Generated by JEB on 2019/08/01

PE: C:\Windows\SysWOW64\ntdll.dll Base=0x4B280000 SHA-256=044119745D7AF54D9D63C9BCD5C19BFA2A0DF648731159D2AAAF3715BB05C35A
PDB: wntdll.pdb GUID={50D4EDAA-6B13-688D-234F3E853C20E0A3} Age=1

7225 located named symbols:
0x4B2855F8: "__cdecl PrivateLoggerNotificationGuid" _PrivateLoggerNotificationGuid
0x4B2E79F0: "__stdcall RtlGetLocaleFileMappingAddress" _RtlGetLocaleFileMappingAddress@12
0x4B2867CC: "sin" ??_C@_03BLEJJJBH@sin?$AA@
0x4B387920: "__stdcall RtlpStackDbEntryIsEqual" _RtlpStackDbEntryIsEqual@8
0x4B2A4338: "an invalid address, %p " ??_C@_0BJ@DDAKPLMO@an?5invalid?5address?0?5?$CFp?6?6?$AA@
0x4B2A70F9: "__stdcall LdrpCompareServiceChecksum" _LdrpCompareServiceChecksum@8
0x4B2A3958: "Conflicting descriptors %p " ??_C@_0BM@OHMMGEEE@Conflicting?5descriptors?5?$CFp?6?$AA@
0x4B39E150: "__cdecl _OP_ATAN2jmptab" __OP_ATAN2jmptab
0x4B2E5810: "__stdcall EtwEventEnabled" _EtwEventEnabled@12
0x4B2F0EF0: "__stdcall ZwCreateEventPair" _ZwCreateEventPair@12
0x4B2A69D0: "__stdcall RtlDeleteElementGenericTableAvlEx" _RtlDeleteElementGenericTableAvlEx@8
0x4B37CB3C: "__stdcall EtwpUseDescriptorType" _EtwpUseDescriptorType@16
0x4B39F60C: "__cdecl RtlpFinalExceptionHandler" _RtlpFinalExceptionHandler
0x4B32C1C0: "__stdcall LdrQueryModuleInfoLocalLoaderLock" _LdrQueryModuleInfoLocalLoaderLock@0
0x4B295880: "AVRF: chain: dll: %ws " ??_C@_0BH@HPOEHLGK@AVRF?3?5chain?3?5dll?3?5?$CFws?6?$AA@
0x4B2E36E0: "__stdcall RtlpWnfNotificationThread" _RtlpWnfNotificationThread@16
0x4B3A171C: "__cdecl SbpContextLock" _SbpContextLock
0x4B2F1EA0: "__stdcall ZwSetSecurityObject" _ZwSetSecurityObject@12
0x4B3790A0: "__stdcall RtlpHpSegMgrVaCtxInitialize" _RtlpHpSegMgrVaCtxInitialize@16
0x4B3A4244: "__cdecl RtlpProtectedPoliciesTotalCount" _RtlpProtectedPoliciesTotalCount
0x4B33B0D3: "__fastcall RtlpPlaceActivationContextOnLiveList" @RtlpPlaceActivationContextOnLiveList@4
0x4B37C350: "__stdcall MD4Update" _MD4Update@12
0x4B32E440: "__stdcall LdrpMakeUnicodeStringFromPathElement" _LdrpMakeUnicodeStringFromPathElement@12
0x4B29907C: " NumberOfWaitingExclusive = %lx " ??_C@_0CB@ECNGEMGO@?5NumberOfWaitingExclusive?5?$DN?5?$CFlx?6@
0x4B2F1D30: "__stdcall ZwSetDriverEntryOrder" _ZwSetDriverEntryOrder@8
0x4B360C90: "__stdcall RtlSetProcessPlaceholderCompatibilityMode" _RtlSetProcessPlaceholderCompatibilityMode@4
0x4B2CF780: "__stdcall LdrpWorkCallback" _LdrpWorkCallback@12
0x4B295938: "AVRF: pid 0x%X: found dll descri" ??_C@_0EH@PGGHMMNF@AVRF?3?5pid?50x?$CFX?3?5found?5dll?5descri@
0x4B2960B0: "`AppModelPolicy_GetPolicy_Internal'::`2'::AppModelPolicy_PolicyValue_Table" ?AppModelPolicy_PolicyValue_Table@?1??AppModelPolicy_GetPolicy_Internal@@9@9
0x4B3047B0: "__stdcall NtdllStaticWndProcWorker" _NtdllStaticWndProcWorker@0
0x4B285510: "PATH" ??_C@_19IJOJOJIB@?$AAP?$AAA?$AAT?$AAH?$AA?$AA@
0x4B292918: "LdrLoadDll" ??_C@_0L@HOFGLFDL@LdrLoadDll?$AA@
0x4B2F0A30: "__stdcall ZwAccessCheckByTypeAndAuditAlarm" _ZwAccessCheckByTypeAndAuditAlarm@64
0x4B2F16F0: "__stdcall ZwOpenSemaphore" _ZwOpenSemaphore@12
0x4B36A55E: "__stdcall RtlpHpTagContextGetTag" _RtlpHpTagContextGetTag@8
0x4B353E51: "__stdcall RtlHpQuerySegmentHeapRoutine" _RtlHpQuerySegmentHeapRoutine@8
0x4B294350: "MaxDeadActivationContexts" ??_C@_1DE@CNNBJKNJ@?$AAM?$AAa?$AAx?$AAD?$AAe?$AAa?$AAd?$AAA?$AAc?$AAt?$AAi?$AAv?$AAa?$AAt?$AAi?$AAo?$AAn?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AAs?$AA?$AA@
0x4B2F0F70: "__stdcall NtCreateMailslotFile" _NtCreateMailslotFile@32
0x4B387999: "__stdcall RtlpStackDbRefCountIncrement" _RtlpStackDbRefCountIncrement@4
0x4B2AB0A0: "__stdcall RtlDestroyProcessParameters" _RtlDestroyProcessParameters@4
0x4B2DD7F0: "__stdcall RtlReleaseActivationContext" _RtlReleaseActivationContext@4
0x4B2A7910: "__stdcall RtlDelete" _RtlDelete@4
0x4B2990A0: " NumberOfActive = %lx " ??_C@_0BH@LPGHPBGB@?5NumberOfActive?5?$DN?5?$CFlx?6?$AA@
0x4B28C490: "\??\UNC\" ??_C@_1BC@MAMPPFNN@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAU?$AAN?$AAC?$AA?2?$AA?$AA@
0x4B2F0870: "__stdcall NtQueryAttributesFile" _NtQueryAttributesFile@8
0x4B2E4147: "__stdcall RtlpLangNameInMultiSzString_Size" _RtlpLangNameInMultiSzString_Size@12
0x4B292898: "\\?\UNC" ??_C@_1BA@BFGBFLGI@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAU?$AAN?$AAC?$AA?$AA@
0x4B39FDC0: "__cdecl LoadAsDataCrits" _LoadAsDataCrits
0x4B2DACB0: "__stdcall LdrUnloadAlternateResourceModuleEx" _LdrUnloadAlternateResourceModuleEx@8
0x4B286990: "Found circular dependent DLL: "%" ??_C@_0FF@BNJIFIDH@Found?5circular?5dependent?5DLL?3?5?$CC?$CF@
0x4B2F27B0: "__stdcall KiUserApcDispatcher" _KiUserApcDispatcher@16
0x4B374668: "__stdcall RtlpHpUnlockHeapForCloning" _RtlpHpUnlockHeapForCloning@8
0x4B2A5384: "TagEntries" ??_C@_0L@PPENPPKI@TagEntries?$AA@
0x4B2A56F4: "About to reallocate block at %p " ??_C@_0CO@CCGGHLHH@About?5to?5reallocate?5block?5at?5?$CFp?5@
0x4B35E036: "__stdcall RtlpGetUserLocaleName" _RtlpGetUserLocaleName@4
0x4B2F06F0: "__stdcall ZwQueryInformationThread" _ZwQueryInformationThread@20
0x4B331DEB: "__stdcall LdrpGenericExceptionFilter" _LdrpGenericExceptionFilter@8
0x4B2D7EAB: "__stdcall RtlpVerCompare" _RtlpVerCompare@20
0x4B374F53: "__stdcall RtlpHpLfhContextMaximumExtension" _RtlpHpLfhContextMaximumExtension@4
0x4B37C992: "__stdcall EtwpPopulatePrivateEnableInfoFromGuidEntry" _EtwpPopulatePrivateEnableInfoFromGuidEntry@4
0x4B34C9D0: "__stdcall RtlNumberOfSetBits" _RtlNumberOfSetBits@4
0x4B2AB211: "__stdcall vDbgPrintExWithPrefixInternal" _vDbgPrintExWithPrefixInternal@24
0x4B2C8C40: "__stdcall RtlCultureNameToLCID" _RtlCultureNameToLCID@8
0x4B2EEBD2: "__stdcall StringToGuidNoBrackets" _StringToGuidNoBrackets@8
0x4B2F17F0: "__stdcall NtPropagationFailed" _NtPropagationFailed@12
0x4B2F10F0: "__stdcall NtCreateWaitablePort" _NtCreateWaitablePort@20
0x4B2ED84F: "__stdcall EtwpReserveTraceBuffer" _EtwpReserveTraceBuffer@20
0x4B2F1010: "__stdcall ZwCreateRegistryTransaction" _ZwCreateRegistryTransaction@16
0x4B39E3E0: "__cdecl NormalizationListHead" _NormalizationListHead
0x4B2EA545: "__stdcall LdrProtectMrdataHeap" _LdrProtectMrdataHeap@4
0x4B343CC0: "__stdcall RtlIsMultiUsersInSessionSku" _RtlIsMultiUsersInSessionSku@0
0x4B36966B: "__stdcall RtlpLogHeapFreeEvent" _RtlpLogHeapFreeEvent@12
0x4B2A3B24: "%02X-%02X-%02X-%02X-%02X-%02X" ??_C@_0BO@GHBLPFMO@?$CF02X?9?$CF02X?9?$CF02X?9?$CF02X?9?$CF02X?9?$CF02X?$AA@
0x4B2F1F00: "__stdcall NtSetThreadExecutionState" _NtSetThreadExecutionState@8
0x4B2D8170: "__stdcall SwitchedRtlGetVersion_Current" _SwitchedRtlGetVersion_Current@0
0x4B37BF37: "__stdcall RtlpHpVsSubsegmentComputeSize" _RtlpHpVsSubsegmentComputeSize@12
0x4B2F2050: "__stdcall ZwThawTransactions" _ZwThawTransactions@0
0x4B355700: "__stdcall RtlpHpGCFlushCallback" _RtlpHpGCFlushCallback@8
0x4B2F3930: "__cdecl sin" _sin
0x4B2FB8B4: "__cdecl _decomp" __decomp
0x4B2DD4E9: "__stdcall TppWorkWait" _TppWorkWait@8
0x4B2F14E0: "__stdcall ZwLockFile" _ZwLockFile@40
0x4B295478: "AVrfAPILookupCallback" ??_C@_0BG@OEKPHNHP@AVrfAPILookupCallback?$AA@
0x4B296E50: "SXS/RTL: TOC entry array (offset" ??_C@_0HP@KCPGIIJM@SXS?1RTL?3?5TOC?5entry?5array?5?$CIoffset@
0x4B2CCC70: "__stdcall RtlValidAcl" _RtlValidAcl@4
0x4B2F0830: "__stdcall ZwFsControlFile" _ZwFsControlFile@40
0x4B2A5300: "MaximumAllocationSize" ??_C@_0BG@HJCIICPN@MaximumAllocationSize?$AA@
0x4B2F1A60: "__stdcall ZwQueryWnfStateData" _ZwQueryWnfStateData@24
0x4B2BE6F0: "__stdcall LdrpLoadDependentModule" _LdrpLoadDependentModule@24
0x4B2F1990: "__stdcall ZwQueryOpenSubKeys" _ZwQueryOpenSubKeys@8
0x4B2A5438: "FrontHeapLockCount" ??_C@_0BD@CCCOPIHC@FrontHeapLockCount?$AA@
0x4B2B8482: "__stdcall LdrpSignalModuleMapped" _LdrpSignalModuleMapped@4
0x4B2B5560: "__stdcall RtlGetPersistedStateLocation" _RtlGetPersistedStateLocation@28
0x4B375FEC: "__stdcall RtlpHpLfhSubsegmentInitialize" _RtlpHpLfhSubsegmentInitialize@20
0x4B2E4FBB: "__fastcall RtlpOpenBaseImageFileOptionsKey" @RtlpOpenBaseImageFileOptionsKey@4
0x4B39F0F0: "__cdecl __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUgsivzwklloUmgwooUdldGEDCUlyquivUrDIGUgkkOlyq@tp" ___@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUgsivzwklloUmgwooUdldGEDCUlyquivUrDIGUgkkOlyq@tp
0x4B2B1D50: "__stdcall RtlCreateAtomTable" _RtlCreateAtomTable@8
0x4B2EF831: "__stdcall RtlpWakeConditionVariable" _RtlpWakeConditionVariable@12
0x4B2A5C94: "Enabling heap debug options " ??_C@_0BN@KLOBBEB@Enabling?5heap?5debug?5options?6?$AA@
0x4B2D220F: "__stdcall LdrpPrepareModuleForExecution" _LdrpPrepareModuleForExecution@8
0x4B37A27A: "__stdcall RtlpHpSegSubAllocate" _RtlpHpSegSubAllocate@20
0x4B2ABB80: "__stdcall RtlpComputeExePath" _RtlpComputeExePath@8
0x4B34DB50: "__stdcall RtlCheckBootStatusIntegrity" _RtlCheckBootStatusIntegrity@8
0x4B2A6800: "__stdcall RtlpLoadMachineUIByPolicy" _RtlpLoadMachineUIByPolicy@12
0x4B2E7223: "__stdcall RtlIsValidHandler" _RtlIsValidHandler@12
0x4B2A71D1: "__stdcall RtlpDereferenceAtom" _RtlpDereferenceAtom@12
0x4B285CC0: "__cdecl szDaylightBias" _szDaylightBias
0x4B364BBE: "__stdcall RtlpTraceDatabaseAllocate" _RtlpTraceDatabaseAllocate@12
0x4B2F21B0: "__stdcall ZwWow64CsrClientCallServer" _ZwWow64CsrClientCallServer@16
0x4B2A6990: "__stdcall RtlDeleteElementGenericTableAvl" _RtlDeleteElementGenericTableAvl@8
0x4B288320: "\Registry\Machine\Software\Micro" ??_C@_1LI@FFKDHKIH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B28C28C: "\Device\IPT" ??_C@_1BI@JCJLLHAP@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAI?$AAP?$AAT?$AA?$AA@
0x4B2F21C0: "__stdcall ZwWow64CsrAllocateCaptureBuffer" _ZwWow64CsrAllocateCaptureBuffer@8
0x4B28780C: "KnownDllPath" ??_C@_1BK@HNONDBBL@?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x4B33FD80: "__stdcall LdrProcessRelocationBlockLongLong" _LdrProcessRelocationBlockLongLong@24
0x4B2925EC: "BinaryName" ??_C@_1BG@JLPNDPHA@?$AAB?$AAi?$AAn?$AAa?$AAr?$AAy?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x4B37DB4C: "__stdcall EtwpFlushActiveBuffers" _EtwpFlushActiveBuffers@8
0x4B35901E: "__stdcall RtlpCopyLegacyContextX86" _RtlpCopyLegacyContextX86@16
0x4B2F3712: "__cdecl _CIpow_default" __CIpow_default
0x4B37E150: "__stdcall EtwpFreeStreamIndexMap" _EtwpFreeStreamIndexMap@4
0x4B36B5CB: "__stdcall RtlDebugFreeHeap" _RtlDebugFreeHeap@12
0x4B34DDF0: "__stdcall RtlGetSetBootStatusData" _RtlGetSetBootStatusData@24
0x4B29487C: "Import '%s' of DLL '%wZ' is redi" ??_C@_0CP@FKLACBBI@Import?5?8?$CFs?8?5of?5DLL?5?8?$CFwZ?8?5is?5redi@
0x4B285CDC: "__cdecl szDaylightName" _szDaylightName
0x4B3781E7: "__stdcall RtlpHpSegFree" _RtlpHpSegFree@12
0x4B2E62DB: "__stdcall RtlStringCbCopyExW" _RtlStringCbCopyExW@24
0x4B2ABBD0: "__stdcall RtlNewSecurityObject" _RtlNewSecurityObject@24
0x4B304D70: "__stdcall RtlLargeIntegerShiftLeft" _RtlLargeIntegerShiftLeft@12
0x4B2E5D99: "__stdcall RtlpInitMuiCriticalSection" _RtlpInitMuiCriticalSection@8
0x4B2A44DC: " *** Unhandled exception 0x%08" ??_C@_0DE@HMPOKDEK@?6?6?5?$CK?$CK?$CK?5Unhandled?5exception?50x?$CF08@
0x4B2A48E8: "heap_failure_buffer_underrun" ??_C@_0BN@KBHNCJCM@heap_failure_buffer_underrun?$AA@
0x4B296B14: "SXS: %s() passed the empty activ" ??_C@_0DE@MPACHFEL@SXS?3?5?$CFs?$CI?$CJ?5passed?5the?5empty?5activ@
0x4B2F0770: "__stdcall ZwSetEventBoostPriority" _ZwSetEventBoostPriority@4
0x4B294550: "!!! Detour detected, disable par" ??_C@_0CP@HMJKNAEI@?$CB?$CB?$CB?5Detour?5detected?0?5disable?5par@
0x4B354946: "__stdcall RtlpAllocateTags" _RtlpAllocateTags@8
0x4B2B90F7: "__stdcall LdrpResolveDelayLoadDescriptor" _LdrpResolveDelayLoadDescriptor@8
0x4B2F1750: "__stdcall NtOpenTransactionManager" _NtOpenTransactionManager@24
0x4B351842: "__stdcall RtlpGetMultiStringLength" _RtlpGetMultiStringLength@12
0x4B281928: "__cdecl TppJobpCleanupGroupMemberVFuncs" _TppJobpCleanupGroupMemberVFuncs
0x4B3A181C: "__cdecl LdrDelegatedKiUserCallbackDispatcher" _LdrDelegatedKiUserCallbackDispatcher
0x4B2F7340: "__cdecl sscanf" _sscanf
0x4B2A4210: "This means the data could not be" ??_C@_0GN@CEMLJLGA@This?5means?5the?5data?5could?5not?5be@
0x4B382AC3: "__stdcall RtlpTpIoLookup" _RtlpTpIoLookup@12
0x4B2D61BA: "__stdcall RtlpFindEntry" _RtlpFindEntry@8
0x4B3676A0: "__stdcall RtlpNtEnumerateSubKey" _RtlpNtEnumerateSubKey@16
0x4B2995F0: " *** Assertion failed: %s%s *** " ??_C@_0DO@CDJIIIPD@?6?$CK?$CK?$CK?5Assertion?5failed?3?5?$CFs?$CFs?6?$CK?$CK?$CK?5@
0x4B39E014: "__cdecl _logemax" __logemax
0x4B32E69A: "__stdcall _TlgCreateWsz" __TlgCreateWsz@8
0x4B2F8040: "__cdecl wcschr" _wcschr
0x4B2F82C0: "__cdecl wcsrchr" _wcsrchr
0x4B3A17C0: "__cdecl RtlpUserPolicies" _RtlpUserPolicies
0x4B2E8510: "__stdcall RtlCreateTagHeap" _RtlCreateTagHeap@16
0x4B3045C0: "__stdcall NtdllListBoxWndProc_A" _NtdllListBoxWndProc_A@0
0x4B286BC0: "LdrpInitializeDllPath" ??_C@_0BG@LHCPLDFO@LdrpInitializeDllPath?$AA@
0x4B2A36CC: "((PHEAP_ENTRY)LastKnownEntry <= " ??_C@_0CH@GBCCOPIC@?$CI?$CIPHEAP_ENTRY?$CJLastKnownEntry?5?$DM?$DN?5@
0x4B286A30: "LdrpInitializeImportRedirection" ??_C@_0CA@BIAHBCHB@LdrpInitializeImportRedirection?$AA@
0x4B3A15A8: "__cdecl LdrpTlsLock" _LdrpTlsLock
0x4B2A582C: "RtlSetUserValueHeap" ??_C@_0BE@HNLMHCKB@RtlSetUserValueHeap?$AA@
0x4B2B5247: "__stdcall IsSystemRootPath" _IsSystemRootPath@8
0x4B3A0C1C: "__cdecl LdrpIsSecureProcess" _LdrpIsSecureProcess
0x4B2F08B0: "__stdcall NtAdjustPrivilegesToken" _NtAdjustPrivilegesToken@24
0x4B2927A8: "CLIENT(ntdll): Found Execute=1, " ??_C@_0GB@MCBLNHJM@CLIENT?$CIntdll?$CJ?3?5Found?5Execute?$DN1?0?5@
0x4B2F880C: "__cdecl _rttospop" __rttospop
0x4B35FE8E: "__stdcall GetUTF32" _GetUTF32@4
0x4B2AB4F0: "__stdcall NtdllpFreeStringRoutine" _NtdllpFreeStringRoutine@4
0x4B3A1718: "__cdecl TppPoolpGlobalPoolLock" _TppPoolpGlobalPoolLock
0x4B2A4728: "Trace database: failing attempt " ??_C@_0EC@DNEJJGPP@Trace?5database?3?5failing?5attempt?5@
0x4B3636B0: "__stdcall RtlLargeIntegerDivide" _RtlLargeIntegerDivide@20
0x4B380509: "__stdcall EtwpWriteRemainingCompressedData" _EtwpWriteRemainingCompressedData@12
0x4B2AC860: "__stdcall WinSqmSetIfMinDWORD" _WinSqmSetIfMinDWORD@12
0x4B357D10: "__stdcall RtlCreateHashTableEx" _RtlCreateHashTableEx@16
0x4B2D7172: "__stdcall TppPoolUpdateNodeRelation" _TppPoolUpdateNodeRelation@4
0x4B292A34: "Merging a cycle rooted at %wZ. " ??_C@_0CA@MDBLHFGL@Merging?5a?5cycle?5rooted?5at?5?$CFwZ?4?6?$AA@
0x4B2F0F10: "__stdcall ZwCreateIoCompletion" _ZwCreateIoCompletion@16
0x4B347880: "__stdcall RtlConvertSharedToExclusive" _RtlConvertSharedToExclusive@4
0x4B2935A0: "Finding the shim engine entry fa" ??_C@_0DK@PGGGOCMM@Finding?5the?5shim?5engine?5entry?5fa@
0x4B2E5BC0: "__stdcall RtlLengthSid" _RtlLengthSid@4
0x4B358472: "__stdcall RtlpGetBucketIndex" _RtlpGetBucketIndex@8
0x4B295DF4: "__cdecl WNF_WER_SERVICE_START" _WNF_WER_SERVICE_START
0x4B3780A6: "__stdcall RtlpHpSegContextReserve" _RtlpHpSegContextReserve@12
0x4B37A892: "__stdcall RtlCSparseBitmapFindBitSetCapped" _RtlCSparseBitmapFindBitSetCapped@12
0x4B2F880E: "__cdecl _rtnospop" __rtnospop
0x4B3652E0: "__stdcall RtlpMuiFreeLangRegistryInfo" _RtlpMuiFreeLangRegistryInfo@4
0x4B33C5E0: "__stdcall AlpcUnregisterCompletionListWorkerThread" _AlpcUnregisterCompletionListWorkerThread@4
0x4B295CF0: "\WindowsErrorReportingServicePor" ??_C@_1EE@NIHCKLHD@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAE?$AAr?$AAr?$AAo?$AAr?$AAR?$AAe?$AAp?$AAo?$AAr?$AAt?$AAi?$AAn?$AAg?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAP?$AAo?$AAr@
0x4B2E6EF0: "__stdcall RtlUnwind" _RtlUnwind@16
0x4B3A1650: "__cdecl RtlpFlsLock" _RtlpFlsLock
0x4B2B1020: "__stdcall RtlEqualPrefixSid" _RtlEqualPrefixSid@8
0x4B2F0A50: "__stdcall ZwWaitForMultipleObjects" _ZwWaitForMultipleObjects@20
0x4B295F78: "%d" ??_C@_15KNBIKKIN@?$AA?$CF?$AAd?$AA?$AA@
0x4B294738: "Init routine %p of DLL "%wZ" rai" ??_C@_0DF@POFIHGBG@Init?5routine?5?$CFp?5of?5DLL?5?$CC?$CFwZ?$CC?5rai@
0x4B3A1708: "__cdecl TppPoolpListLock" _TppPoolpListLock
0x4B2F274D: "__fastcall _guard_check_icall" @_guard_check_icall@4
0x4B2E9F20: "__stdcall RtlRegisterThreadWithCsrss" _RtlRegisterThreadWithCsrss@0
0x4B2F0820: "__stdcall NtQueryTimer" _NtQueryTimer@20
0x4B358250: "__stdcall RtlRemoveEntryHashTable" _RtlRemoveEntryHashTable@12
0x4B2F1EC0: "__stdcall NtSetSystemEnvironmentValueEx" _NtSetSystemEnvironmentValueEx@20
0x4B33BEE0: "__stdcall CsrCaptureTimeout" _CsrCaptureTimeout@8
0x4B2E7BD0: "__stdcall AlpcGetMessageAttribute" _AlpcGetMessageAttribute@8
0x4B33BF40: "__stdcall CsrIdentifyAlertableThread" _CsrIdentifyAlertableThread@0
0x4B2DA190: "__stdcall EtwEventUnregister" _EtwEventUnregister@8
0x4B3587E0: "__stdcall RtlInitializeExtendedContext2" _RtlInitializeExtendedContext2@20
0x4B360B70: "__stdcall RtlInterlockedPushListSListEx" _RtlInterlockedPushListSListEx@16
0x4B35D42A: "__stdcall RtlComputeLfnChecksum" _RtlComputeLfnChecksum@4
0x4B2AAD40: "__stdcall RtlpAddHeapToProtectedList" _RtlpAddHeapToProtectedList@4
0x4B2BDF40: "__stdcall LdrpPreprocessDllName" _LdrpPreprocessDllName@16
0x4B351257: "__stdcall RtlpGetCompleteLanguageFallback" _RtlpGetCompleteLanguageFallback@20
0x4B373993: "__stdcall RtlpHpHeapExtendContext" _RtlpHpHeapExtendContext@8
0x4B2BFAC0: "__stdcall RtlReleaseSRWLockExclusive" _RtlReleaseSRWLockExclusive@4
0x4B2A3734: "((LONG)FreeEntry->Size > 1)" ??_C@_0BM@PABNNLLD@?$CI?$CILONG?$CJFreeEntry?9?$DOSize?5?$DO?51?$CJ?$AA@
0x4B2DD000: "__stdcall RtlpTpWorkUnposted" _RtlpTpWorkUnposted@8
0x4B2D31E0: "__stdcall TpAllocWait" _TpAllocWait@16
0x4B2F0970: "__stdcall NtCreateProcessEx" _NtCreateProcessEx@36
0x4B376CEE: "__stdcall RtlpHpLargeAllocationProtect" _RtlpHpLargeAllocationProtect@8
0x4B2F0D10: "__stdcall NtAlpcQueryInformation" _NtAlpcQueryInformation@20
0x4B373471: "__stdcall RtlpHpHeapCompact" _RtlpHpHeapCompact@8
0x4B32C2A0: "__stdcall LdrQueryProcessModuleInformationEx2" _LdrQueryProcessModuleInformationEx2@20
0x4B362124: "__stdcall Normalization__GetThirdAndLastDecomposedCharPlane0" _Normalization__GetThirdAndLastDecomposedCharPlane0@8
0x4B286900: "__cdecl AeSbImplEvent" _AeSbImplEvent
0x4B2B3361: "__stdcall LdrpValidPathComponentsMask" _LdrpValidPathComponentsMask@0
0x4B2AB330: "__stdcall RtlEnumerateGenericTableWithoutSplayingAvl" _RtlEnumerateGenericTableWithoutSplayingAvl@8
0x4B34E262: "__stdcall RtlpGetSetBootStatusData" _RtlpGetSetBootStatusData@24
0x4B2A76F0: "__stdcall RtlInsertElementGenericTableFull" _RtlInsertElementGenericTableFull@24
0x4B36E1D5: "__stdcall RtlpLowFragHeapFlushCaches" _RtlpLowFragHeapFlushCaches@4
0x4B37A004: "__stdcall RtlpHpSegSegmentComputeCommit" _RtlpHpSegSegmentComputeCommit@8
0x4B2E3660: "__stdcall RtlUnsubscribeWnfStateChangeNotification" _RtlUnsubscribeWnfStateChangeNotification@4
0x4B2B74B6: "__stdcall LdrpFindKnownDll" _LdrpFindKnownDll@16
0x4B341BE0: "__stdcall RtlUpcaseUnicodeToOemN" _RtlUpcaseUnicodeToOemN@20
0x4B29439C: "GlobalFlag2" ??_C@_1BI@CLFLIEOH@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AAF?$AAl?$AAa?$AAg?$AA2?$AA?$AA@
0x4B2E5D4C: "__stdcall RtlpSetProcMergedLangList" _RtlpSetProcMergedLangList@8
0x4B296778: "(This->PrivateDynamicallyAllocat" ??_C@_0GP@CKEDAPEP@?$CIThis?9?$DOPrivateDynamicallyAllocat@
0x4B2F14D0: "__stdcall ZwLoadKeyEx" _ZwLoadKeyEx@32
0x4B3A1760: "__cdecl g_pShimmedModuleList" _g_pShimmedModuleList
0x4B2B5137: "__stdcall GetOverlayFilePath" _GetOverlayFilePath@16
0x4B2F22B0: "__stdcall NtWow64IsProcessorFeaturePresent" _NtWow64IsProcessorFeaturePresent@4
0x4B367C99: "__stdcall RtlpGetHeapInterceptorIndex" _RtlpGetHeapInterceptorIndex@4
0x4B2A4308: "read from" ??_C@_09NILFLICP@read?5from?$AA@
0x4B3322A0: "__stdcall RtlFinalReleaseOutOfProcessMemoryStream" _RtlFinalReleaseOutOfProcessMemoryStream@4
0x4B2A5DE0: "runtimebroker.exe" ??_C@_1CE@DBBJFFBK@?$AAr?$AAu?$AAn?$AAt?$AAi?$AAm?$AAe?$AAb?$AAr?$AAo?$AAk?$AAe?$AAr?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x4B3045E0: "__stdcall NtdllMDIClientWndProc_A" _NtdllMDIClientWndProc_A@0
0x4B35E3AB: "__stdcall RtlpGetNtProductTypeFromRegistry" _RtlpGetNtProductTypeFromRegistry@4
0x4B28488C: "InstallLanguageFallback" ??_C@_1DA@LMPHJKLA@?$AAI?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAF?$AAa?$AAl?$AAl?$AAb?$AAa?$AAc?$AAk?$AA?$AA@
0x4B37A200: "__stdcall RtlpHpSegSizeInternal" _RtlpHpSegSizeInternal@20
0x4B2E65FE: "__stdcall __RtlUserThreadStart" ___RtlUserThreadStart@8
0x4B32BD50: "__stdcall RtlPushFrame" _RtlPushFrame@4
0x4B2D3780: "__stdcall RtlProcessFlsData" _RtlProcessFlsData@4
0x4B2B76B5: "__stdcall CompatCachepLookupCdb" _CompatCachepLookupCdb@8
0x4B2B8FD2: "__stdcall GetLCIDFromLangListNodeWithLICCheck" _GetLCIDFromLangListNodeWithLICCheck@20
0x4B36792A: "__stdcall GetUCBytes" _GetUCBytes@12
0x4B2F21E0: "__stdcall NtWow64CsrAllocateMessagePointer" _NtWow64CsrAllocateMessagePointer@12
0x4B358C91: "__stdcall RtlpCopyLegacyContextAmd64" _RtlpCopyLegacyContextAmd64@16
0x4B2F7DA0: "__cdecl strtol" _strtol
0x4B3A4328: "__cdecl LdrpMrdataUnprotected" _LdrpMrdataUnprotected
0x4B2E704C: "__stdcall RtlDispatchException" _RtlDispatchException@8
0x4B2F8965: "__cdecl _fload_withFB" __fload_withFB
0x4B3322E0: "__stdcall RtlSeekMemoryStream" _RtlSeekMemoryStream@20
0x4B2C113F: "__stdcall NtdllpAllocateStringRoutine" _NtdllpAllocateStringRoutine@4
0x4B377654: "__stdcall RtlpHpVaMgrCtxInitialize" _RtlpHpVaMgrCtxInitialize@4
0x4B286D94: "HEAP: " ??_C@_06FIAELKPP@HEAP?3?5?$AA@
0x4B2F1640: "__stdcall NtOpenKeyEx" _NtOpenKeyEx@16
0x4B2D2AB0: "__stdcall TpSetTimerEx" _TpSetTimerEx@16
0x4B2F0B10: "__stdcall ZwAcquireProcessActivityReference" _ZwAcquireProcessActivityReference@12
0x4B2F1770: "__stdcall NtPrePrepareComplete" _NtPrePrepareComplete@8
0x4B2DDE87: "__stdcall RtlpUninitializeAssemblyStorageMap" _RtlpUninitializeAssemblyStorageMap@4
0x4B2F7720: "__cdecl strncat" _strncat
0x4B375C94: "__stdcall RtlpHpLfhSubsegmentFreeBlock" _RtlpHpLfhSubsegmentFreeBlock@16
0x4B369AC2: "__stdcall RtlpLogHeapSubSegmentInitialize" _RtlpLogHeapSubSegmentInitialize@20
0x4B281410: "__cdecl LdrpLogLevelStateTable" _LdrpLogLevelStateTable
0x4B2A6AB0: "__stdcall RtlInsertElementGenericTableAvl" _RtlInsertElementGenericTableAvl@16
0x4B2919B8: "__cdecl _TraceLoggingMetadata" __TraceLoggingMetadata
0x4B2F1890: "__stdcall NtQueryFullAttributesFile" _NtQueryFullAttributesFile@8
0x4B2E0930: "__stdcall RtlSleepConditionVariableSRW" _RtlSleepConditionVariableSRW@16
0x4B2F04D0: "__stdcall NtCallbackReturn" _NtCallbackReturn@12
0x4B3A17B0: "__cdecl RtlpHeapErrorHandlerThreshold" _RtlpHeapErrorHandlerThreshold
0x4B32BA5C: "__stdcall RtlpQueryPseudoEnvironmentVariable" _RtlpQueryPseudoEnvironmentVariable@16
0x4B295A74: "AVRF: failed to enable handle ch" ??_C@_0DF@OPMKFJMM@AVRF?3?5failed?5to?5enable?5handle?5ch@
0x4B2FD2F0: "__cdecl _splitpath_s" __splitpath_s
0x4B2E2780: "__stdcall EtwRegisterTraceGuidsW" _EtwRegisterTraceGuidsW@32
0x4B3567D0: "__stdcall RtlpSetHeapDebuggingInformation" _RtlpSetHeapDebuggingInformation@8
0x4B2F09C0: "__stdcall NtResumeThread" _NtResumeThread@8
0x4B35BF56: "__stdcall RtlpGetHeapBlock" _RtlpGetHeapBlock@4
0x4B2FAC04: "__cdecl _ctrandisp2" __ctrandisp2
0x4B3044A0: "__stdcall NtdllDesktopWndProc_A" _NtdllDesktopWndProc_A@0
0x4B2819A0: "__cdecl RtlpDosCOMDevice" _RtlpDosCOMDevice
0x4B2E7AD0: "__stdcall RtlQueryImageFileExecutionOptions" _RtlQueryImageFileExecutionOptions@28
0x4B347ABA: "__stdcall RtlpDbgPrintCriticalSectionTimeout" _RtlpDbgPrintCriticalSectionTimeout@12
0x4B34EDC0: "__stdcall RtlGetFileMUIPath" _RtlGetFileMUIPath@28
0x4B38590A: "__stdcall PsspQueryInfoClass_10" _PsspQueryInfoClass_10@8
0x4B2AAA17: "__fastcall RtlpRemoveUCRBlock" @RtlpRemoveUCRBlock@8
0x4B286DE4: "RtlUnlockHeap" ??_C@_0O@BAFDFOCI@RtlUnlockHeap?$AA@
0x4B3785F0: "__stdcall RtlpHpSegLfhAllocate" _RtlpHpSegLfhAllocate@20
0x4B35FFCC: "__stdcall decode_digit" _decode_digit@4
0x4B2E06D0: "__stdcall RtlpTimeFieldsToTime" _RtlpTimeFieldsToTime@12
0x4B37241F: "__stdcall RtlpCalculateSubsegmentSizeIndex" _RtlpCalculateSubsegmentSizeIndex@8
0x4B2D3A93: "__stdcall TppCleanupGroupMemberInitialize" _TppCleanupGroupMemberInitialize@20
0x4B2FB231: "__cdecl _except1" __except1
0x4B2CCA67: "__stdcall RtlpMuiRegTryToAppendLangId" _RtlpMuiRegTryToAppendLangId@20
0x4B2E31F0: "__stdcall RtlGetUserInfoHeap" _RtlGetUserInfoHeap@20
0x4B2F1B30: "__stdcall NtRemoveIoCompletionEx" _NtRemoveIoCompletionEx@24
0x4B292858: "CLIENT(ntdll): Processing sectio" ??_C@_0CP@EMMOKNIC@CLIENT?$CIntdll?$CJ?3?5Processing?5sectio@
0x4B369BAD: "__stdcall RtlpLogHeapValidateEvent" _RtlpLogHeapValidateEvent@4
0x4B3A0BE0: "__cdecl LdrpSuppressedExportOverrideListPtr" _LdrpSuppressedExportOverrideListPtr
0x4B2A36B4: "(HeapHandle != NULL)" ??_C@_0BF@JMLBIMHL@?$CIHeapHandle?5?$CB?$DN?5NULL?$CJ?$AA@
0x4B2952A4: "Xbox One X DevKit" ??_C@_1CE@OIJJDGME@?$AAX?$AAb?$AAo?$AAx?$AA?5?$AAO?$AAn?$AAe?$AA?5?$AAX?$AA?5?$AAD?$AAe?$AAv?$AAK?$AAi?$AAt?$AA?$AA@
0x4B3444F0: "__stdcall RtlRunEncodeUnicodeString" _RtlRunEncodeUnicodeString@8
0x4B35EC9B: "__stdcall RtlpGuardIsSuppressedAddress" _RtlpGuardIsSuppressedAddress@4
0x4B286E30: "RTL: RtlNtStatusToDosError(0x%lx" ??_C@_0EB@CMBCAIKC@RTL?3?5RtlNtStatusToDosError?$CI0x?$CFlx@
0x4B28190C: "__cdecl RtlDecompressFragmentProcs" _RtlDecompressFragmentProcs
0x4B3A4240: "__cdecl RtlpProtectedPoliciesActiveCount" _RtlpProtectedPoliciesActiveCount
0x4B32C51C: "__stdcall LdrQueryProcessModuleInformationEx" _LdrQueryProcessModuleInformationEx@20
0x4B2F0DC0: "__stdcall NtCancelTimer2" _NtCancelTimer2@8
0x4B39FD88: "__cdecl NlsAnsiToUnicodeData" _NlsAnsiToUnicodeData
0x4B2F40F0: "__cdecl atoi" _atoi
0x4B3A1AB8: "__cdecl RtlHeapProcessFlags" _RtlHeapProcessFlags
0x4B2923A8: "__cdecl LoaderFatalErrorThread" _LoaderFatalErrorThread
0x4B2F9300: "__cdecl __ascii_memicmp" ___ascii_memicmp
0x4B2F0490: "__stdcall ZwWorkerFactoryWorkerReady" _ZwWorkerFactoryWorkerReady@4
0x4B32B470: "__stdcall LdrCallEnclave" _LdrCallEnclave@12
0x4B2F2080: "__stdcall NtUmsThreadYield" _NtUmsThreadYield@4
0x4B281920: "__cdecl RtlpInterceptorRoutines" _RtlpInterceptorRoutines
0x4B35DE37: "__stdcall RtlpGetCustomCultureData" _RtlpGetCustomCultureData@16
0x4B2F4100: "__cdecl atol" _atol
0x4B2F3562: "__cdecl _CIcos_default" __CIcos_default
0x4B2F0900: "__stdcall NtYieldExecution" _NtYieldExecution@0
0x4B2B122D: "__stdcall RtlpCompareAces" _RtlpCompareAces@16
0x4B3312DE: "__stdcall LdrpProcessMachineMismatch" _LdrpProcessMachineMismatch@4
0x4B2F6110: "__cdecl iswlower" _iswlower
0x4B381E73: "__stdcall TppETWTimerExpiration" _TppETWTimerExpiration@8
0x4B2A52F0: "TotalFreeSize" ??_C@_0O@POJGLEGF@TotalFreeSize?$AA@
0x4B304E20: "__stdcall RtlLargeIntegerSubtract" _RtlLargeIntegerSubtract@16
0x4B2F10A0: "__stdcall ZwCreateTokenEx" _ZwCreateTokenEx@68
0x4B341120: "__stdcall LdrpResSetFilePointer" _LdrpResSetFilePointer@8
0x4B33F644: "__stdcall RtlpCreateIFEOKeyFilterKey" _RtlpCreateIFEOKeyFilterKey@16
0x4B32C890: "__stdcall LdrVerifyImageMatchesChecksumEx" _LdrVerifyImageMatchesChecksumEx@8
0x4B2F0FE0: "__stdcall NtCreateProcess" _NtCreateProcess@32
0x4B2F04A0: "__stdcall ZwAcceptConnectPort" _ZwAcceptConnectPort@24
0x4B298CAC: "DO" ??_C@_15BJIDFOEN@?$AAD?$AAO?$AA?$AA@
0x4B284AB0: "Software\Policies\Microsoft\Cont" ??_C@_1GE@FKCMPCCE@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt@
0x4B3A6360: "__cdecl __security_cookie" ___security_cookie
0x4B2948AC: "Unmapping DLL "%wZ" " ??_C@_0BF@EPJGNFBO@Unmapping?5DLL?5?$CC?$CFwZ?$CC?6?$AA@
0x4B34C7A0: "__stdcall RtlInterlockedClearBitRun" _RtlInterlockedClearBitRun@12
0x4B281098: "__cdecl RtlpDosCONDevice" _RtlpDosCONDevice
0x4B2B36A5: "__stdcall LdrpFreeUnicodeString" _LdrpFreeUnicodeString@4
0x4B2F1510: "__stdcall NtLockVirtualMemory" _NtLockVirtualMemory@16
0x4B294F48: "Windows.8828080" ??_C@_1CA@GMIGOPOJ@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AA8?$AA8?$AA2?$AA8?$AA0?$AA8?$AA0?$AA?$AA@
0x4B2F25C0: "__fastcall __security_check_cookie" @__security_check_cookie@4
0x4B2E5140: "__stdcall LdrInitializeThunk" _LdrInitializeThunk@8
0x4B336FA3: "__stdcall AvrfMiniLoadDll" _AvrfMiniLoadDll@20
0x4B34BF30: "__stdcall RtlFindLeastSignificantBit" _RtlFindLeastSignificantBit@8
0x4B281100: "__cdecl LdrpKernel32DllName" _LdrpKernel32DllName
0x4B32D404: "__stdcall LdrpEventAddAnsiString" _LdrpEventAddAnsiString@16
0x4B343C30: "__stdcall RtlGetTokenNamedObjectPath" _RtlGetTokenNamedObjectPath@12
0x4B2958B8: "AVRF: Found duplicate for (%ws: " ??_C@_0CM@JIGKAILN@AVRF?3?5Found?5duplicate?5for?5?$CI?$CFws?3?5@
0x4B2F0EA0: "__stdcall NtCreateDebugObject" _NtCreateDebugObject@16
0x4B2E5DF2: "__stdcall RtlpGetWindowsPolicy" _RtlpGetWindowsPolicy@16
0x4B357650: "__stdcall RtlDecompressFragment" _RtlDecompressFragment@32
0x4B2C9B75: "__stdcall LdrpMergeLangFallbackLists" _LdrpMergeLangFallbackLists@36
0x4B3396C0: "__stdcall RtlQueryWnfStateDataWithExplicitScope" _RtlQueryWnfStateDataWithExplicitScope@28
0x4B2E8E80: "__stdcall RtlGetCurrentProcessorNumberEx" _RtlGetCurrentProcessorNumberEx@4
0x4B352670: "__stdcall RtlpSetPreferredUILanguages" _RtlpSetPreferredUILanguages@12
0x4B367899: "__stdcall RtlCreateInvertedFunctionTableCacheEntry" _RtlCreateInvertedFunctionTableCacheEntry@8
0x4B344080: "__stdcall RtlRemovePrivileges" _RtlRemovePrivileges@12
0x4B353D80: "__stdcall RtlEnumProcessHeaps" _RtlEnumProcessHeaps@8
0x4B36E860: "__stdcall RtlpValidateLFHBlock" _RtlpValidateLFHBlock@8
0x4B2E7C73: "__stdcall LdrpHandleReplacedModule" _LdrpHandleReplacedModule@4
0x4B2D0F00: "__stdcall TppAlpcpCallbackEpilog" _TppAlpcpCallbackEpilog@4
0x4B2F1140: "__stdcall NtDeleteAtom" _NtDeleteAtom@4
0x4B3051C3: FinalExceptionHandlerPad19
0x4B3051D7: FinalExceptionHandlerPad39
0x4B2F0800: "__stdcall ZwQuerySystemInformation" _ZwQuerySystemInformation@16
0x4B383980: "__stdcall PssNtDuplicateSnapshot" _PssNtDuplicateSnapshot@20
0x4B3051CD: FinalExceptionHandlerPad29
0x4B3051EB: FinalExceptionHandlerPad59
0x4B38592A: "__stdcall PsspQueryInfoClass_9" _PsspQueryInfoClass_9@8
0x4B3051E1: FinalExceptionHandlerPad49
0x4B2D3353: "__stdcall TppInitializeTimerSubQueue" _TppInitializeTimerSubQueue@12
0x4B2F6070: "__cdecl iswalnum" _iswalnum
0x4B3A17FC: "__cdecl LdrDelegatedKiUserApcDispatcher" _LdrDelegatedKiUserApcDispatcher
0x4B2F0D90: "__stdcall ZwCallEnclave" _ZwCallEnclave@16
0x4B338A81: "__stdcall WerpPathTail" _WerpPathTail@4
0x4B36EE41: "__stdcall RtlpHpEnvAllocVA" _RtlpHpEnvAllocVA@36
0x4B2F0950: "__stdcall NtFlushBuffersFile" _NtFlushBuffersFile@8
0x4B2D9839: "__stdcall RtlpVerGetConditionMask" _RtlpVerGetConditionMask@12
0x4B2E13DD: "__stdcall LdrpCreateLangFallbackList" _LdrpCreateLangFallbackList@16
0x4B2AC4B0: "__stdcall RtlQueryImageFileKeyOption" _RtlQueryImageFileKeyOption@24
0x4B2924B8: "__cdecl HeapSnapshotSnap" _HeapSnapshotSnap
0x4B2F2190: "__stdcall NtWow64CsrClientConnectToServer" _NtWow64CsrClientConnectToServer@20
0x4B284640: "__cdecl szFirstEntry" _szFirstEntry
0x4B35FE6E: "__stdcall FindEmailAt" _FindEmailAt@8
0x4B2F1820: "__stdcall NtQueryBootEntryOrder" _NtQueryBootEntryOrder@8
0x4B32CEF2: "__stdcall LdrpFindDelayloadedMethodInDescriptor" _LdrpFindDelayloadedMethodInDescriptor@12
0x4B2A3D58: "\Registry\Machine\System\Current" ??_C@_1IE@CPEFALAA@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B374A09: "__stdcall RtlpHpLfhBucketSubsegmentStatsUpdate" _RtlpHpLfhBucketSubsegmentStatsUpdate@8
0x4B2C1F50: "__stdcall RtlpAllocateHeapInternal" _RtlpAllocateHeapInternal@16
0x4B365A0E: "__stdcall RtlpMuiRegGetFallbackLanguageInfoByName" _RtlpMuiRegGetFallbackLanguageInfoByName@20
0x4B292F34: "#%u" ??_C@_03PCCJIL@?$CD?$CFu?$AA@
0x4B3A0928: "__cdecl RtlpTimeout" _RtlpTimeout
0x4B2E4A31: "__stdcall RtlpQueryPackageIdentityAttributes" _RtlpQueryPackageIdentityAttributes@20
0x4B36FE5E: "__stdcall RtlCompressBufferXpressHuffStandard" _RtlCompressBufferXpressHuffStandard@36
0x4B2F0A00: "__stdcall ZwQueryEvent" _ZwQueryEvent@20
0x4B2A9FFE: "__stdcall SwapSplayLinks" _SwapSplayLinks@8
0x4B2A3AFC: "%x" ??_C@_02NJNOFBBI@?$CFx?$AA@
0x4B3A1240: "__cdecl LdrpLoaderLockAcquisitionCount" _LdrpLoaderLockAcquisitionCount
0x4B2F17D0: "__stdcall ZwPrivilegedServiceAuditAlarm" _ZwPrivilegedServiceAuditAlarm@20
0x4B2DB2F5: "__stdcall ValidatePointer" _ValidatePointer@12
0x4B2F19E0: "__stdcall ZwQuerySecurityObject" _ZwQuerySecurityObject@20
0x4B37BF8A: "__stdcall RtlpHpVsSubsegmentCreate" _RtlpHpVsSubsegmentCreate@12
0x4B2BD3A0: "__stdcall RtlGetNtSystemRoot" _RtlGetNtSystemRoot@0
0x4B2F1790: "__stdcall ZwPrepareComplete" _ZwPrepareComplete@8
0x4B3A14C8: "__cdecl RtlpSystemDirs" _RtlpSystemDirs
0x4B2F1380: "__stdcall NtGetCurrentProcessorNumberEx" _NtGetCurrentProcessorNumberEx@4
0x4B2F2517: "__cdecl _invalid_parameter" __invalid_parameter
0x4B2931C8: "NtWaitForSingleObject failed wit" ??_C@_0EK@IHLLLFIO@NtWaitForSingleObject?5failed?5wit@
0x4B2B5370: "__stdcall RtlPrefixUnicodeString" _RtlPrefixUnicodeString@12
0x4B2CA872: "__stdcall LdrpInitializeGraphRecurse" _LdrpInitializeGraphRecurse@12
0x4B34CB20: "__stdcall RtlNumberOfSetBitsInRange" _RtlNumberOfSetBitsInRange@12
0x4B2F0850: "__stdcall NtCloseObjectAuditAlarm" _NtCloseObjectAuditAlarm@12
0x4B2E4D72: "__stdcall RtlpValidateAsciiStd3AndLength" _RtlpValidateAsciiStd3AndLength@16
0x4B2EF6A0: "__stdcall MD5Update" _MD5Update@12
0x4B39F388: "__cdecl RtlpHpEnvHandle" _RtlpHpEnvHandle
0x4B2F4F40: "__cdecl _strnicmp" __strnicmp
0x4B2A3E78: "Critical error detected %lx " ??_C@_0BN@DNAIKFFE@Critical?5error?5detected?5?$CFlx?6?$AA@
0x4B299B98: "*** ASSERT FAILED: Input paramet" ??_C@_0IA@BOEDKCPN@?$CK?$CK?$CK?5ASSERT?5FAILED?3?5Input?5paramet@
0x4B2F7DC1: "__cdecl strtolX" _strtolX
0x4B2F022B: "__stdcall EtwpIsPrivateLoggerOn" _EtwpIsPrivateLoggerOn@4
0x4B33BE00: "__stdcall CsrCaptureMessageMultiUnicodeStringsInPlace" _CsrCaptureMessageMultiUnicodeStringsInPlace@12
0x4B3A0C10: "__cdecl g_pShimEngineModule" _g_pShimEngineModule
0x4B2F0CB0: "__stdcall ZwAlpcDeleteSecurityContext" _ZwAlpcDeleteSecurityContext@12
0x4B3392C0: "__stdcall WerReportSQMEvent" _WerReportSQMEvent@16
0x4B2F2020: "__stdcall NtTerminateJobObject" _NtTerminateJobObject@8
0x4B36842A: "__stdcall RtlpHpStackTraceAllocAdd" _RtlpHpStackTraceAllocAdd@12
0x4B360F60: "__stdcall RtlIsNameInUnUpcasedExpression" _RtlIsNameInUnUpcasedExpression@16
0x4B2CD5F0: "__stdcall TppWaitCompletion" _TppWaitCompletion@16
0x4B2D7970: "__stdcall RtlQueryResourcePolicy" _RtlQueryResourcePolicy@16
0x4B297D28: "SXS: Unable to open storage root" ??_C@_0DP@JEMNHIAA@SXS?3?5Unable?5to?5open?5storage?5root@
0x4B2D75A0: "__fastcall RtlpInterlockedPushEntrySList" @RtlpInterlockedPushEntrySList@8
0x4B32D913: "__stdcall LdrpLogEtwEvent" _LdrpLogEtwEvent@24
0x4B294EE0: "Windows.XBoxSRA" ??_C@_1CA@HFHJBLGP@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAX?$AAB?$AAo?$AAx?$AAS?$AAR?$AAA?$AA?$AA@
0x4B292418: "__cdecl DeprecatedDll" _DeprecatedDll
0x4B3A0C18: "__cdecl LdrpSystemDllBase" _LdrpSystemDllBase
0x4B2F11F0: "__stdcall ZwDisplayString" _ZwDisplayString@4
0x4B2F0B40: "__stdcall ZwAddDriverEntry" _ZwAddDriverEntry@8
0x4B3595AE: "__stdcall RtlpCopyMappedMemoryEx_ExceptionFilter" _RtlpCopyMappedMemoryEx_ExceptionFilter@32
0x4B33B446: "__stdcall RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation" _RtlpQueryFilesInAssemblyInformationActivationContextDetailedInformation@20
0x4B3318E7: "__stdcall LdrpCheckPagesForTampering" _LdrpCheckPagesForTampering@8
0x4B2E46D0: "__stdcall RtlActivateActivationContext" _RtlActivateActivationContext@12
0x4B2B1653: "__stdcall RtlpGetDefaultsSubjectContext" _RtlpGetDefaultsSubjectContext@36
0x4B2A6BE0: "__stdcall RtlLookupElementGenericTableAvl" _RtlLookupElementGenericTableAvl@8
0x4B2F8810: "__cdecl _rttosnpop" __rttosnpop
0x4B376E72: "__stdcall RtlpHpLargeReAlloc" _RtlpHpLargeReAlloc@16
0x4B2ACCD1: "__stdcall RtlpQueryRegistryValues" _RtlpQueryRegistryValues@24
0x4B3365CF: "__stdcall AVrfpEnableHandleVerifier" _AVrfpEnableHandleVerifier@0
0x4B2AAFFE: "__stdcall RtlpRemoveHeapFromProtectedList" _RtlpRemoveHeapFromProtectedList@4
0x4B2BBEF0: "__stdcall LdrpAccessResourceDataNoMultipleLanguage" _LdrpAccessResourceDataNoMultipleLanguage@16
0x4B2F1EE0: "__stdcall NtSetSystemPowerState" _NtSetSystemPowerState@12
0x4B2A4A34: "Parameter1: %p " ??_C@_0BA@DLCHMMHB@Parameter1?3?5?$CFp?6?$AA@
0x4B2999F0: "*** ASSERT FAILED: Input paramet" ??_C@_0HK@JCCLBMIE@?$CK?$CK?$CK?5ASSERT?5FAILED?3?5Input?5paramet@
0x4B295D38: "\Registry\Machine\Software\Micro" ??_C@_1LK@EFMJHDBH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B2F1DB0: "__stdcall NtSetInformationKey" _NtSetInformationKey@16
0x4B2F0430: "__stdcall LibLoaderTelemetryInitOnce" _LibLoaderTelemetryInitOnce@12
0x4B2F09E0: "__stdcall NtReadRequestData" _NtReadRequestData@24
0x4B2F1650: "__stdcall ZwOpenKeyTransacted" _ZwOpenKeyTransacted@16
0x4B2E58E0: "__stdcall RtlMakeSelfRelativeSD" _RtlMakeSelfRelativeSD@12
0x4B3341E0: "__stdcall RtlDestroyQueryDebugBuffer" _RtlDestroyQueryDebugBuffer@4
0x4B2F1370: "__stdcall ZwGetCurrentProcessorNumber" _ZwGetCurrentProcessorNumber@0
0x4B375A27: "__stdcall RtlpHpLfhSubsegmentDecommitPages" _RtlpHpLfhSubsegmentDecommitPages@20
0x4B2DFFCF: "__stdcall RtlpFindNextActivationContextSection" _RtlpFindNextActivationContextSection@16
0x4B381867: "__stdcall TppExceptionFilter" _TppExceptionFilter@8
0x4B304F40: "__fastcall LdrpValidateUserCallTargetES" @LdrpValidateUserCallTargetES@4
0x4B351355: "__stdcall RtlpGetDefaultLanguageBaseOrParent" _RtlpGetDefaultLanguageBaseOrParent@28
0x4B2876E0: "__cdecl ulInvalidTypes" _ulInvalidTypes
0x4B286820: "fmod" ??_C@_04KEPJIHGP@fmod?$AA@
0x4B292810: "CLIENT(ntdll): Processing %ws fo" ??_C@_0EH@CFHMMMJI@CLIENT?$CIntdll?$CJ?3?5Processing?5?$CFws?5fo@
0x4B2D95E0: "__stdcall TpSetPoolWorkerThreadIdleTimeout" _TpSetPoolWorkerThreadIdleTimeout@12
0x4B2F18D0: "__stdcall NtQueryInformationJobObject" _NtQueryInformationJobObject@20
0x4B3393C4: "__stdcall WerpEscalationIsWMRSendStringSet" _WerpEscalationIsWMRSendStringSet@0
0x4B2A9F00: "__stdcall RtlQueryInformationAcl" _RtlQueryInformationAcl@16
0x4B36D696: "__fastcall RtlpGetFirstBlockAddress" @RtlpGetFirstBlockAddress@8
0x4B3043C9: "__cdecl _SEH_epilog4" __SEH_epilog4
0x4B2F0B20: "__stdcall ZwAddAtomEx" _ZwAddAtomEx@16
0x4B366750: "__stdcall _RtlpMuiRegAddBaseLanguage" __RtlpMuiRegAddBaseLanguage@20
0x4B2F89BE: "__cdecl _fast_exit" __fast_exit
0x4B2F2764: "__stdcall RtlpBreakWithStatusInstruction" _RtlpBreakWithStatusInstruction@0
0x4B2F1E90: "__stdcall NtSetQuotaInformationFile" _NtSetQuotaInformationFile@16
0x4B2E8488: "__stdcall TpInitializePackage" _TpInitializePackage@0
0x4B286838: "_yn" ??_C@_03ONILCKOB@_yn?$AA@
0x4B37D929: "__stdcall EtwpDemuxUmTraceHandle" _EtwpDemuxUmTraceHandle@8
0x4B32C820: "__stdcall LdrVerifyImageMatchesChecksum" _LdrVerifyImageMatchesChecksum@16
0x4B2938D8: "Creating the process heap failed" ??_C@_0CC@GBBOBHCD@Creating?5the?5process?5heap?5failed@
0x4B2F0290: "__stdcall EtwpLogger" _EtwpLogger@4
0x4B293968: "Querying the known DLL directory" ??_C@_0EJ@NDHFJHMH@Querying?5the?5known?5DLL?5directory@
0x4B2F16E0: "__stdcall NtOpenResourceManager" _NtOpenResourceManager@20
0x4B2F8935: "__cdecl _load_CW" __load_CW
0x4B2889D8: "__cdecl NormalYearDayToMonth" _NormalYearDayToMonth
0x4B2F0C10: "__stdcall NtAlpcConnectPort" _NtAlpcConnectPort@44
0x4B294C58: "LdrpComputeLazyDllPath" ??_C@_0BH@MDCCNKEN@LdrpComputeLazyDllPath?$AA@
0x4B298CBC: "0x" ??_C@_15OEMMNBIC@?$AA0?$AAx?$AA?$AA@
0x4B3A1B2C: "__cdecl RtlpECVRecorded" _RtlpECVRecorded
0x4B2F1230: "__stdcall ZwEnumerateDriverEntries" _ZwEnumerateDriverEntries@8
0x4B37521F: "__stdcall RtlpHpLfhOwnerMoveSubsegment" _RtlpHpLfhOwnerMoveSubsegment@12
0x4B2F2230: "__stdcall ZwWow64DebuggerCall" _ZwWow64DebuggerCall@20
0x4B2F19A0: "__stdcall ZwQueryOpenSubKeysEx" _ZwQueryOpenSubKeysEx@16
0x4B33A674: "__stdcall RtlUnicodeStringCatString" _RtlUnicodeStringCatString@8
0x4B33BE90: "__stdcall CsrCaptureMessageString" _CsrCaptureMessageString@20
0x4B354FB0: "__stdcall RtlpExtendedHeapInformationWorkerCallback" _RtlpExtendedHeapInformationWorkerCallback@8
0x4B2B2E50: "__stdcall RtlGetFullPathName_U" _RtlGetFullPathName_U@16
0x4B2F20F0: "__stdcall NtUnmapViewOfSectionEx" _NtUnmapViewOfSectionEx@12
0x4B2F06C0: "__stdcall ZwRequestWaitReplyPort" _ZwRequestWaitReplyPort@12
0x4B333F8D: "__stdcall RtlpInitializeAuditAce" _RtlpInitializeAuditAce@24
0x4B374834: "__stdcall RtlpHpLfhBucketAddSubsegment" _RtlpHpLfhBucketAddSubsegment@16
0x4B34A5D5: "__stdcall RtlpHpAllocWithExceptionProtection" _RtlpHpAllocWithExceptionProtection@12
0x4B29393C: "Failed to open %wZ with status 0" ??_C@_0CI@GODKKFBD@Failed?5to?5open?5?$CFwZ?5with?5status?50@
0x4B288CC8: "__cdecl RtlBaseAceType" _RtlBaseAceType
0x4B2924F0: "\Registry\Machine\Software\Micro" ??_C@_1KC@OALGIEOE@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B303CD6: "__stdcall LdrpResolveForwarder" _LdrpResolveForwarder@16
0x4B2E8F70: "__stdcall RtlpComputeDllPathWithOptions" _RtlpComputeDllPathWithOptions@8
0x4B2E3F90: "__stdcall RtlpWaitCouldDeadlock" _RtlpWaitCouldDeadlock@0
0x4B2E00F8: "__stdcall RtlpFindGuidInSection" _RtlpFindGuidInSection@12
0x4B350475: "__stdcall RtlpAddLanguagesToMultiSZ" _RtlpAddLanguagesToMultiSZ@28
0x4B2D8170: "__cdecl _matherr" __matherr
0x4B296940: "SXS: Warning: Activation context" ??_C@_0ED@JKGCNHJG@SXS?3?5Warning?3?5Activation?5context@
0x4B2FE2A0: "__cdecl wcstok_s" _wcstok_s
0x4B33F6FB: "__stdcall RtlpCreateUserProcess" _RtlpCreateUserProcess@24
0x4B2F5DA0: "__cdecl _ceil_pentium4" __ceil_pentium4
0x4B2AEBD0: "__cdecl RtlInitializeSidEx" _RtlInitializeSidEx
0x4B294540: "LdrpProcessWork" ??_C@_0BA@MMKPAIAM@LdrpProcessWork?$AA@
0x4B294050: "LdrpIsVerifierActivationFilterMa" ??_C@_0CG@MFFLEJPO@LdrpIsVerifierActivationFilterMa@
0x4B2F2A10: "__stdcall KiFastSystemCall" _KiFastSystemCall@0
0x4B2F1B40: "__stdcall NtRemoveProcessDebug" _NtRemoveProcessDebug@8
0x4B3A1524: "__cdecl Kernel32BaseQueryModuleData" _Kernel32BaseQueryModuleData
0x4B331BBF: "__stdcall LdrpLockTlsDelayedReclaimTable" _LdrpLockTlsDelayedReclaimTable@0
0x4B296764: "This != NULL" ??_C@_0N@GGGICEJA@This?5?$CB?$DN?5NULL?$AA@
0x4B39E84A: "__cdecl _piby2" __piby2
0x4B2FAB90: "__cdecl _cintrindisp2" __cintrindisp2
0x4B32B971: "__stdcall RtlpQueryEnvironmentCache" _RtlpQueryEnvironmentCache@24
0x4B2EBCE0: "__stdcall TpDisablePoolCallbackChecks" _TpDisablePoolCallbackChecks@4
0x4B2F12B0: "__stdcall NtFlushInstallUILanguage" _NtFlushInstallUILanguage@8
0x4B2B3FB0: "__stdcall LdrpResGetResourceDirectory" _LdrpResGetResourceDirectory@20
0x4B2DB3F8: "__stdcall LdrpRemoveAlternateModuleCacheItem" _LdrpRemoveAlternateModuleCacheItem@4
0x4B34A300: "__stdcall RtlPinAtomInAtomTable" _RtlPinAtomInAtomTable@8
0x4B298920: "Type:" ??_C@_1M@NKPEOBAN@?$AAT?$AAy?$AAp?$AAe?$AA?3?$AA?$AA@
0x4B2F1FC0: "__stdcall NtStopProfile" _NtStopProfile@4
0x4B3395C0: "__stdcall WinSqmCheckEscalationSetDWORD64" _WinSqmCheckEscalationSetDWORD64@20
0x4B294444: "CWDIllegalInDLLSearch" ??_C@_1CM@OODOIMLG@?$AAC?$AAW?$AAD?$AAI?$AAl?$AAl?$AAe?$AAg?$AAa?$AAl?$AAI?$AAn?$AAD?$AAL?$AAL?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AA?$AA@
0x4B35B52D: "__stdcall RtlpSysVolCreateSecurityDescriptor" _RtlpSysVolCreateSecurityDescriptor@8
0x4B28123C: "__cdecl RtlpTpWorkTaskCallbacks" _RtlpTpWorkTaskCallbacks
0x4B2F1AE0: "__stdcall NtRecoverTransactionManager" _NtRecoverTransactionManager@4
0x4B37D100: "__stdcall EtwTraceEventInstance" _EtwTraceEventInstance@20
0x4B338320: "__stdcall RtlReportSqmEscalation" _RtlReportSqmEscalation@24
0x4B2938FC: "KnownDLL directory does not yet " ??_C@_0DO@OEBJCGHG@KnownDLL?5directory?5does?5not?5yet?5@
0x4B2DF9A0: "__stdcall RtlSetBits" _RtlSetBits@12
0x4B3A00D8: "__cdecl AVrfpEnabledSystemWide" _AVrfpEnabledSystemWide
0x4B32B2D0: "__stdcall DbgUiDebugActiveProcess" _DbgUiDebugActiveProcess@4
0x4B2F1C70: "__stdcall ZwSaveMergedKeys" _ZwSaveMergedKeys@12
0x4B3052A0: "__stdcall XSaveCHelper" _XSaveCHelper@12
0x4B2F2130: "__stdcall NtWaitForAlertByThreadId" _NtWaitForAlertByThreadId@8
0x4B288B48: "__cdecl NormalYearDaysPrecedingMonth" _NormalYearDaysPrecedingMonth
0x4B386C6C: "__stdcall RtlpQueryDiskWriteConstraintPolicy" _RtlpQueryDiskWriteConstraintPolicy@8
0x4B2D02C0: "__stdcall TppWorkPost" _TppWorkPost@4
0x4B2F15C0: "__stdcall NtNotifyChangeDirectoryFileEx" _NtNotifyChangeDirectoryFileEx@40
0x4B293AF0: "Beginning execution of %wZ (%wZ)" ??_C@_0FE@CBBCFNBD@Beginning?5execution?5of?5?$CFwZ?5?$CI?$CFwZ?$CJ@
0x4B2D9570: "__stdcall TpSetPoolMaxThreads" _TpSetPoolMaxThreads@8
0x4B2EB621: "__stdcall LdrpCompareModuleName" _LdrpCompareModuleName@8
0x4B380920: "__stdcall TpWaitForJobNotification" _TpWaitForJobNotification@4
0x4B2EA200: "__stdcall RtlSetUserCallbackExceptionFilter" _RtlSetUserCallbackExceptionFilter@4
0x4B28789C: "KERNELBASE.dll" ??_C@_1BO@GOMBKADA@?$AAK?$AAE?$AAR?$AAN?$AAE?$AAL?$AAB?$AAA?$AAS?$AAE?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x4B2AA820: "__stdcall RtlOemStringToUnicodeString" _RtlOemStringToUnicodeString@12
0x4B362670: "__stdcall Normalization__LoadClassMapExceptions" _Normalization__LoadClassMapExceptions@4
0x4B284E94: "" ??_C@_00CNPNBAHC@?$AA@
0x4B2EBE00: "__cdecl RtlpTargetCompare" _RtlpTargetCompare
0x4B2B737C: "__stdcall LdrpLoadKnownDll" _LdrpLoadKnownDll@4
0x4B2E7670: "__stdcall RtlpQueryDefaultUILanguage" _RtlpQueryDefaultUILanguage@8
0x4B379BB2: "__stdcall RtlpHpSegProtect" _RtlpHpSegProtect@8
0x4B2F17B0: "__stdcall NtPrivilegeCheck" _NtPrivilegeCheck@12
0x4B2EA5C0: "__stdcall RtlIpv4StringToAddressExA" _RtlIpv4StringToAddressExA@16
0x4B2F47B0: "__cdecl _itow" __itow
0x4B363EA3: "__stdcall RtlpStdGetRecordedStackTraceIndex" _RtlpStdGetRecordedStackTraceIndex@8
0x4B34E5A0: "__stdcall RtlQueryDynamicTimeZoneInformation" _RtlQueryDynamicTimeZoneInformation@4
0x4B292F5C: "LdrpResolveDllName" ??_C@_0BD@GNGEMOED@LdrpResolveDllName?$AA@
0x4B293B90: "Allocating a data table entry fo" ??_C@_0EH@EKJPBJHH@Allocating?5a?5data?5table?5entry?5fo@
0x4B2946FC: "Calling init routine %p for DLL " ??_C@_0CH@BDJJPJGD@Calling?5init?5routine?5?$CFp?5for?5DLL?5@
0x4B3A0BE8: "__cdecl UseCOR" _UseCOR
0x4B2EBCB0: "__stdcall RtlGetLongestNtPathLength" _RtlGetLongestNtPathLength@0
0x4B298F80: "RTL: Pid.Tid %p.%p, owner tid %p" ??_C@_0EO@HEAMCGFP@RTL?3?5Pid?4Tid?5?$CFp?4?$CFp?0?5owner?5tid?5?$CFp@
0x4B29371C: "LdrpInitializePerUserWindowsDire" ??_C@_0CG@DINOMLPC@LdrpInitializePerUserWindowsDire@
0x4B2A7290: "__stdcall RtlpOptimizeWaitOnAddressWaitList" _RtlpOptimizeWaitOnAddressWaitList@4
0x4B3661AF: "__stdcall RtlpMuiRegResizeLanguageConfigList" _RtlpMuiRegResizeLanguageConfigList@8
0x4B2EB64C: "__stdcall _TlgKeywordOn" __TlgKeywordOn@12
0x4B2F1040: "__stdcall ZwCreateSemaphore" _ZwCreateSemaphore@20
0x4B340046: "__stdcall LdrpThumbProcessRelocation" _LdrpThumbProcessRelocation@16
0x4B299C90: "\Registry\Machine\SOFTWARE\Micro" ??_C@_1LK@IMJLNIPI@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B2811CC: "__cdecl TppDirectTaskVFuncs" _TppDirectTaskVFuncs
0x4B2AA150: "__stdcall RtlGetUserPreferredUILanguages" _RtlGetUserPreferredUILanguages@20
0x4B2F935A: "__cdecl _flsbuf" __flsbuf
0x4B35D480: "__stdcall RtlGenerate8dot3Name" _RtlGenerate8dot3Name@16
0x4B2F18E0: "__stdcall NtQueryInformationPort" _NtQueryInformationPort@20
0x4B2867E8: "tanh" ??_C@_04FJHINJAO@tanh?$AA@
0x4B34B2C0: "__stdcall RtlValidateUnicodeString" _RtlValidateUnicodeString@8
0x4B304384: "__cdecl _SEH_prolog4" __SEH_prolog4
0x4B2F1250: "__stdcall NtEnumerateTransactionObject" _NtEnumerateTransactionObject@20
0x4B2F1610: "__stdcall ZwOpenEventPair" _ZwOpenEventPair@12
0x4B32CFAB: "__stdcall LdrpGetDelayloadDescriptor" _LdrpGetDelayloadDescriptor@8
0x4B305010: ExecuteHandler@20
0x4B2F07D0: "__stdcall ZwOpenFile" _ZwOpenFile@24
0x4B295860: "AVRF: chain: searching in %ws " ??_C@_0BP@FKNKCHFE@AVRF?3?5chain?3?5searching?5in?5?$CFws?6?$AA@
0x4B2B7680: "__stdcall RtlDosPathNameToRelativeNtPathName_U_WithStatus" _RtlDosPathNameToRelativeNtPathName_U_WithStatus@16
0x4B2F4EB0: "__cdecl _strlwr" __strlwr
0x4B304630: "__stdcall NtdllImeWndProc_W" _NtdllImeWndProc_W@0
0x4B365168: "__stdcall RtlpLoadPolicyLanguageSpec" _RtlpLoadPolicyLanguageSpec@16
0x4B2DA261: "__stdcall EtwpFreeRegistration" _EtwpFreeRegistration@4
0x4B383F70: "__stdcall PssNtWalkSnapshot" _PssNtWalkSnapshot@20
0x4B2F1070: "__stdcall NtCreateTimer" _NtCreateTimer@16
0x4B35FF75: "__stdcall adapt" _adapt@12
0x4B32ADB7: "__stdcall RtlpCheckDeviceName" _RtlpCheckDeviceName@12
0x4B295980: "AVRF: AVrfDllUnloadNotification " ??_C@_0DN@HKLMHMBB@AVRF?3?5AVrfDllUnloadNotification?5@
0x4B3436E0: "__stdcall RtlAllocateAndInitializeSidEx" _RtlAllocateAndInitializeSidEx@16
0x4B3A17DC: "__cdecl LdrpCODScenarioLock" _LdrpCODScenarioLock
0x4B3448BC: "__stdcall RtlStringCbLengthW" _RtlStringCbLengthW@12
0x4B3A17BC: "__cdecl TppPoolpGlobalPoolMaxThreads" _TppPoolpGlobalPoolMaxThreads
0x4B33BBAC: "__stdcall ImportTablepInsertFunctionSorted" _ImportTablepInsertFunctionSorted@8
0x4B2CDC40: "__stdcall RtlAcquirePebLock" _RtlAcquirePebLock@0
0x4B2E451F: "__stdcall EtwpEventWriteFull" _EtwpEventWriteFull@44
0x4B32F599: "__stdcall LdrpInitializeExceptionTable" _LdrpInitializeExceptionTable@4
0x4B297A60: "SXS: %s() - Caller asked to use " ??_C@_0FJ@FMMKKICE@SXS?3?5?$CFs?$CI?$CJ?5?9?5Caller?5asked?5to?5use?5@
0x4B2A5348: "HeaderValidateCopy" ??_C@_0BD@OHIKCJLG@HeaderValidateCopy?$AA@
0x4B2F06D0: "__stdcall ZwQueryVirtualMemory" _ZwQueryVirtualMemory@24
0x4B2BD16B: "__stdcall LdrProtectMrdata" _LdrProtectMrdata@4
0x4B2F88B0: "__cdecl _nan2" __nan2
0x4B2A49F8: "heap_failure_lfh_bitmap_mismatch" ??_C@_0CB@GLGOFBN@heap_failure_lfh_bitmap_mismatch@
0x4B331887: "__stdcall LdrpCompareRedirectedFunction" _LdrpCompareRedirectedFunction@8
0x4B2F6310: "__cdecl memcmp" _memcmp
0x4B3649F0: "__stdcall RtlTraceDatabaseDestroy" _RtlTraceDatabaseDestroy@4
0x4B285894: "__cdecl LdrpComPlusInstallRootName" _LdrpComPlusInstallRootName
0x4B294828: "LdrpProcessDetachNode" ??_C@_0BG@IFMIJMKA@LdrpProcessDetachNode?$AA@
0x4B2F12F0: "__stdcall NtFlushVirtualMemory" _NtFlushVirtualMemory@16
0x4B296BD0: "SXS: %s() called with invalid co" ??_C@_0EE@EBOBBOGH@SXS?3?5?$CFs?$CI?$CJ?5called?5with?5invalid?5co@
0x4B2F89A8: "__cdecl _checkTOS_withFB" __checkTOS_withFB
0x4B297A10: "SXS: %s() - caller asked to use " ??_C@_0EJ@LKKLPFHJ@SXS?3?5?$CFs?$CI?$CJ?5?9?5caller?5asked?5to?5use?5@
0x4B2F7FB0: "__cdecl towupper" _towupper
0x4B285D80: "__cdecl SystemTraceControlGuid" _SystemTraceControlGuid
0x4B38683E: "__stdcall GetProcessIptTraceSize" _GetProcessIptTraceSize@8
0x4B35C34D: "__stdcall RtlpScanHeapAllocBlocks" _RtlpScanHeapAllocBlocks@0
0x4B285A8C: "\DllNXOptions" ??_C@_1BM@IFCOFMDD@?$AA?2?$AAD?$AAl?$AAl?$AAN?$AAX?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x4B2F2100: "__stdcall ZwUnsubscribeWnfStateChange" _ZwUnsubscribeWnfStateChange@4
0x4B2F21F0: "__stdcall NtWow64CsrCaptureMessageBuffer" _NtWow64CsrCaptureMessageBuffer@16
0x4B2F1730: "__stdcall NtOpenTimer" _NtOpenTimer@12
0x4B386B99: "__stdcall RtlpQueryDiskSpacePolicyByHandle" _RtlpQueryDiskSpacePolicyByHandle@8
0x4B2F2770: "__stdcall DbgUserBreakPoint" _DbgUserBreakPoint@0
0x4B297644: "RtlpQueryInformationActivationCo" ??_C@_0DJ@LPKMJAOP@RtlpQueryInformationActivationCo@
0x4B2A3F90: "The resource is owned shared by " ??_C@_0CM@NFELFFEH@The?5resource?5is?5owned?5shared?5by?5@
0x4B34AE30: "__stdcall RtlEqualDomainName" _RtlEqualDomainName@8
0x4B3354B0: "__stdcall RtlpValidateRange" _RtlpValidateRange@20
0x4B33C0F0: "__fastcall InterlockedPushListSList" @InterlockedPushListSList@16
0x4B2AD220: "__stdcall RtlIsCapabilitySid" _RtlIsCapabilitySid@4
0x4B340622: "__stdcall LdrpResFileSize" _LdrpResFileSize@8
0x4B39F280: "__cdecl RtlpAffinityState" _RtlpAffinityState
0x4B288E90: "__cdecl RtlpIntegerWChars" _RtlpIntegerWChars
0x4B338756: "__stdcall WerpCreateCompletionEvent" _WerpCreateCompletionEvent@4
0x4B2F1240: "__stdcall NtEnumerateSystemEnvironmentValuesEx" _NtEnumerateSystemEnvironmentValuesEx@12
0x4B378CDF: "__stdcall RtlpHpSegMgrRelease" _RtlpHpSegMgrRelease@12
0x4B34A750: "__stdcall RtlDestroyMemoryBlockLookaside" _RtlDestroyMemoryBlockLookaside@4
0x4B3A4234: "__cdecl AvrfAppVerifierMode" _AvrfAppVerifierMode
0x4B2EA6D0: "__stdcall TpAllocCleanupGroup" _TpAllocCleanupGroup@4
0x4B2B878D: "__stdcall LdrInitSecurityCookie" _LdrInitSecurityCookie@20
0x4B3A41FC: "__cdecl g_pfnApphelpCheckModuleProc" _g_pfnApphelpCheckModuleProc
0x4B296704: "Status != STATUS_SXS_SECTION_NOT" ??_C@_0CH@JMENHKGE@Status?5?$CB?$DN?5STATUS_SXS_SECTION_NOT@
0x4B2A3938: "Not enough memory to complete " ??_C@_0BP@DOCEBJGL@Not?5enough?5memory?5to?5complete?6?$AA@
0x4B3307B6: "__stdcall LdrpLoadDelegatedNtdll" _LdrpLoadDelegatedNtdll@4
0x4B281108: "__cdecl TppTimerpCleanupGroupMemberVFuncs" _TppTimerpCleanupGroupMemberVFuncs
0x4B2991AC: "Address of the debug info found " ??_C@_0DE@PJMAILDJ@Address?5of?5the?5debug?5info?5found?5@
0x4B2947F8: "Uninitializing DLL "%wZ" (Init r" ??_C@_0CN@PDBONKOL@Uninitializing?5DLL?5?$CC?$CFwZ?$CC?5?$CIInit?5r@
0x4B3444A0: "__stdcall RtlRunDecodeUnicodeString" _RtlRunDecodeUnicodeString@8
0x4B2F1FD0: "__stdcall ZwSubscribeWnfStateChange" _ZwSubscribeWnfStateChange@16
0x4B34DF50: "__stdcall RtlLockBootStatusData" _RtlLockBootStatusData@4
0x4B2F0C80: "__stdcall NtAlpcDeletePortSection" _NtAlpcDeletePortSection@12
0x4B305110: "__stdcall RtlpCaptureContext" _RtlpCaptureContext@4
0x4B2D0486: "__stdcall TppValidateCleanupGroupMember" _TppValidateCleanupGroupMember@8
0x4B2854B8: "MUI" ??_C@_17JCBKHJFJ@?$AAM?$AAU?$AAI?$AA?$AA@
0x4B2810B8: "__cdecl g_SbModuleTable_RTL" _g_SbModuleTable_RTL
0x4B2EF523: "__stdcall EtwpInitializePrivateLoggerSupport" _EtwpInitializePrivateLoggerSupport@0
0x4B2D3918: "__stdcall TpAdjustBindingCount" _TpAdjustBindingCount@8
0x4B28C208: "__cdecl RtlpSearchWidth" _RtlpSearchWidth
0x4B2F26DA: "__cdecl __report_rangecheckfailure" ___report_rangecheckfailure
0x4B33C200: "__stdcall AlpcFreeCompletionListMessage" _AlpcFreeCompletionListMessage@8
0x4B3351EB: "__stdcall RtlpDeCommitQueryDebugInfo" _RtlpDeCommitQueryDebugInfo@12
0x4B2F10C0: "__stdcall NtCreateTransactionManager" _NtCreateTransactionManager@24
0x4B35DF52: "__stdcall RtlpGetFileSize" _RtlpGetFileSize@8
0x4B2F2170: "__stdcall NtWaitHighEventPair" _NtWaitHighEventPair@4
0x4B364BF5: "__stdcall RtlpTraceDatabaseFree" _RtlpTraceDatabaseFree@8
0x4B2F1690: "__stdcall NtOpenObjectAuditAlarm" _NtOpenObjectAuditAlarm@48
0x4B2E7F4D: "__fastcall RtlpUpdateHeapRates" @RtlpUpdateHeapRates@8
0x4B298C94: "Log" ??_C@_17LLLMIFAB@?$AAL?$AAo?$AAg?$AA?$AA@
0x4B349666: "__stdcall RtlpIsAttributeAceInSacl" _RtlpIsAttributeAceInSacl@16
0x4B2A53BC: "SegmentList" ??_C@_0M@GFKDEDGG@SegmentList?$AA@
0x4B293EEC: "SPPsvc.exe" ??_C@_1BG@NFNOPJFD@?$AAS?$AAP?$AAP?$AAs?$AAv?$AAc?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x4B2E41D0: "__stdcall RtlUnicodeToUTF8N" _RtlUnicodeToUTF8N@20
0x4B339D99: "__stdcall RtlpWnfETWEventUnsubscribe" _RtlpWnfETWEventUnsubscribe@28
0x4B342C0A: "__stdcall RXactpOpenTargetKey" _RXactpOpenTargetKey@16
0x4B2DB0CE: "__stdcall GetResourceDirectoryEntry" _GetResourceDirectoryEntry@12
0x4B2F05C0: "__stdcall ZwFindAtom" _ZwFindAtom@12
0x4B2B1B50: "__stdcall RtlSidDominates" _RtlSidDominates@12
0x4B294FC0: "Desktop" ??_C@_1BA@CBCBMBGJ@?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?$AA@
0x4B39F390: "__cdecl RtlpValidateHeapTagsEnable" _RtlpValidateHeapTagsEnable
0x4B2AC54F: "__stdcall LdrpCorInitialize" _LdrpCorInitialize@4
0x4B2F1D20: "__stdcall NtSetDefaultUILanguage" _NtSetDefaultUILanguage@4
0x4B374AA1: "__stdcall RtlpHpLfhBucketUpdateAffinityMapping" _RtlpHpLfhBucketUpdateAffinityMapping@8
0x4B34D910: "__stdcall RtlLargeIntegerToChar" _RtlLargeIntegerToChar@16
0x4B2A5ACC: "Non-Dedicated free list element " ??_C@_0DE@MMBFEMDH@Non?9Dedicated?5free?5list?5element?5@
0x4B2F1540: "__stdcall ZwManageHotPatch" _ZwManageHotPatch@16
0x4B3011B6: "__cdecl _fgetwc_nolock" __fgetwc_nolock
0x4B2B125F: "__stdcall RtlpCompareKnownAces" _RtlpCompareKnownAces@16
0x4B2F47B0: "__cdecl _ltow" __ltow
0x4B39E724: "__cdecl RtlpProtectedHeapsList" _RtlpProtectedHeapsList
0x4B2876D0: "__stdcall _imp__RtlInitUnicodeString" __imp__RtlInitUnicodeString@8
0x4B33B1EF: "__stdcall ARRAY_FITS" _ARRAY_FITS@16
0x4B2C6440: "__stdcall RtlFreeUnicodeString" _RtlFreeUnicodeString@4
0x4B2811DC: "__cdecl TppWaitpTaskVFuncs" _TppWaitpTaskVFuncs
0x4B2F4A08: "__stdcall _seh_longjmp_unwind4" __seh_longjmp_unwind4@4
0x4B2E684F: "__stdcall RtlxRemoveInvertedFunctionTable" _RtlxRemoveInvertedFunctionTable@8
0x4B32E6D8: "__cdecl _TlgDefineProvider_annotation__TlgCentennialIssueTracker_TraceLoggingProviderProv" __TlgDefineProvider_annotation__TlgCentennialIssueTracker_TraceLoggingProviderProv
0x4B295F80: "\Software\Microsoft\Windows" ??_C@_1DI@PHIIKFEJ@?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?$AA@
0x4B35A3F1: "__stdcall RtlpAllocateHeapRaiseException" _RtlpAllocateHeapRaiseException@4
0x4B2F8630: "__cdecl wcstoul" _wcstoul
0x4B2F0CF0: "__stdcall NtAlpcOpenSenderProcess" _NtAlpcOpenSenderProcess@24
0x4B2F19B0: "__stdcall NtQueryPortInformationProcess" _NtQueryPortInformationProcess@0
0x4B297590: "SXS: %s() found assembly informa" ??_C@_0LC@EBKEJMEM@SXS?3?5?$CFs?$CI?$CJ?5found?5assembly?5informa@
0x4B2E1420: "__stdcall RtlAnsiCharToUnicodeChar" _RtlAnsiCharToUnicodeChar@4
0x4B360DA1: "__stdcall RtlReportCriticalFailure" _RtlReportCriticalFailure@12
0x4B295CA8: "\KernelObjects\SystemErrorPortRe" ??_C@_1EI@MEPMEHFB@?$AA?2?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAE?$AAr?$AAr?$AAo?$AAr?$AAP?$AAo?$AAr?$AAt?$AAR?$AAe@
0x4B2F0FD0: "__stdcall ZwCreatePrivateNamespace" _ZwCreatePrivateNamespace@16
0x4B33122B: "__stdcall LdrpCompleteProcessCloning" _LdrpCompleteProcessCloning@4
0x4B2A5E5C: "__cdecl RtlpHpDefaultBrowserPackageName" _RtlpHpDefaultBrowserPackageName
0x4B2E0BEC: "__stdcall LdrpCondenseGraph" _LdrpCondenseGraph@4
0x4B292498: "__cdecl CurDirDllLoadFailureWarning" _CurDirDllLoadFailureWarning
0x4B2F0A20: "__stdcall NtOpenDirectoryObject" _NtOpenDirectoryObject@12
0x4B2EA7D0: "__stdcall RtlQueryWnfStateData" _RtlQueryWnfStateData@24
0x4B2F0B50: "__stdcall NtAdjustGroupsToken" _NtAdjustGroupsToken@24
0x4B2F1E40: "__stdcall ZwSetIoCompletion" _ZwSetIoCompletion@20
0x4B2CD758: "__stdcall TppCompleteThreadData" _TppCompleteThreadData@4
0x4B377414: "__stdcall RtlpHpVaMgrCtxAllocatorFind" _RtlpHpVaMgrCtxAllocatorFind@16
0x4B347E30: "__stdcall RtlAddAccessAllowedObjectAce" _RtlAddAccessAllowedObjectAce@28
0x4B373D5D: "__stdcall RtlpHpHeapWalk" _RtlpHpHeapWalk@12
0x4B2A4354: "a NULL pointer " ??_C@_0BB@FDBPIHBI@a?5NULL?5pointer?6?6?$AA@
0x4B3051C2: FinalExceptionHandlerPad18
0x4B292398: "__cdecl AppModelLibraryLoadFailureNgenBinary" _AppModelLibraryLoadFailureNgenBinary
0x4B2F1FB0: "__stdcall ZwStartProfile" _ZwStartProfile@4
0x4B33BF5B: "__stdcall ApiSetQuerySchemaInfo" _ApiSetQuerySchemaInfo@16
0x4B2D9860: "__stdcall EtwpNotificationThread" _EtwpNotificationThread@16
0x4B3051D6: FinalExceptionHandlerPad38
0x4B3051CC: FinalExceptionHandlerPad28
0x4B3051EA: FinalExceptionHandlerPad58
0x4B3051E0: FinalExceptionHandlerPad48
0x4B3762DE: "__stdcall RtlpHpLfhSubsegmentSetOwner" _RtlpHpLfhSubsegmentSetOwner@8
0x4B2F0E70: "__stdcall NtCompressKey" _NtCompressKey@4
0x4B3586A0: "__stdcall RtlCopyExtendedContext" _RtlCopyExtendedContext@12
0x4B2EBC10: "__stdcall WinSqmGetEscalationRuleStatus" _WinSqmGetEscalationRuleStatus@8
0x4B2B7610: "__stdcall RtlIsDosDeviceName_U" _RtlIsDosDeviceName_U@4
0x4B2881D8: "." ??_C@_13JOFGPIOO@?$AA?4?$AA?$AA@
0x4B2E5699: "__stdcall LdrpParseForwarderDescription" _LdrpParseForwarderDescription@16
0x4B2A5390: "AlignRound" ??_C@_0L@PMBPJEGA@AlignRound?$AA@
0x4B2B82DA: "__stdcall RtlInsertInvertedFunctionTable" _RtlInsertInvertedFunctionTable@8
0x4B34CF30: "__stdcall RtlAssert" _RtlAssert@16
0x4B338A56: "__stdcall WerpIsProcessNative" _WerpIsProcessNative@4
0x4B35EB86: "__stdcall RtlpGetTargetRvaFlag" _RtlpGetTargetRvaFlag@8
0x4B2ED9D6: "__stdcall EtwpDequeueFreeBuffer" _EtwpDequeueFreeBuffer@4
0x4B2F1350: "__stdcall ZwGetCompleteWnfStateSubscription" _ZwGetCompleteWnfStateSubscription@24
0x4B284C48: "Control Panel\Desktop\LanguageCo" ??_C@_1FI@DIKMNOCP@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?5?$AAP?$AAa?$AAn?$AAe?$AAl?$AA?2?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?2?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAC?$AAo@
0x4B35BCE0: "__stdcall RtlFlushSecureMemoryCache" _RtlFlushSecureMemoryCache@8
0x4B33FA65: "__stdcall RtlpDeleteEmptyImageFileOptionsKey" _RtlpDeleteEmptyImageFileOptionsKey@4
0x4B36465A: "__stdcall RtlpGetSebDataAndFilterBuffer" _RtlpGetSebDataAndFilterBuffer@40
0x4B2F1450: "__stdcall ZwInitiatePowerAction" _ZwInitiatePowerAction@16
0x4B2F1AD0: "__stdcall ZwRecoverResourceManager" _ZwRecoverResourceManager@4
0x4B2A885D: "__stdcall RtlpIdnToUnicodeWorker" _RtlpIdnToUnicodeWorker@28
0x4B3A0BF4: "__cdecl NativePageShift" _NativePageShift
0x4B34E10D: "__stdcall RtlpGetBootStatusPath" _RtlpGetBootStatusPath@8
0x4B3631F0: "__stdcall RtlUnhandledExceptionFilter2" _RtlUnhandledExceptionFilter2@8
0x4B2F0B80: "__stdcall ZwAlertThread" _ZwAlertThread@4
0x4B353397: "__stdcall RtlpSetPrivilege" _RtlpSetPrivilege@8
0x4B2F28A0: "__stdcall KiUserCallbackDispatcher" _KiUserCallbackDispatcher@12
0x4B337910: "__stdcall RtlWow64EnableFsRedirection" _RtlWow64EnableFsRedirection@4
0x4B343870: "__stdcall RtlCopySidAndAttributesArray" _RtlCopySidAndAttributesArray@28
0x4B2B2188: "__stdcall RtlAddAtomToAtomTableEx" _RtlAddAtomToAtomTableEx@16
0x4B2F56C0: "__cdecl _wcstoi64" __wcstoi64
0x4B2E7B30: "__stdcall RtlGetAce" _RtlGetAce@12
0x4B3355A0: "__stdcall RtlpValidateRemoteDebugInformation" _RtlpValidateRemoteDebugInformation@16
0x4B2F2180: "__stdcall ZwWaitLowEventPair" _ZwWaitLowEventPair@4
0x4B386787: "__stdcall GetProcessIptTrace" _GetProcessIptTrace@12
0x4B364B60: "__stdcall RtlTraceDatabaseUnlock" _RtlTraceDatabaseUnlock@4
0x4B2B78BC: "__stdcall LdrpGetNtPathFromDosPath" _LdrpGetNtPathFromDosPath@8
0x4B2F1DF0: "__stdcall NtSetInformationTransaction" _NtSetInformationTransaction@16
0x4B296828: "sxsisol_SearchActCtxForDllName" ??_C@_0BP@KOOLJGCC@sxsisol_SearchActCtxForDllName?$AA@
0x4B35A622: "__stdcall RtlpFlushHeap" _RtlpFlushHeap@4
0x4B2F1E10: "__stdcall ZwSetInformationVirtualMemory" _ZwSetInformationVirtualMemory@24
0x4B376B82: "__stdcall RtlpHpLargeAllocSetExtraPresent" _RtlpHpLargeAllocSetExtraPresent@12
0x4B2F0530: "__stdcall ZwReplyWaitReceivePort" _ZwReplyWaitReceivePort@16
0x4B37AC67: "__stdcall RtlpCSparseBitmapPageCommit" _RtlpCSparseBitmapPageCommit@16
0x4B2B611E: "__stdcall LdrpNtCreateFileUnredirected" _LdrpNtCreateFileUnredirected@12
0x4B2F51FA: "__cdecl _vswprintf_l" __vswprintf_l
0x4B299140: "Critical section debug info addr" ??_C@_0CE@CGPKDFJK@Critical?5section?5debug?5info?5addr@
0x4B2A68C0: "__stdcall RtlCreateServiceSid" _RtlCreateServiceSid@12
0x4B2FD120: "__cdecl _vsnprintf_s" __vsnprintf_s
0x4B2E5710: "__stdcall RtlCharToInteger" _RtlCharToInteger@12
0x4B2E90D0: "__stdcall RtlDeleteNoSplay" _RtlDeleteNoSplay@8
0x4B373C9F: "__stdcall RtlpHpHeapUnlock" _RtlpHpHeapUnlock@12
0x4B2F06B0: "__stdcall NtQueryInformationToken" _NtQueryInformationToken@20
0x4B2AEB4B: "__stdcall RtlpMuiRegCreateStringPool" _RtlpMuiRegCreateStringPool@8
0x4B2EB730: "__stdcall RtlInitializeBitMap" _RtlInitializeBitMap@12
0x4B299950: "\Registry\Machine\System\Current" ??_C@_1JK@FKEAKDJE@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2F10E0: "__stdcall NtCreateWaitCompletionPacket" _NtCreateWaitCompletionPacket@12
0x4B2AE80A: "__stdcall OpenGlobalizationUserSettingsKey" _OpenGlobalizationUserSettingsKey@20
0x4B2F2240: "__stdcall ZwWow64GetCurrentProcessorNumberEx" _ZwWow64GetCurrentProcessorNumberEx@4
0x4B2F52BD: "__cdecl _vsnprintf_l" __vsnprintf_l
0x4B39FDE8: "__cdecl AltResMemBlockCount" _AltResMemBlockCount
0x4B2F14F0: "__stdcall NtLockProductActivationKeys" _NtLockProductActivationKeys@8
0x4B2AAEE0: "__stdcall RtlAddAce" _RtlAddAce@20
0x4B39F5E0: "__cdecl RtlpHpTagContext" _RtlpHpTagContext
0x4B2A3A94: "%ld leaks detected. " ??_C@_0BF@OAIKOAAM@?$CFld?5leaks?5detected?4?6?$AA@
0x4B2A47E4: "Heap error detected at %p (heap " ??_C@_0CM@CAABBOAD@Heap?5error?5detected?5at?5?$CFp?5?$CIheap?5@
0x4B2E0410: "__stdcall RtlpTimeToTimeFields" _RtlpTimeToTimeFields@12
0x4B2EBCC0: "__stdcall RtlIdentifierAuthoritySid" _RtlIdentifierAuthoritySid@4
0x4B3426E6: "__stdcall CompareNamesCaseSensitive" _CompareNamesCaseSensitive@8
0x4B2F0B00: "__stdcall NtAccessCheckByTypeResultListAndAuditAlarmByHandle" _NtAccessCheckByTypeResultListAndAuditAlarmByHandle@68
0x4B288150: "\Registry\MACHINE\System\Current" ??_C@_1IG@EBKJHDAD@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B332280: "__stdcall RtlCloneMemoryStream" _RtlCloneMemoryStream@8
0x4B2A47AC: "*** RtlpMuiRegLoadLicInformation" ??_C@_0DH@CLALMMLF@?$CK?$CK?$CK?5RtlpMuiRegLoadLicInformation@
0x4B2EC200: "__stdcall RtlCapabilityCheck" _RtlCapabilityCheck@12
0x4B2CCD70: "__stdcall RtlFormatCurrentUserKeyPath" _RtlFormatCurrentUserKeyPath@4
0x4B362906: "__stdcall Normalization__NormalizeCharacter" _Normalization__NormalizeCharacter@16
0x4B2D6867: "__fastcall RtlpGetFreeBlockInsidePageBoundaries" @RtlpGetFreeBlockInsidePageBoundaries@16
0x4B372EAC: "__stdcall RtlpHpExtrasGet" _RtlpHpExtrasGet@16
0x4B2DBAC0: "__stdcall RtlIsTextUnicode" _RtlIsTextUnicode@12
0x4B2F0F40: "__stdcall ZwCreateKeyTransacted" _ZwCreateKeyTransacted@32
0x4B29A218: "__cdecl RtlpSmMessageInfo" _RtlpSmMessageInfo
0x4B284A18: "Control Panel\Desktop\MuiCached" ??_C@_1EA@FMIONCIH@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?5?$AAP?$AAa?$AAn?$AAe?$AAl?$AA?2?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?2?$AAM?$AAu?$AAi?$AAC?$AAa?$AAc?$AAh?$AAe?$AAd?$AA?$AA@
0x4B2E4BA0: "__stdcall RtlIdnToAscii" _RtlIdnToAscii@20
0x4B374598: "__stdcall RtlpHpSizeHeap" _RtlpHpSizeHeap@12
0x4B359540: "__stdcall RtlCopyMappedMemory" _RtlCopyMappedMemory@12
0x4B2F2410: "__stdcall RtlResetNtUserPfn" _RtlResetNtUserPfn@0
0x4B37F110: "__stdcall EtwReplyNotification" _EtwReplyNotification@4
0x4B3A4350: "__cdecl LdrpInvertedFunctionTable" _LdrpInvertedFunctionTable
0x4B2EBDF0: "__stdcall SwitchedRtlGetVersion_WinBLUE" _SwitchedRtlGetVersion_WinBLUE@0
0x4B2E0BD0: "__stdcall RtlInitializeCriticalSectionAndSpinCount" _RtlInitializeCriticalSectionAndSpinCount@8
0x4B2F935A: "__cdecl _flsbuf_s" __flsbuf_s
0x4B373F01: "__stdcall RtlpHpMetadataFree" _RtlpHpMetadataFree@12
0x4B2F07B0: "__stdcall ZwQueryPerformanceCounter" _ZwQueryPerformanceCounter@8
0x4B333B40: "__stdcall RtlNewSecurityGrantedAccess" _RtlNewSecurityGrantedAccess@24
0x4B2CB120: "__stdcall LdrLoadDll" _LdrLoadDll@16
0x4B2ACB59: "__stdcall RtlpFindRegTziForCurrentYear" _RtlpFindRegTziForCurrentYear@12
0x4B2A58D8: "Heap entry %p has incorrect Prev" ??_C@_0EH@FLBJEHCL@Heap?5entry?5?$CFp?5has?5incorrect?5Prev@
0x4B288104: "SafeProcessSearchMode" ??_C@_1CM@ECKKBMJ@?$AAS?$AAa?$AAf?$AAe?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x4B304780: "__stdcall NtdllEditWndProcWorker" _NtdllEditWndProcWorker@0
0x4B288208: "CON" ??_C@_17LIAKHCCP@?$AAC?$AAO?$AAN?$AA?$AA@
0x4B293FD0: "LdrpIsSubstringFound" ??_C@_0BF@MFEKEJDA@LdrpIsSubstringFound?$AA@
0x4B2992D8: "double initialized or corrupted " ??_C@_0DB@JMDCMHNA@double?5initialized?5or?5corrupted?5@
0x4B293A28: "forwarders;" ??_C@_1BI@EDFDBMAD@?$AAf?$AAo?$AAr?$AAw?$AAa?$AAr?$AAd?$AAe?$AAr?$AAs?$AA?$DL?$AA?$AA@
0x4B340AE2: "__stdcall LdrpResSearchResourceHandle" _LdrpResSearchResourceHandle@32
0x4B2EE0E8: "__stdcall EtwpAllocateTraceBufferPool" _EtwpAllocateTraceBufferPool@4
0x4B3A14E8: "__cdecl gDefaultLocaleId" _gDefaultLocaleId
0x4B2DD69C: "__stdcall TppCleanupGroupMemberDestroy" _TppCleanupGroupMemberDestroy@4
0x4B2F1E60: "__stdcall NtSetLdtEntries" _NtSetLdtEntries@24
0x4B2EB130: "__stdcall RtlQueryProtectedPolicy" _RtlQueryProtectedPolicy@8
0x4B2F0B70: "__stdcall ZwAlertResumeThread" _ZwAlertResumeThread@8
0x4B2E682C: "__stdcall RtlRemoveInvertedFunctionTable" _RtlRemoveInvertedFunctionTable@4
0x4B2924C8: "TrustedInstaller" ??_C@_1CC@EGMNKOEC@?$AAT?$AAr?$AAu?$AAs?$AAt?$AAe?$AAd?$AAI?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AAe?$AAr?$AA?$AA@
0x4B2DC960: "__stdcall RtlQueueWorkItem" _RtlQueueWorkItem@12
0x4B339C98: "__stdcall RtlpWnfETWEventPublish" _RtlpWnfETWEventPublish@12
0x4B3580E0: "__stdcall RtlInitEnumerationHashTable" _RtlInitEnumerationHashTable@8
0x4B32D209: "__stdcall LdrpResolveDelayloadAddress" _LdrpResolveDelayloadAddress@24
0x4B3617E6: "__stdcall NormBuffer__GetCurrentOutputChar" _NormBuffer__GetCurrentOutputChar@8
0x4B295848: "AVRF: provider %ws " ??_C@_0BF@IKIIJIDM@AVRF?3?5provider?5?$CFws?5?6?$AA@
0x4B37DEC3: "__stdcall EtwpFlushUmLogger" _EtwpFlushUmLogger@16
0x4B336D9C: "__stdcall AVrfpSnapDllImports" _AVrfpSnapDllImports@4
0x4B2B6069: "__stdcall LdrMapAndVerifyResourceFile" _LdrMapAndVerifyResourceFile@36
0x4B2F0E30: "__stdcall NtCompareObjects" _NtCompareObjects@8
0x4B2F1840: "__stdcall ZwQueryDebugFilterState" _ZwQueryDebugFilterState@8
0x4B2F15B0: "__stdcall ZwNotifyChangeDirectoryFile" _ZwNotifyChangeDirectoryFile@36
0x4B343B70: "__stdcall RtlGetSecurityDescriptorRMControl" _RtlGetSecurityDescriptorRMControl@8
0x4B35BFB1: "__stdcall RtlpGetMemoryFlag" _RtlpGetMemoryFlag@8
0x4B2F0670: "__stdcall NtCreateKey" _NtCreateKey@28
0x4B2AC430: "__stdcall RtlDecodeSystemPointer" _RtlDecodeSystemPointer@4
0x4B349E40: "__stdcall RtlpValidCompoundAce" _RtlpValidCompoundAce@4
0x4B2F60B0: "__cdecl iswascii" _iswascii
0x4B2E5EB0: "__stdcall RtlFormatMessageEx" _RtlFormatMessageEx@40
0x4B2AC92A: "__stdcall RtlpRegTziFormatToTzi" _RtlpRegTziFormatToTzi@8
0x4B2A3BBC: "]:%u" ??_C@_19EPBCBBOP@?$AA?$FN?$AA?3?$AA?$CF?$AAu?$AA?$AA@
0x4B2934AC: "LdrpInitializeShimDllDependencie" ??_C@_0CC@KEOGGFBA@LdrpInitializeShimDllDependencie@
0x4B285750: "%d" ??_C@_02DPKJAMEF@?$CFd?$AA@
0x4B2E7381: "__stdcall RtlpGetStackLimits" _RtlpGetStackLimits@8
0x4B2F0480: "__stdcall ZwAccessCheck" _ZwAccessCheck@32
0x4B36DAED: "__stdcall RtlpIsLFHZoneAllocation" _RtlpIsLFHZoneAllocation@8
0x4B2A76B0: "__stdcall RtlInsertElementGenericTable" _RtlInsertElementGenericTable@16
0x4B33C2F0: "__stdcall AlpcGetCompletionListLastMessageInformation" _AlpcGetCompletionListLastMessageInformation@12
0x4B28793C: "SwitchedRtlGetVersion_Current" ??_C@_1DM@PBJCPGDO@?$AAS?$AAw?$AAi?$AAt?$AAc?$AAh?$AAe?$AAd?$AAR?$AAt?$AAl?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA_?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AA?$AA@
0x4B2EC8E0: "__stdcall SHA256Init" _SHA256Init@4
0x4B34B5C0: "__stdcall RtlClearBit" _RtlClearBit@8
0x4B2F1530: "__stdcall ZwMakeTemporaryObject" _ZwMakeTemporaryObject@4
0x4B369835: "__stdcall RtlpLogHeapSubSegmentActivate" _RtlpLogHeapSubSegmentActivate@8
0x4B3445C0: "__stdcall RtlSetSecurityDescriptorRMControl" _RtlSetSecurityDescriptorRMControl@8
0x4B2FABCE: "__cdecl _cintrindisp1" __cintrindisp1
0x4B2F20D0: "__stdcall NtUnlockFile" _NtUnlockFile@20
0x4B364160: "__stdcall RtlOsDeploymentState" _RtlOsDeploymentState@4
0x4B2A57C8: "RtlFreeHeap" ??_C@_0M@BBFBOFBP@RtlFreeHeap?$AA@
0x4B2A6240: "\??\%s" ??_C@_1O@PAJNNBDG@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x4B2FC8E0: "__cdecl mbtowc" _mbtowc
0x4B2810E8: "__cdecl LdrpDefaultExtension" _LdrpDefaultExtension
0x4B2F12E0: "__stdcall NtFlushProcessWriteBuffers" _NtFlushProcessWriteBuffers@0
0x4B380D30: "__stdcall TpQueryPoolStackInformation" _TpQueryPoolStackInformation@8
0x4B2EDA60: "__stdcall EtwProcessPrivateLoggerRequest" _EtwProcessPrivateLoggerRequest@4
0x4B32B3F0: "__stdcall DbgUiSetThreadDebugObject" _DbgUiSetThreadDebugObject@4
0x4B293DC4: "Calling KernelbasePostInit faile" ??_C@_0DH@IDGIBBJA@Calling?5KernelbasePostInit?5faile@
0x4B2F1270: "__stdcall ZwFilterBootOption" _ZwFilterBootOption@20
0x4B3818D2: "__stdcall TppRaiseHandleStatus" _TppRaiseHandleStatus@16
0x4B2EBDD0: "__stdcall RtlDecompressFragmentNS" _RtlDecompressFragmentNS@32
0x4B2886B0: "\Registry\Machine\System\Current" ??_C@_1HM@FADMAHML@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2B1130: "__stdcall RtlpIsDuplicateAce" _RtlpIsDuplicateAce@8
0x4B3379B0: "__stdcall RtlWow64GetCurrentMachine" _RtlWow64GetCurrentMachine@0
0x4B299820: "PortableOperatingSystem" ??_C@_1DA@IFMDNCPF@?$AAP?$AAo?$AAr?$AAt?$AAa?$AAb?$AAl?$AAe?$AAO?$AAp?$AAe?$AAr?$AAa?$AAt?$AAi?$AAn?$AAg?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$AA@
0x4B287B18: "Return correct version from Veri" ??_C@_1IO@JJHFBHII@?$AAR?$AAe?$AAt?$AAu?$AAr?$AAn?$AA?5?$AAc?$AAo?$AAr?$AAr?$AAe?$AAc?$AAt?$AA?5?$AAv?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAf?$AAr?$AAo?$AAm?$AA?5?$AAV?$AAe?$AAr?$AAi@
0x4B2F3622: "__cdecl _CIlog_default" __CIlog_default
0x4B3A00A0: "__cdecl AVrfpPageHeapPreviousStopData" _AVrfpPageHeapPreviousStopData
0x4B2CC2C0: "__stdcall RtlGetThreadPreferredUILanguages" _RtlGetThreadPreferredUILanguages@16
0x4B2B2DD9: "__stdcall LdrIsResItemExist" _LdrIsResItemExist@16
0x4B2C8DE6: "__stdcall LdrpLoadForwardedDll" _LdrpLoadForwardedDll@24
0x4B33A7F1: "__stdcall RtlpEnsureTailingSlashAndAddToList" _RtlpEnsureTailingSlashAndAddToList@8
0x4B281274: "__cdecl TppSimplepTaskVFuncs" _TppSimplepTaskVFuncs
0x4B2B596D: "__stdcall LdrpGetFullPath" _LdrpGetFullPath@8
0x4B295388: "advapi32.dll" ??_C@_1BK@JHLNAEJL@?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x4B2E3150: "__fastcall RtlpExtendLowFragHeapSegment" @RtlpExtendLowFragHeapSegment@12
0x4B35ECBA: "__stdcall RtlpUnsuppressForwardReferencingCallTarget" _RtlpUnsuppressForwardReferencingCallTarget@4
0x4B37770E: "__stdcall RtlpHpVaMgrCtxStart" _RtlpHpVaMgrCtxStart@20
0x4B2817A4: "`RtlpGetCustomCultureRegKey'::`2'::KeyName" ?KeyName@?1??RtlpGetCustomCultureRegKey@@9@9
0x4B2D75DF: "__stdcall RtlpHpStackTraceHeapDestroy" _RtlpHpStackTraceHeapDestroy@4
0x4B383170: "__stdcall SbpUpdateCacheWithCurrentImpl" _SbpUpdateCacheWithCurrentImpl@8
0x4B2877F4: "\SYSTEM32\" ??_C@_1BG@BIKONGDH@?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA3?$AA2?$AA?2?$AA?$AA@
0x4B2B6010: "__stdcall RtlCopyUnicodeString" _RtlCopyUnicodeString@8
0x4B39F950: "__cdecl NlsUnicodeToMbAnsiData" _NlsUnicodeToMbAnsiData
0x4B2B095D: "__stdcall RtlpGenerateInheritAcl" _RtlpGenerateInheritAcl@60
0x4B2D61FC: "__stdcall RtlpInitializeHeapSegment" _RtlpInitializeHeapSegment@32
0x4B284CE0: "UseFilter" ??_C@_1BE@BICGMBFB@?$AAU?$AAs?$AAe?$AAF?$AAi?$AAl?$AAt?$AAe?$AAr?$AA?$AA@
0x4B2E2D65: "__stdcall RtlpMuiRegDupLanguageList" _RtlpMuiRegDupLanguageList@8
0x4B37CBE7: "__stdcall TelemetryCoverageTableLocateInternal" _TelemetryCoverageTableLocateInternal@8
0x4B34B0B0: "__stdcall RtlUpcaseUnicodeStringToCountedOemString" _RtlUpcaseUnicodeStringToCountedOemString@12
0x4B2EE998: "__stdcall EtwpGetRegDwordValue" _EtwpGetRegDwordValue@12
0x4B3A0BD8: "__cdecl RtlpUnhandledExceptionFilter" _RtlpUnhandledExceptionFilter
0x4B287720: ".Local" ??_C@_1O@NBACDNPA@?$AA?4?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?$AA@
0x4B2F5B10: "__cdecl labs" _labs
0x4B37CC50: "__stdcall EtwCreateTraceInstanceId" _EtwCreateTraceInstanceId@8
0x4B29492C: "LdrpAllocateTls" ??_C@_0BA@OJNCDIPI@LdrpAllocateTls?$AA@
0x4B2F8C60: "__cdecl _rtforexpinf" __rtforexpinf
0x4B3A17E0: "__cdecl LdrParentRtlInitializeNtUserPfn" _LdrParentRtlInitializeNtUserPfn
0x4B2F1660: "__stdcall ZwOpenKeyTransactedEx" _ZwOpenKeyTransactedEx@20
0x4B298CB4: "IU" ??_C@_15JKLJPKGI@?$AAI?$AAU?$AA?$AA@
0x4B2A5318: "ProcessHeapsListIndex" ??_C@_0BG@GBCAKBDD@ProcessHeapsListIndex?$AA@
0x4B2F0C60: "__stdcall NtAlpcCreateSectionView" _NtAlpcCreateSectionView@12
0x4B32B020: "__stdcall DbgUiConnectToDbg" _DbgUiConnectToDbg@0
0x4B2E73AD: "__stdcall RtlpIsUserCallTargetBitMapCheckFault" _RtlpIsUserCallTargetBitMapCheckFault@4
0x4B287700: "__cdecl Magic86400000" _Magic86400000
0x4B2EADF5: "__stdcall TppFreeThreadData" _TppFreeThreadData@4
0x4B288500: "NUMBER_OF_PROCESSORS" ??_C@_1CK@OLLBFPKD@?$AAN?$AAU?$AAM?$AAB?$AAE?$AAR?$AA_?$AAO?$AAF?$AA_?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AAO?$AAR?$AAS?$AA?$AA@
0x4B2937BC: "Secure processes must be large a" ??_C@_0CO@JPNHBIGP@Secure?5processes?5must?5be?5large?5a@
0x4B382A51: "__stdcall RtlpTpIoDllUnloaded" _RtlpTpIoDllUnloaded@4
0x4B2A9439: "__stdcall RtlpUnregisterLockedMemoryZone" _RtlpUnregisterLockedMemoryZone@0
0x4B295094: "Industry Handheld" ??_C@_1CE@KPCCEMAN@?$AAI?$AAn?$AAd?$AAu?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAH?$AAa?$AAn?$AAd?$AAh?$AAe?$AAl?$AAd?$AA?$AA@
0x4B3A0BFC: "__cdecl LdrpProcessInitContextRecord" _LdrpProcessInitContextRecord
0x4B2F1BF0: "__stdcall NtRevertContainerImpersonation" _NtRevertContainerImpersonation@0
0x4B295370: "DeregisterEventSource" ??_C@_0BG@LPHFFLAA@DeregisterEventSource?$AA@
0x4B2E2750: "__stdcall EtwRegisterTraceGuidsA" _EtwRegisterTraceGuidsA@32
0x4B2E1714: "__stdcall RtlpGetActivationContextDataStorageMapAndRosterHeader" _RtlpGetActivationContextDataStorageMapAndRosterHeader@24
0x4B37052D: "__stdcall RtlCompressBufferXpressLzMax" _RtlCompressBufferXpressLzMax@36
0x4B356B38: "__stdcall RtlpWalkHeap" _RtlpWalkHeap@12
0x4B2DFC70: "__stdcall EtwEventActivityIdControl" _EtwEventActivityIdControl@8
0x4B2DEE00: "__stdcall RtlInitializeCriticalSection" _RtlInitializeCriticalSection@4
0x4B2B88E0: "__stdcall RtlpStkMarkDllRange" _RtlpStkMarkDllRange@4
0x4B3A09C4: "__cdecl LdrpImageEntry" _LdrpImageEntry
0x4B2F0790: "__stdcall ZwOpenThreadTokenEx" _ZwOpenThreadTokenEx@20
0x4B2ADB83: "__stdcall RtlpMuiRegGetLanguageSpec" _RtlpMuiRegGetLanguageSpec@20
0x4B2B7A4D: "__stdcall LdrpFindLoadedDllByMappingLockHeld" _LdrpFindLoadedDllByMappingLockHeld@16
0x4B2E7CA0: "__stdcall RtlWakeAllConditionVariable" _RtlWakeAllConditionVariable@4
0x4B2A6304: "AutoDownload" ??_C@_1BK@CFDJOJIA@?$AAA?$AAu?$AAt?$AAo?$AAD?$AAo?$AAw?$AAn?$AAl?$AAo?$AAa?$AAd?$AA?$AA@
0x4B295198: "Maker Board" ??_C@_1BI@IMILOLDB@?$AAM?$AAa?$AAk?$AAe?$AAr?$AA?5?$AAB?$AAo?$AAa?$AAr?$AAd?$AA?$AA@
0x4B3488FC: "__stdcall RtlFindAceBySid" _RtlFindAceBySid@12
0x4B331130: "__stdcall NtdllNtCurrentTeb" _NtdllNtCurrentTeb@0
0x4B2F1A80: "__stdcall ZwQueueApcThreadEx" _ZwQueueApcThreadEx@24
0x4B361698: "__stdcall NormBuffer__Append" _NormBuffer__Append@8
0x4B3535F0: "__stdcall RtlCmDecodeMemIoResource" _RtlCmDecodeMemIoResource@8
0x4B2F8C50: "__cdecl _rtinfnpop" __rtinfnpop
0x4B2F0C00: "__stdcall NtAlpcCancelMessage" _NtAlpcCancelMessage@12
0x4B294178: "MaxLoaderThreads" ??_C@_1CC@OLECMBJN@?$AAM?$AAa?$AAx?$AAL?$AAo?$AAa?$AAd?$AAe?$AAr?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAs?$AA?$AA@
0x4B295EB4: "DisableEscalation" ??_C@_1CE@OGDJKNMF@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAE?$AAs?$AAc?$AAa?$AAl?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B32D2A3: "__stdcall LdrpCheckComponentOnDemandEtwEvent" _LdrpCheckComponentOnDemandEtwEvent@4
0x4B2F0610: "__stdcall NtQueryInformationProcess" _NtQueryInformationProcess@20
0x4B343E70: "__stdcall RtlIsValidProcessTrustLabelSid" _RtlIsValidProcessTrustLabelSid@4
0x4B2E1500: "__stdcall RtlMultiAppendUnicodeStringBuffer" _RtlMultiAppendUnicodeStringBuffer@12
0x4B2F13F0: "__stdcall ZwGetWriteWatch" _ZwGetWriteWatch@28
0x4B2A92F0: "__stdcall RtlpModuleEnumeratorCallback" _RtlpModuleEnumeratorCallback@12
0x4B2F0520: "__stdcall ZwReleaseSemaphore" _ZwReleaseSemaphore@12
0x4B2ABAD0: "__stdcall TpWaitForIoCompletion" _TpWaitForIoCompletion@8
0x4B2B80EC: "__stdcall LdrpDoPostSnapWork" _LdrpDoPostSnapWork@4
0x4B2DAED1: "__stdcall LdrpRecordUnloadEvent" _LdrpRecordUnloadEvent@4
0x4B2F75B0: "__cdecl strcmp" _strcmp
0x4B3A0BB8: "__cdecl TlsExpansionBitMap" _TlsExpansionBitMap
0x4B33C170: "__stdcall FirstEntrySList" _FirstEntrySList@4
0x4B2F1D50: "__stdcall ZwSetHighEventPair" _ZwSetHighEventPair@4
0x4B2E4930: "__stdcall RtlQueryPackageIdentity" _RtlQueryPackageIdentity@24
0x4B368A85: "__stdcall RtlpHpStackTraceHeapGetContext" _RtlpHpStackTraceHeapGetContext@12
0x4B2F05D0: "__stdcall ZwQueryDefaultLocale" _ZwQueryDefaultLocale@8
0x4B2867D4: "tan" ??_C@_03IIINPABG@tan?$AA@
0x4B304440: "__stdcall NtdllScrollBarWndProc_A" _NtdllScrollBarWndProc_A@0
0x4B2E9050: "__stdcall RtlInitializeHandleTable" _RtlInitializeHandleTable@12
0x4B3011F4: "__cdecl _ungetwc_nolock" __ungetwc_nolock
0x4B2F1CF0: "__stdcall ZwSetDebugFilterState" _ZwSetDebugFilterState@12
0x4B2D3309: "__stdcall TppInitializeTimerQueue" _TppInitializeTimerQueue@8
0x4B343B00: "__stdcall RtlGetAppContainerSidType" _RtlGetAppContainerSidType@8
0x4B286850: "__cdecl _d_inf" __d_inf
0x4B3A0BF0: "__cdecl LdrpInitCompleteEvent" _LdrpInitCompleteEvent
0x4B2E51A7: "__stdcall _LdrpInitialize" __LdrpInitialize@8
0x4B3A41E0: "__cdecl __guard_check_icall_fptr" ___guard_check_icall_fptr
0x4B387A15: "__stdcall RtlpStackDbSegmentFindOrCreate" _RtlpStackDbSegmentFindOrCreate@8
0x4B2950D8: "Banking" ??_C@_1BA@BIIHFDPN@?$AAB?$AAa?$AAn?$AAk?$AAi?$AAn?$AAg?$AA?$AA@
0x4B286858: "__cdecl _d_ind" __d_ind
0x4B2932B0: "Process initialization failed wi" ??_C@_0DD@IDDMDDOL@Process?5initialization?5failed?5wi@
0x4B299D4C: "GCInterval" ??_C@_1BG@FALENDFF@?$AAG?$AAC?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AA?$AA@
0x4B285E8A: "__cdecl _pi_by_2_to_61" __pi_by_2_to_61
0x4B2F05F0: "__stdcall NtQueryValueKey" _NtQueryValueKey@24
0x4B36AD92: "__stdcall RtlDebugAllocateHeap" _RtlDebugAllocateHeap@12
0x4B2F1360: "__stdcall ZwGetContextThread" _ZwGetContextThread@8
0x4B2F0660: "__stdcall NtSetInformationProcess" _NtSetInformationProcess@16
0x4B2F4820: "__cdecl _ultow" __ultow
0x4B382F61: "__stdcall SbpLookup" _SbpLookup@8
0x4B2EAAEB: "__stdcall RtlpIsProtectedHeap" _RtlpIsProtectedHeap@4
0x4B371BE7: "__stdcall XpressBuildHuffmanEncodings" _XpressBuildHuffmanEncodings@4
0x4B343A10: "__stdcall RtlEraseUnicodeString" _RtlEraseUnicodeString@4
0x4B2F0F30: "__stdcall ZwCreateJobSet" _ZwCreateJobSet@12
0x4B37CAA2: "__stdcall EtwpTrackProviderBinary" _EtwpTrackProviderBinary@8
0x4B33D132: "__stdcall LdrpMUIEtwOutput" _LdrpMUIEtwOutput@16
0x4B330578: "__stdcall LdrpIsSubstringFound" _LdrpIsSubstringFound@8
0x4B298F4C: "RTL: Enter CriticalSection Timeo" ??_C@_0DE@OKDMMNAI@RTL?3?5Enter?5CriticalSection?5Timeo@
0x4B29AC88: "__cdecl crc64Mult_" _crc64Mult_
0x4B32A514: "__stdcall LdrpProcessImageProtectionParameter" _LdrpProcessImageProtectionParameter@8
0x4B3797A0: "__stdcall RtlpHpSegPageRangeCountCommittedPages" _RtlpHpSegPageRangeCountCommittedPages@12
0x4B2F13C0: "__stdcall NtGetNextThread" _NtGetNextThread@24
0x4B2D6550: "__stdcall RtlpAllocateDebugInfo" _RtlpAllocateDebugInfo@0
0x4B2F1900: "__stdcall NtQueryInformationTransaction" _NtQueryInformationTransaction@20
0x4B3A1680: "__cdecl RtlpMemoryZoneLock" _RtlpMemoryZoneLock
0x4B2F1860: "__stdcall NtQueryDirectoryObject" _NtQueryDirectoryObject@28
0x4B2E34AB: "__stdcall RtlpOptimizeSRWLockList" _RtlpOptimizeSRWLockList@8
0x4B2E7A90: "__stdcall LdrQueryImageFileExecutionOptions" _LdrQueryImageFileExecutionOptions@24
0x4B3A0BAC: "__cdecl LdrpAppHeaders" _LdrpAppHeaders
0x4B2E30DE: "__fastcall RtlpGetLFHContext" @RtlpGetLFHContext@8
0x4B2EB4C0: "__stdcall RtlDuplicateUnicodeString" _RtlDuplicateUnicodeString@12
0x4B2AC9A0: "__stdcall RtlpGetDynamicTimeZoneInfoHandle" _RtlpGetDynamicTimeZoneInfoHandle@8
0x4B2FC7F0: "__cdecl _wctomb_s_l" __wctomb_s_l
0x4B299B18: "*** ASSERT FAILED: Input paramet" ??_C@_0HP@IHMEMGDO@?$CK?$CK?$CK?5ASSERT?5FAILED?3?5Input?5paramet@
0x4B39E3B0: "__cdecl RtlpLockedSectionList" _RtlpLockedSectionList
0x4B2C7702: "__stdcall LdrpFindLoadedDllInternal" _LdrpFindLoadedDllInternal@20
0x4B3A4228: "__cdecl Wow64Transition" _Wow64Transition
0x4B2EBC00: "__stdcall RtlAddRefMemoryStream" _RtlAddRefMemoryStream@4
0x4B335BC0: "__stdcall RtlAddVectoredContinueHandler" _RtlAddVectoredContinueHandler@8
0x4B2F13E0: "__stdcall NtGetNotificationResourceManager" _NtGetNotificationResourceManager@28
0x4B2F4650: "__cdecl _ultoa" __ultoa
0x4B284D84: "Kernel-MUI-Number-Allowed" ??_C@_1DE@JIOMGOFI@?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AA?9?$AAM?$AAU?$AAI?$AA?9?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?9?$AAA?$AAl?$AAl?$AAo?$AAw?$AAe?$AAd?$AA?$AA@
0x4B2E9A0B: "__stdcall LdrpInitializePolicy" _LdrpInitializePolicy@0
0x4B2CA7BD: "__stdcall LdrpLogDelayLoadTrigger" _LdrpLogDelayLoadTrigger@16
0x4B2B0CC0: "__stdcall RtlFindAceByType" _RtlFindAceByType@12
0x4B2E03F0: "__stdcall RtlTimeToTimeFields" _RtlTimeToTimeFields@8
0x4B2EAE25: "__stdcall RtlpCallVectoredHandlers" _RtlpCallVectoredHandlers@12
0x4B2F1CA0: "__stdcall NtSetBootEntryOrder" _NtSetBootEntryOrder@8
0x4B338330: "__stdcall RtlWerpReportException" _RtlWerpReportException@24
0x4B2F0A70: "__stdcall NtCancelIoFile" _NtCancelIoFile@8
0x4B3A1648: "__cdecl LdrpForkConditionVariable" _LdrpForkConditionVariable
0x4B33871B: "__stdcall WerpBreakIntoDebuggerIfPresent" _WerpBreakIntoDebuggerIfPresent@12
0x4B2A5BE4: "Tag %04x (%ws) size incorrect (%" ??_C@_0CP@NMPFABLH@Tag?5?$CF04x?5?$CI?$CFws?$CJ?5size?5incorrect?5?$CI?$CF@
0x4B36ACB0: "__stdcall RtlpHpTagRunOnceInit" _RtlpHpTagRunOnceInit@12
0x4B370FA0: "__stdcall RtlCompressWorkSpaceSizeXpressHuff" _RtlCompressWorkSpaceSizeXpressHuff@12
0x4B2F1B60: "__stdcall ZwRenameTransactionManager" _ZwRenameTransactionManager@8
0x4B3A1540: "__cdecl LdrpThunkSignature" _LdrpThunkSignature
0x4B2F1CE0: "__stdcall NtSetContextThread" _NtSetContextThread@8
0x4B2A60EC: ".sb_data" ??_C@_08FANNBIHM@?4sb_data?$AA@
0x4B2A3E08: "ServerNt" ??_C@_1BC@GNJGMHML@?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAN?$AAt?$AA?$AA@
0x4B284F68: "\Program Files" ??_C@_1BO@GEKCLFLB@?$AA?2?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AA?5?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x4B2F0AB0: "__stdcall NtCancelTimer" _NtCancelTimer@8
0x4B377C58: "__stdcall RtlpHpVaMgrRegionAllocate" _RtlpHpVaMgrRegionAllocate@4
0x4B34E470: "__stdcall RtlSetPortableOperatingSystem" _RtlSetPortableOperatingSystem@4
0x4B294580: "LdrpDetectDetour" ??_C@_0BB@GGNGOJOC@LdrpDetectDetour?$AA@
0x4B294484: "LdrpMinimalMapModule" ??_C@_0BF@GGGOKJKP@LdrpMinimalMapModule?$AA@
0x4B2F1970: "__stdcall ZwQueryMultipleValueKey" _ZwQueryMultipleValueKey@24
0x4B2E4801: "__stdcall RtlpAllocateActivationContextStackFrame" _RtlpAllocateActivationContextStackFrame@12
0x4B2DC74D: "__stdcall TppWorkpValidateWork" _TppWorkpValidateWork@12
0x4B36F4C0: "__stdcall RtlDecompressBufferLZNT1" _RtlDecompressBufferLZNT1@28
0x4B2A6250: "\Registry\Machine\System\Current" ??_C@_1JG@EEECFNPB@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B39FDDC: "__cdecl LoadAsDataTableCount" _LoadAsDataTableCount
0x4B39F0F4: "__cdecl __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUvgdUmgwooUdldGEDCUlyquivUrDIGUvgdmgwookOlyq@etwntdll" ___@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUvgdUmgwooUdldGEDCUlyquivUrDIGUvgdmgwookOlyq@etwntdll
0x4B2DDE31: "__stdcall RtlpFreeActivationContext" _RtlpFreeActivationContext@4
0x4B3646B0: "__stdcall RtlpRtlpCtSelfSubscribeCallback" _RtlpRtlpCtSelfSubscribeCallback@28
0x4B294230: "CFGOptions" ??_C@_1BG@EMGCODKE@?$AAC?$AAF?$AAG?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x4B2CEB09: "__stdcall TppCallbackEpilog" _TppCallbackEpilog@4
0x4B285270: "LdrResFallbackLangList Enter" ??_C@_1DK@FDOJIHLD@?$AAL?$AAd?$AAr?$AAR?$AAe?$AAs?$AAF?$AAa?$AAl?$AAl?$AAb?$AAa?$AAc?$AAk?$AAL?$AAa?$AAn?$AAg?$AAL?$AAi?$AAs?$AAt?$AA?5?$AAE?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x4B2B1EC1: "__stdcall LdrpReleaseDllPath" _LdrpReleaseDllPath@4
0x4B2E73B7: "__stdcall RtlGuardIsValidStackPointer" _RtlGuardIsValidStackPointer@8
0x4B2A8640: "__stdcall RtlDeleteTimer" _RtlDeleteTimer@12
0x4B2AB0D0: "__stdcall RtlAddVectoredExceptionHandler" _RtlAddVectoredExceptionHandler@8
0x4B2F1F90: "__stdcall NtSignalAndWaitForSingleObject" _NtSignalAndWaitForSingleObject@16
0x4B2CB4E2: "__stdcall LdrpDllCharacteristicsToLoadFlags" _LdrpDllCharacteristicsToLoadFlags@4
0x4B37FCD0: "__stdcall EvtIntReportAuthzEventAndSourceAsync" _EvtIntReportAuthzEventAndSourceAsync@44
0x4B2F0BB0: "__stdcall ZwAllocateReserveObject" _ZwAllocateReserveObject@12
0x4B374992: "__stdcall RtlpHpLfhBucketInitialize" _RtlpHpLfhBucketInitialize@12
0x4B3714E0: "__stdcall RtlDecompressBufferXpressLz" _RtlDecompressBufferXpressLz@28
0x4B3656D1: "__stdcall RtlpMuiRegGetFallbackInstalledLanguageInfoByLangId" _RtlpMuiRegGetFallbackInstalledLanguageInfoByLangId@20
0x4B2F18B0: "__stdcall NtQueryInformationByName" _NtQueryInformationByName@20
0x4B2E4970: "__stdcall RtlQueryPackageIdentityEx" _RtlQueryPackageIdentityEx@28
0x4B3479A0: "__stdcall RtlQueryCriticalSectionOwner" _RtlQueryCriticalSectionOwner@8
0x4B2F0F60: "__stdcall ZwCreateLowBoxToken" _ZwCreateLowBoxToken@36
0x4B2A6E10: "__stdcall EtwEventProviderEnabled" _EtwEventProviderEnabled@20
0x4B299E00: "__cdecl RtlCrc32Table" _RtlCrc32Table
0x4B284D4C: "Kernel-MUI-Language-Allowed" ??_C@_1DI@OBLKKNGH@?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AA?9?$AAM?$AAU?$AAI?$AA?9?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AA?9?$AAA?$AAl?$AAl?$AAo?$AAw?$AAe?$AAd?$AA?$AA@
0x4B336704: "__stdcall AVrfpFindClosestThunkDuplicate" _AVrfpFindClosestThunkDuplicate@12
0x4B296C88: "SXS/RTL: Activation context data" ??_C@_0FF@CJICNIOA@SXS?1RTL?3?5Activation?5context?5data@
0x4B2F8230: "__cdecl wcsnlen" _wcsnlen
0x4B2B4E60: "__stdcall LdrpResGetMappingSize" _LdrpResGetMappingSize@16
0x4B373F30: "__stdcall RtlpHpMetadataHeapCreate" _RtlpHpMetadataHeapCreate@12
0x4B284A84: "Control Panel\Desktop" ??_C@_1CM@FDDKAFMM@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?5?$AAP?$AAa?$AAn?$AAe?$AAl?$AA?2?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?$AA@
0x4B3A0B30: "__cdecl LdrpTlsBitmap" _LdrpTlsBitmap
0x4B372DC7: "__stdcall RtlpHpComputeSizeInfo" _RtlpHpComputeSizeInfo@20
0x4B2E68D8: "__stdcall LdrpGetFileDriverStoreRoot" _LdrpGetFileDriverStoreRoot@12
0x4B2F81A0: "__cdecl wcsncmp" _wcsncmp
0x4B2D65BB: "__fastcall RtlpCommitBlock" @RtlpCommitBlock@8
0x4B2F1A20: "__stdcall NtQuerySystemEnvironmentValue" _NtQuerySystemEnvironmentValue@16
0x4B2BA10A: "__stdcall RtlpImageDirectoryEntryToDataEx" _RtlpImageDirectoryEntryToDataEx@20
0x4B2F4EE0: "__cdecl _strlwr_s" __strlwr_s
0x4B39F680: "__cdecl RtlpProtectedHeapsListBuffer" _RtlpProtectedHeapsListBuffer
0x4B2A4A1C: "Error code: %d - %s " ??_C@_0BF@BIFIJEKN@Error?5code?3?5?$CFd?5?9?5?$CFs?6?$AA@
0x4B2F1830: "__stdcall NtQueryBootOptions" _NtQueryBootOptions@8
0x4B286844: "_nextafter" ??_C@_0L@KDOEJCKC@_nextafter?$AA@
0x4B293030: "LdrInitializeThunk" ??_C@_0BD@INALBIAL@LdrInitializeThunk?$AA@
0x4B2F0AF0: "__stdcall ZwAccessCheckByTypeResultListAndAuditAlarm" _ZwAccessCheckByTypeResultListAndAuditAlarm@64
0x4B375177: "__stdcall RtlpHpLfhOwnerLockUnlock" _RtlpHpLfhOwnerLockUnlock@8
0x4B2AEFB1: "__stdcall RtlpCopyAces" _RtlpCopyAces@56
0x4B2F1F80: "__stdcall ZwShutdownWorkerFactory" _ZwShutdownWorkerFactory@8
0x4B2AADA7: "__fastcall RtlpInsertUCRBlock" @RtlpInsertUCRBlock@8
0x4B3322C0: "__stdcall RtlWriteMemoryStream" _RtlWriteMemoryStream@16
0x4B3839F0: "__stdcall PssNtFreeRemoteSnapshot" _PssNtFreeRemoteSnapshot@8
0x4B295358: "DeviceForm" ??_C@_1BG@LDBNICEA@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAF?$AAo?$AAr?$AAm?$AA?$AA@
0x4B3524FE: "__stdcall RtlpSetMachineUILanguagesImmediate" _RtlpSetMachineUILanguagesImmediate@8
0x4B2A8360: "__stdcall RtlpTpWaitCallback" _RtlpTpWaitCallback@16
0x4B35948A: "__stdcall RtlpLocateXStateChunk" _RtlpLocateXStateChunk@4
0x4B2F1B90: "__stdcall ZwReplyWaitReplyPort" _ZwReplyWaitReplyPort@8
0x4B2A3A58: "%p %-16Ix %Id" ??_C@_0BA@NHOKOPHO@?$CFp?5?5?$CF?916Ix?5?5?$CFId?$AA@
0x4B37C073: "__stdcall RtlpHpVsSubsegmentFree" _RtlpHpVsSubsegmentFree@12
0x4B287880: "TermsrvGetWindowsDirectoryW" ??_C@_0BM@LNANPNJB@TermsrvGetWindowsDirectoryW?$AA@
0x4B2F8830: "__cdecl _rtonenpop" __rtonenpop
0x4B364B80: "__stdcall RtlTraceDatabaseValidate" _RtlTraceDatabaseValidate@4
0x4B39F614: "__cdecl gSystemLocale" _gSystemLocale
0x4B355910: "__stdcall RtlpHpRemoteStackSerializeWriter" _RtlpHpRemoteStackSerializeWriter@12
0x4B37C310: "__stdcall MD4Init" _MD4Init@4
0x4B358770: "__stdcall RtlGetExtendedContextLength" _RtlGetExtendedContextLength@8
0x4B285BD0: "\Registry\Machine\System\Current" ??_C@_1GG@KMAKALDL@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2F2000: "__stdcall ZwSystemDebugControl" _ZwSystemDebugControl@24
0x4B2881E4: "\\?\" ??_C@_19MJCDBCKE@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AA?$AA@
0x4B293468: "Initializing a shim dependency "" ??_C@_0EB@LPFJLIAB@Initializing?5a?5shim?5dependency?5?$CC@
0x4B3A09FC: "__cdecl LdrpMrdataLock" _LdrpMrdataLock
0x4B3A15B0: "__cdecl LdrpDelayedTlsReclaimTable" _LdrpDelayedTlsReclaimTable
0x4B2F2070: "__stdcall ZwTranslateFilePath" _ZwTranslateFilePath@16
0x4B32B390: "__stdcall DbgUiRemoteBreakin" _DbgUiRemoteBreakin@4
0x4B366CE7: "__stdcall _RtlpMuiRegInitPartialLanguage" __RtlpMuiRegInitPartialLanguage@12
0x4B2F04B0: "__stdcall NtMapUserPhysicalPagesScatter" _NtMapUserPhysicalPagesScatter@12
0x4B2DADE1: "__stdcall LdrpProcessDetachNode" _LdrpProcessDetachNode@4
0x4B28679C: "acos" ??_C@_04PDIFKINK@acos?$AA@
0x4B36D9B8: "__stdcall RtlSetLFHDebuggingInformation" _RtlSetLFHDebuggingInformation@8
0x4B35B770: "__stdcall RtlRealPredecessor" _RtlRealPredecessor@4
0x4B366248: "__stdcall RtlpMuiRegResizeLanguages" _RtlpMuiRegResizeLanguages@8
0x4B2F1810: "__stdcall ZwQueryAuxiliaryCounterFrequency" _ZwQueryAuxiliaryCounterFrequency@4
0x4B294248: "LargePageDLLs" ??_C@_1BM@FKNDABPG@?$AAL?$AAa?$AAr?$AAg?$AAe?$AAP?$AAa?$AAg?$AAe?$AAD?$AAL?$AAL?$AAs?$AA?$AA@
0x4B2F0B90: "__stdcall NtAlertThreadByThreadId" _NtAlertThreadByThreadId@4
0x4B287848: "ERROR" ??_C@_05MBDEGLCK@ERROR?$AA@
0x4B2B2EA0: "__stdcall RtlReplaceSystemDirectoryInPath" _RtlReplaceSystemDirectoryInPath@16
0x4B2D7610: "__stdcall TpAllocWork" _TpAllocWork@16
0x4B34B470: "__stdcall RtlUpperString" _RtlUpperString@8
0x4B332202: "__cdecl StringCbPrintfW" _StringCbPrintfW
0x4B2B8DA0: "__stdcall RtlImageNtHeader" _RtlImageNtHeader@4
0x4B37DF9C: "__stdcall EtwpFreeLoggerContext" _EtwpFreeLoggerContext@4
0x4B374C1A: "__stdcall RtlpHpLfhBucketUpdateStats" _RtlpHpLfhBucketUpdateStats@12
0x4B287AF8: "Win32AppCompat" ??_C@_1BO@MHOCFOI@?$AAW?$AAi?$AAn?$AA3?$AA2?$AAA?$AAp?$AAp?$AAC?$AAo?$AAm?$AAp?$AAa?$AAt?$AA?$AA@
0x4B3506C7: "__stdcall RtlpAutoCompleteLanguageFallback" _RtlpAutoCompleteLanguageFallback@12
0x4B281B98: "__cdecl VerifierDllString" _VerifierDllString
0x4B362204: "__stdcall Normalization__IsNormalized" _Normalization__IsNormalized@16
0x4B2FD700: "__cdecl _wsplitpath_s" __wsplitpath_s
0x4B357CE0: "__stdcall RtlCreateHashTable" _RtlCreateHashTable@12
0x4B361CA6: "__stdcall NormBuffer__VerifyLastStart" _NormBuffer__VerifyLastStart@4
0x4B347830: "__stdcall RtlConvertExclusiveToShared" _RtlConvertExclusiveToShared@4
0x4B371030: "__stdcall RtlDecompressBufferXpressHuff" _RtlDecompressBufferXpressHuff@28
0x4B32CD00: "__stdcall RtlGetUnloadEventTrace" _RtlGetUnloadEventTrace@0
0x4B2D0390: "__stdcall TpSetWaitEx" _TpSetWaitEx@16
0x4B33B238: "__stdcall RtlpQueryAssemblyInformationActivationContextDetailedInformation" _RtlpQueryAssemblyInformationActivationContextDetailedInformation@20
0x4B2B7740: "__stdcall RtlInitUnicodeStringEx" _RtlInitUnicodeStringEx@8
0x4B369F69: "__stdcall RtlpRegisterStackTrace" _RtlpRegisterStackTrace@12
0x4B2F1800: "__stdcall NtPulseEvent" _NtPulseEvent@8
0x4B3A1782: "__cdecl RtlpCriticalSectionVerifier" _RtlpCriticalSectionVerifier
0x4B2FB4E8: "__cdecl _handle_qnan1" __handle_qnan1
0x4B2F1B70: "__stdcall NtReplaceKey" _NtReplaceKey@12
0x4B2E943B: "__stdcall LdrpQueueDeferredTlsData" _LdrpQueueDeferredTlsData@8
0x4B2B2F37: "__stdcall RtlpReplaceFirstUnicodeSubstringOfEqualLength" _RtlpReplaceFirstUnicodeSubstringOfEqualLength@12
0x4B2F0A90: "__stdcall NtPowerInformation" _NtPowerInformation@20
0x4B2F10B0: "__stdcall ZwCreateTransaction" _ZwCreateTransaction@40
0x4B2983C0: "SXS: Storage resolution failed t" ??_C@_0FB@ECDIMNE@SXS?3?5Storage?5resolution?5failed?5t@
0x4B2F0C50: "__stdcall NtAlpcCreateResourceReserve" _NtAlpcCreateResourceReserve@16
0x4B288410: "\Registry\Machine\SYSTEM\Current" ??_C@_1IG@EPMAHCPK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2F1570: "__stdcall ZwMapUserPhysicalPages" _ZwMapUserPhysicalPages@12
0x4B3A1748: "__cdecl RtlpCapChkTelemetryRunOnceCtx" _RtlpCapChkTelemetryRunOnceCtx
0x4B377481: "__stdcall RtlpHpVaMgrCtxAllocatorReference" _RtlpHpVaMgrCtxAllocatorReference@12
0x4B2F1930: "__stdcall ZwQueryInstallUILanguage" _ZwQueryInstallUILanguage@4
0x4B32D01D: "__stdcall LdrpHandleUnprotectedDelayLoad" _LdrpHandleUnprotectedDelayLoad@24
0x4B39F104: "__cdecl EtwpLoggerArray" _EtwpLoggerArray
0x4B2D1AF0: "__stdcall LdrpCheckForRetryLoading" _LdrpCheckForRetryLoading@8
0x4B2F1780: "__stdcall ZwPrePrepareEnlistment" _ZwPrePrepareEnlistment@8
0x4B2D8FB4: "__stdcall RtlpActivateLowFragmentationHeap" _RtlpActivateLowFragmentationHeap@4
0x4B2DEFD0: "__stdcall RtlUnlockHeap" _RtlUnlockHeap@4
0x4B2A6AF0: "__stdcall RtlInsertElementGenericTableFullAvl" _RtlInsertElementGenericTableFullAvl@24
0x4B2F15F0: "__stdcall ZwNotifyChangeSession" _ZwNotifyChangeSession@32
0x4B284EF0: "\Registry\Machine\SOFTWARE\Polic" ??_C@_1HG@LDHOILNO@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc@
0x4B28C4A4: "Security-System-Capability-" ??_C@_1DI@KIKALOEO@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?9?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?9?$AAC?$AAa?$AAp?$AAa?$AAb?$AAi?$AAl?$AAi?$AAt?$AAy?$AA?9?$AA?$AA@
0x4B39F0E8: "__cdecl __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhdrgxsyzxpUxlmgvcgUolzwviUlyquivUrDIGUkivxlnkOlyq@SwitchContextLoader" ___@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhdrgxsyzxpUxlmgvcgUolzwviUlyquivUrDIGUkivxlnkOlyq@SwitchContextLoader
0x4B2F0750: "__stdcall ZwReplyWaitReceivePortEx" _ZwReplyWaitReceivePortEx@20
0x4B3322A0: "__stdcall RtlInitMemoryStream" _RtlInitMemoryStream@4
0x4B2E9E20: "__stdcall TpSetPoolMaxThreadsSoftLimit" _TpSetPoolMaxThreadsSoftLimit@8
0x4B378620: "__stdcall RtlpHpSegLfhExtendContext" _RtlpHpSegLfhExtendContext@8
0x4B2F536D: "__cdecl _vsnwprintf_l" __vsnwprintf_l
0x4B368980: "__stdcall RtlpHpStackTraceEventWriter" _RtlpHpStackTraceEventWriter@12
0x4B380CC0: "__stdcall TppJobpStopCallbackGeneration" _TppJobpStopCallbackGeneration@8
0x4B2848C0: "\Registry\Machine\System\Current" ??_C@_1IA@LECPAJIF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2F1F50: "__stdcall ZwSetVolumeInformationFile" _ZwSetVolumeInformationFile@20
0x4B2D0B54: "__stdcall TppCancelTimer" _TppCancelTimer@12
0x4B292C78: "LdrResolveDelayLoadedAPI:Unable " ??_C@_0EL@GICBJNHB@LdrResolveDelayLoadedAPI?3Unable?5@
0x4B2F1980: "__stdcall ZwQueryMutant" _ZwQueryMutant@20
0x4B39F6E0: "__cdecl RtlpDefaultHeapDebuggingOptions" _RtlpDefaultHeapDebuggingOptions
0x4B2B0A61: "__stdcall RtlpGenerateInheritedAce" _RtlpGenerateInheritedAce@56
0x4B364A50: "__stdcall RtlTraceDatabaseEnumerate" _RtlTraceDatabaseEnumerate@12
0x4B2852AC: "LdrResFallbackLangList Exit" ??_C@_1DI@OBGMOLJJ@?$AAL?$AAd?$AAr?$AAR?$AAe?$AAs?$AAF?$AAa?$AAl?$AAl?$AAb?$AAa?$AAc?$AAk?$AAL?$AAa?$AAn?$AAg?$AAL?$AAi?$AAs?$AAt?$AA?5?$AAE?$AAx?$AAi?$AAt?$AA?$AA@
0x4B303E96: "__stdcall RtlpHpMetadataCommit" _RtlpHpMetadataCommit@24
0x4B3A0B28: "__cdecl LdrpStaticTlsBitmapVector" _LdrpStaticTlsBitmapVector
0x4B359559: "__stdcall RtlpCopyMappedMemoryEx" _RtlpCopyMappedMemoryEx@24
0x4B304770: "__stdcall NtdllDialogWndProcWorker" _NtdllDialogWndProcWorker@0
0x4B2F15E0: "__stdcall ZwNotifyChangeMultipleKeys" _ZwNotifyChangeMultipleKeys@48
0x4B33CAB0: "__stdcall LdrGetFileNameFromLoadAsDataTable" _LdrGetFileNameFromLoadAsDataTable@8
0x4B2F1320: "__stdcall ZwFreezeRegistry" _ZwFreezeRegistry@4
0x4B287840: "WARNING" ??_C@_07KCOHIFOP@WARNING?$AA@
0x4B294F88: "Windows.Core" ??_C@_1BK@OHIBJBEF@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAC?$AAo?$AAr?$AAe?$AA?$AA@
0x4B2A3E1C: "WinNt" ??_C@_1M@PFFFELPH@?$AAW?$AAi?$AAn?$AAN?$AAt?$AA?$AA@
0x4B357D30: "__stdcall RtlDeleteHashTable" _RtlDeleteHashTable@4
0x4B3681A0: "__stdcall RtlpHpStackDbAllocRoutine" _RtlpHpStackDbAllocRoutine@8
0x4B3859F2: "__stdcall PsspWalkInfoClass_PSS_WALK_AUXILIARY_PAGES" _PsspWalkInfoClass_PSS_WALK_AUXILIARY_PAGES@12
0x4B2E2B40: "__stdcall RtlDecodePointer" _RtlDecodePointer@4
0x4B34BC10: "__stdcall RtlFindClearRuns" _RtlFindClearRuns@16
0x4B2C8AB0: "__stdcall LdrpLangFallbackListFindNode" _LdrpLangFallbackListFindNode@16
0x4B32AB50: "__stdcall RtlDosSearchPath_U" _RtlDosSearchPath_U@24
0x4B34E4F0: "__stdcall RtlCreateRegistryKey" _RtlCreateRegistryKey@8
0x4B2F9138: "__cdecl __except_validate_context_record" ___except_validate_context_record
0x4B2B39AD: "__stdcall LdrpResSearchResourceMappedFile" _LdrpResSearchResourceMappedFile@36
0x4B3A0100: "__cdecl AvrfpLoaderEntry" _AvrfpLoaderEntry
0x4B39F118: "__cdecl EtwpRegistrationCount" _EtwpRegistrationCount
0x4B2D22FE: "__stdcall LdrpDynamicShimModule" _LdrpDynamicShimModule@4
0x4B2D0D7D: "__stdcall LdrpDropLastInProgressCount" _LdrpDropLastInProgressCount@0
0x4B298368: "SXS: Unable to open assembly dir" ??_C@_0FC@JNGLGJPK@SXS?3?5Unable?5to?5open?5assembly?5dir@
0x4B369732: "__stdcall RtlpLogHeapReallocateEvent" _RtlpLogHeapReallocateEvent@24
0x4B2DF65C: "__stdcall LdrpAllocateTlsEntry" _LdrpAllocateTlsEntry@20
0x4B299A74: "PreferredUILanguagesPending" ??_C@_1DI@FJENBGDK@?$AAP?$AAr?$AAe?$AAf?$AAe?$AAr?$AAr?$AAe?$AAd?$AAU?$AAI?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAs?$AAP?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?$AA@
0x4B2B1E15: "__stdcall LdrpMapDllRetry" _LdrpMapDllRetry@4
0x4B34A92A: "__stdcall RtlpUnregisterLockedMemoryBlockLookaside" _RtlpUnregisterLockedMemoryBlockLookaside@0
0x4B344933: "__cdecl RtlStringCchPrintfW" _RtlStringCchPrintfW
0x4B36F8DD: "__stdcall RtlCompressBufferXpressHuffMax" _RtlCompressBufferXpressHuffMax@36
0x4B363B70: "__stdcall RtlStdLogStackTrace" _RtlStdLogStackTrace@8
0x4B2DFB70: "__stdcall RtlUnicodeToMultiByteN" _RtlUnicodeToMultiByteN@20
0x4B299700: "\REGISTRY\MACHINE\SYSTEM\Current" ??_C@_1GG@IBGAEKLO@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2887B0: "__cdecl WNF_SEB_DEV_MNF_CUSTOM_NOTIFICATION_RECEIVED" _WNF_SEB_DEV_MNF_CUSTOM_NOTIFICATION_RECEIVED
0x4B28AC80: "__cdecl RtlpRunTable" _RtlpRunTable
0x4B2F1170: "__stdcall ZwDeleteFile" _ZwDeleteFile@4
0x4B2D1EB1: "__stdcall RtlpWaitOnAddress" _RtlpWaitOnAddress@20
0x4B2CFDF0: "__stdcall RtlEnterCriticalSection" _RtlEnterCriticalSection@4
0x4B2F0D40: "__stdcall ZwAlpcSendWaitReceivePort" _ZwAlpcSendWaitReceivePort@32
0x4B2979B0: "SXS: %s() - caller supplied no b" ??_C@_0FO@JNIDBKAC@SXS?3?5?$CFs?$CI?$CJ?5?9?5caller?5supplied?5no?5b@
0x4B34B7C0: "__stdcall RtlExtractBitMap" _RtlExtractBitMap@16
0x4B3808C0: "__stdcall TpReleaseJobNotification" _TpReleaseJobNotification@4
0x4B34E6F0: "__stdcall RtlQueryRegistryValuesEx" _RtlQueryRegistryValuesEx@20
0x4B33C990: "__stdcall LdrFindResourceDirectory_U" _LdrFindResourceDirectory_U@16
0x4B288590: "CommonProgramFiles" ??_C@_1CG@HMNDLOFD@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x4B304BE0: "__stdcall _RtlEnlargedIntegerMultiply" __RtlEnlargedIntegerMultiply@8
0x4B3395A0: "__stdcall WinSqmAddToStream" _WinSqmAddToStream@16
0x4B2D6537: "__stdcall RtlLogStackBackTraceEx" _RtlLogStackBackTraceEx@4
0x4B39F630: "__cdecl RtlpLeakList" _RtlpLeakList
0x4B39F120: "__cdecl EtwpMaxLoggers" _EtwpMaxLoggers
0x4B2F1850: "__stdcall NtQueryDirectoryFileEx" _NtQueryDirectoryFileEx@40
0x4B2B5680: "__stdcall LdrGetDllHandleByMapping" _LdrGetDllHandleByMapping@8
0x4B2937A8: "BaseQueryModuleData" ??_C@_0BE@OCNPPMKM@BaseQueryModuleData?$AA@
0x4B292D2C: "LoadResource API entry" ??_C@_1CO@FEOAEHKM@?$AAL?$AAo?$AAa?$AAd?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAA?$AAP?$AAI?$AA?5?$AAe?$AAn?$AAt?$AAr?$AAy?$AA?$AA@
0x4B33FD30: "__stdcall LdrProcessRelocationBlock" _LdrProcessRelocationBlock@16
0x4B294130: "ShutdownFlags" ??_C@_1BM@JMKJILKC@?$AAS?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x4B355660: "__stdcall RtlpHeapQueryTotalReserveSize" _RtlpHeapQueryTotalReserveSize@8
0x4B2935F8: "Failed to allocated memory for s" ??_C@_0DE@PKMNOJFL@Failed?5to?5allocated?5memory?5for?5s@
0x4B2C4EC0: "__stdcall RtlFreeHeap" _RtlFreeHeap@12
0x4B364E00: "__stdcall RtlWaitOnAddress" _RtlWaitOnAddress@16
0x4B3A1AAC: "__cdecl PossibleDeadlockReportCounter" _PossibleDeadlockReportCounter
0x4B3805E0: "__stdcall TpAlpcUnregisterCompletionList" _TpAlpcUnregisterCompletionList@4
0x4B32DCA1: "__stdcall LdrpLogImportRedirectionTelemetry" _LdrpLogImportRedirectionTelemetry@4
0x4B2929D8: "LdrLockLoaderLock" ??_C@_0BC@JHLIPNEA@LdrLockLoaderLock?$AA@
0x4B2F0AC0: "__stdcall NtSetTimer" _NtSetTimer@28
0x4B304640: "__stdcall NtdllGhostWndProc_A" _NtdllGhostWndProc_A@0
0x4B2CB96B: "__stdcall LdrpFindLoadedDllByHandle" _LdrpFindLoadedDllByHandle@12
0x4B2DD160: "__stdcall TppWorkCallbackPrologRelease" _TppWorkCallbackPrologRelease@12
0x4B2AD87C: "__stdcall _RtlpRemovePendingDeleteLanguages" __RtlpRemovePendingDeleteLanguages@8
0x4B2F1700: "__stdcall ZwOpenSession" _ZwOpenSession@12
0x4B297E38: "SXS: Assembly storage root locat" ??_C@_0EO@HNPDHLBL@SXS?3?5Assembly?5storage?5root?5locat@
0x4B3572B0: "__stdcall RtlCompareAltitudes" _RtlCompareAltitudes@8
0x4B37512D: "__stdcall RtlpHpLfhOwnerListLockUnlock" _RtlpHpLfhOwnerListLockUnlock@16
0x4B2F17C0: "__stdcall NtPrivilegeObjectAuditAlarm" _NtPrivilegeObjectAuditAlarm@24
0x4B2F6186: "__cdecl _iswctype_l" __iswctype_l
0x4B2E9330: "__stdcall RtlExitUserThread" _RtlExitUserThread@4
0x4B2810F8: "__cdecl RtlpDosDevicesPrefix" _RtlpDosDevicesPrefix
0x4B2F0840: "__stdcall ZwWriteVirtualMemory" _ZwWriteVirtualMemory@20
0x4B2F0A40: "__stdcall ZwQuerySystemTime" _ZwQuerySystemTime@4
0x4B3A1AC0: "__cdecl RtlpHpGCTimerScheduled" _RtlpHpGCTimerScheduled
0x4B2F0D30: "__stdcall ZwAlpcRevokeSecurityContext" _ZwAlpcRevokeSecurityContext@12
0x4B32CDB0: "__stdcall LdrQueryOptionalDelayLoadedAPI" _LdrQueryOptionalDelayLoadedAPI@16
0x4B2AACAF: "__stdcall LdrpLogError" _LdrpLogError@16
0x4B2F0FC0: "__stdcall NtCreatePort" _NtCreatePort@20
0x4B281724: "__cdecl __initiallocalestructinfo" ___initiallocalestructinfo
0x4B293878: "StackTraceDatabaseSizeInMb" ??_C@_1DG@HCPBKMAB@?$AAS?$AAt?$AAa?$AAc?$AAk?$AAT?$AAr?$AAa?$AAc?$AAe?$AAD?$AAa?$AAt?$AAa?$AAb?$AAa?$AAs?$AAe?$AAS?$AAi?$AAz?$AAe?$AAI?$AAn?$AAM?$AAb?$AA?$AA@
0x4B35BDC0: "__stdcall RtlpCallSecureMemoryCallbacks" _RtlpCallSecureMemoryCallbacks@8
0x4B2F1390: "__stdcall ZwGetDevicePowerState" _ZwGetDevicePowerState@8
0x4B2F12C0: "__stdcall NtFlushInstructionCache" _NtFlushInstructionCache@12
0x4B2B3770: "__stdcall LdrResSearchResource" _LdrResSearchResource@32
0x4B33AF84: "__fastcall RtlpEnsureLiveDeadListsInitialized" @RtlpEnsureLiveDeadListsInitialized@0
0x4B2F2030: "__stdcall ZwTestAlert" _ZwTestAlert@0
0x4B2A7061: "__stdcall RtlpCheckHeapSignature" _RtlpCheckHeapSignature@8
0x4B2A49B0: "heap_failure_freelists_corruptio" ??_C@_0CC@DPOECGOA@heap_failure_freelists_corruptio@
0x4B295DFC: "`SignalStartWerSvc'::`2'::WerSvcTriggerGuid" ?WerSvcTriggerGuid@?1??SignalStartWerSvc@@9@9
0x4B2A5D18: "\Registry\Machine\SYSTEM\Current" ??_C@_1KA@LCEEGHG@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2F14C0: "__stdcall ZwLoadKey2" _ZwLoadKey2@12
0x4B332F50: "__stdcall RtlIsCurrentThreadAttachExempt" _RtlIsCurrentThreadAttachExempt@0
0x4B361477: "__stdcall RtlpUpcaseUnicodeStringPrivate" _RtlpUpcaseUnicodeStringPrivate@12
0x4B39F3C0: "__cdecl RtlpRandomExConstantVector" _RtlpRandomExConstantVector
0x4B2F0640: "__stdcall ZwWaitForMultipleObjects32" _ZwWaitForMultipleObjects32@20
0x4B2F3940: "__cdecl _CIsin" __CIsin
0x4B345CBD: "__stdcall RtlpFilterSacl" _RtlpFilterSacl@16
0x4B2A9550: "__stdcall RtlCreateEnvironmentEx" _RtlCreateEnvironmentEx@12
0x4B2F18C0: "__stdcall NtQueryInformationEnlistment" _NtQueryInformationEnlistment@20
0x4B2F14B0: "__stdcall ZwLoadKey" _ZwLoadKey@8
0x4B2EBE30: "__stdcall RtlDebugPrintTimes" _RtlDebugPrintTimes@0
0x4B286920: "Status: 0x%08lx " ??_C@_0BB@NFIMEJKA@Status?3?50x?$CF08lx?6?$AA@
0x4B2F3C30: "__cdecl isgraph" _isgraph
0x4B375C17: "__stdcall RtlpHpLfhSubsegmentFree" _RtlpHpLfhSubsegmentFree@16
0x4B2FDF60: "__cdecl swscanf_s" _swscanf_s
0x4B2AC860: "__stdcall WinSqmSetString" _WinSqmSetString@12
0x4B339620: "__stdcall WinSqmGetInstrumentationProperty" _WinSqmGetInstrumentationProperty@16
0x4B2A84D0: "__stdcall RtlDeleteTimerQueueEx" _RtlDeleteTimerQueueEx@8
0x4B2E9C50: "__stdcall RtlIpv6StringToAddressExA" _RtlIpv6StringToAddressExA@16
0x4B2BDBAA: "__stdcall ApiSetpSearchForApiSetHost" _ApiSetpSearchForApiSetHost@16
0x4B2E52D0: "__stdcall LdrpProcessInitializationComplete" _LdrpProcessInitializationComplete@0
0x4B295618: "AVRF: skipped resnapping provide" ??_C@_0CM@DJDFJEIG@AVRF?3?5skipped?5resnapping?5provide@
0x4B2AA0D0: "__stdcall EtwSetMark" _EtwSetMark@16
0x4B3A1AE4: "__cdecl RtlpPreviousStartAddress" _RtlpPreviousStartAddress
0x4B3A17D0: "__cdecl __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUmgwooUdldGEDCUlyquivUrDIGUkxsOlyq@ntdll" ___@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUmgwooUdldGEDCUlyquivUrDIGUkxsOlyq@ntdll
0x4B3052C0: "__stdcall XSaveSHelper" _XSaveSHelper@12
0x4B29298C: "LdrGetDllHandleEx" ??_C@_0BC@BHGIGKLK@LdrGetDllHandleEx?$AA@
0x4B284750: "Type" ??_C@_19BIEPDBPA@?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x4B2EA9B0: "__stdcall RtlGetLastNtStatus" _RtlGetLastNtStatus@0
0x4B3A0C20: "__cdecl LdrpHeap" _LdrpHeap
0x4B331A20: "__cdecl LdrpTargetCompare" _LdrpTargetCompare
0x4B3A1844: "__cdecl g_SxsFreeActivationContexts" _g_SxsFreeActivationContexts
0x4B37FCB0: "__stdcall EtwpGetCpuSpeed" _EtwpGetCpuSpeed@4
0x4B37B880: "__stdcall RtlpHpVsContextAddSubsegment" _RtlpHpVsContextAddSubsegment@8
0x4B2DD862: "__stdcall TppPoolpDereferenceGlobalPool" _TppPoolpDereferenceGlobalPool@8
0x4B363060: "__stdcall RtlIsNormalizedString" _RtlIsNormalizedString@16
0x4B2B7640: "__stdcall RtlDosPathNameToRelativeNtPathName_U" _RtlDosPathNameToRelativeNtPathName_U@16
0x4B287784: "windows blue" ??_C@_1BK@LCHAKNFP@?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAb?$AAl?$AAu?$AAe?$AA?$AA@
0x4B2876B4: "__stdcall _imp__NtCreateFile" __imp__NtCreateFile@44
0x4B294B70: "Locating export "%wZ" for DLL "%" ??_C@_0EC@CAEPNDN@Locating?5export?5?$CC?$CFwZ?$CC?5for?5DLL?5?$CC?$CF@
0x4B2E1CD0: "__stdcall RtlpAssemblyStorageMapResolutionDefaultCallback" _RtlpAssemblyStorageMapResolutionDefaultCallback@12
0x4B2A5958: "Heap block at %p has incorrect s" ??_C@_0DE@NAFKCGNN@Heap?5block?5at?5?$CFp?5has?5incorrect?5s@
0x4B2EA1C0: "__stdcall RtlQueryElevationFlags" _RtlQueryElevationFlags@4
0x4B36A344: "__stdcall RtlpHpTagContextAllocateTag" _RtlpHpTagContextAllocateTag@16
0x4B37C0AF: "__stdcall RtlpHpVsSubsegmentInitialize" _RtlpHpVsSubsegmentInitialize@16
0x4B292DB8: "LoadResource API exit" ??_C@_1CM@KAPIJJGN@?$AAL?$AAo?$AAa?$AAd?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAA?$AAP?$AAI?$AA?5?$AAe?$AAx?$AAi?$AAt?$AA?$AA@
0x4B2F12A0: "__stdcall ZwFlushBuffersFileEx" _ZwFlushBuffersFileEx@20
0x4B3A4224: "__cdecl LdrpMrdataHeapUnprotected" _LdrpMrdataHeapUnprotected
0x4B335BE0: "__stdcall RtlRemoveVectoredContinueHandler" _RtlRemoveVectoredContinueHandler@4
0x4B299214: "corrupted critical section" ??_C@_0BL@JCIOMEBJ@corrupted?5critical?5section?$AA@
0x4B28120C: "__cdecl LdrpKernelbaseDllName" _LdrpKernelbaseDllName
0x4B361686: "__stdcall IsHangulS" _IsHangulS@4
0x4B2D7923: "__fastcall RtlpGetLowFragHeapSize" @RtlpGetLowFragHeapSize@8
0x4B383314: "__stdcall StringCchCopyNW" _StringCchCopyNW@16
0x4B29493C: "TlsVector %p Index %d : %d bytes" ??_C@_0DH@COKBCNAP@TlsVector?5?$CFp?5Index?5?$CFd?5?3?5?$CFd?5bytes@
0x4B39FD80: "__cdecl NlsAnsiCodePage" _NlsAnsiCodePage
0x4B2F1280: "__stdcall ZwFilterToken" _ZwFilterToken@24
0x4B2A7AEB: "__stdcall RtlpTpWaitRundown" _RtlpTpWaitRundown@4
0x4B2D15E0: "__stdcall LdrAddLoadAsDataTable" _LdrAddLoadAsDataTable@20
0x4B2E4BC1: "__stdcall RtlpNameprepAsciiWorker" _RtlpNameprepAsciiWorker@24
0x4B329EE7: "__stdcall LdrpAppxEtwIntegrityFailure" _LdrpAppxEtwIntegrityFailure@12
0x4B39F140: "__cdecl RtlpHpHeapGlobals" _RtlpHpHeapGlobals
0x4B2F1CB0: "__stdcall NtSetBootOptions" _NtSetBootOptions@8
0x4B39FB60: "__cdecl NlsUnicodeToMbOemData" _NlsUnicodeToMbOemData
0x4B2A9470: "__stdcall RtlUnlockModuleSection" _RtlUnlockModuleSection@4
0x4B295578: "AVRF: %ws: pid 0x%X: application" ??_C@_0FM@FCDMDOLE@AVRF?3?5?$CFws?3?5pid?50x?$CFX?3?5application@
0x4B294078: "not " ??_C@_04LKOGMCLF@not?5?$AA@
0x4B3A17F4: "__cdecl LdrpParentRtlInitializeNtUserPfnPointer" _LdrpParentRtlInitializeNtUserPfnPointer
0x4B2E7E09: "__stdcall LdrpFindMessageInAlternateModule" _LdrpFindMessageInAlternateModule@20
0x4B293EBC: "Process 0x%p (%wZ) exiting " ??_C@_0BM@JKFLKHPE@Process?50x?$CFp?5?$CI?$CFwZ?$CJ?5exiting?6?$AA@
0x4B2A5CF0: "__cdecl FormatMaxDisplacement" _FormatMaxDisplacement
0x4B3322A0: "__stdcall TpDbgSetLogRoutine" _TpDbgSetLogRoutine@4
0x4B2C0B00: "__stdcall RtlpLocateActivationContextSection" _RtlpLocateActivationContextSection@20
0x4B2DE4CB: "__stdcall TppCleanupGroupAddMember" _TppCleanupGroupAddMember@4
0x4B39FD94: "__cdecl Nls844UnicodeLowercaseTable" _Nls844UnicodeLowercaseTable
0x4B2BFD60: "__stdcall RtlDosApplyFileIsolationRedirection_Ustr" _RtlDosApplyFileIsolationRedirection_Ustr@36
0x4B368A50: "__stdcall RtlpHpStackTraceHeapDisable" _RtlpHpStackTraceHeapDisable@8
0x4B2A47A8: "*" ??_C@_13BBDEGPLJ@?$AA?$CK?$AA?$AA@
0x4B2F8827: "__cdecl _rtonepop" __rtonepop
0x4B2F08D0: "__stdcall NtContinue" _NtContinue@8
0x4B284CC8: "__cdecl M_strAceIdnPrefix" _M_strAceIdnPrefix
0x4B2F05B0: "__stdcall ZwEnumerateValueKey" _ZwEnumerateValueKey@24
0x4B2A6A18: "__stdcall DeleteNodeFromTree" _DeleteNodeFromTree@8
0x4B2F0D50: "__stdcall ZwAlpcSetInformation" _ZwAlpcSetInformation@16
0x4B3A37AC: "__cdecl RtlpTpIoRegistered" _RtlpTpIoRegistered
0x4B2DA1B0: "__stdcall EtwNotificationUnregister" _EtwNotificationUnregister@12
0x4B2811E4: "__cdecl TppWorkpTaskVFuncs" _TppWorkpTaskVFuncs
0x4B39F940: "__cdecl RtlpForceCSDebugInfoCreation" _RtlpForceCSDebugInfoCreation
0x4B2F0DA0: "__stdcall ZwCancelIoFileEx" _ZwCancelIoFileEx@12
0x4B2AC870: "__stdcall RtlpCheckDynamicTimeZoneInformation" _RtlpCheckDynamicTimeZoneInformation@8
0x4B33CDA3: "__stdcall LdrpGetAlternateResourceModuleHandleEx" _LdrpGetAlternateResourceModuleHandleEx@16
0x4B292468: "__cdecl HeapSnapshotEnd" _HeapSnapshotEnd
0x4B2A544C: "FrontEndHeapType" ??_C@_0BB@IBAKONCK@FrontEndHeapType?$AA@
0x4B2C65D4: "__stdcall RtlpIsSubSegmentReuseable" _RtlpIsSubSegmentReuseable@8
0x4B2947B0: "Failed to load for appcompat rea" ??_C@_0CG@BKCGPJOG@Failed?5to?5load?5for?5appcompat?5rea@
0x4B2F3E30: "__cdecl _alldvrm" __alldvrm
0x4B2EBC00: "__stdcall WinSqmIsOptedInEx" _WinSqmIsOptedInEx@4
0x4B2FBA32: "__cdecl _ctrlfp" __ctrlfp
0x4B304DA0: "__stdcall RtlLargeIntegerShiftRight" _RtlLargeIntegerShiftRight@12
0x4B2F9225: "__cdecl _local_unwind2" __local_unwind2
0x4B2F2280: "__stdcall ZwWow64ReadVirtualMemory64" _ZwWow64ReadVirtualMemory64@28
0x4B3A1644: "__cdecl LdrpForkActiveLock" _LdrpForkActiveLock
0x4B2FDA40: "__cdecl vsprintf_s" _vsprintf_s
0x4B2F4930: "__cdecl _local_unwind4" __local_unwind4
0x4B2F0FA0: "__stdcall ZwCreatePagingFile" _ZwCreatePagingFile@16
0x4B35CE00: "__stdcall RtlIncrementCorrelationVector" _RtlIncrementCorrelationVector@4
0x4B385E45: "__stdcall PsspDuplicateSnapshotLocalToRemote" _PsspDuplicateSnapshotLocalToRemote@16
0x4B2FB7E3: "__cdecl _set_errno_from_matherr" __set_errno_from_matherr
0x4B2AB4F0: "__stdcall RtlDeleteBoundaryDescriptor" _RtlDeleteBoundaryDescriptor@4
0x4B296AA8: "SXS: Activation context data at " ??_C@_0EP@JCEOKMJK@SXS?3?5Activation?5context?5data?5at?5@
0x4B285398: "\Registry\Machine\" ??_C@_1CG@ECHCOIBH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AA?$AA@
0x4B2F3C90: "__cdecl isprint" _isprint
0x4B2FAD8A: "__cdecl _ctrandisp1" __ctrandisp1
0x4B2F0810: "__stdcall ZwOpenSection" _ZwOpenSection@12
0x4B2F1D80: "__stdcall NtSetInformationDebugObject" _NtSetInformationDebugObject@20
0x4B2A2E88: "__cdecl crc64Map1_" _crc64Map1_
0x4B2F0500: "__stdcall ZwWriteFile" _ZwWriteFile@36
0x4B364E50: "__stdcall RtlWakeAddressSingle" _RtlWakeAddressSingle@4
0x4B2928BC: "\\" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x4B2F1920: "__stdcall NtQueryInformationWorkerFactory" _NtQueryInformationWorkerFactory@20
0x4B36889D: "__stdcall RtlpHpStackTraceEnable" _RtlpHpStackTraceEnable@0
0x4B2F1760: "__stdcall ZwPlugPlayControl" _ZwPlugPlayControl@12
0x4B2D5CF9: "__stdcall RtlpPopulateListIndex" _RtlpPopulateListIndex@8
0x4B358190: "__stdcall RtlInsertEntryHashTable" _RtlInsertEntryHashTable@16
0x4B372D40: "__stdcall RtlpHpAppCompatEnablePaddingAndLFHSubsegmentCommit" _RtlpHpAppCompatEnablePaddingAndLFHSubsegmentCommit@0
0x4B2D4270: "__stdcall RtlReleaseSRWLockShared" _RtlReleaseSRWLockShared@4
0x4B339610: "__stdcall WinSqmCommonDatapointSetStreamEx" _WinSqmCommonDatapointSetStreamEx@20
0x4B32B520: "__stdcall LdrInitializeEnclave" _LdrInitializeEnclave@20
0x4B3A1781: "__cdecl g_SxsKeepActivationContextsAlive" _g_SxsKeepActivationContextsAlive
0x4B2CCB6B: "__stdcall RtlpAddKnownAce" _RtlpAddKnownAce@24
0x4B34A7C0: "__stdcall RtlLockMemoryBlockLookaside" _RtlLockMemoryBlockLookaside@4
0x4B292908: "DLL name: %wZ " ??_C@_0P@FKPDOJLJ@DLL?5name?3?5?$CFwZ?6?$AA@
0x4B29338C: "Could not locate procedure "%s" " ??_C@_0DI@LIDEEFAH@Could?5not?5locate?5procedure?5?$CC?$CFs?$CC?5@
0x4B28C470: "INTERNETCLIENT" ??_C@_1BO@FFALCFOG@?$AAI?$AAN?$AAT?$AAE?$AAR?$AAN?$AAE?$AAT?$AAC?$AAL?$AAI?$AAE?$AAN?$AAT?$AA?$AA@
0x4B3A0A04: "__cdecl LdrpSaferIsDllAllowedRoutine" _LdrpSaferIsDllAllowedRoutine
0x4B305300: "__stdcall A_SHAInit" _A_SHAInit@4
0x4B36A2ED: "__stdcall RtlpHpTagAllocateHeap" _RtlpHpTagAllocateHeap@12
0x4B2F8C4E: "__cdecl _rtinfpop" __rtinfpop
0x4B2867D0: "cos" ??_C@_03LALBNOCG@cos?$AA@
0x4B2F20C0: "__stdcall NtUnloadKeyEx" _NtUnloadKeyEx@8
0x4B32C0C0: "__stdcall LdrQueryInLoadOrderModuleList" _LdrQueryInLoadOrderModuleList@12
0x4B37BDF9: "__stdcall RtlpHpVsSubsegmentCommitPages" _RtlpHpVsSubsegmentCommitPages@24
0x4B2C6E00: "__stdcall RtlpHeapFindListLookupEntry" _RtlpHeapFindListLookupEntry@20
0x4B2D5C20: "__stdcall RtlpHeapGenerateRandomValue32" _RtlpHeapGenerateRandomValue32@0
0x4B2F1C80: "__stdcall ZwSecureConnectPort" _ZwSecureConnectPort@36
0x4B294840: "DLL "%wZ" does not contain an ex" ??_C@_0CM@MFBACBPE@DLL?5?$CC?$CFwZ?$CC?5does?5not?5contain?5an?5ex@
0x4B2FB55D: "__cdecl _raise_exc_ex" __raise_exc_ex
0x4B2B3370: "__stdcall LdrpFindExistingModule" _LdrpFindExistingModule@20
0x4B37D459: "__fastcall EtwpTraceUmEvent" @EtwpTraceUmEvent@20
0x4B33E120: "__stdcall RtlSetImageMitigationPolicy" _RtlSetImageMitigationPolicy@20
0x4B2A37E8: "ROUND_UP_TO_POWER2(FreeBlock, PA" ??_C@_0EB@EODAOBJI@ROUND_UP_TO_POWER2?$CIFreeBlock?0?5PA@
0x4B2F1C10: "__stdcall ZwRollbackEnlistment" _ZwRollbackEnlistment@8
0x4B363538: "__stdcall RtlpLogExceptionDispatch" _RtlpLogExceptionDispatch@8
0x4B2A5DB8: "Enabled" ??_C@_1BA@NPJPKIM@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x4B2F1A90: "__stdcall NtRaiseException" _NtRaiseException@12
0x4B2A9CDD: "__stdcall RtlpProcessIFEOKeyFilter" _RtlpProcessIFEOKeyFilter@12
0x4B2ABA82: "__stdcall TppCallbackSendAndDestroyAlpcMessage" _TppCallbackSendAndDestroyAlpcMessage@4
0x4B2A3CA0: "Control Panel\International" ??_C@_1DI@HFDNKLGP@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?5?$AAP?$AAa?$AAn?$AAe?$AAl?$AA?2?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAa?$AAt?$AAi?$AAo?$AAn?$AAa?$AAl?$AA?$AA@
0x4B2F1E00: "__stdcall NtSetInformationTransactionManager" _NtSetInformationTransactionManager@16
0x4B2FA921: "__cdecl _wchartodigit" __wchartodigit
0x4B2F0570: "__stdcall ZwClose" _ZwClose@4
0x4B3696D4: "__stdcall RtlpLogHeapLockEvent" _RtlpLogHeapLockEvent@4
0x4B2A3C7C: "hs" ??_C@_15NDBANMBJ@?$AAh?$AAs?$AA?$AA@
0x4B2EAB81: "__stdcall LdrEnsureMrdataHeapExists" _LdrEnsureMrdataHeapExists@0
0x4B363FF9: "__stdcall RtlpStdLogCapturedStackTrace" _RtlpStdLogCapturedStackTrace@12
0x4B2A9882: "__stdcall RtlpCrackActivationContextStringSectionHeader" _RtlpCrackActivationContextStringSectionHeader@44
0x4B33FCE8: "__stdcall RtlpQueryEafPlusModuleList" _RtlpQueryEafPlusModuleList@8
0x4B37D0A0: "__stdcall EtwLogTraceEvent" _EtwLogTraceEvent@12
0x4B2F4A64: "__fastcall _EH4_GlobalUnwind" @_EH4_GlobalUnwind@4
0x4B32EB3D: "__stdcall LdrpCheckAppDirType" _LdrpCheckAppDirType@4
0x4B2867F8: "sqrt" ??_C@_04EIAKFFMI@sqrt?$AA@
0x4B2818D0: "__cdecl RtlWorkSpaceProcs" _RtlWorkSpaceProcs
0x4B382BD5: "__stdcall RtlpTpImpersonate" _RtlpTpImpersonate@4
0x4B3A172C: "__cdecl EtwpRegistrationTable" _EtwpRegistrationTable
0x4B2D132D: "__stdcall TppCallbackMayRunLongProlog" _TppCallbackMayRunLongProlog@20
0x4B295210: "Thin Client" ??_C@_1BI@NKKGCOGG@?$AAT?$AAh?$AAi?$AAn?$AA?5?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AA?$AA@
0x4B294598: "__RedirectionInformation__" ??_C@_0BL@HLBPBBPA@__RedirectionInformation__?$AA@
0x4B296888: "!(askd.Flags & ACTIVATION_CONTEX" ??_C@_0FD@FEKMFNNA@?$CB?$CIaskd?4Flags?5?$CG?5ACTIVATION_CONTEX@
0x4B294F20: "Windows.ServerNano" ??_C@_1CG@NLECOABM@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAN?$AAa?$AAn?$AAo?$AA?$AA@
0x4B28B700: "\Registry\Machine\System\Current" ??_C@_1GI@HGIHOLK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B3584AF: "__stdcall RtlpGetChainHead" _RtlpGetChainHead@8
0x4B2A6F45: "__stdcall RtlpValidateHeapEntry" _RtlpValidateHeapEntry@12
0x4B3639A0: "__stdcall RtlStdDeleteStackDatabase" _RtlStdDeleteStackDatabase@4
0x4B2AD312: "__stdcall _RtlpMuiRegLoadInstalled" __RtlpMuiRegLoadInstalled@16
0x4B284DE8: "WindowsExcludedProcs" ??_C@_1CK@MPIDPHBP@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAE?$AAx?$AAc?$AAl?$AAu?$AAd?$AAe?$AAd?$AAP?$AAr?$AAo?$AAc?$AAs?$AA?$AA@
0x4B294DE0: "Windows.Desktop" ??_C@_1CA@FKJOFOEP@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?$AA@
0x4B2AB400: "__stdcall RtlRemoveVectoredExceptionHandler" _RtlRemoveVectoredExceptionHandler@4
0x4B295240: "Industry Other" ??_C@_1BO@OJMGJFKJ@?$AAI?$AAn?$AAd?$AAu?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAO?$AAt?$AAh?$AAe?$AAr?$AA?$AA@
0x4B2F1490: "__stdcall ZwLoadDriver" _ZwLoadDriver@4
0x4B304500: "__stdcall NtdllSwitchWindowProc_A" _NtdllSwitchWindowProc_A@0
0x4B2A36F4: "(UCRBlock->Size >= *Size)" ??_C@_0BK@FMFPHHEG@?$CIUCRBlock?9?$DOSize?5?$DO?$DN?5?$CKSize?$CJ?$AA@
0x4B2F2A40: "__stdcall RtlInitString" _RtlInitString@8
0x4B297470: "SXS: %s() found assembly informa" ??_C@_0JL@PNANFKHK@SXS?3?5?$CFs?$CI?$CJ?5found?5assembly?5informa@
0x4B2EBA40: "__stdcall EtwGetTraceEnableFlags" _EtwGetTraceEnableFlags@8
0x4B37875B: "__stdcall RtlpHpSegMgrAllocate" _RtlpHpSegMgrAllocate@12
0x4B2EB32C: "__stdcall RtlpCreateDeferredCriticalSectionEvent" _RtlpCreateDeferredCriticalSectionEvent@4
0x4B2F0310: "__stdcall MD5Init" _MD5Init@4
0x4B36A737: "__stdcall RtlpHpTagContextUpdate" _RtlpHpTagContextUpdate@16
0x4B361762: "__stdcall NormBuffer__AppendEx" _NormBuffer__AppendEx@16
0x4B2FDBD0: "__cdecl strncat_s" _strncat_s
0x4B2F0580: "__stdcall ZwQueryObject" _ZwQueryObject@20
0x4B2A5B58: "Total size of free blocks in are" ??_C@_0FL@JPHINBBC@Total?5size?5of?5free?5blocks?5in?5are@
0x4B2FA870: "__cdecl __ascii_stricmp" ___ascii_stricmp
0x4B39F960: "__cdecl NlsLeadByteInfoTable" _NlsLeadByteInfoTable
0x4B2D9454: "__stdcall RtlpGetBlockSizeEx" _RtlpGetBlockSizeEx@8
0x4B304301: "__stdcall RtlpHpVsContextFreeList" _RtlpHpVsContextFreeList@12
0x4B3364F0: "__stdcall AVrfpDllUnloadNotificationInternal" _AVrfpDllUnloadNotificationInternal@4
0x4B381420: "__stdcall TppTimerpStopCallbackGeneration" _TppTimerpStopCallbackGeneration@8
0x4B3830CC: "__stdcall SbpResolveBasedOnName" _SbpResolveBasedOnName@4
0x4B2A6E70: "__stdcall RtlValidateHeap" _RtlValidateHeap@12
0x4B2A5428: "FrontEndHeap" ??_C@_0N@KPBPFGKB@FrontEndHeap?$AA@
0x4B304930: "__stdcall RtlMoveMemory" _RtlMoveMemory@12
0x4B2F0CC0: "__stdcall ZwAlpcDisconnectPort" _ZwAlpcDisconnectPort@8
0x4B2E06B0: "__stdcall RtlTimeFieldsToTime" _RtlTimeFieldsToTime@8
0x4B347770: "__stdcall RtlTryAcquireSRWLockExclusive" _RtlTryAcquireSRWLockExclusive@4
0x4B297EC0: "SXS: %s() bad parameters: SXS: " ??_C@_0FA@LMJFIBBC@SXS?3?5?$CFs?$CI?$CJ?5bad?5parameters?3?6SXS?3?5?5@
0x4B2F3F80: "__cdecl _alloca_probe_16" __alloca_probe_16
0x4B37815E: "__stdcall RtlpHpSegDescriptorValidate" _RtlpHpSegDescriptorValidate@8
0x4B293AB0: "Allocating a data table entry fo" ??_C@_0DJ@JGDKIEJC@Allocating?5a?5data?5table?5entry?5fo@
0x4B341155: "__stdcall LdrpResValdiateMappedAddress" _LdrpResValdiateMappedAddress@4
0x4B2B79AA: "__stdcall LdrpWriteBackProtectedDelayLoad" _LdrpWriteBackProtectedDelayLoad@20
0x4B2EBC10: "__stdcall RtlSetThreadPoolStartFunc" _RtlSetThreadPoolStartFunc@8
0x4B292488: "__cdecl LoadFailureOperational" _LoadFailureOperational
0x4B2DE300: "__stdcall TpCallbackMayRunLong" _TpCallbackMayRunLong@4
0x4B37F150: "__stdcall EtwSendNotification" _EtwSendNotification@20
0x4B39F0EC: "__cdecl __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUgsivzwklloUxlnkzgUdldGEDCUlyquivUrDIGUgkxlnkzgOlyq@tpcompat" ___@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUgsivzwklloUxlnkzgUdldGEDCUlyquivUrDIGUgkxlnkzgOlyq@tpcompat
0x4B2FE0C0: "__cdecl wcsncat_s" _wcsncat_s
0x4B2A5638: "RtlAllocateHeap" ??_C@_0BA@HKDEHBAO@RtlAllocateHeap?$AA@
0x4B295130: "Gaming" ??_C@_1O@MGHFGOKO@?$AAG?$AAa?$AAm?$AAi?$AAn?$AAg?$AA?$AA@
0x4B39F11E: "__cdecl EtwpReplySend" _EtwpReplySend
0x4B342040: "__stdcall RtlGetInterruptTimePrecise" _RtlGetInterruptTimePrecise@4
0x4B2A72EA: "__stdcall RtlpWaitOnAddressWakeEntireList" _RtlpWaitOnAddressWakeEntireList@4
0x4B2DD8A6: "__stdcall LdrpFindOrPrepareLoadingModule" _LdrpFindOrPrepareLoadingModule@28
0x4B358180: "__stdcall RtlInitWeakEnumerationHashTable" _RtlInitWeakEnumerationHashTable@8
0x4B288210: "CONIN$" ??_C@_1O@PNMIMBDD@?$AAC?$AAO?$AAN?$AAI?$AAN?$AA$?$AA?$AA@
0x4B37C270: "__stdcall MD4Final" _MD4Final@4
0x4B2E5460: "__stdcall LdrpCleanupThreadTlsData" _LdrpCleanupThreadTlsData@0
0x4B2A57F0: "About to free block at %p with t" ??_C@_0CI@CCIOGCGI@About?5to?5free?5block?5at?5?$CFp?5with?5t@
0x4B2F24C0: "__stdcall RtlRetrieveNtUserPfn" _RtlRetrieveNtUserPfn@12
0x4B3A1634: "__cdecl LdrpModuleBaseAddressIndex" _LdrpModuleBaseAddressIndex
0x4B2ADA0E: "__stdcall _RtlpMuiRegInitAnyLanguage" __RtlpMuiRegInitAnyLanguage@16
0x4B39E064: "__cdecl _pctype" __pctype
0x4B2A4B00: "__cdecl XpressHashFunction" _XpressHashFunction
0x4B381B40: "__stdcall TppETWCallbackStart" _TppETWCallbackStart@20
0x4B2F08B0: "__stdcall ZwAdjustPrivilegesToken" _ZwAdjustPrivilegesToken@24
0x4B285A38: ".sforce" ??_C@_07PNEDBEBD@?4sforce?$AA@
0x4B286D88: "HEAP[%wZ]: " ??_C@_0M@GCCCOAPI@HEAP?$FL?$CFwZ?$FN?3?5?$AA@
0x4B37C8B0: "__stdcall EtwWriteUMSecurityEvent" _EtwWriteUMSecurityEvent@16
0x4B2A9A60: "__stdcall RtlQueryAtomInAtomTable" _RtlQueryAtomInAtomTable@24
0x4B2E5060: "__stdcall RtlRunOnceInitialize" _RtlRunOnceInitialize@4
0x4B37A2F7: "__stdcall RtlpHpSegUpdateCommit" _RtlpHpSegUpdateCommit@12
0x4B297050: "SXS: String hash table entry at " ??_C@_0HI@DJGEPBCL@SXS?3?5String?5hash?5table?5entry?5at?5@
0x4B2F0F10: "__stdcall NtCreateIoCompletion" _NtCreateIoCompletion@16
0x4B331BEF: "__stdcall LdrpUnlockTlsDelayedReclaimTable" _LdrpUnlockTlsDelayedReclaimTable@4
0x4B2857E8: "SE_DllUnloaded" ??_C@_0P@OJNDNBGK@SE_DllUnloaded?$AA@
0x4B292FC8: "Changing the protection of the e" ??_C@_0EM@ILAKKAHE@Changing?5the?5protection?5of?5the?5e@
0x4B292438: "__cdecl CurDirDllLoadFailureError" _CurDirDllLoadFailureError
0x4B34F7F0: "__stdcall RtlGetSystemPreferredUILanguages" _RtlGetSystemPreferredUILanguages@20
0x4B39F660: "__cdecl RtlpProcessHeapsListLock" _RtlpProcessHeapsListLock
0x4B2F0A50: "__stdcall NtWaitForMultipleObjects" _NtWaitForMultipleObjects@20
0x4B362041: "__stdcall Normalization__GetSecondAndThirdDecomposedCharPlane0" _Normalization__GetSecondAndThirdDecomposedCharPlane0@16
0x4B2E75A0: "__stdcall RtlSetCriticalSectionSpinCount" _RtlSetCriticalSectionSpinCount@8
0x4B285EC8: "__cdecl _real@3fe0000000000000" __real@3fe0000000000000
0x4B2C9ED4: "__stdcall LdrpFreeLoadContextOfNode" _LdrpFreeLoadContextOfNode@8
0x4B2AB413: "__stdcall RtlpRemoveVectoredHandler" _RtlpRemoveVectoredHandler@8
0x4B2F3D80: "__cdecl _alldiv" __alldiv
0x4B36D386: "__stdcall RtlpHpTlLogGCTimerFinished" _RtlpHpTlLogGCTimerFinished@0
0x4B3727ED: "__stdcall RtlHpGlobalsInitialize" _RtlHpGlobalsInitialize@0
0x4B2BE4C0: "__stdcall LdrpMapAndSnapDependency" _LdrpMapAndSnapDependency@4
0x4B2CD530: "__stdcall RtlpCreateProcessRegistryInfo" _RtlpCreateProcessRegistryInfo@4
0x4B2F0820: "__stdcall ZwQueryTimer" _ZwQueryTimer@20
0x4B2F1EC0: "__stdcall ZwSetSystemEnvironmentValueEx" _ZwSetSystemEnvironmentValueEx@20
0x4B2BFBE0: "__stdcall RtlAcquireSRWLockExclusive" _RtlAcquireSRWLockExclusive@4
0x4B2EE967: "__stdcall EtwpAddProviderTrackingInfo" _EtwpAddProviderTrackingInfo@12
0x4B2B32AF: "__stdcall LdrpComputeLazyDllPath" _LdrpComputeLazyDllPath@4
0x4B295260: "Xbox One" ??_C@_1BC@NMJDGMHN@?$AAX?$AAb?$AAo?$AAx?$AA?5?$AAO?$AAn?$AAe?$AA?$AA@
0x4B3A37BC: "__cdecl __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUxzxsvUrmgviuzxvUorynrmUlyquivUrDIGUxlnkzgxzxsvkOlyq@compatcachemin" ___@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUxzxsvUrmgviuzxvUorynrmUlyquivUrDIGUxlnkzgxzxsvkOlyq@compatcachemin
0x4B364770: "__stdcall RtlpInitRandomExVector" _RtlpInitRandomExVector@12
0x4B39FE84: "__cdecl RtlpSearchPath" _RtlpSearchPath
0x4B333F00: "__stdcall RtlSetSecurityObject" _RtlSetSecurityObject@20
0x4B3876CC: "__stdcall RtlStackDbStackRemove" _RtlStackDbStackRemove@8
0x4B3A37A8: "__cdecl RtlpTpIoRegisteredLock" _RtlpTpIoRegisteredLock
0x4B2EF7F0: "__stdcall RtlWakeConditionVariable" _RtlWakeConditionVariable@4
0x4B2996CC: "\SystemRoot\bootstat.dat" ??_C@_1DC@MEBGDNBI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAb?$AAo?$AAo?$AAt?$AAs?$AAt?$AAa?$AAt?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x4B2C7660: "__stdcall RtlEqualUnicodeString" _RtlEqualUnicodeString@12
0x4B2F21B0: "__stdcall NtWow64CsrClientCallServer" _NtWow64CsrClientCallServer@16
0x4B304EBD: "__stdcall LdrpValidateUserCallTargetBitMapRet" _LdrpValidateUserCallTargetBitMapRet@0
0x4B2F92EC: "__cdecl _NLG_Dispatch" __NLG_Dispatch
0x4B294910: "minkernel\ntdll\ldrtls.c" ??_C@_0BJ@EIFJOLID@minkernel?2ntdll?2ldrtls?4c?$AA@
0x4B2F21C0: "__stdcall NtWow64CsrAllocateCaptureBuffer" _NtWow64CsrAllocateCaptureBuffer@8
0x4B2B69DD: "__stdcall LdrpGetRcConfig" _LdrpGetRcConfig@16
0x4B3646D0: "__stdcall RtlpRtlpCtWaitForWnfQuiescentWorker" _RtlpRtlpCtWaitForWnfQuiescentWorker@12
0x4B3605EC: "__stdcall RtlpWakeSingle" _RtlpWakeSingle@8
0x4B297248: "SXS: %s() passed string section " ??_C@_0HF@PFIFHENE@SXS?3?5?$CFs?$CI?$CJ?5passed?5string?5section?5@
0x4B3A177C: "__cdecl RtlpSearchPathMode" _RtlpSearchPathMode
0x4B2B5201: "__stdcall IsOverlaySupportedPath" _IsOverlaySupportedPath@12
0x4B37E4FA: "__stdcall EtwpStopUmLogger" _EtwpStopUmLogger@16
0x4B2DDF50: "__stdcall TpAllocAlpcCompletionEx" _TpAllocAlpcCompletionEx@20
0x4B32B0B0: "__stdcall DbgUiConvertStateChangeStructure" _DbgUiConvertStateChangeStructure@8
0x4B39F600: "__cdecl RtlpCtPublishInProgress" _RtlpCtPublishInProgress
0x4B2941D0: "TracingFlags" ??_C@_1BK@DEKFNMIF@?$AAT?$AAr?$AAa?$AAc?$AAi?$AAn?$AAg?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x4B2F01C0: "__stdcall RtlPublishWnfStateData" _RtlPublishWnfStateData@24
0x4B34E720: "__stdcall RtlQueryTimeZoneInformation" _RtlQueryTimeZoneInformation@4
0x4B39E908: "__cdecl RtlpWaitOnAddressSpinCount" _RtlpWaitOnAddressSpinCount
0x4B34568E: "__stdcall RtlpConvertToAutoInheritSecurityObject" _RtlpConvertToAutoInheritSecurityObject@24
0x4B2F6A60: "__cdecl qsort" _qsort
0x4B3879DC: "__stdcall RtlpStackDbSegmentComparitor" _RtlpStackDbSegmentComparitor@8
0x4B2F92EC: "__cdecl _NLG_Dispatch2" __NLG_Dispatch2
0x4B2B0FE0: "__stdcall RtlInitializeSid" _RtlInitializeSid@12
0x4B2E8AA1: "__stdcall RtlpIsCustomLocale" _RtlpIsCustomLocale@4
0x4B299368: "\SysWOW64\" ??_C@_1BG@GKLECEJI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AA?$AA@
0x4B286EF0: "__cdecl CheckHeapFillPattern" _CheckHeapFillPattern
0x4B2F0770: "__stdcall NtSetEventBoostPriority" _NtSetEventBoostPriority@4
0x4B29579C: "AVRF: initialized provider %ws (" ??_C@_0DD@HFCKPFDL@AVRF?3?5initialized?5provider?5?$CFws?5?$CI@
0x4B2F1750: "__stdcall ZwOpenTransactionManager" _ZwOpenTransactionManager@24
0x4B2A6D48: "__stdcall RealPredecessor" _RealPredecessor@4
0x4B2D8C99: "__stdcall EtwpEventApiCallback" _EtwpEventApiCallback@8
0x4B32C740: "__stdcall LdrSetImplicitPathOptions" _LdrSetImplicitPathOptions@8
0x4B329CA0: "__stdcall LdrAppxHandleIntegrityFailure" _LdrAppxHandleIntegrityFailure@4
0x4B2B2B5E: "__stdcall RtlpCreateNewDirectoryReference" _RtlpCreateNewDirectoryReference@12
0x4B2A587C: "RtlCreateTagHeap" ??_C@_0BB@GACHJAEO@RtlCreateTagHeap?$AA@
0x4B3A1804: "__cdecl LdrpChildNtdll" _LdrpChildNtdll
0x4B2819A8: "__cdecl RtlpWin32NtUncRoot" _RtlpWin32NtUncRoot
0x4B2F0870: "__stdcall ZwQueryAttributesFile" _ZwQueryAttributesFile@8
0x4B3A1694: "__cdecl pTblPtrs" _pTblPtrs
0x4B2E8E85: "__stdcall RtlpGetCachedPath" _RtlpGetCachedPath@16
0x4B298D18: "BaseNamedObjects" ??_C@_1CC@GOIMJBIF@?$AAB?$AAa?$AAs?$AAe?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$AA@
0x4B3A420C: "__cdecl g_pfnSE_LdrResolveDllName" _g_pfnSE_LdrResolveDllName
0x4B297818: "RtlpQueryRunLevel" ??_C@_0BC@EHEIAKE@RtlpQueryRunLevel?$AA@
0x4B3A1758: "__cdecl LdrpDelegatedNtdllBase" _LdrpDelegatedNtdllBase
0x4B2F06F0: "__stdcall NtQueryInformationThread" _NtQueryInformationThread@20
0x4B334A90: "__stdcall RtlQueryProcessLockInformation" _RtlQueryProcessLockInformation@4
0x4B2B23B5: "__stdcall RtlpHashStringToAtom" _RtlpHashStringToAtom@28
0x4B285458: "LdrResGetRCConfig Exit" ??_C@_1CO@CCNEFJGB@?$AAL?$AAd?$AAr?$AAR?$AAe?$AAs?$AAG?$AAe?$AAt?$AAR?$AAC?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?5?$AAE?$AAx?$AAi?$AAt?$AA?$AA@
0x4B29369C: "Getting ApphelpCheckModule faile" ??_C@_0DH@IHOJLDHE@Getting?5ApphelpCheckModule?5faile@
0x4B331346: "__stdcall LdrpSetModuleSigningLevel" _LdrpSetModuleSigningLevel@20
0x4B2A3B44: "::%hs%u.%u.%u.%u" ??_C@_1CC@CLPLLKPB@?$AA?3?$AA?3?$AA?$CF?$AAh?$AAs?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?$AA@
0x4B32B530: "__stdcall RtlSetCurrentEnvironment" _RtlSetCurrentEnvironment@8
0x4B2A9CB5: "__stdcall LdrpCalcAllocSize" _LdrpCalcAllocSize@8
0x4B285560: "__cdecl RtlpTheEmptyActivationContextData" _RtlpTheEmptyActivationContextData
0x4B2D9980: "__stdcall EtwDeliverDataBlock" _EtwDeliverDataBlock@4
0x4B39ED00: "__cdecl RtlpHpLfhContentionLimit" _RtlpHpLfhContentionLimit
0x4B2E8DFD: "__stdcall SbGetContextDetailsByGuid" _SbGetContextDetailsByGuid@8
0x4B2F10F0: "__stdcall ZwCreateWaitablePort" _ZwCreateWaitablePort@20
0x4B2AA355: "__stdcall RtlpUpdateHeapListIndex" _RtlpUpdateHeapListIndex@8
0x4B295460: "vrfcore.dll" ??_C@_1BI@CPNGMKLH@?$AAv?$AAr?$AAf?$AAc?$AAo?$AAr?$AAe?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x4B2F17F0: "__stdcall ZwPropagationFailed" _ZwPropagationFailed@12
0x4B32BCA0: "__stdcall RtlGetThreadErrorMode" _RtlGetThreadErrorMode@0
0x4B3A0BD0: "__cdecl TlsBitMap" _TlsBitMap
0x4B2EB973: "__stdcall TppDestroyTimerSubQueue" _TppDestroyTimerSubQueue@4
0x4B2F1010: "__stdcall NtCreateRegistryTransaction" _NtCreateRegistryTransaction@16
0x4B2F2050: "__stdcall NtThawTransactions" _NtThawTransactions@0
0x4B34E6C0: "__stdcall RtlQueryRegistryValues" _RtlQueryRegistryValues@20
0x4B2F1F00: "__stdcall ZwSetThreadExecutionState" _ZwSetThreadExecutionState@8
0x4B2B5D40: "__stdcall RtlIntegerToUnicodeString" _RtlIntegerToUnicodeString@12
0x4B2F14E0: "__stdcall NtLockFile" _NtLockFile@40
0x4B2AB300: "__stdcall RtlEnumerateGenericTableAvl" _RtlEnumerateGenericTableAvl@8
0x4B2F0830: "__stdcall NtFsControlFile" _NtFsControlFile@40
0x4B2A81D0: "__stdcall RtlpCopyProcString" _RtlpCopyProcString@16
0x4B378868: "__stdcall RtlpHpSegMgrCommit" _RtlpHpSegMgrCommit@28
0x4B2CBAD0: "__stdcall RtlGetParentLocaleName" _RtlGetParentLocaleName@16
0x4B35B651: "__stdcall RtlpSysVolTakeOwnership" _RtlpSysVolTakeOwnership@4
0x4B2A3AAC: "No leaks detected. " ??_C@_0BE@MOHFKBFM@No?5leaks?5detected?4?6?$AA@
0x4B332313: "__stdcall LdrInitializeMrdata" _LdrInitializeMrdata@0
0x4B2F1A60: "__stdcall NtQueryWnfStateData" _NtQueryWnfStateData@24
0x4B34D040: "__stdcall RtlAvlInsertNodeEx" _RtlAvlInsertNodeEx@16
0x4B351CB9: "__stdcall RtlpMuiRegGetLanginfoTypeNSpec" _RtlpMuiRegGetLanginfoTypeNSpec@12
0x4B2D7555: "__stdcall RtlpFreeDebugInfo" _RtlpFreeDebugInfo@4
0x4B2F1990: "__stdcall NtQueryOpenSubKeys" _NtQueryOpenSubKeys@8
0x4B2E9160: "__stdcall RtlAcquireResourceExclusive" _RtlAcquireResourceExclusive@8
0x4B2BFB80: "__stdcall RtlInterlockedPushEntrySList" _RtlInterlockedPushEntrySList@8
0x4B32E641: "__stdcall TraceLoggingUnregister" _TraceLoggingUnregister@4
0x4B347810: "__stdcall RtlUpdateClonedSRWLock" _RtlUpdateClonedSRWLock@8
0x4B34D7CB: "__stdcall RtlpWalkFrameChainFuzzy" _RtlpWalkFrameChainFuzzy@12
0x4B2D4944: "__stdcall SbAtomicCaptureContextGuid" _SbAtomicCaptureContextGuid@12
0x4B39FDF0: "__cdecl gMUICacheType" _gMUICacheType
0x4B2C8672: "__stdcall RtlpMuiRegLoadLicInformation" _RtlpMuiRegLoadLicInformation@4
0x4B2867B4: "ceil" ??_C@_04GFPJNGEK@ceil?$AA@
0x4B37235A: "__stdcall RtlSetLowFragHeapGlobalFlags" _RtlSetLowFragHeapGlobalFlags@8
0x4B2FC926: "__cdecl _filbuf" __filbuf
0x4B2EF177: "__stdcall EtwpInitLoggerContext" _EtwpInitLoggerContext@20
0x4B297D68: "SXS: Unabel to query location fr" ??_C@_0EO@FKIBMMJ@SXS?3?5Unabel?5to?5query?5location?5fr@
0x4B2DC810: "__stdcall TpReleaseTimer" _TpReleaseTimer@4
0x4B2C7A60: "__fastcall RtlpReAllocateHeap" @RtlpReAllocateHeap@16
0x4B34B2F0: "__stdcall RtlAppendAsciizToString" _RtlAppendAsciizToString@8
0x4B36F3B0: "__stdcall RtlCompressBufferLZNT1" _RtlCompressBufferLZNT1@32
0x4B39FDA4: "__cdecl LoadAsDataTableBlockCount" _LoadAsDataTableBlockCount
0x4B2E5390: "__stdcall VerSetConditionMask" _VerSetConditionMask@16
0x4B298C88: "RXACT" ??_C@_1M@NGDNBJPL@?$AAR?$AAX?$AAA?$AAC?$AAT?$AA?$AA@
0x4B2F0EF0: "__stdcall NtCreateEventPair" _NtCreateEventPair@12
0x4B39E560: "struct _SWITCHBRANCH_MODULE_TABLE_ENTRY g_SbTableEntry_VerifyVersionInfoSwitch_RTL" ?g_SbTableEntry_VerifyVersionInfoSwitch_RTL@@3U_SWITCHBRANCH_MODULE_TABLE_ENTRY@@A
0x4B298B00: "LdrpResValidateFilePath Exit" ??_C@_1DK@OAOJKMPL@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAF?$AAi?$AAl?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?5?$AAE?$AAx?$AAi?$AAt?$AA?$AA@
0x4B32D5ED: "__stdcall LdrpLogDllStateEx2" _LdrpLogDllStateEx2@16
0x4B2A4944: "heap_failure_invalid_allocation_" ??_C@_0CF@MMNKPCPL@heap_failure_invalid_allocation_@
0x4B35A66E: "__stdcall RtlpFreeHeapInternal" _RtlpFreeHeapInternal@20
0x4B361C19: "__stdcall NormBuffer__SortBeforeSameClass" _NormBuffer__SortBeforeSameClass@8
0x4B3045B0: "__stdcall NtdllEditWndProc_W" _NtdllEditWndProc_W@0
0x4B2F1EA0: "__stdcall NtSetSecurityObject" _NtSetSecurityObject@12
0x4B348150: "__stdcall RtlAddAuditAccessAceEx" _RtlAddAuditAccessAceEx@28
0x4B341181: "__stdcall LdrpResValidateFileHandle" _LdrpResValidateFileHandle@4
0x4B2E6950: "__stdcall RtlQueryDepthSList" _RtlQueryDepthSList@4
0x4B3648A0: "__stdcall RtlTraceDatabaseAdd" _RtlTraceDatabaseAdd@16
0x4B3626BF: "__stdcall Normalization__LoadTables" _Normalization__LoadTables@16
0x4B2D1C55: "__stdcall LdrpMapDllNtFileName" _LdrpMapDllNtFileName@8
0x4B2F1D30: "__stdcall NtSetDriverEntryOrder" _NtSetDriverEntryOrder@8
0x4B298320: "SXS: Attempt to translate DOS pa" ??_C@_0EC@MBGDCKJD@SXS?3?5Attempt?5to?5translate?5DOS?5pa@
0x4B304EA0: "__fastcall LdrpValidateUserCallTarget" @LdrpValidateUserCallTarget@4
0x4B2A4648: "WIN://PKGHOSTID" ??_C@_1CA@KNFPKGEL@?$AAW?$AAI?$AAN?$AA?3?$AA?1?$AA?1?$AAP?$AAK?$AAG?$AAH?$AAO?$AAS?$AAT?$AAI?$AAD?$AA?$AA@
0x4B2A93D0: "__stdcall RtlUnlockMemoryZone" _RtlUnlockMemoryZone@4
0x4B2D5C50: "__stdcall RtlRunOnceBeginInitialize" _RtlRunOnceBeginInitialize@12
0x4B299AE8: "LanguageConfiguration" ??_C@_1CM@NLNEHECD@?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B2B1A30: "__stdcall RtlCreateSecurityDescriptor" _RtlCreateSecurityDescriptor@8
0x4B294470: "LdrpRelocateImage" ??_C@_0BC@EEALMMAA@LdrpRelocateImage?$AA@
0x4B2D44A9: "__stdcall TppSetTimer" _TppSetTimer@20
0x4B375557: "__stdcall RtlpHpLfhSlotReserveBlock" _RtlpHpLfhSlotReserveBlock@16
0x4B2DC6D0: "__stdcall TpWaitForWork" _TpWaitForWork@8
0x4B3609AE: "__stdcall RtlpCallUserCallbackExceptionFilter" _RtlpCallUserCallbackExceptionFilter@8
0x4B2F0A30: "__stdcall NtAccessCheckByTypeAndAuditAlarm" _NtAccessCheckByTypeAndAuditAlarm@64
0x4B2F16F0: "__stdcall NtOpenSemaphore" _NtOpenSemaphore@12
0x4B348110: "__stdcall RtlAddAuditAccessAce" _RtlAddAuditAccessAce@24
0x4B3322B0: "__stdcall RtlSetMemoryStreamSize" _RtlSetMemoryStreamSize@12
0x4B34C010: "__stdcall RtlFindMostSignificantBit" _RtlFindMostSignificantBit@8
0x4B3388EA: "__stdcall WerpGlobalFlagsForProcess" _WerpGlobalFlagsForProcess@4
0x4B2F0F70: "__stdcall ZwCreateMailslotFile" _ZwCreateMailslotFile@32
0x4B29352C: "Loading the shim engine DLL fail" ??_C@_0DI@JOMMGJCA@Loading?5the?5shim?5engine?5DLL?5fail@
0x4B2DEB1C: "__stdcall RtlUnicodeStringCopy" _RtlUnicodeStringCopy@8
0x4B2D40DD: "__stdcall TppPoolpReferenceGlobalPool" _TppPoolpReferenceGlobalPool@12
0x4B28C308: "REMOVABLESTORAGE" ??_C@_1CC@OJNEDPCA@?$AAR?$AAE?$AAM?$AAO?$AAV?$AAA?$AAB?$AAL?$AAE?$AAS?$AAT?$AAO?$AAR?$AAA?$AAG?$AAE?$AA?$AA@
0x4B2C9780: "__stdcall LdrShutdownThread" _LdrShutdownThread@0
0x4B372D54: "__stdcall RtlpHpCalculateAllocSize" _RtlpHpCalculateAllocSize@8
0x4B3A4000: "__cdecl NtUserPfn" _NtUserPfn
0x4B2F3F10: "__cdecl _allmul" __allmul
0x4B339E2E: "__stdcall RtlpWnfMarkFailure" _RtlpWnfMarkFailure@12
0x4B34DA5D: "__stdcall RtlLargeIntegerToUnicode" _RtlLargeIntegerToUnicode@16
0x4B3A091C: "__cdecl Kernel32ThreadInitThunkFunction" _Kernel32ThreadInitThunkFunction
0x4B39FB6C: "__cdecl NlsMbOemCodePageTables" _NlsMbOemCodePageTables
0x4B2867AC: "atan" ??_C@_04MLLJIGOK@atan?$AA@
0x4B39E6E4: "__cdecl LdrpDllNotificationLock_DEBUG" _LdrpDllNotificationLock_DEBUG
0x4B304760: "__stdcall NtdllComboListBoxProcWorker" _NtdllComboListBoxProcWorker@0
0x4B29A274: "Crc64 ReFS-v1" ??_C@_0O@BJIIKNLL@Crc64?5ReFS?9v1?$AA@
0x4B2F1140: "__stdcall ZwDeleteAtom" _ZwDeleteAtom@4
0x4B373FA5: "__stdcall RtlpHpOptIntoSegmentHeap" _RtlpHpOptIntoSegmentHeap@4
0x4B3A4214: "__cdecl g_pfnSE_LdrEntryRemoved" _g_pfnSE_LdrEntryRemoved
0x4B2F0800: "__stdcall NtQuerySystemInformation" _NtQuerySystemInformation@16
0x4B385968: "__stdcall PsspQueryInfoClass_PSS_QUERY_PROCESS_INFORMATION" _PsspQueryInfoClass_PSS_QUERY_PROCESS_INFORMATION@8
0x4B377782: "__stdcall RtlpHpVaMgrFree" _RtlpHpVaMgrFree@8
0x4B338E00: "__stdcall ShipAssertGetBufferInfo" _ShipAssertGetBufferInfo@8
0x4B36928C: "__stdcall RtlpLogHeapAffinityManagerEnable" _RtlpLogHeapAffinityManagerEnable@8
0x4B293140: "LdrParentRtlResetNtUserPfn" ??_C@_0BL@IKMJLBBC@LdrParentRtlResetNtUserPfn?$AA@
0x4B2F0D90: "__stdcall NtCallEnclave" _NtCallEnclave@16
0x4B340756: "__stdcall LdrpResMapFile" _LdrpResMapFile@16
0x4B2D4B67: "__stdcall SbpFindMatchingContext" _SbpFindMatchingContext@8
0x4B39FD98: "__cdecl NlsMbOemCodePageTag" _NlsMbOemCodePageTag
0x4B2F0950: "__stdcall ZwFlushBuffersFile" _ZwFlushBuffersFile@8
0x4B2EF922: "__stdcall RtlpQueueWaitBlockToSRWLock" _RtlpQueueWaitBlockToSRWLock@8
0x4B344C04: "__stdcall RtlpComputeMergedAcl2" _RtlpComputeMergedAcl2@44
0x4B3692FD: "__stdcall RtlpLogHeapAffinitySlotAssign" _RtlpLogHeapAffinitySlotAssign@12
0x4B304450: "__stdcall NtdllScrollBarWndProc_W" _NtdllScrollBarWndProc_W@0
0x4B39F610: "__cdecl ConditionVariableSpinCount" _ConditionVariableSpinCount
0x4B2F2190: "__stdcall ZwWow64CsrClientConnectToServer" _ZwWow64CsrClientConnectToServer@20
0x4B298048: "RtlpResolveAssemblyStorageMapEnt" ??_C@_0CD@OIEIHMKG@RtlpResolveAssemblyStorageMapEnt@
0x4B2A4368: " *** A stack buffer overrun oc" ??_C@_0DD@LAOICNHE@?6?6?5?$CK?$CK?$CK?5A?5stack?5buffer?5overrun?5oc@
0x4B2F1820: "__stdcall ZwQueryBootEntryOrder" _ZwQueryBootEntryOrder@8
0x4B3820B7: "__stdcall TppETWWorkerNodeSwitch" _TppETWWorkerNodeSwitch@20
0x4B297720: "SXS: %s() received invalid sub-i" ??_C@_0GD@HNPBCIKP@SXS?3?5?$CFs?$CI?$CJ?5received?5invalid?5sub?9i@
0x4B2E5304: "__stdcall RtlInitializeHeapGC" _RtlInitializeHeapGC@4
0x4B2CCE90: "__stdcall RtlConvertSidToUnicodeString" _RtlConvertSidToUnicodeString@12
0x4B34A880: "__stdcall RtlUnlockMemoryBlockLookaside" _RtlUnlockMemoryBlockLookaside@4
0x4B3537B0: "__stdcall RtlFindClosestEncodableLength" _RtlFindClosestEncodableLength@12
0x4B2A6068: "ThreadPool: attempt to terminate" ??_C@_0IB@FCPILMLF@ThreadPool?3?5attempt?5to?5terminate@
0x4B2D7236: "__stdcall RtlpDestroyHeapSegment" _RtlpDestroyHeapSegment@4
0x4B2DCBA0: "__stdcall RtlRegisterWait" _RtlRegisterWait@24
0x4B35DCF0: "__stdcall RtlGetLastWin32Error" _RtlGetLastWin32Error@0
0x4B339A70: "__stdcall RtlWnfCompareChangeStamp" _RtlWnfCompareChangeStamp@8
0x4B2A9E50: "__stdcall RtlUnicodeToOemN" _RtlUnicodeToOemN@20
0x4B28683C: "_logb" ??_C@_05JGDBENOH@_logb?$AA@
0x4B2F6250: "__cdecl memchr" _memchr
0x4B29A288: "__cdecl crc32Mult_" _crc32Mult_
0x4B281244: "__cdecl TppAlpcpCleanupGroupMemberVFuncs" _TppAlpcpCleanupGroupMemberVFuncs
0x4B2F0DC0: "__stdcall ZwCancelTimer2" _ZwCancelTimer2@8
0x4B2A53E0: "NonDedicatedListLength" ??_C@_0BH@OEGGJOF@NonDedicatedListLength?$AA@
0x4B292B20: "LdrpWriteBackProtectedDelayLoad:" ??_C@_0IO@HGOOPNEA@LdrpWriteBackProtectedDelayLoad?3@
0x4B2F2080: "__stdcall ZwUmsThreadYield" _ZwUmsThreadYield@4
0x4B2F0490: "__stdcall NtWorkerFactoryWorkerReady" _NtWorkerFactoryWorkerReady@4
0x4B341370: "__stdcall RtlConsoleMultiByteToUnicodeN" _RtlConsoleMultiByteToUnicodeN@24
0x4B284F88: "System32" ??_C@_1BC@PBPPGPAN@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x4B34E590: "__stdcall RtlGetNtGlobalFlags" _RtlGetNtGlobalFlags@0
0x4B3428B0: "__stdcall PfxFindPrefix" _PfxFindPrefix@8
0x4B2F0900: "__stdcall ZwYieldExecution" _ZwYieldExecution@0
0x4B2B25C0: "__stdcall RtlIsValidIndexHandle" _RtlIsValidIndexHandle@12
0x4B353880: "__stdcall RtlIoDecodeMemIoResource" _RtlIoDecodeMemIoResource@16
0x4B2A3DF4: "LanmanNt" ??_C@_1BC@HCEJBDJB@?$AAL?$AAa?$AAn?$AAm?$AAa?$AAn?$AAN?$AAt?$AA?$AA@
0x4B2FC737: "__cdecl _fpclass" __fpclass
0x4B2F10A0: "__stdcall NtCreateTokenEx" _NtCreateTokenEx@68
0x4B33C6B0: "__stdcall DbgPrompt" _DbgPrompt@12
0x4B32F5D1: "__stdcall LdrpInitializeExecutionOptions" _LdrpInitializeExecutionOptions@24
0x4B2F0FE0: "__stdcall ZwCreateProcess" _ZwCreateProcess@32
0x4B2F04A0: "__stdcall NtAcceptConnectPort" _NtAcceptConnectPort@24
0x4B292624: ".txt2" ??_C@_05GPMKGAJL@?4txt2?$AA@
0x4B297B08: "SXS: %s() - Caller asked to use " ??_C@_0FB@PHECDDLC@SXS?3?5?$CFs?$CI?$CJ?5?9?5Caller?5asked?5to?5use?5@
0x4B2DB460: "__stdcall RtlSetLastWin32Error" _RtlSetLastWin32Error@4
0x4B34EA1F: "__stdcall LdrpGetMUILangConfigNode" _LdrpGetMUILangConfigNode@16
0x4B34A8CB: "__stdcall RtlpRegisterLockedMemoryBlockLookaside" _RtlpRegisterLockedMemoryBlockLookaside@0
0x4B293D58: "LdrpCodeAuthzInitialize failed w" ??_C@_0DE@BFJECGNH@LdrpCodeAuthzInitialize?5failed?5w@
0x4B2A9B60: "__stdcall RtlpIsQualifiedLanguage" _RtlpIsQualifiedLanguage@12
0x4B33CFE2: "__stdcall LdrpGetModuleInfoFromVirtualMemory" _LdrpGetModuleInfoFromVirtualMemory@28
0x4B2DC590: "__stdcall TppIopFree" _TppIopFree@4
0x4B33C1C0: "__fastcall RtlUshortByteSwap" @RtlUshortByteSwap@4
0x4B296A18: "SXS: Activation context data at " ??_C@_0EH@JKOBCPIE@SXS?3?5Activation?5context?5data?5at?5@
0x4B2F1510: "__stdcall ZwLockVirtualMemory" _ZwLockVirtualMemory@16
0x4B287BA8: "VerifyVersionInfoSwitch" ??_C@_1DA@JFDAHIML@?$AAV?$AAe?$AAr?$AAi?$AAf?$AAy?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AAI?$AAn?$AAf?$AAo?$AAS?$AAw?$AAi?$AAt?$AAc?$AAh?$AA?$AA@
0x4B377BEF: "__stdcall RtlpHpVaMgrRangeSplit" _RtlpHpVaMgrRangeSplit@12
0x4B2E9E70: "__stdcall RtlExpandEnvironmentStrings_U" _RtlExpandEnvironmentStrings_U@16
0x4B34E780: "__stdcall RtlWriteRegistryValue" _RtlWriteRegistryValue@24
0x4B2A61B8: "File" ??_C@_19DDLLJDOO@?$AAF?$AAi?$AAl?$AAe?$AA?$AA@
0x4B2A5474: "Heap %p - headers modified (%p i" ??_C@_0DH@MPPCDLBE@Heap?5?$CFp?5?9?5headers?5modified?5?$CI?$CFp?5i@
0x4B2FD0F0: "__cdecl _snprintf_s" __snprintf_s
0x4B305008: "__stdcall RtlpExecuteHandlerForUnwind" _RtlpExecuteHandlerForUnwind@20
0x4B2FDF00: "__cdecl vswprintf_s" _vswprintf_s
0x4B2F0EA0: "__stdcall ZwCreateDebugObject" _ZwCreateDebugObject@16
0x4B34EC5B: "__stdcall LdrpMultiSZCchLength" _LdrpMultiSZCchLength@12
0x4B37B1D9: "__stdcall RtlpHpVsChunkComputeCost" _RtlpHpVsChunkComputeCost@16
0x4B2CA6ED: "__stdcall LdrpGetDelayloadExportDll" _LdrpGetDelayloadExportDll@20
0x4B2A3770: "((FreeBlock->Flags & HEAP_ENTRY_" ??_C@_0HE@LDFLNCMG@?$CI?$CIFreeBlock?9?$DOFlags?5?$CG?5HEAP_ENTRY_@
0x4B2F1640: "__stdcall ZwOpenKeyEx" _ZwOpenKeyEx@16
0x4B39F620: "__cdecl RtlpLeakHeap" _RtlpLeakHeap
0x4B2F0B10: "__stdcall NtAcquireProcessActivityReference" _NtAcquireProcessActivityReference@12
0x4B2E516F: "__stdcall LdrpInitialize" _LdrpInitialize@8
0x4B2E2E90: "__stdcall LdrSetDllDirectory" _LdrSetDllDirectory@4
0x4B2F1770: "__stdcall ZwPrePrepareComplete" _ZwPrePrepareComplete@8
0x4B2F1890: "__stdcall ZwQueryFullAttributesFile" _ZwQueryFullAttributesFile@8
0x4B28C2A4: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x4B3A15A0: "__cdecl LdrpRedirectionTree" _LdrpRedirectionTree
0x4B2A7CA0: "__stdcall RtlLocaleNameToLcid" _RtlLocaleNameToLcid@12
0x4B2DBF40: "__stdcall RtlAllocateActivationContextStack" _RtlAllocateActivationContextStack@4
0x4B2F04D0: "__stdcall ZwCallbackReturn" _ZwCallbackReturn@12
0x4B2EE1B5: "__stdcall EtwpAllocateFreeBuffers" _EtwpAllocateFreeBuffers@8
0x4B2D24F4: "__stdcall LdrpSendDllNotifications" _LdrpSendDllNotifications@12
0x4B39FE98: "__cdecl LdrpAppPackagesPath" _LdrpAppPackagesPath
0x4B36A20E: "__stdcall RtlpCreateExecutionRequiredRequest" _RtlpCreateExecutionRequiredRequest@8
0x4B2CED10: "__stdcall TppCallbackCheckThreadAfterCallback" _TppCallbackCheckThreadAfterCallback@4
0x4B2E9400: "__stdcall LdrGetProcedureAddress" _LdrGetProcedureAddress@16
0x4B32B320: "__stdcall DbgUiGetThreadDebugObject" _DbgUiGetThreadDebugObject@0
0x4B336864: "__stdcall AVrfpIsVerifierProviderDll" _AVrfpIsVerifierProviderDll@4
0x4B293FB0: "Searching for "%wZ" in "%wZ" " ??_C@_0BO@CKOHJDLG@Searching?5for?5?$CC?$CFwZ?$CC?5in?5?$CC?$CFwZ?$CC?6?$AA@
0x4B2F09C0: "__stdcall ZwResumeThread" _ZwResumeThread@8
0x4B379551: "__stdcall RtlpHpSegPageRangeCommit" _RtlpHpSegPageRangeCommit@24
0x4B347790: "__stdcall RtlTryConvertSRWLockSharedToExclusiveOrRelease" _RtlTryConvertSRWLockSharedToExclusiveOrRelease@4
0x4B304DD0: "__stdcall RtlLargeIntegerArithmeticShift" _RtlLargeIntegerArithmeticShift@12
0x4B2923E8: "__cdecl AppModelGenericLibraryLoadFailureNoTermination" _AppModelGenericLibraryLoadFailureNoTermination
0x4B294DB0: "Windows.WindowsPhone8x" ??_C@_1CO@JHKHLIPP@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAP?$AAh?$AAo?$AAn?$AAe?$AA8?$AAx?$AA?$AA@
0x4B2941F0: "DisableExceptionChainValidation" ??_C@_1EA@GNPIAFMM@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAE?$AAx?$AAc?$AAe?$AAp?$AAt?$AAi?$AAo?$AAn?$AAC?$AAh?$AAa?$AAi?$AAn?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B2AA9B0: "__stdcall LdrGetDllDirectory" _LdrGetDllDirectory@4
0x4B355320: "__stdcall RtlpGetExtraStuffPointerUnsafe" _RtlpGetExtraStuffPointerUnsafe@8
0x4B3787DC: "__stdcall RtlpHpSegMgrApplyLargePagePolicy" _RtlpHpSegMgrApplyLargePagePolicy@4
0x4B2E299F: "__stdcall EtwpFindGuidEntry" _EtwpFindGuidEntry@4
0x4B3A17AC: "__cdecl RtlpExceptionLog2" _RtlpExceptionLog2
0x4B2D173F: "__stdcall LdrLogNewDataDllLoad" _LdrLogNewDataDllLoad@8
0x4B3424A0: "__stdcall RtlLocalTimeToSystemTime" _RtlLocalTimeToSystemTime@8
0x4B364360: "__stdcall RtlRaiseCustomSystemEventTrigger" _RtlRaiseCustomSystemEventTrigger@4
0x4B2CB220: "__stdcall LdrGetDllHandle" _LdrGetDllHandle@16
0x4B2FADF4: "__cdecl __libm_error_support" ___libm_error_support
0x4B2A8D90: "__stdcall RtlUpperChar" _RtlUpperChar@4
0x4B332290: "__stdcall RtlCopyOutOfProcessMemoryStreamTo" _RtlCopyOutOfProcessMemoryStreamTo@24
0x4B29419C: "UseImpersonatedDeviceMap" ??_C@_1DC@OGGBPDH@?$AAU?$AAs?$AAe?$AAI?$AAm?$AAp?$AAe?$AAr?$AAs?$AAo?$AAn?$AAa?$AAt?$AAe?$AAd?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAM?$AAa?$AAp?$AA?$AA@
0x4B2F1B30: "__stdcall ZwRemoveIoCompletionEx" _ZwRemoveIoCompletionEx@24
0x4B36A140: "__stdcall RtlpStackTraceDatabaseLogPrefix" _RtlpStackTraceDatabaseLogPrefix@16
0x4B2E0773: "__stdcall RtlpTimeFieldsToTimeNoLeapSeconds" _RtlpTimeFieldsToTimeNoLeapSeconds@8
0x4B2CCE40: "__stdcall RtlLengthSidAsUnicodeString" _RtlLengthSidAsUnicodeString@8
0x4B28581C: "SE_InstallBeforeInit" ??_C@_0BF@OFJMAJLA@SE_InstallBeforeInit?$AA@
0x4B343FF0: "__stdcall RtlReleasePrivilege" _RtlReleasePrivilege@4
0x4B2CA062: "__stdcall LdrpSnapKernelBaseExtensions" _LdrpSnapKernelBaseExtensions@0
0x4B2E25D0: "__stdcall RtlAllocateAndInitializeSid" _RtlAllocateAndInitializeSid@44
0x4B3502B1: "__stdcall RtlStringCchCatW" _RtlStringCchCatW@12
0x4B3881D6: "__stdcall QueryRegistryValue" _QueryRegistryValue@20
0x4B2EAC80: "__stdcall EtwTraceMessageVa" _EtwTraceMessageVa@24
0x4B2952C8: "UBR" ??_C@_17KEIPLBHK@?$AAU?$AAB?$AAR?$AA?$AA@
0x4B2A6D6C: "__stdcall RtlpImageDirectoryEntryToData64" _RtlpImageDirectoryEntryToData64@24
0x4B361CDE: "__stdcall Normalization__AppendDecomposedChar" _Normalization__AppendDecomposedChar@12
0x4B343FD0: "__stdcall RtlOwnerAcesPresent" _RtlOwnerAcesPresent@4
0x4B3A421C: "__cdecl LdrpMrdataHeap" _LdrpMrdataHeap
0x4B3322D0: "__stdcall RtlRevertMemoryStream" _RtlRevertMemoryStream@4
0x4B32C080: "__stdcall LdrFastFailInLoaderCallout" _LdrFastFailInLoaderCallout@0
0x4B2A5628: "RtlDestroyHeap" ??_C@_0P@HGJJNGEH@RtlDestroyHeap?$AA@
0x4B32BD00: "__stdcall RtlGetFrame" _RtlGetFrame@0
0x4B2F0970: "__stdcall ZwCreateProcessEx" _ZwCreateProcessEx@36
0x4B3619C6: "__stdcall NormBuffer__LastStartBase" _NormBuffer__LastStartBase@4
0x4B3A0B3C: "__cdecl LdrpImportRedirectionPresent" _LdrpImportRedirectionPresent
0x4B298BB8: "LdrResRelease Exit" ??_C@_1CG@HPCBJOKO@?$AAL?$AAd?$AAr?$AAR?$AAe?$AAs?$AAR?$AAe?$AAl?$AAe?$AAa?$AAs?$AAe?$AA?5?$AAE?$AAx?$AAi?$AAt?$AA?$AA@
0x4B2F0D10: "__stdcall ZwAlpcQueryInformation" _ZwAlpcQueryInformation@20
0x4B2CD321: "__stdcall InitializeTEBUserLangList" _InitializeTEBUserLangList@8
0x4B2CC85E: "__stdcall LdrpConvertLangFallbackListToMultiSz" _LdrpConvertLangFallbackListToMultiSz@28
0x4B2F92A9: "__cdecl _abnormal_termination" __abnormal_termination
0x4B2861D0: "__cdecl _wctype" __wctype
0x4B2D23B1: "__stdcall LdrpSendPostSnapNotifications" _LdrpSendPostSnapNotifications@4
0x4B2959F4: "AVRF: Snapped (%ws: %s) with (%w" ??_C@_0CK@LBPEBLAA@AVRF?3?5Snapped?5?$CI?$CFws?3?5?$CFs?$CJ?5with?5?$CI?$CFw@
0x4B2940FC: "FrontEndHeapDebugOptions" ??_C@_1DC@BNEJKDGJ@?$AAF?$AAr?$AAo?$AAn?$AAt?$AAE?$AAn?$AAd?$AAH?$AAe?$AAa?$AAp?$AAD?$AAe?$AAb?$AAu?$AAg?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x4B2F61D0: "__cdecl mbstowcs" _mbstowcs
0x4B2EF7C5: "__stdcall EtwpGuidEntryCompare" _EtwpGuidEntryCompare@8
0x4B2F92F4: "__cdecl _NLG_Call" __NLG_Call
0x4B2F14D0: "__stdcall NtLoadKeyEx" _NtLoadKeyEx@32
0x4B37BB28: "__stdcall RtlpHpVsFreeChunkInsert" _RtlpHpVsFreeChunkInsert@12
0x4B2F22B0: "__stdcall ZwWow64IsProcessorFeaturePresent" _ZwWow64IsProcessorFeaturePresent@4
0x4B2866E8: "__cdecl __lookuptable" ___lookuptable
0x4B338ECA: "__stdcall StringCchCopyW" _StringCchCopyW@12
0x4B2A7150: "__stdcall RtlDeleteAtomFromAtomTable" _RtlDeleteAtomFromAtomTable@8
0x4B2B2A07: "__stdcall RtlpGetLengthWithoutLastPathElement" _RtlpGetLengthWithoutLastPathElement@16
0x4B2DB103: "__stdcall WerEscalationReadImageVersionInfoForModuleBase" _WerEscalationReadImageVersionInfoForModuleBase@8
0x4B298964: "SR - " ??_C@_1M@JAFIDMJJ@?$AAS?$AAR?$AA?5?$AA?9?$AA?5?$AA?$AA@
0x4B288D00: "__cdecl RtlpBitsClearLow" _RtlpBitsClearLow
0x4B2EFDC3: "__stdcall EtwpTrackDebugIdForSession" _EtwpTrackDebugIdForSession@12
0x4B301DF0: "__stdcall SHATransformP3" _SHATransformP3@8
0x4B2F21E0: "__stdcall ZwWow64CsrAllocateMessagePointer" _ZwWow64CsrAllocateMessagePointer@12
0x4B365DE0: "__stdcall RtlpMuiRegGrowLanguageList" _RtlpMuiRegGrowLanguageList@8
0x4B2F6051: "__cdecl isleadbyte" _isleadbyte
0x4B2DDD41: "__stdcall LdrpPinNodeRecurse" _LdrpPinNodeRecurse@4
0x4B2E8420: "__stdcall RtlReleaseResource" _RtlReleaseResource@4
0x4B3A4220: "__cdecl LdrpMrdataSize" _LdrpMrdataSize
0x4B3048E0: "__stdcall RtlFillMemoryUlong" _RtlFillMemoryUlong@12
0x4B2D6DE3: "__stdcall TpAllocPoolInternal" _TpAllocPoolInternal@8
0x4B32BFF7: "__cdecl StringCbPrintfA" _StringCbPrintfA
0x4B2DDDD7: "__stdcall TppCleanupGroupRemoveMember" _TppCleanupGroupRemoveMember@4
0x4B298260: "SXS: Attempt to probe assembly s" ??_C@_0GJ@OHFCGOCL@SXS?3?5Attempt?5to?5probe?5assembly?5s@
0x4B28C35C: "ENTERPRISEAUTHENTICATION" ??_C@_1DC@DGDLMKCJ@?$AAE?$AAN?$AAT?$AAE?$AAR?$AAP?$AAR?$AAI?$AAS?$AAE?$AAA?$AAU?$AAT?$AAH?$AAE?$AAN?$AAT?$AAI?$AAC?$AAA?$AAT?$AAI?$AAO?$AAN?$AA?$AA@
0x4B335102: "__stdcall RtlpCopyRemoteDebugInformation" _RtlpCopyRemoteDebugInformation@4
0x4B361B93: "__stdcall NormBuffer__ReplaceLastStartBasePair" _NormBuffer__ReplaceLastStartBasePair@16
0x4B334790: "__stdcall RtlQueryProcessHeapInformation" _RtlQueryProcessHeapInformation@4
0x4B2F6130: "__cdecl iswprint" _iswprint
0x4B2F1AE0: "__stdcall ZwRecoverTransactionManager" _ZwRecoverTransactionManager@4
0x4B2A535C: "NextAvailableTagIndex" ??_C@_0BG@PMIEMADE@NextAvailableTagIndex?$AA@
0x4B3441B0: "__stdcall RtlReplaceSidInSd" _RtlReplaceSidInSd@16
0x4B3008EC: "__cdecl _winput_s" __winput_s
0x4B2F1C70: "__stdcall NtSaveMergedKeys" _NtSaveMergedKeys@12
0x4B367D66: "__stdcall RtlpHeapLogRangeDestroy" _RtlpHeapLogRangeDestroy@4
0x4B2D2561: "__stdcall SbUpdateSwitchContextBasedOnDll" _SbUpdateSwitchContextBasedOnDll@12
0x4B293214: "_LdrpInitialize" ??_C@_0BA@INBNLPDA@_LdrpInitialize?$AA@
0x4B2F9370: "__cdecl _output_l" __output_l
0x4B2F2130: "__stdcall ZwWaitForAlertByThreadId" _ZwWaitForAlertByThreadId@8
0x4B35FEB6: "__stdcall InsertChar" _InsertChar@12
0x4B2A5F98: "ThreadPool: callback %p(%p) retu" ??_C@_0EA@IBEMPMJI@ThreadPool?3?5callback?5?$CFp?$CI?$CFp?$CJ?5retu@
0x4B2A5EB4: "BuildLabEx" ??_C@_1BG@CLMGIAOK@?$AAB?$AAu?$AAi?$AAl?$AAd?$AAL?$AAa?$AAb?$AAE?$AAx?$AA?$AA@
0x4B2EF600: "__stdcall MD5Final" _MD5Final@4
0x4B33C1A0: "__fastcall RtlUlonglongByteSwap" @RtlUlonglongByteSwap@8
0x4B2D7898: "__fastcall RtlpInitializeLowFragHeap" @RtlpInitializeLowFragHeap@12
0x4B2F15C0: "__stdcall ZwNotifyChangeDirectoryFileEx" _ZwNotifyChangeDirectoryFileEx@40
0x4B2E7B90: "__stdcall AlpcInitializeMessageAttribute" _AlpcInitializeMessageAttribute@16
0x4B2F5000: "__cdecl _swprintf" __swprintf
0x4B2DE560: "__stdcall RtlUTF8ToUnicodeN" _RtlUTF8ToUnicodeN@20
0x4B2B344B: "__stdcall LdrpMapDllSearchPath" _LdrpMapDllSearchPath@4
0x4B2811FC: "__cdecl NtDllName" _NtDllName
0x4B3A00C0: "__cdecl AVrfpVerifierLock" _AVrfpVerifierLock
0x4B342A60: "__stdcall PfxRemovePrefix" _PfxRemovePrefix@8
0x4B3378F0: "__stdcall RtlQueueApcWow64Thread" _RtlQueueApcWow64Thread@20
0x4B2D0CD0: "__stdcall RtlSetThreadWorkOnBehalfTicket" _RtlSetThreadWorkOnBehalfTicket@4
0x4B338E30: "__stdcall ShipAssertMsgW" _ShipAssertMsgW@12
0x4B2E74E0: "__stdcall RtlLengthSecurityDescriptor" _RtlLengthSecurityDescriptor@4
0x4B294C90: "Packaged DLL search path compute" ??_C@_0EE@IDDLJONK@Packaged?5DLL?5search?5path?5compute@
0x4B2E53CE: "__stdcall LdrpFreeTls" _LdrpFreeTls@0
0x4B2F17B0: "__stdcall ZwPrivilegeCheck" _ZwPrivilegeCheck@12
0x4B373B20: "__stdcall RtlpHpHeapProtect" _RtlpHpHeapProtect@8
0x4B2C70A7: "__stdcall LdrpLogNewDllLoad" _LdrpLogNewDllLoad@8
0x4B2968F8: "SXS: Warning: Activation context" ??_C@_0EB@KBDMMBIN@SXS?3?5Warning?3?5Activation?5context@
0x4B378009: "__stdcall RtlpHpSegContextInitialize" _RtlpHpSegContextInitialize@36
0x4B2E64D0: "__stdcall RtlGetThreadWorkOnBehalfTicket" _RtlGetThreadWorkOnBehalfTicket@8
0x4B2CBA50: "__stdcall LdrDisableThreadCalloutsForDll" _LdrDisableThreadCalloutsForDll@4
0x4B2F3CC0: "__cdecl ispunct" _ispunct
0x4B2F1040: "__stdcall NtCreateSemaphore" _NtCreateSemaphore@20
0x4B2EA080: "__stdcall RtlLengthRequiredSid" _RtlLengthRequiredSid@4
0x4B35108C: "__stdcall RtlpFileIsWin32WithRCManifest" _RtlpFileIsWin32WithRCManifest@4
0x4B35EC3E: "__stdcall RtlpGuardGrantSuppressedCallAccess" _RtlpGuardGrantSuppressedCallAccess@8
0x4B2A5648: "Invalid allocation size - %Ix (e" ??_C@_0CO@DOLLCJPN@Invalid?5allocation?5size?5?9?5?$CFIx?5?$CIe@
0x4B2FF95E: "__cdecl _swoutput_s" __swoutput_s
0x4B343EE0: "__stdcall RtlMapSecurityErrorToNtStatus" _RtlMapSecurityErrorToNtStatus@4
0x4B380CD4: "__stdcall TppJobpValidateJob" _TppJobpValidateJob@8
0x4B3784E9: "__stdcall RtlpHpSegLargeRangeAllocate" _RtlpHpSegLargeRangeAllocate@16
0x4B2F18E0: "__stdcall ZwQueryInformationPort" _ZwQueryInformationPort@20
0x4B2F7A40: "__cdecl strnlen" _strnlen
0x4B294FFC: "Detachable" ??_C@_1BG@JBJJDBBO@?$AAD?$AAe?$AAt?$AAa?$AAc?$AAh?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x4B2F2230: "__stdcall NtWow64DebuggerCall" _NtWow64DebuggerCall@20
0x4B2F19A0: "__stdcall NtQueryOpenSubKeysEx" _NtQueryOpenSubKeysEx@16
0x4B338AE8: "__stdcall WerpSetProcessFaultInformation" _WerpSetProcessFaultInformation@12
0x4B2ABCE6: "__stdcall LdrpInitShimEngine" _LdrpInitShimEngine@4
0x4B2D6A38: "__fastcall RtlpFreeUserBlock" @RtlpFreeUserBlock@12
0x4B2A5510: "Invalid CommitSize parameter - %" ??_C@_0CE@LICJEAIN@Invalid?5CommitSize?5parameter?5?9?5?$CF@
0x4B3043E0: "__cdecl _SEH_prolog4_GS" __SEH_prolog4_GS
0x4B2F06C0: "__stdcall NtRequestWaitReplyPort" _NtRequestWaitReplyPort@12
0x4B2F20F0: "__stdcall ZwUnmapViewOfSectionEx" _ZwUnmapViewOfSectionEx@12
0x4B364E80: "__stdcall RtlWakeAddressSingleNoFence" _RtlWakeAddressSingleNoFence@4
0x4B298DBC: "Global\Session\%ld%s" ??_C@_1CK@LDAJCDKF@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AA?2?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?2?$AA?$CF?$AAl?$AAd?$AA?$CF?$AAs?$AA?$AA@
0x4B285DAC: "Invalid parameter passed to C ru" ??_C@_0DB@OPDBMGNG@Invalid?5parameter?5passed?5to?5C?5ru@
0x4B2F7860: "__cdecl strncmp" _strncmp
0x4B2F4240: "__cdecl _aullrem" __aullrem
0x4B2B5DB0: "__stdcall RtlIntegerToChar" _RtlIntegerToChar@16
0x4B2C82D7: "__stdcall RtlpMuiRegAddMultiSzToLangFallbackList" _RtlpMuiRegAddMultiSzToLangFallbackList@28
0x4B292EB8: "Failed to retrieve service check" ??_C@_1EK@ONFECCIN@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAr?$AAe?$AAt?$AAr?$AAi?$AAe?$AAv?$AAe?$AA?5?$AAs?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?5?$AAc?$AAh?$AAe?$AAc?$AAk@
0x4B2CF890: "__stdcall RtlReleasePebLock" _RtlReleasePebLock@0
0x4B2A3C0C: "2147483647" ??_C@_0L@KLDLBCKA@2147483647?$AA@
0x4B36A2B6: "__stdcall RtlpDestroyExecutionRequiredRequest" _RtlpDestroyExecutionRequiredRequest@4
0x4B2F1B40: "__stdcall ZwRemoveProcessDebug" _ZwRemoveProcessDebug@8
0x4B2B7D76: "__stdcall LdrpGenSecurityCookie" _LdrpGenSecurityCookie@4
0x4B2A7B1B: "__stdcall LdrpLogRelativePathWithAlteredSearchError" _LdrpLogRelativePathWithAlteredSearchError@4
0x4B299688: "\OSDataRoot\Windows\bootstat.dat" ??_C@_1EC@POCPCOCD@?$AA?2?$AAO?$AAS?$AAD?$AAa?$AAt?$AAa?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAb?$AAo?$AAo?$AAt?$AAs?$AAt?$AAa?$AAt?$AA?4?$AAd?$AAa?$AAt@
0x4B348450: "__stdcall RtlAddResourceAttributeAce" _RtlAddResourceAttributeAce@28
0x4B2949E8: "Function %s raised exception 0x%" ??_C@_0FK@DNJHCCOK@Function?5?$CFs?5raised?5exception?50x?$CF@
0x4B37915A: "__stdcall RtlpHpSegPageRangeAllocate" _RtlpHpSegPageRangeAllocate@12
0x4B297788: "RtlpQueryFilesInAssemblyInformat" ??_C@_0EI@BBBOKDNG@RtlpQueryFilesInAssemblyInformat@
0x4B3A1704: "__cdecl EtwpRegisterTpInitOnce" _EtwpRegisterTpInitOnce
0x4B2F12B0: "__stdcall ZwFlushInstallUILanguage" _ZwFlushInstallUILanguage@8
0x4B28468C: "__cdecl szTimeZonesSlash" _szTimeZonesSlash
0x4B2F1FC0: "__stdcall ZwStopProfile" _ZwStopProfile@4
0x4B2B2F80: "__stdcall RtlFindUnicodeSubstring" _RtlFindUnicodeSubstring@12
0x4B286BDC: "API set" ??_C@_07MJGMMFLJ@API?5set?$AA@
0x4B2868DC: "__cdecl MS_Windows_AeSwitchBack_Provider" _MS_Windows_AeSwitchBack_Provider
0x4B294D8C: "Windows.Windows8x" ??_C@_1CE@KKJIIBMF@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA8?$AAx?$AA?$AA@
0x4B2F39F0: "__cdecl _CIsqrt" __CIsqrt
0x4B39FB65: "__cdecl NlsMbCodePageTag" _NlsMbCodePageTag
0x4B2857C4: "SE_ProcessDying" ??_C@_0BA@OFEKHGBP@SE_ProcessDying?$AA@
0x4B286B78: "minkernel\ntdll\ldrutil.c" ??_C@_0BK@BANEDJFB@minkernel?2ntdll?2ldrutil?4c?$AA@
0x4B304590: "__stdcall NtdllDialogWndProc_W" _NtdllDialogWndProc_W@0
0x4B2F2980: "__stdcall KiRaiseUserExceptionDispatcher" _KiRaiseUserExceptionDispatcher@0
0x4B294694: "LdrpFindDllActivationContext" ??_C@_0BN@KOLBCFLF@LdrpFindDllActivationContext?$AA@
0x4B2FD1B0: "__cdecl _snscanf_s" __snscanf_s
0x4B381C36: "__stdcall TppETWPoolClose" _TppETWPoolClose@4
0x4B3A182C: "__cdecl AVrfpDebug" _AVrfpDebug
0x4B2B9150: "__stdcall LdrFindResource_U" _LdrFindResource_U@16
0x4B2F1DB0: "__stdcall ZwSetInformationKey" _ZwSetInformationKey@16
0x4B2B1D64: "__stdcall RtlCreateAtomTableEx" _RtlCreateAtomTableEx@12
0x4B369F39: "__stdcall RtlpQueryErrorInformationAddress" _RtlpQueryErrorInformationAddress@12
0x4B2F1EE0: "__stdcall ZwSetSystemPowerState" _ZwSetSystemPowerState@12
0x4B37B414: "__stdcall RtlpHpVsChunkFree" _RtlpHpVsChunkFree@20
0x4B2F1370: "__stdcall NtGetCurrentProcessorNumber" _NtGetCurrentProcessorNumber@0
0x4B2F09E0: "__stdcall ZwReadRequestData" _ZwReadRequestData@24
0x4B3A0B20: "__cdecl LdrpActiveThreadCount" _LdrpActiveThreadCount
0x4B2F1650: "__stdcall NtOpenKeyTransacted" _NtOpenKeyTransacted@16
0x4B304E50: "__stdcall __RtlConvertUlongToLargeInteger" ___RtlConvertUlongToLargeInteger@4
0x4B36A524: "__stdcall RtlpHpTagContextFindFreeTag" _RtlpHpTagContextFindFreeTag@4
0x4B2F18D0: "__stdcall ZwQueryInformationJobObject" _ZwQueryInformationJobObject@20
0x4B2A556C: "Specified HeapBase (%p) invalid," ??_C@_0DA@DLAAMBNJ@Specified?5HeapBase?5?$CI?$CFp?$CJ?5invalid?0@
0x4B286878: "__cdecl __lconv_static_W_null" ___lconv_static_W_null
0x4B298D50: "%s\%ld\%s" ??_C@_1BE@BNDIFIKI@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAl?$AAd?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x4B2FBACB: "__cdecl _floor_default" __floor_default
0x4B286780: "log" ??_C@_03MGHMBJCF@log?$AA@
0x4B37F7D9: "__stdcall EtwpAddReloggedPartitionInfoEvent" _EtwpAddReloggedPartitionInfoEvent@12
0x4B39E7E0: "__cdecl _half" __half
0x4B3395E0: "__stdcall WinSqmIsSessionDisabled" _WinSqmIsSessionDisabled@4
0x4B295140: "Home Automation" ??_C@_1CA@PLFMBJBN@?$AAH?$AAo?$AAm?$AAe?$AA?5?$AAA?$AAu?$AAt?$AAo?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B2F0B20: "__stdcall NtAddAtomEx" _NtAddAtomEx@16
0x4B2F1E90: "__stdcall ZwSetQuotaInformationFile" _ZwSetQuotaInformationFile@16
0x4B2E7858: "__stdcall TppPoolAddWorker" _TppPoolAddWorker@8
0x4B2A8467: "__stdcall RtlpTpWaitCheckReset" _RtlpTpWaitCheckReset@8
0x4B2B5003: "__stdcall RtlpResUltimateFallbackInfo" _RtlpResUltimateFallbackInfo@20
0x4B2EA040: "__stdcall RtlGetEnabledExtendedFeatures" _RtlGetEnabledExtendedFeatures@8
0x4B304650: "__stdcall NtdllGhostWndProc_W" _NtdllGhostWndProc_W@0
0x4B2F16E0: "__stdcall ZwOpenResourceManager" _ZwOpenResourceManager@20
0x4B334EC2: "__stdcall RtlpChangeQueryDebugBufferTarget" _RtlpChangeQueryDebugBufferTarget@16
0x4B299910: "MachineLanguageConfiguration" ??_C@_1DK@EOBOFKDB@?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B294310: "TrackActivationContextReleases" ??_C@_1DO@MFJFCHAG@?$AAT?$AAr?$AAa?$AAc?$AAk?$AAA?$AAc?$AAt?$AAi?$AAv?$AAa?$AAt?$AAi?$AAo?$AAn?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AAR?$AAe?$AAl?$AAe?$AAa?$AAs?$AAe?$AAs?$AA?$AA@
0x4B2E8D63: "__stdcall TppCritSetThread" _TppCritSetThread@4
0x4B304580: "__stdcall NtdllDialogWndProc_A" _NtdllDialogWndProc_A@0
0x4B385BED: "__stdcall PsspWalkInfoClass_PSS_WALK_THREADS" _PsspWalkInfoClass_PSS_WALK_THREADS@12
0x4B2F0C10: "__stdcall ZwAlpcConnectPort" _ZwAlpcConnectPort@44
0x4B332970: "__stdcall RtlpProcessReflectionStartup" _RtlpProcessReflectionStartup@4
0x4B2F54F0: "__cdecl _wcslwr_s" __wcslwr_s
0x4B367EE0: "__stdcall RtlpHpHeapHandleError" _RtlpHpHeapHandleError@12
0x4B2BA2B0: "__stdcall LdrpSearchResourceSection_U" _LdrpSearchResourceSection_U@20
0x4B2A3FC0: "The resource is unowned. This u" ??_C@_0FO@HODLHPII@The?5resource?5is?5unowned?4?5?5This?5u@
0x4B3829A0: "__stdcall RtlpTpIoDllNotification" _RtlpTpIoDllNotification@12
0x4B2D9374: "__stdcall LdrpInitParallelLoadingSupport" _LdrpInitParallelLoadingSupport@0
0x4B281834: "__cdecl trnsfrms" _trnsfrms
0x4B285CF8: "__cdecl szStandardStart" _szStandardStart
0x4B2A8D10: "__stdcall RtlEqualString" _RtlEqualString@12
0x4B298C78: "__cdecl Magic10000000" _Magic10000000
0x4B2F1230: "__stdcall NtEnumerateDriverEntries" _NtEnumerateDriverEntries@8
0x4B33F600: "__stdcall RtlValidProcessProtection" _RtlValidProcessProtection@4
0x4B2FC87E: "__cdecl wctomb_s" _wctomb_s
0x4B333730: "__stdcall RtlCreateUserSecurityObject" _RtlCreateUserSecurityObject@28
0x4B2DD440: "__stdcall TpWaitForWait" _TpWaitForWait@8
0x4B304490: "__stdcall NtdllMenuWndProc_W" _NtdllMenuWndProc_W@0
0x4B386A08: "__stdcall RtlpGetVolumeHandle" _RtlpGetVolumeHandle@8
0x4B32BEB3: "__stdcall LdrpTryAcquireLoaderLock" _LdrpTryAcquireLoaderLock@0
0x4B2E5007: "__fastcall RtlpOpenBaseImageFileOptionsKeyEx" @RtlpOpenBaseImageFileOptionsKeyEx@12
0x4B294E58: "Windows.IoT" ??_C@_1BI@LDOCLPCL@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAI?$AAo?$AAT?$AA?$AA@
0x4B2F0A00: "__stdcall NtQueryEvent" _NtQueryEvent@20
0x4B3A0940: "__cdecl LdrpFailureData" _LdrpFailureData
0x4B3A1AD8: "__cdecl RtlpLeakHeapAddress" _RtlpLeakHeapAddress
0x4B2F19E0: "__stdcall NtQuerySecurityObject" _NtQuerySecurityObject@20
0x4B350870: "__stdcall RtlpCleanupRegistryKeys" _RtlpCleanupRegistryKeys@0
0x4B2F17D0: "__stdcall NtPrivilegedServiceAuditAlarm" _NtPrivilegedServiceAuditAlarm@20
0x4B2944D4: "LdrpCompleteMapModule" ??_C@_0BG@CNAOBOAP@LdrpCompleteMapModule?$AA@
0x4B2F8080: "__cdecl wcscmp" _wcscmp
0x4B2F1790: "__stdcall NtPrepareComplete" _NtPrepareComplete@8
0x4B32A0D1: "__stdcall LdrpAppxGetRemediationRegistryKey" _LdrpAppxGetRemediationRegistryKey@12
0x4B2F3560: "__cdecl _CIcos" __CIcos
0x4B34B580: "__stdcall RtlClearAllBits" _RtlClearAllBits@4
0x4B376674: "__stdcall RtlpLfhBucketUsageUpdate" _RtlpLfhBucketUsageUpdate@12
0x4B2D0F19: "__stdcall RtlpComputeDllPath" _RtlpComputeDllPath@8
0x4B2D38AC: "__stdcall TppInitializeTimer" _TppInitializeTimer@24
0x4B293C10: "DllMain of MSCOREE (or its depen" ??_C@_0ED@FEOEIEEN@DllMain?5of?5MSCOREE?5?$CIor?5its?5depen@
0x4B2F1380: "__stdcall ZwGetCurrentProcessorNumberEx" _ZwGetCurrentProcessorNumberEx@4
0x4B294E70: "Windows.IoTHeadless" ??_C@_1CI@BMPLEPEO@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAI?$AAo?$AAT?$AAH?$AAe?$AAa?$AAd?$AAl?$AAe?$AAs?$AAs?$AA?$AA@
0x4B39FE88: "__cdecl RtlpDllSearchPath" _RtlpDllSearchPath
0x4B2E01A2: "__stdcall RtlpFindActivationContextSection_CheckParameters" _RtlpFindActivationContextSection_CheckParameters@20
0x4B2F3942: "__cdecl _CIsin_default" __CIsin_default
0x4B32E19A: "__stdcall LdrpLogNewDllLoadInternal" _LdrpLogNewDllLoadInternal@20
0x4B347930: "__stdcall RtlEnableEarlyCriticalSectionEventCreation" _RtlEnableEarlyCriticalSectionEventCreation@0
0x4B297328: "SXS: %s() found assembly informa" ??_C@_0JP@IPHGCGDE@SXS?3?5?$CFs?$CI?$CJ?5found?5assembly?5informa@
0x4B2E22A4: "__stdcall RtlDoesFileExists_UstrEx" _RtlDoesFileExists_UstrEx@8
0x4B2F0850: "__stdcall ZwCloseObjectAuditAlarm" _ZwCloseObjectAuditAlarm@12
0x4B2854D8: ";" ??_C@_13PJJBFPED@?$AA?$DL?$AA?$AA@
0x4B343480: "__stdcall RtlAcquirePrivilege" _RtlAcquirePrivilege@16
0x4B344A0C: "__stdcall RtlpCompareKnownObjectAces" _RtlpCompareKnownObjectAces@16
0x4B2B0910: "__stdcall RtlCreateAcl" _RtlCreateAcl@12
0x4B2FA8C0: "__cdecl __ascii_strnicmp" ___ascii_strnicmp
0x4B3A14B8: "__cdecl g_ShimsLoading" _g_ShimsLoading
0x4B3829BE: "__stdcall RtlpTpIoDllProcessUnloads" _RtlpTpIoDllProcessUnloads@8
0x4B2F3710: "__cdecl _CIpow" __CIpow
0x4B2DE360: "__stdcall TpSimpleTryPost" _TpSimpleTryPost@12
0x4B2F2020: "__stdcall ZwTerminateJobObject" _ZwTerminateJobObject@8
0x4B2E7FA0: "__stdcall RtlIpv6StringToAddressExW" _RtlIpv6StringToAddressExW@16
0x4B2F0CB0: "__stdcall NtAlpcDeleteSecurityContext" _NtAlpcDeleteSecurityContext@12
0x4B376234: "__stdcall RtlpHpLfhSubsegmentReserveBlock" _RtlpHpLfhSubsegmentReserveBlock@20
0x4B2939B8: "Allocating a buffer to hold the " ??_C@_0EC@NBKEJDEG@Allocating?5a?5buffer?5to?5hold?5the?5@
0x4B2D4780: "__stdcall RtlSetEnvironmentVariable" _RtlSetEnvironmentVariable@12
0x4B2AF3B0: "__stdcall RtlAddMandatoryAce" _RtlAddMandatoryAce@24
0x4B2955FC: "AVRF: resnapping %ws ... " ??_C@_0BL@CGOCPDPF@AVRF?3?5resnapping?5?$CFws?5?4?4?4?5?6?$AA@
0x4B288B68: "\Registry\Machine\System\Current" ??_C@_1KO@ILBBOJJH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B3A1504: "__cdecl TppNumberNodes" _TppNumberNodes
0x4B2D0D19: "__stdcall RtlpGetDirPath" _RtlpGetDirPath@8
0x4B2EADBF: "__stdcall TppWaitTimerExpiration" _TppWaitTimerExpiration@4
0x4B2989E8: "EAFModules" ??_C@_1BG@FCMBHPBF@?$AAE?$AAA?$AAF?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AAs?$AA?$AA@
0x4B304974: "__stdcall RtlCopyMemoryNonTemporal" _RtlCopyMemoryNonTemporal@12
0x4B2C9F2C: "__stdcall LdrpMinimalMapModule" _LdrpMinimalMapModule@8
0x4B2EB0B1: "__stdcall RtlpInitializeStaticCriticalSection" _RtlpInitializeStaticCriticalSection@4
0x4B2A4280: "This means that the I/O device r" ??_C@_0EM@LNMNDAG@This?5means?5that?5the?5I?1O?5device?5r@
0x4B2F3620: "__cdecl _CIlog" __CIlog
0x4B2F11F0: "__stdcall NtDisplayString" _NtDisplayString@4
0x4B33BAA0: "__stdcall ImportTablepFreeModuleSorted" _ImportTablepFreeModuleSorted@4
0x4B2A62E8: "RedirectedKey" ??_C@_1BM@GGIHPLEN@?$AAR?$AAe?$AAd?$AAi?$AAr?$AAe?$AAc?$AAt?$AAe?$AAd?$AAK?$AAe?$AAy?$AA?$AA@
0x4B2F0B40: "__stdcall NtAddDriverEntry" _NtAddDriverEntry@8
0x4B2FF8D8: "__cdecl _sinput_s" __sinput_s
0x4B3A1688: "__cdecl g_RegInfo" _g_RegInfo
0x4B380950: "__stdcall TppJobpCallbackEpilog" _TppJobpCallbackEpilog@4
0x4B2F0FD0: "__stdcall NtCreatePrivateNamespace" _NtCreatePrivateNamespace@16
0x4B34DEF0: "__stdcall RtlGetSystemBootStatus" _RtlGetSystemBootStatus@16
0x4B2F0A20: "__stdcall ZwOpenDirectoryObject" _ZwOpenDirectoryObject@12
0x4B2EFAF0: "__stdcall RtlCreateUserStack" _RtlCreateUserStack@24
0x4B382EED: "__stdcall SbpRecalculateDynamicContext" _SbpRecalculateDynamicContext@4
0x4B299104: "Initialization stack trace. Use " ??_C@_0DM@CFEIILEE@Initialization?5stack?5trace?4?5Use?5@
0x4B2F0B50: "__stdcall ZwAdjustGroupsToken" _ZwAdjustGroupsToken@24
0x4B2D7F61: "__stdcall SwitchedRtlGetVersion" _SwitchedRtlGetVersion@4
0x4B285888: "_CorExeMain" ??_C@_0M@CJEEBJJ@_CorExeMain?$AA@
0x4B3A0BA0: "__cdecl LdrpWorkQueue" _LdrpWorkQueue
0x4B2F9119: "__cdecl _strtoi64" __strtoi64
0x4B2F1E40: "__stdcall NtSetIoCompletion" _NtSetIoCompletion@20
0x4B2A4598: " *** Restarting wait on critsec " ??_C@_0EA@FDEEKDFG@?5?$CK?$CK?$CK?5Restarting?5wait?5on?5critsec?5@
0x4B2F1FB0: "__stdcall NtStartProfile" _NtStartProfile@4
0x4B29463C: "LdrpDoPostSnapWork" ??_C@_0BD@MKAMLHIL@LdrpDoPostSnapWork?$AA@
0x4B3A1690: "__cdecl gCustomCultureRegKey" _gCustomCultureRegKey
0x4B2C72C0: "__stdcall LdrpFastpthReloadedDll" _LdrpFastpthReloadedDll@16
0x4B292F04: "ResIdCount less than 2." ??_C@_1DA@CGMLEGBJ@?$AAR?$AAe?$AAs?$AAI?$AAd?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?5?$AAl?$AAe?$AAs?$AAs?$AA?5?$AAt?$AAh?$AAa?$AAn?$AA?5?$AA2?$AA?4?$AA?$AA@
0x4B37E6D7: "__stdcall EtwpUpdateUmLogger" _EtwpUpdateUmLogger@16
0x4B2D8E90: "__stdcall RtlpTestHookInitialize" _RtlpTestHookInitialize@12
0x4B2EA460: "__stdcall RtlSubAuthorityCountSid" _RtlSubAuthorityCountSid@4
0x4B2A6174: "Process" ??_C@_1BA@NMDNJJOO@?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x4B2E5D20: "__stdcall RtlReleaseRelativeName" _RtlReleaseRelativeName@4
0x4B2F51E0: "__cdecl _vswprintf" __vswprintf
0x4B2DF070: "__stdcall RtlLockHeap" _RtlLockHeap@4
0x4B2F0E70: "__stdcall ZwCompressKey" _ZwCompressKey@4
0x4B373F7E: "__stdcall RtlpHpMetadataHeapStart" _RtlpHpMetadataHeapStart@12
0x4B36992D: "__stdcall RtlpLogHeapSubSegmentAllocCached" _RtlpLogHeapSubSegmentAllocCached@16
0x4B286558: "__cdecl __newcumap" ___newcumap
0x4B2E3E90: "__stdcall RtlSetThreadSubProcessTag" _RtlSetThreadSubProcessTag@4
0x4B36217E: "__stdcall Normalization__GuessBetterCharCount" _Normalization__GuessBetterCharCount@16
0x4B330602: "__stdcall LdrpIsVerifierActivationFilterMatched" _LdrpIsVerifierActivationFilterMatched@12
0x4B285ED0: "__cdecl __newctype" ___newctype
0x4B3A1684: "__cdecl InitRegistryInfoCritSect" _InitRegistryInfoCritSect
0x4B366D37: "__stdcall _RtlpMuiRegPopulateBaseLanguages" __RtlpMuiRegPopulateBaseLanguages@20
0x4B2EC926: "__stdcall SHA256Update" _SHA256Update@12
0x4B3425E0: "__stdcall RtlTimeToElapsedTimeFields" _RtlTimeToElapsedTimeFields@8
0x4B2F1350: "__stdcall NtGetCompleteWnfStateSubscription" _NtGetCompleteWnfStateSubscription@24
0x4B2F52A0: "__cdecl _vsnprintf" __vsnprintf
0x4B34E070: "__stdcall RtlSetSystemBootStatus" _RtlSetSystemBootStatus@16
0x4B304428: "__cdecl _SEH_epilog4_GS" __SEH_epilog4_GS
0x4B2AF522: "__stdcall RtlpNewSecurityObject" _RtlpNewSecurityObject@40
0x4B3A1530: "__cdecl CentennialIssueTracker_InitializedState" _CentennialIssueTracker_InitializedState
0x4B361EF0: "__stdcall Normalization__CanCombineWithStartFirstPair" _Normalization__CanCombineWithStartFirstPair@20
0x4B2C7020: "__stdcall LdrpFreeLoadContext" _LdrpFreeLoadContext@4
0x4B2DFB30: "__stdcall RtlUnicodeToMultiByteSize" _RtlUnicodeToMultiByteSize@12
0x4B2F50A0: "__cdecl _vscprintf" __vscprintf
0x4B2F1450: "__stdcall NtInitiatePowerAction" _NtInitiatePowerAction@16
0x4B2F1AD0: "__stdcall NtRecoverResourceManager" _NtRecoverResourceManager@4
0x4B296AF8: "RtlCreateActivationContext" ??_C@_0BL@KNFPEMBH@RtlCreateActivationContext?$AA@
0x4B2F0B80: "__stdcall NtAlertThread" _NtAlertThread@4
0x4B39FDEC: "__cdecl DataLoadLockCount" _DataLoadLockCount
0x4B367DD2: "__stdcall RtlpHeapLogRangeRelease" _RtlpHeapLogRangeRelease@12
0x4B365E26: "__stdcall RtlpMuiRegGrowStringPool" _RtlpMuiRegGrowStringPool@16
0x4B299C18: "*** ASSERT FAILED: Input paramet" ??_C@_0HB@PAHCEONM@?$CK?$CK?$CK?5ASSERT?5FAILED?3?5Input?5paramet@
0x4B2D4839: "__stdcall RtlpLocateActivationContextSectionForQuery" _RtlpLocateActivationContextSectionForQuery@44
0x4B2FC721: "__cdecl _frnd" __frnd
0x4B39E930: "__cdecl RtlpHeapFailureInfo" _RtlpHeapFailureInfo
0x4B375BA2: "__stdcall RtlpHpLfhSubsegmentFindEmptyUnits" _RtlpHpLfhSubsegmentFindEmptyUnits@12
0x4B3A1AF0: "__cdecl g_dwLastErrorToBreakOn" _g_dwLastErrorToBreakOn
0x4B2F1690: "__stdcall ZwOpenObjectAuditAlarm" _ZwOpenObjectAuditAlarm@48
0x4B2AD960: "__stdcall RtlpGetNameFromLangInfoNode" _RtlpGetNameFromLangInfoNode@12
0x4B3322C0: "__stdcall RtlReadOutOfProcessMemoryStream" _RtlReadOutOfProcessMemoryStream@16
0x4B3A4231: "__cdecl AVrfpEnabled" _AVrfpEnabled
0x4B2986F8: "SXS: RtlGetAssemblyStorageRoot()" ??_C@_0ID@MAGGMDJA@SXS?3?5RtlGetAssemblyStorageRoot?$CI?$CJ@
0x4B360A27: "__stdcall RtlpGetUserCallTargetBitMapRet" _RtlpGetUserCallTargetBitMapRet@0
0x4B35B7F0: "__stdcall RtlSubtreeSuccessor" _RtlSubtreeSuccessor@4
0x4B2A3724: "(!TrailingUCR)" ??_C@_0P@GLEGKAEG@?$CI?$CBTrailingUCR?$CJ?$AA@
0x4B35A090: "__stdcall RtlZeroHeap" _RtlZeroHeap@8
0x4B39F260: "__cdecl NormalizationListLock" _NormalizationListLock
0x4B3587C0: "__stdcall RtlGetExtendedFeaturesMask" _RtlGetExtendedFeaturesMask@4
0x4B2A42FC: "write to" ??_C@_08KNKBHFKG@write?5to?$AA@
0x4B2849E0: "MachinePreferredUILanguages" ??_C@_1DI@CNCPGFIN@?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AAP?$AAr?$AAe?$AAf?$AAe?$AAr?$AAr?$AAe?$AAd?$AAU?$AAI?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAs?$AA?$AA@
0x4B298C70: "__cdecl SecondsToStartOf1980" _SecondsToStartOf1980
0x4B3395F0: "__stdcall WinSqmCommonDatapointSetDWORD64" _WinSqmCommonDatapointSetDWORD64@16
0x4B2F05C0: "__stdcall NtFindAtom" _NtFindAtom@12
0x4B34C1F0: "__stdcall RtlFindSetBits" _RtlFindSetBits@12
0x4B2DC360: "__stdcall TpAllocIoCompletion" _TpAllocIoCompletion@20
0x4B2AD2D1: "__stdcall ValidateRegistrLangType" _ValidateRegistrLangType@4
0x4B2E0B80: "__stdcall RtlTryEnterCriticalSection" _RtlTryEnterCriticalSection@4
0x4B377B71: "__stdcall RtlpHpVaMgrRangeFree" _RtlpHpVaMgrRangeFree@8
0x4B336178: "__stdcall AVrfpAppendCurrentUserSid" _AVrfpAppendCurrentUserSid@4
0x4B336825: "__stdcall AVrfpFormatCurrentUserKeyPath" _AVrfpFormatCurrentUserKeyPath@4
0x4B2F1D20: "__stdcall ZwSetDefaultUILanguage" _ZwSetDefaultUILanguage@4
0x4B2A5BB4: "Pseudo Tag %04x size incorrect (" ??_C@_0DA@JDDKCBFL@Pseudo?5Tag?5?$CF04x?5size?5incorrect?5?$CI@
0x4B29A488: "__cdecl crc32Map1_" _crc32Map1_
0x4B2F1540: "__stdcall NtManageHotPatch" _NtManageHotPatch@16
0x4B327DC0: "__stdcall LdrpInitializeProcess" _LdrpInitializeProcess@8
0x4B2F2AFC: "__stdcall LZNT1DecompressChunk" _LZNT1DecompressChunk@20
0x4B2E8650: "__stdcall A_SHAFinal" _A_SHAFinal@8
0x4B331484: "__stdcall LdrpAddRedirectedFunction" _LdrpAddRedirectedFunction@8
0x4B2AAD90: "__cdecl RtlpCompareActivationContextGuidSectionEntryByGuid" _RtlpCompareActivationContextGuidSectionEntryByGuid
0x4B2976D8: "RtlpQueryAssemblyInformationActi" ??_C@_0EB@FHMHAEKL@RtlpQueryAssemblyInformationActi@
0x4B363520: "__stdcall RtlUnhandledExceptionFilter" _RtlUnhandledExceptionFilter@4
0x4B2AE850: "__stdcall RtlOpenCurrentUser" _RtlOpenCurrentUser@8
0x4B2F0CF0: "__stdcall ZwAlpcOpenSenderProcess" _ZwAlpcOpenSenderProcess@24
0x4B376C12: "__stdcall RtlpHpLargeAllocSizeInternal" _RtlpHpLargeAllocSizeInternal@12
0x4B2F19B0: "__stdcall ZwQueryPortInformationProcess" _ZwQueryPortInformationProcess@0
0x4B2DF372: "__fastcall LdrpGetNewTlsVector" @LdrpGetNewTlsVector@4
0x4B2D92B0: "__stdcall RtlRandomEx" _RtlRandomEx@4
0x4B37CF40: "__stdcall EtwEventWriteStartScenario" _EtwEventWriteStartScenario@20
0x4B2B2570: "__stdcall RtlpLockAtomTable" _RtlpLockAtomTable@4
0x4B2E6BDF: "__stdcall LdrpCodeAuthzInitialize" _LdrpCodeAuthzInitialize@0
0x4B2854C4: "\SysWOW64" ??_C@_1BE@MJECBGNO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?$AA@
0x4B2F12F0: "__stdcall ZwFlushVirtualMemory" _ZwFlushVirtualMemory@16
0x4B3A37C0: "__cdecl RtlpDiskSpeedInit" _RtlpDiskSpeedInit
0x4B2D7530: "__stdcall RtlpGetStackTraceAddressEx" _RtlpGetStackTraceAddressEx@8
0x4B2EB6D0: "__stdcall RtlSetControlSecurityDescriptor" _RtlSetControlSecurityDescriptor@12
0x4B32B0E6: "__stdcall DbgUiConvertStateChangeStructureWorker" _DbgUiConvertStateChangeStructureWorker@12
0x4B2F2100: "__stdcall NtUnsubscribeWnfStateChange" _NtUnsubscribeWnfStateChange@4
0x4B2F21F0: "__stdcall ZwWow64CsrCaptureMessageBuffer" _ZwWow64CsrCaptureMessageBuffer@16
0x4B298C9C: "__cdecl RtlpRestrictedMapping" _RtlpRestrictedMapping
0x4B2D9CAA: "__stdcall TraceLoggingRegisterEx" _TraceLoggingRegisterEx@12
0x4B380D80: "__stdcall TpSetDefaultPoolMaxThreads" _TpSetDefaultPoolMaxThreads@4
0x4B2F1730: "__stdcall ZwOpenTimer" _ZwOpenTimer@12
0x4B32CE50: "__stdcall LdrResolveDelayLoadsFromDll" _LdrResolveDelayLoadsFromDll@12
0x4B2FC9B5: "__cdecl _flswbuf" __flswbuf
0x4B2FCBC0: "__cdecl _ultoa_s" __ultoa_s
0x4B39FDE0: "__cdecl AlternateResourceModules" _AlternateResourceModules
0x4B2D6C0A: "__stdcall RtlpFreeUserBlockToHeap" _RtlpFreeUserBlockToHeap@12
0x4B2880E0: "SafeDllSearchMode" ??_C@_1CE@PJKAPEDB@?$AAS?$AAa?$AAf?$AAe?$AAD?$AAl?$AAl?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x4B3A1500: "__cdecl SHATrnsfrm" _SHATrnsfrm
0x4B2A476C: "MachineUILock" ??_C@_1BM@EEIHICMO@?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AAU?$AAI?$AAL?$AAo?$AAc?$AAk?$AA?$AA@
0x4B2E7D10: "__stdcall RtlSubAuthoritySid" _RtlSubAuthoritySid@8
0x4B39E78C: "__cdecl LdrpUserDllDirectories" _LdrpUserDllDirectories
0x4B361B29: "__stdcall NormBuffer__ReplaceLastStartBase" _NormBuffer__ReplaceLastStartBase@16
0x4B377D34: "__stdcall RtlpHpSegAlloc" _RtlpHpSegAlloc@20
0x4B2E9B30: "__stdcall RtlGetControlSecurityDescriptor" _RtlGetControlSecurityDescriptor@12
0x4B2A5EA4: "__cdecl LoadMUIDllGuid" _LoadMUIDllGuid
0x4B2BCDD0: "__stdcall LdrRscIsTypeExist" _LdrRscIsTypeExist@16
0x4B37291A: "__stdcall RtlpLogHeapFailure" _RtlpLogHeapFailure@24
0x4B2DF210: "__stdcall RtlImageDirectoryEntryToData" _RtlImageDirectoryEntryToData@16
0x4B365E7D: "__stdcall RtlpMuiRegLangInfoMatchesSpec" _RtlpMuiRegLangInfoMatchesSpec@16
0x4B2F1240: "__stdcall ZwEnumerateSystemEnvironmentValuesEx" _ZwEnumerateSystemEnvironmentValuesEx@12
0x4B34ADC0: "__stdcall RtlDowncaseUnicodeChar" _RtlDowncaseUnicodeChar@4
0x4B377513: "__stdcall RtlpHpVaMgrCtxFree" _RtlpHpVaMgrCtxFree@12
0x4B2858BC: "VS_VERSION_INFO" ??_C@_1CA@FOECMPGO@?$AAV?$AAS?$AA_?$AAV?$AAE?$AAR?$AAS?$AAI?$AAO?$AAN?$AA_?$AAI?$AAN?$AAF?$AAO?$AA?$AA@
0x4B2F1FD0: "__stdcall NtSubscribeWnfStateChange" _NtSubscribeWnfStateChange@16
0x4B288550: "ProgramW6432" ??_C@_1BK@IEDNHAFM@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAW?$AA6?$AA4?$AA3?$AA2?$AA?$AA@
0x4B3439E0: "__stdcall RtlEqualLuid" _RtlEqualLuid@8
0x4B2F0C80: "__stdcall ZwAlpcDeletePortSection" _ZwAlpcDeletePortSection@12
0x4B2B7590: "__stdcall RtlAppendUnicodeStringToString" _RtlAppendUnicodeStringToString@8
0x4B2F4480: "__cdecl _ftol2_sse" __ftol2_sse
0x4B372591: "__stdcall RtlpLfhBlockBitmapAllocate" _RtlpLfhBlockBitmapAllocate@20
0x4B2F3B50: "__cdecl __toascii" ___toascii
0x4B2F2170: "__stdcall ZwWaitHighEventPair" _ZwWaitHighEventPair@4
0x4B2AC400: "__stdcall LdrGetProcedureAddressEx" _LdrGetProcedureAddressEx@20
0x4B3A1260: "__cdecl RtlpEnvironLookupTable" _RtlpEnvironLookupTable
0x4B39FE00: "__cdecl RtlpSlistLockedAltLocks" _RtlpSlistLockedAltLocks
0x4B2BFB20: "__stdcall RtlInterlockedPopEntrySList" _RtlInterlockedPopEntrySList@4
0x4B2F10C0: "__stdcall ZwCreateTransactionManager" _ZwCreateTransactionManager@24
0x4B3642B0: "__cdecl RtlpCompareProtectedPolicyEntry" _RtlpCompareProtectedPolicyEntry
0x4B2B6230: "__stdcall LdrpCheckKnownDllFullPath" _LdrpCheckKnownDllFullPath@8
0x4B372C86: "__stdcall RtlpHpAllocateHeapInternal" _RtlpHpAllocateHeapInternal@20
0x4B2B057D: "__stdcall RtlpInheritAcl" _RtlpInheritAcl@68
0x4B36DB29: "__stdcall RtlpLocalInfoAllocFromCache" _RtlpLocalInfoAllocFromCache@8
0x4B2F1610: "__stdcall NtOpenEventPair" _NtOpenEventPair@12
0x4B39FD84: "__cdecl NlsOemToUnicodeData" _NlsOemToUnicodeData
0x4B2D8287: "__stdcall RtlpAddWnfUserSubToNameSub" _RtlpAddWnfUserSubToNameSub@8
0x4B2F1250: "__stdcall ZwEnumerateTransactionObject" _ZwEnumerateTransactionObject@20
0x4B34E329: "__stdcall RtlpRecordBootStatusData" _RtlpRecordBootStatusData@16
0x4B2F7E46: "__cdecl _tan_default" __tan_default
0x4B2DE1A0: "__stdcall TpCancelAsyncIoOperation" _TpCancelAsyncIoOperation@4
0x4B2AABA7: "__stdcall LdrpLogLoadFailureEtwEvent" _LdrpLogLoadFailureEtwEvent@20
0x4B2F07D0: "__stdcall NtOpenFile" _NtOpenFile@24
0x4B3A174C: "__cdecl EtwpPrivSessionLock" _EtwpPrivSessionLock
0x4B304510: "__stdcall NtdllSwitchWindowProc_W" _NtdllSwitchWindowProc_W@0
0x4B3704D0: "__stdcall RtlCompressBufferXpressLz" _RtlCompressBufferXpressLz@32
0x4B2A8E60: "__stdcall RtlProtectHeap" _RtlProtectHeap@8
0x4B3589C0: "__stdcall RtlLocateExtendedFeature2" _RtlLocateExtendedFeature2@16
0x4B34DCC0: "__stdcall RtlCreateBootStatusDataFile" _RtlCreateBootStatusDataFile@4
0x4B281264: "__cdecl TppSimplepCleanupGroupMemberVFuncs" _TppSimplepCleanupGroupMemberVFuncs
0x4B2A7207: "__stdcall RtlpFreeAllAtom" _RtlpFreeAllAtom@8
0x4B34AEA0: "__stdcall RtlFreeOemString" _RtlFreeOemString@4
0x4B2D9BEA: "__stdcall EtwpProcessNotification" _EtwpProcessNotification@20
0x4B2A3B68: "::ffff:0:%u.%u.%u.%u" ??_C@_1CK@LFMCBOGA@?$AA?3?$AA?3?$AAf?$AAf?$AAf?$AAf?$AA?3?$AA0?$AA?3?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?$AA@
0x4B2F1070: "__stdcall ZwCreateTimer" _ZwCreateTimer@16
0x4B2940D0: "DisableHeapLookaside" ??_C@_1CK@CEGAPBHI@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAH?$AAe?$AAa?$AAp?$AAL?$AAo?$AAo?$AAk?$AAa?$AAs?$AAi?$AAd?$AAe?$AA?$AA@
0x4B3044E0: "__stdcall NtdllMessageWindowProc_A" _NtdllMessageWindowProc_A@0
0x4B2CDFB7: "__stdcall TppPHExtractMin" _TppPHExtractMin@4
0x4B37CE60: "__stdcall EtwEventWriteEndScenario" _EtwEventWriteEndScenario@20
0x4B32F3A4: "__stdcall LdrpInitializeApplicationVerifierPackage" _LdrpInitializeApplicationVerifierPackage@24
0x4B3487C0: "__stdcall RtlAddScopedPolicyIDAce" _RtlAddScopedPolicyIDAce@20
0x4B335AD0: "__stdcall RtlStringCchCopyNExW" _RtlStringCchCopyNExW@28
0x4B2F8870: "__cdecl _nosnan2" __nosnan2
0x4B2F5F70: "__cdecl _floor_pentium4" __floor_pentium4
0x4B338F93: "__stdcall WerEscalationLazyInit" _WerEscalationLazyInit@0
0x4B39E924: "__cdecl PossibleDeadlockReportThreshold" _PossibleDeadlockReportThreshold
0x4B2ADBF8: "__stdcall RtlpMuiRegGetOrAddString" _RtlpMuiRegGetOrAddString@16
0x4B3044F0: "__stdcall NtdllMessageWindowProc_W" _NtdllMessageWindowProc_W@0
0x4B2D5950: "__fastcall RtlpSubSegmentInitialize" @RtlpSubSegmentInitialize@24
0x4B3A0920: "__cdecl LdrpKnownDllDirectoryHandle" _LdrpKnownDllDirectoryHandle
0x4B2A5760: "Just reallocated block at %p to " ??_C@_0CL@IGFDCMGE@Just?5reallocated?5block?5at?5?$CFp?5to?5@
0x4B39E810: "__cdecl _fltused" __fltused
0x4B35B25E: "__stdcall RtlpSysVolCheckOwnerAndSecurity" _RtlpSysVolCheckOwnerAndSecurity@8
0x4B3337A0: "__stdcall RtlDefaultNpAcl" _RtlDefaultNpAcl@4
0x4B2F06D0: "__stdcall NtQueryVirtualMemory" _NtQueryVirtualMemory@24
0x4B285AA8: "secserv.dll" ??_C@_0M@HJDEHGFC@secserv?4dll?$AA@
0x4B285D58: "TimeZoneInformation" ??_C@_1CI@GMLPCOJB@?$AAT?$AAi?$AAm?$AAe?$AAZ?$AAo?$AAn?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B2E3499: "__stdcall RtlpGetExtraStuffPointer" _RtlpGetExtraStuffPointer@4
0x4B32B340: "__stdcall DbgUiIssueRemoteBreakin" _DbgUiIssueRemoteBreakin@4
0x4B2EA916: "__stdcall UpcaseUnicodeToSingleByteNHelper" _UpcaseUnicodeToSingleByteNHelper@28
0x4B292389: "__cdecl _TraceLoggingMetadataEnd" __TraceLoggingMetadataEnd
0x4B2E8550: "__stdcall RtlIsProcessorFeaturePresent" _RtlIsProcessorFeaturePresent@4
0x4B2DC660: "__stdcall TppAlpcpFree" _TppAlpcpFree@4
0x4B39F948: "__cdecl RtlpHypervisorSharedUserVa" _RtlpHypervisorSharedUserVa
0x4B294724: "LdrpInitializeNode" ??_C@_0BD@PNOCAGJO@LdrpInitializeNode?$AA@
0x4B295764: "AVRF: provider %ws passed an inv" ??_C@_0DH@BHMCPING@AVRF?3?5provider?5?$CFws?5passed?5an?5inv@
0x4B298BE0: "LdrpResSearchResourceHandle Ente" ??_C@_1EE@MNODNGBA@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAH?$AAa?$AAn?$AAd?$AAl?$AAe?$AA?5?$AAE?$AAn?$AAt?$AAe@
0x4B2F5490: "__cdecl _wcslwr" __wcslwr
0x4B2EFC8F: "__stdcall EtwpGetUmProcessImageInfo" _EtwpGetUmProcessImageInfo@8
0x4B37A0D1: "__stdcall RtlpHpSegSegmentInitialize" _RtlpHpSegSegmentInitialize@12
0x4B294FD0: "Notebook" ??_C@_1BC@GIBDEHH@?$AAN?$AAo?$AAt?$AAe?$AAb?$AAo?$AAo?$AAk?$AA?$AA@
0x4B3A1764: "__cdecl LdrDelegatedRtlDispatchAPC" _LdrDelegatedRtlDispatchAPC
0x4B2F0C60: "__stdcall ZwAlpcCreateSectionView" _ZwAlpcCreateSectionView@12
0x4B32F15D: "__stdcall LdrpForkProcess" _LdrpForkProcess@0
0x4B2F1660: "__stdcall NtOpenKeyTransactedEx" _NtOpenKeyTransactedEx@20
0x4B3A0BC8: "__cdecl LdrpSystem32" _LdrpSystem32
0x4B361948: "__stdcall NormBuffer__IsBlocked" _NormBuffer__IsBlocked@8
0x4B3053E0: "__stdcall RtlCaptureStackContext" _RtlCaptureStackContext@12
0x4B2AC7C7: "__stdcall LdrpCorProcessImports" _LdrpCorProcessImports@4
0x4B2EBC15: "__stdcall LdrpIsImageArmadilloProtected" _LdrpIsImageArmadilloProtected@4
0x4B39E8AC: "__cdecl RtlpProcessECVPolicy" _RtlpProcessECVPolicy
0x4B2B541E: "__stdcall IsLanguageOverlayBlockedByPolicy" _IsLanguageOverlayBlockedByPolicy@0
0x4B2F0450: "__stdcall LdrxCallInitRoutine" _LdrxCallInitRoutine@16
0x4B2B5A24: "__stdcall RtlpComputeLangListCheckSum" _RtlpComputeLangListCheckSum@4
0x4B296F40: "RtlFindActivationContextSectionS" ??_C@_0GI@PNODLECP@RtlFindActivationContextSectionS@
0x4B32E6D8: "__cdecl _TlgDefineProvider_annotation__TlgRtlpCapChkTraceLoggingProviderProv" __TlgDefineProvider_annotation__TlgRtlpCapChkTraceLoggingProviderProv
0x4B2F5111: "__cdecl _vsprintf_l" __vsprintf_l
0x4B3833A0: "__stdcall PssNtCaptureSnapshot" _PssNtCaptureSnapshot@16
0x4B339D04: "__stdcall RtlpWnfETWEventSubscribe" _RtlpWnfETWEventSubscribe@28
0x4B2F1BF0: "__stdcall ZwRevertContainerImpersonation" _ZwRevertContainerImpersonation@0
0x4B2BD3B7: "__stdcall LdrpCallInitRoutine" _LdrpCallInitRoutine@16
0x4B298110: "SXS: Assembly directory name sto" ??_C@_0HC@NOEIDEDC@SXS?3?5Assembly?5directory?5name?5sto@
0x4B2F0E30: "__stdcall ZwCompareObjects" _ZwCompareObjects@8
0x4B2E9F98: "__stdcall LdrpReleaseTlsEntry" _LdrpReleaseTlsEntry@8
0x4B2F1840: "__stdcall NtQueryDebugFilterState" _NtQueryDebugFilterState@8
0x4B2F15B0: "__stdcall NtNotifyChangeDirectoryFile" _NtNotifyChangeDirectoryFile@36
0x4B2EE8C3: "__stdcall EtwpGetCpuSpeedFromRegistry" _EtwpGetCpuSpeedFromRegistry@4
0x4B28C390: "DOCUMENTSLIBRARY" ??_C@_1CC@NKOFCMFO@?$AAD?$AAO?$AAC?$AAU?$AAM?$AAE?$AAN?$AAT?$AAS?$AAL?$AAI?$AAB?$AAR?$AAA?$AAR?$AAY?$AA?$AA@
0x4B2F0670: "__stdcall ZwCreateKey" _ZwCreateKey@28
0x4B330BBD: "__stdcall LdrpPayloadRestrictionMitigationsEnabled" _LdrpPayloadRestrictionMitigationsEnabled@0
0x4B3677A0: "__stdcall RtlpNtQueryValueKey" _RtlpNtQueryValueKey@20
0x4B37187B: "__stdcall XpressBuildHuffmanDecodingTable" _XpressBuildHuffmanDecodingTable@8
0x4B358310: "__stdcall RtlWeaklyEnumerateEntryHashTable" _RtlWeaklyEnumerateEntryHashTable@8
0x4B2A5534: "May not specify Lock parameter w" ??_C@_0DH@GBJBLKHF@May?5not?5specify?5Lock?5parameter?5w@
0x4B2D17F0: "__stdcall LdrRemoveLoadAsDataTable" _LdrRemoveLoadAsDataTable@16
0x4B2ABA40: "__stdcall RtlpGetLCIDFromLangInfoNode" _RtlpGetLCIDFromLangInfoNode@12
0x4B2FDED0: "__cdecl swprintf_s" _swprintf_s
0x4B2F7DF0: "__cdecl strtoul" _strtoul
0x4B2B19D0: "__stdcall RtlSetOwnerSecurityDescriptor" _RtlSetOwnerSecurityDescriptor@12
0x4B297F38: "SXS: %s() bad parameters SXS: M" ??_C@_0BBA@EGKDJPEG@SXS?3?5?$CFs?$CI?$CJ?5bad?5parameters?6SXS?3?5?5M@
0x4B2C1A30: "__stdcall RtlpDosPathNameToRelativeNtPathName" _RtlpDosPathNameToRelativeNtPathName@28
0x4B284CF4: "%u.%u.%u.%u" ??_C@_1BI@IEJCOLMP@?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?$AA@
0x4B3557AD: "__stdcall RtlpHpOverrideGCInterval" _RtlpHpOverrideGCInterval@4
0x4B366A3A: "__stdcall _RtlpMuiRegInitLIPLanguage" __RtlpMuiRegInitLIPLanguage@12
0x4B333390: "__stdcall RtlConvertToAutoInheritSecurityObject" _RtlConvertToAutoInheritSecurityObject@24
0x4B2F0480: "__stdcall NtAccessCheck" _NtAccessCheck@32
0x4B35919F: "__stdcall RtlpCopyXStateChunk" _RtlpCopyXStateChunk@20
0x4B2A94EE: "__stdcall RtlpLocateModuleSectionInLockedSectionList" _RtlpLocateModuleSectionInLockedSectionList@4
0x4B285504: "S-1-" ??_C@_19LBFLHOKO@?$AAS?$AA?9?$AA1?$AA?9?$AA?$AA@
0x4B39F720: "__cdecl RtlpStkDllRanges" _RtlpStkDllRanges
0x4B381F56: "__stdcall TppETWTimerExpirationEnd" _TppETWTimerExpirationEnd@4
0x4B2F3BD0: "__cdecl iscntrl" _iscntrl
0x4B360CF7: "__stdcall RtlIsAnyDebuggerPresent" _RtlIsAnyDebuggerPresent@0
0x4B2F1530: "__stdcall NtMakeTemporaryObject" _NtMakeTemporaryObject@4
0x4B37A69B: "__stdcall RtlCSparseBitmapBitsClear" _RtlCSparseBitmapBitsClear@12
0x4B2D0B02: "__stdcall TppPHInsert" _TppPHInsert@8
0x4B2F20D0: "__stdcall ZwUnlockFile" _ZwUnlockFile@20
0x4B281140: "__cdecl SbSupportedOsList" _SbSupportedOsList
0x4B33C770: "__stdcall LdrEnumResources" _LdrEnumResources@20
0x4B2F12E0: "__stdcall ZwFlushProcessWriteBuffers" _ZwFlushProcessWriteBuffers@0
0x4B2F1270: "__stdcall NtFilterBootOption" _NtFilterBootOption@20
0x4B2EAF90: "__stdcall RtlAddAccessAllowedAceEx" _RtlAddAccessAllowedAceEx@20
0x4B331A42: "__stdcall LdrpUnsuppressAddressTakenIat" _LdrpUnsuppressAddressTakenIat@12
0x4B304E60: "__fastcall RtlInterlockedCompareExchange64" @RtlInterlockedCompareExchange64@12
0x4B2857D4: "SE_LdrEntryRemoved" ??_C@_0BD@KBMMGEKH@SE_LdrEntryRemoved?$AA@
0x4B2F7E20: "__cdecl tan" _tan
0x4B39E368: "__cdecl LdrpLoaderLock" _LdrpLoaderLock
0x4B348A28: "__stdcall RtlpAddKnownObjectAce" _RtlpAddKnownObjectAce@32
0x4B337A20: "__stdcall RtlWow64IsWowGuestMachineSupported" _RtlWow64IsWowGuestMachineSupported@8
0x4B2E8DC0: "__stdcall RtlGetOwnerSecurityDescriptor" _RtlGetOwnerSecurityDescriptor@12
0x4B3A1508: "__cdecl TppHeapTag" _TppHeapTag
0x4B2A9C25: "__stdcall RtlpFreeTraverseNodes" _RtlpFreeTraverseNodes@4
0x4B2F0F40: "__stdcall NtCreateKeyTransacted" _NtCreateKeyTransacted@32
0x4B39F0E0: "__cdecl RtlpHeapInvalidBadAddress" _RtlpHeapInvalidBadAddress
0x4B388020: "__stdcall RtlpStackDbStackComparitor" _RtlpStackDbStackComparitor@8
0x4B37AC22: "__stdcall RtlSparseArrayElementFindCapped" _RtlSparseArrayElementFindCapped@12
0x4B37E179: "__stdcall EtwpGetProcessorStreamsCount" _EtwpGetProcessorStreamsCount@16
0x4B2DC8D0: "__stdcall TpWaitForTimer" _TpWaitForTimer@8
0x4B2F7F20: "__cdecl toupper" _toupper
0x4B381958: "__stdcall TppRaiseInvalidParameter" _TppRaiseInvalidParameter@0
0x4B3763E0: "__stdcall RtlpHpLfhSubsegmentSizeBlockInternal" _RtlpHpLfhSubsegmentSizeBlockInternal@16
0x4B284DB8: "Kernel-MUI-Language-SKU" ??_C@_1DA@HOOFFHMM@?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AA?9?$AAM?$AAU?$AAI?$AA?9?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AA?9?$AAS?$AAK?$AAU?$AA?$AA@
0x4B2F07B0: "__stdcall NtQueryPerformanceCounter" _NtQueryPerformanceCounter@8
0x4B2A3E6C: "__cdecl M_strAceEmailPrefix" _M_strAceEmailPrefix
0x4B3A14D8: "__cdecl RtlpLockedMemoryZoneCount" _RtlpLockedMemoryZoneCount
0x4B2E2B70: "__stdcall RtlSetThreadPreferredUILanguages" _RtlSetThreadPreferredUILanguages@12
0x4B2D6580: "__fastcall RtlpInterlockedPopEntrySList" @RtlpInterlockedPopEntrySList@4
0x4B368AE0: "__stdcall RtlpHpStackTraceHeapSerialize" _RtlpHpStackTraceHeapSerialize@8
0x4B294D68: "Windows.Universal" ??_C@_1CE@DLJEHEL@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAU?$AAn?$AAi?$AAv?$AAe?$AAr?$AAs?$AAa?$AAl?$AA?$AA@
0x4B3A0C08: "__cdecl FlsBitMap" _FlsBitMap
0x4B337B40: "__stdcall RtlEncodeRemotePointer" _RtlEncodeRemotePointer@12
0x4B332290: "__stdcall RtlUnlockMemoryStreamRegion" _RtlUnlockMemoryStreamRegion@24
0x4B2CBFA0: "__stdcall RtlLcidToLocaleName" _RtlLcidToLocaleName@16
0x4B3618AF: "__stdcall NormBuffer__Insert" _NormBuffer__Insert@12
0x4B3403F0: "__stdcall LdrResRelease" _LdrResRelease@12
0x4B293028: "stxt371" ??_C@_07EOOBCIJG@stxt371?$AA@
0x4B2E05E6: "__stdcall ElapsedDaysToYears" _ElapsedDaysToYears@4
0x4B2CFB10: "__stdcall RtlQueryEnvironmentVariable" _RtlQueryEnvironmentVariable@24
0x4B33C530: "__stdcall AlpcRegisterCompletionListWorkerThread" _AlpcRegisterCompletionListWorkerThread@4
0x4B2DE7E4: "__stdcall CountUTF8ToUnicode" _CountUTF8ToUnicode@12
0x4B286910: "(null)" ??_C@_1O@CEDCILHN@?$AA?$CI?$AAn?$AAu?$AAl?$AAl?$AA?$CJ?$AA?$AA@
0x4B2B17EE: "__stdcall RtlpGetDefaultTrustSubjectContext" _RtlpGetDefaultTrustSubjectContext@8
0x4B2A5B00: "Number of free blocks in arena (" ??_C@_0FE@NGCGCHAC@Number?5of?5free?5blocks?5in?5arena?5?$CI@
0x4B2F1E60: "__stdcall ZwSetLdtEntries" _ZwSetLdtEntries@24
0x4B2EA153: "__stdcall TppPoolRemoveWorker" _TppPoolRemoveWorker@4
0x4B286810: "_cabs" ??_C@_05KBKMEMPO@_cabs?$AA@
0x4B299DE4: "GlobalTags" ??_C@_1BG@FHGJKDOD@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AAT?$AAa?$AAg?$AAs?$AA?$AA@
0x4B3379C0: "__stdcall RtlWow64GetSharedInfoProcess" _RtlWow64GetSharedInfoProcess@12
0x4B39E8E0: "struct _SWITCHBRANCH_CACHED_MODULE_TABLE g_SbCachedModuleTable_RTL" ?g_SbCachedModuleTable_RTL@@3U_SWITCHBRANCH_CACHED_MODULE_TABLE@@A
0x4B2D48A7: "__stdcall SbpRetrieveCompatibilityManifest" _SbpRetrieveCompatibilityManifest@12
0x4B2DA140: "__stdcall EtwUnregisterTraceGuids" _EtwUnregisterTraceGuids@8
0x4B2F0B70: "__stdcall NtAlertResumeThread" _NtAlertResumeThread@8
0x4B2D93A5: "__stdcall LdrpCreateLoaderEvents" _LdrpCreateLoaderEvents@0
0x4B2D3540: "__stdcall RtlQueryActivationContextApplicationSettings" _RtlQueryActivationContextApplicationSettings@28
0x4B2F0350: "__stdcall RtlxAnsiStringToUnicodeSize" _RtlxAnsiStringToUnicodeSize@4
0x4B2CA523: "__stdcall LdrpInitializeNode" _LdrpInitializeNode@4
0x4B2F2180: "__stdcall NtWaitLowEventPair" _NtWaitLowEventPair@4
0x4B2A7265: "__stdcall RtlpFreeHandleForAtom" _RtlpFreeHandleForAtom@8
0x4B2F1DF0: "__stdcall ZwSetInformationTransaction" _ZwSetInformationTransaction@16
0x4B2E6392: "__cdecl RtlStringCchPrintfExW" _RtlStringCchPrintfExW
0x4B304600: "__stdcall NtdllStaticWndProc_A" _NtdllStaticWndProc_A@0
0x4B3045D0: "__stdcall NtdllListBoxWndProc_W" _NtdllListBoxWndProc_W@0
0x4B32E6DB: "__stdcall LdrpFindLoadedDllByAddress" _LdrpFindLoadedDllByAddress@12
0x4B294C18: "Lazy DLL search path computation" ??_C@_0DP@PDJEDKDO@Lazy?5DLL?5search?5path?5computation@
0x4B3A1498: "__cdecl LdrpUnloadIndex" _LdrpUnloadIndex
0x4B2E59F0: "__stdcall RtlpQuerySecurityDescriptor" _RtlpQuerySecurityDescriptor@36
0x4B2F1E10: "__stdcall NtSetInformationVirtualMemory" _NtSetInformationVirtualMemory@24
0x4B2A9170: "__stdcall RtlLockModuleSection" _RtlLockModuleSection@4
0x4B2E2278: "__stdcall RtlDoesFileExists_UEx" _RtlDoesFileExists_UEx@8
0x4B3411C3: "__stdcall LdrpResValidateFilePath" _LdrpResValidateFilePath@4
0x4B2F0530: "__stdcall NtReplyWaitReceivePort" _NtReplyWaitReceivePort@16
0x4B33BAF0: "__stdcall ImportTablepHashCanonicalLists" _ImportTablepHashCanonicalLists@8
0x4B2FCE90: "__cdecl _ui64tow_s" __ui64tow_s
0x4B2F06B0: "__stdcall ZwQueryInformationToken" _ZwQueryInformationToken@20
0x4B39D0A0: "__stdcall RtlAllocateMemoryZone" _RtlAllocateMemoryZone@12
0x4B2E2858: "__stdcall EtwpCreateRegGuidsContext" _EtwpCreateRegGuidsContext@20
0x4B360D80: "__stdcall RtlIsNonEmptyDirectoryReparsePointAllowed" _RtlIsNonEmptyDirectoryReparsePointAllowed@4
0x4B2E1020: "__stdcall RtlInitAnsiStringEx" _RtlInitAnsiStringEx@8
0x4B304610: "__stdcall NtdllStaticWndProc_W" _NtdllStaticWndProc_W@0
0x4B2F10E0: "__stdcall ZwCreateWaitCompletionPacket" _ZwCreateWaitCompletionPacket@12
0x4B2F2240: "__stdcall NtWow64GetCurrentProcessorNumberEx" _NtWow64GetCurrentProcessorNumberEx@4
0x4B348190: "__stdcall RtlAddAuditAccessObjectAce" _RtlAddAuditAccessObjectAce@36
0x4B2F14F0: "__stdcall ZwLockProductActivationKeys" _ZwLockProductActivationKeys@8
0x4B32CD10: "__stdcall RtlGetUnloadEventTraceEx" _RtlGetUnloadEventTraceEx@12
0x4B34E760: "__stdcall RtlSetTimeZoneInformation" _RtlSetTimeZoneInformation@4
0x4B2AE39D: "__stdcall RtlpMuiRegLoadPreferredUILanguages" _RtlpMuiRegLoadPreferredUILanguages@24
0x4B2FCB90: "__cdecl _ui64toa_s" __ui64toa_s
0x4B2F0B00: "__stdcall ZwAccessCheckByTypeResultListAndAuditAlarmByHandle" _ZwAccessCheckByTypeResultListAndAuditAlarmByHandle@68
0x4B2E7C10: "__stdcall AlpcGetHeaderSize" _AlpcGetHeaderSize@4
0x4B354930: "__stdcall RtlWalkHeap" _RtlWalkHeap@8
0x4B338B20: "__stdcall WerpThreadId" _WerpThreadId@4
0x4B374956: "__stdcall RtlpHpLfhBucketGetSubsegment" _RtlpHpLfhBucketGetSubsegment@8
0x4B2A4AB8: "QueryDebugInformation request" ??_C@_1DM@IGILJILI@?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAD?$AAe?$AAb?$AAu?$AAg?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAr?$AAe?$AAq?$AAu?$AAe?$AAs?$AAt?$AA?$AA@
0x4B39E3A0: "__cdecl LdrpDllNotificationList" _LdrpDllNotificationList
0x4B357E20: "__stdcall RtlEndWeakEnumerationHashTable" _RtlEndWeakEnumerationHashTable@8
0x4B2E04E5: "__stdcall RtlpTimeToTimeFieldsNoLeapSeconds" _RtlpTimeToTimeFieldsNoLeapSeconds@8
0x4B2A4138: " *** Inpage error in %ws:%s " ??_C@_0CA@MDOGOMPE@?6?6?5?$CK?$CK?$CK?5Inpage?5error?5in?5?$CFws?3?$CFs?6?6?$AA@
0x4B3806E0: "__stdcall TpAllocJobNotification" _TpAllocJobNotification@20
0x4B38540A: "__stdcall PsspCaptureThreadInformation" _PsspCaptureThreadInformation@16
0x4B361A10: "__stdcall NormBuffer__RecheckStartCombinations" _NormBuffer__RecheckStartCombinations@4
0x4B301290: "__stdcall SHATransform" _SHATransform@8
0x4B2F0AF0: "__stdcall NtAccessCheckByTypeResultListAndAuditAlarm" _NtAccessCheckByTypeResultListAndAuditAlarm@64
0x4B37C600: "__stdcall EtwEventWriteString" _EtwEventWriteString@24
0x4B286E2C: " " ??_C@_01EEMJAFIK@?6?$AA@
0x4B2852E8: "RtlpResUltimateFallbackInfo Exit" ??_C@_1EC@PPAOAPLC@?$AAR?$AAt?$AAl?$AAp?$AAR?$AAe?$AAs?$AAU?$AAl?$AAt?$AAi?$AAm?$AAa?$AAt?$AAe?$AAF?$AAa?$AAl?$AAl?$AAb?$AAa?$AAc?$AAk?$AAI?$AAn?$AAf?$AAo?$AA?5?$AAE?$AAx?$AAi?$AAt@
0x4B2F91C0: "__cdecl _global_unwind2" __global_unwind2
0x4B2811D4: "__cdecl TppTimerpTaskVFuncs" _TppTimerpTaskVFuncs
0x4B2F1F80: "__stdcall NtShutdownWorkerFactory" _NtShutdownWorkerFactory@8
0x4B3728DC: "__stdcall RtlpHeapExceptionFilter" _RtlpHeapExceptionFilter@8
0x4B360480: "__stdcall RtlSleepConditionVariableCS" _RtlSleepConditionVariableCS@12
0x4B3A1814: "__cdecl SecurityCookieInitCount" _SecurityCookieInitCount
0x4B3A423C: "__cdecl RtlpProtectedPolicies" _RtlpProtectedPolicies
0x4B2A3AF8: ":" ??_C@_01JLIPDDHJ@?3?$AA@
0x4B2949D4: "LdrpHandleTlsData" ??_C@_0BC@CMBIMFCN@LdrpHandleTlsData?$AA@
0x4B2A38F4: "System Volume Information" ??_C@_1DE@LIBHJBEH@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?5?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B36C0FC: "__stdcall RtlDebugSetUserValueHeap" _RtlDebugSetUserValueHeap@16
0x4B2F1B90: "__stdcall NtReplyWaitReplyPort" _NtReplyWaitReplyPort@8
0x4B2D8F25: "__fastcall RtlpExtendListLookup" @RtlpExtendListLookup@12
0x4B3045F0: "__stdcall NtdllMDIClientWndProc_W" _NtdllMDIClientWndProc_W@0
0x4B2FB2FB: "__cdecl _handle_exc" __handle_exc
0x4B2F74F6: "__cdecl __from_strstr_to_strchr" ___from_strstr_to_strchr
0x4B299398: "SysARM32" ??_C@_1BC@OCMNFAO@?$AAS?$AAy?$AAs?$AAA?$AAR?$AAM?$AA3?$AA2?$AA?$AA@
0x4B342EC0: "__stdcall RtlApplyRXact" _RtlApplyRXact@4
0x4B33C680: "__cdecl DbgPrintReturnControlC" _DbgPrintReturnControlC
0x4B360C70: "__stdcall RtlQueryProcessPlaceholderCompatibilityMode" _RtlQueryProcessPlaceholderCompatibilityMode@0
0x4B2D1925: "__stdcall LdrpGetLoadAsEntry" _LdrpGetLoadAsEntry@8
0x4B2F2000: "__stdcall NtSystemDebugControl" _NtSystemDebugControl@24
0x4B303F37: "__stdcall RtlpHpLargeLockAcquireShared" _RtlpHpLargeLockAcquireShared@8
0x4B34A830: "__stdcall RtlResetMemoryBlockLookaside" _RtlResetMemoryBlockLookaside@4
0x4B2F2070: "__stdcall NtTranslateFilePath" _NtTranslateFilePath@16
0x4B3388B6: "__stdcall WerpFreeSid" _WerpFreeSid@8
0x4B37C24C: "__stdcall RtlpCSparseBitmapUnlock" _RtlpCSparseBitmapUnlock@4
0x4B33805C: "__stdcall RtlReportExceptionHelper" _RtlReportExceptionHelper@16
0x4B2E164A: "__stdcall RtlGetAssemblyStorageRoot" _RtlGetAssemblyStorageRoot@24
0x4B330BA8: "__stdcall LdrpOverrideExportSuppression" _LdrpOverrideExportSuppression@0
0x4B2F04B0: "__stdcall ZwMapUserPhysicalPagesScatter" _ZwMapUserPhysicalPagesScatter@12
0x4B299DA4: "Unable to release memory at %p f" ??_C@_0DN@IPLNIIDL@Unable?5to?5release?5memory?5at?5?$CFp?5f@
0x4B2F5560: "__cdecl _wcsnicmp" __wcsnicmp
0x4B372D78: "__stdcall RtlpHpCheckAllocationSizeLimit" _RtlpHpCheckAllocationSizeLimit@12
0x4B34D5F0: "__stdcall RtlBarrier" _RtlBarrier@8
0x4B292924: "minkernel\ntdll\ldrapi.c" ??_C@_0BJ@IBPGLFND@minkernel?2ntdll?2ldrapi?4c?$AA@
0x4B285020: "LdrpResGetResourceDirectory Exit" ??_C@_1EC@EEAGLMFE@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAG?$AAe?$AAt?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AA?5?$AAE?$AAx?$AAi?$AAt@
0x4B2F1810: "__stdcall NtQueryAuxiliaryCounterFrequency" _NtQueryAuxiliaryCounterFrequency@4
0x4B298780: "SXS: %s() bad parameters Assembl" ??_C@_0FP@HCNMCLFE@SXS?3?5?$CFs?$CI?$CJ?5bad?5parameters?5Assembl@
0x4B2982D0: "SXS: Unable to resolve storage r" ??_C@_0EN@LOBAANOH@SXS?3?5Unable?5to?5resolve?5storage?5r@
0x4B2BD9D0: "__stdcall EtwNotificationRegister" _EtwNotificationRegister@20
0x4B37CC95: "__stdcall EtwpDereferenceUmGuidEntry" _EtwpDereferenceUmGuidEntry@4
0x4B2F0B90: "__stdcall ZwAlertThreadByThreadId" _ZwAlertThreadByThreadId@4
0x4B2943B8: "Initializing the application ver" ??_C@_0EK@PGMPGCEN@Initializing?5the?5application?5ver@
0x4B39E3E8: "__cdecl TppPoolpList" _TppPoolpList
0x4B39FDA0: "__cdecl RtlpModernAppKey" _RtlpModernAppKey
0x4B336080: "__stdcall AVrfInternalHeapFreeNotification" _AVrfInternalHeapFreeNotification@8
0x4B364860: "__stdcall RtlStackTraceHashFunction" _RtlStackTraceHashFunction@8
0x4B2F1B60: "__stdcall NtRenameTransactionManager" _NtRenameTransactionManager@8
0x4B2F0AB0: "__stdcall ZwCancelTimer" _ZwCancelTimer@8
0x4B34A1A0: "__stdcall RtlDestroyAtomTable" _RtlDestroyAtomTable@4
0x4B2F1CE0: "__stdcall ZwSetContextThread" _ZwSetContextThread@8
0x4B2C92F6: "__stdcall RtlpFindAndCommitPages" _RtlpFindAndCommitPages@8
0x4B331087: "__stdcall LdrpTouchThreadStack" _LdrpTouchThreadStack@4
0x4B292718: "ExecuteOptions" ??_C@_1BO@EBDALOGH@?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAe?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x4B2FDDA0: "__cdecl strtok_s" _strtok_s
0x4B2F1970: "__stdcall NtQueryMultipleValueKey" _NtQueryMultipleValueKey@24
0x4B293058: "RtlDispatchAPC" ??_C@_0P@CLJMDHHH@RtlDispatchAPC?$AA@
0x4B286E1C: ", passed to %s" ??_C@_0P@MHFKLIEN@?0?5passed?5to?5?$CFs?$AA@
0x4B380B30: "__stdcall TppJobpFree" _TppJobpFree@4
0x4B2A906B: "__stdcall RtlpComputeBackupIndex" _RtlpComputeBackupIndex@4
0x4B2EC16D: "__stdcall RtlpRunOnceWaitForInit" _RtlpRunOnceWaitForInit@8
0x4B2F8880: "__cdecl _tosnan2" __tosnan2
0x4B2ADE90: "__stdcall RtlpMuiRegLoadRegistryInfo" _RtlpMuiRegLoadRegistryInfo@8
0x4B2F8840: "__cdecl _tosnan1" __tosnan1
0x4B28B600: "__cdecl RtlpBitsClearTotal" _RtlpBitsClearTotal
0x4B2E401A: "__stdcall RtlpMuiRegTryToAppendLanguageName" _RtlpMuiRegTryToAppendLanguageName@20
0x4B2A4788: "DefaultFallback" ??_C@_1CA@EOGMNDBN@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAF?$AAa?$AAl?$AAl?$AAb?$AAa?$AAc?$AAk?$AA?$AA@
0x4B2F1F90: "__stdcall ZwSignalAndWaitForSingleObject" _ZwSignalAndWaitForSingleObject@16
0x4B2F0BB0: "__stdcall NtAllocateReserveObject" _NtAllocateReserveObject@12
0x4B2A8E1B: "__stdcall RtlpDeleteData" _RtlpDeleteData@12
0x4B2E0B60: "__stdcall RtlTryAcquirePebLock" _RtlTryAcquirePebLock@0
0x4B2A526C: "Flags" ??_C@_05BOOEKJH@Flags?$AA@
0x4B2DF0E6: "__stdcall LdrpRelocateImage" _LdrpRelocateImage@16
0x4B34AADC: "__stdcall IN6_IS_ADDR_V4MAPPED" _IN6_IS_ADDR_V4MAPPED@4
0x4B2F18B0: "__stdcall ZwQueryInformationByName" _ZwQueryInformationByName@20
0x4B350C16: "__stdcall RtlpCompareConfigNodeWithSpec" _RtlpCompareConfigNodeWithSpec@16
0x4B3044B0: "__stdcall NtdllDesktopWndProc_W" _NtdllDesktopWndProc_W@0
0x4B384210: "__stdcall PsspCaptureIptTrace" _PsspCaptureIptTrace@8
0x4B286B94: "DLL search path passed in extern" ??_C@_0CL@KNADOGFE@DLL?5search?5path?5passed?5in?5extern@
0x4B2F0F60: "__stdcall NtCreateLowBoxToken" _NtCreateLowBoxToken@36
0x4B339448: "__stdcall WerpEscalationReadUlongFromKey" _WerpEscalationReadUlongFromKey@12
0x4B2B9640: "__stdcall LdrLoadAlternateResourceModuleEx" _LdrLoadAlternateResourceModuleEx@20
0x4B2ED61B: "__stdcall EtwpTraceUmMessage" _EtwpTraceUmMessage@24
0x4B2933E0: "Loading the shim DLL "%wZ" faile" ??_C@_0DH@JLKAGLIO@Loading?5the?5shim?5DLL?5?$CC?$CFwZ?$CC?5faile@
0x4B297160: "SXS: %s() passed string section " ??_C@_0IC@FONCJIND@SXS?3?5?$CFs?$CI?$CJ?5passed?5string?5section?5@
0x4B2847E8: "\Registry\Machine\System\Current" ??_C@_1KC@FOBDNNHK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2CAE6D: "__stdcall LdrpLoadDll" _LdrpLoadDll@16
0x4B3045A0: "__stdcall NtdllEditWndProc_A" _NtdllEditWndProc_A@0
0x4B2D6C7B: "__fastcall RtlpCreateLowFragHeap" @RtlpCreateLowFragHeap@4
0x4B2F1A20: "__stdcall ZwQuerySystemEnvironmentValue" _ZwQuerySystemEnvironmentValue@16
0x4B36AC6A: "__stdcall RtlpHpTagReAllocateHeap" _RtlpHpTagReAllocateHeap@16
0x4B296FA8: "RtlpFindUnicodeStringInSection: " ??_C@_0FJ@JIHIAEPP@RtlpFindUnicodeStringInSection?3?5@
0x4B2F1830: "__stdcall ZwQueryBootOptions" _ZwQueryBootOptions@8
0x4B295FE8: "\Registry\MACHINE\System\Current" ??_C@_1KM@DAAALKCE@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B3819AA: "__stdcall TppReportExceptionFilter" _TppReportExceptionFilter@4
0x4B3A1740: "__cdecl RtlpPerformanceCounterFrequency" _RtlpPerformanceCounterFrequency
0x4B2F1360: "__stdcall NtGetContextThread" _NtGetContextThread@8
0x4B2F0660: "__stdcall ZwSetInformationProcess" _ZwSetInformationProcess@16
0x4B360E85: "__stdcall RtlDoesNameContainWildCards" _RtlDoesNameContainWildCards@4
0x4B2A7D30: "__stdcall RtlCreateProcessParametersWithTemplate" _RtlCreateProcessParametersWithTemplate@12
0x4B297830: "SXS: %s() found activation conte" ??_C@_0EB@LBMIFKFE@SXS?3?5?$CFs?$CI?$CJ?5found?5activation?5conte@
0x4B340A6A: "__stdcall LdrpResReadFile" _LdrpResReadFile@16
0x4B2F05F0: "__stdcall ZwQueryValueKey" _ZwQueryValueKey@24
0x4B2AA980: "__stdcall RtlxOemStringToUnicodeSize" _RtlxOemStringToUnicodeSize@4
0x4B304D10: "__stdcall RtlExtendedIntegerMultiply" _RtlExtendedIntegerMultiply@12
0x4B2FC89B: "__cdecl _fputwc_nolock" __fputwc_nolock
0x4B2F0F30: "__stdcall NtCreateJobSet" _NtCreateJobSet@12
0x4B2E4C5E: "__stdcall RtlpNameprepAsciiRealWorker" _RtlpNameprepAsciiRealWorker@40
0x4B2F3C60: "__cdecl islower" _islower
0x4B367670: "__stdcall RtlpNtCreateKey" _RtlpNtCreateKey@24
0x4B2F13C0: "__stdcall ZwGetNextThread" _ZwGetNextThread@24
0x4B2B7790: "__stdcall LdrpResolveDllName" _LdrpResolveDllName@20
0x4B2F1900: "__stdcall ZwQueryInformationTransaction" _ZwQueryInformationTransaction@20
0x4B37DADC: "__stdcall EtwpFindAndLockBufferForFlushing" _EtwpFindAndLockBufferForFlushing@12
0x4B2DE530: "__cdecl RtlpCompareActivationContextDataTOCEntryById" _RtlpCompareActivationContextDataTOCEntryById
0x4B2A4478: "The stack trace should show the " ??_C@_0GD@NFJCCKFC@The?5stack?5trace?5should?5show?5the?5@
0x4B2D7740: "__stdcall RtlInitializeResource" _RtlInitializeResource@4
0x4B38221D: "__stdcall TppWorkerpOuterExceptionFilter" _TppWorkerpOuterExceptionFilter@8
0x4B2CA838: "__stdcall LdrpInitializeDllPath" _LdrpInitializeDllPath@12
0x4B36531D: "__stdcall RtlpMuiRegConfigListAddLanguage" _RtlpMuiRegConfigListAddLanguage@12
0x4B2F1860: "__stdcall ZwQueryDirectoryObject" _ZwQueryDirectoryObject@28
0x4B293BD8: "Initializing TLS slots failed wi" ??_C@_0DD@LANBOHJM@Initializing?5TLS?5slots?5failed?5wi@
0x4B297960: "SXS: %s() - caller passed nonzer" ??_C@_0EJ@DLPKGGLO@SXS?3?5?$CFs?$CI?$CJ?5?9?5caller?5passed?5nonzer@
0x4B2D9494: "__stdcall LdrpEnableParallelLoading" _LdrpEnableParallelLoading@4
0x4B304EAB: "__stdcall LdrpValidateUserCallTargetBitMapCheck" _LdrpValidateUserCallTargetBitMapCheck@0
0x4B299D84: "VirtualProtect Failed 0x%p %x " ??_C@_0BP@BNDLCAHI@VirtualProtect?5Failed?50x?$CFp?5?$CFx?6?$AA@
0x4B347F30: "__stdcall RtlAddAccessFilterAce" _RtlAddAccessFilterAce@32
0x4B335215: "__stdcall RtlpQueryCriticalSectionOwnerInformation" _RtlpQueryCriticalSectionOwnerInformation@8
0x4B287EB8: "\Registry\MACHINE\System\Current" ??_C@_1IG@HDHPCFON@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B294C70: "DLL search path computed: %ws " ??_C@_0BP@MPACGAKH@DLL?5search?5path?5computed?3?5?$CFws?6?$AA@
0x4B2CD23D: "__stdcall RtlpSetProcUserMachineLangList" _RtlpSetProcUserMachineLangList@8
0x4B2F13E0: "__stdcall ZwGetNotificationResourceManager" _ZwGetNotificationResourceManager@28
0x4B29904C: "Resource @ %p " ??_C@_0P@ODEPNAEE@Resource?5?$EA?5?$CFp?6?$AA@
0x4B2E441C: "__stdcall _TlgWrite" __TlgWrite@24
0x4B3A0C74: "__cdecl LdrpCorExeMainRoutine" _LdrpCorExeMainRoutine
0x4B35DE7C: "__stdcall RtlpGetCustomCultureDataFromFile" _RtlpGetCustomCultureDataFromFile@20
0x4B3822B0: "__stdcall RtlUpdateTimer" _RtlUpdateTimer@16
0x4B34EAC6: "__stdcall LdrpMergeParentBaseLanguagesToList" _LdrpMergeParentBaseLanguagesToList@20
0x4B2E19D9: "__stdcall RtlpResolveAssemblyStorageMapEntry" _RtlpResolveAssemblyStorageMapEntry@20
0x4B2F5F60: "__cdecl floor" _floor
0x4B2AD9E5: "__stdcall RtlStringCbCopyW" _RtlStringCbCopyW@12
0x4B3A1ABC: "__cdecl RtlpGlobalTagHeap" _RtlpGlobalTagHeap
0x4B2AC960: "__stdcall RtlpSystemTimeToTimeFields" _RtlpSystemTimeToTimeFields@8
0x4B2AD1E0: "__stdcall RtlIsPackageSid" _RtlIsPackageSid@4
0x4B2F1CA0: "__stdcall ZwSetBootEntryOrder" _ZwSetBootEntryOrder@8
0x4B3544D0: "__stdcall RtlSetUserFlagsHeap" _RtlSetUserFlagsHeap@20
0x4B2F0A70: "__stdcall ZwCancelIoFile" _ZwCancelIoFile@8
0x4B2F0790: "__stdcall NtOpenThreadTokenEx" _NtOpenThreadTokenEx@20
0x4B363D6A: "__stdcall RtlpStdExtendLowerWatermark" _RtlpStdExtendLowerWatermark@8
0x4B338E44: "__stdcall HashStringToDwordCaseInsensitiveLen" _HashStringToDwordCaseInsensitiveLen@8
0x4B2AEB0B: "__stdcall RtlpMuiRegCreateLanguages" _RtlpMuiRegCreateLanguages@4
0x4B3A41F0: "__cdecl g_pfnSE_GetProcAddressForCaller" _g_pfnSE_GetProcAddressForCaller
0x4B354AD1: "__stdcall RtlpCoalesceHeap" _RtlpCoalesceHeap@4
0x4B369B4F: "__stdcall RtlpLogHeapUnlockEvent" _RtlpLogHeapUnlockEvent@4
0x4B34E0B0: "__stdcall RtlSetSystemBootStatusEx" _RtlSetSystemBootStatusEx@12
0x4B2F8601: "__cdecl wcstolX" _wcstolX
0x4B3695E5: "__stdcall RtlpLogHeapExtendEvent" _RtlpLogHeapExtendEvent@20
0x4B37D27B: "__fastcall EtwpGetPrivateLoggerContext" @EtwpGetPrivateLoggerContext@8
0x4B2E6E10: "__stdcall RtlFreeHandle" _RtlFreeHandle@8
0x4B2F1A80: "__stdcall NtQueueApcThreadEx" _NtQueueApcThreadEx@24
0x4B2CA310: "__stdcall ApiSetpSearchForApiSet" _ApiSetpSearchForApiSet@12
0x4B2E3F90: "__stdcall RtlDllShutdownInProgress" _RtlDllShutdownInProgress@0
0x4B35F7D0: "__stdcall RtlpHeapTrkLeakCallback" _RtlpHeapTrkLeakCallback@24
0x4B32AAF0: "__stdcall RtlDosLongPathNameToNtPathName_U_WithStatus" _RtlDosLongPathNameToNtPathName_U_WithStatus@16
0x4B361633: "__stdcall GetHangulT" _GetHangulT@4
0x4B39FD90: "__cdecl OemDefaultChar" _OemDefaultChar
0x4B33C9C0: "__stdcall LdrFlushAlternateResourceModules" _LdrFlushAlternateResourceModules@0
0x4B3A1714: "__cdecl TppPoolpGlobalPool" _TppPoolpGlobalPool
0x4B2F0C00: "__stdcall ZwAlpcCancelMessage" _ZwAlpcCancelMessage@12
0x4B372F44: "__stdcall RtlpHpExtrasReportBusyBlock" _RtlpHpExtrasReportBusyBlock@8
0x4B2953BC: "ReportEventW" ??_C@_0N@OGEMJOHI@ReportEventW?$AA@
0x4B39FEA0: "__cdecl AVrfpVerifierDllsString" _AVrfpVerifierDllsString
0x4B2F0610: "__stdcall ZwQueryInformationProcess" _ZwQueryInformationProcess@20
0x4B2F0520: "__stdcall NtReleaseSemaphore" _NtReleaseSemaphore@12
0x4B2F13F0: "__stdcall NtGetWriteWatch" _NtGetWriteWatch@28
0x4B2972C0: "SXS: %s() passed string section " ??_C@_0GG@EFMLCHKL@SXS?3?5?$CFs?$CI?$CJ?5passed?5string?5section?5@
0x4B2F3610: "__cdecl log" _log
0x4B360720: "__stdcall RtlInitializeContext" _RtlInitializeContext@20
0x4B34DF30: "__stdcall RtlGetSystemBootStatusEx" _RtlGetSystemBootStatusEx@12
0x4B2AE0CD: "__stdcall RtlpLoadLanguageConfigList" _RtlpLoadLanguageConfigList@12
0x4B297874: "RtlQueryInformationActivationCon" ??_C@_0CF@GAIJJEPM@RtlQueryInformationActivationCon@
0x4B2858F8: "DriverStore" ??_C@_1BI@HJLJMFFP@?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x4B286970: "minkernel\ntdll\ldrmap.c" ??_C@_0BJ@IGKFNDIP@minkernel?2ntdll?2ldrmap?4c?$AA@
0x4B2A6184: "Section" ??_C@_1BA@LHDKDEEN@?$AAS?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B2F1D50: "__stdcall NtSetHighEventPair" _NtSetHighEventPair@4
0x4B2C8512: "__stdcall RtlpMuiRegGetInstalledLanguageIndex" _RtlpMuiRegGetInstalledLanguageIndex@16
0x4B329C14: "__stdcall LdrpEnableHotPatch" _LdrpEnableHotPatch@4
0x4B2BF840: "__stdcall RtlAnsiStringToUnicodeString" _RtlAnsiStringToUnicodeString@12
0x4B2F4C70: "__cdecl _splitpath" __splitpath
0x4B2F05D0: "__stdcall NtQueryDefaultLocale" _NtQueryDefaultLocale@8
0x4B3584DA: "__stdcall RtlpPopulateContext" _RtlpPopulateContext@12
0x4B284D0C: "Kernel-MUI-Language-Disallowed" ??_C@_1DO@NJNPPJHL@?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AA?9?$AAM?$AAU?$AAI?$AA?9?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AA?9?$AAD?$AAi?$AAs?$AAa?$AAl?$AAl?$AAo?$AAw?$AAe?$AAd?$AA?$AA@
0x4B2F5D90: "__cdecl ceil" _ceil
0x4B2F50BC: "__cdecl _vscwprintf_helper" __vscwprintf_helper
0x4B2F0470: "__fastcall LdrpTouchPageForWrite" @LdrpTouchPageForWrite@4
0x4B2F1CF0: "__stdcall NtSetDebugFilterState" _NtSetDebugFilterState@12
0x4B355A07: "__stdcall RtlpHpScheduleCompaction" _RtlpHpScheduleCompaction@4
0x4B2B8505: "__stdcall LdrpCfgProcessLoadConfig" _LdrpCfgProcessLoadConfig@12
0x4B298530: "SXS: Assembly storage resolution" ??_C@_0HA@HINCHDLK@SXS?3?5Assembly?5storage?5resolution@
0x4B2FB812: "__cdecl _umatherr" __umatherr
0x4B39F5C0: "__cdecl RtlpRandomExAuxVarY" _RtlpRandomExAuxVarY
0x4B3840A8: "__stdcall PsspCaptureHandleTrace" _PsspCaptureHandleTrace@8
0x4B3664F0: "__stdcall RtlpRefreshCachedUILanguage" _RtlpRefreshCachedUILanguage@8
0x4B303E47: "__stdcall RtlpHpEnvQueryProcessorCount" _RtlpHpEnvQueryProcessorCount@0
0x4B2854C0: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x4B2929EC: "LdrUnlockLoaderLock" ??_C@_0BE@IGAAOGAO@LdrUnlockLoaderLock?$AA@
0x4B3A08E4: "__cdecl AVrfpVerifierStopMessageFunction" _AVrfpVerifierStopMessageFunction
0x4B353E30: "__stdcall RtlGetProcessHeapsCallback" _RtlGetProcessHeapsCallback@8
0x4B299278: "First initialization stack trace" ??_C@_0EC@JDDELLDE@First?5initialization?5stack?5trace@
0x4B37D311: "__fastcall EtwpRelogEvent" @EtwpRelogEvent@8
0x4B2F1390: "__stdcall NtGetDevicePowerState" _NtGetDevicePowerState@8
0x4B2F12C0: "__stdcall ZwFlushInstructionCache" _ZwFlushInstructionCache@12
0x4B2F89F5: "__cdecl _check_overflow_exit" __check_overflow_exit
0x4B39FB66: "__cdecl OemTransUniDefaultChar" _OemTransUniDefaultChar
0x4B294384: "GlobalFlag" ??_C@_1BG@OGBFMEDC@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AAF?$AAl?$AAa?$AAg?$AA?$AA@
0x4B2ACFD6: "__stdcall RtlpAllocDeallocQueryBuffer" _RtlpAllocDeallocQueryBuffer@16
0x4B2868F0: "__cdecl AeSbCallEvent" _AeSbCallEvent
0x4B28577C: "ApphelpCheckModule" ??_C@_0BD@PCNHNCIN@ApphelpCheckModule?$AA@
0x4B2F2030: "__stdcall NtTestAlert" _NtTestAlert@0
0x4B292F38: "LdrCreateEnclave" ??_C@_0BB@DBFDAGDJ@LdrCreateEnclave?$AA@
0x4B2926C8: "CLIENT(ntdll): Found CheckAppHel" ??_C@_0EN@PKOILHBG@CLIENT?$CIntdll?$CJ?3?5Found?5CheckAppHel@
0x4B2F14C0: "__stdcall NtLoadKey2" _NtLoadKey2@12
0x4B3819BD: "__stdcall TppTerminateProcess" _TppTerminateProcess@4
0x4B286DD8: "RtlLockHeap" ??_C@_0M@DKBLBPDB@RtlLockHeap?$AA@
0x4B3A16E4: "__cdecl RtlpHpNullGUID" _RtlpHpNullGUID
0x4B2F0640: "__stdcall NtWaitForMultipleObjects32" _NtWaitForMultipleObjects32@20
0x4B35BC50: "__stdcall RtlDeregisterSecureMemoryCacheCallback" _RtlDeregisterSecureMemoryCacheCallback@4
0x4B3047F0: "__stdcall RtlCompareMemory" _RtlCompareMemory@12
0x4B2E92F0: "__stdcall RtlTryAcquireSRWLockShared" _RtlTryAcquireSRWLockShared@4
0x4B2EBC30: "__stdcall RtlpGetSystemDefaultUILanguage" _RtlpGetSystemDefaultUILanguage@8
0x4B286D00: "SXS: %s() flags contains return_" ??_C@_0HB@FCFPPCJK@SXS?3?5?$CFs?$CI?$CJ?5flags?5contains?5return_@
0x4B2F14B0: "__stdcall NtLoadKey" _NtLoadKey@8
0x4B2A5E98: "%s_%d" ??_C@_1M@HGOFLOFI@?$AA?$CF?$AAs?$AA_?$AA?$CF?$AAd?$AA?$AA@
0x4B360A96: "__stdcall RtlpUnlinkHandlerChain" _RtlpUnlinkHandlerChain@4
0x4B2F18C0: "__stdcall ZwQueryInformationEnlistment" _ZwQueryInformationEnlistment@20
0x4B374FA7: "__stdcall RtlpHpLfhOwnerCleanup" _RtlpHpLfhOwnerCleanup@8
0x4B2A3AC0: "ffff:" ??_C@_05PBFMPBMC@ffff?3?$AA@
0x4B285C5C: "ContainerCorrelationId" ??_C@_1CO@GMOLDGFF@?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAC?$AAo?$AAr?$AAr?$AAe?$AAl?$AAa?$AAt?$AAi?$AAo?$AAn?$AAI?$AAd?$AA?$AA@
0x4B2EC9CF: "__stdcall SHA256Transform" _SHA256Transform@8
0x4B3594AB: "__stdcall RtlpValidateContextFlags" _RtlpValidateContextFlags@8
0x4B32B080: "__stdcall DbgUiContinue" _DbgUiContinue@8
0x4B341D45: "__stdcall UpcaseUnicodeToMultiByteNHelper" _UpcaseUnicodeToMultiByteNHelper@20
0x4B3418C0: "__stdcall RtlUnicodeToCustomCPN" _RtlUnicodeToCustomCPN@24
0x4B37BC6D: "__stdcall RtlpHpVsFreeChunkRemove" _RtlpHpVsFreeChunkRemove@12
0x4B2A3B94: ":%u.%u.%u.%u" ??_C@_1BK@ONFLBCMH@?$AA?3?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?$AA@
0x4B339C23: "__stdcall RtlpWnfETWEventNameSubRundown" _RtlpWnfETWEventNameSubRundown@12
0x4B349DA8: "__stdcall RtlpValidAttributeAce" _RtlpValidAttributeAce@4
0x4B35E9A0: "__stdcall RtlGuardCheckLongJumpTarget" _RtlGuardCheckLongJumpTarget@12
0x4B32DA4A: "__stdcall LdrpLogFatalLdrEtwEvent" _LdrpLogFatalLdrEtwEvent@8
0x4B36F1E0: "__stdcall LZNT1FindMatchMaximum" _LZNT1FindMatchMaximum@8
0x4B3518F4: "__stdcall RtlpMUIEnumerateFolder" _RtlpMUIEnumerateFolder@12
0x4B3A1798: "__cdecl g_isErrorOriginProviderEnabled" _g_isErrorOriginProviderEnabled
0x4B3A0BA8: "__cdecl LdrpDetourExist" _LdrpDetourExist
0x4B2857AC: "SE_LdrResolveDllName" ??_C@_0BF@OBMHMPNJ@SE_LdrResolveDllName?$AA@
0x4B2FCEC0: "__cdecl _ultow_s" __ultow_s
0x4B285E28: "__cdecl _real@3ff0000000000000" __real@3ff0000000000000
0x4B286BD8: "SxS" ??_C@_03MMHHLHNA@SxS?$AA@
0x4B298070: "SXS: %s() bad parameters SXS: " ??_C@_0JM@GFEOADIB@SXS?3?5?$CFs?$CI?$CJ?5bad?5parameters?6SXS?3?5?5?5@
0x4B378690: "__stdcall RtlpHpSegLfhVsDecommit" _RtlpHpSegLfhVsDecommit@12
0x4B32EA60: "__stdcall LdrInitShimEngineDynamic" _LdrInitShimEngineDynamic@8
0x4B2AC838: "__stdcall LdrpCorValidateImage" _LdrpCorValidateImage@4
0x4B2A6164: "Thread" ??_C@_1O@CDOGJPJJ@?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AA?$AA@
0x4B2A6D07: "__stdcall PromoteNode" _PromoteNode@4
0x4B2D4340: "__stdcall RtlAcquireSRWLockShared" _RtlAcquireSRWLockShared@4
0x4B3333C0: "__stdcall RtlCopySecurityDescriptor" _RtlCopySecurityDescriptor@8
0x4B375300: "__stdcall RtlpHpLfhSlotAddSubsegment" _RtlpHpLfhSlotAddSubsegment@8
0x4B366389: "__stdcall RtlpMuiRegValidateConfigNode" _RtlpMuiRegValidateConfigNode@8
0x4B32E6D8: "__cdecl _TlgDefineProvider_annotation__Tlgg_LibLoaderProviderProv" __TlgDefineProvider_annotation__Tlgg_LibLoaderProviderProv
0x4B360D20: "__stdcall RtlIsCurrentProcess" _RtlIsCurrentProcess@4
0x4B36EDF5: "__stdcall RtlpWalkLowFragHeapSegment" _RtlpWalkLowFragHeapSegment@12
0x4B2CC840: "__stdcall RtlAddAccessAllowedAce" _RtlAddAccessAllowedAce@16
0x4B33CB4F: "__stdcall LdrpCnvrtShortToLongFileName" _LdrpCnvrtShortToLongFileName@12
0x4B294A88: "Break repeatedly, break Once, Ig" ??_C@_0FG@HMDLMKJA@Break?5repeatedly?0?5break?5Once?0?5Ig@
0x4B379C35: "__stdcall RtlpHpSegReAlloc" _RtlpHpSegReAlloc@16
0x4B354D90: "__stdcall RtlpExtendedHeapInformationGenerator" _RtlpExtendedHeapInformationGenerator@8
0x4B35B8C0: "__stdcall RtlGetElementGenericTable" _RtlGetElementGenericTable@8
0x4B2F1850: "__stdcall ZwQueryDirectoryFileEx" _ZwQueryDirectoryFileEx@40
0x4B375EAC: "__stdcall RtlpHpLfhSubsegmentIncBlockCounts" _RtlpHpLfhSubsegmentIncBlockCounts@28
0x4B360001: "__stdcall punycode_encode" _punycode_encode@24
0x4B357A82: "__stdcall RtlpThunkSmMessage" _RtlpThunkSmMessage@8
0x4B2AB740: "__stdcall TpReleaseCleanupGroupMembers" _TpReleaseCleanupGroupMembers@12
0x4B37C870: "__stdcall EtwRegisterSecurityProvider" _EtwRegisterSecurityProvider@0
0x4B2E5060: "__stdcall RtlInitializeConditionVariable" _RtlInitializeConditionVariable@4
0x4B2A3DDC: "ProductType" ??_C@_1BI@JPCMFPH@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x4B3A1658: "__cdecl RtlpCachedPathLock" _RtlpCachedPathLock
0x4B33BBAC: "__stdcall ImportTablepInsertModuleSorted" _ImportTablepInsertModuleSorted@8
0x4B2E3F9B: "__stdcall RtlpDecrementWnfSerializationGroup" _RtlpDecrementWnfSerializationGroup@4
0x4B2FC7DB: "__cdecl _get_printf_count_output" __get_printf_count_output
0x4B2F1700: "__stdcall NtOpenSession" _NtOpenSession@12
0x4B3A1248: "__cdecl CsrServerApiRoutine" _CsrServerApiRoutine
0x4B2F0AC0: "__stdcall ZwSetTimer" _ZwSetTimer@28
0x4B298A00: "MitigationOptions" ??_C@_1CE@NNPBFBMJ@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x4B2FC926: "__cdecl _filbuf_s" __filbuf_s
0x4B2E75DB: "__stdcall SbGetContextDetailsByVersion" _SbGetContextDetailsByVersion@12
0x4B2F4090: "__cdecl _allshr" __allshr
0x4B2F0840: "__stdcall NtWriteVirtualMemory" _NtWriteVirtualMemory@20
0x4B2F17C0: "__stdcall ZwPrivilegeObjectAuditAlarm" _ZwPrivilegeObjectAuditAlarm@24
0x4B305200: "__stdcall RtlRaiseException" _RtlRaiseException@4
0x4B360CD0: "__stdcall RtlSetProxiedProcessId" _RtlSetProxiedProcessId@4
0x4B2D7B80: "__stdcall RtlSwitchedVVI" _RtlSwitchedVVI@16
0x4B2F0A40: "__stdcall NtQuerySystemTime" _NtQuerySystemTime@4
0x4B2F0D30: "__stdcall NtAlpcRevokeSecurityContext" _NtAlpcRevokeSecurityContext@12
0x4B2F0FC0: "__stdcall ZwCreatePort" _ZwCreatePort@20
0x4B36B0F1: "__stdcall RtlDebugCompactHeap" _RtlDebugCompactHeap@8
0x4B2929C0: "LdrpProtectedCopyMemory" ??_C@_0BI@NFANAMKK@LdrpProtectedCopyMemory?$AA@
0x4B3A1828: "__cdecl AVrfpHandleTraces" _AVrfpHandleTraces
0x4B2AB520: "__stdcall TpSetPoolThreadBasePriority" _TpSetPoolThreadBasePriority@8
0x4B2D4030: "__stdcall RtlpQueryInformationActivationContextBasicInformation" _RtlpQueryInformationActivationContextBasicInformation@28
0x4B345E81: "__stdcall RtlpGetTokenNamedObjectPath" _RtlpGetTokenNamedObjectPath@16
0x4B37BD25: "__stdcall RtlpHpVsIsPageAlignedUserAddr" _RtlpHpVsIsPageAlignedUserAddr@8
0x4B2981E0: "SXS: Attempt to insert well know" ??_C@_0HN@OBHGAAOP@SXS?3?5Attempt?5to?5insert?5well?5know@
0x4B2F1980: "__stdcall NtQueryMutant" _NtQueryMutant@20
0x4B2A6C0A: "__stdcall FindNodeOrParent" _FindNodeOrParent@12
0x4B338BF1: "__stdcall GetShipAssertBuffer" _GetShipAssertBuffer@0
0x4B2F15E0: "__stdcall NtNotifyChangeMultipleKeys" _NtNotifyChangeMultipleKeys@48
0x4B2F1320: "__stdcall NtFreezeRegistry" _NtFreezeRegistry@4
0x4B368694: "__stdcall RtlpHpStackTraceAllocFindMapping" _RtlpHpStackTraceAllocFindMapping@8
0x4B2EEA9C: "__stdcall EtwpQueryPartitionRegistryInformationUm" _EtwpQueryPartitionRegistryInformationUm@16
0x4B33BDD0: "__stdcall CsrAllocateCaptureBuffer" _CsrAllocateCaptureBuffer@8
0x4B3859CF: "__stdcall PsspQueryInfoClass_PSS_QUERY_THREAD_INFORMATION" _PsspQueryInfoClass_PSS_QUERY_THREAD_INFORMATION@8
0x4B292604: "BinaryHash" ??_C@_1BG@FNFFPEAB@?$AAB?$AAi?$AAn?$AAa?$AAr?$AAy?$AAH?$AAa?$AAs?$AAh?$AA?$AA@
0x4B34A6C8: "__stdcall RtlpHpReAllocWithExceptionProtection" _RtlpHpReAllocWithExceptionProtection@16
0x4B2F011D: "__stdcall EtwpInsertGuidEntry" _EtwpInsertGuidEntry@4
0x4B284940: "AlternateCodePage" ??_C@_1CE@GCKIPCGP@?$AAA?$AAl?$AAt?$AAe?$AAr?$AAn?$AAa?$AAt?$AAe?$AAC?$AAo?$AAd?$AAe?$AAP?$AAa?$AAg?$AAe?$AA?$AA@
0x4B2D6A1B: "__stdcall RtlpAllocateEnvBlock" _RtlpAllocateEnvBlock@4
0x4B2E6B10: "__stdcall RtlValidSecurityDescriptor" _RtlValidSecurityDescriptor@4
0x4B37B506: "__stdcall RtlpHpVsChunkSetUnusedBytes" _RtlpHpVsChunkSetUnusedBytes@16
0x4B2A5678: "Just allocated block at %p for %" ??_C@_0CK@PEJIGGFF@Just?5allocated?5block?5at?5?$CFp?5for?5?$CF@
0x4B292890: "COM" ??_C@_17KKLPNNMB@?$AAC?$AAO?$AAM?$AA?$AA@
0x4B287708: "__cdecl Magic10000" _Magic10000
0x4B3A0400: "__cdecl AVrfpCurrentUserKeyPath" _AVrfpCurrentUserKeyPath
0x4B354160: "__stdcall RtlMultipleFreeHeap" _RtlMultipleFreeHeap@16
0x4B2EBD80: "__stdcall TpCallbackSetEventOnCompletion" _TpCallbackSetEventOnCompletion@8
0x4B2F8150: "__cdecl wcsncat" _wcsncat
0x4B36B9CC: "__stdcall RtlDebugQueryTagHeap" _RtlDebugQueryTagHeap@20
0x4B2DB8E6: "__stdcall RtlBeginReadTickLock" _RtlBeginReadTickLock@4
0x4B2E0A4C: "__stdcall EtwpAllocateRegistration" _EtwpAllocateRegistration@16
0x4B3A0C00: "__cdecl g_LdrBreakOnLdrpInitializeProcessFailure" _g_LdrBreakOnLdrpInitializeProcessFailure
0x4B34D4BE: "__stdcall RtlpTreeDoubleRotateNodes" _RtlpTreeDoubleRotateNodes@20
0x4B359389: "__stdcall RtlpGetContextFlagsLocation" _RtlpGetContextFlagsLocation@8
0x4B2F1170: "__stdcall NtDeleteFile" _NtDeleteFile@4
0x4B2F2820: "__stdcall KiUserCallbackExceptionHandler" _KiUserCallbackExceptionHandler@16
0x4B35B870: "__stdcall RtlEnumerateGenericTableWithoutSplaying" _RtlEnumerateGenericTableWithoutSplaying@8
0x4B2F0D40: "__stdcall NtAlpcSendWaitReceivePort" _NtAlpcSendWaitReceivePort@32
0x4B2A8DB0: "__stdcall RtlDeleteAce" _RtlDeleteAce@8
0x4B2DFD60: "__stdcall EtwEventWrite" _EtwEventWrite@20
0x4B343900: "__stdcall RtlCreateVirtualAccountSid" _RtlCreateVirtualAccountSid@16
0x4B29342C: "Initializing the shim DLL "%wZ" " ??_C@_0DM@PIJMEOHP@Initializing?5the?5shim?5DLL?5?$CC?$CFwZ?$CC?5@
0x4B2ACA71: "__stdcall RtlStringCbCatW" _RtlStringCbCatW@12
0x4B2BDEE0: "__stdcall LdrpAppendUnicodeStringToFilenameBuffer" _LdrpAppendUnicodeStringToFilenameBuffer@8
0x4B32E263: "__stdcall LdrpLogVerifyAlternateResourceModuleWithServiceChecksumFailure" _LdrpLogVerifyAlternateResourceModuleWithServiceChecksumFailure@16
0x4B304376: "__stdcall RtlpHpVsDelayFreeContextInitialize" _RtlpHpVsDelayFreeContextInitialize@4
0x4B2E9C11: "__stdcall RtlpFreeTebLanguageList" _RtlpFreeTebLanguageList@4
0x4B2992BC: "Critical section address." ??_C@_0BK@FJIJAMGM@Critical?5section?5address?4?$AA@
0x4B2A6320: "DisableStoreApps" ??_C@_1CC@FPPHGIPD@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAS?$AAt?$AAo?$AAr?$AAe?$AAA?$AAp?$AAp?$AAs?$AA?$AA@
0x4B2F1B70: "__stdcall ZwReplaceKey" _ZwReplaceKey@12
0x4B2F1800: "__stdcall ZwPulseEvent" _ZwPulseEvent@8
0x4B292940: "Nonpackaged process attempted to" ??_C@_0DH@GNHBPCPJ@Nonpackaged?5process?5attempted?5to@
0x4B2FB9C1: "__cdecl _sptype" __sptype
0x4B2F0A90: "__stdcall ZwPowerInformation" _ZwPowerInformation@20
0x4B2F10B0: "__stdcall NtCreateTransaction" _NtCreateTransaction@40
0x4B378B73: "__stdcall RtlpHpSegMgrCommitInitiate" _RtlpHpSegMgrCommitInitiate@24
0x4B2F1570: "__stdcall NtMapUserPhysicalPages" _NtMapUserPhysicalPages@12
0x4B2F85E0: "__cdecl wcstol" _wcstol
0x4B2F0C50: "__stdcall ZwAlpcCreateResourceReserve" _ZwAlpcCreateResourceReserve@16
0x4B2F1930: "__stdcall NtQueryInstallUILanguage" _NtQueryInstallUILanguage@4
0x4B2F45E0: "__cdecl _itoa" __itoa
0x4B2F1780: "__stdcall NtPrePrepareEnlistment" _NtPrePrepareEnlistment@8
0x4B2E9480: "__stdcall RtlAreLongPathsEnabled" _RtlAreLongPathsEnabled@0
0x4B3A4232: "__cdecl RtlGuardAllowSuppressedCalls" _RtlGuardAllowSuppressedCalls
0x4B36D1FA: "__stdcall RtlHpInitializeHeapManager" _RtlHpInitializeHeapManager@0
0x4B2883EC: "WIN://SYSAPPID" ??_C@_1BO@BOGEHPME@?$AAW?$AAI?$AAN?$AA?3?$AA?1?$AA?1?$AAS?$AAY?$AAS?$AAA?$AAP?$AAP?$AAI?$AAD?$AA?$AA@
0x4B33BDE0: "__stdcall CsrAllocateMessagePointer" _CsrAllocateMessagePointer@12
0x4B2E8C50: "__stdcall RtlIpv4StringToAddressExW" _RtlIpv4StringToAddressExW@16
0x4B2F15F0: "__stdcall NtNotifyChangeSession" _NtNotifyChangeSession@32
0x4B2AB375: "__stdcall RealSuccessor" _RealSuccessor@4
0x4B3478E0: "__stdcall RtlDumpResource" _RtlDumpResource@4
0x4B32A210: "__stdcall RtlAppxIsFileOwnedByTrustedInstaller" _RtlAppxIsFileOwnedByTrustedInstaller@8
0x4B294404: "LdrpInitializeExecutionOptions" ??_C@_0BP@PEIBIJMO@LdrpInitializeExecutionOptions?$AA@
0x4B2A5258: "Entry" ??_C@_05HKHPEFOF@Entry?$AA@
0x4B2F0750: "__stdcall NtReplyWaitReceivePortEx" _NtReplyWaitReceivePortEx@20
0x4B33D2CF: "__stdcall LdrpSpecialCacheTypeHandle" _LdrpSpecialCacheTypeHandle@8
0x4B365441: "__stdcall RtlpMuiRegConfigMatchesInstalled" _RtlpMuiRegConfigMatchesInstalled@28
0x4B37E2EA: "__stdcall EtwpQueryUmLogger" _EtwpQueryUmLogger@16
0x4B33C5A0: "__stdcall AlpcRundownCompletionList" _AlpcRundownCompletionList@4
0x4B2991E0: "Invalid debug info address of th" ??_C@_0DE@MBNECAOK@Invalid?5debug?5info?5address?5of?5th@
0x4B33A120: "__stdcall RtlpWnfSetRetryTimer" _RtlpWnfSetRetryTimer@8
0x4B382C35: "__stdcall RtlTpETWCallbackDequeue" _RtlTpETWCallbackDequeue@20
0x4B2E9430: "__stdcall RtlIsStateSeparationEnabled" _RtlIsStateSeparationEnabled@0
0x4B2D68E5: "__stdcall RtlpGetHeapProtection" _RtlpGetHeapProtection@8
0x4B2F1F50: "__stdcall NtSetVolumeInformationFile" _NtSetVolumeInformationFile@20
0x4B3615AC: "__stdcall CanComposeHangul" _CanComposeHangul@8
0x4B2A52A8: "SegmentCommit" ??_C@_0O@CPHFHPH@SegmentCommit?$AA@
0x4B293F20: "Per-DLL page heap is disabled si" ??_C@_0DP@BBOGONIA@Per?9DLL?5page?5heap?5is?5disabled?5si@
0x4B2A48A4: "heap_failure_virtual_block_corru" ??_C@_0CG@MGBGEMDE@heap_failure_virtual_block_corru@
0x4B298CE4: "AppContainerNamedObjects" ??_C@_1DC@JGKFLOCH@?$AAA?$AAp?$AAp?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$AA@
0x4B3A180C: "__cdecl LdrDelegatedRtlUserThreadStart" _LdrDelegatedRtlUserThreadStart
0x4B2E7D30: "__stdcall RtlFindMessage" _RtlFindMessage@20
0x4B2AAC00: "__stdcall LdrRegisterDllNotification" _LdrRegisterDllNotification@16
0x4B2F1490: "__stdcall NtLoadDriver" _NtLoadDriver@4
0x4B37B942: "__stdcall RtlpHpVsContextFree" _RtlpHpVsContextFree@20
0x4B3615E1: "__stdcall ComposeHangulLV" _ComposeHangulLV@8
0x4B347E80: "__stdcall RtlAddAccessDeniedAce" _RtlAddAccessDeniedAce@16
0x4B295228: "Toy" ??_C@_17KECEIPDD@?$AAT?$AAo?$AAy?$AA?$AA@
0x4B386ECE: "__stdcall RtlStackDbContextSerialize" _RtlStackDbContextSerialize@12
0x4B304620: "__stdcall NtdllImeWndProc_A" _NtdllImeWndProc_A@0
0x4B3A1778: "__cdecl LdrpDefaultDllDirectories" _LdrpDefaultDllDirectories
0x4B377EB2: "__stdcall RtlpHpSegContextCompact" _RtlpHpSegContextCompact@8
0x4B2C0670: "__stdcall RtlFindActivationContextSectionString" _RtlFindActivationContextSectionString@20
0x4B374DB6: "__stdcall RtlpHpLfhContextCompact" _RtlpHpLfhContextCompact@8
0x4B2CB250: "__stdcall LdrGetDllHandleEx" _LdrGetDllHandleEx@20
0x4B2B2E7C: "__stdcall CheckOneBitValidFlag" _CheckOneBitValidFlag@8
0x4B331160: "__stdcall RtlGetNtVersionNumbers" _RtlGetNtVersionNumbers@12
0x4B2F0580: "__stdcall NtQueryObject" _NtQueryObject@20
0x4B39F94C: "__cdecl NlsActiveCodePageIsUTF8" _NlsActiveCodePageIsUTF8
0x4B361DA6: "__stdcall Normalization__CanCombinableCharactersCombine" _Normalization__CanCombinableCharactersCombine@12
0x4B2F74F0: "__cdecl strchr" _strchr
0x4B2F7AA0: "__cdecl strrchr" _strrchr
0x4B35E510: "__stdcall RtlVerifyVersionInfo" _RtlVerifyVersionInfo@16
0x4B360AD7: "__stdcall _FinalExceptionHandler" __FinalExceptionHandler@16
0x4B344580: "__stdcall RtlSetAttributesSecurityDescriptor" _RtlSetAttributesSecurityDescriptor@12
0x4B2EC5ED: "__stdcall RtlpGetPolicyValueForSystemCapability" _RtlpGetPolicyValueForSystemCapability@8
0x4B374551: "__stdcall RtlpHpSetUserFlags" _RtlpHpSetUserFlags@20
0x4B2F0CC0: "__stdcall NtAlpcDisconnectPort" _NtAlpcDisconnectPort@8
0x4B303F53: "__stdcall RtlpHpVsContextAllocateInternal" _RtlpHpVsContextAllocateInternal@24
0x4B3661FA: "__stdcall RtlpMuiRegResizeLanguageList" _RtlpMuiRegResizeLanguageList@8
0x4B3770C1: "__stdcall RtlpHpLargeWalkHeap" _RtlpHpLargeWalkHeap@8
0x4B294080: "VerifierActivationFilter match %" ??_C@_0CJ@HBDOFKNO@VerifierActivationFilter?5match?5?$CF@
0x4B2853C0: "Software\Microsoft\LanguageOverl" ??_C@_1EG@EMFHK@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAO?$AAv?$AAe?$AAr?$AAl@
0x4B3322A0: "__stdcall WinSqmEndSession" _WinSqmEndSession@4
0x4B36099E: "__stdcall RtlInitializeProcessExceptionChain" _RtlInitializeProcessExceptionChain@4
0x4B2B1B1F: "__stdcall RtlULongAdd" _RtlULongAdd@12
0x4B2881F0: "PRN" ??_C@_17PFHGFFKC@?$AAP?$AAR?$AAN?$AA?$AA@
0x4B3A0B68: "__cdecl LdrpWorkCompleteEvent" _LdrpWorkCompleteEvent
0x4B35C4CC: "__stdcall RtlpScanProcessVirtualMemory" _RtlpScanProcessVirtualMemory@0
0x4B2EB1F0: "__stdcall RtlQueryThreadPlaceholderCompatibilityMode" _RtlQueryThreadPlaceholderCompatibilityMode@0
0x4B2AB610: "__stdcall LdrLoadAlternateResourceModule" _LdrLoadAlternateResourceModule@16
0x4B2DFEC0: "__stdcall RtlFindActivationContextSectionGuid" _RtlFindActivationContextSectionGuid@20
0x4B2F20C0: "__stdcall ZwUnloadKeyEx" _ZwUnloadKeyEx@8
0x4B295644: "AVRF: verifier dll `%ws' " ??_C@_0BL@OJELNHIK@AVRF?3?5verifier?5dll?5?$GA?$CFws?8?5?6?$AA@
0x4B37C5C0: "__stdcall EtwEventWriteFull" _EtwEventWriteFull@32
0x4B2F1C80: "__stdcall NtSecureConnectPort" _NtSecureConnectPort@36
0x4B358090: "__stdcall RtlGetNextEntryHashTable" _RtlGetNextEntryHashTable@8
0x4B2ADD05: "__stdcall RtlpLoadInstallLanguageFallback" _RtlpLoadInstallLanguageFallback@12
0x4B36D4AC: "__stdcall RtlpHpTlLogVAChange" _RtlpHpTlLogVAChange@16
0x4B3507E8: "__stdcall RtlpCheckMuiMultiStringSafe" _RtlpCheckMuiMultiStringSafe@8
0x4B39F110: "__cdecl EtwpFreeRegistrationList" _EtwpFreeRegistrationList
0x4B2A7A95: "__stdcall TpWaitOutstandingCallbackCount" _TpWaitOutstandingCallbackCount@4
0x4B2F1A90: "__stdcall ZwRaiseException" _ZwRaiseException@12
0x4B34D660: "__stdcall RtlInitBarrier" _RtlInitBarrier@12
0x4B2F1C10: "__stdcall NtRollbackEnlistment" _NtRollbackEnlistment@8
0x4B343830: "__stdcall RtlCopyLuidAndAttributesArray" _RtlCopyLuidAndAttributesArray@12
0x4B304480: "__stdcall NtdllMenuWndProc_A" _NtdllMenuWndProc_A@0
0x4B2F1E00: "__stdcall ZwSetInformationTransactionManager" _ZwSetInformationTransactionManager@16
0x4B34C0B0: "__stdcall RtlFindNextForwardRunClear" _RtlFindNextForwardRunClear@12
0x4B2F0570: "__stdcall NtClose" _NtClose@4
0x4B298D88: "\AppContainerNamedObjects" ??_C@_1DE@ECFPHGNH@?$AA?2?$AAA?$AAp?$AAp?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$AA@
0x4B36A1F0: "__stdcall RtlpDebugPageHeapDestroy" _RtlpDebugPageHeapDestroy@4
0x4B2A3C60: "%%%u!%s!" ??_C@_1BC@DNCBBMLH@?$AA?$CF?$AA?$CF?$AA?$CF?$AAu?$AA?$CB?$AA?$CF?$AAs?$AA?$CB?$AA?$AA@
0x4B35C003: "__stdcall RtlpInitializeLeakDetection" _RtlpInitializeLeakDetection@0
0x4B34BE50: "__stdcall RtlFindLastBackwardRunClear" _RtlFindLastBackwardRunClear@12
0x4B293270: "LDR:MRDATA: Process initializati" ??_C@_0DP@NBPADFJL@LDR?3MRDATA?3?5Process?5initializati@
0x4B358BA0: "__stdcall RtlSetExtendedFeaturesMask" _RtlSetExtendedFeaturesMask@12
0x4B285A48: ".aspack" ??_C@_07GAIGNPHA@?4aspack?$AA@
0x4B29883C: "RtlpGetActivationContextDataStor" ??_C@_0DG@LIFCGBKB@RtlpGetActivationContextDataStor@
0x4B285B28: "%x" ??_C@_15LHNHECKK@?$AA?$CF?$AAx?$AA?$AA@
0x4B286AC8: "Locating procedure "%s" by name " ??_C@_0CB@PDNCFBGN@Locating?5procedure?5?$CC?$CFs?$CC?5by?5name?6@
0x4B33C1D0: "__stdcall AlpcAdjustCompletionListConcurrencyCount" _AlpcAdjustCompletionListConcurrencyCount@8
0x4B2A3E38: " Leaked Block 0x%p size 0x%p (st" ??_C@_0DC@EBFNFNIL@?5Leaked?5Block?50x?$CFp?5size?50x?$CFp?5?$CIst@
0x4B33FE18: "__stdcall LdrRelocateImageWithBias" _LdrRelocateImageWithBias@28
0x4B382CAF: "__stdcall RtlpTpETWCallbackEnqueue" _RtlpTpETWCallbackEnqueue@20
0x4B2F0D50: "__stdcall NtAlpcSetInformation" _NtAlpcSetInformation@16
0x4B2F08D0: "__stdcall ZwContinue" _ZwContinue@8
0x4B2F05B0: "__stdcall NtEnumerateValueKey" _NtEnumerateValueKey@24
0x4B2A3C74: "hc" ??_C@_15IDAJILIG@?$AAh?$AAc?$AA?$AA@
0x4B2E37BE: "__stdcall RtlpRemoveUserSubFromNameSub" _RtlpRemoveUserSubFromNameSub@12
0x4B2F0DA0: "__stdcall NtCancelIoFileEx" _NtCancelIoFileEx@12
0x4B338E30: "__stdcall ShipAssertMsgA" _ShipAssertMsgA@12
0x4B3650F1: "__stdcall RtlpHasMachineUILock" _RtlpHasMachineUILock@8
0x4B2940AC: "\VerifierCounter" ??_C@_1CC@JMFODPIB@?$AA?2?$AAV?$AAe?$AAr?$AAi?$AAf?$AAi?$AAe?$AAr?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x4B33A220: "__stdcall LdrAddDllDirectory" _LdrAddDllDirectory@8
0x4B2F2280: "__stdcall NtWow64ReadVirtualMemory64" _NtWow64ReadVirtualMemory64@28
0x4B2F0FA0: "__stdcall NtCreatePagingFile" _NtCreatePagingFile@16
0x4B2A4618: "Compact" ??_C@_1BA@PIHDMPBJ@?$AAC?$AAo?$AAm?$AAp?$AAa?$AAc?$AAt?$AA?$AA@
0x4B2F0500: "__stdcall NtWriteFile" _NtWriteFile@36
0x4B34AAA0: "__stdcall RtlResetMemoryZone" _RtlResetMemoryZone@4
0x4B2E8477: "__stdcall RtlpNonNegativeDecrement" _RtlpNonNegativeDecrement@4
0x4B331137: "__stdcall NtdllpReallocateStringRoutine" _NtdllpReallocateStringRoutine@8
0x4B2877D8: "windows vista" ??_C@_1BM@PBAMHJKG@?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAv?$AAi?$AAs?$AAt?$AAa?$AA?$AA@
0x4B2D2AA0: "__stdcall TpSetTimer" _TpSetTimer@16
0x4B2F0810: "__stdcall NtOpenSection" _NtOpenSection@12
0x4B294594: "__cdecl LdrpLockMemoryPrivilege" _LdrpLockMemoryPrivilege
0x4B35C1EC: "__stdcall RtlpPushPageDescriptor" _RtlpPushPageDescriptor@8
0x4B2F1D80: "__stdcall ZwSetInformationDebugObject" _ZwSetInformationDebugObject@20
0x4B294D54: "SaferiIsDllAllowed" ??_C@_0BD@MBCLHCBP@SaferiIsDllAllowed?$AA@
0x4B2E3503: "__stdcall RtlpWakeSRWLock" _RtlpWakeSRWLock@12
0x4B288670: "x86" ??_C@_17NIABIIAO@?$AAx?$AA8?$AA6?$AA?$AA@
0x4B2BDD13: "__fastcall RtlpAllocateUserBlock" @RtlpAllocateUserBlock@16
0x4B2E10E2: "__stdcall RtlpFilterandReplaceConsoleLanguages" _RtlpFilterandReplaceConsoleLanguages@20
0x4B2F45E0: "__cdecl _ltoa" __ltoa
0x4B2D8170: "__stdcall WinSqmStartSqmOptinListener" _WinSqmStartSqmOptinListener@0
0x4B2F1920: "__stdcall ZwQueryInformationWorkerFactory" _ZwQueryInformationWorkerFactory@20
0x4B2C78C0: "__stdcall RtlReAllocateHeap" _RtlReAllocateHeap@16
0x4B2EA228: "__stdcall LdrpQueryDllExecuteOptions" _LdrpQueryDllExecuteOptions@8
0x4B2AB980: "__stdcall TpCallbackUnloadDllOnCompletion" _TpCallbackUnloadDllOnCompletion@8
0x4B2F1760: "__stdcall NtPlugPlayControl" _NtPlugPlayControl@12
0x4B349F19: "__stdcall RtlpValidRelativeAttribute" _RtlpValidRelativeAttribute@8
0x4B2F3D50: "__cdecl isxdigit" _isxdigit
0x4B355253: "__stdcall RtlpGetContainingRange" _RtlpGetContainingRange@24
0x4B2DA2F0: "__stdcall RtlRbRemoveNode" _RtlRbRemoveNode@8
0x4B2DD3D4: "__stdcall TppUpdatePoolNodeStatus" _TppUpdatePoolNodeStatus@8
0x4B3A16B0: "__cdecl RtlpHpStackTrackingContext" _RtlpHpStackTrackingContext
0x4B2A57D4: "About to free block at %p " ??_C@_0BL@GOLAHMJN@About?5to?5free?5block?5at?5?$CFp?6?$AA@
0x4B37BA7A: "__stdcall RtlpHpVsContextInitialize" _RtlpHpVsContextInitialize@24
0x4B2B29F0: "__stdcall RtlGetLengthWithoutLastFullDosOrNtPathElement" _RtlGetLengthWithoutLastFullDosOrNtPathElement@12
0x4B32E7BF: "__stdcall LdrpProtectAndRelocateImage" _LdrpProtectAndRelocateImage@20
0x4B39F5FC: "__cdecl RtlpDphInitFailureFlags" _RtlpDphInitFailureFlags
0x4B373A71: "__stdcall RtlpHpHeapLock" _RtlpHpHeapLock@8
0x4B2DF23C: "__stdcall LdrpAllocateTls" _LdrpAllocateTls@0
0x4B34E4B0: "__stdcall RtlCheckRegistryKey" _RtlCheckRegistryKey@8
0x4B3688E0: "__stdcall RtlpHpStackTraceEtwCallback" _RtlpHpStackTraceEtwCallback@36
0x4B2818C0: "__cdecl RtlpMemoryBlockLookasideCriticalRoutines" _RtlpMemoryBlockLookasideCriticalRoutines
0x4B2A598C: "Heap block at %p is not last blo" ??_C@_0DE@GLPAAFC@Heap?5block?5at?5?$CFp?5is?5not?5last?5blo@
0x4B3464CD: "__stdcall RtlpOpenThreadToken" _RtlpOpenThreadToken@8
0x4B33FF0C: "__stdcall LdrpArmProcessRelocation" _LdrpArmProcessRelocation@16
0x4B3743A9: "__stdcall RtlpHpReallocComputeSizes" _RtlpHpReallocComputeSizes@20
0x4B2D8170: "__stdcall WinSqmIsOptedIn" _WinSqmIsOptedIn@0
0x4B2F12A0: "__stdcall NtFlushBuffersFileEx" _NtFlushBuffersFileEx@20
0x4B2818F8: "__cdecl RtlDecompressBufferProcs" _RtlDecompressBufferProcs
0x4B3A14DC: "__cdecl RtlpHpGCTimer" _RtlpHpGCTimer
0x4B32B440: "__stdcall DbgUiWaitStateChange" _DbgUiWaitStateChange@8
0x4B2F1280: "__stdcall NtFilterToken" _NtFilterToken@24
0x4B288730: "\Registry\Machine\Software\Micro" ??_C@_1HO@PKFMCJEM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B2A578C: "Just reallocated block at %p to " ??_C@_0DK@GIBJEKFG@Just?5reallocated?5block?5at?5?$CFp?5to?5@
0x4B2F1CB0: "__stdcall ZwSetBootOptions" _ZwSetBootOptions@8
0x4B3366A9: "__stdcall AVrfpEnableVerifierOptions" _AVrfpEnableVerifierOptions@0
0x4B285848: "SE_InitializeEngine" ??_C@_0BE@NKMLFNDG@SE_InitializeEngine?$AA@
0x4B2FDA90: "__cdecl sscanf_s" _sscanf_s
0x4B343A50: "__stdcall RtlGetAppContainerParent" _RtlGetAppContainerParent@8
0x4B355F60: "__stdcall RtlpQueryExtendedInformationHeap" _RtlpQueryExtendedInformationHeap@8
0x4B32A8B0: "__stdcall RtlAppendPathElement" _RtlAppendPathElement@12
0x4B285910: "\Software\Policies\Microsoft\Win" ??_C@_1HG@MHMMLEKG@?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn@
0x4B383D20: "__stdcall PssNtQuerySnapshot" _PssNtQuerySnapshot@16
0x4B293A40: "Allocating a data table entry fo" ??_C@_0DJ@HCAICHGM@Allocating?5a?5data?5table?5entry?5fo@
0x4B29892C: " Name:" ??_C@_1O@IIBGMGAG@?$AA?5?$AAN?$AAa?$AAm?$AAe?$AA?3?$AA?$AA@
0x4B338D20: "__stdcall ShipAssert" _ShipAssert@8
0x4B33D4A0: "__stdcall RtlCreateUserProcess" _RtlCreateUserProcess@40
0x4B2BD37F: "__stdcall LdrpAllocateFileNameBufferIfNeeded" _LdrpAllocateFileNameBufferIfNeeded@8
0x4B2F2010: "__stdcall ZwTerminateEnclave" _ZwTerminateEnclave@8
0x4B37AAAE: "__stdcall RtlCSparseBitmapStart" _RtlCSparseBitmapStart@16
0x4B2D29C0: "__stdcall RtlQueryEnvironmentVariable_U" _RtlQueryEnvironmentVariable_U@12
0x4B36DA3E: "__stdcall RtlpInitializeLowFragHeapManager" _RtlpInitializeLowFragHeapManager@0
0x4B2E83D0: "__stdcall TpCaptureCaller" _TpCaptureCaller@4
0x4B2CD593: "__stdcall LdrpAcquireLoaderLock" _LdrpAcquireLoaderLock@0
0x4B3681D0: "__stdcall RtlpHpStackDbFreeRoutine" _RtlpHpStackDbFreeRoutine@8
0x4B286ED8: "SbFilterProcedure_RTL" ??_C@_0BG@PMPAHNCC@SbFilterProcedure_RTL?$AA@
0x4B3A16A0: "__cdecl RtlpProtectedPoliciesSRWLock" _RtlpProtectedPoliciesSRWLock
0x4B33C360: "__stdcall AlpcGetMessageFromCompletionList" _AlpcGetMessageFromCompletionList@8
0x4B3A1630: "__cdecl LdrpPathLock" _LdrpPathLock
0x4B281090: "__cdecl RtlpDosAUXDevice" _RtlpDosAUXDevice
0x4B2F0D70: "__stdcall NtAssignProcessToJobObject" _NtAssignProcessToJobObject@8
0x4B3A0B80: "__cdecl LdrpWorkQueueLock" _LdrpWorkQueueLock
0x4B39E798: "__cdecl RtlpSecMemListHead" _RtlpSecMemListHead
0x4B2F1740: "__stdcall NtOpenTransaction" _NtOpenTransaction@20
0x4B304680: "__stdcall NtdllHkINLPCWPRETSTRUCT_A" _NtdllHkINLPCWPRETSTRUCT_A@0
0x4B370A26: "__stdcall RtlCompressBufferXpressLzStandard" _RtlCompressBufferXpressLzStandard@36
0x4B2E3680: "__stdcall RtlUnsubscribeWnfNotificationWaitForCompletion" _RtlUnsubscribeWnfNotificationWaitForCompletion@4
0x4B37322A: "__stdcall RtlpHpGetUserInfo" _RtlpHpGetUserInfo@20
0x4B2F0F20: "__stdcall NtCreateJobObject" _NtCreateJobObject@12
0x4B3672D0: "__stdcall _RtlpMuiRegValidateLIPLanguage" __RtlpMuiRegValidateLIPLanguage@8
0x4B2876C8: "__stdcall _imp__ZwQueryValueKey" __imp__ZwQueryValueKey@24
0x4B3621E9: "__stdcall Normalization__GuessCharCountBySize" _Normalization__GuessCharCountBySize@8
0x4B293FA4: "%s!%s" ??_C@_1M@CPBFCNM@?$AA?$CF?$AAs?$AA?$CB?$AA?$CF?$AAs?$AA?$AA@
0x4B296C40: "SXS: %s() Active frame is not th" ??_C@_0EE@LFILKAKA@SXS?3?5?$CFs?$CI?$CJ?5Active?5frame?5is?5not?5th@
0x4B284B18: "\Registry\Machine\System\Current" ??_C@_1KM@IAIDLDJP@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2F42C0: "__cdecl _aullshr" __aullshr
0x4B2C9734: "__fastcall RtlpFindUCREntry" @RtlpFindUCREntry@8
0x4B2ABE3E: "__stdcall LdrpLoadShimEngine" _LdrpLoadShimEngine@4
0x4B35CDB0: "__stdcall RtlExtendCorrelationVector" _RtlExtendCorrelationVector@4
0x4B2B2EF0: "__stdcall RtlpWow64SelectSystem32PathInternal" _RtlpWow64SelectSystem32PathInternal@12
0x4B299768: "OsBootstatPath" ??_C@_1BO@IJHFMHE@?$AAO?$AAs?$AAB?$AAo?$AAo?$AAt?$AAs?$AAt?$AAa?$AAt?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x4B281078: "__cdecl RtlpDosCONINDevice" _RtlpDosCONINDevice
0x4B3A1528: "__cdecl LdrpModuleDatatableLock" _LdrpModuleDatatableLock
0x4B2D93D5: "__stdcall RtlpInitEnvironmentBlock" _RtlpInitEnvironmentBlock@0
0x4B3A0938: "__cdecl LdrpLargePageDllKeyHandle" _LdrpLargePageDllKeyHandle
0x4B2F0A60: "__stdcall NtSetInformationObject" _NtSetInformationObject@16
0x4B381C94: "__stdcall TppETWPoolCreate" _TppETWPoolCreate@4
0x4B353DC0: "__stdcall RtlGetProcessHeaps" _RtlGetProcessHeaps@8
0x4B2B50F4: "__stdcall LdrpIsModuleUnderSystem32" _LdrpIsModuleUnderSystem32@4
0x4B2F2780: "__stdcall DbgBreakPoint" _DbgBreakPoint@0
0x4B3697B4: "__stdcall RtlpLogHeapReuseThresholdActivate" _RtlpLogHeapReuseThresholdActivate@12
0x4B2F1550: "__stdcall NtManagePartition" _NtManagePartition@20
0x4B2A53A8: "VirtualAllocdBlocks" ??_C@_0BE@OPMHDBHD@VirtualAllocdBlocks?$AA@
0x4B2F1F10: "__stdcall NtSetTimer2" _NtSetTimer2@16
0x4B2F3CF0: "__cdecl isspace" _isspace
0x4B284CB8: "RtlValidateHeap" ??_C@_0BA@EEJAMNOM@RtlValidateHeap?$AA@
0x4B2F1290: "__stdcall NtFilterTokenEx" _NtFilterTokenEx@56
0x4B368347: "__stdcall RtlpHpStackTraceAddStack" _RtlpHpStackTraceAddStack@8
0x4B3533D0: "__stdcall RtlpVerifyAndCommitUILanguageSettings" _RtlpVerifyAndCommitUILanguageSettings@4
0x4B365C36: "__stdcall RtlpMuiRegGetInstalledLanguageInfoByIndex" _RtlpMuiRegGetInstalledLanguageInfoByIndex@24
0x4B331CF4: "__stdcall LdrpEntrySectionValid" _LdrpEntrySectionValid@8
0x4B285B48: "\Registry\Machine\HARDWARE\DESCR" ??_C@_1IC@DEDEABDL@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAH?$AAA?$AAR?$AAD?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAD?$AAE?$AAS?$AAC?$AAR@
0x4B2E67FD: "__stdcall LdrpUnmapModule" _LdrpUnmapModule@4
0x4B2F1580: "__stdcall NtMapViewOfSectionEx" _NtMapViewOfSectionEx@36
0x4B2F86D0: "__cdecl _except_handler4" __except_handler4
0x4B372EF9: "__stdcall RtlpHpExtrasMove" _RtlpHpExtrasMove@20
0x4B36A83E: "__stdcall RtlpHpTagQueryHeapsRemote" _RtlpHpTagQueryHeapsRemote@12
0x4B2A59F8: "Heap Segment at %p contains inva" ??_C@_0EJ@PPLJAKMP@Heap?5Segment?5at?5?$CFp?5contains?5inva@
0x4B2BCFA0: "__stdcall LdrpSetThreadPreferredLangList" _LdrpSetThreadPreferredLangList@0
0x4B2A7AC0: "__stdcall RtlpTpWaitFinalizationCallback" _RtlpTpWaitFinalizationCallback@8
0x4B3A1494: "__cdecl RtlpUnloadEventTraceEx" _RtlpUnloadEventTraceEx
0x4B365D58: "__stdcall RtlpMuiRegGetString" _RtlpMuiRegGetString@16
0x4B2E8010: "__stdcall RtlIpv6StringToAddressW" _RtlIpv6StringToAddressW@12
0x4B2F1BC0: "__stdcall NtResetWriteWatch" _NtResetWriteWatch@12
0x4B2A4510: " *** enter .exr %p for the excep" ??_C@_0CN@HKDICBKD@?5?$CK?$CK?$CK?5enter?5?4exr?5?$CFp?5for?5the?5excep@
0x4B2E3630: "__stdcall RtlEncodePointer" _RtlEncodePointer@4
0x4B39E3A8: "__cdecl RtlCriticalSectionList" _RtlCriticalSectionList
0x4B342150: "__stdcall RtlGetMultiTimePrecise" _RtlGetMultiTimePrecise@12
0x4B2F4BB0: "__cdecl _snwprintf" __snwprintf
0x4B2CBD00: "__stdcall RtlpLangNameInMultiSzString" _RtlpLangNameInMultiSzString@8
0x4B2A54AC: " This is located in the %s fi" ??_C@_0DJ@DHGOHFOK@?5?5?5?5This?5is?5located?5in?5the?5?$CFs?5fi@
0x4B2DB9A0: "__stdcall RtlWalkFrameChain" _RtlWalkFrameChain@12
0x4B2D4EE0: "__stdcall RtlCreateHeap" _RtlCreateHeap@24
0x4B3489E0: "__stdcall RtlSetInformationAcl" _RtlSetInformationAcl@16
0x4B2F1C20: "__stdcall NtRollbackRegistryTransaction" _NtRollbackRegistryTransaction@8
0x4B2F0880: "__stdcall ZwClearEvent" _ZwClearEvent@4
0x4B335BF4: "__stdcall AVrfCallAPILookupCallback" _AVrfCallAPILookupCallback@20
0x4B361EC3: "__stdcall Normalization__CanCombineWithStartBase" _Normalization__CanCombineWithStartBase@16
0x4B2A6230: "\??\%C:" ??_C@_1BA@ODCEJMMC@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$CF?$AAC?$AA?3?$AA?$AA@
0x4B2F0D00: "__stdcall NtAlpcOpenSenderThread" _NtAlpcOpenSenderThread@24
0x4B2F1B00: "__stdcall NtRegisterThreadTerminatePort" _NtRegisterThreadTerminatePort@4
0x4B3A164C: "__cdecl RtlCriticalSectionLock" _RtlCriticalSectionLock
0x4B2938B0: "Stack trace database size is %Id" ??_C@_0CF@LFMLKFBJ@Stack?5trace?5database?5size?5is?5?$CFId@
0x4B2AAFD0: "__stdcall RtlGetSearchPath" _RtlGetSearchPath@4
0x4B2EBCD0: "__stdcall SwitchedRtlGetVersion_Win8" _SwitchedRtlGetVersion_Win8@0
0x4B2DEEF0: "__stdcall RtlReportSilentProcessExit" _RtlReportSilentProcessExit@8
0x4B2E2955: "__stdcall EtwpCheckForPrivatePreEnable" _EtwpCheckForPrivatePreEnable@4
0x4B2A4188: "This failed because of error %Ix" ??_C@_0CE@HMNCBJMG@This?5failed?5because?5of?5error?5?$CFIx@
0x4B361009: "__stdcall RtlpIsNameInExpressionPrivate" _RtlpIsNameInExpressionPrivate@20
0x4B2AD280: "__stdcall RtlpMuiRegCreateAndLoadRegistryInfo" _RtlpMuiRegCreateAndLoadRegistryInfo@4
0x4B2F0F50: "__stdcall NtCreateKeyedEvent" _NtCreateKeyedEvent@16
0x4B3A0BDC: "__cdecl LdrpAuditIntegrityContinuity" _LdrpAuditIntegrityContinuity
0x4B3A41F4: "__cdecl g_pfnSE_DllUnloaded" _g_pfnSE_DllUnloaded
0x4B2A5854: "RtlSizeHeap" ??_C@_0M@EHEBCDHL@RtlSizeHeap?$AA@
0x4B29362C: "LdrpCheckModule" ??_C@_0BA@CEIOODAC@LdrpCheckModule?$AA@
0x4B2F1C90: "__stdcall ZwSerializeBoot" _ZwSerializeBoot@0
0x4B33FFB9: "__stdcall LdrpGenericProcessRelocation" _LdrpGenericProcessRelocation@16
0x4B292D5C: "FindResource API exit" ??_C@_1CM@IOKBEILG@?$AAF?$AAi?$AAn?$AAd?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAA?$AAP?$AAI?$AA?5?$AAe?$AAx?$AAi?$AAt?$AA?$AA@
0x4B292888: "LPT" ??_C@_17KMAOGHDG@?$AAL?$AAP?$AAT?$AA?$AA@
0x4B35FF20: "__stdcall RtlIdnToNameprepUnicode" _RtlIdnToNameprepUnicode@20
0x4B3A1768: "__cdecl LdrDelegatedLdrInitializeThunk" _LdrDelegatedLdrInitializeThunk
0x4B2A5260: "Signature" ??_C@_09GDNFOKKF@Signature?$AA@
0x4B3A1774: "__cdecl LdrpVehLock" _LdrpVehLock
0x4B372F92: "__stdcall RtlpHpExtrasSetPresent" _RtlpHpExtrasSetPresent@12
0x4B2F0C40: "__stdcall ZwAlpcCreatePortSection" _ZwAlpcCreatePortSection@24
0x4B3052E0: "__stdcall XRestoreSHelper" _XRestoreSHelper@12
0x4B35C0B0: "__stdcall RtlpLeakCallbackRoutine" _RtlpLeakCallbackRoutine@8
0x4B337900: "__stdcall RtlWow64CallFunction64" _RtlWow64CallFunction64@28
0x4B367F71: "__stdcall RtlpHpPerHeapStackTraceCleanup" _RtlpHpPerHeapStackTraceCleanup@12
0x4B292B00: "minkernel\ntdll\ldrdload.c" ??_C@_0BL@BEKOOPEF@minkernel?2ntdll?2ldrdload?4c?$AA@
0x4B2F0780: "__stdcall ZwReadFileScatter" _ZwReadFileScatter@36
0x4B35CB70: "__stdcall RtlEthernetStringToAddressA" _RtlEthernetStringToAddressA@12
0x4B2F05A0: "__stdcall NtOpenKey" _NtOpenKey@12
0x4B2E67C0: "__stdcall RtlAreBitsSet" _RtlAreBitsSet@12
0x4B3A0B98: "__cdecl LdrpWorkInProgress" _LdrpWorkInProgress
0x4B34F720: "__stdcall RtlGetProcessPreferredUILanguages" _RtlGetProcessPreferredUILanguages@16
0x4B34E5C0: "__stdcall RtlQueryRegistryValueWithFallback" _RtlQueryRegistryValueWithFallback@28
0x4B3724C4: "__stdcall RtlpHpApplySegmentHeapConfigurations" _RtlpHpApplySegmentHeapConfigurations@0
0x4B361BE0: "__stdcall NormBuffer__RewindOutputCharacter" _NormBuffer__RewindOutputCharacter@4
0x4B2B691A: "__stdcall LdrpVerifyAlternateResourceModuleEx" _LdrpVerifyAlternateResourceModuleEx@24
0x4B3046F0: "__stdcall NtdllDispatchMessage_W" _NtdllDispatchMessage_W@0
0x4B376340: "__stdcall RtlpHpLfhSubsegmentSizeBlock" _RtlpHpLfhSubsegmentSizeBlock@16
0x4B2F5BEA: "__cdecl _CIatan2" __CIatan2
0x4B2F21A0: "__stdcall ZwWow64CsrIdentifyAlertableThread" _ZwWow64CsrIdentifyAlertableThread@0
0x4B2E94A0: "__stdcall RtlSplay" _RtlSplay@4
0x4B343770: "__stdcall RtlAreAllAccessesGranted" _RtlAreAllAccessesGranted@8
0x4B2F0C30: "__stdcall NtAlpcCreatePort" _NtAlpcCreatePort@12
0x4B296D40: "SXS/RTL: Extended TOC entry arra" ??_C@_0JD@NOBJGCGI@SXS?1RTL?3?5Extended?5TOC?5entry?5arra@
0x4B2F0A80: "__stdcall ZwTraceEvent" _ZwTraceEvent@16
0x4B39E704: "__cdecl LdrpLoaderLock_DEBUG" _LdrpLoaderLock_DEBUG
0x4B28C2B8: "__cdecl NullGuid" _NullGuid
0x4B2DDBF0: "__stdcall LdrGetDllHandleByName" _LdrGetDllHandleByName@12
0x4B2934D0: "Building shim engine DLL system3" ??_C@_0EH@KJIIAHGN@Building?5shim?5engine?5DLL?5system3@
0x4B3A1720: "__cdecl RtlpTestHookInit" _RtlpTestHookInit
0x4B2F5CC0: "__cdecl bsearch_s" _bsearch_s
0x4B2F7EF0: "__cdecl tolower" _tolower
0x4B344DF3: "__stdcall RtlpComputeMergedAcl" _RtlpComputeMergedAcl@40
0x4B2E5BE0: "__stdcall ApiSetQueryApiSetPresence" _ApiSetQueryApiSetPresence@8
0x4B281008: "__cdecl RtlpLegacyApplicationCapabilityNames" _RtlpLegacyApplicationCapabilityNames
0x4B2FC9C8: "__cdecl _getbuf" __getbuf
0x4B2F8AB0: "__cdecl _startTwoArgErrorHandling" __startTwoArgErrorHandling
0x4B3648F0: "__stdcall RtlTraceDatabaseCreate" _RtlTraceDatabaseCreate@20
0x4B348F90: "__stdcall RtlpConvertRelativeToAbsoluteSecurityAttribute" _RtlpConvertRelativeToAbsoluteSecurityAttribute@16
0x4B2D2B80: "__stdcall RtlSetEnvironmentVar" _RtlSetEnvironmentVar@20
0x4B34DB12: "__stdcall RtlBootStatusItemInfo" _RtlBootStatusItemInfo@12
0x4B350140: "__stdcall RtlSetProcessPreferredUILanguages" _RtlSetProcessPreferredUILanguages@12
0x4B2F5B30: "__cdecl _CIatan" __CIatan
0x4B2AD0F2: "__stdcall RtlpGetRegistryHandle" _RtlpGetRegistryHandle@16
0x4B369C69: "__stdcall RtlpPrintErrorInformation" _RtlpPrintErrorInformation@0
0x4B347DD0: "__stdcall RtlpUnWaitCriticalSection" _RtlpUnWaitCriticalSection@4
0x4B3476F0: "__stdcall RtlAcquireReleaseSRWLockExclusive" _RtlAcquireReleaseSRWLockExclusive@4
0x4B2F1DA0: "__stdcall NtSetInformationJobObject" _NtSetInformationJobObject@16
0x4B2F81E0: "__cdecl wcsncpy" _wcsncpy
0x4B2F0DD0: "__stdcall NtCancelWaitCompletionPacket" _NtCancelWaitCompletionPacket@8
0x4B2987E0: "SXS: RtlGetAssemblyStorageRoot()" ??_C@_0FJ@DAEEJIJM@SXS?3?5RtlGetAssemblyStorageRoot?$CI?$CJ@
0x4B34CD70: "__stdcall RtlTestBit" _RtlTestBit@8
0x4B2EB9A0: "__stdcall RtlAllocateWnfSerializationGroup" _RtlAllocateWnfSerializationGroup@0
0x4B2F1FF0: "__stdcall NtSuspendThread" _NtSuspendThread@8
0x4B2B1335: "__stdcall RtlpCombineAcls" _RtlpCombineAcls@32
0x4B2D0566: "__stdcall TppSetupNextWait" _TppSetupNextWait@12
0x4B35BD40: "__stdcall RtlRegisterSecureMemoryCacheCallback" _RtlRegisterSecureMemoryCacheCallback@4
0x4B335250: "__stdcall RtlpQueryProcessDebugInformationRemote" _RtlpQueryProcessDebugInformationRemote@4
0x4B293418: "LdrpLoadShimEngine" ??_C@_0BD@CNLNKGBC@LdrpLoadShimEngine?$AA@
0x4B295444: "verifier.dll" ??_C@_1BK@GKAGNDBG@?$AAv?$AAe?$AAr?$AAi?$AAf?$AAi?$AAe?$AAr?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x4B2B632A: "__stdcall LdrpFindLoadedDllByMapping" _LdrpFindLoadedDllByMapping@16
0x4B2F1D90: "__stdcall ZwSetInformationEnlistment" _ZwSetInformationEnlistment@16
0x4B39E8A4: "__cdecl __mb_cur_max" ___mb_cur_max
0x4B2CB42D: "__stdcall LdrpDereferenceModule" _LdrpDereferenceModule@4
0x4B285608: "\system;" ??_C@_1BC@FJJJFDD@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$DL?$AA?$AA@
0x4B2F09B0: "__stdcall NtQuerySection" _NtQuerySection@20
0x4B32B5E0: "__stdcall RtlSetEnvironmentStrings" _RtlSetEnvironmentStrings@8
0x4B39F941: "__cdecl RtlpRaiseExceptionOnPossibleDeadlock" _RtlpRaiseExceptionOnPossibleDeadlock
0x4B2818BC: "__cdecl LdrpSuppressedExportOverrideList" _LdrpSuppressedExportOverrideList
0x4B331F02: "__stdcall LdrpSaveLocationsSearched" _LdrpSaveLocationsSearched@12
0x4B381470: "__stdcall TppStopWaitCallbackGeneration" _TppStopWaitCallbackGeneration@8
0x4B2F8300: "__cdecl wcsspn" _wcsspn
0x4B2EAFE0: "__stdcall RtlImpersonateSelfEx" _RtlImpersonateSelfEx@12
0x4B2F8010: "__cdecl wcscpy" _wcscpy
0x4B3395C0: "__stdcall WinSqmCheckEscalationAddToStreamEx" _WinSqmCheckEscalationAddToStreamEx@20
0x4B2F5E90: "__cdecl fabs" _fabs
0x4B2F1680: "__stdcall ZwOpenMutant" _ZwOpenMutant@12
0x4B372561: "__stdcall RtlpInitializeLfhBitmapData" _RtlpInitializeLfhBitmapData@4
0x4B2D3CD0: "__stdcall RtlQueryInformationActivationContext" _RtlQueryInformationActivationContext@28
0x4B2F07E0: "__stdcall NtDelayExecution" _NtDelayExecution@8
0x4B2F0EE0: "__stdcall NtCreateEnlistment" _NtCreateEnlistment@32
0x4B32DD6B: "__stdcall LdrpLogIntegrityContinuityTelemetry" _LdrpLogIntegrityContinuityTelemetry@20
0x4B2F4F50: "__cdecl _strupr" __strupr
0x4B28C2C8: "__cdecl SessionNotificationGuid" _SessionNotificationGuid
0x4B347720: "__stdcall RtlConvertSRWLockExclusiveToShared" _RtlConvertSRWLockExclusiveToShared@4
0x4B34A9D0: "__stdcall RtlExtendMemoryZone" _RtlExtendMemoryZone@8
0x4B28144C: "`RtlpGetCustomCultureRegKey'::`2'::ObjAttribute" ?ObjAttribute@?1??RtlpGetCustomCultureRegKey@@9@9
0x4B32AE45: "__stdcall RtlpCheckRelativeDrive" _RtlpCheckRelativeDrive@4
0x4B2EBD40: "__stdcall TpSetPoolStackInformation" _TpSetPoolStackInformation@8
0x4B2CF702: "__stdcall TppCallbackCheckThreadBeforeCallback" _TppCallbackCheckThreadBeforeCallback@4
0x4B3A1B38: "__cdecl RtlpValidateHeapHdrsEnable" _RtlpValidateHeapHdrsEnable
0x4B3699B4: "__stdcall RtlpLogHeapSubSegmentFree" _RtlpLogHeapSubSegmentFree@16
0x4B2A5840: "RtlSetUserFlagsHeap" ??_C@_0BE@BFJGGNKO@RtlSetUserFlagsHeap?$AA@
0x4B287F40: "\Registry\Machine\Software\Polic" ??_C@_1JI@JGOADMNK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc@
0x4B39F0C4: "__cdecl __fastflag" ___fastflag
0x4B2EFE5E: "__stdcall EtwpFindDebugId" _EtwpFindDebugId@16
0x4B339650: "__stdcall WinSqmStartSession" _WinSqmStartSession@12
0x4B36EF00: "__stdcall LZNT1CompressChunk" _LZNT1CompressChunk@28
0x4B2CE03E: "__stdcall TppSingleTimerExpiration" _TppSingleTimerExpiration@12
0x4B2A52D4: "DeCommitTotalFreeThreshold" ??_C@_0BL@NFIJLEAJ@DeCommitTotalFreeThreshold?$AA@
0x4B30083E: "__cdecl _swinput_s" __swinput_s
0x4B2A55CC: "Specified HeapBase (%p) is free " ??_C@_0DB@CMBFOAGN@Specified?5HeapBase?5?$CI?$CFp?$CJ?5is?5free?5@
0x4B295110: "Digital Signage" ??_C@_1CA@NGLLFDHA@?$AAD?$AAi?$AAg?$AAi?$AAt?$AAa?$AAl?$AA?5?$AAS?$AAi?$AAg?$AAn?$AAa?$AAg?$AAe?$AA?$AA@
0x4B35D140: "__stdcall RtlFormatMessage" _RtlFormatMessage@36
0x4B37971A: "__stdcall RtlpHpSegPageRangeComputeLargePageCost" _RtlpHpSegPageRangeComputeLargePageCost@12
0x4B2818E4: "__cdecl RtlCompressBufferProcs" _RtlCompressBufferProcs
0x4B347B23: "__stdcall RtlpInitDeferredCriticalSection" _RtlpInitDeferredCriticalSection@0
0x4B304520: "__stdcall NtdllButtonWndProc_A" _NtdllButtonWndProc_A@0
0x4B37FD10: "__stdcall EvtIntReportEventAndSourceAsync" _EvtIntReportEventAndSourceAsync@44
0x4B2F45A0: "__cdecl _i64toa" __i64toa
0x4B286DF4: "Invalid heap signature for heap " ??_C@_0CG@IEIDBOHE@Invalid?5heap?5signature?5for?5heap?5@
0x4B3A1770: "__cdecl LdrpVchLock" _LdrpVchLock
0x4B2F1720: "__stdcall NtOpenThread" _NtOpenThread@16
0x4B2F22F0: "__stdcall RtlInitializeNtUserPfn" _RtlInitializeNtUserPfn@24
0x4B35BB50: "__stdcall RtlIsGenericTableEmptyAvl" _RtlIsGenericTableEmptyAvl@4
0x4B2937EC: "LdrpInitializeProcess" ??_C@_0BG@DLDBJBKM@LdrpInitializeProcess?$AA@
0x4B297B90: "SXS: %s() - internal coding erro" ??_C@_0FJ@BLBPFMFK@SXS?3?5?$CFs?$CI?$CJ?5?9?5internal?5coding?5erro@
0x4B363F4A: "__stdcall RtlpStdGetSpaceForTrace" _RtlpStdGetSpaceForTrace@8
0x4B37D8D4: "__stdcall EtwpCheckForEnoughStackSpace" _EtwpCheckForEnoughStackSpace@4
0x4B338AC1: "__stdcall WerpProcessId" _WerpProcessId@4
0x4B2B10D0: "__stdcall RtlMapGenericMask" _RtlMapGenericMask@8
0x4B2B258B: "__stdcall RtlpAtomMapAtomToHandleEntry" _RtlpAtomMapAtomToHandleEntry@8
0x4B38180F: "__stdcall TppCheckForTransactions" _TppCheckForTransactions@0
0x4B281CC0: "__cdecl RtlpHeapHeaderFieldOffsets" _RtlpHeapHeaderFieldOffsets
0x4B329FE4: "__stdcall LdrpAppxGetBinaryNameKeyInformation" _LdrpAppxGetBinaryNameKeyInformation@12
0x4B2A5DC8: "svchost.exe" ??_C@_1BI@GOFOEOMC@?$AAs?$AAv?$AAc?$AAh?$AAo?$AAs?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x4B2E26A0: "__stdcall RtlQueryUnbiasedInterruptTime" _RtlQueryUnbiasedInterruptTime@4
0x4B2F07C0: "__stdcall NtEnumerateKey" _NtEnumerateKey@24
0x4B2F1630: "__stdcall NtOpenJobObject" _NtOpenJobObject@12
0x4B2D974C: "__stdcall RtlpWnfRegisterTpNotification" _RtlpWnfRegisterTpNotification@0
0x4B35BB70: "__stdcall RtlLookupElementGenericTableFullAvl" _RtlLookupElementGenericTableFullAvl@16
0x4B32D4A0: "__stdcall LdrpIsCODServiceEnabled" _LdrpIsCODServiceEnabled@0
0x4B304530: "__stdcall NtdllButtonWndProc_W" _NtdllButtonWndProc_W@0
0x4B3A6364: "__cdecl __security_cookie_complement" ___security_cookie_complement
0x4B2E89FA: "__stdcall LdrpCheckNxIncompatibleDllSection" _LdrpCheckNxIncompatibleDllSection@4
0x4B2ADF90: "__stdcall RtlpMuiRegFreeRegistryInfo" _RtlpMuiRegFreeRegistryInfo@8
0x4B35EA85: "__stdcall RtlGuardGrantSuppressedCallAccess" _RtlGuardGrantSuppressedCallAccess@12
0x4B28786C: "BaseThreadInitThunk" ??_C@_0BE@EKFOMHKK@BaseThreadInitThunk?$AA@
0x4B28856C: "ProgramFiles(Arm)" ??_C@_1CE@KAFOGPL@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$CI?$AAA?$AAr?$AAm?$AA?$CJ?$AA?$AA@
0x4B285330: "RtlpResUltimateFallbackInfo Ente" ??_C@_1EE@ICPOECNJ@?$AAR?$AAt?$AAl?$AAp?$AAR?$AAe?$AAs?$AAU?$AAl?$AAt?$AAi?$AAm?$AAa?$AAt?$AAe?$AAF?$AAa?$AAl?$AAl?$AAb?$AAa?$AAc?$AAk?$AAI?$AAn?$AAf?$AAo?$AA?5?$AAE?$AAn?$AAt?$AAe@
0x4B2F3FB0: "__cdecl _allrem" __allrem
0x4B29712C: "RtlpCrackActivationContextString" ??_C@_0CO@GAOBBLME@RtlpCrackActivationContextString@
0x4B304540: "__stdcall NtdllComboBoxWndProc_A" _NtdllComboBoxWndProc_A@0
0x4B2B3710: "__stdcall LdrResFindResourceDirectory" _LdrResFindResourceDirectory@28
0x4B34A7A0: "__stdcall RtlExtendMemoryBlockLookaside" _RtlExtendMemoryBlockLookaside@8
0x4B2F7640: "__cdecl strcspn" _strcspn
0x4B329BFD: "__stdcall LdrpInitializeGraph" _LdrpInitializeGraph@8
0x4B2F0E60: "__stdcall ZwCompleteConnectPort" _ZwCompleteConnectPort@4
0x4B2F0CA0: "__stdcall ZwAlpcDeleteSectionView" _ZwAlpcDeleteSectionView@12
0x4B2BD720: "__stdcall LdrpFindLoadedDllByNameLockHeld" _LdrpFindLoadedDllByNameLockHeld@20
0x4B296848: "[%x.%x] SXS: %s - Relative redir" ??_C@_0EA@OEHGPMAN@?$FL?$CFx?4?$CFx?$FN?5SXS?3?5?$CFs?5?9?5Relative?5redir@
0x4B2F2140: "__stdcall ZwWaitForDebugEvent" _ZwWaitForDebugEvent@16
0x4B287ABC: "SwitchedRtlGetVersion_WinBLUE" ??_C@_1DM@CODBBKPE@?$AAS?$AAw?$AAi?$AAt?$AAc?$AAh?$AAe?$AAd?$AAR?$AAt?$AAl?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA_?$AAW?$AAi?$AAn?$AAB?$AAL?$AAU?$AAE?$AA?$AA@
0x4B357530: "__stdcall RtlCompressBuffer" _RtlCompressBuffer@32
0x4B2EFD18: "__stdcall EtwpProviderArrivalCallback" _EtwpProviderArrivalCallback@8
0x4B36DA00: "__stdcall RtlpGetLowFragHeapMetadataSize" _RtlpGetLowFragHeapMetadataSize@12
0x4B360464: "__stdcall RtlImageNtHeaderEx_ExceptionFilter" _RtlImageNtHeaderEx_ExceptionFilter@8
0x4B2A4A64: "Last known valid blocks: before " ??_C@_0DC@LNNEIMKJ@Last?5known?5valid?5blocks?3?5before?5@
0x4B286AAC: "minkernel\ntdll\ldrsnap.c" ??_C@_0BK@PLPGIOHA@minkernel?2ntdll?2ldrsnap?4c?$AA@
0x4B381DB4: "__stdcall TppETWTimerCancelNtTimer" _TppETWTimerCancelNtTimer@4
0x4B2E9AE0: "__stdcall CsrClientConnectToServer" _CsrClientConnectToServer@20
0x4B330E38: "__stdcall LdrpQueryIllegalCWDDevices" _LdrpQueryIllegalCWDDevices@4
0x4B2F0BF0: "__stdcall ZwAlpcAcceptConnectPort" _ZwAlpcAcceptConnectPort@36
0x4B2F1560: "__stdcall NtMapCMFModule" _NtMapCMFModule@24
0x4B2E7490: "__stdcall RtlPcToFileHeader" _RtlPcToFileHeader@8
0x4B3330E0: "__stdcall RtlCheckSandboxedToken" _RtlCheckSandboxedToken@8
0x4B2D3F86: "__stdcall RtlpGetActivationContextData" _RtlpGetActivationContextData@16
0x4B3A17D8: "__cdecl VsmEnclaveTelemetryInitRunOnce" _VsmEnclaveTelemetryInitRunOnce
0x4B292FA8: "LdrpProtectAndRelocateImage" ??_C@_0BM@PGJKCBEM@LdrpProtectAndRelocateImage?$AA@
0x4B2859B0: "`string'" ??_C@_1IG@IDLMENCF@?$AAC?$AAl?$AAe?$AAa?$AAn?$AAu?$AAp?$AA?5?$AAG?$AAr?$AAo?$AAu?$AAp?$AA?$AA?$AAI?$AAO?$AA?$AA?$AAA?$AAl?$AAp?$AAc?$AA?$AA?$AAP?$AAo?$AAo?$AAl?$AA?$AA?$AAT?$AAi?$AAm?$AAe?$AAr@
0x4B383B90: "__stdcall PssNtFreeSnapshot" _PssNtFreeSnapshot@4
0x4B2923F8: "__cdecl SetLastWin32ErrorEvent" _SetLastWin32ErrorEvent
0x4B37B29F: "__stdcall RtlpHpVsChunkDecommit" _RtlpHpVsChunkDecommit@20
0x4B33FD60: "__stdcall LdrProcessRelocationBlockEx" _LdrProcessRelocationBlockEx@20
0x4B296CE0: "SXS/RTL: Extended TOC offset (%l" ??_C@_0FN@CJKFOBLG@SXS?1RTL?3?5Extended?5TOC?5offset?5?$CI?$CFl@
0x4B2817B0: "__cdecl LdrpCriticalLoaderFunctions" _LdrpCriticalLoaderFunctions
0x4B2F0990: "__stdcall NtIsProcessInJob" _NtIsProcessInJob@8
0x4B2E8290: "__stdcall RtlSetProtectedPolicy" _RtlSetProtectedPolicy@12
0x4B35965F: "__stdcall RtlpComputeCrcInternal" _RtlpComputeCrcInternal@20
0x4B2A4A54: "Parameter3: %p " ??_C@_0BA@KMLINNFI@Parameter3?3?5?$CFp?6?$AA@
0x4B39F3A0: "__cdecl RtlpHeapStopOn" _RtlpHeapStopOn
0x4B357EE0: "__stdcall RtlExpandHashTable" _RtlExpandHashTable@4
0x4B2F0510: "__stdcall NtRemoveIoCompletion" _NtRemoveIoCompletion@20
0x4B2F40C0: "__cdecl _atoi64" __atoi64
0x4B35FEDE: "__stdcall IsAnyDot" _IsAnyDot@4
0x4B2B0674: "__stdcall RtlpInheritAcl2" _RtlpInheritAcl2@72
0x4B3395B0: "__stdcall WinSqmAddToStreamEx" _WinSqmAddToStreamEx@20
0x4B2951FC: "Printing" ??_C@_1BC@BDONHKCN@?$AAP?$AAr?$AAi?$AAn?$AAt?$AAi?$AAn?$AAg?$AA?$AA@
0x4B364D70: "__stdcall RtlpTraceDatabaseInternalFind" _RtlpTraceDatabaseInternalFind@16
0x4B2A3F20: "<unknown>" ??_C@_1BE@ELICABCK@?$AA?$DM?$AAu?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$DO?$AA?$AA@
0x4B2F1EF0: "__stdcall NtSetSystemTime" _NtSetSystemTime@8
0x4B2F20E0: "__stdcall ZwUnlockVirtualMemory" _ZwUnlockVirtualMemory@16
0x4B2F1F60: "__stdcall NtSetWnfProcessNotificationEvent" _NtSetWnfProcessNotificationEvent@4
0x4B35942B: "__stdcall RtlpGetLegacyContextLength" _RtlpGetLegacyContextLength@12
0x4B380670: "__stdcall TppIopCancelPendingCallbacks" _TppIopCancelPendingCallbacks@4
0x4B381CF2: "__stdcall TppETWPoolThreadMax" _TppETWPoolThreadMax@8
0x4B288200: "NUL" ??_C@_17CLELIOII@?$AAN?$AAU?$AAL?$AA?$AA@
0x4B2A3688: "!(CheckedFlags & ~HEAP_CREATE_VA" ??_C@_0CK@BNECCOKI@?$CB?$CICheckedFlags?5?$CG?5?$HOHEAP_CREATE_VA@
0x4B2A7960: "__stdcall RtlDeregisterWaitEx" _RtlDeregisterWaitEx@8
0x4B2F2060: "__stdcall NtTraceControl" _NtTraceControl@24
0x4B2F15A0: "__stdcall NtModifyDriverEntry" _NtModifyDriverEntry@4
0x4B2A3A2C: "--------------------------------" ??_C@_0CJ@NAGLDNBO@?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9?9@
0x4B2858F0: "%s" ??_C@_15GANGMFKL@?$AA?$CF?$AAs?$AA?$AA@
0x4B2A7320: "__stdcall TpCallbackSendAlpcMessageOnCompletion" _TpCallbackSendAlpcMessageOnCompletion@16
0x4B338EFF: "__cdecl StringCchPrintfW" _StringCchPrintfW
0x4B2F3AB0: "__cdecl __isascii" ___isascii
0x4B2F11C0: "__stdcall ZwDeleteWnfStateData" _ZwDeleteWnfStateData@8
0x4B3A14A8: "__cdecl LdrpReleaseActCtxW" _LdrpReleaseActCtxW
0x4B2D0EC9: "__stdcall TppFastAlpcAdjustConcurrencyCount" _TppFastAlpcAdjustConcurrencyCount@4
0x4B382F16: "__stdcall SbGetContextDetailsById" _SbGetContextDetailsById@8
0x4B2B83D1: "__stdcall RtlCaptureImageExceptionValues" _RtlCaptureImageExceptionValues@12
0x4B29363C: "Loading the shim engine DLL "%wZ" ??_C@_0DO@CNLHHAHI@Loading?5the?5shim?5engine?5DLL?5?$CC?$CFwZ@
0x4B2E9670: "__stdcall RtlValidRelativeSecurityDescriptor" _RtlValidRelativeSecurityDescriptor@12
0x4B29401C: "VerifierActivationFilter found, " ??_C@_0DC@DFDBKLK@VerifierActivationFilter?5found?0?5@
0x4B2A5890: "RtlQueryTagHeap" ??_C@_0BA@HKHCLDPA@RtlQueryTagHeap?$AA@
0x4B297008: "SXS: String hash collision chain" ??_C@_0EF@BKMLODDA@SXS?3?5String?5hash?5collision?5chain@
0x4B37ABEF: "__stdcall RtlSparseArrayElementAllocated" _RtlSparseArrayElementAllocated@8
0x4B33A5C0: "__stdcall RtlSetSearchPathMode" _RtlSetSearchPathMode@4
0x4B381FB4: "__stdcall TppETWTimerSet" _TppETWTimerSet@8
0x4B2A3AF4: "::" ??_C@_02MOLJINC@?3?3?$AA@
0x4B304C80: "__stdcall RtlExtendedMagicDivide" _RtlExtendedMagicDivide@20
0x4B342D20: "__stdcall RtlAddAttributeActionToRXact" _RtlAddAttributeActionToRXact@32
0x4B359640: "__stdcall RtlCrc64" _RtlCrc64@16
0x4B32A38A: "__stdcall LdrpFixSectionProtection" _LdrpFixSectionProtection@12
0x4B2EA400: "__stdcall LdrpInitializePerUserWindowsDirectory" _LdrpInitializePerUserWindowsDirectory@4
0x4B2F0407: "__stdcall EtwpReferenceUmGuidEntry" _EtwpReferenceUmGuidEntry@4
0x4B2878BC: "KernelbasePostInit" ??_C@_0BD@IGFABMDG@KernelbasePostInit?$AA@
0x4B2FD930: "__cdecl memcpy_s" _memcpy_s
0x4B343300: "__stdcall RtlSelfRelativeToAbsoluteSD" _RtlSelfRelativeToAbsoluteSD@44
0x4B2866DC: "(null)" ??_C@_06OJHGLDPL@?$CInull?$CJ?$AA@
0x4B288000: "MSCOREE.DLL" ??_C@_1BI@LLJGJDCD@?$AAM?$AAS?$AAC?$AAO?$AAR?$AAE?$AAE?$AA?4?$AAD?$AAL?$AAL?$AA?$AA@
0x4B37E3F1: "__stdcall EtwpRegisterPrivateSession" _EtwpRegisterPrivateSession@12
0x4B296DD8: "SXS/RTL: Extended TOC section TO" ??_C@_0HE@FMALJPDA@SXS?1RTL?3?5Extended?5TOC?5section?5TO@
0x4B2F60D0: "__cdecl iswdigit" _iswdigit
0x4B341620: "__stdcall RtlInitCodePageTable" _RtlInitCodePageTable@8
0x4B3821BC: "__stdcall TppWorkerpInnerExceptionFilter" _TppWorkerpInnerExceptionFilter@12
0x4B2F08E0: "__stdcall NtQueryDefaultUILanguage" _NtQueryDefaultUILanguage@4
0x4B2F21D0: "__stdcall NtWow64CsrFreeCaptureBuffer" _NtWow64CsrFreeCaptureBuffer@4
0x4B2A4A98: "Stack trace available at %p " ??_C@_0BN@JKLCHGJG@Stack?5trace?5available?5at?5?$CFp?6?$AA@
0x4B2F3D20: "__cdecl isupper" _isupper
0x4B39F640: "__cdecl RtlpHpGCInterval" _RtlpHpGCInterval
0x4B285D90: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x4B299A6C: "" ??_C@_15EODNFOFM@?$AA?$AA?$AA?$AA?$AA?$AA@
0x4B378740: "__stdcall RtlpHpSegLfhVsFree" _RtlpHpSegLfhVsFree@16
0x4B3748A3: "__stdcall RtlpHpLfhBucketAllocateSlot" _RtlpHpLfhBucketAllocateSlot@12
0x4B2E57D4: "__stdcall RtlULongLongToULong" _RtlULongLongToULong@12
0x4B3044D0: "__stdcall NtdllDefWindowProc_W" _NtdllDefWindowProc_W@0
0x4B2819C0: "__cdecl LdrpDelegatedNtdllExports" _LdrpDelegatedNtdllExports
0x4B39E7B0: "__cdecl LdrpDebugFlags" _LdrpDebugFlags
0x4B2EBC10: "__stdcall WinSqmEventEnabled" _WinSqmEventEnabled@8
0x4B297DB8: "SXS: Assembly storage root locat" ??_C@_0DO@GMJKBOLI@SXS?3?5Assembly?5storage?5root?5locat@
0x4B339600: "__stdcall WinSqmCommonDatapointSetString" _WinSqmCommonDatapointSetString@12
0x4B2C1F00: "__stdcall RtlAllocateHeap" _RtlAllocateHeap@12
0x4B3051BB: FinalExceptionHandlerPad11
0x4B33B987: "long __stdcall InsertModuleFunctions<struct _IMAGE_THUNK_DATA32,unsigned long,2147483648>(struct _IMPORTTABLEP_IMPORTTABLEP_SORTED_LIST_ENTRY *,void *,struct _IMAGE_NT_HEADERS *,struct _IMAGE_IMPORT_DESCRIPTOR *)" ??$InsertModuleFunctions@U_IMAGE_THUNK_DATA32@@K$0IAAAAAAA@@@YGJPAU_IMPORTTABLEP_IMPORTTABLEP_SORTED_LIST_ENTRY@@PAXPAU_IMAGE_NT_HEADERS@@PAU_IMAGE_IMPORT_DESCRIPTOR@@@Z
0x4B3051C5: FinalExceptionHandlerPad21
0x4B3051CF: FinalExceptionHandlerPad31
0x4B358960: "__stdcall RtlInitializeExtendedContext" _RtlInitializeExtendedContext@12
0x4B3051D9: FinalExceptionHandlerPad41
0x4B2F0D60: "__stdcall NtAreMappedFilesTheSame" _NtAreMappedFilesTheSame@8
0x4B3051E3: FinalExceptionHandlerPad51
0x4B3051ED: FinalExceptionHandlerPad61
0x4B2ED400: "__stdcall RtlDeriveCapabilitySidsFromName" _RtlDeriveCapabilitySidsFromName@12
0x4B339870: "__stdcall RtlUnsubscribeWnfNotificationWithCompletionCallback" _RtlUnsubscribeWnfNotificationWithCompletionCallback@12
0x4B36D187: "__stdcall RtlpInitializeUCRIndex" _RtlpInitializeUCRIndex@4
0x4B28B7B4: "\Registry\User\.Default" ??_C@_1DA@PDHFOJA@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAU?$AAs?$AAe?$AAr?$AA?2?$AA?4?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$AA@
0x4B2B71B0: "__stdcall RtlLoadString" _RtlLoadString@32
0x4B332290: "__stdcall RtlLockMemoryStreamRegion" _RtlLockMemoryStreamRegion@24
0x4B28C4E0: "__cdecl SHA256Magic" _SHA256Magic
0x4B3A17F0: "__cdecl LdrDelegatedKiUserExceptionDispatcher" _LdrDelegatedKiUserExceptionDispatcher
0x4B384B93: "__stdcall PsspCaptureHandleInformation" _PsspCaptureHandleInformation@12
0x4B3044C0: "__stdcall NtdllDefWindowProc_A" _NtdllDefWindowProc_A@0
0x4B2936EC: "Failed to reallocate the system " ??_C@_0CP@NLJGIEGK@Failed?5to?5reallocate?5the?5system?5@
0x4B2F1110: "__stdcall ZwCreateWorkerFactory" _ZwCreateWorkerFactory@40
0x4B2F3636: "__cdecl _log_default" __log_default
0x4B2925D0: "\PackageList\" ??_C@_1BM@LMNMHOPK@?$AA?2?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAL?$AAi?$AAs?$AAt?$AA?2?$AA?$AA@
0x4B295A20: "AVRF: warning: did not find `%s'" ??_C@_0DD@MHGHFDKB@AVRF?3?5warning?3?5did?5not?5find?5?$GA?$CFs?8@
0x4B32A710: "__stdcall RtlQueryThreadProfiling" _RtlQueryThreadProfiling@8
0x4B2F1DC0: "__stdcall NtSetInformationResourceManager" _NtSetInformationResourceManager@16
0x4B39F264: "__cdecl RtlpHpEnvEnableSimulatedLargePageCommit" _RtlpHpEnvEnableSimulatedLargePageCommit
0x4B36825B: "__stdcall RtlpHpStackDbLogStackDbEnd" _RtlpHpStackDbLogStackDbEnd@8
0x4B336C4F: "__stdcall AVrfpQueryProcessVerifierOptions" _AVrfpQueryProcessVerifierOptions@4
0x4B2F0ED0: "__stdcall NtCreateEnclave" _NtCreateEnclave@36
0x4B2F1330: "__stdcall NtFreezeTransactions" _NtFreezeTransactions@8
0x4B2A7635: "__stdcall RtlpReferenceCurrentDirectory" _RtlpReferenceCurrentDirectory@4
0x4B2F0AE0: "__stdcall ZwAccessCheckByTypeResultList" _ZwAccessCheckByTypeResultList@44
0x4B298998: "'LDR: %s(), invalid image format" ??_C@_0CP@LBPMLGDA@?8LDR?3?5?$CFs?$CI?$CJ?0?5invalid?5image?5format@
0x4B2935DC: "LdrInitShimEngineDynamic" ??_C@_0BJ@BOHBJMIK@LdrInitShimEngineDynamic?$AA@
0x4B299AAC: "LanguageConfigurationPending" ??_C@_1DK@DKGPACEB@?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAP?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?$AA@
0x4B2E2DE7: "__stdcall RtlpUpdateTEBLanguage" _RtlpUpdateTEBLanguage@12
0x4B2884CC: "__APPDIR__" ??_C@_1BG@NDKGHADL@?$AA_?$AA_?$AAA?$AAP?$AAP?$AAD?$AAI?$AAR?$AA_?$AA_?$AA?$AA@
0x4B2E2D26: "__stdcall RtlpInitializeUserList" _RtlpInitializeUserList@4
0x4B2887B8: "\Registry\Machine\System\Current" ??_C@_1JE@LLECADPK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2AB7FE: "__fastcall RtlpSearchUCRBlock" @RtlpSearchUCRBlock@8
0x4B2B5F70: "__stdcall LdrGetDllFullName" _LdrGetDllFullName@8
0x4B374F26: "__stdcall RtlpHpLfhContextLockUnlock" _RtlpHpLfhContextLockUnlock@8
0x4B2F2150: "__stdcall ZwWaitForKeyedEvent" _ZwWaitForKeyedEvent@16
0x4B2F04F0: "__stdcall NtDeviceIoControlFile" _NtDeviceIoControlFile@40
0x4B2F1400: "__stdcall ZwImpersonateAnonymousToken" _ZwImpersonateAnonymousToken@4
0x4B2F1F70: "__stdcall NtShutdownSystem" _NtShutdownSystem@4
0x4B285988: "Unknown" ??_C@_1BA@LEPJIIOK@?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$AA@
0x4B2F16A0: "__stdcall ZwOpenPartition" _ZwOpenPartition@12
0x4B374603: "__stdcall RtlpHpSizeHeapInternal" _RtlpHpSizeHeapInternal@16
0x4B304700: "__stdcall NtdllMDIActivateDlgProc_A" _NtdllMDIActivateDlgProc_A@0
0x4B2A3BC8: ":%u" ??_C@_17IFFAKLAI@?$AA?3?$AA?$CF?$AAu?$AA?$AA@
0x4B2F3576: "__cdecl _cos_default" __cos_default
0x4B2F1E50: "__stdcall ZwSetIoCompletionEx" _ZwSetIoCompletionEx@24
0x4B2E2FA0: "__stdcall RtlCreateUnicodeString" _RtlCreateUnicodeString@8
0x4B34CD40: "__stdcall RtlSetBit" _RtlSetBit@8
0x4B34C980: "__stdcall RtlNumberOfClearBits" _RtlNumberOfClearBits@4
0x4B2F2210: "__stdcall ZwWow64CsrGetProcessId" _ZwWow64CsrGetProcessId@0
0x4B357DC0: "__stdcall RtlEndEnumerationHashTable" _RtlEndEnumerationHashTable@8
0x4B37A350: "__stdcall RtlpHpSegVsAllocate" _RtlpHpSegVsAllocate@20
0x4B39F604: "__cdecl RtlpStackTraceDatabase" _RtlpStackTraceDatabase
0x4B37AFDF: "__stdcall RtlpHpVsChunkAlignSplit" _RtlpHpVsChunkAlignSplit@12
0x4B2B27E9: "__stdcall RtlpAllocateAtomTableEntry" _RtlpAllocateAtomTableEntry@12
0x4B2D68B3: "__stdcall RtlpSecMemFreeVirtualMemory" _RtlpSecMemFreeVirtualMemory@16
0x4B39F6A0: "__cdecl RtlpProcessHeapsListBuffer" _RtlpProcessHeapsListBuffer
0x4B2F0720: "__stdcall NtMapViewOfSection" _NtMapViewOfSection@40
0x4B2B2170: "__stdcall RtlAddAtomToAtomTable" _RtlAddAtomToAtomTable@12
0x4B2DCDD0: "__stdcall RtlpTpRevertCapture" _RtlpTpRevertCapture@8
0x4B2885E8: "CommonProgramW6432" ??_C@_1CG@NMMNPOME@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAW?$AA6?$AA4?$AA3?$AA2?$AA?$AA@
0x4B2F1130: "__stdcall NtDebugContinue" _NtDebugContinue@12
0x4B33BE95: "__stdcall CsrCaptureMessageUnicodeStringInPlace" _CsrCaptureMessageUnicodeStringInPlace@8
0x4B2E0D1C: "__stdcall LdrpDestroyNode" _LdrpDestroyNode@4
0x4B2F1880: "__stdcall NtQueryEaFile" _NtQueryEaFile@36
0x4B38263E: "__stdcall RtlpTpIoAlloc" _RtlpTpIoAlloc@12
0x4B2950B8: "Industry Tablet" ??_C@_1CA@LAHCJKMK@?$AAI?$AAn?$AAd?$AAu?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAT?$AAa?$AAb?$AAl?$AAe?$AAt?$AA?$AA@
0x4B2F4620: "__cdecl _ui64toa" __ui64toa
0x4B2F1BA0: "__stdcall NtRequestPort" _NtRequestPort@8
0x4B37F656: "__stdcall EtwpAddDebugInfoEvents" _EtwpAddDebugInfoEvents@12
0x4B3A184C: "__cdecl g_SxsLiveActivationContexts" _g_SxsLiveActivationContexts
0x4B2BD850: "__stdcall RtlHashUnicodeString" _RtlHashUnicodeString@16
0x4B358F46: "__stdcall RtlpCopyLegacyContextArm" _RtlpCopyLegacyContextArm@16
0x4B28852C: "ProgramFiles(x86)" ??_C@_1CE@EAPHGJBI@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x4B288610: "CommonProgramFiles(Arm)" ??_C@_1DA@JJLPEGKB@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$CI?$AAA?$AAr?$AAm?$AA?$CJ?$AA?$AA@
0x4B2A3D3C: "en-US" ??_C@_1M@BMHNFIME@?$AAe?$AAn?$AA?9?$AAU?$AAS?$AA?$AA@
0x4B339670: "__stdcall RtlQueryWnfMetaNotification" _RtlQueryWnfMetaNotification@20
0x4B2930EC: "LdrpChildNtdll" ??_C@_0P@EMJHOMLH@LdrpChildNtdll?$AA@
0x4B2DC1C9: "__stdcall RtlpFreeActivationContextStackFrame" _RtlpFreeActivationContextStackFrame@8
0x4B2F0760: "__stdcall NtTerminateProcess" _NtTerminateProcess@8
0x4B36C232: "__stdcall RtlDebugSizeHeap" _RtlDebugSizeHeap@12
0x4B2F2910: "__stdcall KiUserExceptionDispatcher" _KiUserExceptionDispatcher@8
0x4B39FDD8: "__cdecl LoadAsDataTable" _LoadAsDataTable
0x4B2AC80E: "__stdcall AVrfDllLoadNotification" _AVrfDllLoadNotification@4
0x4B2A3ADC: "::ffff:0:%u.%u.%u.%u" ??_C@_0BF@DFCHPNNC@?3?3ffff?30?3?$CFu?4?$CFu?4?$CFu?4?$CFu?$AA@
0x4B37B4B1: "__stdcall RtlpHpVsChunkSetExtraPresent" _RtlpHpVsChunkSetExtraPresent@12
0x4B3A16F4: "__cdecl RtlpHpTagInitVar" _RtlpHpTagInitVar
0x4B2B56E0: "__stdcall LdrpSearchPath" _LdrpSearchPath@36
0x4B2876CC: "__stdcall _imp__ZwCreateKey" __imp__ZwCreateKey@28
0x4B3790E2: "__stdcall RtlpHpSegMgrVaCtxInsert" _RtlpHpSegMgrVaCtxInsert@8
0x4B353940: "__stdcall RtlIoEncodeMemIoResource" _RtlIoEncodeMemIoResource@40
0x4B34DF70: "__stdcall RtlRestoreBootStatusDefaults" _RtlRestoreBootStatusDefaults@4
0x4B2946B8: "Querying the active activation c" ??_C@_0ED@FIHNAPML@Querying?5the?5active?5activation?5c@
0x4B2A4810: "heap_failure_internal" ??_C@_0BG@GIBBAKDF@heap_failure_internal?$AA@
0x4B2F1260: "__stdcall NtExtendSection" _NtExtendSection@8
0x4B3A1738: "__cdecl LibLoaderTelemetryInitRunOnce" _LibLoaderTelemetryInitRunOnce
0x4B2F0FF0: "__stdcall NtCreateProfile" _NtCreateProfile@36
0x4B2A9D90: "__stdcall RtlUnicodeStringToOemString" _RtlUnicodeStringToOemString@12
0x4B29319C: "\SystemRoot\system32\" ??_C@_1CM@ICHMMDGI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AA?$AA@
0x4B2F0DE0: "__stdcall NtCommitComplete" _NtCommitComplete@8
0x4B2F1430: "__stdcall ZwInitializeNlsFiles" _ZwInitializeNlsFiles@12
0x4B34D890: "__stdcall RtlInt64ToUnicodeString" _RtlInt64ToUnicodeString@16
0x4B2B2630: "__stdcall RtlpInsertStringAtom" _RtlpInsertStringAtom@8
0x4B2F1A30: "__stdcall NtQuerySystemEnvironmentValueEx" _NtQuerySystemEnvironmentValueEx@20
0x4B2F47F0: "__cdecl _ui64tow" __ui64tow
0x4B2EC6D0: "__stdcall RtlCheckTokenCapability" _RtlCheckTokenCapability@12
0x4B34C9A0: "__stdcall RtlNumberOfClearBitsInRange" _RtlNumberOfClearBitsInRange@12
0x4B3A16A8: "__cdecl RtlpHpStackTraceProviderHandle" _RtlpHpStackTraceProviderHandle
0x4B2CB893: "__stdcall LdrpDecrementModuleLoadCountEx" _LdrpDecrementModuleLoadCountEx@8
0x4B295A54: "AVRF: (%ws) %s export found. " ??_C@_0BP@JECDKHLN@AVRF?3?5?$CI?$CFws?$CJ?5?$CFs?5export?5found?4?5?6?$AA@
0x4B2D0E00: "__stdcall TppAlpcpExecuteCallback" _TppAlpcpExecuteCallback@16
0x4B3812D7: "__stdcall TppAdjustRunningThreadGoal" _TppAdjustRunningThreadGoal@4
0x4B2F4070: "__cdecl _allshl" __allshl
0x4B2BD906: "__stdcall LdrpLogDllState" _LdrpLogDllState@12
0x4B367E53: "__stdcall RtlpHeapLogRangeReserve" _RtlpHeapLogRangeReserve@12
0x4B2881DC: "\\?" ??_C@_17ELFAOGGE@?$AA?2?$AA?2?$AA?$DP?$AA?$AA@
0x4B357BC0: "__stdcall RtlContractHashTable" _RtlContractHashTable@4
0x4B2F8AC7: "__cdecl _startOneArgErrorHandling" __startOneArgErrorHandling
0x4B294424: "_NO_DEBUG_HEAP" ??_C@_1BO@IADKKJID@?$AA_?$AAN?$AAO?$AA_?$AAD?$AAE?$AAB?$AAU?$AAG?$AA_?$AAH?$AAE?$AAA?$AAP?$AA?$AA@
0x4B3A1800: "__cdecl LdrParentRtlResetNtUserPfn" _LdrParentRtlResetNtUserPfn
0x4B2A4828: "heap_failure_unknown" ??_C@_0BF@BAOFEOOI@heap_failure_unknown?$AA@
0x4B3A17B4: "__cdecl RtlpLFHKey" _RtlpLFHKey
0x4B39E8FC: "__cdecl LdrpPolicyBits" _LdrpPolicyBits
0x4B2DEC7B: "__stdcall RtlUnicodeStringCat" _RtlUnicodeStringCat@8
0x4B2EBD20: "__stdcall RtlEncodeSystemPointer" _RtlEncodeSystemPointer@4
0x4B3437B0: "__stdcall RtlCapabilityCheckForSingleSessionSku" _RtlCapabilityCheckForSingleSessionSku@12
0x4B379322: "__stdcall RtlpHpSegPageRangeCoalesce" _RtlpHpSegPageRangeCoalesce@20
0x4B2E91D0: "__stdcall TppIopExecuteCallback" _TppIopExecuteCallback@16
0x4B284738: "__cdecl RtlpCheckTokenCapabilityGenericMapping" _RtlpCheckTokenCapabilityGenericMapping
0x4B3A0925: "__cdecl LdrpForkInProgress" _LdrpForkInProgress
0x4B2F1940: "__stdcall ZwQueryIntervalProfile" _ZwQueryIntervalProfile@8
0x4B2D66C1: "__fastcall RtlpCollectFreeBlocks" @RtlpCollectFreeBlocks@4
0x4B34A4D0: "__stdcall RtlImageRvaToSection" _RtlImageRvaToSection@12
0x4B36D786: "__fastcall RtlpSubSegmentDebugInitialize" @RtlpSubSegmentDebugInitialize@28
0x4B33C138: "__fastcall RtlpInterlockedFlushSList" @RtlpInterlockedFlushSList@4
0x4B2F4EA0: "__cdecl _stricmp" __stricmp
0x4B2FB190: "__stdcall RaiseException" _RaiseException@16
0x4B292A14: "__cdecl LdrpComPlusVersionName" _LdrpComPlusVersionName
0x4B2E6DF0: "__stdcall RtlInitializeSListHead" _RtlInitializeSListHead@4
0x4B2F1D60: "__stdcall ZwSetHighWaitLowEventPair" _ZwSetHighWaitLowEventPair@4
0x4B2CDC50: "__stdcall TppTimerQueueExpiration" _TppTimerQueueExpiration@16
0x4B34E530: "__stdcall RtlDeleteRegistryValue" _RtlDeleteRegistryValue@12
0x4B37AB89: "__stdcall RtlSparseArrayElementAllocate" _RtlSparseArrayElementAllocate@12
0x4B2F3C00: "__cdecl isdigit" _isdigit
0x4B2CA420: "__stdcall RtlCompareUnicodeStrings" _RtlCompareUnicodeStrings@20
0x4B2E4720: "__stdcall RtlActivateActivationContextEx" _RtlActivateActivationContextEx@16
0x4B2D85CD: "__stdcall EtwpSetProviderTraits" _EtwpSetProviderTraits@16
0x4B2EE32B: "__stdcall EtwpAddLogHeaderToLogFile" _EtwpAddLogHeaderToLogFile@16
0x4B2F0B30: "__stdcall NtAddBootEntry" _NtAddBootEntry@8
0x4B2A540C: "FreeLists" ??_C@_09NCNJPMEA@FreeLists?$AA@
0x4B2F1460: "__stdcall ZwIsSystemResumeAutomatic" _ZwIsSystemResumeAutomatic@0
0x4B2F0930: "__stdcall ZwQueryVolumeInformationFile" _ZwQueryVolumeInformationFile@20
0x4B2F3F50: "__cdecl _alloca_probe" __alloca_probe
0x4B2C0F90: "__stdcall RtlFindCharInUnicodeString" _RtlFindCharInUnicodeString@16
0x4B2C790B: "__stdcall RtlpReAllocateHeapInternal" _RtlpReAllocateHeapInternal@24
0x4B2AD260: "__stdcall RtlpMuiRegCreateRegistryInfo" _RtlpMuiRegCreateRegistryInfo@0
0x4B2ADC6D: "__stdcall RtlpMuiRegAddLanguageByName" _RtlpMuiRegAddLanguageByName@24
0x4B37578E: "__stdcall RtlpHpLfhSubsegmentCountEmptyUnits" _RtlpHpLfhSubsegmentCountEmptyUnits@4
0x4B2876B8: "__stdcall _imp__NtClose" __imp__NtClose@4
0x4B2F1670: "__stdcall ZwOpenKeyedEvent" _ZwOpenKeyedEvent@12
0x4B303CA8: "__stdcall LdrpFreeReplacedModule" _LdrpFreeReplacedModule@4
0x4B2F0018: "__stdcall EtwpUpdatePrivateEnableInfo" _EtwpUpdatePrivateEnableInfo@4
0x4B2947D8: "LdrpPrepareModuleForExecution" ??_C@_0BO@EEABNODO@LdrpPrepareModuleForExecution?$AA@
0x4B2F1AC0: "__stdcall ZwRecoverEnlistment" _ZwRecoverEnlistment@8
0x4B2B6E09: "__stdcall GetOverlayRootFolder" _GetOverlayRootFolder@12
0x4B2DF4E0: "__stdcall RtlFlsAlloc" _RtlFlsAlloc@8
0x4B39FE90: "__cdecl LdrpOriginalAppPackagesPath" _LdrpOriginalAppPackagesPath
0x4B3476A9: "__stdcall RtlpValidTrustSubjectContext" _RtlpValidTrustSubjectContext@16
0x4B2F1D70: "__stdcall NtSetIRTimer" _NtSetIRTimer@8
0x4B3607E0: "__stdcall RtlRemoteCall" _RtlRemoteCall@28
0x4B298C28: "LdrpResSearchResourceHandle Exit" ??_C@_1EC@EOGKALAO@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAH?$AAa?$AAn?$AAd?$AAl?$AAe?$AA?5?$AAE?$AAx?$AAi?$AAt@
0x4B2D7450: "__stdcall RtlDeleteCriticalSection" _RtlDeleteCriticalSection@4
0x4B3A17B8: "__cdecl TppPoolpGlobalPoolStackSize" _TppPoolpGlobalPoolStackSize
0x4B35BA60: "__stdcall RtlGetElementGenericTableAvl" _RtlGetElementGenericTableAvl@8
0x4B36059B: "__stdcall RtlpOptimizeConditionVariableWaitList" _RtlpOptimizeConditionVariableWaitList@8
0x4B2F1BD0: "__stdcall ZwRestoreKey" _ZwRestoreKey@12
0x4B2F1150: "__stdcall ZwDeleteBootEntry" _ZwDeleteBootEntry@4
0x4B2F1ED0: "__stdcall NtSetSystemInformation" _NtSetSystemInformation@12
0x4B28C2B0: "__cdecl EtwpOneSecond" _EtwpOneSecond
0x4B3A14B0: "__cdecl g_ShimsEnabled" _g_ShimsEnabled
0x4B342CA0: "__stdcall RtlAbortRXact" _RtlAbortRXact@4
0x4B2FCE50: "__cdecl _ltow_s" __ltow_s
0x4B2D81AF: "__stdcall RtlpSubscribeWnfStateChangeNotificationInternal" _RtlpSubscribeWnfStateChangeNotificationInternal@40
0x4B2F7FD0: "__cdecl wcscat" _wcscat
0x4B2F11E0: "__stdcall ZwDisableLastKnownGood" _ZwDisableLastKnownGood@0
0x4B33179C: "__stdcall LdrpBuildImportRedirection" _LdrpBuildImportRedirection@8
0x4B2F2040: "__stdcall NtThawRegistry" _NtThawRegistry@0
0x4B373C15: "__stdcall RtlpHpHeapReportCounters" _RtlpHpHeapReportCounters@8
0x4B2884BC: "__CD__" ??_C@_1O@KHNIOJEM@?$AA_?$AA_?$AAC?$AAD?$AA_?$AA_?$AA?$AA@
0x4B357810: "__stdcall RtlConnectToSm" _RtlConnectToSm@16
0x4B362801: "__stdcall Normalization__Normalize" _Normalization__Normalize@24
0x4B2D4DA0: "__stdcall RtlQueryInformationActiveActivationContext" _RtlQueryInformationActiveActivationContext@16
0x4B284A58: "PreferredUILanguages" ??_C@_1CK@CDBMDBEP@?$AAP?$AAr?$AAe?$AAf?$AAe?$AAr?$AAr?$AAe?$AAd?$AAU?$AAI?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAs?$AA?$AA@
0x4B2F0680: "__stdcall ZwFreeVirtualMemory" _ZwFreeVirtualMemory@16
0x4B285A50: "Kernel-OneCore-DeviceFamilyID" ??_C@_1DM@KIMGBAPO@?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AA?9?$AAO?$AAn?$AAe?$AAC?$AAo?$AAr?$AAe?$AA?9?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAF?$AAa?$AAm?$AAi?$AAl?$AAy?$AAI?$AAD?$AA?$AA@
0x4B2EBDE0: "__stdcall MatchAll" _MatchAll@12
0x4B2B2B00: "__stdcall RtlpInitCurrentDir" _RtlpInitCurrentDir@4
0x4B2B1A59: "__stdcall RtlpMuiRegCreateLanguageConfigList" _RtlpMuiRegCreateLanguageConfigList@4
0x4B2F06E0: "__stdcall ZwOpenThreadToken" _ZwOpenThreadToken@16
0x4B2BDB6A: "__stdcall EtwpRegistrationCompare" _EtwpRegistrationCompare@8
0x4B2F16D0: "__stdcall ZwOpenRegistryTransaction" _ZwOpenRegistryTransaction@12
0x4B2A707D: "__stdcall RtlpZeroBlockFromOffset" _RtlpZeroBlockFromOffset@12
0x4B2F2160: "__stdcall ZwWaitForWorkViaWorkerFactory" _ZwWaitForWorkViaWorkerFactory@20
0x4B2F0BD0: "__stdcall ZwAllocateUuids" _ZwAllocateUuids@16
0x4B28C6FC: "__cdecl __volatile_metadata" ___volatile_metadata
0x4B348330: "__stdcall RtlAddProcessTrustLabelAce" _RtlAddProcessTrustLabelAce@24
0x4B3748FB: "__stdcall RtlpHpLfhBucketComputeNewSubsegmentBlockCount" _RtlpHpLfhBucketComputeNewSubsegmentBlockCount@8
0x4B288678: "PROCESSOR_ARCHITEW6432" ??_C@_1CO@FMLBDJLB@?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AAO?$AAR?$AA_?$AAA?$AAR?$AAC?$AAH?$AAI?$AAT?$AAE?$AAW?$AA6?$AA4?$AA3?$AA2?$AA?$AA@
0x4B2F0FB0: "__stdcall ZwCreatePartition" _ZwCreatePartition@16
0x4B2F2090: "__stdcall NtUnloadDriver" _NtUnloadDriver@4
0x4B2D9D60: "__stdcall EtwEventRegister" _EtwEventRegister@16
0x4B3553F5: "__stdcall RtlpGetTagName" _RtlpGetTagName@8
0x4B284E18: "http://schemas.microsoft.com/SMI" ??_C@_1GM@KMBKPNGP@?$AAh?$AAt?$AAt?$AAp?$AA?3?$AA?1?$AA?1?$AAs?$AAc?$AAh?$AAe?$AAm?$AAa?$AAs?$AA?4?$AAm?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?4?$AAc?$AAo?$AAm?$AA?1?$AAS?$AAM?$AAI@
0x4B39E068: "__cdecl _pwctype" __pwctype
0x4B2F5000: "__cdecl swprintf" _swprintf
0x4B2D9F1C: "__stdcall LdrpUnloadNode" _LdrpUnloadNode@4
0x4B2D22E0: "__stdcall RtlIsCriticalSectionLockedByThread" _RtlIsCriticalSectionLockedByThread@4
0x4B2EBC00: "__stdcall RtlInitializeAtomPackage" _RtlInitializeAtomPackage@4
0x4B285998: "Threadpool!" ??_C@_1BI@PJKNEKEP@?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAp?$AAo?$AAo?$AAl?$AA?$CB?$AA?$AA@
0x4B2FBA1F: "__cdecl _clrfp" __clrfp
0x4B2D8180: "__stdcall RtlSubscribeWnfStateChangeNotification" _RtlSubscribeWnfStateChangeNotification@36
0x4B2F16C0: "__stdcall NtOpenProcessToken" _NtOpenProcessToken@12
0x4B3A0900: "__cdecl AVrfpPageHeapStopData" _AVrfpPageHeapStopData
0x4B2B6AC5: "__stdcall LdrResFallbackLangList" _LdrResFallbackLangList@20
0x4B2E1E7C: "__stdcall RtlpInsertAssemblyStorageMapEntry" _RtlpInsertAssemblyStorageMapEntry@16
0x4B32B72E: "__cdecl RtlStringCbPrintfExW" _RtlStringCbPrintfExW
0x4B2F14A0: "__stdcall ZwLoadEnclaveData" _ZwLoadEnclaveData@36
0x4B2F4A30: "__fastcall _EH4_CallFilterFunc" @_EH4_CallFilterFunc@8
0x4B359F0E: "__fastcall RtlpSetupExtendedBlock" @RtlpSetupExtendedBlock@24
0x4B2EB210: "__stdcall TpSetPoolMinThreads" _TpSetPoolMinThreads@8
0x4B2F0740: "__stdcall ZwUnmapViewOfSection" _ZwUnmapViewOfSection@8
0x4B2D97BC: "__cdecl RtlStringCbPrintfA" _RtlStringCbPrintfA
0x4B2AEF55: "__stdcall RtlpValidFilterAclSubjectContext" _RtlpValidFilterAclSubjectContext@8
0x4B355080: "__stdcall RtlpExtendedHeapInformationWorkerThread" _RtlpExtendedHeapInformationWorkerThread@4
0x4B3813A0: "__stdcall TppDirectUnposted" _TppDirectUnposted@8
0x4B35DD30: "__stdcall RtlIsValidLocaleName" _RtlIsValidLocaleName@8
0x4B36C3D2: "__stdcall RtlDebugZeroHeap" _RtlDebugZeroHeap@8
0x4B39FE80: "__cdecl RtlpDllSearchPathWithOptions" _RtlpDllSearchPathWithOptions
0x4B2F1F30: "__stdcall ZwSetTimerResolution" _ZwSetTimerResolution@12
0x4B2E9560: "__stdcall RtlpGetDeviceFamilyInfoEnum" _RtlpGetDeviceFamilyInfoEnum@12
0x4B2F1C40: "__stdcall ZwRollforwardTransactionManager" _ZwRollforwardTransactionManager@8
0x4B2857F8: "SE_DllLoaded" ??_C@_0N@IIJNFABN@SE_DllLoaded?$AA@
0x4B288868: "__cdecl LeapYearDayToMonth" _LeapYearDayToMonth
0x4B341C3A: "__stdcall RtlpDidUnicodeToOemWork" _RtlpDidUnicodeToOemWork@8
0x4B2E0D3E: "__stdcall LdrpMergeNodes" _LdrpMergeNodes@8
0x4B2A7BA5: "__stdcall LdrpGetParentLangId" _LdrpGetParentLangId@8
0x4B2F22A0: "__stdcall ZwWow64CallFunction64" _ZwWow64CallFunction64@28
0x4B339F30: "__stdcall RtlpWnfMetaCallbackProc" _RtlpWnfMetaCallbackProc@16
0x4B37F533: "__stdcall EtwpAddBinaryInfoEvents" _EtwpAddBinaryInfoEvents@12
0x4B2F2120: "__stdcall ZwVdmControl" _ZwVdmControl@8
0x4B332500: "__stdcall RtlCreateProcessReflection" _RtlCreateProcessReflection@24
0x4B35B960: "__stdcall RtlIsGenericTableEmpty" _RtlIsGenericTableEmpty@4
0x4B37A5F2: "__stdcall RtlCSparseBitmapBitmaskWrite" _RtlCSparseBitmapBitmaskWrite@16
0x4B2FD550: "__cdecl _strset_s" __strset_s
0x4B2E44B0: "__stdcall EtwEventWriteEx" _EtwEventWriteEx@40
0x4B33ABFC: "__stdcall AppModelPolicy_GetPolicy_Internal" _AppModelPolicy_GetPolicy_Internal@20
0x4B335460: "__stdcall RtlpSetProcessDebugInformationRemote" _RtlpSetProcessDebugInformationRemote@4
0x4B298FD0: "RTL: Acquire Shared Sem Timeout " ??_C@_0DA@GALAENKK@RTL?3?5Acquire?5Shared?5Sem?5Timeout?5@
0x4B30503C: ExecuteHandler2@20
0x4B2EAA58: "__stdcall RtlpSetRequestedFrontEndHeap" _RtlpSetRequestedFrontEndHeap@8
0x4B2A4568: " *** then kb to get the faulting" ??_C@_0CJ@OOBDAJAB@?5?$CK?$CK?$CK?5then?5kb?5to?5get?5the?5faulting@
0x4B34A970: "__stdcall RtlDestroyMemoryZone" _RtlDestroyMemoryZone@4
0x4B303DD5: "__stdcall RtlGuardCheckImageBase" _RtlGuardCheckImageBase@8
0x4B2B0D13: "__stdcall RtlpCopyEffectiveAce" _RtlpCopyEffectiveAce@64
0x4B379EAF: "__stdcall RtlpHpSegSegmentAllocate" _RtlpHpSegSegmentAllocate@12
0x4B39E7B0: "__cdecl ShowSnaps" _ShowSnaps
0x4B332280: "__stdcall RtlCommitMemoryStream" _RtlCommitMemoryStream@8
0x4B2CFFF0: "__stdcall RtlLeaveCriticalSection" _RtlLeaveCriticalSection@4
0x4B2948D4: "DLL "%wZ" has TLS information at" ??_C@_0CF@HIIINONN@DLL?5?$CC?$CFwZ?$CC?5has?5TLS?5information?5at@
0x4B334E4B: "__cdecl RtlStringCbPrintfW" _RtlStringCbPrintfW
0x4B369068: "__stdcall RtlpLocateRelatedBlocks" _RtlpLocateRelatedBlocks@8
0x4B292458: "__cdecl AppModelRuntimeProviderId" _AppModelRuntimeProviderId
0x4B32AD10: "__stdcall RtlGetLengthWithoutTrailingPathSeperators" _RtlGetLengthWithoutTrailingPathSeperators@12
0x4B2956D4: "AVRF: provider %ws is not a DLL " ??_C@_0CI@GIEGGAKA@AVRF?3?5provider?5?$CFws?5is?5not?5a?5DLL?5@
0x4B2EAB20: "__stdcall RtlIpv4AddressToStringA" _RtlIpv4AddressToStringA@8
0x4B293CEC: "Finding "%wZ" failed with status" ??_C@_0CK@DJMLHBEG@Finding?5?$CC?$CFwZ?$CC?5failed?5with?5status@
0x4B2928C4: "%u" ??_C@_15EFLNJKHH@?$AA?$CF?$AAu?$AA?$AA@
0x4B377136: "__stdcall RtlpHpVaMgrAlloc" _RtlpHpVaMgrAlloc@12
0x4B2AC450: "__stdcall RtlQueryApplicationKeyOption" _RtlQueryApplicationKeyOption@32
0x4B2951C0: "Networking" ??_C@_1BG@NCGPPIEL@?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AAi?$AAn?$AAg?$AA?$AA@
0x4B2E8730: "__stdcall A_SHAUpdate" _A_SHAUpdate@12
0x4B345AD0: "__stdcall RtlpCreateServerAcl" _RtlpCreateServerAcl@20
0x4B3514FB: "__stdcall RtlpGetMUIRedirectedFilePath" _RtlpGetMUIRedirectedFilePath@32
0x4B2936D4: "LdrpDynamicShimModule" ??_C@_0BG@OCOMFJJM@LdrpDynamicShimModule?$AA@
0x4B336CF0: "__stdcall AVrfpSetProcessVerifierOptions" _AVrfpSetProcessVerifierOptions@4
0x4B2F5B46: "__cdecl _atan_default" __atan_default
0x4B2AB9FC: "__stdcall RtlpNeedCurrentDirectoryForExePath" _RtlpNeedCurrentDirectoryForExePath@4
0x4B2E8905: "__stdcall RtlpMuiRegGetOrAddLangInfo" _RtlpMuiRegGetOrAddLangInfo@12
0x4B286874: "__cdecl __lconv_static_W_decimal" ___lconv_static_W_decimal
0x4B2854DC: "EXT-" ??_C@_04OMOICEBF@EXT?9?$AA@
0x4B2E3034: "__fastcall RtlpAffinitizeSegmentInfoForBucket" @RtlpAffinitizeSegmentInfoForBucket@8
0x4B331C80: "__stdcall ApiSetQueryApiSetPresenceEx" _ApiSetQueryApiSetPresenceEx@12
0x4B2F0960: "__stdcall ZwApphelpCacheControl" _ZwApphelpCacheControl@8
0x4B295AAC: "AVRF: Failed to find verifier.dl" ??_C@_0DM@IOOLJHPN@AVRF?3?5Failed?5to?5find?5verifier?4dl@
0x4B2925B0: "AppxStateChange" ??_C@_1CA@JDAKIDNM@?$AAA?$AAp?$AAp?$AAx?$AAS?$AAt?$AAa?$AAt?$AAe?$AAC?$AAh?$AAa?$AAn?$AAg?$AAe?$AA?$AA@
0x4B39FD9C: "__cdecl Nls844UnicodeUpcaseTable" _Nls844UnicodeUpcaseTable
0x4B33C4E0: "__stdcall AlpcRegisterCompletionList" _AlpcRegisterCompletionList@20
0x4B2CE230: "__stdcall TppWorkerThread" _TppWorkerThread@4
0x4B2FBAB9: "__cdecl _statfp" __statfp
0x4B288640: "PROCESSOR_ARCHITECTURE" ??_C@_1CO@KPLMNPIA@?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AAO?$AAR?$AA_?$AAA?$AAR?$AAC?$AAH?$AAI?$AAT?$AAE?$AAC?$AAT?$AAU?$AAR?$AAE?$AA?$AA@
0x4B3A0B38: "__cdecl LdrpActualBitmapSize" _LdrpActualBitmapSize
0x4B2E38EF: "__stdcall RtlpDecRefWnfNameSubscription" _RtlpDecRefWnfNameSubscription@4
0x4B32B410: "__stdcall DbgUiStopDebugging" _DbgUiStopDebugging@4
0x4B33D6E0: "__stdcall RtlQueryImageMitigationPolicy" _RtlQueryImageMitigationPolicy@20
0x4B296B48: "RtlDeactivateActivationContext" ??_C@_0BP@IKHEMMOB@RtlDeactivateActivationContext?$AA@
0x4B32F513: "__stdcall LdrpInitializeCriticalSectionExceptionGlobalMitigation" _LdrpInitializeCriticalSectionExceptionGlobalMitigation@0
0x4B2F1BB0: "__stdcall ZwResetEvent" _ZwResetEvent@8
0x4B2F5AE0: "__cdecl _wtol" __wtol
0x4B3A0930: "__cdecl LdrpKnownDllPath" _LdrpKnownDllPath
0x4B333450: "__stdcall RtlCreateAndSetSD" _RtlCreateAndSetSD@20
0x4B375338: "__stdcall RtlpHpLfhSlotAllocate" _RtlpHpLfhSlotAllocate@20
0x4B3734EF: "__stdcall RtlpHpHeapCreate" _RtlpHpHeapCreate@20
0x4B336321: "__stdcall AVrfpClearVerifiedExports" _AVrfpClearVerifiedExports@8
0x4B33C320: "__stdcall AlpcGetCompletionListMessageAttributes" _AlpcGetCompletionListMessageAttributes@8
0x4B294FB0: "Tablet" ??_C@_1O@ENCGCKEC@?$AAT?$AAa?$AAb?$AAl?$AAe?$AAt?$AA?$AA@
0x4B361AEA: "__stdcall NormBuffer__RemoveCharacter" _NormBuffer__RemoveCharacter@8
0x4B2A3998: "Below is a list of potentially l" ??_C@_0GG@JKGDHCN@Below?5is?5a?5list?5of?5potentially?5l@
0x4B342F50: "__stdcall RtlApplyRXactNoFlush" _RtlApplyRXactNoFlush@4
0x4B2F1220: "__stdcall NtEnumerateBootEntries" _NtEnumerateBootEntries@8
0x4B32AD68: "__stdcall RtlUnicodeStringCopyString" _RtlUnicodeStringCopyString@8
0x4B2EA49B: "__stdcall RtlCheckHeldCriticalSections" _RtlCheckHeldCriticalSections@8
0x4B34D7A8: "__stdcall RtlpStkIsPointerInDllRange" _RtlpStkIsPointerInDllRange@4
0x4B2A5274: "ForceFlags" ??_C@_0L@JMAFPJMA@ForceFlags?$AA@
0x4B2F69F0: "__cdecl memset" _memset
0x4B336371: "__stdcall AVrfpDetectVerifiedExports" _AVrfpDetectVerifiedExports@8
0x4B295410: "Objects=%4u" ??_C@_1BI@NBFJGDDD@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$DN?$AA?$CF?$AA4?$AAu?$AA?$AA@
0x4B334010: "__stdcall RtlCommitDebugInfo" _RtlCommitDebugInfo@8
0x4B287D48: "RtlpHpAppCompatDontChangePolicy" ??_C@_1EA@JBCBLEE@?$AAR?$AAt?$AAl?$AAp?$AAH?$AAp?$AAA?$AAp?$AAp?$AAC?$AAo?$AAm?$AAp?$AAa?$AAt?$AAD?$AAo?$AAn?$AAt?$AAC?$AAh?$AAa?$AAn?$AAg?$AAe?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x4B2F19F0: "__stdcall NtQuerySecurityPolicy" _NtQuerySecurityPolicy@24
0x4B2882B8: "Kernel-ProductInfo" ??_C@_1CG@MNIOEOCG@?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AA?9?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x4B287D88: "Force the segment heap to apply " ??_C@_1OA@PIKOLIIF@?$AAF?$AAo?$AAr?$AAc?$AAe?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAs?$AAe?$AAg?$AAm?$AAe?$AAn?$AAt?$AA?5?$AAh?$AAe?$AAa?$AAp?$AA?5?$AAt?$AAo?$AA?5?$AAa?$AAp?$AAp?$AAl?$AAy?$AA?5@
0x4B2F1D00: "__stdcall ZwSetDefaultHardErrorPort" _ZwSetDefaultHardErrorPort@4
0x4B35831B: "__stdcall RtlpCreateHashTable" _RtlpCreateHashTable@16
0x4B2D0FE0: "__stdcall LdrpGetDllPath" _LdrpGetDllPath@28
0x4B2F0EB0: "__stdcall NtCreateDirectoryObject" _NtCreateDirectoryObject@12
0x4B2F0560: "__stdcall ZwSetEvent" _ZwSetEvent@8
0x4B339660: "__stdcall WinSqmStartSessionForPartner" _WinSqmStartSessionForPartner@16
0x4B37E656: "__stdcall EtwpSynchronizeWithLogger" _EtwpSynchronizeWithLogger@8
0x4B2A9240: "__stdcall LdrEnumerateLoadedModules" _LdrEnumerateLoadedModules@12
0x4B2B54AE: "__stdcall BuildOverlayFilePath" _BuildOverlayFilePath@20
0x4B3A1754: "__cdecl LdrpIllegalCWDDevices" _LdrpIllegalCWDDevices
0x4B2EBE20: "void * __stdcall SbFilterProcedure_RTL(void *)" ?SbFilterProcedure_RTL@@YGPAXPAX@Z
0x4B2FCE50: "__cdecl _itow_s" __itow_s
0x4B3463B1: "__stdcall RtlpGuidPresentInGuidList" _RtlpGuidPresentInGuidList@12
0x4B2C9080: "__stdcall RtlMultiByteToUnicodeSize" _RtlMultiByteToUnicodeSize@12
0x4B347950: "__stdcall RtlGetCriticalSectionRecursionCount" _RtlGetCriticalSectionRecursionCount@4
0x4B359610: "__stdcall RtlCrc32" _RtlCrc32@12
0x4B2F10D0: "__stdcall ZwCreateUserProcess" _ZwCreateUserProcess@44
0x4B2EAD60: "__stdcall RtlIsPartialPlaceholder" _RtlIsPartialPlaceholder@8
0x4B293FE8: "VerifierActivationFilter" ??_C@_1DC@IJLHIGKN@?$AAV?$AAe?$AAr?$AAi?$AAf?$AAi?$AAe?$AAr?$AAA?$AAc?$AAt?$AAi?$AAv?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAi?$AAl?$AAt?$AAe?$AAr?$AA?$AA@
0x4B2CC150: "__stdcall RtlpNlsGetNameIndex" _RtlpNlsGetNameIndex@4
0x4B2F3AD0: "__cdecl __iscsym" ___iscsym
0x4B3A14B4: "__cdecl LdrInitState" _LdrInitState
0x4B2A8B34: "__stdcall FindLabelEnd" _FindLabelEnd@12
0x4B2F1600: "__stdcall NtOpenEnlistment" _NtOpenEnlistment@20
0x4B2AB5A0: "__stdcall RtlpComputeSearchPath" _RtlpComputeSearchPath@8
0x4B2FBA5E: "__cdecl _set_statfp" __set_statfp
0x4B39F391: "__cdecl RtlpHeapInvalidBreakPoint" _RtlpHeapInvalidBreakPoint
0x4B2F1A50: "__stdcall ZwQueryTimerResolution" _ZwQueryTimerResolution@12
0x4B294D38: "ADVAPI32.DLL" ??_C@_1BK@GAEMIDIL@?$AAA?$AAD?$AAV?$AAA?$AAP?$AAI?$AA3?$AA2?$AA?4?$AAD?$AAL?$AAL?$AA?$AA@
0x4B28561C: "__cdecl UserDiagnosticGuid" _UserDiagnosticGuid
0x4B2B5E90: "__stdcall RtlUpcaseUnicodeString" _RtlUpcaseUnicodeString@12
0x4B2D9220: "__stdcall EtwpRegisterTpNotificationOnce" _EtwpRegisterTpNotificationOnce@12
0x4B339F70: "__stdcall RtlpWnfRetryTimerCallback" _RtlpWnfRetryTimerCallback@12
0x4B29317C: "DelegatedNtdll" ??_C@_1BO@ELNFPKMI@?$AAD?$AAe?$AAl?$AAe?$AAg?$AAa?$AAt?$AAe?$AAd?$AAN?$AAt?$AAd?$AAl?$AAl?$AA?$AA@
0x4B2A8F0A: "__stdcall RtlpProtectHeap" _RtlpProtectHeap@8
0x4B3A1678: "__cdecl RtlpFreezeTimeBias" _RtlpFreezeTimeBias
0x4B2F1620: "__stdcall NtOpenIoCompletion" _NtOpenIoCompletion@12
0x4B292A9C: "Unknown" ??_C@_07NBCGADJA@Unknown?$AA@
0x4B28C3EC: "PICTURESLIBRARY" ??_C@_1CA@DAHKLIGG@?$AAP?$AAI?$AAC?$AAT?$AAU?$AAR?$AAE?$AAS?$AAL?$AAI?$AAB?$AAR?$AAA?$AAR?$AAY?$AA?$AA@
0x4B33BF50: "__stdcall CsrVerifyRegion" _CsrVerifyRegion@8
0x4B2F0C20: "__stdcall NtAlpcConnectPortEx" _NtAlpcConnectPortEx@44
0x4B2DB6C0: "__stdcall RtlGetSystemTimePrecise" _RtlGetSystemTimePrecise@0
0x4B281884: "__cdecl RtlpRegistryPaths" _RtlpRegistryPaths
0x4B32CF6D: "__stdcall LdrpGetDelayloadAPIInfo" _LdrpGetDelayloadAPIInfo@20
0x4B2F0910: "__stdcall ZwAddAtom" _ZwAddAtom@12
0x4B2F0E00: "__stdcall NtCommitRegistryTransaction" _NtCommitRegistryTransaction@8
0x4B32D0DA: "__stdcall LdrpRedirectDelayloadFailure" _LdrpRedirectDelayloadFailure@28
0x4B286784: "log10" ??_C@_05HGHHAHAP@log10?$AA@
0x4B2929A0: "LdrVerifyImageMatchesChecksumEx" ??_C@_0CA@PFJAAEPL@LdrVerifyImageMatchesChecksumEx?$AA@
0x4B295B00: "AVRF: Failed to find `VerifierSt" ??_C@_0EH@KHJLEPEI@AVRF?3?5Failed?5to?5find?5?$GAVerifierSt@
0x4B377A64: "__stdcall RtlpHpVaMgrRangeFind" _RtlpHpVaMgrRangeFind@16
0x4B2F3F50: "__cdecl _chkstk" __chkstk
0x4B3051B8: FinalExceptionHandlerPad8
0x4B2F0380: "__stdcall RtlUserFiberStart" _RtlUserFiberStart@0
0x4B3051B9: FinalExceptionHandlerPad9
0x4B2A3F60: "The resource is owned exclusivel" ??_C@_0DA@LHPHNAOC@The?5resource?5is?5owned?5exclusivel@
0x4B3693ED: "__stdcall RtlpLogHeapCommit" _RtlpLogHeapCommit@16
0x4B367245: "__stdcall _RtlpMuiRegValidateAndGetInstallFallbackBase" __RtlpMuiRegValidateAndGetInstallFallbackBase@20
0x4B387F16: "__stdcall RtlpStackDbSegmentRemoveRef" _RtlpStackDbSegmentRemoveRef@8
0x4B2F13B0: "__stdcall NtGetNextProcess" _NtGetNextProcess@20
0x4B2E73F7: "__stdcall LdrpBuildForwarderLink" _LdrpBuildForwarderLink@8
0x4B3051B2: FinalExceptionHandlerPad2
0x4B2D3966: "__stdcall TppWorkInitialize" _TppWorkInitialize@24
0x4B349DFD: "__stdcall RtlpValidAttributeInfo" _RtlpValidAttributeInfo@4
0x4B3051B3: FinalExceptionHandlerPad3
0x4B3051BA: FinalExceptionHandlerPad10
0x4B2E5060: "__stdcall RtlInitializeSRWLock" _RtlInitializeSRWLock@4
0x4B3051B0: FinalExceptionHandlerPad0
0x4B3051C4: FinalExceptionHandlerPad20
0x4B2F1200: "__stdcall NtDrawText" _NtDrawText@4
0x4B2EB87E: "__stdcall TppPoolpFree" _TppPoolpFree@4
0x4B2F0AA0: "__stdcall NtSetValueKey" _NtSetValueKey@24
0x4B36E8C3: "__stdcall RtlpWalkLFHBlock" _RtlpWalkLFHBlock@12
0x4B3051B1: FinalExceptionHandlerPad1
0x4B3051CE: FinalExceptionHandlerPad30
0x4B2F1050: "__stdcall NtCreateSymbolicLinkObject" _NtCreateSymbolicLinkObject@16
0x4B2A5418: "LockVariable" ??_C@_0N@EIHEKGHA@LockVariable?$AA@
0x4B3051B6: FinalExceptionHandlerPad6
0x4B3051D8: FinalExceptionHandlerPad40
0x4B2BD11D: "__stdcall LdrpChangeMrdataProtection" _LdrpChangeMrdataProtection@4
0x4B2E399D: "__stdcall RtlpWnfProcessCurrentDescriptor" _RtlpWnfProcessCurrentDescriptor@8
0x4B3051B7: FinalExceptionHandlerPad7
0x4B3051E2: FinalExceptionHandlerPad50
0x4B2F05E0: "__stdcall NtQueryKey" _NtQueryKey@20
0x4B3051B4: FinalExceptionHandlerPad4
0x4B3051EC: FinalExceptionHandlerPad60
0x4B29261C: ".txt" ??_C@_04LCMACLFG@?4txt?$AA@
0x4B292F70: "Querying large page info failed " ??_C@_0DF@EHLMPNJ@Querying?5large?5page?5info?5failed?5@
0x4B2951B0: "Medical" ??_C@_1BA@NGJEKKJM@?$AAM?$AAe?$AAd?$AAi?$AAc?$AAa?$AAl?$AA?$AA@
0x4B2F41A0: "__cdecl _aulldvrm" __aulldvrm
0x4B3051B5: FinalExceptionHandlerPad5
0x4B35E219: "__stdcall RtlpOpenAndMapCustomCultureFile" _RtlpOpenAndMapCustomCultureFile@12
0x4B2BB8C0: "__stdcall LdrpAccessResourceData" _LdrpAccessResourceData@16
0x4B2F09A0: "__stdcall NtProtectVirtualMemory" _NtProtectVirtualMemory@20
0x4B295660: "AVRF: Cannot load %ws from arbit" ??_C@_0CP@DCGNIHIC@AVRF?3?5Cannot?5load?5?$CFws?5from?5arbit@
0x4B3385E0: "__stdcall WerReportExceptionWorker" _WerReportExceptionWorker@4
0x4B35B7B0: "__stdcall RtlRealSuccessor" _RtlRealSuccessor@4
0x4B357E30: "__stdcall RtlEnumerateEntryHashTable" _RtlEnumerateEntryHashTable@8
0x4B34E740: "__stdcall RtlSetDynamicTimeZoneInformation" _RtlSetDynamicTimeZoneInformation@4
0x4B2F0E90: "__stdcall ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter" _ZwConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
0x4B38621C: "__stdcall PsspDuplicateSnapshotRemoteToRemote" _PsspDuplicateSnapshotRemoteToRemote@20
0x4B2B1BFC: "__stdcall RtlpValidOwnerSubjectContext" _RtlpValidOwnerSubjectContext@16
0x4B2F1E20: "__stdcall NtSetInformationWorkerFactory" _NtSetInformationWorkerFactory@16
0x4B2877A0: "windows eight" ??_C@_1BM@GBKIBMDG@?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAe?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x4B35FF06: "__stdcall IsSurrogate" _IsSurrogate@4
0x4B37A1D3: "__stdcall RtlpHpSegSize" _RtlpHpSegSize@16
0x4B2D9B12: "__stdcall EtwpFindRegistration" _EtwpFindRegistration@8
0x4B2F0C90: "__stdcall ZwAlpcDeleteResourceReserve" _ZwAlpcDeleteResourceReserve@12
0x4B292978: "LdrpLoadDllInternal" ??_C@_0BE@PBPCJFJL@LdrpLoadDllInternal?$AA@
0x4B2F03B0: "__stdcall RtlFreeUserStack" _RtlFreeUserStack@4
0x4B386CB1: "__stdcall RtlpQueryDiskWriteConstraintPolicyByHandle" _RtlpQueryDiskWriteConstraintPolicyByHandle@8
0x4B2F1FA0: "__stdcall NtSinglePhaseReject" _NtSinglePhaseReject@8
0x4B2F60F0: "__cdecl iswgraph" _iswgraph
0x4B364700: "__stdcall RtlUniform" _RtlUniform@4
0x4B381720: "__stdcall TpDisassociateCallback" _TpDisassociateCallback@4
0x4B295274: "Xbox One S" ??_C@_1BG@NDIFKIFJ@?$AAX?$AAb?$AAo?$AAx?$AA?5?$AAO?$AAn?$AAe?$AA?5?$AAS?$AA?$AA@
0x4B2FE3AC: "__cdecl _output_s" __output_s
0x4B2F07A0: "__stdcall NtOpenProcessTokenEx" _NtOpenProcessTokenEx@16
0x4B36C35B: "__stdcall RtlDebugWalkHeap" _RtlDebugWalkHeap@8
0x4B293044: "RtlUserThreadStart" ??_C@_0BD@BHKNPFBB@RtlUserThreadStart?$AA@
0x4B2F4A48: "__fastcall _EH4_TransferToHandler" @_EH4_TransferToHandler@8
0x4B330D5E: "__stdcall LdrpQueryAndUpdateVerifierLaunchCounter" _LdrpQueryAndUpdateVerifierLaunchCounter@8
0x4B2D39FE: "__stdcall TppGetCurrentThreadNumaNode" _TppGetCurrentThreadNumaNode@12
0x4B304E80: "__stdcall InterlockedCompareExchange64" _InterlockedCompareExchange64@20
0x4B286A08: "Loading import redirection DLL: " ??_C@_0CH@LINNEOBA@Loading?5import?5redirection?5DLL?3?5@
0x4B285D14: "__cdecl szStandardBias" _szStandardBias
0x4B2F1520: "__stdcall NtMakePermanentObject" _NtMakePermanentObject@4
0x4B33BDF0: "__stdcall CsrCaptureMessageBuffer" _CsrCaptureMessageBuffer@16
0x4B2F8820: "__cdecl _rtzeropop" __rtzeropop
0x4B343C60: "__stdcall RtlIsElevatedRid" _RtlIsElevatedRid@4
0x4B286E74: "RTL: Edit ntos\rtl\generr.c to c" ??_C@_0DE@FFPIECFN@RTL?3?5Edit?5ntos?2rtl?2generr?4c?5to?5c@
0x4B2F06A0: "__stdcall NtReleaseMutant" _NtReleaseMutant@8
0x4B3A1AB4: "__cdecl RtlpMemoryBlockLookasideLock" _RtlpMemoryBlockLookasideLock
0x4B386A9C: "__stdcall RtlpQueryDiskSpacePolicy" _RtlpQueryDiskSpacePolicy@8
0x4B379D3A: "__stdcall RtlpHpSegReportBusyBlock" _RtlpHpSegReportBusyBlock@20
0x4B288018: ".DLL" ??_C@_19EJGOEFGP@?$AA?4?$AAD?$AAL?$AAL?$AA?$AA@
0x4B285D30: "__cdecl szStandardName" _szStandardName
0x4B36D726: "__fastcall RtlpProtectBlock" @RtlpProtectBlock@8
0x4B3048B0: "__stdcall RtlFillMemoryUlonglong" _RtlFillMemoryUlonglong@16
0x4B2CA3F0: "__stdcall RtlCompareUnicodeString" _RtlCompareUnicodeString@12
0x4B285C8C: "ContainerId" ??_C@_1BI@HJOCIGHC@?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAI?$AAd?$AA?$AA@
0x4B3401A0: "__stdcall RtlQueryModuleInformation" _RtlQueryModuleInformation@12
0x4B32E54B: "__stdcall RtlStringCchCopyExW" _RtlStringCchCopyExW@24
0x4B35DC00: "__stdcall RtlGetCurrentPeb" _RtlGetCurrentPeb@0
0x4B2F1000: "__stdcall ZwCreateProfileEx" _ZwCreateProfileEx@40
0x4B2E433A: "__stdcall CountUnicodeToUTF8" _CountUnicodeToUTF8@12
0x4B347EE0: "__stdcall RtlAddAccessDeniedObjectAce" _RtlAddAccessDeniedObjectAce@28
0x4B2CF310: "__stdcall TppWorkerFindTask" _TppWorkerFindTask@12
0x4B292448: "__cdecl FatalUserCallbackException" _FatalUserCallbackException
0x4B2DBF90: "__stdcall RtlFreeThreadActivationContextStack" _RtlFreeThreadActivationContextStack@0
0x4B2FAAF0: "__cdecl _fFATN2" __fFATN2
0x4B2F0CD0: "__stdcall ZwAlpcImpersonateClientContainerOfPort" _ZwAlpcImpersonateClientContainerOfPort@12
0x4B293068: "KiUserExceptionDispatcher" ??_C@_0BK@CJAFJELE@KiUserExceptionDispatcher?$AA@
0x4B370FF0: "__stdcall RtlCompressWorkSpaceSizeXpressLz" _RtlCompressWorkSpaceSizeXpressLz@12
0x4B2F0920: "__stdcall ZwCreateEvent" _ZwCreateEvent@20
0x4B2F1310: "__stdcall ZwFreeUserPhysicalPages" _ZwFreeUserPhysicalPages@12
0x4B2EFEE0: "__stdcall RtlNtPathNameToDosPathName" _RtlNtPathNameToDosPathName@16
0x4B2F1120: "__stdcall ZwDebugActiveProcess" _ZwDebugActiveProcess@8
0x4B2F1EB0: "__stdcall NtSetSystemEnvironmentValue" _NtSetSystemEnvironmentValue@8
0x4B2923C8: "__cdecl ComponentOnDemand" _ComponentOnDemand
0x4B2E8CA0: "__stdcall RtlIpv4StringToAddressW" _RtlIpv4StringToAddressW@16
0x4B2AC147: "__stdcall LdrpGetShimEngineInterface" _LdrpGetShimEngineInterface@0
0x4B2876C0: "__stdcall _imp__ZwOpenKey" __imp__ZwOpenKey@12
0x4B382141: "__stdcall TppQueueRemoveHead" _TppQueueRemoveHead@4
0x4B2F1160: "__stdcall NtDeleteDriverEntry" _NtDeleteDriverEntry@4
0x4B32AAD0: "__stdcall RtlDoesFileExists_U" _RtlDoesFileExists_U@4
0x4B287C88: "RtlpHpAppCompatEnablePaddingAndL" ??_C@_1GG@PEPDLAMB@?$AAR?$AAt?$AAl?$AAp?$AAH?$AAp?$AAA?$AAp?$AAp?$AAC?$AAo?$AAm?$AAp?$AAa?$AAt?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAP?$AAa?$AAd?$AAd?$AAi?$AAn?$AAg?$AAA?$AAn?$AAd?$AAL@
0x4B2F1F20: "__stdcall NtSetTimerEx" _NtSetTimerEx@16
0x4B382F30: "__stdcall SbExecuteProcedure" _SbExecuteProcedure@20
0x4B2A3C90: "__cdecl RtlFatIllegalTable" _RtlFatIllegalTable
0x4B374D41: "__stdcall RtlpHpLfhContextCleanup" _RtlpHpLfhContextCleanup@4
0x4B281C60: "__cdecl Crc64Ctrl" _Crc64Ctrl
0x4B343BA0: "__stdcall RtlGetSessionProperties" _RtlGetSessionProperties@8
0x4B377E78: "__stdcall RtlpHpSegContextCleanup" _RtlpHpSegContextCleanup@4
0x4B36885F: "__stdcall RtlpHpStackTraceDisable" _RtlpHpStackTraceDisable@0
0x4B39E910: "__cdecl RtlpUnloadEventTraceExSize" _RtlpUnloadEventTraceExSize
0x4B2F8A09: "__cdecl _check_range_exit" __check_range_exit
0x4B3A1AD0: "__cdecl RtlpLDNumBlocks" _RtlpLDNumBlocks
0x4B2E7935: "__stdcall RtlpLoadNlsData" _RtlpLoadNlsData@0
0x4B2D4BA0: "__stdcall SbSelectProcedure" _SbSelectProcedure@16
0x4B356748: "__stdcall RtlpQueryMemoryUsageHeap" _RtlpQueryMemoryUsageHeap@12
0x4B3757CA: "__stdcall RtlpHpLfhSubsegmentCreate" _RtlpHpLfhSubsegmentCreate@12
0x4B2AB1F0: "__cdecl DbgPrint" _DbgPrint
0x4B304560: "__stdcall NtdllComboListBoxProc_A" _NtdllComboListBoxProc_A@0
0x4B35EDE0: "__stdcall RtlHeapTrkInitialize" _RtlHeapTrkInitialize@4
0x4B3A14F0: "__cdecl gDefaultCasingTableSize" _gDefaultCasingTableSize
0x4B2F0CE0: "__stdcall NtAlpcImpersonateClientOfPort" _NtAlpcImpersonateClientOfPort@12
0x4B39E7A8: "__cdecl TppCleanupGroupMemberpNoPoolList" _TppCleanupGroupMemberpNoPoolList
0x4B295914: "AVRF: Chaining (%ws: %s) to %ws " ??_C@_0CB@OMNEILAK@AVRF?3?5Chaining?5?$CI?$CFws?3?5?$CFs?$CJ?5to?5?$CFws?6@
0x4B372FF5: "__stdcall RtlpHpFreeHeap" _RtlpHpFreeHeap@20
0x4B2AAD90: "__cdecl RtlpSearchProtectedPolicyEntry" _RtlpSearchProtectedPolicyEntry
0x4B2F13D0: "__stdcall ZwGetNlsSectionPtr" _ZwGetNlsSectionPtr@20
0x4B2F18A0: "__stdcall ZwQueryInformationAtom" _ZwQueryInformationAtom@20
0x4B365E03: "__stdcall RtlpMuiRegGrowLanguages" _RtlpMuiRegGrowLanguages@8
0x4B3746DB: "__stdcall RtlpHpLfhBucketActivate" _RtlpHpLfhBucketActivate@8
0x4B3616F9: "__stdcall NormBuffer__AppendAndSortDecomposed" _NormBuffer__AppendAndSortDecomposed@8
0x4B2B8158: "__stdcall LdrpGetImportDescriptorForSnap" _LdrpGetImportDescriptorForSnap@4
0x4B376305: "__stdcall RtlpHpLfhSubsegmentSetUnusedBytes" _RtlpHpLfhSubsegmentSetUnusedBytes@12
0x4B2F1440: "__stdcall NtInitializeRegistry" _NtInitializeRegistry@4
0x4B33C740: "__stdcall vDbgPrintExWithPrefix" _vDbgPrintExWithPrefix@20
0x4B2F03E0: "__stdcall RtlpCapChkTelemetryRunOnce" _RtlpCapChkTelemetryRunOnce@12
0x4B2A3974: "Unable to allocate page descript" ??_C@_0CE@JCGDDJJF@Unable?5to?5allocate?5page?5descript@
0x4B34D760: "__stdcall RtlGetCallersAddress" _RtlGetCallersAddress@8
0x4B2BD940: "__stdcall RtlAppendUnicodeToString" _RtlAppendUnicodeToString@8
0x4B28B8F0: "__cdecl RtlpLfhBucketIndexMap" _RtlpLfhBucketIndexMap
0x4B32E680: "__stdcall VsmEnclaveTelemetryInitOnce" _VsmEnclaveTelemetryInitOnce@12
0x4B361665: "__stdcall IsHangulLV" _IsHangulLV@4
0x4B2994F0: "__cdecl RtlpBitsClearAnywhere" _RtlpBitsClearAnywhere
0x4B2F0AD0: "__stdcall ZwAccessCheckByType" _ZwAccessCheckByType@44
0x4B2F0980: "__stdcall ZwCreateThread" _ZwCreateThread@32
0x4B2D9E44: "__stdcall RtlpCreateSerializationGroup" _RtlpCreateSerializationGroup@4
0x4B2AEC20: "__stdcall RtlNewSecurityObjectEx" _RtlNewSecurityObjectEx@32
0x4B2F0690: "__stdcall NtImpersonateClientOfPort" _NtImpersonateClientOfPort@8
0x4B3A7000: "__cdecl GuardCheckLongJumpTargetImpl" _GuardCheckLongJumpTargetImpl
0x4B284968: "\Registry\Machine\Software\Polic" ??_C@_1HG@DLPFCGIL@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc@
0x4B287FD8: "TransparentEnabled" ??_C@_1CG@KIHJPCIJ@?$AAT?$AAr?$AAa?$AAn?$AAs?$AAp?$AAa?$AAr?$AAe?$AAn?$AAt?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x4B285200: "LdrpResGetMappingSize Exit" ??_C@_1DG@EPEALJFE@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAG?$AAe?$AAt?$AAM?$AAa?$AAp?$AAp?$AAi?$AAn?$AAg?$AAS?$AAi?$AAz?$AAe?$AA?5?$AAE?$AAx?$AAi?$AAt?$AA?$AA@
0x4B2F1C30: "__stdcall ZwRollbackTransaction" _ZwRollbackTransaction@8
0x4B2F0F90: "__stdcall NtCreateNamedPipeFile" _NtCreateNamedPipeFile@56
0x4B2F0550: "__stdcall NtSetInformationThread" _NtSetInformationThread@16
0x4B28C3B4: "MUSICLIBRARY" ??_C@_1BK@GPANBIPD@?$AAM?$AAU?$AAS?$AAI?$AAC?$AAL?$AAI?$AAB?$AAR?$AAA?$AAR?$AAY?$AA?$AA@
0x4B33BC10: "__stdcall RtlComputeImportTableHash" _RtlComputeImportTableHash@12
0x4B2EBA10: "__stdcall EtwGetTraceEnableLevel" _EtwGetTraceEnableLevel@8
0x4B3A14FC: "__cdecl RtlpLowFragHeapGlobalFlags" _RtlpLowFragHeapGlobalFlags
0x4B369474: "__stdcall RtlpLogHeapContractEvent" _RtlpLogHeapContractEvent@28
0x4B2F2250: "__stdcall NtWow64GetNativeSystemInformation" _NtWow64GetNativeSystemInformation@16
0x4B294298: "BreakOnInitializeProcessFailure" ??_C@_1EA@FCPODFOD@?$AAB?$AAr?$AAe?$AAa?$AAk?$AAO?$AAn?$AAI?$AAn?$AAi?$AAt?$AAi?$AAa?$AAl?$AAi?$AAz?$AAe?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAF?$AAa?$AAi?$AAl?$AAu?$AAr?$AAe?$AA?$AA@
0x4B304550: "__stdcall NtdllComboBoxWndProc_W" _NtdllComboBoxWndProc_W@0
0x4B334030: "__stdcall RtlCreateQueryDebugBuffer" _RtlCreateQueryDebugBuffer@8
0x4B3762B1: "__stdcall RtlpHpLfhSubsegmentSetExtraPresentBlock" _RtlpHpLfhSubsegmentSetExtraPresentBlock@12
0x4B286872: "__cdecl __lconv_static_null" ___lconv_static_null
0x4B2DC700: "__stdcall TpReleaseWork" _TpReleaseWork@4
0x4B337867: "__stdcall RtlpPageHeapStop" _RtlpPageHeapStop@40
0x4B2DB7D0: "__stdcall RtlQueryPerformanceCounter" _RtlQueryPerformanceCounter@4
0x4B28B7E8: "__cdecl RtlpBucketSizeIndexReuseThreshold" _RtlpBucketSizeIndexReuseThreshold
0x4B2A53C8: "AllocatorBackTraceIndex" ??_C@_0BI@BLDENADN@AllocatorBackTraceIndex?$AA@
0x4B2CBA97: "__stdcall RtlStringCchLengthW" _RtlStringCchLengthW@12
0x4B2F0890: "__stdcall ZwReadVirtualMemory" _ZwReadVirtualMemory@20
0x4B28884C: "__cdecl LeapYearDaysPrecedingMonth" _LeapYearDaysPrecedingMonth
0x4B3A170C: "__cdecl TppPoolpSerializedPool" _TppPoolpSerializedPool
0x4B299360: "#%u" ??_C@_17OGKEIBAI@?$AA?$CD?$AA?$CF?$AAu?$AA?$AA@
0x4B3322E8: "__stdcall LdrForkMrdata" _LdrForkMrdata@4
0x4B285640: "`string'" ??_C@_1BBA@OHHIPMLA@?$AA?$CB?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AA?$AA?$AAC?$AAS?$AAR?$AAS?$AAS?$AA?5?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AA?$AA?$AAL?$AAD?$AAR?$AA?5?$AAD?$AAa?$AAt?$AAa?$AAb?$AAa@
0x4B2A7DC7: "__stdcall RtlCreateProcessParametersInternal" _RtlCreateProcessParametersInternal@48
0x4B294E3C: "Windows.Team" ??_C@_1BK@PDMFEPMG@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAT?$AAe?$AAa?$AAm?$AA?$AA@
0x4B281070: "__cdecl RtlpDosCONOUTDevice" _RtlpDosCONOUTDevice
0x4B3761C4: "__stdcall RtlpHpLfhSubsegmentLockOwner" _RtlpHpLfhSubsegmentLockOwner@12
0x4B285808: "SE_InstallAfterInit" ??_C@_0BE@JFHMMJCN@SE_InstallAfterInit?$AA@
0x4B2EBE30: "__fastcall _guard_check_icall_nop" @_guard_check_icall_nop@4
0x4B37769A: "__stdcall RtlpHpVaMgrCtxQuery" _RtlpHpVaMgrCtxQuery@12
0x4B3A4210: "__cdecl g_pfnSE_InstallBeforeInit" _g_pfnSE_InstallBeforeInit
0x4B32B0D0: "__stdcall DbgUiConvertStateChangeStructureEx" _DbgUiConvertStateChangeStructureEx@8
0x4B2DD610: "__stdcall TppWaitpValidateWait" _TppWaitpValidateWait@12
0x4B377385: "__stdcall RtlpHpVaMgrCtxAllocatorCompare" _RtlpHpVaMgrCtxAllocatorCompare@12
0x4B286B64: "LdrpNameToOrdinal" ??_C@_0BC@EKFCNHAB@LdrpNameToOrdinal?$AA@
0x4B2DBFB4: "__stdcall RtlpInitializeThreadActivationContextStack" _RtlpInitializeThreadActivationContextStack@4
0x4B2FED96: "__cdecl _soutput_s" __soutput_s
0x4B2DCDA1: "__stdcall RtlpTpInitializeData" _RtlpTpInitializeData@12
0x4B2867C4: "modf" ??_C@_04EHEDPDJG@modf?$AA@
0x4B2D7A10: "__stdcall RtlGetVersion" _RtlGetVersion@4
0x4B2993F0: "__cdecl RtlpBitsClearHigh" _RtlpBitsClearHigh
0x4B2E6ACB: "__stdcall RtlpIsALicensedLIPLanguage" _RtlpIsALicensedLIPLanguage@8
0x4B2BA1CC: "__stdcall LdrImageDirectoryEntryToLoadConfig" _LdrImageDirectoryEntryToLoadConfig@4
0x4B2877BC: "windows seven" ??_C@_1BM@KLJKCBDE@?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAs?$AAe?$AAv?$AAe?$AAn?$AA?$AA@
0x4B3A4248: "__cdecl LdrSystemDllInitBlock" _LdrSystemDllInitBlock
0x4B2EBC00: "__stdcall RtlReleaseMemoryStream" _RtlReleaseMemoryStream@4
0x4B2F5B32: "__cdecl _CIatan_default" __CIatan_default
0x4B37E253: "__stdcall EtwpIncrementUmLoggerFile" _EtwpIncrementUmLoggerFile@16
0x4B2F0650: "__stdcall ZwWriteFileGather" _ZwWriteFileGather@36
0x4B285C40: "ContainerType" ??_C@_1BM@FDCLHDIB@?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x4B3A163C: "__cdecl LdrpMappingInfoIndex" _LdrpMappingInfoIndex
0x4B355A90: "__stdcall RtlpQueryExtendedHeapInformation" _RtlpQueryExtendedHeapInformation@12
0x4B2A3B18: "]:%u" ??_C@_04KAGBCOF@?$FN?3?$CFu?$AA@
0x4B381660: "__stdcall TpCallbackReleaseMutexOnCompletion" _TpCallbackReleaseMutexOnCompletion@8
0x4B285238: "LdrpResGetMappingSize Enter" ??_C@_1DI@KINILAEE@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAG?$AAe?$AAt?$AAM?$AAa?$AAp?$AAp?$AAi?$AAn?$AAg?$AAS?$AAi?$AAz?$AAe?$AA?5?$AAE?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x4B285100: "LdrpResSearchResourceMappedFile " ??_C@_1EM@DNGKNMP@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAM?$AAa?$AAp?$AAp?$AAe?$AAd?$AAF?$AAi?$AAl?$AAe?$AA?5@
0x4B2B6600: "__stdcall LdrResGetRCConfig" _LdrResGetRCConfig@20
0x4B332C00: "__stdcall RtlCloneUserProcess" _RtlCloneUserProcess@20
0x4B34A580: "__stdcall RtlDestroyHandleTable" _RtlDestroyHandleTable@4
0x4B35A43A: "__stdcall RtlpCheckBusyBlockTail" _RtlpCheckBusyBlockTail@8
0x4B2EF577: "__stdcall EtwpGetPrivateLoggerContextByName" _EtwpGetPrivateLoggerContextByName@8
0x4B297C90: "SXS: Unable to enumerate assembl" ??_C@_0EI@HEHGNDM@SXS?3?5Unable?5to?5enumerate?5assembl@
0x4B33BA0D: "long __stdcall InsertModuleFunctions<struct _IMAGE_THUNK_DATA64,unsigned __int64,--9223372036854775808>(struct _IMPORTTABLEP_IMPORTTABLEP_SORTED_LIST_ENTRY *,void *,struct _IMAGE_NT_HEADERS *,struct _IMAGE_IMPORT_DESCRIPTOR *)" ??$InsertModuleFunctions@U_IMAGE_THUNK_DATA64@@_K$0?IAAAAAAAAAAAAAAA@@@YGJPAU_IMPORTTABLEP_IMPORTTABLEP_SORTED_LIST_ENTRY@@PAXPAU_IMAGE_NT_HEADERS@@PAU_IMAGE_IMPORT_DESCRIPTOR@@@Z
0x4B32BD20: "__stdcall RtlPopFrame" _RtlPopFrame@4
0x4B3A37B0: "__cdecl RtlpTpIoTreeLock" _RtlpTpIoTreeLock
0x4B2867F0: "atan2" ??_C@_05KNGEOGJB@atan2?$AA@
0x4B2F0E40: "__stdcall ZwCompareSigningLevels" _ZwCompareSigningLevels@8
0x4B32CB02: "__stdcall LdrpGetModuleName" _LdrpGetModuleName@16
0x4B2A7860: "__stdcall RtlLookupElementGenericTableFull" _RtlLookupElementGenericTableFull@16
0x4B2A4640: "%wZ" ??_C@_17JJNMJOBL@?$AA?$CF?$AAw?$AAZ?$AA?$AA@
0x4B2CACB1: "__stdcall RtlpMuiRegGetInstalledLanguageIndexByName" _RtlpMuiRegGetInstalledLanguageIndexByName@16
0x4B304900: "__stdcall RtlZeroMemory" _RtlZeroMemory@8
0x4B2F5AB0: "__cdecl _wtoi64" __wtoi64
0x4B292CC4: "*" ??_C@_01NBENCBCI@?$CK?$AA@
0x4B2D79BD: "__stdcall RtlpQueryPhysicalMemoryPolicy" _RtlpQueryPhysicalMemoryPolicy@4
0x4B2EDFC0: "__stdcall RtlCreateUserThread" _RtlCreateUserThread@40
0x4B2DF9E0: "__stdcall RtlClearBits" _RtlClearBits@12
0x4B2B2850: "__stdcall RtlUnicodeStringToInteger" _RtlUnicodeStringToInteger@12
0x4B2E4AD0: "__stdcall RtlWow64GetProcessMachines" _RtlWow64GetProcessMachines@12
0x4B2A4314: "The instruction at %p tried to %" ??_C@_0CD@FIKGCJIL@The?5instruction?5at?5?$CFp?5tried?5to?5?$CF@
0x4B33D65B: "__stdcall RtlOpenModernAppOptionsKey" _RtlOpenModernAppOptionsKey@12
0x4B2F1500: "__stdcall ZwLockRegistryKey" _ZwLockRegistryKey@4
0x4B2F7690: "__cdecl strlen" _strlen
0x4B32E791: "__stdcall LdrpIsILOnlyImage" _LdrpIsILOnlyImage@4
0x4B3322B0: "__stdcall RtlQueryInterfaceMemoryStream" _RtlQueryInterfaceMemoryStream@12
0x4B355230: "__stdcall RtlpFlushHeapsCallback" _RtlpFlushHeapsCallback@8
0x4B293084: "KiUserApcDispatcher" ??_C@_0BE@DBKDIMNN@KiUserApcDispatcher?$AA@
0x4B292D88: "FindResourceEx API exit" ??_C@_1DA@BIIAJEPG@?$AAF?$AAi?$AAn?$AAd?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAE?$AAx?$AA?5?$AAA?$AAP?$AAI?$AA?5?$AAe?$AAx?$AAi?$AAt?$AA?$AA@
0x4B2F0DF0: "__stdcall ZwCommitEnlistment" _ZwCommitEnlistment@8
0x4B3784B9: "__stdcall RtlpHpSegHeapAddSegment" _RtlpHpSegHeapAddSegment@8
0x4B2E78D0: "__stdcall RtlGetDaclSecurityDescriptor" _RtlGetDaclSecurityDescriptor@16
0x4B2E66A1: "__stdcall LdrpInsertModuleToIndexLockHeld" _LdrpInsertModuleToIndexLockHeld@8
0x4B363BC0: "__stdcall RtlStdReleaseStackTrace" _RtlStdReleaseStackTrace@8
0x4B368722: "__stdcall RtlpHpStackTraceAllocRemove" _RtlpHpStackTraceAllocRemove@8
0x4B3657B3: "__stdcall RtlpMuiRegGetFallbackLanguageInfoByIndex" _RtlpMuiRegGetFallbackLanguageInfoByIndex@24
0x4B2954C4: "VerifierFlags" ??_C@_1BM@IADMEPHN@?$AAV?$AAe?$AAr?$AAi?$AAf?$AAi?$AAe?$AAr?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x4B3797C7: "__stdcall RtlpHpSegPageRangeHandleCommit" _RtlpHpSegPageRangeHandleCommit@20
0x4B3046A0: "__stdcall NtdllDispatchHook_A" _NtdllDispatchHook_A@0
0x4B2F2790: "__stdcall KiUserApcExceptionHandler" _KiUserApcExceptionHandler@16
0x4B2E3600: "__stdcall RtlQueryPerformanceFrequency" _RtlQueryPerformanceFrequency@4
0x4B2DB440: "__stdcall RtlSetLastWin32ErrorAndNtStatusFromNtStatus" _RtlSetLastWin32ErrorAndNtStatusFromNtStatus@4
0x4B2A5724: "About to rellocate block at %p t" ??_C@_0DM@GHMIGCOM@About?5to?5rellocate?5block?5at?5?$CFp?5t@
0x4B374C7D: "__stdcall RtlpHpLfhContextAllocate" _RtlpHpLfhContextAllocate@16
0x4B2F0EC0: "__stdcall NtCreateDirectoryObjectEx" _NtCreateDirectoryObjectEx@20
0x4B29504C: "Large Screen" ??_C@_1BK@EALCPPPI@?$AAL?$AAa?$AAr?$AAg?$AAe?$AA?5?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?$AA@
0x4B2D178C: "__stdcall LdrpInitMuiCrits" _LdrpInitMuiCrits@8
0x4B2F2260: "__stdcall ZwWow64QueryInformationProcess64" _ZwWow64QueryInformationProcess64@20
0x4B2F0E20: "__stdcall ZwCompactKeys" _ZwCompactKeys@8
0x4B2B4CF4: "__stdcall LdrpResCompareResourceNames" _LdrpResCompareResourceNames@32
0x4B3630D0: "__stdcall RtlNormalizeString" _RtlNormalizeString@20
0x4B351D60: "__stdcall RtlpSetInstallLanguage" _RtlpSetInstallLanguage@8
0x4B2A4840: "heap_failure_generic" ??_C@_0BF@KAEPDJD@heap_failure_generic?$AA@
0x4B2F1080: "__stdcall NtCreateTimer2" _NtCreateTimer2@20
0x4B2AEEF0: "__stdcall RtlSetDaclSecurityDescriptor" _RtlSetDaclSecurityDescriptor@16
0x4B347BF0: "__stdcall RtlpNotOwnerCriticalSection" _RtlpNotOwnerCriticalSection@4
0x4B298650: "SXS: %s() bad parameters: SXS: " ??_C@_0KB@NKIJHLHC@SXS?3?5?$CFs?$CI?$CJ?5bad?5parameters?3?6SXS?3?5?5@
0x4B2F48C0: "__cdecl _lfind" __lfind
0x4B3726C8: "__stdcall RtlpLfhFindClearBitAndSet" _RtlpLfhFindClearBitAndSet@16
0x4B292C58: "LdrResolveDelayLoadedAPI" ??_C@_0BJ@GELFLPEE@LdrResolveDelayLoadedAPI?$AA@
0x4B3A1244: "__cdecl LdrpCurrentDllInitializer" _LdrpCurrentDllInitializer
0x4B2F0600: "__stdcall ZwAllocateVirtualMemory" _ZwAllocateVirtualMemory@24
0x4B288230: "\Registry\MACHINE\SYSTEM\Current" ??_C@_1II@NNAIOKFM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2F08F0: "__stdcall ZwQueueApcThread" _ZwQueueApcThread@20
0x4B3046E0: "__stdcall NtdllDispatchMessage_A" _NtdllDispatchMessage_A@0
0x4B33CF4E: "__stdcall LdrpGetMappingFromCacheEntry" _LdrpGetMappingFromCacheEntry@16
0x4B3823C0: "__stdcall RtlpTpTimerCallback" _RtlpTpTimerCallback@12
0x4B2A539C: "AlignMask" ??_C@_09JHFGEGIN@AlignMask?$AA@
0x4B36D2B4: "__stdcall RtlpHpParametersVerify" _RtlpHpParametersVerify@4
0x4B304BF0: "__stdcall _RtlEnlargedUnsignedMultiply" __RtlEnlargedUnsignedMultiply@8
0x4B2881F8: "AUX" ??_C@_17CNBAFMOM@?$AAA?$AAU?$AAX?$AA?$AA@
0x4B284F9C: "SysWOW64" ??_C@_1BC@KHIEHEMG@?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?$AA@
0x4B292AE0: "LdrpRedirectDelayloadFailure" ??_C@_0BN@FABFIBA@LdrpRedirectDelayloadFailure?$AA@
0x4B2F1910: "__stdcall ZwQueryInformationTransactionManager" _ZwQueryInformationTransactionManager@20
0x4B3A1698: "__cdecl gBaseAddress" _gBaseAddress
0x4B298A58: "__cdecl RtlProtectedAccess" _RtlProtectedAccess
0x4B281088: "__cdecl RtlpDosNULDevice" _RtlpDosNULDevice
0x4B2A5C18: "RtlpGetBitState(LookupTable, (UL" ??_C@_0EM@FJLCOGDC@RtlpGetBitState?$CILookupTable?0?5?$CIUL@
0x4B286834: "_y1" ??_C@_03NAKIGLHK@_y1?$AA@
0x4B2BCCF0: "__stdcall LdrpGetFileSizeFromLoadAsDataTable" _LdrpGetFileSizeFromLoadAsDataTable@4
0x4B2810D8: "__cdecl RtlpWin32NtRootSlash" _RtlpWin32NtRootSlash
0x4B380980: "__stdcall TppJobpExecuteCallback" _TppJobpExecuteCallback@16
0x4B2D8150: "__stdcall RtlGetSuiteMask" _RtlGetSuiteMask@0
0x4B2AC860: "__stdcall WinSqmSetIfMaxDWORD" _WinSqmSetIfMaxDWORD@12
0x4B2A8B60: "__stdcall RtlpApplyAclToObject" _RtlpApplyAclToObject@8
0x4B2AAA76: "__stdcall LdrpLogDeprecatedDllEtwEvent" _LdrpLogDeprecatedDllEtwEvent@4
0x4B3322A0: "__stdcall RtlInitOutOfProcessMemoryStream" _RtlInitOutOfProcessMemoryStream@4
0x4B298D3C: "\Sessions" ??_C@_1BE@GBAFMKEO@?$AA?2?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x4B2A3B00: ":%u.%u.%u.%u" ??_C@_0N@GKPKGDBI@?3?$CFu?4?$CFu?4?$CFu?4?$CFu?$AA@
0x4B2F1710: "__stdcall ZwOpenSymbolicLinkObject" _ZwOpenSymbolicLinkObject@12
0x4B336F09: "__stdcall AVrfpVerifierStopInitialize" _AVrfpVerifierStopInitialize@0
0x4B3A1AE8: "__cdecl RtlpLDPreviousPage" _RtlpLDPreviousPage
0x4B363980: "__stdcall RtlReleaseStackTrace" _RtlReleaseStackTrace@4
0x4B294CD4: "OptionValue" ??_C@_1BI@CBOLNBDL@?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x4B3384DA: "__stdcall SignalStartWerSvc" _SignalStartWerSvc@0
0x4B364110: "__stdcall RtlNumberOfSetBitsUlongPtr" _RtlNumberOfSetBitsUlongPtr@4
0x4B2B7324: "__stdcall LdrpMakePermanentImageCommit" _LdrpMakePermanentImageCommit@8
0x4B298C80: "__cdecl SecondsToStartOf1970" _SecondsToStartOf1970
0x4B37A582: "__stdcall RtlCSparseBitmapBitmaskRead" _RtlCSparseBitmapBitmaskRead@12
0x4B3A0C40: "__cdecl PebLdr" _PebLdr
0x4B2BD355: "__stdcall LdrpHashUnicodeString" _LdrpHashUnicodeString@4
0x4B32B470: "__stdcall LdrLoadEnclaveModule" _LdrLoadEnclaveModule@12
0x4B29AE88: "__cdecl crc32Map32_" _crc32Map32_
0x4B2AB281: "__stdcall RtlpMuiRegGetInstalledLangInfoIndex" _RtlpMuiRegGetInstalledLangInfoIndex@16
0x4B287760: "windows threshold" ??_C@_1CE@IHKHGEAG@?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAt?$AAh?$AAr?$AAe?$AAs?$AAh?$AAo?$AAl?$AAd?$AA?$AA@
0x4B3312AB: "__stdcall LdrpPrepareForProcesscloning" _LdrpPrepareForProcesscloning@0
0x4B295AE8: "VerifierStopMessage" ??_C@_0BE@PNJPOBOE@VerifierStopMessage?$AA@
0x4B385D0F: "__stdcall PsspWalkInfoClass_PSS_WALK_VA_SPACE" _PsspWalkInfoClass_PSS_WALK_VA_SPACE@12
0x4B39E448: "struct _SWITCHBRANCH_MODULE_TABLE_ENTRY g_SbTableEntry_HeapPaddingAndLFHSubsegmentCommitSwitch_RTL" ?g_SbTableEntry_HeapPaddingAndLFHSubsegmentCommitSwitch_RTL@@3U_SWITCHBRANCH_MODULE_TABLE_ENTRY@@A
0x4B39E8D8: "__cdecl CachedLanguageOverlayGroupPolicyState" _CachedLanguageOverlayGroupPolicyState
0x4B293F60: "LdrpInitializeApplicationVerifie" ??_C@_0CJ@OIILCONN@LdrpInitializeApplicationVerifie@
0x4B294B5C: "LdrpReportError" ??_C@_0BA@NCJODKKL@LdrpReportError?$AA@
0x4B2E1F7A: "__stdcall RtlpProbeAssemblyStorageRootForAssembly" _RtlpProbeAssemblyStorageRootForAssembly@28
0x4B32E363: "__stdcall LdrpLogVsmEnclaveLdrCreateEnclaveTelemetry" _LdrpLogVsmEnclaveLdrCreateEnclaveTelemetry@12
0x4B2F1C60: "__stdcall ZwSaveKeyEx" _ZwSaveKeyEx@12
0x4B3A4208: "__cdecl g_pfnSE_InitializeEngine" _g_pfnSE_InitializeEngine
0x4B344EA5: "__stdcall RtlpConvertAclToAutoInherit" _RtlpConvertAclToAutoInherit@36
0x4B37732F: "__stdcall RtlpHpVaMgrCtxAlloc" _RtlpHpVaMgrCtxAlloc@16
0x4B2F17A0: "__stdcall NtPrepareEnlistment" _NtPrepareEnlistment@8
0x4B293D18: "Loading Windows subsystem DLL "%" ??_C@_0EA@BEAPBFLL@Loading?5Windows?5subsystem?5DLL?5?$CC?$CF@
0x4B34B3B0: "__stdcall RtlCompareString" _RtlCompareString@12
0x4B2B8DC4: "__stdcall LdrpProcessMappedModule" _LdrpProcessMappedModule@16
0x4B33B7CA: "__stdcall RtlpGetAssemblyStorageMapRootLocation" _RtlpGetAssemblyStorageMapRootLocation@12
0x4B293368: "LdrpInitializeProcessWrapperFilt" ??_C@_0CD@DPPKFIAI@LdrpInitializeProcessWrapperFilt@
0x4B3A0A20: "__cdecl LdrpHashTable" _LdrpHashTable
0x4B35BECD: "__stdcall RtlpDumpEntryInfo" _RtlpDumpEntryInfo@8
0x4B2D12E0: "__stdcall TpCallbackIndependent" _TpCallbackIndependent@4
0x4B2E0210: "__stdcall RtlCutoverTimeToSystemTime" _RtlCutoverTimeToSystemTime@16
0x4B2E1070: "__stdcall RtlGetCurrentTransaction" _RtlGetCurrentTransaction@0
0x4B2F1E80: "__stdcall NtSetLowWaitHighEventPair" _NtSetLowWaitHighEventPair@4
0x4B2F88F0: "__cdecl _rtindfpop" __rtindfpop
0x4B2F1180: "__stdcall NtDeleteKey" _NtDeleteKey@4
0x4B37E1C0: "__stdcall EtwpGetStackExtendedHeaderItem" _EtwpGetStackExtendedHeaderItem@8
0x4B349800: "__stdcall RtlpMergeSecurityAttributeInformation" _RtlpMergeSecurityAttributeInformation@16
0x4B286C98: "SXS: %s() flags contains return_" ??_C@_0GF@HOGCPDBP@SXS?3?5?$CFs?$CI?$CJ?5flags?5contains?5return_@
0x4B303E83: "__stdcall RtlpHpReleaseQueuedLockExclusive" _RtlpHpReleaseQueuedLockExclusive@8
0x4B3A1B30: "__cdecl RtlpHeapStackTraceLog" _RtlpHeapStackTraceLog
0x4B2D064C: "__stdcall LdrpUpdateStatistics" _LdrpUpdateStatistics@0
0x4B2CB8FF: "__stdcall LdrpDecrementNodeLoadCountLockHeld" _LdrpDecrementNodeLoadCountLockHeld@12
0x4B2E3EEC: "__stdcall RtlpDecRefWnfUserSubscription" _RtlpDecRefWnfUserSubscription@12
0x4B2948FC: "LdrpInitializeTls" ??_C@_0BC@IFEGPMPJ@LdrpInitializeTls?$AA@
0x4B2EF04E: "__stdcall EtwpCreateFile" _EtwpCreateFile@24
0x4B2F0860: "__stdcall NtDuplicateObject" _NtDuplicateObject@28
0x4B3047C0: "__stdcall NtdllImeWndProcWorker" _NtdllImeWndProcWorker@0
0x4B339340: "__stdcall WerpEscalationIsDisabled" _WerpEscalationIsDisabled@0
0x4B2F0BE0: "__stdcall ZwAllocateVirtualMemoryEx" _ZwAllocateVirtualMemoryEx@28
0x4B2CB800: "__stdcall LdrUnloadDll" _LdrUnloadDll@4
0x4B363750: "__stdcall RtlLockCurrentThread" _RtlLockCurrentThread@0
0x4B2954E0: "HandleTraces" ??_C@_1BK@HPELFPNB@?$AAH?$AAa?$AAn?$AAd?$AAl?$AAe?$AAT?$AAr?$AAa?$AAc?$AAe?$AAs?$AA?$AA@
0x4B2F03B0: "__stdcall LdrDeleteEnclave" _LdrDeleteEnclave@4
0x4B2DFBE0: "__stdcall RtlSetCurrentTransaction" _RtlSetCurrentTransaction@4
0x4B356876: "__stdcall RtlpUnlockHeapManagerForCloning" _RtlpUnlockHeapManagerForCloning@8
0x4B2F0940: "__stdcall ZwCreateSection" _ZwCreateSection@28
0x4B335300: "__stdcall RtlpQueryProcessEnumHeapsRoutine" _RtlpQueryProcessEnumHeapsRoutine@8
0x4B2930D4: "LdrSystemDllInitBlock" ??_C@_0BG@CMJGNMHH@LdrSystemDllInitBlock?$AA@
0x4B35D370: "__stdcall GetNextWchar" _GetNextWchar@16
0x4B2EBE40: "__stdcall RtlIpv6AddressToStringExW" _RtlIpv6AddressToStringExW@20
0x4B367760: "__stdcall RtlpNtMakeTemporaryKey" _RtlpNtMakeTemporaryKey@4
0x4B2F8C6D: "__cdecl _ffexpm1" __ffexpm1
0x4B2CB360: "__stdcall LdrFindEntryForAddress" _LdrFindEntryForAddress@8
0x4B363E0B: "__stdcall RtlpStdExtendUpperWatermark" _RtlpStdExtendUpperWatermark@8
0x4B2CBCB9: "__stdcall RtlpIsALicensedRegularLanguage" _RtlpIsALicensedRegularLanguage@8
0x4B2A56A4: "Just allocated block at %p for 0" ??_C@_0DJ@LMJEAJHB@Just?5allocated?5block?5at?5?$CFp?5for?50@
0x4B39E8B0: "__cdecl SbDynamicContextDllCount" _SbDynamicContextDllCount
0x4B292CC8: "FindResource API entry" ??_C@_1CO@MHPIJHGD@?$AAF?$AAi?$AAn?$AAd?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAA?$AAP?$AAI?$AA?5?$AAe?$AAn?$AAt?$AAr?$AAy?$AA?$AA@
0x4B2F1E70: "__stdcall NtSetLowEventPair" _NtSetLowEventPair@4
0x4B2F4330: "__cdecl _except_handler4_common" __except_handler4_common
0x4B286790: "pow" ??_C@_03JGHBODFD@pow?$AA@
0x4B2D1490: "__stdcall RtlExpandEnvironmentStrings" _RtlExpandEnvironmentStrings@24
0x4B35EAE0: "__stdcall RtlGuardIsExportSuppressedAddress" _RtlGuardIsExportSuppressedAddress@4
0x4B2A4878: "heap_failure_multiple_entries_co" ??_C@_0CJ@BPHMJNHD@heap_failure_multiple_entries_co@
0x4B2F1E30: "__stdcall ZwSetIntervalProfile" _ZwSetIntervalProfile@8
0x4B2F16B0: "__stdcall ZwOpenPrivateNamespace" _ZwOpenPrivateNamespace@16
0x4B39F820: "__cdecl RtlCriticalSectionDebugSList" _RtlCriticalSectionDebugSList
0x4B2FFA42: "__cdecl _woutput_s" __woutput_s
0x4B2AA640: "__stdcall RtlCreateTimer" _RtlCreateTimer@28
0x4B38012D: "__stdcall EtwpTrackBinaryForSession" _EtwpTrackBinaryForSession@12
0x4B2F2270: "__stdcall NtWow64AllocateVirtualMemory64" _NtWow64AllocateVirtualMemory64@28
0x4B2EA3E0: "__stdcall RtlDeleteSecurityObject" _RtlDeleteSecurityObject@4
0x4B294CF0: "CheckAllProcessMachinePolicyEnab" ??_C@_1EI@HAKPMFOI@?$AAC?$AAh?$AAe?$AAc?$AAk?$AAA?$AAl?$AAl?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAE?$AAn?$AAa?$AAb@
0x4B2DD0B0: "__stdcall TppSimplepExecuteCallback" _TppSimplepExecuteCallback@8
0x4B3A14D0: "__cdecl LdrpDllDirectory" _LdrpDllDirectory
0x4B2FB0B8: "__cdecl _ceil_default" __ceil_default
0x4B3051BD: FinalExceptionHandlerPad13
0x4B2F3F96: "__cdecl _alloca_probe_8" __alloca_probe_8
0x4B3051C7: FinalExceptionHandlerPad23
0x4B2A5ED0: "\Registry\Machine\SOFTWARE\Micro" ??_C@_1HO@HGEJKIOJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B304840: "__stdcall RtlCompareMemoryUlong" _RtlCompareMemoryUlong@12
0x4B3051D1: FinalExceptionHandlerPad33
0x4B3051DB: FinalExceptionHandlerPad43
0x4B2F0BC0: "__stdcall ZwAllocateUserPhysicalPages" _ZwAllocateUserPhysicalPages@12
0x4B2F1AF0: "__stdcall NtRegisterProtocolAddressInformation" _NtRegisterProtocolAddressInformation@20
0x4B3051E5: FinalExceptionHandlerPad53
0x4B293ED8: "LdrShutdownProcess" ??_C@_0BD@JDIKDNHA@LdrShutdownProcess?$AA@
0x4B2A496C: "heap_failure_usage_after_free" ??_C@_0BO@JAFJPGLC@heap_failure_usage_after_free?$AA@
0x4B2F0A10: "__stdcall ZwWriteRequestData" _ZwWriteRequestData@24
0x4B3051EF: FinalExceptionHandlerPad63
0x4B299018: "RTL: Acquire Exclusive Sem Timeo" ??_C@_0DE@BCAMAILI@RTL?3?5Acquire?5Exclusive?5Sem?5Timeo@
0x4B292DE8: "\Registry\Machine\Software\Micro" ??_C@_1MO@EFMEFLBD@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B2F3700: "__cdecl pow" _pow
0x4B32BD72: "__stdcall LdrpGenRandom" _LdrpGenRandom@0
0x4B2F0D20: "__stdcall NtAlpcQueryInformationMessage" _NtAlpcQueryInformationMessage@24
0x4B2F1D40: "__stdcall NtSetEaFile" _NtSetEaFile@16
0x4B2F1190: "__stdcall ZwDeleteObjectAuditAlarm" _ZwDeleteObjectAuditAlarm@12
0x4B2971E8: "SXS: %s() found assembly informa" ??_C@_0FO@OFLDABFF@SXS?3?5?$CFs?$CI?$CJ?5found?5assembly?5informa@
0x4B368CCB: "__stdcall RtlpHpStackTraceRemoveStack" _RtlpHpStackTraceRemoveStack@8
0x4B35EB04: "__stdcall RtlValidateUserCallTarget" _RtlValidateUserCallTarget@8
0x4B342430: "__stdcall RtlGetTickCount" _RtlGetTickCount@0
0x4B32EC3E: "__stdcall LdrpCheckForSafeDiscImage" _LdrpCheckForSafeDiscImage@4
0x4B2F1A40: "__stdcall NtQuerySystemInformationEx" _NtQuerySystemInformationEx@24
0x4B39E920: "__cdecl g_SxsMaxDeadActivationContexts" _g_SxsMaxDeadActivationContexts
0x4B2D5913: "__stdcall RtlpInitializeLfhRandomDataArray" _RtlpInitializeLfhRandomDataArray@0
0x4B39F944: "__cdecl SRWLockSpinCount" _SRWLockSpinCount
0x4B2F1870: "__stdcall ZwQueryDriverEntryOrder" _ZwQueryDriverEntryOrder@8
0x4B2F9DC0: "__cdecl _woutput_l" __woutput_l
0x4B2F1AA0: "__stdcall NtRaiseHardError" _NtRaiseHardError@24
0x4B2B1B1F: "__stdcall RtlSIZETAdd" _RtlSIZETAdd@12
0x4B2B1B1F: "__stdcall RtlSizeTAdd" _RtlSizeTAdd@12
0x4B2EAF60: "__stdcall RtlWakeAddressAll" _RtlWakeAddressAll@4
0x4B383CF0: "__stdcall PssNtFreeWalkMarker" _PssNtFreeWalkMarker@4
0x4B2DDCC8: "__stdcall LdrpIncrementModuleLoadCount" _LdrpIncrementModuleLoadCount@4
0x4B2FD4D0: "__cdecl _strnset_s" __strnset_s
0x4B2F1B20: "__stdcall NtReleaseWorkerFactoryWorker" _NtReleaseWorkerFactoryWorker@4
0x4B32F065: "__stdcall LdrpConstructModernAppKeyName" _LdrpConstructModernAppKeyName@8
0x4B29518C: "Kiosk" ??_C@_1M@IAHDLIKO@?$AAK?$AAi?$AAo?$AAs?$AAk?$AA?$AA@
0x4B2F0540: "__stdcall NtReplyPort" _NtReplyPort@8
0x4B34B460: "__stdcall RtlInitStringEx" _RtlInitStringEx@8
0x4B286800: "fabs" ??_C@_04ODHECPBC@fabs?$AA@
0x4B34CD91: "__stdcall RtlpCopyBitMapTailToHead" _RtlpCopyBitMapTailToHead@16
0x4B34A64E: "__stdcall RtlpHpFreeWithExceptionProtection" _RtlpHpFreeWithExceptionProtection@12
0x4B2A5330: "HeaderValidateLength" ??_C@_0BF@DGDEANDL@HeaderValidateLength?$AA@
0x4B3053C0: "__stdcall LdrAccessResource" _LdrAccessResource@16
0x4B2E2A6E: "__fastcall RtlpLowFragHeapAllocateFromZone" @RtlpLowFragHeapAllocateFromZone@8
0x4B295014: "All in One" ??_C@_1BG@PIIBHLDM@?$AAA?$AAl?$AAl?$AA?5?$AAi?$AAn?$AA?5?$AAO?$AAn?$AAe?$AA?$AA@
0x4B34E143: "__stdcall RtlpGetBootStatusPathFromRegistry" _RtlpGetBootStatusPathFromRegistry@4
0x4B2F1B80: "__stdcall ZwReplacePartitionUnit" _ZwReplacePartitionUnit@12
0x4B3638B3: "__stdcall RtlpUnlockStack" _RtlpUnlockStack@0
0x4B39F840: "__cdecl RtlpStaticDebugInfo" _RtlpStaticDebugInfo
0x4B29486C: "LdrpSnapModule" ??_C@_0P@LAOBGIKK@LdrpSnapModule?$AA@
0x4B2A9090: "__stdcall RtlLockMemoryZone" _RtlLockMemoryZone@4
0x4B2B4230: "__stdcall LdrpResSearchResourceInsideDirectory" _LdrpResSearchResourceInsideDirectory@52
0x4B3A159C: "__cdecl LdrpThreadPool" _LdrpThreadPool
0x4B342837: "__stdcall ComputeNameLength" _ComputeNameLength@4
0x4B298878: "SXS: %s() bad parameters: SXS: " ??_C@_0KG@MDPJOBJC@SXS?3?5?$CFs?$CI?$CJ?5bad?5parameters?3?6SXS?3?5?5@
0x4B292CF8: "FindResourceEx API entry" ??_C@_1DC@LIOENALI@?$AAF?$AAi?$AAn?$AAd?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAE?$AAx?$AA?5?$AAA?$AAP?$AAI?$AA?5?$AAe?$AAn?$AAt?$AAr?$AAy?$AA?$AA@
0x4B2846A8: "\Registry\Machine\Software\Micro" ??_C@_1IO@LDLHHDBF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B373782: "__stdcall RtlpHpHeapDestroy" _RtlpHpHeapDestroy@4
0x4B36D3CB: "__stdcall RtlpHpTlLogMemStats" _RtlpHpTlLogMemStats@8
0x4B37244E: "__stdcall RtlpGetDesiredBlockNumber" _RtlpGetDesiredBlockNumber@16
0x4B2F0D80: "__stdcall NtAssociateWaitCompletionPacket" _NtAssociateWaitCompletionPacket@32
0x4B36D341: "__stdcall RtlpHpTlLogGCScheduled" _RtlpHpTlLogGCScheduled@0
0x4B304470: "__stdcall NtdllTitleWndProc_W" _NtdllTitleWndProc_W@0
0x4B2AC860: "__stdcall WinSqmAddToAverageDWORD" _WinSqmAddToAverageDWORD@12
0x4B37C4C0: "__stdcall EtwEnumerateProcessRegGuids" _EtwEnumerateProcessRegGuids@12
0x4B2F5C00: "__cdecl bsearch" _bsearch
0x4B2B2600: "__stdcall RtlIsValidHandle" _RtlIsValidHandle@8
0x4B32C0B0: "__stdcall LdrGetFailureData" _LdrGetFailureData@0
0x4B364ED0: "__stdcall RtlpGetUserOrMachineUILanguage4NLS" _RtlpGetUserOrMachineUILanguage4NLS@12
0x4B2F0F00: "__stdcall NtCreateIRTimer" _NtCreateIRTimer@12
0x4B2CBDF0: "__stdcall RtlLCIDToCultureName" _RtlLCIDToCultureName@8
0x4B285790: "SE_GetProcAddressForCaller" ??_C@_0BL@OEJMHOGE@SE_GetProcAddressForCaller?$AA@
0x4B29893C: " Language:" ??_C@_1BG@FOIANHHB@?$AA?5?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AA?3?$AA?$AA@
0x4B2E5080: "__stdcall RtlNtStatusToDosErrorNoTeb" _RtlNtStatusToDosErrorNoTeb@4
0x4B35AE34: "__stdcall RtlpHpConvertCreationFlags" _RtlpHpConvertCreationFlags@8
0x4B34B5F0: "__stdcall RtlCopyBitMap" _RtlCopyBitMap@12
0x4B2F26E8: "__cdecl __report_securityfailure" ___report_securityfailure
0x4B374E23: "__stdcall RtlpHpLfhContextInitialize" _RtlpHpLfhContextInitialize@28
0x4B3A0914: "__cdecl AVrfpVerifierFlags" _AVrfpVerifierFlags
0x4B3A0BE4: "__cdecl RtlpUserCallbackExceptionFilter" _RtlpUserCallbackExceptionFilter
0x4B363D30: "__stdcall RtlpStackTraceDatabaseHeapEnum" _RtlpStackTraceDatabaseHeapEnum@8
0x4B281DC8: "__cdecl __guard_fids_table" ___guard_fids_table
0x4B37277B: "__stdcall RtlpUpdateLfhRandomDataArray" _RtlpUpdateLfhRandomDataArray@0
0x4B2F1420: "__stdcall ZwInitializeEnclave" _ZwInitializeEnclave@20
0x4B2A4420: "If this bug ends up in the shipp" ??_C@_0FC@EAFCLJDE@If?5this?5bug?5ends?5up?5in?5the?5shipp@
0x4B2F6150: "__cdecl iswspace" _iswspace
0x4B292BB0: "LdrpWriteBackProtectedDelayLoad" ??_C@_0CA@OFEFHJLM@LdrpWriteBackProtectedDelayLoad?$AA@
0x4B299180: "undeleted critical section in fr" ??_C@_0CL@DMEPGNJH@undeleted?5critical?5section?5in?5fr@
0x4B3755AA: "__stdcall RtlpHpLfhSubsegmentAllocateBlock" _RtlpHpLfhSubsegmentAllocateBlock@16
0x4B2F1410: "__stdcall NtImpersonateThread" _NtImpersonateThread@12
0x4B2F00D1: "__stdcall EtwpAllocateUmGuidEntry" _EtwpAllocateUmGuidEntry@4
0x4B2939FC: "Failed to allocate the system di" ??_C@_0CM@MLMABMB@Failed?5to?5allocate?5the?5system?5di@
0x4B2AAE30: "__stdcall TppDirectExecuteCallback" _TppDirectExecuteCallback@8
0x4B2958E4: "AVRF: Checking %ws for duplicate" ??_C@_0CN@EFLNMJDI@AVRF?3?5Checking?5?$CFws?5for?5duplicate@
0x4B2F2110: "__stdcall ZwUpdateWnfStateData" _ZwUpdateWnfStateData@28
0x4B3395D0: "__stdcall WinSqmCheckEscalationSetString" _WinSqmCheckEscalationSetString@16
0x4B34D630: "__stdcall RtlDeleteBarrier" _RtlDeleteBarrier@4
0x4B2F1DE0: "__stdcall NtSetInformationToken" _NtSetInformationToken@16
0x4B358210: "__stdcall RtlLookupEntryHashTable" _RtlLookupEntryHashTable@12
0x4B2F1B10: "__stdcall ZwReleaseKeyedEvent" _ZwReleaseKeyedEvent@16
0x4B295428: "VirtualAlloc" ??_C@_1BK@OFMFMHJP@?$AAV?$AAi?$AAr?$AAt?$AAu?$AAa?$AAl?$AAA?$AAl?$AAl?$AAo?$AAc?$AA?$AA@
0x4B2D04A9: "__stdcall TppCancelWait" _TppCancelWait@16
0x4B36A0D5: "__stdcall RtlpReportHeapFailure" _RtlpReportHeapFailure@4
0x4B2E6640: "__stdcall RtlInitializeExceptionChain" _RtlInitializeExceptionChain@4
0x4B294E00: "Windows.Mobile" ??_C@_1BO@IELJKNCO@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAM?$AAo?$AAb?$AAi?$AAl?$AAe?$AA?$AA@
0x4B39F108: "__cdecl EtwpGlobalSequence" _EtwpGlobalSequence
0x4B34B4C0: "__stdcall RtlAreBitsClear" _RtlAreBitsClear@12
0x4B2BD473: "__stdcall LdrpInitializeThread" _LdrpInitializeThread@4
0x4B33D510: "__stdcall RtlCreateUserProcessEx" _RtlCreateUserProcessEx@20
0x4B35DDBA: "__stdcall RtlpGetAlternateCodePage" _RtlpGetAlternateCodePage@12
0x4B2D0C54: "__stdcall TppCleanupGroupMemberCallbackProlog" _TppCleanupGroupMemberCallbackProlog@8
0x4B2F0700: "__stdcall NtOpenProcess" _NtOpenProcess@16
0x4B287830: "ENTER" ??_C@_05EMNIMLKD@ENTER?$AA@
0x4B34DC60: "__stdcall RtlCheckSystemBootStatusIntegrity" _RtlCheckSystemBootStatusIntegrity@4
0x4B2F09F0: "__stdcall ZwCreateFile" _ZwCreateFile@44
0x4B37184B: "__stdcall RtlpMakeXpressCallback" _RtlpMakeXpressCallback@12
0x4B2A8778: "__stdcall RtlpTpTimerRundown" _RtlpTpTimerRundown@4
0x4B33AFF3: "__fastcall RtlpMoveActCtxToFreeList" @RtlpMoveActCtxToFreeList@4
0x4B2F1090: "__stdcall ZwCreateToken" _ZwCreateToken@52
0x4B286C64: "RtlpFindActivationContextSection" ??_C@_0DB@IPHPAHEM@RtlpFindActivationContextSection@
0x4B341720: "__stdcall RtlInitNlsTables" _RtlInitNlsTables@16
0x4B2B62D0: "__stdcall RtlGetFullPathName_UEx" _RtlGetFullPathName_UEx@20
0x4B281280: "__cdecl RtlpTheEmptyActivationContextWrapped" _RtlpTheEmptyActivationContextWrapped
0x4B295068: "Head Mounted Display" ??_C@_1CK@HJEBELMK@?$AAH?$AAe?$AAa?$AAd?$AA?5?$AAM?$AAo?$AAu?$AAn?$AAt?$AAe?$AAd?$AA?5?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AA?$AA@
0x4B32F180: "__stdcall LdrpGetProcApphelpCheckModule" _LdrpGetProcApphelpCheckModule@4
0x4B2F0E80: "__stdcall ZwConnectPort" _ZwConnectPort@32
0x4B2FE1C0: "__cdecl wcsncpy_s" _wcsncpy_s
0x4B2F0730: "__stdcall NtAccessCheckAndAuditAlarm" _NtAccessCheckAndAuditAlarm@44
0x4B2CF2E0: "__stdcall TppIopCallbackEpilog" _TppIopCallbackEpilog@4
0x4B2A3B10: "%%%u" ??_C@_04MLNOPOCC@?$CF?$CF?$CFu?$AA@
0x4B3A14C0: "__cdecl RtlpSystem32Dirs" _RtlpSystem32Dirs
0x4B386915: "__stdcall RtlQueryVolumeDiskSpeedPolicy" _RtlQueryVolumeDiskSpeedPolicy@8
0x4B2F4FA0: "__cdecl _strupr_s" __strupr_s
0x4B2D1F76: "__stdcall RtlpAddWaitBlockToWaitList" _RtlpAddWaitBlockToWaitList@8
0x4B33AB63: "__stdcall RtlpSignalSystemDirsModification" _RtlpSignalSystemDirsModification@0
0x4B3665BD: "__stdcall _RtlMuiRegAddLIPParent" __RtlMuiRegAddLIPParent@16
0x4B2818A0: "__cdecl RtlDosPathSeperatorsString" _RtlDosPathSeperatorsString
0x4B3A1B34: "__cdecl RtlpHpStackTraceLogInstance" _RtlpHpStackTraceLogInstance
0x4B2F2200: "__stdcall NtWow64CsrCaptureMessageString" _NtWow64CsrCaptureMessageString@20
0x4B2F8260: "__cdecl wcspbrk" _wcspbrk
0x4B2DE530: "__cdecl RtlpCompareActivationContextStringSectionEntryByPseudoKey" _RtlpCompareActivationContextStringSectionEntryByPseudoKey
0x4B2B8770: "__stdcall LdrControlFlowGuardEnforced" _LdrControlFlowGuardEnforced@0
0x4B2D84D6: "__stdcall RtlpCreateWnfUserSubscription" _RtlpCreateWnfUserSubscription@28
0x4B2F1C50: "__stdcall ZwSaveKey" _ZwSaveKey@8
0x4B2F894C: "__cdecl _convertTOStoQNaN" __convertTOStoQNaN
0x4B293B48: "Initializing the current directo" ??_C@_0EI@EJGAFKBF@Initializing?5the?5current?5directo@
0x4B3A1810: "__cdecl LdrpChildNtdllPointer" _LdrpChildNtdllPointer
0x4B2D6107: "__stdcall RtlpHeapAddListEntry" _RtlpHeapAddListEntry@24
0x4B35BF1A: "__stdcall RtlpGetBlockInfo" _RtlpGetBlockInfo@8
0x4B2F0590: "__stdcall NtQueryInformationFile" _NtQueryInformationFile@20
0x4B2AB0E6: "__stdcall RtlpAddVectoredHandler" _RtlpAddVectoredHandler@12
0x4B292428: "__cdecl AppModelLibraryLoadFailureApplicationBinary" _AppModelLibraryLoadFailureApplicationBinary
0x4B2AE71A: "__stdcall LdrpQueryValueKey" _LdrpQueryValueKey@24
0x4B2DD550: "__stdcall TpReleaseWait" _TpReleaseWait@4
0x4B2E6E40: "__stdcall LdrLockLoaderLock" _LdrLockLoaderLock@12
0x4B2F2290: "__stdcall NtWow64WriteVirtualMemory64" _NtWow64WriteVirtualMemory64@28
0x4B2FDAE0: "__cdecl strcat_s" _strcat_s
0x4B2BB310: "__stdcall LdrGetProcedureAddressForCaller" _LdrGetProcedureAddressForCaller@24
0x4B2854E4: "\REGISTRY\USER\" ??_C@_1CA@BAGEJGFP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$AA@
0x4B2F1B50: "__stdcall NtRenameKey" _NtRenameKey@8
0x4B2F1F40: "__stdcall NtSetUuidSeed" _NtSetUuidSeed@4
0x4B381600: "__stdcall TpCallbackDetectedUnrecoverableError" _TpCallbackDetectedUnrecoverableError@4
0x4B2F11A0: "__stdcall ZwDeletePrivateNamespace" _ZwDeletePrivateNamespace@4
0x4B2A3D34: "en" ??_C@_15MNPNEAIF@?$AAe?$AAn?$AA?$AA@
0x4B35DC80: "__cdecl RtlSetThreadIsCritical" _RtlSetThreadIsCritical
0x4B2F1470: "__stdcall NtIsUILanguageComitted" _NtIsUILanguageComitted@0
0x4B2F19D0: "__stdcall NtQuerySecurityAttributesToken" _NtQuerySecurityAttributesToken@24
0x4B298A24: "MitigationAuditOptions" ??_C@_1CO@GNDGOBAE@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAA?$AAu?$AAd?$AAi?$AAt?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x4B2F11B0: "__stdcall ZwDeleteValueKey" _ZwDeleteValueKey@8
0x4B36A7D0: "__stdcall RtlpHpTagFreeHeap" _RtlpHpTagFreeHeap@12
0x4B2F1DD0: "__stdcall ZwSetInformationSymbolicLink" _ZwSetInformationSymbolicLink@16
0x4B2DB092: "__stdcall WerEscalationReadImageVersionInfoForModuleBaseSafe" _WerEscalationReadImageVersionInfoForModuleBaseSafe@12
0x4B2882E0: "Kernel-ProductInfoLegacyMapping" ??_C@_1EA@KEFFBOME@?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AA?9?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAI?$AAn?$AAf?$AAo?$AAL?$AAe?$AAg?$AAa?$AAc?$AAy?$AAM?$AAa?$AAp?$AAp?$AAi?$AAn?$AAg?$AA?$AA@
0x4B298D64: "\BaseNamedObjects" ??_C@_1CE@NPBNEBGN@?$AA?2?$AAB?$AAa?$AAs?$AAe?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$AA@
0x4B2A3750: "(LONG)FreeEntry->Size > 1" ??_C@_0BK@JLAHADFN@?$CILONG?$CJFreeEntry?9?$DOSize?5?$DO?51?$AA@
0x4B2F1300: "__stdcall ZwFlushWriteBuffer" _ZwFlushWriteBuffer@0
0x4B2F1BE0: "__stdcall NtResumeProcess" _NtResumeProcess@4
0x4B297BF0: "RtlpLocateActivationContextSecti" ??_C@_0GF@KJOPMKPI@RtlpLocateActivationContextSecti@
0x4B2D8BD0: "__stdcall RtlRunOnceExecuteOnce" _RtlRunOnceExecuteOnce@16
0x4B285488: "LdrResGetRCConfig Enter" ??_C@_1DA@KKODPNBO@?$AAL?$AAd?$AAr?$AAR?$AAe?$AAs?$AAG?$AAe?$AAt?$AAR?$AAC?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?5?$AAE?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x4B35C5EA: "__stdcall RtlpSetBlockInfo" _RtlpSetBlockInfo@16
0x4B2EBDC0: "__stdcall RtlWnfDllUnloadCallback" _RtlWnfDllUnloadCallback@4
0x4B2BF9D0: "__fastcall RtlDeactivateActivationContextUnsafeFast" @RtlDeactivateActivationContextUnsafeFast@4
0x4B32AB20: "__stdcall RtlDosLongPathNameToRelativeNtPathName_U_WithStatus" _RtlDosLongPathNameToRelativeNtPathName_U_WithStatus@16
0x4B294EB8: "Windows.Holographic" ??_C@_1CI@BHEEPMLA@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAH?$AAo?$AAl?$AAo?$AAg?$AAr?$AAa?$AAp?$AAh?$AAi?$AAc?$AA?$AA@
0x4B39FB80: "__cdecl NlsOemLeadByteInfoTable" _NlsOemLeadByteInfoTable
0x4B34AFD0: "__stdcall RtlUpcaseUnicodeStringToAnsiString" _RtlUpcaseUnicodeStringToAnsiString@12
0x4B2957D0: "AVRF: provider %ws did not initi" ??_C@_0DC@BMCLHNHH@AVRF?3?5provider?5?$CFws?5did?5not?5initi@
0x4B366047: "__stdcall RtlpMuiRegLoadMachinePreferredUILanguages" _RtlpMuiRegLoadMachinePreferredUILanguages@16
0x4B2F2220: "__stdcall ZwWow64CsrVerifyRegion" _ZwWow64CsrVerifyRegion@8
0x4B2DE200: "__stdcall TpStartAsyncIoOperation" _TpStartAsyncIoOperation@4
0x4B3679A0: "__stdcall HeapCommitFailAvoidTriageRules" _HeapCommitFailAvoidTriageRules@0
0x4B2F15D0: "__stdcall ZwNotifyChangeKey" _ZwNotifyChangeKey@40
0x4B2A4924: "heap_failure_invalid_argument" ??_C@_0BO@KFIGAEPF@heap_failure_invalid_argument?$AA@
0x4B382510: "__stdcall RtlSetIoCompletionCallback" _RtlSetIoCompletionCallback@12
0x4B3A1824: "__cdecl LdrParentInterlockedPopEntrySList" _LdrParentInterlockedPopEntrySList
0x4B2F7E30: "__cdecl _CItan" __CItan
0x4B2DDA2A: "__stdcall LdrpAllocateModuleEntry" _LdrpAllocateModuleEntry@4
0x4B294BB8: "\microsoft.system.package.metada" ??_C@_1FO@KIMINELN@?$AA?2?$AAm?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?4?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?4?$AAp?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AA?4?$AAm?$AAe?$AAt?$AAa?$AAd?$AAa@
0x4B37FBC5: "__stdcall EtwpGenerateFileName" _EtwpGenerateFileName@12
0x4B39F160: "__cdecl RtlpLowFragHeapRandomData" _RtlpLowFragHeapRandomData
0x4B380F50: "__stdcall TpTrimPools" _TpTrimPools@0
0x4B36C4B6: "__stdcall RtlpValidateHeap" _RtlpValidateHeap@8
0x4B39F942: "__cdecl RtlpForceCSToUseEvents" _RtlpForceCSToUseEvents
0x4B377890: "__stdcall RtlpHpVaMgrRangeCoalesce" _RtlpHpVaMgrRangeCoalesce@8
0x4B2F1FE0: "__stdcall NtSuspendProcess" _NtSuspendProcess@4
0x4B2993AC: "\SyCHPE32\" ??_C@_1BG@GIOECHMA@?$AA?2?$AAS?$AAy?$AAC?$AAH?$AAP?$AAE?$AA3?$AA2?$AA?2?$AA?$AA@
0x4B2F1A70: "__stdcall ZwQueryWnfStateNameInformation" _ZwQueryWnfStateNameInformation@20
0x4B2978D0: "SXS: %s() - Caller passed meanin" ??_C@_0FB@JFJNJHFC@SXS?3?5?$CFs?$CI?$CJ?5?9?5Caller?5passed?5meanin@
0x4B2DB910: "__stdcall RtlCaptureStackBackTrace" _RtlCaptureStackBackTrace@16
0x4B2B6A8E: "__stdcall RtlpDosPathNameToRelativeNtPathName_U" _RtlpDosPathNameToRelativeNtPathName_U@20
0x4B39E380: "__cdecl LdrpTlsList" _LdrpTlsList
0x4B2F1100: "__stdcall NtCreateWnfStateName" _NtCreateWnfStateName@28
0x4B2F19C0: "__stdcall NtQueryQuotaInformationFile" _NtQueryQuotaInformationFile@36
0x4B3A1808: "__cdecl LdrpParentRtlRetrieveNtUserPfnPointer" _LdrpParentRtlRetrieveNtUserPfnPointer
0x4B2CF4F0: "__stdcall TppWorkpExecuteCallback" _TppWorkpExecuteCallback@8
0x4B37BD33: "__stdcall RtlpHpVsSubsegmentCleanup" _RtlpHpVsSubsegmentCleanup@8
0x4B2CBBBA: "__stdcall RtlpMUIRegPatchLicenseInfortmation" _RtlpMUIRegPatchLicenseInfortmation@4
0x4B2F372B: "__cdecl _pow_default" __pow_default
0x4B339600: "__stdcall WinSqmCommonDatapointSetDWORD" _WinSqmCommonDatapointSetDWORD@12
0x4B2CD1F0: "__stdcall RtlValidSid" _RtlValidSid@4
0x4B33CEC1: "__stdcall LdrpGetImageSize" _LdrpGetImageSize@8
0x4B3542D0: "__stdcall RtlQueryTagHeap" _RtlQueryTagHeap@20
0x4B2CFE40: "__stdcall RtlpEnterCriticalSectionContended" _RtlpEnterCriticalSectionContended@4
0x4B2F7B20: "__cdecl strstr" _strstr
0x4B347B67: "__stdcall RtlpLogWaitForCriticalSection" _RtlpLogWaitForCriticalSection@4
0x4B2959C0: "AVRF: internal error: New thunk " ??_C@_0DC@OBKHLHPO@AVRF?3?5internal?5error?3?5New?5thunk?5@
0x4B334220: "__stdcall RtlQueryProcessBackTraceInformation" _RtlQueryProcessBackTraceInformation@4
0x4B2F0E50: "__stdcall NtCompareTokens" _NtCompareTokens@12
0x4B288EB0: "__cdecl RtlpIntegerChars" _RtlpIntegerChars
0x4B3A14E4: "__cdecl RtlpDisableBreakOnFailureCookie" _RtlpDisableBreakOnFailureCookie
0x4B285E88: "__cdecl _DEFAULT_CW_in_mem" __DEFAULT_CW_in_mem
0x4B303F1B: "__stdcall RtlpHpLargeLockAcquire" _RtlpHpLargeLockAcquire@8
0x4B2EBA67: "__stdcall EtwpGetMaxLogger" _EtwpGetMaxLogger@0
0x4B33F5B0: "__stdcall RtlTestProtectedAccess" _RtlTestProtectedAccess@8
0x4B2A52B8: "DeCommitFreeBlockThreshold" ??_C@_0BL@BPDEMIFC@DeCommitFreeBlockThreshold?$AA@
0x4B285374: "\Windows" ??_C@_1BC@HIBBLOLI@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?$AA@
0x4B3A1AC8: "__cdecl RtlpHeapKey" _RtlpHeapKey
0x4B2F4490: "__cdecl _ftol2" __ftol2
0x4B284658: "__cdecl szLastEntry" _szLastEntry
0x4B2F0DB0: "__stdcall ZwCancelSynchronousIoFile" _ZwCancelSynchronousIoFile@12
0x4B3A1840: "__cdecl g_SxsCurrentDeadActivationContexts" _g_SxsCurrentDeadActivationContexts
0x4B381850: "__stdcall TppCheckLdrLockHeld" _TppCheckLdrLockHeld@0
0x4B2FB992: "__cdecl _set_exp" __set_exp
0x4B2F08C0: "__stdcall ZwDuplicateToken" _ZwDuplicateToken@24
0x4B2F4B00: "__cdecl _memicmp" __memicmp
0x4B2F0F80: "__stdcall NtCreateMutant" _NtCreateMutant@16
0x4B2F1960: "__stdcall ZwQueryLicenseValue" _ZwQueryLicenseValue@20
0x4B2930FC: "LdrParentInterlockedPopEntrySLis" ??_C@_0CC@JFJDGNMK@LdrParentInterlockedPopEntrySLis@
0x4B2F1060: "__stdcall ZwCreateThreadEx" _ZwCreateThreadEx@44
0x4B32AF98: "__stdcall RtlpResetDriveEnvironment" _RtlpResetDriveEnvironment@4
0x4B2851A8: "LdrpResSearchResourceInsideDirec" ??_C@_1FG@FACOPODK@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAI?$AAn?$AAs?$AAi?$AAd?$AAe?$AAD?$AAi?$AAr?$AAe?$AAc@
0x4B338CC9: "__stdcall SetAssertBufferPtrinPeb" _SetAssertBufferPtrinPeb@4
0x4B35B820: "__stdcall RtlEnumerateGenericTable" _RtlEnumerateGenericTable@8
0x4B297924: "SXS: %s() - caller asked for unk" ??_C@_0DM@BMJPCFGH@SXS?3?5?$CFs?$CI?$CJ?5?9?5caller?5asked?5for?5unk@
0x4B3A1ACC: "__cdecl RtlpSecMemLock" _RtlpSecMemLock
0x4B382260: "__stdcall RtlCancelTimer" _RtlCancelTimer@8
0x4B2F1A00: "__stdcall NtQuerySemaphore" _NtQuerySemaphore@20
0x4B2EB690: "__stdcall RtlInitializeGenericTableAvl" _RtlInitializeGenericTableAvl@20
0x4B2C4B90: "__stdcall RtlpIsDosDeviceName_Ustr" _RtlpIsDosDeviceName_Ustr@4
0x4B2A6194: "Mutant" ??_C@_1O@FBKOCLFA@?$AAM?$AAu?$AAt?$AAa?$AAn?$AAt?$AA?$AA@
0x4B2F18F0: "__stdcall NtQueryInformationResourceManager" _NtQueryInformationResourceManager@20
0x4B2928DC: "UEFI" ??_C@_19BNCIOIMK@?$AAU?$AAE?$AAF?$AAI?$AA?$AA@
0x4B2F0E10: "__stdcall ZwCommitTransaction" _ZwCommitTransaction@8
0x4B363C80: "__stdcall RtlpGetStackTraceAddress" _RtlpGetStackTraceAddress@4
0x4B2F1030: "__stdcall ZwCreateSectionEx" _ZwCreateSectionEx@36
0x4B35C820: "__stdcall RtlIpv6AddressToStringA" _RtlIpv6AddressToStringA@8
0x4B3A1B14: "__cdecl TrkContext" _TrkContext
0x4B336242: "__stdcall AVrfpChainDuplicateVerificationLayers" _AVrfpChainDuplicateVerificationLayers@0
0x4B2DB371: "__stdcall StringCbLengthW" _StringCbLengthW@12
0x4B2F1020: "__stdcall NtCreateResourceManager" _NtCreateResourceManager@28
0x4B2BBB80: "__stdcall RtlpxLookupFunctionTable" _RtlpxLookupFunctionTable@8
0x4B35B000: "__stdcall RtlCreateSystemVolumeInformationFolder" _RtlCreateSystemVolumeInformationFolder@4
0x4B2F07F0: "__stdcall NtQueryDirectoryFile" _NtQueryDirectoryFile@44
0x4B3419D0: "__stdcall RtlUpcaseUnicodeToCustomCPN" _RtlUpcaseUnicodeToCustomCPN@24
0x4B2F4450: "__cdecl _ftol" __ftol
0x4B3772E7: "__stdcall RtlpHpVaMgrAllocAligned" _RtlpHpVaMgrAllocAligned@12
0x4B2F8B99: "__cdecl _fFLN" __fFLN
0x4B2B7DF2: "__stdcall LdrpHandleTlsData" _LdrpHandleTlsData@4
0x4B2F1D10: "__stdcall ZwSetDefaultLocale" _ZwSetDefaultLocale@8
0x4B2F17E0: "__stdcall ZwPropagationComplete" _ZwPropagationComplete@16
0x4B33D590: "__stdcall RtlNormalizeProcessParams" _RtlNormalizeProcessParams@4
0x4B298600: "RtlGetAssemblyStorageRoot" ??_C@_0BK@BGLOJGHF@RtlGetAssemblyStorageRoot?$AA@
0x4B2A49D4: "heap_failure_listentry_corruptio" ??_C@_0CC@KGNKJKHE@heap_failure_listentry_corruptio@
0x4B3A124C: "__cdecl CsrClientProcess" _CsrClientProcess
0x4B39E90C: "__cdecl RtlpHpAppCompatFlags" _RtlpHpAppCompatFlags
0x4B3869B0: "__stdcall RtlpDiskSpeedInitialize" _RtlpDiskSpeedInitialize@12
0x4B33B150: "__stdcall RtlZombifyActivationContext" _RtlZombifyActivationContext@4
0x4B3A1834: "__cdecl g_werEscalationData" _g_werEscalationData
0x4B2F1340: "__stdcall NtGetCachedSigningLevel" _NtGetCachedSigningLevel@24
0x4B2A5E18: "smss.exe" ??_C@_1BC@GMMNGGPN@?$AAs?$AAm?$AAs?$AAs?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x4B2F4A80: "__fastcall _EH4_LocalUnwind" @_EH4_LocalUnwind@16
0x4B2EF4B4: "__stdcall EtwpGetNextAvailableLoggerId" _EtwpGetNextAvailableLoggerId@8
0x4B2F1210: "__stdcall ZwEnableLastKnownGood" _ZwEnableLastKnownGood@0
0x4B2F12D0: "__stdcall ZwFlushKey" _ZwFlushKey@4
0x4B2F1480: "__stdcall NtListenPort" _NtListenPort@8
0x4B339790: "__stdcall RtlRegisterForWnfMetaNotification" _RtlRegisterForWnfMetaNotification@24
0x4B2A3AC8: "::%hs%u.%u.%u.%u" ??_C@_0BB@JMMKNFHP@?3?3?$CFhs?$CFu?4?$CFu?4?$CFu?4?$CFu?$AA@
0x4B35699E: "__stdcall RtlpUpdateTagEntry" _RtlpUpdateTagEntry@20
0x4B354761: "__stdcall RtlUnlockHeapManagerForCloning" _RtlUnlockHeapManagerForCloning@4
0x4B378640: "__stdcall RtlpHpSegLfhVsCommit" _RtlpHpSegLfhVsCommit@12
0x4B28C444: "INTERNETCLIENTSERVER" ??_C@_1CK@HDNFKEDH@?$AAI?$AAN?$AAT?$AAE?$AAR?$AAN?$AAE?$AAT?$AAC?$AAL?$AAI?$AAE?$AAN?$AAT?$AAS?$AAE?$AAR?$AAV?$AAE?$AAR?$AA?$AA@
0x4B34C8D0: "__stdcall RtlLengthCurrentClearRunForward" _RtlLengthCurrentClearRunForward@12
0x4B2EBAB0: "__stdcall RtlGetProductInfo" _RtlGetProductInfo@20
0x4B2F1CD0: "__stdcall NtSetCachedSigningLevel2" _NtSetCachedSigningLevel2@24
0x4B3576FB: "__stdcall ChkSum" _ChkSum@12
0x4B3395E0: "__stdcall WinSqmCommonDatapointDelete" _WinSqmCommonDatapointDelete@4
0x4B2D6920: "__stdcall RtlSizeHeap" _RtlSizeHeap@12
0x4B2DEAB0: "__stdcall RtlUnicodeStringCbCatStringN" _RtlUnicodeStringCbCatStringN@12
0x4B2F04C0: "__stdcall NtWaitForSingleObject" _NtWaitForSingleObject@12
0x4B2F08A0: "__stdcall ZwOpenEvent" _ZwOpenEvent@12
0x4B3A168C: "__cdecl RtlpHpGCTimerInitialized" _RtlpHpGCTimerInitialized
0x4B2F1CC0: "__stdcall ZwSetCachedSigningLevel" _ZwSetCachedSigningLevel@20
0x4B2A56E0: "RtlReAllocateHeap" ??_C@_0BC@KCCBPNDF@RtlReAllocateHeap?$AA@
0x4B297AC0: "SXS: %s() - Caller passed invali" ??_C@_0EB@KIOPJLPB@SXS?3?5?$CFs?$CI?$CJ?5?9?5Caller?5passed?5invali@
0x4B2F8B89: "__cdecl _rtinfnpopse" __rtinfnpopse
0x4B2CF7E4: "__stdcall LdrpQueueWork" _LdrpQueueWork@4
0x4B35C082: "__stdcall RtlpInitializeMap" _RtlpInitializeMap@8
0x4B2F1C00: "__stdcall NtRollbackComplete" _NtRollbackComplete@8
0x4B329C47: "__stdcall EtwInitializeProcess" _EtwInitializeProcess@0
0x4B2AE9FF: "__stdcall RtlpPopulateLanguageConfigList" _RtlpPopulateLanguageConfigList@12
0x4B294B04: "#%d" ??_C@_17OABLBPC@?$AA?$CD?$AA?$CF?$AAd?$AA?$AA@
0x4B2FC92A: "__cdecl _ungetc_nolock" __ungetc_nolock
0x4B2F1A10: "__stdcall NtQuerySymbolicLinkObject" _NtQuerySymbolicLinkObject@12
0x4B2F20B0: "__stdcall NtUnloadKey2" _NtUnloadKey2@8
0x4B3631D0: "__stdcall RtlKnownExceptionFilter" _RtlKnownExceptionFilter@4
0x4B369503: "__stdcall RtlpLogHeapCreateEvent" _RtlpLogHeapCreateEvent@20
0x4B304FE0: "__fastcall RtlFailFast2" @RtlFailFast2@8
0x4B2A5818: "RtlGetUserInfoHeap" ??_C@_0BD@EKECOFIP@RtlGetUserInfoHeap?$AA@
0x4B2F25EB: "__cdecl __report_gsfailure" ___report_gsfailure
0x4B376B33: "__stdcall RtlpHpLargeAllocReport" _RtlpHpLargeAllocReport@12
0x4B2F11D0: "__stdcall ZwDeleteWnfStateName" _ZwDeleteWnfStateName@4
0x4B2A73E0: "__stdcall RtlSetCurrentDirectory_U" _RtlSetCurrentDirectory_U@4
0x4B2924A8: "__cdecl LoaderFatalErrorProc" _LoaderFatalErrorProc
0x4B2945B8: "LdrpDoPostSnapWork:Unable to uns" ??_C@_0IC@OIHMCJLI@LdrpDoPostSnapWork?3Unable?5to?5uns@
0x4B2F13A0: "__stdcall ZwGetMUIRegistryInfo" _ZwGetMUIRegistryInfo@12
0x4B2FCB10: "__cdecl _i64toa_s" __i64toa_s
0x4B39ED04: "__cdecl RtlpDiskSpeedPolicy" _RtlpDiskSpeedPolicy
0x4B34C840: "__stdcall RtlInterlockedSetBitRun" _RtlInterlockedSetBitRun@12
0x4B296C14: "RtlDeactivateActivationContextUn" ??_C@_0CJ@GIJFBGBH@RtlDeactivateActivationContextUn@
0x4B2F04E0: "__stdcall ZwReadFile" _ZwReadFile@36
0x4B2C65EF: "__stdcall RtlpIsSubSegmentReuseThresholdExceeded" _RtlpIsSubSegmentReuseThresholdExceeded@8
0x4B3A17D4: "__cdecl LdrpCODScenarioTriggered" _LdrpCODScenarioTriggered
0x4B37CD18: "__stdcall EtwpDisableTraceProviders" _EtwpDisableTraceProviders@4
0x4B2A3B20: ":%u" ??_C@_03CNODDBJO@?3?$CFu?$AA@
0x4B2A75A0: "__stdcall RtlGetCurrentDirectory_U" _RtlGetCurrentDirectory_U@8
0x4B2AD0D9: "__stdcall RtlpValidateKeyTrust" _RtlpValidateKeyTrust@8
0x4B2932E4: "LdrpInitializationFailure" ??_C@_0BK@EBAFJELE@LdrpInitializationFailure?$AA@
0x4B2DF13D: "__stdcall LdrpInitializeTls" _LdrpInitializeTls@0
0x4B2E0FE0: "__stdcall RtlCreateUnicodeStringFromAsciiz" _RtlCreateUnicodeStringFromAsciiz@8
0x4B292478: "__cdecl UserLoaderGuid" _UserLoaderGuid
0x4B378F95: "__stdcall RtlpHpSegMgrVaCtxFree" _RtlpHpSegMgrVaCtxFree@12
0x4B2AA390: "__stdcall RtlDowncaseUnicodeString" _RtlDowncaseUnicodeString@12
0x4B2AAAE0: "__stdcall RtlIpv4AddressToStringExW" _RtlIpv4AddressToStringExW@16
0x4B365DBD: "__stdcall RtlpMuiRegGrowLanguageConfigList" _RtlpMuiRegGrowLanguageConfigList@8
0x4B2BDC2C: "__stdcall LdrpFindLoadedDll" _LdrpFindLoadedDll@12
0x4B2EA021: "__fastcall LdrpFindTlsEntry" @LdrpFindTlsEntry@4
0x4B36D299: "__stdcall RtlpHpParametersSupported" _RtlpHpParametersSupported@4
0x4B2F4130: "__cdecl _aulldiv" __aulldiv
0x4B2F0C70: "__stdcall NtAlpcCreateSecurityContext" _NtAlpcCreateSecurityContext@12
0x4B305000: "__stdcall RtlpExecuteHandlerForException" _RtlpExecuteHandlerForException@20
0x4B37C9CE: "__stdcall EtwpPreEnableEventApiCallback" _EtwpPreEnableEventApiCallback@4
0x4B295534: "AVRF: %ws: pid 0x%X: flags 0x%X:" ??_C@_0DP@PIHFAALA@AVRF?3?5?$CFws?3?5pid?50x?$CFX?3?5flags?50x?$CFX?3@
0x4B2FDB60: "__cdecl strcpy_s" _strcpy_s
0x4B2F0710: "__stdcall NtSetInformationFile" _NtSetInformationFile@20
0x4B379D8F: "__stdcall RtlpHpSegReportPageRange" _RtlpHpSegReportPageRange@8
0x4B2F0B60: "__stdcall ZwAdjustTokenClaimsAndDeviceGroups" _ZwAdjustTokenClaimsAndDeviceGroups@64
0x4B3A1594: "__cdecl LdrpRetryingModuleIndex" _LdrpRetryingModuleIndex
0x4B2AD677: "__stdcall _RtlpMuiRegValidateInstalled" __RtlpMuiRegValidateInstalled@4
0x4B2F0BA0: "__stdcall NtAllocateLocallyUniqueId" _NtAllocateLocallyUniqueId@4
0x4B2F20A0: "__stdcall ZwUnloadKey" _ZwUnloadKey@4
0x4B3051BC: FinalExceptionHandlerPad12
0x4B286A50: "minkernel\ntdll\ldrredirect.c" ??_C@_0BO@IMPALJMH@minkernel?2ntdll?2ldrredirect?4c?$AA@
0x4B3051C6: FinalExceptionHandlerPad22
0x4B38035D: "__stdcall EtwpWriteBufferCompressed" _EtwpWriteBufferCompressed@16
0x4B2FD2B0: "__cdecl _snwscanf_s" __snwscanf_s
0x4B2D4D30: "__stdcall SbObtainTraceHandle" _SbObtainTraceHandle@4
0x4B341770: "__stdcall RtlResetRtlTranslations" _RtlResetRtlTranslations@4
0x4B3051D0: FinalExceptionHandlerPad32
0x4B2D0370: "__stdcall TpSetWait" _TpSetWait@12
0x4B3577D0: "__stdcall RtlComputeCrc32" _RtlComputeCrc32@12
0x4B3051DA: FinalExceptionHandlerPad42
0x4B2F1950: "__stdcall ZwQueryIoCompletion" _ZwQueryIoCompletion@20
0x4B3051E4: FinalExceptionHandlerPad52
0x4B3051EE: FinalExceptionHandlerPad62
0x4B2DD27A: "__stdcall TpPostTask" _TpPostTask@16
0x4B2F1AB0: "__stdcall NtReadOnlyEnlistment" _NtReadOnlyEnlistment@8
0x4B3A0C14: "__cdecl LdrpNtDllDataTableEntry" _LdrpNtDllDataTableEntry
0x4B286EA8: "RTL: ERROR_MR_MID_NOT_FOUND is b" ??_C@_0CP@JAFLHHOF@RTL?3?5ERROR_MR_MID_NOT_FOUND?5is?5b@
0x4B35AEF3: "__stdcall RtlpHpConvertSegmentFlagsToFlags" _RtlpHpConvertSegmentFlagsToFlags@4
0x4B2951D8: "Point of Service" ??_C@_1CC@HNKKPDIO@?$AAP?$AAo?$AAi?$AAn?$AAt?$AA?5?$AAo?$AAf?$AA?5?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x4B3576B0: "__stdcall RtlGetCompressionWorkSpaceSize" _RtlGetCompressionWorkSpaceSize@12
0x4B2F09D0: "__stdcall NtTerminateThread" _NtTerminateThread@8
0x4B3698A6: "__stdcall RtlpLogHeapSubSegmentAlloc" _RtlpLogHeapSubSegmentAlloc@16
0x4B39F624: "__cdecl RtlpProcessMemoryMap" _RtlpProcessMemoryMap
0x4B376C49: "__stdcall RtlpHpLargeAllocationDestroy" _RtlpHpLargeAllocationDestroy@8
0x4B298414: "RtlpProbeAssemblyStorageRootForA" ??_C@_0CI@FNKIDNED@RtlpProbeAssemblyStorageRootForA@
0x4B3556D0: "__stdcall RtlpHpGCCallback" _RtlpHpGCCallback@12
0x4B2B2960: "__stdcall RtlpApplyLengthFunction" _RtlpApplyLengthFunction@16
0x4B35CB20: "__stdcall RtlEthernetAddressToStringW" _RtlEthernetAddressToStringW@8
0x4B2F1590: "__stdcall ZwModifyBootEntry" _ZwModifyBootEntry@4
0x4B337CA0: "__stdcall RtlReportException" _RtlReportException@12
0x4B2B1920: "__stdcall RtlSidDominatesForTrust" _RtlSidDominatesForTrust@12
0x4B361F49: "__stdcall Normalization__GetFirstDecomposedCharPlane0" _Normalization__GetFirstDecomposedCharPlane0@8
0x4B2A58A0: "RtlWalkHeap" ??_C@_0M@PHEMKBEG@RtlWalkHeap?$AA@
0x4B335D15: "__stdcall AVrfInitializeVerifier" _AVrfInitializeVerifier@24
0x4B2ABC60: "__stdcall RtlEqualWnfChangeStamps" _RtlEqualWnfChangeStamps@8
0x4B2F0DD0: "__stdcall ZwCancelWaitCompletionPacket" _ZwCancelWaitCompletionPacket@8
0x4B293C98: "Locating procedure "%Z" in Windo" ??_C@_0FD@OCNDOPIA@Locating?5procedure?5?$CC?$CFZ?$CC?5in?5Windo@
0x4B2DB32B: "__stdcall FindDirectoryEntry" _FindDirectoryEntry@16
0x4B2867A4: "exp10" ??_C@_05EOHGHCHD@exp10?$AA@
0x4B2F1DA0: "__stdcall ZwSetInformationJobObject" _ZwSetInformationJobObject@16
0x4B2B7170: "__stdcall RtlDosPathNameToNtPathName_U_WithStatus" _RtlDosPathNameToNtPathName_U_WithStatus@16
0x4B3A1660: "__cdecl LdrpDllDirectoryLock" _LdrpDllDirectoryLock
0x4B3387A8: "__stdcall WerpCreateCrashDataSection" _WerpCreateCrashDataSection@8
0x4B2F1D90: "__stdcall NtSetInformationEnlistment" _NtSetInformationEnlistment@16
0x4B299320: "Thread is in a state in which it" ??_C@_0DP@HMPPJKDA@Thread?5is?5in?5a?5state?5in?5which?5it@
0x4B303090: "__stdcall MD4Transform" _MD4Transform@8
0x4B2F1FF0: "__stdcall ZwSuspendThread" _ZwSuspendThread@8
0x4B3A1788: "__cdecl RtlpHpHeapFeatures" _RtlpHpHeapFeatures
0x4B2EBE30: "__stdcall RtlpHpAppCompatDontChangePolicy" _RtlpHpAppCompatDontChangePolicy@0
0x4B2928E8: "%04x:%04x @ %08d - %s - %s: " ??_C@_0BN@MFBHLMMI@?$CF04x?3?$CF04x?5?$EA?5?$CF08d?5?9?5?$CFs?5?9?5?$CFs?3?5?$AA@
0x4B2F4B10: "__cdecl _snprintf" __snprintf
0x4B331D4B: "__stdcall LdrpFatalExceptionFilter" _LdrpFatalExceptionFilter@4
0x4B2F09B0: "__stdcall ZwQuerySection" _ZwQuerySection@20
0x4B32F328: "__stdcall LdrpInitializationFailure" _LdrpInitializationFailure@4
0x4B2F1680: "__stdcall NtOpenMutant" _NtOpenMutant@12
0x4B2AB9C0: "__stdcall RtlGetExePath" _RtlGetExePath@8
0x4B2D49DF: "__stdcall SbpUpdateCache" _SbpUpdateCache@16
0x4B304750: "__stdcall NtdllComboBoxWndProcWorker" _NtdllComboBoxWndProcWorker@0
0x4B2CF9FC: "__stdcall RtlpAllocateUserBlockFromHeap" _RtlpAllocateUserBlockFromHeap@16
0x4B381BBB: "__stdcall TppETWCallbackStop" _TppETWCallbackStop@20
0x4B2F07E0: "__stdcall ZwDelayExecution" _ZwDelayExecution@8
0x4B2F0EE0: "__stdcall ZwCreateEnlistment" _ZwCreateEnlistment@32
0x4B2876D4: "__stdcall _imp__NtQueryValueKey" __imp__NtQueryValueKey@24
0x4B39D190: "__stdcall RtlFreeMemoryBlockLookaside" _RtlFreeMemoryBlockLookaside@8
0x4B376AE7: "__stdcall RtlpHpLargeAllocGetMetadata" _RtlpHpLargeAllocGetMetadata@8
0x4B2DCE00: "__stdcall RtlpTpWorkCallback" _RtlpTpWorkCallback@8
0x4B2D9DB0: "__stdcall _TlgEnableCallback" __TlgEnableCallback@36
0x4B3397E0: "__stdcall RtlTestAndPublishWnfStateData" _RtlTestAndPublishWnfStateData@28
0x4B336679: "__stdcall AVrfpEnableStackVerifier" _AVrfpEnableStackVerifier@0
0x4B2E7767: "__stdcall GetLCIDFromLangListNode" _GetLCIDFromLangListNode@12
0x4B2E250F: "__stdcall RtlpValidateActivationContextData" _RtlpValidateActivationContextData@12
0x4B2A3A68: "Inspecting leaks at process shut" ??_C@_0CK@FGJCKAOL@Inspecting?5leaks?5at?5process?5shut@
0x4B2F8D16: "__cdecl _d_inttype" __d_inttype
0x4B3871F0: "__stdcall RtlStackDbStackAdd" _RtlStackDbStackAdd@12
0x4B2FE040: "__cdecl wcscpy_s" _wcscpy_s
0x4B3A1830: "__cdecl g_disableEscalation" _g_disableEscalation
0x4B333F51: "__stdcall RtlpInitializeAllowedAce" _RtlpInitializeAllowedAce@24
0x4B2A5C64: "(ROUND_UP_TO_POWER2(Size, PAGE_S" ??_C@_0CO@HBNLODKA@?$CIROUND_UP_TO_POWER2?$CISize?0?5PAGE_S@
0x4B349C2C: "__stdcall RtlpValidAccessFilterAce" _RtlpValidAccessFilterAce@4
0x4B36CB0F: "__stdcall RtlpValidateHeapSegment" _RtlpValidateHeapSegment@32
0x4B2D88B2: "__stdcall EtwpRegisterProvider" _EtwpRegisterProvider@12
0x4B33A3F0: "__stdcall LdrRemoveDllDirectory" _LdrRemoveDllDirectory@4
0x4B3A0C70: "__cdecl LdrpProcessInitialized" _LdrpProcessInitialized
0x4B366297: "__stdcall RtlpMuiRegResizeStringPool" _RtlpMuiRegResizeStringPool@16
0x4B293518: "LdrpInitShimEngine" ??_C@_0BD@NFCOMHHO@LdrpInitShimEngine?$AA@
0x4B3322C0: "__stdcall RtlReadMemoryStream" _RtlReadMemoryStream@16
0x4B2EA78E: "__stdcall LdrAllocateMrdataHeap" _LdrAllocateMrdataHeap@4
0x4B2989C8: "FilterFullPath" ??_C@_1BO@JOOJEFDK@?$AAF?$AAi?$AAl?$AAt?$AAe?$AAr?$AAF?$AAu?$AAl?$AAl?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x4B3503ED: "__stdcall RtlUpdateProcessRegistryInfo" _RtlUpdateProcessRegistryInfo@0
0x4B3816A0: "__stdcall TpCallbackReleaseSemaphoreOnCompletion" _TpCallbackReleaseSemaphoreOnCompletion@12
0x4B2FD220: "__cdecl _vsnwprintf_s" __vsnwprintf_s
0x4B2C5460: "__fastcall RtlpFreeHeap" @RtlpFreeHeap@16
0x4B2F88F2: "__cdecl _rtindfnpop" __rtindfnpop
0x4B2EA610: "__stdcall RtlIpv4StringToAddressA" _RtlIpv4StringToAddressA@16
0x4B2F0C40: "__stdcall NtAlpcCreatePortSection" _NtAlpcCreatePortSection@24
0x4B2ED540: "__stdcall EtwpGetNextRegistration" _EtwpGetNextRegistration@4
0x4B3041F4: "__stdcall RtlpHpVsContextFreeInternal" _RtlpHpVsContextFreeInternal@20
0x4B285B30: ":" ??_C@_13EBCNDICG@?$AA?3?$AA?$AA@
0x4B36F650: "__stdcall RtlDecompressFragmentLZNT1" _RtlDecompressFragmentLZNT1@32
0x4B2E97E3: "__stdcall RtlpWaitOnAddressRemoveWaitBlock" _RtlpWaitOnAddressRemoveWaitBlock@8
0x4B286828: "frexp" ??_C@_05GKKHEGJL@frexp?$AA@
0x4B368FFC: "__stdcall RtlpInitializeStackTraceLog" _RtlpInitializeStackTraceLog@0
0x4B29A260: "Crc32 Castagnoli" ??_C@_0BB@IDNEKPJL@Crc32?5Castagnoli?$AA@
0x4B2A4908: "heap_failure_block_not_busy" ??_C@_0BM@MCBFAPEC@heap_failure_block_not_busy?$AA@
0x4B2954FC: "VerifierDebug" ??_C@_1BM@IPPIJOJD@?$AAV?$AAe?$AAr?$AAi?$AAf?$AAi?$AAe?$AAr?$AAD?$AAe?$AAb?$AAu?$AAg?$AA?$AA@
0x4B2DDD78: "__stdcall TpReserveTaskPost" _TpReserveTaskPost@12
0x4B2F0780: "__stdcall NtReadFileScatter" _NtReadFileScatter@36
0x4B375973: "__stdcall RtlpHpLfhSubsegmentDecBlockCounts" _RtlpHpLfhSubsegmentDecBlockCounts@20
0x4B2B33D1: "__stdcall LdrpAppCompatRedirect" _LdrpAppCompatRedirect@20
0x4B2F05A0: "__stdcall ZwOpenKey" _ZwOpenKey@12
0x4B369C0B: "__stdcall RtlpLogHeapWalkEvent" _RtlpLogHeapWalkEvent@4
0x4B2E69D5: "__stdcall RtlpWin32NtNameToNtPathName" _RtlpWin32NtNameToNtPathName@24
0x4B281C30: "__cdecl Crc32Ctrl" _Crc32Ctrl
0x4B2F21A0: "__stdcall NtWow64CsrIdentifyAlertableThread" _NtWow64CsrIdentifyAlertableThread@0
0x4B2F8920: "__cdecl _twoToTOS" __twoToTOS
0x4B36BAAD: "__stdcall RtlDebugReAllocateHeap" _RtlDebugReAllocateHeap@16
0x4B2B1F3F: "__stdcall IsProgramFilesPath" _IsProgramFilesPath@8
0x4B2A4668: "\Registry\Machine\System\Current" ??_C@_1IO@MNHMIIKM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B3341C0: "__stdcall RtlDeCommitDebugInfo" _RtlDeCommitDebugInfo@12
0x4B2BB9A0: "__stdcall LdrpGetFromMUIMemCache" _LdrpGetFromMUIMemCache@16
0x4B344720: "__stdcall RtlSidHashLookup" _RtlSidHashLookup@8
0x4B2F0C30: "__stdcall ZwAlpcCreatePort" _ZwAlpcCreatePort@12
0x4B34ECF0: "__stdcall RtlConvertLCIDToString" _RtlConvertLCIDToString@20
0x4B299630: "Break repeatedly, break Once, Ig" ??_C@_0FH@DEPJAKLD@Break?5repeatedly?0?5break?5Once?0?5Ig@
0x4B2DB650: "__stdcall RtlBackoff" _RtlBackoff@4
0x4B2F0A80: "__stdcall NtTraceEvent" _NtTraceEvent@16
0x4B28678C: "exp" ??_C@_03KHJOGHMM@exp?$AA@
0x4B333F30: "__stdcall RtlSetSecurityObjectEx" _RtlSetSecurityObjectEx@24
0x4B33B670: "__stdcall RtlpQueryInformationActivationContextManifestResourceName" _RtlpQueryInformationActivationContextManifestResourceName@16
0x4B3A1250: "__cdecl RtlpCurDirRef" _RtlpCurDirRef
0x4B304570: "__stdcall NtdllComboListBoxProc_W" _NtdllComboListBoxProc_W@0
0x4B2EDDE4: "__stdcall EtwpSendSessionNotification" _EtwpSendSessionNotification@12
0x4B33C4B0: "__stdcall AlpcGetOutstandingCompletionListMessageCount" _AlpcGetOutstandingCompletionListMessageCount@4
0x4B34AE20: "__stdcall RtlEqualComputerName" _RtlEqualComputerName@8
0x4B386C29: "__stdcall RtlpQueryDiskSpeedPolicy" _RtlpQueryDiskSpeedPolicy@4
0x4B34A260: "__stdcall RtlEmptyAtomTable" _RtlEmptyAtomTable@8
0x4B347C99: "__stdcall RtlpPossibleDeadlock" _RtlpPossibleDeadlock@4
0x4B364C20: "__stdcall RtlpTraceDatabaseInternalAdd" _RtlpTraceDatabaseInternalAdd@16
0x4B2DA2B8: "__stdcall EtwpRemoveRegistrationFromTable" _EtwpRemoveRegistrationFromTable@4
0x4B2D36D0: "__stdcall TpAllocTimer" _TpAllocTimer@16
0x4B3A0B44: "__cdecl LdrpMapAndSnapWork" _LdrpMapAndSnapWork
0x4B2C0C60: "__stdcall RtlpFindUnicodeStringInSection" _RtlpFindUnicodeStringInSection@32
0x4B293D8C: "Finding KernelbasePostInit faile" ??_C@_0DH@CBHMKPBI@Finding?5KernelbasePostInit?5faile@
0x4B39FB68: "__cdecl NlsUnicodeToOemData" _NlsUnicodeToOemData
0x4B34B1C0: "__stdcall RtlUpcaseUnicodeStringToOemString" _RtlUpcaseUnicodeStringToOemString@12
0x4B35E926: "__stdcall CfgAddressToBitState" _CfgAddressToBitState@12
0x4B287850: "KERNEL32.DLL" ??_C@_1BK@DBDEIDLH@?$AAK?$AAE?$AAR?$AAN?$AAE?$AAL?$AA3?$AA2?$AA?4?$AAD?$AAL?$AAL?$AA?$AA@
0x4B29528C: "Xbox One X" ??_C@_1BG@EIECPFI@?$AAX?$AAb?$AAo?$AAx?$AA?5?$AAO?$AAn?$AAe?$AA?5?$AAX?$AA?$AA@
0x4B381E12: "__stdcall TppETWTimerCancelled" _TppETWTimerCancelled@8
0x4B2F1580: "__stdcall ZwMapViewOfSectionEx" _ZwMapViewOfSectionEx@36
0x4B2F8771: "__cdecl _trandisp2" __trandisp2
0x4B35DC10: "__cdecl RtlSetProcessIsCritical" _RtlSetProcessIsCritical
0x4B2EA09F: "__stdcall SbCleanupTrace" _SbCleanupTrace@0
0x4B2F8700: "__cdecl _trandisp1" __trandisp1
0x4B286880: "__cdecl __lookuptable_s" ___lookuptable_s
0x4B32E929: "__stdcall LdrpSetProtection" _LdrpSetProtection@8
0x4B36456E: "__stdcall RtlpCtContextFree" _RtlpCtContextFree@4
0x4B37B096: "__stdcall RtlpHpVsChunkCoalesce" _RtlpHpVsChunkCoalesce@16
0x4B37F239: "__stdcall EtwpReceiveReplyDataBlock" _EtwpReceiveReplyDataBlock@36
0x4B2C5440: "__stdcall RtlGetCurrentServiceSessionId" _RtlGetCurrentServiceSessionId@0
0x4B2F56F0: "__cdecl _wcstoui64" __wcstoui64
0x4B39F700: "__cdecl RegistryInfoCritSect" _RegistryInfoCritSect
0x4B36955E: "__stdcall RtlpLogHeapDecommit" _RtlpLogHeapDecommit@16
0x4B2F1BC0: "__stdcall ZwResetWriteWatch" _ZwResetWriteWatch@12
0x4B295E88: "WMRSendMessageString" ??_C@_1CK@BNKGAPAP@?$AAW?$AAM?$AAR?$AAS?$AAe?$AAn?$AAd?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AA?$AA@
0x4B304E00: "__stdcall RtlLargeIntegerNegate" _RtlLargeIntegerNegate@8
0x4B34757F: "__stdcall RtlpValidLabelSubjectContext" _RtlpValidLabelSubjectContext@16
0x4B2A5860: "RtlCompactHeap" ??_C@_0P@NCPMIHJ@RtlCompactHeap?$AA@
0x4B3637F0: "__stdcall RtlUnlockCurrentThread" _RtlUnlockCurrentThread@0
0x4B2AA5B0: "__stdcall RtlCreateMemoryZone" _RtlCreateMemoryZone@12
0x4B2F0880: "__stdcall NtClearEvent" _NtClearEvent@4
0x4B3A14A0: "__cdecl LdrpCreateActCtxLanguageW" _LdrpCreateActCtxLanguageW
0x4B3311A3: "__stdcall LdrpCaptureCriticalThunks" _LdrpCaptureCriticalThunks@0
0x4B2F1C20: "__stdcall ZwRollbackRegistryTransaction" _ZwRollbackRegistryTransaction@8
0x4B304C20: "__stdcall RtlExtendedLargeIntegerDivide" _RtlExtendedLargeIntegerDivide@16
0x4B39F124: "__cdecl RtlpHpLfhPerfFlags" _RtlpHpLfhPerfFlags
0x4B2F0D00: "__stdcall ZwAlpcOpenSenderThread" _ZwAlpcOpenSenderThread@24
0x4B2F1B00: "__stdcall ZwRegisterThreadTerminatePort" _ZwRegisterThreadTerminatePort@4
0x4B34D1B0: "__stdcall RtlAvlRemoveNode" _RtlAvlRemoveNode@8
0x4B285AC0: "__cdecl GuidFormat" _GuidFormat
0x4B305240: "__stdcall RtlRaiseStatus" _RtlRaiseStatus@4
0x4B2CD050: "__stdcall RtlIntegerToUnicode" _RtlIntegerToUnicode@16
0x4B2879FC: "SwitchedRtlGetVersion_Win8" ??_C@_1DG@GJHPOFBG@?$AAS?$AAw?$AAi?$AAt?$AAc?$AAh?$AAe?$AAd?$AAR?$AAt?$AAl?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA_?$AAW?$AAi?$AAn?$AA8?$AA?$AA@
0x4B286818: "_hypot" ??_C@_06MEIMCGCF@_hypot?$AA@
0x4B36D268: "__stdcall RtlpHpEnvGetEnvHandleFromParams" _RtlpHpEnvGetEnvHandleFromParams@4
0x4B3A166C: "__cdecl MuiCacheSWRLock" _MuiCacheSWRLock
0x4B376464: "__stdcall RtlpHpLfhSubsegmentWalk" _RtlpHpLfhSubsegmentWalk@24
0x4B2EB747: "__stdcall EtwpRegisterGuidsApiCallback" _EtwpRegisterGuidsApiCallback@12
0x4B286808: "ldexp" ??_C@_05CEJMAHNP@ldexp?$AA@
0x4B281678: "__cdecl _load_config_used" __load_config_used
0x4B3824F0: "__stdcall RtlDeregisterWait" _RtlDeregisterWait@4
0x4B2AACE0: "__stdcall RtlSetThreadErrorMode" _RtlSetThreadErrorMode@8
0x4B378EDD: "__stdcall RtlpHpSegMgrVaCtxAlloc" _RtlpHpSegMgrVaCtxAlloc@12
0x4B2F0F50: "__stdcall ZwCreateKeyedEvent" _ZwCreateKeyedEvent@16
0x4B2A6C74: "__stdcall RebalanceNode" _RebalanceNode@4
0x4B2EDB43: "__stdcall EtwpStartUmLogger" _EtwpStartUmLogger@16
0x4B2A8800: "__stdcall RtlIdnToUnicode" _RtlIdnToUnicode@20
0x4B34CD10: "__stdcall RtlSetAllBits" _RtlSetAllBits@4
0x4B2F1C90: "__stdcall NtSerializeBoot" _NtSerializeBoot@0
0x4B2F89CB: "__cdecl _math_exit" __math_exit
0x4B2B1300: "__stdcall RtlEqualSid" _RtlEqualSid@8
0x4B2E4E7F: "__stdcall RtlpOpenImageFileOptionsKeyEx" _RtlpOpenImageFileOptionsKeyEx@16
0x4B2F66B0: "__cdecl memmove" _memmove
0x4B32CD34: "__stdcall LdrpAddNodeServiceTag" _LdrpAddNodeServiceTag@8
0x4B3744AF: "__stdcall RtlpHpRegisterEnvironment" _RtlpHpRegisterEnvironment@8
0x4B2F2010: "__stdcall NtTerminateEnclave" _NtTerminateEnclave@8
0x4B285068: "LdrpResGetResourceDirectory Ente" ??_C@_1EE@NILCEPIN@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAG?$AAe?$AAt?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AA?5?$AAE?$AAn?$AAt?$AAe@
0x4B292408: "__cdecl AeSbContextUpdateEvent" _AeSbContextUpdateEvent
0x4B36F880: "__stdcall RtlCompressBufferXpressHuff" _RtlCompressBufferXpressHuff@32
0x4B287BD8: "Force lfh subsegments to be full" ??_C@_1LA@IMJDKNPN@?$AAF?$AAo?$AAr?$AAc?$AAe?$AA?5?$AAl?$AAf?$AAh?$AA?5?$AAs?$AAu?$AAb?$AAs?$AAe?$AAg?$AAm?$AAe?$AAn?$AAt?$AAs?$AA?5?$AAt?$AAo?$AA?5?$AAb?$AAe?$AA?5?$AAf?$AAu?$AAl?$AAl@
0x4B3A4200: "__cdecl g_pfnSE_ShimDllLoaded" _g_pfnSE_ShimDllLoaded
0x4B333C70: "__stdcall RtlQuerySecurityObject" _RtlQuerySecurityObject@20
0x4B347EB0: "__stdcall RtlAddAccessDeniedAceEx" _RtlAddAccessDeniedAceEx@20
0x4B33CB00: "__stdcall LdrSetMUICacheType" _LdrSetMUICacheType@4
0x4B2F1740: "__stdcall ZwOpenTransaction" _ZwOpenTransaction@20
0x4B33C5C0: "__stdcall AlpcUnregisterCompletionList" _AlpcUnregisterCompletionList@4
0x4B37FD41: "__stdcall EvtIntReportEventWorker" _EvtIntReportEventWorker@48
0x4B2F0D70: "__stdcall ZwAssignProcessToJobObject" _ZwAssignProcessToJobObject@8
0x4B333085: "__stdcall RtlpUnlockFlsCallbackVector" _RtlpUnlockFlsCallbackVector@4
0x4B36B899: "__stdcall RtlDebugGetUserInfoHeap" _RtlDebugGetUserInfoHeap@20
0x4B28585C: "DebugProcessHeapOnly" ??_C@_1CK@PBPNFNEK@?$AAD?$AAe?$AAb?$AAu?$AAg?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAH?$AAe?$AAa?$AAp?$AAO?$AAn?$AAl?$AAy?$AA?$AA@
0x4B295ED8: "\Registry\Machine\Software\Micro" ??_C@_1KA@BFMIEKLO@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B2DC890: "__stdcall TppTimerpFree" _TppTimerpFree@4
0x4B2F0F20: "__stdcall ZwCreateJobObject" _ZwCreateJobObject@12
0x4B2EDE99: "__stdcall EtwpGetUmLoggerInfoFromContext" _EtwpGetUmLoggerInfoFromContext@12
0x4B2A9C4A: "__stdcall RtlpTraverseParents" _RtlpTraverseParents@24
0x4B3819C9: "__stdcall TppETWCallbackCancel" _TppETWCallbackCancel@24
0x4B281840: "__cdecl Wow64EnvironmentThunkTable" _Wow64EnvironmentThunkTable
0x4B2BB000: "__stdcall LdrResolveDelayLoadedAPI" _LdrResolveDelayLoadedAPI@24
0x4B2DEC12: "__stdcall RtlUnicodeStringCbCopyStringN" _RtlUnicodeStringCbCopyStringN@12
0x4B2E15D0: "__stdcall RtlpEnsureBufferSize" _RtlpEnsureBufferSize@12
0x4B2A5E48: "lsass.exe" ??_C@_1BE@FPBDCMAD@?$AAl?$AAs?$AAa?$AAs?$AAs?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x4B35722D: "__stdcall RtlpWalkHeapInternal" _RtlpWalkHeapInternal@12
0x4B2F8370: "__cdecl wcsstr" _wcsstr
0x4B2F2760: "__stdcall DbgBreakPointWithStatus" _DbgBreakPointWithStatus@4
0x4B2F0A60: "__stdcall ZwSetInformationObject" _ZwSetInformationObject@16
0x4B2C73E0: "__stdcall LdrpFindLoadedDllByName" _LdrpFindLoadedDllByName@20
0x4B2F1F10: "__stdcall ZwSetTimer2" _ZwSetTimer2@16
0x4B2A9ED0: "__stdcall RtlxUnicodeStringToAnsiSize" _RtlxUnicodeStringToAnsiSize@4
0x4B2F1550: "__stdcall ZwManagePartition" _ZwManagePartition@20
0x4B39F618: "__cdecl g_hUserDiagnosticProvider" _g_hUserDiagnosticProvider
0x4B3877CF: "__stdcall RtlpStackDbEntryCleanup" _RtlpStackDbEntryCleanup@8
0x4B368E07: "__stdcall RtlpHpStackTraceSerializeRemote" _RtlpHpStackTraceSerializeRemote@4
0x4B294650: "Probing for the manifest of DLL " ??_C@_0EC@CEPGMLAL@Probing?5for?5the?5manifest?5of?5DLL?5@
0x4B286868: "__cdecl _d_mzero" __d_mzero
0x4B287978: "Allows getting the 6.2 version o" ??_C@_1IC@FIFJLKP@?$AAA?$AAl?$AAl?$AAo?$AAw?$AAs?$AA?5?$AAg?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AA6?$AA?4?$AA2?$AA?5?$AAv?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAo@
0x4B354AA0: "__stdcall RtlpCallInterceptRoutine" _RtlpCallInterceptRoutine@20
0x4B293120: "LdrParentRtlInitializeNtUserPfn" ??_C@_0CA@FFFEFGMG@LdrParentRtlInitializeNtUserPfn?$AA@
0x4B2F1290: "__stdcall ZwFilterTokenEx" _ZwFilterTokenEx@56
0x4B2F29E0: "__stdcall RtlUserThreadStart" _RtlUserThreadStart@8
0x4B34E030: "__stdcall RtlRestoreSystemBootStatusDefaults" _RtlRestoreSystemBootStatusDefaults@0
0x4B2F6E90: "__cdecl qsort_s" _qsort_s
0x4B2F4AA0: "__cdecl _memccpy" __memccpy
0x4B281988: "__cdecl RtlpDosLPTDevice" _RtlpDosLPTDevice
0x4B2E3390: "__stdcall RtlSetUserValueHeap" _RtlSetUserValueHeap@16
0x4B34E370: "__stdcall RtlpSystemBootStatusRequest" _RtlpSystemBootStatusRequest@16
0x4B378456: "__stdcall RtlpHpSegGetDescriptorValidateSafe" _RtlpHpSegGetDescriptorValidateSafe@8
0x4B2F55D0: "__cdecl _wcsnset_s" __wcsnset_s
0x4B37415D: "__stdcall RtlpHpReAllocateHeap" _RtlpHpReAllocateHeap@24
0x4B343260: "__stdcall RtlSelfRelativeToAbsoluteSD2" _RtlSelfRelativeToAbsoluteSD2@8
0x4B2EA480: "__stdcall RtlCheckForOrphanedCriticalSections" _RtlCheckForOrphanedCriticalSections@4
0x4B2DE291: "__stdcall TpBindFileToDirect" _TpBindFileToDirect@12
0x4B2EB190: "__stdcall TppExecuteWaitTimerCallback" _TppExecuteWaitTimerCallback@8
0x4B33A4E0: "__stdcall LdrUpdatePackageSearchPath" _LdrUpdatePackageSearchPath@4
0x4B2EC1DC: "__stdcall TppIteWakeWaiters" _TppIteWakeWaiters@4
0x4B3046B0: "__stdcall NtdllDispatchHook_W" _NtdllDispatchHook_W@0
0x4B2CF733: "__stdcall TppWorkerSwitchNode" _TppWorkerSwitchNode@16
0x4B297510: "SXS: %s() found assembly informa" ??_C@_0HP@GMBLBKCE@SXS?3?5?$CFs?$CI?$CJ?5found?5assembly?5informa@
0x4B28148C: "__cdecl RtlpEmptyString" _RtlpEmptyString
0x4B2F0D60: "__stdcall ZwAreMappedFilesTheSame" _ZwAreMappedFilesTheSame@8
0x4B381790: "__stdcall TpDbgDumpHeapUsage" _TpDbgDumpHeapUsage@12
0x4B2EAB60: "__stdcall LdrSetDllManifestProber" _LdrSetDllManifestProber@12
0x4B2CF2E0: "__stdcall TppWorkCallbackEpilog" _TppWorkCallbackEpilog@4
0x4B2C2D70: "__fastcall RtlpAllocateHeap" @RtlpAllocateHeap@24
0x4B3395D0: "__stdcall WinSqmCheckEscalationSetDWORD" _WinSqmCheckEscalationSetDWORD@16
0x4B2AC860: "__stdcall WinSqmSetDWORD" _WinSqmSetDWORD@12
0x4B3A37B4: "__cdecl RtlpTpIoTree" _RtlpTpIoTree
0x4B32B480: "__stdcall LdrCreateEnclave" _LdrCreateEnclave@36
0x4B2D07BB: "__stdcall TppStartThreadData" _TppStartThreadData@16
0x4B2A8600: "__stdcall RtlpTpTimerQueueRundown" _RtlpTpTimerQueueRundown@4
0x4B286D74: "RTL: Re-Waiting " ??_C@_0BB@MGOBPNHN@RTL?3?5Re?9Waiting?6?$AA@
0x4B29315C: "LdrParentRtlRetrieveNtUserPfn" ??_C@_0BO@BHANHGHL@LdrParentRtlRetrieveNtUserPfn?$AA@
0x4B284760: "\Registry\Machine\System\Current" ??_C@_1IG@EEKPLJNI@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B2863D8: "__cdecl __newclmap" ___newclmap
0x4B2A910D: "__stdcall RtlpRegisterLockedMemoryZone" _RtlpRegisterLockedMemoryZone@0
0x4B38303F: "__stdcall SbpParseFuncName" _SbpParseFuncName@20
0x4B2DB4D0: "__stdcall RtlNtStatusToDosError" _RtlNtStatusToDosError@4
0x4B3A093C: "__cdecl LdrpFatalHardErrorCount" _LdrpFatalHardErrorCount
0x4B386D26: "__stdcall RtlStackDbContextCleanup" _RtlStackDbContextCleanup@4
0x4B2F8660: "__cdecl wcstombs" _wcstombs
0x4B2F1110: "__stdcall NtCreateWorkerFactory" _NtCreateWorkerFactory@40
0x4B3464FB: "__stdcall RtlpSetSecurityObject" _RtlpSetSecurityObject@32
0x4B292390: "\/" ??_C@_15MNCACJLI@?$AA?2?$AA?1?$AA?$AA@
0x4B292678: "CLIENT(ntdll): Tyring to fix pro" ??_C@_0EP@GEPLFMPM@CLIENT?$CIntdll?$CJ?3?5Tyring?5to?5fix?5pro@
0x4B2F50BC: "__cdecl _vscprintf_helper" __vscprintf_helper
0x4B2F1DC0: "__stdcall ZwSetInformationResourceManager" _ZwSetInformationResourceManager@16
0x4B2953A4: "RegisterEventSourceW" ??_C@_0BF@FNOHIELI@RegisterEventSourceW?$AA@
0x4B360BF0: "__stdcall RtlIsPartialPlaceholderFileInfo" _RtlIsPartialPlaceholderFileInfo@12
0x4B3A00E0: "__cdecl AVrfpVerifierProvidersList" _AVrfpVerifierProvidersList
0x4B2F0AE0: "__stdcall NtAccessCheckByTypeResultList" _NtAccessCheckByTypeResultList@44
0x4B33854C: "__stdcall WaitForWerSvc" _WaitForWerSvc@4
0x4B2F0ED0: "__stdcall ZwCreateEnclave" _ZwCreateEnclave@36
0x4B2F1330: "__stdcall ZwFreezeTransactions" _ZwFreezeTransactions@8
0x4B2AACA0: "__stdcall RtlNumberGenericTableElements" _RtlNumberGenericTableElements@4
0x4B2928A8: "\\?\UNC\" ??_C@_1BC@NAEGMMKI@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAU?$AAN?$AAC?$AA?2?$AA?$AA@
0x4B2B4FDD: "__stdcall RtlULongPtrSub" _RtlULongPtrSub@12
0x4B3A37B8: "__cdecl RtlpTpIoDllNotificationCookie" _RtlpTpIoDllNotificationCookie
0x4B39FB64: "__cdecl NlsOemCodePageIsUTF8" _NlsOemCodePageIsUTF8
0x4B334C6E: "__stdcall RtlQueryProcessModuleInformation" _RtlQueryProcessModuleInformation@12
0x4B39E000: "__cdecl _infinity" __infinity
0x4B2EC1B7: "__stdcall TppItePush" _TppItePush@8
0x4B3645B2: "__stdcall RtlpCtContextInit" _RtlpCtContextInit@8
0x4B287CF0: "Use the heaps default app compat" ??_C@_1FG@IGGKDKML@?$AAU?$AAs?$AAe?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAh?$AAe?$AAa?$AAp?$AAs?$AA?5?$AAd?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?5?$AAa?$AAp?$AAp?$AA?5?$AAc?$AAo?$AAm?$AAp?$AAa?$AAt@
0x4B2F11C0: "__stdcall NtDeleteWnfStateData" _NtDeleteWnfStateData@8
0x4B2DC540: "__stdcall TpReleaseIoCompletion" _TpReleaseIoCompletion@4
0x4B304F4B: "__stdcall LdrpValidateUserCallTargetBitMapCheck1" _LdrpValidateUserCallTargetBitMapCheck1@0
0x4B284FB0: "LdrResSearchResource Exit" ??_C@_1DE@DFJEAAGE@?$AAL?$AAd?$AAr?$AAR?$AAe?$AAs?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAE?$AAx?$AAi?$AAt?$AA?$AA@
0x4B299890: "\Registry\Machine\System\Current" ??_C@_1IA@GPBHBJN@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B3395A0: "__stdcall WinSqmSetDWORD64" _WinSqmSetDWORD64@16
0x4B2B31B1: "__stdcall LdrpMapDllFullPath" _LdrpMapDllFullPath@4
0x4B39E904: "__cdecl RtlpLargestLfhBlock" _RtlpLargestLfhBlock
0x4B2CC0FB: "__stdcall RtlpInitUnicodeStringUsingBuffer" _RtlpInitUnicodeStringUsingBuffer@16
0x4B2F6370: "__cdecl memcpy" _memcpy
0x4B284CD4: ".mui" ??_C@_19BLMODFHL@?$AA?4?$AAm?$AAu?$AAi?$AA?$AA@
0x4B2BCBC0: "__stdcall RtlImageNtHeaderEx" _RtlImageNtHeaderEx@20
0x4B2E93A0: "__stdcall TpCheckTerminateWorker" _TpCheckTerminateWorker@4
0x4B3A16A4: "__cdecl LdrpInvertedFunctionTableSRWLock" _LdrpInvertedFunctionTableSRWLock
0x4B39E728: "__cdecl RtlpDebugPageHeapTable" _RtlpDebugPageHeapTable
0x4B3A0BB0: "__cdecl LdrpEnforceIntegrityContinuity" _LdrpEnforceIntegrityContinuity
0x4B2F5AA0: "__cdecl _wtoi" __wtoi
0x4B35DD00: "__stdcall UserDiagnosticProviderCallback" _UserDiagnosticProviderCallback@36
0x4B2EC837: "__stdcall SHA256Final" _SHA256Final@8
0x4B298DE8: "TargetPath" ??_C@_1BG@MOOPBIGC@?$AAT?$AAa?$AAr?$AAg?$AAe?$AAt?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x4B2D204C: "__stdcall RtlpUnWaitCriticalSectionEx" _RtlpUnWaitCriticalSectionEx@8
0x4B28C2D8: "CONTACTS" ??_C@_1BC@EFOJIMEP@?$AAC?$AAO?$AAN?$AAT?$AAA?$AAC?$AAT?$AAS?$AA?$AA@
0x4B288C18: "\Registry\Machine\System\Current" ??_C@_1LA@PLBLPNML@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x4B29EE88: "__cdecl crc64Map32_" _crc64Map32_
0x4B33BF10: "__stdcall CsrClientCallServer" _CsrClientCallServer@16
0x4B33688C: "__stdcall AVrfpLoadAndInitializeProvider" _AVrfpLoadAndInitializeProvider@4
0x4B2F08E0: "__stdcall ZwQueryDefaultUILanguage" _ZwQueryDefaultUILanguage@4
0x4B2F21D0: "__stdcall ZwWow64CsrFreeCaptureBuffer" _ZwWow64CsrFreeCaptureBuffer@4
0x4B299D64: "VirtualQuery Failed 0x%p %x " ??_C@_0BN@BPEILKGA@VirtualQuery?5Failed?50x?$CFp?5?$CFx?6?$AA@
0x4B37574B: "__stdcall RtlpHpLfhSubsegmentComputeCommitUnit" _RtlpHpLfhSubsegmentComputeCommitUnit@8
0x4B2FDFB0: "__cdecl wcscat_s" _wcscat_s
0x4B2AF2E7: "__stdcall RtlpOwnerAcesPresent" _RtlpOwnerAcesPresent@8
0x4B2DEF7E: "__stdcall RtlUnlockProcessHeapOnProcessTerminate" _RtlUnlockProcessHeapOnProcessTerminate@0
0x4B353C20: "__stdcall RtlCompactHeap" _RtlCompactHeap@8
0x4B2F5A30: "__cdecl _wcsupr_s" __wcsupr_s
0x4B36A76E: "__stdcall RtlpHpTagDestroyHeap" _RtlpHpTagDestroyHeap@4
0x4B2FBBA0: "__cdecl _mbstrlen" __mbstrlen
0x4B2E2930: "__stdcall ULongAdd" _ULongAdd@12
0x4B2E8B5A: "__stdcall RtlpLookupCurDirSetting" _RtlpLookupCurDirSetting@12
0x4B2D1FE1: "__fastcall RtlpWaitOnAddressWithTimeout" @RtlpWaitOnAddressWithTimeout@16
0x4B2F1560: "__stdcall ZwMapCMFModule" _ZwMapCMFModule@24
0x4B285438: "OverlayPackages" ??_C@_1CA@OFGCFIP@?$AAO?$AAv?$AAe?$AAr?$AAl?$AAa?$AAy?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAs?$AA?$AA@
0x4B2FDCC0: "__cdecl strncpy_s" _strncpy_s
0x4B34B350: "__stdcall RtlAppendStringToString" _RtlAppendStringToString@8
0x4B2F0BF0: "__stdcall NtAlpcAcceptConnectPort" _NtAlpcAcceptConnectPort@36
0x4B284670: "__cdecl szSlashDynamicDst" _szSlashDynamicDst
0x4B29449C: "Could not validate the crypto si" ??_C@_0DF@JIECDPGP@Could?5not?5validate?5the?5crypto?5si@
0x4B295730: "AVRF: cannot find an entry point" ??_C@_0DE@MFELDNIC@AVRF?3?5cannot?5find?5an?5entry?5point@
0x4B2F5BE0: "__cdecl atan2" _atan2
0x4B2E24C0: "__stdcall RtlpInitializeAssemblyStorageMap" _RtlpInitializeAssemblyStorageMap@12
0x4B2F7A60: "__cdecl strpbrk" _strpbrk
0x4B367770: "__stdcall RtlpNtOpenKey" _RtlpNtOpenKey@16
0x4B2A8C90: "__stdcall RtlPrefixString" _RtlPrefixString@12
0x4B3A14B9: "__cdecl LdrpNXProcessPermanent" _LdrpNXProcessPermanent
0x4B39F0F8: "__cdecl g_hPrivLoggerNotificationProvider" _g_hPrivLoggerNotificationProvider
0x4B372B18: "__stdcall RtlpHpAllocateHeap" _RtlpHpAllocateHeap@16
0x4B37327B: "__stdcall RtlpHpHeapAllocate" _RtlpHpHeapAllocate@16
0x4B2F0990: "__stdcall ZwIsProcessInJob" _ZwIsProcessInJob@8
0x4B2F0510: "__stdcall ZwRemoveIoCompletion" _ZwRemoveIoCompletion@20
0x4B2A5600: "May not destroy the process heap" ??_C@_0CI@EKPJIMJA@May?5not?5destroy?5the?5process?5heap@
0x4B2E7DAF: "__stdcall RtlpFindMessageInTable" _RtlpFindMessageInTable@16
0x4B2A3930: "Error " ??_C@_06HPIHNGNL@Error?6?$AA@
0x4B2F1EF0: "__stdcall ZwSetSystemTime" _ZwSetSystemTime@8
0x4B2F20E0: "__stdcall NtUnlockVirtualMemory" _NtUnlockVirtualMemory@16
0x4B363FD9: "__stdcall RtlpStdListRemove" _RtlpStdListRemove@8
0x4B3A1710: "__cdecl TppPoolpSerializedPoolLock" _TppPoolpSerializedPoolLock
0x4B3A4230: "__cdecl AvrfpAPILookupCallbacksEnabled" _AvrfpAPILookupCallbacksEnabled
0x4B3A37A4: "__cdecl TppCleanupGroupMemberpNoPoolListLock" _TppCleanupGroupMemberpNoPoolListLock
0x4B2993C4: "SyCHPE32" ??_C@_1BC@OPEDGAKD@?$AAS?$AAy?$AAC?$AAH?$AAP?$AAE?$AA3?$AA2?$AA?$AA@
0x4B2F1F60: "__stdcall ZwSetWnfProcessNotificationEvent" _ZwSetWnfProcessNotificationEvent@4
0x4B295FB8: "DontIncludeProgramFiles" ??_C@_1DA@BIDALBLD@?$AAD?$AAo?$AAn?$AAt?$AAI?$AAn?$AAc?$AAl?$AAu?$AAd?$AAe?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x4B371F68: "__stdcall XpressDoHuffmanPass" _XpressDoHuffmanPass@20
0x4B338659: "__stdcall WerpAllocateAndInitializeSid" _WerpAllocateAndInitializeSid@44
0x4B3674D7: "__stdcall _RtlpMuiRegValidatePartialLanguage" __RtlpMuiRegValidatePartialLanguage@8
0x4B2D72C0: "__stdcall RtlDestroyHeap" _RtlDestroyHeap@4
0x4B2E9BD7: "__stdcall LdrpCleanUpTebData" _LdrpCleanUpTebData@0
0x4B2953F8: "Objects>%4u" ??_C@_1BI@DKGONIDA@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$DO?$AA?$CF?$AA4?$AAu?$AA?$AA@
0x4B2E86FF: "__stdcall DWORDToBigEndian" _DWORDToBigEndian@12
0x4B35CA40: "__stdcall RtlIpv6AddressToStringExA" _RtlIpv6AddressToStringExA@20
0x4B2B84C2: "__stdcall RtlSectionTableFromVirtualAddress" _RtlSectionTableFromVirtualAddress@12
0x4B2F2060: "__stdcall ZwTraceControl" _ZwTraceControl@24
0x4B2B871B: "__stdcall LdrControlFlowGuardEnforcedWithExportSuppression" _LdrControlFlowGuardEnforcedWithExportSuppression@0
0x4B2F15A0: "__stdcall ZwModifyDriverEntry" _ZwModifyDriverEntry@4
0x4B34FC60: "__stdcall RtlGetThreadLangIdByIndex" _RtlGetThreadLangIdByIndex@16
0x4B3518D0: "__stdcall RtlpInitializeLangRegistryInfo" _RtlpInitializeLangRegistryInfo@4
0x4B2AB560: "__stdcall RtlCopyString" _RtlCopyString@8
0x4B360D50: "__stdcall RtlIsCurrentThread" _RtlIsCurrentThread@4
0x4B2ABC30: "__stdcall TpAllocAlpcCompletion" _TpAllocAlpcCompletion@20
0x4B35BBB0: "__stdcall RtlLookupFirstMatchingElementGenericTableAvl" _RtlLookupFirstMatchingElementGenericTableAvl@12
0x4B2D0690: "__stdcall TppTimerpExecuteCallback" _TppTimerpExecuteCallback@8
0x4B3322A0: "__stdcall RtlpWaitForCriticalSection" _RtlpWaitForCriticalSection@4
0x4B295E10: "\Registry\Machine\Software\Micro" ??_C@_1HG@BODAIHDO@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B2FF126: "__cdecl _input_s" __input_s
0x4B2E6540: "__stdcall RtlGetAppContainerNamedObjectPath" _RtlGetAppContainerNamedObjectPath@16
0x4B292AA4: "Failed to find export %s!%s (Ord" ??_C@_0DM@OGNHJPFC@Failed?5to?5find?5export?5?$CFs?$CB?$CFs?5?$CIOrd@
0x4B2F8822: "__cdecl _rtzeronpop" __rtzeronpop
0x4B36A947: "__stdcall RtlpHpTagQueryTags" _RtlpHpTagQueryTags@12
0x4B2F1720: "__stdcall ZwOpenThread" _ZwOpenThread@16
0x4B35DF99: "__stdcall RtlpGetLocaleDataKey" _RtlpGetLocaleDataKey@0
0x4B286B28: "Procedure "%s" could not be loca" ??_C@_0DK@NLHCCKAF@Procedure?5?$CC?$CFs?$CC?5could?5not?5be?5loca@
0x4B3051BF: FinalExceptionHandlerPad15
0x4B379E6A: "__stdcall RtlpHpSegReportUncommittedRange" _RtlpHpSegReportUncommittedRange@12
0x4B3051C9: FinalExceptionHandlerPad25
0x4B378AD8: "__stdcall RtlpHpSegMgrCommitComplete" _RtlpHpSegMgrCommitComplete@24
0x4B34ACF0: "__stdcall RtlDnsHostNameToComputerName" _RtlDnsHostNameToComputerName@12
0x4B29502C: "Stick PC" ??_C@_1BC@MFACJCFC@?$AAS?$AAt?$AAi?$AAc?$AAk?$AA?5?$AAP?$AAC?$AA?$AA@
0x4B3A124D: "__cdecl CsrInitOnceDone" _CsrInitOnceDone
0x4B3051D3: FinalExceptionHandlerPad35
0x4B3051DD: FinalExceptionHandlerPad45
0x4B3051E7: FinalExceptionHandlerPad55
0x4B2FB53A: "__cdecl _raise_exc" __raise_exc
0x4B2F07C0: "__stdcall ZwEnumerateKey" _ZwEnumerateKey@24
0x4B2F1630: "__stdcall ZwOpenJobObject" _ZwOpenJobObject@12
0x4B3047E0: "__stdcall NtdllCtfHookProcWorker" _NtdllCtfHookProcWorker@0
0x4B3635E2: "__stdcall RtlpLogExceptionHandler" _RtlpLogExceptionHandler@16
0x4B33BF20: "__stdcall CsrFreeCaptureBuffer" _CsrFreeCaptureBuffer@4
0x4B2CAD67: "__stdcall RtlpMuiRegGetOrAddStringToPool" _RtlpMuiRegGetOrAddStringToPool@16
0x4B2C95E2: "__stdcall RtlpCreateUCREntry" _RtlpCreateUCREntry@24
0x4B2F5190: "__cdecl vsprintf" _vsprintf
0x4B33BF30: "__stdcall CsrGetProcessId" _CsrGetProcessId@0
0x4B2E58B0: "__stdcall RtlAbsoluteToSelfRelativeSD" _RtlAbsoluteToSelfRelativeSD@12
0x4B364E90: "__stdcall RtlpInitWaitOnAddress" _RtlpInitWaitOnAddress@4
0x4B286830: "_y0" ??_C@_03MJLDFKDL@_y0?$AA@
0x4B2867E0: "cosh" ??_C@_04HPJJNFIM@cosh?$AA@
0x4B3A422C: "__cdecl LdrpMrdataBase" _LdrpMrdataBase
0x4B2A5E04: "csrss.exe" ??_C@_1BE@OMGDNGEO@?$AAc?$AAs?$AAr?$AAs?$AAs?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x4B3682C0: "__stdcall RtlpHpStackDbLogStackDbSnapshot" _RtlpHpStackDbLogStackDbSnapshot@16
0x4B2C4520: "__stdcall RtlGetFullPathName_Ustr" _RtlGetFullPathName_Ustr@24
0x4B2F2140: "__stdcall NtWaitForDebugEvent" _NtWaitForDebugEvent@16
0x4B2FBEB0: "__cdecl _input_l" __input_l
0x4B343810: "__stdcall RtlCopyLuid" _RtlCopyLuid@8
0x4B2F0E60: "__stdcall NtCompleteConnectPort" _NtCompleteConnectPort@4
0x4B2F0CA0: "__stdcall NtAlpcDeleteSectionView" _NtAlpcDeleteSectionView@12
0x4B2F8B87: "__cdecl _rtinfpopse" __rtinfpopse
0x4B342AEB: "__stdcall RXactpCommit" _RXactpCommit@4
0x4B380620: "__stdcall TpWaitForAlpcCompletion" _TpWaitForAlpcCompletion@4
0x4B384312: "__stdcall PsspCaptureProcessInformation" _PsspCaptureProcessInformation@12
0x4B36B530: "__stdcall RtlDebugDestroyHeap" _RtlDebugDestroyHeap@4
0x4B2D1D9F: "__stdcall RtlpWaitOnCriticalSection" _RtlpWaitOnCriticalSection@8
0x4B35F540: "__stdcall RtlpHeapTrkInterceptor" _RtlpHeapTrkInterceptor@16
0x4B2F3956: "__cdecl _sin_default" __sin_default
0x4B2F1BD0: "__stdcall NtRestoreKey" _NtRestoreKey@12
0x4B2F1150: "__stdcall NtDeleteBootEntry" _NtDeleteBootEntry@4
0x4B2F1ED0: "__stdcall ZwSetSystemInformation" _ZwSetSystemInformation@12
0x4B2A6DE0: "__stdcall RtlAddressInSectionTable" _RtlAddressInSectionTable@12
0x4B2F11E0: "__stdcall NtDisableLastKnownGood" _NtDisableLastKnownGood@0
0x4B2E8860: "__stdcall LdrUnlockLoaderLock" _LdrUnlockLoaderLock@8
0x4B34AB10: "__stdcall RtlCanonicalizeDomainName" _RtlCanonicalizeDomainName@12
0x4B336B0F: "__stdcall AVrfpParseVerifierDllsString" _AVrfpParseVerifierDllsString@4
0x4B2878D0: "Routine for current OS that gets" ??_C@_1GM@FIELMNO@?$AAR?$AAo?$AAu?$AAt?$AAi?$AAn?$AAe?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAc?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AA?5?$AAO?$AAS?$AA?5?$AAt?$AAh?$AAa?$AAt?$AA?5?$AAg?$AAe?$AAt?$AAs@
0x4B2F2040: "__stdcall ZwThawRegistry" _ZwThawRegistry@0
0x4B297C58: "SXS: Unable to open registry key" ??_C@_0DH@LBJPEIFD@SXS?3?5Unable?5to?5open?5registry?5key@
0x4B2F0680: "__stdcall NtFreeVirtualMemory" _NtFreeVirtualMemory@16
0x4B357980: "__stdcall RtlSendMsgToSm" _RtlSendMsgToSm@8
0x4B39F100: "__cdecl PrivateLoggerNotificationEntry" _PrivateLoggerNotificationEntry
0x4B2F06E0: "__stdcall NtOpenThreadToken" _NtOpenThreadToken@16
0x4B3783FE: "__stdcall RtlpHpSegFreeRangeRemove" _RtlpHpSegFreeRangeRemove@8
0x4B2F16D0: "__stdcall NtOpenRegistryTransaction" _NtOpenRegistryTransaction@12
0x4B285150: "LdrpResSearchResourceInsideDirec" ??_C@_1FE@MLGMOANN@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAI?$AAn?$AAs?$AAi?$AAd?$AAe?$AAD?$AAi?$AAr?$AAe?$AAc@
0x4B2F0BD0: "__stdcall NtAllocateUuids" _NtAllocateUuids@16
0x4B2A8958: "__stdcall punycode_decode" _punycode_decode@32
0x4B2F2160: "__stdcall NtWaitForWorkViaWorkerFactory" _NtWaitForWorkViaWorkerFactory@20
0x4B298AC4: "LdrpResValidateFilePath Enter" ??_C@_1DM@OMJKFLCA@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAF?$AAi?$AAl?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?5?$AAE?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x4B35DBD0: "__stdcall RtlGetConsoleSessionForegroundProcessId" _RtlGetConsoleSessionForegroundProcessId@0
0x4B2F0FB0: "__stdcall NtCreatePartition" _NtCreatePartition@16
0x4B2FAB40: "__cdecl _rtpiby2" __rtpiby2
0x4B2F2090: "__stdcall ZwUnloadDriver" _ZwUnloadDriver@4
0x4B304460: "__stdcall NtdllTitleWndProc_A" _NtdllTitleWndProc_A@0
0x4B39E870: "__cdecl _NLG_Destination" __NLG_Destination
0x4B2D6768: "__fastcall RtlpDecommitBlock" @RtlpDecommitBlock@8
0x4B3377F0: "__stdcall RtlApplicationVerifierStop" _RtlApplicationVerifierStop@40
0x4B28C40C: "PRIVATENETWORKCLIENTSERVER" ??_C@_1DG@ENGJHFDI@?$AAP?$AAR?$AAI?$AAV?$AAA?$AAT?$AAE?$AAN?$AAE?$AAT?$AAW?$AAO?$AAR?$AAK?$AAC?$AAL?$AAI?$AAE?$AAN?$AAT?$AAS?$AAE?$AAR?$AAV?$AAE?$AAR?$AA?$AA@
0x4B285764: "apphelp.dll" ??_C@_1BI@BLOGEHMP@?$AAa?$AAp?$AAp?$AAh?$AAe?$AAl?$AAp?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x4B2A8BE0: "__stdcall RtlCreateTimerQueue" _RtlCreateTimerQueue@4
0x4B329C59: "__stdcall LdrpUnloadShimEngine" _LdrpUnloadShimEngine@0
0x4B2FAB50: "__cdecl _rtforatn20" __rtforatn20
0x4B2F16C0: "__stdcall ZwOpenProcessToken" _ZwOpenProcessToken@12
0x4B295160: "Industrial Automation" ??_C@_1CM@LOJPCJHB@?$AAI?$AAn?$AAd?$AAu?$AAs?$AAt?$AAr?$AAi?$AAa?$AAl?$AA?5?$AAA?$AAu?$AAt?$AAo?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B294264: "MinimumStackCommitInBytes" ??_C@_1DE@GMADOGDK@?$AAM?$AAi?$AAn?$AAi?$AAm?$AAu?$AAm?$AAS?$AAt?$AAa?$AAc?$AAk?$AAC?$AAo?$AAm?$AAm?$AAi?$AAt?$AAI?$AAn?$AAB?$AAy?$AAt?$AAe?$AAs?$AA?$AA@
0x4B357590: "__stdcall RtlDecompressBuffer" _RtlDecompressBuffer@24
0x4B295490: "AVRF: Verifier .dlls must not ha" ??_C@_0DC@KNAANCLE@AVRF?3?5Verifier?5?4dlls?5must?5not?5ha@
0x4B2FD5B0: "__cdecl _wmakepath_s" __wmakepath_s
0x4B32A730: "__stdcall RtlReadThreadProfilingData" _RtlReadThreadProfilingData@12
0x4B32C1D0: "__stdcall LdrQueryModuleInfoLocalLoaderUnlock" _LdrQueryModuleInfoLocalLoaderUnlock@0
0x4B288130: "ProgramFiles" ??_C@_1BK@CECDDAML@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x4B2F14A0: "__stdcall NtLoadEnclaveData" _NtLoadEnclaveData@36
0x4B2E8158: "__stdcall LdrpReportError" _LdrpReportError@12
0x4B3322B0: "__stdcall RtlStatMemoryStream" _RtlStatMemoryStream@12
0x4B2A5870: "RtlZeroHeap" ??_C@_0M@CODJONGO@RtlZeroHeap?$AA@
0x4B2968DC: "Status != STATUS_NOT_FOUND" ??_C@_0BL@JBLJBBML@Status?5?$CB?$DN?5STATUS_NOT_FOUND?$AA@
0x4B2EAFC0: "__stdcall RtlImpersonateSelf" _RtlImpersonateSelf@4
0x4B363950: "__stdcall RtlLogStackBackTrace" _RtlLogStackBackTrace@0
0x4B338A29: "__stdcall WerpIsDebugPortPresent" _WerpIsDebugPortPresent@0
0x4B28122C: "__cdecl SlashSystem32SlashString" _SlashSystem32SlashString
0x4B296988: "SXS: Activation context data at " ??_C@_0EC@BMCPFDKM@SXS?3?5Activation?5context?5data?5at?5@
0x4B2BC700: "__stdcall LdrpSnapModule" _LdrpSnapModule@4
0x4B2F0740: "__stdcall NtUnmapViewOfSection" _NtUnmapViewOfSection@8
0x4B33C700: "__stdcall DbgSetDebugFilterState" _DbgSetDebugFilterState@12
0x4B377BC7: "__stdcall RtlpHpVaMgrRangeMarkAllocated" _RtlpHpVaMgrRangeMarkAllocated@12
0x4B296B98: "SXS: %s() called with invalid co" ??_C@_0DD@NEJNEOOO@SXS?3?5?$CFs?$CI?$CJ?5called?5with?5invalid?5co@
0x4B2B303E: "__stdcall LdrpSectionTableFromVirtualAddress" _LdrpSectionTableFromVirtualAddress@24
0x4B373192: "__stdcall RtlpHpFreeVA" _RtlpHpFreeVA@20
0x4B281830: "__cdecl RtlpMemoryZoneCriticalRoutines" _RtlpMemoryZoneCriticalRoutines
0x4B2F1940: "__stdcall NtQueryIntervalProfile" _NtQueryIntervalProfile@8
0x4B293A7C: "Failed to initialize Parallel lo" ??_C@_0DB@MMJJEGNH@Failed?5to?5initialize?5Parallel?5lo@
0x4B32E6D8: "__cdecl _TlgDefineProvider_annotation__Tlgg_VsmEnclaveTraceProviderProv" __TlgDefineProvider_annotation__Tlgg_VsmEnclaveTraceProviderProv
0x4B382899: "__stdcall RtlpTpIoDllLoaded" _RtlpTpIoDllLoaded@4
0x4B39E8F8: "__cdecl RtlpUnloadEventTraceExNumber" _RtlpUnloadEventTraceExNumber
0x4B2B2D35: "__stdcall RtlpDetermineDosPathNameType4" _RtlpDetermineDosPathNameType4@16
0x4B2F1D60: "__stdcall NtSetHighWaitLowEventPair" _NtSetHighWaitLowEventPair@4
0x4B304720: "__stdcall NtdllFilteredProcessRedirectingWndProc_A" _NtdllFilteredProcessRedirectingWndProc_A@0
0x4B2D19C8: "__stdcall LdrpGetDataModulePath" _LdrpGetDataModulePath@28
0x4B2F0B30: "__stdcall ZwAddBootEntry" _ZwAddBootEntry@8
0x4B37D9D5: "__stdcall EtwpFillProcessorStreamIndexMap" _EtwpFillProcessorStreamIndexMap@16
0x4B2F2A30: "__stdcall KiIntSystemCall" _KiIntSystemCall@0
0x4B37C139: "__stdcall RtlpHpVsSubsegmentWalk" _RtlpHpVsSubsegmentWalk@24
0x4B2ABC00: "__stdcall LdrIsModuleSxsRedirected" _LdrIsModuleSxsRedirected@4
0x4B2C1340: "__stdcall RtlDosSearchPath_Ustr" _RtlDosSearchPath_Ustr@36
0x4B2F0930: "__stdcall NtQueryVolumeInformationFile" _NtQueryVolumeInformationFile@20
0x4B2A6020: "ThreadPool: callback %p(%p) retu" ??_C@_0EF@MBENEBAO@ThreadPool?3?5callback?5?$CFp?$CI?$CFp?$CJ?5retu@
0x4B2A4628: "WP://SKUID" ??_C@_1BG@OLJFPOOD@?$AAW?$AAP?$AA?3?$AA?1?$AA?1?$AAS?$AAK?$AAU?$AAI?$AAD?$AA?$AA@
0x4B294FE4: "Convertible" ??_C@_1BI@OOPIIBCP@?$AAC?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AAi?$AAb?$AAl?$AAe?$AA?$AA@
0x4B2F1460: "__stdcall NtIsSystemResumeAutomatic" _NtIsSystemResumeAutomatic@0
0x4B298B90: "LdrResRelease Enter" ??_C@_1CI@ODIBDMHJ@?$AAL?$AAd?$AAr?$AAR?$AAe?$AAs?$AAR?$AAe?$AAl?$AAe?$AAa?$AAs?$AAe?$AA?5?$AAE?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x4B3A1AF4: "__cdecl gLocaleDataRegKey" _gLocaleDataRegKey
0x4B354C87: "__stdcall RtlpEnumProcessHeaps" _RtlpEnumProcessHeaps@12
0x4B304790: "__stdcall NtdllListBoxWndProcWorker" _NtdllListBoxWndProcWorker@0
0x4B2883D8: "WIN://PKG" ??_C@_1BE@BDEKEKBI@?$AAW?$AAI?$AAN?$AA?3?$AA?1?$AA?1?$AAP?$AAK?$AAG?$AA?$AA@
0x4B2F1670: "__stdcall NtOpenKeyedEvent" _NtOpenKeyedEvent@12
0x4B340390: "__stdcall LdrResFindResource" _LdrResFindResource@36
0x4B304730: "__stdcall NtdllFilteredProcessRedirectingWndProc_W" _NtdllFilteredProcessRedirectingWndProc_W@0
0x4B294F68: "Windows.7067329" ??_C@_1CA@HBCEJNBI@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AA7?$AA0?$AA6?$AA7?$AA3?$AA2?$AA9?$AA?$AA@
0x4B2F1AC0: "__stdcall NtRecoverEnlistment" _NtRecoverEnlistment@8
0x4B35B980: "__stdcall RtlEnumerateGenericTableLikeADirectory" _RtlEnumerateGenericTableLikeADirectory@28
0x4B297DF8: "SXS: Assembly storage root locat" ??_C@_0DN@KGPGHOIJ@SXS?3?5Assembly?5storage?5root?5locat@
0x4B2F1D70: "__stdcall ZwSetIRTimer" _ZwSetIRTimer@8
0x4B39F608: "__cdecl RtlpExceptionLogCount" _RtlpExceptionLogCount
0x4B2F1BA0: "__stdcall ZwRequestPort" _ZwRequestPort@8
0x4B36319D: "__stdcall RtlInitializeExceptionLog" _RtlInitializeExceptionLog@4
0x4B3046C0: "__stdcall NtdllDispatchDefWindowProc_A" _NtdllDispatchDefWindowProc_A@0
0x4B2E992F: "__stdcall TppPHDelete" _TppPHDelete@8
0x4B2990B8: "NTDLL: Calling thread (%p) not o" ??_C@_0EK@FNOGANJI@NTDLL?3?5Calling?5thread?5?$CI?$CFp?$CJ?5not?5o@
0x4B2FCFF0: "__cdecl _makepath_s" __makepath_s
0x4B382D2A: "__stdcall RtlpTpETWCallbackStart" _RtlpTpETWCallbackStart@20
0x4B299788: "__cdecl RtlpBootStatusFields" _RtlpBootStatusFields
0x4B2E9610: "__stdcall RtlAcquireResourceShared" _RtlAcquireResourceShared@8
0x4B39F628: "__cdecl RtlpBusyList" _RtlpBusyList
0x4B304670: "__stdcall NtdllHkINLPCWPSTRUCT_W" _NtdllHkINLPCWPSTRUCT_W@0
0x4B2F0760: "__stdcall ZwTerminateProcess" _ZwTerminateProcess@8
0x4B2E9B70: "__stdcall RtlCleanUpTEBLangLists" _RtlCleanUpTEBLangLists@0
0x4B2948C4: "LdrpUnloadNode" ??_C@_0P@NEJMBEPE@LdrpUnloadNode?$AA@
0x4B34E0D0: "__stdcall RtlUnlockBootStatusData" _RtlUnlockBootStatusData@4
0x4B3A14E0: "__cdecl RtlpNumberOfProtectedHeaps" _RtlpNumberOfProtectedHeaps
0x4B29414C: "UnloadEventTraceDepth" ??_C@_1CM@KFDKIEKO@?$AAU?$AAn?$AAl?$AAo?$AAa?$AAd?$AAE?$AAv?$AAe?$AAn?$AAt?$AAT?$AAr?$AAa?$AAc?$AAe?$AAD?$AAe?$AAp?$AAt?$AAh?$AA?$AA@
0x4B2EB9C0: "__stdcall EtwGetTraceLoggerHandle" _EtwGetTraceLoggerHandle@4
0x4B337AF0: "__stdcall RtlDecodeRemotePointer" _RtlDecodeRemotePointer@12
0x4B2F1260: "__stdcall ZwExtendSection" _ZwExtendSection@8
0x4B2C6661: "__stdcall RtlpDeCommitFreeBlock" _RtlpDeCommitFreeBlock@16
0x4B2FECC4: "__cdecl _safecrt_mbtowc" __safecrt_mbtowc
0x4B2F0DE0: "__stdcall ZwCommitComplete" _ZwCommitComplete@8
0x4B293014: "BoG_ *90.0&!! Yy>" ??_C@_0BD@EOKCOEBG@BoG_?5?$CK90?40?$CG?$CB?$CB?5?5Yy?$DO?$AA@
0x4B2DC7B0: "__stdcall TppWorkpFree" _TppWorkpFree@4
0x4B2F0FF0: "__stdcall ZwCreateProfile" _ZwCreateProfile@36
0x4B372E27: "__stdcall RtlpHpExtrasAppend" _RtlpHpExtrasAppend@28
0x4B3A1AEC: "__cdecl RtlpLDCrtPage" _RtlpLDCrtPage
0x4B2F1430: "__stdcall NtInitializeNlsFiles" _NtInitializeNlsFiles@12
0x4B343790: "__stdcall RtlAreAnyAccessesGranted" _RtlAreAnyAccessesGranted@8
0x4B381EF8: "__stdcall TppETWTimerExpirationBegin" _TppETWTimerExpirationBegin@4
0x4B292738: "CLIENT(ntdll): Found ExecuteOpti" ??_C@_0FJ@JGBIHJJA@CLIENT?$CIntdll?$CJ?3?5Found?5ExecuteOpti@
0x4B2B26A0: "__stdcall RtlAllocateHandle" _RtlAllocateHandle@8
0x4B383EB0: "__stdcall PssNtValidateDescriptor" _PssNtValidateDescriptor@8
0x4B332EA0: "__stdcall RtlDeNormalizeProcessParams" _RtlDeNormalizeProcessParams@4
0x4B2F1A30: "__stdcall ZwQuerySystemEnvironmentValueEx" _ZwQuerySystemEnvironmentValueEx@20
0x4B2AB0A0: "__stdcall RtlDestroyEnvironment" _RtlDestroyEnvironment@4
0x4B2A826C: "__stdcall LdrpIsReparsePoint" _LdrpIsReparsePoint@4
0x4B3046D0: "__stdcall NtdllDispatchDefWindowProc_W" _NtdllDispatchDefWindowProc_W@0
0x4B2ACED6: "__stdcall RtlpCallQueryRegistryRoutine" _RtlpCallQueryRegistryRoutine@28
0x4B2EA8D0: "__stdcall RtlUpcaseUnicodeToMultiByteN" _RtlUpcaseUnicodeToMultiByteN@20
0x4B39F0E4: "__cdecl __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUkilxhmzkUmgwooUlyquivUrDIGUkivxlnkOlyq@pssntlib" ___@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUkilxhmzkUmgwooUlyquivUrDIGUkivxlnkOlyq@pssntlib
0x4B2F2AC0: "__stdcall RtlInitUnicodeString" _RtlInitUnicodeString@8
0x4B3575F0: "__stdcall RtlDecompressBufferEx" _RtlDecompressBufferEx@28
0x4B2876C4: "__stdcall _imp__ZwClose" __imp__ZwClose@4
0x4B293F8C: "LdrpTouchThreadStack" ??_C@_0BF@FNBJIACI@LdrpTouchThreadStack?$AA@
0x4B28C5E0: "__cdecl __safe_se_handler_table" ___safe_se_handler_table
0x4B2C8568: "__stdcall RtlpMuiRegGetInstalledLanguageIndexByLangId" _RtlpMuiRegGetInstalledLanguageIndexByLangId@16
0x4B3593B2: "__stdcall RtlpGetEntireXStateAreaLength" _RtlpGetEntireXStateAreaLength@8
0x4B2DF3D0: "__stdcall RtlFlsFree" _RtlFlsFree@4
0x4B287E68: "HeapPaddingAndLFHSubsegmentCommi" ??_C@_1FA@CKFDAPMK@?$AAH?$AAe?$AAa?$AAp?$AAP?$AAa?$AAd?$AAd?$AAi?$AAn?$AAg?$AAA?$AAn?$AAd?$AAL?$AAF?$AAH?$AAS?$AAu?$AAb?$AAs?$AAe?$AAg?$AAm?$AAe?$AAn?$AAt?$AAC?$AAo?$AAm?$AAm?$AAi@
0x4B2B8950: "__stdcall RtlRbInsertNodeEx" _RtlRbInsertNodeEx@16
0x4B332290: "__stdcall RtlCopyMemoryStreamTo" _RtlCopyMemoryStreamTo@24
0x4B36D704: "__fastcall RtlpGetReservedBlockSize" @RtlpGetReservedBlockSize@4
0x4B294A60: " ***Exception thrown within load" ??_C@_0CH@CEDPGFOK@?6?$CK?$CK?$CKException?5thrown?5within?5load@
0x4B37B5E6: "__stdcall RtlpHpVsChunkSplit" _RtlpHpVsChunkSplit@24
0x4B347A90: "__stdcall RtlUpdateClonedCriticalSection" _RtlUpdateClonedCriticalSection@4
0x4B32E038: "__stdcall LdrpLogMapAndVerifyResourceFileFailure" _LdrpLogMapAndVerifyResourceFileFailure@20
0x4B2F1F70: "__stdcall ZwShutdownSystem" _ZwShutdownSystem@4
0x4B2F2150: "__stdcall NtWaitForKeyedEvent" _NtWaitForKeyedEvent@16
0x4B2F04F0: "__stdcall ZwDeviceIoControlFile" _ZwDeviceIoControlFile@40
0x4B2F1400: "__stdcall NtImpersonateAnonymousToken" _NtImpersonateAnonymousToken@4
0x4B2F16A0: "__stdcall NtOpenPartition" _NtOpenPartition@12
0x4B33662A: "__stdcall AVrfpEnableHeapVerifier" _AVrfpEnableHeapVerifier@0
0x4B2E3FE0: "__stdcall RtlInterlockedFlushSList" _RtlInterlockedFlushSList@4
0x4B332430: "__stdcall RtlConvertDeviceFamilyInfoToString" _RtlConvertDeviceFamilyInfoToString@16
0x4B37222A: "__stdcall NormalizationList__Lookup" _NormalizationList__Lookup@4
0x4B32E6D8: "__cdecl _TlgDefineProvider_annotation__TlgRtlpHpTraceLoggingProviderProv" __TlgDefineProvider_annotation__TlgRtlpHpTraceLoggingProviderProv
0x4B2F7E32: "__cdecl _CItan_default" __CItan_default
0x4B2F1E50: "__stdcall NtSetIoCompletionEx" _NtSetIoCompletionEx@24
0x4B2E23B0: "__stdcall RtlCreateActivationContext" _RtlCreateActivationContext@24
0x4B39E2D8: "__cdecl LdrpDllNotificationLock" _LdrpDllNotificationLock
0x4B2A4158: "The instruction at %p referenced" ??_C@_0DA@BPNHGBH@The?5instruction?5at?5?$CFp?5referenced@
0x4B2F2210: "__stdcall NtWow64CsrGetProcessId" _NtWow64CsrGetProcessId@0
0x4B2F5711: "__cdecl wcstoxq" _wcstoxq
0x4B2EA9D0: "__stdcall RtlSetHeapInformation" _RtlSetHeapInformation@16
0x4B37831D: "__stdcall RtlpHpSegFreeRangeInsert" _RtlpHpSegFreeRangeInsert@12
0x4B36A818: "__stdcall RtlpHpTagMappingComparison" _RtlpHpTagMappingComparison@8
0x4B2D0A61: "__stdcall TppEnqueueTimer" _TppEnqueueTimer@8
0x4B2F0720: "__stdcall ZwMapViewOfSection" _ZwMapViewOfSection@40
0x4B2A904D: "__stdcall RtlpValidateSidBuffer" _RtlpValidateSidBuffer@8
0x4B332E20: "__stdcall RtlCreateProcessParameters" _RtlCreateProcessParameters@40
0x4B2F8130: "__cdecl wcslen" _wcslen
0x4B3A0C80: "__cdecl RtlpUnloadEventTrace" _RtlpUnloadEventTrace
0x4B2B1B1F: "__stdcall RtlULongPtrAdd" _RtlULongPtrAdd@12
0x4B2B9E39: "__stdcall LdrpMapDllWithSectionHandle" _LdrpMapDllWithSectionHandle@8
0x4B2953CC: "Wow64 Emulation Layer" ??_C@_1CM@EGJJOBMC@?$AAW?$AAo?$AAw?$AA6?$AA4?$AA?5?$AAE?$AAm?$AAu?$AAl?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAL?$AAa?$AAy?$AAe?$AAr?$AA?$AA@
0x4B3A1AE0: "__cdecl RtlpCrtHeapAddress" _RtlpCrtHeapAddress
0x4B2F1130: "__stdcall ZwDebugContinue" _ZwDebugContinue@12
0x4B37E68C: "__stdcall EtwpTrackRegBinaryInfo" _EtwpTrackRegBinaryInfo@4
0x4B2A3CF0: "\SystemRoot\Globalization\" ??_C@_1DG@IPEDDMBI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AAi?$AAz?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?2?$AA?$AA@
0x4B32ED1D: "__stdcall LdrpCheckForSecuROMImage" _LdrpCheckForSecuROMImage@4
0x4B293098: "KiUserCallbackDispatcher" ??_C@_0BJ@PGKGCADJ@KiUserCallbackDispatcher?$AA@
0x4B2AA8F0: "__stdcall RtlOemToUnicodeN" _RtlOemToUnicodeN@20
0x4B2B81CF: "__stdcall LdrpPrepareImportAddressTableForSnap" _LdrpPrepareImportAddressTableForSnap@4
0x4B2942D8: "KeepActivationContextsAlive" ??_C@_1DI@LIJHLCLN@?$AAK?$AAe?$AAe?$AAp?$AAA?$AAc?$AAt?$AAi?$AAv?$AAa?$AAt?$AAi?$AAo?$AAn?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AAs?$AAA?$AAl?$AAi?$AAv?$AAe?$AA?$AA@
0x4B33509A: "__stdcall RtlpCommitQueryDebugInfo" _RtlpCommitQueryDebugInfo@8
0x4B2A42CC: " *** An Access Violation occur" ??_C@_0DA@LMKCDOHD@?6?6?5?$CK?$CK?$CK?5An?5Access?5Violation?5occur@
0x4B32C270: "__stdcall LdrQueryNextListEntry" _LdrQueryNextListEntry@12
0x4B2CD6A2: "__stdcall TppExecuteWaitCallback" _TppExecuteWaitCallback@12
0x4B295898: "AVRF: chain: thunk: %s == %s ? " ??_C@_0CA@JMNPIJOP@AVRF?3?5chain?3?5thunk?3?5?$CFs?5?$DN?$DN?5?$CFs?5?$DP?6?$AA@
0x4B35E0F3: "__stdcall RtlpMatchUILanguage" _RtlpMatchUILanguage@4
0x4B2F1880: "__stdcall ZwQueryEaFile" _ZwQueryEaFile@36
0x4B3A1818: "__cdecl LdrpParentRtlResetNtUserPfnPointer" _LdrpParentRtlResetNtUserPfnPointer
0x4B2AC860: "__stdcall WinSqmIncrementDWORD" _WinSqmIncrementDWORD@12
0x4B334360: "__stdcall RtlQueryProcessDebugInformation" _RtlQueryProcessDebugInformation@12
0x4B281C88: "`RtlpGetUserLocaleName'::`2'::KeyValueName" ?KeyValueName@?1??RtlpGetUserLocaleName@@9@9
0x4B2DDF6F: "__stdcall TppAllocAlpcCompletion" _TppAllocAlpcCompletion@24
0x4B2A9F80: "__stdcall RtlCreateBoundaryDescriptor" _RtlCreateBoundaryDescriptor@8
0x4B295690: "AVRF: %ws: failed to load provid" ??_C@_0EB@MKAKDAAD@AVRF?3?5?$CFws?3?5failed?5to?5load?5provid@
0x4B37E487: "__stdcall EtwpStopLoggerInstance" _EtwpStopLoggerInstance@4
0x4B380314: "__stdcall EtwpShutdownCompression" _EtwpShutdownCompression@4
0x4B3426A0: "__stdcall RtlTimeToSecondsSince1980" _RtlTimeToSecondsSince1980@8
0x4B2E9EE0: "__stdcall RtlSetThreadPlaceholderCompatibilityMode" _RtlSetThreadPlaceholderCompatibilityMode@4
0x4B286860: "__cdecl _d_max" __d_max
0x4B2CA920: "__stdcall LdrpCallTlsInitializers" _LdrpCallTlsInitializers@8
0x4B365B4D: "__stdcall RtlpMuiRegGetFallbackLanguagesAsMultiSZ" _RtlpMuiRegGetFallbackLanguagesAsMultiSZ@20
0x4B2EA0F0: "__stdcall RtlGetSaclSecurityDescriptor" _RtlGetSaclSecurityDescriptor@16
0x4B2A5280: "VirtualMemoryThreshold" ??_C@_0BH@DPEGHHN@VirtualMemoryThreshold?$AA@
0x4B29A200: "\SmApiPort" ??_C@_1BG@HCJAPODC@?$AA?2?$AAS?$AAm?$AAA?$AAp?$AAi?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x4B2DEE20: "__stdcall RtlExitUserProcess" _RtlExitUserProcess@4
0x4B284EE0: "__cdecl LoadFailure" _LoadFailure
0x4B2F13B0: "__stdcall ZwGetNextProcess" _ZwGetNextProcess@20
0x4B2F1200: "__stdcall ZwDrawText" _ZwDrawText@4
0x4B2F0AA0: "__stdcall ZwSetValueKey" _ZwSetValueKey@24
0x4B2F1050: "__stdcall ZwCreateSymbolicLinkObject" _ZwCreateSymbolicLinkObject@16
0x4B2A45D8: "\Registry\Machine\System\Setup" ??_C@_1DO@PGOAJPNE@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x4B342650: "__stdcall RtlTimeToSecondsSince1970" _RtlTimeToSecondsSince1970@8
0x4B293748: "RaiseExceptionOnPossibleDeadlock" ??_C@_1EC@MEICIJKH@?$AAR?$AAa?$AAi?$AAs?$AAe?$AAE?$AAx?$AAc?$AAe?$AAp?$AAt?$AAi?$AAo?$AAn?$AAO?$AAn?$AAP?$AAo?$AAs?$AAs?$AAi?$AAb?$AAl?$AAe?$AAD?$AAe?$AAa?$AAd?$AAl?$AAo?$AAc?$AAk@
0x4B281128: "__cdecl TppWaitpCleanupGroupMemberVFuncs" _TppWaitpCleanupGroupMemberVFuncs
0x4B2F05E0: "__stdcall ZwQueryKey" _ZwQueryKey@20
0x4B35AF4B: "__stdcall RtlpUpdateHeapWatermarks" _RtlpUpdateHeapWatermarks@4
0x4B2F09A0: "__stdcall ZwProtectVirtualMemory" _ZwProtectVirtualMemory@20
0x4B2E8C10: "__stdcall RtlClearThreadWorkOnBehalfTicket" _RtlClearThreadWorkOnBehalfTicket@0
0x4B36A1C0: "__stdcall RtlpDebugPageHeapCreate" _RtlpDebugPageHeapCreate@24
0x4B360A2D: "__stdcall RtlpReportInvalidExceptionChain" _RtlpReportInvalidExceptionChain@8
0x4B28C2EC: "APPOINTMENTS" ??_C@_1BK@NGIHNAJC@?$AAA?$AAP?$AAP?$AAO?$AAI?$AAN?$AAT?$AAM?$AAE?$AAN?$AAT?$AAS?$AA?$AA@
0x4B2F72C0: "__cdecl sprintf" _sprintf
0x4B2E6970: "__stdcall RtlSetSaclSecurityDescriptor" _RtlSetSaclSecurityDescriptor@16
0x4B2A752D: "__stdcall RtlpCheckForSameCurdir" _RtlpCheckForSameCurdir@4
0x4B3A0BF8: "__cdecl LdrpUseImpersonatedDeviceMap" _LdrpUseImpersonatedDeviceMap
0x4B29930C: "Thread identifier" ??_C@_0BC@GINEEDIF@Thread?5identifier?$AA@
0x4B2933C4: "LdrpGetShimEngineInterface" ??_C@_0BL@DKCENBBM@LdrpGetShimEngineInterface?$AA@
0x4B286D9C: "HEAP: Free Heap block %p modifie" ??_C@_0DM@PAFCANHM@HEAP?3?5Free?5Heap?5block?5?$CFp?5modifie@
0x4B2F0E90: "__stdcall NtConvertBetweenAuxiliaryCounterAndPerformanceCounter" _NtConvertBetweenAuxiliaryCounterAndPerformanceCounter@16
0x4B2955D4: "AVRF: -*- final list of provider" ??_C@_0CI@LPNKPMNF@AVRF?3?5?9?$CK?9?5final?5list?5of?5provider@
0x4B284748: "__cdecl RtlpNtAuthority" _RtlpNtAuthority
0x4B2F1E20: "__stdcall ZwSetInformationWorkerFactory" _ZwSetInformationWorkerFactory@16
0x4B296748: "Internal error check failed" ??_C@_0BM@LCGEIOLJ@Internal?5error?5check?5failed?$AA@
0x4B2F0C90: "__stdcall NtAlpcDeleteResourceReserve" _NtAlpcDeleteResourceReserve@12
0x4B2EBF00: "__stdcall RtlIpv6AddressToStringW" _RtlIpv6AddressToStringW@8
0x4B39E8A0: "__cdecl _matherr_flag" __matherr_flag
0x4B2EDF70: "__stdcall EtwpCreateEtwThread" _EtwpCreateEtwThread@8
0x4B2EE2AD: "__stdcall EtwpEnqueueFreeBuffer" _EtwpEnqueueFreeBuffer@8
0x4B2A4858: "heap_failure_entry_corruption" ??_C@_0BO@DCDHGNFD@heap_failure_entry_corruption?$AA@
0x4B2F0560: "__stdcall NtSetEvent" _NtSetEvent@8
0x4B2EC02D: "__stdcall RtlpSetSegmentInfo" _RtlpSetSegmentInfo@8
0x4B2F8807: "__cdecl _rttospopde" __rttospopde
0x4B2F0EB0: "__stdcall ZwCreateDirectoryObject" _ZwCreateDirectoryObject@12
0x4B2E97B7: "__stdcall RtlpValidateSDOffsetAndSize" _RtlpValidateSDOffsetAndSize@16
0x4B297CD8: "SXS: Attempt to get storage loca" ??_C@_0EP@FPIBOJBJ@SXS?3?5Attempt?5to?5get?5storage?5loca@
0x4B2A5460: "Uncommitted Ranges" ??_C@_0BD@DLOLKPPE@Uncommitted?5Ranges?$AA@
0x4B39E044: "__cdecl _OP_EXPjmptab" __OP_EXPjmptab
0x4B367CB5: "__stdcall RtlpGetModifiedProcessCookie" _RtlpGetModifiedProcessCookie@0
0x4B292630: "Set 0x%X protection for %p secti" ??_C@_0EG@NHIHNLFF@Set?50x?$CFX?5protection?5for?5?$CFp?5secti@
0x4B2A5A94: "dedicated (%04Ix) free list elem" ??_C@_0DH@HHAFOCAN@dedicated?5?$CI?$CF04Ix?$CJ?5free?5list?5elem@
0x4B2CC816: "__stdcall RtlpMuiRegFreeLanguageList" _RtlpMuiRegFreeLanguageList@4
0x4B2D8E66: "__stdcall RtlpRunOnceWakeAll" _RtlpRunOnceWakeAll@4
0x4B2EB380: "__stdcall TpReleasePool" _TpReleasePool@4
0x4B2F10D0: "__stdcall NtCreateUserProcess" _NtCreateUserProcess@44
0x4B2867D8: "sinh" ??_C@_04COOMCNPB@sinh?$AA@
0x4B33235E: "__stdcall LdrpLocateMrdata" _LdrpLocateMrdata@0
0x4B374420: "__stdcall RtlpHpReallocMove" _RtlpHpReallocMove@16
0x4B2B7B83: "__stdcall LdrpInsertDataTableEntry" _LdrpInsertDataTableEntry@4
0x4B364230: "__stdcall RtlQueryTokenHostIdAsUlong64" _RtlQueryTokenHostIdAsUlong64@8
0x4B2BD1D1: "__stdcall LdrpProcessWork" _LdrpProcessWork@8
0x4B2F1600: "__stdcall ZwOpenEnlistment" _ZwOpenEnlistment@20
0x4B2E65E2: "__stdcall _RtlUserThreadStart" __RtlUserThreadStart@8
0x4B2F1A50: "__stdcall NtQueryTimerResolution" _NtQueryTimerResolution@12
0x4B2DC28F: "__stdcall LdrpFindDllActivationContext" _LdrpFindDllActivationContext@4
0x4B281068: "__cdecl RtlpNullString" _RtlpNullString
0x4B2D8580: "__stdcall EtwEventSetInformation" _EtwEventSetInformation@20
0x4B2C1160: "__stdcall RtlGetFullPathName_UstrEx" _RtlGetFullPathName_UstrEx@32
0x4B2BF780: "__stdcall RtlWow64EnableFsRedirectionEx" _RtlWow64EnableFsRedirectionEx@8
0x4B384740: "__stdcall PsspCaptureVaSpaceInformation" _PsspCaptureVaSpaceInformation@12
0x4B287754: "\\.\" ??_C@_19BKJMDJK@?$AA?2?$AA?2?$AA?4?$AA?2?$AA?$AA@
0x4B2C6463: "__stdcall RtlpCoalesceFreeBlocks" _RtlpCoalesceFreeBlocks@16
0x4B35163B: "__stdcall RtlpGetMUIRedirectedFilePathInternal" _RtlpGetMUIRedirectedFilePathInternal@28
0x4B2F0C20: "__stdcall ZwAlpcConnectPortEx" _ZwAlpcConnectPortEx@44
0x4B2F1620: "__stdcall ZwOpenIoCompletion" _ZwOpenIoCompletion@12
0x4B2C99C0: "__stdcall RtlpHeapRemoveListEntry" _RtlpHeapRemoveListEntry@24
0x4B2E9090: "__stdcall RtlInitializeGenericTable" _RtlInitializeGenericTable@20
0x4B361831: "__stdcall NormBuffer__GetLastChar" _NormBuffer__GetLastChar@4
0x4B2C5420: "__stdcall RtlpHpStackLoggingEnabled" _RtlpHpStackLoggingEnabled@4
0x4B2F8811: "__cdecl _rtnospopde" __rtnospopde
0x4B2F0910: "__stdcall NtAddAtom" _NtAddAtom@12
0x4B2F0E00: "__stdcall ZwCommitRegistryTransaction" _ZwCommitRegistryTransaction@8
0x4B2B0C60: "__stdcall RtlFirstFreeAce" _RtlFirstFreeAce@8
0x4B2D3408: "__stdcall RtlpFindActivationContextSection_FillOutReturnedData" _RtlpFindActivationContextSection_FillOutReturnedData@32
0x4B39F11C: "__cdecl EtwpRegistrationSequence" _EtwpRegistrationSequence
0x4B2A382C: "Heap block at %p modified at %p " ??_C@_0DM@PGDNJJIE@Heap?5block?5at?5?$CFp?5modified?5at?5?$CFp?5@
0x4B281080: "__cdecl RtlpDosPRNDevice" _RtlpDosPRNDevice
0x4B3A0A00: "__cdecl LdrpPageSize" _LdrpPageSize
0x4B2D9D23: "__stdcall RtlInitializeHeapLogging" _RtlInitializeHeapLogging@0
0x4B3A17E8: "__cdecl LdrpShouldCreateStackTraceDb" _LdrpShouldCreateStackTraceDb
0x4B360B90: "__stdcall RtlIsPartialPlaceholderFileHandle" _RtlIsPartialPlaceholderFileHandle@8
0x4B2F8B30: "__cdecl _fFEXP" __fFEXP
0x4B2D2A1F: "__stdcall RtlpMoveHeapBetweenLists" _RtlpMoveHeapBetweenLists@16
0x4B2D207E: "__fastcall RtlpWakeByAddress" @RtlpWakeByAddress@12
0x4B28C100: "__cdecl RtlpBucketBlockSizes" _RtlpBucketBlockSizes
0x4B2F0960: "__stdcall NtApphelpCacheControl" _NtApphelpCacheControl@8
0x4B2B2CD1: "__stdcall RtlDetermineDosPathNameType_Ustr" _RtlDetermineDosPathNameType_Ustr@4
0x4B2858DC: "\WinSxS\" ??_C@_1BC@OACMOHID@?$AA?2?$AAW?$AAi?$AAn?$AAS?$AAx?$AAS?$AA?2?$AA?$AA@
0x4B34C0C8: "__stdcall RtlFindNextForwardRunClearCapped" _RtlFindNextForwardRunClearCapped@16
0x4B35DA45: "__stdcall RtlIsValidOemCharacter" _RtlIsValidOemCharacter@4
0x4B2F1BB0: "__stdcall NtResetEvent" _NtResetEvent@8
0x4B3398C0: "__stdcall RtlWaitForWnfMetaNotification" _RtlWaitForWnfMetaNotification@24
0x4B2DD650: "__stdcall TppFreeWait" _TppFreeWait@4
0x4B28696C: "LDR" ??_C@_03PAGHNNKM@LDR?$AA@
0x4B2FCE10: "__cdecl _i64tow_s" __i64tow_s
0x4B2F1220: "__stdcall ZwEnumerateBootEntries" _ZwEnumerateBootEntries@8
0x4B34D610: "__stdcall RtlBarrierForDelete" _RtlBarrierForDelete@8
0x4B2AC6A5: "__stdcall LdrpGetProcedureAddress" _LdrpGetProcedureAddress@16
0x4B2810E0: "__cdecl RtlpWin32NtRoot" _RtlpWin32NtRoot
0x4B3051B0: "__stdcall FinalExceptionHandler" _FinalExceptionHandler@16
0x4B2F19F0: "__stdcall ZwQuerySecurityPolicy" _ZwQuerySecurityPolicy@24
0x4B2A54E8: "Invalid ReserveSize parameter - " ??_C@_0CF@IOONAIAB@Invalid?5ReserveSize?5parameter?5?9?5@
0x4B285580: "TerminalServices-RemoteConnectio" ??_C@_1HI@LOGLGABO@?$AAT?$AAe?$AAr?$AAm?$AAi?$AAn?$AAa?$AAl?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAs?$AA?9?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAC?$AAo?$AAn?$AAn?$AAe?$AAc?$AAt?$AAi?$AAo@
0x4B2EF5BE: "__stdcall EtwpValidateLoggerInfo" _EtwpValidateLoggerInfo@4
0x4B2B91C0: "__stdcall LdrpLoadResourceFromAlternativeModule" _LdrpLoadResourceFromAlternativeModule@20
0x4B2F1D00: "__stdcall NtSetDefaultHardErrorPort" _NtSetDefaultHardErrorPort@4
0x4B2A559C: "Specified HeapBase (%p) != to Ba" ??_C@_0DA@HAOPAFBG@Specified?5HeapBase?5?$CI?$CFp?$CJ?5?$CB?$DN?5to?5Ba@
0x4B35C770: "__stdcall RtlIpv4AddressToStringExA" _RtlIpv4AddressToStringExA@16
0x4B2E49C0: "__stdcall RtlQueryPackageClaims" _RtlQueryPackageClaims@32
0x4B3638F4: "__stdcall RtlControlStackTraceDataBase" _RtlControlStackTraceDataBase@12
0x4B3365A4: "__stdcall AVrfpDumpProviderList" _AVrfpDumpProviderList@0
0x4B347980: "__stdcall RtlIsCriticalSectionLocked" _RtlIsCriticalSectionLocked@4
0x4B2B884C: "__stdcall LdrpFetchAddressOfSecurityCookie" _LdrpFetchAddressOfSecurityCookie@16
0x4B363859: "__stdcall RtlpLockStack" _RtlpLockStack@0
0x4B288EC0: "__cdecl RtlpStatusTable" _RtlpStatusTable
0x4B331EDC: "__stdcall LdrpHashAsciizString" _LdrpHashAsciizString@4
0x4B2F1F30: "__stdcall NtSetTimerResolution" _NtSetTimerResolution@12
0x4B38782F: "__stdcall RtlpStackDbEntryCreate" _RtlpStackDbEntryCreate@12
0x4B2F1C40: "__stdcall NtRollforwardTransactionManager" _NtRollforwardTransactionManager@8
0x4B286794: "asin" ??_C@_04FIHNOPOL@asin?$AA@
0x4B3681ED: "__stdcall RtlpHpStackDbInitialize" _RtlpHpStackDbInitialize@0
0x4B2F22A0: "__stdcall NtWow64CallFunction64" _NtWow64CallFunction64@28
0x4B2923B8: "__cdecl AppModelLibraryLoadFailureSystemBinary" _AppModelLibraryLoadFailureSystemBinary
0x4B364AF0: "__stdcall RtlTraceDatabaseFind" _RtlTraceDatabaseFind@16
0x4B3047D0: "__stdcall NtdllGhostWndProcWorker" _NtdllGhostWndProcWorker@0
0x4B3051BE: FinalExceptionHandlerPad14
0x4B2D91E0: "__stdcall RtlDeleteResource" _RtlDeleteResource@4
0x4B3051C8: FinalExceptionHandlerPad24
0x4B3051D2: FinalExceptionHandlerPad34
0x4B298E00: "__cdecl SidHashByteToIndexLookupTable" _SidHashByteToIndexLookupTable
0x4B2F2120: "__stdcall NtVdmControl" _NtVdmControl@8
0x4B2E9A70: "__stdcall LdrFindResourceEx_U" _LdrFindResourceEx_U@20
0x4B3051DC: FinalExceptionHandlerPad44
0x4B281B88: "__cdecl VrfcoreDllString" _VrfcoreDllString
0x4B3051E6: FinalExceptionHandlerPad54
0x4B294AE0: "Execute '.cxr %p' to dump contex" ??_C@_0CD@KCPGJLCO@Execute?5?8?4cxr?5?$CFp?8?5to?5dump?5contex@
0x4B2ABB20: "__stdcall RtlDispatchAPC" _RtlDispatchAPC@12
0x4B39FB70: "__cdecl NlsMbAnsiCodePageTables" _NlsMbAnsiCodePageTables
0x4B2DE24C: "__stdcall TppIopValidateIo" _TppIopValidateIo@12
0x4B297680: "SXS: %s() found activation conte" ??_C@_0FF@DDEEGJMG@SXS?3?5?$CFs?$CI?$CJ?5found?5activation?5conte@
0x4B3317F1: "__stdcall LdrpCheckRedirection" _LdrpCheckRedirection@8
0x4B382048: "__stdcall TppETWTimerSetNtTimer" _TppETWTimerSetNtTimer@16
0x4B3405C4: "__stdcall LdrpResCompareServiceChecksum" _LdrpResCompareServiceChecksum@16
0x4B2F3550: "__cdecl cos" _cos
0x4B293224: "minkernel\ntdll\ldrinit.c" ??_C@_0BK@IHEKJBGG@minkernel?2ntdll?2ldrinit?4c?$AA@
0x4B37C95C: "__stdcall EtwpGetKmRegHandle" _EtwpGetKmRegHandle@12
0x4B33A4A0: "__stdcall LdrSetDefaultDllDirectories" _LdrSetDefaultDllDirectories@4
0x4B384660: "__stdcall PsspCaptureImageInformation" _PsspCaptureImageInformation@12
0x4B3619E2: "__stdcall NormBuffer__LastStartBasePair" _NormBuffer__LastStartBasePair@4
0x4B2DDEF4: "__stdcall TppAlpcpValidateAlpc" _TppAlpcpValidateAlpc@12
0x4B35C720: "__stdcall RtlEthernetAddressToStringA" _RtlEthernetAddressToStringA@8
0x4B3304EA: "__stdcall LdrpInitializeNlsInfo" _LdrpInitializeNlsInfo@4
0x4B2A3D28: ".nlp" ??_C@_19JMIJHJNO@?$AA?4?$AAn?$AAl?$AAp?$AA?$AA@
0x4B296ED0: "SXS/RTL: Section found (offset %" ??_C@_0GJ@JGGCFIHJ@SXS?1RTL?3?5Section?5found?5?$CIoffset?5?$CF@
0x4B3827B0: "__stdcall RtlpTpIoCallback" _RtlpTpIoCallback@16
0x4B281B90: "__cdecl AvrfpAPILookupCallbackName" _AvrfpAPILookupCallbackName
0x4B369A3B: "__stdcall RtlpLogHeapSubSegmentFreeCached" _RtlpLogHeapSubSegmentFreeCached@16
0x4B3554C0: "__stdcall RtlpHeapPerformCrossProcessQuery" _RtlpHeapPerformCrossProcessQuery@8
0x4B284FE4: "LdrResSearchResource Enter" ??_C@_1DG@MFCDPHEL@?$AAL?$AAd?$AAr?$AAR?$AAe?$AAs?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAE?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x4B2B5CE0: "__stdcall RtlUpcaseUnicodeChar" _RtlUpcaseUnicodeChar@4
0x4B2A9960: "__stdcall RtlAddSIDToBoundaryDescriptor" _RtlAddSIDToBoundaryDescriptor@8
0x4B2EEE6B: "__stdcall RtlpQueryTimeZoneInformationWorker" _RtlpQueryTimeZoneInformationWorker@8
0x4B2FED06: "__cdecl _safecrt_wctomb_s" __safecrt_wctomb_s
0x4B298970: "LdrpLoadResourceFromAlternativeM" ??_C@_0CG@OMJMGNLB@LdrpLoadResourceFromAlternativeM@
0x4B2A61F4: "C:\data\programs\windowsapps" ??_C@_1DK@LFAIJJDD@?$AAC?$AA?3?$AA?2?$AAd?$AAa?$AAt?$AAa?$AA?2?$AAp?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAs?$AA?2?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAa?$AAp?$AAp?$AAs?$AA?$AA@
0x4B364B40: "__stdcall RtlTraceDatabaseLock" _RtlTraceDatabaseLock@4
0x4B2F5660: "__cdecl _wcsset_s" __wcsset_s
0x4B384422: "__stdcall PsspCaptureAuxiliaryPages" _PsspCaptureAuxiliaryPages@20
0x4B2D4DD0: "__stdcall TpIsTimerSet" _TpIsTimerSet@4
0x4B35D1A0: "__stdcall RtlGUIDFromString" _RtlGUIDFromString@8
0x4B304690: "__stdcall NtdllHkINLPCWPRETSTRUCT_W" _NtdllHkINLPCWPRETSTRUCT_W@0
0x4B2B3340: "__stdcall RtlDosPathNameToNtPathName_U" _RtlDosPathNameToNtPathName_U@16
0x4B375692: "__stdcall RtlpHpLfhSubsegmentCommitBlock" _RtlpHpLfhSubsegmentCommitBlock@12
0x4B2DD400: "__stdcall TppSimplepFree" _TppSimplepFree@4
0x4B2F0650: "__stdcall NtWriteFileGather" _NtWriteFileGather@36
0x4B3A0918: "__cdecl RtlFailedCriticalDebugAllocations" _RtlFailedCriticalDebugAllocations
0x4B2E77E1: "__stdcall InitializeUserOrMachineLangList" _InitializeUserOrMachineLangList@20
0x4B3816E0: "__stdcall TpCallbackSendPendingAlpcMessage" _TpCallbackSendPendingAlpcMessage@4
0x4B336435: "__stdcall AVrfpDllLoadNotificationInternal" _AVrfpDllLoadNotificationInternal@4
0x4B32DB1E: "__stdcall LdrpLogFatalUserCallbackException" _LdrpLogFatalUserCallbackException@8
0x4B2EBDE0: "__stdcall WinSqmEventWrite" _WinSqmEventWrite@12
0x4B37D7D9: "__stdcall EtwpBufferingModeFlush" _EtwpBufferingModeFlush@4
0x4B2AA0FA: "__fastcall RtlpProbeUserBufferSafe" @RtlpProbeUserBufferSafe@8
0x4B2F0E40: "__stdcall NtCompareSigningLevels" _NtCompareSigningLevels@8
0x4B304E40: "__stdcall __RtlConvertLongToLargeInteger" ___RtlConvertLongToLargeInteger@4
0x4B32E9E3: "__stdcall InitSecurityCookie" _InitSecurityCookie@0
0x4B382E20: "__stdcall SbpTraceContextUpdate" _SbpTraceContextUpdate@24
0x4B29672C: "minkernel\ntdll\sxsisol.cpp" ??_C@_0BM@JBCICHJG@minkernel?2ntdll?2sxsisol?4cpp?$AA@
0x4B378DC3: "__stdcall RtlpHpSegMgrReserve" _RtlpHpSegMgrReserve@20
0x4B331CB0: "__stdcall CsrSetPriorityClass" _CsrSetPriorityClass@8
0x4B35575C: "__stdcall RtlpHpInitializePerfPolicies" _RtlpHpInitializePerfPolicies@0
0x4B29789C: "SXS: %s() - Caller passed invali" ??_C@_0DD@MLGDJLGG@SXS?3?5?$CFs?$CI?$CJ?5?9?5Caller?5passed?5invali@
0x4B36311F: "__stdcall RtlpNormalizeStringWorker" _RtlpNormalizeStringWorker@20
0x4B360ED0: "__stdcall RtlIsNameInExpression" _RtlIsNameInExpression@16
0x4B284BC8: "Control Panel\Desktop\MuiCached\" ??_C@_1HK@BCFBOMIG@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?5?$AAP?$AAa?$AAn?$AAe?$AAl?$AA?2?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?2?$AAM?$AAu?$AAi?$AAC?$AAa?$AAc?$AAh?$AAe?$AAd?$AA?2@
0x4B2F6170: "__cdecl iswxdigit" _iswxdigit
0x4B2C6440: "__stdcall RtlFreeAnsiString" _RtlFreeAnsiString@4
0x4B2F1440: "__stdcall ZwInitializeRegistry" _ZwInitializeRegistry@4
0x4B2B795E: "__stdcall LdrpAllocateUnicodeString" _LdrpAllocateUnicodeString@8
0x4B2E54FF: "__stdcall LdrpQuerySxSMUIFile" _LdrpQuerySxSMUIFile@20
0x4B293564: "Getting the shim engine exports " ??_C@_0DM@FECNGMCI@Getting?5the?5shim?5engine?5exports?5@
0x4B39F718: "__cdecl RtlpFuzzyStackTracesEnabled" _RtlpFuzzyStackTracesEnabled
0x4B2876D8: "__stdcall _imp__NtOpenKey" __imp__NtOpenKey@12
0x4B2E9CC0: "__stdcall RtlIpv6StringToAddressA" _RtlIpv6StringToAddressA@12
0x4B33CD35: "__stdcall LdrpCompareResourceNames_U" _LdrpCompareResourceNames_U@12
0x4B2F0980: "__stdcall NtCreateThread" _NtCreateThread@32
0x4B2F0AD0: "__stdcall NtAccessCheckByType" _NtAccessCheckByType@44
0x4B2DC0F0: "__stdcall RtlDeactivateActivationContext" _RtlDeactivateActivationContext@8
0x4B2F0690: "__stdcall ZwImpersonateClientOfPort" _ZwImpersonateClientOfPort@8
0x4B3A149C: "__cdecl LdrpUnloadIndexEx" _LdrpUnloadIndexEx
0x4B2D6390: "__stdcall RtlInitializeCriticalSectionEx" _RtlInitializeCriticalSectionEx@12
0x4B296094: "\Forwarders" ??_C@_1BI@BNEBIHDD@?$AA?2?$AAF?$AAo?$AAr?$AAw?$AAa?$AAr?$AAd?$AAe?$AAr?$AAs?$AA?$AA@
0x4B36B445: "__stdcall RtlDebugCreateTagHeap" _RtlDebugCreateTagHeap@16
0x4B373F5C: "__stdcall RtlpHpMetadataHeapCtxGet" _RtlpHpMetadataHeapCtxGet@8
0x4B2F1C30: "__stdcall NtRollbackTransaction" _NtRollbackTransaction@8
0x4B2F0F90: "__stdcall ZwCreateNamedPipeFile" _ZwCreateNamedPipeFile@56
0x4B2F0550: "__stdcall ZwSetInformationThread" _ZwSetInformationThread@16
0x4B2DDCFF: "__stdcall LdrpPinModule" _LdrpPinModule@4
0x4B33A859: "__stdcall RtlpLookupSafeCurDirList" _RtlpLookupSafeCurDirList@0
0x4B32A5E0: "__stdcall RtlDisableThreadProfiling" _RtlDisableThreadProfiling@4
0x4B2952D0: "\Registry\Machine\Software\Micro" ??_C@_1IG@DIKBIGCF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x4B3047A0: "__stdcall NtdllMDIClientWndProcWorker" _NtdllMDIClientWndProcWorker@0
0x4B2F2250: "__stdcall ZwWow64GetNativeSystemInformation" _ZwWow64GetNativeSystemInformation@16
0x4B3A0BC0: "__cdecl NativePageSize" _NativePageSize
0x4B3799FB: "__stdcall RtlpHpSegPageRangeShrink" _RtlpHpSegPageRangeShrink@16
0x4B33C710: "__stdcall vDbgPrintEx" _vDbgPrintEx@16
0x4B3A09F8: "__cdecl LdrpAllocationGranularity" _LdrpAllocationGranularity
0x4B2DDB50: "__stdcall RtlGetActiveActivationContext" _RtlGetActiveActivationContext@4
0x4B2F0890: "__stdcall NtReadVirtualMemory" _NtReadVirtualMemory@20
0x4B35CED0: "__stdcall RtlInitializeCorrelationVector" _RtlInitializeCorrelationVector@12
0x4B299230: "Second initialization stack trac" ??_C@_0ED@NELNFADP@Second?5initialization?5stack?5trac@
0x4B2D274E: "__stdcall SbpDetermineDllContext" _SbpDetermineDllContext@8
0x4B2ABFDF: "__stdcall LdrpSendShimEngineInitialNotifications" _LdrpSendShimEngineInitialNotifications@8
0x4B2977D0: "SXS: %s() received invalid file " ??_C@_0EI@KCKGKGJD@SXS?3?5?$CFs?$CI?$CJ?5received?5invalid?5file?5@
0x4B37224D: "__stdcall RtlpGetNormalization" _RtlpGetNormalization@8
0x4B373E5B: "__stdcall RtlpHpMetadataAlloc" _RtlpHpMetadataAlloc@20
0x4B32E6D8: "__cdecl _TlgDefineProvider_annotation__TlgLdrpMuiResourceLoaderTraceLoggingProviderProv" __TlgDefineProvider_annotation__TlgLdrpMuiResourceLoaderTraceLoggingProviderProv
0x4B330514: "__stdcall LdrpInitializeProcessWrapperFilter" _LdrpInitializeProcessWrapperFilter@8
0x4B2E5C64: "__stdcall TppAllocThreadData" _TppAllocThreadData@4
0x4B2F6090: "__cdecl iswalpha" _iswalpha
0x4B3A432C: "__cdecl LdrpVectorHandlerList" _LdrpVectorHandlerList
0x4B35D8E0: "__stdcall RtlIsNameLegalDOS8Dot3" _RtlIsNameLegalDOS8Dot3@12
0x4B2D83AD: "__stdcall RtlpCreateWnfNameSubscription" _RtlpCreateWnfNameSubscription@16
0x4B3A14BC: "`RtlpGetCookieValue'::`2'::CookieValue" ?CookieValue@?1??RtlpGetCookieValue@@9@9
0x4B2F1EB0: "__stdcall ZwSetSystemEnvironmentValue" _ZwSetSystemEnvironmentValue@8
0x4B2AB39D: "__stdcall TpPoolReferenceExistingGlobalPool" _TpPoolReferenceExistingGlobalPool@0
0x4B2F1120: "__stdcall NtDebugActiveProcess" _NtDebugActiveProcess@8
0x4B361F9D: "__stdcall Normalization__GetLastChar" _Normalization__GetLastChar@24
0x4B2A48CC: "heap_failure_buffer_overrun" ??_C@_0BM@KBPKEJM@heap_failure_buffer_overrun?$AA@
0x4B35443A: "__stdcall RtlSetHeapDebuggingInformation" _RtlSetHeapDebuggingInformation@8
0x4B2F1160: "__stdcall ZwDeleteDriverEntry" _ZwDeleteDriverEntry@4
0x4B2AC04C: "__stdcall LdrpInitializeShimDllDependencies" _LdrpInitializeShimDllDependencies@0
0x4B2F1F20: "__stdcall ZwSetTimerEx" _ZwSetTimerEx@16
0x4B2EA530: "__stdcall RtlGetActiveConsoleId" _RtlGetActiveConsoleId@0
0x4B372892: "__stdcall RtlHpHeapManagerStart" _RtlHpHeapManagerStart@24
0x4B36BFAB: "__stdcall RtlDebugSetUserFlagsHeap" _RtlDebugSetUserFlagsHeap@20
0x4B36F470: "__stdcall RtlCompressWorkSpaceSizeLZNT1" _RtlCompressWorkSpaceSizeLZNT1@12
0x4B3A17E4: "__cdecl LdrpParentInterlockedPopEntrySListPointer" _LdrpParentInterlockedPopEntrySListPointer
0x4B33C6F0: "__stdcall DbgQueryDebugFilterState" _DbgQueryDebugFilterState@8
0x4B3A1AB0: "__cdecl RtlpLockedMemoryBlockLookasideCount" _RtlpLockedMemoryBlockLookasideCount
0x4B3680C0: "__stdcall RtlpHpPerHeapStackTraceInitialize" _RtlpHpPerHeapStackTraceInitialize@12
0x4B2A8F9E: "__stdcall RtlEnumerateBoundaryDescriptorEntries" _RtlEnumerateBoundaryDescriptorEntries@12
0x4B35CC90: "__stdcall RtlEthernetStringToAddressW" _RtlEthernetStringToAddressW@12
0x4B2E7449: "__stdcall LdrpComputeTlsSizeAndAlignment" _LdrpComputeTlsSizeAndAlignment@8
0x4B354033: "__stdcall RtlLockHeapManagerForCloning" _RtlLockHeapManagerForCloning@0
0x4B2949BC: "LdrpAllocateTlsEntry" ??_C@_0BF@HICIHJJA@LdrpAllocateTlsEntry?$AA@
0x4B2AE8F0: "__stdcall RtlIsMultiSessionSku" _RtlIsMultiSessionSku@0
0x4B303F1B: "__stdcall RtlpHpSegLockAcquire" _RtlpHpSegLockAcquire@8
0x4B34E84B: "__stdcall RtlpSetTimeZoneInformationWorker" _RtlpSetTimeZoneInformationWorker@8
0x4B37797B: "__stdcall RtlpHpVaMgrRangeCreate" _RtlpHpVaMgrRangeCreate@12
0x4B350CA0: "__stdcall RtlpConvertCultureNamesToLCIDs" _RtlpConvertCultureNamesToLCIDs@8
0x4B2A38B0: "ZwAllocateVirtualMemory failed %" ??_C@_0EE@GJNIHOMM@ZwAllocateVirtualMemory?5failed?5?$CF@
0x4B2E5B00: "__stdcall RtlAdjustPrivilege" _RtlAdjustPrivilege@16
0x4B2D8DC0: "__stdcall RtlRunOnceComplete" _RtlRunOnceComplete@12
0x4B2A5A48: "Heap Segment at %p contains inva" ??_C@_0EK@GAEMMPJH@Heap?5Segment?5at?5?$CFp?5contains?5inva@
0x4B2ABC80: "__stdcall RtlIsCloudFilesPlaceholder" _RtlIsCloudFilesPlaceholder@8
0x4B364E30: "__stdcall RtlWakeAddressAllNoFence" _RtlWakeAddressAllNoFence@4
0x4B2E35B8: "__stdcall RtlpHpHeapCheckCommitLimit" _RtlpHpHeapCheckCommitLimit@16
0x4B2EC582: "__stdcall RtlpCapabilityCheckSystemCapability" _RtlpCapabilityCheckSystemCapability@12
0x4B350301: "__stdcall RtlUnicodeStringToLcid" _RtlUnicodeStringToLcid@8
0x4B2F0CE0: "__stdcall ZwAlpcImpersonateClientOfPort" _ZwAlpcImpersonateClientOfPort@12
0x4B2CAF50: "__stdcall LdrShutdownProcess" _LdrShutdownProcess@0
0x4B3541A0: "__stdcall RtlQueryHeapInformation" _RtlQueryHeapInformation@20
0x4B335C8C: "__stdcall AVrfDllUnloadNotification" _AVrfDllUnloadNotification@4
0x4B2F7F80: "__cdecl towlower" _towlower
0x4B32BDA0: "__cdecl LdrpLogDbgPrint" _LdrpLogDbgPrint
0x4B2F22C0: "__stdcall UninitUser32Proc" _UninitUser32Proc@0
0x4B2DD94F: "__stdcall LdrpAllocatePlaceHolder" _LdrpAllocatePlaceHolder@28
0x4B295230: "Vending" ??_C@_1BA@MCDGPFHC@?$AAV?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?$AA@
0x4B294E20: "Windows.Xbox" ??_C@_1BK@LOPBGAIM@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAX?$AAb?$AAo?$AAx?$AA?$AA@
0x4B299164: "Critical section address" ??_C@_0BJ@OGOHHGLD@Critical?5section?5address?$AA@
0x4B2FAB80: "__cdecl _rtforatnby0" __rtforatnby0
0x4B2F13D0: "__stdcall NtGetNlsSectionPtr" _NtGetNlsSectionPtr@20
0x4B2F18A0: "__stdcall NtQueryInformationAtom" _NtQueryInformationAtom@20
0x4B354850: "__stdcall RtlValidateProcessHeaps" _RtlValidateProcessHeaps@0
0x4B2E897D: "__stdcall RtlpMuiRegGetLangInfoIndex" _RtlpMuiRegGetLangInfoIndex@8
0x4B2F5B10: "__cdecl abs" _abs
0x4B2F8EB8: "__cdecl __pctype_func" ___pctype_func
0x4B2F1FA0: "__stdcall ZwSinglePhaseReject" _ZwSinglePhaseReject@8
0x4B299810: "MiniNT" ??_C@_1O@BMELCLLB@?$AAM?$AAi?$AAn?$AAi?$AAN?$AAT?$AA?$AA@
0x4B2D58C5: "__stdcall RtlpCreateHeapEncoding" _RtlpCreateHeapEncoding@4
0x4B2D77FB: "__stdcall RtlpLfhIncrementDataSlot" _RtlpLfhIncrementDataSlot@0
0x4B2AC736: "__stdcall LdrpNameToOrdinal" _LdrpNameToOrdinal@24
0x4B2F07A0: "__stdcall ZwOpenProcessTokenEx" _ZwOpenProcessTokenEx@16
0x4B36F260: "__stdcall LZNT1FindMatchStandard" _LZNT1FindMatchStandard@8
0x4B364EB0: "__stdcall RtlWow64GetEquivalentMachineCHPE" _RtlWow64GetEquivalentMachineCHPE@4
0x4B298CC4: "%s\%u-%u-%u-%u" ??_C@_1BO@FFPNCKK@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAu?$AA?9?$AA?$CF?$AAu?$AA?9?$AA?$CF?$AAu?$AA?9?$AA?$CF?$AAu?$AA?$AA@
0x4B287828: "RETURN" ??_C@_06LJMOENAO@RETURN?$AA@
0x4B3A1820: "__cdecl LdrDelegatedSystemDllInitBlock" _LdrDelegatedSystemDllInitBlock
0x4B3A0B50: "__cdecl LdrpStatistics" _LdrpStatistics
0x4B2B7C52: "__stdcall LdrpCompleteMapModule" _LdrpCompleteMapModule@12
0x4B2F3BA0: "__cdecl isalpha" _isalpha
0x4B2F1520: "__stdcall ZwMakePermanentObject" _ZwMakePermanentObject@4
0x4B2A87C0: "__stdcall TpTimerOutstandingCallbackCount" _TpTimerOutstandingCallbackCount@4
0x4B39E840: "__cdecl _indefinite" __indefinite
0x4B358C3F: "__stdcall RtlpCopyLegacyContext" _RtlpCopyLegacyContext@16
0x4B32D449: "__stdcall LdrpEventAddUnicodeString" _LdrpEventAddUnicodeString@16
0x4B3A1724: "__cdecl EtwpGuidEntryTable" _EtwpGuidEntryTable
0x4B367870: "__stdcall RtlpNtSetValueKey" _RtlpNtSetValueKey@16
0x4B2E667A: "__stdcall LdrpInsertModuleToIndex" _LdrpInsertModuleToIndex@8
0x4B2A3868: "RtlpHeapFreeVirtualMemory failed" ??_C@_0EG@CGCCBHGF@RtlpHeapFreeVirtualMemory?5failed@
0x4B372962: "__stdcall RtlpHpAllocVA" _RtlpHpAllocVA@28
0x4B2F06A0: "__stdcall ZwReleaseMutant" _ZwReleaseMutant@8
0x4B3A0BEC: "__cdecl g_pShimmedModuleListLength" _g_pShimmedModuleListLength
0x4B2FC609: "__cdecl _87except" __87except
0x4B294B10: "Locating export at ordinal %d fo" ??_C@_0EK@DGKMIJBL@Locating?5export?5at?5ordinal?5?$CFd?5fo@
0x4B2F25D0: "__cdecl __raise_securityfailure" ___raise_securityfailure
0x4B2E9550: "__stdcall RtlGetDeviceFamilyInfoEnum" _RtlGetDeviceFamilyInfoEnum@12
0x4B286B04: "Loading procedure 0x%lx by ordin" ??_C@_0CE@NJHOKOOH@Loading?5procedure?50x?$CFlx?5by?5ordin@
0x4B338B47: "__stdcall WerpWaitForCrashReporting" _WerpWaitForCrashReporting@16
0x4B297E9C: "RtlpInitializeAssemblyStorageMap" ??_C@_0CB@GEMHLFII@RtlpInitializeAssemblyStorageMap@
0x4B2F1000: "__stdcall NtCreateProfileEx" _NtCreateProfileEx@40
0x4B37247E: "__stdcall RtlpGetSubSegmentBlockCount" _RtlpGetSubSegmentBlockCount@16
0x4B3A1AA8: "__cdecl RtlpCsVerifyDoNotBreak" _RtlpCsVerifyDoNotBreak
0x4B39FDE4: "__cdecl AlternateResourceModuleCount" _AlternateResourceModuleCount
0x4B2F0CD0: "__stdcall NtAlpcImpersonateClientContainerOfPort" _NtAlpcImpersonateClientContainerOfPort@12
0x4B2DAC90: "__stdcall LdrUnloadAlternateResourceModule" _LdrUnloadAlternateResourceModule@4
0x4B29905C: " NumberOfWaitingShared = %lx " ??_C@_0BO@POGOFHC@?5NumberOfWaitingShared?5?$DN?5?$CFlx?6?$AA@
0x4B2F0920: "__stdcall NtCreateEvent" _NtCreateEvent@20
0x4B2F1310: "__stdcall NtFreeUserPhysicalPages" _NtFreeUserPhysicalPages@12
0x4B2A5CC0: "__cdecl FormatMaxLength" _FormatMaxLength
0x4B287838: "INFO" ??_C@_04BEADLPGM@INFO?$AA@
0x4B295B48: " ==============================" ??_C@_0MB@BBMEIHK@?6?6?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN?$DN@
0x4B2A61A4: "Semaphore" ??_C@_1BE@NPGPGCB@?$AAS?$AAe?$AAm?$AAa?$AAp?$AAh?$AAo?$AAr?$AAe?$AA?$AA@
0x4B2EB1D0: "__stdcall RtlIsThreadWithinLoaderCallout" _RtlIsThreadWithinLoaderCallout@0
0x4B33FB0F: "__stdcall RtlpIsEmptyImageFileOptionsKey" _RtlpIsEmptyImageFileOptionsKey@4
0x4B2F2270: "__stdcall ZwWow64AllocateVirtualMemory64" _ZwWow64AllocateVirtualMemory64@28
0x4B3A17EC: "__cdecl LdrDelegatedKiRaiseUserExceptionDispatcher" _LdrDelegatedKiRaiseUserExceptionDispatcher
0x4B2F1E30: "__stdcall NtSetIntervalProfile" _NtSetIntervalProfile@8
0x4B2F16B0: "__stdcall NtOpenPrivateNamespace" _NtOpenPrivateNamespace@16
0x4B2956FC: "AVRF: exception raised while pro" ??_C@_0DE@BOOLGHMF@AVRF?3?5exception?5raised?5while?5pro@
0x4B2F4770: "__cdecl _i64tow" __i64tow
0x4B34E3E0: "__stdcall RtlCheckPortableOperatingSystem" _RtlCheckPortableOperatingSystem@4
0x4B285B3C: "~MHz" ??_C@_19KBOEDNGH@?$AA?$HO?$AAM?$AAH?$AAz?$AA?$AA@
0x4B358B30: "__stdcall RtlLocateExtendedFeature" _RtlLocateExtendedFeature@12
0x4B2A3F34: " *** Resource timeout (%p) in " ??_C@_0CJ@IHJLMNBP@?6?6?5?$CK?$CK?$CK?5Resource?5timeout?5?$CI?$CFp?$CJ?5in?5@
0x4B2D0878: "__stdcall TppUpdateSubQueueTimer" _TppUpdateSubQueueTimer@8
0x4B39E00A: "__cdecl _minfinity" __minfinity
0x4B344840: "__stdcall RtlSidIsHigherLevel" _RtlSidIsHigherLevel@12
0x4B342500: "__stdcall RtlSecondsSince1970ToTime" _RtlSecondsSince1970ToTime@8
0x4B338350: "__stdcall SendMessageToWERService" _SendMessageToWERService@8
0x4B2F0BC0: "__stdcall NtAllocateUserPhysicalPages" _NtAllocateUserPhysicalPages@12
0x4B2F1AF0: "__stdcall ZwRegisterProtocolAddressInformation" _ZwRegisterProtocolAddressInformation@20
0x4B2F0A10: "__stdcall NtWriteRequestData" _NtWriteRequestData@24
0x4B2AB070: "__stdcall RtlSubtreePredecessor" _RtlSubtreePredecessor@4
0x4B3A16F8: "__cdecl RtlpRandomExInit" _RtlpRandomExInit
0x4B2D234A: "__stdcall LdrpNotifyLoadOfGraph" _LdrpNotifyLoadOfGraph@4
0x4B2B24D0: "__stdcall RtlGetIntegerAtom" _RtlGetIntegerAtom@8
0x4B36C9C4: "__stdcall RtlpValidateHeapHeaders" _RtlpValidateHeapHeaders@8
0x4B3A1AA4: "__cdecl RtlpCaptureActivationContextActivationStacks" _RtlpCaptureActivationContextActivationStacks
0x4B37282E: "__stdcall RtlHpHeapManagerInitialize" _RtlHpHeapManagerInitialize@8
0x4B2F73F0: "__cdecl strcat" _strcat
0x4B2F1D40: "__stdcall ZwSetEaFile" _ZwSetEaFile@16
0x4B3553CF: "__stdcall RtlpGetSegmentForAddress" _RtlpGetSegmentForAddress@8
0x4B2F1190: "__stdcall NtDeleteObjectAuditAlarm" _NtDeleteObjectAuditAlarm@12
0x4B3A0B24: "__cdecl LdrpPotentialTlsLeaks" _LdrpPotentialTlsLeaks
0x4B2E0C14: "__stdcall LdrpCondenseGraphRecurse" _LdrpCondenseGraphRecurse@12
0x4B2F0D20: "__stdcall ZwAlpcQueryInformationMessage" _ZwAlpcQueryInformationMessage@24
0x4B33FAC2: "__stdcall RtlpGenerateIFEOKeyFilterId" _RtlpGenerateIFEOKeyFilterId@4
0x4B2E2F72: "__stdcall RtlpInvalidatePathCache" _RtlpInvalidatePathCache@4
0x4B3A1784: "__cdecl RtlpDisableHeapLookaside" _RtlpDisableHeapLookaside
0x4B33A7B8: "__stdcall RtlpAllocateDirPrefixBlock" _RtlpAllocateDirPrefixBlock@4
0x4B2F1A40: "__stdcall ZwQuerySystemInformationEx" _ZwQuerySystemInformationEx@24
0x4B2F1870: "__stdcall NtQueryDriverEntryOrder" _NtQueryDriverEntryOrder@8
0x4B348B80: "__stdcall RtlpConvertAbsoluteToRelativeSecurityAttribute" _RtlpConvertAbsoluteToRelativeSecurityAttribute@12
0x4B37C215: "__stdcall RtlpCSparseBitmapLock" _RtlpCSparseBitmapLock@12
0x4B3586C0: "__stdcall RtlGetExtendedContextLength2" _RtlGetExtendedContextLength2@16
0x4B3313AF: "__stdcall LdrpValidateIntegrityContinuity" _LdrpValidateIntegrityContinuity@12
0x4B2A5F50: "ThreadPool: callback %p(%p) retu" ??_C@_0ED@KFDANBGF@ThreadPool?3?5callback?5?$CFp?$CI?$CFp?$CJ?5retu@
0x4B2F2A80: "__stdcall RtlInitAnsiString" _RtlInitAnsiString@8
0x4B2F1AA0: "__stdcall ZwRaiseHardError" _ZwRaiseHardError@24
0x4B2D4E09: "__stdcall RtlpAddHeapToUnprotectedList" _RtlpAddHeapToUnprotectedList@4
0x4B39E918: "__cdecl g_sqmSessionHandle" _g_sqmSessionHandle
0x4B3802A5: "__stdcall EtwpInitializeCompression" _EtwpInitializeCompression@4
0x4B2866D8: "__cdecl __clocalestr" ___clocalestr
0x4B2F17A0: "__stdcall ZwPrepareEnlistment" _ZwPrepareEnlistment@8
0x4B32CE86: "__stdcall LdrpFindDelayloadedMethod" _LdrpFindDelayloadedMethod@12
0x4B2B52A0: "__stdcall LdrStandardizeSystemPath" _LdrStandardizeSystemPath@4
0x4B332E60: "__stdcall RtlCreateProcessParametersEx" _RtlCreateProcessParametersEx@44
0x4B286A70: "Unable to build import redirecti" ??_C@_0DJ@CJMGMKMH@Unable?5to?5build?5import?5redirecti@
0x4B39D010: "__stdcall RtlAllocateMemoryBlockLookaside" _RtlAllocateMemoryBlockLookaside@12
0x4B2F1180: "__stdcall ZwDeleteKey" _ZwDeleteKey@4
0x4B32C0F0: "__stdcall LdrQueryModuleInfoFromLdrEntry" _LdrQueryModuleInfoFromLdrEntry@20
0x4B2F1E80: "__stdcall ZwSetLowWaitHighEventPair" _ZwSetLowWaitHighEventPair@4
0x4B2E88E0: "__stdcall RtlFreeSid" _RtlFreeSid@4
0x4B295040: "Puck" ??_C@_19CDJGIDMD@?$AAP?$AAu?$AAc?$AAk?$AA?$AA@
0x4B2930B4: "KiRaiseUserExceptionDispatcher" ??_C@_0BP@LPIFGB@KiRaiseUserExceptionDispatcher?$AA@
0x4B333A80: "__stdcall RtlNewInstanceSecurityObject" _RtlNewInstanceSecurityObject@40
0x4B2DFA50: "__stdcall RtlUnicodeStringToAnsiString" _RtlUnicodeStringToAnsiString@12
0x4B381AC5: "__stdcall TppETWCallbackEnqueue" _TppETWCallbackEnqueue@20
0x4B2ABC98: "__stdcall LdrpBuildSystem32FileName" _LdrpBuildSystem32FileName@8
0x4B2F0860: "__stdcall ZwDuplicateObject" _ZwDuplicateObject@28
0x4B32C290: "__stdcall LdrQueryProcessModuleInformation" _LdrQueryProcessModuleInformation@12
0x4B361796: "__stdcall NormBuffer__Construct" _NormBuffer__Construct@24
0x4B2D9128: "__stdcall RtlpExtendFrontEndUsageArray" _RtlpExtendFrontEndUsageArray@8
0x4B2950E8: "Building Automation" ??_C@_1CI@MKBKMNBL@?$AAB?$AAu?$AAi?$AAl?$AAd?$AAi?$AAn?$AAg?$AA?5?$AAA?$AAu?$AAt?$AAo?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x4B37DC85: "__stdcall EtwpFlushBuffer" _EtwpFlushBuffer@12
0x4B2EA863: "__stdcall LdrpCheckSafeDiscDll" _LdrpCheckSafeDiscDll@4
0x4B281990: "__cdecl RtlpWin32NtUncRootSlash" _RtlpWin32NtUncRootSlash
0x4B343CD0: "__stdcall RtlIsParentOfChildAppContainer" _RtlIsParentOfChildAppContainer@8
0x4B2D5E34: "__fastcall RtlpCreateSplitBlock" @RtlpCreateSplitBlock@28
0x4B2F0BE0: "__stdcall NtAllocateVirtualMemoryEx" _NtAllocateVirtualMemoryEx@28
0x4B2E6DE0: "__stdcall RtlGetCurrentProcessorNumber" _RtlGetCurrentProcessorNumber@0
0x4B33B1C0: "__stdcall RtlIsActivationContextActive" _RtlIsActivationContextActive@4
0x4B37C470: "__stdcall EtwCheckCoverage" _EtwCheckCoverage@4
0x4B34B960: "__stdcall RtlFindClearBits" _RtlFindClearBits@12
0x4B2F0940: "__stdcall NtCreateSection" _NtCreateSection@28
0x4B293240: "Delaying execution failed with s" ??_C@_0CP@KJIIEJMD@Delaying?5execution?5failed?5with?5s@
0x4B3A1AD4: "__cdecl RtlpTempBlocks" _RtlpTempBlocks
0x4B3814E0: "__stdcall TppWorkCancelPendingCallbacks" _TppWorkCancelPendingCallbacks@4
0x4B2B2300: "__stdcall RtlLookupAtomInAtomTable" _RtlLookupAtomInAtomTable@12
0x4B2A4A44: "Parameter2: %p " ??_C@_0BA@KMPNGOM@Parameter2?3?5?$CFp?6?$AA@
0x4B343200: "__stdcall RtlStartRXact" _RtlStartRXact@4
0x4B2F1E70: "__stdcall ZwSetLowEventPair" _ZwSetLowEventPair@4
0x4B2C89FC: "__stdcall LdrpLangFallbackListAppendNode" _LdrpLangFallbackListAppendNode@24
0x4B3A4204: "__cdecl g_pfnSE_InstallAfterInit" _g_pfnSE_InstallAfterInit
0x4B335930: "__stdcall RtlpWalkCallbackRoutine" _RtlpWalkCallbackRoutine@8
0x4B339B94: "__stdcall RtlpWnfETWEventCallback" _RtlpWnfETWEventCallback@32
0x4B298954: " Item:" ??_C@_1O@CLPPMPN@?$AA?5?$AAI?$AAt?$AAe?$AAm?$AA?3?$AA?$AA@
0x4B3A41F8: "__cdecl g_pfnSE_ProcessDying" _g_pfnSE_ProcessDying
0x4B2993D8: "\System32\" ??_C@_1BG@MINPLFIK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AA?$AA@
0x4B2DDC70: "__stdcall LdrAddRefDll" _LdrAddRefDll@8
0x4B374123: "__stdcall RtlpHpQueryVA" _RtlpHpQueryVA@20
0x4B2949A4: "LdrpCallTlsInitializers" ??_C@_0BI@NBKNDJPA@LdrpCallTlsInitializers?$AA@
0x4B2F5B20: "__cdecl atan" _atan
0x4B32A630: "__stdcall RtlEnableThreadProfiling" _RtlEnableThreadProfiling@20
0x4B2FDA10: "__cdecl sprintf_s" _sprintf_s
0x4B35534A: "__stdcall RtlpGetNextRegionHeap" _RtlpGetNextRegionHeap@16
0x4B292F4C: "LdrpSearchPath" ??_C@_0P@KEOCLEFC@LdrpSearchPath?$AA@
0x4B34E7F0: "__stdcall RtlpQueryTimeZoneKeyNameRoutine" _RtlpQueryTimeZoneKeyNameRoutine@24
0x4B34FD30: "__stdcall RtlGetUILanguageInfo" _RtlGetUILanguageInfo@20
0x4B2F1710: "__stdcall NtOpenSymbolicLinkObject" _NtOpenSymbolicLinkObject@12
0x4B2B30C8: "__stdcall LdrpFindLoadedDllByMappingFile" _LdrpFindLoadedDllByMappingFile@12
0x4B2923D8: "__cdecl LdrFatalInitError" _LdrFatalInitError
0x4B292A54: "LdrpMergeNodes" ??_C@_0P@OLCMBEMN@LdrpMergeNodes?$AA@
0x4B2A5100: "__cdecl XpressHighBitIndexTable" _XpressHighBitIndexTable
0x4B292BD0: "LdrResolveDelayLoadedAPI:Unable " ??_C@_0II@BCPNIILB@LdrResolveDelayLoadedAPI?3Unable?5@
0x4B286C24: "LdrpPreprocessDllName for DLL %w" ??_C@_0DO@PNDPHKOL@LdrpPreprocessDllName?5for?5DLL?5?$CFw@
0x4B2F5430: "__cdecl _wcsicmp" __wcsicmp
0x4B2CA249: "__stdcall ApiSetResolveToHost" _ApiSetResolveToHost@20
0x4B29367C: "LdrpGetProcApphelpCheckModule" ??_C@_0BO@OEAOJJID@LdrpGetProcApphelpCheckModule?$AA@
0x4B2A5200: "__cdecl szTimeZoneKeyName" _szTimeZoneKeyName
0x4B329C73: "__stdcall LdrpCorReplaceStartContext" _LdrpCorReplaceStartContext@4
0x4B34A3B0: "__stdcall RtlAddIntegrityLabelToBoundaryDescriptor" _RtlAddIntegrityLabelToBoundaryDescriptor@8
0x4B339B21: "__stdcall RtlpWnfCalculateRetryTime" _RtlpWnfCalculateRetryTime@4
0x4B295518: "VerifierDlls" ??_C@_1BK@PIIJKLGC@?$AAV?$AAe?$AAr?$AAi?$AAf?$AAi?$AAe?$AAr?$AAD?$AAl?$AAl?$AAs?$AA?$AA@
0x4B333FC9: "__stdcall RtlpInitializeDeniedAce" _RtlpInitializeDeniedAce@24
0x4B299850: "RtlpQueryRegistryValues: Miscomp" ??_C@_0DN@BGIBODAP@RtlpQueryRegistryValues?3?5Miscomp@
0x4B350E90: "__stdcall RtlpConvertLCIDsToCultureNames" _RtlpConvertLCIDsToCultureNames@8
0x4B2DC600: "__stdcall TpReleaseAlpcCompletion" _TpReleaseAlpcCompletion@4
0x4B358530: "__stdcall RtlCopyContext" _RtlCopyContext@12
0x4B39E85C: "__cdecl _cpower" __cpower
0x4B351C04: "__stdcall RtlpMUIGetAllInstalledLang" _RtlpMUIGetAllInstalledLang@12
0x4B2FADB6: "__cdecl _fload" __fload
0x4B2D96A0: "__stdcall RtlpInitializeWnf" _RtlpInitializeWnf@12
0x4B35BC30: "__stdcall RtlNumberGenericTableElementsAvl" _RtlNumberGenericTableElementsAvl@4
0x4B292794: "Execute=1" ??_C@_1BE@KIPGCCDC@?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAe?$AA?$DN?$AA1?$AA?$AA@
0x4B32A575: "__stdcall RtlpImageNtHeader" _RtlpImageNtHeader@4
0x4B2DE950: "__stdcall TppBarrierAdjust" _TppBarrierAdjust@12
0x4B358140: "__stdcall RtlInitStrongEnumerationHashTable" _RtlInitStrongEnumerationHashTable@8
0x4B3658A5: "__stdcall RtlpMuiRegGetFallbackLanguageInfoByLangId" _RtlpMuiRegGetFallbackLanguageInfoByLangId@20
0x4B295808: "AVRF: exception raised in provid" ??_C@_0EA@MOIDJOKE@AVRF?3?5exception?5raised?5in?5provid@
0x4B2A5298: "SegmentReserve" ??_C@_0P@KCAAENCL@SegmentReserve?$AA@
0x4B294FA4: "Phone" ??_C@_1M@ENKMPMBE@?$AAP?$AAh?$AAo?$AAn?$AAe?$AA?$AA@
0x4B298B68: "LdrpResMapFile Exit" ??_C@_1CI@GPCKFCKC@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAM?$AAa?$AAp?$AAF?$AAi?$AAl?$AAe?$AA?5?$AAE?$AAx?$AAi?$AAt?$AA?$AA@
0x4B37F82C: "__stdcall EtwpFinalizeLogFileHeader" _EtwpFinalizeLogFileHeader@8
0x4B2A4540: " *** enter .cxr %p for the cont" ??_C@_0CF@PEGCDMH@?5?$CK?$CK?$CK?5?5enter?5?4cxr?5?$CFp?5for?5the?5cont@
0x4B2F1C60: "__stdcall NtSaveKeyEx" _NtSaveKeyEx@12
0x4B3639D0: "__stdcall RtlStdInitializeStackDatabase" _RtlStdInitializeStackDatabase@16
0x4B2F1500: "__stdcall NtLockRegistryKey" _NtLockRegistryKey@4
0x4B342F70: "__stdcall RtlInitializeRXact" _RtlInitializeRXact@12
0x4B335417: "__stdcall RtlpSetProcessBacktraces" _RtlpSetProcessBacktraces@4
0x4B297F10: "RtlpInsertAssemblyStorageMapEntr" ??_C@_0CC@KAFENPMP@RtlpInsertAssemblyStorageMapEntr@
0x4B2CEED0: "__stdcall TppPrepareDirectParams" _TppPrepareDirectParams@24
0x4B2A7830: "__stdcall RtlLookupElementGenericTable" _RtlLookupElementGenericTable@8
0x4B2F0DF0: "__stdcall NtCommitEnlistment" _NtCommitEnlistment@8
0x4B2869E8: "LdrpFindOrPrepareLoadingModule" ??_C@_0BP@ONAGLLLA@LdrpFindOrPrepareLoadingModule?$AA@
0x4B34A520: "__stdcall RtlImageRvaToVa" _RtlImageRvaToVa@16
0x4B281494: "__cdecl RtlpDosDevicesUncPrefix" _RtlpDosDevicesUncPrefix
0x4B2A498C: "heap_failure_cross_heap_operatio" ??_C@_0CC@DEFHEJOP@heap_failure_cross_heap_operatio@
0x4B2EB280: "__stdcall RtlStringFromGUID" _RtlStringFromGUID@8
0x4B3051C1: FinalExceptionHandlerPad17
0x4B337D20: "__stdcall RtlReportExceptionEx" _RtlReportExceptionEx@20
0x4B3051CB: FinalExceptionHandlerPad27
0x4B373E14: "__stdcall RtlpHpLockHeapForCloning" _RtlpHpLockHeapForCloning@4
0x4B379DD5: "__stdcall RtlpHpSegReportSegment" _RtlpHpSegReportSegment@12
0x4B3051D5: FinalExceptionHandlerPad37
0x4B298188: "SXS: Attempt to probe known root" ??_C@_0FH@PKKCIKPJ@SXS?3?5Attempt?5to?5probe?5known?5root@
0x4B3051DF: FinalExceptionHandlerPad47
0x4B368D3F: "__stdcall RtlpHpStackTraceSerialize" _RtlpHpStackTraceSerialize@12
0x4B35CF40: "__stdcall RtlValidateCorrelationVector" _RtlValidateCorrelationVector@4
0x4B33C190: "__fastcall RtlUlongByteSwap" @RtlUlongByteSwap@4
0x4B3051E9: FinalExceptionHandlerPad57
0x4B2F0EC0: "__stdcall ZwCreateDirectoryObjectEx" _ZwCreateDirectoryObjectEx@20
0x4B2D6494: "__stdcall RtlpAddDebugInfoToCriticalSection" _RtlpAddDebugInfoToCriticalSection@4
0x4B2F0E20: "__stdcall NtCompactKeys" _NtCompactKeys@8
0x4B38217D: "__stdcall TppAreNodeWorkersSteadyState" _TppAreNodeWorkersSteadyState@4
0x4B287740: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x4B2F2260: "__stdcall NtWow64QueryInformationProcess64" _NtWow64QueryInformationProcess64@20
0x4B2F1080: "__stdcall ZwCreateTimer2" _ZwCreateTimer2@20
0x4B304740: "__stdcall NtdllButtonWndProcWorker" _NtdllButtonWndProcWorker@0
0x4B292A64: "minkernel\ntdll\ldrddag.c" ??_C@_0BK@DFNKGAHA@minkernel?2ntdll?2ldrddag?4c?$AA@
0x4B2944EC: "LdrpFindKnownDll" ??_C@_0BB@GNDICFML@LdrpFindKnownDll?$AA@
0x4B288220: "CONOUT$" ??_C@_1BA@BALFACEM@?$AAC?$AAO?$AAN?$AAO?$AAU?$AAT?$AA$?$AA?$AA@
0x4B2E8567: "__stdcall RtlpInitParameterBlock" _RtlpInitParameterBlock@0
0x4B2E12B1: "__stdcall RtlpConsoleFallbackNameFromLocaleName" _RtlpConsoleFallbackNameFromLocaleName@24
0x4B2973C8: "SXS: %s() found assembly informa" ??_C@_0KH@BBCKLANG@SXS?3?5?$CFs?$CI?$CJ?5found?5assembly?5informa@
0x4B2A4020: " *** Critical Section Timeout " ??_C@_0DB@LDKEGGKM@?6?6?5?$CK?$CK?$CK?5Critical?5Section?5Timeout?5@
0x4B288CD4: "__cdecl RtlIsSystemAceType" _RtlIsSystemAceType
0x4B285A40: ".pcle" ??_C@_05PKJNCPJO@?4pcle?$AA@
0x4B35AEA0: "__stdcall RtlpHpConvertFlagsToSegmentFlags" _RtlpHpConvertFlagsToSegmentFlags@4
0x4B303E29: "__stdcall RtlpHpAcquireQueuedLockExclusive" _RtlpHpAcquireQueuedLockExclusive@12
0x4B2F0600: "__stdcall NtAllocateVirtualMemory" _NtAllocateVirtualMemory@24
0x4B2A41B0: "This means the machine is out of" ??_C@_0FP@KDDLACAE@This?5means?5the?5machine?5is?5out?5of@
0x4B3822A0: "__stdcall RtlSetTimer" _RtlSetTimer@28
0x4B35FF3F: "__stdcall ValidateStd3Range" _ValidateStd3Range@4
0x4B36D13D: "__fastcall RtlpAllocateListLookup" @RtlpAllocateListLookup@16
0x4B2F08F0: "__stdcall NtQueueApcThread" _NtQueueApcThread@20
0x4B2A6158: "Event" ??_C@_1M@JJBFPLJB@?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x4B367CE5: "__stdcall RtlpHeapLogRangeCreate" _RtlpHeapLogRangeCreate@12
0x4B3360E7: "__stdcall AVrfOpenCurrentUserImageFileOptionsKey" _AVrfOpenCurrentUserImageFileOptionsKey@12
0x4B293F04: "PageHeapFlags" ??_C@_1BM@PHBMAMOE@?$AAP?$AAa?$AAg?$AAe?$AAH?$AAe?$AAa?$AAp?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x4B2E57D4: "__stdcall RtlULongLongToUInt" _RtlULongLongToUInt@12
0x4B2F1910: "__stdcall NtQueryInformationTransactionManager" _NtQueryInformationTransactionManager@20
0x4B333C40: "__stdcall RtlNewSecurityObjectWithMultipleInheritance" _RtlNewSecurityObjectWithMultipleInheritance@36
0x4B35A5F5: "__stdcall RtlpEstimateAllocatedSize" _RtlpEstimateAllocatedSize@4
0x4B2EEC22: "__stdcall EtwpQueryRegString" _EtwpQueryRegString@16
0x4B2D91A0: "__stdcall RtlpPerformHeapMaintenance" _RtlpPerformHeapMaintenance@4
0x4B2886A8: "ARM" ??_C@_17FHNCMLPJ@?$AAA?$AAR?$AAM?$AA?$AA@
0x4B2FB1FD: "__cdecl _errcode" __errcode
0x4B3A0C24: "__cdecl NtdllBaseTag" _NtdllBaseTag
0x4B3A0B60: "__cdecl LdrpRetryQueue" _LdrpRetryQueue
0x4B3A17F8: "__cdecl LdrParentRtlRetrieveNtUserPfn" _LdrParentRtlRetrieveNtUserPfn
0x4B2F2220: "__stdcall NtWow64CsrVerifyRegion" _NtWow64CsrVerifyRegion@8
0x4B2876BC: "__stdcall _imp__NtDeviceIoControlFile" __imp__NtDeviceIoControlFile@40
0x4B381630: "__stdcall TpCallbackLeaveCriticalSectionOnCompletion" _TpCallbackLeaveCriticalSectionOnCompletion@8
0x4B2F15D0: "__stdcall NtNotifyChangeKey" _NtNotifyChangeKey@40
0x4B379B21: "__stdcall RtlpHpSegPageRangeSplit" _RtlpHpSegPageRangeSplit@12
0x4B349C7B: "__stdcall RtlpValidAttribute" _RtlpValidAttribute@4
0x4B304710: "__stdcall NtdllMDIActivateDlgProc_W" _NtdllMDIActivateDlgProc_W@0
0x4B2ADE2B: "__stdcall RtlpMuiRegAddAlternateCodePage" _RtlpMuiRegAddAlternateCodePage@8
0x4B329E66: "__stdcall LdrpAppxEtwGenericIntegrityFailure" _LdrpAppxEtwGenericIntegrityFailure@4
0x4B303B79: "__stdcall LdrpResolveProcedureAddress" _LdrpResolveProcedureAddress@20
0x4B351D31: "__stdcall RtlpSafewcslen" _RtlpSafewcslen@12
0x4B2A3BB0: "%%%u" ??_C@_19PBHPHAE@?$AA?$CF?$AA?$CF?$AA?$CF?$AAu?$AA?$AA@
0x4B2C90B4: "__stdcall RtlpExtendHeap" _RtlpExtendHeap@8
0x4B37E8BA: "__stdcall EtwpWriteToPrivateBuffers" _EtwpWriteToPrivateBuffers@40
0x4B2F61A0: "__cdecl iswctype" _iswctype
0x4B2C70F4: "__stdcall LdrpLoadDllInternal" _LdrpLoadDllInternal@32
0x4B286934: "LdrpFindLoadedDllInternal" ??_C@_0BK@LBKPCGGL@LdrpFindLoadedDllInternal?$AA@
0x4B2EB2A0: "__stdcall RtlStringFromGUIDEx" _RtlStringFromGUIDEx@12
0x4B37A189: "__stdcall RtlpHpSegSetExtraPresent" _RtlpHpSegSetExtraPresent@8
0x4B2F1A70: "__stdcall NtQueryWnfStateNameInformation" _NtQueryWnfStateNameInformation@20
0x4B2F1FE0: "__stdcall ZwSuspendProcess" _ZwSuspendProcess@4
0x4B2A40D0: "The critical section is unowned." ??_C@_0GG@GLOMMEJH@The?5critical?5section?5is?5unowned?4@
0x4B296B68: "SXS: %s() called with invalid fl" ??_C@_0CN@BFKOPFCA@SXS?3?5?$CFs?$CI?$CJ?5called?5with?5invalid?5fl@
0x4B2F1100: "__stdcall ZwCreateWnfStateName" _ZwCreateWnfStateName@28
0x4B2E8B14: "__stdcall RtlpGetCustomCultureRegKey" _RtlpGetCustomCultureRegKey@0
0x4B2A9ED0: "__stdcall RtlxUnicodeStringToOemSize" _RtlxUnicodeStringToOemSize@4
0x4B2F19C0: "__stdcall ZwQueryQuotaInformationFile" _ZwQueryQuotaInformationFile@36
0x4B304FF0: "__stdcall Wow64SystemServiceCall" _Wow64SystemServiceCall@0
0x4B2C9A9E: "__stdcall LdrpRecordModuleDependency" _LdrpRecordModuleDependency@16
0x4B2AF4F0: "__stdcall RtlCopySid" _RtlCopySid@12
0x4B285CA4: "__cdecl szDaylightStart" _szDaylightStart
0x4B288498: "ResourcePolicies" ??_C@_1CC@NNGJHDFE@?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?$AA@
0x4B2D962B: "__stdcall LdrpDetectDetour" _LdrpDetectDetour@0
0x4B37E431: "__stdcall EtwpReleasePrivateBuffers" _EtwpReleasePrivateBuffers@8
0x4B284CA8: "__cdecl RtlpCheckTokenMembershipGenericMapping" _RtlpCheckTokenMembershipGenericMapping
0x4B28B768: "\Registry\Machine\Hardware\Devic" ??_C@_1EK@KPCANCBO@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc@
0x4B2D0FC0: "__stdcall LdrGetDllPath" _LdrGetDllPath@16
0x4B293808: "Initializing the execution optio" ??_C@_0FD@MKJELIIJ@Initializing?5the?5execution?5optio@
0x4B3A175C: "__cdecl SecurityCookieInitialized" _SecurityCookieInitialized
0x4B286C0C: "LdrpPreprocessDllName" ??_C@_0BG@DPDMGJML@LdrpPreprocessDllName?$AA@
0x4B2CD835: "__stdcall RtlpComputePath" _RtlpComputePath@16
0x4B29385C: "Initializing process 0x%p " ??_C@_0BL@OMICNFNA@Initializing?5process?50x?$CFp?6?$AA@
0x4B286BE4: "DLL %wZ was redirected to %wZ by" ??_C@_0CF@EKBLGBJB@DLL?5?$CFwZ?5was?5redirected?5to?5?$CFwZ?5by@
0x4B2F1C50: "__stdcall NtSaveKey" _NtSaveKey@8
0x4B37AD51: "__stdcall RtlpCSparseBitmapPageDecommit" _RtlpCSparseBitmapPageDecommit@12
0x4B2DF74E: "__stdcall LdrpAcquireTlsIndex" _LdrpAcquireTlsIndex@8
0x4B35772F: "__stdcall LdrVerifyMappedImageMatchesChecksum" _LdrVerifyMappedImageMatchesChecksum@12
0x4B2A3710: "(UCRBlock != NULL)" ??_C@_0BD@NIMLHKID@?$CIUCRBlock?5?$CB?$DN?5NULL?$CJ?$AA@
0x4B299000: "RTL: Resource at %p " ??_C@_0BF@JHJCBILK@RTL?3?5Resource?5at?5?$CFp?6?$AA@
0x4B34D68D: "__stdcall RtlPosixBarrier" _RtlPosixBarrier@8
0x4B2D9E20: "__stdcall LdrpResReportResourceAccessInternalInitOnce" _LdrpResReportResourceAccessInternalInitOnce@12
0x4B2967E8: "rUS.Length <= This->PrivatePreal" ??_C@_0DN@JEHNPGLO@rUS?4Length?5?$DM?$DN?5This?9?$DOPrivatePreal@
0x4B2F0590: "__stdcall ZwQueryInformationFile" _ZwQueryInformationFile@20
0x4B3A4238: "__cdecl AvrfpAPILookupCallbackRoutine" _AvrfpAPILookupCallbackRoutine
0x4B304BC0: "__stdcall RtlLargeIntegerAdd" _RtlLargeIntegerAdd@16
0x4B34BFD0: "__stdcall RtlFindLongestRunClear" _RtlFindLongestRunClear@8
0x4B2F2290: "__stdcall ZwWow64WriteVirtualMemory64" _ZwWow64WriteVirtualMemory64@28
0x4B2EAD80: "__stdcall RtlGetGroupSecurityDescriptor" _RtlGetGroupSecurityDescriptor@12
0x4B2B1955: "__stdcall RtlCreateSecurityDescriptorRelative" _RtlCreateSecurityDescriptorRelative@8
0x4B2F1B50: "__stdcall ZwRenameKey" _ZwRenameKey@8
0x4B2F1F40: "__stdcall ZwSetUuidSeed" _ZwSetUuidSeed@4
0x4B2A59C0: "Heap block at %p has corrupted P" ??_C@_0DD@MHHHEDI@Heap?5block?5at?5?$CFp?5has?5corrupted?5P@
0x4B331F50: "__stdcall RtlComputePrivatizedDllName_U" _RtlComputePrivatizedDllName_U@12
0x4B3A1794: "__cdecl RtlpShutdownProcessFlags" _RtlpShutdownProcessFlags
0x4B35E19F: "__stdcall RtlpMatchUserLanguage" _RtlpMatchUserLanguage@4
0x4B32C1F0: "__stdcall LdrQueryModuleServiceTags" _LdrQueryModuleServiceTags@12
0x4B3A1750: "__cdecl VSMEnclaveProvidersRegistered" _VSMEnclaveProvidersRegistered
0x4B353E9E: "__stdcall RtlInitializeHeapManager" _RtlInitializeHeapManager@4
0x4B294A44: "LdrpGenericExceptionFilter" ??_C@_0BL@IACDIBFN@LdrpGenericExceptionFilter?$AA@
0x4B2FD9B0: "__cdecl memmove_s" _memmove_s
0x4B2CD7D7: "__stdcall TppTimerpValidateTimer" _TppTimerpValidateTimer@12
0x4B2F11A0: "__stdcall NtDeletePrivateNamespace" _NtDeletePrivateNamespace@4
0x4B293C58: "Loading of import redirection mo" ??_C@_0EA@HPLDKLDC@Loading?5of?5import?5redirection?5mo@
0x4B37B8F9: "__stdcall RtlpHpVsContextAllocate" _RtlpHpVsContextAllocate@16
0x4B285B34: "::" ??_C@_15HEEKGCFC@?$AA?3?$AA?3?$AA?$AA@
0x4B285834: "SE_ShimDllLoaded" ??_C@_0BB@PFKJEAC@SE_ShimDllLoaded?$AA@
0x4B2A9520: "__stdcall RtlCreateEnvironment" _RtlCreateEnvironment@8
0x4B2F1470: "__stdcall ZwIsUILanguageComitted" _ZwIsUILanguageComitted@0
0x4B2F19D0: "__stdcall ZwQuerySecurityAttributesToken" _ZwQuerySecurityAttributesToken@24
0x4B3582B0: "__stdcall RtlStronglyEnumerateEntryHashTable" _RtlStronglyEnumerateEntryHashTable@8
0x4B285AB4: "%u.%u.%u.%u" ??_C@_0M@CDHNGIPM@?$CFu?4?$CFu?4?$CFu?4?$CFu?$AA@
0x4B2810A0: "__cdecl RtlpSlashSlashDot" _RtlpSlashSlashDot
0x4B2F1DD0: "__stdcall NtSetInformationSymbolicLink" _NtSetInformationSymbolicLink@16
0x4B2A3A00: "Entry Heap Size" ??_C@_0CJ@BMJPHAKI@Entry?5?5?5?5?5Heap?5?5?5?5?5?5?5?5?5?5?5?5?5?5Size@
0x4B2F11B0: "__stdcall NtDeleteValueKey" _NtDeleteValueKey@8
0x4B37506B: "__stdcall RtlpHpLfhOwnerCompact" _RtlpHpLfhOwnerCompact@12
0x4B331CB8: "__stdcall LdrpCalloutExceptionFilter" _LdrpCalloutExceptionFilter@4
0x4B2A4088: "Go determine why that thread has" ??_C@_0EG@FOJKMAGM@Go?5determine?5why?5that?5thread?5has@
0x4B36B1F4: "__stdcall RtlDebugCreateHeap" _RtlDebugCreateHeap@24
0x4B2F1300: "__stdcall NtFlushWriteBuffer" _NtFlushWriteBuffer@0
0x4B2A5920: "Free Heap block %p modified at %" ??_C@_0DG@BIBPEJPF@Free?5Heap?5block?5?$CFp?5modified?5at?5?$CF@
0x4B2A3BD0: "%02X-%02X-%02X-%02X-%02X-%02X" ??_C@_1DM@IMCLLIIF@?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$AA@
0x4B2F1BE0: "__stdcall ZwResumeProcess" _ZwResumeProcess@4
0x4B382280: "__stdcall RtlDeleteTimerQueue" _RtlDeleteTimerQueue@4
0x4B3A169C: "__cdecl RtlpLockedSectionListLock" _RtlpLockedSectionListLock
0x4B2B1970: "__stdcall RtlSetGroupSecurityDescriptor" _RtlSetGroupSecurityDescriptor@12
0x4B303500: "__stdcall TransformMD5" _TransformMD5@8
0x4B33D38B: "__stdcall LdrpTraceLoadMUIDll" _LdrpTraceLoadMUIDll@8
0x4B3448FE: "__stdcall RtlStringCchCopyW" _RtlStringCchCopyW@12
0x4B28562C: "NTDLL!" ??_C@_1O@BCGMDHAO@?$AAN?$AAT?$AAD?$AAL?$AAL?$AA?$CB?$AA?$AA@
0x4B2F1B10: "__stdcall NtReleaseKeyedEvent" _NtReleaseKeyedEvent@16
0x4B3394C7: "__stdcall RtlResetStackOverflow" _RtlResetStackOverflow@0
0x4B2F1DE0: "__stdcall ZwSetInformationToken" _ZwSetInformationToken@16
0x4B358BD7: "__stdcall RtlpCopyExtendedContext" _RtlpCopyExtendedContext@24
0x4B2DBFE3: "__stdcall RtlpInitializeActivationContextStack" _RtlpInitializeActivationContextStack@4
0x4B2D0080: "__stdcall RtlpScanEnvironment" _RtlpScanEnvironment@28
0x4B28C3D0: "VIDEOSLIBRARY" ??_C@_1BM@JGFBBEDO@?$AAV?$AAI?$AAD?$AAE?$AAO?$AAS?$AAL?$AAI?$AAB?$AAR?$AAA?$AAR?$AAY?$AA?$AA@
0x4B2F51B0: "__cdecl _vscwprintf" __vscwprintf
0x4B2814A0: "__cdecl NtDllUserStubs" _NtDllUserStubs
0x4B2AB920: "__stdcall TpReleaseCleanupGroup" _TpReleaseCleanupGroup@4
0x4B2EC4E3: "__stdcall RtlpLogCapabilityCheckLatency" _RtlpLogCapabilityCheckLatency@24
0x4B2A5374: "MaximumTagIndex" ??_C@_0BA@OMHBDFIN@MaximumTagIndex?$AA@
0x4B2928CC: "Legacy" ??_C@_1O@ECNENGDC@?$AAL?$AAe?$AAg?$AAa?$AAc?$AAy?$AA?$AA@
0x4B2F5350: "__cdecl _vsnwprintf" __vsnwprintf
0x4B2F0700: "__stdcall ZwOpenProcess" _ZwOpenProcess@16
0x4B2BC300: "__stdcall LdrpHandleProtectedDelayload" _LdrpHandleProtectedDelayload@24
0x4B2E688E: "__stdcall RtlpRemoveInvertedFunctionTableEntry" _RtlpRemoveInvertedFunctionTableEntry@8
0x4B2F09F0: "__stdcall NtCreateFile" _NtCreateFile@44
0x4B2F1090: "__stdcall NtCreateToken" _NtCreateToken@52
0x4B2C6B00: "__stdcall RtlpInsertFreeBlock" _RtlpInsertFreeBlock@12
0x4B2EBDE0: "__stdcall LdrSetAppCompatDllRedirectionCallback" _LdrSetAppCompatDllRedirectionCallback@12
0x4B355A70: "__stdcall RtlpLockUlockAllHeapsCallback" _RtlpLockUlockAllHeapsCallback@8
0x4B377CCE: "__stdcall RtlpHpVaMgrStart" _RtlpHpVaMgrStart@20
0x4B2A5220: "__cdecl szDynamicDaylightDisabled" _szDynamicDaylightDisabled
0x4B2F0E80: "__stdcall NtConnectPort" _NtConnectPort@32
0x4B281254: "__cdecl TppIopCleanupGroupMemberVFuncs" _TppIopCleanupGroupMemberVFuncs
0x4B2D7860: "__stdcall TpAllocPool" _TpAllocPool@8
0x4B360E2D: "__stdcall RtlReportFatalFailure" _RtlReportFatalFailure@4
0x4B2B833A: "__stdcall RtlpInsertInvertedFunctionTableEntry" _RtlpInsertInvertedFunctionTableEntry@20
0x4B2F0730: "__stdcall ZwAccessCheckAndAuditAlarm" _ZwAccessCheckAndAuditAlarm@44
0x4B286AEC: "LdrpGetProcedureAddress" ??_C@_0BI@BLNBHLCM@LdrpGetProcedureAddress?$AA@
0x4B285D94: "User32 init not called" ??_C@_0BH@IDCMGDMD@User32?5init?5not?5called?$AA@
0x4B285D4C: "__cdecl szBias" _szBias
0x4B2CB51C: "__stdcall RtlpGrowBlockInPlace" _RtlpGrowBlockInPlace@20
0x4B380590: "__stdcall TpAlpcRegisterCompletionList" _TpAlpcRegisterCompletionList@4
0x4B3621B9: "__stdcall Normalization__GuessCharCount" _Normalization__GuessCharCount@16
0x4B2D40A0: "__stdcall RtlAddRefActivationContext" _RtlAddRefActivationContext@4
0x4B380E50: "__stdcall TpSetDefaultPoolStackInformation" _TpSetDefaultPoolStackInformation@4
0x4B380B73: "__stdcall TppJobpRundownJob" _TppJobpRundownJob@4
0x4B358B60: "__stdcall RtlLocateLegacyContext" _RtlLocateLegacyContext@8
0x4B2D47BA: "__stdcall RtlpQueryInformationActivationContextCompatibilityInformation" _RtlpQueryInformationActivationContextCompatibilityInformation@16
0x4B3A1ADC: "__cdecl RtlpLeaksCount" _RtlpLeaksCount
0x4B2F2200: "__stdcall ZwWow64CsrCaptureMessageString" _ZwWow64CsrCaptureMessageString@20
0x4B2FCB50: "__cdecl _ltoa_s" __ltoa_s
0x4B2F1B20: "__stdcall ZwReleaseWorkerFactoryWorker" _ZwReleaseWorkerFactoryWorker@4
0x4B2D86F4: "__stdcall LdrpResReportResourceAccessInternal" _LdrpResReportResourceAccessInternal@16
0x4B285388: "Latest" ??_C@_1O@PILNADBK@?$AAL?$AAa?$AAt?$AAe?$AAs?$AAt?$AA?$AA@
0x4B33C650: "__cdecl DbgPrintEx" _DbgPrintEx
0x4B2F0540: "__stdcall ZwReplyPort" _ZwReplyPort@8
0x4B2B6FBB: "__stdcall LdrpMapResourceFile" _LdrpMapResourceFile@24
0x4B342540: "__stdcall RtlSecondsSince1980ToTime" _RtlSecondsSince1980ToTime@8
0x4B334D30: "__stdcall RtlSetProcessDebugInformation" _RtlSetProcessDebugInformation@12
0x4B293E00: "Walking the import tables of the" ??_C@_0FP@MHJEMPFN@Walking?5the?5import?5tables?5of?5the@
0x4B3A4218: "__cdecl g_pfnSE_DllLoaded" _g_pfnSE_DllLoaded
0x4B2E1480: "__stdcall RtlMultiByteToUnicodeN" _RtlMultiByteToUnicodeN@20
0x4B39E900: "__cdecl RtlpMaxNumberOfProtectedHeaps" _RtlpMaxNumberOfProtectedHeaps
0x4B37A03D: "__stdcall RtlpHpSegSegmentFree" _RtlpHpSegSegmentFree@16
0x4B2F1B80: "__stdcall NtReplacePartitionUnit" _NtReplacePartitionUnit@12
0x4B2EF44D: "__stdcall EtwpAddInstanceIdToLogFileName" _EtwpAddInstanceIdToLogFileName@12
0x4B2F0D80: "__stdcall ZwAssociateWaitCompletionPacket" _ZwAssociateWaitCompletionPacket@32
0x4B37FAA2: "__stdcall EtwpFinalizeRelogFileHeaderStats" _EtwpFinalizeRelogFileHeaderStats@20
0x4B2F80D0: "__cdecl wcscspn" _wcscspn
0x4B37A376: "__stdcall RtlpHpSegWalk" _RtlpHpSegWalk@12
0x4B333046: "__stdcall RtlpLockFlsCallbackVector" _RtlpLockFlsCallbackVector@0
0x4B38594A: "__stdcall PsspQueryInfoClass_PSS_QUERY_HANDLE_TRACE_INFORMATION" _PsspQueryInfoClass_PSS_QUERY_HANDLE_TRACE_INFORMATION@8
0x4B2F8903: "__cdecl _rttosnpopde" __rttosnpopde
0x4B342950: "__stdcall PfxInitialize" _PfxInitialize@4
0x4B2F916A: "__cdecl __except_validate_jump_buffer" ___except_validate_jump_buffer
0x4B2A53F8: "PseudoTagEntries" ??_C@_0BB@GKGFCBGK@PseudoTagEntries?$AA@
0x4B2F0F00: "__stdcall ZwCreateIRTimer" _ZwCreateIRTimer@12
0x4B285754: "__cdecl WindowsHeapSnapshotProvider" _WindowsHeapSnapshotProvider
0x4B2C8FFF: "__stdcall LdrpAppendAnsiStringToFilenameBuffer" _LdrpAppendAnsiStringToFilenameBuffer@8
0x4B2DC040: "__stdcall RtlFreeActivationContextStack" _RtlFreeActivationContextStack@4
0x4B2A3CD8: "LocaleName" ??_C@_1BG@IDPMNIFP@?$AAL?$AAo?$AAc?$AAa?$AAl?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x4B3A176C: "__cdecl LdrpAdvapi32DllHandle" _LdrpAdvapi32DllHandle
0x4B39E070: "__cdecl __initiallocinfo" ___initiallocinfo
0x4B341E52: "__stdcall UpcaseUnicodeToUTF8NHelper" _UpcaseUnicodeToUTF8NHelper@20
0x4B2867BC: "floor" ??_C@_05PBJFFIGL@floor?$AA@
0x4B363960: "__stdcall RtlLogStackTrace" _RtlLogStackTrace@4
0x4B2F1420: "__stdcall NtInitializeEnclave" _NtInitializeEnclave@20
0x4B35C2F8: "__stdcall RtlpReadProcessHeaps" _RtlpReadProcessHeaps@0
0x4B3A0924: "__cdecl RtlpTimeoutDisable" _RtlpTimeoutDisable
0x4B32D507: "__stdcall LdrpLogDllRelocationEtwEvent" _LdrpLogDllRelocationEtwEvent@16
0x4B2F3A04: "__cdecl sqrt" _sqrt
0x4B2DCD8C: "__stdcall RtlpTpResumeImpersonation" _RtlpTpResumeImpersonation@4
0x4B39E288: "__cdecl __lconv_c" ___lconv_c
0x4B3A1700: "__cdecl EtwpProvLock" _EtwpProvLock
0x4B2F1410: "__stdcall ZwImpersonateThread" _ZwImpersonateThread@12
0x4B3727C8: "__stdcall RtlHpEnvContextCreate" _RtlHpEnvContextCreate@16
0x4B2D8110: "__stdcall RtlGetNtProductType" _RtlGetNtProductType@4
0x4B2A5FD8: "ThreadPool: callback %p(%p) retu" ??_C@_0ED@JIMNPJPL@ThreadPool?3?5callback?5?$CFp?$CI?$CFp?$CJ?5retu@
0x4B361650: "__stdcall GetSurrogateLow" _GetSurrogateLow@4
0x4B2F2110: "__stdcall NtUpdateWnfStateData" _NtUpdateWnfStateData@28
0x4B2EED75: "__stdcall EtwpGetTimeZoneInformation" _EtwpGetTimeZoneInformation@4
0x4B2ADAAA: "__stdcall _RtlpMuiRegAddNeutralLanguage" __RtlpMuiRegAddNeutralLanguage@12
0x4B2A46F8: "Trace database: failed to releas" ??_C@_0CP@PHIFJIAO@Trace?5database?3?5failed?5to?5releas@
0x4B344600: "__stdcall RtlSidEqualLevel" _RtlSidEqualLevel@12
0x4B2F0C70: "__stdcall ZwAlpcCreateSecurityContext" _ZwAlpcCreateSecurityContext@12
0x4B294F00: "Windows.XBoxERA" ??_C@_1CA@MPKNCDMD@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAX?$AAB?$AAo?$AAx?$AAE?$AAR?$AAA?$AA?$AA@
0x4B2F0710: "__stdcall ZwSetInformationFile" _ZwSetInformationFile@20
0x4B2F0B60: "__stdcall NtAdjustTokenClaimsAndDeviceGroups" _NtAdjustTokenClaimsAndDeviceGroups@64
0x4B349EA8: "__stdcall RtlpValidObjectAce" _RtlpValidObjectAce@4
0x4B2F0BA0: "__stdcall ZwAllocateLocallyUniqueId" _ZwAllocateLocallyUniqueId@4
0x4B34A3D0: "__stdcall RtlFindExportedRoutineByName" _RtlFindExportedRoutineByName@8
0x4B2E7E6E: "__stdcall RtlpRemoveHeapFromUnprotectedList" _RtlpRemoveHeapFromUnprotectedList@4
0x4B34AEC0: "__stdcall RtlUnicodeStringToCountedOemString" _RtlUnicodeStringToCountedOemString@12
0x4B2EDFF7: "__stdcall RtlpCreateUserThreadEx" _RtlpCreateUserThreadEx@44
0x4B33C4D0: "__stdcall AlpcMaxAllowedMessageLength" _AlpcMaxAllowedMessageLength@0
0x4B2F20A0: "__stdcall NtUnloadKey" _NtUnloadKey@4
0x4B301288: "__cdecl _filwbuf_s" __filwbuf_s
0x4B361608: "__stdcall ComposeHangulLVT" _ComposeHangulLVT@8
0x4B2E44F0: "__stdcall EtwEventWriteTransfer" _EtwEventWriteTransfer@28
0x4B36937E: "__stdcall RtlpLogHeapAllocateEvent" _RtlpLogHeapAllocateEvent@16
0x4B353DA0: "__stdcall RtlFlushHeaps" _RtlFlushHeaps@0
0x4B2F1950: "__stdcall NtQueryIoCompletion" _NtQueryIoCompletion@20
0x4B2E7316: "__stdcall RtlpIsValidExceptionChain" _RtlpIsValidExceptionChain@16
0x4B2A77B0: "__stdcall RtlDeleteElementGenericTable" _RtlDeleteElementGenericTable@8
0x4B2F1AB0: "__stdcall ZwReadOnlyEnlistment" _ZwReadOnlyEnlistment@8
0x4B294E98: "Windows.Server" ??_C@_1BO@KLFDLACC@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AA?$AA@
0x4B32D6C6: "__stdcall LdrpLogEtwDllSearchResults" _LdrpLogEtwDllSearchResults@8
0x4B2970C8: "RtlFindActivationContextSectionG" ??_C@_0GE@JMDGNLMA@RtlFindActivationContextSectionG@
0x4B29378C: "\KnownDlls32" ??_C@_1BK@ECBBGPKI@?$AA?2?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AA3?$AA2?$AA?$AA@
0x4B32C7A0: "__stdcall LdrUnregisterDllNotification" _LdrUnregisterDllNotification@4
0x4B358DC0: "__stdcall RtlpCopyLegacyContextArm64" _RtlpCopyLegacyContextArm64@16
0x4B2A43A0: "This is usually the result of a " ??_C@_0HP@GKIHMNKI@This?5is?5usually?5the?5result?5of?5a?5@
0x4B2CBD53: "__stdcall GetNameFromLangListNode" _GetNameFromLangListNode@12
0x4B2B637F: "__stdcall LdrpSetAlternateResourceModuleHandle" _LdrpSetAlternateResourceModuleHandle@32
0x4B2A96C5: "__stdcall RtlpQueryInformationActivationContextDetailedInformation" _RtlpQueryInformationActivationContextDetailedInformation@20
0x4B2F8D80: "__cdecl _powhlp" __powhlp
0x4B2F09D0: "__stdcall ZwTerminateThread" _ZwTerminateThread@8
0x4B2A4054: "The critical section is owned by" ??_C@_0CN@FONAGEDF@The?5critical?5section?5is?5owned?5by@
0x4B292A80: "Adding cyclic module %wZ. " ??_C@_0BL@KADGKMMO@Adding?5cyclic?5module?5?$CFwZ?4?6?$AA@
0x4B2F7910: "__cdecl strncpy" _strncpy
0x4B2DF890: "__stdcall RtlFindClearBitsAndSet" _RtlFindClearBitsAndSet@12
0x4B34C4B0: "__stdcall RtlFindSetBitsAndClear" _RtlFindSetBitsAndClear@12
0x4B29861C: "SXS: %s() passed the empty activ" ??_C@_0CP@PLOPKHNF@SXS?3?5?$CFs?$CI?$CJ?5passed?5the?5empty?5activ@
0x4B2F1590: "__stdcall NtModifyBootEntry" _NtModifyBootEntry@4
0x4B3766DE: "__stdcall RtlpHpLargeAlloc" _RtlpHpLargeAlloc@16
0x4B293E60: "Running the init routines of the" ??_C@_0FJ@LONDICCE@Running?5the?5init?5routines?5of?5the@
0x4B2884E4: "FIRMWARE_TYPE" ??_C@_1BM@CGNBCCHA@?$AAF?$AAI?$AAR?$AAM?$AAW?$AAA?$AAR?$AAE?$AA_?$AAT?$AAY?$AAP?$AAE?$AA?$AA@
0x4B2F73E0: "__cdecl strcpy" _strcpy
0x4B2AAB70: "__stdcall RtlIpv4AddressToStringW" _RtlIpv4AddressToStringW@8
0x4B2EA275: "__stdcall LdrpInitializeImportRedirection" _LdrpInitializeImportRedirection@0
0x4B2F7AD0: "__cdecl strspn" _strspn
0x4B378840: "__stdcall RtlpHpSegMgrCheckOpportunisticLargePage" _RtlpHpSegMgrCheckOpportunisticLargePage@12
0x4B376D3C: "__stdcall RtlpHpLargeFree" _RtlpHpLargeFree@12
0x4B2F890D: "__cdecl _rtchsifneg" __rtchsifneg
0x4B304660: "__stdcall NtdllHkINLPCWPSTRUCT_A" _NtdllHkINLPCWPSTRUCT_A@0
0x4B337B83: "__stdcall ReportExceptionInternal" _ReportExceptionInternal@24
0x4B286950: "minkernel\ntdll\ldrfind.c" ??_C@_0BK@IODOFKLI@minkernel?2ntdll?2ldrfind?4c?$AA@
0x4B348200: "__stdcall RtlAddCompoundAce" _RtlAddCompoundAce@24
0x4B37F76A: "__stdcall EtwpAddEventToBuffer" _EtwpAddEventToBuffer@28
0x4B2DD5D8: "__stdcall TppCleanupGroupMemberRelease" _TppCleanupGroupMemberRelease@8
0x4B35E890: "__fastcall RtlpHandleInvalidUserCallTarget" @RtlpHandleInvalidUserCallTarget@4
0x4B294770: "Init routine %p for DLL "%wZ" fa" ??_C@_0EA@OCPKFPKK@Init?5routine?5?$CFp?5for?5DLL?5?$CC?$CFwZ?$CC?5fa@
0x4B2F1CC0: "__stdcall NtSetCachedSigningLevel" _NtSetCachedSigningLevel@20
0x4B3050E0: "__stdcall RtlCaptureContext" _RtlCaptureContext@4
0x4B2C8F70: "__fastcall RtlActivateActivationContextUnsafeFast" @RtlActivateActivationContextUnsafeFast@8
0x4B3437F0: "__stdcall RtlCheckTokenMembership" _RtlCheckTokenMembership@12
0x4B2F1C00: "__stdcall ZwRollbackComplete" _ZwRollbackComplete@8
0x4B381A4A: "__stdcall TppETWCallbackDequeue" _TppETWCallbackDequeue@20
0x4B3679B6: "__stdcall RtlpAnalyzeHeapFailure" _RtlpAnalyzeHeapFailure@12
0x4B2AA450: "__stdcall RtlCreateMemoryBlockLookaside" _RtlCreateMemoryBlockLookaside@20
0x4B2F20B0: "__stdcall ZwUnloadKey2" _ZwUnloadKey2@8
0x4B2AD03F: "__stdcall RtlpQueryRegistryDirect" _RtlpQueryRegistryDirect@16
0x4B2F1A10: "__stdcall ZwQuerySymbolicLinkObject" _ZwQuerySymbolicLinkObject@12
0x4B2CC797: "__stdcall RtlpMuiRegCreateLanguageList" _RtlpMuiRegCreateLanguageList@12
0x4B2E9F70: "__stdcall RtlSetUnhandledExceptionFilter" _RtlSetUnhandledExceptionFilter@4
0x4B332F80: "__stdcall RtlWow64LogMessageInEventLogger" _RtlWow64LogMessageInEventLogger@12
0x4B304870: "__stdcall RtlFillMemory" _RtlFillMemory@12
0x4B2AB870: "__stdcall EtwEventWriteNoRegistration" _EtwEventWriteNoRegistration@16
0x4B2B1EE0: "__stdcall RtlReleasePath" _RtlReleasePath@4
0x4B39FD8C: "__cdecl NlsUnicodeToAnsiData" _NlsUnicodeToAnsiData
0x4B3A0B40: "__cdecl LdrpLoadCompleteEvent" _LdrpLoadCompleteEvent
0x4B3A1780: "__cdecl g_SxsTrackReleaseStacks" _g_SxsTrackReleaseStacks
0x4B37E88C: "__stdcall EtwpWaitForBufferReferenceCount" _EtwpWaitForBufferReferenceCount@4
0x4B2A58AC: "Invalid address specified to %s(" ??_C@_0CL@CDEHKFFI@Invalid?5address?5specified?5to?5?$CFs?$CI@
0x4B2D28C4: "__stdcall LdrpCheckNXCompatibility" _LdrpCheckNXCompatibility@4
0x4B33ABF0: "__cdecl _errno" __errno
0x4B2F11D0: "__stdcall NtDeleteWnfStateName" _NtDeleteWnfStateName@4
0x4B2885B8: "CommonProgramFiles(x86)" ??_C@_1DA@NDENMJEC@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x4B2FD1F0: "__cdecl _snwprintf_s" __snwprintf_s
0x4B2CF8A3: "__stdcall LdrpDrainWorkQueue" _LdrpDrainWorkQueue@4
0x4B2B213C: "__stdcall LdrpDependencyExist" _LdrpDependencyExist@8
0x4B2F13A0: "__stdcall NtGetMUIRegistryInfo" _NtGetMUIRegistryInfo@12
0x4B376BBB: "__stdcall RtlpHpLargeAllocSize" _RtlpHpLargeAllocSize@16
0x4B331999: "__stdcall LdrpMapCleanModuleView" _LdrpMapCleanModuleView@4
0x4B336D39: "__stdcall AVrfpSnapAlreadyLoadedDlls" _AVrfpSnapAlreadyLoadedDlls@0
0x4B2F04E0: "__stdcall NtReadFile" _NtReadFile@36
0x4B30436B: "__stdcall RtlpHpVsDelayFreeContextFlush" _RtlpHpVsDelayFreeContextFlush@4
0x4B285408: "LanguageOverlayKeyName" ??_C@_1CO@MMDGMHGB@?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAO?$AAv?$AAe?$AAr?$AAl?$AAa?$AAy?$AAK?$AAe?$AAy?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x4B368109: "__stdcall RtlpHpRaiseFatalLimitError" _RtlpHpRaiseFatalLimitError@4
0x4B293300: "Process initialization raised ex" ??_C@_0GF@LOFCHEHI@Process?5initialization?5raised?5ex@
0x4B297B5C: "SXS: %s() - Caller passed invali" ??_C@_0DA@MHMBOCBK@SXS?3?5?$CFs?$CI?$CJ?5?9?5Caller?5passed?5invali@
0x4B2969D0: "SXS: Activation context data at " ??_C@_0ED@OGHCNIJK@SXS?3?5Activation?5context?5data?5at?5@
0x4B381560: "__stdcall TppWorkUnposted" _TppWorkUnposted@8
0x4B2D4642: "__stdcall RtlpWow64ThunkEnvironment64To32" _RtlpWow64ThunkEnvironment64To32@0
0x4B281C90: "`RtlpGetLocaleDataKey'::`2'::KeyPath" ?KeyPath@?1??RtlpGetLocaleDataKey@@9@9
0x4B2EB36C: "__stdcall LdrpCheckPolicy" _LdrpCheckPolicy@4
0x4B381D53: "__stdcall TppETWPoolThreadMin" _TppETWPoolThreadMin@8
0x4B286870: "__cdecl __lconv_static_decimal" ___lconv_static_decimal
0x4B39F638: "__cdecl RtlSecureMemorySystemRangeStart" _RtlSecureMemorySystemRangeStart
0x4B2F3B10: "__cdecl __iscsymf" ___iscsymf
0x4B3395F0: "__stdcall WinSqmSetEscalationInfo" _WinSqmSetEscalationInfo@16
0x4B2FCB50: "__cdecl _itoa_s" __itoa_s
0x4B284CA0: "__cdecl RtlpAppPackageAuthority" _RtlpAppPackageAuthority
0x4B2D89DA: "__stdcall EtwpUpdateEnableInfoAndCallback" _EtwpUpdateEnableInfoAndCallback@8
0x4B2F1340: "__stdcall ZwGetCachedSigningLevel" _ZwGetCachedSigningLevel@24
0x4B3620CC: "__stdcall Normalization__GetSecondDecomposedCharPlane0" _Normalization__GetSecondDecomposedCharPlane0@8
0x4B2F92D5: "__cdecl _NLG_Notify" __NLG_Notify
0x4B2A5E2C: "services.exe" ??_C@_1BK@ILFKGFOJ@?$AAs?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAs?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x4B3414D0: "__stdcall RtlCustomCPToUnicodeN" _RtlCustomCPToUnicodeN@24
0x4B2B202A: "__stdcall LdrpLoadContextReplaceModule" _LdrpLoadContextReplaceModule@8
0x4B3773D2: "__stdcall RtlpHpVaMgrCtxAllocatorDereference" _RtlpHpVaMgrCtxAllocatorDereference@8
0x4B2ED927: "__stdcall EtwpSwitchBuffer" _EtwpSwitchBuffer@12
0x4B36AD6D: "__stdcall RtlpHpTaggableHeap" _RtlpHpTaggableHeap@4
0x4B296A60: "SXS: Activation context data at " ??_C@_0EH@NLPJDNNO@SXS?3?5Activation?5context?5data?5at?5@
0x4B343D40: "__stdcall RtlIsUntrustedObject" _RtlIsUntrustedObject@12
0x4B3A14A4: "__cdecl LdrpManifestProberRoutine" _LdrpManifestProberRoutine
0x4B2F1210: "__stdcall NtEnableLastKnownGood" _NtEnableLastKnownGood@0
0x4B37780E: "__stdcall RtlpHpVaMgrRangeCleanup" _RtlpHpVaMgrRangeCleanup@8
0x4B298440: "SXS: %s() bad parameters SXS: F" ??_C@_0OP@PLNCBDHB@SXS?3?5?$CFs?$CI?$CJ?5bad?5parameters?6SXS?3?5?5F@
0x4B2F12D0: "__stdcall NtFlushKey" _NtFlushKey@4
0x4B2F1480: "__stdcall ZwListenPort" _ZwListenPort@8
0x4B2E48FF: "__stdcall RtlpInitializeActivationContextStackFrameList" _RtlpInitializeActivationContextStackFrameList@4
0x4B2F92F6: "__cdecl _NLG_Return2" __NLG_Return2
0x4B2E3AF4: "__stdcall RtlpWnfWalkUserSubscriptionList" _RtlpWnfWalkUserSubscriptionList@12
0x4B2F3B70: "__cdecl isalnum" _isalnum
0x4B382DA5: "__stdcall RtlpTpETWCallbackStop" _RtlpTpETWCallbackStop@20
0x4B368801: "__stdcall RtlpHpStackTraceConfig" _RtlpHpStackTraceConfig@4
0x4B33D640: "__stdcall RtlOpenImageFileOptionsKey" _RtlOpenImageFileOptionsKey@12
0x4B281234: "__cdecl LdrpMscoreeDllName" _LdrpMscoreeDllName
0x4B295C10: "\Software\Microsoft\Windows NT\C" ??_C@_1JI@IDAENJPE@?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC@
0x4B2F92CC: "__cdecl _NLG_Notify1" __NLG_Notify1
0x4B2F1CD0: "__stdcall ZwSetCachedSigningLevel2" _ZwSetCachedSigningLevel2@24
0x4B33B6F7: "__stdcall RtlpQueryRunLevel" _RtlpQueryRunLevel@12
0x4B2985A0: "SXS: Assembly storage resolution" ??_C@_0FN@EKCFLCEM@SXS?3?5Assembly?5storage?5resolution@
0x4B344690: "__stdcall RtlSidHashInitialize" _RtlSidHashInitialize@12
0x4B385AC9: "__stdcall PsspWalkInfoClass_PSS_WALK_HANDLES" _PsspWalkInfoClass_PSS_WALK_HANDLES@12
0x4B2F04C0: "__stdcall ZwWaitForSingleObject" _ZwWaitForSingleObject@12
0x4B339A8B: "__stdcall RtlpWnfCalculateAndSetNextTimer" _RtlpWnfCalculateAndSetNextTimer@0
0x4B298B3C: "LdrpResMapFile Enter" ??_C@_1CK@NNOGONOF@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAM?$AAa?$AAp?$AAF?$AAi?$AAl?$AAe?$AA?5?$AAE?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x4B342970: "__stdcall PfxInsertPrefix" _PfxInsertPrefix@12
0x4B2F08A0: "__stdcall NtOpenEvent" _NtOpenEvent@12
0x4B3A09E0: "__cdecl FastPebLock" _FastPebLock
0x4B2D0DB7: "__stdcall LdrpReleaseLoaderLock" _LdrpReleaseLoaderLock@16
0x4B353670: "__stdcall RtlCmEncodeMemIoResource" _RtlCmEncodeMemIoResource@24
0x4B2B36C2: "__stdcall LdrpIsSecurityEtwLoggingEnabled" _LdrpIsSecurityEtwLoggingEnabled@0
0x4B2EF9B0: "__stdcall LdrpLogCFGModuleInfoTelemetry" _LdrpLogCFGModuleInfoTelemetry@8
0x4B2F0E50: "__stdcall ZwCompareTokens" _ZwCompareTokens@12
0x4B357E10: "__stdcall RtlEndStrongEnumerationHashTable" _RtlEndStrongEnumerationHashTable@8
0x4B2D0280: "__stdcall TpPostWork" _TpPostWork@4
0x4B294974: "Calling TLS callback %p for DLL " ??_C@_0CN@LPCLKPOG@Calling?5TLS?5callback?5?$CFp?5for?5DLL?5@
0x4B2F59F0: "__cdecl _wcsupr" __wcsupr
0x4B2E1394: "__stdcall RtlpNlsGetLcidIndex" _RtlpNlsGetLcidIndex@4
0x4B2AEC60: "__stdcall RtlCheckTokenMembershipEx" _RtlCheckTokenMembershipEx@16
0x4B2EAC50: "__cdecl EtwTraceMessage" _EtwTraceMessage
0x4B37B540: "__stdcall RtlpHpVsChunkSize" _RtlpHpVsChunkSize@16
0x4B3051C0: FinalExceptionHandlerPad16
0x4B28C32C: "SHAREDUSERCERTIFICATES" ??_C@_1CO@MBAJCLOO@?$AAS?$AAH?$AAA?$AAR?$AAE?$AAD?$AAU?$AAS?$AAE?$AAR?$AAC?$AAE?$AAR?$AAT?$AAI?$AAF?$AAI?$AAC?$AAA?$AAT?$AAE?$AAS?$AA?$AA@
0x4B287A38: "Allows getting the 6.3 version o" ??_C@_1IC@FCEANDLG@?$AAA?$AAl?$AAl?$AAo?$AAw?$AAs?$AA?5?$AAg?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AA6?$AA?4?$AA3?$AA?5?$AAv?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAo@
0x4B342CE0: "__stdcall RtlAddActionToRXact" _RtlAddActionToRXact@24
0x4B3051CA: FinalExceptionHandlerPad26
0x4B2F2A20: "__stdcall KiFastSystemCallRet" _KiFastSystemCallRet@0
0x4B3051D4: FinalExceptionHandlerPad36
0x4B2AE910: "__stdcall RtlpLoadUserUIByPolicy" _RtlpLoadUserUIByPolicy@12
0x4B3051DE: FinalExceptionHandlerPad46
0x4B2A7B72: "__stdcall CentennialIssueTracker_EnsureRegistration" _CentennialIssueTracker_EnsureRegistration@0
0x4B3051E8: FinalExceptionHandlerPad56
0x4B354120: "__stdcall RtlMultipleAllocateHeap" _RtlMultipleAllocateHeap@20
0x4B2F0DB0: "__stdcall NtCancelSynchronousIoFile" _NtCancelSynchronousIoFile@12
0x4B2F0F80: "__stdcall ZwCreateMutant" _ZwCreateMutant@16
0x4B2F1960: "__stdcall NtQueryLicenseValue" _NtQueryLicenseValue@20
0x4B2F08C0: "__stdcall NtDuplicateToken" _NtDuplicateToken@24
0x4B2AB830: "__stdcall RtlpTpTimerFinalizationCallback" _RtlpTpTimerFinalizationCallback@8
0x4B2F1060: "__stdcall NtCreateThreadEx" _NtCreateThreadEx@44
0x4B3750EE: "__stdcall RtlpHpLfhOwnerInitialize" _RtlpHpLfhOwnerInitialize@16
0x4B3A1B40: "__cdecl RtlpHpHeapManager" _RtlpHpHeapManager
0x4B2F1A00: "__stdcall ZwQuerySemaphore" _ZwQuerySemaphore@20
0x4B3463E9: "__stdcall RtlpIsAppContainer" _RtlpIsAppContainer@8
0x4B32F11B: "__stdcall LdrpDoDebuggerBreak" _LdrpDoDebuggerBreak@0
0x4B363C93: "__stdcall RtlpInitializeStackTraceDatabase" _RtlpInitializeStackTraceDatabase@12
0x4B304BFC: "__stdcall _RtlEnlargedUnsignedDivide" __RtlEnlargedUnsignedDivide@16
0x4B2F18F0: "__stdcall ZwQueryInformationResourceManager" _ZwQueryInformationResourceManager@20
0x4B281118: "__cdecl TppWorkpCleanupGroupMemberVFuncs" _TppWorkpCleanupGroupMemberVFuncs
0x4B355E76: "__stdcall RtlpQueryExtendedInformationAllHeaps" _RtlpQueryExtendedInformationAllHeaps@4
0x4B2F1030: "__stdcall NtCreateSectionEx" _NtCreateSectionEx@36
0x4B2F0E10: "__stdcall NtCommitTransaction" _NtCommitTransaction@8
0x4B2DB7A4: "__stdcall RtlTryEndReadTickLock" _RtlTryEndReadTickLock@12
0x4B2850B0: "LdrpResSearchResourceMappedFile " ??_C@_1EK@PHNFFPI@?$AAL?$AAd?$AAr?$AAp?$AAR?$AAe?$AAs?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAM?$AAa?$AAp?$AAp?$AAe?$AAd?$AAF?$AAi?$AAl?$AAe?$AA?5@
0x4B2F07F0: "__stdcall ZwQueryDirectoryFile" _ZwQueryDirectoryFile@44
0x4B2DAC2D: "__stdcall LdrpRemoveDataTableEntry" _LdrpRemoveDataTableEntry@4
0x4B2A9976: "__stdcall RtlAddSIDToBoundaryDescriptorEx" _RtlAddSIDToBoundaryDescriptorEx@12
0x4B292594: "TargetNtPath" ??_C@_1BK@CIGKBGGO@?$AAT?$AAa?$AAr?$AAg?$AAe?$AAt?$AAN?$AAt?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x4B2EA4E0: "__stdcall RtlDetectHeapLeaks" _RtlDetectHeapLeaks@0
0x4B342580: "__stdcall RtlSystemTimeToLocalTime" _RtlSystemTimeToLocalTime@8
0x4B2F1020: "__stdcall ZwCreateResourceManager" _ZwCreateResourceManager@28
0x4B2D1410: "__stdcall RtlDetermineDosPathNameType_U" _RtlDetermineDosPathNameType_U@4
0x4B294500: "Unable to load DLL: "%wZ", Paren" ??_C@_0DP@NKFMMBCI@Unable?5to?5load?5DLL?3?5?$CC?$CFwZ?$CC?0?5Paren@
0x4B299380: "\SysARM32\" ??_C@_1BG@MIEGEDAI@?$AA?2?$AAS?$AAy?$AAs?$AAA?$AAR?$AAM?$AA3?$AA2?$AA?2?$AA?$AA@
0x4B2F1D10: "__stdcall NtSetDefaultLocale" _NtSetDefaultLocale@8
0x4B2F17E0: "__stdcall NtPropagationComplete" _NtPropagationComplete@16
0x4B39FE8C: "__cdecl RtlpExeSearchPath" _RtlpExeSearchPath
0x4B3642D0: "__stdcall RtlQueryValidationRunlevel" _RtlQueryValidationRunlevel@4

[JEB Decompiler by PNF Software]