advapi32.dll - Advanced Windows 32 Base API

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	advapi32.dll
size	878080 (0xd6600)
md5	63a580c88cfaf72a92550940054569ef

type	PE32+ executable (DLL) (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
149	30729	3
1	0	655
147	30729	27
131	30729	10
146	30729	1
142	30729	140
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x521eae52
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0x74a00
SizeOfInitializedData	0x62400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x24ea0
BaseOfCode	0x1000
ImageBase	0x7ff7ff10000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0xdb000
SizeOfHeaders	0x400
CheckSum	0xdc3af
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x748e9	0x74a00	R-X CODE
.rdata	0x76000	0x31c44	0x31e00	R-- IDATA
.data	0xa8000	0x4240	0x3800	RW- IDATA
.pdata	0xad000	0x765c	0x7800	R-- IDATA
.rsrc	0xb5000	0x23140	0x23200	R-- IDATA
.reloc	0xd9000	0x1614	0x1800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x91bd4	0x6860
IMPORT	0x9c91c	0x118
RESOURCE	0xb5000	0x23140
EXCEPTION	0xad000	0x765c
SECURITY	0	0
BASERELOC	0xd9000	0x1614
DEBUG	0x75888	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x76000	0x11f0
Delay_IAT	0x9bf00	0x100
CLR_Header	0	0

show previews

type	name	size
MUI	#1	256
WEVT_TEMPLATE	#1	142030
RCDATA	#102	92
VERSION	#1	944

module_name	hint	ord	function_name
msvcrt.dll	1152		memcpy
msvcrt.dll	1216		strrchr
msvcrt.dll	1289		wcstoul
msvcrt.dll	809		_ultow
msvcrt.dll	1239		tolower
msvcrt.dll	1120		iswctype
msvcrt.dll	913		_wcstoui64
msvcrt.dll	1114		isspace
msvcrt.dll	246		_errno
msvcrt.dll	1105		isalnum
msvcrt.dll	1284		wcstok
msvcrt.dll	1147		mbstowcs
msvcrt.dll	83		__C_specific_handler
msvcrt.dll	1263		wcschr
msvcrt.dll	1278		wcsrchr
msvcrt.dll	1154		memmove
msvcrt.dll	889		_wcsicmp
msvcrt.dll	856		_vsnwprintf
msvcrt.dll	1267		wcscpy_s
msvcrt.dll	1199		strchr
msvcrt.dll	1218		strstr
msvcrt.dll	745		_stricmp
msvcrt.dll	850		_vsnprintf
msvcrt.dll	1287		wcstombs
msvcrt.dll	1282		wcsstr
msvcrt.dll	1226		swprintf_s
msvcrt.dll	1275		wcsncpy_s
msvcrt.dll	1273		wcsncmp
msvcrt.dll	1228		swscanf_s
msvcrt.dll	899		_wcsnicmp
msvcrt.dll	1156		memset
msvcrt.dll	1262		wcscat_s
msvcrt.dll	1151		memcmp
ntdll.dll	636		RtlCaptureContext
ntdll.dll	1027		RtlLookupFunctionEntry
ntdll.dll	1266		RtlVirtualUnwind
ntdll.dll	1137		RtlRunOnceExecuteOnce
ntdll.dll	123		LdrLoadDll
ntdll.dll	116		LdrGetProcedureAddress
ntdll.dll	149		LdrUnloadDll
ntdll.dll	1135		RtlRunOnceBeginInitialize
ntdll.dll	917		RtlImageNtHeader
ntdll.dll	432		NtQueryValueKey
ntdll.dll	403		NtQueryInformationToken
ntdll.dll	357		NtOpenProcessToken
ntdll.dll	215		NtClose
ntdll.dll	348		NtOpenKey
ntdll.dll	59		EtwEventWriteEx
ntdll.dll	32		DbgPrint
ntdll.dll	842		RtlFreeAnsiString
ntdll.dll	863		RtlGetCurrentTransaction
ntdll.dll		1
ntdll.dll	1004		RtlLeaveCriticalSection
ntdll.dll	786		RtlEnterCriticalSection
ntdll.dll	995		RtlIsTextUnicode
ntdll.dll	1007		RtlLengthSid
ntdll.dll	684		RtlCopyUnicodeString
ntdll.dll	1055		RtlOemStringToUnicodeString
ntdll.dll	1231		RtlUnicodeToMultiByteSize
ntdll.dll	1224		RtlUnicodeStringToAnsiString
ntdll.dll	769		RtlDosPathNameToNtPathName_U
ntdll.dll	614		RtlAllocateHeap
ntdll.dll	1046		RtlNtStatusToDosError
ntdll.dll	849		RtlFreeUnicodeString
ntdll.dll	923		RtlInitAnsiString
ntdll.dll	932		RtlInitUnicodeString
ntdll.dll	844		RtlFreeHeap
ntdll.dll	619		RtlAnsiStringToUnicodeString
ntdll.dll	939		RtlInitializeCriticalSection
ntdll.dll	163		NlsMbCodePageTag
ntdll.dll	1326		RtlxUnicodeStringToAnsiSize
ntdll.dll	1029		RtlMakeSelfRelativeSD
ntdll.dll	365		NtOpenThreadToken
ntdll.dll	501		NtSetInformationThread
ntdll.dll	1324		RtlxAnsiStringToUnicodeSize
ntdll.dll	933		RtlInitUnicodeStringEx
ntdll.dll	429		NtQuerySystemTime
ntdll.dll	1098		RtlRandom
ntdll.dll	1197		RtlSubAuthoritySid
ntdll.dll	681		RtlCopySid
ntdll.dll	902		RtlGetThreadPreferredUILanguages
ntdll.dll	1196		RtlSubAuthorityCountSid
ntdll.dll	889		RtlGetNtProductType
ntdll.dll	668		RtlConvertSidToUnicodeString
ntdll.dll	1226		RtlUnicodeStringToInteger
ntdll.dll	998		RtlIsValidIndexHandle
ntdll.dll	613		RtlAllocateHandle
ntdll.dll	843		RtlFreeHandle
ntdll.dll	847		RtlFreeSid
ntdll.dll	799		RtlEqualSid
ntdll.dll	502		NtSetInformationToken
ntdll.dll	588		RtlAddAccessAllowedAceEx
ntdll.dll	277		NtDuplicateToken
ntdll.dll	221		NtCompareTokens
ntdll.dll	612		RtlAllocateAndInitializeSid
ntdll.dll	793		RtlEnumerateGenericTableWithoutSplaying
ntdll.dll	702		RtlCreateSecurityDescriptor
ntdll.dll	990		RtlIsGenericTableEmpty
ntdll.dll	1166		RtlSetOwnerSecurityDescriptor
ntdll.dll	410		NtQueryKey
ntdll.dll	879		RtlGetLastNtStatus
ntdll.dll	811		RtlExpandEnvironmentStrings_U
ntdll.dll	711		RtlCreateUnicodeString
ntdll.dll	272		NtDeviceIoControlFile
ntdll.dll	400		NtQueryInformationProcess
ntdll.dll	778		RtlDuplicateUnicodeString
ntdll.dll	345		NtOpenFile
ntdll.dll	55		EtwEventRegister
ntdll.dll	57		EtwEventWrite
ntdll.dll	624		RtlAppendUnicodeToString
ntdll.dll	235		NtCreateKey
ntdll.dll	737		RtlDeleteElementGenericTable
ntdll.dll	524		NtSetValueKey
ntdll.dll	268		NtDeleteKey
ntdll.dll	952		RtlInsertElementGenericTable
ntdll.dll	1195		RtlStringFromGUID
ntdll.dll	281		NtEnumerateKey
ntdll.dll	945		RtlInitializeHandleTable
ntdll.dll	960		RtlIntegerToUnicodeString
ntdll.dll	623		RtlAppendUnicodeStringToString
ntdll.dll	56		EtwEventUnregister
ntdll.dll	838		RtlFormatCurrentUserKeyPath
ntdll.dll	756		RtlDestroyHandleTable
ntdll.dll	1049		RtlNumberGenericTableElements
ntdll.dll	1088		RtlQueryRegistryValues
ntdll.dll	1022		RtlLookupElementGenericTable
ntdll.dll	943		RtlInitializeGenericTable
ntdll.dll	1261		RtlValidSid
ntdll.dll	851		RtlGUIDFromString
ntdll.dll	1244		RtlUpcaseUnicodeChar
ntdll.dll	763		RtlDetermineDosPathNameType_U
ntdll.dll	363		NtOpenSymbolicLinkObject
ntdll.dll	424		NtQuerySymbolicLinkObject
ntdll.dll	397		NtQueryInformationFile
ntdll.dll	434		NtQueryVolumeInformationFile
ntdll.dll	1063		RtlPrefixUnicodeString
ntdll.dll	873		RtlGetFullPathName_U
ntdll.dll	617		RtlAnsiCharToUnicodeChar
ntdll.dll	1230		RtlUnicodeToMultiByteN
ntdll.dll	1047		RtlNtStatusToDosErrorNoTeb
ntdll.dll	1034		RtlMultiByteToUnicodeN
ntdll.dll	765		RtlDllShutdownInProgress
ntdll.dll	489		NtSetEvent
ntdll.dll	537		NtTerminateThread
ntdll.dll	557		NtWaitForSingleObject
ntdll.dll	229		NtCreateEvent
ntdll.dll	1163		RtlSetLastWin32Error
ntdll.dll	771		RtlDosPathNameToRelativeNtPathName_U
ntdll.dll	231		NtCreateFile
ntdll.dll	1113		RtlReleaseRelativeName
ntdll.dll	809		RtlExitUserThread
ntdll.dll	555		NtWaitForMultipleObjects
ntdll.dll	214		NtClearEvent
ntdll.dll	1107		RtlRegisterThreadWithCsrss
ntdll.dll	263		NtDelayExecution
ntdll.dll	210		NtCancelIoFile
ntdll.dll	276		NtDuplicateObject
ntdll.dll	76		EtwSendNotification
ntdll.dll	516		NtSetSystemInformation
ntdll.dll	541		NtTraceControl
ntdll.dll	50		EtwDeliverDataBlock
ntdll.dll	51		EtwEnumerateProcessRegGuids
ntdll.dll	1083		RtlQueryPerformanceFrequency
ntdll.dll	427		NtQuerySystemInformation
ntdll.dll	961		RtlInterlockedClearBitRun
ntdll.dll	1092		RtlQueryTimeZoneInformation
ntdll.dll	936		RtlInitializeBitMap
ntdll.dll	417		NtQueryPerformanceCounter
ntdll.dll	84		EtwpGetCpuSpeed
ntdll.dll	885		RtlGetNativeSystemInformation
ntdll.dll	685		RtlCreateAcl
ntdll.dll	71		EtwProcessPrivateLoggerRequest
ntdll.dll	761		RtlDestroyQueryDebugBuffer
ntdll.dll	921		RtlImpersonateSelf
ntdll.dll	610		RtlAdjustPrivilege
ntdll.dll	1085		RtlQueryProcessDebugInformation
ntdll.dll	542		NtTraceEvent
ntdll.dll	700		RtlCreateQueryDebugBuffer
ntdll.dll	1076		RtlQueryHeapInformation
ntdll.dll	972		RtlIpv4AddressToStringW
ntdll.dll	371		NtPowerInformation
ntdll.dll	980		RtlIpv6AddressToStringW
ntdll.dll	924		RtlInitAnsiStringEx
ntdll.dll	712		RtlCreateUnicodeStringFromAsciiz
ntdll.dll	655		RtlCompareUnicodeString
ntdll.dll	456		NtRenameKey
ntdll.dll	324		NtLoadKeyEx
ntdll.dll	591		RtlAddAccessDeniedAceEx
ntdll.dll	593		RtlAddAce
ntdll.dll	1153		RtlSetDaclSecurityDescriptor
ntdll.dll	834		RtlFirstFreeAce
ntdll.dll	1258		RtlValidAcl
ntdll.dll	599		RtlAddAuditAccessObjectAce
ntdll.dll	896		RtlGetSaclSecurityDescriptor
ntdll.dll	592		RtlAddAccessDeniedObjectAce
ntdll.dll	1159		RtlSetGroupSecurityDescriptor
ntdll.dll	877		RtlGetGroupSecurityDescriptor
ntdll.dll	1170		RtlSetSaclSecurityDescriptor
ntdll.dll	857		RtlGetControlSecurityDescriptor
ntdll.dll	576		RtlAbsoluteToSelfRelativeSD
ntdll.dll	589		RtlAddAccessAllowedObjectAce
ntdll.dll	865		RtlGetDaclSecurityDescriptor
ntdll.dll	951		RtlInitializeSid
ntdll.dll	891		RtlGetOwnerSecurityDescriptor
ntdll.dll	598		RtlAddAuditAccessAceEx
ntdll.dll	1204		RtlTimeToSecondsSince1970
ntdll.dll	683		RtlCopyString
ntdll.dll	583		RtlAcquireSRWLockShared
ntdll.dll	402		NtQueryInformationThread
ntdll.dll	801		RtlEqualUnicodeString
ntdll.dll	582		RtlAcquireSRWLockExclusive
ntdll.dll	413		NtQueryMutant
ntdll.dll	1115		RtlReleaseSRWLockExclusive
ntdll.dll	414		NtQueryObject
ntdll.dll	201		NtAlpcQueryInformation
ntdll.dll	950		RtlInitializeSRWLock
ntdll.dll	1116		RtlReleaseSRWLockShared
ntdll.dll	587		RtlAddAccessAllowedAce
ntdll.dll	1057		RtlOpenCurrentUser
ntdll.dll	412		NtQueryMultipleValueKey
ntdll.dll	1259		RtlValidRelativeSecurityDescriptor
ntdll.dll	458		NtReplaceKey
ntdll.dll	477		NtSaveMergedKeys
ntdll.dll	475		NtSaveKey
ntdll.dll	422		NtQuerySecurityObject
ntdll.dll	909		RtlGetVersion
ntdll.dll	68		EtwLogTraceEvent
ntdll.dll	1100		RtlReAllocateHeap
ntdll.dll	562		NtWriteFile
ntdll.dll	439		NtReadFile
ntdll.dll	1260		RtlValidSecurityDescriptor
ntdll.dll	1006		RtlLengthSecurityDescriptor
ntdll.dll	349		NtOpenKeyEx
ntdll.dll	497		NtSetInformationKey
ntdll.dll	736		RtlDeleteCriticalSection
KERNELBASE.dll	138		EnumUILanguagesW
KERNELBASE.dll	332		GetUserDefaultUILanguage
KERNELBASE.dll	306		GetSystemDefaultUILanguage
KERNELBASE.dll	27		AreFileApisANSI
API-MS-WIN-Service-Core-L1-1-0.dll	2		StartServiceCtrlDispatcherW
API-MS-WIN-Service-Core-L1-1-0.dll	1		SetServiceStatus
API-MS-WIN-Service-Core-L1-1-0.dll			RegisterServiceCtrlHandlerExW
API-MS-WIN-Service-winsvc-L1-1-0.dll	11		I_ScRpcBindW
API-MS-WIN-Service-winsvc-L1-1-0.dll	18		QueryServiceConfig2A
API-MS-WIN-Service-winsvc-L1-1-0.dll	2		ControlService
API-MS-WIN-Service-winsvc-L1-1-0.dll	23		RegisterServiceCtrlHandlerW
API-MS-WIN-Service-winsvc-L1-1-0.dll	19		QueryServiceConfigA
API-MS-WIN-Service-winsvc-L1-1-0.dll	16		OpenSCManagerA
API-MS-WIN-Service-winsvc-L1-1-0.dll	20		QueryServiceStatus
API-MS-WIN-Service-winsvc-L1-1-0.dll	22		RegisterServiceCtrlHandlerExA
API-MS-WIN-Service-winsvc-L1-1-0.dll	1		ChangeServiceConfigA
API-MS-WIN-Service-winsvc-L1-1-0.dll	24		StartServiceA
API-MS-WIN-Service-winsvc-L1-1-0.dll	4		CreateServiceA
API-MS-WIN-Service-winsvc-L1-1-0.dll	21		RegisterServiceCtrlHandlerA
API-MS-WIN-Service-winsvc-L1-1-0.dll	15		NotifyServiceStatusChangeA
API-MS-WIN-Service-winsvc-L1-1-0.dll	3		ControlServiceExA
API-MS-WIN-Service-winsvc-L1-1-0.dll			ChangeServiceConfig2A
API-MS-WIN-Service-winsvc-L1-1-0.dll	25		StartServiceCtrlDispatcherA
API-MS-WIN-Service-winsvc-L1-1-0.dll	17		OpenServiceA
API-MS-WIN-Service-winsvc-L1-1-0.dll	10		I_ScRpcBindA
API-MS-WIN-Service-Management-L1-1-0.dll			CloseServiceHandle
API-MS-WIN-Service-Management-L1-1-0.dll	1		ControlServiceExW
API-MS-WIN-Service-Management-L1-1-0.dll	5		OpenServiceW
API-MS-WIN-Service-Management-L1-1-0.dll	3		DeleteService
API-MS-WIN-Service-Management-L1-1-0.dll	4		OpenSCManagerW
API-MS-WIN-Service-Management-L1-1-0.dll	2		CreateServiceW
API-MS-WIN-Service-Management-L1-1-0.dll	6		StartServiceW
API-MS-WIN-Service-Management-L2-1-0.dll	5		QueryServiceObjectSecurity
API-MS-WIN-Service-Management-L2-1-0.dll	2		NotifyServiceStatusChangeW
API-MS-WIN-Service-Management-L2-1-0.dll	7		SetServiceObjectSecurity
API-MS-WIN-Service-Management-L2-1-0.dll	3		QueryServiceConfig2W
API-MS-WIN-Service-Management-L2-1-0.dll			ChangeServiceConfig2W
API-MS-WIN-Service-Management-L2-1-0.dll	1		ChangeServiceConfigW
API-MS-WIN-Service-Management-L2-1-0.dll	6		QueryServiceStatusEx
API-MS-WIN-Service-Management-L2-1-0.dll	4		QueryServiceConfigW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	18		RegLoadKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	16		RegGetValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	27		RegQueryInfoKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	8		RegDeleteValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	7		RegDeleteValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	6		RegDeleteTreeW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	12		RegEnumValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	25		RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	17		RegGetValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	23		RegOpenCurrentUser
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	13		RegEnumValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	35		RegSetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	22		RegNotifyChangeKeyValue
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	14		RegFlushKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	11		RegEnumKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll			RegCloseKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	32		RegRestoreKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	26		RegOpenUserClassesRoot
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	4		RegDeleteKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	38		RegUnLoadKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	31		RegRestoreKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	5		RegDeleteTreeA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	36		RegSetValueExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	2		RegCreateKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	29		RegQueryValueExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	28		RegQueryInfoKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	10		RegEnumKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	21		RegLoadMUIStringW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	33		RegSaveKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	1		RegCreateKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	20		RegLoadMUIStringA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	24		RegOpenKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	34		RegSaveKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	15		RegGetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	3		RegDeleteKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	9		RegDisablePredefinedCacheEx
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	19		RegLoadKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	37		RegSetValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	39		RegUnLoadKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	30		RegQueryValueExW
API-MS-Win-Core-NamedPipe-L1-1-0.dll	6		ImpersonateNamedPipeClient
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	5		CreateThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	12		GetCurrentThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	42		TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	11		GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	13		GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	27		OpenThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	10		GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	1		CreateProcessAsUserW
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	39		SetThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	28		OpenThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	26		OpenProcessToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	16		GetPriorityClass
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	17		GetProcessId
API-MS-Win-Security-Base-L1-1-0.dll	61		ImpersonateLoggedOnUser
API-MS-Win-Security-Base-L1-1-0.dll	72		MakeAbsoluteSD
API-MS-Win-Security-Base-L1-1-0.dll	86		SetKernelObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	63		InitializeAcl
API-MS-Win-Security-Base-L1-1-0.dll	21		AllocateLocallyUniqueId
API-MS-Win-Security-Base-L1-1-0.dll	20		AllocateAndInitializeSid
API-MS-Win-Security-Base-L1-1-0.dll	93		SetSecurityDescriptorOwner
API-MS-Win-Security-Base-L1-1-0.dll	68		IsValidRelativeSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll	51		GetSecurityDescriptorOwner
API-MS-Win-Security-Base-L1-1-0.dll	7		AddAccessAllowedAce
API-MS-Win-Security-Base-L1-1-0.dll	83		RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll	40		FreeSid
API-MS-Win-Security-Base-L1-1-0.dll	55		GetSidLengthRequired
API-MS-Win-Security-Base-L1-1-0.dll	65		InitializeSid
API-MS-Win-Security-Base-L1-1-0.dll	13		AddAce
API-MS-Win-Security-Base-L1-1-0.dll	53		GetSecurityDescriptorSacl
API-MS-Win-Security-Base-L1-1-0.dll	60		ImpersonateAnonymousToken
API-MS-Win-Security-Base-L1-1-0.dll	35		DuplicateTokenEx
API-MS-Win-Security-Base-L1-1-0.dll	69		IsValidSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll	45		GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll	11		AddAccessDeniedAceEx
API-MS-Win-Security-Base-L1-1-0.dll	24		CheckTokenMembership
API-MS-Win-Security-Base-L1-1-0.dll	95		SetSecurityDescriptorSacl
API-MS-Win-Security-Base-L1-1-0.dll	23		AreAnyAccessesGranted
API-MS-Win-Security-Base-L1-1-0.dll	19		AdjustTokenPrivileges
API-MS-Win-Security-Base-L1-1-0.dll	59		GetWindowsAccountDomainSid
API-MS-Win-Security-Base-L1-1-0.dll	29		CreatePrivateObjectSecurityWithMultipleInheritance
API-MS-Win-Security-Base-L1-1-0.dll	39		FindFirstFreeAce
API-MS-Win-Security-Base-L1-1-0.dll	25		ConvertToAutoInheritPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	87		SetPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	36		EqualDomainSid
API-MS-Win-Security-Base-L1-1-0.dll	49		GetSecurityDescriptorGroup
API-MS-Win-Security-Base-L1-1-0.dll	48		GetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll	31		CreateWellKnownSid
API-MS-Win-Security-Base-L1-1-0.dll	82		QuerySecurityAccessMask
API-MS-Win-Security-Base-L1-1-0.dll	73		MakeAbsoluteSD2
API-MS-Win-Security-Base-L1-1-0.dll	28		CreatePrivateObjectSecurityEx
API-MS-Win-Security-Base-L1-1-0.dll	50		GetSecurityDescriptorLength
API-MS-Win-Security-Base-L1-1-0.dll	62		ImpersonateSelf
API-MS-Win-Security-Base-L1-1-0.dll	41		GetAce
API-MS-Win-Security-Base-L1-1-0.dll	4		AccessCheckByTypeResultList
API-MS-Win-Security-Base-L1-1-0.dll	27		CreatePrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	91		SetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll	66		IsTokenRestricted
API-MS-Win-Security-Base-L1-1-0.dll	16		AddAuditAccessObjectAce
API-MS-Win-Security-Base-L1-1-0.dll	18		AdjustTokenGroups
API-MS-Win-Security-Base-L1-1-0.dll	10		AddAccessDeniedAce
API-MS-Win-Security-Base-L1-1-0.dll	22		AreAllAccessesGranted
API-MS-Win-Security-Base-L1-1-0.dll	74		MakeSelfRelativeSD
API-MS-Win-Security-Base-L1-1-0.dll	96		SetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll	70		IsValidSid
API-MS-Win-Security-Base-L1-1-0.dll	3		AccessCheckByTypeAndAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	1		AccessCheckAndAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	5		AccessCheckByTypeResultListAndAuditAlarmByHandleW
API-MS-Win-Security-Base-L1-1-0.dll	26		CopySid
API-MS-Win-Security-Base-L1-1-0.dll	77		ObjectDeleteAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	43		GetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll	85		SetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll	76		ObjectCloseAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	79		ObjectPrivilegeAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	78		ObjectOpenAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	6		AccessCheckByTypeResultListAndAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	81		PrivilegedServiceAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	58		GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll	33		DestroyPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	54		GetSidIdentifierAuthority
API-MS-Win-Security-Base-L1-1-0.dll	84		SetAclInformation
API-MS-Win-Security-Base-L1-1-0.dll	67		IsValidAcl
API-MS-Win-Security-Base-L1-1-0.dll	56		GetSidSubAuthority
API-MS-Win-Security-Base-L1-1-0.dll	71		IsWellKnownSid
API-MS-Win-Security-Base-L1-1-0.dll	89		SetSecurityAccessMask
API-MS-Win-Security-Base-L1-1-0.dll	15		AddAuditAccessAceEx
API-MS-Win-Security-Base-L1-1-0.dll	90		SetSecurityDescriptorControl
API-MS-Win-Security-Base-L1-1-0.dll	32		DeleteAce
API-MS-Win-Security-Base-L1-1-0.dll	92		SetSecurityDescriptorGroup
API-MS-Win-Security-Base-L1-1-0.dll	75		MapGenericMask
API-MS-Win-Security-Base-L1-1-0.dll	57		GetSidSubAuthorityCount
API-MS-Win-Security-Base-L1-1-0.dll	94		SetSecurityDescriptorRMControl
API-MS-Win-Security-Base-L1-1-0.dll	52		GetSecurityDescriptorRMControl
API-MS-Win-Security-Base-L1-1-0.dll	8		AddAccessAllowedAceEx
API-MS-Win-Security-Base-L1-1-0.dll	44		GetKernelObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll			AccessCheck
API-MS-Win-Security-Base-L1-1-0.dll	42		GetAclInformation
API-MS-Win-Security-Base-L1-1-0.dll	30		CreateRestrictedToken
API-MS-Win-Security-Base-L1-1-0.dll	47		GetSecurityDescriptorControl
API-MS-Win-Security-Base-L1-1-0.dll	38		EqualSid
API-MS-Win-Security-Base-L1-1-0.dll	88		SetPrivateObjectSecurityEx
API-MS-Win-Security-Base-L1-1-0.dll	14		AddAuditAccessAce
API-MS-Win-Security-Base-L1-1-0.dll	2		AccessCheckByType
API-MS-Win-Security-Base-L1-1-0.dll	9		AddAccessAllowedObjectAce
API-MS-Win-Security-Base-L1-1-0.dll	12		AddAccessDeniedObjectAce
API-MS-Win-Security-Base-L1-1-0.dll	37		EqualPrefixSid
API-MS-Win-Security-Base-L1-1-0.dll	80		PrivilegeCheck
API-MS-Win-Security-Base-L1-1-0.dll	34		DuplicateToken
API-MS-Win-Security-Base-L1-1-0.dll	46		GetPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	64		InitializeSecurityDescriptor
KERNEL32.dll	469		GetDiskFreeSpaceExW
KERNEL32.dll	961		ReadFile
KERNEL32.dll	573		GetOverlappedResult
KERNEL32.dll	1275		VirtualAllocEx
KERNEL32.dll	1277		VirtualFree
KERNEL32.dll	898		OpenProcess
KERNEL32.dll	367		GetActiveProcessorCount
KERNEL32.dll	713		GlobalMemoryStatusEx
KERNEL32.dll	633		GetSystemInfo
KERNEL32.dll	474		GetDriveTypeW
KERNEL32.dll	524		GetLogicalDriveStringsW
KERNEL32.dll	642		GetSystemWindowsDirectoryW
KERNEL32.dll	225		DeviceIoControl
KERNEL32.dll	687		GetVolumeInformationW
KERNEL32.dll	405		GetComputerNameW
KERNEL32.dll	733		HeapSize
KERNEL32.dll	1019		ReleaseMutex
KERNEL32.dll	290		ExpandEnvironmentStringsA
KERNEL32.dll	985		RegKrnInitialize
KERNEL32.dll	536		GetModuleFileNameW
KERNEL32.dll	849		LocalUnlock
KERNEL32.dll	845		LocalLock
KERNEL32.dll	402		GetComputerNameA
KERNEL32.dll	238		EncodePointer
KERNEL32.dll	159		CreateMutexW
KERNEL32.dll	1127		SetEvent
KERNEL32.dll	964		ReadProcessMemory
KERNEL32.dll	361		FreeLibraryAndExitThread
KERNEL32.dll	203		DecodePointer
KERNEL32.dll	236		DuplicateHandle
KERNEL32.dll	833		LoadLibraryExW
KERNEL32.dll	748		InitializeCriticalSection
KERNEL32.dll	1215		SizeofResource
KERNEL32.dll	854		LockResource
KERNEL32.dll	156		CreateMutexA
KERNEL32.dll	731		HeapReAlloc
KERNEL32.dll	637		GetSystemTime
KERNEL32.dll	577		GetPrivateProfileIntW
KERNEL32.dll	1041		ResetEvent
KERNEL32.dll	297		FileTimeToDosDateTime
KERNEL32.dll	232		DosDateTimeToFileTime
KERNEL32.dll	501		GetFileSize
KERNEL32.dll	503		GetFileTime
KERNEL32.dll	1126		SetErrorMode
KERNEL32.dll	314		FindFirstFileExW
KERNEL32.dll	118		CopyFileW
KERNEL32.dll	1137		SetFileInformationByHandle
KERNEL32.dll	331		FindNextFileW
KERNEL32.dll	1369		lstrcmpiA
KERNEL32.dll	540		GetModuleHandleW
KERNEL32.dll	1151		SetLastError
KERNEL32.dll	839		LocalAlloc
KERNEL32.dll	843		LocalFree
KERNEL32.dll	1314		WideCharToMultiByte
KERNEL32.dll	846		LocalReAlloc
KERNEL32.dll	873		MultiByteToWideChar
KERNEL32.dll	1379		lstrlenW
KERNEL32.dll	404		GetComputerNameExW
KERNEL32.dll	166		CreateProcessInternalA
KERNEL32.dll	586		GetProcAddress
KERNEL32.dll	831		LoadLibraryA
KERNEL32.dll	83		CloseHandle
KERNEL32.dll	360		FreeLibrary
KERNEL32.dll	834		LoadLibraryW
KERNEL32.dll	828		LeaveCriticalSection
KERNEL32.dll	518		GetLastError
KERNEL32.dll	242		EnterCriticalSection
KERNEL32.dll	984		RegKrnGetGlobalState
KERNEL32.dll	512		GetFullPathNameW
KERNEL32.dll	1066		SearchPathW
KERNEL32.dll	724		HeapAlloc
KERNEL32.dll	728		HeapFree
KERNEL32.dll	1219		SleepEx
KERNEL32.dll	665		GetTickCount
KERNEL32.dll	591		GetProcessHeap
KERNEL32.dll	495		GetFileAttributesW
KERNEL32.dll	144		CreateFileW
KERNEL32.dll	832		LoadLibraryExA
KERNEL32.dll	207		DelayLoadFailureHook
KERNEL32.dll	1252		UnhandledExceptionFilter
KERNEL32.dll	1202		SetUnhandledExceptionFilter
KERNEL32.dll	935		QueryPerformanceCounter
KERNEL32.dll	639		GetSystemTimeAsFileTime
KERNEL32.dll	134		CreateEventW
KERNEL32.dll	1049		RtlCompareMemory
KERNEL32.dll	664		GetThreadUILanguage
KERNEL32.dll	397		GetCommandLineW
KERNEL32.dll	1367		lstrcmpW
KERNEL32.dll	1370		lstrcmpiW
KERNEL32.dll	539		GetModuleHandleExW
KERNEL32.dll	1216		Sleep
KERNEL32.dll	1139		SetFilePointer
KERNEL32.dll	906		OutputDebugStringW
KERNEL32.dll	1334		WriteFile
KERNEL32.dll	356		FormatMessageW
KERNEL32.dll	519		GetLocalTime
KERNEL32.dll	492		GetFileAttributesExW
KERNEL32.dll	215		DeleteFileW
KERNEL32.dll	291		ExpandEnvironmentStringsW
KERNEL32.dll	630		GetSystemDirectoryW
KERNEL32.dll	857		MapViewOfFile
KERNEL32.dll	1255		UnmapViewOfFile
KERNEL32.dll	97		CompareFileTime
KERNEL32.dll	502		GetFileSizeEx
KERNEL32.dll	531		GetLongPathNameW
KERNEL32.dll	141		CreateFileMappingW
KERNEL32.dll	339		FindResourceExW
KERNEL32.dll	836		LoadResource
KERNEL32.dll	691		GetVolumePathNameW
KERNEL32.dll	210		DeleteCriticalSection
KERNEL32.dll	1290		WaitForSingleObject
KERNEL32.dll	500		GetFileMUIPath
KERNEL32.dll	308		FindClose
KERNEL32.dll	1278		VirtualFreeEx
KERNEL32.dll	509		GetFullPathNameA
RPCRT4.dll	353		RpcBindingBind
RPCRT4.dll	515		UuidCreate
RPCRT4.dll	391		RpcEpResolveBinding
RPCRT4.dll	372		RpcBindingSetAuthInfoA
RPCRT4.dll	81		I_RpcSNCHOption
RPCRT4.dll	149		NdrClientCall2
RPCRT4.dll	520		UuidFromStringW
RPCRT4.dll	524		UuidToStringW
RPCRT4.dll	402		RpcExceptionFilter
RPCRT4.dll	375		RpcBindingSetAuthInfoW
RPCRT4.dll	491		RpcSsDestroyClientContext
RPCRT4.dll	61		I_RpcMapWin32Status
RPCRT4.dll	43		I_RpcExceptionFilter
RPCRT4.dll	150		NdrClientCall3
RPCRT4.dll	374		RpcBindingSetAuthInfoExW
RPCRT4.dll	373		RpcBindingSetAuthInfoExA
RPCRT4.dll	506		RpcStringFreeW
RPCRT4.dll	357		RpcBindingFree
RPCRT4.dll	502		RpcStringBindingComposeW
RPCRT4.dll	359		RpcBindingFromStringBindingW
RPCRT4.dll	356		RpcBindingCreateW

ord	entry_va	function_name
1000	0x45fd0
1001	0x42c90	I_ScGetCurrentGroupStateW
1002	0x97dde	A_SHAFinal
1003	0x97def	A_SHAInit
1004	0x97dff	A_SHAUpdate
1005	0x68cb0	AbortSystemShutdownA
1006	0x63500	AbortSystemShutdownW
1007	0x14270	AccessCheck
1008	0x54f50	AccessCheckAndAuditAlarmA
1009	0x3bea8	AccessCheckAndAuditAlarmW
1010	0xa280	AccessCheckByType
1011	0x54d70	AccessCheckByTypeAndAuditAlarmA
1012	0x3be00	AccessCheckByTypeAndAuditAlarmW
1013	0x3bd94	AccessCheckByTypeResultList
1014	0x54b90	AccessCheckByTypeResultListAndAuditAlarmA
1015	0x549a0	AccessCheckByTypeResultListAndAuditAlarmByHandleA
1016	0x3bce0	AccessCheckByTypeResultListAndAuditAlarmByHandleW
1017	0x3bc2c	AccessCheckByTypeResultListAndAuditAlarmW
1018	0x1de2c	AddAccessAllowedAce
1019	0x14220	AddAccessAllowedAceEx
1020	0x3bbf4	AddAccessAllowedObjectAce
1021	0x3bbe8	AddAccessDeniedAce
1022	0x3bbc8	AddAccessDeniedAceEx
1023	0x3bb90	AddAccessDeniedObjectAce
1024	0xd920	AddAce
1025	0x10c0	AddAuditAccessAce
1026	0x3bb5c	AddAuditAccessAceEx
1027	0x3bb08	AddAuditAccessObjectAce
1028	0x40498	AddConditionalAce
1029	0x97e11	AddMandatoryAce
1030	0x61460	AddUsersToEncryptedFile
1031	0x613d0	AddUsersToEncryptedFileEx
1032	0x3bae0	AdjustTokenGroups
1033	0x1e3a0	AdjustTokenPrivileges
1034	0x1dfec	AllocateAndInitializeSid
1035	0x10a4	AllocateLocallyUniqueId
1036	0x3bacc	AreAllAccessesGranted
1037	0x3bac0	AreAnyAccessesGranted
1038	0xa4f0	AuditComputeEffectivePolicyBySid
1039	0x60d30	AuditComputeEffectivePolicyByToken
1040	0x53ac0	AuditEnumerateCategories
1041	0x49a60	AuditEnumeratePerUserPolicy
1042	0xa790	AuditEnumerateSubCategories
1043	0x1f2d0	AuditFree
1044	0x499b0	AuditLookupCategoryGuidFromCategoryId
1045	0x499f0	AuditLookupCategoryIdFromCategoryGuid
1046	0x60ca0	AuditLookupCategoryNameA
1047	0x53980	AuditLookupCategoryNameW
1048	0x60c10	AuditLookupSubCategoryNameA
1049	0x53860	AuditLookupSubCategoryNameW
1050	0x3d868	AuditQueryGlobalSaclA
1051	0x3d920	AuditQueryGlobalSaclW
1052	0x49ac0	AuditQueryPerUserPolicy
1053	0x49910	AuditQuerySecurity
1054	0xa450	AuditQuerySystemPolicy
1055	0x3d984	AuditSetGlobalSaclA
1056	0xa5cc	AuditSetGlobalSaclW
1057	0x49b60	AuditSetPerUserPolicy
1058	0x53760	AuditSetSecurity
1059	0xa710	AuditSetSystemPolicy
1060	0x67e00	BackupEventLogA
1061	0x620e0	BackupEventLogW
1062	0x1c70	BuildExplicitAccessWithNameA
1063	0x1c70	BuildExplicitAccessWithNameW
1064	0x458b0	BuildImpersonateExplicitAccessWithNameA
1065	0x458b0	BuildImpersonateExplicitAccessWithNameW
1066	0x45590	BuildImpersonateTrusteeA
1067	0x45590	BuildImpersonateTrusteeW
1068	0x65a50	BuildSecurityDescriptorA
1069	0x8390	BuildSecurityDescriptorW
1070	0x1ca0	BuildTrusteeWithNameA
1071	0x1ca0	BuildTrusteeWithNameW
1072	0x45470	BuildTrusteeWithObjectsAndNameA
1073	0x45470	BuildTrusteeWithObjectsAndNameW
1074	0x454c0	BuildTrusteeWithObjectsAndSidA
1075	0x454c0	BuildTrusteeWithObjectsAndSidW
1076	0x45570	BuildTrusteeWithSidA
1077	0x45570	BuildTrusteeWithSidW
1078	0x50e70	CancelOverlappedAccess
1079	0x3bab4	ChangeServiceConfig2A
1080	0x3baa8	ChangeServiceConfig2W
1081	0x3ba3c	ChangeServiceConfigA
1082	0x3b9d0	ChangeServiceConfigW
1083	0x10510	CheckTokenMembership
1084	0x67e70	ClearEventLogA
1085	0x62260	ClearEventLogW
1086	0x23d10	CloseCodeAuthzLevel
1087	0x4a690	CloseEncryptedFileRaw
1088	0x9210	CloseEventLog
1089	0x1adc4	CloseServiceHandle
1090	0x3eed0	CloseThreadWaitChainSession
1091	0x139a0	CloseTrace
1092	0x74d70	CommandLineFromMsiDescriptor
1093	0x23e00	ComputeAccessTokenFromCodeAuthzLevel
1094	0x25668	ControlService
1095	0x3b9c0	ControlServiceExA
1096	0x3b9a8	ControlServiceExW
1097	0x63b70	ControlTraceA
1098	0x12750	ControlTraceW
1099	0x5d020	ConvertAccessToSecurityDescriptorA
1100	0x51170	ConvertAccessToSecurityDescriptorW
1101	0x74910	ConvertSDToStringSDRootDomainA
1102	0x748a0	ConvertSDToStringSDRootDomainW
1103	0x65500	ConvertSecurityDescriptorToAccessA
1104	0x65500	ConvertSecurityDescriptorToAccessNamedA
1105	0x5cde0	ConvertSecurityDescriptorToAccessNamedW
1106	0x5cde0	ConvertSecurityDescriptorToAccessW
1107	0x745a0	ConvertSecurityDescriptorToStringSecurityDescriptorA
1108	0x53c0	ConvertSecurityDescriptorToStringSecurityDescriptorW
1109	0x4cf20	ConvertSidToStringSidA
1110	0x1de80	ConvertSidToStringSidW
1111	0x74370	ConvertStringSDToSDDomainA
1112	0x742b0	ConvertStringSDToSDDomainW
1113	0x744f0	ConvertStringSDToSDRootDomainA
1114	0x74480	ConvertStringSDToSDRootDomainW
1115	0xbcd0	ConvertStringSecurityDescriptorToSecurityDescriptorA
1116	0x14af0	ConvertStringSecurityDescriptorToSecurityDescriptorW
1117	0x20870	ConvertStringSidToSidA
1118	0x20020	ConvertStringSidToSidW
1119	0x3b980	ConvertToAutoInheritPrivateObjectSecurity
1120	0x13ef0	CopySid
1121	0x6a450	CreateCodeAuthzLevel
1122	0x25390	CreatePrivateObjectSecurity
1123	0x120b8	CreatePrivateObjectSecurityEx
1124	0x3b930	CreatePrivateObjectSecurityWithMultipleInheritance
1125	0x4a6f0	CreateProcessAsUserA
1126	0xe780	CreateProcessAsUserW
1127	0x70c10	CreateProcessWithLogonW
1128	0x70ba0	CreateProcessWithTokenW
1129	0x3b8dc	CreateRestrictedToken
1130	0x3b85c	CreateServiceA
1131	0x255c8	CreateServiceW
1132	0x97e2c	CreateTraceInstanceId
1133	0x10890	CreateWellKnownSid
1134	0x6afb0	CredBackupCredentials
1135	0x608f0	CredDeleteA
1136	0x60830	CredDeleteW
1137	0x6ae60	CredEncryptAndMarshalBinaryBlob
1138	0x6dcb0	CredEnumerateA
1139	0x6db80	CredEnumerateW
1140	0x6d630	CredFindBestCredentialA
1141	0x6d520	CredFindBestCredentialW
1142	0x1f2d0	CredFree
1143	0x533f0	CredGetSessionTypes
1144	0x60730	CredGetTargetInfoA
1145	0x60630	CredGetTargetInfoW
1146	0x66bf0	CredIsMarshaledCredentialA
1147	0x66bb0	CredIsMarshaledCredentialW
1148	0x6ac70	CredIsProtectedA
1149	0xf5c0	CredIsProtectedW
1150	0x605d0	CredMarshalCredentialA
1151	0x9e90	CredMarshalCredentialW
1152	0xd760	CredProfileLoaded
1153	0x251c0	CredProfileUnloaded
1154	0x6d2b0	CredProtectA
1155	0x9c60	CredProtectW
1156	0x6def0	CredReadA
1157	0x6d400	CredReadByTokenHandle
1158	0x6d870	CredReadDomainCredentialsA
1159	0x6d740	CredReadDomainCredentialsW
1160	0x6dde0	CredReadW
1161	0x42c70	CredRenameA
1162	0x42c70	CredRenameW
1163	0x6ae90	CredRestoreCredentials
1164	0x60540	CredUnmarshalCredentialA
1165	0xf530	CredUnmarshalCredentialW
1166	0x6acf0	CredUnprotectA
1167	0x89f0	CredUnprotectW
1168	0x6e0b0	CredWriteA
1169	0x6da80	CredWriteDomainCredentialsA
1170	0x6d9a0	CredWriteDomainCredentialsW
1171	0x6e000	CredWriteW
1172	0x6b290	CredpConvertCredential
1173	0x609b0	CredpConvertOneCredentialSize
1174	0x53510	CredpConvertTargetInfo
1175	0x60b50	CredpDecodeCredential
1176	0x60ba0	CredpEncodeCredential
1177	0x66b80	CredpEncodeSecret
1178	0xaf10	CryptAcquireContextA
1179	0x1051c	CryptAcquireContextW
1180	0x3b850	CryptContextAddRef
1181	0x10608	CryptCreateHash
1182	0xd6d0	CryptDecrypt
1183	0x3b830	CryptDeriveKey
1184	0x105f4	CryptDestroyHash
1185	0xe704	CryptDestroyKey
1186	0x3b81c	CryptDuplicateHash
1187	0x3b810	CryptDuplicateKey
1188	0x3b7d0	CryptEncrypt
1189	0x3b7a8	CryptEnumProviderTypesA
1190	0x3b780	CryptEnumProviderTypesW
1191	0x3b758	CryptEnumProvidersA
1192	0x3b730	CryptEnumProvidersW
1193	0xaeb0	CryptExportKey
1194	0x19c8	CryptGenKey
1195	0x107e0	CryptGenRandom
1196	0x3b710	CryptGetDefaultProviderA
1197	0x3b6f0	CryptGetDefaultProviderW
1198	0x10640	CryptGetHashParam
1199	0x3b6d4	CryptGetKeyParam
1200	0x3b6b8	CryptGetProvParam
1201	0x3b6ac	CryptGetUserKey
1202	0x105e0	CryptHashData
1203	0x3b6a0	CryptHashSessionKey
1204	0xe718	CryptImportKey
1205	0x108c0	CryptReleaseContext
1206	0x3b694	CryptSetHashParam
1207	0x3b688	CryptSetKeyParam
1208	0x3b67c	CryptSetProvParam
1209	0x3b670	CryptSetProviderA
1210	0x3b65c	CryptSetProviderExA
1211	0x3b650	CryptSetProviderExW
1212	0x3b644	CryptSetProviderW
1213	0x3b61c	CryptSignHashA
1214	0x3b5f4	CryptSignHashW
1215	0x3b5cc	CryptVerifySignatureA
1216	0xe74c	CryptVerifySignatureW
1217	0x618b0	DecryptFileA
1218	0x61840	DecryptFileW
1219	0x1dfc0	DeleteAce
1220	0x25654	DeleteService
1221	0x1a540	DeregisterEventSource
1222	0x120a4	DestroyPrivateObjectSecurity
1223	0x612c0	DuplicateEncryptionInfoFile
1224	0xfda0	DuplicateToken
1225	0xfd58	DuplicateTokenEx
1226	0x56af0	ElfBackupEventLogFileA
1227	0x57090	ElfBackupEventLogFileW
1228	0x57340	ElfChangeNotify
1229	0x56bb0	ElfClearEventLogFileA
1230	0x57150	ElfClearEventLogFileW
1231	0x9240	ElfCloseEventLog
1232	0x1a570	ElfDeregisterEventSource
1233	0x4ca70	ElfFlushEventLog
1234	0x574c0	ElfNumberOfRecords
1235	0x57410	ElfOldestRecord
1236	0x56c50	ElfOpenBackupEventLogA
1237	0x571f0	ElfOpenBackupEventLogW
1238	0x56d80	ElfOpenEventLogA
1239	0x8f20	ElfOpenEventLogW
1240	0x569b0	ElfReadEventLogA
1241	0x56f50	ElfReadEventLogW
1242	0x27540	ElfRegisterEventSourceA
1243	0x15bf0	ElfRegisterEventSourceW
1244	0x56820	ElfReportEventA
1245	0x427f0	ElfReportEventAndSourceW
1246	0xfe90	ElfReportEventW
1247	0x12d30	EnableTrace
1248	0x12c50	EnableTraceEx
1249	0x12a10	EnableTraceEx2
1250	0x619d0	EncryptFileA
1251	0x61970	EncryptFileW
1252	0x611f0	EncryptedFileKeyInfo
1253	0x61270	EncryptionDisable
1254	0x4d090	EnumDependentServicesA
1255	0x1460	EnumDependentServicesW
1256	0x4d5d0	EnumServiceGroupW
1257	0x4d400	EnumServicesStatusA
1258	0x4d200	EnumServicesStatusExA
1259	0xeac0	EnumServicesStatusExW
1260	0x4d800	EnumServicesStatusW
1261	0x26770	EnumerateTraceGuids
1262	0x4fe30	EnumerateTraceGuidsEx
1263	0x3b5c0	EqualDomainSid
1264	0xb198	EqualPrefixSid
1265	0x1e210	EqualSid
1266	0x2c50	EventAccessControl
1267	0x3060	EventAccessQuery
1268	0x4ff20	EventAccessRemove
1269	0x97e4b	EventActivityIdControl
1270	0x97e6b	EventEnabled
1271	0x97e81	EventProviderEnabled
1272	0x97e9f	EventRegister
1273	0x97eb6	EventUnregister
1274	0x97ecf	EventWrite
1275	0x97ee3	EventWriteEndScenario
1276	0x3b580	EventWriteEx
1277	0x97f02	EventWriteStartScenario
1278	0x97f23	EventWriteString
1279	0x97f3d	EventWriteTransfer
1280	0x61780	FileEncryptionStatusA
1281	0x61730	FileEncryptionStatusW
1282	0x3b570	FindFirstFreeAce
1283	0x610f0	FlushEfsCache
1284	0x69030	FlushTraceA
1285	0x7090	FlushTraceW
1286	0x4a630	FreeEncryptedFileKeyInfo
1287	0x4a5a0	FreeEncryptedFileMetadata
1288	0x4a660	FreeEncryptionCertificateHashList
1289	0x455b0	FreeInheritedFromArray
1290	0x1e208	FreeSid
1291	0x65260	GetAccessPermissionsForObjectA
1292	0x5c6c0	GetAccessPermissionsForObjectW
1293	0x1419c	GetAce
1294	0xe120	GetAclInformation
1295	0x5e7e0	GetAuditedPermissionsFromAclA
1296	0x458f0	GetAuditedPermissionsFromAclW
1297	0x61a80	GetCurrentHwProfileA
1298	0x1150	GetCurrentHwProfileW
1299	0x5e860	GetEffectiveRightsFromAclA
1300	0x459e0	GetEffectiveRightsFromAclW
1301	0x4a600	GetEncryptedFileMetadata
1302	0x92d0	GetEventLogInformation
1303	0x51450	GetExplicitEntriesFromAclA
1304	0x45990	GetExplicitEntriesFromAclW
1305	0x54460	GetFileSecurityA
1306	0xbc30	GetFileSecurityW
1307	0xac00	GetInformationCodeAuthzLevelW
1308	0xb470	GetInformationCodeAuthzPolicyW
1309	0x457a0	GetInheritanceSourceA
1310	0x455f0	GetInheritanceSourceW
1311	0x141e0	GetKernelObjectSecurity
1312	0x1dde4	GetLengthSid
1313	0x5fa70	GetLocalManagedApplicationData
1314	0x5fca0	GetLocalManagedApplications
1315	0x52e80	GetManagedApplicationCategories
1316	0x5fa50	GetManagedApplications
1317	0x453e0	GetMultipleTrusteeA
1318	0x45400	GetMultipleTrusteeOperationA
1319	0x45400	GetMultipleTrusteeOperationW
1320	0x453e0	GetMultipleTrusteeW
1321	0x5e960	GetNamedSecurityInfoA
1322	0x657b0	GetNamedSecurityInfoExA
1323	0x5e260	GetNamedSecurityInfoExW
1324	0x12180	GetNamedSecurityInfoW
1325	0x62430	GetNumberOfEventLogRecords
1326	0x62400	GetOldestEventLogRecord
1327	0x50ef0	GetOverlappedAccessResults
1328	0x3b550	GetPrivateObjectSecurity
1329	0xd90c	GetSecurityDescriptorControl
1330	0x1de40	GetSecurityDescriptorDacl
1331	0xd960	GetSecurityDescriptorGroup
1332	0xd9c4	GetSecurityDescriptorLength
1333	0xd948	GetSecurityDescriptorOwner
1334	0x3b544	GetSecurityDescriptorRMControl
1335	0x141c0	GetSecurityDescriptorSacl
1336	0xda70	GetSecurityInfo
1337	0x65540	GetSecurityInfoExA
1338	0x5d870	GetSecurityInfoExW
1339	0x4db60	GetServiceDisplayNameA
1340	0x25720	GetServiceDisplayNameW
1341	0x4dbf0	GetServiceKeyNameA
1342	0x257f0	GetServiceKeyNameW
1343	0xa980	GetSidIdentifierAuthority
1344	0xd974	GetSidLengthRequired
1345	0x13f14	GetSidSubAuthority
1346	0x13f00	GetSidSubAuthorityCount
1347	0x40740	GetThreadWaitChain
1348	0x1e050	GetTokenInformation
1349	0x97f59	GetTraceEnableFlags
1350	0x97f76	GetTraceEnableLevel
1351	0x97f93	GetTraceLoggerHandle
1352	0x45420	GetTrusteeFormA
1353	0x45420	GetTrusteeFormW
1354	0x45460	GetTrusteeNameA
1355	0x45460	GetTrusteeNameW
1356	0x45440	GetTrusteeTypeA
1357	0x45440	GetTrusteeTypeW
1358	0x107a0	GetUserNameA
1359	0x14930	GetUserNameW
1360	0x3b538	GetWindowsAccountDomainSid
1361	0x97fb1	I_QueryTagInformation
1362	0x97fe8	I_ScIsSecurityProcess
1363	0x9801f	I_ScPnPGetServiceName
1364	0x98056	I_ScQueryServiceConfig
1365	0x9808e	I_ScSendPnPMessage
1366	0x980c2	I_ScSendTSMessage
1367	0x42c70	I_ScSetServiceBitsA
1368	0x8600	I_ScSetServiceBitsW
1369	0x980f5	I_ScValidatePnPService
1370	0x22e80	IdentifyCodeAuthzLevelW
1371	0x3b52c	ImpersonateAnonymousToken
1372	0xf638	ImpersonateLoggedOnUser
1373	0x3b520	ImpersonateNamedPipeClient
1374	0xd7ac	ImpersonateSelf
1375	0x1dd50	InitializeAcl
1376	0x1dd70	InitializeSecurityDescriptor
1377	0xd990	InitializeSid
1378	0x68bc0	InitiateShutdownA
1379	0x63400	InitiateShutdownW
1380	0x68e20	InitiateSystemShutdownA
1381	0x68d20	InitiateSystemShutdownExA
1382	0x63570	InitiateSystemShutdownExW
1383	0x63690	InitiateSystemShutdownW
1384	0x75880	InstallApplication
1385	0x24e70	IsTextUnicode
1386	0xfaec	IsTokenRestricted
1387	0x46640	IsTokenUntrusted
1388	0xbcb0	IsValidAcl
1389	0x9812d	IsValidRelativeSecurityDescriptor
1390	0xe164	IsValidSecurityDescriptor
1391	0x13f30	IsValidSid
1392	0xbc9c	IsWellKnownSid
1393	0x4dae0	LockServiceDatabase
1394	0x70d70	LogonUserA
1395	0x70d00	LogonUserExA
1396	0xe674	LogonUserExExW
1397	0x70c90	LogonUserExW
1398	0xf660	LogonUserW
1399	0x3f47c	LookupAccountNameA
1400	0x10ac4	LookupAccountNameW
1401	0x3f1f4	LookupAccountSidA
1402	0x1e288	LookupAccountSidW
1403	0x675a0	LookupPrivilegeDisplayNameA
1404	0x67420	LookupPrivilegeDisplayNameW
1405	0x678d0	LookupPrivilegeNameA
1406	0x67770	LookupPrivilegeNameW
1407	0x1bb0	LookupPrivilegeValueA
1408	0x1e600	LookupPrivilegeValueW
1409	0x5e540	LookupSecurityDescriptorPartsA
1410	0x51200	LookupSecurityDescriptorPartsW
1411	0x49580	LsaAddAccountRights
1412	0x48650	LsaAddPrivilegesToAccount
1413	0x48df0	LsaClearAuditLog
1414	0x20930	LsaClose
1415	0x6aba0	LsaCreateAccount
1416	0x6a930	LsaCreateSecret
1417	0x6aad0	LsaCreateTrustedDomain
1418	0x667f0	LsaCreateTrustedDomainEx
1419	0x53130	LsaDelete
1420	0x49310	LsaDeleteTrustedDomain
1421	0x495f0	LsaEnumerateAccountRights
1422	0x48860	LsaEnumerateAccounts
1423	0x496a0	LsaEnumerateAccountsWithUserRight
1424	0x48710	LsaEnumeratePrivileges
1425	0x486b0	LsaEnumeratePrivilegesOfAccount
1426	0x33e0	LsaEnumerateTrustedDomains
1427	0x491a0	LsaEnumerateTrustedDomainsEx
1428	0x108a0	LsaFreeMemory
1429	0x48590	LsaGetQuotasForAccount
1430	0x5ffe0	LsaGetRemoteUserName
1431	0x484d0	LsaGetSystemAccessAccount
1432	0xa9a0	LsaGetUserName
1433	0xb8a0	LsaICLookupNames
1434	0x43c0	LsaICLookupNamesWithCreds
1435	0xdf00	LsaICLookupSids
1436	0x46b0	LsaICLookupSidsWithCreds
1437	0x601b0	LsaLookupNames
1438	0xb830	LsaLookupNames2
1439	0x48aa0	LsaLookupPrivilegeDisplayName
1440	0x48d50	LsaLookupPrivilegeName
1441	0x1e6d0	LsaLookupPrivilegeValue
1442	0xdd90	LsaLookupSids
1443	0x532d0	LsaManageSidNameMapping
1444	0x483f0	LsaNtStatusToWinError
1445	0x6a860	LsaOpenAccount
1446	0x1f380	LsaOpenPolicy
1447	0x66660	LsaOpenPolicySce
1448	0x6a790	LsaOpenSecret
1449	0x6aa00	LsaOpenTrustedDomain
1450	0x66730	LsaOpenTrustedDomainByName
1451	0x49130	LsaQueryDomainInformationPolicy
1452	0x49060	LsaQueryForestTrustInformation
1453	0x487c0	LsaQueryInfoTrustedDomain
1454	0x209a0	LsaQueryInformationPolicy
1455	0x6a6f0	LsaQuerySecret
1456	0x48a10	LsaQuerySecurityObject
1457	0x49450	LsaQueryTrustedDomainInfo
1458	0x492a0	LsaQueryTrustedDomainInfoByName
1459	0x49510	LsaRemoveAccountRights
1460	0x485f0	LsaRemovePrivilegesFromAccount
1461	0x6ae0	LsaRetrievePrivateData
1462	0x490c0	LsaSetDomainInformationPolicy
1463	0x48ff0	LsaSetForestTrustInformation
1464	0x531c0	LsaSetInformationPolicy
1465	0x66460	LsaSetInformationTrustedDomain
1466	0x48530	LsaSetQuotasForAccount
1467	0x663f0	LsaSetSecret
1468	0x48900	LsaSetSecurityObject
1469	0x48470	LsaSetSystemAccessAccount
1470	0x668d0	LsaSetTrustedDomainInfoByName
1471	0x49370	LsaSetTrustedDomainInformation
1472	0x66ae0	LsaStorePrivateData
1473	0x9815a	MD4Final
1474	0x98169	MD4Init
1475	0x98177	MD4Update
1476	0x98187	MD5Final
1477	0x98196	MD5Init
1478	0x981a4	MD5Update
1479	0x66fc0	MSChapSrvChangePassword
1480	0x53eb0	MSChapSrvChangePassword2
1481	0xdca8	MakeAbsoluteSD
1482	0x3b510	MakeAbsoluteSD2
1483	0xdb38	MakeSelfRelativeSD
1484	0xaf2c	MapGenericMask
1485	0x4b40	NotifyBootConfigStatus
1486	0x62460	NotifyChangeEventLog
1487	0xd9b8	NotifyServiceStatusChange
1488	0x274c0	NotifyServiceStatusChangeA
1489	0xd9b0	NotifyServiceStatusChangeW
1490	0x546f0	ObjectCloseAuditAlarmA
1491	0x3b500	ObjectCloseAuditAlarmW
1492	0x54670	ObjectDeleteAuditAlarmA
1493	0x3b4f4	ObjectDeleteAuditAlarmW
1494	0x54810	ObjectOpenAuditAlarmA
1495	0x3b480	ObjectOpenAuditAlarmW
1496	0x54770	ObjectPrivilegeAuditAlarmA
1497	0x3b458	ObjectPrivilegeAuditAlarmW
1498	0x67d30	OpenBackupEventLogA
1499	0x61f50	OpenBackupEventLogW
1500	0x61680	OpenEncryptedFileRawA
1501	0x61620	OpenEncryptedFileRawW
1502	0x61e60	OpenEventLogA
1503	0x8ec0	OpenEventLogW
1504	0x1e070	OpenProcessToken
1505	0x1a320	OpenSCManagerA
1506	0xe7f8	OpenSCManagerW
1507	0x1a30c	OpenServiceA
1508	0xe810	OpenServiceW
1509	0x1e918	OpenThreadToken
1510	0x3ef48	OpenThreadWaitChainSession
1511	0x690c0	OpenTraceA
1512	0x11c00	OpenTraceW
1513	0x72c90	PerfAddCounters
1514	0x63200	PerfCloseQueryHandle
1515	0x981b4	PerfCreateInstance
1516	0x981cd	PerfDecrementULongCounterValue
1517	0x981f2	PerfDecrementULongLongCounterValue
1518	0x72c80	PerfDeleteCounters
1519	0x9821b	PerfDeleteInstance
1520	0x38ff0	PerfEnumerateCounterSet
1521	0x6f410	PerfEnumerateCounterSetInstances
1522	0x98234	PerfIncrementULongCounterValue
1523	0x98259	PerfIncrementULongLongCounterValue
1524	0x632b0	PerfOpenQueryHandle
1525	0x72ca0	PerfQueryCounterData
1526	0x6f300	PerfQueryCounterInfo
1527	0x39820	PerfQueryCounterSetRegistrationInfo
1528	0x98282	PerfQueryInstance
1529	0x9829a	PerfSetCounterRefValue
1530	0x982b7	PerfSetCounterSetInfo
1531	0x982d3	PerfSetULongCounterValue
1532	0x982f2	PerfSetULongLongCounterValue
1533	0x98315	PerfStartProvider
1534	0x9832d	PerfStartProviderEx
1535	0x98347	PerfStopProvider
1536	0xa434	PrivilegeCheck
1537	0x545a0	PrivilegedServiceAuditAlarmA
1538	0x3b43c	PrivilegedServiceAuditAlarmW
1539	0x49cd0	ProcessIdleTasks
1540	0x53c70	ProcessIdleTasksW
1541	0x13410	ProcessTrace
1542	0x6c7a0	QueryAllTracesA
1543	0x6c7b0	QueryAllTracesW
1544	0x61540	QueryRecoveryAgentsOnEncryptedFile
1545	0x3b430	QuerySecurityAccessMask
1546	0x3b410	QueryServiceConfig2A
1547	0x3b3f0	QueryServiceConfig2W
1548	0x3b3dc	QueryServiceConfigA
1549	0xec4c	QueryServiceConfigW
1550	0x4d9d0	QueryServiceLockStatusA
1551	0x4d8c0	QueryServiceLockStatusW
1552	0x3b3bc	QueryServiceObjectSecurity
1553	0x1615c	QueryServiceStatus
1554	0x9414	QueryServiceStatusEx
1555	0x690b0	QueryTraceA
1556	0xbc60	QueryTraceW
1557	0x615b0	QueryUsersOnEncryptedFile
1558	0x4a6d0	ReadEncryptedFileRaw
1559	0x61dd0	ReadEventLogA
1560	0x61ed0	ReadEventLogW
1561	0x24e60	RegCloseKey
1562	0x6c780	RegConnectRegistryA
1563	0x6c6f0	RegConnectRegistryExA
1564	0x68ac0	RegConnectRegistryExW
1565	0xaac0	RegConnectRegistryW
1566	0x63180	RegCopyTreeA
1567	0x57fb0	RegCopyTreeW
1568	0xa180	RegCreateKeyA
1569	0x14730	RegCreateKeyExA
1570	0x1dd90	RegCreateKeyExW
1571	0x4dfe0	RegCreateKeyTransactedA
1572	0x25500	RegCreateKeyTransactedW
1573	0x14860	RegCreateKeyW
1574	0x26ca0	RegDeleteKeyA
1575	0x4a590	RegDeleteKeyExA
1576	0x8e20	RegDeleteKeyExW
1577	0x4dec0	RegDeleteKeyTransactedA
1578	0x253d0	RegDeleteKeyTransactedW
1579	0x43e90	RegDeleteKeyValueA
1580	0x43e30	RegDeleteKeyValueW
1581	0x14500	RegDeleteKeyW
1582	0x4a4b0	RegDeleteTreeA
1583	0x4a4c0	RegDeleteTreeW
1584	0x10920	RegDeleteValueA
1585	0xb250	RegDeleteValueW
1586	0xe640	RegDisablePredefinedCache
1587	0x4a580	RegDisablePredefinedCacheEx
1588	0x16440	RegDisableReflectionKey
1589	0x16440	RegEnableReflectionKey
1590	0x9480	RegEnumKeyA
1591	0x14790	RegEnumKeyExA
1592	0x1f130	RegEnumKeyExW
1593	0x1ea90	RegEnumKeyW
1594	0x10300	RegEnumValueA
1595	0x24c20	RegEnumValueW
1596	0x8ea0	RegFlushKey
1597	0x6df0	RegGetKeySecurity
1598	0xaa70	RegGetValueA
1599	0x13f50	RegGetValueW
1600	0x630e0	RegLoadAppKeyA
1601	0x57d20	RegLoadAppKeyW
1602	0x4a500	RegLoadKeyA
1603	0x4a4f0	RegLoadKeyW
1604	0x4a530	RegLoadMUIStringA
1605	0x14150	RegLoadMUIStringW
1606	0x108f0	RegNotifyChangeKeyValue
1607	0x14970	RegOpenCurrentUser
1608	0x102c0	RegOpenKeyA
1609	0x1de60	RegOpenKeyExA
1610	0x24e30	RegOpenKeyExW
1611	0x4df40	RegOpenKeyTransactedA
1612	0x25460	RegOpenKeyTransactedW
1613	0x15b60	RegOpenKeyW
1614	0x4a570	RegOpenUserClassesRoot
1615	0x4e0b0	RegOverridePredefKey
1616	0x268e0	RegQueryInfoKeyA
1617	0x1f2f0	RegQueryInfoKeyW
1618	0x6bf50	RegQueryMultipleValuesA
1619	0x6ba10	RegQueryMultipleValuesW
1620	0x4a190	RegQueryReflectionKey
1621	0x6670	RegQueryValueA
1622	0x24c80	RegQueryValueExA
1623	0x1f0d0	RegQueryValueExW
1624	0x1e930	RegQueryValueW
1625	0x43ef0	RegRenameKey
1626	0x57af0	RegReplaceKeyA
1627	0x57960	RegReplaceKeyW
1628	0x4a510	RegRestoreKeyA
1629	0x25bc0	RegRestoreKeyW
1630	0x688f0	RegSaveKeyA
1631	0x4a520	RegSaveKeyExA
1632	0x258d0	RegSaveKeyExW
1633	0x258f0	RegSaveKeyW
1634	0xa420	RegSetKeySecurity
1635	0x43d70	RegSetKeyValueA
1636	0x25210	RegSetKeyValueW
1637	0x4dc70	RegSetValueA
1638	0x147e0	RegSetValueExA
1639	0x14830	RegSetValueExW
1640	0x26970	RegSetValueW
1641	0x4a4e0	RegUnLoadKeyA
1642	0x4a4d0	RegUnLoadKeyW
1643	0x274e0	RegisterEventSourceA
1644	0x15fe0	RegisterEventSourceW
1645	0x1ec0	RegisterIdleTask
1646	0x3b3b0	RegisterServiceCtrlHandlerA
1647	0x3b3a4	RegisterServiceCtrlHandlerExA
1648	0x8e00	RegisterServiceCtrlHandlerExW
1649	0x2c18	RegisterServiceCtrlHandlerW
1650	0x9835e	RegisterTraceGuidsA
1651	0x9837b	RegisterTraceGuidsW
1652	0x3aa78	RegisterWaitChainCOMCallback
1653	0x50070	RemoveTraceCallback
1654	0x614d0	RemoveUsersFromEncryptedFile
1655	0x61be0	ReportEventA
1656	0xfff0	ReportEventW
1657	0x10800	RevertToSelf
1658	0x23d10	SaferCloseLevel
1659	0x23e00	SaferComputeTokenFromLevel
1660	0x6a450	SaferCreateLevel
1661	0xac00	SaferGetLevelInformation
1662	0xb470	SaferGetPolicyInformation
1663	0x22e80	SaferIdentifyLevel
1664	0x6d070	SaferRecordEventLogEntry
1665	0x6a330	SaferSetLevelInformation
1666	0x6d280	SaferSetPolicyInformation
1667	0x65d10	SaferiChangeRegistryScope
1668	0xe4f0	SaferiCompareTokenLevels
1669	0x3f68c	SaferiIsDllAllowed
1670	0xb2a0	SaferiIsExecutableFileType
1671	0x5ec30	SaferiPopulateDefaultsInRegistry
1672	0x6d070	SaferiRecordEventLogEntry
1673	0xa020	SaferiSearchMatchingHashRules
1674	0x3b398	SetAclInformation
1675	0x4a5d0	SetEncryptedFileMetadata
1676	0x654b0	SetEntriesInAccessListA
1677	0x5cba0	SetEntriesInAccessListW
1678	0x51460	SetEntriesInAclA
1679	0x15f80	SetEntriesInAclW
1680	0x65470	SetEntriesInAuditListA
1681	0x5cb60	SetEntriesInAuditListW
1682	0x54510	SetFileSecurityA
1683	0xbd64	SetFileSecurityW
1684	0x6a330	SetInformationCodeAuthzLevelW
1685	0x6d280	SetInformationCodeAuthzPolicyW
1686	0x1420c	SetKernelObjectSecurity
1687	0x5e8d0	SetNamedSecurityInfoA
1688	0x5db60	SetNamedSecurityInfoExA
1689	0x5df60	SetNamedSecurityInfoExW
1690	0xb660	SetNamedSecurityInfoW
1691	0x3b378	SetPrivateObjectSecurity
1692	0x3b350	SetPrivateObjectSecurityEx
1693	0x3b344	SetSecurityAccessMask
1694	0x258c4	SetSecurityDescriptorControl
1695	0x1de10	SetSecurityDescriptorDacl
1696	0x1209c	SetSecurityDescriptorGroup
1697	0x12088	SetSecurityDescriptorOwner
1698	0x3b338	SetSecurityDescriptorRMControl
1699	0x14260	SetSecurityDescriptorSacl
1700	0xb1b0	SetSecurityInfo
1701	0x5d1b0	SetSecurityInfoExA
1702	0x5d570	SetSecurityInfoExW
1703	0x576b0	SetServiceBits
1704	0x3b32c	SetServiceObjectSecurity
1705	0x8e34	SetServiceStatus
1706	0xfd8c	SetThreadToken
1707	0xd6b0	SetTokenInformation
1708	0x50170	SetTraceCallback
1709	0x613c0	SetUserFileEncryptionKey
1710	0x61350	SetUserFileEncryptionKeyEx
1711	0x3b320	StartServiceA
1712	0x3b314	StartServiceCtrlDispatcherA
1713	0x6e1c	StartServiceCtrlDispatcherW
1714	0x9400	StartServiceW
1715	0x64310	StartTraceA
1716	0x10d80	StartTraceW
1717	0x69090	StopTraceA
1718	0x13ec0	StopTraceW
1719	0x3dc6c	SystemFunction001
1720	0x25144	SystemFunction002
1721	0xd64c	SystemFunction003
1722	0x3dc00	SystemFunction004
1723	0x3db94	SystemFunction005
1724	0xd560	SystemFunction006
1725	0xecb0	SystemFunction007
1726	0x61030	SystemFunction008
1727	0x66fb0	SystemFunction009
1728	0x66f50	SystemFunction010
1729	0x6b350	SystemFunction011
1730	0x60fe0	SystemFunction012
1731	0x60f90	SystemFunction013
1732	0x66f40	SystemFunction014
1733	0x66f30	SystemFunction015
1734	0x60f40	SystemFunction016
1735	0x60ef0	SystemFunction017
1736	0x66f20	SystemFunction018
1737	0x66f10	SystemFunction019
1738	0x66f40	SystemFunction020
1739	0x66f30	SystemFunction021
1740	0x66f40	SystemFunction022
1741	0x66f30	SystemFunction023
1742	0x60e70	SystemFunction024
1743	0x250d0	SystemFunction025
1744	0x66f00	SystemFunction026
1745	0x250c0	SystemFunction027
1746	0x3db38	SystemFunction028
1747	0x3dadc	SystemFunction029
1748	0x25060	SystemFunction030
1749	0x25060	SystemFunction031
1750	0x53bf0	SystemFunction032
1751	0x53bf0	SystemFunction033
1752	0x3da70	SystemFunction034
1753	0x98398	SystemFunction035
1754	0x1044	SystemFunction036
1755	0xa910	SystemFunction040
1756	0xa8a0	SystemFunction041
1757	0x983b5	TraceEvent
1758	0x983cc	TraceEventInstance
1759	0x983e8	TraceMessage
1760	0x983fe	TraceMessageVa
1761	0x3d5f0	TraceSetInformation
1762	0x457a0	TreeResetNamedSecurityInfoA
1763	0x457b0	TreeResetNamedSecurityInfoW
1764	0x457a0	TreeSetNamedSecurityInfoA
1765	0x456b0	TreeSetNamedSecurityInfoW
1766	0x5c800	TrusteeAccessToObjectA
1767	0x5ca50	TrusteeAccessToObjectW
1768	0x52fa0	UninstallApplication
1769	0x4d850	UnlockServiceDatabase
1770	0x49e10	UnregisterIdleTask
1771	0x98416	UnregisterTraceGuids
1772	0x69070	UpdateTraceA
1773	0x69050	UpdateTraceW
1774	0x61170	UsePinForEncryptedFilesA
1775	0x67280	UsePinForEncryptedFilesW
1776	0x1ade0	WmiCloseBlock
1777	0x5a810	WmiDevInstToInstanceNameA
1778	0x5a730	WmiDevInstToInstanceNameW
1779	0x5a8e0	WmiEnumerateGuids
1780	0x5b2f0	WmiExecuteMethodA
1781	0x5af30	WmiExecuteMethodW
1782	0x5acf0	WmiFileHandleToInstanceNameA
1783	0x5aac0	WmiFileHandleToInstanceNameW
1784	0xce00	WmiFreeBuffer
1785	0x69a20	WmiMofEnumerateResourcesA
1786	0xc790	WmiMofEnumerateResourcesW
1787	0x74a60	WmiNotificationRegistrationA
1788	0xd7c0	WmiNotificationRegistrationW
1789	0x1ab00	WmiOpenBlock
1790	0x75030	WmiQueryAllDataA
1791	0x5bdf0	WmiQueryAllDataMultipleA
1792	0x5bbd0	WmiQueryAllDataMultipleW
1793	0x1abc0	WmiQueryAllDataW
1794	0xc450	WmiQueryGuidInformation
1795	0x6faf0	WmiQuerySingleInstanceA
1796	0x64fd0	WmiQuerySingleInstanceMultipleA
1797	0x5b970	WmiQuerySingleInstanceMultipleW
1798	0x6f820	WmiQuerySingleInstanceW
1799	0x6fbd0	WmiReceiveNotificationsA
1800	0x6fc50	WmiReceiveNotificationsW
1801	0x5b8a0	WmiSetSingleInstanceA
1802	0x5b6b0	WmiSetSingleInstanceW
1803	0x5b5e0	WmiSetSingleItemA
1804	0x5b3e0	WmiSetSingleItemW
1805	0x4a6b0	WriteEncryptedFileRaw

module_name	ADVAPI32.dll
flags	0
timestamp	2013-08-29 01:50:50
version	0.0
ordinal_base	1000
nFunctions	806
nNames	805
Names(805)	0x92894
Functions(806)	0x91bfc
NameOrdinals(805)	0x93528

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Advanced Windows 32 Base API
FileVersion	6.1.7601.18247 (win7sp1_gdr.130828-1532)
InternalName	advapi32.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	advapi32.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.18247

VS_FIXEDFILEINFO

FileVersion	6.1.7601.18247
ProductVersion	6.1.7601.18247
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	872496	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

advapi32.dll-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

advapi32.dll
-