wow64.dll

v10.0.19041.3636 64-bit Windows NT Analyzed
Download
Description
Win32 Emulation on NT64
Authors
© Microsoft Corporation. All rights reserved.
File size
346.6 KB
Uploaded
2025-12-01 07:45
Views
120
SHA-256
524beadedb98d8136471759eb2c3c027

Exported functions 29

Wow64AllocThreadHeap #1 · 0x10440
Wow64AllocateHeap #2 · 0x221a0
Wow64AllocateTemp #3 · 0x103e0
Wow64ApcRoutine #4 · 0x10a0
Wow64CheckIfNXEnabled #5 · 0x22b50
Wow64DispatchExceptionCHPE #6 · 0x20a70
Wow64EmulateAtlThunk #7 · 0x22bf0
Wow64FreeHeap #8 · 0x221d0
Wow64FreeThreadHeap #9 · 0x10370
Wow64IsControlFlowGuardEnforced #10 · 0x49f85
Wow64IsStackExtentsCheckEnforced #11 · 0x1ca0
Wow64KiUserCallbackDispatcher #12 · 0x34d0
Wow64LdrpInitialize #13 · 0x3250
Wow64LogPrint #14 · 0xa090
Wow64NotifyUnsimulateComplete #15 · 0x210d0
Wow64PassExceptionToGuest #16 · 0x222b0
Wow64PrepareForDebuggerAttach #17 · 0x224c0
Wow64PrepareForException #18 · 0x19e00
Wow64ProcessPendingCrossProcessItems #19 · 0x23810
Wow64RaiseException #20 · 0x20c10
Wow64ShallowThunkAllocObjectAttributes32TO64_FNC #21 · 0x9840
Wow64ShallowThunkAllocSecurityQualityOfService32TO64_FNC #22 · 0x9fd0
Wow64ShallowThunkSIZE_T32TO64 #23 · 0xc380
Wow64ShallowThunkSIZE_T64TO32 #24 · 0xe8e0
Wow64SuspendLocalProcess #25 · 0x21750
Wow64SuspendLocalThread #26 · 0x21900
Wow64SystemServiceEx #27 · 0x8f80
Wow64ValidateUserCallTarget #28 · 0x22e70
Wow64ValidateUserCallTargetFilter #29 · 0x22f90

Imported DLLs & functions 584

ntdll.dll 582
__C_specific_handler 0x18003ba18
__chkstk 0x18003cbd8
_local_unwind 0x18003bde0
_setjmp 0x18003bdd8
_vsnprintf 0x18003ba30
_vsnwprintf 0x18003ba40
CsrAllocateCaptureBuffer 0x18003ca78
CsrAllocateMessagePointer 0x18003bf90
CsrCaptureMessageBuffer 0x18003c208
CsrCaptureMessageMultiUnicodeStringsInPlace 0x18003cbd0
CsrCaptureMessageString 0x18003c328
CsrClientCallServer 0x18003c1e0
CsrClientConnectToServer 0x18003c618
CsrFreeCaptureBuffer 0x18003c678
CsrGetProcessId 0x18003c2e8
CsrIdentifyAlertableThread 0x18003c498
CsrVerifyRegion 0x18003c790
DbgPrint 0x18003bd48
DbgPrintEx 0x18003ba38
DbgPrompt 0x18003be40
LdrAddRefDll 0x18003cbb8
LdrControlFlowGuardEnforced 0x18003bd38
LdrDisableThreadCalloutsForDll 0x18003bdb8
LdrGetKnownDllSectionHandle 0x18003bb18
LdrGetProcedureAddress 0x18003ba68
LdrLoadDll 0x18003ba58
LdrLockLoaderLock 0x18003ba20
LdrProcessInitializationComplete 0x18003bcd8
LdrSystemDllInitBlock 0x18003baf8
LdrUnloadDll 0x18003ba70
LdrUnlockLoaderLock 0x18003ba28
longjmp 0x18003b9f8
memcpy 0x18003b9b8
memmove 0x18003bdd0
memset 0x18003bdc8
NtAcceptConnectPort 0x18003c408
NtAccessCheck 0x18003c6d8
NtAccessCheckAndAuditAlarm 0x18003be00
NtAccessCheckByType 0x18003c688
NtAccessCheckByTypeAndAuditAlarm 0x18003c258
NtAccessCheckByTypeResultList 0x18003c388
NtAccessCheckByTypeResultListAndAuditAlarm 0x18003c768
NtAccessCheckByTypeResultListAndAuditAlarmByHandle 0x18003bed0
NtAcquireCrossVmMutant 0x18003c550
NtAcquireProcessActivityReference 0x18003c5a0
NtAddAtomEx 0x18003c5b0
NtAddBootEntry 0x18003c198
NtAddDriverEntry 0x18003c0b0
NtAdjustGroupsToken 0x18003c670
NtAdjustPrivilegesToken 0x18003be08
NtAdjustTokenClaimsAndDeviceGroups 0x18003c7a0
NtAlertResumeThread 0x18003cae8
NtAlertThread 0x18003c0c0
NtAlertThreadByThreadId 0x18003bc60
NtAllocateLocallyUniqueId 0x18003beb8
NtAllocateReserveObject 0x18003ca28
NtAllocateUserPhysicalPages 0x18003c330
NtAllocateUserPhysicalPagesEx 0x18003c7c0
NtAllocateUuids 0x18003c8b8
NtAllocateVirtualMemory 0x18003bc88
NtAllocateVirtualMemoryEx 0x18003c750
NtAlpcAcceptConnectPort 0x18003c828
NtAlpcCancelMessage 0x18003c1a8
NtAlpcConnectPort 0x18003c130
NtAlpcConnectPortEx 0x18003bf80
NtAlpcCreatePort 0x18003c908
NtAlpcCreatePortSection 0x18003caf8
NtAlpcCreateResourceReserve 0x18003c338
NtAlpcCreateSectionView 0x18003c340
NtAlpcCreateSecurityContext 0x18003c410
NtAlpcDeletePortSection 0x18003be88
NtAlpcDeleteResourceReserve 0x18003c108
NtAlpcDeleteSectionView 0x18003c608
NtAlpcDeleteSecurityContext 0x18003c950
NtAlpcDisconnectPort 0x18003cac8
NtAlpcImpersonateClientContainerOfPort 0x18003c090
NtAlpcImpersonateClientOfPort 0x18003c3e0
NtAlpcOpenSenderProcess 0x18003c448
NtAlpcOpenSenderThread 0x18003ca80
NtAlpcQueryInformation 0x18003c4f8
NtAlpcQueryInformationMessage 0x18003c638
NtAlpcRevokeSecurityContext 0x18003c2a8
NtAlpcSendWaitReceivePort 0x18003cae0
NtAlpcSetInformation 0x18003ca08
NtApphelpCacheControl 0x18003c500
NtAreMappedFilesTheSame 0x18003c3d8
NtAssignProcessToJobObject 0x18003c460
NtAssociateWaitCompletionPacket 0x18003c2b0
NtCallEnclave 0x18003c868
NtCancelIoFile 0x18003c578
NtCancelIoFileEx 0x18003c030
NtCancelSynchronousIoFile 0x18003bee0
NtCancelTimer 0x18003c518
NtCancelTimer2 0x18003ca70
NtCancelWaitCompletionPacket 0x18003c420
NtClearEvent 0x18003c880
NtClose 0x18003bac0
NtCloseObjectAuditAlarm 0x18003c540
NtCommitComplete 0x18003c970
NtCommitEnlistment 0x18003c190
NtCommitRegistryTransaction 0x18003c980
NtCommitTransaction 0x18003c708
NtCompactKeys 0x18003c468
NtCompareObjects 0x18003c318
NtCompareSigningLevels 0x18003c278
NtCompareTokens 0x18003c960
NtCompleteConnectPort 0x18003c138
NtCompressKey 0x18003c228
NtConnectPort 0x18003c818
NtContinueEx 0x18003ba08
NtConvertBetweenAuxiliaryCounterAndPerformanceCounter 0x18003ca58
NtCopyFileChunk 0x18003bfd0
NtCreateCrossVmEvent 0x18003c580
NtCreateCrossVmMutant 0x18003bf68
NtCreateDebugObject 0x18003c7e8
NtCreateDirectoryObject 0x18003bf10
NtCreateDirectoryObjectEx 0x18003bfa8
NtCreateEnclave 0x18003c5a8
NtCreateEnlistment 0x18003be38
NtCreateEvent 0x18003bad0
NtCreateEventPair 0x18003c1f0
NtCreateFile 0x18003c988
NtCreateIoCompletion 0x18003c400
NtCreateIRTimer 0x18003cab8
NtCreateJobObject 0x18003c378
NtCreateJobSet 0x18003bfc8
NtCreateKey 0x18003cb90
NtCreateKeyedEvent 0x18003c770
NtCreateKeyTransacted 0x18003cb88
NtCreateLowBoxToken 0x18003c538
NtCreateMailslotFile 0x18003be70
NtCreateMutant 0x18003c738
NtCreateNamedPipeFile 0x18003c290
NtCreatePagingFile 0x18003c8e0
NtCreatePartition 0x18003c9d8
NtCreatePort 0x18003bfe8
NtCreatePrivateNamespace 0x18003c5e8
NtCreateProcess 0x18003c8e8
NtCreateProcessEx 0x18003bf18
NtCreateProfile 0x18003c508
NtCreateProfileEx 0x18003bdf0
NtCreateRegistryTransaction 0x18003c660
NtCreateResourceManager 0x18003c0e0
NtCreateSection 0x18003bd80
NtCreateSectionEx 0x18003c968
NtCreateSemaphore 0x18003c848
NtCreateSymbolicLinkObject 0x18003c798
NtCreateThread 0x18003bc10
NtCreateThreadEx 0x18003bc20
NtCreateTimer 0x18003c998
NtCreateTimer2 0x18003bf58
NtCreateToken 0x18003ca90
NtCreateTokenEx 0x18003bf50
NtCreateTransaction 0x18003c018
NtCreateTransactionManager 0x18003c9f8
NtCreateUserProcess 0x18003bbd8
NtCreateWaitablePort 0x18003bf20
NtCreateWaitCompletionPacket 0x18003c4c0
NtCreateWnfStateName 0x18003c078
NtCreateWorkerFactory 0x18003c788
NtDebugActiveProcess 0x18003c168
NtDebugContinue 0x18003ca40
NtDelayExecution 0x18003c428
NtDeleteAtom 0x18003c5c8
NtDeleteBootEntry 0x18003c418
NtDeleteDriverEntry 0x18003c000
NtDeleteFile 0x18003c310
NtDeleteKey 0x18003cb48
NtDeleteObjectAuditAlarm 0x18003caa8
NtDeletePrivateNamespace 0x18003c710
NtDeleteValueKey 0x18003cb60
NtDeleteWnfStateData 0x18003c830
NtDeleteWnfStateName 0x18003c040
NtDeviceIoControlFile 0x18003c4b0
NtDirectGraphicsCall 0x18003c9e8
NtDisableLastKnownGood 0x18003be80
NtDisplayString 0x18003bf30
NtDrawText 0x18003c2c0
NtDuplicateObject 0x18003bc50
NtDuplicateToken 0x18003bfb8
NtEnableLastKnownGood 0x18003cad0
NtEnumerateBootEntries 0x18003c878
NtEnumerateDriverEntries 0x18003c110
NtEnumerateKey 0x18003cb50
NtEnumerateSystemEnvironmentValuesEx 0x18003c8b0
NtEnumerateTransactionObject 0x18003c390
NtEnumerateValueKey 0x18003c060
NtExtendSection 0x18003c6b0
NtFilterBootOption 0x18003bfd8
NtFilterToken 0x18003c6c0
NtFilterTokenEx 0x18003c740
NtFindAtom 0x18003c0e8
NtFlushBuffersFile 0x18003c510
NtFlushBuffersFileEx 0x18003c158
NtFlushInstallUILanguage 0x18003c0c8
NtFlushKey 0x18003c308
NtFlushProcessWriteBuffers 0x18003c850
NtFlushVirtualMemory 0x18003c9a8
NtFlushWriteBuffer 0x18003bee8
NtFreeUserPhysicalPages 0x18003c690
NtFreeVirtualMemory 0x18003bc80
NtFreezeRegistry 0x18003c978
NtFreezeTransactions 0x18003c150
NtFsControlFile 0x18003c5c0
NtGetCachedSigningLevel 0x18003c520
NtGetCompleteWnfStateSubscription 0x18003bf60
NtGetContextThread 0x18003bc48
NtGetCurrentProcessorNumber 0x18003c808
NtGetCurrentProcessorNumberEx 0x18003c858
NtGetDevicePowerState 0x18003c610
NtGetMUIRegistryInfo 0x18003bf98
NtGetNextProcess 0x18003c008
NtGetNextThread 0x18003bc90
NtGetNlsSectionPtr 0x18003c700
NtGetNotificationResourceManager 0x18003be90
NtGetWriteWatch 0x18003c348
NtImpersonateAnonymousToken 0x18003c1f8
NtImpersonateClientOfPort 0x18003c7f0
NtImpersonateThread 0x18003c218
NtInitializeEnclave 0x18003c2d8
NtInitializeNlsFiles 0x18003c8f0
NtInitializeRegistry 0x18003c480
NtInitiatePowerAction 0x18003c548
NtIsProcessInJob 0x18003c4d8
NtIsSystemResumeAutomatic 0x18003bed8
NtIsUILanguageComitted 0x18003c2f0
NtListenPort 0x18003c238
NtLoadDriver 0x18003ca98
NtLoadEnclaveData 0x18003c730
NtLoadKey 0x18003c1a0
NtLoadKey2 0x18003bfe0
NtLoadKey3 0x18003c9f0
NtLoadKeyEx 0x18003c890
NtLockFile 0x18003c2f8
NtLockProductActivationKeys 0x18003c948
NtLockRegistryKey 0x18003bf40
NtLockVirtualMemory 0x18003c4a8
NtMakePermanentObject 0x18003be98
NtMakeTemporaryObject 0x18003c918
NtManagePartition 0x18003cac0
NtMapCMFModule 0x18003c928
NtMapUserPhysicalPages 0x18003c6f0
NtMapUserPhysicalPagesScatter 0x18003c568
NtMapViewOfSection 0x18003bb20
NtMapViewOfSectionEx 0x18003bf08
NtModifyBootEntry 0x18003c2a0
NtModifyDriverEntry 0x18003c630
NtNotifyChangeDirectoryFile 0x18003cad8
NtNotifyChangeDirectoryFileEx 0x18003cb10
NtNotifyChangeKey 0x18003c350
NtNotifyChangeMultipleKeys 0x18003c170
NtNotifyChangeSession 0x18003bf48
NtOpenDirectoryObject 0x18003bb00
NtOpenEnlistment 0x18003c930
NtOpenEvent 0x18003c0f8
NtOpenEventPair 0x18003c2d0
NtOpenFile 0x18003bb68
NtOpenIoCompletion 0x18003c718
NtOpenJobObject 0x18003c560
NtOpenKey 0x18003bd58
NtOpenKeyedEvent 0x18003c1c8
NtOpenKeyEx 0x18003cb80
NtOpenKeyTransactedEx 0x18003cb98
NtOpenMutant 0x18003bdf8
NtOpenObjectAuditAlarm 0x18003c640
NtOpenPartition 0x18003c888
NtOpenPrivateNamespace 0x18003c8f8
NtOpenProcess 0x18003bbb8
NtOpenProcessToken 0x18003bea0
NtOpenProcessTokenEx 0x18003be20
NtOpenRegistryTransaction 0x18003c990
NtOpenResourceManager 0x18003c120
NtOpenSection 0x18003bb10
NtOpenSemaphore 0x18003c100
NtOpenSession 0x18003c528
NtOpenSymbolicLinkObject 0x18003bf70
NtOpenThread 0x18003bd18
NtOpenThreadToken 0x18003c720
NtOpenThreadTokenEx 0x18003c370
NtOpenTimer 0x18003c2e0
NtOpenTransaction 0x18003cab0
NtOpenTransactionManager 0x18003c4d0
NtPowerInformation 0x18003c3a0
NtPrepareComplete 0x18003c230
NtPrepareEnlistment 0x18003c4b8
NtPrePrepareComplete 0x18003c2c8
NtPrePrepareEnlistment 0x18003c210
NtPrivilegeCheck 0x18003c800
NtPrivilegedServiceAuditAlarm 0x18003c398
NtPrivilegeObjectAuditAlarm 0x18003c148
NtPropagationComplete 0x18003c0a8
NtPropagationFailed 0x18003c840
NtProtectVirtualMemory 0x18003ba90
NtPssCaptureVaSpaceBulk 0x18003ca48
NtPulseEvent 0x18003c440
NtQueryAttributesFile 0x18003c488
NtQueryAuxiliaryCounterFrequency 0x18003bef0
NtQueryBootEntryOrder 0x18003bec0
NtQueryBootOptions 0x18003bf28
NtQueryDebugFilterState 0x18003c698
NtQueryDefaultLocale 0x18003ca38
NtQueryDefaultUILanguage 0x18003c7d8
NtQueryDirectoryFile 0x18003c9b8
NtQueryDirectoryFileEx 0x18003c3c8
NtQueryDirectoryObject 0x18003c658
NtQueryDriverEntryOrder 0x18003c358
NtQueryEaFile 0x18003c3e8
NtQueryEvent 0x18003c650
NtQueryFullAttributesFile 0x18003cb08
NtQueryInformationAtom 0x18003c200
NtQueryInformationByName 0x18003c7b8
NtQueryInformationEnlistment 0x18003c9b0
NtQueryInformationFile 0x18003c668
NtQueryInformationJobObject 0x18003c300
NtQueryInformationPort 0x18003c6d0
NtQueryInformationProcess 0x18003bb40
NtQueryInformationResourceManager 0x18003c8a8
NtQueryInformationThread 0x18003bbf8
NtQueryInformationToken 0x18003c3b0
NtQueryInformationTransaction 0x18003c5d8
NtQueryInformationTransactionManager 0x18003c4e8
NtQueryInformationWorkerFactory 0x18003c038
NtQueryInstallUILanguage 0x18003c8d0
NtQueryIntervalProfile 0x18003ca60
NtQueryIoCompletion 0x18003c588
NtQueryKey 0x18003cb40
NtQueryLicenseValue 0x18003c6c8
NtQueryMultipleValueKey 0x18003be58
NtQueryMutant 0x18003c9c0
NtQueryObject 0x18003bb70
NtQueryOpenSubKeys 0x18003be60
NtQueryOpenSubKeysEx 0x18003cb58
NtQueryPerformanceCounter 0x18003c178
NtQueryPortInformationProcess 0x18003c128
NtQueryQuotaInformationFile 0x18003c140
NtQuerySection 0x18003ba80
NtQuerySecurityAttributesToken 0x18003c958
NtQuerySecurityObject 0x18003c9e0
NtQuerySecurityPolicy 0x18003c760
NtQuerySemaphore 0x18003c5b8
NtQuerySymbolicLinkObject 0x18003c160
NtQuerySystemEnvironmentValue 0x18003c530
NtQuerySystemEnvironmentValueEx 0x18003c7b0
NtQuerySystemInformation 0x18003ba78
NtQuerySystemInformationEx 0x18003c180
NtQuerySystemTime 0x18003bec8
NtQueryTimer 0x18003c260
NtQueryTimerResolution 0x18003cb00
NtQueryValueKey 0x18003bd60
NtQueryVirtualMemory 0x18003bd40
NtQueryVolumeInformationFile 0x18003c938
NtQueryWnfStateData 0x18003c298
NtQueryWnfStateNameInformation 0x18003bef8
NtQueueApcThread 0x18003c080
NtQueueApcThreadEx 0x18003c8d8
NtQueueApcThreadEx2 0x18003c9a0
NtRaiseException 0x18003b9d8
NtRaiseHardError 0x18003c4a0
NtReadFile 0x18003c2b8
NtReadFileScatter 0x18003c6a0
NtReadOnlyEnlistment 0x18003c1b0
NtReadRequestData 0x18003ca88
NtReadVirtualMemory 0x18003bbb0
NtRecoverEnlistment 0x18003c4e0
NtRecoverResourceManager 0x18003c9c8
NtRecoverTransactionManager 0x18003be30
NtRegisterProtocolAddressInformation 0x18003c598
NtRegisterThreadTerminatePort 0x18003c748
NtReleaseKeyedEvent 0x18003c360
NtReleaseMutant 0x18003c058
NtReleaseSemaphore 0x18003c920
NtReleaseWorkerFactoryWorker 0x18003ca30
NtRemoveIoCompletion 0x18003c628
NtRemoveIoCompletionEx 0x18003be68
NtRemoveProcessDebug 0x18003c188
NtRenameKey 0x18003cb70
NtRenameTransactionManager 0x18003c020
NtReplaceKey 0x18003c820
NtReplacePartitionUnit 0x18003be18
NtReplyPort 0x18003bff8
NtReplyWaitReceivePort 0x18003c3a8
NtReplyWaitReceivePortEx 0x18003c1d0
NtReplyWaitReplyPort 0x18003c490
NtRequestPort 0x18003cb20
NtRequestWaitReplyPort 0x18003c5d0
NtResetEvent 0x18003bea8
NtResetWriteWatch 0x18003c0d8
NtRestoreKey 0x18003cb78
NtResumeProcess 0x18003c288
NtResumeThread 0x18003bbc8
NtRevertContainerImpersonation 0x18003c240
NtRollbackComplete 0x18003be78
NtRollbackEnlistment 0x18003c7f8
NtRollbackRegistryTransaction 0x18003bde8
NtRollbackTransaction 0x18003c118
NtRollforwardTransactionManager 0x18003bf38
NtSaveKey 0x18003cb68
NtSaveKeyEx 0x18003c8c8
NtSaveMergedKeys 0x18003c8a0
NtSecureConnectPort 0x18003c680
NtSerializeBoot 0x18003c430
NtSetBootEntryOrder 0x18003c320
NtSetBootOptions 0x18003c9d0
NtSetCachedSigningLevel 0x18003cb18
NtSetCachedSigningLevel2 0x18003c780
NtSetDebugFilterState 0x18003c4c8
NtSetDefaultHardErrorPort 0x18003c450
NtSetDefaultLocale 0x18003c1d8
NtSetDefaultUILanguage 0x18003c0a0
NtSetDriverEntryOrder 0x18003c4f0
NtSetEaFile 0x18003c268
NtSetEvent 0x18003bc70
NtSetEventBoostPriority 0x18003be28
NtSetHighEventPair 0x18003c6e8
NtSetHighWaitLowEventPair 0x18003beb0
NtSetInformationDebugObject 0x18003c940
NtSetInformationEnlistment 0x18003ca10
NtSetInformationFile 0x18003c250
NtSetInformationJobObject 0x18003c0d0
NtSetInformationKey 0x18003c7d0
NtSetInformationObject 0x18003c1b8
NtSetInformationProcess 0x18003c810
NtSetInformationResourceManager 0x18003c600
NtSetInformationSymbolicLink 0x18003c380
NtSetInformationThread 0x18003bca8
NtSetInformationToken 0x18003c248
NtSetInformationTransaction 0x18003c860
NtSetInformationTransactionManager 0x18003c3b8
NtSetInformationVirtualMemory 0x18003c910
NtSetInformationWorkerFactory 0x18003caa0
NtSetIntervalProfile 0x18003c458
NtSetIoCompletion 0x18003bff0
NtSetIoCompletionEx 0x18003bf78
NtSetIRTimer 0x18003be50
NtSetLdtEntries 0x18003caf0
NtSetLowEventPair 0x18003c280
NtSetLowWaitHighEventPair 0x18003c0f0
NtSetQuotaInformationFile 0x18003be48
NtSetSecurityObject 0x18003c3c0
NtSetSystemEnvironmentValue 0x18003c898
NtSetSystemEnvironmentValueEx 0x18003c6a8
NtSetSystemInformation 0x18003c220
NtSetSystemPowerState 0x18003c1e8
NtSetSystemTime 0x18003c7a8
NtSetThreadExecutionState 0x18003c838
NtSetTimer 0x18003c010
NtSetTimer2 0x18003be10
NtSetTimerEx 0x18003c270
NtSetTimerResolution 0x18003c6b8
NtSetUuidSeed 0x18003ca00
NtSetValueKey 0x18003cba0
NtSetVolumeInformationFile 0x18003ca68
NtSetWnfProcessNotificationEvent 0x18003bf88
NtShutdownSystem 0x18003c5f8
NtShutdownWorkerFactory 0x18003c590
NtSignalAndWaitForSingleObject 0x18003c8c0
NtSinglePhaseReject 0x18003bfb0
NtStartProfile 0x18003c558
NtStopProfile 0x18003ca18
NtSubscribeWnfStateChange 0x18003c088
NtSuspendThread 0x18003bc40
NtSystemDebugControl 0x18003c900
NtTerminateEnclave 0x18003c7c8
NtTerminateJobObject 0x18003c478
NtTerminateProcess 0x18003bbe8
NtTerminateThread 0x18003bb48
NtTestAlert 0x18003ba10
NtThawRegistry 0x18003bfa0
NtThawTransactions 0x18003c728
NtTraceControl 0x18003c778
NtTraceEvent 0x18003bf00
NtTranslateFilePath 0x18003c3f8
NtUnloadDriver 0x18003c050
NtUnloadKey 0x18003c620
NtUnloadKey2 0x18003c470
NtUnloadKeyEx 0x18003c068
NtUnlockFile 0x18003c1c0
NtUnlockVirtualMemory 0x18003c648
NtUnmapViewOfSection 0x18003bb30
NtUnmapViewOfSectionEx 0x18003c048
NtUnsubscribeWnfStateChange 0x18003c070
NtUpdateWnfStateData 0x18003c7e0
NtWaitForAlertByThreadId 0x18003bc78
NtWaitForDebugEvent 0x18003bfc0
NtWaitForKeyedEvent 0x18003c570
NtWaitForMultipleObjects 0x18003bc58
NtWaitForMultipleObjects32 0x18003c3d0
NtWaitForSingleObject 0x18003bcb0
NtWaitForWorkViaWorkerFactory 0x18003c3f0
NtWaitHighEventPair 0x18003c098
NtWaitLowEventPair 0x18003c5f0
NtWorkerFactoryWorkerReady 0x18003c0b8
NtWriteFile 0x18003c028
NtWriteFileGather 0x18003c758
NtWriteRequestData 0x18003ca50
NtWriteVirtualMemory 0x18003c870
NtYieldExecution 0x18003c6f8
RtlAcquireSRWLockExclusive 0x18003baa8
RtlAcquireSRWLockShared 0x18003bcb8
RtlAllocateHeap 0x18003bcf0
RtlAppendUnicodeStringToString 0x18003bb88
RtlAppendUnicodeToString 0x18003bb80
RtlCaptureContext 0x18003b9c0
RtlCompleteProcessCloning 0x18003bbe0
RtlCopyContext 0x18003bc00
RtlCopySid 0x18003c5e0
RtlCopyUnicodeString 0x18003bb78
RtlCreateHashTable 0x18003baa0
RtlCreateProcessParametersEx 0x18003cbb0
RtlCreateProcessParametersWithTemplate 0x18003bbc0
RtlDecodeSystemPointer 0x18003cbc8
RtlDestroyProcessParameters 0x18003bbf0
RtlEncodeSystemPointer 0x18003cbc0
RtlEqualUnicodeString 0x18003bba0
RtlExpandEnvironmentStrings_U 0x18003cba8
RtlFindExportedRoutineByName 0x18003bb28
RtlFreeHeap 0x18003bcf8
RtlGetCurrentProcessorNumberEx 0x18003c368
RtlGetEnabledExtendedFeatures 0x18003bce0
RtlGetExtendedContextLength 0x18003b9e8
RtlGetNextEntryHashTable 0x18003bcc8
RtlGetNtSystemRoot 0x18003ba48
RtlImageDirectoryEntryToData 0x18003bb58
RtlImageNtHeader 0x18003bb50
RtlImageNtHeaderEx 0x18003ba88
RtlInitAnsiString 0x18003ba60
RtlInitAnsiStringEx 0x18003bd70
RtlInitializeBitMapEx 0x18003bd28
RtlInitializeExtendedContext 0x18003b9f0
RtlInitializeSRWLock 0x18003ba98
RtlInitUnicodeString 0x18003ba50
RtlInitUnicodeStringEx 0x18003bb08
RtlInsertEntryHashTable 0x18003bae8
RtlIsCurrentProcess 0x18003bc28
RtlIsCurrentThread 0x18003bc98
RtlIsProcessorFeaturePresent 0x18003bd78
RtlLengthSid 0x18003c438
RtlLocateLegacyContext 0x18003bce8
RtlLookupEntryHashTable 0x18003bcc0
RtlLookupFunctionEntry 0x18003b9c8
RtlNtdllName 0x18003bb60
RtlNtStatusToDosError 0x18003bd08
RtlpQueryProcessDebugInformationFromWow64 0x18003bd50
RtlPrefixUnicodeString 0x18003bb90
RtlPrepareForProcessCloning 0x18003bbd0
RtlQueryEnvironmentVariable_U 0x18003bd20
RtlRaiseException 0x18003bd00
RtlRaiseStatus 0x18003bba8
RtlReleaseSRWLockExclusive 0x18003bab8
RtlReleaseSRWLockShared 0x18003bcd0
RtlRemoveEntryHashTable 0x18003bab0
RtlTestBitEx 0x18003bd30
RtlUnhandledExceptionFilter 0x18003bdc0
RtlUpcaseUnicodeChar 0x18003cb30
RtlUpcaseUnicodeString 0x18003cb28
RtlUpdateClonedSRWLock 0x18003bc30
RtlUserThreadStart 0x18003bb38
RtlVirtualUnwind 0x18003b9d0
RtlWaitOnAddress 0x18003bc38
RtlWakeAddressAll 0x18003bc68
RtlWow64GetCpuAreaInfo 0x18003b9e0
RtlWow64GetCurrentCpuArea 0x18003ba00
RtlWow64GetCurrentMachine 0x18003bc18
RtlWow64GetEquivalentMachineCHPE 0x18003bd10
RtlWow64GetProcessMachines 0x18003bc08
RtlWow64GetSharedInfoProcess 0x18003bd90
RtlWow64GetThreadSelectorEntry 0x18003c6e0
RtlWow64IsWowGuestMachineSupported 0x18003cb38
RtlWow64PopAllCrossProcessWorkFromWorkList 0x18003bd98
RtlWow64PopCrossProcessWorkFromFreeList 0x18003bda0
RtlWow64PushCrossProcessWorkOntoFreeList 0x18003bd88
RtlWow64PushCrossProcessWorkOntoWorkList 0x18003bdb0
RtlWow64RequestCrossProcessHeavyFlush 0x18003bda8
RtlWow64SuspendProcess 0x18003ca20
RtlWow64SuspendThread 0x18003bca0
TpAllocWait 0x18003bad8
TpReleaseWait 0x18003bac8
TpSetWait 0x18003bae0
TpSetWaitEx 0x18003baf0
wcscmp 0x18003cbe0
wcsncmp 0x18003bb98
wcsrchr 0x18003bd68
wow64win.dll 2
sdwhcon 0x18003cbf0
sdwhwin32 0x18003cbf8