ProcessHacker.exe - Process Hacker

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	ProcessHacker.exe
size	1428480 (0x15cc00)
md5	c506246ae9bed9b6c0e7c1b7eeb67035

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x118

Rich Header

lib id	version	times used
199	41118	2
207	50929	40
205	50929	11
188	30716	2
185	30716	20
156	30319	5
1	0	557
206	50929	138
210	60610	144
202	60610	1
201	60610	1
151	0	1
204	60610	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x51ea8153
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	11.0
SizeOfCode	0xe3c00
SizeOfInitializedData	0x7fc00
SizeOfUninitializedData	0
AddressOfEntryPoint	0xd40d0
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x166000
SizeOfHeaders	0x400
CheckSum	0x16c5f6
Subsystem	2
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xe3b6d	0xe3c00	R-X CODE
.rdata	0xe5000	0x35fff	0x36000	R-- IDATA
.data	0x11b000	0xed38	0x7e00	RW- IDATA
.pdata	0x12a000	0xae0c	0xb000	R-- IDATA
.rsrc	0x135000	0x2d4d8	0x2d600	R-- IDATA
.reloc	0x163000	0x26e8	0x2800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x114960	0x669f
IMPORT	0x110c9c	0x104
RESOURCE	0x135000	0x2d4d8
EXCEPTION	0x12a000	0xae0c
SECURITY	0	0
BASERELOC	0x163000	0x13a0
DEBUG	0xe6200	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x1037e0	0x70
Bound_IAT	0	0
IAT	0xe5000	0x1180
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
BITMAP	#117	1064
BITMAP	#118	1064
BITMAP	#156	1064
BITMAP	#157	1064
BITMAP	#158	1064
BITMAP	#159	1064
BITMAP	#170	1064
BITMAP	#171	1064
ICON	#1	1640
ICON	#2	744
ICON	#3	488
ICON	#4	296
ICON	#5	3752
ICON	#6	2216
ICON	#7	1736
ICON	#8	1384
ICON	#9	67507
ICON	#10	9640
ICON	#11	4264
ICON	#12	2440
ICON	#13	1128
ICON	#14	296
ICON	#15	744
ICON	#16	296
ICON	#17	1384
ICON	#18	872
ICON	#19	1128
ICON	#20	296
ICON	#21	1384
ICON	#22	872
ICON	#23	1128
ICON	#24	296
ICON	#25	1384
ICON	#26	872
ICON	#27	1128
ICON	#28	296
ICON	#29	1384
ICON	#30	872
ICON	#31	1128
MENU	#102	1868
MENU	#110	650
MENU	#111	158
MENU	#112	212
MENU	#120	252
MENU	#123	1236
MENU	#124	236
MENU	#133	124
MENU	#134	154
MENU	#151	188
MENU	#164	150
MENU	#173	742
MENU	#181	258
MENU	#184	196
MENU	#204	220
DIALOG	#103	1452
DIALOG	#104	128
DIALOG	#105	1310
DIALOG	#106	200
DIALOG	#107	144
DIALOG	#108	276
DIALOG	#114	284
DIALOG	#121	720
DIALOG	#125	240
DIALOG	#126	938
DIALOG	#128	1032
DIALOG	#129	252
DIALOG	#130	280
DIALOG	#131	1012
DIALOG	#132	236
DIALOG	#135	600
DIALOG	#136	976
DIALOG	#137	248
DIALOG	#138	230
DIALOG	#139	970
DIALOG	#140	638
DIALOG	#141	520
DIALOG	#142	394
DIALOG	#143	358
DIALOG	#144	394
DIALOG	#145	220
DIALOG	#146	1888
DIALOG	#147	180
DIALOG	#148	262
DIALOG	#149	1728
DIALOG	#150	330
DIALOG	#152	474
DIALOG	#153	1122
DIALOG	#154	232
DIALOG	#155	338
DIALOG	#162	1082
DIALOG	#163	732
DIALOG	#166	684
DIALOG	#167	190
DIALOG	#168	736
DIALOG	#169	360
DIALOG	#170	2956
DIALOG	#171	1170
DIALOG	#175	234
DIALOG	#178	358
DIALOG	#179	388
DIALOG	#180	356
DIALOG	#182	296
DIALOG	#183	360
DIALOG	#185	592
DIALOG	#186	1126
DIALOG	#187	1134
DIALOG	#188	200
DIALOG	#189	1056
DIALOG	#190	386
DIALOG	#191	128
DIALOG	#193	510
DIALOG	#194	144
DIALOG	#195	132
DIALOG	#196	272
DIALOG	#197	1220
DIALOG	#198	3838
DIALOG	#199	416
DIALOG	#200	224
DIALOG	#201	1360
DIALOG	#202	2060
DIALOG	#205	64
DIALOG	#206	2392
ACCELERATORS	#102	96
ACCELERATORS	#198	104
GROUP_ICON	#101	188
GROUP_ICON	#172	34
GROUP_ICON	#191	62
GROUP_ICON	#192	62
GROUP_ICON	#194	62
GROUP_ICON	#195	62
VERSION	#1	756
MANIFEST	#1	1430

module_name	hint	ord	function_name
ntdll.dll	182		NtAllocateVirtualMemory
ntdll.dll	959		RtlInterlockedFlushSList
ntdll.dll	946		RtlInitializeSListHead
ntdll.dll	841		RtlFreeHeap
ntdll.dll	1032		RtlMultiByteToUnicodeSize
ntdll.dll	1228		RtlUnicodeToMultiByteN
ntdll.dll	960		RtlInterlockedPopEntrySList
ntdll.dll	1229		RtlUnicodeToMultiByteSize
ntdll.dll	961		RtlInterlockedPushEntrySList
ntdll.dll	1098		RtlReAllocateHeap
ntdll.dll	612		RtlAllocateHeap
ntdll.dll	1095		RtlRaiseStatus
ntdll.dll	1194		RtlSubAuthorityCountSid
ntdll.dll	909		RtlIdentifierAuthoritySid
ntdll.dll	259		NtDebugActiveProcess
ntdll.dll	224		NtCreateDebugObject
ntdll.dll	231		NtCreateJobObject
ntdll.dll	369		NtPowerInformation
ntdll.dll	315		NtIsProcessInJob
ntdll.dll	1203		RtlTimeToSecondsSince1980
ntdll.dll	1068		RtlQueryDepthSList
ntdll.dll	1138		RtlSecondsSince1980ToTime
ntdll.dll	163		NtAcceptConnectPort
ntdll.dll	459		NtReplyWaitReceivePort
ntdll.dll	240		NtCreatePort
ntdll.dll	220		NtCompleteConnectPort
ntdll.dll	1002		RtlLengthRequiredSid
ntdll.dll	463		NtRequestWaitReplyPort
ntdll.dll	222		NtConnectPort
ntdll.dll	269		NtDeleteValueKey
ntdll.dll	464		NtResetEvent
ntdll.dll	411		NtQueryMutant
ntdll.dll	508		NtSetLowEventPair
ntdll.dll	380		NtPulseEvent
ntdll.dll	421		NtQuerySemaphore
ntdll.dll	489		NtSetHighEventPair
ntdll.dll	391		NtQueryEvent
ntdll.dll	428		NtQueryTimer
ntdll.dll	418		NtQuerySection
ntdll.dll	211		NtCancelTimer
ntdll.dll	977		RtlIpv6AddressToStringW
ntdll.dll	969		RtlIpv4AddressToStringW
ntdll.dll	1137		RtlSecondsSince1970ToTime
ntdll.dll	754		RtlDestroyHeap
ntdll.dll	379		NtProtectVirtualMemory
ntdll.dll	514		NtSetSystemInformation
ntdll.dll	237		NtCreateMutant
ntdll.dll	533		NtTerminateJobObject
ntdll.dll	206		NtAssignProcessToJobObject
ntdll.dll	697		RtlCreateQueryDebugBuffer
ntdll.dll	1083		RtlQueryProcessDebugInformation
ntdll.dll	758		RtlDestroyQueryDebugBuffer
ntdll.dll	936		RtlInitializeCriticalSection
ntdll.dll	415		NtQueryPerformanceCounter
ntdll.dll	733		RtlDeleteCriticalSection
ntdll.dll	1158		RtlSetHeapInformation
ntdll.dll	1072		RtlQueryEnvironmentVariable_U
ntdll.dll	848		RtlGUIDFromString
ntdll.dll	760		RtlDetermineDosPathNameType_U
ntdll.dll	553		NtWaitForMultipleObjects
ntdll.dll	314		NtInitiatePowerAction
ntdll.dll	261		NtDelayExecution
ntdll.dll	491		NtSetInformationDebugObject
ntdll.dll	453		NtRemoveProcessDebug
ntdll.dll	122		LdrLoadDll
ntdll.dll	115		LdrGetProcedureAddress
ntdll.dll	145		LdrUnloadDll
ntdll.dll	699		RtlCreateSecurityDescriptor
ntdll.dll	694		RtlCreateProcessParameters
ntdll.dll	870		RtlGetFullPathName_U
ntdll.dll	284		NtFilterToken
ntdll.dll	430		NtQueryValueKey
ntdll.dll	275		NtDuplicateToken
ntdll.dll	948		RtlInitializeSid
ntdll.dll	1097		RtlRandomEx
ntdll.dll	757		RtlDestroyProcessParameters
ntdll.dll	846		RtlFreeUnicodeString
ntdll.dll	585		RtlAddAccessAllowedAce
ntdll.dll	825		RtlFindMessage
ntdll.dll	1151		RtlSetDaclSecurityDescriptor
ntdll.dll	682		RtlCreateAcl
ntdll.dll	591		RtlAddAce
ntdll.dll	381		NtQueryAttributesFile
ntdll.dll	710		RtlCreateUserProcess
ntdll.dll	808		RtlExpandEnvironmentStrings_U
ntdll.dll	1193		RtlStringFromGUID
ntdll.dll	850		RtlGetAce
ntdll.dll	888		RtlGetOwnerSecurityDescriptor
ntdll.dll	862		RtlGetDaclSecurityDescriptor
ntdll.dll	1003		RtlLengthSecurityDescriptor
ntdll.dll	874		RtlGetGroupSecurityDescriptor
ntdll.dll	893		RtlGetSaclSecurityDescriptor
ntdll.dll	447		NtReleaseKeyedEvent
ntdll.dll	1001		RtlLeaveCriticalSection
ntdll.dll	552		NtWaitForKeyedEvent
ntdll.dll	235		NtCreateKeyedEvent
ntdll.dll	783		RtlEnterCriticalSection
ntdll.dll	518		NtSetTimer
ntdll.dll	177		NtAlertThread
ntdll.dll	252		NtCreateTimer
ntdll.dll	713		RtlCreateUserThread
ntdll.dll	531		NtSuspendThread
ntdll.dll	175		NtAdjustPrivilegesToken
ntdll.dll	354		NtOpenProcess
ntdll.dll	298		NtGetContextThread
ntdll.dll	396		NtQueryInformationJobObject
ntdll.dll	431		NtQueryVirtualMemory
ntdll.dll	355		NtOpenProcessToken
ntdll.dll	497		NtSetInformationProcess
ntdll.dll	339		NtOpenDirectoryObject
ntdll.dll	441		NtReadVirtualMemory
ntdll.dll	467		NtResumeProcess
ntdll.dll	1060		RtlPrefixUnicodeString
ntdll.dll	388		NtQueryDirectoryObject
ntdll.dll	358		NtOpenSection
ntdll.dll	500		NtSetInformationToken
ntdll.dll	362		NtOpenThread
ntdll.dll	499		NtSetInformationThread
ntdll.dll	387		NtQueryDirectoryFile
ntdll.dll	798		RtlEqualUnicodeString
ntdll.dll	422		NtQuerySymbolicLinkObject
ntdll.dll	233		NtCreateKey
ntdll.dll	361		NtOpenSymbolicLinkObject
ntdll.dll	363		NtOpenThreadToken
ntdll.dll	563		NtWriteVirtualMemory
ntdll.dll	534		NtTerminateProcess
ntdll.dll	543		NtUnloadDriver
ntdll.dll	346		NtOpenKey
ntdll.dll	480		NtSetContextThread
ntdll.dll	530		NtSuspendProcess
ntdll.dll	468		NtResumeThread
ntdll.dll	1031		RtlMultiByteToUnicodeN
ntdll.dll	1242		RtlUpcaseUnicodeChar
ntdll.dll	1259		RtlValidSid
ntdll.dll	1043		RtlNtStatusToDosError
ntdll.dll	171		NtAddAtom
ntdll.dll	1195		RtlSubAuthoritySid
ntdll.dll	1004		RtlLengthSid
ntdll.dll	1241		RtlUnwindEx
ntdll.dll	634		RtlCaptureContext
ntdll.dll	1024		RtlLookupFunctionEntry
ntdll.dll	1264		RtlVirtualUnwind
ntdll.dll	666		RtlConvertSidToUnicodeString
ntdll.dll	764		RtlDoesFileExists_U
ntdll.dll	266		NtDeleteKey
ntdll.dll	522		NtSetValueKey
ntdll.dll	496		NtSetInformationObject
ntdll.dll	270		NtDeviceIoControlFile
ntdll.dll	766		RtlDosPathNameToNtPathName_U
ntdll.dll	437		NtReadFile
ntdll.dll	392		NtQueryFullAttributesFile
ntdll.dll	343		NtOpenFile
ntdll.dll	839		RtlFreeAnsiString
ntdll.dll	286		NtFlushBuffersFile
ntdll.dll	229		NtCreateFile
ntdll.dll	547		NtUnlockFile
ntdll.dll	395		NtQueryInformationFile
ntdll.dll	1222		RtlUnicodeStringToAnsiString
ntdll.dll	297		NtFsControlFile
ntdll.dll	323		NtLockFile
ntdll.dll	560		NtWriteFile
ntdll.dll	274		NtDuplicateObject
ntdll.dll	412		NtQueryObject
ntdll.dll	511		NtSetSecurityObject
ntdll.dll	227		NtCreateEvent
ntdll.dll	398		NtQueryInformationProcess
ntdll.dll	400		NtQueryInformationThread
ntdll.dll	535		NtTerminateThread
ntdll.dll	420		NtQuerySecurityObject
ntdll.dll	487		NtSetEvent
ntdll.dll	401		NtQueryInformationToken
ntdll.dll	906		RtlGetVersion
ntdll.dll	425		NtQuerySystemInformation
ntdll.dll	691		RtlCreateHeap
ntdll.dll	247		NtCreateSection
ntdll.dll	549		NtUnmapViewOfSection
ntdll.dll	493		NtSetInformationFile
ntdll.dll	332		NtMapViewOfSection
ntdll.dll	248		NtCreateSemaphore
ntdll.dll	213		NtClose
ntdll.dll	555		NtWaitForSingleObject
ntdll.dll	449		NtReleaseSemaphore
ntdll.dll	294		NtFreeVirtualMemory
winsta.dll	28		WinStationConnectW
winsta.dll	29		WinStationDisconnect
winsta.dll	84		WinStationRegisterConsoleNotification
winsta.dll	91		WinStationReset
winsta.dll	39		WinStationFreeMemory
winsta.dll	74		WinStationQueryInformationW
winsta.dll	38		WinStationFreeGAPMemory
winsta.dll	44		WinStationGetAllProcesses
winsta.dll	101		WinStationShadow
winsta.dll	94		WinStationSendMessageW
winsta.dll	34		WinStationEnumerateW
COMCTL32.dll	119		ImageList_SetImageCount
COMCTL32.dll	124		InitCommonControlsEx
COMCTL32.dll	9		CreatePropertySheetPageW
COMCTL32.dll	134		PropertySheetW
COMCTL32.dll	110		ImageList_Remove
COMCTL32.dll	84		ImageList_Create
COMCTL32.dll	112		ImageList_ReplaceIcon
COMCTL32.dll	85		ImageList_Destroy
COMCTL32.dll	111		ImageList_Replace
VERSION.dll	7		GetFileVersionInfoSizeW
VERSION.dll	16		VerQueryValueW
VERSION.dll	8		GetFileVersionInfoW
KERNEL32.dll	1375		SetUnhandledExceptionFilter
KERNEL32.dll	553		GetCurrentProcess
KERNEL32.dll	1406		TerminateProcess
KERNEL32.dll	1425		TlsFree
KERNEL32.dll	734		GetStartupInfoW
KERNEL32.dll	1517		WideCharToMultiByte
KERNEL32.dll	740		GetStdHandle
KERNEL32.dll	606		GetFileType
KERNEL32.dll	646		GetModuleHandleExW
KERNEL32.dll	44		AreFileApisANSI
KERNEL32.dll	142		CloseHandle
KERNEL32.dll	705		GetProcessHeap
KERNEL32.dll	1537		WriteFile
KERNEL32.dll	643		GetModuleFileNameW
KERNEL32.dll	1087		QueryPerformanceCounter
KERNEL32.dll	554		GetCurrentProcessId
KERNEL32.dll	763		GetSystemTimeAsFileTime
KERNEL32.dll	508		GetConsoleCP
KERNEL32.dll	526		GetConsoleMode
KERNEL32.dll	1304		SetFilePointerEx
KERNEL32.dll	861		HeapReAlloc
KERNEL32.dll	1440		UnhandledExceptionFilter
KERNEL32.dll	948		LCMapStringW
KERNEL32.dll	1390		Sleep
KERNEL32.dll	358		EnumSystemLocalesW
KERNEL32.dll	803		GetUserDefaultLCID
KERNEL32.dll	914		IsValidLocale
KERNEL32.dll	287		DeleteCriticalSection
KERNEL32.dll	879		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	558		GetCurrentThreadId
KERNEL32.dll	1246		SetConsoleCtrlHandler
KERNEL32.dll	1006		MulDiv
KERNEL32.dll	1335		SetProcessShutdownParameters
KERNEL32.dll	446		FreeLibrary
KERNEL32.dll	786		GetThreadPriority
KERNEL32.dll	497		GetComputerNameW
KERNEL32.dll	426		FindResourceW
KERNEL32.dll	969		LoadResource
KERNEL32.dll	1389		SizeofResource
KERNEL32.dll	987		LockResource
KERNEL32.dll	1007		MultiByteToWideChar
KERNEL32.dll	452		GetACP
KERNEL32.dll	1285		SetEndOfFile
KERNEL32.dll	745		GetStringTypeW
KERNEL32.dll	324		EnterCriticalSection
KERNEL32.dll	960		LeaveCriticalSection
KERNEL32.dll	757		GetSystemInfo
KERNEL32.dll	1467		VirtualAlloc
KERNEL32.dll	1473		VirtualProtect
KERNEL32.dll	1475		VirtualQuery
KERNEL32.dll	858		HeapFree
KERNEL32.dll	854		HeapAlloc
KERNEL32.dll	488		GetCommandLineA
KERNEL32.dll	902		IsDebuggerPresent
KERNEL32.dll	320		EncodePointer
KERNEL32.dll	280		DecodePointer
KERNEL32.dll	907		IsProcessorFeaturePresent
KERNEL32.dll	912		IsValidCodePage
KERNEL32.dll	679		GetOEMCP
KERNEL32.dll	467		GetCPInfo
KERNEL32.dll	537		GetConsoleWindow
KERNEL32.dll	443		FreeConsole
KERNEL32.dll	22		AllocConsole
KERNEL32.dll	382		FileTimeToLocalFileTime
KERNEL32.dll	383		FileTimeToSystemTime
KERNEL32.dll	1360		SetThreadPriority
KERNEL32.dll	1317		SetLastError
KERNEL32.dll	675		GetNumberFormatW
KERNEL32.dll	796		GetTimeFormatW
KERNEL32.dll	754		GetSystemDirectoryW
KERNEL32.dll	804		GetUserDefaultLangID
KERNEL32.dll	239		CreateProcessW
KERNEL32.dll	1230		SearchPathW
KERNEL32.dll	564		GetDateFormatW
KERNEL32.dll	750		GetSystemDefaultLangID
KERNEL32.dll	976		LocalFree
KERNEL32.dll	972		LocalAlloc
KERNEL32.dll	1424		TlsAlloc
KERNEL32.dll	1427		TlsSetValue
KERNEL32.dll	1426		TlsGetValue
KERNEL32.dll	240		CreateRemoteThread
KERNEL32.dll	624		GetLastError
KERNEL32.dll	372		ExitThread
KERNEL32.dll	371		ExitProcess
KERNEL32.dll	288		DeleteFiber
KERNEL32.dll	791		GetTickCount
KERNEL32.dll	176		ConvertThreadToFiber
KERNEL32.dll	845		GlobalSize
KERNEL32.dll	837		GlobalFree
KERNEL32.dll	700		GetProcAddress
KERNEL32.dll	848		GlobalUnlock
KERNEL32.dll	966		LoadLibraryW
KERNEL32.dll	830		GlobalAlloc
KERNEL32.dll	647		GetModuleHandleW
KERNEL32.dll	628		GetLocaleInfoW
KERNEL32.dll	841		GlobalLock
KERNEL32.dll	256		CreateThread
KERNEL32.dll	435		FlushFileBuffers
KERNEL32.dll	965		LoadLibraryExW
KERNEL32.dll	1341		SetStdHandle
KERNEL32.dll	1048		OutputDebugStringW
KERNEL32.dll	1116		ReadFile
KERNEL32.dll	1114		ReadConsoleW
KERNEL32.dll	1536		WriteConsoleW
KERNEL32.dll	863		HeapSize
KERNEL32.dll	214		CreateFileW
USER32.dll	16		BringWindowToTop
USER32.dll	164		DeleteMenu
USER32.dll	567		LockWorkStation
USER32.dll	261		ExitWindowsEx
USER32.dll	179		DialogBoxParamW
USER32.dll	232		EndDialog
USER32.dll	517		IsIconic
USER32.dll	426		GetSystemMenu
USER32.dll	537		IsWindowVisible
USER32.dll	740		SetMenuDefaultItem
USER32.dll	102		CreateDialogParamW
USER32.dll	728		SetForegroundWindow
USER32.dll	625		PostMessageW
USER32.dll	723		SetDlgItemInt
USER32.dll	700		SendMessageTimeoutW
USER32.dll	513		IsDialogMessageW
USER32.dll	542		LoadAcceleratorsW
USER32.dll	266		FindWindowW
USER32.dll	509		IsChild
USER32.dll	373		GetMessageW
USER32.dll	833		TranslateAcceleratorW
USER32.dll	574		MapDialogRect
USER32.dll	208		DrawMenuBar
USER32.dll	734		SetLayeredWindowAttributes
USER32.dll	10		AppendMenuW
USER32.dll	355		GetMenu
USER32.dll	805		ShowWindowAsync
USER32.dll	626		PostQuitMessage
USER32.dll	106		CreateIconIndirect
USER32.dll	533		IsWindowEnabled
USER32.dll	320		GetDlgItemInt
USER32.dll	330		GetGuiResources
USER32.dll	516		IsHungAppWindow
USER32.dll	615		OpenWindowStationW
USER32.dll	441		GetUserObjectInformationW
USER32.dll	76		CloseDesktop
USER32.dll	241		EnumDesktopsW
USER32.dll	610		OpenDesktopW
USER32.dll	404		GetProcessWindowStation
USER32.dll	80		CloseWindowStation
USER32.dll	100		CreateDialogIndirectParamW
USER32.dll	256		EnumWindows
USER32.dll	170		DestroyIcon
USER32.dll	792		SetWindowTextW
USER32.dll	73		ClientToScreen
USER32.dll	461		GetWindowPlacement
USER32.dll	265		FindWindowExW
USER32.dll	595		MonitorFromRect
USER32.dll	229		EnableWindow
USER32.dll	294		GetClassNameW
USER32.dll	319		GetDlgItem
USER32.dll	741		SetMenuInfo
USER32.dll	470		GetWindowThreadProcessId
USER32.dll	161		DefWindowProcW
USER32.dll	784		SetWindowLongPtrW
USER32.dll	498		InvalidateRect
USER32.dll	650		RegisterClassExW
USER32.dll	14		BeginPaint
USER32.dll	296		GetClientRect
USER32.dll	455		GetWindowLongPtrW
USER32.dll	548		LoadCursorW
USER32.dll	828		TrackMouseEvent
USER32.dll	234		EndPaint
USER32.dll	701		SendMessageW
USER32.dll	653		RegisterClipboardFormatW
USER32.dll	171		DestroyMenu
USER32.dll	361		GetMenuItemCount
USER32.dll	110		CreatePopupMenu
USER32.dll	560		LoadMenuW
USER32.dll	493		InsertMenuItemW
USER32.dll	364		GetMenuItemInfoW
USER32.dll	423		GetSubMenu
USER32.dll	829		TrackPopupMenu
USER32.dll	30		CallWindowProcW
USER32.dll	407		GetPropW
USER32.dll	787		SetWindowPos
USER32.dll	756		SetPropW
USER32.dll	682		RemovePropW
USER32.dll	716		SetCursor
USER32.dll	113		CreateWindowExW
USER32.dll	269		FrameRect
USER32.dll	310		GetCursorPos
USER32.dll	678		ReleaseDC
USER32.dll	312		GetDCEx
USER32.dll	311		GetDC
USER32.dll	380		GetParent
USER32.dll	215		DrawTextW
USER32.dll	262		FillRect
USER32.dll	686		ScreenToClient
USER32.dll	173		DestroyWindow
USER32.dll	744		SetMenuItemInfoW
USER32.dll	230		EndDeferWindowPos
USER32.dll	713		SetClipboardData
USER32.dll	579		MapWindowPoints
USER32.dll	13		BeginDeferWindowPos
USER32.dll	162		DeferWindowPos
USER32.dll	608		OpenClipboard
USER32.dll	224		EmptyClipboard
USER32.dll	225		EnableMenuItem
USER32.dll	469		GetWindowTextW
USER32.dll	550		LoadIconW
USER32.dll	552		LoadImageW
USER32.dll	462		GetWindowRect
USER32.dll	75		CloseClipboard
USER32.dll	468		GetWindowTextLengthW
USER32.dll	759		SetScrollInfo
USER32.dll	707		SetCaretPos
USER32.dll	677		ReleaseCapture
USER32.dll	91		CreateCaret
USER32.dll	227		EnableScrollBar
USER32.dll	424		GetSysColor
USER32.dll	167		DestroyCaret
USER32.dll	646		RedrawWindow
USER32.dll	760		SetScrollPos
USER32.dll	819		SystemParametersInfoW
USER32.dll	299		GetClipboardData
USER32.dll	418		GetScrollInfo
USER32.dll	196		DragDetect
USER32.dll	635		PtInRect
USER32.dll	798		ShowCaret
USER32.dll	727		SetFocus
USER32.dll	341		GetKeyState
USER32.dll	705		SetCapture
USER32.dll	331		GetIconInfo
USER32.dll	207		DrawIconEx
USER32.dll	182		DispatchMessageW
USER32.dll	597		MoveWindow
USER32.dll	375		GetMonitorInfoW
USER32.dll	591		MessageBoxW
USER32.dll	596		MonitorFromWindow
USER32.dll	622		PeekMessageW
USER32.dll	835		TranslateMessage
USER32.dll	598		MsgWaitForMultipleObjects
USER32.dll	371		GetMessagePos
USER32.dll	372		GetMessageTime
USER32.dll	859		UpdateWindow
USER32.dll	427		GetSystemMetrics
USER32.dll	690		ScrollWindowEx
USER32.dll	532		IsWindow
USER32.dll	425		GetSysColorBrush
USER32.dll	804		ShowWindow
USER32.dll	718		SetCursorPos
USER32.dll	279		GetAsyncKeyState
USER32.dll	203		DrawFocusRect
USER32.dll	282		GetCapture
USER32.dll	437		GetUpdateRect
USER32.dll	882		WaitMessage
USER32.dll	583		MessageBeep
USER32.dll	499		InvalidateRgn
USER32.dll	540		KillTimer
USER32.dll	771		SetTimer
USER32.dll	438		GetUpdateRgn
USER32.dll	725		SetDlgItemTextW
GDI32.dll	727		SetDCBrushColor
GDI32.dll	261		DeleteObject
GDI32.dll	641		Polyline
GDI32.dll	362		GdiAlphaBlend
GDI32.dll	49		CreateCompatibleDC
GDI32.dll	721		SetBkMode
GDI32.dll	54		CreateDIBSection
GDI32.dll	640		Polygon
GDI32.dll	258		DeleteDC
GDI32.dll	760		SetTextColor
GDI32.dll	574		GetTextExtentPoint32W
GDI32.dll	19		BitBlt
GDI32.dll	779		TextOutW
GDI32.dll	66		CreateFontW
GDI32.dll	48		CreateCompatibleBitmap
GDI32.dll	713		SelectObject
GDI32.dll	477		GetCharWidthW
GDI32.dll	490		GetDIBits
GDI32.dll	659		RestoreDC
GDI32.dll	592		IntersectClipRect
GDI32.dll	80		CreateRectRgn
GDI32.dll	666		SaveDC
GDI32.dll	34		CombineRgn
GDI32.dll	722		SetBoundsRect
GDI32.dll	336		ExcludeClipRect
GDI32.dll	65		CreateFontIndirectW
GDI32.dll	582		GetTextMetricsW
GDI32.dll	481		GetClipRgn
GDI32.dll	541		GetObjectW
GDI32.dll	491		GetDeviceCaps
GDI32.dll	649		Rectangle
GDI32.dll	728		SetDCPenColor
GDI32.dll	557		GetStockObject
GDI32.dll	720		SetBkColor
GDI32.dll	711		SelectClipRgn
COMDLG32.dll	14		GetSaveFileNameW
COMDLG32.dll	12		GetOpenFileNameW
COMDLG32.dll	1		ChooseColorW
COMDLG32.dll	3		ChooseFontW
ADVAPI32.dll	469		LsaOpenPolicy
ADVAPI32.dll	443		LsaEnumerateAccounts
ADVAPI32.dll	749		SetServiceStatus
ADVAPI32.dll	687		RegisterServiceCtrlHandlerExW
ADVAPI32.dll	757		StartServiceCtrlDispatcherW
ADVAPI32.dll	93		ChangeServiceConfigW
ADVAPI32.dll	432		LsaAddAccountRights
ADVAPI32.dll	274		EnumServicesStatusExW
ADVAPI32.dll	587		QueryServiceConfigW
ADVAPI32.dll	91		ChangeServiceConfig2W
ADVAPI32.dll	144		CreateServiceW
ADVAPI32.dll	101		CloseServiceHandle
ADVAPI32.dll	234		DeleteService
ADVAPI32.dll	532		OpenSCManagerW
ADVAPI32.dll	534		OpenServiceW
ADVAPI32.dll	758		StartServiceW
ADVAPI32.dll	106		ControlService
ADVAPI32.dll	464		LsaLookupSids
ADVAPI32.dll	585		QueryServiceConfig2W
ADVAPI32.dll	463		LsaLookupPrivilegeValue
ADVAPI32.dll	461		LsaLookupPrivilegeDisplayName
ADVAPI32.dll	460		LsaLookupNames2
ADVAPI32.dll	435		LsaClose
ADVAPI32.dll	462		LsaLookupPrivilegeName
ADVAPI32.dll	449		LsaFreeMemory
ADVAPI32.dll	354		GetSecurityInfo
ADVAPI32.dll	744		SetSecurityInfo
ADVAPI32.dll	140		CreateProcessWithLogonW
ADVAPI32.dll	419		LogonUserW
ADVAPI32.dll	446		LsaEnumeratePrivilegesOfAccount
ADVAPI32.dll	139		CreateProcessAsUserW
ADVAPI32.dll	468		LsaOpenAccount
SHELL32.dll	318		Shell_NotifyIconW
SHELL32.dll	205		SHGetFolderPathW
SHELL32.dll	305		ShellExecuteExW
SHELL32.dll	43		ExtractIconExW
SHELL32.dll	195		SHGetFileInfoW
SHELL32.dll	35		DuplicateIcon
SHELL32.dll	145		SHCreateDirectoryExW
ole32.dll	125		CoTaskMemFree
ole32.dll	29		CoCreateInstance
ole32.dll	83		CoInitializeEx
ole32.dll	129		CoUninitialize
OLEAUT32.dll		6

ord	entry_va	function_name
1	0x1a070	KphCaptureStackBackTraceThread
2	0x19040	KphConnect
3	0x19150	KphConnect2
4	0x19160	KphConnect2Ex
5	0x193f0	KphDisconnect
6	0x1a330	KphDuplicateObject
7	0x1a1d0	KphEnumerateProcessHandles
8	0x19fb0	KphGetContextThread
9	0x19940	KphGetFeatures
10	0x196e0	KphInstall
11	0x196f0	KphInstallEx
12	0x19450	KphIsConnected
13	0x1a3e0	KphOpenDriver
14	0x199a0	KphOpenProcess
15	0x19a60	KphOpenProcessJob
16	0x19a00	KphOpenProcessToken
17	0x19e20	KphOpenThread
18	0x19e80	KphOpenThreadProcess
19	0x1a440	KphQueryInformationDriver
20	0x1a240	KphQueryInformationObject
21	0x19d40	KphQueryInformationProcess
22	0x1a0f0	KphQueryInformationThread
23	0x19bf0	KphReadVirtualMemory
24	0x19cd0	KphReadVirtualMemoryUnsafe
25	0x19b20	KphResumeProcess
26	0x1a010	KphSetContextThread
27	0x1a2c0	KphSetInformationObject
28	0x19db0	KphSetInformationProcess
29	0x1a160	KphSetInformationThread
30	0x19460	KphSetParameters
31	0x19ac0	KphSuspendProcess
32	0x19b80	KphTerminateProcess
33	0x19ee0	KphTerminateThread
34	0x19f50	KphTerminateThreadUnsafe
35	0x19850	KphUninstall
36	0x19c60	KphWriteVirtualMemory
37	0x10070	PhAddComboBoxStrings
38	0x5cf0	PhAddElementAvlTree
39	0x3e30	PhAddEntryHashtable
40	0x3f40	PhAddEntryHashtableEx
41	0x3730	PhAddItemList
42	0x3a50	PhAddItemPointerList
43	0x4480	PhAddItemSimpleHashtable
44	0x3790	PhAddItemsList
45	0x10e00	PhAddLayoutItem
46	0x10e90	PhAddLayoutItemEx
47	0xf6a0	PhAddListViewColumn
48	0xf700	PhAddListViewItem
49	0x90d80	PhAddProcessPropPage
50	0x90df0	PhAddProcessPropPage2
51	0x91010	PhAddPropPageLayoutItem
52	0xb22e0	PhAddSettings
53	0xff80	PhAddTabControlTab
54	0x4b1b0	PhAddTreeNewFilter
55	0x2a480	PhAdjustRectangleToBounds
56	0x2a520	PhAdjustRectangleToWorkingArea
57	0x1400	PhAllocate
58	0x1440	PhAllocateExSafe
59	0x45f0	PhAllocateFromFreeList
60	0x14c0	PhAllocatePage
61	0x1420	PhAllocateSafe
62	0x3310	PhAppendCharStringBuilder
63	0x3370	PhAppendCharStringBuilder2
64	0x3410	PhAppendFormatStringBuilder
65	0x3260	PhAppendStringBuilder
66	0x3270	PhAppendStringBuilder2
67	0x3290	PhAppendStringBuilderEx
68	0x1298d8	PhApplicationFont
69	0x11c8d8	PhApplicationName
70	0x4b330	PhApplyTreeNewFilters
71	0x26650	PhBoostProvider
72	0x4a20	PhBufferToHexString
73	0x2a4f0	PhCenterRectangle
74	0x2a600	PhCenterWindow
75	0x1c230	PhCheckSumMappedImage
76	0x57f0	PhClearCircularBuffer_FLOAT
77	0x57f0	PhClearCircularBuffer_PVOID
78	0x57f0	PhClearCircularBuffer_SIZE_T
79	0x57f0	PhClearCircularBuffer_ULONG
80	0x57f0	PhClearCircularBuffer_ULONG64
81	0x4080	PhClearHashtable
82	0x3810	PhClearList
83	0x4ed30	PhCmLoadSettings
84	0x4f750	PhCmSaveSettings
85	0x1c70	PhCompareStringRef
86	0x2b920	PhCompareUnicodeStringZIgnoreMenuPrefix
87	0x18e0	PhCompareUnicodeStringZNatural
88	0x2da0	PhConcatStringRef2
89	0x2b60	PhConcatStrings
90	0x2cc0	PhConcatStrings2
91	0x2b90	PhConcatStrings_V
92	0x16d0	PhCopyAnsiStringZ
93	0x5800	PhCopyCircularBuffer_FLOAT
94	0x5a20	PhCopyCircularBuffer_PVOID
95	0x5a20	PhCopyCircularBuffer_SIZE_T
96	0x5800	PhCopyCircularBuffer_ULONG
97	0x5a20	PhCopyCircularBuffer_ULONG64
98	0x49ea0	PhCopyListView
99	0x49e00	PhCopyListViewInfoTip
100	0x1760	PhCopyUnicodeStringZ
101	0x1800	PhCopyUnicodeStringZFromAnsi
102	0x27a90	PhCreateAlloc
103	0x2f30	PhCreateAnsiString
104	0x2f50	PhCreateAnsiStringEx
105	0x2fe0	PhCreateAnsiStringFromUnicode
106	0x3000	PhCreateAnsiStringFromUnicodeEx
107	0x8250	PhCreateDsObjectPickerDialog
108	0x9040	PhCreateEMenu
109	0x8780	PhCreateEMenuItem
110	0x18260	PhCreateFileStream
111	0x18490	PhCreateFileStream2
112	0x17b40	PhCreateFileWin32
113	0x17b80	PhCreateFileWin32Ex
114	0x11950	PhCreateHandle
115	0x114e0	PhCreateHandleTable
116	0x3b80	PhCreateHashtable
117	0x25ee0	PhCreateKey
118	0x3640	PhCreateList
119	0x273f0	PhCreateObject
120	0x275a0	PhCreateObjectType
121	0x276b0	PhCreateObjectTypeEx
122	0x2fb90	PhCreateOpenFileDialog
123	0x39b0	PhCreatePointerList
124	0x2dc90	PhCreateProcess
125	0x2e190	PhCreateProcessAsUser
126	0x905f0	PhCreateProcessPropContext
127	0x90e20	PhCreateProcessPropPageContext
128	0x90e30	PhCreateProcessPropPageContextEx
129	0x2ded0	PhCreateProcessWin32
130	0x2df20	PhCreateProcessWin32Ex
131	0x2fca0	PhCreateSaveFileDialog
132	0x28340	PhCreateSecurityPage
133	0xb2960	PhCreateServiceListControl
134	0x4460	PhCreateSimpleHashtable
135	0x2930	PhCreateString
136	0x2950	PhCreateStringEx
137	0x29e0	PhCreateStringFromAnsi
138	0x2a00	PhCreateStringFromAnsiEx
139	0x32610	PhCreateSymbolProvider
140	0x1240	PhCreateThread
141	0x129cbc	PhCurrentSessionId
142	0x123e78	PhCurrentTokenQueryHandle
143	0x27b40	PhDeleteAutoPool
144	0x46a0	PhDeleteCallback
145	0x3a30	PhDeleteCircularBuffer_FLOAT
146	0x3a30	PhDeleteCircularBuffer_PVOID
147	0x3a30	PhDeleteCircularBuffer_SIZE_T
148	0x3a30	PhDeleteCircularBuffer_ULONG
149	0x3a30	PhDeleteCircularBuffer_ULONG64
150	0xa6a0	PhDeleteFastLock
151	0x17d40	PhDeleteFileWin32
152	0x45b0	PhDeleteFreeList
153	0xf3c0	PhDeleteGraphState
154	0x2ca30	PhDeleteImageVersionInfo
155	0x10da0	PhDeleteLayoutManager
156	0x46a0	PhDeleteProviderThread
157	0x3160	PhDeleteStringBuilder
158	0x4b180	PhDeleteTreeNewColumnMenu
159	0x3e910	PhDeleteWorkQueue
160	0x27490	PhDereferenceObject
161	0x274a0	PhDereferenceObjectDeferDelete
162	0x27510	PhDereferenceObjectEx
163	0x2a830	PhDereferenceObjects
164	0x9f270	PhDereferenceProcessRecord
165	0xa94b0	PhDeselectAllProcessNodes
166	0xb5050	PhDeselectAllServiceNodes
167	0x90f0	PhDestroyEMenu
168	0x88b0	PhDestroyEMenuItem
169	0x119d0	PhDestroyHandle
170	0x11590	PhDestroyHandleTable
171	0x17e80	PhDisconnectNamedPipe
172	0x911b0	PhDoPropPageLayout
173	0x98e0	PhDosErrorToNtStatus
174	0x27c90	PhDrainAutoPool
175	0xd450	PhDrawGraph
176	0xdb70	PhDrawGraphDirect
177	0x1570	PhDuplicateAnsiStringZ
178	0x15e0	PhDuplicateAnsiStringZSafe
179	0x21910	PhDuplicateObject
180	0x1660	PhDuplicateUnicodeStringZ
181	0x284e0	PhEditSecurity
182	0x129cb8	PhElevated
183	0x129ca4	PhElevationType
184	0x2b360	PhEllipsisString
185	0x2b440	PhEllipsisStringPath
186	0x10510	PhEnableAllMenuItems
187	0x104f0	PhEnableMenuItem
188	0x6190	PhEnumAvlTree
189	0x574b0	PhEnumCsrProcessHandles
190	0x23dc0	PhEnumDirectoryFile
191	0x23b30	PhEnumDirectoryObjects
192	0x23f20	PhEnumFileStreams
193	0x259d0	PhEnumGenericModules
194	0x11b70	PhEnumHandleTable
195	0x23230	PhEnumHandles
196	0x23330	PhEnumHandlesEx
197	0x40c0	PhEnumHashtable
198	0x570e0	PhEnumHiddenProcesses
199	0x22c90	PhEnumKernelModules
200	0x23430	PhEnumPagefiles
201	0x3ae0	PhEnumPointerListEx
202	0x1ecd0	PhEnumProcessEnvironmentVariables
203	0x1f060	PhEnumProcessHandles
204	0x9b2e0	PhEnumProcessItems
205	0x21f30	PhEnumProcessModules
206	0x22950	PhEnumProcessModules32
207	0x22980	PhEnumProcessModules32Ex
208	0x21f60	PhEnumProcessModulesEx
209	0x22e30	PhEnumProcesses
210	0x22ff0	PhEnumProcessesEx
211	0x22f00	PhEnumProcessesForSession
212	0x31a50	PhEnumServices
213	0x1d50	PhEqualStringRef
214	0x31130	PhEscapeCommandLinePart
215	0x2b750	PhEscapeStringForMenuPrefix
216	0xa94d0	PhExpandAllProcessNodes
217	0x2d1b0	PhExpandEnvironmentStrings
218	0x4940	PhExponentiate
219	0x4970	PhExponentiate64
220	0x30ab0	PhFinalHash
221	0x3250	PhFinalStringBuilderString
222	0x1ec0	PhFindCharInStringRef
223	0x88e0	PhFindEMenuItem
224	0x5f90	PhFindElementAvlTree
225	0x6000	PhFindElementAvlTree2
226	0x4100	PhFindEntryHashtable
227	0x2afa0	PhFindIntegerSiKeyValuePairs
228	0x3820	PhFindItemList
229	0x3b30	PhFindItemPointerList
230	0x44b0	PhFindItemSimpleHashtable
231	0x1fd0	PhFindLastCharInStringRef
232	0xf740	PhFindListViewItemByFlags
233	0xf760	PhFindListViewItemByParam
234	0x2d590	PhFindLoaderEntry
235	0x73e40	PhFindNetworkNode
236	0x8ef00	PhFindPlugin
237	0x230c0	PhFindProcessInformation
238	0x230e0	PhFindProcessInformationByImageName
239	0xa2730	PhFindProcessNode
240	0x9f2f0	PhFindProcessRecord
241	0xb3c50	PhFindServiceNode
242	0x20f0	PhFindStringInStringRef
243	0x2b040	PhFindStringSiKeyValuePairs
244	0x18a80	PhFlushFileStream
245	0xaa20	PhFormat
246	0x2ba10	PhFormatDate
247	0x2bbf0	PhFormatDateTime
248	0x2c280	PhFormatDecimal
249	0x2c4d0	PhFormatGuid
250	0x2cab0	PhFormatImageVersionInfo
251	0x5f530	PhFormatLogEntry
252	0x15590	PhFormatNativeKeyName
253	0x2c490	PhFormatSize
254	0x2e50	PhFormatString
255	0x2e80	PhFormatString_V
256	0x2bb00	PhFormatTime
257	0x2bd50	PhFormatTimeSpanRelative
258	0xbf10	PhFormatToBuffer
259	0x2c250	PhFormatUInt64
260	0x1460	PhFree
261	0x8240	PhFreeDsObjectPickerDialog
262	0x8700	PhFreeDsObjectPickerObjects
263	0x2fdb0	PhFreeFileDialog
264	0x1530	PhFreePage
265	0x4640	PhFreeToFreeList
266	0x2b080	PhGenerateGuid
267	0x2b150	PhGenerateGuidFromName
268	0x2b2e0	PhGenerateRandomAlphaString
269	0x27d50	PhGetAccessEntries
270	0x28070	PhGetAccessString
271	0x2da20	PhGetApplicationDirectory
272	0x2d950	PhGetApplicationFileName
273	0x2d360	PhGetBaseName
274	0x9aa20	PhGetClientIdName
275	0x9ab20	PhGetClientIdNameEx
276	0x100c0	PhGetComboBoxString
277	0x2d850	PhGetDllFileName
278	0xf2c0	PhGetDrawInfoGraphBuffers
279	0x21420	PhGetDriverServiceKeyName
280	0x26770	PhGetEnabledProvider
281	0x20fa0	PhGetEnlistmentBasicInformation
282	0x30520	PhGetFileDialogFileName
283	0x30160	PhGetFileDialogFilterIndex
284	0x2fea0	PhGetFileDialogOptions
285	0x24eb0	PhGetFileName
286	0x10a80	PhGetFileShellIcon
287	0x209d0	PhGetFileSize
288	0x2c520	PhGetFileVersionInfo
289	0x2c5c0	PhGetFileVersionInfoLangCodePage
290	0x2c600	PhGetFileVersionInfoString
291	0x2c650	PhGetFileVersionInfoString2
292	0x73b90	PhGetFilterSupportNetworkTreeList
293	0xa2110	PhGetFilterSupportProcessTreeList
294	0xb39e0	PhGetFilterSupportServiceTreeList
295	0x2d020	PhGetFullPath
296	0x8efa0	PhGetGeneralCallback
297	0x77c0	PhGetGenericTreeNewLines
298	0x16ee0	PhGetHandleInformation
299	0x16f40	PhGetHandleInformationEx
300	0xb0e60	PhGetIntegerPairSetting
301	0xb0d40	PhGetIntegerSetting
302	0x20430	PhGetJobProcessIdList
303	0x22d40	PhGetKernelFileName
304	0x2da90	PhGetKnownLocation
305	0x32a20	PhGetLineFromAddress
306	0x10250	PhGetListBoxString
307	0x49f20	PhGetListViewContextMenuPoint
308	0xf790	PhGetListViewItemImageIndex
309	0xf7f0	PhGetListViewItemParam
310	0x1c870	PhGetMappedArchiveImportEntry
311	0x1b160	PhGetMappedImageDataEntry
312	0x1c100	PhGetMappedImageDelayImports
313	0x1b830	PhGetMappedImageExportEntry
314	0x1b920	PhGetMappedImageExportFunction
315	0x1ba40	PhGetMappedImageExportFunctionRemote
316	0x1b570	PhGetMappedImageExports
317	0x1bd20	PhGetMappedImageImportDll
318	0x1c030	PhGetMappedImageImportEntry
319	0x1bbf0	PhGetMappedImageImports
320	0x1b2c0	PhGetMappedImageLoadConfig32
321	0x1b2e0	PhGetMappedImageLoadConfig64
322	0x1b0e0	PhGetMappedImageSectionName
323	0x6dd30	PhGetMemoryProtectionString
324	0x6de70	PhGetMemoryStateString
325	0x6deb0	PhGetMemoryTypeString
326	0x2a870	PhGetMessage
327	0x32bd0	PhGetModuleFromAddress
328	0x1c410	PhGetNextMappedArchiveMember
329	0x2a940	PhGetNtMessage
330	0x1d5a0	PhGetObjectSecurity
331	0x27590	PhGetObjectType
332	0x277f0	PhGetObjectTypeInformation
333	0x4a350	PhGetPhVersion
334	0x4a3b0	PhGetPhVersionNumbers
335	0x8ef70	PhGetPluginCallback
336	0x18b00	PhGetPositionFileStream
337	0x48d0	PhGetPrimeNumber
338	0x22b30	PhGetProcedureAddressRemote
339	0x1e500	PhGetProcessDepStatus
340	0x1e910	PhGetProcessEnvironment
341	0x1e460	PhGetProcessExecuteFlags
342	0x1d920	PhGetProcessImageFileName
343	0x23510	PhGetProcessImageFileNameByProcessId
344	0x1d9f0	PhGetProcessImageFileNameWin32
345	0x23610	PhGetProcessIsDotNet
346	0x23820	PhGetProcessIsDotNetEx
347	0x1e330	PhGetProcessIsPosix
348	0x47c50	PhGetProcessIsSuspended
349	0x481e0	PhGetProcessKnownType
350	0x1ed80	PhGetProcessMappedFileName
351	0x1dac0	PhGetProcessPebString
352	0x1e5e0	PhGetProcessPosixCommandLine
353	0x9ac90	PhGetProcessPriorityClassString
354	0x1df20	PhGetProcessWindowTitle
355	0x1ee80	PhGetProcessWorkingSetInformation
356	0x1ef80	PhGetProcessWsCounters
357	0x76da0	PhGetProtocolTypeName
358	0x20ef0	PhGetResourceManagerBasicInformation
359	0x26760	PhGetRunIdProvider
360	0x28b80	PhGetSeObjectSecurity
361	0x10640	PhGetSelectedListViewItemParam
362	0x106b0	PhGetSelectedListViewItemParams
363	0xa9340	PhGetSelectedProcessItem
364	0xa9370	PhGetSelectedProcessItems
365	0xb4ee0	PhGetSelectedServiceItem
366	0xb4f10	PhGetSelectedServiceItems
367	0xb6500	PhGetServiceChange
368	0x31c30	PhGetServiceConfig
369	0x31e40	PhGetServiceDelayedAutoStart
370	0x31dd0	PhGetServiceDescription
371	0x320c0	PhGetServiceErrorControlInteger
372	0x32080	PhGetServiceErrorControlString
373	0x32140	PhGetServiceNameFromTag
374	0x32000	PhGetServiceStartTypeInteger
375	0x31fc0	PhGetServiceStartTypeString
376	0x31ec0	PhGetServiceStateString
377	0x31f40	PhGetServiceTypeInteger
378	0x31f00	PhGetServiceTypeString
379	0x1aa40	PhGetSidFullName
380	0x9d420	PhGetStatisticsTime
381	0x9d490	PhGetStatisticsTimeString
382	0x108c0	PhGetStockApplicationIcon
383	0xb0f80	PhGetStringSetting
384	0x32da0	PhGetSymbolFromAddress
385	0x332a0	PhGetSymbolFromName
386	0x2d3c0	PhGetSystemDirectory
387	0x2d530	PhGetSystemRoot
388	0x76de0	PhGetTcpStateName
389	0x1d740	PhGetThreadContext
390	0xc4880	PhGetThreadPriorityWin32String
391	0x32210	PhGetThreadServiceTag
392	0x20600	PhGetTokenGroups
393	0x20790	PhGetTokenIntegrityLevel
394	0x205e0	PhGetTokenOwner
395	0x205f0	PhGetTokenPrimaryGroup
396	0x20610	PhGetTokenPrivileges
397	0x205d0	PhGetTokenUser
398	0x20d00	PhGetTransactionBasicInformation
399	0x20b40	PhGetTransactionManagerBasicInformation
400	0x20b80	PhGetTransactionManagerLogFileName
401	0x20d40	PhGetTransactionPropertiesInformation
402	0x7380	PhGetTreeNewText
403	0x2aa20	PhGetWin32Message
404	0xffb0	PhGetWindowText
405	0xf440	PhGraphStateGetDrawInfo
406	0x49ee0	PhHandleListViewNotifyForCopy
407	0x4afa0	PhHandleTreeNewColumnMenu
408	0x129d08	PhHeapHandle
409	0x49b0	PhHexStringToBuffer
410	0x17870	PhIconToBitmap
411	0x18220	PhImpersonateClientOfNamedPipe
412	0x8d30	PhIndexOfEMenuItem
413	0x27ae0	PhInitializeAutoPool
414	0x5ac0	PhInitializeAvlTree
415	0x4680	PhInitializeCallback
416	0x5670	PhInitializeCircularBuffer_FLOAT
417	0x58a0	PhInitializeCircularBuffer_PVOID
418	0x58a0	PhInitializeCircularBuffer_SIZE_T
419	0x5670	PhInitializeCircularBuffer_ULONG
420	0x58a0	PhInitializeCircularBuffer_ULONG64
421	0xa690	PhInitializeFastLock
422	0x4570	PhInitializeFreeList
423	0xf3a0	PhInitializeGraphState
424	0x30990	PhInitializeHash
425	0x2c7f0	PhInitializeImageVersionInfo
426	0x10ce0	PhInitializeLayoutManager
427	0x1c2a0	PhInitializeMappedArchive
428	0x1ac30	PhInitializeMappedImage
429	0x26130	PhInitializeProviderThread
430	0x30d0	PhInitializeStringBuilder
431	0x4abe0	PhInitializeTreeNewColumnMenu
432	0x3e8b0	PhInitializeWorkQueue
433	0x1f510	PhInjectDllProcess
434	0x8d60	PhInsertEMenuItem
435	0x3850	PhInsertItemList
436	0x3870	PhInsertItemsList
437	0x34f0	PhInsertStringBuilder
438	0x3500	PhInsertStringBuilder2
439	0x3520	PhInsertStringBuilderEx
440	0x4c90	PhIntegerToString64
441	0xa9560	PhInvalidateAllProcessNodes
442	0x4800	PhInvokeCallback
443	0x307d0	PhIsExecutablePacked
444	0x1c860	PhIsMappedArchiveMemberShortFormat
445	0x11210	PhLayoutManagerLayout
446	0x129d00	PhLibImageBase
447	0x17e40	PhListenNamedPipe
448	0xf940	PhLoadListViewColumnSettings
449	0x4a2d0	PhLoadListViewColumnsFromSetting
450	0x1c3c0	PhLoadMappedArchive
451	0x1ad20	PhLoadMappedImage
452	0x33490	PhLoadModuleSymbolProvider
453	0x9620	PhLoadResourceEMenuItem
454	0x49cb0	PhLoadSymbolProviderOptions
455	0x4a040	PhLoadWindowPlacementFromSetting
456	0x13c0	PhLocalTimeToSystemTime
457	0x18c60	PhLockFileStream
458	0x117a0	PhLockHandleTableEntry
459	0x49a0	PhLog2
460	0x5f4b0	PhLogMessageEntry
461	0x11f5c8	PhLoggedCallback
462	0x11ad0	PhLookupHandleTableEntry
463	0x1a8c0	PhLookupName
464	0x1a700	PhLookupPrivilegeDisplayName
465	0x1a690	PhLookupPrivilegeName
466	0x1a770	PhLookupPrivilegeValue
467	0x1a7b0	PhLookupSid
468	0x129850	PhMainWndHandle
469	0x2f980	PhMapFlags1
470	0x2f9e0	PhMapFlags2
471	0x1ad80	PhMapViewOfEntireFile
472	0x1aff0	PhMappedImageRvaToSection
473	0x1b050	PhMappedImageRvaToVa
474	0x2b5d0	PhMatchWildcards
475	0x60c0	PhMaximumElementAvlTree
476	0x6090	PhMinimumElementAvlTree
477	0x11fac8	PhNetworkItemAddedEvent
478	0x11faa8	PhNetworkItemModifiedEvent
479	0x11fa88	PhNetworkItemRemovedEvent
480	0x11fae8	PhNetworkItemsUpdatedEvent
481	0x99e0	PhNtStatusFileNotFound
482	0x98c0	PhNtStatusToDosError
483	0x211f0	PhOpenDriverByBaseAddress
484	0x25fc0	PhOpenKey
485	0x1a5c0	PhOpenLsaPolicy
486	0x1d2a0	PhOpenProcess
487	0x57710	PhOpenProcessByCsrHandle
488	0x578b0	PhOpenProcessByCsrHandles
489	0x1d500	PhOpenProcessToken
490	0x31bc0	PhOpenService
491	0x1d370	PhOpenThread
492	0x1d440	PhOpenThreadProcess
493	0x1d580	PhOpenThreadToken
494	0x129b80	PhOsVersion
495	0x30df0	PhParseCommandLine
496	0x31400	PhParseCommandLineFuzzy
497	0x30b60	PhParseCommandLinePart
498	0x17ee0	PhPeekNamedPipe
499	0x8eff0	PhPluginAddMenuItem
500	0x8f380	PhPluginAddTreeNewColumn
501	0x8f260	PhPluginCreateEMenuItem
502	0x8f430	PhPluginEnableTreeNewNotify
503	0x8f3d0	PhPluginGetObjectExtension
504	0x8f070	PhPluginGetSystemStatistics
505	0x8f400	PhPluginRegisterIcon
506	0x8efd0	PhPluginReserveIds
507	0x8f3c0	PhPluginSetObjectExtension
508	0x8f340	PhPluginTriggerEMenuItem
509	0x6140	PhPredecessorElementAvlTree
510	0x4cf0	PhPrintTimeSpan
511	0x120168	PhProcessAddedEvent
512	0x120188	PhProcessModifiedEvent
513	0x120148	PhProcessRemovedEvent
514	0x120128	PhProcessesUpdatedEvent
515	0x90ff0	PhPropPageDlgProcDestroy
516	0x90f60	PhPropPageDlgProcHeader
517	0x17cb0	PhQueryFullAttributesFileWin32
518	0x11d30	PhQueryInformationHandleTable
519	0x2f910	PhQueryRegistryString
520	0x31cf0	PhQueryServiceVariableSize
521	0x1320	PhQuerySystemTime
522	0x1350	PhQueryTimeZoneBias
523	0x3ee30	PhQueueItemGlobalWorkQueue
524	0x3ecf0	PhQueueItemWorkQueue
525	0x1480	PhReAllocate
526	0x14a0	PhReAllocateSafe
527	0x18710	PhReadFileStream
528	0x1d820	PhReadVirtualMemory
529	0x2ad0	PhReferenceEmptyString
530	0x75580	PhReferenceNetworkItem
531	0x27440	PhReferenceObject
532	0x27450	PhReferenceObjectEx
533	0x27460	PhReferenceObjectSafe
534	0x2a800	PhReferenceObjects
535	0x9b240	PhReferenceProcessItem
536	0x9f820	PhReferenceProcessItemForParent
537	0x9f8e0	PhReferenceProcessItemForRecord
538	0x9f220	PhReferenceProcessRecord
539	0x9f260	PhReferenceProcessRecordForStatistics
540	0x9f230	PhReferenceProcessRecordSafe
541	0xb63a0	PhReferenceServiceItem
542	0x3240	PhReferenceStringBuilderString
543	0x46b0	PhRegisterCallback
544	0x46d0	PhRegisterCallbackEx
545	0x60e60	PhRegisterDialog
546	0x60f80	PhRegisterMessageLoopFilter
547	0x8ed00	PhRegisterPlugin
548	0x26500	PhRegisterProvider
549	0x8f40	PhRemoveAllEMenuItems
550	0x8e70	PhRemoveEMenuItem
551	0x5e10	PhRemoveElementAvlTree
552	0x4190	PhRemoveEntryHashtable
553	0x3920	PhRemoveItemList
554	0x3b60	PhRemoveItemPointerList
555	0x4550	PhRemoveItemSimpleHashtable
556	0x3960	PhRemoveItemsList
557	0xf850	PhRemoveListViewItem
558	0x35e0	PhRemoveStringBuilder
559	0x4b2b0	PhRemoveTreeNewFilter
560	0x56d0	PhResizeCircularBuffer_FLOAT
561	0x5900	PhResizeCircularBuffer_PVOID
562	0x5900	PhResizeCircularBuffer_SIZE_T
563	0x56d0	PhResizeCircularBuffer_ULONG
564	0x5900	PhResizeCircularBuffer_ULONG64
565	0x36e0	PhResizeList
566	0x247e0	PhResolveDevicePrefix
567	0x1d6f0	PhResumeProcess
568	0x1d730	PhResumeThread
569	0x4910	PhRoundUpToPowerOfTwo
570	0xfe50	PhSaveListViewColumnSettings
571	0x4a310	PhSaveListViewColumnsToSetting
572	0x4a1d0	PhSaveWindowPlacementToSetting
573	0x49930	PhSearchOnlineString
574	0x18bf0	PhSeekFileStream
575	0xa95f0	PhSelectAndEnsureVisibleProcessNode
576	0xb5070	PhSelectAndEnsureVisibleServiceNode
577	0x101e0	PhSelectComboBoxString
578	0x121b60	PhServiceAddedEvent
579	0x121b80	PhServiceModifiedEvent
580	0x121ba0	PhServiceRemovedEvent
581	0x121b40	PhServicesUpdatedEvent
582	0x10c10	PhSetClipboardString
583	0x10c20	PhSetClipboardStringEx
584	0xf680	PhSetControlTheme
585	0x26780	PhSetEnabledProvider
586	0x9b00	PhSetExtendedListView
587	0x30630	PhSetFileDialogFileName
588	0x30190	PhSetFileDialogFilter
589	0x2ff70	PhSetFileDialogOptions
590	0x20a10	PhSetFileSize
591	0x9880	PhSetFlagsAllEMenuItems
592	0x97d0	PhSetFlagsEMenuItem
593	0xe140	PhSetGraphText
594	0xa1b0	PhSetHeaderSortIcon
595	0x10850	PhSetImageListBitmap
596	0x11db0	PhSetInformationHandleTable
597	0xb11f0	PhSetIntegerPairSetting
598	0xb10c0	PhSetIntegerSetting
599	0x264b0	PhSetIntervalProviderThread
600	0xf870	PhSetListViewItemImageIndex
601	0xf8b0	PhSetListViewItemStateImage
602	0xf900	PhSetListViewSubItem
603	0x103f0	PhSetMenuItemBitmap
604	0x1d680	PhSetObjectSecurity
605	0x336e0	PhSetOptionsSymbolProvider
606	0x1f200	PhSetProcessAffinityMask
607	0x1f350	PhSetProcessDepStatus
608	0x1f3f0	PhSetProcessDepStatusInvasive
609	0x1f2d0	PhSetProcessExecuteFlags
610	0x1f230	PhSetProcessIoPriority
611	0x22070	PhSetProcessModuleLoadCount
612	0x22a90	PhSetProcessModuleLoadCount32
613	0x10460	PhSetRadioCheckMenuItem
614	0x28c30	PhSetSeObjectSecurity
615	0x337b0	PhSetSearchPathSymbolProvider
616	0x90830	PhSetSelectThreadIdProcessPropContext
617	0x31e90	PhSetServiceDelayedAutoStart
618	0x105a0	PhSetStateAllListViewItems
619	0xb1310	PhSetStringSetting
620	0xb1470	PhSetStringSetting2
621	0x1fa40	PhSetThreadAffinityMask
622	0x1d7b0	PhSetThreadContext
623	0x1fa70	PhSetThreadIoPriority
624	0x20760	PhSetTokenIsVirtualizationEnabled
625	0x20650	PhSetTokenPrivilege
626	0x20700	PhSetTokenPrivilege2
627	0x20620	PhSetTokenSessionId
628	0x2eec0	PhShellExecute
629	0x2ef30	PhShellExecuteEx
630	0x49960	PhShellExecuteUserString
631	0x2f080	PhShellExploreFile
632	0x2f220	PhShellOpenKey
633	0x2f1b0	PhShellProperties
634	0x4cbd0	PhShowChooseProcessDialog
635	0x2ad70	PhShowConfirmMessage
636	0x10370	PhShowContextMenu
637	0x103b0	PhShowContextMenu2
638	0x2ac90	PhShowContinueStatus
639	0x8360	PhShowDsObjectPickerDialog
640	0x9680	PhShowEMenu
641	0x2fe20	PhShowFileDialog
642	0x69090	PhShowIconNotification
643	0x2aa60	PhShowMessage
644	0x2aad0	PhShowMessage_V
645	0x44490	PhShowProcessAffinityDialog2
646	0x9a790	PhShowProcessProperties
647	0x9f980	PhShowProcessRecordDialog
648	0x2abd0	PhShowStatus
649	0x1ab90	PhSidToStringSid
650	0x23c0	PhSplitStringRefAtChar
651	0x2450	PhSplitStringRefAtLastChar
652	0x24e0	PhSplitStringRefAtString
653	0x2580	PhSplitStringRefEx
654	0x34270	PhStackWalk
655	0x263c0	PhStartProviderThread
656	0x15e10	PhStdGetClientIdName
657	0x28a00	PhStdGetObjectSecurity
658	0x28ac0	PhStdSetObjectSecurity
659	0x26450	PhStopProviderThread
660	0x4b00	PhStringToInteger64
661	0x60f0	PhSuccessorElementAvlTree
662	0x1d6d0	PhSuspendProcess
663	0x1d720	PhSuspendThread
664	0x11c70	PhSweepHandleTable
665	0x129cc0	PhSystemBasicInformation
666	0x1380	PhSystemTimeToLocalTime
667	0x1d690	PhTerminateProcess
668	0x1d710	PhTerminateThread
669	0x18020	PhTransceiveNamedPipe
670	0x42c30	PhUiCloseConnections
671	0x43e90	PhUiCloseHandles
672	0x3fa20	PhUiConnectSession
673	0x425c0	PhUiContinueService
674	0x41060	PhUiDebugProcess
675	0x42a70	PhUiDeleteService
676	0x442e0	PhUiDestroyHeap
677	0x41a10	PhUiDetachFromDebuggerProcess
678	0x3fc10	PhUiDisconnectSession
679	0x430d0	PhUiForceTerminateThreads
680	0x43d30	PhUiFreeMemory
681	0x3f8a0	PhUiHibernateComputer
682	0x41b40	PhUiInjectDllProcess
683	0x3f7c0	PhUiLockComputer
684	0x3f800	PhUiLogoffComputer
685	0x3fc60	PhUiLogoffSession
686	0x42750	PhUiPauseService
687	0x41690	PhUiReduceWorkingSetProcesses
688	0x3f8f0	PhUiRestartComputer
689	0x40d70	PhUiRestartProcess
690	0x40a70	PhUiResumeProcesses
691	0x43540	PhUiResumeThreads
692	0x440f0	PhUiSetAttributesHandle
693	0x41ff0	PhUiSetDepStatusProcess
694	0x41c60	PhUiSetIoPriorityProcess
695	0x43850	PhUiSetIoPriorityThread
696	0x41db0	PhUiSetPagePriorityProcess
697	0x43970	PhUiSetPagePriorityThread
698	0x41e80	PhUiSetPriorityProcess
699	0x437b0	PhUiSetPriorityThread
700	0x41860	PhUiSetVirtualizationProcess
701	0x3f980	PhUiShutdownComputer
702	0x3f850	PhUiSleepComputer
703	0x42430	PhUiStartService
704	0x428e0	PhUiStopService
705	0x40770	PhUiSuspendProcesses
706	0x432d0	PhUiSuspendThreads
707	0x40170	PhUiTerminateProcesses
708	0x42e50	PhUiTerminateThreads
709	0x40680	PhUiTerminateTreeProcess
710	0x43a20	PhUiUnloadModule
711	0x1f7c0	PhUnloadDllProcess
712	0x21710	PhUnloadDriver
713	0x1ad70	PhUnloadMappedArchive
714	0x1ad70	PhUnloadMappedImage
715	0x18cd0	PhUnlockFileStream
716	0x11930	PhUnlockHandleTableEntry
717	0x4760	PhUnregisterCallback
718	0x60f20	PhUnregisterDialog
719	0x61080	PhUnregisterMessageLoopFilter
720	0x265b0	PhUnregisterProvider
721	0x24690	PhUpdateDosDevicePrefixes
722	0x30a10	PhUpdateHash
723	0x23f30	PhUpdateMupDevicePrefixes
724	0xa2eb0	PhUpdateProcessNode
725	0xb3f30	PhUpdateServiceNode
726	0x3e740	PhVerifyFile
727	0x185b0	PhVerifyFileStream
728	0x2dba0	PhWaitForMultipleObjectsAndPump
729	0x18080	PhWaitForNamedPipe
730	0x1fb10	PhWalkThreadStack
731	0x188f0	PhWriteFileStream
732	0x343f0	PhWriteMiniDumpProcess
733	0x4a3e0	PhWritePhTextHeader
734	0x18d00	PhWriteStringAsAnsiFileStream
735	0x18d10	PhWriteStringAsAnsiFileStream2
736	0x18d30	PhWriteStringAsAnsiFileStreamEx
737	0x18fe0	PhWriteStringFormatFileStream
738	0x18f90	PhWriteStringFormatFileStream_V
739	0x1d8a0	PhWriteVirtualMemory
740	0x4c170	PhaChoiceDialog
741	0x4fe0	PhaConcatStrings
742	0x5020	PhaConcatStrings2
743	0x4f40	PhaCreateString
744	0x4f80	PhaCreateStringEx
745	0x27bc0	PhaDereferenceObject
746	0x4fb0	PhaDuplicateString
747	0x5050	PhaFormatString
748	0x49220	PhaGetProcessKnownCommandLine
749	0x5090	PhaLowerString
750	0x5110	PhaSubstring
751	0x50d0	PhaUpperString
752	0xa6e0	PhfAcquireFastLockExclusive
753	0xa7b0	PhfAcquireFastLockShared
754	0x26860	PhfAcquireQueuedLockExclusive
755	0x269d0	PhfAcquireQueuedLockShared
756	0x34920	PhfAcquireRundownProtection
757	0x34a30	PhfBeginInitOnce
758	0x34a60	PhfEndInitOnce
759	0x4280	PhfHashBytesHsieh
760	0x4350	PhfHashBytesMurmur
761	0x43e0	PhfHashBytesSdbm
762	0x345f0	PhfInitializeBarrier
763	0x34480	PhfInitializeEvent
764	0x34a10	PhfInitializeInitOnce
765	0x34910	PhfInitializeRundownProtection
766	0x26d00	PhfPulseAllCondition
767	0x26c40	PhfPulseCondition
768	0x27180	PhfQueueWakeEvent
769	0xa890	PhfReleaseFastLockExclusive
770	0xa8f0	PhfReleaseFastLockShared
771	0x26b40	PhfReleaseQueuedLockExclusive
772	0x26b70	PhfReleaseQueuedLockShared
773	0x34950	PhfReleaseRundownProtection
774	0x345e0	PhfResetEvent
775	0x34490	PhfSetEvent
776	0x271c0	PhfSetWakeEvent
777	0xa950	PhfTryAcquireFastLockExclusive
778	0xa970	PhfTryAcquireFastLockShared
779	0x26c00	PhfTryWakeQueuedLock
780	0x34600	PhfWaitForBarrier
781	0x26da0	PhfWaitForCondition
782	0x26ef0	PhfWaitForConditionEx
783	0x344f0	PhfWaitForEvent
784	0x34990	PhfWaitForRundownProtection
785	0x27260	PhfWaitForWakeEvent
786	0x26c20	PhfWakeForReleaseQueuedLock
787	0x5290	PhxfAddInt32
788	0x5320	PhxfAddInt32U
789	0x5550	PhxfDivideSingle2U
790	0x5420	PhxfDivideSingleU
791	0x51e0	PhxfFillMemoryUlong
792	0x129c9c	ProcessAllAccess
793	0x129cb4	ProcessQueryAccess
794	0x129cac	ThreadAllAccess
795	0x129ca0	ThreadQueryAccess
796	0x129ca8	ThreadSetAccess
797	0x129cb0	WindowsVersion
798	0xce240	mxmlAdd
799	0xce370	mxmlDelete
800	0xcab40	mxmlElementDeleteAttr
801	0xcac20	mxmlElementGetAttr
802	0xcac80	mxmlElementSetAttr
803	0xce8d0	mxmlFindElement
804	0xcaf40	mxmlLoadFd
805	0xcaf80	mxmlLoadString
806	0xce4f0	mxmlNewCDATA
807	0xce540	mxmlNewCustom
808	0xce580	mxmlNewElement
809	0xce5d0	mxmlNewOpaque
810	0xce620	mxmlNewText
811	0xce6e0	mxmlNewXML
812	0xce760	mxmlRelease
813	0xce680	mxmlRemove
814	0xce790	mxmlRetain
815	0xcafa0	mxmlSaveAllocString
816	0xcb120	mxmlSaveFd
817	0xcb220	mxmlSaveString
818	0xcebb0	mxmlSetCDATA
819	0xceb40	mxmlSetCustom
820	0xcb2d0	mxmlSetCustomHandlers
821	0xcec30	mxmlSetElement
822	0xcb2e0	mxmlSetErrorCallback
823	0xcec90	mxmlSetOpaque
824	0xcecf0	mxmlSetText
825	0xcea80	mxmlWalkNext
826	0xceae0	mxmlWalkPrev
827	0x5190	ph_crc32
828	0x5150	ph_equal_string

module_name	ProcessHacker.exe
flags	0
timestamp	2013-07-20 12:23:43
version	0.0
ordinal_base	1
nFunctions	828
nNames	828
Names(828)	0x115678
Functions(828)	0x114988
NameOrdinals(828)	0x116368

StringTable 0c0904b0

CompanyName	wj32
FileDescription	Process Hacker
FileVersion	2.31.0.5355
InternalName	Process Hacker
LegalCopyright	Licensed under the GNU GPL, v3.
OriginalFilename	ProcessHacker.exe
ProductName	Process Hacker
ProductVersion	2.31.0.5355

VS_FIXEDFILEINFO

FileVersion	2.31.0.5355
ProductVersion	2.31.0.5355
StrucVersion	0x10000
FileFlagsMask	0x17
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
131770	67507	PNG	(256 x 256)	#
141f23	109789	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

ProcessHacker.exe-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 0c0904b0

VS_FIXEDFILEINFO

ProcessHacker.exe
-