Hi again,

I am stuck on a very basic problem which i think many of you can give me a wayout.
I create a UDP server very simple way like the code below but i have problem when the while(true) loop runs because i cant get the response that the server
started correctly.

Here is a sample code in steps :

void ListenToNewMessages(bool status){
  while(status){
     /////// CHECK IF NEW MESSAGES HAS ARRIVED
  }
}

bool StartServer(){
if(WSAStartup){
  if(SocketCreated){
    if(socketBinded){
      //////////// NOW HERE i have a function to always run and check for new messages which is actually a while loop
      ListenToNewMessages(true);
      return true;
    }else{
      return false;
    }
  }else{
    return false;
  }
}else{
  return false;
}
}

The problem is that in the above code i dont ever get the "return true" back cause the while loop function is always running and stops its below line "return true" value that i need to recieve back from the main function.
Is there any replacement or a way out through this ?
I want to get back the return value that indicates that the server started correctly and also i want to have a loop that listens for new messages coming into my server.

Thank you in advance
 

[00:21] <Samuel-Sama> The forum is dead
[00:21] <Samuel-Sama> sekio, make some random thread
[00:23] <sekio> ok

Let's start a thread for posting our daily picks of music.

I'll start it off with some

Vials of Wrath

Im pretty noob about this stuff but code injection really interests me. I saw rosdevils tut which was great

and was wandering what else there was? Powerloader?

I would like to learn to write each one. I know it will take along time but Im willing to learn

I want to master this stuff so bad its all I can think about

I have managed to get an obfuscator running (the code is posted at the bottom of this post) but am having some difficulties in understanding how it works). When the following code is compiled without any optimization flags set:

void _xor_block(unsigned char *pblock, unsigned int blocksize)
{
  // omitted for brevity 
}
int _xor_chunk(unsigned char* pchunk, unsigned long chunksize, unsigned int blocksize)
{
    // omitted for brevity 
}
__declspec(naked) void __stdcall _stub(void)
{
     // omitted for brevity 
}
__declspec(naked) int _end(void)
{
     // omitted for brevity 
}

is the function order preserved in the output (binary) and its memory image? These functions are used to compute the stub size.

Next, the Misc.VirtualSize and SizeOfRawData fields of the .text section are used to find an offset at which the stub should be inserted at.

dwVSize          = pSecH->Misc.VirtualSize; 
dwSectionSize    = pSecH->SizeOfRawData; 
dwStubSize       = (DWORD) _end - (DWORD) _xor_block;
memcpy(SectionBuffer, FileBuffer + pSecH->PointerToRawData, dwSectionSize); 
memset(SectionBuffer + pSecH->Misc.VirtualSize, 0, (dwSectionSize - pSecH->Misc.VirtualSize));

In the documentation over at MSDN

https://msdn.microsoft.com/en-us/library/windows/desktop/ms680341%28v=vs.85%29.aspx

it is mentioned that Misc.VirtualSize is the size of the section when loaded into memory and SizeOfRawData the size of the section on disk. If the VirtualSize is greater than SizeOfRawData it is padded with zeros until the end. Similarly, if SizeOfRawData is less than the value of the VirtualSize member, the remainder of the section is filled with zeroes.

Now,

1) Can the .text section be extended so that it can fit a larger stub? (than the predefined size members)

2) What are the limitations of how large a stub can be?

3) The code below assumes that SizeOfRawData > VirtualSize. Is this always the case for PEs'? If not how can the stub be still inserted into the .text section?

4) In the implementation the code places the stub at the end of the VirtualSize part of the section and adjusts the entry point so that, the stub is the first thing that's executed, then the .text section up until the stub is being decrypted and a jump is made to the start of the section (original entry point). But how are these values chosen since they are constant?

__declspec(naked) void __stdcall _stub(void)
{
    __asm
    {
		//blocksize
        push 0xFEFEFEFE 
		//chunksize
        push 0xFDFDFDFD 
		//pchunk
        push 0xFCFCFCFC 
		//decrypt
        call _xor_chunk 
		//oep
        mov eax, 0x7FFFFFFF 
        //go go
		jmp eax 
    }
}

Why do we need alignment after reaching for the bytes found at the VirtualSize index?

while(dwSpot % 16) 
        dwSpot++;

I'm guessing is that because we don't want to split instructions right? But this also implies that they are all 2 bytes in length, no?

When the stub is being updated in memory:

#define OEP_o 21 
#define SEG_o 11 
#define BSZ_o 1  
#define  SZ_o 6    
memcpy((void *)((unsigned long) _stub + OEP_o), &oep, 4);
memcpy((void *)((unsigned long) _stub + SEG_o), &seg, 4);
memcpy((void *)((unsigned long) _stub + BSZ_o), &bsz, 4);
memcpy((void *)((unsigned long) _stub +  SZ_o), &dwVSize, 4);

don't the new entry point values overwrite the body of the actual stub? How will the stub look like in memory and where are the offsets (oep, seg, bsz) being placed?

Also, in the _stub() function only constant values are being passed onto the stack. How are they obtained? They set up the parameters for the calling of _xor_chunk() but why is the address of parameters always the same (for pchunk the encrypted section)?

Any help would be greatly appreciated.

Here is the code:

#pragma comment(linker, "/OPT:NOREF") // this tells the linker to keep the machine code of unreferenced source code
#pragma optimize("", off) // disable all optimizations in order for our stub to run smootly, though im not sure if it really helps, i just saw some guy doing it this way lolz <span class="wp-smiley wp-emoji wp-emoji-smile" title=":)">:)</span>
 
#include <windows.h> 
#include <stdio.h> 
 
// those are the offsets to the
// original entry point
#define OEP_o 21 
// virtual address of section
#define SEG_o 11 
// block size, must be a multiple of 8
#define BSZ_o 1  
// section size, must be a multiple of the chosen block size
// values in the stub
#define  SZ_o 6  
 
// a simple block xor. Every byte in the given block is XOR'ed 
//with its index in that block
void _xor_block(unsigned char *pblock, unsigned int blocksize)
{
    unsigned int i;
 
    for(i = 0; i < blocksize; i++)
        pblock[i] ^= i;
 
    return;
}
 
// just a wrapper around the above function
int _xor_chunk(unsigned char* pchunk, unsigned long chunksize, unsigned int blocksize)
{
    if(chunksize % blocksize || blocksize % 8)
        return -1;
 
    unsigned long index = 0;
 
    while(index < chunksize)
    {
        _xor_block(pchunk + index, blocksize);
        index += blocksize;
    }
 
    return 0;
}
 
// this is our stub and the new entry point for the encrypted PE
__declspec(naked) void __stdcall _stub(void)
{
    __asm
    {
		//blocksize
        push 0xFEFEFEFE 
		//chunksize
        push 0xFDFDFDFD 
		//pchunk
        push 0xFCFCFCFC 
		//decrypt
        call _xor_chunk 
		//oep
        mov eax, 0x7FFFFFFF 
        //go go
		jmp eax 
    }
}
 
// a placeholder, used for stub size calculation
__declspec(naked) int _end(void)
{
    __asm ret 8
}
 
// so basicly the ASM code of the above 3 (w/o _end) functions will be added to the end of the ".text" section
// after updating the proper values in the stub, ofc
// then the PE header is updated along with the section header
// and with the entry point at _stub's code its all done! wow that was easy oO
 
// GO GO POWER RANGERS!!!
int main(void)
{
    PIMAGE_DOS_HEADER     pDosH;
    PIMAGE_NT_HEADERS     pNtH;
    PIMAGE_SECTION_HEADER pSecH;
 
    HANDLE hFile, hOutFile;
 
    DWORD  dwFileSize, dwSectionSize, dwStubSize,
           dwVSize, dwOldProt, dwSpot, dwGap, bytes;
 
    LPBYTE FileBuffer, SectionBuffer;
    CHAR FileName[MAX_PATH], OutFileName[MAX_PATH];

	memset(FileName, 0, MAX_PATH);
	memset(OutFileName, 0, MAX_PATH);
 
    // get the filename to encrypt
    printf("File to encrypt: ");
    scanf("%s", &FileName);
	for(int i = 0; i < MAX_PATH; i++)
		if(FileName[i] != '.') 
			OutFileName[i] = FileName[i];
		else 
			break;
	strcat(OutFileName, "_encryted.exe");
    // open it and get the size
    hFile = CreateFileA(FileName, GENERIC_READ|GENERIC_WRITE, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0);
    dwFileSize = GetFileSize(hFile, 0);
	// open the output file too
	hOutFile = CreateFileA(OutFileName, GENERIC_WRITE, 0, 0, CREATE_NEW, 0, 0);
 
    // load in memory
    FileBuffer = (LPBYTE) malloc(dwFileSize);
	// read file contents in memory
    ReadFile(hFile, FileBuffer, dwFileSize, &bytes, 0);
	// write the same contents to the out file (we need to initialize 
	// the file pointer so that we may reuse it later)
	WriteFile(hOutFile, FileBuffer, dwFileSize, &bytes, 0);
    // get the DOS header (it is important only to get to the NT header
    pDosH = (PIMAGE_DOS_HEADER) FileBuffer;
 
    // check if it is valid PE, i would say that this is merely a proper 
	// check, for a proper one you would need to calculate all the RVA's and see if they are valid
    if(pDosH->e_magic != IMAGE_DOS_SIGNATURE)
        return -1;
	// move to the NT header
    pNtH = (PIMAGE_NT_HEADERS) (FileBuffer + pDosH->e_lfanew);
 
    if(pNtH->Signature != IMAGE_NT_SIGNATURE)
        return -2;

	// get first NT section
	pSecH = IMAGE_FIRST_SECTION(pNtH);
	// look for the .text section
    while(memcmp(pSecH->Name, ".text", 5))
		 // get the ".text" section header
        pSecH++;
 
	// the virtual size of the section is the size of 
	// the section when loaded into memory. Later this will be used as 
	// chunksize in our stub, after proper alignment
    dwVSize          = pSecH->Misc.VirtualSize; 
    // the raw data size of the section is the size of the section on 
	// the drive (in the PE binary)
	dwSectionSize    = pSecH->SizeOfRawData; 
	 // the stubsize, in bytes
    dwStubSize       = (DWORD) _end - (DWORD) _xor_block;
	// allocate memory for the .text section, enough to hold our raw section data
    SectionBuffer = (LPBYTE) malloc(dwSectionSize); 
    // copy the text section to memory
	memcpy(SectionBuffer, FileBuffer + pSecH->PointerToRawData, dwSectionSize); 
	// encrypt the .text section in memory. Different block sizes can be used
	// - 8, 16, 32, 64, 128, 256, 512...
    _xor_chunk(SectionBuffer, dwSectionSize, 256); 
	// we fill the portion of the section that is after the one that is to be 
	// loaded into memory with zeros (fill with zeros after the end of actual data)
    memset(SectionBuffer + pSecH->Misc.VirtualSize, 0, (dwSectionSize - pSecH->Misc.VirtualSize)); 
	// we place the stub in this zeroed out portion of the section
	// this will be the offset (relative to the beginning of the section) where we 
	// will place our stub
    dwSpot = pSecH->Misc.VirtualSize; 
	// align it to 16 byte boundary
    while(dwSpot % 16) 
        dwSpot++;
	// this is in order to prevent the stub from corruption by overwriting its own 
	// code, since we will place it after the end of the section data
    dwSpot += 256; 
    dwGap   = dwSpot - pSecH->Misc.VirtualSize; // the gap between our stub and the end of the data
	// the original entry point, this is a linear address
    DWORD oep = pNtH->OptionalHeader.AddressOfEntryPoint + pNtH->OptionalHeader.ImageBase; 
	// the section address, you guessed right, this too is a linear one
    DWORD seg = pSecH->VirtualAddress + pNtH->OptionalHeader.ImageBase; 
    DWORD bsz = 256; 
	// we need to align it to block size
    while(dwVSize % bsz) 
        dwVSize++;
	// change pege r/w/e flags to be able to run the stub
    VirtualProtect(_xor_block, dwStubSize, PAGE_EXECUTE_READWRITE, &dwOldProt); 
 
    // update the stub
    memcpy((void *)((unsigned long) _stub + OEP_o), &oep, 4);
    memcpy((void *)((unsigned long) _stub + SEG_o), &seg, 4);
    memcpy((void *)((unsigned long) _stub + BSZ_o), &bsz, 4);
    memcpy((void *)((unsigned long) _stub +  SZ_o), &dwVSize, 4);
	// write the stub to memory
    memcpy(SectionBuffer + dwSpot, _xor_block, dwStubSize); 
	// r/w/e, executable code, initialized data
    pSecH->Characteristics                        = 0xE0000060; 
	// update the virtual size of the section
    pSecH->Misc.VirtualSize                      += dwStubSize + dwGap; 
    pNtH->OptionalHeader.AddressOfEntryPoint  = pSecH->VirtualAddress + dwSpot + ( (DWORD)_stub - (DWORD)_xor_block ) ;
 
    // and finally update the file
	// new section data
    SetFilePointer(hOutFile, pSecH->PointerToRawData, 0, FILE_BEGIN);               
    WriteFile(hOutFile, SectionBuffer, dwSectionSize, &bytes, 0);
	// new PE header
    SetFilePointer(hOutFile, pDosH->e_lfanew, 0, FILE_BEGIN);                       
    WriteFile(hOutFile, pNtH, sizeof(IMAGE_NT_HEADERS), &bytes, 0);
	//new section header
    SetFilePointer(hOutFile, ((DWORD) pSecH - (DWORD) FileBuffer), 0, FILE_BEGIN); 
    WriteFile(hOutFile, pSecH, sizeof(IMAGE_SECTION_HEADER), &bytes, 0);
 
    // close files/free memory
    CloseHandle(hFile);
	CloseHandle(hOutFile);
 
    free(FileBuffer);
    free(SectionBuffer);
 
    return 0;
}
 
// bye, bye, EOF

I'm working on writing a way to decrypt function during runtime, hoping to use it to re-fud my stubs without needing to do much re-writing. It's sort of working, but I'm confused about something. After I grab the pointer to the function, I xor the opcodes with whatever my key is, then if I call the function again it still executes the original code, and only executes the modified code if I call it using the function pointer. Not really an issue, since it still works, but I'm curious to why I'm still able to call the original.

#include <Windows.h>
#include <iostream>

int xorCode = 39;

//Shamelessly stole function length method from SO

static void funcToDecrypt()
{
    std::cout << "Normal functionality." << std::endl;
}

static void funcToDelimitMyOtherFunc()
{
    __asm _emit 0xCC
    __asm _emit 0xCC
    __asm _emit 0xCC
    __asm _emit 0xCC
}

int getFuncLen(void * functionAddress)
{
    int length = 0;
    for (length = 0; *((UINT32 *)(&((unsigned char *)functionAddress)[length])) != 0xCCCCCCCC; ++length);
    return length;
}

int modifyFunc(void * functionAddress, int functionLength)
{
    DWORD dwOldProtect;

    VirtualProtect(functionAddress, functionLength, PAGE_EXECUTE_READWRITE, &dwOldProtect);
    DWORD xyz = reinterpret_cast<DWORD>(functionAddress);

    char * ptr = reinterpret_cast<char *>(functionAddress);
    for (int i = 0; i < functionLength; i++)
    {
        *(char*)xyz ^= xorCode;
        xyz++;

    }
    //VirtualProtect(functionAddress, functionLength, dwOldProtect, NULL);
    return 0;
}

int displayFunction(void * functionAddress, int funcLen)
{
    DWORD xyz = reinterpret_cast<DWORD>(functionAddress);

    for (int i = 0; i < funcLen; i++)
    {
        std::cout << *(char*)xyz << " ";
        xyz++;
    }
    std::cout << std::endl << std::endl;

    return 0;
}


int main()
{
    int functionLength;

    void(*functionPtr)() = funcToDecrypt;
    functionLength = getFuncLen(functionPtr);


    std::cout << "Function address: " << functionPtr << std::endl;
    std::cout << "Function is " << functionLength << " bytes long." << std::endl;
    std::cout << "Calling function." << std::endl << std::endl;

    functionPtr();

    displayFunction(functionPtr, functionLength);


    std::cout << "Press enter to xor the function" << std::endl;
    std::cin.get();
    modifyFunc(functionPtr, functionLength);

    displayFunction(functionPtr, functionLength);

    std::cout << "Press enter to call original function, then again for the modified function. This should cause the program to crash. " << std::endl;
    std::cin.get();

    funcToDecrypt();//Works still?
    std::cin.get();
    functionPtr();//Causes expected crash

    std::cin.get();
    return 0;
}

hi all,

   Are any windows API easily intergrated in c language,that can be used to get latitude and longitudes of a remote pc?.

for(i=0; i < 5; i++) {
	fread(Io->data + i*Io->cells, Io->Cells,Sz_pix,fp);
}

I am having trouble with ( i*Io->Cells ) parts. 

Why * ? 

What does it mean ? I find it in many case. Can you please explain? 

How to decode this cipher to string ? 

124 150 145 040 147 145 156 145 162 151 143 040 164 145 162 155 040 146 157 162 040 164 150 145 040 155 145 143 150 141 156 151 143 141 154 054 040 145 154 145 143 164 162 151 143 141 154 040 141 156 144 040 145 154 145 143 164 162 157 156 151 143 040 143 157 155 160 157 156 145 156 164 163 040 157 146 040 141 040 143 157 155 160 165 164 145 162 040 141 162 145 040 143 141 154 154 145 144 040 167 150 141 164 077

Thanks 

airmon-ng start wlan0 is not setting the adapter into monitor mode?

It creates a wlan0mon interface and is listed using airmon-ng. I can set it manually 

using iwconfig but don't know why I can't get airmon-ng start working.

Would appreciate anything to help me. Thanks for rohitab forums its a life saver!

The YouTube player works fine if the forum is opened with non-HTTPS connection, but if HTTPS is enabled, the video player will not work.

#include <stdio.h>
#include <Windows.h>
#include <winternl.h>

#pragma comment(lib,"ntdll.lib")

typedef struct _CLIENT_ID
{
	PVOID UniqueProcess;
	PVOID UniqueThread;
}CLIENT_ID,*PCLIENT_ID;

EXTERN_C NTSTATUS NTAPI RtlCreateUserThread(
HANDLE,
PSECURITY_DESCRIPTOR,
BOOLEAN,
ULONG,
PULONG,
PULONG,
PVOID,
PVOID,
PHANDLE,
PCLIENT_ID);

EXTERN_C PIMAGE_NT_HEADERS NTAPI RtlImageNtHeader(PVOID);

EXTERN_C NTSTATUS NTAPI RtlAdjustPrivilege(ULONG,BOOLEAN,BOOLEAN,PBOOLEAN);
EXTERN_C NTSTATUS NTAPI NtOpenProcess(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PCLIENT_ID);
EXTERN_C NTSTATUS NTAPI NtWriteVirtualMemory(HANDLE,PVOID,PVOID,ULONG,PULONG);

LRESULT CALLBACK WndProc(HWND hWnd,UINT uMsg,WPARAM wParam,LPARAM lParam)
{
	HDC hDC;
	PAINTSTRUCT ps;

	switch(uMsg)
	{
		case WM_DESTROY:
  
			PostQuitMessage(0);
			break;

			case WM_PAINT:
				hDC=BeginPaint(hWnd,&ps);

				FillRect(hDC,&ps.rcPaint,0);
				EndPaint(hWnd,&ps);
				break;

		   case WM_LBUTTONDOWN:
			   MessageBox(hWnd,"You clicked the left mouse button.","Message",MB_ICONINFORMATION);
			   break;
		   case WM_RBUTTONDOWN:
			   MessageBox(hWnd,"You clicked the right mouse button.","Message",MB_ICONINFORMATION);
			   break;

		   case WM_KEYDOWN:

			   switch(wParam)
			   {
				   case VK_RETURN:
					   MessageBox(hWnd,"You pressed the enter key.","Message",MB_ICONINFORMATION);
					   break;
				   case VK_SPACE:
					   MessageBox(hWnd,"You pressed the spacebar key.","Message",MB_ICONINFORMATION);
					   break;
				   case 'B':
					   Beep(800,200);
					   break;
			   }

			   break;

		   default:
			   return DefWindowProc(hWnd,uMsg,wParam,lParam);
	}

	return 0;
}

void WINAPI ThreadProc(HINSTANCE hInst)
{
	HWND hWnd;

	WNDCLASS wc;
	MSG msg;

	memset(&wc,0,sizeof(wc));

	wc.hInstance=hInst;
	wc.lpfnWndProc=WndProc;
	wc.lpszClassName="PEWndClass";

	RegisterClass(&wc);

	hWnd=CreateWindowEx(
		0,
		"PEWndClass",
		"PE injection window",
		WS_OVERLAPPEDWINDOW,
		50,
		50,
		250,
		250,
		NULL,
		NULL,
		hInst,
		NULL);

	ShowWindow(hWnd,SW_SHOW);

	while(GetMessage(&msg,NULL,0,0))
	{
		TranslateMessage(&msg);
		DispatchMessage(&msg);
	}

	UnregisterClass("PEWndClass",hInst);
	ExitThread(0);
}

int main(int argc,char* argv[])
{
	PIMAGE_NT_HEADERS pINH;
	PIMAGE_DATA_DIRECTORY pIDD;
	PIMAGE_BASE_RELOCATION pIBR;

	HMODULE hModule;
	PVOID image,mem,StartAddress;
	HANDLE hProcess,hThread;
	DWORD i,count,nSizeOfImage;
	DWORD_PTR delta,OldDelta;
	LPWORD list;
	PDWORD_PTR p;
	BOOLEAN bl;
	NTSTATUS status;

	OBJECT_ATTRIBUTES oa;
	CLIENT_ID cid;

	if(argc!=2)
	{
		printf("Usage: PEWindow.exe [PID]");
		return 1;
	}

	RtlAdjustPrivilege(20,TRUE,FALSE,&bl);

	hModule=GetModuleHandle(NULL);
	pINH=RtlImageNtHeader(hModule);

	nSizeOfImage=pINH->OptionalHeader.SizeOfImage;

	InitializeObjectAttributes(&oa,NULL,0,NULL,NULL);

	cid.UniqueProcess=(HANDLE)atoi(argv[1]);
	cid.UniqueThread=0;

	printf("\nOpening target process handle.\n");

	if(!NT_SUCCESS(status=NtOpenProcess(&hProcess,PROCESS_ALL_ACCESS,&oa,&cid)))
	{
		printf("\nError: Unable to open target process handle. NtOpenProcess failed with status %#x\n",status);
		return 1;
	}

	printf("\nAllocating memory in target process.\n");

	mem=VirtualAllocEx(hProcess,NULL,nSizeOfImage,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);

	if(mem==NULL)
	{
		printf("\nError: Unable to allocate memory in target process. VirtualAllocEx failed with error %d\n",GetLastError());

		NtClose(hProcess);
		return 1;
	}

	printf("\nMemory allocated. Address: %#x\n",mem);

	image=VirtualAlloc(NULL,nSizeOfImage,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);

	memcpy(image,hModule,nSizeOfImage);

	pIDD=&pINH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
	pIBR=(PIMAGE_BASE_RELOCATION)((LPBYTE)image+pIDD->VirtualAddress);

	delta=(DWORD_PTR)((LPBYTE)mem-pINH->OptionalHeader.ImageBase);
	OldDelta=(DWORD_PTR)((LPBYTE)hModule-pINH->OptionalHeader.ImageBase);

	while(pIBR->VirtualAddress!=0)
	{
		if(pIBR->SizeOfBlock>=sizeof(IMAGE_BASE_RELOCATION))
		{
			count=(pIBR->SizeOfBlock-sizeof(IMAGE_BASE_RELOCATION))/sizeof(WORD);
			list=(LPWORD)((LPBYTE)pIBR+sizeof(IMAGE_BASE_RELOCATION));

			for(i=0;i<count;i++)
			{
				if(list[i]>0)
				{
					p=(PDWORD_PTR)((LPBYTE)image+(pIBR->VirtualAddress+(0x0fff & (list[i]))));

				   *p-=OldDelta;
				   *p+=delta;
				}
			}
		}

		pIBR=(PIMAGE_BASE_RELOCATION)((LPBYTE)pIBR+pIBR->SizeOfBlock);
	}

	printf("\nWriting executable image into target process.\n");

	if(!NT_SUCCESS(status=NtWriteVirtualMemory(hProcess,mem,image,nSizeOfImage,NULL)))
	{
		printf("\nError: Unable to write executable image into target process. NtWriteVirtualMemory failed with status %#x\n",status);

		VirtualFreeEx(hProcess,mem,0,MEM_RELEASE);
		NtClose(hProcess);
		return 1;
	}

	StartAddress=(PVOID)((LPBYTE)mem+(DWORD_PTR)(LPBYTE)ThreadProc-(LPBYTE)hModule);

	printf("\nCreating remote thread in target process.\n");

	if(!NT_SUCCESS(status=RtlCreateUserThread(hProcess,NULL,FALSE,0,0,0,StartAddress,mem,&hThread,NULL)))
	{
		printf("\nError: Unable to create remote thread in target process. RtlCreateUserThread failed with status %#x\n",status);

		VirtualFreeEx(hProcess,mem,0,MEM_RELEASE);
		NtClose(hProcess);
		return 1;
	}

	printf("\nThread created. Waiting for the thread to terminate.\n");

	NtWaitForSingleObject(hThread,FALSE,NULL);

	printf("\nThread terminated.\n");

	NtClose(hThread);

	printf("\nFreeing allocated memory.\n");

	VirtualFreeEx(hProcess,mem,0,MEM_RELEASE);
	NtClose(hProcess);

	VirtualFree(image,0,MEM_RELEASE);
	return 0;
}

I prefer either classical piano(think Chopin), or death metal/symphonic black metal.

Classical:

Death:

I don't think I could listen to metal while programming though, that's more of a classical thing for me.

What about you guys?

An example of accessing the PE export table.

#include <stdio.h>
#include <Windows.h>

int main()
{
	PIMAGE_DOS_HEADER pIDH;
	PIMAGE_NT_HEADERS pINH;
	PIMAGE_EXPORT_DIRECTORY pIED;

	PVOID NtdllBase,FunctionAddress;
	PULONG Function,Name;

	LPSTR FunctionName;

	PUSHORT Ordinal;
	ULONG i;

	NtdllBase=GetModuleHandle("ntdll.dll");
	pIDH=(PIMAGE_DOS_HEADER)NtdllBase;

	printf("ntdll.dll base address: %#x\n\n",NtdllBase);

	pINH=(PIMAGE_NT_HEADERS)((PUCHAR)NtdllBase+pIDH->e_lfanew);
	pIED=(PIMAGE_EXPORT_DIRECTORY)((PUCHAR)NtdllBase+pINH->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

	Function=(PULONG)((PUCHAR)NtdllBase+pIED->AddressOfFunctions);
	Name=(PULONG)((PUCHAR)NtdllBase+pIED->AddressOfNames);

	Ordinal=(PUSHORT)((PUCHAR)NtdllBase+pIED->AddressOfNameOrdinals);

	for(i=0;i<pIED->NumberOfNames;i++)
	{
		FunctionName=(char*)NtdllBase+Name[i];
		FunctionAddress=(PUCHAR)NtdllBase+Function[Ordinal[i]];

		printf("%s (%u): %#x\n",FunctionName,Ordinal[i],FunctionAddress);
	}

	return 0;
}

Sample output:

ntdll.dll base address: 0x779f0000

A_SHAFinal (17): 0x77a5b657
A_SHAInit (18): 0x77a59709
A_SHAUpdate (19): 0x77a5b727
AlpcAdjustCompletionListConcurrencyCount (20): 0x77a9d9c9
AlpcFreeCompletionListMessage (21): 0x77a9d648
AlpcGetCompletionListLastMessageInformation (22): 0x77a9d764
AlpcGetCompletionListMessageAttributes (23): 0x77a9d730
AlpcGetHeaderSize (24): 0x77a6a1a9
AlpcGetMessageAttribute (25): 0x77a6a13e
AlpcGetMessageFromCompletionList (26): 0x77a9d491
AlpcGetOutstandingCompletionListMessageCount (27): 0x77a9d78b
AlpcInitializeMessageAttribute (28): 0x77a6a175
AlpcMaxAllowedMessageLength (29): 0x77a9d9ed
AlpcRegisterCompletionList (30): 0x77a9d944
AlpcRegisterCompletionListWorkerThread (31): 0x77a9d7aa
AlpcRundownCompletionList (32): 0x77a9d9ad
AlpcUnregisterCompletionList (33): 0x77a9d991
AlpcUnregisterCompletionListWorkerThread (34): 0x77a9d885
CsrAllocateCaptureBuffer (35): 0x77a9d17f
CsrAllocateMessagePointer (36): 0x77a9d19f
CsrCaptureMessageBuffer (37): 0x77a9d1af
CsrCaptureMessageMultiUnicodeStringsInPlace (38): 0x77a9d258
CsrCaptureMessageString (39): 0x77a9d1bf
CsrCaptureTimeout (40): 0x77a9d1cf
CsrClientCallServer (41): 0x77a9d16f
CsrClientConnectToServer (42): 0x77a36671
CsrFreeCaptureBuffer (43): 0x77a9d18f
CsrGetProcessId (44): 0x77a9d202
CsrIdentifyAlertableThread (45): 0x77a9d165
CsrSetPriorityClass (46): 0x77a91e3f
CsrVerifyRegion (47): 0x77a9d2d4
DbgBreakPoint (48): 0x77a0000c
DbgPrint (49): 0x77a60fb9
DbgPrintEx (50): 0x77a61810
DbgPrintReturnControlC (51): 0x77a9dabd
DbgPrompt (52): 0x77a9d9f8
DbgQueryDebugFilterState (53): 0x77a9da3e
DbgSetDebugFilterState (54): 0x77a9da4e
DbgUiConnectToDbg (55): 0x77a8fabb
DbgUiContinue (56): 0x77a8fb63
DbgUiConvertStateChangeStructure (57): 0x77a8fc8c
DbgUiDebugActiveProcess (58): 0x77a8fc4a
DbgUiGetThreadDebugObject (59): 0x77a8fb0d
DbgUiIssueRemoteBreakin (60): 0x77a8fc03
DbgUiRemoteBreakin (61): 0x77a8fbaa
DbgUiSetThreadDebugObject (62): 0x77a8fb1f
DbgUiStopDebugging (63): 0x77a8fb88
DbgUiWaitStateChange (64): 0x77a8fb3c
DbgUserBreakPoint (65): 0x77a00008
EtwCreateTraceInstanceId (66): 0x77acb2a4
EtwDeliverDataBlock (67): 0x77a45adb
EtwEnumerateProcessRegGuids (68): 0x77acbac1
EtwEventActivityIdControl (69): 0x77a5c60d
EtwEventEnabled (70): 0x77a285de
EtwEventProviderEnabled (71): 0x77acb62c
EtwEventRegister (72): 0x77a32c28
EtwEventSetInformation (73): 0x77acb5ca
EtwEventUnregister (74): 0x77a4a039
EtwEventWrite (75): 0x77a451f4
EtwEventWriteEndScenario (76): 0x77acbd6b
EtwEventWriteEx (77): 0x77acbbbe
EtwEventWriteFull (78): 0x77acbbf1
EtwEventWriteNoRegistration (79): 0x77a63498
EtwEventWriteStartScenario (80): 0x77acbc21
EtwEventWriteString (81): 0x77acb727
EtwEventWriteTransfer (82): 0x77a5c6c3
EtwGetTraceEnableFlags (83): 0x77a48a98
EtwGetTraceEnableLevel (84): 0x77a48a62
EtwGetTraceLoggerHandle (85): 0x77a489f9
EtwLogTraceEvent (86): 0x77acbe31
EtwNotificationRegister (87): 0x77a32aa0
EtwNotificationUnregister (88): 0x77a49fb6
EtwProcessPrivateLoggerRequest (89): 0x77a637d5
EtwRegisterSecurityProvider (90): 0x77acb366
EtwRegisterTraceGuidsA (91): 0x77a582a7
EtwRegisterTraceGuidsW (92): 0x77a3232c
EtwReplyNotification (93): 0x77ace76a
EtwSendNotification (94): 0x77a65320
EtwSetMark (95): 0x77acc0e1
EtwTraceEventInstance (96): 0x77acbe9c
EtwTraceMessage (97): 0x77a56da3
EtwTraceMessageVa (98): 0x77a56dc7
EtwUnregisterTraceGuids (99): 0x77a4a07e
EtwWriteUMSecurityEvent (100): 0x77acb9bb
EtwpCreateEtwThread (101): 0x77acecd7
EtwpGetCpuSpeed (102): 0x77a65839
EtwpNotificationThread (103): 0x77a45a81
EvtIntReportAuthzEventAndSourceAsync (104): 0x77acf70f
EvtIntReportEventAndSourceAsync (105): 0x77acf6d9
ExpInterlockedPopEntrySListEnd (14): 0x77a226e3
ExpInterlockedPopEntrySListFault (15): 0x77a226e1
ExpInterlockedPopEntrySListResume (16): 0x77a226ab
KiFastSystemCall (106): 0x77a001d0
KiFastSystemCallRet (107): 0x77a001d4
KiIntSystemCall (108): 0x77a001e0
KiRaiseUserExceptionDispatcher (109): 0x77a00174
KiUserApcDispatcher (110): 0x77a00028
KiUserCallbackDispatcher (111): 0x77a000dc
KiUserExceptionDispatcher (112): 0x77a00124
LdrAccessResource (113): 0x77a2d284
LdrAddLoadAsDataTable (114): 0x77a47eea
LdrAddRefDll (115): 0x77a32d36
LdrDisableThreadCalloutsForDll (116): 0x77a2a7e0
LdrEnumResources (117): 0x77a9e389
LdrEnumerateLoadedModules (118): 0x77a2a86d
LdrFindEntryForAddress (119): 0x77a47ba8
LdrFindResourceDirectory_U (120): 0x77a9e777
LdrFindResourceEx_U (121): 0x77a33937
LdrFindResource_U (122): 0x77a2d2a1
LdrFlushAlternateResourceModules (123): 0x77a9e5cb
LdrGetDllHandle (124): 0x77a1fd27
LdrGetDllHandleByMapping (125): 0x77a47e5d
LdrGetDllHandleByName (126): 0x77a463ed
LdrGetDllHandleEx (127): 0x77a1fd48
LdrGetFailureData (128): 0x77a90984
LdrGetFileNameFromLoadAsDataTable (129): 0x77a9dc06
LdrGetProcedureAddress (130): 0x77a201da
LdrGetProcedureAddressEx (131): 0x77a201fb
LdrHotPatchRoutine (132): 0x77a8ff74
LdrInitShimEngineDynamic (133): 0x77a66a1a
LdrInitializeThunk (134): 0x77a297f9
LdrLoadAlternateResourceModule (135): 0x77a629bd
LdrLoadAlternateResourceModuleEx (136): 0x77a43b0c
LdrLoadDll (137): 0x77a2f33b
LdrLockLoaderLock (138): 0x77a26d7d
LdrOpenImageFileOptionsKey (139): 0x77a4a9fc
LdrProcessRelocationBlock (140): 0x77a9f03f
LdrQueryImageFileExecutionOptions (141): 0x77a51242
LdrQueryImageFileExecutionOptionsEx (142): 0x77a51269
LdrQueryImageFileKeyOption (143): 0x77a4a445
LdrQueryModuleServiceTags (144): 0x77a908be
LdrQueryProcessModuleInformation (145): 0x77a90894
LdrRegisterDllNotification (146): 0x77a5c3c9
LdrRemoveLoadAsDataTable (147): 0x77a49087
LdrResFindResource (148): 0x77a533ac
LdrResFindResourceDirectory (149): 0x77a30787
LdrResGetRCConfig (150): 0x77a4c7af
LdrResRelease (151): 0x77a9f5b2
LdrResSearchResource (152): 0x77a2fbe5
LdrRscIsTypeExist (153): 0x77a4384f
LdrSetAppCompatDllRedirectionCallback (154): 0x77a908b4
LdrSetDllManifestProber (155): 0x77a3625a
LdrSetMUICacheType (156): 0x77a9e723
LdrShutdownProcess (157): 0x77a49c63
LdrShutdownThread (158): 0x77a466b5
LdrSystemDllInitBlock (159): 0x77af6748
LdrUnloadAlternateResourceModule (160): 0x77a48f76
LdrUnloadAlternateResourceModuleEx (161): 0x77a48f8e
LdrUnloadDll (162): 0x77a33b8c
LdrUnlockLoaderLock (163): 0x77a26e24
LdrUnregisterDllNotification (164): 0x77a5fe75
LdrVerifyImageMatchesChecksum (165): 0x77a9098f
LdrVerifyImageMatchesChecksumEx (166): 0x77a9040a
LdrWx86FormatVirtualImage (167): 0x77a96345
LdrpResGetMappingSize (168): 0x77a2f885
LdrpResGetResourceDirectory (169): 0x77a2fa41
MD4Final (170): 0x77acb201
MD4Init (171): 0x77acb0b4
MD4Update (172): 0x77acb0e8
MD5Final (173): 0x77a63c24
MD5Init (174): 0x77a63ad1
MD5Update (175): 0x77a63cb2
NlsAnsiCodePage (176): 0x77af0010
NlsMbCodePageTag (177): 0x77af0003
NlsMbOemCodePageTag (178): 0x77af0004
NtAcceptConnectPort (179): 0x77a10250
NtAccessCheck (180): 0x77a10268
NtAccessCheckAndAuditAlarm (181): 0x77a0fca8
NtAccessCheckByType (182): 0x77a10280
NtAccessCheckByTypeAndAuditAlarm (183): 0x77a10154
NtAccessCheckByTypeResultList (184): 0x77a10298
NtAccessCheckByTypeResultListAndAuditAlarm (185): 0x77a102b0
NtAccessCheckByTypeResultListAndAuditAlarmByHandle (186): 0x77a102c8
NtAddAtom (187): 0x77a0ff98
NtAddBootEntry (188): 0x77a102e0
NtAddDriverEntry (189): 0x77a102f8
NtAdjustGroupsToken (190): 0x77a10310
NtAdjustPrivilegesToken (191): 0x77a0ff00
NtAlertResumeThread (192): 0x77a10328
NtAlertThread (193): 0x77a10344
NtAllocateLocallyUniqueId (194): 0x77a10360
NtAllocateReserveObject (195): 0x77a1037c
NtAllocateUserPhysicalPages (196): 0x77a10394
NtAllocateUuids (197): 0x77a103ac
NtAllocateVirtualMemory (198): 0x77a0fb00
NtAlpcAcceptConnectPort (199): 0x77a103c8
NtAlpcCancelMessage (200): 0x77a103e0
NtAlpcConnectPort (201): 0x77a103f8
NtAlpcCreatePort (202): 0x77a10410
NtAlpcCreatePortSection (203): 0x77a10428
NtAlpcCreateResourceReserve (204): 0x77a10440
NtAlpcCreateSectionView (205): 0x77a10458
NtAlpcCreateSecurityContext (206): 0x77a10470
NtAlpcDeletePortSection (207): 0x77a10488
NtAlpcDeleteResourceReserve (208): 0x77a104a0
NtAlpcDeleteSectionView (209): 0x77a104b8
NtAlpcDeleteSecurityContext (210): 0x77a104d0
NtAlpcDisconnectPort (211): 0x77a104e8
NtAlpcImpersonateClientOfPort (212): 0x77a10500
NtAlpcOpenSenderProcess (213): 0x77a10518
NtAlpcOpenSenderThread (214): 0x77a10530
NtAlpcQueryInformation (215): 0x77a10548
NtAlpcQueryInformationMessage (216): 0x77a10560
NtAlpcRevokeSecurityContext (217): 0x77a10578
NtAlpcSendWaitReceivePort (218): 0x77a10590
NtAlpcSetInformation (219): 0x77a105a8
NtApphelpCacheControl (220): 0x77a10014
NtAreMappedFilesTheSame (221): 0x77a105c0
NtAssignProcessToJobObject (222): 0x77a105dc
NtCallbackReturn (223): 0x77a0f918
NtCancelIoFile (224): 0x77a101bc
NtCancelIoFileEx (225): 0x77a105f8
NtCancelSynchronousIoFile (226): 0x77a10610
NtCancelTimer (227): 0x77a1021c
NtClearEvent (228): 0x77a0feb4
NtClose (229): 0x77a0fa20
NtCloseObjectAuditAlarm (230): 0x77a0fe6c
NtCommitComplete (231): 0x77a10628
NtCommitEnlistment (232): 0x77a10640
NtCommitTransaction (233): 0x77a10658
NtCompactKeys (234): 0x77a10670
NtCompareTokens (235): 0x77a10688
NtCompleteConnectPort (236): 0x77a106a0
NtCompressKey (237): 0x77a106b8
NtConnectPort (238): 0x77a106d4
NtContinue (239): 0x77a0ff30
NtCreateDebugObject (240): 0x77a106ec
NtCreateDirectoryObject (241): 0x77a10704
NtCreateEnlistment (242): 0x77a1071c
NtCreateEvent (243): 0x77a0ffb4
NtCreateEventPair (244): 0x77a10734
NtCreateFile (245): 0x77a100f4
NtCreateIoCompletion (246): 0x77a1074c
NtCreateJobObject (247): 0x77a10764
NtCreateJobSet (248): 0x77a1077c
NtCreateKey (249): 0x77a0fb80
NtCreateKeyTransacted (250): 0x77a10794
NtCreateKeyedEvent (251): 0x77a107ac
NtCreateMailslotFile (252): 0x77a107c4
NtCreateMutant (253): 0x77a107dc
NtCreateNamedPipeFile (254): 0x77a107f4
NtCreatePagingFile (255): 0x77a1080c
NtCreatePort (256): 0x77a10824
NtCreatePrivateNamespace (257): 0x77a1083c
NtCreateProcess (258): 0x77a10854
NtCreateProcessEx (259): 0x77a1002c
NtCreateProfile (260): 0x77a1086c
NtCreateProfileEx (261): 0x77a10884
NtCreateResourceManager (262): 0x77a1089c
NtCreateSection (263): 0x77a0ffe4
NtCreateSemaphore (264): 0x77a108b4
NtCreateSymbolicLinkObject (265): 0x77a108cc
NtCreateThread (266): 0x77a10044
NtCreateThreadEx (267): 0x77a108e4
NtCreateTimer (268): 0x77a108fc
NtCreateToken (269): 0x77a10914
NtCreateTransaction (270): 0x77a1092c
NtCreateTransactionManager (271): 0x77a10944
NtCreateUserProcess (272): 0x77a1095c
NtCreateWaitablePort (273): 0x77a10974
NtCreateWorkerFactory (274): 0x77a1098c
NtCurrentTeb (275): 0x77a8f313
NtDebugActiveProcess (276): 0x77a109a4
NtDebugContinue (277): 0x77a109c0
NtDelayExecution (278): 0x77a0fdbc
NtDeleteAtom (279): 0x77a109d8
NtDeleteBootEntry (280): 0x77a109f4
NtDeleteDriverEntry (281): 0x77a10a0c
NtDeleteFile (282): 0x77a10a24
NtDeleteKey (283): 0x77a10a3c
NtDeleteObjectAuditAlarm (284): 0x77a10a54
NtDeletePrivateNamespace (285): 0x77a10a6c
NtDeleteValueKey (286): 0x77a10a84
NtDeviceIoControlFile (287): 0x77a0f94c
NtDisableLastKnownGood (288): 0x77a10a9c
NtDisplayString (289): 0x77a10ab4
NtDrawText (290): 0x77a10acc
NtDuplicateObject (291): 0x77a0fe84
NtDuplicateToken (292): 0x77a0ff18
NtEnableLastKnownGood (293): 0x77a10ae4
NtEnumerateBootEntries (294): 0x77a10afc
NtEnumerateDriverEntries (295): 0x77a10b14
NtEnumerateKey (296): 0x77a0fd8c
NtEnumerateSystemEnvironmentValuesEx (297): 0x77a10b2c
NtEnumerateTransactionObject (298): 0x77a10b44
NtEnumerateValueKey (299): 0x77a0fa80
NtExtendSection (300): 0x77a10b5c
NtFilterToken (301): 0x77a10b74
NtFindAtom (302): 0x77a0fa98
NtFlushBuffersFile (303): 0x77a0fffc
NtFlushInstallUILanguage (304): 0x77a10b8c
NtFlushInstructionCache (305): 0x77a10ba4
NtFlushKey (306): 0x77a10bc0
NtFlushProcessWriteBuffers (307): 0x77a10bdc
NtFlushVirtualMemory (308): 0x77a10bf4
NtFlushWriteBuffer (309): 0x77a10c0c
NtFreeUserPhysicalPages (310): 0x77a10c28
NtFreeVirtualMemory (311): 0x77a0fb98
NtFreezeRegistry (312): 0x77a10c40
NtFreezeTransactions (313): 0x77a10c58
NtFsControlFile (314): 0x77a0fe38
NtGetContextThread (315): 0x77a10c70
NtGetCurrentProcessorNumber (316): 0x77a10c88
NtGetDevicePowerState (317): 0x77a10ca4
NtGetMUIRegistryInfo (318): 0x77a10cc0
NtGetNextProcess (319): 0x77a10cd8
NtGetNextThread (320): 0x77a10cf0
NtGetNlsSectionPtr (321): 0x77a10d08
NtGetNotificationResourceManager (322): 0x77a10d20
NtGetPlugPlayEvent (323): 0x77a10d38
NtGetTickCount (324): 0x77aa184c
NtGetWriteWatch (325): 0x77a10d50
NtImpersonateAnonymousToken (326): 0x77a10d68
NtImpersonateClientOfPort (327): 0x77a0fbb0
NtImpersonateThread (328): 0x77a10d84
NtInitializeNlsFiles (329): 0x77a10d9c
NtInitializeRegistry (330): 0x77a10db4
NtInitiatePowerAction (331): 0x77a10dcc
NtIsProcessInJob (332): 0x77a1005c
NtIsSystemResumeAutomatic (333): 0x77a10de8
NtIsUILanguageComitted (334): 0x77a10e04
NtListenPort (335): 0x77a10e1c
NtLoadDriver (336): 0x77a10e34
NtLoadKey (338): 0x77a10e4c
NtLoadKey2 (337): 0x77a10e64
NtLoadKeyEx (339): 0x77a10e7c
NtLockFile (340): 0x77a10e94
NtLockProductActivationKeys (341): 0x77a10eac
NtLockRegistryKey (342): 0x77a10ec8
NtLockVirtualMemory (343): 0x77a10ee4
NtMakePermanentObject (344): 0x77a10efc
NtMakeTemporaryObject (345): 0x77a10f18
NtMapCMFModule (346): 0x77a10f34
NtMapUserPhysicalPages (347): 0x77a10f4c
NtMapUserPhysicalPagesScatter (348): 0x77a0f8e0
NtMapViewOfSection (349): 0x77a0fc90
NtModifyBootEntry (350): 0x77a10f68
NtModifyDriverEntry (351): 0x77a10f80
NtNotifyChangeDirectoryFile (352): 0x77a10f98
NtNotifyChangeKey (353): 0x77a10fb0
NtNotifyChangeMultipleKeys (354): 0x77a10fc8
NtNotifyChangeSession (355): 0x77a10fe0
NtOpenDirectoryObject (356): 0x77a1013c
NtOpenEnlistment (357): 0x77a10ff8
NtOpenEvent (358): 0x77a0fee8
NtOpenEventPair (359): 0x77a11010
NtOpenFile (360): 0x77a0fda4
NtOpenIoCompletion (361): 0x77a11028
NtOpenJobObject (362): 0x77a11040
NtOpenKey (363): 0x77a0fa68
NtOpenKeyEx (364): 0x77a11058
NtOpenKeyTransacted (365): 0x77a11070
NtOpenKeyTransactedEx (366): 0x77a11088
NtOpenKeyedEvent (367): 0x77a110a0
NtOpenMutant (368): 0x77a110b8
NtOpenObjectAuditAlarm (369): 0x77a110d0
NtOpenPrivateNamespace (370): 0x77a110e8
NtOpenProcess (371): 0x77a0fc60
NtOpenProcessToken (372): 0x77a11100
NtOpenProcessTokenEx (373): 0x77a0fd58
NtOpenResourceManager (374): 0x77a11118
NtOpenSection (375): 0x77a0fe08
NtOpenSemaphore (376): 0x77a11130
NtOpenSession (377): 0x77a11148
NtOpenSymbolicLinkObject (378): 0x77a11160
NtOpenThread (379): 0x77a11178
NtOpenThreadToken (380): 0x77a0fc30
NtOpenThreadTokenEx (381): 0x77a0fd40
NtOpenTimer (382): 0x77a11190
NtOpenTransaction (383): 0x77a111a8
NtOpenTransactionManager (384): 0x77a111c0
NtPlugPlayControl (385): 0x77a111d8
NtPowerInformation (386): 0x77a101ec
NtPrePrepareComplete (387): 0x77a111f0
NtPrePrepareEnlistment (388): 0x77a11208
NtPrepareComplete (389): 0x77a11220
NtPrepareEnlistment (390): 0x77a11238
NtPrivilegeCheck (391): 0x77a11250
NtPrivilegeObjectAuditAlarm (392): 0x77a1126c
NtPrivilegedServiceAuditAlarm (393): 0x77a11284
NtPropagationComplete (394): 0x77a1129c
NtPropagationFailed (395): 0x77a112b4
NtProtectVirtualMemory (396): 0x77a10078
NtPulseEvent (397): 0x77a112cc
NtQueryAttributesFile (398): 0x77a0fe9c
NtQueryBootEntryOrder (399): 0x77a112e8
NtQueryBootOptions (400): 0x77a11300
NtQueryDebugFilterState (401): 0x77a11318
NtQueryDefaultLocale (402): 0x77a0fab4
NtQueryDefaultUILanguage (403): 0x77a0ff48
NtQueryDirectoryFile (404): 0x77a0fdd8
NtQueryDirectoryObject (405): 0x77a11334
NtQueryDriverEntryOrder (406): 0x77a1134c
NtQueryEaFile (407): 0x77a11364
NtQueryEvent (408): 0x77a1010c
NtQueryFullAttributesFile (409): 0x77a1137c
NtQueryInformationAtom (410): 0x77a11394
NtQueryInformationEnlistment (411): 0x77a113ac
NtQueryInformationFile (412): 0x77a0fa50
NtQueryInformationJobObject (413): 0x77a113c4
NtQueryInformationPort (414): 0x77a113dc
NtQueryInformationProcess (415): 0x77a0fb18
NtQueryInformationResourceManager (416): 0x77a113f4
NtQueryInformationThread (417): 0x77a0fc48
NtQueryInformationToken (418): 0x77a0fbe8
NtQueryInformationTransaction (419): 0x77a1140c
NtQueryInformationTransactionManager (420): 0x77a11424
NtQueryInformationWorkerFactory (421): 0x77a1143c
NtQueryInstallUILanguage (422): 0x77a11454
NtQueryIntervalProfile (423): 0x77a11470
NtQueryIoCompletion (424): 0x77a1148c
NtQueryKey (425): 0x77a0fad0
NtQueryLicenseValue (426): 0x77a114a4
NtQueryMultipleValueKey (427): 0x77a114bc
NtQueryMutant (428): 0x77a114d4
NtQueryObject (429): 0x77a0fa38
NtQueryOpenSubKeys (430): 0x77a114ec
NtQueryOpenSubKeysEx (431): 0x77a11504
NtQueryPerformanceCounter (432): 0x77a0fd70
NtQueryPortInformationProcess (433): 0x77a1151c
NtQueryQuotaInformationFile (434): 0x77a11538
NtQuerySection (435): 0x77a10090
NtQuerySecurityAttributesToken (436): 0x77a11550
NtQuerySecurityObject (437): 0x77a11568
NtQuerySemaphore (438): 0x77a11580
NtQuerySymbolicLinkObject (439): 0x77a11598
NtQuerySystemEnvironmentValue (440): 0x77a115b0
NtQuerySystemEnvironmentValueEx (441): 0x77a115c8
NtQuerySystemInformation (442): 0x77a0fdf0
NtQuerySystemInformationEx (443): 0x77a115e0
NtQuerySystemTime (444): 0x77a1016c
NtQueryTimer (445): 0x77a0fe20
NtQueryTimerResolution (446): 0x77a115f8
NtQueryValueKey (447): 0x77a0fae8
NtQueryVirtualMemory (448): 0x77a0fc18
NtQueryVolumeInformationFile (449): 0x77a0ffcc
NtQueueApcThread (450): 0x77a0ff64
NtQueueApcThreadEx (451): 0x77a11614
NtRaiseException (452): 0x77a1162c
NtRaiseHardError (453): 0x77a11644
NtReadFile (454): 0x77a0f930
NtReadFileScatter (455): 0x77a0fd24
NtReadOnlyEnlistment (456): 0x77a1165c
NtReadRequestData (457): 0x77a100dc
NtReadVirtualMemory (458): 0x77a0fed0
NtRecoverEnlistment (459): 0x77a11674
NtRecoverResourceManager (460): 0x77a1168c
NtRecoverTransactionManager (461): 0x77a116a4
NtRegisterProtocolAddressInformation (462): 0x77a116bc
NtRegisterThreadTerminatePort (463): 0x77a116d4
NtReleaseKeyedEvent (464): 0x77a116f0
NtReleaseMutant (465): 0x77a0fbcc
NtReleaseSemaphore (466): 0x77a0f9a0
NtReleaseWorkerFactoryWorker (467): 0x77a1170c
NtRemoveIoCompletion (468): 0x77a0f984
NtRemoveIoCompletionEx (469): 0x77a11724
NtRemoveProcessDebug (470): 0x77a1173c
NtRenameKey (471): 0x77a11758
NtRenameTransactionManager (472): 0x77a11770
NtReplaceKey (473): 0x77a11788
NtReplacePartitionUnit (474): 0x77a117a0
NtReplyPort (475): 0x77a0f9d4
NtReplyWaitReceivePort (476): 0x77a0f9bc
NtReplyWaitReceivePortEx (477): 0x77a0fcd8
NtReplyWaitReplyPort (478): 0x77a117b8
NtRequestPort (479): 0x77a117d0
NtRequestWaitReplyPort (480): 0x77a0fc00
NtResetEvent (481): 0x77a117e8
NtResetWriteWatch (482): 0x77a11804
NtRestoreKey (483): 0x77a11820
NtResumeProcess (484): 0x77a11838
NtResumeThread (485): 0x77a100a8
NtRollbackComplete (486): 0x77a11854
NtRollbackEnlistment (487): 0x77a1186c
NtRollbackTransaction (488): 0x77a11884
NtRollforwardTransactionManager (489): 0x77a1189c
NtSaveKey (490): 0x77a118b4
NtSaveKeyEx (491): 0x77a118cc
NtSaveMergedKeys (492): 0x77a118e4
NtSecureConnectPort (493): 0x77a11900
NtSerializeBoot (494): 0x77a11918
NtSetBootEntryOrder (495): 0x77a11930
NtSetBootOptions (496): 0x77a11948
NtSetContextThread (497): 0x77a11960
NtSetDebugFilterState (498): 0x77a11978
NtSetDefaultHardErrorPort (499): 0x77a11994
NtSetDefaultLocale (500): 0x77a119b0
NtSetDefaultUILanguage (501): 0x77a119cc
NtSetDriverEntryOrder (502): 0x77a119e8
NtSetEaFile (503): 0x77a11a00
NtSetEvent (504): 0x77a0fa04
NtSetEventBoostPriority (505): 0x77a0fd08
NtSetHighEventPair (506): 0x77a11a18
NtSetHighWaitLowEventPair (507): 0x77a11a34
NtSetInformationDebugObject (508): 0x77a11a50
NtSetInformationEnlistment (509): 0x77a11a68
NtSetInformationFile (510): 0x77a0fc78
NtSetInformationJobObject (511): 0x77a11a80
NtSetInformationKey (512): 0x77a11a98
NtSetInformationObject (513): 0x77a101a4
NtSetInformationProcess (514): 0x77a0fb68
NtSetInformationResourceManager (515): 0x77a11ab0
NtSetInformationThread (516): 0x77a0f9ec
NtSetInformationToken (517): 0x77a11ac8
NtSetInformationTransaction (518): 0x77a11ae0
NtSetInformationTransactionManager (519): 0x77a11af8
NtSetInformationWorkerFactory (520): 0x77a11b10
NtSetIntervalProfile (521): 0x77a11b28
NtSetIoCompletion (522): 0x77a11b44
NtSetIoCompletionEx (523): 0x77a11b5c
NtSetLdtEntries (524): 0x77a11b74
NtSetLowEventPair (525): 0x77a11b8c
NtSetLowWaitHighEventPair (526): 0x77a11ba8
NtSetQuotaInformationFile (527): 0x77a11bc4
NtSetSecurityObject (528): 0x77a11bdc
NtSetSystemEnvironmentValue (529): 0x77a11bf4
NtSetSystemEnvironmentValueEx (530): 0x77a11c0c
NtSetSystemInformation (531): 0x77a11c24
NtSetSystemPowerState (532): 0x77a11c3c
NtSetSystemTime (533): 0x77a11c54
NtSetThreadExecutionState (534): 0x77a11c70
NtSetTimer (535): 0x77a10238
NtSetTimerEx (536): 0x77a11c8c
NtSetTimerResolution (537): 0x77a11ca4
NtSetUuidSeed (538): 0x77a11cc0
NtSetValueKey (539): 0x77a10204
NtSetVolumeInformationFile (540): 0x77a11cdc
NtShutdownSystem (541): 0x77a11cf4
NtShutdownWorkerFactory (542): 0x77a11d10
NtSignalAndWaitForSingleObject (543): 0x77a11d28
NtSinglePhaseReject (544): 0x77a11d44
NtStartProfile (545): 0x77a11d5c
NtStopProfile (546): 0x77a11d78
NtSuspendProcess (547): 0x77a11d94
NtSuspendThread (548): 0x77a11db0
NtSystemDebugControl (549): 0x77a11dcc
NtTerminateJobObject (550): 0x77a11de4
NtTerminateProcess (551): 0x77a0fcf0
NtTerminateThread (552): 0x77a100c4
NtTestAlert (553): 0x77a11e00
NtThawRegistry (554): 0x77a11e1c
NtThawTransactions (555): 0x77a11e34
NtTraceControl (556): 0x77a11e4c
NtTraceEvent (557): 0x77a101d4
NtTranslateFilePath (558): 0x77a11e64
NtUmsThreadYield (559): 0x77a11e80
NtUnloadDriver (560): 0x77a11e98
NtUnloadKey (562): 0x77a11eb0
NtUnloadKey2 (561): 0x77a11ec8
NtUnloadKeyEx (563): 0x77a11ee0
NtUnlockFile (564): 0x77a11ef8
NtUnlockVirtualMemory (565): 0x77a11f10
NtUnmapViewOfSection (566): 0x77a0fcc0
NtVdmControl (567): 0x77a11f28
NtWaitForDebugEvent (568): 0x77a11f40
NtWaitForKeyedEvent (569): 0x77a11f58
NtWaitForMultipleObjects (571): 0x77a10188
NtWaitForMultipleObjects32 (570): 0x77a0fb30
NtWaitForSingleObject (572): 0x77a0f8fc
NtWaitForWorkViaWorkerFactory (573): 0x77a11f74
NtWaitHighEventPair (574): 0x77a11f8c
NtWaitLowEventPair (575): 0x77a11fa8
NtWorkerFactoryWorkerReady (576): 0x77a11fc4
NtWow64CallFunction64 (577): 0x77a1218c
NtWow64CsrAllocateCaptureBuffer (578): 0x77a12024
NtWow64CsrAllocateMessagePointer (579): 0x77a12054
NtWow64CsrCaptureMessageBuffer (580): 0x77a1206c
NtWow64CsrCaptureMessageString (581): 0x77a12084
NtWow64CsrClientCallServer (582): 0x77a1200c
NtWow64CsrClientConnectToServer (583): 0x77a11fdc
NtWow64CsrFreeCaptureBuffer (584): 0x77a1203c
NtWow64CsrGetProcessId (585): 0x77a1209c
NtWow64CsrIdentifyAlertableThread (586): 0x77a11ff4
NtWow64CsrVerifyRegion (587): 0x77a120b4
NtWow64DebuggerCall (588): 0x77a120cc
NtWow64GetCurrentProcessorNumberEx (589): 0x77a120e4
NtWow64GetNativeSystemInformation (590): 0x77a120fc
NtWow64InterlockedPopEntrySList (591): 0x77a12114
NtWow64QueryInformationProcess64 (592): 0x77a1212c
NtWow64QueryVirtualMemory64 (593): 0x77a12174
NtWow64ReadVirtualMemory64 (594): 0x77a12144
NtWow64WriteVirtualMemory64 (595): 0x77a1215c
NtWriteFile (596): 0x77a0f968
NtWriteFileGather (597): 0x77a0fb4c
NtWriteRequestData (598): 0x77a10124
NtWriteVirtualMemory (599): 0x77a0fe54
NtYieldExecution (600): 0x77a0ff7c
NtdllDefWindowProc_A (601): 0x77a288a5
NtdllDefWindowProc_W (602): 0x77a2260d
NtdllDialogWndProc_A (603): 0x77a6a6e9
NtdllDialogWndProc_W (604): 0x77a542d8
PfxFindPrefix (605): 0x77aa1bd2
PfxInitialize (606): 0x77aa1885
PfxInsertPrefix (607): 0x77aa1adf
PfxRemovePrefix (608): 0x77aa18a7
RtlAbortRXact (609): 0x77aa1cf4
RtlAbsoluteToSelfRelativeSD (610): 0x77a691fb
RtlAcquirePebLock (611): 0x77a282c0
RtlAcquirePrivilege (612): 0x77a4e5bd
RtlAcquireReleaseSRWLockExclusive (613): 0x77a98903
RtlAcquireResourceExclusive (614): 0x77a40f89
RtlAcquireResourceShared (615): 0x77a513a4
RtlAcquireSRWLockExclusive (616): 0x77a23fff
RtlAcquireSRWLockShared (617): 0x77a22590
RtlActivateActivationContext (618): 0x77a68e0a
RtlActivateActivationContextEx (619): 0x77a68e4b
RtlActivateActivationContextUnsafeFast (8): 0x77a12241
RtlAddAccessAllowedAce (620): 0x77a2ea91
RtlAddAccessAllowedAceEx (621): 0x77a4eb6b
RtlAddAccessAllowedObjectAce (622): 0x77aa5708
RtlAddAccessDeniedAce (623): 0x77a63aae
RtlAddAccessDeniedAceEx (624): 0x77aa5672
RtlAddAccessDeniedObjectAce (625): 0x77aa5755
RtlAddAce (626): 0x77a5d9c6
RtlAddActionToRXact (627): 0x77aa1eca
RtlAddAtomToAtomTable (628): 0x77a54ee0
RtlAddAttributeActionToRXact (629): 0x77aa1d36
RtlAddAuditAccessAce (630): 0x77aa5696
RtlAddAuditAccessAceEx (631): 0x77aa56cd
RtlAddAuditAccessObjectAce (632): 0x77aa57a3
RtlAddCompoundAce (633): 0x77aa542d
RtlAddIntegrityLabelToBoundaryDescriptor (634): 0x77aa5a3f
RtlAddMandatoryAce (635): 0x77a59364
RtlAddRefActivationContext (636): 0x77a1f64a
RtlAddRefMemoryStream (637): 0x77a370f8
RtlAddSIDToBoundaryDescriptor (638): 0x77a5b813
RtlAddVectoredContinueHandler (639): 0x77a4ac55
RtlAddVectoredExceptionHandler (640): 0x77a624c1
RtlAddressInSectionTable (641): 0x77a439d8
RtlAdjustPrivilege (642): 0x77aa25b0
RtlAllocateActivationContextStack (643): 0x77a29923
RtlAllocateAndInitializeSid (644): 0x77a28d92
RtlAllocateHandle (645): 0x77a28545
RtlAllocateHeap (646): 0x77a1e036
RtlAllocateMemoryBlockLookaside (647): 0x77ae00a0
RtlAllocateMemoryZone (648): 0x77ae0010
RtlAnsiCharToUnicodeChar (649): 0x77a1f94a
RtlAnsiStringToUnicodeSize (650): 0x77aa68d2
RtlAnsiStringToUnicodeString (651): 0x77a1e6dd
RtlAppendAsciizToString (652): 0x77aa6f11
RtlAppendPathElement (653): 0x77a8f66c
RtlAppendStringToString (654): 0x77aa6f71
RtlAppendUnicodeStringToString (655): 0x77a29ef9
RtlAppendUnicodeToString (656): 0x77a29fc0
RtlApplicationVerifierStop (657): 0x77a97e17
RtlApplyRXact (658): 0x77aa2383
RtlApplyRXactNoFlush (659): 0x77aa2400
RtlAreAllAccessesGranted (660): 0x77aa2994
RtlAreAnyAccessesGranted (661): 0x77aa29b0
RtlAreBitsClear (662): 0x77aa7756
RtlAreBitsSet (663): 0x77a4a115
RtlAssert (664): 0x77aa7bcf
RtlBarrier (665): 0x77aa7cd2
RtlBarrierForDelete (666): 0x77aa7de4
RtlCancelTimer (667): 0x77ad1270
RtlCaptureContext (668): 0x77a4b67f
RtlCaptureStackBackTrace (669): 0x77a54dcd
RtlCaptureStackContext (670): 0x77aa80a6
RtlCharToInteger (671): 0x77a6a047
RtlCheckForOrphanedCriticalSections (672): 0x77a547ff
RtlCheckRegistryKey (673): 0x77aa8594
RtlCheckSandboxedToken (674): 0x77a9367f
RtlCleanUpTEBLangLists (675): 0x77a469b6
RtlClearAllBits (676): 0x77a68c3b
RtlClearBits (677): 0x77a4a0c5
RtlCloneMemoryStream (678): 0x77a91e6e
RtlCloneUserProcess (679): 0x77a9ec7b
RtlCmDecodeMemIoResource (680): 0x77aadaa4
RtlCmEncodeMemIoResource (681): 0x77aad8b0
RtlCommitDebugInfo (682): 0x77a93d55
RtlCommitMemoryStream (683): 0x77a91e6e
RtlCompactHeap (684): 0x77a51c5d
RtlCompareAltitudes (685): 0x77ab01e2
RtlCompareMemory (686): 0x77a4af70
RtlCompareMemoryUlong (687): 0x77a4afc0
RtlCompareString (688): 0x77aa6e28
RtlCompareUnicodeString (689): 0x77a29e76
RtlCompareUnicodeStrings (690): 0x77a29bce
RtlCompressBuffer (691): 0x77ab042d
RtlComputeCrc32 (692): 0x77ab0679
RtlComputeImportTableHash (693): 0x77a9cf7d
RtlComputePrivatizedDllName_U (694): 0x77a91bc7
RtlConnectToSm (695): 0x77ab0ab5
RtlConsoleMultiByteToUnicodeN (696): 0x77aa12a5
RtlContractHashTable (697): 0x77ab1384
RtlConvertExclusiveToShared (698): 0x77a9264b
RtlConvertLCIDToString (699): 0x77aaa1ff
RtlConvertLongToLargeInteger (700): 0x77a2dfb2
RtlConvertSharedToExclusive (701): 0x77a66967
RtlConvertSidToUnicodeString (702): 0x77a2aa3b
RtlConvertToAutoInheritSecurityObject (703): 0x77a93403
RtlConvertUiListToApiList (704): 0x77a939c8
RtlConvertUlongToLargeInteger (705): 0x77a2dfba
RtlCopyContext (706): 0x77ab1c9e
RtlCopyExtendedContext (707): 0x77ab1c7c
RtlCopyLuid (708): 0x77aa2907
RtlCopyLuidAndAttributesArray (709): 0x77aa2925
RtlCopyMappedMemory (710): 0x77ab20fc
RtlCopyMemoryStreamTo (711): 0x77a91e88
RtlCopyOutOfProcessMemoryStreamTo (712): 0x77a91e88
RtlCopySecurityDescriptor (713): 0x77a92f88
RtlCopySid (714): 0x77a28c97
RtlCopySidAndAttributesArray (715): 0x77aa266c
RtlCopyString (716): 0x77a536a7
RtlCopyUnicodeString (717): 0x77a29f65
RtlCreateAcl (718): 0x77a2e962
RtlCreateActivationContext (719): 0x77a3ef6f
RtlCreateAndSetSD (720): 0x77a930d3
RtlCreateAtomTable (721): 0x77a3ec6e
RtlCreateBootStatusDataFile (722): 0x77ab232a
RtlCreateBoundaryDescriptor (723): 0x77a58509
RtlCreateEnvironment (724): 0x77ab24b6
RtlCreateEnvironmentEx (725): 0x77a524b3
RtlCreateHashTable (726): 0x77ab1472
RtlCreateHeap (727): 0x77a34e9d
RtlCreateMemoryBlockLookaside (728): 0x77a58680
RtlCreateMemoryZone (729): 0x77a5857f
RtlCreateProcessParameters (730): 0x77a9ee1b
RtlCreateProcessParametersEx (731): 0x77a50eab
RtlCreateProcessReflection (732): 0x77a920f5
RtlCreateQueryDebugBuffer (733): 0x77a639bd
RtlCreateRegistryKey (734): 0x77aa85ca
RtlCreateSecurityDescriptor (735): 0x77a2e8d5
RtlCreateServiceSid (736): 0x77a5b564
RtlCreateSystemVolumeInformationFolder (737): 0x77ab2da7
RtlCreateTagHeap (738): 0x77a35888
RtlCreateTimer (739): 0x77a58cd8
RtlCreateTimerQueue (740): 0x77a58c02
RtlCreateUnicodeString (741): 0x77a41906
RtlCreateUnicodeStringFromAsciiz (742): 0x77a29d31
RtlCreateUserProcess (743): 0x77a9ebd1
RtlCreateUserSecurityObject (744): 0x77a9338a
RtlCreateUserStack (745): 0x77a60571
RtlCreateUserThread (746): 0x77a9ec41
RtlCreateVirtualAccountSid (747): 0x77aa2700
RtlCultureNameToLCID (748): 0x77a41137
RtlCustomCPToUnicodeN (749): 0x77aa066f
RtlCutoverTimeToSystemTime (750): 0x77a6763d
RtlDeCommitDebugInfo (751): 0x77a93d94
RtlDeNormalizeProcessParams (752): 0x77a9e798
RtlDeactivateActivationContext (753): 0x77a68c6c
RtlDeactivateActivationContextUnsafeFast (9): 0x77a121a9
RtlDebugPrintTimes (754): 0x77ad1140
RtlDecodePointer (755): 0x77a296e5
RtlDecodeSystemPointer (756): 0x77a2ba78
RtlDecompressBuffer (757): 0x77ab04a5
RtlDecompressFragment (758): 0x77ab050d
RtlDefaultNpAcl (759): 0x77a93413
RtlDelete (760): 0x77a4ed7a
RtlDeleteAce (761): 0x77a4ab24
RtlDeleteAtomFromAtomTable (762): 0x77a55093
RtlDeleteBarrier (763): 0x77aa7fbd
RtlDeleteBoundaryDescriptor (764): 0x77a1e695
RtlDeleteCriticalSection (765): 0x77a23ced
RtlDeleteElementGenericTable (766): 0x77a4ecb8
RtlDeleteElementGenericTableAvl (767): 0x77a5d849
RtlDeleteHashTable (768): 0x77ab0f38
RtlDeleteNoSplay (769): 0x77ab2fff
RtlDeleteRegistryValue (770): 0x77aa8600
RtlDeleteResource (771): 0x77a4a1d1
RtlDeleteSecurityObject (772): 0x77a5db67
RtlDeleteTimer (773): 0x77a5d050
RtlDeleteTimerQueue (774): 0x77ad1148
RtlDeleteTimerQueueEx (775): 0x77a6038a
RtlDeregisterSecureMemoryCacheCallback (776): 0x77ab3493
RtlDeregisterWait (777): 0x77ad129b
RtlDeregisterWaitEx (778): 0x77a5fcb1
RtlDestroyAtomTable (779): 0x77aa583a
RtlDestroyEnvironment (780): 0x77a53eaa
RtlDestroyHandleTable (781): 0x77a4a398
RtlDestroyHeap (782): 0x77a4e8de
RtlDestroyMemoryBlockLookaside (783): 0x77a5c9fa
RtlDestroyMemoryZone (784): 0x77a5c97f
RtlDestroyProcessParameters (785): 0x77a50d61
RtlDestroyQueryDebugBuffer (786): 0x77a64600
RtlDetectHeapLeaks (787): 0x77a49eb5
RtlDetermineDosPathNameType_U (788): 0x77a2b214
RtlDisableThreadProfiling (789): 0x77a8f3f0
RtlDllShutdownInProgress (790): 0x77a2263a
RtlDnsHostNameToComputerName (791): 0x77aa6d6b
RtlDoesFileExists_U (792): 0x77a3e33d
RtlDosApplyFileIsolationRedirection_Ustr (793): 0x77a1efb2
RtlDosPathNameToNtPathName_U (794): 0x77a46610
RtlDosPathNameToNtPathName_U_WithStatus (795): 0x77a2eca8
RtlDosPathNameToRelativeNtPathName_U (796): 0x77a2ec82
RtlDosPathNameToRelativeNtPathName_U_WithStatus (797): 0x77a2b4fd
RtlDosSearchPath_U (798): 0x77a8f92a
RtlDosSearchPath_Ustr (799): 0x77a4446e
RtlDowncaseUnicodeChar (800): 0x77aa6850
RtlDowncaseUnicodeString (801): 0x77a4d418
RtlDumpResource (802): 0x77a9269a
RtlDuplicateUnicodeString (803): 0x77a4d029
RtlEmptyAtomTable (804): 0x77aa58f1
RtlEnableEarlyCriticalSectionEventCreation (805): 0x77a92717
RtlEnableThreadProfiling (806): 0x77a8f31f
RtlEncodePointer (807): 0x77a2a1e7
RtlEncodeSystemPointer (808): 0x77a30d90
RtlEndEnumerationHashTable (809): 0x77ab11d0
RtlEndWeakEnumerationHashTable (810): 0x77ab1225
RtlEnlargedIntegerMultiply (811): 0x77a2dd90
RtlEnlargedUnsignedDivide (812): 0x77a2dda8
RtlEnlargedUnsignedMultiply (813): 0x77a2dd9c
RtlEnterCriticalSection (814): 0x77a12300
RtlEnumProcessHeaps (815): 0x77aadfa8
RtlEnumerateEntryHashTable (816): 0x77ab1150
RtlEnumerateGenericTable (817): 0x77ab310e
RtlEnumerateGenericTableAvl (818): 0x77a5d516
RtlEnumerateGenericTableLikeADirectory (819): 0x77ab3346
RtlEnumerateGenericTableWithoutSplaying (820): 0x77a4a196
RtlEnumerateGenericTableWithoutSplayingAvl (821): 0x77a5d80a
RtlEqualComputerName (822): 0x77aa6d5e
RtlEqualDomainName (823): 0x77aa6d01
RtlEqualLuid (824): 0x77aa28de
RtlEqualPrefixSid (825): 0x77a5db13
RtlEqualSid (826): 0x77a28e61
RtlEqualString (827): 0x77a50754
RtlEqualUnicodeString (828): 0x77a1e81b
RtlEraseUnicodeString (829): 0x77aa2579
RtlEthernetAddressToStringA (830): 0x77ab4374
RtlEthernetAddressToStringW (831): 0x77ab43b7
RtlEthernetStringToAddressA (832): 0x77ab47dc
RtlEthernetStringToAddressW (833): 0x77ab48ff
RtlExitUserProcess (834): 0x77a49bd2
RtlExitUserThread (835): 0x77a46954
RtlExpandEnvironmentStrings (836): 0x77a2b8e1
RtlExpandEnvironmentStrings_U (837): 0x77a461af
RtlExpandHashTable (838): 0x77ab1232
RtlExtendMemoryBlockLookaside (839): 0x77aa6638
RtlExtendMemoryZone (840): 0x77aa6753
RtlExtendedIntegerMultiply (841): 0x77a2deb6
RtlExtendedLargeIntegerDivide (842): 0x77a2ddc8
RtlExtendedMagicDivide (843): 0x77a2de26
RtlFillMemory (844): 0x77a4aff0
RtlFillMemoryUlong (845): 0x77a4b060
RtlFillMemoryUlonglong (846): 0x77a4b030
RtlFinalReleaseOutOfProcessMemoryStream (847): 0x77a91e4c
RtlFindAceByType (848): 0x77a5de68
RtlFindActivationContextSectionGuid (849): 0x77a540a3
RtlFindActivationContextSectionString (850): 0x77a1eca0
RtlFindCharInUnicodeString (851): 0x77a1fb67
RtlFindClearBits (852): 0x77a31725
RtlFindClearBitsAndSet (853): 0x77a317f9
RtlFindClearRuns (854): 0x77aa72ce
RtlFindClosestEncodableLength (855): 0x77aadb1f
RtlFindLastBackwardRunClear (856): 0x77aa7970
RtlFindLeastSignificantBit (857): 0x77aa7aeb
RtlFindLongestRunClear (858): 0x77aa75fd
RtlFindMessage (859): 0x77a4fecd
RtlFindMostSignificantBit (860): 0x77aa7a40
RtlFindNextForwardRunClear (861): 0x77aa77e6
RtlFindSetBits (862): 0x77aa6ff3
RtlFindSetBitsAndClear (863): 0x77aa7b84
RtlFirstEntrySList (864): 0x77a22748
RtlFirstFreeAce (865): 0x77a2e829
RtlFlsAlloc (866): 0x77a3199f
RtlFlsFree (867): 0x77a4a212
RtlFlushSecureMemoryCache (868): 0x77ab35cf
RtlFormatCurrentUserKeyPath (869): 0x77a2acb9
RtlFormatMessage (870): 0x77ab4a35
RtlFormatMessageEx (871): 0x77a4f3a1
RtlFreeActivationContextStack (872): 0x77a46840
RtlFreeAnsiString (873): 0x77a1e136
RtlFreeHandle (874): 0x77a28587
RtlFreeHeap (875): 0x77a1df95
RtlFreeMemoryBlockLookaside (876): 0x77ae0080
RtlFreeOemString (877): 0x77a8f08a
RtlFreeSid (878): 0x77a28d62
RtlFreeThreadActivationContextStack (879): 0x77a4681c
RtlFreeUnicodeString (880): 0x77a1e136
RtlFreeUserStack (881): 0x77a6abe0
RtlGUIDFromString (882): 0x77a50864
RtlGenerate8dot3Name (883): 0x77ab4e0c
RtlGetAce (884): 0x77a465b5
RtlGetActiveActivationContext (885): 0x77a2a595
RtlGetCallersAddress (886): 0x77aa81ab
RtlGetCompressionWorkSpaceSize (887): 0x77ab03c3
RtlGetControlSecurityDescriptor (888): 0x77a69255
RtlGetCriticalSectionRecursionCount (889): 0x77a92570
RtlGetCurrentDirectory_U (890): 0x77a455cd
RtlGetCurrentPeb (891): 0x77a29b7c
RtlGetCurrentProcessorNumber (892): 0x77a63099
RtlGetCurrentProcessorNumberEx (893): 0x77a2403f
RtlGetCurrentTransaction (894): 0x77a28169
RtlGetDaclSecurityDescriptor (895): 0x77a341d2
RtlGetElementGenericTable (896): 0x77ab307f
RtlGetElementGenericTableAvl (897): 0x77ab3260
RtlGetEnabledExtendedFeatures (898): 0x77ab52df
RtlGetExtendedContextLength (899): 0x77ab1ece
RtlGetExtendedFeaturesMask (900): 0x77ab1f55
RtlGetFileMUIPath (901): 0x77aac3d3
RtlGetFrame (902): 0x77a8fe7a
RtlGetFullPathName_U (903): 0x77a33f7c
RtlGetFullPathName_UEx (904): 0x77a2b9f6
RtlGetFullPathName_UstrEx (905): 0x77a2b6d0
RtlGetGroupSecurityDescriptor (906): 0x77a69943
RtlGetIntegerAtom (907): 0x77a28794
RtlGetLastNtStatus (908): 0x77ab52fe
RtlGetLastWin32Error (909): 0x77a46df3
RtlGetLengthWithoutLastFullDosOrNtPathElement (910): 0x77a3ed80
RtlGetLengthWithoutTrailingPathSeperators (911): 0x77a8f845
RtlGetLocaleFileMappingAddress (912): 0x77a36063
RtlGetLongestNtPathLength (913): 0x77a4659d
RtlGetNativeSystemInformation (914): 0x77a120fc
RtlGetNextEntryHashTable (915): 0x77ab10bf
RtlGetNtGlobalFlags (916): 0x77a28051
RtlGetNtProductType (917): 0x77a2a15b
RtlGetNtVersionNumbers (918): 0x77a36ce9
RtlGetOwnerSecurityDescriptor (919): 0x77a698fc
RtlGetParentLocaleName (920): 0x77a38d66
RtlGetProcessHeaps (921): 0x77a61da1
RtlGetProcessPreferredUILanguages (922): 0x77aa9eb9
RtlGetProductInfo (923): 0x77a4f785
RtlGetSaclSecurityDescriptor (924): 0x77a4eb8f
RtlGetSecurityDescriptorRMControl (925): 0x77aa30af
RtlGetSetBootStatusData (926): 0x77ab2225
RtlGetSystemPreferredUILanguages (927): 0x77aaad55
RtlGetThreadErrorMode (928): 0x77a63380
RtlGetThreadLangIdByIndex (929): 0x77aa91c8
RtlGetThreadPreferredUILanguages (930): 0x77a3c486
RtlGetUILanguageInfo (931): 0x77aabd06
RtlGetUnloadEventTrace (932): 0x77a903ff
RtlGetUnloadEventTraceEx (933): 0x77a6396d
RtlGetUserInfoHeap (934): 0x77a56ee8
RtlGetUserPreferredUILanguages (935): 0x77aacc23
RtlGetVersion (936): 0x77a2a093
RtlHashUnicodeString (937): 0x77a1ee9a
RtlHeapTrkInitialize (938): 0x77ab669a
RtlIdentifierAuthoritySid (939): 0x77a6a5f2
RtlIdnToAscii (940): 0x77a5f5e5
RtlIdnToNameprepUnicode (941): 0x77ab74c6
RtlIdnToUnicode (942): 0x77ab74ea
RtlImageDirectoryEntryToData (943): 0x77a1f56e
RtlImageNtHeader (944): 0x77a24764
RtlImageNtHeaderEx (945): 0x77a1f4bd
RtlImageRvaToSection (946): 0x77a43a0a
RtlImageRvaToVa (947): 0x77aa5b35
RtlImpersonateSelf (948): 0x77a636a7
RtlImpersonateSelfEx (949): 0x77a636c1
RtlInitAnsiString (950): 0x77a1e1f8
RtlInitAnsiStringEx (951): 0x77a1f7c3
RtlInitBarrier (952): 0x77aa7f44
RtlInitCodePageTable (953): 0x77a3738e
RtlInitEnumerationHashTable (954): 0x77ab1105
RtlInitMemoryStream (955): 0x77a91e4c
RtlInitNlsTables (956): 0x77a3735d
RtlInitOutOfProcessMemoryStream (957): 0x77a91e4c
RtlInitString (958): 0x77a1e1c0
RtlInitUnicodeString (959): 0x77a1e230
RtlInitUnicodeStringEx (960): 0x77a27ffe
RtlInitWeakEnumerationHashTable (961): 0x77ab1205
RtlInitializeAtomPackage (962): 0x77a370f8
RtlInitializeBitMap (963): 0x77a23fe3
RtlInitializeConditionVariable (964): 0x77a28391
RtlInitializeContext (965): 0x77ab768b
RtlInitializeCriticalSection (966): 0x77a24250
RtlInitializeCriticalSectionAndSpinCount (967): 0x77a22618
RtlInitializeCriticalSectionEx (968): 0x77a23e9e
RtlInitializeExceptionChain (969): 0x77a2981f
RtlInitializeExtendedContext (970): 0x77ab1de0
RtlInitializeGenericTable (971): 0x77a3455e
RtlInitializeGenericTableAvl (972): 0x77a588b4
RtlInitializeHandleTable (973): 0x77a34be8
RtlInitializeNtUserPfn (974): 0x77a39a9f
RtlInitializeRXact (975): 0x77aa209f
RtlInitializeResource (976): 0x77a40e42
RtlInitializeSListHead (977): 0x77a28e54
RtlInitializeSRWLock (978): 0x77a28391
RtlInitializeSid (979): 0x77a2f7f6
RtlInsertElementGenericTable (980): 0x77a4deea
RtlInsertElementGenericTableAvl (981): 0x77a588fd
RtlInsertElementGenericTableFull (982): 0x77a4df1c
RtlInsertElementGenericTableFullAvl (983): 0x77a58930
RtlInsertEntryHashTable (984): 0x77ab0fcf
RtlInt64ToUnicodeString (985): 0x77aa84bd
RtlIntegerToChar (986): 0x77a2db0c
RtlIntegerToUnicodeString (987): 0x77a2dbc5
RtlInterlockedClearBitRun (988): 0x77a6528d
RtlInterlockedCompareExchange64 (989): 0x77a22770
RtlInterlockedFlushSList (990): 0x77a227a5
RtlInterlockedPopEntrySList (991): 0x77a23e68
RtlInterlockedPushEntrySList (992): 0x77a23e4f
RtlInterlockedPushListSList (10): 0x77a22720
RtlInterlockedSetBitRun (993): 0x77aa78dd
RtlIoDecodeMemIoResource (994): 0x77aad9e6
RtlIoEncodeMemIoResource (995): 0x77aad5fe
RtlIpv4AddressToStringA (996): 0x77ab429d
RtlIpv4AddressToStringExA (997): 0x77ab42d6
RtlIpv4AddressToStringExW (998): 0x77a50c9e
RtlIpv4AddressToStringW (999): 0x77a50d25
RtlIpv4StringToAddressA (1000): 0x77a51521
RtlIpv4StringToAddressExA (1001): 0x77ab463e
RtlIpv4StringToAddressExW (1002): 0x77a5162d
RtlIpv4StringToAddressW (1003): 0x77a50a0f
RtlIpv6AddressToStringA (1004): 0x77ab3fa5
RtlIpv6AddressToStringExA (1005): 0x77ab41be
RtlIpv6AddressToStringExW (1006): 0x77a52310
RtlIpv6AddressToStringW (1007): 0x77a5221b
RtlIpv6StringToAddressA (1008): 0x77a51965
RtlIpv6StringToAddressExA (1009): 0x77ab43fd
RtlIpv6StringToAddressExW (1010): 0x77a50abd
RtlIpv6StringToAddressW (1011): 0x77a50b18
RtlIsActivationContextActive (1012): 0x77a9c852
RtlIsCriticalSectionLocked (1013): 0x77a92554
RtlIsCriticalSectionLockedByThread (1014): 0x77a42fa5
RtlIsCurrentThreadAttachExempt (1015): 0x77a293e2
RtlIsDosDeviceName_U (1016): 0x77a2b51e
RtlIsGenericTableEmpty (1017): 0x77a50dc4
RtlIsGenericTableEmptyAvl (1018): 0x77ab3247
RtlIsNameInExpression (1019): 0x77ab8003
RtlIsNameLegalDOS8Dot3 (1020): 0x77ab4c92
RtlIsNormalizedString (1021): 0x77ab9129
RtlIsTextUnicode (1022): 0x77a4edbd
RtlIsThreadWithinLoaderCallout (1023): 0x77a287e4
RtlIsValidHandle (1024): 0x77a28510
RtlIsValidIndexHandle (1025): 0x77a28874
RtlIsValidLocaleName (1026): 0x77ab5953
RtlKnownExceptionFilter (1027): 0x77a63398
RtlLCIDToCultureName (1028): 0x77a3ca09
RtlLargeIntegerAdd (1029): 0x77a2dd7c
RtlLargeIntegerArithmeticShift (1030): 0x77a2df5e
RtlLargeIntegerDivide (1031): 0x77ab94a5
RtlLargeIntegerNegate (1032): 0x77a2df8a
RtlLargeIntegerShiftLeft (1033): 0x77a2df0e
RtlLargeIntegerShiftRight (1034): 0x77a2df36
RtlLargeIntegerSubtract (1035): 0x77a2df9e
RtlLargeIntegerToChar (1036): 0x77aa81f5
RtlLcidToLocaleName (1037): 0x77a3c320
RtlLeaveCriticalSection (1038): 0x77a122c0
RtlLengthRequiredSid (1039): 0x77a28d3f
RtlLengthSecurityDescriptor (1040): 0x77a699b4
RtlLengthSid (1041): 0x77a28ccb
RtlLoadString (1042): 0x77a43f35
RtlLocalTimeToSystemTime (1043): 0x77aa1810
RtlLocaleNameToLcid (1044): 0x77a3891a
RtlLocateExtendedFeature (1045): 0x77ab1fce
RtlLocateLegacyContext (1046): 0x77ab1aca
RtlLockBootStatusData (1047): 0x77ab211e
RtlLockCurrentThread (1048): 0x77ab95e8
RtlLockHeap (1049): 0x77a28491
RtlLockMemoryBlockLookaside (1050): 0x77aa6654
RtlLockMemoryStreamRegion (1051): 0x77a91e88
RtlLockMemoryZone (1052): 0x77a686d5
RtlLockModuleSection (1053): 0x77a687a7
RtlLogStackBackTrace (1054): 0x77ab9f06
RtlLookupAtomInAtomTable (1055): 0x77a2ee6a
RtlLookupElementGenericTable (1056): 0x77a4ec54
RtlLookupElementGenericTableAvl (1057): 0x77a589b5
RtlLookupElementGenericTableFull (1058): 0x77a4ec75
RtlLookupElementGenericTableFullAvl (1059): 0x77a589d6
RtlLookupEntryHashTable (1060): 0x77ab107b
RtlMakeSelfRelativeSD (1061): 0x77a69040
RtlMapGenericMask (1062): 0x77a5dac3
RtlMapSecurityErrorToNtStatus (1063): 0x77aa3184
RtlMoveMemory (1064): 0x77a4b0b0
RtlMultiAppendUnicodeStringBuffer (1065): 0x77a33fd0
RtlMultiByteToUnicodeN (1066): 0x77a1e56d
RtlMultiByteToUnicodeSize (1067): 0x77a6a1e9
RtlMultipleAllocateHeap (1068): 0x77aaf5b0
RtlMultipleFreeHeap (1069): 0x77aaf62d
RtlNewInstanceSecurityObject (1070): 0x77a92df2
RtlNewSecurityGrantedAccess (1071): 0x77a92e68
RtlNewSecurityObject (1072): 0x77a65b39
RtlNewSecurityObjectEx (1073): 0x77a5e7b3
RtlNewSecurityObjectWithMultipleInheritance (1074): 0x77a929bf
RtlNormalizeProcessParams (1075): 0x77a36eb8
RtlNormalizeString (1076): 0x77a69372
RtlNtPathNameToDosPathName (1077): 0x77a53c7b
RtlNtStatusToDosError (1078): 0x77a2639d
RtlNtStatusToDosErrorNoTeb (1079): 0x77a263dc
RtlNumberGenericTableElements (1080): 0x77a4a182
RtlNumberGenericTableElementsAvl (1081): 0x77ab3332
RtlNumberOfClearBits (1082): 0x77aa7737
RtlNumberOfSetBits (1083): 0x77aa7634
RtlNumberOfSetBitsUlongPtr (1084): 0x77ab9f36
RtlOemStringToUnicodeSize (1085): 0x77aa68d2
RtlOemStringToUnicodeString (1086): 0x77a5be4b
RtlOemToUnicodeN (1087): 0x77a5bd51
RtlOpenCurrentUser (1088): 0x77a328a5
RtlOwnerAcesPresent (1089): 0x77aa3097
RtlPcToFileHeader (1090): 0x77a32dec
RtlPinAtomInAtomTable (1091): 0x77aa599e
RtlPopFrame (1092): 0x77a8fe5a
RtlPrefixString (1093): 0x77a669b6
RtlPrefixUnicodeString (1094): 0x77a2e019
RtlProcessFlsData (1095): 0x77a29357
RtlProtectHeap (1096): 0x77aaf9cf
RtlPushFrame (1097): 0x77a8fe37
RtlQueryActivationContextApplicationSettings (1098): 0x77a39c99
RtlQueryAtomInAtomTable (1099): 0x77a56acc
RtlQueryCriticalSectionOwner (1100): 0x77a9283a
RtlQueryDepthSList (1101): 0x77a23e14
RtlQueryDynamicTimeZoneInformation (1102): 0x77aa8845
RtlQueryElevationFlags (1103): 0x77a50d87
RtlQueryEnvironmentVariable (1104): 0x77a2909f
RtlQueryEnvironmentVariable_U (1105): 0x77a29303
RtlQueryHeapInformation (1106): 0x77a64965
RtlQueryInformationAcl (1107): 0x77a56505
RtlQueryInformationActivationContext (1108): 0x77a2a2f5
RtlQueryInformationActiveActivationContext (1109): 0x77a287bf
RtlQueryInterfaceMemoryStream (1110): 0x77a91e95
RtlQueryModuleInformation (1111): 0x77a9ee4e
RtlQueryPerformanceCounter (1112): 0x77a228e4
RtlQueryPerformanceFrequency (1113): 0x77a2a185
RtlQueryProcessBackTraceInformation (1114): 0x77a93f16
RtlQueryProcessDebugInformation (1115): 0x77a6470c
RtlQueryProcessHeapInformation (1116): 0x77a944e3
RtlQueryProcessLockInformation (1117): 0x77a94267
RtlQueryRegistryValues (1118): 0x77a678ed
RtlQuerySecurityObject (1119): 0x77a92a20
RtlQueryTagHeap (1120): 0x77aade5d
RtlQueryThreadProfiling (1121): 0x77a8f43a
RtlQueryTimeZoneInformation (1122): 0x77a65687
RtlQueueApcWow64Thread (1123): 0x77a98243
RtlQueueWorkItem (1124): 0x77a57ebe
RtlRaiseException (1125): 0x77a4b9b8
RtlRaiseStatus (1126): 0x77a4b9f5
RtlRandom (1127): 0x77ab9f7a
RtlRandomEx (1128): 0x77a34e37
RtlReAllocateHeap (1129): 0x77a2e098
RtlReadMemoryStream (1130): 0x77a91e54
RtlReadOutOfProcessMemoryStream (1131): 0x77a91e54
RtlReadThreadProfilingData (1132): 0x77a8f459
RtlRealPredecessor (1133): 0x77ab2fc2
RtlRealSuccessor (1134): 0x77a4ece2
RtlRegisterSecureMemoryCacheCallback (1135): 0x77ab3415
RtlRegisterThreadWithCsrss (1136): 0x77a29ba2
RtlRegisterWait (1137): 0x77a5f262
RtlReleaseActivationContext (1138): 0x77a2a4b0
RtlReleaseMemoryStream (1139): 0x77a370f8
RtlReleasePebLock (1140): 0x77a282d7
RtlReleasePrivilege (1141): 0x77a4e76c
RtlReleaseRelativeName (1142): 0x77a2b4dd
RtlReleaseResource (1143): 0x77a40f0d
RtlReleaseSRWLockExclusive (1144): 0x77a23fb9
RtlReleaseSRWLockShared (1145): 0x77a225d9
RtlRemoteCall (1146): 0x77ab7747
RtlRemoveEntryHashTable (1147): 0x77ab1035
RtlRemovePrivileges (1148): 0x77aa27fa
RtlRemoveVectoredContinueHandler (1149): 0x77a96542
RtlRemoveVectoredExceptionHandler (1150): 0x77a62280
RtlReplaceSidInSd (1151): 0x77aa36a7
RtlReportException (1152): 0x77a98b7f
RtlReportSilentProcessExit (1153): 0x77a49b07
RtlReportSqmEscalation (1154): 0x77a98e40
RtlResetMemoryBlockLookaside (1155): 0x77aa66bf
RtlResetMemoryZone (1156): 0x77aa680f
RtlResetRtlTranslations (1157): 0x77a37007
RtlRestoreLastWin32Error (1158): 0x77a1233f
RtlRetrieveNtUserPfn (1159): 0x77a332e2
RtlRevertMemoryStream (1160): 0x77a91e7b
RtlRunDecodeUnicodeString (1161): 0x77aa2538
RtlRunEncodeUnicodeString (1162): 0x77aa24be
RtlRunOnceBeginInitialize (1163): 0x77a2809b
RtlRunOnceComplete (1164): 0x77a2a933
RtlRunOnceExecuteOnce (1165): 0x77a28063
RtlRunOnceInitialize (1166): 0x77a28391
RtlSecondsSince1970ToTime (1167): 0x77aa179d
RtlSecondsSince1980ToTime (1168): 0x77aa1766
RtlSeekMemoryStream (1169): 0x77a91e61
RtlSelfRelativeToAbsoluteSD (1171): 0x77a65d1c
RtlSelfRelativeToAbsoluteSD2 (1170): 0x77aa2420
RtlSendMsgToSm (1172): 0x77ab0d1c
RtlSetAllBits (1173): 0x77aa6fc5
RtlSetAttributesSecurityDescriptor (1174): 0x77aa395f
RtlSetBits (1175): 0x77a3182c
RtlSetControlSecurityDescriptor (1176): 0x77aa2954
RtlSetCriticalSectionSpinCount (1177): 0x77a28e97
RtlSetCurrentDirectory_U (1178): 0x77a4dd5f
RtlSetCurrentEnvironment (1179): 0x77ab24db
RtlSetCurrentTransaction (1180): 0x77a2819a
RtlSetDaclSecurityDescriptor (1181): 0x77a2e903
RtlSetDynamicTimeZoneInformation (1182): 0x77aa882a
RtlSetEnvironmentStrings (1183): 0x77ab2552
RtlSetEnvironmentVar (1184): 0x77a3556e
RtlSetEnvironmentVariable (1185): 0x77a357af
RtlSetExtendedFeaturesMask (1186): 0x77ab1b3a
RtlSetGroupSecurityDescriptor (1187): 0x77a2eb02
RtlSetHeapInformation (1188): 0x77a45665
RtlSetInformationAcl (1189): 0x77aa5346
RtlSetIoCompletionCallback (1190): 0x77a66cea
RtlSetLastWin32Error (1191): 0x77a1233f
RtlSetLastWin32ErrorAndNtStatusFromNtStatus (1192): 0x77a45f16
RtlSetMemoryStreamSize (1193): 0x77a91e95
RtlSetOwnerSecurityDescriptor (1194): 0x77a2eab4
RtlSetProcessDebugInformation (1195): 0x77a93dec
RtlSetProcessIsCritical (1196): 0x77ab5211
RtlSetProcessPreferredUILanguages (1197): 0x77aabb9a
RtlSetSaclSecurityDescriptor (1198): 0x77a4eb0c
RtlSetSecurityDescriptorRMControl (1199): 0x77aa3116
RtlSetSecurityObject (1200): 0x77a929cf
RtlSetSecurityObjectEx (1201): 0x77a929f7
RtlSetThreadErrorMode (1202): 0x77a4f30e
RtlSetThreadIsCritical (1203): 0x77ab5278
RtlSetThreadPoolStartFunc (1204): 0x77a3685b
RtlSetThreadPreferredUILanguages (1205): 0x77a527c7
RtlSetTimeZoneInformation (1206): 0x77aa880f
RtlSetTimer (1207): 0x77ad128b
RtlSetUnhandledExceptionFilter (1208): 0x77a357ee
RtlSetUserCallbackExceptionFilter (1209): 0x77a36f58
RtlSetUserFlagsHeap (1210): 0x77aadc17
RtlSetUserValueHeap (1211): 0x77a4418b
RtlSidDominates (1212): 0x77aa35ed
RtlSidEqualLevel (1213): 0x77aa356d
RtlSidHashInitialize (1214): 0x77aa326f
RtlSidHashLookup (1215): 0x77aa32f4
RtlSidIsHigherLevel (1216): 0x77aa34ed
RtlSizeHeap (1217): 0x77a24610
RtlSleepConditionVariableCS (1218): 0x77a9859b
RtlSleepConditionVariableSRW (1219): 0x77a98698
RtlSplay (1220): 0x77a4ec3b
RtlStartRXact (1221): 0x77aa1c9b
RtlStatMemoryStream (1222): 0x77a91e95
RtlStringFromGUID (1223): 0x77a4d160
RtlSubAuthorityCountSid (1224): 0x77a32913
RtlSubAuthoritySid (1225): 0x77a2f7de
RtlSubtreePredecessor (1226): 0x77a4fc9c
RtlSubtreeSuccessor (1227): 0x77ab2f9f
RtlSystemTimeToLocalTime (1228): 0x77aa17d4
RtlTestBit (1229): 0x77a55d6a
RtlTimeFieldsToTime (1230): 0x77a44e6a
RtlTimeToElapsedTimeFields (1231): 0x77aa16ff
RtlTimeToSecondsSince1970 (1232): 0x77a515da
RtlTimeToSecondsSince1980 (1233): 0x77a39b51
RtlTimeToTimeFields (1234): 0x77a44ad5
RtlTraceDatabaseAdd (1235): 0x77aba56f
RtlTraceDatabaseCreate (1236): 0x77aba201
RtlTraceDatabaseDestroy (1237): 0x77aba306
RtlTraceDatabaseEnumerate (1238): 0x77aba174
RtlTraceDatabaseFind (1239): 0x77aba3b9
RtlTraceDatabaseLock (1240): 0x77aba54f
RtlTraceDatabaseUnlock (1241): 0x77aba55f
RtlTraceDatabaseValidate (1242): 0x77aba36f
RtlTryAcquirePebLock (1243): 0x77a5496b
RtlTryAcquireSRWLockExclusive (1244): 0x77a41e4f
RtlTryAcquireSRWLockShared (1245): 0x77a987d2
RtlTryEnterCriticalSection (1246): 0x77a22530
RtlUTF8ToUnicodeN (1247): 0x77a3fe1c
RtlUlongByteSwap (11): 0x77a6d5e0
RtlUlonglongByteSwap (12): 0x77a6d5f0
RtlUnhandledExceptionFilter (1249): 0x77ab948a
RtlUnhandledExceptionFilter2 (1248): 0x77ab9195
RtlUnicodeStringToAnsiSize (1250): 0x77aa68ad
RtlUnicodeStringToAnsiString (1251): 0x77a26cb0
RtlUnicodeStringToCountedOemString (1252): 0x77aa6ae1
RtlUnicodeStringToInteger (1253): 0x77a462e6
RtlUnicodeStringToOemSize (1254): 0x77aa68ad
RtlUnicodeStringToOemString (1255): 0x77a5bf1d
RtlUnicodeToCustomCPN (1256): 0x77aa0857
RtlUnicodeToMultiByteN (1257): 0x77a26b16
RtlUnicodeToMultiByteSize (1258): 0x77a46184
RtlUnicodeToOemN (1259): 0x77a48d91
RtlUnicodeToUTF8N (1260): 0x77a3ffb8
RtlUniform (1261): 0x77a37833
RtlUnlockBootStatusData (1262): 0x77ab21df
RtlUnlockCurrentThread (1263): 0x77ab967c
RtlUnlockHeap (1264): 0x77a28433
RtlUnlockMemoryBlockLookaside (1265): 0x77aa6705
RtlUnlockMemoryStreamRegion (1266): 0x77a91e88
RtlUnlockMemoryZone (1267): 0x77a68957
RtlUnlockModuleSection (1268): 0x77a689eb
RtlUnwind (1269): 0x77a4b88d
RtlUpcaseUnicodeChar (1270): 0x77a1e841
RtlUpcaseUnicodeString (1271): 0x77a3388d
RtlUpcaseUnicodeStringToAnsiString (1272): 0x77aa68f9
RtlUpcaseUnicodeStringToCountedOemString (1273): 0x77aa6bf1
RtlUpcaseUnicodeStringToOemString (1274): 0x77aa69e0
RtlUpcaseUnicodeToCustomCPN (1275): 0x77aa0a07
RtlUpcaseUnicodeToMultiByteN (1276): 0x77a4dc0d
RtlUpcaseUnicodeToOemN (1277): 0x77a9fce8
RtlUpdateClonedCriticalSection (1278): 0x77a926e5
RtlUpdateClonedSRWLock (1279): 0x77a988e3
RtlUpdateTimer (1280): 0x77ad1160
RtlUpperChar (1281): 0x77a507d0
RtlUpperString (1282): 0x77aa6ecb
RtlUserThreadStart (1283): 0x77a001b4
RtlUshortByteSwap (13): 0x77a6d5d0
RtlValidAcl (1284): 0x77a2e864
RtlValidRelativeSecurityDescriptor (1285): 0x77a61be5
RtlValidSecurityDescriptor (1286): 0x77a69a46
RtlValidSid (1287): 0x77a28c42
RtlValidateHeap (1288): 0x77a51e0d
RtlValidateProcessHeaps (1289): 0x77aafb26
RtlValidateUnicodeString (1290): 0x77a1fc80
RtlVerifyVersionInfo (1291): 0x77a558ff
RtlWakeAllConditionVariable (1292): 0x77a54275
RtlWakeConditionVariable (1293): 0x77a98454
RtlWalkFrameChain (1294): 0x77a54e48
RtlWalkHeap (1295): 0x77aae688
RtlWeaklyEnumerateEntryHashTable (1296): 0x77ab1215
RtlWerpReportException (1297): 0x77a64d46
RtlWow64CallFunction64 (1298): 0x77a98253
RtlWow64EnableFsRedirection (1299): 0x77a98263
RtlWow64EnableFsRedirectionEx (1300): 0x77a692ba
RtlWow64LogMessageInEventLogger (1301): 0x77a9eb13
RtlWriteMemoryStream (1302): 0x77a91e54
RtlWriteRegistryValue (1303): 0x77aa8535
RtlZeroHeap (1304): 0x77aa5ee1
RtlZeroMemory (1305): 0x77a4b080
RtlZombifyActivationContext (1306): 0x77a9c697
RtlpApplyLengthFunction (1307): 0x77a3ed0d
RtlpCheckDynamicTimeZoneInformation (1308): 0x77a67dfd
RtlpCleanupRegistryKeys (1309): 0x77aaa94d
RtlpConvertCultureNamesToLCIDs (1310): 0x77aaa618
RtlpConvertLCIDsToCultureNames (1311): 0x77aaa3ce
RtlpCreateProcessRegistryInfo (1312): 0x77a2822b
RtlpEnsureBufferSize (1313): 0x77a3fd9d
RtlpGetLCIDFromLangInfoNode (1314): 0x77aa9748
RtlpGetNameFromLangInfoNode (1315): 0x77a39e08
RtlpGetSystemDefaultUILanguage (1316): 0x77a38806
RtlpGetUserOrMachineUILanguage4NLS (1317): 0x77abac4e
RtlpInitializeLangRegistryInfo (1318): 0x77a3accd
RtlpIsQualifiedLanguage (1319): 0x77aa9f7b
RtlpLoadMachineUIByPolicy (1320): 0x77abc6a0
RtlpLoadUserUIByPolicy (1321): 0x77a3a2c5
RtlpMuiFreeLangRegistryInfo (1322): 0x77abc209
RtlpMuiRegCreateRegistryInfo (1323): 0x77a3a269
RtlpMuiRegFreeRegistryInfo (1324): 0x77a3a4f5
RtlpMuiRegLoadRegistryInfo (1325): 0x77a3ad53
RtlpNotOwnerCriticalSection (1326): 0x77a9272d
RtlpNtCreateKey (1327): 0x77abd0ae
RtlpNtEnumerateSubKey (1328): 0x77abd1e5
RtlpNtMakeTemporaryKey (1329): 0x77abd1d5
RtlpNtOpenKey (1330): 0x77abd089
RtlpNtQueryValueKey (1331): 0x77abd0db
RtlpNtSetValueKey (1332): 0x77abd1a9
RtlpQueryDefaultUILanguage (1333): 0x77a4199f
RtlpQueryProcessDebugInformationRemote (1334): 0x77a93bd8
RtlpRefreshCachedUILanguage (1335): 0x77abb667
RtlpSetInstallLanguage (1336): 0x77aad0fa
RtlpSetPreferredUILanguages (1337): 0x77aab11d
RtlpSetUserPreferredUILanguages (1338): 0x77aab11d
RtlpUnWaitCriticalSection (1339): 0x77a2da3b
RtlpVerifyAndCommitUILanguageSettings (1340): 0x77aaa7b8
RtlpWaitForCriticalSection (1341): 0x77a92599
RtlxAnsiStringToUnicodeSize (1342): 0x77aa68d2
RtlxOemStringToUnicodeSize (1343): 0x77aa68d2
RtlxUnicodeStringToAnsiSize (1344): 0x77aa68ad
RtlxUnicodeStringToOemSize (1345): 0x77aa68ad
SbExecuteProcedure (1346): 0x77ad1835
SbSelectProcedure (1347): 0x77a2b5ca
ShipAssert (1348): 0x77a99259
ShipAssertGetBufferInfo (1349): 0x77a99348
ShipAssertMsgA (1350): 0x77a9932f
ShipAssertMsgW (1351): 0x77a9932f
TpAllocAlpcCompletion (1352): 0x77acf745
TpAllocAlpcCompletionEx (1353): 0x77a6972c
TpAllocCleanupGroup (1354): 0x77a58356
TpAllocIoCompletion (1355): 0x77a4cc1c
TpAllocPool (1356): 0x77a37cae
TpAllocTimer (1357): 0x77a40b7b
TpAllocWait (1358): 0x77a5c319
TpAllocWork (1359): 0x77a594a8
TpAlpcRegisterCompletionList (1360): 0x77acf8d9
TpAlpcUnregisterCompletionList (1361): 0x77acfb12
TpCallbackIndependent (1362): 0x77a42589
TpCallbackLeaveCriticalSectionOnCompletion (1363): 0x77ad0854
TpCallbackMayRunLong (1364): 0x77a55a93
TpCallbackReleaseMutexOnCompletion (1365): 0x77ad0738
TpCallbackReleaseSemaphoreOnCompletion (1366): 0x77ad0608
TpCallbackSetEventOnCompletion (1367): 0x77ad04ed
TpCallbackUnloadDllOnCompletion (1368): 0x77ad0980
TpCancelAsyncIoOperation (1369): 0x77a5d5e6
TpCaptureCaller (1370): 0x77a28852
TpCheckTerminateWorker (1371): 0x77a29478
TpDbgDumpHeapUsage (1372): 0x77ad0b11
TpDbgGetFreeInfo (1373): 0x77ad0ab3
TpDbgSetLogRoutine (1374): 0x77ad0a9d
TpDisablePoolCallbackChecks (1375): 0x77a3c232
TpDisassociateCallback (1376): 0x77a4369f
TpIsTimerSet (1377): 0x77a28ecb
TpPoolFreeUnusedNodes (1378): 0x77ad0038
TpPostWork (1379): 0x77a5c559
TpQueryPoolStackInformation (1380): 0x77acfdae
TpReleaseAlpcCompletion (1381): 0x77a68a5e
TpReleaseCleanupGroup (1382): 0x77a5d3b6
TpReleaseCleanupGroupMembers (1383): 0x77a60180
TpReleaseIoCompletion (1384): 0x77a5d285
TpReleasePool (1385): 0x77a4c039
TpReleaseTimer (1386): 0x77a5ca3d
TpReleaseWait (1387): 0x77a5cd2e
TpReleaseWork (1388): 0x77a5d74a
TpSetDefaultPoolMaxThreads (1389): 0x77acfecd
TpSetDefaultPoolStackInformation (1390): 0x77acff2e
TpSetPoolMaxThreads (1391): 0x77a58aa9
TpSetPoolMinThreads (1392): 0x77a58a08
TpSetPoolStackInformation (1393): 0x77a3c1fc
TpSetTimer (1394): 0x77a2c780
TpSetWait (1395): 0x77a3d0df
TpSimpleTryPost (1396): 0x77a5610e
TpStartAsyncIoOperation (1397): 0x77a587f9
TpWaitForAlpcCompletion (1398): 0x77acf769
TpWaitForIoCompletion (1399): 0x77a5d53b
TpWaitForTimer (1400): 0x77a5cbca
TpWaitForWait (1401): 0x77a5cc8f
TpWaitForWork (1402): 0x77a5d6ab
VerSetConditionMask (1403): 0x77a558be
WerReportSQMEvent (1404): 0x77a99b11
WinSqmAddToAverageDWORD (1405): 0x77a9b0f5
WinSqmAddToStream (1406): 0x77a627bb
WinSqmAddToStreamEx (1407): 0x77a5c00a
WinSqmCheckEscalationAddToStreamEx (1408): 0x77a9a5c6
WinSqmCheckEscalationSetDWORD (1410): 0x77a9a2ea
WinSqmCheckEscalationSetDWORD64 (1409): 0x77a9a3b1
WinSqmCheckEscalationSetString (1411): 0x77a9a47b
WinSqmCommonDatapointDelete (1412): 0x77a9a131
WinSqmCommonDatapointSetDWORD (1414): 0x77a9a0bb
WinSqmCommonDatapointSetDWORD64 (1413): 0x77a9a0f6
WinSqmCommonDatapointSetStreamEx (1415): 0x77a9a932
WinSqmCommonDatapointSetString (1416): 0x77a9a876
WinSqmEndSession (1417): 0x77a62bf0
WinSqmEventEnabled (1418): 0x77a4525f
WinSqmEventWrite (1419): 0x77a452c4
WinSqmGetEscalationRuleStatus (1420): 0x77a9a6f8
WinSqmGetInstrumentationProperty (1421): 0x77a9a78e
WinSqmIncrementDWORD (1422): 0x77a45445
WinSqmIsOptedIn (1423): 0x77a4078c
WinSqmIsOptedInEx (1424): 0x77a40799
WinSqmSetDWORD (1426): 0x77a582e6
WinSqmSetDWORD64 (1425): 0x77a9af85
WinSqmSetEscalationInfo (1427): 0x77a9a042
WinSqmSetIfMaxDWORD (1428): 0x77a63114
WinSqmSetIfMinDWORD (1429): 0x77a9b12d
WinSqmSetString (1430): 0x77a9ad2c
WinSqmStartSession (1431): 0x77a62cb5
ZwAcceptConnectPort (1432): 0x77a10250
ZwAccessCheck (1433): 0x77a10268
ZwAccessCheckAndAuditAlarm (1434): 0x77a0fca8
ZwAccessCheckByType (1435): 0x77a10280
ZwAccessCheckByTypeAndAuditAlarm (1436): 0x77a10154
ZwAccessCheckByTypeResultList (1437): 0x77a10298
ZwAccessCheckByTypeResultListAndAuditAlarm (1438): 0x77a102b0
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle (1439): 0x77a102c8
ZwAddAtom (1440): 0x77a0ff98
ZwAddBootEntry (1441): 0x77a102e0
ZwAddDriverEntry (1442): 0x77a102f8
ZwAdjustGroupsToken (1443): 0x77a10310
ZwAdjustPrivilegesToken (1444): 0x77a0ff00
ZwAlertResumeThread (1445): 0x77a10328
ZwAlertThread (1446): 0x77a10344
ZwAllocateLocallyUniqueId (1447): 0x77a10360
ZwAllocateReserveObject (1448): 0x77a1037c
ZwAllocateUserPhysicalPages (1449): 0x77a10394
ZwAllocateUuids (1450): 0x77a103ac
ZwAllocateVirtualMemory (1451): 0x77a0fb00
ZwAlpcAcceptConnectPort (1452): 0x77a103c8
ZwAlpcCancelMessage (1453): 0x77a103e0
ZwAlpcConnectPort (1454): 0x77a103f8
ZwAlpcCreatePort (1455): 0x77a10410
ZwAlpcCreatePortSection (1456): 0x77a10428
ZwAlpcCreateResourceReserve (1457): 0x77a10440
ZwAlpcCreateSectionView (1458): 0x77a10458
ZwAlpcCreateSecurityContext (1459): 0x77a10470
ZwAlpcDeletePortSection (1460): 0x77a10488
ZwAlpcDeleteResourceReserve (1461): 0x77a104a0
ZwAlpcDeleteSectionView (1462): 0x77a104b8
ZwAlpcDeleteSecurityContext (1463): 0x77a104d0
ZwAlpcDisconnectPort (1464): 0x77a104e8
ZwAlpcImpersonateClientOfPort (1465): 0x77a10500
ZwAlpcOpenSenderProcess (1466): 0x77a10518
ZwAlpcOpenSenderThread (1467): 0x77a10530
ZwAlpcQueryInformation (1468): 0x77a10548
ZwAlpcQueryInformationMessage (1469): 0x77a10560
ZwAlpcRevokeSecurityContext (1470): 0x77a10578
ZwAlpcSendWaitReceivePort (1471): 0x77a10590
ZwAlpcSetInformation (1472): 0x77a105a8
ZwApphelpCacheControl (1473): 0x77a10014
ZwAreMappedFilesTheSame (1474): 0x77a105c0
ZwAssignProcessToJobObject (1475): 0x77a105dc
ZwCallbackReturn (1476): 0x77a0f918
ZwCancelIoFile (1477): 0x77a101bc
ZwCancelIoFileEx (1478): 0x77a105f8
ZwCancelSynchronousIoFile (1479): 0x77a10610
ZwCancelTimer (1480): 0x77a1021c
ZwClearEvent (1481): 0x77a0feb4
ZwClose (1482): 0x77a0fa20
ZwCloseObjectAuditAlarm (1483): 0x77a0fe6c
ZwCommitComplete (1484): 0x77a10628
ZwCommitEnlistment (1485): 0x77a10640
ZwCommitTransaction (1486): 0x77a10658
ZwCompactKeys (1487): 0x77a10670
ZwCompareTokens (1488): 0x77a10688
ZwCompleteConnectPort (1489): 0x77a106a0
ZwCompressKey (1490): 0x77a106b8
ZwConnectPort (1491): 0x77a106d4
ZwContinue (1492): 0x77a0ff30
ZwCreateDebugObject (1493): 0x77a106ec
ZwCreateDirectoryObject (1494): 0x77a10704
ZwCreateEnlistment (1495): 0x77a1071c
ZwCreateEvent (1496): 0x77a0ffb4
ZwCreateEventPair (1497): 0x77a10734
ZwCreateFile (1498): 0x77a100f4
ZwCreateIoCompletion (1499): 0x77a1074c
ZwCreateJobObject (1500): 0x77a10764
ZwCreateJobSet (1501): 0x77a1077c
ZwCreateKey (1502): 0x77a0fb80
ZwCreateKeyTransacted (1503): 0x77a10794
ZwCreateKeyedEvent (1504): 0x77a107ac
ZwCreateMailslotFile (1505): 0x77a107c4
ZwCreateMutant (1506): 0x77a107dc
ZwCreateNamedPipeFile (1507): 0x77a107f4
ZwCreatePagingFile (1508): 0x77a1080c
ZwCreatePort (1509): 0x77a10824
ZwCreatePrivateNamespace (1510): 0x77a1083c
ZwCreateProcess (1511): 0x77a10854
ZwCreateProcessEx (1512): 0x77a1002c
ZwCreateProfile (1513): 0x77a1086c
ZwCreateProfileEx (1514): 0x77a10884
ZwCreateResourceManager (1515): 0x77a1089c
ZwCreateSection (1516): 0x77a0ffe4
ZwCreateSemaphore (1517): 0x77a108b4
ZwCreateSymbolicLinkObject (1518): 0x77a108cc
ZwCreateThread (1519): 0x77a10044
ZwCreateThreadEx (1520): 0x77a108e4
ZwCreateTimer (1521): 0x77a108fc
ZwCreateToken (1522): 0x77a10914
ZwCreateTransaction (1523): 0x77a1092c
ZwCreateTransactionManager (1524): 0x77a10944
ZwCreateUserProcess (1525): 0x77a1095c
ZwCreateWaitablePort (1526): 0x77a10974
ZwCreateWorkerFactory (1527): 0x77a1098c
ZwDebugActiveProcess (1528): 0x77a109a4
ZwDebugContinue (1529): 0x77a109c0
ZwDelayExecution (1530): 0x77a0fdbc
ZwDeleteAtom (1531): 0x77a109d8
ZwDeleteBootEntry (1532): 0x77a109f4
ZwDeleteDriverEntry (1533): 0x77a10a0c
ZwDeleteFile (1534): 0x77a10a24
ZwDeleteKey (1535): 0x77a10a3c
ZwDeleteObjectAuditAlarm (1536): 0x77a10a54
ZwDeletePrivateNamespace (1537): 0x77a10a6c
ZwDeleteValueKey (1538): 0x77a10a84
ZwDeviceIoControlFile (1539): 0x77a0f94c
ZwDisableLastKnownGood (1540): 0x77a10a9c
ZwDisplayString (1541): 0x77a10ab4
ZwDrawText (1542): 0x77a10acc
ZwDuplicateObject (1543): 0x77a0fe84
ZwDuplicateToken (1544): 0x77a0ff18
ZwEnableLastKnownGood (1545): 0x77a10ae4
ZwEnumerateBootEntries (1546): 0x77a10afc
ZwEnumerateDriverEntries (1547): 0x77a10b14
ZwEnumerateKey (1548): 0x77a0fd8c
ZwEnumerateSystemEnvironmentValuesEx (1549): 0x77a10b2c
ZwEnumerateTransactionObject (1550): 0x77a10b44
ZwEnumerateValueKey (1551): 0x77a0fa80
ZwExtendSection (1552): 0x77a10b5c
ZwFilterToken (1553): 0x77a10b74
ZwFindAtom (1554): 0x77a0fa98
ZwFlushBuffersFile (1555): 0x77a0fffc
ZwFlushInstallUILanguage (1556): 0x77a10b8c
ZwFlushInstructionCache (1557): 0x77a10ba4
ZwFlushKey (1558): 0x77a10bc0
ZwFlushProcessWriteBuffers (1559): 0x77a10bdc
ZwFlushVirtualMemory (1560): 0x77a10bf4
ZwFlushWriteBuffer (1561): 0x77a10c0c
ZwFreeUserPhysicalPages (1562): 0x77a10c28
ZwFreeVirtualMemory (1563): 0x77a0fb98
ZwFreezeRegistry (1564): 0x77a10c40
ZwFreezeTransactions (1565): 0x77a10c58
ZwFsControlFile (1566): 0x77a0fe38
ZwGetContextThread (1567): 0x77a10c70
ZwGetCurrentProcessorNumber (1568): 0x77a10c88
ZwGetDevicePowerState (1569): 0x77a10ca4
ZwGetMUIRegistryInfo (1570): 0x77a10cc0
ZwGetNextProcess (1571): 0x77a10cd8
ZwGetNextThread (1572): 0x77a10cf0
ZwGetNlsSectionPtr (1573): 0x77a10d08
ZwGetNotificationResourceManager (1574): 0x77a10d20
ZwGetPlugPlayEvent (1575): 0x77a10d38
ZwGetWriteWatch (1576): 0x77a10d50
ZwImpersonateAnonymousToken (1577): 0x77a10d68
ZwImpersonateClientOfPort (1578): 0x77a0fbb0
ZwImpersonateThread (1579): 0x77a10d84
ZwInitializeNlsFiles (1580): 0x77a10d9c
ZwInitializeRegistry (1581): 0x77a10db4
ZwInitiatePowerAction (1582): 0x77a10dcc
ZwIsProcessInJob (1583): 0x77a1005c
ZwIsSystemResumeAutomatic (1584): 0x77a10de8
ZwIsUILanguageComitted (1585): 0x77a10e04
ZwListenPort (1586): 0x77a10e1c
ZwLoadDriver (1587): 0x77a10e34
ZwLoadKey (1589): 0x77a10e4c
ZwLoadKey2 (1588): 0x77a10e64
ZwLoadKeyEx (1590): 0x77a10e7c
ZwLockFile (1591): 0x77a10e94
ZwLockProductActivationKeys (1592): 0x77a10eac
ZwLockRegistryKey (1593): 0x77a10ec8
ZwLockVirtualMemory (1594): 0x77a10ee4
ZwMakePermanentObject (1595): 0x77a10efc
ZwMakeTemporaryObject (1596): 0x77a10f18
ZwMapCMFModule (1597): 0x77a10f34
ZwMapUserPhysicalPages (1598): 0x77a10f4c
ZwMapUserPhysicalPagesScatter (1599): 0x77a0f8e0
ZwMapViewOfSection (1600): 0x77a0fc90
ZwModifyBootEntry (1601): 0x77a10f68
ZwModifyDriverEntry (1602): 0x77a10f80
ZwNotifyChangeDirectoryFile (1603): 0x77a10f98
ZwNotifyChangeKey (1604): 0x77a10fb0
ZwNotifyChangeMultipleKeys (1605): 0x77a10fc8
ZwNotifyChangeSession (1606): 0x77a10fe0
ZwOpenDirectoryObject (1607): 0x77a1013c
ZwOpenEnlistment (1608): 0x77a10ff8
ZwOpenEvent (1609): 0x77a0fee8
ZwOpenEventPair (1610): 0x77a11010
ZwOpenFile (1611): 0x77a0fda4
ZwOpenIoCompletion (1612): 0x77a11028
ZwOpenJobObject (1613): 0x77a11040
ZwOpenKey (1614): 0x77a0fa68
ZwOpenKeyEx (1615): 0x77a11058
ZwOpenKeyTransacted (1616): 0x77a11070
ZwOpenKeyTransactedEx (1617): 0x77a11088
ZwOpenKeyedEvent (1618): 0x77a110a0
ZwOpenMutant (1619): 0x77a110b8
ZwOpenObjectAuditAlarm (1620): 0x77a110d0
ZwOpenPrivateNamespace (1621): 0x77a110e8
ZwOpenProcess (1622): 0x77a0fc60
ZwOpenProcessToken (1623): 0x77a11100
ZwOpenProcessTokenEx (1624): 0x77a0fd58
ZwOpenResourceManager (1625): 0x77a11118
ZwOpenSection (1626): 0x77a0fe08
ZwOpenSemaphore (1627): 0x77a11130
ZwOpenSession (1628): 0x77a11148
ZwOpenSymbolicLinkObject (1629): 0x77a11160
ZwOpenThread (1630): 0x77a11178
ZwOpenThreadToken (1631): 0x77a0fc30
ZwOpenThreadTokenEx (1632): 0x77a0fd40
ZwOpenTimer (1633): 0x77a11190
ZwOpenTransaction (1634): 0x77a111a8
ZwOpenTransactionManager (1635): 0x77a111c0
ZwPlugPlayControl (1636): 0x77a111d8
ZwPowerInformation (1637): 0x77a101ec
ZwPrePrepareComplete (1638): 0x77a111f0
ZwPrePrepareEnlistment (1639): 0x77a11208
ZwPrepareComplete (1640): 0x77a11220
ZwPrepareEnlistment (1641): 0x77a11238
ZwPrivilegeCheck (1642): 0x77a11250
ZwPrivilegeObjectAuditAlarm (1643): 0x77a1126c
ZwPrivilegedServiceAuditAlarm (1644): 0x77a11284
ZwPropagationComplete (1645): 0x77a1129c
ZwPropagationFailed (1646): 0x77a112b4
ZwProtectVirtualMemory (1647): 0x77a10078
ZwPulseEvent (1648): 0x77a112cc
ZwQueryAttributesFile (1649): 0x77a0fe9c
ZwQueryBootEntryOrder (1650): 0x77a112e8
ZwQueryBootOptions (1651): 0x77a11300
ZwQueryDebugFilterState (1652): 0x77a11318
ZwQueryDefaultLocale (1653): 0x77a0fab4
ZwQueryDefaultUILanguage (1654): 0x77a0ff48
ZwQueryDirectoryFile (1655): 0x77a0fdd8
ZwQueryDirectoryObject (1656): 0x77a11334
ZwQueryDriverEntryOrder (1657): 0x77a1134c
ZwQueryEaFile (1658): 0x77a11364
ZwQueryEvent (1659): 0x77a1010c
ZwQueryFullAttributesFile (1660): 0x77a1137c
ZwQueryInformationAtom (1661): 0x77a11394
ZwQueryInformationEnlistment (1662): 0x77a113ac
ZwQueryInformationFile (1663): 0x77a0fa50
ZwQueryInformationJobObject (1664): 0x77a113c4
ZwQueryInformationPort (1665): 0x77a113dc
ZwQueryInformationProcess (1666): 0x77a0fb18
ZwQueryInformationResourceManager (1667): 0x77a113f4
ZwQueryInformationThread (1668): 0x77a0fc48
ZwQueryInformationToken (1669): 0x77a0fbe8
ZwQueryInformationTransaction (1670): 0x77a1140c
ZwQueryInformationTransactionManager (1671): 0x77a11424
ZwQueryInformationWorkerFactory (1672): 0x77a1143c
ZwQueryInstallUILanguage (1673): 0x77a11454
ZwQueryIntervalProfile (1674): 0x77a11470
ZwQueryIoCompletion (1675): 0x77a1148c
ZwQueryKey (1676): 0x77a0fad0
ZwQueryLicenseValue (1677): 0x77a114a4
ZwQueryMultipleValueKey (1678): 0x77a114bc
ZwQueryMutant (1679): 0x77a114d4
ZwQueryObject (1680): 0x77a0fa38
ZwQueryOpenSubKeys (1681): 0x77a114ec
ZwQueryOpenSubKeysEx (1682): 0x77a11504
ZwQueryPerformanceCounter (1683): 0x77a0fd70
ZwQueryPortInformationProcess (1684): 0x77a1151c
ZwQueryQuotaInformationFile (1685): 0x77a11538
ZwQuerySection (1686): 0x77a10090
ZwQuerySecurityAttributesToken (1687): 0x77a11550
ZwQuerySecurityObject (1688): 0x77a11568
ZwQuerySemaphore (1689): 0x77a11580
ZwQuerySymbolicLinkObject (1690): 0x77a11598
ZwQuerySystemEnvironmentValue (1691): 0x77a115b0
ZwQuerySystemEnvironmentValueEx (1692): 0x77a115c8
ZwQuerySystemInformation (1693): 0x77a0fdf0
ZwQuerySystemInformationEx (1694): 0x77a115e0
ZwQuerySystemTime (1695): 0x77a1016c
ZwQueryTimer (1696): 0x77a0fe20
ZwQueryTimerResolution (1697): 0x77a115f8
ZwQueryValueKey (1698): 0x77a0fae8
ZwQueryVirtualMemory (1699): 0x77a0fc18
ZwQueryVolumeInformationFile (1700): 0x77a0ffcc
ZwQueueApcThread (1701): 0x77a0ff64
ZwQueueApcThreadEx (1702): 0x77a11614
ZwRaiseException (1703): 0x77a1162c
ZwRaiseHardError (1704): 0x77a11644
ZwReadFile (1705): 0x77a0f930
ZwReadFileScatter (1706): 0x77a0fd24
ZwReadOnlyEnlistment (1707): 0x77a1165c
ZwReadRequestData (1708): 0x77a100dc
ZwReadVirtualMemory (1709): 0x77a0fed0
ZwRecoverEnlistment (1710): 0x77a11674
ZwRecoverResourceManager (1711): 0x77a1168c
ZwRecoverTransactionManager (1712): 0x77a116a4
ZwRegisterProtocolAddressInformation (1713): 0x77a116bc
ZwRegisterThreadTerminatePort (1714): 0x77a116d4
ZwReleaseKeyedEvent (1715): 0x77a116f0
ZwReleaseMutant (1716): 0x77a0fbcc
ZwReleaseSemaphore (1717): 0x77a0f9a0
ZwReleaseWorkerFactoryWorker (1718): 0x77a1170c
ZwRemoveIoCompletion (1719): 0x77a0f984
ZwRemoveIoCompletionEx (1720): 0x77a11724
ZwRemoveProcessDebug (1721): 0x77a1173c
ZwRenameKey (1722): 0x77a11758
ZwRenameTransactionManager (1723): 0x77a11770
ZwReplaceKey (1724): 0x77a11788
ZwReplacePartitionUnit (1725): 0x77a117a0
ZwReplyPort (1726): 0x77a0f9d4
ZwReplyWaitReceivePort (1727): 0x77a0f9bc
ZwReplyWaitReceivePortEx (1728): 0x77a0fcd8
ZwReplyWaitReplyPort (1729): 0x77a117b8
ZwRequestPort (1730): 0x77a117d0
ZwRequestWaitReplyPort (1731): 0x77a0fc00
ZwResetEvent (1732): 0x77a117e8
ZwResetWriteWatch (1733): 0x77a11804
ZwRestoreKey (1734): 0x77a11820
ZwResumeProcess (1735): 0x77a11838
ZwResumeThread (1736): 0x77a100a8
ZwRollbackComplete (1737): 0x77a11854
ZwRollbackEnlistment (1738): 0x77a1186c
ZwRollbackTransaction (1739): 0x77a11884
ZwRollforwardTransactionManager (1740): 0x77a1189c
ZwSaveKey (1741): 0x77a118b4
ZwSaveKeyEx (1742): 0x77a118cc
ZwSaveMergedKeys (1743): 0x77a118e4
ZwSecureConnectPort (1744): 0x77a11900
ZwSerializeBoot (1745): 0x77a11918
ZwSetBootEntryOrder (1746): 0x77a11930
ZwSetBootOptions (1747): 0x77a11948
ZwSetContextThread (1748): 0x77a11960
ZwSetDebugFilterState (1749): 0x77a11978
ZwSetDefaultHardErrorPort (1750): 0x77a11994
ZwSetDefaultLocale (1751): 0x77a119b0
ZwSetDefaultUILanguage (1752): 0x77a119cc
ZwSetDriverEntryOrder (1753): 0x77a119e8
ZwSetEaFile (1754): 0x77a11a00
ZwSetEvent (1755): 0x77a0fa04
ZwSetEventBoostPriority (1756): 0x77a0fd08
ZwSetHighEventPair (1757): 0x77a11a18
ZwSetHighWaitLowEventPair (1758): 0x77a11a34
ZwSetInformationDebugObject (1759): 0x77a11a50
ZwSetInformationEnlistment (1760): 0x77a11a68
ZwSetInformationFile (1761): 0x77a0fc78
ZwSetInformationJobObject (1762): 0x77a11a80
ZwSetInformationKey (1763): 0x77a11a98
ZwSetInformationObject (1764): 0x77a101a4
ZwSetInformationProcess (1765): 0x77a0fb68
ZwSetInformationResourceManager (1766): 0x77a11ab0
ZwSetInformationThread (1767): 0x77a0f9ec
ZwSetInformationToken (1768): 0x77a11ac8
ZwSetInformationTransaction (1769): 0x77a11ae0
ZwSetInformationTransactionManager (1770): 0x77a11af8
ZwSetInformationWorkerFactory (1771): 0x77a11b10
ZwSetIntervalProfile (1772): 0x77a11b28
ZwSetIoCompletion (1773): 0x77a11b44
ZwSetIoCompletionEx (1774): 0x77a11b5c
ZwSetLdtEntries (1775): 0x77a11b74
ZwSetLowEventPair (1776): 0x77a11b8c
ZwSetLowWaitHighEventPair (1777): 0x77a11ba8
ZwSetQuotaInformationFile (1778): 0x77a11bc4
ZwSetSecurityObject (1779): 0x77a11bdc
ZwSetSystemEnvironmentValue (1780): 0x77a11bf4
ZwSetSystemEnvironmentValueEx (1781): 0x77a11c0c
ZwSetSystemInformation (1782): 0x77a11c24
ZwSetSystemPowerState (1783): 0x77a11c3c
ZwSetSystemTime (1784): 0x77a11c54
ZwSetThreadExecutionState (1785): 0x77a11c70
ZwSetTimer (1786): 0x77a10238
ZwSetTimerEx (1787): 0x77a11c8c
ZwSetTimerResolution (1788): 0x77a11ca4
ZwSetUuidSeed (1789): 0x77a11cc0
ZwSetValueKey (1790): 0x77a10204
ZwSetVolumeInformationFile (1791): 0x77a11cdc
ZwShutdownSystem (1792): 0x77a11cf4
ZwShutdownWorkerFactory (1793): 0x77a11d10
ZwSignalAndWaitForSingleObject (1794): 0x77a11d28
ZwSinglePhaseReject (1795): 0x77a11d44
ZwStartProfile (1796): 0x77a11d5c
ZwStopProfile (1797): 0x77a11d78
ZwSuspendProcess (1798): 0x77a11d94
ZwSuspendThread (1799): 0x77a11db0
ZwSystemDebugControl (1800): 0x77a11dcc
ZwTerminateJobObject (1801): 0x77a11de4
ZwTerminateProcess (1802): 0x77a0fcf0
ZwTerminateThread (1803): 0x77a100c4
ZwTestAlert (1804): 0x77a11e00
ZwThawRegistry (1805): 0x77a11e1c
ZwThawTransactions (1806): 0x77a11e34
ZwTraceControl (1807): 0x77a11e4c
ZwTraceEvent (1808): 0x77a101d4
ZwTranslateFilePath (1809): 0x77a11e64
ZwUmsThreadYield (1810): 0x77a11e80
ZwUnloadDriver (1811): 0x77a11e98
ZwUnloadKey (1813): 0x77a11eb0
ZwUnloadKey2 (1812): 0x77a11ec8
ZwUnloadKeyEx (1814): 0x77a11ee0
ZwUnlockFile (1815): 0x77a11ef8
ZwUnlockVirtualMemory (1816): 0x77a11f10
ZwUnmapViewOfSection (1817): 0x77a0fcc0
ZwVdmControl (1818): 0x77a11f28
ZwWaitForDebugEvent (1819): 0x77a11f40
ZwWaitForKeyedEvent (1820): 0x77a11f58
ZwWaitForMultipleObjects (1822): 0x77a10188
ZwWaitForMultipleObjects32 (1821): 0x77a0fb30
ZwWaitForSingleObject (1823): 0x77a0f8fc
ZwWaitForWorkViaWorkerFactory (1824): 0x77a11f74
ZwWaitHighEventPair (1825): 0x77a11f8c
ZwWaitLowEventPair (1826): 0x77a11fa8
ZwWorkerFactoryWorkerReady (1827): 0x77a11fc4
ZwWow64CallFunction64 (1828): 0x77a1218c
ZwWow64CsrAllocateCaptureBuffer (1829): 0x77a12024
ZwWow64CsrAllocateMessagePointer (1830): 0x77a12054
ZwWow64CsrCaptureMessageBuffer (1831): 0x77a1206c
ZwWow64CsrCaptureMessageString (1832): 0x77a12084
ZwWow64CsrClientCallServer (1833): 0x77a1200c
ZwWow64CsrClientConnectToServer (1834): 0x77a11fdc
ZwWow64CsrFreeCaptureBuffer (1835): 0x77a1203c
ZwWow64CsrGetProcessId (1836): 0x77a1209c
ZwWow64CsrIdentifyAlertableThread (1837): 0x77a11ff4
ZwWow64CsrVerifyRegion (1838): 0x77a120b4
ZwWow64DebuggerCall (1839): 0x77a120cc
ZwWow64GetCurrentProcessorNumberEx (1840): 0x77a120e4
ZwWow64GetNativeSystemInformation (1841): 0x77a120fc
ZwWow64InterlockedPopEntrySList (1842): 0x77a12114
ZwWow64QueryInformationProcess64 (1843): 0x77a1212c
ZwWow64QueryVirtualMemory64 (1844): 0x77a12174
ZwWow64ReadVirtualMemory64 (1845): 0x77a12144
ZwWow64WriteVirtualMemory64 (1846): 0x77a1215c
ZwWriteFile (1847): 0x77a0f968
ZwWriteFileGather (1848): 0x77a0fb4c
ZwWriteRequestData (1849): 0x77a10124
ZwWriteVirtualMemory (1850): 0x77a0fe54
ZwYieldExecution (1851): 0x77a0ff7c
_CIcos (1852): 0x77a6b884
_CIlog (1853): 0x77a6b944
_CIpow (1854): 0x77a6ba24
_CIsin (1855): 0x77a6bc44
_CIsqrt (1856): 0x77a6bd00
__isascii (1857): 0x77a5150a
__iscsym (1858): 0x77ac4b64
__iscsymf (1859): 0x77ac4b9c
__toascii (1860): 0x77ac4b52
_alldiv (1861): 0x77a55340
_alldvrm (1862): 0x77a6bdc0
_allmul (1863): 0x77a2dfe0
_alloca_probe (1864): 0x77a2ba48
_alloca_probe_16 (1865): 0x77a6bea0
_alloca_probe_8 (1866): 0x77a6beb6
_allrem (1867): 0x77a6bf00
_allshl (1868): 0x77a24740
_allshr (1869): 0x77a28690
_atoi64 (1870): 0x77ac4bd3
_aulldiv (1871): 0x77a337c0
_aulldvrm (1872): 0x77a1f8b0
_aullrem (1873): 0x77a31bd0
_aullshr (1874): 0x77a228c0
_chkstk (1875): 0x77a2ba48
_fltused (1876): 0x77af4330
_ftol (1877): 0x77a6bfc0
_i64toa (1878): 0x77ac4c26
_i64toa_s (1879): 0x77ac8103
_i64tow (1880): 0x77ac4d31
_i64tow_s (1881): 0x77ac82ca
_itoa (1882): 0x77a523d6
_itoa_s (1883): 0x77ac7f73
_itow (1884): 0x77ac4cb7
_itow_s (1885): 0x77a6822d
_lfind (1886): 0x77ac4d69
_ltoa (1887): 0x77ac4bfa
_ltoa_s (1888): 0x77ac7fa4
_ltow (1889): 0x77ac4ce6
_ltow_s (1890): 0x77ac8161
_makepath_s (1891): 0x77ac8328
_memccpy (1892): 0x77a6c000
_memicmp (1893): 0x77ac4df0
_snprintf (1894): 0x77ac4e00
_snprintf_s (1895): 0x77ac84aa
_snscanf_s (1896): 0x77ac84ce
_snwprintf (1897): 0x77a22447
_snwprintf_s (1898): 0x77ac85a4
_snwscanf_s (1899): 0x77ac85c8
_splitpath (1900): 0x77ac5097
_splitpath_s (1901): 0x77ac8602
_strcmpi (1902): 0x77a2f5d7
_stricmp (1903): 0x77a2f5d7
_strlwr (1904): 0x77ac50e8
_strnicmp (1905): 0x77a3d7c7
_strnset_s (1906): 0x77ac8800
_strset_s (1907): 0x77ac8874
_strupr (1908): 0x77ac5115
_swprintf (1909): 0x77ac5bad
_ui64toa (1910): 0x77a63572
_ui64toa_s (1911): 0x77ac813d
_ui64tow (1912): 0x77a68ba7
_ui64tow_s (1913): 0x77ac8304
_ultoa (1914): 0x77a63553
_ultoa_s (1915): 0x77ac7fd2
_ultow (1916): 0x77ac4d12
_ultow_s (1917): 0x77ac818d
_vscwprintf (1918): 0x77a6255f
_vsnprintf (1919): 0x77a57b2d
_vsnprintf_s (1920): 0x77ac8411
_vsnwprintf (1921): 0x77a3459c
_vsnwprintf_s (1922): 0x77ac8508
_vswprintf (1923): 0x77ac51ec
_wcsicmp (1924): 0x77a28ce7
_wcslwr (1925): 0x77ac520b
_wcsnicmp (1926): 0x77a1f663
_wcsnset_s (1927): 0x77ac525a
_wcsset_s (1928): 0x77ac52d8
_wcstoui64 (1929): 0x77ac55d4
_wcsupr (1930): 0x77ac55f3
_wmakepath_s (1931): 0x77ac88c3
_wsplitpath_s (1932): 0x77ac89de
_wtoi (1933): 0x77a6a6d9
_wtoi64 (1934): 0x77ac562b
_wtol (1935): 0x77a6a4c5
abs (1936): 0x77ac577b
atan (1937): 0x77a6c060
atoi (1938): 0x77a52403
atol (1939): 0x77a52410
bsearch (1940): 0x77a1ec04
ceil (1941): 0x77a6c140
cos (1942): 0x77a6b880
fabs (1943): 0x77ac5652
floor (1944): 0x77a6c280
isalnum (1945): 0x77ac4ab8
isalpha (1946): 0x77a56c16
iscntrl (1947): 0x77ac4b2d
isdigit (1948): 0x77a514e5
isgraph (1949): 0x77ac4b06
islower (1950): 0x77ac4a49
isprint (1951): 0x77ac4adf
ispunct (1952): 0x77ac4a93
isspace (1953): 0x77ac4a6e
isupper (1954): 0x77ac4a24
iswalpha (1955): 0x77a4185c
iswctype (1956): 0x77a4182d
iswdigit (1957): 0x77a456b1
iswlower (1958): 0x77ac5730
iswspace (1959): 0x77ac5763
iswxdigit (1960): 0x77ac5748
isxdigit (1961): 0x77a518ab
labs (1962): 0x77ac577b
log (1963): 0x77a6b940
mbstowcs (1964): 0x77a6102c
memchr (1965): 0x77a6c3d0
memcmp (1966): 0x77a22295
memcpy (1967): 0x77a12370
memcpy_s (1968): 0x77ac8c0c
memmove (1969): 0x77a28900
memmove_s (1970): 0x77ac8c8a
memset (1971): 0x77a1df30
pow (1972): 0x77a6ba20
qsort (1973): 0x77ac5831
sin (1974): 0x77a6bc40
sprintf (1975): 0x77ac5a63
sprintf_s (1976): 0x77ac8d3f
sqrt (1977): 0x77a6bd14
sscanf (1978): 0x77ac5b47
sscanf_s (1979): 0x77ac8d60
strcat (1980): 0x77a6c490
strcat_s (1981): 0x77a6959e
strchr (1982): 0x77a29620
strcmp (1983): 0x77a6c580
strcpy (1984): 0x77a6c480
strcpy_s (1985): 0x77a695fc
strcspn (1986): 0x77a6c640
strlen (1987): 0x77a6c690
strncat (1988): 0x77a6c720
strncat_s (1989): 0x77ac8da9
strncmp (1990): 0x77a4a3d8
strncpy (1991): 0x77a61940
strncpy_s (1992): 0x77a6a007
strnlen (1993): 0x77ac5b6c
strpbrk (1994): 0x77a6c860
strrchr (1995): 0x77a6c8c0
strspn (1996): 0x77a6c900
strstr (1997): 0x77a6c950
strtok_s (1998): 0x77ac8e86
strtol (1999): 0x77a51b4a
strtoul (2000): 0x77ac5b8e
swprintf (2001): 0x77ac5bad
swprintf_s (2002): 0x77a3fbbf
swscanf_s (2003): 0x77ac8f6e
tan (2004): 0x77a6ca00
tolower (2005): 0x77ac5c3f
toupper (2006): 0x77a4d745
towlower (2007): 0x77ac5c6c
towupper (2008): 0x77ac5c8f
vDbgPrintEx (2009): 0x77a9dae0
vDbgPrintExWithPrefix (2010): 0x77a9db06
vsprintf (2011): 0x77ac5d1b
vsprintf_s (2012): 0x77ac8ced
vswprintf_s (2013): 0x77a3fbe0
wcscat (2014): 0x77ac5d3a
wcscat_s (2015): 0x77a4d4fa
wcschr (2016): 0x77a28295
wcscmp (2017): 0x77a224f4
wcscpy (2018): 0x77ac5d6d
wcscpy_s (2019): 0x77a2a040
wcscspn (2020): 0x77a6a211
wcslen (2021): 0x77ac5d91
wcsncat (2022): 0x77ac5db0
wcsncat_s (2023): 0x77a53588
wcsncmp (2024): 0x77a282ee
wcsncpy (2025): 0x77ac5df5
wcsncpy_s (2026): 0x77a69ea3
wcsnlen (2027): 0x77ac5e44
wcspbrk (2028): 0x77a33979
wcsrchr (2029): 0x77a28262
wcsspn (2030): 0x77ac5e68
wcsstr (2031): 0x77a20cb7
wcstol (2032): 0x77a4fc42
wcstombs (2033): 0x77ac5ed5
wcstoul (2034): 0x77ac5eb6

Hello,

I have an application that injects a dll using manual mapping. How would i prevent people from hooking WriteProcessMemory in my application and dumping the buffer of WriteProcessMemory and so getting the data im writing?

In relation to the thread I posted at http://www.rohitab.com/discuss/topic/42297-modified-function-in-memory-only-executes-modified-function-if-called-via-a-pointer/, I'm working on the encrypting side. When compiled it will take in (as arguments) a file path, a byte pattern ("\x90\x32\x49\xF3"), a mask ("x?xx"), a function size, and a xorCode. Right now if I hard code the byte pattern it works fine, but if I try to take it in as an argument, it takes the string literally as "\\x90\\x32\\x49\\xF3", which means my byte scan doesn't work properly. How would I go about making it take the hex values, and not the literal string I'm getting?

Hello rohitabs

This is a general question in every programming language that can get the user key presses on the keyboard.

So what i would like to ask is this.

When i press my keyboard letters and symbols it shows my letters on screen according to my language preferences so A in english will show A, in chinese will show the appropiate letter that describes A in their language etc. etc.

How can i get the same result for every language for A keyboard press, back to my app so i can have a full table of keycodes of each keyboard letter and symbol ?

Is this the ascii code i am looking for ? something else ?

Anyone knows ?

int privileges(){
  HANDLE Token;
  TOKEN_PRIVILEGES tp;
  if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&Token))
  {
	LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
	tp.PrivilegeCount = 1;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		if (AdjustTokenPrivileges(Token, 0, &tp, sizeof(tp), NULL, NULL)==0){
   		 return 1; //FAIL
		}else{
   		 return 0; //SUCCESS
		}
   }	  
   return 1;
}

DWORD getPid(string procName){
   HANDLE hsnap;
   PROCESSENTRY32 pt;
   hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
   pt.dwSize = sizeof(PROCESSENTRY32);
   do{
		  if(!strcmp(pt.szExeFile, procName.c_str())){
			 DWORD pid = pt.th32ProcessID;
			 CloseHandle(hsnap);
			 return pid;
		  }
   } while(Process32Next(hsnap, &pt));
   CloseHandle(hsnap);
   return 0;		  
}

#include <windows.h>
#include <iostream>
#include <fstream>
#include <stdlib.h>
#include <tlhelp32.h>

typedef int (WINAPI* MsgBoxParam)(HWND, LPCSTR, LPCSTR, UINT);
using namespace std;

struct PARAMETERS{
		  DWORD MessageBoxInj;
		  char text[50];		
		  char caption[25];
		  int buttons;
//		  HWND handle;
};

DWORD getPid(string procName);
int privileges();
DWORD myFunc(PARAMETERS * myparam); //(if you use Dev-C++ put static before DWORD)
DWORD Useless(); ////(if you use Dev-C++ put static before DWORD)

int main()
{
  privileges();  

  DWORD pid = getPid("notepad.exe");
  if (pid==0) return 1; //error

   HANDLE p;
   p = OpenProcess(PROCESS_ALL_ACCESS,false,pid);
   if (p==NULL) return 1; //error

   char * mytext = "Hello by CodeCave!";
   char * mycaption = "Injection result";

   PARAMETERS data;	  //let's fill in a PARAMETERS struct
   HMODULE user32 = LoadLibrary("User32.dll");
   data.MessageBoxInj = (DWORD)GetProcAddress(user32, "MessageBoxA");
   strcpy(data.text, mytext);
   strcpy(data.caption, mycaption);
   data.buttons = MB_OKCANCEL | MB_ICONQUESTION;


   DWORD size_myFunc = (PBYTE)Useless - (PBYTE)myFunc;  //this gets myFunc's size


   //--------now we are ready to inject


   LPVOID MyFuncAddress = VirtualAllocEx(p, NULL, size_myFunc, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE);

   WriteProcessMemory(p, MyFuncAddress, (void*)myFunc,size_myFunc, NULL);

	
   LPVOID DataAddress = VirtualAllocEx(p,NULL,sizeof(PARAMETERS),MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE);

   WriteProcessMemory(p, DataAddress, &data, sizeof(PARAMETERS), NULL);

   HANDLE thread = CreateRemoteThread(p, NULL, 0, (LPTHREAD_START_ROUTINE)MyFuncAddress, DataAddress, 0, NULL);
	
	if (thread!=0){
		//injection completed, not we can wait it to end and free the memory
		WaitForSingleObject(thread, INFINITE);   //this waits untill thread thread has finished
		VirtualFree(MyFuncAddress, 0, MEM_RELEASE); //free myFunc memory
		VirtualFree(DataAddress, 0, MEM_RELEASE); //free data memory
		CloseHandle(thread);
		CloseHandle(p);  //don't wait for the thread to finish, just close the handle to the process
		cout<<"Injection completed!"<<endl;
	 }else{
   				   cout<<"Error!"<<endl;
	 }

	
	system("PAUSE");
	return EXIT_SUCCESS;
}

DWORD getPid(string procName){
   HANDLE hsnap;
   PROCESSENTRY32 pt;
   hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
   pt.dwSize = sizeof(PROCESSENTRY32);
   do{
		  if(!strcmp(pt.szExeFile, procName.c_str())){
			 DWORD pid = pt.th32ProcessID;
			 CloseHandle(hsnap);
			 return pid;
		  }
   } while(Process32Next(hsnap, &pt));
   CloseHandle(hsnap);
   return 0;		  
}

static DWORD myFunc(PARAMETERS * myparam){
			 MsgBoxParam MsgBox = (MsgBoxParam)myparam->MessageBoxInj;
			 int result = MsgBox(0, myparam->text, myparam->caption, myparam->buttons);
			 switch(result){
		   		  case IDOK:
		   		  //your code		  
		   		  break;			
		   		  case IDCANCEL:
		   		  //your code
		   		  break;
			 }
			 return 0;
}

static DWORD Useless(){  
  return 0;
}

//this function is needed to get some extra privileges so your code will be able to work without conflicts with the system
int privileges(){
  HANDLE Token;
  TOKEN_PRIVILEGES tp;
  if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&Token))
  {
	LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
	tp.PrivilegeCount = 1;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		if (AdjustTokenPrivileges(Token, 0, &tp, sizeof(tp), NULL, NULL)==0){
   		 return 1; //FAIL
		}else{
   		 return 0; //SUCCESS
		}
   }	  
   return 1;
}

//Note the use of 'static': VisualC++ in debug mode put Useless() before of myFunc() because of
//name order from Z to A, so when we try to calculate the size of my func with
//DWORD size_myFunc = (PBYTE)Useless - (PBYTE) myFunc;
//the result is negative and so when we try the injection the target app crashes.
//So to avoid any problem remember to put 'static' to those functions (adpted to your compiler)

#include "ntdef.h" //--> it has the definition of NTSTATUS


HANDLE NtCreateThreadEx(HANDLE process, LPTHREAD_START_ROUTINE Start, LPVOID lpParameter);

typedef NTSTATUS (WINAPI *LPFUN_NtCreateThreadEx)
(
  OUT PHANDLE hThread,
  IN ACCESS_MASK DesiredAccess,
  IN LPVOID ObjectAttributes,
  IN HANDLE ProcessHandle,
  IN LPTHREAD_START_ROUTINE lpStartAddress,
  IN LPVOID lpParameter,
  IN BOOL CreateSuspended,
  IN DWORD StackZeroBits,
  IN DWORD SizeOfStackCommit,
  IN DWORD SizeOfStackReserve,
  OUT LPVOID lpBytesBuffer
);

struct NtCreateThreadExBuffer
{
  ULONG Size;
  ULONG Unknown1;
  ULONG Unknown2;
  PULONG Unknown3;
  ULONG Unknown4;
  ULONG Unknown5;
  ULONG Unknown6;
  PULONG Unknown7;
  ULONG Unknown8;
};

HANDLE NtCreateThreadEx(HANDLE process, LPTHREAD_START_ROUTINE Start, LPVOID lpParameter){
	
	HMODULE modNtDll = LoadLibrary("ntdll.dll");

	if(!modNtDll){
	   cout<<"Error loading ntdll.dll"<<endl;
	   return 0;
	}

	LPFUN_NtCreateThreadEx funNtCreateThreadEx = (LPFUN_NtCreateThreadEx) GetProcAddress(modNtDll, "NtCreateThreadEx");

	if(!funNtCreateThreadEx){
	   cout<<"Error loading NtCreateThreadEx()"<<endl;
	   return 0;
	}
	NtCreateThreadExBuffer ntbuffer;

	memset (&ntbuffer,0,sizeof(NtCreateThreadExBuffer));
	DWORD temp1 = 0;
	DWORD temp2 = 0;

	ntbuffer.Size = sizeof(NtCreateThreadExBuffer);
	ntbuffer.Unknown1 = 0x10003;
	ntbuffer.Unknown2 = 0x8;
	ntbuffer.Unknown3 = &temp2;
	ntbuffer.Unknown4 = 0;
	ntbuffer.Unknown5 = 0x10004;
	ntbuffer.Unknown6 = 4;
	ntbuffer.Unknown7 = &temp1;
   // ntbuffer.Unknown8 = 0;

	HANDLE hThread;  
	NTSTATUS status = funNtCreateThreadEx(
						&hThread,
						0x1FFFFF,
						NULL,
						process,
						(LPTHREAD_START_ROUTINE) Start,
						lpParameter,
						FALSE, //start instantly
						0, //null
						0, //null
						0, //null
						&ntbuffer
						);
						
	  
	return hThread;

}


//so to use in the above code like this:

HANDLE thread = NtCreateThreadEx(p, (LPTHREAD_START_ROUTINE)MyFuncAddress, DataAddress);
//
//

#include <windows.h>
#include <iostream>
#include <fstream>
#include <stdlib.h>
#include "ntdef.h"
#include <tlhelp32.h>

//For Vista/Win7:
HANDLE NtCreateThreadEx(HANDLE process, LPTHREAD_START_ROUTINE Start, LPVOID lpParameter);

using namespace std;

DWORD getPid(string procName);
int privileges();

int main()
{
   privileges();  //don't mind of the result, because maybe it fails because you already have that privilege

   DWORD pid = getPid("notepad.exe");
   if (pid==0) return 1; //error

   HANDLE p;
   p = OpenProcess(PROCESS_ALL_ACCESS,false,pid);
   if (p==NULL) return 1; //error

   char * dll = "C:\\mydll.dll";

   //--------now we are ready to inject

   unsigned long LoadLib = (unsigned long)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

   LPVOID DataAddress = VirtualAllocEx(p, NULL, strlen(dll) + 1, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);

   WriteProcessMemory(p, DataAddress, dll, strlen(dll), NULL);


   HANDLE thread = CreateRemoteThread(p, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLib, DataAddress, 0, NULL);
  //For Vista/Win7
  //HANDLE thread = NtCreateThreadEx(p, (LPTHREAD_START_ROUTINE)LoadLib, DataAddress);
	
	if (thread!=0){
			   //injection completed
			   WaitForSingleObject(thread, INFINITE);   //this waits untill thread thread has finished
			   VirtualFree(MyFuncAddress, 0, MEM_RELEASE); //free myFunc memory
			   VirtualFree(DataAddress, 0, MEM_RELEASE); //free data memory
	   		CloseHandle(thread);
			   CloseHandle(p);  //don't wait for the thread to finish, just close the handle to the process
			   cout<<"Injection completed!"<<endl;
	 }else{
			   cout<<"Error!"<<endl;
	 }

	
	system("PAUSE");
	return EXIT_SUCCESS;
}

DWORD getPid(string procName){
   HANDLE hsnap;
   PROCESSENTRY32 pt;
   hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
   pt.dwSize = sizeof(PROCESSENTRY32);
   do{
		  if(!strcmp(pt.szExeFile, procName.c_str())){
			 DWORD pid = pt.th32ProcessID;
			 CloseHandle(hsnap);
			 return pid;
		  }
   } while(Process32Next(hsnap, &pt));
   CloseHandle(hsnap);
   return 0;		  
}

int privileges(){
  HANDLE Token;
  TOKEN_PRIVILEGES tp;
  if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&Token))
  {
	LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
	tp.PrivilegeCount = 1;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		if (AdjustTokenPrivileges(Token, 0, &tp, sizeof(tp), NULL, NULL)==0){
   		 return 1; //FAIL
		}else{
   		 return 0; //SUCCESS
		}
   }	  
   return 1;
}


//for VISTA/WIN7


typedef NTSTATUS (WINAPI *LPFUN_NtCreateThreadEx)
(
  OUT PHANDLE hThread,
  IN ACCESS_MASK DesiredAccess,
  IN LPVOID ObjectAttributes,
  IN HANDLE ProcessHandle,
  IN LPTHREAD_START_ROUTINE lpStartAddress,
  IN LPVOID lpParameter,
  IN BOOL CreateSuspended,
  IN DWORD StackZeroBits,
  IN DWORD SizeOfStackCommit,
  IN DWORD SizeOfStackReserve,
  OUT LPVOID lpBytesBuffer
);

struct NtCreateThreadExBuffer
{
  ULONG Size;
  ULONG Unknown1;
  ULONG Unknown2;
  PULONG Unknown3;
  ULONG Unknown4;
  ULONG Unknown5;
  ULONG Unknown6;
  PULONG Unknown7;
  ULONG Unknown8;
};

HANDLE NtCreateThreadEx(HANDLE process, LPTHREAD_START_ROUTINE Start, LPVOID lpParameter){
	
	HMODULE modNtDll = LoadLibrary("ntdll.dll");

	if(!modNtDll){
	   cout<<"Error loading ntdll.dll"<<endl;
	   return 0;
	}

	LPFUN_NtCreateThreadEx funNtCreateThreadEx = (LPFUN_NtCreateThreadEx) GetProcAddress(modNtDll, "NtCreateThreadEx");

	if(!funNtCreateThreadEx){
	   cout<<"Error loading NtCreateThreadEx()"<<endl;
	   return 0;
	}
	NtCreateThreadExBuffer ntbuffer;

	memset (&ntbuffer,0,sizeof(NtCreateThreadExBuffer));
	DWORD temp1 = 0;
	DWORD temp2 = 0;

	ntbuffer.Size = sizeof(NtCreateThreadExBuffer);
	ntbuffer.Unknown1 = 0x10003;
	ntbuffer.Unknown2 = 0x8;
	ntbuffer.Unknown3 = &temp2;
	ntbuffer.Unknown4 = 0;
	ntbuffer.Unknown5 = 0x10004;
	ntbuffer.Unknown6 = 4;
	ntbuffer.Unknown7 = &temp1;
   // ntbuffer.Unknown8 = 0;

	HANDLE hThread;  
	NTSTATUS status = funNtCreateThreadEx(
						&hThread,
						0x1FFFFF,
						NULL,
						process,
						(LPTHREAD_START_ROUTINE) Start,
						lpParameter,
						FALSE, //start instantly
						0, //null
						0, //null
						0, //null
						&ntbuffer
						);
						
	  
	return hThread;

}

int CheckOSVersion()
{
/*
* Windows XP = 1 (NT 5.0)
* Windows Vista = 2 (NT 6.0)
* Windows 7 = 3 (NT 6.1)
* Windows 8 = 4 (NT 6.2)	 --> on Windows 8 CreateRemoteThread works perfectly!!
*/
OSVERSIONINFO osver;
osver.dwOSVersionInfoSize = sizeof(osver);
if (GetVersionEx(&osver))
{
  if (!(osver.dwPlatformId == VER_PLATFORM_WIN32_NT))  
   return 0;
  if (osver.dwMajorVersion == 5)
   return 1;
  if (osver.dwMajorVersion == 6 && osver.dwMinorVersion == 0)
   return 2;
  if (osver.dwMajorVersion == 6 && osver.dwMinorVersion == 1)	
   return 3;  
  if (osver.dwMajorVersion == 6 && osver.dwMinorVersion == 2)	
   return 4;
}
else
  return 0;
}

	char type[50];
	
	int os = CheckOSVersion();
	if (os == 0) return 0;
	if (os==1) strcpy(type, "Windows XP");
	if (os==2) strcpy(type, "Windows Vista");
	if (os==3) strcpy(type, "Windows 7");
	if (os==4) strcpy(type, "Windows 8");

//the size of void* is the answer
if (sizeof(void*) == 4) //is 32bit
if (sizeof(void*) == 8) //is 64bit

typedef struct ID{
	PVOID UniqueProcess;
	PVOID UniqueThread;
} CLIENT_ID, *PCLIENT_ID;

typedef long (*myRtlCreateUserThread)
(HANDLE, PSECURITY_DESCRIPTOR, BOOLEAN, ULONG, PULONG, PULONG, PVOID, PVOID, PHANDLE, PCLIENT_ID);

myRtlCreateUserThread RtlCreateUserThread;

RtlCreateUserThread=(myRtlCreateUserThread)GetProcAddress(GetModuleHandle("ntdll.dll"),"RtlCreateUserThread");

DWORD GetThreadID(DWORD pid){
	  HANDLE hsnap;
	  THREADENTRY32 pt;
	  hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
	  pt.dwSize = sizeof(THREADENTRY32);
	  while (Thread32Next(hsnap, &pt)){
		   if(pt.th32OwnerProcessID == pid){
			 DWORD Thpid = pt.th32ThreadID;
			 CloseHandle(hsnap);
			 return Thpid;
		   }
	  };
	  CloseHandle(hsnap);
	  return 0;		  
}

#include <cstdlib>
#include <iostream>
#include "windows.h"
#include "tlhelp32.h"

using namespace std;

DWORD getPid(string procName);
DWORD GetThreadID(DWORD pid);


int main(int argc, char *argv[])
{
	HHOOK hproc;
	HOOKPROC cbt;
	HMODULE dll = LoadLibrary("DllHook.dll");	//the dll tha we will inject that contains the hook procedure
	cbt = (HOOKPROC)GetProcAddress(dll, "MyProcedure");	  //get the address of our Procedure
	DWORD id = GetThreadID(getPid("notepad.exe"));	 //in this example we want to set the hook in a specific target
	
	if (id == 0) return 0; //if id == 0 means that the process isn't running
	hproc = SetWindowsHookEx(WH_KEYBOARD, cbt, dll, id);   //if we wanted to set the hook in every process we could replace 'id' with 0

	cin.get();
	UnhookWindowsHookEx(hproc); //When we want to remove the hook
	return EXIT_SUCCESS;
}

DWORD GetThreadID(DWORD pid){
	  HANDLE hsnap;
	  THREADENTRY32 pt;
	  hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
	  pt.dwSize = sizeof(THREADENTRY32);
	  while (Thread32Next(hsnap, &pt)){
		   if(pt.th32OwnerProcessID == pid){
			 DWORD Thpid = pt.th32ThreadID;
			 CloseHandle(hsnap);
			 return Thpid;
		   }
	  };
	  CloseHandle(hsnap);
	  return 0;		  
}

DWORD getPid(string procName){
   HANDLE hsnap;
   PROCESSENTRY32 pt;
   hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
   pt.dwSize = sizeof(PROCESSENTRY32);
   do{
		  if(!strcmp(pt.szExeFile, procName.c_str())){
			 DWORD pid = pt.th32ProcessID;
			 CloseHandle(hsnap);
			 return pid;
		  }
   } while(Process32Next(hsnap, &pt));
   CloseHandle(hsnap);
   return 0;		  
}

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>


__declspec(dllexport) LRESULT WINAPI MyProcedure(int code, WPARAM wp, LPARAM lp);

__declspec(dllexport) LRESULT WINAPI MyProcedure(int code, WPARAM wp, LPARAM lp){
			
		//here goes our code
		
		return CallNextHookEx(NULL, code, wp, lp);  //this is needed to let other applications set other hooks on this target
}


BOOL APIENTRY DllMain (HINSTANCE hInst,
					   DWORD reason,
					   LPVOID reserved)
{
	switch (reason)
	{
	  case DLL_PROCESS_ATTACH:
		  
		break;

	  case DLL_PROCESS_DETACH:
		break;

	  case DLL_THREAD_ATTACH:
		break;

	  case DLL_THREAD_DETACH:
		break;
	}

	/* Returns TRUE on success, FALSE on failure */
	return TRUE;
}

	   push 0xACEACEAC ;-> placeholder for the address of our old EIP
	   pushfd ;->save all flags registers
	   pushad ;-> save all registers
	  
	   push 0xACEACEAC ;->placeholder for the address of the string 'User32.dll'
	   mov ecx, 0xACEACEAC ;->placeholder for the address of LoadLibraryA
	   call ecx ;-> traslated in c++: LoadLibrary("User32.dll")

	   ;now the address of the LOADED LIBRARY User32.dll is in eax register

	   push 0xACEACEAC ;->placeholder for the address of the string MessageBoxA
	   push eax ;->push User32.dll into the stack
	   mov edx,0xACEACEAC ;->placeholder for the address of GetProcAddress
	   call edx ;translated in c++: GetProcAddress(LoadLibrary("User32.dll"), "MessageBoxA")

	   ;now the address of MessageBoxA is in eax register

	   push 0 ;push the fourth parameter of MessageBoxA (MB_OK)
	   push 0xACEACEAC ;->placeholder for the address of the text (3 parameter)
	   push 0xACEACEAC ;->placeholder for the address of the caption (2 parameter)
	   push 0 ;push the first parameter into the stack (don't bother)
	   call eax ;translated in c++: MessageBox(0, "caption", "text", MB_OK)

	   popad ;restore all the registers
	   popfd ;restore all the flags
	   ret ;get back to right execution

char shellcode[] = "\x68\xac\xce\xea\xac\x9c\x60\x68\xac\xce\xea\xac\xb9\xac\xce\xea\xac\xff\xd1\x68\xac\xce\xea\xac\x50\xba\xac\xce\xea\xac\xff\xd2\x6a\x00\x68\xac\xce\xea\xac\x68\xac\xce\xea\xac\x6a\x00\xff\xd0\x61\x9d\xc3";

#include <windows.h>
#include <iostream>
#include <fstream>
#include <stdlib.h>
#include <tlhelp32.h>
#include <shlwapi.h>

#pragma comment(lib, "shlwapi.lib")

using namespace std;

int privileges();
DWORD getPid(string procName);
DWORD GetThreadID(DWORD pid);
__declspec() void myFunc();  //if you use Dev-C++ put static before __declspec()
__declspec() void Useless();   //if you use Dev-C++ put static before __declspec()

int _tmain()
{
	privileges();
	unsigned long oldIP;


	DWORD pid = getPid("notepad.exe");
	if (pid==0) return 1;
	cout<<pid<<endl;

	HANDLE p;
	p = OpenProcess(PROCESS_ALL_ACCESS,false,pid);
	if (p==NULL) return 1; //error
	
	char * user32 = "User32.dll";
	char * MsgBox = "MessageBoxA";
	char * testo = "REPORT";
	char * mex = "INJECTION THREAD: SUCCESS!";

	unsigned long size_myFunc = (unsigned long)Useless - (unsigned long)myFunc;
	unsigned long GetProcAdr = (unsigned long)GetProcAddress(GetModuleHandle("kernel32.dll"), "GetProcAddress");
	unsigned long Load = (unsigned long)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");

	void * mexAddress  = VirtualAllocEx(p, NULL, strlen(mex)+1, MEM_COMMIT, PAGE_READWRITE);
	void * testoAddress  = VirtualAllocEx(p, NULL, strlen(testo)+1, MEM_COMMIT, PAGE_READWRITE);
	void * MsgboxAddress = VirtualAllocEx(p, NULL, strlen(MsgBox)+1, MEM_COMMIT, PAGE_READWRITE);
	void * DataAddress   = VirtualAllocEx(p, NULL, strlen(user32)+1, MEM_COMMIT, PAGE_READWRITE);
	void * MyFuncAddress = VirtualAllocEx(p, NULL, size_myFunc, MEM_COMMIT, PAGE_EXECUTE_READWRITE);



	WriteProcessMemory(p, DataAddress, user32, strlen(user32), NULL); //string user32.dll
	WriteProcessMemory(p, MsgboxAddress, MsgBox, strlen(MsgBox), NULL); //string MessageBoxA
	WriteProcessMemory(p, testoAddress, testo, strlen(testo), NULL); //string for caption
	WriteProcessMemory(p, mexAddress, mex, strlen(mex), NULL); //string for text
	
	DWORD thID = GetThreadID(pid);
	HANDLE hThread = OpenThread((THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME), false, thID);
  
	SuspendThread(hThread);
	
	
	CONTEXT ctx;
	ctx.ContextFlags = CONTEXT_CONTROL;
	GetThreadContext(hThread, &ctx);
	oldIP = ctx.Eip;
  
	ctx.Eip =  (DWORD)MyFuncAddress;
	ctx.ContextFlags = CONTEXT_CONTROL;

  
	WriteProcessMemory(p, MyFuncAddress, myFunc, size_myFunc, NULL);
	//After writing the function we patch it with the right addresses
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 1), &oldIP, 4, NULL); //Old EIP
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 8), &DataAddress, 4, NULL); //USER32.DLL
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 13), &Load, 4, NULL);  //LoadLibraryA
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 20), &MsgboxAddress, 4, NULL); //MessageBoxA
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 26), &GetProcAdr, 4, NULL); //GetProcAddress
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 35), &testoAddress, 4, NULL); //caption
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 40), &mexAddress, 4, NULL); //text
	
	SetThreadContext(hThread, &ctx);
	ResumeThread(hThread);

	Sleep(1000); //wait a second!

	//if we want to free the used memory and the injected code that will take a short time of execution,
	//we can of course wait for it for a certain period with Sleep();
	//but if the code will keep running with no ending we cannot free the memory otherwise it will crash the target application
	//VirtualFreeEx(p, MyFuncAddress, size_myFunc, MEM_DECOMMIT);
	//VirtualFreeEx(p, DataAddress, strlen(mytext)+1, MEM_DECOMMIT);
	CloseHandle(p);
	CloseHandle(hThread);

	system("PAUSE");
	return EXIT_SUCCESS;
}


DWORD GetThreadID(DWORD pid){
	  HANDLE hsnap;
	  THREADENTRY32 pt;
	  hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
	  pt.dwSize = sizeof(THREADENTRY32);
	  while (Thread32Next(hsnap, &pt)){
		   if(pt.th32OwnerProcessID == pid){
			 DWORD Thpid = pt.th32ThreadID;
			 CloseHandle(hsnap);
			 return Thpid;
		   }
	  };
	  CloseHandle(hsnap);
	  return 0;		  
}

DWORD getPid(string procName){
   HANDLE hsnap;
   PROCESSENTRY32 pt;
   hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
   pt.dwSize = sizeof(PROCESSENTRY32);
   do{
		  if(!strcmp(pt.szExeFile, procName.c_str())){
			DWORD pid = pt.th32ProcessID;
			CloseHandle(hsnap);
			return pid;
		  }
   } while(Process32Next(hsnap, &pt));
   CloseHandle(hsnap);
   return 0;		  
}


static __declspec(naked) void myFunc(){
	_asm {
	  push 0xACEACEAC
	  pushfd
	  pushad
	  
	  push 0xACEACEAC
	  mov ecx, 0xACEACEAC	  
	  call ecx

	  push 0xACEACEAC
	  push eax
	  mov edx,0xACEACEAC
	  call edx  

	  push 0
	  push 0xACEACEAC
	  push 0xACEACEAC
	  push 0
	  call eax

	  popad
	  popfd
	  ret
	}
			
}


static __declspec(naked) void Useless(){  //this let's us calculate the address of MyFunc
	_asm ret;
}



int privileges(){
  HANDLE Token;
  TOKEN_PRIVILEGES tp;
  if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&Token))
  {
	LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
	tp.PrivilegeCount = 1;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		if (AdjustTokenPrivileges(Token, 0, &tp, sizeof(tp), NULL, NULL)==0){
   		 return 1; //FAIL
		}else{
   		 return 0; //SUCCESS
		}
   }	  
   return 1;
}

//Note the use of 'static': VisualC++ in debug mode put Useless() before of myFunc() because of
//name order from Z to A, so when we try to calculate the size of my func with
//DWORD size_myFunc = (PBYTE)Useless - (PBYTE) myFunc;
//the result is negative and so when we try the injection the target app crashes.
//So to avoid any problem remember to put 'static' to those functions (adpted to your compiler)

// . 0 . 1 . 2 . 3 . 4 . 5 . 6 .   ...
//"\x68\xac\xce\xea\xac\x9c\x60...

(void*)((unsigned long) MyFuncAddress + each_offset)

#include <windows.h>
#include <iostream>
#include <fstream>
#include <stdlib.h>
#include <tlhelp32.h>
#include <shlwapi.h>

#pragma comment(lib, "shlwapi.lib")
using namespace std;

char shellcode[] = "\x68\xac\xce\xea\xac\x9c\x60\x68\xac\xce\xea\xac\xb8\xac\xce\xea\xac\xff\xd0\x61\x9d\xc3";

typedef HANDLE (WINAPI* OpenThreadfunc)(DWORD dwDesiredAccess, BOOL bInheritHandle,  DWORD dwThreadId);
OpenThreadfunc myOpenThread;

void setOpenThread();
int privileges();
DWORD getPid(string procName);
DWORD GetThreadID(DWORD pid);
int injectLibrary(char * process, char * dll);

HMODULE kernel;

int main(int argc, char *argv[])
{

	injectLibrary("notepad.exe", "C:\\fullpath\\myDll.dll");	
	
	system("PAUSE");
	return EXIT_SUCCESS;
}

int injectLibrary(char * process, char * dll){
	
	setOpenThread();
	if (myOpenThread == NULL){
					 cout<<"Error with OpenThread()"<<endl;				
					 return 1;
	}
	
	unsigned long oldIP;
	
	if (privileges()==1){  //if you want to check privileges you can, but some times if you are administrator you can perform injection without setting them
					 cout<<"Error couldn't get privileges..."<<endl;					
	}

	DWORD pid = getPid("notepad.exe");
	if (pid==0) return 1;


	HANDLE p;
	p = OpenProcess(PROCESS_ALL_ACCESS,false,pid);
	if (p==NULL) return 1; //error
	
	
	char * dllName = dll;
	
	unsigned long shsize = strlen(shellcode);
	unsigned long Load = (unsigned long)GetProcAddress(kernel, "LoadLibraryA");
	
	void * DllAddress  = VirtualAllocEx(p, NULL, strlen(dllName)+ 1, MEM_COMMIT,PAGE_READWRITE);
	void * MyFuncAddress = VirtualAllocEx(p, NULL, shsize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	
	WriteProcessMemory(p, DllAddress, dllName, strlen(dllName), NULL);
	
	DWORD thID = GetThreadID(pid);
	HANDLE hThread = myOpenThread((THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME), false, thID);
	
	SuspendThread(hThread);
	CONTEXT ctx;
	ctx.ContextFlags = CONTEXT_CONTROL;
	GetThreadContext(hThread, &ctx);
	oldIP = ctx.Eip;
	ctx.Eip =  (DWORD)MyFuncAddress;
	ctx.ContextFlags = CONTEXT_CONTROL;
	
	WriteProcessMemory(p, MyFuncAddress, &shellcode, shsize, NULL);
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 1), &oldIP, 4, NULL);
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 8), &DllAddress, 4, NULL);
	WriteProcessMemory(p, (void*)((unsigned long)MyFuncAddress + 13), &Load, 4, NULL);
	
	SetThreadContext(hThread, &ctx);
	ResumeThread(hThread);
	
	CloseHandle(p);
	CloseHandle(hThread);
	FreeLibrary(kernel);
	return 0;
}


void setOpenThread(){
	kernel = LoadLibrary("kernel32.dll");
	if (kernel != NULL) myOpenThread = (OpenThreadfunc)GetProcAddress(kernel, "OpenThread");
}


DWORD getPid(string procName){
   HANDLE hsnap;
   PROCESSENTRY32 pt;
   hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
   pt.dwSize = sizeof(PROCESSENTRY32);
   do{
		  if(!strcmp(pt.szExeFile, procName.c_str())){
			 DWORD pid = pt.th32ProcessID;
			 CloseHandle(hsnap);
			 return pid;
		  }
   } while(Process32Next(hsnap, &pt));
   CloseHandle(hsnap);
   return 0;		  
}


DWORD GetThreadID(DWORD pid){
	  HANDLE hsnap;
	  THREADENTRY32 pt;
	  hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
	  pt.dwSize = sizeof(THREADENTRY32);
	  while (Thread32Next(hsnap, &pt)){
		   if(pt.th32OwnerProcessID == pid){
				DWORD Thpid = pt.th32ThreadID;
				CloseHandle(hsnap);
				return Thpid;
		   }
	  };
	  CloseHandle(hsnap);
	  return 0;		  
}

int privileges(){
  HANDLE Token;
  TOKEN_PRIVILEGES tp;
  if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&Token))
  {
	LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
	tp.PrivilegeCount = 1;
	tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		if (AdjustTokenPrivileges(Token, 0, &tp, sizeof(tp), NULL, NULL)==0){
   		 return 1; //FAIL
		}else{
   		 return 0; //SUCCESS
		}
   }	  
   return 1;
}

//(Thanks to Napalm that let me correct the errors)