Generated by JEB on 2019/08/01

PE: C:\Windows\System32\wow64.dll Base=0x180000000 SHA-256=CFDDAFC19A8C7CB0DF0848479CEA155B35258755AC9FCB7A71370BDA5CF7757E
PDB: wow64.pdb GUID={C4CA127E-2BD8-47D2-C28B94052DEE5902} Age=1

2396 located named symbols:
0x180037A90: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x180020704: Wow64ArchSetIP
0x180037BE0: "__cdecl _imp_NtAlertThreadByThreadId" __imp_NtAlertThreadByThreadId
0x1800148C8: whNtSetInformationFile_FileRenameInformation
0x18003A268: "DebugBreak" ??_C@_0L@BPHFKDHF@DebugBreak?$AA@
0x18000F190: Wow64ApcRoutine
0x180038508: "__cdecl _imp_NtDeleteAtom" __imp_NtDeleteAtom
0x18003B498: "NtQuerySection: Called with unsu" ??_C@_0DD@DBPDCBAN@NtQuerySection?3?5Called?5with?5unsu@
0x18002072C: Wow64ArchSetSP
0x180037FB0: "__cdecl _imp_NtUnsubscribeWnfStateChange" __imp_NtUnsubscribeWnfStateChange
0x1800039E0: Wow64NtSetValueKey
0x1800381A0: "__cdecl _imp_NtQueryTimer" __imp_NtQueryTimer
0x18003BC10: "NtSetInformationWorkerFactory: C" ??_C@_0EC@JHNHMPDA@NtSetInformationWorkerFactory?3?5C@
0x18004AE90: CachedWow64ProcessEnvironment
0x180038A90: "__cdecl _imp_NtOpenKeyEx" __imp_NtOpenKeyEx
0x1800256B0: whNtCompareObjects
0x180012F30: whNtQueryObject
0x18002FE10: whNtSetCachedSigningLevel2
0x18003AC88: "RtlWow64GetCpuAreaInfo: ProcessI" ??_C@_0DG@LACGDCLA@RtlWow64GetCpuAreaInfo?3?5ProcessI@
0x18004AA00: WindirPathBuffer
0x180029440: whNtManagePartition
0x180038380: "__cdecl _imp_NtSerializeBoot" __imp_NtSerializeBoot
0x180008840: Wow64LogPrint
0x180038140: "__cdecl _imp_NtQueryInformationAtom" __imp_NtQueryInformationAtom
0x180037960: "__cdecl _imp_RtlWow64GetCpuAreaInfo" __imp_RtlWow64GetCpuAreaInfo
0x180039BD0: "\catroot2" ??_C@_1BE@LEECOKKM@?$AA?2?$AAc?$AAa?$AAt?$AAr?$AAo?$AAo?$AAt?$AA2?$AA?$AA@
0x180001928: InitializeContextMapper
0x18000EAC4: Wow64NtRaiseException
0x18001E2EC: ULongToPtr
0x1800387D0: "__cdecl _imp_NtSaveMergedKeys" __imp_NtSaveMergedKeys
0x18002F3B0: whNtRenameTransactionManager
0x180039610: "InitializeContextMapper: Mapping" ??_C@_0DC@LHAIBKPH@InitializeContextMapper?3?5Mapping@
0x18002AED4: whNtQueryInformationJobObject_JobObjectBasicAndIoAccountingInformation
0x18001FE04: Wow64IsProcessCfgExportSuppressionEnabled
0x180025940: whNtCreateDirectoryObject
0x1800385D0: "__cdecl _imp_NtFreeUserPhysicalPages" __imp_NtFreeUserPhysicalPages
0x18002ADA4: whNtQueryInformationJobObject_JobObjectBasicAccountingInformation
0x1800328D4: whNtSetSystemInformation_SystemVerifierRemoveDriverInformation
0x18004537C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1800120E0: whNtQueryFullAttributesFile
0x180038598: "__cdecl _imp_NtQueryDirectoryObject" __imp_NtQueryDirectoryObject
0x1800031F4: IsOnSystemDirectory
0x180038148: "__cdecl _imp_CsrCaptureMessageBuffer" __imp_CsrCaptureMessageBuffer
0x180034B00: whNtWow64CsrBasepRefreshIniFileMapping
0x1800174C7: "__cdecl local_unwind" _local_unwind
0x180038130: "__cdecl _imp_NtCreateEventPair" __imp_NtCreateEventPair
0x18002B9A8: whNtQueryInformationProcess_ProcessImageSection
0x180039DE8: sdwhbaseNumber
0x180015A20: whNtRequestPort
0x180037988: "__cdecl _imp_NtTestAlert" __imp_NtTestAlert
0x180037FD0: "__cdecl _imp_NtAlpcImpersonateClientContainerOfPort" __imp_NtAlpcImpersonateClientContainerOfPort
0x180031D58: whNtSetInformationTransaction_TransactionPropertiesInformation
0x180032A14: whNtSetSystemInformation_SystemPolicyInformation
0x180031728: whNtSetInformationResourceManager_ResourceManagerCompletionInformation
0x180012680: whNtOpenDirectoryObject
0x180034740: whNtWow64ConsoleLaunchServerProcess
0x18003BB88: "NtSetInformationToken: Called wi" ??_C@_0DK@KPAMGJPH@NtSetInformationToken?3?5Called?5wi@
0x1800280D0: whNtDisableLastKnownGood
0x180025400: whNtCancelTimer
0x18002A5A0: whNtPlugPlayControl
0x18004A188: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18003ADE8: "Wow64LdrpInitialize: ThreadInit " ??_C@_0DC@OHJANLOP@Wow64LdrpInitialize?3?5ThreadInit?5@
0x18004A0F0: Wow64pKnownDllDirectories
0x1800161D0: whNtFlushProcessWriteBuffers
0x18000E6B4: Wow64pSetupExceptionDispatch
0x18002CDF0: whNtQueryOpenSubKeysEx
0x180037B40: "__cdecl _imp_NtOpenProcess" __imp_NtOpenProcess
0x18003C1E0: "Unknown DBGUI_WAIT_STATE_CHANGE " ??_C@_0CH@GOHKPKMJ@Unknown?5DBGUI_WAIT_STATE_CHANGE?5@
0x180032C80: whNtSetSystemInformation_SystemRegistryQuotaInformation
0x180033450: whNtTerminateEnclave
0x180001008: whNtSetInformationThreadAffinityMask
0x180037F98: "__cdecl _imp_NtReleaseMutant" __imp_NtReleaseMutant
0x18003AA28: "Wow64QueryInformationThread: NtO" ??_C@_0DO@OEABIPDE@Wow64QueryInformationThread?3?5NtO@
0x180037ED0: "__cdecl _imp_NtSetWnfProcessNotificationEvent" __imp_NtSetWnfProcessNotificationEvent
0x180037BB8: "__cdecl _imp_NtCreateThreadEx" __imp_NtCreateThreadEx
0x180037B38: "__cdecl _imp_NtReadVirtualMemory" __imp_NtReadVirtualMemory
0x180025510: whNtCommitComplete
0x180038718: "__cdecl _imp_NtUpdateWnfStateData" __imp_NtUpdateWnfStateData
0x18003CFF0: "\REGISTRY\USER\*_Classes\Wow6432" ??_C@_1EK@BFDNIFFD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA_?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA3?$AA2@
0x180038068: "__cdecl _imp_NtQueryPortInformationProcess" __imp_NtQueryPortInformationProcess
0x180025570: whNtCommitRegistryTransaction
0x18000C5D8: whNtQuerySystemInformation_SystemEmulationBasicInformation
0x180037E20: "__cdecl _imp_NtIsSystemResumeAutomatic" __imp_NtIsSystemResumeAutomatic
0x1800383B8: "__cdecl _imp_NtCompactKeys" __imp_NtCompactKeys
0x180006E40: whNtQueryAttributesFile
0x18002A890: whNtPulseEvent
0x18003A4A0: "InitializeContextMapper: Unable " ??_C@_0EM@HBNHOKEC@InitializeContextMapper?3?5Unable?5@
0x180028D20: whNtImpersonateAnonymousToken
0x180012098: whNT32QuerySystemInformationEx
0x1800154C4: whNtQueryInformationJobObject_SpecialQueryCase
0x1800072C0: whNtProtectVirtualMemory
0x180038A60: "__cdecl _imp_NtEnumerateKey" __imp_NtEnumerateKey
0x180038768: "__cdecl _imp_NtDeleteWnfStateData" __imp_NtDeleteWnfStateData
0x18002A9A0: whNtQueryDebugFilterState
0x180014B50: whNtQueryEvent
0x180001154: CsrBasepCreateActCtx
0x180027950: whNtCreateTransaction
0x180037D30: "__cdecl _imp_NtRollbackRegistryTransaction" __imp_NtRollbackRegistryTransaction
0x180029490: whNtMapCMFModule
0x180037990: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180004CF0: whNtSetInformationVirtualMemory
0x18003C398: "whNtWow64CsrClientCallServer(465" ??_C@_0DD@MLAOEENP@whNtWow64CsrClientCallServer?$CI465@
0x180039790: "\Registry\Machine\Software\Micro" ??_C@_1FI@KONKFBE@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x18002E8A0: whNtQuerySystemTime
0x180039858: "Redirected object name is now %w" ??_C@_0CE@CKDDJOGM@Redirected?5object?5name?5is?5now?5?$CFw@
0x180039970: "%s%s\ntdll.dll" ??_C@_1BO@DDDGHGNE@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?2?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18003A390: "Wow64LogInitialize" ??_C@_0BD@KCDBIOCI@Wow64LogInitialize?$AA@
0x180032BB0: whNtSetSystemInformation_SystemRegistryAppendString
0x180038918: "__cdecl _imp_NtSetUuidSeed" __imp_NtSetUuidSeed
0x180028A50: whNtGetDevicePowerState
0x180017700: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18003C500: "whNtWow64CsrFreeCaptureBuffer(46" ??_C@_0IM@ICLGFGDA@whNtWow64CsrFreeCaptureBuffer?$CI46@
0x180036180: WowAmd64NodeString
0x180038240: "__cdecl _imp_NtGetNextThread" __imp_NtGetNextThread
0x180037DB8: "__cdecl _imp_NtCreateMailslotFile" __imp_NtCreateMailslotFile
0x180011A10: whNtCreateSemaphore
0x180020338: CpuNotifyAllocateVirtualMemoryLocal
0x180025154: whNtAlpcSetInformation_AlpcPortInformation
0x180037C20: "__cdecl _imp_RtlGetNextEntryHashTable" __imp_RtlGetNextEntryHashTable
0x1800056D0: whNtOpenSection
0x18002BBD4: whNtQueryInformationProcess_ProcessPooledUsageAndLimits
0x180037A70: "__cdecl _imp_RtlInsertEntryHashTable" __imp_RtlInsertEntryHashTable
0x180032948: whNtSetSystemInformation_SystemFileCacheInformationEx
0x18002D880: whNtQuerySystemInformation_SystemBootEnvironmentInformation
0x1800389A8: "__cdecl _imp_NtSetInformationWorkerFactory" __imp_NtSetInformationWorkerFactory
0x18003D140: "ApphelpCreateAppcompatData" ??_C@_0BL@IPIGEPKC@ApphelpCreateAppcompatData?$AA@
0x180011B40: whNtQuerySystemInformationEx
0x180039700: "\BaseNamedObjects\Global\%s" ??_C@_1DI@MPCNHOAA@?$AA?2?$AAB?$AAa?$AAs?$AAe?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?2?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x180039648: "InitializeContextMapper: Found e" ??_C@_0DH@EGOHNEPM@InitializeContextMapper?3?5Found?5e@
0x18003B450: "NtQueryVolumeInformationFile: ca" ??_C@_0ED@OPOHLIEK@NtQueryVolumeInformationFile?3?5ca@
0x180033EF0: whNtWow64CsrAllocateCaptureBuffer
0x1800379B8: "__cdecl _imp_LdrUnlockLoaderLock" __imp_LdrUnlockLoaderLock
0x180021ED0: whNT32QuerySystemExtendedHandleInformation
0x180005514: Wow64DetectMachineTypeInternal
0x18002A3C0: whNtOpenTransaction
0x1800381B8: "__cdecl _imp_NtCompareSigningLevels" __imp_NtCompareSigningLevels
0x1800389E0: "__cdecl _imp_NtNotifyChangeDirectoryFile" __imp_NtNotifyChangeDirectoryFile
0x180038438: "__cdecl _imp_NtQueryInformationTransactionManager" __imp_NtQueryInformationTransactionManager
0x18003BCD0: "NtSetVolumeInformationFile: call" ??_C@_0EB@IIIANNAH@NtSetVolumeInformationFile?3?5call@
0x180039E70: "BTCpuCfgDispatchControl" ??_C@_0BI@KBDLPJEK@BTCpuCfgDispatchControl?$AA@
0x180026C60: whNtCreateProfileEx
0x18000ED5C: Wow64ArchGetRet
0x180001854: Wow64ProtectMrdata
0x180034240: whNtWow64DebuggerCall
0x18000B900: whNtQueryInformationProcess_ProcessTimes
0x18002C840: whNtQueryInstallUILanguage
0x180038658: "__cdecl _imp_NtOpenIoCompletion" __imp_NtOpenIoCompletion
0x1800381F8: "__cdecl _imp_NtReadFile" __imp_NtReadFile
0x18001E550: Wow64pBreakPoint
0x18002CE80: whNtQueryPerformanceCounter
0x180038288: "__cdecl _imp_NtAlpcCreateSectionView" __imp_NtAlpcCreateSectionView
0x180035220: ConsoleLaunchServerProcess
0x180038AF8: "__cdecl _imp_sdwhcon" __imp_sdwhcon
0x18004A9E0: CpuThreadSize
0x1800336F0: whNtUnloadKey
0x18003B940: "NtQueryInformationJobObject: Cal" ??_C@_0EA@DCAMDJME@NtQueryInformationJobObject?3?5Cal@
0x180016C30: whNtDeleteKey
0x18003CD90: "\{FE10D39B-A7F1-412c-83BA-D00788" ??_C@_1FA@JLMFPFOH@?$AA?2?$AA?$HL?$AAF?$AAE?$AA1?$AA0?$AAD?$AA3?$AA9?$AAB?$AA?9?$AAA?$AA7?$AAF?$AA1?$AA?9?$AA4?$AA1?$AA2?$AAc?$AA?9?$AA8?$AA3?$AAB?$AAA?$AA?9?$AAD?$AA0?$AA0?$AA7?$AA8?$AA8@
0x18001E400: RtlStringCbPrintfA
0x1800384D8: "__cdecl _imp_NtRegisterProtocolAddressInformation" __imp_NtRegisterProtocolAddressInformation
0x18003B4D0: "NtQueryEvent: called with unsupp" ??_C@_0DD@MHEEGDLD@NtQueryEvent?3?5called?5with?5unsupp@
0x18000F1C0: Wow64FreeThreadHeap
0x180025F70: whNtCreateKeyTransacted
0x18003C0D8: "32-bit Debugger couldn't skip na" ??_C@_0DI@PLJHPOAG@32?9bit?5Debugger?5couldn?8t?5skip?5na@
0x180037FA0: "__cdecl _imp_NtEnumerateValueKey" __imp_NtEnumerateValueKey
0x180038490: "__cdecl _imp_NtCloseObjectAuditAlarm" __imp_NtCloseObjectAuditAlarm
0x180038328: "__cdecl _imp_NtAreMappedFilesTheSame" __imp_NtAreMappedFilesTheSame
0x1800382A8: "__cdecl _imp_NtReleaseKeyedEvent" __imp_NtReleaseKeyedEvent
0x18003A5E8: "ThunkStartupContext64TO32: thunk" ??_C@_0DF@PCEEELIO@ThunkStartupContext64TO32?3?5thunk@
0x180031FA0: whNtSetLowWaitHighEventPair
0x180038610: "__cdecl _imp_NtQueryInformationPort" __imp_NtQueryInformationPort
0x180037F40: "__cdecl _imp_NtDeleteDriverEntry" __imp_NtDeleteDriverEntry
0x18003CF28: "\REGISTRY\MACHINE\SOFTWARE" ??_C@_1DG@IOMDFJHH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?$AA@
0x180032A94: whNtSetSystemInformation_SystemPrefetcherInformation
0x1800387E8: "__cdecl _imp_NtAllocateUuids" __imp_NtAllocateUuids
0x180037D40: "__cdecl _imp_NtOpenMutant" __imp_NtOpenMutant
0x18004AC10: WindirPath
0x1800389A0: "__cdecl _imp_NtLoadDriver" __imp_NtLoadDriver
0x180012960: whNtCreateTimer2
0x180025D40: whNtCreateIRTimer
0x1800070E0: whNtAllocateVirtualMemory
0x180032ED0: whNtSetSystemTime
0x180008030: Wow64ShallowThunkAllocObjectAttributes32TO64_FNC
0x180012A50: whNtQuerySymbolicLinkObject
0x180029770: whNtModifyBootEntry
0x180037F68: "__cdecl _imp_NtWriteFile" __imp_NtWriteFile
0x180037C00: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x18002E108: whNtQuerySystemInformation_SystemProcessorFeaturesInformation
0x180037F50: "__cdecl _imp_NtSetTimer" __imp_NtSetTimer
0x18002C920: whNtQueryMultipleValueKey
0x180004250: whNtQuerySystemInformation
0x18003AAC0: "Wow64QueryInformationThread: The" ??_C@_0FO@DONICGGO@Wow64QueryInformationThread?3?5The@
0x1800397E8: "%ws\system32\%ws" ??_C@_1CC@MMMAIAFD@?$AA?$CF?$AAw?$AAs?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x180037F70: "__cdecl _imp_NtCancelIoFileEx" __imp_NtCancelIoFileEx
0x18003A108: "BTCpuThreadInit" ??_C@_0BA@PFFIONMO@BTCpuThreadInit?$AA@
0x180037D58: "__cdecl _imp_NtSetTimer2" __imp_NtSetTimer2
0x18003AD68: "Wow64LdrpInitialize: RtlStringCb" ??_C@_0DK@FJNJPEFN@Wow64LdrpInitialize?3?5RtlStringCb@
0x18003CCA0: "\{1BD51F8C-8CFC-4708-A88D-5690DE" ??_C@_1FA@NFDDCOIJ@?$AA?2?$AA?$HL?$AA1?$AAB?$AAD?$AA5?$AA1?$AAF?$AA8?$AAC?$AA?9?$AA8?$AAC?$AAF?$AAC?$AA?9?$AA4?$AA7?$AA0?$AA8?$AA?9?$AAA?$AA8?$AA8?$AAD?$AA?9?$AA5?$AA6?$AA9?$AA0?$AAD?$AAE@
0x180014F00: whNtAlpcCreateResourceReserve
0x18003C110: "DbgUiWaitWaitStateChange: DbgSin" ??_C@_0DI@FALBOBH@DbgUiWaitWaitStateChange?3?5DbgSin@
0x180026D90: whNtCreateRegistryTransaction
0x18003AF58: "Wow64CallFunction64Nop - Nop rou" ??_C@_0CH@BJEEDEMM@Wow64CallFunction64Nop?5?9?5Nop?5rou@
0x180039880: "\WOW6432Node" ??_C@_1BK@GKBHLFGI@?$AA?2?$AAW?$AAO?$AAW?$AA6?$AA4?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x18003A060: "BTCpuNotifyDllUnload" ??_C@_0BF@DMJMDPPE@BTCpuNotifyDllUnload?$AA@
0x18003AF98: "InputBufferLength = %lx, InputBu" ??_C@_0CL@BPKHJAAO@InputBufferLength?5?$DN?5?$CFlx?0?5InputBu@
0x18003A3D8: "Wow64LogTerminate" ??_C@_0BC@EBCLNOKA@Wow64LogTerminate?$AA@
0x1800386A8: "__cdecl _imp_NtAccessCheckByTypeResultListAndAuditAlarm" __imp_NtAccessCheckByTypeResultListAndAuditAlarm
0x1800379D8: "__cdecl _imp_RtlGetNtSystemRoot" __imp_RtlGetNtSystemRoot
0x180038170: "__cdecl _imp_NtPrepareComplete" __imp_NtPrepareComplete
0x180038930: "__cdecl _imp_NtStopProfile" __imp_NtStopProfile
0x180038B18: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1800389D8: "__cdecl _imp_NtEnableLastKnownGood" __imp_NtEnableLastKnownGood
0x180027160: whNtCreateSymbolicLinkObject
0x180025890: whNtCreateDebugObject
0x180037A20: "__cdecl _imp_RtlInitializeSRWLock" __imp_RtlInitializeSRWLock
0x18000C8AC: whNtQueryInformationProcess_ProcessImageInformation
0x1800255A0: whNtCommitTransaction
0x18003BEE0: "DbgUiWaitWaitStateChange: Couldn" ??_C@_0EF@KLDHIIDJ@DbgUiWaitWaitStateChange?3?5Couldn@
0x18003AE20: "Wow64LdrpInitialize: Calling Rtl" ??_C@_0DA@PEKEALOF@Wow64LdrpInitialize?3?5Calling?5Rtl@
0x180033210: whNtSystemDebugControl
0x18003B5D0: "whNtManageHotPatch(266) unsuppor" ??_C@_0BMF@IDEJECAE@whNtManageHotPatch?$CI266?$CJ?5unsuppor@
0x180030D80: whNtSetInformationJobObject_JobObjectNetRateControlInformation
0x18002F9C0: whNtResetWriteWatch
0x180038010: "__cdecl _imp_NtSetInformationJobObject" __imp_NtSetInformationJobObject
0x1800315B0: whNtSetInformationProcess_ProcessCombineSecurityDomainsInformation
0x180037F28: "__cdecl _imp_NtCreatePort" __imp_NtCreatePort
0x1800380C8: "__cdecl _imp_NtRemoveProcessDebug" __imp_NtRemoveProcessDebug
0x180023460: whNT32ThunkAllocTokenSecurityAttribute32TO64
0x18001F968: Wow64pThunkLegacyPortViewOut
0x18003CE38: "\MediaFoundation" ??_C@_1CC@FEPMIPGD@?$AA?2?$AAM?$AAe?$AAd?$AAi?$AAa?$AAF?$AAo?$AAu?$AAn?$AAd?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x180017640: Wow64pLongJmp
0x1800127D0: whNtOpenSymbolicLinkObject
0x180037FF0: "__cdecl _imp_NtAddDriverEntry" __imp_NtAddDriverEntry
0x18002FD00: whNtSetCachedSigningLevel
0x1800295A0: whNtMapViewOfSectionEx
0x1800091E0: Wow64RedirectKeyPathInternal
0x180001F84: Wow64pLoadLogDll
0x180028990: whNtGetCachedSigningLevel
0x180037BB0: "__cdecl _imp_RtlWow64GetCurrentMachine" __imp_RtlWow64GetCurrentMachine
0x1800160A0: whNtOpenPrivateNamespace
0x180038168: "__cdecl _imp_NtCompressKey" __imp_NtCompressKey
0x180038118: "__cdecl _imp_NtSetDefaultLocale" __imp_NtSetDefaultLocale
0x18000350C: GetKeyTag
0x180001E9C: Wow64pGetLegacyLpcPortName
0x18003A010: "BTCpuNotifyAfterFork" ??_C@_0BF@CODLAFEB@BTCpuNotifyAfterFork?$AA@
0x180023234: whNT32ShallowThunkAllocSecurityAttributeOperations32TO64
0x1800398E0: "ThunkStartupContent64TO32: Origi" ??_C@_0EO@EFFNBKKF@ThunkStartupContent64TO32?3?5Origi@
0x1800267A0: whNtCreatePartition
0x1800396A0: "\??\%s" ??_C@_1O@PAJNNBDG@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x180013F8C: CsrBasepNlsGetUserInfo
0x18002FA00: whNtRestoreKey
0x180038A10: "__cdecl _imp_NtQueryTimerResolution" __imp_NtQueryTimerResolution
0x1800347E0: whNtWow64CsrBaseCheckRunApp
0x180017710: Wow64KiUserCallbackDispatcher
0x180006F30: whNtOpenKey
0x180037E78: "__cdecl _imp_NtQueryBootOptions" __imp_NtQueryBootOptions
0x1800381C8: "__cdecl _imp_NtResumeProcess" __imp_NtResumeProcess
0x180020410: CpuProcessDebugEvent
0x18002D644: whNtQuerySystemInformation_SystemActivityModerationUserSettings
0x18000CB8C: whNtQueryInformationToken_TokenOwner
0x180028270: whNtEnumerateSystemEnvironmentValuesEx
0x180014DC0: whNtQueueApcThread
0x1800200CC: Wow64pQueryControlFlowGuardBitMap
0x180006230: whNtCreateSection
0x180020C44: whNT32AdjustGroupToken
0x180013BC0: whNtAlpcQueryInformationMessage
0x18000C0FC: whNtQueryInformationToken_TokenAppContainerSid
0x180015EF0: whNtFlushVirtualMemory
0x1800385E8: "__cdecl _imp_NtSetSystemEnvironmentValueEx" __imp_NtSetSystemEnvironmentValueEx
0x18003A718: "Wow64RaiseException: Failed to g" ??_C@_0DG@NGLHKIOJ@Wow64RaiseException?3?5Failed?5to?5g@
0x18002F7C0: whNtReplyWaitReceivePortEx
0x18002A120: whNtOpenRegistryTransaction
0x180037A30: "__cdecl _imp_RtlAcquireSRWLockExclusive" __imp_RtlAcquireSRWLockExclusive
0x180038078: "__cdecl _imp_NtCompleteConnectPort" __imp_NtCompleteConnectPort
0x180050000: pfnWow64LogTerminate
0x180037D00: "__cdecl _imp_LdrDisableThreadCalloutsForDll" __imp_LdrDisableThreadCalloutsForDll
0x180012B80: whNtConnectPort
0x180037B10: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x18002A320: whNtOpenTimer
0x18002E990: whNtQueueApcThreadEx
0x180037E00: "__cdecl _imp_NtAllocateLocallyUniqueId" __imp_NtAllocateLocallyUniqueId
0x18002B9A8: whNtQueryInformationProcess_ProcessDebugObjectHandle
0x180038A00: "__cdecl _imp_NtSetLdtEntries" __imp_NtSetLdtEntries
0x1800388D8: "__cdecl _imp_NtQueryInformationEnlistment" __imp_NtQueryInformationEnlistment
0x18003CE08: "\Interface" ??_C@_1BG@GLFHKKME@?$AA?2?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?$AA@
0x180028E00: whNtInitializeEnclave
0x18000EC30: whNtContinue
0x18000A2E0: whNtSetInformationFile
0x180025040: whNtAlpcRevokeSecurityContext
0x18003ABA0: "Wow64SuspendLocalThread : failed" ??_C@_0DG@EDLJLLFG@Wow64SuspendLocalThread?5?3?5failed@
0x18003BF50: "DbgUiWaitWaitStateChange: DbgRep" ??_C@_0CL@LBAEJCJA@DbgUiWaitWaitStateChange?3?5DbgRep@
0x18000E1EC: whNtQuerySystemInformation_SystemHypervisorSharedPageInformation
0x180006FC0: Wow64NtOpenKey
0x180034FB0: Wow64NtQueryOpenSubKeysEx
0x180031610: whNtSetInformationProcess_ProcessInstrumentationCallback
0x180038AB0: "__cdecl _imp_NtSetValueKey" __imp_NtSetValueKey
0x180002694: Wow64pGetKnownDllSectionHandle
0x180037E70: "__cdecl _imp_NtCreateWaitablePort" __imp_NtCreateWaitablePort
0x1800380B0: "__cdecl _imp_NtNotifyChangeMultipleKeys" __imp_NtNotifyChangeMultipleKeys
0x180023980: whNtAcceptConnectPort
0x180038498: "__cdecl _imp_NtInitiatePowerAction" __imp_NtInitiatePowerAction
0x18000C5D8: whNtQuerySystemInformation_SystemBasicInformation
0x180037E80: "__cdecl _imp_NtDisplayString" __imp_NtDisplayString
0x180029E30: whNtOpenKeyedEvent
0x180012AF0: whNtNotifyChangeKey
0x180038630: "__cdecl _imp_NtMapUserPhysicalPages" __imp_NtMapUserPhysicalPages
0x180039B68: "\hostdriverstore" ??_C@_1CC@PCOMLBKE@?$AA?2?$AAh?$AAo?$AAs?$AAt?$AAd?$AAr?$AAi?$AAv?$AAe?$AAr?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x1800205B0: CpuResetToConsistentState
0x180037B20: "__cdecl _imp_wcsncmp" __imp_wcsncmp
0x1800221AC: whNT32QuerySystemLocksInformation
0x180039594: "__cdecl _guard_iat_table" __guard_iat_table
0x180038208: "__cdecl _imp_NtPrePrepareComplete" __imp_NtPrePrepareComplete
0x180028D50: whNtImpersonateClientOfPort
0x180038250: "__cdecl _imp_NtFlushKey" __imp_NtFlushKey
0x180005C40: whNtOpenFile
0x1800384A8: "__cdecl _imp_NtOpenJobObject" __imp_NtOpenJobObject
0x180017330: memcpy
0x180020950: Wow64ProcessPendingCrossProcessItems
0x18002E39C: whNtQuerySystemInformation_SystemRefTraceInformation
0x180037F20: "__cdecl _imp_NtLoadKey2" __imp_NtLoadKey2
0x180004B98: CpuNotifyMapViewOfSection
0x180038928: "__cdecl _imp_NtSetInformationEnlistment" __imp_NtSetInformationEnlistment
0x180039EE0: "BTCpuNotifyMapViewOfSection" ??_C@_0BM@CLFPCPMN@BTCpuNotifyMapViewOfSection?$AA@
0x180014BE0: whNtFlushBuffersFile
0x180028310: whNtFilterBootOption
0x18001725C: "__cdecl _security_init_cookie_ex" __security_init_cookie_ex
0x180028A80: whNtGetMUIRegistryInfo
0x180033D70: whNtWaitForMultipleObjects32
0x18004A7C0: LegacyLpcPortNameBuffer
0x180015DFC: whNtSetInformationFile_FileTrackingInformation
0x18003B410: "NtQuerySystemInformation: Called" ??_C@_0DN@LABAJGOB@NtQuerySystemInformation?3?5Called@
0x180016C4C: whNtQueryInformationThread_ThreadCycleTime
0x1800384A0: "__cdecl _imp_NtStartProfile" __imp_NtStartProfile
0x1800387D8: "__cdecl _imp_NtQueryInformationResourceManager" __imp_NtQueryInformationResourceManager
0x180031B44: whNtSetInformationToken_TokenIntegrityLevel
0x180038568: "__cdecl _imp_NtRemoveIoCompletion" __imp_NtRemoveIoCompletion
0x18003B178: "NtSetInformationProcess: Called " ??_C@_0DM@CEKIPLHD@NtSetInformationProcess?3?5Called?5@
0x180014CA0: whNtSetInformationFile_FileCompletionInformation
0x180024DE0: whNtAlpcOpenSenderThread
0x180037D10: "__cdecl _imp_memset" __imp_memset
0x180014D38: whNtSetInformationThread_SpecialSetCase
0x180038678: "__cdecl _imp_NtCreateMutant" __imp_NtCreateMutant
0x180038AA8: "__cdecl _imp_NtOpenKeyTransactedEx" __imp_NtOpenKeyTransactedEx
0x180032778: whNtSetSystemInformation_SystemActivityModerationExeState
0x1800386A0: "__cdecl _imp_NtQuerySecurityPolicy" __imp_NtQuerySecurityPolicy
0x180037C08: "__cdecl _imp_NtWaitForSingleObject" __imp_NtWaitForSingleObject
0x180014F30: whNtAlpcDisconnectPort
0x180037F30: "__cdecl _imp_NtSetIoCompletion" __imp_NtSetIoCompletion
0x180045390: "__cdecl _IMPORT_DESCRIPTOR_wow64win" __IMPORT_DESCRIPTOR_wow64win
0x1800257B0: whNtConvertBetweenAuxiliaryCounterAndPerformanceCounter
0x18003C8F0: "whNtWow64CsrCaptureMessageBuffer" ??_C@_0CN@GLMNDCEC@whNtWow64CsrCaptureMessageBuffer@
0x180014390: Wow64ShallowThunkAllocUnicodeString32TO64_FNC
0x180037A38: "__cdecl _imp_RtlRemoveEntryHashTable" __imp_RtlRemoveEntryHashTable
0x180038948: "__cdecl _imp_NtQueryDefaultLocale" __imp_NtQueryDefaultLocale
0x1800260D0: whNtCreateKeyedEvent
0x180032180: whNtSetSystemInformation
0x18003AA70: "Wow64QueryInformationThread: NtQ" ??_C@_0EK@OKAONOCK@Wow64QueryInformationThread?3?5NtQ@
0x180030B70: whNtSetInformationJobObject_JobObjectBasicLimitInformation
0x18003A830: InterruptToNtStatus
0x180024640: whNtAddAtom
0x180038548: "__cdecl _imp_NtAlpcDeleteSectionView" __imp_NtAlpcDeleteSectionView
0x180003B50: whNtCreateKey
0x180038308: "__cdecl _imp_NtSetInformationTransactionManager" __imp_NtSetInformationTransactionManager
0x180038058: "__cdecl _imp_NtRollbackTransaction" __imp_NtRollbackTransaction
0x180027690: whNtCreateTokenEx
0x1800385F0: "__cdecl _imp_NtExtendSection" __imp_NtExtendSection
0x180037DE8: "__cdecl _imp_NtOpenProcessToken" __imp_NtOpenProcessToken
0x180017378: RtlUnhandledExceptionFilter
0x1800306EC: whNtSetInformationFile_FilePipeRemoteInformation
0x180038AE8: "__cdecl _imp_wcscmp" __imp_wcscmp
0x180037AB0: "__cdecl _imp_RtlFindExportedRoutineByName" __imp_RtlFindExportedRoutineByName
0x180016F90: whNtGetContextThread
0x180013D00: whNtAlpcSetInformation
0x180033750: whNtUnloadKey2
0x180017360: "__cdecl _C_specific_handler" __C_specific_handler
0x18002FF80: whNtSetContextThread
0x180038050: "__cdecl _imp_NtEnumerateDriverEntries" __imp_NtEnumerateDriverEntries
0x180033D70: whNtWaitForMultipleObjects
0x18003D090: "\REGISTRY\USER\*\SOFTWARE\Classe" ??_C@_1FM@HBIDDIMP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe@
0x180037AD0: "__cdecl _imp_NtTerminateThread" __imp_NtTerminateThread
0x180030120: whNtSetEvent
0x18001733C: RtlCaptureContext
0x180037C80: "__cdecl _imp_RtlInitializeBitMapEx" __imp_RtlInitializeBitMapEx
0x18003B0C0: "NtQueryInformationFile: Called w" ??_C@_0DL@ODODFADF@NtQueryInformationFile?3?5Called?5w@
0x180033E80: whNtWow64CallFunction64
0x180032878: whNtSetSystemInformation_SystemElamCertificateInformation
0x180038628: "__cdecl _imp_NtSetHighEventPair" __imp_NtSetHighEventPair
0x1800384F0: "__cdecl _imp_NtAddAtomEx" __imp_NtAddAtomEx
0x180031ED0: whNtSetIoCompletionEx
0x180031540: whNtSetInformationProcess_ProcessAccessToken
0x1800395A0: "Wow64QueryInformationThread: TEB" ??_C@_0CP@GGFBBHLI@Wow64QueryInformationThread?3?5TEB@
0x180038638: "__cdecl _imp_NtYieldExecution" __imp_NtYieldExecution
0x1800174D3: memmove
0x180030070: whNtSetDriverEntryOrder
0x18003C148: "DbgUiWaitWaitStateChange: DbgLoa" ??_C@_0DF@CBHCCDPO@DbgUiWaitWaitStateChange?3?5DbgLoa@
0x180020754: Wow64ArchSetThreadStartArg1
0x180038378: "__cdecl _imp_NtDelayExecution" __imp_NtDelayExecution
0x180011AB0: whNtCreateWaitCompletionPacket
0x18002D9E0: whNtQuerySystemInformation_SystemFileCacheInformationEx
0x180038818: "__cdecl _imp_NtCreateProcess" __imp_NtCreateProcess
0x1800379F0: "__cdecl _imp_LdrGetProcedureAddress" __imp_LdrGetProcedureAddress
0x18004A1A0: sdwhbaseErrorCase
0x1800387F0: "__cdecl _imp_NtSignalAndWaitForSingleObject" __imp_NtSignalAndWaitForSingleObject
0x1800389B0: "__cdecl _imp_NtDeleteObjectAuditAlarm" __imp_NtDeleteObjectAuditAlarm
0x1800020E4: RtlUnicodeStringCatString
0x18000F804: Wow64NtCreateKey
0x180012240: whNtDuplicateObject
0x180014400: whNtPowerInformation
0x1800351A0: RtlpFindUnicodeString
0x1800352F0: BasepInitializeApphelpGlobals
0x180017510: Wow64PrepareForException
0x180030F5C: whNtSetInformationJobObject_SpecialSetCase
0x18002C870: whNtQueryIntervalProfile
0x18003A198: "_CLUSTER_NETWORK_NAME_" ??_C@_1CO@HCAPGOEH@?$AA_?$AAC?$AAL?$AAU?$AAS?$AAT?$AAE?$AAR?$AA_?$AAN?$AAE?$AAT?$AAW?$AAO?$AAR?$AAK?$AA_?$AAN?$AAA?$AAM?$AAE?$AA_?$AA?$AA@
0x180037B00: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x180038998: "__cdecl _imp_NtCreateToken" __imp_NtCreateToken
0x180037C10: "__cdecl _imp_RtlAcquireSRWLockShared" __imp_RtlAcquireSRWLockShared
0x18002EEB0: whNtRegisterThreadTerminatePort
0x180038530: "__cdecl _imp_NtWaitLowEventPair" __imp_NtWaitLowEventPair
0x180038740: "__cdecl _imp_NtGetCurrentProcessorNumber" __imp_NtGetCurrentProcessorNumber
0x180037D90: "__cdecl _imp_NtSetQuotaInformationFile" __imp_NtSetQuotaInformationFile
0x180028730: whNtFlushInstructionCache
0x180038938: "__cdecl _imp_NtAllocateReserveObject" __imp_NtAllocateReserveObject
0x180037BA0: "__cdecl _imp_RtlWow64GetProcessMachines" __imp_RtlWow64GetProcessMachines
0x18004A000: DllsToRemap
0x180001388: GetImageName
0x1800161F0: whNtAlpcCancelMessage
0x180014050: whNtInitializeNlsFiles
0x180037B50: "__cdecl _imp_NtQueryInformationThread" __imp_NtQueryInformationThread
0x18004AC20: NtSystem32Path
0x18002CAB0: whNtQueryMutant
0x1800382F8: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x1800173CC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180037A58: "__cdecl _imp_NtCreateEvent" __imp_NtCreateEvent
0x180007A40: whNtCallbackReturn
0x18003C750: "whNtWow64CsrCaptureMessageBuffer" ??_C@_0BJP@NONLEAJG@whNtWow64CsrCaptureMessageBuffer@
0x180028AB0: whNtGetNextProcess
0x180033900: whNtWaitForDebugEvent
0x180024C90: whNtAlpcDeleteResourceReserve
0x18003A3A8: "Wow64LogSystemService" ??_C@_0BG@OBDNOEPP@Wow64LogSystemService?$AA@
0x180037DB0: "__cdecl _imp_NtRemoveIoCompletionEx" __imp_NtRemoveIoCompletionEx
0x180030288: whNtSetInformationFile_FileMemoryPartitionInformation
0x18003AF18: "Wow64pIsLegacyLpcPort: The follo" ??_C@_0DL@PEGJCKBP@Wow64pIsLegacyLpcPort?3?5The?5follo@
0x18002B1A8: whNtQueryInformationJobObject_JobObjectCompletionCounter
0x180020380: CpuNotifyFreeVirtualMemoryLocal
0x180038540: "__cdecl _imp_NtSetInformationResourceManager" __imp_NtSetInformationResourceManager
0x180038618: "__cdecl _imp_NtAccessCheck" __imp_NtAccessCheck
0x1800345B0: whNtWriteFileGather
0x180037978: "__cdecl _imp_RtlWow64GetCurrentCpuArea" __imp_RtlWow64GetCurrentCpuArea
0x1800381A8: "__cdecl _imp_NtSetEaFile" __imp_NtSetEaFile
0x180037C30: "__cdecl _imp_LdrProcessInitializationComplete" __imp_LdrProcessInitializationComplete
0x18002A860: whNtPropagationFailed
0x180033860: whNtWaitForAlertByThreadId
0x180037BC8: "__cdecl _imp_RtlWow64SuspendThread" __imp_RtlWow64SuspendThread
0x180004FB0: whNtApphelpCacheControl
0x1800382B8: "__cdecl _imp_NtOpenThreadTokenEx" __imp_NtOpenThreadTokenEx
0x180038238: "__cdecl _imp_NtLockFile" __imp_NtLockFile
0x180037968: "__cdecl _imp_RtlGetExtendedContextLength" __imp_RtlGetExtendedContextLength
0x18004AE60: AlertByThreadIdEventLock
0x180039DF8: "BTCpuProcessDebugEvent" ??_C@_0BH@GFDGHEBO@BTCpuProcessDebugEvent?$AA@
0x18002ED10: whNtReadOnlyEnlistment
0x180026BA0: whNtCreateProfile
0x180037A08: "__cdecl _imp_NtQuerySection" __imp_NtQuerySection
0x1800206DC: Wow64ArchGetSP
0x18002A280: whNtOpenSession
0x1800337C0: whNtUnloadKeyEx
0x180037DE0: "__cdecl _imp_NtMakePermanentObject" __imp_NtMakePermanentObject
0x180025710: whNtCompareTokens
0x180037C48: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x18003BB48: "NtSetInformationKey: called with" ??_C@_0DK@OMJEIEID@NtSetInformationKey?3?5called?5with@
0x18000D090: ThreadInit
0x18002EDE0: whNtRecoverEnlistment
0x18003A3F0: "ProcessInit: Wow64pInitializeFil" ??_C@_0ED@HJAHCODK@ProcessInit?3?5Wow64pInitializeFil@
0x18000F960: whNtCreateUserProcess
0x18002AA00: whNtQueryDefaultUILanguage
0x180036100: LastGoodName
0x180037B58: "__cdecl _imp_NtWriteVirtualMemory" __imp_NtWriteVirtualMemory
0x180038770: "__cdecl _imp_NtSetThreadExecutionState" __imp_NtSetThreadExecutionState
0x18003A5A0: "InitializeContextMapper: Unable " ??_C@_0EE@DKECLFAI@InitializeContextMapper?3?5Unable?5@
0x180039FF0: "BTCpuNotifyAffinityChange" ??_C@_0BK@PLCMHEGL@BTCpuNotifyAffinityChange?$AA@
0x18004A9F0: TotalHeapHits
0x18003C920: "whNtWow64CsrCaptureMessageString" ??_C@_0BPN@MKNOBFOC@whNtWow64CsrCaptureMessageString@
0x18002FCA0: whNtSetBootEntryOrder
0x18002BEB0: whNtQueryInformationThread_ThreadLastSystemCall
0x180014170: whNtAlpcDeletePortSection
0x180038120: "__cdecl _imp_CsrClientCallServer" __imp_CsrClientCallServer
0x180031AE4: whNtSetInformationToken_TokenDefaultDacl
0x180037CC0: "__cdecl _imp_RtlInitAnsiStringEx" __imp_RtlInitAnsiStringEx
0x1800383B0: "__cdecl _imp_NtAssignProcessToJobObject" __imp_NtAssignProcessToJobObject
0x180012860: whNtCreateWorkerFactory
0x180024330: whNtAccessCheckByTypeResultListAndAuditAlarmByHandle
0x180020600: CpuSuspendLocalThread
0x18003A028: "BTCpuNotifyBeforeFork" ??_C@_0BG@BKLCHOAC@BTCpuNotifyBeforeFork?$AA@
0x1800386F8: "__cdecl _imp_NtQueryInformationByName" __imp_NtQueryInformationByName
0x18002B544: whNtQueryInformationJobObject_JobObjectNotificationLimitInformation2
0x18002D300: whNtQuerySystemEnvironmentValueEx
0x18003A148: "\sysnative" ??_C@_1BG@GDBHICHE@?$AA?2?$AAs?$AAy?$AAs?$AAn?$AAa?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x18003BB08: "NtSetInformationJobObject: Calle" ??_C@_0DO@IKPILNBN@NtSetInformationJobObject?3?5Calle@
0x180038398: "__cdecl _imp_NtAlpcOpenSenderProcess" __imp_NtAlpcOpenSenderProcess
0x180037EC8: "__cdecl _imp_NtAlpcConnectPortEx" __imp_NtAlpcConnectPortEx
0x18000CFAC: Wow64SetupInitialCall
0x180023190: whNT32ShallowThunkAllocOctetStringArray32TO64
0x18002D748: whNtQuerySystemInformation_SystemBasicPerformanceInformation
0x180038A20: "__cdecl _imp_NtNotifyChangeDirectoryFileEx" __imp_NtNotifyChangeDirectoryFileEx
0x18004AE80: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUdldGEUdldGEUlyquivUznwGEUkxsOlyq@wow64" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUdldGEUdldGEUlyquivUznwGEUkxsOlyq@wow64
0x180021A18: whNT32QuerySecurityPolicy
0x180028D80: whNtImpersonateThread
0x18002FBF0: whNtSaveKeyEx
0x1800385B0: "__cdecl _imp_NtAdjustGroupsToken" __imp_NtAdjustGroupsToken
0x180037A40: "__cdecl _imp_RtlReleaseSRWLockExclusive" __imp_RtlReleaseSRWLockExclusive
0x180014A20: whNtOpenThread
0x1800328D4: whNtSetSystemInformation_SystemVerifierAddDriverInformation
0x18001FF40: Wow64ValidateUserCallTargetFilter
0x1800010A0: whNtUnlockVirtualMemory
0x180038870: "__cdecl _imp_NtSetInformationDebugObject" __imp_NtSetInformationDebugObject
0x18001E4D0: ThreadExitCallback
0x180050030: NtDll32Base
0x180024A20: whNtAlertResumeThread
0x1800215D4: whNT32NtAdjustTokenClaimsAndDeviceGroups
0x18002FFE0: whNtSetDefaultHardErrorPort
0x180037B88: "__cdecl _imp_NtTerminateProcess" __imp_NtTerminateProcess
0x180037C98: "__cdecl _imp_NtQueryVirtualMemory" __imp_NtQueryVirtualMemory
0x180038180: "__cdecl _imp_NtRevertContainerImpersonation" __imp_NtRevertContainerImpersonation
0x18001E5A0: Wow64DispatchExceptionCHPE
0x1800380D8: "__cdecl _imp_NtAddBootEntry" __imp_NtAddBootEntry
0x18003AC48: "Wow64SuspendLocalThread : failed" ??_C@_0DP@LKFNMDKC@Wow64SuspendLocalThread?5?3?5failed@
0x180029960: whNtNotifyChangeSession
0x180006440: whNtOpenThreadToken
0x1800140D0: whNtSetInformationObject
0x18003C4C8: "whNtWow64CsrAllocateCaptureBuffe" ??_C@_0DI@HFGCAPNO@whNtWow64CsrAllocateCaptureBuffe@
0x180034670: whNtWriteRequestData
0x1800381D0: "__cdecl _imp_NtCreateNamedPipeFile" __imp_NtCreateNamedPipeFile
0x18002A1C0: whNtOpenResourceManager
0x1800287A0: whNtFlushWriteBuffer
0x18003C000: "DbgUiWaitWaitStateChange: DbgExi" ??_C@_0DI@PDHIJHDM@DbgUiWaitWaitStateChange?3?5DbgExi@
0x180039820: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x180027260: whNtCreateThread
0x18000AA10: whNtQueryKey
0x180038340: "__cdecl _imp_NtWaitForWorkViaWorkerFactory" __imp_NtWaitForWorkViaWorkerFactory
0x180037970: "__cdecl _imp_RtlInitializeExtendedContext" __imp_RtlInitializeExtendedContext
0x180038950: "__cdecl _imp_NtDebugContinue" __imp_NtDebugContinue
0x180029ED0: whNtOpenObjectAuditAlarm
0x1800037A0: whNtQueryVolumeInformationFile
0x180039FB8: "BTCpuIsProcessorFeaturePresent" ??_C@_0BP@EGAHNLJD@BTCpuIsProcessorFeaturePresent?$AA@
0x180037DA8: "__cdecl _imp_NtQueryOpenSubKeys" __imp_NtQueryOpenSubKeys
0x18002EE10: whNtRecoverResourceManager
0x180038978: "__cdecl _imp_NtCancelTimer2" __imp_NtCancelTimer2
0x1800384E0: "__cdecl _imp_NtAcquireProcessActivityReference" __imp_NtAcquireProcessActivityReference
0x18002C8A0: whNtQueryIoCompletion
0x180009DC0: whNtAlpcSendWaitReceivePort
0x1800301B0: whNtSetHighWaitLowEventPair
0x180029560: whNtMapUserPhysicalPagesScatter
0x180037B18: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x180030EBC: whNtSetInformationJobObject_JobObjectSecurityLimitInformation
0x180004160: whNtQueryLicenseValue
0x180037A78: "__cdecl _imp_TpSetWaitEx" __imp_TpSetWaitEx
0x1800387A8: "__cdecl _imp_NtEnumerateBootEntries" __imp_NtEnumerateBootEntries
0x180034C10: whNtWow64CsrBasepSetTermsrvAppInstallMode
0x180039EA0: "BTCpuUpdateProcessorInformation" ??_C@_0CA@MECLPAJC@BTCpuUpdateProcessorInformation?$AA@
0x18000D600: whNtAllocateVirtualMemoryEx
0x180032FF0: whNtSetVolumeInformationFile
0x180006070: whNtQuerySecurityAttributesToken
0x1800299D0: whNtOpenEnlistment
0x180038878: "__cdecl _imp_NtLockProductActivationKeys" __imp_NtLockProductActivationKeys
0x18003C0B0: "Bypassing native breakpoint at %" ??_C@_0CE@MDDFNKGB@Bypassing?5native?5breakpoint?5at?5?$CF@
0x1800259E0: whNtCreateDirectoryObjectEx
0x1800387A0: "__cdecl _imp_NtCallEnclave" __imp_NtCallEnclave
0x180037D50: "__cdecl _imp_NtAdjustPrivilegesToken" __imp_NtAdjustPrivilegesToken
0x18002FAD0: whNtRollbackComplete
0x18002FA70: whNtResumeThread
0x180039EC0: "BTCpuNotifyUnmapViewOfSection" ??_C@_0BO@NFNNDPHA@BTCpuNotifyUnmapViewOfSection?$AA@
0x180038488: "__cdecl _imp_NtCreateLowBoxToken" __imp_NtCreateLowBoxToken
0x18001EB90: Wow64NtAlertThreadByThreadId
0x18003A298: "user32.dll" ??_C@_1BG@OILDLIOJ@?$AAu?$AAs?$AAe?$AAr?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1800389F8: "__cdecl _imp_NtSuspendProcess" __imp_NtSuspendProcess
0x180037530: sdwhbaseJumpTable
0x180037D20: "__cdecl _imp__local_unwind" __imp__local_unwind
0x1800027A8: whNtSetInformationThread_ThreadWorkOnBehalfTicket
0x1800318D4: whNtSetInformationThread_ThreadQuerySetWin32StartAddress
0x1800301E0: whNtSetIRTimer
0x18002F4E0: whNtReplacePartitionUnit
0x180038418: "__cdecl _imp_NtSetDebugFilterState" __imp_NtSetDebugFilterState
0x180037C28: "__cdecl _imp_RtlReleaseSRWLockShared" __imp_RtlReleaseSRWLockShared
0x1800116F0: whNtRequestWaitReplyPort
0x180038650: "__cdecl _imp_NtDeletePrivateNamespace" __imp_NtDeletePrivateNamespace
0x18001E740: Wow64RaiseException
0x18003ABD8: "Wow64SuspendLocalThread : NtResu" ??_C@_0DF@CGCBMJLC@Wow64SuspendLocalThread?5?3?5NtResu@
0x18002F330: whNtRenameKey
0x180038408: "__cdecl _imp_NtPrepareEnlistment" __imp_NtPrepareEnlistment
0x18002F990: whNtResetEvent
0x180021498: whNT32GetSidAndAttributesHashCopyoutSize
0x180012710: whNtDuplicateToken
0x180038040: "__cdecl _imp_NtOpenSemaphore" __imp_NtOpenSemaphore
0x180038A70: "__cdecl _imp_NtDeleteValueKey" __imp_NtDeleteValueKey
0x18003A0B0: "BTCpuResetToConsistentState" ??_C@_0BM@FDEJHPGP@BTCpuResetToConsistentState?$AA@
0x180014840: whNtIsUILanguageComitted
0x180037F38: "__cdecl _imp_NtReplyPort" __imp_NtReplyPort
0x18002CB48: whNtQueryMutant_MutantOwnerInformation
0x180032F90: whNtSetTimerResolution
0x180038150: "__cdecl _imp_NtPrePrepareEnlistment" __imp_NtPrePrepareEnlistment
0x180039830: "CpuNotifyUnmapViewOfSection(%p) " ??_C@_0CI@OLOEOI@CpuNotifyUnmapViewOfSection?$CI?$CFp?$CJ?5@
0x1800335B0: whNtThawRegistry
0x180038000: "__cdecl _imp_NtAlertThread" __imp_NtAlertThread
0x1800385A8: "__cdecl _imp_NtQueryInformationFile" __imp_NtQueryInformationFile
0x180015210: whNtQueryInformationJobObject
0x18003C590: "whNtWow64CsrFreeCaptureBuffer(46" ??_C@_0CK@FEJEDEMI@whNtWow64CsrFreeCaptureBuffer?$CI46@
0x18002C558: whNtQueryInformationWorkerFactory_WorkerFactoryBasicInformation
0x18003AC10: "Wow64SuspendLocalThread : NtSusp" ??_C@_0DG@OPCIJBPC@Wow64SuspendLocalThread?5?3?5NtSusp@
0x180038338: "__cdecl _imp_NtQueryEaFile" __imp_NtQueryEaFile
0x180034040: whNtWow64CsrCaptureMessageString
0x180009C70: whNtQueryValueKey
0x180037EB0: "__cdecl _imp_NtGetCompleteWnfStateSubscription" __imp_NtGetCompleteWnfStateSubscription
0x180037EF8: "__cdecl _imp_NtSinglePhaseReject" __imp_NtSinglePhaseReject
0x180025340: whNtCancelSynchronousIoFile
0x180037CA8: "__cdecl _imp_RtlpQueryProcessDebugInformationFromWow64" __imp_RtlpQueryProcessDebugInformationFromWow64
0x180034960: whNtWow64CsrBasepDefineDosDevice
0x180038A40: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x180037F80: "__cdecl _imp_NtDeleteWnfStateName" __imp_NtDeleteWnfStateName
0x180037D78: "__cdecl _imp_NtRecoverTransactionManager" __imp_NtRecoverTransactionManager
0x18000E174: whNT32DeepThunkTokenGroups64TO32Length
0x180038798: "__cdecl _imp_NtSetInformationTransaction" __imp_NtSetInformationTransaction
0x18000148C: ProcessInit
0x180038480: "__cdecl _imp_NtQuerySystemEnvironmentValue" __imp_NtQuerySystemEnvironmentValue
0x18002EF50: whNtReleaseSemaphore
0x18002A770: whNtPrivilegedServiceAuditAlarm
0x18002A940: whNtQueryBootEntryOrder
0x180038AC8: "__cdecl _imp_LdrAddRefDll" __imp_LdrAddRefDll
0x18002A8C0: whNtQueryAuxiliaryCounterFrequency
0x1800387C0: "__cdecl _imp_NtLoadKeyEx" __imp_NtLoadKeyEx
0x1800343E0: whNtWow64QueryInformationProcess64
0x1800252D0: whNtCancelIoFile
0x180017430: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1800236F8: whNT32ThunkAllocTokenSecurityAttributeInformation32TO64
0x18004AC40: WindirFullObjectNameBuffer
0x180020660: CpuUpdateProcessorInformation
0x1800379A8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1800078F0: whNtSetTimerEx
0x180033830: whNtVdmControl
0x1800282A0: whNtEnumerateTransactionObject
0x18003A250: "\SysWOW64" ??_C@_1BE@MJECBGNO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?$AA@
0x180038448: "__cdecl _imp_NtAlpcQueryInformation" __imp_NtAlpcQueryInformation
0x180037940: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18002A6E0: whNtPrivilegeObjectAuditAlarm
0x18003A540: "InitializeContextMapper: GetRelo" ??_C@_0FG@CAODGCAF@InitializeContextMapper?3?5GetRelo@
0x18002D9E0: whNtQuerySystemInformation_SystemSystemPtesInformationEx
0x18004A7A0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUpvimvoyzhvUdldGEUlyquivUznwGEUpvimvoyzhvOlyq@mincsrbase" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUpvimvoyzhvUdldGEUlyquivUznwGEUpvimvoyzhvOlyq@mincsrbase
0x180033DF0: whNtWaitHighEventPair
0x18003B3E8: "Done copying pagefile informatio" ??_C@_0CD@LNBPELIM@Done?5copying?5pagefile?5informatio@
0x180038B08: wow64win_NULL_THUNK_DATA
0x18001FFEC: Wow64pCheckForSafeExecution
0x1800360D0: Wowx86NodeString
0x18003BC98: "NtSetTimerEx: Called with unsupp" ??_C@_0DB@MDAMNBDJ@NtSetTimerEx?3?5Called?5with?5unsupp@
0x1800388C8: "__cdecl _imp_NtCreateTimer" __imp_NtCreateTimer
0x180038178: "__cdecl _imp_NtListenPort" __imp_NtListenPort
0x180015AB0: whNtSecureConnectPort
0x18001F710: Wow64pThunkLegacyLpcMsgIn
0x18002CEE0: whNtQueryQuotaInformationFile
0x180038360: "__cdecl _imp_NtAlpcCreateSecurityContext" __imp_NtAlpcCreateSecurityContext
0x180022B08: whNT32QuerySystemSessionProcessInformation
0x18003C1A8: "DbgUiWaitWaitStateChange: DbgUnl" ??_C@_0DH@DDLHOHIK@DbgUiWaitWaitStateChange?3?5DbgUnl@
0x180013DD0: whNtAlpcSetInformation_AlpcAssociateCompletionPortInformation
0x1800383F8: "__cdecl _imp_NtLockVirtualMemory" __imp_NtLockVirtualMemory
0x180037B80: "__cdecl _imp_RtlCompleteProcessCloning" __imp_RtlCompleteProcessCloning
0x180030040: whNtSetDefaultUILanguage
0x180038258: "__cdecl _imp_NtDeleteFile" __imp_NtDeleteFile
0x18001F1B4: ThunkExceptionRecord64To32
0x180028640: whNtFindAtom
0x18001F574: Wow64SetupForInstrumentationReturn
0x18003A670: "Found inside %ws " ??_C@_0BC@DGPKMMPG@Found?5inside?5?$CFws?6?$AA@
0x18003B548: "NtAlpcQueryInformation: Called w" ??_C@_0DL@IDMFIEBO@NtAlpcQueryInformation?3?5Called?5w@
0x18004A798: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUzkkxlnkzgUdrmDCUdldGEUlyquivUznwGEUkivxlnkOlyq@Wow64Appcompat" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUzkkxlnkzgUdrmDCUdldGEUlyquivUznwGEUkivxlnkOlyq@Wow64Appcompat
0x18000E4DC: whNT32DeepThunkTokenGroups64TO32
0x180037A28: "__cdecl _imp_RtlCreateHashTable" __imp_RtlCreateHashTable
0x1800201C0: Wow64CallFunctionCfgDispatchControl
0x1800173A8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18002F960: whNtReplyWaitReplyPort
0x18000D7AC: whConvertExtendedMemoryParameters
0x180007D70: ConstructKernelKeyPath
0x180037958: "__cdecl _imp_NtRaiseException" __imp_NtRaiseException
0x180007950: whNtSetTimerEx_TimerSetCoalescableTimer
0x180034B70: whNtWow64CsrBasepSetClientTimeZoneInformation
0x180039F70: "BTCpuTurboThunkControl" ??_C@_0BH@ONHMFAII@BTCpuTurboThunkControl?$AA@
0x18003A9F8: "Filesystem redirection disabled " ??_C@_0CL@KFDFOFIG@Filesystem?5redirection?5disabled?5@
0x180037E38: "__cdecl _imp_NtFreeVirtualMemory" __imp_NtFreeVirtualMemory
0x180039A20: "Wow64pIsLegacyLpcPort: Incoming " ??_C@_0CM@HFFFBAK@Wow64pIsLegacyLpcPort?3?5Incoming?5@
0x18000CA70: whNtQueryInformationToken_TokenStatistics
0x180005FD0: whNtWow64IsProcessorFeaturePresent
0x18003D120: "ApphelpQueryModuleDataEx" ??_C@_0BJ@GFJGFLBK@ApphelpQueryModuleDataEx?$AA@
0x180038708: "__cdecl _imp_NtSetInformationKey" __imp_NtSetInformationKey
0x1800381F0: "__cdecl _imp_NtAssociateWaitCompletionPacket" __imp_NtAssociateWaitCompletionPacket
0x1800388A8: "__cdecl _imp_NtFreezeRegistry" __imp_NtFreezeRegistry
0x180027AC0: whNtCreateTransactionManager
0x180038A78: "__cdecl _imp_NtSaveKey" __imp_NtSaveKey
0x18002AC90: whNtQueryInformationFile_SpecialCase
0x180026720: whNtCreatePagingFile
0x18004A79C: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUpvimvoyzhvUwzbglmzfgroUlyquivUznwGEUpvimvoyzhvOlyq@kernelbaseutil" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUpvimvoyzhvUwzbglmzfgroUlyquivUznwGEUpvimvoyzhvOlyq@kernelbaseutil
0x180028FB0: whNtLoadEnclaveData
0x180038400: "__cdecl _imp_NtDeviceIoControlFile" __imp_NtDeviceIoControlFile
0x1800382C8: "__cdecl _imp_NtSetInformationSymbolicLink" __imp_NtSetInformationSymbolicLink
0x18003CE20: "\Media Type" ??_C@_1BI@IHAIEPGC@?$AA?2?$AAM?$AAe?$AAd?$AAi?$AAa?$AA?5?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180037A60: "__cdecl _imp_TpAllocWait" __imp_TpAllocWait
0x18001F0C4: Wow64pCpuInitializeStartupContext
0x180037AA8: "__cdecl _imp_NtMapViewOfSection" __imp_NtMapViewOfSection
0x180050018: pfnWow64LogInitialize
0x180037A80: "__cdecl _imp_LdrSystemDllInitBlock" __imp_LdrSystemDllInitBlock
0x180037B70: "__cdecl _imp_RtlPrepareForProcessCloning" __imp_RtlPrepareForProcessCloning
0x180038668: "__cdecl _imp_NtThawTransactions" __imp_NtThawTransactions
0x1800383C8: "__cdecl _imp_NtTerminateJobObject" __imp_NtTerminateJobObject
0x180037D70: "__cdecl _imp_NtSetEventBoostPriority" __imp_NtSetEventBoostPriority
0x180037FC8: "__cdecl _imp_NtSubscribeWnfStateChange" __imp_NtSubscribeWnfStateChange
0x1800293D0: whNtMakeTemporaryObject
0x18000C4C0: ThunkStartupContext64TO32
0x180022330: whNT32QuerySystemModuleInformation
0x1800060B0: whNT32QuerySecurityAttributesToken
0x1800387B8: "__cdecl _imp_NtOpenPartition" __imp_NtOpenPartition
0x18000E0D0: whNtAlpcCreatePortSection
0x1800388E0: "__cdecl _imp_NtQueryDirectoryFile" __imp_NtQueryDirectoryFile
0x180030288: whNtSetInformationFile_FileIoStatusBlockRangeInformation
0x180025BA0: whNtCreateEnlistment
0x180037D48: "__cdecl _imp_NtAccessCheckAndAuditAlarm" __imp_NtAccessCheckAndAuditAlarm
0x180003DA0: whNtTraceEvent
0x180031F70: whNtSetLowEventPair
0x18003D1D0: "SdbQueryContext" ??_C@_0BA@EJOHPCHF@SdbQueryContext?$AA@
0x180038318: "__cdecl _imp_NtQueryDirectoryFileEx" __imp_NtQueryDirectoryFileEx
0x180037DD8: "__cdecl _imp_NtGetNotificationResourceManager" __imp_NtGetNotificationResourceManager
0x180037C90: "__cdecl _imp_LdrControlFlowGuardEnforced" __imp_LdrControlFlowGuardEnforced
0x180022564: whNT32QuerySystemModuleInformationEx
0x180025E50: whNtCreateJobSet
0x180015FE0: whNtGetNlsSectionPtr
0x180026E40: whNtCreateResourceManager
0x18003A208: "%commonprogramfiles%" ??_C@_1CK@IAGEDDAF@?$AA?$CF?$AAc?$AAo?$AAm?$AAm?$AAo?$AAn?$AAp?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAf?$AAi?$AAl?$AAe?$AAs?$AA?$CF?$AA?$AA@
0x1800062F0: whNtWow64GetCurrentProcessorNumberEx
0x180050008: pfnWow64LogMessageArgList
0x180037A50: "__cdecl _imp_TpReleaseWait" __imp_TpReleaseWait
0x180038518: "__cdecl _imp_NtQueryInformationTransaction" __imp_NtQueryInformationTransaction
0x180038AE0: "__cdecl _imp_CsrCaptureMessageMultiUnicodeStringsInPlace" __imp_CsrCaptureMessageMultiUnicodeStringsInPlace
0x180039E10: "BTCpuNotifyProcessExecuteFlagsCh" ??_C@_0CF@KFCPDCID@BTCpuNotifyProcessExecuteFlagsCh@
0x180038368: "__cdecl _imp_NtDeleteBootEntry" __imp_NtDeleteBootEntry
0x18002A480: whNtOpenTransactionManager
0x180038790: "__cdecl _imp_NtGetCurrentProcessorNumberEx" __imp_NtGetCurrentProcessorNumberEx
0x1800330B0: whNtShutdownSystem
0x18004AE94: CachedMachine
0x18003A358: "\WowAA64Node" ??_C@_1BK@BOJDEMAO@?$AA?2?$AAW?$AAo?$AAw?$AAA?$AAA?$AA6?$AA4?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x180013160: whNtWow64CsrBasepCreateProcess
0x180037FF8: "__cdecl _imp_NtWorkerFactoryWorkerReady" __imp_NtWorkerFactoryWorkerReady
0x180038348: "__cdecl _imp_NtTranslateFilePath" __imp_NtTranslateFilePath
0x180037C88: "__cdecl _imp_RtlTestBitEx" __imp_RtlTestBitEx
0x18000F230: Wow64AllocThreadHeap
0x180031940: whNtSetInformationToken
0x18000E514: Wow64pDispatchException
0x180029A90: whNtOpenEventPair
0x1800297A0: whNtModifyDriverEntry
0x180016F60: whNtShutdownWorkerFactory
0x180034C80: whNtWow64CsrBasepSoundSentryNotification
0x180038428: "__cdecl _imp_NtIsProcessInJob" __imp_NtIsProcessInJob
0x180005760: whNtSetInformationProcess
0x180011420: Wow64pConvertProcessParameters
0x1800232E4: whNT32ShallowThunkAllocTokenGroups32TO64
0x18001E210: Wow64NotifyDebuggerHelper
0x180016BB0: whNtUnlockFile
0x18002FB90: whNtRollforwardTransactionManager
0x18000F2C0: CpuNotifyAllocateVirtualMemory
0x1800387B0: "__cdecl _imp_NtClearEvent" __imp_NtClearEvent
0x1800383A8: "__cdecl _imp_NtSetIntervalProfile" __imp_NtSetIntervalProfile
0x1800362D0: sdwhnt32
0x180030810: whNtSetInformationFile_FileReplaceCompletionInformation
0x18002C4C0: whNtQueryInformationWorkerFactory
0x18002144C: whNT32DeepThunkSidAndAttributesArray32TO64Length
0x18000E19C: whNT32DeepThunkSidAndAttributesArray64TO32Length
0x18003D1F8: "SXS: %s() CsrCaptureMessageMulti" ??_C@_0DO@LLIHLPEN@SXS?3?5?$CFs?$CI?$CJ?5CsrCaptureMessageMulti@
0x1800016BC: CpuLoadBinaryTranslator
0x180037C50: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x180020260: Wow64CallFunctionQueryProcessDebugInfo
0x18003B238: "NtQueryInformationThread: Called" ??_C@_0DN@BDIDKOJI@NtQueryInformationThread?3?5Called@
0x180036160: arm64Dir
0x18004A790: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUdrmDCUxorvmgUdldGEUlyquivUznwGEUyzhvwooOlyq@csrbase" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUdrmDCUxorvmgUdldGEUlyquivUznwGEUyzhvwooOlyq@csrbase
0x18003B140: "NtQueryKey: called with unsuppor" ??_C@_0DB@JJNJPIGB@NtQueryKey?3?5called?5with?5unsuppor@
0x18003A318: "\Wow6464Node" ??_C@_1BK@JDOKLMCN@?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA6?$AA4?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x180014F90: whNtQuerySystemInformation_SystemFileCacheInformation
0x180037E68: "__cdecl _imp_NtCreateProcessEx" __imp_NtCreateProcessEx
0x180033D30: whNtWaitForKeyedEvent
0x180038B00: "__cdecl _imp_sdwhwin32" __imp_sdwhwin32
0x18003B1F8: "NtQueryVirtualMemory: Called wit" ??_C@_0DJ@JPOHJJH@NtQueryVirtualMemory?3?5Called?5wit@
0x1800036C0: whNtQueryWnfStateData
0x18002339C: whNT32ShallowThunkAllocUnicodeStringArray32TO64
0x180028170: whNtDrawText
0x1800382F0: "__cdecl _imp_NtReplyWaitReceivePort" __imp_NtReplyWaitReceivePort
0x180038370: "__cdecl _imp_NtCancelWaitCompletionPacket" __imp_NtCancelWaitCompletionPacket
0x18003987C: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x180038838: "__cdecl _imp_NtAlpcCreatePort" __imp_NtAlpcCreatePort
0x18000B3F0: whNtQueryInformationProcess
0x180038758: "__cdecl _imp_NtReplaceKey" __imp_NtReplaceKey
0x180007254: CpuNotifyUnmapViewOfSection
0x180016220: whNtGetWriteWatch
0x180023D70: whNtAccessCheckByTypeAndAuditAlarm
0x18003ACF8: "Wow64LdrpInitialize: ProcessInit" ??_C@_0DD@OHPBELCA@Wow64LdrpInitialize?3?5ProcessInit@
0x1800029FC: whNtQuerySystemInformation_SpecialQueryCase
0x180038558: "__cdecl _imp_CsrClientConnectToServer" __imp_CsrClientConnectToServer
0x18000C0FC: whNtQueryInformationToken_TokenProcessTrustLevel
0x1800230BC: whNT32ShallowThunkAllocFqbnArray32TO64
0x180038528: "__cdecl _imp_NtCreatePrivateNamespace" __imp_NtCreatePrivateNamespace
0x180039778: "%s%s" ??_C@_19LJDFFCJJ@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$AA@
0x180028E40: whNtInitializeRegistry
0x180013770: whNtOpenProcessTokenEx
0x18001EC44: Wow64NtCreateThread
0x180016E1C: whNtSetInformationProcessThreadStackAllocation
0x18003AEE8: "Wow64pGetLegacyLpcPortName: fail" ??_C@_0CK@NPCKLBLO@Wow64pGetLegacyLpcPortName?3?5fail@
0x18000C1F0: whNtQueryInformationToken_TokenDefaultDacl
0x180039810: "Wow64Transition" ??_C@_0BA@LLBDFIDC@Wow64Transition?$AA@
0x180037E90: "__cdecl _imp_NtLockRegistryKey" __imp_NtLockRegistryKey
0x18003BF28: "DbgUiWaitWaitStateChange: DbgIdl" ??_C@_0CD@ILNPPMJP@DbgUiWaitWaitStateChange?3?5DbgIdl@
0x180015A40: whNtSetInformationFile_FileEndOfFileInformation
0x18000EED0: whNtSetSecurityObject
0x180026F70: whNtCreateSectionEx
0x18003BC58: "NtSetSystemInformation: Called w" ??_C@_0DL@JDFMDLEG@NtSetSystemInformation?3?5Called?5w@
0x180012E90: whNtCreateIoCompletion
0x1800386E0: "__cdecl _imp_NtAdjustTokenClaimsAndDeviceGroups" __imp_NtAdjustTokenClaimsAndDeviceGroups
0x180038738: "__cdecl _imp_NtPrivilegeCheck" __imp_NtPrivilegeCheck
0x18002E950: whNtQueryWnfStateNameInformation
0x18001E5AC: Wow64EmulateX86Int
0x180007630: Wow64SystemServiceEx
0x180032EA0: whNtSetSystemPowerState
0x18003CE80: "\Microsoft\Windows\CurrentVersio" ??_C@_1HG@DJPIFFNN@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo@
0x1800380A8: "__cdecl _imp_NtDebugActiveProcess" __imp_NtDebugActiveProcess
0x180037F90: "__cdecl _imp_NtUnloadDriver" __imp_NtUnloadDriver
0x18002EC50: whNtReadFileScatter
0x180006000: whNtUnmapViewOfSection
0x180038990: "__cdecl _imp_NtReadRequestData" __imp_NtReadRequestData
0x180038730: "__cdecl _imp_NtRollbackEnlistment" __imp_NtRollbackEnlistment
0x180025540: whNtCommitEnlistment
0x180022918: whNT32QuerySystemSessionPoolTagInformation
0x18001F330: Wow64PassExceptionToGuest
0x180038008: "__cdecl _imp_NtFlushInstallUILanguage" __imp_NtFlushInstallUILanguage
0x1800147A8: whNtSetInformationFile_FileBasicInformation
0x180039F40: "BTCpuNotifyMemoryFree" ??_C@_0BG@FKJCMBMA@BTCpuNotifyMemoryFree?$AA@
0x180038680: "__cdecl _imp_NtFilterTokenEx" __imp_NtFilterTokenEx
0x180025460: whNtClose
0x180002068: RtlStringCbPrintfW
0x18003B330: "Determing the required size for " ??_C@_0DN@BMNNNMHP@Determing?5the?5required?5size?5for?5@
0x180038098: "__cdecl _imp_NtFlushBuffersFileEx" __imp_NtFlushBuffersFileEx
0x180025DB0: whNtCreateJobObject
0x180017070: Wow64pInvalidUserCallTarget
0x1800288C0: whNtFsControlFile
0x1800382D0: "__cdecl _imp_NtAccessCheckByTypeResultList" __imp_NtAccessCheckByTypeResultList
0x180005490: whNtOpenEvent
0x1800122C0: whNtAlpcConnectPort
0x180037B28: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x180039F98: "BTCpuGetContext" ??_C@_0BA@BJEBLMKF@BTCpuGetContext?$AA@
0x180036170: WowArmNodeString
0x180037ED8: "__cdecl _imp_CsrAllocateMessagePointer" __imp_CsrAllocateMessagePointer
0x1800384E8: "__cdecl _imp_NtCreateEnclave" __imp_NtCreateEnclave
0x180037FB8: "__cdecl _imp_NtCreateWnfStateName" __imp_NtCreateWnfStateName
0x180030B04: whNtSetInformationJobObject_JobObjectAssociateCompletionPortInformation
0x180037CE0: "__cdecl _imp_RtlIsCurrentProcess" __imp_RtlIsCurrentProcess
0x180003DD0: whNtQuerySecurityObject
0x1800384F8: "__cdecl _imp_NtQuerySemaphore" __imp_NtQuerySemaphore
0x180006320: whNtUnmapViewOfSectionEx
0x18003A6E0: "InitialPC %p found in the space " ??_C@_0DI@ELAAIIKC@InitialPC?5?$CFp?5found?5in?5the?5space?5@
0x18002FCD0: whNtSetBootOptions
0x180017090: "__cdecl DllMainCRTStartupForGS" _DllMainCRTStartupForGS
0x180011CAC: whNtQuerySystemInformationEx_SpecialQueryCase
0x180028350: whNtFilterToken
0x18001F8DC: Wow64pThunkLegacyLpcMsgOut
0x180038880: "__cdecl _imp_NtAlpcDeleteSecurityContext" __imp_NtAlpcDeleteSecurityContext
0x1800386B8: "__cdecl _imp_NtTraceControl" __imp_NtTraceControl
0x180039770: "x86" ??_C@_17NIABIIAO@?$AAx?$AA8?$AA6?$AA?$AA@
0x1800331E0: whNtSuspendThread
0x18002EA10: whNtRaiseHardError
0x1800382A0: "__cdecl _imp_NtQueryDriverEntryOrder" __imp_NtQueryDriverEntryOrder
0x180024AE0: whNtAllocateUserPhysicalPages
0x1800388B8: "__cdecl _imp_NtCreateFile" __imp_NtCreateFile
0x1800387C8: "__cdecl _imp_NtSetSystemEnvironmentValue" __imp_NtSetSystemEnvironmentValue
0x18000DBB4: whNtWow64GetNativeSystemInformation_SystemBasicInformation
0x180037690: Wow64FunctionDispatch64
0x1800139B0: whNtAlpcAcceptConnectPort
0x18003B048: "NtSetInformationThread: Called w" ??_C@_0DL@DAMPADDP@NtSetInformationThread?3?5Called?5w@
0x180003D70: whNtAlpcImpersonateClientOfPort
0x180037FE8: "__cdecl _imp_NtPropagationComplete" __imp_NtPropagationComplete
0x180038B10: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180028890: whNtFreezeTransactions
0x180050040: Ntdll32LoaderInitRoutine
0x180029080: whNtLoadKey
0x180017348: RtlLookupFunctionEntry
0x1800317D8: whNtSetInformationThread_ThreadCounterProfiling
0x180034210: whNtWow64CsrVerifyRegion
0x1800385C8: "__cdecl _imp_NtAccessCheckByType" __imp_NtAccessCheckByType
0x180036050: System32Exempts
0x18000D1C0: Run64IfContextIs64
0x18002EF90: whNtReleaseWorkerFactoryWorker
0x180030300: whNtSetInformationFile_FileLinkInformationEx
0x180037B78: "__cdecl _imp_NtCreateUserProcess" __imp_NtCreateUserProcess
0x180038710: "__cdecl _imp_NtQueryDefaultUILanguage" __imp_NtQueryDefaultUILanguage
0x18000EF10: whNtWriteVirtualMemory
0x180032F00: whNtSetThreadExecutionState
0x180037FA8: "__cdecl _imp_NtUnloadKeyEx" __imp_NtUnloadKeyEx
0x180037B08: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1800293A0: whNtMakePermanentObject
0x18000EDE0: whNtQuerySystemInformation_SystemCodeIntegrityPolicyInformation
0x180037CD8: "__cdecl _imp_RtlWow64PushCrossProcessWork" __imp_RtlWow64PushCrossProcessWork
0x180038890: "__cdecl _imp_NtCompareTokens" __imp_NtCompareTokens
0x180038430: "__cdecl _imp_NtRecoverEnlistment" __imp_NtRecoverEnlistment
0x180038980: "__cdecl _imp_CsrAllocateCaptureBuffer" __imp_CsrAllocateCaptureBuffer
0x18001FA8C: CfgAddressToBitState
0x180034BA0: whNtWow64CsrBasepSetProcessShutdownParam
0x1800380F0: "__cdecl _imp_NtReadOnlyEnlistment" __imp_NtReadOnlyEnlistment
0x180001C50: InitializeWindirFullObjectName
0x18003C3D0: "whNtWow64CsrAllocateCaptureBuffe" ??_C@_0PB@MBNDHDFA@whNtWow64CsrAllocateCaptureBuffe@
0x180030C28: whNtSetInformationJobObject_JobObjectCycleTimeNotification
0x180015710: whNtQuerySection
0x180038458: "__cdecl _imp_NtCreateProfile" __imp_NtCreateProfile
0x180020A84: whMapViewOfSectionCommonPost
0x18001736C: NtTerminateProcess
0x180038478: "__cdecl _imp_NtOpenSession" __imp_NtOpenSession
0x1800300A0: whNtSetEaFile
0x180037C60: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x18003A790: "Wow64RaiseException: Failed to e" ??_C@_0ED@BJDCPPNL@Wow64RaiseException?3?5Failed?5to?5e@
0x180038778: "__cdecl _imp_NtPropagationFailed" __imp_NtPropagationFailed
0x180037BF0: "__cdecl _imp_NtWaitForAlertByThreadId" __imp_NtWaitForAlertByThreadId
0x180039F20: "BTCpuNotifyMemoryProtect" ??_C@_0BJ@BGLKOJDP@BTCpuNotifyMemoryProtect?$AA@
0x1800137D0: whNtOpenThreadTokenEx
0x180038450: "__cdecl _imp_NtApphelpCacheControl" __imp_NtApphelpCacheControl
0x180016A80: whNtLockFile
0x180038228: "__cdecl _imp_CsrGetProcessId" __imp_CsrGetProcessId
0x180038158: "__cdecl _imp_NtImpersonateThread" __imp_NtImpersonateThread
0x1800387F8: "__cdecl _imp_NtSaveKeyEx" __imp_NtSaveKeyEx
0x180024700: whNtAdjustGroupsToken
0x1800148C8: whNtSetInformationFile_FileRenameInformationEx
0x180037B48: "__cdecl _imp_NtOpenThread" __imp_NtOpenThread
0x180016444: whNT32QuerySystemProcessInformationEx
0x180024D00: whNtAlpcOpenSenderProcess
0x18003CB20: "whNtWow64CsrCaptureMessageString" ??_C@_0CN@KLPCOGIM@whNtWow64CsrCaptureMessageString@
0x18000DD70: whNtAlpcConnectPortEx
0x180033F50: whNtWow64CsrAllocateMessagePointer
0x180034294: whNtWow64GetNativeSystemInformation_SystemEmulationBasicInformation
0x180039738: "%s\system32\wow64log.dll" ??_C@_1DC@DPDGIDGF@?$AA?$CF?$AAs?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAw?$AAo?$AAw?$AA6?$AA4?$AAl?$AAo?$AAg?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180029890: whNtNotifyChangeDirectoryFileEx
0x18004AEA0: gApphelpGlobals
0x1800386C8: "__cdecl _imp_NtCreateWorkerFactory" __imp_NtCreateWorkerFactory
0x180037E18: "__cdecl _imp_NtAccessCheckByTypeResultListAndAuditAlarmByHandle" __imp_NtAccessCheckByTypeResultListAndAuditAlarmByHandle
0x180025230: whNtAssignProcessToJobObject
0x18002B438: whNtQueryInformationJobObject_JobObjectNetRateControlInformation
0x180039E58: "BTCpuUseChpeFile" ??_C@_0BB@FJHMLGFG@BTCpuUseChpeFile?$AA@
0x18002AB80: whNtQueryInformationByName
0x18001F280: Wow64HandleSystemServiceError
0x1800386F0: "__cdecl _imp_NtQuerySystemEnvironmentValueEx" __imp_NtQuerySystemEnvironmentValueEx
0x18000B9FC: whNtQueryInformationProcess_SpecialQueryCase
0x180038268: "__cdecl _imp_NtSetBootEntryOrder" __imp_NtSetBootEntryOrder
0x180037DD0: "__cdecl _imp_NtAlpcDeletePortSection" __imp_NtAlpcDeletePortSection
0x180032E00: whNtSetSystemInformation_SystemVerifierInformationEx
0x180033650: whNtUmsThreadYield
0x180038958: "__cdecl _imp_NtWriteRequestData" __imp_NtWriteRequestData
0x18003185C: whNtSetInformationThread_ThreadNameInformation
0x180026550: whNtCreateNamedPipeFile
0x18000D164: CpuThreadInit
0x180038060: "__cdecl _imp_NtOpenResourceManager" __imp_NtOpenResourceManager
0x18002B03C: whNtQueryInformationJobObject_JobObjectBasicLimitInformation
0x1800334B0: whNtTerminateProcess
0x180008BC0: whNtQueryVirtualMemory
0x18002FAA0: whNtRevertContainerImpersonation
0x180004C94: RedirectDosPath
0x180016D2C: whNtQueryInformationThread_ThreadTimes
0x1800246A0: whNtAddBootEntry
0x18000C6F0: whNT32QuerySystemInformation
0x180038660: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x1800380F8: "__cdecl _imp_NtSetInformationObject" __imp_NtSetInformationObject
0x180013148: WriteReturnLengthSilent
0x180037E98: "__cdecl _imp_NtNotifyChangeSession" __imp_NtNotifyChangeSession
0x180034E10: CsrBasepSetClientTimeZoneInformation
0x1800389F0: "__cdecl _imp_NtAlertResumeThread" __imp_NtAlertResumeThread
0x18003AFC8: "OutputBufferLength = %lx, Output" ??_C@_0CN@OKMBMIDK@OutputBufferLength?5?$DN?5?$CFlx?0?5Output@
0x1800383A0: "__cdecl _imp_NtSetDefaultHardErrorPort" __imp_NtSetDefaultHardErrorPort
0x18000EC4C: Wow64NtContinue
0x180022054: whNT32QuerySystemHandleInformation
0x180038588: "__cdecl _imp_NtUnlockVirtualMemory" __imp_NtUnlockVirtualMemory
0x180030210: whNtSetInformationDebugObject
0x18003B01C: "%s" ??_C@_15GANGMFKL@?$AA?$CF?$AAs?$AA?$AA@
0x180038608: "__cdecl _imp_NtQueryLicenseValue" __imp_NtQueryLicenseValue
0x180030888: whNtSetInformationFile_FileValidDataLengthInformation
0x180036040: x86Dir
0x180028210: whNtEnumerateBootEntries
0x18001FB04: KiQueryNxThunkEmulationState
0x180038690: "__cdecl _imp_NtAllocateVirtualMemoryEx" __imp_NtAllocateVirtualMemoryEx
0x180038970: "__cdecl _imp_NtSetVolumeInformationFile" __imp_NtSetVolumeInformationFile
0x180038888: "__cdecl _imp_NtQuerySecurityAttributesToken" __imp_NtQuerySecurityAttributesToken
0x180014720: whNtWow64WriteVirtualMemory64
0x180014EE0: whNtCancelTimer2
0x1800245C0: whNtAcquireProcessActivityReference
0x1800327FC: whNtSetSystemInformation_SystemCodeIntegrityPolicyInformation
0x1800384C8: "__cdecl _imp_NtQueryIoCompletion" __imp_NtQueryIoCompletion
0x1800389E8: "__cdecl _imp_NtAlpcSendWaitReceivePort" __imp_NtAlpcSendWaitReceivePort
0x180037DF8: "__cdecl _imp_NtSetHighWaitLowEventPair" __imp_NtSetHighWaitLowEventPair
0x18003980C: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1800384B0: "__cdecl _imp_NtMapUserPhysicalPagesScatter" __imp_NtMapUserPhysicalPagesScatter
0x1800379E0: "__cdecl _imp_LdrLoadDll" __imp_LdrLoadDll
0x180038A50: "__cdecl _imp_NtQueryKey" __imp_NtQueryKey
0x18000A7E0: whNtWaitForWorkViaWorkerFactory
0x180027D60: whNtDebugContinue
0x180038580: "__cdecl _imp_NtOpenObjectAuditAlarm" __imp_NtOpenObjectAuditAlarm
0x180038868: "__cdecl _imp_NtQueryVolumeInformationFile" __imp_NtQueryVolumeInformationFile
0x180030300: whNtSetInformationFile_FileLinkInformation
0x18002CD80: whNtQueryOpenSubKeys
0x1800388F0: "__cdecl _imp_NtRecoverResourceManager" __imp_NtRecoverResourceManager
0x180036140: amd64Dir
0x180039F58: "BTCpuNotifyMemoryAlloc" ??_C@_0BH@GHKELLBC@BTCpuNotifyMemoryAlloc?$AA@
0x180050010: pfnWow64LogSystemService
0x180037E30: "__cdecl _imp_NtFlushWriteBuffer" __imp_NtFlushWriteBuffer
0x1800206BC: Wow64ArchGetContextFlags
0x18002B2A8: whNtQueryInformationJobObject_JobObjectLimitViolationInformation2
0x18004A9D0: LegacyLpcPortName
0x180037BA8: "__cdecl _imp_NtCreateThread" __imp_NtCreateThread
0x18003B1B8: "NtQueryInformationToken: Called " ??_C@_0DM@DKMGHBAA@NtQueryInformationToken?3?5Called?5@
0x180027F70: whNtDeletePrivateNamespace
0x180038510: "__cdecl _imp_NtRequestWaitReplyPort" __imp_NtRequestWaitReplyPort
0x1800036F8: whNtSetInformationProcess_SpecialSetCase
0x180038A80: "__cdecl _imp_NtRenameKey" __imp_NtRenameKey
0x18002A670: whNtPrepareEnlistment
0x18004AE78: Kernel32Exports32
0x180037DF0: "__cdecl _imp_NtResetEvent" __imp_NtResetEvent
0x1800055C4: RedirectObjectAttributes
0x1800331B0: whNtSuspendProcess
0x18002B9A8: whNtQueryInformationProcess_ProcessDebugPort
0x180038A48: "__cdecl _imp_RtlWow64IsWowGuestMachineSupported" __imp_RtlWow64IsWowGuestMachineSupported
0x180037D98: "__cdecl _imp_NtSetIRTimer" __imp_NtSetIRTimer
0x18002FFB0: whNtSetDebugFilterState
0x180037D60: "__cdecl _imp_NtReplacePartitionUnit" __imp_NtReplacePartitionUnit
0x18003AFF8: "arm" ??_C@_17JDKADKH@?$AAa?$AAr?$AAm?$AA?$AA@
0x180037DC0: "__cdecl _imp_NtRollbackComplete" __imp_NtRollbackComplete
0x180014F50: whNtAdjustPrivilegesToken
0x180013F70: whNtWow64CsrBasepNlsGetUserInfo
0x180037B68: "__cdecl _imp_NtResumeThread" __imp_NtResumeThread
0x18003A160: "\regedit.exe" ??_C@_1BK@DBPENGDH@?$AA?2?$AAr?$AAe?$AAg?$AAe?$AAd?$AAi?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x1800203C8: CpuNotifyProtectVirtualMemoryLocal
0x18003CBB0: "%s" ??_C@_02DKCKIIND@?$CFs?$AA@
0x1800032BC: whNtQueryInformationThread_SpecialQueryCase
0x1800360E0: SysnativeName
0x180026180: whNtCreateLowBoxToken
0x180029340: whNtLockProductActivationKeys
0x180038860: "__cdecl _imp_NtOpenEnlistment" __imp_NtOpenEnlistment
0x18003AB20: "Wow64SuspendLocalThread : failed" ??_C@_0DO@MHNJFL@Wow64SuspendLocalThread?5?3?5failed@
0x180037EF0: "__cdecl _imp_NtCreateDirectoryObjectEx" __imp_NtCreateDirectoryObjectEx
0x180025260: whNtCallEnclave
0x18003A1E8: "%ProgramFiles%" ??_C@_1BO@DFHEBLHG@?$AA?$CF?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$CF?$AA?$AA@
0x180021048: whNT32CopyoutTokenAccessInformation
0x1800379A0: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x1800141A0: whNtGetCompleteWnfStateSubscription
0x1800379C0: "__cdecl _imp__vsnprintf" __imp__vsnprintf
0x18003A2E8: "\SysX8664" ??_C@_1BE@LDACLHGL@?$AA?2?$AAS?$AAy?$AAs?$AAX?$AA8?$AA6?$AA6?$AA4?$AA?$AA@
0x180017300: "__cdecl _security_check_cookie" __security_check_cookie
0x180033120: whNtSinglePhaseReject
0x18003B3C8: "Copying pagefile information " ??_C@_0BO@EPIJPGHH@Copying?5pagefile?5information?6?$AA@
0x180037E28: "__cdecl _imp_NtCancelSynchronousIoFile" __imp_NtCancelSynchronousIoFile
0x180050020: Ntdll32KiUserCallbackDispatcher
0x18002AAC0: whNtQueryEaFile
0x180021C58: whNT32QuerySystemCoverageInformation
0x18001F648: Wow64SkipOverBreakPoint
0x18002C3AC: whNtQueryInformationTransaction_TransactionPropertiesInformation
0x18001F500: Wow64PrepareForDebuggerAttach
0x18003CDE0: "\CLSID" ??_C@_1O@HEJDOEN@?$AA?2?$AAC?$AAL?$AAS?$AAI?$AAD?$AA?$AA@
0x18002A610: whNtPrePrepareEnlistment
0x180024A50: whNtAlertThread
0x18000AB30: whNtQueryInformationFile
0x180038248: "__cdecl _imp_NtQueryInformationJobObject" __imp_NtQueryInformationJobObject
0x180037EE8: "__cdecl _imp_NtThawRegistry" __imp_NtThawRegistry
0x18003A0D0: "BTCpuResetFloatingPoint" ??_C@_0BI@HDDDPNIE@BTCpuResetFloatingPoint?$AA@
0x180039B90: "\drivers\etc" ??_C@_1BK@LMDOPANL@?$AA?2?$AAd?$AAr?$AAi?$AAv?$AAe?$AAr?$AAs?$AA?2?$AAe?$AAt?$AAc?$AA?$AA@
0x180037F00: "__cdecl _imp_NtDuplicateToken" __imp_NtDuplicateToken
0x1800129C0: whNtOpenSemaphore
0x180013C90: whNtDeleteValueKey
0x180038230: "__cdecl _imp_NtIsUILanguageComitted" __imp_NtIsUILanguageComitted
0x18003B508: "NtSetInformationObject: called w" ??_C@_0DN@HJFJAGBL@NtSetInformationObject?3?5called?5w@
0x18002F580: whNtReplyPort
0x1800328D4: whNtSetSystemInformation_SystemExtendServiceTableInformation
0x1800385F8: "__cdecl _imp_NtSetTimerResolution" __imp_NtSetTimerResolution
0x1800384C0: "__cdecl _imp_NtCancelIoFile" __imp_NtCancelIoFile
0x180022C58: whNT32QuerySystemVerifierCancellationInformation
0x1800381B0: "__cdecl _imp_NtSetTimerEx" __imp_NtSetTimerEx
0x180037E08: "__cdecl _imp_NtQueryBootEntryOrder" __imp_NtQueryBootEntryOrder
0x1800291D0: whNtLoadKeyEx
0x18003A7E0: "Wow64RaiseException: Wow64pDispa" ??_C@_0EE@KBINFJNG@Wow64RaiseException?3?5Wow64pDispa@
0x180037E40: "__cdecl _imp_NtQueryAuxiliaryCounterFrequency" __imp_NtQueryAuxiliaryCounterFrequency
0x18003BAC8: "NtQuerySystemInformationEx: Call" ??_C@_0DP@LEOHMGLD@NtQuerySystemInformationEx?3?5Call@
0x18003CC10: "NtWow64QueryInformationProcess64" ??_C@_0EF@MNIAKEFI@NtWow64QueryInformationProcess64@
0x1800386D0: "__cdecl _imp_CsrVerifyRegion" __imp_CsrVerifyRegion
0x180005558: Wow64DetermineEnvironment
0x18000D944: whSepCopyoutSecurityAttributes
0x18002D280: whNtQuerySystemEnvironmentValue
0x180031C10: whNtSetInformationTransaction
0x180038850: "__cdecl _imp_NtReleaseSemaphore" __imp_NtReleaseSemaphore
0x1800382E0: "__cdecl _imp_NtPrivilegedServiceAuditAlarm" __imp_NtPrivilegedServiceAuditAlarm
0x18002E76C: whNtQuerySystemInformation_SystemVerifierInformationEx
0x18000E990: CpuSetInstructionPointer
0x180050024: Ntdll32KiUserApcDispatcher
0x18002EE40: whNtRecoverTransactionManager
0x180027FD0: whNtDeleteWnfStateName
0x180037FE0: "__cdecl _imp_NtSetDefaultUILanguage" __imp_NtSetDefaultUILanguage
0x180030764: whNtSetInformationFile_FileQuotaInformation
0x180027E90: whNtDeleteFile
0x18003A438: "ProcessInit: CpuProcessInit fail" ??_C@_0CP@JJJLIMNB@ProcessInit?3?5CpuProcessInit?5fail@
0x18003CC58: "\system32\" ??_C@_1BG@NCCDOFIB@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AA?$AA@
0x180038028: "__cdecl _imp_NtFindAtom" __imp_NtFindAtom
0x1800150D0: whNtQuerySystemInformation_SystemMemoryListInformation
0x180012570: whNtAlpcCreateSecurityContext
0x180038080: "__cdecl _imp_NtQueryQuotaInformationFile" __imp_NtQueryQuotaInformationFile
0x180039F88: "BTCpuSetContext" ??_C@_0BA@HGOALOM@BTCpuSetContext?$AA@
0x18001F9A8: Wow64pThunkLegacyRemoteViewIn
0x18000EF90: whNtLockVirtualMemory
0x18003BD18: "NtSystemDebugControl: Called wit" ??_C@_0DJ@BNNFNIKB@NtSystemDebugControl?3?5Called?5wit@
0x180036150: WowArm64NodeString
0x1800174BB: "__cdecl _chkstk" __chkstk
0x18003A0E8: "BTCpuSimulate" ??_C@_0O@EPMALDJM@BTCpuSimulate?$AA@
0x18003CCF0: "\{36BBB745-0999-4FD8-A538-4D4D84" ??_C@_1FA@NMDPIOEE@?$AA?2?$AA?$HL?$AA3?$AA6?$AAB?$AAB?$AAB?$AA7?$AA4?$AA5?$AA?9?$AA0?$AA9?$AA9?$AA9?$AA?9?$AA4?$AAF?$AAD?$AA8?$AA?9?$AAA?$AA5?$AA3?$AA8?$AA?9?$AA4?$AAD?$AA4?$AAD?$AA8?$AA4@
0x180013910: whNtCreateTimer
0x18004AE88: Wow64InfoPtr
0x180028F10: whNtListenPort
0x1800385C0: "__cdecl _imp_NtSecureConnectPort" __imp_NtSecureConnectPort
0x1800012CC: Wow64InitializeEmulatedSystemInformation
0x180036120: armDir
0x18003BA90: "NtQuerySemaphore: called with un" ??_C@_0DH@LDGPMCLF@NtQuerySemaphore?3?5called?5with?5un@
0x1800382D8: "__cdecl _imp_NtEnumerateTransactionObject" __imp_NtEnumerateTransactionObject
0x18003D0F0: "\system32\apphelp.dll" ??_C@_1CM@MGBODBPC@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAa?$AAp?$AAp?$AAh?$AAe?$AAl?$AAp?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18001EDE0: Wow64NtSetContextThread
0x180014E00: whNtWow64AllocateVirtualMemory64
0x18000AF30: whNtAlpcQueryInformation
0x180034460: whNtWow64ReadVirtualMemory64
0x1800379E8: "__cdecl _imp_RtlInitAnsiString" __imp_RtlInitAnsiString
0x180038088: "__cdecl _imp_NtPrivilegeObjectAuditAlarm" __imp_NtPrivilegeObjectAuditAlarm
0x1800383E8: "__cdecl _imp_CsrIdentifyAlertableThread" __imp_CsrIdentifyAlertableThread
0x180037FD8: "__cdecl _imp_NtWaitHighEventPair" __imp_NtWaitHighEventPair
0x18000E2C8: whNtQuerySystemInformation_SystemRangeStartInformation
0x18002FBC0: whNtSaveKey
0x180038810: "__cdecl _imp_NtCreatePagingFile" __imp_NtCreatePagingFile
0x180038670: "__cdecl _imp_NtLoadEnclaveData" __imp_NtLoadEnclaveData
0x180037AA0: "__cdecl _imp_LdrGetKnownDllSectionHandle" __imp_LdrGetKnownDllSectionHandle
0x1800064A0: whNtFreeVirtualMemory
0x1800313F0: whNtSetInformationKey
0x18000B2D0: whNtAssociateWaitCompletionPacket
0x180028860: whNtFreezeRegistry
0x180038910: "__cdecl _imp_NtCreateTransactionManager" __imp_NtCreateTransactionManager
0x18003AB60: "Wow64SuspendLocalThread : CpuSus" ??_C@_0DM@MIPNDFKF@Wow64SuspendLocalThread?5?3?5CpuSus@
0x1800383E0: "__cdecl _imp_NtReplyWaitReplyPort" __imp_NtReplyWaitReplyPort
0x18001E81C: ConstructNtPathUsingRootDirectory
0x18000EDC0: whNtRaiseException
0x18000ED80: CpuSetContext
0x1800202C8: CpuFlushInstructionCacheLocal
0x180037CC8: "__cdecl _imp_RtlIsProcessorFeaturePresent" __imp_RtlIsProcessorFeaturePresent
0x180034EEC: CsrBasepRefreshIniFileMapping
0x18003D1A0: "SdbReleaseDatabase" ??_C@_0BD@JBPJCCEK@SdbReleaseDatabase?$AA@
0x180039C00: sdwhnt32Number
0x180037D80: "__cdecl _imp_NtCreateEnlistment" __imp_NtCreateEnlistment
0x180023BD0: whNtAccessCheckAndAuditAlarm
0x180050038: Peb32
0x180037E50: "__cdecl _imp_NtTraceEvent" __imp_NtTraceEvent
0x180012E14: Wow64pIsLegacyLpcPort
0x180029C70: whNtOpenKeyTransacted
0x1800381C0: "__cdecl _imp_NtSetLowEventPair" __imp_NtSetLowEventPair
0x180033480: whNtTerminateJobObject
0x180030150: whNtSetEventBoostPriority
0x1800396B0: "\system32" ??_C@_1BE@MCHPLFCF@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x180012600: whNtSubscribeWnfStateChange
0x18003B2B8: "NtEnumerateKey: called with unsu" ??_C@_0DF@FKIDCIPB@NtEnumerateKey?3?5called?5with?5unsu@
0x18003C038: "DbgUiWaitWaitStateChange: DbgExi" ??_C@_0DJ@NJJHHDGC@DbgUiWaitWaitStateChange?3?5DbgExi@
0x18000E03C: Wow64ShallowThunkAllocSecurityDescriptor32TO64_FNC
0x180038848: "__cdecl _imp_NtMakeTemporaryObject" __imp_NtMakeTemporaryObject
0x180030C28: whNtSetInformationJobObject_JobObjectCompletionCounter
0x180039680: "Initializing context mapper " ??_C@_0BN@DLHNKAIP@Initializing?5context?5mapper?6?$AA@
0x18002A080: whNtOpenPartition
0x18000F370: whNtQueryDirectoryFile
0x1800105E4: Wow64NtCreateUserProcess
0x180038A08: "__cdecl _imp_NtAlpcCreatePortSection" __imp_NtAlpcCreatePortSection
0x18000D2C4: whNtQueryInformationToken_SpecialQueryCase
0x180006B00: whNtMapViewOfSection
0x1800088A0: RedirectPath
0x1800335E0: whNtThawTransactions
0x180037B98: "__cdecl _imp_RtlCopyContext" __imp_RtlCopyContext
0x180028000: whNtDeviceIoControlFile
0x1800317A0: whNtSetInformationSymbolicLink
0x18002DB48: whNtQuerySystemInformation_SystemFlushInformation
0x180038188: "__cdecl _imp_NtSetInformationToken" __imp_NtSetInformationToken
0x1800399E0: "Wow64NtRaiseException: Debugger " ??_C@_0DK@DJDELNBO@Wow64NtRaiseException?3?5Debugger?5@
0x180038B20: "__cdecl _guard_fids_table" __guard_fids_table
0x1800227AC: whNT32QuerySystemSessionMappedViewInformation
0x180038210: "__cdecl _imp_NtOpenEventPair" __imp_NtOpenEventPair
0x180038570: "__cdecl _imp_NtModifyDriverEntry" __imp_NtModifyDriverEntry
0x1800384D0: "__cdecl _imp_NtShutdownWorkerFactory" __imp_NtShutdownWorkerFactory
0x1800113E0: Wow64pThreadPostInitialize
0x180038538: "__cdecl _imp_NtShutdownSystem" __imp_NtShutdownSystem
0x1800382B0: "__cdecl _imp_RtlGetCurrentProcessorNumberEx" __imp_RtlGetCurrentProcessorNumberEx
0x180034150: whNtWow64CsrFreeCaptureBuffer
0x180036190: "__cdecl load_config_used" _load_config_used
0x180020130: Wow64CallFunction64Nop
0x180033610: whNtTranslateFilePath
0x180033E50: whNtWorkerFactoryWorkerReady
0x18003C210: "whNtWow64CsrClientCallServer(465" ??_C@_0BIE@CBDGNJLD@whNtWow64CsrClientCallServer?$CI465@
0x18001E4B4: Wow64LogSystemServiceWrapper
0x180038520: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x18002C1A0: whNtQueryInformationTransaction
0x18003CDF0: "\DirectShow" ??_C@_1BI@PJOGKDFE@?$AA?2?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAS?$AAh?$AAo?$AAw?$AA?$AA@
0x180027E30: whNtDeleteBootEntry
0x180015D28: Wow64pThunkLegacyPortViewIn
0x180013558: CsrBasepCreateProcess
0x180038420: "__cdecl _imp_NtOpenTransactionManager" __imp_NtOpenTransactionManager
0x180028A10: whNtGetCurrentProcessorNumberEx
0x180003850: whNtQueryDirectoryFileEx
0x180028BC0: whNtGetNotificationResourceManager
0x180031AE4: whNtSetInformationToken_TokenOwner
0x180037F10: "__cdecl _imp_NtCreateJobSet" __imp_NtCreateJobSet
0x180038640: "__cdecl _imp_NtGetNlsSectionPtr" __imp_NtGetNlsSectionPtr
0x180038020: "__cdecl _imp_NtCreateResourceManager" __imp_NtCreateResourceManager
0x18002D384: whNtQuerySystemInformationEx_SystemCodeIntegrityPolicyInformation
0x1800304DC: whNtSetInformationFile_FileMailslotSetInformation
0x18003B088: "NtQueryObject: Called with unsup" ??_C@_0DC@IHCPGKDG@NtQueryObject?3?5Called?5with?5unsup@
0x180038200: "__cdecl _imp_NtDrawText" __imp_NtDrawText
0x18001E9E0: Wow64IsModule32bitHelper
0x18002F620: whNtReplyWaitReceivePort
0x180003D50: whNtCancelWaitCompletionPacket
0x180034190: whNtWow64CsrGetProcessId
0x18002B8A0: whNtQueryInformationProcess_ProcessCycleTime
0x18003CB80: "whNtWow64CsrGetProcessId(471) en" ??_C@_0CP@DLOKGOCL@whNtWow64CsrGetProcessId?$CI471?$CJ?5en@
0x1800112BC: Wow64NtCreateThreadEx
0x1800399A0: "Wow64NtRaiseException: Dispatchi" ??_C@_0DM@JLIFOLDN@Wow64NtRaiseException?3?5Dispatchi@
0x18003A180: "\lastgood" ??_C@_1BE@FMGNKDDG@?$AA?2?$AAl?$AAa?$AAs?$AAt?$AAg?$AAo?$AAo?$AAd?$AA?$AA@
0x180023784: whNt32CopyoutClaimAttributesInformation
0x180026A90: whNtCreateProcessEx
0x1800384B8: "__cdecl _imp_NtWaitForKeyedEvent" __imp_NtWaitForKeyedEvent
0x18003D1B8: "SdbUnpackQueryResult" ??_C@_0BF@NFAAEGH@SdbUnpackQueryResult?$AA@
0x1800381D8: "__cdecl _imp_NtQueryWnfStateData" __imp_NtQueryWnfStateData
0x180037F78: "__cdecl _imp_NtQueryInformationWorkerFactory" __imp_NtQueryInformationWorkerFactory
0x18003A040: "BTCpuPrepareForDebuggerAttach" ??_C@_0BO@BGBABAIF@BTCpuPrepareForDebuggerAttach?$AA@
0x1800385B8: "__cdecl _imp_CsrFreeCaptureBuffer" __imp_CsrFreeCaptureBuffer
0x180037C40: "__cdecl _imp_RtlLocateLegacyContext" __imp_RtlLocateLegacyContext
0x180030C88: whNtSetInformationJobObject_JobObjectExtendedLimitInformation
0x1800214EC: whNT32GetTokenAccessInformationCopyoutSize
0x180028EB0: whNtIsProcessInJob
0x180038748: "__cdecl _imp_NtSetInformationProcess" __imp_NtSetInformationProcess
0x180038100: "__cdecl _imp_NtUnlockFile" __imp_NtUnlockFile
0x180037E88: "__cdecl _imp_NtRollforwardTransactionManager" __imp_NtRollforwardTransactionManager
0x180031670: whNtSetInformationProcess_ProcessMemoryExhaustion
0x18003C710: "whNtWow64CsrAllocateMessagePoint" ??_C@_0DJ@DDCIKCMA@whNtWow64CsrAllocateMessagePoint@
0x18003CB50: "whNtWow64CsrGetProcessId(471) pl" ??_C@_0CN@PBFNBEP@whNtWow64CsrGetProcessId?$CI471?$CJ?5pl@
0x180025430: whNtClearEvent
0x180031E60: whNtSetIntervalProfile
0x18003A3C0: "Wow64LogMessageArgList" ??_C@_0BH@MGCPNFDM@Wow64LogMessageArgList?$AA@
0x180038350: "__cdecl _imp_NtCreateIoCompletion" __imp_NtCreateIoCompletion
0x180024780: whNtAdjustTokenClaimsAndDeviceGroups
0x18003C5C0: "whNtWow64CsrAllocateMessagePoint" ??_C@_0BEJ@IOCCDIEF@whNtWow64CsrAllocateMessagePoint@
0x18002A6A0: whNtPrivilegeCheck
0x180038620: "__cdecl _imp_RtlWow64GetThreadSelectorEntry" __imp_RtlWow64GetThreadSelectorEntry
0x180037E48: "__cdecl _imp_NtQueryWnfStateNameInformation" __imp_NtQueryWnfStateNameInformation
0x180034CE8: CsrBasepDefineDosDevice
0x18001F520: Wow64ServiceExceptionFilter
0x180029370: whNtLockRegistryKey
0x180038310: "__cdecl _imp_NtSetSecurityObject" __imp_NtSetSecurityObject
0x180038898: "__cdecl _imp_NtCreateSectionEx" __imp_NtCreateSectionEx
0x18002B1A8: whNtQueryInformationJobObject_JobObjectSharedCommit
0x18000E9F0: CpuSetStackPointer
0x180037A68: "__cdecl _imp_TpSetWait" __imp_TpSetWait
0x180014E40: whNtCreatePrivateNamespace
0x180021B08: whNT32QuerySystemBigPoolInformation
0x1800383D0: "__cdecl _imp_NtInitializeRegistry" __imp_NtInitializeRegistry
0x180037D68: "__cdecl _imp_NtOpenProcessTokenEx" __imp_NtOpenProcessTokenEx
0x18002F430: whNtReplaceKey
0x180013E40: whNtAlpcCreatePort
0x180037AC8: "__cdecl _imp_NtQueryInformationProcess" __imp_NtQueryInformationProcess
0x180001324: Wow64pInitializeCrossProcessMechanism
0x180038290: "__cdecl _imp_NtGetWriteWatch" __imp_NtGetWriteWatch
0x180038198: "__cdecl _imp_NtAccessCheckByTypeAndAuditAlarm" __imp_NtAccessCheckByTypeAndAuditAlarm
0x180037A48: "__cdecl _imp_NtClose" __imp_NtClose
0x180028680: whNtFlushBuffersFileEx
0x1800382C0: "__cdecl _imp_NtCreateJobObject" __imp_NtCreateJobObject
0x18002ED40: whNtReadRequestData
0x180020BD0: whMapViewOfSectionCommonPre
0x18002FB00: whNtRollbackEnlistment
0x1800380D0: "__cdecl _imp_NtCommitEnlistment" __imp_NtCommitEnlistment
0x18003D040: "\REGISTRY\USER\*\SOFTWARE\Classe" ??_C@_1EE@HDBCEPHC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe@
0x180028700: whNtFlushInstallUILanguage
0x180028410: whNtFilterTokenEx
0x180050034: Ntdll32KiUserExceptionDispatcher
0x180001BAC: GetRelocatableImageBasingInformation
0x180037948: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18002DD84: whNtQuerySystemInformation_SystemPageFileInformation
0x18002E4D0: whNtQuerySystemInformation_SystemRegistryQuotaInformation
0x180033680: whNtUnloadDriver
0x1800385E0: "__cdecl _imp_NtReadFileScatter" __imp_NtReadFileScatter
0x180037AB8: "__cdecl _imp_NtUnmapViewOfSection" __imp_NtUnmapViewOfSection
0x18003A278: "kernel32.dll" ??_C@_1BK@MGMFAEKH@?$AAk?$AAe?$AAr?$AAn?$AAe?$AAl?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1800175A0: Wow64pSetJmp
0x18000BF70: whNtQueryInformationToken_TokenIntegrityLevel
0x180038128: "__cdecl _imp_NtSetSystemPowerState" __imp_NtSetSystemPowerState
0x18000DCD0: whNtWow64GetNativeSystemInformation
0x180027D30: whNtDebugActiveProcess
0x180037B90: "__cdecl _imp_RtlDestroyProcessParameters" __imp_RtlDestroyProcessParameters
0x18002D200: whNtQuerySemaphore
0x180037F88: "__cdecl _imp_NtUnmapViewOfSectionEx" __imp_NtUnmapViewOfSectionEx
0x18003A130: "BTCpuProcessInit" ??_C@_0BB@KAHFKMLF@BTCpuProcessInit?$AA@
0x1800388F8: "__cdecl _imp_NtSetBootOptions" __imp_NtSetBootOptions
0x180037B30: "__cdecl _imp_RtlRaiseStatus" __imp_RtlRaiseStatus
0x18003BF80: "DbgUiWaitWaitStateChange: DbgCre" ??_C@_0DK@CPJEEHGC@DbgUiWaitWaitStateChange?3?5DbgCre@
0x180027CA0: whNtCreateWnfStateName
0x180020D58: whNT32CopyoutClaimAttributeValue
0x1800340D0: whNtWow64CsrClientCallServer
0x180039990: "image" ??_C@_1M@BAIAHIDP@?$AAi?$AAm?$AAa?$AAg?$AAe?$AA?$AA@
0x180032CF0: whNtSetSystemInformation_SystemThreadPriorityClientIdInformation
0x180038908: "__cdecl _imp_NtQuerySecurityObject" __imp_NtQuerySecurityObject
0x180037AE8: RtlNtdllName
0x180025AA0: whNtCreateEnclave
0x180038500: "__cdecl _imp_NtFsControlFile" __imp_NtFsControlFile
0x180023FD0: whNtAccessCheckByTypeResultList
0x180038070: "__cdecl _imp_NtAlpcConnectPort" __imp_NtAlpcConnectPort
0x180038038: "__cdecl _imp_NtOpenEvent" __imp_NtOpenEvent
0x1800398A0: "ThunkStartupContext64TO32: Thunk" ??_C@_0DL@ONBHKJKA@ThunkStartupContext64TO32?3?5Thunk@
0x18003B980: "NtQueryInformationTransaction: C" ??_C@_0EC@MNIJIGHC@NtQueryInformationTransaction?3?5C@
0x18000E3D0: whNtAccessCheckByType
0x180037950: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18003A620: "ThunkStartupContent64TO32: New I" ??_C@_0EJ@IBAKLLLL@ThunkStartupContent64TO32?3?5New?5I@
0x18001FE50: Wow64ValidateUserCallTarget
0x18001FA60: Wow64pThunkLegacyRemoteViewOut
0x180038940: "__cdecl _imp_NtReleaseWorkerFactoryWorker" __imp_NtReleaseWorkerFactoryWorker
0x180038330: "__cdecl _imp_NtAlpcImpersonateClientOfPort" __imp_NtAlpcImpersonateClientOfPort
0x18002A820: whNtPropagationComplete
0x180037C38: "__cdecl _imp_RtlGetEnabledExtendedFeatures" __imp_RtlGetEnabledExtendedFeatures
0x180038090: "__cdecl _imp_NtFreezeTransactions" __imp_NtFreezeTransactions
0x1800380E0: "__cdecl _imp_NtLoadKey" __imp_NtLoadKey
0x180032B14: whNtSetSystemInformation_SystemRefTraceInformation
0x180037BD0: "__cdecl _imp_NtSuspendThread" __imp_NtSuspendThread
0x1800383F0: "__cdecl _imp_NtRaiseHardError" __imp_NtRaiseHardError
0x180017390: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18002AA90: whNtQueryDriverEntryOrder
0x180038278: "__cdecl _imp_NtAllocateUserPhysicalPages" __imp_NtAllocateUserPhysicalPages
0x180002274: CpuGetBinaryTranslatorPath
0x180032050: whNtSetSystemEnvironmentValue
0x180006780: whNtCreateFile
0x18003AEB0: "Wow64ServiceExceptionFilter: Han" ??_C@_0DE@CKIKKLMK@Wow64ServiceExceptionFilter?3?5Han@
0x180038760: "__cdecl _imp_NtAlpcAcceptConnectPort" __imp_NtAlpcAcceptConnectPort
0x18004A9E8: LocalThreadHeapHits
0x180037CB8: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x18000EBFC: Wow64AllocThunkExceptionRecordChain32TO64
0x1800033E4: Wow64QueryBasicInformationThread
0x180013830: whNtAlpcDeleteSecurityContext
0x180038600: "__cdecl _imp_NtFilterToken" __imp_NtFilterToken
0x180006900: whNtTraceControl
0x18003D188: "SdbInitDatabaseEx" ??_C@_0BC@BIKDFCBM@SdbInitDatabaseEx?$AA@
0x180031BB0: whNtSetInformationToken_TokenLinkedToken
0x18003BA58: "NtQueryMutant: Called with unsup" ??_C@_0DC@MHJNIGKP@NtQueryMutant?3?5Called?5with?5unsup@
0x1800389C8: "__cdecl _imp_NtManagePartition" __imp_NtManagePartition
0x180016B40: whNtQueryInformationAtom
0x18004AE70: Kernel32Exports64
0x18002FC70: whNtSerializeBoot
0x18002077C: CpuFlushInstructionCache
0x18002E8D0: whNtQueryTimer
0x180031464: whNtSetInformationProcessAffinityMask
0x180007BB0: whNtOpenKeyEx
0x180038260: "__cdecl _imp_NtCompareObjects" __imp_NtCompareObjects
0x18001E300: Wow64GetWow64ImageOption
0x180037AF8: "__cdecl _imp_NtQueryObject" __imp_NtQueryObject
0x1800386C0: "__cdecl _imp_NtSetCachedSigningLevel2" __imp_NtSetCachedSigningLevel2
0x180020820: Wow64OpenCrossProcessWorkConnection
0x180027E00: whNtDeleteAtom
0x180034A00: whNtWow64CsrBasepGetProcessShutdownParam
0x180014D20: whNtUnsubscribeWnfStateChange
0x180050050: ServiceTables
0x18003B278: "NtSetInformationFile: Called wit" ??_C@_0DJ@JGLBCFPN@NtSetInformationFile?3?5Called?5wit@
0x18003A2D0: "\KnownDlls" ??_C@_1BG@MHCCONHN@?$AA?2?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AA?$AA@
0x180024A80: whNtAlertThreadByThreadId
0x18004AE50: WindirFullObjectName
0x1800396C8: "Wow64pGetLegacyLpcPortName: Lega" ??_C@_0DC@BHALOIDB@Wow64pGetLegacyLpcPortName?3?5Lega@
0x180025CA0: whNtCreateEventPair
0x18000EA90: Wow64pNotifyDebugger
0x180038A30: "__cdecl _imp_NtRequestPort" __imp_NtRequestPort
0x180033580: whNtTestAlert
0x180024CC0: whNtAlpcImpersonateClientContainerOfPort
0x180039A98: "RedirectObjectAttributes: Constr" ??_C@_0DO@FDIFBLGO@RedirectObjectAttributes?3?5Constr@
0x18002AA30: whNtQueryDirectoryObject
0x180038A18: "__cdecl _imp_NtQueryFullAttributesFile" __imp_NtQueryFullAttributesFile
0x1800025EC: whNtSetInformationProcessProcessExecuteFlags
0x1800360F0: hostDir
0x180036110: RegeditName
0x180037E60: "__cdecl _imp_NtCreateDirectoryObject" __imp_NtCreateDirectoryObject
0x18001EB50: Wow64NotifyUnsimulateComplete
0x1800287D0: whNtFreeUserPhysicalPages
0x18002D0AC: whNtQuerySection_SectionRelocationInformation
0x180037AD8: "__cdecl _imp_RtlImageNtHeader" __imp_RtlImageNtHeader
0x18003CBC0: "NtWow64GetNativeSystemInformatio" ??_C@_0EG@FKKIDOGC@NtWow64GetNativeSystemInformatio@
0x18002FC30: whNtSaveMergedKeys
0x180039B50: "\logfiles" ??_C@_1BE@BPMBOOJJ@?$AA?2?$AAl?$AAo?$AAg?$AAf?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x180037F60: "__cdecl _imp_NtRenameTransactionManager" __imp_NtRenameTransactionManager
0x18002EF20: whNtReleaseMutant
0x180010770: whNtCreateThreadEx
0x180013B20: whNtWow64CsrClientConnectToServer
0x180014BC0: whNtSetWnfProcessNotificationEvent
0x18000C420: whNtReadVirtualMemory
0x180037D08: "__cdecl _imp_RtlUnhandledExceptionFilter" __imp_RtlUnhandledExceptionFilter
0x180037C68: "__cdecl _imp_RtlWow64GetEquivalentMachineCHPE" __imp_RtlWow64GetEquivalentMachineCHPE
0x180038A68: "__cdecl _imp_NtQueryOpenSubKeysEx" __imp_NtQueryOpenSubKeysEx
0x18002B6AC: whNtQueryInformationJobObject_JobObjectServerSiloUserSharedData
0x180003C70: whNtOpenProcess
0x180038AF0: ntdll_NULL_THUNK_DATA
0x1800362A0: sdwhbase
0x180037938: "__cdecl _imp_memcpy" __imp_memcpy
0x180037A10: "__cdecl _imp_RtlImageNtHeaderEx" __imp_RtlImageNtHeaderEx
0x180038700: "__cdecl _imp_NtTerminateEnclave" __imp_NtTerminateEnclave
0x18003CFB0: "\REGISTRY\USER\*_Classes" ??_C@_1DC@OCGJAOPP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA_?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?$AA@
0x180030DF4: whNtSetInformationJobObject_JobObjectNotificationLimitInformation2
0x180034890: whNtWow64CsrBaseQueryModuleData
0x180038468: "__cdecl _imp_NtCancelTimer" __imp_NtCancelTimer
0x180037B60: "__cdecl _imp_RtlCreateProcessParametersWithTemplate" __imp_RtlCreateProcessParametersWithTemplate
0x180038788: "__cdecl _imp_NtFlushProcessWriteBuffers" __imp_NtFlushProcessWriteBuffers
0x180032D64: whNtSetSystemInformation_SystemVerifierFaultsInformation
0x18003A690: "InitialPC %p is within a native " ??_C@_0EJ@POFFAPCL@InitialPC?5?$CFp?5is?5within?5a?5native?5@
0x18003C180: "Bypassing 64-bit load Dll messag" ??_C@_0CF@GPKHEOGH@Bypassing?564?9bit?5load?5Dll?5messag@
0x180038AD8: "__cdecl _imp_RtlDecodeSystemPointer" __imp_RtlDecodeSystemPointer
0x18003A9B0: "[<__wow64_disable_redirect_all__" ??_C@_1EG@LKBCBAPF@?$AA?$FL?$AA?$DM?$AA_?$AA_?$AAw?$AAo?$AAw?$AA6?$AA4?$AA_?$AAd?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AA_?$AAr?$AAe?$AAd?$AAi?$AAr?$AAe?$AAc?$AAt?$AA_?$AAa?$AAl?$AAl?$AA_?$AA_@
0x18000E3A0: Wow64SelectSystem32PathInternal
0x1800379F8: "__cdecl _imp_LdrUnloadDll" __imp_LdrUnloadDll
0x18003064C: whNtSetInformationFile_FileObjectIdInformation
0x18002E220: whNtQuerySystemInformation_SystemProcessorPowerInformation
0x180037A88: "__cdecl _imp_NtOpenDirectoryObject" __imp_NtOpenDirectoryObject
0x180037DC8: "__cdecl _imp_NtDisableLastKnownGood" __imp_NtDisableLastKnownGood
0x180031AE4: whNtSetInformationToken_TokenPrimaryGroup
0x180037E10: "__cdecl _imp_NtQuerySystemTime" __imp_NtQuerySystemTime
0x180032FC0: whNtSetUuidSeed
0x180038550: "__cdecl _imp_NtGetDevicePowerState" __imp_NtGetDevicePowerState
0x18004A794: "__cdecl _@@_PchSym_@00@UlhUlyqUznwGEuivUlmvxlivUyzhvUdrmDCUxorvmgUoryUlyquivUznwGEUyzhvwooOlyq@kernel32legacylib" __@@_PchSym_@00@UlhUlyqUznwGEuivUlmvxlivUyzhvUdrmDCUxorvmgUoryUlyquivUznwGEUyzhvwooOlyq@kernel32legacylib
0x180038590: "__cdecl _imp_NtQueryEvent" __imp_NtQueryEvent
0x18003B9D0: "NtQueryInformationWorkerFactory:" ??_C@_0EE@JPNNJFHI@NtQueryInformationWorkerFactory?3@
0x180038AD0: "__cdecl _imp_RtlEncodeSystemPointer" __imp_RtlEncodeSystemPointer
0x180037F58: "__cdecl _imp_NtCreateTransaction" __imp_NtCreateTransaction
0x18002FB30: whNtRollbackRegistryTransaction
0x180038858: "__cdecl _imp_NtMapCMFModule" __imp_NtMapCMFModule
0x180039930: "NtQueryInformationProcess: Calle" ??_C@_0DO@GMDJIBJF@NtQueryInformationProcess?3?5Calle@
0x180038840: "__cdecl _imp_NtSetInformationVirtualMemory" __imp_NtSetInformationVirtualMemory
0x180038390: "__cdecl _imp_NtPulseEvent" __imp_NtPulseEvent
0x1800383D8: "__cdecl _imp_NtQueryAttributesFile" __imp_NtQueryAttributesFile
0x18003CEF8: "\Classes\Wow6432Node" ??_C@_1CK@GDGDGMEP@?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x180038138: "__cdecl _imp_NtImpersonateAnonymousToken" __imp_NtImpersonateAnonymousToken
0x180015A40: whNtSetInformationFile_FileAllocationInformation
0x180037BF8: "__cdecl _imp_RtlIsCurrentThread" __imp_RtlIsCurrentThread
0x180037A18: "__cdecl _imp_NtProtectVirtualMemory" __imp_NtProtectVirtualMemory
0x18000B170: whNtEnumerateKey
0x180027FA0: whNtDeleteWnfStateData
0x1800385D8: "__cdecl _imp_NtQueryDebugFilterState" __imp_NtQueryDebugFilterState
0x18002BAB4: whNtQueryInformationProcess_ProcessJobMemoryInformation
0x1800395D0: "Unknown Image" ??_C@_1BM@NHKOOLBO@?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?5?$AAI?$AAm?$AAa?$AAg?$AAe?$AA?$AA@
0x1800388A0: "__cdecl _imp_NtCommitComplete" __imp_NtCommitComplete
0x180037C58: "__cdecl _imp_RtlRaiseException" __imp_RtlRaiseException
0x18004A180: "__cdecl _security_cookie" __security_cookie
0x18003D160: "ApphelpChpeModSettingsFromQueryR" ??_C@_0CG@CIGACODF@ApphelpChpeModSettingsFromQueryR@
0x180014B00: whNtUpdateWnfStateData
0x1800388B0: "__cdecl _imp_NtCommitRegistryTransaction" __imp_NtCommitRegistryTransaction
0x18002CEB0: whNtQueryPortInformationProcess
0x18001FB40: Wow64CheckIfNXEnabled
0x1800255D0: whNtCompactKeys
0x180028EE0: whNtIsSystemResumeAutomatic
0x180022FCC: whNT32RaiseHardError
0x18003D1E0: "CsrBasepCreateActCtx" ??_C@_0BF@MEFCIGJA@CsrBasepCreateActCtx?$AA@
0x1800389B8: "__cdecl _imp_NtOpenTransaction" __imp_NtOpenTransaction
0x18003A2B0: "\KnownDllsArm32" ??_C@_1CA@LAHPPCMD@?$AA?2?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AAA?$AAr?$AAm?$AA3?$AA2?$AA?$AA@
0x18002C260: whNtQueryInformationTransactionManager
0x1800256E0: whNtCompareSigningLevels
0x1800297D0: whNtNotifyChangeDirectoryFile
0x18000ADB0: whNtSetInformationWorkerFactory
0x180039E38: "BTCpuOptimizeChpeImportThunks" ??_C@_0BO@ECAPBFNF@BTCpuOptimizeChpeImportThunks?$AA@
0x1800380C0: "__cdecl _imp_NtQuerySystemInformationEx" __imp_NtQuerySystemInformationEx
0x180039E88: "BTCpuNotifyReadFile" ??_C@_0BE@BLCFPKNH@BTCpuNotifyReadFile?$AA@
0x180033FC0: whNtWow64CsrCaptureMessageBuffer
0x180037998: "__cdecl _imp_LdrQueryImageFileExecutionOptions" __imp_LdrQueryImageFileExecutionOptions
0x180028B30: whNtGetNextThread
0x180026400: whNtCreateMailslotFile
0x180038780: "__cdecl _imp_NtCreateSemaphore" __imp_NtCreateSemaphore
0x18000B148: WriteReturnLengthStatus
0x18003B2F0: "NtQueryDirectoryFile: Called wit" ??_C@_0DJ@FNIKHFEH@NtQueryDirectoryFile?3?5Called?5wit@
0x180002190: RtlUnicodeStringPrintf
0x180037A98: "__cdecl _imp_NtOpenSection" __imp_NtOpenSection
0x180038560: "__cdecl _imp_NtUnloadKey" __imp_NtUnloadKey
0x180038A58: "__cdecl _imp_NtDeleteKey" __imp_NtDeleteKey
0x180038AC0: "__cdecl _imp_RtlCreateProcessParametersEx" __imp_RtlCreateProcessParametersEx
0x18002EE70: whNtRegisterProtocolAddressInformation
0x18004A190: DefaultGuestMachine
0x180038A98: "__cdecl _imp_NtCreateKeyTransacted" __imp_NtCreateKeyTransacted
0x1800041E0: whNtEnumerateValueKey
0x18003A090: "BTCpuFlushInstructionCache" ??_C@_0BL@KAODPHGE@BTCpuFlushInstructionCache?$AA@
0x18003A950: "Wow64pInitializeFilePathRedirect" ??_C@_0FH@OAJMLIGC@Wow64pInitializeFilePathRedirect@
0x180013860: whNtAlpcCreateSectionView
0x180016134: whNtSetInformationProcess_ProcessTelemetryCoverage
0x1800379C8: "__cdecl _imp_DbgPrintEx" __imp_DbgPrintEx
0x180029B30: whNtOpenIoCompletion
0x18002EA60: whNtReadFile
0x18002E5E8: whNtQuerySystemInformation_SystemStackTraceInformation
0x18003AD30: "Wow64LdrpInitialize: Calling NtT" ??_C@_0DC@GEBGJBMA@Wow64LdrpInitialize?3?5Calling?5NtT@
0x18003A238: "\SysArm32" ??_C@_1BE@NGMBNGJA@?$AA?2?$AAS?$AAy?$AAs?$AAA?$AAr?$AAm?$AA3?$AA2?$AA?$AA@
0x1800380B8: "__cdecl _imp_NtQueryPerformanceCounter" __imp_NtQueryPerformanceCounter
0x18003B028: "CpuResetToConsistantState (%p) " ??_C@_0CA@FPPNLMDF@CpuResetToConsistantState?5?$CI?$CFp?$CJ?6?$AA@
0x180025074: whNtAlpcSetInformation_AlpcBasicInformation
0x180034A90: whNtWow64CsrBasepNlsUpdateCacheCount
0x18003BFC0: "DbgUiWaitWaitStateChange: DbgCre" ??_C@_0DL@FFJIODEB@DbgUiWaitWaitStateChange?3?5DbgCre@
0x180037D38: "__cdecl _imp_NtCreateProfileEx" __imp_NtCreateProfileEx
0x180038800: "__cdecl _imp_NtQueryInstallUILanguage" __imp_NtQueryInstallUILanguage
0x1800386E8: "__cdecl _imp_NtSetSystemTime" __imp_NtSetSystemTime
0x180032948: whNtSetSystemInformation_SystemFileCacheInformation
0x1800380A0: "__cdecl _imp_NtQuerySymbolicLinkObject" __imp_NtQuerySymbolicLinkObject
0x1800381E0: "__cdecl _imp_NtModifyBootEntry" __imp_NtModifyBootEntry
0x1800344F0: whNtWriteFile
0x180005D40: whNtSetInformationThread
0x18000DAFC: whSepCopyoutSecurityAttributeValue
0x18003AF80: "Argument Flags - %lx " ??_C@_0BG@NGACMICP@Argument?5Flags?5?9?5?$CFlx?6?$AA@
0x180028F40: whNtLoadDriver
0x1800250E8: whNtAlpcSetInformation_AlpcMessageZoneInformation
0x1800389C0: "__cdecl _imp_NtCreateIRTimer" __imp_NtCreateIRTimer
0x180037EA8: "__cdecl _imp_NtCreateTimer2" __imp_NtCreateTimer2
0x18003A8F0: "Wow64pInitializeFilePathRedirect" ??_C@_0FB@FIGBKFEJ@Wow64pInitializeFilePathRedirect@
0x180038300: "__cdecl _imp_NtAllocateVirtualMemory" __imp_NtAllocateVirtualMemory
0x18002B860: whNtQueryInformationPort
0x1800379D0: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x18003CF60: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1EO@PMMLBCDN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x180027E60: whNtDeleteDriverEntry
0x18003A468: "ThreadInit: CpuThreadInit failed" ??_C@_0CM@HDIIEAOK@ThreadInit?3?5CpuThreadInit?5failed@
0x180013C00: whNtOpenMutant
0x180024C50: whNtAllocateUuids
0x180037CA0: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x180025200: whNtAreMappedFilesTheSame
0x180025490: whNtCloseObjectAuditAlarm
0x18002EEE0: whNtReleaseKeyedEvent
0x18001EEA0: Wow64SuspendLocalThread
0x18004A170: Kernel32ExportNames
0x180038030: "__cdecl _imp_NtSetLowWaitHighEventPair" __imp_NtSetLowWaitHighEventPair
0x18003A1C8: "COMPUTERNAME" ??_C@_1BK@ENEDBDPA@?$AAC?$AAO?$AAM?$AAP?$AAU?$AAT?$AAE?$AAR?$AAN?$AAA?$AAM?$AAE?$AA?$AA@
0x180014C40: whNtSetInformationProcess_ProcessOwnerInformation
0x1800281E0: whNtEnableLastKnownGood
0x18003A338: "\WowAA32Node" ??_C@_1BK@HFANIHID@?$AA?2?$AAW?$AAo?$AAw?$AAA?$AAA?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x1800386D8: "__cdecl _imp_NtCreateSymbolicLinkObject" __imp_NtCreateSymbolicLinkObject
0x180015674: whNtSetInformationWorkerFactory_WorkerFactoryStackInformation
0x180038720: "__cdecl _imp_NtCreateDebugObject" __imp_NtCreateDebugObject
0x180038648: "__cdecl _imp_NtCommitTransaction" __imp_NtCommitTransaction
0x180039FD8: "BTCpuSuspendLocalThread" ??_C@_0BI@KMGHKNHK@BTCpuSuspendLocalThread?$AA@
0x1800240D0: whNtAccessCheckByTypeResultListAndAuditAlarm
0x18003A380: "%8.8X:%8.8X " ??_C@_0N@PHFPECNN@?$CF8?48X?3?$CF8?48X?5?$AA@
0x18002A640: whNtPrepareComplete
0x180037CF0: "__cdecl _imp_RtlWow64PopAllCrossProcessWork" __imp_RtlWow64PopAllCrossProcessWork
0x18003BBD0: "NtSetInformationTransaction: Cal" ??_C@_0EA@HHKGAHOJ@NtSetInformationTransaction?3?5Cal@
0x180033180: whNtStopProfile
0x180017210: "__cdecl _security_init_cookie" __security_init_cookie
0x18000B380: whNtSetTimer2
0x180038280: "__cdecl _imp_NtAlpcCreateResourceReserve" __imp_NtAlpcCreateResourceReserve
0x180037D28: "__cdecl _imp___chkstk" __imp___chkstk
0x18000F260: Wow64AllocateTemp
0x1800385A0: "__cdecl _imp_NtCreateRegistryTransaction" __imp_NtCreateRegistryTransaction
0x18001F240: Wow64AllocateHeap
0x1800325BC: whNtSetSystemInformation_SpecialSetCase
0x180032F30: whNtSetTimer
0x180016FB0: Wow64NtGetContextThread
0x18003B000: "wow64cpu.dll" ??_C@_1BK@JHMFEPLL@?$AAw?$AAo?$AAw?$AA6?$AA4?$AAc?$AAp?$AAu?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180037DA0: "__cdecl _imp_NtQueryMultipleValueKey" __imp_NtQueryMultipleValueKey
0x180037A00: "__cdecl _imp_NtQuerySystemInformation" __imp_NtQuerySystemInformation
0x180014860: whNtCancelIoFileEx
0x18000F044: Wow64ApcRoutineInternal
0x180038828: "__cdecl _imp_NtOpenPrivateNamespace" __imp_NtOpenPrivateNamespace
0x180038A38: "__cdecl _imp_RtlUpcaseUnicodeString" __imp_RtlUpcaseUnicodeString
0x180038470: "__cdecl _imp_NtGetCachedSigningLevel" __imp_NtGetCachedSigningLevel
0x180032948: whNtSetSystemInformation_SystemSystemPtesInformationEx
0x180022D30: whNT32QuerySystemVerifierInformation
0x180025780: whNtCompressKey
0x18003CD40: "\{963F9E1B-197A-4664-B7D1-BCF544" ??_C@_1FA@DCDCJLCC@?$AA?2?$AA?$HL?$AA9?$AA6?$AA3?$AAF?$AA9?$AAE?$AA1?$AAB?$AA?9?$AA1?$AA9?$AA7?$AAA?$AA?9?$AA4?$AA6?$AA6?$AA4?$AA?9?$AAB?$AA7?$AAD?$AA1?$AA?9?$AAB?$AAC?$AAF?$AA5?$AA4?$AA4@
0x180039FA8: "BTCpuGetBopCode" ??_C@_0BA@NGGOCCCG@BTCpuGetBopCode?$AA@
0x18004AE68: AlertByThreadIdEventHashTable
0x180037EB8: "__cdecl _imp_NtOpenSymbolicLinkObject" __imp_NtOpenSymbolicLinkObject
0x1800246D0: whNtAddDriverEntry
0x180038A28: "__cdecl _imp_NtSetCachedSigningLevel" __imp_NtSetCachedSigningLevel
0x180037E58: "__cdecl _imp_NtMapViewOfSectionEx" __imp_NtMapViewOfSectionEx
0x1800174EB: wcscmp
0x180026860: whNtCreatePort
0x18002F300: whNtRemoveProcessDebug
0x18002DC6C: whNtQuerySystemInformation_SystemLegacyDriverInformation
0x180039F00: "BTCpuFlushInstructionCache2" ??_C@_0BM@KHAPBCMH@BTCpuFlushInstructionCache2?$AA@
0x1800136CC: RedirectObjectName
0x180037D18: "__cdecl _imp_memmove" __imp_memmove
0x18000D050: CpuGetContext
0x180038830: "__cdecl _imp_NtSystemDebugControl" __imp_NtSystemDebugControl
0x180038018: "__cdecl _imp_NtResetWriteWatch" __imp_NtResetWriteWatch
0x1800308F0: whNtSetInformationJobObject
0x180008780: Wow64ShallowThunkAllocSecurityQualityOfService32TO64_FNC
0x1800387E0: "__cdecl _imp_NtEnumerateSystemEnvironmentValuesEx" __imp_NtEnumerateSystemEnvironmentValuesEx
0x180037FC0: "__cdecl _imp_NtQueueApcThread" __imp_NtQueueApcThread
0x180037CD0: "__cdecl _imp_NtCreateSection" __imp_NtCreateSection
0x180008CF0: whNtQueryVirtualMemory_SpecialQueryCase
0x18002D4AC: whNtQuerySystemInformationEx_SystemProcessorPowerInformation
0x180037CB0: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x18003A4F0: "InitializeContextMapper: Unable " ??_C@_0ED@OEOPLHBA@InitializeContextMapper?3?5Unable?5@
0x18002A970: whNtQueryBootOptions
0x18002FA40: whNtResumeProcess
0x180021788: whNT32QueryDirectoryObject
0x180017354: RtlVirtualUnwind
0x180038A88: "__cdecl _imp_NtRestoreKey" __imp_NtRestoreKey
0x18002E910: whNtQueryTimerResolution
0x180030010: whNtSetDefaultLocale
0x180038900: "__cdecl _imp_NtCreatePartition" __imp_NtCreatePartition
0x180037AE0: "__cdecl _imp_RtlImageDirectoryEntryToData" __imp_RtlImageDirectoryEntryToData
0x18003B588: "NtAlpcSetInformation: Called wit" ??_C@_0DJ@GENCKFL@NtAlpcSetInformation?3?5Called?5wit@
0x18002CF94: whNtQuerySection_SectionBasicInformation
0x18003B100: "NtEnumerateValueKey: called with" ??_C@_0DK@GLEGGLDA@NtEnumerateValueKey?3?5called?5with@
0x180038388: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x180031F20: whNtSetLdtEntries
0x18002AC50: whNtQueryInformationEnlistment
0x180031CF8: whNtSetInformationTransaction_TransactionBindInformation
0x180038218: "__cdecl _imp_NtInitializeEnclave" __imp_NtInitializeEnclave
0x180037980: "__cdecl _imp_NtContinue" __imp_NtContinue
0x180020210: Wow64CallFunctionOptimizeChpeImportThunks
0x180038190: "__cdecl _imp_NtSetInformationFile" __imp_NtSetInformationFile
0x1800341E0: whNtWow64CsrIdentifyAlertableThread
0x18000C308: whNtQueryInformationToken_TokenPrimaryGroup
0x1800381E8: "__cdecl _imp_NtAlpcRevokeSecurityContext" __imp_NtAlpcRevokeSecurityContext
0x180039BB0: "\driverstore" ??_C@_1BK@ICEGBDPG@?$AA?2?$AAd?$AAr?$AAi?$AAv?$AAe?$AAr?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x180025750: whNtCompleteConnectPort
0x180038750: "__cdecl _imp_NtConnectPort" __imp_NtConnectPort
0x18003C078: "DbgUiWaitWaitStateChange: DbgBre" ??_C@_0DI@BJCMLMPP@DbgUiWaitWaitStateChange?3?5DbgBre@
0x180038220: "__cdecl _imp_NtOpenTimer" __imp_NtOpenTimer
0x18002BFB0: whNtQueryInformationThread_ThreadQuerySetWin32StartAddress
0x180038808: "__cdecl _imp_NtQueueApcThreadEx" __imp_NtQueueApcThreadEx
0x180024AB0: whNtAllocateLocallyUniqueId
0x180039B40: "\spool" ??_C@_1O@HLOENDH@?$AA?2?$AAs?$AAp?$AAo?$AAo?$AAl?$AA?$AA@
0x180038578: "__cdecl _imp_NtAlpcQueryInformationMessage" __imp_NtAlpcQueryInformationMessage
0x1800388D0: "__cdecl _imp_NtFlushVirtualMemory" __imp_NtFlushVirtualMemory
0x1800170C0: "__cdecl _report_gsfailure" __report_gsfailure
0x1800320F0: whNtSetSystemEnvironmentValueEx
0x180002810: whNtWow64CsrBasepCreateActCtx
0x18003BE00: "whNtVdmControl(456) unsupported " ??_C@_0NJ@BHHLAONG@whNtVdmControl?$CI456?$CJ?5unsupported?5@
0x1800388C0: "__cdecl _imp_NtOpenRegistryTransaction" __imp_NtOpenRegistryTransaction
0x180038110: "__cdecl _imp_NtReplyWaitReceivePortEx" __imp_NtReplyWaitReceivePortEx
0x18001FBD0: Wow64EmulateAtlThunk
0x18002A5E0: whNtPrePrepareComplete
0x180038728: "__cdecl _imp_NtImpersonateClientOfPort" __imp_NtImpersonateClientOfPort
0x18003A0F8: "BTCpuThreadTerm" ??_C@_0BA@DBFKNMHF@BTCpuThreadTerm?$AA@
0x180028770: whNtFlushKey
0x18000CF90: RunCpuSimulation
0x180037AF0: "__cdecl _imp_NtOpenFile" __imp_NtOpenFile
0x180029BD0: whNtOpenJobObject
0x180038AB8: "__cdecl _imp_RtlExpandEnvironmentStrings_U" __imp_RtlExpandEnvironmentStrings_U
0x180029120: whNtLoadKey2
0x180015840: whNtQuerySection_SectionImageInformation
0x180050110: BtFuncs
0x18003B8F8: "NtQueryInformationAtom: called w" ??_C@_0DN@HACINHHL@NtQueryInformationAtom?3?5called?5w@
0x180029520: whNtMapUserPhysicalPages
0x18002BD64: whNtQueryInformationProcess_ProcessSecurityDomainInformation
0x180037AC0: "__cdecl _imp_RtlUserThreadStart" __imp_RtlUserThreadStart
0x18003B370: "The required size for SYSTEM_PAG" ??_C@_0FE@KALIDCEI@The?5required?5size?5for?5SYSTEM_PAG@
0x180028100: whNtDisplayString
0x180038108: "__cdecl _imp_NtOpenKeyedEvent" __imp_NtOpenKeyedEvent
0x18000C7C0: whNtQueryInformationProcess_ProcessDeviceMap
0x180038298: "__cdecl _imp_NtNotifyChangeKey" __imp_NtNotifyChangeKey
0x180032948: whNtSetSystemInformation_SystemPagedPoolInformationEx
0x180050028: Wow64pMaxAddress
0x180003960: whNtSetValueKey
0x180027BE0: whNtCreateWaitablePort
0x180037C78: "__cdecl _imp_RtlQueryEnvironmentVariable_U" __imp_RtlQueryEnvironmentVariable_U
0x18003ADA8: "Wow64LdrpInitialize: cpu per thr" ??_C@_0DO@DDDPKHEH@Wow64LdrpInitialize?3?5cpu?5per?5thr@
0x180004AE4: CpupResolveReverseImports
0x1800141E0: whNtNotifyChangeMultipleKeys
0x180038358: "__cdecl _imp_NtAcceptConnectPort" __imp_NtAcceptConnectPort
0x1800332D0: whNtSystemDebugControl_SpecialCase
0x180028E70: whNtInitiatePowerAction
0x18002D1B0: whNtQuerySecurityPolicy
0x180033DB0: whNtWaitForSingleObject
0x180001D58: Wow64pInitializeFilePathRedirection
0x180031E90: whNtSetIoCompletion
0x1800389D0: "__cdecl _imp_NtAlpcDisconnectPort" __imp_NtAlpcDisconnectPort
0x18002C714: whNtQueryInformationWorkerFactory_WorkerFactoryStackInformation
0x18002C094: whNtQueryInformationToken_TokenLinkedToken
0x18000D8A4: Wow64AllocateTempFromHeap
0x180038960: "__cdecl _imp_NtConvertBetweenAuxiliaryCounterAndPerformanceCounter" __imp_NtConvertBetweenAuxiliaryCounterAndPerformanceCounter
0x1800235A8: whNT32ThunkAllocTokenSecurityAttributeAndOperationInformation32TO64
0x18003AE50: "Wow64NtRaiseException: Debugger " ??_C@_0FK@EBLPIPCK@Wow64NtRaiseException?3?5Debugger?5@
0x18003A118: "BTCpuProcessTerm" ??_C@_0BB@GEHHJNAO@BTCpuProcessTerm?$AA@
0x180024EB8: whNtAlpcQueryInformation_SpecialQueryCase
0x1800318D4: whNtSetInformationThread_ThreadSetTlsArrayAddress
0x18001F260: Wow64FreeHeap
0x180029D50: whNtOpenKeyTransactedEx
0x1800040C0: whNtCreateMutant
0x180033150: whNtStartProfile
0x180039BE8: "\catroot" ??_C@_1BC@NAKMOFJH@?$AA?2?$AAc?$AAa?$AAt?$AAr?$AAo?$AAo?$AAt?$AA?$AA@
0x18000F150: CpuGetStackPointer
0x18003B7A0: "whNtPlugPlayControl(300) unsuppo" ??_C@_0BFI@LLIHKDDK@whNtPlugPlayControl?$CI300?$CJ?5unsuppo@
0x18002EFC0: whNtRemoveIoCompletion
0x18002BE70: whNtQueryInformationResourceManager
0x180038988: "__cdecl _imp_NtAlpcOpenSenderThread" __imp_NtAlpcOpenSenderThread
0x18003CC70: "\SysWow64\" ??_C@_1BG@DNNIPMLA@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAo?$AAw?$AA6?$AA4?$AA?2?$AA?$AA@
0x180030250: whNtSetInformationEnlistment
0x18003A750: "Wow64RaiseException: Failed to u" ??_C@_0DJ@COKDANCF@Wow64RaiseException?3?5Failed?5to?5u@
0x180038460: "__cdecl _imp_NtFlushBuffersFile" __imp_NtFlushBuffersFile
0x180037F18: "__cdecl _imp_NtFilterBootOption" __imp_NtFilterBootOption
0x180037EE0: "__cdecl _imp_NtGetMUIRegistryInfo" __imp_NtGetMUIRegistryInfo
0x180038320: "__cdecl _imp_NtWaitForMultipleObjects32" __imp_NtWaitForMultipleObjects32
0x180038920: "__cdecl _imp_NtAlpcSetInformation" __imp_NtAlpcSetInformation
0x18003ACC0: "RtlWow64GetCpuAreaInfo: Calling " ??_C@_0DF@NLNKCELE@RtlWow64GetCpuAreaInfo?3?5Calling?5@
0x1800383C0: "__cdecl _imp_NtUnloadKey2" __imp_NtUnloadKey2
0x18001653C: whNT32ThunkProcessInformationEx
0x18000F330: Wow64IsStackExtentsCheckEnforced
0x18003A078: "BTCpuNotifyDllLoad" ??_C@_0BD@GABEAIOC@BTCpuNotifyDllLoad?$AA@
0x180028240: whNtEnumerateDriverEntries
0x180037BD8: "__cdecl _imp_NtWaitForMultipleObjects" __imp_NtWaitForMultipleObjects
0x18002C2A0: whNtQueryInformationTransaction_TransactionBindInformation
0x1800282E0: whNtExtendSection
0x18000B330: whNtOpenProcessToken
0x180037EA0: "__cdecl _imp_NtCreateTokenEx" __imp_NtCreateTokenEx
0x18003CC88: "(x86)" ??_C@_1M@CGLIBNDG@?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x18003A300: "\SysArm64" ??_C@_1BE@KDGHBIPP@?$AA?2?$AAS?$AAy?$AAs?$AAA?$AAr?$AAm?$AA6?$AA4?$AA?$AA@
0x180037C70: "__cdecl _imp_NtGetContextThread" __imp_NtGetContextThread
0x180036620: sdwhnt32JumpTable
0x180037AE8: "__cdecl _imp_RtlNtdllName" __imp_RtlNtdllName
0x180029400: whNtManageHotPatch
0x180038AA0: "__cdecl _imp_NtCreateKey" __imp_NtCreateKey
0x180037CE8: "__cdecl _imp_RtlWow64GetSharedInfoProcess" __imp_RtlWow64GetSharedInfoProcess
0x180031CC0: whNtSetInformationTransactionManager
0x18002FB60: whNtRollbackTransaction
0x18003BD60: "whNtUmsThreadYield(446) unsuppor" ??_C@_0JB@EBJPCLMH@whNtUmsThreadYield?$CI446?$CJ?5unsuppor@
0x18002A9D0: whNtQueryDefaultLocale
0x1800386B0: "__cdecl _imp_NtCreateKeyedEvent" __imp_NtCreateKeyedEvent
0x180038160: "__cdecl _imp_NtSetSystemInformation" __imp_NtSetSystemInformation
0x180030544: whNtSetInformationFile_FileMoveClusterInformation
0x180014140: whNtAlpcDeleteSectionView
0x180038410: "__cdecl _imp_NtCreateWaitCompletionPacket" __imp_NtCreateWaitCompletionPacket
0x180027DD0: whNtDelayExecution
0x180020280: Wow64CallFunctionTurboThunkControl
0x180026990: whNtCreateProcess
0x1800330E0: whNtSignalAndWaitForSingleObject
0x180037CF8: "__cdecl _imp_RtlWow64PopCrossProcessWork" __imp_RtlWow64PopCrossProcessWork
0x180027EF0: whNtDeleteObjectAuditAlarm
0x180037BC0: "__cdecl _imp_NtDuplicateObject" __imp_NtDuplicateObject
0x1800382E8: "__cdecl _imp_NtPowerInformation" __imp_NtPowerInformation
0x180038968: "__cdecl _imp_NtQueryIntervalProfile" __imp_NtQueryIntervalProfile
0x18002D9E0: whNtQuerySystemInformation_SystemPagedPoolInformationEx
0x18000CC9C: MapContextAddress64TO32
0x1800213BC: whNT32DeepThunkSidAndAttributesArray32TO64
0x18000C074: whNT32DeepThunkSidAndAttributesArray64TO32
0x180038270: "__cdecl _imp_CsrCaptureMessageString" __imp_CsrCaptureMessageString
0x1800395F0: "\KnownDlls32" ??_C@_1BK@ECBBGPKI@?$AA?2?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AA3?$AA2?$AA?$AA@
0x180038440: "__cdecl _imp_NtSetDriverEntryOrder" __imp_NtSetDriverEntryOrder
0x180012FF0: whNtQueryObject_SpecialQueryCase
0x180037EC0: "__cdecl _imp_NtSetIoCompletionEx" __imp_NtSetIoCompletionEx
0x180034710: whNtYieldExecution
0x18003BA18: "NtQueryIoCompletion: called with" ??_C@_0DK@HLBEKCOD@NtQueryIoCompletion?3?5called?5with@
0x180003328: whNtQueryInformationThreadBasicInformation
0x180039A50: "RedirectObjectAttributes: RtlApp" ??_C@_0EF@NBPBOFDP@RedirectObjectAttributes?3?5RtlApp@
0x180033530: whNtTerminateThread
0x180037BE8: "__cdecl _imp_NtSetEvent" __imp_NtSetEvent
0x180005304: RedirectDosPathUnicode
0x180037C18: "__cdecl _imp_RtlLookupEntryHashTable" __imp_RtlLookupEntryHashTable
0x180030180: whNtSetHighEventPair
0x180024660: whNtAddAtomEx
0x180037F48: "__cdecl _imp_NtGetNextProcess" __imp_NtGetNextProcess
0x180037F08: "__cdecl _imp_NtWaitForDebugEvent" __imp_NtWaitForDebugEvent
0x18002F100: whNtRemoveIoCompletionEx
0x180038048: "__cdecl _imp_NtAlpcDeleteResourceReserve" __imp_NtAlpcDeleteResourceReserve
0x18003CE60: "\Classes" ??_C@_1BC@BMEICANI@?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?$AA@
0x1800316F0: whNtSetInformationResourceManager
0x180038698: "__cdecl _imp_NtWriteFileGather" __imp_NtWriteFileGather
0x18000DFB0: whNtAccessCheck
0x18002DF74: whNtQuerySystemInformation_SystemPoolTagInformation
0x18000E4B4: whNT32ShallowThunkAllocObjectTypeList32TO64
0x180009E70: whNtQueryInformationToken
0x18000CD40: Wow64LdrpInitialize
0x1800063A0: whNtCreateEvent
0x180031FD0: whNtSetQuotaInformationFile
0x180037D88: "__cdecl _imp_DbgPrompt" __imp_DbgPrompt
0x180016ED0: whNtAllocateReserveObject
0x1800379B0: "__cdecl _imp_LdrLockLoaderLock" __imp_LdrLockLoaderLock
0x1800380E8: "__cdecl _imp_NtAlpcCancelMessage" __imp_NtAlpcCancelMessage
0x1800388E8: "__cdecl _imp_NtQueryMutant" __imp_NtQueryMutant
0x18002CC5C: whNtQueryObject_ObjectBasicInformation
0x1800174DF: memset
0x1800453A4: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180038820: "__cdecl _imp_NtInitializeNlsFiles" __imp_NtInitializeNlsFiles
0x180003E40: whNtQueryInformationThread
0x1800091C0: Wow64ShallowThunkSIZE_T32TO64
0x18000C4A0: Wow64ShallowThunkSIZE_T64TO32
0x180027420: whNtCreateToken
0x180038688: "__cdecl _imp_NtRegisterThreadTerminatePort" __imp_NtRegisterThreadTerminatePort
0x180033E20: whNtWaitLowEventPair
0x180003548: whNtSetInformationProcessTlsInformation
0x1800289E0: whNtGetCurrentProcessorNumber

[JEB Decompiler by PNF Software]