advapi32.dll - Advanced Windows 32 Base API

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	advapi32.dll
size	640512 (0x9c600)
md5	d67472125471784de7147946eda25feb

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
149	30729	11
1	0	659
147	30729	27
146	30729	1
132	30729	18
131	30729	128
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x521ea86a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x72000
SizeOfInitializedData	0x2aa00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x14965
BaseOfCode	0x1000
BaseOfData	0x70000
ImageBase	0x77c60000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0xa0000
SizeOfHeaders	0x400
CheckSum	0xaa124
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x71ec5	0x72000	R-X CODE
.data	0x73000	0x3588	0x2e00	RW- IDATA
.rsrc	0x77000	0x23140	0x23200	R-- IDATA
.reloc	0x9b000	0x4050	0x4200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x149bc	0x6860
IMPORT	0x6f2a0	0x118
RESOURCE	0x77000	0x23140
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x9b000	0x4050
DEBUG	0x72e64	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x11150	0x40
Bound_IAT	0	0
IAT	0x1000	0x914
Delay_IAT	0x6e9ac	0x100
CLR_Header	0	0

show previews

type	name	size
MUI	#1	256
WEVT_TEMPLATE	#1	142030
RCDATA	#102	92
VERSION	#1	944

module_name	hint	ord	function_name
msvcrt.dll	1228		iswctype
msvcrt.dll	1031		_wcstoui64
msvcrt.dll	404		_ftol2
msvcrt.dll	1337		tolower
msvcrt.dll	926		_ultow
msvcrt.dll	1382		wcstok
msvcrt.dll	1213		isalnum
msvcrt.dll	1222		isspace
msvcrt.dll	342		_errno
msvcrt.dll	1253		mbstowcs
msvcrt.dll	345		_except_handler4_common
msvcrt.dll	1361		wcschr
msvcrt.dll	1376		wcsrchr
msvcrt.dll	1262		memset
msvcrt.dll	1260		memmove
msvcrt.dll	1007		_wcsicmp
msvcrt.dll	974		_vsnwprintf
msvcrt.dll	1258		memcpy
msvcrt.dll	1365		wcscpy_s
msvcrt.dll	862		_stricmp
msvcrt.dll	1299		strchr
msvcrt.dll	1316		strrchr
msvcrt.dll	1318		strstr
msvcrt.dll	968		_vsnprintf
msvcrt.dll	1385		wcstombs
msvcrt.dll	1380		wcsstr
msvcrt.dll	1326		swprintf_s
msvcrt.dll	1373		wcsncpy_s
msvcrt.dll	1371		wcsncmp
msvcrt.dll	1328		swscanf_s
msvcrt.dll	1017		_wcsnicmp
msvcrt.dll	1387		wcstoul
msvcrt.dll	1360		wcscat_s
ntdll.dll	1132		RtlRunOnceExecuteOnce
ntdll.dll	122		LdrLoadDll
ntdll.dll	115		LdrGetProcedureAddress
ntdll.dll	1130		RtlRunOnceBeginInitialize
ntdll.dll	147		LdrUnloadDll
ntdll.dll	347		NtOpenKey
ntdll.dll	431		NtQueryValueKey
ntdll.dll	356		NtOpenProcessToken
ntdll.dll	402		NtQueryInformationToken
ntdll.dll	213		NtClose
ntdll.dll	910		RtlImageNtHeader
ntdll.dll	59		EtwEventWriteEx
ntdll.dll		1
ntdll.dll	839		RtlFreeAnsiString
ntdll.dll	860		RtlGetCurrentTransaction
ntdll.dll	32		DbgPrint
ntdll.dll	780		RtlEnterCriticalSection
ntdll.dll	1005		RtlLeaveCriticalSection
ntdll.dll	989		RtlIsTextUnicode
ntdll.dll	1219		RtlUnicodeStringToAnsiString
ntdll.dll	1226		RtlUnicodeToMultiByteSize
ntdll.dll	1008		RtlLengthSid
ntdll.dll	682		RtlCopyUnicodeString
ntdll.dll	1053		RtlOemStringToUnicodeString
ntdll.dll	916		RtlInitAnsiString
ntdll.dll	617		RtlAnsiStringToUnicodeString
ntdll.dll	846		RtlFreeUnicodeString
ntdll.dll	925		RtlInitUnicodeString
ntdll.dll	760		RtlDosPathNameToNtPathName_U
ntdll.dll	841		RtlFreeHeap
ntdll.dll	612		RtlAllocateHeap
ntdll.dll	1045		RtlNtStatusToDosError
ntdll.dll	731		RtlDeleteCriticalSection
ntdll.dll	932		RtlInitializeCriticalSection
ntdll.dll	651		RtlCompareMemory
ntdll.dll	1311		RtlxUnicodeStringToAnsiSize
ntdll.dll	161		NlsMbCodePageTag
ntdll.dll	1028		RtlMakeSelfRelativeSD
ntdll.dll	926		RtlInitUnicodeStringEx
ntdll.dll	1309		RtlxAnsiStringToUnicodeSize
ntdll.dll	500		NtSetInformationThread
ntdll.dll	364		NtOpenThreadToken
ntdll.dll	1094		RtlRandom
ntdll.dll	428		NtQuerySystemTime
ntdll.dll	883		RtlGetNtProductType
ntdll.dll	896		RtlGetThreadPreferredUILanguages
ntdll.dll	1191		RtlSubAuthoritySid
ntdll.dll	1190		RtlSubAuthorityCountSid
ntdll.dll	679		RtlCopySid
ntdll.dll	1221		RtlUnicodeStringToInteger
ntdll.dll	667		RtlConvertSidToUnicodeString
ntdll.dll	611		RtlAllocateHandle
ntdll.dll	992		RtlIsValidIndexHandle
ntdll.dll	840		RtlFreeHandle
ntdll.dll	792		RtlEqualSid
ntdll.dll	501		NtSetInformationToken
ntdll.dll	587		RtlAddAccessAllowedAceEx
ntdll.dll	844		RtlFreeSid
ntdll.dll	610		RtlAllocateAndInitializeSid
ntdll.dll	219		NtCompareTokens
ntdll.dll	276		NtDuplicateToken
ntdll.dll	1161		RtlSetOwnerSecurityDescriptor
ntdll.dll	700		RtlCreateSecurityDescriptor
ntdll.dll	786		RtlEnumerateGenericTableWithoutSplaying
ntdll.dll	984		RtlIsGenericTableEmpty
ntdll.dll	399		NtQueryInformationProcess
ntdll.dll	409		NtQueryKey
ntdll.dll	874		RtlGetLastNtStatus
ntdll.dll	271		NtDeviceIoControlFile
ntdll.dll	344		NtOpenFile
ntdll.dll	803		RtlExpandEnvironmentStrings_U
ntdll.dll	769		RtlDuplicateUnicodeString
ntdll.dll	706		RtlCreateUnicodeString
ntdll.dll	57		EtwEventWrite
ntdll.dll	55		EtwEventRegister
ntdll.dll	233		NtCreateKey
ntdll.dll	523		NtSetValueKey
ntdll.dll	732		RtlDeleteElementGenericTable
ntdll.dll	267		NtDeleteKey
ntdll.dll	622		RtlAppendUnicodeToString
ntdll.dll	946		RtlInsertElementGenericTable
ntdll.dll	939		RtlInitializeHandleTable
ntdll.dll	56		EtwEventUnregister
ntdll.dll	747		RtlDestroyHandleTable
ntdll.dll	280		NtEnumerateKey
ntdll.dll	953		RtlIntegerToUnicodeString
ntdll.dll	621		RtlAppendUnicodeStringToString
ntdll.dll	1189		RtlStringFromGUID
ntdll.dll	835		RtlFormatCurrentUserKeyPath
ntdll.dll	937		RtlInitializeGenericTable
ntdll.dll	1023		RtlLookupElementGenericTable
ntdll.dll	1085		RtlQueryRegistryValues
ntdll.dll	1047		RtlNumberGenericTableElements
ntdll.dll	1256		RtlValidSid
ntdll.dll	848		RtlGUIDFromString
ntdll.dll	1238		RtlUpcaseUnicodeChar
ntdll.dll	433		NtQueryVolumeInformationFile
ntdll.dll	1061		RtlPrefixUnicodeString
ntdll.dll	423		NtQuerySymbolicLinkObject
ntdll.dll	362		NtOpenSymbolicLinkObject
ntdll.dll	754		RtlDetermineDosPathNameType_U
ntdll.dll	396		NtQueryInformationFile
ntdll.dll	869		RtlGetFullPathName_U
ntdll.dll	1046		RtlNtStatusToDosErrorNoTeb
ntdll.dll	1225		RtlUnicodeToMultiByteN
ntdll.dll	1033		RtlMultiByteToUnicodeN
ntdll.dll	615		RtlAnsiCharToUnicodeChar
ntdll.dll	756		RtlDllShutdownInProgress
ntdll.dll	227		NtCreateEvent
ntdll.dll	536		NtTerminateThread
ntdll.dll	556		NtWaitForSingleObject
ntdll.dll	488		NtSetEvent
ntdll.dll	212		NtClearEvent
ntdll.dll	262		NtDelayExecution
ntdll.dll	801		RtlExitUserThread
ntdll.dll	1103		RtlRegisterThreadWithCsrss
ntdll.dll	208		NtCancelIoFile
ntdll.dll	554		NtWaitForMultipleObjects
ntdll.dll	275		NtDuplicateObject
ntdll.dll	1109		RtlReleaseRelativeName
ntdll.dll	229		NtCreateFile
ntdll.dll	762		RtlDosPathNameToRelativeNtPathName_U
ntdll.dll	1158		RtlSetLastWin32Error
ntdll.dll	540		NtTraceControl
ntdll.dll	76		EtwSendNotification
ntdll.dll	50		EtwDeliverDataBlock
ntdll.dll	51		EtwEnumerateProcessRegGuids
ntdll.dll	515		NtSetSystemInformation
ntdll.dll	1089		RtlQueryTimeZoneInformation
ntdll.dll	1080		RtlQueryPerformanceFrequency
ntdll.dll	84		EtwpGetCpuSpeed
ntdll.dll	426		NtQuerySystemInformation
ntdll.dll	416		NtQueryPerformanceCounter
ntdll.dll	929		RtlInitializeBitMap
ntdll.dll	880		RtlGetNativeSystemInformation
ntdll.dll	954		RtlInterlockedClearBitRun
ntdll.dll	683		RtlCreateAcl
ntdll.dll	541		NtTraceEvent
ntdll.dll	1073		RtlQueryHeapInformation
ntdll.dll	752		RtlDestroyQueryDebugBuffer
ntdll.dll	1082		RtlQueryProcessDebugInformation
ntdll.dll	698		RtlCreateQueryDebugBuffer
ntdll.dll	608		RtlAdjustPrivilege
ntdll.dll	914		RtlImpersonateSelf
ntdll.dll	71		EtwProcessPrivateLoggerRequest
ntdll.dll	370		NtPowerInformation
ntdll.dll	966		RtlIpv4AddressToStringW
ntdll.dll	974		RtlIpv6AddressToStringW
ntdll.dll	917		RtlInitAnsiStringEx
ntdll.dll	654		RtlCompareUnicodeString
ntdll.dll	707		RtlCreateUnicodeStringFromAsciiz
ntdll.dll	455		NtRenameKey
ntdll.dll	323		NtLoadKeyEx
ntdll.dll	945		RtlInitializeSid
ntdll.dll	831		RtlFirstFreeAce
ntdll.dll	1253		RtlValidAcl
ntdll.dll	592		RtlAddAce
ntdll.dll	598		RtlAddAuditAccessObjectAce
ntdll.dll	591		RtlAddAccessDeniedObjectAce
ntdll.dll	590		RtlAddAccessDeniedAceEx
ntdll.dll	597		RtlAddAuditAccessAceEx
ntdll.dll	588		RtlAddAccessAllowedObjectAce
ntdll.dll	854		RtlGetControlSecurityDescriptor
ntdll.dll	890		RtlGetSaclSecurityDescriptor
ntdll.dll	861		RtlGetDaclSecurityDescriptor
ntdll.dll	872		RtlGetGroupSecurityDescriptor
ntdll.dll	885		RtlGetOwnerSecurityDescriptor
ntdll.dll	575		RtlAbsoluteToSelfRelativeSD
ntdll.dll	1165		RtlSetSaclSecurityDescriptor
ntdll.dll	1148		RtlSetDaclSecurityDescriptor
ntdll.dll	1154		RtlSetGroupSecurityDescriptor
ntdll.dll	681		RtlCopyString
ntdll.dll	1198		RtlTimeToSecondsSince1970
ntdll.dll	1112		RtlReleaseSRWLockShared
ntdll.dll	582		RtlAcquireSRWLockShared
ntdll.dll	1111		RtlReleaseSRWLockExclusive
ntdll.dll	581		RtlAcquireSRWLockExclusive
ntdll.dll	401		NtQueryInformationThread
ntdll.dll	944		RtlInitializeSRWLock
ntdll.dll	794		RtlEqualUnicodeString
ntdll.dll	413		NtQueryObject
ntdll.dll	412		NtQueryMutant
ntdll.dll	199		NtAlpcQueryInformation
ntdll.dll	586		RtlAddAccessAllowedAce
ntdll.dll	234		NtCreateKeyTransacted
ntdll.dll	1055		RtlOpenCurrentUser
ntdll.dll	349		NtOpenKeyTransacted
ntdll.dll	411		NtQueryMultipleValueKey
ntdll.dll	348		NtOpenKeyEx
ntdll.dll	350		NtOpenKeyTransactedEx
ntdll.dll	1254		RtlValidRelativeSecurityDescriptor
ntdll.dll	457		NtReplaceKey
ntdll.dll	474		NtSaveKey
ntdll.dll	476		NtSaveMergedKeys
ntdll.dll	421		NtQuerySecurityObject
ntdll.dll	68		EtwLogTraceEvent
ntdll.dll	902		RtlGetVersion
ntdll.dll	438		NtReadFile
ntdll.dll	561		NtWriteFile
ntdll.dll	1096		RtlReAllocateHeap
ntdll.dll	1007		RtlLengthSecurityDescriptor
ntdll.dll	1255		RtlValidSecurityDescriptor
KERNELBASE.dll	138		EnumUILanguagesW
KERNELBASE.dll	332		GetUserDefaultUILanguage
KERNELBASE.dll	306		GetSystemDefaultUILanguage
KERNELBASE.dll	27		AreFileApisANSI
API-MS-WIN-Service-Core-L1-1-0.dll			RegisterServiceCtrlHandlerExW
API-MS-WIN-Service-Core-L1-1-0.dll	2		StartServiceCtrlDispatcherW
API-MS-WIN-Service-Core-L1-1-0.dll	1		SetServiceStatus
API-MS-WIN-Service-winsvc-L1-1-0.dll	11		I_ScRpcBindW
API-MS-WIN-Service-winsvc-L1-1-0.dll	25		StartServiceCtrlDispatcherA
API-MS-WIN-Service-winsvc-L1-1-0.dll	24		StartServiceA
API-MS-WIN-Service-winsvc-L1-1-0.dll	23		RegisterServiceCtrlHandlerW
API-MS-WIN-Service-winsvc-L1-1-0.dll	22		RegisterServiceCtrlHandlerExA
API-MS-WIN-Service-winsvc-L1-1-0.dll	21		RegisterServiceCtrlHandlerA
API-MS-WIN-Service-winsvc-L1-1-0.dll	20		QueryServiceStatus
API-MS-WIN-Service-winsvc-L1-1-0.dll	19		QueryServiceConfigA
API-MS-WIN-Service-winsvc-L1-1-0.dll	18		QueryServiceConfig2A
API-MS-WIN-Service-winsvc-L1-1-0.dll	17		OpenServiceA
API-MS-WIN-Service-winsvc-L1-1-0.dll	16		OpenSCManagerA
API-MS-WIN-Service-winsvc-L1-1-0.dll	15		NotifyServiceStatusChangeA
API-MS-WIN-Service-winsvc-L1-1-0.dll	4		CreateServiceA
API-MS-WIN-Service-winsvc-L1-1-0.dll	3		ControlServiceExA
API-MS-WIN-Service-winsvc-L1-1-0.dll	2		ControlService
API-MS-WIN-Service-winsvc-L1-1-0.dll	1		ChangeServiceConfigA
API-MS-WIN-Service-winsvc-L1-1-0.dll			ChangeServiceConfig2A
API-MS-WIN-Service-winsvc-L1-1-0.dll	10		I_ScRpcBindA
API-MS-WIN-Service-Management-L1-1-0.dll	1		ControlServiceExW
API-MS-WIN-Service-Management-L1-1-0.dll	4		OpenSCManagerW
API-MS-WIN-Service-Management-L1-1-0.dll	5		OpenServiceW
API-MS-WIN-Service-Management-L1-1-0.dll	2		CreateServiceW
API-MS-WIN-Service-Management-L1-1-0.dll	3		DeleteService
API-MS-WIN-Service-Management-L1-1-0.dll			CloseServiceHandle
API-MS-WIN-Service-Management-L1-1-0.dll	6		StartServiceW
API-MS-WIN-Service-Management-L2-1-0.dll	3		QueryServiceConfig2W
API-MS-WIN-Service-Management-L2-1-0.dll	2		NotifyServiceStatusChangeW
API-MS-WIN-Service-Management-L2-1-0.dll			ChangeServiceConfig2W
API-MS-WIN-Service-Management-L2-1-0.dll	1		ChangeServiceConfigW
API-MS-WIN-Service-Management-L2-1-0.dll	4		QueryServiceConfigW
API-MS-WIN-Service-Management-L2-1-0.dll	5		QueryServiceObjectSecurity
API-MS-WIN-Service-Management-L2-1-0.dll	6		QueryServiceStatusEx
API-MS-WIN-Service-Management-L2-1-0.dll	7		SetServiceObjectSecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	34		RegSaveKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	22		RegNotifyChangeKeyValue
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	27		RegQueryInfoKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	28		RegQueryInfoKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	29		RegQueryValueExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	20		RegLoadMUIStringA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	33		RegSaveKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	30		RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	15		RegGetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	35		RegSetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	31		RegRestoreKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	32		RegRestoreKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	37		RegSetValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	18		RegLoadKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	19		RegLoadKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	25		RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	3		RegDeleteKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	4		RegDeleteKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	7		RegDeleteValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	8		RegDeleteValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	10		RegEnumKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	11		RegEnumKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	12		RegEnumValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	13		RegEnumValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	16		RegGetValueA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	17		RegGetValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	1		RegCreateKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	2		RegCreateKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	14		RegFlushKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	23		RegOpenCurrentUser
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	24		RegOpenKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	9		RegDisablePredefinedCacheEx
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	21		RegLoadMUIStringW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	26		RegOpenUserClassesRoot
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	36		RegSetValueExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	38		RegUnLoadKeyA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	39		RegUnLoadKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	6		RegDeleteTreeW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	5		RegDeleteTreeA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll			RegCloseKey
API-MS-Win-Core-NamedPipe-L1-1-0.dll	6		ImpersonateNamedPipeClient
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	5		CreateThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	12		GetCurrentThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	42		TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	10		GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	16		GetPriorityClass
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	27		OpenThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	13		GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	39		SetThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	28		OpenThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	26		OpenProcessToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	1		CreateProcessAsUserW
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	11		GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	17		GetProcessId
API-MS-Win-Security-Base-L1-1-0.dll	55		GetSidLengthRequired
API-MS-Win-Security-Base-L1-1-0.dll	56		GetSidSubAuthority
API-MS-Win-Security-Base-L1-1-0.dll	57		GetSidSubAuthorityCount
API-MS-Win-Security-Base-L1-1-0.dll	59		GetWindowsAccountDomainSid
API-MS-Win-Security-Base-L1-1-0.dll	60		ImpersonateAnonymousToken
API-MS-Win-Security-Base-L1-1-0.dll	61		ImpersonateLoggedOnUser
API-MS-Win-Security-Base-L1-1-0.dll	62		ImpersonateSelf
API-MS-Win-Security-Base-L1-1-0.dll	63		InitializeAcl
API-MS-Win-Security-Base-L1-1-0.dll	64		InitializeSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll	65		InitializeSid
API-MS-Win-Security-Base-L1-1-0.dll	66		IsTokenRestricted
API-MS-Win-Security-Base-L1-1-0.dll	67		IsValidAcl
API-MS-Win-Security-Base-L1-1-0.dll	68		IsValidRelativeSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll	69		IsValidSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll	71		IsWellKnownSid
API-MS-Win-Security-Base-L1-1-0.dll	72		MakeAbsoluteSD
API-MS-Win-Security-Base-L1-1-0.dll	73		MakeAbsoluteSD2
API-MS-Win-Security-Base-L1-1-0.dll	54		GetSidIdentifierAuthority
API-MS-Win-Security-Base-L1-1-0.dll	75		MapGenericMask
API-MS-Win-Security-Base-L1-1-0.dll	80		PrivilegeCheck
API-MS-Win-Security-Base-L1-1-0.dll	82		QuerySecurityAccessMask
API-MS-Win-Security-Base-L1-1-0.dll	83		RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll	84		SetAclInformation
API-MS-Win-Security-Base-L1-1-0.dll	86		SetKernelObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	87		SetPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	88		SetPrivateObjectSecurityEx
API-MS-Win-Security-Base-L1-1-0.dll	36		EqualDomainSid
API-MS-Win-Security-Base-L1-1-0.dll	89		SetSecurityAccessMask
API-MS-Win-Security-Base-L1-1-0.dll	90		SetSecurityDescriptorControl
API-MS-Win-Security-Base-L1-1-0.dll	91		SetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll	92		SetSecurityDescriptorGroup
API-MS-Win-Security-Base-L1-1-0.dll	93		SetSecurityDescriptorOwner
API-MS-Win-Security-Base-L1-1-0.dll	94		SetSecurityDescriptorRMControl
API-MS-Win-Security-Base-L1-1-0.dll	95		SetSecurityDescriptorSacl
API-MS-Win-Security-Base-L1-1-0.dll	96		SetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll	53		GetSecurityDescriptorSacl
API-MS-Win-Security-Base-L1-1-0.dll	52		GetSecurityDescriptorRMControl
API-MS-Win-Security-Base-L1-1-0.dll	51		GetSecurityDescriptorOwner
API-MS-Win-Security-Base-L1-1-0.dll	50		GetSecurityDescriptorLength
API-MS-Win-Security-Base-L1-1-0.dll	49		GetSecurityDescriptorGroup
API-MS-Win-Security-Base-L1-1-0.dll	48		GetSecurityDescriptorDacl
API-MS-Win-Security-Base-L1-1-0.dll	47		GetSecurityDescriptorControl
API-MS-Win-Security-Base-L1-1-0.dll	46		GetPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	45		GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll	44		GetKernelObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	42		GetAclInformation
API-MS-Win-Security-Base-L1-1-0.dll	41		GetAce
API-MS-Win-Security-Base-L1-1-0.dll	40		FreeSid
API-MS-Win-Security-Base-L1-1-0.dll	39		FindFirstFreeAce
API-MS-Win-Security-Base-L1-1-0.dll	74		MakeSelfRelativeSD
API-MS-Win-Security-Base-L1-1-0.dll	38		EqualSid
API-MS-Win-Security-Base-L1-1-0.dll	70		IsValidSid
API-MS-Win-Security-Base-L1-1-0.dll	1		AccessCheckAndAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	3		AccessCheckByTypeAndAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	6		AccessCheckByTypeResultListAndAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	5		AccessCheckByTypeResultListAndAuditAlarmByHandleW
API-MS-Win-Security-Base-L1-1-0.dll	78		ObjectOpenAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	79		ObjectPrivilegeAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	76		ObjectCloseAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	77		ObjectDeleteAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	81		PrivilegedServiceAuditAlarmW
API-MS-Win-Security-Base-L1-1-0.dll	85		SetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll	43		GetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll	26		CopySid
API-MS-Win-Security-Base-L1-1-0.dll	58		GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll			AccessCheck
API-MS-Win-Security-Base-L1-1-0.dll	2		AccessCheckByType
API-MS-Win-Security-Base-L1-1-0.dll	4		AccessCheckByTypeResultList
API-MS-Win-Security-Base-L1-1-0.dll	7		AddAccessAllowedAce
API-MS-Win-Security-Base-L1-1-0.dll	8		AddAccessAllowedAceEx
API-MS-Win-Security-Base-L1-1-0.dll	9		AddAccessAllowedObjectAce
API-MS-Win-Security-Base-L1-1-0.dll	10		AddAccessDeniedAce
API-MS-Win-Security-Base-L1-1-0.dll	11		AddAccessDeniedAceEx
API-MS-Win-Security-Base-L1-1-0.dll	12		AddAccessDeniedObjectAce
API-MS-Win-Security-Base-L1-1-0.dll	13		AddAce
API-MS-Win-Security-Base-L1-1-0.dll	14		AddAuditAccessAce
API-MS-Win-Security-Base-L1-1-0.dll	15		AddAuditAccessAceEx
API-MS-Win-Security-Base-L1-1-0.dll	16		AddAuditAccessObjectAce
API-MS-Win-Security-Base-L1-1-0.dll	18		AdjustTokenGroups
API-MS-Win-Security-Base-L1-1-0.dll	19		AdjustTokenPrivileges
API-MS-Win-Security-Base-L1-1-0.dll	20		AllocateAndInitializeSid
API-MS-Win-Security-Base-L1-1-0.dll	21		AllocateLocallyUniqueId
API-MS-Win-Security-Base-L1-1-0.dll	22		AreAllAccessesGranted
API-MS-Win-Security-Base-L1-1-0.dll	23		AreAnyAccessesGranted
API-MS-Win-Security-Base-L1-1-0.dll	24		CheckTokenMembership
API-MS-Win-Security-Base-L1-1-0.dll	25		ConvertToAutoInheritPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	27		CreatePrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	28		CreatePrivateObjectSecurityEx
API-MS-Win-Security-Base-L1-1-0.dll	29		CreatePrivateObjectSecurityWithMultipleInheritance
API-MS-Win-Security-Base-L1-1-0.dll	30		CreateRestrictedToken
API-MS-Win-Security-Base-L1-1-0.dll	31		CreateWellKnownSid
API-MS-Win-Security-Base-L1-1-0.dll	32		DeleteAce
API-MS-Win-Security-Base-L1-1-0.dll	33		DestroyPrivateObjectSecurity
API-MS-Win-Security-Base-L1-1-0.dll	34		DuplicateToken
API-MS-Win-Security-Base-L1-1-0.dll	35		DuplicateTokenEx
API-MS-Win-Security-Base-L1-1-0.dll	37		EqualPrefixSid
KERNEL32.dll	1259		VirtualAllocEx
KERNEL32.dll	1261		VirtualFree
KERNEL32.dll	895		OpenProcess
KERNEL32.dll	704		GlobalMemoryStatusEx
KERNEL32.dll	361		GetActiveProcessorCount
KERNEL32.dll	626		GetSystemInfo
KERNEL32.dll	221		DeviceIoControl
KERNEL32.dll	635		GetSystemWindowsDirectoryW
KERNEL32.dll	678		GetVolumeInformationW
KERNEL32.dll	467		GetDriveTypeW
KERNEL32.dll	518		GetLogicalDriveStringsW
KERNEL32.dll	1015		ReleaseMutex
KERNEL32.dll	724		HeapSize
KERNEL32.dll	399		GetComputerNameW
KERNEL32.dll	284		ExpandEnvironmentStringsA
KERNEL32.dll	981		RegKrnInitialize
KERNEL32.dll	530		GetModuleFileNameW
KERNEL32.dll	846		LocalUnlock
KERNEL32.dll	842		LocalLock
KERNEL32.dll	396		GetComputerNameA
KERNEL32.dll	1112		SetEvent
KERNEL32.dll	232		DuplicateHandle
KERNEL32.dll	159		CreateMutexW
KERNEL32.dll	960		ReadProcessMemory
KERNEL32.dll	202		DecodePointer
KERNEL32.dll	234		EncodePointer
KERNEL32.dll	355		FreeLibraryAndExitThread
KERNEL32.dll	782		IsWow64Process
KERNEL32.dll	570		GetPrivateProfileIntW
KERNEL32.dll	1037		ResetEvent
KERNEL32.dll	722		HeapReAlloc
KERNEL32.dll	630		GetSystemTime
KERNEL32.dll	156		CreateMutexA
KERNEL32.dll	739		InitializeCriticalSection
KERNEL32.dll	1304		Wow64RevertWow64FsRedirection
KERNEL32.dll	851		LockResource
KERNEL32.dll	1200		SizeofResource
KERNEL32.dll	1300		Wow64DisableWow64FsRedirection
KERNEL32.dll	830		LoadLibraryExW
KERNEL32.dll	494		GetFileSize
KERNEL32.dll	228		DosDateTimeToFileTime
KERNEL32.dll	291		FileTimeToDosDateTime
KERNEL32.dll	496		GetFileTime
KERNEL32.dll	1111		SetErrorMode
KERNEL32.dll	325		FindNextFileW
KERNEL32.dll	308		FindFirstFileExW
KERNEL32.dll	1122		SetFileInformationByHandle
KERNEL32.dll	118		CopyFileW
KERNEL32.dll	1349		lstrcmpiA
KERNEL32.dll	495		GetFileSizeEx
KERNEL32.dll	1137		SetLastError
KERNEL32.dll	840		LocalFree
KERNEL32.dll	836		LocalAlloc
KERNEL32.dll	843		LocalReAlloc
KERNEL32.dll	1298		WideCharToMultiByte
KERNEL32.dll	1359		lstrlenW
KERNEL32.dll	870		MultiByteToWideChar
KERNEL32.dll	398		GetComputerNameExW
KERNEL32.dll	579		GetProcAddress
KERNEL32.dll	828		LoadLibraryA
KERNEL32.dll	83		CloseHandle
KERNEL32.dll	166		CreateProcessInternalA
KERNEL32.dll	354		FreeLibrary
KERNEL32.dll	512		GetLastError
KERNEL32.dll	831		LoadLibraryW
KERNEL32.dll	825		LeaveCriticalSection
KERNEL32.dll	238		EnterCriticalSection
KERNEL32.dll	980		RegKrnGetGlobalState
KERNEL32.dll	1204		SleepEx
KERNEL32.dll	658		GetTickCount
KERNEL32.dll	715		HeapAlloc
KERNEL32.dll	584		GetProcessHeap
KERNEL32.dll	144		CreateFileW
KERNEL32.dll	505		GetFullPathNameW
KERNEL32.dll	719		HeapFree
KERNEL32.dll	488		GetFileAttributesW
KERNEL32.dll	1051		SearchPathW
KERNEL32.dll	206		DelayLoadFailureHook
KERNEL32.dll	745		InterlockedCompareExchange
KERNEL32.dll	829		LoadLibraryExA
KERNEL32.dll	932		QueryPerformanceCounter
KERNEL32.dll	632		GetSystemTimeAsFileTime
KERNEL32.dll	1236		UnhandledExceptionFilter
KERNEL32.dll	1187		SetUnhandledExceptionFilter
KERNEL32.dll	134		CreateEventW
KERNEL32.dll	657		GetThreadUILanguage
KERNEL32.dll	1350		lstrcmpiW
KERNEL32.dll	391		GetCommandLineW
KERNEL32.dll	1347		lstrcmpW
KERNEL32.dll	1201		Sleep
KERNEL32.dll	533		GetModuleHandleExW
KERNEL32.dll	1318		WriteFile
KERNEL32.dll	285		ExpandEnvironmentStringsW
KERNEL32.dll	866		MoveFileW
KERNEL32.dll	214		DeleteFileW
KERNEL32.dll	485		GetFileAttributesExW
KERNEL32.dll	1124		SetFilePointer
KERNEL32.dll	903		OutputDebugStringW
KERNEL32.dll	513		GetLocalTime
KERNEL32.dll	350		FormatMessageW
KERNEL32.dll	534		GetModuleHandleW
KERNEL32.dll	141		CreateFileMappingW
KERNEL32.dll	957		ReadFile
KERNEL32.dll	854		MapViewOfFile
KERNEL32.dll	1239		UnmapViewOfFile
KERNEL32.dll	97		CompareFileTime
KERNEL32.dll	525		GetLongPathNameW
KERNEL32.dll	833		LoadResource
KERNEL32.dll	333		FindResourceExW
KERNEL32.dll	682		GetVolumePathNameW
KERNEL32.dll	209		DeleteCriticalSection
KERNEL32.dll	1274		WaitForSingleObject
KERNEL32.dll	302		FindClose
KERNEL32.dll	493		GetFileMUIPath
KERNEL32.dll	747		InterlockedDecrement
KERNEL32.dll	751		InterlockedIncrement
KERNEL32.dll	748		InterlockedExchange
KERNEL32.dll	1262		VirtualFreeEx
KERNEL32.dll	462		GetDiskFreeSpaceExW
KERNEL32.dll	623		GetSystemDirectoryW
KERNEL32.dll	502		GetFullPathNameA
KERNEL32.dll	566		GetOverlappedResult
RPCRT4.dll	348		RpcBindingCreateW
RPCRT4.dll	507		UuidCreate
RPCRT4.dll	364		RpcBindingSetAuthInfoA
RPCRT4.dll	383		RpcEpResolveBinding
RPCRT4.dll	82		I_RpcSNCHOption
RPCRT4.dll	512		UuidFromStringW
RPCRT4.dll	516		UuidToStringW
RPCRT4.dll	394		RpcExceptionFilter
RPCRT4.dll	367		RpcBindingSetAuthInfoW
RPCRT4.dll	483		RpcSsDestroyClientContext
RPCRT4.dll	62		I_RpcMapWin32Status
RPCRT4.dll	45		I_RpcExceptionFilter
RPCRT4.dll	149		NdrClientCall2
RPCRT4.dll	366		RpcBindingSetAuthInfoExW
RPCRT4.dll	494		RpcStringBindingComposeW
RPCRT4.dll	351		RpcBindingFromStringBindingW
RPCRT4.dll	498		RpcStringFreeW
RPCRT4.dll	349		RpcBindingFree
RPCRT4.dll	365		RpcBindingSetAuthInfoExA
RPCRT4.dll	431		RpcRaiseException
RPCRT4.dll	345		RpcBindingBind

ord	entry_va	function_name
1000	0x4eb25
1001	0x622d9	I_ScGetCurrentGroupStateW
1002	0x1abc6	A_SHAFinal
1003	0x1abd7	A_SHAInit
1004	0x1abe7	A_SHAUpdate
1005	0x5df9c	AbortSystemShutdownA
1006	0x5df48	AbortSystemShutdownW
1007	0xc9dc	AccessCheck
1008	0x413e1	AccessCheckAndAuditAlarmA
1009	0x43104	AccessCheckAndAuditAlarmW
1010	0xadfc	AccessCheckByType
1011	0x414cb	AccessCheckByTypeAndAuditAlarmA
1012	0x43114	AccessCheckByTypeAndAuditAlarmW
1013	0x43124	AccessCheckByTypeResultList
1014	0x415c4	AccessCheckByTypeResultListAndAuditAlarmA
1015	0x416bd	AccessCheckByTypeResultListAndAuditAlarmByHandleA
1016	0x43134	AccessCheckByTypeResultListAndAuditAlarmByHandleW
1017	0x43144	AccessCheckByTypeResultListAndAuditAlarmW
1018	0x140f6	AddAccessAllowedAce
1019	0x145dd	AddAccessAllowedAceEx
1020	0x43154	AddAccessAllowedObjectAce
1021	0x2717c	AddAccessDeniedAce
1022	0x43164	AddAccessDeniedAceEx
1023	0x43174	AddAccessDeniedObjectAce
1024	0xadaf	AddAce
1025	0x19a4	AddAuditAccessAce
1026	0x43184	AddAuditAccessAceEx
1027	0x43194	AddAuditAccessObjectAce
1028	0x6242e	AddConditionalAce
1029	0x1abf9	AddMandatoryAce
1030	0x42b23	AddUsersToEncryptedFile
1031	0x42b66	AddUsersToEncryptedFileEx
1032	0x431a4	AdjustTokenGroups
1033	0x1410e	AdjustTokenPrivileges
1034	0x14066	AllocateAndInitializeSid
1035	0x198c	AllocateLocallyUniqueId
1036	0x431b4	AreAllAccessesGranted
1037	0x431c4	AreAnyAccessesGranted
1038	0xaee4	AuditComputeEffectivePolicyBySid
1039	0x45e81	AuditComputeEffectivePolicyByToken
1040	0x45f6d	AuditEnumerateCategories
1041	0x45e01	AuditEnumeratePerUserPolicy
1042	0xb174	AuditEnumerateSubCategories
1043	0xb28c	AuditFree
1044	0x462a3	AuditLookupCategoryGuidFromCategoryId
1045	0x46241	AuditLookupCategoryIdFromCategoryGuid
1046	0x46171	AuditLookupCategoryNameA
1047	0x46071	AuditLookupCategoryNameW
1048	0x461d9	AuditLookupSubCategoryNameA
1049	0x2927a	AuditLookupSubCategoryNameW
1050	0x4664f	AuditQueryGlobalSaclA
1051	0x46601	AuditQueryGlobalSaclW
1052	0x45d59	AuditQueryPerUserPolicy
1053	0x463d9	AuditQuerySecurity
1054	0xae44	AuditQuerySystemPolicy
1055	0x46491	AuditSetGlobalSaclA
1056	0xb29c	AuditSetGlobalSaclW
1057	0x45cc5	AuditSetPerUserPolicy
1058	0x462df	AuditSetSecurity
1059	0xb0e2	AuditSetSystemPolicy
1060	0x41048	BackupEventLogA
1061	0x40adb	BackupEventLogW
1062	0x23d5	BuildExplicitAccessWithNameA
1063	0x23d5	BuildExplicitAccessWithNameW
1064	0x51efd	BuildImpersonateExplicitAccessWithNameA
1065	0x51efd	BuildImpersonateExplicitAccessWithNameW
1066	0x520c8	BuildImpersonateTrusteeA
1067	0x520c8	BuildImpersonateTrusteeW
1068	0x51a65	BuildSecurityDescriptorA
1069	0x72e7	BuildSecurityDescriptorW
1070	0x2405	BuildTrusteeWithNameA
1071	0x2405	BuildTrusteeWithNameW
1072	0x52184	BuildTrusteeWithObjectsAndNameA
1073	0x52184	BuildTrusteeWithObjectsAndNameW
1074	0x520e5	BuildTrusteeWithObjectsAndSidA
1075	0x520e5	BuildTrusteeWithObjectsAndSidW
1076	0x2777b	BuildTrusteeWithSidA
1077	0x2777b	BuildTrusteeWithSidW
1078	0x53149	CancelOverlappedAccess
1079	0x431d4	ChangeServiceConfig2A
1080	0x431e4	ChangeServiceConfig2W
1081	0x431f4	ChangeServiceConfigA
1082	0x43204	ChangeServiceConfigW
1083	0xdea4	CheckTokenMembership
1084	0x40fdf	ClearEventLogA
1085	0x409af	ClearEventLogW
1086	0x237a5	CloseCodeAuthzLevel
1087	0x42a24	CloseEncryptedFileRaw
1088	0x7763	CloseEventLog
1089	0x1361c	CloseServiceHandle
1090	0x666a5	CloseThreadWaitChainSession
1091	0x10cb7	CloseTrace
1092	0x29a3d	CommandLineFromMsiDescriptor
1093	0x232d2	ComputeAccessTokenFromCodeAuthzLevel
1094	0x270dc	ControlService
1095	0x43214	ControlServiceExA
1096	0x43224	ControlServiceExW
1097	0x590dc	ControlTraceA
1098	0xf5ff	ControlTraceW
1099	0x53df1	ConvertAccessToSecurityDescriptorA
1100	0x52a74	ConvertAccessToSecurityDescriptorW
1101	0x627bd	ConvertSDToStringSDRootDomainA
1102	0x6266e	ConvertSDToStringSDRootDomainW
1103	0x52ca1	ConvertSecurityDescriptorToAccessA
1104	0x52ca1	ConvertSecurityDescriptorToAccessNamedA
1105	0x52c7c	ConvertSecurityDescriptorToAccessNamedW
1106	0x52c7c	ConvertSecurityDescriptorToAccessW
1107	0x6294a	ConvertSecurityDescriptorToStringSecurityDescriptorA
1108	0x4241	ConvertSecurityDescriptorToStringSecurityDescriptorW
1109	0x318f0	ConvertSidToStringSidA
1110	0x142c4	ConvertSidToStringSidW
1111	0x628a0	ConvertStringSDToSDDomainA
1112	0x626c6	ConvertStringSDToSDDomainW
1113	0x6273d	ConvertStringSDToSDRootDomainA
1114	0x6261b	ConvertStringSDToSDRootDomainW
1115	0xca34	ConvertStringSecurityDescriptorToSecurityDescriptorA
1116	0x11ed9	ConvertStringSecurityDescriptorToSecurityDescriptorW
1117	0x20ea3	ConvertStringSidToSidA
1118	0x2095c	ConvertStringSidToSidW
1119	0x43234	ConvertToAutoInheritPrivateObjectSecurity
1120	0x143ce	CopySid
1121	0x4dbc8	CreateCodeAuthzLevel
1122	0x299aa	CreatePrivateObjectSecurity
1123	0xf42f	CreatePrivateObjectSecurityEx
1124	0x43244	CreatePrivateObjectSecurityWithMultipleInheritance
1125	0x42642	CreateProcessAsUserA
1126	0xc532	CreateProcessAsUserW
1127	0x45429	CreateProcessWithLogonW
1128	0x4545f	CreateProcessWithTokenW
1129	0x43254	CreateRestrictedToken
1130	0x43264	CreateServiceA
1131	0x270c4	CreateServiceW
1132	0x1ac14	CreateTraceInstanceId
1133	0x1479e	CreateWellKnownSid
1134	0x47e5d	CredBackupCredentials
1135	0x47a81	CredDeleteA
1136	0x47b31	CredDeleteW
1137	0x48339	CredEncryptAndMarshalBinaryBlob
1138	0x474c1	CredEnumerateA
1139	0x475c1	CredEnumerateW
1140	0x48089	CredFindBestCredentialA
1141	0x48169	CredFindBestCredentialW
1142	0xb28c	CredFree
1143	0x47db1	CredGetSessionTypes
1144	0x47bf3	CredGetTargetInfoA
1145	0x47cd1	CredGetTargetInfoW
1146	0x48577	CredIsMarshaledCredentialA
1147	0x27604	CredIsMarshaledCredentialW
1148	0x48461	CredIsProtectedA
1149	0xc058	CredIsProtectedW
1150	0x484c3	CredMarshalCredentialA
1151	0x8d79	CredMarshalCredentialW
1152	0x59e1	CredProfileLoaded
1153	0x26fa9	CredProfileUnloaded
1154	0x4835b	CredProtectA
1155	0x8bc0	CredProtectW
1156	0x47301	CredReadA
1157	0x48249	CredReadByTokenHandle
1158	0x47881	CredReadDomainCredentialsA
1159	0x47981	CredReadDomainCredentialsW
1160	0x473e1	CredReadW
1161	0x47be1	CredRenameA
1162	0x47be1	CredRenameW
1163	0x47f79	CredRestoreCredentials
1164	0x4850e	CredUnmarshalCredentialA
1165	0xbff7	CredUnmarshalCredentialW
1166	0x485a5	CredUnprotectA
1167	0x807e	CredUnprotectW
1168	0x47191	CredWriteA
1169	0x476c1	CredWriteDomainCredentialsA
1170	0x477a1	CredWriteDomainCredentialsW
1171	0x47249	CredWriteW
1172	0x46cca	CredpConvertCredential
1173	0x46b84	CredpConvertOneCredentialSize
1174	0x46d81	CredpConvertTargetInfo
1175	0x4673a	CredpDecodeCredential
1176	0x466d9	CredpEncodeCredential
1177	0x47e39	CredpEncodeSecret
1178	0x9179	CryptAcquireContextA
1179	0xdeb4	CryptAcquireContextW
1180	0x43274	CryptContextAddRef
1181	0xdeee	CryptCreateHash
1182	0x43284	CryptDecrypt
1183	0x43294	CryptDeriveKey
1184	0xdf06	CryptDestroyHash
1185	0xc4ba	CryptDestroyKey
1186	0x432a4	CryptDuplicateHash
1187	0x432b4	CryptDuplicateKey
1188	0x27733	CryptEncrypt
1189	0x432c4	CryptEnumProviderTypesA
1190	0x432d4	CryptEnumProviderTypesW
1191	0x432e4	CryptEnumProvidersA
1192	0x432f4	CryptEnumProvidersW
1193	0x9186	CryptExportKey
1194	0x8e89	CryptGenKey
1195	0xdf68	CryptGenRandom
1196	0x43304	CryptGetDefaultProviderA
1197	0x43314	CryptGetDefaultProviderW
1198	0xdf1e	CryptGetHashParam
1199	0x27763	CryptGetKeyParam
1200	0x43324	CryptGetProvParam
1201	0x43334	CryptGetUserKey
1202	0xded6	CryptHashData
1203	0x43344	CryptHashSessionKey
1204	0xc4d2	CryptImportKey
1205	0xe0c4	CryptReleaseContext
1206	0x43354	CryptSetHashParam
1207	0x2774b	CryptSetKeyParam
1208	0x43364	CryptSetProvParam
1209	0x43374	CryptSetProviderA
1210	0x43384	CryptSetProviderExA
1211	0x43394	CryptSetProviderExW
1212	0x433a4	CryptSetProviderW
1213	0x433b4	CryptSignHashA
1214	0x433c4	CryptSignHashW
1215	0x433d4	CryptVerifySignatureA
1216	0xc4ea	CryptVerifySignatureW
1217	0x42e81	DecryptFileA
1218	0x42947	DecryptFileW
1219	0x1426c	DeleteAce
1220	0x270f4	DeleteService
1221	0x1355d	DeregisterEventSource
1222	0xf417	DestroyPrivateObjectSecurity
1223	0x42bf0	DuplicateEncryptionInfoFile
1224	0xc786	DuplicateToken
1225	0xc9c4	DuplicateTokenEx
1226	0x65229	ElfBackupEventLogFileA
1227	0x64d59	ElfBackupEventLogFileW
1228	0x64b09	ElfChangeNotify
1229	0x65181	ElfClearEventLogFileA
1230	0x64cb1	ElfClearEventLogFileW
1231	0x7784	ElfCloseEventLog
1232	0x1357e	ElfDeregisterEventSource
1233	0x653e1	ElfFlushEventLog
1234	0x64999	ElfNumberOfRecords
1235	0x64a51	ElfOldestRecord
1236	0x65091	ElfOpenBackupEventLogA
1237	0x64bc1	ElfOpenBackupEventLogW
1238	0x64f1e	ElfOpenEventLogA
1239	0x75e0	ElfOpenEventLogW
1240	0x652e1	ElfReadEventLogA
1241	0x64e11	ElfReadEventLogW
1242	0x12d0d	ElfRegisterEventSourceA
1243	0x125a9	ElfRegisterEventSourceW
1244	0x4019	ElfReportEventA
1245	0x64f11	ElfReportEventAndSourceW
1246	0xc90a	ElfReportEventW
1247	0xfc7e	EnableTrace
1248	0xfa25	EnableTraceEx2
1249	0xfc04	EnableTraceEx
1250	0x42de4	EncryptFileA
1251	0x428f8	EncryptFileW
1252	0x42c5f	EncryptedFileKeyInfo
1253	0x42c33	EncryptionDisable
1254	0x622e4	EnumDependentServicesA
1255	0x1e3a	EnumDependentServicesW
1256	0x620f1	EnumServiceGroupW
1257	0x62201	EnumServicesStatusA
1258	0x2a37a	EnumServicesStatusExA
1259	0xb406	EnumServicesStatusExW
1260	0x62401	EnumServicesStatusW
1261	0x29674	EnumerateTraceGuids
1262	0x589dd	EnumerateTraceGuidsEx
1263	0x433e4	EqualDomainSid
1264	0xcc89	EqualPrefixSid
1265	0x1408b	EqualSid
1266	0x3118	EventAccessControl
1267	0x34be	EventAccessQuery
1268	0x5895e	EventAccessRemove
1269	0x1ac33	EventActivityIdControl
1270	0x1ac53	EventEnabled
1271	0x1ac69	EventProviderEnabled
1272	0x1ac87	EventRegister
1273	0x1ac9e	EventUnregister
1274	0x1acb7	EventWrite
1275	0x1accb	EventWriteEndScenario
1276	0x433f4	EventWriteEx
1277	0x1acea	EventWriteStartScenario
1278	0x1ad0b	EventWriteString
1279	0x1ad25	EventWriteTransfer
1280	0x42f21	FileEncryptionStatusA
1281	0x4299a	FileEncryptionStatusW
1282	0x43425	FindFirstFreeAce
1283	0x4309d	FlushEfsCache
1284	0x59722	FlushTraceA
1285	0x5ff1	FlushTraceW
1286	0x42ca2	FreeEncryptedFileKeyInfo
1287	0x42dc2	FreeEncryptedFileMetadata
1288	0x42a7d	FreeEncryptionCertificateHashList
1289	0x520a2	FreeInheritedFromArray
1290	0x140ae	FreeSid
1291	0x532b1	GetAccessPermissionsForObjectA
1292	0x531c9	GetAccessPermissionsForObjectW
1293	0x14570	GetAce
1294	0xcc29	GetAclInformation
1295	0x51a1f	GetAuditedPermissionsFromAclA
1296	0x519cc	GetAuditedPermissionsFromAclW
1297	0x412e6	GetCurrentHwProfileA
1298	0x1a03	GetCurrentHwProfileW
1299	0x51953	GetEffectiveRightsFromAclA
1300	0x518f1	GetEffectiveRightsFromAclW
1301	0x42d78	GetEncryptedFileMetadata
1302	0x7824	GetEventLogInformation
1303	0x519bf	GetExplicitEntriesFromAclA
1304	0x5199f	GetExplicitEntriesFromAclW
1305	0x41aa0	GetFileSecurityA
1306	0xa8ed	GetFileSecurityW
1307	0x9030	GetInformationCodeAuthzLevelW
1308	0x9cc5	GetInformationCodeAuthzPolicyW
1309	0x52097	GetInheritanceSourceA
1310	0x52051	GetInheritanceSourceW
1311	0x145ad	GetKernelObjectSecurity
1312	0x140bb	GetLengthSid
1313	0x4c5e3	GetLocalManagedApplicationData
1314	0x4c39b	GetLocalManagedApplications
1315	0x4c8d6	GetManagedApplicationCategories
1316	0x4c876	GetManagedApplications
1317	0x52242	GetMultipleTrusteeA
1318	0x52226	GetMultipleTrusteeOperationA
1319	0x52226	GetMultipleTrusteeOperationW
1320	0x52242	GetMultipleTrusteeW
1321	0x51694	GetNamedSecurityInfoA
1322	0x524c9	GetNamedSecurityInfoExA
1323	0x5225d	GetNamedSecurityInfoExW
1324	0xf4a3	GetNamedSecurityInfoW
1325	0x4095b	GetNumberOfEventLogRecords
1326	0x40985	GetOldestEventLogRecord
1327	0x53029	GetOverlappedAccessResults
1328	0x43435	GetPrivateObjectSecurity
1329	0xad7f	GetSecurityDescriptorControl
1330	0x14126	GetSecurityDescriptorDacl
1331	0xadc7	GetSecurityDescriptorGroup
1332	0xcc11	GetSecurityDescriptorLength
1333	0xad97	GetSecurityDescriptorOwner
1334	0x43445	GetSecurityDescriptorRMControl
1335	0x14588	GetSecurityDescriptorSacl
1336	0xb384	GetSecurityInfo
1337	0x528e1	GetSecurityInfoExA
1338	0x52677	GetSecurityInfoExW
1339	0x61e11	GetServiceDisplayNameA
1340	0x27953	GetServiceDisplayNameW
1341	0x61d74	GetServiceKeyNameA
1342	0x27897	GetServiceKeyNameW
1343	0xa8d5	GetSidIdentifierAuthority
1344	0xcc59	GetSidLengthRequired
1345	0x10da2	GetSidSubAuthority
1346	0x10d8a	GetSidSubAuthorityCount
1347	0x673a7	GetThreadWaitChain
1348	0x1429c	GetTokenInformation
1349	0x1ad41	GetTraceEnableFlags
1350	0x1ad5e	GetTraceEnableLevel
1351	0x1ad7b	GetTraceLoggerHandle
1352	0x52209	GetTrusteeFormA
1353	0x52209	GetTrusteeFormW
1354	0x521d9	GetTrusteeNameA
1355	0x521d9	GetTrusteeNameW
1356	0x521ed	GetTrusteeTypeA
1357	0x521ed	GetTrusteeTypeW
1358	0x2a44c	GetUserNameA
1359	0x114fa	GetUserNameW
1360	0x43455	GetWindowsAccountDomainSid
1361	0x1ad99	I_QueryTagInformation
1362	0x1add0	I_ScIsSecurityProcess
1363	0x1ae07	I_ScPnPGetServiceName
1364	0x1ae3e	I_ScQueryServiceConfig
1365	0x1ae76	I_ScSendPnPMessage
1366	0x1aeaa	I_ScSendTSMessage
1367	0x623b9	I_ScSetServiceBitsA
1368	0x7cd9	I_ScSetServiceBitsW
1369	0x1aedd	I_ScValidatePnPService
1370	0x22082	IdentifyCodeAuthzLevelW
1371	0x43465	ImpersonateAnonymousToken
1372	0xc51a	ImpersonateLoggedOnUser
1373	0x43475	ImpersonateNamedPipeClient
1374	0xae2c	ImpersonateSelf
1375	0x1454d	InitializeAcl
1376	0x145a0	InitializeSecurityDescriptor
1377	0xcc41	InitializeSid
1378	0x5e0b6	InitiateShutdownA
1379	0x5dffc	InitiateShutdownW
1380	0x5ddf7	InitiateSystemShutdownA
1381	0x5de9e	InitiateSystemShutdownExA
1382	0x5dd22	InitiateSystemShutdownExW
1383	0x5dc55	InitiateSystemShutdownW
1384	0x4d051	InstallApplication
1385	0x1440e	IsTextUnicode
1386	0xc502	IsTokenRestricted
1387	0x4dc86	IsTokenUntrusted
1388	0x84c3	IsValidAcl
1389	0x1af15	IsValidRelativeSecurityDescriptor
1390	0xb52c	IsValidSecurityDescriptor
1391	0x12e6f	IsValidSid
1392	0xcaa6	IsWellKnownSid
1393	0x61eb1	LockServiceDatabase
1394	0x4275e	LogonUserA
1395	0x4278d	LogonUserExA
1396	0xb905	LogonUserExExW
1397	0x4260f	LogonUserExW
1398	0xc149	LogonUserW
1399	0x41b0d	LookupAccountNameA
1400	0xe216	LookupAccountNameW
1401	0x41eb4	LookupAccountSidA
1402	0x147f4	LookupAccountSidW
1403	0x423fb	LookupPrivilegeDisplayNameA
1404	0x421be	LookupPrivilegeDisplayNameW
1405	0x422e0	LookupPrivilegeNameA
1406	0x420b5	LookupPrivilegeNameW
1407	0x13fca	LookupPrivilegeValueA
1408	0x14133	LookupPrivilegeValueW
1409	0x51d07	LookupSecurityDescriptorPartsA
1410	0x51b56	LookupSecurityDescriptorPartsW
1411	0x48959	LsaAddAccountRights
1412	0x4acf9	LsaAddPrivilegesToAccount
1413	0x49eb1	LsaClearAuditLog
1414	0x21a77	LsaClose
1415	0x4a4f1	LsaCreateAccount
1416	0x4ab01	LsaCreateSecret
1417	0x4a661	LsaCreateTrustedDomain
1418	0x49601	LsaCreateTrustedDomainEx
1419	0x4a2b9	LsaDelete
1420	0x48c11	LsaDeleteTrustedDomain
1421	0x488a9	LsaEnumerateAccountRights
1422	0x4a5a9	LsaEnumerateAccounts
1423	0x487f7	LsaEnumerateAccountsWithUserRight
1424	0x4aa4d	LsaEnumeratePrivileges
1425	0x4ac71	LsaEnumeratePrivilegesOfAccount
1426	0x502d	LsaEnumerateTrustedDomains
1427	0x4953d	LsaEnumerateTrustedDomainsEx
1428	0x1ed61	LsaFreeMemory
1429	0x4ae09	LsaGetQuotasForAccount
1430	0x4b4bb	LsaGetRemoteUserName
1431	0x4af19	LsaGetSystemAccessAccount
1432	0xac82	LsaGetUserName
1433	0x27cbe	LsaICLookupNames
1434	0x274d3	LsaICLookupNamesWithCreds
1435	0x29472	LsaICLookupSids
1436	0x272a0	LsaICLookupSidsWithCreds
1437	0x27c74	LsaLookupNames2
1438	0x4b5dd	LsaLookupNames
1439	0x49fd9	LsaLookupPrivilegeDisplayName
1440	0x49f31	LsaLookupPrivilegeName
1441	0x141d1	LsaLookupPrivilegeValue
1442	0x29374	LsaLookupSids
1443	0x49a1c	LsaManageSidNameMapping
1444	0x4b761	LsaNtStatusToWinError
1445	0x4abb9	LsaOpenAccount
1446	0x206fc	LsaOpenPolicy
1447	0x49d0c	LsaOpenPolicySce
1448	0x4b029	LsaOpenSecret
1449	0x4a719	LsaOpenTrustedDomain
1450	0x497f9	LsaOpenTrustedDomainByName
1451	0x496c9	LsaQueryDomainInformationPolicy
1452	0x498a9	LsaQueryForestTrustInformation
1453	0x4a7d1	LsaQueryInfoTrustedDomain
1454	0x21b30	LsaQueryInformationPolicy
1455	0x4b45d	LsaQuerySecret
1456	0x4a349	LsaQuerySecurityObject
1457	0x48a89	LsaQueryTrustedDomainInfo
1458	0x4908d	LsaQueryTrustedDomainInfoByName
1459	0x489f1	LsaRemoveAccountRights
1460	0x4ad81	LsaRemovePrivilegesFromAccount
1461	0x569e	LsaRetrievePrivateData
1462	0x49761	LsaSetDomainInformationPolicy
1463	0x49931	LsaSetForestTrustInformation
1464	0x49dc1	LsaSetInformationPolicy
1465	0x4a889	LsaSetInformationTrustedDomain
1466	0x4ae91	LsaSetQuotasForAccount
1467	0x4b245	LsaSetSecret
1468	0x4a3f1	LsaSetSecurityObject
1469	0x4afa1	LsaSetSystemAccessAccount
1470	0x4937d	LsaSetTrustedDomainInfoByName
1471	0x48b49	LsaSetTrustedDomainInformation
1472	0x48ec8	LsaStorePrivateData
1473	0x1af42	MD4Final
1474	0x1af51	MD4Init
1475	0x1af5f	MD4Update
1476	0x1af6f	MD5Final
1477	0x1af7e	MD5Init
1478	0x1af8c	MD5Update
1479	0x4402f	MSChapSrvChangePassword2
1480	0x43e4b	MSChapSrvChangePassword
1481	0x43485	MakeAbsoluteSD2
1482	0xcc71	MakeAbsoluteSD
1483	0xcbf9	MakeSelfRelativeSD
1484	0x27a0b	MapGenericMask
1485	0x389b	NotifyBootConfigStatus
1486	0x40931	NotifyChangeEventLog
1487	0xca29	NotifyServiceStatusChange
1488	0x2ec1c	NotifyServiceStatusChangeA
1489	0xca1c	NotifyServiceStatusChangeW
1490	0x41904	ObjectCloseAuditAlarmA
1491	0x43495	ObjectCloseAuditAlarmW
1492	0x41959	ObjectDeleteAuditAlarmA
1493	0x434a5	ObjectDeleteAuditAlarmW
1494	0x417b9	ObjectOpenAuditAlarmA
1495	0x434b5	ObjectOpenAuditAlarmW
1496	0x418a6	ObjectPrivilegeAuditAlarmA
1497	0x434c5	ObjectPrivilegeAuditAlarmW
1498	0x41102	OpenBackupEventLogA
1499	0x40bf7	OpenBackupEventLogW
1500	0x42fc4	OpenEncryptedFileRawA
1501	0x429c6	OpenEncryptedFileRawW
1502	0x410b1	OpenEventLogA
1503	0x7599	OpenEventLogW
1504	0x14284	OpenProcessToken
1505	0x12b58	OpenSCManagerA
1506	0xca04	OpenSCManagerW
1507	0x12b70	OpenServiceA
1508	0xc9ec	OpenServiceW
1509	0x142ac	OpenThreadToken
1510	0x665ce	OpenThreadWaitChainSession
1511	0x588ab	OpenTraceA
1512	0xefc4	OpenTraceW
1513	0x5e719	PerfAddCounters
1514	0x5e34e	PerfCloseQueryHandle
1515	0x1af9c	PerfCreateInstance
1516	0x1afb5	PerfDecrementULongCounterValue
1517	0x1afda	PerfDecrementULongLongCounterValue
1518	0x5e737	PerfDeleteCounters
1519	0x1b003	PerfDeleteInstance
1520	0x5e891	PerfEnumerateCounterSet
1521	0x5eac9	PerfEnumerateCounterSetInstances
1522	0x1b01c	PerfIncrementULongCounterValue
1523	0x1b041	PerfIncrementULongLongCounterValue
1524	0x5ebd1	PerfOpenQueryHandle
1525	0x5e529	PerfQueryCounterData
1526	0x5e421	PerfQueryCounterInfo
1527	0x5e9a9	PerfQueryCounterSetRegistrationInfo
1528	0x1b06a	PerfQueryInstance
1529	0x1b082	PerfSetCounterRefValue
1530	0x1b09f	PerfSetCounterSetInfo
1531	0x1b0bb	PerfSetULongCounterValue
1532	0x1b0da	PerfSetULongLongCounterValue
1533	0x1b0fd	PerfStartProvider
1534	0x1b115	PerfStartProviderEx
1535	0x1b12f	PerfStopProvider
1536	0xae14	PrivilegeCheck
1537	0x419ae	PrivilegedServiceAuditAlarmA
1538	0x434d5	PrivilegedServiceAuditAlarmW
1539	0x45661	ProcessIdleTasks
1540	0x456f9	ProcessIdleTasksW
1541	0x104b7	ProcessTrace
1542	0x59859	QueryAllTracesA
1543	0x5983b	QueryAllTracesW
1544	0x42a9d	QueryRecoveryAgentsOnEncryptedFile
1545	0x434e5	QuerySecurityAccessMask
1546	0x434f5	QueryServiceConfig2A
1547	0x43505	QueryServiceConfig2W
1548	0x299e7	QueryServiceConfigA
1549	0xb4d7	QueryServiceConfigW
1550	0x61f39	QueryServiceLockStatusA
1551	0x61fd1	QueryServiceLockStatusW
1552	0x43515	QueryServiceObjectSecurity
1553	0x12a06	QueryServiceStatus
1554	0x792c	QueryServiceStatusEx
1555	0x5969e	QueryTraceA
1556	0x7a37	QueryTraceW
1557	0x42a3a	QueryUsersOnEncryptedFile
1558	0x429f8	ReadEncryptedFileRaw
1559	0x411b3	ReadEventLogA
1560	0x40f8b	ReadEventLogW
1561	0x1461d	RegCloseKey
1562	0x5f13d	RegConnectRegistryA
1563	0x5f0dd	RegConnectRegistryExA
1564	0x8ebf	RegConnectRegistryExW
1565	0x8ea1	RegConnectRegistryW
1566	0x5f770	RegCopyTreeA
1567	0x5f593	RegCopyTreeW
1568	0xcca1	RegCreateKeyA
1569	0x113e9	RegCreateKeyExA
1570	0x1407e	RegCreateKeyExW
1571	0x5f899	RegCreateKeyTransactedA
1572	0xa7e8	RegCreateKeyTransactedW
1573	0x11494	RegCreateKeyW
1574	0x2a84f	RegDeleteKeyA
1575	0x43525	RegDeleteKeyExA
1576	0xa965	RegDeleteKeyExW
1577	0x5f9a4	RegDeleteKeyTransactedA
1578	0xa88a	RegDeleteKeyTransactedW
1579	0x5f9ef	RegDeleteKeyValueA
1580	0x5fa2f	RegDeleteKeyValueW
1581	0x111f2	RegDeleteKeyW
1582	0x435bf	RegDeleteTreeA
1583	0x435af	RegDeleteTreeW
1584	0x2a482	RegDeleteValueA
1585	0xced1	RegDeleteValueW
1586	0xb544	RegDisablePredefinedCache
1587	0x43535	RegDisablePredefinedCacheEx
1588	0x27c6a	RegDisableReflectionKey
1589	0x27c6a	RegEnableReflectionKey
1590	0x2a231	RegEnumKeyA
1591	0x11401	RegEnumKeyExA
1592	0x14648	RegEnumKeyExW
1593	0x143db	RegEnumKeyW
1594	0xcee9	RegEnumValueA
1595	0x1484c	RegEnumValueW
1596	0x276d7	RegFlushKey
1597	0xa935	RegGetKeySecurity
1598	0xa97d	RegGetValueA
1599	0x10dc5	RegGetValueW
1600	0x5ffb3	RegLoadAppKeyA
1601	0x5fdfb	RegLoadAppKeyW
1602	0x4356f	RegLoadKeyA
1603	0x4357f	RegLoadKeyW
1604	0x4353f	RegLoadMUIStringA
1605	0x11137	RegLoadMUIStringW
1606	0xe0fb	RegNotifyChangeKeyValue
1607	0x1152d	RegOpenCurrentUser
1608	0xcbb5	RegOpenKeyA
1609	0x14887	RegOpenKeyExA
1610	0x1460d	RegOpenKeyExW
1611	0x5f8f3	RegOpenKeyTransactedA
1612	0xa842	RegOpenKeyTransactedW
1613	0x123d9	RegOpenKeyW
1614	0x2885c	RegOpenUserClassesRoot
1615	0x5f7cc	RegOverridePredefKey
1616	0xe0e3	RegQueryInfoKeyA
1617	0x14667	RegQueryInfoKeyW
1618	0x6019a	RegQueryMultipleValuesA
1619	0x60715	RegQueryMultipleValuesW
1620	0x440a7	RegQueryReflectionKey
1621	0xcdb2	RegQueryValueA
1622	0x1486f	RegQueryValueExA
1623	0x1462d	RegQueryValueExW
1624	0x14434	RegQueryValueW
1625	0x5f93c	RegRenameKey
1626	0x60b2b	RegReplaceKeyA
1627	0x60d71	RegReplaceKeyW
1628	0x4355f	RegRestoreKeyA
1629	0x27c52	RegRestoreKeyW
1630	0x60eb1	RegSaveKeyA
1631	0x4354f	RegSaveKeyExA
1632	0x27c3a	RegSaveKeyExW
1633	0x27a33	RegSaveKeyW
1634	0xb274	RegSetKeySecurity
1635	0x5fa6f	RegSetKeyValueA
1636	0x27118	RegSetKeyValueW
1637	0x61029	RegSetValueA
1638	0x11433	RegSetValueExA
1639	0x11456	RegSetValueExW
1640	0x2a622	RegSetValueW
1641	0x4358f	RegUnLoadKeyA
1642	0x4359f	RegUnLoadKeyW
1643	0x12cc6	RegisterEventSourceA
1644	0x1269c	RegisterEventSourceW
1645	0x5bfc	RegisterIdleTask
1646	0x435cf	RegisterServiceCtrlHandlerA
1647	0x435df	RegisterServiceCtrlHandlerExA
1648	0xa94d	RegisterServiceCtrlHandlerExW
1649	0xa91d	RegisterServiceCtrlHandlerW
1650	0x1b146	RegisterTraceGuidsA
1651	0x1b163	RegisterTraceGuidsW
1652	0x66553	RegisterWaitChainCOMCallback
1653	0x5879d	RemoveTraceCallback
1654	0x42ae0	RemoveUsersFromEncryptedFile
1655	0x3ee9	ReportEventA
1656	0xc7d9	ReportEventW
1657	0x114e2	RevertToSelf
1658	0x237a5	SaferCloseLevel
1659	0x232d2	SaferComputeTokenFromLevel
1660	0x4dbc8	SaferCreateLevel
1661	0x9030	SaferGetLevelInformation
1662	0x9cc5	SaferGetPolicyInformation
1663	0x22082	SaferIdentifyLevel
1664	0x4f1fd	SaferRecordEventLogEntry
1665	0x501b3	SaferSetLevelInformation
1666	0x4e5bd	SaferSetPolicyInformation
1667	0x506d5	SaferiChangeRegistryScope
1668	0xb569	SaferiCompareTokenLevels
1669	0x4eeb5	SaferiIsDllAllowed
1670	0x9b75	SaferiIsExecutableFileType
1671	0x919e	SaferiPopulateDefaultsInRegistry
1672	0x4f1fd	SaferiRecordEventLogEntry
1673	0x797b	SaferiSearchMatchingHashRules
1674	0x435ef	SetAclInformation
1675	0x42d9d	SetEncryptedFileMetadata
1676	0x5401d	SetEntriesInAccessListA
1677	0x52d28	SetEntriesInAccessListW
1678	0x51729	SetEntriesInAclA
1679	0x129e6	SetEntriesInAclW
1680	0x54056	SetEntriesInAuditListA
1681	0x52d61	SetEntriesInAuditListW
1682	0x41a39	SetFileSecurityA
1683	0x7963	SetFileSecurityW
1684	0x501b3	SetInformationCodeAuthzLevelW
1685	0x4e5bd	SetInformationCodeAuthzPolicyW
1686	0x145c5	SetKernelObjectSecurity
1687	0x516e0	SetNamedSecurityInfoA
1688	0x53659	SetNamedSecurityInfoExA
1689	0x53442	SetNamedSecurityInfoExW
1690	0x9f82	SetNamedSecurityInfoW
1691	0x435ff	SetPrivateObjectSecurity
1692	0x4360f	SetPrivateObjectSecurityEx
1693	0x4361f	SetSecurityAccessMask
1694	0x27a23	SetSecurityDescriptorControl
1695	0x140de	SetSecurityDescriptorDacl
1696	0xf40a	SetSecurityDescriptorGroup
1697	0xf3f2	SetSecurityDescriptorOwner
1698	0x4362f	SetSecurityDescriptorRMControl
1699	0x14600	SetSecurityDescriptorSacl
1700	0x9e7f	SetSecurityInfo
1701	0x53b41	SetSecurityInfoExA
1702	0x53929	SetSecurityInfoExW
1703	0x623cb	SetServiceBits
1704	0x4363f	SetServiceObjectSecurity
1705	0xc746	SetServiceStatus
1706	0xc76e	SetThreadToken
1707	0x9a32	SetTokenInformation
1708	0x586af	SetTraceCallback
1709	0x43063	SetUserFileEncryptionKey
1710	0x42ba9	SetUserFileEncryptionKeyEx
1711	0x4364f	StartServiceA
1712	0x4365f	StartServiceCtrlDispatcherA
1713	0xa905	StartServiceCtrlDispatcherW
1714	0x7914	StartServiceW
1715	0x58c2e	StartTraceA
1716	0xe407	StartTraceW
1717	0x596bf	StopTraceA
1718	0x10d69	StopTraceW
1719	0x440c0	SystemFunction001
1720	0x26f64	SystemFunction002
1721	0x8425	SystemFunction003
1722	0x44105	SystemFunction004
1723	0x4414a	SystemFunction005
1724	0x836a	SystemFunction006
1725	0xb949	SystemFunction007
1726	0x45956	SystemFunction008
1727	0x459fd	SystemFunction009
1728	0x45a0d	SystemFunction010
1729	0x45a58	SystemFunction011
1730	0x45a65	SystemFunction012
1731	0x45a9f	SystemFunction013
1732	0x45bd5	SystemFunction014
1733	0x45ad9	SystemFunction015
1734	0x45ae6	SystemFunction016
1735	0x45b1c	SystemFunction017
1736	0x45b52	SystemFunction018
1737	0x45b5f	SystemFunction019
1738	0x45bd5	SystemFunction020
1739	0x45ad9	SystemFunction021
1740	0x45bd5	SystemFunction022
1741	0x45ad9	SystemFunction023
1742	0x45b6c	SystemFunction024
1743	0x26f08	SystemFunction025
1744	0x45bc8	SystemFunction026
1745	0x26efb	SystemFunction027
1746	0x4418f	SystemFunction028
1747	0x441d1	SystemFunction029
1748	0x26e9f	SystemFunction030
1749	0x26e9f	SystemFunction031
1750	0x45be5	SystemFunction032
1751	0x45be5	SystemFunction033
1752	0x44213	SystemFunction034
1753	0x1b180	SystemFunction035
1754	0x1919	SystemFunction036
1755	0xa04f	SystemFunction040
1756	0xa00a	SystemFunction041
1757	0x1b19d	TraceEvent
1758	0x1b1b4	TraceEventInstance
1759	0x1b1d0	TraceMessage
1760	0x1b1e6	TraceMessageVa
1761	0x58a8f	TraceSetInformation
1762	0x52046	TreeResetNamedSecurityInfoA
1763	0x51f38	TreeResetNamedSecurityInfoW
1764	0x52046	TreeSetNamedSecurityInfoA
1765	0x51fc2	TreeSetNamedSecurityInfoW
1766	0x52e71	TrusteeAccessToObjectA
1767	0x52d88	TrusteeAccessToObjectW
1768	0x4c34d	UninstallApplication
1769	0x62069	UnlockServiceDatabase
1770	0x45706	UnregisterIdleTask
1771	0x1b1fe	UnregisterTraceGuids
1772	0x596e0	UpdateTraceA
1773	0x59701	UpdateTraceW
1774	0x42cc2	UsePinForEncryptedFilesA
1775	0x42d0b	UsePinForEncryptedFilesW
1776	0x13dbd	WmiCloseBlock
1777	0x56959	WmiDevInstToInstanceNameA
1778	0x2a0bb	WmiDevInstToInstanceNameW
1779	0x5616d	WmiEnumerateGuids
1780	0x566d2	WmiExecuteMethodA
1781	0x55e3d	WmiExecuteMethodW
1782	0x56a11	WmiFileHandleToInstanceNameA
1783	0x56757	WmiFileHandleToInstanceNameW
1784	0x287c9	WmiFreeBuffer
1785	0x57116	WmiMofEnumerateResourcesA
1786	0x282b7	WmiMofEnumerateResourcesW
1787	0x551ec	WmiNotificationRegistrationA
1788	0xaa07	WmiNotificationRegistrationW
1789	0x13ac1	WmiOpenBlock
1790	0x564b1	WmiQueryAllDataA
1791	0x564f5	WmiQueryAllDataMultipleA
1792	0x552b5	WmiQueryAllDataMultipleW
1793	0x13b8d	WmiQueryAllDataW
1794	0x2872d	WmiQueryGuidInformation
1795	0x56541	WmiQuerySingleInstanceA
1796	0x55965	WmiQuerySingleInstanceMultipleA
1797	0x5573d	WmiQuerySingleInstanceMultipleW
1798	0x5549d	WmiQuerySingleInstanceW
1799	0x55272	WmiReceiveNotificationsA
1800	0x55230	WmiReceiveNotificationsW
1801	0x565e7	WmiSetSingleInstanceA
1802	0x55abf	WmiSetSingleInstanceW
1803	0x5665b	WmiSetSingleItemA
1804	0x55c7d	WmiSetSingleItemW
1805	0x42a0e	WriteEncryptedFileRaw

module_name	ADVAPI32.dll
flags	0
timestamp	2013-08-29 01:30:04
version	0.0
ordinal_base	1000
nFunctions	806
nNames	805
Names(805)	0x1567c
Functions(806)	0x149e4
NameOrdinals(805)	0x16310

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Advanced Windows 32 Base API
FileVersion	6.1.7601.18247 (win7sp1_gdr.130828-1532)
InternalName	advapi32.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	advapi32.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.18247

VS_FIXEDFILEINFO

FileVersion	6.1.7601.18247
ProductVersion	6.1.7601.18247
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	640512	DLL	08/29/2013 01:48:26	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

advapi32.dll-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

advapi32.dll
-