DonatShell
Server IP : 180.180.241.3  /  Your IP : 216.73.216.252
Web Server : Microsoft-IIS/7.5
System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586
User : IUSR ( 0)
PHP Version : 5.3.28
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Windows/SysWOW64/manifeststore/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ HOME SHELL ]     

Current File : /Windows/SysWOW64/manifeststore/advapi32.amx
AMX1 2?UB8X8$8|,2?UB8$88\&
!<#
@E((
@
hc(((
@@
@[
@w
@(
@l(
@"$ (((( (&(+(,(-	
@	.,(/	(0	(1	(2	(3	(	( 	(4		(	,	
(
-	(5	

@
62$,(/
(0
(1
(2
(3
(
( 
(4
	(	,

(
-
(5

@7B$,((8(((9(>( (&	(	+
(
,(-
@?	@(/(0(1(2(3(8((@	(	A
(
9(>( 
(
4(,(-(5

@
B
R$@(/
(0
(1
(2
(3
(8
(
(@
	(	A

(
9
(>
( 

(
4
(,
(-
(5

@Cb$,((8(((9(>( (&	(	+
(
D(E
@F@(/(0(1(2(3(8((@	(	A
(
9(>( 
(
4(,(E(5
@G
D(/(0((1(2(3(8(	(	@
(
A(9(>
(
 (4(,(E(5
@Hr$D(/(0((1(2(3(8(	(	@
(
A(9(>
(
 (4(,(E(5
@I$@(/(0(1(2(3(8((@	(	A
(
9(>( 
(
4(,(E(5
@J$(K(R(S(T
@U$(K(R(V(S(T
@W$(K(R(V(S(X(^(T
@_$(K(R(S(T
@`$(K(R(V(S(T
@a$(K(R(V(S(X(^(T
@b$(K(R(c(d(e
@f%(K(R(g(T(h(i
@j%(K(R(V(g(T(h(i
@k"%	$(K(R(V(S(X(^(T(h	(	i
@l%(K(R(V(m(S(T(n(o
@pq
@r(s(t 
@ x(s (t (y (z !
@!{2%(|!(}!(~!(!(!	(o!"
@"	B%(|"("(~"("("
(o"#
@#
 R%)(#(#(#(#(#(#(#(#	(	#
(
#(T#$
@$!b%($%
@%"r%(,%(%&
@&
#%(,&(&'
@'$h(T'('('('
(
@(%Gi(|(((((((
)
@)&3j()()*
@*'g(*+
@+(k
(+(+(+(+,
@,)e(,-
@-*n(-(-.
@.+n(.(./
@/,l(/(/0
@0-k(0(01
@1.+n(1(12
@2/Hm(2(23
@304s(13(34
@41r(14(45
@52!g(T5(5(5(5
6
@63p(6(67
@74f(7(7(7
8
@85q(18(89
@9 6Eq(19(9:
@:!7.f(T:(:
(:;
@;"81o(;(;<
@<#9e(<
(<=
@=$:%(=(=>
@>%;(>(>?
@?&<h(?(?(?(?(?@
@@'=h(@(@(@(@(@A
@A(>(A(A(A(A(A(AB
@B)?(B(B(B(B(B(BC
@C*@ (C(CD
@D+A (D(DE
@E,B	$(E(E(E(E(E(E(E(E	(	EF
@F-C	$(F(F(F(F(F(F(F(F	(	FG
@G.D(G(GH
@H/E(H(HI
@I0F(I(I(=I(1I(I(IJ
@J1G(J(J(=J(1J(J(JK
@K2Ha(K(K(K(K(TKL
@L3Ia(L(L(L(L(TLM
@M4J=(M(TMN
@N	5K=(N(TNO
@O
6Li(OP
@P7M%(P(P(PQ
@Q8N%(Q(Q(QR
@R9O%,(R(R(R(R(R(R(R(R	(	R
(
R( RS
@S!:P%,(S(S(S(S(S(S(S(S	(	S
(
S( ST
@T";Q%(|T(#T($TU
@U%<R(U(UV
@V&=S(V(VW
@W'(>Tc()WX
@X+?U(,XY
@Y-@V(YZ
@Z.AW%(/Z[
@[0BXL(1[\
@\2CYl(3\]
@]4DZ(5](6](7]^
@^89E['()^(:^(;^(y^(<^_
@_=F\%(_(>_(?_`
@`GG]&(`(>`(`(H`a
@aIH^&(a(>a(a(Hab
@bJI_n(Kb(Lb(Mb()bc
@ckJ`0(Kc(Lc(Mc()cd
@dlKaM(md(qd(rd(sd(tde
@euLb(me(qe(re(se(tef
@fwMcU(xf(3f(yf(f(zf({fg
@g|Ndȩ(xg(3g(yg(g(zg({gh
@h}Oe!(~h(=h(h(h(h(h(hi
@iPf!(~i(=i(i(i(i(i(ij
@jQg(~j(=j(j(j(j(j(jk
@kRh(~k(=k(k(k(k(k(kl
@lSiֱ(3l(yl(l(zl({lm
@mTj<(3m(ym(m(zm({mn
@nUk(n(no
@oVl(o(op
@pWm8(p(xp(zp(p(3p(pq
@qXn (q(xq(zq(q(3q(qr
@rYoծ(xr(zr(r(3r(rs
@sZpu(xs(zs(s(3s(st
@t[qY(zt(t(3t(tu
@u\r(zu(u(3u(uv
@v]s(v(vw
@w^tc(w(wx
@x_u"&(x(x(x(=x(x( xy
@y`v2&(y(y(yz
@zaw(z(z(z(z(<z{
@{bxB&({({({({({( {|
@|cyR& (|(|(|(=|(|(|(|( |}
@}dzb&	$(}(}(}(}(}(}(}(}	(	 }~
@~e{v,(~(~(~(~(~(~(~(~	(	~
(
~(~
@f|r&,((((((((	(	
(
 (
@g}R,((((((((	(	
(
 (
@h~R	$(((((((( 	(	
@i&	$((A((!(("((!	(	
@j&
4((( (((((	(	
(
((
(

@k&
4((( (((((	(	
(
((
(

@l
@m&(((T(
@n(((((A
@o(((A
@p(((A
@
q(((
@r((A((
@
sׁ((A((
@t(((A(#
@ua(((A(%
@ve(
@w((
@x!((A(&
@"y((A('
@$z(%
@&{k(%
@'|((()
@*}((()
@+~(,((%
@-U(,((%
@.
@/c
@0(1(2(3(((4(5
@6(1(2(3(((4(5
@7q(((A(#
@8%((((A(9(
@=5(&(A((#
@>('(A((%
@?5(((A(%
@@(A(B((A
@C(A(B((A
@D((((A
@ED(%(,(
@F(%(,(
@Gş(1(((H(2(4
@I(1(((H(2(4
@JG~(#(A
@K(&(#(A
@Lu('(%(A
@M~(%(A
@Nz(O(P(Q%(R%
@Sx(O(Q%
@Tz(O(U'(V'(W
@Xpt((
@Yt((
@Z
([(\((](^
@_&(`(a(b(c(y
@d&(`(a(b(c(y
@e&(f(g(y
@h&(f(i(j(y(k
@l'(j(m(n(y(o(p
@q'(f(i(r(y(s
@t"'(m
@u2'(j
@vB'(m(g(y(k
@wR'(j(g(y(s
@xb'(j(m(n(y(o(p(y
@zr'({(g(y(|(}(~
@'({(g(y(|(}(~
@'({(g(y(|((
@'({(g(y(|((
@'(j(((y(o(p
@'(f(i(y(s
@'(f((
@'(c(g(y((
@'(c(g(y((
@((m((o(p(y
@((j((o(p(y
@"((f((o(p(y
@2((f((
@B((m(o((y
@R((m(j(y
@b((f(o(((y(s
@r((f(y
@((m((o(y
@((j((o(y
@((f((o(y
@(((c
@(((c(g(y
@(((c(g(y
@(((c
@((m(((y((
@)(m(((y((
@)(m(((((y
@")(m(((((y
@!(s(
@(s(
@2)(K(
@B)(
@(
@R)(
@(((((
@b)(((
@r)((((((
@
t(()
@
((*
@
((
@
(()
@
8((*
@
[(
@
(
@
(
@
((
@
w((
@
()()(
@
j(*(*(
@
()()(
@
A(*(*(
@
(((((((
@
K(((((((
@
;()()(
@
(*(*(
@
((((((((()	(	
(
A((
@
4(((*(((((*	(	
(
(*(
(
A((
@
+(((((((((*	(	
(
A((
@\(((((3
@s)(3(R((;((((
@ߒ	-(R((3((;(((	(	,
@!(s
@(s
@	(s(
(-
@((
@c(((.(((
@cd(((/(((
@/a	$((((/((((	(	
@b ((((.((((
@b
(((((((((	(	
(

@ b`
(((((((((	(	
(

@!=f ((((/((((
@"p(#0(((
@)v(*(+(,(-(.(o
@/)(0(1(2	
@	3)(0	(1	

@
4)(0
(1

@5r(Y(6((7(8
@9	Yr(Y((Q

@
:
is(Y

@;<
@=>
@?@
$
@ABP
@CDw
@EF
@GH
@IJ)((K(L1((A(S(T(U(V2
@YZ	
@[\;
@]^h
@_?"(s(`
@aI(s(`
@b)(K(c
@d#(e
@fi(3(g(M
@h(3(g(M
@iQ(j- 
@ kq (l !
@!m,(w!3"
@"p	=
(q"4(u"(v"5#
@#y
 )(T#$
@$z!	$(~$(=$({$(|$(}$(~$6($($7	(	$%
@%"	$(~%(=%({%(|%(}%(~%8(%(%9	(	%&
@&
#*(K&(&(c&'
@'$*(K'('('('(
@(%G(K((((((()
@)&()()()()*
@*'(*:+
@+((+;,
@,)x(,(,(,-
@-*(-(-(-.
@.+' (s.(.(./
@/,(/(/(/(/(/0
@0-(0(0(01
@1.(1(1(12
@2/w(s2(2(2(2(23
@30#*(s3(3(3(3(34
@412(4(4(4(4(45
@524(5(5(5(5(5(<56
@632
((6(=6(6(6(6(6(K6(v65	(	6
(
q6<7
@74
((7(=7(7(7(7(7(K7(v75	(	7
(
q748
@853*(8(8(8(8(89
@9 6C*(T9:
@:!7(:(:(:;
@;"8(;(;(;=<
@<#9(<(<=
@=$:U(=(=(=(=(=?>
@>%;(>?
@?&<(?@
@@'=(@A
@A(>(AB
@B)? (B(=B(B(B(B(B(B(BC
@C*@e	$(~C(=C(C(|C(C(C(C(C	(	CD
@D+A	$(~D(=D(D(|D(D(D(D(D	(	DE
@E,BX (E(=E(E(E(E(E(E(EF
@F-C-(F(FG
@G.DW(G(GH
@H/Eh(H(H(H(HI
@I0FS*(I(I(I(I(oIJ
@J1Gc*(J(J(JK
@K2Hs*(K(K(	K(
KL
@L3I*(L(L(LM
@M
4J*(MN
@N5K*(N(N(NO
@O6L*(3O(OP
@P7M*(P(P(P(PQ
@Q8N (Q(=Q(Q(Q(Q(Q(Q(QR
@R9Oa	$(R(=R(R(|R(R(R(R(R	(	RS
@S:P	$(S(=S(S(|S(S(S(S(S	(	ST
@T;Q](T(T( T(TU
@U<R^(U(U( U(UV
@V=S\(V( V(V(VW
@W>T	](W( W(W(WX
@X ?U*(TXY
@Y!@V*(YZ
@Z"AW*(TZ(#Z[
@[$BX+(T[\
@\%CY=(1\(,\(A\(&\('\((\@(/\]
@]0DZ+(|](1](2](3](o]^
@^45E[_
@_67F\
`
@`89G]?a
@a:H^(ab
@b;I_(bc
@c<J`U(cd
@d=KaU(de
@e>Lbi(ef
@f?Mci(fg
@g@Nd(Ag(Bgh
@hCOe(Ah(Bhi
@iDPf#+(Ti(Ei(Fij
@jGHQgk
@kIJRiUl
@lKLSjm
@mMNTkn
@nOPUl;o
@oQRVmp
@pSWnye(TpC(Vp(Wp(Xp(Ypq
@qZXoe(TqC(Vq(Wq(Xq(Yqr
@r[\Yps
@s]^ZqU(_s(`s(ms(<st
@tn[r3+(otu
@up\sC+(uv
@vq]tS+(rvw
@ws^uc+(wx
@xt_vs+(Kx(ux(vxy
@yw`w+(y(yz
@zxax+	(z(z(z{
@{yby({(z{({{(|{(}{|
@|~cz (|(z|({|(||(}|}
@}d{
(}(z}({}(}(}~
@~e|
(~(z~({~(~(~(}~
@f}F((z({(((}
@g~y((z({((
@h(E
@i(((
@j+(|
@k(
@l+(K
@m
@n+(
@o+(T
@p+(T(
@q^(
@r((((((
@s
(((((((((	(	
(
G
@t+,((((((	((	(	
(
(G
@uC
(((((((((	(	
(
G
@v((((((
@w(((((((
@x	(((((((
@yW(((((((
@zX(((((((
@{+((( ((
@|[((( ((
@}((((
@~R((((
@}(((
@(((
@r(((((((
@(((((((
@
(((*(
@
((
@
`(
@
(
@
((((
@
((*((
@
(((H((
@

((I(((
@
(
@
Ԥ((
@
(((*(
@
(((((
@
t((*((
@
-(((((
@
Z((
@
(((((
@
h(((((
@
$(
@
((G
@
1(*(*(*
@
Z((
@
[(*(*
@
_
(((((*(K(	L(
(A	(	
(

@
0((((((((*	(	K
(
	L(
(
@
	$(((	(K(M(
(A(	(	
@
0((((((((		(	K
(
M(
(
@
J((A((*(K(	N
@
(((*(K(	O
@
ȿ((*(*(
@ 
?(((*
@!
¾((*(
@"
(((	(K(P
@$
i(%(&Q(0U
@70(8

@9
((((
@:
|(*(;W((
@?
(*(;W((
@@
<((*((
@A
((((
@B
((C*((
@D
((E(
@F
4((C*(GX
@J
X((E(
@K
((E(
@L
((M*(N(O*(P
@Q
(((3
@R
(((E(
@S
((C*(E(
@T
(((U(*(
@V
(	((W(
@X
d((Y*(Z*
@[
,((E(
@\
((C*(GX(](^Y
@`
((E(
@a
((E(
@b
((G
@c
((M*(O*
@d
(((3
@e
((
@f
կ((C*(E(
@g
*(((E(
@h
J((Y*(Z*
@ij 
@kl7
@mnO
@oph
@qr
@st
@u`;(((vZ(x({(|Z(}[
@~|9(((((\(\(\
@,((
@,,((((	((((	(	
(
(
@#,(((
@3,(S( 
@e(
@((
@
@C,(((]
@S,(((_
@(/(0(
@c,(/(0(
@0(/(0(
@s,(/(0(
@0(/(0(1(2((((,	(	
(
4((
@,0(/(0(1(2((((,	(	
(
4((
@}(/(0((((
@,(/(0((((
@,((
@((
@"(s(A(,
@u(s(A(,
@((
@((
@,(((|
@,(((
@,(((
@,(((
@,(((
@,(o(((|
@u(A(
@m(`
@h(g
@0((h(
@(
@
@
@
@N((h(
@V	
@	(	(	(	(	

@
(
(
(
i(
(

@	
@	



@
(
(

@
~((j((
@
((h((
@((( (!("((
@#$
@%&
@'(
@)*C
@+,
@-.
@/0
@12
@3-((4(5
@6(/(7(((
@8-(/(7(((
@9%Y
@:Y(;l(=m(?(@
@Aj(B(C($($
@D(E(((F 
@ G(E (( (F !
@!HL(s!(I!3"
@"J	 #-("("#
@#K
!3-(#(#(#(#(#$
@$L"C-($($($($($%
@%M#S-(%(N%n(%(%&
@&Q
$c-(&(N&o(&(&'
@'S%_('(T'p('('(
@(Y&_(((T(q(((()
@)['s-()(\)()()()*
@*](-(*(?*+
@+^)-(+(+(+(+(+,
@,_*(3,(g,(M,-
@-`+Đ(3-(g-(M-.
@.a,(s.(w.3/
@/b-(c/(d/(,/0
@0e.(0(f0(g0(0(h0(i0(j01
@1k/+(1(f1(g1(1(h1(i1(j12
@2l
0c.(j2r3
@3n
1B"(3(j3r(o3r4
@4p
2!(4(j4r(A4(o4r5
@5q
3!(5(j5r(A5(o5r6
@6r
4$"(6(j6r(o6r7
@7s
5u((t7r(u7(v7r8
@8w
6&(t8r(u8(v8r9
@9x
 7)(j9r(y9(o9r:
@:z
!8C.	$(j:r(y:(X:({:(|:(}:(:(o:r	(	~:;
@;
"9S.	$(j;r(y;(X;({;(|;(};(;(o;r	(	~;<
@<
#:*,(j<r(y<(X<({<(|<(}<(<(o<r	(	~<
(
<(<=
@=
$;+,(j=r(y=(X=({=(|=(}=(=(o=r	(	~=
(
=(=>
@>
%</*(j>r(y>(o>r?
@?
&=k/(j?r(?@
@@
'>-(j@r(@(}@(X@A
@A
(?-(jAr(A(}A(XAB
@B
)@.(jBr(B(}B(XB(B(BC
@C
*A /(jCr(C(}C(XC(C(CD
@D
+B/(jDr(yD(DE
@E
,C0(jEr(yE(EF
@F
-D-(jFr(FG
@G
.E
0(jGr(yGH
@H
/F/(jHr(yHI
@I
0G-(jIr(IJ
@J
1H-(jJr(JK
@K
2I-L
@L
3J.M
@M
4K;(MrN
@N
5L;(NrO
@O
6M1(jOr({O(O(OP
@P
7N- (jPr({P(P(P(<P({P(P(P$Q
@Q
8O- (jQr({Q(Q(Q(<Q({Q(Q(Q$R
@R
9PJ1(jRr({R(R(RS
@S
:Q. (jSr({S(S(S(<S(S(S(ST
@T
;R. (jTr({T(T(T(<T(T(T(TU
@U
<Ss.(jUrV
@V
=T=/(jVr(V(V(VW
@W
>U#.(Wr(W(W(yW(W(W(WX
@X
?V3.(Xr(X(X(yX(X(X(XY
@Y
@W96(Y(oYr(}Y(AY(XYZ
@Z
AX4(Z(oZr(}Z(AZ(XZ[
@[
BY/(j[r(y[([\
@\
CZ/(j\r(y\(\]
@]
D[/(j]r(](](](](A](]^
@^
E\-/(j^r(^(^(^(^(A^(^_
@_
F].(j_r(_(_(_(_`
@`
G^.(}`(o`ra
@a
H_u+(jar(ya(oarb
@b
I`.(jbr(yb(|b(}b(obrc
@c
Ja.(jcr(yc(|c(}c(ocrd
@d
Kb~,(jdr(yd(|d(}d(odr(d(de
@e
Lc,(jer(ye(|e(}e(oer(e(ef
@f
Md+(jfr(yf(ofrg
@g
Ne.(g(|g(}g(ogrh
@h
Of((jhr(hri
@i
Pg.0(jir({i(i(<i(i(i(i(i	(	i
(
i(i(i$j
@j
Qh.0(jjr({j(j(<j(j(j(j(j	(	j
(
j(j(j$k
@k
Ri 8(jkr(ks(k(k(kl
@l
Sjk=(jlr(lt(l(l(lm
@m
Tk;(mr(mn
@n
UlA(jnr(yn(n(n
o
@o
Vm.(jor(o(<o(o(o(op
@p
Wn
/(jpr(p(<p(p(p(pq
@q
XoB(jqr(yq(q(q
r
@r
Yp--(jrr(r(rs
@s
ZqD(jsr(ys(s(st
@t
[rG(jtr(yt(t(tu
@u
\s}/(jur(u(yuv
@v
]t/(jvr(v(yvw
@w
^u8H(jwr(w(wx
@x
_v]/(jxr(x(x(Axy
@y
`wm/(jyr(y(y(Ayz
@z
axI(jzr(z(z{
@{
byM/(j{r({({|
@|
czA0(j|r(y|(|(|(|(
|}
@}
d{0(j}r(y}(}(}(}(
}~
@~
e|J(j~r(y~(~(~(
~
@
f}/(jr((X(((

@
g~/(jr((X(((

@
hK(jr(y(((

@
i/(jr(y
@
j/(jr(y
@k((
@lJ((
@m4[((((
@Cn0((
@Co-0(((
@Cp=0(((
@	CqM0((
@
r@
@
sq
@t((
@uY(Y
@v(s(3
@w1	((((((((	(	
@x	((((((((	(	
@y]0
@(zc()
@9{'()(:(;(y(<
@|(((((<
@}2(((((
@~4((((((<
@^U(_(`D(m(<
@\( (!(<
@"k((((
@#4(((((<
@$F}(%r(&
@'*((()(*
@+
Y(,(-*(.
@/(0(1
@2t(3r(4
@5\( (!(<
@6:(j(7(8(9(:(;
@<g0(K(((
@=L (s(>(?(@(D(E3
@Fy(o(Gv(((M(N
@O(o(Gw(((M(N
@QN(R((S(T
@U.(R((S(T
@V(o(Gv(((M(N
@W(o(Gw(((M(N
@X(s((
@Yw0(s((
@Z"k((((
@[#4(((((<
@\0(((3
@]((=((^(_(	(
@`	$(~(=((|(m(q(r(s	(	
@a	$(~(=((|(m(q(r(s	(	
@b2((=((^(_(	(
@c0((d(e( (
@f0((d(e(( (
@g0((
@h0((i(j
@k0((l(	(m
@n0(((o
@p0(((q
@r1(3(
@s1((t((u
@vվ((=((^(_(	(
@w	$((=((|(m(q(r(s	(	
@x	$((=((|(m(q(r(s	(	
@yf(TC(V(W(X
@z'1((\(
@{71(TC(?
@|G1(}(
@~W1(|(1(2(3
@X(Y(
@#(
@X(x((y(z
@g1(((
@w1(y
@1(z
@1(((
@|(K(L(M
@(K(L(M
@(3(g(M
@(3(g(M
@
>({(|(}
@
3?(}(|({
@
x?(|(}
@
?(~(~(~
@
?(~(~(~
@
5`((\
@
`(*(\
@
a({(\(
@
<b({(\(
@
Lb((\(
@
b((\(
@
b(\(\([
@
b([(\(\
@
d(\(([
@
c([((\
@
+c(\({([
@
ac([({(\
@
c(\({([
@
c([({(\
@
d(\(([
@
c([((\
@
d(\(([
@
c([((\
@
c(\(
([
@
Kd([(
(\
@
d(\(
([
@
d([(
(\
@
D@((
@
@((
@sa(\(\
@sa(\(\
@
d(~(~
@
d(~(~
@
@(((
@
@
A((
@
LA(((
@
A(((
@&
@P
@y
@
@w((E((
@],((=((((	((	(	
(
(
@,((=((((	((	(	
(
(
@],((=((((	((	(	
(
(
@h,((=((((	((	(	
(
(
@(~(=(|((o(
@(~(=(|((o(
@j((
@_(
@D[(((
@
@'(3(g(M
@H(3(g(M
@q(((
@	(((
	
@	I(	

@

@(g
(
(
(

@	(g(((
@
m((

@
(
(
(
(
(
(
(

@`(((((((
@
(((( 
@!_(((( 
@"8(
@#,($(%(&
@+$($(%(&
@-P(Y((.(/(A
@0(Y((.(/(A
@1\(2((
@3((Q(
@4(5(C(6(-
@7(5(C(6(-
@8((Q(
@9((:
@>I((g(Q(
@?
(5( (C(6(-
@@(5( (C(6(-
@A((g(Q( 
@ B(C (5 (C (/ !
@!D(C!(5!(C!(/!"
@"E	 ("(g"(
"(F"(G"#
@#H
!:(#(g#(
#(F#(G#$
@$I"c($(g$(J$(
$(F$(G$%
@%K#
(%(g%(J%(
%(F%(G%&
@&L
$(M&(d&(,&'88<#X		,
	,
	,X	,X!	,"	,"	,#	,$	,%X'	,(X:	,;XL	,M	,M	,N	,O	,P	,QXY	,Z	,Z	,[	,\	,]Xu	,v	,v	,w	X		,	
X
	,(
X	,	,X	,	,	,

X
$	,
	,
	,
	,
X	,	,	,X 	,	,	,	,	,X	,	,	,	,	,	,X	,	,	,	,	,	,X 	,	,	,	,	,X	,	,	,=	,1	,	,X	,X	,
	,
	,	,	,X*	,X@	,	,	,A	,B	,C	,D	,E	,FXNx	,O0	,O0	,Q0	,[4	,\8	,]<	,^@	,_D	,`H		,	a
L
	,
bP	,cT	,dX
	,
e\	,f`	,gd	,hh	,il	,jpXP0	,Q	,Q	,R	,S	,
	,T	,U	,V	,W		,	Y
	,
Z(	,A,XXXn	,oXv	,oX	,	,	,	,XD	,	,	,<	,	,	,	,	,	,		,	 
	,
$	,(	,y,
	,
0	,2	,4	,8	,<	,@X	,	,	,	,	, X D	, 	, 	,< 	, 	, 	, 	, 	, 	, 		,	  
	,
 $	, (	,y ,
	,
 0	, 2	, 4	, 8	, <	, @!X!	,!	,!	,!"X"	,"	,"	,"#X#	,A#$X$	,$	,$	,$%X%	,A%&X&(
	,&	,&	,&	,&	,&	,&	,&	,&	,A&		,	 & 
	,
!&$'X'#(
	,'	,'	,'	,'	,'	,'	,'	,'	,A'		,	 ' 
	,
!'$(X(:8	,;(%	,;(%	,<(4)X)	,)	,)	,)	,)*X*	,*	,*	,*	,*+X+	,
+,X,	,,	,,	,,	,,-X-	,
-	,
-	,o-.X.$	,.	,.	, .	,./X/$	,/	,/	, /	,/0X0$$	,Y0	,Y0	,%0	,&0	,0	,`0	,'0 1X1M	,N1	,N1	,
1	,O1	,;1	,P1	,Q1	,R12X2W	,2	,2	,2	,X23X3n	,o3	,o3	,w34X4r	,s4
	,s4
	,t45X5w	,x5	,x56X6	,6	,6	,67X7	,7	,7	,78X8	,8	,8	,89X9	,9	,9	,9:X:|	,:	,:	,:'	,:P+;X;	,;	,;	,;N	,;R<X<	,s<
	,s<
	,t<=X=	,=	,=	,=	,=	,=>X>	,>?X?X	,?	,?	,?	,?	,?	,?	,?	,?$	,?(		,	?8
	,
?<	,?@	,?D
	,
?H	,?L	,?P	,?T@X@)	,=@	,=@	,*@	,+@A	,-@BAXA,BXB.CXCU	,CDXDa	,bDEXE	,E	,E	,EFFXF	,FGXG 	,G	,G	,G	,G	,G	,G	,GHXH	,H*	,H*	,HIXI 	,I*	,I*	,I*	,I	,I	,I	,IJXJ	,JKXK	,K	,K	,KHLXL
	,L	,L	,L	,L
	,ALMXM	,M	,M	,M*	,M
	,AMNXN	,N	,N	,N	,N
	,ANOXO	,O	,O	,O	,O
PXP#	,P	,P	,P*	,P
QXQ'	,(QR	,(QR	,+QS	,-QTRXR)	,R*	,R*	,*R*	,R	,ARSXS,	,S*	,S*	,*S*TXT.	,T	,T	,/TRUXU1	,2UV	,2UV	,5UV	,6UVVXV3	,4V	,4VWXW<	,W	,W	,=W	,2W*	,W	,3W	,>WXXXH	,IX	,IX	,XYXY_	,IY	,IY	,YZXZw	,Z	,Z[X[y	,z[\X\	,z\]X]<	,]	,]	,]	,]	,]	,]^$	,]4	,]8^X^$		,^	,^	,A^	,B^	,C^	,D^	,E^	,F^	,^		,	^ _X_<	,_	,_	,_	,_	,_	,_^$	,_4	,_8`X`	,`	,`	,L`	,`	,`	,^`	,`	,`aX	,`dp		,	`
	,
Q`	,`	,d`
	,
`	,`	,`	,,`aXaX	,ab0	,ab0	,a0	,a4	,a8	,aH	,aL	,ZaP	,acPbXb0cXcdXd	,Qd	,Qd	,
d	,de	,d	,d	,d	,d	,]d		,	^d 
	,
ed$	,d(	,d(
	,
d,	,dd0	,d4	,Ld8	,d<	,df@	,d	,d	,d	,d	,deXefXfgXg	,g	,g	,Lg	,g	,g	,^g	,g	,gaX	,gdp		,	g
	,
Qg	,g	,dg
	,
g	,g	,g	,,ghXh(	,h	,h	,8h	,h	,h	,h	,h 	,Xh$iXi	,i	,i	,ijXj0	,j	,j	,j	,j	,j	,j	,jk kXk	,k	,k	,k	,k	,k	,k	,k
	,k	,klXl<	,lmXm>	,mnXnO$		,n	,n	,n	,n	,n	,n	,Pn	,n	,n		,	 n oXoR$		,o	,o	,o	,o	,o	,o	,Po	,o	,o		,	 o pXpU	,Vp	,Vp	,Wp	,XpqXqZ	,Vq	,Vq	,Wq	,XqrXrm	,rsXs	,s	,s	,s	,s	,stXt	,t	,t	,t	,t	,tuXuA	,BuvXvH(	,v	,v	,Iv	,Jv	,Kv	,v 	,Lv$wXwP(	,w	,w	,Iw	,Jw	,Kw	,w 	,Lw$xXx	,BxyXy	,y	,y	,yzXz	,z	,z	,z{X{	,z{	,z{|X|	,z|	,z|}X}	,z}	,z}~X~	,~	,~	,~	,~X	,z}	,z}X	,z}	,z}X	,	,	,J	,I	,X	,	,	,J	,I	,X'	,d	,d	,(	,)	,*X,	,d	,d	,(	,)	,*X;	,	,	,<	,=q8M<unnamed-tag>.<unnamed-type-AppName>A_SHAFinalA_SHAInitA_SHAUpdate*AbortSystemShutdownA*AbortSystemShutdownWJAccessAccessCheck.4AccessCheckAndAuditAlarmA64AccessCheckAndAuditAlarmW7$AccessCheckByType?@AccessCheckByTypeAndAuditAlarmAB@AccessCheckByTypeAndAuditAlarmWC8AccessCheckByTypeResultListFTAccessCheckByTypeResultListAndAuditAlarmAGdAccessCheckByTypeResultListAndAuditAlarmByHandleAHdAccessCheckByTypeResultListAndAuditAlarmByHandleWITAccessCheckByTypeResultListAndAuditAlarmWAccessGrantedSAccessMaskAccessMode$AccessPermissions-AccessStatusE"AccessStatusListAccountHandle*AccountNameAccountSiduAceCntPAceCountVAceFlagsmAceTypeAclMAclRevisionOAclSize0ActivationStateCallbackSActivityIdJ(AddAccessAllowedAceU,AddAccessAllowedAceExW4AddAccessAllowedObjectAce_&AddAccessDeniedAce`*AddAccessDeniedAceExa2AddAccessDeniedObjectAcebAddAcef$AddAuditAccessAcej(AddAuditAccessAceExk0AddAuditAccessObjectAcel$AddConditionalAce(AddInputp AddMandatoryAce-"AddMultipleInput6$AddMultipleOutput2AddOutputr0AddUsersToEncryptedFilex4AddUsersToEncryptedFileEx{$AdjustTokenGroups,AdjustTokenPrivilegesaAgeLimitiAlgidWAllPrivilegesUAllRights2AllocateAndInitializeSid0AllocateLocallyUniqueId8AllowOrDenytAncestorName,AreAllAccessesGranted,AreAnyAccessesGranted
Args[AsSelfAttributeCountAttributesAuditCategory$AuditCategoryGuid AuditCategoryIdBAuditComputeEffectivePolicyBySidFAuditComputeEffectivePolicyByToken2AuditEnumerateCategories8AuditEnumeratePerUserPolicy8AuditEnumerateSubCategoriesAuditFreeLAuditLookupCategoryGuidFromCategoryIdLAuditLookupCategoryIdFromCategoryGuid2AuditLookupCategoryNameA2AuditLookupCategoryNameW8AuditLookupSubCategoryNameA8AuditLookupSubCategoryNameW,AuditQueryGlobalSaclA,AuditQueryGlobalSaclW0AuditQueryPerUserPolicy&AuditQuerySecurity.AuditQuerySystemPolicy(AuditSetGlobalSaclA(AuditSetGlobalSaclW,AuditSetPerUserPolicy"AuditSetSecurity*AuditSetSystemPolicyAuditSidArray*AuditSubCategoryGuid@AuditType(AuditingInformationAuthIdentity4AuthenticationInformationAuthnLevelAuthnSvcAuthzSvc"AutoInheritFlags BackupEventLogA BackupEventLogWBackupFileName
BlobBlobSizeBlockKeyBootAcceptableBootTime4Branch name 'win7sp1_rtm'BufferBufferCallbackBufferContextBufferLengthQBufferSizeBuffersLostBuffersReadeBuffersWritten:BuildExplicitAccessWithNameA:BuildExplicitAccessWithNameWPBuildImpersonateExplicitAccessWithNameAPBuildImpersonateExplicitAccessWithNameW2BuildImpersonateTrusteeA2BuildImpersonateTrusteeW2BuildSecurityDescriptorA2BuildSecurityDescriptorW,BuildTrusteeWithNameA,BuildTrusteeWithNameW@BuildTrusteeWithObjectsAndNameA@BuildTrusteeWithObjectsAndNameW>BuildTrusteeWithObjectsAndSidA>BuildTrusteeWithObjectsAndSidW*BuildTrusteeWithSidA	*BuildTrusteeWithSidW:CRYPTSP.CheckSignatureInFile$CallStateCallbackCCallbackd CallbackContextCallbacks
.CancelOverlappedAccess,ChangeServiceConfig2A,ChangeServiceConfig2W*ChangeServiceConfigA!*ChangeServiceConfigWOChannel]CheckOnly"*CheckTokenMembershipClearBlock<0ClearCredentialBlobSizeClearData%ClearEventLogA&ClearEventLogW($ClientAccessTokenZClientContextClientToken'(CloseCodeAuthzLevel+,CloseEncryptedFileRaw-CloseEventLog.&CloseServiceHandle08CloseThreadWaitChainSession2CloseTrace2CodeAuthzPolicyInfoClass^CollisionInfo6CommandLine4:CommandLineFromMsiDescriptor7$CommandLineLengthComment8JComputeAccessTokenFromCodeAuthzLevelnConditionStrContainer,Context)Controli,ControlBitsOfInterestj"ControlBitsToSetControlCodeControlFlagsControlGuid=ControlServiceG$ControlServiceExAI$ControlServiceExWJControlTraceAkControlTraceWlFConvertAccessToSecurityDescriptorAuFConvertAccessToSecurityDescriptorWw>ConvertSDToStringSDRootDomainA|>ConvertSDToStringSDRootDomainW}FConvertSecurityDescriptorToAccessAPConvertSecurityDescriptorToAccessNamedAPConvertSecurityDescriptorToAccessNamedWFConvertSecurityDescriptorToAccessWjConvertSecurityDescriptorToStringSecurityDescriptorAjConvertSecurityDescriptorToStringSecurityDescriptorW.ConvertSidToStringSidA.ConvertSidToStringSidW6ConvertStringSDToSDDomainA6ConvertStringSDToSDDomainW>ConvertStringSDToSDRootDomainA>ConvertStringSDToSDRootDomainWjConvertStringSecurityDescriptorToSecurityDescriptorAjConvertStringSecurityDescriptorToSecurityDescriptorW.ConvertStringSidToSidA.ConvertStringSidToSidWTConvertToAutoInheritPrivateObjectSecurityCopySidCountUCountLostCountOfRightsCountReturnedCounterBlockCounterIdCounterList CounterSetArrayCounterSetGuidCpuSpeedInMHz*CreateCodeAuthzLevel8CreatePrivateObjectSecurity<CreatePrivateObjectSecurityExfCreatePrivateObjectSecurityWithMultipleInheritance*CreateProcessAsUserA*CreateProcessAsUserW0CreateProcessWithLogonW0CreateProcessWithTokenW,CreateRestrictedTokenCreateServiceACreateServiceW,CreateTraceInstanceId&CreateWellKnownSid$CreatorDescriptor;
Cred,CredBackupCredentialsCredDeleteACredDeleteW@CredEncryptAndMarshalBinaryBlobCredEnumerateA
CredEnumerateW0CredFindBestCredentialA0CredFindBestCredentialWCredFree(CredGetSessionTypes&CredGetTargetInfoA"&CredGetTargetInfoW$6CredIsMarshaledCredentialA&6CredIsMarshaledCredentialW'"CredIsProtectedA*"CredIsProtectedW+.CredMarshalCredentialA-.CredMarshalCredentialW.$CredProfileLoaded/(CredProfileUnloaded0CredProtectA6CredProtectW7CredReadA8,CredReadByTokenHandle=6CredReadDomainCredentialsA>6CredReadDomainCredentialsW?CredReadW@CredRenameACCredRenameWD.CredRestoreCredentials,CredType CredTypeCount!CredTypesE2CredUnmarshalCredentialAF2CredUnmarshalCredentialWGCredUnprotectAICredUnprotectWJCredWriteAK8CredWriteDomainCredentialsAL8CredWriteDomainCredentialsWMCredWriteWCredential
CredentialBlob	&CredentialBlobSizeCredentialsN.CredpConvertCredentialS<CredpConvertOneCredentialSizeT.CredpConvertTargetInfoX,CredpDecodeCredentialY,CredpEncodeCredentialZ$CredpEncodeSecret_*CryptAcquireContextAd*CryptAcquireContextWe&CryptContextAddRefh CryptCreateHashlCryptDecryptqCryptDeriveKeyt"CryptDestroyHashu CryptDestroyKeyv&CryptDuplicateHashw$CryptDuplicateKeyxCryptEncryptz0CryptEnumProviderTypesA0CryptEnumProviderTypesW(CryptEnumProvidersA(CryptEnumProvidersWCryptExportKeyCryptGenKeyCryptGenRandom2CryptGetDefaultProviderA2CryptGetDefaultProviderW$CryptGetHashParam"CryptGetKeyParam$CryptGetProvParam CryptGetUserKeyCryptHashData(CryptHashSessionKeyCryptImportKey(CryptReleaseContext$CryptSetHashParam"CryptSetKeyParam$CryptSetProvParam$CryptSetProviderA(CryptSetProviderExA(CryptSetProviderExW$CryptSetProviderWCryptSignHashACryptSignHashW,CryptVerifySignatureA,CryptVerifySignatureWCurrentEvent4CurrentSecurityDescriptorCurrentTimeMCurrentValueN(CurrentValueSetTimeCypherBlockCypherData
DataZData1[Data2\Data3]Data42DataBlockGuid DataBlockHandleJDataItemIdDataKey$DataLmOwfPasswordDataSizeDecryptFileADecryptFileWDeleteAce*DeletePrivilegeCountDeleteService/ DeliveryContext.DeliveryInfo,DeregisterEventSource5Descriptor"DescriptorLengthDesiredAccess:DestroyPrivateObjectSecurityDevInstDirPathDisable*DisableAllPrivileges DisableSidCountDisplayNameDnsDomainNameDnsServerNameDnsTreeNamePDoDecodeDomainIndexDomainNameDomainSidDomainsDstFileName8DuplicateEncryptionInfoFileDuplicateToken"DuplicateTokenEx*DuplicateTokenHandle.ElfBackupEventLogFileA.ElfBackupEventLogFileW ElfChangeNotify,ElfClearEventLogFileA,ElfClearEventLogFileW"ElfCloseEventLog2ElfDeregisterEventSource"ElfFlushEventLog&ElfNumberOfRecords ElfOldestRecord.ElfOpenBackupEventLogA.ElfOpenBackupEventLogW"ElfOpenEventLogA"ElfOpenEventLogW"ElfReadEventLogA"ElfReadEventLogW0ElfRegisterEventSourceA0ElfRegisterEventSourceW ElfReportEventA2ElfReportEventAndSourceW ElfReportEventWEnable"EnableFilterDescEnableFlag`EnableFlagsEnableLevel"EnableParametersEnablePropertyEnableTraceEnableTraceExEnableTraceEx2EncryptFileAEncryptFileW9(EncryptedCredential	*EncryptedFileKeyInfo.EncryptedLmOwfPassword.EncryptedNtOwfPassword$EncryptionDisableEndTimeEntries.EnumDependentServicesA.EnumDependentServicesW$EnumServiceGroupW(EnumServicesStatusA,EnumServicesStatusExA ,EnumServicesStatusExW!(EnumServicesStatusW"(EnumerateTraceGuids),EnumerateTraceGuidsEx&EnumerationContext/EqualDomainSid3EqualPrefixSid4EqualSid4ErrorCodeEvent5&EventAccessControl9"EventAccessQuery:$EventAccessRemove;.EventActivityIdControlEventCallbackEventCategoryL EventDescriptor=EventEnabledEventID?*EventProviderEnabled(EventRecordCallbackAEventRegisterEventTimeEventTypeC EventUnregisterEEventWriteG,EventWriteEndScenarioIEventWriteExJ"EventWriteExStubY0EventWriteStartScenario["EventWriteString]&EventWriteTransferdEventsLost(ExistingTokenHandlecExportCallback_,FileEncryptionStatusAa,FileEncryptionStatusWFileHandleFileName-FilePathFilledFilternFinalb"FindFirstFreeAceAFlagsFlatNamedFlushEfsCache_FlushTimerfFlushTraceAhFlushTraceWG ForestTrustInfocFreeBuffersi2FreeEncryptedFileKeyInfok4FreeEncryptedFileMetadatamDFreeEncryptionCertificateHashListp.FreeInheritedFromArrayyFreeSid GenerateOnClosesGenerationGap%GenericAll$GenericExecute GenericMapping"GenericRead#GenericWritez>GetAccessPermissionsForObjectA>GetAccessPermissionsForObjectWGetAce$GetAclInformation<GetAuditedPermissionsFromAclA<GetAuditedPermissionsFromAclW*GetCurrentHwProfileA*GetCurrentHwProfileW6GetEffectiveRightsFromAclA6GetEffectiveRightsFromAclW2GetEncryptedFileMetadata.GetEventLogInformation6GetExplicitEntriesFromAclA6GetExplicitEntriesFromAclW"GetFileSecurityA"GetFileSecurityW<GetInformationCodeAuthzLevelW>GetInformationCodeAuthzPolicyW,GetInheritanceSourceA,GetInheritanceSourceW0GetKernelObjectSecurityGetLengthSid>GetLocalManagedApplicationData8GetLocalManagedApplications@GetManagedApplicationCategories.GetManagedApplications(GetMultipleTrusteeA:GetMultipleTrusteeOperationA:GetMultipleTrusteeOperationW(GetMultipleTrusteeW,GetNamedSecurityInfoA0GetNamedSecurityInfoExA0GetNamedSecurityInfoExW,GetNamedSecurityInfoW6GetNumberOfEventLogRecords0GetOldestEventLogRecord6GetOverlappedAccessResults2GetPrivateObjectSecurity:GetSecurityDescriptorControl4GetSecurityDescriptorDacl6GetSecurityDescriptorGroup
8GetSecurityDescriptorLength6GetSecurityDescriptorOwner>GetSecurityDescriptorRMControl4GetSecurityDescriptorSacl GetSecurityInfo&GetSecurityInfoExA&GetSecurityInfoExW.GetServiceDisplayNameA.GetServiceDisplayNameW&GetServiceKeyNameA&GetServiceKeyNameW 4GetSidIdentifierAuthority!*GetSidLengthRequired"&GetSidSubAuthority$0GetSidSubAuthorityCount%&GetThreadWaitChain0(GetTokenInformation4(GetTraceEnableFlags6(GetTraceEnableLevel8*GetTraceLoggerHandle: GetTrusteeFormA; GetTrusteeFormW< GetTrusteeNameA= GetTrusteeNameW> GetTrusteeTypeA? GetTrusteeTypeW@GetUserNameACGetUserNameWD6GetWindowsAccountDomainSidGpoId,GrantedAccessD$GrantedAccessListGroupCountGroupsY
GuidGuidCount:GuidInfoGuidList#(GuidPropertiesArray%GuidType>HINSTANCE__mHKEY__<HWND__HandleBHandleArrayCHandleCount0HandleId5HandleListjHashAlgorithmHeaderHighPartS$HistoricalContextG,I_QueryTagInformation
4I_ScGetCurrentGroupStateWI,I_ScIsSecurityProcessK,I_ScPnPGetServiceNameM.I_ScQueryServiceConfigO&I_ScSendPnPMessageQ$I_ScSendTSMessageS(I_ScSetServiceBitsAZ(I_ScSetServiceBitsW[.I_ScValidatePnPServiceNId]0IdentifyCodeAuthzLevelWIdleTaskIdgImageHashdImagePathiImageSizen4ImpersonateAnonymousTokenp0ImpersonateLoggedOnUserq6ImpersonateNamedPipeClients ImpersonateSelf&ImpersonationLevelMImportCallback:InAccessToken+InBuffer,InBufferSizeQInCredential6 InOutBufferSizeUInTargetInfo$IncomingAuthInfosDIncomingAuthenticationInformationIndexInfoBuffer$InfoBufferRetSizeInfoBufferSize
InfoClassInfoLevelE"InformationClass$InformationLengthInheritance^0InheritedObjectTypeGuid0InheritedObjectTypeNametInitializeAclw:InitializeSecurityDescriptorxInitializeSidy$InitiateShutdownA~$InitiateShutdownW0InitiateSystemShutdownA4InitiateSystemShutdownExA4InitiateSystemShutdownExW0InitiateSystemShutdownW"InputValueBuffer*InputValueBufferSize&InstallApplicationInstanceIdInstanceIndexInstanceListgInstanceName&InstanceNameLength InstanceNames$IsContainerObject/IsCycle$IsDirectoryObject'IsEnable=IsEventOnly<IsExpensiveIsKernelTrace$IsMemberIsTextUnicode$IsTokenRestricted"IsTokenUntrustedIsValidAclDIsValidRelativeSecurityDescriptor4IsValidSecurityDescriptorIsValidSidIsWellKnownSidItHandleq6KERNELBASE.AddMandatoryAceZKERNELBASE.IsValidRelativeSecurityDescriptorKeepExplicitVKernelHandleKeyInfo"KeyLmOwfPasswordYKeyNameRKeywordLanguage"LanguageReturnedLastWrittenLength;LevelLevelHandleTLinkageLmChallenge"LmNewOwfPassword"LmOldOwfPasswordLmOldPresentLmOwfPasswordLmPassword{LmPresentLmResponseLmSessionKey+LockObject(LockServiceDatabasefLogBuffersLost^LogFileModeLogFileNamei$LogFileNameOffsetLogHandle LogInstanceGuidLogNameLogfileLogfileHeaderFLoggerCountKLoggerHandle&LoggerIdLLoggerNamej"LoggerNameOffsethLoggerThreadIdLogonUserALogonUserExALogonUserExExWLogonUserExWLogonUserW&LookupAccountNameA&LookupAccountNameW$LookupAccountSidA$LookupAccountSidW
LookupLevelLookupOptions8LookupPrivilegeDisplayNameA8LookupPrivilegeDisplayNameW*LookupPrivilegeNameA*LookupPrivilegeNameW,LookupPrivilegeValueA,LookupPrivilegeValueW>LookupSecurityDescriptorPartsA>LookupSecurityDescriptorPartsWLowPart(LsaAddAccountRights4LsaAddPrivilegesToAccount"LsaClearAuditLogLsaClose"LsaCreateAccount LsaCreateSecret.LsaCreateTrustedDomain2LsaCreateTrustedDomainExLsaDelete.LsaDeleteTrustedDomain4LsaEnumerateAccountRights*LsaEnumerateAccountsDLsaEnumerateAccountsWithUserRight.LsaEnumeratePrivileges@LsaEnumeratePrivilegesOfAccount6LsaEnumerateTrustedDomains:LsaEnumerateTrustedDomainsExLsaFreeMemory.LsaGetQuotasForAccount*LsaGetRemoteUserName4LsaGetSystemAccessAccountLsaGetUserName"LsaICLookupNames4LsaICLookupNamesWithCreds LsaICLookupSids2LsaICLookupSidsWithCredsLsaLookupNames LsaLookupNames2<LsaLookupPrivilegeDisplayName .LsaLookupPrivilegeName!0LsaLookupPrivilegeValue"LsaLookupSids$0LsaManageSidNameMapping7,LsaNtStatusToWinError9LsaOpenAccount:LsaOpenPolicy?"LsaOpenPolicySce@LsaOpenSecretA*LsaOpenTrustedDomainB6LsaOpenTrustedDomainByNameD@LsaQueryDomainInformationPolicyF>LsaQueryForestTrustInformationJ4LsaQueryInfoTrustedDomainK4LsaQueryInformationPolicyLLsaQuerySecretQ.LsaQuerySecurityObjectR4LsaQueryTrustedDomainInfoS@LsaQueryTrustedDomainInfoByNameT.LsaRemoveAccountRightsV>LsaRemovePrivilegesFromAccountX.LsaRetrievePrivateData[<LsaSetDomainInformationPolicy\:LsaSetForestTrustInformation`0LsaSetInformationPolicya>LsaSetInformationTrustedDomainb.LsaSetQuotasForAccountcLsaSetSecretd*LsaSetSecurityObjecte4LsaSetSystemAccessAccountf<LsaSetTrustedDomainInfoByNameg>LsaSetTrustedDomainInformationh(LsaStorePrivateData
LuidiMD4FinalkMD4InitmMD4UpdateoMD5FinalqMD5InitsMD5Update'"MOFRESOURCEINFOA,"MOFRESOURCEINFOW~0MSChapSrvChangePasswordu2MSChapSrvChangePassword2MakeAbsoluteSD MakeAbsoluteSD2&MakeSelfRelativeSDMapGenericMaskMappedCount/Mappings%(MarshaledCredential MarshaledString MatchAllKeyword MatchAnyKeyword\MaximumBuffers] MaximumFileSizeMaximumLengthMaximumPersist(MaximumPersistCount,MaximumWorkingSetSizeMemoryMemorySize,MethodDataBlockHandleMethodId&MethodInstanceName.MinNumberOfBytesNeeded[MinimumBuffers,MinimumWorkingSetSized.ModificationDescriptorModuleNameMofDataMofLength%"MofResourceCount$$MofResourceHandle& MofResourceInfo2MultipleTrusteeOperation"NTDLL.A_SHAFinal NTDLL.A_SHAInit$NTDLL.A_SHAUpdatejNTDLL.MD4FinallNTDLL.MD4Initn NTDLL.MD4UpdatepNTDLL.MD5FinalrNTDLL.MD5Initt NTDLL.MD5Update
NameNameUnknownNames$NetbiosDomainName$NetbiosServerNameNewDescriptor|<NewPasswordEncryptedWithOldLmv<NewPasswordEncryptedWithOldNt,NewSecurityDescriptor~NewStateBNewTargetNameNewTokenHandle'NodeCount(NodeInfoArray$NonPagedPoolLimit.NotifyBootConfigStatus*NotifyChangeEventLog4NotifyServiceStatusChange6NotifyServiceStatusChangeA6NotifyServiceStatusChangeWNtChallenge"NtNewOwfPassword"NtOldOwfPasswordNtOwfPasswordNtOwfPassword1NtOwfPassword2NtPasswordNtResponseNtSessionKeyNumStrings"NumberCharactersb NumberOfBuffers$NumberOfBytesRead(NumberOfBytesToRead&NumberOfProcessors NumberOfRecordsbOS version '7601.x86fre.win7sp1_rtm.101119-1850';"ObjectAttributes.ObjectCloseAuditAlarmA.ObjectCloseAuditAlarmW4ObjectCreation0ObjectDeleteAuditAlarmA0ObjectDeleteAuditAlarmW"ObjectDescriptorObjectHandle2ObjectName,ObjectOpenAuditAlarmA,ObjectOpenAuditAlarmW6ObjectPrivilegeAuditAlarmA6ObjectPrivilegeAuditAlarmW*ObjectStatus=ObjectTypeXObjectTypeGuid9ObjectTypeList>*ObjectTypeListLength1ObjectTypeNameObjectTypesObjectsPresente4ObjectsSecurityDescriptorSOldAcl}NOldLmOwfPasswordEncryptedWithNewLmOrNtxFOldNtOwfPasswordEncryptedWithNewNtAOldTargetNameOOldValueP OldValueSetTimeOldestRecord&OldestRecordNumberPOpcodeOpenAsSelf(OpenBackupEventLogA(OpenBackupEventLogW,OpenEncryptedFileRawA,OpenEncryptedFileRawWOpenEventLogAOpenEventLogWOpenFlags"OpenProcessTokenOpenSCManagerAOpenSCManagerWOpenServiceAOpenServiceW OpenThreadToken6OpenThreadWaitChainSessionOpenTraceAOpenTraceW6Operation&OperationInput0 OperationOutput%OperationTypeOptionFlags;OutAccessToken-OutBuffer.OutBufferSizeROutCredentialVOutTargetInfoW$OutTargetInfoSizeOutputBuffer"OutputBufferSizePackageNamePagedPoolLimitPagefileLimit"ParentDescriptorParentGuid"ParentInstanceId PerfAddCounters*PerfCloseQueryHandle&PerfCreateInstance>PerfDecrementULongCounterValueFPerfDecrementULongLongCounterValue&PerfDeleteCounters&PerfDeleteInstance0PerfEnumerateCounterSetBPerfEnumerateCounterSetInstancesPerfFreq>PerfIncrementULongCounterValue	FPerfIncrementULongLongCounterValue(PerfOpenQueryHandle
*PerfQueryCounterData*PerfQueryCounterInfoHPerfQueryCounterSetRegistrationInfo#$PerfQueryInstance%.PerfSetCounterRefValue',PerfSetCounterSetInfo)2PerfSetULongCounterValue+:PerfSetULongLongCounterValue-$PerfStartProvider/(PerfStartProviderEx1"PerfStopProvider PerfTime100NSecPerfTimeStampPersistxPlaceholderPointerSizePolicyHandle,PreferedMaximumLengthPreviousState8"PrincipalSelfSidZPrivateData*Privilege3PrivilegeCheck(PrivilegeCount&PrivilegeSet+&PrivilegeSetLength6:PrivilegedServiceAuditAlarmA8:PrivilegedServiceAuditAlarmWPrivileges&PrivilegesToDeleteProcessHandle9"ProcessIdleTasks:$ProcessIdleTasksWAProcessTrace"ProcessTraceModeProductCodeProductId,ProgressInvokeSettingMPropertiesEPropertyArray(&PropertyArrayCount5ProtectionTypeK&ProvSpecificAccess
ProviderRProviderId ProviderVersionPtrD QueryAllTracesAG QueryAllTracesWHFQueryRecoveryAgentsOnEncryptedFileJ0QuerySecurityAccessMaskK*QueryServiceConfig2AL*QueryServiceConfig2WM(QueryServiceConfigAQ(QueryServiceConfigWS0QueryServiceLockStatusAY0QueryServiceLockStatusW[6QueryServiceObjectSecurity]&QueryServiceStatus^*QueryServiceStatusEx_QueryTraceA`QueryTraceWa4QueryUsersOnEncryptedFileQuotaLimitsRMControlRandomBuffer&RandomBufferLengthb*ReadEncryptedFileRaweReadEventLogAkReadEventLogWReadFlagsg(RealTimeBuffersLostIRecordCountRecordNumberRedirHandle*ReferencedDomainName$ReferencedDomainslRegCloseKeyn(RegConnectRegistryAp,RegConnectRegistryExAq,RegConnectRegistryExWr(RegConnectRegistryWsRegCopyTreeAwRegCopyTreeWxRegCreateKeyAz RegCreateKeyExA RegCreateKeyExW0RegCreateKeyTransactedA0RegCreateKeyTransactedWRegCreateKeyWRegDeleteKeyA RegDeleteKeyExA RegDeleteKeyExW0RegDeleteKeyTransactedA0RegDeleteKeyTransactedW&RegDeleteKeyValueA&RegDeleteKeyValueWRegDeleteKeyWRegDeleteTreeARegDeleteTreeW RegDeleteValueA RegDeleteValueW4RegDisablePredefinedCache8RegDisablePredefinedCacheEx0RegDisableReflectionKey.RegEnableReflectionKeyRegEnumKeyARegEnumKeyExARegEnumKeyExWRegEnumKeyWRegEnumValueARegEnumValueWRegFlushKey$RegGetKeySecurityRegGetValueARegGetValueWKRegHandleRegLoadAppKeyARegLoadAppKeyWRegLoadKeyARegLoadKeyW$RegLoadMUIStringA$RegLoadMUIStringW0RegNotifyChangeKeyValue&RegOpenCurrentUserRegOpenKeyARegOpenKeyExARegOpenKeyExW,RegOpenKeyTransactedA,RegOpenKeyTransactedWRegOpenKeyW.RegOpenUserClassesRoot*RegOverridePredefKey"RegQueryInfoKeyA"RegQueryInfoKeyW0RegQueryMultipleValuesA0RegQueryMultipleValuesW,RegQueryReflectionKeyRegQueryValueA"RegQueryValueExA"RegQueryValueExWRegQueryValueWRegRenameKeyRegReplaceKeyARegReplaceKeyWRegRestoreKeyARegRestoreKeyWRegSaveKeyARegSaveKeyExARegSaveKeyExWRegSaveKeyW$RegSetKeySecurity RegSetKeyValueA RegSetKeyValueWRegSetValueARegSetValueExARegSetValueExWRegSetValueWRegUnLoadKeyARegUnLoadKeyWRegister*RegisterEventSourceA*RegisterEventSourceW"RegisterIdleTask8RegisterServiceCtrlHandlerA<RegisterServiceCtrlHandlerExA<RegisterServiceCtrlHandlerExW	8RegisterServiceCtrlHandlerW
(RegisterTraceGuidsA(RegisterTraceGuidsW:RegisterWaitChainCOMCallbackT$RelatedActivityIdRelativeId+RemoveInput5RemoveOutput(RemoveTraceCallback:RemoveUsersFromEncryptedFileReportEventAReportEventW RequestCode! RequestLanguage*RequestedInformationy4RequestedStringSDRevision4&RequiredPrivilegesXReservedReserved1Reserved2ReservedFlags}ResetToDefault*ResourceBuffer(ResourceName)ResourceSize&RestrictedSidCount(ResultantDescriptoroReturnLengthRevertToSelf7Rights=RootDirectoryxRootDomainSid"RpcBindingHandle"RpcContextHandle**SAFER_LEVEL_HANDLE__SC_HANDLE__U0SERVICE_STATUS_HANDLE__( SaferCloseLevel96SaferComputeTokenFromLevel"SaferCreateLevel2SaferGetLevelInformation4SaferGetPolicyInformation^&SaferIdentifyLevel2SaferRecordEventLogEntry"2SaferSetLevelInformation#4SaferSetPolicyInformation$4SaferiChangeRegistryScope'2SaferiCompareTokenLevels+&SaferiIsDllAllowed/6SaferiIsExecutableFileType2BSaferiPopulateDefaultsInRegistry54SaferiRecordEventLogEntry6SaferiRegisterExtensionDll6<SaferiSearchMatchingHashRules<SbzN
Sbz1Q
Sbz2ScLock\SecretSecretBlobSecretHandleSecretNameSecretSize3&SecurityDescriptor.SecurityDescriptorSizeSecurityInfo(SecurityInformation>2SecurityQualityOfService)$ServerAccessTokenServerName(ServerPrincipalNameServerRevision7ServiceNameServiceStatusSessionHandle<$SetAclInformation=2SetEncryptedFileMetadataF0SetEntriesInAccessListAO0SetEntriesInAccessListWQ"SetEntriesInAclAU"SetEntriesInAclWV.SetEntriesInAuditListAW.SetEntriesInAuditListWX"SetFileSecurityAY"SetFileSecurityWZ<SetInformationCodeAuthzLevelW[>SetInformationCodeAuthzPolicyW\0SetKernelObjectSecurity],SetNamedSecurityInfoA`0SetNamedSecurityInfoExAa0SetNamedSecurityInfoExWb,SetNamedSecurityInfoWc2SetPrivateObjectSecurityf6SetPrivateObjectSecurityExg,SetSecurityAccessMaskh:SetSecurityDescriptorControlk4SetSecurityDescriptorDacln6SetSecurityDescriptorGroupp6SetSecurityDescriptorOwnerr>SetSecurityDescriptorRMControls4SetSecurityDescriptorSaclv SetSecurityInfow&SetSecurityInfoExAx&SetSecurityInfoExWySetServiceBitsz2SetServiceObjectSecurity{"SetServiceStatus|SetThreadToken~(SetTokenInformation"SetTraceCallback2SetUserFileEncryptionKey6SetUserFileEncryptionKeyExSid#SidToCheck	
SidsSidsToDisableSidsToRestrict
SizeSourceId
SpecSrcFileNameSrpIsAllowedStartBuffersStartEventStartServiceA8StartServiceCtrlDispatcherA8StartServiceCtrlDispatcherWStartServiceWStartTimeStartTraceAStartTraceW8StatusStopEventStopTraceAStopTraceW"StringSDRevisionz2StringSecurityDescriptor{8StringSecurityDescriptorLenStringSidStrings/SubsystemNameSupportUrlSystemAccess$SystemFunction001$SystemFunction002$SystemFunction003$SystemFunction004$SystemFunction005$SystemFunction006$SystemFunction007$SystemFunction008$SystemFunction009$SystemFunction010$SystemFunction011$SystemFunction012$SystemFunction013$SystemFunction014$SystemFunction015$SystemFunction016$SystemFunction017$SystemFunction018$SystemFunction019$SystemFunction020$SystemFunction021$SystemFunction022$SystemFunction023$SystemFunction024$SystemFunction025$SystemFunction026$SystemFunction027$SystemFunction028$SystemFunction029$SystemFunction030$SystemFunction031$SystemFunction032$SystemFunction033$SystemFunction034$SystemFunction035$SystemFunction036$SystemFunction040$SystemFunction041SystemNameSystemTimeTargetInfoTargetNameQ
Task}ThreadoThreadHandle&ThreadId-ThreadObjectTimeLimitWTimeStampTimeWrittenTimeZoneTimeout TimerResolutionToken|TokenHandle2"TokenInformation1,TokenInformationClass3.TokenInformationLengthTokenTypeTraceEvent&TraceEventInstance3TraceHandle"TraceInformationTraceMessageTraceMessageVa*(TraceQueryInfoClass(TraceSetInformation8TreeResetNamedSecurityInfoA8TreeResetNamedSecurityInfoW4TreeSetNamedSecurityInfoA4TreeSetNamedSecurityInfoW TrustAttributesTrustDirectionTrustType(TrustedDomainHandle2TrustedDomainInformationC$TrustedDomainName"TrustedDomainSidTrustee.TrusteeAccessToObjectA.TrusteeAccessToObjectWTrusteeFormTrusteeType
TypeUNCServerNameUNCSourceName*UninstallApplication,UnlockServiceDatabase&UnregisterIdleTask*UnregisterTraceGuidsUpdateTraceAUpdateTraceWfUrlZoneIdUse2UsePinForEncryptedFilesA	2UsePinForEncryptedFilesWVUserDataUUserDataCountUserNameUserRightUserRightsUserSessionKeyUserSidUserSidArray UserTokenHandleUsersCountValueGValueBufferF ValueBufferSize
VersionVersionDetail1WctHandle"WellKnownSidTypeWmiCloseBlock
4WmiDevInstToInstanceNameA4WmiDevInstToInstanceNameW$WmiEnumerateGuids$WmiExecuteMethodA$WmiExecuteMethodW:WmiFileHandleToInstanceNameA!:WmiFileHandleToInstanceNameW"WmiFreeBuffer#4WmiMofEnumerateResourcesA+4WmiMofEnumerateResourcesW-:WmiNotificationRegistrationA0:WmiNotificationRegistrationW1WmiOpenBlock3"WmiQueryAllDataA42WmiQueryAllDataMultipleA72WmiQueryAllDataMultipleW8"WmiQueryAllDataW90WmiQueryGuidInformation>0WmiQuerySingleInstanceA?@WmiQuerySingleInstanceMultipleA@@WmiQuerySingleInstanceMultipleWA0WmiQuerySingleInstanceWB2WmiReceiveNotificationsAD2WmiReceiveNotificationsWE,WmiSetSingleInstanceAH,WmiSetSingleInstanceWI$WmiSetSingleItemAK$WmiSetSingleItemWOWnodeL,WriteEncryptedFileRawO
WtoAL
_ACLH*_ACTRL_ACCESS_ENTRYAP*_ACTRL_ACCESS_ENTRYW(_ACTRL_ACCESS_INFOA(_ACTRL_ACCESS_INFOWn_ACTRL_ALISTAv_ACTRL_ALISTW*_ACTRL_CONTROL_INFOA*_ACTRL_CONTROL_INFOW$_ACTRL_OVERLAPPED*_APPCATEGORYINFOLIST4_AUDIT_POLICY_INFORMATION_BLOCK_KEY_CLEAR_BLOCK_CREDENTIALA_CREDENTIALW@_CREDENTIAL_TARGET_INFORMATIONA#@_CREDENTIAL_TARGET_INFORMATIONW_CRYPT_BUFFER_CYPHER_BLOCK_EFS_RPC_BLOB2_ENABLE_TRACE_PARAMETERS:._ENCRYPTED_CREDENTIALWy6_ENCRYPTED_LM_OWF_PASSWORD0_ENCRYPTION_CERTIFICATEA:_ENCRYPTION_CERTIFICATE_HASHnD_ENCRYPTION_CERTIFICATE_HASH_LISTu:_ENCRYPTION_CERTIFICATE_LIST,_ENUM_SERVICE_STATUSA,_ENUM_SERVICE_STATUSW(_ETW_BUFFER_CONTEXTW._EVENT_DATA_DESCRIPTORM$_EVENT_DESCRIPTOR2_EVENT_FILTER_DESCRIPTOR_EVENT_TRACE(_EVENT_TRACE_HEADER,_EVENT_TRACE_LOGFILEA,_EVENT_TRACE_LOGFILEWN0_EVENT_TRACE_PROPERTIES&_EXPLICIT_ACCESS_A&_EXPLICIT_ACCESS_W_FILETIMEw2_FN_OBJECT_MGR_FUNCTIONS!"_GENERIC_MAPPINGY_GUID"_INHERITED_FROMAr"_INHERITED_FROMW_INSTALLDATA_INSTALLSPECX_LARGE_INTEGER"_LM_OWF_PASSWORD_LM_RESPONSE2_LOCALMANAGEDAPPLICATION_P_LSA_FOREST_TRUST_COLLISION_INFORMATIONH<_LSA_FOREST_TRUST_INFORMATION8_LSA_REFERENCED_DOMAIN_LIST)T_LSA_SID_NAME_MAPPING_OPERATION_ADD_INPUT.f_LSA_SID_NAME_MAPPING_OPERATION_ADD_MULTIPLE_INPUT3^_LSA_SID_NAME_MAPPING_OPERATION_GENERIC_OUTPUT'L_LSA_SID_NAME_MAPPING_OPERATION_INPUT1N_LSA_SID_NAME_MAPPING_OPERATION_OUTPUT,Z_LSA_SID_NAME_MAPPING_OPERATION_REMOVE_INPUT#*_LSA_TRANSLATED_NAME0_LSA_TRANSLATED_NAME_EX(_LSA_TRANSLATED_SID*_LSA_TRANSLATED_SID2
0_LSA_TRANSLATED_SID_EX2._LSA_TRUST_INFORMATION_LUID*_LUID_AND_ATTRIBUTES(_MANAGEDAPPLICATION(_OBJECTS_AND_NAME_W"_OBJECTS_AND_SID<&_OBJECT_ATTRIBUTES:$_OBJECT_TYPE_LIST2_PERF_COUNTER_IDENTIFIER$_PERF_DATA_HEADER,_PERF_INSTANCE_HEADER0_POLICY_AUDIT_SID_ARRAY'_PRIVILEGE_SET*_PROCESS_INFORMATIONO._QUERY_SERVICE_CONFIGAR._QUERY_SERVICE_CONFIGWU8_QUERY_SERVICE_LOCK_STATUSAZ8_QUERY_SERVICE_LOCK_STATUSW_QUOTA_LIMITSa._SAFER_CODE_PROPERTIESw>_SAMPR_ENCRYPTED_USER_PASSWORD*_SECURITY_ATTRIBUTES&_SERVICE_NOTIFY_2A&_SERVICE_NOTIFY_2W@ _SERVICE_STATUS0_SERVICE_STATUS_PROCESS,_SERVICE_TABLE_ENTRYA,_SERVICE_TABLE_ENTRYW(_SID_AND_ATTRIBUTES4_SID_IDENTIFIER_AUTHORITY	2_SRP_EXTENSION_CALLBACKS_STARTUPINFOA_STARTUPINFOW_STRING_SYSTEMTIME._TIME_ZONE_INFORMATION_TOKEN_GROUPS$_TOKEN_PRIVILEGES$._TRACE_GUID_PROPERTIES,_TRACE_LOGFILE_HEADERB_TRUSTED_DOMAIN_AUTH_INFORMATION>_TRUSTED_DOMAIN_INFORMATION_EX_TRUSTEE_A"_TRUSTEE_ACCESSA"_TRUSTEE_ACCESSW_TRUSTEE_W _UNICODE_STRING$_USER_SESSION_KEY)*_WAITCHAIN_NODE_INFO,~_WAITCHAIN_NODE_INFO::<unnamed-tag>::<unnamed-type-LockObject>._WAITCHAIN_NODE_INFO::<unnamed-tag>::<unnamed-type-ThreadObject>;(_WMIGUIDINFORMATIONP_WNODE_HEADERadvapi32.dllHnapi-ms-win-service-winsvc-l1-1-0.I_QueryTagInformationJnapi-ms-win-service-winsvc-l1-1-0.I_ScIsSecurityProcessLnapi-ms-win-service-winsvc-l1-1-0.I_ScPnPGetServiceNameNpapi-ms-win-service-winsvc-l1-1-0.I_ScQueryServiceConfigPhapi-ms-win-service-winsvc-l1-1-0.I_ScSendPnPMessageRfapi-ms-win-service-winsvc-l1-1-0.I_ScSendTSMessage\papi-ms-win-service-winsvc-l1-1-0.I_ScValidatePnPServiceibAuditFailurehbAuditSuccessmbDaclDefaultedlbDaclPresent"bForceAppsClosed1$bFromShellExecuteo bGroupDefaultedbInheritHandle bInheritHandlesbInstalled,bIsReflectionDisabledq bOwnerDefaulted*bRebootAfterShutdown4bRetrieveAllSubCategoriesubSaclDefaultedtbSaclPresentWbSetBitsOnX&bUpdateImmediatelybUserAppscCategory,cCountOfAccessEntries*cCountOfAuditEntriesR0cCountOfExplicitEntriesocEntriescallbackcbcbBufSize
cbDataFcbDomainSidcbHashcbNamecbOutBufcbReserved2cbSidbcbSizeBcbTotalLength3cchCredentialscchDisplayNamecchNameH0cchProtectedCredentials0cchReferencedDomainNamez
datagdwAccessMaskdwAceIndexRdwAceRevision,dwAclInformationClassvdwAclRevisiondwActiondwAttributesdwBlobTypeydwBufLendwCapabilitiescdwCheckFlagsEdwCheckPoint>dwControlB&dwControlsAccepted.dwCreationDistribution dwCreationFlagsAdwCurrentStatedwDataLendwDataSize dwDesiredAccessdwDockInfodwErrorControldwEventID dwFillAttributeydwFlags8dwHashSizedwHighDateTimeh dwImageHashSizedwInBufferSizedwInSize{dwIndexdwInfoLeveldwInfoType&dwKeyOptionsdwKeySpecdwLendwLevelIdXdwLockDurationdwLogonFlags dwLogonProviderdwLogonTypedwLowDateTime*dwNotificationStatus0dwNotificationTriggereddwNotifyFilterdwNotifyMaskdwNumCounters_ dwNumProperties"dwNumServiceArgsDdwOperation|dwOptions9(dwOriginalImageSizedwParamdwPathTypedwPolicyCountdwProcessIdcdwProvTypedwQueryFlagsfdwReadFlags}dwReasongdwRecordOffsetdwRecoverydwReserveddwRevisiondwScopeId\,dwSecurityInformationVdwServiceBitsdwServiceFlagsD4dwServiceSpecificExitCodedwServiceStatedwServiceType| dwShutdownFlagsdwSigLendwSizedwStartTypec&dwStartingAceIndexdwStatedwStatusPdwTagIddwThreadId{dwTimeoutdwTotalSizedwTypedwVersiondwVersionHidwVersionLoFdwWaitHintC dwWin32ExitCodedwXdwXCountCharsdwXSizedwYdwYCountCharsdwYSizeIfAccessFlags$fAccessPermission1fAsSelffAsynchronousVfIsLocked fReturnedAccess&fWaitForCompletionfWatchSubtreefnProgressgrfAccessMode*grfAccessPermissionsgrfInheritance hAuthzLevelhBaserhBaseDatahEventhEventLoghExistingTokenhExpKey,hFilemhHashe"hImageFileHandle=hInstancej
hKey3hKeyBase%hKeyCustomRootvhKeyDestthKeySrc)hLevelObjectrhNamedPipehNewKeyhObjecthProcess.hProcessTokenfhProvhPubKeyhQueryhSCManager/hSCObjecthServiceThServiceStatushStdErrorhStdInputhStdOutputhThreadhTokenhTransactionlhWndParenthandle
hkey;
hwndiSizeldwTotsize.lpAccessPermissionNamelpAccountName$lpApplicationName"lpBinaryPathNamelpBuffer{lpClasslpCommandLinelpContextlpControlIdlpControlName&lpCurrentDirectorylpDatalpDatabaseNamelpDependencieslpDesktop lpDisplayNamelpDomainlpEnvironmentlpFileslpFileNameslpGrouplpHandlerProc lpHwProfileInfolpInfoL$lpInheritPropertylpKeyNamelpLanguageId"lpLoadOrderGroupWlpLockOwnerTlpLockStatuslpLuidlpMachineNamezlpMessagelpNamelpNewFilelpNewKeyName~lpObject{lpObjectTypelpOldFilerlpOwnerlpPassword(lpProcessAttributes*lpProcessInformationlpProperty|lpProviderlpQueryBufferlpRawData.lpReferencedDomainName<lpReservedlpReserved2lpResumeIndex*lpSecurityAttributes*lpSecurityDescriptor(lpServiceArgVectorsN lpServiceConfiglpServiceNamelpServiceProc&lpServiceStartName(lpServiceStartTable? lpServiceStatuslpServices&lpServicesReturnedlpSidlpStartupInfo`lpStatuslpStringsylpSubKeylpSubKeyNameulpSubKeySrclpSystemName&lpThreadAttributeslpTitle$lpTokenAttributeslpTypelpUserSidlpUsernamelpValueBuflpValueName
"lpbDaclDefaultedlpbDaclPresent$lpbGroupDefaulted$lpbOwnerDefaulted"lpbSaclDefaultedlpbSaclPresentlpcSubKeyslpcValueslpcbClasslpcbData lpcbMaxClassLen"lpcbMaxSubKeyLen lpcbMaxValueLen(lpcbMaxValueNameLenlpcbName.lpcbSecurityDescriptorlpcbValueNamelpcchBufferFlpdwAbsoluteSecurityDescriptorSize"lpdwBufferLengthlpdwBufferSizelpdwDaclSize~ lpdwDisposition$lpdwOutBufferSizelpdwOwnerSize*lpdwPrimaryGroupSizelpdwRevisionlpdwSaclSizelpdwTagIdlpdwType$lpftLastWriteTimelpiResult lpnLengthNeededlppGrouplppOwnerlpszDomainlpszPasswordlpszUsernamelpvenAceListLength,nAclInformationLengthunAclLengthonCert_Hash@nCmdShow,nDestinationSidLengthnLengthh*nNumberOfBytesToRead#nSubAuthoritynSubAuthority0nSubAuthority1nSubAuthority2nSubAuthority3nSubAuthority4nSubAuthority5nSubAuthority6nSubAuthority7&nSubAuthorityCountvnUsers>ntdll.EtwCreateTraceInstanceId<@ntdll.EtwEventActivityIdControl>,ntdll.EtwEventEnabled@<ntdll.EtwEventProviderEnabledB.ntdll.EtwEventRegisterD2ntdll.EtwEventUnregisterF(ntdll.EtwEventWriteH>ntdll.EtwEventWriteEndScenarioZBntdll.EtwEventWriteStartScenario\4ntdll.EtwEventWriteString^8ntdll.EtwEventWriteTransfer5:ntdll.EtwGetTraceEnableFlags7:ntdll.EtwGetTraceEnableLevel9<ntdll.EtwGetTraceLoggerHandle.ntdll.EtwLogTraceEvent:ntdll.EtwRegisterTraceGuidsA
:ntdll.EtwRegisterTraceGuidsW8ntdll.EtwTraceEventInstance,ntdll.EtwTraceMessage0ntdll.EtwTraceMessageVa<ntdll.EtwUnregisterTraceGuidsnum_valsvo:\w7rtm.obj.x86fre\mergedcomponents\advapi32\objfre\i386\o:\w7rtm.obj.x86fre\mergedcomponents\advapi32\objfre\i386\advapi32.pdb8pAbsoluteSecurityDescriptorG"pAccessEntryListmpAccessListpAccessRightsc
pAcedpAceListK
pAcl pAclInformationpAppCategory&pAuditCategoryGuidqpAuditListpAuditPolicyApBufferkpByteBlockpCategorypCategoryInfoE&pCertificatesAdded` pCodePropertiespComputerNameUpContextpControlHpControlParams	pDaclpData pDestinationSidEpDomainSid]pEncodedSecret^&pEncodedSecretSize.pEncryptionCertificatet0pEncryptionCertificates pExplicitAccess&pExtendedParameter&pFailedAuditRights pGenericMappingpGrouppGuid7pHashBytespHashes*pIdentifierAuthority(pImpersonateTrusteeqpInheritArray*pInheritedObjectGuidpInstallData
pKeyjpKeyInfompLevelHandlepLevelObject*pListOfAccessEntries(pListOfAuditEntries.pListOfExplicitEntries"pMultipleTrusteepNameTpNewAclpNewSDpNotifyBufferpObjNamepObjSid$pObjectClassGuidspObjectGuidpObjectName pObjectTypeGuidMpOldListpOldSDpOverlappedpOwner@pOwnerHashpPrimaryGroupp(pPropertyAccessList) pProtectionTypepQuotaLimitsI pRecoveryAgents"pRegInfopResultpSDpSaclpSecDescriptor(pSecurityDescriptor@pSelfRelativeSecurityDescriptorT
pSid0pSid11pSid2pSizeNewSDpSourceSid$pSubCategoryGuids2pSuccessfulAuditedRightspTokenGroupspTrusteepTrusteeAccesspTrusteeNameCpUserSidwpUsers
paclpbBufferopbDatapbHashlpbMetadata?pbNewMetadata>pbOldMetadata4pbSetDefaultspbSignature.pcCountOfAccessEntries,pcCountOfAuditEntries2pcCountOfExplicitEntries}pcEntries"pcItemsProcessedpcRightsBpcbBufferpcbBytesNeededpcbDatapcbMetadatapcbProvName~pcbTypeName4pcchMaxChars2pcwum.PerfCreateInstanceJpcwum.PerfDecrementULongCounterValueRpcwum.PerfDecrementULongLongCounterValue2pcwum.PerfDeleteInstanceJpcwum.PerfIncrementULongCounterValue
Rpcwum.PerfIncrementULongLongCounterValue$0pcwum.PerfQueryInstance&:pcwum.PerfSetCounterRefValue(8pcwum.PerfSetCounterSetInfo*>pcwum.PerfSetULongCounterValue,Fpcwum.PerfSetULongLongCounterValue.0pcwum.PerfStartProvider04pcwum.PerfStartProviderEx2.pcwum.PerfStopProviderpdwApps"pdwCountReturnedpdwCounterSet pdwCurrentStateppdwDataLen:pdwFoundLevelpdwOutSize"pdwProfileLength|pdwProvTypegpdwReserved*pdwResult;pdwSaferFlagspdwSigLenpdwTypepeUsepfAccessFlags2pfEqual5$pfGenerateOnClose5pfResultvpfnArray$pfnNotifyCallbackkphHashsphKeyphNewToken`phProvphQueryphTokenphUserKeyophkResultipnBytesReadj2pnMinNumberOfBytesNeeded~"ppAccessInfoListppAccessList.ppAuditCategoriesArrayppAuditListppAuditPolicy4ppAuditSubCategoriesArrayppDaclppGroup,ppListOfAccessEntries*ppListOfAuditEntriesppLogonSidNppNewListppNewSDppOwner ppProfileBufferppRightsListppSaclt ppSecDescriptor*ppSecurityDescriptorppbMetadatappsidGroupppsidOwner"ppszCategoryName$ppszCategoryNameA(ppszSubCategoryName*ppszSubCategoryNameAprgLocalAppsprgManagedApps_psidGroup^psidOwner?pszCmdLinepszCommentspszCompanypszContact2pszCredentials$pszDeploymentNamepszDirectorypszGroupNamepszOutBufpszOwnerpszPackageNamepszPolicyNamepszProductId(0pszProtectedCredentialspszProvNamepszPublisher pszServiceNamespszSubKeypszSupportUrlY"pszTransportNamepszValueptstrNamepvDatazpvReservedpwszSubKeypwszValuesDescription}samDesiredaszContainer0szFullPathname szHwProfileGuid szHwProfileNameszMachineszPINszProvNamebszProvider!szTargetPath}szTypeName(tagHW_PROFILE_INFOA(tagHW_PROFILE_INFOWunusedval_listvalue_entAvalue_entWve_typeve_valuelenve_valuenameve_valueptrwCategory
wDaywDayOfWeekwHourwMillisecondswMinutewMonthwNumStringswSecondwShowWindowwTypewYear
wszPINewszServerName

Anon7 - 2022
AnonSec Team