filenamewcp.dll
size3158384 (0x303170)
md52b046b69c2add76a535f117c66da740f
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
2573079512
1473072999
101606
2593079512
2613079520
256307951
26430795423
253307951
2603079512
255307951
258307951

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0xcaaefede
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2122
Magic0x10b
LinkerVersion14.30
SizeOfCode0x2d8400
SizeOfInitializedData0x2d600
SizeOfUninitializedData0
AddressOfEntryPoint0xaaa20
BaseOfCode0x1000
BaseOfData0x2db000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion10.0
ImageVersion10.0
SubsystemVersion6.1
Reserved10
SizeOfImage0x30b000
SizeOfHeaders0x400
CheckSum0x30c199
Subsystem3
DllCharacteristics0x4140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x2d61a30x2d6200R-X CODE
PAGE0x2d80000x1ea90x2000R-X CODE
PAGECMRC0x2da0000x660x200R-X CODE
.data0x2db0000xa4800x5400RW- IDATA
.idata0x2e60000x42240x4400R-- IDATA
.rsrc0x2eb0000x27d00x2800R-- IDATA
.reloc0x2ee0000x1c2a80x1c400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x2cbf700xb233
IMPORT0x2e682c0x3c0
RESOURCE0x2eb0000x27d0
EXCEPTION00
SECURITY0x300c000x2570
BASERELOC0x2ee0000x1c2a8
DEBUG0xa878c0x54
ARCHITECTURE00
GLOBALPTR00
TLS0x1278c0x18
LOAD_CONFIG0x10000x40
Bound_IAT00
IAT0x2e60000x824
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x102cbd2c0x102cbd380x102e06140x1001281800x300000
typenamesizecp
VERSION#19560
#614#190660
module_namehintordfunction_name
api-ms-win-crt-runtime-l1-1-0.dll56_initterm
api-ms-win-crt-runtime-l1-1-0.dll57_initterm_e
api-ms-win-crt-private-l1-1-0.dll354_o__i64tow_s
api-ms-win-crt-private-l1-1-0.dll355_o__initialize_narrow_environment
api-ms-win-crt-private-l1-1-0.dll356_o__initialize_onexit_table
api-ms-win-crt-private-l1-1-0.dll358_o__invalid_parameter_noinfo
api-ms-win-crt-private-l1-1-0.dll641_o__register_onexit_function
api-ms-win-crt-private-l1-1-0.dll648_o__seh_filter_dll
api-ms-win-crt-private-l1-1-0.dll733_o__ui64tow_s
api-ms-win-crt-private-l1-1-0.dll736_o__ultow
api-ms-win-crt-private-l1-1-0.dll737_o__ultow_s
api-ms-win-crt-private-l1-1-0.dll764_o__wcsicmp
api-ms-win-crt-private-l1-1-0.dll768_o__wcslwr
api-ms-win-crt-private-l1-1-0.dll774_o__wcsnicmp
api-ms-win-crt-private-l1-1-0.dll784_o__wcstoi64
api-ms-win-crt-private-l1-1-0.dll791_o__wcstoui64
api-ms-win-crt-private-l1-1-0.dll795_o__wcsupr
api-ms-win-crt-private-l1-1-0.dll1155memmove
api-ms-win-crt-private-l1-1-0.dll900_o_bsearch
api-ms-win-crt-private-l1-1-0.dll926_o_fflush
api-ms-win-crt-private-l1-1-0.dll945_o_free
api-ms-win-crt-private-l1-1-0.dll980_o_iswctype
api-ms-win-crt-private-l1-1-0.dll1018_o_malloc
api-ms-win-crt-private-l1-1-0.dll1029_o_memcpy_s
api-ms-win-crt-private-l1-1-0.dll1051_o_qsort
api-ms-win-crt-private-l1-1-0.dll1088_o_strcpy_s
api-ms-win-crt-private-l1-1-0.dll1112_o_tolower
api-ms-win-crt-private-l1-1-0.dll1113_o_toupper
api-ms-win-crt-private-l1-1-0.dll1120_o_wcscat_s
api-ms-win-crt-private-l1-1-0.dll1123_o_wcscpy_s
api-ms-win-crt-private-l1-1-0.dll1126_o_wcsncpy_s
api-ms-win-crt-private-l1-1-0.dll1132_o_wcstok_s
api-ms-win-crt-private-l1-1-0.dll1138_o_wcstoul
api-ms-win-crt-private-l1-1-0.dll50_except_handler4_common
api-ms-win-crt-private-l1-1-0.dll234_o__execute_onexit_table
api-ms-win-crt-private-l1-1-0.dll232_o__errno
api-ms-win-crt-private-l1-1-0.dll207_o__crt_atexit
api-ms-win-crt-private-l1-1-0.dll200_o__configure_narrow_argv
api-ms-win-crt-private-l1-1-0.dll187_o__cexit
api-ms-win-crt-private-l1-1-0.dll162_o__aligned_malloc
api-ms-win-crt-private-l1-1-0.dll161_o__aligned_free
api-ms-win-crt-private-l1-1-0.dll155_o___stdio_common_vswscanf
api-ms-win-crt-private-l1-1-0.dll154_o___stdio_common_vswprintf_s
api-ms-win-crt-private-l1-1-0.dll152_o___stdio_common_vswprintf
api-ms-win-crt-private-l1-1-0.dll151_o___stdio_common_vsscanf
api-ms-win-crt-private-l1-1-0.dll148_o___stdio_common_vsprintf
api-ms-win-crt-private-l1-1-0.dll147_o___stdio_common_vsnwprintf_s
api-ms-win-crt-private-l1-1-0.dll146_o___stdio_common_vsnprintf_s
api-ms-win-crt-private-l1-1-0.dll142_o___stdio_common_vfwprintf
api-ms-win-crt-private-l1-1-0.dll136_o___std_type_info_destroy_list
api-ms-win-crt-private-l1-1-0.dll1162wcsrchr
api-ms-win-crt-private-l1-1-0.dll1159strstr
api-ms-win-crt-private-l1-1-0.dll1161wcschr
api-ms-win-crt-private-l1-1-0.dll1163wcsstr
api-ms-win-crt-private-l1-1-0.dll1158strrchr
api-ms-win-crt-private-l1-1-0.dll86_o___acrt_iob_func
api-ms-win-crt-private-l1-1-0.dll1157strchr
api-ms-win-crt-private-l1-1-0.dll1153memcmp
api-ms-win-crt-private-l1-1-0.dll1154memcpy
api-ms-win-crt-string-l1-1-0.dll130memmove_s
api-ms-win-crt-string-l1-1-0.dll131memset
api-ms-win-crt-string-l1-1-0.dll142strncmp
api-ms-win-crt-string-l1-1-0.dll169wcsnlen
RPCRT4.dll542UuidFromStringW
RPCRT4.dll528RpcStringFreeW
RPCRT4.dll546UuidToStringW
api-ms-win-core-registry-l1-1-0.dll3RegCreateKeyExW
api-ms-win-core-registry-l1-1-0.dll15RegFlushKey
api-ms-win-core-registry-l1-1-0.dll40RegSetValueExW
api-ms-win-core-registry-l1-1-0.dll33RegQueryValueExW
api-ms-win-core-registry-l1-1-0.dll18RegGetValueW
api-ms-win-core-registry-l1-1-0.dllRegCloseKey
api-ms-win-core-registry-l1-1-0.dll9RegDeleteValueW
api-ms-win-core-registry-l1-1-0.dll28RegOpenKeyExW
api-ms-win-core-libraryloader-l1-1-0.dll7GetModuleFileNameA
api-ms-win-core-libraryloader-l1-1-0.dll12GetModuleHandleW
api-ms-win-core-libraryloader-l1-1-0.dll8GetModuleFileNameW
api-ms-win-core-libraryloader-l1-1-0.dll10GetModuleHandleExA
api-ms-win-core-libraryloader-l1-1-0.dll19LockResource
api-ms-win-core-libraryloader-l1-1-0.dll2FindResourceExW
api-ms-win-core-libraryloader-l1-1-0.dll16LoadResource
api-ms-win-core-libraryloader-l1-1-0.dll4FreeLibrary
api-ms-win-core-libraryloader-l1-1-0.dll13GetProcAddress
api-ms-win-core-libraryloader-l1-1-0.dll11GetModuleHandleExW
api-ms-win-core-libraryloader-l1-1-0.dll15LoadLibraryExW
api-ms-win-core-libraryloader-l1-1-0.dll22SizeofResource
api-ms-win-eventing-provider-l1-1-0.dll5EventUnregister
api-ms-win-eventing-provider-l1-1-0.dll9EventWriteTransfer
api-ms-win-eventing-provider-l1-1-0.dll3EventRegister
api-ms-win-eventing-provider-l1-1-0.dllEventActivityIdControl
api-ms-win-core-rtlsupport-l1-1-0.dll1RtlCaptureStackBackTrace
api-ms-win-core-profile-l1-1-0.dllQueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0.dll12GetCurrentThread
api-ms-win-core-processthreads-l1-1-0.dll47TlsSetValue
api-ms-win-core-processthreads-l1-1-0.dll13GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-0.dll11GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-0.dll26OpenProcessToken
api-ms-win-core-processthreads-l1-1-0.dll44TlsAlloc
api-ms-win-core-processthreads-l1-1-0.dll5CreateThread
api-ms-win-core-processthreads-l1-1-0.dll10GetCurrentProcess
api-ms-win-core-processthreads-l1-1-0.dll45TlsFree
api-ms-win-core-processthreads-l1-1-0.dll42TerminateProcess
api-ms-win-core-processthreads-l1-1-0.dll2CreateProcessW
api-ms-win-core-processthreads-l1-1-0.dll28OpenThreadToken
api-ms-win-core-processthreads-l1-1-0.dll46TlsGetValue
api-ms-win-core-processthreads-l1-1-0.dll14GetExitCodeProcess
api-ms-win-core-sysinfo-l1-1-0.dll10GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-1-0.dll7GetSystemInfo
api-ms-win-core-sysinfo-l1-1-0.dll17GetVersionExW
api-ms-win-core-sysinfo-l1-1-0.dll20GlobalMemoryStatusEx
api-ms-win-core-sysinfo-l1-1-0.dll14GetTickCount64
api-ms-win-core-interlocked-l1-1-0.dllInitializeSListHead
api-ms-win-core-debug-l1-1-0.dllDebugBreak
api-ms-win-core-debug-l1-1-0.dll3OutputDebugStringW
api-ms-win-core-debug-l1-1-0.dll1IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0.dll6UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll1GetLastError
api-ms-win-core-errorhandling-l1-1-0.dll4SetLastError
api-ms-win-core-errorhandling-l1-1-0.dll5SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-0.dll2RaiseException
api-ms-win-core-processthreads-l1-1-1.dll9IsProcessorFeaturePresent
api-ms-win-core-com-l1-1-0.dll61CoTaskMemAlloc
api-ms-win-core-com-l1-1-0.dll62CoTaskMemFree
api-ms-win-core-localization-l1-2-0.dll7FormatMessageW
api-ms-win-core-heap-l1-1-0.dll2HeapAlloc
api-ms-win-core-heap-l1-1-0.dll6HeapFree
api-ms-win-core-heap-l1-1-0.dllGetProcessHeap
api-ms-win-core-synch-l1-1-0.dll23OpenSemaphoreW
api-ms-win-core-synch-l1-1-0.dll26ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-1-0.dll29ResetEvent
api-ms-win-core-synch-l1-1-0.dllAcquireSRWLockExclusive
api-ms-win-core-synch-l1-1-0.dll6CreateEventW
api-ms-win-core-synch-l1-1-0.dll38WaitForMultipleObjectsEx
api-ms-win-core-synch-l1-1-0.dll1AcquireSRWLockShared
api-ms-win-core-synch-l1-1-0.dll16InitializeCriticalSectionAndSpinCount
api-ms-win-core-synch-l1-1-0.dll31SetEvent
api-ms-win-core-synch-l1-1-0.dll27ReleaseSRWLockShared
api-ms-win-core-synch-l1-1-0.dll28ReleaseSemaphore
api-ms-win-core-synch-l1-1-0.dll25ReleaseMutex
api-ms-win-core-synch-l1-1-0.dll40WaitForSingleObjectEx
api-ms-win-core-synch-l1-1-0.dll14EnterCriticalSection
api-ms-win-core-synch-l1-1-0.dll17InitializeCriticalSectionEx
api-ms-win-core-synch-l1-1-0.dll9CreateMutexExW
api-ms-win-core-synch-l1-1-0.dll13DeleteCriticalSection
api-ms-win-core-synch-l1-1-0.dll19LeaveCriticalSection
api-ms-win-core-synch-l1-1-0.dll11CreateSemaphoreExW
api-ms-win-core-synch-l1-1-0.dll39WaitForSingleObject
api-ms-win-core-handle-l1-1-0.dllCloseHandle
api-ms-win-core-handle-l1-1-0.dll2DuplicateHandle
api-ms-win-core-threadpool-l1-2-0.dll6CloseThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll34WaitForThreadpoolTimerCallbacks
api-ms-win-core-threadpool-l1-2-0.dll26SetThreadpoolTimer
api-ms-win-core-threadpool-l1-2-0.dll12CreateThreadpoolTimer
api-ms-win-core-synch-l1-2-0.dll9Sleep
api-ms-win-core-sysinfo-l1-2-0.dll3GetProductInfo
api-ms-win-core-sysinfo-l1-2-0.dll1GetNativeSystemInfo
api-ms-win-core-sysinfo-l1-2-0.dll8VerSetConditionMask
api-ms-win-eventing-legacy-l1-1-0.dll5FlushTraceW
api-ms-win-core-heap-obsolete-l1-1-0.dll12LocalReAlloc
api-ms-win-core-heap-obsolete-l1-1-0.dll10LocalFree
api-ms-win-core-heap-obsolete-l1-1-0.dll8LocalAlloc
api-ms-win-security-base-l1-1-0.dll55GetSidLengthRequired
api-ms-win-security-base-l1-1-0.dll31CreateWellKnownSid
api-ms-win-security-base-l1-1-0.dll56GetSidSubAuthority
api-ms-win-security-base-l1-1-0.dll41GetAce
api-ms-win-security-base-l1-1-0.dll58GetTokenInformation
api-ms-win-security-base-l1-1-0.dll65InitializeSid
api-ms-win-security-base-l1-1-0.dll70IsValidSid
api-ms-win-security-base-l1-1-0.dll63InitializeAcl
api-ms-win-security-base-l1-1-0.dll88SetPrivateObjectSecurityEx
api-ms-win-security-base-l1-1-0.dll45GetLengthSid
api-ms-win-security-base-l1-1-0.dll69IsValidSecurityDescriptor
api-ms-win-security-base-l1-1-0.dll33DestroyPrivateObjectSecurity
api-ms-win-security-base-l1-1-0.dll50GetSecurityDescriptorLength
api-ms-win-security-base-l1-1-0.dll92SetSecurityDescriptorGroup
api-ms-win-security-base-l1-1-0.dll74MakeSelfRelativeSD
api-ms-win-security-base-l1-1-0.dll7AddAccessAllowedAce
api-ms-win-security-base-l1-1-0.dll29CreatePrivateObjectSecurityWithMultipleInheritance
api-ms-win-security-base-l1-1-0.dll64InitializeSecurityDescriptor
api-ms-win-security-base-l1-1-0.dll47GetSecurityDescriptorControl
api-ms-win-security-base-l1-1-0.dll93SetSecurityDescriptorOwner
api-ms-win-security-base-l1-1-0.dll91SetSecurityDescriptorDacl
api-ms-win-core-kernel32-legacy-l1-1-0.dll38LoadLibraryA
api-ms-win-core-kernel32-legacy-l1-1-0.dll39LoadLibraryW
api-ms-win-security-provider-l1-1-0.dll1GetNamedSecurityInfoW
api-ms-win-core-file-l1-1-0.dll62SetEndOfFile
api-ms-win-core-file-l1-1-0.dll57ReadFile
api-ms-win-core-file-l1-1-0.dll34GetFileAttributesW
api-ms-win-core-file-l1-1-0.dll7DeleteFileW
api-ms-win-core-file-l1-1-0.dll4CreateFileW
api-ms-win-core-file-l1-1-0.dll41GetFinalPathNameByHandleW
api-ms-win-core-file-l1-1-0.dll64SetFileAttributesW
api-ms-win-core-file-l1-1-0.dll72WriteFile
api-ms-win-core-file-l1-1-0.dll24FlushFileBuffers
api-ms-win-core-file-l1-1-0.dll67SetFilePointerEx
api-ms-win-core-file-l1-1-0.dll37GetFileSizeEx
api-ms-win-core-namedpipe-l1-1-0.dll2CreatePipe
api-ms-win-core-processenvironment-l1-1-0.dll11GetEnvironmentVariableW
api-ms-win-core-kernel32-legacy-l1-1-1.dll14VerifyVersionInfoW
api-ms-win-core-string-l1-1-0.dll2CompareStringW
api-ms-win-core-file-l2-1-0.dll6MoveFileExW
api-ms-win-service-management-l1-1-0.dll5OpenServiceW
api-ms-win-service-management-l1-1-0.dll3DeleteService
api-ms-win-service-management-l1-1-0.dll4OpenSCManagerW
api-ms-win-service-management-l1-1-0.dllCloseServiceHandle
api-ms-win-service-management-l1-1-0.dll6StartServiceW
api-ms-win-service-winsvc-l1-1-0.dll2ControlService
api-ms-win-service-winsvc-l1-1-0.dll20QueryServiceStatus
api-ms-win-security-lsalookup-l2-1-0.dll1LookupAccountSidW
api-ms-win-security-cryptoapi-l1-1-0.dll1CryptAcquireContextW
api-ms-win-security-cryptoapi-l1-1-0.dll15CryptExportKey
api-ms-win-security-cryptoapi-l1-1-0.dll6CryptDestroyHash
api-ms-win-security-cryptoapi-l1-1-0.dll20CryptGetHashParam
api-ms-win-security-cryptoapi-l1-1-0.dllCryptAcquireContextA
api-ms-win-security-cryptoapi-l1-1-0.dll3CryptCreateHash
api-ms-win-security-cryptoapi-l1-1-0.dll27CryptReleaseContext
api-ms-win-security-cryptoapi-l1-1-0.dll7CryptDestroyKey
api-ms-win-security-cryptoapi-l1-1-0.dll24CryptHashData
api-ms-win-core-string-obsolete-l1-1-0.dll1lstrcmpA
api-ms-win-core-localization-obsolete-l1-2-0.dllCompareStringA
api-ms-win-core-libraryloader-l1-1-1.dll1EnumResourceLanguagesExW
api-ms-win-core-file-l1-2-0.dll1GetTempPathW
api-ms-win-security-lsapolicy-l1-1-0.dll15LsaQueryInformationPolicy
api-ms-win-security-lsapolicy-l1-1-0.dll1LsaClose
api-ms-win-security-lsapolicy-l1-1-0.dll13LsaOpenPolicy
api-ms-win-security-lsapolicy-l1-1-0.dll5LsaFreeMemory
ntdll.dll940RtlDuplicateUnicodeString
ntdll.dll754RtlAppendUnicodeStringToString
ntdll.dll966RtlEqualUnicodeString
ntdll.dll1040RtlGetControlSecurityDescriptor
ntdll.dll1268RtlMakeSelfRelativeSD
ntdll.dll1428RtlSetControlSecurityDescriptor
ntdll.dll748RtlAnsiCharToUnicodeChar
ntdll.dll1535RtlUnicodeToMultiByteN
ntdll.dll1223RtlIsTextUnicode
ntdll.dll1536RtlUnicodeToMultiByteSize
ntdll.dll823RtlConvertSidToUnicodeString
ntdll.dll217NtAllocateLocallyUniqueId
ntdll.dll497NtQueryInformationToken
ntdll.dll1243RtlLengthRequiredSid
ntdll.dll1024RtlFreeSid
ntdll.dll1506RtlTimeToTimeFields
ntdll.dll435NtOpenKey
ntdll.dll931RtlDosPathNameToNtPathName_U
ntdll.dll125LdrGetDllHandleEx
ntdll.dll1273RtlMultiByteToUnicodeN
ntdll.dll1274RtlMultiByteToUnicodeSize
ntdll.dll1015RtlFormatCurrentUserKeyPath
ntdll.dll1553RtlUpcaseUnicodeChar
ntdll.dll937RtlDowncaseUnicodeChar
ntdll.dll35DbgPrintEx
ntdll.dll1368RtlReAllocateHeap
ntdll.dll802RtlCompareMemory
ntdll.dll1269RtlMapGenericMask
ntdll.dll1086RtlGetSaclSecurityDescriptor
ntdll.dll1079RtlGetOwnerSecurityDescriptor
ntdll.dll741RtlAllocateAndInitializeSid
ntdll.dll713RtlAddAccessAllowedAce
ntdll.dll1062RtlGetGroupSecurityDescriptor
ntdll.dll964RtlEqualSid
ntdll.dll523NtQuerySystemInformation
ntdll.dll506NtQueryLicenseValue
ntdll.dll1569RtlValidAcl
ntdll.dll212NtAdjustPrivilegesToken
ntdll.dll1456RtlSetSaclSecurityDescriptor
ntdll.dll1573RtlValidSid
ntdll.dll351NtDuplicateToken
ntdll.dll609NtSetInformationThread
ntdll.dll1440RtlSetGroupSecurityDescriptor
ntdll.dll989RtlFindAceByType
ntdll.dll848RtlCreateEnvironmentEx
ntdll.dll976RtlExpandEnvironmentStrings_U
ntdll.dll1287RtlNtStatusToDosError
ntdll.dll702RtlAbsoluteToSelfRelativeSD
ntdll.dll1415RtlRunOnceComplete
ntdll.dll1414RtlRunOnceBeginInitialize
ntdll.dll1003RtlFindNextForwardRunClear
ntdll.dll1293RtlNumberOfSetBits
ntdll.dll1158RtlInitializeSRWLock
ntdll.dll530NtQueryVolumeInformationFile
ntdll.dll1386RtlReleaseSRWLockExclusive
ntdll.dll708RtlAcquireSRWLockExclusive
ntdll.dll838RtlCopyUnicodeString
ntdll.dll122LdrGetDllHandle
ntdll.dll616NtSetIoCompletion
ntdll.dll673NtWaitForMultipleObjects
ntdll.dll291NtCreateIoCompletion
ntdll.dll287NtCreateEvent
ntdll.dll1711TpSimpleTryPost
ntdll.dll553NtRemoveIoCompletion
ntdll.dll593NtSetEvent
ntdll.dll62EtwEventWrite
ntdll.dll59EtwEventRegister
ntdll.dll684NtYieldExecution
ntdll.dll808RtlComputeCrc32
ntdll.dll480NtQueryDirectoryFile
ntdll.dll726RtlAddAuditAccessObjectAce
ntdll.dll725RtlAddAuditAccessAceEx
ntdll.dll717RtlAddAccessDeniedAceEx
ntdll.dll715RtlAddAccessAllowedObjectAce
ntdll.dll718RtlAddAccessDeniedObjectAce
ntdll.dll1008RtlFirstFreeAce
ntdll.dll1110RtlHashUnicodeString
ntdll.dll484NtQueryEaFile
ntdll.dll1384RtlReleaseRelativeName
ntdll.dll592NtSetEaFile
ntdll.dll934RtlDosPathNameToRelativeNtPathName_U_WithStatus
ntdll.dll903RtlDeleteSecurityObject
ntdll.dll528NtQueryValueKey
ntdll.dll1048RtlGetDaclSecurityDescriptor
ntdll.dll867RtlCreateUnicodeStringFromAsciiz
ntdll.dll1362RtlRaiseException
ntdll.dll34DbgPrint
ntdll.dll1363RtlRaiseStatus
ntdll.dll1242RtlLeaveCriticalSection
ntdll.dll1021RtlFreeHeap
ntdll.dll1145RtlInitializeCriticalSection
ntdll.dll1446RtlSetLastWin32ErrorAndNtStatusFromNtStatus
ntdll.dll952RtlEnterCriticalSection
ntdll.dll111LdrDisableThreadCalloutsForDll
ntdll.dll494NtQueryInformationProcess
ntdll.dll1303RtlPcToFileHeader
ntdll.dll744RtlAllocateHeap
ntdll.dll895RtlDeleteCriticalSection
ntdll.dll438NtOpenKeyTransactedEx
ntdll.dll295NtCreateKey
ntdll.dll841RtlCreateAcl
ntdll.dll634NtSetValueKey
ntdll.dll604NtSetInformationKey
ntdll.dll454NtOpenThreadToken
ntdll.dll376NtFsControlFile
ntdll.dll350NtDuplicateObject
ntdll.dll364NtFlushBuffersFile
ntdll.dll1138RtlInitUnicodeStringEx
ntdll.dll473NtQueryAttributesFile
ntdll.dll720RtlAddAce
ntdll.dll342NtDeleteValueKey
ntdll.dll1047RtlGetCurrentTransaction
ntdll.dll622NtSetSecurityObject
ntdll.dll338NtDeleteFile
ntdll.dll1280RtlNewSecurityObjectEx
ntdll.dll296NtCreateKeyTransacted
ntdll.dll714RtlAddAccessAllowedAceEx
ntdll.dll601NtSetInformationFile
ntdll.dll1326RtlQueryInformationAcl
ntdll.dll496NtQueryInformationThread
ntdll.dll1606RtlpApplyLengthFunction
ntdll.dll517NtQuerySecurityObject
ntdll.dll1031RtlGetAce
ntdll.dll358NtEnumerateValueKey
ntdll.dll680NtWriteFile
ntdll.dll1068RtlGetLengthWithoutLastFullDosOrNtPathElement
ntdll.dll355NtEnumerateKey
ntdll.dll1432RtlSetCurrentTransaction
ntdll.dll1448RtlSetOwnerSecurityDescriptor
ntdll.dll445NtOpenProcessToken
ntdll.dll339NtDeleteKey
ntdll.dll505NtQueryKey
ntdll.dll538NtReadFile
ntdll.dll1288RtlNtStatusToDosErrorNoTeb
ntdll.dll1027RtlFreeUnicodeString
ntdll.dll1244RtlLengthSecurityDescriptor
ntdll.dll847RtlCreateEnvironment
ntdll.dll912RtlDestroyEnvironment
ntdll.dll1437RtlSetEnvironmentVariable
ntdll.dll334NtDelayExecution
ntdll.dll129LdrGetProcedureAddress
ntdll.dll178LdrUnloadDll
ntdll.dll139LdrLoadDll
ntdll.dll1137RtlInitUnicodeString
ntdll.dll1245RtlLengthSid
ntdll.dll755RtlAppendUnicodeToString
ntdll.dll805RtlCompareUnicodeString
ntdll.dll861RtlCreateServiceSid
ntdll.dll1492RtlSubAuthoritySid
ntdll.dll1491RtlSubAuthorityCountSid
ntdll.dll835RtlCopySid
ntdll.dll1433RtlSetDaclSecurityDescriptor
ntdll.dll860RtlCreateSecurityDescriptor
ntdll.dll750RtlAnsiStringToUnicodeString
ntdll.dll1124RtlInitAnsiString
ntdll.dll404NtLoadKey2
ntdll.dll436NtOpenKeyEx
ntdll.dll1159RtlInitializeSid
ntdll.dll368NtFlushKey
ntdll.dll661NtUnloadKey2
ntdll.dll289NtCreateFile
ntdll.dll509NtQueryObject
ntdll.dll575NtRollbackTransaction
ntdll.dll267NtCommitTransaction
ntdll.dll324NtCreateTransaction
ntdll.dll498NtQueryInformationTransaction
ntdll.dll444NtOpenProcess
ntdll.dll491NtQueryInformationFile
ntdll.dll432NtOpenFile
ntdll.dll1505RtlTimeToSecondsSince1980
ntdll.dll675NtWaitForSingleObject
ntdll.dll1320RtlQueryEnvironmentVariable_U
ntdll.dll525NtQuerySystemTime
ntdll.dll262NtClose
ntdll.dll345NtDeviceIoControlFile
ntdll.dll2080ZwQuerySystemInformation
ntdll.dll1029RtlGUIDFromString
ntdll.dll1488RtlStringFromGUID
ntdll.dll2030ZwQueryAttributesFile
ntdll.dll2232ZwWaitForSingleObject
ntdll.dll2062ZwQueryKey
ntdll.dll2107ZwReleaseMutant
ntdll.dll1989ZwOpenFile
ntdll.dll1997ZwOpenMutant
ntdll.dll1821ZwClose
ntdll.dll1854ZwCreateKey
ntdll.dll1960ZwLoadKey
ntdll.dll1900ZwDeleteValueKey
ntdll.dll1897ZwDeleteKey
ntdll.dll1913ZwEnumerateKey
ntdll.dll2085ZwQueryValueKey
ntdll.dll2179ZwSetSecurityObject
ntdll.dll2217ZwUnloadKey
ntdll.dll2191ZwSetValueKey
ntdll.dll1992ZwOpenKey
ntdll.dll1780ZwAllocateUuids
ntdll.dll2077ZwQuerySymbolicLinkObject
ntdll.dll1903ZwDeviceIoControlFile
ntdll.dll2039ZwQueryDirectoryObject
ntdll.dll2009ZwOpenSymbolicLinkObject
ntdll.dll1108RtlGetVersion
ntdll.dll1985ZwOpenDirectoryObject
ntdll.dll2051ZwQueryInformationProcess
ntdll.dll2048ZwQueryInformationFile
ntdll.dll2001ZwOpenProcess
ntdll.dll446NtOpenProcessTokenEx
ntdll.dll455NtOpenThreadTokenEx
ntdll.dll1121RtlImpersonateSelf
ntdll.dll452NtOpenSymbolicLinkObject
ntdll.dll520NtQuerySymbolicLinkObject
ntdll.dll475NtQueryBootEntryOrder
ntdll.dll476NtQueryBootOptions
ntdll.dll657NtTranslateFilePath
ntdll.dll428NtOpenDirectoryObject
ntdll.dll482NtQueryDirectoryObject
ntdll.dll353NtEnumerateBootEntries
ntdll.dll61EtwEventUnregister
ntdll.dll512NtQueryPerformanceCounter
bcrypt.dll13BCryptDestroyHash
bcrypt.dll39BCryptOpenAlgorithmProvider
bcrypt.dll6BCryptCreateHash
bcrypt.dll35BCryptHashData
bcrypt.dll33BCryptGetProperty
bcrypt.dll2BCryptCloseAlgorithmProvider
bcrypt.dll27BCryptFinishHash
CRYPT32.dll15CertAddStoreToCollection
CRYPT32.dll60CertFreeCTLContext
CRYPT32.dll8CertAddEncodedCertificateToStore
CRYPT32.dll177CryptMsgClose
CRYPT32.dll71CertGetEnhancedKeyUsage
CRYPT32.dll188CryptMsgUpdate
CRYPT32.dll69CertGetCertificateChain
CRYPT32.dll64CertFreeCertificateContext
CRYPT32.dll183CryptMsgGetAndVerifySigner
CRYPT32.dll57CertFindSubjectInCTL
CRYPT32.dll185CryptMsgOpenToDecode
CRYPT32.dll18CertCloseStore
CRYPT32.dll184CryptMsgGetParam
CRYPT32.dll25CertCreateCTLContext
CRYPT32.dll161CryptHashCertificate2
CRYPT32.dll61CertFreeCertificateChain
CRYPT32.dll167CryptImportPublicKeyInfoEx
CRYPT32.dll89CertOpenStore
CRYPT32.dll118CertVerifyCertificateChainPolicy
CRYPT32.dll79CertGetSubjectCertificateFromStore
CRYPT32.dll132CryptDecodeObject
OLEAUT32.dll200
OLEAUT32.dll6
ordentry_vafunction_name
10x26fa70??$ReplaceVariablesInStringCallthrough@U_LUNICODE_STRING@@@Rtl@Implementation@WCP@Windows@@YGJPAXPBU_LBLOB@@PAU_RTL_SMART_LBLOB_UCSCHAR_WRITING_CONTEXT@@@Z
20x1528a0??0AIAsimovProvider@COM@Windows@@QAE@XZ
30x225810??0CBackupFileCreator@PrimitiveInstaller@@QAE@XZ
40x227770??0CBaseInstaller@PrimitiveInstaller@@IAE@XZ
50x2278d0??0CCoordinator@PrimitiveInstaller@@QAE@XZ
60x228bb0??0CFileInstaller@@QAE@XZ
70x227b50??0CGacPrimitiveInstaller@@QAE@XZ
80x22c6f0??0CMigInfoInstaller@@QAE@XZ
90x153740??0CQueueExecutor@COM@Windows@@QAE@XZ
100x106c70??0CRawInstallMap@InstallMap@@QAE@XZ
110x109d10??0CRawStoreLayout@ComponentStore@@QAE@XZ
120x22e860??0CRegistryInstaller@@QAE@XZ
130xabda0??0CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QAE@XZ
140x1f0b90??0CXmlCursor@@QAE@XZ
150x152900??1AIAsimovProvider@COM@Windows@@QAE@XZ
160x269530??1AutoLZMSDecoder@Rtl@WCP@Windows@@QAE@XZ
170x269580??1AutoLZMSEncoder@Rtl@WCP@Windows@@QAE@XZ
180x225860??1CBackupFileCreator@PrimitiveInstaller@@QAE@XZ
190x1587f0??1CComponentInformation@COM@Windows@@QAE@XZ
200x210b70??1CCoordinator@PrimitiveInstaller@@QAE@XZ
210x210d30??1CGacPrimitiveInstaller@@QAE@XZ
220x22c720??1CMigInfoInstaller@@QAE@XZ
230x238c00??1CPbrInstaller@@QAE@XZ
240x158870??1CQueueExecutor@COM@Windows@@QAE@XZ
250x106cf0??1CRawInstallMap@InstallMap@@QAE@XZ
260x10a380??1CRawStoreLayout@ComponentStore@@QAE@XZ
270x22ea50??1CRegistryInstaller@@QAE@XZ
280xac600??1CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QAE@XZ
290x239320??1CSettingsInstaller@@QAE@XZ
300x23c6e0??1CShortcutInstaller@@QAE@XZ
310x23e600??1CSysprepInstaller@@QAE@XZ
320x271200??1PrivilegeAcquisition@RtlSystemUtil@@QAE@XZ
330x271250?Acquire@PrivilegeAcquisition@RtlSystemUtil@@QAEJABU?$Vector@$$CBJ@Windows@@@Z
340x160470?AcquireInstallerComponentPath@LocalInstallerServices@COM@WCP@Windows@@UAGJKPAUIDefinitionIdentity@@PAPA_WPAK@Z
350x10aee0?AcquireRequiredResources@CRawStoreLayout@ComponentStore@@QAEJXZ
360x10b1b0?AddCatalogFile@CRawStoreLayout@ComponentStore@@QAEJPBU_LBLOB@@KPAUIRtlSystemIsolationLayer@Rtl@Windows@@PAUIRtlFile@56@PAV?$Auto@U_LUNICODE_STRING@@@6@@Z
370x10b580?AddCatalogMarkFromTlc@CRawStoreLayout@ComponentStore@@QAEJABU_LUNICODE_STRING@@PAUTlcData@2@@Z
380x211fc0?AddChange@ExecutionQueueDeriver@AiQueue@@QAEJPBVWcpManifest@@0@Z
390x10b7c0?AddComponentFile@CRawStoreLayout@ComponentStore@@QAEJKPAUComponentData@2@ABU_LUNICODE_STRING@@KPAUIRtlSystemIsolationLayer@Rtl@Windows@@PAUIRtlFile@67@KPAUIRtlDirectory@67@ABU?$Vector@$$CBUHashInfo@Rtl@ManifestParser@Windows@@@7@PAV?$Auto@PAUIRtlFile@Rtl@Windows@@@7@6PAK@Z
400x10c440?AddComponentImplication@CRawStoreLayout@ComponentStore@@QAEJABUComponentData@2@PAUTlcData@2@@Z
410x2125a0?AddInspect@ExecutionQueueDeriver@AiQueue@@QAEJABVWcpManifest@@@Z
420x106d50?AddInstallMarkToFamily@CRawInstallMap@InstallMap@@QAEJPAUMapForFamily@2@ABT_FOUR_PART_VERSION@@@Z
430x160560?AddInstallerFailureAnnotation@LocalInstallerServices@COM@WCP@Windows@@UAGJKPA_W@Z
440x1605f0?AddRef@LocalInstallerServices@COM@WCP@Windows@@UAGKXZ
450x1605f0?AddRef@LocalTransformerServices@COM@WCP@Windows@@UAGKXZ
460x10c510?AddTlcMark@CRawStoreLayout@ComponentStore@@QAEJKABUTlcInstaller@2@PAUTlcData@2@@Z
470x1648f0AddTrusteeCapabilities
480x11a850?AddVerifiedCatalogMarkInVersionedIndex@CRawStoreLayout@ComponentStore@@QAEJPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@@Z
490x292c90?AllocGroup@CMultiThreadExecQ@MTEQ@@QAEJPAV?$AutoNewPtr@VCItemGroupContextBase@MTEQ@@@Windows@@PAV?$AutoNewPtr@VCGroup@MTEQ@@@4@@Z
500x164d20AllocateTrusteeData
510x21d150?ApplySecurityToObjectEx@@YGJKPAUIRtlSystemObject@Rtl@Windows@@PBU_SECURITY_DESCRIPTOR@@@Z
520x21d280?ApplySecurityToObjectWithDefaults@@YGJ_NPAUIRtlSystemObject@Rtl@Windows@@PBU_SECURITY_DESCRIPTOR@@@Z
530x1f1040?Canonicalize@CBaseCanonicalizer@@QAEJPAUIRtlMicrodom@Rtl@Microdom@Windows@@ABU?$Vector@UNode@Rtl@Microdom@Windows@@@5@PAUIRtlWOFOStream@35@@Z
540x1f2510?Canonicalize@CC14NCanonicalizer@@MAEJUElement@Rtl@Microdom@Windows@@@Z
550x1f2790?Canonicalize@CC14NCanonicalizer@@MAEJUProcessingInstruction@Rtl@Microdom@Windows@@@Z
560x1f2940?Canonicalize@CC14NCanonicalizer@@MAEJUText@Rtl@Microdom@Windows@@@Z
570x120270?CheckComponentFileFlag@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@U_LUNICODE_STRING@@PA_N@Z
580x1203e0?CheckComponentFlag@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PA_N@Z
590x282c70?ChooseBitnessFromIdentityAndTarget@MacroReplacement@@YGJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAK@Z
600x106de0?CleanupInstallMap@CRawInstallMap@InstallMap@@QAEJXZ
610x1072f0?ClearServicingFamilyWinningVersion@CRawInstallMap@InstallMap@@QAEJPAUMapForFamily@2@PAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@@Z
620x1abed0?Close@?$Auto@U_ACL@@@Windows@@QAEXXZ
630x271a50?Close@?$Auto@U_SECURITY_DESCRIPTOR@@@Windows@@QAEXXZ
640x1abed0?Close@?$Auto@U_SID@@@Windows@@QAEXXZ
650x26a2f0?Close@AutoDeltaBlob@Rtl@Windows@@QAEXXZ
660x1244e0?Close@CApplicationAccessor@@QAEXXZ
670x26b390?Close@CCatalog@@QAEJXZ
680x292d40?Close@CMultiThreadExecQ@MTEQ@@QAEJXZ
690xb1eb0?CmsGetBestFileHashInformation@WcpManifest@@UBEJABUFile@WcpManifestParser@@PAUHashInfo@Rtl@ManifestParser@Windows@@@Z
700xb1ed0?CmsGetFileHashInformation@WcpManifest@@SGJABUFile@WcpManifestParser@@PAUHashInfo@Rtl@ManifestParser@Windows@@@Z
710xb4700?CmsVerifyFileHashes@Rtl@ManifestParser@Windows@@YGJKABU?$Vector@$$CBUHashInfo@Rtl@ManifestParser@Windows@@@3@ABU_LUNICODE_STRING@@PAUIRtlFile@13@PAUIRtlDefinitionIdentity@1Identity@3@PAK@Z
720x1d80b0?CoTaskMemAlloc@COM@Windows@@YGPAXK@Z
730x1d8100?CoTaskMemFree@COM@Windows@@YGXPBX@Z
740x106ad0?CompareIdentityAttributeValue@Rtl@Identity@Windows@@YGJPBU_LUNICODE_STRING@@0PAH@Z
750x21dfa0?CompareSecurityDescriptorFromObjectAgainstManifest@Rtl@Implementation@WCP@Windows@@YGJKPBU_SECURITY_DESCRIPTOR@@0PA_N@Z
760x293d50?CompressManifest@Rtl@Implementation@WCP@Windows@@YGJK_NPBU_LBLOB@@PAUIRtlFile@14@@Z
770x2835d0?ConvertIn@COM@Windows@@YGJPAUIDefinitionIdentity@@PAPAUIRtlDefinitionIdentity@Rtl@Identity@2@@Z
780x21ce50?ConvertSecurityDescriptorToString@CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QBEJKPAXKPAV?$Auto@U_LUNICODE_STRING@@@5@PAK@Z
790x21cf60?ConvertStringSecurityDescriptor@CSecurityDescriptorFactory@Rtl@Implementation@WCP@Windows@@QBEJKABU_LUNICODE_STRING@@PAV?$Auto@U_SECURITY_DESCRIPTOR@@@5@PAK@Z
800xf4e70?CopyOut@COM@Windows@@YGJPAUIRtlDefinitionIdentity@Rtl@Identity@2@PAPAUIDefinitionIdentity@@@Z
810x21ed70?CopyOutPath@COM@Windows@@YGJPBU_LUNICODE_STRING@@PAPA_W@Z
820x26b720?Create@CCatalog@@QAEJKKPBU_LBLOB@@PAK@Z
830x214fa0?CreateAdvInstallerQueueFromXml@AiQueue@@YGJPAUIRtlIdentityAuthority@Rtl@Identity@Windows@@PAUIRtlMicrodom@3Microdom@5@PAV?$Auto@U?$Vector@VExecutionQueueEntry@AiQueue@@@Windows@@@5@@Z
840x271b60?CreateSecurityDescriptorFromParts@Rtl@Implementation@WCP@Windows@@YGJKPBU_SID@@0PBU_ACL@@1PAV?$Auto@U_SECURITY_DESCRIPTOR@@@4@@Z
850x10d060?DecodeTlcInstallerFromMarkValueAndData@ComponentStore@@YGJABU_LUNICODE_STRING@@ABU_LBLOB@@PAUTlcInstaller@1@PA_N@Z
860x271d50?DecomposeSecurityDescriptor@Rtl@Implementation@WCP@Windows@@YGJPBU_SECURITY_DESCRIPTOR@@PAKPAV?$Auto@U_SID@@@4@2PAV?$Auto@U_ACL@@@4@3PAG@Z
870x293ed0?DecompressManifest@Rtl@Implementation@WCP@Windows@@YGJKPAV?$Auto@U_LBLOB@@@4@PAK@Z
880x1259b0?DeletePendingFiles@CRawStoreLayout@ComponentStore@@QAEJXZ
890x1655d0DeleteTrusteeCapabilities
900x165680DeleteTrusteeData
910x26a600?DeltaCompressFile@Rtl@Windows@@YGJKKPAU_LBLOB@@PBU3@0PAUIRtlFile@12@@Z
920x26a700?DeltaCompressFile@Rtl@Windows@@YGJKPAUIRtlFile@12@PBU_LBLOB@@00@Z
930x26a7e0?DeltaDecompressBuffer@Rtl@Windows@@YGJKPAU_LBLOB@@K0PAVAutoDeltaBlob@12@1@Z
940x26aa80?DeltaDecompressBuffer@Rtl@Windows@@YGJKPAU_LBLOB@@K0PAVAutoDeltaBlob@12@@Z
950x26aab0?DeltaDecompressFile@Rtl@Windows@@YGJPAUIRtlFile@12@K00@Z
960x26aae0?DeltaDecompressFile@Rtl@Windows@@YGJPAUIRtlFile@12@K00PAVAutoDeltaBlob@12@@Z
970x1e15b0?DestroyOutputStream@Tracing@Windows@@YGXPAUIRtlFormattedOutputStream@Rtl@2@@Z
980x21f0f0?DoesFileMatchHashInManifest@Rtl@Implementation@WCP@Windows@@YGJABU?$Vector@$$CBUHashInfo@Rtl@ManifestParser@Windows@@@4@ABU_LUNICODE_STRING@@PAUIRtlFile@14@PAUIRtlDefinitionIdentity@1Identity@4@PA_N@Z
990x213760?DoesManifestContainAIs@ExecutionQueueDeriver@AiQueue@@QAEJABVWcpManifest@@PA_N@Z
1000x26ba50?DoesTargetHaveTestRootCert@@YGJPAUIRtlSystemIsolationLayerPublic@Rtl@Windows@@PA_N@Z
1010x130ed0?EnsureComponentFullyPresent@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PBVWcpManifest@@PAK@Z
1020x276a30EnumerateFileRedirections
1030x277820EnumerateRegistryRedirections
1040x215ca0?ExecutionQueueToXml@AiQueue@@YGJKABU?$Vector@VExecutionQueueEntry@AiQueue@@@Windows@@PAUIRtlIdentityAuthority@Rtl@Identity@3@PAUIRtlXmlWriter@5Microdom@3@@Z
1050x284310?FileHashAlgorithmToDigest@Rtl@Cms@Windows@@YG?AW4_CMS_HASH_DIGESTMETHOD@23@K@Z
1060x26edb0?FilePathCombine@COM@Windows@@YGJPBGABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@2@@Z
1070x1f2ea0?Finalize@CC14NCanonicalizer@@MAEJXZ
1080x213790?Finalize@ExecutionQueueDeriver@AiQueue@@QAEJPAV?$Auto@U?$Vector@VExecutionQueueEntry@AiQueue@@@Windows@@@Windows@@PAK@Z
1090x23f590?FinalizeChanges@CCoordinator@PrimitiveInstaller@@QAEJXZ
1100x293080?FinalizeGroup@CMultiThreadExecQ@MTEQ@@QAEJV?$AutoNewPtr@VCGroup@MTEQ@@@Windows@@@Z
1110x15b820?FinalizeValue@CComponentInformationTableTraits@COM@Windows@@SGXAAV?$Auto@PAVCComponentInformation@COM@Windows@@@3@@Z
1120x26bad0?FindSubject@CCatalog@@QBEJKPBU_LBLOB@@PA_NPAJ@Z
1130x135e30?FindUnchangedMatchingVersions@VersionedIndexHelper@ComponentStore@@QAEJPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@KKABU_LBLOB@@PAV?$CVector@T_FOUR_PART_VERSION@@VCCallDisposition@Rtl@BUCL@@@BUCL@@@Z
1140x2700c0?FormatFourPartVersion@Rtl@Implementation@WCP@Windows@@YGJKABT_FOUR_PART_VERSION@@PAE1P6I?AU_RTL_UCSCHAR_ENCODER_RETURN_VALUE@@K11@ZPAPAE@Z
1150x2702a0?FormatFourPartVersion@Rtl@Implementation@WCP@Windows@@YGJKPBT_FOUR_PART_VERSION@@PAV?$Auto@U_LUNICODE_STRING@@@4@@Z
1160x270700?FormatNumberIntoBuffer@Rtl@Implementation@WCP@Windows@@YGJ_KKPAE1P6I?AU_RTL_UCSCHAR_ENCODER_RETURN_VALUE@@K11@ZPAPAE@Z
1170x277890FreeRedirectionsMemory
1180x1e6d00?FsnpDowncaseChar@@YIKK@Z
1190x26bb80?GenerateCatalogThumbprint@@YGJPAUIRtlFile@Rtl@Windows@@PAV?$Auto@U_LUNICODE_STRING@@@3@@Z
1200x26bc10?GenerateCatalogThumbprint@@YGJPBU_LBLOB@@PAV?$Auto@U_LUNICODE_STRING@@@Windows@@@Z
1210xb2570?GetComDefinitionIdentity@WcpManifest@@UBEJPAV?$AutoComPtr@UIDefinitionIdentity@@@Windows@@@Z
1220x10efa0?GetComponentAbsolutePath@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAV?$Auto@U_LUNICODE_STRING@@@6@@Z
1230x10f0e0?GetComponentAbsolutePath@ComponentStore@@YGJKPAUIRtlIdentityAuthority@Rtl@Identity@Windows@@PAUIRtlDefinitionIdentity@345@PAUIRtlSystemIsolationLayer@35@2ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@5@@Z
1240x10f220?GetComponentFileAbsolutePath@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@6@2@Z
1250x10f930?GetComponentMatchingVersions@CRawStoreLayout@ComponentStore@@QAEJPAUComponentData@2@_NPAV?$CVector@T_FOUR_PART_VERSION@@VCCallDisposition@Rtl@BUCL@@@BUCL@@@Z
1260x11bb10?GetComponentVersionedKey@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAV?$Auto@PAUIRtlKey@Rtl@Windows@@@6@PAK@Z
1270x107940?GetComponentWinningVersion@CRawInstallMap@InstallMap@@QAEJPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAT_FOUR_PART_VERSION@@PA_N_N@Z
1280x26ac20?GetCompressedFileType@Rtl@WCP@Windows@@YGKPBU_LBLOB@@@Z
1290x293130?GetContext@CGroup@MTEQ@@QAEXPAV?$AutoNewPtr@VCItemGroupContextBase@MTEQ@@@Windows@@@Z
1300x26eec0?GetCurrentDllWin32Path@COM@Windows@@YGJPAXPAV?$Auto@U_LUNICODE_STRING@@@2@@Z
1310x1100c0?GetDeltaDirectoryNameFromFlag@ComponentStore@@YG?AU_LUNICODE_STRING@@K@Z
1320xb25e0?GetDependencyIdentity@WcpManifest@@QBEJABUDependency@WcpManifestParser@@PAV?$Auto@PAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@@Windows@@@Z
1330x110130?GetExternalDirPath@CRawStoreLayout@ComponentStore@@QAEJPAPBU_LUNICODE_STRING@@@Z
1340xb2880?GetFileHashes@WcpManifest@@SGJABUFile@WcpManifestParser@@PAV?$CVector@UHashInfo@Rtl@ManifestParser@Windows@@VCCallDisposition@2BUCL@@@BUCL@@PAPAUHashInfo@Rtl@ManifestParser@Windows@@@Z
1350x21d420?GetFileSystemDefaultSecurity@@YGJKPAV?$Auto@U_SECURITY_DESCRIPTOR@@@Windows@@@Z
1360x165740GetGroupTrusteeDataCountFromManifest
1370x1657c0GetGroupTrusteeDataFromManifest
1380x1607e0?GetIsolationAllocator@LocalTransformerServices@COM@WCP@Windows@@UAGJPAPAUIMalloc@@@Z
1390x294550?GetLUnicodeParameter@Rtl@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@4@PAK@Z
1400x2931e0?GetNextCompletedItemIfAvailable@CGroup@MTEQ@@QAEJPAV?$AutoNewPtr@VCItemExecutorBase@MTEQ@@@Windows@@@Z
1410x294750?GetNtFilePathParameter@Rtl@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@4@PAKK@Z
1420x294840?GetNtRegistryPathParameter@Rtl@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@4@PAKK@Z
1430x1e15e0?GetOutputStreamStreamFromSink@Tracing@Windows@@YGXPAUIRtlOutputSink@Rtl@2@PAPAUIRtlFormattedOutputStream@42@@Z
1440x160850?GetParameter@LocalTransformerServices@COM@WCP@Windows@@UAGJKPB_WPAPA_WPAK@Z
1450x287b20?GetPoqXmlPath@@YG?BU?$Vector@QBU_UNICODE_STRING@@@Windows@@XZ
1460x160e10?GetRollbackSystem@LocalTransformerServices@COM@WCP@Windows@@UAGJPAPAUIRtlSystemIsolationLayerPublic@Rtl@4@@Z
1470x110250?GetRootDirPath@CRawStoreLayout@ComponentStore@@QAEJPAPBU_LUNICODE_STRING@@@Z
1480x26cb20?GetSignerPublicKeyToken@CCatalog@@QAEJPAUIRtlSystemIsolationLayer@Rtl@Windows@@PAU_LBLOB@@@Z
1490x160ec0?GetSystem@LocalTransformerServices@COM@WCP@Windows@@UAGJPAPAUIRtlSystemIsolationLayerPublic@Rtl@4@@Z
1500x1102a0?GetTemporaryDirectory@CRawStoreLayout@ComponentStore@@QAEJKPAV?$Auto@PAUIRtlDirectory@Rtl@Windows@@@Windows@@@Z
1510x2729f0?GetUTF8FileWriterStream@Rtl@Windows@@YGJPAUIRtlFile@12@PAV?$Auto@PAUIRtlWOFOUCSStream@Rtl@Windows@@@2@@Z
1520x110850?GetUniqueName@ComponentStore@@YGJPAV?$Auto@U_LUNICODE_STRING@@@Windows@@@Z
1530x160f60?GetUserProfile@LocalTransformerServices@COM@WCP@Windows@@UAGJPAPAUIRtlUserProfile@Rtl@4@@Z
1540x294ab0?GetWin32FilePathParameter@COM@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@PBGPAPAGPAKK@Z
1550x26f170?GetWin32PathOfSiblingFile@COM@Windows@@YGJPAXPBGPAV?$Auto@U_LUNICODE_STRING@@@2@@Z
1560x26f190?GetWin32PathOfSiblingFile@COM@Windows@@YGJPAXPB_WPAV?$Auto@U_LUNICODE_STRING@@@2@@Z
1570x294bf0?GetWin32RegistryPathParameter@COM@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@PBGPAPAUHKEY__@@PAPAGPAKK@Z
1580x29b260?GetXml@XmlParserGenerator@@YGJPBUDomElement@1@PAV?$Auto@U_LUTF8_STRING@@@Windows@@@Z
1590x213b50?HasImpactfulOperation@ExecutionQueueDeriver@AiQueue@@QBE_NXZ
1600x29beb0?Hydrate@DeltaHydrator@@YGJPAUIRtlFile@Rtl@Windows@@PAUDeltaFile@1@100@Z
1610x110e30?HydrateFile@CRawStoreLayout@ComponentStore@@QAEJPAUComponentData@2@T_FOUR_PART_VERSION@@U_LUNICODE_STRING@@PAUIRtlFile@Rtl@Windows@@PAUIRtlDirectory@78@PAV?$Auto@PAUIRtlFile@Rtl@Windows@@@8@5PAV?$CVector@UPossibleCorruption@ComponentStore@@VCCallDisposition@Rtl@BUCL@@@BUCL@@PAK@Z
1620x29c160?HydrateNull@DeltaHydrator@@YGJPAUIRtlFile@Rtl@Windows@@0@Z
1630x1206b0?InitComponentData@VersionedIndexHelper@ComponentStore@@QAEJ_NPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAUComponentData@2@PA_N@Z
1640x269640?Initialize@AutoLZMSDecoder@Rtl@WCP@Windows@@QAEJXZ
1650x269750?Initialize@AutoLZMSEncoder@Rtl@WCP@Windows@@QAEJXZ
1660x124530?Initialize@CApplicationAccessor@@QAEJPAUIRtlDefinitionAppId@Rtl@AppId@Windows@@PAUIRtlAppIdAuthority@345@@Z
1670x1f12e0?Initialize@CBaseCanonicalizer@@MAEJPAUIRtlMicrodom@Rtl@Microdom@Windows@@ABU?$Vector@UNode@Rtl@Microdom@Windows@@@5@PAUIRtlWOFOStream@35@@Z
1680x1f3c00?Initialize@CC14NCanonicalizer@@MAEJPAUIRtlMicrodom@Rtl@Microdom@Windows@@ABU?$Vector@UNode@Rtl@Microdom@Windows@@@5@PAUIRtlWOFOStream@35@@Z
1690x124600?Initialize@CComponentAccessor@@QAEJPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAUIRtlIdentityAuthority@345@@Z
1700x23fe40?Initialize@CCoordinator@PrimitiveInstaller@@QAEJKKKPAUIRtlPrimitiveInstallerSupport@Rtl@PrimitiveInstallers@Windows@@PAUIRtlPrimitiveInstallerRepairCallback@456@PAUIRtlSystemIsolationLayer@46@@Z
1710x293350?Initialize@CMultiThreadExecQ@MTEQ@@QAEJ_NKK@Z
1720x15d1c0?Initialize@CQueueExecutor@COM@Windows@@QAEJKPB_WPAVIComponentStoreHelper@23@PAUIRtlSystemIsolationLayer@Rtl@3@PAVCTransactionContent@23@@Z
1730x107f50?Initialize@CRawInstallMap@InstallMap@@QAEJ_NPAUIRtlIdentityAuthority@Rtl@Identity@Windows@@PAUIRtlKey@46@PAUIRtlSystemIsolationLayer@46@@Z
1740x1f0d80?Initialize@CXmlCursor@@QAEJPAXK@Z
1750x213b70?Initialize@ExecutionQueueDeriver@AiQueue@@QAEJKKK_KPAUIRtlSystemIsolationLayer@Rtl@Windows@@1PBV?$CVector@UTransformsChangeQueueEntry@AiQueue@@VCCallDisposition@Rtl@BUCL@@@BUCL@@@Z
1760x11bd40?Initialize@VersionedIndexHelper@ComponentStore@@QAEJPAUIRtlKey@Rtl@Windows@@_NPAVIStoreLayoutHelper@2@PAUIRtlIdentityAuthority@4Identity@5@@Z
1770x26ac90?InitializeDeltaCompressor@Rtl@Windows@@YGJPAX@Z
1780x1120e0?InitializeStoreContext@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlIdentityAuthority@Rtl@Identity@Windows@@PAUIRtlAppIdAuthority@4AppId@6@PAUIRtlSystemIsolationLayer@46@2PAUIRtlKey@46@3AAVCRawInstallMap@InstallMap@@PAUIRtlDirectory@46@5PAVLRUCache@12@@Z
1790x112470?InitializeTlcCanonicalData@CRawStoreLayout@ComponentStore@@QAEJABVCApplicationAccessor@@PAUTlcData@2@PA_N@Z
1800xb4a60?IsAnyMidgroundOrAIPresent@WcpManifest@@QBEJPA_N@Z
1810x1317d0?IsComponentFileDeltaOrLZMSCompressed@CRawStoreLayout@ComponentStore@@QAEJABUComponentData@2@ABU_LUNICODE_STRING@@PA_NPAK@Z
1820x120760?IsComponentFileStaged@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@PA_N@Z
1830x120820?IsComponentFileStaged@CRawStoreLayout@ComponentStore@@SGJKABUComponentData@2@ABU_LUNICODE_STRING@@PA_N@Z
1840x1126c0?IsComponentStaged@CRawStoreLayout@ComponentStore@@QAEJPAUComponentData@2@PAK@Z
1850x26ae10?IsDeltaCompressorAvailable@Rtl@Windows@@YGJPA_N@Z
1860xb31b0?IsDeployment@WcpManifest@@QBE_NXZ
1870xfc3b0?IsIdentityDriver@Rtl@Identity@Windows@@YGJPAUIRtlBaseIdentity@123@PA_N@Z
1880x294090?IsManifestCompressed@Rtl@Implementation@WCP@Windows@@YGJPBU_LBLOB@@PA_N@Z
1890x1610b0?IsMobileStore@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
1900x1610e0?IsPhysicallyOffline@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
1910x161100?IsSafeMode@LocalInstallerServices@COM@WCP@Windows@@UAGJPA_N@Z
1920xb31e0?IsServicingStack@WcpManifest@@QBE_NXZ
1930xb3210?IsSingleInstanceFiles@WcpManifest@@QBE_NXZ
1940x161120?IsSkuAssembly@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
1950x161140?IsStateSeparated@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
1960x26dab0?IsValid@CCatalog@@QBE_NXZ
1970x269da0?LZMSCompressFile@Rtl@WCP@Windows@@YGJPBU_LBLOB@@PAUIRtlFile@13@1@Z
1980x269fc0?LZMSDecompressBuffer@Rtl@WCP@Windows@@YGJKPBU_LBLOB@@AAV?$Auto@U_LBLOB@@@3@@Z
1990x26a1c0?LZMSDecompressFile@Rtl@WCP@Windows@@YGJKPAUIRtlFile@13@0@Z
2000x26f280?LoadFirstResourceLanguageAgnostic@Rtl@Windows@@YGJKPAUHINSTANCE__@@PBG1PAU_LBLOB@@@Z
2010x161160?LogAiMessage@LocalInstallerServices@COM@WCP@Windows@@UAGXW4LogAiMessageFlags@ICSIMetadataInstallerServices@@W4LogLevel@6@PAU_RTL_TRACING_FACILITY@Rtl@34@QB_W@Z
2020x1612a0?LogAiMessageA@LocalInstallerServices@COM@WCP@Windows@@UAGXW4LogAiMessageFlags@ICSIMetadataInstallerServices@@W4LogLevel@6@PAU_RTL_TRACING_FACILITY@Rtl@34@QBD@Z
2030x282ed0?LookupStringReplacement@MacroReplacement@@YGJKKABU_LUNICODE_STRING@@PAUIRtlSystemIsolationLayer@Rtl@Windows@@PAXPAUIRtlDefinitionIdentity@4Identity@5@PAV?$Auto@U_LUNICODE_STRING@@@5@PAK@Z
2040x112f40?MakeMarkValueName@ComponentStore@@YGJ_WABU_GUID@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@Windows@@@Z
2050x113060?MakeMarkValueValue@ComponentStore@@YGJABU_LUNICODE_STRING@@0PAV?$Auto@U_LBLOB@@@Windows@@@Z
2060x113250?ManuallyMarkComponentStaged@CRawStoreLayout@ComponentStore@@QAEJABVCComponentAccessor@@PBU_LBLOB@@@Z
2070x113280?ManuallyMarkFileStaged@CRawStoreLayout@ComponentStore@@QAEJPAUComponentData@2@ABU_LUNICODE_STRING@@_N_N@Z
2080x166690MapToPrivilegeName
2090x166710MapToWellKnownSidType
2100x11bea0?MarkComponentInFamily@CRawStoreLayout@ComponentStore@@QAEJKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABT_FOUR_PART_VERSION@@ABVWcpManifest@@@Z
2110x113980?MarkSelfCorrupt@CRawStoreLayout@ComponentStore@@QAEXK@Z
2120x161450?MarkServicingStackCorruptHelper@LocalInstallerServices@COM@WCP@Windows@@UAGJXZ
2130x293550?MaybeGetCompletedGroup@CMultiThreadExecQ@MTEQ@@QAEJ_NPAV?$AutoNewPtr@VCGroup@MTEQ@@@Windows@@PAK@Z
2140x1f0f30?Next@CXmlCursor@@QAEJXZ
2150x114ba0?OpenComponentDerivedData@VersionedIndexHelper@ComponentStore@@QAEJ_NPBU_LUNICODE_STRING@@1PAUComponentData@2@PA_N@Z
2160x1080f0?OpenFamilyMap@CRawInstallMap@InstallMap@@QAEJ_NPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PAUMapForFamily@2@PA_N@Z
2170x115290?OpenTlcByImplication@CRawStoreLayout@ComponentStore@@QAEJ_NABUComponentImplication@2@PAUTlcData@2@PA_N@Z
2180x274130?ParseBase16String@Rtl@Implementation@WCP@Windows@@YGJKPBE0P6I?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@00@ZPAU_LBLOB@@PA_N@Z
2190x2744c0?ParseDottedVersion@Rtl@Implementation@WCP@Windows@@YGJKPBE0P6I?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@00@ZPAT_FOUR_PART_VERSION@@PAKPA_N@Z
2200xb3770?ParseFromBlob@WcpManifest@@QAEJABU_LBLOB@@PAVStopWatch@Rtl@Windows@@@Z
2210xb3790?ParseFromBlob@WcpManifest@@QAEJW4ParseDocumentFlags@XmlParserGenerator@@ABU_LBLOB@@PAVStopWatch@Rtl@Windows@@@Z
2220x274720?ParseGuid@Rtl@Implementation@WCP@Windows@@YGJPBE0P6I?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@00@ZPAU_GUID@@PA_N@Z
2230xfd610?ParseProcessorArchitecture@Rtl@Identity@Windows@@YGJABU_LUNICODE_STRING@@PAVPSEUDO_ARCH@123@PA_N@Z
2240x192910PoqParsePoqexecLog
2250x1614a0?PoqWasExecutedInline@LocalInstallerServices@COM@WCP@Windows@@UAG_NXZ
2260x240180?ProcessChange@CCoordinator@PrimitiveInstaller@@QAEJABUComponentChange@2@@Z
2270x120c40?QueryComponentFlag@CRawStoreLayout@ComponentStore@@SGJABUComponentData@2@PA_NPAK@Z
2280x115a80?QueryComponentImplications@CRawStoreLayout@ComponentStore@@QAEJ_NPAUIRtlKey@Rtl@Windows@@PAKPAV?$CVector@V?$Auto@UComponentImplication@ComponentStore@@@Windows@@VCCallDisposition@Rtl@BUCL@@@BUCL@@@Z
2290x115c50?QueryConfigurationOption@CRawStoreLayout@ComponentStore@@QBEJABU_GUID@@KPAK@Z
2300x115f10?QueryConfigurationOption@CRawStoreLayout@ComponentStore@@QBEJABU_GUID@@_NPA_N@Z
2310x1614c0?QueryInterface@LocalInstallerServices@COM@WCP@Windows@@UAGJABU_GUID@@PAPAX@Z
2320x1615b0?QueryInterface@LocalTransformerServices@COM@WCP@Windows@@UAGJABU_GUID@@PAPAX@Z
2330x116120?QueryMarksOnTopLevelComponent@CRawStoreLayout@ComponentStore@@QAEJKABUTlcData@2@PAUTlcMarks@2@PAV?$CVector@V?$Auto@UTlcMark@ComponentStore@@@Windows@@VCCallDisposition@Rtl@BUCL@@@BUCL@@@Z
2340x161660?QuerySingleResourceOwnershipConfiguration@LocalInstallerServices@COM@WCP@Windows@@UAGJPA_N@Z
2350x1616b0?QuerySmiHiveUpdatesConfiguration@LocalInstallerServices@COM@WCP@Windows@@UAGJPAK@Z
2360x11e390?QueryUnchangedFileVersions@VersionedIndexHelper@ComponentStore@@QAEJ_N0PAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@ABU_LBLOB@@PAV?$CVector@T_FOUR_PART_VERSION@@VCCallDisposition@Rtl@BUCL@@@BUCL@@PA_N@Z
2370x293830?QueueItemForGroup@CMultiThreadExecQ@MTEQ@@QAEJPAVCGroup@2@PAV?$AutoNewPtr@VCItemExecutorBase@MTEQ@@@Windows@@@Z
2380x1f6150?ReadAt@CBufferedStream@@QAEJ_KKPAXPAK@Z
2390x1168a0?ReadKeyValue@ComponentStore@@YGJPAUIRtlKey@Rtl@Windows@@PBU_LUNICODE_STRING@@PAV?$Auto@U_LBLOB@@@4@PAPBU_KEY_VALUE_PARTIAL_INFORMATION@@PA_N@Z
2400x161700?RedirectWowPath@LocalInstallerServices@COM@WCP@Windows@@UAGJW4RedirectWowPathFlags@ICSIMetadataInstallerServices@@PAUIDefinitionIdentity@@PB_WPAPA_W@Z
2410x161890?Release@LocalInstallerServices@COM@WCP@Windows@@UAGKXZ
2420x161890?Release@LocalTransformerServices@COM@WCP@Windows@@UAGKXZ
2430x1173d0?RemoveComponentImplication@CRawStoreLayout@ComponentStore@@QAEJABUComponentData@2@PAUTlcData@2@@Z
2440x128df0?RemoveComponentPayload@CRawStoreLayout@ComponentStore@@QAEJ_NPAUComponentData@2@PAK@Z
2450x1082d0?RemoveInstallMarkFromFamily@CRawInstallMap@InstallMap@@QAEJPAUMapForFamily@2@ABT_FOUR_PART_VERSION@@@Z
2460x1173f0?RemoveTlcMark@CRawStoreLayout@ComponentStore@@QAEJKABUTlcInstaller@2@PAUTlcData@2@@Z
2470x1618a0?ReplaceMacros@LocalInstallerServices@COM@WCP@Windows@@UAGJKPB_WPAPA_WPAUIDefinitionIdentity@@@Z
2480x161a10?ReplaceMacros@LocalTransformerServices@COM@WCP@Windows@@UAGJKPB_WPAPA_WK@Z
2490x283400?ReplaceSystemPathStringWithDefaultMacro@Rtl@ComponentMacroReplacement@@YGJW4ReplaceSystemPathStringWithDefaultMacroFlags@12@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@Windows@@PAW4ReplaceSystemPathStringWithDefaultMacroDisposition@12@@Z
2500x2709e0?ReplaceVariablesInString@Rtl@Implementation@WCP@Windows@@YGJPBU_LBLOB@@P6I?AU_RTL_UCSCHAR_DECODER_RETURN_VALUE@@PBE1@ZPAXP6GJ30PAU_RTL_SMART_LBLOB_UCSCHAR_WRITING_CONTEXT@@@ZP6IJKPAU_RTL_SMART_LBLOB_WRITING_CONTEXT@@@ZP6IJQBKK6@ZPAU5@@Z
2510x16a910?ResolvePendingPhases@COM@Windows@@YGJKPAVCQueueExecutor@12@PA_N@Z
2520x272390?Restore@PrivilegeAcquisition@RtlSystemUtil@@QAEJXZ
2530x1e17a0?RtlCaptureTracingParameterList@Rtl@WCP@Windows@@YIXKKPADQAU_RTL_TRACING_PARAMETER@123@@Z
2540x1e1820?RtlFormatIntoStreamFromParameterList@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@QBDKQBU_RTL_TRACING_PARAMETER@123@@Z
2550x1e1960?RtlGetFacilityTracingFlags@Rtl@WCP@Windows@@YIKPAU_RTL_TRACING_FACILITY@123@@Z
2560x220d50?RtlGetVersionResourceFromSelf@@YGXPAU_RTL_VERSION_RESOURCE@@@Z
2570x1e19a0?RtlIsTracingEnabled@Rtl@WCP@Windows@@YI_NPAU_RTL_TRACING_FACILITY@123@K@Z
2580x28a610?RtlRunPrimitiveOperationsInXmlAgainstExecutor@@YGJW4RtlRunPrimitivesFlags@@KPBU_LBLOB@@ABU?$Vector@QBU_UNICODE_STRING@@@Windows@@P6GJ0KP6GXPAXPAT_PRIMITIVE_OPERATION_UNION_VALUES@@PAU_PRIMITIVE_OPERATION@@PAE@ZP6GX345@ZP6GJPBU_UNICODE_STRING@@3@Z33PBU_POQ_PROGRESS_INFORMATION@@PAU_POQ_CHECKPOINT_INFORMATION@@PAU_POQ_FAILURE_INFORMATION@@@Z3P6GJ93@ZPBU8@PAU9@PAU_POQ_FAILURE_INFORMATION@@PAW4RtlRunPrimitivesDisposition@@@Z
2590x291770?RtlRunPrimitiveOperationsInXmlAgainstSil@@YGJW4RtlRunPrimitivesFlags@@KPAUIRtlSystemIsolationLayer@Rtl@Windows@@PBU_LBLOB@@ABU?$Vector@QBU_UNICODE_STRING@@@4@P6GJPBU_UNICODE_STRING@@PAX@ZPBU_POQ_PROGRESS_INFORMATION@@PAU_POQ_CHECKPOINT_INFORMATION@@PAU_POQ_FAILURE_INFORMATION@@PAW4RtlRunPrimitivesDisposition@@@Z
2600x1e19c0?RtlShutdownTracing@Rtl@WCP@Windows@@YIXXZ
2610x1e1a10?RtlTraceEx@Rtl@WCP@Windows@@YIXPBU_RTL_TRACING_STATIC_DATA@123@QBQBX@Z
2620x1e1ad0?RtlTraceFailureFromGroupList@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@PBU_RTL_TRACING_FAILURE_DATA@123@KQBU_RTL_FORMATTING_GROUP@123@@Z
2630x2917d0?RtlTraceFormat@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBUIRtlSystemIsolationLayerWithPOQ@13@@Z
2640x29b990?RtlTraceFormat@XmlParserGenerator@@YIXPAUIRtlFormattedOutputStream@Rtl@Windows@@PBUDomElement@1@@Z
2650x1e2160?RtlTraceFormat_FormattableObject@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2660x1e21d0?RtlTraceFormat_HANDLE@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2670x100440?RtlTraceFormat_IRtlBaseIdentity@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2680x253b80?RtlTraceFormat_IRtlDefinitionAppId@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2690x1e22f0?RtlTraceFormat_IRtlFormattableObject@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2700x1e2340?RtlTraceFormat_PCBOOLEAN@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2710x1e23a0?RtlTraceFormat_PCFOUR_PART_VERSION@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2720x1e24a0?RtlTraceFormat_PCGUID@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2730x1e24f0?RtlTraceFormat_PCHRESULT@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2740x1e2940?RtlTraceFormat_PCLARGE_INTEGER_AsReadableTime@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2750x198be0?RtlTraceFormat_PCLARGE_INTEGER_AsTime@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2760x1e2b60?RtlTraceFormat_PCLBLOB@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2770x1e2bb0?RtlTraceFormat_PCLBLOB_AsBase64@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2780x1e2da0?RtlTraceFormat_PCLBLOB_LimitLength@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2790x1e2f10?RtlTraceFormat_PCLONG@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2800x1e1eb0?RtlTraceFormat_PCLUNICODE_STRING@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2810x1e2f60?RtlTraceFormat_PCLUNICODE_STRING_AsLiteralString@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2820x1e1ee0?RtlTraceFormat_PCLUTF8_STRING@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2830x1e2fa0?RtlTraceFormat_PCLUTF8_STRING_AsLiteralString@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2840x1e2ff0?RtlTraceFormat_PCNTSTATUS@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2850x1e3cc0?RtlTraceFormat_PCPCVOID@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2860x1e3d10?RtlTraceFormat_PCPCVOID_AsOptDerefPCVOID@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2870x1e3d60?RtlTraceFormat_PCSIZE_T@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2880x1e3db0?RtlTraceFormat_PCSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2890x1e3de0?RtlTraceFormat_PCSTR_AsLiteralString@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2900x1e3e10?RtlTraceFormat_PCULONG@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2910x1e3e70?RtlTraceFormat_PCULONGLONG@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2920x1e3eb0?RtlTraceFormat_PCULONGLONG_AsDecimalOnly@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2930x1e3f00?RtlTraceFormat_PCULONGLONG_AsTickDelta@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2940x1e3f60?RtlTraceFormat_PCULONG_AsDecimalOnly@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2950x1e4230?RtlTraceFormat_PCULONG_AsHexadecimalOnly@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2960x1e4280?RtlTraceFormat_PCULONG_AsHexadecimalOnly_ShortZero@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2970x1e4370?RtlTraceFormat_PCULONG_AsRegValueType@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2980x1e43c0?RtlTraceFormat_PCULONG_AsSpecialCount@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
2990x1e4440?RtlTraceFormat_PCULONG_AsWin32Error@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3000x1e3d60?RtlTraceFormat_PCULONG_PTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3010x1e46a0?RtlTraceFormat_PCUNICODE_STRING@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3020x1e4780?RtlTraceFormat_PCUSHORT_AsProcessorArchitecture@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3030x1e47d0?RtlTraceFormat_PCVOID@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3040x1e4800?RtlTraceFormat_PCWSTR@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3050x1e4830?RtlTraceFormat_PCWSTR_Array@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3060x1e4920?RtlTraceFormat_PCWSTR_AsLiteralString@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3070x1e4a20?RtlTraceFormat_PCbool@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3080x1e4a60?RtlTraceFormat_PCbool_AsSuccessIndicator@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3090x1e4ab0?RtlTraceFormat_RegistryValue@Rtl@WCP@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3100x1e1c70?RtlTraceFromGroupList@Rtl@WCP@Windows@@YIXKPAU_RTL_TRACING_FACILITY@123@PBU_RTL_TRACING_FAILURE_DATA@123@KQBU_RTL_FORMATTING_GROUP@123@@Z
3110x1e1dd0?RtlTraceVa@Rtl@WCP@Windows@@YIXKKPAU_RTL_TRACING_FACILITY@123@QBDKPAD@Z
3120x221450?RtlWcpCreateMicrodomFromXmlBlob@Rtl@Implementation@WCP@Windows@@YGJPBU_LBLOB@@PAUIParseErrorCallback@1Microdom@4@PAV?$Auto@PAUIRtlMicrodom@Rtl@Microdom@Windows@@@4@@Z
3130x221660?RtlWcpParseManifestFromXml@Rtl@Implementation@WCP@Windows@@YGJKPBU_LBLOB@@PAUIParseErrorCallback@1Microdom@4@PAUIRtlManifestParseErrorCallback@1ManifestParser@4@PAV?$Auto@PAVIRtlCdf@Rtl@Cdf@Windows@@@4@@Z
3140x12a1b0?Scavenge@CRawStoreLayout@ComponentStore@@QAEJ_NABUScavengeControl@12@PAUIRtlDirectory@Rtl@Windows@@PAUIScavengeLastDitch@12@@Z
3150x121900?SetComponentFileFlag@CRawStoreLayout@ComponentStore@@QAEJ_NKABUComponentData@2@ABU_LUNICODE_STRING@@@Z
3160x121b90?SetComponentFileStageFlag@CRawStoreLayout@ComponentStore@@QAEJ_NPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@ABU_LUNICODE_STRING@@@Z
3170x121c40?SetComponentFlag@CRawStoreLayout@ComponentStore@@QAEJ_NKABUComponentData@2@@Z
3180x121c70?SetComponentFlag@CRawStoreLayout@ComponentStore@@QAEJ_NKPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@@Z
3190x1083a0?SetFamilyWinningVersion@CRawInstallMap@InstallMap@@QAEJPAUMapForFamily@2@PAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@@Z
3200x11f420?SetVersionedIndexFlags@CRawStoreLayout@ComponentStore@@QAEJPAUIRtlKey@Rtl@Windows@@K@Z
3210x214f10?ShouldRunAIs@ExecutionQueueDeriver@AiQueue@@QAEJPAUIRtlDefinitionIdentity@Rtl@Identity@Windows@@PA_N@Z
3220x273110?SilCreateDirectories@Rtl@Windows@@YGJPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@@Z
3230x2732b0?SilCreateKeys@Rtl@Windows@@YGJPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@@Z
3240x2734d0SilDoesDirectoryExist
3250x273680?SilDoesFileExist@Rtl@Windows@@YGJPAUIRtlSystemIsolationLayerPublic@12@PAUIRtlDirectory@12@ABU_LUNICODE_STRING@@PA_N@Z
3260x2738d0?SilFindExistingPath@Rtl@Windows@@YGJPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@PAU4@PAV?$Auto@PAUIRtlDirectory@Rtl@Windows@@@2@@Z
3270x273a30?SilGetRegistryDWORD@Rtl@Windows@@YGJKPAUIRtlKey@12@ABU_LUNICODE_STRING@@PAK2@Z
3280x273b00?SilGetRegistryDWORD@Rtl@Windows@@YGJKPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@1PAK2@Z
3290x273bc0?SilGetRegistryString@Rtl@Windows@@YGJKPAUIRtlKey@12@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@2@PAK@Z
3300x273d40?SilGetRegistryString@Rtl@Windows@@YGJKPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@1PAV?$Auto@U_LUNICODE_STRING@@@2@PAK@Z
3310x274010?SilSetRegistryDWORD@Rtl@Windows@@YGJPAUIRtlSystemIsolationLayerPublic@12@ABU_LUNICODE_STRING@@1K@Z
3320x26f620?SplitWin32RegistryPathIntoBaseAndSubKey@COM@Windows@@YGJPBGPAPAUHKEY__@@PAPBG@Z
3330x272420?Swap@?$Auto@U_SECURITY_DESCRIPTOR@@@Windows@@QAEXPAV12@@Z
3340x16d860?TraceChangeList@Rtl@ComponentStore@Windows@@YIXPAUIRtlFormattedOutputStream@13@PBX@Z
3350x2958b0?TraceETWEvent@Rtl@WCP@Windows@@YAXU_EVENT_DESCRIPTOR@@PBGZZ
3360x16ec60?TransferWin32FilePathIntoTempDirectory@@YGJKPAUIRtlDirectory@Rtl@Windows@@PAUIRtlSystemIsolationLayer@23@1ABU_LUNICODE_STRING@@2PAV?$Auto@PAUIRtlFile@Rtl@Windows@@@3@@Z
3370x1f48b0?TrimNamespaceTable@CC14NCanonicalizer@@MAEJUElement@Rtl@Microdom@Windows@@PAVCNamespaceTable@@PAVCAttributeTable@@@Z
3380x1620e0?TryGetRollbackStorageDirectory@LocalTransformerServices@COM@WCP@Windows@@UAGJKPAPAUIRtlDirectory@Rtl@4@@Z
3390x162470?TryGetRollbackStorageKey@LocalTransformerServices@COM@WCP@Windows@@UAGJKPAPAUIRtlKey@Rtl@4@@Z
3400x295200?TryGetWin32DirectoryRollbackStoragePath@COM@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@PAPAG@Z
3410x295360?TryGetWin32RegistryRollbackStoragePath@COM@Transformers@WCP@Windows@@YGJKPAUICSITransformerServices@@PAPAUHKEY__@@PAPAG@Z
3420x1627e0?VerifyAdvancedInstaller@LocalInstallerServices@COM@WCP@Windows@@UAGJPB_W00PAK@Z
3430x26e0d0?VerifyCertChainRoot@CCatalog@@QAEJKPAK@Z
3440x13dcd0?VerifyFileAgainstCatalog@Rtl@ComponentStore@Windows@@YGJABVCCatalog@@ABU_LUNICODE_STRING@@PBUIRtlDefinitionIdentity@1Identity@3@ABU_LBLOB@@3PAW4VerifyFileAgainstCatalogDisposition@123@@Z
3450x26ec00?VerifySigner@CCatalog@@QAEJPAUIRtlSystemIsolationLayer@Rtl@Windows@@@Z
3460x295520?VirtualNtRegistryPathToPhysical@Rtl@Transformers@WCP@Windows@@YGJPAUICSITransformerServices@@ABU_LUNICODE_STRING@@PAV?$Auto@U_LUNICODE_STRING@@@4@K@Z
3470x162900?VirtualPathToPhysical@LocalInstallerServices@COM@WCP@Windows@@UAGJKPB_WPAPA_W@Z
3480x295680?VirtualWin32RegistryPathToPhysical@COM@Transformers@WCP@Windows@@YGJPAUICSITransformerServices@@PBGPAPAUHKEY__@@PAPAGK@Z
3490x1f6f20?WriteAt@CBufferedStream@@QAEJ_KKPBXPAK@Z
3500x2200b0?XmlParseError@XmlParseErrorCallback@@UAEXKKKJABU_LUTF8_STRING@@@Z
3510x1629c0?get_IsolationAllocator@LocalInstallerServices@COM@WCP@Windows@@UAGJPAPAUIMalloc@@@Z
3520x162a30?get_RebootIndicator@LocalInstallerServices@COM@WCP@Windows@@UAGJPAW4RebootIndicators@@@Z
3530x162a90?get_System@LocalInstallerServices@COM@WCP@Windows@@UAGJPAPAUIRtlSystemIsolationLayerPublic@Rtl@4@@Z
3540x162b50?get_TargetProcessorArchitecture@LocalInstallerServices@COM@WCP@Windows@@UAGJPAK@Z
3550x162bc0?get_UserProfile@LocalInstallerServices@COM@WCP@Windows@@UAGJPAPAUIRtlUserProfile@Rtl@4@@Z
3560x162e20?put_RebootIndicator@LocalInstallerServices@COM@WCP@Windows@@UAGJW4RebootIndicators@@@Z
3570x1f72e0?utiludom_GetElementImmediateChildrenByName@@YGJPAUIRtlMicrodom@Rtl@Microdom@Windows@@UElement@234@PBU_LUTF8_STRING@@2PAV?$Auto@U?$Vector@UElement@Rtl@Microdom@Windows@@@Windows@@@4@@Z
3580x1f7700?utiludom_GetElementNameDetails@@YGJPAUIRtlMicrodom@Rtl@Microdom@Windows@@UElement@234@PAPBU_LUTF8_STRING@@22@Z
3590x1e7090RtlAppendLUnicodeStringToLUnicodeString
3600x1e8eb0RtlAppendLUtf8StringToLUnicodeString
3610x1e8fd0RtlAppendLUtf8StringToLUtf8String
3620x1ea340RtlCombineNtPathSegments
3630xf34b0RtlCommitSmartLBlobUcsWritingContext
3640x1ea6b0RtlConvertNtFilePathToWin32FilePath
3650x1eaa30RtlConvertNtRegistryPathToWin32RegistryPath
3660x1eaac0RtlConvertWin32FilePathToNtFilePath
3670x1ead00RtlConvertWin32RegistryPathToNtRegistryPath
3680x1ead20RtlConvertWin32RegistryPathToNtRegistryPathWithSid
3690x1ec150RtlCopyLBlob
3700x1e7180RtlCopyLUnicodeString
3710x1e90c0RtlCopyLUtf8String
3720x1e9180RtlCopyLUtf8StringToLUnicodeString
3730x2595d0RtlCreateCdfEx
3740x1f9d00RtlCreateMicrodomUpdateContext
3750x1f9e20RtlCreateUpdatedMicrodomAsMicrodom
3760x1f9f10RtlCreateUpdatedMicrodomAsUtf8
3770x1e7240RtlDeallocateUnicodeString
3780x1eefa0RtlDecodeUtf16LE
3790x1ef020RtlDecodeUtf8
3800x1fa020RtlDestroyMicrodomUpdateContext
3810x1ef3a0RtlDowncaseUCSCharacter
3820x1e7400RtlDuplicateCountedStringToLUnicodeString
3830x1ec220RtlDuplicateLBlob
3840x1e74b0RtlDuplicateLUnicodeString
3850x1e9230RtlDuplicateLUnicodeStringToLUtf8String
3860x1e92d0RtlDuplicateLUtf8String
3870x1e9370RtlDuplicateLUtf8StringToLUnicodeString
3880x1e7550RtlDuplicateNullTerminatedAnsiStringToLUnicodeString
3890x1e75f0RtlDuplicateNullTerminatedStringToLUnicodeString
3900x1e7680RtlDuplicateUnicodeStringToLUnicodeString
3910x1e9410RtlDuplicateUnicodeStringToLUtf8String
3920x1ef5e0RtlEncodeUtf16LE
3930x1ef730RtlEncodeUtf8
3940xac600RtlFinalizeSmartLBlobUcsWritingContext
3950x1ec330RtlFreeLBlob
3960x1e7720RtlFreeLUnicodeString
3970x1e7720RtlFreeLUtf8String
3980x1a6350RtlGetDirectSystem
3990x1ef8e0RtlGetEncodingSizeUtf16
4000x1eb440RtlGetEncodingSizeUtf8
4010x1a6520RtlGetSystem
4020x1e7730RtlHashLUnicodeString
4030x1e94e0RtlHashLUtf8String
4040x1e77e0RtlInitLUnicodeStringFromNullTerminatedString
4050x1e7870RtlInitLUnicodeStringFromUnicodeString
4060x1e78e0RtlInitUnicodeStringFromLUnicodeString
4070x1ec350RtlIsLBlobValid
4080x1e79b0RtlIsLUnicodeStringValid
4090x1eb440RtlLengthOfUcsCharacterEncodedAsUtf8
4100x1fa0a0RtlMicrodomUpdateCreateAttributeNs
4110x1fa1f0RtlMicrodomUpdateCreateElementNs
4120x1fa3f0RtlMicrodomUpdateCreateTextual
4130x1fa4e0RtlMicrodomUpdateGetCookieForExistingAttribute
4140x1fa4e0RtlMicrodomUpdateGetCookieForExistingElement
4150x1fa580RtlMicrodomUpdateGetCookieForExistingNode
4160x1fa610RtlMicrodomUpdateInsertChild
4170x1fa720RtlMicrodomUpdateInsertMicrodomNode
4180x1fa950RtlMicrodomUpdateRemoveChild
4190x1faa10RtlMicrodomUpdateRemoveElement
4200x1faaa0RtlMicrodomUpdateSetNodeName
4210x1fab90RtlMicrodomUpdateSetNodeTextContent
4220x1eb490RtlPreInitializeSmartLBlobUcsWritingContext
4230x1a6d10RtlReplaceSystemPathMappings
4240x1eb4c0RtlSmartMultiUcsEncoder_Utf16LE
4250x1eb4e0RtlSmartMultiUcsEncoder_Utf8
4260x1eb500RtlSmartUcsEncoder_Utf16LE
4270x1eb540RtlSmartUcsEncoder_Utf8
4280x1eae40RtlSplitNtPath
4290x1eaf30RtlSplitWin32RegistryPathIntoRootAndLeaves
4300x1ef3e0RtlUpcaseUCSCharacter
4310x1fbc20RtlXmlCloneRawTokenizationState
4320x1e51d0SetLogToConsole
4330x16b6c0ApplyTransactionPOQsToSil
4340x192210ConvertHResultToNtStatus
4350x1924f0ConvertNtStatusToHResult
4360x1d9c30CreateNewOfflineStore
4370x1e0510CreateNewPseudoWindows
4380x1e0550CreateNewPseudoWindowsEx
4390x1e0df0CreateNewWindows
4400x274ad0DelayExecution
4410x1e1140DismountRegistryHives
4420x211320DllCsiGetHandler
4430x16be90ExecuteMidgroundInstallers
4440x274c30ExpandAndNullTerminateEnvironmentVariableString
4450xae820FreeAndZeroCSI_BROKEN_COMPONENT
4460xae820FreeAndZeroCSI_REPAIRED_COMPONENT
4470xfa660GetAppIdAuthority
4480x2162c0GetFriendlyInstallerName
4490xf71f0GetIdentityAuthority
4500x13e4f0GetPrimitiveInstallerSupport
4510x17a540GetSystemStore
4520x26f790GetTemporaryPath
4530x221280GetVersionString
4540xae880InitializeCSI_BROKEN_COMPONENT
4550xae880InitializeCSI_REPAIRED_COMPONENT
4560x26f8d0IsCompactOSEnabled
4570xfc610IsIdentityPnPDriver
4580x220150IsSkuAssembly
4590x13ef80MergeTwoChangeLists
4600x277980ORAdvanceSubkeyEnumerator
4610x2790b0ORAdvanceValueEnumerator
4620x277ac0ORCleanupSubkeyEnumerator
4630x279170ORCleanupValueEnumerator
4640x27a030ORCloseHive
4650x277b20ORCloseKey
4660x27a0f0ORCreateHive
4670x27a110_ORCreateHiveEx@8
4680x277b80ORCreateKey
4690x2780d0ORDeleteKey
4700x2791c0ORDeleteValue
4710x278280_OREnumKey@28
4720x279280_OREnumValue@28
4730x27a460_ORFlushHive@4
4740x27aa70ORGetKeySecurity
4750x279540ORGetValue
4760x278390_ORGetVirtualFlags@8
4770x278400ORInitializeSubkeyEnumerator
4780x278400ORInitializeValueEnumerator
4790x27ad20ORMergeHives
4800x27a550OROpenHive
4810x27a570_OROpenHiveByHandle@8
4820x278450OROpenKey
4830x278730ORQueryInfoKey
4840x2788b0_ORQueryInfoKeyEx@16
4850x279810_ORQueryInfoKeyValueEx@20
4860x278a60ORQuerySubkeyEnumerator
4870x2798c0ORQueryValueEnumerator
4880x278bb0_ORRenameKey@8
4890x27a810ORSaveHive
4900x27a840_ORSaveHiveEx@20
4910x27a950_ORSaveHiveToHandle@20
4920x27ab10ORSetKeySecurity
4930x279980ORSetValue
4940x278f10_ORSetVirtualFlags@8
4950x278fa0ORStartSubkeyEnumerator
4960x279d60ORStartValueEnumerator
4970x1d9f00OpenExistingOfflineStore
4980xf4800ParseManifest
4990xf4830ParseManifestEx
5000x1ec710RtlAllocateLBlob
5010x1e7a10RtlAllocateLUnicodeString
5020x1e9530RtlAllocateLUtf8String
5030x1e7aa0RtlAllocateUnicodeString
5040x1e7b30RtlAppendUcsCharacterToLUnicodeString
5050x1e7b60RtlAppendUcsCharactersToLUnicodeString
5060x1ec780RtlBase64EncodeLBlobToLUnicodeString
5070x1e9610RtlCalculateUtf16StringLengthFromLUtf8String
5080x1ec9d0RtlCompareEncodedLBlobs
5090x1e9730RtlCompareLUnicodeStringToLUtf8String
5100x1e7ca0RtlCompareLUnicodeStrings
5110x1e9760RtlCompareLUtf8Strings
5120x1e7cd0RtlConcatenateLUnicodeStrings
5130x1e9790RtlConcatenateLUtf8Strings
5140x200a30RtlCreateDefaultMicrodomXmlWriter
5150x201ea0RtlCreateDefaultXmlWriter
5160x207300RtlCreateMicrodom
5170x1f00d0RtlCreateUtf16LEUCSStringBuilder
5180x1f0230RtlCreateUtf8UCSStringBuilder
5190x1ecc70RtlDecodeBase64LUnicodeStringToLBlob
5200x1ecdd0RtlDecodeBase64LUtf8StringToLBlob
5210x2079e0RtlDestroyGrowingList
5220x1ecf50RtlDetermineTranscodedLBlobSize
5230x1e7ea0RtlDoesLUnicodeStringMatchExpression
5240x1e8490RtlEqualLUnicodeStringPrefix
5250x1e84e0RtlEqualLUnicodeStringSuffix
5260x1e8540RtlEqualLUnicodeStrings
5270x1e9a00RtlEqualLUtf8StringPrefix
5280x1e9af0RtlEqualLUtf8Strings
5290x209750RtlExecuteXPathOverMicrodom
5300x1e85b0RtlFilterLUnicodeString
5310x257950RtlGetAppIdAuthority
5320x1ef290RtlGetCharacterSetDecoder
5330x1ed230RtlGetHashAlgorithmHashLength
5340x1042e0RtlGetIdentityAuthority
5350x221380_RtlGetPendingXmlVersion@8
5360x1edb50RtlHashLBlob
5370x207a60RtlIndexIntoGrowingList
5380x207b30RtlInitializeGrowingList
5390x1edfe0RtlInitializeSmartLBlobWritingContext
5400x1eb580RtlInitializeSmartLUnicodeStringWritingContext
5410x1eb650RtlInitializeSmartLUtf8StringWritingContext
5420x1e86d0RtlMatchLUnicodeStringAgainstLUtf8StringList
5430x1e8810RtlMatchLUnicodeStringAgainstList
5440x1e8960RtlMatchLUnicodeStringAgainstPointerList
5450x1e9b80RtlMatchLUtf8StringAgainstList
5460x1e9cc0RtlMatchLUtf8StringAgainstPointerList
5470x1f0430RtlMurmurHashLBlob
5480x2099d0RtlNsDestroy
5490x209af0RtlNsInitialize
5500x2213c0RtlParseDottedVersion
5510xb7320RtlParseManifestMicrodomIntoCdf
5520x1ee1e0RtlReallocateLBlob
5530x1e8aa0RtlReallocateLUnicodeString
5540x1e9e00RtlReallocateLUtf8String
5550x1e8b50RtlReallocateUnicodeString
5560x1f0460RtlRegisterErrorOriginationCallback
5570x1f0480RtlReportErrorOrigination
5580x1f0500RtlReportErrorPropagation
5590x1ee2c0RtlSplitEncodedLBlob
5600x1e8c60RtlSplitLUnicodeString
5610x1e9ea0RtlSplitLUtf8String
5620x1ee740RtlTranscodeLBlobs
5630x1da1b0RtlWcpDllDebugEntrypoint
5640x1da1f0RtlWcpDllDebugSetFeatureState
5650x1eb690RtlWriteDecodedUcsDataIntoSmartLBlobUcsWritingContext
5660x200ad0RtlWriteMicrodomXml
5670x1eb870RtlWriteUcsDataIntoSmartLBlobUcsWritingContext
5680x1fc110RtlXmlCopyStringOut
5690x1fc240RtlXmlDefaultCompareStrings
5700x209f70RtlXmlDestroyNextLogicalThing
5710x1fc3d0RtlXmlDetermineStreamEncoding
5720x209f90RtlXmlExtentToString
5730x20a140RtlXmlExtentToUtf8String
5740x20a400RtlXmlInitializeNextLogicalThing
5750x1fc600RtlXmlInitializeTokenization
5760x20a4a0RtlXmlNextLogicalThing
5770x1fc760RtlXmlNextToken
5780x1da2d0SetIsolationIMalloc
5790x2219b0SilCreateBufferedSil
5800x1da320SilCreateRerootedSil
5810xacc10WcpInitialize
5820xacc40WcpReportExternalErrorOrigination
5830xacc50WcpSetHelperCallback
5840xacc70WcpShutdown
5850x13e580WriteWinnersFromChangelist
module_namewcp.dll
flags0
timestamp2077-10-03 05:55:42
version0.0
ordinal_base1
nFunctions585
nNames585
Names(585)0x2cc8bc
Functions(585)0x2cbf98
NameOrdinals(585)0x2cd1e0

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Componentization Platform Servicing API
FileVersion10.0.22621.1906 (WinBuild.160101.0800)
InternalNameWCPDll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamewcp.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion10.0.22621.1906

VS_FIXEDFILEINFO

FileVersion10.0.22621.1906
ProductVersion10.0.22621.1906
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0

Signers (1)

issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011
serial: 33000004158295A1A3D82E2857000000000415

Certificates (2)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
        Validity
            Not Before: Feb  3 00:05:42 2023 GMT
            Not After : Feb  1 00:05:42 2024 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:f8:f6:2a:d0:be:d5:e2:cd:fe:36:f1:d7:55:85:
                    04:4a:9f:83:87:3d:c3:26:16:f0:a9:61:1e:cc:b6:
                    d8:88:0c:33:a5:85:c0:17:9e:09:77:e9:af:80:12:
                    21:7a:70:95:f9:bf:f8:41:af:40:1b:e7:66:08:85:
                    6a:01:e1:56:69:71:5f:17:c0:22:80:d1:0d:0f:38:
                    15:9a:a1:b8:61:b3:f9:b0:87:70:53:29:39:9a:33:
                    d6:43:30:99:fc:df:da:b8:e8:ed:5b:68:4a:6f:db:
                    9b:d2:14:7b:aa:0c:f9:0e:ec:0d:e7:2c:73:92:7b:
                    4e:d0:cf:b2:4d:40:53:d8:1b:02:bf:a1:02:69:1e:
                    3d:a6:57:ae:68:65:f9:c0:41:17:ab:2f:8d:5e:e9:
                    cf:e8:a6:d2:75:81:72:52:4d:5b:9e:4a:f1:05:5e:
                    ab:e5:6c:cd:2e:33:11:26:4e:6c:0a:51:86:81:e1:
                    69:6a:fc:03:be:3a:ee:5a:cf:83:3d:36:20:7c:1a:
                    35:4c:fa:7e:bc:72:3f:f1:70:f8:f0:f8:50:48:62:
                    e6:2f:ef:08:33:fe:b9:b5:37:8e:04:df:29:8d:cf:
                    ed:82:c9:30:7c:69:08:e5:92:43:32:3d:ca:b7:b2:
                    a0:28:eb:5e:8d:c2:3c:50:b3:47:35:1b:e2:34:40:
                    84:6f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                1.3.6.1.4.1.311.10.3.6, Code Signing
            X509v3 Subject Key Identifier: 
                62:BB:E5:49:30:B4:04:62:37:6C:B3:20:90:44:8F:8D:75:70:6F:32
            X509v3 Subject Alternative Name: 
                DirName:/OU=Microsoft Corporation/serialNumber=229879\+500174
            X509v3 Authority Key Identifier: 
                A9:29:02:39:8E:16:C4:97:78:CD:90:F9:9E:4F:9A:E1:7C:55:AF:53
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt
            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        30:e9:1c:73:87:9b:64:54:d8:c1:5e:15:11:60:c3:b4:f0:42:
        c3:a3:cd:d3:2a:af:15:6d:19:67:d1:95:f2:e1:27:9e:25:f4:
        9e:61:0c:52:b1:ce:86:2f:b0:76:ce:10:e2:65:1a:9c:64:27:
        5f:a3:d9:5f:c0:79:d3:83:9e:5f:2d:97:42:d0:bc:c6:a2:2e:
        b0:06:b3:5b:04:cd:3f:5e:40:9e:3a:99:1b:e3:85:41:14:14:
        b5:cf:a5:e3:3a:7d:9a:49:5a:ab:53:a2:e6:3c:15:96:93:a4:
        bd:bd:61:17:a3:99:bd:fe:bb:b8:d1:c1:85:c6:6d:3b:fe:42:
        dc:d8:f8:91:f7:a3:f3:6f:f3:c0:78:8e:cc:45:95:39:a0:8c:
        b0:05:fe:76:92:18:2d:b0:db:58:94:d3:83:55:66:47:2e:f7:
        46:67:f4:31:2e:97:2c:ce:c1:1a:23:dc:4f:5e:48:08:02:f1:
        fe:35:3b:3b:37:a2:c3:4d:dc:d0:92:e8:3d:e1:20:37:9d:57:
        6e:83:aa:96:89:69:fb:77:66:8a:cc:18:97:53:cb:16:e7:6c:
        88:be:99:9f:e1:13:42:98:6d:fa:30:09:f3:42:26:ad:ec:b3:
        87:e3:0d:98:32:46:14:35:dc:89:64:df:63:ce:7e:b8:2b:f2:
        f1:d6:c1:30

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            61:07:76:56:00:00:00:00:00:08
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Root Certificate Authority 2010
        Validity
            Not Before: Oct 19 18:41:42 2011 GMT
            Not After : Oct 19 18:51:42 2026 GMT
        Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:dd:0c:bb:a2:e4:2e:09:e3:e7:c5:f7:96:69:bc:
                    00:21:bd:69:33:33:ef:ad:04:cb:54:80:ee:06:83:
                    bb:c5:20:84:d9:f7:d2:8b:f3:38:b0:ab:a4:ad:2d:
                    7c:62:79:05:ff:e3:4a:3f:04:35:20:70:e3:c4:e7:
                    6b:e0:9c:c0:36:75:e9:8a:31:dd:8d:70:e5:dc:37:
                    b5:74:46:96:28:5b:87:60:23:2c:bf:dc:47:a5:67:
                    f7:51:27:9e:72:eb:07:a6:c9:b9:1e:3b:53:35:7c:
                    e5:d3:ec:27:b9:87:1c:fe:b9:c9:23:09:6f:a8:46:
                    91:c1:6e:96:3c:41:d3:cb:a3:3f:5d:02:6a:4d:ec:
                    69:1f:25:28:5c:36:ff:fd:43:15:0a:94:e0:19:b4:
                    cf:df:c2:12:e2:c2:5b:27:ee:27:78:30:8b:5b:2a:
                    09:6b:22:89:53:60:16:2c:c0:68:1d:53:ba:ec:49:
                    f3:9d:61:8c:85:68:09:73:44:5d:7d:a2:54:2b:dd:
                    79:f7:15:cf:35:5d:6c:1c:2b:5c:ce:bc:9c:23:8b:
                    6f:6e:b5:26:d9:36:13:c3:4f:d6:27:ae:b9:32:3b:
                    41:92:2c:e1:c7:cd:77:e8:aa:54:4e:f7:5c:0b:04:
                    87:65:b4:43:18:a8:b2:e0:6d:19:77:ec:5a:24:fa:
                    48:03
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            1.3.6.1.4.1.311.21.1: 
                ...
            X509v3 Subject Key Identifier: 
                A9:29:02:39:8E:16:C4:97:78:CD:90:F9:9E:4F:9A:E1:7C:55:AF:53
            1.3.6.1.4.1.311.20.2: 
                .
.S.u.b.C.A
            X509v3 Key Usage: 
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Authority Key Identifier: 
                D5:F6:56:CB:8F:E8:A2:5C:62:68:D1:3D:94:90:5B:D7:CE:9A:18:C4
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
            Authority Information Access: 
                CA Issuers - URI:http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        14:fc:7c:71:51:a5:79:c2:6e:b2:ef:39:3e:bc:3c:52:0f:6e:
        2b:3f:10:13:73:fe:a8:68:d0:48:a6:34:4d:8a:96:05:26:ee:
        31:46:90:61:79:d6:ff:38:2e:45:6b:f4:c0:e5:28:b8:da:1d:
        8f:8a:db:09:d7:1a:c7:4c:0a:36:66:6a:8c:ec:1b:d7:04:90:
        a8:18:17:a4:9b:b9:e2:40:32:36:76:c4:c1:5a:c6:bf:e4:04:
        c0:ea:16:d3:ac:c3:68:ef:62:ac:dd:54:6c:50:30:58:a6:eb:
        7c:fe:94:a7:4e:8e:f4:ec:7c:86:73:57:c2:52:21:73:34:5a:
        f3:a3:8a:56:c8:04:da:07:09:ed:f8:8b:e3:ce:f4:7e:8e:ae:
        f0:f6:0b:8a:08:fb:3f:c9:1d:72:7f:53:b8:eb:be:63:e0:e3:
        3d:31:65:b0:81:e5:f2:ac:cd:16:a4:9f:3d:a8:b1:9b:c2:42:
        d0:90:84:5f:54:1d:ff:89:ea:ba:1d:47:90:6f:b0:73:4e:41:
        9f:40:9f:5f:e5:a1:2a:b2:11:91:73:8a:21:28:f0:ce:de:73:
        39:5f:3e:ab:5c:60:ec:df:03:10:a8:d3:09:e9:f4:f6:96:85:
        b6:7f:51:88:66:47:19:8d:a2:b0:12:3d:81:2a:68:05:77:bb:
        91:4c:62:7b:b6:c1:07:c7:ba:7a:87:34:03:0e:4b:62:7a:99:
        e9:ca:fc:ce:4a:37:c9:2d:a4:57:7c:1c:fe:3d:dc:b8:0f:5a:
        fa:d6:c4:b3:02:85:02:3a:ea:b3:d9:6e:e4:69:21:37:de:81:
        d1:f6:75:19:05:67:d3:93:57:5e:29:1b:39:c8:ee:2d:e1:cd:
        e4:45:73:5b:d0:d2:ce:7a:ab:16:19:82:46:58:d0:5e:9d:81:
        b3:67:af:6c:35:f2:bc:e5:3f:24:e2:35:a2:0a:75:06:f6:18:
        56:99:d4:78:2c:d1:05:1b:eb:d0:88:01:9d:aa:10:f1:05:df:
        ba:7e:2c:63:b7:06:9b:23:21:c4:f9:78:6c:e2:58:17:06:36:
        2b:91:12:03:cc:a4:d9:f2:2d:ba:f9:94:9d:40:ed:18:45:f1:
        ce:8a:5c:6b:3e:ab:03:d3:70:18:2a:0a:6a:e0:5f:47:d1:d5:
        63:0a:32:f2:af:d7:36:1f:2a:70:5a:e5:42:59:08:71:4b:57:
        ba:7e:83:81:f0:21:3c:f4:1c:c1:c5:b9:90:93:0e:88:45:93:
        86:e9:b1:20:99:be:98:cb:c5:95:a4:5d:62:d6:a0:63:08:20:
        bd:75:10:77:7d:3d:f3:45:b9:9f:97:9f:cb:57:80:6f:33:a9:
        04:cf:77:a4:62:1c:59:7e

undefined method `first' for #

offsetsizetypecomment
03148800DLL10/03/2077 05:55:42#
15c115HTM#
300c009584PKCS7Authenticode Signature#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2e0614