module.284.3eefdd40.76fd0000.dll - advapi32.dll

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	module.284.3eefdd40.76fd0000.dll
size	640512 (0x9c600)
md5	3f8f8cc3c210890a92ef71de5c8697e9

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
149	30729	11
1	0	659
147	30729	27
146	30729	1
132	30729	18
131	30729	128
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4ce7b706
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x71e00
SizeOfInitializedData	0x2aa00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x149e5
BaseOfCode	0x1000
BaseOfData	0x70000
ImageBase	0x76fd0000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0xa0000
SizeOfHeaders	0x600
CheckSum	0xa1449
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x71d05	0x71e00	R-X CODE
.data	0x73000	0x3588	0x2e00	RW- IDATA
.rsrc	0x77000	0x23140	0x23200	R-- IDATA
.reloc	0x9b000	0x404c	0x4200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x14a3c	0x6860
IMPORT	0x6f0e0	0x118
RESOURCE	0x77000	0x23140
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x9b000	0x404c
DEBUG	0x72ca4	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x111d0	0x40
Bound_IAT	0x278	0x1f4
IAT	0x1000	0x914
Delay_IAT	0x6e7cc	0x100
CLR_Header	0	0

show previews

type	name	size
MUI	#1	256
WEVT_TEMPLATE	#1	142030
RCDATA	#102	92
VERSION	#1	944

module_name	hint	ord	function_name
msvcrt.dll	1228		iswctype
msvcrt.dll	1031		_wcstoui64
msvcrt.dll	404		_ftol2
msvcrt.dll	1337		tolower
msvcrt.dll	926		_ultow
msvcrt.dll	1382		wcstok
msvcrt.dll	1213		isalnum
msvcrt.dll	1222		isspace
msvcrt.dll	342		_errno
msvcrt.dll	1253		mbstowcs
msvcrt.dll	345		_except_handler4_common
msvcrt.dll	1361		wcschr
msvcrt.dll	1376		wcsrchr
msvcrt.dll	1262		memset
msvcrt.dll	1260		memmove
msvcrt.dll	1007		_wcsicmp
msvcrt.dll	974		_vsnwprintf
msvcrt.dll	1258		memcpy
msvcrt.dll	1365		wcscpy_s
msvcrt.dll	862		_stricmp
msvcrt.dll	1299		strchr
msvcrt.dll	1316		strrchr
msvcrt.dll	1318		strstr
msvcrt.dll	968		_vsnprintf
msvcrt.dll	1385		wcstombs
msvcrt.dll	1380		wcsstr
msvcrt.dll	1326		swprintf_s
msvcrt.dll	1373		wcsncpy_s
msvcrt.dll	1371		wcsncmp
msvcrt.dll	1328		swscanf_s
msvcrt.dll	1017		_wcsnicmp
msvcrt.dll	1387		wcstoul
msvcrt.dll	1360		wcscat_s
ntdll.dll	1131		RtlRunOnceExecuteOnce
ntdll.dll	122		LdrLoadDll
ntdll.dll	115		LdrGetProcedureAddress
ntdll.dll	1129		RtlRunOnceBeginInitialize
ntdll.dll	146		LdrUnloadDll
ntdll.dll	346		NtOpenKey
ntdll.dll	430		NtQueryValueKey
ntdll.dll	355		NtOpenProcessToken
ntdll.dll	401		NtQueryInformationToken
ntdll.dll	212		NtClose
ntdll.dll	909		RtlImageNtHeader
ntdll.dll	59		EtwEventWriteEx
ntdll.dll		1
ntdll.dll	838		RtlFreeAnsiString
ntdll.dll	859		RtlGetCurrentTransaction
ntdll.dll	32		DbgPrint
ntdll.dll	779		RtlEnterCriticalSection
ntdll.dll	1004		RtlLeaveCriticalSection
ntdll.dll	988		RtlIsTextUnicode
ntdll.dll	1218		RtlUnicodeStringToAnsiString
ntdll.dll	1225		RtlUnicodeToMultiByteSize
ntdll.dll	1007		RtlLengthSid
ntdll.dll	681		RtlCopyUnicodeString
ntdll.dll	1052		RtlOemStringToUnicodeS
ntdll.dll
ntdll.dll	1253		RtlValidRelativeSecurityDescriptor
ntdll.dll	456		NtReplaceKey
ntdll.dll	473		NtSaveKey
ntdll.dll	475		NtSaveMergedKeys
ntdll.dll	420		NtQuerySecurityObject
ntdll.dll	68		EtwLogTraceEvent
ntdll.dll	901		RtlGetVersion
ntdll.dll	437		NtReadFile
ntdll.dll	560		NtWriteFile
ntdll.dll	1095		RtlReAllocateHeap
ntdll.dll	1006		RtlLengthSecurityDescriptor
ntdll.dll	1254		RtlValidSecurityDescriptor
KERNELBASE.dll	137		EnumUILanguagesW
KERNELBASE.dll	331		GetUserDefaultUILanguage
KERNELBASE.dll	305		GetSystemDefaultUILanguage
KERNELBASE.dll	26		AreFileApisANSI
API-MS-WIN-Service-Core-L1-1-0.dll			RegisterServiceCtrlHandlerExW
API-MS-WIN-Service-Core-L1-1-0.dll	2		StartServiceCtrlDispatcherW
API-MS-WIN-Service-Core-L1-1-0.dll	1		SetServiceStatus
API-MS-WIN-Service-winsvc-L1-1-0.dll	11		I_ScRpcBindW
API-MS-WIN-Service-winsvc-L1-1-0.dll	25		StartServiceCtrlDispatcherA
API-MS-WIN-Service-winsvc-L1-1-0.dll	24		StartServiceA
API-MS-WIN-Service-winsvc-L1-1-0.dll	23		RegisterServiceCtrlHandlerW
API-MS-WIN-Service-winsvc-L1-1-0.dll	22		RegisterServiceCtrlHandlerExA
API-MS-WIN-Service-winsvc-L1-1-0.dll	21		RegisterServiceCtrlHandlerA
API-MS-WIN-Service-winsvc-L1-1-0.dll	20		QueryServiceStatus
API-MS-WIN-Service-winsvc-L1-1-0.dll	19		QueryServiceConfigA
API-MS-WIN-Service-winsvc-L1-1-0.dll	18		QueryServiceConfig2A
API-MS-WIN-Service-winsvc-L1-1-0.dll	17		OpenServiceA
API-MS-WIN-Service-winsvc-L1-1-0.dll	16		OpenSCManagerA
API-MS-WIN-Service-winsvc-L1-1-0.dll	15		NotifyServiceStatusChangeA
API-MS-WIN-Service-winsvc-L1-1-0.dll	4		CreateServiceA
API-MS-WIN-Service-winsvc-L1-1-0.dll	3		ControlServiceExA
API-MS-WIN-Service-winsvc-L1-1-0.dll	2		ControlService
API-MS-WIN-Service-winsvc-L1-1-0.dll	1		ChangeServiceConfigA
API-MS-WIN-Service-winsvc-L1-1-0.dll			ChangeServiceConfig2A
API-MS-WIN-Service-winsvc-L1-1-0.dll	10		I_ScRpcBindA
API-MS-WIN-Service-Management-L1-1-0.dll	1		ControlServiceExW
API-MS-WIN-Service-Management-L1-1-0.dll	4		OpenSCManagerW
API-MS-WIN-Service-Management-L1-1-0.dll	5		OpenServiceW
API-MS-WIN-Service-Management-L1-1-0.dll	2		CreateServiceW
API-MS-WIN-Service-Management-L1-1-0.dll	3		DeleteService
API-MS-WIN-Service-Management-L1-1-0.dll			CloseServiceHandle
API-MS-WIN-Service-Management-L1-1-0.dll	6		StartServiceW
API-MS-WIN-Service-Management-L2-1-0.dll	3		QueryServiceConfig2W
API-MS-WIN-Service-Management-L2-1-0.dll	2		NotifyServiceStatusChangeW
API-MS-WIN-Service-Management-L2-1-0.dll			ChangeServiceConfig2W
API-MS-WIN-Service-Management-L2-1-0.dll	1		ChangeServiceConfigW
API-MS-WIN-Service-Management-L2-1-0.dll	4		QueryServiceConfigW
API-MS-WIN-Service-Management-L2-1-0.dll	5		QueryServiceObjectSecurity
API-MS-WIN-Service-Management-L2-1-0.dll	6		QueryServiceStatusEx
API-MS-WIN-Service-Management-L2-1-0.dll	7		SetServiceObjectSecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	34		RegSaveKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	22		RegNotifyChangeKeyValue
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	27		RegQueryInfoKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	28		RegQueryInfoKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	29		RegQueryValueExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	20		RegLoadMUIStringA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	33		RegSaveKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	30		RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	15		RegGetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	35		RegSetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	31		RegRestoreKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	32		RegRestoreKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	37		RegSetValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	18		RegLoadKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	19		RegLoadKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	25		RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	3		RegDeleteKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	4		RegDeleteKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	7		RegDeleteValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	8		RegDeleteValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	10		RegEnumKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	11		RegEnumKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	12		RegEnumValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	13		RegEnumValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	16		RegGetValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	17		RegGetValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	1		RegCreateKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	2		RegCreateKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	14		RegFlushKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	23		RegOpenCurrentUser
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	24		RegOpenKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	9		RegDisablePredefinedCacheEx
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	21		RegLoadMUIStringW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	26		RegOpenUserClassesRoot
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	36		RegSetValueExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	38		RegUnLoadKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	39		RegUnLoadKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	6		RegDeleteTreeW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	5		RegDeleteTreeA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll			RegCloseKey
API-MS-Win-Core-NamedPipe-L1-1-0.dll	6		ImpersonateNamedPipeClient
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	5		CreateThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	12		GetCurrentThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	42		TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	10		GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	16		GetPriorityClass
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	27		OpenThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	13		GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	39		SetThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	28		OpenThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	26		OpenProcessToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	1		CreateProcessAsUserW
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	11		GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	17		GetProcessId
API-MS-Win-Security-Base-L1-1-0.dll	55		GetSidLengthRequired
API-MS-Win-Security-Base-L1-1-0.dll	56		GetSidSubAuthority
API-MS-Win-Security-Base-L1-1-0.dll	57		GetSidSubAuthorityCount
API-MS-Win-Security-Base-L1-1-0.dll	59		GetWindowsAccountDomainSid
API-MS-Win-Security-Base-L1-1-0.dll	60		ImpersonateAnonymousToken
API-MS-Win-Security-Base-L1-1-0.dll	61		ImpersonateLoggedOnUser
API-MS-Win-Security-Base-L1-1-0.dll	62		ImpersonateSelf
API-MS-Win-Security-Base-L1-1-0.dll	63		InitializeAcl
API-MS-Win-Security-Base-L1-1-0.dll	64		InitializeSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll	65		InitializeSid
API-MS-Win-Security-Base-L1-1-0.dll	66		IsTokenRestricted
API-MS-Win-Security-Base-L1-1-0.dll	67		IsValidAcl
API-MS-Win-Security-Base-L1-1-0.dll	68		IsValidRelativeSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll	69		IsValidSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll	71		IsWellKnownSid
API-MS-Win-Security-Base-L1-1-0.dll	72		MakeAbsoluteSD
API-MS-Win-Security-Base-L1-1-0.dll	73		MakeAbsoluteSD2
API-MS-Win-Security-Base-L1-1-0.dll	54		GetSidIdentifierAuthority
API-MS-Win-Security-Base-L1-1-0.dll	75		MapGenericMask
API-MS-Win-Security-Base-L1-1-0.dll	80		PrivilegeCheck
API-MS-Win-Security-Base-L1-1-0.dll	82		QuerySecurityAccessMask
API-MS-Win-Security-Base-L1-1-0.dll	83		RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll	84		SetAclInformation
API-MS-Win-Security-Base-L1-1-0.dll	86		SetKernelObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	87		SetPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	88		SetPrivateObjectSecurityEx
API-MS-Win-Security-Base-L1-1-0.dll	36		EqualDomainSid
API-MS-Win-Security-Base-L1-1-0.dll	89		SetSecurityAccessMask
API-MS-Win-Security-Base-L1-1-0.dll	90		SetSecurityDescriptorControl
API-MS-Win-Security-Base-L1-1-0.dll	91		SetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll	92		SetSecurityDescriptorGroup
API-MS-Win-Security-Base-L1-1-0.dll	93		SetSecurityDescriptorOwner
API-MS-Win-Security-Base-L1-1-0.dll	94		SetSecurityDescriptorRMControl
API-MS-Win-Security-Base-L1-1-0.dll	95		SetSecurityDescriptorSacl
API-MS-Win-Security-Base-L1-1-0.dll	96		SetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll	53		GetSecurityDescriptorSacl
API-MS-Win-Security-Base-L1-1-0.dll	52		GetSecurityDescriptorRMControl
API-MS-Win-Security-Base-L1-1-0.dll	51		GetSecurityDescriptorOwner
API-MS-Win-Security-Base-L1-1-0.dll	50		GetSecurityDescriptorLength
API-MS-Win-Security-Base-L1-1-0.dll	49		GetSecurityDescriptorGroup
API-MS-Win-Security-Base-L1-1-0.dll	48		GetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll	47		GetSecurityDescriptorControl
API-MS-Win-Security-Base-L1-1-0.dll	46		GetPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	45		GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll	44		GetKernelObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	42		GetAclInformation
API-MS-Win-Security-Base-L1-1-0.dll	41		GetAce
API-MS-Win-Security-Base-L1-1-0.dll	40		FreeSid
API-MS-Win-Security-Base-L1-1-0.dll	39		FindFirstFreeAce
API-MS-Win-Security-Base-L1-1-0.dll	74		MakeSelfRelativeSD
API-MS-Win-Security-Base-L1-1-0.dll	38		EqualSid
API-MS-Win-Security-Base-L1-1-0.dll	70		IsValidSid
API-MS-Win-Security-Base-L1-1-0.dll	1		AccessCheckAndAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	3		AccessCheckByTypeAndAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	6		AccessCheckByTypeResultListAndAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	5		AccessCheckByTypeResultListAndAuditAlarmByHandleW
API-MS-Win-Security-Base-L1-1-0.dll	78		ObjectOpenAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	79		ObjectPrivilegeAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	76		ObjectCloseAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	77		ObjectDeleteAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	81		PrivilegedServiceAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	85		SetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll	43		GetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll	26		CopySid
API-MS-Win-Security-Base-L1-1-0.dll	58		GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll			AccessCheck
API-MS-Win-Security-Base-L1-1-0.dll	2		AccessCheckByType
API-MS-Win-Security-Base-L1-1-0.dll	4		AccessCheckByTypeResultList
API-MS-Win-Security-Base-L1-1-0.dll	7		AddAccessAllowedAce
API-MS-Win-Security-Base-L1-1-0.dll	8		AddAccessAllowedAceEx
API-MS-Win-Security-Base-L1-1-0.dll	9		AddAccessAllowedObjectAce
API-MS-Win-Security-Base-L1-1-0.dll	10		AddAccessDeniedAce
API-MS-Win-Security-Base-L1-1-0.dll	11		AddAccessDeniedAceEx
API-MS-Win-Security-Base-L1-1-0.dll	12		AddAccessDeniedObjectAce
API-MS-Win-Security-Base-L1-1-0.dll	13		AddAce
API-MS-Win-Security-Base-L1-1-0.dll	14		AddAuditAccessAce
API-MS-Win-Security-Base-L1-1-0.dll	15		AddAuditAccessAceEx
API-MS-Win-Security-Base-L1-1-0.dll	16		AddAuditAccessObjectAce
API-MS-Win-Security-Base-L1-1-0.dll	18		AdjustTokenGroups
API-MS-Win-Security-Base-L1-1-0.dll
KERNEL32.dll
RPCRT4.dll

ord	entry_va	function_name
1000	0x4e9e5
1001	0x620f9	I_ScGetCurrentGroupStateW
1002	0x1ac46	A_SHAFinal
1003	0x1ac57	A_SHAInit
1004	0x1ac67	A_SHAUpdate
1005	0x5ddb4	AbortSystemShutdownA
1006	0x5dd60	AbortSystemShutdownW
1007	0xca3c	AccessCheck
1008	0x412f9	AccessCheckAndAuditAlarmA
1009	0x42ff8	AccessCheckAndAuditAlarmW
1010	0xae5c	AccessCheckByType
1011	0x413e3	AccessCheckByTypeAndAuditAlarmA
1012	0x43008	AccessCheckByTypeAndAuditAlarmW
1013	0x43018	AccessCheckByTypeResultList
1014	0x414dc	AccessCheckByTypeResultListAndAuditAlarmA
1015	0x415d5	AccessCheckByTypeResultListAndAuditAlarmByHandleA
1016	0x43028	AccessCheckByTypeResultListAndAuditAlarmByHandleW
1017	0x43038	AccessCheckByTypeResultListAndAuditAlarmW
1018	0x14176	AddAccessAllowedAce
1019	0x1465d	AddAccessAllowedAceEx
1020	0x43048	AddAccessAllowedObjectAce
1021	0x271e4	AddAccessDeniedAce
1022	0x43058	AddAccessDeniedAceEx
1023	0x43068	AddAccessDeniedObjectAce
1024	0xae0f	AddAce
1025	0x19a4	AddAuditAccessAce
1026	0x43078	AddAuditAccessAceEx
1027	0x43088	AddAuditAccessObjectAce
1028	0x6224e	AddConditionalAce
1029	0x1ac79	AddMandatoryAce
1030	0x42a17	AddUsersToEncryptedFile
1031	0x42a5a	AddUsersToEncryptedFileEx
1032	0x43098	AdjustTokenGroups
1033	0x1418e	AdjustTokenPrivileges
1034	0x140e6	AllocateAndInitializeSid
1035	0x198c	AllocateLocallyUniqueId
1036	0x430a8	AreAllAccessesGranted
1037	0x430b8	AreAnyAccessesGranted
1038	0xaf44	AuditComputeEffectivePolicyBySid
1039	0x45d41	AuditComputeEffectivePolicyByToken
1040	0x45e2d	AuditEnumerateCategories
1041	0x45cc1	AuditEnumeratePerUserPolicy
1042	0xb1d4	AuditEnumerateSubCategories
1043	0xb2ec	AuditFree
1044	0x46163	AuditLookupCategoryGuidFromCategoryId
1045	0x46101	AuditLookupCategoryIdFromCategoryGuid
1046	0x46031	AuditLookupCategoryNameA
1047	0x45f31	AuditLookupCategoryNameW
1048	0x46099	AuditLookupSubCategoryNameA
1049	0x292e2	AuditLookupSubCategoryNameW
1050	0x4650f	AuditQueryGlobalSaclA
1051	0x464c1	AuditQueryGlobalSaclW
1052	0x45c19	AuditQueryPerUserPolicy
1053	0x46299	AuditQuerySecurity
1054	0xaea4	AuditQuerySystemPolicy
1055	0x46351	AuditSetGlobalSaclA
1056	0xb2fc	AuditSetGlobalSaclW
1057	0x45b85	AuditSetPerUserPolicy
1058	0x4619f	AuditSetSecurity
1059	0xb142	AuditSetSystemPolicy
1060	0x40f5a	BackupEventLogA
1061	0x409ed	BackupEventLogW
1062	0x23d5	BuildExplicitAccessWithNameA
1063	0x23d5	BuildExplicitAccessWithNameW
1064	0x51dbd	BuildImpersonateExplicitAccessWithNameA
1065	0x51dbd	BuildImpersonateExplicitAccessWithNameW
1066	0x51f88	BuildImpersonateTrusteeA
1067	0x51f88	BuildImpersonateTrusteeW
1068	0x51925	BuildSecurityDescriptorA
1069	0x7345	BuildSecurityDescriptorW
1070	0x2405	BuildTrusteeWithNameA
1071	0x2405	BuildTrusteeWithNameW
1072	0x52044	BuildTrusteeWithObjectsAndNameA
1073	0x52044	BuildTrusteeWithObjectsAndNameW
1074	0x51fa5	BuildTrusteeWithObjectsAndSidA
1075	0x51fa5	BuildTrusteeWithObjectsAndSidW
1076	0x277e3	BuildTrusteeWithSidA
1077	0x277e3	BuildTrusteeWithSidW
1078	0x53009	CancelOverlappedAccess
1079	0x430c8	ChangeServiceConfig2A
1080	0x430d8	ChangeServiceConfig2W
1081	0x430e8	ChangeServiceConfigA
1082	0x430f8	ChangeServiceConfigW
1083	0xdf04	CheckTokenMembership
1084	0x40ef1	ClearEventLogA
1085	0x408c1	ClearEventLogW
1086	0x23825	CloseCodeAuthzLevel
1087	0x42918	CloseEncryptedFileRaw
1088	0x77c3	CloseEventLog
1089	0x1369c	CloseServiceHandle
1090	0x664c5	CloseThreadWaitChainSession
1091	0x10d39	CloseTrace
1092	0x29aa5	CommandLineFromMsiDescriptor
1093	0x23352	ComputeAccessTokenFromCodeAuthzLevel
1094	0x27144	ControlService
1095	0x43108	ControlServiceExA
1096	0x43118	ControlServiceExW
1097	0x58fd4	ControlTraceA
1098	0xf65b	ControlTraceW
1099	0x53cb1	ConvertAccessToSecurityDescriptorA
1100	0x52934	ConvertAccessToSecurityDescriptorW
1101	0x625dd	ConvertSDToStringSDRootDomainA
1102	0x6248e	ConvertSDToStringSDRootDomainW
1103	0x52b61	ConvertSecurityDescriptorToAccessA
1104	0x52b61	ConvertSecurityDescriptorToAccessNamedA
1105	0x52b3c	ConvertSecurityDescriptorToAccessNamedW
1106	0x52b3c	ConvertSecurityDescriptorToAccessW
1107	0x6276a	ConvertSecurityDescriptorToStringSecurityDescriptorA
1108	0x4241	ConvertSecurityDescriptorToStringSecurityDescriptorW
1109	0x3192a	ConvertSidToStringSidA
1110	0x14344	ConvertSidToStringSidW
1111	0x626c0	ConvertStringSDToSDDomainA
1112	0x624e6	ConvertStringSDToSDDomainW
1113	0x6255d	ConvertStringSDToSDRootDomainA
1114	0x6243b	ConvertStringSDToSDRootDomainW
1115	0xca94	ConvertStringSecurityDescriptorToSecurityDescriptorA
1116	0x11f59	ConvertStringSecurityDescriptorToSecurityDescriptorW
1117	0x20f23	ConvertStringSidToSidA
1118	0x209dc	ConvertStringSidToSidW
1119	0x43128	ConvertToAutoInheritPrivateObjectSecurity
1120	0x1444e	CopySid
1121	0x4da88	CreateCodeAuthzLevel
1122	0x29a12	CreatePrivateObjectSecurity
1123	0xf489	CreatePrivateObjectSecurityEx
1124	0x43138	CreatePrivateObjectSecurityWithMultipleInheritance
1125	0x42538	CreateProcessAsUserA
1126	0xc592	CreateProcessAsUserW
1127	0x452e9	CreateProcessWithLogonW
1128	0x4531f	CreateProcessWithTokenW
1129	0x43148	CreateRestrictedToken
1130	0x43158	CreateServiceA
1131	0x2712c	CreateServiceW
1132	0x1ac94	CreateTraceInstanceId
1133	0x1481e	CreateWellKnownSid
1134	0x47d1d	CredBackupCredentials
1135	0x47941	CredDeleteA
1136	0x479f1	CredDeleteW
1137	0x481f9	CredEncryptAndMarshalBinaryBlob
1138	0x47381	CredEnumerateA
1139	0x47481	CredEnumerateW
1140	0x47f49	CredFindBestCredentialA
1141	0x48029	CredFindBestCredentialW
1142	0xb2ec	CredFree
1143	0x47c71	CredGetSessionTypes
1144	0x47ab3	CredGetTargetInfoA
1145	0x47b91	CredGetTargetInfoW
1146	0x48437	CredIsMarshaledCredentialA
1147	0x2766c	CredIsMarshaledCredentialW
1148	0x48321	CredIsProtectedA
1149	0xc0b8	CredIsProtectedW
1150	0x48383	CredMarshalCredentialA
1151	0x8dd9	CredMarshalCredentialW
1152	0x59e1	CredProfileLoaded
1153	0x27015	CredProfileUnloaded
1154	0x4821b	CredProtectA
1155	0x8c20	CredProtectW
1156	0x471c1	CredReadA
1157	0x48109	CredReadByTokenHandle
1158	0x47741	CredReadDomainCredentialsA
1159	0x47841	CredReadDomainCredentialsW
1160	0x472a1	CredReadW
1161	0x47aa1	CredRenameA
1162	0x47aa1	CredRenameW
1163	0x47e39	CredRestoreCredentials
1164	0x483ce	CredUnmarshalCredentialA
1165	0xc057	CredUnmarshalCredentialW
1166	0x48465	CredUnprotectA
1167	0x80de	CredUnprotectW
1168	0x47051	CredWriteA
1169	0x47581	CredWriteDomainCredentialsA
1170	0x47661	CredWriteDomainCredentialsW
1171	0x47109	CredWriteW
1172	0x46b8a	CredpConvertCredential
1173	0x46a44	CredpConvertOneCredentialSize
1174	0x46c41	CredpConvertTargetInfo
1175	0x465fa	CredpDecodeCredential
1176	0x46599	CredpEncodeCredential
1177	0x47cf9	CredpEncodeSecret
1178	0x91dd	CryptAcquireContextA
1179	0xdf14	CryptAcquireContextW
1180	0x43168	CryptContextAddRef
1181	0xdf4e	CryptCreateHash
1182	0x43178	CryptDecrypt
1183	0x43188	CryptDeriveKey
1184	0xdf66	CryptDestroyHash
1185	0xc51a	CryptDestroyKey
1186	0x43198	CryptDuplicateHash
1187	0x431a8	CryptDuplicateKey
1188	0x2779b	CryptEncrypt
1189	0x431b8	CryptEnumProviderTypesA
1190	0x431c8	CryptEnumProviderTypesW
1191	0x431d8	CryptEnumProvidersA
1192	0x431e8	CryptEnumProvidersW
1193	0x91ea	CryptExportKey
1194	0x8ee9	CryptGenKey
1195	0xdfc8	CryptGenRandom
1196	0x431f8	CryptGetDefaultProviderA
1197	0x43208	CryptGetDefaultProviderW
1198	0xdf7e	CryptGetHashParam
1199	0x277cb	CryptGetKeyParam
1200	0x43218	CryptGetProvParam
1201	0x43228	CryptGetUserKey
1202	0xdf36	CryptHashData
1203	0x43238	CryptHashSessionKey
1204	0xc532	CryptImportKey
1205	0xe124	CryptReleaseContext
1206	0x43248	CryptSetHashParam
1207	0x277b3	CryptSetKeyParam
1208	0x43258	CryptSetProvParam
1209	0x43268	CryptSetProviderA
1210	0x43278	CryptSetProviderExA
1211	0x43288	CryptSetProviderExW
1212	0x43298	CryptSetProviderW
1213	0x432a8	CryptSignHashA
1214	0x432b8	CryptSignHashW
1215	0x432c8	CryptVerifySignatureA
1216	0xc54a	CryptVerifySignatureW
1217	0x42d75	DecryptFileA
1218	0x4283b	DecryptFileW
1219	0x142ec	DeleteAce
1220	0x2715c	DeleteService
1221	0x135dd	DeregisterEventSource
1222	0xf471	DestroyPrivateObjectSecurity
1223	0x42ae4	DuplicateEncryptionInfoFile
1224	0xc7e6	DuplicateToken
1225	0xca24	DuplicateTokenEx
1226	0x65049	ElfBackupEventLogFileA
1227	0x64b79	ElfBackupEventLogFileW
1228	0x64929	ElfChangeNotify
1229	0x64fa1	ElfClearEventLogFileA
1230	0x64ad1	ElfClearEventLogFileW
1231	0x77e4	ElfCloseEventLog
1232	0x135fe	ElfDeregisterEventSource
1233	0x65201	ElfFlushEventLog
1234	0x647b9	ElfNumberOfRecords
1235	0x64871	ElfOldestRecord
1236	0x64eb1	ElfOpenBackupEventLogA
1237	0x649e1	ElfOpenBackupEventLogW
1238	0x64d3e	ElfOpenEventLogA
1239	0x763e	ElfOpenEventLogW
1240	0x65101	ElfReadEventLogA
1241	0x64c31	ElfReadEventLogW
1242	0x12d8d	ElfRegisterEventSourceA
1243	0x12629	ElfRegisterEventSourceW
1244	0x4019	ElfReportEventA
1245	0x64d31	ElfReportEventAndSourceW
1246	0xc96a	ElfReportEventW
1247	0xfcda	EnableTrace
1248	0xfa81	EnableTraceEx2
1249	0xfc60	EnableTraceEx
1250	0x42cd8	EncryptFileA
1251	0x427ec	EncryptFileW
1252	0x42b53	EncryptedFileKeyInfo
1253	0x42b27	EncryptionDisable
1254	0x62104	EnumDependentServicesA
1255	0x1e3a	EnumDependentServicesW
1256	0x61f11	EnumServiceGroupW
1257	0x62021	EnumServicesStatusA
1258	0x2a3e2	EnumServicesStatusExA
1259	0xb466	EnumServicesStatusExW
1260	0x62221	EnumServicesStatusW
1261	0x296dc	EnumerateTraceGuids
1262	0x588d5	EnumerateTraceGuidsEx
1263	0x432d8	EqualDomainSid
1264	0xcce9	EqualPrefixSid
1265	0x1410b	EqualSid
1266	0x3118	EventAccessControl
1267	0x34be	EventAccessQuery
1268	0x58856	EventAccessRemove
1269	0x1acb3	EventActivityIdControl
1270	0x1acd3	EventEnabled
1271	0x1ace9	EventProviderEnabled
1272	0x1ad07	EventRegister
1273	0x1ad1e	EventUnregister
1274	0x1ad37	EventWrite
1275	0x1ad4b	EventWriteEndScenario
1276	0x432e8	EventWriteEx
1277	0x1ad6a	EventWriteStartScenario
1278	0x1ad8b	EventWriteString
1279	0x1ada5	EventWriteTransfer
1280	0x42e15	FileEncryptionStatusA
1281	0x4288e	FileEncryptionStatusW
1282	0x43319	FindFirstFreeAce
1283	0x42f91	FlushEfsCache
1284	0x5961a	FlushTraceA
1285	0x5ff1	FlushTraceW
1286	0x42b96	FreeEncryptedFileKeyInfo
1287	0x42cb6	FreeEncryptedFileMetadata
1288	0x42971	FreeEncryptionCertificateHashList
1289	0x51f62	FreeInheritedFromArray
1290	0x1412e	FreeSid
1291	0x53171	GetAccessPermissionsForObjectA
1292	0x53089	GetAccessPermissionsForObjectW
1293	0x145f0	GetAce
1294	0xcc89	GetAclInformation
1295	0x518df	GetAuditedPermissionsFromAclA
1296	0x5188c	GetAuditedPermissionsFromAclW
1297	0x411f8	GetCurrentHwProfileA
1298	0x1a03	GetCurrentHwProfileW
1299	0x51813	GetEffectiveRightsFromAclA
1300	0x517b1	GetEffectiveRightsFromAclW
1301	0x42c6c	GetEncryptedFileMetadata
1302	0x7884	GetEventLogInformation
1303	0x5187f	GetExplicitEntriesFromAclA
1304	0x5185f	GetExplicitEntriesFromAclW
1305	0x419b8	GetFileSecurityA
1306	0xa94d	GetFileSecurityW
1307	0x9094	GetInformationCodeAuthzLevelW
1308	0x9d25	GetInformationCodeAuthzPolicyW
1309	0x51f57	GetInheritanceSourceA
1310	0x51f11	GetInheritanceSourceW
1311	0x1462d	GetKernelObjectSecurity
1312	0x1413b	GetLengthSid
1313	0x4c4a3	GetLocalManagedApplicationData
1314	0x4c25b	GetLocalManagedApplications
1315	0x4c796	GetManagedApplicationCategories
1316	0x4c736	GetManagedApplications
1317	0x52102	GetMultipleTrusteeA
1318	0x520e6	GetMultipleTrusteeOperationA
1319	0x520e6	GetMultipleTrusteeOperationW
1320	0x52102	GetMultipleTrusteeW
1321	0x51554	GetNamedSecurityInfoA
1322	0x52389	GetNamedSecurityInfoExA
1323	0x5211d	GetNamedSecurityInfoExW
1324	0xf4fd	GetNamedSecurityInfoW
1325	0x4086d	GetNumberOfEventLogRecords
1326	0x40897	GetOldestEventLogRecord
1327	0x52ee9	GetOverlappedAccessResults
1328	0x43329	GetPrivateObjectSecurity
1329	0xaddf	GetSecurityDescriptorControl
1330	0x141a6	GetSecurityDescriptorDacl
1331	0xae27	GetSecurityDescriptorGroup
1332	0xcc71	GetSecurityDescriptorLength
1333	0xadf7	GetSecurityDescriptorOwner
1334	0x43339	GetSecurityDescriptorRMControl
1335	0x14608	GetSecurityDescriptorSacl
1336	0xb3e4	GetSecurityInfo
1337	0x527a1	GetSecurityInfoExA
1338	0x52537	GetSecurityInfoExW
1339	0x61c31	GetServiceDisplayNameA
1340	0x279bb	GetServiceDisplayNameW
1341	0x61b94	GetServiceKeyNameA
1342	0x278ff	GetServiceKeyNameW
1343	0xa935	GetSidIdentifierAuthority
1344	0xccb9	GetSidLengthRequired
1345	0x10e24	GetSidSubAuthority
1346	0x10e0c	GetSidSubAuthorityCount
1347	0x671c7	GetThreadWaitChain
1348	0x1431c	GetTokenInformation
1349	0x1adc1	GetTraceEnableFlags
1350	0x1adde	GetTraceEnableLevel
1351	0x1adfb	GetTraceLoggerHandle
1352	0x520c9	GetTrusteeFormA
1353	0x520c9	GetTrusteeFormW
1354	0x52099	GetTrusteeNameA
1355	0x52099	GetTrusteeNameW
1356	0x520ad	GetTrusteeTypeA
1357	0x520ad	GetTrusteeTypeW
1358	0x2a4b4	GetUserNameA
1359	0x1157a	GetUserNameW
1360	0x43349	GetWindowsAccountDomainSid
1361	0x1ae19	I_QueryTagInformation
1362	0x1ae50	I_ScIsSecurityProcess
1363	0x1ae87	I_ScPnPGetServiceName
1364	0x1aebe	I_ScQueryServiceConfig
1365	0x1aef6	I_ScSendPnPMessage
1366	0x1af2a	I_ScSendTSMessage
1367	0x621d9	I_ScSetServiceBitsA
1368	0x7d39	I_ScSetServiceBitsW
1369	0x1af5d	I_ScValidatePnPService
1370	0x22102	IdentifyCodeAuthzLevelW
1371	0x43359	ImpersonateAnonymousToken
1372	0xc57a	ImpersonateLoggedOnUser
1373	0x43369	ImpersonateNamedPipeClient
1374	0xae8c	ImpersonateSelf
1375	0x145cd	InitializeAcl
1376	0x14620	InitializeSecurityDescriptor
1377	0xcca1	InitializeSid
1378	0x5dece	InitiateShutdownA
1379	0x5de14	InitiateShutdownW
1380	0x5dc0f	InitiateSystemShutdownA
1381	0x5dcb6	InitiateSystemShutdownExA
1382	0x5db3a	InitiateSystemShutdownExW
1383	0x5da6d	InitiateSystemShutdownW
1384	0x4cf11	InstallApplication
1385	0x1448e	IsTextUnicode
1386	0xc562	IsTokenRestricted
1387	0x4db46	IsTokenUntrusted
1388	0x8523	IsValidAcl
1389	0x1af95	IsValidRelativeSecurityDescriptor
1390	0xb58c	IsValidSecurityDescriptor
1391	0x12eef	IsValidSid
1392	0xcb06	IsWellKnownSid
1393	0x61cd1	LockServiceDatabase
1394	0x42654	LogonUserA
1395	0x42683	LogonUserExA
1396	0xb965	LogonUserExExW
1397	0x42505	LogonUserExW
1398	0xc1a9	LogonUserW
1399	0x41a25	LookupAccountNameA
1400	0xe276	LookupAccountNameW
1401	0x41daa	LookupAccountSidA
1402	0x14874	LookupAccountSidW
1403	0x422f1	LookupPrivilegeDisplayNameA
1404	0x420b4	LookupPrivilegeDisplayNameW
1405	0x421d6	LookupPrivilegeNameA
1406	0x41fab	LookupPrivilegeNameW
1407	0x1404a	LookupPrivilegeValueA
1408	0x141b3	LookupPrivilegeValueW
1409	0x51bc7	LookupSecurityDescriptorPartsA
1410	0x51a16	LookupSecurityDescriptorPartsW
1411	0x48819	LsaAddAccountRights
1412	0x4abb9	LsaAddPrivilegesToAccount
1413	0x49d71	LsaClearAuditLog
1414	0x21af7	LsaClose
1415	0x4a3b1	LsaCreateAccount
1416	0x4a9c1	LsaCreateSecret
1417	0x4a521	LsaCreateTrustedDomain
1418	0x494c1	LsaCreateTrustedDomainEx
1419	0x4a179	LsaDelete
1420	0x48ad1	LsaDeleteTrustedDomain
1421	0x48769	LsaEnumerateAccountRights
1422	0x4a469	LsaEnumerateAccounts
1423	0x486b7	LsaEnumerateAccountsWithUserRight
1424	0x4a90d	LsaEnumeratePrivileges
1425	0x4ab31	LsaEnumeratePrivilegesOfAccount
1426	0x502d	LsaEnumerateTrustedDomains
1427	0x493fd	LsaEnumerateTrustedDomainsEx
1428	0x1ede1	LsaFreeMemory
1429	0x4acc9	LsaGetQuotasForAccount
1430	0x4b37b	LsaGetRemoteUserName
1431	0x4add9	LsaGetSystemAccessAccount
1432	0xace2	LsaGetUserName
1433	0x27d26	LsaICLookupNames
1434	0x2753b	LsaICLookupNamesWithCreds
1435	0x294da	LsaICLookupSids
1436	0x27308	LsaICLookupSidsWithCreds
1437	0x27cdc	LsaLookupNames2
1438	0x4b49d	LsaLookupNames
1439	0x49e99	LsaLookupPrivilegeDisplayName
1440	0x49df1	LsaLookupPrivilegeName
1441	0x14251	LsaLookupPrivilegeValue
1442	0x293dc	LsaLookupSids
1443	0x498dc	LsaManageSidNameMapping
1444	0x4b621	LsaNtStatusToWinError
1445	0x4aa79	LsaOpenAccount
1446	0x2077c	LsaOpenPolicy
1447	0x49bcc	LsaOpenPolicySce
1448	0x4aee9	LsaOpenSecret
1449	0x4a5d9	LsaOpenTrustedDomain
1450	0x496b9	LsaOpenTrustedDomainByName
1451	0x49589	LsaQueryDomainInformationPolicy
1452	0x49769	LsaQueryForestTrustInformation
1453	0x4a691	LsaQueryInfoTrustedDomain
1454	0x21bb0	LsaQueryInformationPolicy
1455	0x4b31d	LsaQuerySecret
1456	0x4a209	LsaQuerySecurityObject
1457	0x48949	LsaQueryTrustedDomainInfo
1458	0x48f4d	LsaQueryTrustedDomainInfoByName
1459	0x488b1	LsaRemoveAccountRights
1460	0x4ac41	LsaRemovePrivilegesFromAccount
1461	0x569e	LsaRetrievePrivateData
1462	0x49621	LsaSetDomainInformationPolicy
1463	0x497f1	LsaSetForestTrustInformation
1464	0x49c81	LsaSetInformationPolicy
1465	0x4a749	LsaSetInformationTrustedDomain
1466	0x4ad51	LsaSetQuotasForAccount
1467	0x4b105	LsaSetSecret
1468	0x4a2b1	LsaSetSecurityObject
1469	0x4ae61	LsaSetSystemAccessAccount
1470	0x4923d	LsaSetTrustedDomainInfoByName
1471	0x48a09	LsaSetTrustedDomainInformation
1472	0x48d88	LsaStorePrivateData
1473	0x1afc2	MD4Final
1474	0x1afd1	MD4Init
1475	0x1afdf	MD4Update
1476	0x1afef	MD5Final
1477	0x1affe	MD5Init
1478	0x1b00c	MD5Update
1479	0x43f1f	MSChapSrvChangePassword2
1480	0x43d3b	MSChapSrvChangePassword
1481	0x43379	MakeAbsoluteSD2
1482	0xccd1	MakeAbsoluteSD
1483	0xcc59	MakeSelfRelativeSD
1484	0x27a73	MapGenericMask
1485	0x389b	NotifyBootConfigStatus
1486	0x40843	NotifyChangeEventLog
1487	0xca89	NotifyServiceStatusChange
1488	0x2ec74	NotifyServiceStatusChangeA
1489	0xca7c	NotifyServiceStatusChangeW
1490	0x4181c	ObjectCloseAuditAlarmA
1491	0x43389	ObjectCloseAuditAlarmW
1492	0x41871	ObjectDeleteAuditAlarmA
1493	0x43399	ObjectDeleteAuditAlarmW
1494	0x416d1	ObjectOpenAuditAlarmA
1495	0x433a9	ObjectOpenAuditAlarmW
1496	0x417be	ObjectPrivilegeAuditAlarmA
1497	0x433b9	ObjectPrivilegeAuditAlarmW
1498	0x41014	OpenBackupEventLogA
1499	0x40b09	OpenBackupEventLogW
1500	0x42eb8	OpenEncryptedFileRawA
1501	0x428ba	OpenEncryptedFileRawW
1502	0x40fc3	OpenEventLogA
1503	0x75f7	OpenEventLogW
1504	0x14304	OpenProcessToken
1505	0x12bd8	OpenSCManagerA
1506	0xca64	OpenSCManagerW
1507	0x12bf0	OpenServiceA
1508	0xca4c	OpenServiceW
1509	0x1432c	OpenThreadToken
1510	0x663ee	OpenThreadWaitChainSession
1511	0x587a3	OpenTraceA
1512	0xef8d	OpenTraceW
1513	0x5e539	PerfAddCounters
1514	0x5e169	PerfCloseQueryHandle
1515	0x1b01c	PerfCreateInstance
1516	0x1b035	PerfDecrementULongCounterValue
1517	0x1b05a	PerfDecrementULongLongCounterValue
1518	0x5e557	PerfDeleteCounters
1519	0x1b083	PerfDeleteInstance
1520	0x5e6b1	PerfEnumerateCounterSet
1521	0x5e8e9	PerfEnumerateCounterSetInstances
1522	0x1b09c	PerfIncrementULongCounterValue
1523	0x1b0c1	PerfIncrementULongLongCounterValue
1524	0x5e9f1	PerfOpenQueryHandle
1525	0x5e349	PerfQueryCounterData
1526	0x5e241	PerfQueryCounterInfo
1527	0x5e7c9	PerfQueryCounterSetRegistrationInfo
1528	0x1b0ea	PerfQueryInstance
1529	0x1b102	PerfSetCounterRefValue
1530	0x1b11f	PerfSetCounterSetInfo
1531	0x1b13b	PerfSetULongCounterValue
1532	0x1b15a	PerfSetULongLongCounterValue
1533	0x1b17d	PerfStartProvider
1534	0x1b195	PerfStartProviderEx
1535	0x1b1af	PerfStopProvider
1536	0xae74	PrivilegeCheck
1537	0x418c6	PrivilegedServiceAuditAlarmA
1538	0x433c9	PrivilegedServiceAuditAlarmW
1539	0x45521	ProcessIdleTasks
1540	0x455b9	ProcessIdleTasksW
1541	0x1050f	ProcessTrace
1542	0x59751	QueryAllTracesA
1543	0x59733	QueryAllTracesW
1544	0x42991	QueryRecoveryAgentsOnEncryptedFile
1545	0x433d9	QuerySecurityAccessMask
1546	0x433e9	QueryServiceConfig2A
1547	0x433f9	QueryServiceConfig2W
1548	0x29a4f	QueryServiceConfigA
1549	0xb537	QueryServiceConfigW
1550	0x61d59	QueryServiceLockStatusA
1551	0x61df1	QueryServiceLockStatusW
1552	0x43409	QueryServiceObjectSecurity
1553	0x12a86	QueryServiceStatus
1554	0x798c	QueryServiceStatusEx
1555	0x59596	QueryTraceA
1556	0x7a97	QueryTraceW
1557	0x4292e	QueryUsersOnEncryptedFile
1558	0x428ec	ReadEncryptedFileRaw
1559	0x410c5	ReadEventLogA
1560	0x40e9d	ReadEventLogW
1561	0x1469d	RegCloseKey
1562	0x5ef59	RegConnectRegistryA
1563	0x5eef9	RegConnectRegistryExA
1564	0x8f1f	RegConnectRegistryExW
1565	0x8f01	RegConnectRegistryW
1566	0x5f58c	RegCopyTreeA
1567	0x5f3af	RegCopyTreeW
1568	0xcd01	RegCreateKeyA
1569	0x11469	RegCreateKeyExA
1570	0x140fe	RegCreateKeyExW
1571	0x5f6b5	RegCreateKeyTransactedA
1572	0xa848	RegCreateKeyTransactedW
1573	0x11514	RegCreateKeyW
1574	0x2a8b7	RegDeleteKeyA
1575	0x43419	RegDeleteKeyExA
1576	0xa9c5	RegDeleteKeyExW
1577	0x5f7c0	RegDeleteKeyTransactedA
1578	0xa8ea	RegDeleteKeyTransactedW
1579	0x5f80b	RegDeleteKeyValueA
1580	0x5f84b	RegDeleteKeyValueW
1581	0x11272	RegDeleteKeyW
1582	0x434b3	RegDeleteTreeA
1583	0x434a3	RegDeleteTreeW
1584	0x2a4ea	RegDeleteValueA
1585	0xcf31	RegDeleteValueW
1586	0xb5a4	RegDisablePredefinedCache
1587	0x43429	RegDisablePredefinedCacheEx
1588	0x27cd2	RegDisableReflectionKey
1589	0x27cd2	RegEnableReflectionKey
1590	0x2a299	RegEnumKeyA
1591	0x11481	RegEnumKeyExA
1592	0x146c8	RegEnumKeyExW
1593	0x1445b	RegEnumKeyW
1594	0xcf49	RegEnumValueA
1595	0x148cc	RegEnumValueW
1596	0x2773f	RegFlushKey
1597	0xa995	RegGetKeySecurity
1598	0xa9dd	RegGetValueA
1599	0x10e47	RegGetValueW
1600	0x5fdcd	RegLoadAppKeyA
1601	0x5fc17	RegLoadAppKeyW
1602	0x43463	RegLoadKeyA
1603	0x43473	RegLoadKeyW
1604	0x43433	RegLoadMUIStringA
1605	0x111b6	RegLoadMUIStringW
1606	0xe15b	RegNotifyChangeKeyValue
1607	0x115ad	RegOpenCurrentUser
1608	0xcc15	RegOpenKeyA
1609	0x14907	RegOpenKeyExA
1610	0x1468d	RegOpenKeyExW
1611	0x5f70f	RegOpenKeyTransactedA
1612	0xa8a2	RegOpenKeyTransactedW
1613	0x12459	RegOpenKeyW
1614	0x288c4	RegOpenUserClassesRoot
1615	0x5f5e8	RegOverridePredefKey
1616	0xe143	RegQueryInfoKeyA
1617	0x146e7	RegQueryInfoKeyW
1618	0x5ffb4	RegQueryMultipleValuesA
1619	0x6052d	RegQueryMultipleValuesW
1620	0x43f97	RegQueryReflectionKey
1621	0xce12	RegQueryValueA
1622	0x148ef	RegQueryValueExA
1623	0x146ad	RegQueryValueExW
1624	0x144b4	RegQueryValueW
1625	0x5f758	RegRenameKey
1626	0x60943	RegReplaceKeyA
1627	0x60b89	RegReplaceKeyW
1628	0x43453	RegRestoreKeyA
1629	0x27cba	RegRestoreKeyW
1630	0x60cc9	RegSaveKeyA
1631	0x43443	RegSaveKeyExA
1632	0x27ca2	RegSaveKeyExW
1633	0x27a9b	RegSaveKeyW
1634	0xb2d4	RegSetKeySecurity
1635	0x5f88b	RegSetKeyValueA
1636	0x27180	RegSetKeyValueW
1637	0x60e41	RegSetValueA
1638	0x114b3	RegSetValueExA
1639	0x114d6	RegSetValueExW
1640	0x2a68a	RegSetValueW
1641	0x43483	RegUnLoadKeyA
1642	0x43493	RegUnLoadKeyW
1643	0x12d46	RegisterEventSourceA
1644	0x1271c	RegisterEventSourceW
1645	0x5bfc	RegisterIdleTask
1646	0x434c3	RegisterServiceCtrlHandlerA
1647	0x434d3	RegisterServiceCtrlHandlerExA
1648	0xa9ad	RegisterServiceCtrlHandlerExW
1649	0xa97d	RegisterServiceCtrlHandlerW
1650	0x1b1c6	RegisterTraceGuidsA
1651	0x1b1e3	RegisterTraceGuidsW
1652	0x66373	RegisterWaitChainCOMCallback
1653	0x58695	RemoveTraceCallback
1654	0x429d4	RemoveUsersFromEncryptedFile
1655	0x3ee9	ReportEventA
1656	0xc839	ReportEventW
1657	0x11562	RevertToSelf
1658	0x23825	SaferCloseLevel
1659	0x23352	SaferComputeTokenFromLevel
1660	0x4da88	SaferCreateLevel
1661	0x9094	SaferGetLevelInformation
1662	0x9d25	SaferGetPolicyInformation
1663	0x22102	SaferIdentifyLevel
1664	0x4f0bd	SaferRecordEventLogEntry
1665	0x50073	SaferSetLevelInformation
1666	0x4e47d	SaferSetPolicyInformation
1667	0x50595	SaferiChangeRegistryScope
1668	0xb5c9	SaferiCompareTokenLevels
1669	0x4ed75	SaferiIsDllAllowed
1670	0x9bd5	SaferiIsExecutableFileType
1671	0x9202	SaferiPopulateDefaultsInRegistry
1672	0x4f0bd	SaferiRecordEventLogEntry
1673	0x79db	SaferiSearchMatchingHashRules
1674	0x434e3	SetAclInformation
1675	0x42c91	SetEncryptedFileMetadata
1676	0x53edd	SetEntriesInAccessListA
1677	0x52be8	SetEntriesInAccessListW
1678	0x515e9	SetEntriesInAclA
1679	0x12a66	SetEntriesInAclW
1680	0x53f16	SetEntriesInAuditListA
1681	0x52c21	SetEntriesInAuditListW
1682	0x41951	SetFileSecurityA
1683	0x79c3	SetFileSecurityW
1684	0x50073	SetInformationCodeAuthzLevelW
1685	0x4e47d	SetInformationCodeAuthzPolicyW
1686	0x14645	SetKernelObjectSecurity
1687	0x515a0	SetNamedSecurityInfoA
1688	0x53519	SetNamedSecurityInfoExA
1689	0x53302	SetNamedSecurityInfoExW
1690	0x9fe2	SetNamedSecurityInfoW
1691	0x434f3	SetPrivateObjectSecurity
1692	0x43503	SetPrivateObjectSecurityEx
1693	0x43513	SetSecurityAccessMask
1694	0x27a8b	SetSecurityDescriptorControl
1695	0x1415e	SetSecurityDescriptorDacl
1696	0xf464	SetSecurityDescriptorGroup
1697	0xf44c	SetSecurityDescriptorOwner
1698	0x43523	SetSecurityDescriptorRMControl
1699	0x14680	SetSecurityDescriptorSacl
1700	0x9edf	SetSecurityInfo
1701	0x53a01	SetSecurityInfoExA
1702	0x537e9	SetSecurityInfoExW
1703	0x621eb	SetServiceBits
1704	0x43533	SetServiceObjectSecurity
1705	0xc7a6	SetServiceStatus
1706	0xc7ce	SetThreadToken
1707	0x9a92	SetTokenInformation
1708	0x585a7	SetTraceCallback
1709	0x42f57	SetUserFileEncryptionKey
1710	0x42a9d	SetUserFileEncryptionKeyEx
1711	0x43543	StartServiceA
1712	0x43553	StartServiceCtrlDispatcherA
1713	0xa965	StartServiceCtrlDispatcherW
1714	0x7974	StartServiceW
1715	0x58b26	StartTraceA
1716	0xe467	StartTraceW
1717	0x595b7	StopTraceA
1718	0x10deb	StopTraceW
1719	0x43fb0	SystemFunction001
1720	0x26fd0	SystemFunction002
1721	0x8485	SystemFunction003
1722	0x43ff5	SystemFunction004
1723	0x4403a	SystemFunction005
1724	0x83ca	SystemFunction006
1725	0xb9a9	SystemFunction007
1726	0x45816	SystemFunction008
1727	0x458bd	SystemFunction009
1728	0x458cd	SystemFunction010
1729	0x45918	SystemFunction011
1730	0x45925	SystemFunction012
1731	0x4595f	SystemFunction013
1732	0x45a95	SystemFunction014
1733	0x45999	SystemFunction015
1734	0x459a6	SystemFunction016
1735	0x459dc	SystemFunction017
1736	0x45a12	SystemFunction018
1737	0x45a1f	SystemFunction019
1738	0x45a95	SystemFunction020
1739	0x45999	SystemFunction021
1740	0x45a95	SystemFunction022
1741	0x45999	SystemFunction023
1742	0x45a2c	SystemFunction024
1743	0x26f70	SystemFunction025
1744	0x45a88	SystemFunction026
1745	0x26f63	SystemFunction027
1746	0x4407f	SystemFunction028
1747	0x440c1	SystemFunction029
1748	0x26f07	SystemFunction030
1749	0x26f07	SystemFunction031
1750	0x45aa5	SystemFunction032
1751	0x45aa5	SystemFunction033
1752	0x44103	SystemFunction034
1753	0x1b200	SystemFunction035
1754	0x1919	SystemFunction036
1755	0xa0af	SystemFunction040
1756	0xa06a	SystemFunction041
1757	0x1b21d	TraceEvent
1758	0x1b234	TraceEventInstance
1759	0x1b250	TraceMessage
1760	0x1b266	TraceMessageVa
1761	0x58987	TraceSetInformation
1762	0x51e82	TreeResetNamedSecurityInfoA
1763	0x51df8	TreeResetNamedSecurityInfoW
1764	0x51e82	TreeSetNamedSecurityInfoA
1765	0x51e8d	TreeSetNamedSecurityInfoW
1766	0x52d31	TrusteeAccessToObjectA
1767	0x52c48	TrusteeAccessToObjectW
1768	0x4c20d	UninstallApplication
1769	0x61e89	UnlockServiceDatabase
1770	0x455c6	UnregisterIdleTask
1771	0x1b27e	UnregisterTraceGuids
1772	0x595d8	UpdateTraceA
1773	0x595f9	UpdateTraceW
1774	0x42bb6	UsePinForEncryptedFilesA
1775	0x42bff	UsePinForEncryptedFilesW
1776	0x13e3d	WmiCloseBlock
1777	0x56851	WmiDevInstToInstanceNameA
1778	0x2a123	WmiDevInstToInstanceNameW
1779	0x56065	WmiEnumerateGuids
1780	0x565ca	WmiExecuteMethodA
1781	0x55d35	WmiExecuteMethodW
1782	0x56909	WmiFileHandleToInstanceNameA
1783	0x5664f	WmiFileHandleToInstanceNameW
1784	0x28831	WmiFreeBuffer
1785	0x5700e	WmiMofEnumerateResourcesA
1786	0x2831f	WmiMofEnumerateResourcesW
1787	0x550e1	WmiNotificationRegistrationA
1788	0xaa67	WmiNotificationRegistrationW
1789	0x13b41	WmiOpenBlock
1790	0x563a9	WmiQueryAllDataA
1791	0x563ed	WmiQueryAllDataMultipleA
1792	0x551aa	WmiQueryAllDataMultipleW
1793	0x13c0d	WmiQueryAllDataW
1794	0x28795	WmiQueryGuidInformation
1795	0x56439	WmiQuerySingleInstanceA
1796	0x5585d	WmiQuerySingleInstanceMultipleA
1797	0x55635	WmiQuerySingleInstanceMultipleW
1798	0x55395	WmiQuerySingleInstanceW
1799	0x55167	WmiReceiveNotificationsA
1800	0x55125	WmiReceiveNotificationsW
1801	0x564df	WmiSetSingleInstanceA
1802	0x559b7	WmiSetSingleInstanceW
1803	0x56553	WmiSetSingleItemA
1804	0x55b75	WmiSetSingleItemW
1805	0x42902	WriteEncryptedFileRaw

module_name	ADVAPI32.dll
flags	0
timestamp	2010-11-20 11:03:58
version	0.0
ordinal_base	1000
nFunctions	806
nNames	805
Names(805)	0x156fc
Functions(806)	0x14a64
NameOrdinals(805)	0x16390

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Advanced Windows 32 Base API
FileVersion	6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName	advapi32.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	advapi32.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion	6.1.7601.17514
ProductVersion	6.1.7601.17514
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	640512	DLL	11/20/2010 11:54:46	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x278

module.284.3eefdd40.76fd0000.dll-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

module.284.3eefdd40.76fd0000.dll
-