer - + 323 0x7246762 NtCreateTimer2 - + 325 0x724676e NtCreateToken - + 326 0x7246774 NtCreateTokenEx - + 327 0x724677a NtCreateTransaction - + 328 0x7246780 NtCreateTransactionManager - + 329 0x7246786 NtCreateUserProcess - + 330 0x724678c NtCreateWaitCompletionPacket - + 331 0x7246792 NtCreateWaitablePort - + 332 0x7246798 NtCreateWnfStateName - + 333 0x724679e NtCreateWorkerFactory - + 334 0x72467a4 NtCurrentTeb - + 335 0x72467aa NtDebugActiveProcess - + 336 0x72467b0 NtDebugContinue - + 337 0x6f72d10 NtDelayExecution - + 338 0x72467bc NtDeleteAtom - + 339 0x72467c2 NtDeleteBootEntry - + 340 0x72467c8 NtDeleteDriverEntry - + 341 0x72467ce NtDeleteFile - + 342 0x72467d4 NtDeleteKey - + 343 0x72467da NtDeleteObjectAuditAlarm - + 344 0x72467e0 NtDeletePrivateNamespace - + 345 0x72467e6 NtDeleteValueKey - + 346 0x72467ec NtDeleteWnfStateData - + 347 0x72467f2 NtDeleteWnfStateName - + 348 0x72467f8 NtDeviceIoControlFile - + 349 0x72467fe NtDirectGraphicsCall - + 350 0x7246804 NtDisableLastKnownGood - + 351 0x724680a NtDisplayString - + 352 0x7246810 NtDrawText - + 353 0x7246816 NtDuplicateObject - + 354 0x724681c NtDuplicateToken - + 355 0x7246822 NtEnableLastKnownGood - + 356 0x7246828 NtEnumerateBootEntries - + 357 0x724682e NtEnumerateDriverEntries - + 358 0x6f72cf0 NtEnumerateKey - + 359 0x724683a NtEnumerateSystemEnvironmentValuesEx - + 360 0x7246840 NtEnumerateTransactionObject - + 361 0x6f72ae0 NtEnumerateValueKey - + 362 0x724684c NtExtendSection - + 363 0x7246852 NtFilterBootOption - + 364 0x7246858 NtFilterToken - + 365 0x724685e NtFilterTokenEx - + 366 0x7246864 NtFindAtom - + 367 0x724686a NtFlushBuffersFile - + 368 0x7246870 NtFlushBuffersFileEx - + 369 0x7246876 NtFlushInstallUILanguage - + 370 0x724687c NtFlushInstructionCache - + 371 0x7246882 NtFlushKey - + 372 0x7246888 NtFlushProcessWriteBuffers - + 373 0x724688e NtFlushVirtualMemory - + 374 0x7246894 NtFlushWriteBuffer - + 375 0x724689a NtFreeUserPhysicalPages - + 376 0x6f72bb0 NtFreeVirtualMemory - + 377 0x72468a6 NtFreezeRegistry - + 378 0x72468ac NtFreezeTransactions - + 379 0x72468b2 NtFsControlFile - + 380 0x72468b8 NtGetCachedSigningLevel - + 381 0x72468be NtGetCompleteWnfStateSubscription - + 382 0x6f738f0 NtGetContextThread - + 383 0x72468ca NtGetCurrentProcessorNumber - + 384 0x72468d0 NtGetCurrentProcessorNumberEx - + 385 0x72468d6 NtGetDevicePowerState - + 386 0x72468dc NtGetMUIRegistryInfo - + 387 0x72468e2 NtGetNextProcess - + 388 0x72468e8 NtGetNextThread - + 389 0x72468ee NtGetNlsSectionPtr - + 390 0x72468f4 NtGetNotificationResourceManager - + 391 0x72468fa NtGetTickCount - + 392 0x7246900 NtGetWriteWatch - + 393 0x7246906 NtImpersonateAnonymousToken - + 394 0x724690c NtImpersonateClientOfPort - + 395 0x7246912 NtImpersonateThread - + 396 0x7246918 NtInitializeEnclave - + 397 0x724691e NtInitializeNlsFiles - + 398 0x7246924 NtInitializeRegistry - + 399 0x724692a NtInitiatePowerAction - + 400 0x7246930 NtIsProcessInJob - + 401 0x7246936 NtIsSystemResumeAutomatic - + 402 0x724693c NtIsUILanguageComitted - + 403 0x7246942 NtListenPort - + 404 0x7246948 NtLoadDriver - + 405 0x724694e NtLoadEnclaveData - + 408 0x7246960 NtLoadKey - + 406 0x7246954 NtLoadKey2 - + 407 0x724695a NtLoadKey3 - + 409 0x7246966 NtLoadKeyEx - + 410 0x724696c NtLockFile - + 411 0x7246972 NtLockProductActivationKeys - + 412 0x7246978 NtLockRegistryKey - + 413 0x724697e NtLockVirtualMemory - + 414 0x7246984 NtMakePermanentObject - + 415 0x724698a NtMakeTemporaryObject - + 416 0x7246990 NtManageHotPatch - + 417 0x7246996 NtManagePartition - + 418 0x724699c NtMapCMFModule - + 419 0x72469a2 NtMapUserPhysicalPages - + 420 0x72469a8 NtMapUserPhysicalPagesScatter - + 421 0x6f72c50 NtMapViewOfSection - + 422 0x72469b4 NtMapViewOfSectionEx - + 423 0x72469ba NtModifyBootEntry - + 424 0x72469c0 NtModifyDriverEntry - + 425 0x72469c6 NtNotifyChangeDirectoryFile - + 426 0x72469cc NtNotifyChangeDirectoryFileEx - + 427 0x72469d2 NtNotifyChangeKey - + 428 0x72469d8 NtNotifyChangeMultipleKeys - + 429 0x72469de NtNotifyChangeSession - + 430 0x6f72f50 NtOpenDirectoryObject - + 431 0x72469ea NtOpenEnlistment - + 432 0x72469f0 NtOpenEvent - + 433 0x72469f6 NtOpenEventPair - + 434 0x72469fc NtOpenFile - + 435 0x7246a02 NtOpenIoCompletion - + 436 0x7246a08 NtOpenJobObject - + 437 0x7246a0e NtOpenKey - + 438 0x7246a14 NtOpenKeyEx - + 439 0x7246a1a NtOpenKeyTransacted - + 440 0x7246a20 NtOpenKeyTransactedEx - + 441 0x7246a26 NtOpenKeyedEvent - + 442 0x7246a2c NtOpenMutant - + 443 0x7246a32 NtOpenObjectAuditAlarm - + 444 0x7246a38 NtOpenPartition - + 445 0x7246a3e NtOpenPrivateNamespace - + 446 0x6f72c30 NtOpenProcess - + 447 0x6f73c50 NtOpenProcessToken - + 448 0x7246a50 NtOpenProcessTokenEx - + 449 0x7246a56 NtOpenRegistryTransaction - + 450 0x7246a5c NtOpenResourceManager - + 451 0x7246a62 NtOpenSection - + 452 0x7246a68 NtOpenSemaphore - + 453 0x7246a6e NtOpenSession - + 454 0x7246a74 NtOpenSymbolicLinkObject - + 455 0x6f73cb0 NtOpenThread - + 456 0x7246a80 NtOpenThreadToken - + 457 0x7246a86 NtOpenThreadTokenEx - + 458 0x7246a8c NtOpenTimer - + 459 0x7246a92 NtOpenTransaction - + 460 0x7246a98 NtOpenTransactionManager - + 461 0x7246a9e NtPlugPlayControl - + 462 0x7246aa4 NtPowerInformation - + 463 0x7246aaa NtPrePrepareComplete - + 464 0x7246ab0 NtPrePrepareEnlistment - + 465 0x7246ab6 NtPrepareComplete - + 466 0x7246abc NtPrepareEnlistment - + 467 0x7246ac2 NtPrivilegeCheck - + 468 0x7246ac8 NtPrivilegeObjectAuditAlarm - + 469 0x7246ace NtPrivilegedServiceAuditAlarm - + 470 0x7246ad4 NtPropagationComplete - + 471 0x7246ada NtPropagationFailed - + 472 0x6f72ed0 NtProtectVirtualMemory - + 473 0x7246ae6 NtPssCaptureVaSpaceBulk - + 474 0x7246aec NtPulseEvent - + 475 0x7246af2 NtQueryAttributesFile - + 476 0x7246af8 NtQueryAuxiliaryCounterFrequency - + 477 0x7246afe NtQueryBootEntryOrder - + 478 0x7246b04 NtQueryBootOptions - + 479 0x7246b0a NtQueryDebugFilterState - + 480 0x7246b10 NtQueryDefaultLocale - + 481 0x7246b16 NtQueryDefaultUILanguage - + 482 0x7246b1c NtQueryDirectoryFile - + 483 0x7246b22 NtQueryDirectoryFileEx - + 484 0x7246b28 NtQueryDirectoryObject - + 485 0x7246b2e NtQueryDriverEntryOrder - + 486 0x7246b34 NtQueryEaFile - + 487 0x7246b3a NtQueryEvent - + 488 0x7246b40 NtQueryFullAttributesFile - + 489 0x7246b46 NtQueryInformationAtom - + 490 0x7246b4c NtQueryInformationByName - + 491 0x7246b52 NtQueryInformationEnlistment - + 492 0x6f72ac0 NtQueryInformationFile - + 493 0x7246b5e NtQueryInformationJobObject - + 494 0x7246b64 NtQueryInformationPort - + 495 0x6f72b40 NtQueryInformationProcess - + 496 0x7246b70 NtQueryInformationResourceManager - + 497 0x7246b76 NtQueryInformationThread - + 498 0x6f72be0 NtQueryInformationToken - + 499 0x7246b82 NtQueryInformationTransaction - + 500 0x7246b88 NtQueryInformationTransactionManager - + 501 0x7246b8e NtQueryInformationWorkerFactory - + 502 0x7246b94 NtQueryInstallUILanguage - + 503 0x7246b9a NtQueryIntervalProfile - + 504 0x7246ba0 NtQueryIoCompletion - + 505 0x7246ba6 NtQueryKey - + 506 0x7246bac NtQueryLicenseValue - + 507 0x7246bb2 NtQueryMultipleValueKey - + 508 0x7246bb8 NtQueryMutant - + 509 0x7246bbe NtQueryObject - + 510 0x7246bc4 NtQueryOpenSubKeys - + 511 0x7246bca NtQueryOpenSubKeysEx - + 512 0x7246bd0 NtQueryPerformanceCounter - + 513 0x7246bd6 NtQueryPortInformationProcess - + 514 0x7246bdc NtQueryQuotaInformationFile - + 515 0x6f72ee0 NtQuerySection - + 516 0x7246be8 NtQuerySecurityAttributesToken - + 517 0x7246bee NtQuerySecurityObject - + 518 0x7246bf4 NtQuerySecurityPolicy - + 519 0x7246bfa NtQuerySemaphore - + 520 0x7246c00 NtQuerySymbolicLinkObject - + 521 0x7246c06 NtQuerySystemEnvironmentValue - + 522 0x7246c0c NtQuerySystemEnvironmentValueEx - + 523 0x6f72d30 NtQuerySystemInformation - + 524 0x7246c18 NtQuerySystemInformationEx - + 525 0x7246c1e NtQuerySystemTime - + 526 0x7246c24 NtQueryTimer - + 527 0x7246c2a NtQueryTimerResolution - + 528 0x6f72b20 NtQueryValueKey - + 529 0x6f72c00 NtQueryVirtualMemory - + 530 0x7246c3c NtQueryVolumeInformationFile - + 531 0x7246c42 NtQueryWnfStateData - + 532 0x7246c48 NtQueryWnfStateNameInformation - + 533 0x6f72e20 NtQueueApcThread - + 534 0x7246c54 NtQueueApcThreadEx - + 535 0x7246c5a NtRaiseException - + 536 0x7246c60 NtRaiseHardError - + 537 0x6f72a10 NtReadFile - + 538 0x7246c6c NtReadFileScatter - + 539 0x7246c72 NtReadOnlyEnlistment - + 540 0x7246c78 NtReadRequestData - + 541 0x6f72dc0 NtReadVirtualMemory - + 542 0x7246c84 NtRecoverEnlistment - + 543 0x7246c8a NtRecoverResourceManager - + 544 0x7246c90 NtRecoverTransactionManager - + 545 0x7246c96 NtRegisterProtocolAddressInformation - + 546 0x7246c9c NtRegisterThreadTerminatePort - + 547 0x7246ca2 NtReleaseKeyedEvent - + 548 0x7246ca8 NtReleaseMutant - + 549 0x7246cae NtReleaseSemaphore - + 550 0x7246cb4 NtReleaseWorkerFactoryWorker - + 551 0x7246cba NtRemoveIoCompletion - + 552 0x7246cc0 NtRemoveIoCompletionEx - + 553 0x7246cc6 NtRemoveProcessDebug - + 554 0x7246ccc NtRenameKey - + 555 0x7246cd2 NtRenameTransactionManager - + 556 0x7246cd8 NtReplaceKey - + 557 0x7246cde NtReplacePartitionUnit - + 558 0x7246ce4 NtReplyPort - + 559 0x7246cea NtReplyWaitReceivePort - + 560 0x7246cf0 NtReplyWaitReceivePortEx - + 561 0x7246cf6 NtReplyWaitReplyPort - + 562 0x7246cfc NtRequestPort - + 563 0x7246d02 NtRequestWaitReplyPort - + 564 0x7246d08 NtResetEvent - + 565 0x7246d0e NtResetWriteWatch - + 566 0x7246d14 NtRestoreKey - + 567 0x7246d1a NtResumeProcess - + 568 0x6f72ef0 NtResumeThread - + 569 0x7246d26 NtRevertContainerImpersonation - + 570 0x7246d2c NtRollbackComplete - + 571 0x7246d32 NtRollbackEnlistment - + 572 0x7246d38 NtRollbackRegistryTransaction - + 573 0x7246d3e NtRollbackTransaction - + 574 0x7246d44 NtRollforwardTransactionManager - + 575 0x7246d4a NtSaveKey - + 576 0x7246d50 NtSaveKeyEx - + 577 0x7246d56 NtSaveMergedKeys - + 578 0x7246d5c NtSecureConnectPort - + 579 0x7246d62 NtSerializeBoot - + 580 0x7246d68 NtSetBootEntryOrder - + 581 0x7246d6e NtSetBootOptions - + 583 0x7246d7a NtSetCachedSigningLevel - + 582 0x7246d74 NtSetCachedSigningLevel2 - + 584 0x6f74280 NtSetContextThread - + 585 0x7246d86 NtSetDebugFilterState - + 586 0x7246d8c NtSetDefaultHardErrorPort - + 587 0x7246d92 NtSetDefaultLocale - + 588 0x7246d98 NtSetDefaultUILanguage - + 589 0x7246d9e NtSetDriverEntryOrder - + 590 0x7246da4 NtSetEaFile - + 591 0x7246daa NtSetEvent - + 592 0x7246db0 NtSetEventBoostPriority - + 593 0x7246db6 NtSetHighEventPair - + 594 0x7246dbc NtSetHighWaitLowEventPair - + 595 0x7246dc2 NtSetIRTimer - + 596 0x7246dc8 NtSetInformationDebugObject - + 597 0x7246dce NtSetInformationEnlistment - + 598 0x6f72c40 NtSetInformationFile - + 599 0x7246dda NtSetInformationJobObject - + 600 0x7246de0 NtSetInformationKey - + 601 0x7246de6 NtSetInformationObject - + 602 0x7246dec NtSetInformationProcess - + 603 0x7246df2 NtSetInformationResourceManager - + 604 0x7246df8 NtSetInformationSymbolicLink - + 605 0x7246dfe NtSetInformationThread - + 606 0x7246e04 NtSetInformationToken - + 607 0x7246e0a NtSetInformationTransaction - + 608 0x7246e10 NtSetInformationTransactionManager - + 609 0x7246e16 NtSetInformationVirtualMemory - + 610 0x7246e1c NtSetInformationWorkerFactory - + 611 0x7246e22 NtSetIntervalProfile - + 612 0x7246e28 NtSetIoCompletion - + 613 0x7246e2e NtSetIoCompletionEx - + 614 0x7246e34 NtSetLdtEntries - + 615 0x7246e3a NtSetLowEventPair - + 616 0x7246e40 NtSetLowWaitHighEventPair - + 617 0x7246e46 NtSetQuotaInformationFile - + 618 0x7246e4c NtSetSecurityObject - + 619 0x7246e52 NtSetSystemEnvironmentValue - + 620 0x7246e58 NtSetSystemEnvironmentValueEx - + 621 0x7246e5e NtSetSystemInformation - + 622 0x7246e64 NtSetSystemPowerState - + 623 0x7246e6a NtSetSystemTime - + 624 0x7246e70 NtSetThreadExecutionState - + 626 0x7246e7c NtSetTimer - + 625 0x7246e76 NtSetTimer2 - + 627 0x7246e82 NtSetTimerEx - + 628 0x7246e88 NtSetTimerResolution - + 629 0x7246e8e NtSetUuidSeed - + 630 0x6f72fd0 NtSetValueKey - + 631 0x7246e9a NtSetVolumeInformationFile - + 632 0x7246ea0 NtSetWnfProcessNotificationEvent - + 633 0x7246ea6 NtShutdownSystem - + 634 0x7246eac NtShutdownWorkerFactory - + 635 0x7246eb2 NtSignalAndWaitForSingleObject - + 636 0x7246eb8 NtSinglePhaseReject - + 637 0x7246ebe NtStartProfile - + 638 0x7246ec4 NtStopProfile - + 639 0x7246eca NtSubscribeWnfStateChange - + 640 0x7246ed0 NtSuspendProcess - + 641 0x6f74590 NtSuspendThread - + 642 0x7246edc NtSystemDebugControl - + 643 0x7246ee2 NtTerminateEnclave - + 644 0x7246ee8 NtTerminateJobObject - + 645 0x7246eee NtTerminateProcess - + 646 0x7246ef4 NtTerminateThread - + 647 0x7246efa NtTestAlert - + 648 0x7246f00 NtThawRegistry - + 649 0x7246f06 NtThawTransactions - + 650 0x7246f0c NtTraceControl - + 651 0x7246f12 NtTraceEvent - + 652 0x7246f18 NtTranslateFilePath - + 653 0x7246f1e NtUmsThreadYield - + 654 0x7246f24 NtUnloadDriver - + 656 0x7246f30 NtUnloadKey - + 655 0x7246f2a NtUnloadKey2 - + 657 0x7246f36 NtUnloadKeyEx - + 658 0x7246f3c NtUnlockFile - + 659 0x7246f42 NtUnlockVirtualMemory - + 660 0x6f72c70 NtUnmapViewOfSection - + 661 0x7246f4e NtUnmapViewOfSectionEx - + 662 0x7246f54 NtUnsubscribeWnfStateChange - + 663 0x7246f5a NtUpdateWnfStateData - + 664 0x7246f60 NtVdmControl - + 665 0x7246f66 NtWaitForAlertByThreadId - + 666 0x7246f6c NtWaitForDebugEvent - + 667 0x7246f72 NtWaitForKeyedEvent - + 669 0x7246f7e NtWaitForMultipleObjects - + 668 0x7246f78 NtWaitForMultipleObjects32 - + 670 0x6f729f0 NtWaitForSingleObject - + 671 0x7246f8a NtWaitForWorkViaWorkerFactory - + 672 0x7246f90 NtWaitHighEventPair - + 673 0x7246f96 NtWaitLowEventPair - + 674 0x7246f9c NtWorkerFactoryWorkerReady - + 675 0x7246fa2 NtWow64AllocateVirtualMemory64 - + 676 0x7246fa8 NtWow64CallFunction64 - + 677 0x7246fae NtWow64CsrAllocateCaptureBuffer - + 678 0x7246fb4 NtWow64CsrAllocateMessagePointer - + 679 0x7246fba NtWow64CsrCaptureMessageBuffer - + 680 0x7246fc0 NtWow64CsrCaptureMessageString - + 681 0x7246fc6 NtWow64CsrClientCallServer - + 682 0x7246fcc NtWow64CsrClientConnectToServer - + 683 0x7246fd2 NtWow64CsrFreeCaptureBuffer - + 684 0x7246fd8 NtWow64CsrGetProcessId - + 685 0x7246fde NtWow64CsrIdentifyAlertableThread - + 686 0x7246fe4 NtWow64CsrVerifyRegion - + 687 0x7246fea NtWow64DebuggerCall - + 688 0x7246ff0 NtWow64GetCurrentProcessorNumberEx - + 689 0x7246ff6 NtWow64GetNativeSystemInformation - + 690 0x7246ffc NtWow64IsProcessorFeaturePresent - + 691 0x7247002 NtWow64QueryInformationProcess64 - + 692 0x7247008 NtWow64ReadVirtualMemory64 - + 693 0x724700e NtWow64WriteVirtualMemory64 - + 694 0x6f72a30 NtWriteFile - + 695 0x724701a NtWriteFileGather - + 696 0x7247020 NtWriteRequestData - + 697 0x6f72d70 NtWriteVirtualMemory - + 698 0x724702c NtYieldExecution - + 699 0x7247032 NtdllDefWindowProc_A - + 700 0x7247038 NtdllDefWindowProc_W - + 701 0x724703e NtdllDialogWndProc_A - + 702 0x7247044 NtdllDialogWndProc_W - + 703 0x724704a PfxFindPrefix - + 704 0x7247050 PfxInitialize - + 705 0x7247056 PfxInsertPrefix - + 706 0x724705c PfxRemovePrefix - + 707 0x7247062 PssNtCaptureSnapshot - + 708 0x7247068 PssNtDuplicateSnapshot - + 709 0x724706e PssNtFreeRemoteSnapshot - + 710 0x7247074 PssNtFreeSnapshot - + 711 0x724707a PssNtFreeWalkMarker - + 712 0x7247080 PssNtQuerySnapshot - + 713 0x7247086 PssNtValidateDescriptor - + 714 0x724708c PssNtWalkSnapshot - + 715 0x7247092 RtlAbortRXact - + 716 0x7247098 RtlAbsoluteToSelfRelativeSD - + 717 0x724709e RtlAcquirePebLock - + 718 0x72470a4 RtlAcquirePrivilege - + 719 0x72470aa RtlAcquireReleaseSRWLockExclusive - + 720 0x72470b0 RtlAcquireResourceExclusive - + 721 0x72470b6 RtlAcquireResourceShared - + 722 0x72470bc RtlAcquireSRWLockExclusive - + 723 0x72470c2 RtlAcquireSRWLockShared - + 724 0x72470c8 RtlActivateActivationContext - + 725 0x72470ce RtlActivateActivationContextEx - + 9 0x7246006 RtlActivateActivationContextUnsafeFast - + 726 0x72470d4 RtlAddAccessAllowedAce - + 727 0x72470da RtlAddAccessAllowedAceEx - + 728 0x72470e0 RtlAddAccessAllowedObjectAce - + 729 0x72470e6 RtlAddAccessDeniedAce - + 730 0x72470ec RtlAddAccessDeniedAceEx - + 731 0x72470f2 RtlAddAccessDeniedObjectAce - + 732 0x72470f8 RtlAddAccessFilterAce - + 733 0x72470fe RtlAddAce - + 734 0x7247104 RtlAddActionToRXact - + 735 0x724710a RtlAddAtomToAtomTable - + 736 0x7247110 RtlAddAttributeActionToRXact - + 737 0x7247116 RtlAddAuditAccessAce - + 738 0x724711c RtlAddAuditAccessAceEx - + 739 0x7247122 RtlAddAuditAccessObjectAce - + 740 0x7247128 RtlAddCompoundAce - + 741 0x724712e RtlAddIntegrityLabelToBoundaryDescriptor - + 742 0x7247134 RtlAddMandatoryAce - + 743 0x724713a RtlAddProcessTrustLabelAce - + 744 0x7247140 RtlAddRefActivationContext - + 745 0x7247146 RtlAddRefMemoryStream - + 746 0x724714c RtlAddResourceAttributeAce - + 747 0x7247152 RtlAddSIDToBoundaryDescriptor - + 748 0x7247158 RtlAddScopedPolicyIDAce - + 749 0x724715e RtlAddVectoredContinueHandler - + 750 0x7247164 RtlAddVectoredExceptionHandler - + 751 0x724716a RtlAddressInSectionTable - + 752 0x7247170 RtlAdjustPrivilege - + 753 0x7247176 RtlAllocateActivationContextStack - + 754 0x724717c RtlAllocateAndInitializeSid - + 755 0x7247182 RtlAllocateAndInitializeSidEx - + 756 0x7247188 RtlAllocateHandle - + 757 0x724718e RtlAllocateHeap - + 758 0x7247194 RtlAllocateMemoryBlockLookaside - + 759 0x724719a RtlAllocateMemoryZone - + 760 0x72471a0 RtlAllocateWnfSerializationGroup - + 761 0x72471a6 RtlAnsiCharToUnicodeChar - + 762 0x72471ac RtlAnsiStringToUnicodeSize - + 763 0x72471b2 RtlAnsiStringToUnicodeString - + 764 0x72471b8 RtlAppendAsciizToString - + 765 0x72471be RtlAppendPathElement - + 766 0x72471c4 RtlAppendStringToString - + 767 0x72471ca RtlAppendUnicodeStringToString - + 768 0x72471d0 RtlAppendUnicodeToString - + 769 0x72471d6 RtlApplicationVerifierStop - + 770 0x72471dc RtlApplyRXact - + 771 0x72471e2 RtlApplyRXactNoFlush - + 772 0x72471e8 RtlAppxIsFileOwnedByTrustedInstaller - + 773 0x72471ee RtlAreAllAccessesGranted - + 774 0x72471f4 RtlAreAnyAccessesGranted - + 775 0x72471fa RtlAreBitsClear - + 776 0x7247200 RtlAreBitsSet - + 777 0x7247206 RtlAreLongPathsEnabled - + 778 0x724720c RtlAssert - + 779 0x7247212 RtlAvlInsertNodeEx - + 780 0x7247218 RtlAvlRemoveNode - + 781 0x724721e RtlBarrier - + 782 0x7247224 RtlBarrierForDelete - + 783 0x724722a RtlCancelTimer - + 784 0x7247230 RtlCanonicalizeDomainName - + 785 0x7247236 RtlCapabilityCheck - + 786 0x724723c RtlCapabilityCheckForSingleSessionSku - + 787 0x7247242 RtlCaptureContext - + 788 0x7247248 RtlCaptureStackBackTrace - + 789 0x724724e RtlCaptureStackContext - + 790 0x7247254 RtlCharToInteger - + 791 0x724725a RtlCheckBootStatusIntegrity - + 792 0x7247260 RtlCheckForOrphanedCriticalSections - + 793 0x7247266 RtlCheckPortableOperatingSystem - + 794 0x724726c RtlCheckRegistryKey - + 795 0x7247272 RtlCheckSandboxedToken - + 796 0x7247278 RtlCheckSystemBootStatusIntegrity - + 797 0x724727e RtlCheckTokenCapability - + 798 0x7247284 RtlCheckTokenMembership - + 799 0x724728a RtlCheckTokenMembershipEx - + 800 0x7247290 RtlCleanUpTEBLangLists - + 801 0x7247296 RtlClearAllBits - + 802 0x724729c RtlClearBit - + 803 0x72472a2 RtlClearBits - + 804 0x72472a8 RtlClearThreadWorkOnBehalfTicket - + 805 0x72472ae RtlCloneMemoryStream - + 806 0x72472b4 RtlCloneUserProcess - + 807 0x72472ba RtlCmDecodeMemIoResource - + 808 0x72472c0 RtlCmEncodeMemIoResource - + 809 0x72472c6 RtlCommitDebugInfo - + 810 0x72472cc RtlCommitMemoryStream - + 811 0x72472d2 RtlCompactHeap - + 812 0x72472d8 RtlCompareAltitudes - + 813 0x72472de RtlCompareMemory - + 814 0x72472e4 RtlCompareMemoryUlong - + 815 0x72472ea RtlCompareString - + 816 0x72472f0 RtlCompareUnicodeString - + 817 0x72472f6 RtlCompareUnicodeStrings - + 818 0x72472fc RtlCompressBuffer - + 819 0x7247302 RtlComputeCrc32 - + 820 0x7247308 RtlComputeImportTableHash - + 821 0x724730e RtlComputePrivatizedDllName_U - + 822 0x7247314 RtlConnectToSm - + 823 0x724731a RtlConsoleMultiByteToUnicodeN - + 824 0x7247320 RtlConstructCrossVmEventPath - + 825 0x7247326 RtlConstructCrossVmMutexPath - + 826 0x724732c RtlContractHashTable - + 827 0x7247332 RtlConvertDeviceFamilyInfoToString - + 828 0x7247338 RtlConvertExclusiveToShared - + 829 0x724733e RtlConvertLCIDToString - + 830 0x7247344 RtlConvertLongToLargeInteger - + 831 0x724734a RtlConvertSRWLockExclusiveToShared - + 832 0x7247350 RtlConvertSharedToExclusive - + 833 0x7247356 RtlConvertSidToUnicodeString - + 834 0x724735c RtlConvertToAutoInheritSecurityObject - + 835 0x7247362 RtlConvertUlongToLargeInteger - + 836 0x7247368 RtlCopyBitMap - + 837 0x724736e RtlCopyContext - + 838 0x7247374 RtlCopyExtendedContext - + 839 0x724737a RtlCopyLuid - + 840 0x7247380 RtlCopyLuidAndAttributesArray - + 841 0x7247386 RtlCopyMappedMemory - + 842 0x724738c RtlCopyMemoryStreamTo - + 843 0x7247392 RtlCopyOutOfProcessMemoryStreamTo - + 844 0x7247398 RtlCopySecurityDescriptor - + 845 0x724739e RtlCopySid - + 846 0x72473a4 RtlCopySidAndAttributesArray - + 847 0x72473aa RtlCopyString - + 848 0x72473b0 RtlCopyUnicodeString - + 849 0x72473b6 RtlCrc32 - + 850 0x72473bc RtlCrc64 - + 851 0x72473c2 RtlCreateAcl - + 852 0x72473c8 RtlCreateActivationContext - + 853 0x72473ce RtlCreateAndSetSD - + 854 0x72473d4 RtlCreateAtomTable - + 855 0x72473da RtlCreateBootStatusDataFile - + 856 0x72473e0 RtlCreateBoundaryDescriptor - + 857 0x72473e6 RtlCreateEnvironment - + 858 0x72473ec RtlCreateEnvironmentEx - + 859 0x72473f2 RtlCreateHashTable - + 860 0x72473f8 RtlCreateHashTableEx - + 861 0x72473fe RtlCreateHeap - + 862 0x7247404 RtlCreateMemoryBlockLookaside - + 863 0x724740a RtlCreateMemoryZone - + 864 0x7247410 RtlCreateProcessParameters - + 865 0x7247416 RtlCreateProcessParametersEx - + 866 0x724741c RtlCreateProcessParametersWithTemplate - + 867 0x7247422 RtlCreateProcessReflection - + 868 0x7247428 RtlCreateQueryDebugBuffer - + 869 0x724742e RtlCreateRegistryKey - + 870 0x7247434 RtlCreateSecurityDescriptor - + 871 0x724743a RtlCreateServiceSid - + 872 0x7247440 RtlCreateSystemVolumeInformationFolder - + 873 0x7247446 RtlCreateTagHeap - + 874 0x724744c RtlCreateTimer - + 875 0x7247452 RtlCreateTimerQueue - + 876 0x7247458 RtlCreateUnicodeString - + 877 0x724745e RtlCreateUnicodeStringFromAsciiz - + 878 0x7247464 RtlCreateUserProcess - + 879 0x724746a RtlCreateUserProcessEx - + 880 0x7247470 RtlCreateUserSecurityObject - + 881 0x7247476 RtlCreateUserStack - + 882 0x724747c RtlCreateUserThread - + 883 0x7247482 RtlCreateVirtualAccountSid - + 884 0x7247488 RtlCultureNameToLCID - + 885 0x724748e RtlCustomCPToUnicodeN - + 886 0x7247494 RtlCutoverTimeToSystemTime - + 887 0x724749a RtlDeCommitDebugInfo - + 888 0x72474a0 RtlDeNormalizeProcessParams - + 889 0x72474a6 RtlDeactivateActivationContext - + 10 0x724600c RtlDeactivateActivationContextUnsafeFast - + 890 0x72474ac RtlDebugPrintTimes - + 891 0x72474b2 RtlDecodePointer - + 892 0x72474b8 RtlDecodeRemotePointer - + 893 0x72474be RtlDecodeSystemPointer - + 894 0x72474c4 RtlDecompressBuffer - + 895 0x72474ca RtlDecompressBufferEx - + 896 0x72474d0 RtlDecompressFragment - + 897 0x72474d6 RtlDefaultNpAcl - + 898 0x72474dc RtlDelete - + 899 0x72474e2 RtlDeleteAce - + 900 0x72474e8 RtlDeleteAtomFromAtomTable - + 901 0x72474ee RtlDeleteBarrier - + 902 0x72474f4 RtlDeleteBoundaryDescriptor - + 903 0x72474fa RtlDeleteCriticalSection - + 904 0x7247500 RtlDeleteElementGenericTable - + 905 0x7247506 RtlDeleteElementGenericTableAvl - + 906 0x724750c RtlDeleteElementGenericTableAvlEx - + 907 0x7247512 RtlDeleteHashTable - + 908 0x7247518 RtlDeleteNoSplay - + 909 0x724751e RtlDeleteRegistryValue - + 910 0x7247524 RtlDeleteResource - + 911 0x724752a RtlDeleteSecurityObject - + 912 0x7247530 RtlDeleteTimer - + 913 0x7247536 RtlDeleteTimerQueue - + 914 0x724753c RtlDeleteTimerQueueEx - + 915 0x7247542 RtlDeregisterSecureMemoryCacheCallback - + 916 0x7247548 RtlDeregisterWait - + 917 0x724754e RtlDeregisterWaitEx - + 918 0x7247554 RtlDeriveCapabilitySidsFromName - + 919 0x724755a RtlDestroyAtomTable - + 920 0x7247560 RtlDestroyEnvironment - + 921 0x7247566 RtlDestroyHandleTable - + 922 0x724756c RtlDestroyHeap - + 923 0x7247572 RtlDestroyMemoryBlockLookaside - + 924 0x7247578 RtlDestroyMemoryZone - + 925 0x724757e RtlDestroyProcessParameters - + 926 0x7247584 RtlDestroyQueryDebugBuffer - + 927 0x724758a RtlDetectHeapLeaks - + 928 0x7247590 RtlDetermineDosPathNameType_U - + 929 0x7247596 RtlDisableThreadProfiling - + 930 0x724759c RtlDisownModuleHeapAllocation - + 8 0x7246000 RtlDispatchAPC - + 931 0x72475a2 RtlDllShutdownInProgress - + 932 0x72475a8 RtlDnsHostNameToComputerName - + 933 0x72475ae RtlDoesFileExists_U - + 934 0x72475b4 RtlDoesNameContainWildCards - + 935 0x72475ba RtlDosApplyFileIsolationRedirection_Ustr - + 936 0x72475c0 RtlDosLongPathNameToNtPathName_U_WithStatus - + 937 0x72475c6 RtlDosLongPathNameToRelativeNtPathName_U_WithStatus - + 938 0x72475cc RtlDosPathNameToNtPathName_U - + 939 0x72475d2 RtlDosPathNameToNtPathName_U_WithStatus - + 940 0x72475d8 RtlDosPathNameToRelativeNtPathName_U - + 941 0x72475de RtlDosPathNameToRelativeNtPathName_U_WithStatus - + 942 0x72475e4 RtlDosSearchPath_U - + 943 0x72475ea RtlDosSearchPath_Ustr - + 944 0x72475f0 RtlDowncaseUnicodeChar - + 945 0x72475f6 RtlDowncaseUnicodeString - + 946 0x72475fc RtlDumpResource - + 947 0x7247602 RtlDuplicateUnicodeString - + 948 0x7247608 RtlEmptyAtomTable - + 949 0x724760e RtlEnableEarlyCriticalSectionEventCreation - + 950 0x7247614 RtlEnableThreadProfiling - + 951 0x724761a RtlEncodePointer - + 952 0x7247620 RtlEncodeRemotePointer - + 953 0x7247626 RtlEncodeSystemPointer - + 954 0x724762c RtlEndEnumerationHashTable - + 955 0x7247632 RtlEndStrongEnumerationHashTable - + 956 0x7247638 RtlEndWeakEnumerationHashTable - + 957 0x724763e RtlEnlargedIntegerMultiply - + 958 0x7247644 RtlEnlargedUnsignedMultiply - + 959 0x724764a RtlEnterCriticalSection - + 960 0x7247650 RtlEnumProcessHeaps - + 961 0x7247656 RtlEnumerateEntryHashTable - + 962 0x724765c RtlEnumerateGenericTable - + 963 0x7247662 RtlEnumerateGenericTableAvl - + 964 0x7247668 RtlEnumerateGenericTableLikeADirectory - + 965 0x724766e RtlEnumerateGenericTableWithoutSplaying - + 966 0x7247674 RtlEnumerateGenericTableWithoutSplayingAvl - + 967 0x724767a RtlEqualComputerName - + 968 0x7247680 RtlEqualDomainName - + 969 0x7247686 RtlEqualLuid - + 970 0x724768c RtlEqualPrefixSid - + 971 0x7247692 RtlEqualSid - + 972 0x7247698 RtlEqualString - + 973 0x724769e RtlEqualUnicodeString - + 974 0x72476a4 RtlEqualWnfChangeStamps - + 975 0x72476aa RtlEraseUnicodeString - + 976 0x72476b0 RtlEthernetAddressToStringA - + 977 0x72476b6 RtlEthernetAddressToStringW - + 978 0x72476bc RtlEthernetStringToAddressA - + 979 0x72476c2 RtlEthernetStringToAddressW - + 980 0x72476c8 RtlExitUserProcess - + 981 0x72476ce RtlExitUserThread - + 982 0x72476d4 RtlExpandEnvironmentStrings - + 983 0x72476da RtlExpandEnvironmentStrings_U - + 984 0x72476e0 RtlExpandHashTable - + 985 0x72476e6 RtlExtendCorrelationVector - + 986 0x72476ec RtlExtendMemoryBlockLookaside - + 987 0x72476f2 RtlExtendMemoryZone - + 988 0x72476f8 RtlExtendedIntegerMultiply - + 989 0x72476fe RtlExtendedLargeIntegerDivide - + 990 0x7247704 RtlExtendedMagicDivide - + 991 0x724770a RtlExtractBitMap - + 992 0x7247710 RtlFillMemory - + 993 0x7247716 RtlFillMemoryUlong - + 994 0x724771c RtlFillMemoryUlonglong - + 995 0x7247722 RtlFinalReleaseOutOfProcessMemoryStream - + 996 0x7247728 RtlFindAceByType - + 997 0x724772e RtlFindActivationContextSectionGuid - + 998 0x7247734 RtlFindActivationContextSectionString - + 999 0x724773a RtlFindCharInUnicodeString - + 1000 0x7247740 RtlFindClearBits - + 1001 0x7247746 RtlFindClearBitsAndSet - + 1002 0x724774c RtlFindClearRuns - + 1003 0x7247752 RtlFindClosestEncodableLength - + 1004 0x7247758 RtlFindExportedRoutineByName - + 1005 0x724775e RtlFindLastBackwardRunClear - + 1006 0x7247764 RtlFindLeastSignificantBit - + 1007 0x724776a RtlFindLongestRunClear - + 1008 0x7247770 RtlFindMessage - + 1009 0x7247776 RtlFindMostSignificantBit - + 1010 0x724777c RtlFindNextForwardRunClear - + 1011 0x7247782 RtlFindSetBits - + 1012 0x7247788 RtlFindSetBitsAndClear - + 1013 0x724778e RtlFindUnicodeSubstring - + 1014 0x7247794 RtlFirstEntrySList - + 1015 0x724779a RtlFirstFreeAce - + 1016 0x72477a0 RtlFlsAlloc - + 1017 0x72477a6 RtlFlsFree - + 1018 0x72477ac RtlFlsGetValue - + 1019 0x72477b2 RtlFlsSetValue - + 1020 0x72477b8 RtlFlushHeaps - + 1021 0x72477be RtlFlushSecureMemoryCache - + 1022 0x72477c4 RtlFormatCurrentUserKeyPath - + 1023 0x72477ca RtlFormatMessage - + 1024 0x72477d0 RtlFormatMessageEx - + 1025 0x72477d6 RtlFreeActivationContextStack - + 1026 0x72477dc RtlFreeAnsiString - + 1027 0x72477e2 RtlFreeHandle - + 1028 0x72477e8 RtlFreeHeap - + 1029 0x72477ee RtlFreeMemoryBlockLookaside - + 1030 0x72477f4 RtlFreeOemString - + 1031 0x72477fa RtlFreeSid - + 1032 0x7247800 RtlFreeThreadActivationContextStack - + 1033 0x7247806 RtlFreeUTF8String - + 1034 0x724780c RtlFreeUnicodeString - + 1035 0x7247812 RtlFreeUserStack - + 1036 0x7247818 RtlGUIDFromString - + 1037 0x724781e RtlGenerate8dot3Name - + 1038 0x7247824 RtlGetAce - + 1039 0x724782a RtlGetActiveActivationContext - + 1040 0x7247830 RtlGetActiveConsoleId - + 1041 0x7247836 RtlGetAppContainerNamedObjectPath - + 1042 0x724783c RtlGetAppContainerParent - + 1043 0x7247842 RtlGetAppContainerSidType - + 1044 0x7247848 RtlGetCallersAddress - + 1045 0x724784e RtlGetCompressionWorkSpaceSize - + 1046 0x7247854 RtlGetConsoleSessionForegroundProcessId - + 1047 0x724785a RtlGetControlSecurityDescriptor - + 1048 0x7247860 RtlGetCriticalSectionRecursionCount - + 1049 0x7247866 RtlGetCurrentDirectory_U - + 1050 0x724786c RtlGetCurrentPeb - + 1051 0x7247872 RtlGetCurrentProcessorNumber - + 1052 0x7247878 RtlGetCurrentProcessorNumberEx - + 1053 0x724787e RtlGetCurrentServiceSessionId - + 1054 0x7247884 RtlGetCurrentTransaction - + 1055 0x724788a RtlGetDaclSecurityDescriptor - + 1056 0x7247890 RtlGetDeviceFamilyInfoEnum - + 1057 0x7247896 RtlGetElementGenericTable - + 1058 0x724789c RtlGetElementGenericTableAvl - + 1059 0x72478a2 RtlGetEnabledExtendedFeatures - + 1060 0x72478a8 RtlGetExePath - + 1062 0x72478b4 RtlGetExtendedContextLength - + 1061 0x72478ae RtlGetExtendedContextLength2 - + 1063 0x72478ba RtlGetExtendedFeaturesMask - + 1064 0x72478c0 RtlGetFileMUIPath - + 1065 0x72478c6 RtlGetFrame - + 1066 0x72478cc RtlGetFullPathName_U - + 1067 0x72478d2 RtlGetFullPathName_UEx - + 1068 0x72478d8 RtlGetFullPathName_UstrEx - + 1069 0x72478de RtlGetGroupSecurityDescriptor - + 1070 0x72478e4 RtlGetIntegerAtom - + 1071 0x72478ea RtlGetInterruptTimePrecise - + 1072 0x72478f0 RtlGetLastNtStatus - + 1073 0x72478f6 RtlGetLastWin32Error - + 1074 0x72478fc RtlGetLengthWithoutLastFullDosOrNtPathElement - + 1075 0x7247902 RtlGetLengthWithoutTrailingPathSeperators - + 1076 0x7247908 RtlGetLocaleFileMappingAddress - + 1077 0x724790e RtlGetLongestNtPathLength - + 1078 0x7247914 RtlGetMultiTimePrecise - + 1079 0x724791a RtlGetNativeSystemInformation - + 1080 0x7247920 RtlGetNextEntryHashTable - + 1081 0x7247926 RtlGetNtGlobalFlags - + 1082 0x724792c RtlGetNtProductType - + 1083 0x7247932 RtlGetNtSystemRoot - + 1084 0x7247938 RtlGetNtVersionNumbers - + 1085 0x724793e RtlGetOwnerSecurityDescriptor - + 1086 0x7247944 RtlGetParentLocaleName - + 1087 0x724794a RtlGetPersistedStateLocation - + 1088 0x7247950 RtlGetProcessHeaps - + 1089 0x7247956 RtlGetProcessPreferredUILanguages - + 1090 0x724795c RtlGetProductInfo - + 1091 0x7247962 RtlGetReturnAddressHijackTarget - + 1092 0x7247968 RtlGetSaclSecurityDescriptor - + 1093 0x724796e RtlGetSearchPath - + 1094 0x7247974 RtlGetSecurityDescriptorRMControl - + 1095 0x724797a RtlGetSessionProperties - + 1096 0x7247980 RtlGetSetBootStatusData - + 1097 0x7247986 RtlGetSuiteMask - + 1098 0x724798c RtlGetSystemBootStatus - + 1099 0x7247992 RtlGetSystemBootStatusEx - + 1100 0x7247998 RtlGetSystemPreferredUILanguages - + 1101 0x724799e RtlGetSystemTimeAndBias - + 1102 0x72479a4 RtlGetSystemTimePrecise - + 1103 0x72479aa RtlGetThreadErrorMode - + 1104 0x72479b0 RtlGetThreadLangIdByIndex - + 1105 0x72479b6 RtlGetThreadPreferredUILanguages - + 1106 0x72479bc RtlGetThreadWorkOnBehalfTicket - + 1107 0x72479c2 RtlGetTokenNamedObjectPath - + 1108 0x72479c8 RtlGetUILanguageInfo - + 1109 0x72479ce RtlGetUnloadEventTrace - + 1110 0x72479d4 RtlGetUnloadEventTraceEx - + 1111 0x72479da RtlGetUserInfoHeap - + 1112 0x72479e0 RtlGetUserPreferredUILanguages - + 1113 0x72479e6 RtlGetVersion - + 1114 0x72479ec RtlGuardCheckLongJumpTarget - + 1115 0x72479f2 RtlHashUnicodeString - + 1116 0x72479f8 RtlHeapTrkInitialize - + 1117 0x72479fe RtlIdentifierAuthoritySid - + 1118 0x7247a04 RtlIdnToAscii - + 1119 0x7247a0a RtlIdnToNameprepUnicode - + 1120 0x7247a10 RtlIdnToUnicode - + 1121 0x7247a16 RtlImageDirectoryEntryToData - + 1122 0x7247a1c RtlImageNtHeader - + 1123 0x7247a22 RtlImageNtHeaderEx - + 1124 0x7247a28 RtlImageRvaToSection - + 1125 0x7247a2e RtlImageRvaToVa - + 1126 0x7247a34 RtlImpersonateSelf - + 1127 0x7247a3a RtlImpersonateSelfEx - + 1128 0x7247a40 RtlIncrementCorrelationVector - + 1129 0x7247a46 RtlInitAnsiString - + 1130 0x7247a4c RtlInitAnsiStringEx - + 1131 0x7247a52 RtlInitBarrier - + 1132 0x7247a58 RtlInitCodePageTable - + 1133 0x7247a5e RtlInitEnumerationHashTable - + 1134 0x7247a64 RtlInitMemoryStream - + 1135 0x7247a6a RtlInitNlsTables - + 1136 0x7247a70 RtlInitOutOfProcessMemoryStream - + 1137 0x7247a76 RtlInitString - + 1138 0x7247a7c RtlInitStringEx - + 1139 0x7247a82 RtlInitStrongEnumerationHashTable - + 1140 0x7247a88 RtlInitUTF8String - + 1141 0x7247a8e RtlInitUTF8StringEx - + 1142 0x7247a94 RtlInitUnicodeString - + 1143 0x7247a9a RtlInitUnicodeStringEx - + 1144 0x7247aa0 RtlInitWeakEnumerationHashTable - + 1145 0x7247aa6 RtlInitializeAtomPackage - + 1146 0x7247aac RtlInitializeBitMap - + 1147 0x7247ab2 RtlInitializeConditionVariable - + 1148 0x7247ab8 RtlInitializeContext - + 1149 0x7247abe RtlInitializeCorrelationVector - + 1150 0x7247ac4 RtlInitializeCriticalSection - + 1151 0x7247aca RtlInitializeCriticalSectionAndSpinCount - + 1152 0x7247ad0 RtlInitializeCriticalSectionEx - + 1153 0x7247ad6 RtlInitializeExceptionChain - + 1155 0x7247ae2 RtlInitializeExtendedContext - + 1154 0x7247adc RtlInitializeExtendedContext2 - + 1156 0x7247ae8 RtlInitializeGenericTable - + 1157 0x7247aee RtlInitializeGenericTableAvl - + 1158 0x7247af4 RtlInitializeHandleTable - + 1159 0x7247afa RtlInitializeNtUserPfn - + 1160 0x7247b00 RtlInitializeRXact - + 1161 0x7247b06 RtlInitializeResource - + 1162 0x7247b0c RtlInitializeSListHead - + 1163 0x7247b12 RtlInitializeSRWLock - + 1164 0x7247b18 RtlInitializeSid - + 1165 0x7247b1e RtlInitializeSidEx - + 1166 0x7247b24 RtlInsertElementGenericTable - + 1167 0x7247b2a RtlInsertElementGenericTableAvl - + 1168 0x7247b30 RtlInsertElementGenericTableFull - + 1169 0x7247b36 RtlInsertElementGenericTableFullAvl - + 1170 0x7247b3c RtlInsertEntryHashTable - + 1171 0x7247b42 RtlInt64ToUnicodeString - + 1172 0x7247b48 RtlIntegerToChar - + 1173 0x7247b4e RtlIntegerToUnicodeString - + 1174 0x7247b54 RtlInterlockedClearBitRun - + 1175 0x7247b5a RtlInterlockedCompareExchange64 - + 1176 0x7247b60 RtlInterlockedFlushSList - + 1177 0x7247b66 RtlInterlockedPopEntrySList - + 1178 0x7247b6c RtlInterlockedPushEntrySList - + 11 0x7246012 RtlInterlockedPushListSList - + 1179 0x7247b72 RtlInterlockedPushListSListEx - + 1180 0x7247b78 RtlInterlockedSetBitRun - + 1181 0x7247b7e RtlIoDecodeMemIoResource - + 1182 0x7247b84 RtlIoEncodeMemIoResource - + 1183 0x7247b8a RtlIpv4AddressToStringA - + 1184 0x7247b90 RtlIpv4AddressToStringExA - + 1185 0x7247b96 RtlIpv4AddressToStringExW - + 1186 0x7247b9c RtlIpv4AddressToStringW - + 1187 0x7247ba2 RtlIpv4StringToAddressA - + 1188 0x7247ba8 RtlIpv4StringToAddressExA - + 1189 0x7247bae RtlIpv4StringToAddressExW - + 1190 0x7247bb4 RtlIpv4StringToAddressW - + 1191 0x7247bba RtlIpv6AddressToStringA - + 1192 0x7247bc0 RtlIpv6AddressToStringExA - + 1193 0x7247bc6 RtlIpv6AddressToStringExW - + 1194 0x7247bcc RtlIpv6AddressToStringW - + 1195 0x7247bd2 RtlIpv6StringToAddressA - + 1196 0x7247bd8 RtlIpv6StringToAddressExA - + 1197 0x7247bde RtlIpv6StringToAddressExW - + 1198 0x7247be4 RtlIpv6StringToAddressW - + 1199 0x7247bea RtlIsActivationContextActive - + 1200 0x7247bf0 RtlIsCapabilitySid - + 1201 0x7247bf6 RtlIsCloudFilesPlaceholder - + 1202 0x7247bfc RtlIsCriticalSectionLocked - + 1203 0x7247c02 RtlIsCriticalSectionLockedByThread - + 1204 0x7247c08 RtlIsCurrentProcess - + 1205 0x7247c0e RtlIsCurrentThread - + 1206 0x7247c14 RtlIsCurrentThreadAttachExempt - + 1207 0x7247c1a RtlIsDosDeviceName_U - + 1208 0x7247c20 RtlIsElevatedRid - + 1209 0x7247c26 RtlIsGenericTableEmpty - + 1210 0x7247c2c RtlIsGenericTableEmptyAvl - + 1211 0x7247c32 RtlIsMultiSessionSku - + 1212 0x7247c38 RtlIsMultiUsersInSessionSku - + 1213 0x7247c3e RtlIsNameInExpression - + 1214 0x7247c44 RtlIsNameInUnUpcasedExpression - + 1215 0x7247c4a RtlIsNameLegalDOS8Dot3 - + 1216 0x7247c50 RtlIsNonEmptyDirectoryReparsePointAllowed - + 1217 0x7247c56 RtlIsNormalizedString - + 1218 0x7247c5c RtlIsPackageSid - + 1219 0x7247c62 RtlIsParentOfChildAppContainer - + 1220 0x7247c68 RtlIsPartialPlaceholder - + 1221 0x7247c6e RtlIsPartialPlaceholderFileHandle - + 1222 0x7247c74 RtlIsPartialPlaceholderFileInfo - + 1223 0x7247c7a RtlIsProcessorFeaturePresent - + 1224 0x7247c80 RtlIsStateSeparationEnabled - + 1225 0x7247c86 RtlIsTextUnicode - + 1226 0x7247c8c RtlIsThreadWithinLoaderCallout - + 1227 0x7247c92 RtlIsUntrustedObject - + 1228 0x7247c98 RtlIsValidHandle - + 1229 0x7247c9e RtlIsValidIndexHandle - + 1230 0x7247ca4 RtlIsValidLocaleName - + 1231 0x7247caa RtlIsValidProcessTrustLabelSid - + 1232 0x7247cb0 RtlIsZeroMemory - + 1233 0x7247cb6 RtlKnownExceptionFilter - + 1234 0x7247cbc RtlLCIDToCultureName - + 1235 0x7247cc2 RtlLargeIntegerAdd - + 1236 0x7247cc8 RtlLargeIntegerArithmeticShift - + 1237 0x7247cce RtlLargeIntegerDivide - + 1238 0x7247cd4 RtlLargeIntegerNegate - + 1239 0x7247cda RtlLargeIntegerShiftLeft - + 1240 0x7247ce0 RtlLargeIntegerShiftRight - + 1241 0x7247ce6 RtlLargeIntegerSubtract - + 1242 0x7247cec RtlLargeIntegerToChar - + 1243 0x7247cf2 RtlLcidToLocaleName - + 1244 0x7247cf8 RtlLeaveCriticalSection - + 1245 0x7247cfe RtlLengthRequiredSid - + 1246 0x7247d04 RtlLengthSecurityDescriptor - + 1247 0x7247d0a RtlLengthSid - + 1248 0x7247d10 RtlLengthSidAsUnicodeString - + 1249 0x7247d16 RtlLoadString - + 1250 0x7247d1c RtlLocalTimeToSystemTime - + 1251 0x7247d22 RtlLocaleNameToLcid - + 1253 0x7247d2e RtlLocateExtendedFeature - + 1252 0x7247d28 RtlLocateExtendedFeature2 - + 1254 0x7247d34 RtlLocateLegacyContext - + 1255 0x7247d3a RtlLockBootStatusData - + 1256 0x7247d40 RtlLockCurrentThread - + 1257 0x7247d46 RtlLockHeap - + 1258 0x7247d4c RtlLockMemoryBlockLookaside - + 1259 0x7247d52 RtlLockMemoryStreamRegion - + 1260 0x7247d58 RtlLockMemoryZone - + 1261 0x7247d5e RtlLockModuleSection - + 1262 0x7247d64 RtlLogStackBackTrace - + 1263 0x7247d6a RtlLookupAtomInAtomTable - + 1264 0x7247d70 RtlLookupElementGenericTable - + 1265 0x7247d76 RtlLookupElementGenericTableAvl - + 1266 0x7247d7c RtlLookupElementGenericTableFull - + 1267 0x7247d82 RtlLookupElementGenericTableFullAvl - + 1268 0x7247d88 RtlLookupEntryHashTable - + 1269 0x7247d8e RtlLookupFirstMatchingElementGenericTableAvl - + 1270 0x7247d94 RtlMakeSelfRelativeSD - + 1271 0x7247d9a RtlMapGenericMask - + 1272 0x7247da0 RtlMapSecurityErrorToNtStatus - + 1273 0x7247da6 RtlMoveMemory - + 1274 0x7247dac RtlMultiAppendUnicodeStringBuffer - + 1275 0x7247db2 RtlMultiByteToUnicodeN - + 1276 0x7247db8 RtlMultiByteToUnicodeSize - + 1277 0x7247dbe RtlMultipleAllocateHeap - + 1278 0x7247dc4 RtlMultipleFreeHeap - + 1279 0x7247dca RtlNewInstanceSecurityObject - + 1280 0x7247dd0 RtlNewSecurityGrantedAccess - + 1281 0x7247dd6 RtlNewSecurityObject - + 1282 0x7247ddc RtlNewSecurityObjectEx - + 1283 0x7247de2 RtlNewSecurityObjectWithMultipleInheritance - + 1284 0x7247de8 RtlNormalizeProcessParams - + 1285 0x7247dee RtlNormalizeSecurityDescriptor - + 1286 0x7247df4 RtlNormalizeString - + 1287 0x7247dfa RtlNotifyFeatureUsage - + 1288 0x7247e00 RtlNtPathNameToDosPathName - + 1289 0x7247e06 RtlNtStatusToDosError - + 1290 0x7247e0c RtlNtStatusToDosErrorNoTeb - + 1291 0x7247e12 RtlNumberGenericTableElements - + 1292 0x7247e18 RtlNumberGenericTableElementsAvl - + 1293 0x7247e1e RtlNumberOfClearBits - + 1294 0x7247e24 RtlNumberOfClearBitsInRange - + 1295 0x7247e2a RtlNumberOfSetBits - + 1296 0x7247e30 RtlNumberOfSetBitsInRange - + 1297 0x7247e36 RtlNumberOfSetBitsUlongPtr - + 1298 0x7247e3c RtlOemStringToUnicodeSize - + 1299 0x7247e42 RtlOemStringToUnicodeString - + 1300 0x7247e48 RtlOemToUnicodeN - + 1301 0x7247e4e RtlOpenCurrentUser - + 1302 0x7247e54 RtlOsDeploymentState - + 1303 0x7247e5a RtlOwnerAcesPresent - + 1304 0x7247e60 RtlPcToFileHeader - + 1305 0x7247e66 RtlPinAtomInAtomTable - + 1306 0x7247e6c RtlPopFrame - + 1307 0x7247e72 RtlPrefixString - + 1308 0x7247e78 RtlPrefixUnicodeString - + 1309 0x7247e7e RtlProcessFlsData - + 1310 0x7247e84 RtlProtectHeap - + 1311 0x7247e8a RtlPublishWnfStateData - + 1312 0x7247e90 RtlPushFrame - + 1313 0x7247e96 RtlQueryActivationContextApplicationSettings - + 1314 0x7247e9c RtlQueryAllFeatureConfigurations - + 1315 0x7247ea2 RtlQueryAtomInAtomTable - + 1316 0x7247ea8 RtlQueryCriticalSectionOwner - + 1317 0x7247eae RtlQueryDepthSList - + 1318 0x7247eb4 RtlQueryDynamicTimeZoneInformation - + 1319 0x7247eba RtlQueryElevationFlags - + 1320 0x7247ec0 RtlQueryEnvironmentVariable - + 1321 0x7247ec6 RtlQueryEnvironmentVariable_U - + 1322 0x7247ecc RtlQueryFeatureConfiguration - + 1323 0x7247ed2 RtlQueryFeatureConfigurationChangeStamp - + 1324 0x7247ed8 RtlQueryFeatureUsageNotificationSubscriptions - + 1325 0x7247ede RtlQueryHeapInformation - + 1326 0x7247ee4 RtlQueryImageMitigationPolicy - + 1327 0x7247eea RtlQueryInformationAcl - + 1328 0x7247ef0 RtlQueryInformationActivationContext - + 1329 0x7247ef6 RtlQueryInformationActiveActivationContext - + 1330 0x7247efc RtlQueryInterfaceMemoryStream - + 1331 0x7247f02 RtlQueryModuleInformation - + 1332 0x7247f08 RtlQueryPackageClaims - + 1333 0x7247f0e RtlQueryPackageIdentity - + 1334 0x7247f14 RtlQueryPackageIdentityEx - + 1335 0x7247f1a RtlQueryPerformanceCounter - + 1336 0x7247f20 RtlQueryPerformanceFrequency - + 1337 0x7247f26 RtlQueryProcessBackTraceInformation - + 1338 0x7247f2c RtlQueryProcessDebugInformation - + 1339 0x7247f32 RtlQueryProcessHeapInformation - + 1340 0x7247f38 RtlQueryProcessLockInformation - + 1341 0x7247f3e RtlQueryProcessPlaceholderCompatibilityMode - + 1342 0x7247f44 RtlQueryProtectedPolicy - + 1343 0x7247f4a RtlQueryRegistryValueWithFallback - + 1344 0x7247f50 RtlQueryRegistryValues - + 1345 0x7247f56 RtlQueryRegistryValuesEx - + 1346 0x7247f5c RtlQueryResourcePolicy - + 1347 0x7247f62 RtlQuerySecurityObject - + 1348 0x7247f68 RtlQueryTagHeap - + 1349 0x7247f6e RtlQueryThreadPlaceholderCompatibilityMode - + 1350 0x7247f74 RtlQueryThreadProfiling - + 1351 0x7247f7a RtlQueryTimeZoneInformation - + 1352 0x7247f80 RtlQueryTokenHostIdAsUlong64 - + 1353 0x7247f86 RtlQueryUnbiasedInterruptTime - + 1354 0x7247f8c RtlQueryValidationRunlevel - + 1355 0x7247f92 RtlQueryWnfMetaNotification - + 1356 0x7247f98 RtlQueryWnfStateData - + 1357 0x7247f9e RtlQueryWnfStateDataWithExplicitScope - + 1358 0x7247fa4 RtlQueueApcWow64Thread - + 1359 0x7247faa RtlQueueWorkItem - + 1360 0x7247fb0 RtlRaiseCustomSystemEventTrigger - + 1361 0x7247fb6 RtlRaiseException - + 1362 0x7247fbc RtlRaiseStatus - + 1363 0x7247fc2 RtlRandom - + 1364 0x7247fc8 RtlRandomEx - + 1365 0x7247fce RtlRbInsertNodeEx - + 1366 0x7247fd4 RtlRbRemoveNode - + 1367 0x7247fda RtlReAllocateHeap - + 1368 0x7247fe0 RtlReadMemoryStream - + 1369 0x7247fe6 RtlReadOutOfProcessMemoryStream - + 1370 0x7247fec RtlReadThreadProfilingData - + 1371 0x7247ff2 RtlRealPredecessor - + 1372 0x7247ff8 RtlRealSuccessor - + 1373 0x7247ffe RtlRegisterFeatureConfigurationChangeNotification - + 1374 0x7248004 RtlRegisterForWnfMetaNotification - + 1375 0x724800a RtlRegisterSecureMemoryCacheCallback - + 1376 0x7248010 RtlRegisterThreadWithCsrss - + 1377 0x7248016 RtlRegisterWait - + 1378 0x724801c RtlReleaseActivationContext - + 1379 0x7248022 RtlReleaseMemoryStream - + 1380 0x7248028 RtlReleasePath - + 1381 0x724802e RtlReleasePebLock - + 1382 0x7248034 RtlReleasePrivilege - + 1383 0x724803a RtlReleaseRelativeName - + 1384 0x7248040 RtlReleaseResource - + 1385 0x7248046 RtlReleaseSRWLockExclusive - + 1386 0x724804c RtlReleaseSRWLockShared - + 1387 0x7248052 RtlRemoteCall - + 1388 0x7248058 RtlRemoveEntryHashTable - + 1389 0x724805e RtlRemovePrivileges - + 1390 0x7248064 RtlRemoveVectoredContinueHandler - + 1391 0x724806a RtlRemoveVectoredExceptionHandler - + 1392 0x7248070 RtlReplaceSidInSd - + 1393 0x7248076 RtlReplaceSystemDirectoryInPath - + 1394 0x724807c RtlReportException - + 1395 0x7248082 RtlReportExceptionEx - + 1396 0x7248088 RtlReportSilentProcessExit - + 1397 0x724808e RtlReportSqmEscalation - + 1398 0x7248094 RtlResetMemoryBlockLookaside - + 1399 0x724809a RtlResetMemoryZone - + 1400 0x72480a0 RtlResetNtUserPfn - + 1401 0x72480a6 RtlResetRtlTranslations - + 1402 0x72480ac RtlRestoreBootStatusDefaults - + 1403 0x72480b2 RtlRestoreLastWin32Error - + 1404 0x72480b8 RtlRestoreSystemBootStatusDefaults - + 1405 0x72480be RtlRestoreThreadPreferredUILanguages - + 1406 0x72480c4 RtlRetrieveNtUserPfn - + 1407 0x72480ca RtlRevertMemoryStream - + 1408 0x72480d0 RtlRunDecodeUnicodeString - + 1409 0x72480d6 RtlRunEncodeUnicodeString - + 1410 0x72480dc RtlRunOnceBeginInitialize - + 1411 0x72480e2 RtlRunOnceComplete - + 1412 0x72480e8 RtlRunOnceExecuteOnce - + 1413 0x72480ee RtlRunOnceInitialize - + 1414 0x72480f4 RtlSecondsSince1970ToTime - + 1415 0x72480fa RtlSecondsSince1980ToTime - + 1416 0x7248100 RtlSeekMemoryStream - + 1418 0x724810c RtlSelfRelativeToAbsoluteSD - + 1417 0x7248106 RtlSelfRelativeToAbsoluteSD2 - + 1419 0x7248112 RtlSendMsgToSm - + 1420 0x7248118 RtlSetAllBits - + 1421 0x724811e RtlSetAttributesSecurityDescriptor - + 1422 0x7248124 RtlSetBit - + 1423 0x724812a RtlSetBits - + 1424 0x7248130 RtlSetControlSecurityDescriptor - + 1425 0x7248136 RtlSetCriticalSectionSpinCount - + 1426 0x724813c RtlSetCurrentDirectory_U - + 1427 0x7248142 RtlSetCurrentEnvironment - + 1428 0x7248148 RtlSetCurrentTransaction - + 1429 0x724814e RtlSetDaclSecurityDescriptor - + 1430 0x7248154 RtlSetDynamicTimeZoneInformation - + 1431 0x724815a RtlSetEnvironmentStrings - + 1432 0x7248160 RtlSetEnvironmentVar - + 1433 0x7248166 RtlSetEnvironmentVariable - + 1434 0x724816c RtlSetExtendedFeaturesMask - + 1435 0x7248172 RtlSetFeatureConfigurations - + 1436 0x7248178 RtlSetGroupSecurityDescriptor - + 1437 0x724817e RtlSetHeapInformation - + 1438 0x7248184 RtlSetImageMitigationPolicy - + 1439 0x724818a RtlSetInformationAcl - + 1440 0x7248190 RtlSetIoCompletionCallback - + 1441 0x7248196 RtlSetLastWin32Error - + 1442 0x724819c RtlSetLastWin32ErrorAndNtStatusFromNtStatus - + 1443 0x72481a2 RtlSetMemoryStreamSize - + 1444 0x72481a8 RtlSetOwnerSecurityDescriptor - + 1445 0x72481ae RtlSetPortableOperatingSystem - + 1446 0x72481b4 RtlSetProcessDebugInformation - + 1447 0x72481ba RtlSetProcessIsCritical - + 1448 0x72481c0 RtlSetProcessPlaceholderCompatibilityMode - + 1449 0x72481c6 RtlSetProcessPreferredUILanguages - + 1450 0x72481cc RtlSetProtectedPolicy - + 1451 0x72481d2 RtlSetProxiedProcessId - + 1452 0x72481d8 RtlSetSaclSecurityDescriptor - + 1453 0x72481de RtlSetSearchPathMode - + 1454 0x72481e4 RtlSetSecurityDescriptorRMControl - + 1455 0x72481ea RtlSetSecurityObject - + 1456 0x72481f0 RtlSetSecurityObjectEx - + 1457 0x72481f6 RtlSetSystemBootStatus - + 1458 0x72481fc RtlSetSystemBootStatusEx - + 1459 0x7248202 RtlSetThreadErrorMode - + 1460 0x7248208 RtlSetThreadIsCritical - + 1461 0x724820e RtlSetThreadPlaceholderCompatibilityMode - + 1462 0x7248214 RtlSetThreadPoolStartFunc - + 1464 0x7248220 RtlSetThreadPreferredUILanguages - + 1463 0x724821a RtlSetThreadPreferredUILanguages2 - + 1465 0x7248226 RtlSetThreadSubProcessTag - + 1466 0x724822c RtlSetThreadWorkOnBehalfTicket - + 1467 0x7248232 RtlSetTimeZoneInformation - + 1468 0x7248238 RtlSetTimer - + 1469 0x724823e RtlSetUnhandledExceptionFilter - + 1470 0x7248244 RtlSetUserCallbackExceptionFilter - + 1471 0x724824a RtlSetUserFlagsHeap - + 1472 0x7248250 RtlSetUserValueHeap - + 1473 0x7248256 RtlSidDominates - + 1474 0x724825c RtlSidDominatesForTrust - + 1475 0x7248262 RtlSidEqualLevel - + 1476 0x7248268 RtlSidHashInitialize - + 1477 0x724826e RtlSidHashLookup - + 1478 0x7248274 RtlSidIsHigherLevel - + 1479 0x724827a RtlSizeHeap - + 1480 0x7248280 RtlSleepConditionVariableCS - + 1481 0x7248286 RtlSleepConditionVariableSRW - + 1482 0x724828c RtlSplay - + 1483 0x7248292 RtlStartRXact - + 1484 0x7248298 RtlStatMemoryStream - + 1485 0x724829e RtlStringFromGUID - + 1486 0x72482a4 RtlStringFromGUIDEx - + 1487 0x72482aa RtlStronglyEnumerateEntryHashTable - + 1488 0x72482b0 RtlSubAuthorityCountSid - + 1489 0x72482b6 RtlSubAuthoritySid - + 1490 0x72482bc RtlSubscribeForFeatureUsageNotification - + 1491 0x72482c2 RtlSubscribeWnfStateChangeNotification - + 1492 0x72482c8 RtlSubtreePredecessor - + 1493 0x72482ce RtlSubtreeSuccessor - + 1494 0x72482d4 RtlSwitchedVVI - + 1495 0x72482da RtlSystemTimeToLocalTime - + 1496 0x72482e0 RtlTestAndPublishWnfStateData - + 1497 0x72482e6 RtlTestBit - + 1498 0x72482ec RtlTestProtectedAccess - + 1499 0x72482f2 RtlTimeFieldsToTime - + 1500 0x72482f8 RtlTimeToElapsedTimeFields - + 1501 0x72482fe RtlTimeToSecondsSince1970 - + 1502 0x7248304 RtlTimeToSecondsSince1980 - + 1503 0x724830a RtlTimeToTimeFields - + 1504 0x7248310 RtlTraceDatabaseAdd - + 1505 0x7248316 RtlTraceDatabaseCreate - + 1506 0x724831c RtlTraceDatabaseDestroy - + 1507 0x7248322 RtlTraceDatabaseEnumerate - + 1508 0x7248328 RtlTraceDatabaseFind - + 1509 0x724832e RtlTraceDatabaseLock - + 1510 0x7248334 RtlTraceDatabaseUnlock - + 1511 0x724833a RtlTraceDatabaseValidate - + 1512 0x7248340 RtlTryAcquirePebLock - + 1513 0x7248346 RtlTryAcquireSRWLockExclusive - + 1514 0x724834c RtlTryAcquireSRWLockShared - + 1515 0x7248352 RtlTryConvertSRWLockSharedToExclusiveOrRelease - + 1516 0x7248358 RtlTryEnterCriticalSection - + 1517 0x724835e RtlUTF8StringToUnicodeString - + 1518 0x7248364 RtlUTF8ToUnicodeN - + 1519 0x724836a RtlUdiv128 - + 12 0x7246018 RtlUlongByteSwap - + 13 0x724601e RtlUlonglongByteSwap - + 1521 0x7248376 RtlUnhandledExceptionFilter - + 1520 0x7248370 RtlUnhandledExceptionFilter2 - + 1522 0x724837c RtlUnicodeStringToAnsiSize - + 1523 0x7248382 RtlUnicodeStringToAnsiString - + 1524 0x7248388 RtlUnicodeStringToCountedOemString - + 1525 0x724838e RtlUnicodeStringToInteger - + 1526 0x7248394 RtlUnicodeStringToOemSize - + 1527 0x724839a RtlUnicodeStringToOemString - + 1528 0x72483a0 RtlUnicodeStringToUTF8String - + 1529 0x72483a6 RtlUnicodeToCustomCPN - + 1530 0x72483ac RtlUnicodeToMultiByteN - + 1531 0x72483b2 RtlUnicodeToMultiByteSize - + 1532 0x72483b8 RtlUnicodeToOemN - + 1533 0x72483be RtlUnicodeToUTF8N - + 1534 0x72483c4 RtlUniform - + 1535 0x72483ca RtlUnlockBootStatusData - + 1536 0x72483d0 RtlUnlockCurrentThread - + 1537 0x72483d6 RtlUnlockHeap - + 1538 0x72483dc RtlUnlockMemoryBlockLookaside - + 1539 0x72483e2 RtlUnlockMemoryStreamRegion - + 1540 0x72483e8 RtlUnlockMemoryZone - + 1541 0x72483ee RtlUnlockModuleSection - + 1542 0x72483f4 RtlUnregisterFeatureConfigurationChangeNotification - + 1543 0x72483fa RtlUnsubscribeFromFeatureUsageNotifications - + 1544 0x7248400 RtlUnsubscribeWnfNotificationWaitForCompletion - + 1545 0x7248406 RtlUnsubscribeWnfNotificationWithCompletionCallback - + 1546 0x724840c RtlUnsubscribeWnfStateChangeNotification - + 1547 0x7248412 RtlUnwind - + 1548 0x7248418 RtlUpcaseUnicodeChar - + 1549 0x724841e RtlUpcaseUnicodeString - + 1550 0x7248424 RtlUpcaseUnicodeStringToAnsiString - + 1551 0x724842a RtlUpcaseUnicodeStringToCountedOemString - + 1552 0x7248430 RtlUpcaseUnicodeStringToOemString - + 1553 0x7248436 RtlUpcaseUnicodeToCustomCPN - + 1554 0x724843c RtlUpcaseUnicodeToMultiByteN - + 1555 0x7248442 RtlUpcaseUnicodeToOemN - + 1556 0x7248448 RtlUpdateClonedCriticalSection - + 1557 0x724844e RtlUpdateClonedSRWLock - + 1558 0x7248454 RtlUpdateTimer - + 1559 0x724845a RtlUpperChar - + 1560 0x7248460 RtlUpperString - + 1561 0x7248466 RtlUserFiberStart - + 1562 0x724846c RtlUserThreadStart - + 14 0x7246024 RtlUshortByteSwap - + 1563 0x7248472 RtlValidAcl - + 1564 0x7248478 RtlValidProcessProtection - + 1565 0x724847e RtlValidRelativeSecurityDescriptor - + 1566 0x7248484 RtlValidSecurityDescriptor - + 1567 0x724848a RtlValidSid - + 1568 0x7248490 RtlValidateCorrelationVector - + 1569 0x7248496 RtlValidateHeap - + 1570 0x724849c RtlValidateProcessHeaps - + 1571 0x72484a2 RtlValidateUnicodeString - + 1572 0x72484a8 RtlVerifyVersionInfo - + 1573 0x72484ae RtlWaitForWnfMetaNotification - + 1574 0x72484b4 RtlWaitOnAddress - + 1575 0x72484ba RtlWakeAddressAll - + 1576 0x72484c0 RtlWakeAddressAllNoFence - + 1577 0x72484c6 RtlWakeAddressSingle - + 1578 0x72484cc RtlWakeAddressSingleNoFence - + 1579 0x72484d2 RtlWakeAllConditionVariable - + 1580 0x72484d8 RtlWakeConditionVariable - + 1581 0x72484de RtlWalkFrameChain - + 1582 0x72484e4 RtlWalkHeap - + 1583 0x72484ea RtlWeaklyEnumerateEntryHashTable - + 1584 0x72484f0 RtlWerpReportException - + 1585 0x72484f6 RtlWnfCompareChangeStamp - + 1586 0x72484fc RtlWnfDllUnloadCallback - + 1587 0x7248502 RtlWow64CallFunction64 - + 1588 0x7248508 RtlWow64EnableFsRedirection - + 1589 0x724850e RtlWow64EnableFsRedirectionEx - + 1590 0x7248514 RtlWow64GetCurrentMachine - + 1591 0x724851a RtlWow64GetEquivalentMachineCHPE - + 1592 0x7248520 RtlWow64GetProcessMachines - + 1593 0x7248526 RtlWow64GetSharedInfoProcess - + 1594 0x724852c RtlWow64IsWowGuestMachineSupported - + 1595 0x7248532 RtlWow64LogMessageInEventLogger - + 1596 0x7248538 RtlWriteMemoryStream - + 1597 0x724853e RtlWriteRegistryValue - + 1598 0x7248544 RtlZeroHeap - + 1599 0x724854a RtlZeroMemory - + 1600 0x7248550 RtlZombifyActivationContext - + 1601 0x7248556 RtlpApplyLengthFunction - + 1602 0x724855c RtlpCheckDynamicTimeZoneInformation - + 1603 0x7248562 RtlpCleanupRegistryKeys - + 1604 0x7248568 RtlpConvertAbsoluteToRelativeSecurityAttribute - + 1605 0x724856e RtlpConvertCultureNamesToLCIDs - + 1606 0x7248574 RtlpConvertLCIDsToCultureNames - + 1607 0x724857a RtlpConvertRelativeToAbsoluteSecurityAttribute - + 1608 0x7248580 RtlpCreateProcessRegistryInfo - + 1609 0x7248586 RtlpEnsureBufferSize - + 1610 0x724858c RtlpFreezeTimeBias - + 1611 0x7248592 RtlpGetDeviceFamilyInfoEnum - + 1612 0x7248598 RtlpGetLCIDFromLangInfoNode - + 1613 0x724859e RtlpGetNameFromLangInfoNode - + 1614 0x72485a4 RtlpGetSystemDefaultUILanguage - + 1615 0x72485aa RtlpGetUserOrMachineUILanguage4NLS - + 1616 0x72485b0 RtlpInitializeLangRegistryInfo - + 1617 0x72485b6 RtlpIsQualifiedLanguage - + 1618 0x72485bc RtlpLoadMachineUIByPolicy - + 1619 0x72485c2 RtlpLoadUserUIByPolicy - + 1620 0x72485c8 RtlpMergeSecurityAttributeInformation - + 1621 0x72485ce RtlpMuiFreeLangRegistryInfo - + 1622 0x72485d4 RtlpMuiRegCreateRegistryInfo - + 1623 0x72485da RtlpMuiRegFreeRegistryInfo - + 1624 0x72485e0 RtlpMuiRegLoadRegistryInfo - + 1625 0x72485e6 RtlpNotOwnerCriticalSection - + 1626 0x72485ec RtlpNtCreateKey - + 1627 0x72485f2 RtlpNtEnumerateSubKey - + 1628 0x72485f8 RtlpNtMakeTemporaryKey - + 1629 0x72485fe RtlpNtOpenKey - + 1630 0x7248604 RtlpNtQueryValueKey - + 1631 0x724860a RtlpNtSetValueKey - + 1632 0x7248610 RtlpQueryDefaultUILanguage - + 1633 0x7248616 RtlpQueryProcessDebugInformationRemote - + 1634 0x724861c RtlpRefreshCachedUILanguage - + 1635 0x7248622 RtlpSetInstallLanguage - + 1636 0x7248628 RtlpSetPreferredUILanguages - + 1637 0x724862e RtlpSetUserPreferredUILanguages - + 1638 0x7248634 RtlpTimeFieldsToTime - + 1639 0x724863a RtlpTimeToTimeFields - + 1640 0x7248640 RtlpUnWaitCriticalSection - + 1641 0x7248646 RtlpVerifyAndCommitUILanguageSettings - + 1642 0x724864c RtlpWaitForCriticalSection - + 1643 0x7248652 RtlxAnsiStringToUnicodeSize - + 1644 0x7248658 RtlxOemStringToUnicodeSize - + 1645 0x724865e RtlxUnicodeStringToAnsiSize - + 1646 0x7248664 RtlxUnicodeStringToOemSize - + 1647 0x724866a SbExecuteProcedure - + 1648 0x7248670 SbSelectProcedure - + 1649 0x7248676 ShipAssert - + 1650 0x724867c ShipAssertGetBufferInfo - + 1651 0x7248682 ShipAssertMsgA - + 1652 0x7248688 ShipAssertMsgW - + 1653 0x724868e TpAllocAlpcCompletion - + 1654 0x7248694 TpAllocAlpcCompletionEx - + 1655 0x724869a TpAllocCleanupGroup - + 1656 0x72486a0 TpAllocIoCompletion - + 1657 0x72486a6 TpAllocJobNotification - + 1658 0x72486ac TpAllocPool - + 1659 0x72486b2 TpAllocTimer - + 1660 0x72486b8 TpAllocWait - + 1661 0x72486be TpAllocWork - + 1662 0x72486c4 TpAlpcRegisterCompletionList - + 1663 0x72486ca TpAlpcUnregisterCompletionList - + 1664 0x72486d0 TpCallbackDetectedUnrecoverableError - + 1665 0x72486d6 TpCallbackIndependent - + 1666 0x72486dc TpCallbackLeaveCriticalSectionOnCompletion - + 1667 0x72486e2 TpCallbackMayRunLong - + 1668 0x72486e8 TpCallbackReleaseMutexOnCompletion - + 1669 0x72486ee TpCallbackReleaseSemaphoreOnCompletion - + 1670 0x72486f4 TpCallbackSendAlpcMessageOnCompletion - + 1671 0x72486fa TpCallbackSendPendingAlpcMessage - + 1672 0x7248700 TpCallbackSetEventOnCompletion - + 1673 0x7248706 TpCallbackUnloadDllOnCompletion - + 1674 0x724870c TpCancelAsyncIoOperation - + 1675 0x7248712 TpCaptureCaller - + 1676 0x7248718 TpCheckTerminateWorker - + 1677 0x724871e TpDbgDumpHeapUsage - + 1678 0x7248724 TpDbgSetLogRoutine - + 1679 0x724872a TpDisablePoolCallbackChecks - + 1680 0x7248730 TpDisassociateCallback - + 1681 0x7248736 TpIsTimerSet - + 1682 0x724873c TpPostWork - + 1683 0x7248742 TpQueryPoolStackInformation - + 1684 0x7248748 TpReleaseAlpcCompletion - + 1685 0x724874e TpReleaseCleanupGroup - + 1686 0x7248754 TpReleaseCleanupGroupMembers - + 1687 0x724875a TpReleaseIoCompletion - + 1688 0x7248760 TpReleaseJobNotification - + 1689 0x7248766 TpReleasePool - + 1690 0x724876c TpReleaseTimer - + 1691 0x7248772 TpReleaseWait - + 1692 0x7248778 TpReleaseWork - + 1693 0x724877e TpSetDefaultPoolMaxThreads - + 1694 0x7248784 TpSetDefaultPoolStackInformation - + 1695 0x724878a TpSetPoolMaxThreads - + 1696 0x7248790 TpSetPoolMaxThreadsSoftLimit - + 1697 0x7248796 TpSetPoolMinThreads - + 1698 0x724879c TpSetPoolStackInformation - + 1699 0x72487a2 TpSetPoolThreadBasePriority - + 1700 0x72487a8 TpSetPoolThreadCpuSets - + 1701 0x72487ae TpSetPoolWorkerThreadIdleTimeout - + 1702 0x72487b4 TpSetTimer - + 1703 0x72487ba TpSetTimerEx - + 1704 0x72487c0 TpSetWait - + 1705 0x72487c6 TpSetWaitEx - + 1706 0x72487cc TpSimpleTryPost - + 1707 0x72487d2 TpStartAsyncIoOperation - + 1708 0x72487d8 TpTimerOutstandingCallbackCount - + 1709 0x72487de TpTrimPools - + 1710 0x72487e4 TpWaitForAlpcCompletion - + 1711 0x72487ea TpWaitForIoCompletion - + 1712 0x72487f0 TpWaitForJobNotification - + 1713 0x72487f6 TpWaitForTimer - + 1714 0x72487fc TpWaitForWait - + 1715 0x7248802 TpWaitForWork - + 1716 0x7248808 VerSetConditionMask - + 1717 0x724880e WerReportExceptionWorker - + 1718 0x7248814 WerReportSQMEvent - + 1719 0x724881a WinSqmAddToAverageDWORD - + 1720 0x7248820 WinSqmAddToStream - + 1721 0x7248826 WinSqmAddToStreamEx - + 1722 0x724882c WinSqmCheckEscalationAddToStreamEx - + 1724 0x7248838 WinSqmCheckEscalationSetDWORD - + 1723 0x7248832 WinSqmCheckEscalationSetDWORD64 - + 1725 0x724883e WinSqmCheckEscalationSetString - + 1726 0x7248844 WinSqmCommonDatapointDelete - + 1728 0x7248850 WinSqmCommonDatapointSetDWORD - + 1727 0x724884a WinSqmCommonDatapointSetDWORD64 - + 1729 0x7248856 WinSqmCommonDatapointSetStreamEx - + 1730 0x724885c WinSqmCommonDatapointSetString - + 1731 0x7248862 WinSqmEndSession - + 1732 0x7248868 WinSqmEventEnabled - + 1733 0x724886e WinSqmEventWrite - + 1734 0x7248874 WinSqmGetEscalationRuleStatus - + 1735 0x724887a WinSqmGetInstrumentationProperty - + 1736 0x7248880 WinSqmIncrementDWORD - + 1737 0x7248886 WinSqmIsOptedIn - + 1738 0x724888c WinSqmIsOptedInEx - + 1739 0x7248892 WinSqmIsSessionDisabled - + 1741 0x724889e WinSqmSetDWORD - + 1740 0x7248898 WinSqmSetDWORD64 - + 1742 0x72488a4 WinSqmSetEscalationInfo - + 1743 0x72488aa WinSqmSetIfMaxDWORD - + 1744 0x72488b0 WinSqmSetIfMinDWORD - + 1745 0x72488b6 WinSqmSetString - + 1746 0x72488bc WinSqmStartSession - + 1747 0x72488c2 WinSqmStartSessionForPartner - + 1748 0x72488c8 WinSqmStartSqmOptinListener - + 1749 0x72488ce Wow64Transition - + 1750 0x72488d4 ZwAcceptConnectPort - + 1751 0x72488da ZwAccessCheck - + 1752 0x72488e0 ZwAccessCheckAndAuditAlarm - + 1753 0x72488e6 ZwAccessCheckByType - + 1754 0x72488ec ZwAccessCheckByTypeAndAuditAlarm - + 1755 0x72488f2 ZwAccessCheckByTypeResultList - + 1756 0x72488f8 ZwAccessCheckByTypeResultListAndAuditAlarm - + 1757 0x72488fe ZwAccessCheckByTypeResultListAndAuditAlarmByHandle - + 1758 0x7248904 ZwAcquireCrossVmMutant - + 1759 0x724890a ZwAcquireProcessActivityReference - + 1760 0x7248910 ZwAddAtom - + 1761 0x7248916 ZwAddAtomEx - + 1762 0x724891c ZwAddBootEntry - + 1763 0x7248922 ZwAddDriverEntry - + 1764 0x7248928 ZwAdjustGroupsToken - + 1765 0x724892e ZwAdjustPrivilegesToken - + 1766 0x7248934 ZwAdjustTokenClaimsAndDeviceGroups - + 1767 0x724893a ZwAlertResumeThread - + 1768 0x7248940 ZwAlertThread - + 1769 0x7248946 ZwAlertThreadByThreadId - + 1770 0x724894c ZwAllocateLocallyUniqueId - + 1771 0x7248952 ZwAllocateReserveObject - + 1772 0x7248958 ZwAllocateUserPhysicalPages - + 1773 0x724895e ZwAllocateUserPhysicalPagesEx - + 1774 0x7248964 ZwAllocateUuids - + 1775 0x724896a ZwAllocateVirtualMemory - + 1776 0x7248970 ZwAllocateVirtualMemoryEx - + 1777 0x7248976 ZwAlpcAcceptConnectPort - + 1778 0x724897c ZwAlpcCancelMessage - + 1779 0x7248982 ZwAlpcConnectPort - + 1780 0x7248988 ZwAlpcConnectPortEx - + 1781 0x724898e ZwAlpcCreatePort - + 1782 0x7248994 ZwAlpcCreatePortSection - + 1783 0x724899a ZwAlpcCreateResourceReserve - + 1784 0x72489a0 ZwAlpcCreateSectionView - + 1785 0x72489a6 ZwAlpcCreateSecurityContext - + 1786 0x72489ac ZwAlpcDeletePortSection - + 1787 0x72489b2 ZwAlpcDeleteResourceReserve - + 1788 0x72489b8 ZwAlpcDeleteSectionView - + 1789 0x72489be ZwAlpcDeleteSecurityContext - + 1790 0x72489c4 ZwAlpcDisconnectPort - + 1791 0x72489ca ZwAlpcImpersonateClientContainerOfPort - + 1792 0x72489d0 ZwAlpcImpersonateClientOfPort - + 1793 0x72489d6 ZwAlpcOpenSenderProcess - + 1794 0x72489dc ZwAlpcOpenSenderThread - + 1795 0x72489e2 ZwAlpcQueryInformation - + 1796 0x72489e8 ZwAlpcQueryInformationMessage - + 1797 0x72489ee ZwAlpcRevokeSecurityContext - + 1798 0x72489f4 ZwAlpcSendWaitReceivePort - + 1799 0x72489fa ZwAlpcSetInformation - + 1800 0x7248a00 ZwApphelpCacheControl - + 1801 0x7248a06 ZwAreMappedFilesTheSame - + 1802 0x7248a0c ZwAssignProcessToJobObject - + 1803 0x7248a12 ZwAssociateWaitCompletionPacket - + 1804 0x7248a18 ZwCallEnclave - + 1805 0x7248a1e ZwCallbackReturn - + 1806 0x7248a24 ZwCancelIoFile - + 1807 0x7248a2a ZwCancelIoFileEx - + 1808 0x7248a30 ZwCancelSynchronousIoFile - + 1810 0x7248a3c ZwCancelTimer - + 1809 0x7248a36 ZwCancelTimer2 - + 1811 0x7248a42 ZwCancelWaitCompletionPacket - + 1812 0x7248a48 ZwClearEvent - + 1813 0x7248a4e ZwClose - + 1814 0x7248a54 ZwCloseObjectAuditAlarm - + 1815 0x7248a5a ZwCommitComplete - + 1816 0x7248a60 ZwCommitEnlistment - + 1817 0x7248a66 ZwCommitRegistryTransaction - + 1818 0x7248a6c ZwCommitTransaction - + 1819 0x7248a72 ZwCompactKeys - + 1820 0x7248a78 ZwCompareObjects - + 1821 0x7248a7e ZwCompareSigningLevels - + 1822 0x7248a84 ZwCompareTokens - + 1823 0x7248a8a ZwCompleteConnectPort - + 1824 0x7248a90 ZwCompressKey - + 1825 0x7248a96 ZwConnectPort - + 1826 0x7248a9c ZwContinue - + 1827 0x7248aa2 ZwContinueEx - + 1828 0x7248aa8 ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter - + 1829 0x7248aae ZwCreateCrossVmEvent - + 1830 0x7248ab4 ZwCreateCrossVmMutant - + 1831 0x7248aba ZwCreateDebugObject - + 1832 0x7248ac0 ZwCreateDirectoryObject - + 1833 0x7248ac6 ZwCreateDirectoryObjectEx - + 1834 0x7248acc ZwCreateEnclave - + 1835 0x7248ad2 ZwCreateEnlistment - + 1836 0x7248ad8 ZwCreateEvent - + 1837 0x7248ade ZwCreateEventPair - + 1838 0x7248ae4 ZwCreateFile - + 1839 0x7248aea ZwCreateIRTimer - + 1840 0x7248af0 ZwCreateIoCompletion - + 1841 0x7248af6 ZwCreateJobObject - + 1842 0x7248afc ZwCreateJobSet - + 1843 0x7248b02 ZwCreateKey - + 1844 0x7248b08 ZwCreateKeyTransacted - + 1845 0x7248b0e ZwCreateKeyedEvent - + 1846 0x7248b14 ZwCreateLowBoxToken - + 1847 0x7248b1a ZwCreateMailslotFile - + 1848 0x7248b20 ZwCreateMutant - + 1849 0x7248b26 ZwCreateNamedPipeFile - + 1850 0x7248b2c ZwCreatePagingFile - + 1851 0x7248b32 ZwCreatePartition - + 1852 0x7248b38 ZwCreatePort - + 1853 0x7248b3e ZwCreatePrivateNamespace - + 1854 0x7248b44 ZwCreateProcess - + 1855 0x7248b4a ZwCreateProcessEx - + 1856 0x7248b50 ZwCreateProfile - + 1857 0x7248b56 ZwCreateProfileEx - + 1858 0x7248b5c ZwCreateRegistryTransaction - + 1859 0x7248b62 ZwCreateResourceManager - + 1860 0x7248b68 ZwCreateSection - + 1861 0x7248b6e ZwCreateSectionEx - + 1862 0x7248b74 ZwCreateSemaphore - + 1863 0x7248b7a ZwCreateSymbolicLinkObject - + 1864 0x7248b80 ZwCreateThread - + 1865 0x7248b86 ZwCreateThreadEx - + 1867 0x7248b92 ZwCreateTimer - + 1866 0x7248b8c ZwCreateTimer2 - + 1868 0x7248b98 ZwCreateToken - + 1869 0x7248b9e ZwCreateTokenEx - + 1870 0x7248ba4 ZwCreateTransaction - + 1871 0x7248baa ZwCreateTransactionManager - + 1872 0x7248bb0 ZwCreateUserProcess - + 1873 0x7248bb6 ZwCreateWaitCompletionPacket - + 1874 0x7248bbc ZwCreateWaitablePort - + 1875 0x7248bc2 ZwCreateWnfStateName - + 1876 0x7248bc8 ZwCreateWorkerFactory - + 1877 0x7248bce ZwDebugActiveProcess - + 1878 0x7248bd4 ZwDebugContinue - + 1879 0x7248bda ZwDelayExecution - + 1880 0x7248be0 ZwDeleteAtom - + 1881 0x7248be6 ZwDeleteBootEntry - + 1882 0x7248bec ZwDeleteDriverEntry - + 1883 0x7248bf2 ZwDeleteFile - + 1884 0x7248bf8 ZwDeleteKey - + 1885 0x7248bfe ZwDeleteObjectAuditAlarm - + 1886 0x7248c04 ZwDeletePrivateNamespace - + 1887 0x7248c0a ZwDeleteValueKey - + 1888 0x7248c10 ZwDeleteWnfStateData - + 1889 0x7248c16 ZwDeleteWnfStateName - + 1890 0x7248c1c ZwDeviceIoControlFile - + 1891 0x7248c22 ZwDirectGraphicsCall - + 1892 0x7248c28 ZwDisableLastKnownGood - + 1893 0x7248c2e ZwDisplayString - + 1894 0x7248c34 ZwDrawText - + 1895 0x7248c3a ZwDuplicateObject - + 1896 0x7248c40 ZwDuplicateToken - + 1897 0x7248c46 ZwEnableLastKnownGood - + 1898 0x7248c4c ZwEnumerateBootEntries - + 1899 0x7248c52 ZwEnumerateDriverEntries - + 1900 0x7248c58 ZwEnumerateKey - + 1901 0x7248c5e ZwEnumerateSystemEnvironmentValuesEx - + 1902 0x7248c64 ZwEnumerateTransactionObject - + 1903 0x7248c6a ZwEnumerateValueKey - + 1904 0x7248c70 ZwExtendSection - + 1905 0x7248c76 ZwFilterBootOption - + 1906 0x7248c7c ZwFilterToken - + 1907 0x7248c82 ZwFilterTokenEx - + 1908 0x7248c88 ZwFindAtom - + 1909 0x7248c8e ZwFlushBuffersFile - + 1910 0x7248c94 ZwFlushBuffersFileEx - + 1911 0x7248c9a ZwFlushInstallUILanguage - + 1912 0x7248ca0 ZwFlushInstructionCache - + 1913 0x7248ca6 ZwFlushKey - + 1914 0x7248cac ZwFlushProcessWriteBuffers - + 1915 0x7248cb2 ZwFlushVirtualMemory - + 1916 0x7248cb8 ZwFlushWriteBuffer - + 1917 0x7248cbe ZwFreeUserPhysicalPages - + 1918 0x7248cc4 ZwFreeVirtualMemory - + 1919 0x7248cca ZwFreezeRegistry - + 1920 0x7248cd0 ZwFreezeTransactions - + 1921 0x7248cd6 ZwFsControlFile - + 1922 0x7248cdc ZwGetCachedSigningLevel - + 1923 0x7248ce2 ZwGetCompleteWnfStateSubscription - + 1924 0x7248ce8 ZwGetContextThread - + 1925 0x7248cee ZwGetCurrentProcessorNumber - + 1926 0x7248cf4 ZwGetCurrentProcessorNumberEx - + 1927 0x7248cfa ZwGetDevicePowerState - + 1928 0x7248d00 ZwGetMUIRegistryInfo - + 1929 0x7248d06 ZwGetNextProcess - + 1930 0x7248d0c ZwGetNextThread - + 1931 0x7248d12 ZwGetNlsSectionPtr - + 1932 0x7248d18 ZwGetNotificationResourceManager - + 1933 0x7248d1e ZwGetWriteWatch - + 1934 0x7248d24 ZwImpersonateAnonymousToken - + 1935 0x7248d2a ZwImpersonateClientOfPort - + 1936 0x7248d30 ZwImpersonateThread - + 1937 0x7248d36 ZwInitializeEnclave - + 1938 0x7248d3c ZwInitializeNlsFiles - + 1939 0x7248d42 ZwInitializeRegistry - + 1940 0x7248d48 ZwInitiatePowerAction - + 1941 0x7248d4e ZwIsProcessInJob - + 1942 0x7248d54 ZwIsSystemResumeAutomatic - + 1943 0x7248d5a ZwIsUILanguageComitted - + 1944 0x7248d60 ZwListenPort - + 1945 0x7248d66 ZwLoadDriver - + 1946 0x7248d6c ZwLoadEnclaveData - + 1949 0x7248d7e ZwLoadKey - + 1947 0x7248d72 ZwLoadKey2 - + 1948 0x7248d78 ZwLoadKey3 - + 1950 0x7248d84 ZwLoadKeyEx - + 1951 0x7248d8a ZwLockFile - + 1952 0x7248d90 ZwLockProductActivationKeys - + 1953 0x7248d96 ZwLockRegistryKey - + 1954 0x7248d9c ZwLockVirtualMemory - + 1955 0x7248da2 ZwMakePermanentObject - + 1956 0x7248da8 ZwMakeTemporaryObject - + 1957 0x7248dae ZwManageHotPatch - + 1958 0x7248db4 ZwManagePartition - + 1959 0x7248dba ZwMapCMFModule - + 1960 0x7248dc0 ZwMapUserPhysicalPages - + 1961 0x7248dc6 ZwMapUserPhysicalPagesScatter - + 1962 0x7248dcc ZwMapViewOfSection - + 1963 0x7248dd2 ZwMapViewOfSectionEx - + 1964 0x7248dd8 ZwModifyBootEntry - + 1965 0x7248dde ZwModifyDriverEntry - + 1966 0x7248de4 ZwNotifyChangeDirectoryFile - + 1967 0x7248dea ZwNotifyChangeDirectoryFileEx - + 1968 0x7248df0 ZwNotifyChangeKey - + 1969 0x7248df6 ZwNotifyChangeMultipleKeys - + 1970 0x7248dfc ZwNotifyChangeSession - + 1971 0x7248e02 ZwOpenDirectoryObject - + 1972 0x7248e08 ZwOpenEnlistment - + 1973 0x7248e0e ZwOpenEvent - + 1974 0x7248e14 ZwOpenEventPair - + 1975 0x7248e1a ZwOpenFile - + 1976 0x7248e20 ZwOpenIoCompletion - + 1977 0x7248e26 ZwOpenJobObject - + 1978 0x7248e2c ZwOpenKey - + 1979 0x7248e32 ZwOpenKeyEx - + 1980 0x7248e38 ZwOpenKeyTransacted - + 1981 0x7248e3e ZwOpenKeyTransactedEx - + 1982 0x7248e44 ZwOpenKeyedEvent - + 1983 0x7248e4a ZwOpenMutant - + 1984 0x7248e50 ZwOpenObjectAuditAlarm - + 1985 0x7248e56 ZwOpenPartition - + 1986 0x7248e5c ZwOpenPrivateNamespace - + 1987 0x7248e62 ZwOpenProcess - + 1988 0x7248e68 ZwOpenProcessToken - + 1989 0x7248e6e ZwOpenProcessTokenEx - + 1990 0x7248e74 ZwOpenRegistryTransaction - + 1991 0x7248e7a ZwOpenResourceManager - + 1992 0x7248e80 ZwOpenSection - + 1993 0x7248e86 ZwOpenSemaphore - + 1994 0x7248e8c ZwOpenSession - + 1995 0x7248e92 ZwOpenSymbolicLinkObject - + 1996 0x7248e98 ZwOpenThread - + 1997 0x7248e9e ZwOpenThreadToken - + 1998 0x7248ea4 ZwOpenThreadTokenEx - + 1999 0x7248eaa ZwOpenTimer - + 2000 0x7248eb0 ZwOpenTransaction - + 2001 0x7248eb6 ZwOpenTransactionManager - + 2002 0x7248ebc ZwPlugPlayControl - + 2003 0x7248ec2 ZwPowerInformation - + 2004 0x7248ec8 ZwPrePrepareComplete - + 2005 0x7248ece ZwPrePrepareEnlistment - + 2006 0x7248ed4 ZwPrepareComplete - + 2007 0x7248eda ZwPrepareEnlistment - + 2008 0x7248ee0 ZwPrivilegeCheck - + 2009 0x7248ee6 ZwPrivilegeObjectAuditAlarm - + 2010 0x7248eec ZwPrivilegedServiceAuditAlarm - + 2011 0x7248ef2 ZwPropagationComplete - + 2012 0x7248ef8 ZwPropagationFailed - + 2013 0x7248efe ZwProtectVirtualMemory - + 2014 0x7248f04 ZwPssCaptureVaSpaceBulk - + 2015 0x7248f0a ZwPulseEvent - + 2016 0x7248f10 ZwQueryAttributesFile - + 2017 0x7248f16 ZwQueryAuxiliaryCounterFrequency - + 2018 0x7248f1c ZwQueryBootEntryOrder - + 2019 0x7248f22 ZwQueryBootOptions - + 2020 0x7248f28 ZwQueryDebugFilterState - + 2021 0x7248f2e ZwQueryDefaultLocale - + 2022 0x7248f34 ZwQueryDefaultUILanguage - + 2023 0x7248f3a ZwQueryDirectoryFile - + 2024 0x7248f40 ZwQueryDirectoryFileEx - + 2025 0x7248f46 ZwQueryDirectoryObject - + 2026 0x7248f4c ZwQueryDriverEntryOrder - + 2027 0x7248f52 ZwQueryEaFile - + 2028 0x7248f58 ZwQueryEvent - + 2029 0x7248f5e ZwQueryFullAttributesFile - + 2030 0x7248f64 ZwQueryInformationAtom - + 2031 0x7248f6a ZwQueryInformationByName - + 2032 0x7248f70 ZwQueryInformationEnlistment - + 2033 0x7248f76 ZwQueryInformationFile - + 2034 0x7248f7c ZwQueryInformationJobObject - + 2035 0x7248f82 ZwQueryInformationPort - + 2036 0x7248f88 ZwQueryInformationProcess - + 2037 0x7248f8e ZwQueryInformationResourceManager - + 2038 0x7248f94 ZwQueryInformationThread - + 2039 0x7248f9a ZwQueryInformationToken - + 2040 0x7248fa0 ZwQueryInformationTransaction - + 2041 0x7248fa6 ZwQueryInformationTransactionManager - + 2042 0x7248fac ZwQueryInformationWorkerFactory - + 2043 0x7248fb2 ZwQueryInstallUILanguage - + 2044 0x7248fb8 ZwQueryIntervalProfile - + 2045 0x7248fbe ZwQueryIoCompletion - + 2046 0x7248fc4 ZwQueryKey - + 2047 0x7248fca ZwQueryLicenseValue - + 2048 0x7248fd0 ZwQueryMultipleValueKey - + 2049 0x7248fd6 ZwQueryMutant - + 2050 0x7248fdc ZwQueryObject - + 2051 0x7248fe2 ZwQueryOpenSubKeys - + 2052 0x7248fe8 ZwQueryOpenSubKeysEx - + 2053 0x7248fee ZwQueryPerformanceCounter - + 2054 0x7248ff4 ZwQueryPortInformationProcess - + 2055 0x7248ffa ZwQueryQuotaInformationFile - + 2056 0x7249000 ZwQuerySection - + 2057 0x7249006 ZwQuerySecurityAttributesToken - + 2058 0x724900c ZwQuerySecurityObject - + 2059 0x7249012 ZwQuerySecurityPolicy - + 2060 0x7249018 ZwQuerySemaphore - + 2061 0x724901e ZwQuerySymbolicLinkObject - + 2062 0x7249024 ZwQuerySystemEnvironmentValue - + 2063 0x724902a ZwQuerySystemEnvironmentValueEx - + 2064 0x7249030 ZwQuerySystemInformation - + 2065 0x7249036 ZwQuerySystemInformationEx - + 2066 0x724903c ZwQuerySystemTime - + 2067 0x7249042 ZwQueryTimer - + 2068 0x7249048 ZwQueryTimerResolution - + 2069 0x724904e ZwQueryValueKey - + 2070 0x7249054 ZwQueryVirtualMemory - + 2071 0x724905a ZwQueryVolumeInformationFile - + 2072 0x7249060 ZwQueryWnfStateData - + 2073 0x7249066 ZwQueryWnfStateNameInformation - + 2074 0x724906c ZwQueueApcThread - + 2075 0x7249072 ZwQueueApcThreadEx - + 2076 0x7249078 ZwRaiseException - + 2077 0x724907e ZwRaiseHardError - + 2078 0x7249084 ZwReadFile - + 2079 0x724908a ZwReadFileScatter - + 2080 0x7249090 ZwReadOnlyEnlistment - + 2081 0x7249096 ZwReadRequestData - + 2082 0x724909c ZwReadVirtualMemory - + 2083 0x72490a2 ZwRecoverEnlistment - + 2084 0x72490a8 ZwRecoverResourceManager - + 2085 0x72490ae ZwRecoverTransactionManager - + 2086 0x72490b4 ZwRegisterProtocolAddressInformation - + 2087 0x72490ba ZwRegisterThreadTerminatePort - + 2088 0x72490c0 ZwReleaseKeyedEvent - + 2089 0x72490c6 ZwReleaseMutant - + 2090 0x72490cc ZwReleaseSemaphore - + 2091 0x72490d2 ZwReleaseWorkerFactoryWorker - + 2092 0x72490d8 ZwRemoveIoCompletion - + 2093 0x72490de ZwRemoveIoCompletionEx - + 2094 0x72490e4 ZwRemoveProcessDebug - + 2095 0x72490ea ZwRenameKey - + 2096 0x72490f0 ZwRenameTransactionManager - + 2097 0x72490f6 ZwReplaceKey - + 2098 0x72490fc ZwReplacePartitionUnit - + 2099 0x7249102 ZwReplyPort - + 2100 0x7249108 ZwReplyWaitReceivePort - + 2101 0x724910e ZwReplyWaitReceivePortEx - + 2102 0x7249114 ZwReplyWaitReplyPort - + 2103 0x724911a ZwRequestPort - + 2104 0x7249120 ZwRequestWaitReplyPort - + 2105 0x7249126 ZwResetEvent - + 2106 0x724912c ZwResetWriteWatch - + 2107 0x7249132 ZwRestoreKey - + 2108 0x7249138 ZwResumeProcess - + 2109 0x724913e ZwResumeThread - + 2110 0x7249144 ZwRevertContainerImpersonation - + 2111 0x724914a ZwRollbackComplete - + 2112 0x7249150 ZwRollbackEnlistment - + 2113 0x7249156 ZwRollbackRegistryTransaction - + 2114 0x724915c ZwRollbackTransaction - + 2115 0x7249162 ZwRollforwardTransactionManager - + 2116 0x7249168 ZwSaveKey - + 2117 0x724916e ZwSaveKeyEx - + 2118 0x7249174 ZwSaveMergedKeys - + 2119 0x724917a ZwSecureConnectPort - + 2120 0x7249180 ZwSerializeBoot - + 2121 0x7249186 ZwSetBootEntryOrder - + 2122 0x724918c ZwSetBootOptions - + 2124 0x7249198 ZwSetCachedSigningLevel - + 2123 0x7249192 ZwSetCachedSigningLevel2 - + 2125 0x724919e ZwSetContextThread - + 2126 0x72491a4 ZwSetDebugFilterState - + 2127 0x72491aa ZwSetDefaultHardErrorPort - + 2128 0x72491b0 ZwSetDefaultLocale - + 2129 0x72491b6 ZwSetDefaultUILanguage - + 2130 0x72491bc ZwSetDriverEntryOrder - + 2131 0x72491c2 ZwSetEaFile - + 2132 0x72491c8 ZwSetEvent - + 2133 0x72491ce ZwSetEventBoostPriority - + 2134 0x72491d4 ZwSetHighEventPair - + 2135 0x72491da ZwSetHighWaitLowEventPair - + 2136 0x72491e0 ZwSetIRTimer - + 2137 0x72491e6 ZwSetInformationDebugObject - + 2138 0x72491ec ZwSetInformationEnlistment - + 2139 0x72491f2 ZwSetInformationFile - + 2140 0x72491f8 ZwSetInformationJobObject - + 2141 0x72491fe ZwSetInformationKey - + 2142 0x7249204 ZwSetInformationObject - + 2143 0x724920a ZwSetInformationProcess - + 2144 0x7249210 ZwSetInformationResourceManager - + 2145 0x7249216 ZwSetInformationSymbolicLink - + 2146 0x724921c ZwSetInformationThread - + 2147 0x7249222 ZwSetInformationToken - + 2148 0x7249228 ZwSetInformationTransaction - + 2149 0x724922e ZwSetInformationTransactionManager - + 2150 0x7249234 ZwSetInformationVirtualMemory - + 2151 0x724923a ZwSetInformationWorkerFactory - + 2152 0x7249240 ZwSetIntervalProfile - + 2153 0x7249246 ZwSetIoCompletion - + 2154 0x724924c ZwSetIoCompletionEx - + 2155 0x7249252 ZwSetLdtEntries - + 2156 0x7249258 ZwSetLowEventPair - + 2157 0x724925e ZwSetLowWaitHighEventPair - + 2158 0x7249264 ZwSetQuotaInformationFile - + 2159 0x724926a ZwSetSecurityObject - + 2160 0x7249270 ZwSetSystemEnvironmentValue - + 2161 0x7249276 ZwSetSystemEnvironmentValueEx - + 2162 0x724927c ZwSetSystemInformation - + 2163 0x7249282 ZwSetSystemPowerState - + 2164 0x7249288 ZwSetSystemTime - + 2165 0x724928e ZwSetThreadExecutionState - + 2167 0x724929a ZwSetTimer - + 2166 0x7249294 ZwSetTimer2 - + 2168 0x72492a0 ZwSetTimerEx - + 2169 0x72492a6 ZwSetTimerResolution - + 2170 0x72492ac ZwSetUuidSeed - + 2171 0x72492b2 ZwSetValueKey - + 2172 0x72492b8 ZwSetVolumeInformationFile - + 2173 0x72492be ZwSetWnfProcessNotificationEvent - + 2174 0x72492c4 ZwShutdownSystem - + 2175 0x72492ca ZwShutdownWorkerFactory - + 2176 0x72492d0 ZwSignalAndWaitForSingleObject - + 2177 0x72492d6 ZwSinglePhaseReject - + 2178 0x72492dc ZwStartProfile - + 2179 0x72492e2 ZwStopProfile - + 2180 0x72492e8 ZwSubscribeWnfStateChange - + 2181 0x72492ee ZwSuspendProcess - + 2182 0x72492f4 ZwSuspendThread - + 2183 0x72492fa ZwSystemDebugControl - + 2184 0x7249300 ZwTerminateEnclave - + 2185 0x7249306 ZwTerminateJobObject - + 2186 0x724930c ZwTerminateProcess - + 2187 0x7249312 ZwTerminateThread - + 2188 0x7249318 ZwTestAlert - + 2189 0x724931e ZwThawRegistry - + 2190 0x7249324 ZwThawTransactions - + 2191 0x724932a ZwTraceControl - + 2192 0x7249330 ZwTraceEvent - + 2193 0x7249336 ZwTranslateFilePath - + 2194 0x724933c ZwUmsThreadYield - + 2195 0x7249342 ZwUnloadDriver - + 2197 0x724934e ZwUnloadKey - + 2196 0x7249348 ZwUnloadKey2 - + 2198 0x7249354 ZwUnloadKeyEx - + 2199 0x724935a ZwUnlockFile - + 2200 0x7249360 ZwUnlockVirtualMemory - + 2201 0x7249366 ZwUnmapViewOfSection - + 2202 0x724936c ZwUnmapViewOfSectionEx - + 2203 0x7249372 ZwUnsubscribeWnfStateChange - + 2204 0x7249378 ZwUpdateWnfStateData - + 2205 0x724937e ZwVdmControl - + 2206 0x7249384 ZwWaitForAlertByThreadId - + 2207 0x724938a ZwWaitForDebugEvent - + 2208 0x7249390 ZwWaitForKeyedEvent - + 2210 0x724939c ZwWaitForMultipleObjects - + 2209 0x7249396 ZwWaitForMultipleObjects32 - + 2211 0x72493a2 ZwWaitForSingleObject - + 2212 0x72493a8 ZwWaitForWorkViaWorkerFactory - + 2213 0x72493ae ZwWaitHighEventPair - + 2214 0x72493b4 ZwWaitLowEventPair - + 2215 0x72493ba ZwWorkerFactoryWorkerReady - + 2216 0x72493c0 ZwWow64AllocateVirtualMemory64 - + 2217 0x72493c6 ZwWow64CallFunction64 - + 2218 0x72493cc ZwWow64CsrAllocateCaptureBuffer - + 2219 0x72493d2 ZwWow64CsrAllocateMessagePointer - + 2220 0x72493d8 ZwWow64CsrCaptureMessageBuffer - + 2221 0x72493de ZwWow64CsrCaptureMessageString - + 2222 0x72493e4 ZwWow64CsrClientCallServer - + 2223 0x72493ea ZwWow64CsrClientConnectToServer - + 2224 0x72493f0 ZwWow64CsrFreeCaptureBuffer - + 2225 0x72493f6 ZwWow64CsrGetProcessId - + 2226 0x72493fc ZwWow64CsrIdentifyAlertableThread - + 2227 0x7249402 ZwWow64CsrVerifyRegion - + 2228 0x7249408 ZwWow64DebuggerCall - + 2229 0x724940e ZwWow64GetCurrentProcessorNumberEx - + 2230 0x7249414 ZwWow64GetNativeSystemInformation - + 2231 0x724941a ZwWow64IsProcessorFeaturePresent - + 2232 0x7249420 ZwWow64QueryInformationProcess64 - + 2233 0x7249426 ZwWow64ReadVirtualMemory64 - + 2234 0x724942c ZwWow64WriteVirtualMemory64 - + 2235 0x7249432 ZwWriteFile - + 2236 0x7249438 ZwWriteFileGather - + 2237 0x724943e ZwWriteRequestData - + 2238 0x7249444 ZwWriteVirtualMemory - + 2239 0x724944a ZwYieldExecution - + 2240 0x7249450 _CIcos - + 2241 0x7249456 _CIlog - + 2242 0x724945c _CIpow - + 2243 0x7249462 _CIsin - + 2244 0x7249468 _CIsqrt - + 2245 0x724946e __isascii - + 2246 0x7249474 __iscsym - + 2247 0x724947a __iscsymf - + 2248 0x7249480 __toascii - + 2249 0x7249486 _alldiv - + 2250 0x724948c _alldvrm - + 2251 0x7249492 _allmul - + 2252 0x7249498 _alloca_probe - + 2253 0x724949e _alloca_probe_16 - + 2254 0x72494a4 _alloca_probe_8 - + 2255 0x72494aa _allrem - + 2256 0x72494b0 _allshl - + 2257 0x72494b6 _allshr - + 2258 0x72494bc _atoi64 - + 2259 0x72494c2 _aulldiv - + 2260 0x72494c8 _aulldvrm - + 2261 0x72494ce _aullrem - + 2262 0x72494d4 _aullshr - + 2263 0x72494da _chkstk - + 2264 0x72494e0 _errno - + 2265 0x72494e6 _except_handler4_common - + 2266 0x72494ec _fltused - + 2267 0x72494f2 _ftol - + 2268 0x72494f8 _ftol2 - + 2269 0x72494fe _ftol2_sse - + 2270 0x7249504 _i64toa - + 2271 0x724950a _i64toa_s - + 2272 0x7249510 _i64tow - + 2273 0x7249516 _i64tow_s - + 2274 0x724951c _itoa - + 2275 0x7249522 _itoa_s - + 2276 0x7249528 _itow - + 2277 0x724952e _itow_s - + 2278 0x7249534 _lfind - + 2279 0x724953a _local_unwind4 - + 2280 0x7249540 _ltoa - + 2281 0x7249546 _ltoa_s - + 2282 0x724954c _ltow - + 2283 0x7249552 _ltow_s - + 2284 0x7249558 _makepath_s - + 2285 0x724955e _memccpy - + 2286 0x7249564 _memicmp - + 2287 0x724956a _snprintf - + 2288 0x7249570 _snprintf_s - + 2289 0x7249576 _snscanf_s - + 2290 0x724957c _snwprintf - + 2291 0x7249582 _snwprintf_s - + 2292 0x7249588 _snwscanf_s - + 2293 0x724958e _splitpath - + 2294 0x7249594 _splitpath_s - + 2295 0x724959a _strcmpi - + 2296 0x72495a0 _stricmp - + 2297 0x72495a6 _strlwr - + 2298 0x72495ac _strlwr_s - + 2299 0x72495b2 _strnicmp - + 2300 0x72495b8 _strnset_s - + 2301 0x72495be _strset_s - + 2302 0x72495c4 _strupr - + 2303 0x72495ca _strupr_s - + 2304 0x72495d0 _swprintf - + 2305 0x72495d6 _ui64toa - + 2306 0x72495dc _ui64toa_s - + 2307 0x72495e2 _ui64tow - + 2308 0x72495e8 _ui64tow_s - + 2309 0x72495ee _ultoa - + 2310 0x72495f4 _ultoa_s - + 2311 0x72495fa _ultow - + 2312 0x7249600 _ultow_s - + 2313 0x7249606 _vscprintf - + 2314 0x724960c _vscwprintf - + 2315 0x7249612 _vsnprintf - + 2316 0x7249618 _vsnprintf_s - + 2317 0x724961e _vsnwprintf - + 2318 0x7249624 _vsnwprintf_s - + 2319 0x724962a _vswprintf - + 2320 0x7249630 _wcsicmp - + 2321 0x7249636 _wcslwr - + 2322 0x724963c _wcslwr_s - + 2323 0x7249642 _wcsnicmp - + 2324 0x7249648 _wcsnset_s - + 2325 0x724964e _wcsset_s - + 2326 0x7249654 _wcstoi64 - + 2327 0x724965a _wcstoui64 - + 2328 0x7249660 _wcsupr - + 2329 0x7249666 _wcsupr_s - + 2330 0x724966c _wmakepath_s - + 2331 0x7249672 _wsplitpath_s - + 2332 0x7249678 _wtoi - + 2333 0x724967e _wtoi64 - + 2334 0x7249684 _wtol - + 2335 0x724968a abs - + 2336 0x7249690 atan - + 2337 0x7249696 atan2 - + 2338 0x724969c atoi - + 2339 0x72496a2 atol - + 2340 0x72496a8 bsearch - + 2341 0x72496ae bsearch_s - + 2342 0x72496b4 ceil - + 2343 0x72496ba cos - + 2344 0x72496c0 fabs - + 2345 0x72496c6 floor - + 2346 0x72496cc isalnum - + 2347 0x72496d2 isalpha - + 2348 0x72496d8 iscntrl - + 2349 0x72496de isdigit - + 2350 0x72496e4 isgraph - + 2351 0x72496ea islower - + 2352 0x72496f0 isprint - + 2353 0x72496f6 ispunct - + 2354 0x72496fc isspace - + 2355 0x7249702 isupper - + 2356 0x7249708 iswalnum - + 2357 0x724970e iswalpha - + 2358 0x7249714 iswascii - + 2359 0x724971a iswctype - + 2360 0x7249720 iswdigit - + 2361 0x7249726 iswgraph - + 2362 0x724972c iswlower - + 2363 0x7249732 iswprint - + 2364 0x7249738 iswspace - + 2365 0x724973e iswxdigit - + 2366 0x7249744 isxdigit - + 2367 0x724974a labs - + 2368 0x7249750 log - + 2369 0x7249756 mbstowcs - + 2370 0x724975c memchr - + 2371 0x7249762 memcmp - + 2372 0x7249768 memcpy - + 2373 0x724976e memcpy_s - + 2374 0x7249774 memmove - + 2375 0x724977a memmove_s - + 2376 0x7249780 memset - + 2377 0x7249786 pow - + 2378 0x724978c qsort - + 2379 0x7249792 qsort_s - + 2380 0x7249798 sin - + 2381 0x724979e sprintf - + 2382 0x72497a4 sprintf_s - + 2383 0x72497aa sqrt - + 2384 0x72497b0 sscanf - + 2385 0x72497b6 sscanf_s - + 2386 0x72497bc strcat - + 2387 0x72497c2 strcat_s - + 2388 0x72497c8 strchr - + 2389 0x72497ce strcmp - + 2390 0x72497d4 strcpy - + 2391 0x72497da strcpy_s - + 2392 0x72497e0 strcspn - + 2393 0x72497e6 strlen - + 2394 0x72497ec strncat - + 2395 0x72497f2 strncat_s - + 2396 0x72497f8 strncmp - + 2397 0x72497fe strncpy - + 2398 0x7249804 strncpy_s - + 2399 0x724980a strnlen - + 2400 0x7249810 strpbrk - + 2401 0x7249816 strrchr - + 2402 0x724981c strspn - + 2403 0x7249822 strstr - + 2404 0x7249828 strtok_s - + 2405 0x724982e strtol - + 2406 0x7249834 strtoul - + 2407 0x724983a swprintf - + 2408 0x7249840 swprintf_s - + 2409 0x7249846 swscanf_s - + 2410 0x724984c tan - + 2411 0x7249852 tolower - + 2412 0x7249858 toupper - + 2413 0x724985e towlower - + 2414 0x7249864 towupper - + 2415 0x724986a vDbgPrintEx - + 2416 0x7249870 vDbgPrintExWithPrefix - + 2417 0x7249876 vsprintf - + 2418 0x724987c vsprintf_s - + 2419 0x7249882 vswprintf_s - + 2420 0x7249888 wcscat - + 2421 0x724988e wcscat_s - + 2422 0x7249894 wcschr - + 2423 0x724989a wcscmp - + 2424 0x72498a0 wcscpy - + 2425 0x72498a6 wcscpy_s - + 2426 0x72498ac wcscspn - + 2427 0x72498b2 wcslen - + 2428 0x72498b8 wcsncat - + 2429 0x72498be wcsncat_s - + 2430 0x72498c4 wcsncmp - + 2431 0x72498ca wcsncpy - + 2432 0x72498d0 wcsncpy_s - + 2433 0x72498d6 wcsnlen - + 2434 0x72498dc wcspbrk - + 2435 0x72498e2 wcsrchr - + 2436 0x72498e8 wcsspn - + 2437 0x72498ee wcsstr - + 2438 0x72498f4 wcstok_s - + 2439 0x72498fa wcstol - + 2440 0x7249900 wcstombs - + 2441 0x7249906 wcstoul - +
- - - + + +
- - - - - - - - + + + + + + + + @@ -67556,19 +67556,19 @@

Exports

- - @@ -67576,8 +67576,8 @@

Exports

- @@ -67588,39 +67588,39 @@

Exports

- - @@ -67641,86 +67641,86 @@

Exports

- - - - @@ -67744,57 +67744,57 @@

Exports

- - @@ -67818,65 +67818,65 @@

Exports

- - - @@ -67900,33 +67900,33 @@

Exports

- @@ -67950,81 +67950,81 @@

Exports

- - - @@ -68048,27 +68048,27 @@

Exports

- - @@ -68147,138 +68147,138 @@

Exports

- - - - - - - @@ -68300,8 +68300,8 @@

Exports

- @@ -68312,10 +68312,10 @@

Exports

- @@ -68404,81 +68404,81 @@

Exports

- - - - @@ -68495,23 +68495,23 @@

Exports

 - - - - @@ -68528,48 +68528,48 @@

Exports

- - @@ -68583,41 +68583,41 @@

Exports

- - @@ -68629,62 +68629,62 @@

Exports

- - @@ -68699,34 +68699,34 @@

Exports

- @@ -68743,58 +68743,58 @@

Exports

- - @@ -68831,34 +68831,34 @@

Exports

- - @@ -68881,8 +68881,8 @@

Exports

 - @@ -68900,774 +68900,774 @@

Exports

 - - - - - - - - - - @@ -69676,8 +69676,8 @@

Exports

- @@ -69688,50 +69688,50 @@

Exports

- @@ -69818,29 +69818,29 @@

Exports

 - - - - - @@ -69853,723 +69853,723 @@

Exports

 - @@ -70581,49 +70581,49 @@

Exports

- + - + - +
- +

Process Tree

    - - + +
  • 728546301b7008b5a1fb3aea.exe (PID: 4984)
      - +
    • spiketail.exe (PID: 6044)
      • - +
    • - - - + + +
  • notepad.exe (PID: 4836)
      - +
    • rundll32.exe (PID: 3240)
      • - +
    • - - + +
@@ -70633,7 +70633,7 @@

Process Tree

Behavioral Analysis

- +
@@ -70641,7 +70641,7 @@

Behavioral Analysis

Behavioral Summary

- +
- +
    - +
  • C:\Windows\WindowsShell.Manifest
    • - +
  • C:\Windows\System32\kernel.appcore.dll
    • - +
  • \Device\CNG
    • - +
  • C:\Users\Louise\AppData\Local\Temp\728546301b7008b5a1fb3aea.exe
    • - +
  • C:\Users
    • - +
  • C:\Users\Louise
    • - +
  • C:\Users\Louise\AppData
    • - +
  • C:\Users\Louise\AppData\Local
    • - +
  • C:\Users\Louise\AppData\Local\Temp
    • - +
  • C:\Windows\Globalization\Sorting\sortdefault.nls
    • - +
  • C:\Windows\System32\UxTheme.dll.Config
    • - +
  • C:\Windows\System32\uxtheme.dll
    • - +
  • C:\Users\Louise\AppData\Local\Temp\728546301b7008b5a1fb3aea.exe.Local\
    • - +
  • C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984
    • - +
  • C:\Windows\System32\windows.storage.dll
    • - +
  • C:\Users\Louise\AppData\Local\Temp\Wldp.dll
    • - +
  • C:\Windows\System32\wldp.dll
    • - +
  • C:\Users\Louise\AppData\Local\Temp\reaffection
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA266.tmp
    • - +
  • C:\Users\Louise\AppData\Local\Temp\neophobic
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA2F4.tmp
    • - +
  • C:\Users\Louise\AppData\Local\caprone
    • - +
  • C:\Users\Louise\AppData\Local\caprone\spiketail.exe
    • - +
  • C:\Users\Louise\AppData\Local\Temp\CRYPTSP.dll
    • - +
  • C:\Windows\System32\cryptsp.dll
    • - +
  • C:\Users\Louise\AppData\Local\caprone\spiketail.exe.Local\
    • - +
  • C:\Users\Louise\AppData\Local\caprone\Wldp.dll
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA9AA.tmp
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA9E9.tmp
    • - +
  • C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spiketail.vbs
    • - +
  • C:\Windows\System32\ntdll.dll
    • - +
  • C:\Windows\SysWOW64\rundll32.exe
    • - +
- +
- +
    - +
  • C:\Users\Louise\AppData\Local\Temp\autA266.tmp
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA9AA.tmp
    • - +
- +
- +
    - +
  • C:\Users\Louise\AppData\Local\Temp\autA266.tmp
    • - +
  • C:\Users\Louise\AppData\Local\Temp\reaffection
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA2F4.tmp
    • - +
  • C:\Users\Louise\AppData\Local\Temp\neophobic
    • - +
  • C:\Users\Louise\AppData\Local\caprone\spiketail.exe
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA9AA.tmp
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA9E9.tmp
    • - +
  • C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spiketail.vbs
    • - +
- +
- +
    - +
  • C:\Users\Louise\AppData\Local\Temp\autA266.tmp
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA2F4.tmp
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA9AA.tmp
    • - +
  • C:\Users\Louise\AppData\Local\Temp\autA9E9.tmp
    • - +
- +
- +
    - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
    • - +
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
    • - +
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
    • - +
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
    • - +
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
    • - +
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
    • - +
  • HKEY_CURRENT_USER\Control Panel\Mouse\SwapMouseButtons
    • - +
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
    • - +
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
    • - +
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\000603xx
    • - +
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-US
    • - +
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Category
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Name
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\ParentFolder
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Description
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\RelativePath
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\ParsingName
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\InfoTip
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\LocalizedName
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Icon
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Security
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\StreamResource
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\StreamResourceType
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\LocalRedirectOnly
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Roamable
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PreCreate
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Stream
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PublishExpandedPath
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\DefinitionFlags
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Attributes
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\FolderTypeID
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\InitFolderHandler
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Category
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Name
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\ParentFolder
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Description
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\RelativePath
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\ParsingName
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\InfoTip
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\LocalizedName
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Icon
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Security
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\StreamResource
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\StreamResourceType
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\LocalRedirectOnly
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Roamable
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\PreCreate
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Stream
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\PublishExpandedPath
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\DefinitionFlags
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Attributes
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\FolderTypeID
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\InitFolderHandler
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Category
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Name
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParentFolder
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Description
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\RelativePath
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParsingName
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InfoTip
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalizedName
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Icon
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Security
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResource
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResourceType
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalRedirectOnly
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Roamable
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PreCreate
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Stream
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PublishExpandedPath
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\DefinitionFlags
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Attributes
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\FolderTypeID
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InitFolderHandler
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableUmpdBufferSizeCheck
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ProductName
    • - +
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\CurrentBuild
    • - +
- +
- +

Nothing to display.

- +
- +

Nothing to display.

- +
- +
    - +
  • ole32.dll.CoUninitialize
    • - +
  • ole32.dll.CoInitializeEx
    • - +
  • ole32.dll.CoCreateInstance
    • - +
- +
- +
    - +
  • "C:\Users\Louise\AppData\Local\Temp\728546301b7008b5a1fb3aea.exe"
    • - +
  • "C:\Windows\SysWOW64\rundll32.exe"
    • - +
- +
- +
    - +
  • Local\SM0:4984:168:WilStaging_02
    • - +
  • Local\SM0:6044:168:WilStaging_02
    • - +
  • O656Q78AFX8-XK27
    • - +
  • 217N4TP44BB0J1A9
    • - +
- +
- +

Nothing to display.

- +
- +

Nothing to display.

- +
- +

No results

- +
- +
@@ -71091,9 +71091,9 @@
- +
- +
@@ -71105,14 +71105,14 @@

Full Path: C:\Users\Louise\AppData\Local\Temp\728546301b7008b5a1fb3aea.exe

- +

Command Line: "C:\Users\Louise\AppData\Local\Temp\728546301b7008b5a1fb3aea.exe"

- - + +
- +
@@ -71124,14 +71124,14 @@

Full Path: C:\Users\Louise\AppData\Local\caprone\spiketail.exe

- +

Command Line: "C:\Users\Louise\AppData\Local\Temp\728546301b7008b5a1fb3aea.exe"

- - + +
- +
@@ -71143,14 +71143,14 @@

Full Path: C:\Windows\SysWOW64\svchost.exe

- +

Command Line: "C:\Users\Louise\AppData\Local\Temp\728546301b7008b5a1fb3aea.exe"

- - + +
- +
@@ -71162,14 +71162,14 @@

Full Path: C:\Windows\System32\notepad.exe

- +

Command Line: "C:\Windows\system32\notepad.exe"

- - + +
- +
@@ -71181,33 +71181,33 @@

Full Path: C:\Windows\SysWOW64\rundll32.exe

- +

Command Line: "C:\Windows\SysWOW64\rundll32.exe"

- - + +
- +
- +
- +
- +

Debugger Log

- +
- +

- +

- +

- +

- +

- + - + - + - \ No newline at end of file + diff --git a/utils/dist.py b/utils/dist.py index 5953d93707c..c71ff0ac2ef 100644 --- a/utils/dist.py +++ b/utils/dist.py @@ -97,6 +97,7 @@ # GCS Configuration GCS_ENABLED = dist_conf.gcs.enabled +GCS_DELETE_AFTER_UPLOAD = dist_conf.gcs.get("delete_after_upload") if GCS_ENABLED: from modules.reporting.gcs import GCSUploader @@ -1013,6 +1014,14 @@ def fetch_latest_reports_nfs(self): # We can try to get TLP from task options if available, or just pass None. tlp = t.tlp gcs_uploader.upload(report_path, t.main_task_id, tlp=tlp) + + if GCS_DELETE_AFTER_UPLOAD: + try: + shutil.rmtree(report_path) + log.info("Deleted local report for task %d after GCS upload", t.main_task_id) + except Exception as e: + log.error("Failed to delete local report %s: %s", report_path, e) + except Exception as e: log.error("Failed to upload report to GCS for task %d: %s", t.main_task_id, e) @@ -2032,6 +2041,11 @@ def init_logging(debug=False): default=0, help="Clean tasks for last X hours", ) + p.add_argument( + "--submit-only", + action="store_true", + help="Disable retrieval threads (use when running Go Fast-Fetcher)", + ) args = p.parse_args() log = init_logging(args.debug) @@ -2069,11 +2083,12 @@ def init_logging(debug=False): t.daemon = True t.start() - retrieve = Retriever(name="Retriever") - retrieve.daemon = True - retrieve.start() - # ret = Retriever() - # ret.run() + if not args.submit_only and not dist_conf.distributed.get("submit_only"): + retrieve = Retriever(name="Retriever") + retrieve.daemon = True + retrieve.start() + else: + log.info("Submit-only mode: Retriever thread disabled.") app.run(host=args.host, port=args.port, debug=args.debug, use_reloader=False) @@ -2083,9 +2098,12 @@ def init_logging(debug=False): # this allows run it with gunicorn/uwsgi log = init_logging(True) - retrieve = Retriever(name="Retriever") - retrieve.daemon = True - retrieve.start() + if not dist_conf.distributed.get("submit_only"): + retrieve = Retriever(name="Retriever") + retrieve.daemon = True + retrieve.start() + else: + log.info("Submit-only mode (config): Retriever thread disabled.") t = StatusThread(name="StatusThread") t.daemon = True diff --git a/utils/go-fetcher/config.example.json b/utils/go-fetcher/config.example.json new file mode 100644 index 00000000000..3f8df23e9fd --- /dev/null +++ b/utils/go-fetcher/config.example.json @@ -0,0 +1,14 @@ +{ + "DistDBConn": "postgresql://cape:cape@127.0.0.1:5432/distdb", + "MainDBConn": "postgresql://cape:cape@127.0.0.1:5432/cape", + "RootDir": "/opt/CAPEv2", + "Threads": 8, + "IgnorePatterns": [ + "binary", + "dump_sorted.pcap", + "memory.dmp", + "logs", + "custom_folder" + ], + "NFSMountFolder": "/opt/CAPEv2/workers" +} diff --git a/utils/go-fetcher/db/models.go b/utils/go-fetcher/db/models.go new file mode 100644 index 00000000000..943860c0aa3 --- /dev/null +++ b/utils/go-fetcher/db/models.go @@ -0,0 +1,50 @@ +package db + +import ( + "time" +) + +type Node struct { + ID uint `gorm:"primaryKey"` + Name string `gorm:"type:text"` + URL string `gorm:"type:text"` + Enabled bool `gorm:"default:false"` + APIKey string `gorm:"size:255"` + LastCheck *time.Time +} + +func (Node) TableName() string { + return "node" +} + +type Task struct { + ID uint `gorm:"primaryKey"` + Path string `gorm:"type:text"` + Category string `gorm:"type:text"` + Package string `gorm:"type:text"` + Timeout int + Priority int + Options string `gorm:"type:text"` + Machine string `gorm:"type:text"` + Platform string `gorm:"type:text"` + Route string `gorm:"type:text"` + Tags string `gorm:"type:text"` + Custom string `gorm:"type:text"` + Memory string `gorm:"type:text"` + Clock time.Time `gorm:"default:CURRENT_TIMESTAMP"` + EnforceTimeout string `gorm:"type:text"` + TLP string `gorm:"type:text"` + + NodeID uint `gorm:"index"` + TaskID uint `gorm:"index"` // ID on the worker node + MainTaskID uint `gorm:"index"` // ID on the master node + + Finished bool `gorm:"default:false"` + Retrieved bool `gorm:"default:false"` + Notificated bool `gorm:"default:false"` + Deleted bool `gorm:"default:false"` +} + +func (Task) TableName() string { + return "task" +} diff --git a/utils/go-fetcher/go-fetcher b/utils/go-fetcher/go-fetcher new file mode 100755 index 00000000000..e7a4fe2d2fc Binary files /dev/null and b/utils/go-fetcher/go-fetcher differ diff --git a/utils/go-fetcher/go.mod b/utils/go-fetcher/go.mod new file mode 100644 index 00000000000..c4e730b2880 --- /dev/null +++ b/utils/go-fetcher/go.mod @@ -0,0 +1,22 @@ +module go-fetcher + +go 1.24.0 + +require ( + gorm.io/driver/mysql v1.5.2 + gorm.io/driver/postgres v1.5.4 + gorm.io/driver/sqlite v1.5.4 + gorm.io/gorm v1.25.5 +) + +require ( + github.com/go-sql-driver/mysql v1.7.0 // indirect + github.com/jackc/pgpassfile v1.0.0 // indirect + github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect + github.com/jackc/pgx/v5 v5.4.3 // indirect + github.com/jinzhu/inflection v1.0.0 // indirect + github.com/jinzhu/now v1.1.5 // indirect + github.com/mattn/go-sqlite3 v1.14.17 // indirect + golang.org/x/crypto v0.45.0 // indirect + golang.org/x/text v0.31.0 // indirect +) diff --git a/utils/go-fetcher/go.sum b/utils/go-fetcher/go.sum new file mode 100644 index 00000000000..9059a83939f --- /dev/null +++ b/utils/go-fetcher/go.sum @@ -0,0 +1,41 @@ +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/go-sql-driver/mysql v1.7.0 h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc= +github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI= +github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= +github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= +github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk= +github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM= +github.com/jackc/pgx/v5 v5.4.3 h1:cxFyXhxlvAifxnkKKdlxv8XqUf59tDlYjnV5YYfsJJY= +github.com/jackc/pgx/v5 v5.4.3/go.mod h1:Ig06C2Vu0t5qXC60W8sqIthScaEnFvojjj9dSljmHRA= +github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E= +github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc= +github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ= +github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8= +github.com/mattn/go-sqlite3 v1.14.17 h1:mCRHCLDUBXgpKAqIKsaAaAsrAlbkeomtRFKXh2L6YIM= +github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk= +github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= +golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= +golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= +golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gorm.io/driver/mysql v1.5.2 h1:QC2HRskSE75wBuOxe0+iCkyJZ+RqpudsQtqkp+IMuXs= +gorm.io/driver/mysql v1.5.2/go.mod h1:pQLhh1Ut/WUAySdTHwBpBv6+JKcj+ua4ZFx1QQTBzb8= +gorm.io/driver/postgres v1.5.4 h1:Iyrp9Meh3GmbSuyIAGyjkN+n9K+GHX9b9MqsTL4EJCo= +gorm.io/driver/postgres v1.5.4/go.mod h1:Bgo89+h0CRcdA33Y6frlaHHVuTdOf87pmyzwW9C/BH0= +gorm.io/driver/sqlite v1.5.4 h1:IqXwXi8M/ZlPzH/947tn5uik3aYQslP9BVveoax0nV0= +gorm.io/driver/sqlite v1.5.4/go.mod h1:qxAuCol+2r6PannQDpOP1FP6ag3mKi4esLnB/jHed+4= +gorm.io/gorm v1.25.2-0.20230530020048-26663ab9bf55/go.mod h1:L4uxeKpfBml98NYqVqwAdmV1a2nBtAec/cf3fpucW/k= +gorm.io/gorm v1.25.5 h1:zR9lOiiYf09VNh5Q1gphfyia1JpiClIWG9hQaxB/mls= +gorm.io/gorm v1.25.5/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8= diff --git a/utils/go-fetcher/main.go b/utils/go-fetcher/main.go new file mode 100644 index 00000000000..06b6d3e6cb0 --- /dev/null +++ b/utils/go-fetcher/main.go @@ -0,0 +1,432 @@ +package main + +import ( + "bytes" + "encoding/json" + "flag" + "fmt" + "io" + "log" + "net/http" + "net/url" + "os" + "path/filepath" + "strings" + "sync" + "time" + + "go-fetcher/db" + + "gorm.io/driver/mysql" + "gorm.io/driver/postgres" + "gorm.io/driver/sqlite" + "gorm.io/gorm" + "gorm.io/gorm/logger" +) + +// CAPE Task Statuses +const ( + TaskDistributed = "distributed" + TaskDistributedCompleted = "distributed_completed" + TaskReported = "reported" +) + +type Config struct { + DistDBConn string + MainDBConn string + RootDir string + Threads int + NFSMountFolder string + IgnorePatterns []string +} + +func main() { + configPath := flag.String("config", "", "Path to JSON configuration file") + distDB := flag.String("dist-db", "", "Distributed Database connection string") + mainDB := flag.String("main-db", "", "Main Database connection string") + rootDir := flag.String("root", ".", "CAPE Root directory") + nfsMount := flag.String("nfs-mount", "", "NFS Mount folder base path (e.g. /mnt/cape_workers)") + ignore := flag.String("ignore", "", "Comma-separated list of file/folder names to ignore (e.g. binary,memory.dmp)") + threads := flag.Int("threads", 4, "Number of fetcher threads") + flag.Parse() + + // 1. Load config from file if provided + var cfg Config + if *configPath != "" { + file, err := os.Open(*configPath) + if err != nil { + log.Fatalf("Failed to open config file: %v", err) + } + decoder := json.NewDecoder(file) + if err := decoder.Decode(&cfg); err != nil { + log.Fatalf("Failed to decode config JSON: %v", err) + } + file.Close() + } + + // 2. Override with CLI flags if provided (CLI takes precedence) + if *distDB != "" { + cfg.DistDBConn = *distDB + } + if *mainDB != "" { + cfg.MainDBConn = *mainDB + } + if *rootDir != "." { + cfg.RootDir = *rootDir + } + if *nfsMount != "" { + cfg.NFSMountFolder = *nfsMount + } + if *threads != 4 { + cfg.Threads = *threads + } + if *ignore != "" { + cfg.IgnorePatterns = strings.Split(*ignore, ",") + } + + // Default threads if 0 + if cfg.Threads == 0 { + cfg.Threads = 4 + } + if cfg.RootDir == "" { + cfg.RootDir = "." + } + // Default ignores if empty? + // Dist.py defaults: binary, dump_sorted.pcap, memory.dmp, logs + if len(cfg.IgnorePatterns) == 0 { + cfg.IgnorePatterns = []string{"binary", "dump_sorted.pcap", "memory.dmp", "logs"} + } + + if cfg.DistDBConn == "" || cfg.MainDBConn == "" { + log.Fatal("Both DistDBConn and MainDBConn are required (via config file or flags)") + } + + if cfg.NFSMountFolder == "" { + log.Fatal("NFSMountFolder is required for NFS fetching") + } + + // Connect to Distributed DB + distDBHandle, err := connectDB(cfg.DistDBConn) + if err != nil { + log.Fatalf("Failed to connect to Distributed DB: %v", err) + } + + // Connect to Main DB + mainDBHandle, err := connectDB(cfg.MainDBConn) + if err != nil { + log.Fatalf("Failed to connect to Main DB: %v", err) + } + + log.Printf("Fast-Fetcher started with %d threads", cfg.Threads) + log.Printf("Ignoring patterns: %v", cfg.IgnorePatterns) + + fetcher := &Fetcher{ + DistDB: distDBHandle, + MainDB: mainDBHandle, + RootDir: cfg.RootDir, + NFSMountFolder: cfg.NFSMountFolder, + Threads: cfg.Threads, + IgnoreMap: makeIgnoreMap(cfg.IgnorePatterns), + } + + fetcher.Start() +} + +func makeIgnoreMap(patterns []string) map[string]bool { + m := make(map[string]bool) + for _, p := range patterns { + m[strings.TrimSpace(p)] = true + } + return m +} + +func connectDB(connStr string) (*gorm.DB, error) { + var dialector gorm.Dialector + + // Simple heuristic for dialector + if bytes.HasPrefix([]byte(connStr), []byte("postgres")) { + dialector = postgres.Open(connStr) + } else if bytes.HasPrefix([]byte(connStr), []byte("mysql")) { + dialector = mysql.Open(connStr) + } else { + dialector = sqlite.Open(connStr) + } + + return gorm.Open(dialector, &gorm.Config{ + Logger: logger.Default.LogMode(logger.Silent), + }) +} + +type Fetcher struct { + DistDB *gorm.DB + MainDB *gorm.DB + RootDir string + NFSMountFolder string + Threads int + IgnoreMap map[string]bool +} + +func (f *Fetcher) Start() { + var wg sync.WaitGroup + taskChan := make(chan db.Task, 100) + + // Worker threads + for i := 0; i < f.Threads; i++ { + wg.Add(1) + go func(id int) { + defer wg.Done() + for task := range taskChan { + f.ProcessTask(task) + } + }(i) + } + + // Producer loop + for { + // Find tasks that are not retrieved and not finished in our dist db + // We poll the nodes to see if they are "reported" there. + // Actually, the dist.py fetcher loop looks for "reported" tasks on nodes. + + // Let's get all enabled nodes + var nodes []db.Node + f.DistDB.Where("enabled = ?", true).Find(&nodes) + + for _, node := range nodes { + remoteTasks, err := f.FetchRemoteReportedTasks(node) + if err != nil { + log.Printf("Error fetching tasks from node %s: %v", node.Name, err) + continue + } + + if len(remoteTasks) == 0 { + continue + } + + // For each remote reported task, check if we have it in our dist db as pending retrieval + var localTasks []db.Task + f.DistDB.Where("node_id = ? AND task_id IN ? AND retrieved = ? AND finished = ?", + node.ID, remoteTasks, false, false).Find(&localTasks) + + for _, t := range localTasks { + taskChan <- t + } + } + + time.Sleep(10 * time.Second) + } +} + +func (f *Fetcher) FetchRemoteReportedTasks(node db.Node) ([]uint, error) { + // GET node.URL + /tasks/list/?status=reported&ids=True + apiURL, _ := url.Parse(node.URL) + apiURL.Path = filepath.Join(apiURL.Path, "tasks", "list") + + q := apiURL.Query() + q.Set("status", "reported") + q.Set("ids", "True") + apiURL.RawQuery = q.Encode() + + req, _ := http.NewRequest("GET", apiURL.String(), nil) + req.Header.Set("Authorization", "Token "+node.APIKey) + + client := &http.Client{Timeout: 10 * time.Second} + resp, err := client.Do(req) + if err != nil { + return nil, err + } + defer resp.Body.Close() + + if resp.StatusCode != 200 { + return nil, fmt.Errorf("status %d", resp.StatusCode) + } + + var result struct { + Data []struct { + ID uint `json:"id"` + } `json:"data"` + } + if err := json.NewDecoder(resp.Body).Decode(&result); err != nil { + return nil, err + } + + ids := make([]uint, len(result.Data)) + for i, d := range result.Data { + ids[i] = d.ID + } + return ids, nil +} + +func (f *Fetcher) ProcessTask(t db.Task) { + log.Printf("Processing Task %d (Main: %d) from Node %d", t.TaskID, t.MainTaskID, t.NodeID) + + var node db.Node + f.DistDB.First(&node, t.NodeID) + + // Construct NFS Source Path + // Python: os.path.join(CUCKOO_ROOT, dist_conf.NFS.mount_folder, str(worker_name), "storage", "analyses", str(task_id)) + // f.NFSMountFolder should be the base mount path (e.g. /mnt/cape_workers or similar, or CUCKOO_ROOT/mount_folder) + // If mount_folder in python config is relative, it is joined with CUCKOO_ROOT. + // Here we assume f.NFSMountFolder is the absolute path to where nodes are mounted. + // E.g. /opt/CAPE/nfs_mounts + + // Structure: //storage/analyses/ + srcDir := filepath.Join(f.NFSMountFolder, node.Name, "storage", "analyses", fmt.Sprintf("%d", t.TaskID)) + + // Check if source exists (is mounted?) + if _, err := os.Stat(srcDir); os.IsNotExist(err) { + // Log warning but don't fail hard, maybe not synced yet? + // dist.py logs error and returns True (skips). + log.Printf("Source directory not found (yet?): %s", srcDir) + return + } + + // Destination: storage/analyses/ + destDir := filepath.Join(f.RootDir, "storage", "analyses", fmt.Sprintf("%d", t.MainTaskID)) + + // Ensure dest dir doesn't exist (CopyDir requirement) + os.RemoveAll(destDir) + + // Perform Copy + if err := f.CopyDir(srcDir, destDir); err != nil { + log.Printf("Failed to copy report from %s to %s: %v", srcDir, destDir, err) + return + } + // 3. Update Statuses + // Update Main DB + f.MainDB.Table("tasks").Where("id = ?", t.MainTaskID).Update("status", TaskReported) + + // Update Dist DB + f.DistDB.Model(&t).Updates(map[string]interface{}{ + "retrieved": true, + "finished": true, + }) + + // 4. Delete from worker + f.DeleteFromWorker(node, t.TaskID) + + log.Printf("Successfully retrieved task %d (Main: %d)", t.TaskID, t.MainTaskID) +} +func (f *Fetcher) DeleteFromWorker(node db.Node, taskID uint) { + // DELETE /tasks/delete// + deleteURL := fmt.Sprintf("%s/tasks/delete/%d/", node.URL, taskID) + req, _ := http.NewRequest("GET", deleteURL, nil) // CAPE uses GET for delete in some versions or POST? + // In dist.py it uses DELETE method or POST to delete_many. + // Actually dist.py: requests.post(url, data={"ids": ids, "delete_mongo": False}) + + // Let's use POST delete_many for single ID to be sure + deleteURL = fmt.Sprintf("%s/tasks/delete_many/", node.URL) + form := url.Values{} + form.Add("ids", fmt.Sprintf("%d", taskID)) + form.Add("delete_mongo", "False") + +req, err := http.NewRequest("POST", deleteURL, bytes.NewBufferString(form.Encode())) + if err != nil { + log.Printf("Error creating delete request for task %d on node %s: %v", taskID, node.Name, err) + return + } + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") + req.Header.Set("Authorization", "Token "+node.APIKey) + + client := &http.Client{Timeout: 10 * time.Second} + resp, err := client.Do(req) + if err == nil { + resp.Body.Close() + } +} + +// CopyDir recursively copies a directory tree, attempting to preserve permissions. +func (f *Fetcher) CopyDir(src string, dst string) (err error) { + src = filepath.Clean(src) + dst = filepath.Clean(dst) + + si, err := os.Stat(src) + if err != nil { + return err + } + if !si.IsDir() { + return fmt.Errorf("source is not a directory") + } + + _, err = os.Stat(dst) + if err != nil && !os.IsNotExist(err) { + return + } + // We allow dest to exist (merge/overwrite) or mkdirall + err = os.MkdirAll(dst, si.Mode()) + if err != nil { + return + } + + entries, err := os.ReadDir(src) + if err != nil { + return + } + + for _, entry := range entries { + name := entry.Name() + // Ignore pattern check + if f.IgnoreMap[name] { + continue + } + + srcPath := filepath.Join(src, name) + dstPath := filepath.Join(dst, name) + + if entry.IsDir() { + err = f.CopyDir(srcPath, dstPath) + if err != nil { + return + } + } else { + if entry.Type()&os.ModeSymlink != 0 { + continue + } + + err = CopyFile(srcPath, dstPath) + if err != nil { + return + } + } + } + + return +} + +func CopyFile(src, dst string) (err error) { + in, err := os.Open(src) + if err != nil { + return + } + defer in.Close() + + out, err := os.Create(dst) + if err != nil { + return + } + defer func() { + if e := out.Close(); e != nil { + err = e + } + }() + + _, err = io.Copy(out, in) + if err != nil { + return + } + + err = out.Sync() + if err != nil { + return + } + + si, err := os.Stat(src) + if err != nil { + return + } + err = os.Chmod(dst, si.Mode()) + if err != nil { + return + } + + return +} diff --git a/utils/go-fetcher/readme.md b/utils/go-fetcher/readme.md new file mode 100644 index 00000000000..6a51a0ba672 --- /dev/null +++ b/utils/go-fetcher/readme.md @@ -0,0 +1,57 @@ +# Go Fast-Fetcher for CAPE Distributed + +This utility replaces the Python-based report retrieval in `dist.py` with a high-performance Go binary. It supports NFS-based report retrieval, copying analysis results directly from mounted worker storage to the master storage. + +## Features +- **High Concurrency:** Retrieves reports from multiple worker nodes simultaneously. +- **NFS Support:** Copies reports directly from NFS mounts (replacing HTTP downloads). +- **Auto-Cleanup:** Deletes tasks from worker nodes after successful retrieval. +- **Configurable:** Uses a JSON config file for database and path settings. + +## Build +```bash +go mod tidy +go build -o go-fetcher +``` + +## Configuration +Create a `config.json` file: + +```json +{ + "DistDBConn": "postgresql://cape:cape@127.0.0.1:5432/distdb", + "MainDBConn": "postgresql://cape:cape@127.0.0.1:5432/cape", + "RootDir": "/opt/CAPEv2", + "Threads": 8, + "IgnorePatterns": [ + "binary", + "dump_sorted.pcap", + "memory.dmp", + "logs", + "custom_folder" + ], + "NFSMountFolder": "/opt/CAPEv2/workers" +} +``` + +* `NFSMountFolder`: The base path where worker nodes are mounted (e.g., `/mnt/cape_workers/node1/...`). + +## Usage + +1. **Stop existing retrieval:** + Run `dist.py` with the `--submit-only` flag to disable its internal fetcher. + ```bash + poetry run python utils/dist.py --submit-only + ``` + +2. **Run the Go Fetcher:** + ```bash + ./go-fetcher -config config.json + ``` + +## CLI Arguments +CLI flags override config file settings: +- `-config`: Path to JSON config file. +- `-nfs-mount`: Base path for NFS mounts. +- `-root`: CAPE root directory. +- `-threads`: Number of worker threads. diff --git a/web/static/css/style.css b/web/static/css/style.css index 3aba87a1b13..4205728e557 100644 --- a/web/static/css/style.css +++ b/web/static/css/style.css @@ -405,27 +405,27 @@ pre { color: black; } -.btn-cat-filesystem { background-color: #ffe3c5; color: black; border-color: #ffe3c5; } +.btn-cat-filesystem { background-color: #ffe3c5 !important; color: black; border-color: #ffe3c5; } .btn-cat-filesystem:hover { color: black; } -.btn-cat-registry { background-color: #ffc5c5; color: black; border-color: #ffc5c5; } +.btn-cat-registry { background-color: #ffc5c5 !important; color: black; border-color: #ffc5c5; } .btn-cat-registry:hover { color: black; } -.btn-cat-process { background-color: #c5e0ff; color: black; border-color: #c5e0ff; } +.btn-cat-process { background-color: #c5e0ff !important; color: black; border-color: #c5e0ff; } .btn-cat-process:hover { color: black; } -.btn-cat-threading { background-color: #d3e0ff; color: black; border-color: #d3e0ff; } +.btn-cat-threading { background-color: #d3e0ff !important; color: black; border-color: #d3e0ff; } .btn-cat-threading:hover { color: black; } -.btn-cat-services { background-color: #ccc5ff; color: black; border-color: #ccc5ff; } +.btn-cat-services { background-color: #ccc5ff !important; color: black; border-color: #ccc5ff; } .btn-cat-services:hover { color: black; } -.btn-cat-device { background-color: #d3c5cc; color: black; border-color: #d3c5cc; } +.btn-cat-device { background-color: #d3c5cc !important; color: black; border-color: #d3c5cc; } .btn-cat-device:hover { color: black; } -.btn-cat-network { background-color: #d3ffc5; color: black; border-color: #d3ffc5; } +.btn-cat-network { background-color: #d3ffc5 !important; color: black; border-color: #d3ffc5; } .btn-cat-network:hover { color: black; } -.btn-cat-socket { background-color: #d3ffc5; color: black; border-color: #d3ffc5; } +.btn-cat-socket { background-color: #d3ffc5 !important; color: black; border-color: #d3ffc5; } .btn-cat-socket:hover { color: black; } -.btn-cat-synchronization { background-color: #f9c5ff; color: black; border-color: #f9c5ff; } +.btn-cat-synchronization { background-color: #f9c5ff !important; color: black; border-color: #f9c5ff; } .btn-cat-synchronization:hover { color: black; } -.btn-cat-browser { background-color: #dfffdf; color: black; border-color: #dfffdf; } +.btn-cat-browser { background-color: #dfffdf !important; color: black; border-color: #dfffdf; } .btn-cat-browser:hover { color: black; } -.btn-cat-crypto { background-color: #f0f2c5; color: black; border-color: #f0f2c5; } +.btn-cat-crypto { background-color: #f0f2c5 !important; color: black; border-color: #f0f2c5; } .btn-cat-crypto:hover { color: black; } /* Remove default underline, add on hover (exclude buttons if needed) */ diff --git a/web/templates/analysis/behavior/_processes.html b/web/templates/analysis/behavior/_processes.html index 2530c78b4ac..16ecf74190d 100644 --- a/web/templates/analysis/behavior/_processes.html +++ b/web/templates/analysis/behavior/_processes.html @@ -42,8 +42,8 @@ $("#top_pagination").removeClass("d-none"); $("#bottom_pagination").removeClass("d-none"); - $(".badge-filter").removeClass("badge-light text-dark").addClass("badge-dark"); - $("#badge_default_" + pid).removeClass("badge-dark").addClass("badge-light text-dark"); + $(".badge-filter").removeClass("bg-light text-dark").addClass("bg-dark"); + $("#badge_default_" + pid).removeClass("bg-dark").addClass("bg-light text-dark"); } function show_tab(id, callback) { @@ -91,8 +91,8 @@ $("#top_pagination").addClass("d-none"); $("#bottom_pagination").addClass("d-none"); - $(".badge-filter").removeClass("badge-light text-dark").addClass("badge-dark"); - $("#badge_" + category + "_" + pid).removeClass("badge-dark").addClass("badge-light text-dark"); + $(".badge-filter").removeClass("bg-light text-dark").addClass("bg-dark"); + $("#badge_" + category + "_" + pid).removeClass("bg-dark").addClass("bg-light text-dark"); } diff --git a/web/templates/analysis/generic/_virustotal.html b/web/templates/analysis/generic/_virustotal.html index 28d0b9f9cb9..3d650ebf960 100644 --- a/web/templates/analysis/generic/_virustotal.html +++ b/web/templates/analysis/generic/_virustotal.html @@ -1,5 +1,5 @@ {% if file.virustotal and not file.virustotal.error == True %} -
+
VirusTotal diff --git a/web/templates/analysis/network/_tcp.html b/web/templates/analysis/network/_tcp.html index 8985aa01a01..e0cf5084349 100644 --- a/web/templates/analysis/network/_tcp.html +++ b/web/templates/analysis/network/_tcp.html @@ -1,35 +1,43 @@
- {% if network.tcp %} -

TCP

-
-
- - - - - - - - {% for p in network.tcp %} - - - - - - - {% endfor %} -
SourceSource PortDestinationDestination Port
{{p.src}}{{p.sport}}{{p.dst}} - {% if network.iplookups %} - {{ network.iplookups|get_item:p.dst }} - {% endif %} - {{p.dport}}
-
-
+
+
+
TCP Connections
- {% else %} -

No TCP connections recorded.

- {% endif %} + {% if network.tcp %} +
+
+
+ + + + + + + + {% for p in network.tcp %} + + + + + + + {% endfor %} +
SourceSource PortDestinationDestination Port
{{p.src}}{{p.sport}}{{p.dst}} + {% if network.iplookups %} + {{ network.iplookups|get_item:p.dst }} + {% endif %} + {{p.dport}}
+
+
+
+
+ {% else %} +
+
No TCP connections recorded.
+
+ {% endif %} +
+ + + + + + +{% block extra_head %}{% endblock %} + + +{% block header %} +{% include "header.html" %} +{% endblock %} +
{% autoescape on %} {% block content %}{% endblock %} {% endautoescape %}
-{%include "footer.html" %} + +{% block footer %} +{% include "footer.html" %} +{% endblock %} + + + + + + + +{% block extra_scripts %}{% endblock %} + + diff --git a/web/templates/footer.html b/web/templates/footer.html index 4317bf4a048..49f9216aa49 100644 --- a/web/templates/footer.html +++ b/web/templates/footer.html @@ -1,4 +1,4 @@ -
+ + diff --git a/web/templates/statistics.html b/web/templates/statistics.html index 874692bcf91..fb1fa1acdd6 100644 --- a/web/templates/statistics.html +++ b/web/templates/statistics.html @@ -251,7 +251,7 @@
Clust {% for name, tasks in block.items %}
  • {{name}} - {{tasks}} + {{tasks}}
    • {% endfor %} diff --git a/web/templates/submission/index.html b/web/templates/submission/index.html index fc1f4c9afc7..34872a0d98e 100644 --- a/web/templates/submission/index.html +++ b/web/templates/submission/index.html @@ -15,21 +15,21 @@

    Submi {% if resubmit %}
  • + role="tab" aria-controls="resubmit" aria-selected="true"> Resubmission
    • {% else %}
  • + aria-controls="file" aria-selected="true"> File(s)
    • {% if config.downloading_service %}
  • + role="tab" aria-controls="downloading_service" aria-selected="false"> Download
    • @@ -37,7 +37,7 @@

    Submi {% if config.url_analysis %}
  • + aria-controls="url" aria-selected="false"> URL
    • @@ -45,20 +45,20 @@

    Submi {% if config.dlnexec %}
  • + aria-controls="dlurl" aria-selected="false"> DL & Exec
    • {% endif %}
  • + aria-controls="pcap" aria-selected="false"> PCAP
  • + aria-controls="static" aria-selected="false"> Static
    • @@ -72,14 +72,14 @@

    Submi
    + id="form_resubmission" name="hash" value="{{resubmit}}" readonly />

    {% else %}
    + name="sample" multiple />
    @@ -87,8 +87,8 @@

    Submi
    + id="form_downloading_service" name="hashes" + placeholder="Enter comma separated hashes or just a hash" />
    {% endif %} @@ -97,7 +97,7 @@

    Submi
    + id="form_url" name="url" placeholder="Enter URL to analyze" />
    @@ -106,7 +106,7 @@

    Submi
    + id="form_dlnexec" name="dlnexec" placeholder="Enter URL to download sample from" />
    {% endif %} @@ -114,13 +114,13 @@

    Submi
    + name="pcap" multiple />
    + name="static" multiple />
    {% endif %} @@ -129,7 +129,7 @@

    Submi
    -
    Advanced Options +
    Options
    @@ -138,7 +138,7 @@
    Advance {% if existent_tasks %}
    @@ -148,7 +148,7 @@
    Advance
      {% for block in details %}
    • Task {{block.info.id}} {% if block.family %} - + class="alert-link">{{block.info.id}} {% if block.family %} - {{block.malfamily}}{% endif %}
      • {% endfor %} @@ -163,7 +163,7 @@
      Advance
      + name="package"> {% for package in packages %} @@ -191,7 +191,7 @@
      Advance
      - + id="form_tags" name="tags" placeholder="tag1,tag2" /> +
      @@ -221,7 +221,7 @@
      Advance
      -
      + id="form_timeout" name="timeout" value="{{config.timeout}}" />
      {% if config.linux_on_gui %}
      - +
      + + +
      +
      +
      +

      Use the following syntax: example=value,foo=bar. Do not quote values.

      +
      + + + + + + + + + + + + + + + + + + + + + +
      OptionDescription
      filenameRename the sample file
      fileWhen using the archive package, set the name of the file to execute
      passwordWhen using the archive package, set the password to use for extraction/decryption. Also used when analyzing password-protected Office + documents.
      +
      +
      +
      {% endif %} -
      - -
      - -
      - - -
      -
      -
      -
      - - Syntax: option1=val1,option2=val2 -
      - -
      - -
      -
      - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      OptionDescription
      filenameRename the sample file
      nameForce family extractor to run (e.g., name=trickbot)
      curdirExecution directory (default %TEMP%)
      executiondirDirectory to launch file from (default %TEMP%)
      argumentsArguments for the executable or exported function
      appdataRun executable from AppData instead of Temp
      pwshPrefer PowerShell Core (pwsh.exe)
      freeRun without monitoring (disables many capabilities)
      ignore_size_checkAllow ignore file size (must be enabled in conf)
      check_shellcodeDisable shellcode check during package ID (check_shellcode=0)
      functionExported function/ordinal to execute (DLL)
      dllloaderProcess loading the DLL (default rundll32.exe)
      fileName of file to execute (Zip/Rar)
      passwordPassword for extraction/Office
      startbrowserLaunch browser 30s into analysis
      browserdelaySeconds to wait before starting browser
      urlURL for started browser
      servicedescService description (Service package)
      pre_script_argsArgs for pre_script
      during_script_argsArgs for during_script
      langOverride system language (LCID)
      standaloneRun in standalone mode (no pipe)
      monitorInject monitor into PID/Explorer
      shutdown-mutexMutex name for shutdown signal
      terminate-eventEvent name for termination signal
      terminate-processesTerminate processes on event
      first-process(Internal) First process in tree
      startup-timeMS since system startup
      -
      + +
      + +
      + + +
      +
      +
      +
      + + Syntax: option1=val1,option2=val2
      - -
      -
      - - - - - - - - - - - - - - - - - - -
      OptionDescription
      no-stealthDisable anti-anti-VM/sandbox tricks
      force-sleepskip1 = Skip all sleeps, 0 = Disable sleep skipping
      serialSpoof the system volume serial number
      single-processLimit monitoring to initial process only
      interactiveEnable interactive desktop mode
      referrerFake referrer for URL analysis
      noreferDisable fake referrer
      file-of-interestSpecific file or URL being analyzed
      pdfAdobe Reader specific hooks/behavior
      sysvol_ctimelow/highSpoof creation time of system volume
      fake-rdtscEnable fake RDTSC results
      ntdll-protectEnable write protection on ntdll.dll code
      ntdll-unhookEnable protection against ntdll unhooking
      protected-pidsEnable protection for critical PIDs
      + +
      + +
      +
      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      OptionDescription
      filenameRename the sample file
      nameForce family extractor to run (e.g., name=trickbot)
      curdirExecution directory (default %TEMP%)
      executiondirDirectory to launch file from (default %TEMP%)
      argumentsArguments for the executable or exported function
      appdataRun executable from AppData instead of Temp
      pwshPrefer PowerShell Core (pwsh.exe)
      freeRun without monitoring (disables many capabilities)
      ignore_size_checkAllow ignore file size (must be enabled in conf)
      check_shellcodeDisable shellcode check during package ID (check_shellcode=0)
      functionExported function/ordinal to execute (DLL)
      dllloaderProcess loading the DLL (default rundll32.exe)
      fileName of file to execute (Zip/Rar)
      passwordPassword for extraction/Office
      startbrowserLaunch browser 30s into analysis
      browserdelaySeconds to wait before starting browser
      urlURL for started browser
      servicedescService description (Service package)
      pre_script_argsArgs for pre_script
      during_script_argsArgs for during_script
      langOverride system language (LCID)
      standaloneRun in standalone mode (no pipe)
      monitorInject monitor into PID/Explorer
      shutdown-mutexMutex name for shutdown signal
      terminate-eventEvent name for termination signal
      terminate-processesTerminate processes on event
      first-process(Internal) First process in tree
      startup-timeMS since system startup
      +
      -
      - -
      -
      - - - - - - - - - - - - - - - - - - - - -
      OptionDescription
      full-logsDisable log suppression
      force-flush1 = Flush after non-duplicate API, 2 = Force flush every log
      buffer-maxMax size for log buffer
      large-buffer-maxMax size for large log buffers
      api-rate-capLimit rate of API logging
      api-capLimit total number of API logs
      hook-typeHook type: direct, indirect, or safe (32-bit only)
      syscallEnable syscall hooks (Win10+)
      disable-hook-content1 = Remove payload of non-critical hooks, 2 = All hooks
      exclude-apisColon-separated list of APIs to exclude from hooking
      exclude-dllsColon-separated list of DLLs to exclude from hooking
      unhook-apisDynamically unhook functions (colon-separated)
      coverage-modulesColon-separated list of DLLs to include in monitoring (exclude from 'dll range' filtering)
      zerohookDisable all hooks except essential
      hook-protectEnable write protection on hook pages
      log-exceptionsEnable logging of exceptions
      + +
      +
      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      OptionDescription
      no-stealthDisable anti-anti-VM/sandbox tricks
      force-sleepskip1 = Skip all sleeps, 0 = Disable sleep skipping
      serialSpoof the system volume serial number
      single-processLimit monitoring to initial process only
      interactiveEnable interactive desktop mode
      referrerFake referrer for URL analysis
      noreferDisable fake referrer
      file-of-interestSpecific file or URL being analyzed
      pdfAdobe Reader specific hooks/behavior
      sysvol_ctimelow/highSpoof creation time of system volume
      fake-rdtscEnable fake RDTSC results
      ntdll-protectEnable write protection on ntdll.dll code
      ntdll-unhookEnable protection against ntdll unhooking
      protected-pidsEnable protection for critical PIDs
      +
      -
      - -
      -
      - - - - - - - - - - - - - - - - - - - - -
      OptionDescription
      procdumpEnable process memory dumping on exit/timeout
      procmemdumpEnable full process memory dumping
      dump-on-apiDump calling module when specific APIs are called (colon-separated)
      dump-config-regionDump memory regions suspected to contain C2 config
      dump-cryptoDump buffers from Crypto APIs
      dump-keysDump keys from CryptImportKey
      amsidumpEnable AMSI buffer dumping (Win10+)
      tlsdumpEnable dumping of TLS secrets
      dropped-limitOverride default dropped file limit (100)
      compressionEnable CAPE's extraction of compressed payloads
      extractionEnable CAPE's extraction of payloads from within process
      injectionEnable CAPE's capture of injected payloads
      comboCombine compression, injection, and extraction
      unpacker1 = Passive unpacking, 2 = Active unpacking
      import-reconstructionAttempt import reconstruction on dumps
      store_memdumpForce STORE memdump (submit to analyzer directly)
      + +
      +
      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      OptionDescription
      full-logsDisable log suppression
      force-flush1 = Flush after non-duplicate API, 2 = Force flush every log
      buffer-maxMax size for log buffer
      large-buffer-maxMax size for large log buffers
      api-rate-capLimit rate of API logging
      api-capLimit total number of API logs
      hook-typeHook type: direct, indirect, or safe (32-bit only)
      syscallEnable syscall hooks (Win10+)
      disable-hook-content1 = Remove payload of non-critical hooks, 2 = All hooks
      exclude-apisColon-separated list of APIs to exclude from hooking
      exclude-dllsColon-separated list of DLLs to exclude from hooking
      unhook-apisDynamically unhook functions (colon-separated)
      coverage-modulesColon-separated list of DLLs to include in monitoring (exclude from 'dll range' filtering)
      zerohookDisable all hooks except essential
      hook-protectEnable write protection on hook pages
      log-exceptionsEnable logging of exceptions
      +
      -
      - -
      -
      - - - - - - - - - - - - - - - - - - -
      OptionDescription
      debuggerEnable internal debugger engine
      debug1 = Report critical exceptions, 2 = All exceptions
      bp0...bp3Hardware breakpoints (Address or Module:Export)
      bpSoftware breakpoints (colon-separated addresses)
      break-on-returnBreak on return from specific APIs
      base-on-apiSet base address for breakpoints based on API
      file-offsetsInterpret breakpoints as file offsets
      trace-allEnable full execution tracing
      depthTrace depth limit (default 0)
      countTrace instruction count limit (default 128)
      loop_detectionEnable loop detection (compress call logs)
      ttdTime Travel Debugging (ttd=1)
      polarproxyRun PolarProxy (TLS PCAP)
      mitmdumpRun mitmdump (TLS HAR)
      + +
      +
      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      OptionDescription
      procdumpEnable process memory dumping on exit/timeout
      procmemdumpEnable full process memory dumping
      dump-on-apiDump calling module when specific APIs are called (colon-separated)
      dump-config-regionDump memory regions suspected to contain C2 config
      dump-cryptoDump buffers from Crypto APIs
      dump-keysDump keys from CryptImportKey
      amsidumpEnable AMSI buffer dumping (Win10+)
      tlsdumpEnable dumping of TLS secrets
      dropped-limitOverride default dropped file limit (100)
      compressionEnable CAPE's extraction of compressed payloads
      extractionEnable CAPE's extraction of payloads from within process
      injectionEnable CAPE's capture of injected payloads
      comboCombine compression, injection, and extraction
      unpacker1 = Passive unpacking, 2 = Active unpacking
      import-reconstructionAttempt import reconstruction on dumps
      store_memdumpForce STORE memdump (submit to analyzer directly)
      +
      +
      + +
      +
      + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      OptionDescription
      debuggerEnable internal debugger engine
      debug1 = Report critical exceptions, 2 = All exceptions
      bp0...bp3Hardware breakpoints (Address or Module:Export)
      bpSoftware breakpoints (colon-separated addresses)
      break-on-returnBreak on return from specific APIs
      base-on-apiSet base address for breakpoints based on API
      file-offsetsInterpret breakpoints as file offsets
      trace-allEnable full execution tracing
      depthTrace depth limit (default 0)
      countTrace instruction count limit (default 128)
      loop_detectionEnable loop detection (compress call logs)
      ttdTime Travel Debugging (ttd=1)
      polarproxyRun PolarProxy (TLS PCAP)
      mitmdumpRun mitmdump (TLS HAR)
      +
      -
      - + +
      -
      - -
      -
      - - -
      - {% if config.tlp %} -
      - - -
      - {% endif %} -
      -
      -
      +
      - - + +
      + {% if config.tlp %}
      - - + +
      + {% endif %}
      - {% if config.pre_script %} -
      - - -
      - {% endif %} +
      +
      +
      + + +
      +
      + + +
      +
      - {% if config.during_script %} -
      - - -
      - {% endif %} -
      - - -
      + {% if config.pre_script %} +
      + + +
      + {% endif %} - -
      - -
      -
      -
      -
      - - -
      - {% if config.procmemory %} -
      - - -
      - {% endif %} - {% if config.amsidump %} -
      - - -
      - {% endif %} -
      - - -
      - {% if config.memory %} -
      - - -
      - {% endif %} -
      - - -
      -
      - - -
      -
      - - -
      -
      + {% if config.during_script %} +
      + + +
      + {% endif %} +
      + + +
      -
      -
      - - -
      -
      - - -
      -
      - - + +
      + +
      +
      +
      +
      + + +
      + {% if config.procmemory %} +
      + + +
      + {% endif %} + {% if config.amsidump %} +
      + + +
      + {% endif %} +
      + + +
      + {% if config.memory %} +
      + + +
      + {% endif %} +
      + + +
      +
      + + +
      +
      + + +
      - {% if config.interactive_desktop %} -
      - - -
      -
      - - -
      - {% endif %} - {% if config.kernel %} -
      - - -
      - {% endif %} -
      - - -
      -
      - - -
      -
      - - + +
      +
      + + +
      +
      + + +
      +
      + + +
      + {% if config.interactive_desktop %} +
      + + +
      +
      + + +
      + {% endif %} + {% if config.kernel %} +
      + + +
      + {% endif %} +
      + + +
      +
      + + +
      +
      + + +
      -
      -
      - +
      + +
      @@ -680,7 +1006,6 @@
      Advance
      -