| Server IP : 209.209.40.120 / Your IP : 216.73.217.112 Web Server : Microsoft-IIS/10.0 System : Windows NT NEWWWW 10.0 build 17763 (Windows Server 2019) i586 User : NEWWWW$ ( 0) PHP Version : 8.3.30 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : C:/Program Files (x86)/Windows Kits/10/Lib/10.0.19041.0/um/arm64/ |
Upload File : |
!<arch>
/ 1606894062 0 4365 `
� #4 #4 #4 #4 #4 #4 #4 #4 #4 D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� D� q q q q q q q q q q q q q q q q q q q q q q q q q M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� M� � � � � � � �??_C@_13JOFGPIOO@?$AA?4@ ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4@ ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc@ ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG@ ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg@ EVENTLOG_HANDLE_A_bind EVENTLOG_HANDLE_A_unbind EVENTLOG_HANDLE_W_bind EVENTLOG_HANDLE_W_unbind ??_C@_08EDKKPLCC@Security@ ??_C@_0M@NJALGCHB@Application@ ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy@ CHANNEL_POLICY_APPLICATION_ERROR EVENTLOG EVENTLOG_Context EVENT_ABNORMAL_SHUTDOWN EVENT_AUDIT_AUTO_BACKUP EVENT_AUDIT_EVENTS_DROPPED EVENT_AUDIT_FAILURE EVENT_AUDIT_LOG_CLEARED EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL EVENT_AUDIT_LOG_FULL EVENT_AUDIT_PROCESSING EVENT_AUDIT_PUBLISHER_META_DATA EVENT_AUTO_BACKUP EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY EVENT_EVENTS_DROPPED EVENT_LOG_CLEARED EVENT_LOG_FULL EVENT_OPENEVENTLOG EVENT_PROCESSING EVENT_PUBLISHER_META_DATA EVENT_PUBLISHER_TLG_INVALID_META_DATA EVENT_PULLSUB_CREATE EVENT_PUSHSUB_CREATE EVENT_REGISTEREVENTSOURCE EVENT_REPORTEVENT EVENT_REPORTEVENT_ANSI EVENT_SHUTDOWN ElfAssertThreadPrivilege ElfBackupEventLogFileA ElfBackupEventLogFileW ElfChangeNotify ElfClearEventLogFileA ElfClearEventLogFileW ElfCloseEventLog ElfCreateReconnInfo ElfDeregisterClusterSvc ElfDeregisterEventSource ElfDestroyReconnectionInfo ElfFlushEventLog ElfGetLogInformation ElfGetModuleName ElfGetTheRpcHandle ElfGetUseLegacyReportEvent ElfNumberOfRecords ElfOldestRecord ElfOpenBackupEventLogA ElfOpenBackupEventLogW ElfOpenEventLogA ElfOpenEventLogW ElfReadEventLogA ElfReadEventLogW ElfReconnect ElfRegisterClusterSvc ElfRegisterEventSourceA ElfRegisterEventSourceW ElfReportEventA ElfReportEventAndSourceW ElfReportEventW ElfRevertThreadPrivilege ElfSetUseLegacyReportEvent ElfWriteClusterEvents EventDataDescCreate INIT_CHANNEL INIT_CHANNEL_CONFIG_ERROR INIT_CHANNEL_LOGFILE_WARNING INIT_CHANNEL_LOGFILTER_WARNING INIT_CHANNEL_LOGGING INIT_CHANNEL_MOVED_CORRUPT_LOG INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE INIT_CHANNEL_PUBLISHING LOG_DROPPED_CHUNK McGenControlCallbackV2 McGenEventRegister_EtwEventRegister McGenEventUnregister_EtwEventUnregister McGenEventWrite_EtwEventWriteTransfer McGenLevelKeywordEnabled McTemplateU0usr0_EtwEventWriteTransfer McTemplateU0uzr0_EtwEventWriteTransfer Microsoft_Windows_EventlogEnableBits Microsoft_Windows_EventlogKeywords Microsoft_Windows_EventlogLevels NtCurrentTeb PRIMARY_CHANNEL_CONFIGURATION_WARNING PRIMARY_CHANNEL_FATAL_ERROR WevtInitialize BackupEventLogA BackupEventLogW BaseSetLastNTError CheckEventLogBuffer ClearEventLogA ClearEventLogW CloseEventLog DeregisterEventSource GetEventLogInformation GetNumberOfEventLogRecords GetOldestEventLogRecord InitAnsiString InitUnicodeString NotifyChangeEventLog OpenBackupEventLogA OpenBackupEventLogW OpenEventLogA OpenEventLogW ReadEventLogA ReadEventLogW RegisterEventSourceA RegisterEventSourceW ReportEventA ReportEventW StringCheck ElfrBackupELFA ElfrBackupELFW ElfrChangeNotify ElfrClearELFA ElfrClearELFW ElfrCloseEL ElfrDeregisterClusterSvc ElfrDeregisterEventSource ElfrFlushEL ElfrGetLogInformation ElfrNumberOfRecords ElfrOldestRecord ElfrOpenBELA ElfrOpenBELW ElfrOpenELA ElfrOpenELW ElfrReadELA ElfrReadELW ElfrRegisterClusterSvc ElfrRegisterEventSourceA ElfrRegisterEventSourceW ElfrReportEventA ElfrReportEventAndSourceW ElfrReportEventExA ElfrReportEventExW ElfrReportEventW ElfrWriteClusterEvents eventlog_ClientIfHandle ??_C@_13CGOKJPIL@?$AA?1@ ??_C@_13FPGAJAPJ@?$AA?2@ ??_C@_15MNCACJLI@?$AA?2?$AA?1@ RtlAlternateDosPathSeperatorString RtlDosPathSeperatorsString RtlNtPathSeperatorString __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinGEUkivxlnkOlyq@elfapi
/ 1606894062 0 4073 `
4# �D q �M � � ??_C@_08EDKKPLCC@Security@ ??_C@_0M@NJALGCHB@Application@ ??_C@_13CGOKJPIL@?$AA?1@ ??_C@_13FPGAJAPJ@?$AA?2@ ??_C@_13JOFGPIOO@?$AA?4@ ??_C@_15MNCACJLI@?$AA?2?$AA?1@ ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4@ ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc@ ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy@ ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG@ ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg@ BackupEventLogA BackupEventLogW BaseSetLastNTError CHANNEL_POLICY_APPLICATION_ERROR CheckEventLogBuffer ClearEventLogA ClearEventLogW CloseEventLog DeregisterEventSource EVENTLOG EVENTLOG_Context EVENTLOG_HANDLE_A_bind EVENTLOG_HANDLE_A_unbind EVENTLOG_HANDLE_W_bind EVENTLOG_HANDLE_W_unbind EVENT_ABNORMAL_SHUTDOWN EVENT_AUDIT_AUTO_BACKUP EVENT_AUDIT_EVENTS_DROPPED EVENT_AUDIT_FAILURE EVENT_AUDIT_LOG_CLEARED EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL EVENT_AUDIT_LOG_FULL EVENT_AUDIT_PROCESSING EVENT_AUDIT_PUBLISHER_META_DATA EVENT_AUTO_BACKUP EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY EVENT_EVENTS_DROPPED EVENT_LOG_CLEARED EVENT_LOG_FULL EVENT_OPENEVENTLOG EVENT_PROCESSING EVENT_PUBLISHER_META_DATA EVENT_PUBLISHER_TLG_INVALID_META_DATA EVENT_PULLSUB_CREATE EVENT_PUSHSUB_CREATE EVENT_REGISTEREVENTSOURCE EVENT_REPORTEVENT EVENT_REPORTEVENT_ANSI EVENT_SHUTDOWN ElfAssertThreadPrivilege ElfBackupEventLogFileA ElfBackupEventLogFileW ElfChangeNotify ElfClearEventLogFileA ElfClearEventLogFileW ElfCloseEventLog ElfCreateReconnInfo ElfDeregisterClusterSvc ElfDeregisterEventSource ElfDestroyReconnectionInfo ElfFlushEventLog ElfGetLogInformation ElfGetModuleName ElfGetTheRpcHandle ElfGetUseLegacyReportEvent ElfNumberOfRecords ElfOldestRecord ElfOpenBackupEventLogA ElfOpenBackupEventLogW ElfOpenEventLogA ElfOpenEventLogW ElfReadEventLogA ElfReadEventLogW ElfReconnect ElfRegisterClusterSvc ElfRegisterEventSourceA ElfRegisterEventSourceW ElfReportEventA ElfReportEventAndSourceW ElfReportEventW ElfRevertThreadPrivilege ElfSetUseLegacyReportEvent ElfWriteClusterEvents ElfrBackupELFA ElfrBackupELFW ElfrChangeNotify ElfrClearELFA ElfrClearELFW ElfrCloseEL ElfrDeregisterClusterSvc ElfrDeregisterEventSource ElfrFlushEL ElfrGetLogInformation ElfrNumberOfRecords ElfrOldestRecord ElfrOpenBELA ElfrOpenBELW ElfrOpenELA ElfrOpenELW ElfrReadELA ElfrReadELW ElfrRegisterClusterSvc ElfrRegisterEventSourceA ElfrRegisterEventSourceW ElfrReportEventA ElfrReportEventAndSourceW ElfrReportEventExA ElfrReportEventExW ElfrReportEventW ElfrWriteClusterEvents EventDataDescCreate GetEventLogInformation GetNumberOfEventLogRecords GetOldestEventLogRecord INIT_CHANNEL INIT_CHANNEL_CONFIG_ERROR INIT_CHANNEL_LOGFILE_WARNING INIT_CHANNEL_LOGFILTER_WARNING INIT_CHANNEL_LOGGING INIT_CHANNEL_MOVED_CORRUPT_LOG INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE INIT_CHANNEL_PUBLISHING InitAnsiString InitUnicodeString LOG_DROPPED_CHUNK McGenControlCallbackV2 McGenEventRegister_EtwEventRegister McGenEventUnregister_EtwEventUnregister McGenEventWrite_EtwEventWriteTransfer McGenLevelKeywordEnabled McTemplateU0usr0_EtwEventWriteTransfer McTemplateU0uzr0_EtwEventWriteTransfer Microsoft_Windows_EventlogEnableBits Microsoft_Windows_EventlogKeywords Microsoft_Windows_EventlogLevels NotifyChangeEventLog NtCurrentTeb OpenBackupEventLogA OpenBackupEventLogW OpenEventLogA OpenEventLogW PRIMARY_CHANNEL_CONFIGURATION_WARNING PRIMARY_CHANNEL_FATAL_ERROR ReadEventLogA ReadEventLogW RegisterEventSourceA RegisterEventSourceW ReportEventA ReportEventW RtlAlternateDosPathSeperatorString RtlDosPathSeperatorsString RtlNtPathSeperatorString StringCheck WevtInitialize __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinGEUkivxlnkOlyq@elfapi eventlog_ClientIfHandle
// 1606894062 0 384 `
d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\rpcbind.obj d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\apistub.obj d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\eventapi.obj d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\elf_client.obj d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\precomp.obj /0 1606894062 100666 8529 `
d� �A�_V B .debug$S � @ B.rdata � @@@.rdata � @0@.rdata � @@@.rdata @@@.rdata @@@.text$mn � 0 � @`.debug$S D � : @B.text$mn * 2 @`.debug$S 4 < p
@B.text$mn � �
� @`.debug$S l ^ � @B.text$mn � � @`.debug$S 4 < @B.pdata � � @0@.pdata � � @0@.debug$T � � @ B.chks64 � X
.drectve n �
� � R d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\rpcbind.obj : < � � k k
Microsoft (R) Optimizing Compiler � ` : s ����o� }�+4qt*Y lռ��́dq�X � N~ط �K��� �h��-l��A��D�� � � onecore\admin\wmi\events\advapi\objfre\arm64\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\arm64\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\admin\wmi\events\advapi\rpcbind.c � L_ \ \ . . e v e n t l o g n c a l r p c E V E N T L O G � ��{��� � � � ���� �� � ?� � �� � ���" �R� ��C � ?�`�7�@� � � � ���� ��C � ?��� ��{è�A��_� $ ( L . P T � � < G � t �^ �EVENTLOG_HANDLE_A_bind >p ServerName EQ EQ @ � >x ServerNameU EQ t > bindingHandle AE ` AE t >~ ServerNameA EQ t > Status A
D 0 $
Z �^ @ B! @ p Q ServerName x Q ServerNameU ~ Q ServerNameA 9 �^ 9@ �^ 9d �^ O � X � 8 L � � � �$ � �D � �H � �P � �h � �p � �, , 0 ,
k , o ,
, � ,
� , � ,
� , � ,
� , � ,
, ,
, , 0 ,
� , � ,
� , � ,
� , � ,
� , � ,
�� � � > G �^ �EVENTLOG_HANDLE_A_unbind >p ServerName EQ > BindingHandle EQ
Z �^ B! p Q ServerName Q BindingHandle O� ( 8 � � � �, + 0 +
m + q +
� + � +
+ +
� ��{��� �� �� �s � � � �� 4h@y� 4 � ��� � 4 � ��C � ���� � � � � � �! � ����c � �� �� �� ?� 5 � ��@� ����C � ?� � � ���� *�c � ?�s 5� @� ��{¨�A��_� / 0 4 < / D H X ` d h l p t � � � � � � < G � � �^ �EVENTLOG_HANDLE_W_bind >q ServerName AE � AE � EQ ( � EQ ���� > bindingHandle EQ � > status A
� A � A
� A � >q sb EQ �
Z �^ 0 B! ( q Q ServerName Q bindingHandle q Q sb 9� �^ 9� �^ 9� �^ O � x � 8 l 9 � : � A �D \ �\ a �` F �� M �� O �� Q �� S �� b �� Y �, . 0 .
g . k .
w . { .
� . � .
� . � .
� . � .
� . � .
� . .
. .
. .
= . A .
� . � .
� . � .
� . � .
� . � .
�� � � > G �^ �EVENTLOG_HANDLE_W_unbind >q ServerName EQ > BindingHandle EQ
Z �^ B! q Q ServerName Q BindingHandle O� ( 8 { � ~ �, - 0 -
m - q -
� - � -
- -
� a 0 � � 3 V �N cm�U%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\arm64\precomp.obj �� q �^ & �^ EVENTLOG_HANDLE_W_unbind ��� p �^ & �^ EVENTLOG_HANDLE_A_unbind ���
�^ �^ RpcpUnbindRpc ��
q �^ " �^ EVENTLOG_HANDLE_W_bind �
q q q �^ �^ �^ RpcpBindRpc q q q q q .Z �^
�^ q �^ �^
�^
.Z �^
�^
p �^ " �^ EVENTLOG_HANDLE_A_bind �
| �^ �^
�^
{ v �^ �^
�^
�
���
���
���
���� -FC -MT -wd4746 -volatile:ms -Oy- -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427
�^ Z �^ -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X �^ �^ �^ �^ _ ��n;0��Y�,k:Qӌ�E��Y7�3dxe� �}�K�< �>1T�_+�p)6��x� �9y�����C�L�1�6�z4�K�z(�M�gm�B@�%t��C�L�1�{�Rw��"i~'��!� ��(��\���� -INCLUDE:__@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinGEUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� .debug$S � e .rdata �(9 e .rdata
��@ e ) .rdata ;�na e B .rdata �֗] e .rdata �d�� e � � 2 J X d y � .text$mn � ��� e .debug$S D e .text$mn �)Y e .debug$S
4 e .text$mn � �hM e .debug$S l e .text$mn
�)Y e .debug$S 4
e � � �
wcscmp $LN8 $LN1 t $LN5 p $LN9 $LN1 � $LN5 � $LN7 � $LN3 ` .pdata ��
� e .pdata fԡ^ e 9 .debug$T � e .chks64 � e W ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4@ ??_C@_13JOFGPIOO@?$AA?4@ ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg@ ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc@ ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG@ __imp_RtlFreeUnicodeString __imp_RtlAnsiStringToUnicodeString __imp_RtlInitAnsiString RpcpUnbindRpc RpcpBindRpc __imp_RpcStringFreeW __imp_RpcBindingFromStringBindingW __imp_RpcStringBindingComposeW EVENTLOG_HANDLE_A_unbind EVENTLOG_HANDLE_A_bind EVENTLOG_HANDLE_W_unbind EVENTLOG_HANDLE_W_bind $pdata$EVENTLOG_HANDLE_A_bind $pdata$EVENTLOG_HANDLE_W_bind
/76 1606894062 100666 142341 `
d�%�A�_�� J .debug$S � �- �3 @ B.rdata �3 @@@.rdata �3 @@@.rdata �3 @@@.data H �3 ;4 @P�.rdata
Y4 @@@.rdata h f4 @P@.rdata �4 @@@.rdata �4 @@@.rdata �4 @@@.rdata �4 @@@.rdata 5 @@@.rdata 5 @@@.rdata .5 @@@.rdata >5 @@@.rdata N5 @@@.rdata ^5 @@@.rdata n5 @@@.rdata ~5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata 6 @@@.rdata 6 @@@.rdata .6 @@@.rdata >6 @@@.rdata N6 @@@.rdata ^6 @@@.rdata n6 @@@.rdata ~6 @@@.rdata �6 @@@.rdata �6 @@@.rdata �6 @@@.rdata �6 @@@.rdata �6 @@@.rdata �6 @@@.rdata �6 @@@.rdata �6 @@@.rdata 7 @@@.rdata 7 @@@.text$mn � .7 �7 @`.debug$S � �7 �9 @B.text$mn � v: 6; @`.debug$S T �; �? , @B.text$x , �A �A 0`.text$mn � �A �B @`.debug$S T �B 6G , @B.text$x , �H I 0`.text$mn � .I �I @`.debug$S JJ jO . @B.text$x , 6Q bQ 0`.text$mn � vQ R @`.debug$S jR vV & @B.text$x , �W X 0`.text$mn � 2X �X @`.debug$S &Y 2] & @B.text$x , �^ �^ 0`.text$mn t �^ b_ @`.debug$S l �_ c $ @B.text$x 0 hd �d 0`.text$mn �d �f @`.debug$S � Xg l 6 @B.text$mn n @`.debug$S � (n o @B.text$mn t Lo �o @`.debug$S | �o ns $ @B.text$x 0 �t u 0`.text$mn h u �u @`.debug$S 4 �u �v @B.text$mn jw @`.debug$S � vw Nx @B.text$mn � �x by @`.debug$S � �y v > @B.text$x , � � 0`.text$mn $ "� @`.debug$S P F� �� @B.text$mn < � @`.debug$S @ "� b� @B.text$mn څ @`.debug$S � � ކ @B.text$mn � � ҇ @`.debug$S H "� j� , @B.text$x , "� N� 0`.text$mn � b� � @`.debug$S L j� �� , @B.text$x , n� �� 0`.text$mn � �� �� @`.debug$S � Ɩ �� 2 @B.text$x 0 �� ҝ 0`.text$mn � � ֞ @`.debug$S � �� �� 2 @B.text$x 0 � � 0`.text$mn � .� ֧ @`.debug$S � �� (� J @B.text$x , � 8� 0`.text$mn L� T� @`.debug$S � 0� Ⱦ P @B.text$x , � � 0`.text$mn (� @� @`.debug$S T �� �� N @B.text$x , �� � 0`.text$mn 0� H� @`.debug$S H �� �� L @B.text$x , �� � 0`.text$mn h � ��
@`.debug$S < �� � 0 @B.text$x 0 � 0� 0`.text$mn D� @`.debug$S p P� ��
@B.text$mn $� 4� @`.debug$S � �� � 8 @B.text$x 0 P� �� 0`.text$mn � �� � @`.debug$S � �� �� D @B.text$x , >� j� 0`.text$mn � ~� b� @`.debug$S �
� � � @B.text$x 4 � . 0`.text$mn B @`.debug$S d N � " @B.text$mn � � @`.debug$S � � X, � @B.text$x 4 �2 �2 0`.text$mn l 3 t3 @`.debug$S 8 �3 �4 @B.text$mn B5 @`.debug$S @ N5 �6 @B.text$mn �6 @`.debug$S � �6 j8
@B.text$mn �8 @`.debug$S p �8 J:
@B.text$mn �: �; @`.debug$S D �; ? @B.text$mn $ �? @ @`.debug$S ,@ <B @B.text$mn @ �B C @`.debug$S h 0C �D @B.text$mn H $E lE @`.debug$S @ �E �G @B.text$mn < `H @`.debug$S l �H J
@B.text$mn T lJ �J @`.debug$S � �J �M @B.text$mn \ ~N �N @`.debug$S � �N �Q @B.text$mn �R @`.debug$S � �R LS @B.text$mn P tS �S @`.debug$S � 2T �U @B.xdata 4 �V �V @0@.pdata �V �V @0@.xdata W @0@.pdata W $W @0@.xdata 0 8W hW @0@.pdata �W �W @0@.xdata �W @0@.pdata �W �W @0@.xdata , �W
X @0@.pdata <X DX @0@.xdata XX @0@.pdata dX lX @0@.xdata , �X �X @0@.pdata �X �X @0@.xdata �X @0@.pdata Y Y @0@.xdata ( "Y JY @0@.pdata |Y �Y @0@.xdata �Y @0@.pdata �Y �Y @0@.xdata ( �Y �Y @0@.pdata Z "Z @0@.xdata 6Z @0@.pdata BZ JZ @0@.xdata 0 ^Z �Z @0@.pdata �Z �Z @0@.xdata �Z @0@.pdata �Z �Z @0@.xdata 4 [ 8[ @0@.pdata j[ r[ @0@.xdata �[ @0@.pdata �[ �[ @0@.xdata 0 �[ �[ @0@.pdata \ \ @0@.xdata ,\ @0@.pdata 8\ @\ @0@.xdata $ T\ x\ @0@.pdata �\ �\ @0@.xdata �\ @0@.pdata �\ �\ @0@.xdata $ �\ ] @0@.pdata D] L] @0@.xdata `] @0@.pdata l] t] @0@.xdata , �] �] @0@.pdata �] �] @0@.xdata ^ @0@.pdata ^ ^ @0@.xdata , *^ V^ @0@.pdata �^ �^ @0@.xdata �^ @0@.pdata �^ �^ @0@.xdata ( �^ �^ @0@.pdata &_ ._ @0@.xdata B_ @0@.pdata N_ V_ @0@.xdata 0 j_ �_ @0@.pdata �_ �_ @0@.xdata �_ @0@.pdata �_ �_ @0@.xdata 0 ` @` @0@.pdata r` z` @0@.xdata �` @0@.pdata �` �` @0@.xdata 0 �` �` @0@.pdata a a @0@.xdata 4a @0@.pdata @a Ha @0@.xdata , \a �a @0@.pdata �a �a @0@.xdata �a @0@.pdata �a �a @0@.xdata , �a *b @0@.pdata \b db @0@.xdata xb @0@.pdata �b �b @0@.xdata , �b �b @0@.pdata �b c @0@.xdata c @0@.pdata &c .c @0@.pdata Bc Jc @0@.xdata ( Tc |c @0@.pdata �c �c @0@.xdata �c @0@.pdata �c �c @0@.pdata �c �c @0@.gfids$y d @0@.pdata d d @0@.pdata d "d @0@.pdata ,d 4d @0@.xdata >d Nd @0@.pdata Xd `d @0@.xdata td �d @0@.pdata �d �d @0@.pdata �d �d @0@.debug$S , �d �d @B.debug$S < �d 8e @B.debug$S @ Le �e @B.debug$S , �e �e @B.debug$S 4 �e f @B.debug$S < (f df @B.debug$S 0 xf �f @B.debug$S 4 �f �f @B.debug$S 0 g 4g @B.debug$S @ Hg �g @B.debug$S 4 �g �g @B.debug$S 8 �g h @B.debug$S , 0h \h @B.debug$S 4 ph �h @B.debug$S , �h �h @B.debug$S 4 �h ,i @B.debug$S 0 @i pi @B.debug$S 0 �i �i @B.debug$S 0 �i �i @B.debug$S @ j Lj @B.debug$S @ `j �j @B.debug$S 4 �j �j @B.debug$S , �j (k @B.debug$S , <k hk @B.debug$S , |k �k @B.debug$S 0 �k �k @B.debug$S 4 l 4l @B.debug$S , Hl tl @B.debug$S < �l �l @B.debug$S @ �l m @B.debug$S @ ,m lm @B.debug$S 8 �m �m @B.debug$S < �m n @B.debug$S 8 n Tn @B.debug$S H hn �n @B.debug$S < �n o @B.debug$S 0 o Do @B.debug$S 4 Xo �o @B.debug$S 4 �o �o @B.debug$S ( �o p @B.debug$S $ $p Hp @B.debug$T \p @ B.chks64 ( h�
.drectve n X�
� � R d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\apistub.obj : < � � k k
Microsoft (R) Optimizing Compiler � ? � ComputerNameNetBIOS " R_ ApiElfOpenBackupEventLogA # R_ ApiElfRegisterEventSourceA R_ ApiElfOpenEventLogA " R_ ApiElfOpenBackupEventLogW # R_ ApiElfRegisterEventSourceW R_ ApiElfOpenEventLogW � SecurityImpersonation 1
� Microsoft_Windows_EventlogEnableBits � B _ MCGEN_TRACE_CONTEXT �_ PMCGEN_TRACE_CONTEXT _ _MCGEN_TRACE_CONTEXT R_ ELF_API_TYPE �^ STRING_STORAGE �_ PSTRING_STORAGE _ PRIVILEGE_STATUS �_ PPRIVILEGE_STATUS _ tagPrivilegeStatus �_ PRECONN_INFO R_ tagElfApiType �^ tagStringStorage Y_ tagReconnInfo � � : s ����o� }�+4qt*Y lռ��́dq�X � . �<��� 5�)ڀ�~B�G?_�M�MZ��{� � �^h����j[�|�-� ������0f'�M{Ft 4(���+C�h5J$t�J���h 8�ϽgX�� / �l��ћ��o?� �O�����:Yt�� � X �^ � = �^ � ' �^ 8 �^ 8 , _ ` L_ ` � P_ ` w � R onecore\admin\wmi\events\advapi\objfre\arm64\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\arm64\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\admin\wmi\events\advapi\apistub.c onecore\admin\wmi\events\manifests\objfre\arm64\EventLogEvents.h onecore\external\shared\inc\evntprov.h onecore\external\sdk\inc\nxarm64.h � L�_ � 7 � 7
S e c u r i t y Application Security
0 7 8 @ @ = � � � � � � � @ @p �T
e @S
e @R
e @Q
i @P
e @O
e @N
h @M
e @L
g @� m � m � m � m � m � m � m m e l l �j �i i �h h �g e f e d e ( � d � d � � d � d � d � d � d � d � d � d ���e���bI��n\���H�S���{��� ��� �W�� *��i 4 �R � � ���@ �R ?� q跟t� ) � � ���cB �" �R! �R�* ?� i � q跟h ��{���S���_�AvrP( 6 , 6 H 5 L 5 � ] > G � � (_ �ElfAssertThreadPrivilege > Privilege A l EQ EQ �
>
_ p AE h EQ EQ ( � M �^ N B!
h �^ Q Privilege (
_ Q p 98 +_ 9d _ O � X � 8 L 1 � 2 � 5 �$ 6 �( : �D = �H > �h B �, � 0 �
h � l �
| � � �
� � � �
� � � �
� � � �
� � � �
I � M �
Y � ] �
t � x �
�{���S�� �� � ��� � �� ����" � } � �S �h@y 4�" � �R ��� �� ��� �� *� � � � ��� ?�� *� � � �" � ��* �� � ��@��SA��{è�_� � �
� � D � L � X h ' l ' � � � � � A < G � � m_ �ElfBackupEventLogFileA > LogHandle AF | H AF � EQ � >| BackupFileName AE $ x < $ d AE � EQ ����
>_ Priv EG � > RpcHandle A2 P < ( > status A ` 8 A � EG � Z (_ �^ p_
_ ` @ fG
:��� $LN10 P G LogHandle X | G BackupFileName _ G Priv G status 9t 3_ O � � � 8 | � �$ � �0 � �< �H �P �T �d �h ! �� �� ' �� . �� 0 �� �� C C F , �ElfBackupEventLogFileA$filt$0
>_ Priv EG > status EG fG $LN11 $LN9 P G LogHandle X | G BackupFileName _ G Priv G status 9 5_ O � , 8 �, � 0 �
f � j �
z � ~ �
� � � �
� � � �
� � � �
� � � �
�
�
* � . �
O � S �
g � k �
{ � �
� � � �
= � A �
X � \ �
� �
H � L �
m � q �
� � � �
� � � �
� �
4 � 8 �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �{���S�� �� � ��� � �� ����" � } � �S �h@y 4�" � �R ��� �� ��� �� *� � � � ��� ?�� *� � � �" � ��* �� � ��@��SA��{è�_� � �
� � D � L � X h ' l ' � � � � � A < G � � x_ �ElfBackupEventLogFileW > LogHandle AF | H AF � EQ � >v BackupFileName AE $ x < $ d AE � EQ ����
>_ Priv EG � > RpcHandle A2 P < ( > status A ` 8 A � EG � Z (_ �^ {_
_ ` @ fG
:��� $LN10 P G LogHandle X v G BackupFileName _ G Priv G status 9t 3_ O � � � 8 | P �$ S �0 Y �< i �H p �P q �T u �d x �h { �� y �� � �� � �� � �� [ �� C C F , �ElfBackupEventLogFileW$filt$0
>_ Priv EG > status EG fG $LN11 $LN9 P G LogHandle X v G BackupFileName _ G Priv G status 9 5_ O � , 8 y �, � 0 �
f � j �
z � ~ �
� � � �
� � � �
� � � �
� � � �
�
�
* � . �
O � S �
g � k �
{ � �
� M � M
= � A �
X � \ �
� �
H � L �
m � q �
� K � K
� L � L
� �
4 � 8 �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �{���S�� �� � ��� � �� ����� � } � ����B �%D�H% ��@��
��@�� ��� � �R ��� �� ��*�@� �� *� � � � ��� ?�� *� � s �� � ��*�� � ��@��SA��{è�_� � � � X � ` � p $ � ' � ' � � � � � � 5 G � � �_ �ElfChangeNotify > LogHandle AE � X $ EQ ���� > Event AF $ � \ EQ
>_ Priv EG � > RpcHandle A2 d @ ( >A RpcClientId EG � >s ClientId EG � > status A x D EG � M �^ 0 N Z (_ �^ �_
_ p @ fG
h �^
:��� $LN8 h G LogHandle p G Event _ G Priv A G RpcClientId s G ClientId G status 9� 3_ O� � � 8 � $ �$ * �0 0 �@ 1 �H 2 �P 7 �\ ? �d @ �h D �| F �� I �� G �� O �� R �� T �� � < F , �ElfChangeNotify$filt$0
>_ Priv EG >A RpcClientId EG >s ClientId EG > status EG fG $LN9 $LN7 h G LogHandle p G Event _ G Priv A G RpcClientId s G ClientId G status 9 5_ O� , 8 G �, � 0 �
_ � c �
w � { �
� � � �
� � � �
� � � �
� � � �
$ � ( �
K � O �
l � p �
� � � �
� � �
� � � �
� � � �
d � h �
� � � �
� � � �
� � � �
� �
C � G �
S � W �
� � � �
� �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �{���S�� �� � ��� � �� ����" � } � ��" � �R ��� �� ��� �� *� � � � ��� ?�� *� � S �" � ��*�� � ��@��SA��{è�_� � � 8 � @ � L \ ' ` ' � � � � � ; G � � r_ �ElfClearEventLogFileA > LogHandle AE \ 4 $ EQ � >| BackupFileName AF $ t 8 EQ ����
>_ Priv EG � > RpcHandle A2 D < ( > status A T D EG � Z (_ �^ s_
_ ` @ fG
:��� $LN8 P G LogHandle X | G BackupFileName _ G Priv G status 9h 3_ O � x � 8 l � �$ � �0 � �< � �D � �H � �X � �\ � �t � �x � �| � �� � �� A B F , �ElfClearEventLogFileA$filt$0
>_ Priv EG > status EG fG $LN9 $LN7 P G LogHandle X | G BackupFileName _ G Priv G status 9 5_ O � , 8 � �, � 0 �
e � i �
} � � �
� � � �
� � � �
� � � �
� �
* � . �
F � J �
� � � �
� �
� $ �
� � � �
� � �
$ � ( �
T � X �
d � h �
� � � �
� � � �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �{���S�� �� � ��� � �� ����" � } � ��" � �R ��� �� ��� �� *� � � � ��� ?�� *� � S �" � ��*�� � ��@��SA��{è�_� � � 8 � @ � L \ ' ` ' � � � � � ; G � � |_ �ElfClearEventLogFileW > LogHandle AE \ 4 $ EQ � >v BackupFileName AF $ t 8 EQ ����
>_ Priv EG � > RpcHandle A2 D < ( > status A T D EG � Z (_ �^ }_
_ ` @ fG
:��� $LN8 P G LogHandle X v G BackupFileName _ G Priv G status 9h 3_ O � x � 8 l �$ �0 �< �D �H �X ! �\ $ �t " �x * �| - �� / �� A B F , �ElfClearEventLogFileW$filt$0
>_ Priv EG > status EG fG $LN9 $LN7 P G LogHandle X v G BackupFileName _ G Priv G status 9 5_ O � , 8 " �, � 0 �
e � i �
} � � �
� � � �
� � � �
� � � �
� �
* � . �
F � J �
� S � S
� �
� $ �
� � � �
� � �
$ � ( �
T Q X Q
d R h R
� � � �
� � � �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �S���{��� �� �� � �� � ��c � �� *� � � � ��� ?�� *� ��@��� � � �*�{è�S���_� � � $ 4 ' 8 ' T � � � 6 G t t 6_ �ElfCloseEventLog > LogHandle AF EQ �� EO t > RpcHandle A2 EO t > status A , @ EO t Z �^ 7_ �^ @ @�" $LN8 O LogHandle O RpcHandle O status 9@ 3_ O� p t 8 d � � � � � � � �0 � �4 � �L � �P � �X � �\ � �` � �� # = F 0 $ �ElfCloseEventLog$filt$0 > RpcHandle EO $ > status EO $ �" $LN9 $LN7 O LogHandle O RpcHandle O status 9 5_ O � 0 8 � �, � 0 �
` � d �
t � x �
� � � �
� � � �
� � � �
� � � �
� � �
; E ? E
� � � �
� � � �
@ � D �
� � �
� � � �
� C � C
� D � D
3 � 7 �
L � P �
�{���� @� @� � � ��� ?� �{���_�a � ( ( �S���[��c��{��� �� *�����*���R� ��@�h ��@y� ��@�h ��@y � � ��� ?� � � ���b~@��R ?�� �� ���v � �W�? q��j
�v �7�
q- T� q� TU ��@� �h�h ��@y � �" y��`B �i& y ��� ?֩@yh@�)�i �� ��@�� �h@�h �h�h ��@yhF y � � U ��@� �h�h ��@y � �" y��`B �i& y ��� ?֩@yh@�)�i � ��@�� �h@�h �h�h ��@yhF y � �B y �����`� � ?�� w~)h ���x � � � ��� ?� � � ����� �R ?� ��{���cB��[A��Sè�_�CflET 2 X 2 d 3 h 3 � 0 � 0 0 0 @ 1 D 1 � 1 � 1 � 2 � 2 � / � / � J 9 G V_ �ElfCreateReconnInfo >R_ ApiType A � EQ EQ �� >�^ UNCServerName AG � EQ ( EQ �� >�^ ModuleName AF � EQ 0 EQ � >t IsSecurityLog A! $ � EQ 8 EQ ���� > RpcHandle AJ ( � EQ EQ @ >[_ recInfo AE � � >" structSize A , T M �^ �� N @ B!
h �^ R_ Q ApiType ( �^ Q UNCServerName 0 �^ Q ModuleName 8 t Q IsSecurityLog @ Q RpcHandle 9` �^ 9x ^_ ^x W_ 9� a_ 9\ d_ 9� d_ 9� �^ 9� �^ O � H 8 & < � �( � �, � �8 � �@ � �L � �T � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � � � � � �$ � �( � �4 � �< � �@ � �` � �p � �| � �� � �� � �� � �� � �� � �� � �� � �� � �, � 0 �
a � e �
u � y �
� � � �
� � � �
� � � �
� � � �
� � �
� �
& � * �
N � R �
b � f �
v � z �
� � � �
� � � �
� � � �
� � � �
�
�
� � � �
� � � �
� � � �
�
�
� �
& � * �
6 � : �
F � J �
` � d �
@ �_� � � � = G �^ �ElfDeregisterClusterSvc >v UNCServerName EQ B! v Q UNCServerName O � ( 8 L � P �, � 0 �
o � s �
� � � �
�S���{��� �� �� � �� � ��c � �� *� � � � ��� ?�� *� ��@��� � � �*�{è�S���_� � � $ 4 ' 8 ' T � � � > G t t ,_ �ElfDeregisterEventSource > LogHandle AF EQ �� EO t > RpcHandle A2 EO t > status A , @ EO t Z �^ 0_ �^ @ @�" $LN8 O LogHandle O RpcHandle O status 9@ 3_ O� p t 8 d � � � � � � � �0 � �4 � �L � �P � �X � �\ �` �� + E F 0 $ �ElfDeregisterEventSource$filt$0 > RpcHandle EO $ > status EO $ �" $LN9 $LN7 O LogHandle O RpcHandle O status 9 5_ O � 0 8 � �, � 0 �
h � l �
| � � �
� � � �
� � � �
� � � �
� � � �
� �
C > G >
� � � �
� � � �
H � L �
� � � �
� � � �
� < � <
� = � =
C � G �
\ � ` �
�{���� @� @� � � ��� ?� �{���_�a � ( ( � ��{��� �� �3 �h@�I k� T h � �( � ��� ?� � � ����� �R ?�{���A��_�CflECdaB, 2 0 2 < / @ / � � @ G h h �^ �ElfDestroyReconnectionInfo > LogHandle AE L EQ ` EQ ���� B! Q LogHandle 98 �^ 9P �^ O� 8 h 8 , � � � �$ � �, � �, � 0 �
j � n �
~ � � �
� � � �
� � � �
� � � �
� � �
@ �_�" � � � 6 G �^ �ElfFlushEventLog > LogHandle EQ B! Q LogHandle O � ( 8 w � | �, � 0 �
d � h �
� � � �
�{���S��[��c�� � ��� � �� ��*���*��# � } � �# � �R �s 4 �� � ����*�� �R �� * � � � ��� ?�� * � � # � ��*�� � ��cC��[B��SA��{Ĩ�_� �H � � � H � \ � t # � ' � ' � � � � � i : G � � �_ �ElfGetLogInformation > LogHandle AF $ � ` AF � EQ �� >" InfoLevel A ( | , T $ EQ � > lpBuffer AH , x X AH � EQ ���� >" cbBufSize A 0 t T A � EQ >" pcbBytesNeeded AI 4 p P AI � EQ
>_ Priv EJ � > RpcHandle A2 ` D ( A2 � > status A T H $ , A � EJ � Z (_ �^ �_
_ p @ fJ
:���� $LN12 X J LogHandle ` " J InfoLevel h J lpBuffer p " J cbBufSize x " J pcbBytesNeeded _ J Priv J status 9� 3_ O � � � 8 | _ �4 b �@ g �L m �P � �X p �` q �d u �� w �� z �� x �� � �� � �� � �� � A F , �ElfGetLogInformation$filt$0
>_ Priv EJ > status EJ fJ $LN13 $LN11 X J LogHandle ` " J InfoLevel h J lpBuffer p " J cbBufSize x " J pcbBytesNeeded _ J Priv J status 9 5_ O � , 8 x �, � 0 �
d � h �
x � | �
� � � �
� � � �
� � � �
� � � �
� �
� �
; � ? �
O � S �
c � g �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
0 � 4 �
H � L �
\ � ` �
� �
e � i �
� � � �
0 � 4 �
n � r �
� � � �
� } � }
� ~ � ~
� � � �
� � � �
�{�� @� @� � � ��� ?� �{���_�a � ( ( ` � �� @� � � q釟) ��_� � � 6 G $ �^ �ElfGetModuleName > LogHandle EQ $ " >t ModuleNameIsUnicodeString EQ ( $ J! Q LogHandle & ( t Q ModuleNameIsUnicodeString O � @ $ 8 4 5 � 9 � ; � I � K �, � 0 �
d � h �
� � � �
� �
� �( �
� ��� T(@�
k� T @� ��_� �CflE � � 8 G < < �^ �ElfGetTheRpcHandle > LogHandle A; 0 EQ 4 > result A2 A2 0 B! Q LogHandle O � H < 8 < �
� �$ �( �,
�, � 0 �
b � f �
v � z �
� � � �
� � � �
� � � �
` � �R 4@��_� � � @ G �^ �ElfGetUseLegacyReportEvent > LogHandle EQ J! Q LogHandle O� 8 8 , � � � $ �, � 0 �
n � r �
� � � �
�{���S�� �� � ��� � �� ����" � } � �s �� �" � �R ��� �� ��� �� *� � � � ��� ?�� *� � � �" � ��*�� � ��@��SA��{è�_� �
� � � D � L � X & h ' l ' � � � � � : 8 G � � �_ �ElfNumberOfRecords > LogHandle AF t H AF � EQ � >" NumberOfRecords AE $ d < $ AE � EQ ����
>_ Priv EG � > RpcHandle A2 P < ( > status A ` 4 A � EG � Z (_ �^ �_
_ ` @ fG
:��� $LN9 P G LogHandle X " G NumberOfRecords _ G Priv G status 9t 3_ O � � � 8 | � �$ � �0 � �4 � �< � �H � �P � �T � �d � �h � �� � �� � �� � �� � �� @ ? F , �ElfNumberOfRecords$filt$0
>_ Priv EG > status EG fG $LN10 $LN8 P G LogHandle X " G NumberOfRecords _ G Priv G status 9 5_ O� , 8 � �, � 0 �
b � f �
v � z �
� � � �
� � � �
� � � �
� � � �
� � �
# � ' �
H � L �
` � d �
t � x �
� � � �
6 � : �
P � T �
� �
< � @ �
a � e �
� � � �
� � � �
� �
( � , �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �{���S�� �� � ��� � �� ����" � } � �s �� �" � �R ��� �� ��� �� *� � � � ��� ?�� *� � � �" � ��*�� � ��@��SA��{è�_� �
� � � D � L � X % h ' l ' � � � � � = 5 G � � �_ �ElfOldestRecord > LogHandle AF t H AF � EQ � >" OldestRecordNumber AE $ d < $ AE � EQ ����
>_ Priv EG � > RpcHandle A2 P < ( > status A ` 4 A � EG � Z (_ �^ �_
_ ` @ fG
:��� $LN9 P G LogHandle X " G OldestRecordNumber _ G Priv G status 9t 3_ O � � � 8 | � �$ � �0 � �4 � �< �H �P �T �d �h �� �� �� �� �� @ < F , �ElfOldestRecord$filt$0
>_ Priv EG > status EG fG $LN10 $LN8 P G LogHandle X " G OldestRecordNumber _ G Priv G status 9 5_ O� , 8 �, � 0 �
_ � c �
s � w �
� � � �
� � � �
� � � �
� � � �
� � �
# � ' �
H � L �
` � d �
t � x �
� � � �
9 � = �
T � X �
� �
= � A �
b � f �
� � � �
� � � �
� �
, � 0 �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �S���[��{��� �� �� ���� ���� �V �5 ��@y� 4� �h@yh 4`@� �ҿ ��c �# �R" �R�� �� *� �
� � ��� ?�� *� ��@��@��@�t�7�@� �R����� �R �� �� �t � ��* � �{Ĩ�[A��S¨�_� � �
�d t ' x ' � � � � < G � � �_ �ElfOpenBackupEventLogA >| UNCServerName AE EQ ��� EO 0 � >| FileName AG EQ ��� EO ( � >0W LogHandle AH $ EQ ���� EO � > RpcHandle EO � > status A l X 4 A � EO � >p ServerNameString A2 P Z �_ V_ ` @�" $LN13 0 | O UNCServerName ( | O FileName 0W O LogHandle O RpcHandle O status 9� 3_ O� � � 8 � [ �( d �8 i �D k �H l �L o �P r �T v �p | �t �� } �� � �� � �� � �� � �� � �� � �� � �� f �� ^ C F 0 $ �ElfOpenBackupEventLogA$filt$0 > RpcHandle EO $ > status EO $ �" $LN14 $LN12 0 | O UNCServerName ( | O FileName 0W O LogHandle O RpcHandle O status 9 5_ O � 0 8 } �, � 0 �
j � n �
~ � � �
� � � �
� � � �
� � � �
� � � �
� �
� �
) � - �
Q � U �
r � v �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
% )
� � � �
� � � �
�{���� @� @� � � ��� ?� �{���_�a � ( ( �S���[��{��� �� �� ���� ���� �v �U ��@y 4� �h@y qi T`@� �ҿ ��c �# �R" �R�� �� *� �
� � ��� ?�� *� ��@��@��@�t�7�@� �R����@ �R �� �� �T � ��* � �{Ĩ�[A��S¨�_� �
�h ! x ' | ' � � � � < G � � �_ �ElfOpenBackupEventLogW >v UNCServerName AE EQ ��� EO 0 � >v BackupFileName AG EQ ��� EO ( � >0W LogHandle AH $ EQ ���� EO � > RpcHandle EO � > status A p X 4 A � EO � >q ServerNameString A2 T Z �_ V_ ` @�" $LN13 0 v O UNCServerName ( v O BackupFileName 0W O LogHandle O RpcHandle O status 9� 3_ O� � � 8 � � �( � �8 � �H � �L � �P � �T � �X � �t � �x � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� d C F 0 $ �ElfOpenBackupEventLogW$filt$0 > RpcHandle EO $ > status EO $ �" $LN14 $LN12 0 v O UNCServerName ( v O BackupFileName 0W O LogHandle O RpcHandle O status 9 5_ O� 0 8 � �, � 0 �
j � n �
~ � � �
� � � �
� � � �
� � � �
� � � �
� �
� �
/ � 3 �
W � [ �
x � | �
� � � �
� � � �
� � � �
^ ^
� � � �
� � � �
� � � �
� � � �
� � � �
\ $ \
1 ] 5 ]
� � � �
� � � �
�{���� @� @� � � ��� ?� �{���_�a � ( ( �{���S��[��c��# �� � ���� �� �����4 �5 �6 �(c� } � �)�?} �? �V �5 ��@y� 4� ��@yh 4�@� �� � � � � �( � ��� ?�? ��@� � � � q��7 ��*8 �� 5!c� �R �!� �R �%C �$ �R# �R"� ����� �� *3 � � � ��� ?�� *3 �8@�4@�5@�6@�7 @� � �w 4 c� �s�7$ @��*����` �R �� �� �� � ��* @ ��� ��#@��cC��[B��SA��{Ũ�_� �
� � | � � - � - � � � � � � � � * ' ' 4 � @ � \ � � � � & 6 G � $ � �_ �ElfOpenEventLogA >| UNCServerName EK � AF ( X� x AF 0 h L EQ ���� >| LogName EK � AG , T� x AG 0 d L EQ ��� >0W LogHandle EK ( � AH 0 P� x AH 0 d L EQ ��� >t fIsSecurityLog A" � EK � > RpcHandle EK � >~ RegModuleName EK 0 � >_ BackPriv EK @ � > status A � t P A t $ EK � >_ SecPriv EK X � >p ServerNameString AE | � " Z �_ (_ (_ =_
_
_ V_ � @ fK
:���� $LN15 � | K UNCServerName � | K LogName � 0W K LogHandle t K fIsSecurityLog K RpcHandle 0 ~ K RegModuleName @ _ K BackPriv K status X _ K SecPriv 9� I_ 9 3_ O � � 8 � s �< y �H z �T � �d � �p � �t � �x � �| � �� � �� � �� � �� � �� � �� � � � � � � � �0 � �8 � �< � �D � �H � �d � �h � �l � �p � �t � �| � �� < = F , �ElfOpenEventLogA$filt$0 > RpcHandle EK >~ RegModuleName EK 0 >_ BackPriv EK @ > status EK >_ SecPriv EK X fK $LN16 $LN14 � | K UNCServerName � | K LogName � 0W K LogHandle t K fIsSecurityLog K RpcHandle 0 ~ K RegModuleName @ _ K BackPriv K status X _ K SecPriv 9 5_ O� , 8 � �, � 0 �
h � l �
x � | �
� � � �
� � � �
� � � �
� � � �
� � � �
�
�
. � 2 �
> � B �
R � V �
j � n �
� � � �
� � � �
� � � �
� � � �
" � & �
C � G �
[ � _ �
s � w �
� � � �
� � � �
$ (
� �
" � & �
< � @ �
d � h �
� � � �
� � � �
� � � �
� �
A � E �
q u
� �
p � t �
� � � �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �{���S��[��c��# �� � ���� �� �����5 �4 �6 �(c� } � �)�?} �? �6 � ��@y� 4� ��@y qi T�@� �� �@��P6�@�H=S( 9��+C �* �R*� �?� � S)K �(� �?� �$��c �R �� � � � � � �� � � � � ��� ?�? ��@� � � � q��7 ��*8 �� 5!c� �R �!� �R �%C �$ �R# �R"� ����� �� *3 � � � ��� ?�� *3 �8 @�5@�4@�6@�7@� � �w 4 c� �s�7$ @��*���� �R �� �� �� � ��* ` ��� ��#@��cC��[B��SA��{Ũ�_� � �
� � � 7 � 7 � j � j � : � : � � � . � . � " ( � 4 � P , ` ' d ' � � � � � � � � �
6 G $ �_ �ElfOpenEventLogW >v UNCServerName EK AG ( �8x AG � d L EQ �� >v LogName EK AF , �4x AF � h L EQ � >0W LogHandle EK ( AH 0 �0x AH � d L EQ ���� >t fIsSecurityLog A" EK > RpcHandle EK >x RegModuleName EK 0 >_ BackPriv EK @ > status A X t P A � $ EK >_ SecPriv EK X >q ServerNameString AE � � M L_ ��
Z "_ >3 _Arg0 EK >M_ EventData EK p M �^ �� $ >" DataSize A � N M �^ �� ( N N" Z �_ (_ (_ B_
_
_ V_ @ fK h �^ L_
:���� $LN17 � v K UNCServerName � v K LogName � 0W K LogHandle t K fIsSecurityLog K RpcHandle 0 x K RegModuleName @ _ K BackPriv K status X _ K SecPriv 9� E_ 9l 3_ O � 8 � � �< � �H � �T � �d � �t � �x � �| � �� � �� � �� � �� � � � � � �, � �8 � �\ � �` � �x � �� �� �� �� ��
�� �� �� �� �� �� � �� < = F , �ElfOpenEventLogW$filt$0 > RpcHandle EK >x RegModuleName EK 0 >_ BackPriv EK @ > status EK >_ SecPriv EK X fK $LN18 $LN16 � v K UNCServerName � v K LogName � 0W K LogHandle t K fIsSecurityLog K RpcHandle 0 x K RegModuleName @ _ K BackPriv K status X _ K SecPriv 9 5_ O� , 8 � �, � 0 �
h � l �
x � | �
� � � �
� � � �
� � � �
� � � �
� � � �
�
�
. � 2 �
> � B �
R � V �
j � n �
� � � �
� � � �
� � � �
� � � �
" � & �
C � G �
[ � _ �
s � w �
� � � �
� � � �
� �
8 � < �
u � y �
x x
� � � �
�
�
$ � ( �
T � X �
� � � �
� � � �
� � � �
� �
1 � 5 �
a v e v
r w v w
` � d �
x � | �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �{���S��[��c��k�� � ��� � �� ��*�*���*����H# � } � �� �� �� �h
q@z Th 1 q@z� TA# � �R ��� �@ ��������*�*�* �� *S � � � ��� ?�� *S � � @# � ��* ` �� � ��kD��cC��[B��SA��{Ũ�_� � �
� � � � � � � � ' � ' � � � � � � 6 G $ g_ �ElfReadEventLogA > LogHandle AH ( � � AH � EQ �� >" ReadFlags A , � � $ � A � EQ �� >" RecordNumber A" 0 � � A" � EQ �� > Buffer AI 4 � � AI � EQ � >" NumberOfBytesToRead A# 8 � � A# � EQ ���� >" NumberOfBytesRead AF < � | AF � EQ >" MinNumberOfBytesNeeded AG @ � x AG � EQ
>_ Priv EL > RpcHandle A2 � P ( >" FlagBits A \ ( A � $ > status A � 8 A � EL Z (_ �^ j_
_ � @ fL
:���� $LN14 ` L LogHandle h " L ReadFlags l " L RecordNumber p L Buffer x " L NumberOfBytesToRead � " L NumberOfBytesRead # � " L MinNumberOfBytesNeeded _ L Priv L status 9� 3_ O � � 8 � N �@ R �L X �X a �\ d �h i �l l �x t �� v �� w �� { �� � �� � �� � �� � �� � �� � �� Z �� � = F , �ElfReadEventLogA$filt$0
>_ Priv EL > status EL fL $LN15 $LN13 ` L LogHandle h " L ReadFlags l " L RecordNumber p L Buffer x " L NumberOfBytesToRead � " L NumberOfBytesRead # � " L MinNumberOfBytesNeeded _ L Priv L status 9 5_ O� , 8 � �, � 0 �
` � d �
t � x �
� � � �
� � � �
� � � �
� � � �
� � �
� �
' � + �
H � L �
\ � ` �
p � t �
� � � �
� � � �
� � � �
� � � �
�
�
� �
K � O �
_ � c �
s � w �
� � � �
� � � �
� � � �
� � � �
� �
* � . �
> � B �
� � � �
� � � �
� � � �
| � � �
� � � �
� � � �
� �
� �
� �
4 � 8 �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �{���S��[��c��k�� � ��� � �� ��*�*���*����H# � } � �� �� �� �h Q q( Th Q q� TA# � �R ��� �@ ��������*�*�* �� *S � � � ��� ?�� *S � � @# � ��* ` �� � ��kD��cC��[B��SA��{Ũ�_� � �
� � � � � � � � ' � ' � � � � � � 6 G $ t_ �ElfReadEventLogW > LogHandle AH ( � � AH � EQ �� >" ReadFlags A , � � $ � A � EQ �� >" RecordNumber A" 0 � � A" � EQ �� > Buffer AI 4 � � AI � EQ � >" NumberOfBytesToRead A# 8 � � A# � EQ ���� >" NumberOfBytesRead AF < � | AF � EQ >" MinNumberOfBytesNeeded AG @ � x AG � EQ
>_ Priv EL > RpcHandle A2 � P ( >" FlagBits A \ > status A � 8 A � EL Z (_ �^ u_
_ � @ fL
:���� $LN14 ` L LogHandle h " L ReadFlags l " L RecordNumber p L Buffer x " L NumberOfBytesToRead � " L NumberOfBytesRead # � " L MinNumberOfBytesNeeded _ L Priv L status 9� 3_ O � � 8 � % �@ ) �L / �X 8 �\ : �h ? �l A �x I �� K �� L �� P �� X �� [ �� Y �� a �� d �� f �� 1 �� � = F , �ElfReadEventLogW$filt$0
>_ Priv EL > status EL fL $LN15 $LN13 ` L LogHandle h " L ReadFlags l " L RecordNumber p L Buffer x " L NumberOfBytesToRead � " L NumberOfBytesRead # � " L MinNumberOfBytesNeeded _ L Priv L status 9 5_ O� , 8 Y �, � 0 �
` � d �
t � x �
� � � �
� � � �
� � � �
� � � �
� � �
� �
' � + �
H � L �
\ � ` �
p � t �
� � � �
� � � �
� � � �
� � � �
�
�
� �
K � O �
_ � c �
s � w �
� � � �
� � � �
� � � �
�
�
� " �
2 � 6 �
� 7 � 7
� � � �
� � � �
p � t �
� � � �
� � � �
� 5 5
6 6
� �
( � , �
�{�� @� @� � � ��� ?� �{���_�a � ( ( � ��{��� �� �� �� �� �)
h@� k! T�� �W�� 5h
@�� 5 �Ҡ� � � � ��� ?� �Ҡ� � � � ��� ?�h@�( 4 q� T
q� T q` T� �c �$ �R# �R�� �a� �`@� � �c �$ �R# �R�� �a� �`@� � �c �$ �R# �R�� �a� �`@� � �c �$ �R# �R�� �a� �`@� �� � � � ��� ?֠ ��@�� �7�@�` � �@� ��{Ũ�A��_� �CflE �H . L . ` - d - � ) � * � + , ' ' � p 2 G h h 8_ �ElfReconnect > LogHandle AE EQ ���� EO h >x RegModuleNameW EO 8 h >~ RegModuleNameA EO ( h > RpcHandle EO h > status A
� | $ D 4 A
EO h M �^ , N Z <_ =_ A_ B_ ` @�"
h �^ $LN18 O LogHandle 8 x O RegModuleNameW ( ~ O RegModuleNameA O RpcHandle O status 9T E_ 9l I_ 9( 3_ O� � h 8 � O � U � Z �, ` �@ h �X i �p m �� � �� � �� � �� � �� � �� z �� � �� p � � � � �0 � �4 � �8 � �@ � �H � �L \ �� � 9 F 0 $ �ElfReconnect$filt$0 >x RegModuleNameW EO 8 $ >~ RegModuleNameA EO ( $ > RpcHandle EO $ > status EO $ �" $LN19 $LN17 O LogHandle 8 x O RegModuleNameW ( ~ O RegModuleNameA O RpcHandle O status 9 5_ O � 0 8 � �, � 0 �
\ � ` �
p � t �
� � � �
� � � �
� � � �
�
�
' � + �
C � G �
W � [ �
� � � �
L � P �
\ � ` �
l � p �
� � � �
| � � �
� � � �
� � � �
� �
6 � : �
` � d �
q � u �
� �
� �
�{���� @� @� � � ��� ?� �{���_�a � ( ( @ �_� � � 3 ; G �^ �ElfRegisterClusterSvc >v UNCServerName EQ >" pulSize EQ >�^ ppPackedEventInfo EQ B! v Q UNCServerName " Q pulSize �^ Q ppPackedEventInfo O � ( 8 ? � E �, � 0 �
m � q �
� � � �
� � � �
H � L �
�S���[��{��� �� �� ���� ���� �v �T ��@y 4� �h@yh 4u@� �� � ��� � �( � ��� ?ֿ ��c �$ �R# �R�� ����� �� *� �
� � ��� ?� *� ��@��@��@�u�7�@� �R����� �R �� �� �U � ��* � �{Ũ�[A��S¨�_� �
�P T \ - ` - � ) � ' � ' � � � � = G �_ �ElfRegisterEventSourceA >| UNCServerName AE EQ ���� EO 0 >| ModuleName AF EQ ���� EO ( >0W LogHandle AH $ EQ ���� EO > RpcHandle EO >~ RegModuleName EO 8 > status A � X 4 A � EO >p ServerNameString AG P @ Z <_ V_ p @�" $LN13 0 | O UNCServerName ( | O ModuleName 0W O LogHandle O RpcHandle 8 ~ O RegModuleName O status 9h I_ 9� 3_ O � � 8 � � �( �8 �D �H
�L
�P �l �p �� �� ! �� �� & �� ( �� , �� . �� 0 �� 3 �� 6 �� �� � D F 0 $ �ElfRegisterEventSourceA$filt$0 > RpcHandle EO $ >~ RegModuleName EO 8 $ > status EO $ �" $LN14 $LN12 0 | O UNCServerName ( | O ModuleName 0W O LogHandle O RpcHandle 8 ~ O RegModuleName O status 9 5_ O � 0 8 �, � 0 �
k � o �
� � �
� � � �
� � � �
� � � �
� � � �
� �
� �
, � 0 �
T � X �
� � � �
� � � �
� � � �
� � � �
� � �
6 :
� � � �
� � � �
� �
� � � �
. � 2 �
Z � ^ �
� � �
� �
� �
a � e �
| � � �
�{���� @� @� � � ��� ?� �{���_�a � ( ( �{���S��[�� �� � ���� �� ������
�� �� �V �5 ��@y� 4� ��@y qi T�@� �� �@��P6�@�H=S� 9���& �* �R�R ��V � S�. ��b ��f ��� �c �R �� � � � � � ��� � � � ��� ?� ��" �$ �R# �R� ����� �� *� �
� � ��� ?�� *� ��
@��@��@�s�7�@� �R���� �R �� �� �� � ��* ��� ��@��[B��SA��{Ĩ�_� �
� � d 7 h 7 � g � g � : � : � � � . � . � + ' ' @ � h � � 0 = G � � �_ �ElfRegisterEventSourceW >v UNCServerName EI � AF $ @� \ AF ( P 8 EQ >v ModuleName EI � AG ( <� \ AG ( L 8 EQ >0W LogHandle EI � AH , 8� \ AH ( L 8 EQ > RpcHandle EI � >x RegModuleName EI ( � > status A � X 4 A X EI � >q ServerNameString AE d � M L_ |
Z "_ >3 _Arg0 EI � >M_ EventData EI 8 � M �^ �� $ >" DataSize A � N M �^ | ( N N Z A_ V_ � @ fI h �^ L_
:���� $LN15 � v I UNCServerName � v I ModuleName � 0W I LogHandle I RpcHandle ( x I RegModuleName I status 9� E_ 9 3_ O� � � 8 � A �8 K �H P �X R �\ S �` V �d Y �� [ �� _ �� h � o � r � p �( w �, y �H } �L �P � �T � �X � �` M �� � D F , �ElfRegisterEventSourceW$filt$0 > RpcHandle EI >x RegModuleName EI ( > status EI fI $LN16 $LN14 � v I UNCServerName � v I ModuleName � 0W I LogHandle I RpcHandle ( x I RegModuleName I status 9 5_ O � , 8 p �, � 0 �
o � s �
� � �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
8 � < �
H � L �
\ � ` �
t � x �
� � � �
� � � �
� � � �
� �
� �
D � H �
� � � �
� � � �
� � � �
u j y j
� �
, � 0 �
D � H �
, � 0 �
r � v �
� � � �
� � � �
� h � h
i i
� � � �
� � � �
�{�� @� @� � � ��� ?� �{���_�a � ( ( �{���S��[��c��k��+ �� � ��C�� �� �9< SY y[< S[ yC �C' �D �E yE yF �F# �G �V7 �D; �G? �H�@�H �HC �H�@�H# �HG �H�@�H/ �HK �_' �_ �@#� � � ��� ?��RH �Ic�?} �Bs �Ac� �R � � ��� ?� �� �� �W3 �� �Ac� � � ��� ?�� �� �� �U+ �� � �R_ � �6@�T �X3By� ���F @�E@yD@��*�*��� 5H#@�� ��3 yH @�� �H@�� �H@�� �A#� � H/@�� �H#@�� ��3 yH @�� �H@�� �H@�� �A@� �� *S � � � ��� ?�� *S �X3ByH#@�H �H@yH yH'@�H �[ @yY@yT@�W3@�U+@�V7@�H;@�H �H?@�H �HC@�H �HG@�H# �HK@�H/ �H k� T�� �� �U+ ����h k�
@z� TAc �@#� � � ��� ?�v �( �R�6 �4 �RT �S@���� ��_+ ������ ��*�C� ��+@��kD��cC��[B��SA��{ƨ�_� � � �. � � � � � � � � - � - � x �
� ' � ' D � l p � � � � < 5 G � ( � �_ �ElfReportEventA > LogHandle EL h � AH , T AH � H@ t EQ ���� >! EventType A# 0 EQ ���� EL � >! EventCategory A% 8 EQ � EL � >" EventID EL � EQ ��� EL $ � > UserSid EL ( � EL p � A: p D , EQ ���� >! NumStrings EL � EQ � EL � >" DataSize EL � EQ ��� EL � >�_ Strings EL 0 � EL x � A: h @ 0 EQ ����
> Data EL 8 � EL � � A: ` @ 0 EQ EL � >! Flags EQ EL � >" RecordNumber EL @ � EL � � A: T D , EQ EL � >" TimeWritten EL X � EL � � A: � EQ EL ( � >t fUseLegacyReportEvent A x p EL � > RpcHandle AG � <DL EL P � >" nSize A � EL � >? szComputerNameA EL � � >| pComputerNameA AI � EL ` � >" EventTime EL � > status A
| < 4 A � | < � A � L4 � EL �
>� Time EL H � M �^ � D
N M �^ �|
N Z �_ �^ �_ �_ 8_ �_ @ @ fL h �^ �^
:���� $LN15 � L LogHandle ! L EventType ! L EventCategory $ " L EventID � L UserSid ! L NumStrings " L DataSize � �_ L Strings L Data ! L Flags " L RecordNumber ( " L TimeWritten " t L fUseLegacyReportEvent P L RpcHandle " L nSize � ? L szComputerNameA ` | L pComputerNameA " L EventTime L status H � L Time 9� �_ 9� �_ 9� I_ 9� 3_ 9x �_ O� � 8 ! � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � �, � �0 � �P � �| �� �� �� �� �4 �@ ! �P " �T # �d ) �| * �� + �� , �� 0 �� 2 �� 4 �� 6 �� ? < F 4 $ �ElfReportEventA$filt$0 >" nSize EL $ >? szComputerNameA EL � $ >" EventTime EL $ > status EL $
>� Time EL H $ @ fL $LN16 $LN14 � L LogHandle ! L EventType ! L EventCategory $ " L EventID � L UserSid ! L NumStrings " L DataSize � �_ L Strings L Data ! L Flags " L RecordNumber ( " L TimeWritten " t L fUseLegacyReportEvent P L RpcHandle " L nSize � ? L szComputerNameA ` | L pComputerNameA " L EventTime L status H � L Time 9 5_ O � 4 8 �, � 0 �
c � g �
s � w �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
# � ' �
7 � ; �
] � a �
q � u �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
$ � ( �
8 � < �
_ � c �
s � w �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
� $ �
0 � 4 �
H � L �
\ � ` �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
9 � = �
M � Q �
] � a �
q � u �
� � � �
� � � �
� � � �
� � � �
� �
- � 1 �
A � E �
o � s �
� � � �
� � � �
� � � �
� � � �
�
�
! � % �
9 � = �
\ � ` �
� �
� � � �
� �
� �
( � , �
8 � < �
P � T �
�
� �
�
�
� �
�
� �
( � , �
M � Q �
p � t �
� � � �
� � � �
�
� �
�
�
� �
�
�{���� � @� @� � � ��� ?� �� ��{���_�a � ( ( @ �_� � � ( > G �^ �ElfReportEventAndSourceW > LogHandle EQ >" EventTime EQ >v pComputerNameU EQ >! EventType EQ >! EventCategory EQ >" EventID EQ > UserSid EQ >v UNCSourceName EQ ( >! NumStrings EQ >" DataSize EQ >�^ Strings EQ
> Data EQ >! Flags EQ >" RecordNumber EQ ( >" TimeWritten EQ 0 B! Q LogHandle " Q EventTime v Q pComputerNameU ! Q EventType ! Q EventCategory " Q EventID Q UserSid ( v Q UNCSourceName ! Q NumStrings " Q DataSize �^ Q Strings Q Data ! Q Flags ( " Q RecordNumber 0 " Q TimeWritten O� ( 8 7 � I �, � 0 �
l � p �
� � � �
� � � �
� � � �
� �
; � ? �
a � e �
� � � �
� � � �
� � � �
� �
& � * �
J � N �
u � y �
� � � �
< � @ �
�{���S��[��c��k��+ �� � ��C�� �� �;< S[ yB yB yC �C+ �D �E yE yF �F' �G �U; �D? �GC �H�@�H# �HG �H�@�H' �HK �H�@�H3 �HO �_+ �_ �u �� � @C� � � ��� ?��RH# �I�?} �?}�B� �A� �R � � ��� ?� �� �� �V7 �V �A� � � ��� ?�� �� �� �T/ ��6@�W ��@� q �@�8 �R�P6c �R ��( T�@���@9 }SI 9��K[ �X� �_� �( SJc �H� �_� �D�� � � �@��B@yH 9J �Js �X� �_� � SI{ �H� �_� �DC� � � � � �Y3Cy� ���F@�E@yD@�C @y�*��� 5H'@�� ��3 yH#@�� �H @�� �H@�� �AC� � H3@�� �H'@�� ��3 yH#@�� �H @�� �H@�� �A@� �� *S � � � ��� ?�� *S �8 �RY3CyH'@�H �H@yH yH+@�H �H@yH y[@yW @�V7@�T/@�U;@�H?@�H �HC@�H �HG@�H# �HK@�H' �HO@�H3 �H k� T�� �� �T/ ����h k�
@z� TAc �@C� � � ��� ?ָ6 �7 �RW �S@���� ��_/ ������ ��* � �C� ��+@��kD��cC��[B��SA��{ƨ�_� � � �. � � � � � � � � � . . � 0 7 4 7 � d � d � a � a � : � : � � X h ' l ' � � P d � � �
5 G � ( � �_ �ElfReportEventW > LogHandle EL p � AG , � AG ( P@ | EQ � >! EventType A% 0 EQ z��� EL
� >! EventCategory EL � EQ x��� EL � >" EventID EL � EQ ���� EL ( � > UserSid EL 0 � EL x � A: D , EQ >! NumStrings EL � EQ v��� EL � >" DataSize EL � EQ ���� EL $ � >�^ Strings EL 8 � EL � � A: @ 0 EQ
> Data EL @ � EL � � A: @ 0 EQ EL � � >! Flags EQ EL � � >" RecordNumber EL H � EL � � A: � D , EQ EL � � >" TimeWritten EL ` � EL � � A: , EQ EL � � >t fUseLegacyReportEvent A! 4 EL � >� szComputerNameU EL � > RpcHandle AF , ��D EL X � >" nSize A � EL � >" EventTime EL � > status A
$ < 4 A ` EL � >v pComputerNameU AH � EL h �
>� Time EL P � M �^ � N M L_ �\ >3 _Arg0 EL � >M_ EventData EL � � M �^ �p $ >" DataSize A p N M �^ �\ ( N N M P_ ��
Z "_ >3 _Arg0 EL � >M_ EventData EL � � M �^ �� $ >" DataSize A � N M �^ �� ( N N M �^
�, N Z �_ �^ �_ �_ 8_ �_ � @ fL h �^ �^ �^ �^ L_ P_
:���� $LN23 � L LogHandle
! L EventType ! L EventCategory ( " L EventID � L UserSid ! L NumStrings $ " L DataSize � �^ L Strings � L Data � ! L Flags � " L RecordNumber � " L TimeWritten " t L fUseLegacyReportEvent � L szComputerNameU X L RpcHandle " L nSize " L EventTime L status h v L pComputerNameU P � L Time 9� �_ 9� �_ 9 E_ 9t 3_ 9( �_ O� X � 8 ( L � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � � � �( � �L � �� � �� � �� � �� � �� � �$ � �( � �\ �h �� �� ��
� � � �, �0 �8 �@ �H �L �T " �\ � �� ? < F 4 $ �ElfReportEventW$filt$0 >� szComputerNameU EL $ >" nSize EL $ >" EventTime EL $ > status EL $
>� Time EL P $ @ fL $LN24 $LN22 � L LogHandle
! L EventType ! L EventCategory ( " L EventID � L UserSid ! L NumStrings $ " L DataSize � �^ L Strings � L Data � ! L Flags � " L RecordNumber � " L TimeWritten " t L fUseLegacyReportEvent � L szComputerNameU X L RpcHandle " L nSize " L EventTime L status h v L pComputerNameU P � L Time 9 5_ O � 4 8 �, � 0 �
c � g �
s � w �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
' � + �
; � ? �
a � e �
u � y �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
( � , �
< � @ �
c � g �
w � { �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
$ � ( �
4 � 8 �
L � P �
` � d �
� � � �
� � � �
� � � �
� � � �
� � � �
� � �
� �
= � A �
Q � U �
a � e �
u � y �
� � � �
� � � �
� � � �
� � � �
� # �
; � ? �
[ � _ �
o � s �
� � � �
� � � �
� � � �
� � � �
� �
! � % �
D � H �
� � � �
� � � �
� �
u � y �
� � � �
� � � �
� / � /
�
� �
�
�
� �
�
�
� �
�
�
� �
�
�
� �
�
�
� �
�
d � h �
� � � �
� � � �
� � � �
�
�
<
� @
�
l
- p
-
}
. �
.
s � w �
� � � �
�{���� � @� @� � � ��� ?� �� ��{���_�a � ( ( � ��{��� �� �h@�� ?k� Th@�( 4 � �aB@9`@�cB � ���" �R ?�h
@�H 4 � ��{���A��_� �AvrP( 5 , 5 P 4 � � > G l l
_ �ElfRevertThreadPrivilege
>
_ p AE P EQ d EQ �
Z _ B!
_ Q p 9D _ O � P l 8 D J � L � N �( P �H S �P U �T X �, � 0 �
` � d �
t � x �
� � � �
� � � �
� � � �
@ �4 ��_� � � @ G �^ �ElfSetUseLegacyReportEvent > LogHandle EQ >t UseLegacyReportEvent EQ J! Q LogHandle ! t Q UseLegacyReportEvent O � 0 8 $ ( � , � 1 �, � 0 �
n � r �
� � � �
� �
@ �_� � � A ; G �^ �ElfWriteClusterEvents >v UNCServerName EQ >" ulEventInfoSize EQ >�^ pPackedEventInfo EQ B! v Q UNCServerName " Q ulEventInfoSize �^ Q pPackedEventInfo O � ( 8 X � ^ �, � 0 �
m � q �
� � � �
� � � �
X � \ �
�|)�_� � + 9 G �^ �EventDataDescCreate >; EventDataDescriptor EQ > DataPtr EQ >" DataSize EQ J! ; Q EventDataDescriptor Q DataPtr " Q DataSize O � 0 � $ & � ' � ( �, � 0 �
q � u �
� � � �
� � � �
@ � D �
� �� 4? qa TŠ �� 9�` �( �RD �Ĩ ��$ ��@ �� @y� � �R� 4� ��� ��� �& �R( @�� @9 Ik8?
kD�@z� Th @�
Yk�� ��@�
� TI @�(*�a T* �R
�R
@�i}@�,�E�h � ��yl�� �j 4�* �/*
( �� @yk k��T �T@y�$ �ߠ 9�|�H 4 Q�@�(})mH �R*}K b}~� �_� � � � < G q_ �McGenControlCallbackV2 >k SourceId EQ ( >" ControlCode EQ 0 > Level EQ 4 ># MatchAnyKeyword EQ 8 ># MatchAllKeyword EQ @ >� FilterData EQ H > CallbackContext EQ P >" Ix A < � A M _ T N B!
h _ ( k Q SourceId 0 " Q ControlCode 4 Q Level 8 # Q MatchAnyKeyword @ # Q MatchAllKeyword H � Q FilterData P Q CallbackContext O � � ` � n � v � z � } � � � �$ � �P � �� � �� � �� � �� � �� � �� � �� � �, � 0 �
i � m �
� � � �
� � � �
� � � �
� �
< � @ �
j � n �
� � � �
� � � �
� � � �
h @�h � �R � � ��� �_� � � � � I G $ _ �McGenEventRegister_EtwEventRegister >k ProviderId EQ $ >�^ EnableCallback EQ $ > CallbackContext EQ $ ># RegHandle EQ $ >" Error A
B! k Q ProviderId �^ Q EnableCallback Q CallbackContext # Q RegHandle 9 _ O � @ $ ` 4 O � R � T � U � X �, � 0 �
x � | �
� � � �
� � � �
� � � �
� �
� � � �
� � � �
� ��{��� �� �`@�` � �R � � ��� ?� ��{���A��_� � $ � � M G @ 4 _ �McGenEventUnregister_EtwEventUnregister ># RegHandle AE , EQ @ EQ ���� >" Error A
$ B! # Q RegHandle 9, _ O � H @ ` < w � z � | � } � � �0 � �, � 0 �
w � { �
� � � �
� � � �
� � � �
� �
� $ �
@�� �� � �R �R � �I �R@y�$) � ��� @��* ��� �� �( � , � � � K G H D "_ �McGenEventWrite_EtwEventWriteTransfer >_ Context EQ ( H >F Descriptor EQ 0 H >k ActivityId EQ 8 H >" EventDataCount EQ @ H > _ EventData EQ H H B! ( _ Q Context 0 F Q Descriptor 8 k Q ActivityId @ " Q EventDataCount H _ Q EventData 9D %_ O � ` H ` T
� � � � � � � �$ �, � 0 �
w � { �
� � � �
� � � �
� � � �
� " �
� � � �
� � � �
�@9 !k9@zA T� �@� � T @�("�a T �R �R�_� � > G < 8 _ �McGenLevelKeywordEnabled >_ EnableInfo EQ < > Level EQ < ># Keyword EQ < J! _ Q EnableInfo Q Level # Q Keyword O� @ < ` 4 � � " �, % �4 ) �, � 0 �
m � q �
� � � �
� � � �
, � 0 �
�{��� � ��� ��# �� �c �R�' �H S�) ��� 9� �* �R� ��# � ��� � ��{���_� � @ � H � � P L G T D P_ �McTemplateU0usr0_EtwEventWriteTransfer >_ Context EQ EQ h T >F Descriptor EQ EQ p T >3 _Arg0 EQ ���� EQ D > _Arg1 EQ 0 EQ � T >M_ EventData EQ D M �^ N M �^ N
Z "_ P K!
h �^
:�� h _ Q Context p F Q Descriptor 3 Q _Arg0 � Q _Arg1 M_ Q EventData O� ` T ` T r � { � y � { � w �$ y �( { �0 w �@ { �, � 0 �
x � | �
� � � �
� � � �
� � � �
� � � �
� �
% � ) �
9 � = �
a � e �
d � h �
�{��� � ��� ��# �� �c �R�' �H S�7 � ��� 9y S� ��3 �* �R� ��# � ��� � ��{���_� � H � P � � V L G \ L L_ �McTemplateU0uzr0_EtwEventWriteTransfer >_ Context EQ EQ h \ >F Descriptor EQ EQ p \ >3 _Arg0 EQ ���� EQ L >�% _Arg1 EQ 0 EQ � \ >M_ EventData EQ L M �^ N M �^ N
Z "_ P K!
h �^
:�� h _ Q Context p F Q Descriptor 3 Q _Arg0 � �% Q _Arg1 M_ Q EventData O � p \ ` d � � � � � � � � � �$ � �( � �4 � �8 � �< � �H � �, � 0 �
x � | �
� � � �
� � � �
� � � �
� � � �
� �
% � ) �
9 � = �
a � e �
l � p �
���_� � V 2 G �^ �NtCurrentTeb J! O � ( � < � = �, � 0 �
l � p �
�{��� �? qA T � � � � � � � � � 5 � � � �R�{���_� : : : � � $ � ( � , � 8 : < : @ � � V 4 G P H �_ �WevtInitialize > DllBase EQ EQ P >" Reason EQ EQ P >s0 Context EQ EQ P Z _ _ B! Q DllBase " Q Reason s0 Q Context O � P P 8 D q � u � w �0 x �4 y �8 { �D ~ �, � 0 �
` � d �
t � x �
� � � �
� � � �
� � � �
� � � �
l � p �
� P � ��
Ɉ�Ȅ������ 0 � � ���� � � $ � ( � , � � �
@ ��� � � F P< �Ɉ�Ȅ���� � � � ���� � � � $ � ( � � � @ ���� � � 0 P( �Є���� T h h ��� � � � � $ � � � @ ���� � � ) P# �Є���� H \ \ ��� � � � � $ � � � @ ���� � < P5 @ �Ȃ$��� T t t � � � � $ � � @ ���� � D P> @ �Ȃ$��� p � � � � $ @ ���� � j Pa �ш�Ȅ���� � ���� � $ � ( ! @ ���� � ' � P � ��
Ɉ�Ȅ������ � h h ���� � $ ( � , -
@ ��� � 3 F P< �Ɉ�Ȅ���� � � � ���� � 0 0 $ � ( 0 0 9 @ ���� � ? P @ �"� 4 4 � 8 8 � 8 8 E @ ���� � K P @ �"� 4 4 � ? ? � ? ? Q @ ���� � W 0 P( �Є���� T h h ��� � F F � $ F F ] @ ���� � c ) P# �Є���� H \ \ ��� � N N � $ N N i @ ���� � o < P6 @ �Ȃ$��� X x x � T T � $ T T u @ ���� � { b PZ ��Ȅ������ � ���� � _ _ $ � ( _ _ � @ ���� � � � Px �ш�Ȅ���� 8 ` ` ���� � k k $ � ( k k � @ ���� � � 6 P- ��Ȅ������ d � � ���� � y y $ � ( y y � @ ���� � � 3 P, �Є���� h � � ��� � � � � $ � � � @ ���� � � . P& �Є���� T h h ��� � � � � $ � � � @ ���� � � . P& �Є���� T h h ��� � � � � $ � � � @ ���� � � a a � Z PT @ ������ p � � � � $ � � � @ ���� � � f � � Q � � e a � � b � 0��� �� � � � 0��� �� � � � A a � �
_ EVENTLOG_Context : :
� / -
�_ Microsoft_Windows_EventlogLevels = =
� 1 /
�_ Microsoft_Windows_EventlogKeywords @ @
�
C EVENT_LOG_FULL C C
� % #
C EVENT_AUDIT_PROCESSING F F
� . ,
C EVENT_AUDIT_PUBLISHER_META_DATA I I
� "
C EVENT_AUDIT_FAILURE L L
� & $
C EVENT_AUDIT_AUTO_BACKUP O O
� # !
C EVENT_AUDIT_LOG_FULL R R
� 4 2
C EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL U U
� & $
C EVENT_AUDIT_LOG_CLEARED X X
� ) '
C EVENT_AUDIT_EVENTS_DROPPED [ [
�
C EVENT_SHUTDOWN ^ ^
� % #
C EVENT_REPORTEVENT_ANSI a a
�
C EVENT_REPORTEVENT d d
� ( &
C EVENT_REGISTEREVENTSOURCE g g
� !
C EVENT_OPENEVENTLOG j j
� # !
C EVENT_PULLSUB_CREATE m m
� # !
C EVENT_PUSHSUB_CREATE p p
� 4 2
C EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY s s
� 4 2
C EVENT_PUBLISHER_TLG_INVALID_META_DATA v v
� & $
C EVENT_ABNORMAL_SHUTDOWN y y
�
C LOG_DROPPED_CHUNK | |
�
C EVENT_AUTO_BACKUP
�
C EVENT_LOG_CLEARED � �
� # !
C EVENT_EVENTS_DROPPED � �
� ( &
C EVENT_PUBLISHER_META_DATA � �
�
C EVENT_PROCESSING � �
� / -
C CHANNEL_POLICY_APPLICATION_ERROR � �
� 4 2
C PRIMARY_CHANNEL_CONFIGURATION_WARNING � �
� 4 2
C INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE � �
� * (
C PRIMARY_CHANNEL_FATAL_ERROR � �
� - +
C INIT_CHANNEL_LOGFILTER_WARNING � �
� + )
C INIT_CHANNEL_LOGFILE_WARNING � �
� 9 7
C INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG � �
� - +
C INIT_CHANNEL_MOVED_CORRUPT_LOG � �
� # !
C INIT_CHANNEL_LOGGING � �
� & $
C INIT_CHANNEL_PUBLISHING � �
� ( &
C INIT_CHANNEL_CONFIG_ERROR � �
�
C INIT_CHANNEL � �
�
� EVENTLOG � �
V �N cm�U%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\arm64\precomp.obj �� VD NtCurrentTeb ��� Y EventDataDescCreate
�Z
�^ v " �^ �^ " �^ ElfRegisterClusterSvc ��
v B " v ! ! " v ! " �^ ! " " �^ & �^ ElfReportEventAndSourceW ��� � " �^ ElfDeregisterClusterSvc
�^ �^ ElfFlushEventLog ��� v " �^ �^ " �^ ElfWriteClusterEvents �� �^ & �^ ElfDestroyReconnectionInfo �
� " t �^
�^ t �^ & �^ ElfGetUseLegacyReportEvent � t �^ & �^ ElfSetUseLegacyReportEvent �6 � tagStringStorage .?ATtagStringStorage@@ ��
W
{ A 6 �^ tagStringStorage .?ATtagStringStorage@@ ��2 onecore\admin\wmi\events\advapi\apistub.c �� �^ �^
�^ t �^ �^ �^ ElfGetModuleName ��� �^ �^ ElfGetTheRpcHandle �
�B k �^ # " �^ . _ McGenEventRegister_EtwEventRegister
_
# " _ 2 _ McGenEventUnregister_EtwEventUnregister B � tagPrivilegeStatus .?AUtagPrivilegeStatus@@ ��v
" Asserted �
" Privilege
t NeedsRevert ��
t PrivilegeAdjusted
WasEnabled ���B _ tagPrivilegeStatus .?AUtagPrivilegeStatus@@ �� _ �^
_
_ _ & _ ElfRevertThreadPrivilege ���
# " _
_ t � _ RevertToSelf ��� " _
_ F � _MCGEN_TRACE_CONTEXT .?AU_MCGEN_TRACE_CONTEXT@@ ��
# RegistrationHandle ���
# Logger ���
# MatchAnyKeyword ��
# MatchAllKeyword ��
" Flags
" $ IsEnabled
( Level
) Reserve ��
! * EnableBitsCount ��
" 0 EnableBitMask
L 8 EnableKeyWords ���
J @ EnableLevel ��F _ H _MCGEN_TRACE_CONTEXT .?AU_MCGEN_TRACE_CONTEXT@@ ��J onecore\admin\wmi\events\manifests\objfre\arm64\EventLogEvents.h ��� _ _ �
_ _ # _ & _ McGenLevelKeywordEnabled ���
: _ F k " _ " _ 2 !_ McGenEventWrite_EtwEventWriteTransfer �� # F k k " ; " #_
$_
_ &_ & '_ ElfAssertThreadPrivilege ���
� )_
*_ & �^ ElfDeregisterEventSource ���
[Z
-_ ._ & /_ ElfrDeregisterEventSource ��
1_
2_ t R^
4_ �^ ElfCloseEventLog ��� /_ ElfrCloseEL �^ ElfReconnect ���
�! p 9_ 9_ " " -_ :_ & ;_ ElfrRegisterEventSourceA ��� ;_ ElfrOpenELA
q >_ >_ " " -_ ?_ & @_ ElfrRegisterEventSourceW ��� @_ ElfrOpenELW v � C_
D_
| F_ G_
H_ _ F 3 �% " J_ 2 K_ McTemplateU0uzr0_EtwEventWriteTransfer � : " 0 � _ F 3 " N_ 2 O_ McTemplateU0usr0_EtwEventWriteTransfer �� ApiElfOpenEventLogW �� ApiElfRegisterEventSourceW ��� ApiElfOpenBackupEventLogW ApiElfOpenEventLogA �� ApiElfRegisterEventSourceA ��� ApiElfOpenBackupEventLogA 2 t Q_ tagElfApiType .?AW4tagElfApiType@@ � R_ �^ R_ �^ �^ t T_ U_ ElfCreateReconnInfo 6 � tagReconnInfo .?AUtagReconnInfo@@ �
" Signature
R_ ApiType ��
t IsImpersonating ��
�^ UNCServerName
�^ ModuleName ���
t 0 IsSecurityLog
t 4 UseLegacyReportEvent �
8 RpcHandle 6 X_ @ tagReconnInfo .?AUtagReconnInfo@@ Y_ �^ [
W_ " # \_
]_ $ �= __
`_ v Y b_
c_ " " " " " " e_ f_ ElfReadEventLogA ���" [Z " " " " " h_ i_ ElfrReadELA | k_ " l_ ElfBackupEventLogFileA � [Z 9_ n_ o_ ElfrBackupELFA �" �B McGenControlCallbackV2 �" l_ ElfClearEventLogFileA �� o_ ElfrClearELFA �� f_ ElfReadEventLogW ��� i_ ElfrReadELW v v_ " w_ ElfBackupEventLogFileW � [Z >_ y_ z_ ElfrBackupELFW �" w_ ElfClearEventLogFileW �� z_ ElfrClearELFW �� " " " ~_ " _ ElfGetLogInformation ��� [Z " " " �_ " �_ ElfrGetLogInformation �� �_ �_ ElfChangeNotify [Z ? " �_ �_ ElfrChangeNotify ��� " �_ �_ ElfNumberOfRecords � [Z " �_ �_ ElfrNumberOfRecords �_ ElfOldestRecord �_ ElfrOldestRecord ��� | | 0W �_ " �_ ElfOpenBackupEventLogA � p 9_ " " -_ �_ �_ ElfrOpenBELA ���" �_ ElfRegisterEventSourceA �_ ElfOpenEventLogA ��� t �_ �_ _stricmp ��� v v 0W �_ " �_ ElfOpenBackupEventLogW � q >_ " " -_ �_ �_ ElfrOpenBELW ���
| 6 ! ! " ! " �_ ! " " �_ �_ ElfReportEventA � MIDL_user_allocate �
x
�,
9_ :
[Z �_ ! ! " ! " 9_ �_ �_ ! "
�_ �_ ElfrReportEventExA �> [Z " ! ! " ! " 9_ �_ �_ ! " " �_ �_ ElfrReportEventA ��� � MIDL_user_free �
� �_
�_ � p " t �_
�_ � " �_
�_ �[ WevtInitialize �6 ! ! " ! " �^ ! " " �_ �_ ElfReportEventW
>_ :
[Z �_ ! ! " ! " >_ �_ �_ ! "
�_ �_ ElfrReportEventExW �> [Z " ! ! " ! " >_ �_ �_ ! " " �_ �_ ElfrReportEventW ��� � q " t �_
�_ " �_ ElfRegisterEventSourceW �_ ElfOpenEventLogW ��� 8 _wcsicmp ��� 3 "
� K " h �
_
�^
_
W_
���
���
���
���� -FC -MT -wd4746 -volatile:ms -Oy- -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427
�_ Z �_ -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X �_ �_ �_ �_ �_ ��L� ��<���' )�(��v��f
�ԯ�R 7�`,�eW[ᕽ��<[R1A8�F �7n6�+o���j�P��W^ gC(��4����k�x|�-�4�X�dHJ��A� U��i�Z�/u!
{9Fl�g�qt��"�
�<~#��w>���0<̩0L`��$��V���
hԹ�:OW�ҥ\�պ-�j��{�� ?_�Ef�����.��H���,)\ ����_�(V�5w���9ȨZp!'7�Q�z��{�#Cu� ��G��72Om��.�)���s �f#���D�X| ��S8����H��^+Կ�0�7�6���t�O����~s�O�^^�{+78����Y�����S0w��� �Q �Z|��.�l<3�w��yI��R �Z�� �AI����%k�9�&� �Z�� �
�Xto$k�9�&��T�ڼ� ������- 1�9�&�ǜ��b6 �ruN���P�9�&�ǜ��b6 `Ԉ�O$[��9�&�P�l9jD�D���)~U�FF�M�!�رl�:���]�>s�5�T7����X�6�P�l9jD�o}e�zv��FF�M���
t������fZ� ��I���Z��[e'�^M�?k�Dze;�{�].�Ё9�&�D��3e��i~7��F7:��=�z^^��8� j�P�ٺ^�m���U];�M��@}I .��с9�&�;�M��@}�S��S�7�9�&� מ�K�b�bl��ݮ��FF�M�@:�/�k��6��r�<��FF�M����Ab��3� x \���9�&��o[�1Px�<f�LeI��9�&���&F�
�� ˔*��j�9�&��>���Ƹ��'��л��9�&���'�O�Ȩ�5�R��\�FF�M��5�T7��k~<��H�V�����;�l�F��]�FF�M�q�iɫ�Q ���M����9�&���Eīm����yi�&%�5�t�5�T7��hMծ�묁��=mc�¤���h��&%�5�t���v���y�4�#�5��q
{(>Z�= �N�<��5�T7�� *.fp ��
0Jd@����a�z<Й� [��7�2�C���oIi��^� �Sfy��Y+�]aF�~ � �]e�0ٯ����b��7cf����A!�ohDe�/���^� 3u��Ϙ2�~8>��� ���_����m.�����eb�^�R (���4u7)!X߆�m�Up��� zg\�~ue�Up��� zt.�Dx �p�Up��� zU�I*��C�Up��� z�\�Xfի4�Up��� zU�I*��C�Up��� z��˰V�ҫ�Up��� zU�I*��C�Up��� z��� !1�Up��� z�����֯Up��� zIH�)�a.�Up��� z�����֯Up��� z���o�H�T�Up��� zU�I*��C�Up��� z��8<�Up��� zg\�~ue�Up��� zt.�Dx �p�Up��� zU�I*��C�Up��� z���r�V�P�Up��� z�����֯Up��� z���r�V�P�Up��� z�����֯Up��� z�\�Xfի4�Up��� zU�I*��C�Up��� z��˰V�ҫ�Up��� zU�I*��C�Up��� zR�j\^bS�Up��� z�����֯Up��� z��`X���Up��� zU�I*��C�Up��� z]��u�� �Up��� zU�I*��C�Up��� z}��\`W�`�Up��� zU�I*��C�Up��� z��]��v��Up��� zU�I*��C�Up��� z�W�� ��˯Up��� zU�I*��C�Up��� z�W�� ��˯Up��� zU�I*��C�Up��� zI� �{�q�F����w��Up��� z�����֯Up��� zsYݩE8IH��/z�{� �ߖ�IsO�ZQ���_8ˠT
�f�.�!����Up��� z
��R��,�Up��� z���&:�&�Y뤅��o��W�� �� +C���.�0c�4��Q���F�&��S�(�K;����M���F�ɿ �:�/0An Ὓ� |�G���]ڕoC��s�B'�X�/ W�j���}:%�_�{6��EJ� ��4D7]3!2�:#w� �ݛ�i�l��h���F`��Ϙ����c�`���ztM��HS
~R��y�Q����l�d�ȵ
�{ ��bC� Gy�~+f� o���e˺$�Ht�bZ�&���j/b�+�-)�v��ـ��8����$��Ao�n���Y�����S�gґ�|�zg%j��]n$R`G��dg��츇 �X��������囥�}M\�t�~ -INCLUDE:__@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinGEUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� .debug$S � e .rdata i�y� e .rdata �[!] e A .rdata s\Z e ` { � � � � � � _stricmp � � . A T m � � � � � � _wcsicmp � � - G ` y � � � � � � 0 @ M f .data H )q�� e � .rdata
e�.� e � .rdata h T)�} e � .rdata ~H�� e � .rdata ?�� e .rdata
JK i e
.rdata ��w� e ? .rdata G+� e S .rdata
���@ e k
.rdata �'� e � .rdata ��� e � .rdata ��� e � .rdata 3g� e � .rdata �K� e � .rdata ��*� e � .rdata .�M� e .rdata [Q�M e + .rdata ��� e > .rdata 8t� e S .rdata ��|d e h .rdata ݤ�| e � .rdata �SV
e � .rdata rX�� e � .rdata ��u} e � .rdata ~=�< e � .rdata ���� e .rdata `�m& e .rdata �͡ e 1 .rdata ! �dr e B ! .rdata " ��� e c " .rdata # �� e � # .rdata $ �� e � $ .rdata % �(u� e � % .rdata & �1�� e � & .rdata ' ���3 e ' .rdata ( s^% e 2 ( .rdata ) 8
�� e Q ) .rdata * ���{ e f * .rdata + Mj�� e ~ + .rdata , ʹR� e � , .rdata - 2˵o e EVENTLOG - � � � .text$mn . � G<�� e .debug$S / � . e .text$mn 0 � ��� e .debug$S 1 T , 0 e .text$x 2 , b��&0 e .text$mn 3 � ��� e .debug$S 4 T , 3 e .text$x 5 , b��&3 e .text$mn 6 � �+? e .debug$S 7 . 6 e .text$x 8 , b��&6 e .text$mn 9 � e��� e .debug$S : & 9 e .text$x ; , b��&9 e .text$mn < � e��� e .debug$S = & < e .text$x > , b��&< e .text$mn ? t ~�00 e .debug$S @ l $ ? e .text$x A 0 ��[�? e .text$mn B ��k e .debug$S C � 6 B e .text$mn D �05� e .debug$S E � D e .text$mn F t ~�00 e .debug$S G | $ F e .text$x H 0 ��[�F e .text$mn I h ϦŞ e .debug$S J 4 I e .text$mn K � e .debug$S L � K e .text$mn M � ?��� e .debug$S N � > M e .text$x O , b��&M e .text$mn P $ $�� e .debug$S Q P P e .text$mn R < �W�J e .debug$S S @ R e .text$mn T �]� e .debug$S U � T e .text$mn V � R^�' e .debug$S W H , V e .text$x X , b��&V e .text$mn Y � R^�' e .debug$S Z L , Y e .text$x [ , b��&Y e .text$mn \ � 3�{. e .debug$S ] � 2 \ e .text$x ^ 0 ��[�\ e .text$mn _ � ��\; e .debug$S ` � 2 _ e .text$x a 0 ��[�_ e .text$mn b � v��� e .debug$S c � J b e .text$x d , b��&b e .text$mn e q��] e .debug$S f � P e e .text$x g , b��&e e .text$mn h �xb` e .debug$S i T N h e .text$x j , b��&h e .text$mn k 8 \g e .debug$S l H L k e .text$x m , b��&k e .text$mn n h
U- � e .debug$S o < 0 n e .text$x p 0 ��[�n e .text$mn q �05� e .debug$S r p
q e .text$mn s ��( e .debug$S t � 8 s e .text$x u 0 ��[�s e .text$mn v � �N� e .debug$S w � D v e .text$x x , b��&v e .text$mn y � �/:� e .debug$S z �
� y e .text$x { 4 ��; y e .text$mn | �05� e .debug$S } d " | e .text$mn ~ � = �� e .debug$S � � ~ e .text$x � 4 ��; ~ e .text$mn � l R�� e .debug$S � 8 � e .text$mn � ��"� e .debug$S � @ � e .text$mn � �05� e .debug$S � �
� e .text$mn � y|� e .debug$S � p
� e .text$mn � T�u� e .debug$S � D � e .text$mn � $ �*v� e .debug$S � � e .text$mn � @ 0�q� e .debug$S � h � e .text$mn � H 20� e .debug$S � @ � e .text$mn � < r�LT e .debug$S � l
� e .text$mn � T DH�� e .debug$S � � � e .text$mn � \ E0n� e .debug$S � � � e .text$mn � ~})� e .debug$S � � � e .text$mn � P � �� e .debug$S � � � e � � � K # � 9 D Q q g y w h � 0 � 9 � \ � s � b � | ~ k / F H ? Y 3 p < � _ � v � e � M � 6 � Y � V
I )
n 6
P G
� b
T }
R �
B �
� �
� �
. �
� � 3 � [ � � � � � � � 2 � 5 8 ( ; E > b A z H � O � X � [ � ^
a #
d ;
g S
j k
m �
p �
u �
x �
{ �
� ) > T memset $LN38 y $LN21 � y $LN10 � y $LL2 , y $LN8 T y $LN17 4 y $LN33 � y $LN6 � y $LN3 � y $LN32 ( y $LN19 y $LN4 � y $LN16 $ { $LN14 { $LN15 � y $LN20 h $LN1 � h $LN9 � h $LN8 � h $LN3 � h $LN15 j $LN13 j $LN14 � h $LN16 0 $LN1 � 0 $LN5 � 0 $LN4 � 0 $LN3 � 0 $LN11 2 $LN9 2 $LN10 h 0 $LN13 9 $LN3 | 9 $LN2 x 9 $LN9 ; $LN7 ; $LN8 \ 9 $LN19 \ $LN1 � \ $LN8 � \ $LN7 � \ $LN15 � \ $LN5 P \ $LN4 L \ $LN3 � \ $LN14 $ ^ $LN12 ^ $LN13 t \ $LN19 s $LN1 � s $LN8 � s $LN7 � s $LN15 � s $LN5 P s $LN4 L s $LN3 � s $LN14 $ u $LN12 u $LN13 � s $LN21 b $LN1 � b $LN10 t b $LN9 p b $LN8 D b $LN17 0 b $LN6 � b $LN5 | b $LN4 x b $LN3 | b $LN16 d $LN14 d $LN15 b $LN70 ~ $LN14 @ ~ $LL2 � ~ $LN12 ~ $LN25 � ~ $LN63 \ ~ $LN10 ( ~ $LN3 L ~ $LN64 � ~ $LN7 � ~ $LN61 � ~ $LN5 \ ~ $LN1 ` ~ $LN4 � ~ $LN24 $ � $LN22 � $LN23 h ~ $LN22 k $LN1 � k $LN9 � k $LN8 � k $LN3 � k $LN15 m $LN13 m $LN14 � k $LN13 F $LN3 ` F $LN10 P F $LN2 \ F $LN9 $ H $LN7 H $LN8 4 F $LN13 ? $LN3 ` ? $LN10 P ? $LN2 \ ? $LN9 $ A $LN7 A $LN8 4 ? $LN16 3 $LN1 � 3 $LN5 � 3 $LN4 � 3 $LN3 � 3 $LN11 5 $LN9 5 $LN10 h 3 $LN13 < $LN3 | < $LN2 x < $LN9 > $LN7 > $LN8 \ < $LN19 _ $LN1 � _ $LN8 � _ $LN7 � _ $LN15 � _ $LN5 T _ $LN4 P _ $LN3 � _ $LN14 $ a $LN12 a $LN13 x _ $LN27 v $LN1 d v $LN8 X v $LN7 T v $LN17 ( v $LN11 � v $LN5 d v $LN4 ` v $LN3 ` v $LN16 x $LN14 x $LN15 v $LN29 e $LN1 � e $LN10 � e $LN9 � e $LN8 � e $LN19 � e $LN6 , e $LN13 � e $LN5 � e $LN4 | e $LN3 � e $LN18 g $LN16 g $LN17 ` e $LN18 M $LN5 � M $LN6 � M $LN4 X M $LN13 O $LN11 O $LN12 � M $LN15 6 $LN3 � 6 $LN2 � 6 $LN9 8 $LN7 8 $LN8 � 6 $LN15 Y $LN4 � Y $LN3 � Y $LN1 � Y $LN2 < Y $LN10 [ $LN8 [ $LN9 h Y $LN15 V $LN4 � V $LN3 � V $LN1 � V $LN2 < V $LN10 X $LN8 X $LN9 h V $LN8 I $LN3 T I $LN28 n $LN1 P n $LN23 D n $LN20 4 n $LN24 n $LN12 � n $LN11 � n $LN10 � n $LN9 � n $LN5 L n $LN19 $ p $LN17 p $LN18 n $LN1 P $LN4 P $LN1 � $LN1 T $LN2 T $LN1 0 R $LN3 , R $LN23 B $LN1 � B $LN10 � B $LN8 p B $LN20 � B $LN14 B $LN9 � B $LN12 � B $LN7 ( B $LN15 � B $LN19 � B $LN5 T B $LN4 @ B $LN7 � $LN4 D � $LN2 4 � $LN8 � $LN4 T � $LN3 H � $LN1 X � $LN9 . $LN3 D . $LN2 ( . $LN8 � $LN8 � $LN6 � $LN3 4 � $LN2 � $LN3 � $LN2 � $LN3 $ � $LN2 � $LL6 P � $LN4 � � $LN9 � � $LN15 � � $LN19 � � $LN18 � � $LN11 � � $LN12 � $LN1 8 � $LN5 , � $LN4 4 � .xdata � 4 LB�Vy e k � .pdata � y e � � .xdata � ��Uy e � � .pdata � y e � � .xdata � 0 �0Q�h e � � .pdata � h e � � .xdata � ̠K0h e � .pdata � h e ( � .xdata � , XL�0 e G � .pdata � 0 e f � .xdata � ̠K00 e � � .pdata � 0 e � � .xdata � , ��s�9 e � � .pdata � 9 e � � .xdata � ̠K09 e
� .pdata � 9 e / � .xdata � ( ��<�\ e S � .pdata � \ e r � .xdata � �Iy�\ e � � .pdata � \ e � � .xdata � ( �,~s e � � .pdata � s e � � .xdata � �Iy�s e � .pdata � s e A � .xdata � 0 ��(�b e g � .pdata � b e � � .xdata � ̠K0b e � � .pdata � b e � � .xdata � 4 b�t~ e � � .pdata � ~ e � � .xdata � ��U~ e � .pdata � ~ e % � .xdata � 0 �0Q�k e C � .pdata � k e \ � .xdata � ̠K0k e t � .pdata � k e � � .xdata � $ ��Y8F e � � .pdata � F e � � .xdata � �Iy�F e � � .pdata � F e � .xdata � $ ��Y8? e C � .pdata � ? e \ � .xdata � �Iy�? e t � .pdata � ? e � � .xdata � , XL�3 e � � .pdata � 3 e � � .xdata � ̠K03 e � � .pdata � 3 e � .xdata � , ��s�< e ; � .pdata � < e Y � .xdata � ̠K0< e v � .pdata � < e � � .xdata � ( �"_ e � � .pdata � _ e � � .xdata � �Iy�_ e � � .pdata � _ e " � .xdata � 0 k6v e G � .pdata � v e g � .xdata � ̠K0v e � � .pdata � v e � � .xdata � 0 ���e e � � .pdata � e e � � .xdata � ̠K0e e � .pdata � e e $ � .xdata � 0 g2� M e C � .pdata � M e ` � .xdata � ̠K0M e | � .pdata � M e � � .xdata � , @�\6 e � � .pdata � 6 e � � .xdata � ̠K06 e � � .pdata � 6 e � .xdata � , It0 Y e / � .pdata � Y e G � .xdata � ̠K0Y e ^ � .pdata � Y e } � .xdata � , It0 V e � � .pdata � V e � � .xdata � ̠K0V e � � .pdata � V e � � .pdata � �{�I e � .xdata � ( ka&#n e 5 � .pdata � n e J � .xdata � �Iy�n e ^ � .pdata � n e z � .pdata � �6%�B e � � .gfids$y � ��
s� e � � .pdata � +��-� e � � .pdata � Am� e � � .pdata � ���. e � .xdata �
���� e " � .pdata � � e Q � .xdata � i�3&� e � .pdata � � e � � .pdata � (UI(� e � � .debug$S � , e .debug$S � < e .debug$S � @ e .debug$S � , e .debug$S � 4 e .debug$S � <
e .debug$S 0 e .debug$S 4 e .debug$S 0
e .debug$S @ e .debug$S 4 e .debug$S 8 e .debug$S , e .debug$S 4 e .debug$S , e .debug$S 4 e .debug$S
0 e .debug$S 0 e .debug$S 0 e .debug$S
@ e .debug$S @ e .debug$S 4 e .debug$S , e .debug$S , e .debug$S , e .debug$S 0 e .debug$S 4 e .debug$S , e .debug$S < ! e .debug$S @ " e .debug$S @ # e .debug$S 8 $ e .debug$S < % e .debug$S 8 & e .debug$S H ' e .debug$S < ( e .debug$S 0 ) e .debug$S 4 * e .debug$S 4 + e .debug$S ! ( , e .debug$S " $ - e .debug$T # e .chks64 $ ( e ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy@ ??_C@_0M@NJALGCHB@Application@ ??_C@_08EDKKPLCC@Security@ ElfrReportEventA ElfrReportEventExA __imp_GetComputerNameExA ElfrReadELA ElfrBackupELFA ElfrClearELFA ElfrOpenBELA MIDL_user_free __imp_RtlTimeToSecondsSince1970 ElfrReportEventW ElfrReportEventExW MIDL_user_allocate __imp_GetComputerNameExW __imp_NtQuerySystemTime ElfrReadELW ElfrDeregisterEventSource ElfrCloseEL ElfrBackupELFW ElfrClearELFW ElfrOpenBELW ElfrGetLogInformation ElfrChangeNotify ElfrOldestRecord ElfrNumberOfRecords __imp_I_RpcMapWin32Status __imp_RpcExceptionFilter ElfrRegisterEventSourceA ElfrOpenELA ElfrRegisterEventSourceW ElfrOpenELW __imp_RtlInitAnsiString __imp_RtlInitUnicodeString __imp_HeapFree __imp_RtlCopyString __imp_RtlCopyUnicodeString __imp_GetProcessHeap __imp_HeapAlloc RevertToSelf __imp_RtlAdjustPrivilege __imp_RtlImpersonateSelf Microsoft_Windows_EventlogEnableBits EVENTLOG_Context Microsoft_Windows_EventlogLevels Microsoft_Windows_EventlogKeywords EVENT_LOG_FULL EVENT_AUDIT_PROCESSING EVENT_AUDIT_PUBLISHER_META_DATA EVENT_AUDIT_FAILURE EVENT_AUDIT_AUTO_BACKUP EVENT_AUDIT_LOG_FULL EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL EVENT_AUDIT_LOG_CLEARED EVENT_AUDIT_EVENTS_DROPPED EVENT_SHUTDOWN EVENT_REPORTEVENT_ANSI EVENT_REPORTEVENT EVENT_REGISTEREVENTSOURCE EVENT_OPENEVENTLOG EVENT_PULLSUB_CREATE EVENT_PUSHSUB_CREATE EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY EVENT_PUBLISHER_TLG_INVALID_META_DATA EVENT_ABNORMAL_SHUTDOWN LOG_DROPPED_CHUNK EVENT_AUTO_BACKUP EVENT_LOG_CLEARED EVENT_EVENTS_DROPPED EVENT_PUBLISHER_META_DATA EVENT_PROCESSING CHANNEL_POLICY_APPLICATION_ERROR PRIMARY_CHANNEL_CONFIGURATION_WARNING INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE PRIMARY_CHANNEL_FATAL_ERROR INIT_CHANNEL_LOGFILTER_WARNING INIT_CHANNEL_LOGFILE_WARNING INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG INIT_CHANNEL_MOVED_CORRUPT_LOG INIT_CHANNEL_LOGGING INIT_CHANNEL_PUBLISHING INIT_CHANNEL_CONFIG_ERROR INIT_CHANNEL __imp_EtwEventUnregister __imp_EtwEventRegister __imp_EtwEventWriteTransfer EventDataDescCreate NtCurrentTeb ElfFlushEventLog ElfWriteClusterEvents ElfDeregisterClusterSvc ElfRegisterClusterSvc ElfReportEventA ElfReadEventLogA ElfBackupEventLogFileA ElfClearEventLogFileA ElfOpenBackupEventLogA ElfRegisterEventSourceA ElfOpenEventLogA ElfReportEventAndSourceW ElfReportEventW ElfReadEventLogW ElfDeregisterEventSource ElfCloseEventLog ElfBackupEventLogFileW ElfClearEventLogFileW ElfOpenBackupEventLogW ElfRegisterEventSourceW ElfOpenEventLogW ElfGetLogInformation ElfChangeNotify ElfOldestRecord ElfNumberOfRecords ElfDestroyReconnectionInfo ElfReconnect ElfGetModuleName ElfSetUseLegacyReportEvent ElfGetUseLegacyReportEvent ElfGetTheRpcHandle ElfCreateReconnInfo WevtInitialize ElfRevertThreadPrivilege ElfAssertThreadPrivilege McTemplateU0uzr0_EtwEventWriteTransfer McTemplateU0usr0_EtwEventWriteTransfer McGenEventUnregister_EtwEventUnregister McGenEventRegister_EtwEventRegister McGenEventWrite_EtwEventWriteTransfer McGenControlCallbackV2 McGenLevelKeywordEnabled ElfBackupEventLogFileA$filt$0 ElfBackupEventLogFileW$filt$0 ElfChangeNotify$filt$0 ElfClearEventLogFileA$filt$0 ElfClearEventLogFileW$filt$0 ElfCloseEventLog$filt$0 ElfDeregisterEventSource$filt$0 ElfGetLogInformation$filt$0 ElfNumberOfRecords$filt$0 ElfOldestRecord$filt$0 ElfOpenBackupEventLogA$filt$0 ElfOpenBackupEventLogW$filt$0 ElfOpenEventLogA$filt$0 ElfOpenEventLogW$filt$0 ElfReadEventLogA$filt$0 ElfReadEventLogW$filt$0 ElfReconnect$filt$0 ElfRegisterEventSourceA$filt$0 ElfRegisterEventSourceW$filt$0 ElfReportEventA$filt$0 ElfReportEventW$filt$0 __C_specific_handler __GSHandlerCheck __GSHandlerCheck_SEH __security_pop_cookie __security_push_cookie $unwind$ElfReportEventA $pdata$ElfReportEventA $unwind$ElfReportEventA$filt$0 $pdata$ElfReportEventA$filt$0 $unwind$ElfReadEventLogA $pdata$ElfReadEventLogA $unwind$ElfReadEventLogA$filt$0 $pdata$ElfReadEventLogA$filt$0 $unwind$ElfBackupEventLogFileA $pdata$ElfBackupEventLogFileA $unwind$ElfBackupEventLogFileA$filt$0 $pdata$ElfBackupEventLogFileA$filt$0 $unwind$ElfClearEventLogFileA $pdata$ElfClearEventLogFileA $unwind$ElfClearEventLogFileA$filt$0 $pdata$ElfClearEventLogFileA$filt$0 $unwind$ElfOpenBackupEventLogA $pdata$ElfOpenBackupEventLogA $unwind$ElfOpenBackupEventLogA$filt$0 $pdata$ElfOpenBackupEventLogA$filt$0 $unwind$ElfRegisterEventSourceA $pdata$ElfRegisterEventSourceA $unwind$ElfRegisterEventSourceA$filt$0 $pdata$ElfRegisterEventSourceA$filt$0 $unwind$ElfOpenEventLogA $pdata$ElfOpenEventLogA $unwind$ElfOpenEventLogA$filt$0 $pdata$ElfOpenEventLogA$filt$0 $unwind$ElfReportEventW $pdata$ElfReportEventW $unwind$ElfReportEventW$filt$0 $pdata$ElfReportEventW$filt$0 $unwind$ElfReadEventLogW $pdata$ElfReadEventLogW $unwind$ElfReadEventLogW$filt$0 $pdata$ElfReadEventLogW$filt$0 $unwind$ElfDeregisterEventSource $pdata$ElfDeregisterEventSource $unwind$ElfDeregisterEventSource$filt$0 $pdata$ElfDeregisterEventSource$filt$0 $unwind$ElfCloseEventLog $pdata$ElfCloseEventLog $unwind$ElfCloseEventLog$filt$0 $pdata$ElfCloseEventLog$filt$0 $unwind$ElfBackupEventLogFileW $pdata$ElfBackupEventLogFileW $unwind$ElfBackupEventLogFileW$filt$0 $pdata$ElfBackupEventLogFileW$filt$0 $unwind$ElfClearEventLogFileW $pdata$ElfClearEventLogFileW $unwind$ElfClearEventLogFileW$filt$0 $pdata$ElfClearEventLogFileW$filt$0 $unwind$ElfOpenBackupEventLogW $pdata$ElfOpenBackupEventLogW $unwind$ElfOpenBackupEventLogW$filt$0 $pdata$ElfOpenBackupEventLogW$filt$0 $unwind$ElfRegisterEventSourceW $pdata$ElfRegisterEventSourceW $unwind$ElfRegisterEventSourceW$filt$0 $pdata$ElfRegisterEventSourceW$filt$0 $unwind$ElfOpenEventLogW $pdata$ElfOpenEventLogW $unwind$ElfOpenEventLogW$filt$0 $pdata$ElfOpenEventLogW$filt$0 $unwind$ElfGetLogInformation $pdata$ElfGetLogInformation $unwind$ElfGetLogInformation$filt$0 $pdata$ElfGetLogInformation$filt$0 $unwind$ElfChangeNotify $pdata$ElfChangeNotify $unwind$ElfChangeNotify$filt$0 $pdata$ElfChangeNotify$filt$0 $unwind$ElfOldestRecord $pdata$ElfOldestRecord $unwind$ElfOldestRecord$filt$0 $pdata$ElfOldestRecord$filt$0 $unwind$ElfNumberOfRecords $pdata$ElfNumberOfRecords $unwind$ElfNumberOfRecords$filt$0 $pdata$ElfNumberOfRecords$filt$0 $pdata$ElfDestroyReconnectionInfo $unwind$ElfReconnect $pdata$ElfReconnect $unwind$ElfReconnect$filt$0 $pdata$ElfReconnect$filt$0 $pdata$ElfCreateReconnInfo __guard_fids_WevtInitialize $pdata$WevtInitialize $pdata$ElfRevertThreadPrivilege $pdata$ElfAssertThreadPrivilege $unwind$McTemplateU0uzr0_EtwEventWriteTransfer $pdata$McTemplateU0uzr0_EtwEventWriteTransfer $unwind$McTemplateU0usr0_EtwEventWriteTransfer $pdata$McTemplateU0usr0_EtwEventWriteTransfer $pdata$McGenEventUnregister_EtwEventUnregister
/152 1606894062 100666 56384 `
d�S �A�_"� � .debug$S �
@ B.text$mn � � H
@`.debug$S � � � $ @B.text$mn � � @`.debug$S , 4 ( @B.text$mn @ � @`.debug$S < , h @B.text$mn � � � @`.debug$S ( � �$ D @B.text$mn � �' @(
@`.debug$S � �( �+ $ @B.text$mn � �, �- @`.debug$S . 1 " @B.text$mn ( h2 �2 @`.debug$S p �2 4 @B.text$mn ( �4 �4 @`.debug$S x �4 @6 @B.text$mn ( �6 �6 @`.debug$S � �6 �9 @B.text$mn ( �: �: @`.debug$S � �: �< @B.text$mn ( T= |= @`.debug$S � �= d? @B.text$mn p @ @`.debug$S � t@ <B @B.text$mn p �B @`.debug$S � 8C E @B.text$mn ( �E �E @`.debug$S � �E dG @B.text$mn �G @`.debug$S � �G �H @B.text$mn , �H �I @`.debug$S �J �N 4 @B.text$mn � �P �Q
@`.debug$S | R �U $ @B.text$mn p �V \W @`.debug$S � �W �Z @B.text$mn l �[ \ @`.debug$S � T\ <_ @B.text$mn h h` �` @`.debug$S � �` �d ( @B.text$mn h .f �f @`.debug$S � �f dj ( @B.text$mn l �k `l @`.debug$S � �l �o @B.text$mn l �p q @`.debug$S � \q Ht @B.text$mn tu �w @`.debug$S @ �w : X @B.text$mn �� ʄ @`.debug$S < 8� t� V @B.text$mn | Џ @`.debug$S � L� � @B.text$mn � � @`.debug$S 0 �� �� * @B.xdata , b� �� @0@.pdata �� �� @0@.pdata Қ ښ @0@.pdata � � @0@.pdata �� �� @0@.pdata � � @0@.pdata � "� @0@.pdata ,� 4� @0@.xdata , >� j� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� ț @0@.pdata қ ڛ @0@.pdata � � @0@.pdata �� �� @0@.pdata � � @0@.pdata � "� @0@.pdata ,� 4� @0@.pdata >� F� @0@.pdata P� X� @0@.pdata b� j� @0@.pdata t� |� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.debug$T h
�� @ B.chks64 � $�
.drectve n ��
� � S d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\eventapi.obj : < � � k k
Microsoft (R) Optimizing Compiler � � : s ����o� }�+4qt*Y lռ��́dq�X � ��*�HRI �̏!�&�e�b ��E2b�^� � �;�,�9Y���dnB_ l��fp������L�5 � �l��ћ��o?� �O�����:Yt�� � �^ � = � onecore\admin\wmi\events\advapi\objfre\arm64\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\arm64\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\admin\wmi\events\advapi\eventapi.c onecore\external\shared\inc\intsafe.h onecore\external\sdk\inc\nxarm64.h � L]_ � ��{��� �� �! � � � ���� � ?� � � ���" �R� ��C � ?�@�6 � �R � � ��� ���C � ?��@��� � � � ���� *�C � ?��*�{è�A��_�
( , H � T X t � x | � l 5 G � � @_ �BackupEventLogA > hEventLog AE x AE � EQ EQ @ � >� BackupFileName EQ EQ H � >~ AnsiString EQ � >t ReturnValue A � A � >x UnicodeString EQ � > Status A
D A
l Z �^ _ @ B! @ Q hEventLog H � Q BackupFileName ~ Q AnsiString x Q UnicodeString 9$ �^ 9@ <_ 9h _ 9� =_ O� p � 8 d R � ] � ^ �( _ �D a �H b �L c �T g �l j �x k �� l �, � 0 �
_ � c �
o � s �
� � � �
� � � �
� � � �
� � � �
� �
' � + �
7 � ; �
c � g �
� � � �
� � � �
8 � < �
H � L �
X � \ �
h � l �
� � � �
� ��{��� �� ���� � � � ��� �� ���C � ?� S� 4�C ��� �� �6 � �R 3 �R�'@yH 4���@� 1@� � � �R @� ��� ?��* � � ����
�R ?� �R�{¨�A��_� D L � p t � � � � 5 G � � _ �BackupEventLogW > hEventLog AE � D L 4 AE � EQ EQ 0 � > BackupFileName A2 A2 � EQ EQ 8 � >t ReturnValue A 8 A T < A � A � >x Unicode EQ � > Status A
H A
\ 0 $ M �^ d N Z _ �^ 0 B!
h �^ 0 Q hEventLog 8 Q BackupFileName x Q Unicode 90 _ 9�
_ 9� �! O � � � 8 � ( � 2 � 3 �8 7 �< < �H > �L ? �P @ �T A �X B �\ E �d F �� H �� 8 �� 9 �, � 0 �
_ � c �
w � { �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
& � * �
6 � : �
J � N �
Z � ^ �
� � � �
� � � �
� � � �
a � e �
q � u �
� � � �
� � � �
� ��{��� � � � ��� ?� � � ���� * ?��*�{���A��_� ! ! � � 8 G @ 4 �^ �BaseSetLastNTError > Status EQ @ EQ � >" dwErrorCode A , B! Q Status 9 �^ 9, �! O� 8 @ 8 , 2 � 5 � 6 �0 7 �, � 0 �
c � g �
w � { �
� � � �
� � � �
� � � �
� �
�S���[��c��k��# ��{��� ��*� ��*{B5��k�* �R�
T�
4�� qC
Tj@�tB*���� T��_�h� �� �?
k! T# �R�*���C � ���7# �R�*���C � ���7� @�b*@�� 4_ k Th.@� k� T`B(�@"� �
H��T�� T�� ���7h6@y� 4h&@� k� TZ 4� 7iB(�?�C T� � �R �R�*���C � �`�7h6@y� �k�Ti2@�� 4?kH Th6@� k� ThB(� A)� �
!I�.�T�" Th@� ���K5��5x 4 �R �{¨�#@��kC��cB��[A��SŨ�_� Վ �| � � � � � � � � 9 G � � L_ �CheckEventLogBuffer > lpBuffer EQ EQ � � >" nBytesBufferSize A! ( x EQ ( EQ � � >" nBytesRead EQ , EQ � � >t isUnicode A$ 4 h EQ 0 EQ � � > pbTest A: ` EQ � > pbTooFar AF P < AF @ h < > pStartOfSid A2 � A2 � > pDataStart A: X A: � > pString A; A; � h > pPastEndOfBuffer AM , l >t NumRecordsRead A" 8 h > pPastEndOfData A; \ 0 A; @ l 0 > pPastEndOfSid A: � A: � >u cnt A ( A @ d� ( >t NumUncheckedBytes A � > Status A
� @ � A
@ l< >M_ pEventRecord AE $ � Z �^ �^ �^ �^ p B! � Q lpBuffer � " Q nBytesBufferSize � " Q nBytesRead � t Q isUnicode Q pbTest O� p � 8 + d � �( � �, � �< � �@ � �H � �P � �X � �l � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� �� �� �� �
� �
� �$ �(
�8 �@ �T �X �\ �` " �d $ �l ( �p * �� - �� 0 �� . �, � 0 �
f � j �
z � ~ �
� � � �
� � � �
� � � �
� � � �
� �
. � 2 �
B � F �
V � Z �
w � { �
� � � �
� � � �
� � � �
� � � �
� � � �
� ! �
- � 1 �
O � S �
_ � c �
� � � �
� � � �
� � � �
� � � �
� �
, � 0 �
J � N �
Z � ^ �
� � � �
� � � �
� � � �
� � � �
� � � �
� ��{��� �� �! � � � ���� � ?� � � ���" �R� ��C � ?�@�6 � �R � � ��� ���C � ?��@��� � � � ���� *�C � ?��*�{è�A��_�
( , H � T X t � x | � k 4 G � � A_ �ClearEventLogA > hEventLog AE x AE � EQ EQ @ � >� BackupFileName EQ EQ H � >~ AnsiString EQ � >t ReturnValue A � A � >x UnicodeString EQ � > Status A
D A
l Z �^ _ @ B! @ Q hEventLog H � Q BackupFileName ~ Q AnsiString x Q UnicodeString 9$ �^ 9@ <_ 9h _ 9� =_ O � p � 8 d � ! � " �( # �D % �H & �L ' �T + �l . �x / �� 0 �, � 0 �
^ � b �
n � r �
� � � �
� � � �
� � � �
� � � �
� �
& � * �
6 � : �
b � f �
� � � �
� � � �
7 � ; �
G � K �
W � [ �
g � k �
� � � �
� ��{��� �� ��� � � � ��� �� ���C � ?� SH 5 � � ����
�R ?� �R � �� ��C ��� �� �6 � �R 3 �R�'@yH 4���@� 1@� � � �R @� ��� ?��*�{¨�A��_� < @ h p � � � � U 4 G � � _ �ClearEventLogW > hEventLog AE p h AE � EQ EQ 0 � > BackupFileName A2 T $ EQ EQ 8 � >t ReturnValue A x 8 A � >x Unicode EQ � > Status A
l A
� 0 $ M �^ �� N Z _ �^ 0 B!
h �^ 0 Q hEventLog 8 Q BackupFileName x Q Unicode 90 _ 9L �! 9�
_ O � � � 8 � � � � � � �8 � �< � �P � �X � �\ � �` � �l � �p � �t � �x � �| � �� �� �� �, � 0 �
^ � b �
r � v �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
) � - �
O � S �
p � t �
� � � �
1 � 5 �
A � E �
Q � U �
l � p �
�{��� � �� �6 � �R �R�{���_� � �
3 G ( +_ �CloseEventLog > hEventLog EQ EQ ( >t ReturnValue A
> Status A
Z ,_ �^ B! Q hEventLog O � P ( 8 D � � � � � � � � � � � � � �, � 0 �
a � e �
u � y �
� � � �
� � � �
� $ �
�{��� � �� �6 � �R �R�{���_� � � ; G ( (_ �DeregisterEventSource > hEventLog EQ EQ ( >t ReturnValue A
> Status A
Z *_ �^ B! Q hEventLog O � P ( 8 D � �
� � � � �, � 0 �
i � m �
} � � �
� � � �
� � � �
( � , �
�{��� � �� �6 � �R �R�{���_� � � G < G (
_ �GetEventLogInformation > hEventLog EQ EQ ( >" dwInfoLevel EQ EQ ( > lpBuffer EQ EQ ( ( >" cbBufSize EQ EQ 0 ( >" pcbBytesNeeded EQ ( EQ 8 ( > ntStatus A
Z _ �^ B! Q hEventLog " Q dwInfoLevel ( Q lpBuffer 0 " Q cbBufSize 8 " Q pcbBytesNeeded O � H ( 8 < � � � � � � � � � � � �, � 0 �
j � n �
~ � � �
� � � �
� � � �
� � � �
� � � �
� # �
3 � 7 �
` � d �
t � x �
� � � �
\ � ` �
�{��� � �� �6 � �R �R�{���_� � � w @ G ( _ �GetNumberOfEventLogRecords > hEventLog EQ EQ ( >" NumberOfRecords EQ EQ ( >t ReturnValue A
> Status A
Z _ �^ B! Q hEventLog " Q NumberOfRecords O � P ( 8 D Q � U � W � X � Y � Z � [ �, � 0 �
n � r �
� � � �
� � � �
� � � �
� � � �
� �
� � � �
�{��� � �� �6 � �R �R�{���_� � � n = G ( _ �GetOldestEventLogRecord > hEventLog EQ EQ ( >" OldestRecord EQ EQ ( >t ReturnValue A
> Status A
Z _ �^ B! Q hEventLog " Q OldestRecord O � P ( 8 D � � � � � � � � � � � � �, � 0 �
k � o �
� � �
� � � �
� � � �
� � � �
�
�
� � � �
�R y �a �( �9� 4�R! �?
k� T( �9) h��5�R?kc T �R
(
= S+= S
�R �R y
y �R�_� � 3 4 G p l �^ �InitAnsiString >| DestinationString EQ 0 p >�^ SourceString A3 8 A3 T @ EQ 8 p >" Length A l B! 0 | Q DestinationString 8 �^ Q SourceString O � � p 8
t \ � ] � ^ � _ � ` � j �, k �4 n �@ o �H s �T u �X x �` { �, � 0 �
j � n �
� � � �
� � � �
� � � �
� � � �
H � L �
�R y �a �( @y� 4�R! �?
k� T( @y) h��5�R?kc T �R
(
= S+= S
�R �R y
y �R�_� � : 7 G p l �^ �InitUnicodeString >v DestinationString EQ 0 p >� SourceString A3 8 A3 T @ EQ 8 p >" ByteLength A l B! 0 v Q DestinationString 8 � Q SourceString O � � p 8
t � � � � � � � � � � � �, � �4 � �@ � �H � �T � �X � �` � �, � 0 �
m � q �
� � � �
� � � �
� � � �
� � � �
P � T �
�{��� � �� �6 � �R �R�{���_� � � 5 : G ( #_ �NotifyChangeEventLog > hEventLog EQ EQ ( > hEvent EQ EQ ( > Status A
Z %_ �^ B! Q hEventLog Q hEvent O � H ( 8 < ) � , � . � / � 0 � 2 �, � 0 �
h � l �
| � � �
� � � �
� � � �
� � � �
L � P �
���_� � V 2 G �^ �NtCurrentTeb J! O � ( � < � = �, � 0 �
l � p �
� ��{��� ���@ � � � ���� �� � ?� � � ���" �R� ��C � ?�@�6 � ��3 � � ��� ���C � ?�� � � � ������ � ?� � � ���" �R� ��� � ?�� *��6 � � ����C � ?��*� � � ��� ���� � ?�� @��@� � � � ���� ��C � ?� � � ����� � ?����{Ĩ�A��_�
, 0 L � X \ t
x
� � � � � � � � � � � Q 9 G , 8_ �OpenBackupEventLogA >� UNCServerName EQ EQ P , >� FileName AE � < � AE L � � � EQ EQ X , >~ AnsiString EQ >x UnicodeServerName EQ > ReturnHandle AE AE >x UnicodeFileName EQ 0 > Status A
H A � A
L � < D A L � � � Z �^ _ P B! P � Q UNCServerName X � Q FileName ~ Q AnsiString x Q UnicodeServerName 0 x Q UnicodeFileName 9( �^ 9D <_ 9l _ 9� �^ 9� <_ 9� =_ 9� _ 9 =_ 9 =_ O � � , 8 � � � �, �H �L 7 �X �p # �t $ �� % �� ' �� ( �� ) �� * �� . �� 1 �� 3 � 4 � 5 �, � 0 �
k � o �
� � �
� � � �
� � � �
� � � �
� � � �
� �
C � G �
j � n �
z � ~ �
� � � �
� � � �
� � � �
� � � �
� �
� � � �
� � � �
� � � �
� � �
� �
� ! �
- � 1 �
= � A �
M � Q �
h � l �
� ��{��� � � �� � ������ �� � ?� � � ��� ���c � ?ֳ � � � ��� �� ���c ��� ?� Sh 5@ �C ��c �� � �� �6 � �� � @��7@yH 4���@� 1@� � � �R @� ��� ?����{Ĩ�A��_�3 � , 0 H L � � � � � � � 9 G � � _ �OpenBackupEventLogW > UNCServerName EQ H � EQ ���� > FileName AE | t EQ EQ P � > LogHandle EQ � >x Unicode EQ ( � > ReturnHandle AE � AE � 8 >x UnicodeFileName EQ � > Status A
t ( A
� 0 $ M �^ �� N Z _ �^ P B!
h �^ H Q UNCServerName P Q FileName Q LogHandle ( x Q Unicode x Q UnicodeFileName 9( _ 9@ _ 9d _ 9�
_ O � � � 8 � � � � �, � �D � �H � �p � �t � �x � �� �� �� �� �� �� ��
�� �, � 0 �
k � o �
� � �
� � � �
� � � �
� � � �
� � � �
� �
C � G �
S � W �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� ��{��� � � �� � ���� ��c � ?� � � ������ � ?��C ��c �� � �� �6 � �� � @��{Ĩ�A��_�
(
,
L T � � q 3 G p d �^ �OpenEventLogA >� UNCServerName AE L EQ H p EQ ���� >� ModuleName EQ EQ P p >~ AnsiString EQ ( d >~ AnsiModuleName EQ d > LogHandle EQ d > ReturnHandle A2 \ A2 d > Status A
P Z �^ �^ P B! H � Q UNCServerName P � Q ModuleName ( ~ Q AnsiString ~ Q AnsiModuleName Q LogHandle 9$ �^ 9< �^ O � ` p 8 T � � � �( � �@ � �P � �T � �X � �\ � �` � �, � 0 �
a � e �
u � y �
� � � �
� � � �
� � � �
� � � �
� �
D � H �
k � o �
{ � �
� � � �
] � a �
m � q �
� � � �
� ��{��� � � � ���� ��c � ?� � � ������ � ?��C ��c �� � �� �6 � �� � @��{Ĩ�A��_� $ ( H P � � q 3 G l ` _ �OpenEventLogW > UNCServerName AE L EQ H l EQ ���� > ModuleName EQ EQ P l > LogHandle EQ ` >x Unicode EQ ( ` > ReturnHandle A2 X A2 ` >x UnicodeModuleName EQ ` > Status A
L Z _ �^ P B! H Q UNCServerName P Q ModuleName Q LogHandle ( x Q Unicode x Q UnicodeModuleName 9 _ 98 _ O � ` l 8 T l � t �$ u �< w �L } �P ~ �T �X � �\ � �, � 0 �
a � e �
u � y �
� � � �
� � � �
� � � �
� � � �
� �
; � ? �
K � O �
{ � �
� � � �
] � a �
m � q �
� � � �
�S���[��{��� ����*�� �� *3�7�@�� 4 �R�*�� �� *s �6�* ��3* } S�{���[A��S¨�_� < � L � � L 3 G h X Q_ �ReadEventLogA > hEventLog EQ h EQ �� >" dwReadFlags EQ h EQ � >" dwRecordOffset EQ $ h EQ � > lpBuffer AG L EQ ( h EQ ���� >" nNumberOfBytesToRead A H EQ EQ 0 h >" pnBytesRead AF H EQ EQ 8 h ! >" pnMinNumberOfBytesNeeded EQ EQ @ h > Status A $ @ Z U_ L_ �^ 0 B! Q hEventLog " Q dwReadFlags $ " Q dwRecordOffset ( Q lpBuffer ! 0 " Q nNumberOfBytesToRead 8 " Q pnBytesRead % @ " Q pnMinNumberOfBytesNeeded O� P h 8 D X � ] �$ i �0 k �D n �H o �P t �, � 0 �
a � e �
u � y �
� � � �
� � � �
� � � �
� � � �
� �
+ � / �
? � C �
n � r �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
/ � 3 �
P � T �
` � d �
�S���[��{��� ����*�� �� *3�7�@�� 4# �R�*�� �� *s �6�* ��3* } S�{���[A��S¨�_�
< � L � � L 3 G h X P_ �ReadEventLogW > hEventLog EQ h EQ �� >" dwReadFlags EQ h EQ � >" dwRecordOffset EQ $ h EQ � > lpBuffer AG L EQ ( h EQ ���� >" nNumberOfBytesToRead A H EQ EQ 0 h >" pnBytesRead AF H EQ EQ 8 h ! >" pnMinNumberOfBytesNeeded EQ EQ @ h > Status A $ @ Z T_ L_ �^ 0 B! Q hEventLog " Q dwReadFlags $ " Q dwRecordOffset ( Q lpBuffer ! 0 " Q nNumberOfBytesToRead 8 " Q pnBytesRead % @ " Q pnMinNumberOfBytesNeeded O� P h 8 D O � T �$ _ �0 a �D d �H e �P j �, � 0 �
a � e �
u � y �
� � � �
� � � �
� � � �
� � � �
� �
+ � / �
? � C �
n � r �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
/ � 3 �
P � T �
` � d �
� ��{��� � � � ���� ��c � ?� � � ������ � ?��C ��c �� � �� �6 � �� � @��{Ĩ�A��_�
$
(
H P � � x : G l ` �^ �RegisterEventSourceA >� UNCServerName AE L EQ H l EQ ���� >� ModuleName EQ EQ P l >~ AnsiString EQ ( ` >~ AnsiModuleName EQ ` > LogHandle EQ ` > ReturnHandle A2 X A2 ` > Status A
L Z �^ �^ P B! H � Q UNCServerName P � Q ModuleName ( ~ Q AnsiString ~ Q AnsiModuleName Q LogHandle 9 �^ 98 �^ O� ` l 8 T � � � �$ � �< � �L � �P � �T � �X � �\ � �, � 0 �
h � l �
| � � �
� � � �
� � � �
� � � �
� � � �
# � ' �
K � O �
r � v �
� � � �
� � � �
d � h �
t � x �
� � � �
� ��{��� � � � ���� ��c � ?� � � ������ � ?��C ��c �� � �� �6 � �� � @��{Ĩ�A��_� $ ( H P � � x : G l ` �^ �RegisterEventSourceW > UNCServerName AE L EQ H l EQ ���� > ModuleName EQ EQ P l > LogHandle EQ ` >x Unicode EQ ( ` > ReturnHandle A2 X A2 ` >x UnicodeModuleName EQ ` > Status A
L Z �^ �^ P B! H Q UNCServerName P Q ModuleName Q LogHandle ( x Q Unicode x Q UnicodeModuleName 9 _ 98 _ O� ` l 8 T � � � �$ � �< � �L � �P � �T � �X � �\ � �, � 0 �
h � l �
| � � �
� � � �
� � � �
� � � �
� � � �
� �
B � F �
R � V �
� � � �
� � � �
d � h �
t � x �
� � � �
�S���[��c�� �� ��{��� ��� � ��# �8< S�; yY< S�7 y�*�+ �� �� ��< S�3 y�# ��' ���� �� ��� 1@���}� �R @� � � ��� ?� ��' �5
��@�k T�� 1@��� �R @� � � ��� ?ֳ@��Z3� ��Zs� �� 5s � �h � � s � ���@��@��#@� ( � ��'@��3@y� @��+@��7@y�;@y�#@��@��'@�� 5� �� �� y�K@�� ����*�*�*�*�� �� �� 4�� � ���@�� ��� 1@� �R @���� ?�s Q�5�� 1@��� �R @� � � ��� ?֠@� � �6 � �R �R�� ��{Ũ� @��@��cB��[A��SĨ�_� �
� �x | � � � � h x | � � � � � 2 G 0_ �ReportEventA > hEventLog AI $ EQ ���� EO @ >! wType A" , EQ ���� EO >! wCategory A# 4 EQ ���� EO >" dwEventID A% < EQ ���� EO ( > lpUserSid EO 0 A6 A6 8 � 4 EQ ���� EO 8 >! wNumStrings EQ ���� EO >" dwDataSize EO A A 8 � 4 EQ ���� EO $ >-_ lpStrings AH \ � AH 8 � H ( EQ ���� > lpRawData EQ EO � >t ReturnValue A
� ( >1_ pAStrings AG � EO H >" AllocatedStrings A � EO > Status A
l t h A
� EO M �^ d N M �^ �� N M �^ �� N M �^ �� N Z �^ 4_ �^ � @�"
h �^ $LN20 @ O hEventLog ! O wType ! O wCategory ( " O dwEventID 8 O lpUserSid ! O wNumStrings $ " O dwDataSize P -_ O lpStrings � O lpRawData H 1_ O pAStrings " O AllocatedStrings O Status 9� 7_ 9� 7_ 9�
_ 9�
_ O � 8 � �\ � �` � �d � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � � � �8 � �< � �p � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �, � 0 �
\ � ` �
p � t �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
� �
< � @ �
P � T �
d � h �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
� �
? � C �
O � S �
_ � c �
w � { �
� � � �
� � � �
� � � �
� � � �
� � �
� �
9 � = �
a � e �
u � y �
� � � �
� � � �
� � � �
� � � �
� �
� � � �
� � � �
� � � �
� � �
� �
( � , �
�S���[��c�� �� ��{��� ��� � ��# �8< S�; yY< S�7 y�*�+ �� �� ��< S�3 y�# ��' ���� �� ��� 1@���}� �R @� � � ��� ?� ��' �v
��@�kB T�� 1@��� �R @� � � ��� ?ֳ@��Z3�� �H
� � �Zs� �� 5s � �h ���s � ���@��@��#@� H � ��'@��3@y� @��+@��7@y�;@y�#@��@��'@�� 5� �� �� y�K@�� ����*�*�*�*�� �� �� 4�� � ���@�� ��� 1@� �R @����� ?�s Q�5�� 1@��� �R @� � � ��� ?֨@� � � �6�* � �R �R�� ��{Ũ� @��@��cB��[A��SĨ�_� �
�x | � � � � p � � � � � � � � 2 G E_ �ReportEventW > hEventLog AI $ EQ ���� EO @ >! wType A" , EQ ���� EO >! wCategory A# 4 EQ ���� EO >" dwEventID A% < EQ ���� EO ( > lpUserSid EO 0 A6 A6 @ � 4 EQ ���� EO 8 >! wNumStrings EQ ���� EO >" dwDataSize EO A A @ � 4 EQ ���� EO $ >B_ lpStrings AG \ � AG @ � H ( EQ ���� > lpRawData EQ EO � >t ReturnValue A
� ( >F_ pUStrings AH � EO H >" AllocatedStrings A � EO > Status A
t EO M �^ d N M �^ �� N M �^ �� N M �^ �� N Z �^ I_ �^ � @�"
h �^ $LN20 @ O hEventLog ! O wType ! O wCategory ( " O dwEventID 8 O lpUserSid ! O wNumStrings $ " O dwDataSize H B_ O lpStrings � O lpRawData H F_ O pUStrings " O AllocatedStrings O Status 9� 7_ 9� 7_ 9�
_ 9�
_ O � ( 8 " � �\ � �` � �d � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � � � � � �@ � �D � �x � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �, � 0 �
\ � ` �
p � t �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
� �
< � @ �
P � T �
d � h �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
� �
? � C �
O � S �
_ � c �
w � { �
� � � �
� � � �
� � � �
� � � �
� � �
� �
9 � = �
a � e �
u � y �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
@�
�R?�$9@� T" 4(@y� 4) �?�J c��T( � (@9� 4) �?�J c��T( � �� TJ 5� 5 � �R @ �_֎ � � 1 G | | �^ �StringCheck >�^ ppbTest EQ x > pbTooFar EQ ( x >t isUnicode EQ 0 x >t noEmptyAllowed EQ 4 x >q puTest A: 4 A; $ A: T $ A; > pTest A; D A: T $ A; 8 >t len A p B! �^ Q ppbTest ( Q pbTooFar 0 t Q isUnicode 4 t Q noEmptyAllowed O� � | 8 � o � s � u � w � { �( | �0 ~ �4 � �8 � �H � �P � �T � �d � �h � �p v �, � 0 �
] � a �
� � � �
� � � �
� � � �
� � � �
� �
� �
* � . �
N � R �
^ � b �
n � r �
� � � �
$ � ( �
�S��� ��{��� �� �h2 � �T|@�B T�q T�2 q��H T���� �" T@� T � � ��� ?� � � ����� �R ?� �u � ������ ��� � � � ���� * ?� � � ����� �R ?� �� �� *s 4 �R � �{��� @��S¨�_� � �� �P T ` d � � � � � � � � � s - F �^ �TestSid > pbStartOfSid AE � � AE � EQ EQ 0 � > pbTooFar EQ EQ 8 � >" sidLength AF � EQ EQ @ �
>�^ pSid AG | T AG � > pOnePastEndOfSid A: 4 >t valid A � 8 A � Z �^ �^ 0 B! 0 Q pbStartOfSid 8 Q pbTooFar @ " Q sidLength 9\ �^ 9t �^ ^t 9� �^ 9� �^ O � � 8 � + � 2 �, 5 �0 6 �8 8 �< : �H = �P ? �| @ �� B �� D �� E �� F �� G �� K �� N �� O �� 3 �, � 0 �
Z � ^ �
n � r �
� � � �
� � � �
� � � �
� � � �
� � � �
�
�
� ! �
< � @ �
L � P �
w � { �
� � � �
� � � �
/ � 3 �
? � C �
O � S �
_ � c �
o � s �
� � � �
� P{ ��ц�Ȃ(� � � � � ( � � 9 i � � -� � m � � q � � � a � � a � � P~ ��ц�Ȃ(� � � � � ( � � Q i � � �� � � � � � � � m � m � � � � � ) � ) � ) � ) � ! ) � $ ) � ' A a 6 V �N cm�U%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\arm64\precomp.obj �� VD NtCurrentTeb ���
| �^ t �^ �^ InitAnsiString �
�^ t t �^ �^ StringCheck " �% �^ BaseSetLastNTError �
�^ v � t �^ �^ InitUnicodeString �� " �^ �^ TestSid
T
t �^ �^ IsValidSid �
� " # �^
�^ " t �^
�^ ^ " �^ RegisterEventSourceA ��� $ $ 0W �^ " �^ ElfRegisterEventSourceA �^
�^ �^ OpenEventLogA �� �^ ElfOpenEventLogA ��� " �^ RegisterEventSourceW ��� v v 0W �^ " �^ ElfRegisterEventSourceW �^
_ �^ OpenEventLogW �� �^ ElfOpenEventLogW ��� �^ OpenBackupEventLogW " �^ ElfOpenBackupEventLogW � � v �- _
_ " ^@
_ " " " t _ " _ GetEventLogInformation � " " " _ " _ ElfGetLogInformation ��� t _ _ BackupEventLogW v _ " _ ElfBackupEventLogFileW � " t _ " _ GetOldestEventLogRecord " _ _ ElfOldestRecord _ ClearEventLogW �" _ ElfClearEventLogFileW ��& _ GetNumberOfEventLogRecords � _ ElfNumberOfRecords � t !_ " "_ NotifyChangeEventLog ��� !_ $_ ElfChangeNotify
t &_ " '_ DeregisterEventSource �� &_ & )_ ElfDeregisterEventSource ��� '_ CloseEventLog �� )_ ElfCloseEventLog ���
� * ! ! " ! " -_ t ._ /_ ReportEventA ���
| 6 ! ! " ! " 1_ ! " " 2_ 3_ ElfReportEventA " # 5_
6_ �^ OpenBackupEventLogA
{ v 9_ :_
;_
� � t >_ ?_ BackupEventLogA ?_ ClearEventLogA �
* ! ! " ! " B_ t C_ D_ ReportEventW ���
v 6 ! ! " ! " F_ ! " " G_ H_ ElfReportEventW " " t J_ K_ CheckEventLogBuffer
�& " " " " " " t N_ O_ ReadEventLogW �� O_ ReadEventLogA ��" " " " " " R_ S_ ElfReadEventLogW ��� S_ ElfReadEventLogA ���
���
���
���
���� -FC -MT -wd4746 -volatile:ms -Oy- -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427
Z_ Z [_ -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X V_ W_ X_ Y_ \_ ��V��l
� >�#t�t�-��"��ߕ��A l�_N���o;�כ4�/�]T��^.&� �cL[�z�H����>�#t�t�X�O��F��$3���*\�}θ*�tN�(6��d�P�&l�N�(6��`U�7 ǃ9N�(6����%#�v'�N�(6�ש�[F��h�N�(6�����g$�5/�( 0��r8
���**� ���%�t�*��d��N�(6�צ<��u�4� ���_�����h`;�
���Q�o@O�w�{>nQ�6�<#�4}ǂ �. �Lb4qrЛ� hF|�k��h��������K��Ce�u�͋��^ߙT(�S��|�� O�n�n���h������蠸x�LL�h������C���74��<8��R�G��,
k ��F�AF� �0�?��%��@W&a��,|�1���b�Ơ�2J`d�0��
D��Up��� zZl|Xu���j�"ba�p"۳�ٵ�h�~{r�$�|��r�$�|��TC Ygs�߯Up��� zZl|Xu����q ��Ug��� \
��l�Ğ�p"۳�ٵ�p"۳�ٵe�6� B��2���[hr�qi ��-qi ��-qi ��-qi ��-qi ��-qi ��-���&:� Z�L��� -INCLUDE:__@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinGEUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� .debug$S � e % = N i � � � � � � �
1 I Z u � � � � � � 8 I \ .text$mn �
6T� e .debug$S � $ e .text$mn � ��p e .debug$S , ( e .text$mn @ cxl� e .debug$S < e .text$mn � !� � e .debug$S ( D e .text$mn
�
6T� e .debug$S � $
e .text$mn � ��� e .debug$S
" e .text$mn ( �B2� e .debug$S p e .text$mn ( �B2� e .debug$S x e .text$mn ( �B2� e .debug$S � e .text$mn ( �B2� e .debug$S � e .text$mn ( �B2� e .debug$S � e .text$mn p # � e .debug$S � e .text$mn p �Ō� e .debug$S � e .text$mn ( �B2� e .debug$S � e .text$mn ~})� e .debug$S � e .text$mn , i5�F e .debug$S ! 4 e .text$mn " �
&+�] e .debug$S # | $ " e .text$mn $ p ��# e .debug$S % � $ e .text$mn & l �� � e .debug$S ' � & e .text$mn ( h Fg4 e .debug$S ) � ( ( e .text$mn * h $t e .debug$S + � ( * e .text$mn , l �� � e .debug$S - � , e .text$mn . l �� � e .debug$S / � . e .text$mn 0 t[\ e .debug$S 1 @ X 0 e .text$mn 2 ��2� e .debug$S 3 < V 2 e .text$mn 4 | f�0� e .debug$S 5 � 4 e .text$mn 6 ��6� e .debug$S 7 0 * 6 e x � 0 � ( � � , � $ � �
� 2 * % 4 TestSid 6 1 " E . Z & h x � � � � � �
+ > memcpy $LN43 0 $LN18 � 0 $LN15 � 0 $LN9 � 0 $LL7 � 0 $LN5 � 0 $LN6 � 0 $LN13 p 0 $LN22 8 0 $LL4 � 0 $LN3 0 $LN36 � 0 $LN39 � 0 $LN8 � 0 $LN20 0 $LN8 ( $LN3 P ( $LN2 D ( $LN6 H ( $LN11 $LN9 L $LN6 � $LN5 � $LN1 $LN3 p $LN2 X $LN6 , $LN3 ` , $LN2 \ , $LN6 $ $LN3 d $ $LN2 ` $ $LN7 $LN1 � $LN3 l $LN2 T $LN7
$LN1 �
$LN3 l
$LN2 T
$LN43 2 $LN18 � 2 $LN15 � 2 $LN9 � 2 $LL7 � 2 $LN5 � 2 $LN6 � 2 $LN13 x 2 $LN22 @ 2 $LL4 � 2 $LN39 � 2 $LN12 � 2 $LN3 2 $LN11 � 2 $LN38 2 $LN8 � 2 $LN20 2 $LN8 * $LN3 P * $LN2 D * $LN6 H * $LN64 $LL2 @ $LN30 l $LL6 $LN22 � $LN5 8 $LN19 � $LN32 � $LN60 � $LN1 t 4 $LN14 d 4 $LN6 P 4 $LN31 T 4 $LL4 4 $LN3 0 4 $LL29 8 4 $LN9 p 4 $LN8 � 6 $LN11 � 6 $LN9 � 6 $LN7 � 6 $LN5 < 6 $LN3 � 6 $LN15 " $LN7 � " $LN6 � " $LN5 � " $LN11 � " $LN12 x " $LN6 . $LN3 ` . $LN2 \ . $LN6 & $LN3 ` & $LN2 \ & $LN12 $LN1 � $LN7 � $LN6 \ $LN5 X $LN4 � $LN13 $LN8 � $LN7 � $LN6 | $LN1 � $LN3 ` $LN2 X $LN5 $LN1 $LN2 $LN6 $LN3 $LN2 $LN6 $LN3 $LN2 $LN6 $LN3 $LN2 $LN6 $LN3 $LN2 $LN6 $LN3 $LN2 $LN5 ` $LN1 l $LL2 $LN13 @ $LN6 H $LN4 X $LN5 ` $LN1 l $LL2 $LN13 @ $LN6 H $LN4 X $LN4 .xdata 8 , �堭0 e S 8 .pdata 9 0 e h 9 .pdata : ��; ( e | : .pdata ; U�� e � ; .pdata < _�'`, e � < .pdata = xd�z$ e � = .pdata > �E?g e � > .pdata ? �E?g
e � ? .xdata @ , � ;2 e
@ .pdata A 2 e A .pdata B ��; * e 3 B .pdata C �v� e H C .pdata D �^Xv6 e c D .pdata E �U7�" e r E .pdata F _�'`. e � F .pdata G _�'`& e � G .pdata H �L� e � H .pdata I |dz� e � I .pdata J XD� e � J .pdata K XD� e K .pdata L XD� e ( L .pdata M XD� e J M .pdata N XD� e f N .pdata O XD� e � O .pdata P (UI( e � P .debug$T Q h
e .chks64 R � e � ElfReportEventA ElfReadEventLogA ElfRegisterEventSourceA ElfOpenEventLogA __imp_RtlFreeUnicodeString __imp_RtlAnsiStringToUnicodeString __imp_RtlInitAnsiString ElfReportEventW __imp_RtlAllocateHeap ElfReadEventLogW __imp_HeapFree IsValidSid __imp_GetProcessHeap __imp_HeapAlloc ElfOpenBackupEventLogW ElfRegisterEventSourceW ElfOpenEventLogW __imp_RtlInitUnicodeString ElfBackupEventLogFileW __imp_RtlFreeHeap ElfClearEventLogFileW __imp_RtlDosPathNameToNtPathName_U ElfGetLogInformation ElfOldestRecord ElfNumberOfRecords ElfChangeNotify ElfDeregisterEventSource ElfCloseEventLog __imp_SetLastError __imp_RtlNtStatusToDosError NtCurrentTeb ReportEventA ReadEventLogA OpenBackupEventLogA RegisterEventSourceA OpenEventLogA BackupEventLogA ClearEventLogA ReportEventW ReadEventLogW CheckEventLogBuffer StringCheck OpenBackupEventLogW RegisterEventSourceW OpenEventLogW BackupEventLogW ClearEventLogW GetEventLogInformation GetOldestEventLogRecord GetNumberOfEventLogRecords NotifyChangeEventLog DeregisterEventSource CloseEventLog InitUnicodeString InitAnsiString BaseSetLastNTError __C_specific_handler $unwind$ReportEventA $pdata$ReportEventA $pdata$ReadEventLogA $pdata$OpenBackupEventLogA $pdata$RegisterEventSourceA $pdata$OpenEventLogA $pdata$BackupEventLogA $pdata$ClearEventLogA $unwind$ReportEventW $pdata$ReportEventW $pdata$ReadEventLogW $pdata$CheckEventLogBuffer $pdata$TestSid $pdata$OpenBackupEventLogW $pdata$RegisterEventSourceW $pdata$OpenEventLogW $pdata$BackupEventLogW $pdata$ClearEventLogW $pdata$GetEventLogInformation $pdata$GetOldestEventLogRecord $pdata$GetNumberOfEventLogRecords $pdata$NotifyChangeEventLog $pdata$DeregisterEventSource $pdata$CloseEventLog $pdata$BaseSetLastNTError /229 1606894061 100666 116006 `
d� �A�_ � .debug$S x - �> @ B.rdata � �> @? @P@.rdata � h? @ @P@.rdata � F@ A @P@.rdata ,B @0@.rdata X 0B �B @P@.rdata �B @@@.rdata �B @@@.rdata �B @@@.rdata �B C @@@.rdata *C :C @@@.rdata X DC �C @P@.rdata H �C D @P@.rdata D &D @@@.rdata 0D @0@.rdata X 4D �D @P@.rdata h �D E @P@.rdata � :E �E @P@.rdata � F �F @P@.rdata �F H @P@.rdata �H �H @@@.rdata �H @@@.rdata X �H 2I @P@.rdata PI @@@.rdata \I |I @@@.rdata �I �I @@@.rdata X �I J @P@.rdata � J �J @P@.rdata � K �K @P@.rdata �K �K @@@.rdata �K �K @@@.rdata �K @0@.rdata � L �L @P@.rdata M M @@@.rdata M <M @@@.rdata ( PM @@@.rdata xM �N @P@.rdata h .O �O @P@.rdata �O �O @@@.rdata �O �O @@@.rdata �O P @@@.rdata P ,P @@@.rdata 0 @P @@@.rdata H pP �P @P@.rdata h �P 4Q @P@.rdata \Q lQ @@@.rdata vQ @@.rdata wQ @@@.rdata �Q �Q @@@.rdata �Q �Q @@@.rdata ( �Q @@@.rdata � R �R @P@.rdata �R �R @@@.rdata �R S @@@.rdata ( S @@@.rdata ?S @@@.rdata WS gS @@@.rdata H qS �S @P@.rdata 0 �S �T @P@.rdata �U �U @@@.rdata P �U V @P@.rdata ( %V @@@.rdata MV ]V @@@.rdata gV �V @@@.rdata ( �V @@@.rdata �V �W @P@.rdata _X oX @@@.rdata yX �X @@@.rdata P �X �X @P@.rdata H Y IY @P@.rdata SY cY @@@.rdata mY }Z @P@.rdata [ @0@.rdata
[ @@@.rdata [ %[ @@@.rdata /[ @@@.rdata G[ @@@.rdata _[ o[ @@@.rdata y[ �[ @@@.rdata �[ �[ @@@.rdata �[ �[ @@@.rdata P �[ \ @P@.rdata ( 5\ @@@.rdata H ]\ �\ @P@.rdata �\ �\ @@@.rdata �\ �\ @@@.rdata �\ ] @@@.rdata ( ] @@@.rdata ?] @@.rdata @] @@.rdata A] Q] @@@.rdata [] @@.rdata 6 \] @@@.rdata �] �] @@@.rdata � �] @P@.rdata , �` @P@.bss � @�.data i i @@�.rdata 0 i Fi @@@.rdata ` xi �i @P@.rdata �i @@@.rdata �i @@@.gfids$y
j @0@.gfids$y j @0@.text$mn 0 "j Rj @`.debug$S \ pj �k @B.text$mn 0 Dl tl @`.debug$S \ �l �m @B.text$mn 4 fn �n @`.debug$S � �n @p @B.text$mn 0 �p �p @`.debug$S \ q vr @B.text$mn 0 �r s @`.debug$S \ <s �t @B.text$mn , u <u @`.debug$S � Zu Vv @B.text$mn , �v �v @`.debug$S �v x @B.text$mn , Px |x @`.debug$S �x �y @B.text$mn , �y z @`.debug$S � <z 8{ @B.text$mn < �{ �{ @`.debug$S \ �{ >~ @B.text$mn 0 . ^ @`.debug$S d | � @B.text$mn 0 X� �� @`.debug$S d ��
� @B.text$mn < �� �� @`.debug$S \ ܃ 8� @B.text$mn < (� d� @`.debug$S h �� � @B.text$mn H ڊ "� @`.debug$S � @� �� @B.text$mn H � \� @`.debug$S � z� 6� @B.text$mn H N� �� @`.debug$S 0 �� � @B.text$mn H $� l� @`.debug$S 0 �� �� @B.text$mn 4 �� .� @`.debug$S � L� � @B.text$mn H �� � @`.debug$S � � ڢ @B.text$mn H � :� @`.debug$S � X� � @B.text$mn t 8� �� @`.debug$S T ʨ � @ @B.text$mn t �� � @`.debug$S � 0� � F @B.text$mn x �� (� @`.debug$S � F� 6� 8 @B.text$mn x f� � @`.debug$S � �� �� 8 @B.text$mn t � �� @`.debug$S T �� � @ @B.text$mn 4 �� �� @`.debug$S � �� �� @B.pdata � (� @0@.pdata 2� :� @0@.pdata D� L� @0@.pdata V� ^� @0@.pdata h� p� @0@.pdata z� �� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� � @0@.pdata
� � @0@.pdata � $� @0@.pdata .� 6� @0@.pdata @� H� @0@.pdata R� Z� @0@.pdata d� l� @0@.pdata v� ~� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.pdata �� �� @0@.debug$S 0 � 6� @B.debug$S , J� v� @B.debug$S 4 �� �� @B.debug$S ( �� �� @B.debug$S ( � 6� @B.debug$S ( J� r� @B.debug$S ( �� �� @B.debug$S ( �� �� @B.debug$S ( �� &� @B.debug$S ( :� b� @B.debug$S ( v� �� @B.debug$S ( �� �� @B.debug$S ( �� � @B.debug$S ( *� R� @B.debug$S ( f� �� @B.debug$S ( �� �� @B.debug$S ( �� � @B.debug$S ( � B� @B.debug$S ( V� ~� @B.debug$S ( �� �� @B.debug$S ( �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ,
� 6� @B.debug$S , J� v� @B.debug$S , �� �� @B.debug$S ( �� �� @B.debug$S , � 2� @B.debug$S , F� r� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S , � 2� @B.debug$S , F� r� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S ( � .� @B.debug$S , B� n� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S , � .� @B.debug$S , B� n� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S , � .� @B.debug$S , B� n� @B.debug$S , �� �� @B.debug$S , �� �� @B.debug$S , � .� @B.debug$S , B� n� @B.debug$S < �� �� @B.debug$S , �� �� @B.debug$S 8 � J� @B.debug$S 8 ^� �� @B.debug$S 4 �� �� @B.debug$S 0 �� "� @B.debug$S 8 6� n� @B.debug$S 4 �� �� @B.debug$S 0 �� �� @B.debug$T \^ � @ B.chks64 jM
.drectve n j�
� � U d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\elf_client.obj : < � � k k
Microsoft (R) Optimizing Compiler � �` FC_EXPR_START � , * eventlog__MIDL_AutoBindHandle � �
" �` elf_MIDL_TYPE_FORMAT_STRING " �` elf_MIDL_PROC_FORMAT_STRING # �` _elf_MIDL_PROC_FORMAT_STRING # �` _elf_MIDL_TYPE_FORMAT_STRING NDR64_UINT8 ! NDR64_UINT16 u NDR64_UINT32 NDR64_INT64 NDR64_FORMAT_CHAR NDR64_ALIGNMENT u NDR64_FORMAT_UINT32 H_ NDR64_PARAM_FLAGS 0_ NDR64_BIND_CONTEXT ! <` NDR64_POINTER_REPEAT_FLAGS q` NDR64_STRUCTURE_FLAGS y_ NDR64_ARRAY_FLAGS �` _tagEXPR_TOKEN __midl_frag297_t �_ __midl_frag295_t __midl_frag294_t __midl_frag293_t �_ __midl_frag290_t �_ __midl_frag289_t �_ __midl_frag286_t �_ __midl_frag285_t �_ __midl_frag284_t �_ __midl_frag283_t �_ __midl_frag282_t �_ __midl_frag278_t �_ __midl_frag277_t �_ __midl_frag267_t �_ __midl_frag264_t �_ __midl_frag262_t �_ __midl_frag243_t �_ __midl_frag239_t �_ __midl_frag222_t �_ __midl_frag221_t �_ __midl_frag217_t �_ __midl_frag209_t �_ __midl_frag208_t __midl_frag207_t �_ __midl_frag206_t �_ __midl_frag196_t �_ __midl_frag195_t �_ __midl_frag193_t �_ __midl_frag157_t �_ __midl_frag150_t �_ __midl_frag149_t �_ __midl_frag144_t �_ __midl_frag22_t �_ __midl_frag21_t u __midl_frag1_t �` __midl_frag292_t �` __midl_frag291_t �` __midl_frag113_t �` __midl_frag288_t �` __midl_frag287_t �` __midl_frag92_t * �` _NDR64_CONF_STRUCTURE_HEADER_FORMAT �` __midl_frag256_t % �` _NDR64_STRUCTURE_HEADER_FORMAT �` __midl_frag276_t �` __midl_frag5_t q` _NDR64_STRUCTURE_FLAGS + t` _NDR64_BOGUS_STRUCTURE_HEADER_FORMAT " x` _NDR64_SIMPLE_MEMBER_FORMAT |` _NDR64_MEMPAD_FORMAT d` __midl_frag265_t [` __midl_frag253_t U` __midl_frag245_t R` __midl_frag244_t O` __midl_frag241_t L` __midl_frag240_t " <` _NDR64_POINTER_REPEAT_FLAGS ?` _NDR64_REPEAT_FORMAT , C` _NDR64_POINTER_INSTANCE_HEADER_FORMAT 5` __midl_frag228_t /` __midl_frag225_t )` __midl_frag219_t &` __midl_frag218_t #` __midl_frag214_t ` __midl_frag211_t ` __midl_frag210_t ` __midl_frag205_t ` __midl_frag201_t
` __midl_frag198_t ` __midl_frag197_t ` __midl_frag190_t �_ __midl_frag166_t �_ __midl_frag159_t �_ _NDR64_RANGE_FORMAT �_ __midl_frag158_t �_ __midl_frag152_t �_ __midl_frag143_t �_ __midl_frag133_t �_ __midl_frag119_t �_ __midl_frag117_t �_ __midl_frag114_t �_ __midl_frag115_t �_ __midl_frag110_t �_ __midl_frag94_t �_ __midl_frag93_t & �_ _NDR64_CONF_ARRAY_HEADER_FORMAT �_ _NDR64_ARRAY_ELEMENT_INFO �_ __midl_frag82_t �_ __midl_frag59_t �_ __midl_frag49_t �_ __midl_frag34_t �_ __midl_frag29_t # �_ _NDR64_CONTEXT_HANDLE_FORMAT �_ __midl_frag20_t �_ __midl_frag12_t �_ __midl_frag10_t �_ _NDR64_POINTER_FORMAT _ __midl_frag6_t y_ _NDR64_ARRAY_FLAGS * |_ _NDR64_CONF_VAR_ARRAY_HEADER_FORMAT l_ __midl_frag9_t i_ _NDR64_EXPR_NOOP e_ __midl_frag8_t b_ __midl_frag7_t W_ _NDR64_EXPR_OPERATOR [_ _NDR64_EXPR_VAR __ _NDR64_EXPR_CONST64 S_ __midl_frag2_t *_ _NDR64_PROC_FORMAT 0_ _NDR64_BIND_CONTEXT ' 3_ _NDR64_BIND_AND_NOTIFY_EXTENSION H_ _NDR64_PARAM_FLAGS K_ _NDR64_PARAM_FORMAT � ( : s ����o� }�+4qt*Y lռ��́dq�X � ��H�1�t�~e�͘R�InfdE�6T�#y�N � F?�Z#��.Wi�/0��=�� �9*W�-� � ���@�R�ђ�e��<r = h��� a� 6t�R��;�,
�Z��/2ط�C�8��d�.]; L G�*㥬2����M���}�b�R�̫�)�� s �
���mcJAt�qe�el��]�;�L�� � � onecore\admin\wmi\events\advapi\objfre\arm64\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\arm64\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\external\sdk\inc\ndr64types.h onecore\external\shared\inc\guiddef.h onecore\admin\wmi\events\advapi\elf_client.c onecore\admin\wmi\events\idl\elf\objfre\arm64\elf_c.c onecore\external\shared\inc\pshpack8.h onecore\external\shared\inc\poppack.h � L�` � * � *
]��� ��� +H` 3qq��7I�����6 & ( 0 # x
n 3 * ( @ # � 0 & ) ) 2 ( 2 0 5 8 8 @ 8 H ; P e X > ` G h S p V x V � Y � e � q � t � � � � � � � � � � � � � � @ , $ pH � �� � 0 � @ C ! @ , $ pH � �� � 0 � @ @ h < D p� � � / 0 / p� @ ( $ ( pH P� � �� � 0 @ @ ( D pH � � � ��� � 0 � @ P @ l8 . D q
� � ( � 0 ������ � 0 � @ � P ` p b � @ l0 . D q
� � � ( ����� � 0 � @ P ` b p @ ,x � H pH � � � � � ( � 0 8 @ H P � X ` h � p ���������� � 0 @ P ` p � � � � � � � � � � � � � A D @ , $ pH � �� � 0 @ A J
! M @ , $ pH � �� � 0 � @ @ l8 - D q
� � ( � 0 ������ \ 0 � @ � P ` p b � @ l0 - D q
� � � ( ����� \ 0 � @ P ` b p !
b p� @ j@ < H pH � � � P� ( P� 0 � 8 ������� � 0 @ P � ` k p � � k A n
� �� @ ,x � H pH � � � � � ( � 0 8 @ H P � X ` h � p ���������� � 0 @ P ` p � � � � � � � � � � � � � @ J ( q
� � � ��� � 0 � @ z P � } ! � A �
� �� @ q
� � � 0 @ , & q
� � ��� � 0 � @ � P ! � � �� � A �
� �� @ j0 4 ( pH � � P� � ( ����� � 0 @ � P � ` p � A �
� � @ ( $ pH � � � 0 @ ,� � H pH � � � � ( � 0 � 8 @ H P X � ` h p � x ���������� � 0 @ P ` p � � � � � � � � � � � � � � � ! � A � ! � � 0 � H � � 0 ! � A �
� � 8 @ ,p � ( pH
� � � � ( � 0 8 @ H P � X ` � h
���������� � 0 � @ P ` p � � � � � � � � � � � � � � ! � A � ! � � 0 � H � 5 � � # ! � @ ,p � ( pH
� � � � ( � 0 8 @ H P � X ` � h
���������� � 0 � @ P ` p � � � � � � � � � � � � � pI 0 � � � � � 2 A ! � ! � A � ! � � 0 � H � ( 5 � � P ! � ! A
� � 0 ! 6 l � � � 4p�^�>t��N��x�� h�$� 0I ( U U [ @6\[ � � 0� \ \[\ 0� � �� ) �� [� � � ( [ L �\[ �� [ �L �\[ ! ' ( ���� 0�\[ ) 0 � [\ [ @6\[ � �\� �� � � � ! ' ( ���� ��\[ � �� )T �� [� �� ) �� [ ) [� � � � ! ' 0 ���� �\[ ) 8 � [ �� � � ! ' ( ���� |�\[� � � ! ' ( ���� F�\[ H 0H $ FE �� p H 0H $ FE �� 0 p H 0� 8 @ D G � J p H 0� 8 @ D G � J p H 0H $ $ DE �� P! p H 0H $ $ DE �� P! p H 0H D DE ��� � R H p H 8 1 \* @ FG ������
Z 0 0 H H ( b p 0 H 8 1 \* @ FG ������
Z 0 0 H H ( b p 0 H 0 1 \* @ FG �����
Z 0 H H b p ( H
@ 0H < @ EG ������� H H � f t P!( P!0 p 8 H x 0H � @ FE ���������� H H H H � ( � � 0 � 8 0 @ � H � P H X ` h p p H 0H $ FE �� "p H
0H $ FE �� <p H 8 1 \) @ FG ������
R < <H H ( b p 0 H 8 1 \) @ FG ������
R < <H H ( b p 0 H 0 1 \) @ FG �����
R <H H b p ( H @ 0H < @ EG ������� H H � V t P!( P!0 p 8 H x 0H � @ FE ���������� H H H H � ( `� 0 j 8 < @ � H t P H X ` h p p H 1 \ $ EC ���
Z ! � �p H 1 \ D A �
Z p H 1 \" FE ���
Z � � �p H 0 0H 4 $ EG ����� H �� P! p ( H 0H $ D E � p H � 0H � @ FE ���������� H H H H ( 0 � 0 � 8 @ 0 H � P * X XH ` h p p x H p 0H � $ FE
����������
R H H H � ( v� 0 � 8 0 @ � H � P H X ` p h H p 0H � $ FE
����������
R H H H � ( �� 0 � 8 < @ � H � P H X ` p h 3 & 9 ( ` �?'�*��?x�y)�#� ]��� ��� +H` P 0 3qq��7I�����6 ]��� ��� +H` �{��� ���� � � � �ҡ�R �� *�{���_� 0 0 ' � 4 G 0 ( _ �ElfrBackupELFA >[Z LogHandle EQ EQ 0 >�^ BackupFileName EQ EQ 0
Z �^ B! [Z Q LogHandle �^ Q BackupFileName O � 0 0 � $ | � � �$ � �, � 0 �
b � f �
v � z �
� � � �
� � � �
, � 0 �
�{��� ���� � � � ��! �R �� *�{���_� 0 0 ' � 4 G 0 ( !_ �ElfrBackupELFW >[Z LogHandle EQ EQ 0 >�^ BackupFileName EQ EQ 0
Z �^ B! [Z Q LogHandle �^ Q BackupFileName O � 0 0 � $ n � r �$ x �, � 0 �
b � f �
v � z �
� � � �
� � � �
, � 0 �
�{��� ��*��� � � � �� �R �� *�{���_� 0 0 $ ' � D 6 G 4 , _ �ElfrChangeNotify >[Z LogHandle EQ EQ 4 >A ClientId EQ >" Event EQ EQ ( 4
Z �^ B! [Z Q LogHandle A Q ClientId ( " Q Event O� 0 4 � $ � � � �( � �, � 0 �
d � h �
x � | �
� � � �
� � � �
� � � �
X � \ �
�{��� ���� � � � �ҁ�R �� *�{���_� 0 0 ' � 3 G 0 ( _ �ElfrClearELFA >[Z LogHandle EQ EQ 0 >�^ BackupFileName EQ EQ 0
Z �^ B! [Z Q LogHandle �^ Q BackupFileName O � 0 0 � $ j � n �$ t �, � 0 �
a � e �
u � y �
� � � �
� � � �
, � 0 �
�{��� ���� � � � �� �� �� *�{���_� 0 0 ' � 3 G 0 ( "_ �ElfrClearELFW >[Z LogHandle EQ EQ 0 >�^ BackupFileName EQ EQ 0
Z �^ B! [Z Q LogHandle �^ Q BackupFileName O � 0 0 � $ \ � ` �$ f �, � 0 �
a � e �
u � y �
� � � �
� � � �
, � 0 �
�{��� �� � � � ��A �R �� *�{���_� 0 0 ' � � 1 G , $ _ �ElfrCloseEL >�^ LogHandle EQ EQ ,
Z �^ B! �^ Q LogHandle O � 0 , � $ � � � � �, � 0 �
_ � c �
s � w �
� � � �
�{��� �� � � � �ҁ�R �� *�{���_� 0 0 ' � � > G , $ �^ �ElfrDeregisterClusterSvc >q UNCServerName EQ EQ ,
Z �^ B! q Q UNCServerName O � 0 , � $ 3 � 7 � < �, � 0 �
p � t �
� � � �
� � � �
�{��� �� � � � ��a �R �� *�{���_� 0 0 ' � � ? G , $ _ �ElfrDeregisterEventSource >�^ LogHandle EQ EQ ,
Z �^ B! �^ Q LogHandle O � 0 , � $ � � � � � �, � 0 �
m � q �
� � � �
� � � �
�{��� �� � � � ����R �� *�{���_� 0 0 ' � � 1 G , $ �^ �ElfrFlushEL >[Z LogHandle EQ EQ ,
Z �^ B! [Z Q LogHandle O � 0 , � $ o � s � x �, � 0 �
_ � c �
s � w �
� � � �
�{��� ����*�*� � � �����R �� �� *�{���_� 0 0 , ' � ; G < 4 �^ �ElfrGetLogInformation >[Z LogHandle EQ EQ < >" InfoLevel EQ EQ < > lpBuffer EQ EQ ( < >" cbBufSize EQ EQ 0 < >" pcbBytesNeeded EQ ( EQ 8 <
Z �^ B! [Z Q LogHandle " Q InfoLevel ( Q lpBuffer 0 " Q cbBufSize 8 " Q pcbBytesNeeded O � 0 < � $ [ � _ �0 h �, � 0 �
i � m �
} � � �
� � � �
� � � �
� � � �
� � � �
� �
0 � 4 �
] � a �
q � u �
, � 0 �
�{��� ���� � � � �ҁ �R �� *�{���_� 0 0 ' � 9 G 0 ( _ �ElfrNumberOfRecords >[Z LogHandle EQ EQ 0 >" NumberOfRecords EQ EQ 0
Z �^ B! [Z Q LogHandle " Q NumberOfRecords O � 0 0 � $ � � � �$ � �, � 0 �
g � k �
{ � �
� � � �
� � � �
4 � 8 �
�{��� ���� � � � �ҡ �R �� *�{���_� 0 0 ' � 6 G 0 ( _ �ElfrOldestRecord >[Z LogHandle EQ EQ 0 >" OldestRecordNumber EQ EQ 0
Z �^ B! [Z Q LogHandle " Q OldestRecordNumber O� 0 0 � $ � � � �$ � �, � 0 �
d � h �
x � | �
� � � �
� � � �
4 � 8 �
�{��� ����*��� � � ��*�R �� �� *�{���_� 0 0 , ' � 2 G < 4 �^ �ElfrOpenBELA >p UNCServerName EQ EQ < >�^ FileName EQ EQ < >" MajorVersion EQ EQ ( < >" MinorVersion EQ EQ , < >�^ LogHandle EQ EQ 0 <
Z �^ B! p Q UNCServerName �^ Q FileName ( " Q MajorVersion , " Q MinorVersion 0 �^ Q LogHandle O� 0 < � $ � � � �0 � �, � 0 �
d � h �
x � | �
� � � �
� � � �
� � � �
� � � �
� ! �
1 � 5 �
Y � ] �
m � q �
, � 0 �
�{��� ����*��� � � ��*!�R �� �� *�{���_� 0 0 , ' � $ 2 G < 4 _ �ElfrOpenBELW >q UNCServerName EQ EQ < >�^ BackupFileName EQ EQ < >" MajorVersion EQ EQ ( < >" MinorVersion EQ EQ , < >�^ LogHandle EQ EQ 0 <
Z �^ B! q Q UNCServerName �^ Q BackupFileName ( " Q MajorVersion , " Q MinorVersion 0 �^ Q LogHandle O� 0 < � $ � �0 �, � 0 �
d � h �
x � | �
� � � �
� � � �
� � � �
� � � �
# � ' �
7 � ; �
_ � c �
s � w �
8 � < �
�{��� ��C �� ��*�*����� � � � ���R �� *�C ��{���_�$ 0 ( 0 4 ' � w 1 G H < _ �ElfrOpenELA >p UNCServerName EQ EQ ( H >�^ ModuleName EQ EQ 0 H >�^ RegModuleName EQ EQ 8 H >" MajorVersion EQ EQ @ H >" MinorVersion EQ $ EQ D H >�^ LogHandle EQ ( EQ H H
Z �^ B! ( p Q UNCServerName 0 �^ Q ModuleName 8 �^ Q RegModuleName @ " Q MajorVersion D " Q MinorVersion H �^ Q LogHandle O � 0 H � $ � � � �8 � �, � 0 �
c � g �
w � { �
� � � �
� � � �
� � � �
� � � �
� # �
3 � 7 �
^ � b �
r � v �
� � � �
� � � �
� � � �
�{��� ��C �� ��*�*����� � � � ��� �R �� *�C ��{���_�$ 0 ( 0 4 ' � w 1 G H < _ �ElfrOpenELW >q UNCServerName EQ EQ ( H >�^ ModuleName EQ EQ 0 H >�^ RegModuleName EQ EQ 8 H >" MajorVersion EQ EQ @ H >" MinorVersion EQ $ EQ D H >�^ LogHandle EQ ( EQ H H
Z �^ B! ( q Q UNCServerName 0 �^ Q ModuleName 8 �^ Q RegModuleName @ " Q MajorVersion D " Q MinorVersion H �^ Q LogHandle O � 0 H � $ � � � �8 � �, � 0 �
c � g �
w � { �
� � � �
� � � �
� � � �
� � � �
� # �
3 � 7 �
^ � b �
r � v �
� � � �
� � � �
� � � �
�{��� ��C �� ����*� � � ��*�* ��!�R �� *�C ��{���_� 0 0 4 ' � � 1 G H < _ �ElfrReadELA >[Z LogHandle EQ EQ ( H >" ReadFlags EQ EQ 0 H >" RecordOffset EQ EQ 4 H >" NumberOfBytesToRead EQ EQ 8 H > Buffer EQ EQ @ H >" NumberOfBytesRead EQ ( EQ H H >" MinNumberOfBytesNeeded EQ 0 EQ P H
Z �^ B! ( [Z Q LogHandle 0 " Q ReadFlags 4 " Q RecordOffset 8 " Q NumberOfBytesToRead @ Q Buffer H " Q NumberOfBytesRead # P " Q MinNumberOfBytesNeeded O � 0 H � $ � � � �8 � �, � 0 �
_ � c �
s � w �
� � � �
� � � �
� � � �
� � � �
� $ �
4 � 8 �
Y � ] �
m � q �
� � � �
� � � �
� � � �
� � � �
� �
�{��� ��C �� ����*� � � ��*�* ��A�R �� *�C ��{���_� 0 0 4 ' � � 1 G H < _ �ElfrReadELW >[Z LogHandle EQ EQ ( H >" ReadFlags EQ EQ 0 H >" RecordOffset EQ EQ 4 H >" NumberOfBytesToRead EQ EQ 8 H > Buffer EQ EQ @ H >" NumberOfBytesRead EQ ( EQ H H >" MinNumberOfBytesNeeded EQ 0 EQ P H
Z �^ B! ( [Z Q LogHandle 0 " Q ReadFlags 4 " Q RecordOffset 8 " Q NumberOfBytesToRead @ Q Buffer H " Q NumberOfBytesRead # P " Q MinNumberOfBytesNeeded O � 0 H � $ ) � - �8 8 �, � 0 �
_ � c �
s � w �
� � � �
� � � �
� � � �
� � � �
� $ �
4 � 8 �
Y � ] �
m � q �
� � � �
� � � �
� � � �
� � � �
� �
�{��� ������ � � � ��a�R �� *�{���_� 0 0 $ ' � | < G 4 , �^ �ElfrRegisterClusterSvc >q UNCServerName EQ EQ 4 >" pulSize EQ EQ 4 >�^ ppPackedEventInfo EQ EQ ( 4
Z �^ B! q Q UNCServerName " Q pulSize ( �^ Q ppPackedEventInfo O� 0 4 � $ ! � % �( , �, � 0 �
n � r �
� � � �
� � � �
� � � �
� � � �
� �
� � � �
�{��� ��C �� ��*�*����� � � � ����R �� *�C ��{���_�$ 0 ( 0 4 ' � � > G H < _ �ElfrRegisterEventSourceA >p UNCServerName EQ EQ ( H >�^ ModuleName EQ EQ 0 H >�^ RegModuleName EQ EQ 8 H >" MajorVersion EQ EQ @ H >" MinorVersion EQ $ EQ D H >�^ LogHandle EQ ( EQ H H
Z �^ B! ( p Q UNCServerName 0 �^ Q ModuleName 8 �^ Q RegModuleName @ " Q MajorVersion D " Q MinorVersion H �^ Q LogHandle O� 0 H � $ � � � �8 � �, � 0 �
p � t �
� � � �
� � � �
� � � �
� � � �
� �
, � 0 �
@ � D �
k � o �
� � �
� � � �
� � � �
� � � �
�{��� ��C �� ��*�*����� � � � ���R �� *�C ��{���_�$ 0 ( 0 4 ' � � > G H < _ �ElfrRegisterEventSourceW >q UNCServerName EQ EQ ( H >�^ ModuleName EQ EQ 0 H >�^ RegModuleName EQ EQ 8 H >" MajorVersion EQ EQ @ H >" MinorVersion EQ $ EQ D H >�^ LogHandle EQ ( EQ H H
Z �^ B! ( q Q UNCServerName 0 �^ Q ModuleName 8 �^ Q RegModuleName @ " Q MajorVersion D " Q MinorVersion H �^ Q LogHandle O� 0 H � $ � � � �8 �, � 0 �
p � t �
� � � �
� � � �
� � � �
� � � �
� �
, � 0 �
@ � D �
k � o �
� � �
� � � �
� � � �
� � � �
�{��� ��C��#H�� ��< S��@y� ��*f< S� �E< S���F��*� ��3 � ��A�R�#��3@�� � � � �� *�C��{���_�X 0 \ 0 ` ' � 6 G t h �^ �ElfrReportEventA >[Z LogHandle EQ EQ h t
>" Time EQ EQ p t >! EventType EQ EQ t t >! EventCategory EQ EQ v t >" EventID EQ EQ x t >! NumStrings EQ EQ | t >" DataSize EQ EQ � t >�^ ComputerName EQ ( EQ � t >�^ UserSID EQ EQ ` t >�^ Strings EQ EQ h t
> Data A: 8 EQ EQ p t >! Flags EQ EQ x t >" RecordNumber EQ EQ � t >" TimeWritten A: ( EQ ( EQ � t
Z �^ ` B! h [Z Q LogHandle p " Q Time t ! Q EventType v ! Q EventCategory x " Q EventID | ! Q NumStrings � " Q DataSize � �^ Q ComputerName ` �^ Q UserSID h �^ Q Strings p Q Data x ! Q Flags � " Q RecordNumber � " Q TimeWritten O � 0 t � $ � �d �, � 0 �
d � h �
x � | �
� � � �
� � � �
� � � �
� � � �
� �
+ � / �
Q � U �
e � i �
� � � �
� � � �
� � � �
� � � �
� �
� �
B � F �
V � Z �
| � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
: � > �
N � R �
t � x �
� � � �
� � � �
$ � ( �
�{��� ��C��H��< S� ��Ay� ��*f< S� �E< S�#��#G��*� ��; � ���R���#F��� � � �� *�C��{���_�X 0 \ 0 ` ' � } ? G t h �^ �ElfrReportEventAndSourceW >[Z LogHandle EQ EQ h t
>" Time EQ EQ p t >! EventType EQ EQ t t >! EventCategory EQ EQ v t >" EventID EQ EQ x t >�^ SourceName EQ EQ � t >! NumStrings EQ ( EQ � t >" DataSize EQ , EQ � t >�^ ComputerName EQ EQ ` t >�^ UserSID A: T EQ EQ h t >�^ Strings EQ EQ p t
> Data A: 8 EQ EQ x t >! Flags EQ EQ � t >" RecordNumber EQ ( EQ � t >" TimeWritten A: ( EQ 0 EQ � t
Z �^ ` B! h [Z Q LogHandle p " Q Time t ! Q EventType v ! Q EventCategory x " Q EventID � �^ Q SourceName � ! Q NumStrings � " Q DataSize ` �^ Q ComputerName h �^ Q UserSID p �^ Q Strings x Q Data � ! Q Flags � " Q RecordNumber � " Q TimeWritten O � 0 t � $ � � � �d � �, � 0 �
m � q �
� � � �
� � � �
� � � �
� � � �
� � � �
� $ �
4 � 8 �
Z � ^ �
n � r �
� � � �
� � � �
� � � �
� � � �
� �
# � ' �
N � R �
b � f �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
� �
- � 1 �
Q � U �
e � i �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
�{��� �����@y� ��< S�;@�� ��*f< S� �E< S�3 ��3@���� ��/@�� � ��A�R�'��+@� � �� � �� *���{���_�X 0 \ 0 d ' � � 8 G x l �^ �ElfrReportEventExA >[Z LogHandle EQ EQ X x >�^ TimeGenerated EQ EQ ` x >! EventType EQ EQ h x >! EventCategory EQ EQ j x >" EventID EQ EQ l x >! NumStrings EQ EQ p x >" DataSize EQ $ EQ t x >�^ ComputerName EQ ( EQ x x >�^ UserSID EQ EQ P x >�^ Strings EQ EQ X x
> Data EQ EQ ` x >! Flags EQ EQ h x >" RecordNumber EQ EQ p x
Z �^ P B! X [Z Q LogHandle ` �^ Q TimeGenerated h ! Q EventType j ! Q EventCategory l " Q EventID p ! Q NumStrings t " Q DataSize x �^ Q ComputerName P �^ Q UserSID X �^ Q Strings ` Q Data h ! Q Flags p " Q RecordNumber O � 0 x � $ � � � �h � �, � 0 �
f � j �
z � ~ �
� � � �
� � � �
� � � �
� � � �
" � & �
6 � : �
\ � ` �
p � t �
� � � �
� � � �
� � � �
� � � �
� �
' � + �
M � Q �
a � e �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
5 � 9 �
I � M �
� � � �
�{��� �����@y� ��< S�;@�� ��*f< S� �E< S�3 ��3@���� ��/@�� � ��!�R�'��+@� � �� � �� *���{���_�X 0 \ 0 d ' � � 8 G x l �^ �ElfrReportEventExW >[Z LogHandle EQ EQ X x >�^ TimeGenerated EQ EQ ` x >! EventType EQ EQ h x >! EventCategory EQ EQ j x >" EventID EQ EQ l x >! NumStrings EQ EQ p x >" DataSize EQ $ EQ t x >�^ ComputerName EQ ( EQ x x >�^ UserSID EQ EQ P x >�^ Strings EQ EQ X x
> Data EQ EQ ` x >! Flags EQ EQ h x >" RecordNumber EQ EQ p x
Z �^ P B! X [Z Q LogHandle ` �^ Q TimeGenerated h ! Q EventType j ! Q EventCategory l " Q EventID p ! Q NumStrings t " Q DataSize x �^ Q ComputerName P �^ Q UserSID X �^ Q Strings ` Q Data h ! Q Flags p " Q RecordNumber O � 0 x � $ � � � �h � �, � 0 �
f � j �
z � ~ �
� � � �
� � � �
� � � �
� � � �
" � & �
6 � : �
\ � ` �
p � t �
� � � �
� � � �
� � � �
� � � �
� �
' � + �
M � Q �
a � e �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
5 � 9 �
I � M �
� � � �
�{��� ��C��#H�� ��< S��@y� ��*f< S� �E< S���F��*� ��3 � ��a�R�#��3@�� � � � �� *�C��{���_�X 0 \ 0 ` ' � 6 G t h _ �ElfrReportEventW >[Z LogHandle EQ EQ h t
>" Time EQ EQ p t >! EventType EQ EQ t t >! EventCategory EQ EQ v t >" EventID EQ EQ x t >! NumStrings EQ EQ | t >" DataSize EQ EQ � t >�^ ComputerName EQ ( EQ � t >�^ UserSID EQ EQ ` t >�^ Strings EQ EQ h t
> Data A: 8 EQ EQ p t >! Flags EQ EQ x t >" RecordNumber EQ EQ � t >" TimeWritten A: ( EQ ( EQ � t
Z �^ ` B! h [Z Q LogHandle p " Q Time t ! Q EventType v ! Q EventCategory x " Q EventID | ! Q NumStrings � " Q DataSize � �^ Q ComputerName ` �^ Q UserSID h �^ Q Strings p Q Data x ! Q Flags � " Q RecordNumber � " Q TimeWritten O � 0 t � $ L � P �d b �, � 0 �
d � h �
x � | �
� � � �
� � � �
� � � �
� � � �
� �
+ � / �
Q � U �
e � i �
� � � �
� � � �
� � � �
� � � �
� �
� �
B � F �
V � Z �
| � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
: � > �
N � R �
t � x �
� � � �
� � � �
$ � ( �
�{��� ����*� � � � �ҡ�R �� *�{���_� 0 0 $ ' � f < G 4 , �^ �ElfrWriteClusterEvents >q UNCServerName EQ EQ 4 >" ulSize EQ EQ 4 > pBuffer EQ EQ ( 4
Z �^ B! q Q UNCServerName " Q ulSize ( Q pBuffer O � 0 4 � $ E � I �( P �, � 0 �
n � r �
� � � �
� � � �
� � � �
� � � �
� � � �
| � � �
y � � y � � u � � - � � = � � 5 � � - � � 5 � � u � � I � � = � � I � � I � � 1 � � 1 � � u � � I � � = � � I � � I � � 5 � � 1 � � 1 � � - � � - � � 1 � � 1 � � � " $_ eventlog_SyntaxInfo
� eventlog_StubDesc
� & $ &_ eventlog_Ndr64ProcTable
� '_ __midl_frag1
� S_ __midl_frag2
� b_ __midl_frag7
� e_ __midl_frag8
� l_ __midl_frag9
� _ __midl_frag6
� �_ __midl_frag10 # #
� �_ __midl_frag12 & &
� �_ __midl_frag20 ) )
� �_ __midl_frag21 , ,
� �_ __midl_frag22 / /
� �_ __midl_frag29 2 2
� �_ __midl_frag34 5 5
� �_ __midl_frag49 8 8
� �_ __midl_frag59 ; ;
� �_ __midl_frag82 > >
� �_ __midl_frag93 A A
� �_ __midl_frag94 D D
� �_ __midl_frag110 G G
� �_ __midl_frag115 J J
� �_ __midl_frag114 M M
� �_ __midl_frag117 P P
� �_ __midl_frag119 S S
� �_ __midl_frag133 V V
� �_ __midl_frag143 Y Y
� �_ __midl_frag144 \ \
� �_ __midl_frag149 _ _
� �_ __midl_frag150 b b
� �_ __midl_frag152 e e
� �_ __midl_frag157 h h
� �_ __midl_frag158 k k
� �_ __midl_frag159 n n
� �_ __midl_frag166 q q
� ` __midl_frag190 t t
� �_ __midl_frag193 w w
� �_ __midl_frag195 z z
� �_ __midl_frag196 } }
� ` __midl_frag197 � �
�
` __midl_frag198 � �
� ` __midl_frag201 � �
� ` __midl_frag205 � �
� �_ __midl_frag206 � �
� ` __midl_frag207 � �
� �_ __midl_frag208 � �
� �_ __midl_frag209 � �
� ` __midl_frag210 � �
� ` __midl_frag211 � �
� #` __midl_frag214 � �
� �_ __midl_frag217 � �
� &` __midl_frag218 � �
� )` __midl_frag219 � �
� �_ __midl_frag221 � �
� �_ __midl_frag222 � �
� /` __midl_frag225 � �
� 5` __midl_frag228 � �
� �_ __midl_frag239 � �
� L` __midl_frag240 � �
� O` __midl_frag241 � �
� �_ __midl_frag243 � �
� R` __midl_frag244 � �
� U` __midl_frag245 � �
� [` __midl_frag253 � �
� �_ __midl_frag262 � �
� �_ __midl_frag264 � �
� d` __midl_frag265 � �
� �` __midl_frag5 � �
� �_ __midl_frag267 � �
� �` __midl_frag276 � �
� �_ __midl_frag277 � �
� �` __midl_frag256 � �
� �_ __midl_frag278 � �
� �_ __midl_frag282 � �
� �_ __midl_frag283 � �
� �_ __midl_frag284 � �
� �` __midl_frag92 � �
� �_ __midl_frag285 � �
� �_ __midl_frag286 � �
� �` __midl_frag287 � �
� �` __midl_frag288 � �
� �` __midl_frag113 � �
� �_ __midl_frag289
� �_ __midl_frag290
� �` __midl_frag291
� �` __midl_frag292
� �` __midl_frag293
� �` __midl_frag294
� �_ __midl_frag295
� �` __midl_frag297
� / - �` eventlog_FormatStringOffsetTable
� �` BindingRoutines
� ) ' �` elf__MIDL_TypeFormatString # #
� ) ' �` elf__MIDL_ProcFormatString & &
� & $
eventlog_ClientIfHandle - -
� ! �- eventlog_ProxyInfo 0 0
� , * �! eventlog___RpcClientInterface 3 3
� ' % 18 _NDR64_RpcTransferSyntax 6 6
� ! 18 _RpcTransferSyntax 9 9
V �N cm�U%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\arm64\precomp.obj ��
�,
�^ B [Z " ! ! " �^ ! " �^ �^ �^ ! " " �^ & �^ ElfrReportEventAndSourceW �� �- " �+ �^ �^ NdrClientCall3 �
x :
[Z �^ ! ! " ! " �^ �^ �^ ! "
�^ �^ ElfrReportEventExW � [Z " " " �^ " �^ ElfrGetLogInformation ��
[Z �^ �^ ElfrFlushEL
�!
�^ :
[Z �^ ! ! " ! " �^ �^ �^ ! "
�^ �^ ElfrReportEventExA � q " �^ " �^ ElfrWriteClusterEvents �> [Z " ! ! " ! " �^ �^ �^ ! " " �^ �^ ElfrReportEventA ���
q �^ & �^ ElfrDeregisterClusterSvc ���
q " �^ �^ " �^ ElfrRegisterClusterSvc �
[Z p �^ " " �^ �^ �^ ElfrOpenBELA ���" [Z " " " " " �^ �^ ElfrReadELA p �^ �^ " " �^ _ & _ ElfrRegisterEventSourceA ��� _ ElfrOpenELA [Z �^ _ _ ElfrBackupELFA � _ ElfrClearELFA ��> [Z " ! ! " ! " �^ �^ �^ ! " " _
_ ElfrReportEventW ��� �^ ElfrReadELW q �^ " " �^
_ _ ElfrOpenBELW ��� q �^ �^ " " �^ _ & _ ElfrRegisterEventSourceW ��� _ ElfrOpenELW [Z ? " _ _ ElfrChangeNotify ���
�^ _ & _ ElfrDeregisterEventSource �� [Z " _ _ ElfrOldestRecord ��� _ ElfrNumberOfRecords _ ElfrCloseEL [Z �^ _ _ ElfrBackupELFW � _ ElfrClearELFW ��
s( �� #_ " � �
%_ " � �
u ��B � _NDR64_PROC_FORMAT .?AU_NDR64_PROC_FORMAT@@ ���
u Flags
u StackSize
u ConstantClientBufferSize �
u ConstantServerBufferSize �
! RpcFlags �
! FloatDoubleMask ��
! NumberOfParams ���
! ExtensionSize B )_ _NDR64_PROC_FORMAT .?AU_NDR64_PROC_FORMAT@@ ��. onecore\external\sdk\inc\ndr64types.h �� *_ +_ x ^ � _NDR64_BIND_AND_NOTIFY_EXTENSION .?AU_NDR64_BIND_AND_NOTIFY_EXTENSION@@ ��B � _NDR64_BIND_CONTEXT .?AU_NDR64_BIND_CONTEXT@@ n
HandleType ���
Flags
! StackOffset ��
RoutineIndex �
Ordinal ��B /_ _NDR64_BIND_CONTEXT .?AU_NDR64_BIND_CONTEXT@@ 0_ +_ � .
._ Binding ��
! NotifyIndex ��^ 2_ _NDR64_BIND_AND_NOTIFY_EXTENSION .?AU_NDR64_BIND_AND_NOTIFY_EXTENSION@@ �� 3_ +_ � B � _NDR64_PARAM_FORMAT .?AU_NDR64_PARAM_FORMAT@@
B � _NDR64_PARAM_FLAGS .?AU_NDR64_PARAM_FLAGS@@ ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��V
8_ MustSize �
9_ MustFree �
:_ IsPipe ���
;_ IsIn �
<_ IsOut
=_ IsReturn �
>_ IsBasetype ���
?_ IsByValue
@_ IsSimpleRef ��
A_ IsDontCallFreeInst ���
B_ SaveForAsyncFinish ���
C_ IsPartialIgnore ��
D_ IsForceAllocate ��
E_ Reserved �
F_ UseCache �B G_ _NDR64_PARAM_FLAGS .?AU_NDR64_PARAM_FLAGS@@ �� H_ +_ � V
6_ Type �
7_ Attributes ���
!
Reserved �
u StackOffset ��B J_ _NDR64_PARAM_FORMAT .?AU_NDR64_PARAM_FORMAT@@ K_ +_ � " �2
! frag1
frag2
M_ frag3 : N_ <anonymous-tag> .?AU<anonymous-tag>@@ > onecore\admin\wmi\events\idl\elf\objfre\arm64\elf_c.c �� O_ P_ y b
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
O_ P frag6 : R_ X __midl_frag2_t .?AU__midl_frag2_t@@ �� S_ P_ r F � _NDR64_EXPR_OPERATOR .?AU_NDR64_EXPR_OPERATOR@@ ��R
ExprType �
Operator �
CastType �
Reserved �F V_ _NDR64_EXPR_OPERATOR .?AU_NDR64_EXPR_OPERATOR@@ �� W_ +_ h : � _NDR64_EXPR_VAR .?AU_NDR64_EXPR_VAR@@ R
ExprType �
VarType ��
! Reserved �
u Offset ���: Z_ _NDR64_EXPR_VAR .?AU_NDR64_EXPR_VAR@@ [_ +_ � B � _NDR64_EXPR_CONST64 .?AU_NDR64_EXPR_CONST64@@ V
ExprType �
Reserved �
! Reserved1
ConstValue ���B ^_ _NDR64_EXPR_CONST64 .?AU_NDR64_EXPR_CONST64@@ __ +_ x B
u frag1
U_ frag2
Y_ frag3
]_ frag4 : a_ __midl_frag7_t .?AU__midl_frag7_t@@ �� b_ P_ O B
u frag1
U_ frag2
Y_ frag3
]_ frag4 : d_ __midl_frag8_t .?AU__midl_frag8_t@@ �� e_ P_ D > � _NDR64_EXPR_NOOP .?AU_NDR64_EXPR_NOOP@@ ��:
ExprType �
Size �
! Reserved �> h_ _NDR64_EXPR_NOOP .?AU_NDR64_EXPR_NOOP@@ �� i_ +_ � 2
u frag1
g_ frag2
]_ frag3 : k_ __midl_frag9_t .?AU__midl_frag9_t@@ �� l_ P_ : b � _NDR64_CONF_VAR_ARRAY_HEADER_FORMAT .?AU_NDR64_CONF_VAR_ARRAY_HEADER_FORMAT@@ B � _NDR64_ARRAY_FLAGS .?AU_NDR64_ARRAY_FLAGS@@ ��
��
��
��
��
��
��
��
���
p_ HasPointerInfo ���
q_ HasElementInfo ���
r_ IsMultiDimensional ���
s_ IsArrayofStrings �
t_ Reserved1
u_ Reserved2
v_ Reserved3
w_ Reserved4 B x_ _NDR64_ARRAY_FLAGS .?AU_NDR64_ARRAY_FLAGS@@ �� y_ +_ � �
FormatCode ���
Alignment
o_ Flags
Reserved �
u ElementSize ��
6_ ConfDescriptor ���
6_ VarDescriptor b {_ _NDR64_CONF_VAR_ARRAY_HEADER_FORMAT .?AU_NDR64_CONF_VAR_ARRAY_HEADER_FORMAT@@ |_ +_ �
n_ frag1 : ~_ __midl_frag6_t .?AU__midl_frag6_t@@ �� _ P_ Z F � _NDR64_POINTER_FORMAT .?AU_NDR64_POINTER_FORMAT@@ R
FormatCode ���
Flags
! Reserved �
6_ Pointee ��F �_ _NDR64_POINTER_FORMAT .?AU_NDR64_POINTER_FORMAT@@ �_ +_ �
�_ frag1 : �_ __midl_frag10_t .?AU__midl_frag10_t@@ �_ P_ 2 2
! frag1
frag2
M_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ ' b
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
�_ P frag6 : �_ X __midl_frag12_t .?AU__midl_frag12_t@@ �_ P_ " �2
! frag1
frag2
�_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ R
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
�_ @ frag5 : �_ H __midl_frag20_t .?AU__midl_frag20_t@@ �_ P_ f
FormatCode ���
ContextFlags �
RundownRoutineIndex ��
Ordinal ��V �_ _NDR64_CONTEXT_HANDLE_FORMAT .?AU_NDR64_CONTEXT_HANDLE_FORMAT@@ �� �_ +_ � 2
! frag1
frag2
M_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ � b
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
�_ P frag6 : �_ X __midl_frag29_t .?AU__midl_frag29_t@@ �_ P_ � " �2
! frag1
frag2
�_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ � r
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
�_ ` frag7 : �_ h __midl_frag34_t .?AU__midl_frag34_t@@ �_ P_ � " �2
! frag1
frag2
�_ frag3 : �_
<anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ � �
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
5_ � frag9
�_ � frag10 ���:
�_ � __midl_frag49_t .?AU__midl_frag49_t@@ �_ P_ � " �2
! frag1
frag2
�_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ � �
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
�_ � frag9 : �_ � __midl_frag59_t .?AU__midl_frag59_t@@ �_ P_ � " �2
! frag1
frag2
�_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ � F
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
5_ � frag9
5_ � frag10 ���
5_ � frag11 ���
5_ � frag12 ���
5_ � frag13 ���
5_ � frag14 ���
5_ � frag15 ���
5_ � frag16 ���
5_ frag17 ���
�_ frag18 ���: �_ __midl_frag82_t .?AU__midl_frag82_t@@ �_ P_ � Z � _NDR64_CONF_ARRAY_HEADER_FORMAT .?AU_NDR64_CONF_ARRAY_HEADER_FORMAT@@ �
FormatCode ���
Alignment
o_ Flags
Reserved �
u ElementSize ��
6_ ConfDescriptor ���Z �_ _NDR64_CONF_ARRAY_HEADER_FORMAT .?AU_NDR64_CONF_ARRAY_HEADER_FORMAT@@ �_ +_ � N � _NDR64_ARRAY_ELEMENT_INFO .?AU_NDR64_ARRAY_ELEMENT_INFO@@ 2
u ElementMemSize ���
6_ Element ��N �_ _NDR64_ARRAY_ELEMENT_INFO .?AU_NDR64_ARRAY_ELEMENT_INFO@@ �_ +_ � "
�_ frag1
�_ frag2 : �_ __midl_frag93_t .?AU__midl_frag93_t@@ �_ P_ � "
u frag1
Y_ frag2 : �_ __midl_frag94_t .?AU__midl_frag94_t@@ �_ P_ } 2
! frag1
frag2
M_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ r b
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
�_ P frag6 > �_ X __midl_frag110_t .?AU__midl_frag110_t@@ �� �_ P_ k "
u frag1
Y_ frag2 > �_ __midl_frag115_t .?AU__midl_frag115_t@@ �� �_ P_ I "
�_ frag1
�_ frag2 > �_ __midl_frag114_t .?AU__midl_frag114_t@@ �� �_ P_ R
�_ frag1 > �_ __midl_frag117_t .?AU__midl_frag117_t@@ �� �_ P_ A 2
! frag1
frag2
M_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ 6 b
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
�_ P frag6 > �_ X __midl_frag119_t .?AU__midl_frag119_t@@ �� �_ P_ / 2
! frag1
frag2
�_ frag3 : �_
<anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ $ �
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
5_ � frag9
�_ � frag10 ���>
�_ � __midl_frag133_t .?AU__midl_frag133_t@@ �� �_ P_ 2
! frag1
frag2
�_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ �
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
�_ � frag9 > �_ � __midl_frag143_t .?AU__midl_frag143_t@@ �� �_ P_ " �2
! frag1
frag2
�_ frag3 : �_
<anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ � �
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
5_ � frag9
5_ � frag10 ���
�_ � frag11 ���> �_ � __midl_frag152_t .?AU__midl_frag152_t@@ �� �_ P_ � "
�_ frag1
�_ frag2 > �_ __midl_frag158_t .?AU__midl_frag158_t@@ �� �_ P_ � B � _NDR64_RANGE_FORMAT .?AU_NDR64_RANGE_FORMAT@@ j
FormatCode ���
RangeType
! Reserved �
MinValue �
MaxValue �B �_ _NDR64_RANGE_FORMAT .?AU_NDR64_RANGE_FORMAT@@ �_ +_ � 2
u frag1
�_ frag2
Y_ frag3 > �_ ( __midl_frag159_t .?AU__midl_frag159_t@@ �� �_ P_ � 2
! frag1
frag2
�_ frag3 : �_ <anonymous-tag> .?AU<anonymous-tag>@@ �_ P_ � F
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
5_ � frag9
5_ � frag10 ���
5_ � frag11 ���
5_ � frag12 ���
5_ � frag13 ���
5_ � frag14 ���
5_ � frag15 ���
5_ � frag16 ���
5_ frag17 ���
�_ frag18 ���> �_ __midl_frag166_t .?AU__midl_frag166_t@@ �� �_ P_ � 2
! frag1
frag2
�_ frag3 : ` <anonymous-tag> .?AU<anonymous-tag>@@ ` P_ � r
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
` ` frag7 > ` h __midl_frag190_t .?AU__midl_frag190_t@@ �� ` P_ � "
�_ frag1
�_ frag2 > ` __midl_frag197_t .?AU__midl_frag197_t@@ �� ` P_ } B
u frag1
�_ frag2
U_ frag3
Y_ $ frag4 > ` 0 __midl_frag198_t .?AU__midl_frag198_t@@ ��
` P_ r 2
! frag1
frag2
�_ frag3 : ` <anonymous-tag> .?AU<anonymous-tag>@@
` P_ g R
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
` @ frag5 > ` H __midl_frag201_t .?AU__midl_frag201_t@@ �� ` P_ a 2
! frag1
frag2
�_ frag3 : ` <anonymous-tag> .?AU<anonymous-tag>@@ ` P_ V r
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
` ` frag7 > ` h __midl_frag205_t .?AU__midl_frag205_t@@ �� ` P_ N
��"
�_ frag1
�_ frag2 > ` __midl_frag210_t .?AU__midl_frag210_t@@ �� ` P_ 1 2
u frag1
�_ frag2
Y_ frag3 > ` ( __midl_frag211_t .?AU__midl_frag211_t@@ �� ` P_ ' 2
! frag1
frag2
�_ frag3 : ` <anonymous-tag> .?AU<anonymous-tag>@@ ` P_ �
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
` � frag9 > "` � __midl_frag214_t .?AU__midl_frag214_t@@ �� #` P_ "
�_ frag1
�_ frag2 > %` __midl_frag218_t .?AU__midl_frag218_t@@ �� &` P_ 2
u frag1
�_ frag2
Y_ frag3 > (` ( __midl_frag219_t .?AU__midl_frag219_t@@ �� )` P_ �
2
! frag1
frag2
�_ frag3 : +` <anonymous-tag> .?AU<anonymous-tag>@@ ,` P_ �
R
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
,` @ frag5 > .` H __midl_frag225_t .?AU__midl_frag225_t@@ �� /` P_ �
2
! frag1
frag2
�_ frag3 : 1` <anonymous-tag> .?AU<anonymous-tag>@@ 2` P_ �
Z
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
5_ � frag9
5_ � frag10 ���
5_ � frag11 ���
5_ � frag12 ���
5_ � frag13 ���
5_ � frag14 ���
5_ � frag15 ���
5_ � frag16 ���
5_ frag17 ���
5_ frag18 ���
2` frag19 ���> 4` 0__midl_frag228_t .?AU__midl_frag228_t@@ �� 5` P_ �
F � _NDR64_REPEAT_FORMAT .?AU_NDR64_REPEAT_FORMAT@@ ��R � _NDR64_POINTER_REPEAT_FLAGS .?AU_NDR64_POINTER_REPEAT_FLAGS@@
��
��.
9` SetCorrMark ��
:` Reserved �R ;` _NDR64_POINTER_REPEAT_FLAGS .?AU_NDR64_POINTER_REPEAT_FLAGS@@ <` +_ �
FormatCode ���
8` Flags
! Reserved �
u Increment
u OffsetToArray
u NumberOfPointers �F >` _NDR64_REPEAT_FORMAT .?AU_NDR64_REPEAT_FORMAT@@ �� ?` +_ f � _NDR64_POINTER_INSTANCE_HEADER_FORMAT .?AU_NDR64_POINTER_INSTANCE_HEADER_FORMAT@@ *
u Offset ���
u Reserved �f B` _NDR64_POINTER_INSTANCE_HEADER_FORMAT .?AU_NDR64_POINTER_INSTANCE_HEADER_FORMAT@@ C` +_ "
A` frag1
�_ frag2 : E` <anonymous-tag> .?AU<anonymous-tag>@@ F` P_ �
2
7` frag1
F` frag2
( frag3 : H` 0 <anonymous-tag> .?AU<anonymous-tag>@@ I` P_ �
2
�_ frag1
I` frag2
�_ @ frag3 > K` P __midl_frag240_t .?AU__midl_frag240_t@@ �� L` P_ �
2
u frag1
�_ frag2
Y_ frag3 > N` ( __midl_frag241_t .?AU__midl_frag241_t@@ �� O` P_ �
"
�_ frag1
�_ frag2 > Q` __midl_frag244_t .?AU__midl_frag244_t@@ �� R` P_ �
2
u frag1
�_ frag2
Y_ frag3 > T` ( __midl_frag245_t .?AU__midl_frag245_t@@ �� U` P_ �
2
! frag1
frag2
�_ frag3 : W` <anonymous-tag> .?AU<anonymous-tag>@@ X` P_ {
2
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
5_ � frag9
5_ � frag10 ���
5_ � frag11 ���
5_ � frag12 ���
5_ � frag13 ���
5_ � frag14 ���
5_ � frag15 ���
5_ � frag16 ���
X` frag17 ���> Z` __midl_frag253_t .?AU__midl_frag253_t@@ �� [` P_ i
"
A` frag1
�_ frag2 : ]` <anonymous-tag> .?AU<anonymous-tag>@@ ^` P_ J
2
7` frag1
^` frag2
( frag3 : `` 0 <anonymous-tag> .?AU<anonymous-tag>@@ a` P_ G
2
�_ frag1
a` frag2
�_ @ frag3 > c` P __midl_frag265_t .?AU__midl_frag265_t@@ �� d` P_ D
f � _NDR64_BOGUS_STRUCTURE_HEADER_FORMAT .?AU_NDR64_BOGUS_STRUCTURE_HEADER_FORMAT@@ ��J � _NDR64_STRUCTURE_FLAGS .?AU_NDR64_STRUCTURE_FLAGS@@ ��
��
��
��
��
��
��
��
���
h` HasPointerInfo ���
i` HasMemberInfo
j` HasConfArray �
k` HasOrigPointerInfo ���
l` HasOrigMemberInfo
m` Reserved1
n` Reserved2
o` Reserved3 J p` _NDR64_STRUCTURE_FLAGS .?AU_NDR64_STRUCTURE_FLAGS@@ �� q` +_ C �
FormatCode ���
Alignment
g` Flags
Reserve ��
u MemorySize ���
6_ OriginalMemberLayout �
6_ OriginalPointerLayout
6_ PointerLayout f s` _NDR64_BOGUS_STRUCTURE_HEADER_FORMAT .?AU_NDR64_BOGUS_STRUCTURE_HEADER_FORMAT@@ �� t` +_ b R � _NDR64_SIMPLE_MEMBER_FORMAT .?AU_NDR64_SIMPLE_MEMBER_FORMAT@@ V
FormatCode ���
Reserved1
! Reserved2
u Reserved3 R w` _NDR64_SIMPLE_MEMBER_FORMAT .?AU_NDR64_SIMPLE_MEMBER_FORMAT@@ x` +_ F � _NDR64_MEMPAD_FORMAT .?AU_NDR64_MEMPAD_FORMAT@@ ��V
FormatCode ���
Reserve1 �
! MemPad ���
u Reserved2 F {` _NDR64_MEMPAD_FORMAT .?AU_NDR64_MEMPAD_FORMAT@@ �� |` +_ � R
v` frag1
v` frag2
z` frag3
v` frag4
v` frag5 : ~` ( <anonymous-tag> .?AU<anonymous-tag>@@ ` P_ e "
f` frag1
` frag2 : �` H __midl_frag5_t .?AU__midl_frag5_t@@ �� �` P_ b 2
! frag1
frag2
�_ frag3 : �` <anonymous-tag> .?AU<anonymous-tag>@@ �` P_ 4
2
(_ frag1
-_ frag2
5_ frag3
5_ 0 frag4
5_ @ frag5
5_ P frag6
5_ ` frag7
5_ p frag8
5_ � frag9
5_ � frag10 ���
5_ � frag11 ���
5_ � frag12 ���
5_ � frag13 ���
5_ � frag14 ���
5_ � frag15 ���
5_ � frag16 ���
�` frag17 ���> �` __midl_frag276_t .?AU__midl_frag276_t@@ �� �` P_ "
Z � _NDR64_STRUCTURE_HEADER_FORMAT .?AU_NDR64_STRUCTURE_HEADER_FORMAT@@ ��j
FormatCode ���
Alignment
g` Flags
Reserve ��
u MemorySize ���Z �` _NDR64_STRUCTURE_HEADER_FORMAT .?AU_NDR64_STRUCTURE_HEADER_FORMAT@@ �� �` +_ O
�` frag1 > �` __midl_frag256_t .?AU__midl_frag256_t@@ �� �` P_ a
b � _NDR64_CONF_STRUCTURE_HEADER_FORMAT .?AU_NDR64_CONF_STRUCTURE_HEADER_FORMAT@@ �
FormatCode ���
Alignment
g` Flags
Reserve ��
u MemorySize ���
6_ ArrayDescription �b �` _NDR64_CONF_STRUCTURE_HEADER_FORMAT .?AU_NDR64_CONF_STRUCTURE_HEADER_FORMAT@@ �` +_ X
�` frag1 : �` __midl_frag92_t .?AU__midl_frag92_t@@ �` P_ � "
A` frag1
�_ frag2 : �` <anonymous-tag> .?AU<anonymous-tag>@@ �` P_ � 2
7` frag1
�` frag2
( frag3 : �` 0 <anonymous-tag> .?AU<anonymous-tag>@@ �` P_ � 2
�_ frag1
�` frag2
�_ @ frag3 > �` P __midl_frag287_t .?AU__midl_frag287_t@@ �� �` P_ � 2
u frag1
�_ frag2
Y_ frag3 > �` ( __midl_frag288_t .?AU__midl_frag288_t@@ �� �` P_ � R
v` frag1
v` frag2
z` frag3
v` frag4
v` frag5 : �` ( <anonymous-tag> .?AU<anonymous-tag>@@ �` P_ ^ "
f` frag1
�` frag2 > �` H __midl_frag113_t .?AU__midl_frag113_t@@ �� �` P_ [ "
�_ frag1
�_ frag2 > �` __midl_frag291_t .?AU__midl_frag291_t@@ �� �` P_ � 2
u frag1
�_ frag2
Y_ frag3 > �` ( __midl_frag292_t .?AU__midl_frag292_t@@ �� �` P_ �
��
��
�� FC_EXPR_START FC_EXPR_ILLEGAL �� FC_EXPR_CONST32 �� FC_EXPR_CONST64 �� FC_EXPR_VAR �� FC_EXPR_OPER � FC_EXPR_NOOP � FC_EXPR_END ��6 t �` _tagEXPR_TOKEN .?AW4_tagEXPR_TOKEN@@ ��� �` +_ [ 5 " 6 � " � " � �&
Pad ��
�` Format ���V �` �_elf_MIDL_TYPE_FORMAT_STRING .?AU_elf_MIDL_TYPE_FORMAT_STRING@@ �� �` P_ " ) �&
Pad ��
�` Format ���V �` ,_elf_MIDL_PROC_FORMAT_STRING .?AU_elf_MIDL_PROC_FORMAT_STRING@@ �� �` P_ $
���
���
���
���� -FC -MT -wd4746 -volatile:ms -Oy- -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427
�` Z �` -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X �` �` �` �` �` ��\h������)nCSy���� �ﺥd^z?��l�?a��/���m'}:��ߍd��1bm�� �:B�X���o���@� ����C�M��� W��Xj W����>�3od ��q���D,�)�/�� ���� �$� 0���V%��lZ3�2PZک�`�� �/���)+p4�X��m'}:pd��<����H-�QW����C�M��� W���$D��
̮��×mυ�Bc�A��>�3od ��mg��Q �͕�Fv8fI���� ��H-�QW�E�"F�v��2PZک�`_��M9:u>�3od ��拹Fxw����C┹�H-�QW� �r���#�pk��А�9��tk��P�Bc�A��Jd���2S0�?�cPeI���� ��H-�QW��rf���U�wwpY�m=�I���� ��H-�QW�����h�r�� �1�ն�
U�3�Vq��s��d4bL�6�+�8��Q,_Y\cE�g��҈����C┹�H-�QW���i /�
a�)�=I���� �6�+�8��Q,_Y\cE�M*ؓ$�:k�6�+�8���
a�)�=%�1í�u���{�X�I���� G;Q�:�30��V�lI���� 1�qT�����6�+�8���6�+�8��Q,_Y\cE�qt0
^ӘM*ؓ$�:k�6�+�8�����C┹�H-�QW�s> ����U�]�Z�-�P�P#G�Bc�A���{����
m�fe|ӑfhz��b�w��磸��'[�;�]� �Up��� z����eg4k 2|���S5�,���^�I#J�� ���G�9��*�NuΎޟ���*�yRЕN !� U��Z��ME�n�����(;���o��&؛�(6J��K�HQ���au�9I�1�{pg�ƣ�������Y
��1,_ ӆ�7��e�iݻ���GN0����XT�|���Ey�-@u'��Rp$�B 6}->���=~�S��%>n�� �GH.֚@8��/���?��l:/�=��K�J2⏃�t�"/ �*]��j�ʎ���� D���1�T�us��y)>�C��#�hm �7���^M�I�/ƙF�hf�4O��XORǖV$� �1��8�X�PeY){��FL=xn�J[����z� U{�K]�&˞ �_� z���� _��w��X����NT�İ
`��cV���y��s�~�� ]�>to�b�f�M@<O_*����c�]��X�3���8��8XO���1g��9ٛ[[������l��@��Þ���9ٛ[[��@��Þ��XO���1g���"��ᝡ���l���"����"��ᢐ�,o�
�,o�
�XO���1g���"��ᝡ���l���"����"���@��Þ�����,o�
�,o�
�9ٛ[[��9ٛ[[����,o�
�,o�
�2� ^g�� �ı._���dE��&
��X������'�'�W����I��k ��x���@�+�����A[Fq"k#Er�F���Fv 1�_�г�
�tE q�� Q�=��Eq~:2\1ԯ���|Q�p��%��s�p9��P�p7L6�鈳Ps�ٖP�� ;�i+X���2��*/?�F� �b�$k��OF%� MG@f�M���T�m?��O��9� J��.�{�[XI� ���)�^�eܒ<3�����ʝJq8�$g�UP@n���({�b�� �e�w��t�q���F���9��=%!:q�n
�.��U8R�Kd@3�q�K�,�yTiS�� �Cg��ْL��*�� �AP�F���s9��3y>qtŌa�t��� ��e�~���~�g���
'8.p*>�s���[�^�_�r �`*u|OE���Td8 �Y� +�z2���GJ�~18\F۲�<�B؞���{���@ K�,����q�����\�V�Ûs"[T����s��;��~o Q� �>�k^�? b��x��IX�� ��� ��a ���q<�I IB�э\��\̉��'� ��$�l�� ��� k�~�)�"���t�"���n���5�?���&��]w���28ĐY�c!y���70^���4\��ֲ���mGQj��鏫������S*��4t�D�ҡm3�ħ^d�b�BV��)1L.�S�41��r���v�@FYB�)o��'� ��q�z}+��ڲ�@�6~���_<Z{o&B:43�C��O�2�� n�%��0� ��5�}S� -INCLUDE:__@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinGEUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� .debug$S x e .rdata � ���R e ' .rdata � B��L e : .rdata � e L .rdata e d .rdata X K0�� e q .rdata W�D} e ~ .rdata ��� e � .rdata ��f_ e � .rdata
��/ e �
.rdata rԒ1 e � .rdata X ��W� e � .rdata
H �" e �
.rdata C� e � .rdata �K � e � .rdata X �N e � .rdata h �f�Z e .rdata � Ãuj e .rdata � ��4p e " .rdata ¯�� e 0 .rdata �?qE e > .rdata ]'� e L .rdata X K0�� e Z .rdata ��ˎ e i .rdata ��b+ e x .rdata rԒ1 e � .rdata X ��W� e � .rdata � A�
| e � .rdata � WX~� e � .rdata k&�v e � .rdata C� e � .rdata D�T� e � .rdata ! � i�Gf e � ! .rdata " }{? e � " .rdata # ��b+ e # .rdata $ ( � S� e $ .rdata % ¯�� e , % .rdata & h �ʆ e ; & .rdata ' C� e J ' .rdata ( Q�!� e Y ( .rdata ) rԒ1 e h ) .rdata * ��b+ e w * .rdata + 0 �hyZ e � + .rdata , H �|y e � , .rdata - h L�� e � - .rdata . k&�v e � . .rdata / � �j e � / .rdata 0 f�>� e � 0 .rdata 1 }{? e � 1 .rdata 2 ��b+ e � 2 .rdata 3 ( JJ� e � 3 .rdata 4 � 闢" e
4 .rdata 5 }{? e 5 .rdata 6 ��b+ e + 6 .rdata 7 ( 0��� e : 7 .rdata 8 � � e I 8 .rdata 9 ���R e X 9 .rdata : H �Y�� e g : .rdata ; 0 �$� e v ; .rdata < ��W� e � < .rdata = P �� e � = .rdata > ( �� e � > .rdata ? rԒ1 e � ? .rdata @ ��b+ e � @ .rdata A ( =�U{ e � A .rdata B ��p e � B .rdata C }{? e � C .rdata D ��W� e � D .rdata E P �� e E .rdata F H >tp� e F .rdata G ��W� e ( G .rdata H ��p e 7 H .rdata I �t e F I .rdata J a�q e U J .rdata K }{? e d K .rdata L h?B| e s L .rdata M ��8% e � M .rdata N }{? e � N .rdata O �ex e � O .rdata P ��W� e � P .rdata Q ��W� e � Q .rdata R P �� e � R .rdata S ( �kT� e � S .rdata T H >tp� e � T .rdata U ��W� e � U .rdata V rԒ1 e V .rdata W ��b+ e W .rdata X ( ��� e & X .rdata Y d� e 5 Y .rdata Z �m e D Z .rdata [ k&�v e S [ .rdata \ ��jp e b \ .rdata ] 6 ��� e q ] � � � � .rdata ^ e � ^ .rdata _ � υ � e _ .rdata ` , ~8�� e ` 8 .bss a e G a .data b e e b .rdata c 0 �X e } c .rdata d ` ��2 e � d .rdata e 57� e � e .rdata f c�s� e � f .gfids$y g �!q� e � g .gfids$y h ��9^ e � h .text$mn i 0 �� e .debug$S j \ i e .text$mn k 0 �I� e .debug$S l \ k e .text$mn m 4 � �B e .debug$S n � m e .text$mn o 0 ��� e .debug$S p \ o e .text$mn q 0 �~ e .debug$S r \ q e .text$mn s , p�v@ e .debug$S t � s e .text$mn u , �9�j e .debug$S v u e .text$mn w , {��Z e .debug$S x w e .text$mn y , ���E e .debug$S z � y e .text$mn { < ��� e .debug$S | \ { e .text$mn } 0 �Y� e .debug$S ~ d } e .text$mn 0 � �� e .debug$S � d e .text$mn � < �[�� e .debug$S � \ � e .text$mn � < ���4 e .debug$S � h � e .text$mn � H N9{ e .debug$S � � � e .text$mn � H �Z� e .debug$S � � � e .text$mn � H ��q e .debug$S � 0 � e .text$mn � H ,P� e .debug$S � 0 � e .text$mn � 4 �{� e .debug$S � � � e .text$mn � H e�� e .debug$S � � � e .text$mn � H �A\ e .debug$S � � � e .text$mn � t $�1� e .debug$S � T @ � e .text$mn � t ��� e .debug$S � � F � e .text$mn � x M �e e .debug$S � � 8 � e .text$mn � x �=� e .debug$S � � 8 � e .text$mn � t ��UP e .debug$S � T @ � e .text$mn � 4 U�r e .debug$S � � � e � � � � � ) y 5 { K � b u { � � � � � � � � � � � � i � o � � � � ( � A � M m ^ o } � w � s � k � q $LN4 � $LN4 � $LN4 � $LN4 y $LN4 { $LN4 � $LN4 u $LN4 � $LN4 � $LN4 � $LN4 � $LN4 � $LN4 � $LN4 i $LN4 o $LN4 � $LN4 � $LN4 � $LN4 � $LN4 � $LN4 m $LN4 $LN4 } $LN4 w $LN4 s $LN4 k $LN4 q .pdata � � IH� e � � .pdata � � IH� e � � .pdata � B��� e � � .pdata � �& y e � .pdata � ��?\{ e . � .pdata � ���� e K � .pdata � �& u e i � .pdata � ���� e � � .pdata � B��� e � � .pdata � [�b�� e � � .pdata � ��?\� e � � .pdata � [�b�� e � � .pdata � [�b�� e
� .pdata � (l�i e
� .pdata � (l�o e /
� .pdata � B��� e D
� .pdata � [�b�� e \
� .pdata � ��?\� e o
� .pdata � [�b�� e �
� .pdata � [�b�� e �
� .pdata � ���m e �
� .pdata � (l� e �
� .pdata � (l�} e �
� .pdata � �& w e � .pdata � �& s e " � .pdata � (l�k e 5 � .pdata � (l�q e K � .debug$S � 0 e .debug$S � , e .debug$S � 4 e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � (
e .debug$S � ( e .debug$S � ( e .debug$S � (
e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � ( e .debug$S � , e .debug$S � , e .debug$S � , e .debug$S � , e .debug$S � , e .debug$S � , e .debug$S � , e .debug$S � , e .debug$S � , e .debug$S � , e .debug$S � , ! e .debug$S � , " e .debug$S � , # e .debug$S � , $ e .debug$S � , % e .debug$S � , & e .debug$S � , ' e .debug$S � , ( e .debug$S � , ) e .debug$S � , * e .debug$S � , + e .debug$S � , , e .debug$S � , - e .debug$S � , . e .debug$S � , / e .debug$S � , 0 e .debug$S � , 1 e .debug$S � , 2 e .debug$S � , 3 e .debug$S � , 4 e .debug$S � , 5 e .debug$S � , 6 e .debug$S � , 7 e .debug$S � , 8 e .debug$S � , 9 e .debug$S � , : e .debug$S � , ; e .debug$S � , < e .debug$S � , = e .debug$S � , > e .debug$S � , ? e .debug$S � , @ e .debug$S � , A e .debug$S � , B e .debug$S � , C e .debug$S � , D e .debug$S � , E e .debug$S � ( F e .debug$S � , G e .debug$S , H e .debug$S , I e .debug$S , J e .debug$S , K e .debug$S , L e .debug$S , M e .debug$S , N e .debug$S ( O e .debug$S , P e .debug$S , Q e .debug$S
, R e .debug$S , S e .debug$S , T e .debug$S
, U e .debug$S , V e .debug$S , W e .debug$S , X e .debug$S , Y e .debug$S , Z e .debug$S , [ e .debug$S , \ e .debug$S < ] e .debug$S , ^ e .debug$S 8 _ e .debug$S 8 ` e .debug$S 4 b e .debug$S 0 c e .debug$S 8 d e .debug$S 4 e e .debug$S 0 f e .debug$T \^ e .chks64 e ` eventlog_SyntaxInfo MIDL_user_free MIDL_user_allocate eventlog_StubDesc eventlog_Ndr64ProcTable __midl_frag1 __midl_frag2 __midl_frag7 __midl_frag8 __midl_frag9 __midl_frag6 __midl_frag10 __midl_frag12 __midl_frag20 __midl_frag21 __midl_frag22 __midl_frag29 __midl_frag34 __midl_frag49 __midl_frag59 __midl_frag82 __midl_frag93 __midl_frag94 __midl_frag110 __midl_frag115 __midl_frag114 __midl_frag117 __midl_frag119 __midl_frag133 __midl_frag143 __midl_frag144 __midl_frag149 __midl_frag150 __midl_frag152 __midl_frag157 __midl_frag158 __midl_frag159 __midl_frag166 __midl_frag190 __midl_frag193 __midl_frag195 __midl_frag196 __midl_frag197 __midl_frag198 __midl_frag201 __midl_frag205 __midl_frag206 __midl_frag207 __midl_frag208 __midl_frag209 __midl_frag210 __midl_frag211 __midl_frag214 __midl_frag217 __midl_frag218 __midl_frag219 __midl_frag221 __midl_frag222 __midl_frag225 __midl_frag228 __midl_frag239 __midl_frag240 __midl_frag241 __midl_frag243 __midl_frag244 __midl_frag245 __midl_frag253 __midl_frag262 __midl_frag264 __midl_frag265 __midl_frag5 __midl_frag267 __midl_frag276 __midl_frag277 __midl_frag256 __midl_frag278 __midl_frag282 __midl_frag283 __midl_frag284 __midl_frag92 __midl_frag285 __midl_frag286 __midl_frag287 __midl_frag288 __midl_frag113 __midl_frag289 __midl_frag290 __midl_frag291 __midl_frag292 __midl_frag293 __midl_frag294 __midl_frag295 __midl_frag297 eventlog_FormatStringOffsetTable EVENTLOG_HANDLE_A_unbind EVENTLOG_HANDLE_A_bind EVENTLOG_HANDLE_W_unbind EVENTLOG_HANDLE_W_bind BindingRoutines elf__MIDL_TypeFormatString elf__MIDL_ProcFormatString NdrClientCall3 eventlog__MIDL_AutoBindHandle eventlog_ClientIfHandle eventlog_ProxyInfo eventlog___RpcClientInterface _NDR64_RpcTransferSyntax _RpcTransferSyntax __guard_fids__ ElfrReportEventExA ElfrReportEventExW ElfrReportEventAndSourceW ElfrFlushEL ElfrGetLogInformation ElfrWriteClusterEvents ElfrDeregisterClusterSvc ElfrRegisterClusterSvc ElfrReportEventA ElfrReadELA ElfrOpenBELA ElfrRegisterEventSourceA ElfrOpenELA ElfrBackupELFA ElfrClearELFA ElfrReportEventW ElfrReadELW ElfrOpenBELW ElfrRegisterEventSourceW ElfrOpenELW ElfrChangeNotify ElfrOldestRecord ElfrNumberOfRecords ElfrDeregisterEventSource ElfrCloseEL ElfrBackupELFW ElfrClearELFW $pdata$ElfrReportEventExA $pdata$ElfrReportEventExW $pdata$ElfrReportEventAndSourceW $pdata$ElfrFlushEL $pdata$ElfrGetLogInformation $pdata$ElfrWriteClusterEvents $pdata$ElfrDeregisterClusterSvc $pdata$ElfrRegisterClusterSvc $pdata$ElfrReportEventA $pdata$ElfrReadELA $pdata$ElfrOpenBELA $pdata$ElfrRegisterEventSourceA $pdata$ElfrOpenELA $pdata$ElfrBackupELFA $pdata$ElfrClearELFA $pdata$ElfrReportEventW $pdata$ElfrReadELW $pdata$ElfrOpenBELW $pdata$ElfrRegisterEventSourceW $pdata$ElfrOpenELW $pdata$ElfrChangeNotify $pdata$ElfrOldestRecord $pdata$ElfrNumberOfRecords $pdata$ElfrDeregisterEventSource $pdata$ElfrCloseEL $pdata$ElfrBackupELFW $pdata$ElfrClearELFW /308 1606894061 100666 1574739 `
d�
�A�_� ! .debug$S ̓ � @ B.rdata �� @0@.rdata � @0@.rdata � @0@.rdata
� � @@@.rdata $� 4� @@@.rdata >� N� @@@.debug$S 4 X� �� @B.debug$S @ �� � @B.debug$S 8 � ,� @B.debug$P @j @� @ B.chks64 h �
.drectve �
� � R d:\os\obj\arm64fre\onecore\admin\wmi\events\advapi\objfre\arm64\precomp.obj : < � � k k
Microsoft (R) Optimizing Compiler � ?� 5 n ProcThreadAttributeSafeOpenPromptOriginClaim ) w AuditEventDirectoryServiceAccess � SmrGcActionStop " � ProcessBreakOnTermination � % VrfPlatformModeTest # ImageMitigationOptionsMask ) DynamicTickVetoClockUpdateFailed � , ProcessImageFileMapping I TP_LOG_LEVEL_INFO f � DPFLTR_REFS_ID s ProcessWorkingSetSwap w PowerActionSleep # � PoCsDeviceNotificationWiFi � PowerSystemMaximum & � � SystemSingleModuleInformation ! � EnlistmentCrmInformation ( ) MonitorRequestReasonIdleTimeout ; PerfCSwapLite f � DPFLTR_MPIO_ID K ProfileTotalIssues � 3 ReservedForDVRF51 & j JobObjectReserved2Information 0 u InternalWakeSourcePredictedUserPresence " { S SystemBatteryStatePrecise - ~ 9 FileLinkInformationBypassAccessCheck ! � RtlPathTypeDriveAbsolute # � PlugPlayControlStartDevice � LockQueueIoVpbLock ~ . FileHardLinkInformation & � � AccessReasonFromPrivilege � COR_VERSION_MAJOR { X ThermalStandby KeyBasicInformation LearningModeLogLevelMax � VrfStandardDDIRuleClass { ProcessorInformation % i DISPLAYCONFIG_TOPOLOGY_CLONE � NtProductWinNt � FpFormatI64 , � PlugPlayControlTargetDeviceRelation � PsProtectedSignerLsa � TokenSessionReference FpCodeSquareRoot & SystemVaTypePagedPool � GEO_ISO2 + ) VRF_TRIAGE_CONTEXT_FLIGHT_TARGETED M SecurityAppliance , P MemExtendedParameterPartitionHandle # S PnpQueryTransportRelations { SystemVideoState ~ H FileLinkInformationEx , � PsEnergyComponentTypeWindowResource + � EtwCoverageSamplerQueryInformation 1 FilterBootOptionOperationOpenSystemStore 2 � SE_WS_APPX_SIGNATURE_ORIGIN_NOT_VALIDATED ' � H SystemWatchdogTimerInformation " + FileFsObjectIdInformation / 0 JOB_OBJECT_IO_RATE_CONTROL_VALID_FLAGS # MaxProcessMitigationPolicy ' 7 EtwQueryPartitionInformationV2 " = MmEtwWorkingSetTypeSystem ) E FeatureConfigurationPriorityUser H TypeA K AuditDeleteObject �
LockQueueIoDatabaseLock % �
PsEnergyComponentTypeAudioIn $ s TransactionOutcomeCommitted ) v LdrModulesWaitingForDependencies � LockQueueUnusedSpare15 � ToleranceIntervalShort � D WinHighLabelSid � TpTraceThreadPriority & j JobObjectReserved9Information ) MonitorRequestReasonDP � _ARM64_BARRIER_OSHST 2 � � SystemDifRemovePluginVerificationOnDriver � FileNameInfo { G SuspendResumeInvocation 2 � DISPLAYCONFIG_DEVICE_INFO_GET_SOURCE_NAME $ ACTCTX_RUN_LEVEL_AS_INVOKER , WMI_GET_SINGLE_INSTANCE $ � k WinAccountProtectedUsersSid % � w SystemPagedPoolInformationEx ) MonitorRequestReasonLid . � O ProcessWin32kSyscallFilterInformation � SystemPowerState ! � ThreadActualBasePriority ( � ResourceManagerBasicInformation & � SubsystemInformationTypeWin32 $ � RtlSparseBitmapOperationAny � ? ProcessFaultInformation � AclSizeInformation ) EtwBufferStatePendingCompression f J DPFLTR_DMSERVER_ID j 0 MaxJobObjectInfoClass v SERVERSILO_TERMINATED � MaxTpTraceType � IoPriorityCritical � IoSessionStateCreated & � VrfPowerDelayFuzzingRuleClass � LockQueueNtfsStructLock � ViewUnmap � PowerDeviceMaximum , � CrossProcOperationMemoryDirtyNotify f � DPFLTR_LSASS_ID BootEntropySourceTpm ' $ SectionOriginalBaseInformation f & DPFLTR_SCCLIENT_ID
MaxKeyInfoClass " � � SystemRootSiloInformation ) P WorkerFactoryCallbackIndependent & ProcessSystemCallFilterPolicy _ IMDT_UNAVAILABLE " � � � AccessReasonFilterAce ~ FileStandardInformation 9 � PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION ! j JobObjectWakeInformation , WMI_DISABLE_COLLECTION � GEOCLASS_REGION 3 � W WinCapabilityPrivateNetworkClientServerSid � _ARM64_BARRIER_ST " s TransactionOutcomeAborted � MutantBasicInformation � IrqPriorityLow H TypeC � FpFormatString � 7 SystemNumaProcessorMap $ � MaxSubsystemInformationType � PsProtectedSignerWinTcb � FileIdExtdDirectoryInfo 2 � � SystemCodeIntegrityCertificateInformation ( j JobObjectClearPeakJobMemoryUsed � PS_MITIGATION_OPTION_NX � ViewShare # � PerfInfoDebugEventReceived � TokenLogonSid ' � U WinCapabilityInternetClientSid * � � SystemSecureBootPolicyInformation � IoPriorityVeryLow BackTraceDatabaseCreate 7 P TransactionManagerOldestTransactionInformation $ FpCodeYn � ThreadAmILastThread � TableInsertAsRight � SidTypeAlias ' � EventProviderUseDescriptorType # � ThreadWorkloadClassDefault � MaxHardwareCounterType � DEPPolicyOptOut � OptionOkNoWait $ � SharedVirtualDisksSupported ! x PsAttributeGroupAffinity : � DISPLAYCONFIG_DEVICE_INFO_GET_ADVANCED_COLOR_INFO � FpFormatI16 � COPYFILE2_PROGRESS_STOP ~ ; FileIdInformation ' � ManageHotPatchLoadPatchForUser { 0 GroupPark � PNP_VetoTypeUnknown � SecurityDelegation $ � COPYFILE2_PROGRESS_CONTINUE " � PoCsDeviceNotificationMbn f DPFLTR_KBDCLASS_ID � � MaxSystemInfoClass ] LogExceptionDispatch f ! DPFLTR_FASTFAT_ID K WnfDataScopeSystem . DISPLAYCONFIG_COLOR_ENCODING_YCBCR422 FirmwareTypeMax � IoSessionStateLoggedOn � TokenLinkedToken H TypeB ) N SharedVirtualDiskHandleStateNone ] SysDbgBreakPoint � B WinLowLabelSid � FileFullDirectoryInfo f DPFLTR_SCSIPORT_ID ] SysDbgReadControlSpace + DirectoryNotifyExtendedInformation $ TransactionBasicInformation # WdInfoResetTimer > LocationTypeFileSystem ] SysDbgQueryVersion ' j ) JobObjectReserved19Information ( � FileStorageTierClassUnspecified 0 @ EventTraceHeapSummaryTracingInformation ] SysDbgReadMsr M SYSTEM_HANDLE_EVENT � MarshalDirectionMarshal % ~ FileFullDirectoryInformation � MemoryFlushModifiedList KeyTrustInformation * � RtlResTypeDiskWriteConstraintTier 5 DEBUG_CONTROL_SPACE_PCR ) 9 ORIENTATION_PREFERENCE_LANDSCAPE BackTraceDatabaseDelete ] SysDbgWriteIoSpace � , ReservedForDVRF44 3 � PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES � 7 ReservedForDVRF55 � WinCreatorOwnerSid � MaxProcessTlsOperation ! UmsThreadAffinity % ! SecureSettingValueTypeBinary � F ProcessInPrivate ) � � AccessReasonNotGrantedByCape f 8 DPFLTR_MCHGR_ID * � � COMIMAGE_FLAGS_32BITPREFERRED f Q DPFLTR_IHVSTREAMING_ID ) � Z SystemBootEnvironmentInformation 1 9 ORIENTATION_PREFERENCE_LANDSCAPE_FLIPPED �! STUB_UNMARSHAL # �! VmCfgCallTargetInformation , � ? SystemEmulationProcessorInformation FpCodeModf / � CrossProcOperationMemoryFreePostNotify �! PowerStateSleeping2 5 0 JOB_OBJECT_IO_RATE_CONTROL_STANDALONE_VOLUME � LockQueueUnusedSpare1 M SYSTEM_HANDLE_SEMAPHORE + � PsEnergyComponentTypeTrackingState $ � [ SystemHypervisorInformation # j
JobObjectJobSetInformation + � EtwCoverageSamplerBloomInformation � � SystemFlushInformation % � AlpcServerSessionInformation ^" FpRoundMinusInfinity * j ' JobObjectServerSiloUserSharedData / � � AccessReasonNotGrantedByParentCape # � ExceptionContinueExecution ' j ( JobObjectReserved18Information �" EtwProviderTraitTypeMax ! �" FEEDBACK_TOUCH_DOUBLETAP 2 � f ProcessDynamicEnforcedCetCompatibleRanges �" HiberFileBucket1GB � RpcFailedLbsMessages � PowerDeviceD2 % � ProcessForegroundInformation " �" WdActionQueryTimeoutValue � GEO_FRIENDLYNAME # � FeatureEnabledStateEnabled v LdrModulesCondensed & @ EventTraceSpinlockInformation � E WinSystemLabelSid ! � 2 ProcessWindowInformation � q WinAccountKeyAdminsSid f L DPFLTR_INFINIBAND_ID ] " SysDbgClearUmBreakPid % � W SystemSpecialPoolInformation f o DPFLTR_WHEA_ID � 1 ProcessOwnerInformation � VrfHardwareRuleClass ~ $ FileTrackingInformation = FpCompareGreater 1 � � SystemCodeIntegrityPolicyFullInformation $ � WinBuiltinAdministratorsSid % {# DISPLAYCONFIG_SCALING_CUSTOM # ~# ProcessInformationClassMax ( � SE_VALIDATE_MAPPING_HEADER_ONLY � PsProtectedSignerApp # �#
DeviceInstanceRemovalEvent ' � $ SystemContextSwitchInformation # � � � AccessReasonTrustLabel " � - ProcessAffinityUpdateMode � TraceVersionInfo + �# QUERY_FILE_LAYOUT_NUM_FILTER_TYPES �# PsMaxStdHandleStates ' �# SeImageSignaturePackageCatalog ( � TraceSampledProfileIntervalInfo �# IMPORT_OBJECT_DATA ! ProcessDynamicCodePolicy f | DPFLTR_USBSTOR_ID ( E FeatureConfigurationPriorityMax ! $ WorkerFactoryIdleTimeout $ ResponseOk ,$ DCDC_DISABLE_RELAYOUT � MAX_CLASS_NAME ) 9$ DISPLAYCONFIG_ROTATION_ROTATE180 � FileStorageInfo � Q ProcessWakeInformation ' � ` SystemPrefetchPatchInformation ! { AdministratorPowerPolicy ' �$ HighMemoryResourceNotification & �$ RtlRXactOperationSetAttribute M SYSTEM_HANDLE_PIPE �" WdActionStopTimer ) TransactionDTCPrivateInformation 1 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_MIRACAST U WaitNotification # �$ InvalidAppContainerSidType � SmrGcActionPause ) � ^ ProcessSecurityDomainInformation �! PowerStateSleeping1 * ~ * FileIoStatusBlockRangeInformation % PsMaxWakeReasons % j JobObjectBasicUIRestrictions $ j JobObjectGroupInformationEx # � 1 ThreadPowerThrottlingState d% PdataRefToFullXdata � TracePmcEventListInfo % 7 EtwQueryPartitionInformation {
ProcessorStateHandler2 # � ThreadDescriptorTableEntry $ ~ 6 FileStandardLinkInformation + f" � �HeapDetailedFailureInformation * )
MonitorRequestReasonSessionUnlock � RtlPathTypeRooted / p WOW64_FUNCTION_CPU_TURBO_THUNK_CONTROL � / ThreadAttachContainer ' j * JobObjectReserved20Information 1 SymbolicLinkAccessMask 7& MaxKeySetInfoClass $ ~ ! FileReparsePointInformation ( 9 ORIENTATION_PREFERENCE_PORTRAIT ! �" HiberFileBucketUnlimited � $ ProcessCookie � 4 ReservedForDVRF52 EtwBufferStateMaximum FpCodeTan �& LdrpAnyDevice2bit ' j % JobObjectReserved15Information x PsAttributeJobList � SidTypeWellKnownGroup # ] SysDbgEnableKernelDebugger $ � ProcessDefaultHardErrorMode ( � COMIMAGE_FLAGS_STRONGNAMESIGNED $ � TraceProviderBinaryTracking FpCodeCos ] LogExceptionHandler "
ProcessChildProcessPolicy �' FileIdType , �' LoadReasonStaticForwarderDependency ] SysDbgSetSpecialCall � IMAGE_COR_MIH_METHODRVA � _ARM64_BARRIER_OSH * �' ActivationContextBasicInformation � PNP_VetoDevice ] SysDbgQuerySpecialCalls - � CsvControlMarkHandleLocalVolumeMount �' PMETypeMax / P MemExtendedParameterUserPhysicalHandle . � ) SystemVerifierRemoveDriverInformation . � PS_MITIGATION_OPTION_ROP_CALLER_CHECK PoHot .# VMEConfiguration f DPFLTR_VIDEOPRT_ID f � DPFLTR_XSAVE_ID f N DPFLTR_IHVVIDEO_ID 0( UserNotPresent � SidTypeInvalid ,
WMI_CAPTURE_STATE ! ~ ( FileShortNameInformation 2 � PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS # � . SystemTimeSlipNotification / �# QUERY_FILE_LAYOUT_FILTER_TYPE_CLUSTERS � L ProcessEnergyValues � o SystemAitSamplingValue " � COPYFILE2_PROGRESS_CANCEL + ) MonitorRequestReasonScMonitorpower f DPFLTR_NTFS_ID + � D SystemSessionMappedViewInformation ! � X ProcessUptimeInformation � / ReservedForDVRF47 $ ! SecureSettingValueTypeUlong ) � ^ WinCapabilityRemovableStorageSid & ) PsProtectedTypeProtectedLight # �! VmOfferPriorityBelowNormal # � � AccessReasonAllowedAce f r DPFLTR_TPM_ID �! PowerStateShutdownOff BootEntropySourceRdrand ) TransactionEnlistmentInformation �! PowerStateSleeping3 b) IoSessionEventLogoff + e) SystemMemoryPartitionCombineMemory � GEO_NATION # � PsProtectedSignerWinSystem ! � PsEnergyComponentTypeCpu " � ProcessSessionInformation ! FpCodeTanh & j , JobObjectContainerTelemetryId ! � - WinAccountControllersSid * FeatureVariantPayloadKindExternal w PowerActionNone M SYSTEM_HANDLE_PROCESS �) DeviceWakeSourceType ! � PsEnergyComponentTypeMax 9 � DISPLAYCONFIG_DEVICE_INFO_SET_TARGET_PERSISTENCE � FileCompressionInfo % ACTCTX_RUN_LEVEL_UNSPECIFIED � PNP_VetoOutstandingOpen ( A EtwNotificationTypeCredentialUI p WOW64_FUNCTION_MAXIMUM " x PsAttributeIdealProcessor �( MandatoryLevelCount , �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DVI ( � @ SystemExtendedHandleInformation �
FpFormatCompare ! 5 SystemPixelFormatUnknown - ) MonitorRequestReasonScreenOffRequest M SYSTEM_HANDLE_JOB % ImageStrictHandleCheckPolicy $ SectionBasicInformation � PsCreateFailExeFormat - �' ActivationContextDetailedInformation _*
EtwWdiScenarioCode $ k* MaxServiceRegistryStateType ) >' COPYFILE2_CALLBACK_CHUNK_STARTED f 4 DPFLTR_FUSION_ID 1 ) 0 MonitorRequestReasonDisplayRequiredUnDim # � R ProcessEnergyTrackingState � 1 ReservedForDVRF49 KeyFullInformation � JournalRenameKey � D ProcessSubsystemProcess 0 �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_ENABLE " �* PoSleepDisableReasonVideo f t DPFLTR_ENVIRON_ID ~ 4 FileUnusedInformation # x PsAttributeProtectionLevel �" FEEDBACK_PEN_DOUBLETAP � VrfVMSwitchingRuleClass & { [ QueryPotentialDripsConstraint % � MaximumFileInfoByHandleClass ' + CmResourceShareDriverExclusive �# DeviceInstallEvent + � ( SystemVerifierAddDriverInformation ! K AuditOpenObjectForDelete M SYSTEM_HANDLE_REG_KEY F+ ShutdownReboot � FileEndOfFileInfo c+ GetFileExInfoStandard & � + SystemLegacyDriverInformation " � w WinBuiltinDeviceOwnersSid 0 � CrossProcOperationMemoryAllocPostNotify { L LastResumePerformance 1 @ EventTraceProfileSourceRemoveInformation � TableEmptyTree f { DPFLTR_APPCOMPAT_ID / E
FeatureConfigurationPriorityUserPolicy ! x PsAttributeParentProcess � ThreadWow64Context � ! VrfWDFRuleClass �+ OS_DEPLOYMENT_STANDARD ( { TraceApplicationPowerMessageEnd / j ! JobObjectNotificationLimitInformation2 � C WinMediumLabelSid # $ WorkerFactoryThreadMinimum � FileStorageTierClassMax �# PsNeverDuplicate # � RtlPathTypeRootLocalDevice � RpcFailedLbsDecisions + ~ / FileProcessIdsUsingFileInformation � ProcessDebugFlags �+ IMO_UNAVAILABLE ! w PowerActionShutdownReset 8% MemoryTypeLargePage " � MemoryCaptureAccessedBits # � ManageHotPatchQueryPatches w PowerActionHibernate �) EtwRtBufferLost � ( VrfAVXCorruption � FileRenameInfoEx 0 � PsEnergyComponentTypeCompositorResource m ObjectTypesInformation - � J SystemWow64SharedInformationObsolete " � 3 SystemVerifierInformation � IoPriorityHigh Q, TokenElevationTypeFull " j JobObjectCompletionFilter � ProcessDeviceMap # � UmsInformationCommandQuery � IrqPriorityUndefined u, PlatformRoleMaximum + FileFsVolumeInformation � # ThreadSuspendCount 4 � # WinBuiltinPreWindows2000CompatibleAccessSid " ~ : FileVolumeNameInformation , �, CI_WINDOWS_LOCKDOWN_RESTRICTION_MAX � KHeteroCpuPolicyLarge S PnpQueryBusRelations �' MaximumFileIdType % � FileFullDirectoryRestartInfo + ~ ? FileIdExtdBothDirectoryInformation " � SystemNetRateControlQuota � ThreadTebInformation " �, ImagePolicyEntryTypeInt64 u, PlatformRoleWorkstation # �$ MonitorRequestTypeToggleOn M SmallBusinessRestricted M WnfInfoStateNameExist �
_ARM64_BARRIER_LD / �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SVIDEO � , TokenBnoIsolation + � f WinBuiltinRemoteManagementUsersSid EtwBufferStateCSwitch � SidTypeDeletedAccount � VrfEnhancedIORuleClass � SystemObjectInformation ) � N WinBuiltinCertSvcDComAccessGroup �# DeviceClassChangeEvent f" HeapTaggingInformation � TraceLbrEventListInfo M Personal + �, POINTER_DEVICE_TYPE_INTEGRATED_PEN % � TP_CALLBACK_PRIORITY_INVALID K ProfileTime ! MaxImageMitigationPolicy �& LdrpRemote A � PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY . � c ProcessFreeFiberShadowStackAllocation $ � PsCreateFailOnSectionCreate " �" FEEDBACK_PEN_PRESSANDHOLD 3 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDTVDONGLE � SystemNetRateControlSet �) EtwRtEventNoLoss % KeyVirtualizationInformation # �$ KeyValuePartialInformation / � PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR � A WinUntrustedLabelSid � s SystemErrorPortTimeouts � 2 ReservedForDVRF50 8 � PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE . � � SystemFeatureConfigurationInformation & � SharedVirtualDisksUnsupported � TokenIntegrityLevel 2 � � SystemSecureSpeculationControlInformation ( � $ WinBuiltinRemoteDesktopUsersSid �' ��LoadReasonUnknown � DEPPolicyOptIn * x PsAttributeMitigationAuditOptions f ? DPFLTR_PREFETCHER_ID � PNPISABus 0( UserPresent b) IoSessionEventConnected " � V SystemRefTraceInformation + ], FileMetadataOptimizationInProgress � ThreadPowerThrottling 5 {# DISPLAYCONFIG_SCALING_ASPECTRATIOCENTEREDMAX ! �( RtlBsdItemBootCheckpoint EventSecuritySetDACL , � PlugPlayControlGetBlockedDriverList � SmrGcStateInactive �( MandatoryLevelUntrusted � " WinBuiltinReplicatorSid 6 ImagePolicyIdNone f � DPFLTR_CRASHDUMPXHCI_ID - 9$ ��DISPLAYCONFIG_ROTATION_FORCE_UINT32 f � DPFLTR_PSHED_ID � TokenAppContainerSid * @ EventTraceStackCachingInformation & s ProcessWorkingSetOperationMax 1 @ EventTraceLastBranchEventListInformation � IrqPolicyMachineDefault w AuditEventObjectAccess �"
FEEDBACK_TOUCH_RIGHTTAP ( i DISPLAYCONFIG_TOPOLOGY_INTERNAL f � DPFLTR_FILETRACE_ID # ~ FileMailslotSetInformation � / SystemSessionCreate ) �% CmExtendedParameterTrustClassKey $ �
SystemStackTraceInformation ! � ThreadEventPair_Reusable " Q, TokenElevationTypeLimited �' SC_STATUS_PROCESS_INFO % � VrfSyncDelayFuzzingRuleClass 1 � � SystemFirmwareBootPerformanceInformation FpCodeFrexp ' Z/ CI_WINDOWS_LOCKDOWN_MODE_TRIAL @ MaxEventTraceInfoClass $ �* COPYFILE2_PHASE_READ_SOURCE # � & WinAccountAdministratorSid ' { SystemMonitorHiberBootPowerOff � WinInteractiveSid # � i SystemProcessorBrandString & �/ IMPORT_OBJECT_NAME_UNDECORATE � LockQueueUnusedSpare0 EventSecuritySetSACL { - GetPowerRequestList f DPFLTR_NTOSPNP_ID 1 E FeatureConfigurationPriorityImageDefault ! � ! TokenUserClaimAttributes FpCodeAtan �/ DPI_AWARENESS_UNAWARE % � SystemPerformanceInformation .# CbusConfiguration " �- MemoryReserveIoCompletion $ WorkerFactoryTimeout � PowerDeviceD3 8 � PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32 f c DPFLTR_VDSUTIL_ID + Q0 PerfInfoMMStatAggregatePageCombine � WinLocalSystemSid - � : SystemRecommendedSharedDataAlignment & � y SystemNodeDistanceInformation 6 ImagePolicyIdEtw * � ManageHotPatchQueryPatchesForUser $ �0 DynamicTickDisableReasonMax # j JobObjectFreezeInformation , {# ��DISPLAYCONFIG_SCALING_FORCE_UINT32 ' j . JobObjectReserved24Information ! � WinCreatorOwnerServerSid ) . MonitorRequestReasonDim ' $ WorkerFactoryThreadSoftMaximum �' LoadReasonAsDataLoad ) @ EventTraceTimeProfileInformation ! #1 PoDisabledStateSleeping2 ' LearningModeLogLevelSpecialApc ! �, ImagePolicyEntryTypeNone �# VetoEvent ! �, ImagePolicyEntryTypeBool � FpFormatU32 m ObjectBasicInformation � PMCCounter � ProcessBasicInformation �
VrfIRPTrackingRuleClass v SERVERSILO_TERMINATING " � COR_VTABLEGAP_NAME_LENGTH & � ComputerNamePhysicalDnsDomain .# MPIConfiguration $ � CsvControlGetCsvFsMdsPathV2 ( � ComputerNamePhysicalDnsHostname f" HeapOptimizeResources 2 E FeatureConfigurationPriorityImageOverride $ � PlugPlayControlUnlockDevice f � DPFLTR_UDFS_ID 3 � IrqPolicyAllProcessorsInMachineWhenSteered 0 � � SystemEntropyInterruptTimingInformation f R DPFLTR_IHVBUS_ID � SmrGcActionStart ) � � AccessReasonAllowedParentAce � ProcessQuotaLimits � SidTypeUnknown 82 PerfInfoMemUsageMax � VrfDMARuleClass { ProcessorPowerPolicyAc , � SE_WS_APPX_SIGNATURE_ORIGIN_WINDOWS � . WinAccountCertAdminsSid ( �* DISPLAYCONFIG_PIXELFORMAT_32BPP ( �* DISPLAYCONFIG_PIXELFORMAT_24BPP # h2 FindStreamInfoMaxInfoLevel � SystemObsolete0 � ThreadCSwitchPmu ' � ( ProcessInstrumentationCallback � ThreadCSwitchMon ( � SystemTimeAdjustmentInformation % Width8Bits � MemoryEmptyWorkingSets � WinBuiltinUsersSid f m DPFLTR_IOSTRESS_ID x PsAttributeClientId ) � ; WinBuiltinAuthorizationAccessSid # � G SystemWatchdogTimerHandler � VrfAutoFailRuleClass ' � VrfAllocationFailuresRuleClass DynamicTickVetoNone �$ RtlDiskSpeedPolicyFast ) >' COPYFILE2_CALLBACK_POLL_CONTINUE ~# ProcessReservedValue1 ) � COMIMAGE_FLAGS_NATIVE_ENTRYPOINT �3 PROTOCOL_LOADED ) @ EventTraceSoftRestartInformation ! ProcessFontDisablePolicy ' � FileIdBothDirectoryRestartInfo ! UmsThreadPriority ] SysDbgSetAutoKdEnable $ � � SystemControlFlowTransition ! �' USER_MARSHAL_CB_MARSHALL $ 7& KeySetHandleTagsInformation $ m ObjectHandleFlagInformation � MicroChannel & ! SecureSettingValueTypeBoolean ! � ExceptionNestedException . �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_D_JPN � ThreadTimes f ' DPFLTR_SERIAL_ID � PsCreateSuccess ( � > SystemEmulationBasicInformation ~ FileBasicInformation f ] DPFLTR_VERIFIER_ID � = ReservedForDVRF61 � PCIBus * �+ SystemProcessClassificationSystem $ ResponseRetry � PowerSystemSleeping3 ! � ProcessDebugObjectHandle f n DPFLTR_HEAP_ID + �0 DynamicTickDisableReasonEmOverride ) DISPLAYCONFIG_COLOR_ENCODING_RGB ( � PlugPlayControlInitializeDevice ! I TP_LOG_LEVEL_TRACE_LEAVE > LocationTypeRegistry $ + CmResourceShareUndetermined $ ResponseCancel ( e) SystemMemoryPartitionMoveMemory DynamicTickVetoProcBusy f f DPFLTR_MM_ID 0 K AuditOpenObjectForDeleteWithTransaction ' � � 0 AccessReasonIntegrityLevel � PowerSystemWorking # � SystemTimeOfDayInformation
� CBus # � - ThreadSubsystemInformation K ProfileIcacheMisses u, PlatformRoleMobile ( ProcessPayloadRestrictionPolicy ' ProcessStrictHandleCheckPolicy 4 j JobObjectAssociateCompletionPortInformation $ � PerfInfoDebugEventContinued f _ DPFLTR_VDSBAS_ID $ �* PoSleepDisableReasonVhdBoot �' USER_MARSHAL_CB_FREE � TokenHasRestrictions - �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HDMI % �5
MemoryBasicInformationCapped { P PlatformIdleStates � : ReservedForDVRF58 �
TokenStatistics 6
ImagePolicyIdCapability �+ IMO_INJECTED % V+ RtlFeatureConfigurationCount f DPFLTR_LSERMOUS_ID , WMI_ENABLE_COLLECTION � ` ProcessEnableLogging 3 :3 DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED � ThreadDynamicCodePolicy 2 � CrossProcOperationMemoryProtectPostNotify �5 DriverType $ % PsWakeReasonInstrumentation & � 0 WinAccountEnterpriseAdminsSid � GEOCLASS_ALL �
MPIBus ! S PnpQueryRemovalRelations - ) VRF_TRIAGE_CONTEXT_FLIGHT_MONITORING 6 ImagePolicyIdCrashDump T6 SevereError { I ScreenOff & \ StorageReserveIdUpdateScratch . @ EventTraceProfileSourceAddInformation ! � IoSessionStateTerminated ~ FileNamesInformation " � SystemPageFileInformation = FpCompareEqual � ProcessBasePriority � PNP_VetoPendingClose � PsCreateFailExeName f � DPFLTR_POWER_ID f , DPFLTR_DCOMSS_ID + � # TokenRestrictedUserClaimAttributes ImageHeapPolicy & ) MonitorRequestReasonResumePdc f $ DPFLTR_NETAPI_ID * � MemoryCaptureAndResetAccessedBits & � : WinBuiltinPerfLoggingUsersSid { B PlatformInformation $ � P SystemMemoryListInformation # A EtwNotificationTypeSession �6 PT_TOUCH � ProcessHandleCount . @ EventTraceObjectTypeFilterInformation � TurboChannel ) ) / MonitorRequestReasonBuiltinPanel )$ MemoryNotResident S ���RelationAll � IMAGE_COR_MIH_EHRVA �" WdActionQueryState ' j JobObjectReserved12Information � ? ReservedForDVRF63 # ~ " FileNetworkOpenInformation / ) MonitorRequestReasonSystemStateEntered 0 0 EtwSessionNotificationSessionTerminated ! � COPYFILE2_PROGRESS_PAUSE ) P WorkerFactoryCallbackLongRunning � SidTypeUser ) e) SystemMemoryPartitionInformation " Q, TokenElevationTypeDefault 5 SystemPixelFormatR8G8B8 7 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_WIRED � GEO_ISO_UN_NUMBER ( � N SystemVerifierTriageInformation � MaxTraceSetInfoClass ' �7 MemSectionExtendedParameterMax � NtProductLanManNt ) n ProcThreadAttributeParentProcess �( RtlBsdItemAabTimeout ! � * ProcessWorkingSetWatchEx ( {# � DISPLAYCONFIG_SCALING_PREFERRED { SystemExecutionState � FileStandardInfo P! ProcessActivityTypeMax � FileIdInfo f DPFLTR_MOUCLASS_ID f DPFLTR_CLASSPNP_ID � ProcessImageFileName f 3 DPFLTR_SXS_ID � @ VrfRuleClassSizeMax � = WinBuiltinDCOMUsersSid , FilterBootOptionOperationSetElement � ) TokenProcessTrustLevel $ � WinBuiltinPrintOperatorsSid $ ResponseReturnToCaller ! v SERVERSILO_SHUTTING_DOWN _ IMDT_TOUCH " $ WorkerFactoryBindingCount # � - SystemLookasideInformation �+ OS_DEPLOYMENT_COMPACT ' �$ KeyValueFullInformationAlign64 ' � t SystemLowPriorityIoInformation f z DPFLTR_LUAFV_ID �# CustomDeviceEvent 0 n ProcThreadAttributeSecurityCapabilities f � DPFLTR_SSPICLI_ID # �, ImagePolicyEntryTypeUInt16 ' ProcessSystemCallDisablePolicy " � AlpcWaitForPortReferences � GEO_RFC1766 � IoPriorityHintNormal 0 � � SystemEnergyEstimationConfigInformation " � � ` AccessReasonEmptyDacl +7 XLAT_CLIENT / DISPLAYCONFIG_COLOR_ENCODING_INTENSITY - � ResourceManagerCompletionInformation & �& POINTER_CHANGE_FIRSTBUTTON_UP �# InvalidIDEvent ( j ) JobObjectServerSiloRunningState ) �& POINTER_CHANGE_SECONDBUTTON_DOWN + �
PsEnergyComponentTypeKeyboardInput " � 6 ProcessHandleCheckingMode ) @ EventTracePerformanceInformation f D DPFLTR_DMCONFIG_ID - � SE_WS_APPX_SIGNATURE_ORIGIN_APPSTORE j JobObjectSharedCommit � WinSelfSid � ManageHotPatchLoadPatch 2 � FeatureConfigurationOperationFeatureState J" SystemCrashDumpDisable $
ResponseContinue �9 KTMOBJECT_TRANSACTION f d DPFLTR_DFRGIFC_ID * � EtwCoverageSamplerPerfInformation ! � COPYFILE2_PROGRESS_QUIET . � � SystemSecureBootPolicyFullInformation ] SysDbgReadVirtual �9 DDC_DISABLE_RESIZE
ProcessImageLoadPolicy ; �
DISPLAYCONFIG_DEVICE_INFO_SET_ADVANCED_COLOR_STATE & j JobObjectReserved3Information � RPCHTTP_RS_INTERFACE f � DPFLTR_SE_ID f B DPFLTR_PCI_ID K
ProfileFpInstructions 9 @ EventTraceProcessorTraceConfigurationInformation � _ARM64_BARRIER_SY _* EtwStartLoggerCode ] LogExceptionEmpty ' �* COPYFILE2_PHASE_NAMEGRAFT_COPY ) � � AccessReasonMissingPrivilege ,$ DCDC_DEFAULT ! { W PowerInformationInternal , �0 DynamicTickDisableReasonNoHwSupport " F+ ShutdownRebootForRecovery FpCodeConvert 4 5: MemoryExhaustionTypeFailFastOnCommitFailure + 0 EtwSessionNotificationLogfileError & j ( JobObjectServerSiloInitialize �$ TokenPrimary % � $ ThreadHeterogeneousCpuPolicy 6 �$ ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_FORCE_UINT32 � ! ThreadIdealProcessorEx �
RpcAttemptedLbsMessages < � AlpcAdjustCompletionListConcurrencyCountInformation � ProcessTlsReplaceIndex / �$ ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_OTHER ( �5 MemoryMappedFilenameInformation ( � TraceSystemTraceEnableFlagsInfo & ~ 0 FileNormalizedNameInformation * � � SystemHypervisorDetailInformation { 2 WakeTimerList ! � U ProcessTelemetryCoverage * �+ SystemProcessClassificationNormal � ProcessWow64Information �3 PROTOCOL_NOT_LOADED $ � � SystemSecureBootInformation � OptionCancelTryContinue 8 n ProcThreadAttributeAllApplicationPackagesPolicy ; �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MAXVERSIONTESTED f h DPFLTR_WOW64_ID M WHServer " EtwBufferStatePlaceholder � GEO_LATITUDE * �$ KeyValuePartialInformationAlign64 ' � VrfDeadlockPreventionRuleClass � PsProtectedSignerMax . �: RtlMitigationOptionStateNotConfigured % EtwBufferStateGeneralLogging 6 � DISPLAYCONFIG_DEVICE_INFO_GET_SDR_WHITE_LEVEL � ; ReservedForDVRF59 >' COPYFILE2_CALLBACK_NONE ( � � SystemDmaGuardPolicyInformation ) �* DISPLAYCONFIG_PIXELFORMAT_NONGDI % MaximumDmaWidth " � � SystemBootLogoInformation ! { SystemPowerPolicyCurrent � ThreadPagePriority _ IMDT_MOUSE � 4 ProcessMitigationPolicy { ProcessorStateHandler ' � VrfBelow4GBAllocationRuleClass ( � � AccessReasonDeniedParentAce " �, ImagePolicyEntryTypeInt16 � JournalBeginTransaction & / SystemFirmwareTable_Enumerate f v DPFLTR_WDT_ID � * ReservedForDVRF42 # j JobObjectCompletionCounter v LdrModulesSnapped �; SeLearningModeMax �; PowerUserNotPresent . j JobObjectNotificationLimitInformation # � RpcBackEndConnectionFailed " �
SystemCallTimeInformation M SmallBusiness # � IoSessionStateDisconnected 6 ImagePolicyIdScenarioId * ) MonitorRequestReasonNearProximity 0 �7 SystemActivityModerationAppTypePackaged � DEPPolicyAlwaysOff v LdrModulesSnapping 2 � < WinBuiltinTerminalServerLicenseServersSid � MaximumInterfaceType % � PsProtectedSignerAntimalware M � SYSTEM_HANDLE_INVALID # � PlugPlayControlResetDevice / �7 SystemActivityModerationAppTypeClassic * � TracePeriodicCaptureStateListInfo + �+ SystemProcessClassificationMaximum " � + WinAccountDomainGuestsSid - �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HD15 5 �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION f Y DPFLTR_STORPORT_ID � ManageHotPatchMax ! � & VrfInfoDisclosureIRPRule f * DPFLTR_RPCPROXY_ID 5 �$
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EMBEDDED % �- PoHiberForceDisableReasonMax � TraceGroupQueryList , WMI_SET_SINGLE_ITEM K< MaxJournalInformation F+ ShutdownPowerOff 1 _ EDIT_CONTROL_FEATURE_PASTE_NOTIFICATIONS w PowerActionReserved # j % JobObjectSiloRootDirectory K ProfileDcacheAccesses ' j ' JobObjectReserved17Information � KHeteroCpuPolicyDefault �! VmOfferPriorityVeryLow Q0 PerfInfoMMStatNotUsed ) � C ProcessAllowedCpuSetsInformation � PowerDeviceUnspecified � LockQueueMaximumLock � PowerDeviceD0 � FpFormatU64 " ~ FilePipeRemoteInformation ' �* DISPLAYCONFIG_PIXELFORMAT_8BPP . CacheUnified �! PowerStateShutdownReset . �* PoSleepDisableReasonPortableWorkspace � LockQueueVacbLock { F SetShutdownSelectedTime + � � SystemProcessorIdleMaskInformation � ThreadHideFromDebugger " d% PdataPackedUnwindFragment ImageChildProcessPolicy ( � # SystemKernelDebuggerInformation # WdInfoState x PsAttributeToken 5 �7 MemSectionExtendedParameterUserPhysicalFlags & % PsWakeReasonActivityReference � ToleranceIntervalLong % � l WinCapabilityAppointmentsSid � ThreadGroupInformation & � RtlPhysicalMemoryPolicyNormal ~ FileStreamInformation { V BatteryDeviceState M SYSTEM_HANDLE_TOKEN - � 0 ThreadManageWritesToExecutableMemory �# IMPORT_OBJECT_CODE ! I TP_LOG_LEVEL_TRACE_ENTER 1 N SharedVirtualDiskHandleStateHandleShared � ProcessTlsReplaceVector �; PowerUserInvalid K ProfileTotalCycles ( ) MonitorRequestReasonSleepButton v LdrModulesPlaceHolder K Profile3Issue f � DPFLTR_ENDOFTABLE_ID { R PlatformIdleVeto $ � FileStorageTierMediaTypeScm f q DPFLTR_MMCSS_ID " � < SystemNumaAvailableMemory ! { Z PhysicalPowerButtonPress f K DPFLTR_SR_ID 1 � _ ProcessCombineSecurityDomainsInformation % f � DPFLTR_STORAGECLASSMEMORY_ID 8 � PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS * � � COMIMAGE_FLAGS_TRACKDEBUGDATA 6 ) + MonitorRequestReasonPdcSignalHolographicShell �# SeImageSignatureNone ! UmsThreadUserContext � TokenIsAppContainer $ �5 MemoryWorkingSetInformation $ �# SeImageSignatureCatalogHint & ) MonitorRequestReasonUserInput v SERVERSILO_STARTED + j JobObjectCpuRateControlInformation & �5 MemoryWorkingSetExInformation 8 PdataCrUnchained � MemoryPurgeStandbyList S RelationNumaNode 1 j JobObjectBasicAndIoAccountingInformation f u DPFLTR_EMS_ID + @
EventTracePoolTagFilterInformation % #1 PoDisabledStateSleeping0Idle � ThreadPriority ! A EtwNotificationTypeAudio j * JobObjectIoAttribution & � EnlistmentRecoveryInformation m MaxObjectInfoClass ! � CsvControlDisableCaching { J CsDeviceNotification 1 � � SystemCodeIntegrityUnlockModeInformation x PsAttributeUmsThread � _ARM64_BARRIER_NSH # � � SystemPoolLimitInformation ' j JobObjectReserved11Information 1 � � AccessReasonNotGrantedToAppContainer � PCMCIABus ! � * WinAccountDomainUsersSid FpCodeDivide ( � ThreadQuerySetWin32StartAddress . �' ActivationContextManifestResourceName " ~ FileAllocationInformation ( � ThreadEnableAlignmentFaultFixup � ProcessWx86Information � WinNetworkServiceSid ) � b SystemSystemPartitionInformation 9 ) 1 MonitorRequestReasonBatteryCountChangeSuppressed ' V+ RtlFeatureConfigurationRuntime ' E RTL_RESOURCE_POLICY_FLAGS_NONE ' �& POINTER_CHANGE_FOURTHBUTTON_UP FirmwareTypeUefi " BootEntropySourceAcpiOem0 � DEPPolicyAlwaysOn M SYSTEM_HANDLE_MAX ( ], FileMetadataOptimizationPending M EmbeddedRestricted % .# ��ConfigurationSpaceUndefined w PowerActionShutdown & �# SeImageSignatureCatalogCached ( A EtwNotificationTypeLegacyEnable S* NormalizationC ! �5 Win32ServiceShareProcess FpCodeFabs { D MonitorInvocation
FpCodeAcos % � RpcBackEndConnectionAttempts $ { ProcessorPowerPolicyCurrent & j JobObjectReserved4Information � LockQueueUnusedSpare2 ) ImageExtensionPointDisablePolicy ! �$ KeyValueBasicInformation ) � , SystemCurrentTimeZoneInformation M EmbeddedNT �* SynchronizationEvent & �? ��DPI_HOSTING_BEHAVIOR_INVALID ImageDynamicCodePolicy + � j WinLocalAccountAndAdministratorSid D- FindExInfoStandard 3 � DISPLAYCONFIG_DEVICE_INFO_GET_ADAPTER_NAME � PerfInfoMemResetMax ' �6 FixedWakeSourceDozeToHibernate { ? SessionPowerCleanup : LT_LOWEST_LATENCY � OptionShutdownSystem $ j JobObjectBasicProcessIdList " � IoSessionStateInitialized � KHeteroCpuPolicyMax ~ FilePipeInformation f + DPFLTR_AUTOCHK_ID f DPFLTR_MOUHID_ID % � IrqPolicySpecifiedProcessors f DPFLTR_SMSS_ID 1 � � SystemDifApplyPluginVerificationOnDriver ) j JobObjectEndOfJobTimeInformation % ) MonitorRequestReasonFullWake K Profile4Issue � * TokenPrivateNameSpace � RPCHTTP_RS_ACCESS_1 , .@ DISPLAYCONFIG_MODE_INFO_TYPE_TARGET # FpCodeY1 ! � 8 ProcessRevokeFileHandles % � ProcessLUIDDeviceMapsEnabled ! �$
RtlDiskSpeedPolicyNormal �; PowerUserMaximum - @ EventTraceCoverageSamplerInformation �@ KernelRequester
PoDc { SystemPowerPolicyDc � _ARM64_BARRIER_ISHLD 6 ImagePolicyIdMaximum + � e SystemNumaProximityNodeInformation �( RtlBsdItemBootGood %( DisableLoad ! x
PsAttributeStdHandleInfo �@ AR_NOSENSOR & � PoCsDeviceNotificationMaximum � MaxEventInfo 4 � PS_MITIGATION_OPTION_CET_USER_SHADOW_STACKS K AuditObjectReference H TypeF �(
RtlBsdItemErrorInfo ! � m WinCapabilityContactsSid # WdInfoTriggerReset ( Z/ CI_WINDOWS_LOCKDOWN_MODE_LOCKED � AlpcBasicInformation # � TraceProfileSourceListInfo ProcessDEPPolicy K ProfileIcacheIssues 1 ) , MonitorRequestReasonPdcSignalFingerprint �
FileRemoteProtocolInfo 9 � PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY " �, POINTER_DEVICE_TYPE_TOUCH + ) ! MonitorRequestReasonUserInputTouch 0 ) 2 MonitorRequestReasonResumeModernStandby 5 �
CsvControlEnableUSNRangeModificationTracking � LockQueueBcbLock � WinRestrictedCodeSid % � @ WinBuiltinCryptoOperatorsSid ; PerfCSwapIdle ) 9$ DISPLAYCONFIG_ROTATION_ROTATE270 $ � CsvControlStartRedirectFile ! �$ KeyValueLayerInformation 3 � ^ SystemImageFileExecutionOptionsInformation 4 ) MonitorRequestReasonSetThreadExecutionState { 4 ProcessorIdleStatesHv � , WinAccountComputersSid $ � KHeteroCpuPolicyBiasedSmall � ) VrfAccessModeMismatch ImageDepPolicy $ 82 PerfInfoMemUsagePfnMetadata �6 PT_POINTER ! UmsThreadIsTerminated 0 p WOW64_FUNCTION_CPU_CFG_DISPATCH_CONTROL %( AutoLoad � TokenAppContainerNumber ~# ProcessLeapSecondInfo ) E FeatureConfigurationPriorityTest ) � ProcessEnableAlignmentFaultFixup �( RtlBsdItemMax + P MemExtendedParameterAttributeFlags ( �- PoHiberForceDisableReasonPolicy � . ReservedForDVRF46
PoAc K
ProfileCacheMisses " � MarshalDirectionUnmarshal ^" FpRoundChopped f DPFLTR_CDROM_ID 7& KeySetDebugInformation " � ) WinAccountDomainAdminsSid � GEO_LONGITUDE / �7 MemSectionExtendedParameterInvalidType � ExceptionCollidedUnwind � TraceInfoReserved15 � # VrfXDVPlatformMode % { ` PowerInformationLevelMaximum � WinTerminalServerSid � MaxPlugPlayControl �" FEEDBACK_PEN_TAP �6 PT_PEN . �; PerfInfoDomainChangeEventEnterSyscall . � PlugPlayControlDeviceClassAssociation / ~ 8 FileRenameInformationBypassAccessCheck , � & SystemExtendServiceTableInformation & � ~ SystemBootGraphicsInformation K ProfileAlignmentFixup #) AtomTableInformation & � @ ProcessTelemetryIdInformation �
InternalPowerBus x PsAttributeTebAddress �" WdActionSleep � FileRenameInfo f DPFLTR_CRASHDUMP_ID .# PCMCIAConfiguration F> MemoryLocationResident $ � KHeteroCpuPolicyBiasedLarge 2 � � SystemFeatureUsageSubscriptionInformation & �5 MemoryEnclaveImageInformation �" WdActionResetTimer v LdrModulesMapped � SystemLocksInformation � SecurityImpersonation O2 ShrinkPrepare . � T SystemVerifierCancellationInformation f DPFLTR_KBDHID_ID �# DeviceArrivalEvent $ � 8 SystemPrefetcherInformation / � d SystemProcessorPerformanceDistribution � PowerDeviceD1 w PowerActionShutdownOff & �' LoadReasonDelayloadDependency .# PCIConfiguration K Profile2Issue f G DPFLTR_VSS_ID " � _ SystemCoverageInformation { ^ UpdateBlackBoxRecorder 1 �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_DISABLE I TP_LOG_LEVEL_ERROR - �, CI_WINDOWS_LOCKDOWN_RESTRICTION_NONE f DPFLTR_DMSYNTH_ID �) TimerWakeSourceType � PowerSystemShutdown M
Blade f DPFLTR_SERMOUSE_ID ) M SYSTEM_HANDLE_COMPOSITION_OBJECT � VrfIORuleClass * � R WinThisOrganizationCertificateSid f " DPFLTR_SAMSS_ID % WidthNoWrap ! � TP_CALLBACK_PRIORITY_LOW � MAX_PACKAGE_NAME # � PsEnergyComponentTypeInput ! � , ThreadWorkOnBehalfTicket , � EtwCoverageSamplerStatusInformation 6 :3 ��DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 m ObjectNameInformation ! �% CmExtendedParameterEvent 1 TransactionSuperiorEnlistmentInformation �3 PROTOCOL_ADDRESS_CHANGE %( SystemLoad 3 ) # MonitorRequestReasonUserInputAccelerometer & �$ RtlDiskSpacePolicyBelowNormal � SystemDeviceInformation � NtProductServer � PNP_VetoWindowsService u, PlatformRoleDesktop $ �! PowerStateSleeping4Firmware �. WnfWellKnownStateName < � DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_PREFERRED_MODE u, PlatformRoleSlate � 6 ReservedForDVRF54 �$ GenericLessThan f y DPFLTR_NVCTRACE_ID �! TransactionStateIndoubt " � � SystemKernelDebuggerFlags ~
FileRenameInformation v SERVERSILO_INITING \ StorageReserveIdSoft " � VrfDriverLoggingRuleClass � ' WinAccountGuestSid ! )$ MemoryContiguityStateMax ) � r WinAccountEnterpriseKeyAdminsSid v LdrModulesReadyToInit # DynamicTickVetoNoDeepSleep # �9 KTMOBJECT_RESOURCE_MANAGER � RpcOutgoingBandwidth f C DPFLTR_DMIO_ID + �= POINTER_DEVICE_CURSOR_TYPE_UNKNOWN ( n ProcThreadAttributeWin32kFilter ) jC MaxSystemActivityModerationState & � + ThreadExplicitCaseSensitivity * n ProcThreadAttributeIdealProcessor ! x PsAttributeSecureProcess FpCodeCompare � TokenOrigin � COR_VERSION_MINOR EtwBufferStateFree $ WorkerFactoryPaused ) MonitorRequestReasonPnP + � IoSessionStateDisconnectedLoggedOn SmrGcMethodRotation $ � RtlSparseBitmapOperationSet 6 � � SystemPortableWorkspaceEfiLauncherInformation $ � & TokenRestrictedDeviceGroups , �( RtlBsdItemFeatureConfigurationState � VrfSecurityRuleClass ( j JobObjectMemoryUsageInformation -D PortDumpInformation c3 FindExSearchMaxSearchOp SmrGcMethodCompaction ! f F DPFLTR_WSOCKTRANSPORT_ID ! EtwBufferStateCompressed ) n ProcThreadAttributePreferredNode 6 ImagePolicyIdParentSd POINTER_FEEDBACK_NONE ] SysDbgGetKdBlockEnable 8 PdataCrChainedWithPac M DataCenter `D PROXY_UNMARSHAL 7& KeySetLayerInformation f P DPFLTR_IHVNETWORK_ID . DISPLAYCONFIG_COLOR_ENCODING_YCBCR420 5 � CrossProcOperationInstructionCacheFlushHeavy f � DPFLTR_FLTREGRESS_ID # DirectoryNotifyInformation ! � RpcAttemptedLbsDecisions ; PerfCSwapIdleShort ~ D FileStatInformation T NotificationTimer � _ARM64_BARRIER_OSHLD � \ ProcessSequenceNumber f DPFLTR_SETUP_ID % { PowerInformationLevelUnused0 �( RtlBsdItemVersionNumber � SystemHandleInformation � RpcLastCounter # � EnlistmentBasicInformation + � � SystemFirmwarePartitionInformation �5 RecognizerType ( � j SystemVirtualAddressInformation * � d WinAccountCloneableControllersSid & � TracePeriodicCaptureStateInfo � VrfSpecialPoolRuleClass �# PsRequestDuplicate ( � PlugPlayControlDeregisterDevice � PNP_VetoWindowsApp ( � 5 SystemSessionProcessInformation �# IMPORT_OBJECT_CONST � FpFormatFp80 9 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_VIRTUAL ' ~ ' FileValidDataLengthInformation 0 � S SystemProcessorIdleCycleTimeInformation � RtlResTypeDiskSpeedTier { SystemBatteryState $ + FileFsFullSizeInformationEx " "E AlpcMessageSidInformation � CsvControlQueryMdsPath # � Y SystemErrorPortInformation f" HeapExtendedInformation �$ GenericEqual % ~ @ FileDispositionInformationEx �& LdrpNoDevice $ � M ProcessPowerThrottlingState 6 � K SystemRegisterFirmwareTableInformationHandler � / ProcessGroupInformation " � ThreadAbsoluteCpuPriority $ � SystemFullMemoryInformation K AuditAccessCheck S* NormalizationD ( �/ DPI_AWARENESS_PER_MONITOR_AWARE ~ FileObjectIdInformation , �0 DynamicTickDisableReasonBcdOverride ! �" WdActionSetTriggerAction 3 .@ ��DISPLAYCONFIG_MODE_INFO_TYPE_FORCE_UINT32 { SystemPowerPolicyAc � ProcessIoCounters S RelationCache � VrfStateSepRuleClass * � PS_MITIGATION_OPTION_FONT_DISABLE . � S ProcessManageWritesToExecutableMemory " $# CsvFsDiskConnectivityNone + �# QUERY_FILE_LAYOUT_FILTER_TYPE_NONE FpCodeFmod 5 @ EventTraceProcessorTraceEventListInformation ) ) VRF_TRIAGE_CONTEXT_CERTIFICATION � TraceGuidQueryProcess ! �# SeImageSignatureEmbedded ( �& POINTER_CHANGE_FIFTHBUTTON_DOWN 1 � PlugPlayControlGetDeviceInterfaceEnabled m VERIFIER_MODE_TRIAGE 0 � AlpcUnregisterCompletionListInformation F> MemoryLocationInvalid & ~ + FileIoPriorityHintInformation 0 � � SystemWorkloadAllowedCpuSetsInformation $ �E PowerRequestDisplayRequired ( �& POINTER_CHANGE_THIRDBUTTON_DOWN & 6 ImagePolicyIdCrashDumpKeyGuid & $
WorkerFactoryStackInformation �@ AR_REMOTESESSION # �? DPI_HOSTING_BEHAVIOR_MIXED ) � SystemUnloadGdiDriverInformation . DISPLAYCONFIG_COLOR_ENCODING_YCBCR444 %( DemandLoad % ~ FileBothDirectoryInformation " POINTER_FEEDBACK_INDIRECT 9 �# QUERY_FILE_LAYOUT_FILTER_TYPE_STORAGE_RESERVE_ID ' � L SystemFirmwareTableInformation f E DPFLTR_DMADMIN_ID * >' COPYFILE2_CALLBACK_CHUNK_FINISHED EtwBufferStateFlush & � 2 WinAccountRasAndIasServersSid � TokenDefaultDacl � FileIoPriorityHintInfo & ~ 7 FileRemoteProtocolInformation / � o WinBuiltinDefaultSystemManagedGroupSid c3 FindExSearchNameMatch 0 � � SystemProcessorPerformanceInformationEx �
_ARM64_BARRIER_ISHST + Q0 PerfInfoMMStatIterationPageCombine * j JobObjectIoRateControlInformation m VERIFIER_MODE_UNUSED ~# ProcessInPrivateInfo � < ReservedForDVRF60 _* EtwUpdateLoggerCode & �' MaxActivationContextInfoClass ( � FileStorageTierClassPerformance � ? WinIUserSid w PowerActionDisplayOff / � SharedVirtualDiskCDPSnapshotsSupported % � ; ProcessCheckStackExtentsMode - @ EventTraceSessionSecurityInformation �D TP_DEBUG_CLASS_POOL �$ TokenImpersonation �' ExtendedFileIdType + FileFsDeviceInformation . � � SystemSecureDumpEncryptionInformation � FileAttributeTagInfo $ � � SystemPageFileInformationEx { Q ProcessorIdleVeto � ( TokenIsRestricted � RpcCurrentUniqueUser � KCONTINUE_LONGJUMP K ProfilePipelineDry # A EtwNotificationTypeNoReply # WdInfoStartTimer � > ProcessMemoryExhaustion " � COMIMAGE_FLAGS_IL_LIBRARY �( MandatoryLevelMedium K AuditHandleCreation / FilterBootOptionOperationDeleteElement " j JobObjectGroupInformation ' � � SystemMemoryChannelInformation x PsAttributeErrorMode / � SE_VALIDATE_MAPPING_ENTIRE_IMAGE_CLEAN � ComputerNameNetBIOS KeyLayerInformation . � � SystemEnclaveLaunchControlInformation FpCodeAsin � TokenElevationType 0 P MemExtendedParameterAddressRequirements ' � % SystemRegistryQuotaInformation +7 XLAT_SERVER � Internal " � ManageHotPatchUnloadPatch �( RtlBsdSleepInProgress & ProcessControlFlowGuardPolicy , � PlugPlayControlQueryDeviceRelations �@ AR_DISABLED � FpFormatU16 � LockQueueUnusedSpare3 � 6 WinThisOrganizationSid % x PsAttributeMitigationOptions � WinNullSid % G IoCompletionBasicInformation & � � SystemBootMetadataInformation , � _ WinBuiltinRDSRemoteAccessServersSid � 0 ReservedForDVRF48 # � n SystemRegistryAppendString � GEO_ISO3 Q ToleranceHigh � ProcessDebugPort ] UmsSchedulerThreadYield , NG 2 RtlDiskWriteConstraintPolicyLimited ! � p SystemVhdBootInformation M
SYSTEM_HANDLE_SOCKET $ \@ EtwCompressionModeNoDisable
ImageSehopPolicy �$ NotAppContainerSidType bG HAL_MCA_RECORD .# NuBusConfiguration & �&
POINTER_CHANGE_FIFTHBUTTON_UP : � PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES _ IMDT_TOUCHPAD ) �, POINTER_DEVICE_TYPE_EXTERNAL_PEN ! ] SysDbgGetPrintBufferSize # �: RtlMitigationOptionStateOn - ) MonitorRequestReasonAcDcDisplayBurst + P TransactionManagerBasicInformation ) ) $ MonitorRequestReasonUserInputHid / @
EventTraceProfileSourceListInformation ( �G ServiceDirectoryPersistentState ~ FileEaInformation _ IMDT_KEYBOARD f s DPFLTR_THREADORDER_ID { " ProcessorCap " �5 MemoryRegionInformationEx K WnfDataScopeProcess $ ResponseAbort FpCodeSinh & �
VrfMDLInvariantStackRuleClass & j JobObjectReserved8Information � KHeteroCpuPolicySmall { < IdleResiliency � FileDispositionInfo � ThreadCounterProfiling v ��LdrModulesMerged ) � [ WinCapabilityDocumentsLibrarySid " � q SystemCpuQuotaInformation FpCodePow { Y SystemHiberFileType b) IoSessionEventCreated - �; PerfInfoDomainChangeEventUserRestore ' { _ SessionAllowExternalDmaDevices S* NormalizationKD # WdInfoNop $ + FileFsDriverPathInformation FpCodeRemainder - e) SystemMemoryPartitionNodeInformation � ProcessExceptionPort ( � ` WinBuiltinRDSEndpointServersSid 5 @ EventTraceLastBranchConfigurationInformation % { : PowerSettingNotificationName * �, ImagePolicyEntryTypeUnicodeString ' � � SystemManufacturingInformation 8 PdataCrUnchainedSavedLr . ) MonitorRequestReasonUserInputKeyboard b) IoSessionEventMax { @ SessionLockState , WMI_EXECUTE_METHOD # � " TokenDeviceClaimAttributes EventSecurityAddSACL C# PowerMonitorOff % ] SysDbgSetKdUmExceptionEnable ) VRF_TRIAGE_CONTEXT_NONE ' ) MonitorRequestReasonSystemIdle ) n ProcThreadAttributePseudoConsole 2 � k SystemLogicalProcessorAndGroupInformation f � DPFLTR_MSDSM_ID 7 � PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD D- FindExInfoBasic ~ FileQuotaInformation % � = ProcessProtectionInformation , j " JobObjectLimitViolationInformation2 ! ~ FileEndOfFileInformation + >' COPYFILE2_CALLBACK_STREAM_FINISHED �% CmExtendedParameterMax / ~ I FileLinkInformationExBypassAccessCheck & �$ RtlRXactOperationDelAttribute K
AuditOpenNonObject - i ��DISPLAYCONFIG_TOPOLOGY_FORCE_UINT32 " � VrfMoreDebuggingRuleClass 1 �I MidlWinrtTypeSerializationInfoVersionOne , E FeatureConfigurationPriorityService �( MandatoryLevelHigh � _ARM64_BARRIER_ISH " � ThreadInformationClassMax ( � � SystemAllowedCpuSetsInformation ! � ' SystemPrioritySeperation % { TraceApplicationPowerMessage 4 � ! PS_MITIGATION_OPTION_BLOCK_NON_CET_BINARIES . n ProcThreadAttributeChildProcessPolicy % PsWakeReasonUser ' j , JobObjectReserved22Information KeyCachedInformation + { E FirmwareTableInformationRegistered � SidTypeLogonSession { & ProcessorLoad �B SC_ACTION_OWN_RESTART # = MmEtwWorkingSetTypeMaximum ' ~ < FileIdExtdDirectoryInformation �5 MemoryBasicInformation 5 SystemPixelFormatB8G8R8 ( � � SystemPhysicalMemoryInformation � ThreadUmsInformation > � � SystemHardwareSecurityTestInterfaceResultsInformation
.# Cmos ( � W ProcessEnableReadWriteVmLogging $ �' USER_MARSHAL_CB_BUFFER_SIZE �! VmOfferPriorityLow F+ ShutdownNoReboot � FpFormatFp128 . e) SystemMemoryPartitionCreateLargePages � MaxThreadWorkloadClass FpCodeHypot ! UmsThreadMaxInfoClass K WnfDataScopeSession + ) MonitorRequestReasonUserInputMouse + j JobObjectNetRateControlInformation �
ThreadIdealProcessor ( � [ ProcessSystemResourceManagement � > WinBuiltinIUsersSid � RtlResTypeDiskSpaceTier $ � E ProcessJobMemoryInformation ) @ EventTracePebsTracingInformation - � $ TokenRestrictedDeviceClaimAttributes �
PNP_VetoAlreadyRemoved - � PsEnergyComponentTypeDisplayRequired S* NormalizationKC # B' DfsLinkTrackingInformation # �6 FixedWakeSourceSleepButton f x DPFLTR_NDIS_ID % � RtlResTypePhysicalMemoryTier $ � TP_CALLBACK_PRIORITY_NORMAL . � � SystemHypervisorSharedPageInformation � ThreadSwitchLegacyState �/ ��DPI_AWARENESS_INVALID # { > SessionConnectNotification ) ~ = FileReplaceCompletionInformation �@ AR_ENABLED $ �" FEEDBACK_TOUCH_PRESSANDHOLD �* NotificationEvent " � SmrGcStateActiveFullSpeed K AuditOpenObject � WinNetworkSid � WinBuiltinGuestsSid <% IDL_CS_NO_CONVERT ( � � SystemPlatformBinaryInformation ) e) SystemMemoryPartitionAddPagefile H MaximumDmaSpeed , j JobObjectBasicAccountingInformation ) � SE_VALIDATE_MAPPING_ENTIRE_IMAGE ! � � P AccessReasonNullDacl , 0 EtwSessionNotificationRealtimeError % � ) ProcessThreadStackAllocation ) TransactionPropertiesInformation f ( DPFLTR_SERENUM_ID % � FileStorageTierClassCapacity � TokenPrimaryGroup % � WinBuiltinSystemOperatorsSid f X DPFLTR_SHPC_ID * � VrfForcePendingIORequestRuleClass � OptionYesNo �! PowerStateSleeping4 �) EtwRtEventLossMax + ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE #1 PoDisabledStateMaximum � VMEBus 5 � PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL � WinAuthenticatedUserSid ! ,$ DCDC_DISABLE_FONT_UPDATE # �" WdActionQueryTriggerAction ' � * SystemProcessorIdleInformation # K ProfileSpecialInstructions f : DPFLTR_PCIIDE_ID v LdrModulesMapping = � PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION � WinCreatorGroupSid f 1 DPFLTR_BURNENG_ID ) PsProtectedTypeNone � JournalSetLastWriteTime " � 1 WinAccountPolicyAdminsSid u, PlatformRoleUnspecified � & ProcessCycleTime ' FeatureEnabledStateOptionsNone � Isa ( �! TransactionStateCommittedNotify f 5 DPFLTR_IDLETASK_ID $ � N ProcessReserved3Information KeyNameInformation � IrqPriorityNormal % � r SystemNativeBasicInformation $ � WinEnterpriseControllersSid ) �5 MemoryPrivilegedBasicInformation � ExceptionContinueSearch �
FileIdBothDirectoryInfo � ' ProcessPagePriority � IoPriorityHintLow � SystemBasicInformation � MutantOwnerInformation + � P ProcessDisableSystemAllowedCpuSets K AuditCloseNonObject 0 � ��DISPLAYCONFIG_DEVICE_INFO_FORCE_UINT32 ' �& POINTER_CHANGE_SECONDBUTTON_UP �" HiberFileBucket16GB � FileAllocationInfo p WOW64_FUNCTION_NOP % � � SystemShadowStackInformation { ProcessorPowerPolicyDc � JournalSetKeyUserFlags ' ACTCTX_RUN_LEVEL_REQUIRE_ADMIN ) � � SystemDifSetRuleClassInformation ) � � SystemActivityModerationExeState 3 � IrqPolicySpreadMessagesAcrossAllProcessors # ~ , FileSfioReserveInformation 3 E TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE ( � AlpcRegisterCallbackInformation % � PsEnergyComponentTypeNetwork $ ImageControlFlowGuardPolicy 2 �
PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE <% IDL_CS_IN_PLACE_CONVERT , � h WinAuthenticationServiceAssertedSid ) �" FEEDBACK_PEN_BARRELVISUALIZATION �# BlockedDriverEvent ' s TransactionOutcomeUndetermined \ StorageReserveIdNone M SingleUserTS { 8 LogicalProcessorIdling ! � 1 SystemSessionInformation ] SysDbgGetAutoKdEnable S PnpQueryPowerRelations ! KeyHandleTagsInformation 8 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPOSITE_VIDEO _* EtwFlushLoggerCode ) $# CsvFsDiskConnectivityMdsNodeOnly ! �( RtlBsdItemShutdownBootId 0 ~ ) FileIoCompletionNotificationInformation # ~
FileDispositionInformation " �; SeLearningModeInvalidType 7 p WOW64_FUNCTION_CPU_OPTIMIZE_CHPE_IMPORT_THUNKS � TraceDisallowListQuery ! � SystemPoolTagInformation DynamicTickVetoMax ] SysDbgSetKdBlockEnable ) 3 MonitorRequestReasonMax f p DPFLTR_USERGDI_ID � VrfForceIrqlRuleClass $ ) MonitorRequestReasonUnknown D- FindExInfoMaxInfoLevel 0 � � SystemRegistryReconciliationInformation , � EtwCoverageSamplerCreateInformation " � PNP_VetoInsufficientPower ' � MaxEtwCoverageSamplerInfoClass ( � = SystemProcessorPowerInformation m VERIFIER_MODE_LOGO FpCodeRound { SystemPowerInformation ' � g SystemCodeIntegrityInformation ] & SysDbgKdPullRemoteFile , � J WinEnterpriseReadonlyControllersSid * 0 JOB_OBJECT_IO_RATE_CONTROL_ENABLE �( MandatoryLevelSystem )$ MemoryNotContiguous �. WnfPersistentStateName ) � v WinAuthenticationFreshKeyAuthSid & � Y WinCapabilityVideosLibrarySid 2 � � SystemHypervisorProcessorCountInformation ] SysDbgReadBusData � IrqPriorityHigh % Width64Bits � TraceMaxPmcCounterQuery { H PlmPowerRequestCreate $ � UmsInformationCommandAttach # ~# ProcessProtectionLevelInfo f l DPFLTR_KTM_ID ! �5 SC_EVENT_PROPERTY_CHANGE $ ResponseIgnore % � ! WinBuiltinBackupOperatorsSid " � LockQueueNonPagedPoolLock # + FileFsAttributeInformation ( � PsEnergyComponentTypeMouseInput ' j - JobObjectReserved23Information 0 x PsAttributeAllApplicationPackagesPolicy � _ARM64_BARRIER_NSHST �$ KeyRemoved ] # SysDbgGetUmAttachPid $ ] SysDbgQueryTraceInformation 4 ) ' MonitorRequestReasonUserInputInitialization - � � SystemProcessorCycleStatsInformation �
PlugPlayControlProperty ' + CmResourceShareDeviceExclusive C# PowerMonitorOn $ $ WorkerFactoryTimeoutWaiters ' zE ReadDirectoryNotifyInformation � GEO_OFFICIALLANGUAGES ] SysDbgWriteMsr $ � CsvControlQueryFileRevision / SystemFirmwareTable_Get � RPCHTTP_RS_REDIRECT ' k* ServiceRegistryStatePersistent { ) SessionPowerInit x PsAttributeMax ' @ EventTraceGroupMaskInformation f DPFLTR_CONFIG_ID , � PlugPlayControlQueryAndRemoveDevice � ' VrfLwSpecialPool f
DPFLTR_REDBOOK_ID �; SeLearningModeSettings � Y ProcessImageSection x PsAttributeImageName % Z/ CI_WINDOWS_LOCKDOWN_MODE_MAX + FileFsSizeInformation ' � VrfMDLInvariantDriverRuleClass & 1 SymbolicLinkGlobalInformation f DPFLTR_WMILIB_ID � PNP_VetoLegacyDriver � � SystemCpuSetInformation " �, ImagePolicyEntryTypeInt32 f DPFLTR_TWOTRACK_ID ) @ EventTraceHeapTracingInformation ] UmsSchedulerStartup x PsAttributeBnoIsolation - �
AlpcCompletionListRundownInformation .#
PNPISAConfiguration { = SessionRITState , WMI_ENABLE_EVENTS v ��LdrModulesSnapError � - TokenChildProcessFlags ' j JobObjectBasicLimitInformation 3 � u WinAuthenticationKeyPropertyAttestationSid � KHeteroCpuPolicyDynamic � T WinBuiltinAnyPackageSid ( u InternalWakeSourceTimerOverride % { VerifyProcessorPowerPolicyAc ! � RtlPathTypeDriveRelative �
ProcessIoPortHandlers 4 :3 DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED � " ProcessExecuteFlags & ~ > FileHardLinkFullIdInformation " ] UmsSchedulerThreadBlocked ! b) IoSessionEventTerminated x PsAttributeWin32kFilter � � p AccessReasonNoSD % � PsEnergyComponentTypeStorage � TokenUIAccess # �* PoSleepDisableReasonPolicy # �@ UserSharedServiceRequester % � s WinAuthenticationKeyTrustSid " d% PdataPackedUnwindFunction U WaitAll
FpCodeTruncate �$ KeyModified # WdInfoStopTimer ' j JobObjectReserved13Information ( � PlugPlayControlGetRelatedDevice & DynamicTickVetoClockOutOfSync � ProcessUserModeIOPL ( � } SystemSessionBigPoolInformation � PerfInfoDebugEventMax �@ AR_SUPPRESSED BootEntropySourceUefi � JournalCreateKey & � ( ThreadSystemThreadInformation - �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS > � PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE # )$ MemoryAlignedAndContiguous + ~ C FileDesiredStorageClassInformation f i DPFLTR_ALPC_ID " N SemaphoreBasicInformation - ) MonitorRequestReasonUserDisplayBurst " ~ FileCompletionInformation �@ @ AR_DOCKED > LocationTypeMaximum � GEO_DIALINGCODE � 2 ThreadWorkloadClass BootEntropySourceTcbTpm ( � " SystemCrashDumpStateInformation � ThreadIoPriority �$ RtlRXactOperationDelete FpCodeSubtract �6 PT_TOUCHPAD # K< JournalAbsoluteInformation { # SystemWakeSource K ProfilePipelineFrozen �. WnfPermanentStateName ! POINTER_FEEDBACK_DEFAULT % �, ImagePolicyEntryTypeOverride � ThreadBasicInformation S* NormalizationOther ' � T ProcessCaptureTrustletLiveDump % ) MonitorRequestReasonTerminal % ], FileMetadataOptimizationNone * � FeatureConfigurationOperationNone # c3 FindExSearchLimitToDevices * � I SystemLogicalProcessorInformation . � AlpcRegisterCompletionListInformation � COR_VTABLE_32BIT f DPFLTR_FSTUB_ID . � � SystemCodeIntegrityClearDynamicStores �! PowerStateMaximum { LastWakeTime M CommunicationServer ! � 3 WinNTLMAuthenticationSid FpCodeLog10 f k DPFLTR_PERFLIB_ID 0 �6 VirtualStorageBehaviorCacheWriteThrough # � z SystemAcpiAuditInformation # �# DeviceInstanceStartedEvent �
JournalAbortTransaction `D PROXY_MARSHAL / �' RunlevelInformationInActivationContext � StandardDesign ' m ObjectSessionObjectInformation % � � SystemPoolZeroingInformation �& ��LdrpAnyDevice & SystemVaTypeAll ! � ThreadSetTlsArrayAddress ! ~ FilePipeLocalInformation { SystemPowerLoggingEntry �( RtlBsdItemChecksum $ � KHeteroCpuPolicyLargeOrIdle * >' COPYFILE2_CALLBACK_STREAM_STARTED % �* COPYFILE2_PHASE_PREPARE_DEST + � t WinAuthenticationKeyPropertyMFASid f j DPFLTR_WDI_ID � RF_UNSORTED ! 7& KeyWow64FlagsInformation # J" SystemCrashDumpReconfigure . P TransactionManagerRecoveryInformation = FpCompareUnordered & { SystemPowerStateNotifyHandler ImageAslrPolicy � GEO_LCID �$ MaxAppContainerSidType & �, POINTER_DEVICE_TYPE_TOUCH_PAD ! + FileFsMaximumInformation $ x PsAttributeDesktopAppPolicy ' �* COPYFILE2_PHASE_PREPARE_SOURCE � TableFoundNode ~ FileAccessInformation M SYSTEM_HANDLE_THREAD � ! ProcessIoPriority � % ThreadContainerId + @ EventTraceProfileConfigInformation 3 � � SystemEntropyInterruptTimingRawInformation � RtlPathTypeUnknown # � PerfInfoMemResetUndoFailed 0( � UserUnknown $ � AlpcConnectedSIDInformation , � e ProcessDynamicEHContinuationTargets ( f" � �HeapSetDebuggingInformation FirmwareTypeUnknown # � IrqPolicyOneCloseProcessor � CsvControlStartForceDFO ~ L FileMaximumInformation K AuditPrivilegeObject �9 KTMOBJECT_INVALID � ProcessAffinityMask � ProcessVmCounters (S MaxTimerInfoClass ImageFontDisablePolicy # �( RtlBsdItemBootAttemptCount $ K WnfDataScopePhysicalMachine f DPFLTR_I8042PRT_ID # $ WorkerFactoryThreadMaximum � SmrGcStateActive x PsAttributeDebugObject # WdInfoInvalid & j JobObjectReserved1Information f � DPFLTR_WER_ID { \ EnergyTrackerCreate � & ThreadNameInformation � 9 ReservedForDVRF57 � OptionOk " $ WorkerFactoryCallbackType , WMI_REGINFO - � V WinCapabilityInternetClientServerSid & � SystemNonPagedPoolInformation �E COMPARE_STRING $ � � SystemLeapSecondInformation , � PS_MITIGATION_OPTION_HEAP_TERMINATE + n ProcThreadAttributeProtectionLevel � NuBus & x PsAttributeChildProcessPolicy �( MandatoryLevelLow ' {# DISPLAYCONFIG_SCALING_IDENTITY $ � PoCsDeviceNotificationAudio b) IoSessionEventLogon 8% MemoryTypeHugePage $ % PsWakeReasonPreserveProcess * � a WinBuiltinRDSManagementServersSid f" HeapStackDatabase # � � SystemWin32WerStartCallout # � AlpcMessageZoneInformation $ �! VmPageDirtyStateInformation ~ FileAllInformation �) InternalWakeSourceType f � DPFLTR_GPIO_ID % � 5 WinSChannelAuthenticationSid B jC SystemActivityModerationStateUserManagedDisableThrottling % u, PlatformRoleEnterpriseServer ! P! ProcessActivityTypeAudio � EventProviderSetTraits $ ~# ProcessMemoryExhaustionInfo x PsAttributeHandleList f 7 DPFLTR_TAPE_ID � AlpcPortInformation � RtlPathTypeLocalDevice & j JobObjectReserved6Information f DPFLTR_ACPI_ID � AclRevisionInformation f 6 DPFLTR_SOFTPCI_ID ! & SystemVaTypeNonPagedPool { ! ProcessorIdleStates � PerfInfoMemReset { SystemPowerStateHandler - � � SystemCodeIntegrityUnlockInformation ' � L WinBuiltinEventLogReadersGroup K ProfileLoadLinkedIssues O2 ShrinkAbort / � J ProcessHighGraphicsPriorityInformation � PsCreateInitialState � % ProcessImageInformation % ImageSystemCallDisablePolicy � PNP_VetoDriver # WdInfoTriggerAction _* EtwStopLoggerCode 3 � % WinBuiltinNetworkConfigurationOperatorsSid , WMI_GET_ALL_DATA ~ FileModeInformation � WinRemoteLogonIdSid ! ACTCTX_RUN_LEVEL_NUMBERS ] % SysDbgGetLiveKernelDump , � PlugPlayControlGenerateLegacyDevice " M WnfInfoSubscribersPresent 3 ) & MonitorRequestReasonUserInputSessionSwitch # �
RtlPhysicalMemoryPolicyLow b) IoSessionEventIgnore ! { O RegisterSpmPowerSettings ( �& POINTER_CHANGE_FIRSTBUTTON_DOWN ( � X WinCapabilityPicturesLibrarySid " � COR_VTABLE_FROM_UNMANAGED C :3 DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST 5 �$ � �DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INTERNAL ( � d ProcessAltSystemCallInformation % ] SysDbgQueryModuleInformation f e DPFLTR_DEFAULT_ID FpCodeSin � TokenMandatoryPolicy � KCONTINUE_RESUME x PsAttributeChpe 0 +X JOB_OBJECT_NET_RATE_CONTROL_VALID_FLAGS � O WinMediumPlusLabelSid * f" HeapEnableTerminationOnCorruption % 7 EtwQueryProcessHandleInfoMax f ^ DPFLTR_VDS_ID 9 0 JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ALL " � VrfMiscellaneousRuleClass & � SystemMirrorMemoryInformation * � { SystemBasicPerformanceInformation f T DPFLTR_RTLTHREADPOOL_ID ) � ManageHotPatchUnloadPatchForUser # ~ FileMoveClusterInformation f a DPFLTR_VDSDYNDR_ID $ � * ThreadDynamicCodePolicyInfo " � � AccessReasonDeniedAce m VERIFIER_MODE_TEST - �6 VirtualStorageBehaviorCacheWriteBack + � � SystemInterruptSteeringInformation j JobObjectClearEvent ' { / NotifyUserModeLegacyPowerEvent u, PlatformRoleAppliancePC $ � . ProcessMemoryAllocationMode � TokenSource $ �/ IMPORT_OBJECT_NAME_EXPORTAS � JournalDeleteKey ' ~ E FileMemoryPartitionInformation �( RtlBsdItemProductType # �, ImagePolicyEntryTypeUInt64 ' � PlugPlayControlEnumerateDevice 4 :3 DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE � 7 ProcessKeepAliveCount * � � SystemWheaIpmiHardwareInformation ] SysDbgGetTriageDump � ] ProcessLoaderDetour 0 � R SystemThreadPriorityClientIdInformation f ; DPFLTR_FLOPPY_ID # �! VmImageHotPatchInformation " + FileFsDataCopyInformation � SecurityIdentification & j JobObjectReserved5Information 1 � ] WinCapabilityEnterpriseAuthenticationSid � TracePmcCounterListInfo & � PoCsDeviceNotificationStorage > �' FileInformationInAssemblyOfAssemblyInActivationContxt , � PsEnergyComponentTypeForegroundTime O2 ShrinkCommit $ � H ProcessIumChallengeResponse ! 5 DEBUG_CONTROL_SPACE_PRCB � 0 SystemSessionDetach f DPFLTR_CACHEMGR_ID � FileNormalizedNameInfo � COMIMAGE_FLAGS_ILONLY _* EtwWdiSemUpdate , � l SystemProcessorCycleTimeInformation # { U PowerRequestActionInternal M PhoneNT f A DPFLTR_FCPORT_ID " { ' PowerShutdownNotification �( RtlBsdPowerTransition ( �* PoSleepDisableReasonGuardedHost * � . TokenIsLessPrivilegedAppContainer FpCodeAtan2 K AuditCloseObject & � ComputerNameDnsFullyQualified � 5 ReservedForDVRF53 { VerifySystemPolicyDc " �# DevicePropertyChangeEvent - � � COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE 8% MemoryTypeMax ~ FilePositionInformation ' � � SystemVsmProtectionInformation 0 �
PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD % � a ProcessLeapSecondInformation � WinLogonIdsSid , WMI_DISABLE_EVENTS { SystemPowerStateLogging / � AlpcAssociateCompletionPortInformation , �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDI % �/ IMPORT_OBJECT_NAME_NO_PREFIX - 0 EtwSessionNotificationSessionStarted " �$ ParentAppContainerSidType + �
CsvControlQueryVolumeRedirectState �$ MaxKeyValueInfoClass % P MemExtendedParameterNumaNode 3 � PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE ! { % TraceServicePowerMessage x PsAttributeImageInfo # ImageUserShadowStackPolicy
BootMaxEntropySources � RpcRequestsPerSecond � b WinUserModeDriversSid $ ResponseNo � KCONTINUE_LAST # WdInfoTimeoutValue ! ] SysDbgSetPrintBufferSize * � � SystemProcessorProfileControlArea { SetPowerSettingValue % ProcessUserShadowStackPolicy # � UNSPECIFIED_COMPARTMENT_ID * )$ MemoryNotEligibleToMakeContiguous % � CsvControlQueryRedirectState - ) MonitorRequestReasonPoSetSystemState .# Pos 2 � DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_NAME � 8 ReservedForDVRF56 . ) VRF_TRIAGE_CONTEXT_FLIGHT_DIAGNOSTICS { NotifyUserPowerSetting � CsvControlEnableCaching ! �5 SC_EVENT_DATABASE_CHANGE $ BackTraceDatabaseMaxControl � TokenCapabilities & j JobObjectReserved7Information �9 KTMOBJECT_ENLISTMENT $ � IrqPolicyAllCloseProcessors " BootEntropySourceSeedfile � WinWorldSid 1 � 8 WinBuiltinIncomingForestTrustBuildersSid � RtlPathTypeRelative S5 CoverageAllModules 2 E TOKEN_SECURITY_ATTRIBUTE_OPERATION_DELETE " 5 SystemPixelFormatB8G8R8X8 { VerifySystemPolicyAc FpCodeMultiply ( 9$ DISPLAYCONFIG_ROTATION_IDENTITY & ! SecureSettingValueTypeUnknown � TokenRestrictedSids . CacheTrace w PowerActionWarmEject 2 +X JOB_OBJECT_NET_RATE_CONTROL_MAX_BANDWIDTH * j JobObjectExtendedLimitInformation � WinLocalServiceSid , �5 MemoryPhysicalContiguityInformation �" WdActionStartTimer % � EventProviderBinaryTrackInfo ] SysDbgCheckLowMemory 0 @ EventTraceProfileCounterListInformation �
PNP_VetoNonDisableable f DPFLTR_SYSTEM_ID # TransactionBindInformation # �# HardwareProfileChangeEvent � - ReservedForDVRF45 � JournalSetValue ) � VrfProcessorBranchTraceRuleClass $ B' NtfsLinkTrackingInformation �" WdActionSetTimeoutValue & � < ProcessCommandLineInformation ' � I ProcessChildProcessInformation " � LockQueueIoCompletionLock ! �$ RtlDiskSpacePolicyNormal f @ DPFLTR_RSFILTER_ID f w DPFLTR_FVEVOL_ID ! �' LoadReasonEnclavePrimary f DPFLTR_TCPIP_ID �# SeImageSignatureCache y7 HANDEDNESS_LEFT # � � SystemCpuSetTagInformation #) AtomBasicInformation & j $ JobObjectSiloBasicInformation �* COPYFILE2_PHASE_MAX ] SysDbgWriteVirtual � ThreadPerformanceCount ! � VrfExtendingXDVTimeLimit / � � SystemDeviceDataEnumerationInformation � IoPriorityNormal . � PlugPlayControlGetInterfaceDeviceList 0 �* ��DISPLAYCONFIG_PIXELFORMAT_FORCE_UINT32 % � SystemDpcBehaviorInformation ! ~ FileAlignmentInformation � i WinLocalAccountSid ) j JobObjectInterferenceInformation + @ EventTraceKernelVersionInformation ' � SystemSummaryMemoryInformation ( $ WorkerFactoryThreadBasePriority A � DISPLAYCONFIG_DEVICE_INFO_SET_SUPPORT_VIRTUAL_RESOLUTION f DPFLTR_STORPROP_ID ' � PoCsDeviceNotificationEthernet ! � B SystemBigPoolInformation = MmEtwWorkingSetTypeUser - � CsvControlQueryFileRevisionFileId128 M ComputeServer � ThreadIsTerminated S5 CoverageSearchByName � > ReservedForDVRF62 , j & JobObjectServerSiloBasicInformation �G ServiceDirectoryTypeMax � AccessReasonNone f \ DPFLTR_VSSDYNDISK_ID $ SectionImageInformation � 3 MaxThreadInfoClass ] SysDbgClearSpecialCalls % � � SystemFullProcessInformation � DevicePowerState ' K AuditOpenObjectWithTransaction �( RtlBsdItemBootShutdown $
WorkerFactoryFlags 3 ) % MonitorRequestReasonUserInputPoUserPresent " + FileFsFullSizeInformation M SYSTEM_HANDLE_MUTEX & SystemVaTypeSystemPtes { 1 ProcessorIdleDomains � TokenAccessInformation � WinDialupSid � TraceGuidQueryList ! (S TimerSetCoalescableTimer � GEO_ID � GEO_CURRENCYCODE 1 ~ B FileRenameInformationExBypassAccessCheck _* EtwIncrementFileCode � GEO_CURRENCYSYMBOL FpCodeCosh * �= POINTER_DEVICE_CURSOR_TYPE_ERASER % � SystemVdmInstemulInformation ( � A ProcessCommitReleaseInformation j JobObjectContainerId { C PdcInvocation - e) SystemMemoryPartitionGetMemoryEvents + $# CsvFsDiskConnectivitySubsetOfNodes + �; PerfInfoDomainChangeEventEnterTrap , n ProcThreadAttributeDesktopAppPolicy / � CsvControlUnmarkHandleLocalVolumeMount K ProfileMaximum f" HeapMemoryLimit " $ MaxWorkerFactoryInfoClass " �$ RtlRXactOperationSetValue 0 j / JobObjectThreadImpersonationInformation � RF_SORTED 3 ��DISPLAYCONFIG_COLOR_ENCODING_FORCE_UINT32 �' LoadReasonDynamicLoad M SYSTEM_HANDLE_SECTION ( $ SectionInternalImageInformation 0 �0 BootEntropySourceStructureUninitialized � SystemPathInformation 3 � PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER , �" FEEDBACK_TOUCH_CONTACTVISUALIZATION m VERIFIER_MODE_FIELD f � DPFLTR_VPCI_ID �
GEO_PARENT $ �' LoadReasonEnclaveDependency j - JobObjectSiloSystemRoot % DynamicTickVetoSoftwareTimer f DPFLTR_SVCHOST_ID % ) MonitorRequestReasonResumeS4 � ' ThreadSelectedCpuSets - � � SystemCodeIntegrityPolicyInformation # A EtwNotificationTypePerflib " � TP_CALLBACK_PRIORITY_HIGH � WinBuiltinDomainSid . � SystemProcessorPerformanceInformation ! e) SystemMemoryPartitionMax � ComputerNameDnsDomain ' j JobObjectCycleTimeNotification * � SystemPerformanceTraceInformation { ] EnergyTrackerQuery % 5 DEBUG_CONTROL_SPACE_KSPECIAL ! #1 PoDisabledStateSleeping4 � AlpcServerInformation ' j JobObjectReserved10Information ! �, ��POINTER_DEVICE_TYPE_MAX ) � ManageHotPatchQueryActivePatches @ jC SystemActivityModerationStateUserManagedAllowThrottling � SidTypeDomain ' ~ % FileIdBothDirectoryInformation % f" HeapCompatibilityInformation 8% MemoryTypeNonPaged ~ F FileStatLxInformation ! x PsAttributePriorityClass �+ IMO_SYSTEM � IoPriorityLow $ � UmsInformationCommandDetach ! .# SgiInternalConfiguration . CacheInstruction � SystemFlagsInformation ~ FileFullEaInformation % � u SystemBootEntropyInformation - �' LoadReasonDynamicForwarderDependency $ ResponseNotHandled * Z/ CI_WINDOWS_LOCKDOWN_MODE_UNLOCKED " FpCodeY0 * ) - MonitorRequestReasonDirectedDrips � TokenUser f I DPFLTR_PROCESSOR_ID ( ~ J FileStorageReserveIdInformation / zE ReadDirectoryNotifyExtendedInformation * � p WinBuiltinStorageReplicaAdminsSid { , PowerRequestAction �! STUB_MARSHAL ( {# DISPLAYCONFIG_SCALING_STRETCHED � TokenGroups % +
FileFsVolumeFlagsInformation � � SystemPolicyInformation ( � a SystemVerifierFaultsInformation � TokenSandBoxInert {
SystemReserveHiberFile , � PS_MITIGATION_OPTION_ROP_STACKPIVOT Q ToleranceMedium ( P MemExtendedParameterInvalidType " � / WinAccountSchemaAdminsSid # $ WorkerFactoryThreadCpuSets � DEFAULT_COMPARTMENT_ID 7 �' AssemblyDetailedInformationInActivationContext * � 0 ProcessTokenVirtualizationEnabled " � MaximumIoPriorityHintType � FpFormatFp64 * @ EventTraceStackTracingInformation + +X JOB_OBJECT_NET_RATE_CONTROL_ENABLE T6 CriticalError % � FileStorageTierMediaTypeDisk , j + JobObjectMemoryPartitionInformation # �, ImagePolicyEntryTypeUInt32 ! #1 PoDisabledStateSleeping1 �$ KeyValueFullInformation `D PROXY_CALCSIZE � IoSessionStateConnected ? � $ PS_MITIGATION_OPTION_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY � ThreadCycleTime / � CrossProcOperationMemoryAllocPreNotify � VrfRuleClassBase / @ EventTraceExecutiveResourceInformation * �; PerfInfoDomainChangeEventIdleHalt � JournalSetKeySecurity � KCONTINUE_SET ! m ObjectSessionInformation $ �( MandatoryLevelSecureProcess �# TargetDeviceChangeEvent � EndAlternatives . J" SystemCrashDumpInitializationComplete �) EtwRtBackupLost ! UmsThreadTeb � SecurityAnonymous �; PowerUserPresent / ) MonitorRequestReasonBatteryCountChange ' �( RtlBsdItemPowerButtonPressInfo " ) MonitorRequestReasonWinrt * ProcessSideChannelIsolationPolicy % �9 DDC_DISABLE_CONTROL_RELAYOUT ) � 9 SystemExtendedProcessInformation -D PortBasicInformation * � � SystemInterruptCpuSetsInformation �$ MonitorRequestTypeOff BootEntropySourceCng ! � VrfPortMiniportRuleClass � WinServiceSid / � � SystemTrustedPlatformModuleInformation & �& POINTER_CHANGE_THIRDBUTTON_UP T SynchronizationTimer T6 IgnoreError �B SC_ACTION_RUN_COMMAND � MaxIoPriorityTypes " ~ - FileSfioVolumeInformation f
DPFLTR_SCSIMINIPORT_ID 8% MemoryTypePaged / � PS_MITIGATION_OPTION_RETURN_FLOW_GUARD � TokenAuditPolicy �
GEO_TIMEZONES � � � AccessReasonNoGrant + 0 EtwSessionNotificationMediaChanged T6 NormalError ! ~ FileDirectoryInformation � ProcessAccessToken " �
LockQueueAfdWorkQueueLock ) � 6 SystemLoadGdiDriverInSystemSpace � ProcessLdtSize f DPFLTR_VIDEO_ID f � DPFLTR_KSECDD_ID $ V+ RtlFeatureConfigurationBoot ' � " ThreadCpuAccountingInformation ( � � SystemKernelVaShadowInformation �- MemoryReserveUserApc `D PROXY_GETBUFFER " \@ EtwCompressionModeRestart K AuditPrivilegeService ! S RelationProcessorPackage , � SharedVirtualDiskSnapshotsSupported � RPCHTTP_RS_SESSION �' LoadReasonAsImageLoad + "E AlpcMessageDirectStatusInformation � FpFormatI32 $ �! STUB_CALL_SERVER_NO_HRESULT ] ! SysDbgGetUmBreakPid ! >' COPYFILE2_CALLBACK_ERROR ! UmsThreadIsSuspended % Width32Bits # � 4 WinDigestAuthenticationSid � FileAlignmentInfo 4 �' CompatibilityInformationInActivationContext � ��InterfaceTypeUndefined , WMI_SET_SINGLE_INSTANCE � VrfNdisWifiRuleClass ( 9$ DISPLAYCONFIG_ROTATION_ROTATE90 { ; GetPowerSettingValue * � I WinNonCacheablePrincipalsGroupSid $ �: RtlMitigationOptionStateOff ~ 5 FileNumaNodeInformation f DPFLTR_HALIA64_ID � WinProxySid 5 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EXTERNAL 5 ~ K FileCaseSensitiveInformationForceAccessCheck f O DPFLTR_IHVAUDIO_ID A 0 JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ON_SOFT_CAP f } DPFLTR_SBP2PORT_ID * � MemoryPurgeLowPriorityStandbyList % � � SystemMemoryUsageInformation ' ) VRF_TRIAGE_CONTEXT_DEVELOPMENT ]
SysDbgReadPhysical � P WinLocalLogonSid " 6 ImagePolicyIdCrashDumpKey " � c WinBuiltinHyperVAdminsSid ' k* ServiceRegistryStateParameters f - DPFLTR_UNIMODEM_ID � / TokenIsSandboxed M Enterprise BootEntropySourceTime
� Eisa # K ProfileIntegerInstructions f DPFLTR_AMLI_ID S RelationProcessorCore �" WdActionWake K ProfileTotalNonissues �" ��FEEDBACK_MAX " � SmrGcActionStartFullSpeed � ThreadLastSystemCall � � SystemFlags2Information % � COMIMAGE_FLAGS_32BITREQUIRED " �, ImagePolicyEntryTypeUInt8 ! K ProfileStoreInstructions � TraceMaxLoggersQuery �@ � AR_LAPTOP f � DPFLTR_CFR_ID $ � PlugPlayControlDeviceStatus ~# ProcessPowerThrottling / N SharedVirtualDiskHandleStateFileShared SmrGcMethodCompression f � DPFLTR_STORVSP_ID ( � IrqPolicyAllProcessorsInMachine # � SystemFileCacheInformation ; �/ SystemFeatureConfigurationSectionTypeUsageTriggers 0 � PsEnergyComponentTypeDesktopVisibleTime � DEPTotalPolicyCount f 2 DPFLTR_IMAPI_ID �
TraceSetDisallowList �" HiberFileBucket8GB � GroupAffinityDontCare , � � SystemSpeculationControlInformation � SidTypeGroup f = DPFLTR_TERMSRV_ID # �E PowerRequestSystemRequired M
StorageServer 3 � PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER & $# CsvFsDiskConnectivityAllNodes % � UmsInformationCommandInvalid # �6 FixedWakeSourcePowerButton ) A
EtwNotificationTypeInProcSession �" HiberFileBucket32GB % PsWakeReasonKernel % ~# ProcessTelemetryCoverageInfo �. WnfTemporaryStateName % ] SysDbgGetKdUmExceptionEnable f � DPFLTR_MOUNTMGR_ID 5 � � SystemCodeIntegritySyntheticCacheInformation # � X SystemProcessIdInformation * � 0 TokenOriginatingProcessTrustLevel 1 �( RtlBsdItemReportedAbnormalShutdownBootId , � VrfTrackingPoolAllocationsRuleClass � 7 WinOtherOrganizationSid � PowerSystemUnspecified " BootEntropySourceExternal & �E PowerRequestExecutionRequired ' {# DISPLAYCONFIG_SCALING_CENTERED � KCONTINUE_UNWIND " $ WorkerFactoryRetryTimeout f DPFLTR_DISK_ID � OptionAbortRetryIgnore ( � � SystemMemoryTopologyInformation ~# ProcessAppMemoryInfo 3 jC SystemActivityModerationStateSystemManaged $ 9 ORIENTATION_PREFERENCE_NONE " <% IDL_CS_NEW_BUFFER_CONVERT $ � B ProcessReserved1Information ) � K WinAccountReadonlyControllersSid KeyFlagsInformation �9 DDC_DISABLE_ALL ' c3 FindExSearchLimitToDirectories �+ IMO_HARDWARE �( EventBasicInformation �) EtwRtEventLost # { $ SystemHiberFileInformation � COR_VTABLE_64BIT % Width16Bits ' �( RtlBsdPowerTransitionExtension % ~ FileMailslotQueryInformation ) n ProcThreadAttributeGroupAffinity ! #1 PoDisabledStateSleeping3 f [ DPFLTR_PRINTSPOOLER_ID $ ] SysDbgDisableKernelDebugger # ) VRF_TRIAGE_CONTEXT_DEFAULT 5 �/ SystemFeatureConfigurationSectionTypeRuntime � # ProcessTlsInformation � NEC98x86 " � PlugPlayControlHaltDevice � " VrfMoreIrqlRuleClass �) FixedWakeSourceType # � TokenVirtualizationEnabled ) ) " MonitorRequestReasonUserInputPen / j JobObjectExtendedAccountingInformation % �0 DynamicTickDisableReasonNone + FileFsLabelInformation M TerminalServer & �5 MemorySharedCommitInformation $ � FeatureEnabledStateDisabled ' �% CmExtendedParameterInvalidType I TP_LOG_LEVEL_WARNING 2 �+ SystemProcessClassificationMemCompression . � � SystemSupportedProcessorArchitectures PoConditionMaximum " �$ RtlDiskSpacePolicyVeryLow $ �) TimerPresumedWakeSourceType $ � PlugPlayControlUserResponse ; �, CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK_PERMANENT �B SC_ACTION_NONE v ��LdrModulesUnloaded S RelationGroup � GEO_OFFICIALNAME � RtlPathTypeUncAbsolute f H DPFLTR_PNPMEM_ID _* EtwQueryLoggerCode 0 p WOW64_FUNCTION_QUERY_PROCESS_DEBUG_INFO 4 � G ProcessRaiseUMExceptionOnInvalidHandleClose � _ARM64_BARRIER_NSHLD 0 � CrossProcOperationInstructionCacheFlush A$ TimerBasicInformation ! � SystemProcessInformation ! � ThreadImpersonationToken # 7& KeyControlFlagsInformation � SmrGcStatePaused % � Z WinCapabilityMusicLibrarySid : LT_DONT_CARE �; PowerUserInactive & u, PlatformRolePerformanceServer + j
JobObjectLimitViolationInformation � IoPriorityHintVeryLow & i DISPLAYCONFIG_TOPOLOGY_EXTEND ( �= ��POINTER_DEVICE_CURSOR_TYPE_MAX # � PNP_VetoInsufficientRights � ProcessRaisePriority $ ResponseTryAgain 7 � DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_BASE_TYPE f / DPFLTR_FLTMGR_ID FpCodeExp �" HiberFileBucket4GB ' � H WinCacheablePrincipalsGroupSid �$ GenericGreaterThan @ � PS_MITIGATION_OPTION_USER_CET_SET_CONTEXT_IP_VALIDATION � PsCreateFailOnFileOpen $ LearningModeLogLevelPassive 8 PdataCrChained ! 7 EtwQueryLastDroppedTimes � OptionOkCancel ! � PsProtectedSignerCodeGen , � SE_WS_APPX_SIGNATURE_ORIGIN_UNKNOWN , �+ SystemProcessClassificationRegistry 3 � � SystemCodeIntegrityVerificationInformation 7 � � SystemAffinitizedInterruptProcessorInformation f ` DPFLTR_VDSDYN_ID K ProfileLoadInstructions % � COR_VTABLE_CALL_MOST_DERIVED , �; PerfInfoDomainChangeEventIdleResume $ ResponseYes �@ UserProcessRequester �" HiberFileBucket2GB " 0 EtwSessionNotificationMax 8 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPONENT_VIDEO " �" EtwProviderTraitTypeGroup K WnfDataScopeUser � RpcIncomingBandwidth $ � ComputerNamePhysicalNetBIOS # � ! SystemExceptionInformation % $ SectionRelocationInformation , .@ DISPLAYCONFIG_MODE_INFO_TYPE_SOURCE 9 � PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT 7 ) MonitorRequestReasonAcDcDisplayBurstSuppressed ( �? IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF ! �$ ChildAppContainerSidType ! � G WinCreatorOwnerRightsSid & � x SystemSystemPtesInformationEx 7 � � SystemCodeIntegrityPlatformManifestInformation ! 6 ImagePolicyIdParentSdRev s ProcessWorkingSetEmpty S PnpQueryEjectRelations ' � � SystemSecurityModelInformation .# MaximumBusDataType ! # WdInfoGeneratedLastReset * � � SystemIsolatedUserModeInformation ! � PsEnergyComponentTypeMBB � % TokenDeviceGroups � GEO_NAME �(
RtlBsdItemBootId 0 E TOKEN_SECURITY_ATTRIBUTE_OPERATION_NONE �9 DDC_DEFAULT " � ] SystemTimeZoneInformation � TokenSessionId � PsCreateMaximumStates - FeatureEnabledStateOptionsWexpConfig ' � FileIdExtdDirectoryRestartInfo $ MaxSectionInfoClass * � U SystemProcessorPowerInformationEx + �% CmExtendedParameterFileAccessToken . @ EventTraceProfileEventListInformation ) �& POINTER_CHANGE_FOURTHBUTTON_DOWN $ � KHeteroCpuPolicySmallOrIdle % � TraceProfileSourceConfigInfo �* COPYFILE2_PHASE_NONE & � RtlSparseBitmapOperationClear �B SC_ACTION_RESTART & � WinBuiltinAccountOperatorsSid � : ProcessHandleTable & SystemVaTypeSystemCache � LockQueueUnusedSpare8 + � � SystemOfflineDumpConfigInformation � SystemModuleInformation 7& KeyWriteTimeInformation C :3 DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST + � � SystemCodeIntegrityAddDynamicStore $ � � SystemSpacesBootInformation ! � PsProtectedSignerWindows % j . JobObjectEnergyTrackingState � ComputerNameDnsHostname $ � c SystemSystemDiskInformation ( �! VmPhysicalContiguityInformation ' �,
ImagePolicyEntryTypeAnsiString " 5 SystemPixelFormatR8G8B8X8 # � TP_CALLBACK_PRIORITY_COUNT � ThreadPriorityBoost $ � 2 SystemRangeStartInformation y7 HANDEDNESS_RIGHT . "E AlpcMessageTokenModifiedIdInformation % ] SysDbgRegisterForUmBreakInfo " � E SystemHotpatchInformation � PowerSystemSleeping2 ] SysDbgSetTracepoint F _ EDIT_CONTROL_FEATURE_ENTERPRISE_DATA_PROTECTION_PASTE_SUPPORT f Z DPFLTR_STORMINIPORT_ID " � M SystemModuleInformationEx ! � 9 ProcessWorkingSetControl 2 � FeatureConfigurationOperationVariantState EventSecurityAddDACL " � TraceLbrConfigurationInfo $ P WorkerFactoryCallbackNormal � PNP_VetoLegacyDevice � CsvControlStopForceDFO FpCodeLdexp 6 � e WinBuiltinAccessControlAssistanceOperatorsSid / �! VmVirtualMachinePrepopulateInformation ) ) MonitorRequestReasonSxTransition � TokenType �& POINTER_CHANGE_NONE v LdrModulesInitializing A EtwNotificationTypeMax ImageSignaturePolicy # � FeatureEnabledStateDefault f � DPFLTR_TXF_ID ( ) MonitorRequestReasonPowerButton �@ AR_MULTIMON f V DPFLTR_TCPIP6_ID # ~ FileCompressionInformation ' j + JobObjectReserved21Information M WnfInfoIsQuiescent % ProcessMitigationOptionsMask f � DPFLTR_EXFAT_ID ( � C SystemSessionPoolTagInformation � COR_VERSION_MAJOR_V2 K WnfDataScopeMachine � RtlResTypeMax ' j / JobObjectReserved25Information 2 �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN " � IMAGE_COR_EATJ_THUNK_SIZE � GEOCLASS_NATION ' ~ & FileIdFullDirectoryInformation $ �,
ImagePolicyEntryTypeMaximum ( � � SystemIntegrityQuotaInformation 1 �, CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK ! � ThreadBreakOnTermination ! x PsAttributeMemoryReserve j # JobObjectCreateSilo ) � B ProcessDefaultCpuSetsInformation � ThreadAffinityMask * � n WinAccountDefaultSystemManagedSid � OptionRetryCancel _ IMDT_PEN ^" FpRoundPlusInfinity & LearningModeLogLevelNormalApc � TraceStackTracingInfo ) )
MonitorRequestReasonPolicyChange M MaxSuiteType { T ThermalEvent ]
SysDbgWriteControlSpace $ \@ EtwCompressionModeNoRestart � MemoryCommandMax { * SessionDisplayState & n ProcThreadAttributeHandleList �
WinAnonymousSid � FileCaseSensitiveInfo ! K< JournalClientInformation & �$ LowMemoryResourceNotification Q ToleranceLow � TokenImpersonationLevel �@ AR_NOT_SUPPORTED A � DISPLAYCONFIG_DEVICE_INFO_GET_SUPPORT_VIRTUAL_RESOLUTION % � � SystemKernelDebuggingAllowed " A EtwNotificationTypeEnable ] SysDbgWritePhysical { 5 ProcessorPerfStatesHv � ThreadIsIoPending (4 SC_ENUM_PROCESS_INFO ) #1 PoDisabledStateSleeping4Firmware 1 � CrossProcOperationMemoryProtectPreNotify �
TraceGroupQueryInfo % � Q SystemFileCacheInformationEx { LastSleepTime �" FEEDBACK_TOUCH_TAP f < DPFLTR_FDC_ID * u InternalWakeSourceDozeToHibernate & ) MonitorRequestReasonPdcSignal . � CrossProcOperationMemoryFreePreNotify FirmwareTypeBios - �# QUERY_FILE_LAYOUT_FILTER_TYPE_FILEID " � 4 SystemVerifierThunkExtend C# PowerMonitorDim ! � � SystemBadPageInformation �$
RtlDiskSpacePolicyLow & $ WorkerFactoryBasicInformation FpCodeLog , n ProcThreadAttributeMitigationPolicy + ~ 2 FileIdGlobalTxDirectoryInformation { SystemPowerCapabilities ! �, ImagePolicyEntryTypeInt8 ) �; PerfInfoDomainChangeEventMaximum / � \ WinCapabilitySharedUserCertificatesSid v ��LdrModulesInitError - �- PoHiberForceDisableReasonGuardedHost $ � K ProcessSubsystemInformation f � DPFLTR_FSLIB_ID `D PROXY_SENDRECEIVE f . DPFLTR_SIS_ID * �0 BootEntropySourceDisabledByPolicy & � PlugPlayControlGetDeviceDepth % �E PowerRequestAwayModeRequired �B SC_ACTION_REBOOT ( 7& KeySetVirtualizationInformation & � PsEnergyComponentTypeAudioOut * � b ProcessFiberShadowStackAllocation f S DPFLTR_HPS_ID � WinLocalSid �/ IMPORT_OBJECT_NAME * � v SystemVerifierCountersInformation & % PsWakeReasonExecutionRequired / E TOKEN_SECURITY_ATTRIBUTE_OPERATION_ADD { M DisplayBurst ' j & JobObjectReserved16Information � NATIVE_TYPE_MAX_CB $ � O SystemSuperfetchInformation { ( MonitorCapabilities f DPFLTR_CDAUDIO_ID # 5 DEBUG_CONTROL_SPACE_THREAD = �$
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EXTERNAL f ~ DPFLTR_COVERAGE_ID � OptionYesNoCancel �# MaxPlugEventCategory ] SysDbgReadIoSpace
ImageImageLoadPolicy � � SystemEdidInformation # � SystemProcessorInformation v ��LdrModulesUnloading K ProfileDcacheMisses >' COPYFILE2_CALLBACK_MAX ~# ProcessMemoryPriority " � ) ThreadActualGroupAffinity 3 � � SystemCodeIntegrityPoliciesFullInformation ) � PlugPlayControlRegisterNewDevice " � KHeteroCpuPolicyStaticMax ( �6 VirtualStorageBehaviorUndefined �/ IMPORT_OBJECT_ORDINAL " ! UmsThreadInvalidInfoClass f 0 DPFLTR_WMICORE_ID �5 Win32ServiceOwnProcess ' j JobObjectReserved14Information = �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EMBEDDED + CmResourceShareShared � PowerSystemSleeping1 + �7 MaxSystemActivityModerationAppType # � CsvControlStopRedirectFile $ �0 BootEntropySourceNotPresent & $ WorkerFactoryAdjustThreadGoal $ � FileStorageTierMediaTypeSsd �" FEEDBACK_PEN_RIGHTTAP " � GroupAffinityAllGroupZero � TraceGuidQueryInfo $ � C ProcessReserved2Information $ A EtwNotificationTypeReserved � FileBasicInfo � KHeteroCpuPolicyAll 3 �/ SystemFeatureConfigurationSectionTypeCount ! � � SystemConsoleInformation % n ProcThreadAttributeUmsThread - �; PerfInfoDomainChangeEventUserCallout �# PsAlwaysDuplicate � ProcessWorkingSetWatch � m SystemStoreInformation � ThreadBasePriority � TokenOwner & SystemVaTypeMax { 3 SystemHiberFileSize � WinNtAuthoritySid � TokenPrivileges 3 � COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN �6 FixedWakeSourceRtc & � PsProtectedSignerAuthenticode � 1 MaxTokenInfoClass � RpcIncomingConnections $ K ProfileBranchMispredictions �( CpuSetInformation # = MmEtwWorkingSetTypeSession , �7 MemSectionExtendedParameterNumaNode 5 � � SystemFeatureConfigurationSectionInformation 8 ) ) MonitorRequestReasonPdcSignalWindowsMobileShell ' j JobObjectBackgroundInformation _* EtwActivityIdCreate A � PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION . � ComputerNamePhysicalDnsFullyQualified # n
ProcThreadAttributeJobList ! + FileFsControlInformation { A SystemHiberbootState + NG d RtlDiskWriteConstraintPolicyNormal %( BootLoad H Compatible ProcessSignaturePolicy � COR_DELETED_NAME_LENGTH � SystemVdmBopInformation & ImagePayloadRestrictionPolicy + � � SystemProcessorFeaturesInformation � LockQueueUnusedSpare16 f M DPFLTR_IHVDRIVER_ID $ � ProcessPooledUsageAndLimits f b DPFLTR_VDSLDR_ID # b) IoSessionEventDisconnected BootEntropySourceNone - � � SystemSecureKernelProfileInformation & { N ExitLatencySamplingPercentage �5 SC_EVENT_STATUS_CHANGE ' �= POINTER_DEVICE_CURSOR_TYPE_TIP { 9 UserPresence ! �0 BootEntropySourceSuccess - ) MonitorRequestReasonRemoteConnection �
ThreadZeroTlsCell ! #1 PoDisabledStateReserved5 ! x
PsAttributePreferredNode & � � SystemBuildVersionInformation ! � + TokenSingletonAttributes f � DPFLTR_CAPIMG_ID .# MPSAConfiguration �! STUB_CALL_SERVER $ � PlugPlayControlRetrieveDock " � � @ AccessReasonOwnership �5 MemoryImageInformation ) � f SystemDynamicTimeZoneInformation & +
FileFsMetadataSizeInformation ! & SystemVaTypeSessionSpace 0 �+ SystemProcessClassificationSecureSystem m ObjectTypeInformation � VrfSystemBIOSRuleClass FpCodeUnspecified ) � PS_MITIGATION_OPTION_ROP_SIMEXEC � ThreadMemoryPriority � Q WinConsoleLogonSid u, PlatformRoleSOHOServer FpCodeAdd * � S WinApplicationPackageAuthoritySid ' �$ MonitorRequestTypeOnAndPresent ! � WinCreatorGroupServerSid # � SystemPagedPoolInformation 2 � h SystemProcessorMicrocodeUpdateInformation 0 j JobObjectTimerVirtualizationInformation h2 FindStreamInfoStandard / � 5 ProcessDynamicFunctionTableInformation - x PsAttributeSafeOpenPromptOriginClaim �
SidTypeLabel � ProcessorInternal FpCodeFloor & �9 KTMOBJECT_TRANSACTION_MANAGER / � M WinNewEnterpriseReadonlyControllersSid ? �' FileInformationInAssemblyOfAssemblyInActivationContext M BackOffice � RPCHTTP_RS_ACCESS_2 f # DPFLTR_PNPMGR_ID $ � FileStorageTierMediaTypeMax � ProcessHandleTracing 5: MemoryExhaustionTypeMax % "E AlpcMessageHandleInformation ) NUM_VRF_TRIAGE_CONTEXTS bG HAL_MCE_RECORD �" HiberFileBucketMax Q0 PerfInfoMMStatMax ! �
TokenGroupsAndPrivileges { 7 ProcessorSetIdle - �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_LVDS �! VmOfferPriorityNormal { . ProcessorInformationEx % ~ FileAlternateNameInformation 1 � | SystemQueryPerformanceCounterInformation � ' TokenSecurityAttributes ' DynamicTickVetoClockConstraint f > DPFLTR_W32TIME_ID
� Vmcs % �" FEEDBACK_GESTURE_PRESSANDTAP �6 PT_MOUSE P MemExtendedParameterMax ' �I MidlInterceptionInfoVersionOne ~ A FileRenameInformationEx � WinBuiltinPowerUsersSid % �? DPI_HOSTING_BEHAVIOR_DEFAULT * � � SystemKernelDebuggerInformationEx \ StorageReserveIdMax � MaxJournalChangeAction �
ProcessLdtInformation 1 n ProcThreadAttributeMitigationAuditPolicy 6 ImagePolicyIdDebug + ~ 1 FileNetworkPhysicalNameInformation � TableInsertAsLeft �5 AdapterType 0 � FeatureConfigurationOperationResetState �0 BootEntropySourceError " � VrfCodeIntegrityRuleClass * j JobObjectSecurityLimitInformation �5 FileSystemType $ � � SystemSoftRebootInformation ( ) MonitorRequestReasonGracePeriod 5 �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_VALID_FLAGS 1 P TransactionManagerOnlineProbeInformation { + PowerRequestCreate ) P TransactionManagerLogInformation #
BootEntropySourceTcbRdrand $ + FileFsSectorSizeInformation ^" FpRoundNearest .# EisaConfiguration % FilterBootOptionOperationMax " � V ProcessEnclaveInformation 6 �' AssemblyDetailedInformationInActivationContxt \ StorageReserveIdHard � LockQueueMasterLock ) � PlugPlayControlQueryConflictList # �/ DPI_AWARENESS_SYSTEM_AWARE 0 9 ORIENTATION_PREFERENCE_PORTRAIT_FLIPPED # � SystemCallCountInformation # �' USER_MARSHAL_CB_UNMARSHALL ~ FileNameInformation 6 ImagePolicyIdDeviceId �- MemoryReserveTypeMax ' � SystemLoadGdiDriverInformation �* PoSleepDisableReasonMax " � + ProcessImageFileNameWin32 5 � PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE + ProcessExtensionPointDisablePolicy ) �# SeImageSignatureCatalogNotCached * � A SystemLostDelayedWriteInformation � TokenElevation � TpTraceThreadAffinity ! ) PsProtectedTypeProtected U WaitAny " � . ThreadDbgkWerReportActive �' ObjectIdType S5 CoverageSearchByHash $ � PsCreateFailMachineMismatch ] $ SysDbgClearUmAttachPid � ProcessPriorityClass � ProcessTimes # � TokenVirtualizationAllowed � PerfInfoMemResetUndo & ~ 3 FileIsRemoteDeviceInformation M MultiUserTS � ACPIBus # � PS_MITIGATION_OPTION_SEHOP FpCodeCeil $ � � SystemDeviceDataInformation f W DPFLTR_ISAPNP_ID � RF_CALLBACK f � DPFLTR_CNG_ID % { VerifyProcessorPowerPolicyDc ) PsProtectedTypeMax % ! SecureSettingValueTypeString 7 E TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL � ComputerNameMax + � � SystemVmGenerationCountInformation - +X JOB_OBJECT_NET_RATE_CONTROL_DSCP_TAG � g MaxProcessInfoClass � ( WinAccountKrbtgtSid ) � � SystemWriteConstraintInformation $ � ThreadWorkloadClassGraphics f g DPFLTR_DFSC_ID # �' LoadReasonStaticDependency / j JobObjectSchedulingRankBiasInformation $ � SubsystemInformationTypeWSL � ToleranceIntervalMedium ' �' PMETypeFailFastOnCommitFailure �! VmPrefetchInformation ) � � SystemElamCertificateInformation 1 � � SystemCriticalProcessErrorLogInformation ' �* PoSleepDisableReasonHypervisor S MaxPnpQueryRelations EventSecurityMax �$ KeyAdded / � � SystemCombinePhysicalMemoryInformation " K ProfileBranchInstructions * FeatureVariantPayloadKindResident � JournalDeleteValue . CacheData � ; SystemComPlusPackage f U DPFLTR_LDR_ID F> MemoryLocationPagefile 8 P WorkerFactoryCallbackDetectedUnrecoverableError { ProcessorPerfStates / � SE_WS_APPX_SIGNATURE_ORIGIN_ENTERPRISE = FpCompareLess � FileDispositionInfoEx # K ProfileMemoryBarrierCycles ProcessASLRPolicy . e) SystemMemoryPartitionInitialAddMemory �5 MemoryRegionInformation M SYSTEM_HANDLE_FILE - P TransactionManagerLogPathInformation 2 �/ SystemFeatureConfigurationSectionTypeBoot c+ GetFileExMaxInfoLevel ( i DISPLAYCONFIG_TOPOLOGY_EXTERNAL � IoSessionStateMax � IoSessionStateLoggedOff " � EventProviderSetReserved1 ( �* DISPLAYCONFIG_PIXELFORMAT_16BPP 3 .@ DISPLAYCONFIG_MODE_INFO_TYPE_DESKTOP_IMAGE � FileStreamInfo �( RtlBsdItemAabEnabled ) � 9 WinBuiltinPerfMonitoringUsersSid % � PNP_VetoIllegalDeviceRequest 0 ) * MonitorRequestReasonPdcSignalHeyCortana & FeatureVariantPayloadKindNone f � DPFLTR_DRIVEEXTENDER_ID F> MemoryLocationReserved �[ MemoryRegionInfo ; PerfCSwapFull $ � RtlSparseBitmapOperationMax � RF_KERNEL_DYNAMIC - � � SystemActivityModerationUserSettings , � FileStorageTierMediaTypeUnspecified f % DPFLTR_SCSERVER_ID { K PlatformRole - � SystemScrubPhysicalMemoryInformation � + ReservedForDVRF43 � SidTypeComputer ! � 3 ProcessHandleInformation / �
PlugPlayControlGetInterfaceDeviceAlias ! % PsWakeReasonWorkOnBehalf f 9 DPFLTR_IDEP_ID . � g WinAuthenticationAuthorityAssertedSid U WaitDequeue $ � Z ProcessDebugAuthInformation KeyNodeInformation v LdrModulesReadyToRun �"
WdActionMarkHiberPhase ~ FileInternalInformation " �! VmPagePriorityInformation $ � \ SystemVerifierInformationEx % ~ G FileCaseSensitiveInformation " � VrfAdditionalDDIRuleClass � PowerSystemHibernate + � � SystemDifClearRuleClassInformation FpCodeCabs " � F WinWriteRestrictedCodeSid # �" EtwProviderTraitDecodeGuid # � � SystemFwRamdiskInformation ~ FileLinkInformation , � PS_MITIGATION_OPTION_BOTTOM_UP_ASLR ; ) ( MonitorRequestReasonPdcSignalWindowsMobilePwrNotif ! � JournalCommitTransaction � VrfAdvancedMMRuleClass " � $ VrfStandalonePlatformMode $ �* COPYFILE2_PHASE_SERVER_COPY �& LdrpWebDAV $ 5 DEBUG_CONTROL_SPACE_MAXIMUM ! � F SystemObjectSecurityMode + e) SystemMemoryPartitionSetAttributes � PsProtectedSignerNone � PNPBus ! � IMAGE_COR_MIH_BASICBLOCK �
WinBatchSid { 6 ProcessorPerfCapHv 6 ImagePolicyIdSvn � LockQueueIoCancelLock $ ~ # FileAttributeTagInformation ) A EtwNotificationTypePrivateLogger � ProcessPriorityBoost �! TransactionStateNormal # � SystemInterruptInformation 1 A EtwNotificationTypeFilteredPrivateLogger � FpFormatFp32 BackTraceDatabaseFlush � MPSABus + ) MonitorRequestReasonThermalStandby ] SysDbgWriteBusData * �* COPYFILE2_PHASE_WRITE_DESTINATION f ) DPFLTR_UHCD_ID � x� m
t __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinGEUkivxlnkOlyq@elfapi # �$ _KEY_VALUE_INFORMATION_CLASS H WMI_PROCESS_INFORMATION64 $ �^ PHEAP_AFFINITY_MANAGER_ENABLE * 5C _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 * q5 _SYSTEM_KERNEL_DEBUGGER_INFORMATION ' �^ PCACTIVATION_CONTEXT_QUERY_INDEX K �[ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL u UINT � MENUITEMINFO g8 ALTTABINFO �^ PSYSDBG_LIVEDUMP_CONTROL �^ PXSAVE_FORMAT � ENUM_SERVICE_STATUSW �^ PGENERIC_MAPPING 7 � _RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY ! �B _RTL_UNICODE_STRING_BUFFER �8 HARDWARE_COUNTER_DATA �^ ANON_OBJECT_HEADER_BIGOBJ + �0 PERFINFO_YIELD_PROCESSOR_INFORMATION ( �^ PSYSTEM_ALARM_CALLBACK_OBJECT_ACE K _SE_AUDIT_OPERATION - �^ PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX �^ PFILE_ID_TYPE �+ PMOUSEHOOKSTRUCT I TIMEFMT_ENUMPROCA ! �= POINTER_DEVICE_CURSOR_TYPE �^ PFILE_PIPE_PEEK_BUFFER �^ HKEY $ LPCDLGTEMPLATEA & � EVENT_HEADER_EXTENDED_DATA_ITEM PRTL_REFERENCE_COUNT32 �^ PFP_128 , CX _SYSTEM_BASIC_PERFORMANCE_INFORMATION �^ RTL_AVL_FREE_ROUTINE w AUDIT_EVENT_TYPE ( �8 LOOKUP_STREAM_FROM_CLUSTER_OUTPUT �6 HOT_PATCH_IMAGE_INFO �@ PTPP_START_ROUTINE �^ LPENUMLOGFONTA �T WCRANGE ) �^ PACCESS_DENIED_CALLBACK_OBJECT_ACE 7 �^ PIMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION \ ALPC_PORT_ATTRIBUTES . H _DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE z tagMOUSEMOVEPOINT �^ PINPUT_INJECTION_VALUE % }> _MANAGE_HOT_PATCH_UNLOAD_PATCH , � PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA # v _QUERY_STORAGE_RESERVE_INPUT �^ PFILE_COMPRESSION_INFO �^ NPWNDCLASSEX ! T _ETW_THREAD_AFFINITY_EVENT ' �^ PPUBLIC_OBJECT_BASIC_INFORMATION �^ PIPT_TRACE_EVENT_DATA ', PCUZZWSTR / K; _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE $ �^ PSYSTEM_HANDLE_INFORMATION_EX �0 _Wx86ThreadState �S _FILE_PIPE_INFORMATION I7 _QUOTA_LIMITS $ �^ PSYSTEM_NET_RATE_CONTROL_TYPE �^ WAITORTIMERCALLBACKFUNC �A DESIGNVECTOR " PLOGICAL �^ PVRF_RULE_CLASS_ID � uint8x8x4_t �^ DISPLAYCONFIG_RATIONAL �F _ETW_HEAP_EVENT_SNAPSHOT @: IMAGE_ENCLAVE_IMPORT 4 �+ _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION 3 tagMETAHEADER 0 ;! tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION " PLCID ' �] SYSTEM_BOOT_GRAPHICS_INFORMATION ( ]W RTL_DYNAMIC_TIME_ZONE_INFORMATION _TRIVERTEX #X _PERFINFO_CC_FLUSH_CACHE F6 LPTEXTMETRICW �5 _WNF_STATE_NAME
PPVOID $. _DEDUP_FILE_OPERATION �^ PETW_SET_MARK_INFORMATION ! �4 CS_TYPE_LOCAL_SIZE_ROUTINE g MUTANT_BASIC_INFORMATION �' MENUBARINFO ) PS_PROTECTED_TYPE �^ PPLEX_READ_DATA_REQUEST ! �^ PSYSTEM_HANDLE_INFORMATION
U KEY_NAME_INFORMATION / PR JOURNAL_TRANSACTION_BOUNDARY_INFORMATION " J _RTL_HEAP_MEMORY_LIMIT_INFO �& RTL_HANDLE_TABLE_ENTRY @C ENCRYPTION_BUFFER & �0 _SYSTEM_PAGEFILE_INFORMATION_EX * � _SYSTEM_VERIFIER_TRIAGE_INFORMATION �/ WMI_QUEUE + . _PROCESS_HANDLE_SNAPSHOT_INFORMATION �S PROCESS_INFORMATION �^ ENUMRESNAMEPROCA � PEMRSETBKMODE p PTCH + �A JOBOBJECT_EXTENDED_LIMIT_INFORMATION : _PROCESSOR_IDLE_STATE �^ LPDISPLAY_DEVICE �^ PRPC_INTERFACE_TEMPLATEA
! FSHORT PSECURITY_DESCRIPTOR ; �X _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION # �, REFS_DEALLOCATE_RANGES_RANGE �S EVENT_FILTER_LEVEL_KW - C PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE 2 : _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION x! OSVERSIONINFO PLANGSPEC �X _MUILANGLIST # 8 LPPROC_THREAD_ATTRIBUTE_LIST " FLONG m DUPLICATE_EXTENTS_DATA , �> _CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT �^ PKEY_TRUST_INFORMATION $ �^ PCM_DISK_GEOMETRY_DEVICE_DATA �^ PTP_WAIT � int32x2x4_t / �C _PROCESS_READWRITEVM_LOGGING_INFORMATION � _RTL_HEAP_ENTRY " �^ PEMRCREATEDIBPATTERNBRUSHPT �^ PIMAGE_OS2_HEADER # �^ PKEY_HANDLE_TAGS_INFORMATION + �< CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 % �^ PCOMPATIBILITY_CONTEXT_ELEMENT l/ _RPC_SECURITY_QOS_V4_W �^ PETW_TP_EVENT_TIMER_SET .\ RETRIEVAL_POINTER_BASE �^ PRID_DEVICE_INFO_HID ! �+ tagINPUT_MESSAGE_ORIGIN_ID �^ PIMAGE_DOS_HEADER !^ IMAGE_OS2_HEADER �^ LPCONNECTDLGSTRUCT � KHETERO_CPU_POLICY �D EMRSTROKEPATH � _TP_CALLBACK_PRIORITY �6 TP_WAIT �^ LPSHELLHOOKINFO $ 8 ETW_CREATEDELETE_OBJECT_EVENT
q NWPSTR .\ _RETRIEVAL_POINTER_BASE �^ PSYSTEM_ALARM_OBJECT_ACE �/ LPOSVERSIONINFOW �9 VIDEO_RECORD !^ _IMAGE_OS2_HEADER ) LPPATTERN �- PEMRPOLYLINE �U ICONMETRICSW $ �B _PERFINFO_CC_WORKITEM_DEQUEUE * �^ PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER � _SECTION_INHERIT ( �^ PCREDIRECTION_FUNCTION_DESCRIPTOR �^ PSERVICE_NOTIFY_2W $ �^ PETW_COVERAGE_SAMPLER_OPTIONS �^ PRTLP_START_THREAD bY _LDR_IMPORT_CALLBACK_INFO lV _SECURITY_SEED_AND_LENGTH " [1 _PROCESS_WINDOW_INFORMATION MY LPWNDCLASSEXA ! �^ LPSERVICE_FAILURE_ACTIONSA . �^ PPLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA # OUTLINETEXTMETRIC 2 6- JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 3 �0 SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION s0 LPCONTEXT ' � EVENT_TRACE_SPINLOCK_INFORMATION �^ PSYSTEM_VDM_INSTEMUL_INFO �S NPEXTLOGFONTA �; _MMPFN_IDENTITY ) �^ PACTIVATION_CONTEXT_NOTIFY_ROUTINE �^ HICON & �^ PPROCESS_POWER_THROTTLING_STATE * �U _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY & ~ FILE_FS_DRIVER_PATH_INFORMATION ' �^ DISPLAYCONFIG_DESKTOP_IMAGE_INFO # �^ PDUPLICATE_EXTENTS_DATA_EX32 + ^/ SERVICE_CONTROL_STATUS_REASON_PARAMS �^ PMESSAGE_TRACE_HEADER �G _cpinfoexA E[ _WMI_WAIT_OBJECT_RECORD �^ PKINTERRUPT_ROUTINE t _RTL_DYNAMIC_HASH_TABLE �0 LPICONMETRICSA �$ STYLEBUFA �" _WATCHDOG_HANDLER_ACTION ' D\ RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR # HANDLE_PTR lU _RTL_MODULE_EXTENDED_INFO 3 F SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE �^ PHKEY �0 LPPROCESS_HEAP_ENTRY 5 �^ PPROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY Z5 EISA_MEMORY_CONFIGURATION �0 OBJECT_TYPE_LIST ) �[ _SYSTEM_PREFETCH_PATCH_INFORMATION ) �^ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR - �5 SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 % �^ PSYSTEM_OBJECTTYPE_INFORMATION .6 tagTITLEBARINFO � _STRING64 cB _PROCESS_PRIORITY_CLASS �C _MCA_EXCEPTION zA NPSTYLEBUFW �^ PRTL_AVL_MATCH_FUNCTION ' \ _PERFINFO_SAMPLED_PROFILE_CONFIG �" _SECURITY_DESCRIPTOR & "E _ALPC_MESSAGE_INFORMATION_CLASS O" _FILE_STREAM_INFORMATION ' TRACE_LOGFILE_HEADER32
p PSZ �^ PETW_OBJECT_TYPE_EVENT �^ PSID_IDENTIFIER_AUTHORITY ' ~5 LOOKUP_STREAM_FROM_CLUSTER_INPUT �U _KTMOBJECT_CURSOR % �Z RTL_USER_PROCESS_INFORMATION64 " GEOTYPE F _CONSOLE_CURSOR_INFO " � PERFINFO_DEBUG_EVENT_REASON H- _CM_MONITOR_DEVICE_DATA ! ^ PPERFINFO_MARK_INFORMATION b) IO_SESSION_EVENT . HW_PROFILE_INFO ~^ PTHREAD_BASIC_INFORMATION ) � SYSTEM_VERIFIER_TRIAGE_INFORMATION - SYSTEMTIME ) �F _WIM_PROVIDER_REMOVE_OVERLAY_INPUT }^ PSL_HWID_DEVICE_INFO j CRITICAL_SECTION_DEBUG |^ PISID | WIN32_FIND_DATA H( PEMRPOLYLINE16 {^ PMUILANGLISTNODE z^ PTRACE_GUID_REGISTRATION y^ PMESSAGE_TRACE ! x^ PEMREXTCREATEFONTINDIRECTW w^ PEVENT_DATA_DESCRIPTOR % v^ PPROCESS_DEVICEMAP_INFORMATION / �+ _PROCESS_REVOKE_FILE_HANDLES_INFORMATION u^ PVRF_TRIAGE_CONTEXT � ACTCTXA t^ PETW_HEAP_EVENT_COMMON s^ PCONTEXT . r^ PFILE_DESIRED_STORAGE_CLASS_INFORMATION �G PLUGPLAY_NOTIFY_HDR q^ POSVERSIONINFO J( EMRPOLYBEZIERTO16 �% PERFINFO_CCSWAP_IDLE �& DISPATCHER_CONTEXT_ARM64 �\ _FILE_STORAGE_TIER A L] _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC p^ LPLC_ID ) �U IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY o^ PFIND_BY_SID_OUTPUT - �D STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST n^ PRTL_DYNAMIC_HASH_TABLE Z* NPPOLYTEXTA * �! _RTL_ACTIVATION_CONTEXT_STACK_FRAME " �R _ADMINISTRATOR_POWER_POLICY . m^ PMEMORY_PARTITION_ATTRIBUTE_INFORMATION $ l^ PTRACE_ENABLE_FLAG_EXT_HEADER Q? _BOOT_AREA_INFO �+ LPPOWER_REQUEST_CONTEXT 4 H _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE " != CLAIM_SECURITY_ATTRIBUTE_V1 2 k^ PPROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION $ " SYSTEM_FIRMWARE_TABLE_HANDLER j^ PIO_RESOURCE_DESCRIPTOR 2 LPGLYPHMETRICSFLOAT f STREAM_EXTENT_ENTRY ! CA _TXFS_QUERY_RM_INFORMATION j _JOBOBJECTINFOCLASS g^ PPERFORMANCE_DATA % f^ PFILE_FS_ATTRIBUTE_INFORMATION Q _COMMTIMEOUTS $ �& _FILE_ID_FULL_DIR_INFORMATION SHANDLE_PTR e^ PKLDR_DATA_TABLE_ENTRY �U STARTUPINFOEX 0 d^ PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE ^ HPALETTE__ | WIN32_FIND_DATAA �X VALENTW % 1% _SERVICE_LAUNCH_PROTECTED_INFO c^ POBJECT_ATTRIBUTES32 KIRQL ! +C JOURNAL_CLIENT_INFORMATION b^ WNDPROC Q8 _IMAGE_AUX_SYMBOL_EX - a^ PJOBOBJECT_LIMIT_VIOLATION_INFORMATION *
E _SYSTEM_PROCESSOR_POWER_INFORMATION ! U _RTL_TIME_ZONE_INFORMATION Z$ _ETW_UMGL_KEY DD PWINDOWPOS � _TRACE_LOGFILE_HEADER64 `^ PCACCESS_MASK ^^ PSD_ENUM_SDS_ENTRY �* REPARSE_GUID_DATA_BUFFER ; ]^ PRTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY �Z LPBITMAPFILEHEADER " \^ PETW_TIMER_EXPIRATION_EVENT $ 0 ETW_SESSION_NOTIFICATION_TYPE & �Y _FSCTL_QUERY_REGION_INFO_OUTPUT �Y _SYSDBG_TRIAGE_DUMP " �> RTL_IMAGE_MITIGATION_POLICY }V _PERFINFO_MARK_EVENT V? LUID_AND_ATTRIBUTES_ARRAY . [^ PMEMORY_PARTITION_NODE_PAGE_INFORMATION % Z^ PKEY_VALUE_PARTIAL_INFORMATION - LPOSVERSIONINFOEX2W G H. _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING " Y^ PCACTCTX_SECTION_KEYED_DATA �5 WMI_PNP_RECORD_V4 $ �@ _SILOOBJECT_BASIC_INFORMATION W^ LPMEMORYSTATUSEX V^ PRPC_SEC_CONTEXT_KEY_INFO ) � _RESOURCEMANAGER_INFORMATION_CLASS }+ MDINEXTMENU " )Z ETW_COVERAGE_SAMPLER_STATUS U^ PCACTCTXW * rU SYSTEM_FEATURE_CONFIGURATION_UPDATE ( OFSTRUCT � _OVERLAPPED_ENTRY ~' HELPWININFOW :G MUIREGISTRYINFO & �= _ACTIVATION_CONTEXT_QUERY_INDEX { _WMI_THREAD_INFORMATION 0 Q^ PIMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER �/ EMRTRANSPARENTBLT �] LPHARDWAREINPUT O^ PCOVERAGE_MODULE_INFO N^ PRTL_SPARSE_BITMAP_RANGE ) M^ PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT L^ PEMRTRANSPARENTBLT �( tagMEASUREITEMSTRUCT , F _EVENT_TRACE_PROFILE_LIST_INFORMATION $ �9 _SYSTEM_TIMEOFDAY_INFORMATION % K^ PNTPSS_MEMORY_BULK_INFORMATION " POINTER_INPUT_TYPE -W PAGEDIR_INFORMATION ) J^ PEVENT_EXTENDED_ITEM_STACK_TRACE64 I^ PHEAP_SUMMARY ! W PS_BNO_ISOLATION_PARAMETER ' �: REMOTE_LINK_TRACKING_INFORMATION H^ PPO_WAKE_SOURCE_DEVICE u, _POWER_PLATFORM_ROLE -D PORT_INFORMATION_CLASS q" LPPAINTSTRUCT ' �T _PROCESS_LEAP_SECOND_INFORMATION 2 G^ PPROCESS_MITIGATION_BINARY_SIGNATURE_POLICY �V SUPPORTED_OS_INFO �- _MEMORY_RESERVE_TYPE 0 F^ PJOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 V _REPARSE_INDEX_KEY ) E^ PRTL_FEATURE_ENABLED_STATE_OPTIONS Z/ CI_WINDOWS_LOCKDOWN_MODE $ 9Z FILE_FS_ATTRIBUTE_INFORMATION tagENUMLOGFONTW ( �] _SYSTEM_BOOT_GRAPHICS_INFORMATION ( D^ PEVENT_EXTENDED_ITEM_PMC_COUNTERS " C^ PPERFINFO_IDLE_STATE_CHANGE D �! _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED &$ tagLOCALESIGNATURE �; PLOGPALETTE �1 MINMAXINFO P IMEMENUITEMINFOA handle_t 4 M _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION �" PERFINFO_CCSWAP_BUFFER B^ PCSV_MGMT_LOCK 1 �D _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX ( A^ PRTL_FEATURE_CONFIGURATION_UPDATE @^ PMCA_EXCEPTION ?^ PRTL_HASH_TABLE �< tagEMRFILLRGN $ �S FILE_FS_FULL_SIZE_INFORMATION $ �V PERFINFO_SET_POWER_ACTION_RET WB MUILANGINFO $ �V PROCESS_MITIGATION_DEP_POLICY & THREAD_ENERGY_VALUES ' ]S _FILE_END_OF_FILE_INFORMATION_EX �R _PORT_VIEW n PBITMAPCOREHEADER � FIBER 1 >^ PPLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED � TABLE_SEARCH_RESULT ) >0 SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT =^ PRTL_RVA_LIST p' RTL_CRITICAL_SECTION ' �: _HEAP_BLOCK_SETTABLE_INFORMATION <^ LPENCLAVE_ROUTINE ] PPALETTEENTRY " U! _BY_HANDLE_FILE_INFORMATION OU BLENDFUNCTION ;^ NOTIFICATIONCALLBACK 7^ HWINSTA g tagENHMETAHEADER �% _SYSTEM_POOL_ENTRY ' 6^ PCACTCTX_SECTION_KEYED_DATA_2600 RPC_SECURITY_QOS_V2_W 4^ LPSTYLEBUF 3^ PIMAGE_DEBUG_MISC $ � _SYSTEM_NET_RATE_CONTROL_TYPE � DIBSECTION ' �< _PROCESS_HANDLE_TABLE_ENTRY_INFO 2^ LPCOMMCONFIG 1^ PEMRALPHABLEND �V MONITORINFOEXW * tR _PROCESS_EXTENDED_BASIC_INFORMATION % r _TRANSACTION_BASIC_INFORMATION 0^ LPAXESLIST /^ EXCEPTION_ROUTINE .^ PTP_LOG_ROUTINE u DWORD32 " �Z ENCLAVE_INIT_INFO_VBS_BASIC 8 +^ PASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_ROUTINE �9 tagBITMAP �9 TRACKMOUSEEVENT � _MIDL_METHOD_PROPERTY # c0 FILE_SFIO_VOLUME_INFORMATION '^ PKTMOBJECT_TYPE + X; _EVENT_TRACE_PERFORMANCE_INFORMATION � _PROCESSINFOCLASS �' _PROCESS_EXCEPTION_PORT �E ETW_HEAP_EVENT_FREE r _PORT_MESSAGE ) &^ PSYSTEM_POWER_STATE_DISABLE_REASON , � SYSTEM_PROCESSOR_FEATURES_INFORMATION ) (/ _SYSTEM_PROCESSOR_IDLE_INFORMATION �S PEXTLOGFONTA %^ LANGGROUPLOCALE_ENUMPROCW X3 _ACL ) W PERFINFO_FILENAME_SAME_INFORMATION ^ PUIMAGE_OS2_HEADER / �6 _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION K@ PEMRABORTPATH % I' _IMAGE_LOAD_CONFIG_DIRECTORY64 �# _OBJECT_NAME_INFORMATION Q+ _RTL_BITMAP ) � CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG % _TRANSACTION_INFORMATION_CLASS <E tagHW_PROFILE_INFOW ^ PEMRPOLYDRAW16 ^ LPCDLGTEMPLATE ^ PCSV_QUERY_MDS_PATH �Y PMSGBOXPARAMSW " h! _PERFINFO_CCSWAP_IDLE_SHORT ^ PWMI_TRACE_PACKET # ^ PTOKEN_SECURITY_ATTRIBUTE_V1 &5 _HARDERROR_MSG % ^ PGET_RUNTIME_FUNCTION_CALLBACK ^" FP_IEEE_ROUNDING_MODE �( CPU_SET_INFORMATION_TYPE ^ PEVENTSFORLOGFILE ^ LPCLIENTCREATESTRUCT + �U JOBOBJECT_IO_ATTRIBUTION_INFORMATION �@ _RTL_HEAP_INFORMATION & �, PUBLIC_OBJECT_BASIC_INFORMATION ( ^ PDELAYLOAD_FAILURE_SYSTEM_ROUTINE + ^ PCSV_QUERY_FILE_REVISION_FILE_ID_128 ^ PGESTUREINFO �* PEXTLOGPEN32 � TEB_ACTIVE_FRAME , _CM_PARTIAL_RESOURCE_LIST " ^ RTL_GENERIC_COMPARE_ROUTINE D- _FINDEX_INFO_LEVELS �@ RTL_RXACT_CONTEXT # ^ PETW_COVERAGE_SAMPLER_SAMPLE M3 _SYSTEM_ALARM_ACE 0 ENUMLOGFONTEXDVW
^ HPALETTE �' _ICONINFOEXW - �S _FILE_FS_PERSISTENT_VOLUME_INFORMATION �V PEMRRECTANGLE �R PORT_VIEW # �> _RTL_IMAGE_MITIGATION_POLICY �' _FILE_ID_TYPE �" tagENUMTEXTMETRICW ^ PWNODE_METHOD_ITEM ! � _RPC_HTTP_REDIRECTOR_STAGE ^ PAUDIT_EVENT_TYPE 4> CM_EXTENDED_PARAMETER ^ PLOAD_ASDATA_TABLE ^ PEXCEPTION_RECORD32 ' ^ PFILE_END_OF_FILE_INFORMATION_EX � PSE_TOKEN_USER x _UNICODE_STRING �Z PEMREXCLUDECLIPRECT " ^ PPPM_PERFSTATE_DOMAIN_EVENT �$ APPCONTAINER_SID_TYPE ^ LPCMENUITEMINFO rB CI_LOG_MMCSS_START � tagGESTURENOTIFYSTRUCT e; EVENT_INSTANCE_HEADER s; FILE_LAYOUT_NAME_ENTRY ^ PTP_TASK_CALLBACKS ETW_BUFFER_STATE �S IMAGE_IMPORT_BY_NAME l\ _NON_PAGED_DEBUG_INFO " SAVEPOINT_ID tagRAWMOUSE * ^ RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W �F _CI_LOG_SCHEDULER_WAKEUP /0 tagNCCALCSIZE_PARAMS E[ WMI_WAIT_OBJECT_RECORD � _SYSTEM_VERIFIER_ISSUE WIN32_FIND_DATAW ^ LPTTPOLYCURVE �] PKEY_EVENT_RECORD W TOKEN_LINKED_TOKEN " J _POWER_PLATFORM_INFORMATION 4 �C SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION �\ STUB_THUNK �T tagINPUT_MESSAGE_SOURCE �? _SYSTEM_BASIC_INFORMATION K@ PEMRENDPATH < _COVERAGE_SECTION_HEADER ! �B tagTOUCH_HIT_TESTING_INPUT POOLINDEX �5 _WMI_PNP_RECORD_V4 �5 _SYSTEM_NUMA_INFORMATION � FILE_INFO_BY_HANDLE_CLASS TRIVERTEX �] PEMRSETWORLDTRANSFORM �1 _ETW_STACK_CACHING_CONFIG �] PTOKEN_ELEVATION_TYPE WU _TOKEN_PRIVILEGES �] PFAT_STATISTICS
�( PPOINT �8 _POINTFLOAT �* tagDRAWITEMSTRUCT 3 �@ _IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION �] PWNF_DELIVERY_DESCRIPTOR & �] PPROCESS_EXTENDED_ENERGY_VALUES ( RTL_FEATURE_ENABLED_STATE_OPTIONS �Y PIMEMENUITEMINFOW 9; TIMEFMT_ENUMPROCEX # �] PETW_KERNEL_HEADER_EXTENSION ) }B _SYSTEM_ENTROPY_TIMING_INFORMATION �? PDLGITEMTEMPLATEW zA PSTYLEBUFW F& CSV_QUERY_REDIRECT_STATE " �Y RTL_ALLOCATE_STRING_ROUTINE �] LPNETINFOSTRUCT �Z _RGNDATAHEADER �D LPNONCLIENTMETRICSA �U ETW_WNF_EVENT_PUBLISH ! A _WIN32_FILE_ATTRIBUTE_DATA �] SC_HANDLE $ �B _WIM_PROVIDER_START_INTEGRITY 5 NPWNDCLASSA �W _TOKEN_CONTROL $ �] RTL_UMS_SCHEDULER_ENTRY_POINT �? EVENT_TRACE $ D7 RPC_BINDING_HANDLE_OPTIONS_V1 " �% ACCESS_ALLOWED_CALLBACK_ACE 1H TOKEN_PRIMARY_GROUP ' g4 FILE_REMOTE_PROTOCOL_INFORMATION � _SYSTEM_POWER_POLICY & SYSTEM_VA_TYPE /
JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V1 �3 _FILE_REGION_OUTPUT �] PIRQ_GROUP_POLICY �R tagEMRRESIZEPALETTE . �] PEVENT_EXTENDED_ITEM_RELATED_ACTIVITYID ! �] PPROCESS_BASIC_INFORMATION �] PFILE_FULL_EA_INFORMATION g# WMI_BUFFER_HEADER / �S _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA - �] PCACTIVATION_CONTEXT_BASIC_INFORMATION 7= tagCBT_CREATEWNDA RPC_BINDING_HANDLE $ �] PPERFINFO_PAGE_RANGE_IDENTITY �] PHIBERFILE_BUCKET_SIZE �+ MOUSEHOOKSTRUCT 0U WNF_DELIVERY_DESCRIPTOR <B _IMAGE_FUNCTION_ENTRY64 $ �] PCONSOLE_SCREEN_BUFFER_INFOEX �# tagWNODE_TOO_SMALL , �] PSYSTEM_HYPERVISOR_DETAIL_INFORMATION � KCRM_PROTOCOL_BLOB J( EMRPOLYGON16 - _SYSTEMTIME U EVENT_RECORD ( i5 EVENT_TRACE_IPT_EVENT_INFORMATION �] PENCLAVE_INIT_INFO_VBS �] PRPC_SECURITY_QOS_V3_A ?[ _WMI_RESOURCE $ �] PDEFINE_STORAGE_RESERVE_INPUT $ N _SharedVirtualDiskHandleState * FAT_STATISTICS n' LPCRITICAL_SECTION_DEBUG �] PMIDL_STUB_DESC LRESULT $ tagENUMLOGFONTEXDVA o= EMREXTCREATEPEN �= PS_CPU_QUOTA_QUERY_ENTRY �# PS_STD_HANDLE_STATE �] PEMREXTSELECTCLIPRGN ! �R _KEY_SET_LAYER_INFORMATION # �] PBAD_MEMORY_CALLBACK_ROUTINE �2 tagCIEXYZ �E tagPOLYTEXTW �] PUSAGE_PROPERTIES �Z GROUP_RELATIONSHIP �6 _SYSTEM_PREFETCH_STATS �] LPNLSVERSIONINFO �G _DECRYPTION_STATUS_BUFFER �& PARM64_NT_CONTEXT �] PPOWER_MONITOR_INVOCATION $ �] PETW_TP_EVENT_TIMER_CANCELLED �E MALLOC_FREE_STRUCT ) �] PEVENT_EXTENDED_ITEM_STACK_TRACE32 * �] PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX zY PFN_NT_COMMIT_TRANSACTION �2 CBT_CREATEWNDW �B LDR_DATA_TABLE_ENTRY32 " � _SUBSYSTEM_INFORMATION_TYPE �] PREQUESTER_TYPE �X PLOGBRUSH32 ) �V _STREAMS_ASSOCIATE_ID_INPUT_BUFFER . �] PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS ]% _XSTATE_FEATURE 3 �# SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION " �G I_RpcProxyCallbackInterface � _LUTF8_STRING % �- COVERAGE_UNLOADED_MODULE_ENTRY �] PWMIREGINFOW F RTL_CIRCULAR_LIST_ENTRY $ 84 _ETW_UMS_EVENT_CONTEXT_SWITCH , /, _JOURNAL_SET_KEY_SECURITY_INFORMATION �] PIMAGE_EXPORT_DIRECTORY % 3@ SYSTEM_CPU_SET_TAG_INFORMATION INT64 ' %S RTL_IMAGE_MITIGATION_HEAP_POLICY , �] PEVENT_TRACE_HEAP_TRACING_INFORMATION OH ALPC_SERVER_INFORMATION I A ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING �' tagMENUBARINFO �% PCOMPOSITIONFORM / +( IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER �$ _RTL_AVL_TABLE # �@ _COMPOUND_ACCESS_ALLOWED_ACE / &+ _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 - � SECURE_SPECULATION_CONTROL_INFORMATION G5 CREATE_THREAD_DEBUG_INFO mG HENHMETAFILE__ �9 WMI_DISKIO_FLUSH_BUFFERS d9 PROCESS_JOB_MEMORY_INFO " t IMAGE_ARCHIVE_MEMBER_HEADER �] PLUID_AND_ATTRIBUTES �U _CSV_MGMT_LOCK . = _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA $ WR _PROCESS_AFFINITY_UPDATE_MODE �] PBULK_SECURITY_TEST_DATA 1 �4 _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY ( }B SYSTEM_ENTROPY_TIMING_INFORMATION ) �] PPROCESS_CHILD_PROCESS_INFORMATION �, LPLOGPEN % �] PIMAGE_DYNAMIC_RELOCATION64_V2 4 _PATHNAME_BUFFER " �% _UNIQUE_PROCESS_INFORMATION & h? _FILE_PIPE_CREATE_SYMLINK_INPUT �] PEMRDRAWESCAPE ( �] PRPC_BINDING_HANDLE_TEMPLATE_V1_W �] PWMI_IMAGEID_INFORMATION & PSECURITY_CONTEXT_TRACKING_MODE ' ) _QUERY_PERFORMANCE_COUNTER_FLAGS ( �] PSYSTEM_BOOT_GRAPHICS_INFORMATION " �] PRTL_QUERY_REGISTRY_ROUTINE � PPOINTS �1 tagMINMAXINFO LSTATUS �! poly8x16x3_t �W POWER_SESSION_CONNECT ! �] PTP_TASK_UNPOSTED_CALLBACK �A tagDESIGNVECTOR # �T _FILE_FS_CONTROL_INFORMATION A �] PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC ' *? EVENT_EXTENDED_ITEM_PMC_COUNTERS �] PREMOTE_PORT_VIEW � EMRSETTEXTALIGN ? _WMI_UDP % P9 _ETW_TP_EVENT_TIMER_EXPIRATION # �D PERFINFO_DOMAIN_CHANGE_EVENT # KSPIN_LOCK $ ENUMLOGFONTEXDVA ) hS _FILE_PIPE_EVENT_ENUM_INPUT_BUFFER zW SL_KMEM_CACHE �] RPC_IF_CALLBACK_FN PD _LBR_TRACE_EVENT_DATA �] PPEB $ �] PTRANSACTION_LIST_INFORMATION m[ _XSAVE_FORMAT ! �X FILE_ZERO_DATA_INFORMATION �= tagENUMUILANG ` int32x4x2_t �B tagEMRALPHABLEND ! �* _HEAP_AFFINITY_SLOT_ASSIGN }V PERFINFO_MARK_EVENT �W USAGE_PROPERTIES �] LPNUMBERFMTA �> _MEMORY_BASIC_INFORMATION z, _SERVICE_NOTIFY_2A " c@ ETW_KERNEL_HEADER_EXTENSION �] PPS_PROTECTED_TYPE 1 IMAGE_FILE_HEADER �Z GENERIC_MAPPING j JOBOBJECTINFOCLASS v _SERVERSILO_STATE �] PPPM_WMI_IDLE_STATES_EX & �/ _ETW_AUTOBOOST_NO_ENTRIES_EVENT %; _KAFFINITY_EX % �] PPROCESS_FOREGROUND_BACKGROUND PROCESS_DISK_COUNTERS �X _FILE_REFERENCE_RANGE �U PS_STD_HANDLE_INFO "V GLYPHMETRICS DEBUGHOOKINFO �] PSYSTEM_TPM_INFORMATION �] PENABLE_TRACE_PARAMETERS zC FILE_OBJECTID_INFORMATION & �] PSYSTEM_HANDLE_TABLE_ENTRY_INFO 2 a TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT " �; _JOBOBJECT_WAKE_INFORMATION $ �] PRTL_RETPOLINE_CHECK_FUNCTION 3 �, PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION $ �] PRTLP_HEAP_SERIALIZED_MAPPING > PSFEATURE_OUTPUT �( CREATESTRUCTW �] GEO_ENUMNAMEPROC �] PETW_REGNOTIF_REGISTER ! �] PETW_IDEAL_PROCESSOR_EVENT �: PERFINFO_PROCESS_PERFCTR �] LPSTARTUPINFOEXA . PFN_SC_NOTIFY_CALLBACK g7 tagTTPOLYCURVE % �& _PERFINFO_PPM_IDLE_STATE_ENTER �] PSTRING �] PHARDWAREINPUT " �] PJOURNAL_CLIENT_INFORMATION ( �- _FILE_NOTIFY_EXTENDED_INFORMATION & QV _RTL_PROCESS_BACKTRACES_CONTROL ' �1 _RTLP_PROCESS_REFLECTION_CONTEXT t PINT
p PCH " [' FILE_COMPLETION_INFORMATION " �] LDR_MANIFEST_PROBER_ROUTINE F/ POWER_MONITOR_INVOCATION #? LPPIXELFORMATDESCRIPTOR & �] PETW_TP_EVENT_TIMER_SET_NTTIMER * �] PSYSTEM_VERIFIER_FAULTS_INFORMATION �] PIMAGE_ENCLAVE_CONFIG32 m? LDR_VERIFY_IMAGE_INFO ? �] PACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA ! �] PREPARSE_POINT_INFORMATION ) �C SYSTEM_VERIFIER_FAULTS_INFORMATION �Y ATOM_TABLE_INFORMATION �] PWNF_TYPE_ID ) �> PFN_RTL_IS_NTDDI_VERSION_AVAILABLE # != _CLAIM_SECURITY_ATTRIBUTE_V1 x _PS_ATTRIBUTE_NUM YX LPDLGTEMPLATEA �E POWER_REQUEST_TYPE �] PRTL_BSD_ITEM_TYPE �Y RPC_SEC_CONTEXT_KEY_INFO ) �] PPERFINFO_DYNAMIC_TICK_VETO_REASON �( SCOPE_TABLE_ARM64 �* tagKBDLLHOOKSTRUCT �] PPOWER_SESSION_RIT_STATE �? PO_WAKE_SOURCE_INTERNAL !
T EMRCREATEDIBPATTERNBRUSHPT " n. ETW_OPTICALIO_FLUSH_BUFFERS ! � UNICODE_PREFIX_TABLE_ENTRY �, RGNDATA �@ DISCDLGSTRUCTA �] PRPC_SECURITY_QOS_V2_A ) �] PETW_COVERAGE_SAMPLER_BLOOM_FILTER # PULONG_PTR 4 �] PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION ) H _EVENT_EXTENDED_ITEM_STACK_TRACE64 & _THREAD_ENERGY_VALUES
:) DCB �+ ENUMLOGFONTEX �6 _NETRESOURCEW $ '7 _FILE_FS_OBJECTID_INFORMATION �] PRTL_UMS_SCHEDULER_REASON
@ SMALL_RECT �] PPOWER_REQUEST_TYPE ) �] PFN_NT_SET_INFORMATION_TRANSACTION =\ IMAGE_POLICY_ENTRY lY PFIBER_CALLOUT_ROUTINE * �] LPSERVICE_REQUIRED_PRIVILEGES_INFOW /X IMAGE_DATA_DIRECTORY " �] PMEMORY_COMBINE_INFORMATION " �] PREQUEST_RAW_ENCRYPTED_DATA ) �] PPERFINFO_VIRTUAL_ALLOC_XPARTITION # �] PTOKEN_GROUPS_AND_PRIVILEGES F _FILE_ID_BOTH_DIR_INFO �] PFILE_REFERENCE_RANGE + DW SYSTEM_PROCESS_INFORMATION_EXTENSION 8> _BOOT_RECORD \; HEAP_INFORMATION_ITEM * �] PCFINDFIRSTACTIVATIONCONTEXTSECTION � MULTIKEYHELPA -
_JOBOBJECT_LIMIT_VIOLATION_INFORMATION $ �X _SYSTEM_LOOKASIDE_INFORMATION - 6 JOURNAL_SET_KEY_USER_FLAGS_INFORMATION �X _PERFINFO_VAD_ROTATE_INFO + �A EVENT_TRACE_HEAP_TRACING_INFORMATION �? PKCRM_TRANSACTION_BLOB # rsize_t $ HARDERROR_RESPONSE $ I' IMAGE_LOAD_CONFIG_DIRECTORY64 c3 FINDEX_SEARCH_OPS + �6 _SYSTEM_DMA_GUARD_POLICY_INFORMATION E _PERFINFO_PO_PRESLEEP ) �] PSYSTEM_REGISTRY_QUOTA_INFORMATION �] LPLOAD_DLL_DEBUG_INFO �R PABCFLOAT � LOGICAL_DISK_EXTENTS �S THREAD_PERFORMANCE_DATA �) LPMULTIKEYHELPW " �] PENTER_STATE_NOTIFY_HANDLER �4 GENERATE_NAME_CONTEXT A PERFORMANCE_DATA yG EMRMODIFYWORLDTRANSFORM % �] PFILE_SFIO_RESERVE_INFORMATION & H _SL_KMEM_CACHE_VALUE_DESCRIPTOR �X _VCN_RANGE_INPUT_BUFFER
m$ LPSIZE �] LPEXTLOGFONT P* ALPC_MESSAGE_ATTRIBUTES { _FILE_GET_EA_INFORMATION COVERAGE_MODULES �" ENUMTEXTMETRICW �] PQUERY_BAD_RANGES_OUTPUT � _SHUFFLE_FILE_DATA �] PLIST_ENTRY64 �Z PACKEDEVENTINFO & �] PWIM_PROVIDER_CONTROL_INTEGRITY �] LPPROGRESS_ROUTINE � PAXISINFOA `E PEMRSTROKEANDFILLPATH # �] PSHARED_VIRTUAL_DISK_SUPPORT % h? FILE_PIPE_CREATE_SYMLINK_INPUT ! N7 QUERY_SERVICE_LOCK_STATUSA & � _PERFINFO_PPM_IDLE_EXIT_LATENCY 5 �] PPROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY � _CSV_NAMESPACE_INFO , �] PSYSTEM_PROCESS_INFORMATION_EXTENSION �] PMESSAGE_RESOURCE_ENTRY % _PS_WAKE_REASON # e) _PARTITION_INFORMATION_CLASS $ �0 _KEY_OPEN_SUBKEYS_INFORMATION �] PSYSTEM_ALARM_ACE $ �) _PROCESS_HANDLE_TRACING_QUERY ET _NTFS_STATISTICS EISA_DMA_CONFIGURATION �] PEMREXTESCAPE & �] PFILE_ATTRIBUTE_TAG_INFORMATION �] PSYSDBG_BUS_DATA ] PTOKEN_USER . tagHW_PROFILE_INFOA ~] LPWNDCLASS # �" _PERFINFO_SYSCALL_ENTER_DATA �@ KEY_VALUE_ENTRY & e2 _ETW_WNF_EVENT_NAME_SUB_RUNDOWN �+ REASON_CONTEXT /C tagEMRGLSBOUNDEDRECORD �V _SUPPORTED_OS_INFO % }] PUMS_SYSTEM_THREAD_INFORMATION & |] PPERFINFO_SET_DEVICES_STATE_RET {] PSL_APPX_CACHE �, ETW_TP_EVENT_POOL_CREATE ' ], FILE_METADATA_OPTIMIZATION_STATE ! � _HARDERROR_RESPONSE_OPTION & z] RTLP_UNHANDLED_EXCEPTION_FILTER PUMS_CONTEXT - �S FILE_NETWORK_PHYSICAL_NAME_INFORMATION �* TIMEFMT_ENUMPROCW � _WMI_WAIT_SINGLE # . _FILE_LINK_ENTRY_INFORMATION # �X SYSTEM_LOOKASIDE_INFORMATION y] PEVENT_RECORD_CALLBACK & x] PCIMAGE_BOUND_IMPORT_DESCRIPTOR V _IO_STATUS_BLOCK v] PWOF_EXTERNAL_INFO �; USER_ACTIVITY_PRESENCE , u] PPLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA Z RTL_HASH_BUCKET_TYPE t] PATOM_TABLE_INFORMATION �9 CM_FLOPPY_DEVICE_DATA ' � JOURNAL_CHANGE_INFORMATION_CLASS # DWORD_PTR - s] PSYSTEM_ISOLATED_USER_MODE_INFORMATION �+ POWER_REQUEST_CONTEXT \ PLAYERPLANEDESCRIPTOR �9 tagNEWTEXTMETRICEXW �G CPU_CONFIG_RECORD & �U _SYSTEM_PROCESS_TRUST_LABEL_ACE * ACCESS_REASONS xV _EXCEPTION_RECORD32 LCSGAMUTMATCH = PMODEMSETTINGS ( i5 EVENT_TRACE_LBR_EVENT_INFORMATION ' �; _ETW_COVERAGE_SAMPLER_PERF_STATS r] LPFILTERKEYS ! 8 IMAGE_DYNAMIC_RELOCATION64 q] PTIME_FIELDS r0 LPEXCEPTION_RECORD OB RPC_SECURITY_QOS_V5_A JS _ACCESS_DENIED_ACE 3A _COMSTAT \* POLYTEXT �S SE_ACCESS_REPLY * �> JOBOBJECT_ASSOCIATE_COMPLETION_PORT $ p] PHEAP_AFFINITY_SLOT_ACTIVATED $ o] PETW_TP_EVENT_POOL_TH_MAX_SET � _MESSAGE_RESOURCE_BLOCK n] PRTL_PROCESS_BACKTRACES �B _OBJECT_TYPES_INFORMATION �! _RPC_STRING �Y DL_EUI48 $ � _PERFINFO_PPM_IDLE_STATE_EXIT ! �E _FILE_FULL_DIR_INFORMATION �/ _MEMORY_WORKING_SET_BLOCK m] PHEAP_INFORMATION_ITEM �9 _VIDEO_RECORD � _ARM64INTR_BARRIER_TYPE # �< JOBOBJECT_JOBSET_INFORMATION l] PWNODE_HEADER
t LONG32 k] PPROCESSOR_RELATIONSHIP , >$ KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 , ) EVENT_EXTENDED_ITEM_PROCESS_START_KEY X9 ETW_OPTICALIO_INIT � FILE_EA_INFORMATION _& HELPINFO % j] PWORKER_FACTORY_CALLBACK_CLASS � _RTL_HASH_TABLE �> RTL_RETPOLINE_BINARY_INFO �( NPPOINT � APP_MEMORY_INFORMATION i] PRPC_ENDPOINT_TEMPLATEW , �W CLAIM_SECURITY_ATTRIBUTES_INFORMATION / �V _FILE_PROCESS_IDS_USING_FILE_INFORMATION G? PPELARRAY [R _MESSAGE_TRACE h] PWOF_VERSION_INFO g] PNLSTABLEINFO f] PWMI_PNP_RECORD_V5 e] PIMAGE_SYMBOL # X _ENCLAVE_LOAD_DATA_VBS_BASIC : TRACE_LOGFILE_HEADER ( c] PPERFINFO_MEMORY_NODE_INFORMATION �E _WMI_LOGGER_INFORMATION �$ float32x4x4_t # O2 _SHRINK_VOLUME_REQUEST_TYPES a] DISPLAYCONFIG_SOURCE_MODE & [ _FILE_STANDARD_LINK_INFORMATION $ _] APPLICATION_RECOVERY_CALLBACK LEARNING_MODE_LOG_LEVEL " ]] PSYSTEM_POOLTAG_INFORMATION LANGINDEX * ,$ DIALOG_CONTROL_DPI_CHANGE_BEHAVIORS % \] PSYSTEM_ACPI_AUDIT_INFORMATION b& LPWNDCLASSW # �$ ETW_COVERAGE_SAMPLER_OPTIONS ( ], _FILE_METADATA_OPTIMIZATION_STATE [] LPCONNECTDLGSTRUCTW �! uint16x8x3_t ! �" FILE_ALIGNMENT_INFORMATION �X PERFINFO_VAD_ROTATE_INFO |6 tagCBTACTIVATESTRUCT ) " JOBOBJECT_INTERFERENCE_INFORMATION �4 tagDRAWTEXTPARAMS �6 NETRESOURCEW # Z] PPROCESS_WORKING_SET_CONTROL Y] PHEAP_RANGE_INFORMATION �G RIP_INFO % ! PROCESS_POWER_THROTTLING_STATE �$ poly16x8x4_t � int16x4x4_t , Z SYSTEM_FIRMWARE_PARTITION_INFORMATION ! !C tagUPDATELAYEREDWINDOWINFO �) _ETW_RT_EVENT_LOSS . ++ _MEMORY_PHYSICAL_CONTIGUITY_INFORMATION �2 tagCBT_CREATEWNDW �V PORT_DATA_ENTRY <9 _COVERAGE_MODULE_REQUEST �! ICONINFOEXA ( �W _PROCESS_DEVICEMAP_INFORMATION_EX �( EVENT_INFORMATION_CLASS zW _SL_KMEM_CACHE X] PCIMAGE_POLICY_ENTRY ! � SUBSYSTEM_INFORMATION_TYPE xX tagAUDIODESCRIPTION p SERVICE_FAILURE_ACTIONS # sV _IMAGE_RESOURCE_DIR_STRING_U -D _PORT_INFORMATION_CLASS 0 � JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL " W] PTXFS_GET_METADATA_INFO_OUT �* PO_SLEEP_DISABLE_REASON - WNF_DLLUNLOAD_CALLBACK � tagPOINTS oD LPEVENTMSGMSG � EMRSETBKMODE T] LPNCCALCSIZE_PARAMS S] PSERVICE_TIMECHANGE_INFO � _SYSTEM_INFORMATION_CLASS . R] PJOBOBJECT_NET_RATE_CONTROL_INFORMATION % � PO_CS_DEVICE_NOTIFICATION_TYPE ! 36 _EVENTLOG_FULL_INFORMATION �< tagENUMLOGFONTA ) �E _SERVICE_REQUIRED_PRIVILEGES_INFOA Q] PRTL_RXACT_CONTEXT �$ TOKEN_TYPE " S _ETW_FINALIZE_KTIMER2_EVENT # � DELETE_STORAGE_RESERVE_INPUT P] PKEY_FLAGS_INFORMATION O] PCACTIVATION_CONTEXT " PUCSSTR wD SINGLE_LIST_ENTRY32 n" QUERY_FILE_LAYOUT_OUTPUT @ L] RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC I] HMETAFILE $ 7 _ETW_PROCESS_HANDLE_INFO_TYPE ! H] PCPS_SYSTEM_DLL_INIT_BLOCK 1 F] PSYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION �Z SEC_WINNT_AUTH_IDENTITY_W & CI_LOG_SCHEDULER_SLEEP_RESPONSE & �+ _PERFINFO_FILE_SIMPLE_OPERATION
� PUWSTR E] PUSN_RECORD_V3 ' {@ TIMER_SET_COALESCABLE_TIMER_INFO % �U _SYSTEM_OBJECTTYPE_INFORMATION D] PFILE_LINKS_INFORMATION + C] PSYSTEM_SYSTEM_PARTITION_INFORMATION �V tagHARDWAREHOOKSTRUCT >S PEMREXTTEXTOUTW �\ FILE_STORAGE_TIER �D LPAXESLISTA ) B] PETW_UMS_EVENT_DIRECTED_SWITCH_END � SYSTEM_AUDIT_CALLBACK_ACE = �7 PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION $ �= _SYSTEM_INTERRUPT_INFORMATION A] PEVENT_FILTER_LEVEL_KW , |1 _TRANSACTIONMANAGER_BASIC_INFORMATION " COLORREF wA INPUT_RECORD # @] PETW_COVERAGE_SAMPLER_STATUS ) ?] PFILE_PIPE_EVENT_ENUM_INPUT_BUFFER >] PUSER_ACTIVITY_PRESENCE �V _SYSTEM_WORKINGSET_ENTRY ' =] PBOOT_ENTROPY_SOURCE_RESULT_CODE $ � IMAGE_DYNAMIC_RELOCATION64_V2 <] PRPC_SYNTAX_IDENTIFIER �! __n128x3 RTL_FEATURE_VARIANT ' �0 _BOOT_ENTROPY_SOURCE_RESULT_CODE �+ _OSVERSIONINFOEXW ! ;] PFILE_INTERNAL_INFORMATION :] PSYSTEM_POWER_STATE " w: _SYSTEM_POOLTAG_INFORMATION $ X IMAGE_BOUND_IMPORT_DESCRIPTOR �' PROCESS_EXCEPTION_PORT $ 9] PFILE_ID_FULL_DIR_INFORMATION s1 PCTCH 3 �2 PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION * 8] PTRANSACTIONMANAGER_LOG_INFORMATION ' 5] I_RpcProxyGetConnectionTimeoutFn ! U! BY_HANDLE_FILE_INFORMATION " 0" _SYSTEM_MANDATORY_LABEL_ACE 2] PCPU_SET_INFORMATION_TYPE " \ PROCESSOR_POWER_INFORMATION * �6 SYSTEM_ELAM_CERTIFICATE_INFORMATION # gV CM_DISK_GEOMETRY_DEVICE_DATA � _RTL_QUERY_REGISTRY_TABLE 1] PSTRING64 # 0] PIMAGE_ARCHIVE_MEMBER_HEADER ( 7! _LDR_DLL_LOADED_NOTIFICATION_DATA -S RTL_HEAP_WALK_ENTRY 4 /] PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V1 ! .] PSTARTING_VCN_INPUT_BUFFER � IRQ_DEVICE_POLICY =- _IMAGE_CHPE_RANGE_ENTRY $ �D _RTL_PROCESS_VERIFIER_OPTIONS 6 6 _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION -] ENUMRESNAMEPROCW � TRACE_GUID_INFO KPRIORITY *] PTOKEN_TYPE �R _KEY_LAYER_INFORMATION
(] _Ea <T PRAWHID r9 WMI_TXR &] POBJECT_TYPE_INFORMATION " %] PSYSTEM_MEMORY_LIST_COMMAND ! n _SEC_WINNT_AUTH_IDENTITY_A n2 CACHE_DESCRIPTOR $ 9 _SYSTEM_BOOT_LOGO_INFORMATION �R _RDR_CALLOUT_STATE ( +X JOB_OBJECT_NET_RATE_CONTROL_FLAGS & � _CM_PARTIAL_RESOURCE_DESCRIPTOR FB _CONNECTDLGSTRUCTA $] PMIDL_SERVER_INFO #] PVM_COUNTERS " " _RTL_HEAP_MEMORY_LIMIT_DATA �2 NPMSG & �4 _PERFINFO_CC_LOGGED_STREAM_INFO "] LPSERVICE_DESCRIPTIONA , !] PPERFINFO_CLOCK_INTERRUPT_INFORMATION �? IO_RESOURCE_LIST ] PMUILANGUAGES �7 NPIMECHARPOSITION 2 �\ PEVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION & �U _TOKEN_APPCONTAINER_INFORMATION �( _RTL_BSD_ITEM , i5 EVENT_TRACE_PROFILE_EVENT_INFORMATION & � LEAP_SECOND_DATA_REGISTRY_ENTRY $ � _RTL_CRITICAL_SECTION_DEBUG32 � SHUFFLE_FILE_DATA - ] JOBOBJECT_NET_RATE_CONTROL_INFORMATION 3( _POWER_USER_PRESENCE # RTL_FEATURE_CHANGE_STAMP ( ] PSYSTEM_ACTIVITY_MODERATION_STATE " S. _OPERATION_START_PARAMETERS �@ AR_STATE ! ] PPERFINFO_WORKINGSET_ENTRY � SYSTEM_POWER_STATE # OS RTLP_HEAP_SERIALIZED_MAPPING % EH OBJECT_HANDLE_FLAG_INFORMATION + / _SYSTEM_HYPERVISOR_QUERY_INFORMATION ] ENUMRESTYPEPROCW $ �G _ETW_PARTITION_INFO_EXTENSION
] PUQUAD �W _POWER_SESSION_CONNECT % s _PROCESS_WORKING_SET_OPERATION LIST_ENTRY32 - ] PFILE_FS_PERSISTENT_VOLUME_INFORMATION P- NPDEBUGHOOKINFO ] ANON_OBJECT_HEADER D RTL_RESOURCE ] PEXTLOGFONT # ] PSD_CHANGE_MACHINE_SID_INPUT 3 ] PMEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION
] FONTENUMPROC 'A _ETW_SET_KTIMER2_EVENT ( ] PIMAGE_ARM_RUNTIME_FUNCTION_ENTRY ] LPPALETTEENTRY � _IMAGE_NT_HEADERS64 "
] PSYSTEM_VA_LIST_INFORMATION ] PRTL_ENUM_HEAPS_ROUTINE ] PDECRYPTION_STATUS_BUFFER ] PTP_IO_CALLBACK ] PEMRTEXT ] PTOKEN_PRIMARY_GROUP ] PPSINJECTDATA ] MSGBOXCALLBACK - �< JOBOBJECT_BASIC_ACCOUNTING_INFORMATION �1 tagCOLORADJUSTMENT �5 PERFINFO_MEM_RESET_INFO ! �\ PFSCTL_OFFLOAD_READ_OUTPUT ) PATTERN K@ PEMRBEGINPATH �* KBDLLHOOKSTRUCT �S NT_TIB32 ^T tagMENUGETOBJECTINFO �\ PRTL_RVA_LIST_ITERATOR $ � _ENUM_SERVICE_STATUS_PROCESSA �& RPC_VERSION ENUMLOGFONTW � PEMRPOLYPOLYGON �\ LPSOUNDSENTRY ! �V _PERFINFO_MARK_INFORMATION �\ SC_NOTIFICATION_CALLBACK �\ PWNODE_EVENT_REFERENCE . �\ PEVENT_TRACE_POOLTAG_FILTER_INFORMATION 0 �\ PSYSTEM_VERIFIER_CANCELLATION_INFORMATION ] UMS_SCHEDULER_REASON * PBITMAPV4HEADER �S POUTLINETEXTMETRICA % �! _FILE_FS_DATA_COPY_INFORMATION �W IMAGE_SYMBOL $ �\ PFILE_STORAGE_TIER_MEDIA_TYPE n# _RPC_SECURITY_QOS_V3_W �\ PPERFINFO_DPC_INFORMATION �\ PFILESYSTEM_STATISTICS_EX �F SYSTEM_ALARM_OBJECT_ACE �C RTL_PROCESS_BACKTRACES �X PRAWKEYBOARD � RPC_ADDRESS_CHANGE_FN % � _SYSTEM_RESOURCE_ATTRIBUTE_ACE % _PEBS_DS_SAVE_AREA �\ PCFOUR_PART_VERSION �\ GEO_ENUMPROC �Y LPIMEMENUITEMINFOA . �5 _SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 �\ PATOM_BASIC_INFORMATION >+ RTL_UNLOAD_EVENT_TRACE ;U tagRAWINPUTHEADER , �" _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY _PROCESS_DISK_COUNTERS �; LOGPALETTE J( tagEMRPOLYLINE16 �A PNEWTEXTMETRICA �\ ABORTPROC ' k4 _PERFINFO_PO_SESSION_CALLOUT_RET # POWER_SESSION_TIMEOUTS �\ PEMRSETPALETTEENTRIES 3 � SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT 7 �\ PRTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY GEOID $# _CSVFS_DISK_CONNECTIVITY ! vF _STORAGE_RESERVE_AREA_INFO �\ DPI_AWARENESS_CONTEXT �\ OLDFONTENUMPROCA �# _VIDEOPARAMETERS $ ENUM_SERVICE_STATUS �< ETW_BUFFER_CONTEXT �\ XMIT_HELPER_ROUTINE , h* _PERFINFO_SAMPLED_PROFILE_INFORMATION ' �2 _SYSTEM_MEMORY_USAGE_INFORMATION � PEMRSETLAYOUT & {9 _PROCESS_EXTENDED_ENERGY_VALUES �> _EVENT_HEADER �/ PERFINFO_TRACE_HEADER �\ PNON_PAGED_DEBUG_INFO ! �\ PSYSTEM_THREAD_INFORMATION � TP_CALLBACK_INSTANCE �\ RPC_OBJECT_INQ_FN * cV _SYSTEM_MEMORY_TOPOLOGY_INFORMATION x5 LPCOMPAREITEMSTRUCT % �T PLUGPLAY_CONTROL_CONFLICT_DATA ;= NETRESOURCE .7 _FULL_PTR_XLAT_TABLES EE _TXFS_LIST_TRANSACTIONS % lW _EXTENT_READ_CACHE_INFO_BUFFER R$ NUMA_NODE_RELATIONSHIP �\ PEVENT_CALLBACK " �\ PFILE_ZERO_DATA_INFORMATION & �Z _PROCESS_CYCLE_TIME_INFORMATION $ �\ PPROCESS_AFFINITY_UPDATE_MODE , 7 _FILE_IOSTATUSBLOCK_RANGE_INFORMATION & �\ PFILE_PROVIDER_EXTERNAL_INFO_V1 7 c. _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY ! �( SYSTEM_BIGPOOL_INFORMATION % �\ PPLUGPLAY_CONTROL_INSTALL_DATA �\ LPENUMLOGFONTEX H( PEMRPOLYBEZIER16 # �\ PKEY_VALUE_BASIC_INFORMATION 9U LPRAWINPUTHEADER % �\ LPENUM_SERVICE_STATUS_PROCESSW ! �\ PWMI_IMAGELOAD_INFORMATION �[ _RTL_RVA_LIST �+ ETW_SET_TIMER_EVENT �\ PCONTEXT_CHUNK =. IMAGE_TLS_DIRECTORY64 % �\ PIO_RESOURCE_REQUIREMENTS_LIST �\ PCRAWINPUTDEVICE # �V EVENT_EXTENDED_ITEM_INSTANCE # 5 SERVERSILO_BASIC_INFORMATION ' �\ PPS_MITIGATION_AUDIT_OPTIONS_MAP �< XSTATE_CONTEXT 2 �% JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION $ �& tagPOINTER_BUTTON_CHANGE_TYPE + CM_SHARE_DISPOSITION & �\ PRTL_DISK_WRITE_CONSTRAINT_INFO �\ ICMENUMPROCA �\ PWNODE_ALL_DATA # � _PERFINFO_DEBUG_EVENT_REASON �V FILE_END_OF_FILE_INFO �\ LPMETAFILEPICT ' & TXFS_READ_BACKUP_INFORMATION_OUT �\ PXSTATE_FEATURE �\ REGISTERWORDENUMPROCW �\ PUNWIND_HISTORY_TABLE �\ PMUTANT_OWNER_INFORMATION MENUTEMPLATEW �\ LPWNDCLASSEX ( �Y PERFINFO_CONTIGUOUS_PAGE_GENERATE Z _HV_DETAILS ! �\ PHEAP_EXTENDED_INFORMATION 0 tagEMRSELECTPALETTE �\ PRTL_TREE_WALK_FUNCTION �* _KEY_EVENT_RECORD �% pvalueW �@ DISCDLGSTRUCT & � SERVICE_DELAYED_AUTO_START_INFO �\ PETW_CLOCK_TIME_UPDATE * �1 _PROCESS_COMMIT_RELEASE_INFORMATION �\ PVALENT & �T SYSTEM_ACTIVITY_MODERATION_INFO % �T _PROCESS_FOREGROUND_BACKGROUND ( �< PERFINFO_KERNELMEMORY_RANGE_USAGE & X FILE_DISPOSITION_INFORMATION_EX # Y ENLISTMENT_BASIC_INFORMATION �U _STARTUPINFOEXA -> FILE_ALL_INFORMATION ) �\ PMEMORY_PARTITION_NODE_INFORMATION �2 _DMA_CONFIGURATION_BYTE1 ( �\ PPROCESS_DEVICEMAP_INFORMATION_EX �\ PWNF_STATE_NAME_LIFETIME $ k$ _PERFINFO_PPM_STATE_SELECTION ) bW _RTL_IMAGE_MITIGATION_SEHOP_POLICY $ �& _RTL_CRITICAL_SECTION_DEBUG64
B PSIZEL LCSCSTYPE �\ PETW_CLOSE_HANDLE_EVENT $ �\ RTL_REALLOCATE_STRING_ROUTINE �> tagDROPSTRUCT e, XSAVE_CET_U_FORMAT 0 �\ PEVENT_TRACE_COVERAGE_SAMPLER_INFORMATION �) UNICODE_STRING32 X? _PRIVILEGE_SET ( ACTIVATION_CONTEXT_STACK . _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY �\ PENUMTEXTMETRIC # �G SD_CHANGE_MACHINE_SID_OUTPUT �\ PIMAGE_NT_HEADERS * 1 SYSTEM_WRITE_CONSTRAINT_INFORMATION dS PEXTLOGPEN - tagRECONVERTSTRING b7 HEAP_EVENT_RANGE " �/ _PERFINFO_MEMORY_NODE_ENTRY ! UV _REPARSE_POINT_INFORMATION % S LOGICAL_PROCESSOR_RELATIONSHIP �' EMRPOLYTEXTOUTW ) ID PERFINFO_PO_CALIBRATED_PERFCOUNTER � EMRSETROP2 �Y SYSDBG_TRIAGE_DUMP �\ PTRACE_GUID_PROPERTIES # �\ PPERFINFO_SYSCALL_ENTER_DATA ! � _RTL_FEATURE_ENABLED_STATE �E _OPTICAL_MEDIA_RECORD - �\ PSYSTEM_FIRMWARE_PARTITION_INFORMATION �= EVENT_FILTER_EVENT_ID # �\ PIMAGE_RESOURCE_DIR_STRING_U 0 D RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY �D NEWTEXTMETRICEX ! �\ PTOUCHPREDICTIONPARAMETERS LONG_PTR ) _TOKEN_DEVICE_CLAIMS ! . TXFS_SAVEPOINT_INFORMATION # �\ PPROCESSOR_POWER_INFORMATION " �D PLUGPLAY_CONTROL_DEPTH_DATA �\ LPSYSTEM_POWER_STATUS � tagHIGHCONTRASTW �\ PETW_KQUEUE_ENQUEUE_EVENT * �\ PACCESS_ALLOWED_CALLBACK_OBJECT_ACE % �( _TIME_DYNAMIC_ZONE_INFORMATION ! �\ DISPLAYCONFIG_ADAPTER_NAME �\ PEMRPLGBLT �+ CLIENT_CALL_RETURN "< ACL_REVISION_INFORMATION �\ PMEMORY_RESERVE_TYPE / `, _FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT �- tagNONCLIENTMETRICSW �\ PETW_WAKE_COUNTER_EVENT / �\ PJOBOBJECT_EXTENDED_LIMIT_INFORMATION_V1 �. PALPC_HANDLE_ATTR32 �\ PREASON_BUFFER �\ RTL_AVL_MATCH_FUNCTION % �\ PPERFINFO_CC_WORKITEM_COMPLETE = _EVENT_TRACE_LOGFILEA LANGNAMEINDEX �\ HRSRC �\ PCWNF_TYPE_ID �\ EDITWORDBREAKPROCA F IMAGE_POLICY_METADATA
+ _ETW_HEAP_EVENT_CREATE ( �" _PERFINFO_CC_EXTRA_WB_THREAD_INFO
�/ CURDIR ! zC _FILE_OBJECTID_INFORMATION " ( PROCESS_WORKING_SET_CONTROL $ �\ PCM_EISA_FUNCTION_INFORMATION D _FILE_ALLOCATION_INFO ! 98 _WINDOW_BUFFER_SIZE_RECORD � _IO_RESOURCE_DESCRIPTOR '
Y _ETW_ANTI_STARVATION_BOOST_EVENT *
[ PROCESS_SECURITY_DOMAIN_INFORMATION � EMRSETICMMODE �\ PFILE_STORAGE_TIER ( �\ PWORKER_FACTORY_BASIC_INFORMATION �\ LPSYSTEM_INFO � UNIVERSAL_NAME_INFOW �3 RPC_ADDRESS_CHANGE_TYPE 1 �) _EVENT_TRACE_IPT_CONFIGURATION_INFORMATION & �\ PETW_COVERAGE_SAMPLER_PERF_INFO # PUINT_PTR �\ PIMAGE_TLS_DIRECTORY64 ' ; MEMORY_SHARED_COMMIT_INFORMATION y PEMRPOLYPOLYLINE16 ! �# _SECURITY_OBJECT_AI_PARAMS = _EVENT_DATA_DESCRIPTOR * �# _PERFINFO_HARDPAGEFAULT_INFORMATION . �A JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V1 > tagEXTLOGPEN32 # �\ PIMAGE_DYNAMIC_RELOCATION_V2 �\ PREFS_VOLUME_DATA_BUFFER 1 D _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY $ �D _CONSOLE_SCREEN_BUFFER_INFOEX �\ PPROVIDER Z HV_DETAILS , X7 MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES & �\ PRTL_USER_PROCESS_INFORMATION64 ! ATOM �\ PEMROFFSETCLIPRGN + �\ PFILE_LINK_ENTRY_FULL_ID_INFORMATION + �\ PSYSTEM_BOOT_ENVIRONMENT_INFORMATION * 3 SYSTEM_KERNEL_VA_SHADOW_INFORMATION # 'H ETW_CLOCK_STATE_CHANGE_EVENT * �\ PPERFINFO_SYSTEM_MEMORY_INFORMATION ' �\ PSTORAGE_RESERVE_AREA_DEFINITION + 1 _TRANSACTION_ENLISTMENTS_INFORMATION �\ PTP_WIN32_IO_CALLBACK 9 ORIENTATION_PREFERENCE / �4 SYSTEM_VERIFIER_CANCELLATION_INFORMATION ! �- QUERY_SERVICE_LOCK_STATUSW � SERVICE_NOTIFYW & �T _PLUGPLAY_CONTROL_CONFLICT_DATA �\ PEMREOF �$ _CI_LOG_SCHEDULER_EVENT 4 �\ PSYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE �X MUILANGLIST $ �\ PRTL_USER_PROCESS_INFORMATION �\ LPPOLYTEXT
�T PEB � INTERFACE_TYPE �G _PLUGPLAY_NOTIFY_HDR �Z LPBITMAPCOREINFO �\ PSC_NOTIFICATION_CALLBACK �\ __n8 �7 MENU_EVENT_RECORD �\ PUSN_RECORD_EXTENT \ _Reparse ( }\ PMEMORY_SHARED_COMMIT_INFORMATION , |\ PSYSTEM_LOGICAL_PROCESSOR_INFORMATION {\ PETW_OPTICALIO_INIT � _CSV_CONTROL_PARAM % _REFS_SMR_VOLUME_GC_PARAMETERS z\ PLDR_DLL_LOAD_REASON + y\ PEVENT_TRACE_SPINLOCK_INFORMATION_V1 V _IMAGE_RELOCATION � _VRF_RULE_CLASS_ID 2 @? SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION ( x\ PACTIVATION_CONTEXT_ASSEMBLY_DATA $ w\ PTRACE_PROVIDER_INSTANCE_INFO v\ PNDR_ASYNC_MESSAGE $ W& _QUERY_BAD_RANGES_INPUT_RANGE _FIRMWARE_TYPE �E ETW_UMS_EVENT_PARK �V _SID % [ FILE_STANDARD_LINK_INFORMATION % }U WIM_PROVIDER_ADD_OVERLAY_INPUT % �( _SYSTEM_CALL_COUNT_INFORMATION �$ uint64x2x4_t % BV KEY_VIRTUALIZATION_INFORMATION � FIXED u\ PAR_STATE " X ENCLAVE_LOAD_DATA_VBS_BASIC !9 tagCOMBOBOXINFO t\ LPSERVICE_DESCRIPTION # ULONG_PTR % s\ PEVENT_EXTENDED_ITEM_EVENT_KEY + << _ALPC_PORT_ASSOCIATE_COMPLETION_PORT ) �[ _EVENT_EXTENDED_ITEM_STACK_TRACE32 - r\ PPERFINFO_PFMAPPED_SECTION_INFORMATION � _LUNICODE_STRING Y _CSV_IS_OWNED_BY_CSVFS . q\ PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION $ J$ ETW_TP_EVENT_CALLBACK_DEQUEUE ' p\ PETW_SESSION_NOTIFICATION_PACKET M6 tagWINDOWPLACEMENT $ �Y _FILE_STANDARD_INFORMATION_EX ) o\ PTXFS_ROLLFORWARD_REDO_INFORMATION n\ PCSV_IS_OWNED_BY_CSVFS l\ NON_PAGED_DEBUG_INFO " j\ PMEMORY_BASIC_INFORMATION64 % i\ PQUERY_BAD_RANGES_OUTPUT_RANGE % h\ PEXTENT_READ_CACHE_INFO_BUFFER ! �& _ENCRYPTION_KEY_CTRL_INPUT + w4 _REFS_DEALLOCATE_RANGES_INPUT_BUFFER ! g\ PSECURE_SETTING_VALUE_TYPE f\ PRTL_UNLOAD_EVENT_TRACE64 3 e\ PCLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE d\ PALPC_SERVER_INFORMATION
c\ PFNFTH ! $ _SECTION_INFORMATION_CLASS b\ I_RpcPerformCalloutFn ' C0 _TOKEN_BNO_ISOLATION_INFORMATION �E _POWER_REQUEST_TYPE & _LDR_ENUM_RESOURCE_ENTRY �: FSCTL_OFFLOAD_READ_OUTPUT % a\ PSYSTEM_GDI_DRIVER_INFORMATION �0 _MUILANGUAGES u PULONG32 # W _PS_BNO_ISOLATION_PARAMETERS ! e ALPC_WORK_ON_BEHALF_TICKET q+ _WAKE_TIMER_INFO � PUWSTR_C `\ PEVENT_RECORD p0 PROCESS_WAKE_FILTER �< tagENUMLOGFONTEXW , � _LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION �Z RGNDATAHEADER INT16 ]\ PWRITE_USN_REASON_INPUT + �' SYSTEM_HYPERVISOR_DETAIL_INFORMATION \\ PRTL_TRACE_DATABASE JU _SCRUB_PARITY_EXTENT HC CFG_CALL_TARGET_INFO ) �C _PERFINFO_VIRTUAL_ALLOC_XPARTITION �F PERFINFO_FLT_OPERATION [\ PTP_CLEANUP_GROUP oD PEVENTMSG # Z\ RTL_HEAP_STACK_WRITE_ROUTINE �9 NDR_USER_MARSHAL_INFO " PUCSCHAR ! Y\ I_RpcProxyIsValidMachineFn F4 TTPOLYGONHEADER X\ PROPENUMPROCW �' _NDR_CS_ROUTINES �. _MAXVERSIONTESTED_INFO �= tagFONTSIGNATURE U\ PSD_GLOBAL_CHANGE_OUTPUT - � _MEMORY_PARTITION_TRANSFER_INFORMATION a _ALPC_WORK_ON_BEHALF_ATTR # �1 SYSTEM_HIBERFILE_INFORMATION T\ LPCSCROLLINFO R\ HRAWINPUT ! Q\ PFILE_QUERY_SPARING_BUFFER �> tagEMREXTFLOODFILL $ P\ PEVENT_EXTENDED_ITEM_INSTANCE & J JOBOBJECT_ENERGY_TRACKING_STATE O\ PIO_SESSION_CONNECT_INFO & �Y _WIM_PROVIDER_CONTROL_INTEGRITY % �- _PO_HIBER_FORCE_DISABLE_REASON + N\ PMEM_SECTION_EXTENDED_PARAMETER_TYPE eU LPTITLEBARINFO # M\ PSEMAPHORE_BASIC_INFORMATION % D7 _RPC_BINDING_HANDLE_OPTIONS_V1 L\ PWMI_IDE_CHANNEL_RECORD 9 K\ PPROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION 6 J\ PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY I\ PPLUGPLAY_APC_ROUTINE �. PLOGBRUSH �Y LPIMEMENUITEMINFOW ( D\ _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR �< IMAGE_FUNCTION_ENTRY �9 PBITMAP A\ PKLDR_DATA_TABLE_ENTRY32 �( tagCREATESTRUCTW � DATEFMT_ENUMPROCEXW � _MUTANT_OWNER_INFORMATION �T HTOUCHINPUT__ � _RTL_BALANCED_NODE �Z _GROUP_RELATIONSHIP �! EMRWIDENPATH " @\ PFILE_NUMA_NODE_INFORMATION # ?\ PSYSTEM_VHD_BOOT_INFORMATION �Z _CM_PCCARD_DEVICE_DATA =\ _IMAGE_POLICY_ENTRY 6 _FILE_NAMES_INFORMATION > _PSFEATURE_OUTPUT " �R DRIVER_VERIFIER_THUNK_PAIRS �7 TIME_FIELDS ' ;\ PSYSTEM_ACTIVITY_MODERATION_INFO S tagRGBQUAD ! COLOR16 ( �B _PERFINFO_DRIVER_COMPLETE_REQUEST , 9\ PPERFINFO_DRIVER_COMPLETE_REQUEST_RET # Z RTL_WORK_ON_BEHALF_TICKET_EX [ LPHANDLE + CREATESTRUCT 8\ PIMAGE_VXD_HEADER � PROCESSINFOCLASS ( � FILE_FS_METADATA_SIZE_INFORMATION �* TP_TIMER " CALTYPE 7\ PKHETERO_CPU_POLICY 6\ IELF_HANDLE % 5\ PSYSTEM_SECUREBOOT_INFORMATION 7= CBT_CREATEWND + P TRANSACTIONMANAGER_INFORMATION_CLASS
~ STRING �! RPC_STRING p PCHAR 2\ PMOVE_FILE_RECORD_DATA 4 1\ PRTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY " � TXFS_GET_TRANSACTED_VERSION x' _SD_GLOBAL_CHANGE_OUTPUT 0\ LPENCLAVE_TARGET_FUNCTION 9 _WMI_PUSHLOCK ) � _RTL_PROCESS_BACKTRACE_INFORMATION 2 O= SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION ,\ PRETRIEVAL_POINTER_BASE *\ PPO_WAKE_SOURCE_HEADER =1 ENCLAVE_CREATE_INFO_VBS � FILE_BASIC_INFO )\ PDLL_INIT_ROUTINE ! �2 _WMI_DISKIO_READWRITE_INIT & '\ PSL_APPX_CACHE_VALUE_DESCRIPTOR ! �( PRTL_UMS_THREAD_INFO_CLASS �# RTL_CRITICAL_SECTION32 � _DEVICE_POWER_STATE i: _MULTI_TIME $ &\ PJOBOBJECT_JOBSET_INFORMATION % %\ PPROCESS_ENERGY_TRACKING_STATE + $\ PRPC_HTTP_TRANSPORT_CREDENTIALS_V2_W #\ PWMI_FILE_IO ) H PETW_COVERAGE_SAMPLER_OPTION_FLAGS ) "\ PGET_FILTER_FILE_IDENTIFIER_OUTPUT # !\ PPROCESS_SESSION_INFORMATION " \ PFSCTL_OFFLOAD_WRITE_OUTPUT & �) _PERFINFO_PPM_PERF_STATE_CHANGE # �7 _PERFINFO_MEMORY_INFORMATION �[ OBJECT_TYPE_INFORMATION r SYSTEM_BIGPOOL_ENTRY �R WINSTAENUMPROCW 8 V: _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION ) \ PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX 7+ PEMRSETBRUSHORGEX \ PETW_RT_EVENT_LOSS 6 \ JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 ) \ PSTREAMS_ASSOCIATE_ID_INPUT_BUFFER ( L5 SYSTEM_POWER_STATE_DISABLE_REASON �3 EMRFRAMERGN ): _PERFINFO_FILE_CREATE � RTL_HEAP_ENTRY :) _DCB . \ PFILE_NETWORK_PHYSICAL_NAME_INFORMATION . \ PTRANSACTIONMANAGER_LOGPATH_INFORMATION $ _ENUM_SERVICE_STATUSA A. _RTL_BALANCED_LINKS \ LPEXIT_THREAD_DEBUG_INFO �! int16x8x3_t �8 _NTFS_STATISTICS_EX 7 �D _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION 5F _EVENTSFORLOGFILE \ LPLAYERPLANEDESCRIPTOR �$ NPREGISTERWORDA ', PCUWCHAR ' N$ _SYSTEM_DPC_BEHAVIOR_INFORMATION $ \ PKEY_OPEN_SUBKEYS_INFORMATION 1 \ PEVENT_TRACE_LBR_CONFIGURATION_INFORMATION �. NPDEVMODEA � _GUID # \ _PROCESSOR_POWER_INFORMATION % \ PINVERTED_FUNCTION_TABLE_ENTRY �A _EVENT_FILTER_DESCRIPTOR
\ PKLDR_DATA_TABLE_ENTRY64 ' G _IO_COMPLETION_INFORMATION_CLASS \ PETW_CANCEL_KTIMER2_EVENT ! < _PERFINFO_PO_NOTIFY_DEVICE ) @ _JOBOBJECT_CONTAINER_IDENTIFIER_V2 * FILE_DISPOSITION_INFO_EX " �V ETW_COVERAGE_SAMPLER_SAMPLE
\ __n32 7S PALTTABINFO �: _CM_SERIAL_DEVICE_DATA S& INIT_ONCE \ LPAUDIODESCRIPTION [ PWMI_DISKIO_FLUSH_BUFFERS OB _RPC_SECURITY_QOS_V5_A : �! RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME �' EMRPOLYTEXTOUTA �" PROCESS_LEAP_SECOND_INFO \ PEMRRESTOREDC M SUITE_TYPE ; tagBITMAPINFO p LPCH ! �C PO_SPR_ACTIVE_SESSION_DATA % �[ PSYSDBG_LIVEDUMP_CONTROL_FLAGS <; FILE_STORAGE_INFO 1 PROCESS_HEAP_ENTRY � STARTUPINFOA W* MDICREATESTRUCTA float32x2x2_t a SID_AND_ATTRIBUTES_HASH ! �% CM_EXTENDED_PARAMETER_TYPE �[ PTP_DIRECT_CALLBACK �[ PIO_STATUS_BLOCK ) �[ PFILE_ID_GLOBAL_TX_DIR_INFORMATION , CM_PARTIAL_RESOURCE_LIST H TP_POOL_STACK_INFORMATION RPC_INTERFACE_GROUP ! �[ PPERFINFO_SET_POWER_ACTION $ �) _PERFINFO_FILE_PATH_OPERATION I _FILE_MODE_INFORMATION �S LPPROCESS_INFORMATION �@ UUID_VECTOR �S NETCONNECTINFOSTRUCT �& _SPARSE_OVERALLOCATE_DATA C HTASK__ =R tagEMRMASKBLT ) �5 KEY_SET_VIRTUALIZATION_INFORMATION ! Z5 _EISA_MEMORY_CONFIGURATION �W LPRID_DEVICE_INFO � _LARGE_INTEGER ) +& WIM_PROVIDER_SUSPEND_OVERLAY_INPUT �B _SYSDBG_BUS_DATA & �[ PMANAGE_HOT_PATCH_QUERY_PATCHES ! �W SYSTEM_POWER_LOGGING_ENTRY J �[ ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL - �[ PFSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER " �[ PSE_PACKAGE_CAPABILITY_INFO � EMRCOLORCORRECTPALETTE % �[ _PIMAGE_RUNTIME_FUNCTION_ENTRY U/ WOW64_CPUAREA_INFO Q, _TOKEN_ELEVATION_TYPE K _WNF_DATA_SCOPE " aC MANAGE_HOT_PATCH_LOAD_PATCH ( �[ EVENT_EXTENDED_ITEM_STACK_TRACE32 lV SECURITY_SEED_AND_LENGTH �[ GDI_HANDLE_BUFFER32 � RTL_FEATURE_ENABLED_STATE
A TP_DEBUG_FREE_INFO ! # _WMI_IMAGEID_INFORMATION64 � _SYSTEM_POWER_STATE �X _OPERATION_END_PARAMETERS & X _FILE_PROVIDER_EXTERNAL_INFO_V0 oD PEVENTMSGMSG �[ POBJECT_ATTRIBUTES . _VM_COUNTERS_EX + _FOCUS_EVENT_RECORD # �[ _ETW_DISKIO_FLUSH_BUFFERS_V2 S5 COVERAGE_REQUEST_CODES - �[ PSERVICE_CONTROL_STATUS_REASON_PARAMSW & �@ _PS_CPU_QUOTA_QUERY_INFORMATION nE _RPC_SERVER_INTERFACE
�[ HKEY__
Z HPEN__ �Y RPC_SECURITY_QOS_V2_A �A PETW_DISKIO_READWRITE_V3 �[ PBATTERY_REPORTING_SCALE 7U _FILE_FULL_DIR_INFO �W tagLAYERPLANEDESCRIPTOR �[ PPERFINFO_FILE_CREATE n PROC_THREAD_ATTRIBUTE_NUM �0 tagSCROLLBARINFO " CLONG ' HANDLER_FUNCTION_EX % P _WORKER_FACTORY_CALLBACK_CLASS boolean 0 �[ PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + '% _HEAP_OPTIMIZE_RESOURCES_INFORMATION , v _PERFINFO_CLOCK_INTERRUPT_INFORMATION �[ PTOKEN_DEFAULT_DACL ( �0 _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE �: tagCHANGEFILTERSTRUCT # _ETW_OBJECT_TYPE_EVENT * W ETW_TP_EVENT_WORKER_NUMANODE_SWITCH . ;' _SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE �[ RTL_RVA_LIST
Z HRGN__ * �8 _SYSTEM_LOW_PRIORITY_IO_INFORMATION �[ PACL_SIZE_INFORMATION HZ FILESYSTEM_STATISTICS_EX �[ DLL_INIT_ROUTINE % X FILE_PROVIDER_EXTERNAL_INFO_V0 " �[ PCLDR_DLL_NOTIFICATION_DATA �Z _FILE_NAME_INFO }+ tagMDINEXTMENU ' �W SYSTEM_LEGACY_DRIVER_INFORMATION # (U _PROCESS_LOGGING_INFORMATION ]D THREAD_TLS_INFORMATION & G IO_COMPLETION_INFORMATION_CLASS + �Y SYSTEM_VERIFIER_COUNTERS_INFORMATION ' �0 _PLUGPLAY_CONTROL_CONFLICT_ENTRY 1 �: TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT �+ LPOSVERSIONINFOEXW - m5 SYSTEM_SESSION_MAPPED_VIEW_INFORMATION � WIN32_STREAM_ID �7 PS_MEMORY_RESERVE �@ tagMENUITEMINFOW 0$ _SERVICE_TIMECHANGE_INFO F+ SHUTDOWN_ACTION �Y HACCEL__ �[ LPOVERLAPPED �? LPDLGITEMTEMPLATEW �: LPRECONVERTSTRING ! �[ PIMAGE_RESOURCE_DATA_ENTRY �? SYSTEM_ACCESS_FILTER_ACE 6V ETW_KQUEUE_ENQUEUE_EVENT �= USN_JOURNAL_DATA _KEY_INFORMATION_CLASS �, NPLOGPEN S- EMRANGLEARC ) uint32x2_t � _RESUME_PERFORMANCE , �[ PSYSTEM_INTERRUPT_CPU_SET_INFORMATION �[ PCLDR_DATA_TABLE_ENTRY 1 bU _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION �9 RTL_DEBUG_INFORMATION ' �[ PIMAGE_CE_RUNTIME_FUNCTION_ENTRY �[ PPPM_WMI_PERF_STATE �[ HRSRC__ �[ PMENUGETOBJECTINFO , 0 _PROCESS_EXTENDED_BASIC_INFORMATION64 @ _OSVERSIONINFOEX2A " /! ETW_DFSS_START_NEW_INTERVAL C _EVENT_DESCRIPTOR 7 _FILE_LEVEL_TRIM $ �S NTPSS_MEMORY_BULK_INFORMATION % �[ WIN32_MEMORY_INFORMATION_CLASS , �[ PFILE_IO_PRIORITY_HINT_INFORMATION_EX �X VCN_RANGE_INPUT_BUFFER ) ( _TRACE_PERIODIC_CAPTURE_STATE_INFO
3S _FP_32 % NC _POWER_THROTTLING_THREAD_STATE ) �[ PSYSTEM_PREFETCH_PATCH_INFORMATION ) �[ PJOBOBJECT_BASIC_LIMIT_INFORMATION x poly8x16_t R PPS_APC_ROUTINE �G EVENT_EXTENDED_ITEM_TS_ID 4 �[ PFSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE
$ tagWINDOWINFO c+ GET_FILEEX_INFO_LEVELS {F EMREXCLUDECLIPRECT �[ PPO_WAKE_SOURCE_FIXED # eD JOURNAL_ABSOLUTE_INFORMATION I LOCALE_ENUMPROCA ! wchar_t ( �E SERVICE_REQUIRED_PRIVILEGES_INFOA # �[ PPERFINFO_PO_SESSION_CALLOUT 5: MEMORY_EXHAUSTION_TYPE �[ COMMCONFIG . 9 _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT ( �[ PETW_TIMER_EXPIRATION_START_EVENT D; RTLP_TAG_INFO / �C EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION . �[ PJOBOBJECT_CPU_RATE_CONTROL_INFORMATION �[ PRTL_AVL_FREE_ROUTINE # `' _ETW_TP_EVENT_CALLBACK_START C _PERFINFO_HV_HYPERCALL xU _PERFINFO_IO_TIMER ) \? PERFINFO_SESSIONCREATE_INFORMATION 2 / FILE_IO_COMPLETION_NOTIFICATION_INFORMATION u RTL_FEATURE_ID �[ PRTL_OKAY_TO_LOCK_ROUTINE $ �' ACTIVATION_CONTEXT_INFO_CLASS ! �[ PFILE_POSITION_INFORMATION ( �[ PRPC_HTTP_TRANSPORT_CREDENTIALS_W V WMI_IRQ_RECORD # 0 _REQUEST_OPLOCK_INPUT_BUFFER �[ PPACKEDEVENTINFO @ OSVERSIONINFOEX2 OE _RTL_SPARSE_BITMAP_CTX ICONMETRICSA * S PERFINFO_PAGECOMBINE_ITERATION_STAT * �[ PFILE_VALID_DATA_LENGTH_INFORMATION B& QUERY_FILE_LAYOUT_INPUT + �[ PSYSTEM_KERNEL_VA_SHADOW_INFORMATION - SYSTEM_CODEINTEGRITYPOLICY_INFORMATION �[ PSYSDBG_MSR FB CONNECTDLGSTRUCT �R KEY_LAYER_INFORMATION �; READ_USN_JOURNAL_DATA
q LPWORD % �Z _THREAD_POWER_THROTTLING_STATE G WNODE_HEADER �< _KERNEL_USER_TIMES 2[ PWINDOWPLACEMENT " �[ PALPC_WORK_ON_BEHALF_TICKET # �[ PTXFS_GET_TRANSACTED_VERSION �[ LPCIEXYZ ZE SECTION_IMAGE_INFORMATION 7+ PEMRSETVIEWPORTORGEX ! Y _PERFINFO_WORKINGSET_ENTRY �, IMAGE_COFF_SYMBOLS_HEADER ( �[ PLOOKUP_STREAM_FROM_CLUSTER_ENTRY 7 �[ PSYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION �0 RTL_STACK_CONTEXT �A ETW_DISKIO_READWRITE_V3 �# PRUNTIME_FUNCTION �* _COPYFILE2_COPY_PHASE $ � _FILE_STORAGE_TIER_MEDIA_TYPE �' _DISPLAY_DEVICEW & �[ PRTL_PROCESS_MODULE_INFORMATION 2 h- JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V1 �% WMI_REGISTRY ~ _ETW_KQUEUE_DEQUEUE_EVENT [# PROCESS_HEAP_INFORMATION �[ _OBJECT_TYPE_INFORMATION ' COUNTER_READING $ �[ PTXFS_CREATE_MINIVERSION_INFO ( �[ SYSTEM_PREFETCH_PATCH_INFORMATION ! �[ PETW_DISABLE_KTIMER2_EVENT � uint16x4x3_t �[ PSYSTEM_POOL_INFORMATION �E NPPOLYTEXTW �% STACK_WALK_EVENT_DATA & ( _SYSTEM_VERIFIER_INFORMATION_EX u" EMRMOVETOEX # 7 ETW_PROCESS_HANDLE_INFO_TYPE �[ PRETRIEVAL_POINTER_COUNT �[ PETW_POOL_EVENT K SE_AUDIT_OPERATION �[ PGENERATE_NAME_CONTEXT �[ PETW_HEAP_EVENT_FREE �& PRTL_RESOURCE_DEBUG64 " � SE_WS_APPX_SIGNATURE_ORIGIN " �[ PPROCESS_UPTIME_INFORMATION B1 _IMAGE_OPTIONAL_HEADER64 * E _TOKEN_SECURITY_ATTRIBUTE_OPERATION �[ PTHREAD_WORKLOAD_CLASS ! �2 SYSTEM_ERROR_PORT_TIMEOUTS m: LPCANDIDATELIST � _SE_TOKEN_USER . �< _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION � _IRQ_PRIORITY % <? _PERFINFO_FLT_OPERATION_STATUS % &Z MEMORY_COMBINE_INFORMATION_EX2 �[ PWMI_RESOURCE �. THREAD_NAME_INFORMATION �[ PTP_DIRECT ' �C _RTL_IMAGE_MITIGATION_DEP_POLICY � uint64x1x4_t �[ PMARK_HANDLE_INFO p _WOW64_FUNCTION_CODE64 " LDR_DDAG_NODE q4 PERFINFO_CC_FLUSH_SECTION 9, QUAD � _FILE_STORAGE_TIER_CLASS % �Y FSCTL_QUERY_REGION_INFO_OUTPUT 0 �[ PSYSTEM_FEATURE_CONFIGURATION_INFORMATION v7 FILE_ID_EXTD_DIR_INFO ~ ANSI_STRING
�[ PFP_32 " �D _TXFS_GET_METADATA_INFO_OUT ! �= _CONTAINER_ROOT_INFO_INPUT ) � _FILE_FS_METADATA_SIZE_INFORMATION � EMRSETSTRETCHBLTMODE -- _REARRANGE_FILE_DATA �[ LPSTARTUPINFOA �[ PCONSOLE_SELECTION_INFO # [' _FILE_COMPLETION_INFORMATION % 0V _COMPATIBILITY_CONTEXT_ELEMENT 6 SCRUB_PARITY_EXTENT_DATA * W _PERFINFO_FILENAME_SAME_INFORMATION " 8 _IMAGE_DYNAMIC_RELOCATION64 , �[ PSYSTEM_VERIFIER_COUNTERS_INFORMATION " �[ PCIMAGE_BOUND_FORWARDER_REF ( �: RTL_IMAGE_MITIGATION_OPTION_STATE ! �V WIM_PROVIDER_EXTERNAL_INFO + �[ PSYSTEM_NET_RATE_CONTROL_SET_CONTEXT $ �[ PSYSTEM_PROCESSOR_INFORMATION 1 �[ PCACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION dS NPEXTLOGPEN _cpinfo
�[ PFIBER # �@ _SEMAPHORE_BASIC_INFORMATION m% REG_PROVIDER * �[ PETW_TRACE_PARTITION_INFORMATION_V2 �, _ETW_TP_EVENT_POOL_CREATE OU _BLENDFUNCTION + 4. _SYSTEM_SYSTEM_PARTITION_INFORMATION �[ _COMMCONFIG ) �[ LPSERVICE_REQUIRED_PRIVILEGES_INFO 6 RPC_MESSAGE �< SYSTEM_HANDLE_INFORMATION > _TIME_ZONE_INFORMATION " _HEAP_EVENT_COMMIT_DECOMMIT " PERFINFO_PO_SESSION_CALLOUT ! �[ PNTFS_EXTENDED_VOLUME_DATA �9 _KTMOBJECT_TYPE �[ HINSTANCE $ �[ PGET_SYSTEM_WOW64_DIRECTORY_W & � _FILE_REPARSE_POINT_INFORMATION [ OLDFONTENUMPROCW � MENUITEMINFOA �< _XSTATE_CONTEXT �= NEWTEXTMETRIC �S NPOUTLINETEXTMETRICA # ~[ PENCLAVE_INIT_INFO_VBS_BASIC � LPDIBSECTION u5 MSGBOXPARAMSW }[ PETW_CANCEL_TIMER_EVENT ]F _CM_SCSI_DEVICE_DATA �Z FILE_NAME_INFO j _FILE_STAT_LX_INFORMATION x[ PUSN_JOURNAL_DATA_V1 ( 2' PLUGPLAY_CONTROL_CONFLICT_STRINGS w[ PFILE_QUOTA_INFORMATION + m) PLUGPLAY_CONTROL_RELATED_DEVICE_DATA v[ PRTL_RXACT_OPERATION ' u[ PETW_ANTI_STARVATION_BOOST_EVENT 4 �2 _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION � _KCRM_MARSHAL_HEADER <, LPSECURITY_CAPABILITIES ' t[ RTL_WALK_IMAGE_POLICIES_CALLBACK PLANGNAMEINDEX d NPTEXTMETRICA 4 �R PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY � IO_PRIORITY_HINT i' _CONSOLE_FONT_INFO �A PERFINFO_BOOT_PHASE_START gY ALPC_DATA_VIEW_ATTR & (@ _SL_APPX_CACHE_VALUE_DESCRIPTOR �R SERVICE_DESCRIPTION � EFI_DRIVER_ENTRY_LIST \ STORAGE_RESERVE_ID q[ PREFS_SMR_VOLUME_GC_STATE ) p[ PRTL_IMAGE_MITIGATION_SEHOP_POLICY o[ PPO_SLEEP_DISABLE_REASON m[ XSAVE_FORMAT h[ PEXCEPTION_FILTER �9 FILE_NAME_INFORMATION �V LPHARDWAREHOOKSTRUCT e[ PPOWER_IDLE_RESILIENCY � RTL_IMAGE_POLICY_METADATA �D _PS_ATTRIBUTE �D TP_DEBUG_CLASS ; �Y _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY �C VM_COUNTERS_EX2 + rU _SYSTEM_FEATURE_CONFIGURATION_UPDATE - _HSM_OPCODE ( d[ PFILE_METADATA_OPTIMIZATION_STATE ! c[ PETW_NOTIFICATION_CALLBACK 2 _[ PSYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE c PENHMETAHEADER ' ~A RPC_BINDING_HANDLE_SECURITY_V1_A ! �E MEMORY_BASIC_INFORMATION32 * �2 _FILE_INITIATE_REPAIR_OUTPUT_BUFFER " �R _KEY_WRITE_TIME_INFORMATION �Y NPIMEMENUITEMINFOA �D CSV_QUERY_FILE_REVISION ^[ PFILE_PIPE_EVENT_BUFFER j& LOGCOLORSPACEA &$ LOCALESIGNATURE �2 _HEAP_RANGE_LOG �W _RTL_BUFFER $ ][ PPO_INTERNAL_WAKE_SOURCE_TYPE T4 tagPOINTER_TOUCH_INFO <: _DYNAMIC_FUNCTION_TABLE \[ PRTL_DISK_SPEED_INFO ' �E SERVICE_REQUIRED_PRIVILEGES_INFO ( 6 _IMAGE_LOAD_CONFIG_CODE_INTEGRITY [[ PRTL_MODULE_EXTENDED_INFO s< _PS_ATTRIBUTE_LIST '# _CSV_QUERY_MDS_PATH_V2 ;= NETRESOURCEA Z[ PRPC_SECURITY_QOS_V5_W Y[ PENCRYPTED_DATA_INFO # SC _SHARED_VIRTUAL_DISK_SUPPORT ( X[ PSYSTEM_SINGLE_MODULE_INFORMATION �! GCP_RESULTS V[ PTP_TIMER U[ HDESK 1 T[ PEVENT_TRACE_IPT_CONFIGURATION_INFORMATION " �A FILE_PROVIDER_EXTERNAL_INFO �# PVIDEOPARAMETERS
6 TEB ' �3 FILE_FS_FULL_SIZE_INFORMATION_EX S[ LPDOCINFOW ! R[ PFILE_TRACKING_INFORMATION �D tagEMRFILLPATH $ ENUM_SERVICE_STATUSA ! �/ PERFINFO_MEMORY_NODE_ENTRY ! `' ETW_TP_EVENT_CALLBACK_STOP $ Y PERFINFO_CC_WORKITEM_COMPLETE
�, LOGPEN ! � SYSTEM_MEMORY_LIST_COMMAND # Q[ RTL_RETPOLINE_CHECK_FUNCTION P[ PETW_STACK_CACHING_CONFIG T TIMER_TYPE ' _TOKEN_MANDATORY_LABEL O[ PLDR_FAILURE_DATA �B EMREXTCREATEFONTINDIRECTW B PO_WAKE_SOURCE_INFO 4 �! _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION 5 \& RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY G? NPPELARRAY �E ETW_CRITSEC_EVENT_INIT * �E _JOBOBJECT_MEMORY_USAGE_INFORMATION $ Y _ENLISTMENT_BASIC_INFORMATION N[ PINIT_ONCE_FN �B _WMI_TCPIP V WMI_WAIT_MULTIPLE ) tR PROCESS_EXTENDED_BASIC_INFORMATION �S _PROCESS_INFORMATION J[ LANGUAGEGROUP_ENUMPROCA 2 G[ PACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 �0 RTL_LFG_RNG_STATE �% PEMRARC F _LIST_ENTRY 3 �! SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION ! WORD �! EMRSETVIEWPORTORGEX " �> _SYSTEM_POWER_STATE_CONTEXT C[ PWMI_WAIT_OBJECT_RECORD " # ETW_COVERAGE_SAMPLER_HANDLE ( B[ PLEARNING_MODE_OBJECT_INFORMATION �7 IMECHARPOSITION A[ PRPC_SECURITY_QOS_V2_W ?[ WMI_RESOURCE x UNICODE_STRING " <[ LDR_CREATE_ACT_CTX_LANGUAGE .# _BUS_DATA_TYPE # �& _SYSTEM_VERIFIER_INFORMATION ;[ GOBJENUMPROC , 8[ PRTL_FEATURE_USAGE_SUBSCRIPTION_TABLE * _MAT2 C9 _RPC_SECURITY_QOS_V5_W [V EMRCREATEPALETTE $ 7[ PFILE_END_OF_FILE_INFORMATION . 6 _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION �V LOAD_DLL_DEBUG_INFO % �V _EVENT_EXTENDED_ITEM_EVENT_KEY + h* PERFINFO_SAMPLED_PROFILE_INFORMATION * �* _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX # 6[ PETW_TP_EVENT_CALLBACK_START ! G SE_PACKAGE_CAPABILITY_INFO 5[ PWIN32_MEMORY_RANGE_ENTRY �R EMRSETCOLORADJUSTMENT �: ALPC_BASIC_INFORMATION D _RTL_TRACE_BLOCK RPC_SS_THREAD_HANDLE 5: _MEMORY_EXHAUSTION_TYPE 4[ PAXISINFO J( EMRPOLYLINE16 & ]: _PERFINFO_PPM_IDLE_STATE_CHANGE �$ uint32x4x4_t � VRF_RULE_CLASS_ID � WMI_SPINLOCK �; _ETW_HEAP_EVENT_COMMON $ �/ FILE_SFIO_RESERVE_INFORMATION ' 3[ PFILE_MAILSLOT_QUERY_INFORMATION �R _CSV_QUERY_MDS_PATH M: _EISA_MEMORY_TYPE �Y _ETW_CANCEL_TIMER_EVENT �U _RTL_PHYSICAL_MEMORY_INFO �C USEROBJECTFLAGS 2[ LPWINDOWPLACEMENT ! �Z _SEC_WINNT_AUTH_IDENTITY_W & PEMRSELECTCOLORSPACE & G, _IMAGE_RESOURCE_DIRECTORY_ENTRY 1[ PTHREAD_START_ROUTINE ! 0[ PFSCTL_OFFLOAD_WRITE_INPUT / �G MEMORY_PARTITION_INITIAL_ADD_INFORMATION & �$ ETW_PARTITION_INFO_EXTENSION_V2 /[ PMEM_ADDRESS_REQUIREMENTS .[ PCM_PCCARD_DEVICE_DATA v1 _PERFINFO_PROCESS_INSWAP ' +[ PIO_COMPLETION_BASIC_INFORMATION �4 EVENT_FILTER_EVENT_NAME �U _ETW_WNF_EVENT_PUBLISH *[ PSE_IMAGE_SIGNATURE_TYPE )[ PFILE_ID_EXTD_DIR_INFO LPMENUTEMPLATE u PEN_MASK f tagPOINTER_TYPE_INFO
([ PFP_64 ]D _THREAD_TLS_INFORMATION �( HELPWININFO $ '[ PSYSTEM_INTERRUPT_INFORMATION & &[ PFSCTL_UNMAP_SPACE_INPUT_BUFFER - %[ PWMI_JOB_SEND_NOTIFICATION_INFORMATION &
0 _PERFINFO_SET_DEVICES_STATE_RET $[ PRTL_HASH_ENTRY #[ PCONDITION_VARIABLE �# NEWTEXTMETRICW "[ PWMI_DELAY_EXECUTION " # _IMAGE_DELAYLOAD_DESCRIPTOR % DMA_WIDTH �V COUNTED_REASON_CONTEXT ![ PRTL_ENCLAVE_LAUNCH_TOKEN � LPINPUT 0 [ PJOBOBJECT_LIMIT_VIOLATION_INFORMATION_V1
�2 tagMSG [ PETW_TP_EVENT_POOL_CLOSE �S FILE_LEVEL_TRIM_OUTPUT * [ PSYSTEM_MEMORY_TOPOLOGY_INFORMATION F WMI_TRACE_MESSAGE_PACKET 8G PMUIREGISTRYINFO �! _WMI_JOB_INFORMATION $ �F _WOW64_DESCRIPTOR_TABLE_ENTRY �6 _TOKEN_SOURCE % �@ _FSCTL_QUERY_REGION_INFO_INPUT + CREATESTRUCTA " : KEY_WOW64_FLAGS_INFORMATION 3 _CM_COMPONENT_INFORMATION = EVENT_TRACE_LOGFILEA % _INVERTED_FUNCTION_TABLE_ENTRY % �Z PROCESS_CYCLE_TIME_INFORMATION �U _QUOTA_LIMITS_EX / [ PFSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT & [ PJOURNAL_RENAME_KEY_INFORMATION �7 _MENU_EVENT_RECORD # MW _ETW_CRITSEC_EVENT_COLLISION " J _FILE_FS_VOLUME_INFORMATION + <W RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE ) _GROUP_AFFINITY �? PO_WAKE_SOURCE_DEVICE �A COMM_FAULT_OFFSETS [ PFIND_BY_SID_DATA [ PPERFINFO_PROCESS_INSWAP +
[ _PROCESS_SECURITY_DOMAIN_INFORMATION Z LPKEYBDINPUT [ PPS_ATTRIBUTE_LIST # [ PETW_DISKIO_FLUSH_BUFFERS_V3 ( #A ETW_COVERAGE_SAMPLER_BLOOM_FILTER ) [ PRESOURCEMANAGER_BASIC_INFORMATION ' �B _IR_TIMER_EXTRA_CREATE_PARAMETER PDLL_DIRECTORY_COOKIE d FILE_ID_INFO [ WMIDPREQUEST �2 WMI_DISKIO_READWRITE_INIT -= TOKEN_STATISTICS YS _FILE_REGION_INPUT * '% HEAP_OPTIMIZE_RESOURCES_INFORMATION IT TEB_ACTIVE_FRAME_EX [ PRTL_SPARSE_BITMAP_CTX [ PFILE_END_OF_FILE_INFO ) �< _PERFINFO_KERNELMEMORY_RANGE_USAGE �( IMAGE_SECTION_HEADER [ PEMRGLSBOUNDEDRECORD
[ PPROCESSOR_IDLE_HANDLER 2 *Y SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX � _RASTERIZER_STATUS � PLDR_SERVICE_TAG_RECORD E HUMPD__ [ PLUTF8_STRING + [ PPROCESS_SECURITY_DOMAIN_INFORMATION " �- PROCESSOR_POWER_POLICY_INFO {R _THREAD_BASIC_INFORMATION W" _RTL_BITMAP_EX �= FONTSIGNATURE ! [ PETW_THREAD_AFFINITY_EVENT & [ PFILE_STANDARD_LINK_INFORMATION $ C BOOT_ENTROPY_SOURCE_NT_RESULT 7 FILE_LEVEL_TRIM �5 SERVICE_NODE_TYPE ! ;@ _FILE_BOTH_DIR_INFORMATION ! yG tagEMRMODIFYWORLDTRANSFORM R: MOF_FIELD & �+ SYSTEM_POOL_ZEROING_INFORMATION �G SERVICE_DIRECTORY_TYPE � _TRACE_ENABLE_CONTEXT_EX - � _SYSTEM_ISOLATED_USER_MODE_INFORMATION [ PEMREXTCREATEPEN , �Z PACTIVATION_CONTEXT_BASIC_INFORMATION Q5 DATEFMT_ENUMPROCEXA �$ STYLEBUF & A PERFINFO_WORKINGSET_INFORMATION ! �> _RTL_RETPOLINE_BINARY_INFO �Z LPNEWTEXTMETRIC �Z SENDASYNCPROC �! SID_AND_ATTRIBUTES * �Z PFILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER % �@ PS_CPU_QUOTA_QUERY_INFORMATION - �< SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER 6 MUILANGCFGLIST eC SYSTEM_VDM_INSTEMUL_INFO $ �; SYSTEM_PROCESS_ID_INFORMATION ' ,4 _ETW_TRACE_PARTITION_INFORMATION �C _IMAGE_DEBUG_DIRECTORY �Z PSE_AUDIT_OPERATION ' �Z PRTL_FEATURE_CONFIGURATION_TABLE )
_SYSTEM_SECURITY_MODEL_INFORMATION l+ _ENCLAVE_LOAD_INFO_VBS �* DRAWITEMSTRUCT �R UNWIND_HISTORY_TABLE _MIDL_FORMAT_STRING % �U SYSTEM_PROCESS_TRUST_LABEL_ACE < CURRENCYFMTA � _SID_NAME_USE + OUTLINETEXTMETRICW S> IMAGE_DEBUG_MISC # �Y FILE_STANDARD_INFORMATION_EX , �/ VIRTUALIZATION_INSTANCE_INFO_INPUT_EX " �Z PADMINISTRATOR_POWER_POLICY �Z PSLIST_HEADER y: PLOGFONTA
`+ HIMC__ � PHYSICAL_ADDRESS * �7 SYSTEM_ACTIVITY_APP_MODERATION_TYPE �Z RTL_AVL_ALLOCATE_ROUTINE 3 M PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION ) �2 FILE_INITIATE_REPAIR_OUTPUT_BUFFER ? �Z PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY �U TP_DIRECT l> POINTER_PEN_INFO �A ETW_NOTIFICATION_HEADER ) �" _MEMORY_PARTITION_NODE_INFORMATION �G _RIP_INFO $0 tagPIXELFORMATDESCRIPTOR a REMOTE_NAME_INFOW * �Z PPERFINFO_DPC_EXECUTION_INFORMATION <> _OBJECTID m7 _PORT_DATA_INFORMATION �F PCUNZTCH * �? SYSTEM_CRASH_DUMP_STATE_INFORMATION �Z PBITMAPCOREINFO ( C WMI_EXTENDED_THREAD_INFORMATION64 ', PCUWSTR 3( POWER_USER_PRESENCE �Z PPERFINFO_DEBUG_EVENT GY PMETAHEADER �Z LPDLGITEMTEMPLATE �7 LPIMECHARPOSITION L4 _RTL_HEAP_TAG_INFO �Z LPFNDEVMODE �A LPDESIGNVECTOR �Z LPMDICREATESTRUCTA � _CHAR_INFO DB LPNETRESOURCE f SID_AND_ATTRIBUTES_ARRAY ET NTFS_STATISTICS / �3 SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS � SERVICE_STATUS_HANDLE__
p PNZTCH �Z PIMAGE_SYMBOL_EX � PS_MITIGATION_OPTION " �E PRTL_CRITICAL_SECTION_DEBUG �6 _HARDWARE_COUNTER # �Z PPROCESS_LOGGING_INFORMATION �Z PKCONTINUE_TYPE �Z LPOSVERSIONINFOEX �, _IMAGE_POLICY_ENTRY_TYPE ) �Z PETW_TP_EVENT_TIMER_CANCEL_NTTIMER # �Z _ENCLAVE_INIT_INFO_VBS_BASIC s% HCURSOR �, NPRGNDATA �Z LPSTYLESTRUCT �Z CS_TAG_GETTING_ROUTINE + �Z PPERFINFO_PAGECOMBINE_ITERATION_STAT �: _PERFINFO_PROCESS_PERFCTR ' �Z PPLUGPLAY_CONTROL_CONFLICT_ENTRY �Z PMOFRESOURCEINFOA ! �/ PERFINFO_SET_DEVICES_STATE ' ( _ETW_COVERAGE_SAMPLER_QUERY_INFO �Z PCOUNTER_READING / �Z PFILE_PROCESS_IDS_USING_FILE_INFORMATION �Z PAPPCONTAINER_SID_TYPE + POUTLINETEXTMETRICW �Z PEMRINTERSECTCLIPRECT � _TOKEN_INFORMATION_CLASS & �Z PPROCESS_CYCLE_TIME_INFORMATION & �Z PNTFS_FILE_RECORD_OUTPUT_BUFFER �Z PPERFINFO_FILE_DIRENUM �Z PCURDIR �Z PBOOT_ENTRY & &Z _MEMORY_COMBINE_INFORMATION_EX2 �" SECURITY_DESCRIPTOR aZ LDR_FAILURE_DATA z< RATE_QUOTA_LIMIT �Z HHOOK # � _ALPC_PORT_INFORMATION_CLASS 6 FILE_NAMES_INFORMATION �Z PEVENTLOGRECORD �& DISPATCHER_CONTEXT % X _IMAGE_BOUND_IMPORT_DESCRIPTOR ]0 GDI_TEB_BATCH $ �Z PSYSTEM_REF_TRACE_INFORMATION * W> _PERFINFO_DPC_EXECUTION_INFORMATION �Z PIMAGE_OPTIONAL_HEADER64 E' LINK_TRACKING_INFORMATION �Z PRPC_ENDPOINT_TEMPLATEA * �Z PPERFINFO_PO_CALIBRATED_PERFCOUNTER �Z PWOW64_FLOATING_SAVE_AREA " j _RTL_CRITICAL_SECTION_DEBUG �Z PPPM_WMI_PERF_STATES_EX �Z PQUOTA_LIMITS_EX ( � _PROCESS_TELEMETRY_ID_INFORMATION � _REDIRECTION_DESCRIPTOR �Z PEMR 6 �Z LDR_LOADED_MODULE_ENUMERATION_CALLBACK_FUNCTION � FILE_REGION_INFO �Z PGROUP_RELATIONSHIP m- _NLSTABLEINFO % �' _ACTIVATION_CONTEXT_INFO_CLASS * �Z PSYSTEM_EXTENDED_THREAD_INFORMATION $ 0V COMPATIBILITY_CONTEXT_ELEMENT ' 0 JOB_OBJECT_IO_RATE_CONTROL_FLAGS � _SYSTEM_POOLTAG �Z LPSERIALKEYSA �Z PFILE_PIPE_INFORMATION ' �S PERFINFO_MEMORY_NODE_INFORMATION % |= _SE_SET_FILE_CACHE_INFORMATION 5 �Z PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION $ �Z THREAD_POWER_THROTTLING_STATE �2 _LDR_DATA_TABLE_ENTRY64 ) �Z PFILE_IO_PRIORITY_HINT_INFORMATION �Z PSYSDBG_COMMAND # � PROCESS_TLS_INFORMATION_TYPE ) �R _GET_FILTER_FILE_IDENTIFIER_OUTPUT �Z PRC_CONFIG
� UOW # � ENUM_SERVICE_STATUS_PROCESSA �Z PRPC_PROTSEQ_ENDPOINT ,U _IMAGE_VXD_HEADER �; _USER_ACTIVITY_PRESENCE , �Z PPLUGPLAY_CONTROL_INTERFACE_LIST_DATA �> DROPSTRUCT � _POWER_STATE_TYPE �Z CM_PCCARD_DEVICE_DATA ) �R VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT �. _HEAP_RANGE_DESTROY # �Z PMEM_EXTENDED_PARAMETER_TYPE �Z PRGNDATAHEADER 5Z tagEMRTEXT � PEMRSETICMMODE �Z PETW_HEAP_EVENT_EXPANSION �Z _GENERIC_MAPPING / ? TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY $ _WORKERFACTORYINFOCLASS �Z PBITMAPFILEHEADER �G CPINFOEXA g _HIBERFILE_BUCKET � PKCRM_PROTOCOL_BLOB 69 ACTCTXW �Z PPROCESSOR_IDLESTATE_INFO " �Z LPCREATE_PROCESS_DEBUG_INFO �Z PEMRROUNDRECT �Z PTOUCH_HIT_TESTING_INPUT �. WNF_STATE_NAME_LIFETIME 2 �: _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT �Z PPROCESS_TLS_INFORMATION & �Z _RTL_USER_PROCESS_INFORMATION64 > RPC_BINDING_VECTOR ! �Z PSEC_WINNT_AUTH_IDENTITY_W �Z PIMAGE_TLS_DIRECTORY32 ) �: _REMOTE_LINK_TRACKING_INFORMATION_ . �) _SYSTEM_THREAD_CID_PRIORITY_INFORMATION u UHALF_PTR �Z LPOSVERSIONINFOEX2 �< EMROFFSETCLIPRGN EMRPOLYGON �Z PEMRGLSRECORD ! �: _PERFINFO_SET_POWER_ACTION * �Z PTXFS_LIST_TRANSACTION_LOCKED_FILES �6 SD_ENUM_SDS_OUTPUT U _ETW_CLOCK_TIME_UPDATE �Z _PACKEDEVENTINFO ) 1 _FINDFIRSTACTIVATIONCONTEXTSECTION w LPWIN32_FIND_DATAA " N SEMAPHORE_INFORMATION_CLASS "$ PLOCALESIGNATURE m OBJECT_INFORMATION_CLASS vS _RTL_ELEVATION_FLAGS �Z PFILE_NAME_INFO �$ RTL_AVL_TABLE �$ _APPCONTAINER_SID_TYPE �Z PRTL_STACK_CONTEXT_ENTRY �> PUNICODE_STRING * > _MIDL_WINRT_TYPE_SERIALIZATION_INFO ! �Z PLINK_TRACKING_INFORMATION # �2 CM_EISA_FUNCTION_INFORMATION $ � _PROCESS_TLS_INFORMATION_TYPE # 1 _PROCESS_BASIC_INFORMATION64 �Z DLGPROC �Z NPPOLYTEXT 4 �# _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION �S _RTL_RVA_LIST_ITERATOR �Z PLDR_DATA_TABLE_ENTRY32 �Z PWMI_JOB_REMOVE_PROCESS � _WMI_FILE_IO G FP_IEEE_VALUE }Z HPEN �. tagCHARSETINFO % {Z PPERFINFO_SET_POWER_ACTION_RET % �V _PROCESS_MITIGATION_DEP_POLICY 9( tagEMRCREATECOLORSPACEW zZ LPSOUNDSENTRYA �2 ETW_HEAP_EVENT_ALLOC $ PCANSI_STRING % yZ PSYSTEM_PROCESS_CLASSIFICATION & xZ PPROCESS_MEMORY_EXHAUSTION_TYPE )
E SYSTEM_PROCESSOR_POWER_INFORMATION P) _SYSTEM_PREFETCH_OPTIONS wZ PPPM_PERFSTATE_EVENT 3 ~7 SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION �! tagIMEMENUITEMINFOW PLONG / tG ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT �V SYSTEM_WORKINGSET_ENTRY F+ _SHUTDOWN_ACTION �" ACCESSTIMEOUT VT GCP_RESULTSW " �V _WIM_PROVIDER_EXTERNAL_INFO tZ LPTHREAD_START_ROUTINE �/ IMAGE_LINENUMBER " �+ MEMORY_PARTITION_PAGE_RANGE # � ENLISTMENT_INFORMATION_CLASS 8 sZ PACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION PBOOLEAN 5X WOF_EXTERNAL_INFO � RESUME_PERFORMANCE % - RTL_SPARSE_BITMAP_FREE_ROUTINE rZ NPLOGFONT ( qZ PFILE_REMOTE_PROTOCOL_INFORMATION �G RTL_HEAP_PARAMETERS pZ PFS_INFORMATION_CLASS . KEY_BASIC_INFORMATION # oZ PRTL_SEGMENT_HEAP_PARAMETERS & ?! SYSTEM_HOT_PATCH_REGISTRY_VALUE nZ LPNONCLIENTMETRICS ' mZ PTOKEN_BNO_ISOLATION_INFORMATION ) �E JOBOBJECT_MEMORY_USAGE_INFORMATION 3 lZ PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX y7 HANDEDNESS " kZ PUNWIND_HISTORY_TABLE_ENTRY t RTL_DYNAMIC_HASH_TABLE # jZ PSYSTEM_SCOPED_POLICY_ID_ACE �Y PRPC_STRING iZ PCSTRING �5 WNF_STATE_NAME % hZ PRTL_REALLOCATE_STRING_ROUTINE E RTL_RESOURCE_POLICY_FLAGS ' % ETW_COVERAGE_SAMPLER_CREATE_INFO 7 eZ PSYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION $ � PRTL_CRITICAL_SECTION_DEBUG32 ! @Y _FILE_POSITION_INFORMATION ]F CM_SCSI_DEVICE_DATA t$ _RTL_SPARSE_BITMAP_RUN �> EMRSETTEXTCOLOR dZ PCOBJECT_ATTRIBUTES aZ _LDR_FAILURE_DATA " ^Z PPO_SPR_ACTIVE_SESSION_DATA �4 BITMAPFILEHEADER �- PEMRPOLYLINETO �< IMAGE_THUNK_DATA32 $ �? _EXTENDED_ENCRYPTED_DATA_INFO p PUNZTCH r9 _WMI_TXR ]Z PETW_PER_SESSION_QUOTA $ �F FILE_ZERO_DATA_INFORMATION_EX ! n& _SYSTEM_OBJECT_INFORMATION f TEXTMETRICA \Z PIELF_HANDLE ' ? CFG_CALL_TARGET_LIST_INFORMATION SC_LOCK ZZ PCZPSTR � VALENTA T _IMAGE_ROM_HEADERS $ �G _SD_CHANGE_MACHINE_SID_OUTPUT XZ PBOOT_ENTROPY_NT_RESULT J( EMRPOLYBEZIER16 WZ PCONTAINER_VOLUME_STATE � _KCONTINUE_TYPE / :+ _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION VZ PEX_WNF_CALLBACK L XFORM % TZ PETW_CLOCK_CONFIGURATION_EVENT 3? PERFINFO_PO_POSTSLEEP �> TIMELINE_BITMAP �; FILE_PATH " �) MEMORY_WORKING_SET_EX_BLOCK ! SZ PSTARTING_LCN_INPUT_BUFFER ' � _LEAP_SECOND_DATA_REGISTRY_ENTRY * �B _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM @ ETW_REF_CLOCK . �< _SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER �E WIN32K_SYSCALL_FILTER < SCRUB_DATA_OUTPUT $ �# QUERY_FILE_LAYOUT_FILTER_TYPE % F> MEMORY_WORKING_SET_EX_LOCATION " �- RTL_SPARSE_BITMAP_PARAMETER d LPTEXTMETRICA RZ LPCPINFOEXA ! H _WMI_PROCESS_INFORMATION64 # �R _DRIVER_VERIFIER_THUNK_PAIRS , _FILETIME # POINTER_64_INT QZ PCREATE_USN_JOURNAL_DATA G _SL_HWID_DEVICE_INFO PZ PMESSAGE_RESOURCE_DATA �D _REPAIR_COPIES_OUTPUT OZ PVOLUME_REFS_INFO_BUFFER . NZ PSYSTEM_SPECULATION_CONTROL_INFORMATION $ #@ _RTL_PROCESS_LOCK_INFORMATION 5+ _VOLUME_REFS_INFO_BUFFER �' DISPLAY_DEVICEW EU _QUERY_SERVICE_CONFIGW MZ PCIMAGE_TLS_DIRECTORY64 KZ PKCONTINUE_ARGUMENT JZ PENCLAVE_INIT_INFO_SGX HPOWERNOTIFY �# _PROCESSOR_NUMBER v( _MIDL_SERVER_INFO_ p va_list HZ _FILESYSTEM_STATISTICS_EX Z _SINGLE_LIST_ENTRY # 'V SYSTEM_EXCEPTION_INFORMATION EZ PMULTI_TIME GV _FILE_FULL_EA_INFORMATION DZ PRTL_HEAP_STACK_CONTROL # SID_HASH_ENTRY �1 PVALUEA CZ PQUERYHANDLER � WMI_PAGE_FAULT �$ _REG_ACTION ! �= POINTER_DEVICE_CURSOR_INFO q PPARAM_OFFSETTABLE ! BZ PRTL_RVA_LIST_RAW_ITERATOR # PSIZE_T - ?Z PCLAIM_SECURITY_ATTRIBUTES_INFORMATION & EH _OBJECT_HANDLE_FLAG_INFORMATION ! >Z PCACTIVATION_CONTEXT_STACK �W TOKEN_CONTROL 1 <Z PTRANSACTION_NOTIFICATION_PROMOTE_ARGUMENT ;Z LPENUMLOGFONTEXDV � tagWNODE_EVENT_ITEM c= _WMI_CONTEXTSWAP # s= _SYSTEM_SCOPED_POLICY_ID_ACE # LPLOGFONTW 4 SE_AUDIT_INFO % 9Z _FILE_FS_ATTRIBUTE_INFORMATION ( {@ _TIMER_SET_COALESCABLE_TIMER_INFO �/ EMRSETDIBITSTODEVICE �+ _ETW_REGNOTIF_REGISTER ) 8 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY ( � FILE_ID_EXTD_BOTH_DIR_INFORMATION ! RTL_UMS_THREAD_INFO_CLASS 5Z EMRTEXT _X DESKTOPENUMPROCA EU QUERY_SERVICE_CONFIGW " PSECURITY_INFORMATION K _KPROFILE_SOURCE � _IO_PRIORITY_HINT 3Z LPSERVICE_MAIN_FUNCTIONW # PTRACEHANDLE 2Z PMOFRESOURCEINFOW ! 1Z RPC_NEW_HTTP_PROXY_CHANNEL 4 MIDL_STUB_MESSAGE PCLAIMS_BLOB - ;' SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE -Z PSYSTEM_AUDIT_OBJECT_ACE 42 _PROCESS_TLS_INFORMATION �G RTL_BITMAP_RUN RPC_IF_HANDLE % ,Z PEXCEPTION_REGISTRATION_RECORD �: CM_SERIAL_DEVICE_DATA +Z PCM_SONIC_DEVICE_DATA 2 �, TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT # )Z _ETW_COVERAGE_SAMPLER_STATUS & $Z PMEMORY_COMBINE_INFORMATION_EX2 C+ _RTL_CIRCULAR_LIST_HEAD s" PEMRMOVETOEX "Z WINEVENTPROC �+ _CONNECTDLGSTRUCTW ' �& _ETW_DFSS_RELEASE_THREAD_ON_IDLE � IMAGE_DOS_HEADER ) a: _SYSTEM_VSM_PROTECTION_INFORMATION $ �5 KEY_CONTROL_FLAGS_INFORMATION �W FILE_STORAGE_TIER_REGION �= CONTAINER_ROOT_INFO_INPUT ! � _PS_MITIGATION_OPTIONS_MAP # � TXFS_LIST_TRANSACTIONS_ENTRY U RTL_ENCLAVE_LAUNCH_TOKEN { WMI_THREAD_INFORMATION Z PHV_DETAILS Z PRTL_UNLOAD_EVENT_TRACE32 V0 VARIABLE_NAME Z PRTL_GENERIC_TABLE �* TOUCHINPUT % Z PKAFFINITY_ENUMERATION_CONTEXT ' Z PSYSTEM_SPECIAL_POOL_INFORMATION K@ PEMRSETMETARGN * Z PMIDL_WINRT_TYPE_SERIALIZATION_INFO 8 _EISA_IRQ_DESCRIPTOR j9 _devicemodeW A tagPOINTFX Z PNTFS_VOLUME_DATA_BUFFER c? RTL_UNLOAD_EVENT_TRACE64 Z LINEDDAPROC !C UPDATELAYEREDWINDOWINFO �B ALPC_DIRECT_ATTR
Z PROPENUMPROCA M' TRACE_GUID_PROPERTIES �X EVENT_TRACE_LOGFILEW - �: _MEMORY_PARTITION_PAGEFILE_INFORMATION & 1/ _MANAGE_HOT_PATCH_QUERY_PATCHES Z PKEYBDINPUT $ bX _TRACE_ENABLE_FLAG_EXT_HEADER $ @ EVENT_TRACE_INFORMATION_CLASS Z PACCESS_DENIED_ACE bY LDR_IMPORT_CALLBACK_INFO ) �; _PROCESS_CHILD_PROCESS_INFORMATION
Z PPROCESS_PRIORITY_CLASS
LPARAM Z HRGN
# LOGFONTW - Z _SYSTEM_FIRMWARE_PARTITION_INFORMATION H LPOSVERSIONINFOEX2A �> EMREXTFLOODFILL �@ tagAR_STATE BYTE �! tagABORTPATH �, tagPOINTER_DEVICE_TYPE RPC_STATUS �V _SLIST_HEADER �G tagEMRNAMEDESCAPE B _PO_WAKE_SOURCE_INFO 4 ? PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY ! Z RTL_QUERY_REGISTRY_ROUTINE � _APP_MEMORY_INFORMATION ZA threadlocaleinfostruct ' �5 _ETW_COVERAGE_SAMPLER_BLOOM_INFO )
5 TRANSACTIONMANAGER_LOG_INFORMATION " �) WMI_IMAGELOAD_INFORMATION64 Y PWCRANGE �Y LPMSGBOXPARAMSW ! � _SYSTEM_AUDIT_CALLBACK_ACE ( m3 FILE_IO_PRIORITY_HINT_INFORMATION ' �Y PSYSTEM_SHADOW_STACK_INFORMATION 7 �Y LDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION tC _CONSOLE_SELECTION_INFO �S _SE_ACCESS_REPLY & �Y PFSCTL_QUERY_REGION_INFO_OUTPUT � KUSER_SHARED_DATA �R KEY_SET_LAYER_INFORMATION M _system_handle_t z5 tagCOMPAREITEMSTRUCT * �Y PPROCESS_SYSTEM_RESOURCE_MANAGEMENT �Y PENUMUILANG ! �Y PSHRINK_VOLUME_INFORMATION 4 �Y PSYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION �Y PENCLAVE_TARGET_FUNCTION # PULONGLONG poly8x8x2_t �Y PSE_AUDIT_INFO ! M WNF_STATE_NAME_INFORMATION �Y PENHMETARECORD �Y PSYSDBG_TRIAGE_DUMP / �Y PPLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA �7 RTL_RXACT_LOG �A NPNEWTEXTMETRICA �Y PWMI_IRQ_RECORD �% _KEY_NODE_INFORMATION �Y PDL_EUI48 ! && PERFINFO_BATTERY_LIFE_INFO * X; EVENT_TRACE_PERFORMANCE_INFORMATION ! [1 PROCESS_WINDOW_INFORMATION H@ FP_IEEE_RECORD � _SYSTEM_POWER_INFORMATION �) GESTURECONFIG u> SYSTEM_INFO �X OPERATION_END_PARAMETERS � EMRSETPOLYFILLMODE �> val_context �Y PTOKEN_ACCESS_INFORMATION + �C _CSV_QUERY_FILE_REVISION_FILE_ID_128 byte " PERFINFO_MASK �Y PALPC_DATA_VIEW_ATTR �U RTL_PHYSICAL_MEMORY_INFO > � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT %8 ENCLAVE_INIT_INFO_SGX 3 �Y PTRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION �Y PTP_ALPC `E PEMRSTROKEPATH ! � WMI_JOB_SET_QUERY_NET_RATE �Y PIMAGE_IMPORT_BY_NAME �Y APP_LOCAL_DEVICE_ID
�% PCWSTR �Y PPO_WAKE_SOURCE_TIMER �9 _IMAGE_HOT_PATCH_BASE �Y PRPC_ANSI_STRING i6 _CONTEXT_EX . HGLRC__ 2 �@ IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION * �Y PALPC_PORT_MESSAGE_ZONE_INFORMATION $ �Y PPPM_IDLE_STATE_ACCOUNTING_EX }G _RC_CONFIG � COPYFILE2_MESSAGE_ACTION �Y PWMIREGINFO d/ _MIDL_METHOD_PROPERTY_MAP 1T ETW_CPU_CACHE_FLUSH_EVENT �Y PNT_PRODUCT_TYPE �Y PHARDWARE_COUNTER g> PO_WAKE_SOURCE_TIMER v _LDR_DDAG_STATE ) ]W _RTL_DYNAMIC_TIME_ZONE_INFORMATION & _ETW_CANCEL_KTIMER2_EVENT & �Y PPERFINFO_PPM_IDLE_EXIT_LATENCY - ) _EVENT_EXTENDED_ITEM_PROCESS_START_KEY . �Y PPROCESS_MITIGATION_FONT_DISABLE_POLICY �Y LPCIEXYZTRIPLE ' �Y PWMI_EXTENDED_THREAD_INFORMATION p3 RPC_PROTSEQ_ENDPOINT ` int16x8x2_t , �Y _SYSTEM_VERIFIER_COUNTERS_INFORMATION �Y PPS_WAKE_REASON �0 HMENU__ $ �Y PFILE_TYPE_NOTIFICATION_INPUT DF EMREXTESCAPE �Y NPIMEMENUITEMINFOW $ �Y PFILE_STANDARD_INFORMATION_EX =" _nlsversioninfoex " _PERFINFO_PROCESS_PERFCTR64 �Y _ATOM_TABLE_INFORMATION � _STARTUPINFOA �Y PETW_CREATE_HANDLE_EVENT + CX SYSTEM_BASIC_PERFORMANCE_INFORMATION Y tagENUMTEXTMETRICA * �9 TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE ) �Y RTL_SPARSE_BITMAP_ALLOCATE_ROUTINE 6 �B IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION ' K2 SYSTEM_CODEINTEGRITY_INFORMATION D SYSTEM_THREAD_INFORMATION � BITMAPINFOHEADER rF TEB_ACTIVE_FRAME_CONTEXT - �Y PVIRTUALIZATION_INSTANCE_INFO_INPUT_EX # �> REPAIR_STORAGE_RESERVE_INPUT � tagAXISINFOA �Y LPENHMETARECORD �+ tagENUMLOGFONTEXA �U WRITE_USN_REASON_INPUT �Y LPNUMBERFMTW
CSHORT % �Y WIM_PROVIDER_CONTROL_INTEGRITY " *9 _ETW_HEAP_EVENT_CONTRACTION �Y PTOKEN_LINKED_TOKEN SE_SIGNING_LEVEL $ �V _TXFS_CREATE_MINIVERSION_INFO 'E SYSTEM_POWER_STATUS �@ tagFILTERKEYS �Y _RPC_SECURITY_QOS_V2_A �Y PLDR_VERIFY_IMAGE_INFO ' �Y PIR_TIMER_EXTRA_CREATE_PARAMETER �Y PPERFINFO_CC_FLUSH_CACHE
! wint_t + �Y PKNONVOLATILE_CONTEXT_POINTERS_ARM64 �Y PLDR_DATA_TABLE_ENTRY + �7 _SYSTEM_ACTIVITY_MODERATION_APP_TYPE 24 ENABLE_TRACE_PARAMETERS int8x8x2_t ' X _FILE_DISPOSITION_INFORMATION_EX $ @ _PLUGPLAY_CUSTOM_NOTIFICATION �Y PFOUR_PART_VERSION �Y NPREGISTERWORD ! �9 PERFINFO_SYSCALL_EXIT_DATA ) g5 PEVENT_TRACE_LBR_EVENT_INFORMATION " �@ COMPOUND_ACCESS_ALLOWED_ACE �Y ETW_CANCEL_TIMER_EVENT " �Y PPERFINFO_CCSWAP_IDLE_SHORT , �C _ACTIVATION_CONTEXT_BASIC_INFORMATION ) �Y _PERFINFO_CONTIGUOUS_PAGE_GENERATE : �Y RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY �Y _RPC_SEC_CONTEXT_KEY_INFO * �Y PTOKEN_SECURITY_ATTRIBUTE_OPERATION ( / _DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK B1 IMAGE_OPTIONAL_HEADER64 �Y PFN_NT_CREATE_TRANSACTION �> LPDROPSTRUCT
�Y HACCEL �Y LPSERVICE_TABLE_ENTRYA ! �Y PFILE_STANDARD_INFORMATION WU TOKEN_PRIVILEGES �@ REQUESTER_TYPE / �C SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION �U STARTUPINFOEXA > _STATE_LOCATION_TYPE % �? _ENCLAVE_CREATE_INFO_VBS_BASIC � CM_KEYBOARD_DEVICE_DATA - �6 _HEAP_PERFORMANCE_COUNTERS_INFORMATION � LUTF8_STRING . �Y PSTREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER � PEMRSETSTRETCHBLTMODE , �Y PSERVICE_CONTROL_STATUS_REASON_PARAMS �Y PEVENT_TRACE_LOGFILEW �Y PWOW64_LDT_ENTRY � _SERVICE_NOTIFY_2W 0 tG _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT + W _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH ' �E _IMAGE_CE_RUNTIME_FUNCTION_ENTRY & �# JOBOBJECT_BASIC_PROCESS_ID_LIST �Y PPPM_THERMAL_POLICY_EVENT �F _SYSDBG_PHYSICAL �= PHANDLETABLE H UNIVERSAL_NAME_INFO ( #T ETW_TP_EVENT_TIMER_EXPIRATION_END b) _IO_SESSION_EVENT # �Y PSECTION_IMAGE_INFORMATION64 � SYNCHRONIZATION_BARRIER �Y PIMEMENUITEMINFOA + 7 PROCESS_STACK_ALLOCATION_INFORMATION ) int8x8_t WB _MUILANGINFO ! �Y PRTL_WORK_ON_BEHALF_TICKET % Y _PERFINFO_CC_WORKITEM_COMPLETE ) o6 SYSTEM_SESSION_POOLTAG_INFORMATION 0 A MEMORY_PARTITION_PAGE_COMBINE_INFORMATION & gB FILE_MAILSLOT_QUERY_INFORMATION , : RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET $ 'V _SYSTEM_EXCEPTION_INFORMATION |Y LPHW_PROFILE_INFOW {Y PFILE_ATTRIBUTE_TAG_INFO {+ PMDINEXTMENU ' H< RPC_BINDING_HANDLE_TEMPLATE_V1_W " zY PFN_NT_ROLLBACK_TRANSACTION * �6 SYSTEM_DMA_GUARD_POLICY_INFORMATION �= FILE_PREFETCH t PBOOL � PRTL_BALANCED_NODE wY PKEY_CACHED_INFORMATION vY PFPO_DATA uY PCIMAGE_IMPORT_BY_NAME / sY PSYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION m: PCANDIDATELIST p LPUTSTR . rY PFSCTL_SET_INTEGRITY_INFORMATION_BUFFER � _TRANSACTION_NOTIFICATION 2 >G ACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA & qY PALPC_PORT_CALLBACK_INFORMATION XW _SERVICE_FAILURE_ACTIONSW �$ _TOKEN_ACCESS_INFORMATION : �X TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION - �! _JOBOBJECT_END_OF_JOB_TIME_INFORMATION . d' _TRANSACTIONMANAGER_LOGPATH_INFORMATION
" PCLONG -E TOKEN_ELEVATION �+ PMUICCENTRY �# tagNEWTEXTMETRICW CG tagEMRSETPALETTEENTRIES �9 tagTRACKMOUSEEVENT pY PMEMORY_WORKING_SET_BLOCK oY PFXSAVE_FORMAT_WX86 o$ SIZEL $6 MESSAGE_TRACE_USER & nY PSYSTEM_PAGEFILE_INFORMATION_EX mY PRTL_BSD_ITEM J( EMRPOLYLINETO16 * �* _SYSTEM_SESSION_PROCESS_INFORMATION # �W _SECTION_IMAGE_INFORMATION64 � PBITMAPINFOHEADER �A SERVICE_TABLE_ENTRYA LONG , 0 _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER 2 ]7 _FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX �; NPLOGPALETTE M _EFI_DRIVER_ENTRY lY PENCLAVE_ROUTINE �X value_entW jY PHEAP_COMMIT_DECOMMIT x uint8x16_t " �' TOKEN_GROUPS_AND_PRIVILEGES iY PSYMBOLIC_LINK_INFO_CLASS 3? _PERFINFO_PO_POSTSLEEP PSSIZE_T 7 LOGICAL_DISK_DEFRAG gY _ALPC_DATA_VIEW_ATTR dY PIMAGE_ARCHITECTURE_ENTRY �4 ETW_CREATE_HANDLE_EVENT _Y PLDR_IMPORT_CALLBACK_INFO " ^Y PSYSTEM_POWER_STATE_CONTEXT ) E RTL_FEATURE_CONFIGURATION_PRIORITY _> MONITORINFOEXA ' ]Y PJOBOBJECT_BASIC_UI_RESTRICTIONS $ o _FILE_PIPE_REMOTE_INFORMATION 3 �. FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX � POWER_STATE_TYPE �G COVERAGE_MODULE_INFO �# _MUICCHEADER \Y PCNTSTATUS �: _SID_IDENTIFIER_AUTHORITY �W RTL_BUFFER �, _DOCINFOW vF STORAGE_RESERVE_AREA_INFO , ZY PJOURNAL_SET_DELETE_VALUE_INFORMATION YY PDEVMODE �E _ETW_CRITSEC_EVENT_INIT -H FILE_FS_LABEL_INFORMATION ! �R KEY_WRITE_TIME_INFORMATION � EXCEPTION_DISPOSITION $ � _SECURITY_IMPERSONATION_LEVEL XY LPSERIALKEYS �< _PEB_LDR_DATA WY PCIMAGE_IMPORT_DESCRIPTOR &> _SD_QUERY_STATS_INPUT UY PGHOSTED_FILE_EXTENT 0 L& _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES % TY PIMAGE_DYNAMIC_RELOCATION32_V2 I6 EVENT_BASIC_INFORMATION k CLIENTCREATESTRUCT " �% _WMI_JOB_SET_QUERY_CPU_RATE $ SY PREPAIR_STORAGE_RESERVE_INPUT 1 �W RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER �R EMRRESIZEPALETTE RY HSYNTHETICPOINTERDEVICE + �9 _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE �! tagEMRSETVIEWPORTORGEX �- NONCLIENTMETRICSW % QY PBOOT_ENTROPY_SOURCE_NT_RESULT - HF _JOURNAL_CREATE_DELETE_KEY_INFORMATION PY RTL_TREE_DELETE_FUNCTION 5 OY PPROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY �D EMRSTROKEANDFILLPATH MY NPWNDCLASSEXA REFS_SMR_VOLUME_GC_METHOD % QV RTL_PROCESS_BACKTRACES_CONTROL ( NY PRTL_IMAGE_MITIGATION_HEAP_POLICY ^8 SOUNDSENTRYW MY PWNDCLASSEXA 2 STYLEBUFW �R tagWNODE_EVENT_REFERENCE �X _MEMORY_FRAME_INFORMATION $ LY PWORKER_FACTORY_DEFERRED_WORK ! KY PSECTION_IMAGE_INFORMATION JY PSCOPE_TABLE W DIAGNOSTIC_BUFFER �/ tagEMRSETDIBITSTODEVICE S* NORM_FORM h2 _STREAM_INFO_LEVELS �, DRAWPATRECT IY PSMALL_RECT HY PSE_IMPERSONATION_STATE GY LPMETAHEADER EY LPHIGHCONTRASTA / DY PPROCESS_REVOKE_FILE_HANDLES_INFORMATION + 1 _SYSTEM_WRITE_CONSTRAINT_INFORMATION �@ MUILANGCFGNODE $ CY PCTEB_ACTIVE_FRAME_CONTEXT_EX @Y FILE_POSITION_INFORMATION IR RTL_FEATURE_CONFIGURATION � _REMOTE_PORT_VIEW " NLS_FUNCTION % >Y PTXFS_WRITE_BACKUP_INFORMATION 9 =Y PCACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION � TRACE_LOGFILE_HEADER64 /3 _FILE_STREAM_INFO � RpcPerfCounters * Y) ETW_UMS_EVENT_DIRECTED_SWITCH_START �! _TRANSACTION_STATE 18 RPC_SYNTAX_IDENTIFIER ;@ FILE_BOTH_DIR_INFORMATION - ;Y PJOURNAL_CREATE_DELETE_KEY_INFORMATION , P _TRANSACTIONMANAGER_INFORMATION_CLASS 1 :Y RTL_SPARSE_BITMAP_UPDATE_METADATA_CALLBACK j9 DEVMODEW " �' tagRID_DEVICE_INFO_KEYBOARD 2 IMAGE_ENCLAVE_CONFIG32 $ �F _FILE_PIPE_SILO_ARRIVAL_INPUT ! S. OPERATION_START_PARAMETERS ' 6Y DISPLAYCONFIG_TARGET_DEVICE_NAME 3Y PIMAGE_FUNCTION_ENTRY uint8x8x2_t ! 2Y PPO_FIXED_WAKE_SOURCE_TYPE G" CM_VIDEO_DEVICE_DATA $ � _ENLISTMENT_INFORMATION_CLASS e( WOW64_LDT_ENTRY &. LPSECURITY_ATTRIBUTES # 1Y PETW_OPTICALIO_FLUSH_BUFFERS 9, _QUAD ) E ALPC_PORT_MESSAGE_ZONE_INFORMATION �" _KEY_FULL_INFORMATION �/ _INITIAL_TEB ( �8 _MEMORY_ENCLAVE_IMAGE_INFORMATION � _TP_CALLBACK_ENVIRON_V3 : PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION � tagHANDLETABLE ) .Y PSE_LEARNING_MODE_USER_OBJECT_DATA % "E ALPC_MESSAGE_INFORMATION_CLASS $. DEDUP_FILE_OPERATION # -Y PPERFINFO_MEMORY_INFORMATION - � ETW_COVERAGE_SAMPLER_INFORMATION_CLASS 3 ,Y PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE # _# _TEB_ACTIVE_FRAME_CONTEXT_EX 3 *Y _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX �0 tagNONCLIENTMETRICSA 'Y PTERMINATION_HANDLER �< EMRFILLRGN �S _THREAD_PERFORMANCE_DATA �B _WOF_EXTERNAL_FILE_ID " $Y PSYSTEM_PROCESS_INFORMATION * �7 MEM_SECTION_EXTENDED_PARAMETER_TYPE OW POSVERSIONINFOA < _PHYSICAL_DISK_RECORD � int8x8x4_t _< CM_Power_Data_s #Y PEMRPOLYDRAW # �> PROCESS_WS_WATCH_INFORMATION ) %4 FSCTL_QUERY_STORAGE_CLASSES_OUTPUT /X _IMAGE_DATA_DIRECTORY 1 FILE_FS_SIZE_INFORMATION # "Y I_RpcProxyGetClientAddressFn � _ULARGE_INTEGER Y PERFINFO_WORKINGSET_ENTRY Y CSV_IS_OWNED_BY_CSVFS p EVENTLOG_HANDLE_A ) uint64x1_t $ Y PENLISTMENT_BASIC_INFORMATION I _TP_LOG_LEVEL h _RTL_TRACE_ENUMERATE p NPSTR �= SYSTEM_AUDIT_OBJECT_ACE * _ACCESS_REASONS Y PCI_LOG_MMCSS_STOP a _SID_AND_ATTRIBUTES_HASH Y PPS_STD_HANDLE_INFO Y PLOAD_DLL_EVENT_DATA i6 CONTEXT_EX �V _COUNTED_REASON_CONTEXT Y PACTCTXW ' Y PRTL_SPARSE_BITMAP_CTX_OPERATION " e) PARTITION_INFORMATION_CLASS # '7 FILE_FS_OBJECTID_INFORMATION , a% REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER Y PPPM_THERMALCHANGE_EVENT �F _KEY_CACHED_INFORMATION % _DMA_WIDTH
Y PRTL_RUN_ONCE }X MESSAGE_RESOURCE_DATA �* PLARGE_INTEGER �% SYSTEM_POOL_ENTRY Y LPWCRANGE � EMRSETMAPMODE PSID &
Y ETW_ANTI_STARVATION_BOOST_EVENT �5 CI_LOG_SCHEDULER_SLEEP A$ _TIMER_INFORMATION_CLASS �' _LDR_DLL_LOAD_REASON f$ _WOW64_FLOATING_SAVE_AREA 3 Y PTRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT ' Y PREDIRECTION_FUNCTION_DESCRIPTOR # PERFINFO_TIMESTAMP Y PSYSDBG_VIRTUAL Y PRTL_HANDLE_TABLE �) MULTIKEYHELPW % � _PROCESS_HANDLE_TRACING_ENABLE Y PCSV_QUERY_MDS_PATH_V2 2 �E CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE & Y PMEMORY_WORKING_SET_EX_LOCATION � PCWPSTRUCT �X PPERFINFO_FLT_OPERATION # PDWORD64 � uint32x2x3_t �, IMAGE_POLICY_ENTRY_TYPE � PEMRSELECTCLIPPATH 6$ tagCURSORINFO ) DIRECTORY_NOTIFY_INFORMATION_CLASS D FILE_ALLOCATION_INFO �X PMIDL_METHOD_PROPERTY_MAP # �B PERFINFO_CC_WORKITEM_DEQUEUE ) �X PCLDR_DLL_LOADED_NOTIFICATION_DATA �X MEMORY_FRAME_INFORMATION �0 SCROLLBARINFO �X HIMCC �; PPERFINFO_TRACE_ENTRY % �X PPERFINFO_FLT_OPERATION_STATUS �T BOOT_OPTIONS 5 ,; _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST & �X PRTL_DYNAMIC_HASH_TABLE_CONTEXT �X PACTCTXA �7 tagIMECHARPOSITION � int64x1x3_t �X PFP_IEEE_RECORD �+ RTLP_HEAP_TAGGING_INFO �X LPCPINFOEX ! hG _PERFINFO_FILE_INFORMATION �X PENCLAVE_CREATE_INFO_VBS �X PMUILANGLIST xU PERFINFO_IO_TIMER u ULONG32 �X PSINGLE_LIST_ENTRY32 * &9 EVENT_TRACE_PROFILE_ADD_INFORMATION ! -H _FILE_FS_LABEL_INFORMATION * Y+ _SYSTEM_FEATURE_CONFIGURATION_QUERY �X LPMDICREATESTRUCTW $ �X PETW_KTIMER2_EXPIRATION_EVENT �! int8x16x3_t �X PPHYSICAL_DISK_RECORD & B' _LINK_TRACKING_INFORMATION_TYPE � MEM_EXTENDED_PARAMETER . zE READ_DIRECTORY_NOTIFY_INFORMATION_CLASS * N ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN � SILO_USER_SHARED_DATA + _FSINFOCLASS �X HINSTANCE__ �< _ETW_BUFFER_CONTEXT ! �- MEMORY_COMBINE_INFORMATION , m) _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA �X POPERATION_END_PARAMETERS . �X PRTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY H UNIVERSAL_NAME_INFOA �% LPCOMPOSITIONFORM ) TOKEN_DEVICE_CLAIMS _? PGLYPHSET , �X PPERFINFO_DYNAMIC_TICK_DISABLE_REASON ' �X PSYSTEM_DPC_BEHAVIOR_INFORMATION ( �W _SYSTEM_LEGACY_DRIVER_INFORMATION ( hW _MIDL_INTERFACE_METHOD_PROPERTIES " # _WATCHDOG_INFORMATION_CLASS + �X PRPC_HTTP_TRANSPORT_CREDENTIALS_V2_A # O> UMS_CREATE_THREAD_ATTRIBUTES ' �X PCRITICAL_PROCESS_EXCEPTION_DATA �T _EXIT_PROCESS_DEBUG_INFO lB PERFINFO_SPINLOCK_CONFIG & BV _KEY_VIRTUALIZATION_INFORMATION �2 LPDISPLAY_DEVICEA HDEVNOTIFY �V tagMONITORINFOEXW �D REPAIR_COPIES_OUTPUT , 1= _SYSTEM_INTERRUPT_CPU_SET_INFORMATION $ *F _PLUGPLAY_CONTROL_STATUS_DATA + �X PFSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT ! �1 tagWTSSESSION_NOTIFICATION �X PTEB_ACTIVE_FRAME_EX �9 _LPC_CLIENT_DIED_MSG # �X PPROCESSOR_POWER_POLICY_INFO [. _SD_QUERY_STATS_OUTPUT _WIN32_FIND_DATAW �9 FILE_CASE_SENSITIVE_INFO �X LPLOGBRUSH32 " �$ RTL_GENERIC_COMPARE_RESULTS �D tagPOINTER_INFO �? _SYSTEM_ACCESS_FILTER_ACE �X PSERVICE_NOTIFY_2A �X NPLOGBRUSH32 �X PPERFINFO_VAD_ROTATE_INFO �X LPMSGBOXPARAMS �X PVALENTW RTL_REFERENCE_COUNT32
p PCCHAR � STARTUPINFOW , �X PCSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT ) _PERFINFO_DYNAMIC_TICK_VETO_REASON 5 HMODULE | _WIN32_FIND_DATAA �X FILE_REFERENCE_RANGE & �X PPROCESS_MEMORY_EXHAUSTION_INFO �X PSPARSE_OVERALLOCATE_DATA MOFHANDLE �G _RPC_IF_ID �X PPPM_IDLE_STATE_BUCKET_EX , �: MEMORY_PARTITION_PAGEFILE_INFORMATION % K9 PROCESS_MEMORY_EXHAUSTION_INFO �X PSE_SECURITY_DESCRIPTOR �X PPS_PKG_CLAIM & �X PWIM_PROVIDER_ADD_OVERLAY_INPUT $ �X PSYSTEM_LOOKASIDE_INFORMATION - �X PPLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA Z- _TP_TASK_CALLBACKS ( �S _LOOKUP_STREAM_FROM_CLUSTER_ENTRY # �X RTL_GENERIC_ALLOCATE_ROUTINE ! X UNWIND_HISTORY_TABLE_ENTRY �/ FILE_RENAME_INFORMATION �X PVCN_RANGE_INPUT_BUFFER K@ PEMRCLOSEFIGURE V LPMODEMDEVCAPS � PERFINFO_CCSWAP ; �X PTOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION ) 3 SYSTEM_SESSION_BIGPOOL_INFORMATION �X LPRAWKEYBOARD �X LPNMHDR "V _GLYPHMETRICS ) 1 _TXFS_ROLLFORWARD_REDO_INFORMATION � FSCTL_OFFLOAD_WRITE_INPUT ~9 LPFILETIME �X PMMPFN_IDENTITY �X PKTMOBJECT_CURSOR �X _EVENT_TRACE_LOGFILEW 5 _SYSTEM_PIXEL_FORMAT $ SECTION_INFORMATION_CLASS �? _PO_WAKE_SOURCE_INTERNAL �R RTL_FEATURE_USAGE_DATA $ �: _WORKER_FACTORY_DEFERRED_WORK ' Q JOBOBJECT_RATE_CONTROL_TOLERANCE ?T tagEMRROUNDRECT �X PEMRFORMAT X _FILE_QUOTA_INFORMATION " - _REQUEST_RAW_ENCRYPTED_DATA �X PMEMORY_IMAGE_INFORMATION 0 '< TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT �X LPEXIT_PROCESS_DEBUG_INFO + �X PCLDR_DLL_UNLOADED_NOTIFICATION_DATA # �X PREFS_SMR_VOLUME_INFO_OUTPUT & �X PPERFINFO_SAMPLED_PROFILE_CACHE 3 �X PSYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION �, FLOAT128 # �X PFILE_ALLOCATED_RANGE_BUFFER / LPINIT_ONCE �= NEWTEXTMETRICA 4 *' _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM ! �X PEVENT_EXTENDED_ITEM_TS_ID �B _DEBUG_EVENT �X PLOGICAL_DISK_DEFRAG �E OPTICAL_MEDIA_RECORD 0 �E STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY �X PFIRMWARE_TYPE � _SYSTEM_TPM_INFORMATION � _ACL_INFORMATION_CLASS ! �X PTXFS_QUERY_RM_INFORMATION G _RTL_FEATURE_USAGE_REPORT �X PTP_JOB ( �G LPCREATEFILE2_EXTENDED_PARAMETERS ) float32x2_t �X PALPC_DIRECT_ATTR ! K< _JOURNAL_INFORMATION_CLASS + _PLUGPLAY_CONTROL_USER_RESPONSE_DATA �X LPNETCONNECTINFOSTRUCT & �: _EVENT_EXTENDED_ITEM_PEBS_INDEX �X PDYNAMIC_FUNCTION_TABLE �, HCOLORSPACE__ �X PRPC_IMPORT_CONTEXT_P $ �6 VIRTUAL_STORAGE_BEHAVIOR_CODE �X PIO_RESOURCE_LIST �/ PENUMTEXTMETRICA " �9 _ENABLE_TRACE_PARAMETERS_V1 " �X _FILE_ZERO_DATA_INFORMATION 5 �X PRTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY & �@ PRTL_PROCESS_REFLECTION_ROUTINE �X LPREMOTE_NAME_INFOA �: _ALPC_BASIC_INFORMATION 0 �D FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX " X PSYSTEM_POWER_LOGGING_ENTRY }X _MESSAGE_RESOURCE_DATA [V tagEMRCREATEPALETTE xX AUDIODESCRIPTION p PTSTR ( uX PIMAGE_LOAD_CONFIG_CODE_INTEGRITY tX PCPTABLEINFO , +, _RTL_USER_PROCESS_EXTENDED_PARAMETERS sX PIMAGE_THUNK_DATA32 & �G _SYSTEM_PERFORMANCE_INFORMATION & qX WIN32_MEMORY_REGION_INFORMATION �V HARDWAREHOOKSTRUCT # B _KEY_VALUE_LAYER_INFORMATION � _WOW64_CONTEXT gX KENTROPY_TIMING_ROUTINE # �F WOW64_DESCRIPTOR_TABLE_ENTRY � HBRUSH__ dX PDIAGNOSTIC_BUFFER # bX TRACE_ENABLE_FLAG_EXT_HEADER " �E _MEMORY_BASIC_INFORMATION32 _X WINSTAENUMPROCA 4 �D _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION ^X PREDIRECTION_DESCRIPTOR �! EMRABORTPATH 8B PCUUCSCHAR D? _FP_128 ]X LPCMENUITEMINFOW ! �; JOBOBJECT_WAKE_INFORMATION " �T FILE_FS_CONTROL_INFORMATION ! [X ENTER_STATE_NOTIFY_HANDLER 0 bU SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION �$ poly8x16x4_t & ZX PCM_PNP_BIOS_INSTALLATION_CHECK # ULONG64 � EMRSETCOLORSPACE YX LPDLGTEMPLATEW � WNODE_EVENT_ITEM ( �F WIM_PROVIDER_REMOVE_OVERLAY_INPUT & �, CI_WINDOWS_LOCKDOWN_RESTRICTION ) XX PRTL_YIELD_UNTIL_CONDITION_ROUTINE % UX DISPLAYCONFIG_TARGET_BASE_TYPE RX LPFMTID * }2 _SECTION_INTERNAL_IMAGE_INFORMATION wE CONSOLE_HISTORY_INFO # QX PPARTITION_INFORMATION_CLASS FP_OPERATION_CODE " E _FSCTL_QUERY_FAT_BPB_BUFFER $ PX PEXTENDED_ENCRYPTED_DATA_INFO ' �+ _SYSTEM_POOL_ZEROING_INFORMATION " O2 SHRINK_VOLUME_REQUEST_TYPES + OX PFN_NT_QUERY_INFORMATION_TRANSACTION % � PUBLIC_OBJECT_TYPE_INFORMATION � _KCONTINUE_ARGUMENT T6 SERVICE_ERROR_TYPE " _SERVICE_DESCRIPTIONW �$ int32x4x4_t LX PFSCTL_OFFLOAD_READ_INPUT KX PIMAGE_RELOCATION IX PWNF_DATA_SCOPE �+ ENUMLOGFONTEXA � tagCWPSTRUCT Q0 PERFINFO_MM_STAT 2 �R _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION E _LDRP_CSLIST 5 �8 SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY HX PCPU_CONFIG_RECORD + �0 PERFINFO_DYNAMIC_TICK_DISABLE_REASON M _SUITE_TYPE 6 _FILE_OBJECTID_BUFFER ," _POWER_STATE * GX PSYSTEM_SESSION_POOLTAG_INFORMATION �' LDR_DLL_LOAD_REASON FX PEMRCREATEBRUSHINDIRECT EX PETW_HEAP_EVENT_CREATE Q8 IMAGE_AUX_SYMBOL_EX # d5 SECURITY_DESCRIPTOR_RELATIVE /3 FILE_STREAM_INFO :T _IMAGE_RESOURCE_DIRECTORY _PS_PROTECTION FB CONNECTDLGSTRUCTA , AX PSYSTEM_BASIC_PERFORMANCE_INFORMATION ?X LOCALE_ENUMPROCEX ) �W FILE_QUERY_ON_DISK_VOL_INFO_BUFFER ] RTL_UMS_SCHEDULER_REASON �F LPWINDOWINFO p PNZCH L- SD_ENUM_SDS_ENTRY � EMRDELETECOLORSPACE # 84 ETW_UMS_EVENT_CONTEXT_SWITCH <X PREAD_USN_JOURNAL_DATA_V1 % �- _SYSDBG_LIVEDUMP_CONTROL_FLAGS $ YH _TRACE_PROVIDER_INSTANCE_INFO _ETW_BUFFER_STATE 9X PETW_HEAP_EVENT_SNAPSHOT 1 $ PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION $ eD _JOURNAL_ABSOLUTE_INFORMATION ( 8X PRTL_IMAGE_MITIGATION_ASLR_POLICY " 7X PSYSDBG_KD_PULL_REMOTE_FILE ) C _WMI_EXTENDED_THREAD_INFORMATION64 �" _HIBERFILE_BUCKET_SIZE 5X _WOF_EXTERNAL_INFO 2X PRTL_FEATURE_USAGE_DATA 1X PCM_KEYBOARD_DEVICE_DATA -X PIMAGE_DATA_DIRECTORY # )X PSYSTEM_PAGEFILE_INFORMATION �* RTL_DRIVE_LETTER_CURDIR V0 _VARIABLE_NAME # (X PRTL_GENERIC_COMPARE_ROUTINE " �9 ETW_DISKIO_FLUSH_BUFFERS_V3 " � SERVERSILO_INIT_INFORMATION & 'X PFILE_IO_COMPLETION_INFORMATION %X PETW_READY_THREAD_EVENT �# _IO_STATUS_BLOCK32 #X PERFINFO_CC_FLUSH_CACHE * �; PERFINFO_DOMAIN_CHANGE_EVENT_REASON
# SIZE_T ! 7& _KEY_SET_INFORMATION_CLASS �U tagICONMETRICSW & IW _PERFINFO_SAMPLED_PROFILE_CACHE �6 IMAGE_OPTIONAL_HEADER32 X FILE_QUOTA_INFORMATION %( SERVICE_LOAD_TYPE 2 X PRTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER ' X PFILE_DISPOSITION_INFORMATION_EX & X PFILE_PROVIDER_EXTERNAL_INFO_V0 �& RTL_UMS_CONTEXT $ J$ ETW_TP_EVENT_CALLBACK_ENQUEUE � ETW_WNF_EVENT_SUBSCRIBE " X _UNWIND_HISTORY_TABLE_ENTRY 0 < JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION �B WOF_EXTERNAL_FILE_ID * X PSYSTEM_KERNEL_DEBUGGER_INFORMATION � PLUGPLAY_CONTROL_CLASS �G _RTL_HEAP_PARAMETERS
@ PFLOAT #
X PENCLAVE_LOAD_DATA_VBS_BASIC
HLOCAL % X PIMAGE_BOUND_IMPORT_DESCRIPTOR X PUSN_RECORD_V2 �U _RTL_HANDLE_TABLE ( X PSYSTEM_MANUFACTURING_INFORMATION �- EMREXTTEXTOUTW XW SERVICE_FAILURE_ACTIONSW ! X PWMI_IMAGEID_INFORMATION32 # X PFILE_SET_DEFECT_MGMT_BUFFER �5 _CM_SERVICE_NODE_TYPE �W LPRGBQUAD �3 SRWLOCK �W PFILE_DISPOSITION_INFO - �W _CLAIM_SECURITY_ATTRIBUTES_INFORMATION
�W PTP_IO _IMAGE_MITIGATION_POLICY 8# CWPRETSTRUCT " �W PSYSTEM_MANDATORY_LABEL_ACE $ ; JOBOBJECT_WAKE_INFORMATION_V1 & �T PROCESS_LEAP_SECOND_INFORMATION " �W PFILE_GET_QUOTA_INFORMATION �W PETW_REF_CLOCK �W PKERNEL_USER_TIMES 0 �W PSYSTEM_NET_RATE_CONTROL_DISPATCH_ROUTINE
U _KEY_NAME_INFORMATION �G _RPC_POLICY # � GENERIC_BINDING_ROUTINE_PAIR � _WGLSWAP �W tagUSAGE_PROPERTIES �5 _PERFINFO_MEM_RESET_INFO , �T ACTIVATION_CONTEXT_SECTION_KEYED_DATA
- LPSYSTEMTIME x; EMRCREATEPEN - 91 _TRANSACTIONMANAGER_OLDEST_INFORMATION �W MONITORENUMPROC $ �@ FSCTL_QUERY_REGION_INFO_INPUT ' � RTL_FEATURE_CONFIGURATION_UPDATE '2 WINDOWS_OS_OPTIONS iA CM_EISA_SLOT_INFORMATION �W LPDLGTEMPLATE �G _SC_ACTION # (S _TIMER_SET_INFORMATION_CLASS 7 � _MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION �= tagNEWTEXTMETRICA �U MESSAGE_TRACE_HEADER * NT_TIB64 / �W PPROCESS_READWRITEVM_LOGGING_INFORMATION , �; SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT � PRTL_UMS_COMPLETION_LIST . PROCESSOR_CACHE_TYPE / �4 RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY -> _FILE_ALL_INFORMATION �W PSTRING32 �W PT2_SET_PARAMETERS & �W PSYSTEM_LEAP_SECOND_INFORMATION 0 01 SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION �W PETW_WNF_EVENT_CALLBACK " �W _SYSTEM_POWER_LOGGING_ENTRY & E _PROCESSOR_PROFILE_CONTROL_AREA & �C RTL_IMAGE_MITIGATION_DEP_POLICY �W PTOKEN_CONTROL " �W PWIM_PROVIDER_OVERLAY_ENTRY _> tagMONITORINFOEXA � LUID % E= _FILE_PIPE_EVENT_SELECT_BUFFER " � BAD_MEMORY_CALLBACK_ROUTINE �W PRID_DEVICE_INFO x int16x8_t �W _FILE_STORAGE_TIER_REGION " �W SECTION_IMAGE_INFORMATION64 oD NPEVENTMSG �W LPMONITORINFOEX ) GA _ETW_UMS_EVENT_DIRECTED_SWITCH_END V1 SYSTEM_FLUSH_INFORMATION $ �W PETW_TP_EVENT_POOL_TH_MIN_SET �7 _PS_MEMORY_RESERVE $ �W POBJECT_DIRECTORY_INFORMATION i DISPLAYCONFIG_TOPOLOGY_ID |6 CBTACTIVATESTRUCT ' A _PERFINFO_WORKINGSET_INFORMATION S PNP_QUERY_RELATION % =8 SYSTEM_LEAP_SECOND_INFORMATION # �& HEAP_BLOCK_EXTRA_INFORMATION # �E PROCESS_HANDLE_TRACING_ENTRY �8 _ETW_HEAP_EVENT_RUNDOWN / TXFS_START_RM_INFORMATION = _MEM_ADDRESS_REQUIREMENTS �- _DEVICE_FLAGS �' tagEMRPOLYTEXTOUTA b PERFINFO_GROUPMASK �- _MEMORYSTATUSEX u POINTER_FLAGS �W PFILE_STORAGE_TIER_REGION �W PPROFILE_SOURCE_INFO �6 _SD_ENUM_SDS_OUTPUT �1 pvalueA �5 MEMORY_INFORMATION_CLASS � NDR_NOTIFY_ROUTINE & �W PLINK_TRACKING_INFORMATION_TYPE �W PRTL_BUFFER �W FONTENUMPROCW �W _IMAGE_SYMBOL ! E FSCTL_QUERY_FAT_BPB_BUFFER 8 �# SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION � tagSOUNDSENTRYA + � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION �W ENHMFENUMPROC �< POINTER_DEVICE_INFO � int8x8x3_t �T _BOOT_OPTIONS w% PMOUSEHOOKSTRUCTEX �$ ETW_READY_THREAD_EVENT �W WNF_META_CALLBACK [U _KLDR_DATA_TABLE_ENTRY32 ! B3 _SYSTEM_MEMORY_INFORMATION �. MAXVERSIONTESTED_INFO �W LAYERPLANEDESCRIPTOR �W PPVALUE �* EVENT_TYPE ' �V SYSTEM_MANUFACTURING_INFORMATION �W PEVENT_BASIC_INFORMATION �@ _MUILANGCFGNODE + +, RTL_USER_PROCESS_EXTENDED_PARAMETERS { KERNINGPAIR �W PEMRSTRETCHBLT uint32x2x2_t * �W _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER _WMI_PNP_RECORD_V5 * �R _VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT % V+ RTL_FEATURE_CONFIGURATION_TYPE � PDELETEITEMSTRUCT _WMI_JOB_ASSIGN_PROCESS PTUCHAR % �W PFILE_ZERO_DATA_INFORMATION_EX * _ FILE_STORAGE_RESERVE_ID_INFORMATION �+ SERIALKEYS ( �4 _RPC_HTTP_TRANSPORT_CREDENTIALS_A �1 STICKYKEYS o$ tagSIZE �! poly16x8x3_t * �5 _KEY_SET_VIRTUALIZATION_INFORMATION � IO_SESSION_STATE �W PCI_WINDOWS_LOCKDOWN_MODE vS RTL_ELEVATION_FLAGS 0 �. _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION ^" _FP__IEEE_ROUNDING_MODE # �W PETW_CRITSEC_EVENT_COLLISION ! �, _IMAGE_COFF_SYMBOLS_HEADER �W PCIMAGE_TLS_DIRECTORY32 EE TXFS_LIST_TRANSACTIONS s TRANSACTION_OUTCOME $ �W PEVENT_TRACE_BUFFER_CALLBACKW z, SERVICE_NOTIFY_2A �' IMAGE_HOT_PATCH_INFO # � ReplacesCorHdrNumericDefines � SE_IMPERSONATION_STATE %G FILE_SET_SPARSE_BUFFER �W PRTL_TICK_LOCK
# UINT64 =. IMAGE_TLS_DIRECTORY ' �W PROCESS_DEVICEMAP_INFORMATION_EX - U@ PROCESS_MITIGATION_DYNAMIC_CODE_POLICY �W PCM_MONITOR_DEVICE_DATA $ �( DYNAMIC_TIME_ZONE_INFORMATION F4 tagTTPOLYGONHEADER 8V LPGUITHREADINFO �B _ETW_DEBUG_PRINT_EVENT 5 SYSTEM_AUDIT_ACE �5 _MEMORY_INFORMATION_CLASS �W LPDISCDLGSTRUCTA + e1 _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO ( �W PSYSTEM_LEGACY_DRIVER_INFORMATION 2 �W _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER 0 �8 _EVENT_TRACE_SESSION_SECURITY_INFORMATION 0 ? _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY �W PPOWER_SESSION_CONNECT ! H _TP_POOL_STACK_INFORMATION u PREGISTERWORDW �W PETW_WNF_EVENT_SUBSCRIBE 3 �; _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT R; RTL_RELATIVE_NAME_U �T _RTL_HEAP_STACK_QUERY �7 WNODE_METHOD_ITEM EMRPOLYBEZIERTO ) g5 PEVENT_TRACE_IPT_EVENT_INFORMATION q PWCH # � FILE_TYPE_NOTIFICATION_INPUT 3 EMRCREATECOLORSPACE + tagCREATESTRUCTA sW _PERFINFO_DEBUG_EVENT
W2 _FP_80 �W ENTER_STATE_HANDLER �W PRPC_SERVER_INTERFACE � RTL_RESOURCE_DEBUG32 " DWORD W PCTEB_ACTIVE_FRAME_EX ) tagLOGBRUSH # }W LPTOP_LEVEL_EXCEPTION_FILTER # � _SERVERSILO_INIT_INFORMATION |W PUSN_RECORD wW PSL_KMEM_CACHE �7 UNICODE_PREFIX_TABLE
" RULONG uW PFILE_PREFETCH �# WNODE_TOO_SMALL . � PROCESS_STACK_ALLOCATION_INFORMATION_EX 5 �C _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION sW PERFINFO_DEBUG_EVENT " � IMAGE_DYNAMIC_RELOCATION_V2 , �6 HEAP_PERFORMANCE_COUNTERS_INFORMATION f _STREAM_EXTENT_ENTRY nW PFILE_ALIGNMENT_INFO \! MENUINFO # v9 ENUM_SERVICE_STATUS_PROCESSW
! UINT16 D) _ALPC_SECURITY_ATTR $ lW EXTENT_READ_CACHE_INFO_BUFFER �7 _POWER_SESSION_RIT_STATE �< ENUMLOGFONT �! EMRENDPATH ' hW MIDL_INTERFACE_METHOD_PROPERTIES � ETW_OBJECT_HANDLE_EVENT >, SECURITY_CAPABILITIES ( bW RTL_IMAGE_MITIGATION_SEHOP_POLICY T9 IPT_TRACE_EVENT_DATA ( _W PETW_COVERAGE_SAMPLER_STATUS_INFO ) [W PRTL_DYNAMIC_TIME_ZONE_INFORMATION ! VW LPSERVICE_FAILURE_ACTIONSW �2 _ETW_HEAP_EVENT_ALLOC - RW PSERVICE_CONTROL_STATUS_REASON_PARAMSA V REPARSE_INDEX_KEY $ }> MANAGE_HOT_PATCH_UNLOAD_PATCH OW LPOSVERSIONINFOA RAWMOUSE " MW ETW_CRITSEC_EVENT_COLLISION % IW PERFINFO_SAMPLED_PROFILE_CACHE ( ( TRACE_PERIODIC_CAPTURE_STATE_INFO �2 PCSTR � LPENUMLOGFONTEXDVA " F _FILE_FS_DEVICE_INFORMATION �@ PRTL_ACQUIRE_LOCK_ROUTINE �= IMAGE_IMPORT_DESCRIPTOR
�/ SE_SID * �T FILE_LINK_ENTRY_FULL_ID_INFORMATION � REPAIR_COPIES_INPUT � FP_IEEE_FORMAT , DW _SYSTEM_PROCESS_INFORMATION_EXTENSION - �T _ACTIVATION_CONTEXT_SECTION_KEYED_DATA
�2 LPCSTR �D EXCEPTION_LOG � PARSE_MESSAGE_CONTEXT PLONG_PTR " �( _SYSTEM_CPU_SET_INFORMATION , <W _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE A- ACCESS_ALLOWED_ACE # �3 DEFINE_STORAGE_RESERVE_INPUT �! HIGHCONTRAST + & _PROCESS_KEEPALIVE_COUNT_INFORMATION &> SD_QUERY_STATS_INPUT WMIHANDLE 7W PCULONG $ 5W PREFS_DEALLOCATE_RANGES_RANGE 4W PFN_NT_OPEN_TRANSACTION � PRTL_UMS_CONTEXT u TOUCH_MASK /W LPSC_ACTION + 7 FILE_IOSTATUSBLOCK_RANGE_INFORMATION -W _PAGEDIR_INFORMATION ! X, ENLISTMENT_CRM_INFORMATION (W PRTL_FREE_STRING_ROUTINE + 'W PRTL_IS_THREAD_WITHIN_LOADER_CALLOUT % �4 SYSTEM_DEVICE_DATA_INFORMATION %W LPHW_PROFILE_INFOA RAWINPUT $W RPC_MGMT_AUTHORIZATION_FN ! �7 _ETW_COVERAGE_SAMPLER_DATA �6 FARPROC ! � EVENT_INSTANCE_GUID_HEADER $ � PPS_POST_PROCESS_INIT_ROUTINE �E FILE_FULL_DIR_INFORMATION # *F PLUGPLAY_CONTROL_STATUS_DATA ! !W PPPM_IDLE_STATE_ACCOUNTING �9 _RTL_HEAP_STACK_CONTROL " W PPS_BNO_ISOLATION_PARAMETER �= LASTINPUTINFO _CM_PERF_COUNTERS � _FP__IEEE_FORMAT �( _CPU_SET_INFORMATION_TYPE W PTP_CALLBACK_INSTANCE W PEMRGRADIENTFILL W PIMAGE_ROM_HEADERS W PGET_MODULE_HANDLE_EXA DLL_DIRECTORY_COOKIE
PSHORT J _FILE_SEGMENT_ELEMENT . PINTERFACE_DEREFERENCE % ,% _PROCESS_ENERGY_TRACKING_STATE W LANGGROUPLOCALE_ENUMPROCA W PRID_DEVICE_INFO_KEYBOARD } AXESLISTW W PBOOT_RECORD �9 IMAGE_HOT_PATCH_BASE ;U RAWINPUTHEADER W PCI_LOG_SCHEDULER_WAKEUP W _TOKEN_LINKED_TOKEN W _DIAGNOSTIC_BUFFER ! <2 PERFINFO_IDLE_STATE_CHANGE � _KSPIN_LOCK_QUEUE_NUMBER $ W PQUERY_STORAGE_RESERVE_OUTPUT �6 PROC $ �D EXCEPTION_REGISTRATION_RECORD ) _VRF_TRIAGE_CONTEXT ! mS ETW_TIMER_EXPIRATION_EVENT + W PETW_TP_EVENT_WORKER_NUMANODE_SWITCH cT _MESSAGE_RESOURCE_ENTRY �V _LOAD_DLL_DEBUG_INFO �* LPDRAWITEMSTRUCT �) STRING32 �0 GHOSTED_FILE_EXTENT ' �G _CREATEFILE2_EXTENDED_PARAMETERS + �S _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W ' � _EVENT_HEADER_EXTENDED_DATA_ITEM �V _PORT_DATA_ENTRY " �V PWIM_PROVIDER_EXTERNAL_INFO ! c< KEY_VALUE_FULL_INFORMATION ! _REFS_SMR_VOLUME_GC_METHOD 29 ARM64_NT_CONTEXT � CACHE_RELATIONSHIP �V PHARDWAREHOOKSTRUCT h PRTL_CRITICAL_SECTION � RPC_CLIENT_ALLOC > _NT_TIB 85 _RTL_PROCESS_LOCKS �V PFLS_DATA ! a PUMS_SCHEDULER_ENTRY_POINT �V PERFINFO_MARK_INFORMATION & � _PO_CS_DEVICE_NOTIFICATION_TYPE " TP_VERSION �V PRAWINPUTDEVICELIST , �0 _PERFINFO_DYNAMIC_TICK_DISABLE_REASON u PUINT32 , B _PROCESS_MITIGATION_IMAGE_LOAD_POLICY hT tagMDICREATESTRUCTW �5 TOKEN_USER_CLAIMS ! �V PREFS_SMR_VOLUME_GC_METHOD �V PACTCTX �V PNEON128 � _ETW_OBJECT_HANDLE_EVENT �. SI_COPYFILE ! � _REFS_SMR_VOLUME_GC_ACTION �V PEMRMASKBLT ! �( _FILE_INTERNAL_INFORMATION Y ENUMTEXTMETRICA UINT8 U RTL_TIME_ZONE_INFORMATION e: _TRACE_VERSION_INFO $ �V EVENT_EXTENDED_ITEM_EVENT_KEY s _CLIENT_ID ( �V STREAMS_ASSOCIATE_ID_INPUT_BUFFER ! �V PPS_MITIGATION_OPTIONS_MAP 0 �< _SYSTEM_FEATURE_CONFIGURATION_INFORMATION L tagAXESLISTA �V PINPUT_RECORD " �B FILE_ALLOCATED_RANGE_BUFFER �> REARRANGE_FILE_DATA32 , �A _SYSTEM_LOGICAL_PROCESSOR_INFORMATION �V LPCOMSTAT �? _IMAGE_CHPE_METADATA_X86 �V PSCRUB_PARITY_EXTENT_DATA 6 IMAGE_POLICY_ID 5T PO_WAKE_SOURCE_HEADER hU T2_SET_PARAMETERS 2 EMRSETMAPPERFLAGS �T PRPC_SID % �V PPROCESS_MITIGATION_DEP_POLICY � _PS_MITIGATION_OPTION �V PCONSOLE_FONT_INFOEX �V PCZPCWSTR �2 LPCCH �V SLIST_HEADER $ �V PSECURITY_IMPERSONATION_LEVEL - V _FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER ( �? SYSTEM_WATCHDOG_TIMER_INFORMATION - �V PPLUGPLAY_CONTROL_TARGET_RELATION_DATA ( 6@ SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX ( �V _SYSTEM_MANUFACTURING_INFORMATION $ �V _EVENT_EXTENDED_ITEM_INSTANCE �. ETW_THREAD_SET_NAME_EVENT < tagMSGBOXPARAMSA # �V PFILE_LINK_ENTRY_INFORMATION # IR SYSTEM_FEATURE_CONFIGURATION # Q ACTIVATION_CONTEXT_MSIX_INFO �% PCZZWSTR K KPROFILE_SOURCE �V PDISPATCHER_CONTEXT_ARM64 + 0 PROCESS_EXTENDED_BASIC_INFORMATION64 % �V _PERFINFO_SET_POWER_ACTION_RET
�% LPCWCH � HEAP_SUBSEGMENT_ACTIVATED 36 EVENTLOG_FULL_INFORMATION T NETINFOSTRUCT �: WMIGUIDINFORMATION �) ETW_WAKE_COUNTER_EVENT 0 �G _MEMORY_PARTITION_INITIAL_ADD_INFORMATION �V LPSCROLLINFO # �V POFFSETINSTANCEDATAANDLENGTH PLANGINDEX ) <5 FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER �V PHELPWININFO , �V PJOBOBJECT_IO_ATTRIBUTION_INFORMATION C LPCRECT p? CPTABLEINFO �V DRAWSTATEPROC �V PPORT_DATA_ENTRY , ; _SYSTEM_SECUREBOOT_POLICY_INFORMATION 2 �? _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE �. tagEMRCREATEBRUSHINDIRECT
�) _M128A y@ PCOUNTED_REASON_CONTEXT �V PSUPPORTED_OS_INFO �V HGESTUREINFO__ � _IMAGE_THUNK_DATA64 # �V TXFS_CREATE_MINIVERSION_INFO - = PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA � _REPARSE_DATA_BUFFER V1 _SYSTEM_FLUSH_INFORMATION �A FILE_ID_DESCRIPTOR p BITMAPCOREHEADER
p PUTSTR . �V FILE_PROCESS_IDS_USING_FILE_INFORMATION �V PSYSTEM_WORKINGSET_ENTRY �V LPGCP_RESULTS x; tagEMRCREATEPEN # �V _ETW_COVERAGE_SAMPLER_SAMPLE
�V SID ( �7 _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES & �, PERFINFO_CC_SCHEDULE_READ_AHEAD % �V PPOWER_THROTTLING_THREAD_STATE �V PSYSDBG_IO_SPACE �B OVERLAPPED �V LPMONITORINFOEXW ) �# PERFINFO_HARDPAGEFAULT_INFORMATION $ �F FILE_MOVE_CLUSTER_INFORMATION �V PPNP_QUERY_RELATION ] LPMSGBOXPARAMSA $ �7 _OBJECT_DIRECTORY_INFORMATION (D tagLOGBRUSH32 �R SERVICE_DESCRIPTIONA �V PEMRELLIPSE $ �0 _ETW_TP_EVENT_POOL_TH_MIN_SET & �5 ETW_COVERAGE_SAMPLER_BLOOM_INFO ; _RTL_PROCESS_MODULES & �2 SYSTEM_MEMORY_USAGE_INFORMATION �V SERVICE_MAIN_FUNCTIONA z? _XSAVE_AREA_HEADER ! � PROCESS_HANDLE_INFORMATION �V HGESTUREINFO ' �5 _WMI_EXTENDED_THREAD_INFORMATION 1 _SYMBOLIC_LINK_INFO_CLASS H( PEMRPOLYBEZIERTO16 'C EMRPOLYDRAW16 $ �V PETW_PARTITION_INFO_EXTENSION �) M128A �0 PSCROLLBARINFO �0 PERFINFO_CCSWAP_LITE �V PREG_NOTIFY_INFORMATION �V _FILE_END_OF_FILE_INFO {V PPERFINFO_MARK_EVENT ( ' PERFINFO_DRIVER_COMPLETIONROUTINE
� PCTSTR xV EXCEPTION_RECORD32 _STREAM_INFORMATION_ENTRY EVENT_TRACE_HEADER 0 L# _JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 T) PERFINFO_IPI_RECEIVE_DATA XF IMAGE_NT_HEADERS32 " sV IMAGE_RESOURCE_DIR_STRING_U �D NEWTEXTMETRICEXA � _devicemodeA pV PCZPWSTR nV PKSPIN_LOCK_QUEUE_NUMBER �( _SCOPE_TABLE_ARM64 jV PSECURITY_SEED_AND_LENGTH $F _VARIABLE_NAME_AND_VALUE $ gV _CM_DISK_GEOMETRY_DEVICE_DATA _FILE_ID_128 � _SYSDBG_CONTROL_SPACE �T RTL_HEAP_STACK_QUERY # PDWORD_PTR ) cV SYSTEM_MEMORY_TOPOLOGY_INFORMATION " _V PWNF_STATE_NAME_INFORMATION �% PEMRCHORD ^V PTOKEN_MANDATORY_POLICY E$ FSCTL_UNMAP_SPACE_OUTPUT * �5 _SYSTEM_EXTENDED_THREAD_INFORMATION 1 � _JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL ]V PLBR_TRACE_EVENT_DATA % �U TOKEN_APPCONTAINER_INFORMATION YV PEMRCREATEPALETTE WV PACL_REVISION_INFORMATION �: FILE_ID_INFORMATION UV REPARSE_POINT_INFORMATION & OV PRTL_PROCESS_BACKTRACES_CONTROL PRTL_RB_NODE
� POINTS �U LPICONMETRICSW % �S _FILE_FS_FULL_SIZE_INFORMATION 7& KEY_SET_INFORMATION_CLASS cs_byte 9A ETW_REFDEREF_OBJECT_EVENT ( sD EVENT_TRACE_GROUPMASK_INFORMATION . MV PCACTIVATION_CONTEXT_SECTION_KEYED_DATA + _CM_SHARE_DISPOSITION ) PEMRSETVIEWPORTEXTEX �8 tagEMRSTRETCHBLT u PDWORD32 ( KV PMEMORY_ENCLAVE_IMAGE_INFORMATION % JV PWIM_PROVIDER_INTEGRITY_STATUS " IV PETW_COVERAGE_SAMPLER_STATS # �, FILE_COMPRESSION_INFORMATION GV FILE_FULL_EA_INFORMATION � _MUTANT_INFORMATION_CLASS % �G SYSTEM_PERFORMANCE_INFORMATION $ WORKERFACTORYINFOCLASS DV PNTFS_STATISTICS_EX & :V PKEY_VIRTUALIZATION_INFORMATION 8V PGUITHREADINFO 6V _ETW_KQUEUE_ENQUEUE_EVENT � _ACL_SIZE_INFORMATION 3V PTHREAD_TEB_INFORMATION P< tagINPUT_TRANSFORM 2V PETW_UMS_EVENT_PARK & .V PCCOMPATIBILITY_CONTEXT_ELEMENT ,V PCONSOLE_HISTORY_INFO +V PWMI_WAIT_MULTIPLE *V PQUAD & � _PERFINFO_INTERRUPT_INFORMATION )V PEXCEPTION_RECORD64 $ %V PSYSTEM_EXCEPTION_INFORMATION V LPGLYPHMETRICS V PMODEMDEVCAPS V _WMI_IRQ_RECORD # q PSECURITY_DESCRIPTOR_CONTROL � KCRM_MARSHAL_HEADER V PFILE_ID_BOTH_DIR_INFO �3 tagLOGFONTA V LPNLSVERSIONINFOEX 7U FILE_FULL_DIR_INFO V IO_STATUS_BLOCK V PREPARSE_INDEX_KEY % � FILE_PIPE_DELETE_SYMLINK_INPUT , V FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER 05 PROCESSOR_RECORD % B' LINK_TRACKING_INFORMATION_TYPE V PRTL_BACKOFF /
V PJOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 V% SE_ACCESS_REQUEST * << ALPC_PORT_ASSOCIATE_COMPLETION_PORT S" MIDL_INTERCEPTION_INFO V _WMI_WAIT_MULTIPLE % � PLUGPLAY_CONTROL_PROPERTY_DATA . #- _RESOURCEMANAGER_COMPLETION_INFORMATION �' PDISPLAY_DEVICEW �> _TIMELINE_BITMAP * / SYSTEM_HYPERVISOR_QUERY_INFORMATION �4 ETW_CLOSE_HANDLE_EVENT V PRTL_AVL_ALLOCATE_ROUTINE B6 PEMRSELECTOBJECT �# _PLUGPLAY_EVENT_CATEGORY �' _cpinfoexW V IMAGE_RELOCATION �U QUOTA_LIMITS_EX �U _PS_STD_HANDLE_INFO �U _WRITE_USN_REASON_INPUT �U PCONSOLE_CURSOR_INFO v8 RPC_SECURITY_QOS . _PROCESSOR_IDLE_STATES �? LPDLGITEMTEMPLATEA ! �2 _FILE_STANDARD_INFORMATION �U HRAWINPUT__ �U KTMOBJECT_CURSOR " UCSCHAR �U PPVALUEA �C INVERTED_FUNCTION_TABLE * �U PIMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY �U PEVENT_FILTER_EVENT_NAME # �U PPLUGPLAY_CONTROL_DEPTH_DATA �S tagINPUT_INJECTION_VALUE �% COMPOSITIONFORM , �U _JOBOBJECT_IO_ATTRIBUTION_INFORMATION �U PFILE_REGION_OUTPUT �U PBOOT_ENTRY_LIST oD NPEVENTMSGMSG �U PRTL_PHYSICAL_MEMORY_INFO 5 >G tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA �* LPEXTLOGFONTW # _FILE_PIPE_LOCAL_INFORMATION �U LPNETRESOURCEA � CHAR_INFO �U PSERVICE_NOTIFY �% _WMI_REGISTRY ! �U PETW_WNF_EVENT_UNSUBSCRIBE q PWORD " �" _FILE_ALIGNMENT_INFORMATION �S _FILE_LEVEL_TRIM_OUTPUT WMI_PNP_RECORD �U RTL_HANDLE_TABLE �U LPSTARTUPINFOEX p CCHAR *. LPEXCEPTION_POINTERS � tagDELETEITEMSTRUCT �U PRTL_AVL_TREE ^H RTL_CRITICAL_SECTION64 ' �U PPROCESS_WS_WATCH_INFORMATION_EX J FILE_SEGMENT_ELEMENT LPMENUTEMPLATEA % 0 _ETW_SESSION_NOTIFICATION_TYPE ! �: CONSOLE_SCREEN_BUFFER_INFO �U PEXCEPTION_ROUTINE �U _JUMP_BUFFER - �U PMEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE �U NPOUTLINETEXTMETRIC ' � HEAP_EVENT_SUBSEGMENT_ALLOC_FREE � _IMAGE_DOS_HEADER �U CSV_MGMT_LOCK $ �U PSYSTEM_ROOT_SILO_INFORMATION & 3@ _SYSTEM_CPU_SET_TAG_INFORMATION � AXISINFOA �- MIDL_STUBLESS_PROXY_INFO % B _MEMORY_EXHAUSTION_INFORMATION �U PRTL_RELATIVE_NAME_U �U PICONMETRICSW & �U PSYSTEM_PROCESS_TRUST_LABEL_ACE �U PCSVFS_DISK_CONNECTIVITY �U _TP_DIRECT � _LUID LANGSPEC �S GDI_HANDLE_BUFFER64 " �U PFILE_DIRECTORY_INFORMATION * � _VIRTUALIZATION_INSTANCE_INFO_INPUT �U LPGCP_RESULTSW ) #T _ETW_TP_EVENT_TIMER_EXPIRATION_END -J WMIREGINFO ' �F _ALPC_SERVER_SESSION_INFORMATION & �G CREATEFILE2_EXTENDED_PARAMETERS fE FILE_ATTRIBUTE_TAG_INFO �U PEMRSETCOLORADJUSTMENT ! �U PETW_CPU_CACHE_FLUSH_EVENT $ �U SYSTEM_OBJECTTYPE_INFORMATION �$ RTL_DISK_SPACE_INFO �0 PRECT ! �U PIMAGE_ARCHITECTURE_HEADER & �U PTOKEN_APPCONTAINER_INFORMATION �2 LDR_DATA_TABLE_ENTRY64 " +5 RTL_USER_PROCESS_PARAMETERS �6 POWER_SESSION_WINLOGON u" tagEMRLINETO & � FILE_CASE_SENSITIVE_INFORMATION ! �U PRTL_TREE_COMPARE_FUNCTION � LPCANDIDATEFORM �U _MESSAGE_TRACE_HEADER 6/ CLASSIC_EVENT_ID + � _EVENT_TRACE_SPINLOCK_INFORMATION_V1 �0 tagRECT ' �U PRTL_QUERY_DEBUG_VIRTUAL_PROCESS :T IMAGE_RESOURCE_DIRECTORY � PS_MITIGATION_OPTIONS_MAP " �: IMAGE_SEPARATE_DEBUG_HEADER $ �U PSYSTEM_BOOT_LOGO_INFORMATION �? _MM_ETW_PAGE_INFO + �; PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT 0 �U PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION JU SCRUB_PARITY_EXTENT A _ETW_NOTIFICATION_TYPE �U PVOLUME_BITMAP_BUFFER # �U PSHRINK_VOLUME_REQUEST_TYPES �U PETW_WNF_EVENT_PUBLISH ' �U PETW_COVERAGE_SAMPLER_PERF_STATS $ PANSI_STRING ) int16x4_t �U PDELETE_USN_JOURNAL_DATA �U PTP_JOB_CALLBACK I? tagPELARRAY & � _HEAP_REUSE_THRESHOLD_ACTIVATED SSIZE_T � _ALPC_TOKEN_ATTR " �& SYSTEM_VERIFIER_INFORMATION ( �A SYSTEM_CONTEXT_SWITCH_INFORMATION * E _RTL_FEATURE_CONFIGURATION_PRIORITY �: _WMIGUIDINFORMATION XF _IMAGE_NT_HEADERS ' �U PRTL_STACK_TRACE_DATABASE_CREATE $ U PRTL_PROCESS_LOCK_INFORMATION �) tagGESTURECONFIG � ULARGE_INTEGER �. TP_IO �4 HEAP_EXTENDED_INFORMATION �! _MM_ETW_PAGE_EXTRA_INFO & }U _WIM_PROVIDER_ADD_OVERLAY_INPUT zU LPKERNINGPAIR vU PPERFINFO_IO_TIMER & tU PPROCESS_MEMORY_ALLOCATION_MODE $ E _SYSTEM_PROCESSOR_INFORMATION + oU PSYSTEM_FEATURE_CONFIGURATION_UPDATE lU RTL_MODULE_EXTENDED_INFO hU _T2_SET_PARAMETERS_V0 � TP_CALLBACK_PRIORITY eU PTITLEBARINFO d& tagWNDCLASSW " dU PEVENT_INSTANCE_GUID_HEADER 1 `U PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION - RTL_HEAP_TAG # @ PLUGPLAY_CUSTOM_NOTIFICATION ^U PETW_NOTIFICATION_HEADER ! ]U PACCESS_ALLOWED_OBJECT_ACE ! SECURE_SETTING_VALUE_TYPE [U KLDR_DATA_TABLE_ENTRY32 YD _ETW_HEAP_EVENT_EXPANSION UU PTOKEN_PRIVILEGES �/ INITIAL_TEB TU PFILE_NAME_INFORMATION �9 KTMOBJECT_TYPE 3 eR PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY j FILE_STAT_LX_INFORMATION % SU PWMI_JOB_SET_QUERY_INFORMATION RU _locale_t " LOGICAL $ QU PPERFINFO_MEM_RESET_INFO_TYPE 1 �% MEMORY_PARTITION_CONFIGURATION_INFORMATION �1 _RTL_BACKOFF , rE SERVICE_CONTROL_STATUS_REASON_PARAMSW ; _OBJECT_ATTRIBUTES64 �< ENUMLOGFONTA MU PBLENDFUNCTION �> _ETW_PER_SESSION_QUOTA + N _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN " �E _WIM_PROVIDER_OVERLAY_ENTRY HU PSCRUB_PARITY_EXTENT �. ETW_OPTICALIO_READWRITE " GU PPERFINFO_CC_CAN_WRITE_FAIL ( "& SYSTEM_REGISTRY_QUOTA_INFORMATION ( ? _CFG_CALL_TARGET_LIST_INFORMATION % � MEMORY_WORKING_SET_INFORMATION hF _FOUR_PART_VERSION HGDIOBJ CU LPQUERY_SERVICE_CONFIGW ?) EMRCOLORMATCHTOTARGET % �- MM_ETW_WORKING_SET_PFN_RUNDOWN ( � RESOURCEMANAGER_INFORMATION_CLASS AU PRTL_DEBUG_INFORMATION �% PEMRARCTO "5 tagWNDCLASSEXW $ POEM_STRING G RTL_FEATURE_USAGE_REPORT ! _SECURITY_ATTRIBUTES & @U LPOVERLAPPED_COMPLETION_ROUTINE o: CANDIDATELIST " =U PTRACE_ENABLE_FLAG_EXT_ITEM 9U PRAWINPUTHEADER 5U PFILE_FULL_DIR_INFO ! ^A ETW_COVERAGE_SAMPLER_STATS ' � _SYSTEM_SHADOW_STACK_INFORMATION 3U PMEMORY_RANGE_ENTRY ) 2U PMEMORY_WORKING_SET_EX_INFORMATION WMI_JOB_ASSIGN_PROCESS 0U _WNF_DELIVERY_DESCRIPTOR �? _COMPRESSED_DATA_INFO ' �4 RPC_HTTP_TRANSPORT_CREDENTIALS_A ,U IMAGE_VXD_HEADER ! IR _RTL_FEATURE_CONFIGURATION $ � _TXFS_LIST_TRANSACTIONS_ENTRY �= _IMAGE_IMPORT_DESCRIPTOR F6 PTEXTMETRICW " (U PROCESS_LOGGING_INFORMATION U PMOVE_FILE_DATA32 - NT _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX �, IMAGE_HOT_PATCH_HASHES � CLIENT_ID64 $ �A _ETW_TP_EVENT_TIMER_CANCELLED % U PFILE_PIPE_ASSIGN_EVENT_BUFFER �G _RTL_BITMAP_RUN �D _EXCEPTION_LOG U _RTL_ENCLAVE_LAUNCH_TOKEN 5 WNF_TYPE_ID � _STARTUPINFOW �8 _LDR_DATA_TABLE_ENTRY T7 tagEXTLOGFONTA � poly8x8x4_t + 4& JOURNAL_SET_DELETE_VALUE_INFORMATION ! U PRTL_TIME_ZONE_INFORMATION �: CHANGEFILTERSTRUCT * _FILE_DISPOSITION_INFO_EX �9 VS_FIXEDFILEINFO U PSE_SID ) �: _RTL_IMAGE_MITIGATION_OPTION_STATE
U HLSURF U ETW_CLOCK_TIME_UPDATE 9 N0 _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION U PKEY_NAME_INFORMATION $ U PTRANSACTION_BIND_INFORMATION 2 ETW_DISABLE_KTIMER2_EVENT ' U PPROCESS_HANDLE_TABLE_ENTRY_INFO ~ _FILE_INFORMATION_CLASS �) tagMULTIKEYHELPW / PUUCSCHAR + �G PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA ( RID_DEVICE_INFO_MOUSE # REGHANDLE ! U PSECTION_BASIC_INFORMATION HDWP + U PSYSTEM_CRASH_DUMP_STATE_INFORMATION �, _FLOAT128 4 U PJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE U NAMEENUMPROCA U LPENUM_SERVICE_STATUSW ~" _DISPLAY_DEVICEA \* tagPOLYTEXTA .< _IMAGE_TLS_DIRECTORY32 �C _ImageArchitectureHeader � LDR_DLL_NOTIFICATION_DATA 1 �/ _SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE U PETW_UMGL_KEY � WIN32_MEMORY_RANGE_ENTRY 29 _CONTEXT �. PHYSICAL_CHANNEL_RUN ~F _HEAP_BLOCK_INFORMATION �T HWND �T PGET_MODULE_HANDLE_EXW �T PPOINTFLOAT 1 �T PMEMORY_PARTITION_PAGE_COMBINE_INFORMATION - �T PACTIVATION_CONTEXT_SECTION_KEYED_DATA .8 _FILE_NOTIFY_INFORMATION ) �* SYSTEM_SESSION_PROCESS_INFORMATION �T PTRACE_ENABLE_CONTEXT " �T PIMAGE_DELAYLOAD_DESCRIPTOR s# _RTL_MODULE_BASIC_INFO , �T PPROCESS_MITIGATION_IMAGE_LOAD_POLICY �B SC_ACTION_TYPE �E IMAGE_EXPORT_DIRECTORY ) uint16x4_t S tagEMRGRADIENTFILL , KLOCK_QUEUE_HANDLE �T EXIT_PROCESS_DEBUG_INFO �T PEVENT_DESCRIPTOR �T PWNODE_SINGLE_INSTANCE E LDRP_CSLIST �A LPBITMAPV5HEADER � _PARSE_MESSAGE_CONTEXT �T PUNICODE_STRING64 DF EMRDRAWESCAPE �0 _KCRM_TRANSACTION_BLOB 0 PR _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION % EMRCHORD � PCUZZTSTR @ float32_t �T PCFG_CALL_TARGET_INFO �T tagWCRANGE S PEMRSETBKCOLOR �T PIMAGE_ENCLAVE_CONFIG64 K@ PEMRWIDENPATH # �T PFILE_FS_CONTROL_INFORMATION s@ _GRADIENT_TRIANGLE 9, UQUAD �T PINTERFACE_TYPE 3# MEMORY_RANGE_ENTRY � _TABLE_SEARCH_RESULT �T WOW64_REMOTE_FUNCTION64 �. LPDEVMODEA �T WNF_USER_CALLBACK � _ARM64_NT_NEON128 ' �# _JOBOBJECT_BASIC_PROCESS_ID_LIST }S PROCESSOR_RELATIONSHIP �T PICONINFOEXA �' ICONINFOEXW 3 �T PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V1 � SYSTEM_INFORMATION_CLASS ! �T PWINDOW_BUFFER_SIZE_RECORD G WNODE_ALL_DATA " WNF_CHANGE_STAMP � _HARDWARE_COUNTER_TYPE %G _FILE_SET_SPARSE_BUFFER ) �T PSYSTEM_MEMORY_CHANNEL_INFORMATION iA _CM_EISA_SLOT_INFORMATION "% HEAP_RANGE_INFORMATION gD LPBITMAPINFO �T PETW_DEBUG_PRINT_EVENT $ �T PROCESS_FOREGROUND_BACKGROUND & �T PSL_KMEM_CACHE_VALUE_DESCRIPTOR �+ POSVERSIONINFOEXW & �T PPLUGPLAY_CONTROL_CONFLICT_DATA �# _RTL_CONDITION_VARIABLE �T INPUT_MESSAGE_SOURCE < _currencyfmtA $ �E _NDR_USER_MARSHAL_INFO_LEVEL1 �T PPRPC_SID - $3 FSCTL_GET_INTEGRITY_INFORMATION_BUFFER # DISPLAYCONFIG_COLOR_ENCODING + �T _FILE_LINK_ENTRY_FULL_ID_INFORMATION +B _WIN32_FIND_STREAM_DATA �T PPOWERBROADCAST_SETTING - �T PPROCESS_MITIGATION_POLICY_INFORMATION , �T PEVENT_TRACE_SYSTEM_EVENT_INFORMATION 4 eR _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY �T PRTL_HEAP_STACK_QUERY � PACTIVATION_CONTEXT & �T PIMAGE_DYNAMIC_RELOCATION_TABLE �/ _PERFINFO_TRACE_HEADER $ �T PWIM_PROVIDER_START_INTEGRITY ' �T _SYSTEM_ACTIVITY_MODERATION_INFO ? �5 _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA $ 'H _ETW_CLOCK_STATE_CHANGE_EVENT �T PMM_ETW_WORKING_SET_TYPE $ s PROCESS_WORKING_SET_OPERATION ' �T PQUERY_PERFORMANCE_COUNTER_FLAGS �/ POSVERSIONINFOW , �T PDEDUP_QUERY_FILE_HASHES_INPUT_BUFFER � REFS_SMR_VOLUME_GC_STATE �T PNT_TIB32 ! B _CREATE_PROCESS_DEBUG_INFO �T HTOUCHINPUT $ �3 KNONVOLATILE_CONTEXT_POINTERS , �T PJOBOBJECT_SECURITY_LIMIT_INFORMATION $ p _FILE_ID_EXTD_DIR_INFORMATION �D _CSV_QUERY_FILE_REVISION �T tagBITMAPCOREINFO $ �> _PROCESS_WS_WATCH_INFORMATION + ; SYSTEM_SECUREBOOT_POLICY_INFORMATION �" FEEDBACK_TYPE �C _VM_COUNTERS_EX2 > _FSCTL_OFFLOAD_READ_INPUT 9( EMRCREATECOLORSPACEW Q, TOKEN_ELEVATION_TYPE �; tagPALETTEENTRY � EMRPOLYDRAW ' �T PPROCESS_LEAP_SECOND_INFORMATION � FILE_QUERY_SPARING_BUFFER & J+ _FSCTL_UNMAP_SPACE_INPUT_BUFFER -: _WMI_IDE_CHANNEL_RECORD 3 �T PJOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION
p LPTSTR d9 _PROCESS_JOB_MEMORY_INFO �# REPARSE_DATA_BUFFER_EX �T PBOOT_OPTIONS �E WMI_LOGGER_INFORMATION �' PMENUBARINFO � PS_PROTECTED_SIGNER " �T PPOWER_STATE_NOTIFY_HANDLER $ �C KEY_VALUE_PARTIAL_INFORMATION �T PPREFIX_TABLE_ENTRY �8 _HARDWARE_COUNTER_DATA ! �% ENTER_STATE_SYSTEM_HANDLER KEY_INFORMATION_CLASS �T BITMAPCOREINFO % e2 ETW_WNF_EVENT_NAME_SUB_RUNDOWN ! q> _PROCESS_FAULT_INFORMATION � TP_TRACE_TYPE �T _PEB K@ PEMRFLATTENPATH ' �" ETW_TIMER_EXPIRATION_START_EVENT C# MONITOR_DISPLAY_STATE " jT PTXFS_SAVEPOINT_INFORMATION hT MDICREATESTRUCTW </ WMI_PROCESS_INFORMATION ) eT PEVENT_TRACE_GROUPMASK_INFORMATION cT MESSAGE_RESOURCE_ENTRY � _WMI_PAGE_FAULT `T PWAKE_TIMER_INFO ^T MENUGETOBJECTINFO [T UILANGUAGE_ENUMPROCW ( YC JOBOBJECT_BASIC_LIMIT_INFORMATION % 2< STREAMS_QUERY_ID_OUTPUT_BUFFER ! �' _SYSTEM_NUMA_PROXIMITY_MAP XT PDISPLAY_DEVICE VT tagGCP_RESULTSW ST SERVER_ROUTINE % RT PREFS_SMR_VOLUME_GC_PARAMETERS 7= CBT_CREATEWNDA # B PS_CPU_QUOTA_SET_INFORMATION [. SD_QUERY_STATS_OUTPUT QT PRPC_SECURITY_QOS PT PEVENT_HEADER >, _SECURITY_CAPABILITIES , NT SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX KT LPFIBER_START_ROUTINE ? TOUCHPREDICTIONPARAMETERS IT _TEB_ACTIVE_FRAME_EX - OSVERSIONINFOEX2W CT PNTFS_STATISTICS AT PEMRSETMITERLIMIT ?T EMRROUNDRECT <T LPRAWHID 8T PIMAGE_RESOURCE_DIRECTORY $ �? _FILE_VOLUME_NAME_INFORMATION 5T _PO_WAKE_SOURCE_HEADER % @E ETW_COVERAGE_SAMPLER_PERF_INFO % c8 _WMI_DISKIO_IO_REDIRECTED_INIT * ; SYSTEM_NET_RATE_CONTROL_SET_CONTEXT 3T PRTL_QUERY_REGISTRY_TABLE & n, _SYSTEM_MEMORY_LIST_INFORMATION h2 STREAM_INFO_LEVELS 6# PCWPRETSTRUCT ! 1T _ETW_CPU_CACHE_FLUSH_EVENT * Z _PERFINFO_BOOT_PREFETCH_INFORMATION # �? FILE_VOLUME_NAME_INFORMATION -T __n16 &T PTOKEN_ELEVATION %T LPCURRENCYFMTA �= _HEAP_COMMIT_DECOMMIT + Y) _ETW_UMS_EVENT_DIRECTED_SWITCH_START j& tagLOGCOLORSPACEA ) !T PETW_TP_EVENT_TIMER_EXPIRATION_END ( T PPROCESS_HANDLE_TRACING_ENABLE_EX T PTP_WORK � tagDIBSECTION T PROPENUMPROC # �A JOBOBJECT_FREEZE_INFORMATION ! T PRTL_FEATURE_CONFIGURATION �D _TP_DEBUG_CLASS + T PROCESS_PROTECTION_LEVEL_INFORMATION # PKAFFINITY T IMAGE_ROM_HEADERS S ATOM_BASIC_INFORMATION ! T PFILE_REMOTE_PROTOCOL_INFO . @; _FILE_DESIRED_STORAGE_CLASS_INFORMATION # �$ _RTL_GENERIC_COMPARE_RESULTS . ! _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA & � _PLUGPLAY_CONTROL_PROPERTY_DATA �3 RTL_SRWLOCK " T PETW_UMS_EVENT_DISASSOCIATE $
T tagEMRCREATEDIBPATTERNBRUSHPT ! �F PROCESS_UPTIME_INFORMATION
T PUSN_RECORD_UNION d _FILE_ID_INFO T ETW_THREAD_AFFINITY_EVENT T PRPC_DISPATCH_TABLE " � PERFINFO_CC_LAZY_WRITE_SCAN �A WMI_DISKIO_READWRITE T PSYSDBG_PHYSICAL �R LPABCFLOAT T _NETINFOSTRUCT �S _IMAGE_IMPORT_BY_NAME H _DMA_SPEED �S PSYSTEM_PREFETCH_STATS & _SYSTEM_VA_TYPE t PLONG32 " ACCESS_REASON �S PFILE_EA_INFORMATION �S PFILE_LEVEL_TRIM_OUTPUT % h RTL_DYNAMIC_HASH_TABLE_CONTEXT % �S PRTL_UMS_SCHEDULER_ENTRY_POINT � TITLEBARINFOEX ' �S LOOKUP_STREAM_FROM_CLUSTER_ENTRY ) �S PSYSTEM_SECURITY_MODEL_INFORMATION b& NPWNDCLASSW �S PFILEMUIINFO 1 �R EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION �S EDITWORDBREAKPROC �2 LPMSG % �/ ETW_AUTOBOOST_NO_ENTRIES_EVENT * �6 _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE �S PSE_ACCESS_REPLY - 33 FSCTL_SET_INTEGRITY_INFORMATION_BUFFER � _KCRM_PROTOCOL_BLOB �S _NETCONNECTINFOSTRUCT �D _IMAGE_SYMBOL_EX + �S PCASSEMBLY_FILE_DETAILED_INFORMATION ! �S PPERFINFO_FILE_INFORMATION ! 9 _PAGE_PRIORITY_INFORMATION >D LPMETARECORD �6 RPC_SECURITY_QOS_V3_A �S LPMONITORINFO ~. __GENERIC_BINDING_INFO �3 _IO_ERROR_LOG_MESSAGE % �S PFILE_FS_FULL_SIZE_INFORMATION �S _NT_TIB32 �> FILE_BASIC_INFORMATION �S FILE_PIPE_INFORMATION . �S PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA , �S FILE_FS_PERSISTENT_VOLUME_INFORMATION YS FILE_REGION_INPUT �+ tagMOUSEHOOKSTRUCT AD tagMETARECORD ( �S _PERFINFO_MEMORY_NODE_INFORMATION �S INPUT_INJECTION_VALUE �S PWX86TIB # N SharedVirtualDiskHandleState " �$ _POWER_MONITOR_REQUEST_TYPE * �S RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W �S PRTL_RXACT_LOG ! > _SILOOBJECT_ROOT_DIRECTORY + �S PPLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA �S PPNP_VETO_TYPE L4 RTL_HEAP_TAG_INFO �/ PROCESS_ENERGY_VALUES ^ SCONTEXT_QUEUE $ �S PRTL_GENERIC_ALLOCATE_ROUTINE �S PPOWER_SESSION_WINLOGON P! PROCESS_ACTIVITY_TYPE �S PRTL_STACK_CONTEXT ^H _RTL_CRITICAL_SECTION64 ( �S PFILE_FS_VOLUME_FLAGS_INFORMATION ' i3 _REDIRECTION_FUNCTION_DESCRIPTOR $ �E _PROCESS_HANDLE_TRACING_ENTRY " �S PUNICODE_PREFIX_TABLE_ENTRY � _DEP_SYSTEM_POLICY_TYPE �S LPEXTLOGFONTA �S PTHREAD_PERFORMANCE_DATA ) ') _FILE_ID_GLOBAL_TX_DIR_INFORMATION ? LPRAWINPUTDEVICE ! �S LPOUTPUT_DEBUG_STRING_INFO $ �S PTXFS_TRANSACTION_ACTIVE_INFO # �S PMEMORY_PRIORITY_INFORMATION �= _RTL_GENERIC_TABLE " LPDWORD LPRAWINPUT x! _OSVERSIONINFOA �S CALINFO_ENUMPROCEXEX �S LPIMEMENUITEMINFO � NEON128 Z/ _CI_WINDOWS_LOCKDOWN_MODE # �@ tagACTCTX_SECTION_KEYED_DATA 2 �S PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 �S LPEXCEPTION_DEBUG_INFO �S _EVENT_FILTER_LEVEL_KW �S PALPC_HANDLE_ATTR �S LPOUTLINETEXTMETRICA & �A _FILE_PROVIDER_EXTERNAL_INFO_V1 pC TOKEN_OWNER & T APPLICATIONLAUNCH_SETTING_VALUE -S _RTL_HEAP_WALK_ENTRY �S GDI_HANDLE_BUFFER �S PEISA_IRQ_DESCRIPTOR �S PWMI_CONTEXTSWAP + �S PCLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE . �S _FILE_NETWORK_PHYSICAL_NAME_INFORMATION �: SYSDBG_MSR �- _QUERY_BAD_RANGES_INPUT �S PTPP_THREAD_DATA_CALLBACK �S PROPENUMPROCEXA �S PRPC_POLICY ' �S PPERFINFO_CC_SCHEDULE_READ_AHEAD " � _PROCESS_HANDLE_INFORMATION - _OSVERSIONINFOEX2W ( � _RTL_QUERY_DEBUG_INFORMATION_INFO 5" _DOCINFOA - �S PALPC_PORT_COMPLETION_LIST_INFORMATION % �S _NTPSS_MEMORY_BULK_INFORMATION �S PEISA_PORT_CONFIGURATION �S RTL_RVA_LIST_ITERATOR �S PPROCESS_INFORMATION }S _PROCESSOR_RELATIONSHIP % k; CM_PNP_BIOS_INSTALLATION_CHECK zS PTP_ALPC_CALLBACK_EX % �: EVENT_EXTENDED_ITEM_PEBS_INDEX 0 �, TRANSACTION_NOTIFICATION_PROMOTE_ARGUMENT pS PRTL_ELEVATION_FLAGS " mS _ETW_TIMER_EXPIRATION_EVENT ( jC _SYSTEM_ACTIVITY_MODERATION_STATE 1 �F _PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED jS LPSERIALKEYSW ( hS FILE_PIPE_EVENT_ENUM_INPUT_BUFFER �& EVENTLOGRECORD �- PEMRPOLYBEZIER " eS PETW_DUPLICATE_HANDLE_EVENT dS LPEXTLOGPEN cS IMCENUMPROC & S _RTL_DISK_WRITE_CONSTRAINT_INFO �E POLYTEXTW D PRLIST_ENTRY % _S PFILE_MAILSLOT_SET_INFORMATION & ]S FILE_END_OF_FILE_INFORMATION_EX WS PFILE_REGION_INPUT HGLOBAL � RTL_RESOURCE_CATEGORY US HFONT % TS PFILE_MOVE_CLUSTER_INFORMATION # SS PFILE_PROVIDER_EXTERNAL_INFO 1 RS PSYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION # F SYSTEM_ROOT_SILO_INFORMATION QS PLDR_RESLOADER_RET $ OS _RTLP_HEAP_SERIALIZED_MAPPING & ;C PROCESS_ENERGY_VALUES_EXTENSION S5 _COVERAGE_REQUEST_CODES �R MEMORY_IMAGE_INFORMATION + LS PTRANSACTION_ENLISTMENTS_INFORMATION JS ACCESS_DENIED_ACE 37 _Wx86TIB % �R _FILE_PIPE_ASSIGN_EVENT_BUFFER ) �1 PROCESS_COMMIT_RELEASE_INFORMATION �3 RGBTRIPLE �/ RTL_OSVERSIONINFOW * DS PRTL_SPARSE_BITMAP_ALLOCATE_ROUTINE X CM_ROM_BLOCK CS HWINEVENTHOOK �. _THREAD_NAME_INFORMATION � VIRTUAL_STORAGE_TYPE �! _RPC_CLIENT_INTERFACE : � SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION ) lF _SYSTEM_MEMORY_CHANNEL_INFORMATION BS PIRQ_PRIORITY ) AS PRTL_PROCESS_BACKTRACE_INFORMATION D; _RTLP_TAG_INFO ! _PEBS_DS_SAVE_AREA64 >S PEMREXTTEXTOUTA ( * SE_LEARNING_MODE_USER_OBJECT_DATA ) �, _RTL_PROCESS_MODULE_INFORMATION_EX % � JOURNAL_RENAME_KEY_INFORMATION �F HMONITOR__ 6; PERFINFO_FILE_READ_WRITE =S PCSV_QUERY_REDIRECT_STATE ;S HMETAFILE__ 9S PMENUITEMTEMPLATE ( �& _RPC_BINDING_HANDLE_TEMPLATE_V1_A 8S PALPC_WORK_ON_BEHALF_ATTR 7S LPALTTABINFO 6S PFILE_FS_SIZE_INFORMATION 5S LPCREATESTRUCT 3S FP_32 0 1S PSYSTEM_REGISTRY_APPEND_STRING_PARAMETERS # � SECURITY_IMPERSONATION_LEVEL # H= _SD_CHANGE_MACHINE_SID_INPUT � TOKEN_INFORMATION_CLASS 0S PFILE_LAYOUT_ENTRY ! /S PFILE_MAILSLOT_PEEK_BUFFER +S PRTL_HEAP_WALK_ENTRY " (S TIMER_SET_INFORMATION_CLASS " � _tag_ARM64INTR_BARRIER_TYPE ( %S _RTL_IMAGE_MITIGATION_HEAP_POLICY ( _OFSTRUCT y: LPLOGFONTA ) "S PWIM_PROVIDER_UPDATE_OVERLAY_INPUT ! 7E _FILE_PIPE_WAIT_FOR_BUFFER !S MFENUMPROC S PEMRSETTEXTCOLOR 3 S PPROCESS_MITIGATION_USER_SHADOW_STACK_POLICY �% _PERFINFO_CCSWAP_IDLE 1 S PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY f tagTEXTMETRICA S EMRGRADIENTFILL ` uint64x2x2_t & S PMEMORY_WORKING_SET_INFORMATION _OSVERSIONINFOEXA ! }; SYSDBG_KD_PULL_REMOTE_FILE S _ATOM_BASIC_INFORMATION ~C EXTLOGPEN $ XSAVE_AREA S PSYSTEM_BATTERY_STATE S PSERVICE_NOTIFY_2 �. POSVERSIONINFOEXA $6 _MESSAGE_TRACE_USER + S _PERFINFO_PAGECOMBINE_ITERATION_STAT S RTL_GENERIC_FREE_ROUTINE + S PRTL_FEATURE_CONFIGURATION_OPERATION % S RTL_DISK_WRITE_CONSTRAINT_INFO S RGBQUAD � tagEMRPOLYPOLYLINE - _PROCESS_MITIGATION_POLICY_INFORMATION RG tagSTYLESTRUCT ( � _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY � _THREAD_WORKLOAD_CLASS $ �R PSYSTEM_FILECACHE_INFORMATION �R PCIMAGE_EXPORT_DIRECTORY p0 _JOBOBJECT_WAKE_FILTER $ �R FILE_PIPE_ASSIGN_EVENT_BUFFER p tagBITMAPCOREHEADER + `6 EVENT_TRACE_TIME_PROFILE_INFORMATION �R PPORT_VIEW /& ALPC_CONTEXT_ATTR �R PWNF_META_CALLBACK �R DESKTOPENUMPROCW , B _PERFINFO_DRIVER_COMPLETE_REQUEST_RET �$ RTL_RXACT_OPERATION �R NPABCFLOAT �R PEMRCREATECOLORSPACE �, HEAP_EVENT_RANGE_CREATE , �R PPROCESS_STACK_ALLOCATION_INFORMATION �R PHARDERROR_MSG : SERIALKEYSW �C _INVERTED_FUNCTION_TABLE / �R PSTORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE �R _MEMORY_IMAGE_INFORMATION " �R PKEY_WRITE_TIME_INFORMATION B1 IMAGE_OPTIONAL_HEADER ) uint8x8_t 9 ( _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY �R PIMAGE_FUNCTION_ENTRY64 * �R PVIRTUAL_STORAGE_SET_BEHAVIOR_INPUT ! �R PKEY_SET_LAYER_INFORMATION �' _SC_STATUS_TYPE % �R PFILE_NETWORK_OPEN_INFORMATION �R PKEY_LAYER_INFORMATION # � PERFINFO_PPM_IDLE_STATE_EXIT 5 �R _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY $ �A _JOBOBJECT_FREEZE_INFORMATION . �R PPROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE # �@ SILOOBJECT_BASIC_INFORMATION +B WIN32_FIND_STREAM_DATA �R PEMRRESIZEPALETTE # �R PDRIVER_VERIFIER_THUNK_PAIRS �R _RTL_FEATURE_USAGE_DATA " z0 ETW_COVERAGE_SAMPLER_MODULE
{& _COORD �R RDR_CALLOUT_STATE 2 �R PEVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION �R _UNWIND_HISTORY_TABLE �R PIO_ERROR_LOG_PACKET �. _ETW_HEAP_EVENT_REALLOC < COVERAGE_SECTION_HEADER �< PEB_LDR_DATA !9 COMBOBOXINFO
PUINT8 $ � _FILE_DISPOSITION_INFORMATION ( �R GET_FILTER_FILE_IDENTIFIER_OUTPUT �R PWMI_TRACE_MESSAGE_PACKET ` int8x16x2_t �R CSV_QUERY_MDS_PATH � DELETEITEMSTRUCT �R WNODE_EVENT_REFERENCE �R _SERVICE_DESCRIPTIONA # DWORD64 ! �R CS_TYPE_FROM_NETCS_ROUTINE $ P9 ETW_TP_EVENT_TIMER_EXPIRATION �R PTOKEN_AUDIT_POLICY ! �R ADMINISTRATOR_POWER_POLICY �R PEMRNAMEDESCAPE �1 tagHARDWAREINPUT
�. PRECTL ! �R PWMI_IMAGEID_INFORMATION64 �R PWNF_STATE_NAME # �) PROCESS_HANDLE_TRACING_QUERY " PEXECUTION_STATE �R PZPCSTR �R tagEMRSETCOLORADJUSTMENT 0 ~R I_RpcProxyGetClientSessionAndResourceUUID }R PFP_IEEE_VALUE 0 _FILE_PREFETCH_EX x uint64x2_t " �8 _SYSTEM_PROCESS_INFORMATION `3 _KLDR_DATA_TABLE_ENTRY64 {R THREAD_BASIC_INFORMATION ! wR PSYSTEM_ALARM_CALLBACK_ACE & �+ RTL_QUERY_DEBUG_VIRTUAL_PROCESS vR GENERIC_BINDING_ROUTINE 6; _PERFINFO_FILE_READ_WRITE * hR PPROCESS_EXTENDED_BASIC_INFORMATION 4 _R PPROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY 8% RTL_MEMORY_TYPE ^R PFILE_BASIC_INFO & ]R PPOWER_THROTTLING_PROCESS_STATE q PARAM_OFFSETTABLE [R MESSAGE_TRACE � TOKEN_USER �A _HEAP_SUMMARY �A _RPC_PROTSEQ_VECTORA {F tagEMREXCLUDECLIPRECT PWMIHANDLE # WR PROCESS_AFFINITY_UPDATE_MODE ( � PERFINFO_DRIVER_MAJORFUNCTION_RET ~ CANSI_STRING 0 NR PJOURNAL_TRANSACTION_BOUNDARY_INFORMATION # - RTL_XPRESS_CALLBACK_FUNCTION LR LPCRECTL �. PERFINFO_VIRTUAL_ALLOC ' t3 GET_FILTER_FILE_IDENTIFIER_INPUT � RTL_AVL_TREE % c RTL_UMS_SCHEDULER_STARTUP_INFO P# _SE_SECURITY_DESCRIPTOR ' % _FILE_PIPE_CLIENT_PROCESS_BUFFER $ AR PSYSTEM_FEATURE_CONFIGURATION # @R LPQUERY_SERVICE_LOCK_STATUSW H0 TOKEN_SID_INFORMATION ?R PMARK_HANDLE_INFO32 A WIN32_FILE_ATTRIBUTE_DATA =R EMRMASKBLT 8N NTFS_VOLUME_DATA_BUFFER # �# STARTING_LCN_INPUT_BUFFER_EX 4N VOLUME_BITMAP_BUFFER �) MOVE_FILE_DATA 0N MOVE_FILE_RECORD_DATA �= MFT_ENUM_DATA_V0 > MFT_ENUM_DATA_V1 h= READ_FILE_USN_DATA I3 READ_USN_JOURNAL_DATA_V0 �; READ_USN_JOURNAL_DATA_V1 TH USN_RANGE_TRACK_OUTPUT ,N USN_RECORD_V3 �& USN_RECORD_COMMON_HEADER �C USN_RECORD_V4 0B USN_JOURNAL_DATA_V0 �= USN_JOURNAL_DATA_V1 )N DELETE_USN_JOURNAL_DATA "N MARK_HANDLE_INFO32 w POWER_ACTION # ) POWER_MONITOR_REQUEST_REASON SYSTEM_POWER_CONDITION SET_POWER_SETTING_VALUE ' NOTIFY_USER_POWER_SETTING �M BATTERY_REPORTING_SCALE �! POWER_STATE_HANDLER_TYPE �" POWER_STATE_HANDLER ! �M POWER_STATE_NOTIFY_HANDLER <H PPM_WMI_LEGACY_PERFSTATE � PPM_WMI_IDLE_STATES �M PPM_WMI_IDLE_STATES_EX :6 PPM_WMI_PERF_STATES �M PPM_IDLE_STATE_ACCOUNTING '" PPM_IDLE_ACCOUNTING # �M PPM_IDLE_STATE_ACCOUNTING_EX ,G PPM_IDLE_ACCOUNTING_EX �M PPM_PERFSTATE_EVENT ! �M PPM_PERFSTATE_DOMAIN_EVENT 1+ PPM_IDLESTATE_EVENT �M PPM_THERMALCHANGE_EVENT �M PPM_THERMAL_POLICY_EVENT �) POWER_ACTION_POLICY 58 SYSTEM_POWER_LEVEL �) PO_WAKE_SOURCE_TYPE # u PO_INTERNAL_WAKE_SOURCE_TYPE �K PTP_WAIT_CALLBACK bG MCA_EXCEPTION_TYPE �$ RTL_DISK_SPACE_POLICY ' NG RTL_DISK_WRITE_CONSTRAINT_POLICY �( RTL_BSD_ITEM_TYPE �@ RTL_ACE_DATA ! ACTCTX_REQUESTED_RUN_LEVEL ( �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE & K RTLWOW64_CROSSPROCESS_WORK_HEAD �A BITMAPV5HEADER & :3 DISPLAYCONFIG_SCANLINE_ORDERING {# DISPLAYCONFIG_SCALING `J SHELLHOOKINFO \J POWERBROADCAST_SETTING x+ BSMINFO #, FLASHWINFO & CJ SERVICE_TRIGGER_CUSTOM_STATE_ID z, SERVICE_NOTIFY_2 *3 WMIREGGUIDW -J WMIREGINFOW , WMIDPREQUESTCODE �I MOFRESOURCEINFOW 3 MOFRESOURCEINFOA �I RPC_ENDPOINT_TEMPLATEW �I RPC_ENDPOINT_TEMPLATEA �I RPC_INTERFACE_TEMPLATEA L1 RPC_INTERFACE_TEMPLATEW �I RPC_DISPATCH_TABLE +7 XLAT_SIDE . �D _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST \H PRTL_CRITICAL_SECTION64 # YH TRACE_PROVIDER_INSTANCE_INFO VH PQUOTA_LIMITS RH PUSN_RANGE_TRACK_OUTPUT # .@ DISPLAYCONFIG_MODE_INFO_TYPE �! STUB_PHASE OH _ALPC_SERVER_INFORMATION �6 USN_RECORD K@ PEMRREALIZEPALETTE & CH POBJECT_HANDLE_FLAG_INFORMATION � FILEMUIINFO 7 5 PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY @H FIND_BY_SID_OUTPUT �. CHARSETINFO :H PPPM_WMI_LEGACY_PERFSTATE 9 _RTL_PROTECTED_ACCESS , 6H JOBOBJECT_IO_RATE_CONTROL_INFORMATION - : _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET $ 3H PPERFINFO_DOMAIN_CHANGE_EVENT 1H _TOKEN_PRIMARY_GROUP ! +H PFILE_FS_LABEL_INFORMATION # aC _MANAGE_HOT_PATCH_LOAD_PATCH 7E FILE_PIPE_WAIT_FOR_BUFFER )H PRTL_CIRCULAR_LIST_HEAD ED LPGRADIENT_TRIANGLE ' >6 LEARNING_MODE_OBJECT_INFORMATION $ %H PETW_CLOCK_STATE_CHANGE_EVENT �0 _RTL_LFG_RNG_STATE #H PLOGFONT ! "H PSECURITY_OBJECT_AI_PARAMS $ �5 _FILE_ID_BOTH_DIR_INFORMATION / zE _READ_DIRECTORY_NOTIFY_INFORMATION_CLASS ) 5C FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 3 H FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE ( % _ETW_COVERAGE_SAMPLER_CREATE_INFO H PANSI_STRING32 ! H PTP_POOL_STACK_INFORMATION F _IMAGE_POLICY_METADATA ! H PWMI_PROCESS_INFORMATION64 _* ETWTRACECONTROLCODE ( H EVENT_EXTENDED_ITEM_STACK_TRACE64 H PFILE_STAT_INFORMATION ( �3 _FILE_FS_FULL_SIZE_INFORMATION_EX % H SL_KMEM_CACHE_VALUE_DESCRIPTOR �! EMRREALIZEPALETTE H PCTOUCHINPUT 2 �= PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY H POSVERSIONINFOEX2A �" RTL_PERTHREAD_CURDIR
LPBYTE H PRPC_SECURITY_QOS_V4_A H PSID_AND_ATTRIBUTES_ARRAY H PTP_SIMPLE_CALLBACK - H DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE �G PWMI_PUSHLOCK �G EMRNAMEDESCAPE & ( ETW_COVERAGE_SAMPLER_QUERY_INFO PT2_CANCEL_PARAMETERS & �G PSYSTEM_MEMORY_LIST_INFORMATION �G PTEB_ACTIVE_FRAME_CONTEXT �= _PS_CPU_QUOTA_QUERY_ENTRY �& LPJIT_DEBUG_INFO64 �G RPC_POLICY & �G PSYSTEM_PERFORMANCE_INFORMATION �G PPLUGPLAY_NOTIFY_HDR " �G PCONSOLE_SCREEN_BUFFER_INFO �G SC_ACTION �G PHEAP_BLOCK_INFORMATION �. MOUSEINPUT & b! ALPC_MESSAGE_HANDLE_INFORMATION �# RTL_CONDITION_VARIABLE �G PHPOWERNOTIFY ! �G _EVENT_EXTENDED_ITEM_TS_ID ; _PERFINFO_CCSWAP_TYPE rF _TEB_ACTIVE_FRAME_CONTEXT 9 �G PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION � _CACHE_RELATIONSHIP � float32x2x4_t # PS_SECURITY_DOMAIN 0 �G PMEMORY_PARTITION_INITIAL_ADD_INFORMATION 4 �G PSEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION % �= ACTIVATION_CONTEXT_QUERY_INDEX % �G tagI_RpcProxyCallbackInterface �1 IMAGE_ENCLAVE_CONFIG64 �G PTOKEN_OWNER ; SERVICE_STATUS # PDWORDLONG 8 RUNTIME_FUNCTION �G PRTL_HEAP_PARAMETERS �G PRTLP_CURDIR_REF �' USER_MARSHAL_CB_TYPE E( GESTUREINFO $ �G PFILE_PIPE_SILO_ARRIVAL_INPUT ' RTL_FEATURE_VARIANT_PAYLOAD_KIND �F BOOT_ENTRY_LIST b _PERFINFO_GROUPMASK �7 tagMONITORINFO � tagCANDIDATEFORM �G PGENERIC_BINDING_INFO $ �G PSD_CHANGE_MACHINE_SID_OUTPUT " �G PFILE_FS_VOLUME_INFORMATION w _AUDIT_EVENT_TYPE �G PRTL_BITMAP_RUN % tagEMRARC �G PVARIABLE_NAME_AND_VALUE �G _CPU_CONFIG_RECORD �G _COVERAGE_MODULE_INFO �G RPC_DISPATCH_FUNCTION �G PTOKEN_INFORMATION_CLASS 0F _CM_RESOURCE_LIST , �G _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA �+ RTL_OSVERSIONINFOEXW ' �G PCREATEFILE2_EXTENDED_PARAMETERS % �: _FILE_NETWORK_OPEN_INFORMATION + �5 _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA
�0 NPRECT # �G ETW_PARTITION_INFO_EXTENSION + $ _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA 5 WNDCLASS �G CPINFOEX ) �A _SYSTEM_CONTEXT_SWITCH_INFORMATION 0F CM_RESOURCE_LIST + _OUTLINETEXTMETRICW + FS_INFORMATION_CLASS U _EVENT_RECORD $ )0 IMAGE_LOAD_CONFIG_DIRECTORY32 PCALL_FRAME & �: HEAP_BLOCK_SETTABLE_INFORMATION �G LPRIP_INFO %B _FILE_RENAME_INFO & �E JOBOBJECT_BASIC_UI_RESTRICTIONS �G DECRYPTION_STATUS_BUFFER R2 SHRINK_VOLUME_INFORMATION ' � _SERVICE_DELAYED_AUTO_START_INFO �G RPC_IF_ID }G RC_CONFIG wG PEMRMODIFYWORLDTRANSFORM 0 rG PETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT � int64x1x4_t $ pG PSECURE_MEMORY_CACHE_CALLBACK kG HENHMETAFILE hG PERFINFO_FILE_INFORMATION
t INT * >0 _SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT - eG PREFS_VOLUME_COUNTER_INFO_INPUT_BUFFER @< _FILE_ALIGNMENT_INFO * w4 REFS_DEALLOCATE_RANGES_INPUT_BUFFER � PROCESSOR_IDLE_TIMES % dG PTRANSACTION_BASIC_INFORMATION P* _ALPC_MESSAGE_ATTRIBUTES % ]) ACTCTX_SECTION_KEYED_DATA_2600 % `G PSYSTEM_RESOURCE_ATTRIBUTE_ACE _G PTIMERAPCROUTINE u PEN_FLAGS ( x& _SYSTEM_ALARM_CALLBACK_OBJECT_ACE ( COMMPROP % J$ _ETW_TP_EVENT_CALLBACK_ENQUEUE JG _ETW_TP_EVENT_TIMER_SET 4 ZG PCACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA � PEMRSETTEXTALIGN XG PSERVICE_TRIGGER WG LPIID VG PTHREAD_UMS_INFORMATION ' ;C _PROCESS_ENERGY_VALUES_EXTENSION UG PSYSTEM_BASIC_INFORMATION TG PCM_INT13_DRIVE_PARAMETER RG STYLESTRUCT 9 LUID_AND_ATTRIBUTES �= CONTAINER_VOLUME_STATE �9 _XSTATE_CONFIGURATION 5 LG PASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA JG ETW_TP_EVENT_TIMER_SET �* PEXTLOGFONTW GG LPSERVICE_MAIN_FUNCTIONA u NPREGISTERWORDW �# _PS_STD_HANDLE_STATE 4 FG PFILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX �D PO_WAKE_SOURCE_FIXED ! EG PSYSTEM_NUMA_PROXIMITY_MAP � LAST_EXCEPTION_LOG �- PEMRPOLYBEZIERTO -- REARRANGE_FILE_DATA CG EMRSETPALETTEENTRIES ,9 PMOUSEMOVEPOINT % &? POWER_THROTTLING_PROCESS_STATE & V+ _RTL_FEATURE_CONFIGURATION_TYPE @G LPSERVICE_STATUS �* PPHYSICAL_ADDRESS N. OBJECT_BASIC_INFORMATION . U@ _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY 3 <G PACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA \* POLYTEXTA � _PLUGPLAY_CONTROL_CLASS :G _MUIREGISTRYINFO 0G PIMAGE_CHPE_METADATA_X86 6 #: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION " /G PKEY_VALUE_FULL_INFORMATION # tagEMREXTSELECTCLIPRGN .G PHEAP_SUBSEGMENT_ALLOC � int16x4x3_t (G PPPM_IDLE_ACCOUNTING_EX �E LDR_RESLOADER_RET $ � PROCESS_HANDLE_TRACING_ENABLE z? XSAVE_AREA_HEADER 5 ACCEL ', PCUNZWCH # �" _FILE_ALLOCATION_INFORMATION #G PFILE_SET_SPARSE_BUFFER % �F _DISPLAYCONFIG_SDR_WHITE_LEVEL $ �< _SERVICE_FAILURE_ACTIONS_FLAG % !G PIMAGE_LOAD_CONFIG_DIRECTORY64 ( �! _VIRTUAL_MEMORY_INFORMATION_CLASS G NPNEWTEXTMETRIC G PPROCESSOR_NUMBER " G _SE_PACKAGE_CAPABILITY_INFO n@ SYSTEM_POWER_CAPABILITIES G PPROCESSOR_POWER_POLICY 0 "> _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS G SL_HWID_DEVICE_INFO + LPOUTLINETEXTMETRICW �E _WIN32K_SYSCALL_FILTER # T SYSTEM_FILECACHE_INFORMATION 5 tagWNDCLASSA ! G PDUPLICATE_EXTENTS_DATA_EX W* MDICREATESTRUCT PNTSTATUS % �5 _KEY_CONTROL_FLAGS_INFORMATION �6 tagPOINTER_INPUT_TYPE �@ PRTL_DELETE_LOCK_ROUTINE & �F ALPC_SERVER_SESSION_INFORMATION G WAITORTIMERCALLBACK �( ACCESS_DENIED_OBJECT_ACE & G PSTREAMS_QUERY_ID_OUTPUT_BUFFER
G PSERVICE_TRIGGER_INFO . G PSYSTEM_THREAD_CID_PRIORITY_INFORMATION D PRTL_TRACE_BLOCK ~ OEM_STRING - G PJOBOBJECT_MEMORY_USAGE_INFORMATION_V2 G PRTL_FEATURE_USAGE_REPORT w# _WMI_TRACE_PACKET 3 6- _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 + �6 _SYSTEM_ELAM_CERTIFICATE_INFORMATION G _WNODE_HEADER g HIBERFILE_BUCKET " 7 KEY_VALUE_BASIC_INFORMATION " .? SYSTEM_VHD_BOOT_INFORMATION � IMAGE_THUNK_DATA64 G _FP_IEEE_VALUE ' � _PERFINFO_PPM_THERMAL_CONSTRAINT �F PIO_STATUS_BLOCK32 ' ~ _FILE_FS_DRIVER_PATH_INFORMATION �F GRAYSTRINGPROC �F PWINDOWINFO ; LPTIME_ZONE_INFORMATION & !? _ETW_TP_EVENT_TIMER_SET_NTTIMER $ _HARDERROR_RESPONSE �C _FILE_DISPOSITION_INFO 3 �+ ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION �D _OUTPUT_DEBUG_STRING_INFO = REASON_BUFFER 0 �F PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED MIDL_STUB_DESC 6 � RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY MENUTEMPLATE �F LPREMOTE_NAME_INFO �F FILE_LAYOUT_ENTRY �F PRTL_AVL_COMPARE_ROUTINE ) �F PWIM_PROVIDER_REMOVE_OVERLAY_INPUT �F PNV_MEMORY_RANGE �F PPOOLED_USAGE_AND_LIMITS % �F _FILE_MOVE_CLUSTER_INFORMATION �; _FILE_PATH l _CM_MCA_POS_DATA �$ LPREGISTERWORDA �F _PERFINFO_FLT_OPERATION �F PFILE_LEVEL_TRIM_RANGE % �F PFILE_PIPE_EVENT_SELECT_BUFFER �F LPCURRENCYFMT � _PERFINFO_IPI_SEND_DATA �F _SYSTEM_ALARM_OBJECT_ACE ) �F PSYSTEM_WATCHDOG_TIMER_INFORMATION $ �F PWOW64_DESCRIPTOR_TABLE_ENTRY � AXISINFO ( � _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE �F ETW_HEAP_EVENT_SNAPSHOT �F CI_LOG_SCHEDULER_WAKEUP ' '- SYSTEM_SINGLE_MODULE_INFORMATION 0 �F PEVENT_TRACE_SESSION_SECURITY_INFORMATION U WAIT_TYPE % �F _FILE_ZERO_DATA_INFORMATION_EX �F SYSDBG_PHYSICAL �F PEMRSETPIXELV �F PEISA_MEMORY_TYPE / �F PTRANSACTIONMANAGER_RECOVERY_INFORMATION ) �< SYSTEM_SET_TIME_ADJUST_INFORMATION ! �F PRTL_UNICODE_STRING_BUFFER �D PS_ATTRIBUTE + tagEMRSETVIEWPORTEXTEX �> GUITHREADINFO �? DPI_HOSTING_BEHAVIOR �F PPERFINFO_SPINLOCK_CONFIG Q0 _PERFINFO_MM_STAT $ �F PREQUEST_OPLOCK_OUTPUT_BUFFER " �F _PROCESS_UPTIME_INFORMATION & �F PSYSTEM_DEVICE_DATA_INFORMATION ) �F PPLUGPLAY_CONTROL_CONFLICT_STRINGS �F PHDEVNOTIFY " �% TOKEN_SECURITY_ATTRIBUTE_V1 �F HMONITOR
A DOUBLE ) Y+ SYSTEM_FEATURE_CONFIGURATION_QUERY + �F RTL_SPARSE_BITMAP_ENUMERATE_CALLBACK > tagSCROLLINFO # x* ETW_TP_EVENT_CALLBACK_CANCEL & IMAGE_RESOURCE_DIRECTORY_STRING �F _FILE_LAYOUT_ENTRY # �F FILE_PIPE_SILO_ARRIVAL_INPUT ! 9A _ETW_REFDEREF_OBJECT_EVENT ! ! _SECURE_SETTING_VALUE_TYPE �F _BOOT_ENTRY_LIST $ �F DISPLAYCONFIG_SDR_WHITE_LEVEL �F PRID_DEVICE_INFO_MOUSE B3 SYSTEM_MEMORY_INFORMATION �F KEY_CACHED_INFORMATION �F PHEAP_EVENT_RANGE_CREATE � TP_TASK �* EXTLOGFONTW UCHAR �* _RTL_DRIVE_LETTER_CURDIR . v/ _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION ' �F PALPC_SERVER_SESSION_INFORMATION ! 5% FILE_NUMA_NODE_INFORMATION > � SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY �F PMSGBOXPARAMS �F PCNZTCH # ]E _SYSTEM_PAGEFILE_INFORMATION �@ PRTL_RELEASE_LOCK_ROUTINE ~F HEAP_BLOCK_INFORMATION {F EMRINTERSECTCLIPRECT 8 IMAGE_DYNAMIC_RELOCATION xF PPLUGPLAY_EVENT_BLOCK ! tF PSTORAGE_RESERVE_AREA_INFO � FMTID ! pF PCTEB_ACTIVE_FRAME_CONTEXT % oF PNTFS_FILE_RECORD_INPUT_BUFFER 1 nF PSYSTEM_FEATURE_CONFIGURATION_UPDATE_ENTRY �+ MM_ETW_PAGE_INFO_EX ( lF SYSTEM_MEMORY_CHANNEL_INFORMATION hF FOUR_PART_VERSION _F PFILE_ID_128 �# VIDEOPARAMETERS $ v KAFFINITY_ENUMERATION_CONTEXT [F PCM_SCSI_DEVICE_DATA T7 EXTLOGFONT VF PIMAGE_NT_HEADERS32 Z< CM_SONIC_DEVICE_DATA z5 COMPAREITEMSTRUCT # TF PSECURITY_QUALITY_OF_SERVICE SF PENCLAVE_CREATE_INFO_SGX RF LPJIT_DEBUG_INFO QF PEMRPIXELFORMAT 9 LPCOMBOBOXINFO 9 _LUID_AND_ATTRIBUTES ( NF PTXFS_READ_BACKUP_INFORMATION_OUT " MF PPERFINFO_BATTERY_LIFE_INFO ( 82 _PERFINFO_KERNELMEMORY_USAGE_TYPE LF PLUID int64x1x2_t KF LPPOINTFX JF PWNDCLASSEX $ �4 FILE_MAILSLOT_SET_INFORMATION $ �@ SYSTEM_SECUREBOOT_INFORMATION �1 WTSSESSION_NOTIFICATION ( S= FILE_IS_REMOTE_DEVICE_INFORMATION , HF JOURNAL_CREATE_DELETE_KEY_INFORMATION �$ RTL_DISK_SPEED_POLICY D2 tagLOGCOLORSPACEW DF tagEMREXTESCAPE int32x2x2_t & zD STORAGE_RESERVE_AREA_DEFINITION �# IO_ERROR_LOG_PACKET - [ MEMORY_PARTITION_NODE_PAGE_INFORMATION + �; _PERFINFO_PAGECOMBINE_AGGREGATE_STAT + �C FILE_IO_PRIORITY_HINT_INFORMATION_EX , AF PJOURNAL_SET_KEY_SECURITY_INFORMATION �E LPPOLYTEXTW @F PCM_PNP_BIOS_DEVICE_NODE � _THREAD_UMS_INFORMATION & >F DISPLAYCONFIG_VIDEO_SIGNAL_INFO 4 PATHNAME_BUFFER 5F EVENTSFORLOGFILE -F PCM_RESOURCE_LIST $ (F PPLUGPLAY_CONTROL_STATUS_DATA " LCID BOOLEAN &F PTP_CALLBACK_ENVIRON �! EMRCLOSEFIGURE D6 tagEMRSELECTOBJECT "5 WNDCLASSEXW $F VARIABLE_NAME_AND_VALUE !F PRPC_SECURITY_QOS_V3_W $ �) _THREAD_PROFILING_INFORMATION ! # RTL_SPARSE_BITMAP_CTX_LOCK F DISPLAYCONFIG_TARGET_MODE ptrdiff_t $ F _SYSTEM_ROOT_SILO_INFORMATION s _TRANSACTION_OUTCOME F PUNICODE_PREFIX_TABLE # �@ PRTL_INITIALIZE_LOCK_ROUTINE �1 tagSTICKYKEYS I? PELARRAY W2 FP_80 �@ _REQUESTER_TYPE �< _ALPC_HANDLE_ATTR32 F PCIMAGE_POLICY_METADATA n' PCRITICAL_SECTION_DEBUG p PINT8 � LPCTSTR F FILE_ID_BOTH_DIR_INFO 5 WNDCLASSA 4 F _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE � _IRQ_DEVICE_POLICY ( � _PERFINFO_DPC_ENQUEUE_INFORMATION ; OBJECT_ATTRIBUTES64 C LPMULTIKEYHELPA F _WMI_TRACE_MESSAGE_PACKET " mD _TRACE_ENABLE_FLAG_EXT_ITEM . _SYSTEM_SPECULATION_CONTROL_INFORMATION F PFILE_RENAME_INFO % � DISPLAYCONFIG_DEVICE_INFO_TYPE F CONSOLE_CURSOR_INFO > STATE_LOCATION_TYPE �E _IMAGE_EXPORT_DIRECTORY �% PCWCH � UNICODE_STRING64 �E PWIN32K_SYSCALL_FILTER # tagEMRSETMITERLIMIT � TRACE_PROFILE_INTERVAL �B WMI_TCPIP �E PETW_PRIORITY_EVENT �: CSTRING + |1 TRANSACTIONMANAGER_BASIC_INFORMATION �E POPTICAL_MEDIA_RECORD �E PULARGE_INTEGER * �E PJOBOBJECT_MEMORY_USAGE_INFORMATION 1 �E _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY 3 TD RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY u% tagWNDCLASSEXA � __n64x4 �* LOCALE_ENUMPROCW # �E LPQUERY_SERVICE_LOCK_STATUSA & 8? PROCESS_WS_WATCH_INFORMATION_EX ! �9 ENABLE_TRACE_PARAMETERS_V1 �. _PERFINFO_VIRTUAL_ALLOC �/ DPI_AWARENESS > LPMSLLHOOKSTRUCT 4 ,; SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST �E RTL_HEAP_COMMIT_ROUTINE �E PIMAGE_HOT_PATCH_HASHES � MUTANT_INFORMATION_CLASS ' �E PETW_DFSS_RELEASE_THREAD_ON_IDLE �E PRTL_RESOURCE_DEBUG �E PCUNICODE_STRING 3 <# _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION �" tagACCESSTIMEOUT ' �> _CSV_QUERY_VOLUME_REDIRECT_STATE 3 �E _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE �E _LDR_RESLOADER_RET Q6 EXCEPTION_DEBUG_INFO �" tagFEEDBACK_TYPE �E PETW_CRITSEC_EVENT_INIT
USN & `2 _PROCESS_MITIGATION_ASLR_POLICY Z= _STREAM_LAYOUT_ENTRY $ �? ENCLAVE_CREATE_INFO_VBS_BASIC # �E NDR_USER_MARSHAL_INFO_LEVEL1 ( PERFINFO_DYNAMIC_TICK_VETO_REASON o: tagCANDIDATELIST " CALID " RPC_LENGTH - 9 ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT ! �E PFILE_FULL_DIR_INFORMATION �E SYSNLS_FUNCTION �E _ETW_HEAP_EVENT_FREE �( _IMAGE_SECTION_HEADER |! BOOT_ENTRY ! �E LDR_IMPORT_MODULE_CALLBACK �E PRTL_DEBUG_INFORMATION32 .# BUS_DATA_TYPE
_ImageArchitectureEntry �E _MALLOC_FREE_STRUCT y7 tagHANDEDNESS g0 POINTER_DEVICE_PROPERTY ?) tagCOLORMATCHTOTARGET & �E IMAGE_CE_RUNTIME_FUNCTION_ENTRY �E PUSEROBJECTFLAGS v6 PROCESSOR_POWER_POLICY ' �E PJOBOBJECT_ENERGY_TRACKING_STATE ! �E WIM_PROVIDER_OVERLAY_ENTRY �E PSYSTEM_FLAGS_INFORMATION �$ _REG_NOTIFY_INFORMATION ' �E _JOBOBJECT_BASIC_UI_RESTRICTIONS + �E PEVENT_TRACE_PROFILE_ADD_INFORMATION �E PIMAGE_DEBUG_DIRECTORY # �E PLDR_MANIFEST_PROBER_ROUTINE �? _REMOTE_NAME_INFOA ; �E PPROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION
�7 tagEMR D2 LOGCOLORSPACEW ( �E PPERFINFO_DRIVER_COMPLETE_REQUEST FILESYSTEM_STATISTICS ( � _JOURNAL_CHANGE_INFORMATION_CLASS $ �E PRTL_XPRESS_CALLBACK_FUNCTION * �E LPSERVICE_REQUIRED_PRIVILEGES_INFOA ; RTL_PROCESS_MODULES �E PPOLYTEXTW `D PROXY_PHASE �E PWMI_LOGGER_INFORMATION �E PCOVERAGE_MODULE_REQUEST � _RTL_PATH_TYPE �B LPRGBTRIPLE �E _ETW_UMS_EVENT_PARK $ �E PPROCESS_HANDLE_TRACING_ENTRY ! G9 _FILE_MAILSLOT_PEEK_BUFFER # �D RTL_PROCESS_VERIFIER_OPTIONS �E LPDISCDLGSTRUCT �E PSERVERSILO_STATE " �E PMEMORY_BASIC_INFORMATION32 - E PMANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES �A _ETW_DISKIO_READWRITE_V3 # ~E PCIMAGE_DELAYLOAD_DESCRIPTOR / |E PREAD_DIRECTORY_NOTIFY_INFORMATION_CLASS � MOUSEHOOKSTRUCTEX # �" PERFINFO_CC_WORKITEM_ENQUEUE q PUINT16 wE _CONSOLE_HISTORY_INFO ( ~A _RPC_BINDING_HANDLE_SECURITY_V1_A ( @ JOBOBJECT_CONTAINER_IDENTIFIER_V2 / tE PSYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX - rE _SERVICE_CONTROL_STATUS_REASON_PARAMSW nE RPC_SERVER_INTERFACE ! �C _ACCESS_ALLOWED_OBJECT_ACE jE STARTING_VCN_INPUT_BUFFER fE _FILE_ATTRIBUTE_TAG_INFO cE DESKTOPENUMPROC
! USHORT bE PPROCESS_ENERGY_VALUES & aE PPLUGPLAY_CONTROL_CONFLICT_LIST `E PEMRFILLPATH ?A _NIC_RECORD _E PMFT_ENUM_DATA " ]E SYSTEM_PAGEFILE_INFORMATION ! ZE _SECTION_IMAGE_INFORMATION
�2 MSG QE PRTL_BALANCED_LINKS OE RTL_SPARSE_BITMAP_CTX ( _ACTIVATION_CONTEXT_STACK CE PTXFS_LIST_TRANSACTIONS & @E _ETW_COVERAGE_SAMPLER_PERF_INFO / �. ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION U8 DISCDLGSTRUCTW �( _ACCESS_DENIED_OBJECT_ACE [ _FILE_STANDARD_INFO , �> EVENT_TRACE_STACK_CACHING_INFORMATION <E HW_PROFILE_INFOW h+ EMRSETICMPROFILE z, SERVICE_NOTIFYA s- IMAGE_RESOURCE_DATA_ENTRY ! 5E PFILE_PIPE_WAIT_FOR_BUFFER 3E PEVENT_FILTER_EVENT_ID 8 5 _PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY 2E PSCRUB_DATA_INPUT 1E PCTEB_ACTIVE_FRAME N PROCESS_BASIC_INFORMATION E IO_SESSION_CONNECT_INFO �6 SCRUB_DATA_INPUT j RTL_RESOURCE_DEBUG � _IO_SESSION_STATE ' PREFIX_TABLE_ENTRY |8 ETW_PRIORITY_EVENT 1 < _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION int16x4x2_t , 91 TRANSACTIONMANAGER_OLDEST_INFORMATION e TRACE_ENABLE_CONTEXT � SID_NAME_USE �2 _CI_LOG_MMCSS_STOP ( /E PPERFINFO_CC_EXTRA_WB_THREAD_INFO -E _TOKEN_ELEVATION $ � ALTERNATIVE_ARCHITECTURE_TYPE *E LPHELPWININFO )E PBOOT_AREA_INFO 'E _SYSTEM_POWER_STATUS $E pthreadlocinfo % r IMAGE_DYNAMIC_RELOCATION_TABLE Z= STREAM_LAYOUT_ENTRY - RTL_FREE_STRING_ROUTINE �B MIDL_SYNTAX_INFO ! wctype_t * E _ALPC_PORT_MESSAGE_ZONE_INFORMATION �" HIBERFILE_BUCKET_SIZE * E PSECTION_INTERNAL_IMAGE_INFORMATION E PCOMPRESSED_DATA_INFO �? KEYBDINPUT � tagRAWINPUTDEVICELIST ( tagLC_ID E _IO_SESSION_CONNECT_INFO " E PFSCTL_QUERY_FAT_BPB_BUFFER ( E PSYSTEM_CODEINTEGRITY_INFORMATION ' �& _EVENT_TRACE_VERSION_INFORMATION E PCLIENT_ID * E PSYSTEM_PROCESSOR_POWER_INFORMATION $ _DISPLAYCONFIG_COLOR_ENCODING �- _MIDL_STUBLESS_PROXY_INFO ) E TOKEN_SECURITY_ATTRIBUTE_OPERATION E HUMPD
X3 ACL �D PLDRP_CSLIST �D PKUSER_SHARED_DATA �D LPMENUITEMINFOW � CRM_PROTOCOL_ID # 'A ETW_KTIMER2_EXPIRATION_EVENT �D PTP_DEBUG_CLASS �D PAXESLISTA �D PREPAIR_COPIES_OUTPUT RPC_AUTHZ_HANDLE ( 2 FILE_MEMORY_PARTITION_INFORMATION 6 _HEAP_INFORMATION �D PDRAWPATRECT `@ PIMAGE_TLS_CALLBACK # �: _IMAGE_SEPARATE_DEBUG_HEADER ]0 _GDI_TEB_BATCH % �D _EXCEPTION_REGISTRATION_RECORD . �D PSTORAGE_QUERY_DEPENDENT_VOLUME_REQUEST � _WMI_SPINLOCK [B CM_PNP_BIOS_DEVICE_NODE / �D PHEAP_QUERY_INFORMATION_CALLBACK_ROUTINE
�D PCOORD 1 �D PFSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX J* _PLUGPLAY_EVENT_BLOCK �D PNONCLIENTMETRICSA * [ _LDR_DLL_UNLOADED_NOTIFICATION_DATA - �. PROCESS_DYNAMIC_EH_CONTINUATION_TARGET ' VM_COUNTERS $ �( _RTL_USER_PROCESS_INFORMATION �1 LPMINMAXINFO PMIDL_XMIT_TYPE + D _FILE_SYSTEM_RECOGNITION_INFORMATION � PZPCWSTR � RTL_RB_TREE �D _PO_WAKE_SOURCE_FIXED # �D _PLUGPLAY_CONTROL_DEPTH_DATA �D PROPENUMPROCEX �) _STRING32 �D LPTOGGLEKEYS & �D PHEAP_REUSE_THRESHOLD_ACTIVATED �D PKEY_VALUE_ENTRY # �D CONSOLE_SCREEN_BUFFER_INFOEX " #/ WMI_IMAGELOAD_INFORMATION32 _> MONITORINFOEX �, RPC_SID ! �D TXFS_GET_METADATA_INFO_OUT �D POINTER_INFO �D PEXCEPTION_LOG # � _FILE_MAKE_COMPATIBLE_BUFFER 0 �4 _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY � TP_CALLBACK_ENVIRON �D PRTL_HEAP_COMMIT_ROUTINE $ �D PRTL_PROCESS_VERIFIER_OPTIONS $ �D _PERFINFO_DOMAIN_CHANGE_EVENT % �D PMEMORY_EXHAUSTION_INFORMATION �D PSYSTEM_VERIFIER_ISSUE ' �D PCI_LOG_SCHEDULER_SLEEP_RESPONSE � LPUWSTR X: PCURSORINFO �2 _HEAP_RANGE_CREATE �D IMAGE_SYMBOL_EX �D PIMAGE_AUX_SYMBOL �D PPOWER_USER_PRESENCE_TYPE �D LPTPMPARAMS �D _StreamInformation 6 �D SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION % r7 _WMI_JOB_SET_QUERY_INFORMATION �D POBJECT_TYPES_INFORMATION �D PPS_ATTRIBUTE � TP_CLEANUP_GROUP �D tagNEWTEXTMETRICEXA �D PCSV_QUERY_FILE_REVISION 9 EISA_PORT_CONFIGURATION �D OUTPUT_DEBUG_STRING_INFO �D EMRFILLPATH ! �0 LPC_UNREGISTER_PROCESS_MSG 3 �D SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION AD METARECORD " }D OFFSETINSTANCEDATAANDLENGTH ' zD _STORAGE_RESERVE_AREA_DEFINITION wD _SINGLE_LIST_ENTRY32 $# CSVFS_DISK_CONNECTIVITY & �1 RTLP_PROCESS_REFLECTION_CONTEXT ) � _PROCESS_ENERGY_COMPONENT_TYPE_NUM w. _RPC_SECURITY_QOS_V4_A <% IDL_CS_CONVERT �& _SYSTEM_TRACE_HEADER �" _PERFINFO_CCSWAP_BUFFER ) sD _EVENT_TRACE_GROUPMASK_INFORMATION �3 _IMAGE_AUX_SYMBOL ! pD PFILE_INFO_BY_HANDLE_CLASS oD LPEVENTMSG ! mD TRACE_ENABLE_FLAG_EXT_ITEM jD PENCRYPTION_BUFFER % �* FILE_IO_COMPLETION_INFORMATION iD PETW_HEAP_EVENT_REALLOC hD POSVERSIONINFOEX gD PBITMAPINFO � SYSTEM_ALARM_CALLBACK_ACE , �A _JOBOBJECT_EXTENDED_LIMIT_INFORMATION $ cD PJOURNAL_ABSOLUTE_INFORMATION [D PTHREAD_TLS_INFORMATION : PROCESSOR_IDLE_STATE YD ETW_HEAP_EVENT_EXPANSION _HEAP_SUBSEGMENT_INIT �5 _TOKEN_USER_CLAIMS �> _REARRANGE_FILE_DATA32 �@ ACTCTX_SECTION_KEYED_DATA , _KLOCK_QUEUE_HANDLE 4 TD _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY PD LBR_TRACE_EVENT_DATA
> NT_TIB ( � _RTL_FEATURE_CONFIGURATION_UPDATE LD LPHEAP_SUMMARY " 8 _PERFINFO_PROCESS_PERFCTR32
� LPGUID �$ uint16x8x4_t h RTL_TRACE_ENUMERATE ; KD PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME * ID _PERFINFO_PO_CALIBRATED_PERFCOUNTER & FD PFILE_PIPE_DELETE_SYMLINK_INPUT ED PGRADIENT_TRIANGLE DD LPWINDOWPOS PVOID CD PCSV_CONTROL_OP >D PMETARECORD % ;D PTHREAD_CYCLE_TIME_INFORMATION ! :D PPERFINFO_IPI_RECEIVE_DATA 9D PLDR_SECTION_INFO 7D _DataStream 3D SYSTEM_BATTERY_STATE /D RTL_RUN_ONCE_INIT_FN �> _FILE_BASIC_INFORMATION (D LOGBRUSH32 . WORKERCALLBACKFUNC &D PRTLP_EXIT_THREAD �4 tagEMRPIXELFORMAT % �; _SYSTEM_PROCESS_ID_INFORMATION \! tagMENUINFO #D _ETW_DISKIO_READWRITE_V2 D RTL_TRACE_BLOCK D BULK_SECURITY_TEST_DATA ! D _SYSTEM_THREAD_INFORMATION i, LOAD_DLL_EVENT_DATA � _TRACE_QUERY_INFO_CLASS D RPCLT_PDU_FILTER_FUNC PCSZ 1 D PRTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY D LPQUERY_SERVICE_CONFIG D I_RpcFreeCalloutStateFn $ � IMAGE_DYNAMIC_RELOCATION32_V2 D PMM_ETW_PAGE_INFO � MESSAGE_RESOURCE_BLOCK D PFILE_ALLOCATION_INFO �9 PEMRSETICMPROFILE n" _QUERY_FILE_LAYOUT_OUTPUT D PIMAGE_NT_HEADERS64 D UILANGUAGE_ENUMPROCA & � _THREAD_UMS_INFORMATION_COMMAND �C PHEAP_INFORMATION # NPLOGFONTW ) �C PFILE_IS_REMOTE_DEVICE_INFORMATION + �C ACTIVATION_CONTEXT_BASIC_INFORMATION . PROCESSOR_IDLE_STATES �1 tagENHMETARECORD �C PCI_LOG_SCHEDULER_EVENT �C _RTL_PROCESS_BACKTRACES �C PGESTURENOTIFYSTRUCT , �C _FILE_IO_PRIORITY_HINT_INFORMATION_EX * �C _SYSTEM_VERIFIER_FAULTS_INFORMATION , i5 _EVENT_TRACE_SYSTEM_EVENT_INFORMATION �C IMAGE_DEBUG_DIRECTORY 2 GLYPHMETRICSFLOAT �C IMAGE_ARCHITECTURE_HEADER . �C PROCESS_READWRITEVM_LOGGING_INFORMATION �C PPROCESS_ACCESS_TOKEN
�C HKL �7 EVENT_TRACE_PROPERTIES . �C PEVENT_TRACE_PROFILE_CONFIG_INFORMATION �C ACCESS_ALLOWED_OBJECT_ACE �' _IMAGE_HOT_PATCH_INFO �C PUSN_RECORD_V4 * � _SYSTEM_PHYSICAL_MEMORY_INFORMATION � _IRQ_GROUP_POLICY �C tagUSEROBJECTFLAGS �C GENERIC_UNBIND_ROUTINE ( �C PERFINFO_VIRTUAL_ALLOC_XPARTITION ' �C PRTL_IMAGE_MITIGATION_DEP_POLICY �C LPDEBUG_EVENT & �C PPERFINFO_PPM_IDLE_STATE_CHANGE �C PPO_WAKE_SOURCE_TYPE �C MCA_EXCEPTION / �C DISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION ) > _ACCESS_DENIED_CALLBACK_OBJECT_ACE $ |= SE_SET_FILE_CACHE_INFORMATION �C PFILESYSTEM_STATISTICS 5 �C PSYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION �C LPSERVICE_STATUS_PROCESS �; TP_WORK �@ RTL_HEAP_INFORMATION �C PALPC_SECURITY_ATTR ! �C PPERFINFO_BOOT_PHASE_START 0 �C _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION �C FILE_DISPOSITION_INFO �C PRPC_CLIENT_ID �B PRGBTRIPLE * �C CSV_QUERY_FILE_REVISION_FILE_ID_128 �C PINVERTED_FUNCTION_TABLE LPFXPT16DOT16 � tagEMRBITBLT �$ tagEMREOF 0 �C _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION & �$ IO_COMPLETION_BASIC_INFORMATION " �C _PO_SPR_ACTIVE_SESSION_DATA �+ _REASON_CONTEXT t errno_t # �; _FILE_SET_DEFECT_MGMT_BUFFER % �C _KEY_VALUE_PARTIAL_INFORMATION ! PERFINFO_PROCESS_PERFCTR64 �C PEVENT_FILTER_DESCRIPTOR ! #1 PPOWER_STATE_DISABLED_TYPE �; _SYSDBG_VIRTUAL 4B tagEMRRESTOREDC " SECURITY_INFORMATION �C PVM_COUNTERS_EX2 �C PRTL_GENERIC_FREE_ROUTINE ~C tagEXTLOGPEN �: PRECONVERTSTRING �B _MIDL_SYNTAX_INFO q WCHAR ! xC PFILE_OBJECTID_INFORMATION vC PMOUSE_EVENT_RECORD �( MANDATORY_LEVEL tC CONSOLE_SELECTION_INFO + �? EVENT_TRACE_SOFT_RESTART_INFORMATION pC _TOKEN_OWNER , )$ MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE PBYTE mC PMEMORY_EXHAUSTION_TYPE $ lC PSYSTEM_TIMEOFDAY_INFORMATION ( �$ MEMORY_RESOURCE_NOTIFICATION_TYPE " �; _SE_LEARNING_MODE_DATA_TYPE ' jC SYSTEM_ACTIVITY_MODERATION_STATE G5 _CREATE_THREAD_DEBUG_INFO hC PDLGITEMTEMPLATE # b$ ETW_TP_EVENT_POOL_TH_MAX_SET / gC PEVENT_TRACE_PROFILE_COUNTER_INFORMATION 5 tagCOPYDATASTRUCT � SD_GLOBAL_CHANGE_INPUT eC _SYSTEM_VDM_INSTEMUL_INFO # \C PMANAGE_HOT_PATCH_LOAD_PATCH ) YC _JOBOBJECT_BASIC_LIMIT_INFORMATION & WC PRTL_FEATURE_CONFIGURATION_TYPE VC LPMOUSEKEYS ( � _EVENT_TRACE_SPINLOCK_INFORMATION * UC PEVENT_TRACE_TAG_FILTER_INFORMATION . �# _EVENT_TRACE_PROFILE_REMOVE_INFORMATION , R _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 " SC SHARED_VIRTUAL_DISK_SUPPORT " EXECUTION_STATE PC TPP_THREAD_DATA_CALLBACK @ OSVERSIONINFOEX2A �A _SERVICE_TABLE_ENTRYA $ NC POWER_THROTTLING_THREAD_STATE KC PFILE_INFORMATION_CLASS 4 JC PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION �6 SECTION_BASIC_INFORMATION x int64x2_t x uint32x4_t HC _CFG_CALL_TARGET_INFO 5 ! _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA EC DISPLAYCONFIG_2DREGION �7 PPM_WMI_IDLE_STATE ) �B SERVICE_TRIGGER_SPECIFIC_DATA_ITEM BC PCLASSIC_EVENT_ID @C _ENCRYPTION_BUFFER # _POWER_SESSION_TIMEOUTS k= _SERVICE_STATUS_PROCESS
=C PZPSTR ' �! VIRTUAL_MEMORY_INFORMATION_CLASS �; RPC_TRANSFER_SYNTAX ' 7C PPROCESS_ENERGY_VALUES_EXTENSION * 3C PFILE_PIPE_CLIENT_PROCESS_BUFFER_V2 1C PTP_LOG_LEVEL /C EMRGLSBOUNDEDRECORD ~ ETW_KQUEUE_DEQUEUE_EVENT # �. SYSTEM_HANDLE_INFORMATION_EX " +C _JOURNAL_CLIENT_INFORMATION 'C tagEMRPOLYDRAW16 " PWNF_CHANGE_STAMP , �< _SYSTEM_QUERY_TIME_ADJUST_INFORMATION & $C PRTL_SEGMENT_HEAP_MEMORY_SOURCE #C LPHW_PROFILE_INFO C PUPDATELAYEREDWINDOWINFO _LEARNING_MODE_LOG_LEVEL ! � _RTL_IMAGE_POLICY_METADATA C PMULTIKEYHELPA % C PVIRTUAL_STORAGE_BEHAVIOR_CODE % C _BOOT_ENTROPY_SOURCE_NT_RESULT � _ETW_WNF_EVENT_SUBSCRIBE rB _CI_LOG_MMCSS_START ' C PCSV_QUERY_VOLUME_REDIRECT_STATE # C PRTL_SPARSE_BITMAP_PARAMETER $ 1% SERVICE_LAUNCH_PROTECTED_INFO
LIST_ENTRY64 . C _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE ) ! _WIM_PROVIDER_UPDATE_OVERLAY_INPUT C HTASK % C PETW_LAST_DROPPED_EVENT_STRUCT H PCUSHORT 3 O= _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION 1 : MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION S _PNP_QUERY_RELATION ) �B PWMI_EXTENDED_THREAD_INFORMATION64 " �B PPERFINFO_SET_DEVICES_STATE ?A NIC_RECORD �B PWOF_EXTERNAL_FILE_ID 4 � SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION # �4 _CM_FULL_RESOURCE_DESCRIPTOR @B _RTL_STACK_CONTEXT_ENTRY �> tagEMRSETTEXTCOLOR �B TOUCH_HIT_TESTING_INPUT " �B PPERFINFO_PROCESS_PERFCTR32 $ TRANSACTION_INFORMATION_CLASS �B PNONCLIENTMETRICS �B PETW_SET_KTIMER2_EVENT ) poly8x8_t �B OBJECT_TYPES_INFORMATION � _SERVICE_SID_INFO % �B PISECURITY_DESCRIPTOR_RELATIVE �B PENABLECALLBACK �B EMRALPHABLEND ' �B PERFINFO_DRIVER_COMPLETE_REQUEST �B DEBUG_EVENT �B _LDR_DATA_TABLE_ENTRY32 8 �B PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION �2 HEAP_RANGE_LOG 7 �B _IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION � _ENERGY_STATE_DURATION q> PROCESS_FAULT_INFORMATION � POWER_IDLE_RESILIENCY * �B PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM + �; _PERFINFO_DOMAIN_CHANGE_EVENT_REASON � _SERVICE_TRIGGER_INFO �B PHEAP_RANGE_CREATE �B RTL_UNICODE_STRING_BUFFER � NETWORK_APP_INSTANCE_EA �+ _MUICCENTRY $ �B PPERFINFO_CC_WORKITEM_DEQUEUE �& RTL_RESOURCE_DEBUG64 �B _SC_ACTION_TYPE �B ETW_DEBUG_PRINT_EVENT �B PIO_SESSION_EVENT # �B WIM_PROVIDER_START_INTEGRITY �B PRTL_PROTECTED_ACCESS # �B tagEMREXTCREATEFONTINDIRECTW LA RTL_DEBUG_INFORMATION32 �B _OVERLAPPED �A SERVICE_TABLE_ENTRY �B PMIDL_SYNTAX_INFO ! _PROCESS_MITIGATION_POLICY � CSV_CONTROL_OP " SERVICE_DESCRIPTIONW �B PWMI_TCPIP �9 LPC_CLIENT_DIED_MSG �B _ALPC_DIRECT_ATTR �B SYSDBG_BUS_DATA " PSECURITY_ATTRIBUTES_OPAQUE �B NPRGBTRIPLE # �B _FILE_ALLOCATED_RANGE_BUFFER � _KUSER_SHARED_DATA # �# RTL_DYNAMIC_HASH_TABLE_ENTRY 4 �B PACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION > SILOOBJECT_ROOT_DIRECTORY �B PETW_BUFFER_STATE & �B IR_TIMER_EXTRA_CREATE_PARAMETER �B LPAXISINFO " B PSUBSYSTEM_INFORMATION_TYPE ) xB PSYSTEM_ENTROPY_TIMING_INFORMATION A vB PRTL_QUERY_DEBUG_VIRTUAL_PROCESS_QUERY_INFORMATION_ROUTINE uB LPGCP_RESULTSA tB PARRAY_INFO pB PCI_LOG_MMCSS_START . PFLS_CALLBACK_FUNCTION L AXESLISTA # � _HOT_PATCH_INFORMATION_CLASS nB PSERVICE_NOTIFY_1 RTL_REFERENCE_COUNT EMRPOLYLINE # LDR_EXTERNAL_DLL_PATH lB _PERFINFO_SPINLOCK_CONFIG % )0 _IMAGE_LOAD_CONFIG_DIRECTORY32 � _THREADINFOCLASS �+ _MM_ETW_PAGE_INFO_EX # iB PTRANSACTION_ENLISTMENT_PAIR * & PROCESS_KEEPALIVE_COUNT_INFORMATION ' gB _FILE_MAILSLOT_QUERY_INFORMATION " V _FILE_GET_QUOTA_INFORMATION �? _QUERY_BAD_RANGES_OUTPUT 6 � SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION cB PROCESS_PRIORITY_CLASS � _PROCESSOR_GROUP_INFO `B PTRACE_LOGFILE_HEADER _B NDR_NOTIFY2_ROUTINE [B _CM_PNP_BIOS_DEVICE_NODE SB PMUILANGINFO RB LPSC_HANDLE JB PRPC_SECURITY_QOS_V5_A * HB PVIRTUALIZATION_INSTANCE_INFO_INPUT % , RTL_SEGMENT_HEAP_MEMORY_SOURCE % �4 _ETW_LAST_DROPPED_EVENT_STRUCT CB LPCONNECTDLGSTRUCTA �" JOB_SET_ARRAY @B RTL_STACK_CONTEXT_ENTRY ? ABCFLOAT R$ _NUMA_NODE_RELATIONSHIP �, PRGNDATA $ �= tagPOINTER_DEVICE_CURSOR_TYPE # >B USER_MARSHAL_FREEING_ROUTINE <B IMAGE_FUNCTION_ENTRY64 " 9B PSYSTEM_CPU_SET_INFORMATION 8B PCUUCSSTR & 6B PACTCTX_SECTION_KEYED_DATA_2600 4B EMRRESTOREDC u" EMRLINETO </ _WMI_PROCESS_INFORMATION .B PUSN_JOURNAL_DATA_V0 � _LAST_EXCEPTION_LOG (B PWIN32_FIND_STREAM_DATA %B FILE_RENAME_INFO , `6 _EVENT_TRACE_TIME_PROFILE_INFORMATION 3 }( JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 "B PFILE_LAYOUT_NAME_ENTRY + !B PRPC_HTTP_TRANSPORT_CREDENTIALS_V3_W � PERFINFO_DPC_INFORMATION B PTP_DEBUG_FREE_INFO B PRTL_CIRCULAR_LIST_ENTRY � EISA_PORT_DESCRIPTOR m< RTL_HASH_ENTRY B PCOMPARTMENT_ID �+ _IMAGE_BASE_RELOCATION + B PROCESS_MITIGATION_IMAGE_LOAD_POLICY * 0; _ETW_TRACE_PARTITION_INFORMATION_V2 B CREATE_PROCESS_DEBUG_INFO �. ALPC_HANDLE_ATTR B PEFI_DRIVER_ENTRY_LIST � TRACE_ENABLE_INFO $ B MEMORY_EXHAUSTION_INFORMATION � EMRSETLAYOUT & % FILE_PIPE_CLIENT_PROCESS_BUFFER X% PGRADIENT_RECT " `' ETW_TP_EVENT_CALLBACK_START �* _PO_SLEEP_DISABLE_REASON ! B PPERFINFO_PO_NOTIFY_DEVICE B PPO_WAKE_SOURCE_INFO B LPSIZEL + B PERFINFO_DRIVER_COMPLETE_REQUEST_RET $ �" _PERFINFO_CC_WORKITEM_ENQUEUE �A _ETW_NOTIFICATION_HEADER , �A _EVENT_TRACE_HEAP_TRACING_INFORMATION z< _RATE_QUOTA_LIMIT ] _SYSDBG_COMMAND �4 CORRELATION_VECTOR $ �A PACTIVATION_CONTEXT_MSIX_INFO # �A ETW_TP_EVENT_TIMER_CANCELLED �A LPSERVICE_TABLE_ENTRY " �@ PVECTORED_EXCEPTION_HANDLER m' LPCRITICAL_SECTION BCHAR �9 ETW_WNF_EVENT_CALLBACK ! |4 _FILE_TRACKING_INFORMATION % �A FILE_PROVIDER_EXTERNAL_INFO_V1 �A PRTL_RETPOLINE_ROUTINES �# _SYSDBG_IO_SPACE �A RPC_PROTSEQ_VECTORA - �A PJOBOBJECT_END_OF_JOB_TIME_INFORMATION , �A PJOBOBJECT_EXTENDED_LIMIT_INFORMATION � PROCESS_WAKE_INFORMATION ) �A PSYSTEM_CONTEXT_SWITCH_INFORMATION �, tagLOGPEN " GEOCLASS �( _XMIT_ROUTINE_QUINTUPLE + �A SYSTEM_LOGICAL_PROCESSOR_INFORMATION ' �A PPERFINFO_PPM_THERMAL_CONSTRAINT h TOKEN_GROUPS PSE_SIGNING_LEVEL # �A PETW_DFSS_START_NEW_INTERVAL # �5 FILE_ID_BOTH_DIR_INFORMATION �- SYSTEM_FLAGS_INFORMATION - �A PTOKEN_SECURITY_ATTRIBUTES_INFORMATION �? RTL_UNLOAD_EVENT_TRACE32 � _COMPUTER_NAME_FORMAT ' �& RPC_BINDING_HANDLE_TEMPLATE_V1_A " ^$ _PERFINFO_CC_CAN_WRITE_FAIL ! �; SE_LEARNING_MODE_DATA_TYPE + �A DISPLAYCONFIG_SET_TARGET_PERSISTENCE
� IID A= BOOT_ENTROPY_NT_RESULT $ B/ UMS_SYSTEM_THREAD_INFORMATION �A LPRASTERIZER_STATUS �@ _RPC_PROTSEQ_VECTORW ! �A _PERFINFO_BOOT_PHASE_START ! � _IMAGE_ROM_OPTIONAL_HEADER �A jmp_buf �A EVENT_FILTER_DESCRIPTOR �A PBITMAPV5HEADER �1 _EXCEPTION_RECORD64 �3 MEMORY_SCRUB_INFORMATION �A LPNEWTEXTMETRICA " �* SECTION_IMAGE_INFORMATION32 + �A PVIRTUALIZATION_INSTANCE_INFO_OUTPUT & �A PSYSTEM_VERIFIER_INFORMATION_EX
� ACTCTX �( tagRID_DEVICE_INFO �A _COMM_FAULT_OFFSETS �A PPERFINFO_PO_PRESLEEP � SD_ENUM_SDS_INPUT . 0. TRANSACTIONMANAGER_RECOVERY_INFORMATION �A PDESIGNVECTOR A _RPC_CLIENT_ID " �A PIMAGE_DYNAMIC_RELOCATION64 # �A PIMAGE_LOAD_CONFIG_DIRECTORY �A HEAP_SUMMARY �A HWINEVENTHOOK__ + i5 EVENT_TRACE_SYSTEM_EVENT_INFORMATION �A PWMI_DISKIO_READWRITE $ �A PJOBOBJECT_FREEZE_INFORMATION r) TIMER_BASIC_INFORMATION % EMRARCTO �? MENUITEMTEMPLATEHEADER �A PPM_WMI_PERF_STATES_EX �A LPFILE_ID_DESCRIPTOR ( |A PRPC_BINDING_HANDLE_SECURITY_V1_A j _WMI_POWER_RECORD zA LPSTYLEBUFW ' 1 WORKER_FACTORY_BASIC_INFORMATION ) yA PSYSTEM_VSM_PROTECTION_INFORMATION �! EMRSAVEDC � _ENCLAVE_CREATE_INFO_SGX �9 _CM_FLOPPY_DEVICE_DATA wA _INPUT_RECORD % qA LPSERVICE_FAILURE_ACTIONS_FLAG , �3 TOKEN_SECURITY_ATTRIBUTES_INFORMATION $ pA PSERVERSILO_BASIC_INFORMATION nA HFONT__ gA PCM_EISA_SLOT_INFORMATION eA WNDENUMPROC �0 NONCLIENTMETRICS bA PEMRSELECTPALETTE " ^A _ETW_COVERAGE_SAMPLER_STATS L! _KLDR_DATA_TABLE_ENTRY ZA threadlocinfo NA PSCRUB_DATA_OUTPUT S& RTL_RUN_ONCE LA _RTL_DEBUG_INFORMATION32 �# IMPORT_OBJECT_TYPE 3 �( _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT �" LPENUMTEXTMETRICW ( Q _JOBOBJECT_RATE_CONTROL_TOLERANCE " IA PENTER_STATE_SYSTEM_HANDLER ( GA ETW_UMS_EVENT_DIRECTED_SWITCH_END CA TXFS_QUERY_RM_INFORMATION �> MEMORY_BASIC_INFORMATION <A PNIC_RECORD ! 7A PETW_REFDEREF_OBJECT_EVENT 5A PXSTATE_CONFIGURATION 3A COMSTAT 'A ETW_SET_KTIMER2_EVENT ) #A _ETW_COVERAGE_SAMPLER_BLOOM_FILTER A _PERFORMANCE_DATA $ O> _UMS_CREATE_THREAD_ATTRIBUTES o* ENCLAVE_INIT_INFO_VBS / � RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY ' A PPERFINFO_WORKINGSET_INFORMATION / b _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX ! A PETW_THREAD_SET_NAME_EVENT " A LPWIN32_FILE_ATTRIBUTE_DATA A POINTFX ! poly16_t ( A PSYSTEM_AUDIT_CALLBACK_OBJECT_ACE
A _TP_DEBUG_FREE_INFO J A _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING A DISPLAYCONFIG_MODE_INFO # �@ PFILE_ALLOCATION_INFORMATION � EVENT_INFO_CLASS PTEB PVOID64 �@ RPC_PROTSEQ_VECTORW � _REFS_SMR_VOLUME_GC_STATE �@ PRTL_RUN_ONCE_INIT_FN h+ EMRSETICMPROFILEA �@ PCM_POWER_DATA ! �@ PUSER_THREAD_START_ROUTINE �@ MENUITEMINFOW & �@ PPS_CPU_QUOTA_QUERY_INFORMATION ( POFSTRUCT �@ PPERFINFO_GROUPMASK u0 EXCEPTION_POINTERS �3 _RTL_SRWLOCK �" tagPOINT " TRACE_ENABLE_FLAG_EXTENSION ) �8 SYSTEM_LOW_PRIORITY_IO_INFORMATION �@ PLIST_ENTRY32 3 < JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V1 3 �@ PIMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION " �@ PTOP_LEVEL_EXCEPTION_FILTER 05 _PROCESSOR_RECORD $ �@ PSILOOBJECT_BASIC_INFORMATION 1 �@ PTRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT 8# tagCWPRETSTRUCT " u RTL_FEATURE_VARIANT_PAYLOAD , ^9 _JOBOBJECT_SECURITY_LIMIT_INFORMATION " �@ PRTL_HEAP_MEMORY_LIMIT_DATA �? REMOTE_NAME_INFO % , _PERFINFO_DRIVER_MAJORFUNCTION �. _MOVE_FILE_DATA32 { POWER_INFORMATION_LEVEL ? BREAK_ON_STATUS_BUFFER �: FILE_PIPE_EVENT_BUFFER �@ _KEY_VALUE_ENTRY $ �@ PGET_SYSTEM_WOW64_DIRECTORY_A �@ PIO_COUNTERS �= USN_JOURNAL_DATA_V2 " �@ SEMAPHORE_BASIC_INFORMATION �@ PRTL_ACE_DATA �@ _DISCDLGSTRUCTA $ �& PERFINFO_PPM_IDLE_STATE_ENTER > �@ PPROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION �@ PWNF_DLLUNLOAD_CALLBACK �! EMRSETWINDOWORGEX � CSV_NAMESPACE_INFO � _RTL_RESOURCE_CATEGORY ~" DISPLAY_DEVICEA PROCESS_MITIGATION_POLICY ! �@ PACTCTX_SECTION_KEYED_DATA �@ FILTERKEYS �? _EVENT_TRACE 6 _RPC_MESSAGE �@ PMIDL_INTERCEPTION_INFO �@ PSYSTEM_TRACE_HEADER * �@ PPERFINFO_SESSIONCREATE_INFORMATION 0 � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE �' _NV_MEMORY_RANGE '1 ETW_TP_EVENT_POOL_CLOSE % � _IO_RESOURCE_REQUIREMENTS_LIST �@ PMUILANGCFGNODE �; tagLOGPALETTE $ c8 WMI_DISKIO_IO_REDIRECTED_INIT %; KAFFINITY_EX �@ _RTL_RXACT_CONTEXT � tagBITMAPINFOHEADER
" LCTYPE
p PZZSTR �< _IMAGE_THUNK_DATA32 N. _OBJECT_BASIC_INFORMATION % �@ _SYSTEM_SECUREBOOT_INFORMATION �@ PSERVICE_START_REASON % �@ PFSCTL_QUERY_REGION_INFO_INPUT ! {$ IMAGE_AUX_SYMBOL_TOKEN_DEF �1 DMA_CONFIGURATION_BYTE0 �@ _UUID_VECTOR # J> FILE_END_OF_FILE_INFORMATION # _TRANSACTION_LIST_ENTRY �@ PSCONTEXT_QUEUE $ �5 _TRANSACTION_BIND_INFORMATION # H% NDR_CS_SIZE_CONVERT_ROUTINES �@ FIND_BY_SID_DATA B& _QUERY_FILE_LAYOUT_INPUT �@ PALPC_CONTEXT_ATTR �6 TOKEN_SOURCE 3 7 JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE - POSVERSIONINFOEX2W �@ PRTL_HEAP_INFORMATION � tagTITLEBARINFOEX # �@ PCOMPOUND_ACCESS_ALLOWED_ACE
t LPBOOL W. _UNLOAD_DLL_DEBUG_INFO �! ICONINFOEX �% PVALUEW , ( PERFINFO_PFMAPPED_SECTION_INFORMATION , �@ PCLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 �@ PCI_LOG_SCHEDULER_SLEEP + ~@ PCRTL_ACTIVATION_CONTEXT_STACK_FRAME - g5 PEVENT_TRACE_STACK_TRACING_INFORMATION ( v@ PTIMER_SET_COALESCABLE_TIMER_INFO " PSAVEPOINT_ID + �4 _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A �0 _OBJECT_TYPE_LIST + � _RTL_FEATURE_CONFIGURATION_OPERATION �; LPENUMLOGFONTEXDVW q" PPAINTSTRUCT d% ARM64_FNPDATA_FLAGS s@ GRADIENT_TRIANGLE 5" DOCINFOA p@ PEMRSTRETCHDIBITS �5 SC_EVENT_TYPE ! j@ PSYSTEM_POWER_CAPABILITIES � SYSTEM_POWER_INFORMATION ; � _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION g@ SC_HANDLE__ : �3 PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION .8 FILE_NOTIFY_INFORMATION 2 �; TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT # c@ _ETW_KERNEL_HEADER_EXTENSION 8 � _IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION ?7 FPO_DATA # PSID_HASH_ENTRY C EVENT_DESCRIPTOR & `@ KENTROPY_INITIALIZATION_ROUTINE ~' tagHELPWININFOW & \@ ETW_COMPRESSION_RESUMPTION_MODE ( Z@ PLOOKUP_STREAM_FROM_CLUSTER_INPUT , Y@ PPLUGPLAY_CONTROL_DEVICE_CONTROL_DATA + i5 EVENT_TRACE_PEBS_TRACING_INFORMATION & X@ PCSE_SET_FILE_CACHE_INFORMATION �$ LPSYNCHRONIZATION_BARRIER " tagEMRPLGBLT H0 _TOKEN_SID_INFORMATION . N@ PPROCESS_MITIGATION_DYNAMIC_CODE_POLICY / M@ PPROCESS_MITIGATION_CHILD_PROCESS_POLICY ! L@ PUSN_TRACK_MODIFIED_RANGES K@ PEMRSAVEDC $ J@ PPS_CPU_QUOTA_SET_INFORMATION H@ _FP_IEEE_RECORD D@ PCM_MCA_POS_DATA C@ PTP_NBQ_FREE_ROUTINE @@ RPC_FORWARD_FUNCTION $ =@ PTHREAD_PROFILING_INFORMATION ! 9@ PFILE_BOTH_DIR_INFORMATION ) 6@ _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX & 1@ PSYSTEM_CPU_SET_TAG_INFORMATION ,@ DATEFMT_ENUMPROCEXEX " _FILE_LINK_INFORMATION % (@ SL_APPX_CACHE_VALUE_DESCRIPTOR &@ LPQUERY_SERVICE_CONFIGA ' j1 _PERFINFO_PMC_SAMPLE_INFORMATION %@ PFILE_ID_INFORMATION # #@ RTL_PROCESS_LOCK_INFORMATION � SERVICE_SID_INFO @ _ETW_REF_CLOCK �4 _VIRTUALIZATION_RECORD " P MEM_EXTENDED_PARAMETER_TYPE �- EMREXTTEXTOUTA 7 @ PLDR_LOADED_MODULE_ENUMERATION_CALLBACK_FUNCTION " EMRPAINTRGN ! � MEMORY_BASIC_INFORMATION64 - J" _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS ( !+ MEMORY_WORKING_SET_EX_INFORMATION @ LPDISCDLGSTRUCTW " �9 _PERFINFO_SYSCALL_EXIT_DATA , @ PEVENT_TRACE_SOFT_RESTART_INFORMATION @ POSVERSIONINFOEX2 ( @ PRTL_QUERY_DEBUG_INFORMATION_INFO @ LPCURRENCYFMTW )
@ PJOBOBJECT_CONTAINER_IDENTIFIER_V2
@ _SMALL_RECT * P4 _PERFINFO_EXECUTIVE_RESOURCE_CONFIG @ PTP_NBQ_ALLOC_ROUTINE " N7 _QUERY_SERVICE_LOCK_STATUSA * �< _SYSTEM_SET_TIME_ADJUST_INFORMATION $ @ PPLUGPLAY_CUSTOM_NOTIFICATION @ PCGESTUREINFO ! RTL_STRING_LENGTH_TYPE , �? _EVENT_TRACE_SOFT_RESTART_INFORMATION �? PPO_WAKE_SOURCE_INTERNAL � tagICEXYZTRIPLE =. _IMAGE_TLS_DIRECTORY64 �? REMOTE_NAME_INFOA ' d6 PROCESS_HANDLE_TRACING_ENABLE_EX # �? EXTENDED_ENCRYPTED_DATA_INFO " X, _ENLISTMENT_CRM_INFORMATION HRESULT 1 �? SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE �? PRKCRM_TRANSACTION_BLOB �. tagMOUSEINPUT �? LPCPINFOEXW % s8 WOW64_ARCHITECTURE_INFORMATION % �? PENCLAVE_CREATE_INFO_VBS_BASIC �? PIMAGE_ENCLAVE_IMPORT �? COMPRESSED_DATA_INFO % �+ _SYSTEM_PROCESS_CLASSIFICATION � RID_DEVICE_INFO_HID �? PSYSTEM_ACCESS_FILTER_ACE , �? PSYSTEM_QUERY_TIME_ADJUST_INFORMATION �% tagEMRGLSRECORD �? PIMAGE_FILE_HEADER �? QUERY_BAD_RANGES_OUTPUT �# _SE_IMAGE_SIGNATURE_TYPE 3 �, _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT " + _ETW_UMS_EVENT_DISASSOCIATE " FILE_LINK_INFORMATION �? PCACTCTXA & �> _SYSTEM_HANDLE_TABLE_ENTRY_INFO ! �? PSYSTEM_OBJECT_INFORMATION ! �4 _IMAGE_BOUND_FORWARDER_REF 2 )8 _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 �? PMANDATORY_LEVEL 6 \& _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY �+ INPUT_MESSAGE_ORIGIN_ID �" MOUSE_EVENT_RECORD �? _IO_RESOURCE_LIST 2 _EXIT_THREAD_DEBUG_INFO �9 NPBITMAP �? IMAGE_AUX_SYMBOL_TYPE x _LDR_SECTION_INFO $ �? PSET_PURGE_FAILURE_MODE_INPUT �? PMENUITEMTEMPLATEHEADER ' �5 USER_MARSHAL_MARSHALLING_ROUTINE �? SYSTEM_BASIC_INFORMATION . � PROCESS_MITIGATION_CHILD_PROCESS_POLICY �7 THREAD_TEB_INFORMATION - ! MEMORY_PARTITION_ATTRIBUTE_INFORMATION �? _RTL_UNLOAD_EVENT_TRACE32 �= tagLASTINPUTINFO �? PEVENT_TRACE
" LGRPID . Y8 _STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER �? _PO_WAKE_SOURCE_DEVICE +# _TOKEN_ORIGIN , �6 SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA �? MM_ETW_PAGE_INFO � tagEMRSELECTCLIPPATH � NUMBERFMTA
u LPUINT " <4 _ETW_DUPLICATE_HANDLE_EVENT �? IMAGE_CHPE_METADATA_X86 �? PIMAGE_ENCLAVE_CONFIG �? PDLGITEMTEMPLATEA �? tagKEYBDINPUT �) _X86_CALL_FRAME �? PIO_APC_ROUTINE + �? _SYSTEM_CRASH_DUMP_STATE_INFORMATION � PKCRM_MARSHAL_HEADER �* tagEXTLOGFONTW - ^/ _SERVICE_CONTROL_STATUS_REASON_PARAMSA + �2 _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE �? PWNF_USER_CALLBACK & �? PPERFINFO_CC_LOGGED_STREAM_INFO " �? PSYSTEM_ERROR_PORT_TIMEOUTS �. _SERVICE_START_REASON �? PHARDWARE_COUNTER_TYPE $ �? PFILE_VOLUME_NAME_INFORMATION ) �? _SYSTEM_WATCHDOG_TIMER_INFORMATION & � RTL_STACK_TRACE_DATABASE_CREATE # ? tagTouchPredictionParameters - |? PEVENT_TRACE_STACK_CACHING_INFORMATION w? PXSAVE_AREA_HEADER v? PRTL_MEMORY_TYPE �9 PEMRSETICMPROFILEA " s? PETW_HEAP_EVENT_CONTRACTION X? PRIVILEGE_SET " r? PPROCESSOR_IDLESTATE_POLICY p? _CPTABLEINFO # � RTL_CRITICAL_SECTION_DEBUG32 o1 SERVICE_TRIGGER m? _LDR_VERIFY_IMAGE_INFO & f? PFILE_PIPE_CREATE_SYMLINK_INPUT c? _RTL_UNLOAD_EVENT_TRACE64 `? PRTL_UNLOAD_EVENT_TRACE _? LPGLYPHSET * �; PERFINFO_PAGECOMBINE_AGGREGATE_STAT # ^? PKEY_WOW64_FLAGS_INFORMATION * \? _PERFINFO_SESSIONCREATE_INFORMATION ) PPATTERN U? PPRIVILEGE_SET � EMRPOLYPOLYLINE " / PERFINFO_FILE_OPERATION_END S? PTXFS_MODIFY_RM Q? BOOT_AREA_INFO G? LPPELARRAY [" _EXFAT_STATISTICS c+ _GET_FILEEX_INFO_LEVELS � HIGHCONTRASTW
D? FP_128 3 @? _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION ! � UMS_SCHEDULER_STARTUP_INFO $ <? PERFINFO_FLT_OPERATION_STATUS �! int32x4x3_t �- SLIST_ENTRY ' 8? _PROCESS_WS_WATCH_INFORMATION_EX 0 5? PPOWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES �< ENUMLOGFONTEXW 1? PPERFINFO_PO_POSTSLEEP $ � MEMORY_COMBINE_INFORMATION_EX # .? _SYSTEM_VHD_BOOT_INFORMATION e; _EVENT_INSTANCE_HEADER ( *? _EVENT_EXTENDED_ITEM_PMC_COUNTERS ' Z _PERFINFO_FILEOBJECT_INFORMATION & &? _POWER_THROTTLING_PROCESS_STATE #? PPIXELFORMATDESCRIPTOR % !? ETW_TP_EVENT_TIMER_SET_NTTIMER 5 ? _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY 0 ? PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY + ? PRPC_HTTP_TRANSPORT_CREDENTIALS_V3_A + �> _JOBOBJECT_ASSOCIATE_COMPLETION_PORT � SECTION_INHERIT ) int32x2_t ? PBREAK_ON_STATUS_BUFFER ( ? PCFG_CALL_TARGET_LIST_INFORMATION ' ? DISPLAYCONFIG_DEVICE_INFO_HEADER ` uint16x8x2_t ? _ABCFLOAT $ �> _REPAIR_STORAGE_RESERVE_INPUT ] SYSDBG_COMMAND �> PVALCONTEXT & 2 PERFINFO_CC_READ_AHEAD_COMPLETE # �1 SYSTEM_CALL_TIME_INFORMATION �> EMRSETBKCOLOR �> LPCBT_CREATEWND ! �> PETW_COVERAGE_SAMPLER_DATA � ACCESS_REASON_TYPE & �> CSV_QUERY_VOLUME_REDIRECT_STATE ! �> SYSTEM_POWER_STATE_CONTEXT % �> SYSTEM_HANDLE_TABLE_ENTRY_INFO ! �> PEVENT_TRACE_PROPERTIES_V2 ' �> PPERFINFO_PO_SESSION_CALLOUT_RET �7 _ETW_POOL_EVENT $ KSYSTEM_TIME �> EVENT_HEADER �> PVIRTUALIZATION_RECORD $ �> PPROCESS_WS_WATCH_INFORMATION + � PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA �! uint64x2x3_t $ / _SYSTEM_FIRMWARE_TABLE_ACTION �> PEMREXTFLOODFILL �> PRPC_UNICODE_STRING t PHALF_PTR �> ANON_OBJECT_HEADER_V2 ! �> PSYSTEM_POLICY_INFORMATION �> PTIMELINE_BITMAP 4 _PREFIX_TABLE - �> _EVENT_TRACE_STACK_CACHING_INFORMATION �> PMEMORY_BASIC_INFORMATION �> PDROPSTRUCT �> ETW_PER_SESSION_QUOTA # �> PLDR_CREATE_ACT_CTX_LANGUAGE �> PFILE_BASIC_INFORMATION _TXFS_MODIFY_RM ! �1 FSCTL_OFFLOAD_WRITE_OUTPUT 0 �> PFN_RTL_IS_SERVICE_PACK_VERSION_INSTALLED tagEMRPOLYLINE �> PACCESS_ALLOWED_ACE p! _STARTUPINFOEXW " �9 DIALOG_DPI_CHANGE_BEHAVIORS + �> PJOBOBJECT_ASSOCIATE_COMPLETION_PORT \ _LOAD_ASDATA_TABLE �> PREARRANGE_FILE_DATA32 ! �> PRTL_RETPOLINE_BINARY_INFO � tagEMRSETARCDIRECTION �% EXCEPTION_RECORD " �. _IMAGE_DYNAMIC_RELOCATION32 + �> CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT > �5 ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA �> PROCESSOR_IDLE_HANDLER �> tagGUITHREADINFO ' / DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK h9 NPDEVMODEW # > PRTL_IMAGE_MITIGATION_POLICY % x> PMANAGE_HOT_PATCH_UNLOAD_PATCH + FOCUS_EVENT_RECORD u> _SYSTEM_INFO �* WNODE_SINGLE_ITEM ! o> PPROCESS_FAULT_INFORMATION l> tagPOINTER_PEN_INFO u, POWER_PLATFORM_ROLE - j> PSYSTEM_PROCESSOR_PROFILE_CONTROL_AREA �0 _PERFINFO_CCSWAP_LITE * � VIRTUALIZATION_INSTANCE_INFO_OUTPUT . � _SECURE_SPECULATION_CONTROL_INFORMATION \3 _EISA_IRQ_CONFIGURATION i> LPLOGCOLORSPACEA . � _ETW_COVERAGE_SAMPLER_INFORMATION_CLASS ) �4 MANAGE_WRITES_TO_EXECUTABLE_MEMORY g> _PO_WAKE_SOURCE_TIMER NDR_CCONTEXT " c> PLDR_IMPORT_MODULE_CALLBACK ' _IMAGE_RESOURCE_DIRECTORY_STRING 6 _TEB ]> LPMONITORINFOEXA Z> PPM_WMI_PERF_STATE ) W> PERFINFO_DPC_EXECUTION_INFORMATION S> _IMAGE_DEBUG_MISC $ M> PUMS_CREATE_THREAD_ATTRIBUTES $ J> _FILE_END_OF_FILE_INFORMATION & F> _MEMORY_WORKING_SET_EX_LOCATION D> NPTEXTMETRIC �- tagMOUSEKEYS C> RPC_SETFILTER_FUNC <> OBJECTID 8> BOOT_RECORD 0> PCM_EXTENDED_PARAMETER ) �* TRANSACTION_PROPERTIES_INFORMATION "7 _MUILANGLISTNODE )> PFILE_ALL_INFORMATION � SYSGEOCLASS $> PSD_QUERY_STATS_INPUT / "> SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS # �+ _OS_DEPLOYEMENT_STATE_VALUES > PMSLLHOOKSTRUCT 5 LPWNDCLASSEXW > FSCTL_OFFLOAD_READ_INPUT 9$ DISPLAYCONFIG_ROTATION # � FILE_DISPOSITION_INFORMATION _JIT_DEBUG_INFO > _RPC_BINDING_VECTOR �7 PS_SYSTEM_DLL_INIT_BLOCK , i5 EVENT_TRACE_STACK_TRACING_INFORMATION �2 PCZZSTR 4 �7 PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY $ b _SYSTEM_REF_TRACE_INFORMATION > SCROLLINFO > PWMI_PNP_RECORD_V3 8 SYSDBG_LIVEDUMP_CONTROL > PPSFEATURE_OUTPUT �= LPFONTSIGNATURE ) > MIDL_WINRT_TYPE_SERIALIZATION_INFO ( > ACCESS_DENIED_CALLBACK_OBJECT_ACE ! > PSILOOBJECT_ROOT_DIRECTORY �= _FILE_PREFETCH �= PFONTSIGNATURE �= RTL_GENERIC_TABLE �+ OSVERSIONINFOEXW ) �1 FILE_VALID_DATA_LENGTH_INFORMATION ) �= PSYSTEM_FIRMWARE_TABLE_INFORMATION % PS_WAKE_REASON & 80 FILE_FS_SECTOR_SIZE_INFORMATION )! SYSTEM_POOL_INFORMATION �= HEAP_COMMIT_DECOMMIT A ETW_LBR_ENTRY & �= PPERFINFO_FILE_SIMPLE_OPERATION �= PPS_CPU_QUOTA_QUERY_ENTRY # �= SYSTEM_INTERRUPT_INFORMATION �- tagWINDOWPOS RPC_NS_HANDLE '= METAFILEPICT $ �= tagPOINTER_DEVICE_CURSOR_INFO
�' HSTR__ " �* MEMORY_PRIORITY_INFORMATION �= PIMAGE_IMPORT_DESCRIPTOR �1 _IMAGE_ENCLAVE_CONFIG64 & �= PACTIVATION_CONTEXT_QUERY_INDEX ! / _TXFS_START_RM_INFORMATION & �= PRTL_UMS_SCHEDULER_STARTUP_INFO �= _EVENT_FILTER_EVENT_ID �= ENUMUILANG �= LPHANDLETABLE @5 tagMSLLHOOKSTRUCT 3 �= PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION ' 82 PERFINFO_KERNELMEMORY_USAGE_TYPE �! float32x4x3_t �= PMFT_ENUM_DATA_V0 �= _CONTAINER_VOLUME_STATE 3 �= _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY �= PUSN_JOURNAL_DATA_V2 � _FILE_REGION_INFO � STRING64 f" _HEAP_INFORMATION_CLASS ) �6 PERFINFO_PO_NOTIFY_DEVICE_COMPLETE =- IMAGE_CHPE_RANGE_ENTRY �= PUSN_JOURNAL_DATA �3 IO_ERROR_LOG_MESSAGE � _KEY_TRUST_INFORMATION K< JOURNAL_INFORMATION_CLASS & j1 PERFINFO_PMC_SAMPLE_INFORMATION D _RTL_RESOURCE �= PSERVICE_NOTIFYA �= PPS_CREATE_INFO �= PNEWTEXTMETRIC 7 tagEMRSETPIXELV S NDR_EXPR_DESC % �5 _ETW_CLOCK_CONFIGURATION_EVENT " _ACCESS_DENIED_CALLBACK_ACE �= _SYSTEM_AUDIT_OBJECT_ACE ! �= _SYSTEM_POLICY_INFORMATION �= PCOEM_STRING �= PTOKEN_STATISTICS ^8 tagSOUNDSENTRYW PLONGLONG �= PVM_COUNTERS_EX ! �= PCONTAINER_ROOT_INFO_INPUT - �! EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID �= SYSTEM_POLICY_INFORMATION 1 _PROCESS_HEAP_ENTRY ~ tagEMRPOLYPOLYLINE16 �= PREPARSE_DATA_BUFFER_EX = PLASTINPUTINFO % z= PSE_SET_FILE_CACHE_INFORMATION �6 _PROCESS_ACCESS_TOKEN 1 w= JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 " s= SYSTEM_SCOPED_POLICY_ID_ACE o= tagEMREXTCREATEPEN k= SERVICE_STATUS_PROCESS # �) PERFINFO_FILE_PATH_OPERATION f= PREAD_FILE_USN_DATA �( _PO_WAKE_SOURCE_HISTORY c= WMI_CONTEXTSWAP \= PSCOPE_TABLE_ARM64 poly16x4x2_t X= PSTREAM_LAYOUT_ENTRY ' V= PSYSTEM_HOT_PATCH_REGISTRY_VALUE " PTP_VERSION U= PFILE_STORAGE_INFO i' CONSOLE_FONT_INFO " �( _SYSTEM_BIGPOOL_INFORMATION ! � SYSTEM_VA_LIST_INFORMATION ! ! _RTL_UMS_THREAD_INFO_CLASS n2 _CACHE_DESCRIPTOR " �2 CONSOLE_READCONSOLE_CONTROL ) S= _FILE_IS_REMOTE_DEVICE_INFORMATION 3 L= PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION #) ATOM_INFORMATION_CLASS � RTL_BARRIER J= POBJECT_ATTRIBUTES64 " H= SD_CHANGE_MACHINE_SID_INPUT $ E= FILE_PIPE_EVENT_SELECT_BUFFER A= _BOOT_ENTROPY_NT_RESULT ;= _NETRESOURCEA 5= LPCBT_CREATEWNDA 3= PPOWER_STATE_TYPE - �; _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT + 1= SYSTEM_INTERRUPT_CPU_SET_INFORMATION l0 ANIMATIONINFO
LONG64 -= _TOKEN_STATISTICS |* FILE_PIPE_PEEK_BUFFER
# tagLOGFONTW �0 tagEMRCREATEMONOBRUSH 0 �4 STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY - *= PSYSTEM_PROCESSOR_FEATURES_INFORMATION # �5 QUERY_STORAGE_RESERVE_OUTPUT 1 )= PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION
"( _FP_64 H DMA_SPEED '= tagMETAFILEPICT # = PCLAIM_SECURITY_ATTRIBUTE_V1 & �- _COVERAGE_UNLOADED_MODULE_ENTRY c" HSAVEDUILANGUAGES__ = LPMODEMSETTINGS = PEVENT_TRACE_LOGFILEA 2: RPC_CLIENT_INFORMATION1
�9 BITMAP ( = PGET_FILTER_FILE_IDENTIFIER_INPUT = _REASON_BUFFER " = PSYSTEM_CONSOLE_INFORMATION = MEM_ADDRESS_REQUIREMENTS �% LPCWCHAR . � ACTIVATION_CONTEXT_DETAILED_INFORMATION ! �< PPAGE_PRIORITY_INFORMATION o$ SIZE �9 _FILE_CASE_SENSITIVE_INFO �< LPENUMLOGFONT �# OBJECT_NAME_INFORMATION ~ FILE_INFORMATION_CLASS �( PO_WAKE_SOURCE_HISTORY �6 _HOT_PATCH_IMAGE_INFO ', LPCUWSTR $ }) _SET_PURGE_FAILURE_MODE_INPUT ! �< _SYSTEM_HANDLE_INFORMATION �0 RECT �1 COLORADJUSTMENT s# RTL_MODULE_BASIC_INFO # �< PRTL_USER_PROCESS_PARAMETERS U FILE_STAT_INFORMATION �< tagPOINTER_DEVICE_INFO ) �< PPERFINFO_KERNELMEMORY_RANGE_USAGE " ULONG * �< PSYSTEM_SET_TIME_ADJUST_INFORMATION ; PERFINFO_CCSWAP_TYPE . �< PSYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER " �+ OS_DEPLOYEMENT_STATE_VALUES 3 *' SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM �< _IMAGE_FUNCTION_ENTRY �< PCIMAGE_THUNK_DATA32 #2 _WMI_JOB_REMOVE_PROCESS , �< _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 ! _5 CONTAINER_ROOT_INFO_OUTPUT r _ABC a _REMOTE_NAME_INFOW �< KERNEL_USER_TIMES + �< SYSTEM_QUERY_TIME_ADJUST_INFORMATION . �< PJOBOBJECT_BASIC_ACCOUNTING_INFORMATION " �0 _LPC_UNREGISTER_PROCESS_MSG �< PREPARSE_GUID_DATA_BUFFER �< PSYSTEM_NUMA_INFORMATION x poly16x8_t / �< SYSTEM_FEATURE_CONFIGURATION_INFORMATION = _MM_ETW_WORKING_SET_TYPE # �< SERVICE_FAILURE_ACTIONS_FLAG & �< PROCESS_HANDLE_TABLE_ENTRY_INFO �< ALPC_HANDLE_ATTR32 �< PXSTATE_CONTEXT ( i< _ETW_COVERAGE_SAMPLER_STATUS_INFO & �< PPUBLIC_OBJECT_TYPE_INFORMATION $ �< _JOBOBJECT_JOBSET_INFORMATION % � DEDUP_CHUNK_INFORMATION_HASH32 �< PEISA_IRQ_CONFIGURATION �< LPENUMLOGFONTEXW �1 RAWKEYBOARD �/ _OSVERSIONINFOW �< tagEMROFFSETCLIPRGN �< PETW_BUFFER_CONTEXT �8 ETW_HEAP_EVENT_RUNDOWN �< PPEB_LDR_DATA �< PEMRFILLRGN SECURITY_STATUS �9 _ENCRYPTED_DATA_INFO < PHYSICAL_DISK_RECORD v< PRATE_QUOTA_LIMIT s< PS_ATTRIBUTE_LIST ( / SYSTEM_FIRMWARE_TABLE_INFORMATION m< _RTL_HASH_ENTRY �. NPCHARSETINFO ' i< ETW_COVERAGE_SAMPLER_STATUS_INFO e< PNETWORK_APP_INSTANCE_EA " c< _KEY_VALUE_FULL_INFORMATION _< CM_POWER_DATA � WMI_WAIT_SINGLE $ �( SYSTEM_CALL_COUNT_INFORMATION 0 �/ SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE Z< _CM_SONIC_DEVICE_DATA W< PTRACE_VERSION_INFO ' V< PFILE_FS_SECTOR_SIZE_INFORMATION U< PRTL_TREE_DELETE_FUNCTION ( � PROCESS_ENERGY_COMPONENT_TYPE_NUM � tagEMRSETCOLORSPACE ) � _FILE_ID_EXTD_BOTH_DIR_INFORMATION T< ENUMRESLANGPROCW P< INPUT_TRANSFORM $ x* _ETW_TP_EVENT_CALLBACK_CANCEL h9 LPDEVMODEW ( H< _RPC_BINDING_HANDLE_TEMPLATE_V1_W B< PCM_COMPONENT_INFORMATION @< FILE_ALIGNMENT_INFO # �2 _CONSOLE_READCONSOLE_CONTROL + :< PALPC_PORT_ASSOCIATE_COMPLETION_PORT 7< RPC_STATS_VECTOR & 2< _STREAMS_QUERY_ID_OUTPUT_BUFFER .< IMAGE_TLS_DIRECTORY32 1 '< _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT �* DATEFMT_ENUMPROCW $< PSTYLEBUF "< _ACL_REVISION_INFORMATION < HLSURF__ LPRAWMOUSE < _SCRUB_DATA_OUTPUT # < PMEMORY_PARTITION_PAGE_RANGE t BOOL ] LPXFORM 1 < PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION % � CM_PARTIAL_RESOURCE_DESCRIPTOR 7 � _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION ! S ETW_FINALIZE_KTIMER2_EVENT / < PPROCESS_STACK_ALLOCATION_INFORMATION_EX < PIMEMENUITEMINFO 1
< I_RpcProxyUpdatePerfCounterBackendServerFn < PERFINFO_PO_NOTIFY_DEVICE < PCOVERAGE_SECTION_HEADER * �4 _MANAGE_WRITES_TO_EXECUTABLE_MEMORY �. PCHARSETINFO �; ETW_HEAP_EVENT_COMMON � IMAGE_NT_HEADERS % �; PKNONVOLATILE_CONTEXT_POINTERS 3 �; PTRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT 1 EMRSETWORLDTRANSFORM
�2 PCNZCH . �. _PROCESS_DYNAMIC_EH_CONTINUATION_TARGET �; PALETTEENTRY + �; PPERFINFO_PAGECOMBINE_AGGREGATE_STAT �; PFILE_PATH �; PEVENT_FILTER_HEADER �; PPERFINFO_TRACE_HEADER �; PRTL_BITMAP_EX �; _RPC_TRANSFER_SYNTAX % �; PSYSTEM_PROCESS_ID_INFORMATION ! �; _WMI_IMAGELOAD_INFORMATION # PKSPIN_LOCK �' tagNMHDR " �; FILE_SET_DEFECT_MGMT_BUFFER " �; PJOBOBJECT_WAKE_INFORMATION � SYSDBG_CONTROL_SPACE �; MMPFN_IDENTITY �; PREAD_USN_JOURNAL_DATA - �; PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT � EMRPOLYPOLYGON $ �; LPENUM_SERVICE_STATUS_PROCESS
q PWCHAR �; PENUMLOGFONTEXDVW �5 _SC_EVENT_TYPE $ �; PETW_HEAP_EVENT_RUNDOWN_RANGE + �; PPERFINFO_DOMAIN_CHANGE_EVENT_REASON �; LPLOGPALETTE ( �; PROCESS_CHILD_PROCESS_INFORMATION �# NPNEWTEXTMETRICW 5 PWNDCLASSEXW �; SYSDBG_VIRTUAL �; NPEXTLOGFONT , �; _PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT & �; PDEDUP_CHUNK_INFORMATION_HASH32 �; PTP_WORK_CALLBACK �; WMI_IMAGELOAD_INFORMATION 4 }( _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 N7 QUERY_SERVICE_LOCK_STATUS & �; ETW_COVERAGE_SAMPLER_PERF_STATS *3 WMIREGGUID �! int64x2x3_t �; PX86_CALL_FRAME �; PMEMORY_SCRUB_INFORMATION �% tagCOMPOSITIONFORM . �; PRETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER * 3 _SYSTEM_SESSION_BIGPOOL_INFORMATION " }; _SYSDBG_KD_PULL_REMOTE_FILE � NUMBERFMTW 4 z; PPROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY v; PEMRCREATEPEN s; _FILE_LAYOUT_NAME_ENTRY ! p; KENTROPY_RAW_DATA_CALLBACK m; PSTORAGE_RESERVE_ID & k; _CM_PNP_BIOS_INSTALLATION_CHECK h; PWOW64_FUNCTION_CODE64 g; LPHELPINFO `; PEVENT_INSTANCE_HEADER �$ int64x2x4_t ^; PRTL_RB_TREE \; _HEAP_INFORMATION_ITEM � tagMULTIKEYHELPA + V; PEVENT_TRACE_PERFORMANCE_INFORMATION T; PSYSTEM_PREFETCH_OPTIONS RPC_BUFPTR R; _RTL_RELATIVE_NAME_U 1 ]7 FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX � CURSORSHAPE N; PCIMAGE_SECTION_HEADER . K; STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE B; PRTLP_TAG_INFO f TEXTMETRIC �' USER_MARSHAL_CB $ �1 _SYSTEM_CALL_TIME_INFORMATION , #! _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA T6 _CM_ERROR_CONTROL_TYPE - @; FILE_DESIRED_STORAGE_CLASS_INFORMATION <; _FILE_STORAGE_INFO 9; NAMEENUMPROCW . �0 _PROCESS_MITIGATION_FONT_DISABLE_POLICY w tagREGISTERWORDW 4; PPERFINFO_FILE_READ_WRITE # � _REFS_SMR_VOLUME_INFO_OUTPUT 2; PTRANSACTION_NOTIFICATION ) 0; ETW_TRACE_PARTITION_INFORMATION_V2 5 ); PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST ! '; PMEMORY_REGION_INFORMATION 1 y) EVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION "; PKAFFINITY_EX + ; _SYSTEM_NET_RATE_CONTROL_SET_CONTEXT ; PRTL_PROCESS_MODULES , ; PSYSTEM_SECUREBOOT_POLICY_INFORMATION � DEP_SYSTEM_POLICY_TYPE ; PEMRFRAMERGN "
; PWMI_JOB_SET_QUERY_NET_RATE ; PCOBJECT_ATTRIBUTES64 . ; POUT_OF_PROCESS_FUNCTION_TABLE_CALLBACK ; _SERVICE_STATUS ( ; _MEMORY_SHARED_COMMIT_INFORMATION � value_entA �: _CSTRING �: NPRECONVERTSTRING # �: PIMAGE_SEPARATE_DEBUG_HEADER �' PEMRPOLYTEXTOUTW �: PCEVENT_DESCRIPTOR p TCHAR �- _SLIST_ENTRY � MIDL_METHOD_PROPERTY �: PALPC_BASIC_INFORMATION �. NPLOGBRUSH ( �: PREMOTE_LINK_TRACKING_INFORMATION �: PEMRCOLORCORRECTPALETTE �: PWMIGUIDINFORMATION " k* SERVICE_REGISTRY_STATE_TYPE $ �: FILE_NETWORK_OPEN_INFORMATION ! �: PROCESSOR_IDLESTATE_POLICY - �: PMEMORY_PARTITION_PAGEFILE_INFORMATION 85 RTL_PROCESS_LOCKS ' �: PHEAP_BLOCK_SETTABLE_INFORMATION + �: PPERFINFO_IMAGELOAD_IN_PAGEFILE_INFO ! , FILE_DIRECTORY_INFORMATION ( (/ SYSTEM_PROCESSOR_IDLE_INFORMATION
�: HDC R: _MOF_FIELD # �: WORKER_FACTORY_DEFERRED_WORK �: SID_IDENTIFIER_AUTHORITY * �! PRTL_ACTIVATION_CONTEXT_STACK_FRAME 5 PWNDCLASSA �: ENCLAVE_TARGET_FUNCTION �: _FILE_ID_INFORMATION # � SharedVirtualDiskSupportType b7 _HEAP_EVENT_RANGE % � _ALTERNATIVE_ARCHITECTURE_TYPE & PEMRSETCOLORSPACE & �: PEVENT_EXTENDED_ITEM_PEBS_INDEX �: PERFINFO_SET_POWER_ACTION �: PPOINTL �: PXMIT_ROUTINE_QUINTUPLE V$ _POOLED_USAGE_AND_LIMITS 2 �: PTRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT �: PHEAP_RANGE_DESTROY �: PPERFINFO_PROCESS_PERFCTR 0 FILE_PREFETCH_EX �: _FILE_PIPE_EVENT_BUFFER �: _SYSDBG_MSR f _DPFLTR_TYPE " �: _CONSOLE_SCREEN_BUFFER_INFO ! �: _FSCTL_OFFLOAD_READ_OUTPUT $ �, SYSTEM_ACPI_AUDIT_INFORMATION LPLDT_ENTRY �: PCM_SERIAL_DEVICE_DATA �: PCHANGEFILTERSTRUCT �: RPC_IF_ID_VECTOR z: PEX_WNF_SUBSCRIPTION y: NPLOGFONTA 2 _GLYPHMETRICSFLOAT # / _PERFINFO_FILE_OPERATION_END ! w: SYSTEM_POOLTAG_INFORMATION t: PRTL_HEAP_TAG s: LANGUAGEGROUP_ENUMPROCW � SERVICE_MAIN_FUNCTIONW m: NPCANDIDATELIST k: PARM64_NT_NEON128 i: MULTI_TIME e: TRACE_VERSION_INFO � LPCUTSTR ( a: SYSTEM_VSM_PROTECTION_INFORMATION % ]: PERFINFO_PPM_IDLE_STATE_CHANGE # Z: PRTL_ALLOCATE_STRING_ROUTINE X: LPCURSORINFO �% LPCWSTR �3 PCUCSSTR 7 V: ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION �1 LPCOLORADJUSTMENT P: PMOF_FIELD M: EISA_MEMORY_TYPE � FILE_STORAGE_TIER_CLASS
9 RAWHID D: PPERFINFO_MM_STAT ! C: PIMAGE_BOUND_FORWARDER_REF ' TOKEN_MANDATORY_LABEL 0 B: PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION � LPCWPSTRUCT @: _IMAGE_ENCLAVE_IMPORT �5 DUPLICATE_EXTENTS_DATA_EX <: DYNAMIC_FUNCTION_TABLE 8: PFILE_OBJECTID_BUFFER 7: PPOWER_ACTION � TP_POOL �+ PAXESLISTW " _5 _CONTAINER_ROOT_INFO_OUTPUT TEXTMETRICW @ FLOAT w REGISTERWORDW 0: PRPC_CLIENT_INFORMATION1 -: WMI_IDE_CHANNEL_RECORD ): PERFINFO_FILE_CREATE &: PLDR_RELEASE_ACT_CTX 7 #: _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION & h _RTL_DYNAMIC_HASH_TABLE_CONTEXT : DISPLAYCONFIG_PATH_INFO : PFSCTL_UNMAP_SPACE_OUTPUT : PPROCESSOR_IDLE_STATE # KAFFINITY �4 HBITMAP__ : _TRACE_LOGFILE_HEADER # z0 _ETW_COVERAGE_SAMPLER_MODULE : PCOBJECT_ATTRIBUTES32 : PTOUCHINPUT �( tagHELPWININFOA p' _RTL_CRITICAL_SECTION " Q1 RTL_SEGMENT_HEAP_PARAMETERS Q _HEAP_REGION_INFORMATION �1 FILEOFFSET_INFORMATION 2 �9 PMEMORY_PARTITION_MEMORY_EVENTS_INFORMATION �9 PEMRSETICMPROFILEW - 2 _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 �9 _FILE_NAME_INFORMATION �* LPKBDLLHOOKSTRUCT �9 tagVS_FIXEDFILEINFO # �9 _ETW_DISKIO_FLUSH_BUFFERS_V3 �0 WX86THREAD �9 PSRWLOCK # �9 PCM_FULL_RESOURCE_DESCRIPTOR �9 _ETW_WNF_EVENT_CALLBACK ) 2 _FILE_MEMORY_PARTITION_INFORMATION �, MODEMDEVCAPS �9 PEVENT_TRACE_PROPERTIES * �9 PFSCTL_QUERY_STORAGE_CLASSES_OUTPUT �9 LPTRACKMOUSEEVENT # �9 SYSTEM_TIMEOFDAY_INFORMATION ' �9 DISPLAYCONFIG_SOURCE_DEVICE_NAME 5 N+ _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION % � PERFINFO_INTERRUPT_INFORMATION �# PARM64_RUNTIME_FUNCTION �9 PVIDEO_RECORD
q PNZWCH . �9 PFSCTL_GET_INTEGRITY_INFORMATION_BUFFER �9 LPBITMAP �9 NEWTEXTMETRICEXW �9 PPOLYTEXT ) poly16x4_t P- PDEBUGHOOKINFO �9 _NDR_USER_MARSHAL_INFO D6 EMRDELETEOBJECT " �9 PENABLE_TRACE_PARAMETERS_V1 �* COPYFILE2_COPY_PHASE + �9 PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE # T3 _DUPLICATE_EXTENTS_DATA_EX32 � THREADINFOCLASS - �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS �9 PMUILANGCFGLIST � MULTIKEYHELP �9 PIMAGE_HOT_PATCH_BASE �9 ENCRYPTED_DATA_INFO �9 PLPC_CLIENT_DIED_MSG 8 LPHELPWININFOA " �9 PPERFINFO_SYSCALL_EXIT_DATA �9 PENCLAVE_LOAD_INFO_VBS �9 PCM_FLOPPY_DEVICE_DATA �9 PFILE_CASE_SENSITIVE_INFO m HEAP_SUBSEGMENT_ALLOC 0 +( _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER �9 RTL_HEAP_STACK_CONTROL �9 _RTL_DEBUG_INFORMATION
# WPARAM �9 NPSTYLEBUF �/ _WMI_QUEUE �9 PLDR_ENUM_RESOURCE_ENTRY �9 XSTATE_CONFIGURATION * � _ASSEMBLY_FILE_DETAILED_INFORMATION # k$ PERFINFO_PPM_STATE_SELECTION �- QUERY_BAD_RANGES_INPUT ~9 PFILETIME }9 PACE_HEADER % {9 PROCESS_EXTENDED_ENERGY_VALUES $ v9 _ENUM_SERVICE_STATUS_PROCESSW p9 PWMI_TXR m9 HICON__ h9 PDEVMODEW f9 QUERYHANDLER �) _ETW_SET_MARK_INFORMATION b9 PPROCESS_JOB_MEMORY_INFO & `9 PSYSTEM_SYSTEM_DISK_INFORMATION + ^9 JOBOBJECT_SECURITY_LIMIT_INFORMATION Z9 PPEBS_DS_SAVE_AREA64 X9 _ETW_OPTICALIO_INIT �' CONTEXT_CHUNK T9 _IPT_TRACE_EVENT_DATA � uint32x2x4_t % N9 PETW_TP_EVENT_TIMER_EXPIRATION % _WIM_PROVIDER_INTEGRITY_STATUS & K9 _PROCESS_MEMORY_EXHAUSTION_INFO G9 FILE_MAILSLOT_PEEK_BUFFER C9 RPC_SECURITY_QOS_V5_W <9 COVERAGE_MODULE_REQUEST 69 tagACTCTXW 29 CONTEXT % LDR_RELOCATE_IMAGE_RETURN_TYPE .9 PHSM_OPCODE 4 -9 PSYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT ,9 LPMOUSEMOVEPOINT tagICONMETRICSA ! *9 ETW_HEAP_EVENT_CONTRACTION + &9 _EVENT_TRACE_PROFILE_ADD_INFORMATION #9 RTL_AVL_COMPARE_ROUTINE t$ RTL_SPARSE_BITMAP_RUN " OPERATION_ID " PEMRPAINTRGN A tagRAWINPUTDEVICE % � FILE_REPARSE_POINT_INFORMATION 9 PCOMBOBOXINFO 9 PAGE_PRIORITY_INFORMATION # 9 SYSTEM_BOOT_LOGO_INFORMATION 9 _EISA_PORT_CONFIGURATION ! 9 PLUID_AND_ATTRIBUTES_ARRAY (
9 PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES �# PLUGPLAY_EVENT_CATEGORY p' CRITICAL_SECTION 9 WMI_PUSHLOCK � SYSTEM_DEVICE_INFORMATION $ W/ LDR_DLL_NOTIFICATION_FUNCTION 4 PREFIX_TABLE 9 tagRAWHID . �8 PETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT �8 PETW_HEAP_EVENT_RUNDOWN $ c0 _FILE_SFIO_VOLUME_INFORMATION �8 NPWNDCLASS ," POWER_STATE - RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS ; �3 _PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION � CSV_CONTROL_PARAM ! �8 SYSTEM_PROCESS_INFORMATION Q' EMRSTRETCHDIBITS j WMI_POWER_RECORD ` poly8x16x2_t 3 ) _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE ! �) SYSTEM_CONSOLE_INFORMATION 6 �8 _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY # �8 PMEMORY_WORKING_SET_EX_BLOCK & �- _MM_ETW_WORKING_SET_PFN_RUNDOWN �8 POINTFLOAT �8 LDR_DATA_TABLE_ENTRY �8 PHARDWARE_COUNTER_DATA �8 PFILE_ACCESS_INFORMATION �8 EMRSTRETCHBLT + �8 RPC_INTERFACE_GROUP_IDLE_CALLBACK_FN % @ _EVENT_TRACE_INFORMATION_CLASS / �8 EVENT_TRACE_SESSION_SECURITY_INFORMATION ) [ LDR_DLL_UNLOADED_NOTIFICATION_DATA �8 NTFS_STATISTICS_EX .2 _locale_tstruct ) �8 _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT + s* _FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT ' �8 MEMORY_ENCLAVE_IMAGE_INFORMATION D �8 PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED & �8 RTLWOW64_CROSSPROCESS_WORK_ITEM
�. _RECTL 2 �8 PMEMORY_PARTITION_CONFIGURATION_INFORMATION �4 DRAWTEXTPARAMS PEXCEPTION_POINTERS * 8 PSYSTEM_LOW_PRIORITY_IO_INFORMATION |8 _ETW_PRIORITY_EVENT D6 EMRSELECTOBJECT v8 _RPC_SECURITY_QOS t errcode �/ IMPORT_OBJECT_NAME_TYPE ! � _LDR_DLL_NOTIFICATION_DATA & s8 _WOW64_ARCHITECTURE_INFORMATION 3 j8 PCACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 g8 tagALTTABINFO % a8 PWMI_DISKIO_IO_REDIRECTED_INIT \8 LPSOUNDSENTRYW ,1 _WMI_IMAGEID_INFORMATION - Y8 STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER ' �( _SYSTEM_SPECIAL_POOL_INFORMATION U8 _DISCDLGSTRUCTW C8 PIMAGE_AUX_SYMBOL_EX # tagEVENTMSG & =8 _SYSTEM_LEAP_SECOND_INFORMATION " �, KEY_HANDLE_TAGS_INFORMATION Z* LPPOLYTEXTA 98 WINDOW_BUFFER_SIZE_RECORD 38 PSYSTEM_POWER_LEVEL �! EMRBEGINPATH 18 _RPC_SYNTAX_IDENTIFIER ,8 PFILE_NOTIFY_INFORMATION 0 �3 _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS 1 )8 ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 LPFXPT2DOT30 � PTEB_ACTIVE_FRAME ) �4 TXFS_LIST_TRANSACTION_LOCKED_FILES %8 _ENCLAVE_INIT_INFO_SGX 5 SERVICE_NOTIFY_1 8 PIMAGE_DYNAMIC_RELOCATION $ � _DELETE_STORAGE_RESERVE_INPUT 8 PHELPWININFOA 8 _SYSDBG_LIVEDUMP_CONTROL 8 ARM64_FNPDATA_CR 8 EISA_IRQ_DESCRIPTOR ( 8 PPERFINFO_DPC_ENQUEUE_INFORMATION " 8 PPROC_THREAD_ATTRIBUTE_LIST ! 8 PERFINFO_PROCESS_PERFCTR32 �6 _IMAGE_OPTIONAL_HEADER 8 PKEY_BASIC_INFORMATION �) PMEASUREITEMSTRUCT & j. CRITICAL_PROCESS_EXCEPTION_DATA 8 TIMERPROC �7 _EVENT_TRACE_PROPERTIES FCHAR �7 _THREAD_TEB_INFORMATION + �7 PSYSTEM_ACTIVITY_MODERATION_APP_TYPE �7 PMUISTRINGPOOL �7 PTEXTMETRIC 5 �7 _PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY �7 _PS_SYSTEM_DLL_INIT_BLOCK % �7 PPO_HIBER_FORCE_DISABLE_REASON ' �7 SYSDBG_LIVEDUMP_CONTROL_ADDPAGES �7 PPORT_DATA_INFORMATION �7 PWMIREGGUIDW �7 tagWNODE_METHOD_ITEM �7 PPS_MEMORY_RESERVE �7 HWINSTA__ �7 PMENU_EVENT_RECORD ! �7 PPERFINFO_CC_FLUSH_SECTION � _CSV_CONTROL_OP �) LPSTYLEBUFA ) Z PERFINFO_BOOT_PREFETCH_INFORMATION - FILE_LINKS_INFORMATION �7 _UNICODE_PREFIX_TABLE ~ EMRPOLYPOLYLINE16 ' �1 RPC_HTTP_TRANSPORT_CREDENTIALS_W #1 POWER_STATE_DISABLED_TYPE �7 _TIME_FIELDS �7 ETW_POOL_EVENT �7 ETW_COVERAGE_SAMPLER_DATA �7 POWER_SESSION_RIT_STATE
�7 EMR �7 _RTL_RXACT_LOG �3 PFULL_PTR_XLAT_TABLES % Z USER_MARSHAL_ROUTINE_QUADRUPLE �3 LOGFONT �7 PIMECHARPOSITION " h) SECURITY_QUALITY_OF_SERVICE �7 PPPM_WMI_IDLE_STATE � _SERVICE_TABLE_ENTRYW " �7 PERFINFO_MEMORY_INFORMATION > �7 _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION �7 RTL_TRACE_HASH_FUNCTION # �7 OBJECT_DIRECTORY_INFORMATION
r ABC �7 MONITORINFO �7 PWNF_USER_SUBSCRIPTION 4 ~7 _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION {7 PHANDEDNESS * +& _WIM_PROVIDER_SUSPEND_OVERLAY_INPUT p! STARTUPINFOEXW v7 _FILE_ID_EXTD_DIR_INFO FXPT16DOT16 $ r7 WMI_JOB_SET_QUERY_INFORMATION PRTL_REFERENCE_COUNT ) o7 PIMAGE_IA64_RUNTIME_FUNCTION_ENTRY # � _PERFINFO_CC_LAZY_WRITE_SCAN m7 PORT_DATA_INFORMATION g7 TTPOLYCURVE `7 PHEAP_EVENT_RANGE ( _7 PPERFINFO_KERNELMEMORY_USAGE_TYPE ' 7! LDR_DLL_LOADED_NOTIFICATION_DATA 2 [7 PFILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX " � _SYSTEM_MEMORY_LIST_COMMAND - X7 _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES �$ REG_ACTION T7 EXTLOGFONTA MENUTEMPLATEA �* CODEPAGE_ENUMPROCW $ _KSYSTEM_TIME 2 tagEMRSETMAPPERFLAGS Q7 LPMENUITEMINFOA (4 SC_ENUM_TYPE P7 PSID_AND_ATTRIBUTES � WELL_KNOWN_SID_TYPE �1 FILE_LEVEL_TRIM_RANGE l0 tagANIMATIONINFO " L7 LPQUERY_SERVICE_LOCK_STATUS I7 QUOTA_LIMITS # F7 PKEY_VALUE_LAYER_INFORMATION , PLUGPLAY_CONTROL_TARGET_RELATION_DATA � _TOKEN_MANDATORY_POLICY � MINIMIZEDMETRICS % B7 PRPC_BINDING_HANDLE_OPTIONS_V1 ?7 _FPO_DATA - 67 PSYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT 57 PNDR_CORRELATION_INFO # �4 _PROCESS_SESSION_INFORMATION 37 WX86TIB �! HIGHCONTRASTA .7 FULL_PTR_XLAT_TABLES @2 tagEMRELLIPSE )7 PIMAGE_TLS_DIRECTORY $ %7 PFILE_FS_OBJECTID_INFORMATION "7 MUILANGLISTNODE 7 PWNDCLASS 7 PWOW64_CPUAREA_INFO � KSPIN_LOCK_QUEUE_NUMBER 6 7 JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V1 , 7 _PROCESS_STACK_ALLOCATION_INFORMATION 7 PFILE_LEVEL_TRIM # 7 _KEY_VALUE_BASIC_INFORMATION ! J RTL_HEAP_MEMORY_LIMIT_INFO 7 _LOGICAL_DISK_DEFRAG . `, FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT 7 EMRSETPIXELV , 7 PFILE_IOSTATUSBLOCK_RANGE_INFORMATION p NPABC ) H# _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER �6 _RPC_SECURITY_QOS_V3_A . �6 SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION �' _USER_MARSHAL_CB_TYPE �6 HARDWARE_COUNTER % �6 _VIRTUAL_STORAGE_BEHAVIOR_CODE �6 PFE_EXPORT_FUNC � AXISINFOW {. PSFEATURE_CUSTPAPER � _LOGICAL_DISK_EXTENTS ) �$ _MEMORY_RESOURCE_NOTIFICATION_TYPE q PWSTR �6 PTOKEN_SOURCE �6 USN_RECORD_V2 �6 PO_FIXED_WAKE_SOURCE_TYPE ' �6 PETW_PARTITION_INFO_EXTENSION_V2 �6 PKSPIN_LOCK_QUEUE + �6 PSYSTEM_ELAM_CERTIFICATE_INFORMATION �$ WMI_DELAY_EXECUTION # tagINPUT __time64_t �6 PROCESS_ACCESS_TOKEN � PS_CREATE_STATE �6 LPMEMORYSTATUS - �6 DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS �6 PSD_ENUM_SDS_OUTPUT - �6 PHEAP_PERFORMANCE_COUNTERS_INFORMATION �6 PWMI_DPI_RECORD �6 _SCRUB_DATA_INPUT �6 _SECTIONBASICINFO �6 WINSTAENUMPROC u% WNDCLASSEX ! �6 PRETRIEVAL_POINTERS_BUFFER �6 NEARPROC �6 _POWER_SESSION_WINLOGON �6 KEY_PID_ARRAY - �6 _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA + �6 PSYSTEM_DMA_GUARD_POLICY_INFORMATION �6 LPNETRESOURCEW �6 PHOT_PATCH_IMAGE_INFO �4 HKL__ * �6 PPERFINFO_PO_NOTIFY_DEVICE_COMPLETE �6 PPERFINFO_VTL_CHANGE �6 SYSTEM_PREFETCH_STATS , g5 PEVENT_TRACE_PEBS_TRACING_INFORMATION �6 PIMAGE_OPTIONAL_HEADER32 ) r/ PROCESS_SYSTEM_RESOURCE_MANAGEMENT �2 TP_ALPC ~6 PWINDOWS_OS_OPTIONS ) o _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR z6 LPCBTACTIVATESTRUCT �! tagHIGHCONTRASTA
u UINT32 ! � _EVENT_TRACE_PROPERTIES_V2 ' x6 PTHREAD_LAST_SYSCALL_INFORMATION v6 _PROCESSOR_POWER_POLICY " PACCESS_MASK * o6 _SYSTEM_SESSION_POOLTAG_INFORMATION k6 PIRQ_DEVICE_POLICY �/ OSVERSIONINFOW <% _IDL_CS_CONVERT �! _PERFINFO_FILE_DIRENUM g6 PCONTEXT_EX % 8 _ETW_CREATEDELETE_OBJECT_EVENT ( d6 _PROCESS_HANDLE_TRACING_ENABLE_EX � CANDIDATEFORM ) y) EVENT_TRACE_TAG_FILTER_INFORMATION % `2 PROCESS_MITIGATION_ASLR_POLICY ( V+ SYSTEM_FEATURE_CONFIGURATION_TYPE g ENHMETAHEADER , ^6 PEVENT_TRACE_TIME_PROFILE_INFORMATION Y6 PIO_SESSION_STATE W6 HDC__ Q6 _EXCEPTION_DEBUG_INFO M6 WINDOWPLACEMENT I6 _EVENT_BASIC_INFORMATION F6 NPTEXTMETRICW B6 PEMRDELETEOBJECT * @6 PSYSTEM_PLATFORM_BINARY_INFORMATION = MM_ETW_WORKING_SET_TYPE �0 EMRCREATEMONOBRUSH ( >6 _LEARNING_MODE_OBJECT_INFORMATION $ � _SharedVirtualDiskSupportType 66 PPPM_WMI_PERF_STATES " 16 LPEVENTLOG_FULL_INFORMATION �, _RGNDATA $ � _GENERIC_BINDING_ROUTINE_PAIR �* LPEXTLOGPEN32 L AXESLIST .6 TITLEBARINFO �3 LOGFONTA % *6 DISPLAYCONFIG_PATH_SOURCE_INFO ' � _PS_MITIGATION_AUDIT_OPTIONS_MAP . _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION ! UMS_THREAD_INFO_CLASS * _NT_TIB64 �1 KEY_FLAGS_INFORMATION !6 PMESSAGE_TRACE_USER 6 FILE_OBJECTID_BUFFER . 6 PJOURNAL_SET_KEY_USER_FLAGS_INFORMATION 6 _MUILANGCFGLIST 6 PFILE_NAMES_INFORMATION
6 PFILE_RENAME_INFORMATION # o FILE_PIPE_REMOTE_INFORMATION 6 PEXFAT_STATISTICS 6 HEAP_INFORMATION tagRAWINPUT 6 _SCRUB_PARITY_EXTENT_DATA �. RECTL ' y _THREAD_LAST_SYSCALL_INFORMATION ! �5 _DUPLICATE_EXTENTS_DATA_EX �5 LPCURSORSHAPE �5 PSC_EVENT_TYPE �5 PAPCFUNC �5 LPCLSID ! � _SYSTEM_DEVICE_INFORMATION � tagEMRGDICOMMENT @2 EMRELLIPSE �5 PWMI_PNP_RECORD_V4 # �) _WMI_IMAGELOAD_INFORMATION64 % �5 PETW_TP_EVENT_CALLBACK_DEQUEUE
t PINT32 + �" IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY * �5 PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA $ �1 _SYSTEM_HIBERFILE_INFORMATION $ �5 ETW_CLOCK_CONFIGURATION_EVENT � OVERLAPPED_ENTRY * �5 PPERFINFO_EXECUTIVE_RESOURCE_CONFIG �5 PCWNF_STATE_NAME . �5 PSYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 [ PHANDLE & �5 WMI_EXTENDED_THREAD_INFORMATION �5 _CI_LOG_SCHEDULER_SLEEP ' �5 PETW_COVERAGE_SAMPLER_BLOOM_INFO PS_PROTECTION �5 HSYNTHETICPOINTERDEVICE__ $ @4 _IMAGE_RUNTIME_FUNCTION_ENTRY $ �5 _QUERY_STORAGE_RESERVE_OUTPUT ) �5 SYSTEM_EXTENDED_THREAD_INFORMATION �5 PENUMLOGFONTEXDV * �3 KNONVOLATILE_CONTEXT_POINTERS_ARM64 # �5 TRANSACTION_BIND_INFORMATION GLOBALHANDLE " EMRINVERTRGN # N, PERFINFO_PAGE_RANGE_IDENTITY $ �5 PFILE_COMPRESSION_INFORMATION $ �5 PFILE_ID_BOTH_DIR_INFORMATION �5 SYSTEM_NUMA_INFORMATION % �5 PKEY_CONTROL_FLAGS_INFORMATION @ �5 PCACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA ) �5 USER_MARSHAL_UNMARSHALLING_ROUTINE �5 PPERFINFO_MEM_RESET_INFO �5 PTOKEN_USER_CLAIMS FIRMWARE_TYPE * �5 PKEY_SET_VIRTUALIZATION_INFORMATION �% EMRSCALEWINDOWEXTEX �5 PIMAGE_THUNK_DATA ( ~5 _LOOKUP_STREAM_FROM_CLUSTER_INPUT * �* _TRANSACTION_PROPERTIES_INFORMATION 6 � RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY x5 PCOMPAREITEMSTRUCT u5 tagMSGBOXPARAMSW ) q5 SYSTEM_KERNEL_DEBUGGER_INFORMATION . m5 _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION ! � FILE_IO_PRIORITY_HINT_INFO - g5 PEVENT_TRACE_PROFILE_EVENT_INFORMATION $ d5 _SECURITY_DESCRIPTOR_RELATIVE : & _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION a5 PFILE_STANDARD_INFO " ]5 PCONTAINER_ROOT_INFO_OUTPUT ! W5 PEISA_MEMORY_CONFIGURATION V5 PVALENTA � _SE_VALIDATE_MAPPING_TYPE , �$ DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY �- LPNONCLIENTMETRICSW � LUNICODE_STRING $ �2 THREAD_CYCLE_TIME_INFORMATION U5 PCOVERAGE_REQUEST_CODES Q5 CALINFO_ENUMPROCEXA " N5 PPROCESSOR_PERFSTATE_POLICY ) L5 _SYSTEM_POWER_STATE_DISABLE_REASON ! C5 LPCREATE_THREAD_DEBUG_INFO 3 MOFRESOURCEINFO � HARDWARE_COUNTER_TYPE @5 MSLLHOOKSTRUCT * <5 _FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER 45 PRTL_PROCESS_LOCKS " 25 USER_MARSHAL_SIZING_ROUTINE * PLUGPLAY_CONTROL_USER_RESPONSE_DATA .5 PPROCESSOR_RECORD # +5 _RTL_USER_PROCESS_PARAMETERS &5 HARDERROR_MSG �$ _RTL_RXACT_OPERATION 5 NPWNDCLASSEXW ! 5 PPROCESS_MITIGATION_POLICY 5 LPWNDCLASSA 5 _SERVICE_NOTIFY_1 8 5 PPROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY ' � _FILE_CASE_SENSITIVE_INFORMATION *
5 _TRANSACTIONMANAGER_LOG_INFORMATION � DEVMODEA $ 5 _SERVERSILO_BASIC_INFORMATION � SYSTEM_POOLTAG 5 _WNF_TYPE_ID 0 �4 _SYSTEM_VERIFIER_CANCELLATION_INFORMATION " �4 CM_FULL_RESOURCE_DESCRIPTOR �4 LPMENUITEMINFO * �4 _TXFS_LIST_TRANSACTION_LOCKED_FILES �4 tagBITMAPFILEHEADER �4 _ETW_CREATE_HANDLE_EVENT # � ETW_HEAP_EVENT_RUNDOWN_RANGE �4 PTOKEN_GROUPS �4 _GENERATE_NAME_CONTEXT % �4 _FILE_MAILSLOT_SET_INFORMATION �4 HBITMAP �4 LPDRAWTEXTPARAMS � IMAGE_ROM_OPTIONAL_HEADER 1 �4 PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY & �4 _SYSTEM_DEVICE_DATA_INFORMATION 0 �4 PRTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY * MAT2 & DLGTEMPLATE �4 LPHKL �" REGISTERWORD � NDR_RUNDOWN 5 tagACCEL ) ' _PERFINFO_DRIVER_COMPLETIONROUTINE � _KSPIN_LOCK_QUEUE
�4 TP_JOB �4 PRTL_BARRIER * �4 PMANAGE_WRITES_TO_EXECUTABLE_MEMORY �4 PICONINFOEX ( �4 PRPC_HTTP_TRANSPORT_CREDENTIALS_A �4 CS_TYPE_NET_SIZE_ROUTINE �4 VIRTUALIZATION_RECORD ' �4 PETW_TRACE_PARTITION_INFORMATION PMIDL_STUB_MESSAGE ! �4 _HEAP_EXTENDED_INFORMATION � _FILE_COMPRESSION_INFO * �4 RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A �4 PETW_OPTICALIO_READWRITE PERFINFO_VTL_CHANGE $ �4 ETW_LAST_DROPPED_EVENT_STRUCT ( � _RTL_IMAGE_MITIGATION_ASLR_POLICY �# CONDITION_VARIABLE - 9" _WMI_JOB_SEND_NOTIFICATION_INFORMATION . �4 PMEMORY_PHYSICAL_CONTIGUITY_INFORMATION �4 PCORRELATION_VECTOR * BITMAPV4HEADER �4 EMRPIXELFORMAT ' �4 PPERFINFO_CC_READ_AHEAD_COMPLETE % �4 PERFINFO_CC_LOGGED_STREAM_INFO � PAINTSTRUCT �4 IMAGE_BOUND_FORWARDER_REF " �4 PROCESS_SESSION_INFORMATION �4 _EVENT_FILTER_EVENT_NAME � _PS_PROTECTED_SIGNER |4 FILE_TRACKING_INFORMATION ' y4 PCI_WINDOWS_LOCKDOWN_RESTRICTION 5 DEBUG_CONTROL_SPACE_ITEM + t4 PREFS_DEALLOCATE_RANGES_INPUT_BUFFER � CLSID C# _MONITOR_DISPLAY_STATE ! q4 _PERFINFO_CC_FLUSH_SECTION # n4 PPERFINFO_DEBUG_EVENT_REASON
TUCHAR m4 PSE_ACCESS_REQUEST � LPTITLEBARINFOEX & k4 PERFINFO_PO_SESSION_CALLOUT_RET ( g4 _FILE_REMOTE_PROTOCOL_INFORMATION T4 POINTER_TOUCH_INFO ) P4 PERFINFO_EXECUTIVE_RESOURCE_CONFIG * �% _PERFINFO_SYSTEM_MEMORY_INFORMATION J4 PRTL_HEAP_TAG_INFO ; H4 PRTL_QUERY_DEBUG_VIRTUAL_PROCESS_READ_MEMORY_ROUTINE C4 LPTTPOLYGONHEADER ( @4 IMAGE_IA64_RUNTIME_FUNCTION_ENTRY ! <4 ETW_DUPLICATE_HANDLE_EVENT $ 64 PETW_UMS_EVENT_CONTEXT_SWITCH 44 PALPC_TOKEN_ATTR 24 _ENABLE_TRACE_PARAMETERS /4 PRTL_BITMAP ! .4 LPSERVICE_PRESHUTDOWN_INFO & ,4 ETW_TRACE_PARTITION_INFORMATION (4 _SC_ENUM_TYPE * %4 _FSCTL_QUERY_STORAGE_CLASSES_OUTPUT 0 # SYSTEM_FEATURE_CONFIGURATION_CHANGE_STAMP * �/ _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE 4 PPREFIX_TABLE 4 PPATHNAME_BUFFER � SOUNDSENTRYA 4 _SE_AUDIT_INFO ( �, RESOURCEMANAGER_BASIC_INFORMATION 4 HSPRITE * _PROFILE_SOURCE_INFO # # _HEAP_AFINITY_MANAGER_ENABLE
4 PHANDLER_ROUTINE ! 4 PHEAP_AFFINITY_SLOT_ASSIGN 4 _MIDL_STUB_MESSAGE + �3 _KNONVOLATILE_CONTEXT_POINTERS_ARM64 ; �3 PPROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION ( �3 PFILE_FS_FULL_SIZE_INFORMATION_EX � IO_COUNTERS v SERVERSILO_STATE � KINTERRUPT_ROUTINE - �3 _TOKEN_SECURITY_ATTRIBUTES_INFORMATION $ �3 _DEFINE_STORAGE_RESERVE_INPUT �3 PIO_ERROR_LOG_MESSAGE " �3 PIMAGE_DYNAMIC_RELOCATION32 0 �3 PSYSTEM_ACTIVITY_MODERATION_USER_SETTINGS �3 PRTL_SRWLOCK uint16x4x2_t % r, FILE_ATTRIBUTE_TAG_INFORMATION �3 FILE_REGION_OUTPUT G" _CM_VIDEO_DEVICE_DATA �3 PPLUGPLAY_EVENT_CATEGORY �3 LPLOGFONT �3 tagEMRFRAMERGN �3 PCM_PERF_COUNTERS �3 _MEMORY_SCRUB_INFORMATION �3 PFIBER_START_ROUTINE �3 tagRGBTRIPLE �3 PCUCSCHAR �3 IMAGE_AUX_SYMBOL ( t3 _GET_FILTER_FILE_IDENTIFIER_INPUT � tagMENUITEMINFOA p3 _RPC_PROTSEQ_ENDPOINT �. LPMOUSEINPUT " FILE_PIPE_LOCAL_INFORMATION { FILE_GET_EA_INFORMATION ) m3 _FILE_IO_PRIORITY_HINT_INFORMATION & i3 REDIRECTION_FUNCTION_DESCRIPTOR ( g3 PRPC_BINDING_HANDLE_SECURITY_V1_W f3 PCZPCSTR c3 _FINDEX_SEARCH_OPS `3 KLDR_DATA_TABLE_ENTRY64 \3 EISA_IRQ_CONFIGURATION V3 PACL " T3 DUPLICATE_EXTENTS_DATA_EX32 Q3 PROPENUMPROCEXW M3 SYSTEM_ALARM_ACE G3 PREAD_USN_JOURNAL_DATA_V0 / E3 PSYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION t CM_RESOURCE_TYPE , D3 PPERFINFO_YIELD_PROCESSOR_INFORMATION ! @3 PSYSTEM_MEMORY_INFORMATION % =3 DISPLAYCONFIG_PATH_TARGET_INFO
" REGSAM . 33 _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER -3 PFILE_STREAM_INFO (3 PWMIREGGUID # uintptr_t ` float32x4x2_t
, _MODEMSETTINGS &3 PPOWER_PLATFORM_ROLE . $3 _FSCTL_GET_INTEGRITY_INFORMATION_BUFFER + 3 _SYSTEM_KERNEL_VA_SHADOW_INFORMATION �- DEVICE_FLAGS 3 PMOFRESOURCEINFO & u RTL_FEATURE_CONFIGURATION_TABLE 3 METAHEADER 3 tagEMRCREATECOLORSPACE 3 CM_COMPONENT_INFORMATION �2 LPCBT_CREATEWNDW ) �2 PFINDFIRSTACTIVATIONCONTEXTSECTION �2 PDISPLAY_DEVICEA q RPC_WSTR �2 PETW_HEAP_EVENT_ALLOC � IMAGE_NT_HEADERS64 �2 PLDR_DATA_TABLE_ENTRY64 �2 PMSG * �2 PFILE_INITIATE_REPAIR_OUTPUT_BUFFER �2 DMA_CONFIGURATION_BYTE1 $ �2 PEVENT_TRACE_BUFFER_CALLBACKA % �2 _THREAD_CYCLE_TIME_INFORMATION r) _TIMER_BASIC_INFORMATION $ �2 _CM_EISA_FUNCTION_INFORMATION �2 PMUICCHEADER �2 PCREDIRECTION_DESCRIPTOR �2 FILE_STANDARD_INFORMATION �. _SI_COPYFILE # CLSN �2 PSID_NAME_USE " �2 _SYSTEM_ERROR_PORT_TIMEOUTS d& WNDCLASSW
q LPWSTR �' FILE_ID_TYPE
�2 CIEXYZ �0 PAXISINFOW # �2 PCONSOLE_READCONSOLE_CONTROL �2 HEAP_RANGE_CREATE �2 CI_LOG_MMCSS_STOP * �2 CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE �2 RETRIEVAL_POINTERS_BUFFER �2 PTP_ALPC_CALLBACK �2 PRTLP_HEAP_TAGGING_INFO �2 PHEAP_RANGE_LOG $ _TOKEN_DEFAULT_DACL ! �2 PWMI_DISKIO_READWRITE_INIT v _PLEX_READ_DATA_REQUEST �2 PWNODE_SINGLE_ITEM �! WMI_JOB_INFORMATION �2 PQUERYACTCTXW_FUNC & � _ETW_THREAD_EVENT_SUBPROCESSTAG # UINT_PTR �2 PCCH 4 �2 PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION ' �2 PSYSTEM_MEMORY_USAGE_INFORMATION ) }2 SECTION_INTERNAL_IMAGE_INFORMATION q2 LPOUTLINETEXTMETRIC / p2 PJOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 l2 PCACHE_DESCRIPTOR j2 PJOB_SET_ARRAY & c2 PETW_WNF_EVENT_NAME_SUB_RUNDOWN & Y2 PPROCESS_MITIGATION_ASLR_POLICY
U2 PFP_80 ! R2 _SHRINK_VOLUME_INFORMATION ( K2 _SYSTEM_CODEINTEGRITY_INFORMATION H2 PCIMAGE_THUNK_DATA �& _RTL_HANDLE_TABLE_ENTRY �/ _IMAGE_LINENUMBER BOOT_ENTROPY_SOURCE_ID F2 LPOSVERSIONINFO f POINTER_TYPE_INFO ` poly16x8x2_t B2 LPLOGCOLORSPACEW @2 EMRRECTANGLE " <2 _PERFINFO_IDLE_STATE_CHANGE 62 PDISPATCHER_CONTEXT � SYSTEM_POWER_POLICY " OBJECT_ATTRIBUTES32 42 PROCESS_TLS_INFORMATION _FP_IEEE_OPERATION_CODE .2 localeinfo_struct '2 _WINDOWS_OS_OPTIONS #2 WMI_JOB_REMOVE_PROCESS 2 _IMAGE_ENCLAVE_CONFIG32 2 DLGITEMTEMPLATE 2 EXIT_THREAD_DEBUG_INFO � _PNP_VETO_TYPE $ Z _RTL_WORK_ON_BEHALF_TICKET_EX � GLYPHSET 2 PGLYPHMETRICSFLOAT & Z PERFINFO_FILEOBJECT_INFORMATION 2 _PERFINFO_CC_READ_AHEAD 2 PTP_POOL 2 PEMRSETMAPPERFLAGS p SERVICE_FAILURE_ACTIONSA 2 tagSTYLEBUFW ( �1 _RPC_HTTP_TRANSPORT_CREDENTIALS_W �1 IMAGE_ENCLAVE_CONFIG �1 _FILE_LEVEL_TRIM_RANGE u SYSTEM_FEATURE_ID �1 LPSTICKYKEYS �( TRACE_GUID_REGISTRATION �1 PUNICODE_STRING32 $ � PROCESS_DEVICEMAP_INFORMATION * �1 _FILE_VALID_DATA_LENGTH_INFORMATION �1 RTL_BACKOFF ' �1 PRTLP_PROCESS_REFLECTION_CONTEXT H _UNIVERSAL_NAME_INFOA " ! SECURITY_DESCRIPTOR_CONTROL �1 ENHMETARECORD " �1 _FSCTL_OFFLOAD_WRITE_OUTPUT
LPVOID �1 HARDWAREINPUT
�1 PVALUE l/ RPC_SECURITY_QOS_V4_W H/ PRPC_INTERFACE_GROUP ) �1 PRTL_PROCESS_MODULE_INFORMATION_EX �1 EXCEPTION_RECORD64 �1 PMINMAXINFO �1 HIMCC__ �1 LPWIN32_STREAM_ID # �1 PWMI_IMAGELOAD_INFORMATION32 * �1 PPROCESS_COMMIT_RELEASE_INFORMATION �1 _FILEOFFSET_INFORMATION �1 _KEY_FLAGS_INFORMATION �+ IMAGE_BASE_RELOCATION �1 PWTSSESSION_NOTIFICATION $ �1 PSYSTEM_CALL_TIME_INFORMATION �1 ETW_STACK_CACHING_CONFIG % �1 PFILE_FS_DATA_COPY_INFORMATION ' �- FILE_NOTIFY_EXTENDED_INFORMATION �1 USN_TRACK_MODIFIED_RANGES �1 _DMA_CONFIGURATION_BYTE0 � GUID �1 tagRAWKEYBOARD �1 _IELF_HANDLE NTSTATUS $ �1 PSYSTEM_HIBERFILE_INFORMATION * � _CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG A RAWINPUTDEVICE �1 PCOLORADJUSTMENT ~1 LPREGISTERWORD , z1 PTRANSACTIONMANAGER_BASIC_INFORMATION � RPC_SECURITY_CALLBACK_FN x1 PSTACK_WALK_EVENT_DATA q LPWCH v1 PERFINFO_PROCESS_INSWAP
s1 LPCTCH o1 _SERVICE_TRIGGER ' h1 PPERFINFO_PMC_SAMPLE_INFORMATION * e1 PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO " Y1 PPROCESS_WINDOW_INFORMATION p0 JOBOBJECT_WAKE_FILTER T1 PSYSTEM_FLUSH_INFORMATION # Q1 _RTL_SEGMENT_HEAP_PARAMETERS E1 PRPC_INTERFACE_TEMPLATEW ?1 PIMAGE_OPTIONAL_HEADER poly8_t C FILE_ACCESS_INFORMATION =1 _ENCLAVE_CREATE_INFO_VBS - 71 PTRANSACTIONMANAGER_OLDEST_INFORMATION 51 I_RpcProxyFilterIfFn 1 01 _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION - #- RESOURCEMANAGER_COMPLETION_INFORMATION ,1 WMI_IMAGEID_INFORMATION & )1 PPERFINFO_PPM_PERF_STATE_CHANGE % �# _QUERY_FILE_LAYOUT_FILTER_TYPE + _ _FILE_STORAGE_RESERVE_ID_INFORMATION '1 _ETW_TP_EVENT_POOL_CLOSE / h- JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION ( 1 _WORKER_FACTORY_BASIC_INFORMATION ( 1 FINDFIRSTACTIVATIONCONTEXTSECTION 1 tagEMRSETWORLDTRANSFORM 1 _IMAGE_FILE_HEADER � _SILO_USER_SHARED_DATA 1 PEFI_DRIVER_ENTRY * 1 TRANSACTION_ENLISTMENTS_INFORMATION 1 RTL_TREE_WALK_FUNCTION � LPTRIVERTEX ( 1 TXFS_ROLLFORWARD_REDO_INFORMATION + 1 PSYSTEM_WRITE_CONSTRAINT_INFORMATION �0 PPROCESS_HEAP_ENTRY $ �& _HEAP_BLOCK_EXTRA_INFORMATION �0 PPERFINFO_CCSWAP_LITE " �0 PLPC_UNREGISTER_PROCESS_MSG 4 �0 _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION � poly16x4x4_t - RTL_OSVERSIONINFOEX2W �$ RTL_DISK_SPEED_INFO �0 LPAXISINFOW �0 PEMRCREATEMONOBRUSH �$ _RTL_DISK_SPACE_INFO �0 NONCLIENTMETRICSA ' �0 PPERFINFO_SAMPLED_PROFILE_CONFIG �0 POBJECT_TYPE_LIST - �0 PROCESS_MITIGATION_FONT_DISABLE_POLICY & �0 PLUGPLAY_CONTROL_CONFLICT_ENTRY �0 _RTL_STACK_CONTEXT ' �0 SYSTEM_AUDIT_CALLBACK_OBJECT_ACE / ? SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION �0 KCRM_TRANSACTION_BLOB �0 _GHOSTED_FILE_EXTENT �0 HMENU
�0 LPRECT �$ int8x16x4_t �0 MUILANGUAGES �0 PICONMETRICSA �0 LPSCROLLBARINFO �0 PWX86THREAD % �0 SYSTEM_PAGEFILE_INFORMATION_EX & �0 BOOT_ENTROPY_SOURCE_RESULT_CODE �0 PRTL_LFG_RNG_STATE , �0 _PERFINFO_YIELD_PROCESSOR_INFORMATION # �0 ETW_TP_EVENT_POOL_TH_MIN_SET ' + FILE_FS_VOLUME_FLAGS_INFORMATION ! �0 PREFS_SMR_VOLUME_GC_ACTION 1 � _EVENT_TRACE_LBR_CONFIGURATION_INFORMATION # �0 KEY_OPEN_SUBKEYS_INFORMATION � TP_CALLBACK_ENVIRON_V3 | LPWIN32_FIND_DATAW 0 tagENUMLOGFONTEXDVW # x0 PETW_COVERAGE_SAMPLER_MODULE u0 _EXCEPTION_POINTERS & _PROCESS_MEMORY_ALLOCATION_MODE n0 PJOBOBJECT_WAKE_FILTER j0 LPANIMATIONINFO ! g0 tagPOINTER_DEVICE_PROPERTY $ a0 PFILE_SFIO_VOLUME_INFORMATION % _0 PSYSTEM_FIRMWARE_TABLE_HANDLER X0 PGDI_TEB_BATCH T0 PVARIABLE_NAME �. _PHYSICAL_CHANNEL_RUN 8 N0 PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION $ K0 PQUERY_BAD_RANGES_INPUT_RANGE J0 LPDOCINFO F0 PTOKEN_SID_INFORMATION & C0 TOKEN_BNO_ISOLATION_INFORMATION + @0 PPROCESS_HANDLE_SNAPSHOT_INFORMATION * <0 PSET_DAX_ALLOC_ALIGNMENT_HINT_INPUT :0 PSERVICE_NOTIFYW ' 80 _FILE_FS_SECTOR_SIZE_INFORMATION ' 50 PAPPLICATIONLAUNCH_SETTING_VALUE 0 � _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY �( PMINIMIZEDMETRICS # 40 PREQUEST_OPLOCK_INPUT_BUFFER ) � SYSTEM_PHYSICAL_MEMORY_INFORMATION 2 QUERY_SERVICE_CONFIGA 30 PETW_SET_TIMER_EVENT # �* _SECTION_IMAGE_INFORMATION32 /0 NCCALCSIZE_PARAMS % '0 PIMAGE_LOAD_CONFIG_DIRECTORY32 $0 PIXELFORMATDESCRIPTOR !0 FONTENUMPROCA 0 EMRSELECTPALETTE ' 0 PEVENT_TRACE_VERSION_INFORMATION 0 PFILE_PREFETCH_EX + 0 DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER %
0 PERFINFO_SET_DEVICES_STATE_RET $ 0 PRTL_DYNAMIC_HASH_TABLE_ENTRY 0 HSPRITE__ � PUOW � NUMBERFMT % �/ _FILE_SFIO_RESERVE_INFORMATION % E. _TXFS_WRITE_BACKUP_INFORMATION �/ _CURDIR �/ _PROCESS_ENERGY_VALUES �/ LPPANOSE �/ PIMAGE_LINENUMBER �/ PINITIAL_TEB �/ USN_RECORD_UNION �$ _TOKEN_TYPE �/ LPENUMTEXTMETRICA " �/ _PERFINFO_SET_DEVICES_STATE 1 PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY - LDR_RELEASE_ACT_CTX � RTL_AVL_NODE
~, POINTL # / SYSTEM_FIRMWARE_TABLE_ACTION & � RTL_SPARSE_BITMAP_CTX_OPERATION �- TPMPARAMS % �% _QUERY_BAD_RANGES_OUTPUT_RANGE �/ tagEMRTRANSPARENTBLT & �/ PETW_AUTOBOOST_NO_ENTRIES_EVENT .' EMRFORMAT ) VRF_TRIAGE_CONTEXT �/ PEMRSETDIBITSTODEVICE - �/ _VIRTUALIZATION_INSTANCE_INFO_INPUT_EX 1 �/ PSYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE �/ PRTL_OSVERSIONINFOW �/ LPUNLOAD_DLL_DEBUG_INFO x int32x4_t �/ PPSFEATURE_CUSTPAPER * �/ DISPLAYCONFIG_TARGET_PREFERRED_MODE ) �/ ACCESS_ALLOWED_CALLBACK_OBJECT_ACE + F EVENT_TRACE_PROFILE_LIST_INFORMATION �/ _SE_SID �/ PWMI_QUEUE �/ _FILE_RENAME_INFORMATION �/ MEMORY_WORKING_SET_BLOCK �/ HHOOK__ EMRPOLYLINETO �/ PERFINFO_TRACE_ENTRY �/ LPWIN32_FIND_DATA " �/ PPERFINFO_MEMORY_NODE_ENTRY PUMS_COMPLETION_LIST ! �/ PROCESSOR_PERFSTATE_POLICY " U# SERVICE_PREFERRED_NODE_INFO �" REGISTERWORDA # x/ PACCESS_ALLOWED_CALLBACK_ACE - v/ JOBOBJECT_CPU_RATE_CONTROL_INFORMATION * r/ _PROCESS_SYSTEM_RESOURCE_MANAGEMENT g/ PRPC_SECURITY_QOS_V4_W d/ MIDL_METHOD_PROPERTY_MAP , ^/ SERVICE_CONTROL_STATUS_REASON_PARAMSA - X/ PRTL_PROCESS_DLL_NOTIFICATION_FUNCTION
p PTCHAR l __C_ASSERT__ U/ _WOW64_CPUAREA_INFO K/ RPC_AUTH_KEY_RETRIEVAL_FN �$ uint8x16x4_t # @# SYSTEM_KERNEL_DEBUGGER_FLAGS F/ _POWER_MONITOR_INVOCATION � uint64x1x3_t % B/ _UMS_SYSTEM_THREAD_INFORMATION :/ PWMI_PROCESS_INFORMATION , � MEMORY_PARTITION_TRANSFER_INFORMATION 8/ PPLUGPLAY_CONTROL_CLASS 6/ _CLASSIC_EVENT_ID �! uint8x16x3_t % 1/ MANAGE_HOT_PATCH_QUERY_PATCHES ) &/ PSYSTEM_PROCESSOR_IDLE_INFORMATION # #/ _WMI_IMAGELOAD_INFORMATION32 3 / _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION / PINIT_ONCE � LARGE_INTEGER ) / _SYSTEM_FIRMWARE_TABLE_INFORMATION + / PSYSTEM_HYPERVISOR_QUERY_INFORMATION ! / PTXFS_START_RM_INFORMATION
/ PEMRGDICOMMENT # / PPERFINFO_FILE_OPERATION_END / PUUCSSTR ( �. PDPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK 8 ARM64_RUNTIME_FUNCTION �. PMAXVERSIONTESTED_INFO �. PREASON_CONTEXT a _RTL_SPLAY_LINKS �. PDEVMODEA 4 �. _FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX $ RTL_RETPOLINE_ROUTINES �. ETW_HEAP_EVENT_REALLOC q PUSHORT
_ACE_HEADER & y- _PLUGPLAY_CONTROL_CONFLICT_LIST 0 �. PACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION �. PMOUSEINPUT + NLSVERSIONINFO �. PPERFINFO_VIRTUAL_ALLOC . �. PPROCESS_DYNAMIC_EH_CONTINUATION_TARGET �. PPHYSICAL_CHANNEL_RUN �. PSI_COPYFILE ) LOGBRUSH �. EMRCREATEBRUSHINDIRECT �. MOVE_FILE_DATA32 �. LPRECTL ! �. _ETW_THREAD_SET_NAME_EVENT �. NTFS_EXTENDED_VOLUME_DATA + �. PFILE_SYSTEM_RECOGNITION_INFORMATION �. PSD_GLOBAL_CHANGE_INPUT �. SERVICE_START_REASON �. HEAP_RANGE_DESTROY �. PTHREAD_NAME_INFORMATION �. _DesiredStorageClass � CM_INT13_DRIVE_PARAMETER ! �. IMAGE_DYNAMIC_RELOCATION32 �. LPOSVERSIONINFOEXA ~# PROCESS_INFORMATION_CLASS �! EMRFLATTENPATH Y ENUMTEXTMETRIC . �. PETW_COVERAGE_SAMPLER_INFORMATION_CLASS � THREAD_WORKLOAD_CLASS �. PRTL_PROCESS_HEAPS �. _ETW_OPTICALIO_READWRITE $ �. _SYSTEM_HANDLE_INFORMATION_EX �. _WNF_STATE_NAME_LIFETIME �. LPCHARSETINFO �. LPLOGBRUSH �. pthreadmbcinfo �. _ALPC_HANDLE_ATTR ' �% ACTIVATION_CONTEXT_ASSEMBLY_DATA ~. GENERIC_BINDING_INFO t INT32 {. _PSFEATURE_CUSTPAPER w. RPC_SECURITY_QOS_V4_A # n. _ETW_OPTICALIO_FLUSH_BUFFERS - �& EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 ' j. _CRITICAL_PROCESS_EXCEPTION_DATA g. PRTL_SPLAY_LINKS f. PREGISTERCLASSNAMEW 6 c. RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY �) NPSTYLEBUFA $ , PERFINFO_DRIVER_MAJORFUNCTION `. PDEBUG_PRINT_CALLBACK ]. PEMRANGLEARC Y. PSD_QUERY_STATS_OUTPUT TP_WAIT_RESULT W. UNLOAD_DLL_DEBUG_INFO " Q. POPERATION_START_PARAMETERS L. POBJECT_BASIC_INFORMATION ) _PS_PROTECTED_TYPE F H. ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING # _OUTLINETEXTMETRICA $ E. TXFS_WRITE_BACKUP_INFORMATION A. RTL_BALANCED_LINKS 8. PCIMAGE_TLS_DIRECTORY " v QUERY_STORAGE_RESERVE_INPUT * 4. SYSTEM_SYSTEM_PARTITION_INFORMATION / 0. _TRANSACTIONMANAGER_RECOVERY_INFORMATION 4 RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY
HANDLE / -. PRTL_READ_MAPPED_MEMORY_EXCEPTION_FILTER ). PFE_IMPORT_FUNC � _TP_TRACE_TYPE &. PSECURITY_ATTRIBUTES # _TRACE_ENABLE_FLAG_EXTENSION p INT8 ". PDEDUP_FILE_OPERATION . HGLRC % . NTFS_FILE_RECORD_OUTPUT_BUFFER . _KEY_BASIC_INFORMATION . VM_COUNTERS_EX %
. PPROCESS_WORKING_SET_OPERATION . HW_PROFILE_INFOA j& LOGCOLORSPACE # U# _SERVICE_PREFERRED_NODE_INFO " . FILE_LINK_ENTRY_INFORMATION �- PPROCESSOR_IDLE_STATES # �& RTL_CRITICAL_SECTION_DEBUG64 �- PNONCLIENTMETRICSW �- STARTING_LCN_INPUT_BUFFER �- PEMRPOLYGON p PZZTSTR & �- PCOVERAGE_UNLOADED_MODULE_ENTRY " �- _QUERY_SERVICE_LOCK_STATUSW # ULONGLONG __n64x2 �- MEMORYSTATUSEX $ �- SYSDBG_LIVEDUMP_CONTROL_FLAGS # �- _PROCESSOR_POWER_POLICY_INFO e, _XSAVE_CET_U_FORMAT � PROCESSOR_GROUP_INFO " �- _MEMORY_COMBINE_INFORMATION �- PDEVICE_FLAGS " LPCOLORREF I CODEPAGE_ENUMPROCA �- PENTER_STATE_HANDLER �- PMIDL_STUBLESS_PROXY_INFO �- PZPWSTR �- PCLUNICODE_STRING __time32_t ( �- PFILE_NOTIFY_EXTENDED_INFORMATION % GRADIENT_RECT �- PQUERY_BAD_RANGES_INPUT & �- PMM_ETW_WORKING_SET_PFN_RUNDOWN ( A( _RPC_BINDING_HANDLE_SECURITY_V1_W � poly16x4x3_t . K FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT 0( POWER_USER_PRESENCE_TYPE �- _SYSTEM_FLAGS_INFORMATION �- PSLIST_ENTRY �- tagTPMPARAMS # �- _RTL_SPARSE_BITMAP_PARAMETER �' _RTL_PROCESS_HEAPS �- WINDOWPOS % G, IMAGE_RESOURCE_DIRECTORY_ENTRY �- MEMORY_RESERVE_TYPE $ �- PO_HIBER_FORCE_DISABLE_REASON 5" DOCINFO - >$ _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 �- tagEMREXTTEXTOUTA �- MOUSEKEYS - _RTL_HEAP_TAG {- PTRACE_ENABLE_CONTEXT_EX ' � _RTL_SPARSE_BITMAP_CTX_OPERATION % y- PLUGPLAY_CONTROL_CONFLICT_LIST ! s- _IMAGE_RESOURCE_DATA_ENTRY \ _STORAGE_RESERVE_ID p- PDMA_SPEED m- NLSTABLEINFO 0 h- _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION = _FP_IEEE_COMPARE_RESULT �# _FILE_LAYOUT_INFO_ENTRY �# FILE_LAYOUT_INFO_ENTRY e- EX_WNF_CALLBACK Z- TP_TASK_CALLBACKS * $ PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA �' WMI_DPI_RECORD S- tagEMRANGLEARC P- LPDEBUGHOOKINFO ! ~# _PROCESS_INFORMATION_CLASS $ O- PSC_NOTIFICATION_REGISTRATION L- _SD_ENUM_SDS_ENTRY H- CM_MONITOR_DEVICE_DATA D- FINDEX_INFO_LEVELS * y) _EVENT_TRACE_TAG_FILTER_INFORMATION x uint16x8_t A- _ACCESS_ALLOWED_ACE 9- PIMAGE_CHPE_RANGE_ENTRY �+ SERIALKEYSA 3 4- PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 1- CREATE_USN_JOURNAL_DATA +- PREARRANGE_FILE_DATA )- PEISA_PORT_DESCRIPTOR ( '- _SYSTEM_SINGLE_MODULE_INFORMATION . !- PRESOURCEMANAGER_COMPLETION_INFORMATION - PRTL_OSVERSIONINFOEX2W H( PEMRPOLYLINETO16 - RECONVERTSTRING - PETW_LBR_ENTRY $ - NTFS_FILE_RECORD_INPUT_BUFFER ( - PTP_CLEANUP_GROUP_CANCEL_CALLBACK * - PASSEMBLY_FILE_DETAILED_INFORMATION
- PSYSTEMTIME - PCOVERAGE_MODULES - MENUITEMTEMPLATE 6 - JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 �" KEY_FULL_INFORMATION ! �, PIMAGE_COFF_SYMBOLS_HEADER 5 _DEBUG_CONTROL_SPACE_ITEM $ �, _FILE_COMPRESSION_INFORMATION $ �, _REFS_DEALLOCATE_RANGES_RANGE # �, _KEY_HANDLE_TAGS_INFORMATION �, DOCINFOW ' �, _PERFINFO_CC_SCHEDULE_READ_AHEAD �, _IMAGE_HOT_PATCH_HASHES > MFT_ENUM_DATA
�, PLBLOB �, LPCOMMTIMEOUTS �, _DRAWPATRECT �, _RPC_SID �, _HEAP_EVENT_RANGE_CREATE 3 �, PTRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT % �, _SYSTEM_ACPI_AUDIT_INFORMATION ' _SL_APPX_CACHE �, _MODEMDEVCAPS % �* _PLUGPLAY_CONTROL_INSTALL_DATA ) �, _RESOURCEMANAGER_BASIC_INFORMATION e RTL_WORK_ON_BEHALF_TICKET �, EDITWORDBREAKPROCW �, PFLOAT128 �, LPSERVICE_TABLE_ENTRYW �, PETW_TP_EVENT_POOL_CREATE ( �, RTL_PROCESS_MODULE_INFORMATION_EX �, HCOLORSPACE 6 RPC_CWSTR PACCESS_TOKEN �, POINTER_DEVICE_TYPE �, PLOGPEN � _TRACE_ENABLE_INFO 4 �, _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION �, REFS_VOLUME_DATA_BUFFER - �& _SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT ' �, _PUBLIC_OBJECT_BASIC_INFORMATION |% _RTL_UMS_COMPLETION_LIST �, PFILE_MODE_INFORMATION �, LPRGNDATA
x __n128 �, HDESK__ ~, _POINTL
% EMRARC |, LPENUM_SERVICE_STATUSA z, SERVICE_NOTIFY w, PPERFINFO_IPI_SEND_DATA + �' _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A & r, _FILE_ATTRIBUTE_TAG_INFORMATION % n, SYSTEM_MEMORY_LIST_INFORMATION i, _LOAD_DLL_EVENT_DATA c, PXSAVE_CET_U_FORMAT / [, PFILE_QUERY_METADATA_OPTIMIZATION_OUTPUT " V, PENLISTMENT_CRM_INFORMATION T, PVIRTUAL_STORAGE_TYPE S, PREPAIR_COPIES_INPUT � RpcProxyPerfCounters = EVENT_DATA_DESCRIPTOR $ N, _PERFINFO_PAGE_RANGE_IDENTITY & A, PIMAGE_RESOURCE_DIRECTORY_ENTRY <, PSECURITY_CAPABILITIES " _LDR_DDAG_NODE t HFILE 7, PCUQUAD 3, PPM_IDLE_STATE_BUCKET_EX �" WATCHDOG_HANDLER_ACTION + /, JOURNAL_SET_KEY_SECURITY_INFORMATION , ), PRTL_USER_PROCESS_EXTENDED_PARAMETERS � UUID ', LPCUWCHAR h+ EMRSETICMPROFILEW !, PFLASHWINFO , PCM_PARTIAL_RESOURCE_LIST O" FILE_STREAM_INFORMATION f DPFLTR_TYPE , FILETIME & , _RTL_SEGMENT_HEAP_MEMORY_SOURCE " , _FILE_DIRECTORY_INFORMATION
, LPMDICREATESTRUCT
, MODEMSETTINGS , REGISTERWORDENUMPROCA % , PPERFINFO_DRIVER_MAJORFUNCTION # �+ _MEMORY_PARTITION_PAGE_RANGE �+ _CLIENT_CALL_RETURN �+ MUICCENTRY �+ NPIMEMENUITEMINFO �+ PRTL_OSVERSIONINFOEXW ' �+ _RTL_QUERY_DEBUG_VIRTUAL_PROCESS � LDR_SERVICE_TAG_RECORD ~ _ICONINFO �+ PIMAGE_BASE_RELOCATION % PEBS_DS_SAVE_AREA �+ LPAXESLISTW �+ PMM_ETW_PAGE_INFO_EX � PRIORITY_HINT �+ LPENUMLOGFONTEXA �+ _RTLP_HEAP_TAGGING_INFO 5 �+ PCACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION �+ PCLBLOB $ �+ SYSTEM_PROCESS_CLASSIFICATION % �+ PERFINFO_FILE_SIMPLE_OPERATION ' �+ PSYSTEM_POOL_ZEROING_INFORMATION �+ PPOWER_REQUEST_CONTEXT �+ IMPORT_OBJECT_HEADER �+ LPMOUSEHOOKSTRUCT �+ tagSERIALKEYSA �+ ETW_REGNOTIF_REGISTER �+ PGROUP_AFFINITY � _MUISTRINGPOOL �+ CONNECTDLGSTRUCTW �% _EXCEPTION_RECORD �+ _ETW_SET_TIMER_EVENT
PINT16 . �+ PROCESS_REVOKE_FILE_HANDLES_INFORMATION >' COPYFILE2_MESSAGE_TYPE " SYSINF_PAGE_COUNT {+ LPMDINEXTMENU t+ PBSMINFO r PORT_MESSAGE q+ WAKE_TIMER_INFO l+ ENCLAVE_LOAD_INFO_VBS h+ tagEMRSETICMPROFILE . e+ PTOUCH_HIT_TESTING_PROXIMITY_EVALUATION # TRACEHANDLE ^+ HIMC � _INTERFACE_TYPE * T+ PSYSTEM_FEATURE_CONFIGURATION_QUERY Q+ RTL_BITMAP 4 N+ JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION % J+ FSCTL_UNMAP_SPACE_INPUT_BUFFER C+ RTL_CIRCULAR_LIST_HEAD >+ _RTL_UNLOAD_EVENT_TRACE > TIME_ZONE_INFORMATION . :+ SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION 7+ PEMRSETWINDOWORGEX 5+ VOLUME_REFS_INFO_BUFFER /+ PPPM_IDLESTATE_EVENT $ -+ PSYSTEM_KERNEL_DEBUGGER_FLAGS - ++ MEMORY_PHYSICAL_CONTIGUITY_INFORMATION . &+ JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 ) !+ _MEMORY_WORKING_SET_EX_INFORMATION + NPOUTLINETEXTMETRICW + LPCREATESTRUCTA
+ ETW_HEAP_EVENT_CREATE " � HOT_PATCH_INFORMATION_CLASS ! + ETW_UMS_EVENT_DISASSOCIATE + PWOW64_CONTEXT + PFOCUS_EVENT_RECORD / �' IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER * �* PTRANSACTION_PROPERTIES_INFORMATION �* NPEXTLOGFONTW * �* PSYSTEM_SESSION_PROCESS_INFORMATION � _THREAD_INFORMATION_CLASS ' �* PALPC_MESSAGE_HANDLE_INFORMATION & �* _FILE_IO_COMPLETION_INFORMATION # 8 IMAGE_RUNTIME_FUNCTION_ENTRY # �* PSECTION_IMAGE_INFORMATION32 �# PNEWTEXTMETRICW �* PKBDLLHOOKSTRUCT �* PEVENT_INSTANCE_INFO �* PRTL_DRIVE_LETTER_CURDIR �* PDRAWITEMSTRUCT �* tagWNODE_SINGLE_ITEM �* _REPARSE_GUID_DATA_BUFFER " NOTIFICATION_MASK �* CALINFO_ENUMPROCW �* _EVENT_TYPE . �* PEVENT_TRACE_PROFILE_REMOVE_INFORMATION
� _LBLOB �* HEAP_AFFINITY_SLOT_ASSIGN �* NPEXTLOGPEN32 �* DISPLAYCONFIG_PIXELFORMAT ) �* FILE_PIPE_CLIENT_PROCESS_BUFFER_EX ! # WATCHDOG_INFORMATION_CLASS # V' TRANSACTION_LIST_INFORMATION ! p _FILE_REMOTE_PROTOCOL_INFO �* tagTOUCHINPUT �* PTP_TIMER_CALLBACK $ �* PLUGPLAY_CONTROL_INSTALL_DATA $ P WORKER_FACTORY_CALLBACK_CLASS � EMRSETARCDIRECTION �* KEY_EVENT_RECORD �* PTP_TIMESTAMP # �* _MEMORY_PRIORITY_INFORMATION � _COPYFILE2_MESSAGE_ACTION �* COPYFILE2_MESSAGE |* _FILE_PIPE_PEEK_BUFFER $ v* PETW_TP_EVENT_CALLBACK_CANCEL 2 �( SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT �& ENCRYPTION_KEY_CTRL_INPUT * s* FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT � _EXCEPTION_DISPOSITION � ACL_INFORMATION_CLASS o* _ENCLAVE_INIT_INFO_VBS , b* PPERFINFO_SAMPLED_PROFILE_INFORMATION Z* PPOLYTEXTA W* tagMDICREATESTRUCTA S* _NORM_FORM N* PALPC_MESSAGE_ATTRIBUTES � RTL_RB_NODE 6# LPCWPRETSTRUCT L* PENERGY_STATE_DURATION �% CLUSTER_RANGE J* PLUGPLAY_EVENT_BLOCK * LPBITMAPV4HEADER
* LPMAT2 * PWMI_BUFFER_HEADER * PWMI_UDP * _FAT_STATISTICS * PROFILE_SOURCE_INFO * PACCESS_REASONS ) * _SE_LEARNING_MODE_USER_OBJECT_DATA * PNT_TIB64 �) PPOWER_STATE_HANDLER_TYPE P tagIMEMENUITEMINFOA � FXSAVE_FORMAT_WX86 & � _RTL_RETPOLINE_RELOCATION_INDEX {' LPHELPWININFOW $ �) PPERFINFO_FILE_PATH_OPERATION " �) _SYSTEM_CONSOLE_INFORMATION �$ LPWGLSWAP I DATEFMT_ENUMPROCA % �" JOBOBJECT_IO_ATTRIBUTION_STATS % �( _SYSTEM_GDI_DRIVER_INFORMATION
�) PM128A �) PGESTURECONFIG % �) PERFINFO_PPM_PERF_STATE_CHANGE - �) SYSTEM_THREAD_CID_PRIORITY_INFORMATION �) ANSI_STRING32 �) X86_CALL_FRAME �) PPOWER_ACTION_POLICY �) PMULTIKEYHELPW �) PSTYLEBUFA $ �) PPROCESS_HANDLE_TRACING_QUERY ] EXCEPTION_LOG_TYPE �% _CLUSTER_RANGE �) ETW_RT_EVENT_LOSS � PUNZWCH �% KEY_NODE_INFORMATION # �) THREAD_PROFILING_INFORMATION # �) _MEMORY_WORKING_SET_EX_BLOCK �) _ETW_WAKE_COUNTER_EVENT : �) PSYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION �) LPMEASUREITEMSTRUCT # �) PWMI_IMAGELOAD_INFORMATION64 �) ETW_SET_MARK_INFORMATION 0 �) EVENT_TRACE_IPT_CONFIGURATION_INFORMATION �) PMOVE_FILE_DATA % ) PJOBOBJECT_WAKE_INFORMATION_V1 # }) SET_PURGE_FAILURE_MODE_INPUT - y) EVENT_TRACE_POOLTAG_FILTER_INFORMATION
( _OBJECT_ATTRIBUTES � IMAGE_THUNK_DATA - v) OUT_OF_PROCESS_FUNCTION_TABLE_CALLBACK p) PTIMER_BASIC_INFORMATION , k) PPLUGPLAY_CONTROL_RELATED_DEVICE_DATA
! LANGID # h) _SECURITY_QUALITY_OF_SERVICE `) PTRACE_LOGFILE_HEADER32 9 _) PPROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY & � PS_MITIGATION_AUDIT_OPTIONS_MAP ( ]) tagACTCTX_SECTION_KEYED_DATA_2600 + W) PETW_UMS_EVENT_DIRECTED_SWITCH_START ! T) _PERFINFO_IPI_RECEIVE_DATA P) SYSTEM_PREFETCH_OPTIONS D) ALPC_SECURITY_ATTR =) PEMRCOLORMATCHTOTARGET ) _WOF_VERSION_INFO *) LPDCB
p PSCHAR ( ') FILE_ID_GLOBAL_TX_DIR_INFORMATION #) _ATOM_INFORMATION_CLASS & ) QUERY_PERFORMANCE_COUNTER_FLAGS % �' PROCESS_MEMORY_EXHAUSTION_TYPE �! tagGCP_RESULTSA 2 ) TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE ) WOF_VERSION_INFO ) PMM_ETW_PAGE_EXTRA_INFO ) NPPATTERN �% ETW_IDEAL_PROCESSOR_EVENT
PINT64 ) PTOKEN_DEVICE_CLAIMS ) APC_CALLBACK_FUNCTION - ) PEVENT_EXTENDED_ITEM_PROCESS_START_KEY ! �( SYSTEM_CPU_SET_INFORMATION & �( SYSTEM_SPECIAL_POOL_INFORMATION �( HELPWININFOA �( RID_DEVICE_INFO �( _TRACE_GUID_REGISTRATION # �( RTL_USER_PROCESS_INFORMATION �( LPCREATESTRUCTW �( LPMINIMIZEDMETRICS �( SCOPE_TABLE �( FILE_INTERNAL_INFORMATION % �( PSYSTEM_CALL_COUNT_INFORMATION
� PANOSE �( PIMAGE_SECTION_HEADER �( PACCESS_DENIED_OBJECT_ACE " 1 PROCESS_BASIC_INFORMATION64 �( ARRAY_INFO �( PPO_WAKE_SOURCE_HISTORY $ �( SYSTEM_GDI_DRIVER_INFORMATION �( PUMS_THREAD_INFO_CLASS �% PCWCHAR % �( PDYNAMIC_TIME_ZONE_INFORMATION 1& PEMRSCALEWINDOWEXTEX �( _EVENT_INFORMATION_CLASS " �( PSYSTEM_BIGPOOL_INFORMATION 3 �( PSYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT �( MEASUREITEMSTRUCT �( XMIT_ROUTINE_QUINTUPLE �( RTL_BSD_ITEM FXPT2DOT30 ) __n64 �( _MANDATORY_LEVEL �( LPPOINT " �( PWMI_JOB_SET_QUERY_CPU_RATE ( ( PPROCESS_TELEMETRY_ID_INFORMATION 4 y( PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 v( MIDL_SERVER_INFO g( PPS_PROTECTED_SIGNER e( _WOW64_LDT_ENTRY O( PRTL_PERTHREAD_CURDIR N( PCIMAGE_THUNK_DATA64 # L( PTEB_ACTIVE_FRAME_CONTEXT_EX u PUINT H( PEMRPOLYGON16 E( tagGESTUREINFO ' A( RPC_BINDING_HANDLE_SECURITY_V1_W B" RTL_SPARSE_BITMAP_RANGE - _DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO 6( PEMRCREATECOLORSPACEW .( PPOWER_USER_PRESENCE 0 )( PIMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER %( _CM_SERVICE_LOAD_TYPE "( FP_64 # ( _PROCESS_WORKING_SET_CONTROL � PACTIVATION_CONTEXT_STACK % �$ ALPC_PORT_CALLBACK_INFORMATION % ( SYSTEM_VERIFIER_INFORMATION_EX 5 � _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION - ( _PERFINFO_PFMAPPED_SECTION_INFORMATION ( LC_ID
( OBJECT_ATTRIBUTES H _PEBS_DS_SAVE_AREA32 & �' _PROCESS_MEMORY_EXHAUSTION_TYPE ( LPOFSTRUCT ( tagRID_DEVICE_INFO_MOUSE 0 �' _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER * �' RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A �' SYSTEM_NUMA_PROXIMITY_MAP �' PEMRPOLYTEXTOUTA �' RID_DEVICE_INFO_KEYBOARD �' _USER_MARSHAL_CB �' LPMENUBARINFO # �' _TOKEN_GROUPS_AND_PRIVILEGES _EISA_DMA_CONFIGURATION �' LPDISPLAY_DEVICEW �' SC_STATUS_TYPE �' NDR_CS_ROUTINES _HEAP_SUBSEGMENT_FREE . c EVENT_TRACE_PROFILE_COUNTER_INFORMATION �' RTL_PROCESS_HEAPS tagTOGGLEKEYS # _ tagINPUT_MESSAGE_DEVICE_TYPE �' _WMI_DPI_RECORD , �' _SYSTEM_HYPERVISOR_DETAIL_INFORMATION �' HSTR � _PRIORITY_HINT �% EMRSCALEVIEWPORTEXTEX �' PIMAGE_HOT_PATCH_INFO � DUPLICATE_EXTENTS_DATA32 �' NV_MEMORY_RANGE " � _FILE_IO_PRIORITY_HINT_INFO �# SE_IMAGE_SIGNATURE_TYPE �' PICONINFOEXW �! RPC_CLIENT_INTERFACE � _ACCESS_REASON_TYPE �' PPROCESS_EXCEPTION_PORT �' NPDEVMODE �' CPINFOEXW �' _CONTEXT_CHUNK �' NMHDR {' PHELPWININFOW �" tagREGISTERWORDA x' SD_GLOBAL_CHANGE_OUTPUT 1 r' PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS m' PCRITICAL_SECTION
" PULONG g' PCONSOLE_FONT_INFO - � _ALPC_PORT_COMPLETION_LIST_INFORMATION - d' TRANSACTIONMANAGER_LOGPATH_INFORMATION � _RTL_RB_TREE " ^' PETW_TP_EVENT_CALLBACK_STOP ' 3 _ETW_SESSION_NOTIFICATION_PACKET # Y' PFILE_COMPLETION_INFORMATION $ V' _TRANSACTION_LIST_INFORMATION Q' tagEMRSTRETCHDIBITS M' _TRACE_GUID_PROPERTIES " I' IMAGE_LOAD_CONFIG_DIRECTORY ! E' _LINK_TRACKING_INFORMATION >' _COPYFILE2_MESSAGE_TYPE u TOUCH_FLAGS HEAP_SUBSEGMENT_INIT & �" _JOBOBJECT_IO_ATTRIBUTION_STATS . 5' PSYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE ) 2' _PLUGPLAY_CONTROL_CONFLICT_STRINGS .' tagEMRFORMAT 5 !' LPSERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM ' PTOKEN_MANDATORY_LABEL ' _TRACE_LOGFILE_HEADER32 ' _COUNTER_READING � REFS_SMR_VOLUME_GC_ACTION ' _PREFIX_TABLE_ENTRY ' _VM_COUNTERS ' SL_APPX_CACHE ! �& PENCRYPTION_KEY_CTRL_INPUT + � RTLWOW64_CROSSPROCESS_WORK_OPERATION RPC_AUTH_IDENTITY_HANDLE �& _RPC_VERSION �& _DISPATCHER_CONTEXT �& _RTL_UMS_CONTEXT �& LPJIT_DEBUG_INFO32 . �& _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 �& PUSN_RECORD_COMMON_HEADER �& SPARSE_OVERALLOCATE_DATA & � _SYSTEM_SYSTEM_DISK_INFORMATION �& PRTL_HANDLE_TABLE_ENTRY � poly8x8x3_t # �& PSYSTEM_VERIFIER_INFORMATION $ �& PRTL_CRITICAL_SECTION_DEBUG64 L% CONSOLE_FONT_INFOEX �& SYSTEM_TRACE_HEADER % �& PPERFINFO_PPM_IDLE_STATE_ENTER # �& FILE_ID_FULL_DIR_INFORMATION �& _EVENTLOGRECORD ( �& PRPC_BINDING_HANDLE_TEMPLATE_V1_A & �& ETW_DFSS_RELEASE_THREAD_ON_IDLE , �& SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT $ �& PHEAP_BLOCK_EXTRA_INFORMATION ! �& POINTER_BUTTON_CHANGE_TYPE ! �& PSEC_WINNT_AUTH_IDENTITY_A & �& EVENT_TRACE_VERSION_INFORMATION }& PICONMETRICS {& COORD ' x& SYSTEM_ALARM_CALLBACK_OBJECT_ACE $ t& COPYFILE2_EXTENDED_PARAMETERS p& LPMENUINFO n& SYSTEM_OBJECT_INFORMATION h& LPLOGCOLORSPACE �" WMI_IMAGEID_INFORMATION32 b& PWNDCLASSW _& tagHELPINFO 6 Z& PRTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY # W& QUERY_BAD_RANGES_INPUT_RANGE S& _RTL_RUN_ONCE / L& POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES ) I& PCACTIVATION_CONTEXT_ASSEMBLY_DATA F& _CSV_QUERY_REDIRECT_STATE :& PQUERY_FILE_LAYOUT_INPUT , 4& _JOURNAL_SET_DELETE_VALUE_INFORMATION 1& PEMRSCALEVIEWPORTEXTEX ) 3! _SERVICE_REQUIRED_PRIVILEGES_INFOW /& _ALPC_CONTEXT_ATTR * )& PWIM_PROVIDER_SUSPEND_OVERLAY_INPUT " && _PERFINFO_BATTERY_LIFE_INFO ) "& _SYSTEM_REGISTRY_QUOTA_INFORMATION �% PCNZWCH & LDR_ENUM_RESOURCE_ENTRY 9 & SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION ` int64x2x2_t & PTHREAD_ENERGY_VALUES ( & _TXFS_READ_BACKUP_INFORMATION_OUT [# _PROCESS_HEAP_INFORMATION & PEMRDELETECOLORSPACE & ETW_CANCEL_KTIMER2_EVENT + & PPROCESS_KEEPALIVE_COUNT_INFORMATION �% NDR_SCONTEXT ! �% _ETW_IDEAL_PROCESSOR_EVENT
# size_t � PCANDIDATEFORM ) �% PERFINFO_SYSTEM_MEMORY_INFORMATION $ �% QUERY_BAD_RANGES_OUTPUT_RANGE �% PCLUSTER_RANGE IMAGE_MITIGATION_POLICY �% RTLP_EXIT_THREAD �% _STACK_WALK_EVENT_DATA \ _ALPC_PORT_ATTRIBUTES �% PWMI_REGISTRY �% PSYSTEM_POOL_ENTRY �% tagEMRSCALEVIEWPORTEXTEX �% PICONINFO ) int64x1_t 3 �% _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION ( �% _ACTIVATION_CONTEXT_ASSEMBLY_DATA ! �% WMI_JOB_SET_QUERY_CPU_RATE a RTL_SPLAY_LINKS �% NPCOMPOSITIONFORM % �% PLDR_DLL_NOTIFICATION_FUNCTION # �% _ACCESS_ALLOWED_CALLBACK_ACE ! �% UNIQUE_PROCESS_INFORMATION �% RTLP_START_THREAD �% PPERFINFO_CCSWAP_IDLE # �% _TOKEN_SECURITY_ATTRIBUTE_V1 �% PEXCEPTION_RECORD 2 �% _MEMORY_PARTITION_CONFIGURATION_INFORMATION �% PEMRPIE " �% PCM_EXTENDED_PARAMETER_TYPE �% PPVALUEW �$ int16x8x4_t " tagEMRINVERTRGN �% PKEY_NODE_INFORMATION �% LPFNDEVCAPS �% EMRGLSRECORD % � THREAD_UMS_INFORMATION_COMMAND # TXFS_TRANSACTION_ACTIVE_INFO |% RTL_UMS_COMPLETION_LIST z% ENUMRESTYPEPROCA # OUTLINETEXTMETRICA w% LPMOUSEHOOKSTRUCTEX u% WNDCLASSEXA m% provider_info
time_t - a% _REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER ]% XSTATE_FEATURE �# _RTL_CRITICAL_SECTION32 X% LPGRADIENT_RECT # PULONG64 V% _SE_ACCESS_REQUEST � _FUNCTION_TABLE_TYPE L% _CONSOLE_FONT_INFOEX + � LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION $ H% _NDR_CS_SIZE_CONVERT_ROUTINES 8% _RTL_MEMORY_TYPE " 5% _FILE_NUMA_NODE_INFORMATION * � RTL_FEATURE_CONFIGURATION_OPERATION % � _MEMORY_COMBINE_INFORMATION_EX % /% PSERVICE_LAUNCH_PROTECTED_INFO $ ,% PROCESS_ENERGY_TRACKING_STATE + %% PHEAP_OPTIMIZE_RESOURCES_INFORMATION "% _HEAP_RANGE_INFORMATION p PABC � _PS_CREATE_INFO ' % PFILE_PIPE_CLIENT_PROCESS_BUFFER % PDMA_WIDTH � TP_TIMESTAMP % _GRADIENT_RECT
% EMRPIE + R TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 % LPUNIVERSAL_NAME_INFOW ( % PETW_COVERAGE_SAMPLER_CREATE_INFO p SCHAR % PPEBS_DS_SAVE_AREA - % PSYSTEM_CRASH_DUMP_CONFIGURATION_CLASS LONGLONG �$ _ETW_READY_THREAD_EVENT �$ RETRIEVAL_POINTER_COUNT ' �$ _IO_COMPLETION_BASIC_INFORMATION �$ _RTL_DISK_SPEED_INFO �$ PHEAP_SUBSEGMENT_FREE 0 - RTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK �$ PSYNCHRONIZATION_BARRIER �$ PRTL_AVL_TABLE " �$ KEY_VALUE_INFORMATION_CLASS �$ TOKEN_ACCESS_INFORMATION ( _RTL_FEATURE_VARIANT_PAYLOAD_KIND " error_status_t �$ LPCOMMPROP
�$ EMREOF & �$ _ALPC_PORT_CALLBACK_INFORMATION �$ PWGLSWAP �$ _WMI_DELAY_EXECUTION �$ __n128x4 1 � _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION �$ PREGISTERWORDA $ �$ _ETW_COVERAGE_SAMPLER_OPTIONS �$ CI_LOG_SCHEDULER_EVENT ! �$ POWER_MONITOR_REQUEST_TYPE �$ tagSTYLEBUFA ' �$ _ETW_PARTITION_INFO_EXTENSION_V2 � uint8x8x3_t �$ PRTL_DISK_SPACE_INFO � DEVICE_POWER_STATE �$ REG_NOTIFY_INFORMATION $ _RTL_RETPOLINE_ROUTINES " y$ PIMAGE_AUX_SYMBOL_TOKEN_DEF v$ PDEVICE_POWER_STATE r$ PRTL_SPARSE_BITMAP_RUN m$ PSIZE $ i$ PPERFINFO_PPM_STATE_SELECTION 0 � SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION f$ WOW64_FLOATING_SAVE_AREA $ b$ _ETW_TP_EVENT_POOL_TH_MAX_SET ! ^$ PERFINFO_CC_CAN_WRITE_FAIL Z$ ETW_UMGL_KEY V$ POOLED_USAGE_AND_LIMITS P$ PNUMA_NODE_RELATIONSHIP & N$ SYSTEM_DPC_BEHAVIOR_INFORMATION Q HEAP_REGION_INFORMATION % H$ PETW_TP_EVENT_CALLBACK_ENQUEUE E$ _FSCTL_UNMAP_SPACE_OUTPUT A$ TIMER_INFORMATION_CLASS - <$ PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64 X _CM_ROM_BLOCK ! n _PROC_THREAD_ATTRIBUTE_NUM 6$ CURSORINFO 0$ SERVICE_TIMECHANGE_INFO . _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS - )$ _MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE I TP_LOG_LEVEL "$ LPLOCALESIGNATURE _ INPUT_MESSAGE_DEVICE_TYPE # PREGHANDLE & $ PETW_THREAD_EVENT_SUBPROCESSTAG $ PUTF8_STRING % $ PDRIVER_VERIFIER_THUNK_ROUTINE + EMRSETWINDOWEXTEX $ TOKEN_DEFAULT_DACL 2 $ _PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION
$ WINDOWINFO $ LPENUM_SERVICE_STATUS $ PZPTSTR $ PKSYSTEM_TIME �# LPNEWTEXTMETRICW �# IO_STATUS_BLOCK32 �# PTOKEN_ORIGIN 4 PFORMAT_STRING �# _REPARSE_DATA_BUFFER_EX ( �# PRTL_WALK_IMAGE_POLICIES_CALLBACK r _SYSTEM_BIGPOOL_ENTRY �# PRTL_CONDITION_VARIABLE �# SECURITY_OBJECT_AI_PARAMS $ �# PSTARTING_LCN_INPUT_BUFFER_EX �# SYSDBG_IO_SPACE " S! PBY_HANDLE_FILE_INFORMATION �# PPROCESS_LEAP_SECOND_INFO �# LPVIDEOPARAMETERS �# PWNODE_TOO_SMALL ' �# PJOBOBJECT_BASIC_PROCESS_ID_LIST * �# PPERFINFO_HARDPAGEFAULT_INFORMATION JIT_DEBUG_INFO �# PFILE_LAYOUT_INFO_ENTRY t LPINT �# PROCESSOR_NUMBER �# PRTL_CRITICAL_SECTION32 �# _IO_ERROR_LOG_PACKET * �# PIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY 4 �# PSYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION �# POBJECT_NAME_INFORMATION $ �# _RTL_DYNAMIC_HASH_TABLE_ENTRY - �# EVENT_TRACE_PROFILE_REMOVE_INFORMATION 5 COPYDATASTRUCT �# MUICCHEADER 9 �# _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION ) y# PPERFINFO_DRIVER_MAJORFUNCTION_RET w# WMI_TRACE_PACKET q# PRTL_MODULE_BASIC_INFO n# RPC_SECURITY_QOS_V3_W g# _WMI_BUFFER_HEADER p PSTR " _# TEB_ACTIVE_FRAME_CONTEXT_EX Y# PPROCESS_HEAP_INFORMATION �" ETW_PROVIDER_TRAIT_TYPE $ W# PFILTER_BOOT_OPTION_OPERATION 4 � _PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY $ S# LPSERVICE_PREFERRED_NODE_INFO PMOFHANDLE P# SE_SECURITY_DESCRIPTOR / L# JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 ( H# ETW_TP_EVENT_TIMER_CANCEL_NTTIMER E# PMONITOR_DISPLAY_STATE $ @# _SYSTEM_KERNEL_DEBUGGER_FLAGS 2 <# TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION 6# NPCWPRETSTRUCT
CPINFO 3# _MEMORY_RANGE_ENTRY 0# PBUS_DATA_TYPE +# TOKEN_ORIGIN * _DIRECTORY_NOTIFY_INFORMATION_CLASS '# CSV_QUERY_MDS_PATH_V2 # WMI_IMAGEID_INFORMATION64 # EMRSETMITERLIMIT # EMREXTSELECTCLIPRGN # LPNUMBERFMT - c EVENT_TRACE_PROFILE_CONFIG_INFORMATION # PPOWER_SESSION_TIMEOUTS # # HEAP_AFFINITY_MANAGER_ENABLE # PLOGFONTW # EVENTMSG # ETW_OBJECT_TYPE_EVENT �" PKEY_FULL_INFORMATION �" _PROCESS_LEAP_SECOND_INFO ! �" _WMI_IMAGEID_INFORMATION32 % E PROCESSOR_PROFILE_CONTROL_AREA 2 � MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION ( �" MEMORY_PARTITION_NODE_INFORMATION $ �" PPERFINFO_CC_WORKITEM_ENQUEUE ' �" PERFINFO_CC_EXTRA_WB_THREAD_INFO �" PPERFINFO_CCSWAP_BUFFER �" PISECURITY_DESCRIPTOR �" POINT �" PENUMTEXTMETRICW �" PPROCESS_WAKE_INFORMATION WMI_PNP_RECORD_V5 " �" PFILE_ALIGNMENT_INFORMATION �" LPACCESSTIMEOUT ( �" _ETW_TIMER_EXPIRATION_START_EVENT � _NT_PRODUCT_TYPE " �" FILE_ALLOCATION_INFORMATION �" PTP_TASK_EXECUTE_CALLBACK ! � _FILE_INFO_BY_HANDLE_CLASS �" PREGISTERWORD D PLIST_ENTRY �" PPOWER_STATE_HANDLER �" _MOUSE_EVENT_RECORD , �" PIMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY x int8x16_t " �" PERFINFO_SYSCALL_ENTER_DATA �" _JOB_SET_ARRAY & �" PJOBOBJECT_IO_ATTRIBUTION_STATS �" _RTL_PERTHREAD_CURDIR ~" DISPLAY_DEVICE z" CS_TYPE_TO_NETCS_ROUTINE * w" PJOBOBJECT_INTERFERENCE_INFORMATION s" PEMRLINETO q" NPPAINTSTRUCT p" LPICONMETRICS l" PQUERY_FILE_LAYOUT_OUTPUT j" PTIMER_APC_ROUTINE f" HEAP_INFORMATION_CLASS a" HSAVEDUILANGUAGES [" EXFAT_STATISTICS _BOOT_ENTROPY_SOURCE_ID W" RTL_BITMAP_EX � STARTUPINFO S" _MIDL_INTERCEPTION_INFO M" PFILE_STREAM_INFORMATION , J" SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS E" PCM_VIDEO_DEVICE_DATA B" _RTL_SPARSE_BITMAP_RANGE =" NLSVERSIONINFOEX , 9" WMI_JOB_SEND_NOTIFICATION_INFORMATION � REPARSE_DATA_BUFFER 3" LPDOCINFOA ! 0" SYSTEM_MANDATORY_LABEL_ACE *" PPOWER_STATE ! J POWER_PLATFORM_INFORMATION #" PPPM_IDLE_ACCOUNTING " LPSERVICE_DESCRIPTIONW " � TRANSACTION_ENLISTMENT_PAIR " _OBJECT_ATTRIBUTES32 % " _SYSTEM_FIRMWARE_TABLE_HANDLER " PEMRINVERTRGN " EMRPLGBLT * " _JOBOBJECT_INTERFERENCE_INFORMATION �! PLDR_DDAG_NODE ) �! RTL_ACTIVATION_CONTEXT_STACK_FRAME & �! PFILE_LINKS_FULL_ID_INFORMATION � _RTL_AVL_TREE + EMRSETVIEWPORTEXTEX - �! RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER $ �! FILE_FS_DATA_COPY_INFORMATION �! OFFER_PRIORITY �! _ICONINFOEXA �! MM_ETW_PAGE_EXTRA_INFO * �! PCUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG , �! JOBOBJECT_END_OF_JOB_TIME_INFORMATION C �! RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED �! EMRSETMETARGN JIT_DEBUG_INFO64 �! GCP_RESULTSA �! LPHIGHCONTRAST �! uint32x4x3_t �! EMRSETBRUSHORGEX �! LPHANDLER_FUNCTION . �! _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID �! _SID_AND_ATTRIBUTES �! PCLIENT_ID64 �! IMEMENUITEMINFOW �! RPC_ANSI_STRING �! PWMI_JOB_INFORMATION �! TRANSACTION_STATE 4 �! PSYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION �! PRPC_CLIENT_INTERFACE �! PERFINFO_FILE_DIRENUM |! _BOOT_ENTRY ! F FILE_FS_DEVICE_INFORMATION x! OSVERSIONINFOA . t! JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 l! LPSTARTUPINFOEXW j! LPMULTIKEYHELP ! h! PERFINFO_CCSWAP_IDLE_SHORT ' b! _ALPC_MESSAGE_HANDLE_INFORMATION Y! LPCMENUINFO # S! LPBY_HANDLE_FILE_INFORMATION P! _PROCESS_ACTIVITY_TYPE N! LPTEXTMETRIC L! KLDR_DATA_TABLE_ENTRY ' ?! _SYSTEM_HOT_PATCH_REGISTRY_VALUE - ;! TOUCH_HIT_TESTING_PROXIMITY_EVALUATION ( 5! PLDR_DLL_LOADED_NOTIFICATION_DATA ( 3! SERVICE_REQUIRED_PRIVILEGES_INFOW # /! _ETW_DFSS_START_NEW_INTERVAL � KCONTINUE_TYPE )! _SYSTEM_POOL_INFORMATION + #! PLUGPLAY_CONTROL_INTERFACE_LIST_DATA & ! _PROCESS_POWER_THROTTLING_STATE ! PPERFINFO_CCSWAP ( ! WIM_PROVIDER_UPDATE_OVERLAY_INPUT g _MUTANT_BASIC_INFORMATION ! PEBS_DS_SAVE_AREA64 . ! _MEMORY_PARTITION_ATTRIBUTE_INFORMATION - ! PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA 4 ! ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA � _PROCESS_WAKE_INFORMATION $ � PDELETE_STORAGE_RESERVE_INPUT 0 � EVENT_TRACE_LBR_CONFIGURATION_INFORMATION � PSYSTEM_POWER_POLICY � LPSERVICE_FAILURE_ACTIONS & � _FILE_PIPE_DELETE_SYMLINK_INPUT � EMRGDICOMMENT ~ UTF8_STRING $ � _REQUEST_OPLOCK_OUTPUT_BUFFER � tagMINIMIZEDMETRICS � GESTURENOTIFYSTRUCT � LPCGUID 7 � IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION � PSYSTEM_AUDIT_ACE # p FILE_ID_EXTD_DIR_INFORMATION � LPSERVICE_SID_INFO � PWMI_WAIT_SINGLE # � PERFINFO_MEM_RESET_INFO_TYPE � _CLIENT_ID64 , � ALPC_PORT_COMPLETION_LIST_INFORMATION # � _TXFS_GET_TRANSACTED_VERSION � PSYSTEM_POOLTAG � COMPUTER_NAME_FORMAT � RPC_HTTP_REDIRECTOR_STAGE " ACCESS_MASK � PRKCRM_MARSHAL_HEADER � PCZZTSTR / � _PROCESS_STACK_ALLOCATION_INFORMATION_EX � _REPAIR_COPIES_INPUT " � _UNICODE_PREFIX_TABLE_ENTRY ' � RTL_IMAGE_MITIGATION_ASLR_POLICY � LPSTARTUPINFO / � SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE - � _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA
� HBRUSH _RPC_SECURITY_QOS_V2_W # s PQUERY_STORAGE_RESERVE_INPUT � PSINJECTDATA n LPBITMAPCOREHEADER k tagCLIENTCREATESTRUCT e PMUTANT_BASIC_INFORMATION # b SYSTEM_REF_TRACE_INFORMATION ^ _SCONTEXT_QUEUE T _TIMER_TYPE ! R RPC_HTTP_PROXY_FREE_STRING + L PETW_TP_EVENT_TIMER_EXPIRATION_BEGIN I FILE_MODE_INFORMATION & B PPROCESSOR_PROFILE_CONTROL_AREA ; PTIME_ZONE_INFORMATION 1 SYMBOLIC_LINK_INFO_CLASS * . PROCESS_HANDLE_SNAPSHOT_INFORMATION ' # PETW_COVERAGE_SAMPLER_QUERY_INFO $ REFS_SMR_VOLUME_GC_PARAMETERS - SYSTEM_SPECULATION_CONTROL_INFORMATION $ � IO_RESOURCE_REQUIREMENTS_LIST � RTL_TREE_COMPARE_FUNCTION % � _IMAGE_DYNAMIC_RELOCATION32_V2 # TRANSACTION_LIST_ENTRY ' RTL_STACK_TRACE_DATABASE_CONTROL � PFILE_REGION_INFO � KEY_TRUST_INFORMATION � SERVICE_TRIGGER_INFO � PLUNICODE_STRING � PROCESSOR_IDLESTATE_INFO " � _SYSTEM_VA_LIST_INFORMATION � TOKEN_AUDIT_POLICY � PSYSTEM_VA_TYPE ; � PSYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION � PEMRPOLYPOLYLINE % � PERFINFO_PPM_IDLE_EXIT_LATENCY " � ALPC_PORT_INFORMATION_CLASS � tagCOLORCORRECTPALETTE � HANDLETABLE & � PPERFINFO_INTERRUPT_INFORMATION 1 � _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION % � SYSTEM_SYSTEM_DISK_INFORMATION & � _DEDUP_CHUNK_INFORMATION_HASH32 SHORT * � SYSTEM_BOOT_ENVIRONMENT_INFORMATION 3 � _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION � PCRM_PROTOCOL_ID } PTRACE_GUID_INFO " | PACCESS_DENIED_CALLBACK_ACE z MOUSEMOVEPOINT + v PERFINFO_CLOCK_INTERRUPT_INFORMATION d PPORT_MESSAGE � _TRACE_PROFILE_INTERVAL 3 a _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT ^ PTP_TASK
] PXFORM . [ _MEMORY_PARTITION_NODE_PAGE_INFORMATION W _RTL_TICK_LOCK * U PPERFINFO_FILENAME_SAME_INFORMATION , M PTOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 ' J _JOBOBJECT_ENERGY_TRACKING_STATE G EXPR_EVAL � RTL_BALANCED_NODE # E SYSTEM_PROCESSOR_INFORMATION A ETW_NOTIFICATION_TYPE ; BITMAPINFO 5 _SYSTEM_AUDIT_ACE # / PPROCESS_BASIC_INFORMATION64 - _FILE_LINKS_INFORMATION 8 ( PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY _MIDL_STUB_DESC � ETW_WNF_EVENT_UNSUBSCRIBE � PCACTCTX � _TEB_ACTIVE_FRAME # � SYSTEM_NET_RATE_CONTROL_TYPE � PRTL_HEAP_ENTRY � PWIN32_FIND_DATA $ � _ETW_HEAP_EVENT_RUNDOWN_RANGE ' � PERFINFO_DPC_ENQUEUE_INFORMATION # � PSERVERSILO_INIT_INFORMATION - � _SYSTEM_PROCESSOR_FEATURES_INFORMATION ! HEAP_EVENT_COMMIT_DECOMMIT % SECURITY_CONTEXT_TRACKING_MODE $ � PIMAGE_RUNTIME_FUNCTION_ENTRY � KCONTINUE_ARGUMENT LOCALHANDLE � LPAXISINFOA
� PINPUT � PMULTIKEYHELP � PIMAGE_THUNK_DATA64 v LDR_DDAG_STATE � ENERGY_STATE_DURATION % � PMEMORY_COMBINE_INFORMATION_EX & i PCM_PARTIAL_RESOURCE_DESCRIPTOR d PTEXTMETRICA c PEVENT_TRACE_HEADER a ALPC_WORK_ON_BEHALF_ATTR $ V PRTL_WORK_ON_BEHALF_TICKET_EX S _NDR_EXPR_DESC ) H _ETW_COVERAGE_SAMPLER_OPTION_FLAGS / K _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT G tagWNODE_ALL_DATA � RPC_CLIENT_FREE 1 A _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION . ; PPLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA 7 RPC_IMPORT_CONTEXT_P PINT_PTR 1 _FILE_FS_SIZE_INFORMATION ! - REQUEST_RAW_ENCRYPTED_DATA * LPUNIVERSAL_NAME_INFOA ) & PTRACE_PERIODIC_CAPTURE_STATE_INFO ! PTRANSACTION_LIST_ENTRY � tagWNODE_SINGLE_INSTANCE PHEAP_SUBSEGMENT_INIT LPCVOID # PTRACE_ENABLE_FLAG_EXTENSION % RTL_PROCESS_MODULE_INFORMATION " � _UMS_SCHEDULER_STARTUP_INFO ; _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION $ _TXFS_TRANSACTION_ACTIVE_INFO - _PLUGPLAY_CONTROL_TARGET_RELATION_DATA PLONG64 $ WIM_PROVIDER_INTEGRITY_STATUS 4 � _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT � LBLOB � _FILEMUIINFO ' � PROCESS_TELEMETRY_ID_INFORMATION # � FILE_STORAGE_TIER_MEDIA_TYPE ! � PRTL_IMAGE_POLICY_METADATA J PCUCHAR � RAWINPUTDEVICELIST PCSHORT � _VIRTUAL_STORAGE_TYPE � _SD_GLOBAL_CHANGE_INPUT
� VALENT � PETW_OBJECT_HANDLE_EVENT � _PSINJECTDATA � _TOKEN_AUDIT_POLICY � _WIN32_STREAM_ID � _PERFINFO_DPC_INFORMATION ' � PFILE_CASE_SENSITIVE_INFORMATION � HARDERROR_RESPONSE_OPTION � IRQ_GROUP_POLICY & � PPLUGPLAY_CONTROL_PROPERTY_DATA � EMRSELECTCOLORSPACE � PIMAGE_COR20_HEADER � MEMORYSTATUS � PCLUTF8_STRING � PCSV_NAMESPACE_INFO � _KHETERO_CPU_POLICY 7 � _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY � _numberfmtW % � PPROCESS_HANDLE_TRACING_ENABLE � PCSV_CONTROL_PARAM 7 � PSYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION } tagAXESLISTW HPCON x LDR_SECTION_INFO $ r TRANSACTION_BASIC_INFORMATION n SEC_WINNT_AUTH_IDENTITY_A � ANSI_STRING64 h PFILE_STAT_LX_INFORMATION e _TRACE_ENABLE_CONTEXT ] PSID_AND_ATTRIBUTES_HASH [ SPHANDLE V LPENUMTEXTMETRIC I_RPC_HANDLE � __n64x3 " Q PETW_FINALIZE_KTIMER2_EVENT ! N _PROCESS_BASIC_INFORMATION " H PPOWER_PLATFORM_INFORMATION F PCSCHAR C _FILE_ACCESS_INFORMATION 0 ? _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION # : _KEY_WOW64_FLAGS_INFORMATION 6 _IMAGE_POLICY_ID ~ EMRPOLYPOLYGON16 * 0 PSYSTEM_SESSION_BIGPOOL_INFORMATION + _nlsversioninfo p LPTCH ! % PNOTIFY_USER_POWER_SETTING ! " RTL_HEAP_MEMORY_LIMIT_DATA � _EVENT_INFO_CLASS # _PERFINFO_PO_SESSION_CALLOUT PXSAVE_AREA PDUPLICATE_EXTENTS_DATA32 " PHEAP_EVENT_COMMIT_DECOMMIT 2 _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY , DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO � PENUMLOGFONTEXDVA � PCEVENT_RECORD # � PFILE_MAKE_COMPATIBLE_BUFFER � TRANSACTION_NOTIFICATION � FILE_COMPRESSION_INFO 0 � SYSTEM_FEATURE_CONFIGURATION_UPDATE_ENTRY � _FILE_BASIC_INFO " � _WMI_JOB_SET_QUERY_NET_RATE � SYSTEM_TPM_INFORMATION � tagPANOSE ! � PIMAGE_ROM_OPTIONAL_HEADER � IRQ_PRIORITY � PRKCRM_PROTOCOL_BLOB � _FXSAVE_FORMAT_WX86 � PTRACE_PROFILE_INTERVAL ) � VIRTUALIZATION_INSTANCE_INFO_INPUT � PREPARSE_DATA_BUFFER � tagRID_DEVICE_INFO_HID � ACL_SIZE_INFORMATION ( o RTL_DYNAMIC_HASH_TABLE_ENUMERATOR � REMOTE_PORT_VIEW " � REFS_SMR_VOLUME_INFO_OUTPUT � _NETWORK_APP_INSTANCE_EA ! RTL_ATOM - RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY y PWMI_THREAD_INFORMATION v PLEX_READ_DATA_REQUEST STREAM_INFORMATION_ENTRY o PSYSTEM_BIGPOOL_ENTRY l CM_MCA_POS_DATA / i PACTIVATION_CONTEXT_DETAILED_INFORMATION e PHIBERFILE_BUCKET . b SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX [ FILE_STANDARD_INFO X ICMENUMPROCW RPC_CSTR $ T _SYSTEM_FILECACHE_INFORMATION < MSGBOXPARAMSA M system_handle_t " G PRTL_HEAP_MEMORY_LIMIT_INFO A PRTL_RESOURCE > EXTLOGPEN32 : tagSERIALKEYSW ' 6 IMAGE_LOAD_CONFIG_CODE_INTEGRITY , 2 JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 * PKLOCK_QUEUE_HANDLE # FILTER_BOOT_OPTION_OPERATION ) % PPERFINFO_DRIVER_COMPLETIONROUTINE PFILE_LINK_INFORMATION � PNP_VETO_TYPE LPENUMLOGFONTW LPCPINFO HEAP_SUBSEGMENT_FREE
ACE_HEADER * PDIRECTORY_NOTIFY_INFORMATION_CLASS TXFS_MODIFY_RM � PSYSDBG_CONTROL_SPACE , � _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA ' � RTL_QUERY_DEBUG_INFORMATION_INFO $ � _FILE_TYPE_NOTIFICATION_INPUT + � _VIRTUALIZATION_INSTANCE_INFO_OUTPUT � PTRACE_ENABLE_INFO & � _FILE_LINKS_FULL_ID_INFORMATION � _PERFINFO_CCSWAP � PWMI_SPINLOCK � FUNCTION_TABLE_TYPE � PTITLEBARINFOEX � PFILE_STORAGE_TIER_CLASS 0 � PRTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY � RTL_HASH_TABLE � LPPOINTS � HOOKPROC ' � PEVENT_HEADER_EXTENDED_DATA_ITEM � IMAGE_COR20_HEADER � ARM64_NT_NEON128 $ � I_RpcProxyUpdatePerfCounterFn & � SYSTEM_SHADOW_STACK_INFORMATION � PRTL_RESOURCE_DEBUG32 � LPDEVMODE ' � __PUBLIC_OBJECT_TYPE_INFORMATION | PWIN32_FIND_DATAW & y THREAD_LAST_SYSCALL_INFORMATION ' u _RTL_FEATURE_CONFIGURATION_TABLE $ m PFILE_PIPE_REMOTE_INFORMATION ! j RTL_CRITICAL_SECTION_DEBUG b PFILE_ID_INFO � PEMRSETROP2 + Z PFILE_STORAGE_RESERVE_ID_INFORMATION W RTL_TICK_LOCK Q COMMTIMEOUTS " M _WNF_STATE_NAME_INFORMATION H PFILE_SEGMENT_ELEMENT ! E _RTL_RESOURCE_POLICY_FLAGS $ B _PS_CPU_QUOTA_SET_INFORMATION < PMFT_ENUM_DATA_V1 6 � MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION 9 RTL_PROTECTED_ACCESS 3 PCOPYDATASTRUCT , # PPROCESS_EXTENDED_BASIC_INFORMATION64 ( ! PRTL_FEATURE_VARIANT_PAYLOAD_KIND PRAWINPUT TOGGLEKEYS ,
JOBOBJECT_LIMIT_VIOLATION_INFORMATION $ INVERTED_FUNCTION_TABLE_ENTRY ICONMETRICS � _EISA_PORT_DESCRIPTOR ' � _RTL_STACK_TRACE_DATABASE_CREATE intptr_t ! � PSYSTEM_DEVICE_INFORMATION # � PHOT_PATCH_INFORMATION_CLASS
� _FIXED � PLAST_EXCEPTION_LOG � CIEXYZTRIPLE � PSYSTEM_POWER_INFORMATION � LPCMENUITEMINFOA ! � PLDR_DLL_NOTIFICATION_DATA X PSINGLE_LIST_ENTRY � PSD_ENUM_SDS_INPUT # � PPERFINFO_CC_LAZY_WRITE_SCAN � KSPIN_LOCK_QUEUE � WOW64_CONTEXT � tagAXISINFOW $ _FILTER_BOOT_OPTION_OPERATION � _MEMORYSTATUS � float32x2x3_t
� _FIBER � RASTERIZER_STATUS ! � _FILE_QUERY_SPARING_BUFFER � PSHUFFLE_FILE_DATA � HANDLER_FUNCTION � COMPARTMENT_ID � _TOKEN_USER OSVERSIONINFOEX { PETW_KQUEUE_DEQUEUE_EVENT x float32x4_t h _TOKEN_GROUPS / c _EVENT_TRACE_PROFILE_COUNTER_INFORMATION & \ PERFINFO_SAMPLED_PROFILE_CONFIG 4 RTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION W DISK_SPACE_INFORMATION & S _LOGICAL_PROCESSOR_RELATIONSHIP 4 K PPERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION ( H ETW_COVERAGE_SAMPLER_OPTION_FLAGS % 6 PETW_CREATEDELETE_OBJECT_EVENT & 3 ETW_SESSION_NOTIFICATION_PACKET ( + _FILE_FS_VOLUME_FLAGS_INFORMATION ( LPHANDLER_FUNCTION_EX ! SECURITY_ATTRIBUTES POINTER_FEEDBACK_MODE EVENTSECURITYOPERATION " PPERFINFO_PROCESS_PERFCTR64 & _RTL_PROCESS_MODULE_INFORMATION * PRTL_FEATURE_CONFIGURATION_PRIORITY INT_PTR . PSYSTEM_CODEINTEGRITYPOLICY_INFORMATION PPROCESS_DISK_COUNTERS � _TRACE_GUID_INFO $ � _PERFINFO_MEM_RESET_INFO_TYPE 4 _SERVICE_PRESHUTDOWN_INFO � LPHIGHCONTRASTW � _EFI_DRIVER_ENTRY_LIST % � LPENUM_SERVICE_STATUS_PROCESSA � SE_TOKEN_USER / � _PROCESS_MITIGATION_CHILD_PROCESS_POLICY � _RTL_BARRIER � SERVICE_NOTIFY_2W � WMI_PNP_RECORD_V3 � PLOGICAL_DISK_EXTENTS $ � PFILE_DISPOSITION_INFORMATION , � SYSTEM_ISOLATED_USER_MODE_INFORMATION ! � _SYSTEM_ALARM_CALLBACK_ACE � int32x2x3_t � EVENT_INSTANCE_INFO F LIST_ENTRY � THREAD_UMS_INFORMATION � THREAD_INFORMATION_CLASS � PCHAR_INFO � PWMI_PAGE_FAULT ' _CI_LOG_SCHEDULER_SLEEP_RESPONSE y PFILE_GET_EA_INFORMATION s CLIENT_ID % � RTL_RETPOLINE_RELOCATION_INDEX p _SERVICE_FAILURE_ACTIONSA h PWMI_POWER_RECORD " e _ALPC_WORK_ON_BEHALF_TICKET � EMRBITBLT _ LPREMOTE_NAME_INFOW Y PALPC_PORT_ATTRIBUTES ! V FILE_GET_QUOTA_INFORMATION t HALF_PTR � NT_PRODUCT_TYPE ! � _MEMORY_REGION_INFORMATION O PHEAP_REGION_INFORMATION H PAXESLIST E PERFINFO_PO_PRESLEEP p PUZZTSTR ? PRAWINPUTDEVICE < CURRENCYFMT 9 PNT_TIB 2 PRPC_MESSAGE 0 RPC_EP_INQ_HANDLE x RPC_UNICODE_STRING " . _TXFS_SAVEPOINT_INFORMATION ( PFILE_DISPOSITION_INFO_EX # INPUT ! ACCESS_DENIED_CALLBACK_ACE _COVERAGE_MODULES PIMAGE_MITIGATION_POLICY
IMAGE_ARCHITECTURE_ENTRY PSTREAM_INFORMATION_ENTRY tagDEBUGHOOKINFO . _PS_PKG_CLAIM 3 � PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY " PTP_MILLISECONDS ( � PHEAP_EVENT_SUBSEGMENT_ALLOC_FREE % � ETW_THREAD_EVENT_SUBPROCESSTAG " � FILE_MAKE_COMPATIBLE_BUFFER � PCACHE_RELATIONSHIP = � ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT � LPDELETEITEMSTRUCT q EVENTLOG_HANDLE_W � PSILO_USER_SHARED_DATA 7 � PMEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION � tagACTCTXA � PRPC_RUNDOWN & � _JOURNAL_RENAME_KEY_INFORMATION � tagGLYPHSET 2 QUERY_SERVICE_CONFIG # PUINT64 � DPI_AWARENESS_CONTEXT__ � SERVICE_TABLE_ENTRYW
PUCHAR � MARK_HANDLE_INFO � _CM_KEYBOARD_DEVICE_DATA � DEVMODE � CWPSTRUCT * � EVENT_TRACE_SPINLOCK_INFORMATION_V1 � LPSTARTUPINFOW � SOUNDSENTRY ( � RTL_PROCESS_BACKTRACE_INFORMATION . z PSECURE_SPECULATION_CONTROL_INFORMATION u LPREGISTERWORDW ] _RTL_UMS_SCHEDULER_REASON p LPABC m VERIFIER_MODE j USN_RECORD_EXTENT ` PSTREAM_EXTENT_ENTRY ] _EXCEPTION_LOG_TYPE * X PPERFINFO_BOOT_PREFETCH_INFORMATION U _WAIT_TYPE ( S PJOBOBJECT_RATE_CONTROL_TOLERANCE # N _SEMAPHORE_INFORMATION_CLASS K WNF_DATA_SCOPE I CALINFO_ENUMPROCA 1 F PJOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL PPOOLINDEX
PKIRQL * D FILE_SYSTEM_RECOGNITION_INFORMATION / ? IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA m _DUPLICATE_EXTENTS_DATA * ) _SYSTEM_PLATFORM_BINARY_INFORMATION 3 LPACCEL � PCUTSTR " 0 REQUEST_OPLOCK_INPUT_BUFFER � TRACE_QUERY_INFO_CLASS ) GROUP_AFFINITY $ _XSAVE_AREA FILE_ID_128 JIT_DEBUG_INFO32 � EMRSELECTCLIPPATH EMRPOLYBEZIER PRAWMOUSE PWMI_PNP_RECORD ) _RTL_FEATURE_ENABLED_STATE_OPTIONS + � PPLUGPLAY_CONTROL_USER_RESPONSE_DATA V CURRENCYFMTW � PDIBSECTION R _EVENT_FILTER_HEADER & � _MEMORY_WORKING_SET_INFORMATION � _numberfmtA ! � PSYSTEM_AUDIT_CALLBACK_ACE � _FILE_EA_INFORMATION 5 � PSYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION $ � PTXFS_LIST_TRANSACTIONS_ENTRY � PPROCESSOR_IDLE_TIMES � PPARSE_MESSAGE_CONTEXT � PEMRBITBLT ! � _HEAP_SUBSEGMENT_ACTIVATED � RTL_QUERY_REGISTRY_TABLE � _SD_ENUM_SDS_INPUT 7 � PRTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY / � _ACTIVATION_CONTEXT_DETAILED_INFORMATION � PANSI_STRING64 � WGLSWAP � NPCWPSTRUCT � tagCURSORSHAPE � _CM_INT13_DRIVE_PARAMETER � FLS_DATA � SE_VALIDATE_MAPPING_TYPE � _TP_TASK y PEMRPOLYPOLYGON16 p FILE_REMOTE_PROTOCOL_INFO ] PMSGBOXPARAMSA * W PLDR_DLL_UNLOADED_NOTIFICATION_DATA ' T _APPLICATIONLAUNCH_SETTING_VALUE P IMEMENUITEMINFO A RPC_CLIENT_ID : LATENCY_TIME 4 SERVICE_PRESHUTDOWN_INFO . PINTERFACE_REFERENCE ( _COMMPROP $ ENUMLOGFONTEXDV uint64x1x2_t , PROCESS_MITIGATION_POLICY_INFORMATION � PTRIVERTEX � WNODE_SINGLE_INSTANCE & � PFILE_REPARSE_POINT_INFORMATION � _FLS_DATA # � REQUEST_OPLOCK_OUTPUT_BUFFER � tagPAINTSTRUCT & � PERFINFO_PPM_THERMAL_CONSTRAINT � MUTANT_OWNER_INFORMATION - � PMEMORY_PARTITION_TRANSFER_INFORMATION � WMI_FILE_IO * � PSYSTEM_PHYSICAL_MEMORY_INFORMATION & � PRTL_RETPOLINE_RELOCATION_INDEX � REDIRECTION_DESCRIPTOR ` uint32x4x2_t � PEMRSETARCDIRECTION $ � GET_RUNTIME_FUNCTION_CALLBACK " � _EVENT_INSTANCE_GUID_HEADER $ � PPERFINFO_PPM_IDLE_STATE_EXIT � TRACE_ENABLE_CONTEXT_EX � PPPM_WMI_IDLE_STATES � PPROCESSOR_GROUP_INFO # � _TRANSACTION_ENLISTMENT_PAIR 8 � PIMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION ' � PRTLP_UNHANDLED_EXCEPTION_FILTER w PWIN32_FIND_DATAA # t _IMAGE_ARCHIVE_MEMBER_HEADER k PDUPLICATE_EXTENTS_DATA � RTL_PATH_TYPE b PRTL_TRACE_ENUMERATE _ EDIT_CONTROL_FEATURE \ LOAD_ASDATA_TABLE V PCM_ROM_BLOCK " HELPPOLY ` uint8x16x2_t ! J FILE_FS_VOLUME_INFORMATION " D PFILE_FS_DEVICE_INFORMATION A _ETW_LBR_ENTRY = FP_IEEE_COMPARE_RESULT - 7 PRTL_FEATURE_USAGE_SUBSCRIPTION_TARGET 5 SYSTEM_PIXEL_FORMAT H PEBS_DS_SAVE_AREA32 ! 2 _ETW_DISABLE_KTIMER2_EVENT . PS_PKG_CLAIM p CHAR ! # IMAGE_DELAYLOAD_DESCRIPTOR ( _RTL_STACK_TRACE_DATABASE_CONTROL tagTEXTMETRICW _EVENT_TRACE_HEADER CM_PERF_COUNTERS % PROCESS_MEMORY_ALLOCATION_MODE � _ENUM_SERVICE_STATUSW � EVENT_TRACE_PROPERTIES_V2 $ � SYSTEM_RESOURCE_ATTRIBUTE_ACE � LPBITMAPINFOHEADER % � _IMAGE_DYNAMIC_RELOCATION64_V2 � LPOVERLAPPED_ENTRY � SYSGEOTYPE % � _PROCESS_DEVICEMAP_INFORMATION � tagEMRPOLYDRAW � TOKEN_MANDATORY_POLICY � _POWER_IDLE_RESILIENCY � PWNODE_EVENT_ITEM � PAPP_MEMORY_INFORMATION � PRESUME_PERFORMANCE � PTRACE_LOGFILE_HEADER64 ( � PEVENT_TRACE_SPINLOCK_INFORMATION " � PPROCESS_HANDLE_INFORMATION ) � PFILE_ID_EXTD_BOTH_DIR_INFORMATION � _WMI_PNP_RECORD_V3 " ~ PUMS_SCHEDULER_STARTUP_INFO { tagKERNINGPAIR % v _KAFFINITY_ENUMERATION_CONTEXT $ m PFILE_ID_EXTD_DIR_INFORMATION b PPOINTER_TYPE_INFO + ^ _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W ' X PPERFINFO_FILEOBJECT_INFORMATION Z SINGLE_LIST_ENTRY U _FILE_STAT_INFORMATION $ Q _ACTIVATION_CONTEXT_MSIX_INFO L tagXFORM E PPEBS_DS_SAVE_AREA32 " B KEY_VALUE_LAYER_INFORMATION < MSGBOXPARAMS 2 _QUERY_SERVICE_CONFIGA . _PROCESSOR_CACHE_TYPE ) PEMRSETWINDOWEXTEX $ LPCDLGTEMPLATEW ' PIMAGE_RESOURCE_DIRECTORY_STRING # PFILE_PIPE_LOCAL_INFORMATION 5 _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY 6 PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION (
SYSTEM_SECURITY_MODEL_INFORMATION � IO_RESOURCE_DESCRIPTOR " � PFILE_IO_PRIORITY_HINT_INFO p LPSTR � NPCANDIDATEFORM I_RPC_MUTEX � uint16x4x4_t ) float16x4_t ' � PLEAP_SECOND_DATA_REGISTRY_ENTRY " � _MEMORY_BASIC_INFORMATION64 $ � PGENERIC_BINDING_ROUTINE_PAIR ) � _PERFINFO_DRIVER_MAJORFUNCTION_RET ~ _STRING % � HEAP_REUSE_THRESHOLD_ACTIVATED � CALINFO_ENUMPROCEXW � SERVICE_STATUS_HANDLE " � ENUM_SERVICE_STATUS_PROCESS x PS_ATTRIBUTE_NUM & r _IMAGE_DYNAMIC_RELOCATION_TABLE m _OBJECT_INFORMATION_CLASS c LPENHMETAHEADER ` __n128x2 & Z _USER_MARSHAL_ROUTINE_QUADRUPLE F LPUNIVERSAL_NAME_INFO C PERFINFO_HV_HYPERCALL " TP_MILLISECONDS ? WMI_UDP * 8 _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY - HSM_OPCODE & ' PRTL_SPARSE_BITMAP_FREE_ROUTINE POUTLINETEXTMETRIC PPS_PROTECTION _FILESYSTEM_STATISTICS q PRTL_ATOM � PEMRSETPOLYFILLMODE _PERFINFO_VTL_CHANGE PSET_POWER_SETTING_VALUE OSVERSIONINFOEXA � PUZZWSTR � _SE_IMPERSONATION_STATE * � PSYSTEM_VERIFIER_TRIAGE_INFORMATION � tagMOUSEHOOKSTRUCTEX � _LDR_SERVICE_TAG_RECORD ? � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY � PMESSAGE_RESOURCE_BLOCK � MUISTRINGPOOL ) � PFILE_FS_METADATA_SIZE_INFORMATION q PZZWSTR ! � _FSCTL_OFFLOAD_WRITE_INPUT � _DUPLICATE_EXTENTS_DATA32 7 � PRTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY 0 � PCACTIVATION_CONTEXT_DETAILED_INFORMATION � _IO_COUNTERS � SYSTEM_VERIFIER_ISSUE ! � RTL_PHYSICAL_MEMORY_POLICY � _UNIVERSAL_NAME_INFOW � MEMORY_REGION_INFORMATION " � PCOPYFILE2_PROGRESS_ROUTINE � PEMRSETMAPMODE ' { PFILE_FS_DRIVER_PATH_INFORMATION p WOW64_FUNCTION_CODE64 m _HEAP_SUBSEGMENT_ALLOC & c _RTL_UMS_SCHEDULER_STARTUP_INFO V _currencyfmtW R EVENT_FILTER_HEADER M EFI_DRIVER_ENTRY , > PEVENT_TRACE_PROFILE_LIST_INFORMATION % ; _JOBOBJECT_WAKE_INFORMATION_V1 5 6 RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION ) , PFILE_MEMORY_PARTITION_INFORMATION ) ) SYSTEM_PLATFORM_BINARY_INFORMATION + " PPLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA MIDL_FORMAT_STRING u PUHALF_PTR 0 SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS PRTL_AVL_NODE PWMI_JOB_ASSIGN_PROCESS PEISA_DMA_CONFIGURATION
" PDWORD � TRACE_INFO_CLASS � PMIDL_METHOD_PROPERTY # DWORDLONG � ALPC_TOKEN_ATTR 0 � SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION � PMEM_EXTENDED_PARAMETER � PS_CREATE_INFO ) � ASSEMBLY_FILE_DETAILED_INFORMATION � PERFINFO_IPI_SEND_DATA � ENCLAVE_CREATE_INFO_SGX � ENUMRESLANGPROCA ( � LPSERVICE_DELAYED_AUTO_START_INFO ' � IMAGE_ARM_RUNTIME_FUNCTION_ENTRY % � FILE_LINKS_FULL_ID_INFORMATION
LPLONG � _WIN32_MEMORY_RANGE_ENTRY LPMENUTEMPLATEW ~ ICONINFO
s HWND__ � � � F9�6K�v�/�|S��]t�RF�W2��I ( ��wkO'�l�5l�c���~|�� ��o�O� ] f߹��R�|��ڕ����G/S�6�<��� � Ҥ��\��}7 �O~aD��0��-x���x�`<� � @ȍl2��X�1��}���e��C��>�ȢF)� � B-<y�� ��9P/�M�#��_��<�� φ6R^ � e��i�45���̯Zo�� ���q�+�<�� ! � �ý3NP� ��eb�nM `I����<�F I 5��`&N_� |�<�$���!�O]}��" n � [��t'Q��A���2��9\���h��fcY�!�?8 � ������A$խ�0� NG�%+�*�
!7�=b � �[�-%`4�����o2�>�'�q.qg�Gn��) # ���^br�ee��� ���Nǐ����5�j�Ja E �>� j�t�&~8^�B��J2�/Ru�~ h �2 Ԃ�sr |R_e(�� V�����z,v�y� � `���[4dx���By%�Г��� z�&K�-�pW � �0:s�0pV�eҐ����lj� �6�Ȗ0 � � �- ��}n�5��L���:I����R��~(�y ���{�$��N�� ��~p��o7��T�1*���. ( ƨ��T ��� Ȓ� ���)n���y��aP`I M ]�����W ��}Ν�� �lq����ϋN�Z x �k@�ʘM� p�?ho�7���Z��� �j�H� � �O�3tk#�L-�1�
��M �H�sx?�� � M�d�Q�?����:��ޅǧ8�M�%�i_&� �G�/�m��hB-����-q�b}��Y�~Y + ����̫��2r�WQ��K��TI�Up��/�z P _��';�3*� v2��hz�x����B�H� v N�Q� 4O&K�� +l;x�2�%��ݮ�pZ,� � �4Y����|��B�N��m#��*�sE��Bp�� � ����o� }�+4qt*Y lռ��́dq�X � ���O.@=4L�C�ي�m�;_�iM %q� Zڤ�~����̓s���� ��* ���k��)C� , �kE9OӨ��.I F��SY9G&��.��?堳( J �t�T�`���Niu�$�I8FQ@e�}&f�S��E�� h �D�rlBsm�DE�cQ����}W� �w��±� � S���M�"��S��U}h�g�c�q�c5w�k���8 � 0T�]�yǥ˘�0�H��I��G(����� � NM�1C����+e#����
�S�x������� ��������0TcIC4�U��m��sF'<�Z . �A+��z'����k��mD�XL���t U o�&���-�},��'�w��_�BIS;�§g
�7; z ���U7�E#�����i�r]u�`�a�j� � �*�����ou��M+K�Ŋ�;��qh� � ��7 ��������3] ��"F���:�,�U� � )\��u��ݡ�_6 mV����*���[�1�l&�! �:B{m�n=�g���\c*�ӏ���Z" ��Y = �y��� qtY��-l��|��+!so�$&� d ��*
Y,�}��Ƴ�������X���� � ��3)�J�$��{�.
w ~�/�l���M� � )G�xS�l�F,�yV���6�}�����ָ@��j � ޑV�k�J�k=Fx8� Ǫ�.Am�����ͪ� I�(��+�S�u��]?�z�9NP�3Q�MJ�B ? n*�\T�uM�fk �<�t���L�ee�#a�� a �J��W6���,�)J dɫ7�%eڭ�� � j�v��b~�ۥ�)0M�/�띡e��� \� @Z � �.r�� �A6
؇Sz�I��x{_K�<ކ�� � ~��$P �<�tv��AHE/��)�}�yS� S�O����SXn�� T�F����ZS�kk!m� I &��8�i_u& ��>�-Z%�f�>R69ϓ5�%� m ����ɵ\|5 ��Z��b���Q 3 ���kb���B � ����FAP�icû����;�|" B7�㙨^ �9 � O �2
�ש Tg���FF��ݼ�-�BS�� � 3*�ָ䊀��DJ՝�� ��q/�=M�f�t�
��.b��)���]Ý2�tW���Q�*� D
|�8�>�$�;�@�[VP��sVf*wۭg g
y3�
6$��g涧i0����
�E�g$E��$ �
�U��Q�u"��w�!� �fB"���`ru^���9 �
3E �� �r`QQ���e��e����`z� i �
4o��g-+ 2ܪܚosm�E����a��^�R�=� �
E~/EX"�-�p-���i����`��.�z#�0� " �.ו+�8W(M��6[���Z\��~���[� H ��`�\��7A���)����F)J� )��%��7 w �m�%:�|l�����h��D�m��-� �[ � �f�u�Jn\��zx�\�G����q*�V�,� � � OHa]R���s���&���\��:�yE� � ��o�ۗ��.�F��F9�37 ���9�0 �x2� F?�Z#��.Wi�/0��=�� �9*W�-� > ��ꪄ<}��}�^|�{�)D��Xh�;�� i ����#��ZF��-�wRϵI
5I�گ�Q�[d � � ��܆�f؇��"xU. @����;2}X��}H � �N�4�!Z�j��_ƒ���ﳝ3�Hf���e � 8����}ڥ��#�J�7�����"��Ѻ��^� "
D�n��q���9��a�_�G���H�E���-W��xZ E
�G�jp)X} ��L�{&<ĥ ��) oܽ� m
T�@�
2��U��p�|��� ��k����[p*& �
�n�cil�S��8�r%��V�l ��4��q��FT �
X�s.��Z���-���Q�iL0pIH� �
��a�;.+�!6�%ri� E�Q�p�u�G�g�.� 4(���+C�h5J$t�J���h 8�ϽgX�� 8 �ܟ��-@��Q�ǩ��g:��y���G�J� _ �5�-��MTo>���cߤ�K���� ͏��.~�! � ����8�����L�v���X m*����I/i�� � G�*㥬2����M���}�b�R�̫�)�� � �۠�Җ �{���� ���n"]�,$J�� � m����Wc�L����z0� ���ٶ�$< & B��V�v4�'���xܺky�3m�F�k z U C���4�h��y��t:;K�͑\�Df��1 � x 焙v GI��� ����P�
��W� � _H��i�%0�eTu ˔���3��E�+ �_� � ��dk߲#���Jq��x9���iF���>b/���� � PH<��R�N�-Ulֵ��S�O�7g�n�䯲*�� �YY�c*��}+�;hs�(s��f�i@��n��ܱ� A ���L� ���g�;�[������r���ؓ� ��� k ${E&Cv�wdGa�|}� oj�b�P�<�/ � �k�s���ӢC� �S�-z��=<� k�� � *�7�C
TQ�� ?R����֪¸��FHc�� � �Ѩ��@<���k�x+"7�><n��^� } ��da�nGۛ'�*���M���G�]����" < ˬ6�MDmc�Y � �Z���D�˸J ��2� _ �fس!�m���o�0�(P5i�W��x��3� Ob � ��(��ڲ�M�<K:��R� �-�`�#��� � �-h/� S��~����
a!�1k��j � ;�]� ��)J��5م��s<`Γ|��� � ��#YV^b%�}��/'p�O�Gʈ?��z��� # ��ˎ�jy*ƱT1A��`��#^$L �
�Ӭ �c H �*f{�ً��n��2D�x?����s>���%�؞� v 43� $���s`!?GQ61�D�� +�BNk�� � p�& ;Tt<�ѝ0捶�K߿#56�f� � � ��%|�#o5a�0i�^�{�ơz[ l���HR � /��J��5\�Z��_g4�4�%]�L�� ��3h� k�3 �G�� ��F2#�)� ER�O|��v\;� = ��V��� Ť��ڃ "��?�f�R�s�[Y�%=� g ��[��P���q�s���k̍�R���`�L � �$�����+`�.?�ʿA��=Gݗ��'Lm � @�J���ۊ�މ
��H��s��P��˓YH� � �p[F����ll�<��A�=��l}�K���R� �����y�Q+���{"WÌ�R~̟���H���? % h҄� �3(/�e��f��`�z&�e$P��MD� L ��'��,��@H4sS�k�!Ȫ:ݬ���"fE) s H�}ӰWU����f1O_�d ��Hf�
��N�nZ � -�?bF��,U1�.Er;H�Ԡ`p I��4M � %:��qI0fI�J� �ͪ�� �< � p
y��f�9����|= 6���4 ��n`�RM� N���NE���\�H3�K4��9�|f�U �Ӹ�r 4 ym�Z���y M����w�\lOU��3��)H� d X�Y
��m�kּg�L��~�g���x�5�
� �~����.P�t�OWsP-"�x#N�:�&��� � ���r��Axa?E$��N�:���i�ٯa5.�P� � ���巪�� ���0v�};��?$�N�� a 2��j�/@�R�?�_A��w�?���g�|��*c� 2 �:��2K] �
j����e�
ʪ�3k�ӭ� U 0�i�dܾ�[~uz"*���B�:�ٝy�!($� } E���ҷ ��;j�A!'���FR5��k �� � �M��wK�58�� �5h2�
/�U���R�:Jf � �*ʡZ�4��D��?� e�A� fa��A��; � W|A
w�O�?�pU]~-�2�!�\O����5� ! ��@\קĒ��$Ir�͢�)��|�u���� O �A�T:�U 3�QZ� j-r76y�c~���� n *s�4��bc�v�7���h\Sř�_s� �4�h� � �
���mcJAt�qe�el��]�;�L�� � �D&<�@)�Z?��as� z�����A��? p� � ������Q�;�[$��ۅ=@��� �,��
hV
>.r��h�#��Y��e� �y��f:h?� < �*�o�&�\b_-=�-���~���I V��� c �����C��ґtE� �W3�ې�����o� � �l��ћ��o?� �O�����:Yt�� � �o ��#�V����|G%D�VH� ,= Q�� � �� ��/�5h��d�����,�]0�f& (� �F��B�6�0A��(|� C��F�7 * '���8�#�qf �N�g����X���P���� V ���� k|)�E@���B�#���b�V�<�2Ǡ3 y ?�9��X.��~�v�{ľ �J�_%�Z[�f��� � � �S:c٭ؙo߮ ���qO>�)o��Z� � �˝u�׀߁\y�����x� �l���z3�t � ��� [r�"��衷� �R ��ҹ�� �� #^�S� q�9�s"-0#�H��'�N�"Y
�:i > �u�Մ��+�5�5�f �s�a{�:˨���Za i m��] ~_�B �3�쌰��l]��(��Q��@� � ����w�^��ȯ�
?���;��f���B(H� � '�N� 8t����A��d�W�G$���l�0"$�& � .6oA�}4�ؐ,��ǣ�
+h��4�Q�X3� �[��=�
Tǜ�
]����>d��Wƫ��� . �Jd��hy��R�*��Ll11�{SI� [ *��Q O ܇h���6
���d3�����:iW�jG^��t� r K�o��]�R2cj��
��K?C��9s�PH.] � ��z!��<y5�1�aF�=)�;ђ�)Y bčW � � onecore\external\shared\inc\pshpack2.h onecore\external\sdk\inc\mincore\systemtopologyapi.h onecore\internal\sdk\inc\ntlpcapi.h onecore\admin\wmi\events\advapi\objfre\arm64\pch_hdr.src onecore\internal\sdk\inc\ntrtl.h onecore\internal\sdk\inc\ntrtl_x.h onecore\external\sdk\inc\windows.h onecore\external\shared\inc\ip2string.h onecore\external\shared\inc\windef.h onecore\admin\wmi\events\advapi\objfre\arm64\precomp.pch onecore\external\sdk\inc\minwin\jobapi.h onecore\external\shared\inc\minwin\minwindef.h onecore\internal\sdk\inc\ntelfapi.h onecore\internal\sdk\inc\pebteb.h onecore\internal\sdk\inc\ntiolog.h onecore\external\sdk\inc\minwin\threadpoollegacyapiset.h onecore\external\ddk\inc\ntnls.h onecore\internal\sdk\inc\ntseapi.h onecore\external\sdk\inc\imm.h onecore\internal\sdk\inc\ntconfig.h onecore\internal\sdk\inc\ntseapi_x.h onecore\external\sdk\inc\mincore\jobapi2.h onecore\external\sdk\inc\mincore\processtopologyapi.h onecore\external\sdk\inc\minwin\synchapi.h onecore\external\sdk\inc\minwin\libloaderapi.h onecore\internal\sdk\inc\ntwow64.h onecore\internal\sdk\inc\ntwow64_x.h onecore\external\sdk\inc\crt\stddef.h onecore\internal\sdk\inc\warning.h onecore\internal\sdk\inc\suppress_x.h onecore\admin\wmi\events\advapi\precomp.h shared\inc\winapifamily.h onecore\external\sdk\inc\minwin\winreg.h onecore\internal\sdk\inc\nt.h shared\inc\winpackagefamily.h onecore\external\shared\inc\kernelspecs.h onecore\external\sdk\inc\crt\excpt.h onecore\external\sdk\inc\reason.h onecore\external\sdk\inc\minwin\stringapiset.h onecore\external\shared\inc\basetsd.h onecore\external\sdk\inc\crt\crtdefs.h onecore\internal\sdk\inc\rtlrbtree.h onecore\external\sdk\inc\crt\arm64intr.h onecore\external\shared\inc\specstrings.h onecore\external\sdk\inc\wincon.h onecore\internal\sdk\inc\minwin\xstateapi.h onecore\external\shared\inc\sal.h onecore\external\sdk\inc\wincontypes.h onecore\external\shared\inc\sdkddkver.h onecore\external\shared\inc\concurrencysal.h onecore\internal\sdk\inc\minwin\ntpnpapi.h onecore\external\sdk\inc\crt\arm64_neon.h onecore\external\shared\inc\specstrings_strict.h onecore\external\shared\inc\cfg.h onecore\external\ddk\inc\ntpoapi.h onecore\external\shared\inc\specstrings_undef.h onecore\external\sdk\inc\minwin\securityappcontainer.h onecore\external\sdk\inc\minwin\interlockedapi.h onecore\external\sdk\inc\minwin\utilapiset.h onecore\external\sdk\inc\ntassert.h onecore\external\shared\inc\driverspecs.h onecore\external\shared\inc\sdv_driverspecs.h onecore\admin\wmi\events\idl\elf\objfre\arm64\elf.h onecore\external\sdk\inc\crt\vadefs.h onecore\external\shared\inc\rpcndr.h onecore\external\sdk\inc\rpcnsip.h onecore\internal\sdk\inc\nturtl.h onecore\internal\sdk\inc\minwin\ntdef_p.h onecore\internal\sdk\inc\ntpsapi.h onecore\external\shared\inc\pshpck16.h onecore\internal\sdk\inc\ntpsapi_x.h onecore\external\shared\inc\rpcdcep.h onecore\external\sdk\inc\mincore\consoleapi3.h onecore\external\sdk\inc\minwin\realtimeapiset.h onecore\external\sdk\inc\rpcnsi.h onecore\external\sdk\inc\minwin\fibersapi.h onecore\external\sdk\inc\wingdi.h onecore\external\shared\inc\guiddef.h onecore\external\sdk\inc\minwin\ioapiset.h onecore\external\sdk\inc\minwin\enclaveapi.h onecore\internal\sdk\inc\volatile_accessors.h onecore\admin\wmi\events\advapi\elfcommn.h onecore\external\sdk\inc\minwin\threadpoolapiset.h onecore\internal\sdk\inc\nttpapi.h onecore\internal\sdk\inc\minwin\ntetw.h onecore\internal\sdk\inc\minwin\umstls.h onecore\external\sdk\inc\evntcons.h onecore\external\sdk\inc\minwin\processthreadsapi.h onecore\internal\sdk\inc\ntxcapi.h onecore\external\shared\inc\evntprov.h onecore\admin\wmi\events\idl\imports.h onecore\external\shared\inc\tvout.h onecore\internal\sdk\inc\ntxcapi_x.h onecore\external\shared\inc\pshpack8.h onecore\internal\sdk\inc\ntrtlstringandbuffer.h onecore\external\shared\inc\ntstatus.h onecore\external\sdk\inc\minwin\namedpipeapi.h onecore\internal\sdk\inc\ntkeapi.h onecore\external\sdk\inc\crt\string.h onecore\external\sdk\inc\minwin\profileapi.h onecore\external\sdk\inc\minwin\handleapi.h onecore\internal\sdk\inc\ntkeapi_x.h onecore\external\shared\inc\rpcsal.h onecore\external\sdk\inc\fileapifromapp.h onecore\external\sdk\inc\minwin\fileapi.h onecore\external\sdk\inc\minwin\apiquery2.h onecore\internal\sdk\inc\minwin\ntregapi.h onecore\external\sdk\inc\minwin\heapapi.h onecore\internal\sdk\inc\ntregapi_x.h onecore\external\sdk\inc\winbase.h onecore\external\sdk\inc\minwin\processenv.h onecore\external\sdk\inc\minwin\minwinbase.h onecore\internal\sdk\inc\ntobapi.h onecore\external\shared\inc\rpc.h onecore\internal\sdk\inc\ntobapi_x.h onecore\external\shared\inc\rpcdce.h onecore\external\sdk\inc\minwin\wow64apiset.h onecore\external\sdk\inc\minwin\securitybaseapi.h onecore\external\shared\inc\stralign.h onecore\internal\sdk\inc\rtlhashdef.h onecore\internal\sdk\inc\ntmmapi.h onecore\internal\sdk\inc\ntmmapi_x.h onecore\internal\sdk\inc\minwin\ntioapi.h onecore\external\sdk\inc\winuser.h onecore\external\shared\inc\devioctl.h onecore\internal\sdk\inc\minwin\ntioapi_x.h onecore\internal\sdk\inc\nttmapi.h onecore\internal\sdk\inc\ntrtlpath.h onecore\external\shared\inc\ktmtypes.h onecore\external\shared\inc\pshpack1.h onecore\external\sdk\inc\minwin\rtlsupportapi.h onecore\internal\sdk\inc\affinity.h onecore\external\sdk\inc\winsvc.h onecore\external\shared\inc\minwin\apiset.h onecore\external\sdk\inc\mcx.h onecore\external\sdk\inc\mincore\namespaceapi.h onecore\external\shared\inc\minwin\apisetcconv.h onecore\external\sdk\inc\winver.h onecore\external\sdk\inc\winnetwk.h onecore\external\sdk\inc\minwin\verrsrc.h onecore\external\sdk\inc\minwin\consoleapi.h onecore\external\shared\inc\wnnc.h onecore\internal\sdk\inc\minwin\ntwmi.h onecore\external\sdk\inc\minwin\errhandlingapi.h onecore\internal\sdk\inc\minwin\ntwmi_x.h onecore\external\sdk\inc\winnls.h onecore\external\shared\inc\dpfilter.h onecore\external\sdk\inc\minwin\datetimeapi.h onecore\external\ddk\inc\mce.h onecore\internal\sdk\inc\ntldr.h onecore\external\shared\inc\poppack.h onecore\internal\sdk\inc\rtlfeatureconfigtypes.h onecore\external\shared\inc\rpcnterr.h onecore\external\sdk\inc\mincore\consoleapi2.h onecore\external\shared\inc\winerror.h onecore\internal\com\inc\ntrpcp.h onecore\external\sdk\inc\nxarm64.h onecore\external\sdk\inc\minwin\sysinfoapi.h onecore\external\sdk\inc\minwin\minappmodel.h onecore\external\shared\inc\evntrace.h onecore\external\sdk\inc\minwin\memoryapi.h onecore\internal\sdk\inc\ntexapi.h onecore\external\sdk\inc\crt\intrin.h onecore\internal\sdk\inc\ntexapi_x.h onecore\external\sdk\inc\crt\setjmp.h onecore\external\sdk\inc\crt\stdarg.h onecore\external\sdk\inc\minwin\timezoneapi.h onecore\external\sdk\inc\minwin\debugapi.h onecore\external\sdk\inc\ntarm64.h onecore\external\shared\inc\minwin\ntdef.h onecore\external\sdk\inc\minwin\ime_cmodes.h onecore\external\sdk\inc\ntarm64_x.h onecore\external\sdk\inc\crt\ctype.h onecore\external\sdk\inc\wmium.h onecore\external\ddk\inc\ntimage.h onecore\external\shared\inc\wmistr.h onecore\external\shared\inc\pshpack4.h � L�^ � ��
\ \ / /
� ' %
x RtlNtPathSeperatorString
� 1 /
x RtlAlternateDosPathSeperatorString
� ) '
x RtlDosPathSeperatorsString
��
" ��
��
t ��
u ��
� 6 � LIST_ENTRY64 .?AULIST_ENTRY64@@ ��
"
# Flink
# Blink 6 LIST_ENTRY64 .?AULIST_ENTRY64@@ ��2 onecore\external\shared\inc\minwin\ntdef.h �
� 6 � LIST_ENTRY32 .?AULIST_ENTRY32@@ ��
"
" Flink
" Blink 6 LIST_ENTRY32 .?AULIST_ENTRY32@@ �� �
p ��
# #
q ��
# #
�" __n64 .?AT__n64@@
# " � u " � ! " � " � " � t " � " � p " � @ " � A " ��
n64_u64 ��
n64_u32 ��
n64_u16 ��
! n64_u8 ���
" n64_i64 ��
# n64_i32 ��
$ n64_i16 ��
% n64_i8 ���
& n64_f32 ��
' n64_f64 ��
&( __n64 .?AT__n64@@ 2 onecore\external\sdk\inc\crt\arm64_neon.h �� ) * T
��
,
��
.
��
1
��
3
! ��
5
# ��
8
��
:
! ��
<
@ ��
>
p ��
@
p ��
B
p ��
D
p ��
F
��
H
��
J
��
L
��
N
��
P
t ��
R
��
T
t ��
V
��
X
��
Z
��
\
��
^
A p `
a
��
c
��
e E p g
h
��
j
��
l
I n
o
! ��
q M s
t
! ��
v
Q x
y
" ��
{ U }
~
" ��
�
Y �
�
# ��
� ] �
�
# ��
�
�
� � SE_WS_APPX_SIGNATURE_ORIGIN_NOT_VALIDATED SE_WS_APPX_SIGNATURE_ORIGIN_UNKNOWN �� SE_WS_APPX_SIGNATURE_ORIGIN_APPSTORE � SE_WS_APPX_SIGNATURE_ORIGIN_WINDOWS �� SE_WS_APPX_SIGNATURE_ORIGIN_ENTERPRISE ���N t � SE_WS_APPX_SIGNATURE_ORIGIN .?AW4SE_WS_APPX_SIGNATURE_ORIGIN@@ �* onecore\internal\sdk\inc\ntseapi.h � � � � PS_MITIGATION_OPTION_NX �� PS_MITIGATION_OPTION_SEHOP ��� PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES ��� PS_MITIGATION_OPTION_HEAP_TERMINATE �� PS_MITIGATION_OPTION_BOTTOM_UP_ASLR �� PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR ��� PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE �� PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE � PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE ���
PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD �� PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES PS_MITIGATION_OPTION_FONT_DISABLE
PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL � PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32 �� PS_MITIGATION_OPTION_RETURN_FLOW_GUARD ��� PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY � PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD ��� PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT � PS_MITIGATION_OPTION_ROP_STACKPIVOT �� PS_MITIGATION_OPTION_ROP_CALLER_CHECK PS_MITIGATION_OPTION_ROP_SIMEXEC � PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER ��� PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS �� PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION � PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER ��� PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION � PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION � PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY � PS_MITIGATION_OPTION_CET_USER_SHADOW_STACKS �� PS_MITIGATION_OPTION_USER_CET_SET_CONTEXT_IP_VALIDATION �� ! PS_MITIGATION_OPTION_BLOCK_NON_CET_BINARIES �� $ PS_MITIGATION_OPTION_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY ���B # t � _PS_MITIGATION_OPTION .?AW4_PS_MITIGATION_OPTION@@ �* onecore\internal\sdk\inc\ntpsapi.h � � � �
# R � _PS_MITIGATION_OPTIONS_MAP .?AU_PS_MITIGATION_OPTIONS_MAP@@ �� # " �
� Map ��R � _PS_MITIGATION_OPTIONS_MAP .?AU_PS_MITIGATION_OPTIONS_MAP@@ �� � � m
� ^ � _PS_MITIGATION_AUDIT_OPTIONS_MAP .?AU_PS_MITIGATION_AUDIT_OPTIONS_MAP@@ ��
� Map ��^ � _PS_MITIGATION_AUDIT_OPTIONS_MAP .?AU_PS_MITIGATION_AUDIT_OPTIONS_MAP@@ �� � � �
� B � _KUSER_SHARED_DATA .?AU_KUSER_SHARED_DATA@@ ��
� 6 � _KSYSTEM_TIME .?AU_KSYSTEM_TIME@@
� �� q " �J NtProductWinNt ��� NtProductLanManNt NtProductServer ��: t � _NT_PRODUCT_TYPE .?AW4_NT_PRODUCT_TYPE@@ ��� � � " � " @ �B StandardDesign ��� NEC98x86 � EndAlternatives ��V t � _ALTERNATIVE_ARCHITECTURE_TYPE .?AW4_ALTERNATIVE_ARCHITECTURE_TYPE@@ ���. onecore\internal\sdk\inc\ntexapi_x.h ��� � � � 2 � _LARGE_INTEGER .?AT_LARGE_INTEGER@@ ��
��
��
��
�� " �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" �� " " � # " � " " � " " � ! " �
# ��F � _XSTATE_CONFIGURATION .?AU_XSTATE_CONFIGURATION@@ B
" TickCountLowDeprecated ���
" TickCountMultiplier ��
� InterruptTime
� SystemTime ���
� TimeZoneBias �
! , ImageNumberLow ���
! . ImageNumberHigh ��
� 0 NtSystemRoot �
" 8MaxStackTraceDepth ���
" <CryptoExponent ���
" @TimeZoneId ���
" DLargePageMinimum �
" HAitSamplingValue �
" LAppCompatFlag
# PRNGSeedVersion ���
" XGlobalValidationRunlevel �
T \TimeZoneBiasStamp
" `NtBuildNumber
� dNtProductType
hProductTypeIsValid ���
� iReserved0
! jNativeProcessorArchitecture ��
" lNtMajorVersion ���
" pNtMinorVersion ���
� tProcessorFeatures
" �Reserved1
" �Reserved3
� �TimeSlip �
� �AlternativeArchitecture ��
" �BootId ���
� �SystemExpirationDate �
" �SuiteMask
�KdDebuggerEnabled
�MitigationPolicies ���
� �NXSupportPolicy ��
� �SEHValidationPolicy ��
� �CurDirDevicesSkippedForDlls ��
� �Reserved �
! �CyclesPerYield ���
� �ActiveConsoleId ��
� �DismountCount
" �ComPlusPackage ���
" �LastSystemRITEventTickCount ��
" �NumberOfPhysicalPages
�SafeBootMode �
�VirtualizationFlags ��
� �Reserved12 ���
" �SharedDataFlags ��
� �DbgErrorPortPresent ��
� �DbgElevationEnabled ��
� �DbgVirtEnabled ���
� �DbgInstallerDetectEnabled
� �DbgLkgEnabled
� �DbgDynProcessorEnabled ���
� �DbgConsoleBrokerEnabled ��
� �DbgSecureBootEnabled �
� �DbgMultiSessionSku ���
� �DbgMultiUsersInSessionSku
� �DbgStateSeparationEnabled
� �SpareBits
� �DataFlagsPad �
# �TestRetInstruction ���
QpcFrequency �
" SystemCall ���
" Reserved2
� SystemCallPad
� TickCount
� TickCountQuad
� ReservedTickCountOverlay �
� ,TickCountPad �
" 0Cookie ���
� 4CookiePad
8ConsoleSessionForegroundProcessId
# @TimeUpdateLock ���
# HBaselineSystemTimeQpc
# PBaselineInterruptTimeQpc �
# XQpcSystemTimeIncrement ���
# `QpcInterruptTimeIncrement
hQpcSystemTimeIncrementShift ��
iQpcInterruptTimeIncrementShift ���
! jUnparkedProcessorCount ���
� lEnclaveFeatureMask ���
" |TelemetryCoverageRound ���
� �UserModeGlobalLogger �
" �ImageFileExecutionOptions
" �LangGenerationCount ��
# �Reserved4
� �InterruptTimeBias
� �QpcBias ��
" �ActiveProcessorCount �
j �ActiveGroupCount �
�Reserved9
! �QpcData ��
j �QpcBypassEnabled �
�QpcShift �
� �TimeZoneBiasEffectiveStart ���
� �TimeZoneBiasEffectiveEnd �
� �XState ���
� FeatureConfigurationChangeStamp ��
" Spare B d � _KUSER_SHARED_DATA .?AU_KUSER_SHARED_DATA@@ �� � �
� # �
� 2 � _ULARGE_INTEGER .?AT_ULARGE_INTEGER@@ *
" LowPart ��
" HighPart �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � J
" LowPart ��
" HighPart �
� u
# QuadPart �2 � _ULARGE_INTEGER .?AT_ULARGE_INTEGER@@ � �
� # �
� �
� J � _TP_CALLBACK_ENVIRON_V3 .?AU_TP_CALLBACK_ENVIRON_V3@@
� . � _TP_POOL .?AU_TP_POOL@@ ��
� > � _TP_CLEANUP_GROUP .?AU_TP_CLEANUP_GROUP@@
� �
� B � _ACTIVATION_CONTEXT .?AU_ACTIVATION_CONTEXT@@
� F � _TP_CALLBACK_INSTANCE .?AU_TP_CALLBACK_INSTANCE@@
� � �
�
" ��
" ��
" ��F
� LongFunction �
� Persistent ���
� Private ��: � <anonymous-tag> .?AU<anonymous-tag>@@ * onecore\internal\sdk\inc\nttpapi.h � � � !
" Flags
� s 2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � � TP_CALLBACK_PRIORITY_HIGH TP_CALLBACK_PRIORITY_NORMAL �� TP_CALLBACK_PRIORITY_LOW � TP_CALLBACK_PRIORITY_INVALID � TP_CALLBACK_PRIORITY_COUNT ���B t � _TP_CALLBACK_PRIORITY .?AW4_TP_CALLBACK_PRIORITY@@ � � � J �
" Version ��
� Pool �
� CleanupGroup �
� CleanupGroupCancelCallback ���
RaceDll ��
� ( ActivationContext
� 0 FinalizationCallback �
� 8 u
� < CallbackPriority �
" @ Size �J
� H _TP_CALLBACK_ENVIRON_V3 .?AU_TP_CALLBACK_ENVIRON_V3@@ � �
�
�
�
�
�
� & � _TEB .?AU_TEB@@ ��
* � _NT_TIB .?AU_NT_TIB@@ 2 � _CLIENT_ID .?AU_CLIENT_ID@@ ��& � _PEB .?AU_PEB@@ ��
" " h � " " � " � � " � � p "
�N � _ACTIVATION_CONTEXT_STACK .?AU_ACTIVATION_CONTEXT_STACK@@ " � " �
: � _GDI_TEB_BATCH .?AU_GDI_TEB_BATCH@@ �� # " � � " H � # " � �: � _UNICODE_STRING .?AU_UNICODE_STRING@@ q "
� " � " �2 � _LIST_ENTRY .?AU_LIST_ENTRY@@ " � " X �& � _GUID .?AU_GUID@@ > � _PROCESSOR_NUMBER .?AU_PROCESSOR_NUMBER@@
> � _TEB_ACTIVE_FRAME .?AU_TEB_ACTIVE_FRAME@@
"
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��
! ��
NtTib
8 EnvironmentPointer ���
@ ClientId �
P ActiveRpcHandle ��
X ThreadLocalStoragePointer
` ProcessEnvironmentBlock ��
" h LastErrorValue ���
" l CountOfOwnedCriticalSections �
p CsrClientThread ��
x Win32ThreadInfo ��
� User32Reserved ���
� UserReserved �
WOW32Reserved
" CurrentLocale
" FpSoftwareStatusRegister �
ReservedForDebuggerInstrumentation ���
�SystemReserved1 ��
p �PlaceholderCompatibilityMode �
�PlaceholderHydrationAlwaysExplicit ���
�PlaceholderReserved ��
" �ProxiedProcessId �
�_ActivationStack �
�WorkingOnBehalfTicket
�ExceptionCode
�Padding0 �
�ActivationContextStackPointer
# �InstrumentationCallbackSp
# �InstrumentationCallbackPreviousPc
# �InstrumentationCallbackPreviousSp
" �TxFsContext ��
�InstrumentationCallbackDisabled ��
�UnalignedLoadStoreExceptions �
� �Padding1 �
�GdiTebBatch ��
�RealClientId �
�GdiCachedProcessHandle ���
" �GdiClientPID �
" �GdiClientTID �
�GdiThreadLocalInfo ���
Win32ClientInfo ��
� glDispatchTable ��
8glReserved1 ��
glReserved2 ��
(glSectionInfo
0glSection
8glTable ��
@glCurrentRC ��
HglContext
" PLastStatusValue ��
TPadding2 �
XStaticUnicodeString ��
hStaticUnicodeBuffer ��
rPadding3 �
xDeallocationStack
�TlsSlots �
�TlsLinks �
�Vdm ��
�ReservedForNtRpc �
�DbgSsReserved
" �HardErrorMode
�Padding4 �
�Instrumentation ��
ActivityId ���
SubProcessTag
(PerflibData ��
0EtwTraceData �
8WinSockData ��
" @GdiBatchCount
DCurrentIdealProcessor
" DIdealProcessorValue ��
DReservedPad0 �
EReservedPad1 �
FReservedPad2 �
GIdealProcessor ���
" HGuaranteedStackBytes �
LPadding5 �
PReservedForPerf ��
XReservedForOle ���
" `WaitingOnLoaderLock ��
dPadding6 �
hSavedPriorityState ���
# pReservedForCodeCoverage ��
xThreadPoolData ���
! �TlsExpansionSlots
�DeallocationBStore ���
�BStoreLimit ��
" �MuiGeneration
" �IsImpersonating ��
�NlsCache �
�pShimData
" �HeapData �
�Padding7 �
�CurrentTransactionHandle �
# �ActiveFrame ��
�FlsData ��
�PreferredLanguages ���
�UserPrefLanguages
�MergedPrefLanguages ��
" �MuiImpersonation �
v �CrossTebFlags
$ �SpareCrossTebBits
! �SameTebFlags �
% �SafeThunkCall
& �InDebugPrint �
' �HasFiberData �
( �SkipThreadAttach �
) �WerInShipAssertCode ��
* �RanProcessInit ���
+ �ClonedThread �
, �SuppressDebugMsg �
- �DisableUserStackWalk �
. �RtlExceptionAttached �
/ �InitialThread
0 �SessionAware �
1 �LoadOwner
2 �LoaderWorker �
3 �SkipLoaderInit ���
4 �SpareSameTebBits �
�TxnScopeEnterCallback
�TxnScopeExitCallback �
TxnScopeContext ��
" LockCount
WowTebOffset �
ResourceRetValue �
ReservedForWdf ���
# ReservedForCrt ���
(EffectiveContainerId �& 5 8_TEB .?AU_TEB@@ ��* onecore\internal\sdk\inc\pebteb.h �� 6 7 �
Z � _EXCEPTION_REGISTRATION_RECORD .?AU_EXCEPTION_REGISTRATION_RECORD@@ ��
:
�
; ExceptionList
StackBase
StackLimit ���
SubSystemTib �
FiberData
" Version ��
( ArbitraryUserPointer �
< 0 Self �* = 8 _NT_TIB .?AU_NT_TIB@@ . onecore\internal\sdk\inc\ntpsapi_x.h ��� > ? �
A
"
D Flink
D Blink 2 E _LIST_ENTRY .?AU_LIST_ENTRY@@ F Y
D
��
I
K
" M
N P
Q
C S
T B � _SINGLE_LIST_ENTRY .?AU_SINGLE_LIST_ENTRY@@ ��
V
V
X Next �B Y _SINGLE_LIST_ENTRY .?AU_SINGLE_LIST_ENTRY@@ �� Z c
X > � _RTL_SPLAY_LINKS .?AU_RTL_SPLAY_LINKS@@ ��
]
] B
_ Parent ���
_ LeftChild
_ RightChild ���> ` _RTL_SPLAY_LINKS .?AU_RTL_SPLAY_LINKS@@ ��* onecore\internal\sdk\inc\ntrtl_x.h � a b x
_ Z � _RTL_DYNAMIC_HASH_TABLE_CONTEXT .?AU_RTL_DYNAMIC_HASH_TABLE_CONTEXT@@
e B
C ChainHead
C PrevLinkage ��
# Signature Z g _RTL_DYNAMIC_HASH_TABLE_CONTEXT .?AU_RTL_DYNAMIC_HASH_TABLE_CONTEXT@@ h b ,
C b � _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR .?AU_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR@@ ��
k V � _RTL_DYNAMIC_HASH_TABLE_ENTRY .?AU_RTL_DYNAMIC_HASH_TABLE_ENTRY@@ V
m HashEntry
C CurEntry �
C ChainHead
" BucketIndex ��b n ( _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR .?AU_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR@@ �� o b 2 J � _RTL_DYNAMIC_HASH_TABLE .?AU_RTL_DYNAMIC_HASH_TABLE@@
q �
" Flags
" Shift
" TableSize
" Pivot
" DivisorMask ��
" NumEntries ���
" NonEmptyBuckets ��
" NumEnumerators ���
Directory J s ( _RTL_DYNAMIC_HASH_TABLE .?AU_RTL_DYNAMIC_HASH_TABLE@@ t b ;
B
! Length ���
! MaximumLength
q Buffer ���: w _UNICODE_STRING .?AU_UNICODE_STRING@@ x
q * � _STRING .?AU_STRING@@
{ B
! Length ���
! MaximumLength
p Buffer ���* } _STRING .?AU_STRING@@ ~ �
p *
" LowPart ��
HighPart �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � J
" LowPart ��
HighPart �
� u
QuadPart �2 � _LARGE_INTEGER .?AT_LARGE_INTEGER@@ �� � �
� & � _LUID .?AU_LUID@@ *
" LowPart ��
HighPart �& � _LUID .?AU_LUID@@ � � b � _CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG .?AU_CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG@@
�
q ��
� &
" Size �
� TriggerId b � _CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG .?AU_CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG@@ � b &
� B � _IMAGE_NT_HEADERS64 .?AU_IMAGE_NT_HEADERS64@@
� B � _IMAGE_FILE_HEADER .?AU_IMAGE_FILE_HEADER@@ ��N � _IMAGE_OPTIONAL_HEADER64 .?AU_IMAGE_OPTIONAL_HEADER64@@ ��J
" Signature
� FileHeader ���
� OptionalHeader ���B � _IMAGE_NT_HEADERS64 .?AU_IMAGE_NT_HEADERS64@@ * onecore\external\ddk\inc\ntimage.h � � � v > � _IMAGE_DOS_HEADER .?AU_IMAGE_DOS_HEADER@@
� ! " � ! " �n
! e_magic ��
! e_cblp ���
! e_cp �
! e_crlc ���
! e_cparhdr
!
e_minalloc ���
! e_maxalloc ���
! e_ss �
! e_sp �
! e_csum ���
! e_ip �
! e_cs �
! e_lfarlc �
! e_ovno ���
� e_res
! $ e_oemid ��
! & e_oeminfo
� ( e_res2 ���
< e_lfanew �> � @ _IMAGE_DOS_HEADER .?AU_IMAGE_DOS_HEADER@@ � � E ! " � ! " �6 � _RTL_RB_TREE .?AU_RTL_RB_TREE@@ ��
� B � _RTL_BALANCED_NODE .?AU_RTL_BALANCED_NODE@@ ��
�
��6
� Root �
� Encoded ��
� Min ��6 � _RTL_RB_TREE .?AU_RTL_RB_TREE@@ ��. onecore\internal\sdk\inc\rtlrbtree.h ��� � � ,
�
� � " �
��
��r
� Children �
� Left �
� Right
� Red ��
� Balance ��
# ParentValue ��B � _RTL_BALANCED_NODE .?AU_RTL_BALANCED_NODE@@ �� � r
� � �
�
� � � " � �
�
� � �
� � � " �
� � �
� � � " � �
� � � " � �
� � � " � �
� � " � �
� � � " � �
� � " �
�
� � �
� � � � �
� 6 � _RTL_AVL_TREE .?AU_RTL_AVL_TREE@@
�
�
� Root �6 � _RTL_AVL_TREE .?AU_RTL_AVL_TREE@@ � � 6
� � � �
�
� �
� � � � �
� � � � �
� � � � �
�
B
" Data1
! Data2
! Data3
! Data4 & � _GUID .?AU_GUID@@ . onecore\external\shared\inc\guiddef.h �� � �
& # # " " " �
�
� �
� �
� � �
�
� �
q q
q ��
� t
q ��
t
t
!
t #
$ q q &
'
q * +
, * * .
/ q # t 1
2
# 4
5 t 7
8 J � _EVENT_DATA_DESCRIPTOR .?AU_EVENT_DATA_DESCRIPTOR@@ ��
: n
# Ptr ��
" Size �
" Reserved �
Type �
Reserved1
! Reserved2 J < _EVENT_DATA_DESCRIPTOR .?AU_EVENT_DATA_DESCRIPTOR@@ ��. onecore\external\shared\inc\evntprov.h � = > � > � _EVENT_DESCRIPTOR .?AU_EVENT_DESCRIPTOR@@
@ �
! Id ���
Version ��
Channel ��
Level
Opcode ���
! Task �
# Keyword ��> B _EVENT_DESCRIPTOR .?AU_EVENT_DESCRIPTOR@@ C > �
@ ��
E
! ��
G
��
I
# ��
K 6 � _EVENT_RECORD .?AU_EVENT_RECORD@@
M ��
N 6 � _EVENT_HEADER .?AU_EVENT_HEADER@@ B � _ETW_BUFFER_CONTEXT .?AU_ETW_BUFFER_CONTEXT@@ ^ � _EVENT_HEADER_EXTENDED_DATA_ITEM .?AU_EVENT_HEADER_EXTENDED_DATA_ITEM@@ ��
R �
P EventHeader ��
Q P BufferContext
! T ExtendedDataCount
! V UserDataLength ���
S X ExtendedData �
` UserData �
h UserContext ��6 T p _EVENT_RECORD .?AU_EVENT_RECORD@@ * onecore\external\sdk\inc\evntcons.h U V �
! ��
X
p ��
Z
! ��
\ B � _PERFINFO_GROUPMASK .?AU_PERFINFO_GROUPMASK@@
^ " " �
` Masks B a _PERFINFO_GROUPMASK .?AU_PERFINFO_GROUPMASK@@ . onecore\internal\sdk\inc\minwin\ntwmi.h b c �
"
� # # # g
h
��
j p " �� ProcThreadAttributeParentProcess � ProcThreadAttributeHandleList ProcThreadAttributeGroupAffinity � ProcThreadAttributePreferredNode � ProcThreadAttributeIdealProcessor ProcThreadAttributeUmsThread � ProcThreadAttributeMitigationPolicy �� ProcThreadAttributeSecurityCapabilities �� ProcThreadAttributeProtectionLevel ���
ProcThreadAttributeJobList ��� ProcThreadAttributeChildProcessPolicy ProcThreadAttributeAllApplicationPackagesPolicy �� ProcThreadAttributeWin32kFilter �� ProcThreadAttributeSafeOpenPromptOriginClaim � ProcThreadAttributeDesktopAppPolicy �� ProcThreadAttributePseudoConsole � ProcThreadAttributeMitigationAuditPolicy �N t m _PROC_THREAD_ATTRIBUTE_NUM .?AW4_PROC_THREAD_ATTRIBUTE_NUM@@ ���* onecore\external\sdk\inc\winbase.h � n o �
* � HWND__ .?AUHWND__@@ ��
t unused ���* r HWND__ .?AUHWND__@@ ��. onecore\external\shared\inc\windef.h ��� s t ' J AuditEventObjectAccess ��� AuditEventDirectoryServiceAccess �: t v _AUDIT_EVENT_TYPE .?AW4_AUDIT_EVENT_TYPE@@ �. onecore\internal\sdk\inc\ntseapi_x.h ��� w x N . � _ICONINFO .?AU_ICONINFO@@ . � HBITMAP__ .?AUHBITMAP__@@
{ b
t fIcon
" xHotspot �
" yHotspot �
| hbmMask ��
| hbmColor �. } _ICONINFO .?AU_ICONINFO@@ * onecore\external\sdk\inc\winuser.h � ~ �) N � _WIN32_MEMORY_RANGE_ENTRY .?AU_WIN32_MEMORY_RANGE_ENTRY@@ 6
VirtualAddress ���
# NumberOfBytes N � _WIN32_MEMORY_RANGE_ENTRY .?AU_WIN32_MEMORY_RANGE_ENTRY@@ 2 onecore\external\sdk\inc\minwin\memoryapi.h � � � j SmrGcActionStart � SmrGcActionStartFullSpeed SmrGcActionPause � SmrGcActionStop ��N t � _REFS_SMR_VOLUME_GC_ACTION .?AW4_REFS_SMR_VOLUME_GC_ACTION@@ ���2 onecore\internal\sdk\inc\minwin\ntioapi_x.h � � � Z � _FILE_LINKS_FULL_ID_INFORMATION .?AU_FILE_LINKS_FULL_ID_INFORMATION@@ f � _FILE_LINK_ENTRY_FULL_ID_INFORMATION .?AU_FILE_LINK_ENTRY_FULL_ID_INFORMATION@@ ��F
" BytesNeeded ��
" EntriesReturned ��
� Entry Z � $ _FILE_LINKS_FULL_ID_INFORMATION .?AU_FILE_LINKS_FULL_ID_INFORMATION@@ � � � ^ � _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM_RUNTIME_FUNCTION_ENTRY@@
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
"
���
" BeginAddress �
" UnwindData ���
� Flag �
� FunctionLength ���
� Ret ��
� H
� Reg ��
� R
� L
� C
� StackAdjust ��^ � _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM_RUNTIME_FUNCTION_ENTRY@@ � � � ^ � _SERVICE_DELAYED_AUTO_START_INFO .?AU_SERVICE_DELAYED_AUTO_START_INFO@@ ��
�
t fDelayedAutostart ^ � _SERVICE_DELAYED_AUTO_START_INFO .?AU_SERVICE_DELAYED_AUTO_START_INFO@@ ��* onecore\external\sdk\inc\winsvc.h �� � � < 2 � HINSTANCE__ .?AUHINSTANCE__@@
�
Z � � � ! t �
� N � _ENCLAVE_CREATE_INFO_SGX .?AU_ENCLAVE_CREATE_INFO_SGX@@ �� " �
� Secs �N � _ENCLAVE_CREATE_INFO_SGX .?AU_ENCLAVE_CREATE_INFO_SGX@@ ��. onecore\internal\sdk\inc\ntmmapi_x.h ��� � � � �
ProcessBasicInformation �� ProcessQuotaLimits ��� ProcessIoCounters ProcessVmCounters ProcessTimes � ProcessBasePriority �� ProcessRaisePriority � ProcessDebugPort � ProcessExceptionPort � ProcessAccessToken ���
ProcessLdtInformation ProcessLdtSize ��� ProcessDefaultHardErrorMode ��
ProcessIoPortHandlers ProcessPooledUsageAndLimits �� ProcessWorkingSetWatch ��� ProcessUserModeIOPL �� ProcessEnableAlignmentFaultFixup � ProcessPriorityClass � ProcessWx86Information ��� ProcessHandleCount ��� ProcessAffinityMask �� ProcessPriorityBoost � ProcessDeviceMap � ProcessSessionInformation ProcessForegroundInformation � ProcessWow64Information �� ProcessImageFileName � ProcessLUIDDeviceMapsEnabled � ProcessBreakOnTermination ProcessDebugObjectHandle � ProcessDebugFlags ProcessHandleTracing � ! ProcessIoPriority " ProcessExecuteFlags �� # ProcessTlsInformation $ ProcessCookie % ProcessImageInformation �� & ProcessCycleTime � ' ProcessPagePriority �� ( ProcessInstrumentationCallback ��� ) ProcessThreadStackAllocation � * ProcessWorkingSetWatchEx � + ProcessImageFileNameWin32 , ProcessImageFileMapping �� - ProcessAffinityUpdateMode . ProcessMemoryAllocationMode �� / ProcessGroupInformation �� 0 ProcessTokenVirtualizationEnabled 1 ProcessOwnerInformation �� 2 ProcessWindowInformation � 3 ProcessHandleInformation � 4 ProcessMitigationPolicy �� 5 ProcessDynamicFunctionTableInformation ��� 6 ProcessHandleCheckingMode 7 ProcessKeepAliveCount 8 ProcessRevokeFileHandles � 9 ProcessWorkingSetControl � : ProcessHandleTable ��� ; ProcessCheckStackExtentsMode � < ProcessCommandLineInformation = ProcessProtectionInformation � > ProcessMemoryExhaustion �� ? ProcessFaultInformation �� @ ProcessTelemetryIdInformation A ProcessCommitReleaseInformation �� B ProcessDefaultCpuSetsInformation � C ProcessAllowedCpuSetsInformation � B ProcessReserved1Information �� C ProcessReserved2Information �� D ProcessSubsystemProcess �� E ProcessJobMemoryInformation �� F ProcessInPrivate � G ProcessRaiseUMExceptionOnInvalidHandleClose �� H ProcessIumChallengeResponse �� I ProcessChildProcessInformation ��� J ProcessHighGraphicsPriorityInformation ��� K ProcessSubsystemInformation �� L ProcessEnergyValues �� M ProcessPowerThrottlingState �� N ProcessReserved3Information �� O ProcessWin32kSyscallFilterInformation P ProcessDisableSystemAllowedCpuSets ��� Q ProcessWakeInformation ��� R ProcessEnergyTrackingState ��� S ProcessManageWritesToExecutableMemory T ProcessCaptureTrustletLiveDump ��� U ProcessTelemetryCoverage � V ProcessEnclaveInformation W ProcessEnableReadWriteVmLogging �� X ProcessUptimeInformation � Y ProcessImageSection �� Z ProcessDebugAuthInformation �� [ ProcessSystemResourceManagement �� \ ProcessSequenceNumber ] ProcessLoaderDetour �� ^ ProcessSecurityDomainInformation � _ ProcessCombineSecurityDomainsInformation � ` ProcessEnableLogging � a ProcessLeapSecondInformation � b ProcessFiberShadowStackAllocation c ProcessFreeFiberShadowStackAllocation d ProcessAltSystemCallInformation �� e ProcessDynamicEHContinuationTargets �� f ProcessDynamicEnforcedCetCompatibleRanges g MaxProcessInfoClass ��: j t � _PROCESSINFOCLASS .?AW4_PROCESSINFOCLASS@@ � � ? ] J � _PERFINFO_IPI_SEND_DATA .?AU_PERFINFO_IPI_SEND_DATA@@ v
# InitialTime ��
WorkerRoutine
" RequestType ��
" IpiType ��
" TargetCount ��J � _PERFINFO_IPI_SEND_DATA .?AU_PERFINFO_IPI_SEND_DATA@@ � c 5 b � _ASSEMBLY_FILE_DETAILED_INFORMATION .?AU_ASSEMBLY_FILE_DETAILED_INFORMATION@@ z
" ulFlags ��
" ulFilenameLength �
" ulPathLength �
� lpFileName ���
� lpFilePath ���b � _ASSEMBLY_FILE_DETAILED_INFORMATION .?AU_ASSEMBLY_FILE_DETAILED_INFORMATION@@ * onecore\internal\sdk\inc\nturtl.h �� � � � : � _PS_CREATE_INFO .?AU_PS_CREATE_INFO@@ � PsCreateInitialState � PsCreateFailOnFileOpen ��� PsCreateFailOnSectionCreate �� PsCreateFailExeFormat PsCreateFailMachineMismatch �� PsCreateFailExeName �� PsCreateSuccess �� PsCreateMaximumStates 6 t � PS_CREATE_STATE .?AW4PS_CREATE_STATE@@ � � � )
��
��
��
��
��
��
! ��
" InitFlags
� WriteOutputOnExit
� DetectManifest ���
� IFEOSkipDebugger �
� IFEODoNotPropagateKeyState ���
� SpareBits1 ���
� SpareBits2 ���
� ProhibitedImageCharacteristics ���
" AdditionalFileAccess �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � �
FileHandle ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � "
! DllCharacteristics ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � �
IFEOKey ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � � �
��
��
��
��
��
��
��
! ��
" OutputFlags ��
� ProtectedProcess �
� AddressSpaceOverride �
� DevOverrideEnabled ���
� ManifestDetected �
� ProtectedProcessLight
� SpareBits1 ���
� SpareBits2 ���
� SpareBits3 ���
FileHandle ���
SectionHandle
# UserProcessParametersNative ��
" UserProcessParametersWow64 ���
" $ CurrentParameterFlags
# ( PebAddressNative �
" 0 PebAddressWow64 ��
# 8 ManifestAddress ��
" @ ManifestSize �: � H <anonymous-tag> .?AU<anonymous-tag>@@ � � � �
# Size �
� State
� InitState
� FailSection ��
� ExeFormat
� ExeName ��
� SuccessState �: � X _PS_CREATE_INFO .?AU_PS_CREATE_INFO@@ � � � J � MEM_EXTENDED_PARAMETER .?AUMEM_EXTENDED_PARAMETER@@ ��
�
# ��
# 8��
� Type �
� Reserved �
# ULong64 ��
Pointer ��
# Size �
Handle ���
" ULong J � MEM_EXTENDED_PARAMETER .?AUMEM_EXTENDED_PARAMETER@@ �� � � � r � _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION@@ ��f � _SYSTEM_SECUREBOOT_POLICY_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_INFORMATION@@ " �J
� PolicyInformation
" PolicySize ���
� Policy ���r � _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION@@ ��* onecore\internal\sdk\inc\ntexapi.h � � � � > � _ALPC_TOKEN_ATTR .?AU_ALPC_TOKEN_ATTR@@ ��J
� TokenId ��
� AuthenticationId �
� ModifiedId ���> � _ALPC_TOKEN_ATTR .?AU_ALPC_TOKEN_ATTR@@ ��* onecore\internal\sdk\inc\ntlpcapi.h � � ^ F � _MIDL_METHOD_PROPERTY .?AU_MIDL_METHOD_PROPERTY@@
� "
" Id ���
# Value F � _MIDL_METHOD_PROPERTY .?AU_MIDL_METHOD_PROPERTY@@ . onecore\external\shared\inc\rpcndr.h ��� � � [ ^ VrfSpecialPoolRuleClass �� VrfForceIrqlRuleClass VrfAllocationFailuresRuleClass ��� VrfTrackingPoolAllocationsRuleClass �� VrfIORuleClass ��� VrfDeadlockPreventionRuleClass ��� VrfEnhancedIORuleClass ��� VrfDMARuleClass �� VrfSecurityRuleClass � VrfForcePendingIORequestRuleClass
VrfIRPTrackingRuleClass �� VrfMiscellaneousRuleClass VrfMoreDebuggingRuleClass
VrfMDLInvariantStackRuleClass VrfMDLInvariantDriverRuleClass ��� VrfPowerDelayFuzzingRuleClass VrfPortMiniportRuleClass � VrfStandardDDIRuleClass �� VrfAutoFailRuleClass � VrfAdditionalDDIRuleClass VrfRuleClassBase � VrfNdisWifiRuleClass � VrfDriverLoggingRuleClass VrfSyncDelayFuzzingRuleClass � VrfVMSwitchingRuleClass �� VrfCodeIntegrityRuleClass VrfBelow4GBAllocationRuleClass ��� VrfProcessorBranchTraceRuleClass � VrfAdvancedMMRuleClass ��� VrfExtendingXDVTimeLimit � VrfSystemBIOSRuleClass ��� VrfHardwareRuleClass � VrfStateSepRuleClass � ! VrfWDFRuleClass �� " VrfMoreIrqlRuleClass � # VrfXDVPlatformMode ��� $ VrfStandalonePlatformMode % VrfPlatformModeTest �� & VrfInfoDisclosureIRPRule � ' VrfLwSpecialPool � ( VrfAVXCorruption � ) VrfAccessModeMismatch * ReservedForDVRF42 + ReservedForDVRF43 , ReservedForDVRF44 - ReservedForDVRF45 . ReservedForDVRF46 / ReservedForDVRF47 0 ReservedForDVRF48 1 ReservedForDVRF49 2 ReservedForDVRF50 3 ReservedForDVRF51 4 ReservedForDVRF52 5 ReservedForDVRF53 6 ReservedForDVRF54 7 ReservedForDVRF55 8 ReservedForDVRF56 9 ReservedForDVRF57 : ReservedForDVRF58 ; ReservedForDVRF59 < ReservedForDVRF60 = ReservedForDVRF61 > ReservedForDVRF62 ? ReservedForDVRF63 @ VrfRuleClassSizeMax ��> A t � _VRF_RULE_CLASS_ID .?AW4_VRF_RULE_CLASS_ID@@ ��� � � w � TraceGuidQueryList ��� TraceGuidQueryInfo ��� TraceGuidQueryProcess TraceStackTracingInfo TraceSystemTraceEnableFlagsInfo �� TraceSampledProfileIntervalInfo �� TraceProfileSourceConfigInfo � TraceProfileSourceListInfo ��� TracePmcEventListInfo TracePmcCounterListInfo ��
TraceSetDisallowList � TraceVersionInfo � TraceGroupQueryList ��
TraceGroupQueryInfo �� TraceDisallowListQuery ��� TraceInfoReserved15 �� TracePeriodicCaptureStateListInfo TracePeriodicCaptureStateInfo TraceProviderBinaryTracking �� TraceMaxLoggersQuery � TraceLbrConfigurationInfo TraceLbrEventListInfo TraceMaxPmcCounterQuery �� MaxTraceSetInfoClass �F t � _TRACE_QUERY_INFO_CLASS .?AW4_TRACE_QUERY_INFO_CLASS@@ �. onecore\external\shared\inc\evntrace.h � � � E ImageDepPolicy ��� ImageAslrPolicy �� ImageDynamicCodePolicy ��� ImageStrictHandleCheckPolicy � ImageSystemCallDisablePolicy � ImageMitigationOptionsMask ��� ImageExtensionPointDisablePolicy � ImageControlFlowGuardPolicy �� ImageSignaturePolicy � ImageFontDisablePolicy ���
ImageImageLoadPolicy � ImagePayloadRestrictionPolicy ImageChildProcessPolicy ��
ImageSehopPolicy � ImageHeapPolicy �� ImageUserShadowStackPolicy ��� MaxImageMitigationPolicy �J t � _IMAGE_MITIGATION_POLICY .?AW4_IMAGE_MITIGATION_POLICY@@ ���* onecore\internal\sdk\inc\ntrtl.h ��� � J � _EISA_DMA_CONFIGURATION .?AU_EISA_DMA_CONFIGURATION@@
N � _DMA_CONFIGURATION_BYTE0 .?AU_DMA_CONFIGURATION_BYTE0@@ ��N � _DMA_CONFIGURATION_BYTE1 .?AU_DMA_CONFIGURATION_BYTE1@@ ��B
ConfigurationByte0 ���
ConfigurationByte1 ���J _EISA_DMA_CONFIGURATION .?AU_EISA_DMA_CONFIGURATION@@ * onecore\internal\sdk\inc\ntconfig.h DynamicTickVetoNone �� DynamicTickVetoProcBusy �� DynamicTickVetoSoftwareTimer � DynamicTickVetoClockConstraint ��� DynamicTickVetoClockOutOfSync DynamicTickVetoClockUpdateFailed � DynamicTickVetoNoDeepSleep ��� DynamicTickVetoMax ���^ t _PERFINFO_DYNAMIC_TICK_VETO_REASON .?AW4_PERFINFO_DYNAMIC_TICK_VETO_REASON@@ ��� c � J � _WMI_JOB_ASSIGN_PROCESS .?AU_WMI_JOB_ASSIGN_PROCESS@@
Z
ContainerId ��
" JobId
" UniqueProcessId ��
Status ���J _WMI_JOB_ASSIGN_PROCESS .?AU_WMI_JOB_ASSIGN_PROCESS@@ c �
� # j � _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS@@ j � _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET@@ ��f
u FeatureId
! ReportingKind
! ReportingOptions �
ReportingTarget ��j _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS@@ : onecore\internal\sdk\inc\rtlfeatureconfigtypes.h ��� � B � _MIDL_FORMAT_STRING .?AU_MIDL_FORMAT_STRING@@ " �&
Pad ��
Format ���B _MIDL_FORMAT_STRING .?AU_MIDL_FORMAT_STRING@@ � ? f � _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA .?AU_PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA@@ ��
! >
" DeviceInstanceLength �
q DeviceInstance ���f # _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA .?AU_PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA@@ ��2 onecore\internal\sdk\inc\minwin\ntpnpapi.h � $ % � b � _SYSTEM_PLATFORM_BINARY_INFORMATION .?AU_SYSTEM_PLATFORM_BINARY_INFORMATION@@ �
# PhysicalAddress ��
HandoffBuffer
CommandLineBuffer
" HandoffBufferSize
" CommandLineBufferSize b ( _SYSTEM_PLATFORM_BINARY_INFORMATION .?AU_SYSTEM_PLATFORM_BINARY_INFORMATION@@ ) � �
b � _FILE_MEMORY_PARTITION_INFORMATION .?AU_FILE_MEMORY_PARTITION_INFORMATION@@ ��
+ " �J
NoCrossPartitionAccess ���
- Spare
" AllFlags �2 . <anonymous-tag> .?AT<anonymous-tag>@@ / � � 2
# OwnerPartitionHandle �
/ Flags b 1 _FILE_MEMORY_PARTITION_INFORMATION .?AU_FILE_MEMORY_PARTITION_INFORMATION@@ �� 2 � � z � _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION .?AU_RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION@@ j
ReflectionProcessHandle ��
ReflectionThreadHandle ���
ReflectionClientId ���z 5 _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION .?AU_RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION@@ 6 � � Z � _JOBOBJECT_WAKE_INFORMATION_V1 .?AU_JOBOBJECT_WAKE_INFORMATION_V1@@ �� # " �:
# NotificationChannel ��
9 WakeCounters �Z : ( _JOBOBJECT_WAKE_INFORMATION_V1 .?AU_JOBOBJECT_WAKE_INFORMATION_V1@@ �� ; � - f � _EVENT_TRACE_PROFILE_LIST_INFORMATION .?AU_EVENT_TRACE_PROFILE_LIST_INFORMATION@@
= � EventTraceKernelVersionInformation ��� EventTraceGroupMaskInformation ��� EventTracePerformanceInformation � EventTraceTimeProfileInformation � EventTraceSessionSecurityInformation � EventTraceSpinlockInformation EventTraceStackTracingInformation EventTraceExecutiveResourceInformation ��� EventTraceHeapTracingInformation � EventTraceHeapSummaryTracingInformation ��
EventTracePoolTagFilterInformation ��� EventTracePebsTracingInformation � EventTraceProfileConfigInformation ���
EventTraceProfileSourceListInformation ��� EventTraceProfileEventListInformation EventTraceProfileCounterListInformation �� EventTraceStackCachingInformation EventTraceObjectTypeFilterInformation EventTraceSoftRestartInformation � EventTraceLastBranchConfigurationInformation � EventTraceLastBranchEventListInformation � EventTraceProfileSourceAddInformation EventTraceProfileSourceRemoveInformation � EventTraceProcessorTraceConfigurationInformation � EventTraceProcessorTraceEventListInformation � EventTraceCoverageSamplerInformation � MaxEventTraceInfoClass ���V t ? _EVENT_TRACE_INFORMATION_CLASS .?AW4_EVENT_TRACE_INFORMATION_CLASS@@ ���. onecore\internal\sdk\inc\minwin\ntetw.h @ A � F � _PROFILE_SOURCE_INFO .?AU_PROFILE_SOURCE_INFO@@ �� C " �N
@ EventTraceInformationClass ���
" Spare
D Profile ��f E ( _EVENT_TRACE_PROFILE_LIST_INFORMATION .?AU_EVENT_TRACE_PROFILE_LIST_INFORMATION@@ F A @ � TP_LOG_LEVEL_ERROR ��� TP_LOG_LEVEL_WARNING � TP_LOG_LEVEL_INFO TP_LOG_LEVEL_TRACE_ENTER � TP_LOG_LEVEL_TRACE_LEAVE �2 t H _TP_LOG_LEVEL .?AW4_TP_LOG_LEVEL@@ � I � ? > � _EFI_DRIVER_ENTRY .?AU_EFI_DRIVER_ENTRY@@ z
" Version ��
" Length ���
" Id ���
" FriendlyNameOffset ���
" DriverFilePathOffset �> L _EFI_DRIVER_ENTRY .?AU_EFI_DRIVER_ENTRY@@ M � F � _EVENT_FILTER_HEADER .?AU_EVENT_FILTER_HEADER@@ �� " �z
! Id ���
Version ��
P Reserved �
# InstanceId ���
" Size �
" NextOffset ���F Q _EVENT_FILTER_HEADER .?AU_EVENT_FILTER_HEADER@@ �� R > T 6 � _currencyfmtW .?AU_currencyfmtW@@ �
u NumDigits
u LeadingZero ��
u Grouping �
q lpDecimalSep �
q lpThousandSep
u NegativeOrder
u $ PositiveOrder
q ( lpCurrencySymbol �6 U 0 _currencyfmtW .?AU_currencyfmtW@@ * onecore\external\sdk\inc\winnls.h �� V W � Z � _RTL_UMS_SCHEDULER_STARTUP_INFO .?AU_RTL_UMS_SCHEDULER_STARTUP_INFO@@ N � _RTL_UMS_COMPLETION_LIST .?AU_RTL_UMS_COMPLETION_LIST@@ ��
Z ^ UmsSchedulerStartup �� UmsSchedulerThreadBlocked UmsSchedulerThreadYield ��J t \ _RTL_UMS_SCHEDULER_REASON .?AW4_RTL_UMS_SCHEDULER_REASON@@ � ] b �! ] # _
` j
" UmsVersion ���
[ CompletionList ���
a SchedulerProc
SchedulerParam ���Z b _RTL_UMS_SCHEDULER_STARTUP_INFO .?AU_RTL_UMS_SCHEDULER_STARTUP_INFO@@ c b " B DPFLTR_SYSTEM_ID � DPFLTR_SMSS_ID ��� DPFLTR_SETUP_ID �� DPFLTR_NTFS_ID ��� DPFLTR_FSTUB_ID �� DPFLTR_CRASHDUMP_ID �� DPFLTR_CDAUDIO_ID DPFLTR_CDROM_ID �� DPFLTR_CLASSPNP_ID ��� DPFLTR_DISK_ID ���
DPFLTR_REDBOOK_ID DPFLTR_STORPROP_ID ��� DPFLTR_SCSIPORT_ID ���
DPFLTR_SCSIMINIPORT_ID ��� DPFLTR_CONFIG_ID � DPFLTR_I8042PRT_ID ��� DPFLTR_SERMOUSE_ID ��� DPFLTR_LSERMOUS_ID ��� DPFLTR_KBDHID_ID � DPFLTR_MOUHID_ID � DPFLTR_KBDCLASS_ID ��� DPFLTR_MOUCLASS_ID ��� DPFLTR_TWOTRACK_ID ��� DPFLTR_WMILIB_ID � DPFLTR_ACPI_ID ��� DPFLTR_AMLI_ID ��� DPFLTR_HALIA64_ID DPFLTR_VIDEO_ID �� DPFLTR_SVCHOST_ID DPFLTR_VIDEOPRT_ID ��� DPFLTR_TCPIP_ID �� DPFLTR_DMSYNTH_ID DPFLTR_NTOSPNP_ID ! DPFLTR_FASTFAT_ID " DPFLTR_SAMSS_ID �� # DPFLTR_PNPMGR_ID � $ DPFLTR_NETAPI_ID � % DPFLTR_SCSERVER_ID ��� & DPFLTR_SCCLIENT_ID ��� ' DPFLTR_SERIAL_ID � ( DPFLTR_SERENUM_ID ) DPFLTR_UHCD_ID ��� * DPFLTR_RPCPROXY_ID ��� + DPFLTR_AUTOCHK_ID , DPFLTR_DCOMSS_ID � - DPFLTR_UNIMODEM_ID ��� . DPFLTR_SIS_ID / DPFLTR_FLTMGR_ID � 0 DPFLTR_WMICORE_ID 1 DPFLTR_BURNENG_ID 2 DPFLTR_IMAPI_ID �� 3 DPFLTR_SXS_ID 4 DPFLTR_FUSION_ID � 5 DPFLTR_IDLETASK_ID ��� 6 DPFLTR_SOFTPCI_ID 7 DPFLTR_TAPE_ID ��� 8 DPFLTR_MCHGR_ID �� 9 DPFLTR_IDEP_ID ��� : DPFLTR_PCIIDE_ID � ; DPFLTR_FLOPPY_ID � < DPFLTR_FDC_ID = DPFLTR_TERMSRV_ID > DPFLTR_W32TIME_ID ? DPFLTR_PREFETCHER_ID � @ DPFLTR_RSFILTER_ID ��� A DPFLTR_FCPORT_ID � B DPFLTR_PCI_ID C DPFLTR_DMIO_ID ��� D DPFLTR_DMCONFIG_ID ��� E DPFLTR_DMADMIN_ID F DPFLTR_WSOCKTRANSPORT_ID � G DPFLTR_VSS_ID H DPFLTR_PNPMEM_ID � I DPFLTR_PROCESSOR_ID �� J DPFLTR_DMSERVER_ID ��� K DPFLTR_SR_ID � L DPFLTR_INFINIBAND_ID � M DPFLTR_IHVDRIVER_ID �� N DPFLTR_IHVVIDEO_ID ��� O DPFLTR_IHVAUDIO_ID ��� P DPFLTR_IHVNETWORK_ID � Q DPFLTR_IHVSTREAMING_ID ��� R DPFLTR_IHVBUS_ID � S DPFLTR_HPS_ID T DPFLTR_RTLTHREADPOOL_ID �� U DPFLTR_LDR_ID V DPFLTR_TCPIP6_ID � W DPFLTR_ISAPNP_ID � X DPFLTR_SHPC_ID ��� Y DPFLTR_STORPORT_ID ��� Z DPFLTR_STORMINIPORT_ID ��� [ DPFLTR_PRINTSPOOLER_ID ��� \ DPFLTR_VSSDYNDISK_ID � ] DPFLTR_VERIFIER_ID ��� ^ DPFLTR_VDS_ID _ DPFLTR_VDSBAS_ID � ` DPFLTR_VDSDYN_ID � a DPFLTR_VDSDYNDR_ID ��� b DPFLTR_VDSLDR_ID � c DPFLTR_VDSUTIL_ID d DPFLTR_DFRGIFC_ID e DPFLTR_DEFAULT_ID f DPFLTR_MM_ID � g DPFLTR_DFSC_ID ��� h DPFLTR_WOW64_ID �� i DPFLTR_ALPC_ID ��� j DPFLTR_WDI_ID k DPFLTR_PERFLIB_ID l DPFLTR_KTM_ID m DPFLTR_IOSTRESS_ID ��� n DPFLTR_HEAP_ID ��� o DPFLTR_WHEA_ID ��� p DPFLTR_USERGDI_ID q DPFLTR_MMCSS_ID �� r DPFLTR_TPM_ID s DPFLTR_THREADORDER_ID t DPFLTR_ENVIRON_ID u DPFLTR_EMS_ID v DPFLTR_WDT_ID w DPFLTR_FVEVOL_ID � x DPFLTR_NDIS_ID ��� y DPFLTR_NVCTRACE_ID ��� z DPFLTR_LUAFV_ID �� { DPFLTR_APPCOMPAT_ID �� | DPFLTR_USBSTOR_ID } DPFLTR_SBP2PORT_ID ��� ~ DPFLTR_COVERAGE_ID ��� DPFLTR_CACHEMGR_ID ��� � DPFLTR_MOUNTMGR_ID ��� � DPFLTR_CFR_ID � DPFLTR_TXF_ID � DPFLTR_KSECDD_ID � � DPFLTR_FLTREGRESS_ID � � DPFLTR_MPIO_ID ��� � DPFLTR_MSDSM_ID �� � DPFLTR_UDFS_ID ��� � DPFLTR_PSHED_ID �� � DPFLTR_STORVSP_ID � DPFLTR_LSASS_ID �� � DPFLTR_SSPICLI_ID � DPFLTR_CNG_ID � DPFLTR_EXFAT_ID �� � DPFLTR_FILETRACE_ID �� � DPFLTR_XSAVE_ID �� � DPFLTR_SE_ID � � DPFLTR_DRIVEEXTENDER_ID �� � DPFLTR_POWER_ID �� � DPFLTR_CRASHDUMPXHCI_ID �� � DPFLTR_GPIO_ID ��� � DPFLTR_REFS_ID ��� � DPFLTR_WER_ID � DPFLTR_CAPIMG_ID � � DPFLTR_VPCI_ID ��� � DPFLTR_STORAGECLASSMEMORY_ID � � DPFLTR_FSLIB_ID �� � DPFLTR_ENDOFTABLE_ID �2 � t e _DPFLTR_TYPE .?AW4_DPFLTR_TYPE@@ ���. onecore\external\shared\inc\dpfilter.h � f g J � _HEAP_SUBSEGMENT_ALLOC .?AU_HEAP_SUBSEGMENT_ALLOC@@ ��F � _SYSTEM_TRACE_HEADER .?AU_SYSTEM_TRACE_HEADER@@ ��^ � _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE .?AU_HEAP_EVENT_SUBSEGMENT_ALLOC_FREE@@ &
j Header ���
k Event J l @ _HEAP_SUBSEGMENT_ALLOC .?AU_HEAP_SUBSEGMENT_ALLOC@@ �� m c M WOW64_FUNCTION_NOP ��� WOW64_FUNCTION_QUERY_PROCESS_DEBUG_INFO �� WOW64_FUNCTION_CPU_TURBO_THUNK_CONTROL ��� WOW64_FUNCTION_CPU_CFG_DISPATCH_CONTROL �� WOW64_FUNCTION_CPU_OPTIMIZE_CHPE_IMPORT_THUNKS ��� WOW64_FUNCTION_MAXIMUM ���F t o _WOW64_FUNCTION_CODE64 .?AW4_WOW64_FUNCTION_CODE64@@ ��� p � b ProcessWorkingSetSwap ProcessWorkingSetEmpty ��� ProcessWorkingSetOperationMax V t r _PROCESS_WORKING_SET_OPERATION .?AW4_PROCESS_WORKING_SET_OPERATION@@ ���* onecore\internal\sdk\inc\ntmmapi.h � s t F � PowerActionNone �� PowerActionReserved �� PowerActionSleep � PowerActionHibernate � PowerActionShutdown �� PowerActionShutdownReset � PowerActionShutdownOff ��� PowerActionWarmEject � PowerActionDisplayOff 2 t v POWER_ACTION .?AW4POWER_ACTION@@ ���* onecore\external\ddk\inc\ntpoapi.h � w x � ^ � _FILE_FS_DRIVER_PATH_INFORMATION .?AU_FILE_FS_DRIVER_PATH_INFORMATION@@ ��
z q " �N
DriverInPath �
" DriverNameLength �
| DriverName ���^ } _FILE_FS_DRIVER_PATH_INFORMATION .?AU_FILE_FS_DRIVER_PATH_INFORMATION@@ �� ~ � � F � tagEMRSELECTCLIPPATH .?AUtagEMRSELECTCLIPPATH@@ ��
� * � tagEMR .?AUtagEMR@@ ��"
� emr ��
" iMode F � tagEMRSELECTCLIPPATH .?AUtagEMRSELECTCLIPPATH@@ ��* onecore\external\sdk\inc\wingdi.h �� � � a � COPYFILE2_PROGRESS_CONTINUE �� COPYFILE2_PROGRESS_CANCEL COPYFILE2_PROGRESS_STOP �� COPYFILE2_PROGRESS_QUIET � COPYFILE2_PROGRESS_PAUSE �J t � _COPYFILE2_MESSAGE_ACTION .?AW4_COPYFILE2_MESSAGE_ACTION@@ � � o F > � COPYFILE2_MESSAGE .?AUCOPYFILE2_MESSAGE@@
� ��
� � � �
� R � _MEMORY_REGION_INFORMATION .?AU_MEMORY_REGION_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
AllocationBase ���
" AllocationProtect
" RegionType ���
� Private ��
� MappedDataFile ���
� MappedImage ��
� MappedPageFile ���
� MappedPhysical ���
� DirectMapped �
� SoftwareEnclave ��
� PageSize64K ��
� PlaceholderReservation ���
� Reserved �
# RegionSize ���
# CommitSize ���
# PartitionId ��
# ( NodePreference ���R � 0 _MEMORY_REGION_INFORMATION .?AU_MEMORY_REGION_INFORMATION@@ �� � t � F � _UNIVERSAL_NAME_INFOW .?AU_UNIVERSAL_NAME_INFOW@@
q lpUniversalName ��F � _UNIVERSAL_NAME_INFOW .?AU_UNIVERSAL_NAME_INFOW@@ * onecore\external\sdk\inc\winnetwk.h � � � J
RtlPhysicalMemoryPolicyLow ��� RtlPhysicalMemoryPolicyNormal N t � RTL_PHYSICAL_MEMORY_POLICY .?AW4RTL_PHYSICAL_MEMORY_POLICY@@ ��� � J � _SYSTEM_VERIFIER_ISSUE .?AU_SYSTEM_VERIFIER_ISSUE@@ �� # " �B
# IssueType
Address ��
� Parameters ���J � _SYSTEM_VERIFIER_ISSUE .?AU_SYSTEM_VERIFIER_ISSUE@@ �� � � � � PoCsDeviceNotificationStorage PoCsDeviceNotificationWiFi ��� PoCsDeviceNotificationMbn PoCsDeviceNotificationAudio �� PoCsDeviceNotificationEthernet ��� PoCsDeviceNotificationMaximum V t � _PO_CS_DEVICE_NOTIFICATION_TYPE .?AW4_PO_CS_DEVICE_NOTIFICATION_TYPE@@ � � x ^
6 � _IO_COUNTERS .?AU_IO_COUNTERS@@ ��
# ReadOperationCount ���
# WriteOperationCount ��
# OtherOperationCount ��
# ReadTransferCount
# WriteTransferCount ���
# ( OtherTransferCount ���6 � 0 _IO_COUNTERS .?AU_IO_COUNTERS@@ �� � ? � n � _ACTIVATION_CONTEXT_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_DETAILED_INFORMATION@@ ��
� ��
� z
" dwFlags ��
" ulFormatVersion ��
" ulAssemblyCount ��
" ulRootManifestPathType ���
" ulRootManifestPathChars ��
" ulRootConfigurationPathType ��
" ulRootConfigurationPathChars �
" ulAppDirPathType �
" ulAppDirPathChars
� ( lpRootManifestPath ���
� 0 lpRootConfigurationPath ��
� 8 lpAppDirPath �n � @ _ACTIVATION_CONTEXT_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_DETAILED_INFORMATION@@ �� � � ~ � _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ ��
� N � _RTL_IMAGE_MITIGATION_POLICY .?AT_RTL_IMAGE_MITIGATION_POLICY@@ ��&
� BlockWin32kSystemCalls ���~ � _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ �� � P � PowerSystemUnspecified ��� PowerSystemWorking ��� PowerSystemSleeping1 � PowerSystemSleeping2 � PowerSystemSleeping3 � PowerSystemHibernate � PowerSystemShutdown �� PowerSystemMaximum ���> t � _SYSTEM_POWER_STATE .?AW4_SYSTEM_POWER_STATE@@ � � x � N � _DUPLICATE_EXTENTS_DATA32 .?AU_DUPLICATE_EXTENTS_DATA32@@ f
u FileHandle ���
� SourceFileOffset �
� TargetFileOffset �
� ByteCount N � _DUPLICATE_EXTENTS_DATA32 .?AU_DUPLICATE_EXTENTS_DATA32@@ � � \ R � _FSCTL_OFFLOAD_WRITE_INPUT .?AU_FSCTL_OFFLOAD_WRITE_INPUT@@ �� " �~
" Size �
" Flags
# FileOffset ���
# CopyLength ���
# TransferOffset ���
� Token R � _FSCTL_OFFLOAD_WRITE_INPUT .?AU_FSCTL_OFFLOAD_WRITE_INPUT@@ �� � � � " " � � # SystemBasicInformation ��� SystemProcessorInformation ��� SystemPerformanceInformation � SystemTimeOfDayInformation ��� SystemPathInformation SystemProcessInformation � SystemCallCountInformation ��� SystemDeviceInformation �� SystemProcessorPerformanceInformation SystemFlagsInformation ���
SystemCallTimeInformation SystemModuleInformation �� SystemLocksInformation ���
SystemStackTraceInformation �� SystemPagedPoolInformation ��� SystemNonPagedPoolInformation SystemHandleInformation �� SystemObjectInformation �� SystemPageFileInformation SystemVdmInstemulInformation � SystemVdmBopInformation �� SystemFileCacheInformation ��� SystemPoolTagInformation � SystemInterruptInformation ��� SystemDpcBehaviorInformation � SystemFullMemoryInformation �� SystemLoadGdiDriverInformation ��� SystemUnloadGdiDriverInformation � SystemTimeAdjustmentInformation �� SystemSummaryMemoryInformation ��� SystemMirrorMemoryInformation SystemPerformanceTraceInformation SystemObsolete0 �� ! SystemExceptionInformation ��� " SystemCrashDumpStateInformation �� # SystemKernelDebuggerInformation �� $ SystemContextSwitchInformation ��� % SystemRegistryQuotaInformation ��� & SystemExtendServiceTableInformation �� ' SystemPrioritySeperation � ( SystemVerifierAddDriverInformation ��� ) SystemVerifierRemoveDriverInformation * SystemProcessorIdleInformation ��� + SystemLegacyDriverInformation , SystemCurrentTimeZoneInformation � - SystemLookasideInformation ��� . SystemTimeSlipNotification ��� / SystemSessionCreate �� 0 SystemSessionDetach �� 1 SystemSessionInformation � 2 SystemRangeStartInformation �� 3 SystemVerifierInformation 4 SystemVerifierThunkExtend 5 SystemSessionProcessInformation �� 6 SystemLoadGdiDriverInSystemSpace � 7 SystemNumaProcessorMap ��� 8 SystemPrefetcherInformation �� 9 SystemExtendedProcessInformation � : SystemRecommendedSharedDataAlignment � ; SystemComPlusPackage � < SystemNumaAvailableMemory = SystemProcessorPowerInformation �� > SystemEmulationBasicInformation �� ? SystemEmulationProcessorInformation �� @ SystemExtendedHandleInformation �� A SystemLostDelayedWriteInformation B SystemBigPoolInformation � C SystemSessionPoolTagInformation �� D SystemSessionMappedViewInformation ��� E SystemHotpatchInformation F SystemObjectSecurityMode � G SystemWatchdogTimerHandler ��� H SystemWatchdogTimerInformation ��� I SystemLogicalProcessorInformation J SystemWow64SharedInformationObsolete � K SystemRegisterFirmwareTableInformationHandler L SystemFirmwareTableInformation ��� M SystemModuleInformationEx N SystemVerifierTriageInformation �� O SystemSuperfetchInformation �� P SystemMemoryListInformation �� Q SystemFileCacheInformationEx � R SystemThreadPriorityClientIdInformation �� S SystemProcessorIdleCycleTimeInformation �� T SystemVerifierCancellationInformation U SystemProcessorPowerInformationEx V SystemRefTraceInformation W SystemSpecialPoolInformation � X SystemProcessIdInformation ��� Y SystemErrorPortInformation ��� Z SystemBootEnvironmentInformation � [ SystemHypervisorInformation �� \ SystemVerifierInformationEx �� ] SystemTimeZoneInformation ^ SystemImageFileExecutionOptionsInformation ��� _ SystemCoverageInformation ` SystemPrefetchPatchInformation ��� a SystemVerifierFaultsInformation �� b SystemSystemPartitionInformation � c SystemSystemDiskInformation �� d SystemProcessorPerformanceDistribution ��� e SystemNumaProximityNodeInformation ��� f SystemDynamicTimeZoneInformation � g SystemCodeIntegrityInformation ��� h SystemProcessorMicrocodeUpdateInformation i SystemProcessorBrandString ��� j SystemVirtualAddressInformation �� k SystemLogicalProcessorAndGroupInformation l SystemProcessorCycleTimeInformation �� m SystemStoreInformation ��� n SystemRegistryAppendString ��� o SystemAitSamplingValue ��� p SystemVhdBootInformation � q SystemCpuQuotaInformation r SystemNativeBasicInformation � s SystemErrorPortTimeouts �� t SystemLowPriorityIoInformation ��� u SystemBootEntropyInformation � v SystemVerifierCountersInformation w SystemPagedPoolInformationEx � x SystemSystemPtesInformationEx y SystemNodeDistanceInformation z SystemAcpiAuditInformation ��� { SystemBasicPerformanceInformation | SystemQueryPerformanceCounterInformation � } SystemSessionBigPoolInformation �� ~ SystemBootGraphicsInformation SystemScrubPhysicalMemoryInformation � � SystemBadPageInformation � � SystemProcessorProfileControlArea � SystemCombinePhysicalMemoryInformation ��� � SystemEntropyInterruptTimingInformation �� � SystemConsoleInformation � � SystemPlatformBinaryInformation �� � SystemPolicyInformation �� � SystemHypervisorProcessorCountInformation � SystemDeviceDataInformation �� � SystemDeviceDataEnumerationInformation ��� � SystemMemoryTopologyInformation �� � SystemMemoryChannelInformation ��� � SystemBootLogoInformation � SystemProcessorPerformanceInformationEx �� � SystemCriticalProcessErrorLogInformation � � SystemSecureBootPolicyInformation � SystemPageFileInformationEx �� � SystemSecureBootInformation �� � SystemEntropyInterruptTimingRawInformation ��� � SystemPortableWorkspaceEfiLauncherInformation � SystemFullProcessInformation � � SystemKernelDebuggerInformationEx � SystemBootMetadataInformation � SystemSoftRebootInformation �� � SystemElamCertificateInformation � � SystemOfflineDumpConfigInformation ��� � SystemProcessorFeaturesInformation ��� � SystemRegistryReconciliationInformation �� � SystemEdidInformation � SystemManufacturingInformation ��� � SystemEnergyEstimationConfigInformation �� � SystemHypervisorDetailInformation � SystemProcessorCycleStatsInformation � � SystemVmGenerationCountInformation ��� � SystemTrustedPlatformModuleInformation ��� � SystemKernelDebuggerFlags � SystemCodeIntegrityPolicyInformation � � SystemIsolatedUserModeInformation � SystemHardwareSecurityTestInterfaceResultsInformation � SystemSingleModuleInformation � SystemAllowedCpuSetsInformation �� � SystemVsmProtectionInformation ��� � SystemInterruptCpuSetsInformation � SystemSecureBootPolicyFullInformation � SystemCodeIntegrityPolicyFullInformation � � SystemAffinitizedInterruptProcessorInformation ��� � SystemRootSiloInformation � SystemCpuSetInformation �� � SystemCpuSetTagInformation ��� � SystemWin32WerStartCallout ��� � SystemSecureKernelProfileInformation � � SystemCodeIntegrityPlatformManifestInformation ��� � SystemInterruptSteeringInformation ��� � SystemSupportedProcessorArchitectures � SystemMemoryUsageInformation � � SystemCodeIntegrityCertificateInformation � SystemPhysicalMemoryInformation �� � SystemControlFlowTransition �� � SystemKernelDebuggingAllowed � � SystemActivityModerationExeState � � SystemActivityModerationUserSettings � � SystemCodeIntegrityPoliciesFullInformation ��� � SystemCodeIntegrityUnlockInformation � � SystemIntegrityQuotaInformation �� � SystemFlushInformation ��� � SystemProcessorIdleMaskInformation ��� � SystemSecureDumpEncryptionInformation � SystemWriteConstraintInformation � � SystemKernelVaShadowInformation �� � SystemHypervisorSharedPageInformation � SystemFirmwareBootPerformanceInformation � � SystemCodeIntegrityVerificationInformation ��� � SystemFirmwarePartitionInformation ��� � SystemSpeculationControlInformation �� � SystemDmaGuardPolicyInformation �� � SystemEnclaveLaunchControlInformation � SystemWorkloadAllowedCpuSetsInformation �� � SystemCodeIntegrityUnlockModeInformation � � SystemLeapSecondInformation �� � SystemFlags2Information �� � SystemSecurityModelInformation ��� � SystemCodeIntegritySyntheticCacheInformation � � SystemFeatureConfigurationInformation � SystemFeatureConfigurationSectionInformation � � SystemFeatureUsageSubscriptionInformation � SystemSecureSpeculationControlInformation � SystemSpacesBootInformation �� � SystemFwRamdiskInformation ��� � SystemWheaIpmiHardwareInformation � SystemDifSetRuleClassInformation � � SystemDifClearRuleClassInformation ��� � SystemDifApplyPluginVerificationOnDriver � � SystemDifRemovePluginVerificationOnDriver � SystemShadowStackInformation � � SystemBuildVersionInformation � SystemPoolLimitInformation ��� � SystemCodeIntegrityAddDynamicStore ��� � SystemCodeIntegrityClearDynamicStores � SystemPoolZeroingInformation � � MaxSystemInfoClass ���J � t � _SYSTEM_INFORMATION_CLASS .?AW4_SYSTEM_INFORMATION_CLASS@@ � � � � b � _FILE_FS_METADATA_SIZE_INFORMATION .?AU_FILE_FS_METADATA_SIZE_INFORMATION@@ ��
� j
� TotalMetadataAllocationUnits �
" SectorsPerAllocationUnit �
" BytesPerSector ���b � _FILE_FS_METADATA_SIZE_INFORMATION .?AU_FILE_FS_METADATA_SIZE_INFORMATION@@ �� � � | : � _MUISTRINGPOOL .?AU_MUISTRINGPOOL@@ ��
u TotalSize
! MaxNumStrings
! NumStrings ���
! MaxNumCharsInPool
!
NumCharsInPool ���
Strings ��
q Pool �: � _MUISTRINGPOOL .?AU_MUISTRINGPOOL@@ �� � t J � _MESSAGE_RESOURCE_BLOCK .?AU_MESSAGE_RESOURCE_BLOCK@@
� B
" LowId
" HighId ���
" OffsetToEntries ��J � _MESSAGE_RESOURCE_BLOCK .?AU_MESSAGE_RESOURCE_BLOCK@@ � b � � � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY@@ ��>
# ChangeStamp ��
Section ��
# Size � � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY@@ �� � � s J � _LDR_SERVICE_TAG_RECORD .?AU_LDR_SERVICE_TAG_RECORD@@
� *
� Next �
" ServiceTag ���J � _LDR_SERVICE_TAG_RECORD .?AU_LDR_SERVICE_TAG_RECORD@@ * onecore\internal\sdk\inc\ntldr.h ��� � � i F � tagMOUSEHOOKSTRUCTEX .?AUtagMOUSEHOOKSTRUCTEX@@ ��. � tagPOINT .?AUtagPOINT@@ ��
q f
� pt ���
� hwnd �
u wHitTestCode �
# dwExtraInfo ��
" mouseData F � ( tagMOUSEHOOKSTRUCTEX .?AUtagMOUSEHOOKSTRUCTEX@@ �� � � b � _SYSTEM_VERIFIER_TRIAGE_INFORMATION .?AU_SYSTEM_VERIFIER_TRIAGE_INFORMATION@@
� # " ( � q " �z
" ActionTaken ��
� CrashData
" 0 VerifierMode �
" 4 VerifierFlags
� 8 VerifierTargets ��b � 8_SYSTEM_VERIFIER_TRIAGE_INFORMATION .?AU_SYSTEM_VERIFIER_TRIAGE_INFORMATION@@ � � � J � _SE_IMPERSONATION_STATE .?AU_SE_IMPERSONATION_STATE@@ r SecurityAnonymous SecurityIdentification ��� SecurityImpersonation SecurityDelegation ���R t � _SECURITY_IMPERSONATION_LEVEL .?AW4_SECURITY_IMPERSONATION_LEVEL@@ � � x � R
Token
CopyOnOpen ���
EffectiveOnly
� Level J � _SE_IMPERSONATION_STATE .?AU_SE_IMPERSONATION_STATE@@ � x R
j EnlistmentBasicInformation ��� EnlistmentRecoveryInformation EnlistmentCrmInformation �R t � _ENLISTMENT_INFORMATION_CLASS .?AW4_ENLISTMENT_INFORMATION_CLASS@@ �* onecore\internal\sdk\inc\nttmapi.h � � � c
> � _OSVERSIONINFOEXA .?AU_OSVERSIONINFOEXA@@ p " � �
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
szCSDVersion �
! � wServicePackMajor
! � wServicePackMinor
! � wSuiteMask ���
� wProductType �
� wReserved > � _OSVERSIONINFOEXA .?AU_OSVERSIONINFOEXA@@ b � J � SET_POWER_SETTING_VALUE .?AUSET_POWER_SETTING_VALUE@@
B PoAc � PoDc � PoHot PoConditionMaximum ���F t SYSTEM_POWER_CONDITION .?AW4SYSTEM_POWER_CONDITION@@ ��� x j j
" Version ��
Guid �
PowerCondition ���
" DataLength ���
� Data �J
SET_POWER_SETTING_VALUE .?AUSET_POWER_SETTING_VALUE@@ x q F � _PERFINFO_VTL_CHANGE .?AU_PERFINFO_VTL_CHANGE@@ ��2
! OperationCode
! ServiceCode ��F _PERFINFO_VTL_CHANGE .?AU_PERFINFO_VTL_CHANGE@@ �� c - J � _FILESYSTEM_STATISTICS .?AU_FILESYSTEM_STATISTICS@@ ��
! FileSystemType ���
! Version ��
" SizeOfCompleteStructure ��
" UserFileReads
" UserFileReadBytes
" UserDiskReads
" UserFileWrites ���
" UserFileWriteBytes ���
" UserDiskWrites ���
" MetaDataReads
" $ MetaDataReadBytes
" ( MetaDataDiskReads
" , MetaDataWrites ���
" 0 MetaDataWriteBytes ���
" 4 MetaDataDiskWrites ���J 8 _FILESYSTEM_STATISTICS .?AU_FILESYSTEM_STATISTICS@@ �� � : � _PS_PROTECTION .?AU_PS_PROTECTION@@ ��
��
��
��F
Level
Type �
Audit
Signer ���: _PS_PROTECTION .?AU_PS_PROTECTION@@ �� � [ B � _OUTLINETEXTMETRICA .?AU_OUTLINETEXTMETRICA@@
: � tagTEXTMETRICA .?AUtagTEXTMETRICA@@ ��. � tagPANOSE .?AUtagPANOSE@@ * � tagRECT .?AUtagRECT@@ Z
u otmSize ��
otmTextMetrics ���
< otmFiller
= otmPanoseNumber ��
u H otmfsSelection ���
u L otmfsType
t P otmsCharSlopeRise
t T otmsCharSlopeRun �
t X otmItalicAngle ���
u \ otmEMSquare ��
t ` otmAscent
t d otmDescent ���
u h otmLineGap ���
u l otmsCapEmHeight ��
u p otmsXHeight ��
! t otmrcFontBox �
t � otmMacAscent �
t � otmMacDescent
u � otmMacLineGap
u � otmusMinimumPPEM �
� � otmptSubscriptSize ���
� � otmptSubscriptOffset �
� � otmptSuperscriptSize �
� � otmptSuperscriptOffset ���
u � otmsStrikeoutSize
t � otmsStrikeoutPosition
t � otmsUnderscoreSize ���
t � otmsUnderscorePosition ���
p � otmpFamilyName ���
p � otmpFaceName �
p � otmpStyleName
p � otmpFullName �B " � _OUTLINETEXTMETRICA .?AU_OUTLINETEXTMETRICA@@ # � �
%
& � MonitorRequestReasonUnknown �� MonitorRequestReasonPowerButton �� MonitorRequestReasonRemoteConnection � MonitorRequestReasonScMonitorpower ��� MonitorRequestReasonUserInput MonitorRequestReasonAcDcDisplayBurst � MonitorRequestReasonUserDisplayBurst � MonitorRequestReasonPoSetSystemState � MonitorRequestReasonSetThreadExecutionState �� MonitorRequestReasonFullWake �
MonitorRequestReasonSessionUnlock MonitorRequestReasonScreenOffRequest � MonitorRequestReasonIdleTimeout ��
MonitorRequestReasonPolicyChange � MonitorRequestReasonSleepButton �� MonitorRequestReasonLid �� MonitorRequestReasonBatteryCountChange ��� MonitorRequestReasonGracePeriod �� MonitorRequestReasonPnP �� MonitorRequestReasonDP ��� MonitorRequestReasonSxTransition � MonitorRequestReasonSystemIdle ��� MonitorRequestReasonNearProximity MonitorRequestReasonThermalStandby ��� MonitorRequestReasonResumePdc MonitorRequestReasonResumeS4 � MonitorRequestReasonTerminal � MonitorRequestReasonPdcSignal MonitorRequestReasonAcDcDisplayBurstSuppressed ��� MonitorRequestReasonSystemStateEntered ��� MonitorRequestReasonWinrt MonitorRequestReasonUserInputKeyboard MonitorRequestReasonUserInputMouse ��� ! MonitorRequestReasonUserInputTouch ��� " MonitorRequestReasonUserInputPen � # MonitorRequestReasonUserInputAccelerometer ��� $ MonitorRequestReasonUserInputHid � % MonitorRequestReasonUserInputPoUserPresent ��� & MonitorRequestReasonUserInputSessionSwitch ��� ' MonitorRequestReasonUserInputInitialization �� ( MonitorRequestReasonPdcSignalWindowsMobilePwrNotif ��� ) MonitorRequestReasonPdcSignalWindowsMobileShell �� * MonitorRequestReasonPdcSignalHeyCortana �� + MonitorRequestReasonPdcSignalHolographicShell , MonitorRequestReasonPdcSignalFingerprint � - MonitorRequestReasonDirectedDrips . MonitorRequestReasonDim �� / MonitorRequestReasonBuiltinPanel � 0 MonitorRequestReasonDisplayRequiredUnDim � 1 MonitorRequestReasonBatteryCountChangeSuppressed � 2 MonitorRequestReasonResumeModernStandby �� 3 MonitorRequestReasonMax ��R 4 t ( POWER_MONITOR_REQUEST_REASON .?AW4POWER_MONITOR_REQUEST_REASON@@ ��� ) x 2 � _HSM_OPCODE .?AU_HSM_OPCODE@@ "
" Tag ��
" Code �2 , _HSM_OPCODE .?AU_HSM_OPCODE@@ - � �" b � _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY@@
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" BeginAddress �
" UnwindData ���
0 Flag �
1 FunctionLength ���
2 RegF �
3 RegI �
4 H
5 CR ���
6 FrameSize b 7 _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY@@ 8 � Z PerfCSwapIdleShort ��� PerfCSwapIdle PerfCSwapLite PerfCSwapFull B t : _PERFINFO_CCSWAP_TYPE .?AW4_PERFINFO_CCSWAP_TYPE@@ � ; c { . � _WMI_UDP .?AU_WMI_UDP@@ ��r
" PID ��
! Size �
" DestAddr �
" SrcAddr ��
! DestPort �
! SrcPort ��. > _WMI_UDP .?AU_WMI_UDP@@ �� ? c J � _PERFINFO_HV_HYPERCALL .?AU_PERFINFO_HV_HYPERCALL@@ ��>
u CallCode �
IsFast ���
IsNested �J B _PERFINFO_HV_HYPERCALL .?AU_PERFINFO_HV_HYPERCALL@@ �� C c @ F � _UNIVERSAL_NAME_INFOA .?AU_UNIVERSAL_NAME_INFOA@@
E
p lpUniversalName ��F G _UNIVERSAL_NAME_INFOA .?AU_UNIVERSAL_NAME_INFOA@@ H � ~ � ProfileTime �� ProfileAlignmentFixup ProfileTotalIssues ��� ProfilePipelineDry ��� ProfileLoadInstructions �� ProfilePipelineFrozen ProfileBranchInstructions ProfileTotalNonissues ProfileDcacheMisses �� ProfileIcacheMisses ��
ProfileCacheMisses ��� ProfileBranchMispredictions �� ProfileStoreInstructions �
ProfileFpInstructions ProfileIntegerInstructions ��� Profile2Issue Profile3Issue Profile4Issue ProfileSpecialInstructions ��� ProfileTotalCycles ��� ProfileIcacheIssues �� ProfileDcacheAccesses ProfileMemoryBarrierCycles ��� ProfileLoadLinkedIssues �� ProfileMaximum ���: t J _KPROFILE_SOURCE .?AW4_KPROFILE_SOURCE@@ ���. onecore\internal\sdk\inc\ntkeapi_x.h ��� K L � Z � _USER_MARSHAL_ROUTINE_QUADRUPLE .?AU_USER_MARSHAL_ROUTINE_QUADRUPLE@@ " " " O
P " R
S
S " V
W ^
Q pfnBufferSize
T pfnMarshall ��
U pfnUnmarshall
X pfnFree ��Z Y _USER_MARSHAL_ROUTINE_QUADRUPLE .?AU_USER_MARSHAL_ROUTINE_QUADRUPLE@@ Z � n . � __n128x2 .?AU__n128x2@@ ��" �" __n128 .?AT__n128@@ �� ] " �
^ val ��. _ __n128x2 .?AU__n128x2@@ �� ` * � > � tagENHMETAHEADER .?AUtagENHMETAHEADER@@ ��
b * � _RECTL .?AU_RECTL@@ ��* � tagSIZE .?AUtagSIZE@@ �
" iType
" nSize
d rclBounds
d rclFrame �
" ( dSignature ���
" , nVersion �
" 0 nBytes ���
" 4 nRecords �
! 8 nHandles �
! : sReserved
" < nDescription �
" @ offDescription ���
" D nPalEntries ��
e H szlDevice
e P szlMillimeters ���
" X cbPixelFormat
" \ offPixelFormat ���
" ` bOpenGL ��
e d szlMicrometers ���> f l tagENHMETAHEADER .?AUtagENHMETAHEADER@@ �� g � ; JobObjectBasicAccountingInformation �� JobObjectBasicLimitInformation ��� JobObjectBasicProcessIdList �� JobObjectBasicUIRestrictions � JobObjectSecurityLimitInformation JobObjectEndOfJobTimeInformation � JobObjectAssociateCompletionPortInformation �� JobObjectBasicAndIoAccountingInformation � JobObjectExtendedLimitInformation
JobObjectJobSetInformation ��� JobObjectGroupInformation JobObjectNotificationLimitInformation
JobObjectLimitViolationInformation ��� JobObjectGroupInformationEx �� JobObjectCpuRateControlInformation ��� JobObjectCompletionFilter JobObjectCompletionCounter ��� JobObjectFreezeInformation ��� JobObjectExtendedAccountingInformation ��� JobObjectWakeInformation � JobObjectBackgroundInformation ��� JobObjectSchedulingRankBiasInformation ��� JobObjectTimerVirtualizationInformation �� JobObjectCycleTimeNotification ��� JobObjectClearEvent �� JobObjectInterferenceInformation � JobObjectClearPeakJobMemoryUsed �� JobObjectMemoryUsageInformation �� JobObjectSharedCommit JobObjectContainerId � JobObjectIoRateControlInformation % JobObjectSiloRootDirectory ��� & JobObjectServerSiloBasicInformation �� ' JobObjectServerSiloUserSharedData ( JobObjectServerSiloInitialize ) JobObjectServerSiloRunningState �� * JobObjectIoAttribution ��� + JobObjectMemoryPartitionInformation �� , JobObjectContainerTelemetryId - JobObjectSiloSystemRoot �� . JobObjectEnergyTrackingState � / JobObjectThreadImpersonationInformation �� JobObjectReserved1Information JobObjectReserved2Information JobObjectReserved3Information JobObjectReserved4Information JobObjectReserved5Information JobObjectReserved6Information JobObjectReserved7Information JobObjectReserved8Information JobObjectReserved9Information JobObjectReserved10Information ��� JobObjectReserved11Information ��� JobObjectReserved12Information ��� JobObjectReserved13Information ��� JobObjectReserved14Information ��� JobObjectNetRateControlInformation ��� ! JobObjectNotificationLimitInformation2 ��� " JobObjectLimitViolationInformation2 �� # JobObjectCreateSilo �� $ JobObjectSiloBasicInformation % JobObjectReserved15Information ��� & JobObjectReserved16Information ��� ' JobObjectReserved17Information ��� ( JobObjectReserved18Information ��� ) JobObjectReserved19Information ��� * JobObjectReserved20Information ��� + JobObjectReserved21Information ��� , JobObjectReserved22Information ��� - JobObjectReserved23Information ��� . JobObjectReserved24Information ��� / JobObjectReserved25Information ��� 0 MaxJobObjectInfoClass > I t i _JOBOBJECTINFOCLASS .?AW4_JOBOBJECTINFOCLASS@@ � j ? P ObjectBasicInformation ��� ObjectNameInformation ObjectTypeInformation ObjectTypesInformation ��� ObjectHandleFlagInformation �� ObjectSessionInformation � ObjectSessionObjectInformation ��� MaxObjectInfoClass ���J t l _OBJECT_INFORMATION_CLASS .?AW4_OBJECT_INFORMATION_CLASS@@ �. onecore\internal\sdk\inc\ntobapi_x.h ��� m n e Z � _IMAGE_DYNAMIC_RELOCATION_TABLE .?AU_IMAGE_DYNAMIC_RELOCATION_TABLE@@ &
" Version ��
" Size �Z q _IMAGE_DYNAMIC_RELOCATION_TABLE .?AU_IMAGE_DYNAMIC_RELOCATION_TABLE@@ r � � � InternalWakeSourceDozeToHibernate InternalWakeSourcePredictedUserPresence �� InternalWakeSourceTimerOverride ��R t t PO_INTERNAL_WAKE_SOURCE_TYPE .?AW4PO_INTERNAL_WAKE_SOURCE_TYPE@@ ��� u x
� PsAttributeParentProcess � PsAttributeDebugObject ��� PsAttributeToken � PsAttributeClientId �� PsAttributeTebAddress PsAttributeImageName � PsAttributeImageInfo � PsAttributeMemoryReserve � PsAttributePriorityClass � PsAttributeErrorMode �
PsAttributeStdHandleInfo � PsAttributeHandleList PsAttributeGroupAffinity �
PsAttributePreferredNode � PsAttributeIdealProcessor PsAttributeUmsThread � PsAttributeMitigationOptions � PsAttributeProtectionLevel ��� PsAttributeSecureProcess � PsAttributeJobList ��� PsAttributeChildProcessPolicy PsAttributeAllApplicationPackagesPolicy �� PsAttributeWin32kFilter �� PsAttributeSafeOpenPromptOriginClaim � PsAttributeBnoIsolation �� PsAttributeDesktopAppPolicy �� PsAttributeChpe �� PsAttributeMitigationAuditOptions PsAttributeMax ���: t w _PS_ATTRIBUTE_NUM .?AW4_PS_ATTRIBUTE_NUM@@ � x � � SystemPowerPolicyAc �� SystemPowerPolicyDc �� VerifySystemPolicyAc � VerifySystemPolicyDc � SystemPowerCapabilities �� SystemBatteryState ��� SystemPowerStateHandler �� ProcessorStateHandler SystemPowerPolicyCurrent � AdministratorPowerPolicy �
SystemReserveHiberFile ��� ProcessorInformation � SystemPowerInformation ���
ProcessorStateHandler2 ��� LastWakeTime � LastSleepTime SystemExecutionState � SystemPowerStateNotifyHandler ProcessorPowerPolicyAc ��� ProcessorPowerPolicyDc ��� VerifyProcessorPowerPolicyAc � VerifyProcessorPowerPolicyDc � ProcessorPowerPolicyCurrent �� SystemPowerStateLogging �� SystemPowerLoggingEntry �� SetPowerSettingValue � NotifyUserPowerSetting ��� PowerInformationLevelUnused0 � SystemMonitorHiberBootPowerOff ��� SystemVideoState � TraceApplicationPowerMessage � TraceApplicationPowerMessageEnd �� ProcessorPerfStates �� ! ProcessorIdleStates �� " ProcessorCap � # SystemWakeSource � $ SystemHiberFileInformation ��� % TraceServicePowerMessage � & ProcessorLoad ' PowerShutdownNotification ( MonitorCapabilities �� ) SessionPowerInit � * SessionDisplayState �� + PowerRequestCreate ��� , PowerRequestAction ��� - GetPowerRequestList �� . ProcessorInformationEx ��� / NotifyUserModeLegacyPowerEvent ��� 0 GroupPark 1 ProcessorIdleDomains � 2 WakeTimerList 3 SystemHiberFileSize �� 4 ProcessorIdleStatesHv 5 ProcessorPerfStatesHv 6 ProcessorPerfCapHv ��� 7 ProcessorSetIdle � 8 LogicalProcessorIdling ��� 9 UserPresence � : PowerSettingNotificationName � ; GetPowerSettingValue � < IdleResiliency ��� = SessionRITState �� > SessionConnectNotification ��� ? SessionPowerCleanup �� @ SessionLockState � A SystemHiberbootState � B PlatformInformation �� C PdcInvocation D MonitorInvocation E FirmwareTableInformationRegistered ��� F SetShutdownSelectedTime �� G SuspendResumeInvocation �� H PlmPowerRequestCreate I ScreenOff J CsDeviceNotification � K PlatformRole � L LastResumePerformance M DisplayBurst � N ExitLatencySamplingPercentage O RegisterSpmPowerSettings � P PlatformIdleStates ��� Q ProcessorIdleVeto R PlatformIdleVeto � S SystemBatteryStatePrecise T ThermalEvent � U PowerRequestActionInternal ��� V BatteryDeviceState ��� W PowerInformationInternal � X ThermalStandby ��� Y SystemHiberFileType �� Z PhysicalPowerButtonPress � [ QueryPotentialDripsConstraint \ EnergyTrackerCreate �� ] EnergyTrackerQuery ��� ^ UpdateBlackBoxRecorder ��� _ SessionAllowExternalDmaDevices ��� ` PowerInformationLevelMaximum �F a t z POWER_INFORMATION_LEVEL .?AW4POWER_INFORMATION_LEVEL@@ � { x q ^
FileDirectoryInformation � FileFullDirectoryInformation � FileBothDirectoryInformation � FileBasicInformation � FileStandardInformation �� FileInternalInformation �� FileEaInformation FileAccessInformation FileNameInformation ��
FileRenameInformation FileLinkInformation �� FileNamesInformation �
FileDispositionInformation ��� FilePositionInformation �� FileFullEaInformation FileModeInformation �� FileAlignmentInformation � FileAllInformation ��� FileAllocationInformation FileEndOfFileInformation � FileAlternateNameInformation � FileStreamInformation FilePipeInformation �� FilePipeLocalInformation � FilePipeRemoteInformation FileMailslotQueryInformation � FileMailslotSetInformation ��� FileCompressionInformation ��� FileObjectIdInformation �� FileCompletionInformation FileMoveClusterInformation ��� FileQuotaInformation � ! FileReparsePointInformation �� " FileNetworkOpenInformation ��� # FileAttributeTagInformation �� $ FileTrackingInformation �� % FileIdBothDirectoryInformation ��� & FileIdFullDirectoryInformation ��� ' FileValidDataLengthInformation ��� ( FileShortNameInformation � ) FileIoCompletionNotificationInformation �� * FileIoStatusBlockRangeInformation + FileIoPriorityHintInformation , FileSfioReserveInformation ��� - FileSfioVolumeInformation . FileHardLinkInformation �� / FileProcessIdsUsingFileInformation ��� 0 FileNormalizedNameInformation 1 FileNetworkPhysicalNameInformation ��� 2 FileIdGlobalTxDirectoryInformation ��� 3 FileIsRemoteDeviceInformation 4 FileUnusedInformation 5 FileNumaNodeInformation �� 6 FileStandardLinkInformation �� 7 FileRemoteProtocolInformation 8 FileRenameInformationBypassAccessCheck ��� 9 FileLinkInformationBypassAccessCheck � : FileVolumeNameInformation ; FileIdInformation < FileIdExtdDirectoryInformation ��� = FileReplaceCompletionInformation � > FileHardLinkFullIdInformation ? FileIdExtdBothDirectoryInformation ��� @ FileDispositionInformationEx � A FileRenameInformationEx �� B FileRenameInformationExBypassAccessCheck � C FileDesiredStorageClassInformation ��� D FileStatInformation �� E FileMemoryPartitionInformation ��� F FileStatLxInformation G FileCaseSensitiveInformation � H FileLinkInformationEx I FileLinkInformationExBypassAccessCheck ��� J FileStorageReserveIdInformation �� K FileCaseSensitiveInformationForceAccessCheck � L FileMaximumInformation ���F L t } _FILE_INFORMATION_CLASS .?AW4_FILE_INFORMATION_CLASS@@ � ~ � \ V � _ENUM_SERVICE_STATUS_PROCESSA .?AU_ENUM_SERVICE_STATUS_PROCESSA@@ J � _SERVICE_STATUS_PROCESS .?AU_SERVICE_STATUS_PROCESS@@ R
p lpServiceName
p lpDisplayName
� ServiceStatusProcess �V � 8 _ENUM_SERVICE_STATUS_PROCESSA .?AU_ENUM_SERVICE_STATUS_PROCESSA@@ � � J � SERVICE_STATUS_HANDLE__ .?AUSERVICE_STATUS_HANDLE__@@
�
t unused ���J � SERVICE_STATUS_HANDLE__ .?AUSERVICE_STATUS_HANDLE__@@ � � � q " t �
� � RtlPathTypeUnknown ��� RtlPathTypeUncAbsolute ��� RtlPathTypeDriveAbsolute � RtlPathTypeDriveRelative � RtlPathTypeRooted RtlPathTypeRelative �� RtlPathTypeLocalDevice ��� RtlPathTypeRootLocalDevice ���6 t � _RTL_PATH_TYPE .?AW4_RTL_PATH_TYPE@@ ��� � � g � PlugPlayControlEnumerateDevice ��� PlugPlayControlRegisterNewDevice � PlugPlayControlDeregisterDevice �� PlugPlayControlInitializeDevice �� PlugPlayControlStartDevice ��� PlugPlayControlUnlockDevice �� PlugPlayControlQueryAndRemoveDevice �� PlugPlayControlUserResponse �� PlugPlayControlGenerateLegacyDevice �� PlugPlayControlGetInterfaceDeviceList
PlugPlayControlProperty �� PlugPlayControlDeviceClassAssociation PlugPlayControlGetRelatedDevice ��
PlugPlayControlGetInterfaceDeviceAlias ��� PlugPlayControlDeviceStatus �� PlugPlayControlGetDeviceDepth PlugPlayControlQueryDeviceRelations �� PlugPlayControlTargetDeviceRelation �� PlugPlayControlQueryConflictList � PlugPlayControlRetrieveDock �� PlugPlayControlResetDevice ��� PlugPlayControlHaltDevice PlugPlayControlGetBlockedDriverList �� PlugPlayControlGetDeviceInterfaceEnabled � MaxPlugPlayControl ���F t � _PLUGPLAY_CONTROL_CLASS .?AW4_PLUGPLAY_CONTROL_CLASS@@ � � % � LockQueueUnusedSpare0 LockQueueUnusedSpare1 LockQueueUnusedSpare2 LockQueueUnusedSpare3 LockQueueVacbLock LockQueueMasterLock �� LockQueueNonPagedPoolLock LockQueueIoCancelLock LockQueueUnusedSpare8 LockQueueIoVpbLock ���
LockQueueIoDatabaseLock �� LockQueueIoCompletionLock LockQueueNtfsStructLock ��
LockQueueAfdWorkQueueLock LockQueueBcbLock � LockQueueUnusedSpare15 ��� LockQueueUnusedSpare16 ��� LockQueueMaximumLock �J t � _KSPIN_LOCK_QUEUE_NUMBER .?AW4_KSPIN_LOCK_QUEUE_NUMBER@@ ��� � L | Z � _HEAP_REUSE_THRESHOLD_ACTIVATED .?AU_HEAP_REUSE_THRESHOLD_ACTIVATED@@ ^
j Header ���
HeapHandle ���
( SubSegment ���
" 0 BucketIndex ��Z � 4 _HEAP_REUSE_THRESHOLD_ACTIVATED .?AU_HEAP_REUSE_THRESHOLD_ACTIVATED@@ � c � � AccessReasonNone � � AccessReasonAllowedAce ��� � AccessReasonDeniedAce � AccessReasonAllowedParentAce � � AccessReasonDeniedParentAce �� � AccessReasonNotGrantedByCape � � AccessReasonNotGrantedByParentCape ��� � AccessReasonNotGrantedToAppContainer � � AccessReasonMissingPrivilege � � AccessReasonFromPrivilege � 0 AccessReasonIntegrityLevel ��� � @ AccessReasonOwnership � P AccessReasonNullDacl � � ` AccessReasonEmptyDacl � p AccessReasonNoSD � � � AccessReasonNoGrant �� � � AccessReasonTrustLabel ��� � � AccessReasonFilterAce > t � _ACCESS_REASON_TYPE .?AW4_ACCESS_REASON_TYPE@@ � � x � b � _PERFINFO_DRIVER_MAJORFUNCTION_RET .?AU_PERFINFO_DRIVER_MAJORFUNCTION_RET@@ ��*
Irp ��
" UniqMatchId ��b � _PERFINFO_DRIVER_MAJORFUNCTION_RET .?AU_PERFINFO_DRIVER_MAJORFUNCTION_RET@@ �� � c � * COMIMAGE_FLAGS_ILONLY COMIMAGE_FLAGS_32BITREQUIRED � COMIMAGE_FLAGS_IL_LIBRARY COMIMAGE_FLAGS_STRONGNAMESIGNED �� COMIMAGE_FLAGS_NATIVE_ENTRYPOINT � � COMIMAGE_FLAGS_TRACKDEBUGDATA � COMIMAGE_FLAGS_32BITPREFERRED COR_VERSION_MAJOR_V2 � COR_VERSION_MAJOR COR_VERSION_MINOR COR_DELETED_NAME_LENGTH �� COR_VTABLEGAP_NAME_LENGTH NATIVE_TYPE_MAX_CB ��� � COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE � IMAGE_COR_MIH_METHODRVA �� IMAGE_COR_MIH_EHRVA �� IMAGE_COR_MIH_BASICBLOCK � COR_VTABLE_32BIT � COR_VTABLE_64BIT � COR_VTABLE_FROM_UNMANAGED COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN ��� COR_VTABLE_CALL_MOST_DERIVED � IMAGE_COR_EATJ_THUNK_SIZE MAX_CLASS_NAME ��� MAX_PACKAGE_NAME �R t � ReplacesCorHdrNumericDefines .?AW4ReplacesCorHdrNumericDefines@@ ��� � � � V � _GENERIC_BINDING_ROUTINE_PAIR .?AU_GENERIC_BINDING_ROUTINE_PAIR@@
�
�
� �
� *
� pfnBind ��
� pfnUnbind V � _GENERIC_BINDING_ROUTINE_PAIR .?AU_GENERIC_BINDING_ROUTINE_PAIR@@ � � 5 R � _MEMORY_BASIC_INFORMATION64 .?AU_MEMORY_BASIC_INFORMATION64@@ �
# BaseAddress ��
# AllocationBase ���
" AllocationProtect
" __alignment1 �
# RegionSize ���
" State
" $ Protect ��
" ( Type �
" , __alignment2 �R � 0 _MEMORY_BASIC_INFORMATION64 .?AU_MEMORY_BASIC_INFORMATION64@@ � � i ^ � _LEAP_SECOND_DATA_REGISTRY_ENTRY .?AU_LEAP_SECOND_DATA_REGISTRY_ENTRY@@ ��
� f
Year �
Month
Day ��
Hour �
Flags
Reserved �^ � _LEAP_SECOND_DATA_REGISTRY_ENTRY .?AU_LEAP_SECOND_DATA_REGISTRY_ENTRY@@ �� � � � * � __n64x4 .?AU__n64x4@@ " �
� val ��* � __n64x4 .?AU__n64x4@@ � * � > � tagCANDIDATEFORM .?AUtagCANDIDATEFORM@@ ��
� V
" dwIndex ��
" dwStyle ��
� ptCurrentPos �
! rcArea ���> � tagCANDIDATEFORM .?AUtagCANDIDATEFORM@@ ��& onecore\external\sdk\inc\imm.h � � � < R � _FILE_IO_PRIORITY_HINT_INFO .?AU_FILE_IO_PRIORITY_HINT_INFO@@
� r IoPriorityHintVeryLow IoPriorityHintLow IoPriorityHintNormal � MaximumIoPriorityHintType 6 t � _PRIORITY_HINT .?AW4_PRIORITY_HINT@@ ��� � o �"
� PriorityHint �R � _FILE_IO_PRIORITY_HINT_INFO .?AU_FILE_IO_PRIORITY_HINT_INFO@@ � o �" � � � � J � _IO_RESOURCE_DESCRIPTOR .?AU_IO_RESOURCE_DESCRIPTOR@@ b
" Length ���
" Alignment
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � b
" Length ���
" Alignment
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � IrqPolicyMachineDefault �� IrqPolicyAllCloseProcessors �� IrqPolicyOneCloseProcessor ��� IrqPolicyAllProcessorsInMachine �� IrqPolicySpecifiedProcessors � IrqPolicySpreadMessagesAcrossAllProcessors ��� IrqPolicyAllProcessorsInMachineWhenSteered ���> t � _IRQ_DEVICE_POLICY .?AW4_IRQ_DEVICE_POLICY@@ ��� � x f IrqPriorityUndefined � IrqPriorityLow ��� IrqPriorityNormal IrqPriorityHigh ��2 t � _IRQ_PRIORITY .?AW4_IRQ_PRIORITY@@ � � � �
" MinimumVector
" MaximumVector
� AffinityPolicy ���
� PriorityPolicy ���
# TargetedProcessors ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � :
" MinimumChannel ���
" MaximumChannel ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � Z
" RequestLine ��
" Reserved �
" Channel ��
" TransferWidth : � <anonymous-tag> .?AU<anonymous-tag>@@ � � b
" Length ���
" Alignment
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � �
� Data �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � Z
" Length ���
" MinBusNumber �
" MaxBusNumber �
" Reserved �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � >
" Priority �
" Reserved1
" Reserved2 : � <anonymous-tag> .?AU<anonymous-tag>@@ � � f
" Length40 �
" Alignment40 ��
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � f
" Length48 �
" Alignment48 ��
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � f
" Length64 �
" Alignment64 ��
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � v
Class
Type �
Reserved1
Reserved2
" IdLowPart
" IdHighPart ���: � <anonymous-tag> .?AU<anonymous-tag>@@ �
� Port �
� Memory ���
� Interrupt
� Dma ��
� DmaV3
� Generic ��
� DevicePrivate
� BusNumber
� ConfigData ���
� Memory40 �
� Memory48 �
� Memory64 �
� Connection ���2
� <anonymous-tag> .?AT<anonymous-tag>@@ � � �
Option ���
Type �
ShareDisposition �
Spare1 ���
! Flags
! Spare2 ���
� u J � _IO_RESOURCE_DESCRIPTOR .?AU_IO_RESOURCE_DESCRIPTOR@@ � � > KeyBasicInformation �� KeyNodeInformation ��� KeyFullInformation ��� KeyNameInformation ��� KeyCachedInformation � KeyFlagsInformation �� KeyVirtualizationInformation � KeyHandleTagsInformation � KeyTrustInformation �� KeyLayerInformation ��
MaxKeyInfoClass ��F t _KEY_INFORMATION_CLASS .?AW4_KEY_INFORMATION_CLASS@@ ���. onecore\internal\sdk\inc\ntregapi_x.h �� b � _SYSTEM_SECURITY_MODEL_INFORMATION .?AU_SYSTEM_SECURITY_MODEL_INFORMATION@@ ��
" ��
" ��
" ��f
SModeAdminlessEnabled
AllowDeviceOwnerProtectionDowngrade ��
Reserved �: <anonymous-tag> .?AU<anonymous-tag>@@
� <
"
SecurityModelFlags ���b _SYSTEM_SECURITY_MODEL_INFORMATION .?AU_SYSTEM_SECURITY_MODEL_INFORMATION@@ ��
� ;
4 z � _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY@@ ��b
� UserShadowStack ��
� SetContextIpValidation ���
� BlockNonCetBinaries ��z _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY@@ �� ^ V � _FILE_PIPE_LOCAL_INFORMATION .?AU_FILE_PIPE_LOCAL_INFORMATION@@ ��
" NamedPipeType
" NamedPipeConfiguration ���
" MaximumInstances �
" CurrentInstances �
" InboundQuota �
" ReadDataAvailable
" OutboundQuota
" WriteQuotaAvailable ��
" NamedPipeState ���
" $ NamedPipeEnd �V
( _FILE_PIPE_LOCAL_INFORMATION .?AU_FILE_PIPE_LOCAL_INFORMATION@@ �� � M � LearningModeLogLevelPassive �� LearningModeLogLevelNormalApc LearningModeLogLevelSpecialApc ��� LearningModeLogLevelMax ��J t _LEARNING_MODE_LOG_LEVEL .?AW4_LEARNING_MODE_LOG_LEVEL@@ ��� � � ^ � _IMAGE_RESOURCE_DIRECTORY_STRING .?AU_IMAGE_RESOURCE_DIRECTORY_STRING@@ ��
p " �.
! Length ���
NameString ���^ _IMAGE_RESOURCE_DIRECTORY_STRING .?AU_IMAGE_RESOURCE_DIRECTORY_STRING@@ �� � f 2 � DLGTEMPLATE .?AUDLGTEMPLATE@@
" ��
# v
" style
" dwExtendedStyle ��
! cdit �
x
y
cx ���
cy ���2 % DLGTEMPLATE .?AUDLGTEMPLATE@@ & ( J � tagEMRSETVIEWPORTEXTEX .?AUtagEMRSETVIEWPORTEXTEX@@ ��
( &
� emr ��
e szlExtent J * tagEMRSETVIEWPORTEXTEX .?AUtagEMRSETVIEWPORTEXTEX@@ �� + � � R CacheUnified � CacheInstruction � CacheData CacheTrace ���B t - _PROCESSOR_CACHE_TYPE .?AW4_PROCESSOR_CACHE_TYPE@@ � . � � J � _QUERY_SERVICE_CONFIGA .?AU_QUERY_SERVICE_CONFIGA@@ ���
" dwServiceType
" dwStartType ��
" dwErrorControl ���
p lpBinaryPathName �
p lpLoadOrderGroup �
" dwTagId ��
p ( lpDependencies ���
p 0 lpServiceStartName ���
p 8 lpDisplayName J 1 @ _QUERY_SERVICE_CONFIGA .?AU_QUERY_SERVICE_CONFIGA@@ �� 2 � 0 > � tagMSGBOXPARAMSA .?AUtagMSGBOXPARAMSA@@ ��
� 2 � tagHELPINFO .?AUtagHELPINFO@@
6
7 8
9 �
u cbSize ���
� hwndOwner
5 hInstance
� lpszText �
� lpszCaption ��
" ( dwStyle ��
� 0 lpszIcon �
# 8 dwContextHelpId ��
: @ lpfnMsgBoxCallback ���
" H dwLanguageId �>
; P tagMSGBOXPARAMSA .?AUtagMSGBOXPARAMSA@@ �� < $ V � _KEY_VALUE_LAYER_INFORMATION .?AU_KEY_VALUE_LAYER_INFORMATION@@ ��
" ��
" ��.
? IsTombstone ��
@ Reserved �V A _KEY_VALUE_LAYER_INFORMATION .?AU_KEY_VALUE_LAYER_INFORMATION@@ �� B f F � _PEBS_DS_SAVE_AREA32 .?AU_PEBS_DS_SAVE_AREA32@@ ��
D # " @ �"
" BtsBufferBase
" BtsIndex �
" BtsAbsoluteMaximum ���
" BtsInterruptThreshold
" PebsBufferBase ���
" PebsIndex
" PebsAbsoluteMaximum ��
" PebsInterruptThreshold ���
F PebsGpCounterReset ���
9 ` PebsFixedCounterReset F
G � _PEBS_DS_SAVE_AREA32 .?AU_PEBS_DS_SAVE_AREA32@@ �� H � � . � tagXFORM .?AUtagXFORM@@ ��b
@ eM11 �
@ eM12 �
@ eM21 �
@ eM22 �
@ eDx ��
@ eDy ��.
K tagXFORM .?AUtagXFORM@@ �� L � N V � _ACTIVATION_CONTEXT_MSIX_INFO .?AU_ACTIVATION_CONTEXT_MSIX_INFO@@ q " �&
O ApplicationUserModelId ���V P _ACTIVATION_CONTEXT_MSIX_INFO .?AU_ACTIVATION_CONTEXT_MSIX_INFO@@ Q � / J � _FILE_STAT_INFORMATION .?AU_FILE_STAT_INFORMATION@@ ��
� FileId ���
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( AllocationSize ���
� 0 EndOfFile
" 8 FileAttributes ���
" < ReparseTag ���
" @ NumberOfLinks
" D EffectiveAccess ��J T H _FILE_STAT_INFORMATION .?AU_FILE_STAT_INFORMATION@@ �� U � I ^ � _PERFINFO_FILEOBJECT_INFORMATION .?AU_PERFINFO_FILEOBJECT_INFORMATION@@ ��
W
FileObject ���^ Y _PERFINFO_FILEOBJECT_INFORMATION .?AU_PERFINFO_FILEOBJECT_INFORMATION@@ �� Z c c f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W@@ ��
TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
q ServerCertificateSubject �
( ProxyCredentials �
" 0 NumberOfProxyAuthnSchemes
" 8 ProxyAuthnSchemes f ] @ _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W@@ ��. onecore\external\shared\inc\rpcdce.h ��� ^ _ � F � tagPOINTER_TYPE_INFO .?AUtagPOINTER_TYPE_INFO@@ ��
a F � tagPOINTER_TOUCH_INFO .?AUtagPOINTER_TOUCH_INFO@@ B � tagPOINTER_PEN_INFO .?AUtagPOINTER_PEN_INFO@@ :
" type �
c touchInfo
d penInfo ��F e � tagPOINTER_TYPE_INFO .?AUtagPOINTER_TYPE_INFO@@ �� f H � DISPLAYCONFIG_TOPOLOGY_INTERNAL �� DISPLAYCONFIG_TOPOLOGY_CLONE � DISPLAYCONFIG_TOPOLOGY_EXTEND DISPLAYCONFIG_TOPOLOGY_EXTERNAL �� ��DISPLAYCONFIG_TOPOLOGY_FORCE_UINT32 �J t h DISPLAYCONFIG_TOPOLOGY_ID .?AW4DISPLAYCONFIG_TOPOLOGY_ID@@ � i � � � % V � _FILE_ID_EXTD_DIR_INFORMATION .?AU_FILE_ID_EXTD_DIR_INFORMATION@@
l 6 � _FILE_ID_128 .?AU_FILE_ID_128@@ ��V
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
" D ReparsePointTag ��
n H FileId ���
| X FileName �V o ` _FILE_ID_EXTD_DIR_INFORMATION .?AU_FILE_ID_EXTD_DIR_INFORMATION@@ p � @ Z � _KAFFINITY_ENUMERATION_CONTEXT .?AU_KAFFINITY_ENUMERATION_CONTEXT@@ ��6 � _KAFFINITY_EX .?AU_KAFFINITY_EX@@
s F
t Affinity �
# CurrentMask ��
! CurrentIndex �Z u _KAFFINITY_ENUMERATION_CONTEXT .?AU_KAFFINITY_ENUMERATION_CONTEXT@@ ��* onecore\internal\sdk\inc\affinity.h v w s : � tagKERNINGPAIR .?AUtagKERNINGPAIR@@ ��B
! wFirst ���
! wSecond ��
t iKernAmount ��: z tagKERNINGPAIR .?AUtagKERNINGPAIR@@ �� { � $ R � _UMS_SCHEDULER_STARTUP_INFO .?AU_UMS_SCHEDULER_STARTUP_INFO@@
}
` j
" UmsVersion ���
CompletionList ���
SchedulerProc
SchedulerParam ���R � _UMS_SCHEDULER_STARTUP_INFO .?AU_UMS_SCHEDULER_STARTUP_INFO@@ � o 2 B � _WMI_PNP_RECORD_V3 .?AU_WMI_PNP_RECORD_V3@@ ��f
" IDLength �
" DescriptionLength
" FriendlyNameLength ���
| Strings ��B � _WMI_PNP_RECORD_V3 .?AU_WMI_PNP_RECORD_V3@@ �� � c � b � _FILE_ID_EXTD_BOTH_DIR_INFORMATION .?AU_FILE_ID_EXTD_BOTH_DIR_INFORMATION@@ ��
� q " �
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
" D ReparsePointTag ��
n H FileId ���
p X ShortNameLength ��
� Z ShortName
| r FileName �b � x _FILE_ID_EXTD_BOTH_DIR_INFORMATION .?AU_FILE_ID_EXTD_BOTH_DIR_INFORMATION@@ �� � � Q R � _PROCESS_HANDLE_INFORMATION .?AU_PROCESS_HANDLE_INFORMATION@@
� >
" HandleCount ��
" HandleCountHighWatermark �R � _PROCESS_HANDLE_INFORMATION .?AU_PROCESS_HANDLE_INFORMATION@@ � � # ^ � _EVENT_TRACE_SPINLOCK_INFORMATION .?AU_EVENT_TRACE_SPINLOCK_INFORMATION@@
� �
@ EventTraceInformationClass ���
" SpinLockSpinThreshold
" SpinLockAcquireSampleRate
" SpinLockContentionSampleRate �
" SpinLockHoldThreshold ^ � _EVENT_TRACE_SPINLOCK_INFORMATION .?AU_EVENT_TRACE_SPINLOCK_INFORMATION@@ � A J � _TRACE_LOGFILE_HEADER64 .?AU_TRACE_LOGFILE_HEADER64@@
� f
MajorVersion �
MinorVersion �
SubVersion ���
SubMinorVersion ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � � J � _TIME_ZONE_INFORMATION .?AU_TIME_ZONE_INFORMATION@@ ��.
" BufferSize ���
" Version ��
� VersionDetail
" ProviderVersion ��
" NumberOfProcessors ���
� EndTime ��
" TimerResolution ��
" MaximumFileSize ��
" LogFileMode ��
" $ BuffersWritten ���
( LogInstanceGuid ��
" ( StartBuffers �
" , PointerSize ��
" 0 EventsLost ���
" 4 CpuSpeedInMHz
# 8 LoggerName ���
# @ LogFileName ��
� H TimeZone �
� � BootTime �
� PerfFreq �
� StartTime
" ReservedFlags
" BuffersLost ��J � _TRACE_LOGFILE_HEADER64 .?AU_TRACE_LOGFILE_HEADER64@@ � � B � _RESUME_PERFORMANCE .?AU_RESUME_PERFORMANCE@@
� Z
" PostTimeMs ���
# TotalResumeTimeMs
# ResumeCompleteTimestamp ��B � _RESUME_PERFORMANCE .?AU_RESUME_PERFORMANCE@@ � x ` � FpFormatFp32 � FpFormatFp64 � FpFormatFp80 � FpFormatFp128 FpFormatI16 �� FpFormatI32 �� FpFormatI64 �� FpFormatU16 �� FpFormatU32 �� FpFormatU64 ��
FpFormatCompare �� FpFormatString ���: t � _FP__IEEE_FORMAT .?AW4_FP__IEEE_FORMAT@@ ���* onecore\internal\sdk\inc\ntxcapi.h � � � U J � _APP_MEMORY_INFORMATION .?AU_APP_MEMORY_INFORMATION@@
� ~
# AvailableCommit ��
# PrivateCommitUsage ���
# PeakPrivateCommitUsage ���
# TotalCommitUsage �J � _APP_MEMORY_INFORMATION .?AU_APP_MEMORY_INFORMATION@@ : onecore\external\sdk\inc\minwin\processthreadsapi.h � � � B � tagWNODE_EVENT_ITEM .?AUtagWNODE_EVENT_ITEM@@
� 6 � _WNODE_HEADER .?AU_WNODE_HEADER@@
� WnodeHeader ��B � 0 tagWNODE_EVENT_ITEM .?AUtagWNODE_EVENT_ITEM@@ . onecore\external\shared\inc\wmistr.h ��� � � J � _POWER_IDLE_RESILIENCY .?AU_POWER_IDLE_RESILIENCY@@ ��>
" CoalescingTimeout
" IdleResiliencyPeriod �J � _POWER_IDLE_RESILIENCY .?AU_POWER_IDLE_RESILIENCY@@ �� � x > PsProtectedSignerNone PsProtectedSignerAuthenticode PsProtectedSignerCodeGen � PsProtectedSignerAntimalware � PsProtectedSignerLsa � PsProtectedSignerWindows � PsProtectedSignerWinTcb �� PsProtectedSignerWinSystem ��� PsProtectedSignerApp � PsProtectedSignerMax �B
t � _PS_PROTECTED_SIGNER .?AW4_PS_PROTECTED_SIGNER@@ ��� � � j J � _TOKEN_MANDATORY_POLICY .?AU_TOKEN_MANDATORY_POLICY@@
" Policy ���J � _TOKEN_MANDATORY_POLICY .?AU_TOKEN_MANDATORY_POLICY@@ � x � V TokenUser TokenGroups �� TokenPrivileges �� TokenOwner ��� TokenPrimaryGroup TokenDefaultDacl � TokenSource �� TokenType TokenImpersonationLevel ��
TokenStatistics �� TokenRestrictedSids �� TokenSessionId ���
TokenGroupsAndPrivileges � TokenSessionReference TokenSandBoxInert TokenAuditPolicy � TokenOrigin �� TokenElevationType ��� TokenLinkedToken � TokenElevation ��� TokenHasRestrictions � TokenAccessInformation ��� TokenVirtualizationAllowed ��� TokenVirtualizationEnabled ��� TokenIntegrityLevel �� TokenUIAccess TokenMandatoryPolicy � TokenLogonSid TokenIsAppContainer �� TokenCapabilities TokenAppContainerSid � TokenAppContainerNumber �� ! TokenUserClaimAttributes � " TokenDeviceClaimAttributes ��� # TokenRestrictedUserClaimAttributes ��� $ TokenRestrictedDeviceClaimAttributes � % TokenDeviceGroups & TokenRestrictedDeviceGroups �� ' TokenSecurityAttributes �� ( TokenIsRestricted ) TokenProcessTrustLevel ��� * TokenPrivateNameSpace + TokenSingletonAttributes � , TokenBnoIsolation - TokenChildProcessFlags ��� . TokenIsLessPrivilegedAppContainer / TokenIsSandboxed � 0 TokenOriginatingProcessTrustLevel 1 MaxTokenInfoClass J 1 t � _TOKEN_INFORMATION_CLASS .?AW4_TOKEN_INFORMATION_CLASS@@ ��� � x 8 : � tagEMRPOLYDRAW .?AUtagEMRPOLYDRAW@@ ��* � _POINTL .?AU_POINTL@@ � " � " �Z
� emr ��
d rclBounds
" cptl �
� aptl �
� $ abTypes ��: � ( tagEMRPOLYDRAW .?AUtagEMRPOLYDRAW@@ �� � � Q Z � _PROCESS_DEVICEMAP_INFORMATION .?AU_PROCESS_DEVICEMAP_INFORMATION@@ ��
DirectoryHandle ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � ? " �*
" DriveMap �
� DriveType : � $ <anonymous-tag> .?AU<anonymous-tag>@@ � ? "
� Set ��
� Query Z � ( _PROCESS_DEVICEMAP_INFORMATION .?AU_PROCESS_DEVICEMAP_INFORMATION@@ �� � ? z GEO_NATION ��� GEO_LATITUDE � GEO_LONGITUDE GEO_ISO2 � GEO_ISO3 � GEO_RFC1766 �� GEO_LCID � GEO_FRIENDLYNAME � GEO_OFFICIALNAME �
GEO_TIMEZONES GEO_OFFICIALLANGUAGES GEO_ISO_UN_NUMBER
GEO_PARENT ��� GEO_DIALINGCODE �� GEO_CURRENCYCODE � GEO_CURRENCYSYMBOL ��� GEO_NAME � GEO_ID ���. t � SYSGEOTYPE .?AW4SYSGEOTYPE@@ ��� � W > � _OVERLAPPED_ENTRY .?AU_OVERLAPPED_ENTRY@@
� 2 � _OVERLAPPED .?AU_OVERLAPPED@@
� r
# lpCompletionKey ��
� lpOverlapped �
# Internal �
" dwNumberOfBytesTransferred ���> � _OVERLAPPED_ENTRY .?AU_OVERLAPPED_ENTRY@@ 6 onecore\external\sdk\inc\minwin\minwinbase.h ��� � � B
� Z � _IMAGE_DYNAMIC_RELOCATION64_V2 .?AU_IMAGE_DYNAMIC_RELOCATION64_V2@@ ��n
" HeaderSize ���
" FixupInfoSize
# Symbol ���
" SymbolGroup ��
" Flags Z � _IMAGE_DYNAMIC_RELOCATION64_V2 .?AU_IMAGE_DYNAMIC_RELOCATION64_V2@@ �� � � � B � tagBITMAPINFOHEADER .?AUtagBITMAPINFOHEADER@@
�
" biSize ���
biWidth ��
biHeight �
! biPlanes �
! biBitCount ���
" biCompression
" biSizeImage ��
biXPelsPerMeter ��
biYPelsPerMeter ��
" biClrUsed
" $ biClrImportant ���B � ( tagBITMAPINFOHEADER .?AUtagBITMAPINFOHEADER@@ � � , Z � _SYSTEM_RESOURCE_ATTRIBUTE_ACE .?AU_SYSTEM_RESOURCE_ATTRIBUTE_ACE@@ ��2 � _ACE_HEADER .?AU_ACE_HEADER@@ :
� Header ���
" Mask �
" SidStart �Z � _SYSTEM_RESOURCE_ATTRIBUTE_ACE .?AU_SYSTEM_RESOURCE_ATTRIBUTE_ACE@@ �� � x � R � _EVENT_TRACE_PROPERTIES_V2 .?AU_EVENT_TRACE_PROPERTIES_V2@@ ��
" ��N � _EVENT_FILTER_DESCRIPTOR .?AU_EVENT_FILTER_DESCRIPTOR@@ ��
�
" ��
" ��
" ��
" ���
� Wnode
" 0 BufferSize ���
" 4 MinimumBuffers ���
" 8 MaximumBuffers ���
" < MaximumFileSize ��
" @ LogFileMode ��
" D FlushTimer ���
" H EnableFlags ��
L AgeLimit �
L FlushThreshold ���
" P NumberOfBuffers ��
" T FreeBuffers ��
" X EventsLost ���
" \ BuffersWritten ���
" ` LogBuffersLost ���
" d RealTimeBuffersLost ��
h LoggerThreadId ���
" p LogFileNameOffset
" t LoggerNameOffset �
� x VersionNumber
" x V2Control
" | FilterDescCount ��
� � FilterDesc ���
� � Wow ��
� � QpcDeltaTracking �
� � LargeMdlPages
� � ExcludeKernelStack ���
# � V2Options R � � _EVENT_TRACE_PROPERTIES_V2 .?AU_EVENT_TRACE_PROPERTIES_V2@@ �� � � z F � _ENUM_SERVICE_STATUSW .?AU_ENUM_SERVICE_STATUSW@@ : � _SERVICE_STATUS .?AU_SERVICE_STATUS@@ J
q lpServiceName
q lpDisplayName
� ServiceStatus F � 0 _ENUM_SERVICE_STATUSW .?AU_ENUM_SERVICE_STATUSW@@ � � � R � _PROCESS_MEMORY_ALLOCATION_MODE .?AT_PROCESS_MEMORY_ALLOCATION_MODE@@
" ��
" ��:
" Flags
TopDown ��
Reserved �R _PROCESS_MEMORY_ALLOCATION_MODE .?AT_PROCESS_MEMORY_ALLOCATION_MODE@@ � � > � _CM_PERF_COUNTERS .?AU_CM_PERF_COUNTERS@@ *
# OpenedKeys ���
# DelayCloseKCBs ���
# PrivateAllocPages
# PrivateAllocFree �
# PrivateAllocUsed �
# ( LookupCacheHit ���
# 0 LookupCacheMissFound �
# 8 LookupCacheMissNotFound ��
# @ ViewMap ��
# H ViewUnMap
# P HiveShrink ���> X _CM_PERF_COUNTERS .?AU_CM_PERF_COUNTERS@@ c 0 B � _EVENT_TRACE_HEADER .?AU_EVENT_TRACE_HEADER@@ 6
Type �
Level
! Version ��: <anonymous-tag> .?AU<anonymous-tag>@@
� + N
! Size �
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��
" Version ��
Class
" ThreadId �
" ProcessId
� TimeStamp
Guid �
# GuidPtr ��
" ( KernelTime ���
" , UserTime �
# ( ProcessorTime
" ( ClientContext
" , Flags B 0 _EVENT_TRACE_HEADER .?AU_EVENT_TRACE_HEADER@@ � : � tagTEXTMETRICW .?AUtagTEXTMETRICW@@ ���
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
q , tmFirstChar ��
q . tmLastChar ���
q 0 tmDefaultChar
q 2 tmBreakChar ��
4 tmItalic �
5 tmUnderlined �
6 tmStruckOut ��
7 tmPitchAndFamily �
8 tmCharSet : < tagTEXTMETRICW .?AUtagTEXTMETRICW@@ �� � � � BackTraceDatabaseCreate �� BackTraceDatabaseDelete �� BackTraceDatabaseFlush ��� BackTraceDatabaseMaxControl ��Z t _RTL_STACK_TRACE_DATABASE_CONTROL .?AW4_RTL_STACK_TRACE_DATABASE_CONTROL@@ � � � FpCodeUnspecified FpCodeAdd FpCodeSubtract ��� FpCodeMultiply ��� FpCodeDivide � FpCodeSquareRoot � FpCodeRemainder �� FpCodeCompare FpCodeConvert FpCodeRound ��
FpCodeTruncate ��� FpCodeFloor �� FpCodeCeil ���
FpCodeAcos ��� FpCodeAsin ��� FpCodeAtan ��� FpCodeAtan2 �� FpCodeCabs ��� FpCodeCos FpCodeCosh ��� FpCodeExp FpCodeFabs ��� FpCodeFmod ��� FpCodeFrexp �� FpCodeHypot �� FpCodeLdexp �� FpCodeLog FpCodeLog10 �� FpCodeModf ��� FpCodePow FpCodeSin FpCodeSinh ��� FpCodeTan ! FpCodeTanh ��� " FpCodeY0 � # FpCodeY1 � $ FpCodeYn �F % t _FP_IEEE_OPERATION_CODE .?AW4_FP_IEEE_OPERATION_CODE@@ � � h R � _IMAGE_DELAYLOAD_DESCRIPTOR .?AU_IMAGE_DELAYLOAD_DESCRIPTOR@@
" ��
" ��N
" AllAttributes
RvaBased �
ReservedAttributes ���2 <anonymous-tag> .?AT<anonymous-tag>@@ � �
Attributes ���
" DllNameRVA ���
" ModuleHandleRVA ��
" ImportAddressTableRVA
" ImportNameTableRVA ���
" BoundImportAddressTableRVA ���
" UnloadInformationTableRVA
" TimeDateStamp R " _IMAGE_DELAYLOAD_DESCRIPTOR .?AU_IMAGE_DELAYLOAD_DESCRIPTOR@@ # � � SystemVaTypeAll �� SystemVaTypeNonPagedPool � SystemVaTypePagedPool SystemVaTypeSystemCache �� SystemVaTypeSystemPtes ��� SystemVaTypeSessionSpace � SystemVaTypeMax ��6 t % _SYSTEM_VA_TYPE .?AW4_SYSTEM_VA_TYPE@@ � & � �
: VRF_TRIAGE_CONTEXT_NONE �� VRF_TRIAGE_CONTEXT_DEFAULT ��� VRF_TRIAGE_CONTEXT_DEVELOPMENT ��� VRF_TRIAGE_CONTEXT_CERTIFICATION � VRF_TRIAGE_CONTEXT_FLIGHT_TARGETED ��� VRF_TRIAGE_CONTEXT_FLIGHT_DIAGNOSTICS VRF_TRIAGE_CONTEXT_FLIGHT_MONITORING � NUM_VRF_TRIAGE_CONTEXTS ��> t ( _VRF_TRIAGE_CONTEXT .?AW4_VRF_TRIAGE_CONTEXT@@ � ) � � 6 � _PS_PKG_CLAIM .?AU_PS_PKG_CLAIM@@
" ��&
" Flags
, Origin ���6 - _PS_PKG_CLAIM .?AU_PS_PKG_CLAIM@@ . � j
R � _ETW_DISABLE_KTIMER2_EVENT .?AU_ETW_DISABLE_KTIMER2_EVENT@@ ��^
# TimerKey �
# DisableCallback ��
# DisableContextKey
Flags R 1 _ETW_DISABLE_KTIMER2_EVENT .?AU_ETW_DISABLE_KTIMER2_EVENT@@ �� 2 c � � SystemPixelFormatUnknown � SystemPixelFormatR8G8B8 �� SystemPixelFormatR8G8B8X8 SystemPixelFormatB8G8R8 �� SystemPixelFormatB8G8R8X8 B t 4 _SYSTEM_PIXEL_FORMAT .?AW4_SYSTEM_PIXEL_FORMAT@@ ��� 5 � U
" " �
8 Data �j 9 _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET@@ �� : � b FpCompareEqual ��� FpCompareGreater � FpCompareLess FpCompareUnordered ���F t < _FP_IEEE_COMPARE_RESULT .?AW4_FP_IEEE_COMPARE_RESULT@@ � = � J : � _ETW_LBR_ENTRY .?AU_ETW_LBR_ENTRY@@ ��B
FromAddress ��
ToAddress
Reserved �: @ _ETW_LBR_ENTRY .?AU_ETW_LBR_ENTRY@@ �� A c R � _FILE_FS_DEVICE_INFORMATION .?AU_FILE_FS_DEVICE_INFORMATION@@
C 6
" DeviceType ���
" Characteristics ��R E _FILE_FS_DEVICE_INFORMATION .?AU_FILE_FS_DEVICE_INFORMATION@@ F � � R � _FILE_FS_VOLUME_INFORMATION .?AU_FILE_FS_VOLUME_INFORMATION@@ �
� VolumeCreationTime ���
" VolumeSerialNumber ���
" VolumeLabelLength
SupportsObjects ��
| VolumeLabel ��R I _FILE_FS_VOLUME_INFORMATION .?AU_FILE_FS_VOLUME_INFORMATION@@ J � � SmallBusiness Enterprise ��� BackOffice ��� CommunicationServer �� TerminalServer ��� SmallBusinessRestricted �� EmbeddedNT ��� DataCenter ��� SingleUserTS � Personal �
Blade EmbeddedRestricted ��� SecurityAppliance
StorageServer ComputeServer WHServer � PhoneNT �� MultiUserTS �� MaxSuiteType �. t L _SUITE_TYPE .?AW4_SUITE_TYPE@@ � M � & MemExtendedParameterInvalidType �� MemExtendedParameterAddressRequirements �� MemExtendedParameterNumaNode � MemExtendedParameterPartitionHandle �� MemExtendedParameterUserPhysicalHandle ��� MemExtendedParameterAttributeFlags ��� MemExtendedParameterMax ��N t O MEM_EXTENDED_PARAMETER_TYPE .?AW4MEM_EXTENDED_PARAMETER_TYPE@@ � P � � � PnpQueryEjectRelations ��� PnpQueryRemovalRelations � PnpQueryPowerRelations ��� PnpQueryBusRelations � PnpQueryTransportRelations ��� MaxPnpQueryRelations �> t R _PNP_QUERY_RELATION .?AW4_PNP_QUERY_RELATION@@ � S % � 6 � _CM_ROM_BLOCK .?AU_CM_ROM_BLOCK@@
U &
" Address ��
" Size �6 W _CM_ROM_BLOCK .?AU_CM_ROM_BLOCK@@ X � B � _LOAD_ASDATA_TABLE .?AU_LOAD_ASDATA_TABLE@@ ��
Module ���
q FilePath �
# Size �
Handle ���
RefCount �
� ( EntryPointActivationContext ��B [ 0 _LOAD_ASDATA_TABLE .?AU_LOAD_ASDATA_TABLE@@ �� \ � P v EDIT_CONTROL_FEATURE_ENTERPRISE_DATA_PROTECTION_PASTE_SUPPORT EDIT_CONTROL_FEATURE_PASTE_NOTIFICATIONS �B t ^ EDIT_CONTROL_FEATURE .?AW4EDIT_CONTROL_FEATURE@@ ��� _
, F � _RTL_TRACE_ENUMERATE .?AU_RTL_TRACE_ENUMERATE@@ ��
a B � _RTL_TRACE_DATABASE .?AU_RTL_TRACE_DATABASE@@
c > � _RTL_TRACE_BLOCK .?AU_RTL_TRACE_BLOCK@@ ��
e 6
d Database �
" Index
f Block F g _RTL_TRACE_ENUMERATE .?AU_RTL_TRACE_ENUMERATE@@ �� h ( J � _DUPLICATE_EXTENTS_DATA .?AU_DUPLICATE_EXTENTS_DATA@@
j f
FileHandle ���
� SourceFileOffset �
� TargetFileOffset �
� ByteCount J l _DUPLICATE_EXTENTS_DATA .?AU_DUPLICATE_EXTENTS_DATA@@ m � O V � _IMAGE_ARCHIVE_MEMBER_HEADER .?AU_IMAGE_ARCHIVE_MEMBER_HEADER@@ �� " � " � "
�~
p Name �
q Date �
UserID ���
" GroupID ��
( Mode �
r 0 Size �
� : EndHeader V s < _IMAGE_ARCHIVE_MEMBER_HEADER .?AU_IMAGE_ARCHIVE_MEMBER_HEADER@@ �� t � U > � _WIN32_FIND_DATAA .?AU_WIN32_FIND_DATAA@@
v . � _FILETIME .?AU_FILETIME@@ p " � p " �
" dwFileAttributes �
x ftCreationTime ���
x ftLastAccessTime �
x ftLastWriteTime ��
" nFileSizeHigh
" nFileSizeLow �
" $ dwReserved0 ��
" ( dwReserved1 ��
y , cFileName
z 0cAlternateFileName ���>
{ @_WIN32_FIND_DATAA .?AU_WIN32_FIND_DATAA@@ | � f B � _EXCEPTION_POINTERS .?AU_EXCEPTION_POINTERS@@
~
" �
� ~ � _IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@
� ��
�
" ��
" ��
"
��N
� PageRelativeOffset ���
� IndirectCall �
� IATIndex �~ � _IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@ � � � V � _TRANSACTION_ENLISTMENT_PAIR .?AU_TRANSACTION_ENLISTMENT_PAIR@@ ��6
EnlistmentId �
ResourceManagerId V � _TRANSACTION_ENLISTMENT_PAIR .?AU_TRANSACTION_ENLISTMENT_PAIR@@ �� � � F � _PROCESSOR_GROUP_INFO .?AU_PROCESSOR_GROUP_INFO@@
� " & �v
MaximumProcessorCount
ActiveProcessorCount �
� Reserved �
# ( ActiveProcessorMask ��F � 0 _PROCESSOR_GROUP_INFO .?AU_PROCESSOR_GROUP_INFO@@ � � 5 B � PPM_WMI_IDLE_STATES .?AUPPM_WMI_IDLE_STATES@@
� B � PPM_WMI_IDLE_STATE .?AUPPM_WMI_IDLE_STATE@@ �� � " �z
" Type �
" Count
" TargetState ��
" OldState �
# TargetProcessors �
� State B � 8 PPM_WMI_IDLE_STATES .?AUPPM_WMI_IDLE_STATES@@ � x � N � _TRACE_ENABLE_CONTEXT_EX .?AU_TRACE_ENABLE_CONTEXT_EX@@ ��
! LoggerId �
Level
InternalFlag �
" EnableFlags ��
" EnableFlagsHigh ��
" Reserved �N � _TRACE_ENABLE_CONTEXT_EX .?AU_TRACE_ENABLE_CONTEXT_EX@@ ��2 onecore\internal\sdk\inc\minwin\ntwmi_x.h �� � � > V � _PERFINFO_PPM_IDLE_STATE_EXIT .?AU_PERFINFO_PPM_IDLE_STATE_EXIT@@
� &
" State
" Status ���V � _PERFINFO_PPM_IDLE_STATE_EXIT .?AU_PERFINFO_PPM_IDLE_STATE_EXIT@@ � c ' R � _EVENT_INSTANCE_GUID_HEADER .?AU_EVENT_INSTANCE_GUID_HEADER@@ 6
Type �
Level
! Version ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � c �
! Size �
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��
" Version ��
� Class
" ThreadId �
" ProcessId
� TimeStamp
Guid �
# GuidPtr ��
" ( ClientContext
" , Flags
" ( KernelTime ���
" , UserTime �
# ( ProcessorTime
" 0 InstanceId ���
" 4 ParentInstanceId �
8 ParentGuid ���R � H _EVENT_INSTANCE_GUID_HEADER .?AU_EVENT_INSTANCE_GUID_HEADER@@ � c
/ # � � F � tagEMRSETARCDIRECTION .?AUtagEMRSETARCDIRECTION@@
� *
� emr ��
" iArcDirection F � tagEMRSETARCDIRECTION .?AUtagEMRSETARCDIRECTION@@ � � } J � _REDIRECTION_DESCRIPTOR .?AU_REDIRECTION_DESCRIPTOR@@ ^ � _REDIRECTION_FUNCTION_DESCRIPTOR .?AU_REDIRECTION_FUNCTION_DESCRIPTOR@@ ��
� ��
� F
" Version ��
" FunctionCount
� Redirections �J � _REDIRECTION_DESCRIPTOR .?AU_REDIRECTION_DESCRIPTOR@@ 6 onecore\external\sdk\inc\minwin\libloaderapi.h � � � f Z � _RTL_RETPOLINE_RELOCATION_INDEX .?AU_RTL_RETPOLINE_RELOCATION_INDEX@@
� ~ � _IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@ ��v � _IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION .?AU_IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION@@ ��>
� Import ���
� Indir
� SwitchJump ���2 � <anonymous-tag> .?AT<anonymous-tag>@@ � e �
! ImportRelocationSize �
! IndirectRelocationSize ���
! SwitchJumpRelocationSize �
! StraddleType �
� StraddleReloc Z � _RTL_RETPOLINE_RELOCATION_INDEX .?AU_RTL_RETPOLINE_RELOCATION_INDEX@@ � ` b � _SYSTEM_PHYSICAL_MEMORY_INFORMATION .?AU_SYSTEM_PHYSICAL_MEMORY_INFORMATION@@
� f
# TotalPhysicalBytes ���
# LowestPhysicalAddress
# HighestPhysicalAddress ���b � _SYSTEM_PHYSICAL_MEMORY_INFORMATION .?AU_SYSTEM_PHYSICAL_MEMORY_INFORMATION@@ � � � z PsEnergyComponentTypeCpu � PsEnergyComponentTypeStorage � PsEnergyComponentTypeNetwork � PsEnergyComponentTypeMBB � PsEnergyComponentTypeForegroundTime �� PsEnergyComponentTypeDesktopVisibleTime �� PsEnergyComponentTypeWindowResource �� PsEnergyComponentTypeCompositorResource �� PsEnergyComponentTypeTrackingState ��� PsEnergyComponentTypeInput ���
PsEnergyComponentTypeAudioIn � PsEnergyComponentTypeAudioOut PsEnergyComponentTypeDisplayRequired �
PsEnergyComponentTypeKeyboardInput ��� PsEnergyComponentTypeMouseInput �� PsEnergyComponentTypeMax �^ t � _PROCESS_ENERGY_COMPONENT_TYPE_NUM .?AW4_PROCESS_ENERGY_COMPONENT_TYPE_NUM@@ ��� � � � 6 � _WMI_FILE_IO .?AU_WMI_FILE_IO@@ ��.
FileObject ���
| FileName �6 � _WMI_FILE_IO .?AU_WMI_FILE_IO@@ �� � c j � _MEMORY_PARTITION_TRANSFER_INFORMATION .?AU_MEMORY_PARTITION_TRANSFER_INFORMATION@@ ��
� >
# NumberOfPages
" NumaNode �
" Flags j � _MEMORY_PARTITION_TRANSFER_INFORMATION .?AU_MEMORY_PARTITION_TRANSFER_INFORMATION@@ �� � t � N � _MUTANT_OWNER_INFORMATION .?AU_MUTANT_OWNER_INFORMATION@@
ClientId �N � _MUTANT_OWNER_INFORMATION .?AU_MUTANT_OWNER_INFORMATION@@ � � 8 ^ � _PERFINFO_PPM_THERMAL_CONSTRAINT .?AU_PERFINFO_PPM_THERMAL_CONSTRAINT@@ ��2
" Constraint ���
# Processors ���^ � _PERFINFO_PPM_THERMAL_CONSTRAINT .?AU_PERFINFO_PPM_THERMAL_CONSTRAINT@@ �� � c Z : � tagPAINTSTRUCT .?AUtagPAINTSTRUCT@@ ��& � HDC__ .?AUHDC__@@
� " �~
� hdc ��
t fErase ���
! rcPaint ��
t fRestore �
t fIncUpdate ���
� $ rgbReserved ��: � H tagPAINTSTRUCT .?AUtagPAINTSTRUCT@@ �� � k V � _REQUEST_OPLOCK_OUTPUT_BUFFER .?AU_REQUEST_OPLOCK_OUTPUT_BUFFER@@ �
! StructureVersion �
! StructureLength ��
" OriginalOplockLevel ��
" NewOplockLevel ���
" Flags
" AccessMode ���
! ShareMode V � _REQUEST_OPLOCK_OUTPUT_BUFFER .?AU_REQUEST_OPLOCK_OUTPUT_BUFFER@@ � � � EtwCoverageSamplerCreateInformation �� EtwCoverageSamplerQueryInformation ��� EtwCoverageSamplerBloomInformation ��� EtwCoverageSamplerPerfInformation EtwCoverageSamplerStatusInformation �� MaxEtwCoverageSamplerInfoClass ���f t � _ETW_COVERAGE_SAMPLER_INFORMATION_CLASS .?AW4_ETW_COVERAGE_SAMPLER_INFORMATION_CLASS@@ � � A � . � _FLS_DATA .?AU_FLS_DATA@@ " �"
Entry
� Slots . � _FLS_DATA .?AU_FLS_DATA@@ � � �
Z � _FILE_REPARSE_POINT_INFORMATION .?AU_FILE_REPARSE_POINT_INFORMATION@@
� *
FileReference
" Tag ��Z � _FILE_REPARSE_POINT_INFORMATION .?AU_FILE_REPARSE_POINT_INFORMATION@@ � � s N � tagWNODE_SINGLE_INSTANCE .?AUtagWNODE_SINGLE_INSTANCE@@ �� " �
� WnodeHeader ��
" 0 OffsetInstanceName ���
" 4 InstanceIndex
" 8 DataBlockOffset ��
" < SizeDataBlock
� @ VariableData �N � @ tagWNODE_SINGLE_INSTANCE .?AUtagWNODE_SINGLE_INSTANCE@@ �� � � � 2 � _TRIVERTEX .?AU_TRIVERTEX@@ ��
� Z
x
y
! Red ��
!
Green
! Blue �
! Alpha 2 _TRIVERTEX .?AU_TRIVERTEX@@ �� � # j � _PROCESS_MITIGATION_POLICY_INFORMATION .?AU_PROCESS_MITIGATION_POLICY_INFORMATION@@ ��R ProcessDEPPolicy � ProcessASLRPolicy ProcessDynamicCodePolicy � ProcessStrictHandleCheckPolicy ��� ProcessSystemCallDisablePolicy ��� ProcessMitigationOptionsMask � ProcessExtensionPointDisablePolicy ��� ProcessControlFlowGuardPolicy ProcessSignaturePolicy ��� ProcessFontDisablePolicy �
ProcessImageLoadPolicy ��� ProcessSystemCallFilterPolicy ProcessPayloadRestrictionPolicy ��
ProcessChildProcessPolicy ProcessSideChannelIsolationPolicy ProcessUserShadowStackPolicy � MaxProcessMitigationPolicy ���N t _PROCESS_MITIGATION_POLICY .?AW4_PROCESS_MITIGATION_POLICY@@ ��� ? & Z � _PROCESS_MITIGATION_ASLR_POLICY .?AU_PROCESS_MITIGATION_ASLR_POLICY@@ z � _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ ��z � _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ �� � _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ ��j � _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY .?AU_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY@@ v � _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@ r � _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY@@ j � _PROCESS_MITIGATION_FONT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_FONT_DISABLE_POLICY@@ f � _PROCESS_MITIGATION_IMAGE_LOAD_POLICY .?AU_PROCESS_MITIGATION_IMAGE_LOAD_POLICY@@ v � _PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY@@ z � _PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ ��n � _PROCESS_MITIGATION_CHILD_PROCESS_POLICY .?AU_PROCESS_MITIGATION_CHILD_PROCESS_POLICY@@ ��~ � _PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY .?AU_PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY@@ v � _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY@@ ���
Policy ���
ASLRPolicy ���
StrictHandleCheckPolicy ��
SystemCallDisablePolicy ��
ExtensionPointDisablePolicy ��
DynamicCodePolicy
ControlFlowGuardPolicy ���
SignaturePolicy ��
FontDisablePolicy
ImageLoadPolicy ��
SystemCallFilterPolicy ���
PayloadRestrictionPolicy �
ChildProcessPolicy ���
SideChannelIsolationPolicy ���
UserShadowStackPolicy j _PROCESS_MITIGATION_POLICY_INFORMATION .?AU_PROCESS_MITIGATION_POLICY_INFORMATION@@ �� � " * � __n64x2 .?AU__n64x2@@ " �
val ��* __n64x2 .?AU__n64x2@@ * | � FilterBootOptionOperationOpenSystemStore � FilterBootOptionOperationSetElement �� FilterBootOptionOperationDeleteElement ��� FilterBootOptionOperationMax �R t _FILTER_BOOT_OPTION_OPERATION .?AW4_FILTER_BOOT_OPTION_OPERATION@@ � � � B � tagENUMLOGFONTEXDVA .?AUtagENUMLOGFONTEXDVA@@ > � tagENUMLOGFONTEXA .?AUtagENUMLOGFONTEXA@@ : � tagDESIGNVECTOR .?AUtagDESIGNVECTOR@@ :
! elfEnumLogfontEx �
" � elfDesignVector ��B # tagENUMLOGFONTEXDVA .?AUtagENUMLOGFONTEXDVA@@ $ � P . � _COMMPROP .?AU_COMMPROP@@ �
! wPacketLength
! wPacketVersion ���
" dwServiceMask
" dwReserved1 ��
" dwMaxTxQueue �
" dwMaxRxQueue �
" dwMaxBaud
" dwProvSubType
" dwProvCapabilities ���
" dwSettableParams �
" $ dwSettableBaud ���
! ( wSettableData
! * wSettableStopParity ��
" , dwCurrentTxQueue �
" 0 dwCurrentRxQueue �
" 4 dwProvSpec1 ��
" 8 dwProvSpec2 ��
| < wcProvChar ���. ' @ _COMMPROP .?AU_COMMPROP@@ ( o � � FileFsVolumeInformation �� FileFsLabelInformation ��� FileFsSizeInformation FileFsDeviceInformation �� FileFsAttributeInformation ��� FileFsControlInformation � FileFsFullSizeInformation FileFsObjectIdInformation FileFsDriverPathInformation ��
FileFsVolumeFlagsInformation � FileFsSectorSizeInformation �� FileFsDataCopyInformation
FileFsMetadataSizeInformation FileFsFullSizeInformationEx �� FileFsMaximumInformation �2 t * _FSINFOCLASS .?AW4_FSINFOCLASS@@ ��� + � � %
- JOB_OBJECT_IO_RATE_CONTROL_ENABLE JOB_OBJECT_IO_RATE_CONTROL_STANDALONE_VOLUME � JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ALL � JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ON_SOFT_CAP � JOB_OBJECT_IO_RATE_CONTROL_VALID_FLAGS ���Z t / JOB_OBJECT_IO_RATE_CONTROL_FLAGS .?AW4JOB_OBJECT_IO_RATE_CONTROL_FLAGS@@ ��� 0 ? N N � _SERVICE_PRESHUTDOWN_INFO .?AU_SERVICE_PRESHUTDOWN_INFO@@ "
" dwPreshutdownTimeout �N 3 _SERVICE_PRESHUTDOWN_INFO .?AU_SERVICE_PRESHUTDOWN_INFO@@ 4 � e � EtwQueryPartitionInformation � EtwQueryPartitionInformationV2 ��� EtwQueryLastDroppedTimes � EtwQueryProcessHandleInfoMax �R t 6 _ETW_PROCESS_HANDLE_INFO_TYPE .?AW4_ETW_PROCESS_HANDLE_INFO_TYPE@@ � 7 � w . LT_DONT_CARE � LT_LOWEST_LATENCY 2 t 9 LATENCY_TIME .?AW4LATENCY_TIME@@ ��� : x - � MmEtwWorkingSetTypeUser �� MmEtwWorkingSetTypeSession ��� MmEtwWorkingSetTypeSystem MmEtwWorkingSetTypeMaximum ���J t < _MM_ETW_WORKING_SET_TYPE .?AW4_MM_ETW_WORKING_SET_TYPE@@ ��� = t ; : � _RPC_CLIENT_ID .?AU_RPC_CLIENT_ID@@ ��2
" UniqueProcess
" UniqueThread �: @ _RPC_CLIENT_ID .?AU_RPC_CLIENT_ID@@ ��: onecore\admin\wmi\events\idl\elf\objfre\arm64\elf.h A B Q 6 FeatureConfigurationPriorityImageDefault � FeatureConfigurationPriorityService �� FeatureConfigurationPriorityUser �
FeatureConfigurationPriorityUserPolicy ��� FeatureConfigurationPriorityTest � FeatureConfigurationPriorityImageOverride FeatureConfigurationPriorityMax ��^ t D _RTL_FEATURE_CONFIGURATION_PRIORITY .?AW4_RTL_FEATURE_CONFIGURATION_PRIORITY@@ � E 6 ^ Compatible ��� TypeA TypeB TypeC TypeF MaximumDmaSpeed ��. t G _DMA_SPEED .?AW4_DMA_SPEED@@ ��� H � �+ � AuditPrivilegeObject � AuditPrivilegeService AuditAccessCheck � AuditOpenObject �� AuditOpenObjectWithTransaction ��� AuditCloseObject � AuditDeleteObject AuditOpenObjectForDelete � AuditOpenObjectForDeleteWithTransaction �� AuditCloseNonObject ��
AuditOpenNonObject ��� AuditObjectReference � AuditHandleCreation ��>
t J _SE_AUDIT_OPERATION .?AW4_SE_AUDIT_OPERATION@@ � K x B � tagIMEMENUITEMINFOA .?AUtagIMEMENUITEMINFOA@@ p " P �
u cbSize ���
u fType
u fState ���
u wID ��
| hbmpChecked ��
| hbmpUnchecked
" dwItemData ���
N $ szString �
| x hbmpItem �B O � tagIMEMENUITEMINFOA .?AUtagIMEMENUITEMINFOA@@ P � � ^ � _APPLICATIONLAUNCH_SETTING_VALUE .?AU_APPLICATIONLAUNCH_SETTING_VALUE@@ ��J
� ActivationTime ���
" Flags
" ButtonInstanceID �^ S _APPLICATIONLAUNCH_SETTING_VALUE .?AU_APPLICATIONLAUNCH_SETTING_VALUE@@ �� T x � b � _LDR_DLL_UNLOADED_NOTIFICATION_DATA .?AU_LDR_DLL_UNLOADED_NOTIFICATION_DATA@@
V
��
X n
" Flags
Y FullDllName ��
Y BaseDllName ��
DllBase ��
" SizeOfImage ��b Z ( _LDR_DLL_UNLOADED_NOTIFICATION_DATA .?AU_LDR_DLL_UNLOADED_NOTIFICATION_DATA@@ [ � �
4 R � _FILE_REMOTE_PROTOCOL_INFO .?AU_FILE_REMOTE_PROTOCOL_INFO@@ ��
` Reserved �: _ <anonymous-tag> .?AU<anonymous-tag>@@ ` o u#
" Capabilities �: b <anonymous-tag> .?AU<anonymous-tag>@@ c o �# 2
" Capabilities �
" CachingFlags �: e <anonymous-tag> .?AU<anonymous-tag>@@ f o �# &
c Server ���
f Share : h <anonymous-tag> .?AU<anonymous-tag>@@ i o �# " " @ �&
i Smb2 �
k Reserved �2 l @ <anonymous-tag> .?AT<anonymous-tag>@@ m o �#
! StructureVersion �
! StructureSize
" Protocol �
! ProtocolMajorVersion �
!
ProtocolMinorVersion �
! ProtocolRevision �
! Reserved �
" Flags
` GenericReserved ��
m 4 ProtocolSpecific �R
o t _FILE_REMOTE_PROTOCOL_INFO .?AU_FILE_REMOTE_PROTOCOL_INFO@@ �� p o c# n TransactionOutcomeUndetermined ��� TransactionOutcomeCommitted �� TransactionOutcomeAborted B t r _TRANSACTION_OUTCOME .?AW4_TRANSACTION_OUTCOME@@ ��� s � � � ��LdrModulesMerged ��LdrModulesInitError � ��LdrModulesSnapError � ��LdrModulesUnloaded �� ��LdrModulesUnloading � LdrModulesPlaceHolder LdrModulesMapping LdrModulesMapped � LdrModulesWaitingForDependencies � LdrModulesSnapping ��� LdrModulesSnapped LdrModulesCondensed �� LdrModulesReadyToInit LdrModulesInitializing ��� LdrModulesReadyToRun �6 t u _LDR_DDAG_STATE .?AW4_LDR_DDAG_STATE@@ � v � n F � tagEMRPOLYPOLYLINE16 .?AUtagEMRPOLYPOLYLINE16@@ ��
x " " �. � tagPOINTS .?AUtagPOINTS@@ { " �r
� emr ��
d rclBounds
" nPolys ���
" cpts �
z aPolyCounts ��
| $ apts �F } ( tagEMRPOLYPOLYLINE16 .?AUtagEMRPOLYPOLYLINE16@@ �� ~ � n . � _TP_TASK .?AU_TP_TASK@@ ��B � _TP_TASK_CALLBACKS .?AU_TP_TASK_CALLBACKS@@ ��
� ��
� Z
� Callbacks
" NumaNode �
IdealProcessor ���
ListEntry . � _TP_TASK .?AU_TP_TASK@@ �� � � � ^ ToleranceIntervalShort ��� ToleranceIntervalMedium �� ToleranceIntervalLong n t � _JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL .?AW4_JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL@@ ��� � ? � � SE_VALIDATE_MAPPING_HEADER_ONLY �� SE_VALIDATE_MAPPING_ENTIRE_IMAGE � SE_VALIDATE_MAPPING_ENTIRE_IMAGE_CLEAN ���J t � _SE_VALIDATE_MAPPING_TYPE .?AW4_SE_VALIDATE_MAPPING_TYPE@@ � � � � WinNullSid ��� WinWorldSid �� WinLocalSid �� WinCreatorOwnerSid ��� WinCreatorGroupSid ��� WinCreatorOwnerServerSid � WinCreatorGroupServerSid � WinNtAuthoritySid WinDialupSid � WinNetworkSid
WinBatchSid �� WinInteractiveSid WinServiceSid
WinAnonymousSid �� WinProxySid �� WinEnterpriseControllersSid �� WinSelfSid ��� WinAuthenticatedUserSid �� WinRestrictedCodeSid � WinTerminalServerSid � WinRemoteLogonIdSid �� WinLogonIdsSid ��� WinLocalSystemSid WinLocalServiceSid ��� WinNetworkServiceSid � WinBuiltinDomainSid �� WinBuiltinAdministratorsSid �� WinBuiltinUsersSid ��� WinBuiltinGuestsSid �� WinBuiltinPowerUsersSid �� WinBuiltinAccountOperatorsSid WinBuiltinSystemOperatorsSid � WinBuiltinPrintOperatorsSid �� ! WinBuiltinBackupOperatorsSid � " WinBuiltinReplicatorSid �� # WinBuiltinPreWindows2000CompatibleAccessSid �� $ WinBuiltinRemoteDesktopUsersSid �� % WinBuiltinNetworkConfigurationOperatorsSid ��� & WinAccountAdministratorSid ��� ' WinAccountGuestSid ��� ( WinAccountKrbtgtSid �� ) WinAccountDomainAdminsSid * WinAccountDomainUsersSid � + WinAccountDomainGuestsSid , WinAccountComputersSid ��� - WinAccountControllersSid � . WinAccountCertAdminsSid �� / WinAccountSchemaAdminsSid 0 WinAccountEnterpriseAdminsSid 1 WinAccountPolicyAdminsSid 2 WinAccountRasAndIasServersSid 3 WinNTLMAuthenticationSid � 4 WinDigestAuthenticationSid ��� 5 WinSChannelAuthenticationSid � 6 WinThisOrganizationSid ��� 7 WinOtherOrganizationSid �� 8 WinBuiltinIncomingForestTrustBuildersSid � 9 WinBuiltinPerfMonitoringUsersSid � : WinBuiltinPerfLoggingUsersSid ; WinBuiltinAuthorizationAccessSid � < WinBuiltinTerminalServerLicenseServersSid = WinBuiltinDCOMUsersSid ��� > WinBuiltinIUsersSid �� ? WinIUserSid �� @ WinBuiltinCryptoOperatorsSid � A WinUntrustedLabelSid � B WinLowLabelSid ��� C WinMediumLabelSid D WinHighLabelSid �� E WinSystemLabelSid F WinWriteRestrictedCodeSid G WinCreatorOwnerRightsSid � H WinCacheablePrincipalsGroupSid ��� I WinNonCacheablePrincipalsGroupSid J WinEnterpriseReadonlyControllersSid �� K WinAccountReadonlyControllersSid � L WinBuiltinEventLogReadersGroup ��� M WinNewEnterpriseReadonlyControllersSid ��� N WinBuiltinCertSvcDComAccessGroup � O WinMediumPlusLabelSid P WinLocalLogonSid � Q WinConsoleLogonSid ��� R WinThisOrganizationCertificateSid S WinApplicationPackageAuthoritySid T WinBuiltinAnyPackageSid �� U WinCapabilityInternetClientSid ��� V WinCapabilityInternetClientServerSid � W WinCapabilityPrivateNetworkClientServerSid ��� X WinCapabilityPicturesLibrarySid �� Y WinCapabilityVideosLibrarySid Z WinCapabilityMusicLibrarySid � [ WinCapabilityDocumentsLibrarySid � \ WinCapabilitySharedUserCertificatesSid ��� ] WinCapabilityEnterpriseAuthenticationSid � ^ WinCapabilityRemovableStorageSid � _ WinBuiltinRDSRemoteAccessServersSid �� ` WinBuiltinRDSEndpointServersSid �� a WinBuiltinRDSManagementServersSid b WinUserModeDriversSid c WinBuiltinHyperVAdminsSid d WinAccountCloneableControllersSid e WinBuiltinAccessControlAssistanceOperatorsSid f WinBuiltinRemoteManagementUsersSid ��� g WinAuthenticationAuthorityAssertedSid h WinAuthenticationServiceAssertedSid �� i WinLocalAccountSid ��� j WinLocalAccountAndAdministratorSid ��� k WinAccountProtectedUsersSid �� l WinCapabilityAppointmentsSid � m WinCapabilityContactsSid � n WinAccountDefaultSystemManagedSid o WinBuiltinDefaultSystemManagedGroupSid ��� p WinBuiltinStorageReplicaAdminsSid q WinAccountKeyAdminsSid ��� r WinAccountEnterpriseKeyAdminsSid � s WinAuthenticationKeyTrustSid � t WinAuthenticationKeyPropertyMFASid ��� u WinAuthenticationKeyPropertyAttestationSid ��� v WinAuthenticationFreshKeyAuthSid � w WinBuiltinDeviceOwnersSid > x t � WELL_KNOWN_SID_TYPE .?AW4WELL_KNOWN_SID_TYPE@@ � � x � R TpTraceThreadPriority TpTraceThreadAffinity MaxTpTraceType ���6 t � _TP_TRACE_TYPE .?AW4_TP_TRACE_TYPE@@ ��� � � u N � _CM_INT13_DRIVE_PARAMETER .?AU_CM_INT13_DRIVE_PARAMETER@@ z
! DriveSelect ��
" MaxCylinders �
! SectorsPerTrack ��
! MaxHeads �
!
NumberDrives �N � _CM_INT13_DRIVE_PARAMETER .?AU_CM_INT13_DRIVE_PARAMETER@@ � � : � tagCURSORSHAPE .?AUtagCURSORSHAPE@@ ��
t xHotSpot �
t yHotSpot �
t cx ���
t cy ���
t cbWidth ��
Planes ���
BitsPixel : � tagCURSORSHAPE .?AUtagCURSORSHAPE@@ �� � * 6 � tagCWPSTRUCT .?AUtagCWPSTRUCT@@ ��
� N
lParam ���
# wParam ���
u message ��
� hwnd �6 � tagCWPSTRUCT .?AUtagCWPSTRUCT@@ �� � . . � _WGLSWAP .?AU_WGLSWAP@@ ��&
� hdc ��
u uiFlags ��. � _WGLSWAP .?AU_WGLSWAP@@ �� � � � . � _STRING64 .?AU_STRING64@@
� B
! Length ���
! MaximumLength
# Buffer ���. � _STRING64 .?AU_STRING64@@ � � ~ � _RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ ��
� q " ��
� EnableExportAddressFilter
� EnableExportAddressFilterPlus
� EnableImportAddressFilter
� EnableRopStackPivot ��
� EnableRopCallerCheck �
� ( EnableRopSimExec �
� 0 EafPlusModuleList ~ � 0_RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ �� � � B � _SD_ENUM_SDS_INPUT .?AU_SD_ENUM_SDS_INPUT@@ ��>
# StartingOffset ���
# MaxSDEntriesToReturn �B � _SD_ENUM_SDS_INPUT .?AU_SD_ENUM_SDS_INPUT@@ �� � � � N � _RTL_QUERY_REGISTRY_TABLE .?AU_RTL_QUERY_REGISTRY_TABLE@@ q " " �
� �
� QueryRoutine �
" Flags
q Name �
EntryContext �
" DefaultType ��
( DefaultData ��
" 0 DefaultLength N � 8 _RTL_QUERY_REGISTRY_TABLE .?AU_RTL_QUERY_REGISTRY_TABLE@@ � b � R � _HEAP_SUBSEGMENT_ACTIVATED .?AU_HEAP_SUBSEGMENT_ACTIVATED@@ ��F
j Header ���
HeapHandle ���
( SubSegment ���R � 0 _HEAP_SUBSEGMENT_ACTIVATED .?AU_HEAP_SUBSEGMENT_ACTIVATED@@ �� � c � 6 � tagEMRBITBLT .?AUtagEMRBITBLT@@ ��
� 2
� emr ��
d rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
J 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc 6 � d tagEMRBITBLT .?AUtagEMRBITBLT@@ �� � � � J � _PARSE_MESSAGE_CONTEXT .?AU_PARSE_MESSAGE_CONTEXT@@ ��
� ~
" fFlags ���
" cwSavColumn ��
# iwSrc
# iwDst
# iwDstSpace ���
p lpvArgStart ��J � ( _PARSE_MESSAGE_CONTEXT .?AU_PARSE_MESSAGE_CONTEXT@@ �� � � F � PROCESSOR_IDLE_TIMES .?AUPROCESSOR_IDLE_TIMES@@ ��
� >
# StartTime
# EndTime ��
� Reserved �F � PROCESSOR_IDLE_TIMES .?AUPROCESSOR_IDLE_TIMES@@ �� � x _ V � _TXFS_LIST_TRANSACTIONS_ENTRY .?AU_TXFS_LIST_TRANSACTIONS_ENTRY@@
� r
TransactionId
" TransactionState �
" Reserved1
" Reserved2
Reserved3 V � ( _TXFS_LIST_TRANSACTIONS_ENTRY .?AU_TXFS_LIST_TRANSACTIONS_ENTRY@@ � � , z � _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION .?AU_SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION@@ ��
�
" Operation z � _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION .?AU_SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION@@ �� � � �
F � _FILE_EA_INFORMATION .?AU_FILE_EA_INFORMATION@@ ��
" EaSize ���F � _FILE_EA_INFORMATION .?AU_FILE_EA_INFORMATION@@ �� � � � R � _SYSTEM_AUDIT_CALLBACK_ACE .?AU_SYSTEM_AUDIT_CALLBACK_ACE@@ ��
� :
� Header ���
" Mask �
" SidStart �R � _SYSTEM_AUDIT_CALLBACK_ACE .?AU_SYSTEM_AUDIT_CALLBACK_ACE@@ �� � x F _ARM64_BARRIER_SY _ARM64_BARRIER_ST
_ARM64_BARRIER_LD _ARM64_BARRIER_ISH ���
_ARM64_BARRIER_ISHST � _ARM64_BARRIER_ISHLD � _ARM64_BARRIER_NSH ��� _ARM64_BARRIER_NSHST � _ARM64_BARRIER_NSHLD � _ARM64_BARRIER_OSH ��� _ARM64_BARRIER_OSHST � _ARM64_BARRIER_OSHLD �N t � _tag_ARM64INTR_BARRIER_TYPE .?AW4_tag_ARM64INTR_BARRIER_TYPE@@ �2 onecore\external\sdk\inc\crt\arm64intr.h ��� � � # 2 � _numberfmtA .?AU_numberfmtA@@ �
u NumDigits
u LeadingZero ��
u Grouping �
p lpDecimalSep �
p lpThousandSep
u NegativeOrder 2 � ( _numberfmtA .?AU_numberfmtA@@ � W � Z � _MEMORY_WORKING_SET_INFORMATION .?AU_MEMORY_WORKING_SET_INFORMATION@@ N � _MEMORY_WORKING_SET_BLOCK .?AU_MEMORY_WORKING_SET_BLOCK@@ � " �:
# NumberOfEntries ��
� WorkingSetInfo ���Z � _MEMORY_WORKING_SET_INFORMATION .?AU_MEMORY_WORKING_SET_INFORMATION@@ � t � 6 � tagDIBSECTION .?AUtagDIBSECTION@@
� . � tagBITMAP .?AUtagBITMAP@@ " " �j
� dsBm �
� dsBmih ���
� H dsBitfields ��
X dshSection ���
" ` dsOffset �6 � h tagDIBSECTION .?AUtagDIBSECTION@@ � � # � FileBasicInfo FileStandardInfo � FileNameInfo � FileRenameInfo ��� FileDispositionInfo �� FileAllocationInfo ��� FileEndOfFileInfo FileStreamInfo ��� FileCompressionInfo �� FileAttributeTagInfo �
FileIdBothDirectoryInfo �� FileIdBothDirectoryRestartInfo ��� FileIoPriorityHintInfo ���
FileRemoteProtocolInfo ��� FileFullDirectoryInfo FileFullDirectoryRestartInfo � FileStorageInfo �� FileAlignmentInfo FileIdInfo ��� FileIdExtdDirectoryInfo �� FileIdExtdDirectoryRestartInfo ��� FileDispositionInfoEx FileRenameInfoEx � FileCaseSensitiveInfo FileNormalizedNameInfo ��� MaximumFileInfoByHandleClass �N t � _FILE_INFO_BY_HANDLE_CLASS .?AW4_FILE_INFO_BY_HANDLE_CLASS@@ ��� � � � � DISPLAYCONFIG_DEVICE_INFO_GET_SOURCE_NAME DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_NAME DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_PREFERRED_MODE �� DISPLAYCONFIG_DEVICE_INFO_GET_ADAPTER_NAME ��� DISPLAYCONFIG_DEVICE_INFO_SET_TARGET_PERSISTENCE � DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_BASE_TYPE ��� DISPLAYCONFIG_DEVICE_INFO_GET_SUPPORT_VIRTUAL_RESOLUTION � DISPLAYCONFIG_DEVICE_INFO_SET_SUPPORT_VIRTUAL_RESOLUTION � DISPLAYCONFIG_DEVICE_INFO_GET_ADVANCED_COLOR_INFO
DISPLAYCONFIG_DEVICE_INFO_SET_ADVANCED_COLOR_STATE ��� DISPLAYCONFIG_DEVICE_INFO_GET_SDR_WHITE_LEVEL ��DISPLAYCONFIG_DEVICE_INFO_FORCE_UINT32 ��V t � DISPLAYCONFIG_DEVICE_INFO_TYPE .?AW4DISPLAYCONFIG_DEVICE_INFO_TYPE@@ ��� � � � f � _PLUGPLAY_CONTROL_USER_RESPONSE_DATA .?AU_PLUGPLAY_CONTROL_USER_RESPONSE_DATA@@ ��
� � PNP_VetoTypeUnknown �� PNP_VetoLegacyDevice � PNP_VetoPendingClose � PNP_VetoWindowsApp ��� PNP_VetoWindowsService ��� PNP_VetoOutstandingOpen �� PNP_VetoDevice ��� PNP_VetoDriver ��� PNP_VetoIllegalDeviceRequest � PNP_VetoInsufficientPower
PNP_VetoNonDisableable ��� PNP_VetoLegacyDriver � PNP_VetoInsufficientRights ���
PNP_VetoAlreadyRemoved ���6 t � _PNP_VETO_TYPE .?AW4_PNP_VETO_TYPE@@ ���* onecore\external\shared\inc\cfg.h �� � / Z
" Response �
� VetoType �
q VetoName �
" VetoNameLength ���f _PLUGPLAY_CONTROL_USER_RESPONSE_DATA .?AU_PLUGPLAY_CONTROL_USER_RESPONSE_DATA@@ �� % V FeatureEnabledStateOptionsNone ��� FeatureEnabledStateOptionsWexpConfig �^ t _RTL_FEATURE_ENABLED_STATE_OPTIONS .?AW4_RTL_FEATURE_ENABLED_STATE_OPTIONS@@ ��� A B � _WMI_PNP_RECORD_V5 .?AU_WMI_PNP_RECORD_V5@@ ��
�
ClassGuid
" UpperFilterCount �
" LowerFilterCount �
" DevStatus
" DevProblem ���
| Strings ��B
$ _WMI_PNP_RECORD_V5 .?AU_WMI_PNP_RECORD_V5@@ �� c � 2 � tagRAWMOUSE .?AUtagRAWMOUSE@@
�
! usFlags ��
" ulButtons
! usButtonFlags
! usButtonData �
" ulRawButtons �
lLastX ���
lLastY ���
" ulExtraInformation ���2 tagRAWMOUSE .?AUtagRAWMOUSE@@ 9: : � tagEMRPOLYLINE .?AUtagEMRPOLYLINE@@ ��F
� emr ��
d rclBounds
" cptl �
� aptl �: $ tagEMRPOLYLINE .?AUtagEMRPOLYLINE@@ �� � 9 : � _JIT_DEBUG_INFO .?AU_JIT_DEBUG_INFO@@ �
" dwSize ���
" dwProcessorArchitecture ��
" dwThreadID ���
" dwReserved0 ��
# lpExceptionAddress ���
# lpExceptionRecord
# lpContextRecord ��: ( _JIT_DEBUG_INFO .?AU_JIT_DEBUG_INFO@@ o � � ACTCTX_RUN_LEVEL_UNSPECIFIED � ACTCTX_RUN_LEVEL_AS_INVOKER �� ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE ��� ACTCTX_RUN_LEVEL_REQUIRE_ADMIN ��� ACTCTX_RUN_LEVEL_NUMBERS �N t ACTCTX_REQUESTED_RUN_LEVEL .?AW4ACTCTX_REQUESTED_RUN_LEVEL@@ ��� � �
p Identifier ���6 _FILE_ID_128 .?AU_FILE_ID_128@@ �� � R 2 � _XSAVE_AREA .?AU_XSAVE_AREA@@ 6 � _XSAVE_FORMAT .?AU_XSAVE_FORMAT@@ B � _XSAVE_AREA_HEADER .?AU_XSAVE_AREA_HEADER@@ ��.
! LegacyState ��
" Header ���2 # @_XSAVE_AREA .?AU_XSAVE_AREA@@ $ L : � _GROUP_AFFINITY .?AU_GROUP_AFFINITY@@ ! " �6
# Mask �
! Group
'
Reserved �: ( _GROUP_AFFINITY .?AU_GROUP_AFFINITY@@ ) . WMI_GET_ALL_DATA � WMI_GET_SINGLE_INSTANCE �� WMI_SET_SINGLE_INSTANCE �� WMI_SET_SINGLE_ITEM �� WMI_ENABLE_EVENTS WMI_DISABLE_EVENTS ��� WMI_ENABLE_COLLECTION WMI_DISABLE_COLLECTION ��� WMI_REGINFO �� WMI_EXECUTE_METHOD ���
WMI_CAPTURE_STATE : t + WMIDPREQUESTCODE .?AW4WMIDPREQUESTCODE@@ ��� , � � V � _REQUEST_OPLOCK_INPUT_BUFFER .?AU_REQUEST_OPLOCK_INPUT_BUFFER@@ ��j
! StructureVersion �
! StructureLength ��
" RequestedOplockLevel �
" Flags V / _REQUEST_OPLOCK_INPUT_BUFFER .?AU_REQUEST_OPLOCK_INPUT_BUFFER@@ �� 0 � � . � tagACCEL .?AUtagACCEL@@ ��
2 2
fVirt
! key ��
! cmd ��. 4 tagACCEL .?AUtagACCEL@@ �� 5 _ f � IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA .?ATIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" HeaderData ���
8 FunctionLength ���
9 Version ��
: ExceptionDataPresent �
; EpilogInHeader ���
< EpilogCount ��
= CodeWords f > IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA .?ATIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA@@ �� ? � f � _FILE_SYSTEM_RECOGNITION_INFORMATION .?AU_FILE_SYSTEM_RECOGNITION_INFORMATION@@ �� p " �
B FileSystem ���f C _FILE_SYSTEM_RECOGNITION_INFORMATION .?AU_FILE_SYSTEM_RECOGNITION_INFORMATION@@ �� D � �
�
p t G
H � WnfDataScopeSystem ��� WnfDataScopeSession �� WnfDataScopeUser � WnfDataScopeProcess �� WnfDataScopeMachine �� WnfDataScopePhysicalMachine ��6 t J _WNF_DATA_SCOPE .?AW4_WNF_DATA_SCOPE@@ � K � u " SemaphoreBasicInformation R t M _SEMAPHORE_INFORMATION_CLASS .?AW4_SEMAPHORE_INFORMATION_CLASS@@ ��� N � � B ToleranceLow � ToleranceMedium �� ToleranceHigh Z t P _JOBOBJECT_RATE_CONTROL_TOLERANCE .?AW4_JOBOBJECT_RATE_CONTROL_TOLERANCE@@ � Q ? �
Q N WaitAll �� WaitAny �� WaitNotification � WaitDequeue ��. t T _WAIT_TYPE .?AW4_WAIT_TYPE@@ ��� U � b � _PERFINFO_BOOT_PREFETCH_INFORMATION .?AU_PERFINFO_BOOT_PREFETCH_INFORMATION@@
W :
Action ���
Status ���
Pages b Y _PERFINFO_BOOT_PREFETCH_INFORMATION .?AU_PERFINFO_BOOT_PREFETCH_INFORMATION@@ Z c � R LogExceptionEmpty LogExceptionDispatch � LogExceptionHandler ��> t \ _EXCEPTION_LOG_TYPE .?AW4_EXCEPTION_LOG_TYPE@@ � ]
F � _STREAM_EXTENT_ENTRY .?AU_STREAM_EXTENT_ENTRY@@ ��
_ N � RETRIEVAL_POINTERS_BUFFER .?AURETRIEVAL_POINTERS_BUFFER@@
a RetrievalPointers 2 b <anonymous-tag> .?AT<anonymous-tag>@@ c � � .
" Flags
c ExtentInformation F e ( _STREAM_EXTENT_ENTRY .?AU_STREAM_EXTENT_ENTRY@@ �� f � � > � USN_RECORD_EXTENT .?AUUSN_RECORD_EXTENT@@ *
Offset ���
Length ���> i USN_RECORD_EXTENT .?AUUSN_RECORD_EXTENT@@ j � � � VERIFIER_MODE_UNUSED � VERIFIER_MODE_TRIAGE � VERIFIER_MODE_FIELD �� VERIFIER_MODE_LOGO ��� VERIFIER_MODE_TEST ���2 t l VERIFIER_MODE .?AW4VERIFIER_MODE@@ � m � � & � _ABC .?AU_ABC@@ ��
o 2
t abcA �
u abcB �
t abcC �& q _ABC .?AU_ABC@@ �� r � � > � tagREGISTERWORDW .?AUtagREGISTERWORDW@@ ��
t *
q lpReading
q lpWord ���> v tagREGISTERWORDW .?AUtagREGISTERWORDW@@ �� w � ` j � _SECURE_SPECULATION_CONTROL_INFORMATION .?AU_SECURE_SPECULATION_CONTROL_INFORMATION@@
y
" ��
" ��
" ��
" ��
" ��
" ��
{ KvaShadowSupported ���
| KvaShadowEnabled �
} KvaShadowUserGlobal ��
~ KvaShadowPcid
MbClearEnabled ���
� Reserved �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � &
� SecureSpeculationFlags ���j � _SECURE_SPECULATION_CONTROL_INFORMATION .?AU_SECURE_SPECULATION_CONTROL_INFORMATION@@ � � � b � _RTL_PROCESS_BACKTRACE_INFORMATION .?AU_RTL_PROCESS_BACKTRACE_INFORMATION@@ �� " �j
p SymbolicBackTrace
" TraceCount ���
! Index
! Depth
� BackTrace b � _RTL_PROCESS_BACKTRACE_INFORMATION .?AU_RTL_PROCESS_BACKTRACE_INFORMATION@@ �� � � : � tagSOUNDSENTRYA .?AUtagSOUNDSENTRYA@@ R
u cbSize ���
" dwFlags ��
" iFSTextEffect
" iFSTextEffectMSec
" iFSTextEffectColorBits ���
" iFSGrafEffect
" iFSGrafEffectMSec
" iFSGrafEffectColor ���
" iWindowsEffect ���
" $ iWindowsEffectMSec ���
p ( lpszWindowsEffectDLL �
" 0 iWindowsEffectOrdinal : � 8 tagSOUNDSENTRYA .?AUtagSOUNDSENTRYA@@ � 4 6 � _STARTUPINFOW .?AU_STARTUPINFOW@@
� �
" cb ���
q lpReserved ���
q lpDesktop
q lpTitle ��
" dwX ��
" $ dwY ��
" ( dwXSize ��
" , dwYSize ��
" 0 dwXCountChars
" 4 dwYCountChars
" 8 dwFillAttribute ��
" < dwFlags ��
! @ wShowWindow ��
! B cbReserved2 ��
H lpReserved2 ��
P hStdInput
X hStdOutput ���
` hStdError 6 � h _STARTUPINFOW .?AU_STARTUPINFOW@@ � � 7 f � _EVENT_TRACE_SPINLOCK_INFORMATION_V1 .?AU_EVENT_TRACE_SPINLOCK_INFORMATION_V1@@ ��
@ EventTraceInformationClass ���
" SpinLockSpinThreshold
" SpinLockAcquireSampleRate
" SpinLockContentionSampleRate �f � _EVENT_TRACE_SPINLOCK_INFORMATION_V1 .?AU_EVENT_TRACE_SPINLOCK_INFORMATION_V1@@ �� � A 6 � _devicemodeA .?AU_devicemodeA@@ ��
� dmDeviceName �
! dmSpecVersion
! " dmDriverVersion ��
! $ dmSize ���
! & dmDriverExtra
" ( dmFields �
, dmOrientation
. dmPaperSize ��
0 dmPaperLength
2 dmPaperWidth �
4 dmScale ��
6 dmCopies �
8 dmDefaultSource ��
: dmPrintQuality ���
� , dmPosition ���
" 4 dmDisplayOrientation �
" 8 dmDisplayFixedOutput �
< dmColor ��
> dmDuplex �
@ dmYResolution
B dmTTOption ���
D dmCollate
� F dmFormName ���
! f dmLogPixels ��
" h dmBitsPerPel �
" l dmPelsWidth ��
" p dmPelsHeight �
" t dmDisplayFlags ���
" t dmNup
" x dmDisplayFrequency ���
" | dmICMMethod ��
" � dmICMIntent ��
" � dmMediaType ��
" � dmDitherType �
" � dmReserved1 ��
" � dmReserved2 ��
" � dmPanningWidth ���
" � dmPanningHeight ��6 & � � _devicemodeA .?AU_devicemodeA@@ �� � � � N � _CM_KEYBOARD_DEVICE_DATA .?AU_CM_KEYBOARD_DEVICE_DATA@@ ��f
! Version ��
! Revision �
Type �
Subtype ��
! KeyboardFlags N � _CM_KEYBOARD_DEVICE_DATA .?AU_CM_KEYBOARD_DEVICE_DATA@@ �� � & > � MARK_HANDLE_INFO .?AUMARK_HANDLE_INFO@@ ��b
" UsnSourceInfo
" CopyNumber ���
VolumeHandle �
" HandleInfo ���> � MARK_HANDLE_INFO .?AUMARK_HANDLE_INFO@@ �� � � . F � _SERVICE_TABLE_ENTRYW .?AU_SERVICE_TABLE_ENTRYW@@
q " � �
� 2
q lpServiceName
� lpServiceProc F � _SERVICE_TABLE_ENTRYW .?AU_SERVICE_TABLE_ENTRYW@@ � � } J � DPI_AWARENESS_CONTEXT__ .?AUDPI_AWARENESS_CONTEXT__@@
t unused ���J � DPI_AWARENESS_CONTEXT__ .?AUDPI_AWARENESS_CONTEXT__@@ � t 2 SystemPowerState � DevicePowerState �: t � _POWER_STATE_TYPE .?AW4_POWER_STATE_TYPE@@ � � x � 2 � tagGLYPHSET .?AUtagGLYPHSET@@ 2 � tagWCRANGE .?AUtagWCRANGE@@ �� � " �n
" cbThis ���
" flAccel ��
" cGlyphsSupported �
" cRanges ��
� ranges ���2 � tagGLYPHSET .?AUtagGLYPHSET@@ � � � Z � _JOURNAL_RENAME_KEY_INFORMATION .?AU_JOURNAL_RENAME_KEY_INFORMATION@@ Z JournalCreateKey � JournalDeleteKey � JournalRenameKey � JournalSetValue �� JournalDeleteValue ��� JournalSetKeySecurity JournalSetKeyUserFlags ��� JournalSetLastWriteTime �� JournalBeginTransaction �� JournalCommitTransaction �
JournalAbortTransaction �� MaxJournalChangeAction ���Z t � _JOURNAL_CHANGE_INFORMATION_CLASS .?AW4_JOURNAL_CHANGE_INFORMATION_CLASS@@ �2 onecore\internal\sdk\inc\minwin\ntregapi.h � � � � r
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
( KeyKeyName ���Z � 8 _JOURNAL_RENAME_KEY_INFORMATION .?AU_JOURNAL_RENAME_KEY_INFORMATION@@ � � � 2 ThreadBasicInformation ��� ThreadTimes �� ThreadPriority ��� ThreadBasePriority ��� ThreadAffinityMask ��� ThreadImpersonationToken � ThreadDescriptorTableEntry ��� ThreadEnableAlignmentFaultFixup �� ThreadEventPair_Reusable � ThreadQuerySetWin32StartAddress ��
ThreadZeroTlsCell ThreadPerformanceCount ��� ThreadAmILastThread ��
ThreadIdealProcessor � ThreadPriorityBoost �� ThreadSetTlsArrayAddress � ThreadIsIoPending ThreadHideFromDebugger ��� ThreadBreakOnTermination � ThreadSwitchLegacyState �� ThreadIsTerminated ��� ThreadLastSystemCall � ThreadIoPriority � ThreadCycleTime �� ThreadPagePriority ��� ThreadActualBasePriority � ThreadTebInformation � ThreadCSwitchMon � ThreadCSwitchPmu � ThreadWow64Context ��� ThreadGroupInformation ��� ThreadUmsInformation � ThreadCounterProfiling ��� ! ThreadIdealProcessorEx ��� " ThreadCpuAccountingInformation ��� # ThreadSuspendCount ��� $ ThreadHeterogeneousCpuPolicy � % ThreadContainerId & ThreadNameInformation ' ThreadSelectedCpuSets ( ThreadSystemThreadInformation ) ThreadActualGroupAffinity * ThreadDynamicCodePolicyInfo �� + ThreadExplicitCaseSensitivity , ThreadWorkOnBehalfTicket � - ThreadSubsystemInformation ��� . ThreadDbgkWerReportActive / ThreadAttachContainer 0 ThreadManageWritesToExecutableMemory � 1 ThreadPowerThrottlingState ��� 2 ThreadWorkloadClass �� 3 MaxThreadInfoClass ���: 4 t � _THREADINFOCLASS .?AW4_THREADINFOCLASS@@ ��� � ? � �
� 2 � tagACTCTXA .?AUtagACTCTXA@@ ���
" cbSize ���
" dwFlags ��
� lpSource �
! wProcessorArchitecture ���
! wLangId ��
� lpAssemblyDirectory ��
� lpResourceName ���
� ( lpApplicationName
� 0 hModule ��2 � 8 tagACTCTXA .?AUtagACTCTXA@@ �� � o F V ResourceManagerBasicInformation �� ResourceManagerCompletionInformation �^ t � _RESOURCEMANAGER_INFORMATION_CLASS .?AW4_RESOURCEMANAGER_INFORMATION_CLASS@@ ��� � � O ~ � _MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION .?AU_MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION@@ ��
� �
" Flags
" NumaNode �
# LargePageSize
# NumberOfLargePagesToCreate ���
# NumberOfLargePagesCreated ~ � _MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION .?AU_MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION@@ �� � t � n SubsystemInformationTypeWin32 SubsystemInformationTypeWSL �� MaxSubsystemInformationType ��N t � _SUBSYSTEM_INFORMATION_TYPE .?AW4_SUBSYSTEM_INFORMATION_TYPE@@ � � ? � � RtlSparseBitmapOperationClear RtlSparseBitmapOperationSet �� RtlSparseBitmapOperationAny �� RtlSparseBitmapOperationMax ��Z t � _RTL_SPARSE_BITMAP_CTX_OPERATION .?AW4_RTL_SPARSE_BITMAP_CTX_OPERATION@@ ��� � � J � _SILO_USER_SHARED_DATA .?AU_SILO_USER_SHARED_DATA@@ ��
�
" ServiceSessionId �
" ActiveConsoleId ��
ConsoleSessionForegroundProcessId
� NtProductType
" SuiteMask
" SharedUserSessionId ��
IsMultiSessionSku
� NtSystemRoot �
� &UserModeGlobalLogger �J � H_SILO_USER_SHARED_DATA .?AU_SILO_USER_SHARED_DATA@@ �� � � u
> AclRevisionInformation ��� AclSizeInformation ���F t � _ACL_INFORMATION_CLASS .?AW4_ACL_INFORMATION_CLASS@@ ��� � x I B � tagDELETEITEMSTRUCT .?AUtagDELETEITEMSTRUCT@@
� b
u CtlType ��
u CtlID
u itemID ���
� hwndItem �
# itemData �B � tagDELETEITEMSTRUCT .?AUtagDELETEITEMSTRUCT@@ � !
� � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT@@ v
ResolutionContext
# RootIndex
CancelResolution �
NoMoreEntries
Root � � ( _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT@@ � � � B � _CACHE_RELATIONSHIP .?AU_CACHE_RELATIONSHIP@@
� " �
Level
Associativity
! LineSize �
" CacheSize
. Type �
� Reserved �
& GroupMask B � 0 _CACHE_RELATIONSHIP .?AU_CACHE_RELATIONSHIP@@ � � + V � _FILE_MAKE_COMPATIBLE_BUFFER .?AU_FILE_MAKE_COMPATIBLE_BUFFER@@ ��
CloseDisc V � _FILE_MAKE_COMPATIBLE_BUFFER .?AU_FILE_MAKE_COMPATIBLE_BUFFER@@ �� � � Z � _ETW_THREAD_EVENT_SUBPROCESSTAG .?AU_ETW_THREAD_EVENT_SUBPROCESSTAG@@ >
j Header ���
" OldTag ���
" $ NewTag ���Z � ( _ETW_THREAD_EVENT_SUBPROCESSTAG .?AU_ETW_THREAD_EVENT_SUBPROCESSTAG@@ � c U
k b
HeapHandle ���
SubSegment ���
# SubSegmentSize ���
# BlockSize ^ � _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE .?AU_HEAP_EVENT_SUBSEGMENT_ALLOC_FREE@@ � c =
" ��
" ��>
" Flags
� FilterId �
� ReservedFlags v � _PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY@@ � ? � > � tagDEBUGHOOKINFO .?AUtagDEBUGHOOKINFO@@ ��j
" idThread �
" idThreadInstaller
lParam ���
# wParam ���
t code �> tagDEBUGHOOKINFO .?AUtagDEBUGHOOKINFO@@ �� y N � _STREAM_INFORMATION_ENTRY .?AU_STREAM_INFORMATION_ENTRY@@
: � _StreamInformation .?AT_StreamInformation@@ ��B
" Version ��
" Flags
StreamInformation N _STREAM_INFORMATION_ENTRY .?AU_STREAM_INFORMATION_ENTRY@@ � p J � _ImageArchitectureEntry .?AU_ImageArchitectureEntry@@ .
" FixupInstRVA �
" NewInst ��J _ImageArchitectureEntry .?AU_ImageArchitectureEntry@@
� c � EtwBufferStateFree ��� EtwBufferStateGeneralLogging � EtwBufferStateCSwitch EtwBufferStateFlush �� EtwBufferStatePendingCompression � EtwBufferStateCompressed � EtwBufferStatePlaceholder EtwBufferStateMaximum : t _ETW_BUFFER_STATE .?AW4_ETW_BUFFER_STATE@@ � c �
> � _COVERAGE_MODULES .?AU_COVERAGE_MODULES@@ N � _COVERAGE_MODULE_REQUEST .?AU_COVERAGE_MODULE_REQUEST@@ ��F � _COVERAGE_MODULE_INFO .?AU_COVERAGE_MODULE_INFO@@ " �f
" ListAndReset �
" NumberOfModules ��
ModuleRequestInfo
Modules ��> @ _COVERAGE_MODULES .?AU_COVERAGE_MODULES@@ � � R � _ACCESS_DENIED_CALLBACK_ACE .?AU_ACCESS_DENIED_CALLBACK_ACE@@ :
� Header ���
" Mask �
" SidStart �R _ACCESS_DENIED_CALLBACK_ACE .?AU_ACCESS_DENIED_CALLBACK_ACE@@ x � . � tagINPUT .?AUtagINPUT@@ ��6 � tagMOUSEINPUT .?AUtagMOUSEINPUT@@ 6 � tagKEYBDINPUT .?AUtagKEYBDINPUT@@ > � tagHARDWAREINPUT .?AUtagHARDWAREINPUT@@ ��B
" type �
mi ���
ki ���
! hi ���. " ( tagINPUT .?AUtagINPUT@@ �� # � � � � % N � _FILE_DISPOSITION_INFO_EX .?AU_FILE_DISPOSITION_INFO_EX@@
'
" Flags N ) _FILE_DISPOSITION_INFO_EX .?AU_FILE_DISPOSITION_INFO_EX@@ * o �" R � _TXFS_SAVEPOINT_INFORMATION .?AU_TXFS_SAVEPOINT_INFORMATION@@ N
KtmTransaction ���
" ActionCode ���
" SavepointId ��R - _TXFS_SAVEPOINT_INFORMATION .?AU_TXFS_SAVEPOINT_INFORMATION@@ . � �
6 � _RPC_MESSAGE .?AU_RPC_MESSAGE@@ ��
1 J � _RPC_SYNTAX_IDENTIFIER .?AU_RPC_SYNTAX_IDENTIFIER@@ ��
3
Handle ���
" DataRepresentation ���
Buffer ���
u BufferLength �
u ProcNum ��
4 TransferSyntax ���
( RpcInterfaceInformation ��
0 ReservedForRuntime ���
8 ManagerEpv ���
@ ImportContext
" H RpcFlags �6 5 P _RPC_MESSAGE .?AU_RPC_MESSAGE@@ ��. onecore\external\shared\inc\rpcdcep.h �� 6 7 3
6 � _currencyfmtA .?AU_currencyfmtA@@ �
u NumDigits
u LeadingZero ��
u Grouping �
p lpDecimalSep �
p lpThousandSep
u NegativeOrder
u $ PositiveOrder
p ( lpCurrencySymbol �6 ; 0 _currencyfmtA .?AU_currencyfmtA@@ < W � > � tagRAWINPUTDEVICE .?AUtagRAWINPUTDEVICE@@
> Z
! usUsagePage ��
! usUsage ��
" dwFlags ��
� hwndTarget ���> @ tagRAWINPUTDEVICE .?AUtagRAWINPUTDEVICE@@ A ^; F � _PERFINFO_PO_PRESLEEP .?AU_PERFINFO_PO_PRESLEEP@@ B
� PerformanceCounter ���
� PerformanceFrequency �F D _PERFINFO_PO_PRESLEEP .?AU_PERFINFO_PO_PRESLEEP@@ E c � 6 � tagAXESLISTA .?AUtagAXESLISTA@@ ��
G 6 � tagAXISINFOA .?AUtagAXISINFOA@@ �� I " � �J
" axlReserved ��
" axlNumAxes ���
J axlAxisInfo ��6 K �tagAXESLISTA .?AUtagAXESLISTA@@ �� L � 6 N � _HEAP_REGION_INFORMATION .?AU_HEAP_REGION_INFORMATION@@ ��
N �
# Address ��
# ReserveSize ��
# CommitSize ���
# FirstRangeInformationOffset ��
# NextRegionInformationOffset ��N P ( _HEAP_REGION_INFORMATION .?AU_HEAP_REGION_INFORMATION@@ �� Q � � R � _FILE_GET_QUOTA_INFORMATION .?AU_FILE_GET_QUOTA_INFORMATION@@ & � _SID .?AU_SID@@ ��B
" NextEntryOffset ��
" SidLength
T Sid ��R U _FILE_GET_QUOTA_INFORMATION .?AU_FILE_GET_QUOTA_INFORMATION@@ V � � F � _ALPC_PORT_ATTRIBUTES .?AU_ALPC_PORT_ATTRIBUTES@@
X V � _SECURITY_QUALITY_OF_SERVICE .?AU_SECURITY_QUALITY_OF_SERVICE@@ ��
" Flags
Z SecurityQos ��
# MaxMessageLength �
# MemoryBandwidth ��
# MaxPoolUsage �
# ( MaxSectionSize ���
# 0 MaxViewSize ��
# 8 MaxTotalSectionSize ��
" @ DupObjectTypes ���
" D Reserved �F
[ H _ALPC_PORT_ATTRIBUTES .?AU_ALPC_PORT_ATTRIBUTES@@ \ � � B � _REMOTE_NAME_INFOW .?AU_REMOTE_NAME_INFOW@@ ��
^ V
q lpUniversalName ��
q lpConnectionName �
q lpRemainingPath ��B ` _REMOTE_NAME_INFOW .?AU_REMOTE_NAME_INFOW@@ �� a � � R � _ALPC_WORK_ON_BEHALF_TICKET .?AU_ALPC_WORK_ON_BEHALF_TICKET@@ 6
" ThreadId �
" ThreadCreationTimeLow R d _ALPC_WORK_ON_BEHALF_TICKET .?AU_ALPC_WORK_ON_BEHALF_TICKET@@ e � l > � _WMI_POWER_RECORD .?AU_WMI_POWER_RECORD@@
g �
SystemS1 �
SystemS2 �
SystemS3 �
SystemS4 �
SystemS5 �
AoAc �
p Pad2 �
p Pad3 �> i _WMI_POWER_RECORD .?AU_WMI_POWER_RECORD@@ j c s N � _SERVICE_FAILURE_ACTIONSA .?AU_SERVICE_FAILURE_ACTIONSA@@ 2 � _SC_ACTION .?AU_SC_ACTION@@ ��
m r
" dwResetPeriod
p lpRebootMsg ��
p lpCommand
" cActions �
n lpsaActions ��N o ( _SERVICE_FAILURE_ACTIONSA .?AU_SERVICE_FAILURE_ACTIONSA@@ p � 2
UniqueProcess
UniqueThread �2 r _CLIENT_ID .?AU_CLIENT_ID@@ �� s ? � � SERVERSILO_INITING ��� SERVERSILO_STARTED ��� SERVERSILO_SHUTTING_DOWN � SERVERSILO_TERMINATING ��� SERVERSILO_TERMINATED : t u _SERVERSILO_STATE .?AW4_SERVERSILO_STATE@@ � v ? � N � _FILE_GET_EA_INFORMATION .?AU_FILE_GET_EA_INFORMATION@@ ��
x J
" NextEntryOffset ��
EaNameLength �
EaName ���N z _FILE_GET_EA_INFORMATION .?AU_FILE_GET_EA_INFORMATION@@ �� { � � ^ � _CI_LOG_SCHEDULER_SLEEP_RESPONSE .?AU_CI_LOG_SCHEDULER_SLEEP_RESPONSE@@ ��
Header ���^ ~ 0 _CI_LOG_SCHEDULER_SLEEP_RESPONSE .?AU_CI_LOG_SCHEDULER_SLEEP_RESPONSE@@ �� c [ : � _WMI_PAGE_FAULT .?AU_WMI_PAGE_FAULT@@
� :
VirtualAddress ���
ProgramCounter ���: � _WMI_PAGE_FAULT .?AU_WMI_PAGE_FAULT@@ � c 2 � _CHAR_INFO .?AU_CHAR_INFO@@ ��
� .
q UnicodeChar ��
p AsciiChar 2 � <anonymous-tag> .?AT<anonymous-tag>@@ . onecore\external\sdk\inc\wincontypes.h � � � � *
� Char �
! Attributes ���2 � _CHAR_INFO .?AU_CHAR_INFO@@ �� � � � � ThreadMemoryPriority � ThreadAbsoluteCpuPriority ThreadDynamicCodePolicy �� ThreadPowerThrottling ThreadInformationClassMax J t � _THREAD_INFORMATION_CLASS .?AW4_THREAD_INFORMATION_CLASS@@ � � � 0 � IoPriorityVeryLow IoPriorityLow IoPriorityNormal � IoPriorityHigh ��� IoPriorityCritical ��� MaxIoPriorityTypes ���: t � _IO_PRIORITY_HINT .?AW4_IO_PRIORITY_HINT@@ � � � � J � _THREAD_UMS_INFORMATION .?AU_THREAD_UMS_INFORMATION@@ � UmsInformationCommandInvalid � UmsInformationCommandAttach �� UmsInformationCommandDetach �� UmsInformationCommandQuery ���V t � _THREAD_UMS_INFORMATION_COMMAND .?AW4_THREAD_UMS_INFORMATION_COMMAND@@ � � ?
Z > � _RTL_UMS_CONTEXT .?AU_RTL_UMS_CONTEXT@@ ��
�
" ��
" ��
� Command ��
� CompletionList ���
� UmsContext ���
" Flags
� IsUmsSchedulerThread �
� IsUmsWorkerThread J � _THREAD_UMS_INFORMATION .?AU_THREAD_UMS_INFORMATION@@ � ? ' B � EVENT_INSTANCE_INFO .?AUEVENT_INSTANCE_INFO@@ .
RegHandle
" InstanceId ���B � EVENT_INSTANCE_INFO .?AUEVENT_INSTANCE_INFO@@ � � D & IoSessionStateCreated IoSessionStateInitialized IoSessionStateConnected �� IoSessionStateDisconnected ��� IoSessionStateDisconnectedLoggedOn ��� IoSessionStateLoggedOn ��� IoSessionStateLoggedOff �� IoSessionStateTerminated � IoSessionStateMax : t � _IO_SESSION_STATE .?AW4_IO_SESSION_STATE@@ � � � * � __n64x3 .?AU__n64x3@@ " �
� val ��* � __n64x3 .?AU__n64x3@@ � * � R � _SYSTEM_ALARM_CALLBACK_ACE .?AU_SYSTEM_ALARM_CALLBACK_ACE@@ ��:
� Header ���
" Mask �
" SidStart �R � _SYSTEM_ALARM_CALLBACK_ACE .?AU_SYSTEM_ALARM_CALLBACK_ACE@@ �� � x j � _SYSTEM_ISOLATED_USER_MODE_INFORMATION .?AU_SYSTEM_ISOLATED_USER_MODE_INFORMATION@@ ��
��
��
��
��
��
��
��
��
��
�� " �J
� SecureKernelRunning ��
� HvciEnabled ��
� HvciStrictMode ���
� DebugEnabled �
� FirmwarePageProtection ���
� EncryptionKeyAvailable ���
� SpareFlags ���
� TrustletRunning ��
� HvciDisableAllowed ���
� SpareFlags2 ��
� Spare0 ���
# Spare1 ���j � _SYSTEM_ISOLATED_USER_MODE_INFORMATION .?AU_SYSTEM_ISOLATED_USER_MODE_INFORMATION@@ �� � � N V � _FILE_DISPOSITION_INFORMATION .?AU_FILE_DISPOSITION_INFORMATION@@
�
DeleteFile ���V � _FILE_DISPOSITION_INFORMATION .?AU_FILE_DISPOSITION_INFORMATION@@ � � � F � _LOGICAL_DISK_EXTENTS .?AU_LOGICAL_DISK_EXTENTS@@
� q " � q " �b
# StartingOffset ���
# PartitionSize
" DiskNumber ���
" Size �
" DriveType
� DriveLetterString
" $ Pad ��
" ( PartitionNumber ��
" , SectorsPerCluster
" 0 BytesPerSector ���
8 NumberOfFreeClusters �
@ TotalNumberOfClusters
� H FileSystemType ���
" h VolumeExt F � p _LOGICAL_DISK_EXTENTS .?AU_LOGICAL_DISK_EXTENTS@@ � c � B � _SERVICE_NOTIFY_2W .?AU_SERVICE_NOTIFY_2W@@ ��
- �
" dwVersion
� pfnNotifyCallback
pContext �
" dwNotificationStatus �
� ServiceStatus
" @ dwNotificationTriggered ��
q H pszServiceNames ��B � P _SERVICE_NOTIFY_2W .?AU_SERVICE_NOTIFY_2W@@ �� � � � 6 � _RTL_BARRIER .?AU_RTL_BARRIER@@ �� " �f
" Reserved1
" Reserved2
� Reserved3
" Reserved4
" Reserved5 : � <anonymous-tag> .?AU<anonymous-tag>@@ � b g �
T Barrier ��
LeftBarrier ��
� WaitEvent
TotalProcessors ��
" Spins
� DUMMYRESERVEDSTRUCTNAME ��6 � _RTL_BARRIER .?AU_RTL_BARRIER@@ �� � b W
" ��
" ��
" ��
" ��
" Flags
� NoChildProcessCreation ���
� AuditNoChildProcessCreation ��
� AllowSecureProcessCreation ���
� ReservedFlags n � _PROCESS_MITIGATION_CHILD_PROCESS_POLICY .?AU_PROCESS_MITIGATION_CHILD_PROCESS_POLICY@@ �� � ? � : � _SE_TOKEN_USER .?AU_SE_TOKEN_USER@@ ��2 � _TOKEN_USER .?AU_TOKEN_USER@@ B � _SID_AND_ATTRIBUTES .?AU_SID_AND_ATTRIBUTES@@ " D �J
� TokenUser
� User �
T Sid ��
� Buffer ���: � X _SE_TOKEN_USER .?AU_SE_TOKEN_USER@@ �� � x v
� J � _EFI_DRIVER_ENTRY_LIST .?AU_EFI_DRIVER_ENTRY_LIST@@ ��6
" NextEntryOffset ��
K DriverEntry ��J � _EFI_DRIVER_ENTRY_LIST .?AU_EFI_DRIVER_ENTRY_LIST@@ �� � � " > � tagHIGHCONTRASTW .?AUtagHIGHCONTRASTW@@ ��
� F
u cbSize ���
" dwFlags ��
q lpszDefaultScheme > � tagHIGHCONTRASTW .?AUtagHIGHCONTRASTW@@ �� � p2 " ViewShare ViewUnmap : t � _SECTION_INHERIT .?AW4_SECTION_INHERIT@@ ��� � � � � PowerDeviceUnspecified ��� PowerDeviceD0 PowerDeviceD1 PowerDeviceD2 PowerDeviceD3 PowerDeviceMaximum ���> t � _DEVICE_POWER_STATE .?AW4_DEVICE_POWER_STATE@@ � � x � v PerfInfoMemReset � PerfInfoMemResetUndo � PerfInfoMemResetUndoFailed ��� PerfInfoMemResetMax ��R t � _PERFINFO_MEM_RESET_INFO_TYPE .?AW4_PERFINFO_MEM_RESET_INFO_TYPE@@ � � c q > � _TRACE_GUID_INFO .?AU_TRACE_GUID_INFO@@ ��.
" InstanceCount
" Reserved �> � _TRACE_GUID_INFO .?AU_TRACE_GUID_INFO@@ �� � � � CrossProcOperationMemoryAllocPreNotify ��� CrossProcOperationMemoryAllocPostNotify �� CrossProcOperationMemoryFreePreNotify CrossProcOperationMemoryFreePostNotify ��� CrossProcOperationMemoryProtectPreNotify � CrossProcOperationMemoryProtectPostNotify CrossProcOperationInstructionCacheFlush �� CrossProcOperationInstructionCacheFlushHeavy � CrossProcOperationMemoryDirtyNotify ��b t � RTLWOW64_CROSSPROCESS_WORK_OPERATION .?AW4RTLWOW64_CROSSPROCESS_WORK_OPERATION@@ ��� � � � J � _PROCESS_DISK_COUNTERS .?AU_PROCESS_DISK_COUNTERS@@ ��
�
# BytesRead
# BytesWritten �
# ReadOperationCount ���
# WriteOperationCount ��
# FlushOperationCount ��J ( _PROCESS_DISK_COUNTERS .?AU_PROCESS_DISK_COUNTERS@@ �� � � j � _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION .?AU_SYSTEM_CODEINTEGRITYPOLICY_INFORMATION@@
Z
" Options ��
" HVCIOptions ��
# Version ��
PolicyGuid ���j _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION .?AU_SYSTEM_CODEINTEGRITYPOLICY_INFORMATION@@ � � n BootEntropySourceNone BootEntropySourceSeedfile BootEntropySourceExternal BootEntropySourceTpm � BootEntropySourceRdrand �� BootEntropySourceTime BootEntropySourceAcpiOem0 BootEntropySourceUefi BootEntropySourceCng � BootEntropySourceTcbTpm ��
BootEntropySourceTcbRdrand ���
BootMaxEntropySources F t _BOOT_ENTROPY_SOURCE_ID .?AW4_BOOT_ENTROPY_SOURCE_ID@@ � �
E Z � _RTL_PROCESS_MODULE_INFORMATION .?AU_RTL_PROCESS_MODULE_INFORMATION@@ " ��
Section ��
MappedBase ���
ImageBase
" ImageSize
" Flags
! LoadOrderIndex ���
! " InitOrderIndex ���
! $ LoadCount
! & OffsetToFileName �
( FullPathName �Z
(_RTL_PROCESS_MODULE_INFORMATION .?AU_RTL_PROCESS_MODULE_INFORMATION@@ � � R � _PERFINFO_PROCESS_PERFCTR64 .?AU_PERFINFO_PROCESS_PERFCTR64@@
�
" ProcessId
" PageFaultCount ���
" HandleCount ��
" Reserved �
# PeakVirtualSize ��
# PeakWorkingSetSize ���
# PeakPagefileUsage
# ( QuotaPeakPagedPoolUsage ��
# 0 QuotaPeakNonPagedPoolUsage ���
# 8 VirtualSize ��
# @ WorkingSetSize ���
# H PagefileUsage
# P QuotaPagedPoolUsage ��
# X QuotaNonPagedPoolUsage ���
# ` PrivatePageCount �R h _PERFINFO_PROCESS_PERFCTR64 .?AU_PERFINFO_PROCESS_PERFCTR64@@ c � EventSecuritySetDACL � EventSecuritySetSACL � EventSecurityAddDACL � EventSecurityAddSACL � EventSecurityMax �F t EVENTSECURITYOPERATION .?AW4EVENTSECURITYOPERATION@@ ��� V 2 ^ POINTER_FEEDBACK_DEFAULT � POINTER_FEEDBACK_INDIRECT POINTER_FEEDBACK_NONE B t POINTER_FEEDBACK_MODE .?AW4POINTER_FEEDBACK_MODE@@ � $ F � _SECURITY_ATTRIBUTES .?AU_SECURITY_ATTRIBUTES@@ ��R
" nLength ��
lpSecurityDescriptor �
t bInheritHandle ���F _SECURITY_ATTRIBUTES .?AU_SECURITY_ATTRIBUTES@@ �� ! � . � SectionBasicInformation �� SectionImageInformation �� SectionRelocationInformation � SectionOriginalBaseInformation ��� SectionInternalImageInformation �� MaxSectionInfoClass ��N t # _SECTION_INFORMATION_CLASS .?AW4_SECTION_INFORMATION_CLASS@@ ��� $ t ^ " " " &
' ^ � _FILE_FS_VOLUME_FLAGS_INFORMATION .?AU_FILE_FS_VOLUME_FLAGS_INFORMATION@@
" Flags ^ * _FILE_FS_VOLUME_FLAGS_INFORMATION .?AU_FILE_FS_VOLUME_FLAGS_INFORMATION@@ + � � ^ � _ETW_SESSION_NOTIFICATION_PACKET .?AU_ETW_SESSION_NOTIFICATION_PACKET@@ ��N � _ETW_NOTIFICATION_HEADER .?AU_ETW_NOTIFICATION_HEADER@@ �� EtwSessionNotificationMediaChanged ��� EtwSessionNotificationSessionTerminated �� EtwSessionNotificationLogfileError ��� EtwSessionNotificationRealtimeError �� EtwSessionNotificationSessionStarted � EtwSessionNotificationMax V t / _ETW_SESSION_NOTIFICATION_TYPE .?AW4_ETW_SESSION_NOTIFICATION_TYPE@@ ��� 0 A h r
. NotificationHeader ���
0 H Type �
L Status ���
# P TraceHandle ��
8 X Reserved �^ 2 ` _ETW_SESSION_NOTIFICATION_PACKET .?AU_ETW_SESSION_NOTIFICATION_PACKET@@ �� 3 A q Z � _ETW_CREATEDELETE_OBJECT_EVENT .?AU_ETW_CREATEDELETE_OBJECT_EVENT@@ ��
5 .
Object ���
! ObjectType ���Z 7 _ETW_CREATEDELETE_OBJECT_EVENT .?AU_ETW_CREATEDELETE_OBJECT_EVENT@@ �� 8 c v
Z � _ETW_COVERAGE_SAMPLER_OPTION_FLAGS .?AT_ETW_COVERAGE_SAMPLER_OPTION_FLAGS@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��n
" AllFlags �
; RequireProfileTotalIssuesSource ��
< ForceProfileTimeSource ���
= NoProfileSampling
> NoCSwitchSampling
? NoReadyThreadSampling
@ NoFaultSampling ��
A NoStackCache �
B NoSampleBuffers ��
C NoPauseWhenFull ��
D NoLowPriority
E WithAppId
F FilterKernel �Z
G _ETW_COVERAGE_SAMPLER_OPTION_FLAGS .?AT_ETW_COVERAGE_SAMPLER_OPTION_FLAGS@@ �� H A � v � _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION@@
J .
SectionObject
RangeBase v L _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION@@ M c r � WorkerFactoryCallbackNormal �� WorkerFactoryCallbackLongRunning � WorkerFactoryCallbackIndependent � WorkerFactoryCallbackDetectedUnrecoverableError ��V t O _WORKER_FACTORY_CALLBACK_CLASS .?AW4_WORKER_FACTORY_CALLBACK_CLASS@@ ��� P � � � RelationProcessorCore RelationNumaNode � RelationCache RelationProcessorPackage � RelationGroup ���RelationAll V t R _LOGICAL_PROCESSOR_RELATIONSHIP .?AW4_LOGICAL_PROCESSOR_RELATIONSHIP@@ � S � � J � DISK_SPACE_INFORMATION .?AUDISK_SPACE_INFORMATION@@ ��
# ActualTotalAllocationUnits ���
# ActualAvailableAllocationUnits ���
# ActualPoolUnavailableAllocationUnits �
# CallerTotalAllocationUnits ���
# CallerAvailableAllocationUnits ���
# ( CallerPoolUnavailableAllocationUnits �
# 0 UsedAllocationUnits ��
# 8 TotalReservedAllocationUnits �
# @ VolumeStorageReserveAllocationUnits ��
# H AvailableCommittedAllocationUnits
# P PoolAvailableAllocationUnits �
" X SectorsPerAllocationUnit �
" \ BytesPerSector ���J
V ` DISK_SPACE_INFORMATION .?AUDISK_SPACE_INFORMATION@@ ��2 onecore\external\sdk\inc\minwin\fileapi.h �� W X � ^ � _PERFINFO_SAMPLED_PROFILE_CONFIG .?AU_PERFINFO_SAMPLED_PROFILE_CONFIG@@ ��F
" Source ���
" NewInterval ��
" OldInterval ��^ [ _PERFINFO_SAMPLED_PROFILE_CONFIG .?AU_PERFINFO_SAMPLED_PROFILE_CONFIG@@ �� \ c � z IMDT_UNAVAILABLE � IMDT_KEYBOARD IMDT_MOUSE ��� IMDT_TOUCH ��� IMDT_PEN � IMDT_TOUCHPAD R t ^ tagINPUT_MESSAGE_DEVICE_TYPE .?AW4tagINPUT_MESSAGE_DEVICE_TYPE@@ ��� _ �= n � _EVENT_TRACE_PROFILE_COUNTER_INFORMATION .?AU_EVENT_TRACE_PROFILE_COUNTER_INFORMATION@@ ��Z
@ EventTraceInformationClass ���
# TraceHandle ��
� ProfileSource n b _EVENT_TRACE_PROFILE_COUNTER_INFORMATION .?AU_EVENT_TRACE_PROFILE_COUNTER_INFORMATION@@ �� c A F 6 � _TOKEN_GROUPS .?AU_TOKEN_GROUPS@@ � " �.
" GroupCount ���
f Groups ���6 g _TOKEN_GROUPS .?AU_TOKEN_GROUPS@@ h x � # " � u " � ! " � " � " � t " � " � p " � @ " � A " �&
low64
high64 ���: t <anonymous-tag> .?AU<anonymous-tag>@@ u * u �
j n128_u64 �
k n128_u32 �
l n128_u16 �
m n128_u8 ��
n n128_i64 �
o n128_i32 �
p n128_i16 �
q n128_i8 ��
r n128_f32 �
s n128_f64 �
u s " &w __n128 .?AT__n128@@ �� x * g N � _ETW_KQUEUE_DEQUEUE_EVENT .?AU_ETW_KQUEUE_DEQUEUE_EVENT@@
z " �B
" ThreadId �
" EntryCount ���
| Entries ��N } _ETW_KQUEUE_DEQUEUE_EVENT .?AU_ETW_KQUEUE_DEQUEUE_EVENT@@ ~ c �
� User �2 � _TOKEN_USER .?AU_TOKEN_USER@@ � x p A A � F GEOCLASS_NATION �� GEOCLASS_REGION �� GEOCLASS_ALL �. t � SYSGEOCLASS .?AW4SYSGEOCLASS@@ � � W ) F UNSPECIFIED_COMPARTMENT_ID ��� DEFAULT_COMPARTMENT_ID ���6 t � COMPARTMENT_ID .?AW4COMPARTMENT_ID@@ ��� � �
" � B � _SHUFFLE_FILE_DATA .?AU_SHUFFLE_FILE_DATA@@ ��
� B
StartingOffset ���
Length ���
" Flags B � _SHUFFLE_FILE_DATA .?AU_SHUFFLE_FILE_DATA@@ �� � � Q( R � _FILE_QUERY_SPARING_BUFFER .?AU_FILE_QUERY_SPARING_BUFFER@@ ��r
" SparingUnitBytes �
SoftwareSparing ��
" TotalSpareBlocks �
" FreeSpareBlocks ��R � _FILE_QUERY_SPARING_BUFFER .?AU_FILE_QUERY_SPARING_BUFFER@@ �� � � 1 B � _RASTERIZER_STATUS .?AU_RASTERIZER_STATUS@@ ��>
nSize
wFlags ���
nLanguageID ��B � _RASTERIZER_STATUS .?AU_RASTERIZER_STATUS@@ �� � �
* � _FIBER .?AU_FIBER@@ ��. � _CONTEXT .?AU_CONTEXT@@ ��. � _Wx86TIB .?AU_Wx86TIB@@ ��
�
R
FiberData
; ExceptionList
StackBase
StackLimit ���
DeallocationStack
( Pad ��
� 0 FiberContext �
� �Wx86Tib ��
� �ActivationContextStackPointer
�FlsData ��
" �GuaranteedStackBytes �
! �TebFlags �
! �ReservedPad ��
# �FiberCookie ��* � �_FIBER .?AU_FIBER@@ �� � � , 6 � _MEMORYSTATUS .?AU_MEMORYSTATUS@@ �
" dwLength �
" dwMemoryLoad �
# dwTotalPhys ��
# dwAvailPhys ��
# dwTotalPageFile ��
# dwAvailPageFile ��
# ( dwTotalVirtual ���
# 0 dwAvailVirtual ���6 � 8 _MEMORYSTATUS .?AU_MEMORYSTATUS@@ � o V 6 � tagAXISINFOW .?AUtagAXISINFOW@@ ��J
axMinValue ���
axMaxValue ���
� axAxisName ���6 � ( tagAXISINFOW .?AUtagAXISINFOW@@ �� � � & : � _WOW64_CONTEXT .?AU_WOW64_CONTEXT@@ ��N � _WOW64_FLOATING_SAVE_AREA .?AU_WOW64_FLOATING_SAVE_AREA@@ �
" ContextFlags �
" Dr0 ��
" Dr1 ��
" Dr2 ��
" Dr3 ��
" Dr6 ��
" Dr7 ��
� FloatSave
" � SegGs
" � SegFs
" � SegEs
" � SegDs
" � Edi ��
" � Esi ��
" � Ebx ��
" � Edx ��
" � Ecx ��
" � Eax ��
" � Ebp ��
" � Eip ��
" � SegCs
" � EFlags ���
" � Esp ��
" � SegSs
� � ExtendedRegisters : � �_WOW64_CONTEXT .?AU_WOW64_CONTEXT@@ ��. onecore\internal\sdk\inc\ntwow64_x.h ��� � � \ B MutantBasicInformation ��� MutantOwnerInformation ���J t � _MUTANT_INFORMATION_CLASS .?AW4_MUTANT_INFORMATION_CLASS@@ � � � ) > � _KSPIN_LOCK_QUEUE .?AU_KSPIN_LOCK_QUEUE@@
�
# "
� Next �
� Lock �> � _KSPIN_LOCK_QUEUE .?AU_KSPIN_LOCK_QUEUE@@ � L � V � _PERFINFO_CC_LAZY_WRITE_SCAN .?AU_PERFINFO_CC_LAZY_WRITE_SCAN@@ ��
� r
# WorkItemKey ��
" ReasonForFlush ���
" PagesToWrite �
# TotalDirtyPages ��
# AvailablePages ���
# DirtyPageThreshold ���
# ( NumberOfMappedVacbs ��
# 0 TopDirtyPageThreshold
# 8 BottomDirtyPageThreshold �
# @ AverageAvailablePages
# H AverageDirtyPages
# P ConsecutiveWorklessLazywriteScans V � X _PERFINFO_CC_LAZY_WRITE_SCAN .?AU_PERFINFO_CC_LAZY_WRITE_SCAN@@ �� � c �
� J � _LDR_DLL_NOTIFICATION_DATA .?AT_LDR_DLL_NOTIFICATION_DATA@@ ��
� ^ � _LDR_DLL_LOADED_NOTIFICATION_DATA .?AU_LDR_DLL_LOADED_NOTIFICATION_DATA@@ *
� Loaded ���
V Unloaded �J � ( _LDR_DLL_NOTIFICATION_DATA .?AT_LDR_DLL_NOTIFICATION_DATA@@ �� � � �
2 - � > � tagMENUITEMINFOA .?AUtagMENUITEMINFOA@@ ��
� ��
� * � HMENU__ .?AUHMENU__@@
� �
u cbSize ���
u fMask
u fType
u fState ���
u wID ��
� hSubMenu �
| hbmpChecked ��
| ( hbmpUnchecked
# 0 dwItemData ���
p 8 dwTypeData ���
u @ cch ��
| H hbmpItem �> � P tagMENUITEMINFOA .?AUtagMENUITEMINFOA@@ �� � � N � _SYSTEM_POWER_INFORMATION .?AU_SYSTEM_POWER_INFORMATION@@
� f
" MaxIdlenessAllowed ���
" Idleness �
" TimeRemaining
CoolingMode ��N � _SYSTEM_POWER_INFORMATION .?AU_SYSTEM_POWER_INFORMATION@@ � x � : � tagICEXYZTRIPLE .?AUtagICEXYZTRIPLE@@ . � tagCIEXYZ .?AUtagCIEXYZ@@ F
� ciexyzRed
� ciexyzGreen ��
� ciexyzBlue ���: � $ tagICEXYZTRIPLE .?AUtagICEXYZTRIPLE@@ � � � > � _X86_NT5_CONTEXT .?AU_X86_NT5_CONTEXT@@ �� � " " " � B � _LAST_EXCEPTION_LOG .?AU_LAST_EXCEPTION_LOG@@
� > � _EXCEPTION_RECORD .?AU_EXCEPTION_RECORD@@ � ExceptionContinueExecution ��� ExceptionContinueSearch �� ExceptionNestedException � ExceptionCollidedUnwind ��F t � _EXCEPTION_DISPOSITION .?AW4_EXCEPTION_DISPOSITION@@ ���. onecore\external\sdk\inc\crt\excpt.h ��� � � ' z
� ExceptionRecord ��
� � ContextRecord
" 0ControlPc
� 4Disposition ��
8HandlerData ��B � P_LAST_EXCEPTION_LOG .?AU_LAST_EXCEPTION_LOG@@ � , * � _FIXED .?AU_FIXED@@ ��"
! fract
value * � _FIXED .?AU_FIXED@@ �� � � c
ManageHotPatchLoadPatch �� ManageHotPatchUnloadPatch ManageHotPatchQueryPatches ��� ManageHotPatchLoadPatchForUser ��� ManageHotPatchUnloadPatchForUser � ManageHotPatchQueryPatchesForUser ManageHotPatchQueryActivePatches � ManageHotPatchMax R t � _HOT_PATCH_INFORMATION_CLASS .?AW4_HOT_PATCH_INFORMATION_CLASS@@ ��� � t :
� R � _SYSTEM_DEVICE_INFORMATION .?AU_SYSTEM_DEVICE_INFORMATION@@ ��
� �
" NumberOfDisks
" NumberOfFloppies �
" NumberOfCdRoms ���
" NumberOfTapes
" NumberOfSerialPorts ��
" NumberOfParallelPorts R � _SYSTEM_DEVICE_INFORMATION .?AU_SYSTEM_DEVICE_INFORMATION@@ �� � � x ^ � _RTL_STACK_TRACE_DATABASE_CREATE .?AU_RTL_STACK_TRACE_DATABASE_CREATE@@ ��J
CommitBase ���
# CommitSize ���
# ReserveSize ��^ � _RTL_STACK_TRACE_DATABASE_CREATE .?AU_RTL_STACK_TRACE_DATABASE_CREATE@@ �� � � F � _EISA_PORT_DESCRIPTOR .?AU_EISA_PORT_DESCRIPTOR@@
��
��
��
��Z
� NumberPorts ��
� Reserved �
� Shared ���
� MoreEntries ��F � _EISA_PORT_DESCRIPTOR .?AU_EISA_PORT_DESCRIPTOR@@ � : � tagICONMETRICSA .?AUtagICONMETRICSA@@ 2 � tagLOGFONTA .?AUtagLOGFONTA@@ r
u cbSize ���
t iHorzSpacing �
t iVertSpacing �
t iTitleWrap ���
lfFont ���: L tagICONMETRICSA .?AUtagICONMETRICSA@@ &2 Z � _INVERTED_FUNCTION_TABLE_ENTRY .?AU_INVERTED_FUNCTION_TABLE_ENTRY@@ ��
/ J � _DYNAMIC_FUNCTION_TABLE .?AU_DYNAMIC_FUNCTION_TABLE@@
v
FunctionTable
DynamicTable �
ImageBase
" SizeOfImage ��
" SizeOfTable ��Z _INVERTED_FUNCTION_TABLE_ENTRY .?AU_INVERTED_FUNCTION_TABLE_ENTRY@@ �� � j � _JOBOBJECT_LIMIT_VIOLATION_INFORMATION .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION@@ ��R
" LimitFlags ���
" ViolationLimitFlags ��
# IoReadBytes ��
# IoReadBytesLimit �
# IoWriteBytes �
# IoWriteBytesLimit
� ( PerJobUserTime ���
� 0 PerJobUserTimeLimit ��
# 8 JobMemory
# @ JobMemoryLimit ���
Q H RateControlTolerance �
Q L RateControlToleranceLimit j P _JOBOBJECT_LIMIT_VIOLATION_INFORMATION .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION@@ ��
? � 6 � tagTOGGLEKEYS .?AUtagTOGGLEKEYS@@ *
u cbSize ���
" dwFlags ��6 tagTOGGLEKEYS .?AUtagTOGGLEKEYS@@ Z4 2 � tagRAWINPUT .?AUtagRAWINPUT@@
> � tagRAWINPUTHEADER .?AUtagRAWINPUTHEADER@@ : � tagRAWKEYBOARD .?AUtagRAWKEYBOARD@@ ��. � tagRAWHID .?AUtagRAWHID@@ 6
mouse
keyboard �
hid ��2 <anonymous-tag> .?AT<anonymous-tag>@@ �: &
header ���
data �2 0 tagRAWINPUT .?AUtagRAWINPUT@@ �: v FeatureVariantPayloadKindNone FeatureVariantPayloadKindResident FeatureVariantPayloadKindExternal Z t _RTL_FEATURE_VARIANT_PAYLOAD_KIND .?AW4_RTL_FEATURE_VARIANT_PAYLOAD_KIND@@ � M
f � _PROCESS_EXTENDED_BASIC_INFORMATION64 .?AU_PROCESS_EXTENDED_BASIC_INFORMATION64@@
" V � _PROCESS_BASIC_INFORMATION64 .?AU_PROCESS_BASIC_INFORMATION64@@ ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��>
# Size �
$ BasicInfo
u 8 Flags
% 8 IsProtectedProcess ���
& 8 IsWow64Process ���
' 8 IsProcessDeleting
( 8 IsCrossSessionCreate �
) 8 IsFrozen �
* 8 IsBackground �
+ 8 IsStronglyNamed ��
, 8 IsSecureProcess ��
- 8 IsPicoProcess
. 8 SpareBits f
/ @ _PROCESS_EXTENDED_BASIC_INFORMATION64 .?AU_PROCESS_EXTENDED_BASIC_INFORMATION64@@ 0 � � > � tagCOPYDATASTRUCT .?AUtagCOPYDATASTRUCT@@
2 >
# dwData ���
" cbData ���
lpData ���> 4 tagCOPYDATASTRUCT .?AUtagCOPYDATASTRUCT@@ 5 ) F � _RTL_PROTECTED_ACCESS .?AU_RTL_PROTECTED_ACCESS@@ Z
" DominateMask �
" DeniedProcessAccess ��
" DeniedThreadAccess ���F 8 _RTL_PROTECTED_ACCESS .?AU_RTL_PROTECTED_ACCESS@@ 9 � > � MFT_ENUM_DATA_V1 .?AUMFT_ENUM_DATA_V1@@ ��
; �
# StartFileReferenceNumber �
LowUsn ���
HighUsn ��
! MinMajorVersion ��
! MaxMajorVersion ��> = MFT_ENUM_DATA_V1 .?AUMFT_ENUM_DATA_V1@@ �� > � �
V � _PS_CPU_QUOTA_SET_INFORMATION .?AU_PS_CPU_QUOTA_SET_INFORMATION@@ .
SessionHandle
" Weight ���V A _PS_CPU_QUOTA_SET_INFORMATION .?AU_PS_CPU_QUOTA_SET_INFORMATION@@ B � * RTL_RESOURCE_POLICY_FLAGS_NONE ���N t D _RTL_RESOURCE_POLICY_FLAGS .?AW4_RTL_RESOURCE_POLICY_FLAGS@@ ��� E C > � _FILE_SEGMENT_ELEMENT .?AT_FILE_SEGMENT_ELEMENT@@
G *
Buffer ���
# Alignment > I _FILE_SEGMENT_ELEMENT .?AT_FILE_SEGMENT_ELEMENT@@ J � Z WnfInfoStateNameExist WnfInfoSubscribersPresent WnfInfoIsQuiescent ���N t L _WNF_STATE_NAME_INFORMATION .?AW4_WNF_STATE_NAME_INFORMATION@@ � M �
6 � _COMMTIMEOUTS .?AU_COMMTIMEOUTS@@ �
" ReadIntervalTimeout ��
" ReadTotalTimeoutMultiplier ���
" ReadTotalTimeoutConstant �
" WriteTotalTimeoutMultiplier ��
" WriteTotalTimeoutConstant 6 P _COMMTIMEOUTS .?AU_COMMTIMEOUTS@@ Q o 2 � _RTL_TICK_LOCK .?AT_RTL_TICK_LOCK@@ ��
# ��
# ?��6
# AsULong64
T Busy �
U Ticks 2 V _RTL_TICK_LOCK .?AT_RTL_TICK_LOCK@@ �� W � f � _FILE_STORAGE_RESERVE_ID_INFORMATION .?AU_FILE_STORAGE_RESERVE_ID_INFORMATION@@ ��
Y � StorageReserveIdNone � StorageReserveIdHard � StorageReserveIdSoft � StorageReserveIdUpdateScratch StorageReserveIdMax ��> t [ _STORAGE_RESERVE_ID .?AW4_STORAGE_RESERVE_ID@@ � \ �
\ StorageReserveId �f ^ _FILE_STORAGE_RESERVE_ID_INFORMATION .?AU_FILE_STORAGE_RESERVE_ID_INFORMATION@@ �� _ � S+ 6 � _FILE_ID_INFO .?AU_FILE_ID_INFO@@
a 6
# VolumeSerialNumber ���
n FileId ���6 c _FILE_ID_INFO .?AU_FILE_ID_INFO@@ d o &# R � _RTL_CRITICAL_SECTION_DEBUG .?AU_RTL_CRITICAL_SECTION_DEBUG@@ F � _RTL_CRITICAL_SECTION .?AU_RTL_CRITICAL_SECTION@@
g �
! Type �
! CreatorBackTraceIndex
h CriticalSection ��
ProcessLocksList �
" EntryCount ���
" $ ContentionCount ��
" ( Flags
! , CreatorBackTraceIndexHigh
! . SpareUSHORT ��R i 0 _RTL_CRITICAL_SECTION_DEBUG .?AU_RTL_CRITICAL_SECTION_DEBUG@@ j � < V � _FILE_PIPE_REMOTE_INFORMATION .?AU_FILE_PIPE_REMOTE_INFORMATION@@
l B
� CollectDataTime ��
" MaximumCollectionCount ���V n _FILE_PIPE_REMOTE_INFORMATION .?AU_FILE_PIPE_REMOTE_INFORMATION@@ o � \ ^ � _RTL_FEATURE_CONFIGURATION_TABLE .?AU_RTL_FEATURE_CONFIGURATION_TABLE@@ ��R � _RTL_FEATURE_CONFIGURATION .?AU_RTL_FEATURE_CONFIGURATION@@ �� r " �.
" FeatureCount �
s Features �^ t _RTL_FEATURE_CONFIGURATION_TABLE .?AU_RTL_FEATURE_CONFIGURATION_TABLE@@ �� u o ^ � _THREAD_LAST_SYSCALL_INFORMATION .?AU_THREAD_LAST_SYSCALL_INFORMATION@@ ��Z
FirstArgument
! SystemCallNumber �
'
Pad ��
# WaitTime �^ x _THREAD_LAST_SYSCALL_INFORMATION .?AU_THREAD_LAST_SYSCALL_INFORMATION@@ �� y � � > � _WIN32_FIND_DATAW .?AU_WIN32_FIND_DATAW@@
{ q " �
" dwFileAttributes �
x ftCreationTime ���
x ftLastAccessTime �
x ftLastWriteTime ��
" nFileSizeHigh
" nFileSizeLow �
" $ dwReserved0 ��
" ( dwReserved1 ��
� , cFileName
} 4cAlternateFileName ���>
~ P_WIN32_FIND_DATAW .?AU_WIN32_FIND_DATAW@@ � w ^ � __PUBLIC_OBJECT_TYPE_INFORMATION .?AU__PUBLIC_OBJECT_TYPE_INFORMATION@@ �� " " X �*
TypeName �
� Reserved �^ � h __PUBLIC_OBJECT_TYPE_INFORMATION .?AU__PUBLIC_OBJECT_TYPE_INFORMATION@@ �� � n �
� V � _RTL_CRITICAL_SECTION_DEBUG32 .?AU_RTL_CRITICAL_SECTION_DEBUG32@@
� �
! Type �
! CreatorBackTraceIndex
" CriticalSection ��
ProcessLocksList �
" EntryCount ���
" ContentionCount ��
8 Spare V � _RTL_CRITICAL_SECTION_DEBUG32 .?AU_RTL_CRITICAL_SECTION_DEBUG32@@ � � q ^ � _SYSTEM_SHADOW_STACK_INFORMATION .?AU_SYSTEM_SHADOW_STACK_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
� CetCapable ���
� UserCetAllowed ���
� ReservedForUserCet ���
� KernelCetEnabled �
� ReservedForKernelCet �
� Reserved �^ � _SYSTEM_SHADOW_STACK_INFORMATION .?AU_SYSTEM_SHADOW_STACK_INFORMATION@@ �� � � )
j RpcCurrentUniqueUser � RpcBackEndConnectionAttempts � RpcBackEndConnectionFailed ��� RpcRequestsPerSecond � RpcIncomingConnections ��� RpcIncomingBandwidth � RpcOutgoingBandwidth � RpcAttemptedLbsDecisions � RpcFailedLbsDecisions
RpcAttemptedLbsMessages �� RpcFailedLbsMessages � RpcLastCounter ���B t � RpcProxyPerfCounters .?AW4RpcProxyPerfCounters@@ ��� � 7 ` � t " �
� 6 � _ARM64_NT_NEON128 .?AT_ARM64_NT_NEON128@@ ! " �R
# Low ��
High �
s D
r S
� H
p B 6 � _ARM64_NT_NEON128 .?AT_ARM64_NT_NEON128@@ . onecore\external\sdk\inc\ntarm64_x.h ��� � � B � IMAGE_COR20_HEADER .?AUIMAGE_COR20_HEADER@@ ��F � _IMAGE_DATA_DIRECTORY .?AU_IMAGE_DATA_DIRECTORY@@ V
" cb ���
! MajorRuntimeVersion ��
! MinorRuntimeVersion ��
� MetaData �
" Flags
" EntryPointToken ��
" EntryPointRVA
� Resources
� StrongNameSignature ��
� ( CodeManagerTable �
� 0 VTableFixups �
� 8 ExportAddressTableJumps ��
� @ ManagedNativeHeader ��B
� H IMAGE_COR20_HEADER .?AUIMAGE_COR20_HEADER@@ �� � � �
R
! ��
! ��z
! Reserved1
! ExtType ��
� Linkage ��
� Reserved2
! DataSize �
# DataPtr ��^ � _EVENT_HEADER_EXTENDED_DATA_ITEM .?AU_EVENT_HEADER_EXTENDED_DATA_ITEM@@ �� � V G t # �
�
{
x
y . � tagPOINTS .?AUtagPOINTS@@ � t � : � _RTL_HASH_TABLE .?AU_RTL_HASH_TABLE@@
" ��
" ��
V ^
" EntryCount ���
� MaskBitCount �
� BucketCount ��
� Buckets ��: � _RTL_HASH_TABLE .?AU_RTL_HASH_TABLE@@ . onecore\internal\sdk\inc\rtlhashdef.h �� � � n � _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY@@
� "
� DisableNonSystemFonts n � _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY@@ � � � FileStorageTierClassUnspecified �� FileStorageTierClassCapacity � FileStorageTierClassPerformance �� FileStorageTierClassMax ��J t � _FILE_STORAGE_TIER_CLASS .?AW4_FILE_STORAGE_TIER_CLASS@@ ��� � � �
� > � tagTITLEBARINFOEX .?AUtagTITLEBARINFOEX@@
� " " � ! " ` �V
" cbSize ���
! rcTitleBar ���
� rgstate ��
� , rgrect ���> � � tagTITLEBARINFOEX .?AUtagTITLEBARINFOEX@@ � 9 R RF_SORTED RF_UNSORTED �� RF_CALLBACK �� RF_KERNEL_DYNAMIC B t � _FUNCTION_TABLE_TYPE .?AW4_FUNCTION_TABLE_TYPE@@ ��� � D f PerfInfoDebugEventReceived ��� PerfInfoDebugEventContinued �� PerfInfoDebugEventMax R t � _PERFINFO_DEBUG_EVENT_REASON .?AW4_PERFINFO_DEBUG_EVENT_REASON@@ ��� � c
6 � _WMI_SPINLOCK .?AU_WMI_SPINLOCK@@
�
��
��
��Z
SpinLockAddress ��
CallerAddress
# AcquireTime ��
# ReleaseTime ��
" WaitTimeInCycles �
" $ SpinCount
" ( ThreadId �
" , InterruptCount ���
0 Irql �
1 AcquireDepth �
� 2 AcquireMode ��
� 2 ExecuteDpc ���
� 2 ExecuteIsr ���
2 Flags
P 3 Reserved �6 � 8 _WMI_SPINLOCK .?AU_WMI_SPINLOCK@@ � c D > � _PERFINFO_CCSWAP .?AU_PERFINFO_CCSWAP@@ ��
" ��
" ��
" ��
" ��
"
��
" ��
� DataType �
� TimeDelta
� OldThreadIdIndex �
� OldThreadStateWr �
� OldThreadPriority
� NewThreadWaitTime > � _PERFINFO_CCSWAP .?AU_PERFINFO_CCSWAP@@ �� � c � B � _TRACE_ENABLE_INFO .?AU_TRACE_ENABLE_INFO@@ ��
� �
" IsEnabled
Level
Reserved1
! LoggerId �
" EnableProperty ���
" Reserved2
# MatchAnyKeyword ��
# MatchAllKeyword ��B � _TRACE_ENABLE_INFO .?AU_TRACE_ENABLE_INFO@@ �� � � � f � _VIRTUALIZATION_INSTANCE_INFO_OUTPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_OUTPUT@@ ��&
VirtualizationInstanceID �f � _VIRTUALIZATION_INSTANCE_INFO_OUTPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_OUTPUT@@ �� � � �" V � _FILE_TYPE_NOTIFICATION_INPUT .?AU_FILE_TYPE_NOTIFICATION_INPUT@@ " �F
" Flags
" NumFileTypeIDs ���
� FileTypeID ���V � _FILE_TYPE_NOTIFICATION_INPUT .?AU_FILE_TYPE_NOTIFICATION_INPUT@@ � � ^ � _RTL_QUERY_DEBUG_INFORMATION_INFO .?AU_RTL_QUERY_DEBUG_INFORMATION_INFO@@ B
" UniqueProcessId ��
" Flags
# Buffer ���^ � _RTL_QUERY_DEBUG_INFORMATION_INFO .?AU_RTL_QUERY_DEBUG_INFORMATION_INFO@@ � �
v � f � _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA@@ .
DeviceInstance ���
" Flags f � _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA@@ � % � F � _SYSDBG_CONTROL_SPACE .?AU_SYSDBG_CONTROL_SPACE@@
� R
# Address ��
Buffer ���
" Request ��
" Processor F � _SYSDBG_CONTROL_SPACE .?AU_SYSDBG_CONTROL_SPACE@@ � � : � _TXFS_MODIFY_RM .?AU_TXFS_MODIFY_RM@@ �
" Flags
" LogContainerCountMax �
" LogContainerCountMin �
" LogContainerCount
" LogGrowthIncrement ���
" LogAutoShrinkPercentage ��
# Reserved �
! LoggingMode ��: ( _TXFS_MODIFY_RM .?AU_TXFS_MODIFY_RM@@ � � R DirectoryNotifyInformation ��� DirectoryNotifyExtendedInformation ���^ t _DIRECTORY_NOTIFY_INFORMATION_CLASS .?AW4_DIRECTORY_NOTIFY_INFORMATION_CLASS@@ � � �
>
AceType ��
AceFlags �
! AceSize ��2 _ACE_HEADER .?AU_ACE_HEADER@@
x � F � _HEAP_SUBSEGMENT_FREE .?AU_HEAP_SUBSEGMENT_FREE@@ &
j Header ���
k Event F
@ _HEAP_SUBSEGMENT_FREE .?AU_HEAP_SUBSEGMENT_FREE@@ c F * � _cpinfo .?AU_cpinfo@@
" � " �F
u MaxCharSize ��
DefaultChar ��
LeadByte �* _cpinfo .?AU_cpinfo@@ W ? : � tagENUMLOGFONTW .?AUtagENUMLOGFONTW@@
2 � tagLOGFONTW .?AUtagLOGFONTW@@ q " � � q " @ �F
elfLogFont ���
\ elfFullName ��
� elfStyle �: tagENUMLOGFONTW .?AUtagENUMLOGFONTW@@ � � J � _FILE_LINK_INFORMATION .?AU_FILE_LINK_INFORMATION@@ ��
v
ReplaceIfExists ��
" Flags
RootDirectory
" FileNameLength ���
| FileName �J ! _FILE_LINK_INFORMATION .?AU_FILE_LINK_INFORMATION@@ �� " � � b � _PERFINFO_DRIVER_COMPLETIONROUTINE .?AU_PERFINFO_DRIVER_COMPLETIONROUTINE@@ ��
$ B
Routine ��
IrpPtr ���
" UniqMatchId ��b & _PERFINFO_DRIVER_COMPLETIONROUTINE .?AU_PERFINFO_DRIVER_COMPLETIONROUTINE@@ �� ' c % B � _KLOCK_QUEUE_HANDLE .?AU_KLOCK_QUEUE_HANDLE@@
) *
� LockQueue
OldIrql ��B + _KLOCK_QUEUE_HANDLE .?AU_KLOCK_QUEUE_HANDLE@@ , L � j � _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION_V2@@ ��b � _JOBOBJECT_MEMORY_USAGE_INFORMATION .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION@@ # " �F
/ BasicInfo
# JobSharedMemory ��
0 Reserved �j 1 ( _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION_V2@@ �� 2 � V ^ � _IMAGE_LOAD_CONFIG_CODE_INTEGRITY .?AU_IMAGE_LOAD_CONFIG_CODE_INTEGRITY@@ R
! Flags
! Catalog ��
" CatalogOffset
" Reserved �^ 5 _IMAGE_LOAD_CONFIG_CODE_INTEGRITY .?AU_IMAGE_LOAD_CONFIG_CODE_INTEGRITY@@ 6 � � : � tagSERIALKEYSW .?AUtagSERIALKEYSW@@ ��
u cbSize ���
" dwFlags ��
q lpszActivePort ���
q lpszPort �
u iBaudRate
u iPortState ���
u iActive ��: 9 ( tagSERIALKEYSW .?AUtagSERIALKEYSW@@ �� : R2 : � tagEXTLOGPEN32 .?AUtagEXTLOGPEN32@@ ��
" elpPenStyle ��
" elpWidth �
u elpBrushStyle
" elpColor �
" elpHatch �
" elpNumEntries
z elpStyleEntry : = tagEXTLOGPEN32 .?AUtagEXTLOGPEN32@@ �� > � � 6 � _RTL_RESOURCE .?AU_RTL_RESOURCE@@
@
f �
g CriticalSection ��
( SharedSemaphore ��
� 0 NumberOfWaitingShared
8 ExclusiveSemaphore ���
� @ NumberOfWaitingExclusive �
T D NumberOfActive ���
H ExclusiveOwnerThread �
" P Flags
B X DebugInfo 6 C ` _RTL_RESOURCE .?AU_RTL_RESOURCE@@ D � � R � _RTL_HEAP_MEMORY_LIMIT_INFO .?AU_RTL_HEAP_MEMORY_LIMIT_INFO@@
F R � _RTL_HEAP_MEMORY_LIMIT_DATA .?AU_RTL_HEAP_MEMORY_LIMIT_DATA@@ &
" Version ��
H Data �R I ( _RTL_HEAP_MEMORY_LIMIT_INFO .?AU_RTL_HEAP_MEMORY_LIMIT_INFO@@ J b �
� SYSTEM_HANDLE_FILE ��� SYSTEM_HANDLE_SEMAPHORE �� SYSTEM_HANDLE_EVENT �� SYSTEM_HANDLE_MUTEX �� SYSTEM_HANDLE_PROCESS SYSTEM_HANDLE_TOKEN �� SYSTEM_HANDLE_SECTION SYSTEM_HANDLE_REG_KEY SYSTEM_HANDLE_THREAD � SYSTEM_HANDLE_COMPOSITION_OBJECT �
SYSTEM_HANDLE_SOCKET � SYSTEM_HANDLE_JOB SYSTEM_HANDLE_PIPE ��� SYSTEM_HANDLE_MAX � SYSTEM_HANDLE_INVALID : t L _system_handle_t .?AW4_system_handle_t@@ ��� M � � TransactionManagerBasicInformation ��� TransactionManagerLogInformation � TransactionManagerLogPathInformation � TransactionManagerRecoveryInformation TransactionManagerOnlineProbeInformation � TransactionManagerOldestTransactionInformation ���b t O _TRANSACTIONMANAGER_INFORMATION_CLASS .?AW4_TRANSACTIONMANAGER_INFORMATION_CLASS@@ � P � < V � _SYSTEM_FILECACHE_INFORMATION .?AU_SYSTEM_FILECACHE_INFORMATION@@
# CurrentSize ��
# PeakSize �
" PageFaultCount ���
# MinimumWorkingSet
# MaximumWorkingSet
# ( CurrentSizeIncludingTransitionInPages
# 0 PeakSizeIncludingTransitionInPages ���
" 8 TransitionRePurposeCount �
" < Flags V S @ _SYSTEM_FILECACHE_INFORMATION .?AU_SYSTEM_FILECACHE_INFORMATION@@ T �
q t V
W B � _FILE_STANDARD_INFO .?AU_FILE_STANDARD_INFO@@ v
� AllocationSize ���
� EndOfFile
" NumberOfLinks
DeletePending
Directory B Z _FILE_STANDARD_INFO .?AU_FILE_STANDARD_INFO@@ [ o y" n � _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX@@ ��J � _PROCESSOR_RELATIONSHIP .?AU_PROCESSOR_RELATIONSHIP@@ J � _NUMA_NODE_RELATIONSHIP .?AU_NUMA_NODE_RELATIONSHIP@@ B � _GROUP_RELATIONSHIP .?AU_GROUP_RELATIONSHIP@@ r
S Relationship �
" Size �
^ Processor
_ NumaNode �
� Cache
` Group n a P _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX@@ �� b � C > � _HIBERFILE_BUCKET .?AU_HIBERFILE_BUCKET@@
d >
# MaxPhysicalMemory
� PhysicalMemoryPercent > f _HIBERFILE_BUCKET .?AU_HIBERFILE_BUCKET@@ g x �
� > � _CM_MCA_POS_DATA .?AU_CM_MCA_POS_DATA@@ ��f
! AdapterId
PosData1 �
PosData2 �
PosData3 �
PosData4 �> k _CM_MCA_POS_DATA .?AU_CM_MCA_POS_DATA@@ �� l � F � _SYSTEM_BIGPOOL_ENTRY .?AU_SYSTEM_BIGPOOL_ENTRY@@
n
# ��n
VirtualAddress ���
p NonPaged �
# SizeInBytes ��
Tag ��
" TagUlong �F q _SYSTEM_BIGPOOL_ENTRY .?AU_SYSTEM_BIGPOOL_ENTRY@@ r � �
J � _PLEX_READ_DATA_REQUEST .?AU_PLEX_READ_DATA_REQUEST@@ J
� ByteOffset ���
" ByteLength ���
" PlexNumber ���J u _PLEX_READ_DATA_REQUEST .?AU_PLEX_READ_DATA_REQUEST@@ v � � J � _WMI_THREAD_INFORMATION .?AU_WMI_THREAD_INFORMATION@@
x *
" ProcessId
" ThreadId �J z _WMI_THREAD_INFORMATION .?AU_WMI_THREAD_INFORMATION@@ { c j � _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY .?AU_RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY@@ b
� BlockRemoteImageLoads
� BlockLowLabelImageLoads ��
� PreferSystem32 ���j ~ _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY .?AU_RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY@@ � f TableEmptyTree ��� TableFoundNode ��� TableInsertAsLeft TableInsertAsRight ���B t � _TABLE_SEARCH_RESULT .?AW4_TABLE_SEARCH_RESULT@@ ��� � b D N � _NETWORK_APP_INSTANCE_EA .?AU_NETWORK_APP_INSTANCE_EA@@ ��.
AppInstanceID
" CsvFlags �N � _NETWORK_APP_INSTANCE_EA .?AU_NETWORK_APP_INSTANCE_EA@@ �� � � , V � _REFS_SMR_VOLUME_INFO_OUTPUT .?AU_REFS_SMR_VOLUME_INFO_OUTPUT@@ ��n SmrGcStateInactive ��� SmrGcStatePaused � SmrGcStateActive � SmrGcStateActiveFullSpeed J t � _REFS_SMR_VOLUME_GC_STATE .?AW4_REFS_SMR_VOLUME_GC_STATE@@ � � � � # " 8 �"
" Version ��
" Flags
� SizeOfRandomlyWritableTier ���
� FreeSpaceInRandomlyWritableTier ��
� SizeofSMRTier
� FreeSpaceInSMRTier ���
� ( UsableFreeSpaceInSMRTier �
� 0 VolumeGcState
4 VolumeGcLastStatus ���
� 8 Unused ���V
� p _REFS_SMR_VOLUME_INFO_OUTPUT .?AU_REFS_SMR_VOLUME_INFO_OUTPUT@@ �� � � � > � _REMOTE_PORT_VIEW .?AU_REMOTE_PORT_VIEW@@ >
" Length ���
# ViewSize �
ViewBase �> � _REMOTE_PORT_VIEW .?AU_REMOTE_PORT_VIEW@@ � � � SidTypeUser �� SidTypeGroup � SidTypeDomain SidTypeAlias � SidTypeWellKnownGroup SidTypeDeletedAccount SidTypeInvalid ��� SidTypeUnknown ��� SidTypeComputer ��
SidTypeLabel � SidTypeLogonSession ��2 t � _SID_NAME_USE .?AW4_SID_NAME_USE@@ � � x ; � EventProviderBinaryTrackInfo � EventProviderSetReserved1 EventProviderSetTraits ��� EventProviderUseDescriptorType ��� MaxEventInfo �: t � _EVENT_INFO_CLASS .?AW4_EVENT_INFO_CLASS@@ � � > � F � _ACL_SIZE_INFORMATION .?AU_ACL_SIZE_INFORMATION@@ F
" AceCount �
" AclBytesInUse
" AclBytesFree �F � _ACL_SIZE_INFORMATION .?AU_ACL_SIZE_INFORMATION@@ � x \ J � tagRID_DEVICE_INFO_HID .?AUtagRID_DEVICE_INFO_HID@@ ��z
" dwVendorId ���
" dwProductId ��
" dwVersionNumber ��
! usUsagePage ��
! usUsage ��J � tagRID_DEVICE_INFO_HID .?AUtagRID_DEVICE_INFO_HID@@ �� � #; F � _REPARSE_DATA_BUFFER .?AU_REPARSE_DATA_BUFFER@@ ��
� �
! SubstituteNameOffset �
! SubstituteNameLength �
! PrintNameOffset ��
! PrintNameLength ��
" Flags
| PathBuffer ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � *# �
! SubstituteNameOffset �
! SubstituteNameLength �
! PrintNameOffset ��
! PrintNameLength ��
| PathBuffer ���: �
<anonymous-tag> .?AU<anonymous-tag>@@ � � 2#
� DataBuffer ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � 9# �
" ReparseTag ���
! ReparseDataLength
! Reserved �
� SymbolicLinkReparseBuffer
� MountPointReparseBuffer ��
� GenericReparseBuffer �F � _REPARSE_DATA_BUFFER .?AU_REPARSE_DATA_BUFFER@@ �� � � ## b � _VIRTUALIZATION_INSTANCE_INFO_INPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT@@ 2
" NumberOfWorkerThreads
" Flags b � _VIRTUALIZATION_INSTANCE_INFO_INPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT@@ � � �" j ThreadWorkloadClassDefault ��� ThreadWorkloadClassGraphics �� MaxThreadWorkloadClass ���F t � _THREAD_WORKLOAD_CLASS .?AW4_THREAD_WORKLOAD_CLASS@@ ��� � ? � 6 PMCCounter ��� MaxHardwareCounterType ���F t � _HARDWARE_COUNTER_TYPE .?AW4_HARDWARE_COUNTER_TYPE@@ ��� � ? � DEPPolicyAlwaysOff ��� DEPPolicyAlwaysOn DEPPolicyOptIn ��� DEPPolicyOptOut �� DEPTotalPolicyCount ��F t � _DEP_SYSTEM_POLICY_TYPE .?AW4_DEP_SYSTEM_POLICY_TYPE@@ � � o R � OptionAbortRetryIgnore ��� OptionOk � OptionOkCancel ��� OptionRetryCancel OptionYesNo �� OptionYesNoCancel OptionShutdownSystem � OptionOkNoWait ��� OptionCancelTryContinue ��N t � _HARDERROR_RESPONSE_OPTION .?AW4_HARDERROR_RESPONSE_OPTION@@ ��� � � � J � _TRACE_PROFILE_INTERVAL .?AU_TRACE_PROFILE_INTERVAL@@
� *
" Source ���
" Interval �J � _TRACE_PROFILE_INTERVAL .?AU_TRACE_PROFILE_INTERVAL@@ � � ~ " # # " " � B � _FXSAVE_FORMAT_WX86 .?AU_FXSAVE_FORMAT_WX86@@ " � � " � �&
! ControlWord ��
! StatusWord ���
! TagWord ��
! ErrorOpcode ��
" ErrorOffset ��
" ErrorSelector
" DataOffset ���
" DataSelector �
" MXCsr
" MXCsr_Mask ���
� RegisterArea �
� � Reserved3
� Reserved4 B
� _FXSAVE_FORMAT_WX86 .?AU_FXSAVE_FORMAT_WX86@@ * onecore\internal\sdk\inc\ntwow64.h � � � < B � _KCRM_PROTOCOL_BLOB .?AU_KCRM_PROTOCOL_BLOB@@
� �
ProtocolId ���
" StaticInfoLength �
" TransactionIdInfoLength ��
" Unused1 ��
" Unused2 ��B � _KCRM_PROTOCOL_BLOB .?AU_KCRM_PROTOCOL_BLOB@@ . onecore\external\shared\inc\ktmtypes.h � � � � � SharedVirtualDisksUnsupported SharedVirtualDisksSupported �� SharedVirtualDiskSnapshotsSupported �� SharedVirtualDiskCDPSnapshotsSupported ���R t � _SharedVirtualDiskSupportType .?AW4_SharedVirtualDiskSupportType@@ � � � �' R � _IMAGE_ROM_OPTIONAL_HEADER .?AU_IMAGE_ROM_OPTIONAL_HEADER@@ ��
� N
! Magic
MajorLinkerVersion ���
MinorLinkerVersion ���
" SizeOfCode ���
" SizeOfInitializedData
" SizeOfUninitializedData ��
" AddressOfEntryPoint ��
" BaseOfCode ���
" BaseOfData ���
" BaseOfBss
" GprMask ��
� $ CprMask ��
" 4 GpValue ��R
� 8 _IMAGE_ROM_OPTIONAL_HEADER .?AU_IMAGE_ROM_OPTIONAL_HEADER@@ �� � � 7 �
bFamilyType ��
bSerifStyle ��
bWeight ��
bProportion ��
bContrast
bStrokeVariation �
bArmStyle
bLetterform ��
bMidline �
bXHeight �.
�
tagPANOSE .?AUtagPANOSE@@ � � � J � _SYSTEM_TPM_INFORMATION .?AU_SYSTEM_TPM_INFORMATION@@
" Flags J � _SYSTEM_TPM_INFORMATION .?AU_SYSTEM_TPM_INFORMATION@@ � � � R � _WMI_JOB_SET_QUERY_NET_RATE .?AU_WMI_JOB_SET_QUERY_NET_RATE@@ >
" Flags
# MaxBandwidth �
DscpTag ��R � _WMI_JOB_SET_QUERY_NET_RATE .?AU_WMI_JOB_SET_QUERY_NET_RATE@@ � c � > � _FILE_BASIC_INFO .?AU_FILE_BASIC_INFO@@ ��
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
" FileAttributes ���> � ( _FILE_BASIC_INFO .?AU_FILE_BASIC_INFO@@ �� � o q" ^ � _RTL_FEATURE_CONFIGURATION_UPDATE .?AU_RTL_FEATURE_CONFIGURATION_UPDATE@@ n FeatureEnabledStateDefault ��� FeatureEnabledStateDisabled �� FeatureEnabledStateEnabled ���N t � _RTL_FEATURE_ENABLED_STATE .?AW4_RTL_FEATURE_ENABLED_STATE@@ ��� � / � FeatureConfigurationOperationNone FeatureConfigurationOperationFeatureState FeatureConfigurationOperationVariantState FeatureConfigurationOperationResetState ��b t � _RTL_FEATURE_CONFIGURATION_OPERATION .?AW4_RTL_FEATURE_CONFIGURATION_OPERATION@@ ��� � ! �
u FeatureId
E Priority �
� EnabledState �
EnabledStateOptions ��
Variant ��
- Reserved �
VariantPayloadKind ���
u VariantPayload ���
� Operation ^ � _RTL_FEATURE_CONFIGURATION_UPDATE .?AU_RTL_FEATURE_CONFIGURATION_UPDATE@@ � W J � _FILE_COMPRESSION_INFO .?AU_FILE_COMPRESSION_INFO@@ ��
� CompressedFileSize ���
! CompressionFormat
CompressionUnitShift �
ChunkShift ���
ClusterShift �
-
Reserved �J � _FILE_COMPRESSION_INFO .?AU_FILE_COMPRESSION_INFO@@ �� � o �" N � _TRANSACTION_NOTIFICATION .?AU_TRANSACTION_NOTIFICATION@@ z
TransactionKey ���
" TransactionNotification ��
� TmVirtualClock ���
" ArgumentLength ���N � _TRANSACTION_NOTIFICATION .?AU_TRANSACTION_NOTIFICATION@@ � � �
�
N
j � _DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO .?AU_DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO@@ ��^ � DISPLAYCONFIG_DEVICE_INFO_HEADER .?AUDISPLAYCONFIG_DEVICE_INFO_HEADER@@ ��
u ��
u ��
u ��
u ��
u �� DISPLAYCONFIG_COLOR_ENCODING_RGB � DISPLAYCONFIG_COLOR_ENCODING_YCBCR444 DISPLAYCONFIG_COLOR_ENCODING_YCBCR422 DISPLAYCONFIG_COLOR_ENCODING_YCBCR420 DISPLAYCONFIG_COLOR_ENCODING_INTENSITY ��� ��DISPLAYCONFIG_COLOR_ENCODING_FORCE_UINT32 ���R t _DISPLAYCONFIG_COLOR_ENCODING .?AW4_DISPLAYCONFIG_COLOR_ENCODING@@ � � J �
header ���
advancedColorSupported ���
advancedColorEnabled �
wideColorEnforced
advancedColorForceDisabled ���
reserved �
u value
colorEncoding
u bitsPerColorChannel ��j
_DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO .?AU_DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO@@ �� � T
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
MicrosoftSignedOnly ��
StoreSignedOnly ��
MitigationOptIn ��
AuditMicrosoftSignedOnly �
AuditStoreSignedOnly �
ReservedFlags r _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY@@ ? � R � _HEAP_EVENT_COMMIT_DECOMMIT .?AU_HEAP_EVENT_COMMIT_DECOMMIT@@
N
HeapHandle ���
Block
# Size �
" Caller ���R _HEAP_EVENT_COMMIT_DECOMMIT .?AU_HEAP_EVENT_COMMIT_DECOMMIT@@ c '
�
V � _PERFINFO_PO_SESSION_CALLOUT .?AU_PERFINFO_PO_SESSION_CALLOUT@@ ��b
w SystemAction �
� MinSystemState ���
" Flags
" PowerStateTask ���V _PERFINFO_PO_SESSION_CALLOUT .?AU_PERFINFO_PO_SESSION_CALLOUT@@ �� c � �
# CommitLimitBytes �
# CommitLimitFailureCode ���
# MaxAllocationSizeBytes ���
# AllocationLimitFailureCode ���R ! _RTL_HEAP_MEMORY_LIMIT_DATA .?AU_RTL_HEAP_MEMORY_LIMIT_DATA@@ " b �
N � NOTIFY_USER_POWER_SETTING .?AUNOTIFY_USER_POWER_SETTING@@
$
Guid �N & NOTIFY_USER_POWER_SETTING .?AUNOTIFY_USER_POWER_SETTING@@ ' x � : � _nlsversioninfo .?AU_nlsversioninfo@@ �
" dwNLSVersionInfoSize �
" dwNLSVersion �
" dwDefinedVersion �
" dwEffectiveId
guidCustomVersion : * _nlsversioninfo .?AU_nlsversioninfo@@ + W � � � - b � _SYSTEM_SESSION_BIGPOOL_INFORMATION .?AU_SYSTEM_SESSION_BIGPOOL_INFORMATION@@
/ n " �Z
# NextEntryOffset ��
" SessionId
" Count
1 AllocatedInfo b 2 ( _SYSTEM_SESSION_BIGPOOL_INFORMATION .?AU_SYSTEM_SESSION_BIGPOOL_INFORMATION@@ 3 � �
~ ImagePolicyIdNone ImagePolicyIdEtw � ImagePolicyIdDebug ��� ImagePolicyIdCrashDump ��� ImagePolicyIdCrashDumpKey ImagePolicyIdCrashDumpKeyGuid ImagePolicyIdParentSd ImagePolicyIdParentSdRev � ImagePolicyIdSvn � ImagePolicyIdDeviceId
ImagePolicyIdCapability �� ImagePolicyIdScenarioId �� ImagePolicyIdMaximum �:
t 5 _IMAGE_POLICY_ID .?AW4_IMAGE_POLICY_ID@@ ��� 6 b ]& V � _KEY_WOW64_FLAGS_INFORMATION .?AU_KEY_WOW64_FLAGS_INFORMATION@@ ��
" UserFlags V 9 _KEY_WOW64_FLAGS_INFORMATION .?AU_KEY_WOW64_FLAGS_INFORMATION@@ �� : n � _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION@@ 0 " @ �
= Cycles ���n > @ _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION@@ ? � _ N � _FILE_ACCESS_INFORMATION .?AU_FILE_ACCESS_INFORMATION@@ ��
" AccessFlags ��N B _FILE_ACCESS_INFORMATION .?AU_FILE_ACCESS_INFORMATION@@ �� C � �
p ��
E R � _POWER_PLATFORM_INFORMATION .?AU_POWER_PLATFORM_INFORMATION@@
G
AoAc �R I _POWER_PLATFORM_INFORMATION .?AU_POWER_PLATFORM_INFORMATION@@ J x � R � _PROCESS_BASIC_INFORMATION .?AU_PROCESS_BASIC_INFORMATION@@ ��
ExitStatus ���
PebBaseAddress ���
# AffinityMask �
BasePriority �
# UniqueProcessId ��
# ( InheritedFromUniqueProcessId �R M 0 _PROCESS_BASIC_INFORMATION .?AU_PROCESS_BASIC_INFORMATION@@ �� N ? � R � _ETW_FINALIZE_KTIMER2_EVENT .?AU_ETW_FINALIZE_KTIMER2_EVENT@@
P N
# TimerKey �
# DisableCallback ��
# DisableContextKey R R _ETW_FINALIZE_KTIMER2_EVENT .?AU_ETW_FINALIZE_KTIMER2_EVENT@@ S c � B � tagENUMTEXTMETRICA .?AUtagENUMTEXTMETRICA@@ ��
U B � tagNEWTEXTMETRICEXA .?AUtagNEWTEXTMETRICEXA@@ :
W etmNewTextMetricEx ���
G ` etmAxesList ��B X �tagENUMTEXTMETRICA .?AUtagENUMTEXTMETRICA@@ �� Y � m
N � _SID_AND_ATTRIBUTES_HASH .?AU_SID_AND_ATTRIBUTES_HASH@@ ��
\
� # " �:
" SidCount �
^ SidAttr ��
_ Hash �N ` _SID_AND_ATTRIBUTES_HASH .?AU_SID_AND_ATTRIBUTES_HASH@@ �� a x X F � _TRACE_ENABLE_CONTEXT .?AU_TRACE_ENABLE_CONTEXT@@ V
! LoggerId �
Level
InternalFlag �
" EnableFlags ��F d _TRACE_ENABLE_CONTEXT .?AU_TRACE_ENABLE_CONTEXT@@ e � 7 N � _FILE_STAT_LX_INFORMATION .?AU_FILE_STAT_LX_INFORMATION@@
g �
� FileId ���
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( AllocationSize ���
� 0 EndOfFile
" 8 FileAttributes ���
" < ReparseTag ���
" @ NumberOfLinks
" D EffectiveAccess ��
" H LxFlags ��
" L LxUid
" P LxGid
" T LxMode ���
" X LxDeviceIdMajor ��
" \ LxDeviceIdMinor ��N i ` _FILE_STAT_LX_INFORMATION .?AU_FILE_STAT_LX_INFORMATION@@ j � b R � _SEC_WINNT_AUTH_IDENTITY_A .?AU_SEC_WINNT_AUTH_IDENTITY_A@@ ��
User �
" UserLength ���
Domain ���
" DomainLength �
Password �
" ( PasswordLength ���
" , Flags R m 0 _SEC_WINNT_AUTH_IDENTITY_A .?AU_SEC_WINNT_AUTH_IDENTITY_A@@ �� n _ � Z � _TRANSACTION_BASIC_INFORMATION .?AU_TRANSACTION_BASIC_INFORMATION@@ ��>
TransactionId
" State
" Outcome ��Z q _TRANSACTION_BASIC_INFORMATION .?AU_TRANSACTION_BASIC_INFORMATION@@ �� r � � > � _LDR_SECTION_INFO .?AU_LDR_SECTION_INFO@@ B � _OBJECT_ATTRIBUTES .?AU_OBJECT_ATTRIBUTES@@ ��
u �
SectionHandle
" DesiredAccess
v ObjA �
" SectionPageProtection
" AllocationAttributes �> w _LDR_SECTION_INFO .?AU_LDR_SECTION_INFO@@ x � � 6 � tagAXESLISTW .?AUtagAXESLISTW@@ �� � " � �J
" axlReserved ��
" axlNumAxes ���
{ axlAxisInfo ��6 | �tagAXESLISTW .?AUtagAXESLISTW@@ �� } � < ~ � _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION .?AU_SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION@@ ��
6
" FlagsToEnable
" FlagsToDisable ���~ � _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION .?AU_SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION@@ �� � � )
B � _CSV_CONTROL_PARAM .?AU_CSV_CONTROL_PARAM@@ ��
� > CsvControlStartRedirectFile �� CsvControlStopRedirectFile ��� CsvControlQueryRedirectState � CsvControlQueryFileRevision �� CsvControlQueryMdsPath ��� CsvControlQueryFileRevisionFileId128 �
CsvControlQueryVolumeRedirectState ���
CsvControlEnableUSNRangeModificationTracking � CsvControlMarkHandleLocalVolumeMount � CsvControlUnmarkHandleLocalVolumeMount ��� CsvControlGetCsvFsMdsPathV2 �� CsvControlDisableCaching � CsvControlEnableCaching �� CsvControlStartForceDFO �� CsvControlStopForceDFO ���6 t � _CSV_CONTROL_OP .?AW4_CSV_CONTROL_OP@@ � � � F *
� Operation
Unused ���B � _CSV_CONTROL_PARAM .?AU_CSV_CONTROL_PARAM@@ �� � � X Z � _PROCESS_HANDLE_TRACING_ENABLE .?AU_PROCESS_HANDLE_TRACING_ENABLE@@ ��
�
" Flags Z � _PROCESS_HANDLE_TRACING_ENABLE .?AU_PROCESS_HANDLE_TRACING_ENABLE@@ �� � ? > 2 � _numberfmtW .?AU_numberfmtW@@ �
u NumDigits
u LeadingZero ��
u Grouping �
q lpDecimalSep �
q lpThousandSep
u NegativeOrder 2 � ( _numberfmtW .?AU_numberfmtW@@ � W � b KHeteroCpuPolicyAll �� KHeteroCpuPolicyLarge KHeteroCpuPolicyLargeOrIdle �� KHeteroCpuPolicySmall KHeteroCpuPolicySmallOrIdle �� KHeteroCpuPolicyDynamic �� KHeteroCpuPolicyStaticMax KHeteroCpuPolicyBiasedSmall �� KHeteroCpuPolicyBiasedLarge �� KHeteroCpuPolicyDefault �� KHeteroCpuPolicyMax ��> t � _KHETERO_CPU_POLICY .?AW4_KHETERO_CPU_POLICY@@ � � w ~ B � _CSV_NAMESPACE_INFO .?AU_CSV_NAMESPACE_INFO@@
� b
" Version ��
" DeviceNumber �
� StartingOffset ���
" SectorSize ���B � _CSV_NAMESPACE_INFO .?AU_CSV_NAMESPACE_INFO@@ � � 6 6 � _LUTF8_STRING .?AU_LUTF8_STRING@@
� ��
� B
# Length ���
# MaximumLength
Buffer ���6 � _LUTF8_STRING .?AU_LUTF8_STRING@@ 2 onecore\internal\sdk\inc\minwin\ntdef_p.h �� � �
� B � tagEMRSETCOLORSPACE .?AUtagEMRSETCOLORSPACE@@ "
� emr ��
" ihCS �B � tagEMRSETCOLORSPACE .?AUtagEMRSETCOLORSPACE@@ � � � Z � _PLUGPLAY_CONTROL_PROPERTY_DATA .?AU_PLUGPLAY_CONTROL_PROPERTY_DATA@@
� b
DeviceInstance ���
" PropertyType �
Buffer ���
" BufferSize ���Z � ( _PLUGPLAY_CONTROL_PROPERTY_DATA .?AU_PLUGPLAY_CONTROL_PROPERTY_DATA@@ � % 8 > GroupAffinityAllGroupZero GroupAffinityDontCare : t � _IRQ_GROUP_POLICY .?AW4_IRQ_GROUP_POLICY@@ � � � ^ � _FILE_CASE_SENSITIVE_INFORMATION .?AU_FILE_CASE_SENSITIVE_INFORMATION@@ ��
�
" Flags ^ � _FILE_CASE_SENSITIVE_INFORMATION .?AU_FILE_CASE_SENSITIVE_INFORMATION@@ �� � � � N � _PERFINFO_DPC_INFORMATION .?AU_PERFINFO_DPC_INFORMATION@@ 2
# InitialTime ��
DpcRoutine ���N � _PERFINFO_DPC_INFORMATION .?AU_PERFINFO_DPC_INFORMATION@@ � c � > � _WIN32_STREAM_ID .?AU_WIN32_STREAM_ID@@ ��~
" dwStreamId ���
" dwStreamAttributes ���
� Size �
" dwStreamNameSize �
| cStreamName ��> � _WIN32_STREAM_ID .?AU_WIN32_STREAM_ID@@ �� � o � B � _TOKEN_AUDIT_POLICY .?AU_TOKEN_AUDIT_POLICY@@ " �
� PerUserPolicy B � _TOKEN_AUDIT_POLICY .?AU_TOKEN_AUDIT_POLICY@@ � x � 6 � _PSINJECTDATA .?AU_PSINJECTDATA@@ J
" DataBytes
! InjectionPoint ���
! PageNumber ���6 � _PSINJECTDATA .?AU_PSINJECTDATA@@ � � � N � _ETW_OBJECT_HANDLE_EVENT .?AU_ETW_OBJECT_HANDLE_EVENT@@ ��
� V
Object ���
" ProcessId
" Handle ���
! ObjectType ���N � _ETW_OBJECT_HANDLE_EVENT .?AU_ETW_OBJECT_HANDLE_EVENT@@ �� � c i
2 � value_entA .?AUvalue_entA@@ ��^
p ve_valuename �
" ve_valuelen ��
# ve_valueptr ��
" ve_type ��2 � value_entA .?AUvalue_entA@@ ��2 onecore\external\sdk\inc\minwin\winreg.h ��� � � � J � _SD_GLOBAL_CHANGE_INPUT .?AU_SD_GLOBAL_CHANGE_INPUT@@ V � _SD_CHANGE_MACHINE_SID_INPUT .?AU_SD_CHANGE_MACHINE_SID_INPUT@@ ��F � _SD_QUERY_STATS_INPUT .?AU_SD_QUERY_STATS_INPUT@@ j
" Flags
" ChangeType ���
� SdChange �
� SdQueryStats �
� SdEnumSds J � _SD_GLOBAL_CHANGE_INPUT .?AU_SD_GLOBAL_CHANGE_INPUT@@ � � m F � _VIRTUAL_STORAGE_TYPE .?AU_VIRTUAL_STORAGE_TYPE@@ *
" DeviceId �
VendorId �F � _VIRTUAL_STORAGE_TYPE .?AU_VIRTUAL_STORAGE_TYPE@@ � � 0 F � tagRAWINPUTDEVICELIST .?AUtagRAWINPUTDEVICELIST@@ *
hDevice ��
" dwType ���F � tagRAWINPUTDEVICELIST .?AUtagRAWINPUTDEVICELIST@@ � �; R � _RTL_IMAGE_POLICY_METADATA .?AU_RTL_IMAGE_POLICY_METADATA@@ ��
� J � _IMAGE_POLICY_METADATA .?AU_IMAGE_POLICY_METADATA@@ ��
� ��
� F
� PolicyMetadata ���
# LBound ���
# UBound ���R � _RTL_IMAGE_POLICY_METADATA .?AU_RTL_IMAGE_POLICY_METADATA@@ �� � b �& � FileStorageTierMediaTypeUnspecified �� FileStorageTierMediaTypeDisk � FileStorageTierMediaTypeSsd �� FileStorageTierMediaTypeScm �� FileStorageTierMediaTypeMax ��R t � _FILE_STORAGE_TIER_MEDIA_TYPE .?AW4_FILE_STORAGE_TIER_MEDIA_TYPE@@ � � � � ^ � _PROCESS_TELEMETRY_ID_INFORMATION .?AU_PROCESS_TELEMETRY_ID_INFORMATION@@ �
" HeaderSize ���
" ProcessId
# ProcessStartKey ��
# CreateTime ���
# CreateInterruptTime ��
# CreateUnbiasedInterruptTime ��
# ( ProcessSequenceNumber
# 0 SessionCreateTime
" 8 SessionId
" < BootId ���
" @ ImageChecksum
" D ImageTimeDateStamp ���
" H UserSidOffset
" L ImagePathOffset ��
" P PackageNameOffset
" T RelativeAppNameOffset
" X CommandLineOffset ^ � ` _PROCESS_TELEMETRY_ID_INFORMATION .?AU_PROCESS_TELEMETRY_ID_INFORMATION@@ � � k 6 � _FILEMUIINFO .?AU_FILEMUIINFO@@ �� " � " �Z
" dwSize ���
" dwVersion
" dwFileType ���
� pChecksum
� pServiceChecksum �
" , dwLanguageNameOffset �
" 0 dwTypeIDMainSize �
" 4 dwTypeIDMainOffset ���
" 8 dwTypeNameMainOffset �
" < dwTypeIDMUISize ��
" @ dwTypeIDMUIOffset
" D dwTypeNameMUIOffset ��
� H abBuffer �6
� P _FILEMUIINFO .?AU_FILEMUIINFO@@ �� � W � v � _ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION .?AU_ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION@@ * � _LBLOB .?AU_LBLOB@@ ��B
# Length ���
# MaximumLength
Buffer ���* � _LBLOB .?AU_LBLOB@@ �� � � / " " " � � v � _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT@@
" ��
" ��>
� Enabled ��
� Reserved �
" AsULONG ��v � _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT@@ � �
Z � _WIM_PROVIDER_INTEGRITY_STATUS .?AU_WIM_PROVIDER_INTEGRITY_STATUS@@ ��v
IntegrityComplete
IntegrityRunning �
# IntegrityAvailable ���
# IntegrityRequired Z _WIM_PROVIDER_INTEGRITY_STATUS .?AU_WIM_PROVIDER_INTEGRITY_STATUS@@ �� � V" j � _PLUGPLAY_CONTROL_TARGET_RELATION_DATA .?AU_PLUGPLAY_CONTROL_TARGET_RELATION_DATA@@ ��j
UserFileHandle ���
Status ���
" DeviceInstanceLen
q DeviceInstance ���j _PLUGPLAY_CONTROL_TARGET_RELATION_DATA .?AU_PLUGPLAY_CONTROL_TARGET_RELATION_DATA@@ �� % � V � _TXFS_TRANSACTION_ACTIVE_INFO .?AU_TXFS_TRANSACTION_ACTIVE_INFO@@ *
TransactionsActiveAtSnapshot �V
_TXFS_TRANSACTION_ACTIVE_INFO .?AU_TXFS_TRANSACTION_ACTIVE_INFO@@ � & � � _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION@@ ��j � _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE@@
Z
! NumberOfRanges ���
! Reserved �
" Reserved2
Ranges ��� _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION@@ �� ? � V � _TRACE_ENABLE_FLAG_EXTENSION .?AU_TRACE_ENABLE_FLAG_EXTENSION@@ ��
:
! Offset ���
Length ���
Flag �V _TRACE_ENABLE_FLAG_EXTENSION .?AU_TRACE_ENABLE_FLAG_EXTENSION@@ �� c F � _HEAP_SUBSEGMENT_INIT .?AU_HEAP_SUBSEGMENT_INIT@@
�
j Header ���
HeapHandle ���
( SubSegment ���
# 0 BlockSize
# 8 BlockCount ���
" @ AffinityIndex F D _HEAP_SUBSEGMENT_INIT .?AU_HEAP_SUBSEGMENT_INIT@@ c W f FirmwareTypeUnknown �� FirmwareTypeBios � FirmwareTypeUefi � FirmwareTypeMax ��6 t _FIRMWARE_TYPE .?AW4_FIRMWARE_TYPE@@ ��� � @ J � _TRANSACTION_LIST_ENTRY .?AU_TRANSACTION_LIST_ENTRY@@
UOW ��J " _TRANSACTION_LIST_ENTRY .?AU_TRANSACTION_LIST_ENTRY@@ # � i b � _TRACE_PERIODIC_CAPTURE_STATE_INFO .?AU_TRACE_PERIODIC_CAPTURE_STATE_INFO@@ ��
% Z
" CaptureStateFrequencyInSeconds ���
! ProviderCount
! Reserved �b ' _TRACE_PERIODIC_CAPTURE_STATE_INFO .?AU_TRACE_PERIODIC_CAPTURE_STATE_INFO@@ �� ( � �
E R � _REQUEST_RAW_ENCRYPTED_DATA .?AU_REQUEST_RAW_ENCRYPTED_DATA@@ .
FileOffset ���
" Length ���R , _REQUEST_RAW_ENCRYPTED_DATA .?AU_REQUEST_RAW_ENCRYPTED_DATA@@ - � N � _FILE_FS_SIZE_INFORMATION .?AU_FILE_FS_SIZE_INFORMATION@@ �
� TotalAllocationUnits �
� AvailableAllocationUnits �
" SectorsPerAllocationUnit �
" BytesPerSector ���N 0 _FILE_FS_SIZE_INFORMATION .?AU_FILE_FS_SIZE_INFORMATION@@ 1 � F � RPC_IMPORT_CONTEXT_P .?AURPC_IMPORT_CONTEXT_P@@ ��B � _RPC_BINDING_VECTOR .?AU_RPC_BINDING_VECTOR@@
4 J
LookupContext
ProposedHandle ���
5 Bindings �F 6 RPC_IMPORT_CONTEXT_P .?AURPC_IMPORT_CONTEXT_P@@ ��* onecore\external\sdk\inc\rpcnsip.h � 7 8 ! j � _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA@@
: ^
DeviceInstance ���
S Operation
" BufferLength �
q Buffer ���j < _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA@@ = % � r � _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION .?AU_MEMORY_PARTITION_PAGE_COMBINE_INFORMATION@@ ��J
StopHandle ���
" Flags
# TotalNumberOfPages ���r @ _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION .?AU_MEMORY_PARTITION_PAGE_COMBINE_INFORMATION@@ �� A t � > � tagWNODE_ALL_DATA .?AUtagWNODE_ALL_DATA@@ R � OFFSETINSTANCEDATAANDLENGTH .?AUOFFSETINSTANCEDATAANDLENGTH@@ D " �
� WnodeHeader ��
" 0 DataBlockOffset ��
" 4 InstanceCount
" 8 OffsetInstanceNameOffsets
" < FixedInstanceSize
E < OffsetInstanceDataAndLength ��> F H tagWNODE_ALL_DATA .?AUtagWNODE_ALL_DATA@@ G � � n � _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT@@ ��J
" ExtentCount ��
" TotalExtentCount �
� Extents ��n J _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT@@ �� K � �* � SharedVirtualDiskHandleStateNone � SharedVirtualDiskHandleStateFileShared ��� SharedVirtualDiskHandleStateHandleShared �R t M _SharedVirtualDiskHandleState .?AW4_SharedVirtualDiskHandleState@@ � N � �' : � _NDR_EXPR_DESC .?AU_NDR_EXPR_DESC@@ ��
3 .
6 pOffset ��
Q pFormatExpr ��: R _NDR_EXPR_DESC .?AU_NDR_EXPR_DESC@@ �� S � � V � _RTL_WORK_ON_BEHALF_TICKET_EX .?AU_RTL_WORK_ON_BEHALF_TICKET_EX@@
U
" ��
" ��f
c Ticket ���
" Flags
W CurrentThread
X Reserved1
" Reserved2 V Y _RTL_WORK_ON_BEHALF_TICKET_EX .?AU_RTL_WORK_ON_BEHALF_TICKET_EX@@ Z � SysDbgQueryModuleInformation � SysDbgQueryTraceInformation �� SysDbgSetTracepoint �� SysDbgSetSpecialCall � SysDbgClearSpecialCalls �� SysDbgQuerySpecialCalls �� SysDbgBreakPoint � SysDbgQueryVersion ��� SysDbgReadVirtual SysDbgWriteVirtual ���
SysDbgReadPhysical ��� SysDbgWritePhysical �� SysDbgReadControlSpace ���
SysDbgWriteControlSpace �� SysDbgReadIoSpace SysDbgWriteIoSpace ��� SysDbgReadMsr SysDbgWriteMsr ��� SysDbgReadBusData SysDbgWriteBusData ��� SysDbgCheckLowMemory � SysDbgEnableKernelDebugger ��� SysDbgDisableKernelDebugger �� SysDbgGetAutoKdEnable SysDbgSetAutoKdEnable SysDbgGetPrintBufferSize � SysDbgSetPrintBufferSize � SysDbgGetKdUmExceptionEnable � SysDbgSetKdUmExceptionEnable � SysDbgGetTriageDump �� SysDbgGetKdBlockEnable ��� SysDbgSetKdBlockEnable ��� SysDbgRegisterForUmBreakInfo � ! SysDbgGetUmBreakPid �� " SysDbgClearUmBreakPid # SysDbgGetUmAttachPid � $ SysDbgClearUmAttachPid ��� % SysDbgGetLiveKernelDump �� & SysDbgKdPullRemoteFile ���6 ' t \ _SYSDBG_COMMAND .?AW4_SYSDBG_COMMAND@@ � ] � � N � _ALPC_WORK_ON_BEHALF_ATTR .?AU_ALPC_WORK_ON_BEHALF_ATTR@@
c Ticket ���N ` _ALPC_WORK_ON_BEHALF_ATTR .?AU_ALPC_WORK_ON_BEHALF_ATTR@@ a � q
�
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
, tmFirstChar ��
- tmLastChar ���
. tmDefaultChar
/ tmBreakChar ��
0 tmItalic �
1 tmUnderlined �
2 tmStruckOut ��
3 tmPitchAndFamily �
4 tmCharSet : e 8 tagTEXTMETRICA .?AUtagTEXTMETRICA@@ �� f � � Z � _CM_PARTIAL_RESOURCE_DESCRIPTOR .?AU_CM_PARTIAL_RESOURCE_DESCRIPTOR@@
h &
� Start
" Length ���: j <anonymous-tag> .?AU<anonymous-tag>@@ k � &
� Start
" Length ���: m <anonymous-tag> .?AU<anonymous-tag>@@ n � :
" Level
" Vector ���
# Affinity �: p <anonymous-tag> .?AU<anonymous-tag>@@ q � V
! Reserved �
! MessageCount �
" Vector ���
# Affinity �: s <anonymous-tag> .?AU<anonymous-tag>@@ t � :
" Level
" Vector ���
# Affinity �: v <anonymous-tag> .?AU<anonymous-tag>@@ w � *
t Raw ��
w Translated ���: y <anonymous-tag> .?AU<anonymous-tag>@@ z � &
� Start
" Length ���: | <anonymous-tag> .?AU<anonymous-tag>@@ } � :
" Channel ��
" Port �
" Reserved1 : <anonymous-tag> .?AU<anonymous-tag>@@ � � �
" Channel ��
" RequestLine ��
TransferWidth
Reserved1
Reserved2
Reserved3 : � <anonymous-tag> .?AU<anonymous-tag>@@ �
� Data �: � <anonymous-tag> .?AU<anonymous-tag>@@ � :
" Start
" Length ���
" Reserved �: � <anonymous-tag> .?AU<anonymous-tag>@@ � >
" DataSize �
" Reserved1
" Reserved2 : � <anonymous-tag> .?AU<anonymous-tag>@@ � $ &
� Start
" Length40 �: � <anonymous-tag> .?AU<anonymous-tag>@@ � , &
� Start
" Length48 �: � <anonymous-tag> .?AU<anonymous-tag>@@ � 1 &
� Start
" Length64 �: � <anonymous-tag> .?AU<anonymous-tag>@@ � 6 v
Class
Type �
Reserved1
Reserved2
" IdLowPart
" IdHighPart ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � ; *
k Generic ��
n Port �
q Interrupt
z MessageInterrupt �
} Memory ���
� Dma ��
� DmaV3
� DevicePrivate
� BusNumber
� DeviceSpecificData ���
� Memory40 �
� Memory48 �
� Memory64 �
� Connection ���2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � J
Type �
ShareDisposition �
! Flags
� u Z � _CM_PARTIAL_RESOURCE_DESCRIPTOR .?AU_CM_PARTIAL_RESOURCE_DESCRIPTOR@@ � � Z � _MEMORY_COMBINE_INFORMATION_EX .?AU_MEMORY_COMBINE_INFORMATION_EX@@ ��
� >
Handle ���
# PagesCombined
" Flags Z � _MEMORY_COMBINE_INFORMATION_EX .?AU_MEMORY_COMBINE_INFORMATION_EX@@ �� � � � B � _ENERGY_STATE_DURATION .?AT_ENERGY_STATE_DURATION@@ ��
" ��
" ��V
# Value
" LastChangeTime ���
� Duration �
� IsInState B � _ENERGY_STATE_DURATION .?AT_ENERGY_STATE_DURATION@@ �� � � � B � _IMAGE_THUNK_DATA64 .?AU_IMAGE_THUNK_DATA64@@
� ^
# ForwarderString ��
# Function �
# Ordinal ��
# AddressOfData 2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � �
� u1 ���B � _IMAGE_THUNK_DATA64 .?AU_IMAGE_THUNK_DATA64@@ � � � > � tagMULTIKEYHELPA .?AUtagMULTIKEYHELPA@@ ��
� B
" mkSize ���
p mkKeylist
szKeyphrase ��> � tagMULTIKEYHELPA .?AUtagMULTIKEYHELPA@@ �� � �/
I J
axMinValue ���
axMaxValue ���
� axAxisName ���6 � tagAXISINFOA .?AUtagAXISINFOA@@ �� � � � B � _KCONTINUE_ARGUMENT .?AU_KCONTINUE_ARGUMENT@@ z KCONTINUE_UNWIND � KCONTINUE_RESUME � KCONTINUE_LONGJUMP ��� KCONTINUE_SET KCONTINUE_LAST ���6 t � _KCONTINUE_TYPE .?AW4_KCONTINUE_TYPE@@ � � � � F
� ContinueType �
" ContinueFlags
� Reserved �B � _KCONTINUE_ARGUMENT .?AU_KCONTINUE_ARGUMENT@@ � �
/ j � _SYSTEM_PROCESSOR_FEATURES_INFORMATION .?AU_SYSTEM_PROCESSOR_FEATURES_INFORMATION@@ �� # " �6
# ProcessorFeatureBits �
� Reserved �j � _SYSTEM_PROCESSOR_FEATURES_INFORMATION .?AU_SYSTEM_PROCESSOR_FEATURES_INFORMATION@@ �� � � < V � _SERVERSILO_INIT_INFORMATION .?AU_SERVERSILO_INIT_INFORMATION@@ ��
� :
DeleteEvent ��
IsDownlevelContainer �V � _SERVERSILO_INIT_INFORMATION .?AU_SERVERSILO_INIT_INFORMATION@@ �� � ? � ^ � _PERFINFO_DPC_ENQUEUE_INFORMATION .?AU_PERFINFO_DPC_ENQUEUE_INFORMATION@@ �
# Key ��
DpcQueueDepth
" DpcCount �
" TargetProcessorIndex �
Importance ���
- Reserved �^ � _PERFINFO_DPC_ENQUEUE_INFORMATION .?AU_PERFINFO_DPC_ENQUEUE_INFORMATION@@ � c � V � _ETW_HEAP_EVENT_RUNDOWN_RANGE .?AU_ETW_HEAP_EVENT_RUNDOWN_RANGE@@ &
Address ��
# Size �V � _ETW_HEAP_EVENT_RUNDOWN_RANGE .?AU_ETW_HEAP_EVENT_RUNDOWN_RANGE@@ � c �
v : � _RTL_HEAP_ENTRY .?AU_RTL_HEAP_ENTRY@@
� &
# Settable �
" Tag ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � � 2
# CommittedSize
FirstBlock ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � "
� s1 ���
� s2 ���2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � R
# Size �
! Flags
!
AllocatorBackTraceIndex ��
� u : � _RTL_HEAP_ENTRY .?AU_RTL_HEAP_ENTRY@@ � �
B SystemNetRateControlSet �� SystemNetRateControlQuota R t � _SYSTEM_NET_RATE_CONTROL_TYPE .?AW4_SYSTEM_NET_RATE_CONTROL_TYPE@@ � � � �
" N � _TEB_ACTIVE_FRAME_CONTEXT .?AU_TEB_ACTIVE_FRAME_CONTEXT@@
� ��
� :
" Flags
� Previous �
� Context ��> � _TEB_ACTIVE_FRAME .?AU_TEB_ACTIVE_FRAME@@ � 7 �
� ��
� N � _ETW_WNF_EVENT_SUBSCRIBE .?AU_ETW_WNF_EVENT_SUBSCRIBE@@ ��
j Header ���
� StateName
( Subscription �
0 NameSub ��
8 Callback �
" @ RefCount �
" D DeliveryFlags N � H _ETW_WNF_EVENT_SUBSCRIBE .?AU_ETW_WNF_EVENT_SUBSCRIBE@@ �� � c _ : � _MIDL_STUB_DESC .?AU_MIDL_STUB_DESC@@
# �
�
J � __GENERIC_BINDING_INFO .?AU__GENERIC_BINDING_INFO@@ ��
� V
� pAutoHandle ��
� pPrimitiveHandle �
� pGenericBindingInfo ��2 � <anonymous-tag> .?AT<anonymous-tag>@@ � �
�
� ��
B � _MIDL_STUB_MESSAGE .?AU_MIDL_STUB_MESSAGE@@ ��
J � _XMIT_ROUTINE_QUINTUPLE .?AU_XMIT_ROUTINE_QUINTUPLE@@
��
B � _MALLOC_FREE_STRUCT .?AU_MALLOC_FREE_STRUCT@@
B � _COMM_FAULT_OFFSETS .?AU_COMM_FAULT_OFFSETS@@
��
N ��
�
> � _NDR_CS_ROUTINES .?AU_NDR_CS_ROUTINES@@ ��
��
P ��
&
RpcInterfaceInformation ��
� pfnAllocate ��
� pfnFree ��
� IMPLICIT_HANDLE_INFO �
apfnNdrRundownRoutines ���
( aGenericBindingRoutinePairs ��
0 apfnExprEval �
8 aXmitQuintuple ���
4 @ pFormatTypes �
t H fCheckBounds �
" L Version ��
P pMallocFreeStruct
X MIDLVersion ��
` CommFaultOffsets �
h aUserMarshalQuadruple
p NotifyRoutineTable ���
# x mFlags ���
� CsRoutineTables ��
� ProxyServerInfo ��
� pExprInfo : � _MIDL_STUB_DESC .?AU_MIDL_STUB_DESC@@ � � � TransactionBasicInformation �� TransactionPropertiesInformation � TransactionEnlistmentInformation � TransactionSuperiorEnlistmentInformation � TransactionBindInformation ��� TransactionDTCPrivateInformation �V t _TRANSACTION_INFORMATION_CLASS .?AW4_TRANSACTION_INFORMATION_CLASS@@ ��� � , � WdInfoTimeoutValue ��� WdInfoResetTimer � WdInfoStopTimer �� WdInfoStartTimer � WdInfoTriggerAction �� WdInfoState �� WdInfoTriggerReset ��� WdInfoNop WdInfoGeneratedLastReset � WdInfoInvalid N
t " _WATCHDOG_INFORMATION_CLASS .?AW4_WATCHDOG_INFORMATION_CLASS@@ � # � @
" ��
" ��N
" Flags
% DisableExtensionPoints ���
& ReservedFlags � ' _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ �� ( ? n J � _FILE_LINKS_INFORMATION .?AU_FILE_LINKS_INFORMATION@@ V � _FILE_LINK_ENTRY_INFORMATION .?AU_FILE_LINK_ENTRY_INFORMATION@@ ��F
" BytesNeeded ��
" EntriesReturned ��
+ Entry J , _FILE_LINKS_INFORMATION .?AU_FILE_LINKS_INFORMATION@@ - � �
$ �
ExitStatus ���
u Pad1 �
# PebBaseAddress ���
# AffinityMask �
BasePriority �
u Pad2 �
# UniqueProcessId ��
# ( InheritedFromUniqueProcessId �V 0 0 _PROCESS_BASIC_INFORMATION64 .?AU_PROCESS_BASIC_INFORMATION64@@ �� 1 � � > � _SYSTEM_AUDIT_ACE .?AU_SYSTEM_AUDIT_ACE@@ :
� Header ���
" Mask �
" SidStart �> 4 _SYSTEM_AUDIT_ACE .?AU_SYSTEM_AUDIT_ACE@@ 5 x � 6 � tagBITMAPINFO .?AUtagBITMAPINFO@@ 2 � tagRGBQUAD .?AUtagRGBQUAD@@ �� 8 " �*
� bmiHeader
9 ( bmiColors 6 : , tagBITMAPINFO .?AUtagBITMAPINFO@@ ; � � Z LocationTypeRegistry � LocationTypeFileSystem ��� LocationTypeMaximum ��B t = _STATE_LOCATION_TYPE .?AW4_STATE_LOCATION_TYPE@@ ��� > b ($ � EtwNotificationTypeNoReply ��� EtwNotificationTypeLegacyEnable �� EtwNotificationTypeEnable EtwNotificationTypePrivateLogger � EtwNotificationTypePerflib ��� EtwNotificationTypeAudio � EtwNotificationTypeSession ��� EtwNotificationTypeReserved �� EtwNotificationTypeCredentialUI ��
EtwNotificationTypeInProcSession � EtwNotificationTypeFilteredPrivateLogger � EtwNotificationTypeMax ���F t @ _ETW_NOTIFICATION_TYPE .?AW4_ETW_NOTIFICATION_TYPE@@ ��� A A * V � _SYSTEM_PROCESSOR_INFORMATION .?AU_SYSTEM_PROCESSOR_INFORMATION@@ �
! ProcessorArchitecture
! ProcessorLevel ���
! ProcessorRevision
! MaximumProcessors
" ProcessorFeatureBits �V D _SYSTEM_PROCESSOR_INFORMATION .?AU_SYSTEM_PROCESSOR_INFORMATION@@ E � �
V � _JOBOBJECT_ENERGY_TRACKING_STATE .?AT_JOBOBJECT_ENERGY_TRACKING_STATE@@ ��B
# Value
" UpdateMask ���
" DesiredState �V I _JOBOBJECT_ENERGY_TRACKING_STATE .?AT_JOBOBJECT_ENERGY_TRACKING_STATE@@ �� J � G f � _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1@@
L f
� pInt64 ���
� pUint64 ��
� ppString �
� pFqbn
� pOctetString �2 N <anonymous-tag> .?AT<anonymous-tag>@@ O � v
" Name �
! ValueType
! Reserved �
" Flags
" ValueCount ���
O Values ���f Q _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1@@ R � � b � _PERFINFO_FILENAME_SAME_INFORMATION .?AU_PERFINFO_FILENAME_SAME_INFORMATION@@
T *
OldFile ��
NewFile ��b V _PERFINFO_FILENAME_SAME_INFORMATION .?AU_PERFINFO_FILENAME_SAME_INFORMATION@@ W c g j � _MEMORY_PARTITION_NODE_PAGE_INFORMATION .?AU_MEMORY_PARTITION_NODE_PAGE_INFORMATION@@
# TotalPageCount ���
# SmallFreePageCount ���
# SmallZeroPageCount ���
# MediumFreePageCount ��
# MediumZeroPageCount ��
# ( LargeFreePageCount ���
# 0 LargeZeroPageCount ���
# 8 HugeFreePageCount
# @ HugeZeroPageCount j Z H _MEMORY_PARTITION_NODE_PAGE_INFORMATION .?AU_MEMORY_PARTITION_NODE_PAGE_INFORMATION@@ [ t �
J
� v � _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT@@ ��*
TmIdentity ���
" Flags v ` _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT@@ �� a � � 6 � _PORT_MESSAGE .?AU_PORT_MESSAGE@@
c 2
DataLength ���
TotalLength ��: e <anonymous-tag> .?AU<anonymous-tag>@@ f � < &
f s1 ���
" Length ���2 h <anonymous-tag> .?AT<anonymous-tag>@@ i � ; .
Type �
DataInfoOffset ���: k <anonymous-tag> .?AU<anonymous-tag>@@ l � C &
l s2 ���
" ZeroInit �2 n <anonymous-tag> .?AT<anonymous-tag>@@ o � B �
i u1 ���
o u2 ���
ClientId �
A DoNotUseThisField
" MessageId
# ClientViewSize ���
" CallbackId ���6 q ( _PORT_MESSAGE .?AU_PORT_MESSAGE@@ r � : f � _PERFINFO_CLOCK_INTERRUPT_INFORMATION .?AU_PERFINFO_CLOCK_INTERRUPT_INFORMATION@@ *
# InterruptTime
Flags f u _PERFINFO_CLOCK_INTERRUPT_INFORMATION .?AU_PERFINFO_CLOCK_INTERRUPT_INFORMATION@@ v c � > � tagMOUSEMOVEPOINT .?AUtagMOUSEMOVEPOINT@@ B
t x
t y
" time �
# dwExtraInfo ��> y tagMOUSEMOVEPOINT .?AUtagMOUSEMOVEPOINT@@ z 2
� v � _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION@@ ��
" ��
" ��B
State
� Reserved �
" AllInformation ���v � _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION@@ �� � t � f � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION@@ ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��J
BootIdentifier ���
FirmwareType �
# BootFlags
� DbgMenuOsSelection ���
� DbgHiberBoot �
� DbgSoftBoot ��
� DbgMeasuredLaunch
� DbgMeasuredLaunchCapable �
� DbgSystemHiveReplace �
� DbgMeasuredLaunchSmmProtections ��
� DbgMeasuredLaunchSmmLevel f � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION@@ �� � �
Z � _DEDUP_CHUNK_INFORMATION_HASH32 .?AU_DEDUP_CHUNK_INFORMATION_HASH32@@ ^
" ChunkFlags ���
ChunkOffsetInFile
ChunkSize
� HashVal ��Z � 8 _DEDUP_CHUNK_INFORMATION_HASH32 .?AU_DEDUP_CHUNK_INFORMATION_HASH32@@ � � Z � _SYSTEM_SYSTEM_DISK_INFORMATION .?AU_SYSTEM_SYSTEM_DISK_INFORMATION@@
SystemDisk ���Z � _SYSTEM_SYSTEM_DISK_INFORMATION .?AU_SYSTEM_SYSTEM_DISK_INFORMATION@@ � � ]
r � _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION@@ ��2
" ProcessorCount ���
� Offsets ��r � _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION@@ �� � � Z � _PERFINFO_INTERRUPT_INFORMATION .?AU_PERFINFO_INTERRUPT_INFORMATION@@
� v
# InitialTime ��
ServiceRoutine ���
ReturnValue ��
! Vector ���
Reserved �Z � _PERFINFO_INTERRUPT_INFORMATION .?AU_PERFINFO_INTERRUPT_INFORMATION@@ � c � : � tagHANDLETABLE .?AUtagHANDLETABLE@@ �� " �
� objectHandle �: � tagHANDLETABLE .?AUtagHANDLETABLE@@ �� � � � t � J � tagCOLORCORRECTPALETTE .?AUtagCOLORCORRECTPALETTE@@ ��j
� emr ��
" ihPalette
" nFirstEntry ��
" nPalEntries ��
" nReserved J � tagCOLORCORRECTPALETTE .?AUtagCOLORCORRECTPALETTE@@ �� � � � � AlpcBasicInformation � AlpcPortInformation �� AlpcAssociateCompletionPortInformation ��� AlpcConnectedSIDInformation �� AlpcServerInformation AlpcMessageZoneInformation ��� AlpcRegisterCompletionListInformation AlpcUnregisterCompletionListInformation �� AlpcAdjustCompletionListConcurrencyCountInformation �� AlpcRegisterCallbackInformation ��
AlpcCompletionListRundownInformation � AlpcWaitForPortReferences AlpcServerSessionInformation �R
t � _ALPC_PORT_INFORMATION_CLASS .?AW4_ALPC_PORT_INFORMATION_CLASS@@ ��� � � Z � _PERFINFO_PPM_IDLE_EXIT_LATENCY .?AU_PERFINFO_PPM_IDLE_EXIT_LATENCY@@ v
" Flags
" PlatformState
" ProcessorState ���
" ReturnLatency
" TotalLatency �Z � _PERFINFO_PPM_IDLE_EXIT_LATENCY .?AU_PERFINFO_PPM_IDLE_EXIT_LATENCY@@ � c G B MarshalDirectionMarshal �� MarshalDirectionUnmarshal b t � _LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION .?AW4_LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION@@ � � 7 � B � tagEMRPOLYPOLYLINE .?AUtagEMRPOLYPOLYLINE@@ ��
� r
� emr ��
d rclBounds
" nPolys ���
" cptl �
z aPolyCounts ��
� $ aptl �B � , tagEMRPOLYPOLYLINE .?AUtagEMRPOLYPOLYLINE@@ �� � � c � � _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION .?AU_SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION@@ ��
� ~
" ExtentCount ��
" ValidStructureSize ���
" NextExtentIndex ��
" ExtentRestart
" CycleCount ���
" TimeoutCount �
# CycleTime
# CycleTimeMax �
# ( ExtentTime ���
" 0 ExtentTimeIndex ��
" 4 ExtentTimeMaxIndex ���
# 8 ExtentTimeMax
# @ HyperFlushTimeMax
# H TranslateVaTimeMax ���
# P DebugExemptionCount ��
# X TbHitCount ���
# ` TbMissCount ��
# h VinaPendingYield �
# p HashCycles ���
" x HistogramOffset ��
" | HistogramBuckets �
" � HistogramShift ���
" � Reserved1
# � PageNotPresentCount �� � � _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION .?AU_SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION@@ �� � � �
& � MemoryCaptureAccessedBits MemoryCaptureAndResetAccessedBits MemoryEmptyWorkingSets ��� MemoryFlushModifiedList �� MemoryPurgeStandbyList ��� MemoryPurgeLowPriorityStandbyList MemoryCommandMax �N t � _SYSTEM_MEMORY_LIST_COMMAND .?AW4_SYSTEM_MEMORY_LIST_COMMAND@@ � � � � R � _SYSTEM_VA_LIST_INFORMATION .?AU_SYSTEM_VA_LIST_INFORMATION@@ j
# VirtualSize ��
# VirtualPeak ��
# VirtualLimit �
# AllocationFailures ���R � _SYSTEM_VA_LIST_INFORMATION .?AU_SYSTEM_VA_LIST_INFORMATION@@ � � �
N � PROCESSOR_IDLESTATE_INFO .?AUPROCESSOR_IDLESTATE_INFO@@ ��Z
" TimeCheck
DemotePercent
PromotePercent ���
� Spare N � PROCESSOR_IDLESTATE_INFO .?AUPROCESSOR_IDLESTATE_INFO@@ �� � x 3 > � _LUNICODE_STRING .?AU_LUNICODE_STRING@@ ��
� B
# Length ���
# MaximumLength
q Buffer ���> � _LUNICODE_STRING .?AU_LUNICODE_STRING@@ �� � �
F � _SERVICE_TRIGGER_INFO .?AU_SERVICE_TRIGGER_INFO@@ > � _SERVICE_TRIGGER .?AU_SERVICE_TRIGGER@@ ��
� >
" cTriggers
� pTriggers
pReserved F � _SERVICE_TRIGGER_INFO .?AU_SERVICE_TRIGGER_INFO@@ � � � J � _KEY_TRUST_INFORMATION .?AU_KEY_TRUST_INFORMATION@@ ��
" ��
" ��.
� TrustedKey ���
� Reserved �J � _KEY_TRUST_INFORMATION .?AU_KEY_TRUST_INFORMATION@@ �� � ~ > � _FILE_REGION_INFO .?AU_FILE_REGION_INFO@@
� R
FileOffset ���
Length ���
" Usage
" Reserved �> � _FILE_REGION_INFO .?AU_FILE_REGION_INFO@@ � � i
t t � Z � _IMAGE_DYNAMIC_RELOCATION32_V2 .?AU_IMAGE_DYNAMIC_RELOCATION32_V2@@ ��n
" HeaderSize ���
" FixupInfoSize
" Symbol ���
" SymbolGroup ��
" Flags Z � _IMAGE_DYNAMIC_RELOCATION32_V2 .?AU_IMAGE_DYNAMIC_RELOCATION32_V2@@ �� � � � � � RtlResTypePhysicalMemoryTier � RtlResTypeDiskSpaceTier �� RtlResTypeDiskSpeedTier �� RtlResTypeDiskWriteConstraintTier RtlResTypeMax F t � _RTL_RESOURCE_CATEGORY .?AW4_RTL_RESOURCE_CATEGORY@@ ��� � ;
^ � Z � _IO_RESOURCE_REQUIREMENTS_LIST .?AU_IO_RESOURCE_REQUIREMENTS_LIST@@ ��b ��InterfaceTypeUndefined �� Internal � Isa �� Eisa � MicroChannel � TurboChannel � PCIBus ��� VMEBus ��� NuBus PCMCIABus CBus �
MPIBus ��� MPSABus �� ProcessorInternal
InternalPowerBus � PNPISABus PNPBus ��� Vmcs � ACPIBus �� MaximumInterfaceType �6 t � _INTERFACE_TYPE .?AW4_INTERFACE_TYPE@@ � � � �+ > � _IO_RESOURCE_LIST .?AU_IO_RESOURCE_LIST@@ � " ( �
" ListSize �
� InterfaceType
" BusNumber
" SlotNumber ���
� Reserved �
" AlternativeLists �
� List �Z � H _IO_RESOURCE_REQUIREMENTS_LIST .?AU_IO_RESOURCE_REQUIREMENTS_LIST@@ �� � j � _SYSTEM_SPECULATION_CONTROL_INFORMATION .?AU_SYSTEM_SPECULATION_CONTROL_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
� BpbEnabled ���
� BpbDisabledSystemPolicy ��
� BpbDisabledNoHardwareSupport �
� SpecCtrlEnumerated ���
� SpecCmdEnumerated
� IbrsPresent ��
� StibpPresent �
� SmepPresent ��
SpeculativeStoreBypassDisableAvailable ���
SpeculativeStoreBypassDisableSupported ���
SpeculativeStoreBypassDisabledSystemWide �
SpeculativeStoreBypassDisabledKernel �
SpeculativeStoreBypassDisableRequired
BpbDisabledKernelToUser ��
SpecCtrlRetpolineEnabled �
SpecCtrlImportOptimizationEnabled
EnhancedIbrs �
HvL1tfStatusAvailable
HvL1tfProcessorNotAffected ���
HvL1tfMigitationEnabled ��
HvL1tfMigitationNotEnabled_Hardware ��
HvL1tfMigitationNotEnabled_LoadOption
HvL1tfMigitationNotEnabled_CoreScheduler �
EnhancedIbrsReported �
MdsHardwareProtected �
MbClearEnabled ���
MbClearReported ��
Reserved �: <anonymous-tag> .?AU<anonymous-tag>@@ � � &
SpeculationControlFlags ��j _SYSTEM_SPECULATION_CONTROL_INFORMATION .?AU_SYSTEM_SPECULATION_CONTROL_INFORMATION@@ � � Z � _REFS_SMR_VOLUME_GC_PARAMETERS .?AU_REFS_SMR_VOLUME_GC_PARAMETERS@@ ��Z SmrGcMethodCompaction SmrGcMethodCompression ��� SmrGcMethodRotation ��N t _REFS_SMR_VOLUME_GC_METHOD .?AW4_REFS_SMR_VOLUME_GC_METHOD@@ ��� � � # " @ �
" Version ��
" Flags
� Action ���
Method ���
" IoGranularity
" CompressionFormat
Unused ���Z X _REFS_SMR_VOLUME_GC_PARAMETERS .?AU_REFS_SMR_VOLUME_GC_PARAMETERS@@ �� � � ^ � _ETW_COVERAGE_SAMPLER_QUERY_INFO .?AU_ETW_COVERAGE_SAMPLER_QUERY_INFO@@ ��
" n � _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION .?AU_EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION@@
" ��R � _ETW_COVERAGE_SAMPLER_DATA .?AU_ETW_COVERAGE_SAMPLER_DATA@@ ��F
$ Common ���
% EmptyStackCache ��
& Header ���^ ' @ _ETW_COVERAGE_SAMPLER_QUERY_INFO .?AU_ETW_COVERAGE_SAMPLER_QUERY_INFO@@ �� ( A ^ f � _PROCESS_HANDLE_SNAPSHOT_INFORMATION .?AU_PROCESS_HANDLE_SNAPSHOT_INFORMATION@@ ��^ � _PROCESS_HANDLE_TABLE_ENTRY_INFO .?AU_PROCESS_HANDLE_TABLE_ENTRY_INFO@@ �� + " ( �F
# NumberOfHandles ��
# Reserved �
, Handles ��f - 8 _PROCESS_HANDLE_SNAPSHOT_INFORMATION .?AU_PROCESS_HANDLE_SNAPSHOT_INFORMATION@@ �� . � � F SymbolicLinkGlobalInformation SymbolicLinkAccessMask ���J t 0 _SYMBOLIC_LINK_INFO_CLASS .?AW4_SYMBOLIC_LINK_INFO_CLASS@@ �* onecore\internal\sdk\inc\ntobapi.h � 1 2 � DEBUG_CONTROL_SPACE_PCR �� DEBUG_CONTROL_SPACE_PRCB � DEBUG_CONTROL_SPACE_KSPECIAL � DEBUG_CONTROL_SPACE_THREAD ��� DEBUG_CONTROL_SPACE_MAXIMUM ��J t 4 _DEBUG_CONTROL_SPACE_ITEM .?AW4_DEBUG_CONTROL_SPACE_ITEM@@ �* onecore\external\sdk\inc\ntarm64.h � 5 6 M � ORIENTATION_PREFERENCE_NONE �� ORIENTATION_PREFERENCE_LANDSCAPE � ORIENTATION_PREFERENCE_PORTRAIT �� ORIENTATION_PREFERENCE_LANDSCAPE_FLIPPED � ORIENTATION_PREFERENCE_PORTRAIT_FLIPPED ��F t 8 ORIENTATION_PREFERENCE .?AW4ORIENTATION_PREFERENCE@@ ��� 9 �=
� 2 � _SYSTEMTIME .?AU_SYSTEMTIME@@ �
Bias �
StandardName �
< D StandardDate �
T StandardBias �
X DaylightName �
< � DaylightDate �
� DaylightBias �J = � _TIME_ZONE_INFORMATION .?AU_TIME_ZONE_INFORMATION@@ ��6 onecore\external\sdk\inc\minwin\timezoneapi.h �� > ? # Z � _PROCESSOR_PROFILE_CONTROL_AREA .?AU_PROCESSOR_PROFILE_CONTROL_AREA@@
A B � _PEBS_DS_SAVE_AREA .?AU_PEBS_DS_SAVE_AREA@@ ��
C PebsDsSaveArea ���Z D � _PROCESSOR_PROFILE_CONTROL_AREA .?AU_PROCESSOR_PROFILE_CONTROL_AREA@@ E � � J � _FILE_MODE_INFORMATION .?AU_FILE_MODE_INFORMATION@@ ��
" Mode �J H _FILE_MODE_INFORMATION .?AU_FILE_MODE_INFORMATION@@ �� I � � f � _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN@@ ��
K *
j Header ���
SubQueue �f M ( _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN@@ �� N c 6
q P
Q 6 NotificationTimer SynchronizationTimer �. t S _TIMER_TYPE .?AW4_TIMER_TYPE@@ � T � : � _SCONTEXT_QUEUE .?AU_SCONTEXT_QUEUE@@ " �*
W pad ��
userContext ��: X <anonymous-tag> .?AU<anonymous-tag>@@ Y �
Y
[ :
" NumberOfObjects ��
\ ArrayOfObjects ���: ] _SCONTEXT_QUEUE .?AU_SCONTEXT_QUEUE@@ ^ � # V � _SYSTEM_REF_TRACE_INFORMATION .?AU_SYSTEM_REF_TRACE_INFORMATION@@ j
TraceEnable ��
TracePermanent ���
TraceProcessName �
TracePoolTags V a ( _SYSTEM_REF_TRACE_INFORMATION .?AU_SYSTEM_REF_TRACE_INFORMATION@@ b � � N � _MUTANT_BASIC_INFORMATION .?AU_MUTANT_BASIC_INFORMATION@@
d N
CurrentCount �
OwnedByCaller
AbandonedState ���N f _MUTANT_BASIC_INFORMATION .?AU_MUTANT_BASIC_INFORMATION@@ g � 2 F � tagCLIENTCREATESTRUCT .?AUtagCLIENTCREATESTRUCT@@ 2
hWindowMenu ��
u idFirstChild �F j tagCLIENTCREATESTRUCT .?AUtagCLIENTCREATESTRUCT@@ k / B � tagBITMAPCOREHEADER .?AUtagBITMAPCOREHEADER@@
m j
" bcSize ���
! bcWidth ��
! bcHeight �
! bcPlanes �
!
bcBitCount ���B o tagBITMAPCOREHEADER .?AUtagBITMAPCOREHEADER@@ p � V � _QUERY_STORAGE_RESERVE_INPUT .?AU_QUERY_STORAGE_RESERVE_INPUT@@ ��
r \ " �j
" Version ��
" Flags
" AreaIdOffset �
" AreaIdCount ��
t AreaId ���V u _QUERY_STORAGE_RESERVE_INPUT .?AU_QUERY_STORAGE_RESERVE_INPUT@@ �� v � + J � _RPC_SECURITY_QOS_V2_W .?AU_RPC_SECURITY_QOS_V2_W@@ ��^ � _RPC_HTTP_TRANSPORT_CREDENTIALS_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_W@@
y
z HttpCredentials ��2 { <anonymous-tag> .?AT<anonymous-tag>@@ | _ �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
| u J ~ _RPC_SECURITY_QOS_V2_W .?AU_RPC_SECURITY_QOS_V2_W@@ �� _ . � HBRUSH__ .?AUHBRUSH__@@ ��
�
t unused ���. � HBRUSH__ .?AUHBRUSH__@@ �� � t J j � _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA@@ ��
SymbolicLinkName �
� AliasClassGuid ���
q AliasSymbolicLinkName
" AliasSymbolicLinkNameLength ��j � ( _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA@@ �� � % v n � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE@@ z � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY@@ � " �.
" UpdateCount ��
� Updates ��n � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE@@ � � � 6 � _STARTUPINFOA .?AU_STARTUPINFOA@@
� �
" cb ���
p lpReserved ���
p lpDesktop
p lpTitle ��
" dwX ��
" $ dwY ��
" ( dwXSize ��
" , dwYSize ��
" 0 dwXCountChars
" 4 dwYCountChars
" 8 dwFillAttribute ��
" < dwFlags ��
! @ wShowWindow ��
! B cbReserved2 ��
H lpReserved2 ��
P hStdInput
X hStdOutput ���
` hStdError 6 � h _STARTUPINFOA .?AU_STARTUPINFOA@@ � � # ^ � _RTL_IMAGE_MITIGATION_ASLR_POLICY .?AU_RTL_IMAGE_MITIGATION_ASLR_POLICY@@ f
� ForceRelocateImages ��
� BottomUpRandomization
� HighEntropyRandomization �^ � _RTL_IMAGE_MITIGATION_ASLR_POLICY .?AU_RTL_IMAGE_MITIGATION_ASLR_POLICY@@ � R � _UNICODE_PREFIX_TABLE_ENTRY .?AU_UNICODE_PREFIX_TABLE_ENTRY@@
� �
NodeTypeCode �
NameLength ���
� NextPrefixTree ���
� CaseMatch
] Links
v 0 Prefix ���R � 8 _UNICODE_PREFIX_TABLE_ENTRY .?AU_UNICODE_PREFIX_TABLE_ENTRY@@ � b R F � _REPAIR_COPIES_INPUT .?AU_REPAIR_COPIES_INPUT@@ ��
" Size �
" Flags
� FileOffset ���
" Length ���
" SourceCopy ���
" NumberOfRepairCopies �
� RepairCopies �F � _REPAIR_COPIES_INPUT .?AU_REPAIR_COPIES_INPUT@@ �� � � 4 n � _PROCESS_STACK_ALLOCATION_INFORMATION_EX .?AU_PROCESS_STACK_ALLOCATION_INFORMATION_EX@@ ��f � _PROCESS_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_STACK_ALLOCATION_INFORMATION@@ j
" PreferredNode
" Reserved0
" Reserved1
" Reserved2
� AllocInfo n � ( _PROCESS_STACK_ALLOCATION_INFORMATION_EX .?AU_PROCESS_STACK_ALLOCATION_INFORMATION_EX@@ �� � � �
Z F � _KCRM_MARSHAL_HEADER .?AU_KCRM_MARSHAL_HEADER@@ ��
� ^
" VersionMajor �
" VersionMinor �
" NumProtocols �
" Unused ���F � _KCRM_MARSHAL_HEADER .?AU_KCRM_MARSHAL_HEADER@@ �� � � � � RPCHTTP_RS_REDIRECT �� RPCHTTP_RS_ACCESS_1 �� RPCHTTP_RS_SESSION ��� RPCHTTP_RS_ACCESS_2 �� RPCHTTP_RS_INTERFACE �N t � _RPC_HTTP_REDIRECTOR_STAGE .?AW4_RPC_HTTP_REDIRECTOR_STAGE@@ ��� � _ � 2 ComputerNameNetBIOS �� ComputerNameDnsHostname �� ComputerNameDnsDomain ComputerNameDnsFullyQualified ComputerNamePhysicalNetBIOS �� ComputerNamePhysicalDnsHostname �� ComputerNamePhysicalDnsDomain ComputerNamePhysicalDnsFullyQualified ComputerNameMax ��B t � _COMPUTER_NAME_FORMAT .?AW4_COMPUTER_NAME_FORMAT@@ �6 onecore\external\sdk\inc\minwin\sysinfoapi.h ��� � � R : � _SYSTEM_POOLTAG .?AU_SYSTEM_POOLTAG@@
� �
Tag ��
" TagUlong �
" PagedAllocs ��
" PagedFrees ���
# PagedUsed
" NonPagedAllocs ���
" NonPagedFrees
# NonPagedUsed �: � ( _SYSTEM_POOLTAG .?AU_SYSTEM_POOLTAG@@ � � u
V � _TXFS_GET_TRANSACTED_VERSION .?AU_TXFS_GET_TRANSACTED_VERSION@@ ��
" ThisBaseVersion ��
" LatestVersion
! ThisMiniVersion ��
!
FirstMiniVersion �
! LatestMiniVersion V � _TXFS_GET_TRANSACTED_VERSION .?AU_TXFS_GET_TRANSACTED_VERSION@@ �� � � � j � _ALPC_PORT_COMPLETION_LIST_INFORMATION .?AU_ALPC_PORT_COMPLETION_LIST_INFORMATION@@ ��^
Buffer ���
" Size �
" ConcurrencyCount �
" AttributeFlags ���j � _ALPC_PORT_COMPLETION_LIST_INFORMATION .?AU_ALPC_PORT_COMPLETION_LIST_INFORMATION@@ �� � � 6 � _CLIENT_ID64 .?AU_CLIENT_ID64@@ ��2
# UniqueProcess
# UniqueThread �6 � _CLIENT_ID64 .?AU_CLIENT_ID64@@ �� � ? } > � _WMI_WAIT_SINGLE .?AU_WMI_WAIT_SINGLE@@ ��
� B
" ThreadId �
Object ���
ObjectType ���> � _WMI_WAIT_SINGLE .?AU_WMI_WAIT_SINGLE@@ �� � c � > � _SERVICE_SID_INFO .?AU_SERVICE_SID_INFO@@
�
" dwServiceSidType �> � _SERVICE_SID_INFO .?AU_SERVICE_SID_INFO@@ � � J
3
j J � tagGESTURENOTIFYSTRUCT .?AUtagGESTURENOTIFYSTRUCT@@ ��r
u cbSize ���
" dwFlags ��
� hwndTarget ���
{ ptsLocation ��
" dwInstanceID �J � tagGESTURENOTIFYSTRUCT .?AUtagGESTURENOTIFYSTRUCT@@ �� � �< B � tagMINIMIZEDMETRICS .?AUtagMINIMIZEDMETRICS@@ f
u cbSize ���
t iWidth ���
t iHorzGap �
t iVertGap �
t iArrange �B � tagMINIMIZEDMETRICS .?AUtagMINIMIZEDMETRICS@@ � 2 > � tagEMRGDICOMMENT .?AUtagEMRGDICOMMENT@@ ��6
� emr ��
" cbData ���
� Data �> � tagEMRGDICOMMENT .?AUtagEMRGDICOMMENT@@ �� � � � Z � _FILE_PIPE_DELETE_SYMLINK_INPUT .?AU_FILE_PIPE_DELETE_SYMLINK_INPUT@@ 2
! NameOffset ���
! NameLength ���Z � _FILE_PIPE_DELETE_SYMLINK_INPUT .?AU_FILE_PIPE_DELETE_SYMLINK_INPUT@@ � � �)
l b ProcessTlsReplaceIndex ��� ProcessTlsReplaceVector �� MaxProcessTlsOperation ���R t � _PROCESS_TLS_INFORMATION_TYPE .?AW4_PROCESS_TLS_INFORMATION_TYPE@@ � � � Y F � _SYSTEM_POWER_POLICY .?AU_SYSTEM_POWER_POLICY@@ ��
� B � POWER_ACTION_POLICY .?AUPOWER_ACTION_POLICY@@ B � SYSTEM_POWER_LEVEL .?AUSYSTEM_POWER_LEVEL@@ �� � " ` �
" Revision �
� PowerButton ��
� SleepButton ��
� LidClose �
� ( LidOpenWake ��
" , Reserved �
� 0 Idle �
" < IdleTimeout ��
@ IdleSensitivity ��
A DynamicThrottle ��
� B Spare2 ���
� D MinSleep �
� H MaxSleep �
� L ReducedLatencySleep ��
" P WinLogonFlags
" T Spare3 ���
" X DozeS4Timeout
" \ BroadcastCapacityResolution ��
� ` DischargePolicy ��
" � VideoTimeout �
� VideoDimDisplay ��
� � VideoReserved
" � SpindownTimeout ��
� OptimizeForPower �
� FanThrottleTolerance �
� ForcedThrottle ���
� MinThrottle ��
� � OverThrottled F � � _SYSTEM_POWER_POLICY .?AU_SYSTEM_POWER_POLICY@@ �� � x �
r � _EVENT_TRACE_LBR_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_LBR_CONFIGURATION_INFORMATION@@ ��b
@ EventTraceInformationClass ���
# TraceHandle ��
" ConfigurationOptions �r � _EVENT_TRACE_LBR_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_LBR_CONFIGURATION_INFORMATION@@ �� � A r V � _DELETE_STORAGE_RESERVE_INPUT .?AU_DELETE_STORAGE_RESERVE_INPUT@@
� j
" Version ��
" Flags
" AreaIdOffset �
" AreaIdCount ��
t AreaId ���V � _DELETE_STORAGE_RESERVE_INPUT .?AU_DELETE_STORAGE_RESERVE_INPUT@@ � � ,+ N � _PROCESS_WAKE_INFORMATION .?AU_PROCESS_WAKE_INFORMATION@@ " " �J � _JOBOBJECT_WAKE_FILTER .?AU_JOBOBJECT_WAKE_FILTER@@ ��R
# NotificationChannel ��
� WakeCounters �
� $ WakeFilter ���N � 0 _PROCESS_WAKE_INFORMATION .?AU_PROCESS_WAKE_INFORMATION@@ � � 8 r � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA .?AT_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA@@ �� � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING@@ � � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL@@ �� � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING@@ ��r
� ResolutionBeginning ��
� GetRoot ��
� ResolutionSuccessful �
� ResolutionEnding �r ! @ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA .?AT_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA@@ �� ! � � > � _RTLP_CURDIR_REF .?AU_RTLP_CURDIR_REF@@ ��j � _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA .?AU_PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA@@ r
DeviceInstance ���
" Flags
� VetoType �
q VetoName �
" VetoNameLength ���j ! ( _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA .?AU_PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA@@ ! %
! � UmsThreadInvalidInfoClass UmsThreadUserContext � UmsThreadPriority UmsThreadAffinity UmsThreadTeb � UmsThreadIsSuspended � UmsThreadIsTerminated UmsThreadMaxInfoClass N t
! _RTL_UMS_THREAD_INFO_CLASS .?AW4_RTL_UMS_THREAD_INFO_CLASS@@ ��� ! b �! j � _MEMORY_PARTITION_ATTRIBUTE_INFORMATION .?AU_MEMORY_PARTITION_ATTRIBUTE_INFORMATION@@
# Flags j ! _MEMORY_PARTITION_ATTRIBUTE_INFORMATION .?AU_MEMORY_PARTITION_ATTRIBUTE_INFORMATION@@ ! t � F � _PEBS_DS_SAVE_AREA64 .?AU_PEBS_DS_SAVE_AREA64@@ ��"
# BtsBufferBase
# BtsIndex �
# BtsAbsoluteMaximum ���
# BtsInterruptThreshold
# PebsBufferBase ���
# ( PebsIndex
# 0 PebsAbsoluteMaximum ��
# 8 PebsInterruptThreshold ���
F @ PebsGpCounterReset ���
9 � PebsFixedCounterReset F
! � _PEBS_DS_SAVE_AREA64 .?AU_PEBS_DS_SAVE_AREA64@@ �� ! � � b � _WIM_PROVIDER_UPDATE_OVERLAY_INPUT .?AU_WIM_PROVIDER_UPDATE_OVERLAY_INPUT@@ ��R
� DataSourceId �
" WimFileNameOffset
" WimFileNameLength b ! _WIM_PROVIDER_UPDATE_OVERLAY_INPUT .?AU_WIM_PROVIDER_UPDATE_OVERLAY_INPUT@@ �� ! � -" � SecureSettingValueTypeBoolean SecureSettingValueTypeUlong �� SecureSettingValueTypeBinary � SecureSettingValueTypeString � SecureSettingValueTypeUnknown N t ! _SECURE_SETTING_VALUE_TYPE .?AW4_SECURE_SETTING_VALUE_TYPE@@ ��� ! � b
� Z � _PROCESS_POWER_THROTTLING_STATE .?AU_PROCESS_POWER_THROTTLING_STATE@@ B
" Version ��
" ControlMask ��
" StateMask Z ! _PROCESS_POWER_THROTTLING_STATE .?AU_PROCESS_POWER_THROTTLING_STATE@@ ! � � f � _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_LIST_DATA@@ z
DeviceInstance ���
� InterfaceGuid
q InterfaceList
" InterfaceListSize
" $ Flags f "! ( _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_LIST_DATA@@ #! % + N � _SYSTEM_POOL_INFORMATION .?AU_SYSTEM_POOL_INFORMATION@@ ��B � _SYSTEM_POOL_ENTRY .?AU_SYSTEM_POOL_ENTRY@@ �� &! " �
# TotalSize
FirstEntry ���
! EntryOverhead
PoolTagPresent ���
Spare0 ���
" NumberOfEntries ��
'! Entries ��N (! ( _SYSTEM_POOL_INFORMATION .?AU_SYSTEM_POOL_INFORMATION@@ �� )! � k
V � _ETW_DFSS_START_NEW_INTERVAL .?AU_ETW_DFSS_START_NEW_INTERVAL@@ ��J � _ETW_PER_SESSION_QUOTA .?AU_ETW_PER_SESSION_QUOTA@@ �� ,! " �
" CurrentGeneration
" SessionCount �
# TotalCycleCredit �
# TotalCyclesAccumulated ���
-! SessionQuota �V .! 0 _ETW_DFSS_START_NEW_INTERVAL .?AU_ETW_DFSS_START_NEW_INTERVAL@@ �� /! c 3
b � _SERVICE_REQUIRED_PRIVILEGES_INFOW .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOW@@ ��&
q pmszRequiredPrivileges ���b 2! _SERVICE_REQUIRED_PRIVILEGES_INFOW .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOW@@ �� 3! � W
� n
" Flags
Y FullDllName ��
Y BaseDllName ��
DllBase ��
" SizeOfImage ��^ 6! ( _LDR_DLL_LOADED_NOTIFICATION_DATA .?AU_LDR_DLL_LOADED_NOTIFICATION_DATA@@ 7! � � n � tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION .?AUtagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION@@ *
! score
� adjustedPoint n :! tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION .?AUtagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION@@ ;! " ^ � _SYSTEM_HOT_PATCH_REGISTRY_VALUE .?AU_SYSTEM_HOT_PATCH_REGISTRY_VALUE@@ ��2
! ImageNameLength ��
| ImageName ^ >! _SYSTEM_HOT_PATCH_REGISTRY_VALUE .?AU_SYSTEM_HOT_PATCH_REGISTRY_VALUE@@ ��2 onecore\internal\sdk\inc\minwin\ntioapi.h �� ?! @!
J � _KLDR_DATA_TABLE_ENTRY .?AU_KLDR_DATA_TABLE_ENTRY@@ ��F � _NON_PAGED_DEBUG_INFO .?AU_NON_PAGED_DEBUG_INFO@@
C!
! ��
! ��
! ��b
E! SignatureLevel ���
F! SignatureType
G! Unused ���
! EntireField ��2 H! <anonymous-tag> .?AT<anonymous-tag>@@ I! � �
InLoadOrderLinks �
ExceptionTable ���
" ExceptionTableSize ���
GpValue ��
D! ( NonPagedDebugInfo
0 DllBase ��
8 EntryPoint ���
" @ SizeOfImage ��
H FullDllName ��
X BaseDllName ��
" h Flags
! l LoadCount
I! n u1 ���
p SectionPointer ���
" x CheckSum �
" | CoverageSectionSize ��
� CoverageSection ��
� LoadedImports
� Spare
" � SizeOfImageNotRounded
" � TimeDateStamp J K! � _KLDR_DATA_TABLE_ENTRY .?AU_KLDR_DATA_TABLE_ENTRY@@ �� L! � �
B ProcessActivityTypeAudio � ProcessActivityTypeMax ���F t O! _PROCESS_ACTIVITY_TYPE .?AW4_PROCESS_ACTIVITY_TYPE@@ ��� P! � &
R � _BY_HANDLE_FILE_INFORMATION .?AU_BY_HANDLE_FILE_INFORMATION@@
R!
" dwFileAttributes �
x ftCreationTime ���
x ftLastAccessTime �
x ftLastWriteTime ��
" dwVolumeSerialNumber �
" nFileSizeHigh
" $ nFileSizeLow �
" ( nNumberOfLinks ���
" , nFileIndexHigh ���
" 0 nFileIndexLow R
T! 4 _BY_HANDLE_FILE_INFORMATION .?AU_BY_HANDLE_FILE_INFORMATION@@ U! X � 2 � tagMENUINFO .?AUtagMENUINFO@@
W! ��
X!
� �
" cbSize ���
" fMask
" dwStyle ��
u cyMax
Z! hbrBack ��
" dwContextHelpID ��
# dwMenuData ���2 [! ( tagMENUINFO .?AUtagMENUINFO@@ \! B � � ^! ^ � _ALPC_MESSAGE_HANDLE_INFORMATION .?AU_ALPC_MESSAGE_HANDLE_INFORMATION@@ ��f
" Index
" Flags
" Handle ���
" ObjectType ���
" GrantedAccess ^ a! _ALPC_MESSAGE_HANDLE_INFORMATION .?AU_ALPC_MESSAGE_HANDLE_INFORMATION@@ �� b! � R � _PERFINFO_CCSWAP_IDLE_SHORT .?AU_PERFINFO_CCSWAP_IDLE_SHORT@@
! ��
! ��*
e! DataType �
f! TimeDelta R g! _PERFINFO_CCSWAP_IDLE_SHORT .?AU_PERFINFO_CCSWAP_IDLE_SHORT@@ h! c �
� : � _STARTUPINFOEXW .?AU_STARTUPINFOEXW@@
k! R � _PROC_THREAD_ATTRIBUTE_LIST .?AU_PROC_THREAD_ATTRIBUTE_LIST@@
m! 6
� StartupInfo ��
n! h lpAttributeList ��: o! p _STARTUPINFOEXW .?AU_STARTUPINFOEXW@@ p! o 5 j � JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 .?AUJOBOBJECT_LIMIT_VIOLATION_INFORMATION_2@@ r
" LimitFlags ���
" ViolationLimitFlags ��
# IoReadBytes ��
# IoReadBytesLimit �
# IoWriteBytes �
# IoWriteBytesLimit
� ( PerJobUserTime ���
� 0 PerJobUserTimeLimit ��
# 8 JobMemory
# @ JobHighMemoryLimit ���
# @ JobMemoryLimit ���
Q H RateControlTolerance �
Q H CpuRateControlTolerance ��
Q L RateControlToleranceLimit
Q L CpuRateControlToleranceLimit �
# P JobLowMemoryLimit
Q X IoRateControlTolerance ���
Q \ IoRateControlToleranceLimit ��
Q ` NetRateControlTolerance ��
Q d NetRateControlToleranceLimit �j s! h JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 .?AUJOBOBJECT_LIMIT_VIOLATION_INFORMATION_2@@ t! ? � : � _OSVERSIONINFOA .?AU_OSVERSIONINFOA@@ �
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
szCSDVersion �: w! � _OSVERSIONINFOA .?AU_OSVERSIONINFOA@@ x! b � 2 � _BOOT_ENTRY .?AU_BOOT_ENTRY@@ �
" Version ��
" Length ���
" Id ���
" Attributes ���
" FriendlyNameOffset ���
" BootFilePathOffset ���
" OsOptionsLength ��
� OsOptions 2 {! _BOOT_ENTRY .?AU_BOOT_ENTRY@@ |! � � J � _PERFINFO_FILE_DIRENUM .?AU_PERFINFO_FILE_DIRENUM@@ ��
# Irp ��
# FileObject ���
# FileKey ��
" IssuingThreadId ��
" Length ���
" InfoClass
" $ FileIndex
| ( FileName �J ! 0 _PERFINFO_FILE_DIRENUM .?AU_PERFINFO_FILE_DIRENUM@@ �� �! c i F � _RPC_CLIENT_INTERFACE .?AU_RPC_CLIENT_INTERFACE@@
�! B � RPC_DISPATCH_TABLE .?AURPC_DISPATCH_TABLE@@ ��
�! F � _RPC_PROTSEQ_ENDPOINT .?AU_RPC_PROTSEQ_ENDPOINT@@
�! �
u Length ���
3 InterfaceId ��
3 TransferSyntax ���
�! 0 DispatchTable
u 8 RpcProtseqEndpointCount ��
�! @ RpcProtseqEndpoint ���
# H Reserved �
P InterpreterInfo ��
u X Flags F �! ` _RPC_CLIENT_INTERFACE .?AU_RPC_CLIENT_INTERFACE@@ �! 7 � v � _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION@@
�!
# CycleTime v �! _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION@@ �! �
j TransactionStateNormal ��� TransactionStateIndoubt �� TransactionStateCommittedNotify ��> t �! _TRANSACTION_STATE .?AW4_TRANSACTION_STATE@@ ��� �! � � F � _WMI_JOB_INFORMATION .?AU_WMI_JOB_INFORMATION@@ ��
�! N
ContainerId ��
" JobId
" Flags
Status ���F �! _WMI_JOB_INFORMATION .?AU_WMI_JOB_INFORMATION@@ �� �! c � 2 � _RPC_STRING .?AU_RPC_STRING@@ B
! Length ���
! MaximumLength
p Buffer ���2 �! _RPC_STRING .?AU_RPC_STRING@@ �! B D B � tagIMEMENUITEMINFOW .?AUtagIMEMENUITEMINFOW@@ q " � �
u cbSize ���
u fType
u fState ���
u wID ��
| hbmpChecked ��
| hbmpUnchecked
" dwItemData ���
�! $ szString �
| � hbmpItem �B �! � tagIMEMENUITEMINFOW .?AUtagIMEMENUITEMINFOW@@ �! � � j STUB_UNMARSHAL ��� STUB_CALL_SERVER � STUB_MARSHAL � STUB_CALL_SERVER_NO_HRESULT ��. t �! STUB_PHASE .?AW4STUB_PHASE@@ ��� �! � G
VmPrefetchInformation VmPagePriorityInformation VmCfgCallTargetInformation ��� VmPageDirtyStateInformation �� VmImageHotPatchInformation ��� VmPhysicalContiguityInformation �� VmVirtualMachinePrepopulateInformation ���Z t �! _VIRTUAL_MEMORY_INFORMATION_CLASS .?AW4_VIRTUAL_MEMORY_INFORMATION_CLASS@@ � �! � 1
� *
Sid ��
" Attributes ���B �! _SID_AND_ATTRIBUTES .?AU_SID_AND_ATTRIBUTES@@ �! x I j � _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID .?AU_EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID@@
RelatedActivityId j �! _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID .?AU_EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID@@ �! V `
� J � tagEMRSETVIEWPORTORGEX .?AUtagEMRSETVIEWPORTORGEX@@ ��&
� emr ��
� ptlOrigin J �! tagEMRSETVIEWPORTORGEX .?AUtagEMRSETVIEWPORTORGEX@@ �� �! � � . � __n128x3 .?AU__n128x3@@ �� ] " 0 �
�! val ��. �! 0 __n128x3 .?AU__n128x3@@ �� �! * � > � tagHIGHCONTRASTA .?AUtagHIGHCONTRASTA@@ ��
�! F
u cbSize ���
" dwFlags ��
p lpszDefaultScheme > �! tagHIGHCONTRASTA .?AUtagHIGHCONTRASTA@@ �� �! j2 : � tagGCP_RESULTSA .?AUtagGCP_RESULTSA@@ �
" lStructSize ��
p lpOutString ��
u lpOrder ��
t lpDx �
t lpCaretPos ���
p ( lpClass ��
q 0 lpGlyphs �
u 8 nGlyphs ��
t < nMaxFit ��: �! @ tagGCP_RESULTSA .?AUtagGCP_RESULTSA@@ �! � �
6 � tagABORTPATH .?AUtagABORTPATH@@ ��
� emr ��6 �! tagABORTPATH .?AUtagABORTPATH@@ �� �! � T � � _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED@@ b � _RTL_ACTIVATION_CONTEXT_STACK_FRAME .?AU_RTL_ACTIVATION_CONTEXT_STACK_FRAME@@ �
# Size �
" Format ���
�! Frame
( Extra1 ���
0 Extra2 ���
8 Extra3 ���
@ Extra4 ��� �! H _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED@@ �! �
j � _JOBOBJECT_END_OF_JOB_TIME_INFORMATION .?AU_JOBOBJECT_END_OF_JOB_TIME_INFORMATION@@ ��"
" EndOfJobTimeAction ���j �! _JOBOBJECT_END_OF_JOB_TIME_INFORMATION .?AU_JOBOBJECT_END_OF_JOB_TIME_INFORMATION@@ �� �! ? � ) +
� B � _MM_ETW_PAGE_EXTRA_INFO .?AT_MM_ETW_PAGE_EXTRA_INFO@@
# ��
�! SharedInitial : �! <anonymous-tag> .?AU<anonymous-tag>@@ �! t C
# ��
# ��
# ��J
�! WorkingSetType ���
�! NotAddedtoWS �
�! COWFault �: �! <anonymous-tag> .?AU<anonymous-tag>@@ �! t F R
�! e1 ���
�! e2 ���
# ProtoPte �
VirtualAddress ���B �! _MM_ETW_PAGE_EXTRA_INFO .?AT_MM_ETW_PAGE_EXTRA_INFO@@ �! t B 6 � _ICONINFOEXA .?AU_ICONINFOEXA@@ ��
" cbSize ���
t fIcon
" xHotspot �
" yHotspot �
| hbmMask ��
| hbmColor �
! wResID ���
y " szModName
y &szResName 6 �! 0_ICONINFOEXA .?AU_ICONINFOEXA@@ �� �! �* ~ VmOfferPriorityVeryLow ��� VmOfferPriorityLow ��� VmOfferPriorityBelowNormal ��� VmOfferPriorityNormal 6 t �! OFFER_PRIORITY .?AW4OFFER_PRIORITY@@ ��� �! � � Z � _FILE_FS_DATA_COPY_INFORMATION .?AU_FILE_FS_DATA_COPY_INFORMATION@@ ��
" NumberOfCopies ���Z �! _FILE_FS_DATA_COPY_INFORMATION .?AU_FILE_FS_DATA_COPY_INFORMATION@@ �� �! � � PowerStateSleeping1 �� PowerStateSleeping2 �� PowerStateSleeping3 �� PowerStateSleeping4 �� PowerStateShutdownOff PowerStateShutdownReset �� PowerStateSleeping4Firmware �� PowerStateMaximum J t �! POWER_STATE_HANDLER_TYPE .?AW4POWER_STATE_HANDLER_TYPE@@ ��� �! x � j � RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER .?AURETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER@@ ��B
� NextVcn ��
� Lcn ��
" ReferenceCount ���: �! <anonymous-tag> .?AU<anonymous-tag>@@ �! � u
�! " �F
" ExtentCount ��
� StartingVcn ��
�! Extents ��j �! ( RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER .?AURETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER@@ �� �! � q
�
�!
� B
�! Previous �
�! ActivationContext
" Flags b �! _RTL_ACTIVATION_CONTEXT_STACK_FRAME .?AU_RTL_ACTIVATION_CONTEXT_STACK_FRAME@@ �! � o
: � _LDR_DDAG_NODE .?AU_LDR_DDAG_NODE@@ ��
�!
� 6 � _LDRP_CSLIST .?AU_LDRP_CSLIST@@ ��
Modules ��
�! ServiceTagList ���
" LoadCount
" LoadWhileUnloadingCount ��
" LowestLink ���
�! ( Dependencies �
�! 0 IncomingDependencies �
v 8 State
V @ CondenseLink �
" H PreorderNumber ���:
�! P _LDR_DDAG_NODE .?AU_LDR_DDAG_NODE@@ �� " � � b � _JOBOBJECT_INTERFERENCE_INFORMATION .?AU_JOBOBJECT_INTERFERENCE_INFORMATION@@
# Count b " _JOBOBJECT_INTERFERENCE_INFORMATION .?AU_JOBOBJECT_INTERFERENCE_INFORMATION@@ " � C 6 � tagEMRPLGBLT .?AUtagEMRPLGBLT@@ �� � " �
� emr ��
d rclBounds
" aptlDest �
0 xSrc �
4 ySrc �
8 cxSrc
< cySrc
J @ xformSrc �
" X crBkColorSrc �
" \ iUsageSrc
" ` offBmiSrc
" d cbBmiSrc �
" h offBitsSrc ���
" l cbBitsSrc
p xMask
t yMask
" x iUsageMask ���
" | offBmiMask ���
" � cbBmiMask
" � offBitsMask ��
" � cbBitsMask ���6 " � tagEMRPLGBLT .?AUtagEMRPLGBLT@@ �� " � � : � tagEMRINVERTRGN .?AUtagEMRINVERTRGN@@
" N
� emr ��
d rclBounds
" cbRgnData
� RgnData ��:
" tagEMRINVERTRGN .?AUtagEMRINVERTRGN@@ " � y Z � _SYSTEM_FIRMWARE_TABLE_HANDLER .?AU_SYSTEM_FIRMWARE_TABLE_HANDLER@@ ��b � _SYSTEM_FIRMWARE_TABLE_INFORMATION .?AU_SYSTEM_FIRMWARE_TABLE_INFORMATION@@ ��
"
" "
" j
" ProviderSignature
Register �
" FirmwareTableHandler �
DriverObject �Z " _SYSTEM_FIRMWARE_TABLE_HANDLER .?AU_SYSTEM_FIRMWARE_TABLE_HANDLER@@ �� " � d F � _OBJECT_ATTRIBUTES32 .?AU_OBJECT_ATTRIBUTES32@@ ��
" Length ���
" RootDirectory
" ObjectName ���
" Attributes ���
" SecurityDescriptor ���
" SecurityQualityOfService �F " _OBJECT_ATTRIBUTES32 .?AU_OBJECT_ATTRIBUTES32@@ �� " F � _SERVICE_DESCRIPTIONW .?AU_SERVICE_DESCRIPTIONW@@
"
q lpDescription F " _SERVICE_DESCRIPTIONW .?AU_SERVICE_DESCRIPTIONW@@ " � � B � PPM_IDLE_ACCOUNTING .?AUPPM_IDLE_ACCOUNTING@@
"" N � PPM_IDLE_STATE_ACCOUNTING .?AUPPM_IDLE_STATE_ACCOUNTING@@ $" " 0 �r
" StateCount ���
" TotalTransitions �
" ResetCount ���
# StartTime
%" State B &" H PPM_IDLE_ACCOUNTING .?AUPPM_IDLE_ACCOUNTING@@ '" x
. � _POWER_STATE .?AT_POWER_STATE@@ ��
)" 2
� SystemState ��
� DeviceState ��. +" _POWER_STATE .?AT_POWER_STATE@@ �� ," x � R � _SYSTEM_MANDATORY_LABEL_ACE .?AU_SYSTEM_MANDATORY_LABEL_ACE@@ :
� Header ���
" Mask �
" SidStart �R /" _SYSTEM_MANDATORY_LABEL_ACE .?AU_SYSTEM_MANDATORY_LABEL_ACE@@ 0" x � . � _DOCINFOA .?AU_DOCINFOA@@
2" r
t cbSize ���
� lpszDocName ��
� lpszOutput ���
� lpszDatatype �
" fwType ���. 4" ( _DOCINFOA .?AU_DOCINFOA@@ 5" � � j � _WMI_JOB_SEND_NOTIFICATION_INFORMATION .?AU_WMI_JOB_SEND_NOTIFICATION_INFORMATION@@ ��F
ContainerId ��
" JobId
" NotificationId ���j 8" _WMI_JOB_SEND_NOTIFICATION_INFORMATION .?AU_WMI_JOB_SEND_NOTIFICATION_INFORMATION@@ �� 9" c � > � _nlsversioninfoex .?AU_nlsversioninfoex@@ �
" dwNLSVersionInfoSize �
" dwNLSVersion �
" dwDefinedVersion �
" dwEffectiveId
guidCustomVersion > <" _nlsversioninfoex .?AU_nlsversioninfoex@@ =" W � N � _RTL_SPARSE_BITMAP_RANGE .?AU_RTL_SPARSE_BITMAP_RANGE@@ ��2 � _RTL_BITMAP .?AU_RTL_BITMAP@@ :
# Lock �
@" RangeBitmap ��
V Next �N A" _RTL_SPARSE_BITMAP_RANGE .?AU_RTL_SPARSE_BITMAP_RANGE@@ �� B" � F � _CM_VIDEO_DEVICE_DATA .?AU_CM_VIDEO_DEVICE_DATA@@
D" B
! Version ��
! Revision �
" VideoClock ���F F" _CM_VIDEO_DEVICE_DATA .?AU_CM_VIDEO_DEVICE_DATA@@ G" � r SystemCrashDumpDisable ��� SystemCrashDumpReconfigure ��� SystemCrashDumpInitializationComplete f t I" _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS .?AW4_SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS@@ ��� J" � & N � _FILE_STREAM_INFORMATION .?AU_FILE_STREAM_INFORMATION@@ ��
L" �
" NextEntryOffset ��
" StreamNameLength �
� StreamSize ���
� StreamAllocationSize �
| StreamName ���N N" _FILE_STREAM_INFORMATION .?AU_FILE_STREAM_INFORMATION@@ �� O" � - J � _MIDL_INTERCEPTION_INFO .?AU_MIDL_INTERCEPTION_INFO@@ z
" Version ��
Q ProcString ���
6 ProcFormatOffsetTable
" ProcCount
Q TypeString ���J R" ( _MIDL_INTERCEPTION_INFO .?AU_MIDL_INTERCEPTION_INFO@@ S" � � : � _RTL_BITMAP_EX .?AU_RTL_BITMAP_EX@@ ��.
# SizeOfBitMap �
# Buffer ���: V" _RTL_BITMAP_EX .?AU_RTL_BITMAP_EX@@ �� W" � > � _EXFAT_STATISTICS .?AU_EXFAT_STATISTICS@@
" CreateHits ���
" SuccessfulCreates
" FailedCreates
" NonCachedReads ���
" NonCachedReadBytes ���
" NonCachedWrites ��
" NonCachedWriteBytes ��
" NonCachedDiskReads ���
" NonCachedDiskWrites ��> Z" $ _EXFAT_STATISTICS .?AU_EXFAT_STATISTICS@@ [" � N j FpRoundNearest ��� FpRoundMinusInfinity � FpRoundPlusInfinity �� FpRoundChopped ���F t ]" _FP__IEEE_ROUNDING_MODE .?AW4_FP__IEEE_ROUNDING_MODE@@ � ^" � � B � HSAVEDUILANGUAGES__ .?AUHSAVEDUILANGUAGES__@@
`"
t unused ���B b" HSAVEDUILANGUAGES__ .?AUHSAVEDUILANGUAGES__@@ c" W
. HeapCompatibilityInformation � HeapEnableTerminationOnCorruption HeapExtendedInformation �� HeapOptimizeResources HeapTaggingInformation ��� HeapStackDatabase HeapMemoryLimit �� � �HeapDetailedFailureInformation ��� � �HeapSetDebuggingInformation ��F t e" _HEAP_INFORMATION_CLASS .?AW4_HEAP_INFORMATION_CLASS@@ � f" � Q " h"
i" N � _QUERY_FILE_LAYOUT_OUTPUT .?AU_QUERY_FILE_LAYOUT_OUTPUT@@
k" ^
" FileEntryCount ���
" FirstFileOffset ��
" Flags
" Reserved �N m" _QUERY_FILE_LAYOUT_OUTPUT .?AU_QUERY_FILE_LAYOUT_OUTPUT@@ n" � Y
�
� 6 � tagEMRLINETO .?AUtagEMRLINETO@@ ��
r" "
� emr ��
� ptl ��6 t" tagEMRLINETO .?AUtagEMRLINETO@@ �� u" � �
" " " " " " x"
y" > � _DISPLAY_DEVICEA .?AU_DISPLAY_DEVICEA@@ �� p " �
" cb ���
|" DeviceName ���
$ DeviceString �
" � StateFlags ���
� DeviceID �
(DeviceKey > }" �_DISPLAY_DEVICEA .?AU_DISPLAY_DEVICEA@@ �� ~" � �
F � _RTL_PERTHREAD_CURDIR .?AU_RTL_PERTHREAD_CURDIR@@ N � _RTL_DRIVE_LETTER_CURDIR .?AU_RTL_DRIVE_LETTER_CURDIR@@ ��
�" N
�" CurrentDirectories ���
v ImageName
Environment ��F �" _RTL_PERTHREAD_CURDIR .?AU_RTL_PERTHREAD_CURDIR@@ �" � 4 f EtwProviderTraitTypeGroup EtwProviderTraitDecodeGuid ��� EtwProviderTraitTypeMax ��F t �" ETW_PROVIDER_TRAIT_TYPE .?AW4ETW_PROVIDER_TRAIT_TYPE@@ � �" V � � FEEDBACK_TOUCH_CONTACTVISUALIZATION �� FEEDBACK_PEN_BARRELVISUALIZATION � FEEDBACK_PEN_TAP � FEEDBACK_PEN_DOUBLETAP ��� FEEDBACK_PEN_PRESSANDHOLD FEEDBACK_PEN_RIGHTTAP FEEDBACK_TOUCH_TAP ��� FEEDBACK_TOUCH_DOUBLETAP � FEEDBACK_TOUCH_PRESSANDHOLD ��
FEEDBACK_TOUCH_RIGHTTAP �� FEEDBACK_GESTURE_PRESSANDTAP � ��FEEDBACK_MAX : t �" tagFEEDBACK_TYPE .?AW4tagFEEDBACK_TYPE@@ ��� �" R Z � _JOBOBJECT_IO_ATTRIBUTION_STATS .?AU_JOBOBJECT_IO_ATTRIBUTION_STATS@@
�" z
# IoCount ��
# TotalNonOverlappedQueueTime ��
# TotalNonOverlappedServiceTime
# TotalSize Z �" _JOBOBJECT_IO_ATTRIBUTION_STATS .?AU_JOBOBJECT_IO_ATTRIBUTION_STATS@@ �" ? � : � _JOB_SET_ARRAY .?AU_JOB_SET_ARRAY@@ ��>
JobHandle
" MemberLevel ��
" Flags : �" _JOB_SET_ARRAY .?AU_JOB_SET_ARRAY@@ �� �" ? � V � _PERFINFO_SYSCALL_ENTER_DATA .?AU_PERFINFO_SYSCALL_ENTER_DATA@@ ��
SysCallAddr ��V �" _PERFINFO_SYSCALL_ENTER_DATA .?AU_PERFINFO_SYSCALL_ENTER_DATA@@ �� �" c & f � _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY@@
�" �
# BeginAddress �
# EndAddress ���
# ExceptionHandler �
# HandlerData ��
# PrologEndAddress �f �" ( _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY@@ �" � # B � _MOUSE_EVENT_RECORD .?AU_MOUSE_EVENT_RECORD@@ * � _COORD .?AU_COORD@@ ��j
�" dwMousePosition ��
" dwButtonState
" dwControlKeyState
" dwEventFlags �B �" _MOUSE_EVENT_RECORD .?AU_MOUSE_EVENT_RECORD@@ �" � R B � POWER_STATE_HANDLER .?AUPOWER_STATE_HANDLER@@
�" %
�" �" U �"
�" ^
�! Type �
RtcWake ��
- Spare
�" Handler ��
Context ��B �" POWER_STATE_HANDLER .?AUPOWER_STATE_HANDLER@@ �" x - > � tagREGISTERWORDA .?AUtagREGISTERWORDA@@ ��
�" *
p lpReading
p lpWord ���> �" tagREGISTERWORDA .?AUtagREGISTERWORDA@@ �� �" � \
� � �" �"
�" � HiberFileBucket1GB ��� HiberFileBucket2GB ��� HiberFileBucket4GB ��� HiberFileBucket8GB ��� HiberFileBucket16GB �� HiberFileBucket32GB �� HiberFileBucketUnlimited � HiberFileBucketMax ���F t �" _HIBERFILE_BUCKET_SIZE .?AW4_HIBERFILE_BUCKET_SIZE@@ ��� �" x � V � _FILE_ALLOCATION_INFORMATION .?AU_FILE_ALLOCATION_INFORMATION@@ ��
� AllocationSize ���V �" _FILE_ALLOCATION_INFORMATION .?AU_FILE_ALLOCATION_INFORMATION@@ �� �" � � ^ � _ETW_TIMER_EXPIRATION_START_EVENT .?AU_ETW_TIMER_EXPIRATION_START_EVENT@@ :
# InterruptTime
HrTimerExpirationOnly ^ �" _ETW_TIMER_EXPIRATION_START_EVENT .?AU_ETW_TIMER_EXPIRATION_START_EVENT@@ �" c � > � tagACCESSTIMEOUT .?AUtagACCESSTIMEOUT@@ ��
�" B
u cbSize ���
" dwFlags ��
" iTimeOutMSec �> �" tagACCESSTIMEOUT .?AUtagACCESSTIMEOUT@@ �� �" �3 R � _FILE_ALIGNMENT_INFORMATION .?AU_FILE_ALIGNMENT_INFORMATION@@
�" "
" AlignmentRequirement �R �" _FILE_ALIGNMENT_INFORMATION .?AU_FILE_ALIGNMENT_INFORMATION@@ �" � �
� B � tagENUMTEXTMETRICW .?AUtagENUMTEXTMETRICW@@ ��
�" B � tagNEWTEXTMETRICEXW .?AUtagNEWTEXTMETRICEXW@@ :
�" etmNewTextMetricEx ���
z d etmAxesList ��B �" �tagENUMTEXTMETRICW .?AUtagENUMTEXTMETRICW@@ �� �" � r
x
y . �" tagPOINT .?AUtagPOINT@@ �� �" t � : WdActionSetTimeoutValue �� WdActionQueryTimeoutValue WdActionResetTimer ��� WdActionStopTimer WdActionStartTimer ��� WdActionSetTriggerAction � WdActionQueryTriggerAction ��� WdActionQueryState ��� WdActionSleep WdActionWake �
WdActionMarkHiberPhase ���J t �" _WATCHDOG_HANDLER_ACTION .?AW4_WATCHDOG_HANDLER_ACTION@@ ��� �" � 2
F � _SECURITY_DESCRIPTOR .?AU_SECURITY_DESCRIPTOR@@ ��
�" & � _ACL .?AU_ACL@@ ��
�" z
Revision �
Sbz1 �
! Control ��
Owner
Group
�" Sacl �
�" Dacl �F �" ( _SECURITY_DESCRIPTOR .?AU_SECURITY_DESCRIPTOR@@ �� �" x � J � _PERFINFO_CCSWAP_BUFFER .?AU_PERFINFO_CCSWAP_BUFFER@@
�" p " �R
FirstTimeStamp ���
k TidTable �
�" H ThreadBasePriority ���J �" X _PERFINFO_CCSWAP_BUFFER .?AU_PERFINFO_CCSWAP_BUFFER@@ �" c � ^ � _PERFINFO_CC_EXTRA_WB_THREAD_INFO .?AU_PERFINFO_CC_EXTRA_WB_THREAD_INFO@@ �
" ThreadAction �
" ActiveExtraWBThreads �
# TotalDirtyPages ��
# DirtyPageThreshold ���
# AvailablePages ���^ �" _PERFINFO_CC_EXTRA_WB_THREAD_INFO .?AU_PERFINFO_CC_EXTRA_WB_THREAD_INFO@@ �" c V � _PERFINFO_CC_WORKITEM_ENQUEUE .?AU_PERFINFO_CC_WORKITEM_ENQUEUE@@
�" �
# WorkItemKey ��
# FileObjectKey
QueueType
WorkItemType �
Requeue ��
Reserved �V �" _PERFINFO_CC_WORKITEM_ENQUEUE .?AU_PERFINFO_CC_WORKITEM_ENQUEUE@@ �" c � b � _MEMORY_PARTITION_NODE_INFORMATION .?AU_MEMORY_PARTITION_NODE_INFORMATION@@ ��
Y J
" NumaNodeCount
" Flags
�" NodePageInformation ��b �" _MEMORY_PARTITION_NODE_INFORMATION .?AU_MEMORY_PARTITION_NODE_INFORMATION@@ �� �" t � R � _WMI_IMAGEID_INFORMATION32 .?AU_WMI_IMAGEID_INFORMATION32@@ ��z
u ImageBase32 ��
u ImageSize32 ��
" ProcessId
" TimeDateStamp
| OriginalFileName �R �" _WMI_IMAGEID_INFORMATION32 .?AU_WMI_IMAGEID_INFORMATION32@@ �� �" c � N � _PROCESS_LEAP_SECOND_INFO .?AU_PROCESS_LEAP_SECOND_INFO@@ &
" Flags
" Reserved �N �" _PROCESS_LEAP_SECOND_INFO .?AU_PROCESS_LEAP_SECOND_INFO@@ �" � � F � _KEY_FULL_INFORMATION .?AU_KEY_FULL_INFORMATION@@
�"
� LastWriteTime
" TitleIndex ���
" ClassOffset ��
" ClassLength ��
" SubKeys ��
" MaxNameLen ���
" MaxClassLen ��
" Values ���
" $ MaxValueNameLen ��
" ( MaxValueDataLen ��
| , Class F �" 0 _KEY_FULL_INFORMATION .?AU_KEY_FULL_INFORMATION@@ �" � J � _ETW_OBJECT_TYPE_EVENT .?AU_ETW_OBJECT_TYPE_EVENT@@ ��>
! ObjectType ���
! Reserved �
| Name �J # _ETW_OBJECT_TYPE_EVENT .?AU_ETW_OBJECT_TYPE_EVENT@@ �� # c c
2 � tagEVENTMSG .?AUtagEVENTMSG@@ ^
u message ��
u paramL ���
u paramH ���
" time �
� hwnd �2 # tagEVENTMSG .?AUtagEVENTMSG@@ # !
F
lfHeight �
lfWidth ��
lfEscapement �
lfOrientation
lfWeight �
lfItalic �
lfUnderline ��
lfStrikeOut ��
lfCharSet
lfOutPrecision ���
lfClipPrecision ��
lfQuality
lfPitchAndFamily �
lfFaceName ���2 # \ tagLOGFONTW .?AUtagLOGFONTW@@
# � � V � _HEAP_AFINITY_MANAGER_ENABLE .?AU_HEAP_AFINITY_MANAGER_ENABLE@@ ��F
j Header ���
HeapHandle ���
" ( BucketIndex ��V
# , _HEAP_AFINITY_MANAGER_ENABLE .?AU_HEAP_AFINITY_MANAGER_ENABLE@@ �� # c g J � _POWER_SESSION_TIMEOUTS .?AU_POWER_SESSION_TIMEOUTS@@
# 6
" InputTimeout �
" DisplayTimeout ���J # _POWER_SESSION_TIMEOUTS .?AU_POWER_SESSION_TIMEOUTS@@ # x �
� J � tagEMREXTSELECTCLIPRGN .?AUtagEMREXTSELECTCLIPRGN@@ ��J
� emr ��
" cbRgnData
" iMode
� RgnData ��J # tagEMREXTSELECTCLIPRGN .?AUtagEMREXTSELECTCLIPRGN@@ �� # � � B � tagEMRSETMITERLIMIT .?AUtagEMRSETMITERLIMIT@@ *
� emr ��
@ eMiterLimit ��B # tagEMRSETMITERLIMIT .?AUtagEMRSETMITERLIMIT@@ # � q R � _WMI_IMAGEID_INFORMATION64 .?AU_WMI_IMAGEID_INFORMATION64@@ ��z
# ImageBase64 ��
# ImageSize64 ��
" ProcessId
" TimeDateStamp
| OriginalFileName �R # _WMI_IMAGEID_INFORMATION64 .?AU_WMI_IMAGEID_INFORMATION64@@ �� # c � J � _CSV_QUERY_MDS_PATH_V2 .?AU_CSV_QUERY_MDS_PATH_V2@@ �� CsvFsDiskConnectivityNone CsvFsDiskConnectivityMdsNodeOnly � CsvFsDiskConnectivitySubsetOfNodes ��� CsvFsDiskConnectivityAllNodes J t ## _CSVFS_DISK_CONNECTIVITY .?AW4_CSVFS_DISK_CONNECTIVITY@@ ��� $# � � �
Version ��
" RequiredSize �
" MdsNodeId
" DsNodeId �
" Flags
$# DiskConnectivity �
VolumeId �
" , IpAddressOffset ��
" 0 IpAddressLength ��
" 4 PathOffset ���
" 8 PathLength ���J &# @ _CSV_QUERY_MDS_PATH_V2 .?AU_CSV_QUERY_MDS_PATH_V2@@ �� '# � � 6 � _TOKEN_ORIGIN .?AU_TOKEN_ORIGIN@@ &
� OriginatingLogonSession ��6 *# _TOKEN_ORIGIN .?AU_TOKEN_ORIGIN@@ +# x ^ ��ConfigurationSpaceUndefined � Cmos � EisaConfiguration Pos �� CbusConfiguration PCIConfiguration � VMEConfiguration � NuBusConfiguration ��� PCMCIAConfiguration �� MPIConfiguration � MPSAConfiguration
PNPISAConfiguration �� SgiInternalConfiguration � MaximumBusDataType ���6 t -# _BUS_DATA_TYPE .?AW4_BUS_DATA_TYPE@@ ��� .# � �+
.# B � _MEMORY_RANGE_ENTRY .?AU_MEMORY_RANGE_ENTRY@@ 6
VirtualAddress ���
# NumberOfBytes B 2# _MEMORY_RANGE_ENTRY .?AU_MEMORY_RANGE_ENTRY@@ 3# � � : � tagCWPRETSTRUCT .?AUtagCWPRETSTRUCT@@
5# b
lResult ��
lParam ���
# wParam ���
u message ��
� hwnd �: 7# ( tagCWPRETSTRUCT .?AUtagCWPRETSTRUCT@@ 8# 9 v � _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION .?AU_TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION@@ ��&
� SuperiorEnlistmentPair ���v ;# _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION .?AU_TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION@@ �� <# � V � _SYSTEM_KERNEL_DEBUGGER_FLAGS .?AU_SYSTEM_KERNEL_DEBUGGER_FLAGS@@ .
KernelDebuggerIgnoreUmExceptions �V ?# _SYSTEM_KERNEL_DEBUGGER_FLAGS .?AU_SYSTEM_KERNEL_DEBUGGER_FLAGS@@ @# � � J PowerMonitorOff �� PowerMonitorOn ��� PowerMonitorDim ��F t B# _MONITOR_DISPLAY_STATE .?AW4_MONITOR_DISPLAY_STATE@@ ��� C# x �
C# b � _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER .?AU_ETW_TP_EVENT_TIMER_CANCEL_NTTIMER@@ ��*
j Header ���
SubQueue �b G# ( _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER .?AU_ETW_TP_EVENT_TIMER_CANCEL_NTTIMER@@ �� H# c / n � _JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2@@ r
" LimitFlags ���
" ViolationLimitFlags ��
# IoReadBytes ��
# IoReadBytesLimit �
# IoWriteBytes �
# IoWriteBytesLimit
� ( PerJobUserTime ���
� 0 PerJobUserTimeLimit ��
# 8 JobMemory
# @ JobLowMemoryLimit
# H JobHighMemoryLimit ���
Q P RateControlTolerance �
Q T RateControlToleranceLimit n
K# X _JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2@@ L# � � J � _SE_SECURITY_DESCRIPTOR .?AU_SE_SECURITY_DESCRIPTOR@@ B
" Size �
" Flags
SecurityDescriptor ���J O# _SE_SECURITY_DESCRIPTOR .?AU_SE_SECURITY_DESCRIPTOR@@ P# x � V � _SERVICE_PREFERRED_NODE_INFO .?AU_SERVICE_PREFERRED_NODE_INFO@@ ��
R# 2
! usPreferredNode ��
fDelete ��V T# _SERVICE_PREFERRED_NODE_INFO .?AU_SERVICE_PREFERRED_NODE_INFO@@ �� U# � �
N � _PROCESS_HEAP_INFORMATION .?AU_PROCESS_HEAP_INFORMATION@@
X# r
# ReserveSize ��
# CommitSize ���
" NumberOfHeaps
# FirstHeapInformationOffset ���N Z# _PROCESS_HEAP_INFORMATION .?AU_PROCESS_HEAP_INFORMATION@@ [# � � V � _TEB_ACTIVE_FRAME_CONTEXT_EX .?AU_TEB_ACTIVE_FRAME_CONTEXT_EX@@ ��6
� BasicContext �
[ SourceLocation ���V ^# _TEB_ACTIVE_FRAME_CONTEXT_EX .?AU_TEB_ACTIVE_FRAME_CONTEXT_EX@@ �� _# 7 � B � _WMI_BUFFER_HEADER .?AU_WMI_BUFFER_HEADER@@ ��
# ��
# =��
a# : � _ETW_REF_CLOCK .?AU_ETW_REF_CLOCK@@ ���
" BufferSize ���
" SavedOffset ��
� CurrentOffset
T ReferenceCount ���
� TimeStamp
SequenceNumber ���
b# ClockType
c# Frequency
V SlistEntry ���
d# NextBuffer ���
Q ( ClientContext
, State
" 0 Offset ���
! 4 BufferFlag ���
! 6 BufferType ���
� 8 Padding1 �
e# 8 ReferenceTime
8 GlobalEntry ��
8 Pointer0 �
@ Pointer1 �B f# H _WMI_BUFFER_HEADER .?AU_WMI_BUFFER_HEADER@@ �� g# c � J � _RPC_SECURITY_QOS_V3_W .?AU_RPC_SECURITY_QOS_V3_W@@ ��
z HttpCredentials ��2 j# <anonymous-tag> .?AT<anonymous-tag>@@ k# _ . �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
k# u
Sid ��J m# ( _RPC_SECURITY_QOS_V3_W .?AU_RPC_SECURITY_QOS_V3_W@@ �� n# _ ' J � _RTL_MODULE_BASIC_INFO .?AU_RTL_MODULE_BASIC_INFO@@ ��
p#
ImageBase J r# _RTL_MODULE_BASIC_INFO .?AU_RTL_MODULE_BASIC_INFO@@ �� s# � � > � _WMI_TRACE_PACKET .?AU_WMI_TRACE_PACKET@@ F
! Size �
! HookId ���
Type �
Group > v# _WMI_TRACE_PACKET .?AU_WMI_TRACE_PACKET@@ w# c
� & DISPLAYCONFIG_SCALING_IDENTITY ��� DISPLAYCONFIG_SCALING_CENTERED ��� DISPLAYCONFIG_SCALING_STRETCHED �� DISPLAYCONFIG_SCALING_ASPECTRATIOCENTEREDMAX � DISPLAYCONFIG_SCALING_CUSTOM � � DISPLAYCONFIG_SCALING_PREFERRED �� ��DISPLAYCONFIG_SCALING_FORCE_UINT32 ��B t z# DISPLAYCONFIG_SCALING .?AW4DISPLAYCONFIG_SCALING@@ � {# � 6 > ProcessMemoryPriority ProcessMemoryExhaustionInfo �� ProcessAppMemoryInfo � ProcessInPrivateInfo � ProcessPowerThrottling ��� ProcessReservedValue1 ProcessTelemetryCoverageInfo � ProcessProtectionLevelInfo ��� ProcessLeapSecondInfo ProcessInformationClassMax ���N
t }# _PROCESS_INFORMATION_CLASS .?AW4_PROCESS_INFORMATION_CLASS@@ ��� ~# � � � � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION@@ �� � " H �:
# OverallChangeStamp ���
�# Descriptors �� �# P _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION@@ �� �# � � 6 � _MUICCHEADER .?AU_MUICCHEADER@@ ���
u ulMaxStringsSize �
u ulSizeStrings
u ulMaxNumInstalledCultures
u ulNumInstalledCultures ���
u ulMaxNumUnverifiedCultures ���
u ulNumUnverifiedCultures ��6 �# _MUICCHEADER .?AU_MUICCHEADER@@ �� �# j � _EVENT_TRACE_PROFILE_REMOVE_INFORMATION .?AU_EVENT_TRACE_PROFILE_REMOVE_INFORMATION@@ ^
@ EventTraceInformationClass ���
K ProfileSource
� CpuInfoHierarchy �j �# _EVENT_TRACE_PROFILE_REMOVE_INFORMATION .?AU_EVENT_TRACE_PROFILE_REMOVE_INFORMATION@@ �# A � *
Linkage ��
# Signature V �# _RTL_DYNAMIC_HASH_TABLE_ENTRY .?AU_RTL_DYNAMIC_HASH_TABLE_ENTRY@@ �# b N � _OBJECT_NAME_INFORMATION .?AU_OBJECT_NAME_INFORMATION@@ ��
�#
Name �N �# _OBJECT_NAME_INFORMATION .?AU_OBJECT_NAME_INFORMATION@@ �� �# n N v � _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION .?AU_SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION@@
�# ^ � _QUERY_PERFORMANCE_COUNTER_FLAGS .?AU_QUERY_PERFORMANCE_COUNTER_FLAGS@@ ��>
" Version ��
�# Flags
�# ValidFlags ���v �# _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION .?AU_SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION@@ �# � �
/ F � _IO_ERROR_LOG_PACKET .?AU_IO_ERROR_LOG_PACKET@@ ��B
MajorFunctionCode
RetryCount ���
! DumpDataSize �
! NumberOfStrings ��
! StringOffset �
! EventCategory
ErrorCode
" UniqueErrorValue �
FinalStatus ��
" SequenceNumber ���
" IoControlCode
� DeviceOffset �
� ( DumpData �F
�# 0 _IO_ERROR_LOG_PACKET .?AU_IO_ERROR_LOG_PACKET@@ ��* onecore\internal\sdk\inc\ntiolog.h � �# �# / J � _RTL_CRITICAL_SECTION32 .?AU_RTL_CRITICAL_SECTION32@@
�# �
" DebugInfo
LockCount
RecursionCount ���
" OwningThread �
" LockSemaphore
" SpinCount J �# _RTL_CRITICAL_SECTION32 .?AU_RTL_CRITICAL_SECTION32@@ �# � � ~ HardwareProfileChangeEvent ��� TargetDeviceChangeEvent �� DeviceClassChangeEvent ��� CustomDeviceEvent DeviceInstallEvent ��� DeviceArrivalEvent ��� VetoEvent BlockedDriverEvent ��� InvalidIDEvent ��� DevicePropertyChangeEvent
DeviceInstanceRemovalEvent ��� DeviceInstanceStartedEvent ��� MaxPlugEventCategory �J
t �# _PLUGPLAY_EVENT_CATEGORY .?AW4_PLUGPLAY_EVENT_CATEGORY@@ ��� �# % / :
! Group
Number ���
Reserved �> �# _PROCESSOR_NUMBER .?AU_PROCESSOR_NUMBER@@ �# J � _FILE_LAYOUT_INFO_ENTRY .?AU_FILE_LAYOUT_INFO_ENTRY@@
�# �
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
" FileAttributes ���: �# ( <anonymous-tag> .?AU<anonymous-tag>@@ �# � � v
�# BasicInformation �
" ( OwnerId ��
" , SecurityId ���
0 Usn ��
\ 8 StorageReserveId �J �# @ _FILE_LAYOUT_INFO_ENTRY .?AU_FILE_LAYOUT_INFO_ENTRY@@ �# � � b � _PERFINFO_HARDPAGEFAULT_INFORMATION .?AU_PERFINFO_HARDPAGEFAULT_INFORMATION@@
�# v
� ReadOffset ���
VirtualAddress ���
FileObject ���
" ThreadId �
" ByteCount b �# _PERFINFO_HARDPAGEFAULT_INFORMATION .?AU_PERFINFO_HARDPAGEFAULT_INFORMATION@@ �# c M ^ � _JOBOBJECT_BASIC_PROCESS_ID_LIST .?AU_JOBOBJECT_BASIC_PROCESS_ID_LIST@@ ��
�# # " �b
" NumberOfAssignedProcesses
" NumberOfProcessIdsInList �
�# ProcessIdList ^ �# _JOBOBJECT_BASIC_PROCESS_ID_LIST .?AU_JOBOBJECT_BASIC_PROCESS_ID_LIST@@ �� �# ? � B � tagWNODE_TOO_SMALL .?AUtagWNODE_TOO_SMALL@@ ��
�# 2
� WnodeHeader ��
" 0 SizeNeeded ���B �# 8 tagWNODE_TOO_SMALL .?AUtagWNODE_TOO_SMALL@@ �� �# � " � QUERY_FILE_LAYOUT_FILTER_TYPE_NONE ��� QUERY_FILE_LAYOUT_FILTER_TYPE_CLUSTERS ��� QUERY_FILE_LAYOUT_FILTER_TYPE_FILEID � QUERY_FILE_LAYOUT_FILTER_TYPE_STORAGE_RESERVE_ID � QUERY_FILE_LAYOUT_NUM_FILTER_TYPES ���V t �# _QUERY_FILE_LAYOUT_FILTER_TYPE .?AW4_QUERY_FILE_LAYOUT_FILTER_TYPE@@ ��� �# � � j PsNeverDuplicate � PsRequestDuplicate ��� PsAlwaysDuplicate PsMaxStdHandleStates �B t �# _PS_STD_HANDLE_STATE .?AW4_PS_STD_HANDLE_STATE@@ ��� �# � F � SeImageSignatureNone � SeImageSignatureEmbedded � SeImageSignatureCache SeImageSignatureCatalogCached SeImageSignatureCatalogNotCached � SeImageSignatureCatalogHint �� SeImageSignaturePackageCatalog ���J t �# _SE_IMAGE_SIGNATURE_TYPE .?AW4_SE_IMAGE_SIGNATURE_TYPE@@ ��� �# x �
> � _VIDEOPARAMETERS .?AU_VIDEOPARAMETERS@@ ��
�# 2
Guid �
" dwOffset �
" dwCommand
" dwFlags ��
" dwMode ���
" dwTVStandard �
" $ dwAvailableModes �
" ( dwAvailableTVStandard
" , dwFlickerFilter ��
" 0 dwOverScanX ��
" 4 dwOverScanY ��
" 8 dwMaxUnscaledX ���
" < dwMaxUnscaledY ���
" @ dwPositionX ��
" D dwPositionY ��
" H dwBrightness �
" L dwContrast ���
" P dwCPType �
" T dwCPCommand ��
" X dwCPStandard �
" \ dwCPKey ��
" ` bCP_APSTriggerBits ���
d bOEMCopyProtection ���> �# d_VIDEOPARAMETERS .?AU_VIDEOPARAMETERS@@ ��* onecore\external\shared\inc\tvout.h �# �# V IMPORT_OBJECT_CODE ��� IMPORT_OBJECT_DATA ��� IMPORT_OBJECT_CONST ��> t �# IMPORT_OBJECT_TYPE .?AW4IMPORT_OBJECT_TYPE@@ ��� �# � �
�" > � _SYSDBG_IO_SPACE .?AU_SYSDBG_IO_SPACE@@ ��
# Address ��
Buffer ���
" Request ��
� InterfaceType
" BusNumber
" AddressSpace �> �# _SYSDBG_IO_SPACE .?AU_SYSDBG_IO_SPACE@@ �� �# � V � STARTING_LCN_INPUT_BUFFER_EX .?AUSTARTING_LCN_INPUT_BUFFER_EX@@ ��
�# *
� StartingLcn ��
" Flags V �# STARTING_LCN_INPUT_BUFFER_EX .?AUSTARTING_LCN_INPUT_BUFFER_EX@@ �� �# � ;
R � _SECURITY_OBJECT_AI_PARAMS .?AU_SECURITY_OBJECT_AI_PARAMS@@ ��.
" Size �
" ConstraintMask ���R �# _SECURITY_OBJECT_AI_PARAMS .?AU_SECURITY_OBJECT_AI_PARAMS@@ �� �# x J � _RTL_CONDITION_VARIABLE .?AU_RTL_CONDITION_VARIABLE@@
�#
# ��
# ��J
�# WakeCount
�# Waking ���
# Value
Ptr ��J �# _RTL_CONDITION_VARIABLE .?AU_RTL_CONDITION_VARIABLE@@ �# � <
� B � _IMAGE_POLICY_ENTRY .?AU_IMAGE_POLICY_ENTRY@@
�# ��
�# �# �# �#
�# J � _REPARSE_DATA_BUFFER_EX .?AU_REPARSE_DATA_BUFFER_EX@@ N � _REPARSE_GUID_DATA_BUFFER .?AU_REPARSE_GUID_DATA_BUFFER@@ �
" Flags
" ExistingReparseTag ���
ExistingReparseGuid ��
# Reserved �
� ReparseDataBuffer
�# ReparseGuidDataBuffer J �# @ _REPARSE_DATA_BUFFER_EX .?AU_REPARSE_DATA_BUFFER_EX@@ �# � C&
)# B � _IO_STATUS_BLOCK32 .?AU_IO_STATUS_BLOCK32@@ ��.
Status ���
" Information ��B �# _IO_STATUS_BLOCK32 .?AU_IO_STATUS_BLOCK32@@ �� �# � � > � tagNEWTEXTMETRICW .?AUtagNEWTEXTMETRICW@@
�# F
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
q , tmFirstChar ��
q . tmLastChar ���
q 0 tmDefaultChar
q 2 tmBreakChar ��
4 tmItalic �
5 tmUnderlined �
6 tmStruckOut ��
7 tmPitchAndFamily �
8 tmCharSet
" < ntmFlags �
u @ ntmSizeEM
u D ntmCellHeight
u H ntmAvgWidth ��> �# L tagNEWTEXTMETRICW .?AUtagNEWTEXTMETRICW@@ �# � �
� >
" LowPart ��
High1Time
High2Time 6 $ _KSYSTEM_TIME .?AU_KSYSTEM_TIME@@ $ L /
p F � _ENUM_SERVICE_STATUSA .?AU_ENUM_SERVICE_STATUSA@@
$ J
p lpServiceName
p lpDisplayName
� ServiceStatus F $ 0 _ENUM_SERVICE_STATUSA .?AU_ENUM_SERVICE_STATUSA@@ $ � � 6 � tagWINDOWINFO .?AUtagWINDOWINFO@@ �
" cbSize ���
! rcWindow �
! rcClient �
" $ dwStyle ��
" ( dwExStyle
" , dwWindowStatus ���
u 0 cxWindowBorders ��
u 4 cyWindowBorders ��
! 8 atomWindowType ���
! : wCreatorVersion ��6
$ < tagWINDOWINFO .?AUtagWINDOWINFO@@
$ �8 r � _PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION .?AU_PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION@@ 6
DynamicFunctionTable �
Remove ���r $ _PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION .?AU_PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION@@ $ � N B � _TOKEN_DEFAULT_DACL .?AU_TOKEN_DEFAULT_DACL@@
�" DefaultDacl ��B $ _TOKEN_DEFAULT_DACL .?AU_TOKEN_DEFAULT_DACL@@ $ x � # %
$
{
� B WorkerFactoryTimeout � WorkerFactoryRetryTimeout WorkerFactoryIdleTimeout � WorkerFactoryBindingCount WorkerFactoryThreadMinimum ��� WorkerFactoryThreadMaximum ��� WorkerFactoryPaused �� WorkerFactoryBasicInformation WorkerFactoryAdjustThreadGoal WorkerFactoryCallbackType
WorkerFactoryStackInformation WorkerFactoryThreadBasePriority �� WorkerFactoryTimeoutWaiters ��
WorkerFactoryFlags ��� WorkerFactoryThreadSoftMaximum ��� WorkerFactoryThreadCpuSets ��� MaxWorkerFactoryInfoClass F t $ _WORKERFACTORYINFOCLASS .?AW4_WORKERFACTORYINFOCLASS@@ � $ � � ResponseReturnToCaller ��� ResponseNotHandled ��� ResponseAbort ResponseCancel ��� ResponseIgnore ��� ResponseNo ��� ResponseOk ��� ResponseRetry ResponseYes �� ResponseTryAgain �
ResponseContinue �> t $ _HARDERROR_RESPONSE .?AW4_HARDERROR_RESPONSE@@ � $ � � B � tagLOCALESIGNATURE .?AUtagLOCALESIGNATURE@@ ��
!$ " " � " " �F
#$ lsUsb
$$ lsCsbDefault �
$$ lsCsbSupported ���B %$ tagLOCALESIGNATURE .?AUtagLOCALESIGNATURE@@ �� &$ � � � MemoryNotContiguous �� MemoryAlignedAndContiguous ��� MemoryNotResident MemoryNotEligibleToMakeContiguous MemoryContiguityStateMax �f t ($ _MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE .?AW4_MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE@@ ��� )$ t � R DCDC_DEFAULT � DCDC_DISABLE_FONT_UPDATE � DCDC_DISABLE_RELAYOUT ^ t +$ DIALOG_CONTROL_DPI_CHANGE_BEHAVIORS .?AW4DIALOG_CONTROL_DPI_CHANGE_BEHAVIORS@@ � ,$ � N � _SERVICE_TIMECHANGE_INFO .?AU_SERVICE_TIMECHANGE_INFO@@ ��*
� liNewTime
� liOldTime N /$ _SERVICE_TIMECHANGE_INFO .?AU_SERVICE_TIMECHANGE_INFO@@ �� 0$ � � 6 � tagCURSORINFO .?AUtagCURSORINFO@@ * � HICON__ .?AUHICON__@@
3$ R
" cbSize ���
" flags
4$ hCursor ��
� ptScreenPos ��6 5$ tagCURSORINFO .?AUtagCURSORINFO@@ 6$ �8 � DISPLAYCONFIG_ROTATION_IDENTITY �� DISPLAYCONFIG_ROTATION_ROTATE90 �� DISPLAYCONFIG_ROTATION_ROTATE180 � DISPLAYCONFIG_ROTATION_ROTATE270 � ��DISPLAYCONFIG_ROTATION_FORCE_UINT32 �F t 8$ DISPLAYCONFIG_ROTATION .?AW4DISPLAYCONFIG_ROTATION@@ ��� 9$ � A j � _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 .?AU_KEY_VALUE_PARTIAL_INFORMATION_ALIGN64@@ ��
;$ :
" Type �
" DataLength ���
� Data �j =$ _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 .?AU_KEY_VALUE_PARTIAL_INFORMATION_ALIGN64@@ �� >$ ` TimerBasicInformation J t @$ _TIMER_INFORMATION_CLASS .?AW4_TIMER_INFORMATION_CLASS@@ ��� A$ � � N � _FSCTL_UNMAP_SPACE_OUTPUT .?AU_FSCTL_UNMAP_SPACE_OUTPUT@@
� BytesUnmapped N D$ _FSCTL_UNMAP_SPACE_OUTPUT .?AU_FSCTL_UNMAP_SPACE_OUTPUT@@ E$ � �* Z � _ETW_TP_EVENT_CALLBACK_ENQUEUE .?AU_ETW_TP_EVENT_CALLBACK_ENQUEUE@@ ��
G$ ~
j Header ���
PoolId ���
( TaskId ���
0 Callback �
8 Context ��
@ SubProcessTag Z I$ H _ETW_TP_EVENT_CALLBACK_ENQUEUE .?AU_ETW_TP_EVENT_CALLBACK_ENQUEUE@@ �� J$ c � ^ � _SYSTEM_DPC_BEHAVIOR_INFORMATION .?AU_SYSTEM_DPC_BEHAVIOR_INFORMATION@@ ��~
" Spare
" DpcQueueDepth
" MinimumDpcRate ���
" AdjustDpcThreshold ���
" IdealDpcRate �^ M$ _SYSTEM_DPC_BEHAVIOR_INFORMATION .?AU_SYSTEM_DPC_BEHAVIOR_INFORMATION@@ �� N$ � �
_ B
" NodeNumber ���
� Reserved �
& GroupMask J Q$ ( _NUMA_NODE_RELATIONSHIP .?AU_NUMA_NODE_RELATIONSHIP@@ R$ � % N � _POOLED_USAGE_AND_LIMITS .?AU_POOLED_USAGE_AND_LIMITS@@ ��
# PeakPagedPoolUsage ���
# PagedPoolUsage ���
# PagedPoolLimit ���
# PeakNonPagedPoolUsage
# NonPagedPoolUsage
# ( NonPagedPoolLimit
# 0 PeakPagefileUsage
# 8 PagefileUsage
# @ PagefileLimit N U$ H _POOLED_USAGE_AND_LIMITS .?AU_POOLED_USAGE_AND_LIMITS@@ �� V$ ? l 6 � _ETW_UMGL_KEY .?AU_ETW_UMGL_KEY@@ &
LoggerId �
Flags 6 Y$ _ETW_UMGL_KEY .?AU_ETW_UMGL_KEY@@ Z$ A R R � _PERFINFO_CC_CAN_WRITE_FAIL .?AU_PERFINFO_CC_CAN_WRITE_FAIL@@ n
# FileObjectKey
# TotalDirtyPages ��
# DirtyPageThreshold ���
" BytesToWrite �R ]$ _PERFINFO_CC_CAN_WRITE_FAIL .?AU_PERFINFO_CC_CAN_WRITE_FAIL@@ ^$ c � V � _ETW_TP_EVENT_POOL_TH_MAX_SET .?AU_ETW_TP_EVENT_POOL_TH_MAX_SET@@ >
j Header ���
PoolId ���
" ( ThreadNum V a$ 0 _ETW_TP_EVENT_POOL_TH_MAX_SET .?AU_ETW_TP_EVENT_POOL_TH_MAX_SET@@ b$ c � " P ��
" ControlWord ��
" StatusWord ���
" TagWord ��
" ErrorOffset ��
" ErrorSelector
" DataOffset ���
" DataSelector �
d$ RegisterArea �
" l Cr0NpxState ��N e$ p _WOW64_FLOATING_SAVE_AREA .?AU_WOW64_FLOATING_SAVE_AREA@@ f$ � B V � _PERFINFO_PPM_STATE_SELECTION .?AU_PERFINFO_PPM_STATE_SELECTION@@
h$ J
" SelectedState
" VetoedStates �
� VetoReason ���V j$ _PERFINFO_PPM_STATE_SELECTION .?AU_PERFINFO_PPM_STATE_SELECTION@@ k$ c ,
e "
cx ���
cy ���* n$ tagSIZE .?AUtagSIZE@@ o$ t � J � _RTL_SPARSE_BITMAP_RUN .?AU_RTL_SPARSE_BITMAP_RUN@@ ��
q$ b
" StartingIndexLow �
" StartingIndexHigh
" Length ���
Metadata �J s$ _RTL_SPARSE_BITMAP_RUN .?AU_RTL_SPARSE_BITMAP_RUN@@ �� t$ �
� R � IMAGE_AUX_SYMBOL_TOKEN_DEF .?AUIMAGE_AUX_SYMBOL_TOKEN_DEF@@ ��
w$ ��
x$ ^
bAuxType �
bReserved
" SymbolTableIndex �
q rgbReserved ��R z$ IMAGE_AUX_SYMBOL_TOKEN_DEF .?AUIMAGE_AUX_SYMBOL_TOKEN_DEF@@ �� {$ � J � _RTL_RETPOLINE_ROUTINES .?AU_RTL_RETPOLINE_ROUTINES@@ �
" UnwindDataOffset �
k SwitchtableJump ��
" D CfgIndirectRax ���
" H NonCfgIndirectRax
" L ImportR10 J ~$ P _RTL_RETPOLINE_ROUTINES .?AU_RTL_RETPOLINE_ROUTINES@@ $ X J � _REG_NOTIFY_INFORMATION .?AU_REG_NOTIFY_INFORMATION@@ : KeyAdded � KeyRemoved ��� KeyModified ��. t �$ _REG_ACTION .?AW4_REG_ACTION@@ � �$ � b V
" NextEntryOffset ��
�$ Action ���
" KeyLength
| Key ��J �$ _REG_NOTIFY_INFORMATION .?AU_REG_NOTIFY_INFORMATION@@ �$ � h N LowMemoryResourceNotification HighMemoryResourceNotification ���^ t �$ _MEMORY_RESOURCE_NOTIFICATION_TYPE .?AW4_MEMORY_RESOURCE_NOTIFICATION_TYPE@@ ��� �$ � � F � _RTL_DISK_SPACE_INFO .?AU_RTL_DISK_SPACE_INFO@@ ��
�$ � RtlDiskSpacePolicyVeryLow
RtlDiskSpacePolicyLow RtlDiskSpacePolicyBelowNormal RtlDiskSpacePolicyNormal �B t �$ RTL_DISK_SPACE_POLICY .?AW4RTL_DISK_SPACE_POLICY@@ � �$ '
�$ Policy ���F �$ _RTL_DISK_SPACE_INFO .?AU_RTL_DISK_SPACE_INFO@@ �� �$ . ^ � _ETW_PARTITION_INFO_EXTENSION_V2 .?AU_ETW_PARTITION_INFO_EXTENSION_V2@@ ��b
! EventVersion �
! Reserved �
" PartitionType
� QpcOffsetFromRoot ^ �$ _ETW_PARTITION_INFO_EXTENSION_V2 .?AU_ETW_PARTITION_INFO_EXTENSION_V2@@ �� �$ A � 6 � tagSTYLEBUFA .?AUtagSTYLEBUFA@@ ��.
" dwStyle ��
|" szDescription 6 �$ $ tagSTYLEBUFA .?AUtagSTYLEBUFA@@ �� �$ � � � RtlRXactOperationDelete �� RtlRXactOperationSetValue RtlRXactOperationDelAttribute RtlRXactOperationSetAttribute B t �$ _RTL_RXACT_OPERATION .?AW4_RTL_RXACT_OPERATION@@ ��� �$ � � j MonitorRequestTypeOff MonitorRequestTypeOnAndPresent ��� MonitorRequestTypeToggleOn ���N t �$ _POWER_MONITOR_REQUEST_TYPE .?AW4_POWER_MONITOR_REQUEST_TYPE@@ � �$ x N J � _CI_LOG_SCHEDULER_EVENT .?AU_CI_LOG_SCHEDULER_EVENT@@ f
Header ���
" 0 ProcessId
" 4 ThreadId �
" 8 Priority �
" < TaskIndex J �$ @ _CI_LOG_SCHEDULER_EVENT .?AU_CI_LOG_SCHEDULER_EVENT@@ �$ c B 2 � _WOW64INFO .?AU_WOW64INFO@@ ��V � _ETW_COVERAGE_SAMPLER_OPTIONS .?AU_ETW_COVERAGE_SAMPLER_OPTIONS@@ q " �
: Flags
" HashSeed �
" ImageLruSize �
" SampleTableMinEntries
" SampleTableMaxEntries
" SampleTableMaxQueued �
" SampleBufferSize �
" SampleBufferMaxCountPerProc ��
" CaptureBufferMaxCountPerProc �
" $ ApcMaxCountPerProc ���
" ( ProfileSamplePeriodUS
" , ProfileSampleCountPerPeriod ��
" 0 CSwitchSamplePeriodUS
" 4 CSwitchSampleCountPerPeriod ��
" 8 RThreadSamplePeriodUS
" < RThreadSampleCountPerPeriod ��
" @ PGFaultSamplePeriodUS
" D PGFaultSampleCountPerPeriod ��
" H StackDepth ���
" L StackCacheEntries
�$ P PathInclusionList
�$ PPathExclusionList V �$ P_ETW_COVERAGE_SAMPLER_OPTIONS .?AU_ETW_COVERAGE_SAMPLER_OPTIONS@@ �$ A
�" . � __n128x4 .?AU__n128x4@@ �� ] " @ �
�$ val ��. �$ @ __n128x4 .?AU__n128x4@@ �� �$ * � F � _WMI_DELAY_EXECUTION .?AU_WMI_DELAY_EXECUTION@@ ��&
" ThreadId �
# Delta F �$ _WMI_DELAY_EXECUTION .?AU_WMI_DELAY_EXECUTION@@ �� �$ c �
� Z � _ALPC_PORT_CALLBACK_INFORMATION .?AU_ALPC_PORT_CALLBACK_INFORMATION@@ 2
CallbackObject ���
Context ��Z �$ _ALPC_PORT_CALLBACK_INFORMATION .?AU_ALPC_PORT_CALLBACK_INFORMATION@@ �$ � , . � tagEMREOF .?AUtagEMREOF@@ V
� emr ��
" nPalEntries ��
" offPalEntries
" nSizeLast . �$ tagEMREOF .?AUtagEMREOF@@ �$ � �
& N � _TOKEN_ACCESS_INFORMATION .?AU_TOKEN_ACCESS_INFORMATION@@
\ > � _TOKEN_PRIVILEGES .?AU_TOKEN_PRIVILEGES@@
�$ 2 TokenPrimary � TokenImpersonation ���. t �$ _TOKEN_TYPE .?AW4_TOKEN_TYPE@@ � �$ x ! R
�$ SidHash ��
�$ RestrictedSidHash
�$ Privileges ���
� AuthenticationId �
�$ TokenType
� $ ImpersonationLevel ���
� ( MandatoryPolicy ��
" , Flags
" 0 AppContainerNumber ���
8 PackageSid ���
�$ @ CapabilitiesHash �
H TrustLevelSid
P SecurityAttributes ���N
�$ X _TOKEN_ACCESS_INFORMATION .?AU_TOKEN_ACCESS_INFORMATION@@ �$ x � � KeyValueBasicInformation � KeyValueFullInformation �� KeyValuePartialInformation ��� KeyValueFullInformationAlign64 ��� KeyValuePartialInformationAlign64 KeyValueLayerInformation � MaxKeyValueInfoClass �R t �$ _KEY_VALUE_INFORMATION_CLASS .?AW4_KEY_VALUE_INFORMATION_CLASS@@ ��� �$ r : � _RTL_AVL_TABLE .?AU_RTL_AVL_TABLE@@ ��
�$ B � _RTL_BALANCED_LINKS .?AU_RTL_BALANCED_LINKS@@
�$ J GenericLessThan �� GenericGreaterThan ��� GenericEqual �R t �$ _RTL_GENERIC_COMPARE_RESULTS .?AW4_RTL_GENERIC_COMPARE_RESULTS@@ ��� �$ b O
�$ �$ �$ �$
�$ �$ " �$
�$ �$ �$
�$ .
�$ BalancedRoot �
OrderedPointer ���
" ( WhichOrderedElement ��
" , NumberGenericTableElements ���
" 0 DepthOfTree ��
�$ 8 RestartKey ���
" @ DeleteCount ��
�$ H CompareRoutine ���
�$ P AllocateRoutine ��
�$ X FreeRoutine ��
` TableContext �: �$ h _RTL_AVL_TABLE .?AU_RTL_AVL_TABLE@@ �� �$ b � � ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_OTHER ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HD15 � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SVIDEO ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPOSITE_VIDEO �� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPONENT_VIDEO �� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DVI �� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HDMI � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_LVDS � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_D_JPN DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDI ��
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EXTERNAL � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EMBEDDED � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EXTERNAL �
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EMBEDDED � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDTVDONGLE ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_MIRACAST � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_WIRED ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_VIRTUAL � � �DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INTERNAL � ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_FORCE_UINT32 b t �$ DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY .?AW4DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY@@ � �$ � �
�
F � _RTL_DISK_SPEED_INFO .?AU_RTL_DISK_SPEED_INFO@@ ��B
RtlDiskSpeedPolicyNormal � RtlDiskSpeedPolicyFast ���B t �$ RTL_DISK_SPEED_POLICY .?AW4RTL_DISK_SPEED_POLICY@@ � �$
�$ Policy ���F �$ _RTL_DISK_SPEED_INFO .?AU_RTL_DISK_SPEED_INFO@@ �� �$ # � NotAppContainerSidType ��� ChildAppContainerSidType � ParentAppContainerSidType InvalidAppContainerSidType ��� MaxAppContainerSidType ���F t �$ _APPCONTAINER_SID_TYPE .?AW4_APPCONTAINER_SID_TYPE@@ ��� �$ b �" ^ � _IO_COMPLETION_BASIC_INFORMATION .?AU_IO_COMPLETION_BASIC_INFORMATION@@ ��
Depth ^ �$ _IO_COMPLETION_BASIC_INFORMATION .?AU_IO_COMPLETION_BASIC_INFORMATION@@ �� �$ @! C J � RETRIEVAL_POINTER_COUNT .?AURETRIEVAL_POINTER_COUNT@@
" ExtentCount ��J �$ RETRIEVAL_POINTER_COUNT .?AURETRIEVAL_POINTER_COUNT@@ �$ � �
J � _ETW_READY_THREAD_EVENT .?AU_ETW_READY_THREAD_EVENT@@
��
��
��
��
��
" ThreadId �
AdjustReason �
p AdjustIncrement ��
�$ ExecutingDpc �
�$ KernelStackNotResident ���
�$ ProcessOutOfMemory ���
�$ DirectSwitchAttempt ��
�$ Reserved �
Flags
SpareByte J
�$ _ETW_READY_THREAD_EVENT .?AU_ETW_READY_THREAD_EVENT@@ �$ c �
J"
C *
D As32Bit ��
! As64Bit ��B % � _PEBS_DS_SAVE_AREA .?AU_PEBS_DS_SAVE_AREA@@ �� % � � � PsWakeReasonUser � PsWakeReasonExecutionRequired PsWakeReasonKernel ��� PsWakeReasonInstrumentation �� PsWakeReasonPreserveProcess �� PsWakeReasonActivityReference PsWakeReasonWorkOnBehalf � PsMaxWakeReasons �6 t % _PS_WAKE_REASON .?AW4_PS_WAKE_REASON@@ � % � ^ � _ETW_COVERAGE_SAMPLER_CREATE_INFO .?AU_ETW_COVERAGE_SAMPLER_CREATE_INFO@@
% b � _ETW_COVERAGE_SAMPLER_BLOOM_FILTER .?AU_ETW_COVERAGE_SAMPLER_BLOOM_FILTER@@ ��V
$ Common ���
�$ Options ��
% `Bloom
# xSamplesReadyEvent ^ % �_ETW_COVERAGE_SAMPLER_CREATE_INFO .?AU_ETW_COVERAGE_SAMPLER_CREATE_INFO@@ % A
� . � tagEMRARC .?AUtagEMRARC@@ N
� emr ��
d rclBox ���
� ptlStart �
� ptlEnd ���. % ( tagEMRARC .?AUtagEMRARC@@ % � % : � _GRADIENT_RECT .?AU_GRADIENT_RECT@@ ��.
" UpperLeft
" LowerRight ���: % _GRADIENT_RECT .?AU_GRADIENT_RECT@@ �� % � : ~ Width8Bits ��� Width16Bits �� Width32Bits �� Width64Bits �� WidthNoWrap �� MaximumDmaWidth ��. t % _DMA_WIDTH .?AW4_DMA_WIDTH@@ ��� % � �+
% ^ � _FILE_PIPE_CLIENT_PROCESS_BUFFER .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER@@ ��
% 2
ClientSession
ClientProcess ^ % _FILE_PIPE_CLIENT_PROCESS_BUFFER .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER@@ �� % � 1) J � _HEAP_RANGE_INFORMATION .?AU_HEAP_RANGE_INFORMATION@@ �
# Address ��
# Size �
" Type �
" Protection ���
# FirstBlockInformationOffset ��
# NextRangeInformationOffset ���J !% ( _HEAP_RANGE_INFORMATION .?AU_HEAP_RANGE_INFORMATION@@ "% � � f � _HEAP_OPTIMIZE_RESOURCES_INFORMATION .?AU_HEAP_OPTIMIZE_RESOURCES_INFORMATION@@ ��
$% &
" Version ��
" Flags f &% _HEAP_OPTIMIZE_RESOURCES_INFORMATION .?AU_HEAP_OPTIMIZE_RESOURCES_INFORMATION@@ �� '% � | Z � _PROCESS_ENERGY_TRACKING_STATE .?AU_PROCESS_ENERGY_TRACKING_STATE@@ ��
" ��v
" StateUpdateMask ��
" StateDesiredValue
" StateSequence
*% UpdateTag
Tag ��Z +% � _PROCESS_ENERGY_TRACKING_STATE .?AU_PROCESS_ENERGY_TRACKING_STATE@@ �� ,% � p Z � _SERVICE_LAUNCH_PROTECTED_INFO .?AU_SERVICE_LAUNCH_PROTECTED_INFO@@ ��
.%
" dwLaunchProtected Z 0% _SERVICE_LAUNCH_PROTECTED_INFO .?AU_SERVICE_LAUNCH_PROTECTED_INFO@@ �� 1% � � R � _FILE_NUMA_NODE_INFORMATION .?AU_FILE_NUMA_NODE_INFORMATION@@
! NodeNumber ���R 4% _FILE_NUMA_NODE_INFORMATION .?AU_FILE_NUMA_NODE_INFORMATION@@ 5% �
� MemoryTypePaged �� MemoryTypeNonPaged ��� MemoryTypeLargePage �� MemoryTypeHugePage ��� MemoryTypeMax : t 7% _RTL_MEMORY_TYPE .?AW4_RTL_MEMORY_TYPE@@ ��� 8% b �
V � _NDR_CS_SIZE_CONVERT_ROUTINES .?AU_NDR_CS_SIZE_CONVERT_ROUTINES@@ Z IDL_CS_NO_CONVERT IDL_CS_IN_PLACE_CONVERT �� IDL_CS_NEW_BUFFER_CONVERT 6 t ;% _IDL_CS_CONVERT .?AW4_IDL_CS_CONVERT@@ � <% � �
<% " " >% " " ?%
@%
y"
@% & " " " " " D%
E% b
A% pfnNetSize ���
B% pfnToNetCs ���
C% pfnLocalSize �
F% pfnFromNetCs �V G% _NDR_CS_SIZE_CONVERT_ROUTINES .?AU_NDR_CS_SIZE_CONVERT_ROUTINES@@ H% � � F � _CONSOLE_FONT_INFOEX .?AU_CONSOLE_FONT_INFOEX@@ ��
" cbSize ���
" nFont
�" dwFontSize ���
u FontFamily ���
u FontWeight ���
FaceName �F K% T _CONSOLE_FONT_INFOEX .?AU_CONSOLE_FONT_INFOEX@@ ��6 onecore\external\sdk\inc\mincore\consoleapi3.h � L% M% B B � _SE_ACCESS_REQUEST .?AU_SE_ACCESS_REQUEST@@ ��
N# > � _GENERIC_MAPPING .?AU_GENERIC_MAPPING@@ ��
Q% > � _OBJECT_TYPE_LIST .?AU_OBJECT_TYPE_LIST@@
S% �
" Size �
P% SeSecurityDescriptor �
" DesiredAccess
" PreviouslyGrantedAccess ��
PrincipalSelfSid �
R% GenericMapping ���
" ( ObjectTypeListCount ��
T% 0 ObjectTypeList ���B U% 8 _SE_ACCESS_REQUEST .?AU_SE_ACCESS_REQUEST@@ �� V% x �
% � � � Y% : � _XSTATE_FEATURE .?AU_XSTATE_FEATURE@@ &
" Offset ���
" Size �: \% _XSTATE_FEATURE .?AU_XSTATE_FEATURE@@ ]% � _ j � _REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER .?AU_REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER@@ ��
ResetCounters j `% _REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER .?AU_REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER@@ �� a% � �) ^ PdataRefToFullXdata �� PdataPackedUnwindFunction PdataPackedUnwindFragment > t c% ARM64_FNPDATA_FLAGS .?AW4ARM64_FNPDATA_FLAGS@@ � d% � � 6 � provider_info .?AUprovider_info@@ 2 � val_context .?AUval_context@@
g% h% " " " " i%
j% �
k% pi_R0_1val ���
k% pi_R0_allvals
k% pi_R3_1val ���
k% pi_R3_allvals
" pi_flags �
( pi_key_context ���6 l% 0 provider_info .?AUprovider_info@@ m% � � : � tagWNDCLASSEXA .?AUtagWNDCLASSEXA@@ �� � u # p%
q%
3$
u cbSize ���
u style
r% lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
5 hInstance
s% hIcon
4$ ( hCursor ��
Z! 0 hbrBackground
� 8 lpszMenuName �
� @ lpszClassName
s% H hIconSm ��: t% P tagWNDCLASSEXA .?AUtagWNDCLASSEXA@@ �� u% �
� � p t x%
y% r
W ThreadListHead ���
CompletionEvent ��
" CompletionFlags ��
V InternalListHead �N {% _RTL_UMS_COMPLETION_LIST .?AU_RTL_UMS_COMPLETION_LIST@@ �� |% b �! : � tagEMRGLSRECORD .?AUtagEMRGLSRECORD@@ 6
� emr ��
" cbData ���
� Data �: % tagEMRGLSRECORD .?AUtagEMRGLSRECORD@@ �% � �
� p p u p �% " �%
�% F � _KEY_NODE_INFORMATION .?AU_KEY_NODE_INFORMATION@@
�% �
� LastWriteTime
" TitleIndex ���
" ClassOffset ��
" ClassLength ��
" NameLength ���
| Name �F �% _KEY_NODE_INFORMATION .?AU_KEY_NODE_INFORMATION@@ �% � * � pvalueW .?AUpvalueW@@
�% b
q pv_valuename �
t pv_valuelen ��
pv_value_context �
" pv_type ��* �% pvalueW .?AUpvalueW@@ �% � � � CmExtendedParameterInvalidType ��� CmExtendedParameterTrustClassKey � CmExtendedParameterEvent � CmExtendedParameterFileAccessToken ��� CmExtendedParameterMax ���N t �% CM_EXTENDED_PARAMETER_TYPE .?AW4CM_EXTENDED_PARAMETER_TYPE@@ ��� �% �
�%
% r � _MEMORY_PARTITION_CONFIGURATION_INFORMATION .?AU_MEMORY_PARTITION_CONFIGURATION_INFORMATION@@ # " @ ��
" Flags
" NumaNode �
" Channel ��
" NumberOfNumaNodes
# ResidentAvailablePages ���
# CommittedPages ���
# CommitLimit ��
# ( PeakCommitment ���
# 0 TotalNumberOfPages ���
# 8 AvailablePages ���
# @ ZeroPages
# H FreePages
# P StandbyPages �
�% X StandbyPageCountByPriority ���
�% � RepurposedPagesByPriority
# � MaximumCommitLimit ���
# � DonatedPagesToPartitions �
" � PartitionId ��r �% � _MEMORY_PARTITION_CONFIGURATION_INFORMATION .?AU_MEMORY_PARTITION_CONFIGURATION_INFORMATION@@ �% t �
�
� # " x �
ExceptionCode
" ExceptionFlags ���
�% ExceptionRecord ��
ExceptionAddress �
" NumberParameters �
�% ExceptionInformation �> �% � _EXCEPTION_RECORD .?AU_EXCEPTION_RECORD@@ . onecore\internal\sdk\inc\ntxcapi_x.h ��� �% �% M V � _TOKEN_SECURITY_ATTRIBUTE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_V1@@ ��f � _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE@@ ��
�% v � _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ ��
�% f
pInt64 ���
# pUint64 ��
v pString ��
�% pFqbn
�% pOctetString �2 �% <anonymous-tag> .?AT<anonymous-tag>@@ �% � � v
Name �
! ValueType
! Reserved �
" Flags
" ValueCount ���
�% Values ���V �% ( _TOKEN_SECURITY_ATTRIBUTE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_V1@@ �� �% � � F � _PERFINFO_CCSWAP_IDLE .?AU_PERFINFO_CCSWAP_IDLE@@
�%
" ��
" ��*
�% DataType �
�% TimeDelta F �% _PERFINFO_CCSWAP_IDLE .?AU_PERFINFO_CCSWAP_IDLE@@ �% c � %
�% �% [ �% R � _UNIQUE_PROCESS_INFORMATION .?AU_UNIQUE_PROCESS_INFORMATION@@
# ��
# 0 ��
# 9��F
�% DontUse ��
�% UniqueProcessKey �
�% Reserved �R �% _UNIQUE_PROCESS_INFORMATION .?AU_UNIQUE_PROCESS_INFORMATION@@ �% t V � _ACCESS_ALLOWED_CALLBACK_ACE .?AU_ACCESS_ALLOWED_CALLBACK_ACE@@ ��:
� Header ���
" Mask �
" SidStart �V �% _ACCESS_ALLOWED_CALLBACK_ACE .?AU_ACCESS_ALLOWED_CALLBACK_ACE@@ �� �% x �
� ��
�% " �% �%
�% B � tagCOMPOSITIONFORM .?AUtagCOMPOSITIONFORM@@ ��
�% B
" dwStyle ��
� ptCurrentPos �
! rcArea ���B �% tagCOMPOSITIONFORM .?AUtagCOMPOSITIONFORM@@ �� �% � 5 R � _WMI_JOB_SET_QUERY_CPU_RATE .?AU_WMI_JOB_SET_QUERY_CPU_RATE@@ &
" AllFlags �
" Value R �% _WMI_JOB_SET_QUERY_CPU_RATE .?AU_WMI_JOB_SET_QUERY_CPU_RATE@@ �% c � ^ � _ACTIVATION_CONTEXT_ASSEMBLY_DATA .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DATA@@
� �
" Size �
" Flags
�% AssemblyName �
" AssemblyNameLength ���
" HashAlgorithm
" PseudoKey ^ �% _ACTIVATION_CONTEXT_ASSEMBLY_DATA .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DATA@@ �% �
v � _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION .?AU_JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION@@ ��
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
� ( OldLastWriteTime �
� 0 NewLastWriteTime �v �% 8 _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION .?AU_JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION@@ �� �% � �
z N � tagEMRSCALEVIEWPORTEXTEX .?AUtagEMRSCALEVIEWPORTEXTEX@@ ��Z
� emr ��
xNum �
xDenom ���
yNum �
yDenom ���N �% tagEMRSCALEVIEWPORTEXTEX .?AUtagEMRSCALEVIEWPORTEXTEX@@ �� �% � �
&! �
Allocated
Spare0 ���
! AllocatorBackTraceIndex ��
" Size �
Tag ��
" TagUlong �
ProcessChargedQuota ��B �% _SYSTEM_POOL_ENTRY .?AU_SYSTEM_POOL_ENTRY@@ �� �% � _
6 � _WMI_REGISTRY .?AU_WMI_REGISTRY@@
�% r
InitialTime ��
" Status ���
" Index
" InfoClass
Kcb ��
| Name �6 �% _WMI_REGISTRY .?AU_WMI_REGISTRY@@ �% c � J � _STACK_WALK_EVENT_DATA .?AU_STACK_WALK_EVENT_DATA@@ ��R
# TimeStamp
" ProcessId
" ThreadId �
| Addresses J �% _STACK_WALK_EVENT_DATA .?AU_STACK_WALK_EVENT_DATA@@ �� �% c
�% : � _CLUSTER_RANGE .?AU_CLUSTER_RANGE@@ ��
�% 6
� StartingCluster ��
� ClusterCount �: �% _CLUSTER_RANGE .?AU_CLUSTER_RANGE@@ �� �% � � Z � _QUERY_BAD_RANGES_OUTPUT_RANGE .?AU_QUERY_BAD_RANGES_OUTPUT_RANGE@@ ��V
" Flags
" Reserved �
# StartOffset ��
# LengthInBytes Z �% _QUERY_BAD_RANGES_OUTPUT_RANGE .?AU_QUERY_BAD_RANGES_OUTPUT_RANGE@@ �� �% � 7! b � _PERFINFO_SYSTEM_MEMORY_INFORMATION .?AU_PERFINFO_SYSTEM_MEMORY_INFORMATION@@ z
# PagedPoolCommitPageCount �
# NonPagedPoolPageCount
# MdlPageCount �
# CommitPageCount ��b �% _PERFINFO_SYSTEM_MEMORY_INFORMATION .?AU_PERFINFO_SYSTEM_MEMORY_INFORMATION@@ �% c � R � _ETW_IDEAL_PROCESSOR_EVENT .?AU_ETW_IDEAL_PROCESSOR_EVENT@@ ��N
" ThreadId �
" OldIdealProcessor
" NewIdealProcessor R �% _ETW_IDEAL_PROCESSOR_EVENT .?AU_ETW_IDEAL_PROCESSOR_EVENT@@ �� �% c
Y f � _PROCESS_KEEPALIVE_COUNT_INFORMATION .?AU_PROCESS_KEEPALIVE_COUNT_INFORMATION@@ ��
�% .
" WakeCount
" NoWakeCount ��f & _PROCESS_KEEPALIVE_COUNT_INFORMATION .?AU_PROCESS_KEEPALIVE_COUNT_INFORMATION@@ �� & ? 1 N � _ETW_CANCEL_KTIMER2_EVENT .?AU_ETW_CANCEL_KTIMER2_EVENT@@
# TimerKey �N & _ETW_CANCEL_KTIMER2_EVENT .?AU_ETW_CANCEL_KTIMER2_EVENT@@ & c �
� ^ � _TXFS_READ_BACKUP_INFORMATION_OUT .?AU_TXFS_READ_BACKUP_INFORMATION_OUT@@ .
" BufferLength �
� Buffer ���^
& _TXFS_READ_BACKUP_INFORMATION_OUT .?AU_TXFS_READ_BACKUP_INFORMATION_OUT@@ & � ` F � _THREAD_ENERGY_VALUES .?AU_THREAD_ENERGY_VALUES@@
& 6 � _TIMELINE_BITMAP .?AT_TIMELINE_BITMAP@@ ��j
= Cycles ���
= @ AttributedCycles �
= � WorkOnBehalfCycles ���
& � CpuTimeline ��F & � _THREAD_ENERGY_VALUES .?AU_THREAD_ENERGY_VALUES@@ & � � � _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION .?AU_SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION@@ "
EfiLauncherEnabled ��� & _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION .?AU_SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION@@ & � � N � _LDR_ENUM_RESOURCE_ENTRY .?AU_LDR_ENUM_RESOURCE_ENTRY@@ ��
N
# NameOrId �
& Name �
! Id ���
! NameIsPresent 2 & <anonymous-tag> .?AT<anonymous-tag>@@ & � a & " �F
& Path �
Data �
" Size �
" $ Reserved �N & ( _LDR_ENUM_RESOURCE_ENTRY .?AU_LDR_ENUM_RESOURCE_ENTRY@@ �� & � ` b � _SYSTEM_REGISTRY_QUOTA_INFORMATION .?AU_SYSTEM_REGISTRY_QUOTA_INFORMATION@@ ��V
" RegistryQuotaAllowed �
" RegistryQuotaUsed
# PagedPoolSize b !& _SYSTEM_REGISTRY_QUOTA_INFORMATION .?AU_SYSTEM_REGISTRY_QUOTA_INFORMATION@@ �� "& � � R � _PERFINFO_BATTERY_LIFE_INFO .?AU_PERFINFO_BATTERY_LIFE_INFO@@ .
" RemainingCapacity
" Rate �R %& _PERFINFO_BATTERY_LIFE_INFO .?AU_PERFINFO_BATTERY_LIFE_INFO@@ && c / b � _WIM_PROVIDER_SUSPEND_OVERLAY_INPUT .?AU_WIM_PROVIDER_SUSPEND_OVERLAY_INPUT@@
(&
� DataSourceId �b *& _WIM_PROVIDER_SUSPEND_OVERLAY_INPUT .?AU_WIM_PROVIDER_SUSPEND_OVERLAY_INPUT@@ +& � 7" B � _ALPC_CONTEXT_ATTR .?AU_ALPC_CONTEXT_ATTR@@ ��v
PortContext ��
MessageContext ���
" Sequence �
" MessageId
" CallbackId ���B .& _ALPC_CONTEXT_ATTR .?AU_ALPC_CONTEXT_ATTR@@ �� /& �
�% f � _JOURNAL_SET_DELETE_VALUE_INFORMATION .?AU_JOURNAL_SET_DELETE_VALUE_INFORMATION@@ �
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
( ValueName
" 8 OldValueType �
" < OldDataLength
@ OldData ��
" H NewValueType �
" L NewDataLength
P NewData ��f 3& X _JOURNAL_SET_DELETE_VALUE_INFORMATION .?AU_JOURNAL_SET_DELETE_VALUE_INFORMATION@@ 4& � � KeyWriteTimeInformation �� KeyWow64FlagsInformation � KeyControlFlagsInformation ��� KeySetVirtualizationInformation �� KeySetDebugInformation ��� KeySetHandleTagsInformation �� KeySetLayerInformation ��� MaxKeySetInfoClass ���N t 6& _KEY_SET_INFORMATION_CLASS .?AW4_KEY_SET_INFORMATION_CLASS@@ ��� 7& 8 N � _QUERY_FILE_LAYOUT_INPUT .?AU_QUERY_FILE_LAYOUT_INPUT@@ ��
9& �% " �F � _FILE_REFERENCE_RANGE .?AU_FILE_REFERENCE_RANGE@@ <& " �V
;& ClusterRanges
=& FileReferenceRanges ��
t StorageReserveIds 2 >& <anonymous-tag> .?AT<anonymous-tag>@@ ?& � 0 �
" FilterEntryCount �
" NumberOfPairs
" Flags
�# FilterType ���
" Reserved �
?& Filter ���N A& _QUERY_FILE_LAYOUT_INPUT .?AU_QUERY_FILE_LAYOUT_INPUT@@ �� B& � N � _CSV_QUERY_REDIRECT_STATE .?AU_CSV_QUERY_REDIRECT_STATE@@ F
" MdsNodeId
" DsNodeId �
FileRedirected ���N E& _CSV_QUERY_REDIRECT_STATE .?AU_CSV_QUERY_REDIRECT_STATE@@ F& � `
�% ��
H& n � _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES .?AU_POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES@@
IsAllowed n K& _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES .?AU_POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES@@ L& x w ! N& . � _RTL_RUN_ONCE .?AT_RTL_RUN_ONCE@@
# ��2
Ptr ��
# Value
Q& State . R& _RTL_RUN_ONCE .?AT_RTL_RUN_ONCE@@ S& b V � _QUERY_BAD_RANGES_INPUT_RANGE .?AU_QUERY_BAD_RANGES_INPUT_RANGE@@ 2
# StartOffset ��
# LengthInBytes V V& _QUERY_BAD_RANGES_INPUT_RANGE .?AU_QUERY_BAD_RANGES_INPUT_RANGE@@ W& � ! z � _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@
Y& B
� ControlFlowGuard �
� StrictControlFlowGuard ���z [& _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@ \& x �
u cbSize ���
t iContextType �
t iCtrlId ��
hItemHandle ��
# dwContextId ��
� MousePos �2 ^& ( tagHELPINFO .?AUtagHELPINFO@@ _& K# 6 � tagWNDCLASSW .?AUtagWNDCLASSW@@ ��
a& �
u style
r% lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
5 hInstance
s% hIcon
4$ ( hCursor ��
Z! 0 hbrBackground
8 lpszMenuName �
@ lpszClassName 6
c& H tagWNDCLASSW .?AUtagWNDCLASSW@@ �� d& J � _WNF_USER_SUBSCRIPTION .?AU_WNF_USER_SUBSCRIPTION@@ ��> � tagLOGCOLORSPACEA .?AUtagLOGCOLORSPACEA@@
g& �
" lcsSignature �
" lcsVersion ���
" lcsSize ��
lcsCSType
lcsIntent
� lcsEndpoints �
" 8 lcsGammaRed ��
" < lcsGammaGreen
" @ lcsGammaBlue �
y D lcsFilename ��>
i& HtagLOGCOLORSPACEA .?AUtagLOGCOLORSPACEA@@ j& � � R � _SYSTEM_OBJECT_INFORMATION .?AU_SYSTEM_OBJECT_INFORMATION@@ ��B
" NextEntryOffset ��
Object ���
CreatorUniqueProcess �
! CreatorBackTraceIndex
! Flags
PointerCount �
HandleCount ��
" $ PagedPoolCharge ��
" ( NonPagedPoolCharge ���
0 ExclusiveProcessId ���
8 SecurityDescriptor ���
�# @ NameInfo �R m& P _SYSTEM_OBJECT_INFORMATION .?AU_SYSTEM_OBJECT_INFORMATION@@ �� n& � 0
W! V � COPYFILE2_EXTENDED_PARAMETERS .?AUCOPYFILE2_EXTENDED_PARAMETERS@@
� z
" dwSize ���
" dwCopyFlags ��
t pfCancel �
r& pProgressRoutine �
pvCallbackContext V s& COPYFILE2_EXTENDED_PARAMETERS .?AUCOPYFILE2_EXTENDED_PARAMETERS@@ t& o � ^ � _SYSTEM_ALARM_CALLBACK_OBJECT_ACE .?AU_SYSTEM_ALARM_CALLBACK_OBJECT_ACE@@ �
� Header ���
" Mask �
" Flags
ObjectType ���
InheritedObjectType ��
" , SidStart �^ w& 0 _SYSTEM_ALARM_CALLBACK_OBJECT_ACE .?AU_SYSTEM_ALARM_CALLBACK_OBJECT_ACE@@ x& x 1
X
Y * z& _COORD .?AU_COORD@@ �� {& � $
� ^ � _EVENT_TRACE_VERSION_INFORMATION .?AU_EVENT_TRACE_VERSION_INFORMATION@@ ��N
@ EventTraceInformationClass ���
" EventTraceKernelVersion ��^ & _EVENT_TRACE_VERSION_INFORMATION .?AU_EVENT_TRACE_VERSION_INFORMATION@@ �� �& A �
l � POINTER_CHANGE_NONE �� POINTER_CHANGE_FIRSTBUTTON_DOWN �� POINTER_CHANGE_FIRSTBUTTON_UP POINTER_CHANGE_SECONDBUTTON_DOWN � POINTER_CHANGE_SECONDBUTTON_UP ��� POINTER_CHANGE_THIRDBUTTON_DOWN �� POINTER_CHANGE_THIRDBUTTON_UP POINTER_CHANGE_FOURTHBUTTON_DOWN � POINTER_CHANGE_FOURTHBUTTON_UP ��� POINTER_CHANGE_FIFTHBUTTON_DOWN ��
POINTER_CHANGE_FIFTHBUTTON_UP R t �& tagPOINTER_BUTTON_CHANGE_TYPE .?AW4tagPOINTER_BUTTON_CHANGE_TYPE@@ � �& � V � _HEAP_BLOCK_EXTRA_INFORMATION .?AU_HEAP_BLOCK_EXTRA_INFORMATION@@
�& 2
Next �
" Type �
# Size �V �& _HEAP_BLOCK_EXTRA_INFORMATION .?AU_HEAP_BLOCK_EXTRA_INFORMATION@@ �& � � j � _SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT@@ ��j � _SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER .?AU_SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER@@ j
�& Header ���
# OverQuotaHistory �
" IntervalLength ���
" NumberOfIntervals j �& _SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT@@ �� �& � � n LdrpNoDevice � LdrpWebDAV ��� LdrpRemote ��� ��LdrpAnyDevice ��� LdrpAnyDevice2bit N t �& <unnamed-enum-LdrpNoDevice> .?AW4<unnamed-enum-LdrpNoDevice>@@ � �& � � ^ � _ETW_DFSS_RELEASE_THREAD_ON_IDLE .?AU_ETW_DFSS_RELEASE_THREAD_ON_IDLE@@ ��z
" CurrentGeneration
" SessionSelectedToRun �
# CycleBaseAllowance ���
CyclesRemaining ��^ �& _ETW_DFSS_RELEASE_THREAD_ON_IDLE .?AU_ETW_DFSS_RELEASE_THREAD_ON_IDLE@@ �� �& c B
^ � _RPC_BINDING_HANDLE_TEMPLATE_V1_A .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_A@@
�&
Reserved �2 �& <anonymous-tag> .?AT<anonymous-tag>@@ �& _ �
" Version ��
" Flags
" ProtocolSequence �
NetworkAddress ���
StringEndpoint ���
�& u1 ���
( ObjectUuid ���^ �& 8 _RPC_BINDING_HANDLE_TEMPLATE_V1_A .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_A@@ �& _ : � _EVENTLOGRECORD .?AU_EVENTLOGRECORD@@ z
" Length ���
" Reserved �
" RecordNumber �
" TimeGenerated
" TimeWritten ��
" EventID ��
! EventType
! NumStrings ���
! EventCategory
! ReservedFlags
" ClosingRecordNumber ��
" $ StringOffset �
" ( UserSidLength
" , UserSidOffset
" 0 DataLength ���
" 4 DataOffset ���: �& 8 _EVENTLOGRECORD .?AU_EVENTLOGRECORD@@ * onecore\internal\sdk\inc\ntelfapi.h �& �& E V � _FILE_ID_FULL_DIR_INFORMATION .?AU_FILE_ID_FULL_DIR_INFORMATION@@ :
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
� H FileId ���
| P FileName �V
�& X _FILE_ID_FULL_DIR_INFORMATION .?AU_FILE_ID_FULL_DIR_INFORMATION@@ �& � � Z � _PERFINFO_PPM_IDLE_STATE_ENTER .?AU_PERFINFO_PPM_IDLE_STATE_ENTER@@ ��
�& �
" State
! Properties ���
ExpectedWakeReason ���
Reserved �
" Flags
# ExpectedDuration �Z �& _PERFINFO_PPM_IDLE_STATE_ENTER .?AU_PERFINFO_PPM_IDLE_STATE_ENTER@@ �� �& c �
" Marker ���
! Version ��
HeaderType ���
Flags
" Header ���
u# Packet ���
" ThreadId �
" ProcessId
� SystemTime ���
" KernelTime ���
" UserTime �F �& _SYSTEM_TRACE_HEADER .?AU_SYSTEM_TRACE_HEADER@@ �� �& c _ V � _RTL_CRITICAL_SECTION_DEBUG64 .?AU_RTL_CRITICAL_SECTION_DEBUG64@@
�& �
! Type �
! CreatorBackTraceIndex
# CriticalSection ��
ProcessLocksList �
" EntryCount ���
" $ ContentionCount ��
8 ( Spare V �& 0 _RTL_CRITICAL_SECTION_DEBUG64 .?AU_RTL_CRITICAL_SECTION_DEBUG64@@ �& � { V � _SYSTEM_VERIFIER_INFORMATION .?AU_SYSTEM_VERIFIER_INFORMATION@@ ��
�&
" ��
" ��
" ��V
�& AreAllDriversBeingVerified ���
�& DisabledFromCrash
�& Spare : �& <anonymous-tag> .?AU<anonymous-tag>@@ �& � V "
�& Flags
" Whole 2 �& <anonymous-tag> .?AT<anonymous-tag>@@ �& � T >
" NextEntryOffset ��
" Level
8 RuleClasses ��
" TriageContext
�& u1 ���
DriverName ���
" ( RaiseIrqls ���
" , AcquireSpinLocks �
" 0 SynchronizeExecutions
" 4 AllocationsAttempted �
" 8 AllocationsSucceeded �
" < AllocationsSucceededSpecialPool ��
" @ AllocationsWithNoTag �
" D TrimRequests �
" H Trims
" L AllocationsFailed
" P AllocationsFailedDeliberately
" T Loads
" X Unloads ��
" \ UnTrackedPool
" ` CurrentPagedPoolAllocations ��
" d CurrentNonPagedPoolAllocations ���
" h PeakPagedPoolAllocations �
" l PeakNonPagedPoolAllocations ��
# p PagedPoolUsageInBytes
# x NonPagedPoolUsageInBytes �
# � PeakPagedPoolUsageInBytes
# � PeakNonPagedPoolUsageInBytes �V �& � _SYSTEM_VERIFIER_INFORMATION .?AU_SYSTEM_VERIFIER_INFORMATION@@ �� �& � N J � _RTL_HANDLE_TABLE_ENTRY .?AU_RTL_HANDLE_TABLE_ENTRY@@
�& &
" Flags
�& NextFree �J �& _RTL_HANDLE_TABLE_ENTRY .?AU_RTL_HANDLE_TABLE_ENTRY@@ �& � � N � _SPARSE_OVERALLOCATE_DATA .?AU_SPARSE_OVERALLOCATE_DATA@@ &
" SparseOverAllocateSize ���N �& _SPARSE_OVERALLOCATE_DATA .?AU_SPARSE_OVERALLOCATE_DATA@@ �& � j( N � USN_RECORD_COMMON_HEADER .?AUUSN_RECORD_COMMON_HEADER@@ ��
�& J
" RecordLength �
! MajorVersion �
! MinorVersion �N �& USN_RECORD_COMMON_HEADER .?AUUSN_RECORD_COMMON_HEADER@@ �� �& � � j � _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION_V2@@ �
PerfEvtEventSelect ���
PerfEvtUnitSelect
PerfEvtCMask �
PerfEvtCInv ��
PerfEvtAnyThread �
PerfEvtEdgeDetect : �& <anonymous-tag> .?AU<anonymous-tag>@@ �& A | >
PerfEvtEventSelect ���
PerfEvtUnitSelect : �& <anonymous-tag> .?AU<anonymous-tag>@@ �& A � 2
" PerfEvtType ��
AllowsHalt ���: �& <anonymous-tag> .?AU<anonymous-tag>@@ �& A � 2
�& Intel
�& Amd ��
�& Arm ��j �& _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION_V2@@ �& A z
� ��
� ��
� ��
� ��
� ��
� ��
� ��
� ��
� >��
V Link �
Pad ��
� Context ��
�Teb ��
�UserContext ��
�& �ScheduledThread ��
�& �Suspended
�& �VolatileContext ��
�& �Terminated ���
�& �DebugActive ��
�& �RunningOnSelfThread ��
�& �DenyRunningOnSelfThread ��
T �Flags
�& �KernelUpdateLock �
�& �PrimaryClientID ��
� �ContextLock ��
� �PrimaryUmsContext
" �SwitchCount ��
" �KernelYieldCount �
" �MixedYieldCount ��
" �YieldCount ���> �& �_RTL_UMS_CONTEXT .?AU_RTL_UMS_CONTEXT@@ �� �& b ! B � _DISPATCHER_CONTEXT .?AU_DISPATCHER_CONTEXT@@
�
� �% �& � �&
�& F � _UNWIND_HISTORY_TABLE .?AU_UNWIND_HISTORY_TABLE@@
�& .
# ControlPc
# ImageBase
� FunctionEntry
# EstablisherFrame �
# TargetPc �
�& ( ContextRecord
�& 0 LanguageHandler ��
8 HandlerData ��
�& @ HistoryTable �
" H ScopeIndex ���
L ControlPcIsUnwound ���
P NonVolatileRegisters �B �& X _DISPATCHER_CONTEXT .?AU_DISPATCHER_CONTEXT@@ �& � � 6 � _RPC_VERSION .?AU_RPC_VERSION@@ ��2
! MajorVersion �
! MinorVersion �6 �& _RPC_VERSION .?AU_RPC_VERSION@@ �� �& 7 ) R � _ENCRYPTION_KEY_CTRL_INPUT .?AU_ENCRYPTION_KEY_CTRL_INPUT@@ ��
�& �
" HeaderSize ���
" StructureSize
! KeyOffset
!
KeySize ��
" DplLock ��
# DplUserId
# DplCredentialId ��R �& _ENCRYPTION_KEY_CTRL_INPUT .?AU_ENCRYPTION_KEY_CTRL_INPUT@@ �� �& � �! : � _SL_APPX_CACHE .?AU_SL_APPX_CACHE@@ ��Z � _SL_APPX_CACHE_VALUE_DESCRIPTOR .?AU_SL_APPX_CACHE_VALUE_DESCRIPTOR@@ ' " 0 �j
" Version ��
" Flags
" DataSize �
# DataCheckSum �
' Descriptors ��: ' H _SL_APPX_CACHE .?AU_SL_APPX_CACHE@@ �� ' � � 6 � _VM_COUNTERS .?AU_VM_COUNTERS@@ ��R
# PeakVirtualSize ��
# VirtualSize ��
" PageFaultCount ���
# PeakWorkingSetSize ���
# WorkingSetSize ���
# ( QuotaPeakPagedPoolUsage ��
# 0 QuotaPagedPoolUsage ��
# 8 QuotaPeakNonPagedPoolUsage ���
# @ QuotaNonPagedPoolUsage ���
# H PagefileUsage
# P PeakPagefileUsage 6 ' X _VM_COUNTERS .?AU_VM_COUNTERS@@ �� ' ? � B � _PREFIX_TABLE_ENTRY .?AU_PREFIX_TABLE_ENTRY@@
' r
NodeTypeCode �
NameLength ���
' NextPrefixTree ���
] Links
$ ( Prefix ���B ' 0 _PREFIX_TABLE_ENTRY .?AU_PREFIX_TABLE_ENTRY@@ ' b > � _COUNTER_READING .?AU_COUNTER_READING@@ ��B
� Type �
" Index
# Start
# Total > ' _COUNTER_READING .?AU_COUNTER_READING@@ �� ' � |
! t ' J � _TRACE_LOGFILE_HEADER32 .?AU_TRACE_LOGFILE_HEADER32@@ f
MajorVersion �
MinorVersion �
SubVersion ���
SubMinorVersion ��: ' <anonymous-tag> .?AU<anonymous-tag>@@ ' � � .
" BufferSize ���
" Version ��
' VersionDetail
" ProviderVersion ��
" NumberOfProcessors ���
� EndTime ��
" TimerResolution ��
" MaximumFileSize ��
" LogFileMode ��
" $ BuffersWritten ���
( LogInstanceGuid ��
" ( StartBuffers �
" , PointerSize ��
" 0 EventsLost ���
" 4 CpuSpeedInMHz
u 8 LoggerName ���
u < LogFileName ��
� @ TimeZone �
� � BootTime �
� � PerfFreq �
� StartTime
" ReservedFlags
" BuffersLost ��J ' _TRACE_LOGFILE_HEADER32 .?AU_TRACE_LOGFILE_HEADER32@@ ' � � J � _TOKEN_MANDATORY_LABEL .?AU_TOKEN_MANDATORY_LABEL@@ ��
'
� Label J ' _TOKEN_MANDATORY_LABEL .?AU_TOKEN_MANDATORY_LABEL@@ �� ' x � v � _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM .?AU_SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM@@
' Z � SERVICE_TRIGGER_CUSTOM_STATE_ID .?AUSERVICE_TRIGGER_CUSTOM_STATE_ID@@ *
" DataOffset ���
� Data �: #' <anonymous-tag> .?AU<anonymous-tag>@@ $' � � &
"' CustomStateId
$' s 2 &' <anonymous-tag> .?AT<anonymous-tag>@@ '' � �
'' u v )' _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM .?AU_SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM@@ *' � � 6 � tagEMRFORMAT .?AUtagEMRFORMAT@@ ��V
" dSignature ���
" nVersion �
" cbData ���
" offData ��6 -' tagEMRFORMAT .?AUtagEMRFORMAT@@ �� .' � � b � _PLUGPLAY_CONTROL_CONFLICT_STRINGS .?AU_PLUGPLAY_CONTROL_CONFLICT_STRINGS@@ ��B
" NullDeviceInstance ���
| DeviceInstanceStrings b 1' _PLUGPLAY_CONTROL_CONFLICT_STRINGS .?AU_PLUGPLAY_CONTROL_CONFLICT_STRINGS@@ �� 2' % � j � _SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE .?AU_SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE@@
4'
�&
6' 7'
8' &
9' NetRateControlDispatch ���j :' _SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE .?AU_SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE@@ ;' � � . COPYFILE2_CALLBACK_NONE �� COPYFILE2_CALLBACK_CHUNK_STARTED � COPYFILE2_CALLBACK_CHUNK_FINISHED COPYFILE2_CALLBACK_STREAM_STARTED COPYFILE2_CALLBACK_STREAM_FINISHED ��� COPYFILE2_CALLBACK_POLL_CONTINUE � COPYFILE2_CALLBACK_ERROR � COPYFILE2_CALLBACK_MAX ���F t =' _COPYFILE2_MESSAGE_TYPE .?AW4_COPYFILE2_MESSAGE_TYPE@@ � >' o ; R � _LINK_TRACKING_INFORMATION .?AU_LINK_TRACKING_INFORMATION@@ ��J NtfsLinkTrackingInformation �� DfsLinkTrackingInformation ���V t A' _LINK_TRACKING_INFORMATION_TYPE .?AW4_LINK_TRACKING_INFORMATION_TYPE@@ � B' � �) &
B' Type �
p VolumeId �R D' _LINK_TRACKING_INFORMATION .?AU_LINK_TRACKING_INFORMATION@@ �� E' � �) Z � _IMAGE_LOAD_CONFIG_DIRECTORY64 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY64@@ ��
" Size �
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" GlobalFlagsClear �
" GlobalFlagsSet ���
" CriticalSectionDefaultTimeout
# DeCommitFreeBlockThreshold ���
# DeCommitTotalFreeThreshold ���
# ( LockPrefixTable ��
# 0 MaximumAllocationSize
# 8 VirtualMemoryThreshold ���
# @ ProcessAffinityMask ��
" H ProcessHeapFlags �
! L CSDVersion ���
! N DependentLoadFlags ���
# P EditList �
# X SecurityCookie ���
# ` SEHandlerTable ���
# h SEHandlerCount ���
# p GuardCFCheckFunctionPointer ��
# x GuardCFDispatchFunctionPointer ���
# � GuardCFFunctionTable �
# � GuardCFFunctionCount �
" � GuardFlags ���
4 � CodeIntegrity
# � GuardAddressTakenIatEntryTable ���
# � GuardAddressTakenIatEntryCount ���
# � GuardLongJumpTargetTable �
# � GuardLongJumpTargetCount �
# � DynamicValueRelocTable ���
# � CHPEMetadataPointer ��
# � GuardRFFailureRoutine
# � GuardRFFailureRoutineFunctionPointer �
" � DynamicValueRelocTableOffset �
! � DynamicValueRelocTableSection
! � Reserved2
# � GuardRFVerifyStackPointerFunctionPointer �
" � HotPatchTableOffset ��
" � Reserved3
# � EnclaveConfigurationPointer ��
# VolatileMetadataPointer ��
# GuardEHContinuationTable �
# GuardEHContinuationCount �Z , H' _IMAGE_LOAD_CONFIG_DIRECTORY64 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY64@@ �� I' � 5 J � _TRACE_GUID_PROPERTIES .?AU_TRACE_GUID_PROPERTIES@@ ��~
Guid �
" GuidType �
" LoggerId �
" EnableLevel ��
" EnableFlags ��
IsEnable �J L' $ _TRACE_GUID_PROPERTIES .?AU_TRACE_GUID_PROPERTIES@@ �� M' � � B � tagEMRSTRETCHDIBITS .?AUtagEMRSTRETCHDIBITS@@ &
� emr ��
d rclBounds
xDest
yDest
xSrc �
$ ySrc �
( cxSrc
, cySrc
" 0 offBmiSrc
" 4 cbBmiSrc �
" 8 offBitsSrc ���
" < cbBitsSrc
" @ iUsageSrc
" D dwRop
H cxDest ���
L cyDest ���B P' P tagEMRSTRETCHDIBITS .?AUtagEMRSTRETCHDIBITS@@ Q' � + V � _TRANSACTION_LIST_INFORMATION .?AU_TRANSACTION_LIST_INFORMATION@@ " �F
" NumberOfTransactions �
T' TransactionInformation ���V U' _TRANSACTION_LIST_INFORMATION .?AU_TRANSACTION_LIST_INFORMATION@@ V' � m V � _FILE_COMPLETION_INFORMATION .?AU_FILE_COMPLETION_INFORMATION@@ ��
X' "
Port �
Key ��V Z' _FILE_COMPLETION_INFORMATION .?AU_FILE_COMPLETION_INFORMATION@@ �� [' � ? V � _ETW_TP_EVENT_CALLBACK_START .?AU_ETW_TP_EVENT_CALLBACK_START@@ ��
]' ~
j Header ���
PoolId ���
( TaskId ���
0 Callback �
8 Context ��
@ SubProcessTag V _' H _ETW_TP_EVENT_CALLBACK_START .?AU_ETW_TP_EVENT_CALLBACK_START@@ �� `' c � j � _TRANSACTIONMANAGER_LOGPATH_INFORMATION .?AU_TRANSACTIONMANAGER_LOGPATH_INFORMATION@@ .
" LogPathLength
| LogPath ��j c' _TRANSACTIONMANAGER_LOGPATH_INFORMATION .?AU_TRANSACTIONMANAGER_LOGPATH_INFORMATION@@ d' � � B � _CONSOLE_FONT_INFO .?AU_CONSOLE_FONT_INFO@@ ��
f' *
" nFont
�" dwFontSize ���B h' _CONSOLE_FONT_INFO .?AU_CONSOLE_FONT_INFO@@ �� i' � �
u k'
g
f �
n' DebugInfo
LockCount
RecursionCount ���
OwningThread �
LockSemaphore
# SpinCount F o' ( _RTL_CRITICAL_SECTION .?AU_RTL_CRITICAL_SECTION@@ p' � Z
N � _SD_GLOBAL_CHANGE_OUTPUT .?AU_SD_GLOBAL_CHANGE_OUTPUT@@ ��V � _SD_CHANGE_MACHINE_SID_OUTPUT .?AU_SD_CHANGE_MACHINE_SID_OUTPUT@@ J � _SD_QUERY_STATS_OUTPUT .?AU_SD_QUERY_STATS_OUTPUT@@ ��B � _SD_ENUM_SDS_OUTPUT .?AU_SD_ENUM_SDS_OUTPUT@@ j
" Flags
" ChangeType ���
t' SdChange �
u' SdQueryStats �
v' SdEnumSds N w' H _SD_GLOBAL_CHANGE_OUTPUT .?AU_SD_GLOBAL_CHANGE_OUTPUT@@ �� x' � � : � tagHELPWININFOW .?AUtagHELPWININFOW@@
z' q " �z
t wStructSize ��
t x
t y
t dx ���
t dy ���
t wMax �
|' rgchMember ���: }' tagHELPWININFOW .?AUtagHELPWININFOW@@ ~' �/ . � tagNMHDR .?AUtagNMHDR@@ ��:
� hwndFrom �
# idFrom ���
u code �. �' tagNMHDR .?AUtagNMHDR@@ �� �' � : � _CONTEXT_CHUNK .?AU_CONTEXT_CHUNK@@ ��*
Offset ���
" Length ���: �' _CONTEXT_CHUNK .?AU_CONTEXT_CHUNK@@ �� �' L B 2 � _cpinfoexW .?AU_cpinfoexW@@ ��
u MaxCharSize ��
DefaultChar ��
LeadByte �
q UnicodeDefaultChar ���
u CodePage �
� CodePageName �2 �' _cpinfoexW .?AU_cpinfoexW@@ �� �' W l
� J � _PROCESS_EXCEPTION_PORT .?AU_PROCESS_EXCEPTION_PORT@@
�' :
ExceptionPortHandle ��
" StateFlags ���J �' _PROCESS_EXCEPTION_PORT .?AU_PROCESS_EXCEPTION_PORT@@ �' ? � 6 � _ICONINFOEXW .?AU_ICONINFOEXW@@ ��
�' �
" cbSize ���
t fIcon
" xHotspot �
" yHotspot �
| hbmMask ��
| hbmColor �
! wResID ���
� " szModName
� *szResName 6 �' 8_ICONINFOEXW .?AU_ICONINFOEXW@@ �� �' �* > � _NV_MEMORY_RANGE .?AU_NV_MEMORY_RANGE@@ ��.
BaseAddress ��
# Length ���> �' _NV_MEMORY_RANGE .?AU_NV_MEMORY_RANGE@@ �� �' b �$ F � _IMAGE_HOT_PATCH_INFO .?AU_IMAGE_HOT_PATCH_INFO@@
�' �
" Version ��
" Size �
" SequenceNumber ���
" BaseImageList
" BaseImageCount ���
" BufferOffset �
" ExtraPatchSize ���F �' _IMAGE_HOT_PATCH_INFO .?AU_IMAGE_HOT_PATCH_INFO@@ �' � � ^ FileIdType ��� ObjectIdType � ExtendedFileIdType ��� MaximumFileIdType 2 t �' _FILE_ID_TYPE .?AW4_FILE_ID_TYPE@@ � �' o �# * � HSTR__ .?AUHSTR__@@ ��
�'
t unused ���* �' HSTR__ .?AUHSTR__@@ ��6 onecore\external\shared\inc\minwin\minwindef.h � �' �' f � _SYSTEM_HYPERVISOR_DETAIL_INFORMATION .?AU_SYSTEM_HYPERVISOR_DETAIL_INFORMATION@@ 2 � _HV_DETAILS .?AU_HV_DETAILS@@ �
�' HvVendorAndMaxFunction ���
�' HypervisorInterface ��
�' HypervisorVersion
�' 0 HvFeatures ���
�' @ HwFeatures ���
�' P EnlightenmentInfo
�' ` ImplementationLimits �f �' p _SYSTEM_HYPERVISOR_DETAIL_INFORMATION .?AU_SYSTEM_HYPERVISOR_DETAIL_INFORMATION@@ �' � = : � _WMI_DPI_RECORD .?AU_WMI_DPI_RECORD@@ .
" MachineDPI ���
" UserDPI ��: �' _WMI_DPI_RECORD .?AU_WMI_DPI_RECORD@@ �' c j B � _RTL_PROCESS_HEAPS .?AU_RTL_PROCESS_HEAPS@@ ��F � _RTL_HEAP_INFORMATION .?AU_RTL_HEAP_INFORMATION@@ �' " X �*
" NumberOfHeaps
�' Heaps B �' ` _RTL_PROCESS_HEAPS .?AU_RTL_PROCESS_HEAPS@@ �� �' � F V LoadReasonStaticDependency ��� LoadReasonStaticForwarderDependency �� LoadReasonDynamicForwarderDependency � LoadReasonDelayloadDependency LoadReasonDynamicLoad LoadReasonAsImageLoad LoadReasonAsDataLoad � LoadReasonEnclavePrimary � LoadReasonEnclaveDependency �� ��LoadReasonUnknown ���B
t �' _LDR_DLL_LOAD_REASON .?AW4_LDR_DLL_LOAD_REASON@@ ��� �' � �
:% t " " " " �'
�'
�' B
�' pSizeConvertRoutines �
�' pTagGettingRoutines ��> �' _NDR_CS_ROUTINES .?AU_NDR_CS_ROUTINES@@ �� �' � � " SC_STATUS_PROCESS_INFO ���6 t �' _SC_STATUS_TYPE .?AW4_SC_STATUS_TYPE@@ � �' � � > � _DISPLAY_DEVICEW .?AU_DISPLAY_DEVICEW@@ ��
�' �
" cb ���
DeviceName ���
�$ D DeviceString �
" DStateFlags ���
�$ HDeviceID �
�$ HDeviceKey > �' H_DISPLAY_DEVICEW .?AU_DISPLAY_DEVICEW@@ �� �' � �
� � �' V � _TOKEN_GROUPS_AND_PRIVILEGES .?AU_TOKEN_GROUPS_AND_PRIVILEGES@@ ��F � _LUID_AND_ATTRIBUTES .?AU_LUID_AND_ATTRIBUTES@@ ��
�'
" SidCount �
" SidLength
^ Sids �
" RestrictedSidCount ���
" RestrictedSidLength ��
^ RestrictedSids ���
" PrivilegeCount ���
" $ PrivilegeLength ��
�' ( Privileges ���
� 0 AuthenticationId �V
�' 8 _TOKEN_GROUPS_AND_PRIVILEGES .?AU_TOKEN_GROUPS_AND_PRIVILEGES@@ �� �' x � : � tagMENUBARINFO .?AUtagMENUBARINFO@@ ��
�'
t ��
t ��
t ��
" cbSize ���
! rcBar
� hMenu
� hwndMenu �
�' ( fBarFocused ��
�' ( fFocused �
�' ( fUnused ��: �' 0 tagMENUBARINFO .?AUtagMENUBARINFO@@ �� �' 9 > � _USER_MARSHAL_CB .?AU_USER_MARSHAL_CB@@ ��
� USER_MARSHAL_CB_BUFFER_SIZE �� USER_MARSHAL_CB_MARSHALL � USER_MARSHAL_CB_UNMARSHALL ��� USER_MARSHAL_CB_FREE �B t �' _USER_MARSHAL_CB_TYPE .?AW4_USER_MARSHAL_CB_TYPE@@ � �' � x �
" Flags
�' pStubMsg �
Q pReserve �
" Signature
�' CBType ���
Q pFormat ��
Q ( pTypeFormat ��> �' 0 _USER_MARSHAL_CB .?AU_USER_MARSHAL_CB@@ �� �' � � R � tagRID_DEVICE_INFO_KEYBOARD .?AUtagRID_DEVICE_INFO_KEYBOARD@@ �
" dwType ���
" dwSubType
" dwKeyboardMode ���
" dwNumberOfFunctionKeys ���
" dwNumberOfIndicators �
" dwNumberOfKeysTotal ��R �' tagRID_DEVICE_INFO_KEYBOARD .?AUtagRID_DEVICE_INFO_KEYBOARD@@ �' ; B � tagEMRPOLYTEXTOUTA .?AUtagEMRPOLYTEXTOUTA@@ ��
�' 2 � tagEMRTEXT .?AUtagEMRTEXT@@ �� �' " ( �
� emr ��
d rclBounds
" iGraphicsMode
@ exScale ��
@ eyScale ��
$ cStrings �
�' ( aemrtext �B �' P tagEMRPOLYTEXTOUTA .?AUtagEMRPOLYTEXTOUTA@@ �� �' � � � ActivationContextBasicInformation ActivationContextDetailedInformation � AssemblyDetailedInformationInActivationContext ��� FileInformationInAssemblyOfAssemblyInActivationContext ��� RunlevelInformationInActivationContext ��� CompatibilityInformationInActivationContext �� ActivationContextManifestResourceName MaxActivationContextInfoClass AssemblyDetailedInformationInActivationContxt FileInformationInAssemblyOfAssemblyInActivationContxt V
t �' _ACTIVATION_CONTEXT_INFO_CLASS .?AW4_ACTIVATION_CONTEXT_INFO_CLASS@@ ��� �' � D R � _SYSTEM_NUMA_PROXIMITY_MAP .?AU_SYSTEM_NUMA_PROXIMITY_MAP@@ ��6
" NodeProximityId ��
! NodeNumber ���R �' _SYSTEM_NUMA_PROXIMITY_MAP .?AU_SYSTEM_NUMA_PROXIMITY_MAP@@ �� �' � 5 f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A@@ ��
TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
ServerCertificateSubject �
( ProxyCredentials �
" 0 NumberOfProxyAuthnSchemes
" 8 ProxyAuthnSchemes f �' @ _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A@@ �� �' _ � n � _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER@@
PrologueByteCount n �' _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER@@ �' � � > PMETypeFailFastOnCommitFailure ��� PMETypeMax ���V t �' _PROCESS_MEMORY_EXHAUSTION_TYPE .?AW4_PROCESS_MEMORY_EXHAUSTION_TYPE@@ � �' � � N � tagRID_DEVICE_INFO_MOUSE .?AUtagRID_DEVICE_INFO_MOUSE@@ ��f
" dwId �
" dwNumberOfButtons
" dwSampleRate �
t fHasHorizontalWheel ��N ( tagRID_DEVICE_INFO_MOUSE .?AUtagRID_DEVICE_INFO_MOUSE@@ �� ( ; . � _OFSTRUCT .?AU_OFSTRUCT@@
( �
cBytes ���
fFixedDisk ���
! nErrCode �
! Reserved1
! Reserved2
szPathName ���. ( � _OFSTRUCT .?AU_OFSTRUCT@@ ( o � �
" Length ���
RootDirectory
v ObjectName ���
" Attributes ���
SecurityDescriptor ���
( SecurityQualityOfService �B ( 0 _OBJECT_ATTRIBUTES .?AU_OBJECT_ATTRIBUTES@@ ��
( . � tagLC_ID .?AUtagLC_ID@@ ��>
! wLanguage
! wCountry �
! wCodePage .
( tagLC_ID .?AUtagLC_ID@@ ��. onecore\external\sdk\inc\crt\crtdefs.h � ( ( � j � _PERFINFO_PFMAPPED_SECTION_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_INFORMATION@@ ��F
RangeBase
RangeEnd �
" CreatingProcessId j ( _PERFINFO_PFMAPPED_SECTION_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_INFORMATION@@ �� ( c l Z � _SYSTEM_VERIFIER_INFORMATION_EX .?AU_SYSTEM_VERIFIER_INFORMATION_EX@@ �
" VerifyMode ���
" OptionChanges
PreviousBucketName ���
" IrpCancelTimeoutMsec �
" VerifierExtensionEnabled �
� Reserved �Z ( ( _SYSTEM_VERIFIER_INFORMATION_EX .?AU_SYSTEM_VERIFIER_INFORMATION_EX@@ ( � � ~
�! ActiveFrame ��
FrameListCache ���
" Flags
" NextCookieSequenceNumber �
" StackId ��N ( ( _ACTIVATION_CONTEXT_STACK .?AU_ACTIVATION_CONTEXT_STACK@@ ( 7 � V � _PROCESS_WORKING_SET_CONTROL .?AU_PROCESS_WORKING_SET_CONTROL@@ ��:
" Version ��
s Operation
" Flags V ( _PROCESS_WORKING_SET_CONTROL .?AU_PROCESS_WORKING_SET_CONTROL@@ �� ( t W * � _FP_64 .?AU_FP_64@@ ��
8 W * !( _FP_64 .?AU_FP_64@@ �� "( � : ^ BootLoad � SystemLoad ��� AutoLoad � DemandLoad ��� DisableLoad ��B t $( _CM_SERVICE_LOAD_TYPE .?AW4_CM_SERVICE_LOAD_TYPE@@ � %( n � _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER@@
'( ��
(( ~
" EpilogueCount
EpilogueByteCount
BranchDescriptorElementSize ��
! BranchDescriptorCount n *( _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER@@ +( � � F � _POWER_USER_PRESENCE .?AU_POWER_USER_PRESENCE@@ ��
-( B UserNotPresent ��� UserPresent �� � UserUnknown ��J t /( POWER_USER_PRESENCE_TYPE .?AW4POWER_USER_PRESENCE_TYPE@@ ��� 0( x �
0( UserPresence �F 2( _POWER_USER_PRESENCE .?AU_POWER_USER_PRESENCE@@ �� 3( x � J � tagEMRCREATECOLORSPACEW .?AUtagEMRCREATECOLORSPACEW@@
5( > � tagLOGCOLORSPACEW .?AUtagLOGCOLORSPACEW@@ j
� emr ��
" ihCS �
7( lcs ��
" XdwFlags ��
" \cbData ���
� `Data �J 8( dtagEMRCREATECOLORSPACEW .?AUtagEMRCREATECOLORSPACEW@@ 9( � � ^ � _RPC_BINDING_HANDLE_SECURITY_V1_W .?AU_RPC_BINDING_HANDLE_SECURITY_V1_W@@ R � _SEC_WINNT_AUTH_IDENTITY_W .?AU_SEC_WINNT_AUTH_IDENTITY_W@@ ��
<( > � _RPC_SECURITY_QOS .?AU_RPC_SECURITY_QOS@@
>( �
" Version ��
q ServerPrincName ��
" AuthnLevel ���
" AuthnSvc �
=( AuthIdentity �
?( SecurityQos ��^ @( ( _RPC_BINDING_HANDLE_SECURITY_V1_W .?AU_RPC_BINDING_HANDLE_SECURITY_V1_W@@ A( _ : � tagGESTUREINFO .?AUtagGESTUREINFO@@ ���
u cbSize ���
" dwFlags ��
" dwID �
� hwndTarget ���
{ ptsLocation ��
" dwInstanceID �
" dwSequenceID �
# ( ullArguments �
u 0 cbExtraArgs ��: D( 8 tagGESTUREINFO .?AUtagGESTUREINFO@@ �� E( �< > � tagEMRPOLYLINE16 .?AUtagEMRPOLYLINE16@@ ��
G( F
� emr ��
d rclBounds
" cpts �
| apts �> I( tagEMRPOLYLINE16 .?AUtagEMRPOLYLINE16@@ �� J( � E
]#
� ��
M(
�" > � _WOW64_LDT_ENTRY .?AU_WOW64_LDT_ENTRY@@ ��R
BaseMid ��
Flags1 ���
Flags2 ���
BaseHi ���: Q( <anonymous-tag> .?AU<anonymous-tag>@@ R( � �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
T( BaseMid ��
U( Type �
V( Dpl ��
W( Pres �
X( LimitHi ��
Y( Sys ��
Z( Reserved_0 ���
[( Default_Big ��
\( Granularity ��
]( BaseHi ���:
^( <anonymous-tag> .?AU<anonymous-tag>@@ _( � � "
R( Bytes
_( Bits �2 a( <anonymous-tag> .?AT<anonymous-tag>@@ b( � � >
! LimitLow �
! BaseLow ��
b( HighWord �> d( _WOW64_LDT_ENTRY .?AU_WOW64_LDT_ENTRY@@ �� e( � �
� B � _MIDL_SERVER_INFO_ .?AU_MIDL_SERVER_INFO_@@ ��
� ��
i(
k(
l(
m(
�' o(
p(
q( > � _MIDL_SYNTAX_INFO .?AU_MIDL_SYNTAX_INFO@@
s( �
j( pStubDesc
n( DispatchTable
Q ProcString ���
6 FmtStringOffset ��
r( ThunkTable ���
4 ( pTransferSyntax ��
# 0 nCount ���
t( 8 pSyntaxInfo ��B u( @ _MIDL_SERVER_INFO_ .?AU_MIDL_SERVER_INFO_@@ �� v( � p v � _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2@@
x( j � _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_ACCOUNTING_INFORMATION@@ J � _PROCESS_ENERGY_VALUES .?AU_PROCESS_ENERGY_VALUES@@ ���
z( BasicInfo
� 0 IoInfo ���
` DiskIoInfo ���
# � ContextSwitches ��
� � TotalCycleTime ���
# � ReadyTime
{( � EnergyValues �
# �KernelWaitTime ���
# �UserWaitTime �v |( �_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2@@ }( � �
�
�%
� � MandatoryLevelUntrusted �� MandatoryLevelLow MandatoryLevelMedium � MandatoryLevelHigh ��� MandatoryLevelSystem � MandatoryLevelSecureProcess �� MandatoryLevelCount ��: t �( _MANDATORY_LEVEL .?AW4_MANDATORY_LEVEL@@ ��� �( x 6 � _RTL_BSD_ITEM .?AU_RTL_BSD_ITEM@@ ^ RtlBsdItemVersionNumber �� RtlBsdItemProductType RtlBsdItemAabEnabled � RtlBsdItemAabTimeout � RtlBsdItemBootGood ��� RtlBsdItemBootShutdown ��� RtlBsdSleepInProgress RtlBsdPowerTransition RtlBsdItemBootAttemptCount ��� RtlBsdItemBootCheckpoint �
RtlBsdItemBootId � RtlBsdItemShutdownBootId � RtlBsdItemReportedAbnormalShutdownBootId �
RtlBsdItemErrorInfo �� RtlBsdItemPowerButtonPressInfo ��� RtlBsdItemChecksum ��� RtlBsdPowerTransitionExtension ��� RtlBsdItemFeatureConfigurationState �� RtlBsdItemMax : t �( RTL_BSD_ITEM_TYPE .?AW4RTL_BSD_ITEM_TYPE@@ � �( B B
�( Type �
DataBuffer ���
" DataLength ���6 �( _RTL_BSD_ITEM .?AU_RTL_BSD_ITEM@@ �( X
p( r
�( pfnTranslateToXmit ���
�( pfnTranslateFromXmit �
�( pfnFreeXmit ��
�( pfnFreeInst ��J �( _XMIT_ROUTINE_QUINTUPLE .?AU_XMIT_ROUTINE_QUINTUPLE@@ �( � P F � tagMEASUREITEMSTRUCT .?AUtagMEASUREITEMSTRUCT@@ ��z
u CtlType ��
u CtlID
u itemID ���
u itemWidth
u itemHeight ���
# itemData �F �( tagMEASUREITEMSTRUCT .?AUtagMEASUREITEMSTRUCT@@ �� �(
v � _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT@@ ��
�( �
" Gsiv �
ControllerInterrupt ��
EdgeInterrupt
IsPrimaryInterrupt ���
& TargetAffinity ���v �( _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT@@ �� �( � R � _SYSTEM_BIGPOOL_INFORMATION .?AU_SYSTEM_BIGPOOL_INFORMATION@@
�( *
" Count
1 AllocatedInfo R �( _SYSTEM_BIGPOOL_INFORMATION .?AU_SYSTEM_BIGPOOL_INFORMATION@@ �( � �
EventBasicInformation J t �( _EVENT_INFORMATION_CLASS .?AW4_EVENT_INFORMATION_CLASS@@ ��� �( � a F � _NDR_CORRELATION_INFO .?AU_NDR_CORRELATION_INFO@@ Z � _TIME_DYNAMIC_ZONE_INFORMATION .?AU_TIME_DYNAMIC_ZONE_INFORMATION@@ ��
�( �
Bias �
StandardName �
< D StandardDate �
T StandardBias �
X DaylightName �
< � DaylightDate �
� DaylightBias �
�$ � TimeZoneKeyName ��
�DynamicDaylightTimeDisabled ��Z �( �_TIME_DYNAMIC_ZONE_INFORMATION .?AU_TIME_DYNAMIC_ZONE_INFORMATION@@ �� �( ? -
! Z � _SYSTEM_GDI_DRIVER_INFORMATION .?AU_SYSTEM_GDI_DRIVER_INFORMATION@@ ��J � _IMAGE_EXPORT_DIRECTORY .?AU_IMAGE_EXPORT_DIRECTORY@@
�( �
DriverName ���
ImageAddress �
SectionPointer ���
EntryPoint ���
�( ( ExportSectionPointer �
" 0 ImageLength ��Z �( 8 _SYSTEM_GDI_DRIVER_INFORMATION .?AU_SYSTEM_GDI_DRIVER_INFORMATION@@ �� �( � � J � _PO_WAKE_SOURCE_HISTORY .?AU_PO_WAKE_SOURCE_HISTORY@@
�( &
" Count
� Offsets ��J �( _PO_WAKE_SOURCE_HISTORY .?AU_PO_WAKE_SOURCE_HISTORY@@ �( x :
2 � ARRAY_INFO .?AUARRAY_INFO@@ ��
Dimension
" BufferConformanceMark
" BufferVarianceMark ���
" MaxCountArray
" OffsetArray ��
" ( ActualCountArray �2 �( 0 ARRAY_INFO .?AUARRAY_INFO@@ �� �( � 5 N � _ACCESS_DENIED_OBJECT_ACE .?AU_ACCESS_DENIED_OBJECT_ACE@@
�( �
� Header ���
" Mask �
" Flags
ObjectType ���
InheritedObjectType ��
" , SidStart �N �( 0 _ACCESS_DENIED_OBJECT_ACE .?AU_ACCESS_DENIED_OBJECT_ACE@@ �( x � F � _IMAGE_SECTION_HEADER .?AU_IMAGE_SECTION_HEADER@@
�( 6
" PhysicalAddress ��
" VirtualSize ��2 �( <anonymous-tag> .?AT<anonymous-tag>@@ �( �
Name �
�( Misc �
" VirtualAddress ���
" SizeOfRawData
" PointerToRawData �
" PointerToRelocations �
" PointerToLinenumbers �
! NumberOfRelocations ��
! " NumberOfLinenumbers ��
" $ Characteristics ��F
�( ( _IMAGE_SECTION_HEADER .?AU_IMAGE_SECTION_HEADER@@ �( � Z � _SYSTEM_CALL_COUNT_INFORMATION .?AU_SYSTEM_CALL_COUNT_INFORMATION@@ ��
�( 2
" Length ���
" NumberOfTables ���Z �( _SYSTEM_CALL_COUNT_INFORMATION .?AU_SYSTEM_CALL_COUNT_INFORMATION@@ �� �( � e R � _FILE_INTERNAL_INFORMATION .?AU_FILE_INTERNAL_INFORMATION@@ ��
� IndexNumber ��R �( _FILE_INTERNAL_INFORMATION .?AU_FILE_INTERNAL_INFORMATION@@ �� �( � � B � _SCOPE_TABLE_ARM64 .?AU_SCOPE_TABLE_ARM64@@ ��f
" BeginAddress �
" EndAddress ���
" HandlerAddress ���
" JumpTarget ���: �( <anonymous-tag> .?AU<anonymous-tag>@@ �( � # �( " �*
" Count
�( ScopeRecord ��B �( _SCOPE_TABLE_ARM64 .?AU_SCOPE_TABLE_ARM64@@ �� �( �
� > � tagCREATESTRUCTW .?AUtagCREATESTRUCTW@@ ��
�( �
lpCreateParams ���
5 hInstance
� hMenu
� hwndParent ���
t cy ���
t $ cx ���
t ( y
t , x
0 style
8 lpszName �
@ lpszClass
" H dwExStyle > �( P tagCREATESTRUCTW .?AUtagCREATESTRUCTW@@ �� �( � V � _RTL_USER_PROCESS_INFORMATION .?AU_RTL_USER_PROCESS_INFORMATION@@ R � _SECTION_IMAGE_INFORMATION .?AU_SECTION_IMAGE_INFORMATION@@ ��n
" Length ���
Process ��
Thread ���
ClientId �
�( ( ImageInformation �V �( h _RTL_USER_PROCESS_INFORMATION .?AU_RTL_USER_PROCESS_INFORMATION@@ �( - N � _TRACE_GUID_REGISTRATION .?AU_TRACE_GUID_REGISTRATION@@ ��&
k Guid �
RegHandle N �( _TRACE_GUID_REGISTRATION .?AU_TRACE_GUID_REGISTRATION@@ �� �( � � B � tagRID_DEVICE_INFO .?AUtagRID_DEVICE_INFO@@ ��^
" cbSize ���
" dwType ���
( mouse
�' keyboard �
� hid ��B �( tagRID_DEVICE_INFO .?AUtagRID_DEVICE_INFO@@ �� �( /; : � tagHELPWININFOA .?AUtagHELPWININFOA@@ p " �z
t wStructSize ��
t x
t y
t dx ���
t dy ���
t wMax �
�( rgchMember ���: �( tagHELPWININFOA .?AUtagHELPWININFOA@@ �( �/ ^ � _SYSTEM_SPECIAL_POOL_INFORMATION .?AU_SYSTEM_SPECIAL_POOL_INFORMATION@@ ��&
" PoolTag ��
" Flags ^ �( _SYSTEM_SPECIAL_POOL_INFORMATION .?AU_SYSTEM_SPECIAL_POOL_INFORMATION@@ �� �( � "
R � _SYSTEM_CPU_SET_INFORMATION .?AU_SYSTEM_CPU_SET_INFORMATION@@ CpuSetInformation J t �( _CPU_SET_INFORMATION_TYPE .?AW4_CPU_SET_INFORMATION_TYPE@@ � �( � P
��
��
��
��
��~
" Id ���
! Group
LogicalProcessorIndex
CoreIndex
LastLevelCacheIndex ��
NumaNodeIndex
EfficiencyClass ��
AllFlags �
�( Parked ���
�( Allocated
�( AllocatedToTargetProcess �
�( RealTime �
�( ReservedFlags
" Reserved �
SchedulingClass ��
# AllocationTag : �( <anonymous-tag> .?AU<anonymous-tag>@@ �( � X 6
" Size �
�( Type �
�( CpuSet ���R �( _SYSTEM_CPU_SET_INFORMATION .?AU_SYSTEM_CPU_SET_INFORMATION@@ �( � T j � _EVENT_EXTENDED_ITEM_PROCESS_START_KEY .?AU_EVENT_EXTENDED_ITEM_PROCESS_START_KEY@@ ��
)
# ProcessStartKey ��j ) _EVENT_EXTENDED_ITEM_PROCESS_START_KEY .?AU_EVENT_EXTENDED_ITEM_PROCESS_START_KEY@@ �� ) V z )
) F � _TOKEN_DEVICE_CLAIMS .?AU_TOKEN_DEVICE_CLAIMS@@ ��
)
DeviceClaims �F
) _TOKEN_DEVICE_CLAIMS .?AU_TOKEN_DEVICE_CLAIMS@@ �� ) x � 2 � tagLOGBRUSH .?AUtagLOGBRUSH@@
) >
u lbStyle ��
" lbColor ��
# lbHatch ��2 ) tagLOGBRUSH .?AUtagLOGBRUSH@@ ) � K
�! > � _WOF_VERSION_INFO .?AU_WOF_VERSION_INFO@@
" WofVersion ���> ) _WOF_VERSION_INFO .?AU_WOF_VERSION_INFO@@ ) � " .
pValue ���
" ValueLength ��v ) _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ �� ) �
" ��
" ��B
) KernelTransition �
) Reserved �
" ul ���^ ) _QUERY_PERFORMANCE_COUNTER_FLAGS .?AU_QUERY_PERFORMANCE_COUNTER_FLAGS@@ �� ) � �
~ PsProtectedTypeNone �� PsProtectedTypeProtectedLight PsProtectedTypeProtected � PsProtectedTypeMax ���> t ) _PS_PROTECTED_TYPE .?AW4_PS_PROTECTED_TYPE@@ ��� ) � { : AtomBasicInformation � AtomTableInformation �F t ") _ATOM_INFORMATION_CLASS .?AW4_ATOM_INFORMATION_CLASS@@ � #) � b � _FILE_ID_GLOBAL_TX_DIR_INFORMATION .?AU_FILE_ID_GLOBAL_TX_DIR_INFORMATION@@ ��^
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
� @ FileId ���
H LockingTransactionId �
" X TxInfoFlags ��
| \ FileName �b &) ` _FILE_ID_GLOBAL_TX_DIR_INFORMATION .?AU_FILE_ID_GLOBAL_TX_DIR_INFORMATION@@ �� ') � + & � _DCB .?AU_DCB@@ ��
))
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ��
" ��
" ��R
" DCBlength
" BaudRate �
+) fBinary ��
,) fParity ��
-) fOutxCtsFlow �
.) fOutxDsrFlow �
/) fDtrControl ��
0) fDsrSensitivity ��
1) fTXContinueOnXoff
2) fOutX
3) fInX �
4) fErrorChar ���
5) fNull
6) fRtsControl ��
7) fAbortOnError
8) fDummy2 ��
! wReserved
! XonLim ���
! XoffLim ��
ByteSize �
Parity ���
StopBits �
p XonChar ��
p XoffChar �
p ErrorChar
p EofChar ��
p EvtChar ��
! wReserved1 ���& 9) _DCB .?AU_DCB@@ �� :) o � F � tagCOLORMATCHTOTARGET .?AUtagCOLORMATCHTOTARGET@@
<) r
� emr ��
" dwAction �
" dwFlags ��
" cbName ���
" cbData ���
� Data �F >) tagCOLORMATCHTOTARGET .?AUtagCOLORMATCHTOTARGET@@ ?) � � B � _ALPC_SECURITY_ATTR .?AU_ALPC_SECURITY_ATTR@@
Z :
" Flags
B) QoS ��
ContextHandle B C) _ALPC_SECURITY_ATTR .?AU_ALPC_SECURITY_ATTR@@ D) � � N � _SYSTEM_PREFETCH_OPTIONS .?AU_SYSTEM_PREFETCH_OPTIONS@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
G) LowerPriority
H) VirtualOffsets ���
I) TrickleIOs ���
J) SkipInStorePages �
K) PrefetchFilesByVa
L) SkipMemoryStorePages �
M) Spare
N) ScenarioType �N O) _SYSTEM_PREFETCH_OPTIONS .?AU_SYSTEM_PREFETCH_OPTIONS@@ �� P) � � R � _PERFINFO_IPI_RECEIVE_DATA .?AU_PERFINFO_IPI_RECEIVE_DATA@@ ��J
# InitialTime ��
WorkerRoutine
" RequestType ��R S) _PERFINFO_IPI_RECEIVE_DATA .?AU_PERFINFO_IPI_RECEIVE_DATA@@ �� T) c > f � _ETW_UMS_EVENT_DIRECTED_SWITCH_START .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_START@@ ��
V) f
" ProcessId
" ScheduledThreadId
" PrimaryThreadId ��
" SwitchFlags ��f X) _ETW_UMS_EVENT_DIRECTED_SWITCH_START .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_START@@ �� Y) c s ^ � tagACTCTX_SECTION_KEYED_DATA_2600 .?AUtagACTCTX_SECTION_KEYED_DATA_2600@@
" cbSize ���
" ulDataFormatVersion ��
lpData ���
" ulLength �
lpSectionGlobalData ��
" ulSectionGlobalDataLength
( lpSectionBase
" 0 ulSectionTotalLength �
8 hActCtx ��
" @ ulAssemblyRosterIndex ^
\) H tagACTCTX_SECTION_KEYED_DATA_2600 .?AUtagACTCTX_SECTION_KEYED_DATA_2600@@ ]) o �
' � IoSessionEventIgnore � IoSessionEventCreated IoSessionEventTerminated � IoSessionEventConnected �� IoSessionEventDisconnected ��� IoSessionEventLogon �� IoSessionEventLogoff � IoSessionEventMax : t a) _IO_SESSION_EVENT .?AW4_IO_SESSION_EVENT@@ � b) � � � SystemMemoryPartitionInformation � SystemMemoryPartitionMoveMemory �� SystemMemoryPartitionAddPagefile � SystemMemoryPartitionCombineMemory ��� SystemMemoryPartitionInitialAddMemory SystemMemoryPartitionGetMemoryEvents � SystemMemoryPartitionSetAttributes ��� SystemMemoryPartitionNodeInformation � SystemMemoryPartitionCreateLargePages SystemMemoryPartitionMax �R
t d) _PARTITION_INFORMATION_CLASS .?AW4_PARTITION_INFORMATION_CLASS@@ ��� e) � �
n
" Length ���
� ImpersonationLevel ���
ContextTrackingMode ��
EffectiveOnly V g) _SECURITY_QUALITY_OF_SERVICE .?AU_SECURITY_QUALITY_OF_SERVICE@@ �� h) x D
f � _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA .?AU_PLUGPLAY_CONTROL_RELATED_DEVICE_DATA@@
j) ~
TargetDeviceInstance �
" Relation �
q RelatedDeviceInstance
" RelatedDeviceInstanceLength ��f l) ( _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA .?AU_PLUGPLAY_CONTROL_RELATED_DEVICE_DATA@@ m) % c N � _TIMER_BASIC_INFORMATION .?AU_TIMER_BASIC_INFORMATION@@ ��
o) 2
� RemainingTime
TimerState ���N q) _TIMER_BASIC_INFORMATION .?AU_TIMER_BASIC_INFORMATION@@ �� r) � �
� " t) u) b � _EVENT_TRACE_TAG_FILTER_INFORMATION .?AU_EVENT_TRACE_TAG_FILTER_INFORMATION@@ V
@ EventTraceInformationClass ���
# TraceHandle ��
� Filter ���b x) _EVENT_TRACE_TAG_FILTER_INFORMATION .?AU_EVENT_TRACE_TAG_FILTER_INFORMATION@@ y) A V � _SET_PURGE_FAILURE_MODE_INPUT .?AU_SET_PURGE_FAILURE_MODE_INPUT@@
" Flags V |) _SET_PURGE_FAILURE_MODE_INPUT .?AU_SET_PURGE_FAILURE_MODE_INPUT@@ }) � �
8 : � MOVE_FILE_DATA .?AUMOVE_FILE_DATA@@ ��
�) b
FileHandle ���
� StartingVcn ��
� StartingLcn ��
" ClusterCount �: �) MOVE_FILE_DATA .?AUMOVE_FILE_DATA@@ �� �) � �
r � _EVENT_TRACE_IPT_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_IPT_CONFIGURATION_INFORMATION@@ ��b
@ EventTraceInformationClass ���
# TraceHandle ��
# ConfigurationOptions �r �) _EVENT_TRACE_IPT_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_IPT_CONFIGURATION_INFORMATION@@ �� �) A � N � _ETW_SET_MARK_INFORMATION .?AU_ETW_SET_MARK_INFORMATION@@ "
" Flag �
| Mark �N �) _ETW_SET_MARK_INFORMATION .?AU_ETW_SET_MARK_INFORMATION@@ �) A � V � _WMI_IMAGELOAD_INFORMATION64 .?AU_WMI_IMAGELOAD_INFORMATION64@@ ��
�) :
# ImageBase64 ��
# ImageSize64 ��
" ProcessId
" ImageChecksum
" TimeDateStamp
SignatureLevel ���
SignatureType
! Reserved0
# DefaultBase64
" ( Reserved1
" , Reserved2
" 0 Reserved3
" 4 Reserved4
| 8 FileName �V �) @ _WMI_IMAGELOAD_INFORMATION64 .?AU_WMI_IMAGELOAD_INFORMATION64@@ �� �) c f
�(
r " �)
& J � _ETW_WAKE_COUNTER_EVENT .?AU_ETW_WAKE_COUNTER_EVENT@@ J
Object ���
# Tag ��
" ProcessId
Count J �) _ETW_WAKE_COUNTER_EVENT .?AU_ETW_WAKE_COUNTER_EVENT@@ �) c
V � _MEMORY_WORKING_SET_EX_BLOCK .?AU_MEMORY_WORKING_SET_EX_BLOCK@@ ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# $��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
�) Valid
�) Reserved0
�) Shared ���
�) Reserved1
�) PageTable
�) Location �
�) Priority �
�) ModifiedList �
�) Reserved2
�) SharedOriginal ���
�) Bad ��
�) ReservedUlong : �) <anonymous-tag> .?AU<anonymous-tag>@@ �) t ^ 6
�) Valid
�) ShareCount ���
�) Win32Protection ��
�) Shared ���
�) Node �
�) Locked ���
�) LargePage
�) Priority �
�) Reserved �
�) SharedOriginal ���
�) Bad ��
�) Win32GraphicsProtection ��
�) ReservedUlong
�) Invalid ��V �) _MEMORY_WORKING_SET_EX_BLOCK .?AU_MEMORY_WORKING_SET_EX_BLOCK@@ �� �) t J V � _THREAD_PROFILING_INFORMATION .?AU_THREAD_PROFILING_INFORMATION@@ N � _THREAD_PERFORMANCE_DATA .?AU_THREAD_PERFORMANCE_DATA@@ ��
�) ^
# HardwareCounters �
" Flags
" Enable ���
�) PerformanceData ��V �) _THREAD_PROFILING_INFORMATION .?AU_THREAD_PROFILING_INFORMATION@@ �) � � z EtwRtEventNoLoss � EtwRtEventLost ��� EtwRtBufferLost �� EtwRtBackupLost �� EtwRtEventLossMax > t �) _ETW_RT_EVENT_LOSS .?AW4_ETW_RT_EVENT_LOSS@@ ��� �) c � � DeviceWakeSourceType � FixedWakeSourceType �� TimerWakeSourceType �� TimerPresumedWakeSourceType �� InternalWakeSourceType ���> t �) PO_WAKE_SOURCE_TYPE .?AW4PO_WAKE_SOURCE_TYPE@@ � �) x
V � _PROCESS_HANDLE_TRACING_QUERY .?AU_PROCESS_HANDLE_TRACING_QUERY@@
�) V � _PROCESS_HANDLE_TRACING_ENTRY .?AU_PROCESS_HANDLE_TRACING_ENTRY@@ �) " � �F
Handle ���
" TotalTraces ��
�) HandleTrace ��V �) � _PROCESS_HANDLE_TRACING_QUERY .?AU_PROCESS_HANDLE_TRACING_QUERY@@ �) ? U
�$ > � tagMULTIKEYHELPW .?AUtagMULTIKEYHELPW@@ ��
�) B
" mkSize ���
q mkKeylist
| szKeyphrase ��> �) tagMULTIKEYHELPW .?AUtagMULTIKEYHELPW@@ �� �) �/
� :
w Action ���
" Flags
" EventCode B �) POWER_ACTION_POLICY .?AUPOWER_ACTION_POLICY@@ �) x �
: � _X86_CALL_FRAME .?AU_X86_CALL_FRAME@@ ^
" ReturnAddress
" Param1 ���
" Param2 ���
" CompatibilityArea : �) _X86_CALL_FRAME .?AU_X86_CALL_FRAME@@ �) � �
. � _STRING32 .?AU_STRING32@@ B
! Length ���
! MaximumLength
" Buffer ���. �) _STRING32 .?AU_STRING32@@ �) � j � _SYSTEM_THREAD_CID_PRIORITY_INFORMATION .?AU_SYSTEM_THREAD_CID_PRIORITY_INFORMATION@@ *
ClientId �
Priority �j �) _SYSTEM_THREAD_CID_PRIORITY_INFORMATION .?AU_SYSTEM_THREAD_CID_PRIORITY_INFORMATION@@ �) �
Z � _PERFINFO_PPM_PERF_STATE_CHANGE .?AU_PERFINFO_PPM_PERF_STATE_CHANGE@@ f
" Type �
" NewState �
" OldState �
Result ���
# Processors ���Z �) _PERFINFO_PPM_PERF_STATE_CHANGE .?AU_PERFINFO_PPM_PERF_STATE_CHANGE@@ �) c R > � tagGESTURECONFIG .?AUtagGESTURECONFIG@@ ��
�) :
" dwID �
" dwWant ���
" dwBlock ��> �) tagGESTURECONFIG .?AUtagGESTURECONFIG@@ �� �) = * � _M128A .?AU_M128A@@ ��
�) "
# Low ��
High �* �) _M128A .?AU_M128A@@ �� �) L � R � _SYSTEM_CONSOLE_INFORMATION .?AU_SYSTEM_CONSOLE_INFORMATION@@
" ��
" ��*
�) DriverLoaded �
�) Spare R �) _SYSTEM_CONSOLE_INFORMATION .?AU_SYSTEM_CONSOLE_INFORMATION@@ �) � � V � _PERFINFO_FILE_PATH_OPERATION .?AU_PERFINFO_FILE_PATH_OPERATION@@
�) �
# Irp ��
# FileObject ���
# FileKey ��
# ExtraInformation �
" IssuingThreadId ��
" $ InfoClass
| ( Path �V �) 0 _PERFINFO_FILE_PATH_OPERATION .?AU_PERFINFO_FILE_PATH_OPERATION@@ �) c t f " " �)
�! . � _NT_TIB64 .?AU_NT_TIB64@@
�) �
# ExceptionList
# StackBase
# StackLimit ���
# SubSystemTib �
# FiberData
" Version ��
# ( ArbitraryUserPointer �
# 0 Self �. * 8 _NT_TIB64 .?AU_NT_TIB64@@ * ? ? b � _SE_LEARNING_MODE_USER_OBJECT_DATA .?AU_SE_LEARNING_MODE_USER_OBJECT_DATA@@ ��F
" Cookie ���
v ObjectType ���
v ObjectName ���b * _SE_LEARNING_MODE_USER_OBJECT_DATA .?AU_SE_LEARNING_MODE_USER_OBJECT_DATA@@ �� * � : � _ACCESS_REASONS .?AU_ACCESS_REASONS@@
* " " � �
* Data �: * � _ACCESS_REASONS .?AU_ACCESS_REASONS@@ * x � �
" NextEntryOffset ��
" Source ���
" MinInterval ��
" MaxInterval ��
# Reserved �
| Description ��F * _PROFILE_SOURCE_INFO .?AU_PROFILE_SOURCE_INFO@@ �� * � : � _FAT_STATISTICS .?AU_FAT_STATISTICS@@
" CreateHits ���
" SuccessfulCreates
" FailedCreates
" NonCachedReads ���
" NonCachedReadBytes ���
" NonCachedWrites ��
" NonCachedWriteBytes ��
" NonCachedDiskReads ���
" NonCachedDiskWrites ��: * $ _FAT_STATISTICS .?AU_FAT_STATISTICS@@ * � @
=
a# & � _MAT2 .?AU_MAT2@@
* B
� eM11 �
� eM12 �
� eM21 �
� eM22 �& * _MAT2 .?AU_MAT2@@ * � n
: � BITMAPV4HEADER .?AUBITMAPV4HEADER@@ ��
* �
" bV4Size ��
bV4Width �
bV4Height
! bV4Planes
! bV4BitCount ��
" bV4V4Compression �
" bV4SizeImage �
bV4XPelsPerMeter �
bV4YPelsPerMeter �
" bV4ClrUsed ���
" $ bV4ClrImportant ��
" ( bV4RedMask ���
" , bV4GreenMask �
" 0 bV4BlueMask ��
" 4 bV4AlphaMask �
" 8 bV4CSType
� < bV4Endpoints �
" ` bV4GammaRed ��
" d bV4GammaGreen
" h bV4GammaBlue �: * l BITMAPV4HEADER .?AUBITMAPV4HEADER@@ �� * � B F � _PLUGPLAY_EVENT_BLOCK .?AU_PLUGPLAY_EVENT_BLOCK@@ 2
ClassGuid
| SymbolicLinkName �: "* <anonymous-tag> .?AU<anonymous-tag>@@ #* % L
| DeviceId �: %* <anonymous-tag> .?AU<anonymous-tag>@@ &* % Q
| DeviceId �: (* <anonymous-tag> .?AU<anonymous-tag>@@ )* % U 6
NotificationStructure
| DeviceId �: +* <anonymous-tag> .?AU<anonymous-tag>@@ ,* % Y
Notification �: .* <anonymous-tag> .?AU<anonymous-tag>@@ /* % ^ :
" NotificationCode �
" NotificationData �: 1* <anonymous-tag> .?AU<anonymous-tag>@@ 2* % b :
� VetoType �
| DeviceIdVetoNameBuffer ���: 4* <anonymous-tag> .?AU<anonymous-tag>@@ 5* % g
BlockedDriverGuid : 7* <anonymous-tag> .?AU<anonymous-tag>@@ 8* % l
| ParentId �: :* <anonymous-tag> .?AU<anonymous-tag>@@ ;* % p j
PowerSettingGuid �
" Flags
" SessionId
" DataLength ���
� Data �: =* <anonymous-tag> .?AU<anonymous-tag>@@ >* % t
| DeviceId �: @* <anonymous-tag> .?AU<anonymous-tag>@@ A* % |
| DeviceId �: C* <anonymous-tag> .?AU<anonymous-tag>@@ D* % � z
#* DeviceClass ��
&* TargetDevice �
)* InstallDevice
,* CustomNotification ���
/* ProfileNotification ��
2* PowerNotification
5* VetoNotification �
8* BlockedDriverNotification
;* InvalidIDNotification
>* PowerSettingNotification �
A* PropertyChangeNotification ���
D* DeviceInstanceNotification ���2 F* <anonymous-tag> .?AT<anonymous-tag>@@ G* % J �
EventGuid
�# EventCategory
" Result ���
" Flags
" $ TotalSize
( DeviceObject �
G* 0 u F I* P _PLUGPLAY_EVENT_BLOCK .?AU_PLUGPLAY_EVENT_BLOCK@@ J* % ?
� N � _ALPC_MESSAGE_ATTRIBUTES .?AU_ALPC_MESSAGE_ATTRIBUTES@@ ��
M* >
" AllocatedAttributes ��
" ValidAttributes ��N O* _ALPC_MESSAGE_ATTRIBUTES .?AU_ALPC_MESSAGE_ATTRIBUTES@@ �� P* � � ~ NormalizationOther ��� NormalizationC ��� NormalizationD ��� NormalizationKC �� NormalizationKD ��. t R* _NORM_FORM .?AW4_NORM_FORM@@ ��� S* W A B � tagMDICREATESTRUCTA .?AUtagMDICREATESTRUCTA@@ �
� szClass ��
� szTitle ��
hOwner ���
t x
t y
t cx ���
t $ cy ���
" ( style
0 lParam ���B V* 8 tagMDICREATESTRUCTA .?AUtagMDICREATESTRUCTA@@ W* �. 6 � tagPOLYTEXTA .?AUtagPOLYTEXTA@@ ��
Y* j
t x
t y
u n
� lpstr
u uiFlags ��
! rcl ��
t 0 pdx ��6 [* 8 tagPOLYTEXTA .?AUtagPOLYTEXTA@@ �� \* � =
� EtwStartLoggerCode ��� EtwStopLoggerCode EtwQueryLoggerCode ��� EtwUpdateLoggerCode �� EtwFlushLoggerCode ��� EtwIncrementFileCode � EtwActivityIdCreate ��
EtwWdiScenarioCode ��� EtwWdiSemUpdate ��> t ^* ETWTRACECONTROLCODE .?AW4ETWTRACECONTROLCODE@@ � _* A < f � _PERFINFO_SAMPLED_PROFILE_INFORMATION .?AU_PERFINFO_SAMPLED_PROFILE_INFORMATION@@
a*
��
��
��
��
InstructionPointer ���
" ThreadId �
! Count
c* ExecutingDpc �
d* ExecutingIsr �
e* Reserved �
f* Priority �
Flags
Rank �f g* _PERFINFO_SAMPLED_PROFILE_INFORMATION .?AU_PERFINFO_SAMPLED_PROFILE_INFORMATION@@ h* c { v ServiceRegistryStateParameters ��� ServiceRegistryStatePersistent ��� MaxServiceRegistryStateType ��N t j* SERVICE_REGISTRY_STATE_TYPE .?AW4SERVICE_REGISTRY_STATE_TYPE@@ � k* � J � _ENCLAVE_INIT_INFO_VBS .?AU_ENCLAVE_INIT_INFO_VBS@@ ��.
" Length ���
" ThreadCount ��J n* _ENCLAVE_INIT_INFO_VBS .?AU_ENCLAVE_INIT_INFO_VBS@@ �� o* � � f � _FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT .?AU_FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT@@ ��
" NumaNode �f r* _FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT .?AU_FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT@@ �� s* � �* V � _ETW_TP_EVENT_CALLBACK_CANCEL .?AU_ETW_TP_EVENT_CALLBACK_CANCEL@@
u* �
j Header ���
PoolId ���
( TaskId ���
0 Callback �
8 Context ��
@ SubProcessTag
" H CancelCount ��V w* P _ETW_TP_EVENT_CALLBACK_CANCEL .?AU_ETW_TP_EVENT_CALLBACK_CANCEL@@ x* c � J � _FILE_PIPE_PEEK_BUFFER .?AU_FILE_PIPE_PEEK_BUFFER@@ ��~
" NamedPipeState ���
" ReadDataAvailable
" NumberOfMessages �
" MessageLength
Data �J {* _FILE_PIPE_PEEK_BUFFER .?AU_FILE_PIPE_PEEK_BUFFER@@ �� |* � ) �
" dwStreamNumber ���
" dwReserved ���
hSourceFile ��
hDestinationFile �
� uliChunkNumber ���
� uliChunkSize �
� ( uliStreamSize
� 0 uliTotalFileSize �: ~* 8 <anonymous-tag> .?AU<anonymous-tag>@@ * o c
" dwStreamNumber ���
" dwFlags ��
hSourceFile ��
hDestinationFile �
� uliChunkNumber ���
� uliChunkSize �
� ( uliStreamSize
� 0 uliStreamBytesTransferred
� 8 uliTotalFileSize �
� @ uliTotalBytesTransferred �:
�* H <anonymous-tag> .?AU<anonymous-tag>@@ �* o n �
" dwStreamNumber ���
" dwReserved ���
hSourceFile ��
hDestinationFile �
� uliStreamSize
� uliTotalFileSize �: �* ( <anonymous-tag> .?AU<anonymous-tag>@@ �* o { �
" dwStreamNumber ���
" dwReserved ���
hSourceFile ��
hDestinationFile �
� uliStreamSize
� uliStreamBytesTransferred
� ( uliTotalFileSize �
� 0 uliTotalBytesTransferred �: �* 8 <anonymous-tag> .?AU<anonymous-tag>@@ �* o �
" dwReserved ���: �* <anonymous-tag> .?AU<anonymous-tag>@@ �* o � COPYFILE2_PHASE_NONE � COPYFILE2_PHASE_PREPARE_SOURCE ��� COPYFILE2_PHASE_PREPARE_DEST � COPYFILE2_PHASE_READ_SOURCE �� COPYFILE2_PHASE_WRITE_DESTINATION COPYFILE2_PHASE_SERVER_COPY �� COPYFILE2_PHASE_NAMEGRAFT_COPY ��� COPYFILE2_PHASE_MAX ��B t �* _COPYFILE2_COPY_PHASE .?AW4_COPYFILE2_COPY_PHASE@@ � �* o N �
�* CopyPhase
" dwStreamNumber ���
hrFailure
" dwReserved ���
� uliChunkNumber ���
� uliStreamSize
� uliStreamBytesTransferred
� ( uliTotalFileSize �
� 0 uliTotalBytesTransferred �: �* 8 <anonymous-tag> .?AU<anonymous-tag>@@ �* o � �
* ChunkStarted �
�* ChunkFinished
�* StreamStarted
�* StreamFinished ���
�* PollContinue �
�* Error 2 �* H <anonymous-tag> .?AT<anonymous-tag>@@ �* o a 6
>' Type �
" dwPadding
�* Info �> �* P COPYFILE2_MESSAGE .?AUCOPYFILE2_MESSAGE@@ �* o \ V � _MEMORY_PRIORITY_INFORMATION .?AU_MEMORY_PRIORITY_INFORMATION@@ ��
" MemoryPriority ���V �* _MEMORY_PRIORITY_INFORMATION .?AU_MEMORY_PRIORITY_INFORMATION@@ �� �* � :
� > � _KEY_EVENT_RECORD .?AU_KEY_EVENT_RECORD@@ .
q UnicodeChar ��
p AsciiChar 2 �* <anonymous-tag> .?AT<anonymous-tag>@@ �* � 5 �
t bKeyDown �
! wRepeatCount �
! wVirtualKeyCode ��
! wVirtualScanCode �
�*
uChar
" dwControlKeyState > �* _KEY_EVENT_RECORD .?AU_KEY_EVENT_RECORD@@ �* � 0 Z � _PLUGPLAY_CONTROL_INSTALL_DATA .?AU_PLUGPLAY_CONTROL_INSTALL_DATA@@ ��.
" BufferLength �
q Buffer ���Z �* _PLUGPLAY_CONTROL_INSTALL_DATA .?AU_PLUGPLAY_CONTROL_INSTALL_DATA@@ �� �* % � . � _TP_TIMER .?AU_TP_TIMER@@
�* � �* �*
�* 6 � tagTOUCHINPUT .?AUtagTOUCHINPUT@@ �
x
y
hSource ��
" dwID �
" dwFlags ��
" dwMask ���
" dwTime ���
# dwExtraInfo ��
" ( cxContact
" , cyContact 6
�* 0 tagTOUCHINPUT .?AUtagTOUCHINPUT@@ �* b � _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_EX@@ v
ClientSession
ClientProcess
! ClientComputerNameLength �
� ClientComputerBuffer �b �* 8 _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_EX@@ �* � K) � JOBOBJECT_IO_ATTRIBUTION_CONTROL_ENABLE �� JOBOBJECT_IO_ATTRIBUTION_CONTROL_DISABLE � JOBOBJECT_IO_ATTRIBUTION_CONTROL_VALID_FLAGS �f t �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS .?AW4JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS@@ ��� �* ? � � DISPLAYCONFIG_PIXELFORMAT_8BPP ��� DISPLAYCONFIG_PIXELFORMAT_16BPP �� DISPLAYCONFIG_PIXELFORMAT_24BPP �� DISPLAYCONFIG_PIXELFORMAT_32BPP �� DISPLAYCONFIG_PIXELFORMAT_NONGDI � ��DISPLAYCONFIG_PIXELFORMAT_FORCE_UINT32 ��J t �* DISPLAYCONFIG_PIXELFORMAT .?AW4DISPLAYCONFIG_PIXELFORMAT@@ � �* � R
< PoSleepDisableReasonVideo PoSleepDisableReasonHypervisor ��� PoSleepDisableReasonVhdBoot �� PoSleepDisableReasonPortableWorkspace PoSleepDisableReasonPolicy ��� PoSleepDisableReasonGuardedHost �� PoSleepDisableReasonMax ��J t �* _PO_SLEEP_DISABLE_REASON .?AW4_PO_SLEEP_DISABLE_REASON@@ ��� �* x F
R � _HEAP_AFFINITY_SLOT_ASSIGN .?AU_HEAP_AFFINITY_SLOT_ASSIGN@@ ��Z
j Header ���
HeapHandle ���
( SubSegment ���
" 0 SlotIndex R �* 4 _HEAP_AFFINITY_SLOT_ASSIGN .?AU_HEAP_AFFINITY_SLOT_ASSIGN@@ �� �* c t
�# 6 NotificationEvent SynchronizationEvent �. t �* _EVENT_TYPE .?AW4_EVENT_TYPE@@ � �* � t
�*
� DataBuffer ���: �* <anonymous-tag> .?AU<anonymous-tag>@@ �* � V# �
" ReparseTag ���
! ReparseDataLength
! Reserved �
ReparseGuid ��
�* GenericReparseBuffer �N �* _REPARSE_GUID_DATA_BUFFER .?AU_REPARSE_GUID_DATA_BUFFER@@ �* � Q# F � tagWNODE_SINGLE_ITEM .?AUtagWNODE_SINGLE_ITEM@@ ��
� WnodeHeader ��
" 0 OffsetInstanceName ���
" 4 InstanceIndex
" 8 ItemId ���
" < DataBlockOffset ��
" @ SizeDataItem �
� D VariableData �F �* H tagWNODE_SINGLE_ITEM .?AUtagWNODE_SINGLE_ITEM@@ �� �* � � > � tagDRAWITEMSTRUCT .?AUtagDRAWITEMSTRUCT@@
�* �
u CtlType ��
u CtlID
u itemID ���
u itemAction ���
u itemState
� hwndItem �
� hDC ��
! ( rcItem ���
# 8 itemData �> �* @ tagDRAWITEMSTRUCT .?AUtagDRAWITEMSTRUCT@@ �*
�" N
! Flags
! Length ���
" TimeStamp
{ DosPath ��N �* _RTL_DRIVE_LETTER_CURDIR .?AU_RTL_DRIVE_LETTER_CURDIR@@ �� �* 7
� B � tagKBDLLHOOKSTRUCT .?AUtagKBDLLHOOKSTRUCT@@ ��
�* b
" vkCode ���
" scanCode �
" flags
" time �
# dwExtraInfo ��B �* tagKBDLLHOOKSTRUCT .?AUtagKBDLLHOOKSTRUCT@@ �� �* [ V � _SECTION_IMAGE_INFORMATION32 .?AU_SECTION_IMAGE_INFORMATION32@@ ��
�*
��
��
��n
" TransferAddress ��
" ZeroBits �
" MaximumStackSize �
" CommittedStackSize ���
" SubSystemType
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���
! ImageCharacteristics �
! DllCharacteristics ���
! Machine ��
" ImageContainsCode
# ImageFlags ���
�* # ComPlus ��
�* # ImageDynamicallyRelocated
�* # Reserved �
" $ LoaderFlags ��
" ( ImageFileSize
" , CheckSum �V �* 0 _SECTION_IMAGE_INFORMATION32 .?AU_SECTION_IMAGE_INFORMATION32@@ �� �* t � Z � _FILE_IO_COMPLETION_INFORMATION .?AU_FILE_IO_COMPLETION_INFORMATION@@ > � _IO_STATUS_BLOCK .?AU_IO_STATUS_BLOCK@@ ��J
KeyContext ���
ApcContext ���
�* IoStatusBlock Z �* _FILE_IO_COMPLETION_INFORMATION .?AU_FILE_IO_COMPLETION_INFORMATION@@ �* @! �
`! b � _SYSTEM_SESSION_PROCESS_INFORMATION .?AU_SYSTEM_SESSION_PROCESS_INFORMATION@@
�* >
" SessionId
" SizeOfBuf
Buffer ���b �* _SYSTEM_SESSION_PROCESS_INFORMATION .?AU_SYSTEM_SESSION_PROCESS_INFORMATION@@ �* � @ : � tagEXTLOGFONTW .?AUtagEXTLOGFONTW@@ ��
�* " ��
elfLogFont ���
\ elfFullName ��
� elfStyle �
" elfVersion ���
" elfStyleSize �
" $elfMatch �
" (elfReserved ��
�* ,elfVendorId ��
" 0elfCulture ���
4elfPanose :
�* @tagEXTLOGFONTW .?AUtagEXTLOGFONTW@@ �� �* � b � _TRANSACTION_PROPERTIES_INFORMATION .?AU_TRANSACTION_PROPERTIES_INFORMATION@@
�* �
" IsolationLevel ���
" IsolationFlags ���
� Timeout ��
" Outcome ��
" DescriptionLength
| Description ��b �* _TRANSACTION_PROPERTIES_INFORMATION .?AU_TRANSACTION_PROPERTIES_INFORMATION@@ �* � � B � _FOCUS_EVENT_RECORD .?AU_FOCUS_EVENT_RECORD@@
+
t bSetFocus B + _FOCUS_EVENT_RECORD .?AU_FOCUS_EVENT_RECORD@@ + � v
� R � _ETW_UMS_EVENT_DISASSOCIATE .?AU_ETW_UMS_EVENT_DISASSOCIATE@@ �
" ProcessId
" ScheduledThreadId
" PrimaryThreadId ��
" UmsApcControlFlags ���
Status ���R + _ETW_UMS_EVENT_DISASSOCIATE .?AU_ETW_UMS_EVENT_DISASSOCIATE@@ + c � J � _ETW_HEAP_EVENT_CREATE .?AU_ETW_HEAP_EVENT_CREATE@@ ��
j Header ���
HeapHandle ���
" ( Flags
# , ReserveSize ��
# 4 CommitSize ���
# < AllocatedSize J + D _ETW_HEAP_EVENT_CREATE .?AU_ETW_HEAP_EVENT_CREATE@@ ��
+ c > � tagCREATESTRUCTA .?AUtagCREATESTRUCTA@@ ��
+ �
lpCreateParams ���
5 hInstance
� hMenu
� hwndParent ���
t cy ���
t $ cx ���
t ( y
t , x
0 style
� 8 lpszName �
� @ lpszClass
" H dwExStyle > + P tagCREATESTRUCTA .?AUtagCREATESTRUCTA@@ �� + z B � _OUTLINETEXTMETRICW .?AU_OUTLINETEXTMETRICW@@
+ Z
u otmSize ��
otmTextMetrics ���
@ otmFiller
A otmPanoseNumber ��
u L otmfsSelection ���
u P otmfsType
t T otmsCharSlopeRise
t X otmsCharSlopeRun �
t \ otmItalicAngle ���
u ` otmEMSquare ��
t d otmAscent
t h otmDescent ���
u l otmLineGap ���
u p otmsCapEmHeight ��
u t otmsXHeight ��
! x otmrcFontBox �
t � otmMacAscent �
t � otmMacDescent
u � otmMacLineGap
u � otmusMinimumPPEM �
� � otmptSubscriptSize ���
� � otmptSubscriptOffset �
� � otmptSuperscriptSize �
� � otmptSuperscriptOffset ���
u � otmsStrikeoutSize
t � otmsStrikeoutPosition
t � otmsUnderscoreSize ���
t � otmsUnderscorePosition ���
p � otmpFamilyName ���
p � otmpFaceName �
p � otmpStyleName
p � otmpFullName �B + � _OUTLINETEXTMETRICW .?AU_OUTLINETEXTMETRICW@@ + �
� CmResourceShareUndetermined �� CmResourceShareDeviceExclusive ��� CmResourceShareDriverExclusive ��� CmResourceShareShared B t + _CM_SHARE_DISPOSITION .?AW4_CM_SHARE_DISPOSITION@@ � + b � _MEMORY_WORKING_SET_EX_INFORMATION .?AU_MEMORY_WORKING_SET_EX_INFORMATION@@ ��.
�) VirtualAttributes
# Long �2 + <anonymous-tag> .?AT<anonymous-tag>@@ + t z .
VirtualAddress ���
+ u1 ���b + _MEMORY_WORKING_SET_EX_INFORMATION .?AU_MEMORY_WORKING_SET_EX_INFORMATION@@ �� !+ t x n � _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2@@ ��b � _JOBOBJECT_BASIC_LIMIT_INFORMATION .?AU_JOBOBJECT_BASIC_LIMIT_INFORMATION@@ ���
$+ BasicLimitInformation
� @ IoInfo ���
# p ProcessMemoryLimit ���
# x JobMemoryLimit ���
# � PeakProcessMemoryUsed
# � PeakJobMemoryUsed
# � JobTotalMemoryLimit ��n %+ � _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2@@ �� &+ ? o j � _MEMORY_PHYSICAL_CONTIGUITY_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_INFORMATION@@
~ �
VirtualAddress ���
# Size �
# ContiguityUnitSize ���
" Flags
)+ ContiguityUnitInformation j *+ ( _MEMORY_PHYSICAL_CONTIGUITY_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_INFORMATION@@ ++ t �
># B � PPM_IDLESTATE_EVENT .?AUPPM_IDLESTATE_EVENT@@
.+ B
" NewState �
" OldState �
# Processors ���B 0+ PPM_IDLESTATE_EVENT .?AUPPM_IDLESTATE_EVENT@@ 1+ x �
N � _VOLUME_REFS_INFO_BUFFER .?AU_VOLUME_REFS_INFO_BUFFER@@ ��b
� CacheSizeInBytes �
� AllocatedCacheInBytes
� PopulatedCacheInBytes
� InErrorCacheInBytes ��
� MemoryUsedForCacheMetadata ���
" ( CacheLineSize
, CacheTransactionsOutstanding �
0 CacheLinesFree ���
4 CacheLinesInError
� 8 CacheHitsInBytes �
� @ CacheMissesInBytes ���
� H CachePopulationUpdatesInBytes
� P CacheWriteThroughUpdatesInBytes ��
� X CacheInvalidationsInBytes
� ` CacheOverReadsInBytes
� h MetadataWrittenBytes �
p CacheHitCounter ��
t CacheMissCounter �
x CacheLineAllocationCounter ���
| CacheInvalidationsCounter
� CachePopulationUpdatesCounter
� CacheWriteThroughUpdatesCounter ��
� MaxCacheTransactionsOutstanding ��
� DataWritesReallocationCount ��
� DataInPlaceWriteCount
� MetadataAllocationsFastTierCount �
� MetadataAllocationsSlowTierCount �
� DataAllocationsFastTierCount �
� DataAllocationsSlowTierCount �
� DestagesSlowTierToFastTier ���
� DestagesFastTierToSlowTier ���
� SlowTierDataFillRatio
� FastTierDataFillRatio
� SlowTierMetadataFillRatio
� FastTierMetadataFillRatio
� SlowToFastDestageReadLatency �
� SlowToFastDestageReadLatencyBase �
� SlowToFastDestageWriteLatency
� SlowToFastDestageWriteLatencyBase
� FastToSlowDestageReadLatency �
� FastToSlowDestageReadLatencyBase �
� FastToSlowDestageWriteLatency
� FastToSlowDestageWriteLatencyBase
� SlowTierContainerFillRatio ���
� SlowTierContainerFillRatioBase ���
� FastTierContainerFillRatio ���
� FastTierContainerFillRatioBase ���
� TreeUpdateLatency
� TreeUpdateLatencyBase
� CheckpointLatency
� CheckpointLatencyBase
� TreeUpdateCount ��
CheckpointCount ��
LogWriteCount
LogFillRatio �
ReadCacheInvalidationsForOverwrite ���
ReadCacheInvalidationsForReuse ���
ReadCacheInvalidationsGeneral
ReadCacheChecksOnMount ���
ReadCacheIssuesOnMount ���
TrimLatency ��
$TrimLatencyBase ��
(DataCompactionCount ��
,CompactionReadLatency
0CompactionReadLatencyBase
4CompactionWriteLatency ���
8CompactionWriteLatencyBase ���
� @DataInPlaceWriteClusterCount �
HCompactionFailedDueToIneligibleContainer �
LCompactionFailedDueToMaxFragmentation
PCompactedContainerFillRatio ��
TCompactedContainerFillRatioBase ��
XContainerMoveRetryCount ��
\ContainerMoveFailedDueToIneligibleContainer ��
`CompactionFailureCount ���
dContainerMoveFailureCount
� hNumberOfDirtyMetadataPages ���
pNumberOfDirtyTableListEntries
tNumberOfDeleteQueueEntries ���N O 4+ x_VOLUME_REFS_INFO_BUFFER .?AU_VOLUME_REFS_INFO_BUFFER@@ �� 5+ � �)
�! n � _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION@@ ��
# CycleTime n 9+ _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION@@ �� :+ � � J � _RTL_UNLOAD_EVENT_TRACE .?AU_RTL_UNLOAD_EVENT_TRACE@@ �
BaseAddress ��
# SizeOfImage ��
" Sequence �
" TimeDateStamp
" CheckSum �
ImageName
8 \ Version ��J =+ h _RTL_UNLOAD_EVENT_TRACE .?AU_RTL_UNLOAD_EVENT_TRACE@@ >+ � � J � _RTL_CIRCULAR_LIST_HEAD .?AU_RTL_CIRCULAR_LIST_HEAD@@
A+ HeadEntry J B+ _RTL_CIRCULAR_LIST_HEAD .?AU_RTL_CIRCULAR_LIST_HEAD@@ C+ � j ShutdownNoReboot � ShutdownReboot ��� ShutdownPowerOff � ShutdownRebootForRecovery : t E+ _SHUTDOWN_ACTION .?AW4_SHUTDOWN_ACTION@@ ��� F+ � 9 Z � _FSCTL_UNMAP_SPACE_INPUT_BUFFER .?AU_FSCTL_UNMAP_SPACE_INPUT_BUFFER@@
� BytesToUnmap �Z I+ _FSCTL_UNMAP_SPACE_INPUT_BUFFER .?AU_FSCTL_UNMAP_SPACE_INPUT_BUFFER@@ J+ � �* z � _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION@@ ��*
z( BasicInfo
� 0 IoInfo ���z M+ ` _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION@@ �� N+ ? � .
" SizeOfBitMap �
" Buffer ���2 P+ _RTL_BITMAP .?AU_RTL_BITMAP@@ Q+ b f b � _SYSTEM_FEATURE_CONFIGURATION_QUERY .?AU_SYSTEM_FEATURE_CONFIGURATION_QUERY@@
S+ r RtlFeatureConfigurationBoot �� RtlFeatureConfigurationRuntime ��� RtlFeatureConfigurationCount �V t U+ _RTL_FEATURE_CONFIGURATION_TYPE .?AW4_RTL_FEATURE_CONFIGURATION_TYPE@@ � V+ t 2
V+ ConfigurationType
u FeatureId b X+ _SYSTEM_FEATURE_CONFIGURATION_QUERY .?AU_SYSTEM_FEATURE_CONFIGURATION_QUERY@@ Y+ � ^
J [+ * � HIMC__ .?AUHIMC__@@ ��
]+
t unused ���* _+ HIMC__ .?AUHIMC__@@ �� `+ � : GetFileExInfoStandard GetFileExMaxInfoLevel F t b+ _GET_FILEEX_INFO_LEVELS .?AW4_GET_FILEEX_INFO_LEVELS@@ � c+ � �
9! B � tagEMRSETICMPROFILE .?AUtagEMRSETICMPROFILE@@ ^
� emr ��
" dwFlags ��
" cbName ���
" cbData ���
� Data �B g+ tagEMRSETICMPROFILE .?AUtagEMRSETICMPROFILE@@ h+ � � J � _ENCLAVE_LOAD_INFO_VBS .?AU_ENCLAVE_LOAD_INFO_VBS@@ ��V
ImageHandle ��
# Unused ���
! NameLength ���
|
Name �J k+ _ENCLAVE_LOAD_INFO_VBS .?AU_ENCLAVE_LOAD_INFO_VBS@@ �� l+ � � > � _WAKE_TIMER_INFO .?AU_WAKE_TIMER_INFO@@ ��B � _DIAGNOSTIC_BUFFER .?AU_DIAGNOSTIC_BUFFER@@ ��Z
# OffsetToNext �
� DueTime ��
" Period ���
o+ ReasonContext > p+ @ _WAKE_TIMER_INFO .?AU_WAKE_TIMER_INFO@@ �� q+ x � * � BSMINFO .?AUBSMINFO@@
s+ * � HDESK__ .?AUHDESK__@@
u+ F
u cbSize ���
v+ hdesk
� hwnd �
� luid �* w+ BSMINFO .?AUBSMINFO@@ x+ � : � tagMDINEXTMENU .?AUtagMDINEXTMENU@@ ��
z+ >
� hmenuIn ��
� hmenuNext
� hwndNext �: |+ tagMDINEXTMENU .?AUtagMDINEXTMENU@@ �� }+ 0 n � _PROCESS_REVOKE_FILE_HANDLES_INFORMATION .?AU_PROCESS_REVOKE_FILE_HANDLES_INFORMATION@@ ��
TargetDevicePath �n �+ _PROCESS_REVOKE_FILE_HANDLES_INFORMATION .?AU_PROCESS_REVOKE_FILE_HANDLES_INFORMATION@@ �� �+ ? : F � _ETW_SET_TIMER_EVENT .?AU_ETW_SET_TIMER_EVENT@@ ���
# ExpectedDueTime ��
# TimerAddress �
! TargetProcessorGroup �
TargetProcessorIndex �
Flags
" Period ���
EncodedDelay �
Reserved0
! UniqueProcessId ��F �+ _ETW_SET_TIMER_EVENT .?AU_ETW_SET_TIMER_EVENT@@ �� �+ c � B � _CONNECTDLGSTRUCTW .?AU_CONNECTDLGSTRUCTW@@ ��6 � _NETRESOURCEW .?AU_NETRESOURCEW@@
�+ j
" cbStructure ��
� hwndOwner
�+ lpConnRes
" dwFlags ��
" dwDevNum �B �+ _CONNECTDLGSTRUCTW .?AU_CONNECTDLGSTRUCTW@@ �� �+ � �
& J � _ETW_REGNOTIF_REGISTER .?AU_ETW_REGNOTIF_REGISTER@@ ��b
Notification �
Kcb ��
Type �
WatchTree
Primary ��J �+ _ETW_REGNOTIF_REGISTER .?AU_ETW_REGNOTIF_REGISTER@@ �� �+ c � : � tagSERIALKEYSA .?AUtagSERIALKEYSA@@ ��
u cbSize ���
" dwFlags ��
p lpszActivePort ���
p lpszPort �
u iBaudRate
u iPortState ���
u iActive ��: �+ ( tagSERIALKEYSA .?AUtagSERIALKEYSA@@ �� �+ H2 B � tagMOUSEHOOKSTRUCT .?AUtagMOUSEHOOKSTRUCT@@ ��
�+ R
� pt ���
� hwnd �
u wHitTestCode �
# dwExtraInfo ��B �+ tagMOUSEHOOKSTRUCT .?AUtagMOUSEHOOKSTRUCT@@ �� �+ � F � IMPORT_OBJECT_HEADER .?AUIMPORT_OBJECT_HEADER@@ ��
! ��
! ��
! ���
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
" SizeOfData ���
! Ordinal ��
! Hint �
�+ Type �
�+ NameType �
�+ Reserved �F �+ IMPORT_OBJECT_HEADER .?AUIMPORT_OBJECT_HEADER@@ �� �+ � q : � _REASON_CONTEXT .?AU_REASON_CONTEXT@@
�+ r
� LocalizedReasonModule
" LocalizedReasonId
" ReasonStringCount
� ReasonStrings : �+ <anonymous-tag> .?AU<anonymous-tag>@@ �+ �
6
�+ Detailed �
q SimpleReasonString ���2 �+ <anonymous-tag> .?AT<anonymous-tag>@@ �+ � :
" Version ��
" Flags
�+ Reason ���: �+ _REASON_CONTEXT .?AU_REASON_CONTEXT@@ �+ � > OS_DEPLOYMENT_STANDARD ��� OS_DEPLOYMENT_COMPACT R t �+ _OS_DEPLOYEMENT_STATE_VALUES .?AW4_OS_DEPLOYEMENT_STATE_VALUES@@ ��� �+ b �# ^ � _SYSTEM_POOL_ZEROING_INFORMATION .?AU_SYSTEM_POOL_ZEROING_INFORMATION@@ ��
�+ &
PoolZeroingSupportPresent ^ �+ _SYSTEM_POOL_ZEROING_INFORMATION .?AU_SYSTEM_POOL_ZEROING_INFORMATION@@ �� �+ � � Z � _PERFINFO_FILE_SIMPLE_OPERATION .?AU_PERFINFO_FILE_SIMPLE_OPERATION@@ Z
# Irp ��
# FileObject ���
# FileKey ��
" IssuingThreadId ��Z �+ _PERFINFO_FILE_SIMPLE_OPERATION .?AU_PERFINFO_FILE_SIMPLE_OPERATION@@ �+ c �
SystemProcessClassificationNormal SystemProcessClassificationSystem SystemProcessClassificationSecureSystem �� SystemProcessClassificationMemCompression SystemProcessClassificationRegistry �� SystemProcessClassificationMaximum ���V t �+ _SYSTEM_PROCESS_CLASSIFICATION .?AW4_SYSTEM_PROCESS_CLASSIFICATION@@ ��� �+ �
� ��
�+ v � _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION .?AU_ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION@@
�+ ��
�+ Z � _COMPATIBILITY_CONTEXT_ELEMENT .?AU_COMPATIBILITY_CONTEXT_ELEMENT@@ �� �+ " �.
" ElementCount �
�+ Elements �v �+ _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION .?AU_ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION@@ �+ � J � _RTLP_HEAP_TAGGING_INFO .?AU_RTLP_HEAP_TAGGING_INFO@@ : � _RTLP_TAG_INFO .?AU_RTLP_TAG_INFO@@ �� �+ " �f
! Version ��
! Flags
Process ��
# EntriesCount �
�+ Entries ��J �+ 0 _RTLP_HEAP_TAGGING_INFO .?AU_RTLP_HEAP_TAGGING_INFO@@ �+ � �
! " @ �Z
elfLogFont ���
�+ < elfFullName ��
� | elfStyle �
� � elfScript > �+ � tagENUMLOGFONTEXA .?AUtagENUMLOGFONTEXA@@ �+ � � F � _MM_ETW_PAGE_INFO_EX .?AU_MM_ETW_PAGE_INFO_EX@@ ��
�+ > � _MM_ETW_PAGE_INFO .?AU_MM_ETW_PAGE_INFO@@ &
�+ PageInfo �
�! Info �F �+ _MM_ETW_PAGE_INFO_EX .?AU_MM_ETW_PAGE_INFO_EX@@ �� �+ t S V IMO_UNAVAILABLE �� IMO_HARDWARE � IMO_INJECTED � IMO_SYSTEM ���N t �+ tagINPUT_MESSAGE_ORIGIN_ID .?AW4tagINPUT_MESSAGE_ORIGIN_ID@@ ��� �+ �=
z J � _IMAGE_BASE_RELOCATION .?AU_IMAGE_BASE_RELOCATION@@ ��
�+ ��
�+ 6
" VirtualAddress ���
" SizeOfBlock ��J �+ _IMAGE_BASE_RELOCATION .?AU_IMAGE_BASE_RELOCATION@@ �� �+ � $ ^ � _RTL_QUERY_DEBUG_VIRTUAL_PROCESS .?AU_RTL_QUERY_DEBUG_VIRTUAL_PROCESS@@ �� # # �+
�+ � " " �+
�+ V
Context ��
�+ ReadMemoryRoutine
�+ QueryInformationRoutine ��^ �+ _RTL_QUERY_DEBUG_VIRTUAL_PROCESS .?AU_RTL_QUERY_DEBUG_VIRTUAL_PROCESS@@ �� �+ � . > � _OSVERSIONINFOEXW .?AU_OSVERSIONINFOEXW@@
�+
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
�$ szCSDVersion �
! wServicePackMajor
! wServicePackMinor
! wSuiteMask ���
wProductType �
wReserved > �+ _OSVERSIONINFOEXW .?AU_OSVERSIONINFOEXW@@ �+ b �
M 2 � _MUICCENTRY .?AU_MUICCENTRY@@
�+ �+ " � t " �
u lCultureNameOffset ���
u ulCultureID ��
" ulLanguageType ���
�+ pNeutralCulture ��
�+ lBaseLanguageIndices �
�+ 8 lParentLanguageIndices ���2 �+ H _MUICCENTRY .?AU_MUICCENTRY@@ �+ : � _CLIENT_CALL_RETURN .?AT_CLIENT_CALL_RETURN@@ *
Pointer ��
Simple ���: �+ _CLIENT_CALL_RETURN .?AT_CLIENT_CALL_RETURN@@ �+ � � V � _MEMORY_PARTITION_PAGE_RANGE .?AU_MEMORY_PARTITION_PAGE_RANGE@@ ��.
# StartPage
# NumberOfPages V �+ _MEMORY_PARTITION_PAGE_RANGE .?AU_MEMORY_PARTITION_PAGE_RANGE@@ �� �+ t � Z � _PERFINFO_DRIVER_MAJORFUNCTION .?AU_PERFINFO_DRIVER_MAJORFUNCTION@@ ��
, �
" MajorFunction
" MinorFunction
RoutineAddr ��
FileNamePointer ��
Irp ��
" UniqMatchId ��Z , $ _PERFINFO_DRIVER_MAJORFUNCTION .?AU_PERFINFO_DRIVER_MAJORFUNCTION@@ �� , c � � " � t ,
, : � _MODEMSETTINGS .?AU_MODEMSETTINGS@@ ��j
" dwActualSize �
" dwRequiredSize ���
" dwDevSpecificOffset ��
" dwDevSpecificSize
" dwCallSetupFailTimer �
" dwInactivityTimeout ��
" dwSpeakerVolume ��
" dwSpeakerMode
" dwPreferredModemOptions ��
" $ dwNegotiatedModemOptions �
" ( dwNegotiatedDCERate ��
� , abVariablePortion : , 0 _MODEMSETTINGS .?AU_MODEMSETTINGS@@ ��& onecore\external\sdk\inc\mcx.h �
, , 2
U* R � _FILE_DIRECTORY_INFORMATION .?AU_FILE_DIRECTORY_INFORMATION@@
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
| @ FileName �R , H _FILE_DIRECTORY_INFORMATION .?AU_FILE_DIRECTORY_INFORMATION@@ , � � Z � _RTL_SEGMENT_HEAP_MEMORY_SOURCE .?AU_RTL_SEGMENT_HEAP_MEMORY_SOURCE@@ # " �r
" Flags
" MemoryTypeMask ���
" NumaNode �
PartitionHandle ��
, Reserved �Z , ( _RTL_SEGMENT_HEAP_MEMORY_SOURCE .?AU_RTL_SEGMENT_HEAP_MEMORY_SOURCE@@ , b �
6
" dwLowDateTime
" dwHighDateTime ���. , _FILETIME .?AU_FILETIME@@ , �' N � _CM_PARTIAL_RESOURCE_LIST .?AU_CM_PARTIAL_RESOURCE_LIST@@
, h " �Z
! Version ��
! Revision �
" Count
, PartialDescriptors ���N , _CM_PARTIAL_RESOURCE_LIST .?AU_CM_PARTIAL_RESOURCE_LIST@@ , U 2 � FLASHWINFO .?AUFLASHWINFO@@ ��
, b
u cbSize ���
� hwnd �
" dwFlags ��
u uCount ���
" dwTimeout 2 ", FLASHWINFO .?AUFLASHWINFO@@ �� #, : � " %,
f � _RTL_USER_PROCESS_EXTENDED_PARAMETERS .?AU_RTL_USER_PROCESS_EXTENDED_PARAMETERS@@
(, �
! Version ��
! NodeNumber ���
ProcessSecurityDescriptor
ThreadSecurityDescriptor �
ParentProcess
DebugPort
( TokenHandle ��
0 JobHandle f *, 8 _RTL_USER_PROCESS_EXTENDED_PARAMETERS .?AU_RTL_USER_PROCESS_EXTENDED_PARAMETERS@@ +, W f � _JOURNAL_SET_KEY_SECURITY_INFORMATION .?AU_JOURNAL_SET_KEY_SECURITY_INFORMATION@@ �
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
" ( OldSecurityDescriptorLength ��
0 OldSecurityDescriptor
" 8 NewSecurityDescriptorLength ��
@ NewSecurityDescriptor f ., H _JOURNAL_SET_KEY_SECURITY_INFORMATION .?AU_JOURNAL_SET_KEY_SECURITY_INFORMATION@@ /, � � N � PPM_IDLE_STATE_BUCKET_EX .?AUPPM_IDLE_STATE_BUCKET_EX@@ ��R
# TotalTimeUs ��
" MinTimeUs
" MaxTimeUs
" Count N 2, PPM_IDLE_STATE_BUCKET_EX .?AUPPM_IDLE_STATE_BUCKET_EX@@ �� 3, x
& � _QUAD .?AU_QUAD@@
5, ��
6, >
UseThisFieldToCopy ���
A DoNotUseThisField & 8, _QUAD .?AU_QUAD@@ 9, � J � _SECURITY_CAPABILITIES .?AU_SECURITY_CAPABILITIES@@ ��
;, f
AppContainerSid ��
^ Capabilities �
" CapabilityCount ��
" Reserved �J =, _SECURITY_CAPABILITIES .?AU_SECURITY_CAPABILITIES@@ �� >, x ; Z � _IMAGE_RESOURCE_DIRECTORY_ENTRY .?AU_IMAGE_RESOURCE_DIRECTORY_ENTRY@@
@,
" ��
" ��
" ��
" ��
B, NameOffset ���
C, NameIsString �
" Name �
! Id ���
" OffsetToData �
D, OffsetToDirectory
E, DataIsDirectory ��Z F, _IMAGE_RESOURCE_DIRECTORY_ENTRY .?AU_IMAGE_RESOURCE_DIRECTORY_ENTRY@@ G, � K V � _PERFINFO_PAGE_RANGE_IDENTITY .?AU_PERFINFO_PAGE_RANGE_IDENTITY@@
# ��
# 0��
# 4��
J, UseDescription ���
K, UniqueKey
L, Reserved �
ProtoPteAddress ��
# PageFrameIndex ���
VirtualAddress ���
# PageCount V M, _PERFINFO_PAGE_RANGE_IDENTITY .?AU_PERFINFO_PAGE_RANGE_IDENTITY@@ N, c � b TokenElevationTypeDefault TokenElevationTypeFull ��� TokenElevationTypeLimited B t P, _TOKEN_ELEVATION_TYPE .?AW4_TOKEN_ELEVATION_TYPE@@ � Q, x -
�
� R � _ENLISTMENT_CRM_INFORMATION .?AU_ENLISTMENT_CRM_INFORMATION@@
U, b
CrmTransactionManagerId ��
CrmResourceManagerId �
CrmEnlistmentId ��R W, 0 _ENLISTMENT_CRM_INFORMATION .?AU_ENLISTMENT_CRM_INFORMATION@@ X, � [ n � _FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT .?AU_FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT@@ ��
Z, z FileMetadataOptimizationNone � FileMetadataOptimizationInProgress ��� FileMetadataOptimizationPending ��Z t \, _FILE_METADATA_OPTIMIZATION_STATE .?AW4_FILE_METADATA_OPTIMIZATION_STATE@@ � ], � �(
], State
" AttributeListSize
" MetadataSpaceUsed
" MetadataSpaceAllocated ���
" NumberOfFileRecords ��
" NumberOfResidentAttributes ���
" NumberOfNonresidentAttributes
" TotalInProgress ��
" TotalPending �n _, $ _FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT .?AU_FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT@@ �� `, � �( B � _XSAVE_CET_U_FORMAT .?AU_XSAVE_CET_U_FORMAT@@
b, 2
# Ia32CetUMsr ��
# Ia32Pl3SspMsr B d, _XSAVE_CET_U_FORMAT .?AU_XSAVE_CET_U_FORMAT@@ e, L F � _LOAD_DLL_EVENT_DATA .?AU_LOAD_DLL_EVENT_DATA@@ ��
| ImageName F h, _LOAD_DLL_EVENT_DATA .?AU_LOAD_DLL_EVENT_DATA@@ �� i, c * Z � _SYSTEM_MEMORY_LIST_INFORMATION .?AU_SYSTEM_MEMORY_LIST_INFORMATION@@ # " @ ��
# ZeroPageCount
# FreePageCount
# ModifiedPageCount
# ModifiedNoWritePageCount �
# BadPageCount �
l, ( PageCountByPriority ��
l, h RepurposedPagesByPriority
# � ModifiedPageCountPageFile Z m, � _SYSTEM_MEMORY_LIST_INFORMATION .?AU_SYSTEM_MEMORY_LIST_INFORMATION@@ n, � � Z � _FILE_ATTRIBUTE_TAG_INFORMATION .?AU_FILE_ATTRIBUTE_TAG_INFORMATION@@ 6
" FileAttributes ���
" ReparseTag ���Z q, _FILE_ATTRIBUTE_TAG_INFORMATION .?AU_FILE_ATTRIBUTE_TAG_INFORMATION@@ r, � ? 6 PlatformRoleUnspecified �� PlatformRoleDesktop �� PlatformRoleMobile ��� PlatformRoleWorkstation �� PlatformRoleEnterpriseServer � PlatformRoleSOHOServer ��� PlatformRoleAppliancePC �� PlatformRolePerformanceServer PlatformRoleSlate PlatformRoleMaximum ��B
t t, _POWER_PLATFORM_ROLE .?AW4_POWER_PLATFORM_ROLE@@ ��� u, x �
� B � _SERVICE_NOTIFY_2A .?AU_SERVICE_NOTIFY_2A@@ ��
" dwVersion
� pfnNotifyCallback
pContext �
" dwNotificationStatus �
� ServiceStatus
" @ dwNotificationTriggered ��
p H pszServiceNames ��B y, P _SERVICE_NOTIFY_2A .?AU_SERVICE_NOTIFY_2A@@ �� z, � �
$
x
y * }, _POINTL .?AU_POINTL@@ ~, t �
t unused ���* �, HDESK__ .?AUHDESK__@@ �, t S . � _RGNDATA .?AU_RGNDATA@@ ��
�, : � _RGNDATAHEADER .?AU_RGNDATAHEADER@@ ��&
�, rdh ��
l Buffer ���. �, $ _RGNDATA .?AU_RGNDATA@@ �� �, � � � CI_WINDOWS_LOCKDOWN_RESTRICTION_NONE � CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK � CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK_PERMANENT ��� CI_WINDOWS_LOCKDOWN_RESTRICTION_MAX ��V t �, CI_WINDOWS_LOCKDOWN_RESTRICTION .?AW4CI_WINDOWS_LOCKDOWN_RESTRICTION@@ � �, � �
G ^ � _PUBLIC_OBJECT_BASIC_INFORMATION .?AU_PUBLIC_OBJECT_BASIC_INFORMATION@@ �� " " ( �v
" Attributes ���
" GrantedAccess
" HandleCount ��
" PointerCount �
�, Reserved �^ �, 8 _PUBLIC_OBJECT_BASIC_INFORMATION .?AU_PUBLIC_OBJECT_BASIC_INFORMATION@@ �� �, n � J � REFS_VOLUME_DATA_BUFFER .?AUREFS_VOLUME_DATA_BUFFER@@ � " H ��
" ByteCount
" MajorVersion �
" MinorVersion �
" BytesPerPhysicalSector ���
� VolumeSerialNumber ���
� NumberSectors
� TotalClusters
� ( FreeClusters �
� 0 TotalReserved
" 8 BytesPerSector ���
" < BytesPerCluster ��
� @ MaximumSizeOfResidentFile
! H FastTierDataFillRatio
! J SlowTierDataFillRatio
" L DestagesFastTierToSlowTierRate ���
�, P Reserved �J �, � REFS_VOLUME_DATA_BUFFER .?AUREFS_VOLUME_DATA_BUFFER@@ �, �
v � _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION .?AU_PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION@@ >
" Version ��
" Reserved �
# Callback �v �, _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION .?AU_PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION@@ �, � � . � tagLOGPEN .?AUtagLOGPEN@@
�, >
u lopnStyle
� lopnWidth
" lopnColor . �, tagLOGPEN .?AUtagLOGPEN@@ �, � k � POINTER_DEVICE_TYPE_INTEGRATED_PEN ��� POINTER_DEVICE_TYPE_EXTERNAL_PEN � POINTER_DEVICE_TYPE_TOUCH POINTER_DEVICE_TYPE_TOUCH_PAD ��POINTER_DEVICE_TYPE_MAX �F t �, tagPOINTER_DEVICE_TYPE .?AW4tagPOINTER_DEVICE_TYPE@@ ��� �, �; 6 � HCOLORSPACE__ .?AUHCOLORSPACE__@@
�,
t unused ���6 �, HCOLORSPACE__ .?AUHCOLORSPACE__@@ �, t M b � _RTL_PROCESS_MODULE_INFORMATION_EX .?AU_RTL_PROCESS_MODULE_INFORMATION_EX@@ ��v
! NextOffset ���
BaseInfo �
" 0ImageChecksum
" 4TimeDateStamp
8DefaultBase ��b �, @_RTL_PROCESS_MODULE_INFORMATION_EX .?AU_RTL_PROCESS_MODULE_INFORMATION_EX@@ �� �, � � N � _ETW_TP_EVENT_POOL_CREATE .?AU_ETW_TP_EVENT_POOL_CREATE@@
�, *
j Header ���
PoolId ���N �, ( _ETW_TP_EVENT_POOL_CREATE .?AU_ETW_TP_EVENT_POOL_CREATE@@ �, c �
� � ImagePolicyEntryTypeNone � ImagePolicyEntryTypeBool � ImagePolicyEntryTypeInt8 � ImagePolicyEntryTypeUInt8 ImagePolicyEntryTypeInt16 ImagePolicyEntryTypeUInt16 ��� ImagePolicyEntryTypeInt32 ImagePolicyEntryTypeUInt32 ��� ImagePolicyEntryTypeInt64 ImagePolicyEntryTypeUInt64 ���
ImagePolicyEntryTypeAnsiString ��� ImagePolicyEntryTypeUnicodeString ImagePolicyEntryTypeOverride �
ImagePolicyEntryTypeMaximum ��J t �, _IMAGE_POLICY_ENTRY_TYPE .?AW4_IMAGE_POLICY_ENTRY_TYPE@@ ��� �, b L& . � _FLOAT128 .?AU_FLOAT128@@
�, *
LowPart ��
HighPart �. �, _FLOAT128 .?AU_FLOAT128@@ �, U q t t t t �,
�, b � _RESOURCEMANAGER_BASIC_INFORMATION .?AU_RESOURCEMANAGER_BASIC_INFORMATION@@ ��R
ResourceManagerId
" DescriptionLength
| Description ��b �, _RESOURCEMANAGER_BASIC_INFORMATION .?AU_RESOURCEMANAGER_BASIC_INFORMATION@@ �� �, � 6 � _MODEMDEVCAPS .?AU_MODEMDEVCAPS@@ N
" dwActualSize �
" dwRequiredSize ���
" dwDevSpecificOffset ��
" dwDevSpecificSize
" dwModemProviderVersion ���
" dwModemManufacturerOffset
" dwModemManufacturerSize ��
" dwModemModelOffset ���
" dwModemModelSize �
" $ dwModemVersionOffset �
" ( dwModemVersionSize ���
" , dwDialOptions
" 0 dwCallSetupFailTimer �
" 4 dwInactivityTimeout ��
" 8 dwSpeakerVolume ��
" < dwSpeakerMode
" @ dwModemOptions ���
" D dwMaxDTERate �
" H dwMaxDCERate �
� L abVariablePortion 6 �, P _MODEMDEVCAPS .?AU_MODEMDEVCAPS@@ �, , Z � _SYSTEM_ACPI_AUDIT_INFORMATION .?AU_SYSTEM_ACPI_AUDIT_INFORMATION@@ ��
" ��
" ��
" ��Z
" RsdpCount
�, SameRsdt �
�, SlicPresent ��
�, SlicDifferent Z �, _SYSTEM_ACPI_AUDIT_INFORMATION .?AU_SYSTEM_ACPI_AUDIT_INFORMATION@@ �� �, � �
v � _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT@@ ��
�, ^
" PropagationCookie
UOW ��
TmIdentity ���
" $ BufferLength �v �, ( _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT@@ �� �, � � N � _HEAP_EVENT_RANGE_CREATE .?AU_HEAP_EVENT_RANGE_CREATE@@ ��F
HeapHandle ���
# FirstRangeSize ���
" Flags N �, _HEAP_EVENT_RANGE_CREATE .?AU_HEAP_EVENT_RANGE_CREATE@@ �� �, c � . � _RPC_SID .?AU_RPC_SID@@ ��N � _SID_IDENTIFIER_AUTHORITY .?AU_SID_IDENTIFIER_AUTHORITY@@ j
Revision �
SubAuthorityCount
�, IdentifierAuthority ��
� SubAuthority �. �, _RPC_SID .?AU_RPC_SID@@ �� �, B 8 6 � _DRAWPATRECT .?AU_DRAWPATRECT@@ ��V
� ptPosition ���
� ptSize ���
! wStyle ���
! wPattern �6 �, _DRAWPATRECT .?AU_DRAWPATRECT@@ �� �, � %
O
�
� � �, J � _IMAGE_HOT_PATCH_HASHES .?AU_IMAGE_HOT_PATCH_HASHES@@ &
� SHA256 ���
� SHA1 �J �, 4 _IMAGE_HOT_PATCH_HASHES .?AU_IMAGE_HOT_PATCH_HASHES@@ �, � � ^ � _PERFINFO_CC_SCHEDULE_READ_AHEAD .?AU_PERFINFO_CC_SCHEDULE_READ_AHEAD@@ ��
" ��
" ��j
# WorkItemKey ��
# FileObjectKey
# FileOffset ���
" Length ���
" ReadAheadUnit
" ReadAheadLength ��
# ( ReadAheadOffset ��
# 0 ReadAheadBeyondLastByte ��
8 ReadPattern ��
" < SequentialReadCount ��
" @ SharedCacheMapFlags ��
�, D ReadAheadSettingsChanged �
�, D ReadAheadActive ��^
�, H _PERFINFO_CC_SCHEDULE_READ_AHEAD .?AU_PERFINFO_CC_SCHEDULE_READ_AHEAD@@ �� �, c � . � _DOCINFOW .?AU_DOCINFOW@@ r
t cbSize ���
lpszDocName ��
lpszOutput ���
lpszDatatype �
" fwType ���. �, ( _DOCINFOW .?AU_DOCINFOW@@ �, � � V � _KEY_HANDLE_TAGS_INFORMATION .?AU_KEY_HANDLE_TAGS_INFORMATION@@ ��
" HandleTags ���V �, _KEY_HANDLE_TAGS_INFORMATION .?AU_KEY_HANDLE_TAGS_INFORMATION@@ �� �, � Z V � _REFS_DEALLOCATE_RANGES_RANGE .?AU_REFS_DEALLOCATE_RANGES_RANGE@@ 2
# StartOfRange �
# CountOfRange �V �, _REFS_DEALLOCATE_RANGES_RANGE .?AU_REFS_DEALLOCATE_RANGES_RANGE@@ �, � �* V � _FILE_COMPRESSION_INFORMATION .?AU_FILE_COMPRESSION_INFORMATION@@ �
� CompressedFileSize ���
! CompressionFormat
CompressionUnitShift �
ChunkShift ���
ClusterShift �
-
Reserved �V �, _FILE_COMPRESSION_INFORMATION .?AU_FILE_COMPRESSION_INFORMATION@@ �, � � R � _IMAGE_COFF_SYMBOLS_HEADER .?AU_IMAGE_COFF_SYMBOLS_HEADER@@ ��
�, �
" NumberOfSymbols ��
" LvaToFirstSymbol �
" NumberOfLinenumbers ��
" LvaToFirstLinenumber �
" RvaToFirstByteOfCode �
" RvaToLastByteOfCode ��
" RvaToFirstByteOfData �
" RvaToLastByteOfData ��R �, _IMAGE_COFF_SYMBOLS_HEADER .?AU_IMAGE_COFF_SYMBOLS_HEADER@@ �� �, � � z � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2@@ �
MaxIops ��
MaxBandwidth �
ReservationIops ��
q VolumeName ���
" BaseIoSize ���
0 $ ControlFlags �
! ( VolumeNameLength �
0 CriticalReservationIops ��
8 ReservationBandwidth �
@ CriticalReservationBandwidth �
H MaxTimePercent ���
P ReservationTimePercent ���
X CriticalReservationTimePercent ���z
- ` JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2@@ - ? l > � MENUITEMTEMPLATE .?AUMENUITEMTEMPLATE@@ ��:
! mtOption �
! mtID �
| mtString �> - MENUITEMTEMPLATE .?AUMENUITEMTEMPLATE@@ �� - �(
< �
! wYear
! wMonth ���
! wDayOfWeek ���
! wDay �
! wHour
!
wMinute ��
! wSecond ��
! wMilliseconds 2 - _SYSTEMTIME .?AU_SYSTEMTIME@@ - � Z
�
� V � NTFS_FILE_RECORD_INPUT_BUFFER .?AUNTFS_FILE_RECORD_INPUT_BUFFER@@ "
� FileReferenceNumber ��V - NTFS_FILE_RECORD_INPUT_BUFFER .?AUNTFS_FILE_RECORD_INPUT_BUFFER@@ - � �
| " -
? B � tagRECONVERTSTRING .?AUtagRECONVERTSTRING@@ ���
" dwSize ���
" dwVersion
" dwStrLen �
" dwStrOffset ��
" dwCompStrLen �
" dwCompStrOffset ��
" dwTargetStrLen ���
" dwTargetStrOffset B - tagRECONVERTSTRING .?AUtagRECONVERTSTRING@@ �� - � x B � _OSVERSIONINFOEX2W .?AU_OSVERSIONINFOEX2W@@ ��
- N
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
�$ szCSDVersion �
! wServicePackMajor
! wServicePackMinor
! wSuiteMask ���
wProductType �
wReserved
" wSuiteMaskEx �
" wReserved2 ���B
- $_OSVERSIONINFOEX2W .?AU_OSVERSIONINFOEX2W@@ �� - b � j � _RESOURCEMANAGER_COMPLETION_INFORMATION .?AU_RESOURCEMANAGER_COMPLETION_INFORMATION@@
- >
IoCompletionPortHandle ���
# CompletionKey j "- _RESOURCEMANAGER_COMPLETION_INFORMATION .?AU_RESOURCEMANAGER_COMPLETION_INFORMATION@@ #- � $ ^ � _SYSTEM_SINGLE_MODULE_INFORMATION .?AU_SYSTEM_SINGLE_MODULE_INFORMATION@@ 6
TargetModuleAddress ��
�, ExInfo ���^ &- H_SYSTEM_SINGLE_MODULE_INFORMATION .?AU_SYSTEM_SINGLE_MODULE_INFORMATION@@ '- � ]
� F � _REARRANGE_FILE_DATA .?AU_REARRANGE_FILE_DATA@@ ��
*- z
# SourceStartingOffset �
# TargetOffset �
SourceFileHandle �
" Length ���
" Flags F ,- _REARRANGE_FILE_DATA .?AU_REARRANGE_FILE_DATA@@ �� -- � ( J � CREATE_USN_JOURNAL_DATA .?AUCREATE_USN_JOURNAL_DATA@@ 6
# MaximumSize ��
# AllocationDelta ��J 0- CREATE_USN_JOURNAL_DATA .?AUCREATE_USN_JOURNAL_DATA@@ 1- �
v � _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2@@ ��
3- �
# IoReadBytesLimit �
# IoWriteBytesLimit
� PerJobUserTimeLimit ��
# JobLowMemoryLimit
# JobHighMemoryLimit ���
Q ( RateControlTolerance �
� , RateControlToleranceInterval �
" 0 LimitFlags ���v 5- 8 _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2@@ �� 6- � � J � _IMAGE_CHPE_RANGE_ENTRY .?AU_IMAGE_CHPE_RANGE_ENTRY@@
8-
" ��
" ��^
" StartOffset ��
:- NativeCode ���
;- AddressBits ��
" Length ���J <- _IMAGE_CHPE_RANGE_ENTRY .?AU_IMAGE_CHPE_RANGE_ENTRY@@ =- � v B � _ACCESS_ALLOWED_ACE .?AU_ACCESS_ALLOWED_ACE@@ :
� Header ���
" Mask �
" SidStart �B @- _ACCESS_ALLOWED_ACE .?AU_ACCESS_ALLOWED_ACE@@ A- x V FindExInfoStandard ��� FindExInfoBasic �� FindExInfoMaxInfoLevel ���> t C- _FINDEX_INFO_LEVELS .?AW4_FINDEX_INFO_LEVELS@@ � D- � � J � _CM_MONITOR_DEVICE_DATA .?AU_CM_MONITOR_DEVICE_DATA@@ J
! Version ��
! Revision �
! HorizontalScreenSize �
! VerticalScreenSize ���
! HorizontalResolution �
!
VerticalResolution ���
! HorizontalDisplayTimeLow �
! HorizontalDisplayTime
! HorizontalDisplayTimeHigh
! HorizontalBackPorchLow ���
! HorizontalBackPorch ��
! HorizontalBackPorchHigh ��
! HorizontalFrontPorchLow ��
! HorizontalFrontPorch �
! HorizontalFrontPorchHigh �
! HorizontalSyncLow
! HorizontalSync ���
! " HorizontalSyncHigh ���
! $ VerticalBackPorchLow �
! & VerticalBackPorch
! ( VerticalBackPorchHigh
! * VerticalFrontPorchLow
! , VerticalFrontPorch ���
! . VerticalFrontPorchHigh ���
! 0 VerticalSyncLow ��
! 2 VerticalSync �
! 4 VerticalSyncHigh �J G- 6 _CM_MONITOR_DEVICE_DATA .?AU_CM_MONITOR_DEVICE_DATA@@ H- � B � _SD_ENUM_SDS_ENTRY .?AU_SD_ENUM_SDS_ENTRY@@ ��j
" Hash �
" SecurityId ���
# Offset ���
" Length ���
� Descriptor ���B K- _SD_ENUM_SDS_ENTRY .?AU_SD_ENUM_SDS_ENTRY@@ �� L- � V � _SC_NOTIFICATION_REGISTRATION .?AU_SC_NOTIFICATION_REGISTRATION@@
N-
: � tagEMRANGLEARC .?AUtagEMRANGLEARC@@ ��j
� emr ��
� ptlCenter
" nRadius ��
@ eStartAngle ��
@ eSweepAngle ��: R- tagEMRANGLEARC .?AUtagEMRANGLEARC@@ �� S- � 0
�" �" � V-
W- 2
U- ExecuteCallback ��
X- Unposted �B Y- _TP_TASK_CALLBACKS .?AU_TP_TASK_CALLBACKS@@ �� Z- � � F � _EX_WNF_SUBSCRIPTION .?AU_EX_WNF_SUBSCRIPTION@@ ��
\- : � _WNF_STATE_NAME .?AU_WNF_STATE_NAME@@
^- ��
_- 6 � _WNF_TYPE_ID .?AU_WNF_TYPE_ID@@ ��
a- ��
b- ]- `- " " c- d- n � _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION@@ �
# IoReadBytesLimit �
# IoWriteBytesLimit
� PerJobUserTimeLimit ��
# JobMemoryLimit ���
Q RateControlTolerance �
� $ RateControlToleranceInterval �
" ( LimitFlags ���n g- 0 _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION@@ h- ? � 6 � _NLSTABLEINFO .?AU_NLSTABLEINFO@@ 6 � _CPTABLEINFO .?AU_CPTABLEINFO@@ ��j
k- OemTableInfo �
k- @ AnsiTableInfo
q � UpperCaseTable ���
q � LowerCaseTable ���6 l- � _NLSTABLEINFO .?AU_NLSTABLEINFO@@ * onecore\external\ddk\inc\ntnls.h ��� m- n- 3
H R � _IMAGE_RESOURCE_DATA_ENTRY .?AU_IMAGE_RESOURCE_DATA_ENTRY@@ ��R
" OffsetToData �
" Size �
" CodePage �
" Reserved �R r- _IMAGE_RESOURCE_DATA_ENTRY .?AU_IMAGE_RESOURCE_DATA_ENTRY@@ �� s- � | Z � _PLUGPLAY_CONTROL_CONFLICT_LIST .?AU_PLUGPLAY_CONTROL_CONFLICT_LIST@@ ^ � _PLUGPLAY_CONTROL_CONFLICT_ENTRY .?AU_PLUGPLAY_CONTROL_CONFLICT_ENTRY@@ �� v- " ( �
" Reserved1
" Reserved2
" ConflictsCounted �
" ConflictsListed ��
" RequiredBufferSize ���
w- ConflictEntry Z x- @ _PLUGPLAY_CONTROL_CONFLICT_LIST .?AU_PLUGPLAY_CONTROL_CONFLICT_LIST@@ y- % �
� 6 � _RTL_HEAP_TAG .?AU_RTL_HEAP_TAG@@ q " 0 �
" NumberOfAllocations ��
" NumberOfFrees
# BytesAllocated ���
! TagIndex �
! CreatorBackTraceIndex
}- TagName ��6 ~- H _RTL_HEAP_TAG .?AU_RTL_HEAP_TAG@@ - � - 6 � tagMOUSEKEYS .?AUtagMOUSEKEYS@@ ��
u cbSize ���
" dwFlags ��
" iMaxSpeed
" iTimeToMaxSpeed ��
" iCtrlSpeed ���
" dwReserved1 ��
" dwReserved2 ��6 �- tagMOUSEKEYS .?AUtagMOUSEKEYS@@ �� �- �3 > � tagEMREXTTEXTOUTA .?AUtagEMREXTTEXTOUTA@@ z
� emr ��
d rclBounds
" iGraphicsMode
@ exScale ��
@ eyScale ��
�' $ emrtext ��> �- L tagEMREXTTEXTOUTA .?AUtagEMREXTTEXTOUTA@@ �- � � z PoHiberForceDisableReasonPolicy �� PoHiberForceDisableReasonGuardedHost � PoHiberForceDisableReasonMax �V t �- _PO_HIBER_FORCE_DISABLE_REASON .?AW4_PO_HIBER_FORCE_DISABLE_REASON@@ ��� �- x S
Z MemoryReserveUserApc � MemoryReserveIoCompletion MemoryReserveTypeMax �B t �- _MEMORY_RESERVE_TYPE .?AW4_MEMORY_RESERVE_TYPE@@ ��� �- �
6 � tagWINDOWPOS .?AUtagWINDOWPOS@@ ��v
� hwnd �
� hwndInsertAfter ��
t x
t y
t cx ���
t cy ���
u flags 6 �- ( tagWINDOWPOS .?AUtagWINDOWPOS@@ �� �- y
V � _RTL_SPARSE_BITMAP_PARAMETER .?AU_RTL_SPARSE_BITMAP_PARAMETER@@ ��
# �-
�-
&
" ��
" ��
" ��
" ��
# BitCountMax ��
" MetadataSizePerBit ���
" BitsPerRange �
" RangeCountMax
�- AllocateRoutine ��
�- FreeRoutine ��
�- ( DefaultBitsSet ���
�- ( SparseRangeArray �
�- ( NoInternalLocking
�- ( SpareFlags ���V
�- 0 _RTL_SPARSE_BITMAP_PARAMETER .?AU_RTL_SPARSE_BITMAP_PARAMETER@@ �� �- � 6 � tagTPMPARAMS .?AUtagTPMPARAMS@@ ��*
u cbSize ���
! rcExclude 6 �- tagTPMPARAMS .?AUtagTPMPARAMS@@ �� �- 6 � _SLIST_ENTRY .?AU_SLIST_ENTRY@@ ��
�-
�- Next �6 �- _SLIST_ENTRY .?AU_SLIST_ENTRY@@ �� �- b T N � _SYSTEM_FLAGS_INFORMATION .?AU_SYSTEM_FLAGS_INFORMATION@@
" Flags N �- _SYSTEM_FLAGS_INFORMATION .?AU_SYSTEM_FLAGS_INFORMATION@@ �- � � Z � _MM_ETW_WORKING_SET_PFN_RUNDOWN .?AU_MM_ETW_WORKING_SET_PFN_RUNDOWN@@
�- �+ " �J
# ProcessId
# EntryCount ���
�- WorkingSetInfo ���Z �- 0 _MM_ETW_WORKING_SET_PFN_RUNDOWN .?AU_MM_ETW_WORKING_SET_PFN_RUNDOWN@@ �- t X J � _QUERY_BAD_RANGES_INPUT .?AU_QUERY_BAD_RANGES_INPUT@@
�- U& " �:
" Flags
" NumRanges
�- Ranges ���J �- _QUERY_BAD_RANGES_INPUT .?AU_QUERY_BAD_RANGES_INPUT@@ �- � !! ^ � _FILE_NOTIFY_EXTENDED_INFORMATION .?AU_FILE_NOTIFY_EXTENDED_INFORMATION@@
�- f
" NextEntryOffset ��
" Action ���
� CreationTime �
� LastModificationTime �
� LastChangeTime ���
� LastAccessTime ���
� ( AllocatedLength ��
� 0 FileSize �
" 8 FileAttributes ���
" < ReparsePointTag ��
� @ FileId ���
� H ParentFileId �
" P FileNameLength ���
| T FileName �^ �- X _FILE_NOTIFY_EXTENDED_INFORMATION .?AU_FILE_NOTIFY_EXTENDED_INFORMATION@@ �- � @
� ��
�-
q N � _MIDL_STUBLESS_PROXY_INFO .?AU_MIDL_STUBLESS_PROXY_INFO@@
�- �
j( pStubDesc
Q ProcFormatString �
6 FormatStringOffset ���
4 pTransferSyntax ��
# nCount ���
t( ( pSyntaxInfo ��N �- 0 _MIDL_STUBLESS_PROXY_INFO .?AU_MIDL_STUBLESS_PROXY_INFO@@ �- � �
�" 6 � _DEVICE_FLAGS .?AU_DEVICE_FLAGS@@
�-
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�- Failed ���
�- ReadOnly �
�- Removable
�- ConsoleIn
�- ConsoleOut ���
�- Input
�- Output ���6 �- _DEVICE_FLAGS .?AU_DEVICE_FLAGS@@ �- � R � _MEMORY_COMBINE_INFORMATION .?AU_MEMORY_COMBINE_INFORMATION@@ .
Handle ���
# PagesCombined R �- _MEMORY_COMBINE_INFORMATION .?AU_MEMORY_COMBINE_INFORMATION@@ �- � � V � _PROCESSOR_POWER_POLICY_INFO .?AU_PROCESSOR_POWER_POLICY_INFO@@ ��
" ��
" ��
" ���
" TimeCheck
" DemoteLimit ��
" PromoteLimit �
DemotePercent
PromotePercent ���
� Spare
�- AllowDemotion
�- AllowPromotion ���
�- Reserved �V �- _PROCESSOR_POWER_POLICY_INFO .?AU_PROCESSOR_POWER_POLICY_INFO@@ �� �- x V R � _SYSDBG_LIVEDUMP_CONTROL_FLAGS .?AT_SYSDBG_LIVEDUMP_CONTROL_FLAGS@@ ��
" ��
" ��
" ��
" ��
" ��
�- UseDumpStorageStack ��
�- CompressMemoryPagesData ��
�- IncludeUserSpaceMemoryPages ��
�- AbortIfMemoryPressure
�- Reserved �
" AsUlong ��R �- _SYSDBG_LIVEDUMP_CONTROL_FLAGS .?AT_SYSDBG_LIVEDUMP_CONTROL_FLAGS@@ �� �- � < : � _MEMORYSTATUSEX .?AU_MEMORYSTATUSEX@@ �
" dwLength �
" dwMemoryLoad �
# ullTotalPhys �
# ullAvailPhys �
# ullTotalPageFile �
# ullAvailPageFile �
# ( ullTotalVirtual ��
# 0 ullAvailVirtual ��
# 8 ullAvailExtendedVirtual ��: �- @ _MEMORYSTATUSEX .?AU_MEMORYSTATUSEX@@ �- � B R � _QUERY_SERVICE_LOCK_STATUSW .?AU_QUERY_SERVICE_LOCK_STATUSW@@ J
" fIsLocked
q lpLockOwner ��
" dwLockDuration ���R �- _QUERY_SERVICE_LOCK_STATUSW .?AU_QUERY_SERVICE_LOCK_STATUSW@@ �- � Z � _COVERAGE_UNLOADED_MODULE_ENTRY .?AU_COVERAGE_UNLOADED_MODULE_ENTRY@@
�- �
NextEntry
BaseDllName ��
FullDllName ��
" 0 CoverageSectionSize ��
8 CoverageSection ��Z �- @ _COVERAGE_UNLOADED_MODULE_ENTRY .?AU_COVERAGE_UNLOADED_MODULE_ENTRY@@ �- � l �
N � STARTING_LCN_INPUT_BUFFER .?AUSTARTING_LCN_INPUT_BUFFER@@
� StartingLcn ��N �- STARTING_LCN_INPUT_BUFFER .?AUSTARTING_LCN_INPUT_BUFFER@@ �- � 1
F � tagNONCLIENTMETRICSW .?AUtagNONCLIENTMETRICSW@@ ��
�- �
u cbSize ���
t iBorderWidth �
t iScrollWidth �
t iScrollHeight
t iCaptionWidth
t iCaptionHeight ���
lfCaptionFont
t t iSmCaptionWidth ��
t x iSmCaptionHeight �
| lfSmCaptionFont ��
t � iMenuWidth ���
t � iMenuHeight ��
� lfMenuFont ���
<lfStatusFont �
�lfMessageFont
t �iPaddedBorderWidth ���F �- �tagNONCLIENTMETRICSW .?AUtagNONCLIENTMETRICSW@@ �� �- �1 J � _PROCESSOR_IDLE_STATES .?AU_PROCESSOR_IDLE_STATES@@ ��
�- F � _PROCESSOR_IDLE_STATE .?AU_PROCESSOR_IDLE_STATE@@ . " �r
" Size �
" Revision �
" Count
" Type �
# TargetProcessors �
. State J . 8 _PROCESSOR_IDLE_STATES .?AU_PROCESSOR_IDLE_STATES@@ �� . x � f
" NextEntryOffset ��
ParentFileId �
" FileNameLength ���
| FileName �V . _FILE_LINK_ENTRY_INFORMATION .?AU_FILE_LINK_ENTRY_INFORMATION@@ �� . � z B � tagHW_PROFILE_INFOA .?AUtagHW_PROFILE_INFOA@@ p " ' �R
" dwDockInfo ���
. szHwProfileGuid ��
N + szHwProfileName ��B
. | tagHW_PROFILE_INFOA .?AUtagHW_PROFILE_INFOA@@ . o �
s : � _VM_COUNTERS_EX .?AU_VM_COUNTERS_EX@@ j
# PeakVirtualSize ��
# VirtualSize ��
" PageFaultCount ���
# PeakWorkingSetSize ���
# WorkingSetSize ���
# ( QuotaPeakPagedPoolUsage ��
# 0 QuotaPagedPoolUsage ��
# 8 QuotaPeakNonPagedPoolUsage ���
# @ QuotaNonPagedPoolUsage ���
# H PagefileUsage
# P PeakPagefileUsage
# X PrivateUsage �: . ` _VM_COUNTERS_EX .?AU_VM_COUNTERS_EX@@ . ? � J � _KEY_BASIC_INFORMATION .?AU_KEY_BASIC_INFORMATION@@ ��Z
� LastWriteTime
" TitleIndex ���
" NameLength ���
| Name �J . _KEY_BASIC_INFORMATION .?AU_KEY_BASIC_INFORMATION@@ �� . � Z � NTFS_FILE_RECORD_OUTPUT_BUFFER .?AUNTFS_FILE_RECORD_OUTPUT_BUFFER@@ ��Z
� FileReferenceNumber ��
" FileRecordLength �
� FileRecordBuffer �Z . NTFS_FILE_RECORD_OUTPUT_BUFFER .?AUNTFS_FILE_RECORD_OUTPUT_BUFFER@@ �� . � �
* � HGLRC__ .?AUHGLRC__@@
.
t unused ���* . HGLRC__ .?AUHGLRC__@@ . t R � � � � . F � _DEDUP_FILE_OPERATION .?AU_DEDUP_FILE_OPERATION@@
!.
" Code �F #. _DEDUP_FILE_OPERATION .?AU_DEDUP_FILE_OPERATION@@ $. �
" " '.
(.
~ *. +.
,. n � _TRANSACTIONMANAGER_RECOVERY_INFORMATION .?AU_TRANSACTIONMANAGER_RECOVERY_INFORMATION@@ ��
# LastRecoveredLsn �n /. _TRANSACTIONMANAGER_RECOVERY_INFORMATION .?AU_TRANSACTIONMANAGER_RECOVERY_INFORMATION@@ �� 0. � � f � _SYSTEM_SYSTEM_PARTITION_INFORMATION .?AU_SYSTEM_SYSTEM_PARTITION_INFORMATION@@ ��
SystemPartition ��f 3. _SYSTEM_SYSTEM_PARTITION_INFORMATION .?AU_SYSTEM_SYSTEM_PARTITION_INFORMATION@@ �� 4. � Y
J � _IMAGE_TLS_DIRECTORY64 .?AU_IMAGE_TLS_DIRECTORY64@@ ��
6. ��
7.
" ��
" ��
" ���
# StartAddressOfRawData
# EndAddressOfRawData ��
# AddressOfIndex ���
# AddressOfCallBacks ���
" SizeOfZeroFill ���
" $ Characteristics ��
9. $ Reserved0
:. $ Alignment
;. $ Reserved1 J <. ( _IMAGE_TLS_DIRECTORY64 .?AU_IMAGE_TLS_DIRECTORY64@@ �� =. � �
�$ j
?. Parent ���
?. LeftChild
?. RightChild ���
p Balance ��
- Reserved �B @. _RTL_BALANCED_LINKS .?AU_RTL_BALANCED_LINKS@@ A. b � Z � _TXFS_WRITE_BACKUP_INFORMATION .?AU_TXFS_WRITE_BACKUP_INFORMATION@@ ��
� Buffer ���Z D. _TXFS_WRITE_BACKUP_INFORMATION .?AU_TXFS_WRITE_BACKUP_INFORMATION@@ �� E. � }
ResolutionContext � G. _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING@@ �� H. � � � N � _OBJECT_BASIC_INFORMATION .?AU_OBJECT_BASIC_INFORMATION@@
K.
" Attributes ���
" GrantedAccess
" HandleCount ��
" PointerCount �
" PagedPoolCharge ��
" NonPagedPoolCharge ���
� Reserved �
" $ NameInfoSize �
" ( TypeInfoSize �
" , SecurityDescriptorSize ���
� 0 CreationTime �N M. 8 _OBJECT_BASIC_INFORMATION .?AU_OBJECT_BASIC_INFORMATION@@ N. 2 ) R � _OPERATION_START_PARAMETERS .?AU_OPERATION_START_PARAMETERS@@
P. >
" Version ��
" OperationId ��
" Flags R R. _OPERATION_START_PARAMETERS .?AU_OPERATION_START_PARAMETERS@@ S. o � J � _UNLOAD_DLL_DEBUG_INFO .?AU_UNLOAD_DLL_DEBUG_INFO@@ ��
lpBaseOfDll ��J V. _UNLOAD_DLL_DEBUG_INFO .?AU_UNLOAD_DLL_DEBUG_INFO@@ �� W. � Y
u' �
# SdsStreamSize
# SdsAllocationSize
# SiiStreamSize
# SiiAllocationSize
# SdhStreamSize
# ( SdhAllocationSize
# 0 NumSDTotal ���
# 8 NumSDUnused ��J Z. @ _SD_QUERY_STATS_OUTPUT .?AU_SD_QUERY_STATS_OUTPUT@@ �� [. � �
Q- $ " " ^.
_. ~ � _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ ��"
� StrictHandleChecks ���~ b. _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ �� c. E
e.
] ^ � _CRITICAL_PROCESS_EXCEPTION_DATA .?AU_CRITICAL_PROCESS_EXCEPTION_DATA@@ ��v
ReportId �
ModuleName ���
" ModuleTimestamp ��
" $ ModuleSize ���
# ( Offset ���^ i. 0 _CRITICAL_PROCESS_EXCEPTION_DATA .?AU_CRITICAL_PROCESS_EXCEPTION_DATA@@ �� j. � V � _ETW_OPTICALIO_FLUSH_BUFFERS .?AU_ETW_OPTICALIO_FLUSH_BUFFERS@@ ��~
" DiskNumber ���
" IrpFlags �
# HighResResponseTime ��
IrpAddr ��
" IssuingThreadId ��V m. _ETW_OPTICALIO_FLUSH_BUFFERS .?AU_ETW_OPTICALIO_FLUSH_BUFFERS@@ �� n. c � J � _RPC_SECURITY_QOS_V4_A .?AU_RPC_SECURITY_QOS_V4_A@@ ��^ � _RPC_HTTP_TRANSPORT_CREDENTIALS_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_A@@
q.
r. HttpCredentials ��2 s. <anonymous-tag> .?AT<anonymous-tag>@@ t. _ [ �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
t. u
Sid ��
u ( EffectiveOnly J v. 0 _RPC_SECURITY_QOS_V4_A .?AU_RPC_SECURITY_QOS_V4_A@@ �� w. _ T F � _PSFEATURE_CUSTPAPER .?AU_PSFEATURE_CUSTPAPER@@ ��r
lOrientation �
lWidth ���
lHeight ��
lWidthOffset �
lHeightOffset F z. _PSFEATURE_CUSTPAPER .?AU_PSFEATURE_CUSTPAPER@@ �� {. � J
pObj �
u Size �
� pfnBind ��
� pfnUnbind J }. __GENERIC_BINDING_INFO .?AU__GENERIC_BINDING_INFO@@ �� ~. � ; > � _ALPC_HANDLE_ATTR .?AU_ALPC_HANDLE_ATTR@@
" ��
" ��
" ��
" ��
" ��
" ��B � _ALPC_HANDLE_ATTR32 .?AU_ALPC_HANDLE_ATTR32@@
�. &
" Flags
�. Reserved0
�. SameAccess ���
�. SameAttributes ���
�. Indirect �
�. Inherit ��
�. Reserved1
Handle ���
�. HandleAttrArray ��
" ObjectType ���
" HandleCount ��
" DesiredAccess
" GrantedAccess >
�. _ALPC_HANDLE_ATTR .?AU_ALPC_HANDLE_ATTR@@ �. � ? B � threadmbcinfostruct .?AUthreadmbcinfostruct@@
�.
) : � tagCHARSETINFO .?AUtagCHARSETINFO@@ ��
�. > � tagFONTSIGNATURE .?AUtagFONTSIGNATURE@@ ��6
u ciCharset
u ciACP
�. fs ���: �. tagCHARSETINFO .?AUtagCHARSETINFO@@ �� �. � � v WnfWellKnownStateName WnfPermanentStateName WnfPersistentStateName ��� WnfTemporaryStateName J t �. _WNF_STATE_NAME_LIFETIME .?AW4_WNF_STATE_NAME_LIFETIME@@ ��� �. � @ V � _SYSTEM_HANDLE_INFORMATION_EX .?AU_SYSTEM_HANDLE_INFORMATION_EX@@ b � _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX@@ �� �. " ( �F
# NumberOfHandles ��
# Reserved �
�. Handles ��V �. 8 _SYSTEM_HANDLE_INFORMATION_EX .?AU_SYSTEM_HANDLE_INFORMATION_EX@@ �. � N � _ETW_OPTICALIO_READWRITE .?AU_ETW_OPTICALIO_READWRITE@@ ���
" DiskNumber ���
" IrpFlags �
" Size �
" Reserved �
# ByteOffset ���
FileObject ���
IrpAddr ��
# ( HighResResponseTime ��
" 0 IssuingThreadId ��N �. 8 _ETW_OPTICALIO_READWRITE .?AU_ETW_OPTICALIO_READWRITE@@ �� �. c �
�'
�
R � _IMAGE_DYNAMIC_RELOCATION32 .?AU_IMAGE_DYNAMIC_RELOCATION32@@ .
" Symbol ���
" BaseRelocSize R �. _IMAGE_DYNAMIC_RELOCATION32 .?AU_IMAGE_DYNAMIC_RELOCATION32@@ �. � � F � _DesiredStorageClass .?AU_DesiredStorageClass@@ ��"
� Class
" Flags F �. _DesiredStorageClass .?AU_DesiredStorageClass@@ �� �. � � N � _THREAD_NAME_INFORMATION .?AU_THREAD_NAME_INFORMATION@@ ��
�.
ThreadName ���N �. _THREAD_NAME_INFORMATION .?AU_THREAD_NAME_INFORMATION@@ �� �. � � B � _HEAP_RANGE_DESTROY .?AU_HEAP_RANGE_DESTROY@@ .
j Header ���
HeapHandle ���B �. ( _HEAP_RANGE_DESTROY .?AU_HEAP_RANGE_DESTROY@@ �. c � F � _SERVICE_START_REASON .?AU_SERVICE_START_REASON@@
" dwReason �F �. _SERVICE_START_REASON .?AU_SERVICE_START_REASON@@ �. � �
�
A N � NTFS_EXTENDED_VOLUME_DATA .?AUNTFS_EXTENDED_VOLUME_DATA@@ 2
" ByteCount
! MajorVersion �
! MinorVersion �
" BytesPerPhysicalSector ���
! LfsMajorVersion ��
! LfsMinorVersion ��
" MaxDeviceTrimExtentCount �
" MaxDeviceTrimByteCount ���
" MaxVolumeTrimExtentCount �
" MaxVolumeTrimByteCount ���N
�. NTFS_EXTENDED_VOLUME_DATA .?AUNTFS_EXTENDED_VOLUME_DATA@@ �. � � R � _ETW_THREAD_SET_NAME_EVENT .?AU_ETW_THREAD_SET_NAME_EVENT@@ ��B
" ProcessId
" ThreadId �
| ThreadName ���R �. _ETW_THREAD_SET_NAME_EVENT .?AU_ETW_THREAD_SET_NAME_EVENT@@ �� �. c ,
d F
left �
top ��
right
bottom ���* �. _RECTL .?AU_RECTL@@ �� �. t � > � _MOVE_FILE_DATA32 .?AU_MOVE_FILE_DATA32@@ b
u FileHandle ���
� StartingVcn ��
� StartingLcn ��
" ClusterCount �> �. _MOVE_FILE_DATA32 .?AU_MOVE_FILE_DATA32@@ �. � �
N � tagEMRCREATEBRUSHINDIRECT .?AUtagEMRCREATEBRUSHINDIRECT@@ 6 � tagLOGBRUSH32 .?AUtagLOGBRUSH32@@ 6
� emr ��
" ihBrush ��
�. lb ���N �. tagEMRCREATEBRUSHINDIRECT .?AUtagEMRCREATEBRUSHINDIRECT@@ �. � b 6 � _SI_COPYFILE .?AU_SI_COPYFILE@@ ��
�. r
" SourceFileNameLength �
" DestinationFileNameLength
" Flags
| FileNameBuffer ���6 �. _SI_COPYFILE .?AU_SI_COPYFILE@@ �� �. � F � _PHYSICAL_CHANNEL_RUN .?AU_PHYSICAL_CHANNEL_RUN@@
�. j
" NodeNumber ���
" ChannelNumber
# BasePage �
# PageCount
# Flags F �. _PHYSICAL_CHANNEL_RUN .?AU_PHYSICAL_CHANNEL_RUN@@ �. t j � _PROCESS_DYNAMIC_EH_CONTINUATION_TARGET .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGET@@
�. *
# TargetAddress
# Flags j �. _PROCESS_DYNAMIC_EH_CONTINUATION_TARGET .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGET@@ �. ? r J � _PERFINFO_VIRTUAL_ALLOC .?AU_PERFINFO_VIRTUAL_ALLOC@@
�. ^
CapturedBase �
# CapturedRegionSize ���
" ProcessId
" Flags J �. _PERFINFO_VIRTUAL_ALLOC .?AU_PERFINFO_VIRTUAL_ALLOC@@ �. c Y
r
dx ���
dy ���
" mouseData
" dwFlags ��
" time �
# dwExtraInfo ��6 �. tagMOUSEINPUT .?AUtagMOUSEINPUT@@ �. � n � _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION .?AU_ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION@@
�. >
" ulFlags ��
RunLevel �
" UiAccess �n �. _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION .?AU_ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION@@ �. � � J � _ETW_HEAP_EVENT_REALLOC .?AU_ETW_HEAP_EVENT_REALLOC@@ �
j Header ���
HeapHandle ���
( NewAddress ���
0 OldAddress ���
# 8 NewSize ��
# @ OldSize ��
" H Source ���J �. L _ETW_HEAP_EVENT_REALLOC .?AU_ETW_HEAP_EVENT_REALLOC@@ �. c �
v � _FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX@@ 2
\ StorageReserveId �
SpaceUsed v �. _FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX@@ �. � s+
� * � _TP_IO .?AU_TP_IO@@ ��
�+ J � _MAXVERSIONTESTED_INFO .?AU_MAXVERSIONTESTED_INFO@@ ��
�.
# MaxVersionTested �J �. _MAXVERSIONTESTED_INFO .?AU_MAXVERSIONTESTED_INFO@@ �� �. � ^ � _DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK .?AU_DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK@@
�. �
" Signature
! Revision �
! Size �
! DpcWatchdogProfileOffset �
" DpcWatchdogProfileLength �^ / _DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK .?AU_DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK@@ / L �
" ��
/ V � _PERFINFO_FILE_OPERATION_END .?AU_PERFINFO_FILE_OPERATION_END@@ ��
/ B
# Irp ��
# ExtraInformation �
Status ���V / _PERFINFO_FILE_OPERATION_END .?AU_PERFINFO_FILE_OPERATION_END@@ �� / c �
� R � _TXFS_START_RM_INFORMATION .?AU_TXFS_START_RM_INFORMATION@@ ��
/ B
" Flags
# LogContainerSize �
" LogContainerCountMin �
" LogContainerCountMax �
" LogGrowthIncrement ���
" LogAutoShrinkPercentage ��
" TmLogPathOffset ��
! $ TmLogPathLength ��
! & LoggingMode ��
! ( LogPathLength
! * Reserved �
| , LogPath ��R
/ 0 _TXFS_START_RM_INFORMATION .?AU_TXFS_START_RM_INFORMATION@@ �� / � N f � _SYSTEM_HYPERVISOR_QUERY_INFORMATION .?AU_SYSTEM_HYPERVISOR_QUERY_INFORMATION@@ ��
/ " �
HypervisorConnected ��
HypervisorDebuggingEnabled ���
HypervisorPresent
HypervisorSchedulerType ��
/ Spare0 ���
# EnabledEnlightenments f / _SYSTEM_HYPERVISOR_QUERY_INFORMATION .?AU_SYSTEM_HYPERVISOR_QUERY_INFORMATION@@ �� / � 0 F SystemFirmwareTable_Enumerate SystemFirmwareTable_Get ��R t / _SYSTEM_FIRMWARE_TABLE_ACTION .?AW4_SYSTEM_FIRMWARE_TABLE_ACTION@@ � / � Q z
" ProviderSignature
/ Action ���
" TableID ��
" TableBufferLength
� TableBuffer ��b / _SYSTEM_FIRMWARE_TABLE_INFORMATION .?AU_SYSTEM_FIRMWARE_TABLE_INFORMATION@@ �� / � V
P& v � _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION .?AU_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION@@ ��
" Flags v / _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION .?AU_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION@@ �� / � V � _WMI_IMAGELOAD_INFORMATION32 .?AU_WMI_IMAGELOAD_INFORMATION32@@ ��:
u ImageBase32 ��
u ImageSize32 ��
" ProcessId
" ImageChecksum
" TimeDateStamp
SignatureLevel ���
SignatureType
! Reserved0
u DefaultBase32
" Reserved1
" Reserved2
" $ Reserved3
" ( Reserved4
| , FileName �V "/ 0 _WMI_IMAGELOAD_INFORMATION32 .?AU_WMI_IMAGELOAD_INFORMATION32@@ �� #/ c U b � _SYSTEM_PROCESSOR_IDLE_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_INFORMATION@@ ��
%/ �
# IdleTime �
# C1Time ���
# C2Time ���
# C3Time ���
" C1Transitions
" $ C2Transitions
" ( C3Transitions
" , Padding ��b '/ 0 _SYSTEM_PROCESSOR_IDLE_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_INFORMATION@@ �� (/ � Z � _MANAGE_HOT_PATCH_QUERY_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_PATCHES@@ &
T Sid ��
� Buffer ���2 +/ D <anonymous-tag> .?AT<anonymous-tag>@@ ,/ t � F � _HOT_PATCH_IMAGE_INFO .?AU_HOT_PATCH_IMAGE_INFO@@
./ r
" Version ��
,/ UserSid ��
" H PatchCount ���
v P PatchPathStrings �
// X BaseInfos Z 0/ ` _MANAGE_HOT_PATCH_QUERY_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_PATCHES@@ 1/ t � > � _CLASSIC_EVENT_ID .?AU_CLASSIC_EVENT_ID@@ " �:
EventGuid
Type �
4/ Reserved �> 5/ _CLASSIC_EVENT_ID .?AU_CLASSIC_EVENT_ID@@ 6/ � x
� N � _WMI_PROCESS_INFORMATION .?AU_WMI_PROCESS_INFORMATION@@ ��
9/ �
# UniqueProcessKey �
" ProcessId
" ParentId �
" SessionId
ExitStatus ���
# DirectoryTableBase ���
" Flags
" $ Sid ��N ;/ ( _WMI_PROCESS_INFORMATION .?AU_WMI_PROCESS_INFORMATION@@ �� </ c � Z � _UMS_SYSTEM_THREAD_INFORMATION .?AU_UMS_SYSTEM_THREAD_INFORMATION@@ ��
" ��
" ��r
" UmsVersion ���
?/ IsUmsSchedulerThread �
@/ IsUmsWorkerThread
" ThreadUmsFlags ���Z A/ _UMS_SYSTEM_THREAD_INFORMATION .?AU_UMS_SYSTEM_THREAD_INFORMATION@@ �� B/ o K N � _POWER_MONITOR_INVOCATION .?AU_POWER_MONITOR_INVOCATION@@ .
Console ��
) RequestReason N E/ _POWER_MONITOR_INVOCATION .?AU_POWER_MONITOR_INVOCATION@@ F/ x W
q " H/ I/
J/ B � _WOW64_CPUAREA_INFO .?AU_WOW64_CPUAREA_INFO@@
� : � _AMD64_CONTEXT .?AU_AMD64_CONTEXT@@ ��
N/ 6 � _ARM_CONTEXT .?AU_ARM_CONTEXT@@ ��
P/ : � _ARM64_CONTEXT .?AU_ARM64_CONTEXT@@ ��
R/ J
Context ��
M/ ContextX86 ���
O/ ContextAmd64 �
Q/ ContextArm ���
S/ ContextArm64 �
PerThreadDataLocation
" ContextFlagsLocation �
" CpuAreaFlagsLocation �
" ArchContextFlag ��
! $ Machine ��
! & Pad1 �
U ( KernelWriteToExecutableSignaledLocation ��B T/ 0 _WOW64_CPUAREA_INFO .?AU_WOW64_CPUAREA_INFO@@ U/ S �%
W/ � CI_WINDOWS_LOCKDOWN_MODE_UNLOCKED CI_WINDOWS_LOCKDOWN_MODE_TRIAL ��� CI_WINDOWS_LOCKDOWN_MODE_LOCKED �� CI_WINDOWS_LOCKDOWN_MODE_MAX �J t Y/ _CI_WINDOWS_LOCKDOWN_MODE .?AW4_CI_WINDOWS_LOCKDOWN_MODE@@ � Z/ � � j � _SERVICE_CONTROL_STATUS_REASON_PARAMSA .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSA@@ ��F
" dwReason �
p pszComment ���
� ServiceStatus j ]/ 8 _SERVICE_CONTROL_STATUS_REASON_PARAMSA .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSA@@ �� ^/ � � N � _MIDL_METHOD_PROPERTY_MAP .?AU_MIDL_METHOD_PROPERTY_MAP@@
� ��
a/ *
" Count
b/ Properties ���N c/ _MIDL_METHOD_PROPERTY_MAP .?AU_MIDL_METHOD_PROPERTY_MAP@@ d/ � a J � _RPC_SECURITY_QOS_V4_W .?AU_RPC_SECURITY_QOS_V4_W@@ ��
f/
z HttpCredentials ��2 h/ <anonymous-tag> .?AT<anonymous-tag>@@ i/ _ M �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
i/ u
Sid ��
u ( EffectiveOnly J k/ 0 _RPC_SECURITY_QOS_V4_W .?AU_RPC_SECURITY_QOS_V4_W@@ �� l/ _ F Z � _PROCESS_SYSTEM_RESOURCE_MANAGEMENT .?AT_PROCESS_SYSTEM_RESOURCE_MANAGEMENT@@
" ��
" ��>
" Flags
o/ Foreground ���
p/ Reserved �Z q/ _PROCESS_SYSTEM_RESOURCE_MANAGEMENT .?AT_PROCESS_SYSTEM_RESOURCE_MANAGEMENT@@ r/ � B j � _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION .?AU_JOBOBJECT_CPU_RATE_CONTROL_INFORMATION@@ j
" ControlFlags �
" CpuRate ��
" Weight ���
! MinRate ��
! MaxRate ��j u/ _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION .?AU_JOBOBJECT_CPU_RATE_CONTROL_INFORMATION@@ v/ ?
�% R � PROCESSOR_PERFSTATE_POLICY .?AUPROCESSOR_PERFSTATE_POLICY@@ ��
��
��
��
��
AsUCHAR ��
z/ NoDomainAccounting ���
{/ IncreasePolicy ���
|/ DecreasePolicy ���
}/ Reserved �2 ~/ <anonymous-tag> .?AT<anonymous-tag>@@ / x � �
" Revision �
MaxThrottle ��
MinThrottle ��
BusyAdjThreshold �
Spare
/ Flags
" TimeCheck
" IncreaseTime �
" DecreaseTime �
" IncreasePercent ��
" DecreasePercent ��R �/ PROCESSOR_PERFSTATE_POLICY .?AUPROCESSOR_PERFSTATE_POLICY@@ �� �/ x � R � _PERFINFO_MEMORY_NODE_ENTRY .?AU_PERFINFO_MEMORY_NODE_ENTRY@@
�/ .
" NodeNumber ���
# TotalPageCount ���
# SmallFreePageCount ���
# SmallZeroPageCount ���
# MediumFreePageCount ��
# $ MediumZeroPageCount ��
# , LargeFreePageCount ���
# 4 LargeZeroPageCount ���
# < HugeFreePageCount
# D HugeZeroPageCount R
�/ L _PERFINFO_MEMORY_NODE_ENTRY .?AU_PERFINFO_MEMORY_NODE_ENTRY@@ �/ c �
v J � _PERFINFO_TRACE_HEADER .?AU_PERFINFO_TRACE_HEADER@@ ��
" Marker ���
! Version ��
HeaderType ���
Flags
" Header ���
u# Packet ���
# TS ���
� SystemTime ���
� Data �J �/ _PERFINFO_TRACE_HEADER .?AU_PERFINFO_TRACE_HEADER@@ �� �/ c G
F �/ * � HHOOK__ .?AUHHOOK__@@
t unused ���* �/ HHOOK__ .?AUHHOOK__@@ �/ t (
# ��
# ��
# ��
# ��
# 4 ��n
�/ Protection ���
�/ ShareCount ���
�/ Shared ���
�/ Node �
�/ VirtualPage ��N �/ _MEMORY_WORKING_SET_BLOCK .?AU_MEMORY_WORKING_SET_BLOCK@@ �/ t 2 N � _FILE_RENAME_INFORMATION .?AU_FILE_RENAME_INFORMATION@@ ��v
ReplaceIfExists ��
" Flags
RootDirectory
" FileNameLength ���
| FileName �N �/ _FILE_RENAME_INFORMATION .?AU_FILE_RENAME_INFORMATION@@ �� �/ � 2 � _WMI_QUEUE .?AU_WMI_QUEUE@@ ��
�/ :
Queue
" ThreadId �
Action ���2 �/ _WMI_QUEUE .?AU_WMI_QUEUE@@ �� �/ c � " � _SE_SID .?AT_SE_SID@@ &
T Sid ��
� Buffer ���" �/ D _SE_SID .?AT_SE_SID@@ �/ x 3 � IMPORT_OBJECT_ORDINAL IMPORT_OBJECT_NAME ��� IMPORT_OBJECT_NAME_NO_PREFIX � IMPORT_OBJECT_NAME_UNDECORATE IMPORT_OBJECT_NAME_EXPORTAS ��F t �/ IMPORT_OBJECT_NAME_TYPE .?AW4IMPORT_OBJECT_NAME_TYPE@@ � �/ � � b � _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE .?AU_ACCESS_ALLOWED_CALLBACK_OBJECT_ACE@@ �
� Header ���
" Mask �
" Flags
ObjectType ���
InheritedObjectType ��
" , SidStart �b �/ 0 _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE .?AU_ACCESS_ALLOWED_CALLBACK_OBJECT_ACE@@ �/ x b � DISPLAYCONFIG_TARGET_PREFERRED_MODE .?AUDISPLAYCONFIG_TARGET_PREFERRED_MODE@@ N � DISPLAYCONFIG_TARGET_MODE .?AUDISPLAYCONFIG_TARGET_MODE@@ R
header ���
u width
u height ���
�/ targetMode ���b �/ P DISPLAYCONFIG_TARGET_PREFERRED_MODE .?AUDISPLAYCONFIG_TARGET_PREFERRED_MODE@@ �/ �
y.
U. : � _OSVERSIONINFOW .?AU_OSVERSIONINFOW@@
�/ �
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
�$ szCSDVersion �: �/ _OSVERSIONINFOW .?AU_OSVERSIONINFOW@@ �/ b � � SystemFeatureConfigurationSectionTypeBoot SystemFeatureConfigurationSectionTypeRuntime � SystemFeatureConfigurationSectionTypeUsageTriggers ��� SystemFeatureConfigurationSectionTypeCount ���n t �/ _SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE .?AW4_SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE@@ ��� �/ � y
�/ j � _VIRTUALIZATION_INSTANCE_INFO_INPUT_EX .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT_EX@@ ��
! HeaderSize ���
" Flags
" NotificationInfoSize �
! NotificationInfoOffset ���
! ProviderMajorVersion �j �/ _VIRTUALIZATION_INSTANCE_INFO_INPUT_EX .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT_EX@@ �� �/ � �" J � tagEMRSETDIBITSTODEVICE .?AUtagEMRSETDIBITSTODEVICE@@
�/
� emr ��
d rclBounds
xDest
yDest
xSrc �
$ ySrc �
( cxSrc
, cySrc
" 0 offBmiSrc
" 4 cbBmiSrc �
" 8 offBitsSrc ���
" < cbBitsSrc
" @ iUsageSrc
" D iStartScan ���
" H cScans ���J �/ L tagEMRSETDIBITSTODEVICE .?AUtagEMRSETDIBITSTODEVICE@@ �/ � Z � _ETW_AUTOBOOST_NO_ENTRIES_EVENT .?AU_ETW_AUTOBOOST_NO_ENTRIES_EVENT@@
�/ &
Lock �
" ThreadId �Z �/ _ETW_AUTOBOOST_NO_ENTRIES_EVENT .?AU_ETW_AUTOBOOST_NO_ENTRIES_EVENT@@ �/ c
F � tagEMRTRANSPARENTBLT .?AUtagEMRTRANSPARENTBLT@@ ��R
� emr ��
d rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
J 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d cxSrc
h cySrc F �/ l tagEMRTRANSPARENTBLT .?AUtagEMRTRANSPARENTBLT@@ �� �/ � R � _PERFINFO_SET_DEVICES_STATE .?AU_PERFINFO_SET_DEVICES_STATE@@ V
" SystemState ��
Waking ���
Shutdown �
IrpMinor �R �/ _PERFINFO_SET_DEVICES_STATE .?AU_PERFINFO_SET_DEVICES_STATE@@ �/ c Z
U 6 � USN_RECORD_UNION .?ATUSN_RECORD_UNION@@ ��6 � USN_RECORD_V2 .?AUUSN_RECORD_V2@@ 6 � USN_RECORD_V3 .?AUUSN_RECORD_V3@@ 6 � USN_RECORD_V4 .?AUUSN_RECORD_V4@@ F
�& Header ���
�/ V2 ���
�/ V3 ���
�/ V4 ���6 �/ P USN_RECORD_UNION .?ATUSN_RECORD_UNION@@ �� �/ � � 6 � _INITIAL_TEB .?AU_INITIAL_TEB@@ ��
�/ 2
OldStackBase �
OldStackLimit : �/ <anonymous-tag> .?AU<anonymous-tag>@@ �/ � " f
�/ OldInitialTeb
StackBase
StackLimit ���
StackAllocationBase ��6 �/ ( _INITIAL_TEB .?AU_INITIAL_TEB@@ �� �/ � ! > � _IMAGE_LINENUMBER .?AU_IMAGE_LINENUMBER@@
�/ ��
�/ :
" SymbolTableIndex �
" VirtualAddress ���2 �/ <anonymous-tag> .?AT<anonymous-tag>@@ �/ � *
�/ Type �
! Linenumber ���> �/ _IMAGE_LINENUMBER .?AU_IMAGE_LINENUMBER@@ �/ � � ��DPI_AWARENESS_INVALID ��� DPI_AWARENESS_UNAWARE DPI_AWARENESS_SYSTEM_AWARE ��� DPI_AWARENESS_PER_MONITOR_AWARE ��2 t �/ DPI_AWARENESS .?AW4DPI_AWARENESS@@ � �/ t
� " ��
= Cycles ���
# @ DiskEnergy ���
# H NetworkTailEnergy
# P MBBTailEnergy
# X NetworkTxRxBytes �
# ` MBBTxRxBytes �
�/ h Durations
� h ForegroundDuration ���
� p DesktopVisibleDuration ���
� x PSMForegroundDuration
" � CompositionRendered ��
" � CompositionDirtyGenerated
" � CompositionDirtyPropagated ���
" � Reserved1
= � AttributedCycles �
= � WorkOnBehalfCycles ���J �/ _PROCESS_ENERGY_VALUES .?AU_PROCESS_ENERGY_VALUES@@ �� �/ � $ * � _CURDIR .?AU_CURDIR@@ *
DosPath ��
Handle ���* �/ _CURDIR .?AU_CURDIR@@ �/ 7 �
� �/ Z � _FILE_SFIO_RESERVE_INFORMATION .?AU_FILE_SFIO_RESERVE_INFORMATION@@ ��
" RequestsPerPeriod
" Period ���
RetryFailures
Discardable ��
" RequestSize ��
" NumOutstandingRequests ���Z �/ _FILE_SFIO_RESERVE_INFORMATION .?AU_FILE_SFIO_RESERVE_INFORMATION@@ �� �/ � �
p t 0 . � HSPRITE__ .?AUHSPRITE__@@
t unused ���. 0 HSPRITE__ .?AUHSPRITE__@@ 0 �' �
m Z � _PERFINFO_SET_DEVICES_STATE_RET .?AU_PERFINFO_SET_DEVICES_STATE_RET@@
Status ���Z 0 _PERFINFO_SET_DEVICES_STATE_RET .?AU_PERFINFO_SET_DEVICES_STATE_RET@@
0 c e f � _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER .?AU_DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER@@ z
" Version ��
" QueryFlags ���
" HashAlgorithm
� RangeOffsetInFile
� RangeLength ��f
0 _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER .?AU_DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER@@ 0 � > � _FILE_PREFETCH_EX .?AU_FILE_PREFETCH_EX@@
0 # " �J
" Type �
" Count
Context ��
0 Prefetch �> 0 _FILE_PREFETCH_EX .?AU_FILE_PREFETCH_EX@@ 0 �
~& B � tagEMRSELECTPALETTE .?AUtagEMRSELECTPALETTE@@ "
� emr ��
" ihPal B 0 tagEMRSELECTPALETTE .?AUtagEMRSELECTPALETTE@@ 0 � �
��
0
��
0 0 0 " t 0
0 N � tagPIXELFORMATDESCRIPTOR .?AUtagPIXELFORMATDESCRIPTOR@@ ��^
! nSize
! nVersion �
" dwFlags ��
iPixelType ���
cColorBits ���
cRedBits �
cRedShift
cGreenBits ���
cGreenShift ��
cBlueBits
cBlueShift ���
cAlphaBits ���
cAlphaShift ��
cAccumBits ���
cAccumRedBits
cAccumGreenBits ��
cAccumBlueBits ���
cAccumAlphaBits ��
cDepthBits ���
cStencilBits �
cAuxBuffers ��
iLayerType ���
bReserved
" dwLayerMask ��
" dwVisibleMask
" $ dwDamageMask �N #0 ( tagPIXELFORMATDESCRIPTOR .?AUtagPIXELFORMATDESCRIPTOR@@ �� $0 � Z � _IMAGE_LOAD_CONFIG_DIRECTORY32 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY32@@ ��
&0 �
" Size �
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" GlobalFlagsClear �
" GlobalFlagsSet ���
" CriticalSectionDefaultTimeout
" DeCommitFreeBlockThreshold ���
" DeCommitTotalFreeThreshold ���
" LockPrefixTable ��
" $ MaximumAllocationSize
" ( VirtualMemoryThreshold ���
" , ProcessHeapFlags �
" 0 ProcessAffinityMask ��
! 4 CSDVersion ���
! 6 DependentLoadFlags ���
" 8 EditList �
" < SecurityCookie ���
" @ SEHandlerTable ���
" D SEHandlerCount ���
" H GuardCFCheckFunctionPointer ��
" L GuardCFDispatchFunctionPointer ���
" P GuardCFFunctionTable �
" T GuardCFFunctionCount �
" X GuardFlags ���
4 \ CodeIntegrity
" h GuardAddressTakenIatEntryTable ���
" l GuardAddressTakenIatEntryCount ���
" p GuardLongJumpTargetTable �
" t GuardLongJumpTargetCount �
" x DynamicValueRelocTable ���
" | CHPEMetadataPointer ��
" � GuardRFFailureRoutine
" � GuardRFFailureRoutineFunctionPointer �
" � DynamicValueRelocTableOffset �
! � DynamicValueRelocTableSection
! � Reserved2
" � GuardRFVerifyStackPointerFunctionPointer �
" � HotPatchTableOffset ��
" � Reserved3
" � EnclaveConfigurationPointer ��
" � VolatileMetadataPointer ��
" � GuardEHContinuationTable �
" � GuardEHContinuationCount �Z , (0 � _IMAGE_LOAD_CONFIG_DIRECTORY32 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY32@@ �� )0 � F � tagNCCALCSIZE_PARAMS .?AUtagNCCALCSIZE_PARAMS@@ �� ! " 0 �
�- "
,0 rgrc �
-0 0 lppos F .0 8 tagNCCALCSIZE_PARAMS .?AUtagNCCALCSIZE_PARAMS@@ �� /0 �
� � � 10
�+
.
R ^ � _FILE_FS_SECTOR_SIZE_INFORMATION .?AU_FILE_FS_SECTOR_SIZE_INFORMATION@@ ��&
" LogicalBytesPerSector
" PhysicalBytesPerSectorForAtomicity ���
" PhysicalBytesPerSectorForPerformance �
" FileSystemEffectivePhysicalBytesPerSectorForAtomicity
" Flags
" ByteOffsetForSectorAlignment �
" ByteOffsetForPartitionAlignment ��^ 70 _FILE_FS_SECTOR_SIZE_INFORMATION .?AU_FILE_FS_SECTOR_SIZE_INFORMATION@@ �� 80 � �
� b � _SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT .?AU_SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT@@
;0 n
" Flags
" AlignmentShift ���
# FileOffsetToAlign
" FallbackAlignmentShift ���b =0 _SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT .?AU_SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT@@ >0 � �!
* ^ � _TOKEN_BNO_ISOLATION_INFORMATION .?AU_TOKEN_BNO_ISOLATION_INFORMATION@@ ��:
q IsolationPrefix ��
IsolationEnabled �^ B0 _TOKEN_BNO_ISOLATION_INFORMATION .?AU_TOKEN_BNO_ISOLATION_INFORMATION@@ �� C0 x - J � _TOKEN_SID_INFORMATION .?AU_TOKEN_SID_INFORMATION@@ ��
E0
Sid ��J G0 _TOKEN_SID_INFORMATION .?AU_TOKEN_SID_INFORMATION@@ �� H0 x )
2"
U& � � _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@ ��n
# ReserveSize ��
# CommitSize ���
" PreferredNode
" Reserved �
Ssp �� M0 _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@ �� N0 �
� PerfInfoMMStatNotUsed PerfInfoMMStatAggregatePageCombine ��� PerfInfoMMStatIterationPageCombine ��� PerfInfoMMStatMax : t P0 _PERFINFO_MM_STAT .?AW4_PERFINFO_MM_STAT@@ � Q0 c : � _VARIABLE_NAME .?AU_VARIABLE_NAME@@ ��
S0 F
" NextEntryOffset ��
VendorGuid ���
| Name �: U0 _VARIABLE_NAME .?AU_VARIABLE_NAME@@ �� V0 � -
" ��
" �� " " � �Z
Y0 Offset ���
Z0 HasRenderingCommand ��
# HDC ��
[0 Buffer ���: \0 �_GDI_TEB_BATCH .?AU_GDI_TEB_BATCH@@ �� ]0 ? Z
" V � _FILE_SFIO_VOLUME_INFORMATION .?AU_FILE_SFIO_VOLUME_INFORMATION@@
`0 ^
" MaximumRequestsPerPeriod �
" MinimumPeriod
" MinimumTransferSize ��V b0 _FILE_SFIO_VOLUME_INFORMATION .?AU_FILE_SFIO_VOLUME_INFORMATION@@ c0 � � R � tagPOINTER_DEVICE_PROPERTY .?AUtagPOINTER_DEVICE_PROPERTY@@ ��
t logicalMin ���
t logicalMax ���
t physicalMin ��
t physicalMax ��
u unit �
u unitExponent �
! usagePageId ��
! usageId ��R f0 tagPOINTER_DEVICE_PROPERTY .?AUtagPOINTER_DEVICE_PROPERTY@@ �� g0 �; > � tagANIMATIONINFO .?AUtagANIMATIONINFO@@ ��
i0 .
u cbSize ���
t iMinAnimate ��> k0 tagANIMATIONINFO .?AUtagANIMATIONINFO@@ �� l0 B2
� 6
" HighEdgeFilter ���
" LowEdgeFilter J o0 _JOBOBJECT_WAKE_FILTER .?AU_JOBOBJECT_WAKE_FILTER@@ �� p0 � �
�
� 6
r0 ExceptionRecord ��
s0 ContextRecord B t0 _EXCEPTION_POINTERS .?AU_EXCEPTION_POINTERS@@ u0 �% o V � _ETW_COVERAGE_SAMPLER_MODULE .?AU_ETW_COVERAGE_SAMPLER_MODULE@@ ��
w0 *
" PathOffset ���
" PathLength ���
" DebugInfoOffset ��
" DebugInfoLength ��
" TimeDateStamp
" ImageChecksum
" ImageSize
" ModuleId �
" ModuleSequence ���
" $ ExeModuleId ��
" ( ExeModuleSequence
" , ExeProcessId �V y0 0 _ETW_COVERAGE_SAMPLER_MODULE .?AU_ETW_COVERAGE_SAMPLER_MODULE@@ �� z0 A 2 B � tagENUMLOGFONTEXDVW .?AUtagENUMLOGFONTEXDVW@@ > � tagENUMLOGFONTEXW .?AUtagENUMLOGFONTEXW@@ :
}0 elfEnumLogfontEx �
" \elfDesignVector ��B ~0 �tagENUMLOGFONTEXDVW .?AUtagENUMLOGFONTEXDVW@@ 0 � U V � _KEY_OPEN_SUBKEYS_INFORMATION .?AU_KEY_OPEN_SUBKEYS_INFORMATION@@ 6 � KEY_PID_ARRAY .?AUKEY_PID_ARRAY@@ �0 " �&
" Count
�0 KeyArray �V �0 _KEY_OPEN_SUBKEYS_INFORMATION .?AU_KEY_OPEN_SUBKEYS_INFORMATION@@ �0 � t
� V � _ETW_TP_EVENT_POOL_TH_MIN_SET .?AU_ETW_TP_EVENT_POOL_TH_MIN_SET@@ >
j Header ���
PoolId ���
" ( ThreadNum V �0 0 _ETW_TP_EVENT_POOL_TH_MIN_SET .?AU_ETW_TP_EVENT_POOL_TH_MIN_SET@@ �0 c � f � _PERFINFO_YIELD_PROCESSOR_INFORMATION .?AU_PERFINFO_YIELD_PROCESSOR_INFORMATION@@ N
" YieldReason ��
" DpcWatchdogCount �
" DpcTimeCount �f �0 _PERFINFO_YIELD_PROCESSOR_INFORMATION .?AU_PERFINFO_YIELD_PROCESSOR_INFORMATION@@ �0 c � B � _RTL_LFG_RNG_STATE .?AU_RTL_LFG_RNG_STATE@@ ��
�0 " " � �6
�0 SeedArray
" � Next �
" � NextP B �0 � _RTL_LFG_RNG_STATE .?AU_RTL_LFG_RNG_STATE@@ �� �0 b �
� BootEntropySourceStructureUninitialized �� BootEntropySourceDisabledByPolicy BootEntropySourceNotPresent �� BootEntropySourceError ��� BootEntropySourceSuccess �Z t �0 _BOOT_ENTROPY_SOURCE_RESULT_CODE .?AW4_BOOT_ENTROPY_SOURCE_RESULT_CODE@@ ��� �0 � Z � _SYSTEM_PAGEFILE_INFORMATION_EX .?AU_SYSTEM_PAGEFILE_INFORMATION_EX@@ V � _SYSTEM_PAGEFILE_INFORMATION .?AU_SYSTEM_PAGEFILE_INFORMATION@@ ��B
�0 Info �
" MinimumSize ��
" $ MaximumSize ��Z �0 ( _SYSTEM_PAGEFILE_INFORMATION_EX .?AU_SYSTEM_PAGEFILE_INFORMATION_EX@@ �0 � G > � _Wx86ThreadState .?AU_Wx86ThreadState@@ ��
�0 n
" CallBx86Eip ��
DeallocationCpu ��
UseKnownWx86Dll ��
p OleStubInvoked ���> �0 _Wx86ThreadState .?AU_Wx86ThreadState@@ �� �0 ? g > � tagSCROLLBARINFO .?AUtagSCROLLBARINFO@@ ��
�0 �
" cbSize ���
! rcScrollBar ��
t dxyLineButton
t xyThumbTop ���
t xyThumbBottom
t reserved �
� $ rgstate ��> �0 < tagSCROLLBARINFO .?AUtagSCROLLBARINFO@@ �� �0 79
� 6 � _MUILANGUAGES .?AU_MUILANGUAGES@@ 6 � _MUILANGINFO .?AU_MUILANGINFO@@ ��
�0 ~
u TotalSize
! MaxNumLanguages ��
! NumLanguages �
! NumInstalledLanguages
�0 LangInfos 6 �0 _MUILANGUAGES .?AU_MUILANGUAGES@@ �0 <
! F
left �
top ��
right
bottom ���* �0 tagRECT .?AUtagRECT@@ �0 t �
�
t unused ���* �0 HMENU__ .?AUHMENU__@@ �0 t Z F � _GHOSTED_FILE_EXTENT .?AU_GHOSTED_FILE_EXTENT@@ ��
� FileOffset ���
� ByteCount
RecallOwnerGuid ��
" NextEntryOffset ��
" $ RecallMetadataBufferSize �
� ( RecallMetadataBuffer �F �0 0 _GHOSTED_FILE_EXTENT .?AU_GHOSTED_FILE_EXTENT@@ �� �0 � �* J � _KCRM_TRANSACTION_BLOB .?AU_KCRM_TRANSACTION_BLOB@@ ��
UOW ��
TmIdentity ���
" IsolationLevel ���
" $ IsolationFlags ���
" ( Timeout ��
, Description ��J �0 � _KCRM_TRANSACTION_BLOB .?AU_KCRM_TRANSACTION_BLOB@@ �� �0 � � ^ � _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE .?AU_SYSTEM_AUDIT_CALLBACK_OBJECT_ACE@@ �
� Header ���
" Mask �
" Flags
ObjectType ���
InheritedObjectType ��
" , SidStart �^ �0 0 _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE .?AU_SYSTEM_AUDIT_CALLBACK_OBJECT_ACE@@ �0 x ' � DynamicTickDisableReasonNone � DynamicTickDisableReasonBcdOverride �� DynamicTickDisableReasonNoHwSupport �� DynamicTickDisableReasonEmOverride ��� DynamicTickDisableReasonMax ��b t �0 _PERFINFO_DYNAMIC_TICK_DISABLE_REASON .?AW4_PERFINFO_DYNAMIC_TICK_DISABLE_REASON@@ � �0 c
B � _RTL_STACK_CONTEXT .?AU_RTL_STACK_CONTEXT@@ ��N � _RTL_STACK_CONTEXT_ENTRY .?AU_RTL_STACK_CONTEXT_ENTRY@@ �� �0 " �.
" NumberOfEntries ��
�0 Entry B �0 _RTL_STACK_CONTEXT .?AU_RTL_STACK_CONTEXT@@ �� �0 � �
" DeviceInstance ���
" DeviceFlags ��
" ResourceType �
# ResourceStart
# ResourceEnd ��
" ResourceFlags ^ �0 ( _PLUGPLAY_CONTROL_CONFLICT_ENTRY .?AU_PLUGPLAY_CONTROL_CONFLICT_ENTRY@@ �� �0 % �
" ��
" ��
" ��n
" Flags
�0 DisableNonSystemFonts
�0 AuditNonSystemFontLoading
�0 ReservedFlags j �0 _PROCESS_MITIGATION_FONT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_FONT_DISABLE_POLICY@@ �0 ? �
S% :
! Level
! Sbz ��
� ObjectType ���> �0 _OBJECT_TYPE_LIST .?AU_OBJECT_TYPE_LIST@@ �0 x :
Z F � tagNONCLIENTMETRICSA .?AUtagNONCLIENTMETRICSA@@ ��
u cbSize ���
t iBorderWidth �
t iScrollWidth �
t iScrollHeight
t iCaptionWidth
t iCaptionHeight ���
lfCaptionFont
t T iSmCaptionWidth ��
t X iSmCaptionHeight �
\ lfSmCaptionFont ��
t � iMenuWidth ���
t � iMenuHeight ��
� lfMenuFont ���
� lfStatusFont �
lfMessageFont
t TiPaddedBorderWidth ���F �0 XtagNONCLIENTMETRICSA .?AUtagNONCLIENTMETRICSA@@ �� �0 �1 F � tagEMRCREATEMONOBRUSH .?AUtagEMRCREATEMONOBRUSH@@
�0 �
� emr ��
" ihBrush ��
" iUsage ���
" offBmi ���
" cbBmi
" offBits ��
" cbBits ���F �0 tagEMRCREATEMONOBRUSH .?AUtagEMRCREATEMONOBRUSH@@ �0 � j
� v � _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION@@ &
ImageFile
" Type �v �0 _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION@@ �0 � 3 R � _LPC_UNREGISTER_PROCESS_MSG .?AU_LPC_UNREGISTER_PROCESS_MSG@@
�0 2
c PortMsg ��
( UniqueProcessId ��R �0 0 _LPC_UNREGISTER_PROCESS_MSG .?AU_LPC_UNREGISTER_PROCESS_MSG@@ �0 � � F � _PERFINFO_CCSWAP_LITE .?AU_PERFINFO_CCSWAP_LITE@@
�0
" ��
" ��
" ��
" ��
" ��~
�0 DataType �
�0 OldThreadIdIndex �
�0 OldThreadPriInc ��
�0 OldThreadStateWr �
�0 TimeDelta F �0 _PERFINFO_CCSWAP_LITE .?AU_PERFINFO_CCSWAP_LITE@@ �0 c � B � _PROCESS_HEAP_ENTRY .?AU_PROCESS_HEAP_ENTRY@@
�0 *
hMem �
� dwReserved ���: �0 <anonymous-tag> .?AU<anonymous-tag>@@ �0 � � j
" dwCommittedSize ��
" dwUnCommittedSize
lpFirstBlock �
lpLastBlock ��: �0 <anonymous-tag> .?AU<anonymous-tag>@@ �0 � � �
lpData ���
" cbData ���
cbOverhead ���
iRegionIndex �
! wFlags ���
�0 Block
�0 Region ���B �0 ( _PROCESS_HEAP_ENTRY .?AU_PROCESS_HEAP_ENTRY@@ 1 � � f � _SYSTEM_WRITE_CONSTRAINT_INFORMATION .?AU_SYSTEM_WRITE_CONSTRAINT_INFORMATION@@ ��
1 6
" WriteConstraintPolicy
" Reserved �f 1 _SYSTEM_WRITE_CONSTRAINT_INFORMATION .?AU_SYSTEM_WRITE_CONSTRAINT_INFORMATION@@ �� 1 � s b � _TXFS_ROLLFORWARD_REDO_INFORMATION .?AU_TXFS_ROLLFORWARD_REDO_INFORMATION@@ ��f
� LastVirtualClock �
# LastRedoLsn ��
# HighestRecoveryLsn ���
" Flags b 1 _TXFS_ROLLFORWARD_REDO_INFORMATION .?AU_TXFS_ROLLFORWARD_REDO_INFORMATION@@ �� 1 � � f � _TRANSACTION_ENLISTMENTS_INFORMATION .?AU_TRANSACTION_ENLISTMENTS_INFORMATION@@ �� � " �>
" NumberOfEnlistments ��
1 EnlistmentPair ���f 1 $ _TRANSACTION_ENLISTMENTS_INFORMATION .?AU_TRANSACTION_ENLISTMENTS_INFORMATION@@ �� 1 �
K �
! Machine ��
! NumberOfSections �
" TimeDateStamp
" PointerToSymbolTable �
" NumberOfSymbols ��
! SizeOfOptionalHeader �
! Characteristics ��B 1 _IMAGE_FILE_HEADER .?AU_IMAGE_FILE_HEADER@@ �� 1 � � J � tagEMRSETWORLDTRANSFORM .?AUtagEMRSETWORLDTRANSFORM@@ "
� emr ��
J xform J 1 tagEMRSETWORLDTRANSFORM .?AUtagEMRSETWORLDTRANSFORM@@ 1 � � b � _FINDFIRSTACTIVATIONCONTEXTSECTION .?AU_FINDFIRSTACTIVATIONCONTEXTSECTION@@ ��n
" Size �
" Flags
� ExtensionGuid
" Id ���
" Depth
" OutFlags �b 1 _FINDFIRSTACTIVATIONCONTEXTSECTION .?AU_FINDFIRSTACTIVATIONCONTEXTSECTION@@ �� 1 � 3 ^ � _WORKER_FACTORY_BASIC_INFORMATION .?AU_WORKER_FACTORY_BASIC_INFORMATION@@
�% ^
� Timeout ��
� RetryTimeout �
� IdleTimeout ��
Paused ���
TimerSet �
QueuedToExWorker �
MayCreate
CreateInProgress �
InsertedIntoQueue
Shutdown �
" BindingCount �
" $ ThreadMinimum
" ( ThreadMaximum
" , PendingWorkerCount ���
" 0 WaitingWorkerCount ���
" 4 TotalWorkerCount �
" 8 ReleaseCount �
@ InfiniteWaitGoal �
1 H StartRoutine �
P StartParameter ���
X ProcessId
# ` StackReserve �
# h StackCommit ��
p LastThreadCreationStatus �^ 1 x _WORKER_FACTORY_BASIC_INFORMATION .?AU_WORKER_FACTORY_BASIC_INFORMATION@@ 1 � � PoDisabledStateSleeping1 � PoDisabledStateSleeping2 � PoDisabledStateSleeping3 � PoDisabledStateSleeping4 � PoDisabledStateSleeping0Idle � PoDisabledStateReserved5 � PoDisabledStateSleeping4Firmware � PoDisabledStateMaximum ���J t "1 POWER_STATE_DISABLED_TYPE .?AW4POWER_STATE_DISABLED_TYPE@@ � #1 x N � _ETW_TP_EVENT_POOL_CLOSE .?AU_ETW_TP_EVENT_POOL_CLOSE@@ ��*
j Header ���
PoolId ���N &1 ( _ETW_TP_EVENT_POOL_CLOSE .?AU_ETW_TP_EVENT_POOL_CLOSE@@ �� '1 c �
�) N � _WMI_IMAGEID_INFORMATION .?AU_WMI_IMAGEID_INFORMATION@@ ��r
ImageBase
# ImageSize
" ProcessId
" TimeDateStamp
| OriginalFileName �N +1 _WMI_IMAGEID_INFORMATION .?AU_WMI_IMAGEID_INFORMATION@@ �� ,1 c y r � _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION .?AU_SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION@@ ��"
� EnclaveLaunchSigner ��r /1 _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION .?AU_SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION@@ �� 01 � N
21 ! t 31
41 j � _TRANSACTIONMANAGER_OLDEST_INFORMATION .?AU_TRANSACTIONMANAGER_OLDEST_INFORMATION@@ ��
61 "
OldestTransactionGuid j 81 _TRANSACTIONMANAGER_OLDEST_INFORMATION .?AU_TRANSACTIONMANAGER_OLDEST_INFORMATION@@ �� 91 � � N � _ENCLAVE_CREATE_INFO_VBS .?AU_ENCLAVE_CREATE_INFO_VBS@@ ��&
" Flags
� OwnerID ��N <1 $ _ENCLAVE_CREATE_INFO_VBS .?AU_ENCLAVE_CREATE_INFO_VBS@@ �� =1 � �
� � " � �N
! Magic
MajorLinkerVersion ���
MinorLinkerVersion ���
" SizeOfCode ���
" SizeOfInitializedData
" SizeOfUninitializedData ��
" AddressOfEntryPoint ��
" BaseOfCode ���
# ImageBase
" SectionAlignment �
" $ FileAlignment
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
! , MajorImageVersion
! . MinorImageVersion
! 0 MajorSubsystemVersion
! 2 MinorSubsystemVersion
" 4 Win32VersionValue
" 8 SizeOfImage ��
" < SizeOfHeaders
" @ CheckSum �
! D Subsystem
! F DllCharacteristics ���
# H SizeOfStackReserve ���
# P SizeOfStackCommit
# X SizeOfHeapReserve
# ` SizeOfHeapCommit �
" h LoaderFlags ��
" l NumberOfRvaAndSizes ��
@1 p DataDirectory N A1 � _IMAGE_OPTIONAL_HEADER64 .?AU_IMAGE_OPTIONAL_HEADER64@@ �� B1 � G J � RPC_INTERFACE_TEMPLATEW .?AURPC_INTERFACE_TEMPLATEW@@
D1 F1
G1 6 � _UUID_VECTOR .?AU_UUID_VECTOR@@ ��
I1 �
" Version ��
IfSpec ���
21 MgrTypeUuid ��
MgrEpv ���
u Flags
u $ MaxCalls �
u ( MaxRpcSize ���
H1 0 IfCallback ���
J1 8 UuidVector ���
q @ Annotation ���
H SecurityDescriptor ���J K1 P RPC_INTERFACE_TEMPLATEW .?AURPC_INTERFACE_TEMPLATEW@@ L1 _ V � _RTL_SEGMENT_HEAP_PARAMETERS .?AU_RTL_SEGMENT_HEAP_PARAMETERS@@ �� # " �b
! Version ��
! Size �
" Flags
, MemorySource �
O1 0 Reserved �V P1 P _RTL_SEGMENT_HEAP_PARAMETERS .?AU_RTL_SEGMENT_HEAP_PARAMETERS@@ �� Q1 b �
N � _SYSTEM_FLUSH_INFORMATION .?AU_SYSTEM_FLUSH_INFORMATION@@
S1 ~
" SupportedFlushMethods
" ProcessorCacheFlushSize ��
# SystemFlushCapabilities ��
0 Reserved �N U1 _SYSTEM_FLUSH_INFORMATION .?AU_SYSTEM_FLUSH_INFORMATION@@ V1 � Q R � _PROCESS_WINDOW_INFORMATION .?AU_PROCESS_WINDOW_INFORMATION@@
X1 N
" WindowFlags ��
! WindowTitleLength
| WindowTitle ��R Z1 _PROCESS_WINDOW_INFORMATION .?AU_PROCESS_WINDOW_INFORMATION@@ [1 � � f � _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO .?AU_PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO@@ ��
! ��
! ��
! ��j
! Flags
^1 ActiveDataReference ��
_1 DeviceEjectable ��
`1 WritableHandles ��2 a1 <anonymous-tag> .?AT<anonymous-tag>@@ b1 c j
FileObject ���
" DeviceCharacteristics
! FileCharacteristics ��
b1 Flags f d1 _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO .?AU_PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO@@ �� e1 c ^ � _PERFINFO_PMC_SAMPLE_INFORMATION .?AU_PERFINFO_PMC_SAMPLE_INFORMATION@@ ��
g1 b
InstructionPointer ���
" ThreadId �
! ProfileSource
! Reserved �^ i1 _PERFINFO_PMC_SAMPLE_INFORMATION .?AU_PERFINFO_PMC_SAMPLE_INFORMATION@@ �� j1 c � b � _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM .?AU_SERVICE_TRIGGER_SPECIFIC_DATA_ITEM@@
l1 z
" dwTriggerType
" dwAction �
� pTriggerSubtype ��
" cDataItems ���
m1 pDataItems ���> n1 _SERVICE_TRIGGER .?AU_SERVICE_TRIGGER@@ �� o1 � | m q1
Z N � _PERFINFO_PROCESS_INSWAP .?AU_PERFINFO_PROCESS_INSWAP@@ ��6
# DirectoryTableBase ���
" ProcessId N u1 _PERFINFO_PROCESS_INSWAP .?AU_PERFINFO_PROCESS_INSWAP@@ �� v1 c #
�% f � _TRANSACTIONMANAGER_BASIC_INFORMATION .?AU_TRANSACTIONMANAGER_BASIC_INFORMATION@@
y1 2
TmIdentity ���
� VirtualClock �f {1 _TRANSACTIONMANAGER_BASIC_INFORMATION .?AU_TRANSACTIONMANAGER_BASIC_INFORMATION@@ |1 � �
�" B � tagCOLORADJUSTMENT .?AUtagCOLORADJUSTMENT@@ ��
1 .
! caSize ���
! caFlags ��
! caIlluminantIndex
! caRedGamma ���
! caGreenGamma �
!
caBlueGamma ��
! caReferenceBlack �
! caReferenceWhite �
caContrast ���
caBrightness �
caColorfulness ���
caRedGreenTint ���B �1 tagCOLORADJUSTMENT .?AUtagCOLORADJUSTMENT@@ �� �1 � p V � _SYSTEM_HIBERFILE_INFORMATION .?AU_SYSTEM_HIBERFILE_INFORMATION@@
�1 � " �.
" NumberOfMcbPairs �
�1 Mcb ��V �1 _SYSTEM_HIBERFILE_INFORMATION .?AU_SYSTEM_HIBERFILE_INFORMATION@@ �1 x � 6 � _IELF_HANDLE .?AU_IELF_HANDLE@@ ��
Next �
# LastRecordRead ���
WorkItem �
LogPublisher �
( LogModule
" 0 RefCount �
" 4 Signature
" 8 Flags
" < MajorVersion �
" @ MinorVersion �
" D dwNotifyRequests �
" H NameLength ���
| L Name �6
�1 P _IELF_HANDLE .?AU_IELF_HANDLE@@ �� �1 B _ z
! MakeCode �
! Flags
! Reserved �
! VKey �
u Message ��
" ExtraInformation �: �1 tagRAWKEYBOARD .?AUtagRAWKEYBOARD@@ �� �1 �:
��
��
��
��V
�1 Channel ��
�1 Reserved �
�1 Shared ���
�1 MoreEntries ��N �1 _DMA_CONFIGURATION_BYTE0 .?AU_DMA_CONFIGURATION_BYTE0@@ �� �1 � N � USN_TRACK_MODIFIED_RANGES .?AUUSN_TRACK_MODIFIED_RANGES@@ V
" Flags
" Unused ���
# ChunkSize
FileSizeThreshold N �1 USN_TRACK_MODIFIED_RANGES .?AUUSN_TRACK_MODIFIED_RANGES@@ �1 � R
�! N � _ETW_STACK_CACHING_CONFIG .?AU_ETW_STACK_CACHING_CONFIG@@ .
" CacheSize
" BucketCount ��N �1 _ETW_STACK_CACHING_CONFIG .?AU_ETW_STACK_CACHING_CONFIG@@ �1 c > V � _SYSTEM_CALL_TIME_INFORMATION .?AU_SYSTEM_CALL_TIME_INFORMATION@@
�1 F
" Length ���
" TotalCalls ���
�1 TimeOfCalls ��V �1 _SYSTEM_CALL_TIME_INFORMATION .?AU_SYSTEM_CALL_TIME_INFORMATION@@ �1 � � R � tagWTSSESSION_NOTIFICATION .?AUtagWTSSESSION_NOTIFICATION@@ ��
�1 .
" cbSize ���
" dwSessionId ��R �1 tagWTSSESSION_NOTIFICATION .?AUtagWTSSESSION_NOTIFICATION@@ �� �1 ~ J � _KEY_FLAGS_INFORMATION .?AU_KEY_FLAGS_INFORMATION@@ ��F
" Wow64Flags ���
" KeyFlags �
" ControlFlags �J �1 _KEY_FLAGS_INFORMATION .?AU_KEY_FLAGS_INFORMATION@@ �� �1 � R J � _FILEOFFSET_INFORMATION .?AU_FILEOFFSET_INFORMATION@@
# ��
# 0 ��
# 9��>
�1 DontUse ��
�1 Offset ���
�1 Reserved �J �1 _FILEOFFSET_INFORMATION .?AU_FILEOFFSET_INFORMATION@@ �1 t b � _PROCESS_COMMIT_RELEASE_INFORMATION .?AU_PROCESS_COMMIT_RELEASE_INFORMATION@@
�1
" ��
" ��
" ��
" ���
" Version ��
�1 Eligible �
�1 ReleaseRepurposedMemResetCommit ��
�1 ForceReleaseMemResetCommit ���
�1 Spare
# CommitDebt ���
# CommittedMemResetSize
# RepurposedMemResetSize ���b �1 _PROCESS_COMMIT_RELEASE_INFORMATION .?AU_PROCESS_COMMIT_RELEASE_INFORMATION@@ �1 � �
!/
� * � HIMCC__ .?AUHIMCC__@@
t unused ���* �1 HIMCC__ .?AUHIMCC__@@ �1 � 6 � tagMINMAXINFO .?AUtagMINMAXINFO@@
�1 ~
� ptReserved ���
� ptMaxSize
� ptMaxPosition
� ptMinTrackSize ���
� ptMaxTrackSize ���6 �1 ( tagMINMAXINFO .?AUtagMINMAXINFO@@ �1 � B � _EXCEPTION_RECORD64 .?AU_EXCEPTION_RECORD64@@ # " x ��
ExceptionCode
" ExceptionFlags ���
# ExceptionRecord ��
# ExceptionAddress �
" NumberParameters �
" __unusedAlignment
�1 ExceptionInformation �B �1 � _EXCEPTION_RECORD64 .?AU_EXCEPTION_RECORD64@@ �1 �% a
�, * � pvalueA .?AUpvalueA@@ b
p pv_valuename �
t pv_valuelen ��
pv_value_context �
" pv_type ��* �1 pvalueA .?AUpvalueA@@ �1 � � :
" uMsg �
! wParamL ��
! wParamH ��> �1 tagHARDWAREINPUT .?AUtagHARDWAREINPUT@@ �� �1 � R � _FSCTL_OFFLOAD_WRITE_OUTPUT .?AU_FSCTL_OFFLOAD_WRITE_OUTPUT@@ :
" Size �
" Flags
# LengthWritten R �1 _FSCTL_OFFLOAD_WRITE_OUTPUT .?AU_FSCTL_OFFLOAD_WRITE_OUTPUT@@ �1 � � > � tagENHMETARECORD .?AUtagENHMETARECORD@@ ��2
" iType
" nSize
z dParm > �1 tagENHMETARECORD .?AUtagENHMETARECORD@@ �� �1 � 4 ^ � _RTLP_PROCESS_REFLECTION_CONTEXT .?AU_RTLP_PROCESS_REFLECTION_CONTEXT@@ ��
�1
�%
# ReflectionContextSize
" ReflectionFlags ��
�1 ReflectionRoutine
ReflectionParameter ��
ReflectedProcessCreatedEvent �
( ReflectedProcessHandlesDuplicatedEvent ���
0 ReflectionStartEvent �
4 8 ReflectionInformation ^ �1 X _RTLP_PROCESS_REFLECTION_CONTEXT .?AU_RTLP_PROCESS_REFLECTION_CONTEXT@@ �� �1 � � 6 � _RTL_BACKOFF .?AU_RTL_BACKOFF@@ ��
" Delay 6 �1 _RTL_BACKOFF .?AU_RTL_BACKOFF@@ �� �1 � b � _FILE_VALID_DATA_LENGTH_INFORMATION .?AU_FILE_VALID_DATA_LENGTH_INFORMATION@@
� ValidDataLength ��b �1 _FILE_VALID_DATA_LENGTH_INFORMATION .?AU_FILE_VALID_DATA_LENGTH_INFORMATION@@ �1 � �
�) 6 � tagSTICKYKEYS .?AUtagSTICKYKEYS@@
�1 *
u cbSize ���
" dwFlags ��6 �1 tagSTICKYKEYS .?AUtagSTICKYKEYS@@ �1 �3 J � _FILE_LEVEL_TRIM_RANGE .?AU_FILE_LEVEL_TRIM_RANGE@@ ��*
# Offset ���
# Length ���J �1 _FILE_LEVEL_TRIM_RANGE .?AU_FILE_LEVEL_TRIM_RANGE@@ �� �1 � 9 J � _IMAGE_ENCLAVE_CONFIG64 .?AU_IMAGE_ENCLAVE_CONFIG64@@ F
" Size �
" MinimumRequiredConfigSize
" PolicyFlags ��
" NumberOfImports ��
" ImportList ���
" ImportEntrySize ��
p FamilyID �
p ( ImageID ��
" 8 ImageVersion �
" < SecurityVersion ��
# @ EnclaveSize ��
" H NumberOfThreads ��
" L EnclaveFlags �J
�1 P _IMAGE_ENCLAVE_CONFIG64 .?AU_IMAGE_ENCLAVE_CONFIG64@@ �1 � s �
=( TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
q ServerCertificateSubject �^ �1 ( _RPC_HTTP_TRANSPORT_CREDENTIALS_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_W@@ �1 _ � 6 � tagSTYLEBUFW .?AUtagSTYLEBUFW@@ ��.
" dwStyle ��
szDescription 6 �1 D tagSTYLEBUFW .?AUtagSTYLEBUFW@@ �� 2 � � F � tagEMRSETMAPPERFLAGS .?AUtagEMRSETMAPPERFLAGS@@ ��
2 &
� emr ��
" dwFlags ��F 2 tagEMRSETMAPPERFLAGS .?AUtagEMRSETMAPPERFLAGS@@ �� 2 � � � 2
� J � _PERFINFO_CC_READ_AHEAD .?AU_PERFINFO_CC_READ_AHEAD@@ �
# WorkItemKey ��
# FileOffset ���
" Size �
" PagePriority �
" DetectedPattern ��
" Reserved �J 2 _PERFINFO_CC_READ_AHEAD .?AU_PERFINFO_CC_READ_AHEAD@@ 2 c � # �/ B � _GLYPHMETRICSFLOAT .?AU_GLYPHMETRICSFLOAT@@ ��
2 2 � _POINTFLOAT .?AU_POINTFLOAT@@ ~
@ gmfBlackBoxX �
@ gmfBlackBoxY �
2 gmfptGlyphOrigin �
@ gmfCellIncX ��
@ gmfCellIncY ��B
2 _GLYPHMETRICSFLOAT .?AU_GLYPHMETRICSFLOAT@@ �� 2 � U J � _EXIT_THREAD_DEBUG_INFO .?AU_EXIT_THREAD_DEBUG_INFO@@
" dwExitCode ���J 2 _EXIT_THREAD_DEBUG_INFO .?AU_EXIT_THREAD_DEBUG_INFO@@ 2 � H : � DLGITEMTEMPLATE .?AUDLGITEMTEMPLATE@@ v
" style
" dwExtendedStyle ��
x
y
cx ���
cy ���
! id ���: 2 DLGITEMTEMPLATE .?AUDLGITEMTEMPLATE@@ 2 X J � _IMAGE_ENCLAVE_CONFIG32 .?AU_IMAGE_ENCLAVE_CONFIG32@@ F
" Size �
" MinimumRequiredConfigSize
" PolicyFlags ��
" NumberOfImports ��
" ImportList ���
" ImportEntrySize ��
p FamilyID �
p ( ImageID ��
" 8 ImageVersion �
" < SecurityVersion ��
" @ EnclaveSize ��
" D NumberOfThreads ��
" H EnclaveFlags �J
2 L _IMAGE_ENCLAVE_CONFIG32 .?AU_IMAGE_ENCLAVE_CONFIG32@@ 2 � c J � _WMI_JOB_REMOVE_PROCESS .?AU_WMI_JOB_REMOVE_PROCESS@@ v
ContainerId ��
" JobId
" UniqueProcessId ��
" RemovalFlags �
ExitStatus ���J "2 _WMI_JOB_REMOVE_PROCESS .?AU_WMI_JOB_REMOVE_PROCESS@@ #2 c � B � _WINDOWS_OS_OPTIONS .?AU_WINDOWS_OS_OPTIONS@@ r
Signature
" Version ��
" Length ���
" OsLoadPathOffset �
| OsLoadOptions B &2 _WINDOWS_OS_OPTIONS .?AU_WINDOWS_OS_OPTIONS@@ '2 � � > � localeinfo_struct .?AUlocaleinfo_struct@@ J � threadlocaleinfostruct .?AUthreadlocaleinfostruct@@ ��
*2
�. *
+2 locinfo ��
,2 mbcinfo ��> -2 localeinfo_struct .?AUlocaleinfo_struct@@ .2 ( � N � _PROCESS_TLS_INFORMATION .?AU_PROCESS_TLS_INFORMATION@@ ��J � _THREAD_TLS_INFORMATION .?AU_THREAD_TLS_INFORMATION@@ 12 " �
" Flags
" OperationType
" ThreadDataCount ��
" TlsIndex �
" PreviousCount
22 ThreadData ���N 32 ( _PROCESS_TLS_INFORMATION .?AU_PROCESS_TLS_INFORMATION@@ �� 42 � o
�& B PerfInfoMemUsagePfnMetadata �� PerfInfoMemUsageMax ��Z t 72 _PERFINFO_KERNELMEMORY_USAGE_TYPE .?AW4_PERFINFO_KERNELMEMORY_USAGE_TYPE@@ � 82 c R � _PERFINFO_IDLE_STATE_CHANGE .?AU_PERFINFO_IDLE_STATE_CHANGE@@ :
" State
" Throttle �
" Direction R ;2 _PERFINFO_IDLE_STATE_CHANGE .?AU_PERFINFO_IDLE_STATE_CHANGE@@ <2 c 4 6 � tagEMRELLIPSE .?AUtagEMRELLIPSE@@ &
� emr ��
d rclBox ���6 ?2 tagEMRELLIPSE .?AUtagEMRELLIPSE@@ @2 �
7( �
" lcsSignature �
" lcsVersion ���
" lcsSize ��
lcsCSType
lcsIntent
� lcsEndpoints �
" 8 lcsGammaRed ��
" < lcsGammaGreen
" @ lcsGammaBlue �
� D lcsFilename ��>
C2 LtagLOGCOLORSPACEW .?AUtagLOGCOLORSPACEW@@ D2 �
v!
� ��
G2 ^ � _SYSTEM_CODEINTEGRITY_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_INFORMATION@@ 6
" Length ���
" CodeIntegrityOptions �^ J2 _SYSTEM_CODEINTEGRITY_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_INFORMATION@@ K2 � �
R � _SHRINK_VOLUME_INFORMATION .?AU_SHRINK_VOLUME_INFORMATION@@ ��> ShrinkPrepare ShrinkCommit � ShrinkAbort ��R t N2 _SHRINK_VOLUME_REQUEST_TYPES .?AW4_SHRINK_VOLUME_REQUEST_TYPES@@ ��� O2 � � N
O2 ShrinkRequestType
# Flags
NewNumberOfSectors ���R Q2 _SHRINK_VOLUME_INFORMATION .?AU_SHRINK_VOLUME_INFORMATION@@ �� R2 � � * � _FP_80 .?AU_FP_80@@ ��
T2
� W * V2 _FP_80 .?AU_FP_80@@ �� W2 � >
" ��
" ��
" ��
" ��
" ��
" Flags
Z2 EnableBottomUpRandomization ��
[2 EnableForceRelocateImages
\2 EnableHighEntropy
]2 DisallowStrippedImages ���
^2 ReservedFlags Z _2 _PROCESS_MITIGATION_ASLR_POLICY .?AU_PROCESS_MITIGATION_ASLR_POLICY@@ `2 ? ? Z � _ETW_WNF_EVENT_NAME_SUB_RUNDOWN .?AU_ETW_WNF_EVENT_NAME_SUB_RUNDOWN@@
b2 >
j Header ���
� StateName
( NameSub ��Z d2 0 _ETW_WNF_EVENT_NAME_SUB_RUNDOWN .?AU_ETW_WNF_EVENT_NAME_SUB_RUNDOWN@@ e2 c � F FindStreamInfoStandard ��� FindStreamInfoMaxInfoLevel ���> t g2 _STREAM_INFO_LEVELS .?AW4_STREAM_INFO_LEVELS@@ � h2 X L
�" > � _CACHE_DESCRIPTOR .?AU_CACHE_DESCRIPTOR@@
k2 ^
Level
Associativity
! LineSize �
" Size �
. Type �> m2 _CACHE_DESCRIPTOR .?AU_CACHE_DESCRIPTOR@@ n2 �
r!
b � _SECTION_INTERNAL_IMAGE_INFORMATION .?AU_SECTION_INTERNAL_IMAGE_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�( SectionInformation ���
" @ ExtendedFlags
s2 @ ImageExportSuppressionEnabled
t2 @ ImageCetShadowStacksReady
u2 @ ImageXfgEnabled ��
v2 @ ImageCetShadowStacksStrictMode ���
w2 @ ImageCetSetContextIpValidationRelaxedMode
x2 @ ImageCetDynamicApisAllowInProc ���
y2 @ ImageCetDowngradeReserved1 ���
z2 @ ImageCetDowngradeReserved2 ���
{2 @ Reserved �b |2 H _SECTION_INTERNAL_IMAGE_INFORMATION .?AU_SECTION_INTERNAL_IMAGE_INFORMATION@@ }2 t � ^ � _SYSTEM_MEMORY_USAGE_INFORMATION .?AU_SYSTEM_MEMORY_USAGE_INFORMATION@@ ��
2 �
# TotalPhysicalBytes ���
# AvailableBytes ���
ResidentAvailableBytes ���
# CommittedBytes ���
# SharedCommittedBytes �
# ( CommitLimitBytes �
# 0 PeakCommitmentBytes ��^ �2 8 _SYSTEM_MEMORY_USAGE_INFORMATION .?AU_SYSTEM_MEMORY_USAGE_INFORMATION@@ �� �2 � y v � _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION .?AU_PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION@@
�2
ProcessHandle v �2 _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION .?AU_PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION@@ �2 � P
Z " " " # # t �2
�2
�* R � _WMI_DISKIO_READWRITE_INIT .?AU_WMI_DISKIO_READWRITE_INIT@@ ��
�2 .
Irp ��
" IssuingThreadId ��R �2 _WMI_DISKIO_READWRITE_INIT .?AU_WMI_DISKIO_READWRITE_INIT@@ �� �2 c � : � _HEAP_RANGE_LOG .?AU_HEAP_RANGE_LOG@@
�2 > � _HEAP_EVENT_RANGE .?AU_HEAP_EVENT_RANGE@@ &
j Header ���
�2 Range : �2 8 _HEAP_RANGE_LOG .?AU_HEAP_RANGE_LOG@@ �2 c �
�+ . � _TP_ALPC .?AU_TP_ALPC@@ ��
�2 � �2 �2
�2 &
� NextVcn ��
� Lcn ��: �2 <anonymous-tag> .?AU<anonymous-tag>@@ �2 � ^
�2 " �F
" ExtentCount ��
� StartingVcn ��
�2 Extents ��N �2 RETRIEVAL_POINTERS_BUFFER .?AURETRIEVAL_POINTERS_BUFFER@@ �2 � Z
f � _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE@@ ��&
# Version ��
q Name �f �2 _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE@@ �� �2 x O B � _CI_LOG_MMCSS_STOP .?AU_CI_LOG_MMCSS_STOP@@ ��
Header ���B �2 0 _CI_LOG_MMCSS_STOP .?AU_CI_LOG_MMCSS_STOP@@ �� �2 c g B � _HEAP_RANGE_CREATE .?AU_HEAP_RANGE_CREATE@@ ��&
j Header ���
�, Event B �2 8 _HEAP_RANGE_CREATE .?AU_HEAP_RANGE_CREATE@@ �� �2 c � V � _CONSOLE_READCONSOLE_CONTROL .?AU_CONSOLE_READCONSOLE_CONTROL@@ ��
�2 f
" nLength ��
" nInitialChars
" dwCtrlWakeupMask �
" dwControlKeyState V �2 _CONSOLE_READCONSOLE_CONTROL .?AU_CONSOLE_READCONSOLE_CONTROL@@ ��6 onecore\external\sdk\inc\minwin\consoleapi.h ��� �2 �2 � >
ciexyzX ��
ciexyzY ��
ciexyzZ ��. �2 tagCIEXYZ .?AUtagCIEXYZ@@ �2 � � R � _SYSTEM_ERROR_PORT_TIMEOUTS .?AU_SYSTEM_ERROR_PORT_TIMEOUTS@@ 2
" StartTimeout �
" CommTimeout ��R �2 _SYSTEM_ERROR_PORT_TIMEOUTS .?AU_SYSTEM_ERROR_PORT_TIMEOUTS@@ �2 �
� R � _FILE_STANDARD_INFORMATION .?AU_FILE_STANDARD_INFORMATION@@ ��v
� AllocationSize ���
� EndOfFile
" NumberOfLinks
DeletePending
Directory R �2 _FILE_STANDARD_INFORMATION .?AU_FILE_STANDARD_INFORMATION@@ �� �2 � �
� ��
�2
�# V � _CM_EISA_FUNCTION_INFORMATION .?AU_CM_EISA_FUNCTION_INFORMATION@@ " �R � _EISA_MEMORY_CONFIGURATION .?AU_EISA_MEMORY_CONFIGURATION@@ �� �2 " ? �J � _EISA_IRQ_CONFIGURATION .?AU_EISA_IRQ_CONFIGURATION@@ �2 " � " �N � _EISA_PORT_CONFIGURATION .?AU_EISA_PORT_CONFIGURATION@@ �� �2 " < � " < �6
" CompressedId �
IdSlotFlags1 �
IdSlotFlags2 �
MinorRevision
MajorRevision
�2 Selections ���
" FunctionFlags
d$ # TypeString ���
�2 s EisaMemory ���
�2 � EisaIrq ��
�2 � EisaDma ��
�2 � EisaPort �
�2 InitializationData ���V
�2 @_CM_EISA_FUNCTION_INFORMATION .?AU_CM_EISA_FUNCTION_INFORMATION@@ �2 9 Z � _THREAD_CYCLE_TIME_INFORMATION .?AU_THREAD_CYCLE_TIME_INFORMATION@@ ��:
# AccumulatedCycles
# CurrentCycleCount Z �2 _THREAD_CYCLE_TIME_INFORMATION .?AU_THREAD_CYCLE_TIME_INFORMATION@@ �� �2 � � F � _EVENT_TRACE_LOGFILEA .?AU_EVENT_TRACE_LOGFILEA@@
�2
�2 " �2
�2
��
��
��
��V
�2 Reserved0
�2 TransferSize �
�2 Timing ���
�2 Reserved1 N �2 _DMA_CONFIGURATION_BYTE1 .?AU_DMA_CONFIGURATION_BYTE1@@ �� �2 b � _FILE_INITIATE_REPAIR_OUTPUT_BUFFER .?AU_FILE_INITIATE_REPAIR_OUTPUT_BUFFER@@
�2 F
# Hint1
# Hint2
# Clsn �
Status ���b �2 _FILE_INITIATE_REPAIR_OUTPUT_BUFFER .?AU_FILE_INITIATE_REPAIR_OUTPUT_BUFFER@@ �2 � � * � tagMSG .?AUtagMSG@@ ��
�2 n
� hwnd �
u message ��
# wParam ���
lParam ���
" time �
� $ pt ���* �2 0 tagMSG .?AUtagMSG@@ �� �2 P J � _LDR_DATA_TABLE_ENTRY64 .?AU_LDR_DATA_TABLE_ENTRY64@@
�2 �
InLoadOrderLinks �
InMemoryOrderLinks ���
InInitializationOrderLinks ���
# 0 DllBase ��
# 8 EntryPoint ���
" @ SizeOfImage ��
� H FullDllName ��
� X BaseDllName ��
" h Flags
! l LoadCount
! n TlsIndex �
p HashLinks
# p SectionPointer ���
" x CheckSum �
" � TimeDateStamp
# � LoadedImports J �2 � _LDR_DATA_TABLE_ENTRY64 .?AU_LDR_DATA_TABLE_ENTRY64@@ �2 � > F � _ETW_HEAP_EVENT_ALLOC .?AU_ETW_HEAP_EVENT_ALLOC@@
�2 f
j Header ���
HeapHandle ���
# ( Size �
0 Address ��
" 8 Source ���F �2 < _ETW_HEAP_EVENT_ALLOC .?AU_ETW_HEAP_EVENT_ALLOC@@ �2 c �
{"
1 > � tagCBT_CREATEWNDW .?AUtagCBT_CREATEWNDW@@
�2 .
�( lpcs �
� hwndInsertAfter ��> �2 tagCBT_CREATEWNDW .?AUtagCBT_CREATEWNDW@@ �2 ] N � _CM_COMPONENT_INFORMATION .?AU_CM_COMPONENT_INFORMATION@@ N
�- Flags
" Version ��
" Key ��
# AffinityMask �N 3 _CM_COMPONENT_INFORMATION .?AU_CM_COMPONENT_INFORMATION@@ 3 � J � tagEMRCREATECOLORSPACE .?AUtagEMRCREATECOLORSPACE@@ ��2
� emr ��
" ihCS �
g& lcs ��J 3 TtagEMRCREATECOLORSPACE .?AUtagEMRCREATECOLORSPACE@@ �� 3 � � 6 � tagMETAHEADER .?AUtagMETAHEADER@@ �
! mtType ���
! mtHeaderSize �
! mtVersion
" mtSize ���
!
mtNoObjects ��
" mtMaxRecord ��
! mtNoParameters ���6 3 tagMETAHEADER .?AUtagMETAHEADER@@ 3 � > � MOFRESOURCEINFOA .?AUMOFRESOURCEINFOA@@ ��
3 b
p ImagePath
p ResourceName �
" ResourceSize �
ResourceBuffer ���>
3 MOFRESOURCEINFOA .?AUMOFRESOURCEINFOA@@ ��* onecore\external\sdk\inc\wmium.h ��� 3 3 L f � _SYSTEM_KERNEL_VA_SHADOW_INFORMATION .?AU_SYSTEM_KERNEL_VA_SHADOW_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��2
3 KvaShadowEnabled �
3 KvaShadowUserGlobal ��
3 KvaShadowPcid
3 KvaShadowInvpcid �
3 KvaShadowRequired
3 KvaShadowRequiredAvailable ���
3 InvalidPteBit
3 L1DataCacheFlushSupported
3 L1TerminalFaultMitigationPresent �
3 Reserved �:
3 <anonymous-tag> .?AU<anonymous-tag>@@ 3 � �
3 KvaShadowFlags ���f 3 _SYSTEM_KERNEL_VA_SHADOW_INFORMATION .?AU_SYSTEM_KERNEL_VA_SHADOW_INFORMATION@@ �� 3 � � j � _FSCTL_GET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_GET_INTEGRITY_INFORMATION_BUFFER@@ �
! ChecksumAlgorithm
! Reserved �
" Flags
" ChecksumChunkSizeInBytes �
" ClusterSizeInBytes ���j #3 _FSCTL_GET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_GET_INTEGRITY_INFORMATION_BUFFER@@ $3 � �
u, 2 � WMIREGGUIDW .?AUWMIREGGUIDW@@
'3 �
Guid �
" Flags
" InstanceCount
" InstanceNameList �
" BaseNameOffset ���
# Pdo ��
# InstanceInfo �2 )3 WMIREGGUIDW .?AUWMIREGGUIDW@@ *3 � * > � _FILE_STREAM_INFO .?AU_FILE_STREAM_INFO@@
,3 �
" NextEntryOffset ��
" StreamNameLength �
� StreamSize ���
� StreamAllocationSize �
| StreamName ���> .3 _FILE_STREAM_INFO .?AU_FILE_STREAM_INFO@@ /3 o �" j � _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER@@ B
! ChecksumAlgorithm
! Reserved �
" Flags j 23 _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER@@ 33 � � Z � DISPLAYCONFIG_PATH_TARGET_INFO .?AUDISPLAYCONFIG_PATH_TARGET_INFO@@ ��
u ��
u ��J � DISPLAYCONFIG_RATIONAL .?AUDISPLAYCONFIG_RATIONAL@@ ��Z DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED �� DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE �� DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED ��� DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST ��� DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST ��� ��DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 V t 93 DISPLAYCONFIG_SCANLINE_ORDERING .?AW4DISPLAYCONFIG_SCANLINE_ORDERING@@ � :3 � &
� adapterId
u id ���
u modeInfoIdx ��
63 desktopModeInfoIdx ���
73 targetModeInfoIdx
�$ outputTechnology �
9$ rotation �
{# scaling ��
83 refreshRate ��
:3 $ scanLineOrdering �
t ( targetAvailable ��
u , statusFlags ��Z <3 0 DISPLAYCONFIG_PATH_TARGET_INFO .?AUDISPLAYCONFIG_PATH_TARGET_INFO@@ �� =3 � � R � _SYSTEM_MEMORY_INFORMATION .?AU_SYSTEM_MEMORY_INFORMATION@@ ��
?3 z
# PagedPoolCommitPageCount �
# NonPagedPoolPageCount
# MdlPageCount �
# CommitPageCount ��R A3 _SYSTEM_MEMORY_INFORMATION .?AU_SYSTEM_MEMORY_INFORMATION@@ �� B3 � �
�0
8+ N � READ_USN_JOURNAL_DATA_V0 .?AUREAD_USN_JOURNAL_DATA_V0@@ ��
F3 �
StartUsn �
" ReasonMask ���
" ReturnOnlyOnClose
# Timeout ��
# BytesToWaitFor ���
# UsnJournalID �N H3 ( READ_USN_JOURNAL_DATA_V0 .?AUREAD_USN_JOURNAL_DATA_V0@@ �� I3 � . > � _SYSTEM_ALARM_ACE .?AU_SYSTEM_ALARM_ACE@@ :
� Header ���
" Mask �
" SidStart �> L3 _SYSTEM_ALARM_ACE .?AU_SYSTEM_ALARM_ACE@@ M3 x � � q # t O3
P3 V � _DUPLICATE_EXTENTS_DATA_EX32 .?AU_DUPLICATE_EXTENTS_DATA_EX32@@ ��
u Size �
u FileHandle ���
� SourceFileOffset �
� TargetFileOffset �
� ByteCount
" Flags V S3 ( _DUPLICATE_EXTENTS_DATA_EX32 .?AU_DUPLICATE_EXTENTS_DATA_EX32@@ �� T3 � �
�" b
AclRevision ��
Sbz1 �
! AclSize ��
! AceCount �
! Sbz2 �& W3 _ACL .?AU_ACL@@ �� X3 x � F � _EISA_IRQ_DESCRIPTOR .?AU_EISA_IRQ_DESCRIPTOR@@ ��2
Z3 ConfigurationByte
Reserved �J [3 _EISA_IRQ_CONFIGURATION .?AU_EISA_IRQ_CONFIGURATION@@ \3 � N � _KLDR_DATA_TABLE_ENTRY64 .?AU_KLDR_DATA_TABLE_ENTRY64@@ ��
InLoadOrderLinks �
# __Undefined1 �
# __Undefined2 �
# __Undefined3 �
# ( NonPagedDebugInfo
# 0 DllBase ��
# 8 EntryPoint ���
" @ SizeOfImage ��
� H FullDllName ��
� X BaseDllName ��
" h Flags
! l LoadCount
! n __Undefined5 �
# p __Undefined6 �
" x CheckSum �
" | __padding1 ���
" � TimeDateStamp
" � __padding2 ���N _3 � _KLDR_DATA_TABLE_ENTRY64 .?AU_KLDR_DATA_TABLE_ENTRY64@@ �� `3 � z � FindExSearchNameMatch FindExSearchLimitToDirectories ��� FindExSearchLimitToDevices ��� FindExSearchMaxSearchOp ��> t b3 _FINDEX_SEARCH_OPS .?AW4_FINDEX_SEARCH_OPS@@ ��� c3 � �
Z
e3
;( J
[ DllName ��
[ FunctionName �
RedirectionTarget ^ h3 _REDIRECTION_FUNCTION_DESCRIPTOR .?AU_REDIRECTION_FUNCTION_DESCRIPTOR@@ �� i3 � ^ b � _FILE_IO_PRIORITY_HINT_INFORMATION .?AU_FILE_IO_PRIORITY_HINT_INFORMATION@@ ��
� PriorityHint �b l3 _FILE_IO_PRIORITY_HINT_INFORMATION .?AU_FILE_IO_PRIORITY_HINT_INFORMATION@@ �� m3 � � 6
RpcProtocolSequence ��
Endpoint �F o3 _RPC_PROTSEQ_ENDPOINT .?AU_RPC_PROTSEQ_ENDPOINT@@ p3 7 � ^ � _GET_FILTER_FILE_IDENTIFIER_INPUT .?AU_GET_FILTER_FILE_IDENTIFIER_INPUT@@ 2
! AltitudeLength ���
| Altitude �^ s3 _GET_FILTER_FILE_IDENTIFIER_INPUT .?AU_GET_FILTER_FILE_IDENTIFIER_INPUT@@ t3 � �" 6 � _IMAGE_AUX_SYMBOL .?AT_IMAGE_AUX_SYMBOL@@ *
! Linenumber ���
! Size �: w3 <anonymous-tag> .?AU<anonymous-tag>@@ x3 � &
x3 LnSz �
" TotalSize 2 z3 <anonymous-tag> .?AT<anonymous-tag>@@ {3 � B
" PointerToLinenumber ��
" PointerToNextFunction : }3 <anonymous-tag> .?AU<anonymous-tag>@@ ~3 �
� Dimension : �3 <anonymous-tag> .?AU<anonymous-tag>@@ �3 � ! &
~3 Function �
�3 Array 2 �3 <anonymous-tag> .?AT<anonymous-tag>@@ �3 � N
" TagIndex �
{3 Misc �
�3 FcnAry ���
! TvIndex ��: �3 <anonymous-tag> .?AU<anonymous-tag>@@ �3 � " �
�3 Name �: �3 <anonymous-tag> .?AU<anonymous-tag>@@ �3 � ' �
" Length ���
! NumberOfRelocations ��
! NumberOfLinenumbers ��
" CheckSum �
Number ���
Selection
bReserved
HighNumber ���: �3 <anonymous-tag> .?AU<anonymous-tag>@@ �3 � * " �*
" crc ��
�3 rgbReserved ��: �3 <anonymous-tag> .?AU<anonymous-tag>@@ �3 � 5 Z
�3 Sym ��
�3 File �
�3 Section ��
w$ TokenDef �
�3 CRC ��6 �3 _IMAGE_AUX_SYMBOL .?AT_IMAGE_AUX_SYMBOL@@ �3 �
" ��
�3 6 � tagRGBTRIPLE .?AUtagRGBTRIPLE@@ ��>
rgbtBlue �
rgbtGreen
rgbtRed ��6 �3 tagRGBTRIPLE .?AUtagRGBTRIPLE@@ �� �3 � l
�3
�3 N � _MEMORY_SCRUB_INFORMATION .?AU_MEMORY_SCRUB_INFORMATION@@ .
Handle ���
# PagesScrubbed N �3 _MEMORY_SCRUB_INFORMATION .?AU_MEMORY_SCRUB_INFORMATION@@ �3 � � V PROTOCOL_NOT_LOADED �� PROTOCOL_LOADED �� PROTOCOL_ADDRESS_CHANGE ��F t �3 RPC_ADDRESS_CHANGE_TYPE .?AW4RPC_ADDRESS_CHANGE_TYPE@@ � �3 7 P
: � tagEMRFRAMERGN .?AUtagEMRFRAMERGN@@ ��v
� emr ��
d rclBounds
" cbRgnData
" ihBrush ��
e szlStroke
� ( RgnData ��: �3 , tagEMRFRAMERGN .?AUtagEMRFRAMERGN@@ �� �3 � �
F
lfHeight �
lfWidth ��
lfEscapement �
lfOrientation
lfWeight �
lfItalic �
lfUnderline ��
lfStrikeOut ��
lfCharSet
lfOutPrecision ���
lfClipPrecision ��
lfQuality
lfPitchAndFamily �
|" lfFaceName ���2 �3 < tagLOGFONTA .?AUtagLOGFONTA@@ �3 � �
�# B � _FILE_REGION_OUTPUT .?AU_FILE_REGION_OUTPUT@@ � " �v
" Flags
" TotalRegionEntryCount
" RegionEntryCount �
" Reserved �
�3 Region ���B �3 ( _FILE_REGION_OUTPUT .?AU_FILE_REGION_OUTPUT@@ �3 � p 6 � _RTL_SRWLOCK .?AU_RTL_SRWLOCK@@ ��
�3
# ��
# ��
# ��
# ��
# <��
�3 Locked ���
�3 Waiting ��
�3 Waking ���
�3 MultipleShared ���
�3 Shared ���
# Value
Ptr ��6 �3 _RTL_SRWLOCK .?AU_RTL_SRWLOCK@@ �� �3 � � n � _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS .?AU_SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS@@
�3
UserKeyHandle n �3 _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS .?AU_SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS@@ �3 � 0
�. F � _IO_ERROR_LOG_MESSAGE .?AU_IO_ERROR_LOG_MESSAGE@@
�3 �
! Type �
! Size �
! DriverNameLength �
� TimeStamp
" DriverNameOffset �
�# EntryData F �3 H _IO_ERROR_LOG_MESSAGE .?AU_IO_ERROR_LOG_MESSAGE@@ �3 �# D V � _DEFINE_STORAGE_RESERVE_INPUT .?AU_DEFINE_STORAGE_RESERVE_INPUT@@ ^ � _STORAGE_RESERVE_AREA_DEFINITION .?AU_STORAGE_RESERVE_AREA_DEFINITION@@ �� �3 " �
" Version ��
" Flags
" AreaDefinitionOffset �
" AreaDefinitionCount ��
�3 AreaDefinition ���V �3 _DEFINE_STORAGE_RESERVE_INPUT .?AU_DEFINE_STORAGE_RESERVE_INPUT@@ �3 � + j � _TOKEN_SECURITY_ATTRIBUTES_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_INFORMATION@@ ��
�%
�3 pAttributeV1 �2 �3 <anonymous-tag> .?AT<anonymous-tag>@@ �3 � 1 Z
! Version ��
! Reserved �
" AttributeCount ���
�3 Attribute j �3 _TOKEN_SECURITY_ATTRIBUTES_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_INFORMATION@@ �� �3 � " ^ � _FILE_FS_FULL_SIZE_INFORMATION_EX .?AU_FILE_FS_FULL_SIZE_INFORMATION_EX@@
�3
# ActualTotalAllocationUnits ���
# ActualAvailableAllocationUnits ���
# ActualPoolUnavailableAllocationUnits �
# CallerTotalAllocationUnits ���
# CallerAvailableAllocationUnits ���
# ( CallerPoolUnavailableAllocationUnits �
# 0 UsedAllocationUnits ��
# 8 TotalReservedAllocationUnits �
# @ VolumeStorageReserveAllocationUnits ��
# H AvailableCommittedAllocationUnits
# P PoolAvailableAllocationUnits �
" X SectorsPerAllocationUnit �
" \ BytesPerSector ���^
�3 ` _FILE_FS_FULL_SIZE_INFORMATION_EX .?AU_FILE_FS_FULL_SIZE_INFORMATION_EX@@ �3 � $ � � _PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION@@ ��
�3
�. Z
! NumberOfTargets ��
! Reserved �
" Reserved2
�3 Targets �� �3 _PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION@@ �� �3 ? w f � _KNONVOLATILE_CONTEXT_POINTERS_ARM64 .?AU_KNONVOLATILE_CONTEXT_POINTERS_ARM64@@ ��B
# X19 ��
# X20 ��
# X21 ��
# X22 ��
# X23 ��
# ( X24 ��
# 0 X25 ��
# 8 X26 ��
# @ X27 ��
# H X28 ��
# P Fp ���
# X Lr ���
# ` D8 ���
# h D9 ���
# p D10 ��
# x D11 ��
# � D12 ��
# � D13 ��
# � D14 ��
# � D15 ��f �3 � _KNONVOLATILE_CONTEXT_POINTERS_ARM64 .?AU_KNONVOLATILE_CONTEXT_POINTERS_ARM64@@ �� �3 � '
1 R � NDR_ALLOC_ALL_NODES_CONTEXT .?AUNDR_ALLOC_ALL_NODES_CONTEXT@@
�3 J � NDR_POINTER_QUEUE_STATE .?AUNDR_POINTER_QUEUE_STATE@@
�3
� ��
�3 F � _FULL_PTR_XLAT_TABLES .?AU_FULL_PTR_XLAT_TABLES@@
�3
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t
��
t ��
t ��
t
��
t ��> � IRpcChannelBuffer .?AUIRpcChannelBuffer@@
4
�( B � _NDR_ASYNC_MESSAGE .?AU_NDR_ASYNC_MESSAGE@@ ��
4
�( > � _NDR_PROC_CONTEXT .?AU_NDR_PROC_CONTEXT@@
4 �
�3 RpcMsg ���
Buffer ���
BufferStart ��
BufferEnd
BufferMark ���
" ( BufferLength �
" , MemorySize ���
0 Memory ���
8 IsClient �
9 Pad ��
! : uFlags2 ��
t < ReuseBuffer ��
�3 @ pAllocAllNodesContext
�3 H pPointerQueueState ���
t P IgnoreEmbeddedPointers ���
X PointerBufferMark
` CorrDespIncrement
a uFlags ���
! b UniquePtrCount ���
# h MaxCount �
" p Offset ���
" t ActualCount ��
� x pfnAllocate ��
� � pfnFree ��
� StackTop �
� pPresentedType ���
� pTransmitType
� SavedHandle ��
�3 � StubDesc �
�3 � FullPtrXlatTables
" � FullPtrRefId �
" � PointerLength
�3 � fInDontFree ��
�3 � fDontCallFreeInst
�3 � fUnused1 �
�3 � fHasReturn ���
�3 � fHasExtensions ���
�3 � fHasNewCorrDesc ��
�3 � fIsIn
�3 � fIsOut ���
�3 � fIsOicf ��
�3 � fBufferValid �
�3 � fHasMemoryValidateCallback ���
�3 � fInFree ��
�3 � fNeedMCCP
�3 � fUnused2 �
�3 � fUnused3 �
" � dwDestContext
� pvDestContext
\ � SavedContextHandles ��
� ParamNumber ��
4 � pRpcChannelBuffer
4 � pArrayInfo ���
" � SizePtrCountArray
" � SizePtrOffsetArray ���
" SizePtrLengthArray ���
pArgQueue
" dwStubPhase ��
LowStackMark �
4 pAsyncMsg
4 (pCorrInfo
0pCorrMemory ��
8pMemoryList ��
@pCSInfo ��
HConformanceMark ��
PVarianceMark �
XUnused ���
4 `pContext �
hContextHandleHash
ppUserMarshalList �
xReserved51_3 �
�Reserved51_4 �
�Reserved51_5 �B I 4 �_MIDL_STUB_MESSAGE .?AU_MIDL_STUB_MESSAGE@@ �� 4 � Q
�* t �
4
0 : � _SE_AUDIT_INFO .?AU_SE_AUDIT_INFO@@ ��
� "
" Size �
w AuditType
K AuditOperation ���
" AuditFlags ���
SubsystemName
ObjectTypeName ���
0 ObjectName ���
@ HandleId �
� H TransactionId
4 P OperationId ��
X ObjectCreation ���
Y GenerateOnClose ��: 4 ` _SE_AUDIT_INFO .?AU_SE_AUDIT_INFO@@ �� 4 x & %
4 > � _PATHNAME_BUFFER .?AU_PATHNAME_BUFFER@@ ��
4 .
" PathNameLength ���
| Name �> 4 _PATHNAME_BUFFER .?AU_PATHNAME_BUFFER@@ �� 4 � � 6 � _PREFIX_TABLE .?AU_PREFIX_TABLE@@
4
' N
NodeTypeCode �
NameLength ���
4 NextPrefixTree ���6 4 _PREFIX_TABLE .?AU_PREFIX_TABLE@@ 4 b b � _FSCTL_QUERY_STORAGE_CLASSES_OUTPUT .?AU_FSCTL_QUERY_STORAGE_CLASSES_OUTPUT@@ B � _FILE_STORAGE_TIER .?AU_FILE_STORAGE_TIER@@ �� "4 " ( �
" Version ��
" Size �
" Flags
" TotalNumberOfTiers ���
" NumberOfTiersReturned
#4 Tiers b $4 @_FSCTL_QUERY_STORAGE_CLASSES_OUTPUT .?AU_FSCTL_QUERY_STORAGE_CLASSES_OUTPUT@@ %4 � 8 SC_ENUM_PROCESS_INFO �2 t '4 _SC_ENUM_TYPE .?AW4_SC_ENUM_TYPE@@ � (4 � � ^ � _ETW_TRACE_PARTITION_INFORMATION .?AU_ETW_TRACE_PARTITION_INFORMATION@@ ��b
PartitionId ��
ParentId �
QpcOffsetFromRoot
" ( PartitionType ^ +4 0 _ETW_TRACE_PARTITION_INFORMATION .?AU_ETW_TRACE_PARTITION_INFORMATION@@ �� ,4 � ~
2
@" N � _ENABLE_TRACE_PARAMETERS .?AU_ENABLE_TRACE_PARAMETERS@@ ��
" Version ��
" EnableProperty ���
" ControlFlags �
SourceId �
� EnableFilterDesc �
" ( FilterDescCount ��N 14 0 _ENABLE_TRACE_PARAMETERS .?AU_ENABLE_TRACE_PARAMETERS@@ �� 24 �
� V � _ETW_UMS_EVENT_CONTEXT_SWITCH .?AU_ETW_UMS_EVENT_CONTEXT_SWITCH@@
54 �
j Header ���
" ScheduledThreadId
" $ SwitchCount ��
" ( KernelYieldCount �
" , MixedYieldCount ��
" 0 YieldCount ���V 74 8 _ETW_UMS_EVENT_CONTEXT_SWITCH .?AU_ETW_UMS_EVENT_CONTEXT_SWITCH@@ 84 c � R � _ETW_DUPLICATE_HANDLE_EVENT .?AU_ETW_DUPLICATE_HANDLE_EVENT@@ �
Object ���
" SourceHandle �
" TargetHandle �
" TargetProcessId ��
! ObjectType ���
" SourceProcessId ��R ;4 _ETW_DUPLICATE_HANDLE_EVENT .?AU_ETW_DUPLICATE_HANDLE_EVENT@@ <4 c X
V � _IMAGE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_RUNTIME_FUNCTION_ENTRY@@ f
" BeginAddress �
" EndAddress ���
" UnwindInfoAddress
" UnwindData ���V ?4 _IMAGE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_RUNTIME_FUNCTION_ENTRY@@ @4 � 3 B � tagTTPOLYGONHEADER .?AUtagTTPOLYGONHEADER@@ ��
B4 2 � tagPOINTFX .?AUtagPOINTFX@@ ��:
" cb ���
" dwType ���
D4 pfxStart �B E4 tagTTPOLYGONHEADER .?AUtagTTPOLYGONHEADER@@ �� F4 � �
�+ B � _RTL_HEAP_TAG_INFO .?AU_RTL_HEAP_TAG_INFO@@ ��
I4 V
" NumberOfAllocations ��
" NumberOfFrees
# BytesAllocated ���B K4 _RTL_HEAP_TAG_INFO .?AU_RTL_HEAP_TAG_INFO@@ �� L4 � � b � _PERFINFO_EXECUTIVE_RESOURCE_CONFIG .?AU_PERFINFO_EXECUTIVE_RESOURCE_CONFIG@@ j
" ReleaseSamplingRate ��
" ContentionSamplingRate ���
" NumberOfExcessiveTimeouts b O4 _PERFINFO_EXECUTIVE_RESOURCE_CONFIG .?AU_PERFINFO_EXECUTIVE_RESOURCE_CONFIG@@ P4 c � : � tagPOINTER_INFO .?AUtagPOINTER_INFO@@ �
R4 pointerInfo ��
u ` touchFlags ���
u d touchMask
! h rcContact
! x rcContactRaw �
u � orientation ��
u � pressure �F S4 � tagPOINTER_TOUCH_INFO .?AUtagPOINTER_TOUCH_INFO@@ T4 � ^ � _FILE_REMOTE_PROTOCOL_INFORMATION .?AU_FILE_REMOTE_PROTOCOL_INFORMATION@@
` Reserved �: W4 <anonymous-tag> .?AU<anonymous-tag>@@ X4 � t
" Capabilities �: Z4 <anonymous-tag> .?AU<anonymous-tag>@@ [4 � � n
" Capabilities �
" CachingFlags �
ShareType
- Reserved0
" Reserved1 : ]4 <anonymous-tag> .?AU<anonymous-tag>@@ ^4 � � &
[4 Server ���
^4 Share : `4 <anonymous-tag> .?AU<anonymous-tag>@@ a4 � � &
a4 Smb2 �
k Reserved �2 c4 @ <anonymous-tag> .?AT<anonymous-tag>@@ d4 � �
! StructureVersion �
! StructureSize
" Protocol �
! ProtocolMajorVersion �
!
ProtocolMinorVersion �
! ProtocolRevision �
! Reserved �
" Flags
X4 GenericReserved ��
d4 4 ProtocolSpecific �^
f4 t _FILE_REMOTE_PROTOCOL_INFORMATION .?AU_FILE_REMOTE_PROTOCOL_INFORMATION@@ g4 � b ^ � _PERFINFO_PO_SESSION_CALLOUT_RET .?AU_PERFINFO_PO_SESSION_CALLOUT_RET@@ ��
Status ���^ j4 _PERFINFO_PO_SESSION_CALLOUT_RET .?AU_PERFINFO_PO_SESSION_CALLOUT_RET@@ �� k4 c �
O%
� R � _PERFINFO_CC_FLUSH_SECTION .?AU_PERFINFO_CC_FLUSH_SECTION@@ ��r
# WorkItemKey ��
# FileObjectKey
# Offset ���
" Length ���
" MmFlushFlags �R p4 _PERFINFO_CC_FLUSH_SECTION .?AU_PERFINFO_CC_FLUSH_SECTION@@ �� q4 c � f � _REFS_DEALLOCATE_RANGES_INPUT_BUFFER .?AU_REFS_DEALLOCATE_RANGES_INPUT_BUFFER@@ ��
s4 �, " �.
" RangeCount ���
u4 Ranges ���f v4 _REFS_DEALLOCATE_RANGES_INPUT_BUFFER .?AU_REFS_DEALLOCATE_RANGES_INPUT_BUFFER@@ �� w4 � �*
�, R � _FILE_TRACKING_INFORMATION .?AU_FILE_TRACKING_INFORMATION@@ ��^
DestinationFile ��
" ObjectInformationLength ��
ObjectInformation R {4 _FILE_TRACKING_INFORMATION .?AU_FILE_TRACKING_INFORMATION@@ �� |4 � 7 N � _EVENT_FILTER_EVENT_NAME .?AU_EVENT_FILTER_EVENT_NAME@@ ��
# MatchAnyKeyword ��
# MatchAllKeyword ��
Level
FilterIn �
! NameCount
� Names N 4 _EVENT_FILTER_EVENT_NAME .?AU_EVENT_FILTER_EVENT_NAME@@ �� �4 > z V � _PROCESS_SESSION_INFORMATION .?AU_PROCESS_SESSION_INFORMATION@@ ��
" SessionId V �4 _PROCESS_SESSION_INFORMATION .?AU_PROCESS_SESSION_INFORMATION@@ �� �4 ? : R � _IMAGE_BOUND_FORWARDER_REF .?AU_IMAGE_BOUND_FORWARDER_REF@@ ��J
" TimeDateStamp
! OffsetModuleName �
! Reserved �R �4 _IMAGE_BOUND_FORWARDER_REF .?AU_IMAGE_BOUND_FORWARDER_REF@@ �� �4 � Z � _PERFINFO_CC_LOGGED_STREAM_INFO .?AU_PERFINFO_CC_LOGGED_STREAM_INFO@@ �
# FileObjectKey
" ReasonForFlush ���
" PagesToWrite �
# DirtyLoggedPages �
# DirtyLoggedPageThreshold �
� LargestLsnForLWS �Z �4 ( _PERFINFO_CC_LOGGED_STREAM_INFO .?AU_PERFINFO_CC_LOGGED_STREAM_INFO@@ �4 c �
2 > � tagEMRPIXELFORMAT .?AUtagEMRPIXELFORMAT@@ "
� emr ��
"0 pfd ��> �4 0 tagEMRPIXELFORMAT .?AUtagEMRPIXELFORMAT@@ �4 � � B � CORRELATION_VECTOR .?AUCORRELATION_VECTOR@@ ��
�4 p " � �*
p Version ��
�4 Vector ���B �4 � CORRELATION_VECTOR .?AUCORRELATION_VECTOR@@ �� �4 b �%
(+ Z � _ETW_LAST_DROPPED_EVENT_STRUCT .?AU_ETW_LAST_DROPPED_EVENT_STRUCT@@ ��6
" Count
" Padding ��
�1 Times Z �4 _ETW_LAST_DROPPED_EVENT_STRUCT .?AU_ETW_LAST_DROPPED_EVENT_STRUCT@@ �� �4 A �
�. f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A@@ ��
l
�4 TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
ServerCertificateSubject �
�4 ( ProxyCredentials �
" 0 NumberOfProxyAuthnSchemes
" 8 ProxyAuthnSchemes f �4 @ _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A@@ �� �4 _ � R � _HEAP_EXTENDED_INFORMATION .?AU_HEAP_EXTENDED_INFORMATION@@ ��J � _HEAP_INFORMATION_ITEM .?AU_HEAP_INFORMATION_ITEM@@ ��
�4 �4 �4
�4 > � _HEAP_INFORMATION .?AU_HEAP_INFORMATION@@ �
Process ��
# Heap �
" Level
�4 CallbackRoutine ��
CallbackContext ��
X# ( ProcessHeapInformation ���
�4 ( HeapInformation ��R �4 X _HEAP_EXTENDED_INFORMATION .?AU_HEAP_EXTENDED_INFORMATION@@ �� �4 � X
*4 J � _VIRTUALIZATION_RECORD .?AU_VIRTUALIZATION_RECORD@@ ��b
VbsEnabled ���
HvciEnabled ��
HyperVisorEnabled
Reserved �J �4 _VIRTUALIZATION_RECORD .?AU_VIRTUALIZATION_RECORD@@ �� �4 c �
@%
q. �
�4 TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
ServerCertificateSubject �^ �4 ( _RPC_HTTP_TRANSPORT_CREDENTIALS_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_A@@ �4 _ �
�! b � _MANAGE_WRITES_TO_EXECUTABLE_MEMORY .?AU_MANAGE_WRITES_TO_EXECUTABLE_MEMORY@@
�4
" ��
" ��
" ��
"
��
�4 Version ��
�4 ProcessEnableWriteExceptions �
�4 ThreadAllowWrites
�4 Spare
KernelWriteToExecutableSignal b �4 _MANAGE_WRITES_TO_EXECUTABLE_MEMORY .?AU_MANAGE_WRITES_TO_EXECUTABLE_MEMORY@@ �4 � �
� * � _TP_JOB .?AU_TP_JOB@@ & � HKL__ .?AUHKL__@@
�4
�4
t unused ���& �4 HKL__ .?AUHKL__@@ �4 �' n � _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY .?AU_RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY@@
�4
� BlockDynamicCode �n �4 _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY .?AU_RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY@@ �4 f Z � _SYSTEM_DEVICE_DATA_INFORMATION .?AU_SYSTEM_DEVICE_DATA_INFORMATION@@ r
DeviceId �
DataName �
" DataType �
" $ DataBufferLength �
( DataBuffer ���Z �4 0 _SYSTEM_DEVICE_DATA_INFORMATION .?AU_SYSTEM_DEVICE_DATA_INFORMATION@@ �4 � n r � _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY@@ ��
�4 z
" EntryLength ��
" DependencyTypeFlags ��
" ProviderSpecificFlags
� VirtualStorageType ���r �4 _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY@@ �� �4 � C > � tagDRAWTEXTPARAMS .?AUtagDRAWTEXTPARAMS@@
�4 v
u cbSize ���
t iTabLength ���
t iLeftMargin ��
t iRightMargin �
u uiLengthDrawn > �4 tagDRAWTEXTPARAMS .?AUtagDRAWTEXTPARAMS@@ �4 �
{
t unused ���. �4 HBITMAP__ .?AUHBITMAP__@@ �4 t I Z � _FILE_MAILSLOT_SET_INFORMATION .?AU_FILE_MAILSLOT_SET_INFORMATION@@ ��
� ReadTimeout ��Z �4 _FILE_MAILSLOT_SET_INFORMATION .?AU_FILE_MAILSLOT_SET_INFORMATION@@ �� �4 � m J � _GENERATE_NAME_CONTEXT .?AU_GENERATE_NAME_CONTEXT@@ �� q " �
! Checksum �
ChecksumInserted �
NameLength ���
�4 NameBuffer ���
" ExtensionLength ��
� ExtensionBuffer ��
" LastIndexValue ���J �4 $ _GENERATE_NAME_CONTEXT .?AU_GENERATE_NAME_CONTEXT@@ �� �4 b �
e N � _ETW_CREATE_HANDLE_EVENT .?AU_ETW_CREATE_HANDLE_EVENT@@ ��B
Object ���
" Handle ���
! ObjectType ���N �4 _ETW_CREATE_HANDLE_EVENT .?AU_ETW_CREATE_HANDLE_EVENT@@ �� �4 c M
B � tagBITMAPFILEHEADER .?AUtagBITMAPFILEHEADER@@ n
! bfType ���
" bfSize ���
! bfReserved1 ��
! bfReserved2 ��
"
bfOffBits B �4 tagBITMAPFILEHEADER .?AUtagBITMAPFILEHEADER@@ �4 � � b � _TXFS_LIST_TRANSACTION_LOCKED_FILES .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES@@ j
KtmTransaction ���
# NumberOfFiles
# BufferSizeRequired ���
# Offset ���b �4 ( _TXFS_LIST_TRANSACTION_LOCKED_FILES .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES@@ �4 �
� V � _CM_FULL_RESOURCE_DESCRIPTOR .?AU_CM_FULL_RESOURCE_DESCRIPTOR@@ ��N
� InterfaceType
" BusNumber
, PartialResourceList ��V �4 $ _CM_FULL_RESOURCE_DESCRIPTOR .?AU_CM_FULL_RESOURCE_DESCRIPTOR@@ �� �4 m n � _SYSTEM_VERIFIER_CANCELLATION_INFORMATION .?AU_SYSTEM_VERIFIER_CANCELLATION_INFORMATION@@ � " �
" CancelProbability
" CancelThreshold ��
" CompletionThreshold ��
" CancellationVerifierDisabled �
" AvailableIssues ��
�4 Issues ���n �4 _SYSTEM_VERIFIER_CANCELLATION_INFORMATION .?AU_SYSTEM_VERIFIER_CANCELLATION_INFORMATION@@ �4 � �
TypeId ���6 5 _WNF_TYPE_ID .?AU_WNF_TYPE_ID@@ �� 5 � � V � _SERVERSILO_BASIC_INFORMATION .?AU_SERVERSILO_BASIC_INFORMATION@@ �
" ServiceSessionId �
v State
ExitStatus ���
IsDownlevelContainer �
ApiSetSchema �
HostApiSetSchema �V 5 _SERVERSILO_BASIC_INFORMATION .?AU_SERVERSILO_BASIC_INFORMATION@@ 5 ? � b � _TRANSACTIONMANAGER_LOG_INFORMATION .?AU_TRANSACTIONMANAGER_LOG_INFORMATION@@
LogIdentity ��b 5 _TRANSACTIONMANAGER_LOG_INFORMATION .?AU_TRANSACTIONMANAGER_LOG_INFORMATION@@
5 � �
" ��
" ��
" ��
" ��
" ��
" Flags
5 SmtBranchTargetIsolation �
5 IsolateSecurityDomain
5 DisablePageCombine ���
5 SpeculativeStoreBypassDisable
5 ReservedFlags ~ 5 _PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY .?AU_PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY@@ 5 ? � > � _SERVICE_NOTIFY_1 .?AU_SERVICE_NOTIFY_1@@ ~
" dwVersion
� pfnNotifyCallback
pContext �
" dwNotificationStatus �
� ServiceStatus > 5 @ _SERVICE_NOTIFY_1 .?AU_SERVICE_NOTIFY_1@@ 5 � � 6 � tagWNDCLASSA .?AUtagWNDCLASSA@@ ��
5 �
u style
r% lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
5 hInstance
s% hIcon
4$ ( hCursor ��
Z! 0 hbrBackground
� 8 lpszMenuName �
� @ lpszClassName 6
5 H tagWNDCLASSA .?AUtagWNDCLASSA@@ �� 5
: � tagWNDCLASSEXW .?AUtagWNDCLASSEXW@@ ��
5
u cbSize ���
u style
r% lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
5 hInstance
s% hIcon
4$ ( hCursor ��
Z! 0 hbrBackground
8 lpszMenuName �
@ lpszClassName
s% H hIconSm ��: !5 P tagWNDCLASSEXW .?AUtagWNDCLASSEXW@@ �� "5 � : � _HARDERROR_MSG .?AU_HARDERROR_MSG@@ ���
c h
( Status ���
� 0 ErrorTime
" 8 ValidResponseOptions �
" < Response �
" @ NumberOfParameters ���
" D UnicodeStringParameterMask ���
� H Parameters ���: %5 p _HARDERROR_MSG .?AU_HARDERROR_MSG@@ �� &5 � � V � _RTL_USER_PROCESS_PARAMETERS .?AU_RTL_USER_PROCESS_PARAMETERS@@ �� �" " ��
" MaximumLength
" Length ���
" Flags
" DebugFlags ���
ConsoleHandle
" ConsoleFlags �
StandardInput
( StandardOutput ���
0 StandardError
�/ 8 CurrentDirectory �
P DllPath ��
` ImagePathName
p CommandLine ��
� Environment ��
" � StartingX
" � StartingY
" � CountX ���
" � CountY ���
" � CountCharsX ��
" � CountCharsY ��
" � FillAttribute
" � WindowFlags ��
" � ShowWindowFlags ��
� WindowTitle ��
� DesktopInfo ��
� ShellInfo
� RuntimeData ��
)5 � CurrentDirectores
# �EnvironmentSize ��
# �EnvironmentVersion ���
PackageDependencyData
" ProcessGroupId ���
" LoaderThreads
RedirectionDllName ���
HeapPartitionName
# 0DefaultThreadpoolCpuSetMasks �
" 8DefaultThreadpoolCpuSetMaskCount �
" <DefaultThreadpoolThreadMaximum ���V & *5 @_RTL_USER_PROCESS_PARAMETERS .?AU_RTL_USER_PROCESS_PARAMETERS@@ �� +5 7 k > � _PROCESSOR_RECORD .?AU_PROCESSOR_RECORD@@
-5 �
" Index
" FeatureSet ���
" ProcessorSpeed ���
ProcessorName
�$ � ProcessorIdentifier ��
� �VendorIdentifier �> /5 �_PROCESSOR_RECORD .?AU_PROCESSOR_RECORD@@ 05 c �
P B � _RTL_PROCESS_LOCKS .?AU_RTL_PROCESS_LOCKS@@ ��
35 V � _RTL_PROCESS_LOCK_INFORMATION .?AU_RTL_PROCESS_LOCK_INFORMATION@@ 55 " 0 �*
" NumberOfLocks
65 Locks B 75 8 _RTL_PROCESS_LOCKS .?AU_RTL_PROCESS_LOCKS@@ �� 85 � b � _FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER@@
" EventTypes ���b ;5 _FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER@@ <5 � �) > � tagMSLLHOOKSTRUCT .?AUtagMSLLHOOKSTRUCT@@ ^
� pt ���
" mouseData
" flags
" time �
# dwExtraInfo ��> ?5 tagMSLLHOOKSTRUCT .?AUtagMSLLHOOKSTRUCT@@ @5 f N � _CREATE_THREAD_DEBUG_INFO .?AU_CREATE_THREAD_DEBUG_INFO@@
B5 " �3
D5 N
hThread ��
lpThreadLocalBase
E5 lpStartAddress ���N F5 _CREATE_THREAD_DEBUG_INFO .?AU_CREATE_THREAD_DEBUG_INFO@@ G5 � 5 b � _SYSTEM_POWER_STATE_DISABLE_REASON .?AU_SYSTEM_POWER_STATE_DISABLE_REASON@@ �� " �R
J5 AffectedState
" PowerReasonCode ��
" PowerReasonLength b K5 _SYSTEM_POWER_STATE_DISABLE_REASON .?AU_SYSTEM_POWER_STATE_DISABLE_REASON@@ �� L5 x
y/ p " t O5
P5 V CoverageAllModules ��� CoverageSearchByHash � CoverageSearchByName �F t R5 _COVERAGE_REQUEST_CODES .?AW4_COVERAGE_REQUEST_CODES@@ � S5 � �
S5
�
�2 > � _EISA_MEMORY_TYPE .?AU_EISA_MEMORY_TYPE@@ �
X5 ConfigurationByte
DataSize �
! AddressLowWord ���
AddressHighByte ��
! MemorySize ���R Y5 _EISA_MEMORY_CONFIGURATION .?AU_EISA_MEMORY_CONFIGURATION@@ �� Z5 � R � _CONTAINER_ROOT_INFO_OUTPUT .?AU_CONTAINER_ROOT_INFO_OUTPUT@@
\5 >
! ContainerRootIdLength
� ContainerRootId ��R ^5 _CONTAINER_ROOT_INFO_OUTPUT .?AU_CONTAINER_ROOT_INFO_OUTPUT@@ _5 � �"
Y V � _SECURITY_DESCRIPTOR_RELATIVE .?AU_SECURITY_DESCRIPTOR_RELATIVE@@ z
Revision �
Sbz1 �
! Control ��
" Owner
" Group
" Sacl �
" Dacl �V c5 _SECURITY_DESCRIPTOR_RELATIVE .?AU_SECURITY_DESCRIPTOR_RELATIVE@@ d5 x � f � _EVENT_TRACE_SYSTEM_EVENT_INFORMATION .?AU_EVENT_TRACE_SYSTEM_EVENT_INFORMATION@@
f5 V
@ EventTraceInformationClass ���
# TraceHandle ��
� HookId ���f h5 _EVENT_TRACE_SYSTEM_EVENT_INFORMATION .?AU_EVENT_TRACE_SYSTEM_EVENT_INFORMATION@@ i5 A j � _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION .?AU_SYSTEM_SESSION_MAPPED_VIEW_INFORMATION@@ �
# NextEntryOffset ��
" SessionId
" ViewFailures �
# NumberOfBytesAvailable ���
# NumberOfBytesAvailableContiguous �j l5 _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION .?AU_SYSTEM_SESSION_MAPPED_VIEW_INFORMATION@@ m5 � �
b � _SYSTEM_KERNEL_DEBUGGER_INFORMATION .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION@@ F
KernelDebuggerEnabled
KernelDebuggerNotPresent �b p5 _SYSTEM_KERNEL_DEBUGGER_INFORMATION .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION@@ q5 � � > � tagMSGBOXPARAMSW .?AUtagMSGBOXPARAMSW@@ ���
u cbSize ���
� hwndOwner
5 hInstance
lpszText �
lpszCaption ��
" ( dwStyle ��
0 lpszIcon �
# 8 dwContextHelpId ��
: @ lpfnMsgBoxCallback ���
" H dwLanguageId �>
t5 P tagMSGBOXPARAMSW .?AUtagMSGBOXPARAMSW@@ �� u5 $ F � tagCOMPAREITEMSTRUCT .?AUtagCOMPAREITEMSTRUCT@@ ��
w5 �
u CtlType ��
u CtlID
� hwndItem �
u itemID1 ��
# itemData1
u itemID2 ��
# ( itemData2
" 0 dwLocaleId ���F y5 8 tagCOMPAREITEMSTRUCT .?AUtagCOMPAREITEMSTRUCT@@ �� z5 ,
^ � _LOOKUP_STREAM_FROM_CLUSTER_INPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_INPUT@@ B
" Flags
" NumberOfClusters �
�1 Cluster ��^ }5 _LOOKUP_STREAM_FROM_CLUSTER_INPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_INPUT@@ ~5 � � � MemoryBasicInformation ��� MemoryWorkingSetInformation �� MemoryMappedFilenameInformation �� MemoryRegionInformation �� MemoryWorkingSetExInformation MemorySharedCommitInformation MemoryImageInformation ��� MemoryRegionInformationEx MemoryPrivilegedBasicInformation � MemoryEnclaveImageInformation
MemoryBasicInformationCapped � MemoryPhysicalContiguityInformation ��J t �5 _MEMORY_INFORMATION_CLASS .?AW4_MEMORY_INFORMATION_CLASS@@ � �5 �
� b � _KEY_SET_VIRTUALIZATION_INFORMATION .?AU_KEY_SET_VIRTUALIZATION_INFORMATION@@
�5
" ��
" ��
" ��
" ��^
�5 VirtualTarget
�5 VirtualStore �
�5 VirtualSource
�5 Reserved �b �5 _KEY_SET_VIRTUALIZATION_INFORMATION .?AU_KEY_SET_VIRTUALIZATION_INFORMATION@@ �5 % B � _TOKEN_USER_CLAIMS .?AU_TOKEN_USER_CLAIMS@@ ��
�5
UserClaims ���B �5 _TOKEN_USER_CLAIMS .?AU_TOKEN_USER_CLAIMS@@ �� �5 x � N � _PERFINFO_MEM_RESET_INFO .?AU_PERFINFO_MEM_RESET_INFO@@ ��
�5
" ��
" ��f
BaseAddress ��
# SizeInBytes ��
�5 TypeInfo �
�5 Spare
" Flags N �5 _PERFINFO_MEM_RESET_INFO .?AU_PERFINFO_MEM_RESET_INFO@@ �� �5 c x
S � � _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ ��
�5 ��
�5
� �
�5 Information ��
SectionBase ��
" SectionLength
SectionGlobalDataBase
" SectionGlobalDataLength �� �5 ( _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ �� �5 � � Z � _KEY_CONTROL_FLAGS_INFORMATION .?AU_KEY_CONTROL_FLAGS_INFORMATION@@ ��
�5
" ControlFlags �Z �5 _KEY_CONTROL_FLAGS_INFORMATION .?AU_KEY_CONTROL_FLAGS_INFORMATION@@ �� �5 ! N � _SYSTEM_NUMA_INFORMATION .?AU_SYSTEM_NUMA_INFORMATION@@ �� & " � # " � # " �
" HighestNodeNumber
" Reserved �
�5 ActiveProcessorsGroupAffinity
�5 AvailableMemory ��
�5 Pad ��N �5 _SYSTEM_NUMA_INFORMATION .?AU_SYSTEM_NUMA_INFORMATION@@ �� �5 � : V � _FILE_ID_BOTH_DIR_INFORMATION .?AU_FILE_ID_BOTH_DIR_INFORMATION@@
�5 j
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
p D ShortNameLength ��
� F ShortName
� ` FileId ���
| h FileName �V �5 p _FILE_ID_BOTH_DIR_INFORMATION .?AU_FILE_ID_BOTH_DIR_INFORMATION@@ �5 �
�, V � _TRANSACTION_BIND_INFORMATION .?AU_TRANSACTION_BIND_INFORMATION@@
TmHandle �V �5 _TRANSACTION_BIND_INFORMATION .?AU_TRANSACTION_BIND_INFORMATION@@ �5 �
b � _SYSTEM_EXTENDED_THREAD_INFORMATION .?AU_SYSTEM_EXTENDED_THREAD_INFORMATION@@ R � _SYSTEM_THREAD_INFORMATION .?AU_SYSTEM_THREAD_INFORMATION@@ ��
�5 ThreadInfo ���
P StackBase
X StackLimit ���
` Win32StartAddress
h TebBase ��
# p Reserved2
# x Reserved3
# � Reserved4 b �5 � _SYSTEM_EXTENDED_THREAD_INFORMATION .?AU_SYSTEM_EXTENDED_THREAD_INFORMATION@@ �5 � U V � _QUERY_STORAGE_RESERVE_OUTPUT .?AU_QUERY_STORAGE_RESERVE_OUTPUT@@ R � _STORAGE_RESERVE_AREA_INFO .?AU_STORAGE_RESERVE_AREA_INFO@@ �� �5 " �B
" Version ��
" AreaInfoCount
�5 AreaInfo �V �5 _QUERY_STORAGE_RESERVE_OUTPUT .?AU_QUERY_STORAGE_RESERVE_OUTPUT@@ �5 � + N � HSYNTHETICPOINTERDEVICE__ .?AUHSYNTHETICPOINTERDEVICE__@@
t unused ���N �5 HSYNTHETICPOINTERDEVICE__ .?AUHSYNTHETICPOINTERDEVICE__@@ �5 � ^ � _ETW_COVERAGE_SAMPLER_BLOOM_INFO .?AU_ETW_COVERAGE_SAMPLER_BLOOM_INFO@@ ��
�5 &
$ Common ���
% Bloom ^ �5 ( _ETW_COVERAGE_SAMPLER_BLOOM_INFO .?AU_ETW_COVERAGE_SAMPLER_BLOOM_INFO@@ �� �5 A # J � _CI_LOG_SCHEDULER_SLEEP .?AU_CI_LOG_SCHEDULER_SLEEP@@
Header ���J �5 0 _CI_LOG_SCHEDULER_SLEEP .?AU_CI_LOG_SCHEDULER_SLEEP@@ �5 c U ^ � _WMI_EXTENDED_THREAD_INFORMATION .?AU_WMI_EXTENDED_THREAD_INFORMATION@@ ��j
" ProcessId
" ThreadId �
StackBase
StackLimit ���
UserStackBase
UserStackLimit ���
( StartAddr
# ( Affinity �
0 Win32StartAddr ���
8 TebBase ��
" @ SubProcessTag
p D BasePriority �
E PagePriority �
F IoPriority ���
G Flags
| H ThreadName ���^ �5 P _WMI_EXTENDED_THREAD_INFORMATION .?AU_WMI_EXTENDED_THREAD_INFORMATION@@ �� �5 c j � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1@@
�5 6
BootIdentifier ���
FirmwareType �j �5 _SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1@@ �5 �
_-
8 Data �: �5 _WNF_STATE_NAME .?AU_WNF_STATE_NAME@@ �5 �
N4 Z � _ETW_CLOCK_CONFIGURATION_EVENT .?AU_ETW_CLOCK_CONFIGURATION_EVENT@@ ��F
" KnownType
" Capabilities �
�0 DisableReason Z �5 _ETW_CLOCK_CONFIGURATION_EVENT .?AU_ETW_CLOCK_CONFIGURATION_EVENT@@ �� �5 c
� � �5 f � _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA .?AU_PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA@@ ��V
ServiceName ��
q DeviceInstance ���
" DeviceInstanceLength �f �5 _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA .?AU_PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA@@ �� �5 % !
G$ B � _WMI_PNP_RECORD_V4 .?AU_WMI_PNP_RECORD_V4@@ ��
�5 b
ClassGuid
" UpperFilterCount �
" LowerFilterCount �
| Strings ��B �5 _WMI_PNP_RECORD_V4 .?AU_WMI_PNP_RECORD_V4@@ �� �5 c � � DriverType ��� FileSystemType ��� Win32ServiceOwnProcess ��� Win32ServiceShareProcess � AdapterType �� RecognizerType ���B t �5 _CM_SERVICE_NODE_TYPE .?AW4_CM_SERVICE_NODE_TYPE@@ � �5 v
# �5
�5 b SC_EVENT_DATABASE_CHANGE � SC_EVENT_PROPERTY_CHANGE � SC_EVENT_STATUS_CHANGE ���6 t �5 _SC_EVENT_TYPE .?AW4_SC_EVENT_TYPE@@ ��� �5 � �
�5 �5
� R � _DUPLICATE_EXTENTS_DATA_EX .?AU_DUPLICATE_EXTENTS_DATA_EX@@ ��
# Size �
FileHandle ���
� SourceFileOffset �
� TargetFileOffset �
� ByteCount
" ( Flags R �5 0 _DUPLICATE_EXTENTS_DATA_EX .?AU_DUPLICATE_EXTENTS_DATA_EX@@ �� �5 � r N � _SCRUB_PARITY_EXTENT_DATA .?AU_SCRUB_PARITY_EXTENT_DATA@@ F � _SCRUB_PARITY_EXTENT .?AU_SCRUB_PARITY_EXTENT@@ �� 6 " �
! Size �
! Flags
! NumberOfParityExtents
! MaximumNumberOfParityExtents �
6 ParityExtents N 6 _SCRUB_PARITY_EXTENT_DATA .?AU_SCRUB_PARITY_EXTENT_DATA@@ 6 � ' �
# Address ��
" Mode �
# ReserveSize ��
# CommitSize ���
# FirstRegionInformationOffset �
# ( NextHeapInformationOffset > 6 0 _HEAP_INFORMATION .?AU_HEAP_INFORMATION@@ 6 � �
Y"
�/ J � _FILE_NAMES_INFORMATION .?AU_FILE_NAMES_INFORMATION@@
6 b
" NextEntryOffset ��
" FileIndex
" FileNameLength ���
| FileName �J
6 _FILE_NAMES_INFORMATION .?AU_FILE_NAMES_INFORMATION@@ 6 � $ : � _MUILANGCFGLIST .?AU_MUILANGCFGLIST@@ : � _MUILANGCFGNODE .?AU_MUILANGCFGNODE@@
6 f
u TotalSize
! NumLanguages �
! MaxNumLanguages ��
6 LanguageConfigs ��: 6 _MUILANGCFGLIST .?AU_MUILANGCFGLIST@@ 6 K j � _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION .?AU_JOURNAL_SET_KEY_USER_FLAGS_INFORMATION@@
6 �
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
" ( OldFlags �
" , NewFlags �j 6 0 _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION .?AU_JOURNAL_SET_KEY_USER_FLAGS_INFORMATION@@ 6 � � F � _FILE_OBJECTID_BUFFER .?AU_FILE_OBJECTID_BUFFER@@ " 0 �r
p ObjectId �
p BirthVolumeId
p BirthObjectId
p 0 DomainId �
6 ExtendedInfo �F 6 @ _FILE_OBJECTID_BUFFER .?AU_FILE_OBJECTID_BUFFER@@ 6 � ~ B � _MESSAGE_TRACE_USER .?AU_MESSAGE_TRACE_USER@@
6 F � _MESSAGE_TRACE_HEADER .?AU_MESSAGE_TRACE_HEADER@@ n
"6 MessageHeader
MessageGuid ��
" MessageFlags �
" DataSize �
# Data �B #6 ( _MESSAGE_TRACE_USER .?AU_MESSAGE_TRACE_USER@@ $6 c � Z � DISPLAYCONFIG_PATH_SOURCE_INFO .?AUDISPLAYCONFIG_PATH_SOURCE_INFO@@ ��
u ��
u ��
� adapterId
u id ���
u modeInfoIdx ��
'6 cloneGroupId �
(6 sourceModeInfoIdx
u statusFlags ��Z )6 DISPLAYCONFIG_PATH_SOURCE_INFO .?AUDISPLAYCONFIG_PATH_SOURCE_INFO@@ �� *6 � � : � tagTITLEBARINFO .?AUtagTITLEBARINFO@@ B
" cbSize ���
! rcTitleBar ���
� rgstate ��: -6 , tagTITLEBARINFO .?AUtagTITLEBARINFO@@ .6 9 R � _EVENTLOG_FULL_INFORMATION .?AU_EVENTLOG_FULL_INFORMATION@@ ��
06
" dwFull ���R 26 _EVENTLOG_FULL_INFORMATION .?AU_EVENTLOG_FULL_INFORMATION@@ �� 36 o � B � PPM_WMI_PERF_STATES .?AUPPM_WMI_PERF_STATES@@
56 B � PPM_WMI_PERF_STATE .?AUPPM_WMI_PERF_STATE@@ �� 76 " @ ��
" Count
" MaxFrequency �
" CurrentState �
" MaxPerfState �
" MinPerfState �
" LowestPerfState ��
" ThermalConstraint
BusyAdjThreshold �
PolicyType ���
Type �
Reserved �
" TimerInterval
# ( TargetProcessors �
" 0 PStateHandler
" 4 PStateContext
" 8 TStateHandler
" < TStateContext
" @ FeedbackHandler ��
" D Reserved1
# H Reserved2
86 P State B 96 � PPM_WMI_PERF_STATES .?AUPPM_WMI_PERF_STATES@@ :6 x � ^ � _LEARNING_MODE_OBJECT_INFORMATION .?AU_LEARNING_MODE_OBJECT_INFORMATION@@ �
V ListEntry
LogLevel �
v ObjectType ���
v ObjectName ���
RootDirectory
( FullObjectName ���^ =6 8 _LEARNING_MODE_OBJECT_INFORMATION .?AU_LEARNING_MODE_OBJECT_INFORMATION@@ >6 � �
' B � tagEMRSELECTOBJECT .?AUtagEMRSELECTOBJECT@@ ��
A6 &
� emr ��
" ihObject �B C6 tagEMRSELECTOBJECT .?AUtagEMRSELECTOBJECT@@ �� D6 � �
N � _EVENT_BASIC_INFORMATION .?AU_EVENT_BASIC_INFORMATION@@ ��.
�* EventType
EventState ���N H6 _EVENT_BASIC_INFORMATION .?AU_EVENT_BASIC_INFORMATION@@ �� I6 � i B � tagWINDOWPLACEMENT .?AUtagWINDOWPLACEMENT@@ ��
u length ���
u flags
u showCmd ��
� ptMinPosition
� ptMaxPosition
! rcNormalPosition �B L6 , tagWINDOWPLACEMENT .?AUtagWINDOWPLACEMENT@@ �� M6 � F � _EXCEPTION_DEBUG_INFO .?AU_EXCEPTION_DEBUG_INFO@@ 6
� ExceptionRecord ��
" � dwFirstChance F P6 � _EXCEPTION_DEBUG_INFO .?AU_EXCEPTION_DEBUG_INFO@@ Q6 � 0 R IgnoreError �� NormalError �� SevereError �� CriticalError F t S6 _CM_ERROR_CONTROL_TYPE .?AW4_CM_ERROR_CONTROL_TYPE@@ ��� T6 �
t unused ���& V6 HDC__ .?AUHDC__@@ W6 t P
� # �
[6 f � _EVENT_TRACE_TIME_PROFILE_INFORMATION .?AU_EVENT_TRACE_TIME_PROFILE_INFORMATION@@
]6 F
@ EventTraceInformationClass ���
" ProfileInterval ��f _6 _EVENT_TRACE_TIME_PROFILE_INFORMATION .?AU_EVENT_TRACE_TIME_PROFILE_INFORMATION@@ `6 A � ^ � _PROCESS_HANDLE_TRACING_ENABLE_EX .?AU_PROCESS_HANDLE_TRACING_ENABLE_EX@@ *
" Flags
" TotalSlots ���^ c6 _PROCESS_HANDLE_TRACING_ENABLE_EX .?AU_PROCESS_HANDLE_TRACING_ENABLE_EX@@ d6 ? B 2 � _CONTEXT_EX .?AU_CONTEXT_EX@@
f6 :
�' All ��
�' Legacy ���
�' XState ���2 h6 _CONTEXT_EX .?AU_CONTEXT_EX@@ i6 L `
� b � _SYSTEM_SESSION_POOLTAG_INFORMATION .?AU_SYSTEM_SESSION_POOLTAG_INFORMATION@@ � " ( �V
# NextEntryOffset ��
" SessionId
" Count
m6 TagInfo ��b n6 8 _SYSTEM_SESSION_POOLTAG_INFORMATION .?AU_SYSTEM_SESSION_POOLTAG_INFORMATION@@ o6 � �
J � _PROCESSOR_POWER_POLICY .?AU_PROCESSOR_POWER_POLICY@@
" ��
" �� �- " < �
" Revision �
DynamicThrottle ��
- Spare
r6 DisableCStates ���
s6 Reserved �
" PolicyCount ��
t6 Policy ���J u6 L _PROCESSOR_POWER_POLICY .?AU_PROCESSOR_POWER_POLICY@@ v6 x j
w F � tagCBTACTIVATESTRUCT .?AUtagCBTACTIVATESTRUCT@@ ��
y6 .
t fMouse ���
� hWndActive ���F {6 tagCBTACTIVATESTRUCT .?AUtagCBTACTIVATESTRUCT@@ �� |6 m
%2 J � _IMAGE_OPTIONAL_HEADER .?AU_IMAGE_OPTIONAL_HEADER@@ ��
6 f
! Magic
MajorLinkerVersion ���
MinorLinkerVersion ���
" SizeOfCode ���
" SizeOfInitializedData
" SizeOfUninitializedData ��
" AddressOfEntryPoint ��
" BaseOfCode ���
" BaseOfData ���
" ImageBase
" SectionAlignment �
" $ FileAlignment
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
! , MajorImageVersion
! . MinorImageVersion
! 0 MajorSubsystemVersion
! 2 MinorSubsystemVersion
" 4 Win32VersionValue
" 8 SizeOfImage ��
" < SizeOfHeaders
" @ CheckSum �
! D Subsystem
! F DllCharacteristics ���
" H SizeOfStackReserve ���
" L SizeOfStackCommit
" P SizeOfHeapReserve
" T SizeOfHeapCommit �
" X LoaderFlags ��
" \ NumberOfRvaAndSizes ��
@1 ` DataDirectory J �6 � _IMAGE_OPTIONAL_HEADER .?AU_IMAGE_OPTIONAL_HEADER@@ �� �6 � J � _SYSTEM_PREFETCH_STATS .?AU_SYSTEM_PREFETCH_STATS@@ ��
" DemandFilePageCount ��
" DemandFileIOCount
" TrickleFilePageCount �
" TrickleFileIOCount ���
" DemandPrivatePageCount ���
" DemandPrivateIOCount �
" TricklePrivatePageCount ��
" TricklePrivateIOCount J �6 _SYSTEM_PREFETCH_STATS .?AU_SYSTEM_PREFETCH_STATS@@ �� �6 � �
b � _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE .?AU_PERFINFO_PO_NOTIFY_DEVICE_COMPLETE@@
�6 &
Irp ��
Status ���b �6 _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE .?AU_PERFINFO_PO_NOTIFY_DEVICE_COMPLETE@@ �6 c �
./ .
" CheckSum �
" TimeDateStamp F �6 _HOT_PATCH_IMAGE_INFO .?AU_HOT_PATCH_IMAGE_INFO@@ �6 t E
�+ �
" dwScope ��
" dwType ���
" dwDisplayType
" dwUsage ��
q lpLocalName ��
q lpRemoteName �
q lpComment
q ( lpProvider ���6 �6 0 _NETRESOURCEW .?AU_NETRESOURCEW@@ �6 � n f � _SYSTEM_DMA_GUARD_POLICY_INFORMATION .?AU_SYSTEM_DMA_GUARD_POLICY_INFORMATION@@ ��
�6 "
DmaGuardPolicyEnabled f �6 _SYSTEM_DMA_GUARD_POLICY_INFORMATION .?AU_SYSTEM_DMA_GUARD_POLICY_INFORMATION@@ �� �6 � > j � _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA .?AU_SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA@@ ��
A >
�6 ProcessorProfileControlArea ��
Allocate �j �6 _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA .?AU_SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA@@ �� �6 � � &
PID ��
KeyName ��6 �6 KEY_PID_ARRAY .?AUKEY_PID_ARRAY@@ �6 � o J � _POWER_SESSION_WINLOGON .?AU_POWER_SESSION_WINLOGON@@ >
" SessionId
Console ��
Locked ���J �6 _POWER_SESSION_WINLOGON .?AU_POWER_SESSION_WINLOGON@@ �6 x � k(
�6
a p t �6
�6 > � _SECTIONBASICINFO .?AU_SECTIONBASICINFO@@ R
BaseAddress ��
" AllocationAttributes �
� MaximumSize ��> �6 _SECTIONBASICINFO .?AU_SECTIONBASICINFO@@ �6 t i > � _SCRUB_DATA_INPUT .?AU_SCRUB_DATA_INPUT@@ " " d � " 0 �z
" Size �
" Flags
" MaximumIos ���
� ObjectId �
�6 Reserved �
�6 � ResumeContext > �6 �_SCRUB_DATA_INPUT .?AU_SCRUB_DATA_INPUT@@ �6 � �&
�' Z PT_POINTER ��� PT_TOUCH � PT_PEN ��� PT_MOUSE � PT_TOUCHPAD ��B t �6 tagPOINTER_INPUT_TYPE .?AW4tagPOINTER_INPUT_TYPE@@ � �6 x j � _HEAP_PERFORMANCE_COUNTERS_INFORMATION .?AU_HEAP_PERFORMANCE_COUNTERS_INFORMATION@@ ��
�6 v � _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION .?AU_SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION@@ �
" Size �
" Version ��
" HeapIndex
" LastHeapIndex
# BaseAddress ��
# ReserveSize ��
# CommitSize ���
" ( SegmentCount �
# 0 LargeUCRMemory ���
" 8 UCRLength
# @ AllocatedSpace ���
# H FreeSpace
" P FreeListLength ���
" T Contention ���
" X VirtualBlocks
" \ CommitRate ���
" ` DecommitRate �
�6 h SegmentHeapPerfInformation ���j �6 � _HEAP_PERFORMANCE_COUNTERS_INFORMATION .?AU_HEAP_PERFORMANCE_COUNTERS_INFORMATION@@ �� �6 �
v' J- " �n
# NextOffset ���
# NumSDEntriesReturned �
# NumSDBytesReturned ���
�6 SDEntry ��B �6 0 _SD_ENUM_SDS_OUTPUT .?AU_SD_ENUM_SDS_OUTPUT@@ �6 � @ j � DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS@@ ��
u ��
u ��
u ��
u ��~
�6 friendlyNameFromEdid �
�6 friendlyNameForced ���
�6 edidIdsValid �
�6 reserved �
u value j �6 DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS@@ �� �6 � �
� F � _PROCESS_ACCESS_TOKEN .?AU_PROCESS_ACCESS_TOKEN@@ &
Token
Thread ���F �6 _PROCESS_ACCESS_TOKEN .?AU_PROCESS_ACCESS_TOKEN@@ �6 ? � f � _SYSTEM_ELAM_CERTIFICATE_INFORMATION .?AU_SYSTEM_ELAM_CERTIFICATE_INFORMATION@@ ��
�6
ElamDriverFile ���f �6 _SYSTEM_ELAM_CERTIFICATE_INFORMATION .?AU_SYSTEM_ELAM_CERTIFICATE_INFORMATION@@ �� �6 � '
�
�$ � FixedWakeSourcePowerButton ��� FixedWakeSourceSleepButton ��� FixedWakeSourceRtc ��� FixedWakeSourceDozeToHibernate ���J t �6 PO_FIXED_WAKE_SOURCE_TYPE .?AW4PO_FIXED_WAKE_SOURCE_TYPE@@ � �6 x
^
" RecordLength �
! MajorVersion �
! MinorVersion �
# FileReferenceNumber ��
# ParentFileReferenceNumber
Usn ��
� TimeStamp
" ( Reason ���
" , SourceInfo ���
" 0 SecurityId ���
" 4 FileAttributes ���
! 8 FileNameLength ���
! : FileNameOffset ���
| < FileName �6 �6 @ USN_RECORD_V2 .?AUUSN_RECORD_V2@@ �6 � s 6 � _TOKEN_SOURCE .?AU_TOKEN_SOURCE@@
�6 p " �6
�6 SourceName ���
� SourceIdentifier �6 �6 _TOKEN_SOURCE .?AU_TOKEN_SOURCE@@ �6 x � . � _TP_WAIT .?AU_TP_WAIT@@ �� " " �6
�6 � VirtualStorageBehaviorUndefined �� VirtualStorageBehaviorCacheWriteThrough �� VirtualStorageBehaviorCacheWriteBack �V t �6 _VIRTUAL_STORAGE_BEHAVIOR_CODE .?AW4_VIRTUAL_STORAGE_BEHAVIOR_CODE@@ ��� �6 � �! > � _HARDWARE_COUNTER .?AU_HARDWARE_COUNTER@@ 6
� Type �
" Reserved �
# Index > �6 _HARDWARE_COUNTER .?AU_HARDWARE_COUNTER@@ �6 ? n � _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION@@ ��
" ��
" ��
" ��
" ��~
" Flags
�6 Locked ���
�6 UnlockApplied
�6 UnlockIdValid
�6 Reserved �
� UnlockId �n �6 $ _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION@@ �� �6 � �
J � _RPC_SECURITY_QOS_V3_A .?AU_RPC_SECURITY_QOS_V3_A@@ ��
r. HttpCredentials ��2 �6 <anonymous-tag> .?AT<anonymous-tag>@@ �6 _ ; �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
�6 u
Sid ��J �6 ( _RPC_SECURITY_QOS_V3_A .?AU_RPC_SECURITY_QOS_V3_A@@ �� �6 _ 4 f � _FILE_IOSTATUSBLOCK_RANGE_INFORMATION .?AU_FILE_IOSTATUSBLOCK_RANGE_INFORMATION@@
7 6
IoStatusBlockRange ���
" Length ���f 7 _FILE_IOSTATUSBLOCK_RANGE_INFORMATION .?AU_FILE_IOSTATUSBLOCK_RANGE_INFORMATION@@ 7 � � : � tagEMRSETPIXELV .?AUtagEMRSETPIXELV@@ :
� emr ��
� ptlPixel �
" crColor ��: 7 tagEMRSETPIXELV .?AUtagEMRSETPIXELV@@ 7 � F � _LOGICAL_DISK_DEFRAG .?AU_LOGICAL_DISK_DEFRAG@@ ��
# AlignmentClusters
# AvgFreeSpaceSize �
# ClustersPerSlab ��
# FragmentedDirectoryExtents ���
# FragmentedExtents
# ( FreeSpaceCount ���
# 0 LargestFreeSpaceSize �
# 8 LastRunActualPurgeClusters ���
# @ LastRunClustersTrimmed ���
# H LastRunFullDefragTime
# P LastRunTime ��
# X MFTSize ��
# ` TotalClusters
# h TotalUsedClusters
" p AvgFragmentsPerFile ��
" t BytesPerCluster ��
" x DirectoryCount ���
" | FragmentedDirectories
" � FragmentedFiles ��
" � FragmentedSpace ��
" � HardwareIssue
" � InUseMFTRecords ��
" � InUseSlabs ���
" � LastRunActualPurgeSlabs ��
" � LastRunInitialBackedSlabs
" � LastRunPercentFragmentation ��
" � LastRunPinnedSlabs ���
" � LastRunPotentialPurgeSlabs ���
" � LastRunSpaceInefficientSlabs �
" � LastRunTrimmedSlabs ��
" � LastRunUnknownEvictFailSlabs �
" � LastRunVolsnapPinnedSlabs
" � MFTFragmentCount �
" � MovableFiles �
" � TotalMFTRecords ��
" � TotalSlabs ���
" � UnmovableFiles ���
� VolumeId �
| � VolumePathNames ��F '
7 � _LOGICAL_DISK_DEFRAG .?AU_LOGICAL_DISK_DEFRAG@@ �� 7 c V � _KEY_VALUE_BASIC_INFORMATION .?AU_KEY_VALUE_BASIC_INFORMATION@@ ��R
" TitleIndex ���
" Type �
" NameLength ���
| Name �V 7 _KEY_VALUE_BASIC_INFORMATION .?AU_KEY_VALUE_BASIC_INFORMATION@@ �� 7 H > � _FILE_LEVEL_TRIM .?AU_FILE_LEVEL_TRIM@@ ��
7 �1 " �:
" Key ��
" NumRanges
7 Ranges ���> 7 _FILE_LEVEL_TRIM .?AU_FILE_LEVEL_TRIM@@ �� 7 � L B
# ReserveSize ��
# ZeroBits �
StackBase f 7 _PROCESS_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_STACK_ALLOCATION_INFORMATION@@ 7 � � v � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE@@ ��
MaxIops ��
MaxBandwidth �
ReservationIops ��
q VolumeName ���
" BaseIoSize ���
0 $ ControlFlags �
! ( VolumeNameLength �v 7 0 JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE@@ �� 7 ? _
L/
5 > � _MUILANGLISTNODE .?AU_MUILANGLISTNODE@@ ��F
! LanguageType �
! Reserved �
LanguageSpec �> !7 _MUILANGLISTNODE .?AU_MUILANGLISTNODE@@ �� "7 T V � _FILE_FS_OBJECTID_INFORMATION .?AU_FILE_FS_OBJECTID_INFORMATION@@
$7 .
p ObjectId �
6 ExtendedInfo �V &7 @ _FILE_FS_OBJECTID_INFORMATION .?AU_FILE_FS_OBJECTID_INFORMATION@@ '7 � �
6. * XLAT_SERVER �� XLAT_CLIENT ��* t *7 XLAT_SIDE .?AW4XLAT_SIDE@@ � +7 � � b
RefIdToPointer ���
PointerToRefId ���
" NextRefId
+7 XlatSide �F -7 _FULL_PTR_XLAT_TABLES .?AU_FULL_PTR_XLAT_TABLES@@ .7 � �
:
�
�
� �
" Size �
" InitialPc
StackBase
StackLimit ���
DeallocationStack
" LogFlags �
" InitialSp
SimulationCount ��
InCpuSimulation ��
EmulateInitialPc �
Initialized ��
07 ExceptionList
$ CpuContext ���
17 ( InitialExceptionContext ��
, pCallersRIID �
0 pCallersUnknown ��
" 4 Flags
8 SelfRegDllName ���
< SelfRegDllHandle �. 27 @ _Wx86TIB .?AU_Wx86TIB@@ �� 37 � �
�(
�& . � _FPO_DATA .?AU_FPO_DATA@@
! ��
! ��
! ��
! ��
!
��
! ���
" ulOffStart ���
" cbProcSize ���
" cdwLocals
! cdwParams
87 cbProlog �
97 cbRegs ���
:7 fHasSEH ��
;7 fUseBP ���
<7 reserved �
=7 cbFrame ��.
>7 _FPO_DATA .?AU_FPO_DATA@@ ?7 � � Z � _RPC_BINDING_HANDLE_OPTIONS_V1 .?AU_RPC_BINDING_HANDLE_OPTIONS_V1@@ ��
A7 V
" Version ��
" Flags
" ComTimeout ���
" CallTimeout ��Z C7 _RPC_BINDING_HANDLE_OPTIONS_V1 .?AU_RPC_BINDING_HANDLE_OPTIONS_V1@@ �� D7 _ (
> 6 � _QUOTA_LIMITS .?AU_QUOTA_LIMITS@@ �
# PagedPoolLimit ���
# NonPagedPoolLimit
# MinimumWorkingSetSize
# MaximumWorkingSetSize
# PagefileLimit
� ( TimeLimit 6 H7 0 _QUOTA_LIMITS .?AU_QUOTA_LIMITS@@ I7 ? � R � _QUERY_SERVICE_LOCK_STATUSA .?AU_QUERY_SERVICE_LOCK_STATUSA@@
K7 J
" fIsLocked
p lpLockOwner ��
" dwLockDuration ���R M7 _QUERY_SERVICE_LOCK_STATUSA .?AU_QUERY_SERVICE_LOCK_STATUSA@@ N7 �
�
� : � tagEXTLOGFONTA .?AUtagEXTLOGFONTA@@ ���
elfLogFont ���
�+ < elfFullName ��
� | elfStyle �
" � elfVersion ���
" � elfStyleSize �
" � elfMatch �
" � elfReserved ��
�* � elfVendorId ��
" � elfCulture ���
� elfPanose :
S7 � tagEXTLOGFONTA .?AUtagEXTLOGFONTA@@ �� T7 � j � _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES@@ ��v
" Version ��
ProcessHandle
" PatchCount ���
v PatchPathStrings �
// BaseInfos j W7 ( _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES@@ �� X7 t � r � _FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX@@
Z7 .
\ StorageReserveId �
" Flags r \7 _FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX@@ ]7 � i+
82
�2 >
HeapHandle ���
Address ��
# Size �> a7 _HEAP_EVENT_RANGE .?AU_HEAP_EVENT_RANGE@@ b7 c � : � tagTTPOLYCURVE .?AUtagTTPOLYCURVE@@ �� D4 " �2
! wType
! cpfx �
e7 apfx �: f7 tagTTPOLYCURVE .?AUtagTTPOLYCURVE@@ �� g7 � �
J � _PORT_DATA_INFORMATION .?AU_PORT_DATA_INFORMATION@@ ��> � _PORT_DATA_ENTRY .?AU_PORT_DATA_ENTRY@@ �� j7 " �6
" CountDataEntries �
k7 DataEntries ��J l7 _PORT_DATA_INFORMATION .?AU_PORT_DATA_INFORMATION@@ �� m7 � [
>4 Z � _WMI_JOB_SET_QUERY_INFORMATION .?AU_WMI_JOB_SET_QUERY_INFORMATION@@ ��N
ContainerId ��
" JobId
" JobObjectInformationClass Z q7 _WMI_JOB_SET_QUERY_INFORMATION .?AU_WMI_JOB_SET_QUERY_INFORMATION@@ �� r7 c � J � _FILE_ID_EXTD_DIR_INFO .?AU_FILE_ID_EXTD_DIR_INFO@@ ��V
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
" D ReparsePointTag ��
n H FileId ���
| X FileName �J u7 ` _FILE_ID_EXTD_DIR_INFO .?AU_FILE_ID_EXTD_DIR_INFO@@ �� v7 o .# 2 HANDEDNESS_LEFT �� HANDEDNESS_RIGHT �2 t x7 tagHANDEDNESS .?AW4tagHANDEDNESS@@ � y7 �1
y7 v � _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION .?AU_SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION@@ >
FileHandle ���
" ImageSize
Image v }7 _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION .?AU_SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION@@ ~7 � 4 A ! A �7
f& : � tagMONITORINFO .?AUtagMONITORINFO@@ ��R
" cbSize ���
! rcMonitor
! rcWork ���
" $ dwFlags ��: �7 ( tagMONITORINFO .?AUtagMONITORINFO@@ �� �7 �4 � MemSectionExtendedParameterInvalidType ��� MemSectionExtendedParameterUserPhysicalFlags � MemSectionExtendedParameterNumaNode �� MemSectionExtendedParameterMax ���^ t �7 MEM_SECTION_EXTENDED_PARAMETER_TYPE .?AW4MEM_SECTION_EXTENDED_PARAMETER_TYPE@@ � �7 � & V � _OBJECT_DIRECTORY_INFORMATION .?AU_OBJECT_DIRECTORY_INFORMATION@@ &
Name �
TypeName �V �7 _OBJECT_DIRECTORY_INFORMATION .?AU_OBJECT_DIRECTORY_INFORMATION@@ �7 2 � " " �7
�7 � � _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@
Ssp �� �7 _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@ �7 � V � _PERFINFO_MEMORY_INFORMATION .?AU_PERFINFO_MEMORY_INFORMATION@@ ���
# ZeroPageCount
# FreePageCount
# ModifiedPageCount
# ModifiedNoWritePageCount �
# BadPageCount �
l, ( PageCountByPriority ��
l, h RepurposedPagesByPriority
# � ModifiedPageCountPageFile V �7 � _PERFINFO_MEMORY_INFORMATION .?AU_PERFINFO_MEMORY_INFORMATION@@ �� �7 c �
� �
" Latency ��
" Power
" TimeCheck
PromotePercent ���
DemotePercent
StateType
Reserved �
" StateFlags ���
" Context ��
" IdleHandler ��
" Reserved1 B �7 PPM_WMI_IDLE_STATE .?AUPPM_WMI_IDLE_STATE@@ �� �7 x � B � tagIMECHARPOSITION .?AUtagIMECHARPOSITION@@ ��
�7 j
" dwSize ���
" dwCharPos
� pt ���
u cLineHeight ��
! rcDocument ���B �7 $ tagIMECHARPOSITION .?AUtagIMECHARPOSITION@@ �� �7 � � : � _RTL_RXACT_LOG .?AU_RTL_RXACT_LOG@@ ��^
" OperationCount ���
" LogSize ��
" LogSizeInUse �
" Alignment : �7 _RTL_RXACT_LOG .?AU_RTL_RXACT_LOG@@ �� �7 � � "
" iType
" nSize * �7 tagEMR .?AUtagEMR@@ �� �7 � > N � _POWER_SESSION_RIT_STATE .?AU_POWER_SESSION_RIT_STATE@@ ��.
Active ���
" LastInputTime N �7 _POWER_SESSION_RIT_STATE .?AU_POWER_SESSION_RIT_STATE@@ �� �7 x �
" HeaderSize ���
" TotalSize
" QuerySequence
" OptionsOffset
" OptionsSize ��
" StatsOffset ��
" StatsSize
" SamplesOffset
" SampleCount ��
" $ ModulesOffset
" ( ModuleCount ��R �7 , _ETW_COVERAGE_SAMPLER_DATA .?AU_ETW_COVERAGE_SAMPLER_DATA@@ �� �7 A N : � _ETW_POOL_EVENT .?AU_ETW_POOL_EVENT@@ N
" PoolType �
" Tag ��
# NumberOfBytes
Entry : �7 _ETW_POOL_EVENT .?AU_ETW_POOL_EVENT@@ �7 c @
6 � _TIME_FIELDS .?AU_TIME_FIELDS@@ ��
Year �
Month
Day ��
Hour �
Minute ���
Second ���
Milliseconds �
Weekday ��6 �7 _TIME_FIELDS .?AU_TIME_FIELDS@@ �� �7 b a F � _UNICODE_PREFIX_TABLE .?AU_UNICODE_PREFIX_TABLE@@
� f
NodeTypeCode �
NameLength ���
�7 NextPrefixTree ���
�7 LastNextEntry F �7 _UNICODE_PREFIX_TABLE .?AU_UNICODE_PREFIX_TABLE@@ �7 b \
o4 B � _MENU_EVENT_RECORD .?AU_MENU_EVENT_RECORD@@ ��
�7
u dwCommandId ��B �7 _MENU_EVENT_RECORD .?AU_MENU_EVENT_RECORD@@ �� �7 � r . � HWINSTA__ .?AUHWINSTA__@@
t unused ���. �7 HWINSTA__ .?AUHWINSTA__@@ �7 �' B � _PS_MEMORY_RESERVE .?AU_PS_MEMORY_RESERVE@@ ��
�7 6
ReserveAddress ���
# ReserveSize ��B �7 _PS_MEMORY_RESERVE .?AU_PS_MEMORY_RESERVE@@ �� �7 � $ F � tagWNODE_METHOD_ITEM .?AUtagWNODE_METHOD_ITEM@@ ��
� WnodeHeader ��
" 0 OffsetInstanceName ���
" 4 InstanceIndex
" 8 MethodId �
" < DataBlockOffset ��
" @ SizeDataBlock
� D VariableData �F �7 H tagWNODE_METHOD_ITEM .?AUtagWNODE_METHOD_ITEM@@ �� �7 � �
'3 ^ ^ �7
i7 V � _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES .?AT_SYSDBG_LIVEDUMP_CONTROL_ADDPAGES@@
" ��
" ��F
�7 HypervisorPages ��
�7 Reserved �
" AsUlong ��V �7 _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES .?AT_SYSDBG_LIVEDUMP_CONTROL_ADDPAGES@@ �7 � d
�- N � _PS_SYSTEM_DLL_INIT_BLOCK .?AU_PS_SYSTEM_DLL_INIT_BLOCK@@ # " � �
" ��
" ��z
" Size �
# SystemDllWowRelocation ���
# SystemDllNativeRelocation
�7 Wow64SharedInformation ���
" � RngData ��
" � Flags
�7 � CfgOverride ��
�7 � Reserved �
� � MitigationOptionsMap �
# � CfgBitMap
# � CfgBitMapSize
# � Wow64CfgBitMap ���
# � Wow64CfgBitMapSize ���
� � MitigationAuditOptionsMap N �7 � _PS_SYSTEM_DLL_INIT_BLOCK .?AU_PS_SYSTEM_DLL_INIT_BLOCK@@ �7 � @
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ���
" Flags
�7 EnableExportAddressFilter
�7 AuditExportAddressFilter �
�7 EnableExportAddressFilterPlus
�7 AuditExportAddressFilterPlus �
�7 EnableImportAddressFilter
�7 AuditImportAddressFilter �
�7 EnableRopStackPivot ��
�7 AuditRopStackPivot ���
�7 EnableRopCallerCheck �
�7 AuditRopCallerCheck ��
�7 EnableRopSimExec �
�7 AuditRopSimExec ��
�7 ReservedFlags z �7 _PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ �� �7 ? �
� � SystemActivityModerationAppTypeClassic ��� SystemActivityModerationAppTypePackaged �� MaxSystemActivityModerationAppType ���b t �7 _SYSTEM_ACTIVITY_MODERATION_APP_TYPE .?AW4_SYSTEM_ACTIVITY_MODERATION_APP_TYPE@@ ��� �7 � $
�7 J � _THREAD_TEB_INFORMATION .?AU_THREAD_TEB_INFORMATION@@ J
TebInformation ���
" TebOffset
" BytesToRead ��J �7 _THREAD_TEB_INFORMATION .?AU_THREAD_TEB_INFORMATION@@ �7 � � J � _EVENT_TRACE_PROPERTIES .?AU_EVENT_TRACE_PROPERTIES@@ �
� Wnode
" 0 BufferSize ���
" 4 MinimumBuffers ���
" 8 MaximumBuffers ���
" < MaximumFileSize ��
" @ LogFileMode ��
" D FlushTimer ���
" H EnableFlags ��
L AgeLimit �
L FlushThreshold ���
" P NumberOfBuffers ��
" T FreeBuffers ��
" X EventsLost ���
" \ BuffersWritten ���
" ` LogBuffersLost ���
" d RealTimeBuffersLost ��
h LoggerThreadId ���
" p LogFileNameOffset
" t LoggerNameOffset �J �7 x _EVENT_TRACE_PROPERTIES .?AU_EVENT_TRACE_PROPERTIES@@ �7 � ^ � u # " 8
8
. R � _PERFINFO_PROCESS_PERFCTR32 .?AU_PERFINFO_PROCESS_PERFCTR32@@ �
" ProcessId
" PageFaultCount ���
" HandleCount ��
" Reserved �
u PeakVirtualSize ��
u PeakWorkingSetSize ���
u PeakPagefileUsage
u QuotaPeakPagedPoolUsage ��
u QuotaPeakNonPagedPoolUsage ���
u $ VirtualSize ��
u ( WorkingSetSize ���
u , PagefileUsage
u 0 QuotaPagedPoolUsage ��
u 4 QuotaNonPagedPoolUsage ���
u 8 PrivatePageCount �R 8 < _PERFINFO_PROCESS_PERFCTR32 .?AU_PERFINFO_PROCESS_PERFCTR32@@ 8 c �
m!
�
��
��
��
��
��r
8 Interrupt
8 Reserved �
8 LevelTriggered ���
8 Shared ���
8 MoreEntries ��F 8 _EISA_IRQ_DESCRIPTOR .?AU_EISA_IRQ_DESCRIPTOR@@ �� 8 � n PdataCrUnchained � PdataCrUnchainedSavedLr �� PdataCrChainedWithPac PdataCrChained ���: t 8 ARM64_FNPDATA_CR .?AW4ARM64_FNPDATA_CR@@ ��� 8 � N � _SYSDBG_LIVEDUMP_CONTROL .?AU_SYSDBG_LIVEDUMP_CONTROL@@ ��
" Version ��
" BugCheckCode �
# BugCheckParam1 ���
# BugCheckParam2 ���
# BugCheckParam3 ���
# BugCheckParam4 ���
( DumpFileHandle ���
0 CancelEventHandle
�- 8 Flags
�7 < AddPagesControl ��N
8 @ _SYSDBG_LIVEDUMP_CONTROL .?AU_SYSDBG_LIVEDUMP_CONTROL@@ �� 8 � v
�( R � _IMAGE_DYNAMIC_RELOCATION64 .?AU_IMAGE_DYNAMIC_RELOCATION64@@
8 .
# Symbol ���
" BaseRelocSize R 8 _IMAGE_DYNAMIC_RELOCATION64 .?AU_IMAGE_DYNAMIC_RELOCATION64@@ 8 � � J � _ENCLAVE_INIT_INFO_SGX .?AU_ENCLAVE_INIT_INFO_SGX@@ �� " � " � � " 0 � " � �V
8 SigStruct
!8 Reserved1
"8 EInitToken ���
#8 0 Reserved2 J $8 _ENCLAVE_INIT_INFO_SGX .?AU_ENCLAVE_INIT_INFO_SGX@@ �� %8 � � r � _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600@@
" Size �
" DataFormatVersion
Data �
" Length ���
SectionGlobalData
" SectionGlobalDataLength ��
( SectionBase ��
" 0 SectionTotalLength ���
�! 8 ActivationContext
" @ AssemblyRosterIndex ��
" D Flags r (8 H _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600@@ )8 � � N � _FILE_NOTIFY_INFORMATION .?AU_FILE_NOTIFY_INFORMATION@@ ��
+8 b
" NextEntryOffset ��
" Action ���
" FileNameLength ���
| FileName �N -8 _FILE_NOTIFY_INFORMATION .?AU_FILE_NOTIFY_INFORMATION@@ �� .8 � 8 2
SyntaxGUID ���
�& SyntaxVersion J 08 _RPC_SYNTAX_IDENTIFIER .?AU_RPC_SYNTAX_IDENTIFIER@@ �� 18 7 .
� r
Enable ���
- Spare
" BatteryLevel �
� PowerPolicy ��
� MinSystemState ���B 48 SYSTEM_POWER_LEVEL .?AUSYSTEM_POWER_LEVEL@@ �� 58 x �
R � _WINDOW_BUFFER_SIZE_RECORD .?AU_WINDOW_BUFFER_SIZE_RECORD@@ ��
�" dwSize ���R 88 _WINDOW_BUFFER_SIZE_RECORD .?AU_WINDOW_BUFFER_SIZE_RECORD@@ �� 98 � n Z � _SYSTEM_LEAP_SECOND_INFORMATION .?AU_SYSTEM_LEAP_SECOND_INFORMATION@@ &
Enabled ��
" Flags Z <8 _SYSTEM_LEAP_SECOND_INFORMATION .?AU_SYSTEM_LEAP_SECOND_INFORMATION@@ =8 � �
! t ?8 > � _IMAGE_AUX_SYMBOL_EX .?AT_IMAGE_AUX_SYMBOL_EX@@ ��
A8 ��
B8 V
" WeakDefaultSymIndex ��
" WeakSearchType ���
q rgbReserved ��: D8 <anonymous-tag> .?AU<anonymous-tag>@@ E8 � =
� Name �: G8 <anonymous-tag> .?AU<anonymous-tag>@@ H8 � B �
" Length ���
! NumberOfRelocations ��
! NumberOfLinenumbers ��
" CheckSum �
Number ���
Selection
bReserved
HighNumber ���
� rgbReserved ��: J8 <anonymous-tag> .?AU<anonymous-tag>@@ K8 � E *
" crc ��
p rgbReserved ��: M8 <anonymous-tag> .?AU<anonymous-tag>@@ N8 � T r
E8 Sym ��
H8 File �
K8 Section ��
w$ TokenDef �
� rgbReserved ��
N8 CRC ��> P8 _IMAGE_AUX_SYMBOL_EX .?AT_IMAGE_AUX_SYMBOL_EX@@ �� Q8 � < : � _DISCDLGSTRUCTW .?AU_DISCDLGSTRUCTW@@ r
" cbStructure ��
� hwndOwner
q lpLocalName ��
q lpRemoteName �
" dwFlags ��: T8 ( _DISCDLGSTRUCTW .?AU_DISCDLGSTRUCTW@@ U8 � � j � _STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER .?AU_STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER@@ n
" OptimalWriteSize �
" StreamGranularitySize
" StreamIdMin ��
" StreamIdMax ��j X8 _STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER .?AU_STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER@@ Y8 � � : � tagSOUNDSENTRYW .?AUtagSOUNDSENTRYW@@
[8 R
u cbSize ���
" dwFlags ��
" iFSTextEffect
" iFSTextEffectMSec
" iFSTextEffectColorBits ���
" iFSGrafEffect
" iFSGrafEffectMSec
" iFSGrafEffectColor ���
" iWindowsEffect ���
" $ iWindowsEffectMSec ���
q ( lpszWindowsEffectDLL �
" 0 iWindowsEffectOrdinal : ]8 8 tagSOUNDSENTRYW .?AUtagSOUNDSENTRYW@@ ^8 ,4 Z � _WMI_DISKIO_IO_REDIRECTED_INIT .?AU_WMI_DISKIO_IO_REDIRECTED_INIT@@ ��
`8 &
Irp ��
FileKey ��Z b8 _WMI_DISKIO_IO_REDIRECTED_INIT .?AU_WMI_DISKIO_IO_REDIRECTED_INIT@@ �� c8 c � 6 � tagALTTABINFO .?AUtagALTTABINFO@@ �
" cbSize ���
t cItems ���
t cColumns �
t cRows
t iColFocus
t iRowFocus
t cxItem ���
t cyItem ���
� ptStart ��6 f8 ( tagALTTABINFO .?AUtagALTTABINFO@@ g8 �9
'8 ��
i8 Z � _WOW64_ARCHITECTURE_INFORMATION .?AU_WOW64_ARCHITECTURE_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
l8 Machine ��
m8 KernelMode ���
n8 UserMode �
o8 Native ���
p8 Process ��
q8 ReservedZero0 Z r8 _WOW64_ARCHITECTURE_INFORMATION .?AU_WOW64_ARCHITECTURE_INFORMATION@@ s8 ? r f
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType > u8 _RPC_SECURITY_QOS .?AU_RPC_SECURITY_QOS@@ v8 _ n
q x8 B � _ETW_PRIORITY_EVENT .?AU_ETW_PRIORITY_EVENT@@ v
" ThreadId �
p OldPriority ��
p NewPriority ��
p DynamicPriority ��
p Reserved �B {8 _ETW_PRIORITY_EVENT .?AU_ETW_PRIORITY_EVENT@@ |8 c
b � _SYSTEM_LOW_PRIORITY_IO_INFORMATION .?AU_SYSTEM_LOW_PRIORITY_IO_INFORMATION@@
~8 n
" LowPriReadOperations �
" LowPriWriteOperations
" KernelBumpedToNormalOperations ���
" LowPriPagingReadOperations ���
" KernelPagingReadsBumpedToNormal ��
" LowPriPagingWriteOperations ��
" KernelPagingWritesBumpedToNormal �
" BoostedIrpCount ��
" BoostedPagingIrpCount
" $ BlanketBoostCount b
�8 ( _SYSTEM_LOW_PRIORITY_IO_INFORMATION .?AU_SYSTEM_LOW_PRIORITY_IO_INFORMATION@@ �8 � �
�% Z � RTLWOW64_CROSSPROCESS_WORK_ITEM .?AURTLWOW64_CROSSPROCESS_WORK_ITEM@@ z
BaseAddress ��
# RegionSize ���
" AllocationType ���
" Protect ��
SyscallStatus : �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � � ^
BaseAddress ��
# RegionSize ���
" FreeType �
SyscallStatus : �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � � b
BaseAddress ��
# RegionSize ���
" NewProtect ���
SyscallStatus : �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � � .
BaseAddress ��
# Length ���: �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � � 2
BaseAddress ��
# RegionSize ���: �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � � �
" Next �
� Operation
�8 MemoryAllocData ��
�8 MemoryFreeData ���
�8 MemoryProtectData
�8 InstructionCacheFlushData
�8 MemoryDirtyData ��Z �8 ( RTLWOW64_CROSSPROCESS_WORK_ITEM .?AURTLWOW64_CROSSPROCESS_WORK_ITEM@@ �8 � �
�! ^ � _MEMORY_ENCLAVE_IMAGE_INFORMATION .?AU_MEMORY_ENCLAVE_IMAGE_INFORMATION@@ N � _MEMORY_IMAGE_INFORMATION .?AU_MEMORY_IMAGE_INFORMATION@@ >
�8 ImageInfo
� UniqueID �
� 8 AuthorID �^ �8 X _MEMORY_ENCLAVE_IMAGE_INFORMATION .?AU_MEMORY_ENCLAVE_IMAGE_INFORMATION@@ �8 t � b � _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_OUTPUT@@ ��R
" Offset ���
" NumberOfMatches ��
" BufferSizeRequired ���b �8 _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_OUTPUT@@ �� �8 � � B � _NTFS_STATISTICS_EX .?AU_NTFS_STATISTICS_EX@@ J
" Write
" Create ���
" SetInfo ��
" Flush : �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � � J
" Write
" Create ���
" SetInfo ��
" Flush : �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � J
" Write
" Create ���
" SetInfo ��
" Flush : �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � J
" Write
" Create ���
" SetInfo ��
" Flush : �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � , �
" Calls
" RunsReturned �
" Hints
" HintsHonored �
" Cache
" CacheMiss
# Clusters �
# HintsClusters
# ( CacheClusters
# 0 CacheMissClusters :
�8 8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � A R
" LogFileFullExceptions
" OtherExceptions ��
# MftReads �
# MftReadBytes �
# MftWrites
# MftWriteBytes
�8 ( MftWritesUserLevel ���
" 8 MftWritesFlushForLogFileFull �
" < MftWritesLazyWriter ��
" @ MftWritesUserRequest �
# H Mft2Writes ���
# P Mft2WriteBytes ���
�8 X Mft2WritesUserLevel ��
" h Mft2WritesFlushForLogFileFull
" l Mft2WritesLazyWriter �
" p Mft2WritesUserRequest
# x RootIndexReads ���
# � RootIndexReadBytes ���
# � RootIndexWrites ��
# � RootIndexWriteBytes ��
# � BitmapReads ��
# � BitmapReadBytes ��
# � BitmapWrites �
# � BitmapWriteBytes �
" � BitmapWritesFlushForLogFileFull ��
" � BitmapWritesLazyWriter ���
" � BitmapWritesUserRequest ��
�8 � BitmapWritesUserLevel
# � MftBitmapReads ���
# � MftBitmapReadBytes ���
# � MftBitmapWrites ��
# � MftBitmapWriteBytes ��
" � MftBitmapWritesFlushForLogFileFull ���
" � MftBitmapWritesLazyWriter
" MftBitmapWritesUserRequest ���
�8 MftBitmapWritesUserLevel �
# UserIndexReads ���
# UserIndexReadBytes ���
# (UserIndexWrites ��
# 0UserIndexWriteBytes ��
# 8LogFileReads �
# @LogFileReadBytes �
# HLogFileWrites
# PLogFileWriteBytes
�8 XAllocate �
" �DiskResourcesExhausted ���
# �VolumeTrimCount ��
# �VolumeTrimTime ���
# �VolumeTrimByteCount ��
# �FileLevelTrimCount ���
# �FileLevelTrimTime
# �FileLevelTrimByteCount ���
# �VolumeTrimSkippedCount ���
# �VolumeTrimSkippedByteCount ���
# �NtfsFillStatInfoFromMftRecordCalledCount �
# �NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount ���
# �NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount ��B 9 �8 �_NTFS_STATISTICS_EX .?AU_NTFS_STATISTICS_EX@@ �8 � � n � _EVENT_TRACE_SESSION_SECURITY_INFORMATION .?AU_EVENT_TRACE_SESSION_SECURITY_INFORMATION@@ �
@ EventTraceInformationClass ���
" SecurityInformation ��
# TraceHandle ��
� SecurityDescriptor ���n �8 _EVENT_TRACE_SESSION_SECURITY_INFORMATION .?AU_EVENT_TRACE_SESSION_SECURITY_INFORMATION@@ �8 A � " �8 > � tagEMRSTRETCHBLT .?AUtagEMRSTRETCHBLT@@ ��R
� emr ��
d rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
J 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d cxSrc
h cySrc > �8 l tagEMRSTRETCHBLT .?AUtagEMRSTRETCHBLT@@ �� �8 � �
A J � _HARDWARE_COUNTER_DATA .?AU_HARDWARE_COUNTER_DATA@@ ��
�8 6
� Type �
" Reserved �
# Value J �8 _HARDWARE_COUNTER_DATA .?AU_HARDWARE_COUNTER_DATA@@ �� �8 � + F � _LDR_DATA_TABLE_ENTRY .?AU_LDR_DATA_TABLE_ENTRY@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�! B � _LDRP_LOAD_CONTEXT .?AU_LDRP_LOAD_CONTEXT@@ ��
�8 "
InLoadOrderLinks �
InMemoryOrderLinks ���
InInitializationOrderLinks ���
0 DllBase ��
8 EntryPoint ���
" @ SizeOfImage ��
H FullDllName ��
X BaseDllName ��
h FlagGroup
" h Flags
�8 h PackagedBinary ���
�8 h MarkedForRemoval �
�8 h ImageDll �
�8 h LoadNotificationsSent
�8 h TelemetryEntryProcessed ��
�8 h ProcessStaticImport ��
�8 h InLegacyLists
�8 h InIndexes
�8 h ShimDll ��
�8 h InExceptionTable �
�8 h ReservedFlags1 ���
�8 h LoadInProgress ���
�8 h LoadConfigProcessed ��
�8 h EntryProcessed ���
�8 h ProtectDelayLoad �
�8 h ReservedFlags3 ���
�8 h DontCallForThreads ���
�8 h ProcessAttachCalled ��
�8 h ProcessAttachFailed ��
�8 h CorDeferredValidate ��
�8 h CorImage �
�8 h DontRelocate �
�8 h CorILOnly
�8 h ChpeImage
�8 h ReservedFlags5 ���
�8 h Redirected ���
�8 h ReservedFlags6 ���
�8 h CompatDatabaseProcessed ��
! l ObsoleteLoadCount
! n TlsIndex �
p HashLinks
" � TimeDateStamp
� � EntryPointActivationContext ��
� Lock �
�8 � DdagNode �
� NodeModuleLink ���
�8 � LoadContext ��
� ParentDllBase
� SwitchBackContext
� � BaseAddressIndexNode �
� � MappingInfoIndexNode �
# � OriginalBase �
� LoadTime �
" BaseNameHashValue
�' LoadReason ���
" ImplicitPathOptions ��
" ReferenceCount ���
" DependentLoadFlags ���
SigningLevel �F ; �8 _LDR_DATA_TABLE_ENTRY .?AU_LDR_DATA_TABLE_ENTRY@@ �8 � �
@ x
@ y 2
�8 _POINTFLOAT .?AU_POINTFLOAT@@ �8 � P
�) *
" Remove ���
Details ��z �8 _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY@@ �8 � � R � _SYSTEM_PROCESS_INFORMATION .?AU_SYSTEM_PROCESS_INFORMATION@@ �
" NextEntryOffset ��
" NumberOfThreads ��
� WorkingSetPrivateSize
" HardFaultCount ���
" NumberOfThreadsHighWatermark �
# CycleTime
� CreateTime ���
� ( UserTime �
� 0 KernelTime ���
8 ImageName
H BasePriority �
P UniqueProcessId ��
X InheritedFromUniqueProcessId �
" ` HandleCount ��
" d SessionId
# h UniqueProcessKey �
# p PeakVirtualSize ��
# x VirtualSize ��
" � PageFaultCount ���
# � PeakWorkingSetSize ���
# � WorkingSetSize ���
# � QuotaPeakPagedPoolUsage ��
# � QuotaPagedPoolUsage ��
# � QuotaPeakNonPagedPoolUsage ���
# � QuotaNonPagedPoolUsage ���
# � PagefileUsage
# � PeakPagefileUsage
# � PrivatePageCount �
� � ReadOperationCount ���
� � WriteOperationCount ��
� � OtherOperationCount ��
� � ReadTransferCount
� � WriteTransferCount ���
� � OtherTransferCount ���R " �8 _SYSTEM_PROCESS_INFORMATION .?AU_SYSTEM_PROCESS_INFORMATION@@ �8 � �
5 J � _ETW_HEAP_EVENT_RUNDOWN .?AU_ETW_HEAP_EVENT_RUNDOWN@@
�8 � " �
j Header ���
HeapHandle ���
" ( Flags
" , ProcessId
" 0 RangeCount ���
" 4 Reserved �
�8 8 Ranges ���J �8 H _ETW_HEAP_EVENT_RUNDOWN .?AU_ETW_HEAP_EVENT_RUNDOWN@@ �8 c � j � _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT@@
�8
p ��
p ��
p ��
p ��
��
��
��
��f
Lock �
" ThreadId �
p NewCpuPriorityFloor ��
p
OldCpuPriority ���
�8 NewIoPriorityFloor ���
�8 OldIoPriority
�8 NewIoQoSPriorityFloor
�8 OldIoQoSPriority �
p IoPriorities �
�8 ExecutingDpc �
9 WakeupBoost ��
9 BoostedOutstandingIrps ���
9 Reserved �
Flags j 9 _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT@@ 9 c � >
" dwSizeHid
" dwCount ��
� bRawData �. 9 tagRAWHID .?AUtagRAWHID@@ 9 �: 6 � _WMI_PUSHLOCK .?AU_WMI_PUSHLOCK@@ >
PushLock �
" ThreadId �
Action ���6
9 _WMI_PUSHLOCK .?AU_WMI_PUSHLOCK@@ 9 c �
�7 �' " �
9 *
� Luid �
" Attributes ���F 9 _LUID_AND_ATTRIBUTES .?AU_LUID_AND_ATTRIBUTES@@ �� 9 x � 2
� Configuration
! PortAddress ��N 9 _EISA_PORT_CONFIGURATION .?AU_EISA_PORT_CONFIGURATION@@ �� 9 V � _SYSTEM_BOOT_LOGO_INFORMATION .?AU_SYSTEM_BOOT_LOGO_INFORMATION@@ *
" Flags
" BitmapOffset �V 9 _SYSTEM_BOOT_LOGO_INFORMATION .?AU_SYSTEM_BOOT_LOGO_INFORMATION@@ 9 � u R � _PAGE_PRIORITY_INFORMATION .?AU_PAGE_PRIORITY_INFORMATION@@ ��
" PagePriority �R 9 _PAGE_PRIORITY_INFORMATION .?AU_PAGE_PRIORITY_INFORMATION@@ �� 9 ? � : � tagCOMBOBOXINFO .?AUtagCOMBOBOXINFO@@
9 �
" cbSize ���
! rcItem ���
! rcButton �
" $ stateButton ��
� ( hwndCombo
� 0 hwndItem �
� 8 hwndList �: 9 @ tagCOMBOBOXINFO .?AUtagCOMBOBOXINFO@@ !9 M9 �$ �$ f � _EVENT_TRACE_PROFILE_ADD_INFORMATION .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION@@ ��
@ EventTraceInformationClass ���
Version ��
�& V2 ���
� CpuInfoHierarchy �
" InitialInterval ��
Persist ��
| " ProfileSourceDescription �f %9 $ _EVENT_TRACE_PROFILE_ADD_INFORMATION .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION@@ �� &9 A � R � _ETW_HEAP_EVENT_CONTRACTION .?AU_ETW_HEAP_EVENT_CONTRACTION@@ �
j Header ���
HeapHandle ���
# ( DeCommitSize �
0 DeCommitAddress ��
# 8 FreeSpace
# @ CommittedSpace ���
# H ReservedSpace
" P NoOfUCRs �
# T AllocatedSpace ���R )9 \ _ETW_HEAP_EVENT_CONTRACTION .?AU_ETW_HEAP_EVENT_CONTRACTION@@ *9 c �
x
�
+ # " � � � " �
" ContextFlags �
" Cpsr �
# X0 ���
# X1 ���
# X2 ���
# X3 ���
# ( X4 ���
# 0 X5 ���
# 8 X6 ���
# @ X7 ���
# H X8 ���
# P X9 ���
# X X10 ��
# ` X11 ��
# h X12 ��
# p X13 ��
# x X14 ��
# � X15 ��
# � X16 ��
# � X17 ��
# � X18 ��
# � X19 ��
# � X20 ��
# � X21 ��
# � X22 ��
# � X23 ��
# � X24 ��
# � X25 ��
# � X26 ��
# � X27 ��
# � X28 ��
# � Fp ���
# � Lr ���
/9 X
# Sp ���
# Pc ���
09 V
" Fpcr �
" Fpsr �
` Bcr ��
F 8Bvr ��
8 xWcr ��
0 �Wvr ��. + 19 �_CONTEXT .?AU_CONTEXT@@ �� 29 � 7 2 � tagACTCTXW .?AUtagACTCTXW@@ ���
" cbSize ���
" dwFlags ��
lpSource �
! wProcessorArchitecture ���
! wLangId ��
lpAssemblyDirectory ��
lpResourceName ���
( lpApplicationName
� 0 hModule ��2 59 8 tagACTCTXW .?AUtagACTCTXW@@ �� 69 o Q .
p MD5Hash ��
ModuleName ���2 89 <anonymous-tag> .?AT<anonymous-tag>@@ 99 � � 2
S5 RequestType ��
99 SearchInfo ���N ;9 _COVERAGE_MODULE_REQUEST .?AU_COVERAGE_MODULE_REQUEST@@ �� <9 � � J � _RPC_SECURITY_QOS_V5_W .?AU_RPC_SECURITY_QOS_V5_W@@ ��
z HttpCredentials ��2 ?9 <anonymous-tag> .?AT<anonymous-tag>@@ @9 _ n �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
@9 u
Sid ��
u ( EffectiveOnly
0 ServerSecurityDescriptor �J B9 8 _RPC_SECURITY_QOS_V5_W .?AU_RPC_SECURITY_QOS_V5_W@@ �� C9 _ g R � _FILE_MAILSLOT_PEEK_BUFFER .?AU_FILE_MAILSLOT_PEEK_BUFFER@@ ��R
" ReadDataAvailable
" NumberOfMessages �
" MessageLength R F9 _FILE_MAILSLOT_PEEK_BUFFER .?AU_FILE_MAILSLOT_PEEK_BUFFER@@ �� G9 @! 1 Z � _PROCESS_MEMORY_EXHAUSTION_INFO .?AU_PROCESS_MEMORY_EXHAUSTION_INFO@@ J
! Version ��
! Reserved �
�' Type �
# Value Z J9 _PROCESS_MEMORY_EXHAUSTION_INFO .?AU_PROCESS_MEMORY_EXHAUSTION_INFO@@ K9 � � Z � _ETW_TP_EVENT_TIMER_EXPIRATION .?AU_ETW_TP_EVENT_TIMER_EXPIRATION@@ ��
M9 z
j Header ���
DueTime ��
( SubQueue �
0 Timer
" 8 Period ���
" < WindowLength �Z O9 @ _ETW_TP_EVENT_TIMER_EXPIRATION .?AU_ETW_TP_EVENT_TIMER_EXPIRATION@@ �� P9 c D F � _IPT_TRACE_EVENT_DATA .?AU_IPT_TRACE_EVENT_DATA@@ �
# TimeStamp
" ProcessId
" ThreadId �
# IptOption
" IptTraceSize �
" IptTraceStopOffset ���
� IptTrace �F S9 ( _IPT_TRACE_EVENT_DATA .?AU_IPT_TRACE_EVENT_DATA@@ T9 c B � _ETW_OPTICALIO_INIT .?AU_ETW_OPTICALIO_INIT@@ .
Irp ��
" IssuingThreadId ��B W9 _ETW_OPTICALIO_INIT .?AU_ETW_OPTICALIO_INIT@@ X9 c �
! f � _JOBOBJECT_SECURITY_LIMIT_INFORMATION .?AU_JOBOBJECT_SECURITY_LIMIT_INFORMATION@@
e �
" SecurityLimitFlags ���
JobToken �
\9 SidsToDisable
�$ PrivilegesToDelete ���
\9 RestrictedSids ���f ]9 ( _JOBOBJECT_SECURITY_LIMIT_INFORMATION .?AU_JOBOBJECT_SECURITY_LIMIT_INFORMATION@@ ^9 ? �
� N � _PROCESS_JOB_MEMORY_INFO .?AU_PROCESS_JOB_MEMORY_INFO@@ ��
a9 �
# SharedCommitUsage
# PrivateCommitUsage ���
# PeakPrivateCommitUsage ���
# PrivateCommitLimit ���
# TotalCommitLimit �N c9 ( _PROCESS_JOB_MEMORY_INFO .?AU_PROCESS_JOB_MEMORY_INFO@@ �� d9 ? � " i% 6 � _devicemodeW .?AU_devicemodeW@@ ��
g9 �
dmDeviceName �
! @ dmSpecVersion
! B dmDriverVersion ��
! D dmSize ���
! F dmDriverExtra
" H dmFields �
L dmOrientation
N dmPaperSize ��
P dmPaperLength
R dmPaperWidth �
T dmScale ��
V dmCopies �
X dmDefaultSource ��
Z dmPrintQuality ���
� L dmPosition ���
" T dmDisplayOrientation �
" X dmDisplayFixedOutput �
\ dmColor ��
^ dmDuplex �
` dmYResolution
b dmTTOption ���
d dmCollate
f dmFormName ���
! � dmLogPixels ��
" � dmBitsPerPel �
" � dmPelsWidth ��
" � dmPelsHeight �
" � dmDisplayFlags ���
" � dmNup
" � dmDisplayFrequency ���
" � dmICMMethod ��
" � dmICMIntent ��
" � dmMediaType ��
" � dmDitherType �
" � dmReserved1 ��
" � dmReserved2 ��
" � dmPanningWidth ���
" � dmPanningHeight ��6 & i9 � _devicemodeW .?AU_devicemodeW@@ �� j9 � �
t unused ���* l9 HICON__ .?AUHICON__@@ m9 t X . � _WMI_TXR .?AU_WMI_TXR@@ ��
o9 f
InitialTime ��
TxRGUID ��
" Status ���
" UowCount �
| Hive �. q9 ( _WMI_TXR .?AU_WMI_TXR@@ �� r9 c � V � _ENUM_SERVICE_STATUS_PROCESSW .?AU_ENUM_SERVICE_STATUS_PROCESSW@@ R
q lpServiceName
q lpDisplayName
� ServiceStatusProcess �V u9 8 _ENUM_SERVICE_STATUS_PROCESSW .?AU_ENUM_SERVICE_STATUS_PROCESSW@@ v9 � Z � _PROCESS_EXTENDED_ENERGY_VALUES .?AU_PROCESS_EXTENDED_ENERGY_VALUES@@ ^ � _PROCESS_ENERGY_VALUES_EXTENSION .?AU_PROCESS_ENERGY_VALUES_EXTENSION@@ ��&
{( Base �
y9 Extension Z z9 �_PROCESS_EXTENDED_ENERGY_VALUES .?AU_PROCESS_EXTENDED_ENERGY_VALUES@@ {9 � i
�
x
" ��
" �� [% " � " " �V
# EnabledFeatures ��
# EnabledVolatileFeatures ��
" Size �
" ControlFlags �
9 OptimizedSave
�9 CompactionEnabled
�9 Features �
# EnabledSupervisorFeatures
# AlignedFeatures ��
" (AllFeatureSize ���
�9 ,AllFeatures ��
# 0EnabledUserVisibleSupervisorFeatures �F �9 8_XSTATE_CONFIGURATION .?AU_XSTATE_CONFIGURATION@@ �9 � d
&
�$ J � _RTL_DEBUG_INFORMATION .?AU_RTL_DEBUG_INFORMATION@@ ��F � _RTL_PROCESS_MODULES .?AU_RTL_PROCESS_MODULES@@ ��
�9
�, J � _RTL_PROCESS_BACKTRACES .?AU_RTL_PROCESS_BACKTRACES@@
�9
�'
35 V � _RTL_PROCESS_VERIFIER_OPTIONS .?AU_RTL_PROCESS_VERIFIER_OPTIONS@@
�9 " �b
SectionHandleClient ��
ViewBaseClient ���
ViewBaseTarget ���
# ViewBaseDelta
EventPairClient ��
( EventPairTarget ��
0 TargetProcessId ��
8 TargetThreadHandle ���
" @ Flags
# H OffsetFree ���
# P CommitSize ���
# X ViewSize �
�9 ` Modules ��
�9 ` ModulesEx
�9 h BackTraces ���
�9 p Heaps
�9 x Locks
� SpecificHeap �
� TargetProcessHandle ��
�9 � VerifierOptions ��
� ProcessHeap ��
� CriticalSectionHandle
� CriticalSectionOwnerThread ���
�9 � Reserved �J �9 � _RTL_DEBUG_INFORMATION .?AU_RTL_DEBUG_INFORMATION@@ �� �9 � � J � _RTL_HEAP_STACK_CONTROL .?AU_RTL_HEAP_STACK_CONTROL@@ :
! Version ��
! Flags
Process ��J �9 _RTL_HEAP_STACK_CONTROL .?AU_RTL_HEAP_STACK_CONTROL@@ �9 � � N � _FILE_CASE_SENSITIVE_INFO .?AU_FILE_CASE_SENSITIVE_INFO@@
�9
" Flags N �9 _FILE_CASE_SENSITIVE_INFO .?AU_FILE_CASE_SENSITIVE_INFO@@ �9 o �" � KTMOBJECT_TRANSACTION KTMOBJECT_TRANSACTION_MANAGER KTMOBJECT_RESOURCE_MANAGER ��� KTMOBJECT_ENLISTMENT � KTMOBJECT_INVALID 6 t �9 _KTMOBJECT_TYPE .?AW4_KTMOBJECT_TYPE@@ � �9 � w J � _CM_FLOPPY_DEVICE_DATA .?AU_CM_FLOPPY_DEVICE_DATA@@ ��
�9 �
! Version ��
! Revision �
�6 Size �
" MaxDensity ���
" MountDensity �
StepRateHeadUnloadTime ���
HeadLoadTime �
MotorOffTime �
SectorLengthCode �
SectorPerTrack ���
ReadWriteGapLength ���
DataTransferLength ���
FormatGapLength ��
FormatFillCharacter ��
HeadSettleTime ���
MotorSettleTime ��
MaximumTrackValue
DataTransferRate �J �9 $ _CM_FLOPPY_DEVICE_DATA .?AU_CM_FLOPPY_DEVICE_DATA@@ �� �9
j+ R � _PERFINFO_SYSCALL_EXIT_DATA .?AU_PERFINFO_SYSCALL_EXIT_DATA@@
�9
ReturnValue ��R �9 _PERFINFO_SYSCALL_EXIT_DATA .?AU_PERFINFO_SYSCALL_EXIT_DATA@@ �9 c * F � _LPC_CLIENT_DIED_MSG .?AU_LPC_CLIENT_DIED_MSG@@ ��
�9 .
c PortMsg ��
� ( CreateTime ���F �9 0 _LPC_CLIENT_DIED_MSG .?AU_LPC_CLIENT_DIED_MSG@@ �� �9 � � F � _ENCRYPTED_DATA_INFO .?AU_ENCRYPTED_DATA_INFO@@ ��B
# StartingFileOffset ���
" OutputBufferOffset ���
" BytesWithinFileSize ��
" BytesWithinValidDataLength ���
! CompressionFormat
DataUnitShift
ChunkShift ���
ClusterShift �
EncryptionFormat �
! NumberOfDataBlocks ���
� DataBlockSize F �9 _ENCRYPTED_DATA_INFO .?AU_ENCRYPTED_DATA_INFO@@ �� �9 � @ F � _IMAGE_HOT_PATCH_BASE .?AU_IMAGE_HOT_PATCH_BASE@@
�9 �
" SequenceNumber ���
" Flags
" OriginalTimeDateStamp
" OriginalCheckSum �
" CodeIntegrityInfo
" CodeIntegritySize
" PatchTable ���
" BufferOffset �F �9 _IMAGE_HOT_PATCH_BASE .?AU_IMAGE_HOT_PATCH_BASE@@ �9 � �
6
�% &
# Version ��
Name �f �9 _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE@@ �� �9 � R � _ENABLE_TRACE_PARAMETERS_V1 .?AU_ENABLE_TRACE_PARAMETERS_V1@@
�9 z
" Version ��
" EnableProperty ���
" ControlFlags �
SourceId �
� EnableFilterDesc �R �9 ( _ENABLE_TRACE_PARAMETERS_V1 .?AU_ENABLE_TRACE_PARAMETERS_V1@@ �9 � J � _NDR_USER_MARSHAL_INFO .?AU_NDR_USER_MARSHAL_INFO@@ ��V � _NDR_USER_MARSHAL_INFO_LEVEL1 .?AU_NDR_USER_MARSHAL_INFO_LEVEL1@@ 2
" InformationLevel �
�9 Level1 ���J �9 X _NDR_USER_MARSHAL_INFO .?AU_NDR_USER_MARSHAL_INFO@@ �� �9 �
Y* *
�# ntmTm
�. L ntmFontSig ���B �9 d tagNEWTEXTMETRICEXW .?AUtagNEWTEXTMETRICEXW@@ �9 � %
� �
bmType ���
bmWidth ��
bmHeight �
bmWidthBytes �
! bmPlanes �
! bmBitsPixel ��
bmBits ���. �9 tagBITMAP .?AUtagBITMAP@@ �9 � Y
"3 6 � _VIDEO_RECORD .?AU_VIDEO_RECORD@@
�9 �
" MemorySize ���
" XResolution ��
" YResolution ��
" BitsPerPixel �
" VRefresh �
� ChipType �
� DACType ��
� AdapterString
� BiosString ���
� DeviceId �
"
StateFlags ���6 �9
_VIDEO_RECORD .?AU_VIDEO_RECORD@@ �9 c \ n DDC_DEFAULT �� DDC_DISABLE_ALL �� DDC_DISABLE_RESIZE ��� DDC_DISABLE_CONTROL_RELAYOUT �N t �9 DIALOG_DPI_CHANGE_BEHAVIORS .?AW4DIALOG_DPI_CHANGE_BEHAVIORS@@ � �9 � ^ � DISPLAYCONFIG_SOURCE_DEVICE_NAME .?AUDISPLAYCONFIG_SOURCE_DEVICE_NAME@@ ��2
header ���
viewGdiDeviceName ^ �9 T DISPLAYCONFIG_SOURCE_DEVICE_NAME .?AUDISPLAYCONFIG_SOURCE_DEVICE_NAME@@ �� �9 � � V � _SYSTEM_TIMEOFDAY_INFORMATION .?AU_SYSTEM_TIMEOFDAY_INFORMATION@@ �
� BootTime �
� CurrentTime ��
� TimeZoneBias �
" TimeZoneId ���
" Reserved �
# BootTimeBias �
# ( SleepTimeBias V �9 0 _SYSTEM_TIMEOFDAY_INFORMATION .?AU_SYSTEM_TIMEOFDAY_INFORMATION@@ �9 � � B � tagTRACKMOUSEEVENT .?AUtagTRACKMOUSEEVENT@@ ��
�9 V
" cbSize ���
" dwFlags ��
� hwndTrack
" dwHoverTime ��B �9 tagTRACKMOUSEEVENT .?AUtagTRACKMOUSEEVENT@@ �� �9 �
!4
�7 J � _ETW_WNF_EVENT_CALLBACK .?AU_ETW_WNF_EVENT_CALLBACK@@ �
j Header ���
� StateName
( Subscription �
0 NameSub ��
8 Callback �
" @ ChangeStamp ��
" D DeliveryFlags
" H Return ���J �9 P _ETW_WNF_EVENT_CALLBACK .?AU_ETW_WNF_EVENT_CALLBACK@@ �9 c n
�4
�3 V � _ETW_DISKIO_FLUSH_BUFFERS_V3 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V3@@ ��~
" DiskNumber ���
" IrpFlags �
# HighResResponseTime ��
IrpAddr ��
" IssuingThreadId ��V �9 _ETW_DISKIO_FLUSH_BUFFERS_V3 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V3@@ �� �9 c � B � tagVS_FIXEDFILEINFO .?AUtagVS_FIXEDFILEINFO@@ V
" dwSignature ��
" dwStrucVersion ���
" dwFileVersionMS ��
" dwFileVersionLS ��
" dwProductVersionMS ���
" dwProductVersionLS ���
" dwFileFlagsMask ��
" dwFileFlags ��
" dwFileOS �
" $ dwFileType ���
" ( dwFileSubtype
" , dwFileDateMS �
" 0 dwFileDateLS �B
�9 4 tagVS_FIXEDFILEINFO .?AUtagVS_FIXEDFILEINFO@@ 2 onecore\external\sdk\inc\minwin\verrsrc.h �� �9 �9 � J � _FILE_NAME_INFORMATION .?AU_FILE_NAME_INFORMATION@@ ��2
" FileNameLength ���
| FileName �J �9 _FILE_NAME_INFORMATION .?AU_FILE_NAME_INFORMATION@@ �� �9 �
f+ r � _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION .?AU_MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION@@
�9
" ��
" ��>
: CommitEvents �
: Spare
" AllFlags �2 : <anonymous-tag> .?AT<anonymous-tag>@@ : t � �
: Flags
" HandleAttributes �
" DesiredAccess
LowCommitCondition ���
HighCommitCondition ��
MaximumCommitCondition ���r : ( _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION .?AU_MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION@@ : t �
�* v q ! :
" ��
: F � _TRACE_LOGFILE_HEADER .?AU_TRACE_LOGFILE_HEADER@@ f
MajorVersion �
MinorVersion �
SubVersion ���
SubMinorVersion ��: : <anonymous-tag> .?AU<anonymous-tag>@@ : � � .
" BufferSize ���
" Version ��
: VersionDetail
" ProviderVersion ��
" NumberOfProcessors ���
� EndTime ��
" TimerResolution ��
" MaximumFileSize ��
" LogFileMode ��
" $ BuffersWritten ���
( LogInstanceGuid ��
" ( StartBuffers �
" , PointerSize ��
" 0 EventsLost ���
" 4 CpuSpeedInMHz
q 8 LoggerName ���
q @ LogFileName ��
� H TimeZone �
� � BootTime �
� PerfFreq �
� StartTime
" ReservedFlags
" BuffersLost ��F : _TRACE_LOGFILE_HEADER .?AU_TRACE_LOGFILE_HEADER@@ : � �
.
� # : :
: �
StateType
" StateFlags ���
" HardwareLatency ��
" Power
# Context ��
: Handler ��F : _PROCESSOR_IDLE_STATE .?AU_PROCESSOR_IDLE_STATE@@ : x x
C$ J � DISPLAYCONFIG_PATH_INFO .?AUDISPLAYCONFIG_PATH_INFO@@ B
&6 sourceInfo ���
53 targetInfo ���
u D flags J : H DISPLAYCONFIG_PATH_INFO .?AUDISPLAYCONFIG_PATH_INFO@@ : � � ~ � _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION .?AU_SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION@@ ��>
" PlatformManifestSize �
� PlatformManifest �~ ": _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION .?AU_SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION@@ �� #: � � %
%: F � _PERFINFO_FILE_CREATE .?AU_PERFINFO_FILE_CREATE@@ �
# Irp ��
# FileObject ���
" IssuingThreadId ��
" Options ��
" Attributes ���
" ShareAccess ��
| OpenPath �F (: ( _PERFINFO_FILE_CREATE .?AU_PERFINFO_FILE_CREATE@@ ): c V J � _WMI_IDE_CHANNEL_RECORD .?AU_WMI_IDE_CHANNEL_RECORD@@ �
" TargetId �
" DeviceType ���
" DeviceTimingMode �
" LocationInformationLen ���
| LocationInformation ��J ,: _WMI_IDE_CHANNEL_RECORD .?AU_WMI_IDE_CHANNEL_RECORD@@ -: c � J � RPC_CLIENT_INFORMATION1 .?AURPC_CLIENT_INFORMATION1@@
/: V
UserName �
ComputerName �
! Privilege
" AuthFlags J 1: RPC_CLIENT_INFORMATION1 .?AURPC_CLIENT_INFORMATION1@@ 2: _ D
V MemoryExhaustionTypeFailFastOnCommitFailure �� MemoryExhaustionTypeMax ��F t 4: _MEMORY_EXHAUSTION_TYPE .?AW4_MEMORY_EXHAUSTION_TYPE@@ � 5: ? �
w
6 � �
9:
ListEntry
FunctionTable
� TimeStamp
# MinimumAddress ���
# ( MaximumAddress ���
# 0 BaseAddress ��
:: 8 Callback �
@ Context ��
q H OutOfProcessCallbackDll ��
� P Type �
" T EntryCount ���
� X TreeNode �J ;: p _DYNAMIC_FUNCTION_TABLE .?AU_DYNAMIC_FUNCTION_TABLE@@ <: K F � _IMAGE_ENCLAVE_IMPORT .?AU_IMAGE_ENCLAVE_IMPORT@@ �
" MatchType
" MinimumSecurityVersion ���
� UniqueOrAuthorID �
p ( FamilyID �
p 8 ImageID ��
" H ImportName ���
" L Reserved �F ?: P _IMAGE_ENCLAVE_IMPORT .?AU_IMAGE_ENCLAVE_IMPORT@@ @: � �
<
�4
Q0
��
��
��
��
��
��
��
E: ReadWrite
F: Cached ���
G: Reserved0
H: Type �
I: Shared ���
J: Reserved1
K: MoreEntries ��> L: _EISA_MEMORY_TYPE .?AU_EISA_MEMORY_TYPE@@ M: � 2 � _MOF_FIELD .?AU_MOF_FIELD@@ ��
O: >
# DataPtr ��
" Length ���
" DataType �2 Q: _MOF_FIELD .?AU_MOF_FIELD@@ �� R: � � ~ � _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION@@ �
" ulFlags ��
" ulEncodedAssemblyIdentityLength ��
" ulManifestPathType ���
" ulManifestPathLength �
� liManifestLastWriteTime ��
" ulPolicyPathType �
" ulPolicyPathLength ���
� liPolicyLastWriteTime
" ( ulMetadataSatelliteRosterIndex ���
" , ulManifestVersionMajor ���
" 0 ulManifestVersionMinor ���
" 4 ulPolicyVersionMajor �
" 8 ulPolicyVersionMinor �
" < ulAssemblyDirectoryNameLength
� @ lpAssemblyEncodedAssemblyIdentity
� H lpAssemblyManifestPath ���
� P lpAssemblyPolicyPath �
� X lpAssemblyDirectoryName ��
" ` ulFileCount ��~ U: h _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION@@ V: � �
2$ �-
Y: Z � _PERFINFO_PPM_IDLE_STATE_CHANGE .?AU_PERFINFO_PPM_IDLE_STATE_CHANGE@@ B
" NewState �
" OldState �
# Processors ���Z \: _PERFINFO_PPM_IDLE_STATE_CHANGE .?AU_PERFINFO_PPM_IDLE_STATE_CHANGE@@ ]: c � b � _SYSTEM_VSM_PROTECTION_INFORMATION .?AU_SYSTEM_VSM_PROTECTION_INFORMATION@@ ��
DmaProtectionsAvailable ��
DmaProtectionsInUse ��
HardwareMbecAvailable
ApicVirtualizationAvailable ��b `: _SYSTEM_VSM_PROTECTION_INFORMATION .?AU_SYSTEM_VSM_PROTECTION_INFORMATION@@ �� a: � G B � _TRACE_VERSION_INFO .?AU_TRACE_VERSION_INFO@@ :
u EtwTraceProcessingVersion
u Reserved �B d: _TRACE_VERSION_INFO .?AU_TRACE_VERSION_INFO@@ e: � � 2 � _MULTI_TIME .?AU_MULTI_TIME@@ >
� Qpc ��
� HostQpc ��
SystemTime ���2 h: _MULTI_TIME .?AU_MULTI_TIME@@ i: �
� > � tagCANDIDATELIST .?AUtagCANDIDATELIST@@ ��
l: �
" dwSize ���
" dwStyle ��
" dwCount ��
" dwSelection ��
" dwPageStart ��
" dwPageSize ���
z dwOffset �> n: tagCANDIDATELIST .?AUtagCANDIDATELIST@@ �� o: � K " q q " t q:
r:
|- R � _SYSTEM_POOLTAG_INFORMATION .?AU_SYSTEM_POOLTAG_INFORMATION@@ &
" Count
m6 TagInfo ��R v: 0 _SYSTEM_POOLTAG_INFORMATION .?AU_SYSTEM_POOLTAG_INFORMATION@@ w: � �
\- > � RPC_IF_ID_VECTOR .?AURPC_IF_ID_VECTOR@@ ��2 � _RPC_IF_ID .?AU_RPC_IF_ID@@ ��
|: }: " �"
" Count
~: IfId �> : RPC_IF_ID_VECTOR .?AURPC_IF_ID_VECTOR@@ �� �: _ F � tagCHANGEFILTERSTRUCT .?AUtagCHANGEFILTERSTRUCT@@
�: *
" cbSize ���
" ExtStatus F �: tagCHANGEFILTERSTRUCT .?AUtagCHANGEFILTERSTRUCT@@ �: [< J � _CM_SERIAL_DEVICE_DATA .?AU_CM_SERIAL_DEVICE_DATA@@ ��
�: >
! Version ��
! Revision �
" BaudClock J �: _CM_SERIAL_DEVICE_DATA .?AU_CM_SERIAL_DEVICE_DATA@@ �� �: � R � _FSCTL_OFFLOAD_READ_OUTPUT .?AU_FSCTL_OFFLOAD_READ_OUTPUT@@ ��N
" Size �
" Flags
# TransferLength ���
� Token R �: _FSCTL_OFFLOAD_READ_OUTPUT .?AU_FSCTL_OFFLOAD_READ_OUTPUT@@ �� �: � � R � _CONSOLE_SCREEN_BUFFER_INFO .?AU_CONSOLE_SCREEN_BUFFER_INFO@@ 2 � _SMALL_RECT .?AU_SMALL_RECT@@ ~
�" dwSize ���
�" dwCursorPosition �
! wAttributes ��
�:
srWindow �
�" dwMaximumWindowSize ��R �: _CONSOLE_SCREEN_BUFFER_INFO .?AU_CONSOLE_SCREEN_BUFFER_INFO@@ 6 onecore\external\sdk\inc\mincore\consoleapi2.h � �: �: � 2 � _SYSDBG_MSR .?AU_SYSDBG_MSR@@ "
" Msr ��
# Data �2 �: _SYSDBG_MSR .?AU_SYSDBG_MSR@@ �: � J � _FILE_PIPE_EVENT_BUFFER .?AU_FILE_PIPE_EVENT_BUFFER@@ v
" NamedPipeState ���
" EntryType
" ByteCount
" KeyValue �
" NumberRequests ���J �: _FILE_PIPE_EVENT_BUFFER .?AU_FILE_PIPE_EVENT_BUFFER@@ �: � ) N � _PERFINFO_PROCESS_PERFCTR .?AU_PERFINFO_PROCESS_PERFCTR@@
�: �
" ProcessId
" PageFaultCount ���
" HandleCount ��
" Reserved �
# PeakVirtualSize ��
# PeakWorkingSetSize ���
# PeakPagefileUsage
# ( QuotaPeakPagedPoolUsage ��
# 0 QuotaPeakNonPagedPoolUsage ���
# 8 VirtualSize ��
# @ WorkingSetSize ���
# H PagefileUsage
# P QuotaPagedPoolUsage ��
# X QuotaNonPagedPoolUsage ���
# ` PrivatePageCount �N �: h _PERFINFO_PROCESS_PERFCTR .?AU_PERFINFO_PROCESS_PERFCTR@@ �: c �
�. r � _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT@@
�: *
EnlistmentId �
UOW ��r �: _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT@@ �: � �
� R � _PERFINFO_SET_POWER_ACTION .?AU_PERFINFO_SET_POWER_ACTION@@ ��F
Trigger ��
" PowerAction ��
" LightestState R �: _PERFINFO_SET_POWER_ACTION .?AU_PERFINFO_SET_POWER_ACTION@@ �� �: c ? Z � _EVENT_EXTENDED_ITEM_PEBS_INDEX .?AU_EVENT_EXTENDED_ITEM_PEBS_INDEX@@
�:
# PebsIndex Z �: _EVENT_EXTENDED_ITEM_PEBS_INDEX .?AU_EVENT_EXTENDED_ITEM_PEBS_INDEX@@ �: V r � ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS � ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION � ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MAXVERSIONTESTED ���Z t �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE .?AW4ACTCTX_COMPATIBILITY_ELEMENT_TYPE@@ � �: � � F � _FILE_ID_INFORMATION .?AU_FILE_ID_INFORMATION@@ ��6
# VolumeSerialNumber ���
n FileId ���F �: _FILE_ID_INFORMATION .?AU_FILE_ID_INFORMATION@@ �� �: � � %
Value N �: _SID_IDENTIFIER_AUTHORITY .?AU_SID_IDENTIFIER_AUTHORITY@@ �: x V � _WORKER_FACTORY_DEFERRED_WORK .?AU_WORKER_FACTORY_DEFERRED_WORK@@
c n
�: AlpcSendMessage ��
AlpcSendMessagePort ��
" AlpcSendMessageFlags �
" Flags V �: _WORKER_FACTORY_DEFERRED_WORK .?AU_WORKER_FACTORY_DEFERRED_WORK@@ �: � �
�
]1 � M ^ � _HEAP_BLOCK_SETTABLE_INFORMATION .?AU_HEAP_BLOCK_SETTABLE_INFORMATION@@ ��
�: N
# Settable �
! TagIndex �
!
AllocatorBackTraceIndex ��^ �: _HEAP_BLOCK_SETTABLE_INFORMATION .?AU_HEAP_BLOCK_SETTABLE_INFORMATION@@ �� �: � j � _MEMORY_PARTITION_PAGEFILE_INFORMATION .?AU_MEMORY_PARTITION_PAGEFILE_INFORMATION@@ ��
�: Z
PageFileName �
� MinimumSize ��
� MaximumSize ��
" Flags j �: ( _MEMORY_PARTITION_PAGEFILE_INFORMATION .?AU_MEMORY_PARTITION_PAGEFILE_INFORMATION@@ �� �: t � R � PROCESSOR_IDLESTATE_POLICY .?AUPROCESSOR_IDLESTATE_POLICY@@ ��
! ��
! ��
! ��V
! AsUSHORT �
�: AllowScaling �
�: Disabled �
�: Reserved �2 �: <anonymous-tag> .?AT<anonymous-tag>@@ �: x < � " �R
! Revision �
�: Flags
" PolicyCount ��
�: Policy ���R �: PROCESSOR_IDLESTATE_POLICY .?AUPROCESSOR_IDLESTATE_POLICY@@ �� �: x : Z � _FILE_NETWORK_OPEN_INFORMATION .?AU_FILE_NETWORK_OPEN_INFORMATION@@ ��
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� AllocationSize ���
� ( EndOfFile
" 0 FileAttributes ���Z �: 8 _FILE_NETWORK_OPEN_INFORMATION .?AU_FILE_NETWORK_OPEN_INFORMATION@@ �� �: � 0 v RtlMitigationOptionStateNotConfigured RtlMitigationOptionStateOn ��� RtlMitigationOptionStateOff ��^ t �: _RTL_IMAGE_MITIGATION_OPTION_STATE .?AW4_RTL_IMAGE_MITIGATION_OPTION_STATE@@ ��� �: � B � _WMIGUIDINFORMATION .?AU_WMIGUIDINFORMATION@@
�: B
" Size �
IsExpensive ��
IsEventOnly ��B �: _WMIGUIDINFORMATION .?AU_WMIGUIDINFORMATION@@ �: 3 �
� b � _REMOTE_LINK_TRACKING_INFORMATION_ .?AU_REMOTE_LINK_TRACKING_INFORMATION_@@ ��
�: ~
TargetFileObject �
" TargetLinkTrackingInformationLength ��
� TargetLinkTrackingInformationBuffer ��b �: _REMOTE_LINK_TRACKING_INFORMATION_ .?AU_REMOTE_LINK_TRACKING_INFORMATION_@@ �� �: � �) J � _ALPC_BASIC_INFORMATION .?AU_ALPC_BASIC_INFORMATION@@
�: B
" Flags
" SequenceNo ���
PortContext ��J �: _ALPC_BASIC_INFORMATION .?AU_ALPC_BASIC_INFORMATION@@ �: � �
E V � _IMAGE_SEPARATE_DEBUG_HEADER .?AU_IMAGE_SEPARATE_DEBUG_HEADER@@ ��
�: 6
! Signature
! Flags
! Machine ��
! Characteristics ��
" TimeDateStamp
" CheckSum �
" ImageBase
" SizeOfImage ��
" NumberOfSections �
" ExportedNamesSize
" DebugDirectorySize ���
" $ SectionAlignment �
8 ( Reserved �V
�: 0 _IMAGE_SEPARATE_DEBUG_HEADER .?AU_IMAGE_SEPARATE_DEBUG_HEADER@@ �� �: � $
- . � _CSTRING .?AU_CSTRING@@ ��B
! Length ���
! MaximumLength
Buffer ���. �: _CSTRING .?AU_CSTRING@@ �� �: ^ � _MEMORY_SHARED_COMMIT_INFORMATION .?AU_MEMORY_SHARED_COMMIT_INFORMATION@@
# CommitSize ���^ �: _MEMORY_SHARED_COMMIT_INFORMATION .?AU_MEMORY_SHARED_COMMIT_INFORMATION@@ ; t � �
" dwServiceType
" dwCurrentState ���
" dwControlsAccepted ���
" dwWin32ExitCode ��
" dwServiceSpecificExitCode
" dwCheckPoint �
" dwWaitHint ���: ; _SERVICE_STATUS .?AU_SERVICE_STATUS@@ ; � � u)
; F � _OBJECT_ATTRIBUTES64 .?AU_OBJECT_ATTRIBUTES64@@ ��
; ��
; �
" Length ���
# RootDirectory
# ObjectName ���
" Attributes ���
# SecurityDescriptor ���
# ( SecurityQualityOfService �F
; 0 _OBJECT_ATTRIBUTES64 .?AU_OBJECT_ATTRIBUTES64@@ �� ;
�
�3
� N
PolicyPublisher ��
" PolicyVersion
" PolicyOptions f ; _SYSTEM_SECUREBOOT_POLICY_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_INFORMATION@@ ; �
�9 " ( �2
" NumberOfModules ��
; Modules ��F ; 0_RTL_PROCESS_MODULES .?AU_RTL_PROCESS_MODULES@@ �� ; � � f � _SYSTEM_NET_RATE_CONTROL_SET_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_SET_CONTEXT@@ ��
" ��
" ��
" ��
" ��
" ��
" ���
�& Header ���
# MaxBandwidth �
� ContainerId ��
" Flags
; Set ��
; Update ���
; Clear
; DscpTagEnabled ���
; MaxBandwidthEnabled ��
; Reserved �
$ DscpTag ��f ; ( _SYSTEM_NET_RATE_CONTROL_SET_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_SET_CONTEXT@@ �� ; � �
s # " � �J
! Count
! Size �
" Reserved �
#; Bitmap ���6 $; � _KAFFINITY_EX .?AU_KAFFINITY_EX@@ %; w T
� z � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST@@ ��
(; # " �"
*; PreviousChangeStamps �z +; _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST@@ �� ,; � � b � _ETW_TRACE_PARTITION_INFORMATION_V2 .?AU_ETW_TRACE_PARTITION_INFORMATION_V2@@ b
QpcOffsetFromRoot
" PartitionType
q PartitionId ��
q ParentId �b /; _ETW_TRACE_PARTITION_INFORMATION_V2 .?AU_ETW_TRACE_PARTITION_INFORMATION_V2@@ 0; � �
� N � _PERFINFO_FILE_READ_WRITE .?AU_PERFINFO_FILE_READ_WRITE@@
3; �
# Offset ���
# Irp ��
# FileObject ���
# FileKey ��
" IssuingThreadId ��
" $ Size �
" ( Flags
" , ExtraFlags ���N 5; 0 _PERFINFO_FILE_READ_WRITE .?AU_PERFINFO_FILE_READ_WRITE@@ 6; c � t V
8; B � _FILE_STORAGE_INFO .?AU_FILE_STORAGE_INFO@@ ��&
" LogicalBytesPerSector
" PhysicalBytesPerSectorForAtomicity ���
" PhysicalBytesPerSectorForPerformance �
" FileSystemEffectivePhysicalBytesPerSectorForAtomicity
" Flags
" ByteOffsetForSectorAlignment �
" ByteOffsetForPartitionAlignment ��B ;; _FILE_STORAGE_INFO .?AU_FILE_STORAGE_INFO@@ �� <; o # j � _FILE_DESIRED_STORAGE_CLASS_INFORMATION .?AU_FILE_DESIRED_STORAGE_CLASS_INFORMATION@@ "
� Class
" Flags j ?; _FILE_DESIRED_STORAGE_CLASS_INFORMATION .?AU_FILE_DESIRED_STORAGE_CLASS_INFORMATION@@ @; � 2
�+ 2
Id ���
# CurrentAllocatedBytes : C; _RTLP_TAG_INFO .?AU_RTLP_TAG_INFO@@ �� D; � � n � _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE@@ �� �4 " �r � _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY@@ �� H; " �b
" ResponseLevel
" NumberEntries
G; Lev1Depends ��
I; Lev2Depends ��n J; L _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE@@ �� K; � b
�( ��
M; F � _RTL_RELATIVE_NAME_U .?AU_RTL_RELATIVE_NAME_U@@ ��
! N
RelativeName �
ContainingDirectory ��
P; CurDirRef F Q; _RTL_RELATIVE_NAME_U .?AU_RTL_RELATIVE_NAME_U@@ �� R; � a
F) f � _EVENT_TRACE_PERFORMANCE_INFORMATION .?AU_EVENT_TRACE_PERFORMANCE_INFORMATION@@ ��
U; J
@ EventTraceInformationClass ���
� LogfileBytesWritten ��f W; _EVENT_TRACE_PERFORMANCE_INFORMATION .?AU_EVENT_TRACE_PERFORMANCE_INFORMATION@@ �� X; A � J � _HEAP_BLOCK_INFORMATION .?AU_HEAP_BLOCK_INFORMATION@@ �
" Level
# Size �
X# ProcessHeapInformation ���
�4 HeapInformation ��
N HeapRegionInformation
% HeapRangeInformation �
Z; HeapBlockInformation �
�6 HeapPerfInformation ��
# DynamicStart �J [; � _HEAP_INFORMATION_ITEM .?AU_HEAP_INFORMATION_ITEM@@ �� \; � =
� J � _EVENT_INSTANCE_HEADER .?AU_EVENT_INSTANCE_HEADER@@ ��
_; 6
Type �
Level
! Version ��: a; <anonymous-tag> .?AU<anonymous-tag>@@ b; � S �
! Size �
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��
" Version ��
b; Class
" ThreadId �
" ProcessId
� TimeStamp
# RegHandle
" InstanceId ���
" $ ParentInstanceId �
" ( KernelTime ���
" , UserTime �
# ( ProcessorTime
" ( EventId ��
" , Flags
# 0 ParentRegHandle ��J d; 8 _EVENT_INSTANCE_HEADER .?AU_EVENT_INSTANCE_HEADER@@ �� e; � H
6
p Z � _CM_PNP_BIOS_INSTALLATION_CHECK .?AU_CM_PNP_BIOS_INSTALLATION_CHECK@@ v
Signature
Revision �
Length ���
! ControlField �
Checksum �
" EventFlagAddress �
!
RealModeEntryOffset ��
! RealModeEntrySegment �
! ProtectedModeEntryOffset �
" ProtectedModeCodeBaseAddress �
" OemDeviceId ��
! RealModeDataBaseAddress ��
" ProtectedModeDataBaseAddress �Z
j; ! _CM_PNP_BIOS_INSTALLATION_CHECK .?AU_CM_PNP_BIOS_INSTALLATION_CHECK@@ k; i
\ " " n;
o; J � _FILE_LAYOUT_NAME_ENTRY .?AU_FILE_LAYOUT_NAME_ENTRY@@ �
" NextNameOffset ���
" Flags
# ParentFileReferenceNumber
" FileNameLength ���
" Reserved �
| FileName �J r; _FILE_LAYOUT_NAME_ENTRY .?AU_FILE_LAYOUT_NAME_ENTRY@@ s; � � : � tagEMRCREATEPEN .?AUtagEMRCREATEPEN@@
u; 2
� emr ��
" ihPen
�, lopn �: w; tagEMRCREATEPEN .?AUtagEMRCREATEPEN@@ x; � N
R � _SYSDBG_KD_PULL_REMOTE_FILE .?AU_SYSDBG_KD_PULL_REMOTE_FILE@@
ImageFileName R |; _SYSDBG_KD_PULL_REMOTE_FILE .?AU_SYSDBG_KD_PULL_REMOTE_FILE@@ }; � � Z SeLearningModeInvalidType SeLearningModeSettings ��� SeLearningModeMax N t ; _SE_LEARNING_MODE_DATA_TYPE .?AW4_SE_LEARNING_MODE_DATA_TYPE@@ � �; x 3
�!
�3 ~ PowerUserPresent � PowerUserNotPresent �� PowerUserInactive PowerUserMaximum � PowerUserInvalid �F t �; _USER_ACTIVITY_PRESENCE .?AW4_USER_ACTIVITY_PRESENCE@@ � �; x �
�) ^ � _ETW_COVERAGE_SAMPLER_PERF_STATS .?AU_ETW_COVERAGE_SAMPLER_PERF_STATS@@ ��*
# RunTime ��
SampleProfile
SampleCSwitch
SampleRThread
SamplePGFault
CaptureSampleProfile �
CaptureSampleCSwitch �
CaptureSampleRThread �
$ CaptureSamplePGFault �
( CoverageSamplerCreated ���
, CoverageSamplerDeleted ���
0 CoverageSamplerStarted ���
4 CoverageSamplerPaused
8 CoverageSamplerResumed ���
< CoverageSamplerStopped ���
@ CoverageSamplerQueried ���
D CoverageSamplerQueryFailNotActive
H SamplesAdded �
L SamplesFound �
P SamplesDropped ���
T SamplesMappedUM ��
X SamplesMappedKM ��
\ SamplesTryMapUM ��
` SamplesTryMapKM ��
d SamplesAddedAlreadyMapped
h ModulesTrackedUM �
l ModulesMappedUM ��
p ModulesUnmappedUM
t ModulesTrackedKM �
x ModulesMappedKM ��
| ModulesUnmappedKM
� ModulesCleared ���
� ModulesPruned
� ModulesPrunedPendingDelete ���
� ModulesOutOfDatePendingDelete
� ModuleBucketsGrown ���
� ModuleDebugInfoFailedQuery ���
� ModuleDebugInfoTooLarge ��
� ModuleIdHashDuplicate
� ModuleIdHashConflict �
� ProcessesTracked �
� ProcessesIgnored �
� ProcessesDeleted �
� CaptureSampleAttempts
� CaptureSampleSamplingPaused ��
� CaptureKernelStack ���
� CaptureUserStack �
� CaptureIPNotInStack ��
� CaptureSampleIdle
� CaptureUserCheckSystemThread �
� CaptureUserCheckNullTeb ��
� CaptureUserCheckTerminating ��
� CaptureUserCheckSuspended
� CaptureApcNotInGoodEnvironment ���
� CaptureRebalanceQueue
� CaptureRebalance �
� CaptureApc ���
� CaptureApcNotAvailable ���
� CaptureApcThreadNotQueueable �
� CaptureApcAlreadyQueued ��
� CaptureThreadAlreadySampling �
� CaptureApcQueue ��
� CaptureApcQueueAtHighIrql
CaptureApcFailedToQueue ��
CaptureApcFailedToQueueAtHighIrql
CaptureApcFailedToQueueAtHighIrqlNotRunning ��
CaptureApcFailedToQueueAtHighIrqlNotApcQueueable �
CaptureApcRundown
CaptureApcCancel �
CaptureApcCancelFailRemove ���
CaptureBufferNotAvailable
CaptureBufferReleaseEmpty
$CaptureBufferQueued ��
(CaptureBufferCopied ��
,CaptureStartFailureCleanup ���
0SampleBufferNotAvailable �
4WorkerWakeUpForCaptureBuffer �
8WorkerWakeUpForRebalance �
<WorkerProcessCaptureBuffer ���
@WorkerProcessSampleBuffer
DWorkerProcessFlushBuffer �
HStackHashMiss
LStackHashHit �
PStackHashHitInHistory
TStackHashSwitchTables
XStackHashCollisionInAdd ��
\StackHashAddHitLoad ��
`StackHashAddHitMax ���
dBloomFilterExceptions
hBloomFilterSet ���
lBloomFilterOnCreate ��
pBloomFilterHit ���
tBloomFilterMiss ��
xBufferSamplesCopied ��
|BufferSamplesProcessed ���
�BufferSamplesAddedToSampler ��
�BufferAddressesCopied
�BufferAddressesProcessed �
�BufferAddressesAddedToSampler
�ReserveFailedAcquireLock �
�ReserveCaptureStopped
�ReserveNewBufferSet ��
�ReserveNewBufferFailed ���
�ReserveNewBufferAllocated
�ReserveNewBufferReleased �
�ReserveSucceeded �
�TableGrew
�TableGrow
�TableQueued ��
�TableHitInCurrent
�TableHitInOld ^ o �; �_ETW_COVERAGE_SAMPLER_PERF_STATS .?AU_ETW_COVERAGE_SAMPLER_PERF_STATS@@ �� �; A " R � _WMI_IMAGELOAD_INFORMATION .?AU_WMI_IMAGELOAD_INFORMATION@@ ��2
ImageBase
# ImageSize
" ProcessId
" ImageChecksum
" TimeDateStamp
SignatureLevel ���
SignatureType
! Reserved0
DefaultBase ��
" ( Reserved1
" , Reserved2
" 0 Reserved3
" 4 Reserved4
| 8 FileName �R �; @ _WMI_IMAGELOAD_INFORMATION .?AU_WMI_IMAGELOAD_INFORMATION@@ �� �; c D . � _TP_WORK .?AU_TP_WORK@@ ��
�; � �; �;
�;
� f � _PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT .?AU_PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT@@
# TargetAddress f �; _PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT .?AU_PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT@@ �; c 8
R7 : � _SYSDBG_VIRTUAL .?AU_SYSDBG_VIRTUAL@@ >
Address ��
Buffer ���
" Request ��: �; _SYSDBG_VIRTUAL .?AU_SYSDBG_VIRTUAL@@ �; � � b � _PROCESS_CHILD_PROCESS_INFORMATION .?AU_PROCESS_CHILD_PROCESS_INFORMATION@@ ��v
ProhibitChildProcesses ���
AlwaysAllowSecureChildProcess
AuditProhibitChildProcesses ��b �; _PROCESS_CHILD_PROCESS_INFORMATION .?AU_PROCESS_CHILD_PROCESS_INFORMATION@@ �� �; ? � 6 � tagLOGPALETTE .?AUtagLOGPALETTE@@
�; : � tagPALETTEENTRY .?AUtagPALETTEENTRY@@ �; " �J
! palVersion ���
! palNumEntries
�; palPalEntry ��6 �; tagLOGPALETTE .?AUtagLOGPALETTE@@ �; � � . PerfInfoDomainChangeEventIdleHalt PerfInfoDomainChangeEventIdleResume �� PerfInfoDomainChangeEventUserRestore � PerfInfoDomainChangeEventUserCallout � PerfInfoDomainChangeEventEnterSyscall PerfInfoDomainChangeEventEnterTrap ��� PerfInfoDomainChangeEventMaximum �b t �; _PERFINFO_DOMAIN_CHANGE_EVENT_REASON .?AW4_PERFINFO_DOMAIN_CHANGE_EVENT_REASON@@ ��� �; c
�;
�
|0
� j � _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT .?AU_SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT@@ ��
�; .
# Hits �
PercentFrequency �j �; _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT .?AU_SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT@@ �� �; � N � READ_USN_JOURNAL_DATA_V1 .?AUREAD_USN_JOURNAL_DATA_V1@@ ��
�; �
StartUsn �
" ReasonMask ���
" ReturnOnlyOnClose
# Timeout ��
# BytesToWaitFor ���
# UsnJournalID �
! ( MinMajorVersion ��
! * MaxMajorVersion ��N �; 0 READ_USN_JOURNAL_DATA_V1 .?AUREAD_USN_JOURNAL_DATA_V1@@ �� �; � 9 : � _MMPFN_IDENTITY .?AU_MMPFN_IDENTITY@@ N � _MEMORY_FRAME_INFORMATION .?AU_MEMORY_FRAME_INFORMATION@@ F � _PAGEDIR_INFORMATION .?AU_PAGEDIR_INFORMATION@@ ��B
�; e1 ���
�1 e2 ���
�; e3 ���
�% e4 ���2 �; <anonymous-tag> .?AT<anonymous-tag>@@ �; t %
# ��
# ��&
�; Image
�; Mismatch �: �; <anonymous-tag> .?AU<anonymous-tag>@@ �; t -
# ��
�; CombinedPage �: �; <anonymous-tag> .?AU<anonymous-tag>@@ �; t 1 �
�; e1 ���
�; e2 ���
FileObject ���
UniqueFileObjectKey ��
ProtoPteAddress ��
VirtualAddress ���2 �; <anonymous-tag> .?AT<anonymous-tag>@@ �; t , >
�; u1 ���
# PageFrameIndex ���
�; u2 ���: �; _MMPFN_IDENTITY .?AU_MMPFN_IDENTITY@@ �; t $ R � _JOBOBJECT_WAKE_INFORMATION .?AU_JOBOBJECT_WAKE_INFORMATION@@
�; # " 8 �:
# NotificationChannel ��
�; WakeCounters �R �; @ _JOBOBJECT_WAKE_INFORMATION .?AU_JOBOBJECT_WAKE_INFORMATION@@ �; � 3 V � _FILE_SET_DEFECT_MGMT_BUFFER .?AU_FILE_SET_DEFECT_MGMT_BUFFER@@ ��
Disable ��V �; _FILE_SET_DEFECT_MGMT_BUFFER .?AU_FILE_SET_DEFECT_MGMT_BUFFER@@ �� �; � ' Z � _SYSTEM_PROCESS_ID_INFORMATION .?AU_SYSTEM_PROCESS_ID_INFORMATION@@ ��
�; *
ProcessId
ImageName Z �; _SYSTEM_PROCESS_ID_INFORMATION .?AU_SYSTEM_PROCESS_ID_INFORMATION@@ �� �; � ` F � _RPC_TRANSFER_SYNTAX .?AU_RPC_TRANSFER_SYNTAX@@ ��:
Uuid �
! VersMajor
! VersMinor F �; _RPC_TRANSFER_SYNTAX .?AU_RPC_TRANSFER_SYNTAX@@ �� �; 7 �
U"
�/
O 2 � _FILE_PATH .?AU_FILE_PATH@@ ��
�; N
" Version ��
" Length ���
" Type �
� FilePath �2 �; _FILE_PATH .?AU_FILE_PATH@@ �� �; � s f � _PERFINFO_PAGECOMBINE_AGGREGATE_STAT .?AU_PERFINFO_PAGECOMBINE_AGGREGATE_STAT@@ ��
�;
" ��
" ��
�; StatType �
�; Spare
" CombineScanCount �
# PagesScanned �
# PagesCombined
CombinedBlocksInUse ��
SumCombinedBlocksReferenceCount ��f �; _PERFINFO_PAGECOMBINE_AGGREGATE_STAT .?AU_PERFINFO_PAGECOMBINE_AGGREGATE_STAT@@ �� �; c ( N
peRed
peGreen ��
peBlue ���
peFlags ��: �; tagPALETTEENTRY .?AUtagPALETTEENTRY@@ �; � � v � _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT@@ ��
�;
" SavepointId ��v �; _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT@@ �� �; � �
�3 J � _ETW_HEAP_EVENT_COMMON .?AU_ETW_HEAP_EVENT_COMMON@@ ��*
j Header ���
Handle ���J �; ( _ETW_HEAP_EVENT_COMMON .?AU_ETW_HEAP_EVENT_COMMON@@ �� �; c �
N � _COVERAGE_SECTION_HEADER .?AU_COVERAGE_SECTION_HEADER@@ ��
�; �
" Signature
" CoverageType �
p MD5Hash ��
" CoverageSectionSize ��
" CoverageVectorSize ���
" CoverageVectorOffset �
" $ ExtraDataOffset ��N < ( _COVERAGE_SECTION_HEADER .?AU_COVERAGE_SECTION_HEADER@@ �� < � ' R � _PERFINFO_PO_NOTIFY_DEVICE .?AU_PERFINFO_PO_NOTIFY_DEVICE@@ ���
Irp ��
DriverStart ��
OrderLevel ���
MajorFunction
MinorFunction
� Type �
)" State
" DeviceNameLength �
| DeviceName ���R < ( _PERFINFO_PO_NOTIFY_DEVICE .?AU_PERFINFO_PO_NOTIFY_DEVICE@@ �� < c n q t <
<
M
�
d
< � � < r � _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION@@ ��
< �
z( BasicInfo
� 0 IoInfo ���
` DiskIoInfo ���
# � ContextSwitches ��
� � TotalCycleTime ���
# � ReadyTime
{( � EnergyValues �r < �_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION@@ �� < � �
�+ B � _SCRUB_DATA_OUTPUT .?AU_SCRUB_DATA_OUTPUT@@ �� " " $ ��
" Size �
" Flags
" Status ���
# ErrorFileOffset ��
# ErrorLength ��
# NumberOfBytesRepaired
# ( NumberOfBytesFailed ��
# 0 InternalFileReference
! 8 ResumeContextLength ��
! : ParityExtentDataOffset ���
< < Reserved �
# ` NumberOfMetadataBytesProcessed ���
# h NumberOfDataBytesProcessed ���
# p TotalNumberOfMetadataBytesInUse ��
# x TotalNumberOfDataBytesInUse ��
�6 � ResumeContext B < �_SCRUB_DATA_OUTPUT .?AU_SCRUB_DATA_OUTPUT@@ �� < � /' . � HLSURF__ .?AUHLSURF__@@ ��
t unused ���. < HLSURF__ .?AUHLSURF__@@ �� < �' � N � _ACL_REVISION_INFORMATION .?AU_ACL_REVISION_INFORMATION@@
" AclRevision ��N !< _ACL_REVISION_INFORMATION .?AU_ACL_REVISION_INFORMATION@@ "< x S
�$ r � _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT@@ ��*
" MarshalCookie
UOW ��r &< _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT@@ �� '< � � J � _IMAGE_TLS_DIRECTORY32 .?AU_IMAGE_TLS_DIRECTORY32@@ ��
" ��
" ��
" ���
" StartAddressOfRawData
" EndAddressOfRawData ��
" AddressOfIndex ���
" AddressOfCallBacks ���
" SizeOfZeroFill ���
" Characteristics ��
*< Reserved0
+< Alignment
,< Reserved1 J -< _IMAGE_TLS_DIRECTORY32 .?AU_IMAGE_TLS_DIRECTORY32@@ �� .< � � Z � _STREAMS_QUERY_ID_OUTPUT_BUFFER .?AU_STREAMS_QUERY_ID_OUTPUT_BUFFER@@
" StreamId �Z 1< _STREAMS_QUERY_ID_OUTPUT_BUFFER .?AU_STREAMS_QUERY_ID_OUTPUT_BUFFER@@ 2< � � > � RPC_STATS_VECTOR .?AURPC_STATS_VECTOR@@ �� " " �"
u Count
5< Stats > 6< RPC_STATS_VECTOR .?AURPC_STATS_VECTOR@@ �� 7< _ f � _ALPC_PORT_ASSOCIATE_COMPLETION_PORT .?AU_ALPC_PORT_ASSOCIATE_COMPLETION_PORT@@ ��
9< 6
CompletionKey
CompletionPort ���f ;< _ALPC_PORT_ASSOCIATE_COMPLETION_PORT .?AU_ALPC_PORT_ASSOCIATE_COMPLETION_PORT@@ �� << � F � _FILE_ALIGNMENT_INFO .?AU_FILE_ALIGNMENT_INFO@@ ��"
" AlignmentRequirement �F ?< _FILE_ALIGNMENT_INFO .?AU_FILE_ALIGNMENT_INFO@@ �� @< o #
�2 ^ � _RPC_BINDING_HANDLE_TEMPLATE_V1_W .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_W@@
q Reserved �2 D< <anonymous-tag> .?AT<anonymous-tag>@@ E< _ � �
" Version ��
" Flags
" ProtocolSequence �
q NetworkAddress ���
q StringEndpoint ���
E< u1 ���
( ObjectUuid ���^ G< 8 _RPC_BINDING_HANDLE_TEMPLATE_V1_W .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_W@@ H< _ � b JournalAbsoluteInformation ��� JournalClientInformation � MaxJournalInformation N t J< _JOURNAL_INFORMATION_CLASS .?AW4_JOURNAL_INFORMATION_CLASS@@ ��� K< � � B � tagINPUT_TRANSFORM .?AUtagINPUT_TRANSFORM@@ �� r " @ �
@ _11 ��
@ _12 ��
@ _13 ��
@ _14 ��
@ _21 ��
@ _22 ��
@ _23 ��
@ _24 ��
@ _31 ��
@ $ _32 ��
@ ( _33 ��
@ , _34 ��
@ 0 _41 ��
@ 4 _42 ��
@ 8 _43 ��
@ < _44 ��
N< m B O< @ tagINPUT_TRANSFORM .?AUtagINPUT_TRANSFORM@@ �� P< � � ! t R<
S<
�
60
c: F � _CM_SONIC_DEVICE_DATA .?AU_CM_SONIC_DEVICE_DATA@@ j
! Version ��
! Revision �
! DataConfigurationRegister
EthernetAddress ��F Y< _CM_SONIC_DEVICE_DATA .?AU_CM_SONIC_DEVICE_DATA@@ Z< � : � CM_Power_Data_s .?AUCM_Power_Data_s@@ � " ��
" PD_Size ��
� PD_MostRecentPowerState ��
" PD_Capabilities ��
" PD_D1Latency �
" PD_D2Latency �
" PD_D3Latency �
]< PD_PowerStateMapping �
� 4 PD_DeepestSystemWake �: ^< 8 CM_Power_Data_s .?AUCM_Power_Data_s@@ _< x b R � _KEY_VALUE_FULL_INFORMATION .?AU_KEY_VALUE_FULL_INFORMATION@@ �
" TitleIndex ���
" Type �
" DataOffset ���
" DataLength ���
" NameLength ���
| Name �R b< _KEY_VALUE_FULL_INFORMATION .?AU_KEY_VALUE_FULL_INFORMATION@@ c< O
� ^ � _ETW_COVERAGE_SAMPLER_STATUS_INFO .?AU_ETW_COVERAGE_SAMPLER_STATUS_INFO@@ V � _ETW_COVERAGE_SAMPLER_STATUS .?AU_ETW_COVERAGE_SAMPLER_STATUS@@ ��*
$ Common ���
g< Status ���^ h< _ETW_COVERAGE_SAMPLER_STATUS_INFO .?AU_ETW_COVERAGE_SAMPLER_STATUS_INFO@@ i< A - : � _RTL_HASH_ENTRY .?AU_RTL_HASH_ENTRY@@ *
V BucketLink ���
# Key ��: l< _RTL_HASH_ENTRY .?AU_RTL_HASH_ENTRY@@ m< � * B � _PS_ATTRIBUTE_LIST .?AU_PS_ATTRIBUTE_LIST@@ ��6 � _PS_ATTRIBUTE .?AU_PS_ATTRIBUTE@@ p< " �2
# TotalLength ��
q< Attributes ���B r< ( _PS_ATTRIBUTE_LIST .?AU_PS_ATTRIBUTE_LIST@@ �� s< � � 6 � _RATE_QUOTA_LIMIT .?AT_RATE_QUOTA_LIMIT@@
u<
" ��
" ��B
" RateData �
w< RatePercent ��
x< Reserved0 6 y< _RATE_QUOTA_LIMIT .?AT_RATE_QUOTA_LIMIT@@ z< ? � F � _PHYSICAL_DISK_RECORD .?AU_PHYSICAL_DISK_RECORD@@ q " �N
" DiskNumber ���
" BytesPerSector ���
" SectorsPerTrack ��
" TracksPerCylinder
# Cylinders
" SCSIPortNumber ���
" SCSIPathId ���
" SCSITargetId �
" $ SCSILun ��
� ( Manufacturer �
" (PartitionCount ���
,WriteCacheEnabled
}< .BootDriveLetter ��F
~< 8_PHYSICAL_DISK_RECORD .?AU_PHYSICAL_DISK_RECORD@@ < c � 6 � tagEMRFILLRGN .?AUtagEMRFILLRGN@@
�< b
� emr ��
d rclBounds
" cbRgnData
" ihBrush ��
� RgnData ��6 �< $ tagEMRFILLRGN .?AUtagEMRFILLRGN@@ �< � � 6 � _PEB_LDR_DATA .?AU_PEB_LDR_DATA@@
�<
" Length ���
Initialized ��
SsHandle �
InLoadOrderModuleList
InMemoryOrderModuleList ��
0 InInitializationOrderModuleList ��
@ EntryInProgress ��
H ShutdownInProgress ���
P ShutdownThreadId �6 �< X _PEB_LDR_DATA .?AU_PEB_LDR_DATA@@ �< ? ,
Q b
ProcessorNumber ��
Alignment
! ProcessorIndex ���
! LoggerId �B �< _ETW_BUFFER_CONTEXT .?AU_ETW_BUFFER_CONTEXT@@ �< � � B � tagEMROFFSETCLIPRGN .?AUtagEMROFFSETCLIPRGN@@ &
� emr ��
� ptlOffset B �< tagEMROFFSETCLIPRGN .?AUtagEMROFFSETCLIPRGN@@ �< � �
}0 Z
elfLogFont ���
\ elfFullName ��
� elfStyle �
elfScript > �< \tagENUMLOGFONTEXW .?AUtagENUMLOGFONTEXW@@ �< � �
�2 V � _JOBOBJECT_JOBSET_INFORMATION .?AU_JOBOBJECT_JOBSET_INFORMATION@@
" MemberLevel ��V �< _JOBOBJECT_JOBSET_INFORMATION .?AU_JOBOBJECT_JOBSET_INFORMATION@@ �< ? �
� : � _XSTATE_CONTEXT .?AU_XSTATE_CONTEXT@@
�<
^
# Mask �
" Length ���
" Reserved1
�< Area �
Buffer ���: �< _XSTATE_CONTEXT .?AU_XSTATE_CONTEXT@@ �< L $
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
�< Reserved0
�< SameAccess ���
�< SameAttributes ���
�< Indirect �
�< Inherit ��
�< Reserved1
" Handle ���
" ObjectType ���
" DesiredAccess
" GrantedAccess B �< _ALPC_HANDLE_ATTR32 .?AU_ALPC_HANDLE_ATTR32@@ �< � ) �
HandleValue ��
# HandleCount ��
# PointerCount �
" GrantedAccess
" ObjectTypeIndex ��
" HandleAttributes �
" $ Reserved �^ �< ( _PROCESS_HANDLE_TABLE_ENTRY_INFO .?AU_PROCESS_HANDLE_TABLE_ENTRY_INFO@@ �� �< � � V � _SERVICE_FAILURE_ACTIONS_FLAG .?AU_SERVICE_FAILURE_ACTIONS_FLAG@@ .
t fFailureActionsOnNonCrashFailures V �< _SERVICE_FAILURE_ACTIONS_FLAG .?AU_SERVICE_FAILURE_ACTIONS_FLAG@@ �< � C n � _SYSTEM_FEATURE_CONFIGURATION_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_INFORMATION@@ 2
# ChangeStamp ��
r Configuration n �< _SYSTEM_FEATURE_CONFIGURATION_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_INFORMATION@@ �< � c
�5
�#
z( �
� TotalUserTime
� TotalKernelTime ��
� ThisPeriodTotalUserTime ��
� ThisPeriodTotalKernelTime
" TotalPageFaultCount ��
" $ TotalProcesses ���
" ( ActiveProcesses ��
" , TotalTerminatedProcesses �j �< 0 _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_ACCOUNTING_INFORMATION@@ �< ? I f � _SYSTEM_QUERY_TIME_ADJUST_INFORMATION .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION@@ J
" TimeAdjustment ���
" TimeIncrement
Enable ���f �< _SYSTEM_QUERY_TIME_ADJUST_INFORMATION .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION@@ �< � c B � _KERNEL_USER_TIMES .?AU_KERNEL_USER_TIMES@@ ��Z
� CreateTime ���
� ExitTime �
� KernelTime ���
� UserTime �B �< _KERNEL_USER_TIMES .?AU_KERNEL_USER_TIMES@@ �� �< ? � f � _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1@@ f
� pInt64 ���
� pUint64 ��
� ppString �
� pFqbn
� pOctetString �2 �< <anonymous-tag> .?AT<anonymous-tag>@@ �< x
v
" Name �
! ValueType
! Reserved �
" Flags
" ValueCount ���
�< Values ���f �< _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1@@ �< x � B � _IMAGE_THUNK_DATA32 .?AU_IMAGE_THUNK_DATA32@@
�< ��
�< ^
" ForwarderString ��
" Function �
" Ordinal ��
" AddressOfData 2 �< <anonymous-tag> .?AT<anonymous-tag>@@ �< � �
�< u1 ���B �< _IMAGE_THUNK_DATA32 .?AU_IMAGE_THUNK_DATA32@@ �< � � F � _IMAGE_FUNCTION_ENTRY .?AU_IMAGE_FUNCTION_ENTRY@@ N
" StartingAddress ��
" EndingAddress
" EndOfPrologue F �< _IMAGE_FUNCTION_ENTRY .?AU_IMAGE_FUNCTION_ENTRY@@ �< � A # A �<
�& *
# PolicyCookie �
� Type �j �< _SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER .?AU_SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER@@ �< � � b � _SYSTEM_SET_TIME_ADJUST_INFORMATION .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION@@
�< 2
" TimeAdjustment ���
Enable ���b �< _SYSTEM_SET_TIME_ADJUST_INFORMATION .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION@@ �< � o b � _PERFINFO_KERNELMEMORY_RANGE_USAGE .?AU_PERFINFO_KERNELMEMORY_RANGE_USAGE@@ ��
�<
" ��
" ��V
�< UsageType
�< Spare
VirtualAddress ���
# PageCount b �< _PERFINFO_KERNELMEMORY_RANGE_USAGE .?AU_PERFINFO_KERNELMEMORY_RANGE_USAGE@@ �� �< c J � tagPOINTER_DEVICE_INFO .?AUtagPOINTER_DEVICE_INFO@@ ��2 � HMONITOR__ .?AUHMONITOR__@@ ��
�< q " �
" displayOrientation ���
device ���
�, pointerDeviceType
�< monitor ��
" startingCursorId �
! $ maxActiveContacts
�< & productString J �< 8tagPOINTER_DEVICE_INFO .?AUtagPOINTER_DEVICE_INFO@@ �� �< �;
(5 R � _SYSTEM_HANDLE_INFORMATION .?AU_SYSTEM_HANDLE_INFORMATION@@ ��Z � _SYSTEM_HANDLE_TABLE_ENTRY_INFO .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO@@ �< " �2
" NumberOfHandles ��
�< Handles ��R �< _SYSTEM_HANDLE_INFORMATION .?AU_SYSTEM_HANDLE_INFORMATION@@ �� �< � : � tagENUMLOGFONTA .?AUtagENUMLOGFONTA@@
�< F
elfLogFont ���
�+ < elfFullName ��
� | elfStyle �: �< � tagENUMLOGFONTA .?AUtagENUMLOGFONTA@@ �< � �
9 N � _MEM_ADDRESS_REQUIREMENTS .?AU_MEM_ADDRESS_REQUIREMENTS@@ V
LowestStartingAddress
HighestEndingAddress �
# Alignment N = _MEM_ADDRESS_REQUIREMENTS .?AU_MEM_ADDRESS_REQUIREMENTS@@ = � �
�) : � _REASON_BUFFER .?AU_REASON_BUFFER@@ ��
" Flags
# ResourceFileNameOffset ���
! ResourceReasonId �
" StringCount ��
# SubstitutionStringsOffset
# SimpleStringOffset ���: = _REASON_BUFFER .?AU_REASON_BUFFER@@ �� = x �
r3
�2 6 � _EVENT_TRACE .?AU_EVENT_TRACE@@ ��
�2
=
=
=
=
M
= =
= �
p LogFileName ��
p LoggerName ���
CurrentTime ��
" BuffersRead ��
" LogFileMode ��
" ProcessTraceMode �
= CurrentEvent �
: x LogfileHeader
= �BufferCallback ���
" �BufferSize ���
" �Filled ���
" �EventsLost ���
= �EventCallback
= �EventRecordCallback ��
" �IsKernelTrace
�Context ��F = �_EVENT_TRACE_LOGFILEA .?AU_EVENT_TRACE_LOGFILEA@@ = � �
, V � _CLAIM_SECURITY_ATTRIBUTE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_V1@@ ��
=
�2 v � _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ ��
= f
pInt64 ���
# pUint64 ��
�- ppString �
= pFqbn
= pOctetString �2 = <anonymous-tag> .?AT<anonymous-tag>@@ = x � v
q Name �
! ValueType
!
Reserved �
" Flags
" ValueCount ���
= Values ���V = _CLAIM_SECURITY_ATTRIBUTE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_V1@@ �� != x � : � tagMETAFILEPICT .?AUtagMETAFILEPICT@@ 2 � HMETAFILE__ .?AUHMETAFILE__@@
$= B
mm ���
xExt �
yExt �
%= hMF ��: &= tagMETAFILEPICT .?AUtagMETAFILEPICT@@ '= �
.1
� > � _TOKEN_STATISTICS .?AU_TOKEN_STATISTICS@@
� TokenId ��
� AuthenticationId �
� ExpirationTime ���
�$ TokenType
� ImpersonationLevel ���
" DynamicCharged ���
" $ DynamicAvailable �
" ( GroupCount ���
" , PrivilegeCount ���
� 0 ModifiedId ���>
,= 8 _TOKEN_STATISTICS .?AU_TOKEN_STATISTICS@@ -= x � f � _SYSTEM_INTERRUPT_CPU_SET_INFORMATION .?AU_SYSTEM_INTERRUPT_CPU_SET_INFORMATION@@ 6
" Gsiv �
! Group
# CpuSets ��f 0= _SYSTEM_INTERRUPT_CPU_SET_INFORMATION .?AU_SYSTEM_INTERRUPT_CPU_SET_INFORMATION@@ 1= � �
� > � tagCBT_CREATEWNDA .?AUtagCBT_CREATEWNDA@@
4= .
+ lpcs �
� hwndInsertAfter ��> 6= tagCBT_CREATEWNDA .?AUtagCBT_CREATEWNDA@@ 7= U 6 � _NETRESOURCEA .?AU_NETRESOURCEA@@ �
" dwScope ��
" dwType ���
" dwDisplayType
" dwUsage ��
p lpLocalName ��
p lpRemoteName �
p lpComment
p ( lpProvider ���6 := 0 _NETRESOURCEA .?AU_NETRESOURCEA@@ ;= � d J � _BOOT_ENTROPY_NT_RESULT .?AU_BOOT_ENTROPY_NT_RESULT@@ Z � _BOOT_ENTROPY_SOURCE_NT_RESULT .?AU_BOOT_ENTROPY_SOURCE_NT_RESULT@@ �� >= " �Z
" maxEntropySources
?= EntropySourceResult ��
6 SeedBytesForCng ��J @= H_BOOT_ENTROPY_NT_RESULT .?AU_BOOT_ENTROPY_NT_RESULT@@ A= � N Z � _FILE_PIPE_EVENT_SELECT_BUFFER .?AU_FILE_PIPE_EVENT_SELECT_BUFFER@@ ��2
" EventTypes ���
# EventHandle ��Z D= _FILE_PIPE_EVENT_SELECT_BUFFER .?AU_FILE_PIPE_EVENT_SELECT_BUFFER@@ �� E= � �) �
! CurrentMachineSIDOffset ��
! CurrentMachineSIDLength ��
! NewMachineSIDOffset ��
! NewMachineSIDLength ��V G= _SD_CHANGE_MACHINE_SID_INPUT .?AU_SD_CHANGE_MACHINE_SID_INPUT@@ �� H= � �
; v � _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION .?AU_SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION@@ ��
K= # " �.
# WorkloadClass
M= CpuSets ��v N= _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION .?AU_SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION@@ �� O= � � b � _FILE_IS_REMOTE_DEVICE_INFORMATION .?AU_FILE_IS_REMOTE_DEVICE_INFORMATION@@ ��
IsRemote �b R= _FILE_IS_REMOTE_DEVICE_INFORMATION .?AU_FILE_IS_REMOTE_DEVICE_INFORMATION@@ �� S= �
:;
=! F � _STREAM_LAYOUT_ENTRY .?AU_STREAM_LAYOUT_ENTRY@@ ��
W= 2
" Version ��
" NextStreamOffset �
" Flags
" ExtentInformationOffset ��
� AllocationSize ���
� EndOfFile
" StreamInformationOffset ��
" $ AttributeTypeCode
" ( AttributeFlags ���
" , StreamIdentifierLength ���
| 0 StreamIdentifier �F Y= 8 _STREAM_LAYOUT_ENTRY .?AU_STREAM_LAYOUT_ENTRY@@ �� Z= � 4
�( > � _WMI_CONTEXTSWAP .?AU_WMI_CONTEXTSWAP@@ ��
��
��
��
��
" NewThreadId ��
" OldThreadId ��
p NewThreadPriority
p OldThreadPriority
PreviousCState ���
OldThreadRank
p NewThreadPriorityDecrement ���
p SpareByte
OldThreadWaitReason ��
^=
OldThreadWaitMode
_=
OldThreadBamQosLevel �
`=
NewThreadBamQosLevel �
a=
Reserved �
Flags
OldThreadState ���
OldThreadIdealProcessor ��
" NewThreadWaitTime
OldThreadRemainingQuantum > b= _WMI_CONTEXTSWAP .?AU_WMI_CONTEXTSWAP@@ �� c= c B � READ_FILE_USN_DATA .?AUREAD_FILE_USN_DATA@@ ��
e= :
! MinMajorVersion ��
! MaxMajorVersion ��B g= READ_FILE_USN_DATA .?AUREAD_FILE_USN_DATA@@ �� h= � �
" dwServiceType
" dwCurrentState ���
" dwControlsAccepted ���
" dwWin32ExitCode ��
" dwServiceSpecificExitCode
" dwCheckPoint �
" dwWaitHint ���
" dwProcessId ��
" dwServiceFlags ���J j= $ _SERVICE_STATUS_PROCESS .?AU_SERVICE_STATUS_PROCESS@@ k= � � B � tagEMREXTCREATEPEN .?AUtagEMREXTCREATEPEN@@ ��~
� emr ��
" ihPen
" offBmi ���
" cbBmi
" offBits ��
" cbBits ���
< elp ��B n= 8 tagEMREXTCREATEPEN .?AUtagEMREXTCREATEPEN@@ �� o= � U V � _SYSTEM_SCOPED_POLICY_ID_ACE .?AU_SYSTEM_SCOPED_POLICY_ID_ACE@@ ��:
� Header ���
" Mask �
" SidStart �V r= _SYSTEM_SCOPED_POLICY_ID_ACE .?AU_SYSTEM_SCOPED_POLICY_ID_ACE@@ �� s= x � r � JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 .?AUJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2@@ ��
# IoReadBytesLimit �
# IoWriteBytesLimit
� PerJobUserTimeLimit ��
# JobHighMemoryLimit ���
# JobMemoryLimit ���
Q RateControlTolerance �
Q CpuRateControlTolerance ��
� $ RateControlToleranceInterval �
� $ CpuRateControlToleranceInterval ��
" ( LimitFlags ���
Q , IoRateControlTolerance ���
# 0 JobLowMemoryLimit
� 8 IoRateControlToleranceInterval ���
Q < NetRateControlTolerance ��
� @ NetRateControlToleranceInterval ��r v= H JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 .?AUJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2@@ �� w= ? � Z � _SE_SET_FILE_CACHE_INFORMATION .?AU_SE_SET_FILE_CACHE_INFORMATION@@ ��
y= 2
" Size �
CatalogDirectoryPath �Z {= _SE_SET_FILE_CACHE_INFORMATION .?AU_SE_SET_FILE_CACHE_INFORMATION@@ �� |= � � > � tagLASTINPUTINFO .?AUtagLASTINPUTINFO@@ ��
~= *
u cbSize ���
" dwTime ���> �= tagLASTINPUTINFO .?AUtagLASTINPUTINFO@@ �� �= �
�# R � _SYSTEM_POLICY_INFORMATION .?AU_SYSTEM_POLICY_INFORMATION@@ ��v
InputData
OutputData ���
" InputDataSize
" OutputDataSize ���
" Version ��R �= _SYSTEM_POLICY_INFORMATION .?AU_SYSTEM_POLICY_INFORMATION@@ �� �= � R
R � _CONTAINER_ROOT_INFO_INPUT .?AU_CONTAINER_ROOT_INFO_INPUT@@ ��
�=
" Flags R �= _CONTAINER_ROOT_INFO_INPUT .?AU_CONTAINER_ROOT_INFO_INPUT@@ �� �= � �"
.
+=
{ ��
�= N � _SYSTEM_AUDIT_OBJECT_ACE .?AU_SYSTEM_AUDIT_OBJECT_ACE@@ ��
� Header ���
" Mask �
" Flags
ObjectType ���
InheritedObjectType ��
" , SidStart �N �= 0 _SYSTEM_AUDIT_OBJECT_ACE .?AU_SYSTEM_AUDIT_OBJECT_ACE@@ �� �= x � > � tagNEWTEXTMETRICA .?AUtagNEWTEXTMETRICA@@
�= F
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
, tmFirstChar ��
- tmLastChar ���
. tmDefaultChar
/ tmBreakChar ��
0 tmItalic �
1 tmUnderlined �
2 tmStruckOut ��
3 tmPitchAndFamily �
4 tmCharSet
" 8 ntmFlags �
u < ntmSizeEM
u @ ntmCellHeight
u D ntmAvgWidth ��> �= H tagNEWTEXTMETRICA .?AUtagNEWTEXTMETRICA@@ �= � �
�
x, B � USN_JOURNAL_DATA_V1 .?AUUSN_JOURNAL_DATA_V1@@
�= �
# UsnJournalID �
FirstUsn �
NextUsn ��
LowestValidUsn ���
MaxUsn ���
# ( MaximumSize ��
# 0 AllocationDelta ��
! 8 MinSupportedMajorVersion �
! : MaxSupportedMajorVersion �B �= @ USN_JOURNAL_DATA_V1 .?AUUSN_JOURNAL_DATA_V1@@ �= � � B � USN_JOURNAL_DATA_V2 .?AUUSN_JOURNAL_DATA_V2@@
�= F
# UsnJournalID �
FirstUsn �
NextUsn ��
LowestValidUsn ���
MaxUsn ���
# ( MaximumSize ��
# 0 AllocationDelta ��
! 8 MinSupportedMajorVersion �
! : MaxSupportedMajorVersion �
" < Flags
# @ RangeTrackChunkSize ��
H RangeTrackFileSizeThreshold ��B �= P USN_JOURNAL_DATA_V2 .?AUUSN_JOURNAL_DATA_V2@@ �= � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" Flags
�= EnableUserShadowStack
�= AuditUserShadowStack �
�= SetContextIpValidation ���
�= AuditSetContextIpValidation ��
�= EnableUserShadowStackStrictMode ��
�= BlockNonCetBinaries ��
�= BlockNonCetBinariesNonEhcont �
�= AuditBlockNonCetBinaries �
�= CetDynamicApisOutOfProcOnly ��
�= SetContextIpValidationRelaxedMode
�= ReservedFlags v �= _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY@@ �� �= ? J � _CONTAINER_VOLUME_STATE .?AU_CONTAINER_VOLUME_STATE@@
" Flags J �= _CONTAINER_VOLUME_STATE .?AU_CONTAINER_VOLUME_STATE@@ �= � �" > � MFT_ENUM_DATA_V0 .?AUMFT_ENUM_DATA_V0@@ ��
�= N
# StartFileReferenceNumber �
LowUsn ���
HighUsn ��> �= MFT_ENUM_DATA_V0 .?AUMFT_ENUM_DATA_V0@@ �� �= � �
/
� 6 � tagENUMUILANG .?AUtagENUMUILANG@@ V
" NumOfEnumUILang ��
" SizeOfEnumUIBuffer ���
q pEnumUIBuffer 6 �= tagENUMUILANG .?AUtagENUMUILANG@@ �= � ( J � _EVENT_FILTER_EVENT_ID .?AU_EVENT_FILTER_EVENT_ID@@ �� ! " �N
FilterIn �
Reserved �
! Count
�= Events ���J �= _EVENT_FILTER_EVENT_ID .?AU_EVENT_FILTER_EVENT_ID@@ �� �= > c
Y Z � _ACTIVATION_CONTEXT_QUERY_INDEX .?AU_ACTIVATION_CONTEXT_QUERY_INDEX@@
�= >
" ulAssemblyIndex ��
" ulFileIndexInAssembly Z �= _ACTIVATION_CONTEXT_QUERY_INDEX .?AU_ACTIVATION_CONTEXT_QUERY_INDEX@@ �= � a N � _IMAGE_IMPORT_DESCRIPTOR .?AU_IMAGE_IMPORT_DESCRIPTOR@@ ��
�= ��
�= �
" Characteristics ��
" OriginalFirstThunk ���
" TimeDateStamp
" ForwarderChain ���
" Name �
" FirstThunk ���N �= _IMAGE_IMPORT_DESCRIPTOR .?AU_IMAGE_IMPORT_DESCRIPTOR@@ �� �= � � V � tagPOINTER_DEVICE_CURSOR_INFO .?AUtagPOINTER_DEVICE_CURSOR_INFO@@ � POINTER_DEVICE_CURSOR_TYPE_UNKNOWN ��� POINTER_DEVICE_CURSOR_TYPE_TIP ��� POINTER_DEVICE_CURSOR_TYPE_ERASER ��POINTER_DEVICE_CURSOR_TYPE_MAX ��R t �= tagPOINTER_DEVICE_CURSOR_TYPE .?AW4tagPOINTER_DEVICE_CURSOR_TYPE@@ � �= �; *
u cursorId �
�= cursor ���V �= tagPOINTER_DEVICE_CURSOR_INFO .?AUtagPOINTER_DEVICE_CURSOR_INFO@@ �= �; V � _SYSTEM_INTERRUPT_INFORMATION .?AU_SYSTEM_INTERRUPT_INFORMATION@@ �
" ContextSwitches ��
" DpcCount �
" DpcRate ��
" TimeIncrement
" DpcBypassCount ���
" ApcBypassCount ���V �= _SYSTEM_INTERRUPT_INFORMATION .?AU_SYSTEM_INTERRUPT_INFORMATION@@ �= � �
N � _PS_CPU_QUOTA_QUERY_ENTRY .?AU_PS_CPU_QUOTA_QUERY_ENTRY@@
�= *
" SessionId
" Weight ���N �= _PS_CPU_QUOTA_QUERY_ENTRY .?AU_PS_CPU_QUOTA_QUERY_ENTRY@@ �= �
�+ F � _HEAP_COMMIT_DECOMMIT .?AU_HEAP_COMMIT_DECOMMIT@@ &
j Header ���
Event F �= @ _HEAP_COMMIT_DECOMMIT .?AU_HEAP_COMMIT_DECOMMIT@@ �= c 1
" B � _RTL_GENERIC_TABLE .?AU_RTL_GENERIC_TABLE@@ ��
�= �= �$ �=
�= �= " �=
�= �= �=
�= �
^ TableRoot
InsertOrderList ��
C OrderedPointer ���
" WhichOrderedElement ��
" $ NumberGenericTableElements ���
�= ( CompareRoutine ���
�= 0 AllocateRoutine ��
�= 8 FreeRoutine ��
@ TableContext �B �= H _RTL_GENERIC_TABLE .?AU_RTL_GENERIC_TABLE@@ �� �= b �
�. "
#$ fsUsb
$$ fsCsb > �= tagFONTSIGNATURE .?AUtagFONTSIGNATURE@@ �� �= � � : � _FILE_PREFETCH .?AU_FILE_PREFETCH@@ ��6
" Type �
" Count
0 Prefetch �: �= _FILE_PREFETCH .?AU_FILE_PREFETCH@@ �� �= � � R � _SILOOBJECT_ROOT_DIRECTORY .?AU_SILOOBJECT_ROOT_DIRECTORY@@ ��
> *
" ControlFlags �
Path �R > _SILOOBJECT_ROOT_DIRECTORY .?AU_SILOOBJECT_ROOT_DIRECTORY@@ �� > ? � b � _ACCESS_DENIED_CALLBACK_OBJECT_ACE .?AU_ACCESS_DENIED_CALLBACK_OBJECT_ACE@@ ��
� Header ���
" Mask �
" Flags
ObjectType ���
InheritedObjectType ��
" , SidStart �b > 0 _ACCESS_DENIED_CALLBACK_OBJECT_ACE .?AU_ACCESS_DENIED_CALLBACK_OBJECT_ACE@@ �� > x b � _MIDL_WINRT_TYPE_SERIALIZATION_INFO .?AU_MIDL_WINRT_TYPE_SERIALIZATION_INFO@@ z
" Version ��
Q TypeFormatString �
! FormatStringSize �
! TypeOffset ���
j( StubDesc �b
> _MIDL_WINRT_TYPE_SERIALIZATION_INFO .?AU_MIDL_WINRT_TYPE_SERIALIZATION_INFO@@ > � � > � _PSFEATURE_OUTPUT .?AU_PSFEATURE_OUTPUT@@
> :
t bPageIndependent �
t bSetPageDevice ���> > _PSFEATURE_OUTPUT .?AU_PSFEATURE_OUTPUT@@ > �
� 6 � tagSCROLLINFO .?AUtagSCROLLINFO@@ z
u cbSize ���
u fMask
t nMin �
t nMax �
u nPage
t nPos �
t nTrackPos 6 > tagSCROLLINFO .?AUtagSCROLLINFO@@ > �. " �&
" Count
> BindingH �B > _RPC_BINDING_VECTOR .?AU_RPC_BINDING_VECTOR@@ > _ _ N � _FSCTL_OFFLOAD_READ_INPUT .?AU_FSCTL_OFFLOAD_READ_INPUT@@ �
" Size �
" Flags
" TokenTimeToLive ��
" Reserved �
# FileOffset ���
# CopyLength ���N > _FSCTL_OFFLOAD_READ_INPUT .?AU_FSCTL_OFFLOAD_READ_INPUT@@ > � �
>5 n � _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS .?AU_SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS@@
KeyHandle
v ValueNamePointer �
" RequiredLengthPointer
Buffer ���
" BufferLength �
" $ Type �
( AppendBuffer �
" 0 AppendBufferLength ���
4 CreateIfDoesntExist ��
5 TruncateExistingValue n
!> 8 _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS .?AU_SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS@@ "> � �
�
" Reserved �F %> _SD_QUERY_STATS_INPUT .?AU_SD_QUERY_STATS_INPUT@@ &> � � F � _FILE_ALL_INFORMATION .?AU_FILE_ALL_INFORMATION@@
(> J � _FILE_BASIC_INFORMATION .?AU_FILE_BASIC_INFORMATION@@ R � _FILE_POSITION_INFORMATION .?AU_FILE_POSITION_INFORMATION@@ ��
*> BasicInformation �
�2 ( StandardInformation ��
�( @ InternalInformation ��
� H EaInformation
A L AccessInformation
+> P PositionInformation ��
G X ModeInformation ��
�" \ AlignmentInformation �
�9 ` NameInformation ��F ,> h _FILE_ALL_INFORMATION .?AU_FILE_ALL_INFORMATION@@ -> � F � CM_EXTENDED_PARAMETER .?AUCM_EXTENDED_PARAMETER@@
/>
# ��
# 8��
1> Type �
2> Reserved �
# ULong64 ��
Pointer ��
# Size �
Handle ���
" ULong
" AccessMask ���F 3> CM_EXTENDED_PARAMETER .?AUCM_EXTENDED_PARAMETER@@ 4> � 6 � _BOOT_RECORD .?AU_BOOT_RECORD@@ ��
# BootFlags
" FirmwareType �
SecureBootEnabled
SecureBootCapable
Reserved1
Reserved2 6 7> _BOOT_RECORD .?AU_BOOT_RECORD@@ �� 8> c � . � _OBJECTID .?AU_OBJECTID@@ .
Lineage ��
" Uniquifier ���. ;> _OBJECTID .?AU_OBJECTID@@ <> b u t >>
?>
@> A>
B>
~ MemoryLocationInvalid MemoryLocationResident ��� MemoryLocationPagefile ��� MemoryLocationReserved ���V t E> _MEMORY_WORKING_SET_EX_LOCATION .?AW4_MEMORY_WORKING_SET_EX_LOCATION@@ � F> t C V � _FILE_END_OF_FILE_INFORMATION .?AU_FILE_END_OF_FILE_INFORMATION@@
� EndOfFile V I> _FILE_END_OF_FILE_INFORMATION .?AU_FILE_END_OF_FILE_INFORMATION@@ J> � � V � _UMS_CREATE_THREAD_ATTRIBUTES .?AU_UMS_CREATE_THREAD_ATTRIBUTES@@
L> �
" UmsVersion ���
� RtlUmsContext
UmsContext ���
� RtlUmsCompletionList �
UmsCompletionList V N> _UMS_CREATE_THREAD_ATTRIBUTES .?AU_UMS_CREATE_THREAD_ATTRIBUTES@@ O> ? R > � _IMAGE_DEBUG_MISC .?AU_IMAGE_DEBUG_MISC@@ b
" DataType �
" Length ���
Unicode ��
- Reserved �
� Data �> R> _IMAGE_DEBUG_MISC .?AU_IMAGE_DEBUG_MISC@@ S> � � b � _PERFINFO_DPC_EXECUTION_INFORMATION .?AU_PERFINFO_DPC_EXECUTION_INFORMATION@@ *
DpcRoutine ���
# Key ��b V> _PERFINFO_DPC_EXECUTION_INFORMATION .?AU_PERFINFO_DPC_EXECUTION_INFORMATION@@ W> c � *
" Frequency
" Power
PercentFrequency �
IncreaseLevel
DecreaseLevel
Type �
" IncreaseTime �
" DecreaseTime �
# Control ��
# Status ���
" ( HitCount �
" , Reserved1
# 0 Reserved2
# 8 Reserved3 B Y> @ PPM_WMI_PERF_STATE .?AUPPM_WMI_PERF_STATE@@ �� Z> x � > � tagMONITORINFOEXA .?AUtagMONITORINFOEXA@@
\> f
" cbSize ���
! rcMonitor
! rcWork ���
" $ dwFlags ��
|" ( szDevice �> ^> H tagMONITORINFOEXA .?AUtagMONITORINFOEXA@@ _> �4 p a>
b> F � _PO_WAKE_SOURCE_TIMER .?AU_PO_WAKE_SOURCE_TIMER@@ J � _PO_WAKE_SOURCE_HEADER .?AU_PO_WAKE_SOURCE_HEADER@@ ��*
e> Header ���
o+ Reason ���F f> 0 _PO_WAKE_SOURCE_TIMER .?AU_PO_WAKE_SOURCE_TIMER@@ g> x .
g&
�6 �
R4 pointerInfo ��
u ` penFlags �
u d penMask ��
u h pressure �
u l rotation �
t p tiltX
t t tiltY B k> x tagPOINTER_PEN_INFO .?AUtagPOINTER_PEN_INFO@@ l> � R � _PROCESS_FAULT_INFORMATION .?AU_PROCESS_FAULT_INFORMATION@@ ��
n> 6
" FaultFlags ���
" AdditionalInfo ���R p> _PROCESS_FAULT_INFORMATION .?AU_PROCESS_FAULT_INFORMATION@@ �� q> � ` 6 � _SYSTEM_INFO .?AU_SYSTEM_INFO@@ ��r
" dwOemId ��
! wProcessorArchitecture ���
! wReserved
" dwPageSize ���
lpMinimumApplicationAddress ��
lpMaximumApplicationAddress ��
# dwActiveProcessorMask
" dwNumberOfProcessors �
" $ dwProcessorType ��
" ( dwAllocationGranularity ��
! , wProcessorLevel ��
! . wProcessorRevision ���6 t> 0 _SYSTEM_INFO .?AU_SYSTEM_INFO@@ �� u> � / Z � _MANAGE_HOT_PATCH_UNLOAD_PATCH .?AU_MANAGE_HOT_PATCH_UNLOAD_PATCH@@ ��
w> &
T Sid ��
� Buffer ���2 y> D <anonymous-tag> .?AT<anonymous-tag>@@ z> t } >
" Version ��
./ BaseInfo �
z> UserSid ��Z |> P _MANAGE_HOT_PATCH_UNLOAD_PATCH .?AU_MANAGE_HOT_PATCH_UNLOAD_PATCH@@ �� }> t o
�
# ��
# ��
# ��
# <��
# ��
# ��
# ��
# <���
�> AuditState ���
�> AuditFlag
�> EnableAdditionalAuditingOption ���
�> Reserved �
�> PolicyState ��
�> AlwaysInherit
�> EnableAdditionalPolicyOption �
�> AuditReserved N �> _RTL_IMAGE_MITIGATION_POLICY .?AT_RTL_IMAGE_MITIGATION_POLICY@@ �� �> � C S > � tagGUITHREADINFO .?AUtagGUITHREADINFO@@ ���
" cbSize ���
" flags
� hwndActive ���
� hwndFocus
� hwndCapture ��
� hwndMenuOwner
� ( hwndMoveSize �
� 0 hwndCaret
! 8 rcCaret ��> �> H tagGUITHREADINFO .?AUtagGUITHREADINFO@@ �� �> �7 : f � _CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT .?AU_CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT@@ b
# VetoedFromAltitudeIntegral ���
# VetoedFromAltitudeDecimal
� Reason ���f �> _CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT .?AU_CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT@@ �> � R � _RTL_RETPOLINE_BINARY_INFO .?AU_RTL_RETPOLINE_BINARY_INFO@@ ��
�> " %
�> �
RetpolineStubsStartRva ���
" CfgDispatchFunctionPtrRva
" IATRva ���
ImportRvas ���
# IAT ��
ImageBase
�> ( CheckFunction R �> 0 _RTL_RETPOLINE_BINARY_INFO .?AU_RTL_RETPOLINE_BINARY_INFO@@ �� �> H J � _REARRANGE_FILE_DATA32 .?AU_REARRANGE_FILE_DATA32@@ ��
�> z
# SourceStartingOffset �
# TargetOffset �
u SourceFileHandle �
" Length ���
" Flags J �> _REARRANGE_FILE_DATA32 .?AU_REARRANGE_FILE_DATA32@@ �� �> � 6( f � _JOBOBJECT_ASSOCIATE_COMPLETION_PORT .?AU_JOBOBJECT_ASSOCIATE_COMPLETION_PORT@@ ��
�> 6
CompletionKey
CompletionPort ���f �> _JOBOBJECT_ASSOCIATE_COMPLETION_PORT .?AU_JOBOBJECT_ASSOCIATE_COMPLETION_PORT@@ �� �> ? �
?- M
�>
*> �
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
" FileAttributes ���J �> ( _FILE_BASIC_INFORMATION .?AU_FILE_BASIC_INFORMATION@@ �> � � ! �>
�> n
" SessionId
" CpuShareWeight ���
CapturedWeightData ���
# CyclesAccumulated J �> _ETW_PER_SESSION_QUOTA .?AU_ETW_PER_SESSION_QUOTA@@ �� �> c (
6 � tagDROPSTRUCT .?AUtagDROPSTRUCT@@
�> ~
� hwndSource ���
� hwndSink �
" wFmt �
# dwData ���
� ptDrop ���
" ( dwControlData 6 �> 0 tagDROPSTRUCT .?AUtagDROPSTRUCT@@ �> g N � _MEMORY_BASIC_INFORMATION .?AU_MEMORY_BASIC_INFORMATION@@
�> �
BaseAddress ��
AllocationBase ���
" AllocationProtect
! PartitionId ��
# RegionSize ���
" State
" $ Protect ��
" ( Type �N �> 0 _MEMORY_BASIC_INFORMATION .?AU_MEMORY_BASIC_INFORMATION@@ �> � P j � _EVENT_TRACE_STACK_CACHING_INFORMATION .?AU_EVENT_TRACE_STACK_CACHING_INFORMATION@@ ��
@ EventTraceInformationClass ���
# TraceHandle ��
Enabled ��
- Reserved �
" CacheSize
" BucketCount ��j �> _EVENT_TRACE_STACK_CACHING_INFORMATION .?AU_EVENT_TRACE_STACK_CACHING_INFORMATION@@ �� �> A N
& :
# Value
" EndTime ��
" Bitmap ���6 �> _TIMELINE_BITMAP .?AT_TIMELINE_BITMAP@@ �� �> � �
�= F � ANON_OBJECT_HEADER_V2 .?AUANON_OBJECT_HEADER_V2@@ �
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
ClassID ��
" SizeOfData ���
" Flags
" $ MetaDataSize �
" ( MetaDataOffset ���F
�> , ANON_OBJECT_HEADER_V2 .?AUANON_OBJECT_HEADER_V2@@ �> � �
B � tagEMREXTFLOODFILL .?AUtagEMREXTFLOODFILL@@ ��
�> J
� emr ��
� ptlStart �
" crColor ��
" iMode B �> tagEMREXTFLOODFILL .?AUtagEMREXTFLOODFILL@@ �� �> � V � _PROCESS_WS_WATCH_INFORMATION .?AU_PROCESS_WS_WATCH_INFORMATION@@
�> 2
FaultingPc ���
FaultingVa ���V �> _PROCESS_WS_WATCH_INFORMATION .?AU_PROCESS_WS_WATCH_INFORMATION@@ �> ? �
�4
! Size �
! HeaderType ���
! Flags
! EventProperty
" ThreadId �
" ProcessId
� TimeStamp
ProviderId ���
@ ( EventDescriptor ��
" 8 KernelTime ���
" < UserTime �
# 8 ProcessorTime
@ ActivityId ���6
�> P _EVENT_HEADER .?AU_EVENT_HEADER@@ �> V � � � �>
i4
� �
! UniqueProcessId ��
! CreatorBackTraceIndex
ObjectTypeIndex ��
HandleAttributes �
! HandleValue ��
Object ���
" GrantedAccess Z �> _SYSTEM_HANDLE_TABLE_ENTRY_INFO .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO@@ �> � R � _SYSTEM_POWER_STATE_CONTEXT .?AU_SYSTEM_POWER_STATE_CONTEXT@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�> Reserved1
�> TargetSystemState
�> EffectiveSystemState �
�> CurrentSystemState ���
�> IgnoreHibernationPath
�> PseudoTransition �
�> KernelSoftReboot �
�> DirectedDripsTransition ��
�> Reserved2
" ContextAsUlong ���R
�> _SYSTEM_POWER_STATE_CONTEXT .?AU_SYSTEM_POWER_STATE_CONTEXT@@ �> x � ^ � _CSV_QUERY_VOLUME_REDIRECT_STATE .?AU_CSV_QUERY_VOLUME_REDIRECT_STATE@@ ��
" MdsNodeId
" DsNodeId �
IsDiskConnected ��
ClusterEnableDirectIo
$# DiskConnectivity �^ �> _CSV_QUERY_VOLUME_REDIRECT_STATE .?AU_CSV_QUERY_VOLUME_REDIRECT_STATE@@ �� �> � �
&
4= B � tagEMRSETTEXTCOLOR .?AUtagEMRSETTEXTCOLOR@@ ��&
� emr ��
" crColor ��B �> tagEMRSETTEXTCOLOR .?AUtagEMRSETTEXTCOLOR@@ �� �> � �
g% F
t valuelen �
value_context
val_buff_ptr �2 �> val_context .?AUval_context@@ �> � � V � _REPAIR_STORAGE_RESERVE_INPUT .?AU_REPAIR_STORAGE_RESERVE_INPUT@@ j
" Version ��
" Flags
" AreaIdOffset �
" AreaIdCount ��
t AreaId ���V �> _REPAIR_STORAGE_RESERVE_INPUT .?AU_REPAIR_STORAGE_RESERVE_INPUT@@ �> � <+ . � _ABCFLOAT .?AU_ABCFLOAT@@ 2
@ abcfA
@ abcfB
@ abcfC .
? _ABCFLOAT .?AU_ABCFLOAT@@ ? � � F
� type �
u size �
� adapterId
u id ���^ ? DISPLAYCONFIG_DEVICE_INFO_HEADER .?AUDISPLAYCONFIG_DEVICE_INFO_HEADER@@ �� ? � � ^ � _CFG_CALL_TARGET_LIST_INFORMATION .?AU_CFG_CALL_TARGET_LIST_INFORMATION@@
? F � _CFG_CALL_TARGET_INFO .?AU_CFG_CALL_TARGET_INFO@@
? �
" NumberOfEntries ��
" Reserved �
" NumberOfEntriesProcessed �
? CallTargetInfo ���
Section ��
# FileOffset ���^
? ( _CFG_CALL_TARGET_LIST_INFORMATION .?AU_CFG_CALL_TARGET_LIST_INFORMATION@@ ? � � J � BREAK_ON_STATUS_BUFFER .?AUBREAK_ON_STATUS_BUFFER@@ ��
? p " �n
NtStatus �
" Win32Error ���
" ThreadId �
" ProcessId
? ImageFileName J ? BREAK_ON_STATUS_BUFFER .?AUBREAK_ON_STATUS_BUFFER@@ �� ? � �
�' n � _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY@@
? �
# Offset ���
" NameFlags
FileId ���
" Reserved1
" Reserved2
Reserved3
| ( FileName �n ? 0 _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY@@ ? � �
" ��
" ��
" ��z
" Flags
? DisallowWin32kSystemCalls
? AuditDisallowWin32kSystemCalls ���
? ReservedFlags z ? _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ �� ? ? c Z � _ETW_TP_EVENT_TIMER_SET_NTTIMER .?AU_ETW_TP_EVENT_TIMER_SET_NTTIMER@@ Z
j Header ���
DueTime ��
( SubQueue �
" 0 TolerableDelay ���Z ? 4 _ETW_TP_EVENT_TIMER_SET_NTTIMER .?AU_ETW_TP_EVENT_TIMER_SET_NTTIMER@@ !? c &
"0 Z � _POWER_THROTTLING_PROCESS_STATE .?AU_POWER_THROTTLING_PROCESS_STATE@@ B
" Version ��
" ControlMask ��
" StateMask Z %? _POWER_THROTTLING_PROCESS_STATE .?AU_POWER_THROTTLING_PROCESS_STATE@@ &? ? � ^ � _EVENT_EXTENDED_ITEM_PMC_COUNTERS .?AU_EVENT_EXTENDED_ITEM_PMC_COUNTERS@@
M= Counter ��^ )? _EVENT_EXTENDED_ITEM_PMC_COUNTERS .?AU_EVENT_EXTENDED_ITEM_PMC_COUNTERS@@ *? V v V � _SYSTEM_VHD_BOOT_INFORMATION .?AU_SYSTEM_VHD_BOOT_INFORMATION@@ ��V
OsDiskIsVhd ��
" OsVhdFilePathOffset ��
| OsVhdParentVolume V -? _SYSTEM_VHD_BOOT_INFORMATION .?AU_SYSTEM_VHD_BOOT_INFORMATION@@ �� .? � �
J � _PERFINFO_PO_POSTSLEEP .?AU_PERFINFO_PO_POSTSLEEP@@ ��
0? "
� PerformanceCounter ���J 2? _PERFINFO_PO_POSTSLEEP .?AU_PERFINFO_PO_POSTSLEEP@@ �� 3? c �
J& ^ � _PROCESS_WS_WATCH_INFORMATION_EX .?AU_PROCESS_WS_WATCH_INFORMATION_EX@@ ��B
�> BasicInfo
# FaultingThreadId �
# Flags ^ 7? _PROCESS_WS_WATCH_INFORMATION_EX .?AU_PROCESS_WS_WATCH_INFORMATION_EX@@ �� 8? � � Z � _PERFINFO_FLT_OPERATION_STATUS .?AU_PERFINFO_FLT_OPERATION_STATUS@@ ��
RoutineAddr ��
FileObject ���
FsContext
IrpPtr ���
CbdPtr ���
( MajorFunction
, Status ���Z ;? 0 _PERFINFO_FLT_OPERATION_STATUS .?AU_PERFINFO_FLT_OPERATION_STATUS@@ �� <? c � v � _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION .?AU_SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION@@ ��
Enabled ��v ?? _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION .?AU_SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION@@ �� @? � [ * � _FP_128 .?AU_FP_128@@
� W * C? _FP_128 .?AU_FP_128@@ D? � B 2 � tagPELARRAY .?AUtagPELARRAY@@
F? f
paXCount �
paYCount �
paXExt ���
paYExt ���
paRGBs ���2 H? tagPELARRAY .?AUtagPELARRAY@@ I? � ; : � _BOOT_AREA_INFO .?AU_BOOT_AREA_INFO@@
� Offset ���: L? <anonymous-tag> .?AU<anonymous-tag>@@ M? � > M? " �6
" BootSectorCount ��
O? BootSectors ��: P? _BOOT_AREA_INFO .?AU_BOOT_AREA_INFO@@ Q? � ;
: � _PRIVILEGE_SET .?AU_PRIVILEGE_SET@@ ��
T? �' " �F
" PrivilegeCount ���
" Control ��
V? Privilege : W? _PRIVILEGE_SET .?AU_PRIVILEGE_SET@@ �� X? x � b � _PERFINFO_SESSIONCREATE_INFORMATION .?AU_PERFINFO_SESSIONCREATE_INFORMATION@@ 2
# UniqueSessionId ��
" SessionId b [? _PERFINFO_SESSIONCREATE_INFORMATION .?AU_PERFINFO_SESSIONCREATE_INFORMATION@@ \? c �
8
�
<+ N � _RTL_UNLOAD_EVENT_TRACE64 .?AU_RTL_UNLOAD_EVENT_TRACE64@@ �
# BaseAddress ��
# SizeOfImage ��
" Sequence �
" TimeDateStamp
" CheckSum �
ImageName
8 \ Version ��N b? h _RTL_UNLOAD_EVENT_TRACE64 .?AU_RTL_UNLOAD_EVENT_TRACE64@@ c? � � Z � _FILE_PIPE_CREATE_SYMLINK_INPUT .?AU_FILE_PIPE_CREATE_SYMLINK_INPUT@@
e? �
! NameOffset ���
! NameLength ���
! SubstituteNameOffset �
! SubstituteNameLength �
" Flags Z g? _FILE_PIPE_CREATE_SYMLINK_INPUT .?AU_FILE_PIPE_CREATE_SYMLINK_INPUT@@ h? � x) J � _LDR_VERIFY_IMAGE_INFO .?AU_LDR_VERIFY_IMAGE_INFO@@ ��N � _LDR_IMPORT_CALLBACK_INFO .?AU_LDR_IMPORT_CALLBACK_INFO@@ r
" Size �
" Flags
k? CallbackInfo �
t SectionInfo ��
! 8 ImageCharacteristics �J l? @ _LDR_VERIFY_IMAGE_INFO .?AU_LDR_VERIFY_IMAGE_INFO@@ �� m? � � 6
! CodePage �
! MaximumCharacterSize �
! DefaultChar ��
! UniDefaultChar ���
! TransDefaultChar �
!
TransUniDefaultChar ��
! DBCSCodePage �
q LeadByte �
q MultiByteTable ���
( WideCharTable
q 0 DBCSRanges ���
q 8 DBCSOffsets ��6 o? @ _CPTABLEINFO .?AU_CPTABLEINFO@@ �� p? n- $
�:
(9
u t t?
8%
" # " 0 �B
# Mask �
# CompactionMask ���
x? Reserved2 B y? @ _XSAVE_AREA_HEADER .?AU_XSAVE_AREA_HEADER@@ �� z? L
�> V � tagTouchPredictionParameters .?AUtagTouchPredictionParameters@@ ��^
u cbSize ���
u dwLatency
u dwSampleTime �
u bUseHWTimeStamp ��V ~? tagTouchPredictionParameters .?AUtagTouchPredictionParameters@@ �� ? �0 b � _SYSTEM_WATCHDOG_TIMER_INFORMATION .?AU_SYSTEM_WATCHDOG_TIMER_INFORMATION@@ ��.
# WdInfoClass ��
" DataValue b �? _SYSTEM_WATCHDOG_TIMER_INFORMATION .?AU_SYSTEM_WATCHDOG_TIMER_INFORMATION@@ �� �? � M
V � _FILE_VOLUME_NAME_INFORMATION .?AU_FILE_VOLUME_NAME_INFORMATION@@
�? 6
" DeviceNameLength �
| DeviceName ���V �? _FILE_VOLUME_NAME_INFORMATION .?AU_FILE_VOLUME_NAME_INFORMATION@@ �? � �
�
�2
�4
a- ^- " �? " �?
�? � � � �? f � _SYSTEM_CRASH_DUMP_STATE_INFORMATION .?AU_SYSTEM_CRASH_DUMP_STATE_INFORMATION@@ ��*
J" CrashDumpConfigurationClass ��f �? _SYSTEM_CRASH_DUMP_STATE_INFORMATION .?AU_SYSTEM_CRASH_DUMP_STATE_INFORMATION@@ �� �? � ,
�* �? " �?
�? ^
! wVk ��
! wScan
" dwFlags ��
" time �
# dwExtraInfo ��6 �? tagKEYBDINPUT .?AUtagKEYBDINPUT@@ �? �
2
�1 N � _IMAGE_CHPE_METADATA_X86 .?AU_IMAGE_CHPE_METADATA_X86@@ ��
" Version ��
" CHPECodeAddressRangeOffset ���
" CHPECodeAddressRangeCount
" WowA64ExceptionHandlerFunctionPointer
" WowA64DispatchCallFunctionPointer
" WowA64DispatchIndirectCallFunctionPointer
" WowA64DispatchIndirectCallCfgFunctionPointer �
" WowA64DispatchRetFunctionPointer �
" WowA64DispatchRetLeafFunctionPointer �
" $ WowA64DispatchJumpFunctionPointer
" ( CompilerIATPointer ���
" , WowA64RdtscFunctionPointer ���N �? 0 _IMAGE_CHPE_METADATA_X86 .?AU_IMAGE_CHPE_METADATA_X86@@ �� �? � g
�; PfnIdentity ��> �? _MM_ETW_PAGE_INFO .?AU_MM_ETW_PAGE_INFO@@ �? t O
t �? J � _PO_WAKE_SOURCE_DEVICE .?AU_PO_WAKE_SOURCE_DEVICE@@ ��.
e> Header ���
| InstancePath �J �? _PO_WAKE_SOURCE_DEVICE .?AU_PO_WAKE_SOURCE_DEVICE@@ �� �? x
= �
Header ���
" 0 InstanceId ���
" 4 ParentInstanceId �
8 ParentGuid ���
H MofData ��
" P MofLength
" T ClientContext
Q T BufferContext 6 �? X _EVENT_TRACE .?AU_EVENT_TRACE@@ �� �? � N � _RTL_UNLOAD_EVENT_TRACE32 .?AU_RTL_UNLOAD_EVENT_TRACE32@@ �
" BaseAddress ��
" SizeOfImage ��
" Sequence �
" TimeDateStamp
" CheckSum �
ImageName
8 T Version ��N �? \ _RTL_UNLOAD_EVENT_TRACE32 .?AU_RTL_UNLOAD_EVENT_TRACE32@@ �? � � N � _SYSTEM_BASIC_INFORMATION .?AU_SYSTEM_BASIC_INFORMATION@@ ^
" Reserved �
" TimerResolution ��
" PageSize �
" NumberOfPhysicalPages
" LowestPhysicalPageNumber �
" HighestPhysicalPageNumber
" AllocationGranularity
# MinimumUserModeAddress ���
# ( MaximumUserModeAddress ���
# 0 ActiveProcessorsAffinityMask �
p 8 NumberOfProcessors ���N �? @ _SYSTEM_BASIC_INFORMATION .?AU_SYSTEM_BASIC_INFORMATION@@ �? � � J � MENUITEMTEMPLATEHEADER .?AUMENUITEMTEMPLATEHEADER@@ ��
�? .
! versionNumber
! offset ���J �? MENUITEMTEMPLATEHEADER .?AUMENUITEMTEMPLATEHEADER@@ �� �? �(
{) * IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF ��B t �? IMAGE_AUX_SYMBOL_TYPE .?AW4IMAGE_AUX_SYMBOL_TYPE@@ � �? � [ � " �R
! Version ��
! Revision �
" Count
�? Descriptors ��> �? ( _IO_RESOURCE_LIST .?AU_IO_RESOURCE_LIST@@ �?
�(
�?
l&
� n ��DPI_HOSTING_BEHAVIOR_INVALID DPI_HOSTING_BEHAVIOR_DEFAULT � DPI_HOSTING_BEHAVIOR_MIXED ���B t �? DPI_HOSTING_BEHAVIOR .?AW4DPI_HOSTING_BEHAVIOR@@ ��� �? t N � _QUERY_BAD_RANGES_OUTPUT .?AU_QUERY_BAD_RANGES_OUTPUT@@ �� �% " �^
" Flags
" NumBadRanges �
# NextOffsetToLookUp ���
�? BadRanges N �? ( _QUERY_BAD_RANGES_OUTPUT .?AU_QUERY_BAD_RANGES_OUTPUT@@ �� �? � S!
�
�< N � _SYSTEM_ACCESS_FILTER_ACE .?AU_SYSTEM_ACCESS_FILTER_ACE@@
�? :
� Header ���
" Mask �
" SidStart �N �? _SYSTEM_ACCESS_FILTER_ACE .?AU_SYSTEM_ACCESS_FILTER_ACE@@ �? x � F � _COMPRESSED_DATA_INFO .?AU_COMPRESSED_DATA_INFO@@ �
! CompressionFormatAndEngine ���
CompressionUnitShift �
ChunkShift ���
ClusterShift �
Reserved �
! NumberOfChunks ���
� CompressedChunkSizes �F �? _COMPRESSED_DATA_INFO .?AU_COMPRESSED_DATA_INFO@@ �? b �
- �?
>: Z � _ENCLAVE_CREATE_INFO_VBS_BASIC .?AU_ENCLAVE_CREATE_INFO_VBS_BASIC@@ ��
�? &
" Flags
� OwnerID ��Z �? $ _ENCLAVE_CREATE_INFO_VBS_BASIC .?AU_ENCLAVE_CREATE_INFO_VBS_BASIC@@ �� �? � �
�'
�0 k �? r � _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE@@ 2
# TimeAdjustment ���
Enable ���r �? _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE@@ �? � t V � _EXTENDED_ENCRYPTED_DATA_INFO .?AU_EXTENDED_ENCRYPTED_DATA_INFO@@ R
" ExtendedCode �
" Length ���
" Flags
" Reserved �V �? _EXTENDED_ENCRYPTED_DATA_INFO .?AU_EXTENDED_ENCRYPTED_DATA_INFO@@ �? � � B � _REMOTE_NAME_INFOA .?AU_REMOTE_NAME_INFOA@@ ��V
p lpUniversalName ��
p lpConnectionName �
p lpRemainingPath ��B �? _REMOTE_NAME_INFOA .?AU_REMOTE_NAME_INFOA@@ �� �? � � N � _PO_WAKE_SOURCE_INTERNAL .?AU_PO_WAKE_SOURCE_INTERNAL@@ ��
�? :
e> Header ���
u InternalWakeSourceType ���N �? _PO_WAKE_SOURCE_INTERNAL .?AU_PO_WAKE_SOURCE_INTERNAL@@ �� �? x '
f � _EVENT_TRACE_SOFT_RESTART_INFORMATION .?AU_EVENT_TRACE_SOFT_RESTART_INFORMATION@@ v
@ EventTraceInformationClass ���
# TraceHandle ��
PersistTraceBuffers ��
| FileName �f �? _EVENT_TRACE_SOFT_RESTART_INFORMATION .?AU_EVENT_TRACE_SOFT_RESTART_INFORMATION@@ �? A W
C( ��
�? V � _PLUGPLAY_CUSTOM_NOTIFICATION .?AU_PLUGPLAY_CUSTOM_NOTIFICATION@@
@ F � _PLUGPLAY_NOTIFY_HDR .?AU_PLUGPLAY_NOTIFY_HDR@@ ��j
@ HeaderInfo ���
FileObject ���
NameBufferOffset �
� $ CustomDataBuffer �V @ ( _PLUGPLAY_CUSTOM_NOTIFICATION .?AU_PLUGPLAY_CUSTOM_NOTIFICATION@@ @ % � �
@ F
Left �
Top ��
Right
Bottom ���2 @ _SMALL_RECT .?AU_SMALL_RECT@@
@ � ) b � _JOBOBJECT_CONTAINER_IDENTIFIER_V2 .?AU_JOBOBJECT_CONTAINER_IDENTIFIER_V2@@ ��
@ J
ContainerId ��
ContainerTelemetryId �
" JobId b @ $ _JOBOBJECT_CONTAINER_IDENTIFIER_V2 .?AU_JOBOBJECT_CONTAINER_IDENTIFIER_V2@@ �� @ � f
T
� B � _OSVERSIONINFOEX2A .?AU_OSVERSIONINFOEX2A@@ ��
@ N
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
szCSDVersion �
! � wServicePackMajor
! � wServicePackMinor
! � wSuiteMask ���
� wProductType �
� wReserved
" � wSuiteMaskEx �
" � wReserved2 ���B
@ � _OSVERSIONINFOEX2A .?AU_OSVERSIONINFOEX2A@@ �� @ b �
�?
S8
�8 ��
@ @ @
@ 2
� StartTime
� StartPerfClock ���: @ _ETW_REF_CLOCK .?AU_ETW_REF_CLOCK@@ �� @ c �
Address ��
! Type �
!
CreatorBackTraceIndex
OwningThread �
LockCount
" ContentionCount ��
" EntryCount ���
$ RecursionCount ���
" ( NumberOfWaitingShared
" , NumberOfWaitingExclusive �V
"@ 0 _RTL_PROCESS_LOCK_INFORMATION .?AU_RTL_PROCESS_LOCK_INFORMATION@@ #@ �
�:
0 V
� HashedName ���
# Expiration ���
" ( DataSize �
� , Data �Z '@ 0 _SL_APPX_CACHE_VALUE_DESCRIPTOR .?AU_SL_APPX_CACHE_VALUE_DESCRIPTOR@@ (@ � � q " t *@
+@ � DISPLAYCONFIG_MODE_INFO_TYPE_SOURCE �� DISPLAYCONFIG_MODE_INFO_TYPE_TARGET �� DISPLAYCONFIG_MODE_INFO_TYPE_DESKTOP_IMAGE ��� ��DISPLAYCONFIG_MODE_INFO_TYPE_FORCE_UINT32 ���R t -@ DISPLAYCONFIG_MODE_INFO_TYPE .?AW4DISPLAYCONFIG_MODE_INFO_TYPE@@ ��� .@ � J Z � _SYSTEM_CPU_SET_TAG_INFORMATION .?AU_SYSTEM_CPU_SET_TAG_INFORMATION@@
0@ &
# Tag ��
M= CpuSets ��Z 2@ _SYSTEM_CPU_SET_TAG_INFORMATION .?AU_SYSTEM_CPU_SET_TAG_INFORMATION@@ 3@ � � �
Object ���
# UniqueProcessId ��
# HandleValue ��
" GrantedAccess
! CreatorBackTraceIndex
! ObjectTypeIndex ��
" HandleAttributes �
" $ Reserved �b 5@ ( _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX@@ �� 6@ � R � _FILE_BOTH_DIR_INFORMATION .?AU_FILE_BOTH_DIR_INFORMATION@@ ��
8@ V
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
p D ShortNameLength ��
� F ShortName
| ^ FileName �R :@ ` _FILE_BOTH_DIR_INFORMATION .?AU_FILE_BOTH_DIR_INFORMATION@@ �� ;@ �
�)
�& 21 >@ 21 H/ ?@ " " A@
B@
j : � _FP_IEEE_RECORD .?AU_FP_IEEE_RECORD@@ : � _FP_IEEE_VALUE .?AU_FP_IEEE_VALUE@@ ��>
F@ Operand1 �
F@ Operand2 �
F@ 0 Result ���: G@ H _FP_IEEE_RECORD .?AU_FP_IEEE_RECORD@@ H@ � �
@
�!
�1
" ��
" ��
" ��
" ��
" ��
" Flags
O@ ProhibitDynamicCode ��
P@ AllowThreadOptOut
Q@ AllowRemoteDowngrade �
R@ AuditProhibitDynamicCode �
S@ ReservedFlags j T@ _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY .?AU_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY@@ U@ ? x
y= ��
W@
�
|5 j EtwCompressionModeRestart EtwCompressionModeNoDisable �� EtwCompressionModeNoRestart ��V t [@ ETW_COMPRESSION_RESUMPTION_MODE .?AW4ETW_COMPRESSION_RESUMPTION_MODE@@ � \@ � " ^@
_@ V � _ETW_KERNEL_HEADER_EXTENSION .?AU_ETW_KERNEL_HEADER_EXTENSION@@ ��.
^ GroupMasks ���
" Version ��V b@ $ _ETW_KERNEL_HEADER_EXTENSION .?AU_ETW_KERNEL_HEADER_EXTENSION@@ �� c@ A � 2 � SC_HANDLE__ .?AUSC_HANDLE__@@
t unused ���2 f@ SC_HANDLE__ .?AUSC_HANDLE__@@ g@ � � N � SYSTEM_POWER_CAPABILITIES .?AUSYSTEM_POWER_CAPABILITIES@@
i@ J � BATTERY_REPORTING_SCALE .?AUBATTERY_REPORTING_SCALE@@ k@ " �R
PowerButtonPresent ���
SleepButtonPresent ���
LidPresent ���
SystemS1 �
SystemS2 �
SystemS3 �
SystemS4 �
SystemS5 �
HiberFilePresent �
FullWake �
VideoDimPresent ��
ApmPresent ���
UpsPresent ���
ThermalControl ���
ProcessorThrottle
ProcessorMinThrottle �
ProcessorMaxThrottle �
FastSystemS4 �
Hiberboot
WakeAlarmPresent �
AoAc �
DiskSpinDown �
HiberFileType
AoAcConnectivitySupported
spare3 ���
SystemBatteriesPresent ���
BatteriesAreShortTerm
l@ BatteryScale �
� 8 AcOnLineWake �
� < SoftLidWake ��
� @ RtcWake ��
� D MinDeviceWakeState ���
� H DefaultLowLatencyWake N ! m@ L SYSTEM_POWER_CAPABILITIES .?AUSYSTEM_POWER_CAPABILITIES@@ n@ x �
O' B � _GRADIENT_TRIANGLE .?AU_GRADIENT_TRIANGLE@@ ��>
" Vertex1 ��
" Vertex2 ��
" Vertex3 ��B r@ _GRADIENT_TRIANGLE .?AU_GRADIENT_TRIANGLE@@ �� s@ � 3 ^ � _TIMER_SET_COALESCABLE_TIMER_INFO .?AU_TIMER_SET_COALESCABLE_TIMER_INFO@@
u@
i" J � _COUNTED_REASON_CONTEXT .?AU_COUNTED_REASON_CONTEXT@@
x@ �
� DueTime ��
w@ TimerApcRoutine ��
TimerContext �
y@ WakeContext ��
" Period ���
" $ TolerableDelay ���
( PreviousState ^ z@ 0 _TIMER_SET_COALESCABLE_TIMER_INFO .?AU_TIMER_SET_COALESCABLE_TIMER_INFO@@ {@ � �
�! ��
}@ Z KernelRequester �� UserProcessRequester � UserSharedServiceRequester ���6 t @ _REQUESTER_TYPE .?AW4_REQUESTER_TYPE@@ � �@ x �
�5
�< V � _COMPOUND_ACCESS_ALLOWED_ACE .?AU_COMPOUND_ACCESS_ALLOWED_ACE@@ ��
�@ j
� Header ���
" Mask �
! CompoundAceType ��
!
Reserved �
" SidStart �V �@ _COMPOUND_ACCESS_ALLOWED_ACE .?AU_COMPOUND_ACCESS_ALLOWED_ACE@@ �� �@ � �
�'
|-
� F
BaseAddress ��
" Flags
! EntryOverhead
! CreatorBackTraceIndex
# BytesAllocated ���
# BytesCommitted ���
" NumberOfTags �
" $ NumberOfEntries ��
" ( NumberOfPseudoTags ���
" , PseudoTagGranularity �
0 Reserved �
�@ H Tags �
�@ P Entries ��F
�@ X _RTL_HEAP_INFORMATION .?AU_RTL_HEAP_INFORMATION@@ �@ � 6
-& > � FIND_BY_SID_DATA .?AUFIND_BY_SID_DATA@@ ��&
" Restart ��
T Sid ��> �@ FIND_BY_SID_DATA .?AUFIND_BY_SID_DATA@@ �� �@ � �
V 21 " �"
" Count
�@ Uuid �6 �@ _UUID_VECTOR .?AU_UUID_VECTOR@@ �� �@ _ h Z � _FSCTL_QUERY_REGION_INFO_INPUT .?AU_FSCTL_QUERY_REGION_INFO_INPUT@@ ��
�@ f
" Version ��
" Size �
" Flags
" NumberOfTierIds ��
� TierIds ��Z �@ _FSCTL_QUERY_REGION_INFO_INPUT .?AU_FSCTL_QUERY_REGION_INFO_INPUT@@ �� �@ � �
�. � AR_ENABLED ��� AR_DISABLED �� AR_SUPPRESSED AR_REMOTESESSION � AR_MULTIMON �� AR_NOSENSOR �� AR_NOT_SUPPORTED � @ AR_DOCKED � AR_LAPTOP . t �@ tagAR_STATE .?AW4tagAR_STATE@@ � �@ �= Z � _SYSTEM_SECUREBOOT_INFORMATION .?AU_SYSTEM_SECUREBOOT_INFORMATION@@ ��:
SecureBootEnabled
SecureBootCapable Z �@ _SYSTEM_SECUREBOOT_INFORMATION .?AU_SYSTEM_SECUREBOOT_INFORMATION@@ �� �@ � � B � _RTL_RXACT_CONTEXT .?AU_RTL_RXACT_CONTEXT@@ ��
�7 ^
RootRegistryKey ��
RXactKey �
HandlesValid �
�@ RXactLog �B �@ _RTL_RXACT_CONTEXT .?AU_RTL_RXACT_CONTEXT@@ �� �@ � �
6 " �Z
LangSpec �
! FallbackTypes
! Reserved �
�@ FallbackSpecs : �@ _MUILANGCFGNODE .?AU_MUILANGCFGNODE@@ �@ D
Z?
j
Q" 6 � tagFILTERKEYS .?AUtagFILTERKEYS@@ �
u cbSize ���
" dwFlags ��
" iWaitMSec
" iDelayMSec ���
" iRepeatMSec ��
" iBounceMSec ��6 �@ tagFILTERKEYS .?AUtagFILTERKEYS@@ �@ �3 V � tagACTCTX_SECTION_KEYED_DATA .?AUtagACTCTX_SECTION_KEYED_DATA@@ ��
�@ z � tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AUtagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ ��>
" cbSize ���
" ulDataFormatVersion ��
lpData ���
" ulLength �
lpSectionGlobalData ��
" ulSectionGlobalDataLength
( lpSectionBase
" 0 ulSectionTotalLength �
8 hActCtx ��
" @ ulAssemblyRosterIndex
" D ulFlags ��
�@ H AssemblyMetadata �V �@ p tagACTCTX_SECTION_KEYED_DATA .?AUtagACTCTX_SECTION_KEYED_DATA@@ �� �@ o � %
�@
7 �� �@ " �
�7 : � _DISCDLGSTRUCTA .?AU_DISCDLGSTRUCTA@@ r
" cbStructure ��
� hwndOwner
p lpLocalName ��
p lpRemoteName �
" dwFlags ��: �@ ( _DISCDLGSTRUCTA .?AU_DISCDLGSTRUCTA@@ �@ � � 6 � RTL_ACE_DATA .?AURTL_ACE_DATA@@ ��
�@
b
AceType ��
InheritFlags �
AceFlags �
" Mask �
�@ Sid ��6 �@ RTL_ACE_DATA .?AURTL_ACE_DATA@@ �� �@ � � V � _SEMAPHORE_BASIC_INFORMATION .?AU_SEMAPHORE_BASIC_INFORMATION@@ ��2
CurrentCount �
MaximumCount �V �@ _SEMAPHORE_BASIC_INFORMATION .?AU_SEMAPHORE_BASIC_INFORMATION@@ �� �@ � �
� p u u �@
�@ > � _KEY_VALUE_ENTRY .?AU_KEY_VALUE_ENTRY@@ ��V
v ValueName
" DataLength ���
" DataOffset ���
" Type �> �@ _KEY_VALUE_ENTRY .?AU_KEY_VALUE_ENTRY@@ �� �@ k
H
%< V � _SILOOBJECT_BASIC_INFORMATION .?AU_SILOOBJECT_BASIC_INFORMATION@@
�@ z
" SiloId ���
" SiloParentId �
" NumberOfProcesses
IsInServerSilo ���
-
Reserved �V �@ _SILOOBJECT_BASIC_INFORMATION .?AU_SILOOBJECT_BASIC_INFORMATION@@ �@ ? � �
�@
� ��
�@
! ��
! ��>
�@ PageRelativeOffset ���
�@ RegisterNumber ���v �@ _IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION .?AU_IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION@@ �� �@ � �
^ Z � _PS_CPU_QUOTA_QUERY_INFORMATION .?AU_PS_CPU_QUOTA_QUERY_INFORMATION@@
�@ �= " �:
" SessionCount �
�@ SessionInformation ���Z �@ _PS_CPU_QUOTA_QUERY_INFORMATION .?AU_PS_CPU_QUOTA_QUERY_INFORMATION@@ �@ � > � tagMENUITEMINFOW .?AUtagMENUITEMINFOW@@ ���
u cbSize ���
u fMask
u fType
u fState ���
u wID ��
� hSubMenu �
| hbmpChecked ��
| ( hbmpUnchecked
# 0 dwItemData ���
q 8 dwTypeData ���
u @ cch ��
| H hbmpItem �> �@ P tagMENUITEMINFOW .?AUtagMENUITEMINFOW@@ �� �@ �
�%
\< / " �@
�@ F � _RPC_PROTSEQ_VECTORW .?AU_RPC_PROTSEQ_VECTORW@@ �� q " �&
u Count
�@ Protseq ��F �@ _RPC_PROTSEQ_VECTORW .?AU_RPC_PROTSEQ_VECTORW@@ �� �@ _ �
�" J � DISPLAYCONFIG_MODE_INFO .?AUDISPLAYCONFIG_MODE_INFO@@ N � DISPLAYCONFIG_SOURCE_MODE .?AUDISPLAYCONFIG_SOURCE_MODE@@ ^ � DISPLAYCONFIG_DESKTOP_IMAGE_INFO .?AUDISPLAYCONFIG_DESKTOP_IMAGE_INFO@@ ��
.@ infoType �
u id ���
� adapterId
�/ targetMode ���
A sourceMode ���
A desktopImageInfo �J A @ DISPLAYCONFIG_MODE_INFO .?AUDISPLAYCONFIG_MODE_INFO@@ A � o �
Data �
" AssemblyRosterIndex ��
ResolutionContext
Root �
( KnownRoot
# 0 RootCount
8 CancelResolution � A @ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING@@ A � z B � _TP_DEBUG_FREE_INFO .?AU_TP_DEBUG_FREE_INFO@@
" FreeListSize �B A _TP_DEBUG_FREE_INFO .?AU_TP_DEBUG_FREE_INFO@@
A � ;
�0
� x
� y 2
A tagPOINTFX .?AUtagPOINTFX@@ �� A � �
R � _WIN32_FILE_ATTRIBUTE_DATA .?AU_WIN32_FILE_ATTRIBUTE_DATA@@ ��
A �
" dwFileAttributes �
x ftCreationTime ���
x ftLastAccessTime �
x ftLastWriteTime ��
" nFileSizeHigh
" nFileSizeLow �R A $ _WIN32_FILE_ATTRIBUTE_DATA .?AU_WIN32_FILE_ATTRIBUTE_DATA@@ �� A X X
�. ^ � _PERFINFO_WORKINGSET_INFORMATION .?AU_PERFINFO_WORKINGSET_INFORMATION@@ ��
A R � _PERFINFO_WORKINGSET_ENTRY .?AU_PERFINFO_WORKINGSET_ENTRY@@ �� A " D �&
" Count
A WsEntry ��^ A H _PERFINFO_WORKINGSET_INFORMATION .?AU_PERFINFO_WORKINGSET_INFORMATION@@ �� A c � > � _PERFORMANCE_DATA .?AU_PERFORMANCE_DATA@@ �8 " ��
! Size �
Version ��
HwCountersCount ��
" ContextSwitchCount ���
# WaitReasonBitMap �
# CycleTime
" RetryCount ���
" Reserved �
A HwCounters ���> A _PERFORMANCE_DATA .?AU_PERFORMANCE_DATA@@ A � 3 R
# FileMapping ��
" Size �
" HashSeed �
" HashCount b "A _ETW_COVERAGE_SAMPLER_BLOOM_FILTER .?AU_ETW_COVERAGE_SAMPLER_BLOOM_FILTER@@ �� #A A � J � _ETW_SET_KTIMER2_EVENT .?AU_ETW_SET_KTIMER2_EVENT@@ ��
# DueTime ��
# MaximumDueTime ���
# Period ���
# TimerKey �
# Callback �
# ( CallbackContextKey ���
0 Flags J &A 8 _ETW_SET_KTIMER2_EVENT .?AU_ETW_SET_KTIMER2_EVENT@@ �� 'A c � . � _COMSTAT .?AU_COMSTAT@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
*A fCtsHold �
+A fDsrHold �
,A fRlsdHold
-A fXoffHold
.A fXoffSent
/A fEof �
0A fTxim
1A fReserved
" cbInQue ��
" cbOutQue �.
2A _COMSTAT .?AU_COMSTAT@@ �� 3A o �
� R � _ETW_REFDEREF_OBJECT_EVENT .?AU_ETW_REFDEREF_OBJECT_EVENT@@ ��
6A 6
Object ���
" Tag ��
" Count R 8A _ETW_REFDEREF_OBJECT_EVENT .?AU_ETW_REFDEREF_OBJECT_EVENT@@ �� 9A c p
2 � _NIC_RECORD .?AU_NIC_RECORD@@
;A " �"
� NICName ��
" Index
" PhysicalAddrLen ��
�4 PhysicalAddr �
" Size �
IpAddress
SubnetMask ���
$DhcpServer ���
(Gateway ��
,PrimaryWinsServer
0SecondaryWinsServer ��
=A 4DnsServer
" DData �2
>A H_NIC_RECORD .?AU_NIC_RECORD@@ ?A c L R � _TXFS_QUERY_RM_INFORMATION .?AU_TXFS_QUERY_RM_INFORMATION@@ ��
" BytesRequired
# TailLsn ��
# CurrentLsn ���
# ArchiveTailLsn ���
# LogContainerSize �
� ( HighestVirtualClock ��
" 0 LogContainerCount
" 4 LogContainerCountMax �
" 8 LogContainerCountMin �
" < LogGrowthIncrement ���
" @ LogAutoShrinkPercentage ��
" D Flags
! H LoggingMode ��
! J Reserved �
" L RmState ��
# P LogCapacity ��
# X LogFree ��
# ` TopsSize �
# h TopsUsed �
# p TransactionCount �
# x OnePCCount ���
# � TwoPCCount ���
# � NumberLogFileFull
# � OldestTransactionAge �
� RMName ���
" � TmLogPathOffset ��R BA � _TXFS_QUERY_RM_INFORMATION .?AU_TXFS_QUERY_RM_INFORMATION@@ �� CA � W b � _ETW_UMS_EVENT_DIRECTED_SWITCH_END .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_END@@ ��f
" ProcessId
" ScheduledThreadId
" PrimaryThreadId ��
" SwitchFlags ��b FA _ETW_UMS_EVENT_DIRECTED_SWITCH_END .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_END@@ �� GA c |
�" N � _RTL_DEBUG_INFORMATION32 .?AU_RTL_DEBUG_INFORMATION32@@ ��b
" SectionHandleClient ��
" ViewBaseClient ���
" ViewBaseTarget ���
" ViewBaseDelta
" EventPairClient ��
" EventPairTarget ��
" TargetProcessId ��
" TargetThreadHandle ���
" Flags
" $ OffsetFree ���
" ( CommitSize ���
" , ViewSize �
" 0 Modules ��
" 0 ModulesEx
" 4 BackTraces ���
" 8 Heaps
" < Locks
" @ SpecificHeap �
" D TargetProcessHandle ��
" H VerifierOptions ��
" L ProcessHeap ��
" P CriticalSectionHandle
" T CriticalSectionOwnerThread ���
� X Reserved �N KA h _RTL_DEBUG_INFORMATION32 .?AU_RTL_DEBUG_INFORMATION32@@ �� LA � �
< " " � ( " $ �R
p locale ���
q wlocale ��
t refcount �
t wrefcount : QA <anonymous-tag> .?AU<anonymous-tag>@@ RA ( RA " � �& � lconv .?AUlconv@@
UA : � __lc_time_data .?AU__lc_time_data@@ ��
WA �
t refcount �
u lc_codepage ��
u lc_collate_cp
OA lc_handle
PA $ lc_id
TA H lc_category ��
t lc_clike �
t mb_cur_max ���
t lconv_intl_refcount ��
t lconv_num_refcount ���
t lconv_mon_refcount ���
VA (lconv
t 0ctype1_refcount ��
q 8ctype1 ���
6 @pctype ���
4 Hpclmap ���
4 Ppcumap ���
XA Xlc_time_curr �J YA `threadlocaleinfostruct .?AUthreadlocaleinfostruct@@ �� ZA ( R � _ETW_COVERAGE_SAMPLER_STATS .?AU_ETW_COVERAGE_SAMPLER_STATS@@ �
SamplesAdded �
SamplesFound �
SamplesDropped ���
SamplesRaisedUM ��
SamplesMappedUM ��
SamplesRaisedKM ��
SamplesMappedKM ��
SamplingPaused ���
ApcNotAvailable ��
$ CaptureBufferNotAvailable
( SampleBufferNotAvailable �
, ProfileSampleCount ���
0 CSwitchSampleCount ���
4 RThreadSampleCount ���
8 PGFaultSampleCount ���R ]A < _ETW_COVERAGE_SAMPLER_STATS .?AU_ETW_COVERAGE_SAMPLER_STATS@@ ^A A �
O " `A
0 � t cA
dA N � _CM_EISA_SLOT_INFORMATION .?AU_CM_EISA_SLOT_INFORMATION@@
fA �
ReturnCode ���
ReturnFlags ��
MajorRevision
MinorRevision
! Checksum �
NumberFunctions ��
FunctionInformation ��
" CompressedId �N hA _CM_EISA_SLOT_INFORMATION .?AU_CM_EISA_SLOT_INFORMATION@@ iA ) ! * � HFONT__ .?AUHFONT__@@
t unused ���* mA HFONT__ .?AUHFONT__@@ nA t V
5
�< 6 � _INPUT_RECORD .?AU_INPUT_RECORD@@ z
�* KeyEvent �
�" MouseEvent ���
78 WindowBufferSizeEvent
�7 MenuEvent
+ FocusEvent ���2 sA <anonymous-tag> .?AT<anonymous-tag>@@ tA � | &
! EventType
tA Event 6 vA _INPUT_RECORD .?AU_INPUT_RECORD@@ wA � z
_:
�1 ^ � _RPC_BINDING_HANDLE_SECURITY_V1_A .?AU_RPC_BINDING_HANDLE_SECURITY_V1_A@@
{A �
" Version ��
ServerPrincName ��
" AuthnLevel ���
" AuthnSvc �
�4 AuthIdentity �
?( SecurityQos ��^ }A ( _RPC_BINDING_HANDLE_SECURITY_V1_A .?AU_RPC_BINDING_HANDLE_SECURITY_V1_A@@ ~A _ B � FILE_ID_DESCRIPTOR .?AUFILE_ID_DESCRIPTOR@@ ��
�A j
" dwSize ���
�' Type �
� FileId ���
ObjectId �
n ExtendedFileId ���B �A FILE_ID_DESCRIPTOR .?AUFILE_ID_DESCRIPTOR@@ �� �A o �# J � PPM_WMI_PERF_STATES_EX .?AUPPM_WMI_PERF_STATES_EX@@ ���
" Count
" MaxFrequency �
" CurrentState �
" MaxPerfState �
" MinPerfState �
" LowestPerfState ��
" ThermalConstraint
BusyAdjThreshold �
PolicyType ���
Type �
Reserved �
" TimerInterval
( TargetProcessors �
" 0 PStateHandler
" 4 PStateContext
" 8 TStateHandler
" < TStateContext
" @ FeedbackHandler ��
" D Reserved1
# H Reserved2
86 P State J �A � PPM_WMI_PERF_STATES_EX .?AUPPM_WMI_PERF_STATES_EX@@ �� �A x � V � _JOBOBJECT_FREEZE_INFORMATION .?AU_JOBOBJECT_FREEZE_INFORMATION@@
�A
" ��
" ��
" ��
" ���
" Flags
�A FreezeOperation ��
�A FilterOperation ��
�A SwapOperation
�A Reserved �
Freeze ���
Swap �
� Reserved0
� WakeFilter ���V �A _JOBOBJECT_FREEZE_INFORMATION .?AU_JOBOBJECT_FREEZE_INFORMATION@@ �A � N � _ETW_DISKIO_READWRITE_V3 .?AU_ETW_DISKIO_READWRITE_V3@@ ��
�A �
" DiskNumber ���
" IrpFlags �
" Size �
" Reserved �
# ByteOffset ���
FileObject ���
IrpAddr ��
# ( HighResResponseTime ��
" 0 IssuingThreadId ��N �A 8 _ETW_DISKIO_READWRITE_V3 .?AU_ETW_DISKIO_READWRITE_V3@@ �� �A c � : � HWINEVENTHOOK__ .?AUHWINEVENTHOOK__@@
t unused ���: �A HWINEVENTHOOK__ .?AUHWINEVENTHOOK__@@ �A t b � �A 6 � _HEAP_SUMMARY .?AU_HEAP_SUMMARY@@ r
" cb ���
# cbAllocated ��
# cbCommitted ��
# cbReserved ���
# cbMaxReserve �6 �A ( _HEAP_SUMMARY .?AU_HEAP_SUMMARY@@ 2 onecore\external\sdk\inc\minwin\heapapi.h �� �A �A +
G'
8
" " @ �B
" dvReserved ���
" dvNumAxes
�A dvValues �: �A H tagDESIGNVECTOR .?AUtagDESIGNVECTOR@@ �A � �
C 2
CommOffset ���
FaultOffset ��B �A _COMM_FAULT_OFFSETS .?AU_COMM_FAULT_OFFSETS@@ �A � �
(
�
�= : � BITMAPV5HEADER .?AUBITMAPV5HEADER@@ ��
�A B
" bV5Size ��
bV5Width �
bV5Height
! bV5Planes
! bV5BitCount ��
" bV5Compression ���
" bV5SizeImage �
bV5XPelsPerMeter �
bV5YPelsPerMeter �
" bV5ClrUsed ���
" $ bV5ClrImportant ��
" ( bV5RedMask ���
" , bV5GreenMask �
" 0 bV5BlueMask ��
" 4 bV5AlphaMask �
" 8 bV5CSType
� < bV5Endpoints �
" ` bV5GammaRed ��
" d bV5GammaGreen
" h bV5GammaBlue �
" l bV5Intent
" p bV5ProfileData ���
" t bV5ProfileSize ���
" x bV5Reserved ��: �A | BITMAPV5HEADER .?AUBITMAPV5HEADER@@ �� �A � a 2
# Ptr ��
" Size �
" Type �N �A _EVENT_FILTER_DESCRIPTOR .?AU_EVENT_FILTER_DESCRIPTOR@@ �� �A > H # " � �R � _PERFINFO_BOOT_PHASE_START .?AU_PERFINFO_BOOT_PHASE_START@@ ��
Phase R �A _PERFINFO_BOOT_PHASE_START .?AU_PERFINFO_BOOT_PHASE_START@@ �� �A c �
� f � DISPLAYCONFIG_SET_TARGET_PERSISTENCE .?AUDISPLAYCONFIG_SET_TARGET_PERSISTENCE@@ ��
u ��
u ��V
header ���
�A bootPersistenceOn
�A reserved �
u value f �A DISPLAYCONFIG_SET_TARGET_PERSISTENCE .?AUDISPLAYCONFIG_SET_TARGET_PERSISTENCE@@ �� �A � .
�3
+!
� f � _SYSTEM_LOGICAL_PROCESSOR_INFORMATION .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION@@
Flags : �A <anonymous-tag> .?AU<anonymous-tag>@@ �A �
" NodeNumber ���: �A <anonymous-tag> .?AU<anonymous-tag>@@ �A � �
# ProcessorMask
S Relationship �
�A ProcessorCore
�A NumaNode �
k2 Cache
� Reserved �f �A _SYSTEM_LOGICAL_PROCESSOR_INFORMATION .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION@@ �A � b � _SYSTEM_CONTEXT_SWITCH_INFORMATION .?AU_SYSTEM_CONTEXT_SWITCH_INFORMATION@@ ��
�A
" ContextSwitches ��
" FindAny ��
" FindLast �
" FindIdeal
" IdleAny ��
" IdleCurrent ��
" IdleLast �
" IdleIdeal
" PreemptAny ���
" $ PreemptCurrent ���
" ( PreemptLast ��
" , SwitchToIdle �b �A 0 _SYSTEM_CONTEXT_SWITCH_INFORMATION .?AU_SYSTEM_CONTEXT_SWITCH_INFORMATION@@ �� �A � �
f � _JOBOBJECT_EXTENDED_LIMIT_INFORMATION .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION@@
�A �
$+ BasicLimitInformation
� @ IoInfo ���
# p ProcessMemoryLimit ���
# x JobMemoryLimit ���
# � PeakProcessMemoryUsed
# � PeakJobMemoryUsed f �A � _JOBOBJECT_EXTENDED_LIMIT_INFORMATION .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION@@ �A ? `
�! F � _RPC_PROTSEQ_VECTORA .?AU_RPC_PROTSEQ_VECTORA@@ �� " �&
u Count
�A Protseq ��F �A _RPC_PROTSEQ_VECTORA .?AU_RPC_PROTSEQ_VECTORA@@ �� �A _ �
}$
� " �A Z � _FILE_PROVIDER_EXTERNAL_INFO_V1 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V1@@ :
" Version ��
" Algorithm
" Flags Z �A _FILE_PROVIDER_EXTERNAL_INFO_V1 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V1@@ �A � }"
/ - �A F � _SERVICE_TABLE_ENTRYA .?AU_SERVICE_TABLE_ENTRYA@@
�A
p " �A �A
�A 2
p lpServiceName
�A lpServiceProc F �A _SERVICE_TABLE_ENTRYA .?AU_SERVICE_TABLE_ENTRYA@@ �A � y V � _ETW_TP_EVENT_TIMER_CANCELLED .?AU_ETW_TP_EVENT_TIMER_CANCELLED@@ :
j Header ���
SubQueue �
( Timer V �A 0 _ETW_TP_EVENT_TIMER_CANCELLED .?AU_ETW_TP_EVENT_TIMER_CANCELLED@@ �A c
N f � _EVENT_TRACE_HEAP_TRACING_INFORMATION .?AU_EVENT_TRACE_HEAP_TRACING_INFORMATION@@ >
@ EventTraceInformationClass ���
� ProcessId f �A _EVENT_TRACE_HEAP_TRACING_INFORMATION .?AU_EVENT_TRACE_HEAP_TRACING_INFORMATION@@ �A A #
A NotificationType �
" NotificationSize �
" Offset ���
ReplyRequested ���
" Timeout ��
" ReplyCount ���
" NotifyeeCount
# Reserved2
" TargetPID
" $ SourcePID
( DestinationGuid ��
8 SourceGuid ���N �A H _ETW_NOTIFICATION_HEADER .?AU_ETW_NOTIFICATION_HEADER@@ �� �A A H f � _PERFINFO_DRIVER_COMPLETE_REQUEST_RET .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST_RET@@ *
Irp ��
" UniqMatchId ��f B _PERFINFO_DRIVER_COMPLETE_REQUEST_RET .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST_RET@@ B c
e F � _PO_WAKE_SOURCE_INFO .?AU_PO_WAKE_SOURCE_INFO@@ ��
B &
" Count
� Offsets ��F B _PO_WAKE_SOURCE_INFO .?AU_PO_WAKE_SOURCE_INFO@@ �� B x 5
< Z � _MEMORY_EXHAUSTION_INFORMATION .?AU_MEMORY_EXHAUSTION_INFORMATION@@ ��J
! Version ��
! Reserved �
5: Type �
# Value Z B _MEMORY_EXHAUSTION_INFORMATION .?AU_MEMORY_EXHAUSTION_INFORMATION@@ �� B ? �
� R � _CREATE_PROCESS_DEBUG_INFO .?AU_CREATE_PROCESS_DEBUG_INFO@@ ���
hFile
hProcess �
hThread ��
lpBaseOfImage
" dwDebugInfoFileOffset
" $ nDebugInfoSize ���
( lpThreadLocalBase
E5 0 lpStartAddress ���
8 lpImageName ��
! @ fUnicode �R
B H _CREATE_PROCESS_DEBUG_INFO .?AU_CREATE_PROCESS_DEBUG_INFO@@ �� B � ; � B
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
B NoRemoteImages ���
B NoLowMandatoryLabelImages
B PreferSystem32Images �
B AuditNoRemoteImages ��
B AuditNoLowMandatoryLabelImages ���
B ReservedFlags f B _PROCESS_MITIGATION_IMAGE_LOAD_POLICY .?AU_PROCESS_MITIGATION_IMAGE_LOAD_POLICY@@ B ? �
�
A
\
q; > � _FILE_RENAME_INFO .?AU_FILE_RENAME_INFO@@ v
ReplaceIfExists ��
" Flags
RootDirectory
" FileNameLength ���
| FileName �> $B _FILE_RENAME_INFO .?AU_FILE_RENAME_INFO@@ %B o �" J � _WIN32_FIND_STREAM_DATA .?AU_WIN32_FIND_STREAM_DATA@@
'B q " P �2
� StreamSize ���
)B cStreamName ��J *B X_WIN32_FIND_STREAM_DATA .?AU_WIN32_FIND_STREAM_DATA@@ +B X S B � USN_JOURNAL_DATA_V0 .?AUUSN_JOURNAL_DATA_V0@@
-B �
# UsnJournalID �
FirstUsn �
NextUsn ��
LowestValidUsn ���
MaxUsn ���
# ( MaximumSize ��
# 0 AllocationDelta ��B /B 8 USN_JOURNAL_DATA_V0 .?AUUSN_JOURNAL_DATA_V0@@ 0B � � : � tagEMRRESTOREDC .?AUtagEMRRESTOREDC@@ &
� emr ��
iRelative : 3B tagEMRRESTOREDC .?AUtagEMRRESTOREDC@@ 4B � w
[)
" ��
7B
�( J � _IMAGE_FUNCTION_ENTRY64 .?AU_IMAGE_FUNCTION_ENTRY64@@ j
# StartingAddress ��
# EndingAddress
# EndOfPrologue
# UnwindInfoAddress J ;B _IMAGE_FUNCTION_ENTRY64 .?AU_IMAGE_FUNCTION_ENTRY64@@ <B �
W &
# Address ��
# Data �N ?B _RTL_STACK_CONTEXT_ENTRY .?AU_RTL_STACK_CONTEXT_ENTRY@@ �� @B � B � _CONNECTDLGSTRUCTA .?AU_CONNECTDLGSTRUCTA@@ ��
BB
9= j
" cbStructure ��
� hwndOwner
DB lpConnRes
" dwFlags ��
" dwDevNum �B EB _CONNECTDLGSTRUCTA .?AU_CONNECTDLGSTRUCTA@@ �� FB � �
� J � _RPC_SECURITY_QOS_V5_A .?AU_RPC_SECURITY_QOS_V5_A@@ ��
IB
r. HttpCredentials ��2 KB <anonymous-tag> .?AT<anonymous-tag>@@ LB _ } �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
LB u
Sid ��
u ( EffectiveOnly
0 ServerSecurityDescriptor �J NB 8 _RPC_SECURITY_QOS_V5_A .?AU_RPC_SECURITY_QOS_V5_A@@ �� OB _ v
e@
QB
�0 " � " �
! Flags
! Reserved �
! LangId ���
LangNameIndex
! FallbackTypes
NeutralLangSpec ��
TB FallbackSpecs
UB AlternateCodePage 6 VB _MUILANGINFO .?AU_MUILANGINFO@@ �� WB 1 N � _CM_PNP_BIOS_DEVICE_NODE .?AU_CM_PNP_BIOS_DEVICE_NODE@@ ��j
! Size �
Node �
" ProductId
- DeviceType ���
!
DeviceAttributes �N ZB _CM_PNP_BIOS_DEVICE_NODE .?AU_CM_PNP_BIOS_DEVICE_NODE@@ �� [B [
]B
^B
: J � _PROCESS_PRIORITY_CLASS .?AU_PROCESS_PRIORITY_CLASS@@ 2
Foreground ���
PriorityClass J bB _PROCESS_PRIORITY_CLASS .?AU_PROCESS_PRIORITY_CLASS@@ cB � 9 ^ � _FILE_MAILSLOT_QUERY_INFORMATION .?AU_FILE_MAILSLOT_QUERY_INFORMATION@@ ��
" MaximumMessageSize ���
" MailslotQuota
" NextMessageSize ��
" MessagesAvailable
� ReadTimeout ��^ fB _FILE_MAILSLOT_QUERY_INFORMATION .?AU_FILE_MAILSLOT_QUERY_INFORMATION@@ �� gB � c
� N � _PERFINFO_SPINLOCK_CONFIG .?AU_PERFINFO_SPINLOCK_CONFIG@@ �
" SpinLockSpinThreshold
" SpinLockContentionSampleRate �
" SpinLockAcquireSampleRate
" SpinLockHoldThreshold N kB _PERFINFO_SPINLOCK_CONFIG .?AU_PERFINFO_SPINLOCK_CONFIG@@ lB c �
5 B � _CI_LOG_MMCSS_START .?AU_CI_LOG_MMCSS_START@@
oB
Header ���B qB 0 _CI_LOG_MMCSS_START .?AU_CI_LOG_MMCSS_START@@ rB c a
�(
�!
�+ b � _SYSTEM_ENTROPY_TIMING_INFORMATION .?AU_SYSTEM_ENTROPY_TIMING_INFORMATION@@ ��
wB A@
yB
_@ ^
zB EntropyRoutine ���
{B InitializationRoutine
InitializationContext b |B _SYSTEM_ENTROPY_TIMING_INFORMATION .?AU_SYSTEM_ENTROPY_TIMING_INFORMATION@@ �� }B �
�
I ^ � _IR_TIMER_EXTRA_CREATE_PARAMETER .?AU_IR_TIMER_EXTRA_CREATE_PARAMETER@@ ��2
! ComponentId ��
! RelativeId ���^ �B _IR_TIMER_EXTRA_CREATE_PARAMETER .?AU_IR_TIMER_EXTRA_CREATE_PARAMETER@@ �� �B � 9
�+ V � _FILE_ALLOCATED_RANGE_BUFFER .?AU_FILE_ALLOCATED_RANGE_BUFFER@@ ��.
� FileOffset ���
� Length ���V �B _FILE_ALLOCATED_RANGE_BUFFER .?AU_FILE_ALLOCATED_RANGE_BUFFER@@ �� �B � �
�3 > � _SYSDBG_BUS_DATA .?AU_SYSDBG_BUS_DATA@@ ��
" Address ��
Buffer ���
" Request ��
.# BusDataType ��
" BusNumber
" SlotNumber ���> �B _SYSDBG_BUS_DATA .?AU_SYSDBG_BUS_DATA@@ �� �B � > � _ALPC_DIRECT_ATTR .?AU_ALPC_DIRECT_ATTR@@
Event > �B _ALPC_DIRECT_ATTR .?AU_ALPC_DIRECT_ATTR@@ �B � f 2 � _WMI_TCPIP .?AU_WMI_TCPIP@@ ��
�B v
" Context ��
" Size �
" DestAddr �
" SrcAddr ��
! DestPort �
! SrcPort ��2 �B _WMI_TCPIP .?AU_WMI_TCPIP@@ �� �B c
s(
�! ^ � _MIDL_INTERFACE_METHOD_PROPERTIES .?AU_MIDL_INTERFACE_METHOD_PROPERTIES@@
�B ��
�B �
3 TransferSyntax ���
�B DispatchTable
Q ProcString ���
6 ( FmtStringOffset ��
Q 0 TypeString ���
8 aUserMarshalQuadruple
�B @ pMethodProperties
# H pReserved2 ���> �B P _MIDL_SYNTAX_INFO .?AU_MIDL_SYNTAX_INFO@@ �B � � �
# Internal �
# InternalHigh �
" Offset ���
" OffsetHigh ���
Pointer ��
hEvent ���2 �B _OVERLAPPED .?AU_OVERLAPPED@@ �B � 4 V � tagEMREXTCREATEFONTINDIRECTW .?AUtagEMREXTCREATEFONTINDIRECTW@@ ��6
� emr ��
" ihFont ���
�* elfw �V �B LtagEMREXTCREATEFONTINDIRECTW .?AUtagEMREXTCREATEFONTINDIRECTW@@ �� �B � ?
7 V � _WIM_PROVIDER_START_INTEGRITY .?AU_WIM_PROVIDER_START_INTEGRITY@@
� DataSourceId �V �B _WIM_PROVIDER_START_INTEGRITY .?AU_WIM_PROVIDER_START_INTEGRITY@@ �B � ]"
b) J � _ETW_DEBUG_PRINT_EVENT .?AU_ETW_DEBUG_PRINT_EVENT@@ ��:
" Component
" Level
Message ��J �B _ETW_DEBUG_PRINT_EVENT .?AU_ETW_DEBUG_PRINT_EVENT@@ �� �B c 2
� SC_ACTION_NONE ��� SC_ACTION_RESTART SC_ACTION_REBOOT � SC_ACTION_RUN_COMMAND SC_ACTION_OWN_RESTART 6 t �B _SC_ACTION_TYPE .?AW4_SC_ACTION_TYPE@@ � �B �
V � _PERFINFO_CC_WORKITEM_DEQUEUE .?AU_PERFINFO_CC_WORKITEM_DEQUEUE@@
�B
# WorkItemKey ��V �B _PERFINFO_CC_WORKITEM_DEQUEUE .?AU_PERFINFO_CC_WORKITEM_DEQUEUE@@ �B c � S R � _RTL_UNICODE_STRING_BUFFER .?AU_RTL_UNICODE_STRING_BUFFER@@ ��2 � _RTL_BUFFER .?AU_RTL_BUFFER@@ Z
String ���
�B ByteBuffer ���
� 0 MinimumStaticBufferForTerminalNul R �B 8 _RTL_UNICODE_STRING_BUFFER .?AU_RTL_UNICODE_STRING_BUFFER@@ ��6 onecore\internal\sdk\inc\ntrtlstringandbuffer.h �B �B �
�2
l1 >
" dwDataType ���
" cbData ���
pData b �B _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM .?AU_SERVICE_TRIGGER_SPECIFIC_DATA_ITEM@@ �B � l
! ��
! ��
!
��
! ��
! ��z
�B PageRelativeOffset ���
�B IndirectCall �
�B RexWPrefix ���
�B CfgCheck �
�B Reserved �~ �B _IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@ �� �B � � " � � " �- �B
�B J � _LDR_DATA_TABLE_ENTRY32 .?AU_LDR_DATA_TABLE_ENTRY32@@ �
InLoadOrderLinks �
InMemoryOrderLinks ���
InInitializationOrderLinks ���
" DllBase ��
" EntryPoint ���
" SizeOfImage ��
�) $ FullDllName ��
�) , BaseDllName ��
" 4 Flags
! 8 LoadCount
! : TlsIndex �
< HashLinks
" < SectionPointer ���
" @ CheckSum �
" D TimeDateStamp
" D LoadedImports J �B H _LDR_DATA_TABLE_ENTRY32 .?AU_LDR_DATA_TABLE_ENTRY32@@ �B � 6 � _DEBUG_EVENT .?AU_DEBUG_EVENT@@ ��N � _EXIT_PROCESS_DEBUG_INFO .?AU_EXIT_PROCESS_DEBUG_INFO@@ ��F � _LOAD_DLL_DEBUG_INFO .?AU_LOAD_DLL_DEBUG_INFO@@ ��N � _OUTPUT_DEBUG_STRING_INFO .?AU_OUTPUT_DEBUG_STRING_INFO@@ . � _RIP_INFO .?AU_RIP_INFO@@ �
O6 Exception
B5 CreateThread �
B CreateProcessInfo
2 ExitThread ���
�B ExitProcess ��
�B LoadDll ��
U. UnloadDll
�B DebugString ��
�B RipInfo ��2 �B � <anonymous-tag> .?AT<anonymous-tag>@@ �B � m Z
" dwDebugEventCode �
" dwProcessId ��
" dwThreadId ���
�B u 6 �B � _DEBUG_EVENT .?AU_DEBUG_EVENT@@ �� �B � i ^ � _PERFINFO_DRIVER_COMPLETE_REQUEST .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST@@ B
RoutineAddr ��
Irp ��
" UniqMatchId ��^ �B _PERFINFO_DRIVER_COMPLETE_REQUEST .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST@@ �B c > � tagEMRALPHABLEND .?AUtagEMRALPHABLEND@@ ��R
� emr ��
d rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
J 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d cxSrc
h cySrc > �B l tagEMRALPHABLEND .?AUtagEMRALPHABLEND@@ �� �B � � " k " # # � �B
�B
b5 N � _OBJECT_TYPES_INFORMATION .?AU_OBJECT_TYPES_INFORMATION@@
" NumberOfTypes N �B _OBJECT_TYPES_INFORMATION .?AU_OBJECT_TYPES_INFORMATION@@ �B 2 R
%A
�0
8 R � tagTOUCH_HIT_TESTING_INPUT .?AUtagTOUCH_HIT_TESTING_INPUT@@ ��z
u pointerId
� point
! boundingBox ��
! nonOccludedBoundingBox ���
u , orientation ��R �B 0 tagTOUCH_HIT_TESTING_INPUT .?AUtagTOUCH_HIT_TESTING_INPUT@@ �� �B , F � _WOF_EXTERNAL_FILE_ID .?AU_WOF_EXTERNAL_FILE_ID@@
�B
n FileId ���F �B _WOF_EXTERNAL_FILE_ID .?AU_WOF_EXTERNAL_FILE_ID@@ �B � �!
�/ b � _WMI_EXTENDED_THREAD_INFORMATION64 .?AU_WMI_EXTENDED_THREAD_INFORMATION64@@ ��
�B v
" ProcessId
" ThreadId �
# StackBase64 ��
# StackLimit64 �
# UserStackBase64 ��
# UserStackLimit64 �
# ( StartAddr64 ��
# ( Affinity �
# 0 Win32StartAddr64 �
# 8 TebBase64
" @ SubProcessTag
p D BasePriority �
E PagePriority �
F IoPriority ���
G Flags
| H ThreadName ���b �B P _WMI_EXTENDED_THREAD_INFORMATION64 .?AU_WMI_EXTENDED_THREAD_INFORMATION64@@ �� C c (
�4 * � HTASK__ .?AUHTASK__@@
C
t unused ���* C HTASK__ .?AUHTASK__@@ C �' :
# BaseAddress ��
# Size �
" Flags j C _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE@@ C ? �
�-
�>
#
C " @ �
SourceId �
# Policy ���
�0 ResultCode ���
ResultStatus �
# Time �
" EntropyLength
C $ EntropyData ��Z C h _BOOT_ENTROPY_SOURCE_NT_RESULT .?AU_BOOT_ENTROPY_SOURCE_NT_RESULT@@ �� C � D
�6
� R � tagUPDATELAYEREDWINDOWINFO .?AUtagUPDATELAYEREDWINDOWINFO@@ ��
C
� ��
C
e ��
C : � _BLENDFUNCTION .?AU_BLENDFUNCTION@@ ��
C ��
C
! ��
C �
" cbSize ���
� hdcDst ���
C pptDst ���
C psize
� hdcSrc ���
C ( pptSrc ���
" 0 crKey
C 8 pblend ���
" @ dwFlags ��
C H prcDirty �R
C P tagUPDATELAYEREDWINDOWINFO .?AUtagUPDATELAYEREDWINDOWINFO@@ �� !C �
.
, > � tagEMRPOLYDRAW16 .?AUtagEMRPOLYDRAW16@@ ��Z
� emr ��
d rclBounds
" cpts �
| apts �
� abTypes ��> &C $ tagEMRPOLYDRAW16 .?AUtagEMRPOLYDRAW16@@ �� 'C � Z R � _JOURNAL_CLIENT_INFORMATION .?AU_JOURNAL_CLIENT_INFORMATION@@ r
� StartTimeStamp ���
� CurrentTimeStamp �
# RecordsToProcess �
" RelativeFillLevel R *C _JOURNAL_CLIENT_INFORMATION .?AU_JOURNAL_CLIENT_INFORMATION@@ +C � J � tagEMRGLSBOUNDEDRECORD .?AUtagEMRGLSBOUNDEDRECORD@@ ��J
� emr ��
d rclBounds
" cbData ���
� Data �J .C tagEMRGLSBOUNDEDRECORD .?AUtagEMRGLSBOUNDEDRECORD@@ �� /C � �
I b � _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_V2@@
2C 2
# ClientSession
ClientProcess b 4C _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_V2@@ 5C � =)
y9 & " p � � " ( �
8C Timelines
& CpuTimeline ��
& DiskTimeline �
& NetworkTimeline ��
& MBBTimeline ��
& ForegroundTimeline ���
& ( DesktopVisibleTimeline ���
& 0 CompositionRenderedTimeline ��
& 8 CompositionDirtyGeneratedTimeline
& @ CompositionDirtyPropagatedTimeline ���
& H InputTimeline
& P AudioInTimeline ��
& X AudioOutTimeline �
& ` DisplayRequiredTimeline ��
& h KeyboardInputTimeline
9C p Durations
� p InputDuration
� x AudioInDuration ��
� � AudioOutDuration �
� � DisplayRequiredDuration ��
� � PSMBackgroundDuration
" � KeyboardInput
" � MouseInput ���^ :C � _PROCESS_ENERGY_VALUES_EXTENSION .?AU_PROCESS_ENERGY_VALUES_EXTENSION@@ �� ;C � E
p B � _ENCRYPTION_BUFFER .?AU_ENCRYPTION_BUFFER@@ ��6
" EncryptionOperation ��
� Private ��B ?C _ENCRYPTION_BUFFER .?AU_ENCRYPTION_BUFFER@@ �� @C � �
3/ J � DISPLAYCONFIG_2DREGION .?AUDISPLAYCONFIG_2DREGION@@ ��"
u cx ���
u cy ���J DC DISPLAYCONFIG_2DREGION .?AUDISPLAYCONFIG_2DREGION@@ �� EC � &
# Offset ���
# Flags F GC _CFG_CALL_TARGET_INFO .?AU_CFG_CALL_TARGET_INFO@@ HC � �
�,
~ Z � _POWER_THROTTLING_THREAD_STATE .?AU_POWER_THROTTLING_THREAD_STATE@@ ��B
" Version ��
" ControlMask ��
" StateMask Z MC _POWER_THROTTLING_THREAD_STATE .?AU_POWER_THROTTLING_THREAD_STATE@@ �� NC ? � N � _TPP_THREAD_DATA_CALLBACK .?AU_TPP_THREAD_DATA_CALLBACK@@ V � _SHARED_VIRTUAL_DISK_SUPPORT .?AU_SHARED_VIRTUAL_DISK_SUPPORT@@ ��>
� SharedVirtualDiskSupport �
N HandleState ��V RC _SHARED_VIRTUAL_DISK_SUPPORT .?AU_SHARED_VIRTUAL_DISK_SUPPORT@@ �� SC � �'
w)
�-
V+
� PerProcessUserTimeLimit ��
� PerJobUserTimeLimit ��
" LimitFlags ���
# MinimumWorkingSetSize
# MaximumWorkingSetSize
" ( ActiveProcessLimit ���
# 0 Affinity �
" 8 PriorityClass
" < SchedulingClass ��b XC @ _JOBOBJECT_BASIC_LIMIT_INFORMATION .?AU_JOBOBJECT_BASIC_LIMIT_INFORMATION@@ �� YC ? T V � _MANAGE_HOT_PATCH_LOAD_PATCH .?AU_MANAGE_HOT_PATCH_LOAD_PATCH@@ ��
[C &
T Sid ��
� Buffer ���2 ]C D <anonymous-tag> .?AT<anonymous-tag>@@ ^C t ` R
" Version ��
PatchPath
^C UserSid ��
./ \ BaseInfo �V `C h _MANAGE_HOT_PATCH_LOAD_PATCH .?AU_MANAGE_HOT_PATCH_LOAD_PATCH@@ �� aC t R N � _SYSTEM_VDM_INSTEMUL_INFO .?AU_SYSTEM_VDM_INSTEMUL_INFO@@ R
" SegmentNotPresent
" VdmOpcode0F ��
" OpcodeESPrefix ���
" OpcodeCSPrefix ���
" OpcodeSSPrefix ���
" OpcodeDSPrefix ���
" OpcodeFSPrefix ���
" OpcodeGSPrefix ���
" OpcodeOPER32Prefix ���
" $ OpcodeADDR32Prefix ���
" ( OpcodeINSB ���
" , OpcodeINSW ���
" 0 OpcodeOUTSB ��
" 4 OpcodeOUTSW ��
" 8 OpcodePUSHF ��
" < OpcodePOPF ���
" @ OpcodeINTnn ��
" D OpcodeINTO ���
" H OpcodeIRET ���
" L OpcodeINBimm �
" P OpcodeINWimm �
" T OpcodeOUTBimm
" X OpcodeOUTWimm
" \ OpcodeINB
" ` OpcodeINW
" d OpcodeOUTB ���
" h OpcodeOUTW ���
" l OpcodeLOCKPrefix �
" p OpcodeREPNEPrefix
" t OpcodeREPPrefix ��
" x OpcodeHLT
" | OpcodeCLI
" � OpcodeSTI
" � BopCount �N " dC � _SYSTEM_VDM_INSTEMUL_INFO .?AU_SYSTEM_VDM_INSTEMUL_INFO@@ eC � �
a
2 � SystemActivityModerationStateSystemManaged ��� SystemActivityModerationStateUserManagedAllowThrottling �� SystemActivityModerationStateUserManagedDisableThrottling MaxSystemActivityModerationState �Z t iC _SYSTEM_ACTIVITY_MODERATION_STATE .?AW4_SYSTEM_ACTIVITY_MODERATION_STATE@@ � jC �
�9
5: 6 � _TOKEN_OWNER .?AU_TOKEN_OWNER@@ ��
Owner 6 oC _TOKEN_OWNER .?AU_TOKEN_OWNER@@ �� pC x � J � _CONSOLE_SELECTION_INFO .?AU_CONSOLE_SELECTION_INFO@@ J
" dwFlags ��
�" dwSelectionAnchor
�: srSelection ��J sC _CONSOLE_SELECTION_INFO .?AU_CONSOLE_SELECTION_INFO@@ tC M% k
�" R � _FILE_OBJECTID_INFORMATION .?AU_FILE_OBJECTID_INFORMATION@@ ��
wC �
FileReference
p ObjectId �
p BirthVolumeId
p ( BirthObjectId
p 8 DomainId �
6 ExtendedInfo �R yC H _FILE_OBJECTID_INFORMATION .?AU_FILE_OBJECTID_INFORMATION@@ �� zC � d 6 � tagEXTLOGPEN .?AUtagEXTLOGPEN@@ ��
" elpPenStyle ��
" elpWidth �
u elpBrushStyle
" elpColor �
# elpHatch �
" elpNumEntries
z elpStyleEntry 6 }C tagEXTLOGPEN .?AUtagEXTLOGPEN@@ �� ~C � x
�= > � _VM_COUNTERS_EX2 .?AU_VM_COUNTERS_EX2@@ ��
�C V
. CountersEx ���
# ` PrivateWorkingSetSize
# h SharedCommitUsage > �C p _VM_COUNTERS_EX2 .?AU_VM_COUNTERS_EX2@@ �� �C ?
q �C
� Z � _KEY_VALUE_PARTIAL_INFORMATION .?AU_KEY_VALUE_PARTIAL_INFORMATION@@ ��R
" TitleIndex ���
" Type �
" DataLength ���
� Data �Z �C _KEY_VALUE_PARTIAL_INFORMATION .?AU_KEY_VALUE_PARTIAL_INFORMATION@@ �� �C Y R � _PO_SPR_ACTIVE_SESSION_DATA .?AU_PO_SPR_ACTIVE_SESSION_DATA@@ .
Start
ActiveSessionGuid R �C _PO_SPR_ACTIVE_SESSION_DATA .?AU_PO_SPR_ACTIVE_SESSION_DATA@@ �C x ?
�
@ EventTraceInformationClass ���
CoverageSamplerInformationClass ��
MajorVersion �
MinorVersion �
Reserved �
# SamplerHandle n �C _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION .?AU_EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION@@ �C A � N � _INVERTED_FUNCTION_TABLE .?AU_INVERTED_FUNCTION_TABLE@@ ��
�C " 0 �n
" CurrentSize ��
" MaximumSize ��
� Epoch
Overflow �
�C TableEntry ���N �C 0_INVERTED_FUNCTION_TABLE .?AU_INVERTED_FUNCTION_TABLE@@ �� �C � f � _CSV_QUERY_FILE_REVISION_FILE_ID_128 .?AU_CSV_QUERY_FILE_REVISION_FILE_ID_128@@ �� " �.
n FileId ���
�C FileRevision �f �C ( _CSV_QUERY_FILE_REVISION_FILE_ID_128 .?AU_CSV_QUERY_FILE_REVISION_FILE_ID_128@@ �� �C � �
? J � _FILE_DISPOSITION_INFO .?AU_FILE_DISPOSITION_INFO@@ ��
DeleteFileA ��J �C _FILE_DISPOSITION_INFO .?AU_FILE_DISPOSITION_INFO@@ �� �C o �" n � _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION@@ �
� IdleTime �
� KernelTime ���
� UserTime �
� DpcTime ��
� InterruptTime
" ( InterruptCount ���n �C 0 _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION@@ �C � �
�A
A)
� z � _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION .?AU_SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION@@ ��
�C >
" NumberOfLogicalProcessors
" NumberOfCores z �C _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION .?AU_SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION@@ �� �C �
n � DISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION .?AUDISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION@@ ��
u ��
u ��f
header ���
�C disableMonitorVirtualResolution ��
�C reserved �
u value n �C DISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION .?AUDISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION@@ �� �C � < : � _MCA_EXCEPTION .?AU_MCA_EXCEPTION@@ ��
" Dummy : �C _MCA_EXCEPTION .?AU_MCA_EXCEPTION@@ ��& onecore\external\ddk\inc\mce.h � �C �C t
�)
[:
�B ^ � _RTL_IMAGE_MITIGATION_DEP_POLICY .?AU_RTL_IMAGE_MITIGATION_DEP_POLICY@@ ��
�C
� Dep ��^ �C _RTL_IMAGE_MITIGATION_DEP_POLICY .?AU_RTL_IMAGE_MITIGATION_DEP_POLICY@@ �� �C , b � _PERFINFO_VIRTUAL_ALLOC_XPARTITION .?AU_PERFINFO_VIRTUAL_ALLOC_XPARTITION@@ ��6
CapturedBase �
! TargetPartition ��b �C _PERFINFO_VIRTUAL_ALLOC_XPARTITION .?AU_PERFINFO_VIRTUAL_ALLOC_XPARTITION@@ �� �C c `
� B � tagUSEROBJECTFLAGS .?AUtagUSEROBJECTFLAGS@@ ��>
t fInherit �
t fReserved
" dwFlags ��B �C tagUSEROBJECTFLAGS .?AUtagUSEROBJECTFLAGS@@ �� �C �
�/ h " �
�& Header ���
n FileReferenceNumber ��
n ParentFileReferenceNumber
( Usn ��
" 0 Reason ���
" 4 SourceInfo ���
" 8 RemainingExtents �
! < NumberOfExtents ��
! > ExtentSize ���
�C @ Extents ��6
�C P USN_RECORD_V4 .?AUUSN_RECORD_V4@@ �C � � R � _ACCESS_ALLOWED_OBJECT_ACE .?AU_ACCESS_ALLOWED_OBJECT_ACE@@ ��
� Header ���
" Mask �
" Flags
ObjectType ���
InheritedObjectType ��
" , SidStart �R �C 0 _ACCESS_ALLOWED_OBJECT_ACE .?AU_ACCESS_ALLOWED_OBJECT_ACE@@ �� �C x �
a
�4
�6 f � _PROCESS_READWRITEVM_LOGGING_INFORMATION .?AT_PROCESS_READWRITEVM_LOGGING_INFORMATION@@ ��
��
��
��f
Flags
�C EnableReadVmLogging ��
�C EnableWriteVmLogging �
�C Unused ���f �C _PROCESS_READWRITEVM_LOGGING_INFORMATION .?AT_PROCESS_READWRITEVM_LOGGING_INFORMATION@@ �� �C ? Q N � _ImageArchitectureHeader .?AU_ImageArchitectureHeader@@ ��
u ��
u ��J
�C AmaskValue ���
�C AmaskShift ���
" FirstEntryRVA N �C _ImageArchitectureHeader .?AU_ImageArchitectureHeader@@ �� �C � Z J � _IMAGE_DEBUG_DIRECTORY .?AU_IMAGE_DEBUG_DIRECTORY@@ ���
" Characteristics ��
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" Type �
" SizeOfData ���
" AddressOfRawData �
" PointerToRawData �J �C _IMAGE_DEBUG_DIRECTORY .?AU_IMAGE_DEBUG_DIRECTORY@@ �� �C � � b � _SYSTEM_VERIFIER_FAULTS_INFORMATION .?AU_SYSTEM_VERIFIER_FAULTS_INFORMATION@@ b
" Probability ��
" MaxProbability ���
PoolTags �
Applications �b �C ( _SYSTEM_VERIFIER_FAULTS_INFORMATION .?AU_SYSTEM_VERIFIER_FAULTS_INFORMATION@@ �C � � f � _FILE_IO_PRIORITY_HINT_INFORMATION_EX .?AU_FILE_IO_PRIORITY_HINT_INFORMATION_EX@@ 6
� PriorityHint �
BoostOutstanding �f �C _FILE_IO_PRIORITY_HINT_INFORMATION_EX .?AU_FILE_IO_PRIORITY_HINT_INFORMATION_EX@@ �C � �
� � " �
# CommittedMemory ��
# ReservedMemory ���
" NumberOfBackTraceLookups �
" NumberOfBackTraces ���
�C BackTraces ���J �C (_RTL_PROCESS_BACKTRACES .?AU_RTL_PROCESS_BACKTRACES@@ �C �
�$ f � _ACTIVATION_CONTEXT_BASIC_INFORMATION .?AU_ACTIVATION_CONTEXT_BASIC_INFORMATION@@ V
� ActivationContext
hActCtx ��
" Flags
" dwFlags ��f �C _ACTIVATION_CONTEXT_BASIC_INFORMATION .?AU_ACTIVATION_CONTEXT_BASIC_INFORMATION@@ �C � �
Q=
�C
�4 p t D
D
� F � _FILE_ALLOCATION_INFO .?AU_FILE_ALLOCATION_INFO@@
D
� AllocationSize ���F D _FILE_ALLOCATION_INFO .?AU_FILE_ALLOCATION_INFO@@ D o �"
�+ B � _RDR_CALLOUT_STATE .?AU_RDR_CALLOUT_STATE@@ ��
D
D D
D
0 r � _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY .?AU_RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY@@ ��
D *
� DisallowChildProcessCreation �r D _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY .?AU_RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY@@ �� D L
?> �
� KernelTime ���
� UserTime �
� CreateTime ���
" WaitTime �
StartAddress �
( ClientId �
8 Priority �
< BasePriority �
" @ ContextSwitches ��
" D ThreadState ��
" H WaitReason ���R D P _SYSTEM_THREAD_INFORMATION .?AU_SYSTEM_THREAD_INFORMATION@@ �� D � F J � BULK_SECURITY_TEST_DATA .?AUBULK_SECURITY_TEST_DATA@@ 2
" DesiredAccess
� SecurityIds ��J D BULK_SECURITY_TEST_DATA .?AUBULK_SECURITY_TEST_DATA@@ D � �
e �
" Magic
" Count
" Size �
# UserCount
# UserSize �
UserContext ��
D ( Next �
0 Trace > D 8 _RTL_TRACE_BLOCK .?AU_RTL_TRACE_BLOCK@@ �� D N � _ETW_DISKIO_READWRITE_V2 .?AU_ETW_DISKIO_READWRITE_V2@@ ��
" DiskNumber ���
" IrpFlags �
" Size �
" Reserved �
# ByteOffset ���
FileObject ���
IrpAddr ��
# ( HighResResponseTime ��N "D 0 _ETW_DISKIO_READWRITE_V2 .?AU_ETW_DISKIO_READWRITE_V2@@ �� #D c � �%
%D >
u lbStyle ��
" lbColor ��
" lbHatch ��6 'D tagLOGBRUSH32 .?AUtagLOGBRUSH32@@ (D � R
� *D : PortBasicInformation � PortDumpInformation ��F t ,D _PORT_INFORMATION_CLASS .?AW4_PORT_INFORMATION_CLASS@@ � -D � � " �@ F � SYSTEM_BATTERY_STATE .?AUSYSTEM_BATTERY_STATE@@ �� " �
AcOnLine �
BatteryPresent ���
Charging �
Discharging ��
1D Spare1 ���
Tag ��
" MaxCapacity ��
" RemainingCapacity
" Rate �
" EstimatedTime
" DefaultAlert1
" DefaultAlert2 F 2D SYSTEM_BATTERY_STATE .?AUSYSTEM_BATTERY_STATE@@ �� 3D x 0 2 � _DataStream .?AU_DataStream@@ J
! Length ���
! Flags
" Reserved �
# Vdl ��2 6D _DataStream .?AU_DataStream@@ 7D � �
t
R)
�2 6 � tagMETARECORD .?AUtagMETARECORD@@
<D ��
=D ! " �B
" rdSize ���
! rdFunction ���
?D rdParm ���6 @D tagMETARECORD .?AUtagMETARECORD@@ AD � �
�
�-
q@
� b � _PERFINFO_PO_CALIBRATED_PERFCOUNTER .?AU_PERFINFO_PO_CALIBRATED_PERFCOUNTER@@ "
� PerformanceCounter ���b HD _PERFINFO_PO_CALIBRATED_PERFCOUNTER .?AU_PERFINFO_PO_CALIBRATED_PERFCOUNTER@@ ID c �
�!
�A F � _LBR_TRACE_EVENT_DATA .?AU_LBR_TRACE_EVENT_DATA@@ ? " �f
# TimeStamp
" ProcessId
" ThreadId �
" Options ��
ND Entries ��F OD 0 _LBR_TRACE_EVENT_DATA .?AU_LBR_TRACE_EVENT_DATA@@ PD c v � _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY@@ ^
� BlockNonMicrosoftSignedBinaries ��
� EnforceSigningOnModuleDependencies ���v SD _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY@@ TD � � N � _ETW_HEAP_EVENT_EXPANSION .?AU_ETW_HEAP_EVENT_EXPANSION@@ �
j Header ���
HeapHandle ���
# ( CommittedSize
0 Address ��
# 8 FreeSpace
# @ CommittedSpace ���
# H ReservedSpace
" P NoOfUCRs �
# T AllocatedSpace ���N XD \ _ETW_HEAP_EVENT_EXPANSION .?AU_ETW_HEAP_EVENT_EXPANSION@@ YD c �
12 V
" Flags
NewTlsData ���
OldTlsData ���
ThreadId �J \D _THREAD_TLS_INFORMATION .?AU_THREAD_TLS_INFORMATION@@ ]D � b v PROXY_CALCSIZE ��� PROXY_GETBUFFER �� PROXY_MARSHAL PROXY_SENDRECEIVE PROXY_UNMARSHAL ��. t _D PROXY_PHASE .?AW4PROXY_PHASE@@ � `D � N
V � _JOURNAL_ABSOLUTE_INFORMATION .?AU_JOURNAL_ABSOLUTE_INFORMATION@@
bD f
� StartTimeStamp ���
� EndTimeStamp �
# NumberOfRecords ��
" FillLevel V dD _JOURNAL_ABSOLUTE_INFORMATION .?AU_JOURNAL_ABSOLUTE_INFORMATION@@ eD � �
7
�.
>C R � _TRACE_ENABLE_FLAG_EXT_ITEM .?AU_TRACE_ENABLE_FLAG_EXT_ITEM@@ &
! Offset ���
! Type �R lD _TRACE_ENABLE_FLAG_EXT_ITEM .?AU_TRACE_ENABLE_FLAG_EXT_ITEM@@ mD c $
#
� b � _EVENT_TRACE_GROUPMASK_INFORMATION .?AU_EVENT_TRACE_GROUPMASK_INFORMATION@@ ��b
@ EventTraceInformationClass ���
# TraceHandle ��
^ EventTraceGroupMasks �b rD 0 _EVENT_TRACE_GROUPMASK_INFORMATION .?AU_EVENT_TRACE_GROUPMASK_INFORMATION@@ �� sD A � F � _SINGLE_LIST_ENTRY32 .?AU_SINGLE_LIST_ENTRY32@@ ��
" Next �F vD _SINGLE_LIST_ENTRY32 .?AU_SINGLE_LIST_ENTRY32@@ �� wD � >
\ Id ���
" Flags
SpaceGuarantee ���^ yD _STORAGE_RESERVE_AREA_DEFINITION .?AU_STORAGE_RESERVE_AREA_DEFINITION@@ �� zD � �* B
" OffsetInstanceData ���
" LengthInstanceData ���R |D OFFSETINSTANCEDATAANDLENGTH .?AUOFFSETINSTANCEDATAANDLENGTH@@ }D � � �
# SegmentReserveSize ���
# SegmentCommitSize
# SegmentCount �
# AllocatedSize
# LargeAllocReserveSize
# ( LargeAllocCommitSize �v D 0 _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION .?AU_SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION@@ �D � : � tagEMRFILLPATH .?AUtagEMRFILLPATH@@ ��&
� emr ��
d rclBounds : �D tagEMRFILLPATH .?AUtagEMRFILLPATH@@ �� �D � � R
p lpDebugStringData
! fUnicode �
!
nDebugStringLength ���N �D _OUTPUT_DEBUG_STRING_INFO .?AU_OUTPUT_DEBUG_STRING_INFO@@ �D � ] N � _CSV_QUERY_FILE_REVISION .?AU_CSV_QUERY_FILE_REVISION@@ ��
�D .
FileId ���
�C FileRevision �N �D _CSV_QUERY_FILE_REVISION .?AU_CSV_QUERY_FILE_REVISION@@ �� �D � l *
�= ntmTm
�. H ntmFontSig ���B �D ` tagNEWTEXTMETRICEXA .?AUtagNEWTEXTMETRICEXA@@ �D �
p< b
# Attribute
# Size �
# Value
ValuePtr �
# ReturnLength �6 �D _PS_ATTRIBUTE .?AU_PS_ATTRIBUTE@@ �D � �
�B ~ � _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION@@ �� �; " �J
" ProcessorNumber ��
" StateCount ���
�D States ���~ �D _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION@@ �� �D � . � _Reparse .?AU_Reparse@@ ��" � _Ea .?AU_Ea@@ ^
�. DesiredStorageClass ��
5D DataStream ���
�D Reparse ��
�D Ea ���: �D _StreamInformation .?AT_StreamInformation@@ �� �D � �
�-
0(
v3 ��
�D > � _IMAGE_SYMBOL_EX .?AU_IMAGE_SYMBOL_EX@@ ��"
" Short
" Long �: �D <anonymous-tag> .?AU<anonymous-tag>@@ �D � { :
ShortName
�D Name �
8 LongName �2 �D <anonymous-tag> .?AT<anonymous-tag>@@ �D � y ~
�D N
" Value
SectionNumber
! Type �
StorageClass �
NumberOfAuxSymbols ���> �D _IMAGE_SYMBOL_EX .?AU_IMAGE_SYMBOL_EX@@ �� �D � x u !
}
� � � �D
B V � _PERFINFO_DOMAIN_CHANGE_EVENT .?AU_PERFINFO_DOMAIN_CHANGE_EVENT@@ >
# NewDomain
�; Reason ���
" ThreadId �V �D _PERFINFO_DOMAIN_CHANGE_EVENT .?AU_PERFINFO_DOMAIN_CHANGE_EVENT@@ �D c #
�9 F
" SizeStruct ���
" Option ���
� OptionData ���V �D _RTL_PROCESS_VERIFIER_OPTIONS .?AU_RTL_PROCESS_VERIFIER_OPTIONS@@ �D � # �D
�D : � _EXCEPTION_LOG .?AU_EXCEPTION_LOG@@ ��
�D �
� ExceptionRecord ��
� � ContextRecord
] 0Type �
4Disposition ��
# 8Thread ���
# @ControlPc
HHandler ��: �D P_EXCEPTION_LOG .?AU_EXCEPTION_LOG@@ �� �D �
" pointerType ��
u pointerId
u frameId ��
u pointerFlags �
sourceDevice �
� hwndTarget ���
� ptPixelLocation ��
� ( ptHimetricLocation ���
� 0 ptPixelLocationRaw ���
� 8 ptHimetricLocationRaw
" @ dwTime ���
u D historyCount �
t H InputData
" L dwKeyStates ��
# P PerformanceCount �
�& X ButtonChangeType �: �D ` tagPOINTER_INFO .?AUtagPOINTER_INFO@@ �D � R � _TXFS_GET_METADATA_INFO_OUT .?AU_TXFS_GET_METADATA_INFO_OUT@@ *
LowPart ��
HighPart �: �D <anonymous-tag> .?AU<anonymous-tag>@@ �D � � f
�D TxfFileId
LockingTransaction ���
# LastLsn ��
" ( TransactionState �R �D 0 _TXFS_GET_METADATA_INFO_OUT .?AU_TXFS_GET_METADATA_INFO_OUT@@ �D � � V � _CONSOLE_SCREEN_BUFFER_INFOEX .?AU_CONSOLE_SCREEN_BUFFER_INFOEX@@ " " @ ��
" cbSize ���
�" dwSize ���
�" dwCursorPosition �
! wAttributes ��
�: srWindow �
�" dwMaximumWindowSize ��
! wPopupAttributes �
t bFullscreenSupported �
�D ColorTable ���V �D ` _CONSOLE_SCREEN_BUFFER_INFOEX .?AU_CONSOLE_SCREEN_BUFFER_INFOEX@@ �D �: �
�@
�
� p # t �D
�D V � _PLUGPLAY_CONTROL_DEPTH_DATA .?AU_PLUGPLAY_CONTROL_DEPTH_DATA@@ ��6
DeviceInstance ���
" DeviceDepth ��V �D _PLUGPLAY_CONTROL_DEPTH_DATA .?AU_PLUGPLAY_CONTROL_DEPTH_DATA@@ �� �D % � F � _PO_WAKE_SOURCE_FIXED .?AU_PO_WAKE_SOURCE_FIXED@@ 6
e> Header ���
�6 FixedWakeSourceType ��F �D _PO_WAKE_SOURCE_FIXED .?AU_PO_WAKE_SOURCE_FIXED@@ �D x "
�0 r � _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX@@ ��
�D �
EnableIntegrity ��
KeepIntegrityStateUnchanged ��
! Reserved �
" Flags
Version ��
4/ Reserved2 r �D _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX@@ �� �D � �
�"
�4 j � _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST@@
�D 2
" RequestLevel �
" RequestFlags �j �D _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST@@ �D � ; &
; Next �
�& Handler ��Z �D _EXCEPTION_REGISTRATION_RECORD .?AU_EXCEPTION_REGISTRATION_RECORD@@ �� �D ?
�, F � _REPAIR_COPIES_OUTPUT .?AU_REPAIR_COPIES_OUTPUT@@
�D B
" Size �
Status ���
� ResumeFileOffset �F �D _REPAIR_COPIES_OUTPUT .?AU_REPAIR_COPIES_OUTPUT@@ �D � F
G TP_DEBUG_CLASS_POOL ��6 t �D _TP_DEBUG_CLASS .?AW4_TP_DEBUG_CLASS@@ � �D � 5
�D
�@
�
�!
W Tail �6 �D _LDRP_CSLIST .?AU_LDRP_CSLIST@@ �� E � � * � HUMPD__ .?AUHUMPD__@@
E
t unused ���* E HUMPD__ .?AUHUMPD__@@ E t x � TOKEN_SECURITY_ATTRIBUTE_OPERATION_NONE �� TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL ��� TOKEN_SECURITY_ATTRIBUTE_OPERATION_ADD ��� TOKEN_SECURITY_ATTRIBUTE_OPERATION_DELETE TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE ���^ t E _TOKEN_SECURITY_ATTRIBUTE_OPERATION .?AW4_TOKEN_SECURITY_ATTRIBUTE_OPERATION@@ � E � - b � _SYSTEM_PROCESSOR_POWER_INFORMATION .?AU_SYSTEM_PROCESSOR_POWER_INFORMATION@@
E Z
CurrentFrequency �
ThermalLimitFrequency
ConstantThrottleFrequency
DegradedThrottleFrequency
LastBusyFrequency
LastC3Frequency ��
LastAdjustedBusyFrequency
ProcessorMinThrottle �
ProcessorMaxThrottle �
" NumberOfFrequencies ��
" PromotionCount ���
" DemotionCount
" ErrorCount ���
" RetryCount ���
# CurrentFrequencyTime �
# ( CurrentProcessorTime �
# 0 CurrentProcessorIdleTime �
# 8 LastProcessorTime
# @ LastProcessorIdleTime
# H Energy ���b E P _SYSTEM_PROCESSOR_POWER_INFORMATION .?AU_SYSTEM_PROCESSOR_POWER_INFORMATION@@
E � D
I2 R � _FSCTL_QUERY_FAT_BPB_BUFFER .?AU_FSCTL_QUERY_FAT_BPB_BUFFER@@
E " $ �*
E First0x24BytesOfBootSector ���R E $ _FSCTL_QUERY_FAT_BPB_BUFFER .?AU_FSCTL_QUERY_FAT_BPB_BUFFER@@ E � � N � _IO_SESSION_CONNECT_INFO .?AU_IO_SESSION_CONNECT_INFO@@ ��.
" SessionId
LocalSession �N E _IO_SESSION_CONNECT_INFO .?AU_IO_SESSION_CONNECT_INFO@@ �� E � *
�?
r2 b � _ALPC_PORT_MESSAGE_ZONE_INFORMATION .?AU_ALPC_PORT_MESSAGE_ZONE_INFORMATION@@ &
Buffer ���
" Size �b E _ALPC_PORT_MESSAGE_ZONE_INFORMATION .?AU_ALPC_PORT_MESSAGE_ZONE_INFORMATION@@ E � & � AlpcMessageSidInformation AlpcMessageTokenModifiedIdInformation AlpcMessageDirectStatusInformation ��� AlpcMessageHandleInformation �V t !E _ALPC_MESSAGE_INFORMATION_CLASS .?AW4_ALPC_MESSAGE_INFORMATION_CLASS@@ � "E � �
*2 F � _SYSTEM_POWER_STATUS .?AU_SYSTEM_POWER_STATUS@@ ��
ACLineStatus �
BatteryFlag ��
BatteryLifePercent ���
SystemStatusFlag �
" BatteryLifeTime ��
" BatteryFullLifeTime ��F &E _SYSTEM_POWER_STATUS .?AU_SYSTEM_POWER_STATUS@@ �� 'E o )
K?
�( > � _TOKEN_ELEVATION .?AU_TOKEN_ELEVATION@@ ��
" TokenIsElevated ��> ,E _TOKEN_ELEVATION .?AU_TOKEN_ELEVATION@@ �� -E x �
�"
" ��
0E
�6
�= R � _FILE_PIPE_WAIT_FOR_BUFFER .?AU_FILE_PIPE_WAIT_FOR_BUFFER@@ ��
4E Z
� Timeout ��
" NameLength ���
TimeoutSpecified �
| Name �R 6E _FILE_PIPE_WAIT_FOR_BUFFER .?AU_FILE_PIPE_WAIT_FOR_BUFFER@@ �� 7E � () B � tagHW_PROFILE_INFOW .?AUtagHW_PROFILE_INFOW@@ q " N �R
" dwDockInfo ���
:E szHwProfileGuid ��
�! R szHwProfileName ��B ;E � tagHW_PROFILE_INFOW .?AUtagHW_PROFILE_INFOW@@ <E o � Z � _ETW_COVERAGE_SAMPLER_PERF_INFO .?AU_ETW_COVERAGE_SAMPLER_PERF_INFO@@ *
$ Common ���
�; PerfStats Z ?E �_ETW_COVERAGE_SAMPLER_PERF_INFO .?AU_ETW_COVERAGE_SAMPLER_PERF_INFO@@ @E A ( J � _TXFS_LIST_TRANSACTIONS .?AU_TXFS_LIST_TRANSACTIONS@@
BE B
# NumberOfTransactions �
# BufferSizeRequired ���J DE _TXFS_LIST_TRANSACTIONS .?AU_TXFS_LIST_TRANSACTIONS@@ EE � C J � _RTL_SPARSE_BITMAP_CTX .?AU_RTL_SPARSE_BITMAP_CTX@@ ��
?"
HE
" ��
" ��
" ��
" ��
# Lock �
IE BitmapRanges �
@" RangeArrayCommitStatus ���
�- AllocateRoutine ��
�- ( FreeRoutine ��
" 0 RangeCount ���
" 4 RangeIndexLimit ��
" 8 BitsPerRange �
" < RangeCountMax
" @ RangeMetadataOffset ��
" D MetadataSizePerBit ���
JE H DefaultBitsSet ���
KE H SparseRangeArray �
LE H NoInternalLocking
ME H SpareFlags ���J NE P _RTL_SPARSE_BITMAP_CTX .?AU_RTL_SPARSE_BITMAP_CTX@@ �� OE �
�$
��
��
��
��
��
��
���
TransferAddress ��
" ZeroBits �
# MaximumStackSize �
# CommittedStackSize ���
" SubSystemType
! $ SubSystemMinorVersion
! & SubSystemMajorVersion
" $ SubSystemVersion �
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
" ( OperatingSystemVersion ���
! , ImageCharacteristics �
! . DllCharacteristics ���
! 0 Machine ��
2 ImageContainsCode
3 ImageFlags ���
RE 3 ComPlusNativeReady ���
SE 3 ComPlusILOnly
TE 3 ImageDynamicallyRelocated
UE 3 ImageMappedFlat ��
VE 3 BaseBelow4gb �
WE 3 ComPlusPrefer32bit ���
XE 3 Reserved �
" 4 LoaderFlags ��
" 8 ImageFileSize
" < CheckSum �R YE @ _SECTION_IMAGE_INFORMATION .?AU_SECTION_IMAGE_INFORMATION@@ �� ZE t w v
" NextEntryOffset ��
" TotalSize
" TotalInUse ���
" PeakUsage
PageFileName �V \E _SYSTEM_PAGEFILE_INFORMATION .?AU_SYSTEM_PAGEFILE_INFORMATION@@ �� ]E � ?
;
�D
u-
{(
�6 N � _FILE_ATTRIBUTE_TAG_INFO .?AU_FILE_ATTRIBUTE_TAG_INFO@@ ��6
" FileAttributes ���
" ReparseTag ���N eE _FILE_ATTRIBUTE_TAG_INFO .?AU_FILE_ATTRIBUTE_TAG_INFO@@ �� fE o �" N � STARTING_VCN_INPUT_BUFFER .?AUSTARTING_VCN_INPUT_BUFFER@@
� StartingVcn ��N iE STARTING_VCN_INPUT_BUFFER .?AUSTARTING_VCN_INPUT_BUFFER@@ jE � T
F � _RPC_SERVER_INTERFACE .?AU_RPC_SERVER_INTERFACE@@ �
u Length ���
3 InterfaceId ��
3 TransferSyntax ���
�! 0 DispatchTable
u 8 RpcProtseqEndpointCount ��
�! @ RpcProtseqEndpoint ���
H DefaultManagerEpv
P InterpreterInfo ��
u X Flags F mE ` _RPC_SERVER_INTERFACE .?AU_RPC_SERVER_INTERFACE@@ nE 7 � j � _SERVICE_CONTROL_STATUS_REASON_PARAMSW .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSW@@ ��F
" dwReason �
q pszComment ���
� ServiceStatus j qE 8 _SERVICE_CONTROL_STATUS_REASON_PARAMSW .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSW@@ �� rE � �
] F � _CONSOLE_HISTORY_INFO .?AU_CONSOLE_HISTORY_INFO@@ j
u cbSize ���
u HistoryBufferSize
u NumberOfHistoryBuffers ���
" dwFlags ��F vE _CONSOLE_HISTORY_INFO .?AU_CONSOLE_HISTORY_INFO@@ wE M% Z ReadDirectoryNotifyInformation ��� ReadDirectoryNotifyExtendedInformation ���j t yE _READ_DIRECTORY_NOTIFY_INFORMATION_CLASS .?AW4_READ_DIRECTORY_NOTIFY_INFORMATION_CLASS@@ ��� zE � �
zE
��
}E
V7 R � _MEMORY_BASIC_INFORMATION32 .?AU_MEMORY_BASIC_INFORMATION32@@
�E �
" BaseAddress ��
" AllocationBase ���
" AllocationProtect
" RegionSize ���
" State
" Protect ��
" Type �R �E _MEMORY_BASIC_INFORMATION32 .?AU_MEMORY_BASIC_INFORMATION32@@ �E � _
v
�@
�) N
Handle ���
ClientId �
" Type �
Stacks ���V �E � _PROCESS_HANDLE_TRACING_ENTRY .?AU_PROCESS_HANDLE_TRACING_ENTRY@@ �E ? N B � _ETW_UMS_EVENT_PARK .?AU_ETW_UMS_EVENT_PARK@@ F
" ProcessId
" ScheduledThreadId
" ParkFlags B �E _ETW_UMS_EVENT_PARK .?AU_ETW_UMS_EVENT_PARK@@ �E c �
J � _WMI_LOGGER_INFORMATION .?AU_WMI_LOGGER_INFORMATION@@
�E
# ��
# ��
# ��
# ��
� Wnode
" 0 BufferSize ���
" 4 MinimumBuffers ���
" 8 MaximumBuffers ���
" < MaximumFileSize ��
" @ LogFileMode ��
" D FlushTimer ���
" H EnableFlags ��
L AgeLimit �
L FlushThreshold ���
�E P Wow ��
�E P QpcDeltaTracking �
�E P LargeMdlPages
�E P ExcludeKernelStack ���
# P V2Options
X LogFileHandle
# X LogFileHandle64 ��
" ` NumberOfBuffers ��
" ` InstanceCount
" d FreeBuffers ��
" d InstanceId ���
" h EventsLost ���
" h NumberOfProcessors ���
" l BuffersWritten ���
" p LogBuffersLost ���
" p Flags
" t RealTimeBuffersLost ��
x LoggerThreadId ���
# x LoggerThreadId64 �
� LogFileName ��
� � LogFileName64
� LoggerName ���
� � LoggerName64 �
" � RealTimeConsumerCount
" � SequenceNumber ���
� LoggerExtension ��
# � LoggerExtension64 J % �E � _WMI_LOGGER_INFORMATION .?AU_WMI_LOGGER_INFORMATION@@ �E c @ 6 � tagPOLYTEXTW .?AUtagPOLYTEXTW@@ ��
�E j
t x
t y
u n
lpstr
u uiFlags ��
! rcl ��
t 0 pdx ��6 �E 8 tagPOLYTEXTW .?AUtagPOLYTEXTW@@ �� �E � G
b � _SERVICE_REQUIRED_PRIVILEGES_INFOA .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOA@@ ��
�E &
p pmszRequiredPrivileges ���b �E _SERVICE_REQUIRED_PRIVILEGES_INFOA .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOA@@ �� �E � Q %
�E
�B
� �E
�E
�C
$9 ^ � _JOBOBJECT_BASIC_UI_RESTRICTIONS .?AU_JOBOBJECT_BASIC_UI_RESTRICTIONS@@ ��"
" UIRestrictionsClass ��^ �E _JOBOBJECT_BASIC_UI_RESTRICTIONS .?AU_JOBOBJECT_BASIC_UI_RESTRICTIONS@@ �� �E ? �
�- R � _WIM_PROVIDER_OVERLAY_ENTRY .?AU_WIM_PROVIDER_OVERLAY_ENTRY@@ �
" NextEntryOffset ��
� DataSourceId �
WimGuid ��
" WimFileNameOffset
" $ WimType ��
" ( WimIndex �
" , Flags R �E 0 _WIM_PROVIDER_OVERLAY_ENTRY .?AU_WIM_PROVIDER_OVERLAY_ENTRY@@ �E � ;"
H
�C ^ � _IMAGE_CE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_CE_RUNTIME_FUNCTION_ENTRY@@ ��
" ��
" ��
" ��
" ��n
" FuncStart
�E PrologLen
�E FuncLen ��
�E ThirtyTwoBit �
�E ExceptionFlag ^ �E _IMAGE_CE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_CE_RUNTIME_FUNCTION_ENTRY@@ �� �E � � � PowerRequestDisplayRequired �� PowerRequestSystemRequired ��� PowerRequestAwayModeRequired � PowerRequestExecutionRequired > t �E _POWER_REQUEST_TYPE .?AW4_POWER_REQUEST_TYPE@@ � �E x H .
� pfnAllocate ��
� pfnFree ��B �E _MALLOC_FREE_STRUCT .?AU_MALLOC_FREE_STRUCT@@ �E � �
JA a> F � _ETW_HEAP_EVENT_FREE .?AU_ETW_HEAP_EVENT_FREE@@ ��V
j Header ���
HeapHandle ���
( Address ��
" 0 Source ���F �E 4 _ETW_HEAP_EVENT_FREE .?AU_ETW_HEAP_EVENT_FREE@@ �� �E c �
COMPARE_STRING ���6 t �E SYSNLS_FUNCTION .?AW4SYSNLS_FUNCTION@@ � �E W � R � _FILE_FULL_DIR_INFORMATION .?AU_FILE_FULL_DIR_INFORMATION@@ ��
�E &
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
| D FileName �R �E H _FILE_FULL_DIR_INFORMATION .?AU_FILE_FULL_DIR_INFORMATION@@ �� �E � � �
Buffer ���
" BufferSize ���
� pfnAllocate ��
� pfnFree ��
4 pRpcChannelBuffer
� ( Reserved �V �E P _NDR_USER_MARSHAL_INFO_LEVEL1 .?AU_NDR_USER_MARSHAL_INFO_LEVEL1@@ �E � J � _ETW_CRITSEC_EVENT_INIT .?AU_ETW_CRITSEC_EVENT_INIT@@
�E >
j Header ���
SpinCount
( Address ��J �E 0 _ETW_CRITSEC_EVENT_INIT .?AU_ETW_CRITSEC_EVENT_INIT@@ �E c � B � _LDR_RESLOADER_RET .?AU_LDR_RESLOADER_RET@@ ��B
Module ���
DataEntry
TargetModule �B �E _LDR_RESLOADER_RET .?AU_LDR_RESLOADER_RET@@ �� �E b � " " � �E .
pValue ���
" ValueLength ��v �E _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ �� �E x [
X
f
�&
�, �D
K7 �
" EntryLength ��
" DependencyTypeFlags ��
" ProviderSpecificFlags
� VirtualStorageType ���
" AncestorLevel
" $ HostVolumeNameOffset �
" ( HostVolumeNameSize ���
" , DependentVolumeNameOffset
" 0 DependentVolumeNameSize ��
" 4 RelativePathOffset ���
" 8 RelativePathSize �
" < DependentDeviceNameOffset
" @ DependentDeviceNameSize ��r
�E D _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY@@ �� �E � J
/ 2
# JobMemory
# PeakJobMemoryUsed b �E _JOBOBJECT_MEMORY_USAGE_INFORMATION .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION@@ �E � O
� F � _OPTICAL_MEDIA_RECORD .?AU_OPTICAL_MEDIA_RECORD@@
�E ~
! DiskNumber ���
! BusType ��
! DeviceType ���
! MediaType
# StartingOffset ���
# Size �
# NumberOfFreeBlocks ���
# TotalNumberOfBlocks ��
# ( NextWritableAddress ��
" 0 NumberOfSessions �
" 4 NumberOfTracks ���
" 8 BytesPerSector ���
! < DiscStatus ���
! > LastSessionStatus
| @ Data �F �E H _OPTICAL_MEDIA_RECORD .?AU_OPTICAL_MEDIA_RECORD@@ �E c 3
z8 J � _WIN32K_SYSCALL_FILTER .?AU_WIN32K_SYSCALL_FILTER@@ ��
�E .
" FilterState ��
" FilterSet J �E _WIN32K_SYSCALL_FILTER .?AU_WIN32K_SYSCALL_FILTER@@ �� �E ? �
" Characteristics ��
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" Name �
" Base �
" NumberOfFunctions
" NumberOfNames
" AddressOfFunctions ���
" AddressOfNames ���
" $ AddressOfNameOrdinals J �E ( _IMAGE_EXPORT_DIRECTORY .?AU_IMAGE_EXPORT_DIRECTORY@@ �E � j F � _CONSOLE_CURSOR_INFO .?AU_CONSOLE_CURSOR_INFO@@ ��*
" dwSize ���
t bVisible �F F _CONSOLE_CURSOR_INFO .?AU_CONSOLE_CURSOR_INFO@@ �� F �: �
#B N � _WMI_TRACE_MESSAGE_PACKET .?AU_WMI_TRACE_MESSAGE_PACKET@@ 2
! MessageNumber
! OptionFlags ��N F _WMI_TRACE_MESSAGE_PACKET .?AU_WMI_TRACE_MESSAGE_PACKET@@ F c } v � _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE@@ J
# TimeAdjustment ���
# TimeIncrement
Enable ���v
F _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE@@ F � i J � _FILE_ID_BOTH_DIR_INFO .?AU_FILE_ID_BOTH_DIR_INFO@@ ��j
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
p D ShortNameLength ��
� F ShortName
� ` FileId ���
| h FileName �J F p _FILE_ID_BOTH_DIR_INFO .?AU_FILE_ID_BOTH_DIR_INFO@@ �� F o �"
� �# " �V
Version ��
4/ Reserved0
# ApplicationId
F Policies �J F _IMAGE_POLICY_METADATA .?AU_IMAGE_POLICY_METADATA@@ �� F b �&
�7 V � _SYSTEM_ROOT_SILO_INFORMATION .?AU_SYSTEM_ROOT_SILO_INFORMATION@@ 2
" NumberOfSilos
� SiloIdList ���V F _SYSTEM_ROOT_SILO_INFORMATION .?AU_SYSTEM_ROOT_SILO_INFORMATION@@ F � � Z � DISPLAYCONFIG_VIDEO_SIGNAL_INFO .?AUDISPLAYCONFIG_VIDEO_SIGNAL_INFO@@ "
F targetVideoSignalInfo N F 0 DISPLAYCONFIG_TARGET_MODE .?AUDISPLAYCONFIG_TARGET_MODE@@ F � c
? - F
i# N � _VARIABLE_NAME_AND_VALUE .?AU_VARIABLE_NAME_AND_VALUE@@ ��
" NextEntryOffset ��
" ValueOffset ��
" ValueLength ��
" Attributes ���
VendorGuid ���
| Name �N #F $ _VARIABLE_NAME_AND_VALUE .?AU_VARIABLE_NAME_AND_VALUE@@ �� $F � 3
� V � _PLUGPLAY_CONTROL_STATUS_DATA .?AU_PLUGPLAY_CONTROL_STATUS_DATA@@
'F �
DeviceInstance ���
" Operation
" DeviceStatus �
" DeviceProblem
" Flags
ProblemStatus V )F ( _PLUGPLAY_CONTROL_STATUS_DATA .?AU_PLUGPLAY_CONTROL_STATUS_DATA@@ *F % � > � _CM_RESOURCE_LIST .?AU_CM_RESOURCE_LIST@@
,F �4 " $ �"
" Count
.F List �> /F ( _CM_RESOURCE_LIST .?AU_CM_RESOURCE_LIST@@ 0F x > � _EVENTSFORLOGFILE .?AU_EVENTSFORLOGFILE@@ �& " �f
" ulSize ���
� szLogicalLogFile �
" ulNumRecords �
3F pEventLogRecords �> 4F _EVENTSFORLOGFILE .?AU_EVENTSFORLOGFILE@@ 5F �& t
u ��
u ��
u
��J
7F videoStandard
8F vSyncFreqDivider �
9F reserved �: :F <anonymous-tag> .?AU<anonymous-tag>@@ ;F � % �
# pixelRate
83 hSyncFreq
83 vSyncFreq
CC activeSize ���
CC totalSize
;F ( AdditionalSignalInfo �
u ( videoStandard
:3 , scanLineOrdering �Z =F 0 DISPLAYCONFIG_VIDEO_SIGNAL_INFO .?AUDISPLAYCONFIG_VIDEO_SIGNAL_INFO@@ >F �
YB
-, : � tagEMREXTESCAPE .?AUtagEMREXTESCAPE@@ N
� emr ��
t iEscape ��
t cbEscData
� EscData ��: CF tagEMREXTESCAPE .?AUtagEMREXTESCAPE@@ DF � � j � _JOURNAL_CREATE_DELETE_KEY_INFORMATION .?AU_JOURNAL_CREATE_DELETE_KEY_INFORMATION@@ ���
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
" ( SecurityDescriptorLength �
0 SecurityDescriptor ���
! 8 ClassLength ��
@ ClassData
H SymbolicLink �j GF P _JOURNAL_CREATE_DELETE_KEY_INFORMATION .?AU_JOURNAL_CREATE_DELETE_KEY_INFORMATION@@ �� HF � �
o%
D4
�
$&
&
OF
�4
�
Z > � _IMAGE_NT_HEADERS .?AU_IMAGE_NT_HEADERS@@
UF J
" Signature
� FileHeader ���
6 OptionalHeader ���> WF � _IMAGE_NT_HEADERS .?AU_IMAGE_NT_HEADERS@@ XF � | F � _CM_SCSI_DEVICE_DATA .?AU_CM_SCSI_DEVICE_DATA@@ ��
ZF F
! Version ��
! Revision �
HostIdentifier ���F \F _CM_SCSI_DEVICE_DATA .?AU_CM_SCSI_DEVICE_DATA@@ �� ]F �
n : � _FOUR_PART_VERSION .?AT_FOUR_PART_VERSION@@ ��6
" BuildAndRevision �
" MajorAndMinor : aF <anonymous-tag> .?AU<anonymous-tag>@@ bF : F
! Revision �
! Build
! Minor
! Major : dF <anonymous-tag> .?AU<anonymous-tag>@@ eF > >
# Version64
bF Version32
eF Version16 : gF _FOUR_PART_VERSION .?AT_FOUR_PART_VERSION@@ �� hF 8 b � _SYSTEM_MEMORY_CHANNEL_INFORMATION .?AU_SYSTEM_MEMORY_CHANNEL_INFORMATION@@ ��
" ChannelNumber
" ChannelHeatIndex �
# TotalPageCount ���
# ZeroPageCount
# FreePageCount
# StandbyPageCount �b kF ( _SYSTEM_MEMORY_CHANNEL_INFORMATION .?AU_SYSTEM_MEMORY_CHANNEL_INFORMATION@@ �� lF t +
�
-
� &
" Flags
[ FrameName N qF _TEB_ACTIVE_FRAME_CONTEXT .?AU_TEB_ACTIVE_FRAME_CONTEXT@@ rF 7 �
�5 R
\ Id ���
" Flags
SpaceGuarantee ���
SpaceUsed R uF _STORAGE_RESERVE_AREA_INFO .?AU_STORAGE_RESERVE_AREA_INFO@@ �� vF � �*
!* F � tagEMREXCLUDECLIPRECT .?AUtagEMREXCLUDECLIPRECT@@ &
� emr ��
d rclClip ��F zF tagEMREXCLUDECLIPRECT .?AUtagEMREXCLUDECLIPRECT@@ {F � � z
# Address ��
" Flags
# DataSize �
# OverheadSize �
# NextBlockInformationOffset ���J }F ( _HEAP_BLOCK_INFORMATION .?AU_HEAP_BLOCK_INFORMATION@@ ~F �
Z
4 ^ � _ALPC_SERVER_SESSION_INFORMATION .?AU_ALPC_SERVER_SESSION_INFORMATION@@ ��
�F *
" SessionId
" ProcessId ^ �F _ALPC_SERVER_SESSION_INFORMATION .?AU_ALPC_SERVER_SESSION_INFORMATION@@ �� �F � �
�, J � _KEY_CACHED_INFORMATION .?AU_KEY_CACHED_INFORMATION@@ �
� LastWriteTime
" TitleIndex ���
" SubKeys ��
" MaxNameLen ���
" Values ���
" MaxValueNameLen ��
" MaxValueDataLen ��
" NameLength ���J �F ( _KEY_CACHED_INFORMATION .?AU_KEY_CACHED_INFORMATION@@ �F �
( Z � _DISPLAYCONFIG_SDR_WHITE_LEVEL .?AU_DISPLAYCONFIG_SDR_WHITE_LEVEL@@ ��.
header ���
" SDRWhiteLevel Z �F _DISPLAYCONFIG_SDR_WHITE_LEVEL .?AU_DISPLAYCONFIG_SDR_WHITE_LEVEL@@ �� �F � x > � _BOOT_ENTRY_LIST .?AU_BOOT_ENTRY_LIST@@ ��2
" NextEntryOffset ��
z! BootEntry > �F $ _BOOT_ENTRY_LIST .?AU_BOOT_ENTRY_LIST@@ �� �F � � V � _FILE_PIPE_SILO_ARRIVAL_INPUT .?AU_FILE_PIPE_SILO_ARRIVAL_INPUT@@
JobHandle V �F _FILE_PIPE_SILO_ARRIVAL_INPUT .?AU_FILE_PIPE_SILO_ARRIVAL_INPUT@@ �F � Y) B � _FILE_LAYOUT_ENTRY .?AU_FILE_LAYOUT_ENTRY@@ ���
" Version ��
" NextFileOffset ���
" Flags
" FileAttributes ���
# FileReferenceNumber ��
" FirstNameOffset ��
" FirstStreamOffset
" ExtraInfoOffset ��
" $ ExtraInfoLength ��B �F ( _FILE_LAYOUT_ENTRY .?AU_FILE_LAYOUT_ENTRY@@ �� �F � u # /4 " " �F
�F
�<
t unused ���2 �F HMONITOR__ .?AUHMONITOR__@@ �� �F t n
0'
�4 R � _PROCESS_UPTIME_INFORMATION .?AU_PROCESS_UPTIME_INFORMATION@@
" ��
" ��
" ��
" ��
# QueryInterruptTime ���
# QueryUnbiasedTime
# EndInterruptTime �
# TimeSinceCreation
# Uptime ���
# ( SuspendedTime
�F 0 HangCount
�F 0 GhostCount ���
�F 0 Crashed ��
�F 0 Terminated ���R
�F 8 _PROCESS_UPTIME_INFORMATION .?AU_PROCESS_UPTIME_INFORMATION@@ �F � �
�
jB
�B
..
X5
7 > � _SYSDBG_PHYSICAL .?AU_SYSDBG_PHYSICAL@@ ��>
� Address ��
Buffer ���
" Request ��> �F _SYSDBG_PHYSICAL .?AU_SYSDBG_PHYSICAL@@ �� �F � � Z � _FILE_ZERO_DATA_INFORMATION_EX .?AU_FILE_ZERO_DATA_INFORMATION_EX@@ ��F
� FileOffset ���
� BeyondFinalZero ��
" Flags Z �F _FILE_ZERO_DATA_INFORMATION_EX .?AU_FILE_ZERO_DATA_INFORMATION_EX@@ �� �F � �
�8 N � _CI_LOG_SCHEDULER_WAKEUP .?AU_CI_LOG_SCHEDULER_WAKEUP@@ ��*
Header ���
" 0 Reason ���N �F 8 _CI_LOG_SCHEDULER_WAKEUP .?AU_CI_LOG_SCHEDULER_WAKEUP@@ �� �F c M N � _ETW_HEAP_EVENT_SNAPSHOT .?AU_ETW_HEAP_EVENT_SNAPSHOT@@ ��
j Header ���
HeapHandle ���
# ( FreeSpace
# 0 CommittedSpace ���
# 8 ReservedSpace
" @ Flags
" D ProcessId
# H LargeUCRSpace
" P FreeListLength ���
" T UCRLength
# X AllocatedSpace ���N �F ` _ETW_HEAP_EVENT_SNAPSHOT .?AU_ETW_HEAP_EVENT_SNAPSHOT@@ �� �F c � V � _WOW64_DESCRIPTOR_TABLE_ENTRY .?AU_WOW64_DESCRIPTOR_TABLE_ENTRY@@
�F .
" Selector �
P( Descriptor ���V �F _WOW64_DESCRIPTOR_TABLE_ENTRY .?AU_WOW64_DESCRIPTOR_TABLE_ENTRY@@ �F � �
�? N � _SYSTEM_ALARM_OBJECT_ACE .?AU_SYSTEM_ALARM_OBJECT_ACE@@ ��
� Header ���
" Mask �
" Flags
ObjectType ���
InheritedObjectType ��
" , SidStart �N �F 0 _SYSTEM_ALARM_OBJECT_ACE .?AU_SYSTEM_ALARM_OBJECT_ACE@@ �� �F x �
:
C=
�1 J � _PERFINFO_FLT_OPERATION .?AU_PERFINFO_FLT_OPERATION@@ �
RoutineAddr ��
FileObject ���
FsContext
IrpPtr ���
CbdPtr ���
( MajorFunction J �F , _PERFINFO_FLT_OPERATION .?AU_PERFINFO_FLT_OPERATION@@ �F c � Z � _FILE_MOVE_CLUSTER_INFORMATION .?AU_FILE_MOVE_CLUSTER_INFORMATION@@ ��b
" ClusterCount �
RootDirectory
" FileNameLength ���
| FileName �Z �F _FILE_MOVE_CLUSTER_INFORMATION .?AU_FILE_MOVE_CLUSTER_INFORMATION@@ �� �F � �
T$
�' b � _WIM_PROVIDER_REMOVE_OVERLAY_INPUT .?AU_WIM_PROVIDER_REMOVE_OVERLAY_INPUT@@ ��
�F
� DataSourceId �b �F _WIM_PROVIDER_REMOVE_OVERLAY_INPUT .?AU_WIM_PROVIDER_REMOVE_OVERLAY_INPUT@@ �� �F � 3"
�$
�? r � _PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED .?AU_PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED@@ ��B
DeviceInterface ��
" Flags
Enabled ��r �F _PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED .?AU_PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED@@ �� �F %
$ � t t �F
�F
�# * � _FP_32 .?AU_FP_32@@ ��
I16Value �
! U16Value �
I32Value �
" U32Value �
StringValue ��
" CompareValue �
�F Fp32Value
� I64Value �
� U64Value �
( Fp64Value
T2 Fp80Value
B? Fp128Value ���2 �F <anonymous-tag> .?AT<anonymous-tag>@@ �F � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�F RoundingMode �
�F Inexact ��
�F Underflow
�F Overflow �
�F ZeroDivide ���
�F InvalidOperation �
�F OperandValid �
�F Format ���
�F Precision
�F Operation
�F Spare
�F HardwareException : �F <anonymous-tag> .?AU<anonymous-tag>@@ �F � � &
�F Value
�F Control ��: G _FP_IEEE_VALUE .?AU_FP_IEEE_VALUE@@ �� G � � �
" BufferSize ���
" ProviderId ���
# HistoricalContext
" Version ��
" Linkage ��
" CountLost
KernelHandle �
� TimeStamp
Guid �
" ( ClientContext
" , Flags 6 G 0 _WNODE_HEADER .?AU_WNODE_HEADER@@ G � N � _RTL_FEATURE_USAGE_REPORT .?AU_RTL_FEATURE_USAGE_REPORT@@
G J
u FeatureId
! ReportingKind
! ReportingOptions �N G _RTL_FEATURE_USAGE_REPORT .?AU_RTL_FEATURE_USAGE_REPORT@@ G �
.
�)
� & IoCompletionBasicInformation �Z t G _IO_COMPLETION_INFORMATION_CLASS .?AW4_IO_COMPLETION_INFORMATION_CLASS@@ ��� G @! ;
0< G
G
�5 F � _SL_HWID_DEVICE_INFO .?AU_SL_HWID_DEVICE_INFO@@ ��
" SizeBytes
Type �
DeviceRemovalPolicy ��
AuthenticationStatus �
Disposition ��
" DeviceNodeLevel ��
Guid �
� Data �F G _SL_HWID_DEVICE_INFO .?AU_SL_HWID_DEVICE_INFO@@ �� G � �
q6 R � _SE_PACKAGE_CAPABILITY_INFO .?AU_SE_PACKAGE_CAPABILITY_INFO@@ 2
" Remaining
" PackageGrantedAccess �
" CapabilityGrantedAccess ��
" UserGroupsRemaining ��
" AllAppPackagesSkippedAccess ��
PackagesPresent ��
PackageMatch �
CapabilityMatch ��
LogPermissiveFailure �
AllAppPackagesSkipped R
G _SE_PACKAGE_CAPABILITY_INFO .?AU_SE_PACKAGE_CAPABILITY_INFO@@ G �
�=
G' J � _FILE_SET_SPARSE_BUFFER .?AU_FILE_SET_SPARSE_BUFFER@@
"G
SetSparse J $G _FILE_SET_SPARSE_BUFFER .?AU_FILE_SET_SPARSE_BUFFER@@ %G � � J � PPM_IDLE_ACCOUNTING_EX .?AUPPM_IDLE_ACCOUNTING_EX@@ ��
'G V � PPM_IDLE_STATE_ACCOUNTING_EX .?AUPPM_IDLE_STATE_ACCOUNTING_EX@@ �� )G " � �
" StateCount ���
" TotalTransitions �
" ResetCount ���
" AbortCount ���
# StartTime
*G State J +G �PPM_IDLE_ACCOUNTING_EX .?AUPPM_IDLE_ACCOUNTING_EX@@ �� ,G x )
i
a<
�? > � _MUIREGISTRYINFO .?AU_MUIREGISTRYINFO@@ �� ! " �
�0
�
6 6 � _MUILANGLIST .?AU_MUILANGLIST@@ ��
6G
1G v
u Owned
2G InstallLanguageFallback ��
" Generation ���
" ProcessGeneration
3G Installed
4G Strings ��
5G ( MachineConfig
5G 0 UserConfig ���
7G 8 MachinePreferred �
7G @ UserPreferred
7G H ProcessPreferred �
7G P MergedUser ���
7G X MergedMachine
7G ` MergedFallback ���
8G h PrevRegInfo ��
" p MUI_Locked ���
" t MUI_SE ���
" x MUI_NumberAllowed
q � MUI_AllowedLanguage ��
q � MUI_InstalledSKU �
" � cbInstalledSKU ���
" � cbAllowedLanguage
q � MUI_DisallowedLanguage ���
" � cbDisallowedLanguage �> 9G � _MUIREGISTRYINFO .?AU_MUIREGISTRYINFO@@ �� :G ~
�@ �
lpInformation
lpSectionBase
" ulSectionLength ��
lpSectionGlobalDataBase ��
" ulSectionGlobalDataLength z =G ( tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AUtagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ �� >G o �
� J � tagEMRSETPALETTEENTRIES .?AUtagEMRSETPALETTEENTRIES@@ b
� emr ��
" ihPal
" iStart ���
" cEntries �
�; aPalEntries ��J BG tagEMRSETPALETTEENTRIES .?AUtagEMRSETPALETTEENTRIES@@ CG � �
�'
�.
�A J � _ETW_TP_EVENT_TIMER_SET .?AU_ETW_TP_EVENT_TIMER_SET@@ �
j Header ���
DueTime ��
( SubQueue �
0 Timer
" 8 Period ���
" < WindowLength �
" @ Absolute �J IG D _ETW_TP_EVENT_TIMER_SET .?AU_ETW_TP_EVENT_TIMER_SET@@ JG c
� Z 2 RtlDiskWriteConstraintPolicyLimited �� d RtlDiskWriteConstraintPolicyNormal ���Z t MG RTL_DISK_WRITE_CONSTRAINT_POLICY .?AW4RTL_DISK_WRITE_CONSTRAINT_POLICY@@ ��� NG 2 : � tagSTYLESTRUCT .?AUtagSTYLESTRUCT@@ ��*
" styleOld �
" styleNew �: QG tagSTYLESTRUCT .?AUtagSTYLESTRUCT@@ �� RG �
�
�?
�
�
�@ ��
YG � p � [G " " ]G
^G
� 2 HAL_MCE_RECORD ��� HAL_MCA_RECORD ���> t aG MCA_EXCEPTION_TYPE .?AW4MCA_EXCEPTION_TYPE@@ ��� bG �C $
p
_% R � _PERFINFO_FILE_INFORMATION .?AU_PERFINFO_FILE_INFORMATION@@ ��
# Irp ��
# FileObject ���
# FileKey ��
# ExtraInformation �
" IssuingThreadId ��
" $ InfoClass R gG ( _PERFINFO_FILE_INFORMATION .?AU_PERFINFO_FILE_INFORMATION@@ �� hG c ` : � HENHMETAFILE__ .?AUHENHMETAFILE__@@ ��
jG
t unused ���: lG HENHMETAFILE__ .?AUHENHMETAFILE__@@ �� mG t T
oG n � _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT@@
qG >
Lock �
" ThreadId �
" BoostBitmap ��n sG _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT@@ tG c
R � tagEMRMODIFYWORLDTRANSFORM .?AUtagEMRMODIFYWORLDTRANSFORM@@ ��
vG 2
� emr ��
J xform
" iMode R xG $ tagEMRMODIFYWORLDTRANSFORM .?AUtagEMRMODIFYWORLDTRANSFORM@@ �� yG � 2 � _RC_CONFIG .?AU_RC_CONFIG@@ ��R
" dwSignature ��
" dwLength �
" dwRCConfigVersion
" dwFilePathType ���
" dwFileType ���
" dwSystemAttributes ���
" dwUltimateFallbackLocation ���
� dwServiceCheckSum
� , dwChecksum ���
" < dwReserved1 ��
" @ dwReserved2 ��
" D dwMUIFileNameOffset ��
" H dwMUIFileNameLength ��
" L dwMUIFilePathOffset ��
" P dwMUIFilePathLength ��
" T dwMainResNameTypesOffset �
" X dwMainResNameTypesLength �
" \ dwMainResIDTypesOffset ���
" ` dwMainResIDTypesLength ���
" d dwMUIResNameTypesOffset ��
" h dwMUIResNameTypesLength ��
" l dwMUIResIDTypesOffset
" p dwMUIResIDTypesLength
" t dwLanguageOffset �
" x dwLanguageLength �
" | dwUltimateFallbackLanguageOffset �
" � dwUltimateFallbackLanguageLength �2 |G � _RC_CONFIG .?AU_RC_CONFIG@@ �� }G � :
Uuid �
! VersMajor
! VersMinor 2 G _RPC_IF_ID .?AU_RPC_IF_ID@@ �� �G _ { N � _DECRYPTION_STATUS_BUFFER .?AU_DECRYPTION_STATUS_BUFFER@@ "
NoEncryptedStreams ���N �G _DECRYPTION_STATUS_BUFFER .?AU_DECRYPTION_STATUS_BUFFER@@ �G �
�B *
" dwError ��
" dwType ���. �G _RIP_INFO .?AU_RIP_INFO@@ �G � c 2 � _cpinfoexA .?AU_cpinfoexA@@ ��
u MaxCharSize ��
DefaultChar ��
LeadByte �
q UnicodeDefaultChar ���
u CodePage �
y CodePageName �2 �G _cpinfoexA .?AU_cpinfoexA@@ �� �G W c V � _ETW_PARTITION_INFO_EXTENSION .?AU_ETW_PARTITION_INFO_EXTENSION@@ �
! EventVersion �
! Reserved �
" PartitionType
� QpcOffsetFromRoot
PartitionId ��
ParentId �V �G 0 _ETW_PARTITION_INFO_EXTENSION .?AU_ETW_PARTITION_INFO_EXTENSION@@ �G A � ^ � _CREATEFILE2_EXTENDED_PARAMETERS .?AU_CREATEFILE2_EXTENDED_PARAMETERS@@ ��
�G
�
" dwSize ���
" dwFileAttributes �
" dwFileFlags ��
" dwSecurityQosFlags ���
�G lpSecurityAttributes �
hTemplateFile ^ �G _CREATEFILE2_EXTENDED_PARAMETERS .?AU_CREATEFILE2_EXTENDED_PARAMETERS@@ �� �G X f � _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA .?AU_PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA@@ >
" Flags
" BufferLength �
Buffer ���f �G _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA .?AU_PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA@@ �G %
�
�3 �G
�G �
" ModuleInfoSize ���
" IsBinaryLoaded ���
ModulePathName ���
" CoverageSectionSize ��
� CoverageSection ��F �G _COVERAGE_MODULE_INFO .?AU_COVERAGE_MODULE_INFO@@ �G � t B � _CPU_CONFIG_RECORD .?AU_CPU_CONFIG_RECORD@@ �� q " �
" ProcessorSpeed ���
" NumberOfProcessors ���
" MemorySize ���
" PageSize �
" AllocationGranularity
� ComputerName �
�G DomainName ���
# HyperThreadingFlag ���
# (HighestUserAddress ���
! 0ProcessorArchitecture
! 2ProcessorLevel ���
! 4ProcessorRevision
6NxEnabled
7PaeEnabled ���
" 8MemorySpeed ��B �G @_CPU_CONFIG_RECORD .?AU_CPU_CONFIG_RECORD@@ �� �G c �
"F : � _RTL_BITMAP_RUN .?AU_RTL_BITMAP_RUN@@
�G 2
" StartingIndex
" NumberOfBits �: �G _RTL_BITMAP_RUN .?AU_RTL_BITMAP_RUN@@ �G b )
H
t' �
# NumSDChangedSuccess ��
# NumSDChangedFail �
# NumSDUnused ��
# NumSDTotal ���
# NumMftSDChangedSuccess ���
# ( NumMftSDChangedFail ��
# 0 NumMftSDTotal V �G 8 _SD_CHANGE_MACHINE_SID_OUTPUT .?AU_SD_CHANGE_MACHINE_SID_OUTPUT@@ �G � �
� J ServiceDirectoryPersistentState �� ServiceDirectoryTypeMax ��F t �G SERVICE_DIRECTORY_TYPE .?AW4SERVICE_DIRECTORY_TYPE@@ ��� �G �
�F
! F � _RTL_HEAP_PARAMETERS .?AU_RTL_HEAP_PARAMETERS@@ ��
�G
�D >
" Length ���
# SegmentReserve ���
# SegmentCommit
# DeCommitFreeBlockThreshold ���
# DeCommitTotalFreeThreshold ���
# ( MaximumAllocationSize
# 0 VirtualMemoryThreshold ���
# 8 InitialCommit
# @ InitialReserve ���
�G H CommitRoutine
, P Reserved �F �G ` _RTL_HEAP_PARAMETERS .?AU_RTL_HEAP_PARAMETERS@@ �� �G b �
nC Z � tagI_RpcProxyCallbackInterface .?AUtagI_RpcProxyCallbackInterface@@ �� q q " �G
�G p " �G
�G
" �G
�G D � �G
�G
D t 21 t 21 �G
�G
41
�
< B
�G IsValidMachineFn �
�G GetClientAddressFn ���
�G GetConnectionTimeoutFn ���
�G PerformCalloutFn �
�G FreeCalloutStateFn ���
�G ( GetClientSessionAndResourceUUIDFn
�G 0 ProxyFilterIfFn ��
�G 8 RpcProxyUpdatePerfCounterFn ��
�G @ RpcProxyUpdatePerfCounterBackendServerFn �Z �G H tagI_RpcProxyCallbackInterface .?AUtagI_RpcProxyCallbackInterface@@ �� �G 7 �
�6 n � _MEMORY_PARTITION_INITIAL_ADD_INFORMATION .?AU_MEMORY_PARTITION_INITIAL_ADD_INFORMATION@@
�G �+ " �j
" Flags
" NumberOfRanges ���
# NumberOfPagesAdded ���
�G PartitionRanges ��n �G _MEMORY_PARTITION_INITIAL_ADD_INFORMATION .?AU_MEMORY_PARTITION_INITIAL_ADD_INFORMATION@@ �G t �
�# R � _EVENT_EXTENDED_ITEM_TS_ID .?AU_EVENT_EXTENDED_ITEM_TS_ID@@ ��
" SessionId R �G _EVENT_EXTENDED_ITEM_TS_ID .?AU_EVENT_EXTENDED_ITEM_TS_ID@@ �� �G V d
Z; "
�B Type �
" Delay 2 �G _SC_ACTION .?AU_SC_ACTION@@ �� �G �
�:
@ 6
! Version ��
! Size �
Event F �G _PLUGPLAY_NOTIFY_HDR .?AU_PLUGPLAY_NOTIFY_HDR@@ �� �G % � Z � _SYSTEM_PERFORMANCE_INFORMATION .?AU_SYSTEM_PERFORMANCE_INFORMATION@@
�G
� IdleProcessTime ��
� IoReadTransferCount ��
� IoWriteTransferCount �
� IoOtherTransferCount �
" IoReadOperationCount �
" $ IoWriteOperationCount
" ( IoOtherOperationCount
" , AvailablePages ���
" 0 CommittedPages ���
" 4 CommitLimit ��
" 8 PeakCommitment ���
" < PageFaultCount ���
" @ CopyOnWriteCount �
" D TransitionCount ��
" H CacheTransitionCount �
" L DemandZeroCount ��
" P PageReadCount
" T PageReadIoCount ��
" X CacheReadCount ���
" \ CacheIoCount �
" ` DirtyPagesWriteCount �
" d DirtyWriteIoCount
" h MappedPagesWriteCount
" l MappedWriteIoCount ���
" p PagedPoolPages ���
" t NonPagedPoolPages
" x PagedPoolAllocs ��
" | PagedPoolFrees ���
" � NonPagedPoolAllocs ���
" � NonPagedPoolFrees
" � FreeSystemPtes ���
" � ResidentSystemCodePage ���
" � TotalSystemDriverPages ���
" � TotalSystemCodePages �
" � NonPagedPoolLookasideHits
" � PagedPoolLookasideHits ���
" � AvailablePagedPoolPages ��
" � ResidentSystemCachePage ��
" � ResidentPagedPoolPage
" � ResidentSystemDriverPage �
" � CcFastReadNoWait �
" � CcFastReadWait ���
" � CcFastReadResourceMiss ���
" � CcFastReadNotPossible
" � CcFastMdlReadNoWait ��
" � CcFastMdlReadWait
" � CcFastMdlReadResourceMiss
" � CcFastMdlReadNotPossible �
" � CcMapDataNoWait ��
" � CcMapDataWait
" � CcMapDataNoWaitMiss ��
" � CcMapDataWaitMiss
" � CcPinMappedDataCount �
" � CcPinReadNoWait ��
" � CcPinReadWait
" � CcPinReadNoWaitMiss ��
" � CcPinReadWaitMiss
" � CcCopyReadNoWait �
" � CcCopyReadWait ���
" � CcCopyReadNoWaitMiss �
" CcCopyReadWaitMiss ���
" CcMdlReadNoWait ��
" CcMdlReadWait
" CcMdlReadNoWaitMiss ��
" CcMdlReadWaitMiss
" CcReadAheadIos ���
" CcLazyWriteIos ���
" CcLazyWritePages �
" CcDataFlushes
" $CcDataPages ��
" (ContextSwitches ��
" ,FirstLevelTbFills
" 0SecondLevelTbFills ���
" 4SystemCalls ��
# 8CcTotalDirtyPages
# @CcDirtyPageThreshold �
HResidentAvailablePages ���
# PSharedCommittedPages �Z N �G X_SYSTEM_PERFORMANCE_INFORMATION .?AU_SYSTEM_PERFORMANCE_INFORMATION@@ �G � � 2 � _RPC_POLICY .?AU_RPC_POLICY@@ B
u Length ���
" EndpointFlags
" NICFlags �2 �G _RPC_POLICY .?AU_RPC_POLICY@@ �G _ �
�
k, > � tagEMRNAMEDESCAPE .?AUtagEMRNAMEDESCAPE@@ b
� emr ��
t iEscape ��
t cbDriver �
t cbEscData
� EscData ��> �G tagEMRNAMEDESCAPE .?AUtagEMRNAMEDESCAPE@@ �G � �
9 j � _DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE .?AU_DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE@@
u ��
u ��Z
header ���
�G enableAdvancedColor ��
�G reserved �
u value j H _DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE .?AU_DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE@@ H � i
� � " �
H
p.
@
�* ��
H Z � _SL_KMEM_CACHE_VALUE_DESCRIPTOR .?AU_SL_KMEM_CACHE_VALUE_DESCRIPTOR@@ �
! Size �
! NameLength ���
! Type �
! DataLength ���
" Attributes ���
" Reserved �
| Name �Z H _SL_KMEM_CACHE_VALUE_DESCRIPTOR .?AU_SL_KMEM_CACHE_VALUE_DESCRIPTOR@@ H � i
S b � _EVENT_EXTENDED_ITEM_STACK_TRACE64 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE64@@ ��*
# MatchId ��
M= Address ��b H _EVENT_EXTENDED_ITEM_STACK_TRACE64 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE64@@ �� H V m R � _WMI_PROCESS_INFORMATION64 .?AU_WMI_PROCESS_INFORMATION64@@ ��
H �
# UniqueProcessKey64 ���
" ProcessId
" ParentId �
" SessionId
ExitStatus ���
# DirectoryTableBase ���
" Flags
" $ Sid ��R H ( _WMI_PROCESS_INFORMATION64 .?AU_WMI_PROCESS_INFORMATION64@@ �� H c R � _TP_POOL_STACK_INFORMATION .?AU_TP_POOL_STACK_INFORMATION@@ ��
H 2
# StackReserve �
# StackCommit ��R H _TP_POOL_STACK_INFORMATION .?AU_TP_POOL_STACK_INFORMATION@@ �� H � R
�) v � _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE@@ .
� FileOffset ���
� ByteCount v H _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE@@ H � �*
�#
V � _ETW_CLOCK_STATE_CHANGE_EVENT .?AU_ETW_CLOCK_STATE_CHANGE_EVENT@@
$H �
NewState �
PrevState
Reserved �
# DeliveredIncrement ���
# RequestedIncrement ���
# NextClockUpdateTime ��V &H _ETW_CLOCK_STATE_CHANGE_EVENT .?AU_ETW_CLOCK_STATE_CHANGE_EVENT@@ 'H c
@+ R � _FILE_FS_LABEL_INFORMATION .?AU_FILE_FS_LABEL_INFORMATION@@ ��
*H 6
" VolumeLabelLength
| VolumeLabel ��R ,H _FILE_FS_LABEL_INFORMATION .?AU_FILE_FS_LABEL_INFORMATION@@ �� -H � F � _TOKEN_PRIMARY_GROUP .?AU_TOKEN_PRIMARY_GROUP@@ ��
PrimaryGroup �F 0H _TOKEN_PRIMARY_GROUP .?AU_TOKEN_PRIMARY_GROUP@@ �� 1H x �
�D f � JOBOBJECT_IO_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION@@ �
MaxIops ��
MaxBandwidth �
ReservationIops ��
� VolumeName ���
" BaseIoSize ���
" $ ControlFlags �f 5H ( JOBOBJECT_IO_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION@@ 2 onecore\external\sdk\inc\mincore\jobapi2.h � 6H 7H N � PPM_WMI_LEGACY_PERFSTATE .?AUPPM_WMI_LEGACY_PERFSTATE@@ ��
9H B
" Frequency
" Flags
" PercentFrequency �N ;H PPM_WMI_LEGACY_PERFSTATE .?AUPPM_WMI_LEGACY_PERFSTATE@@ �� <H x � B � FIND_BY_SID_OUTPUT .?AUFIND_BY_SID_OUTPUT@@ ��b
" NextEntryOffset ��
" FileIndex
" FileNameLength ���
| FileName �B ?H FIND_BY_SID_OUTPUT .?AUFIND_BY_SID_OUTPUT@@ �� @H � �
Z � _OBJECT_HANDLE_FLAG_INFORMATION .?AU_OBJECT_HANDLE_FLAG_INFORMATION@@
BH 2
Inherit ��
ProtectFromClose �Z DH _OBJECT_HANDLE_FLAG_INFORMATION .?AU_OBJECT_HANDLE_FLAG_INFORMATION@@ EH 2 W N � _ALPC_SERVER_INFORMATION .?AU_ALPC_SERVER_INFORMATION@@ ��
ThreadHandle �: HH <anonymous-tag> .?AU<anonymous-tag>@@ IH � � Z
ThreadBlocked
ConnectedProcessId ���
ConnectionPortName ���: KH <anonymous-tag> .?AU<anonymous-tag>@@ LH � � "
IH In ���
LH Out ��N NH _ALPC_SERVER_INFORMATION .?AU_ALPC_SERVER_INFORMATION@@ �� OH � � J � USN_RANGE_TRACK_OUTPUT .?AUUSN_RANGE_TRACK_OUTPUT@@ ��
QH
Usn ��J SH USN_RANGE_TRACK_OUTPUT .?AUUSN_RANGE_TRACK_OUTPUT@@ �� TH � Y
G7 V � _TRACE_PROVIDER_INSTANCE_INFO .?AU_TRACE_PROVIDER_INSTANCE_INFO@@ R
" NextOffset ���
" EnableCount ��
" Pid ��
" Flags V XH _TRACE_PROVIDER_INSTANCE_INFO .?AU_TRACE_PROVIDER_INSTANCE_INFO@@ YH � � J � _RTL_CRITICAL_SECTION64 .?AU_RTL_CRITICAL_SECTION64@@
[H �
# DebugInfo
LockCount
RecursionCount ���
# OwningThread �
# LockSemaphore
# SpinCount J ]H ( _RTL_CRITICAL_SECTION64 .?AU_RTL_CRITICAL_SECTION64@@ ^H � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��Z
`H RequireProfileTotalIssuesSource ��
aH ForceProfileTimeSource ���
bH NoProfileSampling
cH NoCSwitchSampling
dH NoReadyThreadSampling
eH NoFaultSampling ��
fH NoStackCache �
gH NoSampleBuffers ��
hH NoPauseWhenFull ��
iH NoLowPriority
jH WithAppId
kH FilterKernel �: lH <anonymous-tag> .?AU<anonymous-tag>@@ mH A �
�& V2 ���2 oH <anonymous-tag> .?AT<anonymous-tag>@@ pH A � 2
�& Intel
�& Amd ��
�& Arm ��2 rH <anonymous-tag> .?AT<anonymous-tag>@@ sH A { 2
" ReplyCount ���
" NotifyeeCount 2 uH <anonymous-tag> .?AT<anonymous-tag>@@ vH A R :
LoggerExtension ��
# LoggerExtension64 2 xH <anonymous-tag> .?AT<anonymous-tag>@@ yH c � 2
LoggerName ���
� LoggerName64 �2 {H <anonymous-tag> .?AT<anonymous-tag>@@ |H c { 2
LogFileName ��
� LogFileName64 2 ~H <anonymous-tag> .?AT<anonymous-tag>@@ H c u :
LoggerThreadId ���
# LoggerThreadId64 �2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c q .
" LogBuffersLost ���
" Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c k :
" EventsLost ���
" NumberOfProcessors ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c f 2
" FreeBuffers ��
" InstanceId ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c b 6
" NumberOfBuffers ��
" InstanceCount 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c ^ 6
LogFileHandle
# LogFileHandle64 ��2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c Z
# ��
# ��
# ��
# ��f
�H Wow ��
�H QpcDeltaTracking �
�H LargeMdlPages
�H ExcludeKernelStack ���: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c N
# ��
# ��
# ��
# ��z
�H Wow ��
�H QpcDeltaTracking �
�H LargeMdlPages
�H ExcludeKernelStack ���
# V2Options 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c M 2
AgeLimit �
FlushThreshold ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c I B
# PagedPoolPageCount ���
# VirtualSizeInPages ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c � 2
" UniqueProcessId ��
" SessionId 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c �
! ��
! ��
! ��Z
�H ActiveDataReference ��
�H DeviceEjectable ��
�H WritableHandles ��: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c
" ��
" ��&
�H TypeInfo �
�H Spare : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c |
" ��
" ��6
�H TypeInfo �
�H Spare
" Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c {
" ��
" ��&
�H Direction
�H Spare : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c i
" ��
" ��6
�H Direction
�H Spare
" Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c h V
ProtoPteAddress ��
# PageFrameIndex ���
VirtualAddress ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c �
# ��
# 0��
# 4��F
�H UseDescription ���
�H UniqueKey
�H Reserved �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c �
��
��
��
��Z
�H ExecutingDpc �
�H ExecutingIsr �
�H Reserved �
�H Priority �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c �
��
��
��
��j
�H ExecutingDpc �
�H ExecutingIsr �
�H Reserved �
�H Priority �
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c N
! Properties ���
ExpectedWakeReason ���
Reserved �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c ^
! Properties ���
ExpectedWakeReason ���
Reserved �
" Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c B
# DeliveredIncrement ���
# RequestedIncrement ���: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c
b
# DeliveredIncrement ���
# RequestedIncrement ���
# NextClockUpdateTime ��2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c
��
��
��
��j
�H ExecutingDpc �
�H WakeupBoost ��
�H BoostedOutstandingIrps ���
�H Reserved �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c �
��
��
��
��z
�H ExecutingDpc �
�H WakeupBoost ��
�H BoostedOutstandingIrps ���
�H Reserved �
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H c �
p ��
p ��
p ��
p ��v
�H NewIoPriorityFloor ���
�H OldIoPriority
�H NewIoQoSPriorityFloor
�H OldIoQoSPriority �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H c �
p ��
p ��
p ��
p ��
�H NewIoPriorityFloor ���
�H OldIoPriority
�H NewIoQoSPriorityFloor
�H OldIoQoSPriority �
p IoPriorities �2 I <anonymous-tag> .?AT<anonymous-tag>@@ I c �
��
��
��
��
��
I ExecutingDpc �
I KernelStackNotResident ���
I ProcessOutOfMemory ���
I DirectSwitchAttempt ��
I Reserved �: I <anonymous-tag> .?AU<anonymous-tag>@@ I c �
��
��
��
��
��
I ExecutingDpc �
I KernelStackNotResident ���
I ProcessOutOfMemory ���
I DirectSwitchAttempt ��
I Reserved �
Flags 2 I <anonymous-tag> .?AT<anonymous-tag>@@ I c �
��
��
��J
I AcquireMode ��
I ExecuteDpc ���
I ExecuteIsr ���: I <anonymous-tag> .?AU<anonymous-tag>@@ I c Q
��
��
��Z
I AcquireMode ��
I ExecuteDpc ���
I ExecuteIsr ���
Flags 2 I <anonymous-tag> .?AT<anonymous-tag>@@ I c P
��
��
��
��r
I OldThreadWaitMode
I OldThreadBamQosLevel �
!I NewThreadBamQosLevel �
"I Reserved �: #I <anonymous-tag> .?AU<anonymous-tag>@@ $I c /
��
��
��
��
&I OldThreadWaitMode
'I OldThreadBamQosLevel �
(I NewThreadBamQosLevel �
)I Reserved �
Flags 2 *I <anonymous-tag> .?AT<anonymous-tag>@@ +I c . >
p NewThreadPriorityDecrement ���
p SpareByte 2 -I <anonymous-tag> .?AT<anonymous-tag>@@ .I c ) 6
PreviousCState ���
OldThreadRank 2 0I <anonymous-tag> .?AT<anonymous-tag>@@ 1I c % &
" Index
" InfoClass 2 3I <anonymous-tag> .?AT<anonymous-tag>@@ 4I c � .
# StartAddr64 ��
# Affinity �2 6I <anonymous-tag> .?AT<anonymous-tag>@@ 7I c / *
StartAddr
# Affinity �2 9I <anonymous-tag> .?AT<anonymous-tag>@@ :I c *
Pointer0 �
Pointer1 �: <I <anonymous-tag> .?AU<anonymous-tag>@@ =I c n
� Padding1 �
e# ReferenceTime
GlobalEntry ��
Pointer0 �
Pointer1 �2 ?I <anonymous-tag> .?AT<anonymous-tag>@@ @I c
# ��
# =��*
BI ClockType
CI Frequency : DI <anonymous-tag> .?AU<anonymous-tag>@@ EI c �
# ��
# =��Z
GI ClockType
HI Frequency
V SlistEntry ���
d# NextBuffer ���2 II <anonymous-tag> .?AT<anonymous-tag>@@ JI c � *
" Header ���
F Packet ���2 LI <anonymous-tag> .?AT<anonymous-tag>@@ MI c � :
! Size �
Reserved �
Version ��: OI <anonymous-tag> .?AU<anonymous-tag>@@ PI c � N
" Marker ���
! Size �
Reserved �
Version ��2 RI <anonymous-tag> .?AT<anonymous-tag>@@ SI c � *
" Header ���
u# Packet ���2 UI <anonymous-tag> .?AT<anonymous-tag>@@ VI c h >
! Version ��
HeaderType ���
Flags : XI <anonymous-tag> .?AU<anonymous-tag>@@ YI c b R
" Marker ���
! Version ��
HeaderType ���
Flags 2 [I <anonymous-tag> .?AT<anonymous-tag>@@ \I c ` *
# TS ���
� SystemTime ���2 ^I <anonymous-tag> .?AT<anonymous-tag>@@ _I c T *
" Header ���
u# Packet ���2 aI <anonymous-tag> .?AT<anonymous-tag>@@ bI c P >
! Version ��
HeaderType ���
Flags : dI <anonymous-tag> .?AU<anonymous-tag>@@ eI c J R
" Marker ���
! Version ��
HeaderType ���
Flags 2 gI <anonymous-tag> .?AT<anonymous-tag>@@ hI c H .
" KernelTime ���
" UserTime �: jI <anonymous-tag> .?AU<anonymous-tag>@@ kI c 0 *
" ClientContext
" Flags : mI <anonymous-tag> .?AU<anonymous-tag>@@ nI c , n
" ClientContext
" Flags
" KernelTime ���
" UserTime �
# ProcessorTime 2 pI <anonymous-tag> .?AT<anonymous-tag>@@ qI c + &
Guid �
# GuidPtr ��2 sI <anonymous-tag> .?AT<anonymous-tag>@@ tI c ' &
" Version ��
� Class 2 vI <anonymous-tag> .?AT<anonymous-tag>@@ wI c 2
HeaderType ���
MarkerFlags ��: yI <anonymous-tag> .?AU<anonymous-tag>@@ zI c N
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��2 |I <anonymous-tag> .?AT<anonymous-tag>@@ }I c "
Type �
Group : I <anonymous-tag> .?AU<anonymous-tag>@@ �I c 6
! HookId ���
Type �
Group 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I c .
" KernelTime ���
" UserTime �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I V � F
" KernelTime ���
" UserTime �
# ProcessorTime 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I V �
! ��
! ��*
�I Linkage ��
�I Reserved2 : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I V K :
Type �
Reserved1
! Reserved2 : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I > � N
" Reserved �
Type �
Reserved1
! Reserved2 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I > �
�9 Level1 ���2 �I P <anonymous-tag> .?AT<anonymous-tag>@@ �I � 2 MidlWinrtTypeSerializationInfoVersionOne � t �I <unnamed-enum-MidlWinrtTypeSerializationInfoVersionOne> .?AW4<unnamed-enum-MidlWinrtTypeSerializationInfoVersionOne>@@ � �I � � * MidlInterceptionInfoVersionOne ���r t �I <unnamed-enum-MidlInterceptionInfoVersionOne> .?AW4<unnamed-enum-MidlInterceptionInfoVersionOne>@@ � �I � �
�G
�I N
u DispatchTableCount ���
�I DispatchTable
Reserved �B �I RPC_DISPATCH_TABLE .?AURPC_DISPATCH_TABLE@@ �� �I 7 � J � RPC_INTERFACE_TEMPLATEA .?AURPC_INTERFACE_TEMPLATEA@@ �
" Version ��
IfSpec ���
21 MgrTypeUuid ��
MgrEpv ���
u Flags
u $ MaxCalls �
u ( MaxRpcSize ���
H1 0 IfCallback ���
J1 8 UuidVector ���
@ Annotation ���
H SecurityDescriptor ���J �I P RPC_INTERFACE_TEMPLATEA .?AURPC_INTERFACE_TEMPLATEA@@ �I _ p J � RPC_ENDPOINT_TEMPLATEA .?AURPC_ENDPOINT_TEMPLATEA@@ ��r
" Version ��
ProtSeq ��
Endpoint �
SecurityDescriptor ���
" Backlog ��J �I ( RPC_ENDPOINT_TEMPLATEA .?AURPC_ENDPOINT_TEMPLATEA@@ �� �I _ S J � RPC_ENDPOINT_TEMPLATEW .?AURPC_ENDPOINT_TEMPLATEW@@ ��r
" Version ��
q ProtSeq ��
q Endpoint �
SecurityDescriptor ���
" Backlog ��J �I ( RPC_ENDPOINT_TEMPLATEW .?AURPC_ENDPOINT_TEMPLATEW@@ �� �I _ J
r. HttpCredentials ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I _ > � MOFRESOURCEINFOW .?AUMOFRESOURCEINFOW@@ ��b
q ImagePath
q ResourceName �
" ResourceSize �
ResourceBuffer ���> �I MOFRESOURCEINFOW .?AUMOFRESOURCEINFOW@@ �� �I 3 4 :
= EventCallback
= EventRecordCallback ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � 6
" LogFileMode ��
" ProcessTraceMode �2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � :
= EventCallback
= EventRecordCallback ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � 6
" LogFileMode ��
" ProcessTraceMode �2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � p 2
" ClientContext
Q BufferContext 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � " 2
ProcessorNumber ��
Alignment : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � � N
ProcessorNumber ��
Alignment
! ProcessorIndex ���2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � �
" ��
" ��
" ��
" ��f
�I Wow ��
�I QpcDeltaTracking �
�I LargeMdlPages
�I ExcludeKernelStack ���: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � �
" ��
" ��
" ��
" ��z
�I Wow ��
�I QpcDeltaTracking �
�I LargeMdlPages
�I ExcludeKernelStack ���
# V2Options 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � �
" ��
�I VersionNumber : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � �
" ��.
�I VersionNumber
" V2Control 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � 2
AgeLimit �
FlushThreshold ���2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � 2
AgeLimit �
FlushThreshold ���2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � i b
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � # ~
LogInstanceGuid ��
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � ! .
" Version ��
� VersionDetail 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � b
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � � ~
LogInstanceGuid ��
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � .
" Version ��
' VersionDetail 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � b
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � � ~
LogInstanceGuid ��
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � .
" Version ��
: VersionDetail 2 J <anonymous-tag> .?AT<anonymous-tag>@@ J � � &
" EventId ��
" Flags : J <anonymous-tag> .?AU<anonymous-tag>@@ J � e .
" KernelTime ���
" UserTime �: J <anonymous-tag> .?AU<anonymous-tag>@@ J � ` j
" KernelTime ���
" UserTime �
# ProcessorTime
" EventId ��
" Flags 2 J <anonymous-tag> .?AT<anonymous-tag>@@
J � _ &
" Version ��
b; Class 2 J <anonymous-tag> .?AT<anonymous-tag>@@
J � Q 2
HeaderType ���
MarkerFlags ��: J <anonymous-tag> .?AU<anonymous-tag>@@ J � L N
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��2 J <anonymous-tag> .?AT<anonymous-tag>@@ J � J *
" ClientContext
" Flags : J <anonymous-tag> .?AU<anonymous-tag>@@ J � > .
" KernelTime ���
" UserTime �: J <anonymous-tag> .?AU<anonymous-tag>@@ J � 9 n
" KernelTime ���
" UserTime �
# ProcessorTime
" ClientContext
" Flags 2 J <anonymous-tag> .?AT<anonymous-tag>@@ J � 8 &
Guid �
# GuidPtr ��2 J <anonymous-tag> .?AT<anonymous-tag>@@ J � 4 &
" Version ��
Class 2 !J <anonymous-tag> .?AT<anonymous-tag>@@ "J � ) 2
HeaderType ���
MarkerFlags ��: $J <anonymous-tag> .?AU<anonymous-tag>@@ %J � $ N
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��2 'J <anonymous-tag> .?AT<anonymous-tag>@@ (J � " 2 � WMIREGINFOW .?AUWMIREGINFOW@@ '3 " �
" BufferSize ���
" NextWmiRegInfo ���
" RegistryPath �
" MofResourceName ��
" GuidCount
+J WmiRegGuid ���2 ,J WMIREGINFOW .?AUWMIREGINFOW@@ -J � y b
" InstanceNameList �
" BaseNameOffset ���
# Pdo ��
# InstanceInfo �2 /J <anonymous-tag> .?AT<anonymous-tag>@@ 0J � 1 q " �B
" TargetInstanceIndex ��
2J TargetInstanceName ���2 3J <anonymous-tag> .?AT<anonymous-tag>@@ 4J � F
" FixedInstanceSize
E OffsetInstanceDataAndLength ��2 6J <anonymous-tag> .?AT<anonymous-tag>@@ 7J � � B
" CountLost
KernelHandle �
� TimeStamp 2 9J <anonymous-tag> .?AT<anonymous-tag>@@ :J � - *
" Version ��
" Linkage ��: <J <anonymous-tag> .?AU<anonymous-tag>@@ =J � & F
# HistoricalContext
" Version ��
" Linkage ��2 ?J <anonymous-tag> .?AT<anonymous-tag>@@ @J � #
$$ Data �Z BJ SERVICE_TRIGGER_CUSTOM_STATE_ID .?AUSERVICE_TRIGGER_CUSTOM_STATE_ID@@ CJ � � 6
( mouse
�' keyboard �
� hid ��2 EJ <anonymous-tag> .?AT<anonymous-tag>@@ FJ 2; 2
! usButtonFlags
! usButtonData �: HJ <anonymous-tag> .?AU<anonymous-tag>@@ IJ D: F
" ulButtons
! usButtonFlags
! usButtonData �2 KJ <anonymous-tag> .?AT<anonymous-tag>@@ LJ B:
@ _11 ��
@ _12 ��
@ _13 ��
@ _14 ��
@ _21 ��
@ _22 ��
@ _23 ��
@ _24 ��
@ _31 ��
@ $ _32 ��
@ ( _33 ��
@ , _34 ��
@ 0 _41 ��
@ 4 _42 ��
@ 8 _43 ��
@ < _44 ��:
NJ @ <anonymous-tag> .?AU<anonymous-tag>@@ OJ �
@ _11 ��
@ _12 ��
@ _13 ��
@ _14 ��
@ _21 ��
@ _22 ��
@ _23 ��
@ _24 ��
@ _31 ��
@ $ _32 ��
@ ( _33 ��
@ , _34 ��
@ 0 _41 ��
@ 4 _42 ��
@ 8 _43 ��
@ < _44 ��
N< m 2 QJ @ <anonymous-tag> .?AT<anonymous-tag>@@ RJ � *
c touchInfo
d penInfo ��2 TJ � <anonymous-tag> .?AT<anonymous-tag>@@ UJ J 2
mi ���
ki ���
! hi ���2 WJ <anonymous-tag> .?AT<anonymous-tag>@@ XJ � J � POWERBROADCAST_SETTING .?AUPOWERBROADCAST_SETTING@@ ��B
PowerSetting �
" DataLength ���
� Data �J [J POWERBROADCAST_SETTING .?AUPOWERBROADCAST_SETTING@@ �� \J / 6 � SHELLHOOKINFO .?AUSHELLHOOKINFO@@ "
� hwnd �
! rc ���6 _J SHELLHOOKINFO .?AUSHELLHOOKINFO@@ `J
u ��
u ��6
bJ enableAdvancedColor ��
cJ reserved �: dJ <anonymous-tag> .?AU<anonymous-tag>@@ eJ � o
u ��
u ��F
gJ enableAdvancedColor ��
hJ reserved �
u value 2 iJ <anonymous-tag> .?AT<anonymous-tag>@@ jJ � m
u ��
u ��
u ��
u ��
u ��
lJ advancedColorSupported ���
mJ advancedColorEnabled �
nJ wideColorEnforced
oJ advancedColorForceDisabled ���
pJ reserved �: qJ <anonymous-tag> .?AU<anonymous-tag>@@ rJ � Z
u ��
u ��
u ��
u ��
u ��
tJ advancedColorSupported ���
uJ advancedColorEnabled �
vJ wideColorEnforced
wJ advancedColorForceDisabled ���
xJ reserved �
u value 2 yJ <anonymous-tag> .?AT<anonymous-tag>@@ zJ � X
u ��
u ��B
|J disableMonitorVirtualResolution ��
}J reserved �: ~J <anonymous-tag> .?AU<anonymous-tag>@@ J � B
u ��
u ��R
�J disableMonitorVirtualResolution ��
�J reserved �
u value 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � @
u ��
u ��2
�J bootPersistenceOn
�J reserved �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � 4
u ��
u ��B
�J bootPersistenceOn
�J reserved �
u value 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � 2
u ��
u ��
u ��
u ��n
�J friendlyNameFromEdid �
�J friendlyNameForced ���
�J edidIdsValid �
�J reserved �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J �
u ��
u ��
u ��
u ��~
�J friendlyNameFromEdid �
�J friendlyNameForced ���
�J edidIdsValid �
�J reserved �
u value 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J �
u ��
u ��>
�J desktopModeInfoIdx ���
�J targetModeInfoIdx : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
u ��
u ��V
u modeInfoIdx ��
�J desktopModeInfoIdx ���
�J targetModeInfoIdx 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � �
u ��
u ��6
�J cloneGroupId �
�J sourceModeInfoIdx : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
u ��
u ��N
u modeInfoIdx ��
�J cloneGroupId �
�J sourceModeInfoIdx 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � N
�/ targetMode ���
A sourceMode ���
A desktopImageInfo �2 �J 0 <anonymous-tag> .?AT<anonymous-tag>@@ �J � u :
;F AdditionalSignalInfo �
u videoStandard 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � # .
" dmDisplayFlags ���
" dmNup 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � Z
� dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���
� dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � .
" dmDisplayFlags ���
" dmNup 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � Z
� dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���
� dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � F
� FileId ���
ObjectId �
n ExtendedFileId ���2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J o �# .
ReplaceIfExists ��
" Flags 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J o �"
" ��
" ��>
�J IsUmsSchedulerThread �
�J IsUmsWorkerThread : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J o N
" ��
" ��Z
�J IsUmsSchedulerThread �
�J IsUmsWorkerThread
" ThreadUmsFlags ���2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J o M
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�J Private ��
�J MappedDataFile ���
�J MappedImage ��
�J MappedPageFile ���
�J MappedPhysical ���
�J DirectMapped �
�J Reserved �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
�J Private ��
�J MappedDataFile ���
�J MappedImage ��
�J MappedPageFile ���
�J MappedPhysical ���
�J DirectMapped �
�J Reserved �2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � :
! wProcessorArchitecture ���
! wReserved : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � 2 N
" dwOemId ��
! wProcessorArchitecture ���
! wReserved 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � 0 &
�0 Block
�0 Region ���2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � .
" Offset ���
" OffsetHigh ���: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � 8 B
" Offset ���
" OffsetHigh ���
Pointer ��2 K <anonymous-tag> .?AT<anonymous-tag>@@ K � 7 �
�8 MemoryAllocData ��
�8 MemoryFreeData ���
�8 MemoryProtectData
�8 InstructionCacheFlushData
�8 MemoryDirtyData ��2 K <anonymous-tag> .?AT<anonymous-tag>@@ K � �
" ��
" ��>
K First
K HeavyFlush ���
" Sequence �: K <anonymous-tag> .?AU<anonymous-tag>@@ K � �
" ��
" ��N
K First
K HeavyFlush ���
" Sequence �
\ Value 2
K <anonymous-tag> .?AT<anonymous-tag>@@ K � � Z � RTLWOW64_CROSSPROCESS_WORK_HEAD .?AURTLWOW64_CROSSPROCESS_WORK_HEAD@@
" ��
" ��N
K First
K HeavyFlush ���
" Sequence �
\ Value Z K RTLWOW64_CROSSPROCESS_WORK_HEAD .?AURTLWOW64_CROSSPROCESS_WORK_HEAD@@ K � � &
" Flags
" dwFlags ��2 K <anonymous-tag> .?AT<anonymous-tag>@@ K � � 2
� ActivationContext
hActCtx ��2 K <anonymous-tag> .?AT<anonymous-tag>@@ K � � &
" Flags
�& NextFree �2 K <anonymous-tag> .?AT<anonymous-tag>@@ K � � *
" Modules ��
" ModulesEx 2 K <anonymous-tag> .?AT<anonymous-tag>@@ K � *
�9 Modules ��
�9 ModulesEx 2 "K <anonymous-tag> .?AT<anonymous-tag>@@ #K � � B
X# ProcessHeapInformation ���
�4 HeapInformation ��2 %K 0 <anonymous-tag> .?AT<anonymous-tag>@@ &K � ` �
X# ProcessHeapInformation ���
�4 HeapInformation ��
N HeapRegionInformation
% HeapRangeInformation �
Z; HeapBlockInformation �
�6 HeapPerfInformation ��
# DynamicStart �2 (K � <anonymous-tag> .?AT<anonymous-tag>@@ )K � B b
" CommittedSize
" UnCommittedSize ��
FirstEntry ���
LastEntry : +K <anonymous-tag> .?AU<anonymous-tag>@@ ,K � � b
# Settable �
! TagIndex �
!
AllocatorBackTraceIndex ��
8 Reserved �: .K <anonymous-tag> .?AU<anonymous-tag>@@ /K � � &
/K Block
,K Segment ��2 1K <anonymous-tag> .?AT<anonymous-tag>@@ 2K � �
# ��
# ��*
4K WakeCount
5K Waking ���: 6K <anonymous-tag> .?AU<anonymous-tag>@@ 7K � E
# ��
# ��J
9K WakeCount
:K Waking ���
# Value
Ptr ��2 ;K <anonymous-tag> .?AT<anonymous-tag>@@ <K � C
# ��
# ��
# ��
# ��
# <��n
>K Locked ���
?K Waiting ��
@K Waking ���
AK MultipleShared ���
BK Shared ���: CK <anonymous-tag> .?AU<anonymous-tag>@@ DK � �
# ��
# ��
# ��
# ��
# <��
FK Locked ���
GK Waiting ��
HK Waking ���
IK MultipleShared ���
JK Shared ���
# Value
Ptr ��2 KK <anonymous-tag> .?AT<anonymous-tag>@@ LK � � v
Context ��
M/ ContextX86 ���
O/ ContextAmd64 �
Q/ ContextArm ���
S/ ContextArm64 �2 NK <anonymous-tag> .?AT<anonymous-tag>@@ OK T
" ��
" ��.
QK CurrentThread
RK Reserved1 : SK <anonymous-tag> .?AU<anonymous-tag>@@ TK
" ��
" ��>
" Flags
VK CurrentThread
WK Reserved1 2 XK <anonymous-tag> .?AT<anonymous-tag>@@ YK
# ��
# ?��"
[K Busy �
\K Ticks : ]K <anonymous-tag> .?AU<anonymous-tag>@@ ^K �
��&
`K Encoded ��
� Min ��2 aK <anonymous-tag> .?AT<anonymous-tag>@@ bK � . *
# Lock �
@" RangeBitmap ��: dK <anonymous-tag> .?AU<anonymous-tag>@@ eK � :
# Lock �
@" RangeBitmap ��
V Next �2 gK <anonymous-tag> .?AT<anonymous-tag>@@ hK �
# ��
# ��
# ��
# <��r
jK PolicyState ��
kK AlwaysInherit
lK EnableAdditionalPolicyOption �
mK AuditReserved : nK <anonymous-tag> .?AU<anonymous-tag>@@ oK �
# ��
# ��
# ��
# <��n
qK AuditState ���
rK AuditFlag
sK EnableAdditionalAuditingOption ���
tK Reserved �: uK <anonymous-tag> .?AU<anonymous-tag>@@ vK � 6
� ControlData ��
� DatabaseCreate ���2 xK <anonymous-tag> .?AT<anonymous-tag>@@ yK � 2
FunctionTable
DynamicTable �2 {K <anonymous-tag> .?AT<anonymous-tag>@@ |K �
None �
BoolValue
p Int8Value
UInt8Value ���
Int16Value ���
! UInt16Value ��
t Int32Value ���
u UInt32Value ��
Int64Value ���
# UInt64Value ��
[ AnsiStringValue ��
� UnicodeStringValue ���2 ~K <anonymous-tag> .?AT<anonymous-tag>@@ K b p&
� ��
� >��:
�K KernelUpdateLock �
�K PrimaryClientID ��: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K b �!
� ��
� >��R
�K KernelUpdateLock �
�K PrimaryClientID ��
� ContextLock ��2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K b �!
� ��
� ��
� ��
� ��
� ��
� ��
� ���
�K ScheduledThread ��
�K Suspended
�K VolatileContext ��
�K Terminated ���
�K DebugActive ��
�K RunningOnSelfThread ��
�K DenyRunningOnSelfThread ��: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K b �!
� ��
� ��
� ��
� ��
� ��
� ��
� ���
�K ScheduledThread ��
�K Suspended
�K VolatileContext ��
�K Terminated ���
�K DebugActive ��
�K RunningOnSelfThread ��
�K DenyRunningOnSelfThread ��
T Flags 2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K b �! *
m HashEntry
C CurEntry �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K b 3
" ��
" ��
" ��
" ��z
�K ElevationEnabled �
�K VirtualizationEnabled
�K InstallerDetectEnabled ���
�K ReservedBits �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K b n
T Barrier ��
LeftBarrier ��
� WaitEvent
TotalProcessors ��
" Spins : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K b Y �
T Barrier ��
LeftBarrier ��
� WaitEvent
TotalProcessors ��
" Spins
� DUMMYRESERVEDSTRUCTNAME ��2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K b X
# ��
�K State : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K b
# ��
# 0��
# ��
# <��N
�K Depth
�K Sequence �
�K Reserved �
�K NextEntry : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K b w *
# Alignment
# Region ���: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K b s
�6 � �K �K
�K *
t Raw ��
w Translated ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K � v
# ULong64 ��
Pointer ��
# Size �
Handle ���
" ULong
" AccessMask ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K �
# ��
# 8��&
�K Type �
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K �
" ��
" ��*
�K CommitEvents �
�K Spare : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K t �
��
��
��N
�K ComPlus ��
�K ImageDynamicallyRelocated
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K t �
��
��
��f
ImageFlags ���
�K ComPlus ��
�K ImageDynamicallyRelocated
�K Reserved �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K t � R
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K t � v
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K t � B
! SubSystemMinorVersion
! SubSystemMajorVersion : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K t � ^
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K t �
��
��
��N
�K ComPlus ��
�K ImageDynamicallyRelocated
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K t �
��
��
��f
ImageFlags ���
�K ComPlus ��
�K ImageDynamicallyRelocated
�K Reserved �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K t � R
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K t � v
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K t � B
! SubSystemMinorVersion
! SubSystemMajorVersion : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K t � ^
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K t �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��Z
L ImageExportSuppressionEnabled
L ImageCetShadowStacksReady
L ImageXfgEnabled ��
L ImageCetShadowStacksStrictMode ���
L ImageCetSetContextIpValidationRelaxedMode
L ImageCetDynamicApisAllowInProc ���
L ImageCetDowngradeReserved1 ���
L ImageCetDowngradeReserved2 ���
L Reserved �:
L <anonymous-tag> .?AU<anonymous-tag>@@ L t �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��r
" ExtendedFlags
L ImageExportSuppressionEnabled
L ImageCetShadowStacksReady
L ImageXfgEnabled ��
L ImageCetShadowStacksStrictMode ���
L ImageCetSetContextIpValidationRelaxedMode
L ImageCetDynamicApisAllowInProc ���
L ImageCetDowngradeReserved1 ���
L ImageCetDowngradeReserved2 ���
L Reserved �2
L <anonymous-tag> .?AT<anonymous-tag>@@ L t �
��
��
��
��
��
��
���
L ComPlusNativeReady ���
L ComPlusILOnly
L ImageDynamicallyRelocated
L ImageMappedFlat ��
L BaseBelow4gb �
L ComPlusPrefer32bit ���
L Reserved �: L <anonymous-tag> .?AU<anonymous-tag>@@ !L t �
��
��
��
��
��
��
���
ImageFlags ���
#L ComPlusNativeReady ���
$L ComPlusILOnly
%L ImageDynamicallyRelocated
&L ImageMappedFlat ��
'L BaseBelow4gb �
(L ComPlusPrefer32bit ���
)L Reserved �2 *L <anonymous-tag> .?AT<anonymous-tag>@@ +L t � R
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��: -L <anonymous-tag> .?AU<anonymous-tag>@@ .L t � v
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���2 0L <anonymous-tag> .?AT<anonymous-tag>@@ 1L t � B
! SubSystemMinorVersion
! SubSystemMajorVersion : 3L <anonymous-tag> .?AU<anonymous-tag>@@ 4L t ~ ^
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �2 6L <anonymous-tag> .?AT<anonymous-tag>@@ 7L t }
" ��
" ��&
9L State
:L Reserved �: ;L <anonymous-tag> .?AU<anonymous-tag>@@ <L t �
" ��
" ��B
>L State
?L Reserved �
" AllInformation ���2 @L <anonymous-tag> .?AT<anonymous-tag>@@ AL t �
" ��
" ��
" ��
" ��n
CL ImagePartialMap ��
DL ImageNotExecutable ���
EL ImageSigningLevel
FL Reserved �: GL <anonymous-tag> .?AU<anonymous-tag>@@ HL t �
" ��
" ��
" ��
" ��
" ImageFlags ���
JL ImagePartialMap ��
KL ImageNotExecutable ���
LL ImageSigningLevel
ML Reserved �2 NL <anonymous-tag> .?AT<anonymous-tag>@@ OL t �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
QL Private ��
RL MappedDataFile ���
SL MappedImage ��
TL MappedPageFile ���
UL MappedPhysical ���
VL DirectMapped �
WL SoftwareEnclave ��
XL PageSize64K ��
YL PlaceholderReservation ���
ZL Reserved �:
[L <anonymous-tag> .?AU<anonymous-tag>@@ \L t �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" RegionType ���
^L Private ��
_L MappedDataFile ���
`L MappedImage ��
aL MappedPageFile ���
bL MappedPhysical ���
cL DirectMapped �
dL SoftwareEnclave ��
eL PageSize64K ��
fL PlaceholderReservation ���
gL Reserved �2 hL <anonymous-tag> .?AT<anonymous-tag>@@ iL t �
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# $��"
kL Valid
lL ShareCount ���
mL Win32Protection ��
nL Shared ���
oL Node �
pL Locked ���
qL LargePage
rL Priority �
sL Reserved �
tL SharedOriginal ���
uL Bad ��
vL Win32GraphicsProtection ��
wL ReservedUlong :
xL <anonymous-tag> .?AU<anonymous-tag>@@ yL t L
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# $��6
{L Valid
|L ShareCount ���
}L Win32Protection ��
~L Shared ���
L Node �
�L Locked ���
�L LargePage
�L Priority �
�L Reserved �
�L SharedOriginal ���
�L Bad ��
�L Win32GraphicsProtection ��
�L ReservedUlong
�) Invalid ��2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L t K .
ImageHandle ��
# Unused ���2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � � 6
SignatureInfoHandle ��
# Unused ���2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � � ^
# ULong64 ��
Pointer ��
# Size �
Handle ���
" ULong 2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � �
# ��
# 8��&
�L Type �
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � �
" ��
" ��2
�L HypervisorPages ��
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � f
" ��
" ��
" ��
" ��
" ��
�L UseDumpStorageStack ��
�L CompressMemoryPagesData ��
�L IncludeUserSpaceMemoryPages ��
�L AbortIfMemoryPressure
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � >
" ��
" ��*
�L Enabled ��
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L �
" ��
" ��>
�L Enabled ��
�L Reserved �
" AsULONG ��2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L �
C PebsDsSaveArea ���2 �L � <anonymous-tag> .?AT<anonymous-tag>@@ �L � � *
D As32Bit ��
! As64Bit ��2 �L � <anonymous-tag> .?AT<anonymous-tag>@@ �L � �
" ��
" ��2
�L KernelTransition �
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � �
" ��
" ��B
�L KernelTransition �
�L Reserved �
" ul ���2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � �
" ��
" ��
" ��F
�L SameRsdt �
�L SlicPresent ��
�L SlicDifferent : �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � �
" ��
" ��
" ��
" ��Z
�L Locked ���
�L UnlockApplied
�L UnlockIdValid
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � �
" ��
" ��
" ��
" ��j
" Flags
�L Locked ���
�L UnlockApplied
�L UnlockIdValid
�L Reserved �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � �
" ��
" ��
" ��
" ��
" ��
" ��
�L CetCapable ���
�L UserCetAllowed ���
�L ReservedForUserCet ���
�L KernelCetEnabled �
�L ReservedForKernelCet �
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � ,
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
�L CetCapable ���
�L UserCetAllowed ���
�L ReservedForUserCet ���
�L KernelCetEnabled �
�L ReservedForKernelCet �
�L Reserved �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � *
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
�L DbgMenuOsSelection ���
�L DbgHiberBoot �
�L DbgSoftBoot ��
�L DbgMeasuredLaunch
�L DbgMeasuredLaunchCapable �
�L DbgSystemHiveReplace �
�L DbgMeasuredLaunchSmmProtections ��
�L DbgMeasuredLaunchSmmLevel : �L <anonymous-tag> .?AU<anonymous-tag>@@ �L �
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# BootFlags
�L DbgMenuOsSelection ���
�L DbgHiberBoot �
�L DbgSoftBoot ��
�L DbgMeasuredLaunch
�L DbgMeasuredLaunchCapable �
�L DbgSystemHiveReplace �
�L DbgMeasuredLaunchSmmProtections ��
�L DbgMeasuredLaunchSmmLevel 2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L �
&
Tag ��
" TagUlong �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � �
# ��2
VirtualAddress ���
�L NonPaged �2 M <anonymous-tag> .?AT<anonymous-tag>@@ M � �
&
Tag ��
" TagUlong �2 M <anonymous-tag> .?AT<anonymous-tag>@@ M � v
F
Tag ��
" TagUlong �
ProcessChargedQuota ��2 M <anonymous-tag> .?AT<anonymous-tag>@@ M � d
B
# PagedPoolPageCount ���
# VirtualSizeInPages ���2 M <anonymous-tag> .?AT<anonymous-tag>@@
M � � 2
" UniqueProcessId ��
" SessionId 2 M <anonymous-tag> .?AT<anonymous-tag>@@
M � �
" ��
" ��
" ��
" ��n
M HasStrongId ��
M Classification ���
M BackgroundActivityModerated ��
M Spare : M <anonymous-tag> .?AU<anonymous-tag>@@ M � /
" ��
" ��
" ��
" ��~
" Flags
M HasStrongId ��
M Classification ���
M BackgroundActivityModerated ��
M Spare 2 M <anonymous-tag> .?AT<anonymous-tag>@@ M � - V
�5 ActiveProcessorsGroupAffinity
�5 AvailableMemory ��
�5 Pad ��2 M <anonymous-tag> .?AT<anonymous-tag>@@ M � =
" ��
" ��
" ��
" ��
" ��
" ��
M Set ��
!M Update ���
"M Clear
#M DscpTagEnabled ���
$M MaxBandwidthEnabled ��
%M Reserved �: &M <anonymous-tag> .?AU<anonymous-tag>@@ 'M � �
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
)M Set ��
*M Update ���
+M Clear
,M DscpTagEnabled ���
-M MaxBandwidthEnabled ��
.M Reserved �2 /M <anonymous-tag> .?AT<anonymous-tag>@@ 0M � � 2
j QpcBypassEnabled �
QpcShift �: 2M <anonymous-tag> .?AU<anonymous-tag>@@ 3M � � F
! QpcData ��
j QpcBypassEnabled �
QpcShift �2 5M <anonymous-tag> .?AT<anonymous-tag>@@ 6M � � >
� ReservedTickCountOverlay �
� TickCountPad �: 8M <anonymous-tag> .?AU<anonymous-tag>@@ 9M � ^ j
� TickCount
� TickCountQuad
� ReservedTickCountOverlay �
� TickCountPad �2 ;M <anonymous-tag> .?AT<anonymous-tag>@@ <M � [
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��~
>M DbgErrorPortPresent ��
?M DbgElevationEnabled ��
@M DbgVirtEnabled ���
AM DbgInstallerDetectEnabled
BM DbgLkgEnabled
CM DbgDynProcessorEnabled ���
DM DbgConsoleBrokerEnabled ��
EM DbgSecureBootEnabled �
FM DbgMultiSessionSku ���
GM DbgMultiUsersInSessionSku
HM DbgStateSeparationEnabled
IM SpareBits : JM <anonymous-tag> .?AU<anonymous-tag>@@ KM � "
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" SharedDataFlags ��
MM DbgErrorPortPresent ��
NM DbgElevationEnabled ��
OM DbgVirtEnabled ���
PM DbgInstallerDetectEnabled
QM DbgLkgEnabled
RM DbgDynProcessorEnabled ���
SM DbgConsoleBrokerEnabled ��
TM DbgSecureBootEnabled �
UM DbgMultiSessionSku ���
VM DbgMultiUsersInSessionSku
WM DbgStateSeparationEnabled
XM SpareBits 2
YM <anonymous-tag> .?AT<anonymous-tag>@@ ZM �
��
��
��
��z
\M NXSupportPolicy ��
]M SEHValidationPolicy ��
^M CurDirDevicesSkippedForDlls ��
_M Reserved �: `M <anonymous-tag> .?AU<anonymous-tag>@@ aM � �
��
��
��
��
MitigationPolicies ���
cM NXSupportPolicy ��
dM SEHValidationPolicy ��
eM CurDirDevicesSkippedForDlls ��
fM Reserved �2 gM <anonymous-tag> .?AT<anonymous-tag>@@ hM � �
" ��
" ��6
jM OptimizedSave
kM CompactionEnabled : lM <anonymous-tag> .?AU<anonymous-tag>@@ mM � r
" ��
" ��N
" ControlFlags �
oM OptimizedSave
pM CompactionEnabled 2 qM <anonymous-tag> .?AT<anonymous-tag>@@ rM � o 2
" Reserved �
SchedulingClass ��2 tM <anonymous-tag> .?AT<anonymous-tag>@@ uM � q
��
��
��
��
��z
wM Parked ���
xM Allocated
yM AllocatedToTargetProcess �
zM RealTime �
{M ReservedFlags : |M <anonymous-tag> .?AU<anonymous-tag>@@ }M � h
��
��
��
��
��
AllFlags �
M Parked ���
�M Allocated
�M AllocatedToTargetProcess �
�M RealTime �
�M ReservedFlags 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � `
�( CpuSet ���2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � W J
^ Processor
_ NumaNode �
� Cache
` Group 2 �M H <anonymous-tag> .?AT<anonymous-tag>@@ �M � F R
�A ProcessorCore
�A NumaNode �
k2 Cache
� Reserved �2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � B
# DeviceDescriptionOffset ��
# DevicePathOffset �: �M <anonymous-tag> .?AU<anonymous-tag>@@ �M x � R
# ProcessImageNameOffset ���
" ProcessId
" ServiceTag ���: �M <anonymous-tag> .?AU<anonymous-tag>@@ �M x � �
# ProcessImageNameOffset ���
" ProcessId
" ServiceTag ���
# DeviceDescriptionOffset ��
# DevicePathOffset �2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M x � ~
# ResourceFileNameOffset ���
! ResourceReasonId �
" StringCount ��
# SubstitutionStringsOffset : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M x � �
# ResourceFileNameOffset ���
! ResourceReasonId �
" StringCount ��
# SubstitutionStringsOffset
# SimpleStringOffset ���2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M x �
��
��
��
��n
�M NoDomainAccounting ���
�M IncreasePolicy ���
�M DecreasePolicy ���
�M Reserved �: �M <anonymous-tag> .?AU<anonymous-tag>@@ �M x � "
Spare
/ Flags 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M x �
! ��
! ��
! ��B
�M AllowScaling �
�M Disabled �
�M Reserved �: �M <anonymous-tag> .?AU<anonymous-tag>@@ �M x > N � PPM_THERMAL_POLICY_EVENT .?AUPPM_THERMAL_POLICY_EVENT@@ ��*
Mode �
# Processors ���N �M PPM_THERMAL_POLICY_EVENT .?AUPPM_THERMAL_POLICY_EVENT@@ �� �M x �
J � PPM_THERMALCHANGE_EVENT .?AUPPM_THERMALCHANGE_EVENT@@ 6
" ThermalConstraint
# Processors ���J �M PPM_THERMALCHANGE_EVENT .?AUPPM_THERMALCHANGE_EVENT@@ �M x �
R � PPM_PERFSTATE_DOMAIN_EVENT .?AUPPM_PERFSTATE_DOMAIN_EVENT@@ ��N
" State
" Latency ��
" Speed
# Processors ���R �M PPM_PERFSTATE_DOMAIN_EVENT .?AUPPM_PERFSTATE_DOMAIN_EVENT@@ �� �M x �
B � PPM_PERFSTATE_EVENT .?AUPPM_PERFSTATE_EVENT@@ ^
" State
" Status ���
" Latency ��
" Speed
" Processor B �M PPM_PERFSTATE_EVENT .?AUPPM_PERFSTATE_EVENT@@ �M x �
1, " � ��
# TotalTime
" IdleTransitions ��
" FailedTransitions
" InvalidBucketIndex ���
" MinTimeUs
" MaxTimeUs
" CancelledTransitions �
�M IdleTimeBuckets ��V �M �PPM_IDLE_STATE_ACCOUNTING_EX .?AUPPM_IDLE_STATE_ACCOUNTING_EX@@ �� �M x
" " �
" IdleTransitions ��
" FailedTransitions
" InvalidBucketIndex ���
# TotalTime
�M IdleTimeBuckets ��N �M 0 PPM_IDLE_STATE_ACCOUNTING .?AUPPM_IDLE_STATE_ACCOUNTING@@ �M x
J � PPM_WMI_IDLE_STATES_EX .?AUPPM_WMI_IDLE_STATES_EX@@ ��z
" Type �
" Count
" TargetState ��
" OldState �
TargetProcessors �
� State J �M 8 PPM_WMI_IDLE_STATES_EX .?AUPPM_WMI_IDLE_STATES_EX@@ �� �M x � R � POWER_STATE_NOTIFY_HANDLER .?AUPOWER_STATE_NOTIFY_HANDLER@@ �� �! �M
�M *
�M Handler ��
Context ��R �M POWER_STATE_NOTIFY_HANDLER .?AUPOWER_STATE_NOTIFY_HANDLER@@ �� �M x D .
" Granularity ��
" Capacity �J �M BATTERY_REPORTING_SCALE .?AUBATTERY_REPORTING_SCALE@@ �M x � j
ResourceFileName �
! ResourceReasonId �
" StringCount ��
v ReasonStrings : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M x �
ResourceFileName �
! ResourceReasonId �
" StringCount ��
v ReasonStrings
SimpleString �2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M x
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�M Reserved1
�M TargetSystemState
�M EffectiveSystemState �
�M CurrentSystemState ���
�M IgnoreHibernationPath
�M PseudoTransition �
�M KernelSoftReboot �
�M DirectedDripsTransition ��
�M Reserved2 : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M x �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�M Reserved1
�M TargetSystemState
�M EffectiveSystemState �
�M CurrentSystemState ���
�M IgnoreHibernationPath
�M PseudoTransition �
�M KernelSoftReboot �
�M DirectedDripsTransition ��
�M Reserved2
" ContextAsUlong ���2
�M <anonymous-tag> .?AT<anonymous-tag>@@ �M x � >
� ReparseDataBuffer
�# ReparseGuidDataBuffer 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � u& j
� SymbolicLinkReparseBuffer
� MountPointReparseBuffer ��
� GenericReparseBuffer �2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � )# 6
" FilterEntryCount �
" NumberOfPairs 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � B
t' SdChange �
u' SdQueryStats �
v' SdEnumSds 2 �M @ <anonymous-tag> .?AT<anonymous-tag>@@ �M � � B
� SdChange �
� SdQueryStats �
� SdEnumSds 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ N � | 2
G; Lev1Depends ��
I; Lev2Depends ��2 N D <anonymous-tag> .?AT<anonymous-tag>@@ N � e .
" BufferLength �
� Buffer ���2 N <anonymous-tag> .?AT<anonymous-tag>@@ N � a F
p BirthVolumeId
p BirthObjectId
p DomainId �: N 0 <anonymous-tag> .?AU<anonymous-tag>@@ N � � ^
p BirthVolumeId
p BirthObjectId
p DomainId �
6 ExtendedInfo �2 N 0 <anonymous-tag> .?AT<anonymous-tag>@@ N � � �
" Calls
" Clusters �
" Hints
" RunsReturned �
" HintsHonored �
" HintsClusters
" Cache
" CacheClusters
" CacheMiss
" $ CacheMissClusters :
N ( <anonymous-tag> .?AU<anonymous-tag>@@ N � � J
! Write
! Create ���
! SetInfo ��
! Flush : N <anonymous-tag> .?AU<anonymous-tag>@@ N � � :
! Write
! Create ���
! SetInfo ��: N <anonymous-tag> .?AU<anonymous-tag>@@ N � � J
! Write
! Create ���
! SetInfo ��
! Flush : N <anonymous-tag> .?AU<anonymous-tag>@@ N � v J
! Write
! Create ���
! SetInfo ��
! Flush : N <anonymous-tag> .?AU<anonymous-tag>@@ N � i 2
" UsnSourceInfo
" CopyNumber ���2 N <anonymous-tag> .?AT<anonymous-tag>@@ N � F B � MARK_HANDLE_INFO32 .?AUMARK_HANDLE_INFO32@@ ��b
" UsnSourceInfo
" CopyNumber ���
u VolumeHandle �
" HandleInfo ���B !N MARK_HANDLE_INFO32 .?AUMARK_HANDLE_INFO32@@ �� "N � C 2
" UsnSourceInfo
" CopyNumber ���2 $N <anonymous-tag> .?AT<anonymous-tag>@@ %N � 1 J � DELETE_USN_JOURNAL_DATA .?AUDELETE_USN_JOURNAL_DATA@@ 2
# UsnJournalID �
" DeleteFlags ��J (N DELETE_USN_JOURNAL_DATA .?AUDELETE_USN_JOURNAL_DATA@@ )N � ^
" RecordLength �
! MajorVersion �
! MinorVersion �
n FileReferenceNumber ��
n ParentFileReferenceNumber
( Usn ��
� 0 TimeStamp
" 8 Reason ���
" < SourceInfo ���
" @ SecurityId ���
" D FileAttributes ���
! H FileNameLength ���
! J FileNameOffset ���
| L FileName �6 +N P USN_RECORD_V3 .?AUUSN_RECORD_V3@@ ,N � � F � MOVE_FILE_RECORD_DATA .?AUMOVE_FILE_RECORD_DATA@@ R
FileHandle ���
� SourceFileRecord �
� TargetFileRecord �F /N MOVE_FILE_RECORD_DATA .?AUMOVE_FILE_RECORD_DATA@@ 0N � �
F � VOLUME_BITMAP_BUFFER .?AUVOLUME_BITMAP_BUFFER@@ ��F
� StartingLcn ��
� BitmapSize ���
� Buffer ���F 3N VOLUME_BITMAP_BUFFER .?AUVOLUME_BITMAP_BUFFER@@ �� 4N � D
J � NTFS_VOLUME_DATA_BUFFER .?AUNTFS_VOLUME_DATA_BUFFER@@ �
� VolumeSerialNumber ���
� NumberSectors
� TotalClusters
� FreeClusters �
� TotalReserved
" ( BytesPerSector ���
" , BytesPerCluster ��
" 0 BytesPerFileRecordSegment
" 4 ClustersPerFileRecordSegment �
� 8 MftValidDataLength ���
� @ MftStartLcn ��
� H Mft2StartLcn �
� P MftZoneStart �
� X MftZoneEnd ���J 7N ` NTFS_VOLUME_DATA_BUFFER .?AUNTFS_VOLUME_DATA_BUFFER@@ 8N � � 6
NoCrossPartitionAccess ���
- Spare : :N <anonymous-tag> .?AU<anonymous-tag>@@ ;N � � .
ReplaceIfExists ��
" Flags 2 =N <anonymous-tag> .?AT<anonymous-tag>@@ >N � .
ReplaceIfExists ��
" Flags 2 @N <anonymous-tag> .?AT<anonymous-tag>@@ AN � � F
p BirthVolumeId
p BirthObjectId
p DomainId �: CN 0 <anonymous-tag> .?AU<anonymous-tag>@@ DN � h ^
p BirthVolumeId
p BirthObjectId
p DomainId �
6 ExtendedInfo �2 FN 0 <anonymous-tag> .?AT<anonymous-tag>@@ GN � g *
Status ���
Pointer ��2 IN <anonymous-tag> .?AT<anonymous-tag>@@ JN � � "
IH In ���
LH Out ��2 LN <anonymous-tag> .?AT<anonymous-tag>@@ MN � � 2
" DesiredAccess
" GrantedAccess 2 ON <anonymous-tag> .?AT<anonymous-tag>@@ PN � V 2
" ObjectType ���
" HandleCount ��2 RN <anonymous-tag> .?AT<anonymous-tag>@@ SN � Q 2
Handle ���
�. HandleAttrArray ��2 UN <anonymous-tag> .?AT<anonymous-tag>@@ VN � L
" ��
" ��
" ��
" ��
" ��
" ��
XN Reserved0
YN SameAccess ���
ZN SameAttributes ���
[N Indirect �
\N Inherit ��
]N Reserved1 : ^N <anonymous-tag> .?AU<anonymous-tag>@@ _N � B
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
aN Reserved0
bN SameAccess ���
cN SameAttributes ���
dN Indirect �
eN Inherit ��
fN Reserved1 2 gN <anonymous-tag> .?AT<anonymous-tag>@@ hN � @ 2
" DesiredAccess
" GrantedAccess 2 jN <anonymous-tag> .?AT<anonymous-tag>@@ kN � 8
" ��
" ��
" ��
" ��
" ��
" ��
mN Reserved0
nN SameAccess ���
oN SameAttributes ���
pN Indirect �
qN Inherit ��
rN Reserved1 : sN <anonymous-tag> .?AU<anonymous-tag>@@ tN � ,
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
vN Reserved0
wN SameAccess ���
xN SameAttributes ���
yN Indirect �
zN Inherit ��
{N Reserved1 2 |N <anonymous-tag> .?AT<anonymous-tag>@@ }N � * 6
# ClientViewSize ���
" CallbackId ���2 N <anonymous-tag> .?AT<anonymous-tag>@@ �N � N 2
ClientId �
A DoNotUseThisField 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � I
" ��
" ��.
�N CfgOverride ��
�N Reserved �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � H
" ��
" ��>
" Flags
�N CfgOverride ��
�N Reserved �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � F
2
" UpdateMask ���
" DesiredState �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � I
" ��
" ��
" ��
" ��f
�N FreezeOperation ��
�N FilterOperation ��
�N SwapOperation
�N Reserved �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N �
" ��
" ��
" ��
" ��v
" Flags
�N FreezeOperation ��
�N FilterOperation ��
�N SwapOperation
�N Reserved �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � 6
# ManifestAddress ��
" ManifestSize �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � � 6
# ManifestAddress ��
" ManifestSize �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � �
��
��
��
��
��
��
��
! ���
�N ProtectedProcess �
�N AddressSpaceOverride �
�N DevOverrideEnabled ���
�N ManifestDetected �
�N ProtectedProcessLight
�N SpareBits1 ���
�N SpareBits2 ���
�N SpareBits3 ���: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � �
��
��
��
��
��
��
��
! ��
" OutputFlags ��
�N ProtectedProcess �
�N AddressSpaceOverride �
�N DevOverrideEnabled ���
�N ManifestDetected �
�N ProtectedProcessLight
�N SpareBits1 ���
�N SpareBits2 ���
�N SpareBits3 ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � �
��
��
��
��
��
��
! ���
�N WriteOutputOnExit
�N DetectManifest ���
�N IFEOSkipDebugger �
�N IFEODoNotPropagateKeyState ���
�N SpareBits1 ���
�N SpareBits2 ���
�N ProhibitedImageCharacteristics ���: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � �
��
��
��
��
��
��
! ���
" InitFlags
�N WriteOutputOnExit
�N DetectManifest ���
�N IFEOSkipDebugger �
�N IFEODoNotPropagateKeyState ���
�N SpareBits1 ���
�N SpareBits2 ���
�N ProhibitedImageCharacteristics ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � � n
� InitState
� FailSection ��
� ExeFormat
� ExeName ��
� SuccessState �2 �N H <anonymous-tag> .?AT<anonymous-tag>@@ �N � �
��
��
��6
�N Type �
�N Audit
�N Signer ���: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � ^
��
��
��F
Level
�N Type �
�N Audit
�N Signer ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � \ &
" StdHandleSubsystemType ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � U
" ��
" ��:
�N StdHandleState ���
�N PseudoHandleMask �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � P
" ��
" ��J
" Flags
�N StdHandleState ���
�N PseudoHandleMask �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � N &
# Value
ValuePtr �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � � �
ASLRPolicy ���
StrictHandleCheckPolicy ��
SystemCallDisablePolicy ��
ExtensionPointDisablePolicy ��
DynamicCodePolicy
ControlFlowGuardPolicy ���
SignaturePolicy ��
FontDisablePolicy
ImageLoadPolicy ��
SystemCallFilterPolicy ���
PayloadRestrictionPolicy �
ChildProcessPolicy ���
SideChannelIsolationPolicy ���
UserShadowStackPolicy 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � $
" ��
" ��*
�N TopDown ��
�N Reserved �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � �
" ��
" ��
" ��F
�N EnableAutoUpdate �
�N Permanent
�N Reserved �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � � �
� InputDuration
� AudioInDuration ��
� AudioOutDuration �
� DisplayRequiredDuration ��
� PSMBackgroundDuration : �N ( <anonymous-tag> .?AU<anonymous-tag>@@ �N � \ �
9C Durations
� InputDuration
� AudioInDuration ��
� AudioOutDuration �
� DisplayRequiredDuration ��
� PSMBackgroundDuration 2 O ( <anonymous-tag> .?AT<anonymous-tag>@@ O � Z �
& CpuTimeline ��
& DiskTimeline �
& NetworkTimeline ��
& MBBTimeline ��
& ForegroundTimeline ���
& ( DesktopVisibleTimeline ���
& 0 CompositionRenderedTimeline ��
& 8 CompositionDirtyGeneratedTimeline
& @ CompositionDirtyPropagatedTimeline ���
& H InputTimeline
& P AudioInTimeline ��
& X AudioOutTimeline �
& ` DisplayRequiredTimeline ��
& h KeyboardInputTimeline : O p <anonymous-tag> .?AU<anonymous-tag>@@ O � H �
8C Timelines
& CpuTimeline ��
& DiskTimeline �
& NetworkTimeline ��
& MBBTimeline ��
& ForegroundTimeline ���
& ( DesktopVisibleTimeline ���
& 0 CompositionRenderedTimeline ��
& 8 CompositionDirtyGeneratedTimeline
& @ CompositionDirtyPropagatedTimeline ���
& H InputTimeline
& P AudioInTimeline ��
& X AudioOutTimeline �
& ` DisplayRequiredTimeline ��
& h KeyboardInputTimeline 2 O p <anonymous-tag> .?AT<anonymous-tag>@@ O � F f
� ForegroundDuration ���
� DesktopVisibleDuration ���
� PSMForegroundDuration : O <anonymous-tag> .?AU<anonymous-tag>@@
O � / z
�/ Durations
� ForegroundDuration ���
� DesktopVisibleDuration ���
� PSMForegroundDuration 2 O <anonymous-tag> .?AT<anonymous-tag>@@
O � +
" ��
" ��F
" LastChangeTime ���
O Duration �
O IsInState : O <anonymous-tag> .?AU<anonymous-tag>@@ O � � *
" EndTime ��
" Bitmap ���: O <anonymous-tag> .?AU<anonymous-tag>@@ O � �
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
O IsProtectedProcess ���
O IsWow64Process ���
O IsProcessDeleting
O IsCrossSessionCreate �
O IsFrozen �
O IsBackground �
O IsStronglyNamed ��
O IsSecureProcess ��
O IsPicoProcess
O SpareBits :
!O <anonymous-tag> .?AU<anonymous-tag>@@ "O � �
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u Flags
$O IsProtectedProcess ���
%O IsWow64Process ���
&O IsProcessDeleting
'O IsCrossSessionCreate �
(O IsFrozen �
)O IsBackground �
*O IsStronglyNamed ��
+O IsSecureProcess ��
,O IsPicoProcess
-O SpareBits 2 .O <anonymous-tag> .?AT<anonymous-tag>@@ /O � � .
" TlsIndex �
" PreviousCount 2 1O <anonymous-tag> .?AT<anonymous-tag>@@ 2O � s
ThreadId �2 4O <anonymous-tag> .?AT<anonymous-tag>@@ 5O � h 2
NewTlsData ���
OldTlsData ���2 7O <anonymous-tag> .?AT<anonymous-tag>@@ 8O � d
" ��
" ��.
:O Foreground ���
;O Reserved �: <O <anonymous-tag> .?AU<anonymous-tag>@@ =O � D *
" ControlFlags �
Path �2 ?O <anonymous-tag> .?AT<anonymous-tag>@@ @O ? � *
! MinRate ��
! MaxRate ��: BO <anonymous-tag> .?AU<anonymous-tag>@@ CO ? R
" CpuRate ��
" Weight ���
! MinRate ��
! MaxRate ��2 EO <anonymous-tag> .?AT<anonymous-tag>@@ FO ? N
Q RateControlToleranceLimit
Q CpuRateControlToleranceLimit �2 HO <anonymous-tag> .?AT<anonymous-tag>@@ IO ? F
Q RateControlTolerance �
Q CpuRateControlTolerance ��2 KO <anonymous-tag> .?AT<anonymous-tag>@@ LO ? >
# JobHighMemoryLimit ���
# JobMemoryLimit ���2 NO <anonymous-tag> .?AT<anonymous-tag>@@ OO ? � V
� RateControlToleranceInterval �
� CpuRateControlToleranceInterval ��2 QO <anonymous-tag> .?AT<anonymous-tag>@@ RO ? � F
Q RateControlTolerance �
Q CpuRateControlTolerance ��2 TO <anonymous-tag> .?AT<anonymous-tag>@@ UO ? � >
# JobHighMemoryLimit ���
# JobMemoryLimit ���2 WO <anonymous-tag> .?AT<anonymous-tag>@@ XO ? �
" ��
" ��
" ��
" ��
" ��
ZO EnableReadVmLogging ��
[O EnableWriteVmLogging �
\O EnableProcessSuspendResumeLogging
]O EnableThreadSuspendResumeLogging �
^O Reserved �: _O <anonymous-tag> .?AU<anonymous-tag>@@ `O ? \
��
��
��V
bO EnableReadVmLogging ��
cO EnableWriteVmLogging �
dO Unused ���: eO <anonymous-tag> .?AU<anonymous-tag>@@ fO ? S
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
hO EnableUserShadowStack
iO AuditUserShadowStack �
jO SetContextIpValidation ���
kO AuditSetContextIpValidation ��
lO EnableUserShadowStackStrictMode ��
mO BlockNonCetBinaries ��
nO BlockNonCetBinariesNonEhcont �
oO AuditBlockNonCetBinaries �
pO CetDynamicApisOutOfProcOnly ��
qO SetContextIpValidationRelaxedMode
rO ReservedFlags : sO <anonymous-tag> .?AU<anonymous-tag>@@ tO ?
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" Flags
vO EnableUserShadowStack
wO AuditUserShadowStack �
xO SetContextIpValidation ���
yO AuditSetContextIpValidation ��
zO EnableUserShadowStackStrictMode ��
{O BlockNonCetBinaries ��
|O BlockNonCetBinariesNonEhcont �
}O AuditBlockNonCetBinaries �
~O CetDynamicApisOutOfProcOnly ��
O SetContextIpValidationRelaxedMode
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O ?
" ��
" ��
" ��
" ��
" ��
�O SmtBranchTargetIsolation �
�O IsolateSecurityDomain
�O DisablePageCombine ���
�O SpeculativeStoreBypassDisable
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��
" ��
" Flags
�O SmtBranchTargetIsolation �
�O IsolateSecurityDomain
�O DisablePageCombine ���
�O SpeculativeStoreBypassDisable
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��
�O NoChildProcessCreation ���
�O AuditNoChildProcessCreation ��
�O AllowSecureProcessCreation ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��
" Flags
�O NoChildProcessCreation ���
�O AuditNoChildProcessCreation ��
�O AllowSecureProcessCreation ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ��
�O EnableExportAddressFilter
�O AuditExportAddressFilter �
�O EnableExportAddressFilterPlus
�O AuditExportAddressFilterPlus �
�O EnableImportAddressFilter
�O AuditImportAddressFilter �
�O EnableRopStackPivot ��
�O AuditRopStackPivot ���
�O EnableRopCallerCheck �
�O AuditRopCallerCheck ��
�O EnableRopSimExec �
�O AuditRopSimExec ��
�O ReservedFlags :
�O <anonymous-tag> .?AU<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ���
" Flags
�O EnableExportAddressFilter
�O AuditExportAddressFilter �
�O EnableExportAddressFilterPlus
�O AuditExportAddressFilterPlus �
�O EnableImportAddressFilter
�O AuditImportAddressFilter �
�O EnableRopStackPivot ��
�O AuditRopStackPivot ���
�O EnableRopCallerCheck �
�O AuditRopCallerCheck ��
�O EnableRopSimExec �
�O AuditRopSimExec ��
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O ? �
" ��
" ��.
�O FilterId �
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O ? �
" ��
" ��>
" Flags
�O FilterId �
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��
" ��
" ���
�O NoRemoteImages ���
�O NoLowMandatoryLabelImages
�O PreferSystem32Images �
�O AuditNoRemoteImages ��
�O AuditNoLowMandatoryLabelImages ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
�O NoRemoteImages ���
�O NoLowMandatoryLabelImages
�O PreferSystem32Images �
�O AuditNoRemoteImages ��
�O AuditNoLowMandatoryLabelImages ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O ? �
" ��
" ��
" ��^
�O DisableNonSystemFonts
�O AuditNonSystemFontLoading
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O ? �
" ��
" ��
" ��n
" Flags
�O DisableNonSystemFonts
�O AuditNonSystemFontLoading
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��
" ��
" ��
�O MicrosoftSignedOnly ��
�O StoreSignedOnly ��
�O MitigationOptIn ��
�O AuditMicrosoftSignedOnly �
�O AuditStoreSignedOnly �
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
�O MicrosoftSignedOnly ��
�O StoreSignedOnly ��
�O MitigationOptIn ��
�O AuditMicrosoftSignedOnly �
�O AuditStoreSignedOnly �
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O ? �
" ��
" ��
" ��
" ��z
�O EnableControlFlowGuard ���
�O EnableExportSuppression ��
�O StrictMode ���
�O ReservedFlags : P <anonymous-tag> .?AU<anonymous-tag>@@ P ? �
" ��
" ��
" ��
" ��
" Flags
P EnableControlFlowGuard ���
P EnableExportSuppression ��
P StrictMode ���
P ReservedFlags 2 P <anonymous-tag> .?AT<anonymous-tag>@@ P ? �
" ��
" ��
" ��
" ��
" ��
P ProhibitDynamicCode ��
P AllowThreadOptOut
P AllowRemoteDowngrade �
P AuditProhibitDynamicCode �
P ReservedFlags : P <anonymous-tag> .?AU<anonymous-tag>@@ P ? {
" ��
" ��
" ��
" ��
" ��
" Flags
P ProhibitDynamicCode ��
P AllowThreadOptOut
P AllowRemoteDowngrade �
P AuditProhibitDynamicCode �
P ReservedFlags 2 P <anonymous-tag> .?AT<anonymous-tag>@@ P ? y
" ��
" ��>
P DisableExtensionPoints ���
P ReservedFlags : P <anonymous-tag> .?AU<anonymous-tag>@@ P ? q
" ��
" ��N
" Flags
P DisableExtensionPoints ���
P ReservedFlags 2 !P <anonymous-tag> .?AT<anonymous-tag>@@ "P ? o
" ��
" ��
" ��j
$P DisallowWin32kSystemCalls
%P AuditDisallowWin32kSystemCalls ���
&P ReservedFlags : 'P <anonymous-tag> .?AU<anonymous-tag>@@ (P ? f
" ��
" ��
" ��z
" Flags
*P DisallowWin32kSystemCalls
+P AuditDisallowWin32kSystemCalls ���
,P ReservedFlags 2 -P <anonymous-tag> .?AT<anonymous-tag>@@ .P ? d
" ��
" ��
" ��~
0P RaiseExceptionOnInvalidHandleReference ���
1P HandleExceptionsPermanentlyEnabled ���
2P ReservedFlags : 3P <anonymous-tag> .?AU<anonymous-tag>@@ 4P ? [
" ��
" ��
" ��
" Flags
6P RaiseExceptionOnInvalidHandleReference ���
7P HandleExceptionsPermanentlyEnabled ���
8P ReservedFlags 2 9P <anonymous-tag> .?AT<anonymous-tag>@@ :P ? Y
" ��
" ��
" ��R
<P Enable ���
=P DisableAtlThunkEmulation �
>P ReservedFlags : ?P <anonymous-tag> .?AU<anonymous-tag>@@ @P ? O
" ��
" ��
" ��b
" Flags
BP Enable ���
CP DisableAtlThunkEmulation �
DP ReservedFlags 2 EP <anonymous-tag> .?AT<anonymous-tag>@@ FP ? M
" ��
" ��
" ��
" ��
" ��
HP EnableBottomUpRandomization ��
IP EnableForceRelocateImages
JP EnableHighEntropy
KP DisallowStrippedImages ���
LP ReservedFlags : MP <anonymous-tag> .?AU<anonymous-tag>@@ NP ? B
" ��
" ��
" ��
" ��
" ��
" Flags
PP EnableBottomUpRandomization ��
QP EnableForceRelocateImages
RP EnableHighEntropy
SP DisallowStrippedImages ���
TP ReservedFlags 2 UP <anonymous-tag> .?AT<anonymous-tag>@@ VP ? @
" ��
" ��.
XP RatePercent ��
YP Reserved0 : ZP <anonymous-tag> .?AU<anonymous-tag>@@ [P ? � *
" DriveMap �
� DriveType : ]P $ <anonymous-tag> .?AU<anonymous-tag>@@ ^P ? (
DirectoryHandle ��: `P <anonymous-tag> .?AU<anonymous-tag>@@ aP ? % "
aP Set ��
^P Query 2 cP ( <anonymous-tag> .?AT<anonymous-tag>@@ dP ? $ "
� Set ��
� Query 2 fP ( <anonymous-tag> .?AT<anonymous-tag>@@ gP ?
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
iP IsProtectedProcess ���
jP IsWow64Process ���
kP IsProcessDeleting
lP IsCrossSessionCreate �
mP IsFrozen �
nP IsBackground �
oP IsStronglyNamed ��
pP IsSecureProcess ��
qP IsSubsystemProcess ���
rP SpareBits :
sP <anonymous-tag> .?AU<anonymous-tag>@@ tP ? �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��"
" Flags
vP IsProtectedProcess ���
wP IsWow64Process ���
xP IsProcessDeleting
yP IsCrossSessionCreate �
zP IsFrozen �
{P IsBackground �
|P IsStronglyNamed ��
}P IsSecureProcess ��
~P IsSubsystemProcess ���
P SpareBits 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P ? � >
� RtlUmsCompletionList �
UmsCompletionList 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P ? f 2
� RtlUmsContext
UmsContext ���2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P ? ]
" ��
" ��>
�P IsUmsSchedulerThread �
�P IsUmsWorkerThread : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P ? E
" ��
" ��N
" Flags
�P IsUmsSchedulerThread �
�P IsUmsWorkerThread 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P ? C 6
� CompletionList ���
� UmsContext ���: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P ? 0
" ��
" ��
� CompletionList ���
� UmsContext ���
" Flags
�P IsUmsSchedulerThread �
�P IsUmsWorkerThread 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P ? .
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��
! ��
�P SafeThunkCall
�P InDebugPrint �
�P HasFiberData �
�P SkipThreadAttach �
�P WerInShipAssertCode ��
�P RanProcessInit ���
�P ClonedThread �
�P SuppressDebugMsg �
�P DisableUserStackWalk �
�P RtlExceptionAttached �
�P InitialThread
�P SessionAware �
�P LoadOwner
�P LoaderWorker �
�P SkipLoaderInit ���
�P SpareSameTebBits �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P 7 �
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��
! ���
! SameTebFlags �
�P SafeThunkCall
�P InDebugPrint �
�P HasFiberData �
�P SkipThreadAttach �
�P WerInShipAssertCode ��
�P RanProcessInit ���
�P ClonedThread �
�P SuppressDebugMsg �
�P DisableUserStackWalk �
�P RtlExceptionAttached �
�P InitialThread
�P SessionAware �
�P LoadOwner
�P LoaderWorker �
�P SkipLoaderInit ���
�P SpareSameTebBits �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P 7 z
! ��
�P SpareCrossTebBits : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P 7 r
! ��6
v CrossTebFlags
�P SpareCrossTebBits 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P 7 p f
ReservedPad0 �
ReservedPad1 �
ReservedPad2 �
IdealProcessor ���: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P 7 G �
CurrentIdealProcessor
" IdealProcessorValue ��
ReservedPad0 �
ReservedPad1 �
ReservedPad2 �
IdealProcessor ���2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P 7 D
" ��
" ��6
�P SixtySecondEnabled ���
�P Reserved �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P 7 �
" ��
" ��R
" LeapSecondFlags ��
�P SixtySecondEnabled ���
�P Reserved �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P 7 �
" ��
" ��
" ��
" ��
�P HeapTracingEnabled ���
�P CritSecTracingEnabled
�P LibLoaderTracingEnabled ��
�P SpareTracingBits �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P 7 I
" ��
" ��
" ��
" ��
" TracingFlags �
�P HeapTracingEnabled ���
�P CritSecTracingEnabled
�P LibLoaderTracingEnabled ��
�P SpareTracingBits �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P 7 G >
KernelCallbackTable ��
UserSharedInfoPtr 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P 7 �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�P ProcessInJob �
�P ProcessInitializing ��
�P ProcessUsingVEH ��
�P ProcessUsingVCH ��
�P ProcessUsingFTH ��
�P ProcessPreviouslyThrottled ���
�P ProcessCurrentlyThrottled
�P ProcessImagesHotPatched ��
�P ReservedBits0 : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P 7 �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��2
" CrossProcessFlags
�P ProcessInJob �
�P ProcessInitializing ��
�P ProcessUsingVEH ��
�P ProcessUsingVCH ��
�P ProcessUsingFTH ��
�P ProcessPreviouslyThrottled ���
�P ProcessCurrentlyThrottled
�P ProcessImagesHotPatched ��
�P ReservedBits0 2
�P <anonymous-tag> .?AT<anonymous-tag>@@ Q 7 �
��
��
��
��
��
��
��
��
Q ImageUsesLargePages ��
Q IsProtectedProcess ���
Q IsImageDynamicallyRelocated ��
Q SkipPatchingUser32Forwarders �
Q IsPackagedProcess
Q IsAppContainer ���
Q IsProtectedProcessLight ��
Q IsLongPathAwareProcess ���:
Q <anonymous-tag> .?AU<anonymous-tag>@@ Q 7 s
��
��
��
��
��
��
��
��&
BitField �
Q ImageUsesLargePages ��
Q IsProtectedProcess ���
Q IsImageDynamicallyRelocated ��
Q SkipPatchingUser32Forwarders �
Q IsPackagedProcess
Q IsAppContainer ���
Q IsProtectedProcessLight ��
Q IsLongPathAwareProcess ���2 Q <anonymous-tag> .?AT<anonymous-tag>@@ Q 7 q *
# FiberData
" Version ��2 Q <anonymous-tag> .?AT<anonymous-tag>@@ Q ? F *
" FiberData
" Version ��2 Q <anonymous-tag> .?AT<anonymous-tag>@@ Q ? 3 *
FiberData
" Version ��2 Q <anonymous-tag> .?AT<anonymous-tag>@@ Q ? *
! Id ���
! NameIsPresent : !Q <anonymous-tag> .?AU<anonymous-tag>@@ "Q � d
# LoadedImports : $Q <anonymous-tag> .?AU<anonymous-tag>@@ %Q � U
" TimeDateStamp : 'Q <anonymous-tag> .?AU<anonymous-tag>@@ (Q � R 2
" TimeDateStamp
# LoadedImports 2 *Q <anonymous-tag> .?AT<anonymous-tag>@@ +Q � Q 2
# SectionPointer ���
" CheckSum �: -Q <anonymous-tag> .?AU<anonymous-tag>@@ .Q � L F
HashLinks
# SectionPointer ���
" CheckSum �2 0Q <anonymous-tag> .?AT<anonymous-tag>@@ 1Q � J
" LoadedImports : 3Q <anonymous-tag> .?AU<anonymous-tag>@@ 4Q � 2
" TimeDateStamp : 6Q <anonymous-tag> .?AU<anonymous-tag>@@ 7Q � / 2
" TimeDateStamp
" LoadedImports 2 9Q <anonymous-tag> .?AT<anonymous-tag>@@ :Q � . 2
" SectionPointer ���
" CheckSum �: <Q <anonymous-tag> .?AU<anonymous-tag>@@ =Q � ) F
HashLinks
" SectionPointer ���
" CheckSum �2 ?Q <anonymous-tag> .?AT<anonymous-tag>@@ @Q � '
! ��
! ��
! ��J
BQ SignatureLevel ���
CQ SignatureType
DQ Unused ���: EQ <anonymous-tag> .?AU<anonymous-tag>@@ FQ �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
HQ PackagedBinary ���
IQ MarkedForRemoval �
JQ ImageDll �
KQ LoadNotificationsSent
LQ TelemetryEntryProcessed ��
MQ ProcessStaticImport ��
NQ InLegacyLists
OQ InIndexes
PQ ShimDll ��
QQ InExceptionTable �
RQ ReservedFlags1 ���
SQ LoadInProgress ���
TQ LoadConfigProcessed ��
UQ EntryProcessed ���
VQ ProtectDelayLoad �
WQ ReservedFlags3 ���
XQ DontCallForThreads ���
YQ ProcessAttachCalled ��
ZQ ProcessAttachFailed ��
[Q CorDeferredValidate ��
\Q CorImage �
]Q DontRelocate �
^Q CorILOnly
_Q ChpeImage
`Q ReservedFlags5 ���
aQ Redirected ���
bQ ReservedFlags6 ���
cQ CompatDatabaseProcessed ��: dQ <anonymous-tag> .?AU<anonymous-tag>@@ eQ � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��&
FlagGroup
" Flags
gQ PackagedBinary ���
hQ MarkedForRemoval �
iQ ImageDll �
jQ LoadNotificationsSent
kQ TelemetryEntryProcessed ��
lQ ProcessStaticImport ��
mQ InLegacyLists
nQ InIndexes
oQ ShimDll ��
pQ InExceptionTable �
qQ ReservedFlags1 ���
rQ LoadInProgress ���
sQ LoadConfigProcessed ��
tQ EntryProcessed ���
uQ ProtectDelayLoad �
vQ ReservedFlags3 ���
wQ DontCallForThreads ���
xQ ProcessAttachCalled ��
yQ ProcessAttachFailed ��
zQ CorDeferredValidate ��
{Q CorImage �
|Q DontRelocate �
}Q CorILOnly
~Q ChpeImage
Q ReservedFlags5 ���
�Q Redirected ���
�Q ReservedFlags6 ���
�Q CompatDatabaseProcessed ��2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � �
=
�Q pAttributeV1 �2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q x ,
&
T Sid ��
� Buffer ���2 �Q D <anonymous-tag> .?AT<anonymous-tag>@@ �Q x | &
� TokenUser
� User �2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q x w �
# X0 ���
# X1 ���
# X2 ���
# X3 ���
# X4 ���
# ( X5 ���
# 0 X6 ���
# 8 X7 ���
# @ X8 ���
# H X9 ���
# P X10 ��
# X X11 ��
# ` X12 ��
# h X13 ��
# p X14 ��
# x X15 ��
# � X16 ��
# � X17 ��
# � X18 ��
# � X19 ��
# � X20 ��
# � X21 ��
# � X22 ��
# � X23 ��
# � X24 ��
# � X25 ��
# � X26 ��
# � X27 ��
# � X28 ��
# � Fp ���
# � Lr ���: �Q � <anonymous-tag> .?AU<anonymous-tag>@@ �Q � E �
# X0 ���
# X1 ���
# X2 ���
# X3 ���
# X4 ���
# ( X5 ���
# 0 X6 ���
# 8 X7 ���
# @ X8 ���
# H X9 ���
# P X10 ��
# X X11 ��
# ` X12 ��
# h X13 ��
# p X14 ��
# x X15 ��
# � X16 ��
# � X17 ��
# � X18 ��
# � X19 ��
# � X20 ��
# � X21 ��
# � X22 ��
# � X23 ��
# � X24 ��
# � X25 ��
# � X26 ��
# � X27 ��
# � X28 ��
# � Fp ���
# � Lr ���
/9 X 2 �Q � <anonymous-tag> .?AT<anonymous-tag>@@ �Q � D "
# Low ��
High �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � 6
" EntryPointToken ��
" EntryPointRVA 2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � � &
! Ordinal ��
! Hint �2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � y 6
# EndOfPrologue
# UnwindInfoAddress 2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q �
6
" UnwindInfoAddress
" UnwindData ���2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � 6
" ��
" ��
" ��
" ��
" ��
" ��
�Q FunctionLength ���
�Q Version ��
�Q ExceptionDataPresent �
�Q EpilogInHeader ���
�Q EpilogCount ��
�Q CodeWords : �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q �
" ��
" ��
"
��
" ��
" ��
" ��
" ��~
�Q Flag �
�Q FunctionLength ���
�Q RegF �
�Q RegI �
�Q H
�Q CR ���
�Q FrameSize : �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" UnwindData ���
�Q Flag �
�Q FunctionLength ���
�Q RegF �
�Q RegI �
�Q H
�Q CR ���
�Q FrameSize 2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
"
��
�Q Flag �
�Q FunctionLength ���
�Q Ret ��
�Q H
�Q Reg ��
�Q R
�Q L
�Q C
�Q StackAdjust ��: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
"
��
" UnwindData ���
�Q Flag �
�Q FunctionLength ���
�Q Ret ��
�Q H
�Q Reg ��
�Q R
�Q L
�Q C
�Q StackAdjust ��2
�Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � �
" ��
" ��2
�Q NativeCode ���
�Q AddressBits ��: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � y
" ��
" ��J
" StartOffset ��
�Q NativeCode ���
�Q AddressBits ��2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � w
" ��
" ��:
�Q OffsetToDirectory
�Q DataIsDirectory ��: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � V
" ��
" ��R
" OffsetToData �
�Q OffsetToDirectory
�Q DataIsDirectory ��2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � T
" ��
" ��2
�Q NameOffset ���
�Q NameIsString �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � M
" ��
" ��R
�Q NameOffset ���
�Q NameIsString �
" Name �
! Id ���2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � L
" ��
" ��6
�Q RvaBased �
�Q ReservedAttributes ���: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q �
>
" Characteristics ��
" OriginalFirstThunk ���2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � �
" ��
" ��
" ��>
R Reserved0
R Alignment
R Reserved1 : R <anonymous-tag> .?AU<anonymous-tag>@@ R � �
" ��
" ��
" ��Z
" Characteristics ��
R Reserved0
R Alignment
R Reserved1 2 R <anonymous-tag> .?AT<anonymous-tag>@@
R � �
" ��
" ��
" ��>
R Reserved0
R Alignment
R Reserved1 : R <anonymous-tag> .?AU<anonymous-tag>@@ R � �
" ��
" ��
" ��Z
" Characteristics ��
R Reserved0
R Alignment
R Reserved1 2 R <anonymous-tag> .?AT<anonymous-tag>@@ R � � 6
" VirtualAddress ���
" RelocCount ���2 R <anonymous-tag> .?AT<anonymous-tag>@@ R � v .
w$ TokenDef �
� rgbReserved ��: R <anonymous-tag> .?AU<anonymous-tag>@@ R � P "
" Short
" Long �: R <anonymous-tag> .?AU<anonymous-tag>@@ R � h :
ShortName
R Name �
8 LongName �2 !R <anonymous-tag> .?AT<anonymous-tag>@@ "R � f
p x
� test �: $R <anonymous-tag> .?AU<anonymous-tag>@@ %R
��
��>
'R Red ��
(R Balance ��
# ParentValue ��2 )R <anonymous-tag> .?AT<anonymous-tag>@@ *R } "
� Left �
� Right : ,R <anonymous-tag> .?AU<anonymous-tag>@@ -R u 6
� Children �
� Left �
� Right 2 /R <anonymous-tag> .?AT<anonymous-tag>@@ 0R s *
" LowPart ��
" HighPart �: 2R <anonymous-tag> .?AU<anonymous-tag>@@ 3R � *
" LowPart ��
HighPart �: 5R <anonymous-tag> .?AU<anonymous-tag>@@ 6R � >
UseThisFieldToCopy ���
A DoNotUseThisField 2 8R <anonymous-tag> .?AT<anonymous-tag>@@ 9R � 6 � tagEMRMASKBLT .?AUtagEMRMASKBLT@@ �
� emr ��
d rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
J 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d xMask
h yMask
" l iUsageMask ���
" p offBmiMask ���
" t cbBmiMask
" x offBitsMask ��
" | cbBitsMask ���6 <R � tagEMRMASKBLT .?AUtagEMRMASKBLT@@ =R � �
N
�-
r
u ��
u ��
u ��
u ��
u ��
u ���
u FeatureId
BR Priority �
CR EnabledState �
DR IsWexpConfiguration ��
ER HasSubscriptions �
FR Variant ��
GR VariantPayloadKind ���
u VariantPayload ���R HR _RTL_FEATURE_CONFIGURATION .?AU_RTL_FEATURE_CONFIGURATION@@ �� IR c
d ��
KR n � _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION .?AU_JOURNAL_TRANSACTION_BOUNDARY_INFORMATION@@
MR Z
� Action ���
# RecordNumber �
� TimeStamp
TransactionID n OR ( _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION .?AU_JOURNAL_TRANSACTION_BOUNDARY_INFORMATION@@ PR � � N � _PROCESS_AFFINITY_UPDATE_MODE .?AT_PROCESS_AFFINITY_UPDATE_MODE@@
" ��
" ��
" ��V
" Flags
SR EnableAutoUpdate �
TR Permanent
UR Reserved �N VR _PROCESS_AFFINITY_UPDATE_MODE .?AT_PROCESS_AFFINITY_UPDATE_MODE@@ WR � � : � _MESSAGE_TRACE .?AU_MESSAGE_TRACE@@ ��*
"6 MessageHeader
Data �: ZR _MESSAGE_TRACE .?AU_MESSAGE_TRACE@@ �� [R c �
$?
�
" ��
" ��
" ��
" ��
" Flags
`R EnableControlFlowGuard ���
aR EnableExportSuppression ��
bR StrictMode ���
cR ReservedFlags v dR _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@ eR ? � b � _PROCESS_EXTENDED_BASIC_INFORMATION .?AU_PROCESS_EXTENDED_BASIC_INFORMATION@@
gR
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��F
# Size �
L BasicInfo
" 8 Flags
iR 8 IsProtectedProcess ���
jR 8 IsWow64Process ���
kR 8 IsProcessDeleting
lR 8 IsCrossSessionCreate �
mR 8 IsFrozen �
nR 8 IsBackground �
oR 8 IsStronglyNamed ��
pR 8 IsSecureProcess ��
qR 8 IsSubsystemProcess ���
rR 8 SpareBits b
sR @ _PROCESS_EXTENDED_BASIC_INFORMATION .?AU_PROCESS_EXTENDED_BASIC_INFORMATION@@ tR ? �
�
� N � _THREAD_BASIC_INFORMATION .?AU_THREAD_BASIC_INFORMATION@@
�
ExitStatus ���
yR TebBaseAddress ���
ClientId �
# AffinityMask �
( Priority �
, BasePriority �N zR 0 _THREAD_BASIC_INFORMATION .?AU_THREAD_BASIC_INFORMATION@@ {R � �
F@
�G N � tagEMRSETCOLORADJUSTMENT .?AUtagEMRSETCOLORADJUSTMENT@@ ��.
� emr ��
1 ColorAdjustment ��N �R tagEMRSETCOLORADJUSTMENT .?AUtagEMRSETCOLORADJUSTMENT@@ �� �R � �
[
^-
#
�G R � _ADMINISTRATOR_POWER_POLICY .?AU_ADMINISTRATOR_POWER_POLICY@@ �
� MinSleep �
� MaxSleep �
" MinVideoTimeout ��
" MaxVideoTimeout ��
" MinSpindownTimeout ���
" MaxSpindownTimeout ���R �R _ADMINISTRATOR_POWER_POLICY .?AU_ADMINISTRATOR_POWER_POLICY@@ �R x �
�
E% F � _SERVICE_DESCRIPTIONA .?AU_SERVICE_DESCRIPTIONA@@
p lpDescription F �R _SERVICE_DESCRIPTIONA .?AU_SERVICE_DESCRIPTIONA@@ �R � � N � tagWNODE_EVENT_REFERENCE .?AUtagWNODE_EVENT_REFERENCE@@ ��
� WnodeHeader ��
0 TargetGuid ���
" @ TargetDataBlockSize ��
" D TargetInstanceIndex ��
2J D TargetInstanceName ���N �R H tagWNODE_EVENT_REFERENCE .?AUtagWNODE_EVENT_REFERENCE@@ �� �R � B � _CSV_QUERY_MDS_PATH .?AU_CSV_QUERY_MDS_PATH@@ R
" MdsNodeId
" DsNodeId �
" PathLength ���
| Path �B �R _CSV_QUERY_MDS_PATH .?AU_CSV_QUERY_MDS_PATH@@ �R � �
F b � _GET_FILTER_FILE_IDENTIFIER_OUTPUT .?AU_GET_FILTER_FILE_IDENTIFIER_OUTPUT@@ ��J
! FilterFileIdentifierLength ���
� FilterFileIdentifier �b �R _GET_FILTER_FILE_IDENTIFIER_OUTPUT .?AU_GET_FILTER_FILE_IDENTIFIER_OUTPUT@@ �� �R � �"
�# R � _UNWIND_HISTORY_TABLE_ENTRY .?AU_UNWIND_HISTORY_TABLE_ENTRY@@ �R " � �
" Count
LocalHint
GlobalHint ���
Search ���
Once �
# LowAddress ���
# HighAddress ��
�R Entry F �R � _UNWIND_HISTORY_TABLE .?AU_UNWIND_HISTORY_TABLE@@ �R � � r � _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION .?AU_EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION@@
�R �
@ EventTraceInformationClass ���
" ReleaseSamplingRate ��
" ContentionSamplingRate ���
" NumberOfExcessiveTimeouts r �R _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION .?AU_EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION@@ �R A V
LastError
LastEEInfo ���
� LastCalledStage ��
q ServerName ���
q ServerPort ���
q ( RemoteUser ���
q 0 AuthType �
8 ResourceTypePresent ��
9 SessionIdPresent �
: InterfacePresent �
< ResourceType �
L SessionId
3 \ Interface
p CertContext ��B �R x _RDR_CALLOUT_STATE .?AU_RDR_CALLOUT_STATE@@ �� �R 7 J � _RTL_FEATURE_USAGE_DATA .?AU_RTL_FEATURE_USAGE_DATA@@ B
u FeatureId
! ReportingKind
! Reserved �J �R _RTL_FEATURE_USAGE_DATA .?AU_RTL_FEATURE_USAGE_DATA@@ �R z V � _DRIVER_VERIFIER_THUNK_PAIRS .?AU_DRIVER_VERIFIER_THUNK_PAIRS@@ ��
�R
$ 6
�R PristineRoutine ��
�R NewRoutine ���V �R _DRIVER_VERIFIER_THUNK_PAIRS .?AU_DRIVER_VERIFIER_THUNK_PAIRS@@ �� �R � � B � tagEMRRESIZEPALETTE .?AUtagEMRRESIZEPALETTE@@
�R 6
� emr ��
" ihPal
" cEntries �B �R tagEMRRESIZEPALETTE .?AUtagEMRRESIZEPALETTE@@ �R � �
" ��
" ��
" ��
" Flags
�R RaiseExceptionOnInvalidHandleReference ���
�R HandleExceptionsPermanentlyEnabled ���
�R ReservedFlags z �R _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ �� �R ? X J � _KEY_LAYER_INFORMATION .?AU_KEY_LAYER_INFORMATION@@ ��
�R
" ��
" ��
" ��
" ��
" ��
�R IsTombstone ��
�R IsSupersedeLocal �
�R IsSupersedeTree ��
�R ClassIsInherited �
�R Reserved �J �R _KEY_LAYER_INFORMATION .?AU_KEY_LAYER_INFORMATION@@ �� �R
�: R � _KEY_SET_LAYER_INFORMATION .?AU_KEY_SET_LAYER_INFORMATION@@ ��
�R
" ��
" ��
" ��
" ��
" ��
�R IsTombstone ��
�R IsSupersedeLocal �
�R IsSupersedeTree ��
�R ClassIsInherited �
�R Reserved �R �R _KEY_SET_LAYER_INFORMATION .?AU_KEY_SET_LAYER_INFORMATION@@ �� �R . b � _VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT .?AU_VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT@@
�R *
" Size �
�6 BehaviorCode �b �R _VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT .?AU_VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT@@ �R � �!
:B " ! R � _KEY_WRITE_TIME_INFORMATION .?AU_KEY_WRITE_TIME_INFORMATION@@
�R
� LastWriteTime R �R _KEY_WRITE_TIME_INFORMATION .?AU_KEY_WRITE_TIME_INFORMATION@@ �R
" ��
" ��
" ��
" ��
ImageBase
# SizeOfImage ��
" ImageFlags ���
�R ImagePartialMap ��
�R ImageNotExecutable ���
�R ImageSigningLevel
�R Reserved �N �R _MEMORY_IMAGE_INFORMATION .?AU_MEMORY_IMAGE_INFORMATION@@ �R t �
F;
$5
�
3
�>
8; ^- " �R
�R 2 � _PORT_VIEW .?AU_PORT_VIEW@@ ��
�R �
" Length ���
SectionHandle
" SectionOffset
# ViewSize �
ViewBase �
( ViewRemoteBase ���2 �R 0 _PORT_VIEW .?AU_PORT_VIEW@@ �� �R � � Z � _FILE_PIPE_ASSIGN_EVENT_BUFFER .?AU_FILE_PIPE_ASSIGN_EVENT_BUFFER@@ ��.
EventHandle ��
" KeyValue �Z �R _FILE_PIPE_ASSIGN_EVENT_BUFFER .?AU_FILE_PIPE_ASSIGN_EVENT_BUFFER@@ �� �R �
)
�( ��
�R
R V
rgbBlue ��
rgbGreen �
rgbRed ���
rgbReserved ��2 �R tagRGBQUAD .?AUtagRGBQUAD@@ �� S � z Z � _RTL_DISK_WRITE_CONSTRAINT_INFO .?AU_RTL_DISK_WRITE_CONSTRAINT_INFO@@
NG Policy ���Z S _RTL_DISK_WRITE_CONSTRAINT_INFO .?AU_RTL_DISK_WRITE_CONSTRAINT_INFO@@ S 7
� �= f � _PERFINFO_PAGECOMBINE_ITERATION_STAT .?AU_PERFINFO_PAGECOMBINE_ITERATION_STAT@@ ��
" ��
" ��V
S StatType �
S Spare
" PagesScanned �
" PagesCombined f S _PERFINFO_PAGECOMBINE_ITERATION_STAT .?AU_PERFINFO_PAGECOMBINE_ITERATION_STAT@@ �� S c @
x,
0D J � _ATOM_BASIC_INFORMATION .?AU_ATOM_BASIC_INFORMATION@@ R
! UsageCount ���
! Flags
! NameLength ���
| Name �J S _ATOM_BASIC_INFORMATION .?AU_ATOM_BASIC_INFORMATION@@ S �
� B � tagEMRGRADIENTFILL .?AUtagEMRGRADIENTFILL@@ �� � " �j
� emr ��
d rclBounds
" nVer �
" nTri �
" ulMode ���
S $ Ver ��B S 4 tagEMRGRADIENTFILL .?AUtagEMRGRADIENTFILL@@ �� S �
H;
�>
�
<D � S S t t S
S
! ^ � _RTL_IMAGE_MITIGATION_HEAP_POLICY .?AU_RTL_IMAGE_MITIGATION_HEAP_POLICY@@ "
� TerminateOnHeapErrors ^ $S _RTL_IMAGE_MITIGATION_HEAP_POLICY .?AU_RTL_IMAGE_MITIGATION_HEAP_POLICY@@ %S = : TimerSetCoalescableTimer � MaxTimerInfoClass R t 'S _TIMER_SET_INFORMATION_CLASS .?AW4_TIMER_SET_INFORMATION_CLASS@@ ��� (S � � F � _RTL_HEAP_WALK_ENTRY .?AU_RTL_HEAP_WALK_ENTRY@@ ��
*S �
DataAddress ��
# DataSize �
OverheadBytes
SegmentIndex �
! Flags
/K Block
,K Segment ��F ,S 0 _RTL_HEAP_WALK_ENTRY .?AU_RTL_HEAP_WALK_ENTRY@@ �� -S � �
E9
�F
>
� W * 2S _FP_32 .?AU_FP_32@@ �� 3S � 6
+
/
e8
_
-
t unused ���2 :S HMETAFILE__ .?AUHMETAFILE__@@ ;S �' �
D&
�- � � ?S
�
�
�A
�- > � _LEAP_SECOND_DATA .?AU_LEAP_SECOND_DATA@@
A FS B � _ACCESS_DENIED_ACE .?AU_ACCESS_DENIED_ACE@@ ��:
� Header ���
" Mask �
" SidStart �B IS _ACCESS_DENIED_ACE .?AU_ACCESS_DENIED_ACE@@ �� JS x �
1 V � _RTLP_HEAP_SERIALIZED_MAPPING .?AU_RTLP_HEAP_SERIALIZED_MAPPING@@ F
# Allocation ���
StackReference ���
# Size �V NS _RTLP_HEAP_SERIALIZED_MAPPING .?AU_RTLP_HEAP_SERIALIZED_MAPPING@@ OS � z
�E
�
�A
�F
lA B � _FILE_REGION_INPUT .?AU_FILE_REGION_INPUT@@ ��
VS F
FileOffset ���
Length ���
" DesiredUsage �B XS _FILE_REGION_INPUT .?AU_FILE_REGION_INPUT@@ �� YS � } ^ � _FILE_END_OF_FILE_INFORMATION_EX .?AU_FILE_END_OF_FILE_INFORMATION_EX@@ ��b
� EndOfFile
� PagingFileSizeInMM ���
� PagingFileMaxSize
" Flags ^ \S _FILE_END_OF_FILE_INFORMATION_EX .?AU_FILE_END_OF_FILE_INFORMATION_EX@@ �� ]S � $
�4
]+ `S t aS
bS
|C
:4 b � _FILE_PIPE_EVENT_ENUM_INPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_INPUT_BUFFER@@ ��
# EventHandle ��b gS _FILE_PIPE_EVENT_ENUM_INPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_INPUT_BUFFER@@ �� hS � �)
8 R � _ETW_TIMER_EXPIRATION_EVENT .?AU_ETW_TIMER_EXPIRATION_EVENT@@ j
# ExpectedDueTime ��
# TimerAddress �
# DeferredRoutine ��
EncodedDelay �R lS _ETW_TIMER_EXPIRATION_EVENT .?AU_ETW_TIMER_EXPIRATION_EVENT@@ mS c � > � _RTL_ELEVATION_FLAGS .?AT_RTL_ELEVATION_FLAGS@@ ��
oS
" ��
" ��
" ��
" ��
" Flags
qS ElevationEnabled �
rS VirtualizationEnabled
sS InstallerDetectEnabled ���
tS ReservedBits �> uS _RTL_ELEVATION_FLAGS .?AT_RTL_ELEVATION_FLAGS@@ �� vS b } � �2 xS
yS & " �n
Flags
EfficiencyClass ��
� Reserved �
! GroupCount ���
{S GroupMask J |S ( _PROCESSOR_RELATIONSHIP .?AU_PROCESSOR_RELATIONSHIP@@ }S � F � _PROCESS_INFORMATION .?AU_PROCESS_INFORMATION@@ ��
S Z
hProcess �
hThread ��
" dwProcessId ��
" dwThreadId ���F �S _PROCESS_INFORMATION .?AU_PROCESS_INFORMATION@@ �� �S � J � _RTL_RVA_LIST_ITERATOR .?AU_RTL_RVA_LIST_ITERATOR@@ ��Z
" CurrentRva ���
" CurrentRvaIndex ��
" CompressedRvaDataOffset ��J �S _RTL_RVA_LIST_ITERATOR .?AU_RTL_RVA_LIST_ITERATOR@@ �� �S r
�2 Z � _NTPSS_MEMORY_BULK_INFORMATION .?AU_NTPSS_MEMORY_BULK_INFORMATION@@ ��R
" QueryFlags ���
" NumberOfEntries ��
NextValidAddress �Z �S _NTPSS_MEMORY_BULK_INFORMATION .?AU_NTPSS_MEMORY_BULK_INFORMATION@@ �� �S � *
�
�,
�G
�D
PC j � _FILE_NETWORK_PHYSICAL_NAME_INFORMATION .?AU_FILE_NETWORK_PHYSICAL_NAME_INFORMATION@@ 2
" FileNameLength ���
| FileName �j �S _FILE_NETWORK_PHYSICAL_NAME_INFORMATION .?AU_FILE_NETWORK_PHYSICAL_NAME_INFORMATION@@ �S � �
�2
]=
Z3 " " � �
�. J � _EVENT_FILTER_LEVEL_KW .?AU_EVENT_FILTER_LEVEL_KW@@ ��^
# MatchAnyKeyword ��
# MatchAllKeyword ��
Level
FilterIn �J �S _EVENT_FILTER_LEVEL_KW .?AU_EVENT_FILTER_LEVEL_KW@@ �� �S > �
O6
u=
M q " q t �S
�S
�*
�B
�) ' " � �
! Size �
! Version ��
ProcessorNumber ��
" ContextSwitches ��
" HwCountersCount ��
� UpdateCount ��
# WaitReasonBitMap �
# HardwareCounters �
' ( CycleTime
�S @ HwCounters ���N
�S �_THREAD_PERFORMANCE_DATA .?AU_THREAD_PERFORMANCE_DATA@@ �� �S � �
R7
� # M
)
�0
�6
�=
�
�5
�7 f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W@@ ��
=( TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
q ServerCertificateSubject �
=( ( ProxyCredentials �
" 0 NumberOfProxyAuthnSchemes
" 8 ProxyAuthnSchemes f �S @ _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W@@ �� �S _ �
� N � tagINPUT_INJECTION_VALUE .?AUtagINPUT_INJECTION_VALUE@@ ��B
! page �
! usage
t value
! index N �S tagINPUT_INJECTION_VALUE .?AUtagINPUT_INJECTION_VALUE@@ �� �S P ^ � _PERFINFO_MEMORY_NODE_INFORMATION .?AU_PERFINFO_MEMORY_NODE_INFORMATION@@ �/ " L �>
" PartitionId ��
" Count
�S NodeEntry ^ �S T _PERFINFO_MEMORY_NODE_INFORMATION .?AU_PERFINFO_MEMORY_NODE_INFORMATION@@ �S c � j � _FILE_FS_PERSISTENT_VOLUME_INFORMATION .?AU_FILE_FS_PERSISTENT_VOLUME_INFORMATION@@ ��V
" VolumeFlags ��
" FlagMask �
" Version ��
" Reserved �j �S _FILE_FS_PERSISTENT_VOLUME_INFORMATION .?AU_FILE_FS_PERSISTENT_VOLUME_INFORMATION@@ �� �S � W n � _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA .?AU_PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA@@ ��
DeviceInstance ���
� InterfaceGuid
Reference
( Register �
q 0 SymLink ��
" 8 SymLinkLength n �S @ _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA .?AU_PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA@@ �� �S % V J � _FILE_PIPE_INFORMATION .?AU_FILE_PIPE_INFORMATION@@ ��2
" ReadMode �
" CompletionMode ���J �S _FILE_PIPE_INFORMATION .?AU_FILE_PIPE_INFORMATION@@ �� �S � F . � _NT_TIB32 .?AU_NT_TIB32@@ �
" ExceptionList
" StackBase
" StackLimit ���
" SubSystemTib �
" FiberData
" Version ��
" ArbitraryUserPointer �
" Self �. �S _NT_TIB32 .?AU_NT_TIB32@@ �S ? , Z � _FILE_FS_FULL_SIZE_INFORMATION .?AU_FILE_FS_FULL_SIZE_INFORMATION@@ ��
�S �
� TotalAllocationUnits �
� CallerAvailableAllocationUnits ���
� ActualAvailableAllocationUnits ���
" SectorsPerAllocationUnit �
" BytesPerSector ���Z �S _FILE_FS_FULL_SIZE_INFORMATION .?AU_FILE_FS_FULL_SIZE_INFORMATION@@ �� �S �
�7
fG
� ��
�S F � _NETCONNECTINFOSTRUCT .?AU_NETCONNECTINFOSTRUCT@@ n
" cbStructure ��
" dwFlags ��
" dwSpeed ��
" dwDelay ��
" dwOptDataSize F �S _NETCONNECTINFOSTRUCT .?AU_NETCONNECTINFOSTRUCT@@ �S � u > � _SE_ACCESS_REPLY .?AU_SE_ACCESS_REPLY@@ ��
�S
*
T?
�S �
" Size �
" ResultListCount ��
" GrantedAccess
AccessStatus �
�S AccessReason �
�S Privileges ���> �S ( _SE_ACCESS_REPLY .?AU_SE_ACCESS_REPLY@@ �� �S x p t t t t �S
�S
�
^ � _LOOKUP_STREAM_FROM_CLUSTER_ENTRY .?AU_LOOKUP_STREAM_FROM_CLUSTER_ENTRY@@ f
" OffsetToNext �
" Flags
� Reserved �
� Cluster ��
| FileName �^ �S _LOOKUP_STREAM_FROM_CLUSTER_ENTRY .?AU_LOOKUP_STREAM_FROM_CLUSTER_ENTRY@@ �S � �
` J � _FILE_LEVEL_TRIM_OUTPUT .?AU_FILE_LEVEL_TRIM_OUTPUT@@
�S "
" NumRangesProcessed ���J �S _FILE_LEVEL_TRIM_OUTPUT .?AU_FILE_LEVEL_TRIM_OUTPUT@@ �S � g
�
�6 F � _IMAGE_IMPORT_BY_NAME .?AU_IMAGE_IMPORT_BY_NAME@@ "
! Hint �
Name �F �S _IMAGE_IMPORT_BY_NAME .?AU_IMAGE_IMPORT_BY_NAME@@ �S � } : � _NETINFOSTRUCT .?AU_NETINFOSTRUCT@@ ��
" cbStructure ��
" dwProviderVersion
" dwStatus �
" dwCharacteristics
# dwHandle �
! wNetType �
" dwPrinters ���
" dwDrives �: T ( _NETINFOSTRUCT .?AU_NETINFOSTRUCT@@ �� T � �
�F
�! R � _ETW_THREAD_AFFINITY_EVENT .?AU_ETW_THREAD_AFFINITY_EVENT@@ ��J
# Mask �
" ThreadId �
! Group
! Reserved �R T _ETW_THREAD_AFFINITY_EVENT .?AU_ETW_THREAD_AFFINITY_EVENT@@ �� T c %
�/ V � tagEMRCREATEDIBPATTERNBRUSHPT .?AUtagEMRCREATEDIBPATTERNBRUSHPT@@ �
� emr ��
" ihBrush ��
" iUsage ���
" offBmi ���
" cbBmi
" offBits ��
" cbBits ���V T tagEMRCREATEDIBPATTERNBRUSHPT .?AUtagEMRCREATEDIBPATTERNBRUSHPT@@
T � u
+
Y:
^ B � _IMAGE_ROM_HEADERS .?AU_IMAGE_ROM_HEADERS@@ ��6
� FileHeader ���
� OptionalHeader ���B T L _IMAGE_ROM_HEADERS .?AU_IMAGE_ROM_HEADERS@@ �� T � � f � PROCESS_PROTECTION_LEVEL_INFORMATION .?AUPROCESS_PROTECTION_LEVEL_INFORMATION@@ ��
" ProtectionLevel ��f T PROCESS_PROTECTION_LEVEL_INFORMATION .?AUPROCESS_PROTECTION_LEVEL_INFORMATION@@ �� T � �
r � � t T
T
�;
b6 b � _ETW_TP_EVENT_TIMER_EXPIRATION_END .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_END@@ ��
T *
j Header ���
SubQueue �b "T ( _ETW_TP_EVENT_TIMER_EXPIRATION_END .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_END@@ �� #T c =
:
+E �" __n16 .?AT__n16@@ ! " � " � " � p " �R
(T n16_u16 ��
)T n16_u8 ���
*T n16_i16 ��
+T n16_i8 ��� &,T __n16 .?AT__n16@@ -T * < R � _ETW_CPU_CACHE_FLUSH_EVENT .?AU_ETW_CPU_CACHE_FLUSH_EVENT@@ ��
Address ��
# Bytes
Clean
FullFlush
Rectangle
Reserved0
" Reserved1 R 0T _ETW_CPU_CACHE_FLUSH_EVENT .?AU_ETW_CPU_CACHE_FLUSH_EVENT@@ �� 1T c N
� "
�) Type �
" Size �J 4T _PO_WAKE_SOURCE_HEADER .?AU_PO_WAKE_SOURCE_HEADER@@ �� 5T x
N � _IMAGE_RESOURCE_DIRECTORY .?AU_IMAGE_RESOURCE_DIRECTORY@@
7T �
" Characteristics ��
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
! NumberOfNamedEntries �
! NumberOfIdEntries N 9T _IMAGE_RESOURCE_DIRECTORY .?AU_IMAGE_RESOURCE_DIRECTORY@@ :T � /
: � tagEMRROUNDRECT .?AUtagEMRROUNDRECT@@ :
� emr ��
d rclBox ���
e szlCorner : >T tagEMRROUNDRECT .?AUtagEMRROUNDRECT@@ ?T �
# > � _NTFS_STATISTICS .?AU_NTFS_STATISTICS@@ ��
BT ~
" LogFileFullExceptions
" OtherExceptions ��
" MftReads �
" MftReadBytes �
" MftWrites
" MftWriteBytes
N MftWritesUserLevel ���
! MftWritesFlushForLogFileFull �
! " MftWritesLazyWriter ��
! $ MftWritesUserRequest �
" ( Mft2Writes ���
" , Mft2WriteBytes ���
N 0 Mft2WritesUserLevel ��
! 8 Mft2WritesFlushForLogFileFull
! : Mft2WritesLazyWriter �
! < Mft2WritesUserRequest
" @ RootIndexReads ���
" D RootIndexReadBytes ���
" H RootIndexWrites ��
" L RootIndexWriteBytes ��
" P BitmapReads ��
" T BitmapReadBytes ��
" X BitmapWrites �
" \ BitmapWriteBytes �
! ` BitmapWritesFlushForLogFileFull ��
! b BitmapWritesLazyWriter ���
! d BitmapWritesUserRequest ��
N f BitmapWritesUserLevel
" l MftBitmapReads ���
" p MftBitmapReadBytes ���
" t MftBitmapWrites ��
" x MftBitmapWriteBytes ��
! | MftBitmapWritesFlushForLogFileFull ���
! ~ MftBitmapWritesLazyWriter
! � MftBitmapWritesUserRequest ���
N � MftBitmapWritesUserLevel �
" � UserIndexReads ���
" � UserIndexReadBytes ���
" � UserIndexWrites ��
" � UserIndexWriteBytes ��
" � LogFileReads �
" � LogFileReadBytes �
" � LogFileWrites
" � LogFileWriteBytes
N � Allocate �
" � DiskResourcesExhausted ���> . DT � _NTFS_STATISTICS .?AU_NTFS_STATISTICS@@ �� ET � \ F � _TEB_ACTIVE_FRAME_EX .?AU_TEB_ACTIVE_FRAME_EX@@ ��:
" BasicFrame ���
ExtensionIdentifier ��F HT _TEB_ACTIVE_FRAME_EX .?AU_TEB_ACTIVE_FRAME_EX@@ �� IT 7 �
�3 j � _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX@@ ��V
DebuggerAllowed ��
DebuggerEnabled ��
DebuggerPresent ��j MT _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX@@ �� NT � �
P
>(
l( : � tagGCP_RESULTSW .?AUtagGCP_RESULTSW@@ �
" lStructSize ��
q lpOutString ��
u lpOrder ��
t lpDx �
t lpCaretPos ���
p ( lpClass ��
q 0 lpGlyphs �
u 8 nGlyphs ��
t < nMaxFit ��: UT @ tagGCP_RESULTSW .?AUtagGCP_RESULTSW@@ VT � �
{" q t YT
ZT F � tagMENUGETOBJECTINFO .?AUtagMENUGETOBJECTINFO@@ ��V
" dwFlags ��
u uPos �
� hmenu
riid �
pvObj F ]T tagMENUGETOBJECTINFO .?AUtagMENUGETOBJECTINFO@@ �� ^T h
n+ J � _MESSAGE_RESOURCE_ENTRY .?AU_MESSAGE_RESOURCE_ENTRY@@ 6
! Length ���
! Flags
� Text �J bT _MESSAGE_RESOURCE_ENTRY .?AU_MESSAGE_RESOURCE_ENTRY@@ cT b �
qD B � tagMDICREATESTRUCTW .?AUtagMDICREATESTRUCTW@@ �
szClass ��
szTitle ��
hOwner ���
t x
t y
t cx ���
t $ cy ���
" ( style
0 lParam ���B gT 8 tagMDICREATESTRUCTW .?AUtagMDICREATESTRUCTW@@ hT �.
,
��
��
��
��
��
��
��
��
�< . � _SLIST_HEADER .?AT_SLIST_HEADER@@
tT
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" �� " " � �
� " " � �N � _ACTIVATION_CONTEXT_DATA .?AU_ACTIVATION_CONTEXT_DATA@@ ��
�T ��
�T F � _ASSEMBLY_STORAGE_MAP .?AU_ASSEMBLY_STORAGE_MAP@@
�T
" ��
" ��
" ��
" �� p " �
ES
" ��
" ��6
InheritedAddressSpace
ReadImageFileExecOptions �
BeingDebugged
BitField �
kT ImageUsesLargePages ��
lT IsProtectedProcess ���
mT IsImageDynamicallyRelocated ��
nT SkipPatchingUser32Forwarders �
oT IsPackagedProcess
pT IsAppContainer ���
qT IsProtectedProcessLight ��
rT IsLongPathAwareProcess ���
Padding0 �
Mutant ���
ImageBaseAddress �
sT Ldr ��
�< ProcessParameters
( SubSystemData
0 ProcessHeap ��
h 8 FastPebLock ��
uT @ AtlThunkSListPtr �
H IFEOKey ��
" P CrossProcessFlags
vT P ProcessInJob �
wT P ProcessInitializing ��
xT P ProcessUsingVEH ��
yT P ProcessUsingVCH ��
zT P ProcessUsingFTH ��
{T P ProcessPreviouslyThrottled ���
|T P ProcessCurrentlyThrottled
}T P ProcessImagesHotPatched ��
~T P ReservedBits0
T Padding1 �
X KernelCallbackTable ��
X UserSharedInfoPtr
" ` SystemReserved ���
" d AtlThunkSListPtr32 ���
h ApiSetMap
" p TlsExpansionCounter ��
t Padding2 �
x TlsBitmap
8 � TlsBitmapBits
� ReadOnlySharedMemoryBase �
� SharedData ���
! � ReadOnlyStaticServerData �
� AnsiCodePageData �
� OemCodePageData ��
� UnicodeCaseTableData �
" � NumberOfProcessors ���
" � NtGlobalFlag �
� � CriticalSectionTimeout ���
# � HeapSegmentReserve ���
# � HeapSegmentCommit
# � HeapDeCommitTotalFreeThreshold ���
# � HeapDeCommitFreeBlockThreshold ���
" � NumberOfHeaps
" � MaximumNumberOfHeaps �
! � ProcessHeaps �
� GdiSharedHandleTable �
ProcessStarterHelper �
" GdiDCAttributeList ���
Padding3 �
h LoaderLock ���
" OSMajorVersion ���
" OSMinorVersion ���
! OSBuildNumber
! "OSCSDVersion �
" $OSPlatformId �
" (ImageSubsystem ���
" ,ImageSubsystemMajorVersion ���
" 0ImageSubsystemMinorVersion ���
4Padding4 �
# 8ActiveProcessAffinityMask
T @GdiHandleBuffer ��
�T 0PostProcessInitRoutine ���
8TlsExpansionBitmap ���
�T @TlsExpansionBitmapBits ���
" �SessionId
�Padding5 �
� �AppCompatFlags ���
� �AppCompatFlagsUser ���
�pShimData
�AppCompatInfo
�CSDVersion ���
�T �ActivationContextData
�T ProcessAssemblyStorageMap
�T SystemDefaultActivationContextData ���
�T SystemAssemblyStorageMap �
# MinimumStackCommit ���
�9 SparePointers
@SpareUlongs ��
XWerRegistrationData ��
`WerShipAssertPtr �
hpUnused ��
ppImageHeaderHash �
" xTracingFlags �
�T xHeapTracingEnabled ���
�T xCritSecTracingEnabled
�T xLibLoaderTracingEnabled ��
�T xSpareTracingBits �
|Padding6 �
# �CsrServerReadOnlySharedMemoryBase
# �TppWorkerpListLock ���
�TppWorkerpList ���
� �WaitOnAddressHashTable ���
�TelemetryCoverageHeader ��
" �CloudFileFlags ���
" �CloudFileDiagFlags ���
p �PlaceholderCompatibilityMode �
�T �PlaceholderCompatibilityModeReserved �
�T �LeapSecondData ���
" �LeapSecondFlags ��
�T �SixtySecondEnabled ���
�T �Reserved �
" �NtGlobalFlag2 & s �T �_PEB .?AU_PEB@@ �� �T 7 m > � tagBITMAPCOREINFO .?AUtagBITMAPCOREINFO@@ �3 " �2
m bmciHeader ���
�T bmciColors ���> �T tagBITMAPCOREINFO .?AUtagBITMAPCOREINFO@@ �T � �
'
�M 6 � _BOOT_OPTIONS .?AU_BOOT_OPTIONS@@
�T �
" Version ��
" Length ���
" Timeout ��
" CurrentBootEntryId ���
" NextBootEntryId ��
| HeadlessRedirection ��6 �T _BOOT_OPTIONS .?AU_BOOT_OPTIONS@@ �T � �
�% ^ � _PROCESS_LEAP_SECOND_INFORMATION .?AU_PROCESS_LEAP_SECOND_INFORMATION@@ ��
�T &
" Flags
" Reserved �^ �T _PROCESS_LEAP_SECOND_INFORMATION .?AU_PROCESS_LEAP_SECOND_INFORMATION@@ �� �T ?
[9 6 � HTOUCHINPUT__ .?AUHTOUCHINPUT__@@
�T
t unused ���6 �T HTOUCHINPUT__ .?AUHTOUCHINPUT__@@ �T
�S
�T
0
�#
= ^ � _SYSTEM_ACTIVITY_MODERATION_INFO .?AU_SYSTEM_ACTIVITY_MODERATION_INFO@@ ��J
Identifier ���
jC ModerationState ��
�7 AppType ��^ �T _SYSTEM_ACTIVITY_MODERATION_INFO .?AU_SYSTEM_ACTIVITY_MODERATION_INFO@@ �� �T � *
�B
p F � _RTL_HEAP_STACK_QUERY .?AU_RTL_HEAP_STACK_QUERY@@
�T # �T
�T �
" Version ��
Process ��
�T WriteRoutine �
SerializationContext �
QueryLevel ���
! Flags F �T ( _RTL_HEAP_STACK_QUERY .?AU_RTL_HEAP_STACK_QUERY@@ �T � �
f5
ZJ f
" NextEntryOffset ��
n ParentFileId �
" FileNameLength ���
| FileName �f �T _FILE_LINK_ENTRY_FULL_ID_INFORMATION .?AU_FILE_LINK_ENTRY_FULL_ID_INFORMATION@@ �� �T � �
�,
�T J � tagINPUT_MESSAGE_SOURCE .?AUtagINPUT_MESSAGE_SOURCE@@ .
_ deviceType ���
�+ originId �J �T tagINPUT_MESSAGE_SOURCE .?AUtagINPUT_MESSAGE_SOURCE@@ �T �= Z � _PLUGPLAY_CONTROL_CONFLICT_DATA .?AU_PLUGPLAY_CONTROL_CONFLICT_DATA@@
�T
,F
u- �
DeviceInstance ���
�T ResourceList �
" ResourceListSize �
�T ConflictBuffer ���
" ( ConflictBufferSize ���
" , Flags
0 Status ���Z �T 8 _PLUGPLAY_CONTROL_CONFLICT_DATA .?AU_PLUGPLAY_CONTROL_CONFLICT_DATA@@ �T % �
H Z � _PROCESS_FOREGROUND_BACKGROUND .?AU_PROCESS_FOREGROUND_BACKGROUND@@ ��
Foreground ���Z �T _PROCESS_FOREGROUND_BACKGROUND .?AU_PROCESS_FOREGROUND_BACKGROUND@@ �� �T � > !
�B
jF
78
f-
�! �? " " " " �T
�T
� V � _FILE_FS_CONTROL_INFORMATION .?AU_FILE_FS_CONTROL_INFORMATION@@ ��
�T �
� FreeSpaceStartFiltering ��
� FreeSpaceThreshold ���
� FreeSpaceStopFiltering ���
� DefaultQuotaThreshold
� DefaultQuotaLimit
" ( FileSystemControlFlags ���V �T 0 _FILE_FS_CONTROL_INFORMATION .?AU_FILE_FS_CONTROL_INFORMATION@@ �� �T � �
�1 &
q wcLow
! cGlyphs ��2 �T tagWCRANGE .?AUtagWCRANGE@@ �� �T � �
?
�
�
@
" dwExitCode ���N �T _EXIT_PROCESS_DEBUG_INFO .?AU_EXIT_PROCESS_DEBUG_INFO@@ �� �T � L
c j � _ACTIVATION_CONTEXT_SECTION_KEYED_DATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA@@ ��
�T 2
" Size �
" DataFormatVersion
Data �
" Length ���
SectionGlobalData
" SectionGlobalDataLength ��
( SectionBase ��
" 0 SectionTotalLength ���
�! 8 ActivationContext
" @ AssemblyRosterIndex ��
" D Flags
�5 H AssemblyMetadata �j �T p _ACTIVATION_CONTEXT_SECTION_KEYED_DATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA@@ �� �T � �
?
2
� " �T t �T
�T
q
X$
�
�6
7
�? ] U
�6
+
�5 F � _KEY_NAME_INFORMATION .?AU_KEY_NAME_INFORMATION@@
U *
" NameLength ���
| Name �F U _KEY_NAME_INFORMATION .?AU_KEY_NAME_INFORMATION@@
U � J � _ETW_CLOCK_TIME_UPDATE .?AU_ETW_CLOCK_TIME_UPDATE@@ ��2
# InterruptTime
" ClockOwner ���J U _ETW_CLOCK_TIME_UPDATE .?AU_ETW_CLOCK_TIME_UPDATE@@ �� U c
<
�/ R � _RTL_TIME_ZONE_INFORMATION .?AU_RTL_TIME_ZONE_INFORMATION@@ ��
U �
Bias �
StandardName �
�7 D StandardStart
T StandardBias �
X DaylightName �
�7 � DaylightStart
� DaylightBias �R U � _RTL_TIME_ZONE_INFORMATION .?AU_RTL_TIME_ZONE_INFORMATION@@ �� U � � M N � _RTL_ENCLAVE_LAUNCH_TOKEN .?AU_RTL_ENCLAVE_LAUNCH_TOKEN@@ �
� Measurement ��
� AuthorId �
p @ FamilyId �
p P ImageId ��
# ` EnclaveSize ��
" h EnclaveSvn ���
" l PolicyFlags ��N U p _RTL_ENCLAVE_LAUNCH_TOKEN .?AU_RTL_ENCLAVE_LAUNCH_TOKEN@@ U
�R
�. N � _PROCESS_LOGGING_INFORMATION .?AT_PROCESS_LOGGING_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" Flags
"U EnableReadVmLogging ��
#U EnableWriteVmLogging �
$U EnableProcessSuspendResumeLogging
%U EnableThreadSuspendResumeLogging �
&U Reserved �N 'U _PROCESS_LOGGING_INFORMATION .?AT_PROCESS_LOGGING_INFORMATION@@ �� (U ? Z > � _IMAGE_VXD_HEADER .?AU_IMAGE_VXD_HEADER@@ �
! e32_magic
e32_border ���
e32_worder ���
" e32_level
! e32_cpu ��
!
e32_os ���
" e32_ver ��
" e32_mflags ���
" e32_mpages ���
" e32_startobj �
" e32_eip ��
" e32_stackobj �
" $ e32_esp ��
" ( e32_pagesize �
" , e32_lastpagesize �
" 0 e32_fixupsize
" 4 e32_fixupsum �
" 8 e32_ldrsize ��
" < e32_ldrsum ���
" @ e32_objtab ���
" D e32_objcnt ���
" H e32_objmap ���
" L e32_itermap ��
" P e32_rsrctab ��
" T e32_rsrccnt ��
" X e32_restab ���
" \ e32_enttab ���
" ` e32_dirtab ���
" d e32_dircnt ���
" h e32_fpagetab �
" l e32_frectab ��
" p e32_impmod ���
" t e32_impmodcnt
" x e32_impproc ��
" | e32_pagesum ��
" � e32_datapage �
" � e32_preload ��
" � e32_nrestab ��
" � e32_cbnrestab
" � e32_nressum ��
" � e32_autodata �
" � e32_debuginfo
" � e32_debuglen �
" � e32_instpreload ��
" � e32_instdemand ���
" � e32_heapsize �
q � e32_res3 �
" � e32_winresoff
" � e32_winreslen
! � e32_devid
! � e32_ddkver ���> 3 +U � _IMAGE_VXD_HEADER .?AU_IMAGE_VXD_HEADER@@ ,U � | N � _WNF_DELIVERY_DESCRIPTOR .?AU_WNF_DELIVERY_DESCRIPTOR@@ ��
# SubscriptionId ���
^- StateName
" ChangeStamp ��
" StateDataSize
" EventMask
a- TypeId ���
" , StateDataOffset ��N /U 0 _WNF_DELIVERY_DESCRIPTOR .?AU_WNF_DELIVERY_DESCRIPTOR@@ �� 0U � 6
+
1# B � _FILE_FULL_DIR_INFO .?AU_FILE_FULL_DIR_INFO@@
4U &
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
| D FileName �B 6U H _FILE_FULL_DIR_INFO .?AU_FILE_FULL_DIR_INFO@@ 7U o �"
R
" dwType ���
" dwSize ���
hDevice ��
# wParam ���> :U tagRAWINPUTHEADER .?AUtagRAWINPUTHEADER@@ ;U :
kD " " � >U
?U
�9 J � _QUERY_SERVICE_CONFIGW .?AU_QUERY_SERVICE_CONFIGW@@ ��
BU �
" dwServiceType
" dwStartType ��
" dwErrorControl ���
q lpBinaryPathName �
q lpLoadOrderGroup �
" dwTagId ��
q ( lpDependencies ���
q 0 lpServiceStartName ���
q 8 lpDisplayName J DU @ _QUERY_SERVICE_CONFIGW .?AU_QUERY_SERVICE_CONFIGW@@ �� EU � ;
\$
6 *
Offset ���
# Length ���F IU _SCRUB_PARITY_EXTENT .?AU_SCRUB_PARITY_EXTENT@@ �� JU � ' t !
C f
BlendOp ��
BlendFlags ���
SourceConstantAlpha ��
AlphaFormat ��: NU _BLENDFUNCTION .?AU_BLENDFUNCTION@@ �� OU � F
�
)2
p7
�9
�$ 6
" PrivilegeCount ���
V? Privileges ���> VU _TOKEN_PRIVILEGES .?AU_TOKEN_PRIVILEGES@@ WU x � N � _KLDR_DATA_TABLE_ENTRY32 .?AU_KLDR_DATA_TABLE_ENTRY32@@ ��v
InLoadOrderLinks �
" __Undefined1 �
" __Undefined2 �
" __Undefined3 �
" NonPagedDebugInfo
" DllBase ��
" EntryPoint ���
" SizeOfImage ��
�) $ FullDllName ��
�) , BaseDllName ��
" 4 Flags
! 8 LoadCount
! : __Undefined5 �
" < __Undefined6 �
" @ CheckSum �
" D TimeDateStamp N ZU H _KLDR_DATA_TABLE_ENTRY32 .?AU_KLDR_DATA_TABLE_ENTRY32@@ �� [U � a
�C
. r � _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION .?AU_SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION@@ ��
_U &
HypervisorSharedUserVa ���r aU _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION .?AU_SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION@@ �� bU � D
�
,6 F � _T2_SET_PARAMETERS_V0 .?AU_T2_SET_PARAMETERS_V0@@ F
" Version ��
" Reserved �
NoWakeTolerance ��F gU _T2_SET_PARAMETERS_V0 .?AU_T2_SET_PARAMETERS_V0@@ hU � � N � _RTL_MODULE_EXTENDED_INFO .?AU_RTL_MODULE_EXTENDED_INFO@@ ^
p# BasicInfo
" ImageSize
! FileNameOffset ���
FullPathName �N kU _RTL_MODULE_EXTENDED_INFO .?AU_RTL_MODULE_EXTENDED_INFO@@ lU � � f � _SYSTEM_FEATURE_CONFIGURATION_UPDATE .?AU_SYSTEM_FEATURE_CONFIGURATION_UPDATE@@ ��
nU � " �j
# PreviousChangeStamp ��
V+ ConfigurationType
" UpdateCount ��
pU Updates ��f qU 0 _SYSTEM_FEATURE_CONFIGURATION_UPDATE .?AU_SYSTEM_FEATURE_CONFIGURATION_UPDATE@@ �� rU � j
B � _PERFINFO_IO_TIMER .?AU_PERFINFO_IO_TIMER@@ ��
uU 6
DeviceObject �
RoutineAddress ���B wU _PERFINFO_IO_TIMER .?AU_PERFINFO_IO_TIMER@@ �� xU c .
y Z � _WIM_PROVIDER_ADD_OVERLAY_INPUT .?AU_WIM_PROVIDER_ADD_OVERLAY_INPUT@@ b
" WimType ��
" WimIndex �
" WimFileNameOffset
" WimFileNameLength Z |U _WIM_PROVIDER_ADD_OVERLAY_INPUT .?AU_WIM_PROVIDER_ADD_OVERLAY_INPUT@@ }U � &"
55
�
�4 � �U # �U
�U
'N
�; J � _ETW_WNF_EVENT_PUBLISH .?AU_ETW_WNF_EVENT_PUBLISH@@ ��
�U B
j Header ���
� StateName
" ( DataLength ���J �U 0 _ETW_WNF_EVENT_PUBLISH .?AU_ETW_WNF_EVENT_PUBLISH@@ �� �U c {
O2
2N
f-
9
�+ v
" Marker ���
! Size �
Reserved �
Version ��
" Header ���
F Packet ���F �U _MESSAGE_TRACE_HEADER .?AU_MESSAGE_TRACE_HEADER@@ �U c �
� Z � _TOKEN_APPCONTAINER_INFORMATION .?AU_TOKEN_APPCONTAINER_INFORMATION@@
�U
TokenAppContainer Z �U _TOKEN_APPCONTAINER_INFORMATION .?AU_TOKEN_APPCONTAINER_INFORMATION@@ �U x !
�C Z � _SYSTEM_OBJECTTYPE_INFORMATION .?AU_SYSTEM_OBJECTTYPE_INFORMATION@@ ��
" NextEntryOffset ��
" NumberOfObjects ��
" NumberOfHandles ��
" TypeIndex
" InvalidAttributes
Q% GenericMapping ���
" $ ValidAccessMask ��
" ( PoolType �
, SecurityRequired �
- WaitableObject ���
0 TypeName �Z �U @ _SYSTEM_OBJECTTYPE_INFORMATION .?AU_SYSTEM_OBJECTTYPE_INFORMATION@@ �� �U � "
/T
R
TT
, 2 � _TP_DIRECT .?AU_TP_DIRECT@@ ��
�U � �U �? �U
�U �
� Task �
# Lock �
( IoCompletionInformationList ��
�U 8 Callback �
" @ NumaNode �
D IdealProcessor ���2 �U H _TP_DIRECT .?AU_TP_DIRECT@@ �� �U �
$# Z � _SYSTEM_PROCESS_TRUST_LABEL_ACE .?AU_SYSTEM_PROCESS_TRUST_LABEL_ACE@@
�U :
� Header ���
" Mask �
" SidStart �Z �U _SYSTEM_PROCESS_TRUST_LABEL_ACE .?AU_SYSTEM_PROCESS_TRUST_LABEL_ACE@@ �U x � : � tagICONMETRICSW .?AUtagICONMETRICSW@@
�U r
u cbSize ���
t iHorzSpacing �
t iVertSpacing �
t iTitleWrap ���
lfFont ���: �U l tagICONMETRICSW .?AUtagICONMETRICSW@@ �U .2
O;
F : � _CSV_MGMT_LOCK .?AU_CSV_MGMT_LOCK@@ ��
" Flags : �U _CSV_MGMT_LOCK .?AU_CSV_MGMT_LOCK@@ �� �U � ,
)$ 6 � _JUMP_BUFFER .?AU_JUMP_BUFFER@@ �� A " @ �"
# Frame
# Reserved �
# X19 ��
# X20 ��
# X21 ��
# ( X22 ��
# 0 X23 ��
# 8 X24 ��
# @ X25 ��
# H X26 ��
# P X27 ��
# X X28 ��
# ` Fp ���
# h Lr ���
# p Sp ���
u x Fpcr �
u | Fpsr �
�U � D 6 �U � _JUMP_BUFFER .?AU_JUMP_BUFFER@@ ��. onecore\external\sdk\inc\crt\setjmp.h �� �U �U �
�&
6?
� : � _STARTUPINFOEXA .?AU_STARTUPINFOEXA@@
�U 6
� StartupInfo ��
n! h lpAttributeList ��: �U p _STARTUPINFOEXA .?AU_STARTUPINFOEXA@@ �U o 1 > � _RTL_HANDLE_TABLE .?AU_RTL_HANDLE_TABLE@@
�& �
" MaximumNumberOfHandles ���
" SizeOfHandleTableEntry ���
" UseHeap ��
" TableSize
�U FreeHandles ��
�U CommittedHandles �
�U UnCommittedHandles ���
�U ( MaxReservedHandles ���> �U 0 _RTL_HANDLE_TABLE .?AU_RTL_HANDLE_TABLE@@ �U � �
�
x,
9= N � _RTL_PHYSICAL_MEMORY_INFO .?AU_RTL_PHYSICAL_MEMORY_INFO@@
�U
� Policy ���N �U _RTL_PHYSICAL_MEMORY_INFO .?AU_RTL_PHYSICAL_MEMORY_INFO@@ �U
�F
�3 f � _JOBOBJECT_IO_ATTRIBUTION_INFORMATION .?AU_JOBOBJECT_IO_ATTRIBUTION_INFORMATION@@ F
" ControlFlags �
�" ReadStats
�" ( WriteStats ���f �U H _JOBOBJECT_IO_ATTRIBUTION_INFORMATION .?AU_JOBOBJECT_IO_ATTRIBUTION_INFORMATION@@ �U ? �
�D
~4 b � _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY@@
�U �
" BeginAddress �
" EndAddress ���
" ExceptionHandler �
" HandlerData ��
" PrologEndAddress �b �U _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY@@ �U � +
�1 > � _KTMOBJECT_CURSOR .?AU_KTMOBJECT_CURSOR@@ B
LastQuery
" ObjectIdCount
� ObjectIds > �U $ _KTMOBJECT_CURSOR .?AU_KTMOBJECT_CURSOR@@ �U � � 2 � HRAWINPUT__ .?AUHRAWINPUT__@@
t unused ���2 �U HRAWINPUT__ .?AUHRAWINPUT__@@ �U �9
F J � _WRITE_USN_REASON_INPUT .?AU_WRITE_USN_REASON_INPUT@@ .
" Flags
" UsnReasonToWrite �J �U _WRITE_USN_REASON_INPUT .?AU_WRITE_USN_REASON_INPUT@@ �U � � B � _PS_STD_HANDLE_INFO .?AU_PS_STD_HANDLE_INFO@@
" ��
" ��n
" Flags
�U StdHandleState ���
�U PseudoHandleMask �
" StdHandleSubsystemType ���B �U _PS_STD_HANDLE_INFO .?AU_PS_STD_HANDLE_INFO@@ �U � M > � _QUOTA_LIMITS_EX .?AU_QUOTA_LIMITS_EX@@ ��&
# PagedPoolLimit ���
# NonPagedPoolLimit
# MinimumWorkingSetSize
# MaximumWorkingSetSize
# PagefileLimit
� ( TimeLimit
# 0 WorkingSetLimit ��
# 8 Reserved2
# @ Reserved3
# H Reserved4
" P Flags
u< T CpuRateLimit �> �U X _QUOTA_LIMITS_EX .?AU_QUOTA_LIMITS_EX@@ �� �U ? � > � _IMAGE_RELOCATION .?AU_IMAGE_RELOCATION@@ b
" VirtualAddress ���
" RelocCount ���
" SymbolTableIndex �
! Type �> �U
_IMAGE_RELOCATION .?AU_IMAGE_RELOCATION@@ V � u
�$ . � in6_addr .?AUin6_addr@@ ��B � _WMI_WAIT_MULTIPLE .?AU_WMI_WAIT_MULTIPLE@@ ��J � _WMI_WAIT_OBJECT_RECORD .?AU_WMI_WAIT_OBJECT_RECORD@@ V " �Z
" ThreadId �
WaitType �
ObjectCount ��
V ObjectRecord �B V _WMI_WAIT_MULTIPLE .?AU_WMI_WAIT_MULTIPLE@@ �� V c �
#+
�1 j � _FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER .?AU_FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER@@ ��
� FileOffset ���
� ByteCount
RecallOwnerGuid ��
" RecallMetadataBufferSize �
� $ RecallMetadataBuffer �j
V ( _FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER .?AU_FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER@@ �� V � o* B � _REPARSE_INDEX_KEY .?AU_REPARSE_INDEX_KEY@@ ��
V 2
" FileReparseTag ���
� FileId ���B V _REPARSE_INDEX_KEY .?AU_REPARSE_INDEX_KEY@@ �� V � (& B
Status ���
Pointer ��
# Information ��> V _IO_STATUS_BLOCK .?AU_IO_STATUS_BLOCK@@ �� V � �
;"
F : � _WMI_IRQ_RECORD .?AU_WMI_IRQ_RECORD@@ �
# IRQAffinity ��
! IRQGroup �
!
Reserved �
" IRQNum ���
" DeviceDescriptionLen �
| DeviceDescription : V _WMI_IRQ_RECORD .?AU_WMI_IRQ_RECORD@@ V c �
�, 6 � _GLYPHMETRICS .?AU_GLYPHMETRICS@@
V ~
u gmBlackBoxX ��
u gmBlackBoxY ��
� gmptGlyphOrigin ��
gmCellIncX ���
gmCellIncY ���6 !V _GLYPHMETRICS .?AU_GLYPHMETRICS@@ "V � w
V � _SYSTEM_EXCEPTION_INFORMATION .?AU_SYSTEM_EXCEPTION_INFORMATION@@
$V �
" AlignmentFixupCount ��
" ExceptionDispatchCount ���
" FloatingEmulationCount ���
" ByteWordEmulationCount ���V &V _SYSTEM_EXCEPTION_INFORMATION .?AU_SYSTEM_EXCEPTION_INFORMATION@@ 'V � �
�1
5,
V
uE
�+ ��
-V >
Id ���
�: Type �
# MaxVersionTested �Z /V _COMPATIBILITY_CONTEXT_ELEMENT .?AU_COMPATIBILITY_CONTEXT_ELEMENT@@ �� 0V � �
�E
�7 N � _ETW_KQUEUE_ENQUEUE_EVENT .?AU_ETW_KQUEUE_ENQUEUE_EVENT@@ &
Entry
" ThreadId �N 5V _ETW_KQUEUE_ENQUEUE_EVENT .?AU_ETW_KQUEUE_ENQUEUE_EVENT@@ 6V c �
�> Z � _KEY_VIRTUALIZATION_INFORMATION .?AU_KEY_VIRTUALIZATION_INFORMATION@@
9V
" ��
" ��
" ��
" ��
" ��
" ��
;V VirtualizationCandidate ��
<V VirtualizationEnabled
=V VirtualTarget
>V VirtualStore �
?V VirtualSource
@V Reserved �Z AV _KEY_VIRTUALIZATION_INFORMATION .?AU_KEY_VIRTUALIZATION_INFORMATION@@ BV �
�8 N � _FILE_FULL_EA_INFORMATION .?AU_FILE_FULL_EA_INFORMATION@@ r
" NextEntryOffset ��
Flags
EaNameLength �
! EaValueLength
EaName ���N FV _FILE_FULL_EA_INFORMATION .?AU_FILE_FULL_EA_INFORMATION@@ GV � �
\A
�8
�T ��
LV Z � _RTL_PROCESS_BACKTRACES_CONTROL .?AU_RTL_PROCESS_BACKTRACES_CONTROL@@
NV f
" ControlCode ��
" ControlSize ��
� ControlData ��
� DatabaseCreate ���Z PV _RTL_PROCESS_BACKTRACES_CONTROL .?AU_RTL_PROCESS_BACKTRACES_CONTROL@@ QV � R � _REPARSE_POINT_INFORMATION .?AU_REPARSE_POINT_INFORMATION@@ ��>
! ReparseDataLength
! UnparsedNameLength ���R TV _REPARSE_POINT_INFORMATION .?AU_REPARSE_POINT_INFORMATION@@ �� UV @!
< B � tagEMRCREATEPALETTE .?AUtagEMRCREATEPALETTE@@
XV 2
� emr ��
" ihPal
�; lgpl �B ZV tagEMRCREATEPALETTE .?AUtagEMRCREATEPALETTE@@ [V � F
MD
�
M b � _SYSTEM_MEMORY_TOPOLOGY_INFORMATION .?AU_SYSTEM_MEMORY_TOPOLOGY_INFORMATION@@ �. " �^
# NumberOfRuns �
" NumberOfNodes
" NumberOfChannels �
aV Run ��b bV 0 _SYSTEM_MEMORY_TOPOLOGY_INFORMATION .?AU_SYSTEM_MEMORY_TOPOLOGY_INFORMATION@@ cV t V � _CM_DISK_GEOMETRY_DEVICE_DATA .?AU_CM_DISK_GEOMETRY_DEVICE_DATA@@ n
" BytesPerSector ���
" NumberOfCylinders
" SectorsPerTrack ��
" NumberOfHeads V fV _CM_DISK_GEOMETRY_DEVICE_DATA .?AU_CM_DISK_GEOMETRY_DEVICE_DATA@@ gV 2 N � _SECURITY_SEED_AND_LENGTH .?AU_SECURITY_SEED_AND_LENGTH@@
iV &
Length ���
Seed �N kV _SECURITY_SEED_AND_LENGTH .?AU_SECURITY_SEED_AND_LENGTH@@ lV � �
�
q
oV V � _IMAGE_RESOURCE_DIR_STRING_U .?AU_IMAGE_RESOURCE_DIR_STRING_U@@ ��.
! Length ���
| NameString ���V rV _IMAGE_RESOURCE_DIR_STRING_U .?AU_IMAGE_RESOURCE_DIR_STRING_U@@ �� sV � l B � _EXCEPTION_RECORD32 .?AU_EXCEPTION_RECORD32@@ " " < �
ExceptionCode
" ExceptionFlags ���
" ExceptionRecord ��
" ExceptionAddress �
" NumberParameters �
vV ExceptionInformation �B wV P _EXCEPTION_RECORD32 .?AU_EXCEPTION_RECORD32@@ xV �% X F � _PERFINFO_MARK_EVENT .?AU_PERFINFO_MARK_EVENT@@ ��
zV V
" TranId ���
Level
AppId
! OpId �
| Text �F |V _PERFINFO_MARK_EVENT .?AU_PERFINFO_MARK_EVENT@@ �� }V c � J � _FILE_END_OF_FILE_INFO .?AU_FILE_END_OF_FILE_INFO@@ ��
� EndOfFile J �V _FILE_END_OF_FILE_INFO .?AU_FILE_END_OF_FILE_INFO@@ �� �V o �"
�$
�G : � HGESTUREINFO__ .?AUHGESTUREINFO__@@ ��
�V
t unused ���: �V HGESTUREINFO__ .?AUHGESTUREINFO__@@ �� �V �<
p " �V �V
>2
S > � tagMONITORINFOEXW .?AUtagMONITORINFOEXW@@
�V f
" cbSize ���
! rcMonitor
! rcWork ���
" $ dwFlags ��
( szDevice �> �V h tagMONITORINFOEXW .?AUtagMONITORINFOEXW@@ �V 5
�#
LC j
Revision �
SubAuthorityCount
�, IdentifierAuthority ��
� SubAuthority �& �V _SID .?AU_SID@@ �� �V x V � _ETW_COVERAGE_SAMPLER_SAMPLE .?AU_ETW_COVERAGE_SAMPLER_SAMPLE@@ ��*
" ModuleId �
" Offset ���V �V _ETW_COVERAGE_SAMPLER_SAMPLE .?AU_ETW_COVERAGE_SAMPLER_SAMPLE@@ �� �V A G
�! N � _SYSTEM_WORKINGSET_ENTRY .?AU_SYSTEM_WORKINGSET_ENTRY@@ ��
�V �
" UniqueProcessId ��
" SessionId
# WorkingSetPageCount ��
# CommitPageCount ��
# PagedPoolPageCount ���
# VirtualSizeInPages ���
# PrivateWorkingSetPageCount ���N �V ( _SYSTEM_WORKINGSET_ENTRY .?AU_SYSTEM_WORKINGSET_ENTRY@@ �� �V � � n � _FILE_PROCESS_IDS_USING_FILE_INFORMATION .?AU_FILE_PROCESS_IDS_USING_FILE_INFORMATION@@ ��>
" NumberOfProcessIdsInList �
�# ProcessIdList n �V _FILE_PROCESS_IDS_USING_FILE_INFORMATION .?AU_FILE_PROCESS_IDS_USING_FILE_INFORMATION@@ �� �V � V � _TXFS_CREATE_MINIVERSION_INFO .?AU_TXFS_CREATE_MINIVERSION_INFO@@ j
! StructureVersion �
! StructureLength ��
" BaseVersion ��
! MiniVersion ��V �V _TXFS_CREATE_MINIVERSION_INFO .?AU_TXFS_CREATE_MINIVERSION_INFO@@ �V � B � _SUPPORTED_OS_INFO .?AU_SUPPORTED_OS_INFO@@ ��
�V 2
! MajorVersion �
! MinorVersion �B �V _SUPPORTED_OS_INFO .?AU_SUPPORTED_OS_INFO@@ �� �V � �
" Version ��
" Flags
ResourceFileName �
! ResourceReasonId �
" StringCount ��
v ReasonStrings
SimpleString �J �V ( _COUNTED_REASON_CONTEXT .?AU_COUNTED_REASON_CONTEXT@@ �V x
j7 "
Base �
" Size �> �V _PORT_DATA_ENTRY .?AU_PORT_DATA_ENTRY@@ �� �V � U � # t t t �V
�V
�U
�(
D
> Z � _PERFINFO_SET_POWER_ACTION_RET .?AU_PERFINFO_SET_POWER_ACTION_RET@@ ��*
Trigger ��
Status ���Z �V _PERFINFO_SET_POWER_ACTION_RET .?AU_PERFINFO_SET_POWER_ACTION_RET@@ �� �V c O
�&
+ V � _EVENT_EXTENDED_ITEM_INSTANCE .?AU_EVENT_EXTENDED_ITEM_INSTANCE@@ N
" InstanceId ���
" ParentInstanceId �
ParentGuid ���V �V _EVENT_EXTENDED_ITEM_INSTANCE .?AU_EVENT_EXTENDED_ITEM_INSTANCE@@ �V V Z ^ � _SYSTEM_MANUFACTURING_INFORMATION .?AU_SYSTEM_MANUFACTURING_INFORMATION@@ .
" Options ��
ProfileName ��^ �V _SYSTEM_MANUFACTURING_INFORMATION .?AU_SYSTEM_MANUFACTURING_INFORMATION@@ �V � ~
� B
# Alignment
# Region ���
�K HeaderArm64 ��. �V _SLIST_HEADER .?AT_SLIST_HEADER@@ �V b r
�
�V
J% Z � _PROCESS_MITIGATION_DEP_POLICY .?AU_PROCESS_MITIGATION_DEP_POLICY@@ ��
�V
" ��
" ��
" ��v
" Flags
�V Enable ���
�V DisableAtlThunkEmulation �
�V ReservedFlags
Permanent Z �V _PROCESS_MITIGATION_DEP_POLICY .?AU_PROCESS_MITIGATION_DEP_POLICY@@ �� �V ? L
6
)A
rA
� b � _STREAMS_ASSOCIATE_ID_INPUT_BUFFER .?AU_STREAMS_ASSOCIATE_ID_INPUT_BUFFER@@ ��&
" Flags
" StreamId �b �V _STREAMS_ASSOCIATE_ID_INPUT_BUFFER .?AU_STREAMS_ASSOCIATE_ID_INPUT_BUFFER@@ �� �V � � Z � _EVENT_EXTENDED_ITEM_EVENT_KEY .?AU_EVENT_EXTENDED_ITEM_EVENT_KEY@@ ��
# Key ��Z �V _EVENT_EXTENDED_ITEM_EVENT_KEY .?AU_EVENT_EXTENDED_ITEM_EVENT_KEY@@ �� �V V ~
;R
�
� �
� �
� R � _PERFINFO_MARK_INFORMATION .?AU_PERFINFO_MARK_INFORMATION@@ ��
l Name �R �V _PERFINFO_MARK_INFORMATION .?AU_PERFINFO_MARK_INFORMATION@@ �� �V c J
� F � tagHARDWAREHOOKSTRUCT .?AUtagHARDWAREHOOKSTRUCT@@
�V N
� hwnd �
u message ��
# wParam ���
lParam ���F �V tagHARDWAREHOOKSTRUCT .?AUtagHARDWAREHOOKSTRUCT@@ �V � R � _WIM_PROVIDER_EXTERNAL_INFO .?AU_WIM_PROVIDER_EXTERNAL_INFO@@
�V V
" Version ��
" Flags
� DataSourceId �
� ResourceHash �R �V ( _WIM_PROVIDER_EXTERNAL_INFO .?AU_WIM_PROVIDER_EXTERNAL_INFO@@ �V � " �
hFile
lpBaseOfDll ��
" dwDebugInfoFileOffset
" nDebugInfoSize ���
lpImageName ��
! fUnicode �F �V ( _LOAD_DLL_DEBUG_INFO .?AU_LOAD_DLL_DEBUG_INFO@@ �� �V � P f � _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH .?AU_ETW_TP_EVENT_WORKER_NUMANODE_SWITCH@@ ��
W �
j Header ���
PoolId ���
" ( CurrentNode ��
" , NextNode �
! 0 CurrentGroup �
! 2 NextGroup
" 4 CurrentWorkerCount ���
" 8 NextWorkerCount ��f W @ _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH .?AU_ETW_TP_EVENT_WORKER_NUMANODE_SWITCH@@ �� W c
�5 �
# Size �
�@ CallerType ���
# ProcessImageNameOffset ���
" ProcessId
" ServiceTag ���
# DeviceDescriptionOffset ��
# DevicePathOffset �
# ReasonOffset �B W ( _DIAGNOSTIC_BUFFER .?AU_DIAGNOSTIC_BUFFER@@ �� W x � B � _TOKEN_LINKED_TOKEN .?AU_TOKEN_LINKED_TOKEN@@
LinkedToken ��B W _TOKEN_LINKED_TOKEN .?AU_TOKEN_LINKED_TOKEN@@ W x �
�F
6>
�' " " p t W
W " � �T t W
W
T
S
� C C W V � _PS_BNO_ISOLATION_PARAMETERS .?AU_PS_BNO_ISOLATION_PARAMETERS@@ ��
W f
IsolationPrefix ��
" HandleCount ��
[ Handles ��
IsolationEnabled �V W ( _PS_BNO_ISOLATION_PARAMETERS .?AU_PS_BNO_ISOLATION_PARAMETERS@@ �� W � �
$" " t "W
#W
. �
&W
4
# ��
# 0 ��
# 9��F
)W DontUse ��
*W PageDirectoryBase
+W Reserved �F ,W _PAGEDIR_INFORMATION .?AU_PAGEDIR_INFORMATION@@ �� -W t
m
0W " v 1W 2W
3W
�,
" ��
6W ! �/ f � _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE@@ " �6
" SubscriptionCount
:W Subscriptions f ;W _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE@@ <W � f � _SYSTEM_PROCESS_INFORMATION_EXTENSION .?AU_SYSTEM_PROCESS_INFORMATION_EXTENSION@@
" ��
" ��
" ��
" ��
DiskCounters �
# ( ContextSwitches ��
" 0 Flags
?W 0 HasStrongId ��
@W 0 Classification ���
AW 0 BackgroundActivityModerated ��
BW 0 Spare
" 4 UserSidOffset
" 8 PackageFullNameOffset
{( @ EnergyValues �
" PAppIdOffset ��
# XSharedCommitCharge ���
" `JobObjectId ��
" dSpareUlong ���
# hProcessSequenceNumber f CW p_SYSTEM_PROCESS_INFORMATION_EXTENSION .?AU_SYSTEM_PROCESS_INFORMATION_EXTENSION@@ DW � * Z � _PERFINFO_SAMPLED_PROFILE_CACHE .?AU_PERFINFO_SAMPLED_PROFILE_CACHE@@ a* " @ �*
" Entries ��
GW Sample ���Z HW H_PERFINFO_SAMPLED_PROFILE_CACHE .?AU_PERFINFO_SAMPLED_PROFILE_CACHE@@ IW c � V � _ETW_CRITSEC_EVENT_COLLISION .?AU_ETW_CRITSEC_EVENT_COLLISION@@ ��j
j Header ���
" LockCount
" $ SpinCount
( OwningThread �
0 Address ��V LW 8 _ETW_CRITSEC_EVENT_COLLISION .?AU_ETW_CRITSEC_EVENT_COLLISION@@ �� MW c �
v! � � PW
\/
f SW N � _SERVICE_FAILURE_ACTIONSW .?AU_SERVICE_FAILURE_ACTIONSW@@
UW r
" dwResetPeriod
q lpRebootMsg ��
q lpCommand
" cActions �
n lpsaActions ��N WW ( _SERVICE_FAILURE_ACTIONSW .?AU_SERVICE_FAILURE_ACTIONSW@@ XW � $ b � _RTL_DYNAMIC_TIME_ZONE_INFORMATION .?AU_RTL_DYNAMIC_TIME_ZONE_INFORMATION@@ ��
ZW V
U tzi ��
�$ � TimeZoneKeyName ��
�DynamicDaylightTimeDisabled ��b \W �_RTL_DYNAMIC_TIME_ZONE_INFORMATION .?AU_RTL_DYNAMIC_TIME_ZONE_INFORMATION@@ �� ]W �
f< b � _RTL_IMAGE_MITIGATION_SEHOP_POLICY .?AU_RTL_IMAGE_MITIGATION_SEHOP_POLICY@@ ��
� Sehop b aW _RTL_IMAGE_MITIGATION_SEHOP_POLICY .?AU_RTL_IMAGE_MITIGATION_SEHOP_POLICY@@ �� bW
`/ ��
dW
eW 6
! MethodCount ��
fW MethodProperties �^ gW _MIDL_INTERFACE_METHOD_PROPERTIES .?AU_MIDL_INTERFACE_METHOD_PROPERTIES@@ hW � g Z � _EXTENT_READ_CACHE_INFO_BUFFER .?AU_EXTENT_READ_CACHE_INFO_BUFFER@@ ��R
� AllocatedCache ���
� PopulatedCache ���
� InErrorCache �Z kW _EXTENT_READ_CACHE_INFO_BUFFER .?AU_EXTENT_READ_CACHE_INFO_BUFFER@@ �� lW � �)
>< f l oW F � _PERFINFO_DEBUG_EVENT .?AU_PERFINFO_DEBUG_EVENT@@ >
" ProcessId
" ThreadId �
� Reason ���F rW _PERFINFO_DEBUG_EVENT .?AU_PERFINFO_DEBUG_EVENT@@ sW c
�= : � _SL_KMEM_CACHE .?AU_SL_KMEM_CACHE@@ ��
vW
H " �
" TotalSize
" SizeOfData ���
" SignatureSize
" Flags
" Version ��
xW Descriptors ��: yW ( _SL_KMEM_CACHE .?AU_SL_KMEM_CACHE@@ �� zW � u
�/
�@
GT ��
~W
lE �"
� J � _POWER_SESSION_CONNECT .?AU_POWER_SESSION_CONNECT@@ ��
�W *
Connected
Console ��J �W _POWER_SESSION_CONNECT .?AU_POWER_SESSION_CONNECT@@ �� �W x � r � _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER .?AU_RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER@@ n
! Version ��
! PointerSize ��
# Heap �
# TotalCommit ��
# TotalReserve �r �W _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER .?AU_RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER@@ �W � q ^ � _SYSTEM_LEGACY_DRIVER_INFORMATION .?AU_SYSTEM_LEGACY_DRIVER_INFORMATION@@
�W *
" VetoType �
VetoList �^ �W _SYSTEM_LEGACY_DRIVER_INFORMATION .?AU_SYSTEM_LEGACY_DRIVER_INFORMATION@@ �W � �
�@
F- ^ � _PROCESS_DEVICEMAP_INFORMATION_EX .?AU_PROCESS_DEVICEMAP_INFORMATION_EX@@ 2
aP Set ��
^P Query
" ( Flags ^ �W 0 _PROCESS_DEVICEMAP_INFORMATION_EX .?AU_PROCESS_DEVICEMAP_INFORMATION_EX@@ �W ? #
S F � _EVENT_TRACE_LOGFILEW .?AU_EVENT_TRACE_LOGFILEW@@
�W
�W " �W
�W
)< ��
�W
KW
Z/
�F b � _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER .?AU_FILE_QUERY_ON_DISK_VOL_INFO_BUFFER@@ q " D �B
� DirectoryCount ���
� FileCount
! FsFormatMajVersion ���
! FsFormatMinVersion ���
� FsFormatName �
� 0 FormatTime ���
� 8 LastUpdateTime ���
�W @ CopyrightInfo
�W � AbstractInfo �
�W � FormattingImplementationInfo �
�W LastModifyingImplementationInfo ��b �W P_FILE_QUERY_ON_DISK_VOL_INFO_BUFFER .?AU_FILE_QUERY_ON_DISK_VOL_INFO_BUFFER@@ �W � >
�8
G6
�1 J � tagLAYERPLANEDESCRIPTOR .?AUtagLAYERPLANEDESCRIPTOR@@ .
! nSize
! nVersion �
" dwFlags ��
iPixelType ���
cColorBits ���
cRedBits �
cRedShift
cGreenBits ���
cGreenShift ��
cBlueBits
cBlueShift ���
cAlphaBits ���
cAlphaShift ��
cAccumBits ���
cAccumRedBits
cAccumGreenBits ��
cAccumBlueBits ���
cAccumAlphaBits ��
cDepthBits ���
cStencilBits �
cAuxBuffers ��
iLayerPlane ��
bReserved
" crTransparent J �W tagLAYERPLANEDESCRIPTOR .?AUtagLAYERPLANEDESCRIPTOR@@ �W � j �R
�1 ��
�W � S �W t t �W
�W : � IRpcStubBuffer .?AUIRpcStubBuffer@@ ��6 � _IMAGE_SYMBOL .?AU_IMAGE_SYMBOL@@ ~
"R N
" Value
SectionNumber
! Type �
StorageClass �
NumberOfAuxSymbols ���6 �W _IMAGE_SYMBOL .?AU_IMAGE_SYMBOL@@ �W � e
��
�W
��
�W �W �W " t �W
�W
�B V
Buffer ���
StaticBuffer �
# Size �
# StaticSize ���2 �W _RTL_BUFFER .?AU_RTL_BUFFER@@ �W �B r
B'
C N � _FILE_STORAGE_TIER_REGION .?AU_FILE_STORAGE_TIER_REGION@@
�W >
TierId ���
# Offset ���
# Length ���N �W _FILE_STORAGE_TIER_REGION .?AU_FILE_STORAGE_TIER_REGION@@ �W � � # �W �W
�7
�0
\> V � _SECTION_IMAGE_INFORMATION64 .?AU_SECTION_IMAGE_INFORMATION64@@ ��
��
��
��n
# TransferAddress ��
" ZeroBits �
# MaximumStackSize �
# CommittedStackSize ���
" SubSystemType
! $ SubSystemMinorVersion
! & SubSystemMajorVersion
" $ SubSystemVersion �
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
" ( OperatingSystemVersion ���
! , ImageCharacteristics �
! . DllCharacteristics ���
! 0 Machine ��
2 ImageContainsCode
3 ImageFlags ���
�W 3 ComPlus ��
�W 3 ImageDynamicallyRelocated
�W 3 Reserved �
" 4 LoaderFlags ��
" 8 ImageFileSize
" < CheckSum �V �W @ _SECTION_IMAGE_INFORMATION64 .?AU_SECTION_IMAGE_INFORMATION64@@ �� �W t �
�(
�E : � _TOKEN_CONTROL .?AU_TOKEN_CONTROL@@ ��
�W b
� TokenId ��
� AuthenticationId �
� ModifiedId ���
�6 TokenSource ��: �W ( _TOKEN_CONTROL .?AU_TOKEN_CONTROL@@ �� �W x R � _SYSTEM_POWER_LOGGING_ENTRY .?AU_SYSTEM_POWER_LOGGING_ENTRY@@ *
" Reason ���
" States ���R �W _SYSTEM_POWER_LOGGING_ENTRY .?AU_SYSTEM_POWER_LOGGING_ENTRY@@ �W x y
�9
;8
fU
�)
�C
"
! �< � �W t �W
�W B � tagUSAGE_PROPERTIES .?AUtagUSAGE_PROPERTIES@@ �
! level
! page �
! usage
t logicalMinimum ���
t logicalMaximum ���
! unit �
! exponent �
count
t physicalMinimum ��
t physicalMaximum ��B
�W tagUSAGE_PROPERTIES .?AUtagUSAGE_PROPERTIES@@ �W ;
8'
�<
e#
S
."
�. j � _CLAIM_SECURITY_ATTRIBUTES_INFORMATION .?AU_CLAIM_SECURITY_ATTRIBUTES_INFORMATION@@ ��Z
! Version ��
! Reserved �
" AttributeCount ���
�Q Attribute j �W _CLAIM_SECURITY_ATTRIBUTES_INFORMATION .?AU_CLAIM_SECURITY_ATTRIBUTES_INFORMATION@@ �� �W x
0 - �W
�C
8
�;
�"
�V
�/ Z � _IMAGE_BOUND_IMPORT_DESCRIPTOR .?AU_IMAGE_BOUND_IMPORT_DESCRIPTOR@@ ��
X ^
" TimeDateStamp
! OffsetModuleName �
! NumberOfModuleForwarderRefs ��Z X _IMAGE_BOUND_IMPORT_DESCRIPTOR .?AU_IMAGE_BOUND_IMPORT_DESCRIPTOR@@ �� X � � V � _ENCLAVE_LOAD_DATA_VBS_BASIC .?AU_ENCLAVE_LOAD_DATA_VBS_BASIC@@ ��
X
" PageType �V X _ENCLAVE_LOAD_DATA_VBS_BASIC .?AU_ENCLAVE_LOAD_DATA_VBS_BASIC@@ �� X � �
o5 .
# ImageBase
� FunctionEntry R X _UNWIND_HISTORY_TABLE_ENTRY .?AU_UNWIND_HISTORY_TABLE_ENTRY@@ X � � Z � _FILE_PROVIDER_EXTERNAL_INFO_V0 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V0@@
X *
" Version ��
" Algorithm Z X _FILE_PROVIDER_EXTERNAL_INFO_V0 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V0@@ X � x" ^ � _FILE_DISPOSITION_INFORMATION_EX .?AU_FILE_DISPOSITION_INFORMATION_EX@@ ��
X
" Flags ^ X _FILE_DISPOSITION_INFORMATION_EX .?AU_FILE_DISPOSITION_INFORMATION_EX@@ �� X � �
�W J � _FILE_QUOTA_INFORMATION .?AU_FILE_QUOTA_INFORMATION@@ �
" NextEntryOffset ��
" SidLength
� ChangeTime ���
� QuotaUsed
� QuotaThreshold ���
� QuotaLimit ���
T ( Sid ��J X 8 _FILE_QUOTA_INFORMATION .?AU_FILE_QUOTA_INFORMATION@@ X � � N � _PERFINFO_CC_FLUSH_CACHE .?AU_PERFINFO_CC_FLUSH_CACHE@@ ��
# WorkItemKey ��
# FileObjectKey
# Offset ���
" Length ���
" SharedCacheMapFlags ��
" Flags
" $ Reserved �N "X ( _PERFINFO_CC_FLUSH_CACHE .?AU_PERFINFO_CC_FLUSH_CACHE@@ �� #X c �
�$ � *D
�*
�=
�0 � JOB_OBJECT_NET_RATE_CONTROL_ENABLE ��� JOB_OBJECT_NET_RATE_CONTROL_MAX_BANDWIDTH JOB_OBJECT_NET_RATE_CONTROL_DSCP_TAG � JOB_OBJECT_NET_RATE_CONTROL_VALID_FLAGS ��Z t *X JOB_OBJECT_NET_RATE_CONTROL_FLAGS .?AW4JOB_OBJECT_NET_RATE_CONTROL_FLAGS@@ � +X ? )
� .
" VirtualAddress ���
" Size �F .X _IMAGE_DATA_DIRECTORY .?AU_IMAGE_DATA_DIRECTORY@@ /X �
�
�R B � _WOF_EXTERNAL_INFO .?AU_WOF_EXTERNAL_INFO@@ ��*
" Version ��
" Provider �B 4X _WOF_EXTERNAL_INFO .?AU_WOF_EXTERNAL_INFO@@ �� 5X � �!
{;
�
�F � � � :X
�; q " t =X
>X f � _SYSTEM_BASIC_PERFORMANCE_INFORMATION .?AU_SYSTEM_BASIC_PERFORMANCE_INFORMATION@@
@X n
# AvailablePages ���
# CommittedPages ���
# CommitLimit ��
# PeakCommitment ���f BX _SYSTEM_BASIC_PERFORMANCE_INFORMATION .?AU_SYSTEM_BASIC_PERFORMANCE_INFORMATION@@ CX � �
+
�.
l6
�G
K
�U ��
JX
> " " MX
NX
�?
e)
Z � DISPLAYCONFIG_TARGET_BASE_TYPE .?AUDISPLAYCONFIG_TARGET_BASE_TYPE@@ ��6
header ���
�$ baseOutputTechnology �Z TX DISPLAYCONFIG_TARGET_BASE_TYPE .?AUDISPLAYCONFIG_TARGET_BASE_TYPE@@ �� UX � ( �
WX
"
i; �M
�@ ��
\X
�
�6 V � _TRACE_ENABLE_FLAG_EXT_HEADER .?AU_TRACE_ENABLE_FLAG_EXT_HEADER@@ &
! Length ���
! Items V aX _TRACE_ENABLE_FLAG_EXT_HEADER .?AU_TRACE_ENABLE_FLAG_EXT_HEADER@@ bX c
o+
eX
yB Z � WIN32_MEMORY_REGION_INFORMATION .?AUWIN32_MEMORY_REGION_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��&
AllocationBase ���
" AllocationProtect
" Flags
iX Private ��
jX MappedDataFile ���
kX MappedImage ��
lX MappedPageFile ���
mX MappedPhysical ���
nX DirectMapped �
oX Reserved �
# RegionSize ���
# CommitSize ���Z pX WIN32_MEMORY_REGION_INFORMATION .?AUWIN32_MEMORY_REGION_INFORMATION@@ qX � �
�<
k-
4 B � tagAUDIODESCRIPTION .?AUtagAUDIODESCRIPTION@@ >
u cbSize ���
t Enabled ��
" Locale ���B wX tagAUDIODESCRIPTION .?AUtagAUDIODESCRIPTION@@ xX q4 J � _MESSAGE_RESOURCE_DATA .?AU_MESSAGE_RESOURCE_DATA@@ �� � " �2
" NumberOfBlocks ���
{X Blocks ���J |X _MESSAGE_RESOURCE_DATA .?AU_MESSAGE_RESOURCE_DATA@@ �� }X b �
�W
�?
R � _FILE_ZERO_DATA_INFORMATION .?AU_FILE_ZERO_DATA_INFORMATION@@ 6
� FileOffset ���
� BeyondFinalZero ��R �X _FILE_ZERO_DATA_INFORMATION .?AU_FILE_ZERO_DATA_INFORMATION@@ �X � �
�
3
�S
�B
�4
AA
7
�G
�B
>?
FW
�
V ��
�X
�B
�8
,'
�W �
q LogFileName ��
q LoggerName ���
CurrentTime ��
" BuffersRead ��
" LogFileMode ��
" ProcessTraceMode �
= CurrentEvent �
: x LogfileHeader
�X �BufferCallback ���
" �BufferSize ���
" �Filled ���
" �EventsLost ���
= �EventCallback
= �EventRecordCallback ��
" �IsKernelTrace
�Context ��F �X �_EVENT_TRACE_LOGFILEW .?AU_EVENT_TRACE_LOGFILEW@@ �X � k
�U
�;
�'
� � _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION@@ ��
�X
�3
E 2
�X Attributes ���
�X Operations ��� �X _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION@@ �� �X � 6 J � _VCN_RANGE_INPUT_BUFFER .?AU_VCN_RANGE_INPUT_BUFFER@@
�X 2
� StartingVcn ��
� ClusterCount �J �X _VCN_RANGE_INPUT_BUFFER .?AU_VCN_RANGE_INPUT_BUFFER@@ �X � �) �=
� V � _SYSTEM_LOOKASIDE_INFORMATION .?AU_SYSTEM_LOOKASIDE_INFORMATION@@
�X �
! CurrentDepth �
! MaximumDepth �
" TotalAllocates ���
" AllocateMisses ���
" TotalFrees ���
" FreeMisses ���
" Type �
" Tag ��
" Size �V �X _SYSTEM_LOOKASIDE_INFORMATION .?AU_SYSTEM_LOOKASIDE_INFORMATION@@ �X � �
{U
+
N#
1,
�&
I9 N
# StartingFileReferenceNumber ��
# EndingFileReferenceNumber F �X _FILE_REFERENCE_RANGE .?AU_FILE_REFERENCE_RANGE@@ �X � �
t unused ���2 �X HINSTANCE__ .?AUHINSTANCE__@@ �X �' �
�> � � � �X 2 � value_entW .?AUvalue_entW@@ ��
�X ^
q ve_valuename �
" ve_valuelen ��
# ve_valueptr ��
" ve_type ��2 �X value_entW .?AUvalue_entW@@ �� �X � �
4 N � _PERFINFO_VAD_ROTATE_INFO .?AU_PERFINFO_VAD_ROTATE_INFO@@
�X
" ��
" ��f
BaseAddress ��
# SizeInBytes ��
�X Direction
�X Spare
" Flags N �X _PERFINFO_VAD_ROTATE_INFO .?AU_PERFINFO_VAD_ROTATE_INFO@@ �X c e
�.
x,
�-
GT
q*
h.
�4
L$
�0
} N � _OPERATION_END_PARAMETERS .?AU_OPERATION_END_PARAMETERS@@
�X >
" Version ��
" OperationId ��
" Flags N �X _OPERATION_END_PARAMETERS .?AU_OPERATION_END_PARAMETERS@@ �X o � W W �X
|<
%A
fT
uD
6G
7 q " ��
u TotalSize
! NumLanguages �
! MaxNumLanguages ��
bUseUseMachineConfigList �
8G RegInfo ��
�X Languages
# ullMask ��
u ( uConsoleFlag �
�X , Checksum �6 �X @ _MUILANGLIST .?AU_MUILANGLIST@@ �� �X h
;1
�G
E@
�
e
:?
�1
# ��
# ��
# ��
# ��
# 0 ��
# 9��
# <��
�X UseDescription ���
�X ListDescription ��
�X Cold �
�X Pinned ���
�X DontUse ��
�X Priority �
�X Reserved �N �X _MEMORY_FRAME_INFORMATION .?AU_MEMORY_FRAME_INFORMATION@@ �X t
� ��
�X
`/
�F
F>
"#
�U
�; ; " Y
�
_ ^ � _ETW_ANTI_STARVATION_BOOST_EVENT .?AU_ETW_ANTI_STARVATION_BOOST_EVENT@@ ��^
" ThreadId �
! ProcessorIndex ���
p OldPriority ��
SpareByte ^ Y _ETW_ANTI_STARVATION_BOOST_EVENT .?AU_ETW_ANTI_STARVATION_BOOST_EVENT@@ ��
Y c �
�
P&
�M
�
49
g,
�U
�2 V � _ENLISTMENT_BASIC_INFORMATION .?AU_ENLISTMENT_BASIC_INFORMATION@@
Y N
EnlistmentId �
TransactionId
ResourceManagerId V Y 0 _ENLISTMENT_BASIC_INFORMATION .?AU_ENLISTMENT_BASIC_INFORMATION@@ Y � U J � _CSV_IS_OWNED_BY_CSVFS .?AU_CSV_IS_OWNED_BY_CSVFS@@ ��
OwnedByCSVFS �J Y _CSV_IS_OWNED_BY_CSVFS .?AU_CSV_IS_OWNED_BY_CSVFS@@ �� Y � / J
" UniqueProcessId ��
" SessionId
# WorkingSetPageCount ��
# CommitPageCount ��
# PagedPoolPageCount ���
# VirtualSizeInPages ���
# PrivateWorkingSetPageCount ���
# $ StoreSizeInPages �
# , StoredPageCount ��
# 4 CommitDebtInPages
# < SharedCommitInPages ��R Y D _PERFINFO_WORKINGSET_ENTRY .?AU_PERFINFO_WORKINGSET_ENTRY@@ �� Y c � & A ! ! # Y
�G
�
�8 # %Y
&Y v � _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX@@ ���
� IdleTime �
� KernelTime ���
� UserTime �
� DpcTime ��
� InterruptTime
" ( InterruptCount ���
" , Spare0 ���
� 0 AvailableTime
� 8 Spare1 ���
� @ Spare2 ���v
)Y H _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX@@ �� *Y � �
�%
�7
* � � /Y
l.
�6
�< ^ � DISPLAYCONFIG_TARGET_DEVICE_NAME .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME@@ ���
header ���
�6 flags
�$ outputTechnology �
! edidManufactureId
! edidProductCodeId
u connectorInstance
$ monitorFriendlyDeviceName
�$ � monitorDevicePath ^ 5Y �DISPLAYCONFIG_TARGET_DEVICE_NAME .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME@@ �� 6Y � " " 8Y
9Y
FF
T: ��
<Y
C.
� CurrentByteOffset R ?Y _FILE_POSITION_INFORMATION .?AU_FILE_POSITION_INFORMATION@@ �� @Y � �
]# ��
BY
+
�!
3 ��
FY
�
�:
�(
�(
�:
o%
#S
�
>=
�5
�>
�
�0
�= ��
VY
�+
�
2&
��
[Y
�E
�>
k?
b> F
`Y ImportCallbackRoutine
ImportCallbackParameter ��N aY _LDR_IMPORT_CALLBACK_INFO .?AU_LDR_IMPORT_CALLBACK_INFO@@ bY � �
F � _ALPC_DATA_VIEW_ATTR .?AU_ALPC_DATA_VIEW_ATTR@@ ��R
" Flags
SectionHandle
ViewBase �
# ViewSize �F fY _ALPC_DATA_VIEW_ATTR .?AU_ALPC_DATA_VIEW_ATTR@@ �� gY � �
1
�= �3
kY
�(
�0
�
�
�$
13
�6
�S ��
tY
77
�F xY
yY
dE
9E Z � _PERFINFO_CC_WORKITEM_COMPLETE .?AU_PERFINFO_CC_WORKITEM_COMPLETE@@ ��
# WorkItemKey ��Z ~Y _PERFINFO_CC_WORKITEM_COMPLETE .?AU_PERFINFO_CC_WORKITEM_COMPLETE@@ �� Y c �
c
M
�W
�M
P(
�W
\/
W8
�2
�A . � HACCEL__ .?AUHACCEL__@@ ��
�Y
t unused ���. �Y HACCEL__ .?AUHACCEL__@@ �� �Y t F .
0W " v 1W " " " � v
�Y
�Y
E N � _RPC_SEC_CONTEXT_KEY_INFO .?AU_RPC_SEC_CONTEXT_KEY_INFO@@ R
" EncryptAlgorithm �
" KeySize ��
" SignatureAlgorithm ���N �Y _RPC_SEC_CONTEXT_KEY_INFO .?AU_RPC_SEC_CONTEXT_KEY_INFO@@ �Y 7 � � _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ ��&
� DisableExtensionPoints ��� �Y _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ �� �Y Z b � _PERFINFO_CONTIGUOUS_PAGE_GENERATE .?AU_PERFINFO_CONTIGUOUS_PAGE_GENERATE@@ ��.
# ThreadId �
# NumberOfBytes b �Y _PERFINFO_CONTIGUOUS_PAGE_GENERATE .?AU_PERFINFO_CONTIGUOUS_PAGE_GENERATE@@ �� �Y c
d! J � _ETW_CANCEL_TIMER_EVENT .?AU_ETW_CANCEL_TIMER_EVENT@@
# TimerAddress �J �Y _ETW_CANCEL_TIMER_EVENT .?AU_ETW_CANCEL_TIMER_EVENT@@ �Y c �
�" � � �Y
`F
�8
�3
!X
�B
j? J � _RPC_SECURITY_QOS_V2_A .?AU_RPC_SECURITY_QOS_V2_A@@ ��
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
�I u J �Y _RPC_SECURITY_QOS_V2_A .?AU_RPC_SECURITY_QOS_V2_A@@ �� �Y _
W Z � _WIM_PROVIDER_CONTROL_INTEGRITY .?AU_WIM_PROVIDER_CONTROL_INTEGRITY@@
" ControlCode ��Z �Y _WIM_PROVIDER_CONTROL_INTEGRITY .?AU_WIM_PROVIDER_CONTROL_INTEGRITY@@ �Y � L"
�
�1
�/ �-
t �Y
�4 J � _ATOM_TABLE_INFORMATION .?AU_ATOM_TABLE_INFORMATION@@ ! " �*
" NumberOfAtoms
�Y Atoms J �Y _ATOM_TABLE_INFORMATION .?AU_ATOM_TABLE_INFORMATION@@ �Y �
4 - �Y
] # �Y V � _FILE_STANDARD_INFORMATION_EX .?AU_FILE_STANDARD_INFORMATION_EX@@
�Y �
� AllocationSize ���
� EndOfFile
" NumberOfLinks
DeletePending
Directory
AlternateStream ��
MetadataAttribute V �Y _FILE_STANDARD_INFORMATION_EX .?AU_FILE_STANDARD_INFORMATION_EX@@ �Y � �
�!
�
% f � _SYSTEM_VERIFIER_COUNTERS_INFORMATION .?AU_SYSTEM_VERIFIER_COUNTERS_INFORMATION@@ �
�& Legacy ���
" � RaiseIrqls ���
" � AcquireSpinLocks �
" � SynchronizeExecutions
" � AllocationsWithNoTag �
" � AllocationsFailed
" � AllocationsFailedDeliberately
# � LockedBytes ��
# � PeakLockedBytes ��
# � MappedLockedBytes
# � PeakMappedLockedBytes
# � MappedIoSpaceBytes ���
# � PeakMappedIoSpaceBytes ���
# � PagesForMdlBytes �
# � PeakPagesForMdlBytes �
# � ContiguousMemoryBytes
# � PeakContiguousMemoryBytes
" � ExecutePoolTypes �
" � ExecutePageProtections ���
" ExecutePageMappings ��
" ExecuteWriteSections �
" SectionAlignmentFailures �
" IATInExecutableSection ���f �Y _SYSTEM_VERIFIER_COUNTERS_INFORMATION .?AU_SYSTEM_VERIFIER_COUNTERS_INFORMATION@@ �Y � y
�5
�
�
�6
�
*J
)G
E
�!
d> B � APP_LOCAL_DEVICE_ID .?AUAPP_LOCAL_DEVICE_ID@@
� value B �Y APP_LOCAL_DEVICE_ID .?AUAPP_LOCAL_DEVICE_ID@@ �Y t �
�S
�2
:#
eY
�$ & � _DL_EUI48 .?AT_DL_EUI48@@
�Y
V
�S B � _SYSDBG_TRIAGE_DUMP .?AU_SYSDBG_TRIAGE_DUMP@@
�Y �
" Flags
" BugCheckCode �
# BugCheckParam1 ���
# BugCheckParam2 ���
# BugCheckParam3 ���
# BugCheckParam4 ���
" ( ProcessHandles ���
" , ThreadHandles
[ 0 Handles ��B �Y 8 _SYSDBG_TRIAGE_DUMP .?AU_SYSDBG_TRIAGE_DUMP@@ �Y � *
4 %
�Y
�0
M2
�=
n/ Z � _FSCTL_QUERY_REGION_INFO_OUTPUT .?AU_FSCTL_QUERY_REGION_INFO_OUTPUT@@
�Y �W " �
" Version ��
" Size �
" Flags
" Reserved �
# Alignment
" TotalNumberOfRegions �
" NumberOfRegionsReturned ��
�Y Regions ��Z �Y @ _FSCTL_QUERY_REGION_INFO_OUTPUT .?AU_FSCTL_QUERY_REGION_INFO_OUTPUT@@ �Y � �B
�
s5 � j � _SYSTEM_FIRMWARE_PARTITION_INFORMATION .?AU_SYSTEM_FIRMWARE_PARTITION_INFORMATION@@ ��
FirmwarePartition j Z _SYSTEM_FIRMWARE_PARTITION_INFORMATION .?AU_SYSTEM_FIRMWARE_PARTITION_INFORMATION@@ �� Z � e
* � HRGN__ .?AUHRGN__@@ ��
Z
t unused ���* Z HRGN__ .?AUHRGN__@@ �� Z �' �
aB
HS
T t t Z
Z
6N " " " " " k " Z
>
�(
r
�=
�?
W W Z
�'
� Data �2 Z _HV_DETAILS .?AU_HV_DETAILS@@ Z � 9
�A " Z " � " " Z
!Z Z � _MEMORY_COMBINE_INFORMATION_EX2 .?AU_MEMORY_COMBINE_INFORMATION_EX2@@
#Z V
Handle ���
# PagesCombined
" Flags
ProcessHandle Z %Z _MEMORY_COMBINE_INFORMATION_EX2 .?AU_MEMORY_COMBINE_INFORMATION_EX2@@ &Z � �
Active ���V (Z _ETW_COVERAGE_SAMPLER_STATUS .?AU_ETW_COVERAGE_SAMPLER_STATUS@@ �� )Z A �
X<
:
�=
q 6 � q q q q " .Z .Z /Z
0Z
�I
� v
� ptlReference �
" nChars ���
" offString
" fOptions �
d rcl ��
" $ offDx 2 4Z ( tagEMRTEXT .?AUtagEMRTEXT@@ �� 5Z � G Z � _FILE_FS_ATTRIBUTE_INFORMATION .?AU_FILE_FS_ATTRIBUTE_INFORMATION@@ ��
" FileSystemAttributes �
MaximumComponentNameLength ���
" FileSystemNameLength �
| FileSystemName ���Z 8Z _FILE_FS_ATTRIBUTE_INFORMATION .?AU_FILE_FS_ATTRIBUTE_INFORMATION@@ �� 9Z � �
�,
��
=Z
�W " " @Z
AZ
j%
�9
g: N � _FILESYSTEM_STATISTICS_EX .?AU_FILESYSTEM_STATISTICS_EX@@ �
! FileSystemType ���
! Version ��
" SizeOfCompleteStructure ��
# UserFileReads
# UserFileReadBytes
# UserDiskReads
# UserFileWrites ���
# ( UserFileWriteBytes ���
# 0 UserDiskWrites ���
# 8 MetaDataReads
# @ MetaDataReadBytes
# H MetaDataDiskReads
# P MetaDataWrites ���
# X MetaDataWriteBytes ���
# ` MetaDataDiskWrites ���N GZ h _FILESYSTEM_STATISTICS_EX .?AU_FILESYSTEM_STATISTICS_EX@@ HZ � �
8
�
6. ��
LZ
�
3+
zX
/-
�G
�-
�5 d-
UZ
�=
==
p
YZ
�1
[Z
,!
�C > � _LDR_FAILURE_DATA .?AU_LDR_FAILURE_DATA@@ F
Status ���
ImageName
D AdditionalInfo ���> `Z � _LDR_FAILURE_DATA .?AU_LDR_FAILURE_DATA@@ aZ � �
u ��
cZ
�D # fZ
gZ
�:
q=
�R
(Y
A0
�0
N1
+
V4
T:
D5
t uZ
�M
�'
�+
�
�V * � HPEN__ .?AUHPEN__@@ ��
|Z
t unused ���* ~Z HPEN__ .?AUHPEN__@@ �� Z t ^
!2
�B
Y* p%
�Z
@'
�0 : � _FILE_NAME_INFO .?AU_FILE_NAME_INFO@@
�Z 2
" FileNameLength ���
| FileName �: �Z _FILE_NAME_INFO .?AU_FILE_NAME_INFO@@ �Z o �" > � _PACKEDEVENTINFO .?AU_PACKEDEVENTINFO@@ �� " " �J
" ulSize ���
" ulNumEventsForLogFile
�Z ulOffsets > �Z _PACKEDEVENTINFO .?AU_PACKEDEVENTINFO@@ �� �Z �& |
t �Z
�4
~%
@
)<
<( �
q User �
" UserLength ���
q Domain ���
" DomainLength �
q Password �
" ( PasswordLength ���
" , Flags R �Z 0 _SEC_WINNT_AUTH_IDENTITY_W .?AU_SEC_WINNT_AUTH_IDENTITY_W@@ �� �Z _ { Z � _RTL_USER_PROCESS_INFORMATION64 .?AU_RTL_USER_PROCESS_INFORMATION64@@ n
" Length ���
Process ��
Thread ���
� ClientId �
�W ( ImageInformation �Z �Z h _RTL_USER_PROCESS_INFORMATION64 .?AU_RTL_USER_PROCESS_INFORMATION64@@ �Z <
02
�B
=T
B
�
�4 f
" GenericRead ��
" GenericWrite �
" GenericExecute ���
" GenericAll ���> �Z _GENERIC_MAPPING .?AU_GENERIC_MAPPING@@ �� �Z x �
WD
�, b
" dwSize ���
" iType
" nCount ���
" nRgnSize �
! rcBound ��: �Z _RGNDATAHEADER .?AU_RGNDATAHEADER@@ �� �Z � �
P J � _CM_PCCARD_DEVICE_DATA .?AU_CM_PCCARD_DEVICE_DATA@@ ��
Flags
ErrorCode
! Reserved �
" BusData ��
" DeviceId �
" LegacyBaseAddress
p IRQMap ���J �Z _CM_PCCARD_DEVICE_DATA .?AU_CM_PCCARD_DEVICE_DATA@@ �� �Z ?
!!
�!
{G
]
k3 Z � _THREAD_POWER_THROTTLING_STATE .?AU_THREAD_POWER_THROTTLING_STATE@@ ��B
" Version ��
" ControlMask ��
" StateMask Z �Z _THREAD_POWER_THROTTLING_STATE .?AU_THREAD_POWER_THROTTLING_STATE@@ �� �Z � ^
L+
�S
�+
�5
` � " 0 �b
! MaximumGroupCount
! ActiveGroupCount �
� Reserved �
�Z GroupInfo B �Z H _GROUP_RELATIONSHIP .?AU_GROUP_RELATIONSHIP@@ �Z � < @
�
�U
�A
�
GD
�I
�
`
�&
�/
z!
�/
~!
. Z � _PROCESS_CYCLE_TIME_INFORMATION .?AU_PROCESS_CYCLE_TIME_INFORMATION@@
�Z :
# AccumulatedCycles
# CurrentCycleCount Z �Z _PROCESS_CYCLE_TIME_INFORMATION .?AU_PROCESS_CYCLE_TIME_INFORMATION@@ �Z � �
yF
�$
�V
'
3
v-
S
�'
PG V � _ENCLAVE_INIT_INFO_VBS_BASIC .?AU_ENCLAVE_INIT_INFO_VBS_BASIC@@ ��
p FamilyId �
p ImageId ��
# EnclaveSize ��
" ( EnclaveSvn ���
" , Reserved �
0 SignatureInfoHandle ��
# 0 Unused ���V �Z 8 _ENCLAVE_INIT_INFO_VBS_BASIC .?AU_ENCLAVE_INIT_INFO_VBS_BASIC@@ �� �Z � �
F#
�
!U
�D ��
�Z
U* & � � �% p p �% p u u �Z
�Z
2
qW
�T
U>
� �$
tT
�R
q
K
:5 � u # �Z
�Z
�=
�C
m= Z � _FILE_STANDARD_LINK_INFORMATION .?AU_FILE_STANDARD_LINK_INFORMATION@@
[ r
" NumberOfAccessibleLinks ��
" TotalNumberOfLinks ���
DeletePending
Directory Z [ _FILE_STANDARD_LINK_INFORMATION .?AU_FILE_STANDARD_LINK_INFORMATION@@ [ � �
T f � _PROCESS_SECURITY_DOMAIN_INFORMATION .?AU_PROCESS_SECURITY_DOMAIN_INFORMATION@@ ��
[
# SecurityDomain ���f [ _PROCESS_SECURITY_DOMAIN_INFORMATION .?AU_PROCESS_SECURITY_DOMAIN_INFORMATION@@ ��
[ � L
�
:
-C
V
GE , " " [
[
�,
�9
o<
t1
�@
�
I 6 � _X86_CONTEXT .?AU_X86_CONTEXT@@ ��
`V
r ! [
%1
U
�$
�#
k<
7"
H+
�=
(
t7
�#
�$ q ,[
�Z
�<
�
D5
K6
eB
I
�
]'
H>
9W t 9[
:[ �> 6 � _WMI_RESOURCE .?AU_WMI_RESOURCE@@ �
# AcquireTime ��
# HoldTime �
# WaitTime �
" MaxRecursionDepth
" ThreadId �
Resource �
" ( Action ���
" , ContentionDelta ��6 >[ 0 _WMI_RESOURCE .?AU_WMI_RESOURCE@@ ?[ c y
x
<6
V .
Object ���
ObjectType ���J D[ _WMI_WAIT_OBJECT_RECORD .?AU_WMI_WAIT_OBJECT_RECORD@@ E[ c �
'8 " p p " t H[
I[
P& K[ t L[
M[
_Z
�1 " %
z4
�,
�)
u+
�* " �
%-
�9
>9
jU
�$
u
�:
�?
. `[ " a[
b[
],
� # f[
g[ �) " � � �) " � " ` �j
! ControlWord ��
! StatusWord ���
TagWord ��
Reserved1
! ErrorOpcode ��
" ErrorOffset ��
! ErrorSelector
! Reserved2
" DataOffset ���
! DataSelector �
! Reserved3
" MxCsr
" MxCsr_Mask ���
i[ FloatRegisters ���
j[ � XmmRegisters �
k[ �Reserved4 6 l[ _XSAVE_FORMAT .?AU_XSAVE_FORMAT@@ m[ L �
�*
`W
�
# r[ �#
Y
�$
X
�=
p y[ � � {[
�Y
�Z
�W q u u �[
�[
�
�.
�E 2 � _COMMCONFIG .?AU_COMMCONFIG@@ �
" dwSize ���
! wVersion �
! wReserved
)) dcb ��
" $ dwProviderSubType
" ( dwProviderOffset �
" , dwProviderSize ���
| 0 wcProviderData ���2 �[ 4 _COMMCONFIG .?AU_COMMCONFIG@@ �[ o
.;
�
�. ��
�[
C
;
�4 ��
�[
�Y
rC
�
�F
�<
�
�U
=[
�
�F
�E
�4
�7
�$
%!
0 b � _SYSTEM_PREFETCH_PATCH_INFORMATION .?AU_SYSTEM_PREFETCH_PATCH_INFORMATION@@ ��"
" PrefetchPatchCount ���b �[ _SYSTEM_PREFETCH_PATCH_INFORMATION .?AU_SYSTEM_PREFETCH_PATCH_INFORMATION@@ �� �[ � �
�V N � _OBJECT_TYPE_INFORMATION .?AU_OBJECT_TYPE_INFORMATION@@ ���
TypeName �
" TotalNumberOfObjects �
" TotalNumberOfHandles �
" TotalPagedPoolUsage ��
" TotalNonPagedPoolUsage ���
" TotalNamePoolUsage ���
" $ TotalHandleTableUsage
" ( HighWaterNumberOfObjects �
" , HighWaterNumberOfHandles �
" 0 HighWaterPagedPoolUsage ��
" 4 HighWaterNonPagedPoolUsage ���
" 8 HighWaterNamePoolUsage ���
" < HighWaterHandleTableUsage
" @ InvalidAttributes
Q% D GenericMapping ���
" T ValidAccessMask ��
X SecurityRequired �
Y MaintainHandleCount ��
Z TypeIndex
p [ ReservedByte �
" \ PoolType �
" ` DefaultPagedPoolCharge ���
" d DefaultNonPagedPoolCharge N �[ h _OBJECT_TYPE_INFORMATION .?AU_OBJECT_TYPE_INFORMATION@@ �� �[ 2 8
!:
�S
�
�
c
�:
3
�1
�Z
�[
y
+> %
�[
�$
t/
�"
�D
H
$+ * � in_addr .?AUin_addr@@
�[
�C MemoryRegionInfo �V t �[ WIN32_MEMORY_INFORMATION_CLASS .?AW4WIN32_MEMORY_INFORMATION_CLASS@@ ��� �[ � |
\T * � HRSRC__ .?AUHRSRC__@@
t unused ���* �[ HRSRC__ .?AUHRSRC__@@ �[ �' �
76
�E
@
/=
q-
�
9 - �[
�% " s0 �[
� 6 � _RTL_RVA_LIST .?AU_RTL_RVA_LIST@@ �
# RvaCount �
" StateBitsPerRva ��
CompressedBuffer �
# CompressedBufferSize �
U" RvaStateBitMap ���
" 0 StateBitValueMap �
8 ExtensionBuffer ��6 �[ @ _RTL_RVA_LIST .?AU_RTL_RVA_LIST@@ �[ N
$
�C
�[
':
k@ * � HKEY__ .?AUHKEY__@@ ��
t unused ���* �[ HKEY__ .?AUHKEY__@@ �� �[ �' �
pE " " " �[ V � _ETW_DISKIO_FLUSH_BUFFERS_V2 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V2@@ ��b
" DiskNumber ���
" IrpFlags �
# HighResResponseTime ��
IrpAddr ��V �[ _ETW_DISKIO_FLUSH_BUFFERS_V2 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V2@@ �� �[ c �
u " " � �b � _EVENT_EXTENDED_ITEM_STACK_TRACE32 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE32@@ ��*
# MatchId ��
� Address ��b �[ _EVENT_EXTENDED_ITEM_STACK_TRACE32 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE32@@ �� �[ V h
>4
G
V 6
ResolutionContext
" RootIndexUsed � �[ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL@@ �� �[ � �
*/
�:
%)
�*
�U
�-
2B
vX �" __n32 .?AT__n32@@ u " � " � t " � " � p " � @ " �
\ n32_u32 ��
� n32_u16 ��
\ n32_u8 ���
\ n32_i32 ��
\ n32_i16 ��
\ n32_i8 ���
\ n32_f32 �� & \ __n32 .?AT__n32@@
\ * ,
&
^3
V � _PROCESSOR_POWER_INFORMATION .?AU_PROCESSOR_POWER_INFORMATION@@ ��
" Number ���
" MaxMhz ���
" CurrentMhz ���
" MhzLimit �
" MaxIdleState �
" CurrentIdleState �V \ _PROCESSOR_POWER_INFORMATION .?AU_PROCESSOR_POWER_INFORMATION@@ �� \ x �
�
�0
�W
2
b'
�S
�V z � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3@@ J
MaxIops ��
MaxBandwidth �
ReservationIops ��
q VolumeName ���
" BaseIoSize ���
0 $ ControlFlags �
! ( VolumeNameLength �
0 CriticalReservationIops ��
8 ReservationBandwidth �
@ CriticalReservationBandwidth �
H MaxTimePercent ���
P ReservationTimePercent ���
X CriticalReservationTimePercent ���
` SoftMaxIops ��
h SoftMaxBandwidth �
p SoftMaxTimePercent ���
x LimitExcessNotifyIops
� LimitExcessNotifyBandwidth ���
� LimitExcessNotifyTimePercent �z \ � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3@@ \ ? |
�)
�.
�1
�4
�R
�
�S
)%
�<
' �[
(\
e> J � _RETRIEVAL_POINTER_BASE .?AU_RETRIEVAL_POINTER_BASE@@
+\
� FileAreaOffset ���J -\ _RETRIEVAL_POINTER_BASE .?AU_RETRIEVAL_POINTER_BASE@@ .\ � J
�Y
RD
.N " _ 3\
�@
�1
�
*U
�A " �
�T 2
�, Type �
6 PolicyId �
K u B <\ _IMAGE_POLICY_ENTRY .?AU_IMAGE_POLICY_ENTRY@@ =\ b m&
,?
3%
YU ^ � _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR .?AU_RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR@@ .
" BufferSize ���
p Buffer ���^ C\ _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR .?AU_RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR@@ D\ 7
!* F\ G\
H\
�
L0
+:
�@
�7
E
�V
�
�U
> ��
S\
s' � t V\
W\
�G �T
�
c
�U
f ^\
M
�(
�G
"
GH
=
a?
!
jW
�%
� �
! Signature
! Flags
" Size �
! Machine ��
!
Characteristics ��
" TimeDateStamp
" CheckSum �
" SizeOfImage ��
# ImageBase F k\ _NON_PAGED_DEBUG_INFO .?AU_NON_PAGED_DEBUG_INFO@@ l\ � 6
Y
1
-
k5
(
�V
�R
�@
4
WH
�%
�
�'
V9
�A
�: ^
! Length ���
! Flags
" ReparseDataSize ��
" ReparseDataOffset . ~\ _Reparse .?AU_Reparse@@ �� \ � �
h �" __n8 .?AT__n8@@ �� " �"
�\ n8_u8
l n8_i8 &�\ __n8 .?AT__n8@@ �� �\ * I " �\
�\
Y*
�(
F
�$
�. � " # �\ �\
�\
�3
�%
�
�
�<
�Z
f%
�,
�
gZ
6.
>E
s>
1
"4 �
Id ���
� Name �
� Description ��
# Flags
# ProvisionedCapacity ��
� MediaType
� $Class B �\ (_FILE_STORAGE_TIER .?AU_FILE_STORAGE_TIER@@ �� �\ � �
�2
�S
b-
�[
}Y �$
=
�A
�)
�-
" R � DISPLAYCONFIG_ADAPTER_NAME .?AUDISPLAYCONFIG_ADAPTER_NAME@@ ��2
header ���
�$ adapterDevicePath R �\ DISPLAYCONFIG_ADAPTER_NAME .?AUDISPLAYCONFIG_ADAPTER_NAME@@ �� �\ � "
�/
4V
%E
\
}?
qV
Z
�"
K'
�
U
$ fZ
�4
�.
�W | p ! �\
�"
�
U
�
�4
o%
�
�& " t �\
�\
[%
#=
C t �6
�\
S
�
> ��
�\
�
�'
�;
t9
7
!
�*
�A
RR
�X
= 21 21 �\
�5
C!
p(
0
�
a.
AG � t t �\
�\
S
t �\
�\
`F ��
�\
FZ
�
�
�4
w)
�R �\
�
�S
�:
9
�
/H
�' � �? �\ ]
]
�G �
]
�
�;
�
0
~
�
R7 B � ANON_OBJECT_HEADER .?AUANON_OBJECT_HEADER@@ ��
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
ClassID ��
" SizeOfData ���B ] ANON_OBJECT_HEADER .?AUANON_OBJECT_HEADER@@ �� ] � �
�S
5, � q t ]
]
A
jC j � JOBOBJECT_NET_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_NET_RATE_CONTROL_INFORMATION@@ ��F
# MaxBandwidth �
+X ControlFlags �
DscpTag ��j ] JOBOBJECT_NET_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_NET_RATE_CONTROL_INFORMATION@@ �� ] ? <
�0
t
�R
'
h(
�
�[ Z
! Length ���
! Flags
" EaSize ���
" EaInformationOffset ��" '] _Ea .?AU_Ea@@ (] � �
�$ � q t +]
,]
hE
<
o
�
�(
3]
�G * # * 6]
5
�&
�
�(
3
�0
�;
fS
g<
�S
EA
2.
*
�/
�
�7 ��
G]
$= � � _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC@@ ��6
# Size �
" Format ���
�! Frame � K] ( _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC@@ �� L] � y
� ��
N]
�1
�@
]
.$
+0
= - U]
�D
�#
%
(
�+
�,
u: " %
^] R
u width
u height ���
�* pixelFormat ��
� position �N `] DISPLAYCONFIG_SOURCE_MODE .?AUDISPLAYCONFIG_SOURCE_MODE@@ a] � [
�S
�W ��
d]
j-
)
�I
P
^
�
�4
�9
`$
�
�7
�@
�
�Y
�G
3X
X ��
w]
= " �
�&
0
>/
5
�
�B
p,
BF
K3
aT
>W
QC * � � � � " " " �]
�]
�Y
�?
R7
�/
�M
�B
&
1 ��
�]
<&
; - �]
�'
�C
+
�-
1! " �]
�]
7 - �]
�E
] ! !
|7
%
�Y
�7
�(
a-
SV
�5
2
�C
? �E
)C
!
{
�U
�%
�+ q t �]
�]
MS
�>
�<
04
�
�T
�M
)
�
S'
F1
�
J]
W-
� ^ � _SYSTEM_BOOT_GRAPHICS_INFORMATION .?AU_SYSTEM_BOOT_GRAPHICS_INFORMATION@@
�] �
� FrameBuffer ��
" Width
" Height ���
" PixelStride ��
" Flags
5 Format ���
" DisplayRotation ��^ �] _SYSTEM_BOOT_GRAPHICS_INFORMATION .?AU_SYSTEM_BOOT_GRAPHICS_INFORMATION@@ �] � e
*1
C<
�
�;
@ �]
D
�'
�A
�(
*J
�@
�*
�[
�A
D/
)
�W �
�]
#
i(
�3
�6
m*
�'
�D
�"
I,
�C ��
�]
EV
L
�!
� _
e@
T
a@
x9
.U
*
Q,
1 � � p � �]
�*
d7
�
�
�M
[S
uV
Z
w
�7 2 � HPALETTE__ .?AUHPALETTE__@@ ��
^
t unused ���2 ^ HPALETTE__ .?AUHPALETTE__@@ �� ^ t ]
�V �$ �=
C(
�C � � ^
^
i
2F
9:
�%
u#
�R
#
%C > � _IMAGE_OS2_HEADER .?AU_IMAGE_OS2_HEADER@@
^ ��
^ �
! ne_magic �
p ne_ver ���
p ne_rev ���
! ne_enttab
! ne_cbenttab ��
ne_crc ���
! ne_flags �
! ne_autodata ��
! ne_heap ��
! ne_stack �
ne_csip ��
ne_sssp ��
! ne_cseg ��
! ne_cmod ��
! ne_cbnrestab �
! " ne_segtab
! $ ne_rsrctab ���
! & ne_restab
! ( ne_modtab
! * ne_imptab
, ne_nrestab ���
! 0 ne_cmovent ���
! 2 ne_align �
! 4 ne_cres ��
6 ne_exetyp
7 ne_flagsothers ���
! 8 ne_pretthunks
! : ne_psegrefbytes ��
! < ne_swaparea ��
! > ne_expver > ^ @ _IMAGE_OS2_HEADER .?AU_IMAGE_OS2_HEADER@@ !^ � [ " " q t #^
$^
I5
�9
� " (^ )^
*^ [ " [ I [ ,^
-^ � �&
G
�B
�[
Q>
�$
[) ��
5^
�7
� 8^ # 9^
:^
kY
�[
�F
�
�C
�
�U
:2
(?
J#
�?
�A
H
�S
�/
�8
?"
�' ��
P^
" R^
49 ��
T^
�Y
�-
�@ ��
X^
�C
Y
kS
�Y
J-
" ��
_^
q%
"
�
B!
7Z
A
6 - h^
�
$
`X
!
q
>H
(
v!
>;
�
�;
)
�
:
�B
YR
�(
7
T
G
xR
�V
�,
# �$
�^
�U
k
�[
�^ �
�^
"6
R3 " M Z
� PathSourceSize ���
d DesktopImageRegion ���
d DesktopImageClip �^ �^ ( DISPLAYCONFIG_DESKTOP_IMAGE_INFO .?AUDISPLAYCONFIG_DESKTOP_IMAGE_INFO@@ �� �^ � h
!
3$ " �! �^
�^
cC
!
l �%
�^
�$
�
�
�W
�F
^J
BB
�
�
HG
�+
�,
^
T
�6
eV
�
�I
{" � � p t �^
�^
�<
t
�) .
u Numerator
u Denominator ��J �^ DISPLAYCONFIG_RATIONAL .?AUDISPLAYCONFIG_RATIONAL@@ �� �^ � �
�
G
�
�.
R9
�,
o%
�
�S
� ��
�^
>
�< �$
B?
�[
z*
�'
LT
v& N � ANON_OBJECT_HEADER_BIGOBJ .?AUANON_OBJECT_HEADER_BIGOBJ@@ *
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
ClassID ��
" SizeOfData ���
" Flags
" $ MetaDataSize �
" ( MetaDataOffset ���
" , NumberOfSections �
" 0 PointerToSymbolTable �
" 4 NumberOfSymbols ��N
�^ 8 ANON_OBJECT_HEADER_BIGOBJ .?AUANON_OBJECT_HEADER_BIGOBJ@@ �^ � �
Q%
!
8
�= ��
�^
# cm�U
���
���
���
���� -MT -wd4746 -volatile:ms -Oy- -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427
�^ Z �^ -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X �^ �^ �^ �^ �^ �����m��;���{ �j�n�M���'��Aі�f��)Y�d���)Y�d���K�f(��M���- �D$7���s�����{�q��
�y @comp.idk�� @feat.00� ��� .debug$S ̓ e .rdata �ہ e e .rdata �w � e ~ .rdata h�Q� e � .rdata x� � e � .rdata x� � e � .rdata 1�, e � .debug$S 4 e .debug$S @ e .debug$S
8 e .debug$P @j e .chks64 h e
__@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinGEUkivxlnkOlyq@elfapi ??_C@_13FPGAJAPJ@?$AA?2@ ??_C@_15MNCACJLI@?$AA?2?$AA?1@ ??_C@_13CGOKJPIL@?$AA?1@ RtlNtPathSeperatorString RtlAlternateDosPathSeperatorString RtlDosPathSeperatorsString