Generated by JEB on 2019/08/01

PE: C:\Windows\System32\wtsapi32.dll Base=0x130000000 SHA-256=BA81055B56E5DA344BB8798F9D497064C541DD1043AFDCA49F4B7ECF8D57FBD1
PDB: wtsapi32.pdb GUID={CCF42567-326B-35A9-415CDBAFBBE00DC9} Age=1

451 located named symbols:
0x13000A318: "__cdecl _imp_RtlUnicodeToMultiByteSize" __imp_RtlUnicodeToMultiByteSize
0x130010158: "__cdecl _imp_WinStationFreeEXECENVDATAEX" __imp_WinStationFreeEXECENVDATAEX
0x13000A630: "%hu.%hu.%hu.%hu" ??_C@_1CA@EEKMHEGJ@?$AA?$CF?$AAh?$AAu?$AA?4?$AA?$CF?$AAh?$AAu?$AA?4?$AA?$CF?$AAh?$AAu?$AA?4?$AA?$CF?$AAh?$AAu?$AA?$AA@
0x130002C1C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x13000A170: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x130006C88: VirtualChannelIoctl
0x130004C30: WTSOpenServerW
0x130002A20: "__cdecl FindPESection" _FindPESection
0x130007438: StringCchCatW
0x1300020B0: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x13000CA9C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x130003290: "__cdecl _imp_load_WinStationWaitSystemEvent" __imp_load_WinStationWaitSystemEvent
0x1300033E6: "__cdecl _imp_load_WinStationGetAllSessionsEx" __imp_load_WinStationGetAllSessionsEx
0x13000327E: "__cdecl _imp_load_WinStationIsChildSessionsEnabled" __imp_load_WinStationIsChildSessionsEnabled
0x1300033D4: "__cdecl _imp_load_WTSUnRegisterSessionNotificationEx" __imp_load_WTSUnRegisterSessionNotificationEx
0x130003464: "__cdecl _imp_load_WinStationFreeGAPMemory" __imp_load_WinStationFreeGAPMemory
0x130007080: CollectUserInfoForSet
0x13000E010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1300044B0: WTSStartRemoteControlSessionA
0x130006D50: WTSVirtualChannelPurgeOutput
0x1300045A0: WTSStartRemoteControlSessionW
0x1300024FC: "__cdecl CRT_INIT" _CRT_INIT
0x130006D30: WTSVirtualChannelPurgeInput
0x13000A1E0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x130002F25: "__cdecl _imp_load_RegWinStationQueryExtendedSettingsW" __imp_load_RegWinStationQueryExtendedSettingsW
0x130010058: "__cdecl _imp_RegPdQueryW" __imp_RegPdQueryW
0x1300100C0: "__cdecl _imp_WinStationFreeMemory" __imp_WinStationFreeMemory
0x13000A550: "__cdecl _sz_ext_ms_win_ntuser_window_l1_1_0_dll" __sz_ext_ms_win_ntuser_window_l1_1_0_dll
0x130003600: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x130002ECB: "__cdecl _imp_load_RegWinStationQueryW" __imp_load_RegWinStationQueryW
0x130002EDD: "__cdecl _imp_load_RegWinStationQueryExNew" __imp_load_RegWinStationQueryExNew
0x13000B614: "__cdecl _DELAY_IMPORT_DESCRIPTOR_browcli_dll" __DELAY_IMPORT_DESCRIPTOR_browcli_dll
0x1300100F0: "__cdecl _imp_WinStationIsChildSessionsEnabled" __imp_WinStationIsChildSessionsEnabled
0x13000A650: "%2hX" ??_C@_19JIPHKBGH@?$AA?$CF?$AA2?$AAh?$AAX?$AA?$AA@
0x13000A880: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x13000308F: "__cdecl _tailMerge_samcli_dll" __tailMerge_samcli_dll
0x13000C9E8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x130005700: WTSEnumerateSessionsA
0x13000A1B8: "__cdecl _imp_CancelIo" __imp_CancelIo
0x130001E20: WTSEnumerateSessionsW
0x13000A1A0: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x1300032B4: "__cdecl _imp_load_WinStationQueryInformationW" __imp_load_WinStationQueryInformationW
0x130010198: "__cdecl _imp_PrivilegeCheck" __imp_PrivilegeCheck
0x13000325A: "__cdecl _imp_load_WinStationConnectW" __imp_load_WinStationConnectW
0x1300033C2: "__cdecl _imp_load_WinStationReset" __imp_load_WinStationReset
0x130005440: ConvertSessionInfoToAnsi
0x1300031DB: "__cdecl _tailMerge_winsta_dll" __tailMerge_winsta_dll
0x13000A350: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x130001800: CollectSessionInfo
0x130005E50: "__cdecl AllocateAndCopyAnsiString" _AllocateAndCopyAnsiString
0x1300048F0: WTSCloseServer
0x130010018: "__cdecl _imp_RegDefaultUserConfigQueryW" __imp_RegDefaultUserConfigQueryW
0x1300101A8: "__cdecl _imp_GetSecurityDescriptorControl" __imp_GetSecurityDescriptorControl
0x130002A04: "__cdecl XcptFilter" _XcptFilter
0x13000A358: "__cdecl _xc_a" __xc_a
0x13000559C: StringCbCopyW
0x130010040: "__cdecl _imp_RegWinStationQueryExNew" __imp_RegWinStationQueryExNew
0x130005EF8: "__cdecl CopyStringA" _CopyStringA
0x130002F37: "__cdecl _imp_load_RegWinStationSetExtendedSettingsW" __imp_load_RegWinStationSetExtendedSettingsW
0x130006EE0: CollectUserInfoForQuery
0x130001930: StringCchCopyW
0x130010088: "__cdecl _imp_WinStationGetAllProcesses" __imp_WinStationGetAllProcesses
0x1300042F0: WTSConnectSessionW
0x130010100: "__cdecl _imp_WinStationShutdownSystem" __imp_WinStationShutdownSystem
0x1300021B0: CollectSessionInfoEx
0x13000A4E4: "__cdecl _guard_iat_table" __guard_iat_table
0x1300035D6: memcpy
0x13000A600: WTSStateMapping
0x13000A2F8: "__cdecl _imp_memset" __imp_memset
0x130002BEC: "__cdecl initterm" _initterm
0x13000A338: "__cdecl _imp_NtWaitForSingleObject" __imp_NtWaitForSingleObject
0x13000A530: "__cdecl _sz_netutils_dll" __sz_netutils_dll
0x130001FF0: WTSFreeMemoryExW
0x13000CA74: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x13000E5F8: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x13000A1A8: "__cdecl _imp_GetOverlappedResult" __imp_GetOverlappedResult
0x130003452: "__cdecl _imp_load_WinStationIsSessionRemoteable" __imp_load_WinStationIsSessionRemoteable
0x13000A280: "__cdecl _imp_Sleep" __imp_Sleep
0x1300076F0: WTSQueryUserConfigW
0x130010178: "__cdecl _imp_WinStationDisconnect" __imp_WinStationDisconnect
0x13000A378: "__cdecl _xi_z" __xi_z
0x1300100F8: "__cdecl _imp_WinStationWaitSystemEvent" __imp_WinStationWaitSystemEvent
0x130007510: WTSQueryUserConfigA
0x13000A150: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x130010030: "__cdecl _imp_RegWinstationQuerySecurityConfig_Machine" __imp_RegWinstationQuerySecurityConfig_Machine
0x130002BF8: "__cdecl _C_specific_handler" __C_specific_handler
0x130003083: "__cdecl _imp_load_NetUserGetInfo" __imp_load_NetUserGetInfo
0x1300101F0: netutils_NULL_THUNK_DATA_DLA
0x13000BF08: netutils_NULL_THUNK_DATA_DLB
0x13000B848: netutils_NULL_THUNK_DATA_DLN
0x13000341C: "__cdecl _imp_load_WinStationSendMessageW" __imp_load_WinStationSendMessageW
0x13000A65C: "\\" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x130003440: "__cdecl _imp_load_WinStationSendMessageA" __imp_load_WinStationSendMessageA
0x130006500: WTSEnumerateProcessesExA
0x13000A180: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x130010068: "__cdecl _imp_RegWinStationEnumerateW" __imp_RegWinStationEnumerateW
0x13000A218: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x130003570: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1300100E0: "__cdecl _imp_WinStationConnectW" __imp_WinStationConnectW
0x1300043F0: WTSShutdownSystem
0x130010170: "__cdecl _imp_WTSRegisterSessionNotificationEx" __imp_WTSRegisterSessionNotificationEx
0x130008180: ConvertListenerConfigFromAnsiToUnicode
0x1300101B8: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA_DLA
0x130004320: WTSEnableChildSessions
0x13000A268: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x13000B7E8: WINSTA_NULL_THUNK_DATA_DLN
0x13000BF40: ext-ms-win-ntuser-window-l1-1-0_NULL_THUNK_DATA_DLB
0x130010190: WINSTA_NULL_THUNK_DATA_DLA
0x13000BF58: WINSTA_NULL_THUNK_DATA_DLB
0x13000A220: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x130002A10: "__cdecl amsg_exit" _amsg_exit
0x13000A580: "__cdecl _sz_WINSTA_dll" __sz_WINSTA_dll
0x13000A878: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x13000B574: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_base_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_base_l1_1_0_dll
0x130002EB9: "__cdecl _imp_load_RegWinstationQuerySecurityConfig_Machine" __imp_load_RegWinstationQuerySecurityConfig_Machine
0x1300016E0: "__cdecl CopyStringW" _CopyStringW
0x13000B820: browcli_NULL_THUNK_DATA_DLN
0x130004200: WTSConnectSessionA
0x130006D70: WTSVirtualChannelRead
0x13000A260: "__cdecl _imp_WideCharToMultiByte" __imp_WideCharToMultiByte
0x130010120: "__cdecl _imp_WinStationSetRenderHint" __imp_WinStationSetRenderHint
0x1300101F8: "__cdecl _imp_NetUserGetInfo" __imp_NetUserGetInfo
0x13000E5D0: "__cdecl _hmod__browcli_dll" __hmod__browcli_dll
0x13000A238: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x130002F67: "__cdecl _tailMerge_api_ms_win_security_base_l1_1_0_dll" __tailMerge_api_ms_win_security_base_l1_1_0_dll
0x1300101A0: "__cdecl _imp_GetSecurityDescriptorLength" __imp_GetSecurityDescriptorLength
0x13000A158: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x130004340: WTSFreeMemoryExA
0x13000A2E0: "__cdecl _imp__wcsupr" __imp__wcsupr
0x130005580: QueryActiveSession
0x1300043A0: WTSIsChildSessionsEnabled
0x13000A1F0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x130010150: "__cdecl _imp_WinStationEnumerateW" __imp_WinStationEnumerateW
0x13000E5C0: "__cdecl _hmod__ext_ms_win_ntuser_window_l1_1_0_dll" __hmod__ext_ms_win_ntuser_window_l1_1_0_dll
0x13000E5E8: "__cdecl _native_startup_lock" __native_startup_lock
0x130003120: "__cdecl _imp_load_GetSecurityDescriptorControl" __imp_load_GetSecurityDescriptorControl
0x130010008: "__cdecl _imp_RegWinStationSetExtendedSettingsW" __imp_RegWinStationSetExtendedSettingsW
0x130002BE0: DllMain
0x13000C9D4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x1300020F0: WTSRegisterSessionNotification
0x13000A2C0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1300065B0: WTSEnumerateProcessesExW
0x13000A248: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x13000A790: "PdDLL" ??_C@_1M@GENCCGBD@?$AAP?$AAd?$AAD?$AAL?$AAL?$AA?$AA@
0x13000339E: "__cdecl _imp_load_WTSRegisterSessionNotificationEx" __imp_load_WTSRegisterSessionNotificationEx
0x130002BE0: WTSSetSessionInformationW
0x130002BE0: WTSSetSessionInformationA
0x13000A140: "__cdecl _imp_GetLastError" __imp_GetLastError
0x13000E000: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x13000354C: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x130004C00: WTSOpenServerA
0x1300098A4: SetNumValue
0x13000A330: "__cdecl _imp_NtDeviceIoControlFile" __imp_NtDeviceIoControlFile
0x13000A328: "__cdecl _imp_RtlAdjustPrivilege" __imp_RtlAdjustPrivilege
0x1300097FC: GetNumValue
0x130003368: "__cdecl _imp_load_WinStationFreeEXECENVDATAEX" __imp_load_WinStationFreeEXECENVDATAEX
0x13000CAC4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x13000A1D0: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x13000A700: "System\CurrentControlSet\Control" ??_C@_1JA@ONLAJIJJ@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x13000A270: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x130010048: "__cdecl _imp_RegWinStationSetSecurityW" __imp_RegWinStationSetSecurityW
0x13000A808: "PdFlag1" ??_C@_1BA@BLMOIKBB@?$AAP?$AAd?$AAF?$AAl?$AAa?$AAg?$AA1?$AA?$AA@
0x130001780: "__cdecl CopyData" _CopyData
0x130003476: "__cdecl _imp_load_WinStationTerminateProcess" __imp_load_WinStationTerminateProcess
0x13000A878: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x130002AD0: "__cdecl ValidateImageBase" _ValidateImageBase
0x13000A7A0: "PdName" ??_C@_1O@GLLJGFB@?$AAP?$AAd?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x130010038: "__cdecl _imp_RegWinStationQueryW" __imp_RegWinStationQueryW
0x130002EEF: "__cdecl _imp_load_RegWinStationSetSecurityW" __imp_load_RegWinStationSetSecurityW
0x1300100D0: "__cdecl _imp_WinStationShadow" __imp_WinStationShadow
0x130002DF2: "__cdecl _tailMerge_regapi_dll" __tailMerge_regapi_dll
0x130007318: ConvertUserInfoFromUnicodeToAnsi
0x13000A320: "__cdecl _imp_RtlUnicodeToMultiByteN" __imp_RtlUnicodeToMultiByteN
0x13000BEF8: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA_DLB
0x13000A7C0: "PdFlag" ??_C@_1O@FDKCMLIE@?$AAP?$AAd?$AAF?$AAl?$AAa?$AAg?$AA?$AA@
0x13000B634: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x130002740: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x13000A2B0: "__cdecl _imp__initterm" __imp__initterm
0x130002E71: "__cdecl _imp_load_RegUserConfigQuery" __imp_load_RegUserConfigQuery
0x1300101E0: ext-ms-win-ntuser-window-l1-1-0_NULL_THUNK_DATA_DLA
0x130010000: "__cdecl _imp_RegUserConfigSet" __imp_RegUserConfigSet
0x130010010: "__cdecl _imp_RegUserConfigQuery" __imp_RegUserConfigQuery
0x13000A148: "__cdecl _imp_SetLastError" __imp_SetLastError
0x130002E95: "__cdecl _imp_load_RegWinStationCreateW" __imp_load_RegWinStationCreateW
0x13000604C: ConvertProcessInfoFromUnicodeToAnsi
0x13000CAB0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x13000E5B0: "__cdecl _hmod__netutils_dll" __hmod__netutils_dll
0x130001010: WTSQueryUserToken
0x13000CA38: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x13000A840: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x13000E5D8: "__cdecl _onexitend" __onexitend
0x1300032A2: "__cdecl _imp_load_WinStationShutdownSystem" __imp_load_WinStationShutdownSystem
0x130010028: "__cdecl _imp_RegWdQueryW" __imp_RegWdQueryW
0x13000A348: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x130010060: "__cdecl _imp_RegWinStationQueryExtendedSettingsW" __imp_RegWinStationQueryExtendedSettingsW
0x13000A1F8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x130002FF2: "__cdecl _tailMerge_netutils_dll" __tailMerge_netutils_dll
0x1300031CF: "__cdecl _imp_load_WinStationShadow" __imp_load_WinStationShadow
0x13000A2E8: "__cdecl _imp_swscanf" __imp_swscanf
0x1300071F8: ConvertUserInfoFromAnsiToUnicode
0x13000A308: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x13000A680: "System\CurrentControlSet\Control" ??_C@_1HK@IFIPFLBK@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x130010148: "__cdecl _imp_WinStationOpenServerW" __imp_WinStationOpenServerW
0x13000B838: ext-ms-win-ntuser-window-l1-1-0_NULL_THUNK_DATA_DLN
0x130010080: "__cdecl _imp_WinStationEnumerateProcesses" __imp_WinStationEnumerateProcesses
0x13000A2A0: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x13000A368: "__cdecl _xi_a" __xi_a
0x13000342E: "__cdecl _imp_load_WinStationRegisterConsoleNotification" __imp_load_WinStationRegisterConsoleNotification
0x130010128: "__cdecl _imp_WinStationOpenServerA" __imp_WinStationOpenServerA
0x1300043E0: WTSSetRenderHint
0x13000A290: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x130004C10: WTSOpenServerExA
0x13000A128: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x130004900: WTSEnumerateServersA
0x130002F5B: "__cdecl _imp_load_PrivilegeCheck" __imp_load_PrivilegeCheck
0x13000C078: browcli_NULL_THUNK_DATA_DLB
0x1300032D8: "__cdecl _imp_load_WinStationGetChildSessionId" __imp_load_WinStationGetChildSessionId
0x13000A1C0: api-ms-win-core-io-l1-1-1_NULL_THUNK_DATA
0x1300101E8: "__cdecl _imp_NetApiBufferFree" __imp_NetApiBufferFree
0x130003320: "__cdecl _imp_load_WinStationOpenServerExW" __imp_load_WinStationOpenServerExW
0x130010138: "__cdecl _imp_WinStationOpenServerExW" __imp_WinStationOpenServerExW
0x1300023C0: WTSVirtualChannelQuery
0x1300100E8: "__cdecl _imp_WinStationShadowStop" __imp_WinStationShadowStop
0x130010130: "__cdecl _imp_WinStationOpenServerExA" __imp_WinStationOpenServerExA
0x130005B50: WTSLogoffSession
0x13000C998: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x130010108: "__cdecl _imp_WinStationQueryInformationW" __imp_WinStationQueryInformationW
0x130003488: "__cdecl _imp_load_WinStationGetAllProcesses" __imp_load_WinStationGetAllProcesses
0x13000E600: "__cdecl pRawDllMain" _pRawDllMain
0x130008580: WTSCreateListenerW
0x130004730: EnumerateMultiUserServers
0x130002F49: "__cdecl _imp_load_RegWinStationEnumerateW" __imp_load_RegWinStationEnumerateW
0x130009320: WTSQueryListenerConfigW
0x1300034BE: "__cdecl _imp_load_NetServerEnum" __imp_load_NetServerEnum
0x130005580: RegisterUsertokenForNoWinlogon
0x130009210: WTSQueryListenerConfigA
0x13000B594: "__cdecl _DELAY_IMPORT_DESCRIPTOR_netutils_dll" __DELAY_IMPORT_DESCRIPTOR_netutils_dll
0x1300029E0: "__cdecl _security_check_cookie" __security_check_cookie
0x13000B5F4: "__cdecl _DELAY_IMPORT_DESCRIPTOR_WINSTA_dll" __DELAY_IMPORT_DESCRIPTOR_WINSTA_dll
0x13000A360: "__cdecl _xc_z" __xc_z
0x13000338C: "__cdecl _imp_load_WinStationGetDeviceId" __imp_load_WinStationGetDeviceId
0x13000C9AC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x13000A200: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x130008F30: WTSGetListenerSecurityA
0x1300024B0: IsInteractiveUserSession
0x130009000: WTSGetListenerSecurityW
0x130002FE6: "__cdecl _imp_load_NetApiBufferFree" __imp_load_NetApiBufferFree
0x1300101D0: "__cdecl _imp_IsWindow" __imp_IsWindow
0x13000A1B0: api-ms-win-core-io-l1-1-0_NULL_THUNK_DATA
0x1300031BD: "__cdecl _imp_load_GetWindowThreadProcessId" __imp_load_GetWindowThreadProcessId
0x13000A298: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1300051B8: ConvertConfigInfoToAnsi
0x130006C70: WTSTerminateProcess
0x1300100B8: "__cdecl _imp_WinStationSendMessageW" __imp_WinStationSendMessageW
0x13000E5A0: "__cdecl _hmod__REGAPI_dll" __hmod__REGAPI_dll
0x130004FBC: ConvertClientInfoToAnsi
0x130007D10: WTSSetUserConfigW
0x1300052DC: ConvertSessionInfoExToAnsi
0x13000A198: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x13000A118: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x130007B50: WTSSetUserConfigA
0x130010050: "__cdecl _imp_RegWinstationSetSecurityConfig" __imp_RegWinstationSetSecurityConfig
0x130003620: "__cdecl _chkstk" __chkstk
0x1300056E0: WTSDisconnectSession
0x130005970: WTSEnumerateSessionsExA
0x13000A500: "__cdecl _sz_api_ms_win_security_base_l1_1_0_dll" __sz_api_ms_win_security_base_l1_1_0_dll
0x130005D30: WTSRegisterSessionNotificationExStub
0x1300033B0: "__cdecl _imp_load_WinStationDisconnect" __imp_load_WinStationDisconnect
0x1300019B0: WTSEnumerateSessionsExW
0x13000313E: "__cdecl _tailMerge_ext_ms_win_ntuser_window_l1_1_0_dll" __tailMerge_ext_ms_win_ntuser_window_l1_1_0_dll
0x1300101C0: "__cdecl _imp_NetServerEnum" __imp_NetServerEnum
0x130002160: WTSUnRegisterSessionNotification
0x13000A258: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x130002EA7: "__cdecl _imp_load_RegWdQueryW" __imp_load_RegWdQueryW
0x13000A668: "rdpwd" ??_C@_1M@JKGEEOEM@?$AAr?$AAd?$AAp?$AAw?$AAd?$AA?$AA@
0x130002320: WTSVirtualChannelOpenEx
0x13000E5A8: "__cdecl _hmod__api_ms_win_security_base_l1_1_0_dll" __hmod__api_ms_win_security_base_l1_1_0_dll
0x130003071: "__cdecl _imp_load_GetLengthSid" __imp_load_GetLengthSid
0x1300034CA: "__cdecl _tailMerge_browcli_dll" __tailMerge_browcli_dll
0x130001FE0: WTSFreeMemory
0x13000CA88: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x13000A210: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x13000A380: "__cdecl _guard_fids_table" __guard_fids_table
0x13000A300: msvcrt_NULL_THUNK_DATA
0x13000A010: "__cdecl load_config_used" _load_config_used
0x130002F13: "__cdecl _imp_load_RegPdQueryW" __imp_load_RegPdQueryW
0x130010098: "__cdecl _imp_WinStationFreeGAPMemory" __imp_WinStationFreeGAPMemory
0x13000B5D4: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_ntuser_window_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_ntuser_window_l1_1_0_dll
0x1300098E4: SetStringValue
0x13000A130: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x130008CA0: WTSEnumerateListenersA
0x13000A120: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x1300101D8: "__cdecl _imp_GetWindowThreadProcessId" __imp_GetWindowThreadProcessId
0x1300100C8: "__cdecl _imp_WinStationQuerySessionVirtualIP" __imp_WinStationQuerySessionVirtualIP
0x13000B5B4: "__cdecl _DELAY_IMPORT_DESCRIPTOR_samcli_dll" __DELAY_IMPORT_DESCRIPTOR_samcli_dll
0x130009844: GetStringValue
0x13000CA24: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0
0x13000C9FC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-1
0x1300100A0: "__cdecl _imp_WinStationIsSessionRemoteable" __imp_WinStationIsSessionRemoteable
0x130010168: "__cdecl _imp_WinStationGetDeviceId" __imp_WinStationGetDeviceId
0x13000B810: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA_DLN
0x13000A2D0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x130008304: ConvertListenerConfigFromUnicodeToAnsi
0x130002338: "__cdecl WTSVirtualChannelOpen" _WTSVirtualChannelOpen
0x13000349A: "__cdecl _imp_load_WinStationEnumerateProcesses" __imp_load_WinStationEnumerateProcesses
0x13000A858: "DefaultSecurity" ??_C@_1CA@IHKJPGJE@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1300032C6: "__cdecl _imp_load_WinStationEnableChildSessions" __imp_load_WinStationEnableChildSessions
0x13000B858: samcli_NULL_THUNK_DATA_DLN
0x13000BF20: samcli_NULL_THUNK_DATA_DLB
0x130010200: samcli_NULL_THUNK_DATA_DLA
0x13000A250: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x13000A208: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x13000A540: "__cdecl _sz_samcli_dll" __sz_samcli_dll
0x13000A310: "__cdecl _imp_RtlMultiByteToUnicodeN" __imp_RtlMultiByteToUnicodeN
0x130006930: WTSEnumerateProcessesW
0x1300100B0: "__cdecl _imp_WinStationRegisterConsoleNotification" __imp_WinStationRegisterConsoleNotification
0x1300101C8: browcli_NULL_THUNK_DATA_DLA
0x13000A240: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x13000310E: "__cdecl _imp_load_GetSecurityDescriptorLength" __imp_load_GetSecurityDescriptorLength
0x13000A880: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x130002C10: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x13000A188: "__cdecl _imp_LocalReAlloc" __imp_LocalReAlloc
0x1300032FC: "__cdecl _imp_load_WinStationOpenServerA" __imp_load_WinStationOpenServerA
0x13000C9C0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x13000A2D8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x13000A340: ntdll_NULL_THUNK_DATA
0x13000A2B8: "__cdecl _imp_memcpy" __imp_memcpy
0x130008DD0: WTSEnumerateListenersW
0x1300056A0: ValidateCopyUnicodeToUnicode
0x130010020: "__cdecl _imp_RegWinStationCreateW" __imp_RegWinStationCreateW
0x13000B6C8: REGAPI_NULL_THUNK_DATA_DLN
0x13000BE80: REGAPI_NULL_THUNK_DATA_DLB
0x130010070: REGAPI_NULL_THUNK_DATA_DLA
0x13000CA10: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x13000A678: "tcp" ??_C@_17FHJIGCJE@?$AAt?$AAc?$AAp?$AA?$AA@
0x130010078: "__cdecl _imp_WinStationVirtualOpenEx" __imp_WinStationVirtualOpenEx
0x13000E008: "__cdecl _security_cookie" __security_cookie
0x13000A7E0: "PdName1" ??_C@_1BA@PCFLMDBL@?$AAP?$AAd?$AAN?$AAa?$AAm?$AAe?$AA1?$AA?$AA@
0x130010090: "__cdecl _imp_WinStationTerminateProcess" __imp_WinStationTerminateProcess
0x13000A230: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x13000A4F0: "__cdecl _sz_REGAPI_dll" __sz_REGAPI_dll
0x13000A7B0: "PdClass" ??_C@_1BA@CKDHCNDK@?$AAP?$AAd?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x130003620: "__cdecl alloca_probe" _alloca_probe
0x130010110: "__cdecl _imp_WinStationEnableChildSessions" __imp_WinStationEnableChildSessions
0x130004C40: CollectClientInfo
0x13000A178: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1300032EA: "__cdecl _imp_load_WinStationSetRenderHint" __imp_load_WinStationSetRenderHint
0x13000A190: "__cdecl _imp_LocalFree" __imp_LocalFree
0x130010188: "__cdecl _imp_WTSUnRegisterSessionNotificationEx" __imp_WTSUnRegisterSessionNotificationEx
0x1300101B0: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x130005FB4: "__cdecl FreeExSessionEnumData" _FreeExSessionEnumData
0x13000C984: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x130002F01: "__cdecl _imp_load_RegWinstationSetSecurityConfig" __imp_load_RegWinstationSetSecurityConfig
0x130004E68: CollectConfigInfo
0x1300095C0: WTSSetListenerSecurityA
0x13000E5E0: "__cdecl _onexitbegin" __onexitbegin
0x130009680: WTSSetListenerSecurityW
0x130006290: WTSEnumerateProcessesA
0x130010160: "__cdecl _imp_WinStationUnRegisterConsoleNotification" __imp_WinStationUnRegisterConsoleNotification
0x130002DE6: "__cdecl _imp_load_RegUserConfigSet" __imp_load_RegUserConfigSet
0x13000A138: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x13000A1C8: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x1300033F8: "__cdecl _imp_load_WinStationQuerySessionVirtualIP" __imp_load_WinStationQuerySessionVirtualIP
0x13000A7F0: "PdClass1" ??_C@_1BC@CIOBDHPP@?$AAP?$AAd?$AAC?$AAl?$AAa?$AAs?$AAs?$AA1?$AA?$AA@
0x13000A228: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x130004370: WTSGetChildSessionId
0x130002B04: "__cdecl _security_init_cookie" __security_init_cookie
0x130005628: StringCbLengthW
0x130003344: "__cdecl _imp_load_WinStationOpenServerW" __imp_load_WinStationOpenServerW
0x130002E83: "__cdecl _imp_load_RegDefaultUserConfigQueryW" __imp_load_RegDefaultUserConfigQueryW
0x13000C970: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x13000A590: "__cdecl _sz_browcli_dll" __sz_browcli_dll
0x130005E40: WTSUnRegisterSessionNotificationExStub
0x130010118: "__cdecl _imp_WinStationGetChildSessionId" __imp_WinStationGetChildSessionId
0x130006E50: WTSVirtualChannelWrite
0x130004C20: WTSOpenServerExW
0x13000A2A8: "__cdecl _imp_malloc" __imp_malloc
0x130004A90: WTSEnumerateServersW
0x13000A160: "__cdecl _imp_WriteFile" __imp_WriteFile
0x13000E5C8: "__cdecl _hmod__WINSTA_dll" __hmod__WINSTA_dll
0x130003356: "__cdecl _imp_load_WinStationEnumerateW" __imp_load_WinStationEnumerateW
0x13000330E: "__cdecl _imp_load_WinStationOpenServerExA" __imp_load_WinStationOpenServerExA
0x130002C60: "__cdecl _report_gsfailure" __report_gsfailure
0x13000A818: "fEnableWinStation" ??_C@_1CE@LGMNHIOO@?$AAf?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAW?$AAi?$AAn?$AAS?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1300100D8: "__cdecl _imp_WinStationGetAllSessionsEx" __imp_WinStationGetAllSessionsEx
0x13000E5F0: "__cdecl _native_startup_state" __native_startup_state
0x13000E5B8: "__cdecl _hmod__samcli_dll" __hmod__samcli_dll
0x1300034AC: "__cdecl _imp_load_WinStationVirtualOpenEx" __imp_load_WinStationVirtualOpenEx
0x1300045D0: WTSStopRemoteControlSession
0x130008490: WTSCreateListenerA
0x13000326C: "__cdecl _imp_load_WinStationShadowStop" __imp_load_WinStationShadowStop
0x130002310: WTSVirtualChannelOpen
0x13000337A: "__cdecl _imp_load_WinStationUnRegisterConsoleNotification" __imp_load_WinStationUnRegisterConsoleNotification
0x13000A7D0: "PdDLL1" ??_C@_1O@PLHFDPHJ@?$AAP?$AAd?$AAD?$AAL?$AAL?$AA1?$AA?$AA@
0x130003332: "__cdecl _imp_load_WinStationCloseServer" __imp_load_WinStationCloseServer
0x13000A1D8: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x13000B554: "__cdecl _DELAY_IMPORT_DESCRIPTOR_REGAPI_dll" __DELAY_IMPORT_DESCRIPTOR_REGAPI_dll
0x130003132: "__cdecl _imp_load_IsWindow" __imp_load_IsWindow
0x130010180: "__cdecl _imp_WinStationReset" __imp_WinStationReset
0x130005DC0: WTSSendMessageW
0x130004890: StringCchLengthW
0x130002450: WTSVirtualChannelClose
0x13000CA60: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x130005D40: WTSSendMessageA
0x13000A2C8: "__cdecl _imp_free" __imp_free
0x130002A70: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x13000A288: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x1300100A8: "__cdecl _imp_WinStationSendMessageA" __imp_WinStationSendMessageA
0x13000A2F0: "__cdecl _imp_memcpy_s" __imp_memcpy_s
0x13000A1E8: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x13000A278: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x13000CA4C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x1300045F0: WTSWaitSystemEvent
0x13000340A: "__cdecl _imp_load_WinStationFreeMemory" __imp_load_WinStationFreeMemory
0x1300035E2: memset
0x13000CAD8: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1300011B0: WTSQuerySessionInformationW
0x130010140: "__cdecl _imp_WinStationCloseServer" __imp_WinStationCloseServer
0x13000A168: "__cdecl _imp_ReadFile" __imp_ReadFile
0x130005B70: WTSQuerySessionInformationA

[JEB Decompiler by PNF Software]