| Server IP : 209.209.40.120 / Your IP : 216.73.217.112 Web Server : Microsoft-IIS/10.0 System : Windows NT NEWWWW 10.0 build 17763 (Windows Server 2019) i586 User : NEWWWW$ ( 0) PHP Version : 8.3.30 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /Program Files (x86)/Windows Kits/10/Lib/10.0.19041.0/um/x86/ |
Upload File : |
!<arch>
/ 1606895243 0 4758 `
� &6 &6 &6 &6 &6 &6 &6 &6 &6 F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� F� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 �8 S S S S S S S??_C@_13JOFGPIOO@?$AA?4@ ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4@ ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc@ ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG@ ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg@ _EVENTLOG_HANDLE_A_bind@4 _EVENTLOG_HANDLE_A_unbind@8 _EVENTLOG_HANDLE_W_bind@4 _EVENTLOG_HANDLE_W_unbind@8 ??_C@_08EDKKPLCC@Security@ ??_C@_0M@NJALGCHB@Application@ ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy@ _CHANNEL_POLICY_APPLICATION_ERROR _EVENTLOG _EVENTLOG_Context _EVENT_ABNORMAL_SHUTDOWN _EVENT_AUDIT_AUTO_BACKUP _EVENT_AUDIT_EVENTS_DROPPED _EVENT_AUDIT_FAILURE _EVENT_AUDIT_LOG_CLEARED _EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL _EVENT_AUDIT_LOG_FULL _EVENT_AUDIT_PROCESSING _EVENT_AUDIT_PUBLISHER_META_DATA _EVENT_AUTO_BACKUP _EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY _EVENT_EVENTS_DROPPED _EVENT_LOG_CLEARED _EVENT_LOG_FULL _EVENT_OPENEVENTLOG _EVENT_PROCESSING _EVENT_PUBLISHER_META_DATA _EVENT_PUBLISHER_TLG_INVALID_META_DATA _EVENT_PULLSUB_CREATE _EVENT_PUSHSUB_CREATE _EVENT_REGISTEREVENTSOURCE _EVENT_REPORTEVENT _EVENT_REPORTEVENT_ANSI _EVENT_SHUTDOWN _ElfAssertThreadPrivilege@8 _ElfBackupEventLogFileA@8 _ElfBackupEventLogFileW@8 _ElfChangeNotify@8 _ElfClearEventLogFileA@8 _ElfClearEventLogFileW@8 _ElfCloseEventLog@4 _ElfCreateReconnInfo@20 _ElfDeregisterClusterSvc@4 _ElfDeregisterEventSource@4 _ElfDestroyReconnectionInfo@4 _ElfFlushEventLog@4 _ElfGetLogInformation@20 _ElfGetModuleName@8 _ElfGetTheRpcHandle@4 _ElfGetUseLegacyReportEvent@4 _ElfNumberOfRecords@8 _ElfOldestRecord@8 _ElfOpenBackupEventLogA@12 _ElfOpenBackupEventLogW@12 _ElfOpenEventLogA@12 _ElfOpenEventLogW@12 _ElfReadEventLogA@28 _ElfReadEventLogW@28 _ElfReconnect@4 _ElfRegisterClusterSvc@12 _ElfRegisterEventSourceA@12 _ElfRegisterEventSourceW@12 _ElfReportEventA@48 _ElfReportEventAndSourceW@60 _ElfReportEventW@48 _ElfRevertThreadPrivilege@4 _ElfSetUseLegacyReportEvent@8 _ElfWriteClusterEvents@12 _EventDataDescCreate@12 _INIT_CHANNEL _INIT_CHANNEL_CONFIG_ERROR _INIT_CHANNEL_LOGFILE_WARNING _INIT_CHANNEL_LOGFILTER_WARNING _INIT_CHANNEL_LOGGING _INIT_CHANNEL_MOVED_CORRUPT_LOG _INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG _INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE _INIT_CHANNEL_PUBLISHING _LOG_DROPPED_CHUNK _McGenControlCallbackV2@36 _McGenEventRegister_EtwEventRegister@16 _McGenEventUnregister_EtwEventUnregister@4 _McGenEventWrite_EtwEventWriteTransfer@20 _McGenLevelKeywordEnabled@16 _McTemplateU0usr0_EtwEventWriteTransfer@16 _McTemplateU0uzr0_EtwEventWriteTransfer@16 _Microsoft_Windows_EventlogEnableBits _Microsoft_Windows_EventlogKeywords _Microsoft_Windows_EventlogLevels _NtCurrentTeb@0 _PRIMARY_CHANNEL_CONFIGURATION_WARNING _PRIMARY_CHANNEL_FATAL_ERROR _WevtInitialize@12 _BackupEventLogA@8 _BackupEventLogW@8 _BaseSetLastNTError@4 _CheckEventLogBuffer@16 _ClearEventLogA@8 _ClearEventLogW@8 _CloseEventLog@4 _DeregisterEventSource@4 _GetEventLogInformation@20 _GetNumberOfEventLogRecords@8 _GetOldestEventLogRecord@8 _InitAnsiString@8 _InitUnicodeString@8 _NotifyChangeEventLog@8 _OpenBackupEventLogA@8 _OpenBackupEventLogW@8 _OpenEventLogA@8 _OpenEventLogW@8 _ReadEventLogA@28 _ReadEventLogW@28 _RegisterEventSourceA@8 _RegisterEventSourceW@8 _ReportEventA@36 _ReportEventW@36 _StringCheck@16 _ElfrBackupELFA@8 _ElfrBackupELFW@8 _ElfrChangeNotify@16 _ElfrClearELFA@8 _ElfrClearELFW@8 _ElfrCloseEL@4 _ElfrDeregisterClusterSvc@4 _ElfrDeregisterEventSource@4 _ElfrFlushEL@4 _ElfrGetLogInformation@20 _ElfrNumberOfRecords@8 _ElfrOldestRecord@8 _ElfrOpenBELA@20 _ElfrOpenBELW@20 _ElfrOpenELA@24 _ElfrOpenELW@24 _ElfrReadELA@28 _ElfrReadELW@28 _ElfrRegisterClusterSvc@12 _ElfrRegisterEventSourceA@24 _ElfrRegisterEventSourceW@24 _ElfrReportEventA@56 _ElfrReportEventAndSourceW@60 _ElfrReportEventExA@52 _ElfrReportEventExW@52 _ElfrReportEventW@56 _ElfrWriteClusterEvents@12 _eventlog_ClientIfHandle ??_C@_13CGOKJPIL@?$AA?1@ ??_C@_13FPGAJAPJ@?$AA?2@ ??_C@_15MNCACJLI@?$AA?2?$AA?1@ _RtlAlternateDosPathSeperatorString _RtlDosPathSeperatorsString _RtlNtPathSeperatorString ___@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUrDIGUkivxlnkOlyq@elfapi / 1606895243 0 4466 `
6& �F �� 8� S � ??_C@_08EDKKPLCC@Security@ ??_C@_0M@NJALGCHB@Application@ ??_C@_13CGOKJPIL@?$AA?1@ ??_C@_13FPGAJAPJ@?$AA?2@ ??_C@_13JOFGPIOO@?$AA?4@ ??_C@_15MNCACJLI@?$AA?2?$AA?1@ ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4@ ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc@ ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy@ ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG@ ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg@ _BackupEventLogA@8 _BackupEventLogW@8 _BaseSetLastNTError@4 _CHANNEL_POLICY_APPLICATION_ERROR _CheckEventLogBuffer@16 _ClearEventLogA@8 _ClearEventLogW@8 _CloseEventLog@4 _DeregisterEventSource@4 _EVENTLOG _EVENTLOG_Context _EVENTLOG_HANDLE_A_bind@4 _EVENTLOG_HANDLE_A_unbind@8 _EVENTLOG_HANDLE_W_bind@4 _EVENTLOG_HANDLE_W_unbind@8 _EVENT_ABNORMAL_SHUTDOWN _EVENT_AUDIT_AUTO_BACKUP _EVENT_AUDIT_EVENTS_DROPPED _EVENT_AUDIT_FAILURE _EVENT_AUDIT_LOG_CLEARED _EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL _EVENT_AUDIT_LOG_FULL _EVENT_AUDIT_PROCESSING _EVENT_AUDIT_PUBLISHER_META_DATA _EVENT_AUTO_BACKUP _EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY _EVENT_EVENTS_DROPPED _EVENT_LOG_CLEARED _EVENT_LOG_FULL _EVENT_OPENEVENTLOG _EVENT_PROCESSING _EVENT_PUBLISHER_META_DATA _EVENT_PUBLISHER_TLG_INVALID_META_DATA _EVENT_PULLSUB_CREATE _EVENT_PUSHSUB_CREATE _EVENT_REGISTEREVENTSOURCE _EVENT_REPORTEVENT _EVENT_REPORTEVENT_ANSI _EVENT_SHUTDOWN _ElfAssertThreadPrivilege@8 _ElfBackupEventLogFileA@8 _ElfBackupEventLogFileW@8 _ElfChangeNotify@8 _ElfClearEventLogFileA@8 _ElfClearEventLogFileW@8 _ElfCloseEventLog@4 _ElfCreateReconnInfo@20 _ElfDeregisterClusterSvc@4 _ElfDeregisterEventSource@4 _ElfDestroyReconnectionInfo@4 _ElfFlushEventLog@4 _ElfGetLogInformation@20 _ElfGetModuleName@8 _ElfGetTheRpcHandle@4 _ElfGetUseLegacyReportEvent@4 _ElfNumberOfRecords@8 _ElfOldestRecord@8 _ElfOpenBackupEventLogA@12 _ElfOpenBackupEventLogW@12 _ElfOpenEventLogA@12 _ElfOpenEventLogW@12 _ElfReadEventLogA@28 _ElfReadEventLogW@28 _ElfReconnect@4 _ElfRegisterClusterSvc@12 _ElfRegisterEventSourceA@12 _ElfRegisterEventSourceW@12 _ElfReportEventA@48 _ElfReportEventAndSourceW@60 _ElfReportEventW@48 _ElfRevertThreadPrivilege@4 _ElfSetUseLegacyReportEvent@8 _ElfWriteClusterEvents@12 _ElfrBackupELFA@8 _ElfrBackupELFW@8 _ElfrChangeNotify@16 _ElfrClearELFA@8 _ElfrClearELFW@8 _ElfrCloseEL@4 _ElfrDeregisterClusterSvc@4 _ElfrDeregisterEventSource@4 _ElfrFlushEL@4 _ElfrGetLogInformation@20 _ElfrNumberOfRecords@8 _ElfrOldestRecord@8 _ElfrOpenBELA@20 _ElfrOpenBELW@20 _ElfrOpenELA@24 _ElfrOpenELW@24 _ElfrReadELA@28 _ElfrReadELW@28 _ElfrRegisterClusterSvc@12 _ElfrRegisterEventSourceA@24 _ElfrRegisterEventSourceW@24 _ElfrReportEventA@56 _ElfrReportEventAndSourceW@60 _ElfrReportEventExA@52 _ElfrReportEventExW@52 _ElfrReportEventW@56 _ElfrWriteClusterEvents@12 _EventDataDescCreate@12 _GetEventLogInformation@20 _GetNumberOfEventLogRecords@8 _GetOldestEventLogRecord@8 _INIT_CHANNEL _INIT_CHANNEL_CONFIG_ERROR _INIT_CHANNEL_LOGFILE_WARNING _INIT_CHANNEL_LOGFILTER_WARNING _INIT_CHANNEL_LOGGING _INIT_CHANNEL_MOVED_CORRUPT_LOG _INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG _INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE _INIT_CHANNEL_PUBLISHING _InitAnsiString@8 _InitUnicodeString@8 _LOG_DROPPED_CHUNK _McGenControlCallbackV2@36 _McGenEventRegister_EtwEventRegister@16 _McGenEventUnregister_EtwEventUnregister@4 _McGenEventWrite_EtwEventWriteTransfer@20 _McGenLevelKeywordEnabled@16 _McTemplateU0usr0_EtwEventWriteTransfer@16 _McTemplateU0uzr0_EtwEventWriteTransfer@16 _Microsoft_Windows_EventlogEnableBits _Microsoft_Windows_EventlogKeywords _Microsoft_Windows_EventlogLevels _NotifyChangeEventLog@8 _NtCurrentTeb@0 _OpenBackupEventLogA@8 _OpenBackupEventLogW@8 _OpenEventLogA@8 _OpenEventLogW@8 _PRIMARY_CHANNEL_CONFIGURATION_WARNING _PRIMARY_CHANNEL_FATAL_ERROR _ReadEventLogA@28 _ReadEventLogW@28 _RegisterEventSourceA@8 _RegisterEventSourceW@8 _ReportEventA@36 _ReportEventW@36 _RtlAlternateDosPathSeperatorString _RtlDosPathSeperatorsString _RtlNtPathSeperatorString _StringCheck@16 _WevtInitialize@12 ___@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUrDIGUkivxlnkOlyq@elfapi _eventlog_ClientIfHandle // 1606895243 0 369 `
d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\rpcbind.obj d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\apistub.obj d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\eventapi.obj d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\elf_client.obj d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\precomp.obj
/0 1606895243 100666 8290 `
L �F�_x 4 .debug$S � @ B.rdata � @0@.rdata � @0@.rdata � @0@.rdata � @0@.rdata � @0@.text$mn M Y `.debug$S h � � @B.text$mn � � `.debug$S t � " @B.text$mn � | ] `.debug$S � � W @B.text$mn = N `.debug$S t X � @B.debug$T � & @ B.chks64 � �
.drectve n
� � O d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\rpcbind.obj : < � k k
Microsoft (R) Optimizing Compiler � ` 9 q ����o� }�+4qt*Y lռ��́dq�X � N~ط �K��� �h��-l��A��D�� � � onecore\admin\wmi\events\advapi\objfre\i386\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\i386\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\admin\wmi\events\advapi\rpcbind.c $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 12 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 12 - ^ = $24 $T0 16 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 20 - ^ = � L-^ \ \ . . e v e n t l o g n c a l r p c E V E N T L O G ��U����u�E�P� �e� �E�jP�E�P� ��xV�u�� ��E�P� ��^�3��� % 2 / > � D M � . � � � < G M I ^ �EVENTLOG_HANDLE_A_bind >p ServerName E D >> ServerNameU D���� > bindingHandle A 8
>D ServerNameA D� > Status A )
Z ^ �" p ServerName ����> ServerNameU �D ServerNameA 9 ^ 9# $^ 9< %^ O � h M 8
\ � � � � � � � �) � �- � �8 � �B � �G � �I � � - x - | -
� - � -
- -
D - H -
� - � -
� - � -
� - � -
- -
��U��u � ]� � $ � � > G
^ �EVENTLOG_HANDLE_A_unbind >p ServerName E D > BindingHandle E D
Z ^ �" p ServerName BindingHandle O� 0 8 $ � � � �
� � , X , \ ,
� , � ,
� , � ,
D , H ,
��U��QQ�MVW3��}����� � ��f�0f;2u f��tf�pf;ru����f��uދ�������tMf99tH� ��f�0f;2u f��tf�pf;ru����f��uދ�������t�E�PWh Q� �8�E�PWh Wh W� ��u"�E�P�u�� ��E�P� ��u�E��3�_^�� U
� � �
� � � � � d � � � � � I � � < G � � ^ �EVENTLOG_HANDLE_W_bind >q ServerName A
� � E D > bindingHandle D���� > status A � A � A � A � >q sb D����
Z ^ �" q ServerName ���� bindingHandle
����q sb 9� ^ 9� ^ 9� ^ O � x � 8 l 9 � A �� \ �� a �� F �� M �� O �� Q �� S �� b �� Y �� b � / � / � /
� / � /
� / � /
4 / 8 /
D / H /
T / X /
d / h /
� / � /
� / /
/ /
( / , /
��U��u � ]� � $ � � > G
^ �EVENTLOG_HANDLE_W_unbind >q ServerName E D > BindingHandle E D
Z ^ �" q ServerName BindingHandle O� 0 8 $ { � ~ �
� . X . \ .
� . � .
� . � .
D . H .
V N ���%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\i386\precomp.obj ��� q ^ & ^ EVENTLOG_HANDLE_W_unbind ���
^ ^ RpcpUnbindRpc �� p ^ & ^ EVENTLOG_HANDLE_A_unbind ���
q
^ " ^ EVENTLOG_HANDLE_W_bind �
� q q q
^ ^ ^ RpcpBindRpc q q q q q �Y ^
^
� q
^ ^
^
�
�Y ^
^
�
p ^ " ^ EVENTLOG_HANDLE_A_bind �
� B ^ ^
^
�
A
� < !^ "^
#^
�
g
�
���
���
���
���� -FC -MT -c -Zl -Zp8 -Gy -Gm- -W4 -Gz -hotpatch -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 ��
*^ f +^ -arch:IA32 -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X � &^ '^ (^ )^ ,^ ����8��Ѝ,k:Qӌ�E��Y7�3dxe� �}�K�< �>1T�_+�p ���=d�H_�Tήr�D��?�ujw�� ppR]d�����X`�8w�D��?�u�_���\�'X qOT� -INCLUDE:___@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUrDIGUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� @vol.md �� .debug$S e .rdata �(9 e .rdata
��@ e ) .rdata ;�na e B .rdata �֗] e .rdata �d�� e � � 9 T e u � � .text$mn M dH�m e .debug$S h e .text$mn �}* e .debug$S
t e .text$mn � ��
� e .debug$S � e .text$mn
�}* e .debug$S t
e � �
( .debug$T � e .chks64 � e B ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4@ ??_C@_13JOFGPIOO@?$AA?4@ ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg@ ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc@ ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG@ __imp__RtlFreeUnicodeString@4 __imp__RtlAnsiStringToUnicodeString@12 __imp__RtlInitAnsiString@8 _RpcpUnbindRpc@4 _RpcpBindRpc@16 __imp__RpcStringFreeW@4 __imp__RpcBindingFromStringBindingW@8 __imp__RpcStringBindingComposeW@24 _EVENTLOG_HANDLE_A_unbind@8 _EVENTLOG_HANDLE_A_bind@4 _EVENTLOG_HANDLE_W_unbind@8 _EVENTLOG_HANDLE_W_bind@4 /73 1606895243 100666 110477 `
L� �F�_um � .debug$S � d# <0 @ B.rdata P0 @0@.rdata b0 @0@.rdata n0 @0@.data 8 w0 �0 @@�.rdata
�0 @0@.rdata h �0 @@@.rdata B1 @@@.rdata R1 @@@.rdata b1 @@@.rdata r1 @@@.rdata �1 @@@.rdata �1 @@@.rdata �1 @@@.rdata �1 @@@.rdata �1 @@@.rdata �1 @@@.rdata �1 @@@.rdata �1 @@@.rdata 2 @@@.rdata 2 @@@.rdata "2 @@@.rdata 22 @@@.rdata B2 @@@.rdata R2 @@@.rdata b2 @@@.rdata r2 @@@.rdata �2 @@@.rdata �2 @@@.rdata �2 @@@.rdata �2 @@@.rdata �2 @@@.rdata �2 @@@.rdata �2 @@@.rdata �2 @@@.rdata 3 @@@.rdata 3 @@@.rdata "3 @@@.rdata 23 @@@.rdata B3 @@@.rdata R3 @@@.rdata b3 @@@.rdata r3 @@@.rdata �3 @@@.rdata �3 @0@.text$mn U �3 �3 `.debug$S � 4 �5 @B.text$mn � �6 >7 `.debug$S l �7 �: # @B.debug$F X< h< @B.text$mn � r< = `.debug$S l _= �@ # @B.debug$F )B 9B @B.text$mn � CB �B `.debug$S � 2C �F ) @B.debug$F �H �H @B.text$mn � �H 2I `.debug$S D �I �L ! @B.debug$F N N @B.text$mn � *N �N `.debug$S D O JR ! @B.debug$F �S �S @B.text$mn w �S %T `.debug$S � kT �V @B.debug$F �W �W @B.text$mn x X Y `.debug$S � �Y �^ - @B.text$mn y` `.debug$S $ �` �a @B.text$mn w �a bb `.debug$S � �b 8e @B.debug$F 2f Bf @B.text$mn . Lf zf `.debug$S T �f �g
@B.text$mn dh `.debug$S lh �i @B.text$mn � �i mj `.debug$S ` �j o - @B.debug$F �p �p @B.text$mn % �p `.debug$S � q �r @B.text$mn ( |s `.debug$S h �s u @B.text$mn zu `.debug$S 4 �u �v @B.text$mn � w �w `.debug$S d x f{ # @B.debug$F �| �| @B.text$mn � �| u} `.debug$S h �} -� # @B.debug$F �� �� @B.text$mn � �� z� `.debug$S � �� v� # @B.debug$F Ԉ � @B.text$mn � � ĉ `.debug$S � � ̍ # @B.debug$F *� :� @B.text$mn U D� �� `.debug$S L %� q� ) @B.debug$F � � @B.text$mn s %� �� `.debug$S l B� �� + @B.debug$F \� l� @B.text$mn � v� ^� `.debug$S � �� .� 5 @B.debug$F @� P� @B.text$mn � Z� B� `.debug$S � �� � 5 @B.debug$F $� 4� @B.text$mn : >� x�
`.debug$S � ܴ �� @B.debug$F �� ¹ @B.text$mn ̹ `.debug$S � Թ �� @B.text$mn � �� � `.debug$S 6� F� % @B.debug$F �� �� @B.text$mn �� �� `.debug$S L� h� % @B.debug$F �� �� @B.text$mn � �� �� `.debug$S � 4� � A @B.debug$F �� �� @B.text$mn �� `.debug$S �� �� # @B.text$mn � /� `.debug$S � � �� E @B.debug$F W� g� @B.text$mn = q� �� `.debug$S | �� >� @B.text$mn �� `.debug$S � �� R� @B.text$mn �� `.debug$S � �� �� @B.text$mn � `.debug$S � !� �
@B.text$mn k� y� `.debug$S @ �� � @B.text$mn ' � � `.debug$S l � �� @B.text$mn ' @ g `.debug$S � q
@B.text$mn G � � `.debug$S � � � @B.text$mn L � `.debug$S � " �
@B.text$mn ^ h � `.debug$S $ �
@B.text$mn ` �
`.debug$S P 0 � @B.text$mn > `.debug$S � E � @B.text$mn 9 / h `.debug$S � � h @B.voltbl � .xdata$x � � @@@.xdata$x # @@@.xdata$x 7 S @@@.xdata$x g � @@@.xdata$x � � @@@.xdata$x � � @@@.xdata$x � @@@.xdata$x ' C @@@.xdata$x W s @@@.xdata$x � � @@@.xdata$x � � @@@.xdata$x � @@@.xdata$x 3 @@@.xdata$x G c @@@.xdata$x w � @@@.xdata$x � � @@@.xdata$x � � @@@.xdata$x # @@@.voltbl 7 .xdata$x 8 T @@@.xdata$x h � @@@.xdata$x � � @@@.voltbl � .voltbl � .gfids$y � @0@.voltbl � .debug$S , � � @B.debug$S < K @B.debug$S @ _ � @B.debug$S , � � @B.debug$S 4 � ' @B.debug$S < ; w @B.debug$S 0 � � @B.debug$S 4 � @B.debug$S 0 G @B.debug$S @ [ � @B.debug$S 4 � � @B.debug$S 8 � / @B.debug$S , C o @B.debug$S 4 � � @B.debug$S , � � @B.debug$S 4 ? @B.debug$S 0 S � @B.debug$S 0 � � @B.debug$S 0 � @B.debug$S @ _ @B.debug$S @ s � @B.debug$S 4 � � @B.debug$S , ; @B.debug$S , O { @B.debug$S , � � @B.debug$S 0 � � @B.debug$S 4 ! G! @B.debug$S , [! �! @B.debug$S < �! �! @B.debug$S @ �! +" @B.debug$S @ ?" " @B.debug$S 8 �" �" @B.debug$S < �" # @B.debug$S 8 /# g# @B.debug$S H {# �# @B.debug$S < �# $ @B.debug$S 0 '$ W$ @B.debug$S 4 k$ �$ @B.debug$S 4 �$ �$ @B.debug$S ( �$ #% @B.debug$S $ 7% [% @B.debug$T 4 o% @ B.sxdata �B 0 .chks64 �B
.drectve n m
� � O d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\apistub.obj : < � k k
Microsoft (R) Optimizing Compiler � ? @ ComputerNameNetBIOS " t^ ApiElfOpenBackupEventLogA # t^ ApiElfRegisterEventSourceA t^ ApiElfOpenEventLogA " t^ ApiElfOpenBackupEventLogW # t^ ApiElfRegisterEventSourceW t^ ApiElfOpenEventLogW � SecurityImpersonation 1
� Microsoft_Windows_EventlogEnableBits � B B^ MCGEN_TRACE_CONTEXT �^ PMCGEN_TRACE_CONTEXT B^ _MCGEN_TRACE_CONTEXT t^ ELF_API_TYPE /^ STRING_STORAGE �^ PSTRING_STORAGE !^ PRIVILEGE_STATUS �^ PPRIVILEGE_STATUS !^ tagPrivilegeStatus �^ PRECONN_INFO t^ tagElfApiType /^ tagStringStorage {^ tagReconnInfo � � 9 q �4y4[G�c �c��e��U�W,Qᨵ7�� � ����o� }�+4qt*Y lռ��́dq�X � . �<��� 5�)ڀ�~B�G?_�M�MZ��{� � �^h����j[�|�-� ������0f'�M{Ft ' 4(���+C�h5J$t�J���h 8�ϽgX�� � @ ^ / ^ � ' ^ ` , ^ ` O^ � � f onecore\admin\wmi\events\advapi\objfre\i386\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\i386\precomp.pch onecore\internal\sdk\inc\nxi386.h onecore\admin\wmi\events\advapi\precomp.h onecore\admin\wmi\events\advapi\apistub.c onecore\admin\wmi\events\manifests\objfre\i386\EventLogEvents.h onecore\external\shared\inc\evntprov.h $T0 .raSearch = $eip $T0 ^ = $esp $T0 4 + = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 4 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 56 - ^ = $23 $T0 60 - ^ = $24 $T0 64 - ^ = $T0 $ebp = $T2 $esp = $T1 .raSearchStart = $eip $T1 ^ = $ebp $T0 = $esp $T1 4 + = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 40 - ^ = $23 $T0 44 - ^ = $24 $T0 48 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 4 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 4 - ^ = $23 $T0 8 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 4 - ^ = $23 $T0 8 - ^ = $24 $T0 12 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 56 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 60 - ^ = $23 $T0 64 - ^ = $24 $T0 68 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 68 - ^ = $23 $T0 72 - ^ = $24 $T0 76 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 4 - ^ = $20 $T0 8 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 4 - ^ = $20 $T0 8 - ^ = $24 $T0 12 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 64 - ^ = $23 $T0 68 - ^ = $24 $T0 72 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 48 - ^ = $23 $T0 52 - ^ = $24 $T0 56 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 112 - ^ = $23 $T0 116 - ^ = $24 $T0 120 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 108 - ^ = $23 $T0 112 - ^ = $24 $T0 116 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 128 - ^ = $23 $T0 132 - ^ = $24 $T0 136 - ^ = � L_ � 8 � 8
S e c u r i t y Application Security
, 8 0 A 4 > � � � � � � � @ @p �T
e @S
e @R
e @Q
i @P
e @O
e @N
h @M
e @L
g @� m � m � m � m � m � m � m m e l l �j �i i �h h �g e f e d e ( � d � d � � d � d � d � d � d � d � d � d ���e���bI��n\���H��U��d� 3�V�u 9�� uj� 3Ʌ����F�N�MPjjQ�N� 3��AvrP�����N ^]� 7 < 6 � D U { C � � A > G U Q R^ �ElfAssertThreadPrivilege > Privilege A 1 E D
>$^ p A @ E D M ^ N �"
h ^ Privilege $^ p 9 U^ 9: ,^ O � H U ` < 1 � 2 � : �( > �B B �Q C � � x � | �
� � � �
� � � �
� � � �
� �
y � } �
� � � �
� � � �
j(h � �]�u 3��}Ы������tf3�f9>t_�E�Pj� S� ��t8�}�VP� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� ����
��M�d�
Y_^[�� ! � . � 4 � B a ) n ( ~ � � D � 8 � T 8 m � i < G � � �^ �ElfBackupEventLogFileA > LogHandle A | 7 . E D >B BackupFileName A y 4 . g
E D
>!^ Priv D��� > RpcHandle A 8 D . > status A F . * A H > . A �
D��� Z R^ ^ �^ '^ 8 @�"
:��
:���� $LN10 $LN13 $LN16 $LN9 LogHandle B BackupFileName ���!^ Priv ��� status 9_ j^ 9l m^ O � � � ` � � � � � � �' �2 �8 �< �? �F . �T �i ! �r �t ' �y . �� 0 �� �� 1 � � x � | �
� � � �
� � � �
� � � �
� �
Z � ^ �
� � �
� � � �
� � � �
� ! � !
�
�
� �
+ � / �
< � @ �
� � � �
� � � �
� � � �
T � j(h � �]�u 3��}Ы������tf3�f9>t_�E�Pj� S� ��t8�}�VP� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� ����
��M�d�
Y_^[�� < � . � 4 � B a ) n ( ~ � � D � 8 � T 8 m � i < G � � �^ �ElfBackupEventLogFileW > LogHandle A | 7 . E D >< BackupFileName A y 4 . g
E D
>!^ Priv D��� > RpcHandle A 8 D . > status A F . * A H > . A �
D��� Z R^ ^ �^ '^ 8 @�"
:��
:���� $LN10 $LN13 $LN16 $LN9 LogHandle < BackupFileName ���!^ Priv ��� status 9_ j^ 9l m^ O � � � ` � P � S � Y �' i �2 p �8 q �< s �? u �F � �T y �i { �r y �t � �y � �� � �� [ �� � � � x � | �
� � � �
� � � �
� � � �
� �
Z � ^ �
� � �
� � � �
� � � �
� < � <
�
�
� �
+ � / �
< � @ �
� � � �
� � � �
� � � �
T � j,h � �u�] 3��}Ы����d� �x �@$�E̍E�Pj� V� ��t=�e� S�u�WP� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� �ƋM�d�
Y_^[�� N � 2 � 8 � K % j ) w ( � � � D � < 2 ] < m � � 5 G � � �^ �ElfChangeNotify > LogHandle A s @ . E D > Event A � = . E D
>!^ Priv D��� > RpcHandle A < I . >� RpcClientId C % t * . C ( C O E A ��� � > status A O . * A Q I . D��� M ^ N Z R^ ^ �^ '^ < @�"
h ^
:��
:���� $LN8 $LN13 $LN16 $LN7 LogHandle Event ���!^ Priv ��� status 9h j^ 9u m^ O� � � ` � $ � * � 0 �+ 7 �6 ? �< @ �@ B �D D �O R �] G �r I �{ G �} O �� R �� T �� U � � x � | �
� � � �
� � � �
� � � �
� �
F � J �
t � x �
� � � �
� � � �
� � � �
� � � �
� � � �
@ N D N
r v
� �
� �
� �
� �
� �
( � , �
] � j(h � �u�] 3��}Ы�����E�Pj� V� ��t9�e� SP� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� �ƋM�d�
Y_^[�� $ � # � ) � 8 W ) d ( t � � D � 8 � J 8 m � S ; G � z �^ �ElfClearEventLogFileA > LogHandle A ` - . E D >B BackupFileName A v * . E D
>!^ Priv D��� > RpcHandle A - E . > status A < . * A > I . D��� Z R^ ^ �^ '^ 8 @�"
:��
:���� $LN8 $LN11 $LN14 $LN7 LogHandle B BackupFileName ���!^ Priv ��� status 9U j^ 9b m^ O � � � ` � � � � � � �' � �- � �1 � �5 � �< � �J � �_ � �h � �j � �o � �x � �z � � � x � | �
� � � �
� � � �
� � � �
� �
U � Y �
z � ~ �
� � � �
� $ � $
� � � �
� �
� �
& � * �
� � � �
� � � �
� � � �
J � j(h � �u�] 3��}Ы�����E�Pj� V� ��t9�e� SP� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� �ƋM�d�
Y_^[�� ? � # � ) � 8 ! W ) d ( t � � D � 8 � J 8 m � S ; G � z �^ �ElfClearEventLogFileW > LogHandle A ` - . E D >< BackupFileName A v * . E D
>!^ Priv D��� > RpcHandle A - E . > status A < . * A > I . D��� Z R^ ^ �^ '^ 8 @�"
:��
:���� $LN8 $LN11 $LN14 $LN7 LogHandle < BackupFileName ���!^ Priv ��� status 9U j^ 9b m^ O � � � ` � � � �' �- �1 �5 �< - �J " �_ $ �h " �j * �o - �x / �z 0 � � x � | �
� � � �
� � � �
� � � �
� �
U � Y �
z � ~ �
� � � �
� ? � ?
� � � �
� �
� �
& � * �
� � � �
� � � �
� � � �
J � jh � �u� �E�tC�e� �E�P� � �E� � �E�P� Ëe�u� ��u��E������u� �� ��ƋM�d�
Y_^[�� 9 � � $ 7 ) D ( X � � D w $ � * $ m � � 6 G w e �^ �ElfCloseEventLog > LogHandle E D > RpcHandle D�� > status A ( " A J ( D��� Z ^ �^ ^ $ @�"
:��� $LN8 $LN11 $LN14 $LN7 LogHandle �� RpcHandle ��� status 95 j^ 9B m^ O� � w `
t � � � � � � � � � �( � �* � �? � �H � �\ � �^ � �c � �e � � � x � | �
� � � �
� � � �
�
�
E 9 I 9
_ � c �
o � s �
� � � �
� � � �
� � � �
� � � �
� �
* � ��U��S�] VWj(Y��t �{ t�Cȋ}��t � t�G�Qj� P� ���$ d� 3ɋU�V9�� ���N���� ��~s���� ��t.�{ t(�F(3ɉFf�Cf�F�F SPf�� �CF�F���� � �� �~ u�F(�Ff�G3�f�F�FWPf�� �`��t.�{ t(�F(3ɉFf�Cf�F�F SPf�� �CF�F��t*� t$�~ u�F(�Ff�G3�f�F�FWPf�� �E�f �F �E�F$���CflE�Vj � P� 3�_^[]� 6 3 = 4 � 1 � 1 2 A 2 d 3 k 0 � � x { n /
i y g � � 9 G x t x^ �ElfCreateReconnInfo >t^ ApiType A V � M B E D >1^ UNCServerName A k E D >1^ ModuleName A ! Q E D >t IsSecurityLog E D > RpcHandle E D >}^ recInfo A C 0 >" structSize A A 1 M ^ K N �"
h ^ t^ ApiType 1^ UNCServerName 1^ ModuleName t IsSecurityLog RpcHandle 94 ^ 9; �^ ^; y^ 9� �^ 9� �^ 9 �^ 9? �^ 9b ^ 9i ^ O � @ x ` % 4 � � � � � � � �+ � �1 � �C � �K � �e � �{ � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � �
� � � �! � �' � �- � �1 � �: � �E � �H � �U � �_ � �o � � � � � � �
� � � �
� �
5 � 9 �
I � M �
v � z �
� � � �
� � � �
� � � �
� �
= � A �
M � Q �
� �
� # �
/ � 3 �
? � C �
O � S �
_ � c �
o � s �
� � �
� � � �
� � � �
� �� � $ N � � = G ^ �ElfDeregisterClusterSvc >< UNCServerName E D �" < UNCServerName O � 0 ` $ L � P � Q � � X � \ �
� � � �
� � � �
jh � �u� �E�tC�e� �E�P� � �E� � �E�P� Ëe�u� ��u��E������u� �� ��ƋM�d�
Y_^[�� 6 � � $ 7 ) D ( X � � D w $ � * $ m � � > G w e o^ �ElfDeregisterEventSource > LogHandle E D > RpcHandle D�� > status A ( " A J ( D��� Z ^ r^ ^ $ @�"
:��� $LN8 $LN11 $LN14 $LN7 LogHandle �� RpcHandle ��� status 95 j^ 9B m^ O� � w `
t � � � � � � � � � �( � �* � �? � �H � �\ � �^ �c �e � � x � | �
� � � �
� � �
� �
M 6 Q 6
g � k �
w � { �
� � � �
� � � �
� � � �
� � � �
� �
* � ��U��E��t �8CflEuPj � CdaB� P� ]� 3 & 0 � $ . { � � @ G . * ^ �ElfDestroyReconnectionInfo > LogHandle A E D �" LogHandle 9 ^ 9$ ^ O � 8 . ` , � � � � � �* � � � X � \ �
� � � �
� � � �
� � � �
� �
� �
�" �� � $ N � � 6 G �^ �ElfFlushEventLog > LogHandle E D �" LogHandle O � 0 ` $ w � | � � � � X � \ �
� � � �
� � � �
j,h � �u�]�E�E�3��}Ы�����E�Pj� �} t�H ��PV� ��tA�e� �u�uSj P� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� �ƋM�d�
Y_^[�� K � ) � < � S $ r ) ( � � � D � < 2 e < m � ` : G � � �^ �ElfGetLogInformation > LogHandle A { ) H . E D >" InfoLevel E D > lpBuffer A x E . E D >" cbBufSize E D >" pcbBytesNeeded D��� A E D
>!^ Priv D��� > RpcHandle A @ J . A � > status A W . * A 8 $ A � D��� Z R^ ^ �^ '^ < @�"
:��
:���� $LN12 $LN15 $LN18 $LN11 LogHandle " InfoLevel lpBuffer " cbBufSize " pcbBytesNeeded ���!^ Priv ��� status 9p j^ 9} m^ O� � � ` � _ � b �" g �- m �3 � �: p �@ q �D s �H u �W � �e x �z z �� x �� � �� � �� � �� � � � x � | �
� � � �
� � � �
� � �
' � + �
? � C �
o � s �
� � � �
� � � �
� � �
� �
4 � 8 �
H � L �
\ � ` �
� K � K
� �
� �
� �
� �
� � � �
� � � �
� � � �
e � ��U��U��u3��jX;B�E �A��B]� � $ % { � G 6 G % ! 4^ �ElfGetModuleName > LogHandle A E D " >t ModuleNameIsUnicodeString E D >1^ result A ! A �" LogHandle $ t ModuleNameIsUnicodeString O � @ % ` 4 5 � 9 � ; � I �! L � � X � \ �
� � � �
� � � �
� � � �
�
�
� �
� � � �
��U��E3Ʌ�t���t�8CflEu�H$���3�]� � $ ( { � � 8 G ( $ ^ �ElfGetTheRpcHandle > LogHandle A E D > result A
�" LogHandle O � P ( ` D �
� � � �"
�$ � � X � \ �
� � � �
� � � �
� � � �
� �
��U��E��t�@ ]� � $ { � � @ G ^ �ElfGetUseLegacyReportEvent > LogHandle A E D �" LogHandle O � 8 ` , � � $ � % � � X � \ �
� � � �
� � � �
� � �
j(h � �]�u 3��}������u�
��^�E�Pj� S� ��t9�e� VP� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� �ƋM�d�
Y_^[�� W � . � 4 � C ' b ) o ( � � D � 8 � U 8 m � b 8 G � � �^ �ElfNumberOfRecords > LogHandle A v 8 . E D >" NumberOfRecords A h 5 . E D
>!^ Priv D��� > RpcHandle A 8 E . > status A G . * A I < . A �
D��� Z R^ ^ �^ '^ 8 @�"
:��
:���� $LN9 $LN12 $LN15 $LN8 LogHandle " NumberOfRecords ���!^ Priv ��� status 9` j^ 9m m^ O � � � ` � � � � � � � � �' � �2 � �8 � �< � �@ � �G � �U � �j � �s � �u � �z � �� � �� � � � x � | �
� � � �
� � � �
� � � �
� �
S � W �
x � | �
� � � �
� � � �
� W � W
# '
4 8
� � � �
� � � �
� � � �
U � j(h � �]�u 3��}������u�
��^�E�Pj� S� ��t9�e� VP� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� �ƋM�d�
Y_^[�� T � . � 4 � C & b ) o ( � � D � 8 � U 8 m � e 5 G � � �^ �ElfOldestRecord > LogHandle A v 8 . E D >" OldestRecordNumber A h 5 . E D
>!^ Priv D��� > RpcHandle A 8 E . > status A G . * A I < . A �
D��� Z R^ ^ �^ '^ 8 @�"
:��
:���� $LN9 $LN12 $LN15 $LN8 LogHandle " OldestRecordNumber ���!^ Priv ��� status 9` j^ 9m m^ O � � � ` � � � � � � � � �' �2 �8 �<
�@ �G �U �j �s �u �z �� �� � � x � | �
� � � �
� � � �
� � � �
� �
S � W �
x � | �
� � � �
� � � �
� T � T
# '
4
8
� � � �
� � � �
� � � �
U � jh � �} �� �E ���� 3�f90�� �E��t
f90t�@��Ɖu�u��M�Qjj�u P� ���}��E������,�E� � �E�P� Ëe�u� ���}��E�����3���x!�u�V�u �uj� �M���u � ���E�0����
��M�d�
Y_^[�� ' � R q ) ~ ( � � � D � $ � d $ m � � < G � � �^ �ElfOpenBackupEventLogA >B UNCServerName A / E D >B FileName A E D >�V LogHandle E D > RpcHandle D�� > status A X ] ) / , A � D��� >p ServerNameString A ; Z �^ x^ $ @�"
:��� $LN13 $LN16 $LN18 $LN12 B UNCServerName B FileName �V LogHandle �� RpcHandle ��� status 9o j^ 9| m^ O � � � ` � [ � d �, i �8 k �; l �= o �? r �B t �E v �[ | �d } �y �� } �� � �� � �� � �� � �� � �� � �� � �� f �� � � � x � | �
� � � �
� � � �
� � � �
� �
= � A �
� � � �
� � � �
� � � �
' '
� �
, � 0 �
= � A �
N � R �
� � � �
� � � �
� � � �
d � jh � �} �� �E ���� 3�f90�� �E3�A��t
f9v�@��Ɖu�u��U�RQQ�u P� ���}��E������,�E� � �E�P� Ëe�u� ���}��E�����3���x!�u�V�u �uj� �M���u � ���E�0����
��M�d�
Y_^[�� B � S " r ) ( � � � D � $ � e $ m � � < G � � �^ �ElfOpenBackupEventLogW >< UNCServerName A / E D >< BackupFileName A E D >�V LogHandle E D > RpcHandle D�� > status A Y ] ) / , A � D��� >q ServerNameString A > Z �^ x^ $ @�"
:��� $LN13 $LN17 $LN19 $LN12 < UNCServerName < BackupFileName �V LogHandle �� RpcHandle ��� status 9p j^ 9} m^ O � � � ` � � � � �, � �; � �> � �@ � �B � �E � �H � �\ � �e � �z � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � x � | �
� � � �
� � � �
� � �
� �
C � G �
� � � �
� � � �
� � � �
B B
! � % �
2 � 6 �
C � G �
T � X �
� � � �
� � � �
� �
e � j\h � �U�U��] �]��M�M�3��}������3��}������� ���� 3�f93�� ��t
f92t�z���h �E�P� �u��sh � YY3Ʌ����M��M���u �E�Pj� �E�Pj� �u��E�Pjj�E�PSW� ���}��E������/�E� � �E�P� Ëe�u�� ���}��E�����3��]��E�P� �}� t �E�P� ��x!�u��u�S�u�j� �M����u � ���E��0����
��M�d�
Y_^[�� - � ^
h . s
x � � � � � + � ) � ( � � � ! � � D U l � l m � � 6 G U C �^ �ElfOpenEventLogA >B UNCServerName D���� A 4] � E D >B LogName D���� A <� / E D >�V LogHandle D���� A (Q � E D >t fIsSecurityLog A � D���� > RpcHandle D���� >D RegModuleName D���� >!^ BackPriv D��� > status A � x ) / G A : D���� >!^ SecPriv D���� >p ServerNameString A Y d " Z �^ R^ R^ \^ '^ '^ x^ l @�"
:��
:���� $LN15 $LN18 $LN20 $LN14 B UNCServerName B LogName �V LogHandle ����t fIsSecurityLog ���� RpcHandle ����D RegModuleName ���!^ BackPriv ���� status ����!^ SecPriv 9f h^ 9� j^ 9� m^ O � U ` s � y �( z �2 � �M � �V � �Y � �[ � �] � �l � �o � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � � � � � �* � �. � �3 � �5 � �: � �> � �C � � � x � | �
� � � �
� � � �
� �
� �
N � R �
f � j �
� � � �
� �
/ � 3 �
� � � �
� - � -
� � � �
� � � �
� �
� ! �
� � � �
�
�
� �
4 � 8 �
� � j\h � �U�U��] �]��M�M�3��}������3��}�������" ��� �f��� 3�F��t
f92v�z�3�� t�s��Ph h � j �E�P� �e� �sh � YY3Ʌ����M��M���u �E�Pj� �E�Pj� �e� �E�PVV�E�PSW� ��u��E������-�E� � �E�P� Ëe�u�� ��u��E������]��E�P� �}� t �E�P� ��x!�u��u�S�u�j � �M����u
� ���E�� ����
��M�d�
Y_^[�� H � c 8 q k v ; { � � / � � # � � � � � - � ) ( � ) � > � � D s l � l m � � 6 G s a �^ �ElfOpenEventLogW >< UNCServerName D���� A Rp � E D >< LogName D���� A Z� - E D >�V LogHandle D���� A Fd � E D >t fIsSecurityLog A � D���� > RpcHandle D���� >> RegModuleName D���� >!^ BackPriv D��� > status A � v ) / E A X D���� >!^ SecPriv D���� >q ServerNameString A ] � A X G & Z �^ �^ R^ R^ a^ '^ '^ x^ l @�"
:��
:���� $LN17 $LN21 $LN23 $LN16 < UNCServerName < LogName �V LogHandle ����t fIsSecurityLog ���� RpcHandle ����> RegModuleName ���!^ BackPriv ���� status ����!^ SecPriv 9� d^ 9� j^ 9 m^ O � s ` ! � � � �( � �2 � �N � �Z � �] � �_ � �a � � � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � �$ �- �1
�G �K �P �R �X �\ � �a � � x � | �
� � � �
� � � �
� �
� �
N � R �
f � j �
� � � �
� �
/ � 3 �
� � � �
� � � �
� H � H
� �
� �
$ (
5 9
� �
! � % �
1 � 5 �
L � P �
� � j0h � �E�E̋M�Mȋu �] 3��}Ы�������� ���� ���� �E ������ ��t~�E �� �� ts��to�E�Pj� �u�� ��tF�e� SV�u�u�u�u P� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� ����
��M�d�
Y_^[�� � i � q � � � ) � ( � � � D � @ � � @ m � ] 6 G � � �^ �ElfReadEventLogA > LogHandle D��� A E D >" ReadFlags E D >" RecordNumber E D > Buffer D��� A � X d E D >" NumberOfBytesToRead E D >" NumberOfBytesRead A � v . �
E D >" MinNumberOfBytesNeeded A � s . E D
>!^ Priv D��� > RpcHandle A u R . >" FlagBits A C " A � > status A � . * A � > . A �
D���� Z R^ ^ �^ '^ @ @�"
:��
:���� $LN14 $LN17 $LN20 $LN13 LogHandle " ReadFlags " RecordNumber Buffer " NumberOfBytesToRead " NumberOfBytesRead ! " MinNumberOfBytesNeeded ���!^ Priv ���� status 9� j^ 9� m^ O � � � ` � N � R �( X �@ a �F d �S i �Y l �b t �m v �u w �y y �} { �� � �� � �� � �� � �� � �� � �� � �� Z �� � � � x � | �
� � � �
� � � �
� � � �
+ � / �
\ � ` �
t � x �
� � � �
� � � �
� � �
7 � ; �
O � S �
� � � �
� � � �
� � � �
� � � �
� � �
� �
N R
t � x �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � j0h � �E�E̋M�Mȋu �] 3��}Ы�������� ���� ���� �E ������ ��t~�E �� ��ws��to�E�Pj� �u�� ��tF�e� SV�u�u�u�u P� ��u��E������%�E� � �E�P� Ëe�u� �Ҿ ��E�P� ����
��M�d�
Y_^[�� 3 � i � q � � � ) � ( � � � D � @ � � @ m � ] 6 G � � �^ �ElfReadEventLogW > LogHandle D��� A E D >" ReadFlags E D >" RecordNumber E D > Buffer D��� A � X d E D >" NumberOfBytesToRead E D >" NumberOfBytesRead A � v . �
E D >" MinNumberOfBytesNeeded A � s . E D
>!^ Priv D��� > RpcHandle A u R . >" FlagBits A C " A � > status A � . * A � > . A �
D���� Z R^ ^ �^ '^ @ @�"
:��
:���� $LN14 $LN17 $LN20 $LN13 LogHandle " ReadFlags " RecordNumber Buffer " NumberOfBytesToRead " NumberOfBytesRead ! " MinNumberOfBytesNeeded ���!^ Priv ���� status 9� j^ 9� m^ O � � � ` � % � ) �( / �@ 8 �F : �S ? �Y A �b I �m K �u L �y N �} P �� d �� Y �� [ �� Y �� a �� d �� f �� 1 �� g � � x � | �
� � � �
� � � �
� � � �
+ � / �
\ � ` �
t � x �
� � � �
� � � �
� � �
7 � ; �
O � S �
� � � �
� � � �
� � � �
� � � �
� � �
� �
N 3 R 3
t � x �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � j$h � 3��}�u���
�>CflE�� d� 9�� �� 9~�� W�E�P� W�E�P� �}��F+�te��tFH��t&��t� ��f�E�Pjj�E�P�FP�v� �L�E�Pjj�E�P�FP�v� �2�E�Pjj�E�P�FP�v� ��E�Pjj�E�P�FP�v� �E��E������+�E� � �E�P� Ëe�u� �E��E������u��x�E�F$�E��3��M�d�
Y_^[�� Z � J / U . � * � + � , � - � ) ( � D : 4 � � 4 m � q 2 G : ( V^ �ElfReconnect > LogHandle A !� + E D >> RegModuleNameW D��� >D RegModuleNameA D��� > RpcHandle D�� > status A x k 6 P D�� M ^ ( N Z [^ \^ `^ a^ 4 @�"
h ^
:���� $LN18 $LN24 $LN27 $LN17 LogHandle ���> RegModuleNameW ���D RegModuleNameA �� RpcHandle �� status 9H d^ 9S h^ 9� j^ 9 m^ O � � : ` � O � U � Z �( ` �C h �N i �Y k �\ m �s � �z � �� � �� � �� � �� z �� � �� p �� � �� � � � �
� � � � � �! � �& \ �( � � � x � | �
� � � �
� � � �
G � K �
� Z � Z
� �
� �
� �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �� � $ N � K ; G ^ �ElfRegisterClusterSvc >< UNCServerName E D >" pulSize E D >
^ ppPackedEventInfo E D �" < UNCServerName " pulSize
^ ppPackedEventInfo O � 0 ` $ ? � E � F � � X � \ �
� � � �
� � � �
� � �
� � � �
j h � �} �� �E ���� 3�f90�� �E��t
f90t�x���h �E�P� �u�u��E�Pjj�E�P�u W� ���}��E������,�E� � �E�P� Ëe�u� ���}��E�����3���x!�u�V�u �uj� �M���u � ���E�0����
��M�d�
Y_^[�� * � @
J . e * � ) � ( � � � D � , � w , m � � = G � � �^ �ElfRegisterEventSourceA >B UNCServerName A / E D >B ModuleName A E D >�V LogHandle E D > RpcHandle D�� >D RegModuleName D��� > status A k ] ) / , A � D��� >p ServerNameString A ; 0 Z [^ x^ , @�"
:��� $LN13 $LN16 $LN18 $LN12 B UNCServerName B ModuleName �V LogHandle �� RpcHandle ���D RegModuleName ��� status 9H h^ 9� j^ 9� m^ O� � � ` � � � �, �8 �;
�=
�? �N �Q �T �n �w �� ! �� �� & �� ( �� , �� . �� 0 �� 3 �� 6 �� �� 7 � � x � | �
� � � �
� � � �
� � � �
� �
< � @ �
� � � �
� � � �
� � � �
* $ *
: � > �
K � O �
\ � ` �
m � q �
� �
� �
( � , �
@ � D �
w � j h � �} �� �E ���� �f���� �E3�G��t
f98v�p�3�� t�E �p��Qh h � j �E�P� �e� �e� �E�PWW�E�P�u V� ��u��E������-�E� � �E�P� Ëe�u� ��u��E�����3�G��x!�u�j �u �uW� �M���u
� ���E� ����
��M�d�
Y_^[�� E � E 8 V h [ ; ` � l / � , � ) � ( � � � D , � � , m � � = G � �^ �ElfRegisterEventSourceW >< UNCServerName A 0 E D >< ModuleName A E D >�V LogHandle E D > RpcHandle D�� >> RegModuleName D��� > status A � ^ ) / - A � D��� >q ServerNameString A ? N Z �^ `^ x^ , @�"
:��� $LN15 $LN19 $LN21 $LN14 < UNCServerName < ModuleName �V LogHandle �� RpcHandle ���> RegModuleName ��� status 9j d^ 9� j^ 9� m^ O� � ` � A � K �- P �< R �? S �A V �C Y �d [ �p _ �t f �x h �� o �� p �� r �� p �� w �� y �� } �� �� � �� � �� � �� M �� � � � x � | �
� � � �
� � � �
� � � �
� �
< � @ �
� � � �
� � � �
� � � �
$ E ( E
> � B �
O � S �
` � d �
q � u �
� �
� �
, � 0 �
D � H �
� � jXh � �]�]��E�E��E$�E��E(�EċE0�EȋE4�E�3��u��u��u��E�P� �E� 3��}ԫ����E�P�E�PV� j� ���}���t �E�PW� � �S� �EЅ�u!]���C �Ẽ}� �� �e� �}� u-�u�u,�u�u��u�W�u �u �u�u�u �E�P�u�� �-�u��u�u,�u�u��u�W�u �u �u�u�u �u��u�� ��u��E������0�E� � �E�P� Ëe�u�� ��u��E������}��]��� �uS� �E��>�����. �u+�}� u%�E�P�E�P� ��t�C �E� � ����e� ����W� �ƋM�d�
Y_^[��0 � A ` g { . � � � % ) 2 ( R � v � � D � h 0 � h 0 m � 3 5 G � � �^ �ElfReportEventA > LogHandle D���� A � | 0 E D >! EventType E D >! EventCategory E D >" EventID E D > UserSid D���� E D >! NumStrings E D >" DataSize E D >�^ Strings D���� E D$
> Data D��� E $ D( >! Flags E ( D, >" RecordNumber D��� E , D0 >" TimeWritten D���� E 0 D4 >t fUseLegacyReportEvent D��� > RpcHandle D��� >" nSize D���� >q> szComputerNameA D��� >B pComputerNameA A m � � D���� >" EventTime D���� > status A � 1 - A � � p � ) A � ? n � D����
>� Time D���� M ^ �� D
>}^ recInfo A � A � | 0 N M ^ �z
N Z �^ ^ �^ �^ V^ �^ h @�" h ^ ^
:��
:���� $LN15 $LN33 $LN36 $LN14 LogHandle ! EventType ! EventCategory " EventID UserSid ! NumStrings " DataSize $ �^ Strings ( Data , ! Flags 0 " RecordNumber 4 " TimeWritten ���t fUseLegacyReportEvent ��� RpcHandle ����" nSize ���q> szComputerNameA ����B pComputerNameA ����" EventTime ���� status ����� Time 9? �^ 9^ �^ 9y h^ 9# j^ 90 m^ 9t �^ O � 8 � ` $ , � �0 � �8 � �; � �E � �L � �U � �d � �p � �t � � � �� � �� � �� � �� � �� � �� � �� �� �
� �- �; �H �P ! �Y " �^ # �l ) �z * �� + �� , �� 0 �� 2 �� 4 �� 6 �� 7 � � x � | �
� � � �
� � � �
� � � �
/ � 3 �
] � a �
� � � �
� � � �
� � � �
) � - �
\ � ` �
� � � �
� � � �
� � �
� � � �
� � � �
�
�
! � % �
� � � �
� � � �
� �
* � . �
; � ? �
L � P �
] � a �
+ � / �
; � ? �
K � O �
[ � _ �
k � o �
{ � �
� � � �
� � ��< � $ < N � � > G ^ �ElfReportEventAndSourceW > LogHandle E D >" EventTime E D >< pComputerNameU E D >! EventType E D >! EventCategory E D >" EventID E D > UserSid E D >< UNCSourceName E D$ >! NumStrings E $ D( >" DataSize E ( D, >^ Strings E , D0
> Data E 0 D4 >! Flags E 4 D8 >" RecordNumber E 8 D< >" TimeWritten E < D@ �" LogHandle " EventTime < pComputerNameU ! EventType ! EventCategory " EventID UserSid $ < UNCSourceName ( ! NumStrings , " DataSize 0 ^ Strings 4 Data 8 ! Flags < " RecordNumber @ " TimeWritten O� 0 ` $ 7 � I � J � � X � \ �
� � � �
� � � �
� � �
- � 1 �
a � e �
� � � �
� � � �
� � � �
" � & �
Q � U �
� � �
� � � �
� � � �
�
�
; � ? �
� � � �
jlh � �]�]��E�E��E$�E��E(�E��E0�E��E4�E�3��u��u��u���u
� �� �E�P� �E� jY3��}��E�P�E�PV� j� ���}����w �E�PW� � �S� �E��C �E��E�PS� �}� t%� t;�p� ����Ph h � � � t�p� Ph h � �}� �� �e� �}� u-�u��u,�u��u��u�W�u �u �u�u�u �E�P�u�� �-�u��u��u,�u��u��u�W�u �u �u�u�u �u��u�� ��u��E������0�E� � �E�P� Ëe�u�� ��u��E������}��]��� �uS� �E��>�����. �u'�}� u!�E�P�E�P� �C �E� �����e� ����W� ���� ��M�d�
Y_^[��0 0 � O o v � / � � � � � 8 � e � ; � � � 8 � b � ; � � 5 d � ) � ( � � � � � D | 0 � v | 0 m � � 5 G �^ �ElfReportEventW > LogHandle D���� A � | 0 E D >! EventType E D >! EventCategory E D >" EventID E D > UserSid D���� E D >! NumStrings E D >" DataSize E D >^ Strings D���� E D$
> Data D���� E $ D( >! Flags E ( D, >" RecordNumber D���� E , D0 >" TimeWritten D���� E 0 D4 >t fUseLegacyReportEvent D���� >? szComputerNameU D��� > RpcHandle D���� >" nSize D���� >" EventTime D���� > status A 9 1 - A � c p � ) A � ? n � D���� >< pComputerNameU A | * $ D����
>� Time D���� >1^ pModuleName A � : A � 6 n � >t fWide D���� M ^ �� >}^ recInfo A �� A � | 0 N M ^
�� N* Z �^ ^ 4^ �^ �^ �^ �^ V^ �^ | @�" h ^ ^
:��
:t��� $LN23 $LN43 $LN46 $LN22 LogHandle ! EventType ! EventCategory " EventID UserSid ! NumStrings " DataSize $ ^ Strings ( Data , ! Flags 0 " RecordNumber 4 " TimeWritten ����t fUseLegacyReportEvent ���? szComputerNameU ���� RpcHandle ����" nSize ����" EventTime ���� status ����< pComputerNameU ����� Time ����t fWide 9M �^ 9m �^ 9� d^ 9� j^ 9� m^ 9� �^ O � x ` , l � �0 � �8 � �; � �? � �I � �S � �Z � �d � �s � � � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � � � �9 � �; � �h �v �� �� �� ��
�� �� �� �� �� �� �� �� �� �� " �� � � # � � x � | �
� � � �
� � � �
� � �
3 � 7 �
a � e �
� � � �
� � � �
� � � �
- � 1 �
` � d �
� � � �
� � � �
� �
� � � �
� � � �
� � � �
- � 1 �
v � z �
� � � �
� � � �
� � � �
d 0 h 0
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � �
� �
v � ��U��V�u�>AvrPu'�~ t�FP� jP�v� �~ t� �& ^]� & 6 1 5 � D = { 3 � � � > G = 9 '^ �ElfRevertThreadPrivilege
>$^ p A 0 E D
Z )^ �" $^ p 9$ ,^ O� X = ` L J � L � N � P �* S �0 U �5 X �9 Y � � x � | �
� � � �
� � � �
� �
$ � ( �
��U��M��t�E �A ]� � $ { � @ G ^ �ElfSetUseLegacyReportEvent > LogHandle A E D >t UseLegacyReportEvent E D �" LogHandle t UseLegacyReportEvent O � 8 ` , ( � , � 1 � 2 � � X � \ �
� � � �
� � � �
� � � �
X � \ �
� �� � $ N � Y ; G ^ �ElfWriteClusterEvents >< UNCServerName E D >" ulEventInfoSize E D >^ pPackedEventInfo E D �" < UNCServerName " ulEventInfoSize ^ pPackedEventInfo O � 0 ` $ X � ^ � _ � � X � \ �
� � � �
� � � �
�
�
� � � �
��U��M�E �a �a ��E�A]� � $ { � M 9 G ^ �EventDataDescCreate >� EventDataDescriptor A E D > DataPtr E D >" DataSize E D �" � EventDataDescriptor DataPtr " DataSize O � 8 � , & � ' � ) � + � � X � \ �
� � � �
� � � �
� � � �
� �
� � � �
��U��V�u(���� �E 3�+��� ���� �E�шF(�E�F�E�F�E �F�E �F 3��F$ f;F*�� SW�F4�N(8 v��u2�F0�<Ћ\��� �t&�ϋ�#N#F �t�F�N #�#�;Fu;N t2����F,������� � ����t������B�F*;�r�_[�9�F*�N$�N(�N�N�N�N f��t H��� ���� PQ�v,� �� ^]�$ � � � $ { $ � [ s $ j \ q $ � � < G
�^ �McGenControlCallbackV2 >� SourceId E D >" ControlCode E D > Level E D ># MatchAnyKeyword E D ># MatchAllKeyword E D >v FilterData E D$ > CallbackContext A E $ D( >" Ix A , � A M O^ \( ># Keyword C q < C u . * N �"
h O^ � SourceId " ControlCode Level # MatchAnyKeyword # MatchAllKeyword $ v FilterData ( CallbackContext O � � � | n � v � z �' } �* � �\ � �� � �� � �� � �� � �� � �� � �� � �
� � � � � � �
� � � �
' � + �
S � W �
� � � �
� � � �
� � � �
" � & �
6 � : �
[ � _ �
k � o �
� � � �
� � � �
� � � �
��U��M� At3��Q�u�u �u� ]� � � $ ' { � � I G ' # 8^ �McGenEventRegister_EtwEventRegister >� ProviderId E D >5^ EnableCallback E D > CallbackContext E D ># RegHandle A E D >" Error A �" � ProviderId 5^ EnableCallback CallbackContext # RegHandle 9 9^ O � H ' � < O � R � T � U � X �# \ � � X � \ �
� � � �
� � � �
� �
; � ? �
O � S �
w � { �
�
�
$ � ( �
��U��V�u� Ft�v�6� �& �f ^]� � � D ' { � � � M G ' # <^ �McGenEventUnregister_EtwEventUnregister ># RegHandle A E D >" Error A �" # RegHandle 9 ?^ O � H ' � < w � z � � � � �" � �# � � � x � | �
� � � �
� � � �
� � �
? � C �
X � \ �
��U��U�EV�J�` ��u!3��j�� ^P�u�Hj �u�p �u �r�2� ^]� > � � D G { 7 � � 8 K G G C I^ �McGenEventWrite_EtwEventWriteTransfer >E^ Context A : E D >� Descriptor E D >� ActivityId E D >" EventDataCount E D >F^ EventData A 7 E D >� Traits A A % �" E^ Context � Descriptor � ActivityId " EventDataCount F^ EventData 9< L^ O� ` G � T
� � � � � � �% �C # � � x � | �
� � � �
� � � �
� �
5 � 9 �
j � n �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
��U��U�B(8E v��u.�E Et*�J�B#M#E �t�B�J #E#M;Bu;J t2���]� � $ L { � : > G L H O^ �McGenLevelKeywordEnabled >E^ EnableInfo A D E D > Level E D ># Keyword E D �" E^ EnableInfo Level # Keyword O � H L � < � � " �B ) �F % �H * � � X � \ �
� � � �
� � � �
� � � �
� �
| � � �
��U���4� 3ʼnE��M �E�U�E܋EV�E�3��E�E�E�PjVQR�u��E� �u�u�u�� �M�3�^� �� g K � V � � D ^ 4 { " " 3 4 A � : L G ^ " O �^ �McTemplateU0usr0_EtwEventWriteTransfer >E^ Context A 4 E D >� Descriptor A : E D >� _Arg0 E D > _Arg1 E D >�^ EventData D���" M ^ N M ^
# N
Z I^ 4 �"
h ^
:���� E^ Context � Descriptor � _Arg0 _Arg1 ����^ EventData O � � ^ � | r � w � r � w � y �! r �" y �% w �' y �. { �7 w �D y �J { �O | � � x � | �
� � � �
� � � �
� �
� �
A � E �
m � q �
� � � �
��U���4� 3ʼnE��M �E�U�E܋E�E��EV��E� �E�3��Ẻu�PjVQR�u�u�u�� �M�3�^� �� g M � X � � D ` 4 { ) ) . 4 A � ` L G ` ) Q �^ �McTemplateU0uzr0_EtwEventWriteTransfer >E^ Context A 6 E D >� Descriptor A < E D >� _Arg0 E D >O% _Arg1 E D >�^ EventData D��� M ^ >" DataSize A + N& M ^
N
Z I^ 4 �"
h ^
:���� E^ Context � Descriptor � _Arg0 O% _Arg1 ����^ EventData O� � ` � � � � � � � � � � � �+ � �2 � �5 � �7 � �: � �= � �C � �F � �L � �Q � � � x � | �
� � � �
� � � �
� �
� �
A � E �
m � q �
� � � �
� � � �
d� � � $ N � V 2 G ^ �NtCurrentTeb �" O � / � � X � \ �
� � � �
��U��} u� PPh h � ��} u
h � �]� ; � � � * ; / � � $ 9 { � , 4 G 9 5 �^ �WevtInitialize > DllBase E D >" Reason E D >�/ Context E D Z 8^ <^ �" DllBase " Reason �/ Context O� X 9 ` L q � u � w �! x �# y �) { �3 ~ �5 � � X � \ �
� � � �
� � � �
� � � �
l � p �
�� ���� ���� � � �� ���� ���� � � �� ���� ���� � � �� ���� ���� � � ���� ��� ���� � � ���� ��� ���� � � �� ���� ���� � � �� t��� ���� � � �� ���� ���� � � ���� ��� ���� � � ���� ��� ���� � � �� ���� ���� � � �� ���� ���� � � ���� ��� ���� � � ���� ��� ���� � � �� ���� ���� � �� ���� ���� �� ���� ���� �� ���� ����
�� ���� ���� ���� ���� ���� (K� �
B^ EVENTLOG_Context ; ;
� / -
�^ Microsoft_Windows_EventlogLevels > >
� 1 /
�^ Microsoft_Windows_EventlogKeywords A A
�
� EVENT_LOG_FULL D D
� % #
� EVENT_AUDIT_PROCESSING G G
� . ,
� EVENT_AUDIT_PUBLISHER_META_DATA J J
� "
� EVENT_AUDIT_FAILURE M M
� & $
� EVENT_AUDIT_AUTO_BACKUP P P
� # !
� EVENT_AUDIT_LOG_FULL S S
� 4 2
� EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL V V
� & $
� EVENT_AUDIT_LOG_CLEARED Y Y
� ) '
� EVENT_AUDIT_EVENTS_DROPPED \ \
�
� EVENT_SHUTDOWN _ _
� % #
� EVENT_REPORTEVENT_ANSI b b
�
� EVENT_REPORTEVENT e e
� ( &
� EVENT_REGISTEREVENTSOURCE h h
� !
� EVENT_OPENEVENTLOG k k
� # !
� EVENT_PULLSUB_CREATE n n
� # !
� EVENT_PUSHSUB_CREATE q q
� 4 2
� EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY t t
� 4 2
� EVENT_PUBLISHER_TLG_INVALID_META_DATA w w
� & $
� EVENT_ABNORMAL_SHUTDOWN z z
�
� LOG_DROPPED_CHUNK } }
�
� EVENT_AUTO_BACKUP � �
�
� EVENT_LOG_CLEARED � �
� # !
� EVENT_EVENTS_DROPPED � �
� ( &
� EVENT_PUBLISHER_META_DATA � �
�
� EVENT_PROCESSING � �
� / -
� CHANNEL_POLICY_APPLICATION_ERROR � �
� 4 2
� PRIMARY_CHANNEL_CONFIGURATION_WARNING � �
� 4 2
� INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE � �
� * (
� PRIMARY_CHANNEL_FATAL_ERROR � �
� - +
� INIT_CHANNEL_LOGFILTER_WARNING � �
� + )
� INIT_CHANNEL_LOGFILE_WARNING � �
� 9 7
� INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG � �
� - +
� INIT_CHANNEL_MOVED_CORRUPT_LOG � �
� # !
� INIT_CHANNEL_LOGGING � �
� & $
� INIT_CHANNEL_PUBLISHING � �
� ( &
� INIT_CHANNEL_CONFIG_ERROR � �
�
� INIT_CHANNEL � �
�
� EVENTLOG � �
V N ���%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\i386\precomp.obj ���
�Y
� < " ^ ^ " ^ ElfWriteClusterEvents �� �C NtCurrentTeb ��� f " ^ ElfDeregisterClusterSvc
<
� B " < ! ! " < ! " ^ ! " " ^ &
^ ElfReportEventAndSourceW ��� gX EventDataDescCreate
^
� < "
^ ^ " ^ ElfRegisterClusterSvc ��
^ & ^ ElfDestroyReconnectionInfo �
-
� " t ^
^
� t ^ & ^ ElfSetUseLegacyReportEvent � t ^ & ^ ElfGetUseLegacyReportEvent � ^ ^ ElfGetTheRpcHandle �B � tagPrivilegeStatus .?AUtagPrivilegeStatus@@ ��v
" Asserted �
" Privilege
t NeedsRevert ��
t PrivilegeAdjusted
WasEnabled ���B ^ tagPrivilegeStatus .?AUtagPrivilegeStatus@@ ��2 onecore\admin\wmi\events\advapi\apistub.c �� !^ "^
^
�
$^ %^ & &^ ElfRevertThreadPrivilege ��� t � (^ RevertToSelf ��� " *^
+^
� 6 � tagStringStorage .?ATtagStringStorage@@ ��
� W
A A 6 .^ tagStringStorage .?ATtagStringStorage@@ �� /^ "^
-^
� t 1^ 2^ 3^ ElfGetModuleName ���
RB
� � 5^ # " 6^ . 7^ McGenEventRegister_EtwEventRegister
7^
�
# " :^ 2 ;^ McGenEventUnregister_EtwEventUnregister
# " =^
>^
� F � _MCGEN_TRACE_CONTEXT .?AU_MCGEN_TRACE_CONTEXT@@ ��
# RegistrationHandle ���
# Logger ���
# MatchAnyKeyword ��
# MatchAllKeyword ��
" Flags
" $ IsEnabled
( Level
) Reserve ��
! * EnableBitsCount ��
" , EnableBitMask
� 0 EnableKeyWords ���
� 4 EnableLevel ��F A^ 8 _MCGEN_TRACE_CONTEXT .?AU_MCGEN_TRACE_CONTEXT@@ ��F onecore\admin\wmi\events\manifests\objfre\i386\EventLogEvents.h B^ C^ �
@^
�
�
� E^ � � " F^ " G^ 2 H^ McGenEventWrite_EtwEventWriteTransfer �� # � � � " � " J^
K^
� E^ # M^ & N^ McGenLevelKeywordEnabled ��� $^ P^ & Q^ ElfAssertThreadPrivilege ���
� S^
T^
� ^ ElfReconnect ���
%!
�
�Y
� p W^ W^ " " X^ Y^ & Z^ ElfrRegisterEventSourceA ��� Z^ ElfrOpenELA
�
� q ]^ ]^ " " X^ ^^ & _^ ElfrRegisterEventSourceW ��� _^ ElfrOpenELW < P b^
c^
�
� B e^ f^
g^
� t �]
i^
�
k^
l^
� ^ & n^ ElfDeregisterEventSource ���
X^ p^ & q^ ElfrDeregisterEventSource ��� ApiElfOpenEventLogW �� ApiElfRegisterEventSourceW ��� ApiElfOpenBackupEventLogW ApiElfOpenEventLogA �� ApiElfRegisterEventSourceA ��� ApiElfOpenBackupEventLogA 2 t s^ tagElfApiType .?AW4tagElfApiType@@ � t^ "^ t^ 1^ 1^ t v^ w^ ElfCreateReconnInfo 6 � tagReconnInfo .?AUtagReconnInfo@@ �
" Signature
t^ ApiType ��
t IsImpersonating ��
-^ UNCServerName
-^ ModuleName ���
t IsSecurityLog
t UseLegacyReportEvent �
$ RpcHandle 6 z^ ( tagReconnInfo .?AUtagReconnInfo@@ {^ "^ [
y^
� " " ~^
^
� �# �< �^
�^
� < � �^
�^
� n^ ElfCloseEventLog ��� q^ ElfrCloseEL E^ � � " �^ 2 �^ McTemplateU0usr0_EtwEventWriteTransfer � E^ � � O% " �^ 2 �^ McTemplateU0uzr0_EtwEventWriteTransfer � � " 0 � n^ ElfFlushEventLog ��� B �^ " �^ ElfBackupEventLogFileA � �Y W^ �^ �^ ElfrBackupELFA �" �^ ElfClearEventLogFileA �� �^ ElfrClearELFA ��" " " " " " �^ �^ ElfReadEventLogA ���" �Y " " " " " �^ �^ ElfrReadELA < �^ " �^ ElfClearEventLogFileW �� �Y ]^ �^ �^ ElfrClearELFW ��" RB McGenControlCallbackV2 �" �^ ElfBackupEventLogFileW � �^ ElfrBackupELFW � �^ ElfReadEventLogW ��� �^ ElfrReadELW " " " �^ " �^ ElfGetLogInformation ��� �^ �^ ElfChangeNotify �Y " " " �^ " �^ ElfrGetLogInformation �� �Y � " �^ �^ ElfrChangeNotify ��� " �^ �^ ElfOldestRecord �Y " �^ �^ ElfrOldestRecord ��� �^ ElfNumberOfRecords � �^ ElfrNumberOfRecords B B �V �^ " �^ ElfOpenBackupEventLogA � p W^ " " X^ �^ �^ ElfrOpenBELA ���" �^ ElfRegisterEventSourceA �^ ElfOpenEventLogA ��� t �^ �^ _stricmp ��� < < �V �^ " �^ ElfOpenBackupEventLogW � q ]^ " " X^ �^ �^ ElfrOpenBELW ���
B
� 6 ! ! " ! " �^ ! " " �^ �^ ElfReportEventA y MIDL_user_allocate �
�
�
[,
�
W^
� :
�Y �^ ! ! " ! " W^ �^ �^ ! "
�^ �^ ElfrReportEventExA �> �Y " ! ! " ! " W^ �^ �^ ! " " �^ �^ ElfrReportEventA ��� ; MIDL_user_free �
S4 �^
�^
� @ p " t �^
�^
� S4 " �^
�^
� $[ WevtInitialize �" �^ ElfRegisterEventSourceW �^ ElfOpenEventLogW ��� t �^ �^ _wcsicmp ���6 ! ! " ! " ^ ! " " �^ �^ ElfReportEventW
]^
� :
�Y �^ ! ! " ! " ]^ �^ �^ ! "
�^ �^ ElfrReportEventExW �> �Y " ! ! " ! " ]^ �^ �^ ! " " �^ �^ ElfrReportEventW ��� @ q " t �^
�^
� � "
� � " h �
@^
�
-^
�
^
�
y^
�
���
���
���
���� -FC -MT -c -Zl -Zp8 -Gy -Gm- -W4 -Gz -hotpatch -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 ��
_ f _ -arch:IA32 -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X � _ _ _ _ _ �� U}�U� �' )�(��v��f
�ԯ�R 7�`,�BҐ�oA�<[R1A8�F �7n6�+o���j�P��W^ gC(��4����k�x|�-�4�X�dHJ��A� U��i�Z�/u!
{9Fl�g�qt��"�
�<~#��w>���0<̩0L`��$��V���
hԹ�:OW�ҥ\�պ-�j��{�� ?_�Ef�����.��H���,)\ ����_�(V�5w���9ȨZp!'7�Q�z��{�#Cu� ��G��72Om��.�)���s �f#���D�X| ��S8����H��^+Կ�0�7�6���t�O����~s�O�^^�{+78����Y�����S0w��� �Q �Z|�yG��⨵z��J
��Q[�Ն]�����f�J G���Q[��RőX@��Af�J G���V�C���h_��>�둍���V����>�_�r�zf�m������ H��>�_�r��g9�j����� Hg���4�4��")y��w6Q��WI�s\9X }E�V����5��"�c �G�)2Yg���4�4�� �� �w6Q��WI������X�H�X������*����N��[5 ��6~߆�~'{�S�"
�e� ^��%���TI�w���(����,<��g��� �~WV �;RM݆B�� w*���#*ҩp� H��z<18��u>��ةp� H�G,F�:(���u>����gd:�8/��w2:���wZ>F� PyR �l�"��[����ǹe� ^��%��u� �螭N�,��4�S���e�'E�dy� �G���શ؛TU�A?�O��E�� ���wIU}Z )�e�e�� ,GX�'��s�+�Z )�e�e �k�]Zܪ�������3��홟`�5߰� �]]�"֛Ij�4��n�ۊ��W3o�<KO�a%�Z�X ���y hQo'N� �&�1W�JR��HQ9���T����B�F��@�]Z�X~�p���h��u�ܧ?��cvЅ;��M���y��HV�GJ��[�=�p�C��o �?w�P$��n�`�5߰� A�Cxa��xc������٣�D|�ߣ��H�m_�T Bg��&1�CX�`��t�f�P��̚���a�)GC�'��]���S��� 4MY�v�9��|@�Jv��\ f[\�6'8�W)�ю�f��<��~U�40p��Z�m�V]],��K]�RΌ��n�é:Z�R�n4 ���z�����JC�1QvX��� }�W l@}�W l@� �yb�`�7PѾ��6d����L�<C���Pے71QvX��� � �yb�`� �yb�`}�W l@}�W l@� �yb�`�7PѾ��6d����L�<��s�l�(�s�l�(�O�*!�`}�W l@}�W l@���Je2뱫� ` ���Uv-1j�
���`��{����
��BjpS���c�3����Y{Q���[���I@��}�D����w!���Dp����>5������j�I����:U��~k��f�3�a�L����c��/�JL���5m�d��� l}��/L������ lRI� �����7�M����*F � m[�2J���<�j-�r)�kS�U6�Q�7��3��[� ���D��
�ͩ*z�+;�h3�Qt����{F�*d5ż+����hH��������1ѝ�v��e�&�
RK����x�:�&6�F!B�ĉ7 �|�����?�a&��S�v �E��'l��`�P�I�3�|G e��7O�
�ej&(s -INCLUDE:___@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUrDIGUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� @vol.md �� .debug$S � e .rdata i�y� e .rdata �[!] e A .rdata s\Z e ` { � � � � � � $ G \ s � � � � � � 1 ; U j ~ � � � � � ( C a t � � � � � .data 8 [p�� e D .rdata
e�.� e V .rdata h T)�} e x .rdata ~H�� e � .rdata ?�� e � .rdata
JK i e �
.rdata ��w� e � .rdata G+� e � .rdata
���@ e
.rdata �'� e ) .rdata ��� e P .rdata ��� e i .rdata 3g� e � .rdata �K� e � .rdata ��*� e � .rdata .�M� e � .rdata [Q�M e � .rdata ��� e � .rdata 8t� e .rdata ��|d e .rdata ݤ�| e B .rdata �SV
e i .rdata rX�� e � .rdata ��u} e � .rdata ~=�< e � .rdata ���� e � .rdata `�m& e � .rdata �͡ e � .rdata ! �dr e � ! .rdata " ��� e " .rdata # �� e G # .rdata $ �� e n $ .rdata % �(u� e � % .rdata & �1�� e � & .rdata ' ���3 e � ' .rdata ( s^% e � ( .rdata ) 8
�� e ) .rdata * ���{ e + * .rdata + Mj�� e D + .rdata , ʹR� e _ , .rdata - 2˵o e m - w � � .text$mn . U S��; e .debug$S / � . e .text$mn 0 � [�� e .debug$S 1 l # 0 e .debug$F 2 0 e .text$mn 3 � [�� e .debug$S 4 l # 3 e .debug$F 5 3 e .text$mn 6 � +N� e .debug$S 7 � ) 6 e .debug$F 8 6 e .text$mn 9 � �*P e .debug$S : D ! 9 e .debug$F ; 9 e .text$mn < � �*P e .debug$S = D ! < e .debug$F > < e .text$mn ? w ��c� e .debug$S @ � ? e .debug$F A ? e .text$mn B x �"^ e .debug$S C � - B e .text$mn D �� e .debug$S E $ D e .text$mn F w ��c� e .debug$S G � F e .debug$F H F e .text$mn I . :� e .debug$S J T
I e .text$mn K ��;� e .debug$S L K e .text$mn M � ��� e .debug$S N ` - M e .debug$F O M e .text$mn P % �(-� e .debug$S Q � P e .text$mn R ( �P�� e .debug$S S h R e .text$mn T �� e .debug$S U 4 T e .text$mn V � �)B e .debug$S W d # V e .debug$F X V e .text$mn Y � �)B e .debug$S Z h # Y e .debug$F [ Y e .text$mn \ � *S
e .debug$S ] � # \ e .debug$F ^ \ e .text$mn _ � ��Rm e .debug$S ` � # _ e .debug$F a _ e .text$mn b U P=� e .debug$S c L ) b e .debug$F d b e .text$mn e s ��{v e .debug$S f l + e e .debug$F g e e .text$mn h � �ձb e .debug$S i � 5 h e .debug$F j h e .text$mn k � :�Ϟ e .debug$S l � 5 k e .debug$F m k e .text$mn n :
a��� e .debug$S o � n e .debug$F p n e .text$mn q ?_� e .debug$S r � q e .text$mn s � 5 e .debug$S t % s e .debug$F u s e .text$mn v ��v e .debug$S w % v e .debug$F x v e .text$mn y � �$> e .debug$S z � A y e .debug$F { y e .text$mn | � e .debug$S } # | e .text$mn ~ �Z e .debug$S � E ~ e .debug$F � ~ e .text$mn � = ��� e .debug$S � | � e .text$mn � �b� e .debug$S � � � e .text$mn � ?_� e .debug$S � � � e .text$mn � 뗤� e .debug$S � �
� e .text$mn � B�� e .debug$S � @ � e .text$mn � ' �d e .debug$S � l � e .text$mn � ' �� � e .debug$S � �
� e .text$mn � G ��� e .debug$S � � � e .text$mn � L `G�r e .debug$S � �
� e .text$mn � ^ ��|� e .debug$S � $ � e .text$mn � ` �ۡ� e .debug$S � P � e .text$mn � ��D� e .debug$S � � � e .text$mn � 9 z!k� e .debug$S � � � e � � � � � K
� $ D ? q Y y m h � 0 � 9 � \ � s � b
|
~ 2
k G
F c
? w
3 �
< �
_ �
v �
e �
M 6 " Y 5 V K I i n y P � � � T � R � B � �
� & . B � m � � � � � � �
� 0
� M
h
v
�
_memset $LN15 * y $LN33 ) y $LN36 y $LN14 y $LN14 � h $LN17 � h $LN20 � h $LN13 � h $LN10 f 0 $LN13 e 0 $LN16 T 0 $LN9 T 0 $LN8 \ 9 $LN11 [ 9 $LN14 J 9 $LN7 J 9 $LN13 v \ $LN16 u \ $LN18 d \ $LN12 d \ $LN13 � s $LN16 � s $LN18 w s $LN12 w s $LN15 � b $LN18 � b $LN20 � b $LN14 � b $LN23 � ~ $LN43 � ~ $LN46 v ~ $LN22 v ~ $LN14 � k $LN17 � k $LN20 � k $LN13 � k $LN8 < F $LN11 ; F $LN14 * F $LN7 * F $LN8 < ? $LN11 ; ? $LN14 * ? $LN7 * ? $LN10 f 3 $LN13 e 3 $LN16 T 3 $LN9 T 3 $LN8 \ < $LN11 [ < $LN14 J < $LN7 J < $LN13 w _ $LN17 v _ $LN19 e _ $LN12 e _ $LN15 � v $LN19 � v $LN21 � v $LN14 � v $LN17 � e $LN21 � e $LN23 � e $LN16 � e $LN12 w M $LN15 v M $LN18 e M $LN11 e M $LN8 o 6 $LN13 n 6 $LN16 ] 6 $LN7 ] 6 $LN9 g Y $LN12 f Y $LN15 U Y $LN8 U Y $LN9 g V $LN12 f V $LN15 U V $LN8 U V $LN18 � n $LN24 � n $LN27 � n $LN17 � n .voltbl � � e _volmd � .xdata$x � /Z��y e �
� .xdata$x � �wc�h e �
� .xdata$x � ��P0 e �
� .xdata$x � ��P9 e �
� .xdata$x � b� �\ e ! � .xdata$x � ��Ys e G � .xdata$x � �g�yb e n � .xdata$x � �|��~ e � � .xdata$x � �wc�k e � � .xdata$x � b� �F e � � .xdata$x � b� �? e � � .xdata$x � ��P3 e � .xdata$x � ��P< e 8 � .xdata$x � b� �_ e \ � .xdata$x � ��Yv e � � .xdata$x � �g�ye e � � .xdata$x � ꜎�M e � � .xdata$x � ꜎�6 e � � .voltbl � O\6 e _volmd � .xdata$x � ��PY e � .xdata$x � ��PV e ) � .xdata$x � Z�� n e J � .voltbl � ���5n e _volmd � .voltbl � ��B e _volmd � .gfids$y � ���˙ e e � .voltbl � ��jp. e _volmd � � .debug$S � , e .debug$S � < e .debug$S � @ e .debug$S � , e .debug$S � 4 e .debug$S � <
e .debug$S � 0 e .debug$S � 4 e .debug$S � 0
e .debug$S � @ e .debug$S � 4 e .debug$S � 8 e .debug$S � , e .debug$S � 4 e .debug$S � , e .debug$S � 4 e .debug$S � 0 e .debug$S � 0 e .debug$S � 0 e .debug$S � @ e .debug$S � @ e .debug$S � 4 e .debug$S � , e .debug$S � , e .debug$S � , e .debug$S � 0 e .debug$S � 4 e .debug$S � , e .debug$S � < ! e .debug$S � @ " e .debug$S � @ # e .debug$S � 8 $ e .debug$S � < % e .debug$S � 8 & e .debug$S � H ' e .debug$S � < ( e .debug$S � 0 ) e .debug$S � 4 * e .debug$S � 4 + e .debug$S � ( , e .debug$S � $ - e .debug$T � 4 e .sxdata � e .chks64 � e � ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy@ ??_C@_0M@NJALGCHB@Application@ ??_C@_08EDKKPLCC@Security@ _ElfrReportEventA@56 _ElfrReportEventExA@52 __imp__GetComputerNameExA@12 _ElfrReadELA@28 _ElfrBackupELFA@8 _ElfrClearELFA@8 _ElfrOpenBELA@20 __stricmp _MIDL_user_free@4 __imp__RtlTimeToSecondsSince1970@8 _ElfrReportEventW@56 _ElfrReportEventExW@52 _MIDL_user_allocate@4 __imp__GetComputerNameExW@12 __imp__NtQuerySystemTime@4 _ElfrReadELW@28 _ElfrDeregisterEventSource@4 _ElfrCloseEL@4 _ElfrBackupELFW@8 _ElfrClearELFW@8 _ElfrOpenBELW@20 __wcsicmp _ElfrGetLogInformation@20 _ElfrChangeNotify@16 _ElfrOldestRecord@8 _ElfrNumberOfRecords@8 __imp__I_RpcMapWin32Status@4 __imp__RpcExceptionFilter@4 _ElfrRegisterEventSourceA@24 _ElfrOpenELA@24 _ElfrRegisterEventSourceW@24 _ElfrOpenELW@24 __imp__RtlInitAnsiString@8 __imp__RtlInitUnicodeString@8 __imp__HeapFree@12 __imp__RtlCopyString@8 __imp__RtlCopyUnicodeString@8 __imp__GetProcessHeap@0 __imp__HeapAlloc@12 _RevertToSelf@0 __imp__RtlAdjustPrivilege@16 __imp__RtlImpersonateSelf@4 _Microsoft_Windows_EventlogEnableBits _EVENTLOG_Context _Microsoft_Windows_EventlogLevels _Microsoft_Windows_EventlogKeywords _EVENT_LOG_FULL _EVENT_AUDIT_PROCESSING _EVENT_AUDIT_PUBLISHER_META_DATA _EVENT_AUDIT_FAILURE _EVENT_AUDIT_AUTO_BACKUP _EVENT_AUDIT_LOG_FULL _EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL _EVENT_AUDIT_LOG_CLEARED _EVENT_AUDIT_EVENTS_DROPPED _EVENT_SHUTDOWN _EVENT_REPORTEVENT_ANSI _EVENT_REPORTEVENT _EVENT_REGISTEREVENTSOURCE _EVENT_OPENEVENTLOG _EVENT_PULLSUB_CREATE _EVENT_PUSHSUB_CREATE _EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY _EVENT_PUBLISHER_TLG_INVALID_META_DATA _EVENT_ABNORMAL_SHUTDOWN _LOG_DROPPED_CHUNK _EVENT_AUTO_BACKUP _EVENT_LOG_CLEARED _EVENT_EVENTS_DROPPED _EVENT_PUBLISHER_META_DATA _EVENT_PROCESSING _CHANNEL_POLICY_APPLICATION_ERROR _PRIMARY_CHANNEL_CONFIGURATION_WARNING _INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE _PRIMARY_CHANNEL_FATAL_ERROR _INIT_CHANNEL_LOGFILTER_WARNING _INIT_CHANNEL_LOGFILE_WARNING _INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG _INIT_CHANNEL_MOVED_CORRUPT_LOG _INIT_CHANNEL_LOGGING _INIT_CHANNEL_PUBLISHING _INIT_CHANNEL_CONFIG_ERROR _INIT_CHANNEL _EVENTLOG __imp__EtwEventUnregister@8 __imp__EtwEventRegister@16 __imp__EtwEventWriteTransfer@28 _EventDataDescCreate@12 _NtCurrentTeb@0 _ElfFlushEventLog@4 _ElfWriteClusterEvents@12 _ElfDeregisterClusterSvc@4 _ElfRegisterClusterSvc@12 _ElfReportEventA@48 _ElfReadEventLogA@28 _ElfBackupEventLogFileA@8 _ElfClearEventLogFileA@8 _ElfOpenBackupEventLogA@12 _ElfRegisterEventSourceA@12 _ElfOpenEventLogA@12 _ElfReportEventAndSourceW@60 _ElfReportEventW@48 _ElfReadEventLogW@28 _ElfDeregisterEventSource@4 _ElfCloseEventLog@4 _ElfBackupEventLogFileW@8 _ElfClearEventLogFileW@8 _ElfOpenBackupEventLogW@12 _ElfRegisterEventSourceW@12 _ElfOpenEventLogW@12 _ElfGetLogInformation@20 _ElfChangeNotify@8 _ElfOldestRecord@8 _ElfNumberOfRecords@8 _ElfDestroyReconnectionInfo@4 _ElfReconnect@4 _ElfGetModuleName@8 _ElfSetUseLegacyReportEvent@8 _ElfGetUseLegacyReportEvent@4 _ElfGetTheRpcHandle@4 _ElfCreateReconnInfo@20 _WevtInitialize@12 _ElfRevertThreadPrivilege@4 _ElfAssertThreadPrivilege@8 _McTemplateU0uzr0_EtwEventWriteTransfer@16 _McTemplateU0usr0_EtwEventWriteTransfer@16 _McGenEventUnregister_EtwEventUnregister@4 _McGenEventRegister_EtwEventRegister@16 _McGenEventWrite_EtwEventWriteTransfer@20 _McGenControlCallbackV2@36 _McGenLevelKeywordEnabled@16 @__security_check_cookie@4 __SEH_prolog4 __SEH_prolog4_GS __except_handler4 __sehtable$_ElfReportEventA@48 __sehtable$_ElfReadEventLogA@28 __sehtable$_ElfBackupEventLogFileA@8 __sehtable$_ElfClearEventLogFileA@8 __sehtable$_ElfOpenBackupEventLogA@12 __sehtable$_ElfRegisterEventSourceA@12 __sehtable$_ElfOpenEventLogA@12 __sehtable$_ElfReportEventW@48 __sehtable$_ElfReadEventLogW@28 __sehtable$_ElfDeregisterEventSource@4 __sehtable$_ElfCloseEventLog@4 __sehtable$_ElfBackupEventLogFileW@8 __sehtable$_ElfClearEventLogFileW@8 __sehtable$_ElfOpenBackupEventLogW@12 __sehtable$_ElfRegisterEventSourceW@12 __sehtable$_ElfOpenEventLogW@12 __sehtable$_ElfGetLogInformation@20 __sehtable$_ElfChangeNotify@8 __sehtable$_ElfOldestRecord@8 __sehtable$_ElfNumberOfRecords@8 __sehtable$_ElfReconnect@4 __guard_fids__WevtInitialize@12 ___security_cookie
/146 1606895243 100666 47454 `
LB �F�_� � .debug$S � d
@ B.text$mn d � L `.debug$S � � d @B.text$mn r J � `.debug$S � � � @B.text$mn � � `.debug$S � � s
@B.text$mn l � a `.debug$S ( � �% E @B.text$mn d c( �( `.debug$S � ) �+ @B.text$mn w �, <- `.debug$S � n- 20 @B.text$mn " 1 &1 `.debug$S � :1 �2 @B.text$mn " <3 ^3 `.debug$S � r3 5 @B.text$mn . |5 �5 `.debug$S � �5 R8 @B.text$mn % �8 !9 `.debug$S � 59 );
@B.text$mn % �; �; `.debug$S � �; �=
@B.text$mn R R> `.debug$S L �> �@ @B.text$mn [ �A `.debug$S ` B iD @B.text$mn % E 8E `.debug$S � LE �F @B.text$mn � fG H `.debug$S � �H �L ' @B.text$mn � N �N `.debug$S d �N =R @B.text$mn O #S rS `.debug$S � �S ~V @B.text$mn H <W �W `.debug$S � �W dZ @B.text$mn U [ c[ `.debug$S � �[ %_ @B.text$mn U ` `` `.debug$S � ~` "d @B.text$mn H e Pe `.debug$S � xe 8h @B.text$mn H �h *i `.debug$S � Ri l @B.text$mn 0 �l �m `.debug$S $ Fn jt 7 @B.debug$F �v �v @B.text$mn 6 �v �w `.debug$S :x N~ 5 @B.debug$F `� p� @B.text$mn \ z� `.debug$S @ ր � @B.text$mn � $� �� `.debug$S � �� |� # @B.xdata$x ڊ �� @@@.voltbl
� .xdata$x � *� @@@.voltbl >� .voltbl B� .voltbl C� .voltbl D� .debug$T h
E� @ B.sxdata �� 0 .chks64 ��
.drectve n �
� � P d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\eventapi.obj : < � k k
Microsoft (R) Optimizing Compiler � � 9 q ����o� }�+4qt*Y lռ��́dq�X � ��*�HRI �̏!�&�e�b ��E2b�^� � �;�,�9Y���dnB_ l��fp������L�5 � > onecore\admin\wmi\events\advapi\objfre\i386\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\i386\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\admin\wmi\events\advapi\eventapi.c onecore\external\shared\inc\intsafe.h $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 4 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 4 - ^ = $24 $T0 8 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 24 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 40 - ^ = $23 $T0 44 - ^ = $24 $T0 48 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 4 - ^ = $T0 $ebp = $T2 $esp = $T1 .raSearchStart = $eip $T1 ^ = $ebp $T0 = $esp $T1 4 + = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 4 - ^ = $23 $T0 8 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 4 - ^ = $23 $T0 8 - ^ = $24 $T0 12 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 12 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 24 - ^ = $24 $T0 28 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 20 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $23 $T0 28 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 24 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 24 - ^ = $23 $T0 28 - ^ = $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = $20 $T0 24 - ^ = $23 $T0 28 - ^ = $24 $T0 32 - ^ = � L�^ ��U����} t+�u �E�P� j�E�P�E�P� ��yP� 3��'j �E�P� V�u��u� ��E�P� ��^�� '
1 � A M � Y � D d � F � � 5 G d ` n^ �BackupEventLogA > hEventLog E D >7 BackupFileName E D >D AnsiString D� >t ReturnValue A S
>> UnicodeString D���� > Status A +
A E Z
^ M^ �" hEventLog 7 BackupFileName �D AnsiString ����> UnicodeString 9 ^ 9% r^ 9? :^ 9W s^ O� x d 8 l R � ] � ^ � _ �+ a �/ b �5 c �9 g �E j �S k �] l �` n � � x � | �
� � � �
� � � �
/ � 3 �
p � t �
� � � �
� �
, � 0 �
< � @ �
L � P �
d � h �
��U��QQ�} tWj j �E�P�u � ����t?V�E�P�u� ��y
P� 3��3�Ff�}� t�u�d�
0 j �q� ��^�
jW� 3��� . 8 � [ h ! � D r � & < � � � 5 G r n M^ �BackupEventLogW > hEventLog E D >�% BackupFileName E D >t ReturnValue A ! A > $ A d >> Unicode D���� > Status A 2
A C Z P^
^ �" hEventLog �% BackupFileName ����> Unicode 9 S^ 9Y 2^ 9f <! O� � r 8 � ( � 2 �
3 �! 7 �% < �2 > �6 ? �< @ �> A �@ B �C E �J F �_ H �d 8 �l 9 �n J � � x � | �
� � � �
� � � �
� �
" � & �
6 � : �
q � u �
� � � �
� �
� �
$ � ( �
< � @ �
��U��V�u� ��V� ��^]� " ! � D � % � � 8 G
^ �BaseSetLastNTError > Status E D >" dwErrorCode A
�" Status 9 ^ 9 <! O � @ 8 4 2 � 5 � 6 � 7 � 8 � � x � | �
� � � �
� � � �
� �
* � . �
D � H �
��U���S�]3�V�uW�U� �E�;] �; ���3 ��8�* ��<1;�� �F8�E�9O�� j�u�E�WP� ���� j�u�E�WP� ���� �F(�M��M���tF;E �� �N,;M �� ;M��� ;��� ;��� PWQ� ���� �M�3�f9VvA�F$;E w}9Ut�ut�;�rn�E��U�R�u�E�WP� ��x[�M��FA�M�j Z;�r܋F0��t ;E w8�N4;M w0��;M�r';�w#;�s + ���E�@�E��t�E�������t3���� �_^[�� ] � t � � � � � � l � _ '
X r S � � � 9 G l h x^ �CheckEventLogBuffer > lpBuffer E D >" nBytesBufferSize E D >" nBytesRead E D >t isUnicode E D > pbTest D���� > pOptionalData A � r : A - ? � � � B����- ? > pbTooFar A ; % A - 9 % > pStartOfSid A � $ A ` > pDataStart A 2 A - ? > pString A �
A � m a > pPastEndOfBuffer A ?-
A ` B�� P >t NumRecordsRead A H A ` B� V > pPastEndOfData A 4
A A $ > pPastEndOfSid A � ! A ` >u cnt A
A - ? � � � B�- ? >t NumUncheckedBytes A \ > Status A a � " E r 3 A � � > L F >y^ pEventRecord A U Z ^ ^ ^ ^ �" lpBuffer " nBytesBufferSize " nBytesRead t isUnicode ���� pbTest O � � l 8 0 � � � � � � � � �% � �- � �6 � �; � �C � �I � �R � �a � �i � �x � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� �� �� �� ��
�� ��
�� � �
� �# �0 �2 �4 �9 " �= $ �A ( �C ) �E * �P � �X - �\ 0 �` . �f 2 � � � � � �
� � � �
) � - �
Z � ^ �
� � � �
� � � �
� � � �
� �
& � * �
6 � : �
` � d �
p � t �
� � � �
� � � �
� � � �
� � � �
� �
� " �
. � 2 �
W � [ �
k � o �
{ � �
� � � �
� � � �
� � � �
� � � �
� �
� " �
: � > �
f � j �
� � � �
� � � �
� � � �
� � � �
��U����} t+�u �E�P� j�E�P�E�P� ��yP� 3��'j �E�P� V�u��u� ��E�P� ��^�� '
1 � A M � Y � D d � F � � 4 G d ` t^ �ClearEventLogA > hEventLog E D >7 BackupFileName E D >D AnsiString D� >t ReturnValue A S
>> UnicodeString D���� > Status A +
A E Z
^ \^ �" hEventLog 7 BackupFileName �D AnsiString ����> UnicodeString 9 ^ 9% r^ 9? :^ 9W s^ O � x d 8 l � ! � " � # �+ % �/ & �5 ' �9 + �E . �S / �] 0 �` 1 � � x � | �
� � � �
� � � �
. � 2 �
o � s �
� � �
� �
+ � / �
; � ? �
K � O �
d � h �
��U��QQ�} t!j j �E�P�u � ��ujW� 3��E3�!E��E�V�E�P�u� ��y
P� 3��3�Ff�}� t�u�d�
0 j �q� ��^�� & ! ? I � l � D w � 7 < � � � 4 G w s \^ �ClearEventLogW > hEventLog E D >�% BackupFileName E D >t ReturnValue A O $ >> Unicode D���� > Status A C
A T Z ]^
^ �" hEventLog �% BackupFileName ����> Unicode 9 S^ 9$ <! 9j 2^ O � � w 8 � � � � �
� � � �" � �* � �. � �0 � �6 � �C � �G � �M � �O � �Q � �T �[ �p �s � � x � | �
� � � �
� � � �
� �
P � T �
d � h �
� � � �
� � � �
� �
� �
��U��u� ��y
P� 3��3�@]� � � $ " � � � 3 G " j^ �CloseEventLog > hEventLog E D >t ReturnValue A > Status A
Z k^
^ �" hEventLog O� X " 8 L � � � �
� � � � � � � � � � � � � X � \ �
� � � �
� � � �
� � � �
< � @ �
��U��u� ��y
P� 3��3�@]� � � $ " � � ; G " g^ �DeregisterEventSource > hEventLog E D >t ReturnValue A > Status A
Z i^
^ �" hEventLog O� X " 8 L � �
� � � � � � � X � \ �
� � � �
� � � �
� � � �
D � H �
��U��u�u�u�u �u� ��y
P� 3��3�@]� � � $ . � � < G . * G^ �GetEventLogInformation > hEventLog E D >" dwInfoLevel E D > lpBuffer E D >" cbBufSize E D >" pcbBytesNeeded E D > ntStatus A
Z J^
^ �" hEventLog " dwInfoLevel lpBuffer " cbBufSize " pcbBytesNeeded O � P . 8 D � � � � � � � �# � �' � �* � � � X � \ �
� � � �
� � � �
� � � �
' � + �
\ � ` �
� � � �
D � H �
��U��u �u� ��y
P� 3��3�@]� � � $ % � � [ @ G % ! ^^ �GetNumberOfEventLogRecords > hEventLog E D >" NumberOfRecords E D >t ReturnValue A > Status A
Z _^
^ �" hEventLog " NumberOfRecords O � X % 8 L Q � U � W � X � Y � Z � [ �! _ � � X � \ �
� � � �
� � � �
� � �
# � ' �
� � � �
��U��u �u� ��y
P� 3��3�@]� � � $ % � � R = G % ! X^ �GetOldestEventLogRecord > hEventLog E D >" OldestRecord E D >t ReturnValue A > Status A
Z [^
^ �" hEventLog " OldestRecord O � X % 8 L � � � � � � � � � � � � �! � � � X � \ �
� � � �
� � � �
� � � �
� ! �
� � � �
��U��U3�3�Vf�
�M �J��t'8t�� A;�s
@�9 u�;�r3���ȍA�����f�
f�B3�@^]� � D R �
A % � c 4 G R
N ^ �InitAnsiString >B DestinationString A J E D >^ SourceString A 0 & A M E D >" Length A ) A #
�" B DestinationString ^ SourceString O � � R 8 | \ � ^ � _ � ` � j �( k �. n �2 o �6 r �9 s �? u �A x �C { �N | � � x � | �
� � � �
� � � �
� � � �
�
�
� ! �
F � J �
V � Z �
� � � �
��U��V�u3�3�W��f��M �N��t,f9t ��� �I;�s ��f9u�;�r3���ʍA�����f�f�F3�@_^]� � d [ � Q % H o � V 7 G [ W ^ �InitUnicodeString >< DestinationString A N E D >P SourceString A 5 + A U E D >" ByteLength A K �" < DestinationString P SourceString O � � [ 8 | � � � � � � � � � �. � �6 � �: � �> � �A � �G � �I � �K � �U � � � � � � �
� � � �
� � � �
� �
, � 0 �
@ � D �
m � q �
� � � �
��U��u �u� ��y
P� 3��3�@]� � � $ % � � : G % ! b^ �NotifyChangeEventLog > hEventLog E D > hEvent E D > Status A
Z d^
^ �" hEventLog hEvent O � P % 8 D ) � , � . � / � 0 � 2 �! 4 � � X � \ �
� � � �
� � � �
� � � �
\ � ` �
��U����} t+�u�E�P� j�E�P�E�P� ��yP� 3��zj �E�P� �} Vt7�u �E�P� j�E�P�E�P� ��y �E�P� V� 3��/j �E�P� �u�u�� ��E�P� �E�P� ��^�� '
1 � A U e
u { � � � � � � � D � � J i � � � 9 G � � u^ �OpenBackupEventLogA >7 UNCServerName E D >7 FileName E D >D AnsiString D� >> UnicodeServerName D���� > ReturnHandle A � A � >> UnicodeFileName D�� > Status A +
A k A E C
1 A � $
Z
^
^ T^ �" 7 UNCServerName 7 FileName �D AnsiString ����> UnicodeServerName ��> UnicodeFileName 9 ^ 9% r^ 9? :^ 9S ^ 9c r^ 9s s^ 9� :^ 9� s^ 9� s^ O � � � 8 � � � � �+ �/ �5 �9 �E # �L $ �Y % �k ' �o ( �y ) � * �� . �� 1 �� 3 �� 4 �� 5 �� 7 � � x � | �
� � � �
� � � �
V � Z �
f � j �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � �
� �
� # �
8 � < �
��U���VW�u�E�3�P�}�� W�E�P� 9} tWW�E�P�u � ��u�3 ���E�P�E�P�E�P� ��y
P� ����u�f9}�t�u�d�
0 W�q� _��^�� # 7 S ] � ~ � d � �
} �
y 4 � A 9 G �
� T^ �OpenBackupEventLogW >�% UNCServerName E D >�% FileName E D > LogHandle D���� >> Unicode D�� > ReturnHandle A c # >> UnicodeFileName D� > Status A D $ A h Z U^
^ �" �% UNCServerName �% FileName ���� LogHandle ��> Unicode �> UnicodeFileName 9 :^ 9! :^ 95 S^ 9| 2^ O � � � 8 � � �
� � � �' � �, � �? � �D � �F � �W �[ �a �c �e �h �n
�� �� � � � � � �
� � � �
�
�
k � o �
� � � �
� � � �
y � } �
� � � �
� � � �
� � � �
� � � �
��U���V�u �E�3�P�u�� �u�E�P� �E�P�E�P�E�P� ��yP� ��u���^�� $ 5 ? � � D O � B � � 3 G O K ^ �OpenEventLogA >7 UNCServerName E D >7 ModuleName E D >D AnsiString D�� >D AnsiModuleName D� > LogHandle D���� > ReturnHandle A : > Status A 9
A H Z ^
^ �" 7 UNCServerName 7 ModuleName ��D AnsiString �D AnsiModuleName ���� LogHandle 9 ^ 9" ^ O � h O 8
\ � � � � � �( � �9 � �= � �C � �E � �H � �K � � � x � | �
� � � �
� � � �
k � o �
� � � �
� � � �
S � W �
c � g �
| � � �
��U����E�u P� �u�E�P� �E�P�E�P�E�P� ��y
P� 3���E��� / 9 � � $ H � � 3 G H D ;^ �OpenEventLogW >�% UNCServerName E D >�% ModuleName E D > LogHandle D���� >> Unicode D�� > ReturnHandle A ? >> UnicodeModuleName D� > Status A 3
Z @^
^ �" �% UNCServerName �% ModuleName ���� LogHandle ��> Unicode �> UnicodeModuleName 9 :^ 9 :^ O � h H 8
\ l � t � u �" w �3 } �7 ~ �= �? � �A � �D � � � X � \ �
� � � �
� � � �
' � + �
p � t �
' � + �
7 � ; �
P � T �
��U��VW�u �} W�u�u�u�u �u� ��x�? vj �7�u�u� ��yV� ��� _��^]� 8 � D � � d U � K % G o � � 3 G U Q �^ �ReadEventLogA > hEventLog E D >" dwReadFlags E D >" dwRecordOffset E D > lpBuffer E D >" nNumberOfBytesToRead E D >" pnBytesRead A
A E D ! >" pnMinNumberOfBytesNeeded E D > Status A $ & Z �^ x^
^ �" hEventLog " dwReadFlags " dwRecordOffset lpBuffer " nNumberOfBytesToRead " pnBytesRead # " pnMinNumberOfBytesNeeded O � X U 8 L X � ] �$ i �- k �> n �B o �H t �Q v � � � � � �
� � � �
� � �
4 � 8 �
c � g �
� � � �
� � � �
� � � �
� # �
H � L �
L � P �
��U��VW�u �} W�u�u�u�u �u� ��x�? vj�7�u�u� ��yV� ��� _��^]� 8 � D � � d U � K % G o � � 3 G U Q |^ �ReadEventLogW > hEventLog E D >" dwReadFlags E D >" dwRecordOffset E D > lpBuffer E D >" nNumberOfBytesToRead E D >" pnBytesRead A
A E D ! >" pnMinNumberOfBytesNeeded E D > Status A $ & Z ^ x^
^ �" hEventLog " dwReadFlags " dwRecordOffset lpBuffer " nNumberOfBytesToRead " pnBytesRead # " pnMinNumberOfBytesNeeded O � X U 8 L O � T �$ _ �- a �> d �B e �H j �Q l � � � � � �
� � � �
� � �
4 � 8 �
c � g �
� � � �
� � � �
� � � �
� # �
H � L �
L � P �
��U����E�u P� �u�E�P� �E�P�E�P�E�P� ��y
P� 3���E��� / 9 � � $ H � � : G H D ^ �RegisterEventSourceA >7 UNCServerName E D >7 ModuleName E D >D AnsiString D�� >D AnsiModuleName D� > LogHandle D���� > ReturnHandle A ? > Status A 3
Z ^
^ �" 7 UNCServerName 7 ModuleName ��D AnsiString �D AnsiModuleName ���� LogHandle 9 ^ 9 ^ O � h H 8
\ � � � � � �" � �3 � �7 � �= � �? � �A � �D � � � X � \ �
� � � �
� � � �
R � V �
w � { �
. � 2 �
> � B �
X � \ �
��U����E�u P� �u�E�P� �E�P�E�P�E�P� ��y
P� 3���E��� / 9 � � $ H � � : G H D 5^ �RegisterEventSourceW >�% UNCServerName E D >�% ModuleName E D > LogHandle D���� >> Unicode D�� > ReturnHandle A ? >> UnicodeModuleName D� > Status A 3
Z 8^
^ �" �% UNCServerName �% ModuleName ���� LogHandle ��> Unicode �> UnicodeModuleName 9 :^ 9 :^ O � h H 8
\ � � � � � �" � �3 � �7 � �= � �? � �A � �D � � � X � \ �
� � � �
� � � �
. � 2 �
w � { �
. � 2 �
> � B �
X � \ �
jh � 3��u�u��] ���PVd�0 �p� ���}܅��� �u�9]�s6jVd�0 �p� �U����t#�M$�4�P� ��u�E��E�
��E������ �E��3�@Ëe��E�
��E�����3��}܃}� u$VVV�u(W�u �u �u�u�u�u �u� �E�ރ}� v �<� t�4�Vd�0 �p� C;]�r�WVd�0 �p� �E��� ���yP� �3�F�ƋM�d�
Y_^[��$ � � *
Q
g � � � � � � D 0 $ $ � $ $ � � � 2 G 0 ^ �ReportEventA > hEventLog E D >! wType E D >! wCategory E D >" dwEventID E D > lpUserSid E D >! wNumStrings E D >" dwDataSize E D >^ lpStrings E D$ > lpRawData E $ D( >t ReturnValue A y
>" i A � ; A
> ^ pAStrings A 0 D��� >" AllocatedStrings A X D�� > Status A A D�� Z ^ &^
^ $ @�"
:��� $LN20 $LN31 $LN33 $LN19 hEventLog ! wType ! wCategory " dwEventID lpUserSid ! wNumStrings " dwDataSize $ ^ lpStrings ( lpRawData ��� ^ pAStrings ��" AllocatedStrings �� Status 9( 0^ 9O 0^ 9� 2^ 9� 2^ O � 0 8 � � � � � � � �3 � �; � �> � �C � �[ � �_ � �o � �r � �y � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � �
� � � � � � � � � � � � � x � | �
� � � �
� � � �
� �
8 � < �
h � l �
� � � �
� � � �
� � � �
+ � / �
Y � ] �
y � } �
� � � �
� � � �
� � � �
�
�
! � % �
Y � ] �
s � w �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� �
� � jh � 3��u�u��] ���PVd�0 �p� ���}܅��� �u�9]�sAjVd�0 �p� �ȋU� ���u �E� ���E$�4�Q� �E�u��E�
��E������3�@Ëe��E�
��E�����3��}܃}� u$VVV�u(W�u �u �u�u�u�u �u� �E�ރ}� v �<� t�4�Vd�0 �p� C;]�r�WVd�0 �p� �E��� ���yP� �3�F�ƋM�d�
Y_^[��$ � � *
Q
r � � � � � D 6 $ $ � $ $ � � � 2 G 6 $ ?^ �ReportEventW > hEventLog E D >! wType E D >! wCategory E D >" dwEventID E D > lpUserSid E D >! wNumStrings E D >" dwDataSize E D ><^ lpStrings E D$ > lpRawData E $ D( >t ReturnValue A #
>" i A � ; A >A^ pUStrings A 0 D��� >" AllocatedStrings D�� > Status A A " D�� Z ^ D^
^ $ @�"
:��� $LN20 $LN31 $LN33 $LN19 hEventLog ! wType ! wCategory " dwEventID lpUserSid ! wNumStrings " dwDataSize $ <^ lpStrings ( lpRawData ���A^ pUStrings ��" AllocatedStrings �� Status 9( 0^ 9O 0^ 9� 2^ 9 2^ O � 6 8 � � � � � � � �3 � �; � �> � �C � �] � �a � �h � �j � �} � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � � � � � � � � � �" � �$ � � � x � | �
� � � �
� � � �
� �
8 � < �
h � l �
� � � �
� � � �
� � � �
+ � / �
Y � ] �
y � } �
� � � �
� � � �
� � � �
� �
I � M �
c � g �
t � x �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
� � �
� � ��U��M V�uW3��;�s:��t69Utf98t��B;�r�� �8 tB@;�r�@;�s��u9}u�3���� �_^]� � d \ �
O %
J o � 0 1 G \
X ^ �StringCheck >^ ppbTest A L E D > pbTooFar A T E D >t isUnicode E D >t noEmptyAllowed E D >q puTest A (
A 6 / > pTest A +
A 6 / >t len A K �" ^ ppbTest pbTooFar t isUnicode t noEmptyAllowed O� � \ 8 � o � u � w � { �( | �- ~ �0 � �2 � �7 � �= � �> � �K � �M � �Q v �W � � � � � � �
� � � �
� � � �
� �
� �
H � L �
} � � �
� � � �
� � � �
� � � �
� � � �
$ � ( �
� � � �
��U��S�]VW�C ;E so�u��Dwgj X;�v���;E sW��tBVj � P� ����u� ��:VSW� �� W� Wj �� P� �S� ��t3���� �_^[]� 5 < Q � Z e l t � � � � � �
! } | � 9 - F � � ^ �TestSid > pbStartOfSid A � E D > pbTooFar E D >" sidLength A d M E D
> ^ pSid A B 0 A z > pOnePastEndOfSid A $ >t valid A c A � Z #^ #^ �" pbStartOfSid pbTooFar " sidLength 93 '^ 9: *^ ^: 9c '^ 9j -^ O � � � 8 � + � 2 � 5 �" 6 �$ : �+ = �0 ? �B @ �F B �M D �X E �^ F �p G �r K �z N �~ O �� 3 �� R � � � � � �
� � � �
� � � �
) � - �
U � Y �
m � q �
� � � �
� � � �
� � � �
� � � �
� �
� � � �
� � � �
� � � �
� � � �
� � � �
� � � �
���� ��� ���� � � F��� ��� ���� � � F�qM^ V N ���%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\i386\precomp.obj ��� < P t ^ ^ InitUnicodeString ��
� ^ t t ^ ^ StringCheck
� B ^ t ^
^ InitAnsiString � " i% ^ BaseSetLastNTError �
^
� G] " ^ RegisterEventSourceA ��� �# �# �V ^ " ^ ElfRegisterEventSourceA ^
^
� ^ OpenEventLogA �� ^ ElfOpenEventLogA ���
7
� * ! ! " ! " ^ t ^ ^ ReportEventA ��� " ^ ^ TestSid
�
�
B
�
t !^ "^ IsValidSid �6 ! ! " ! " ^ ! " " $^ %^ ElfReportEventA
-
� " " (^
)^
� " t +^
,^
� " " .^
/^
� " �?
1^
� �% �% 3^ " 4^ RegisterEventSourceW ��� < < �V 6^ " 7^ ElfRegisterEventSourceW ^
9^
� 4^ OpenEventLogW ��
�%
� * ! ! " ! " <^ t =^ >^ ReportEventW ��� 7^ ElfOpenEventLogW ���
<
� 6 ! ! " ! " A^ ! " " B^ C^ ElfReportEventW " " " t E^ " F^ GetEventLogInformation � " " " H^ " I^ ElfGetLogInformation ��� �% t K^ L^ BackupEventLogW < N^ " O^ ElfBackupEventLogFileW � P < @- Q^
R^
� 4^ OpenBackupEventLogW " 7^ ElfOpenBackupEventLogW � " t V^ " W^ GetOldestEventLogRecord " Y^ Z^ ElfOldestRecord L^ ClearEventLogW �" O^ ElfClearEventLogFileW ��& W^ GetNumberOfEventLogRecords � Z^ ElfNumberOfRecords � t `^ " a^ NotifyChangeEventLog ��� `^ c^ ElfChangeNotify
t e^ " f^ DeregisterEventSource �� e^ & h^ ElfDeregisterEventSource ��� f^ CloseEventLog �� h^ ElfCloseEventLog ��� 7 t l^ m^ BackupEventLogA
A
� < o^ p^
q^
�
g
� m^ ClearEventLogA � ^ OpenBackupEventLogA " " t v^ w^ CheckEventLogBuffer
&
� " " " " " " t z^ {^ ReadEventLogW ��" " " " " " }^ ~^ ElfReadEventLogW ��� {^ ReadEventLogA �� ~^ ElfReadEventLogA ���
���
���
���
���� -FC -MT -c -Zl -Zp8 -Gy -Gm- -W4 -Gz -hotpatch -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 ��
�^ f �^ -arch:IA32 -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X � �^ �^ �^ �^ �^ �� � C�&�+5��'�� � �Q
|خ�y>P�iKķ7O�U3)� `�M��{����e�{�4 F�Uv����'�� ß� 7>2NM�������f&�TO�Fx���y��q�TO�Fx���P��i'6�m����WQ���`���vL��ے�Aeѐ`���vL�V?���-��� I�+���l3� �,͢$����T�A�`���vL�q`�x<!�L�ڑ(�
<WE惆8-d��u����3�a�_�%\��L�RK�n��,�d��jZ�N��n���Uf�N�g�p���_���̉��e@���${���jZ�N�ܮ$�:�;��jZ�N��!Jd|�0M ��E���O���v��h��sZ�y�u>��Q�h��u֞�b� ?�>�
��J�# �$��&�
i^��+�0Y��v�E�� �yb�`,R�v��k� �yb�`��zud��5��;�d�q�|�Gt͞���_WS��H���/G���} -INCLUDE:___@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUrDIGUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� @vol.md �� .debug$S � e - I ^ | � � � � " : N i � � � � � ( A T j } � � � .text$mn d (`� e .debug$S � e .text$mn r ��ݠ e .debug$S � e .text$mn +?�� e .debug$S �
e .text$mn l ]3?� e .debug$S ( E e .text$mn
d (`� e .debug$S �
e .text$mn w ��P e .debug$S
� e .text$mn " ��� e .debug$S � e .text$mn " ��� e .debug$S � e .text$mn . ow> e .debug$S � e .text$mn % =�m� e .debug$S �
e .text$mn % =�m� e .debug$S �
e .text$mn R 7a 0 e .debug$S L e .text$mn [ �a|g e .debug$S ` e .text$mn % =�m� e .debug$S � e .text$mn � ^�,� e .debug$S � ' e .text$mn � �� e .debug$S ! d e .text$mn " O � � e .debug$S # � " e .text$mn $ H 4�� e .debug$S % � $ e .text$mn & U �f. e .debug$S ' � & e .text$mn ( U em�` e .debug$S ) � ( e .text$mn * H 4�� e .debug$S + � * e .text$mn , H 4�� e .debug$S - � , e .text$mn . 0 �� e .debug$S / $ 7 . e .debug$F 0 . e .text$mn 1 6 �c e .debug$S 2 5 1 e .debug$F 3 1 e .text$mn 4 \ m�-� e .debug$S 5 @ 4 e .text$mn 6 � Ǵ( e .debug$S 7 � # 6 e � . � & * 4 " E X
j 1 { ( � � 4 � 6 � � , � $ & A \ z � � � � � � _memcpy $LN20 � . $LN31 � . $LN33 � . $LN19 � . $LN20 � 1 $LN31 � 1 $LN33 � 1 $LN19 � 1 .xdata$x 8 b� �. e 8 .voltbl 9 �;+�. e _volmd 9 .xdata$x : b� �1 e 5 : .voltbl ; �
VT1 e _volmd ; .voltbl < �A' e _volmd < .voltbl = -=m e _volmd = .voltbl > �|ӌ e _volmd > .debug$T ? h
e .sxdata @ e .chks64 A e Q _ElfReportEventA@48 _ElfReadEventLogA@28 _ElfRegisterEventSourceA@12 _ElfOpenEventLogA@12 __imp__RtlFreeUnicodeString@4 __imp__RtlAnsiStringToUnicodeString@12 __imp__RtlInitAnsiString@8 _ElfReportEventW@48 __imp__RtlAllocateHeap@12 _ElfReadEventLogW@28 __imp__HeapFree@12 _IsValidSid@4 __imp__GetProcessHeap@0 __imp__HeapAlloc@12 _ElfOpenBackupEventLogW@12 _ElfRegisterEventSourceW@12 _ElfOpenEventLogW@12 __imp__RtlInitUnicodeString@8 _ElfBackupEventLogFileW@8 __imp__RtlFreeHeap@12 _ElfClearEventLogFileW@8 __imp__RtlDosPathNameToNtPathName_U@16 _ElfGetLogInformation@20 _ElfOldestRecord@8 _ElfNumberOfRecords@8 _ElfChangeNotify@8 _ElfDeregisterEventSource@4 _ElfCloseEventLog@4 __imp__SetLastError@4 __imp__RtlNtStatusToDosError@4 _ReportEventA@36 _ReadEventLogA@28 _OpenBackupEventLogA@8 _RegisterEventSourceA@8 _OpenEventLogA@8 _BackupEventLogA@8 _ClearEventLogA@8 _ReportEventW@36 _ReadEventLogW@28 _CheckEventLogBuffer@16 _StringCheck@16 _TestSid@12 _OpenBackupEventLogW@8 _RegisterEventSourceW@8 _OpenEventLogW@8 _BackupEventLogW@8 _ClearEventLogW@8 _GetEventLogInformation@20 _GetOldestEventLogRecord@8 _GetNumberOfEventLogRecords@8 _NotifyChangeEventLog@8 _DeregisterEventSource@4 _CloseEventLog@4 _InitUnicodeString@8 _InitAnsiString@8 _BaseSetLastNTError@4 __SEH_prolog4 __except_handler4 __sehtable$_ReportEventA@36 __sehtable$_ReportEventW@36 /220 1606895243 100666 41634 `
LM �F�_�� � .debug$S L h @ B.rdata 6 | @0@.rdata � � @0@.rdata � @@@.rdata P � @ @@@.rdata B | @@@.bss � 0�.data � � @0�.rdata D � @@@.rdata @0@.gfids$y $ @0@.gfids$y 4 @0@.text$mn ! < ] `.debug$S l { � @B.text$mn ! A b `.debug$S l � � @B.text$mn ' F m `.debug$S � � +! @B.text$mn ! �! �! `.debug$S l �! D# @B.text$mn ! �# �# `.debug$S l �# I% @B.text$mn �% �% `.debug$S �% �& @B.text$mn =' [' `.debug$S , y' �( @B.text$mn �( ) `.debug$S ( ') O* @B.text$mn �* �* `.debug$S �* �+ @B.text$mn * /, Y, `.debug$S D w, �. @B.text$mn ! Q/ r/ `.debug$S t �/ 1 @B.text$mn ! ^1 1 `.debug$S t �1 3 @B.text$mn * k3 �3 `.debug$S D �3 �5 @B.text$mn * �6 �6 `.debug$S P �6 %9 @B.text$mn - �9 �9 `.debug$S � : �< @B.text$mn - D= q= `.debug$S � �= #@ @B.text$mn 0 �@ �@ `.debug$S � A D @B.text$mn 0 �D E `.debug$S � #E H @B.text$mn $ �H I `.debug$S � I �J @B.text$mn - QK ~K `.debug$S � �K <N @B.text$mn - �N O `.debug$S � 1O �Q @B.text$mn M {R �R `.debug$S � �R �W ! @B.text$mn P �X Y `.debug$S � :Y &^ # @B.text$mn J �_ �_ `.debug$S d �_ Pd @B.text$mn J �e �e `.debug$S d �e Rj @B.text$mn M �k �k `.debug$S � �k �p ! @B.text$mn $ �q �q `.debug$S � r �s @B.debug$S < 5t qt @B.debug$S , �t �t @B.debug$S 8 �t �t @B.debug$S , u =u @B.debug$S 8 Qu �u @B.debug$S 4 �u �u @B.debug$S 8 �u v @B.debug$S 0 1v av @B.debug$T ` uv @ B.chks64 h Ձ
.drectve n E�
� � R d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\elf_client.obj : < � k k
Microsoft (R) Optimizing Compiler � , * eventlog__MIDL_AutoBindHandle � � " S^ elf_MIDL_TYPE_FORMAT_STRING " X^ elf_MIDL_PROC_FORMAT_STRING # X^ _elf_MIDL_PROC_FORMAT_STRING # S^ _elf_MIDL_TYPE_FORMAT_STRING � � 9 q ����o� }�+4qt*Y lռ��́dq�X � ���@�R�ђ�e��<r = h��� a� � Ą��� o���v Pb�V0'R��v�Q�� � 6 onecore\admin\wmi\events\advapi\objfre\i386\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\i386\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\admin\wmi\events\advapi\elf_client.c onecore\admin\wmi\events\idl\elf\objfre\i386\elf_c.c $T0 $ebp = $eip $T0 4 + ^ = $ebp $T0 ^ = $esp $T0 8 + = � La^ � �
0 ` � � � J�� j�B��b�:p��Z�
0I ( U U [ K\F\ �[\[ � 0� \ \[\ 0� � �� ) �� [� � � ( [ L �\[ �� [ �L �\[ ' K\HI .�[\[ ) � [\ [ K\F\ �[\[ �\� �� � � � ' K\HI ��[\[ � �� )T �� [� �� ) �� [ ) [� � � � ' K\HI �[\[ ) � [ �� � � ' K\HI v�[\[� � � ' K\HI D�[\[
n # H 0H $ FE p H 0H $ FE 0 p H 0� 8 @ DG N p H 0� 8 @ DG N p H 0H $ $ DE P! p H 0H $ $ DE P! p H 0H D DE � V H p H 1 \* @ FG
^ 0 0 H H f p H 1 \* @ FG
^ 0 0 H H f p H 1 \* @ FG
^ 0 H H f p H
0H < @ EG H H � j x P! P! p H < 0H � @ FE H H H H � � � � 0 � $ � ( H , 0 " 4 "p 8 H 0H $ FE &p H
0H $ FE @p H 1 \) @ FG
Z @ @H H f p H 1 \) @ FG
Z @ @H H f p H 1 \) @ FG
Z @H H f p H 0H < @ EG H H � ^ x P! P! p H < 0H � @ FE H H H H � h� r @ � $ | ( H , 0 " 4 "p 8 H 1 \ $ EC
^ ! � �p H 1 \ DA
^ p H 1 \" FE
^ � � �p H 0H 4 $ EG H �� P! p H 0H $ DE p H @ 0H � @ FE H H H H 0 � � ( 0 $ � ( 2 , `H 0 4 " 8 "p < H 8 0H � $ FE
V H H H � ~� � 0 � $ � ( H , 0 "p 4 H 8 0H � $ FE
V H H H � �� � @ � $ � ( H , 0 "p 4 # D �?'�*��?x�y)�#� ]��� ��� +H` ]��� ��� +H`
��U��u �uh h � ��]� � $ ! � � � 4 G ! 3^ �ElfrBackupELFA >�Y LogHandle E D >^ BackupFileName E D
Z
^ �" �Y LogHandle ^ BackupFileName O � 0 ! ` $ j � n � u � � X � \ �
� � � �
� � � �
< � @ �
��U��u �uh2 h � ��]� � $ ! � � � 4 G ! M^ �ElfrBackupELFW >�Y LogHandle E D > ^ BackupFileName E D
Z
^ �" �Y LogHandle ^ BackupFileName O � 0 ! ` $ h � l � s � � X � \ �
� � � �
� � � �
< � @ �
��U��u�u�u �uh h � ��]� � $ ' � � . 6 G ' # B^ �ElfrChangeNotify >�Y LogHandle E D >� ClientId E D >" Event E D
Z
^ �" �Y LogHandle � ClientId " Event O � 0 ' ` $ � � � �# � � � X � \ �
� � � �
� � � �
� � � �
p � t �
��U��u �uh� h � ��]� � $ ! � � � 3 G ! 4^ �ElfrClearELFA >�Y LogHandle E D >^ BackupFileName E D
Z
^ �" �Y LogHandle ^ BackupFileName O � 0 ! ` $ Y � ] � d � � X � \ �
� � � �
� � � �
< � @ �
��U��u �uh h � ��]� � $ ! � � � 3 G ! N^ �ElfrClearELFW >�Y LogHandle E D > ^ BackupFileName E D
Z
^ �" �Y LogHandle ^ BackupFileName O � 0 ! ` $ W � [ � b � � X � \ �
� � � �
� � � �
< � @ �
��U��uhb h � �� ]� � $ � � � 1 G J^ �ElfrCloseEL >)^ LogHandle E D
Z
^ �" )^ LogHandle O � 0 ` $ x � | � � � � X � \ �
� � � �
� � � �
��U��uh h � �� ]� � $ � � � > G ^ �ElfrDeregisterClusterSvc >q UNCServerName E D
Z
^ �" q UNCServerName O� 0 ` $ � � $ � � X � \ �
� � � �
� � �
��U��uh� h � �� ]� � $ � � � ? G I^ �ElfrDeregisterEventSource >)^ LogHandle E D
Z
^ �" )^ LogHandle O � 0 ` $ � � � � � � � X � \ �
� � � �
� � � �
��U��uh� h � �� ]� � $ � � � 1 G ^ �ElfrFlushEL >�Y LogHandle E D
Z
^ �" �Y LogHandle O � 0 ` $ S � W � ] � � X � \ �
� � � �
� � � �
��U��u�u�u�u �uhr h � �� ]� � $ * � � � ; G * & ^ �ElfrGetLogInformation >�Y LogHandle E D >" InfoLevel E D > lpBuffer E D >" cbBufSize E D >" pcbBytesNeeded E D
Z
^ �" �Y LogHandle " InfoLevel lpBuffer " cbBufSize " pcbBytesNeeded O � 0 * ` $ @ � D �& N � � X � \ �
� � � �
� � � �
� � � �
$ � ( �
Y � ] �
� �
��U��u �uh� h � ��]� � $ ! � � 9 G ! F^ �ElfrNumberOfRecords >�Y LogHandle E D >" NumberOfRecords E D
Z
^ �" �Y LogHandle " NumberOfRecords O � 0 ! ` $ � � � � � � � X � \ �
� � � �
� � � �
D � H �
��U��u �uh� h � ��]� � $ ! � � 6 G ! E^ �ElfrOldestRecord >�Y LogHandle E D >" OldestRecordNumber E D
Z
^ �" �Y LogHandle " OldestRecordNumber O� 0 ! ` $ � � � � � � � X � \ �
� � � �
� � � �
D � H �
��U��u�u�u�u �uh� h � �� ]� � $ * � � � 2 G * & ,^ �ElfrOpenBELA >p UNCServerName E D >^ FileName E D >" MajorVersion E D >" MinorVersion E D >)^ LogHandle E D
Z
^ �" p UNCServerName ^ FileName " MajorVersion " MinorVersion )^ LogHandle O � 0 * ` $ � � � �& � � � X � \ �
� � � �
� � � �
� � � �
% � ) �
U � Y �
� �
��U��u�u�u�u �uh� h � �� ]� � $ * � � � 2 G * & ;^ �ElfrOpenBELW >q UNCServerName E D > ^ BackupFileName E D >" MajorVersion E D >" MinorVersion E D >)^ LogHandle E D
Z
^ �" q UNCServerName ^ BackupFileName " MajorVersion " MinorVersion )^ LogHandle O � 0 * ` $ � �& � � X � \ �
� � � �
� � � �
� � � �
+ � / �
[ � _ �
� $ �
��U��u �u�u�u�u �uhD h � �� ]� " � $ - � � # 1 G - ) 0^ �ElfrOpenELA >p UNCServerName E D >^ ModuleName E D >^ RegModuleName E D >" MajorVersion E D >" MinorVersion E D >)^ LogHandle E D
Z
^ �" p UNCServerName ^ ModuleName ^ RegModuleName " MajorVersion " MinorVersion )^ LogHandle O � 0 - ` $ � � �) � � � X � \ �
� � � �
� � � �
� � � �
' � + �
Z � ^ �
� � � �
d � h �
��U��u �u�u�u�u �uhL h � �� ]� " � $ - � � # 1 G - ) ?^ �ElfrOpenELW >q UNCServerName E D > ^ ModuleName E D > ^ RegModuleName E D >" MajorVersion E D >" MinorVersion E D >)^ LogHandle E D
Z
^ �" q UNCServerName ^ ModuleName ^ RegModuleName " MajorVersion " MinorVersion )^ LogHandle O � 0 - ` $ � � � �) � � � X � \ �
� � � �
� � � �
� � � �
' � + �
Z � ^ �
� � � �
d � h �
��U��u �u �u�u�u�u �uh h � ��$]� % � $ 0 � � � 1 G 0 , (^ �ElfrReadELA >�Y LogHandle E D >" ReadFlags E D >" RecordOffset E D >" NumberOfBytesToRead E D > Buffer E D >" NumberOfBytesRead E D >" MinNumberOfBytesNeeded E D
Z
^ �" �Y LogHandle " ReadFlags " RecordOffset " NumberOfBytesToRead Buffer " NumberOfBytesRead ! " MinNumberOfBytesNeeded O � 0 0 ` $ � � � �, � � � X � \ �
� � � �
� � � �
� � � �
( � , �
U � Y �
� � � �
� � � �
� � � �
��U��u �u �u�u�u�u �uh h � ��$]� % � $ 0 � � � 1 G 0 , 8^ �ElfrReadELW >�Y LogHandle E D >" ReadFlags E D >" RecordOffset E D >" NumberOfBytesToRead E D > Buffer E D >" NumberOfBytesRead E D >" MinNumberOfBytesNeeded E D
Z
^ �" �Y LogHandle " ReadFlags " RecordOffset " NumberOfBytesToRead Buffer " NumberOfBytesRead ! " MinNumberOfBytesNeeded O � 0 0 ` $ � �, * � � X � \ �
� � � �
� � � �
� � � �
( � , �
U � Y �
� � � �
� � � �
� � � �
��U��u�u �uh� h � ��]� � $ $ � � R < G $ "^ �ElfrRegisterClusterSvc >q UNCServerName E D >" pulSize E D > ^ ppPackedEventInfo E D
Z
^ �" q UNCServerName " pulSize ^ ppPackedEventInfo O � 0 $ ` $ �
� � � X � \ �
� � � �
� � � �
� �
� � � �
��U��u �u�u�u�u �uh� h � �� ]� " � $ - � � 0 > G - ) /^ �ElfrRegisterEventSourceA >p UNCServerName E D >^ ModuleName E D >^ RegModuleName E D >" MajorVersion E D >" MinorVersion E D >)^ LogHandle E D
Z
^ �" p UNCServerName ^ ModuleName ^ RegModuleName " MajorVersion " MinorVersion )^ LogHandle O� 0 - ` $ � � � �) � � � X � \ �
� � � �
� � � �
� �
4 � 8 �
g � k �
� � � �
p � t �
��U��u �u�u�u�u �uh� h � �� ]� " � $ - � � 0 > G - ) >^ �ElfrRegisterEventSourceW >q UNCServerName E D > ^ ModuleName E D > ^ RegModuleName E D >" MajorVersion E D >" MinorVersion E D >)^ LogHandle E D
Z
^ �" q UNCServerName ^ ModuleName ^ RegModuleName " MajorVersion " MinorVersion )^ LogHandle O� 0 - ` $ � � � �) � � � X � \ �
� � � �
� � � �
� �
4 � 8 �
g � k �
� � � �
p � t �
��U��u<�E4�u8P�u0�E �u,�u(�u$�u P�u�EP�EP�u �uhd h � ��@]�8 8 = B � $ M 8 � � * 6 G M I %^ �ElfrReportEventA >�Y LogHandle E D
>" Time E D >! EventType E D >! EventCategory E D >" EventID E D >! NumStrings E D >" DataSize E D >^ ComputerName E D$ >^ UserSID E $ D( >^ Strings E ( D,
> Data E , D0 >! Flags E 0 D4 >" RecordNumber E 4 D8 >" TimeWritten E 8 D<
Z
^ �" �Y LogHandle " Time ! EventType ! EventCategory " EventID ! NumStrings " DataSize $ ^ ComputerName ( ^ UserSID , ^ Strings 0 Data 4 ! Flags 8 " RecordNumber < " TimeWritten O � 0 M ` $ � � � �I � � X � \ �
� � � �
� � � �
� � � �
� # �
M � Q �
~ � � �
� � � �
� � � �
� �
< � @ �
g � k �
� � � �
� � � �
� � � �
l � p �
��U��u@�E8�u<P�u4�E �u0�u,�u(�u$P�u �E�uP�EP�u �uh� h � ��D]�< ; @ E � $ P < � � { ? G P L ^ �ElfrReportEventAndSourceW >�Y LogHandle E D
>" Time E D >! EventType E D >! EventCategory E D >" EventID E D > ^ SourceName E D >! NumStrings E D >" DataSize E D$ > ^ ComputerName E $ D( >^ UserSID E ( D, > ^ Strings E , D0
> Data E 0 D4 >! Flags E 4 D8 >" RecordNumber E 8 D< >" TimeWritten E < D@
Z
^ �" �Y LogHandle " Time ! EventType ! EventCategory " EventID ^ SourceName ! NumStrings $ " DataSize ( ^ ComputerName , ^ UserSID 0 ^ Strings 4 Data 8 ! Flags < " RecordNumber @ " TimeWritten O � 0 P ` $ p � t �L � � � X � \ �
� � � �
� � � �
� � � �
( � , �
V � Z �
� � � �
� � � �
� � � �
� �
H � L �
v � z �
� � � �
� � � �
� �
2 � 6 �
� � � �
��U��u8�E4P�u0�E �u,�u(�u$�u P�u�EP�EP�u �uh� h � ��<]�4 5 : ? � $ J 4 � � � 8 G J F ^ �ElfrReportEventExA >�Y LogHandle E D >^ TimeGenerated E D >! EventType E D >! EventCategory E D >" EventID E D >! NumStrings E D >" DataSize E D >^ ComputerName E D$ >^ UserSID E $ D( >^ Strings E ( D,
> Data E , D0 >! Flags E 0 D4 >" RecordNumber E 4 D8
Z
^ �" �Y LogHandle ^ TimeGenerated ! EventType ! EventCategory " EventID ! NumStrings " DataSize $ ^ ComputerName ( ^ UserSID , ^ Strings 0 Data 4 ! Flags 8 " RecordNumber O� 0 J ` $ � � � �F � � � X � \ �
� � � �
� � � �
� � � �
* � . �
X � \ �
� � � �
� � � �
� � � �
� �
G � K �
r � v �
� � � �
� � � �
4 � 8 �
��U��u8�E4P�u0�E �u,�u(�u$�u P�u�EP�EP�u �uh\ h � ��<]�4 5 : ? � $ J 4 � � � 8 G J F ^ �ElfrReportEventExW >�Y LogHandle E D >^ TimeGenerated E D >! EventType E D >! EventCategory E D >" EventID E D >! NumStrings E D >" DataSize E D > ^ ComputerName E D$ >^ UserSID E $ D( > ^ Strings E ( D,
> Data E , D0 >! Flags E 0 D4 >" RecordNumber E 4 D8
Z
^ �" �Y LogHandle ^ TimeGenerated ! EventType ! EventCategory " EventID ! NumStrings " DataSize $ ^ ComputerName ( ^ UserSID , ^ Strings 0 Data 4 ! Flags 8 " RecordNumber O� 0 J ` $ � � � �F � � � X � \ �
� � � �
� � � �
� � � �
* � . �
X � \ �
� � � �
� � � �
� � � �
� �
G � K �
r � v �
� � � �
� � � �
4 � 8 �
��U��u<�E4�u8P�u0�E �u,�u(�u$�u P�u�EP�EP�u �uhl h � ��@]�8 8 = B � $ M 8 � � * 6 G M I 7^ �ElfrReportEventW >�Y LogHandle E D
>" Time E D >! EventType E D >! EventCategory E D >" EventID E D >! NumStrings E D >" DataSize E D > ^ ComputerName E D$ >^ UserSID E $ D( > ^ Strings E ( D,
> Data E , D0 >! Flags E 0 D4 >" RecordNumber E 4 D8 >" TimeWritten E 8 D<
Z
^ �" �Y LogHandle " Time ! EventType ! EventCategory " EventID ! NumStrings " DataSize $ ^ ComputerName ( ^ UserSID , ^ Strings 0 Data 4 ! Flags 8 " RecordNumber < " TimeWritten O � 0 M ` $ < � @ �I S � � X � \ �
� � � �
� � � �
� � � �
� # �
M � Q �
~ � � �
� � � �
� � � �
� �
< � @ �
g � k �
� � � �
� � � �
� � � �
l � p �
��U��u�u �uh< h � ��]� � $ $ � � < < G $ ^ �ElfrWriteClusterEvents >q UNCServerName E D >" ulSize E D > pBuffer E D
Z
^ �" q UNCServerName " ulSize pBuffer O� 0 $ ` $ + � / � 7 � � X � \ �
� � � �
� � � �
� � � �
| � � �
� / - O^ eventlog_FormatStringOffsetTable
� P^ BindingRoutines
� ) ' S^ elf__MIDL_TypeFormatString
� � eventlog_StubDesc
� ) ' X^ elf__MIDL_ProcFormatString
� & $
eventlog_ClientIfHandle
� , * ! eventlog___RpcClientInterface # #
� ! �7 _RpcTransferSyntax & &
V N ���%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\i386\precomp.obj ���
�
�
%!
�
[,
�
^
� :
�Y ^ ! ! " ! " ^ ^ ^ ! "
^ ^ ElfrReportEventExA � �' � z+ ^ ^ NdrClientCall4 �
�
�
^
� :
�Y ^ ! ! " ! " ^ ^ ^ ! "
^ ^ ElfrReportEventExW �B �Y " ! ! " ^ ! " ^ ^ ^ ! " " ^ & ^ ElfrReportEventAndSourceW ��
�Y ^ ^ ElfrFlushEL �Y " " " ^ " ^ ElfrGetLogInformation �� q " ^ " ^ ElfrWriteClusterEvents �
q ^ & ^ ElfrDeregisterClusterSvc ���
� q " ^ ^ " !^ ElfrRegisterClusterSvc �> �Y " ! ! " ! " ^ ^ ^ ! " " #^ $^ ElfrReportEventA ���" �Y " " " " " &^ '^ ElfrReadELA
�Y
� p ^ " " )^ *^ +^ ElfrOpenBELA ��� p ^ ^ " " )^ -^ & .^ ElfrRegisterEventSourceA ��� .^ ElfrOpenELA �Y ^ 1^ 2^ ElfrBackupELFA � 2^ ElfrClearELFA ��> �Y " ! ! " ! " ^ ^ ^ ! " " 5^ 6^ ElfrReportEventW ��� '^ ElfrReadELW q ^ " " )^ 9^ :^ ElfrOpenBELW ��� q ^ ^ " " )^ <^ & =^ ElfrRegisterEventSourceW ��� =^ ElfrOpenELW �Y � " @^ A^ ElfrChangeNotify ��� �Y " C^ D^ ElfrOldestRecord ��� D^ ElfrNumberOfRecords
)^ G^ & H^ ElfrDeregisterEventSource �� H^ ElfrCloseEL �Y ^ K^ L^ ElfrBackupELFW � L^ ElfrClearELFW �� � " 6 � � " � " �&
Pad ��
Q^ Format ���V R^ _elf_MIDL_TYPE_FORMAT_STRING .?AU_elf_MIDL_TYPE_FORMAT_STRING@@ ��> onecore\admin\wmi\events\idl\elf\objfre\i386\elf_c.c ��� S^ T^ " ? �&
Pad ��
V^ Format ���V W^ B_elf_MIDL_PROC_FORMAT_STRING .?AU_elf_MIDL_PROC_FORMAT_STRING@@ �� X^ T^ $
���
���
���
���� -FC -MT -c -Zl -Zp8 -Gy -Gm- -W4 -Gz -hotpatch -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 ��
^^ f _^ -arch:IA32 -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X � Z^ [^ \^ ]^ `^ ���Ȍa���,o�`�7G��q�����sMe� ��b��U�T�*�\ �?a��/۲��X��^�I#J��KU��<���`�S��i�i�I�jA��T _�U�z����� ���2�7��Z �������oC���ݟ$�HM�D�Wt|)�H�Tn�Ife�EQ٢8�a%�@��0`��U�#�*��|*n{�.����zЩ�
h����A(j���jU(�����W!SGz�E��e[��-����Sy7�_����K�0ǐ���%.v�t� uʒ���B�c�v�,W�����v1��D�R��Y�c�A��U�5�Q��e[M�� ��t�JF4�V�� ��_�� �y* �5�h�� O��Ok��[d:c�-mZZmh;6�&�O=
GP~�ߵ`x6������K3��kYz�)uIך�r8�PS�W!ogMH��g������Sk�n�W#-�yގ�k;�'�~,�>���δYP_�n�3"�a�fZ~��u��K[��]ΪV�|�y��A�*<Bl��L§ �����©��-�h���,�R�e�Nk�U]� "��En�缼�Hg�1��� -INCLUDE:___@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUrDIGUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� @vol.md �� .debug$S L e .rdata 6 T�@2 e , N j � � .rdata e � .rdata �`^r e � .rdata P M��� e � .rdata B ��6$ e � .bss e & .data e E .rdata D w:� e ^ .rdata
c�s� e }
.gfids$y ��� e � .gfids$y �Q�m e � .text$mn
! Gm�� e .debug$S l
e .text$mn ! � �Y e .debug$S l e .text$mn ' j��� e .debug$S � e .text$mn ! g��� e .debug$S l e .text$mn ! �7υ e .debug$S l e .text$mn ���� e .debug$S e .text$mn Q �� e .debug$S , e .text$mn �M�m e .debug$S ( e .text$mn �ۿ e .debug$S e .text$mn * ���J e .debug$S D e .text$mn ! ! ���y e .debug$S " t ! e .text$mn # ! �Ƭ� e .debug$S $ t # e .text$mn % * �� e .debug$S & D % e .text$mn ' * ��r e .debug$S ( P ' e .text$mn ) - B3 s e .debug$S * � ) e .text$mn + - �L7� e .debug$S , � + e .text$mn - 0 8� e .debug$S . � - e .text$mn / 0 ��� e .debug$S 0 � / e .text$mn 1 $ e e .debug$S 2 � 1 e .text$mn 3 - f e .debug$S 4 � 3 e .text$mn 5 - p�s4 e .debug$S 6 � 5 e .text$mn 7 M �L�M e .debug$S 8 � ! 7 e .text$mn 9 P �*� e .debug$S : � # 9 e .text$mn ; J ���g e .debug$S < d ; e .text$mn = J �
i� e .debug$S > d = e .text$mn ? M T�`� e .debug$S @ � ! ? e .text$mn A $ ��5 e .debug$S B � A e � ; � = � 9 � � A 0 L 1 g 7 | - � % � 3 � ) �
� � ? / ' # 5 @ + P e # y ! � � � � .debug$S C < e .debug$S D , e .debug$S E 8 e .debug$S F , e .debug$S G 8 e .debug$S H 4 e .debug$S I 8 e .debug$S J 0
e .debug$T K ` e .chks64 L h e � _MIDL_user_free@4 _MIDL_user_allocate@4 _eventlog_FormatStringOffsetTable _EVENTLOG_HANDLE_A_unbind@8 _EVENTLOG_HANDLE_A_bind@4 _EVENTLOG_HANDLE_W_unbind@8 _EVENTLOG_HANDLE_W_bind@4 _BindingRoutines _elf__MIDL_TypeFormatString _eventlog_StubDesc _elf__MIDL_ProcFormatString _NdrClientCall4 _eventlog__MIDL_AutoBindHandle _eventlog_ClientIfHandle _eventlog___RpcClientInterface __RpcTransferSyntax __guard_fids__ _ElfrReportEventExA@52 _ElfrReportEventExW@52 _ElfrReportEventAndSourceW@60 _ElfrFlushEL@4 _ElfrGetLogInformation@20 _ElfrWriteClusterEvents@12 _ElfrDeregisterClusterSvc@4 _ElfrRegisterClusterSvc@12 _ElfrReportEventA@56 _ElfrReadELA@28 _ElfrOpenBELA@20 _ElfrRegisterEventSourceA@24 _ElfrOpenELA@24 _ElfrBackupELFA@8 _ElfrClearELFA@8 _ElfrReportEventW@56 _ElfrReadELW@28 _ElfrOpenBELW@20 _ElfrRegisterEventSourceW@24 _ElfrOpenELW@24 _ElfrChangeNotify@16 _ElfrOldestRecord@8 _ElfrNumberOfRecords@8 _ElfrDeregisterEventSource@4 _ElfrCloseEL@4 _ElfrBackupELFW@8 _ElfrClearELFW@8 /296 1606895243 100666 1568548 `
L
�F�_�� " .debug$S �� �� @ B.rdata �� @0@.rdata �� @0@.rdata @0@.rdata Ɗ Ί @0@.rdata ؊ � @0@.rdata � � @0@.debug$S 4 �� 0� @B.debug$S @ D� �� @B.debug$S 8 �� Ћ @B.debug$P X] � @ B.chks64 h <�
.drectve ��
� � O d:\os\obj\x86fre\onecore\admin\wmi\events\advapi\objfre\i386\precomp.obj : < � k k
Microsoft (R) Optimizing Compiler � Ǭ 5 ProcThreadAttributeSafeOpenPromptOriginClaim )
AuditEventDirectoryServiceAccess SmrGcActionStop " B ProcessBreakOnTermination � % VrfPlatformModeTest # � ImageMitigationOptionsMask ) � DynamicTickVetoClockUpdateFailed B , ProcessImageFileMapping � TP_LOG_LEVEL_INFO � � DPFLTR_REFS_ID ProcessWorkingSetSwap PowerActionSleep # @ PoCsDeviceNotificationWiFi S PowerSystemMaximum & ] � SystemSingleModuleInformation ! � EnlistmentCrmInformation ( � MonitorRequestReasonIdleTimeout � PerfCSwapLite � � DPFLTR_MPIO_ID � ProfileTotalIssues � 3 ReservedForDVRF51 & � JobObjectReserved2Information 0 � InternalWakeSourcePredictedUserPresence " S SystemBatteryStatePrecise - 9 FileLinkInformationBypassAccessCheck ! RtlPathTypeDriveAbsolute # PlugPlayControlStartDevice LockQueueIoVpbLock . FileHardLinkInformation & $ � AccessReasonFromPrivilege + COR_VERSION_MAJOR X ThermalStandby � KeyBasicInformation � LearningModeLogLevelMax � VrfStandardDDIRuleClass ProcessorInformation % � DISPLAYCONFIG_TOPOLOGY_CLONE u NtProductWinNt * FpFormatI64 , PlugPlayControlTargetDeviceRelation ? PsProtectedSignerLsa F TokenSessionReference � FpCodeSquareRoot � SystemVaTypePagedPool [ GEO_ISO2 + � VRF_TRIAGE_CONTEXT_FLIGHT_TARGETED � SecurityAppliance , � MemExtendedParameterPartitionHandle # � PnpQueryTransportRelations SystemVideoState H FileLinkInformationEx , M PsEnergyComponentTypeWindowResource + l EtwCoverageSamplerQueryInformation 1 � FilterBootOptionOperationOpenSystemStore 2 \ SE_WS_APPX_SIGNATURE_ORIGIN_NOT_VALIDATED ' ] H SystemWatchdogTimerInformation " � FileFsObjectIdInformation / � JOB_OBJECT_IO_RATE_CONTROL_VALID_FLAGS # � MaxProcessMitigationPolicy ' � EtwQueryPartitionInformationV2 " � MmEtwWorkingSetTypeSystem ) � FeatureConfigurationPriorityUser � TypeA � AuditDeleteObject
LockQueueIoDatabaseLock % M
PsEnergyComponentTypeAudioIn $ � TransactionOutcomeCommitted ) � LdrModulesWaitingForDependencies LockQueueUnusedSpare15 ToleranceIntervalShort D WinHighLabelSid TpTraceThreadPriority & � JobObjectReserved9Information � MonitorRequestReasonDP 2 ] � SystemDifRemovePluginVerificationOnDriver m FileNameInfo G SuspendResumeInvocation 2 p DISPLAYCONFIG_DEVICE_INFO_GET_SOURCE_NAME $ � ACTCTX_RUN_LEVEL_AS_INVOKER � WMI_GET_SINGLE_INSTANCE $ k WinAccountProtectedUsersSid % ] w SystemPagedPoolInformationEx � MonitorRequestReasonLid . B O ProcessWin32kSyscallFilterInformation ( SystemPowerState ! 9 ThreadActualBasePriority ( B ResourceManagerBasicInformation & J SubsystemInformationTypeWin32 $ M RtlSparseBitmapOperationAny B ? ProcessFaultInformation U AclSizeInformation ) � EtwBufferStatePendingCompression � J DPFLTR_DMSERVER_ID � 0 MaxJobObjectInfoClass � SERVERSILO_TERMINATED MaxTpTraceType IoPriorityCritical " IoSessionStateCreated & � VrfPowerDelayFuzzingRuleClass LockQueueNtfsStructLock i ViewUnmap l PowerDeviceMaximum , v CrossProcOperationMemoryDirtyNotify � � DPFLTR_LSASS_ID � BootEntropySourceTpm ' � SectionOriginalBaseInformation � & DPFLTR_SCCLIENT_ID �
MaxKeyInfoClass " ] � SystemRootSiloInformation ) � WorkerFactoryCallbackIndependent & � ProcessSystemCallFilterPolicy � IMDT_UNAVAILABLE " $ � � AccessReasonFilterAce FileStandardInformation 9 ` PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION ! � JobObjectWakeInformation � WMI_DISABLE_COLLECTION � GEOCLASS_REGION 3 W WinCapabilityPrivateNetworkClientServerSid " � TransactionOutcomeAborted MutantBasicInformation \ IrqPriorityLow � TypeC * FpFormatString ] 7 SystemNumaProcessorMap $ J MaxSubsystemInformationType ? PsProtectedSignerWinTcb m FileIdExtdDirectoryInfo 2 ] � SystemCodeIntegrityCertificateInformation ( � JobObjectClearPeakJobMemoryUsed ` PS_MITIGATION_OPTION_NX i ViewShare # @ PerfInfoDebugEventReceived F TokenLogonSid ' U WinCapabilityInternetClientSid * ] � SystemSecureBootPolicyInformation IoPriorityVeryLow � BackTraceDatabaseCreate 7 � TransactionManagerOldestTransactionInformation � $ FpCodeYn 9 ThreadAmILastThread � TableInsertAsRight
SidTypeAlias ' EventProviderUseDescriptorType # - ThreadWorkloadClassDefault 0 MaxHardwareCounterType 3 DEPPolicyOptOut 6 OptionOkNoWait $ M SharedVirtualDisksSupported ! PsAttributeGroupAffinity : p DISPLAYCONFIG_DEVICE_INFO_GET_ADVANCED_COLOR_INFO * FpFormatI16 COPYFILE2_PROGRESS_STOP ; FileIdInformation ' Q ManageHotPatchLoadPatchForUser 0 GroupPark u PNP_VetoTypeUnknown � SecurityDelegation $ COPYFILE2_PROGRESS_CONTINUE " @ PoCsDeviceNotificationMbn � DPFLTR_KBDCLASS_ID ] � MaxSystemInfoClass � LogExceptionDispatch � ! DPFLTR_FASTFAT_ID � WnfDataScopeSystem . � DISPLAYCONFIG_COLOR_ENCODING_YCBCR422 � FirmwareTypeMax " IoSessionStateLoggedOn F TokenLinkedToken � TypeB ) � SharedVirtualDiskHandleStateNone � SysDbgBreakPoint B WinLowLabelSid m FileFullDirectoryInfo � DPFLTR_SCSIPORT_ID � SysDbgReadControlSpace + v DirectoryNotifyExtendedInformation $ � TransactionBasicInformation � WdInfoResetTimer � LocationTypeFileSystem � SysDbgQueryVersion ' � ) JobObjectReserved19Information ( 5 FileStorageTierClassUnspecified 0 � EventTraceHeapSummaryTracingInformation � SysDbgReadMsr � SYSTEM_HANDLE_EVENT I MarshalDirectionMarshal % FileFullDirectoryInformation W MemoryFlushModifiedList � KeyTrustInformation * } RtlResTypeDiskWriteConstraintTier ) � ORIENTATION_PREFERENCE_LANDSCAPE � BackTraceDatabaseDelete � SysDbgWriteIoSpace � , ReservedForDVRF44 3 ` PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES � 7 ReservedForDVRF55 WinCreatorOwnerSid r MaxProcessTlsOperation � UmsThreadAffinity % � SecureSettingValueTypeBinary B F ProcessInPrivate ) $ � AccessReasonNotGrantedByCape � 8 DPFLTR_MCHGR_ID * + � COMIMAGE_FLAGS_32BITPREFERRED � Q DPFLTR_IHVSTREAMING_ID ) ] Z SystemBootEnvironmentInformation 1 � ORIENTATION_PREFERENCE_LANDSCAPE_FLIPPED /! STUB_UNMARSHAL # 2! VmCfgCallTargetInformation , ] ? SystemEmulationProcessorInformation � FpCodeModf / v CrossProcOperationMemoryFreePostNotify r! PowerStateSleeping2 5 � JOB_OBJECT_IO_RATE_CONTROL_STANDALONE_VOLUME LockQueueUnusedSpare1 � SYSTEM_HANDLE_SEMAPHORE + M PsEnergyComponentTypeTrackingState $ ] [ SystemHypervisorInformation # �
JobObjectJobSetInformation + l EtwCoverageSamplerBloomInformation ] � SystemFlushInformation % B AlpcServerSessionInformation �! FpRoundMinusInfinity * � ' JobObjectServerSiloUserSharedData / $ � AccessReasonNotGrantedByParentCape # F ExceptionContinueExecution ' � ( JobObjectReserved18Information
" EtwProviderTraitTypeMax !
" FEEDBACK_TOUCH_DOUBLETAP 2 B f ProcessDynamicEnforcedCetCompatibleRanges ?" HiberFileBucket1GB RpcFailedLbsMessages l PowerDeviceD2 % B ProcessForegroundInformation " ^" WdActionQueryTimeoutValue [ GEO_FRIENDLYNAME # e FeatureEnabledStateEnabled � LdrModulesCondensed & � EventTraceSpinlockInformation E WinSystemLabelSid ! B 2 ProcessWindowInformation q WinAccountKeyAdminsSid � L DPFLTR_INFINIBAND_ID � " SysDbgClearUmBreakPid % ] W SystemSpecialPoolInformation � o DPFLTR_WHEA_ID B 1 ProcessOwnerInformation � VrfHardwareRuleClass $ FileTrackingInformation � FpCompareGreater 1 ] � SystemCodeIntegrityPolicyFullInformation $ WinBuiltinAdministratorsSid % # DISPLAYCONFIG_SCALING_CUSTOM # # ProcessInformationClassMax ( SE_VALIDATE_MAPPING_HEADER_ONLY ? PsProtectedSignerApp # /#
DeviceInstanceRemovalEvent ' ] $ SystemContextSwitchInformation # $ � � AccessReasonTrustLabel " B - ProcessAffinityUpdateMode � TraceVersionInfo + M# QUERY_FILE_LAYOUT_NUM_FILTER_TYPES P# PsMaxStdHandleStates ' S# SeImageSignaturePackageCatalog ( � TraceSampledProfileIntervalInfo \# IMPORT_OBJECT_DATA ! � ProcessDynamicCodePolicy � | DPFLTR_USBSTOR_ID ( � FeatureConfigurationPriorityMax ! �# WorkerFactoryIdleTimeout �# ResponseOk �# DCDC_DISABLE_RELAYOUT + MAX_CLASS_NAME ) �# DISPLAYCONFIG_ROTATION_ROTATE180 m FileStorageInfo B Q ProcessWakeInformation ' ] ` SystemPrefetchPatchInformation ! AdministratorPowerPolicy ' $ HighMemoryResourceNotification & $ RtlRXactOperationSetAttribute � SYSTEM_HANDLE_PIPE ^" WdActionStopTimer ) � TransactionDTCPrivateInformation 1 _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_MIRACAST � WaitNotification # k$ InvalidAppContainerSidType SmrGcActionPause ) B ^ ProcessSecurityDomainInformation r! PowerStateSleeping1 * * FileIoStatusBlockRangeInformation �$ PsMaxWakeReasons % � JobObjectBasicUIRestrictions $ � JobObjectGroupInformationEx # 9 1 ThreadPowerThrottlingState �$ PdataRefToFullXdata � TracePmcEventListInfo % � EtwQueryPartitionInformation
ProcessorStateHandler2 # 9 ThreadDescriptorTableEntry $ 6 FileStandardLinkInformation + �! � �HeapDetailedFailureInformation * �
MonitorRequestReasonSessionUnlock RtlPathTypeRooted / WOW64_FUNCTION_CPU_TURBO_THUNK_CONTROL 9 / ThreadAttachContainer ' � * JobObjectReserved20Information � SymbolicLinkAccessMask �% MaxKeySetInfoClass $ ! FileReparsePointInformation ( � ORIENTATION_PREFERENCE_PORTRAIT ! ?" HiberFileBucketUnlimited B $ ProcessCookie � 4 ReservedForDVRF52 � EtwBufferStateMaximum � FpCodeTan & LdrpAnyDevice2bit ' � % JobObjectReserved15Information PsAttributeJobList
SidTypeWellKnownGroup # � SysDbgEnableKernelDebugger $ B ProcessDefaultHardErrorMode ( + COMIMAGE_FLAGS_STRONGNAMESIGNED $ � TraceProviderBinaryTracking � FpCodeCos � LogExceptionHandler " �
ProcessChildProcessPolicy ' FileIdType , +' LoadReasonStaticForwarderDependency � SysDbgSetSpecialCall + IMAGE_COR_MIH_METHODRVA * a' ActivationContextBasicInformation u PNP_VetoDevice � SysDbgQuerySpecialCalls - � CsvControlMarkHandleLocalVolumeMount p' PMETypeMax / � MemExtendedParameterUserPhysicalHandle . ] ) SystemVerifierRemoveDriverInformation . ` PS_MITIGATION_OPTION_ROP_CALLER_CHECK � PoHot �" VMEConfiguration � DPFLTR_VIDEOPRT_ID � � DPFLTR_XSAVE_ID � N DPFLTR_IHVVIDEO_ID �' UserNotPresent
SidTypeInvalid �
WMI_CAPTURE_STATE ! ( FileShortNameInformation 2 ` PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS # ] . SystemTimeSlipNotification / M# QUERY_FILE_LAYOUT_FILTER_TYPE_CLUSTERS B L ProcessEnergyValues ] o SystemAitSamplingValue " COPYFILE2_PROGRESS_CANCEL + � MonitorRequestReasonScMonitorpower � DPFLTR_NTFS_ID + ] D SystemSessionMappedViewInformation ! B X ProcessUptimeInformation � / ReservedForDVRF47 $ � SecureSettingValueTypeUlong ) ^ WinCapabilityRemovableStorageSid & �( PsProtectedTypeProtectedLight # k! VmOfferPriorityBelowNormal # $ � AccessReasonAllowedAce � r DPFLTR_TPM_ID r! PowerStateShutdownOff � BootEntropySourceRdrand ) � TransactionEnlistmentInformation r! PowerStateSleeping3 �( IoSessionEventLogoff + �( SystemMemoryPartitionCombineMemory [ GEO_NATION # ? PsProtectedSignerWinSystem ! M PsEnergyComponentTypeCpu " B ProcessSessionInformation � ! FpCodeTanh & � , JobObjectContainerTelemetryId ! - WinAccountControllersSid * � FeatureVariantPayloadKindExternal PowerActionNone � SYSTEM_HANDLE_PROCESS A) DeviceWakeSourceType ! M PsEnergyComponentTypeMax 9 p DISPLAYCONFIG_DEVICE_INFO_SET_TARGET_PERSISTENCE m FileCompressionInfo % � ACTCTX_RUN_LEVEL_UNSPECIFIED u PNP_VetoOutstandingOpen ( � EtwNotificationTypeCredentialUI WOW64_FUNCTION_MAXIMUM " PsAttributeIdealProcessor �' MandatoryLevelCount , _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DVI ( ] @ SystemExtendedHandleInformation *
FpFormatCompare ! � SystemPixelFormatUnknown - � MonitorRequestReasonScreenOffRequest � SYSTEM_HANDLE_JOB % � ImageStrictHandleCheckPolicy � SectionBasicInformation P PsCreateFailExeFormat - a' ActivationContextDetailedInformation �)
EtwWdiScenarioCode $ �) MaxServiceRegistryStateType ) �& COPYFILE2_CALLBACK_CHUNK_STARTED � 4 DPFLTR_FUSION_ID 1 � 0 MonitorRequestReasonDisplayRequiredUnDim # B R ProcessEnergyTrackingState � 1 ReservedForDVRF49 � KeyFullInformation 2 JournalRenameKey B D ProcessSubsystemProcess 0 5* JOBOBJECT_IO_ATTRIBUTION_CONTROL_ENABLE " <* PoSleepDisableReasonVideo � t DPFLTR_ENVIRON_ID 4 FileUnusedInformation # PsAttributeProtectionLevel
" FEEDBACK_PEN_DOUBLETAP � VrfVMSwitchingRuleClass & [ QueryPotentialDripsConstraint % m MaximumFileInfoByHandleClass ' �* CmResourceShareDriverExclusive /# DeviceInstallEvent + ] ( SystemVerifierAddDriverInformation ! � AuditOpenObjectForDelete � SYSTEM_HANDLE_REG_KEY �* ShutdownReboot m FileEndOfFileInfo �* GetFileExInfoStandard & ] + SystemLegacyDriverInformation " w WinBuiltinDeviceOwnersSid 0 v CrossProcOperationMemoryAllocPostNotify L LastResumePerformance 1 � EventTraceProfileSourceRemoveInformation � TableEmptyTree � { DPFLTR_APPCOMPAT_ID / �
FeatureConfigurationPriorityUserPolicy ! PsAttributeParentProcess 9 ThreadWow64Context � ! VrfWDFRuleClass 1+ OS_DEPLOYMENT_STANDARD ( TraceApplicationPowerMessageEnd / � ! JobObjectNotificationLimitInformation2 C WinMediumLabelSid # �# WorkerFactoryThreadMinimum 5 FileStorageTierClassMax P# PsNeverDuplicate # RtlPathTypeRootLocalDevice RpcFailedLbsDecisions + / FileProcessIdsUsingFileInformation B ProcessDebugFlags [+ IMO_UNAVAILABLE ! PowerActionShutdownReset �$ MemoryTypeLargePage " W MemoryCaptureAccessedBits # Q ManageHotPatchQueryPatches PowerActionHibernate >) EtwRtBufferLost � ( VrfAVXCorruption m FileRenameInfoEx 0 M PsEnergyComponentTypeCompositorResource � ObjectTypesInformation - ] J SystemWow64SharedInformationObsolete " ] 3 SystemVerifierInformation IoPriorityHigh �+ TokenElevationTypeFull " � JobObjectCompletionFilter B ProcessDeviceMap # UmsInformationCommandQuery \ IrqPriorityUndefined �+ PlatformRoleMaximum � FileFsVolumeInformation 9 # ThreadSuspendCount 4 # WinBuiltinPreWindows2000CompatibleAccessSid " : FileVolumeNameInformation , , CI_WINDOWS_LOCKDOWN_RESTRICTION_MAX
KHeteroCpuPolicyLarge � PnpQueryBusRelations ' MaximumFileIdType % m FileFullDirectoryRestartInfo + ? FileIdExtdBothDirectoryInformation " h SystemNetRateControlQuota 9 ThreadTebInformation " 9, ImagePolicyEntryTypeInt64 �+ PlatformRoleWorkstation # "$ MonitorRequestTypeToggleOn � SmallBusinessRestricted � WnfInfoStateNameExist / _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SVIDEO F , TokenBnoIsolation + f WinBuiltinRemoteManagementUsersSid � EtwBufferStateCSwitch
SidTypeDeletedAccount � VrfEnhancedIORuleClass ] SystemObjectInformation ) N WinBuiltinCertSvcDComAccessGroup /# DeviceClassChangeEvent �! HeapTaggingInformation � TraceLbrEventListInfo � Personal + ', POINTER_DEVICE_TYPE_INTEGRATED_PEN % � TP_CALLBACK_PRIORITY_INVALID � ProfileTime ! � MaxImageMitigationPolicy & LdrpRemote A ` PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY . B c ProcessFreeFiberShadowStackAllocation $ P PsCreateFailOnSectionCreate "
" FEEDBACK_PEN_PRESSANDHOLD 3 _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDTVDONGLE h SystemNetRateControlSet >) EtwRtEventNoLoss % � KeyVirtualizationInformation # H$ KeyValuePartialInformation / ` PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR A WinUntrustedLabelSid ] s SystemErrorPortTimeouts � 2 ReservedForDVRF50 8 ` PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE . ] � SystemFeatureConfigurationInformation & M SharedVirtualDisksUnsupported F TokenIntegrityLevel 2 ] � SystemSecureSpeculationControlInformation ( $ WinBuiltinRemoteDesktopUsersSid +' ��LoadReasonUnknown 3 DEPPolicyOptIn * PsAttributeMitigationAuditOptions � ? DPFLTR_PREFETCHER_ID � PNPISABus �' UserPresent �( IoSessionEventConnected " ] V SystemRefTraceInformation + �+ FileMetadataOptimizationInProgress ThreadPowerThrottling 5 # DISPLAYCONFIG_SCALING_ASPECTRATIOCENTEREDMAX ! �' RtlBsdItemBootCheckpoint � EventSecuritySetDACL , PlugPlayControlGetBlockedDriverList SmrGcStateInactive �' MandatoryLevelUntrusted " WinBuiltinReplicatorSid � ImagePolicyIdNone � � DPFLTR_CRASHDUMPXHCI_ID - �# ��DISPLAYCONFIG_ROTATION_FORCE_UINT32 � � DPFLTR_PSHED_ID F TokenAppContainerSid * � EventTraceStackCachingInformation & ProcessWorkingSetOperationMax 1 � EventTraceLastBranchEventListInformation Y IrqPolicyMachineDefault
AuditEventObjectAccess
"
FEEDBACK_TOUCH_RIGHTTAP ( � DISPLAYCONFIG_TOPOLOGY_INTERNAL � � DPFLTR_FILETRACE_ID # FileMailslotSetInformation ] / SystemSessionCreate ) % CmExtendedParameterTrustClassKey $ ]
SystemStackTraceInformation ! 9 ThreadEventPair_Reusable " �+ TokenElevationTypeLimited 6' SC_STATUS_PROCESS_INFO % � VrfSyncDelayFuzzingRuleClass 1 ] � SystemFirmwareBootPerformanceInformation � FpCodeFrexp ' �. CI_WINDOWS_LOCKDOWN_MODE_TRIAL � MaxEventTraceInfoClass $ * COPYFILE2_PHASE_READ_SOURCE # & WinAccountAdministratorSid ' SystemMonitorHiberBootPowerOff WinInteractiveSid # ] i SystemProcessorBrandString & !/ IMPORT_OBJECT_NAME_UNDECORATE LockQueueUnusedSpare0 � EventSecuritySetSACL - GetPowerRequestList � DPFLTR_NTOSPNP_ID 1 � FeatureConfigurationPriorityImageDefault ! F ! TokenUserClaimAttributes � FpCodeAtan f/ DPI_AWARENESS_UNAWARE % ] SystemPerformanceInformation �" CbusConfiguration " - MemoryReserveIoCompletion �# WorkerFactoryTimeout l PowerDeviceD3 8 ` PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32 � c DPFLTR_VDSUTIL_ID + �/ PerfInfoMMStatAggregatePageCombine WinLocalSystemSid - ] : SystemRecommendedSharedDataAlignment & ] y SystemNodeDistanceInformation � ImagePolicyIdEtw * Q ManageHotPatchQueryPatchesForUser $ 40 DynamicTickDisableReasonMax # � JobObjectFreezeInformation , # ��DISPLAYCONFIG_SCALING_FORCE_UINT32 ' � . JobObjectReserved24Information ! WinCreatorOwnerServerSid � . MonitorRequestReasonDim ' �# WorkerFactoryThreadSoftMaximum +' LoadReasonAsDataLoad ) � EventTraceTimeProfileInformation ! �0 PoDisabledStateSleeping2 ' � LearningModeLogLevelSpecialApc ! 9, ImagePolicyEntryTypeNone /# VetoEvent ! 9, ImagePolicyEntryTypeBool * FpFormatU32 � ObjectBasicInformation 0 PMCCounter B ProcessBasicInformation �
VrfIRPTrackingRuleClass � SERVERSILO_TERMINATING " + COR_VTABLEGAP_NAME_LENGTH & @ ComputerNamePhysicalDnsDomain �" MPIConfiguration $ � CsvControlGetCsvFsMdsPathV2 ( @ ComputerNamePhysicalDnsHostname �! HeapOptimizeResources 2 � FeatureConfigurationPriorityImageOverride $ PlugPlayControlUnlockDevice � � DPFLTR_UDFS_ID 3 Y IrqPolicyAllProcessorsInMachineWhenSteered 0 ] � SystemEntropyInterruptTimingInformation � R DPFLTR_IHVBUS_ID SmrGcActionStart ) $ � AccessReasonAllowedParentAce B ProcessQuotaLimits
SidTypeUnknown �1 PerfInfoMemUsageMax � VrfDMARuleClass ProcessorPowerPolicyAc , \ SE_WS_APPX_SIGNATURE_ORIGIN_WINDOWS . WinAccountCertAdminsSid ( 8* DISPLAYCONFIG_PIXELFORMAT_32BPP ( 8* DISPLAYCONFIG_PIXELFORMAT_24BPP # �1 FindStreamInfoMaxInfoLevel ] SystemObsolete0 9 ThreadCSwitchPmu ' B ( ProcessInstrumentationCallback 9 ThreadCSwitchMon ( ] SystemTimeAdjustmentInformation �$ Width8Bits W MemoryEmptyWorkingSets WinBuiltinUsersSid � m DPFLTR_IOSTRESS_ID PsAttributeClientId ) ; WinBuiltinAuthorizationAccessSid # ] G SystemWatchdogTimerHandler � VrfAutoFailRuleClass ' � VrfAllocationFailuresRuleClass � DynamicTickVetoNone e$ RtlDiskSpeedPolicyFast ) �& COPYFILE2_CALLBACK_POLL_CONTINUE # ProcessReservedValue1 ) + COMIMAGE_FLAGS_NATIVE_ENTRYPOINT 3 PROTOCOL_LOADED ) � EventTraceSoftRestartInformation ! � ProcessFontDisablePolicy ' m FileIdBothDirectoryRestartInfo � UmsThreadPriority � SysDbgSetAutoKdEnable $ ] � SystemControlFlowTransition ! P' USER_MARSHAL_CB_MARSHALL $ �% KeySetHandleTagsInformation $ � ObjectHandleFlagInformation � MicroChannel & � SecureSettingValueTypeBoolean ! F ExceptionNestedException . _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_D_JPN 9 ThreadTimes � ' DPFLTR_SERIAL_ID P PsCreateSuccess ( ] > SystemEmulationBasicInformation FileBasicInformation � ] DPFLTR_VERIFIER_ID � = ReservedForDVRF61 � PCIBus * =+ SystemProcessClassificationSystem �# ResponseRetry S PowerSystemSleeping3 ! B ProcessDebugObjectHandle � n DPFLTR_HEAP_ID + 40 DynamicTickDisableReasonEmOverride ) � DISPLAYCONFIG_COLOR_ENCODING_RGB ( PlugPlayControlInitializeDevice ! � TP_LOG_LEVEL_TRACE_LEAVE � LocationTypeRegistry $ �* CmResourceShareUndetermined �# ResponseCancel ( �( SystemMemoryPartitionMoveMemory � DynamicTickVetoProcBusy � f DPFLTR_MM_ID 0 � AuditOpenObjectForDeleteWithTransaction ' $ � 0 AccessReasonIntegrityLevel S PowerSystemWorking # ] SystemTimeOfDayInformation
� CBus # 9 - ThreadSubsystemInformation � ProfileIcacheMisses �+ PlatformRoleMobile ( � ProcessPayloadRestrictionPolicy ' � ProcessStrictHandleCheckPolicy 4 � JobObjectAssociateCompletionPortInformation $ @ PerfInfoDebugEventContinued � _ DPFLTR_VDSBAS_ID $ <* PoSleepDisableReasonVhdBoot P' USER_MARSHAL_CB_FREE F TokenHasRestrictions - _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HDMI % �4
MemoryBasicInformationCapped P PlatformIdleStates � : ReservedForDVRF58 F
TokenStatistics �
ImagePolicyIdCapability [+ IMO_INJECTED % �* RtlFeatureConfigurationCount � DPFLTR_LSERMOUS_ID � WMI_ENABLE_COLLECTION B ` ProcessEnableLogging 3 �2 DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED ThreadDynamicCodePolicy 2 v CrossProcOperationMemoryProtectPostNotify b5 DriverType $ �$ PsWakeReasonInstrumentation & 0 WinAccountEnterpriseAdminsSid � GEOCLASS_ALL �
MPIBus ! � PnpQueryRemovalRelations - � VRF_TRIAGE_CONTEXT_FLIGHT_MONITORING � ImagePolicyIdCrashDump �5 SevereError I ScreenOff & � StorageReserveIdUpdateScratch . � EventTraceProfileSourceAddInformation ! " IoSessionStateTerminated FileNamesInformation " ] SystemPageFileInformation � FpCompareEqual B ProcessBasePriority u PNP_VetoPendingClose P PsCreateFailExeName � � DPFLTR_POWER_ID � , DPFLTR_DCOMSS_ID + F # TokenRestrictedUserClaimAttributes � ImageHeapPolicy & � MonitorRequestReasonResumePdc � $ DPFLTR_NETAPI_ID * W MemoryCaptureAndResetAccessedBits & : WinBuiltinPerfLoggingUsersSid B PlatformInformation $ ] P SystemMemoryListInformation # � EtwNotificationTypeSession %6 PT_TOUCH B ProcessHandleCount . � EventTraceObjectTypeFilterInformation � TurboChannel ) � / MonitorRequestReasonBuiltinPanel �# MemoryNotResident � ���RelationAll + IMAGE_COR_MIH_EHRVA ^" WdActionQueryState ' � JobObjectReserved12Information � ? ReservedForDVRF63 # " FileNetworkOpenInformation / � MonitorRequestReasonSystemStateEntered 0 � EtwSessionNotificationSessionTerminated ! COPYFILE2_PROGRESS_PAUSE ) � WorkerFactoryCallbackLongRunning
SidTypeUser ) �( SystemMemoryPartitionInformation " �+ TokenElevationTypeDefault � SystemPixelFormatR8G8B8 7 _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_WIRED [ GEO_ISO_UN_NUMBER ( ] N SystemVerifierTriageInformation � MaxTraceSetInfoClass ' �6 MemSectionExtendedParameterMax u NtProductLanManNt ) ProcThreadAttributeParentProcess �' RtlBsdItemAabTimeout ! B * ProcessWorkingSetWatchEx ( # � DISPLAYCONFIG_SCALING_PREFERRED SystemExecutionState m FileStandardInfo � ProcessActivityTypeMax m FileIdInfo � DPFLTR_MOUCLASS_ID � DPFLTR_CLASSPNP_ID B ProcessImageFileName � 3 DPFLTR_SXS_ID � @ VrfRuleClassSizeMax = WinBuiltinDCOMUsersSid , � FilterBootOptionOperationSetElement F ) TokenProcessTrustLevel $ WinBuiltinPrintOperatorsSid �# ResponseReturnToCaller ! � SERVERSILO_SHUTTING_DOWN � IMDT_TOUCH " �# WorkerFactoryBindingCount # ] - SystemLookasideInformation 1+ OS_DEPLOYMENT_COMPACT ' H$ KeyValueFullInformationAlign64 ' ] t SystemLowPriorityIoInformation � z DPFLTR_LUAFV_ID /# CustomDeviceEvent 0 ProcThreadAttributeSecurityCapabilities � � DPFLTR_SSPICLI_ID # 9, ImagePolicyEntryTypeUInt16 ' � ProcessSystemCallDisablePolicy " B AlpcWaitForPortReferences [ GEO_RFC1766 J IoPriorityHintNormal 0 ] � SystemEnergyEstimationConfigInformation " $ � ` AccessReasonEmptyDacl �6 XLAT_CLIENT / � DISPLAYCONFIG_COLOR_ENCODING_INTENSITY - B ResourceManagerCompletionInformation & & POINTER_CHANGE_FIRSTBUTTON_UP /# InvalidIDEvent ( � ) JobObjectServerSiloRunningState ) & POINTER_CHANGE_SECONDBUTTON_DOWN + M
PsEnergyComponentTypeKeyboardInput " B 6 ProcessHandleCheckingMode ) � EventTracePerformanceInformation � D DPFLTR_DMCONFIG_ID - \ SE_WS_APPX_SIGNATURE_ORIGIN_APPSTORE � JobObjectSharedCommit WinSelfSid Q ManageHotPatchLoadPatch 2 h FeatureConfigurationOperationFeatureState �! SystemCrashDumpDisable �#
ResponseContinue 9 KTMOBJECT_TRANSACTION � d DPFLTR_DFRGIFC_ID * l EtwCoverageSamplerPerfInformation ! COPYFILE2_PROGRESS_QUIET . ] � SystemSecureBootPolicyFullInformation � SysDbgReadVirtual 99 DDC_DISABLE_RESIZE �
ProcessImageLoadPolicy ; p
DISPLAYCONFIG_DEVICE_INFO_SET_ADVANCED_COLOR_STATE & � JobObjectReserved3Information = RPCHTTP_RS_INTERFACE � � DPFLTR_SE_ID � B DPFLTR_PCI_ID �
ProfileFpInstructions 9 � EventTraceProcessorTraceConfigurationInformation �) EtwStartLoggerCode � LogExceptionEmpty ' * COPYFILE2_PHASE_NAMEGRAFT_COPY ) $ � AccessReasonMissingPrivilege �# DCDC_DEFAULT ! W PowerInformationInternal , 40 DynamicTickDisableReasonNoHwSupport " �* ShutdownRebootForRecovery � FpCodeConvert 4 �9 MemoryExhaustionTypeFailFastOnCommitFailure + � EtwSessionNotificationLogfileError & � ( JobObjectServerSiloInitialize B$ TokenPrimary % 9 $ ThreadHeterogeneousCpuPolicy 6 _$ ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_FORCE_UINT32 9 ! ThreadIdealProcessorEx
RpcAttemptedLbsMessages < B AlpcAdjustCompletionListConcurrencyCountInformation r ProcessTlsReplaceIndex / _$ ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_OTHER ( �4 MemoryMappedFilenameInformation ( � TraceSystemTraceEnableFlagsInfo & 0 FileNormalizedNameInformation * ] � SystemHypervisorDetailInformation 2 WakeTimerList ! B U ProcessTelemetryCoverage * =+ SystemProcessClassificationNormal B ProcessWow64Information 3 PROTOCOL_NOT_LOADED $ ] � SystemSecureBootInformation 6 OptionCancelTryContinue 8 ProcThreadAttributeAllApplicationPackagesPolicy ; ': ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MAXVERSIONTESTED � h DPFLTR_WOW64_ID � WHServer " � EtwBufferStatePlaceholder [ GEO_LATITUDE * H$ KeyValuePartialInformationAlign64 ' � VrfDeadlockPreventionRuleClass ? PsProtectedSignerMax . S: RtlMitigationOptionStateNotConfigured % � EtwBufferStateGeneralLogging 6 p DISPLAYCONFIG_DEVICE_INFO_GET_SDR_WHITE_LEVEL � ; ReservedForDVRF59 �& COPYFILE2_CALLBACK_NONE ( ] � SystemDmaGuardPolicyInformation ) 8* DISPLAYCONFIG_PIXELFORMAT_NONGDI �$ MaximumDmaWidth " ] � SystemBootLogoInformation ! SystemPowerPolicyCurrent 9 ThreadPagePriority � IMDT_MOUSE B 4 ProcessMitigationPolicy ProcessorStateHandler ' � VrfBelow4GBAllocationRuleClass ( $ � AccessReasonDeniedParentAce " 9, ImagePolicyEntryTypeInt16 2 JournalBeginTransaction & �. SystemFirmwareTable_Enumerate � v DPFLTR_WDT_ID � * ReservedForDVRF42 # � JobObjectCompletionCounter � LdrModulesSnapped �: SeLearningModeMax �: PowerUserNotPresent . � JobObjectNotificationLimitInformation # RpcBackEndConnectionFailed " ]
SystemCallTimeInformation � SmallBusiness # " IoSessionStateDisconnected � ImagePolicyIdScenarioId * � MonitorRequestReasonNearProximity 0 ^7 SystemActivityModerationAppTypePackaged 3 DEPPolicyAlwaysOff � LdrModulesSnapping 2 < WinBuiltinTerminalServerLicenseServersSid � MaximumInterfaceType % ? PsProtectedSignerAntimalware � � SYSTEM_HANDLE_INVALID # PlugPlayControlResetDevice / ^7 SystemActivityModerationAppTypeClassic * � TracePeriodicCaptureStateListInfo + =+ SystemProcessClassificationMaximum " + WinAccountDomainGuestsSid - _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HD15 5 ': ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION � Y DPFLTR_STORPORT_ID Q ManageHotPatchMax ! � & VrfInfoDisclosureIRPRule � * DPFLTR_RPCPROXY_ID 5 _$
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EMBEDDED % - PoHiberForceDisableReasonMax � TraceGroupQueryList � WMI_SET_SINGLE_ITEM �; MaxJournalInformation �* ShutdownPowerOff 1 � EDIT_CONTROL_FEATURE_PASTE_NOTIFICATIONS PowerActionReserved # � % JobObjectSiloRootDirectory � ProfileDcacheAccesses ' � ' JobObjectReserved17Information
KHeteroCpuPolicyDefault k! VmOfferPriorityVeryLow �/ PerfInfoMMStatNotUsed ) B C ProcessAllowedCpuSetsInformation l PowerDeviceUnspecified LockQueueMaximumLock l PowerDeviceD0 * FpFormatU64 " FilePipeRemoteInformation ' 8* DISPLAYCONFIG_PIXELFORMAT_8BPP � CacheUnified r! PowerStateShutdownReset . <* PoSleepDisableReasonPortableWorkspace LockQueueVacbLock F SetShutdownSelectedTime + ] � SystemProcessorIdleMaskInformation 9 ThreadHideFromDebugger " �$ PdataPackedUnwindFragment � ImageChildProcessPolicy ( ] # SystemKernelDebuggerInformation � WdInfoState PsAttributeToken 5 �6 MemSectionExtendedParameterUserPhysicalFlags & �$ PsWakeReasonActivityReference ToleranceIntervalLong % l WinCapabilityAppointmentsSid 9 ThreadGroupInformation & 8 RtlPhysicalMemoryPolicyNormal FileStreamInformation V BatteryDeviceState � SYSTEM_HANDLE_TOKEN - 9 0 ThreadManageWritesToExecutableMemory \# IMPORT_OBJECT_CODE ! � TP_LOG_LEVEL_TRACE_ENTER 1 � SharedVirtualDiskHandleStateHandleShared r ProcessTlsReplaceVector �: PowerUserInvalid � ProfileTotalCycles ( � MonitorRequestReasonSleepButton � LdrModulesPlaceHolder � Profile3Issue � � DPFLTR_ENDOFTABLE_ID R PlatformIdleVeto $ a FileStorageTierMediaTypeScm � q DPFLTR_MMCSS_ID " ] < SystemNumaAvailableMemory ! Z PhysicalPowerButtonPress � K DPFLTR_SR_ID 1 B _ ProcessCombineSecurityDomainsInformation % � � DPFLTR_STORAGECLASSMEMORY_ID 8 ` PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS * + � COMIMAGE_FLAGS_TRACKDEBUGDATA 6 � + MonitorRequestReasonPdcSignalHolographicShell S# SeImageSignatureNone � UmsThreadUserContext F TokenIsAppContainer $ �4 MemoryWorkingSetInformation $ S# SeImageSignatureCatalogHint & � MonitorRequestReasonUserInput � SERVERSILO_STARTED + � JobObjectCpuRateControlInformation & �4 MemoryWorkingSetExInformation |7 PdataCrUnchained W MemoryPurgeStandbyList � RelationNumaNode 1 � JobObjectBasicAndIoAccountingInformation � u DPFLTR_EMS_ID + �
EventTracePoolTagFilterInformation % �0 PoDisabledStateSleeping0Idle 9 ThreadPriority ! � EtwNotificationTypeAudio � * JobObjectIoAttribution & � EnlistmentRecoveryInformation � MaxObjectInfoClass ! � CsvControlDisableCaching J CsDeviceNotification 1 ] � SystemCodeIntegrityUnlockModeInformation PsAttributeUmsThread # ] � SystemPoolLimitInformation ' � JobObjectReserved11Information 1 $ � AccessReasonNotGrantedToAppContainer � PCMCIABus ! * WinAccountDomainUsersSid � FpCodeDivide ( 9 ThreadQuerySetWin32StartAddress . a' ActivationContextManifestResourceName " FileAllocationInformation ( 9 ThreadEnableAlignmentFaultFixup B ProcessWx86Information WinNetworkServiceSid ) ] b SystemSystemPartitionInformation 9 � 1 MonitorRequestReasonBatteryCountChangeSuppressed ' �* RtlFeatureConfigurationRuntime ' � RTL_RESOURCE_POLICY_FLAGS_NONE ' & POINTER_CHANGE_FOURTHBUTTON_UP � FirmwareTypeUefi " � BootEntropySourceAcpiOem0 3 DEPPolicyAlwaysOn � SYSTEM_HANDLE_MAX ( �+ FileMetadataOptimizationPending � EmbeddedRestricted % �" ��ConfigurationSpaceUndefined PowerActionShutdown & S# SeImageSignatureCatalogCached ( � EtwNotificationTypeLegacyEnable �) NormalizationC ! b5 Win32ServiceShareProcess � FpCodeFabs D MonitorInvocation �
FpCodeAcos % RpcBackEndConnectionAttempts $ ProcessorPowerPolicyCurrent & � JobObjectReserved4Information LockQueueUnusedSpare2 ) � ImageExtensionPointDisablePolicy ! H$ KeyValueBasicInformation ) ] , SystemCurrentTimeZoneInformation � EmbeddedNT D* SynchronizationEvent & )? ��DPI_HOSTING_BEHAVIOR_INVALID � ImageDynamicCodePolicy + j WinLocalAccountAndAdministratorSid �, FindExInfoStandard 3 p DISPLAYCONFIG_DEVICE_INFO_GET_ADAPTER_NAME o PerfInfoMemResetMax ' G6 FixedWakeSourceDozeToHibernate ? SessionPowerCleanup � LT_LOWEST_LATENCY 6 OptionShutdownSystem $ � JobObjectBasicProcessIdList " " IoSessionStateInitialized
KHeteroCpuPolicyMax FilePipeInformation � + DPFLTR_AUTOCHK_ID � DPFLTR_MOUHID_ID % Y IrqPolicySpecifiedProcessors � DPFLTR_SMSS_ID 1 ] � SystemDifApplyPluginVerificationOnDriver ) � JobObjectEndOfJobTimeInformation % � MonitorRequestReasonFullWake � Profile4Issue F * TokenPrivateNameSpace = RPCHTTP_RS_ACCESS_1 , �? DISPLAYCONFIG_MODE_INFO_TYPE_TARGET � # FpCodeY1 ! B 8 ProcessRevokeFileHandles % B ProcessLUIDDeviceMapsEnabled ! e$
RtlDiskSpeedPolicyNormal �: PowerUserMaximum - � EventTraceCoverageSamplerInformation �? KernelRequester
� PoDc SystemPowerPolicyDc � ImagePolicyIdMaximum + ] e SystemNumaProximityNodeInformation �' RtlBsdItemBootGood �' DisableLoad !
PsAttributeStdHandleInfo @ AR_NOSENSOR & @ PoCsDeviceNotificationMaximum MaxEventInfo 4 ` PS_MITIGATION_OPTION_CET_USER_SHADOW_STACKS � AuditObjectReference � TypeF �'
RtlBsdItemErrorInfo ! m WinCapabilityContactsSid � WdInfoTriggerReset ( �. CI_WINDOWS_LOCKDOWN_MODE_LOCKED B AlpcBasicInformation # � TraceProfileSourceListInfo � ProcessDEPPolicy � ProfileIcacheIssues 1 � , MonitorRequestReasonPdcSignalFingerprint m
FileRemoteProtocolInfo 9 ` PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY " ', POINTER_DEVICE_TYPE_TOUCH + � ! MonitorRequestReasonUserInputTouch 0 � 2 MonitorRequestReasonResumeModernStandby 5 �
CsvControlEnableUSNRangeModificationTracking LockQueueBcbLock WinRestrictedCodeSid % @ WinBuiltinCryptoOperatorsSid � PerfCSwapIdle ) �# DISPLAYCONFIG_ROTATION_ROTATE270 $ � CsvControlStartRedirectFile ! H$ KeyValueLayerInformation 3 ] ^ SystemImageFileExecutionOptionsInformation 4 � MonitorRequestReasonSetThreadExecutionState 4 ProcessorIdleStatesHv , WinAccountComputersSid $
KHeteroCpuPolicyBiasedSmall � ) VrfAccessModeMismatch � ImageDepPolicy $ �1 PerfInfoMemUsagePfnMetadata %6 PT_POINTER � UmsThreadIsTerminated 0 WOW64_FUNCTION_CPU_CFG_DISPATCH_CONTROL �' AutoLoad F TokenAppContainerNumber # ProcessLeapSecondInfo ) � FeatureConfigurationPriorityTest ) B ProcessEnableAlignmentFaultFixup �' RtlBsdItemMax + � MemExtendedParameterAttributeFlags ( - PoHiberForceDisableReasonPolicy � . ReservedForDVRF46
� PoAc �
ProfileCacheMisses " I MarshalDirectionUnmarshal �! FpRoundChopped � DPFLTR_CDROM_ID �% KeySetDebugInformation " ) WinAccountDomainAdminsSid [ GEO_LONGITUDE / �6 MemSectionExtendedParameterInvalidType F ExceptionCollidedUnwind � TraceInfoReserved15 � # VrfXDVPlatformMode % ` PowerInformationLevelMaximum WinTerminalServerSid MaxPlugPlayControl
" FEEDBACK_PEN_TAP %6 PT_PEN . ; PerfInfoDomainChangeEventEnterSyscall . PlugPlayControlDeviceClassAssociation / 8 FileRenameInformationBypassAccessCheck , ] & SystemExtendServiceTableInformation & ] ~ SystemBootGraphicsInformation � ProfileAlignmentFixup �( AtomTableInformation & B @ ProcessTelemetryIdInformation �
InternalPowerBus PsAttributeTebAddress ^" WdActionSleep m FileRenameInfo � DPFLTR_CRASHDUMP_ID �" PCMCIAConfiguration �= MemoryLocationResident $
KHeteroCpuPolicyBiasedLarge 2 ] � SystemFeatureUsageSubscriptionInformation & �4 MemoryEnclaveImageInformation ^" WdActionResetTimer � LdrModulesMapped ] SystemLocksInformation � SecurityImpersonation �1 ShrinkPrepare . ] T SystemVerifierCancellationInformation � DPFLTR_KBDHID_ID /# DeviceArrivalEvent $ ] 8 SystemPrefetcherInformation / ] d SystemProcessorPerformanceDistribution l PowerDeviceD1 PowerActionShutdownOff & +' LoadReasonDelayloadDependency �" PCIConfiguration � Profile2Issue � G DPFLTR_VSS_ID " ] _ SystemCoverageInformation ^ UpdateBlackBoxRecorder 1 5* JOBOBJECT_IO_ATTRIBUTION_CONTROL_DISABLE � TP_LOG_LEVEL_ERROR - , CI_WINDOWS_LOCKDOWN_RESTRICTION_NONE � DPFLTR_DMSYNTH_ID A) TimerWakeSourceType S PowerSystemShutdown �
Blade � DPFLTR_SERMOUSE_ID ) � SYSTEM_HANDLE_COMPOSITION_OBJECT � VrfIORuleClass * R WinThisOrganizationCertificateSid � " DPFLTR_SAMSS_ID �$ WidthNoWrap ! � TP_CALLBACK_PRIORITY_LOW + MAX_PACKAGE_NAME # M PsEnergyComponentTypeInput ! 9 , ThreadWorkOnBehalfTicket , l EtwCoverageSamplerStatusInformation 6 �2 ��DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 � ObjectNameInformation ! % CmExtendedParameterEvent 1 � TransactionSuperiorEnlistmentInformation 3 PROTOCOL_ADDRESS_CHANGE �' SystemLoad 3 � # MonitorRequestReasonUserInputAccelerometer & $ RtlDiskSpacePolicyBelowNormal ] SystemDeviceInformation u NtProductServer u PNP_VetoWindowsService �+ PlatformRoleDesktop $ r! PowerStateSleeping4Firmware . WnfWellKnownStateName < p DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_PREFERRED_MODE �+ PlatformRoleSlate � 6 ReservedForDVRF54 O$ GenericLessThan � y DPFLTR_NVCTRACE_ID ! TransactionStateIndoubt " ] � SystemKernelDebuggerFlags
FileRenameInformation � SERVERSILO_INITING � StorageReserveIdSoft " � VrfDriverLoggingRuleClass ' WinAccountGuestSid ! �# MemoryContiguityStateMax ) r WinAccountEnterpriseKeyAdminsSid � LdrModulesReadyToInit # � DynamicTickVetoNoDeepSleep # 9 KTMOBJECT_RESOURCE_MANAGER RpcOutgoingBandwidth � C DPFLTR_DMIO_ID + == POINTER_DEVICE_CURSOR_TYPE_UNKNOWN ( ProcThreadAttributeWin32kFilter ) �B MaxSystemActivityModerationState & 9 + ThreadExplicitCaseSensitivity * ProcThreadAttributeIdealProcessor ! PsAttributeSecureProcess � FpCodeCompare F TokenOrigin + COR_VERSION_MINOR � EtwBufferStateFree �# WorkerFactoryPaused � MonitorRequestReasonPnP + " IoSessionStateDisconnectedLoggedOn � SmrGcMethodRotation $ M RtlSparseBitmapOperationSet 6 ] � SystemPortableWorkspaceEfiLauncherInformation $ F & TokenRestrictedDeviceGroups , �' RtlBsdItemFeatureConfigurationState � VrfSecurityRuleClass ( � JobObjectMemoryUsageInformation �C PortDumpInformation �2 FindExSearchMaxSearchOp � SmrGcMethodCompaction ! � F DPFLTR_WSOCKTRANSPORT_ID ! � EtwBufferStateCompressed ) ProcThreadAttributePreferredNode � ImagePolicyIdParentSd � POINTER_FEEDBACK_NONE � SysDbgGetKdBlockEnable |7 PdataCrChainedWithPac � DataCenter �C PROXY_UNMARSHAL �% KeySetLayerInformation � P DPFLTR_IHVNETWORK_ID . � DISPLAYCONFIG_COLOR_ENCODING_YCBCR420 5 v CrossProcOperationInstructionCacheFlushHeavy � � DPFLTR_FLTREGRESS_ID # v DirectoryNotifyInformation ! RpcAttemptedLbsDecisions � PerfCSwapIdleShort D FileStatInformation � NotificationTimer B \ ProcessSequenceNumber � DPFLTR_SETUP_ID % PowerInformationLevelUnused0 �' RtlBsdItemVersionNumber ] SystemHandleInformation RpcLastCounter # � EnlistmentBasicInformation + ] � SystemFirmwarePartitionInformation b5 RecognizerType ( ] j SystemVirtualAddressInformation * d WinAccountCloneableControllersSid & � TracePeriodicCaptureStateInfo � VrfSpecialPoolRuleClass P# PsRequestDuplicate ( PlugPlayControlDeregisterDevice u PNP_VetoWindowsApp ( ] 5 SystemSessionProcessInformation \# IMPORT_OBJECT_CONST * FpFormatFp80 9 _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_VIRTUAL ' ' FileValidDataLengthInformation 0 ] S SystemProcessorIdleCycleTimeInformation } RtlResTypeDiskSpeedTier SystemBatteryState $ � FileFsFullSizeInformationEx " �D AlpcMessageSidInformation � CsvControlQueryMdsPath # ] Y SystemErrorPortInformation �! HeapExtendedInformation O$ GenericEqual % @ FileDispositionInformationEx & LdrpNoDevice $ B M ProcessPowerThrottlingState 6 ] K SystemRegisterFirmwareTableInformationHandler B / ProcessGroupInformation " ThreadAbsoluteCpuPriority $ ] SystemFullMemoryInformation � AuditAccessCheck �) NormalizationD ( f/ DPI_AWARENESS_PER_MONITOR_AWARE FileObjectIdInformation , 40 DynamicTickDisableReasonBcdOverride ! ^" WdActionSetTriggerAction 3 �? ��DISPLAYCONFIG_MODE_INFO_TYPE_FORCE_UINT32 SystemPowerPolicyAc B ProcessIoCounters � RelationCache � VrfStateSepRuleClass * ` PS_MITIGATION_OPTION_FONT_DISABLE . B S ProcessManageWritesToExecutableMemory " �" CsvFsDiskConnectivityNone + M# QUERY_FILE_LAYOUT_FILTER_TYPE_NONE � FpCodeFmod 5 � EventTraceProcessorTraceEventListInformation ) � VRF_TRIAGE_CONTEXT_CERTIFICATION � TraceGuidQueryProcess ! S# SeImageSignatureEmbedded ( & POINTER_CHANGE_FIFTHBUTTON_DOWN 1 PlugPlayControlGetDeviceInterfaceEnabled � VERIFIER_MODE_TRIAGE 0 B AlpcUnregisterCompletionListInformation �= MemoryLocationInvalid & + FileIoPriorityHintInformation 0 ] � SystemWorkloadAllowedCpuSetsInformation $ &E PowerRequestDisplayRequired ( & POINTER_CHANGE_THIRDBUTTON_DOWN & � ImagePolicyIdCrashDumpKeyGuid & �#
WorkerFactoryStackInformation @ AR_REMOTESESSION # )? DPI_HOSTING_BEHAVIOR_MIXED ) ] SystemUnloadGdiDriverInformation . � DISPLAYCONFIG_COLOR_ENCODING_YCBCR444 �' DemandLoad % FileBothDirectoryInformation " � POINTER_FEEDBACK_INDIRECT 9 M# QUERY_FILE_LAYOUT_FILTER_TYPE_STORAGE_RESERVE_ID ' ] L SystemFirmwareTableInformation � E DPFLTR_DMADMIN_ID * �& COPYFILE2_CALLBACK_CHUNK_FINISHED � EtwBufferStateFlush & 2 WinAccountRasAndIasServersSid F TokenDefaultDacl m FileIoPriorityHintInfo & 7 FileRemoteProtocolInformation / o WinBuiltinDefaultSystemManagedGroupSid �2 FindExSearchNameMatch 0 ] � SystemProcessorPerformanceInformationEx + �/ PerfInfoMMStatIterationPageCombine * � JobObjectIoRateControlInformation � VERIFIER_MODE_UNUSED # ProcessInPrivateInfo � < ReservedForDVRF60 �) EtwUpdateLoggerCode & a' MaxActivationContextInfoClass ( 5 FileStorageTierClassPerformance ? WinIUserSid PowerActionDisplayOff / M SharedVirtualDiskCDPSnapshotsSupported % B ; ProcessCheckStackExtentsMode - � EventTraceSessionSecurityInformation _D TP_DEBUG_CLASS_POOL B$ TokenImpersonation ' ExtendedFileIdType � FileFsDeviceInformation . ] � SystemSecureDumpEncryptionInformation m FileAttributeTagInfo $ ] � SystemPageFileInformationEx Q ProcessorIdleVeto F ( TokenIsRestricted RpcCurrentUniqueUser < KCONTINUE_LONGJUMP � ProfilePipelineDry # � EtwNotificationTypeNoReply � WdInfoStartTimer B > ProcessMemoryExhaustion " + COMIMAGE_FLAGS_IL_LIBRARY �' MandatoryLevelMedium � AuditHandleCreation / � FilterBootOptionOperationDeleteElement " � JobObjectGroupInformation ' ] � SystemMemoryChannelInformation PsAttributeErrorMode / SE_VALIDATE_MAPPING_ENTIRE_IMAGE_CLEAN @ ComputerNameNetBIOS � KeyLayerInformation . ] � SystemEnclaveLaunchControlInformation � FpCodeAsin F TokenElevationType 0 � MemExtendedParameterAddressRequirements ' ] % SystemRegistryQuotaInformation �6 XLAT_SERVER � Internal " Q ManageHotPatchUnloadPatch �' RtlBsdSleepInProgress & � ProcessControlFlowGuardPolicy , PlugPlayControlQueryDeviceRelations @ AR_DISABLED * FpFormatU16 LockQueueUnusedSpare3 6 WinThisOrganizationSid % PsAttributeMitigationOptions WinNullSid % oF IoCompletionBasicInformation & ] � SystemBootMetadataInformation , _ WinBuiltinRDSRemoteAccessServersSid � 0 ReservedForDVRF48 # ] n SystemRegistryAppendString [ GEO_ISO3 � ToleranceHigh B ProcessDebugPort � UmsSchedulerThreadYield , �F 2 RtlDiskWriteConstraintPolicyLimited ! ] p SystemVhdBootInformation �
SYSTEM_HANDLE_SOCKET $ �? EtwCompressionModeNoDisable �
ImageSehopPolicy k$ NotAppContainerSidType � HAL_MCA_RECORD �" NuBusConfiguration & &
POINTER_CHANGE_FIFTHBUTTON_UP : ` PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES � IMDT_TOUCHPAD ) ', POINTER_DEVICE_TYPE_EXTERNAL_PEN ! � SysDbgGetPrintBufferSize # S: RtlMitigationOptionStateOn - � MonitorRequestReasonAcDcDisplayBurst + � TransactionManagerBasicInformation ) � $ MonitorRequestReasonUserInputHid / �
EventTraceProfileSourceListInformation ( G ServiceDirectoryPersistentState FileEaInformation � IMDT_KEYBOARD � s DPFLTR_THREADORDER_ID " ProcessorCap " �4 MemoryRegionInformationEx � WnfDataScopeProcess �# ResponseAbort � FpCodeSinh & �
VrfMDLInvariantStackRuleClass & � JobObjectReserved8Information
KHeteroCpuPolicySmall < IdleResiliency m FileDispositionInfo 9 ThreadCounterProfiling � ��LdrModulesMerged ) [ WinCapabilityDocumentsLibrarySid " ] q SystemCpuQuotaInformation � FpCodePow Y SystemHiberFileType �( IoSessionEventCreated - ; PerfInfoDomainChangeEventUserRestore ' _ SessionAllowExternalDmaDevices �) NormalizationKD � WdInfoNop $ � FileFsDriverPathInformation � FpCodeRemainder - �( SystemMemoryPartitionNodeInformation B ProcessExceptionPort ( ` WinBuiltinRDSEndpointServersSid 5 � EventTraceLastBranchConfigurationInformation % : PowerSettingNotificationName * 9, ImagePolicyEntryTypeUnicodeString ' ] � SystemManufacturingInformation |7 PdataCrUnchainedSavedLr . � MonitorRequestReasonUserInputKeyboard �( IoSessionEventMax @ SessionLockState � WMI_EXECUTE_METHOD # F " TokenDeviceClaimAttributes � EventSecurityAddSACL �" PowerMonitorOff % � SysDbgSetKdUmExceptionEnable � VRF_TRIAGE_CONTEXT_NONE ' � MonitorRequestReasonSystemIdle ) ProcThreadAttributePseudoConsole 2 ] k SystemLogicalProcessorAndGroupInformation � � DPFLTR_MSDSM_ID 7 ` PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD �, FindExInfoBasic FileQuotaInformation % B = ProcessProtectionInformation , � " JobObjectLimitViolationInformation2 ! FileEndOfFileInformation + �& COPYFILE2_CALLBACK_STREAM_FINISHED % CmExtendedParameterMax / I FileLinkInformationExBypassAccessCheck & $ RtlRXactOperationDelAttribute �
AuditOpenNonObject - � ��DISPLAYCONFIG_TOPOLOGY_FORCE_UINT32 " � VrfMoreDebuggingRuleClass 1 I MidlWinrtTypeSerializationInfoVersionOne , � FeatureConfigurationPriorityService �' MandatoryLevelHigh " ThreadInformationClassMax ( ] � SystemAllowedCpuSetsInformation ! ] ' SystemPrioritySeperation % TraceApplicationPowerMessage 4 ` ! PS_MITIGATION_OPTION_BLOCK_NON_CET_BINARIES . ProcThreadAttributeChildProcessPolicy �$ PsWakeReasonUser ' � , JobObjectReserved22Information � KeyCachedInformation + E FirmwareTableInformationRegistered
SidTypeLogonSession & ProcessorLoad B SC_ACTION_OWN_RESTART # � MmEtwWorkingSetTypeMaximum ' < FileIdExtdDirectoryInformation �4 MemoryBasicInformation � SystemPixelFormatB8G8R8 ( ] � SystemPhysicalMemoryInformation 9 ThreadUmsInformation > ] � SystemHardwareSecurityTestInterfaceResultsInformation
�" Cmos ( B W ProcessEnableReadWriteVmLogging $ P' USER_MARSHAL_CB_BUFFER_SIZE k! VmOfferPriorityLow �* ShutdownNoReboot * FpFormatFp128 . �( SystemMemoryPartitionCreateLargePages - MaxThreadWorkloadClass � FpCodeHypot � UmsThreadMaxInfoClass � WnfDataScopeSession + � MonitorRequestReasonUserInputMouse + � JobObjectNetRateControlInformation 9
ThreadIdealProcessor ( B [ ProcessSystemResourceManagement > WinBuiltinIUsersSid } RtlResTypeDiskSpaceTier $ B E ProcessJobMemoryInformation ) � EventTracePebsTracingInformation - F $ TokenRestrictedDeviceClaimAttributes u
PNP_VetoAlreadyRemoved - M PsEnergyComponentTypeDisplayRequired �) NormalizationKC # �& DfsLinkTrackingInformation # G6 FixedWakeSourceSleepButton � x DPFLTR_NDIS_ID % } RtlResTypePhysicalMemoryTier $ � TP_CALLBACK_PRIORITY_NORMAL . ] � SystemHypervisorSharedPageInformation 9 ThreadSwitchLegacyState f/ ��DPI_AWARENESS_INVALID # > SessionConnectNotification ) = FileReplaceCompletionInformation @ AR_ENABLED $
" FEEDBACK_TOUCH_PRESSANDHOLD D* NotificationEvent " SmrGcStateActiveFullSpeed � AuditOpenObject WinNetworkSid WinBuiltinGuestsSid �$ IDL_CS_NO_CONVERT ( ] � SystemPlatformBinaryInformation ) �( SystemMemoryPartitionAddPagefile � MaximumDmaSpeed , � JobObjectBasicAccountingInformation ) SE_VALIDATE_MAPPING_ENTIRE_IMAGE ! $ � P AccessReasonNullDacl , � EtwSessionNotificationRealtimeError % B ) ProcessThreadStackAllocation ) � TransactionPropertiesInformation � ( DPFLTR_SERENUM_ID % 5 FileStorageTierClassCapacity F TokenPrimaryGroup % WinBuiltinSystemOperatorsSid � X DPFLTR_SHPC_ID * � VrfForcePendingIORequestRuleClass 6 OptionYesNo r! PowerStateSleeping4 >) EtwRtEventLossMax + � ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE �0 PoDisabledStateMaximum � VMEBus 5 ` PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL WinAuthenticatedUserSid ! �# DCDC_DISABLE_FONT_UPDATE # ^" WdActionQueryTriggerAction ' ] * SystemProcessorIdleInformation # � ProfileSpecialInstructions � : DPFLTR_PCIIDE_ID � LdrModulesMapping = ` PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION WinCreatorGroupSid � 1 DPFLTR_BURNENG_ID �( PsProtectedTypeNone 2 JournalSetLastWriteTime " 1 WinAccountPolicyAdminsSid �+ PlatformRoleUnspecified B & ProcessCycleTime ' | FeatureEnabledStateOptionsNone � Isa ( ! TransactionStateCommittedNotify � 5 DPFLTR_IDLETASK_ID $ B N ProcessReserved3Information � KeyNameInformation \ IrqPriorityNormal % ] r SystemNativeBasicInformation $ WinEnterpriseControllersSid ) �4 MemoryPrivilegedBasicInformation F ExceptionContinueSearch m
FileIdBothDirectoryInfo B ' ProcessPagePriority J IoPriorityHintLow ] SystemBasicInformation MutantOwnerInformation + B P ProcessDisableSystemAllowedCpuSets � AuditCloseNonObject 0 p ��DISPLAYCONFIG_DEVICE_INFO_FORCE_UINT32 ' & POINTER_CHANGE_SECONDBUTTON_UP ?" HiberFileBucket16GB m FileAllocationInfo WOW64_FUNCTION_NOP % ] � SystemShadowStackInformation ProcessorPowerPolicyDc 2 JournalSetKeyUserFlags ' � ACTCTX_RUN_LEVEL_REQUIRE_ADMIN ) ] � SystemDifSetRuleClassInformation ) ] � SystemActivityModerationExeState 3 Y IrqPolicySpreadMessagesAcrossAllProcessors # , FileSfioReserveInformation 3 nD TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE ( B AlpcRegisterCallbackInformation % M PsEnergyComponentTypeNetwork $ � ImageControlFlowGuardPolicy 2 `
PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE �$ IDL_CS_IN_PLACE_CONVERT , h WinAuthenticationServiceAssertedSid )
" FEEDBACK_PEN_BARRELVISUALIZATION /# BlockedDriverEvent ' � TransactionOutcomeUndetermined � StorageReserveIdNone � SingleUserTS 8 LogicalProcessorIdling ! ] 1 SystemSessionInformation � SysDbgGetAutoKdEnable � PnpQueryPowerRelations ! � KeyHandleTagsInformation 8 _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPOSITE_VIDEO �) EtwFlushLoggerCode ) �" CsvFsDiskConnectivityMdsNodeOnly ! �' RtlBsdItemShutdownBootId 0 ) FileIoCompletionNotificationInformation #
FileDispositionInformation " �: SeLearningModeInvalidType 7 WOW64_FUNCTION_CPU_OPTIMIZE_CHPE_IMPORT_THUNKS � TraceDisallowListQuery ! ] SystemPoolTagInformation � DynamicTickVetoMax � SysDbgSetKdBlockEnable � 3 MonitorRequestReasonMax � p DPFLTR_USERGDI_ID � VrfForceIrqlRuleClass $ � MonitorRequestReasonUnknown �, FindExInfoMaxInfoLevel 0 ] � SystemRegistryReconciliationInformation , l EtwCoverageSamplerCreateInformation " u PNP_VetoInsufficientPower ' l MaxEtwCoverageSamplerInfoClass ( ] = SystemProcessorPowerInformation � VERIFIER_MODE_LOGO � FpCodeRound SystemPowerInformation ' ] g SystemCodeIntegrityInformation � & SysDbgKdPullRemoteFile , J WinEnterpriseReadonlyControllersSid * � JOB_OBJECT_IO_RATE_CONTROL_ENABLE �' MandatoryLevelSystem �# MemoryNotContiguous . WnfPersistentStateName ) v WinAuthenticationFreshKeyAuthSid & Y WinCapabilityVideosLibrarySid 2 ] � SystemHypervisorProcessorCountInformation � SysDbgReadBusData \ IrqPriorityHigh �$ Width64Bits � TraceMaxPmcCounterQuery H PlmPowerRequestCreate $ UmsInformationCommandAttach # # ProcessProtectionLevelInfo � l DPFLTR_KTM_ID ! i5 SC_EVENT_PROPERTY_CHANGE �# ResponseIgnore % ! WinBuiltinBackupOperatorsSid " LockQueueNonPagedPoolLock # � FileFsAttributeInformation ( M PsEnergyComponentTypeMouseInput ' � - JobObjectReserved23Information 0 PsAttributeAllApplicationPackagesPolicy $ KeyRemoved � # SysDbgGetUmAttachPid $ � SysDbgQueryTraceInformation 4 � ' MonitorRequestReasonUserInputInitialization - ] � SystemProcessorCycleStatsInformation
PlugPlayControlProperty ' �* CmResourceShareDeviceExclusive �" PowerMonitorOn $ �# WorkerFactoryTimeoutWaiters ' �D ReadDirectoryNotifyInformation [ GEO_OFFICIALLANGUAGES � SysDbgWriteMsr $ � CsvControlQueryFileRevision �. SystemFirmwareTable_Get = RPCHTTP_RS_REDIRECT ' �) ServiceRegistryStatePersistent ) SessionPowerInit PsAttributeMax ' � EventTraceGroupMaskInformation � DPFLTR_CONFIG_ID , PlugPlayControlQueryAndRemoveDevice � ' VrfLwSpecialPool �
DPFLTR_REDBOOK_ID �: SeLearningModeSettings B Y ProcessImageSection PsAttributeImageName % �. CI_WINDOWS_LOCKDOWN_MODE_MAX � FileFsSizeInformation ' � VrfMDLInvariantDriverRuleClass & � SymbolicLinkGlobalInformation � DPFLTR_WMILIB_ID u PNP_VetoLegacyDriver ] � SystemCpuSetInformation " 9, ImagePolicyEntryTypeInt32 � DPFLTR_TWOTRACK_ID ) � EventTraceHeapTracingInformation � UmsSchedulerStartup PsAttributeBnoIsolation - B
AlpcCompletionListRundownInformation �"
PNPISAConfiguration = SessionRITState � WMI_ENABLE_EVENTS � ��LdrModulesSnapError F - TokenChildProcessFlags ' � JobObjectBasicLimitInformation 3 u WinAuthenticationKeyPropertyAttestationSid
KHeteroCpuPolicyDynamic T WinBuiltinAnyPackageSid ( � InternalWakeSourceTimerOverride % VerifyProcessorPowerPolicyAc ! RtlPathTypeDriveRelative B
ProcessIoPortHandlers 4 �2 DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED B " ProcessExecuteFlags & > FileHardLinkFullIdInformation " � UmsSchedulerThreadBlocked ! �( IoSessionEventTerminated PsAttributeWin32kFilter $ � p AccessReasonNoSD % M PsEnergyComponentTypeStorage F TokenUIAccess # <* PoSleepDisableReasonPolicy # �? UserSharedServiceRequester % s WinAuthenticationKeyTrustSid " �$ PdataPackedUnwindFunction � WaitAll �
FpCodeTruncate $ KeyModified � WdInfoStopTimer ' � JobObjectReserved13Information ( PlugPlayControlGetRelatedDevice & � DynamicTickVetoClockOutOfSync B ProcessUserModeIOPL ( ] } SystemSessionBigPoolInformation @ PerfInfoDebugEventMax @ AR_SUPPRESSED � BootEntropySourceUefi 2 JournalCreateKey & 9 ( ThreadSystemThreadInformation - ': ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS > ` PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE # �# MemoryAlignedAndContiguous + C FileDesiredStorageClassInformation � i DPFLTR_ALPC_ID " � SemaphoreBasicInformation - � MonitorRequestReasonUserDisplayBurst " FileCompletionInformation @ @ AR_DOCKED � LocationTypeMaximum [ GEO_DIALINGCODE 9 2 ThreadWorkloadClass � BootEntropySourceTcbTpm ( ] " SystemCrashDumpStateInformation 9 ThreadIoPriority $ RtlRXactOperationDelete � FpCodeSubtract %6 PT_TOUCHPAD # �; JournalAbsoluteInformation # SystemWakeSource � ProfilePipelineFrozen . WnfPermanentStateName ! � POINTER_FEEDBACK_DEFAULT % 9, ImagePolicyEntryTypeOverride 9 ThreadBasicInformation �) NormalizationOther ' B T ProcessCaptureTrustletLiveDump % � MonitorRequestReasonTerminal % �+ FileMetadataOptimizationNone * h FeatureConfigurationOperationNone # �2 FindExSearchLimitToDevices * ] I SystemLogicalProcessorInformation . B AlpcRegisterCompletionListInformation + COR_VTABLE_32BIT � DPFLTR_FSTUB_ID . ] � SystemCodeIntegrityClearDynamicStores r! PowerStateMaximum LastWakeTime � CommunicationServer ! 3 WinNTLMAuthenticationSid � FpCodeLog10 � k DPFLTR_PERFLIB_ID 0 W6 VirtualStorageBehaviorCacheWriteThrough # ] z SystemAcpiAuditInformation # /# DeviceInstanceStartedEvent 2
JournalAbortTransaction �C PROXY_MARSHAL / a' RunlevelInformationInActivationContext z StandardDesign ' � ObjectSessionObjectInformation % ] � SystemPoolZeroingInformation & ��LdrpAnyDevice � SystemVaTypeAll ! 9 ThreadSetTlsArrayAddress ! FilePipeLocalInformation SystemPowerLoggingEntry �' RtlBsdItemChecksum $
KHeteroCpuPolicyLargeOrIdle * �& COPYFILE2_CALLBACK_STREAM_STARTED % * COPYFILE2_PHASE_PREPARE_DEST + t WinAuthenticationKeyPropertyMFASid � j DPFLTR_WDI_ID ! �% KeyWow64FlagsInformation # �! SystemCrashDumpReconfigure . � TransactionManagerRecoveryInformation � FpCompareUnordered & SystemPowerStateNotifyHandler � ImageAslrPolicy [ GEO_LCID k$ MaxAppContainerSidType & ', POINTER_DEVICE_TYPE_TOUCH_PAD ! � FileFsMaximumInformation $ PsAttributeDesktopAppPolicy ' * COPYFILE2_PHASE_PREPARE_SOURCE � TableFoundNode FileAccessInformation � SYSTEM_HANDLE_THREAD B ! ProcessIoPriority 9 % ThreadContainerId + � EventTraceProfileConfigInformation 3 ] � SystemEntropyInterruptTimingRawInformation RtlPathTypeUnknown # o PerfInfoMemResetUndoFailed �' � UserUnknown $ B AlpcConnectedSIDInformation , B e ProcessDynamicEHContinuationTargets ( �! � �HeapSetDebuggingInformation � FirmwareTypeUnknown # Y IrqPolicyOneCloseProcessor � CsvControlStartForceDFO L FileMaximumInformation � AuditPrivilegeObject 9 KTMOBJECT_INVALID B ProcessAffinityMask B ProcessVmCounters �R MaxTimerInfoClass � ImageFontDisablePolicy # �' RtlBsdItemBootAttemptCount $ � WnfDataScopePhysicalMachine � DPFLTR_I8042PRT_ID # �# WorkerFactoryThreadMaximum SmrGcStateActive PsAttributeDebugObject � WdInfoInvalid & � JobObjectReserved1Information � � DPFLTR_WER_ID \ EnergyTrackerCreate 9 & ThreadNameInformation � 9 ReservedForDVRF57 6 OptionOk " �# WorkerFactoryCallbackType � WMI_REGINFO - V WinCapabilityInternetClientServerSid & ] SystemNonPagedPoolInformation 2E COMPARE_STRING $ ] � SystemLeapSecondInformation , ` PS_MITIGATION_OPTION_HEAP_TERMINATE + ProcThreadAttributeProtectionLevel � NuBus & PsAttributeChildProcessPolicy �' MandatoryLevelLow ' # DISPLAYCONFIG_SCALING_IDENTITY $ @ PoCsDeviceNotificationAudio �( IoSessionEventLogon �$ MemoryTypeHugePage $ �$ PsWakeReasonPreserveProcess * a WinBuiltinRDSManagementServersSid �! HeapStackDatabase # ] � SystemWin32WerStartCallout # B AlpcMessageZoneInformation $ 2! VmPageDirtyStateInformation FileAllInformation A) InternalWakeSourceType � � DPFLTR_GPIO_ID % 5 WinSChannelAuthenticationSid B �B SystemActivityModerationStateUserManagedDisableThrottling % �+ PlatformRoleEnterpriseServer ! � ProcessActivityTypeAudio EventProviderSetTraits $ # ProcessMemoryExhaustionInfo PsAttributeHandleList � 7 DPFLTR_TAPE_ID B AlpcPortInformation RtlPathTypeLocalDevice & � JobObjectReserved6Information � DPFLTR_ACPI_ID U AclRevisionInformation � 6 DPFLTR_SOFTPCI_ID ! � SystemVaTypeNonPagedPool ! ProcessorIdleStates o PerfInfoMemReset SystemPowerStateHandler - ] � SystemCodeIntegrityUnlockInformation ' L WinBuiltinEventLogReadersGroup � ProfileLoadLinkedIssues �1 ShrinkAbort / B J ProcessHighGraphicsPriorityInformation P PsCreateInitialState B % ProcessImageInformation % � ImageSystemCallDisablePolicy u PNP_VetoDriver � WdInfoTriggerAction �) EtwStopLoggerCode 3 % WinBuiltinNetworkConfigurationOperatorsSid � WMI_GET_ALL_DATA FileModeInformation WinRemoteLogonIdSid ! � ACTCTX_RUN_LEVEL_NUMBERS � % SysDbgGetLiveKernelDump , PlugPlayControlGenerateLegacyDevice " � WnfInfoSubscribersPresent 3 � & MonitorRequestReasonUserInputSessionSwitch # 8
RtlPhysicalMemoryPolicyLow �( IoSessionEventIgnore ! O RegisterSpmPowerSettings ( & POINTER_CHANGE_FIRSTBUTTON_DOWN ( X WinCapabilityPicturesLibrarySid " + COR_VTABLE_FROM_UNMANAGED C �2 DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST 5 _$ � �DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INTERNAL ( B d ProcessAltSystemCallInformation % � SysDbgQueryModuleInformation � e DPFLTR_DEFAULT_ID � FpCodeSin F TokenMandatoryPolicy < KCONTINUE_RESUME PsAttributeChpe 0 �W JOB_OBJECT_NET_RATE_CONTROL_VALID_FLAGS O WinMediumPlusLabelSid * �! HeapEnableTerminationOnCorruption % � EtwQueryProcessHandleInfoMax � ^ DPFLTR_VDS_ID 9 � JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ALL " � VrfMiscellaneousRuleClass & ] SystemMirrorMemoryInformation * ] { SystemBasicPerformanceInformation � T DPFLTR_RTLTHREADPOOL_ID ) Q ManageHotPatchUnloadPatchForUser # FileMoveClusterInformation � a DPFLTR_VDSDYNDR_ID $ 9 * ThreadDynamicCodePolicyInfo " $ � AccessReasonDeniedAce � VERIFIER_MODE_TEST - W6 VirtualStorageBehaviorCacheWriteBack + ] � SystemInterruptSteeringInformation � JobObjectClearEvent ' / NotifyUserModeLegacyPowerEvent �+ PlatformRoleAppliancePC $ B . ProcessMemoryAllocationMode F TokenSource $ !/ IMPORT_OBJECT_NAME_EXPORTAS 2 JournalDeleteKey ' E FileMemoryPartitionInformation �' RtlBsdItemProductType # 9, ImagePolicyEntryTypeUInt64 ' PlugPlayControlEnumerateDevice 4 �2 DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE B 7 ProcessKeepAliveCount * ] � SystemWheaIpmiHardwareInformation � SysDbgGetTriageDump B ] ProcessLoaderDetour 0 ] R SystemThreadPriorityClientIdInformation � ; DPFLTR_FLOPPY_ID # 2! VmImageHotPatchInformation " � FileFsDataCopyInformation � SecurityIdentification & � JobObjectReserved5Information 1 ] WinCapabilityEnterpriseAuthenticationSid � TracePmcCounterListInfo & @ PoCsDeviceNotificationStorage > a' FileInformationInAssemblyOfAssemblyInActivationContxt , M PsEnergyComponentTypeForegroundTime �1 ShrinkCommit $ B H ProcessIumChallengeResponse ] 0 SystemSessionDetach � DPFLTR_CACHEMGR_ID m FileNormalizedNameInfo + COMIMAGE_FLAGS_ILONLY �) EtwWdiSemUpdate , ] l SystemProcessorCycleTimeInformation # U PowerRequestActionInternal � PhoneNT � A DPFLTR_FCPORT_ID " ' PowerShutdownNotification �' RtlBsdPowerTransition ( <* PoSleepDisableReasonGuardedHost * F . TokenIsLessPrivilegedAppContainer � FpCodeAtan2 � AuditCloseObject & @ ComputerNameDnsFullyQualified � 5 ReservedForDVRF53 VerifySystemPolicyDc " /# DevicePropertyChangeEvent - + � COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE �$ MemoryTypeMax FilePositionInformation ' ] � SystemVsmProtectionInformation 0 `
PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD % B a ProcessLeapSecondInformation WinLogonIdsSid � WMI_DISABLE_EVENTS SystemPowerStateLogging / B AlpcAssociateCompletionPortInformation , _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDI % !/ IMPORT_OBJECT_NAME_NO_PREFIX - � EtwSessionNotificationSessionStarted " k$ ParentAppContainerSidType + �
CsvControlQueryVolumeRedirectState H$ MaxKeyValueInfoClass % � MemExtendedParameterNumaNode 3 ` PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE ! % TraceServicePowerMessage PsAttributeImageInfo # � ImageUserShadowStackPolicy �
BootMaxEntropySources RpcRequestsPerSecond b WinUserModeDriversSid �# ResponseNo < KCONTINUE_LAST � WdInfoTimeoutValue ! � SysDbgSetPrintBufferSize * ] � SystemProcessorProfileControlArea SetPowerSettingValue % � ProcessUserShadowStackPolicy # � UNSPECIFIED_COMPARTMENT_ID * �# MemoryNotEligibleToMakeContiguous % � CsvControlQueryRedirectState - � MonitorRequestReasonPoSetSystemState �" Pos 2 p DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_NAME � 8 ReservedForDVRF56 . � VRF_TRIAGE_CONTEXT_FLIGHT_DIAGNOSTICS NotifyUserPowerSetting � CsvControlEnableCaching ! i5 SC_EVENT_DATABASE_CHANGE $ � BackTraceDatabaseMaxControl F TokenCapabilities & � JobObjectReserved7Information 9 KTMOBJECT_ENLISTMENT $ Y IrqPolicyAllCloseProcessors " � BootEntropySourceSeedfile WinWorldSid 1 8 WinBuiltinIncomingForestTrustBuildersSid RtlPathTypeRelative �4 CoverageAllModules 2 nD TOKEN_SECURITY_ATTRIBUTE_OPERATION_DELETE " � SystemPixelFormatB8G8R8X8 VerifySystemPolicyAc � FpCodeMultiply ( �# DISPLAYCONFIG_ROTATION_IDENTITY & � SecureSettingValueTypeUnknown F TokenRestrictedSids � CacheTrace PowerActionWarmEject 2 �W JOB_OBJECT_NET_RATE_CONTROL_MAX_BANDWIDTH * � JobObjectExtendedLimitInformation WinLocalServiceSid , �4 MemoryPhysicalContiguityInformation ^" WdActionStartTimer % EventProviderBinaryTrackInfo � SysDbgCheckLowMemory 0 � EventTraceProfileCounterListInformation u
PNP_VetoNonDisableable � DPFLTR_SYSTEM_ID # � TransactionBindInformation # /# HardwareProfileChangeEvent � - ReservedForDVRF45 2 JournalSetValue ) � VrfProcessorBranchTraceRuleClass $ �& NtfsLinkTrackingInformation ^" WdActionSetTimeoutValue & B < ProcessCommandLineInformation ' B I ProcessChildProcessInformation " LockQueueIoCompletionLock ! $ RtlDiskSpacePolicyNormal � @ DPFLTR_RSFILTER_ID � w DPFLTR_FVEVOL_ID ! +' LoadReasonEnclavePrimary � DPFLTR_TCPIP_ID S# SeImageSignatureCache �6 HANDEDNESS_LEFT # ] � SystemCpuSetTagInformation �( AtomBasicInformation & � $ JobObjectSiloBasicInformation * COPYFILE2_PHASE_MAX � SysDbgWriteVirtual 9 ThreadPerformanceCount ! � VrfExtendingXDVTimeLimit / ] � SystemDeviceDataEnumerationInformation IoPriorityNormal . PlugPlayControlGetInterfaceDeviceList 0 8* ��DISPLAYCONFIG_PIXELFORMAT_FORCE_UINT32 % ] SystemDpcBehaviorInformation ! FileAlignmentInformation i WinLocalAccountSid ) � JobObjectInterferenceInformation + � EventTraceKernelVersionInformation ' ] SystemSummaryMemoryInformation ( �# WorkerFactoryThreadBasePriority A p DISPLAYCONFIG_DEVICE_INFO_SET_SUPPORT_VIRTUAL_RESOLUTION � DPFLTR_STORPROP_ID ' @ PoCsDeviceNotificationEthernet ! ] B SystemBigPoolInformation � MmEtwWorkingSetTypeUser - � CsvControlQueryFileRevisionFileId128 � ComputeServer 9 ThreadIsTerminated �4 CoverageSearchByName � > ReservedForDVRF62 , � & JobObjectServerSiloBasicInformation G ServiceDirectoryTypeMax $ AccessReasonNone � \ DPFLTR_VSSDYNDISK_ID � SectionImageInformation 9 3 MaxThreadInfoClass � SysDbgClearSpecialCalls % ] � SystemFullProcessInformation ( DevicePowerState ' � AuditOpenObjectWithTransaction �' RtlBsdItemBootShutdown �#
WorkerFactoryFlags 3 � % MonitorRequestReasonUserInputPoUserPresent " � FileFsFullSizeInformation � SYSTEM_HANDLE_MUTEX � SystemVaTypeSystemPtes 1 ProcessorIdleDomains F TokenAccessInformation WinDialupSid � TraceGuidQueryList ! �R TimerSetCoalescableTimer [ GEO_ID [ GEO_CURRENCYCODE 1 B FileRenameInformationExBypassAccessCheck �) EtwIncrementFileCode [ GEO_CURRENCYSYMBOL � FpCodeCosh * == POINTER_DEVICE_CURSOR_TYPE_ERASER % ] SystemVdmInstemulInformation ( B A ProcessCommitReleaseInformation � JobObjectContainerId C PdcInvocation - �( SystemMemoryPartitionGetMemoryEvents + �" CsvFsDiskConnectivitySubsetOfNodes + ; PerfInfoDomainChangeEventEnterTrap , ProcThreadAttributeDesktopAppPolicy / � CsvControlUnmarkHandleLocalVolumeMount � ProfileMaximum �! HeapMemoryLimit " �# MaxWorkerFactoryInfoClass " $ RtlRXactOperationSetValue 0 � / JobObjectThreadImpersonationInformation 3 � ��DISPLAYCONFIG_COLOR_ENCODING_FORCE_UINT32 +' LoadReasonDynamicLoad � SYSTEM_HANDLE_SECTION ( � SectionInternalImageInformation 0 0 BootEntropySourceStructureUninitialized ] SystemPathInformation 3 ` PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER ,
" FEEDBACK_TOUCH_CONTACTVISUALIZATION � VERIFIER_MODE_FIELD � � DPFLTR_VPCI_ID [
GEO_PARENT $ +' LoadReasonEnclaveDependency � - JobObjectSiloSystemRoot % � DynamicTickVetoSoftwareTimer � DPFLTR_SVCHOST_ID % � MonitorRequestReasonResumeS4 9 ' ThreadSelectedCpuSets - ] � SystemCodeIntegrityPolicyInformation # � EtwNotificationTypePerflib " � TP_CALLBACK_PRIORITY_HIGH WinBuiltinDomainSid . ] SystemProcessorPerformanceInformation ! �( SystemMemoryPartitionMax @ ComputerNameDnsDomain ' � JobObjectCycleTimeNotification * ] SystemPerformanceTraceInformation ] EnergyTrackerQuery ! �0 PoDisabledStateSleeping4 B AlpcServerInformation ' � JobObjectReserved10Information ! ', ��POINTER_DEVICE_TYPE_MAX ) Q ManageHotPatchQueryActivePatches @ �B SystemActivityModerationStateUserManagedAllowThrottling
SidTypeDomain ' % FileIdBothDirectoryInformation % �! HeapCompatibilityInformation �$ MemoryTypeNonPaged F FileStatLxInformation ! PsAttributePriorityClass [+ IMO_SYSTEM IoPriorityLow $ UmsInformationCommandDetach ! �" SgiInternalConfiguration � CacheInstruction ] SystemFlagsInformation FileFullEaInformation % ] u SystemBootEntropyInformation - +' LoadReasonDynamicForwarderDependency �# ResponseNotHandled * �. CI_WINDOWS_LOCKDOWN_MODE_UNLOCKED � " FpCodeY0 * � - MonitorRequestReasonDirectedDrips F TokenUser � I DPFLTR_PROCESSOR_ID ( J FileStorageReserveIdInformation / �D ReadDirectoryNotifyExtendedInformation * p WinBuiltinStorageReplicaAdminsSid , PowerRequestAction /! STUB_MARSHAL ( # DISPLAYCONFIG_SCALING_STRETCHED F TokenGroups % �
FileFsVolumeFlagsInformation ] � SystemPolicyInformation ( ] a SystemVerifierFaultsInformation F TokenSandBoxInert
SystemReserveHiberFile , ` PS_MITIGATION_OPTION_ROP_STACKPIVOT � ToleranceMedium ( � MemExtendedParameterInvalidType " / WinAccountSchemaAdminsSid # �# WorkerFactoryThreadCpuSets � DEFAULT_COMPARTMENT_ID 7 a' AssemblyDetailedInformationInActivationContext * B 0 ProcessTokenVirtualizationEnabled " J MaximumIoPriorityHintType * FpFormatFp64 * � EventTraceStackTracingInformation + �W JOB_OBJECT_NET_RATE_CONTROL_ENABLE �5 CriticalError % a FileStorageTierMediaTypeDisk , � + JobObjectMemoryPartitionInformation # 9, ImagePolicyEntryTypeUInt32 ! �0 PoDisabledStateSleeping1 H$ KeyValueFullInformation �C PROXY_CALCSIZE " IoSessionStateConnected ? ` $ PS_MITIGATION_OPTION_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY 9 ThreadCycleTime / v CrossProcOperationMemoryAllocPreNotify � VrfRuleClassBase / � EventTraceExecutiveResourceInformation * ; PerfInfoDomainChangeEventIdleHalt 2 JournalSetKeySecurity < KCONTINUE_SET ! � ObjectSessionInformation $ �' MandatoryLevelSecureProcess /# TargetDeviceChangeEvent z EndAlternatives . �! SystemCrashDumpInitializationComplete >) EtwRtBackupLost � UmsThreadTeb � SecurityAnonymous �: PowerUserPresent / � MonitorRequestReasonBatteryCountChange ' �' RtlBsdItemPowerButtonPressInfo " � MonitorRequestReasonWinrt * � ProcessSideChannelIsolationPolicy % 99 DDC_DISABLE_CONTROL_RELAYOUT ) ] 9 SystemExtendedProcessInformation �C PortBasicInformation * ] � SystemInterruptCpuSetsInformation "$ MonitorRequestTypeOff � BootEntropySourceCng ! � VrfPortMiniportRuleClass WinServiceSid / ] � SystemTrustedPlatformModuleInformation & & POINTER_CHANGE_THIRDBUTTON_UP � SynchronizationTimer �5 IgnoreError B SC_ACTION_RUN_COMMAND MaxIoPriorityTypes " - FileSfioVolumeInformation �
DPFLTR_SCSIMINIPORT_ID �$ MemoryTypePaged / ` PS_MITIGATION_OPTION_RETURN_FLOW_GUARD F TokenAuditPolicy [
GEO_TIMEZONES $ � � AccessReasonNoGrant + � EtwSessionNotificationMediaChanged �5 NormalError ! FileDirectoryInformation B ProcessAccessToken "
LockQueueAfdWorkQueueLock ) ] 6 SystemLoadGdiDriverInSystemSpace B ProcessLdtSize � DPFLTR_VIDEO_ID � � DPFLTR_KSECDD_ID $ �* RtlFeatureConfigurationBoot ' 9 " ThreadCpuAccountingInformation ( ] � SystemKernelVaShadowInformation - MemoryReserveUserApc �C PROXY_GETBUFFER " �? EtwCompressionModeRestart � AuditPrivilegeService ! � RelationProcessorPackage , M SharedVirtualDiskSnapshotsSupported = RPCHTTP_RS_SESSION +' LoadReasonAsImageLoad + �D AlpcMessageDirectStatusInformation * FpFormatI32 $ /! STUB_CALL_SERVER_NO_HRESULT � ! SysDbgGetUmBreakPid ! �& COPYFILE2_CALLBACK_ERROR � UmsThreadIsSuspended �$ Width32Bits # 4 WinDigestAuthenticationSid m FileAlignmentInfo 4 a' CompatibilityInformationInActivationContext � ��InterfaceTypeUndefined � WMI_SET_SINGLE_INSTANCE � VrfNdisWifiRuleClass ( �# DISPLAYCONFIG_ROTATION_ROTATE90 ; GetPowerSettingValue * I WinNonCacheablePrincipalsGroupSid $ S: RtlMitigationOptionStateOff 5 FileNumaNodeInformation � DPFLTR_HALIA64_ID WinProxySid 5 _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EXTERNAL 5 K FileCaseSensitiveInformationForceAccessCheck � O DPFLTR_IHVAUDIO_ID A � JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ON_SOFT_CAP � } DPFLTR_SBP2PORT_ID * W MemoryPurgeLowPriorityStandbyList % ] � SystemMemoryUsageInformation ' � VRF_TRIAGE_CONTEXT_DEVELOPMENT �
SysDbgReadPhysical P WinLocalLogonSid " � ImagePolicyIdCrashDumpKey " c WinBuiltinHyperVAdminsSid ' �) ServiceRegistryStateParameters � - DPFLTR_UNIMODEM_ID F / TokenIsSandboxed � Enterprise � BootEntropySourceTime
� Eisa # � ProfileIntegerInstructions � DPFLTR_AMLI_ID � RelationProcessorCore ^" WdActionWake � ProfileTotalNonissues
" ��FEEDBACK_MAX " SmrGcActionStartFullSpeed 9 ThreadLastSystemCall ] � SystemFlags2Information % + COMIMAGE_FLAGS_32BITREQUIRED " 9, ImagePolicyEntryTypeUInt8 ! � ProfileStoreInstructions � TraceMaxLoggersQuery @ � AR_LAPTOP � � DPFLTR_CFR_ID $ PlugPlayControlDeviceStatus # ProcessPowerThrottling / � SharedVirtualDiskHandleStateFileShared � SmrGcMethodCompression � � DPFLTR_STORVSP_ID ( Y IrqPolicyAllProcessorsInMachine # ] SystemFileCacheInformation ; 4/ SystemFeatureConfigurationSectionTypeUsageTriggers 0 M PsEnergyComponentTypeDesktopVisibleTime 3 DEPTotalPolicyCount � 2 DPFLTR_IMAPI_ID �
TraceSetDisallowList ?" HiberFileBucket8GB ( GroupAffinityDontCare , ] � SystemSpeculationControlInformation
SidTypeGroup � = DPFLTR_TERMSRV_ID # &E PowerRequestSystemRequired �
StorageServer 3 ` PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER & �" CsvFsDiskConnectivityAllNodes % UmsInformationCommandInvalid # G6 FixedWakeSourcePowerButton ) �
EtwNotificationTypeInProcSession ?" HiberFileBucket32GB �$ PsWakeReasonKernel % # ProcessTelemetryCoverageInfo . WnfTemporaryStateName % � SysDbgGetKdUmExceptionEnable � � DPFLTR_MOUNTMGR_ID 5 ] � SystemCodeIntegritySyntheticCacheInformation # ] X SystemProcessIdInformation * F 0 TokenOriginatingProcessTrustLevel 1 �' RtlBsdItemReportedAbnormalShutdownBootId , � VrfTrackingPoolAllocationsRuleClass 7 WinOtherOrganizationSid S PowerSystemUnspecified " � BootEntropySourceExternal & &E PowerRequestExecutionRequired ' # DISPLAYCONFIG_SCALING_CENTERED < KCONTINUE_UNWIND " �# WorkerFactoryRetryTimeout � DPFLTR_DISK_ID 6 OptionAbortRetryIgnore ( ] � SystemMemoryTopologyInformation # ProcessAppMemoryInfo 3 �B SystemActivityModerationStateSystemManaged $ � ORIENTATION_PREFERENCE_NONE " �$ IDL_CS_NEW_BUFFER_CONVERT $ B B ProcessReserved1Information ) K WinAccountReadonlyControllersSid � KeyFlagsInformation 99 DDC_DISABLE_ALL ' �2 FindExSearchLimitToDirectories [+ IMO_HARDWARE ( EventBasicInformation >) EtwRtEventLost # $ SystemHiberFileInformation + COR_VTABLE_64BIT �$ Width16Bits ' �' RtlBsdPowerTransitionExtension % FileMailslotQueryInformation ) ProcThreadAttributeGroupAffinity ! �0 PoDisabledStateSleeping3 � [ DPFLTR_PRINTSPOOLER_ID $ � SysDbgDisableKernelDebugger # � VRF_TRIAGE_CONTEXT_DEFAULT 5 4/ SystemFeatureConfigurationSectionTypeRuntime B # ProcessTlsInformation z NEC98x86 " PlugPlayControlHaltDevice � " VrfMoreIrqlRuleClass A) FixedWakeSourceType # F TokenVirtualizationEnabled ) � " MonitorRequestReasonUserInputPen / � JobObjectExtendedAccountingInformation % 40 DynamicTickDisableReasonNone � FileFsLabelInformation � TerminalServer & �4 MemorySharedCommitInformation $ e FeatureEnabledStateDisabled ' % CmExtendedParameterInvalidType � TP_LOG_LEVEL_WARNING 2 =+ SystemProcessClassificationMemCompression . ] � SystemSupportedProcessorArchitectures � PoConditionMaximum " $ RtlDiskSpacePolicyVeryLow $ A) TimerPresumedWakeSourceType $ PlugPlayControlUserResponse ; , CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK_PERMANENT B SC_ACTION_NONE � ��LdrModulesUnloaded � RelationGroup [ GEO_OFFICIALNAME RtlPathTypeUncAbsolute � H DPFLTR_PNPMEM_ID �) EtwQueryLoggerCode 0 WOW64_FUNCTION_QUERY_PROCESS_DEBUG_INFO 4 B G ProcessRaiseUMExceptionOnInvalidHandleClose 0 v CrossProcOperationInstructionCacheFlush �# TimerBasicInformation ! ] SystemProcessInformation ! 9 ThreadImpersonationToken # �% KeyControlFlagsInformation SmrGcStatePaused % Z WinCapabilityMusicLibrarySid � LT_DONT_CARE �: PowerUserInactive & �+ PlatformRolePerformanceServer + �
JobObjectLimitViolationInformation J IoPriorityHintVeryLow & � DISPLAYCONFIG_TOPOLOGY_EXTEND ( == ��POINTER_DEVICE_CURSOR_TYPE_MAX # u PNP_VetoInsufficientRights B ProcessRaisePriority �# ResponseTryAgain 7 p DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_BASE_TYPE � / DPFLTR_FLTMGR_ID � FpCodeExp ?" HiberFileBucket4GB ' H WinCacheablePrincipalsGroupSid O$ GenericGreaterThan @ ` PS_MITIGATION_OPTION_USER_CET_SET_CONTEXT_IP_VALIDATION P PsCreateFailOnFileOpen $ � LearningModeLogLevelPassive |7 PdataCrChained ! � EtwQueryLastDroppedTimes 6 OptionOkCancel ! ? PsProtectedSignerCodeGen , \ SE_WS_APPX_SIGNATURE_ORIGIN_UNKNOWN , =+ SystemProcessClassificationRegistry 3 ] � SystemCodeIntegrityVerificationInformation 7 ] � SystemAffinitizedInterruptProcessorInformation � ` DPFLTR_VDSDYN_ID � ProfileLoadInstructions % + COR_VTABLE_CALL_MOST_DERIVED , ; PerfInfoDomainChangeEventIdleResume �# ResponseYes �? UserProcessRequester ?" HiberFileBucket2GB " � EtwSessionNotificationMax 8 _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPONENT_VIDEO "
" EtwProviderTraitTypeGroup � WnfDataScopeUser RpcIncomingBandwidth $ @ ComputerNamePhysicalNetBIOS # ] ! SystemExceptionInformation % � SectionRelocationInformation , �? DISPLAYCONFIG_MODE_INFO_TYPE_SOURCE 9 ` PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT 7 � MonitorRequestReasonAcDcDisplayBurstSuppressed ( ? IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF ! k$ ChildAppContainerSidType ! G WinCreatorOwnerRightsSid & ] x SystemSystemPtesInformationEx 7 ] � SystemCodeIntegrityPlatformManifestInformation ! � ImagePolicyIdParentSdRev ProcessWorkingSetEmpty � PnpQueryEjectRelations ' ] � SystemSecurityModelInformation �" MaximumBusDataType ! � WdInfoGeneratedLastReset * ] � SystemIsolatedUserModeInformation ! M PsEnergyComponentTypeMBB F % TokenDeviceGroups [ GEO_NAME �'
RtlBsdItemBootId 0 nD TOKEN_SECURITY_ATTRIBUTE_OPERATION_NONE 99 DDC_DEFAULT " ] ] SystemTimeZoneInformation F TokenSessionId P PsCreateMaximumStates - | FeatureEnabledStateOptionsWexpConfig ' m FileIdExtdDirectoryRestartInfo � MaxSectionInfoClass * ] U SystemProcessorPowerInformationEx + % CmExtendedParameterFileAccessToken . � EventTraceProfileEventListInformation ) & POINTER_CHANGE_FOURTHBUTTON_DOWN $
KHeteroCpuPolicySmallOrIdle % � TraceProfileSourceConfigInfo * COPYFILE2_PHASE_NONE & M RtlSparseBitmapOperationClear B SC_ACTION_RESTART & WinBuiltinAccountOperatorsSid B : ProcessHandleTable � SystemVaTypeSystemCache LockQueueUnusedSpare8 + ] � SystemOfflineDumpConfigInformation ] SystemModuleInformation �% KeyWriteTimeInformation C �2 DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST + ] � SystemCodeIntegrityAddDynamicStore $ ] � SystemSpacesBootInformation ! ? PsProtectedSignerWindows % � . JobObjectEnergyTrackingState @ ComputerNameDnsHostname $ ] c SystemSystemDiskInformation ( 2! VmPhysicalContiguityInformation ' 9,
ImagePolicyEntryTypeAnsiString " � SystemPixelFormatR8G8B8X8 # � TP_CALLBACK_PRIORITY_COUNT 9 ThreadPriorityBoost $ ] 2 SystemRangeStartInformation �6 HANDEDNESS_RIGHT . �D AlpcMessageTokenModifiedIdInformation % � SysDbgRegisterForUmBreakInfo " ] E SystemHotpatchInformation S PowerSystemSleeping2 � SysDbgSetTracepoint F � EDIT_CONTROL_FEATURE_ENTERPRISE_DATA_PROTECTION_PASTE_SUPPORT � Z DPFLTR_STORMINIPORT_ID " ] M SystemModuleInformationEx ! B 9 ProcessWorkingSetControl 2 h FeatureConfigurationOperationVariantState � EventSecurityAddDACL " � TraceLbrConfigurationInfo $ � WorkerFactoryCallbackNormal u PNP_VetoLegacyDevice � CsvControlStopForceDFO � FpCodeLdexp 6 e WinBuiltinAccessControlAssistanceOperatorsSid / 2! VmVirtualMachinePrepopulateInformation ) � MonitorRequestReasonSxTransition F TokenType & POINTER_CHANGE_NONE � LdrModulesInitializing � EtwNotificationTypeMax � ImageSignaturePolicy # e FeatureEnabledStateDefault � � DPFLTR_TXF_ID ( � MonitorRequestReasonPowerButton @ AR_MULTIMON � V DPFLTR_TCPIP6_ID # FileCompressionInformation ' � + JobObjectReserved21Information � WnfInfoIsQuiescent % � ProcessMitigationOptionsMask � � DPFLTR_EXFAT_ID ( ] C SystemSessionPoolTagInformation + COR_VERSION_MAJOR_V2 � WnfDataScopeMachine } RtlResTypeMax ' � / JobObjectReserved25Information 2 ': ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN " + IMAGE_COR_EATJ_THUNK_SIZE � GEOCLASS_NATION ' & FileIdFullDirectoryInformation $ 9,
ImagePolicyEntryTypeMaximum ( ] � SystemIntegrityQuotaInformation 1 , CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK ! 9 ThreadBreakOnTermination ! PsAttributeMemoryReserve � # JobObjectCreateSilo ) B B ProcessDefaultCpuSetsInformation 9 ThreadAffinityMask * n WinAccountDefaultSystemManagedSid 6 OptionRetryCancel � IMDT_PEN �! FpRoundPlusInfinity & � LearningModeLogLevelNormalApc � TraceStackTracingInfo ) �
MonitorRequestReasonPolicyChange � MaxSuiteType T ThermalEvent �
SysDbgWriteControlSpace $ �? EtwCompressionModeNoRestart W MemoryCommandMax * SessionDisplayState & ProcThreadAttributeHandleList
WinAnonymousSid m FileCaseSensitiveInfo ! �; JournalClientInformation & $ LowMemoryResourceNotification � ToleranceLow F TokenImpersonationLevel @ AR_NOT_SUPPORTED A p DISPLAYCONFIG_DEVICE_INFO_GET_SUPPORT_VIRTUAL_RESOLUTION % ] � SystemKernelDebuggingAllowed " � EtwNotificationTypeEnable � SysDbgWritePhysical 5 ProcessorPerfStatesHv 9 ThreadIsIoPending �3 SC_ENUM_PROCESS_INFO ) �0 PoDisabledStateSleeping4Firmware 1 v CrossProcOperationMemoryProtectPreNotify �
TraceGroupQueryInfo % ] Q SystemFileCacheInformationEx LastSleepTime
" FEEDBACK_TOUCH_TAP � < DPFLTR_FDC_ID * � InternalWakeSourceDozeToHibernate & � MonitorRequestReasonPdcSignal . v CrossProcOperationMemoryFreePreNotify � FirmwareTypeBios - M# QUERY_FILE_LAYOUT_FILTER_TYPE_FILEID " ] 4 SystemVerifierThunkExtend �" PowerMonitorDim ! ] � SystemBadPageInformation $
RtlDiskSpacePolicyLow & �# WorkerFactoryBasicInformation � FpCodeLog , ProcThreadAttributeMitigationPolicy + 2 FileIdGlobalTxDirectoryInformation SystemPowerCapabilities ! 9, ImagePolicyEntryTypeInt8 ) ; PerfInfoDomainChangeEventMaximum / \ WinCapabilitySharedUserCertificatesSid � ��LdrModulesInitError - - PoHiberForceDisableReasonGuardedHost $ B K ProcessSubsystemInformation � � DPFLTR_FSLIB_ID �C PROXY_SENDRECEIVE � . DPFLTR_SIS_ID * 0 BootEntropySourceDisabledByPolicy & PlugPlayControlGetDeviceDepth % &E PowerRequestAwayModeRequired B SC_ACTION_REBOOT ( �% KeySetVirtualizationInformation & M PsEnergyComponentTypeAudioOut * B b ProcessFiberShadowStackAllocation � S DPFLTR_HPS_ID WinLocalSid !/ IMPORT_OBJECT_NAME * ] v SystemVerifierCountersInformation & �$ PsWakeReasonExecutionRequired / nD TOKEN_SECURITY_ATTRIBUTE_OPERATION_ADD M DisplayBurst ' � & JobObjectReserved16Information + NATIVE_TYPE_MAX_CB $ ] O SystemSuperfetchInformation ( MonitorCapabilities � DPFLTR_CDAUDIO_ID = _$
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EXTERNAL � ~ DPFLTR_COVERAGE_ID 6 OptionYesNoCancel /# MaxPlugEventCategory � SysDbgReadIoSpace �
ImageImageLoadPolicy ] � SystemEdidInformation # ] SystemProcessorInformation � ��LdrModulesUnloading � ProfileDcacheMisses �& COPYFILE2_CALLBACK_MAX # ProcessMemoryPriority " 9 ) ThreadActualGroupAffinity 3 ] � SystemCodeIntegrityPoliciesFullInformation ) PlugPlayControlRegisterNewDevice "
KHeteroCpuPolicyStaticMax ( W6 VirtualStorageBehaviorUndefined !/ IMPORT_OBJECT_ORDINAL " � UmsThreadInvalidInfoClass � 0 DPFLTR_WMICORE_ID b5 Win32ServiceOwnProcess ' � JobObjectReserved14Information = _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EMBEDDED �* CmResourceShareShared S PowerSystemSleeping1 + ^7 MaxSystemActivityModerationAppType # � CsvControlStopRedirectFile $ 0 BootEntropySourceNotPresent & �# WorkerFactoryAdjustThreadGoal $ a FileStorageTierMediaTypeSsd
" FEEDBACK_PEN_RIGHTTAP " ( GroupAffinityAllGroupZero � TraceGuidQueryInfo $ B C ProcessReserved2Information $ � EtwNotificationTypeReserved m FileBasicInfo
KHeteroCpuPolicyAll 3 4/ SystemFeatureConfigurationSectionTypeCount ! ] � SystemConsoleInformation % ProcThreadAttributeUmsThread - ; PerfInfoDomainChangeEventUserCallout P# PsAlwaysDuplicate B ProcessWorkingSetWatch ] m SystemStoreInformation 9 ThreadBasePriority F TokenOwner � SystemVaTypeMax 3 SystemHiberFileSize WinNtAuthoritySid F TokenPrivileges 3 + COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN G6 FixedWakeSourceRtc & ? PsProtectedSignerAuthenticode F 1 MaxTokenInfoClass RpcIncomingConnections $ � ProfileBranchMispredictions d( CpuSetInformation # � MmEtwWorkingSetTypeSession , �6 MemSectionExtendedParameterNumaNode 5 ] � SystemFeatureConfigurationSectionInformation 8 � ) MonitorRequestReasonPdcSignalWindowsMobileShell ' � JobObjectBackgroundInformation �) EtwActivityIdCreate A ` PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION . @ ComputerNamePhysicalDnsFullyQualified #
ProcThreadAttributeJobList ! � FileFsControlInformation A SystemHiberbootState + �F d RtlDiskWriteConstraintPolicyNormal �' BootLoad � Compatible � ProcessSignaturePolicy + COR_DELETED_NAME_LENGTH ] SystemVdmBopInformation & � ImagePayloadRestrictionPolicy + ] � SystemProcessorFeaturesInformation LockQueueUnusedSpare16 � M DPFLTR_IHVDRIVER_ID $ B ProcessPooledUsageAndLimits � b DPFLTR_VDSLDR_ID # �( IoSessionEventDisconnected � BootEntropySourceNone - ] � SystemSecureKernelProfileInformation & N ExitLatencySamplingPercentage i5 SC_EVENT_STATUS_CHANGE ' == POINTER_DEVICE_CURSOR_TYPE_TIP 9 UserPresence ! 0 BootEntropySourceSuccess - � MonitorRequestReasonRemoteConnection 9
ThreadZeroTlsCell ! �0 PoDisabledStateReserved5 !
PsAttributePreferredNode & ] � SystemBuildVersionInformation ! F + TokenSingletonAttributes � � DPFLTR_CAPIMG_ID �" MPSAConfiguration /! STUB_CALL_SERVER $ PlugPlayControlRetrieveDock " $ � @ AccessReasonOwnership �4 MemoryImageInformation ) ] f SystemDynamicTimeZoneInformation & �
FileFsMetadataSizeInformation ! � SystemVaTypeSessionSpace 0 =+ SystemProcessClassificationSecureSystem � ObjectTypeInformation � VrfSystemBIOSRuleClass � FpCodeUnspecified ) ` PS_MITIGATION_OPTION_ROP_SIMEXEC ThreadMemoryPriority Q WinConsoleLogonSid �+ PlatformRoleSOHOServer � FpCodeAdd * S WinApplicationPackageAuthoritySid ' "$ MonitorRequestTypeOnAndPresent ! WinCreatorGroupServerSid # ] SystemPagedPoolInformation 2 ] h SystemProcessorMicrocodeUpdateInformation 0 � JobObjectTimerVirtualizationInformation �1 FindStreamInfoStandard / B 5 ProcessDynamicFunctionTableInformation - PsAttributeSafeOpenPromptOriginClaim
SidTypeLabel � ProcessorInternal � FpCodeFloor & 9 KTMOBJECT_TRANSACTION_MANAGER / M WinNewEnterpriseReadonlyControllersSid ? a' FileInformationInAssemblyOfAssemblyInActivationContext � BackOffice = RPCHTTP_RS_ACCESS_2 � # DPFLTR_PNPMGR_ID $ a FileStorageTierMediaTypeMax B ProcessHandleTracing �9 MemoryExhaustionTypeMax % �D AlpcMessageHandleInformation � NUM_VRF_TRIAGE_CONTEXTS � HAL_MCE_RECORD ?" HiberFileBucketMax �/ PerfInfoMMStatMax ! F
TokenGroupsAndPrivileges 7 ProcessorSetIdle - _$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_LVDS k! VmOfferPriorityNormal . ProcessorInformationEx % FileAlternateNameInformation 1 ] | SystemQueryPerformanceCounterInformation F ' TokenSecurityAttributes ' � DynamicTickVetoClockConstraint � > DPFLTR_W32TIME_ID
� Vmcs %
" FEEDBACK_GESTURE_PRESSANDTAP %6 PT_MOUSE � MemExtendedParameterMax ' I MidlInterceptionInfoVersionOne A FileRenameInformationEx WinBuiltinPowerUsersSid % )? DPI_HOSTING_BEHAVIOR_DEFAULT * ] � SystemKernelDebuggerInformationEx � StorageReserveIdMax 2 MaxJournalChangeAction B
ProcessLdtInformation 1 ProcThreadAttributeMitigationAuditPolicy � ImagePolicyIdDebug + 1 FileNetworkPhysicalNameInformation � TableInsertAsLeft b5 AdapterType 0 h FeatureConfigurationOperationResetState 0 BootEntropySourceError " � VrfCodeIntegrityRuleClass * � JobObjectSecurityLimitInformation b5 FileSystemType $ ] � SystemSoftRebootInformation ( � MonitorRequestReasonGracePeriod 5 5* JOBOBJECT_IO_ATTRIBUTION_CONTROL_VALID_FLAGS 1 � TransactionManagerOnlineProbeInformation + PowerRequestCreate ) � TransactionManagerLogInformation # �
BootEntropySourceTcbRdrand $ � FileFsSectorSizeInformation �! FpRoundNearest �" EisaConfiguration % � FilterBootOptionOperationMax " B V ProcessEnclaveInformation 6 a' AssemblyDetailedInformationInActivationContxt � StorageReserveIdHard LockQueueMasterLock ) PlugPlayControlQueryConflictList # f/ DPI_AWARENESS_SYSTEM_AWARE 0 � ORIENTATION_PREFERENCE_PORTRAIT_FLIPPED # ] SystemCallCountInformation # P' USER_MARSHAL_CB_UNMARSHALL FileNameInformation � ImagePolicyIdDeviceId - MemoryReserveTypeMax ' ] SystemLoadGdiDriverInformation <* PoSleepDisableReasonMax " B + ProcessImageFileNameWin32 5 ` PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE + � ProcessExtensionPointDisablePolicy ) S# SeImageSignatureCatalogNotCached * ] A SystemLostDelayedWriteInformation F TokenElevation TpTraceThreadAffinity ! �( PsProtectedTypeProtected � WaitAny " 9 . ThreadDbgkWerReportActive ' ObjectIdType �4 CoverageSearchByHash $ P PsCreateFailMachineMismatch � $ SysDbgClearUmAttachPid B ProcessPriorityClass B ProcessTimes # F TokenVirtualizationAllowed o PerfInfoMemResetUndo & 3 FileIsRemoteDeviceInformation � MultiUserTS � ACPIBus # ` PS_MITIGATION_OPTION_SEHOP � FpCodeCeil $ ] � SystemDeviceDataInformation � W DPFLTR_ISAPNP_ID � � DPFLTR_CNG_ID % VerifyProcessorPowerPolicyDc �( PsProtectedTypeMax % � SecureSettingValueTypeString 7 nD TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL @ ComputerNameMax + ] � SystemVmGenerationCountInformation - �W JOB_OBJECT_NET_RATE_CONTROL_DSCP_TAG B g MaxProcessInfoClass ( WinAccountKrbtgtSid ) ] � SystemWriteConstraintInformation $ - ThreadWorkloadClassGraphics � g DPFLTR_DFSC_ID # +' LoadReasonStaticDependency / � JobObjectSchedulingRankBiasInformation $ J SubsystemInformationTypeWSL ToleranceIntervalMedium ' p' PMETypeFailFastOnCommitFailure 2! VmPrefetchInformation ) ] � SystemElamCertificateInformation 1 ] � SystemCriticalProcessErrorLogInformation ' <* PoSleepDisableReasonHypervisor � MaxPnpQueryRelations � EventSecurityMax $ KeyAdded / ] � SystemCombinePhysicalMemoryInformation " � ProfileBranchInstructions * � FeatureVariantPayloadKindResident 2 JournalDeleteValue � CacheData ] ; SystemComPlusPackage � U DPFLTR_LDR_ID �= MemoryLocationPagefile 8 � WorkerFactoryCallbackDetectedUnrecoverableError ProcessorPerfStates / \ SE_WS_APPX_SIGNATURE_ORIGIN_ENTERPRISE � FpCompareLess m FileDispositionInfoEx # � ProfileMemoryBarrierCycles � ProcessASLRPolicy . �( SystemMemoryPartitionInitialAddMemory �4 MemoryRegionInformation � SYSTEM_HANDLE_FILE - � TransactionManagerLogPathInformation 2 4/ SystemFeatureConfigurationSectionTypeBoot �* GetFileExMaxInfoLevel ( � DISPLAYCONFIG_TOPOLOGY_EXTERNAL " IoSessionStateMax " IoSessionStateLoggedOff " EventProviderSetReserved1 ( 8* DISPLAYCONFIG_PIXELFORMAT_16BPP 3 �? DISPLAYCONFIG_MODE_INFO_TYPE_DESKTOP_IMAGE m FileStreamInfo �' RtlBsdItemAabEnabled ) 9 WinBuiltinPerfMonitoringUsersSid % u PNP_VetoIllegalDeviceRequest 0 � * MonitorRequestReasonPdcSignalHeyCortana & � FeatureVariantPayloadKindNone � � DPFLTR_DRIVEEXTENDER_ID �= MemoryLocationReserved [ MemoryRegionInfo � PerfCSwapFull $ M RtlSparseBitmapOperationMax - ] � SystemActivityModerationUserSettings , a FileStorageTierMediaTypeUnspecified � % DPFLTR_SCSERVER_ID K PlatformRole - ] SystemScrubPhysicalMemoryInformation � + ReservedForDVRF43
SidTypeComputer ! B 3 ProcessHandleInformation /
PlugPlayControlGetInterfaceDeviceAlias ! �$ PsWakeReasonWorkOnBehalf � 9 DPFLTR_IDEP_ID . g WinAuthenticationAuthorityAssertedSid � WaitDequeue $ B Z ProcessDebugAuthInformation � KeyNodeInformation � LdrModulesReadyToRun ^"
WdActionMarkHiberPhase FileInternalInformation " 2! VmPagePriorityInformation $ ] \ SystemVerifierInformationEx % G FileCaseSensitiveInformation " � VrfAdditionalDDIRuleClass S PowerSystemHibernate + ] � SystemDifClearRuleClassInformation � FpCodeCabs " F WinWriteRestrictedCodeSid #
" EtwProviderTraitDecodeGuid # ] � SystemFwRamdiskInformation FileLinkInformation , ` PS_MITIGATION_OPTION_BOTTOM_UP_ASLR ; � ( MonitorRequestReasonPdcSignalWindowsMobilePwrNotif ! 2 JournalCommitTransaction � VrfAdvancedMMRuleClass " � $ VrfStandalonePlatformMode $ * COPYFILE2_PHASE_SERVER_COPY & LdrpWebDAV ! ] F SystemObjectSecurityMode + �( SystemMemoryPartitionSetAttributes ? PsProtectedSignerNone � PNPBus ! + IMAGE_COR_MIH_BASICBLOCK
WinBatchSid 6 ProcessorPerfCapHv � ImagePolicyIdSvn LockQueueIoCancelLock $ # FileAttributeTagInformation ) � EtwNotificationTypePrivateLogger B ProcessPriorityBoost ! TransactionStateNormal # ] SystemInterruptInformation 1 � EtwNotificationTypeFilteredPrivateLogger * FpFormatFp32 � BackTraceDatabaseFlush � MPSABus + � MonitorRequestReasonThermalStandby � SysDbgWriteBusData * * COPYFILE2_PHASE_WRITE_DESTINATION � ) DPFLTR_UHCD_ID � �� l
t __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUrDIGUkivxlnkOlyq@elfapi # H$ _KEY_VALUE_INFORMATION_CLASS ~G WMI_PROCESS_INFORMATION64 $ ^ PHEAP_AFFINITY_MANAGER_ENABLE * �B _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 * �4 _SYSTEM_KERNEL_DEBUGGER_INFORMATION ' �] PCACTIVATION_CONTEXT_QUERY_INDEX K B[ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL u UINT 4 MENUITEMINFO �7 ALTTABINFO �] PSYSDBG_LIVEDUMP_CONTROL �] PXSAVE_FORMAT � ENUM_SERVICE_STATUSW �] PGENERIC_MAPPING 7 ' _RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY ! 'B _RTL_UNICODE_STRING_BUFFER "8 HARDWARE_COUNTER_DATA �] ANON_OBJECT_HEADER_BIGOBJ + �/ PERFINFO_YIELD_PROCESSOR_INFORMATION ( �] PSYSTEM_ALARM_CALLBACK_OBJECT_ACE � _SE_AUDIT_OPERATION - �] PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX �] PFILE_ID_TYPE + PMOUSEHOOKSTRUCT � TIMEFMT_ENUMPROCA ! == POINTER_DEVICE_CURSOR_TYPE �] PFILE_PIPE_PEEK_BUFFER �] HKEY � LPCDLGTEMPLATEA & EVENT_HEADER_EXTENDED_DATA_ITEM PRTL_REFERENCE_COUNT32 �] PFP_128 , �W _SYSTEM_BASIC_PERFORMANCE_INFORMATION �] RTL_AVL_FREE_ROUTINE
AUDIT_EVENT_TYPE ( �7 LOOKUP_STREAM_FROM_CLUSTER_OUTPUT �5 HOT_PATCH_IMAGE_INFO Y@ PTPP_START_ROUTINE �] LPENUMLOGFONTA FT WCRANGE ) �] PACCESS_DENIED_CALLBACK_OBJECT_ACE 7 �] PIMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION � ALPC_PORT_ATTRIBUTES . iG _DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE tagMOUSEMOVEPOINT �] PINPUT_INJECTION_VALUE % �= _MANAGE_HOT_PATCH_UNLOAD_PATCH , PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA # _QUERY_STORAGE_RESERVE_INPUT �] PFILE_COMPRESSION_INFO �] NPWNDCLASSEX ! qS _ETW_THREAD_AFFINITY_EVENT ' �] PPUBLIC_OBJECT_BASIC_INFORMATION �] PIPT_TRACE_EVENT_DATA O% PCUZZWSTR / �: _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE $ �] PSYSTEM_HANDLE_INFORMATION_EX 0 _Wx86ThreadState 9S _FILE_PIPE_INFORMATION �6 _QUOTA_LIMITS $ �] PSYSTEM_NET_RATE_CONTROL_TYPE �] WAITORTIMERCALLBACKFUNC A DESIGNVECTOR " PLOGICAL �] PVRF_RULE_CLASS_ID �] DISPLAYCONFIG_RATIONAL "F _ETW_HEAP_EVENT_SNAPSHOT �9 IMAGE_ENCLAVE_IMPORT 4 G+ _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION 2 tagMETAHEADER 0 � tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION " PLCID ' ] SYSTEM_BOOT_GRAPHICS_INFORMATION ( �V RTL_DYNAMIC_TIME_ZONE_INFORMATION � _TRIVERTEX �W _PERFINFO_CC_FLUSH_CACHE �5 LPTEXTMETRICW N5 _WNF_STATE_NAME
PPVOID �- _DEDUP_FILE_OPERATION �] PETW_SET_MARK_INFORMATION ! #4 CS_TYPE_LOCAL_SIZE_ROUTINE � MUTANT_BASIC_INFORMATION K' MENUBARINFO �( PS_PROTECTED_TYPE �] PPLEX_READ_DATA_REQUEST ! �] PSYSTEM_HANDLE_INFORMATION kT KEY_NAME_INFORMATION / �Q JOURNAL_TRANSACTION_BOUNDARY_INFORMATION " � _RTL_HEAP_MEMORY_LIMIT_INFO E& RTL_HANDLE_TABLE_ENTRY �B ENCRYPTION_BUFFER & 0 _SYSTEM_PAGEFILE_INFORMATION_EX * � _SYSTEM_VERIFIER_TRIAGE_INFORMATION / WMI_QUEUE + � _PROCESS_HANDLE_SNAPSHOT_INFORMATION �R PROCESS_INFORMATION �] ENUMRESNAMEPROCA PEMRSETBKMODE p PTCH + FA JOBOBJECT_EXTENDED_LIMIT_INFORMATION z9 _PROCESSOR_IDLE_STATE �] LPDISPLAY_DEVICE �] PRPC_INTERFACE_TEMPLATEA
! FSHORT PSECURITY_DESCRIPTOR ; X _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION # ~, REFS_DEALLOCATE_RANGES_RANGE S EVENT_FILTER_LEVEL_KW - rB PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE 2 f9 _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION ! OSVERSIONINFO PLANGSPEC KX _MUILANGLIST # q7 LPPROC_THREAD_ATTRIBUTE_LIST " FLONG � DUPLICATE_EXTENTS_DATA , �= _CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT �] PKEY_TRUST_INFORMATION $ �] PCM_DISK_GEOMETRY_DEVICE_DATA �] PTP_WAIT / ?C _PROCESS_READWRITEVM_LOGGING_INFORMATION e _RTL_HEAP_ENTRY " �] PEMRCREATEDIBPATTERNBRUSHPT �] PIMAGE_OS2_HEADER # �] PKEY_HANDLE_TAGS_INFORMATION + 6< CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 % �] PCOMPATIBILITY_CONTEXT_ELEMENT �. _RPC_SECURITY_QOS_V4_W �] PETW_TP_EVENT_TIMER_SET n[ RETRIEVAL_POINTER_BASE �] PRID_DEVICE_INFO_HID ! [+ tagINPUT_MESSAGE_ORIGIN_ID �] PIMAGE_DOS_HEADER T] IMAGE_OS2_HEADER �] LPCONNECTDLGSTRUCT
KHETERO_CPU_POLICY �C EMRSTROKEPATH � _TP_CALLBACK_PRIORITY R6 TP_WAIT �] LPSHELLHOOKINFO $ � ETW_CREATEDELETE_OBJECT_EVENT
q NWPSTR n[ _RETRIEVAL_POINTER_BASE �] PSYSTEM_ALARM_OBJECT_ACE // LPOSVERSIONINFOW 69 VIDEO_RECORD T] _IMAGE_OS2_HEADER ( LPPATTERN u- PEMRPOLYLINE U ICONMETRICSW $ !B _PERFINFO_CC_WORKITEM_DEQUEUE * �] PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER i _SECTION_INHERIT ( �] PCREDIRECTION_FUNCTION_DESCRIPTOR �] PSERVICE_NOTIFY_2W $ �] PETW_COVERAGE_SAMPLER_OPTIONS �] PRTLP_START_THREAD �X _LDR_IMPORT_CALLBACK_INFO �U _SECURITY_SEED_AND_LENGTH " �0 _PROCESS_WINDOW_INFORMATION �X LPWNDCLASSEXA ! �] LPSERVICE_FAILURE_ACTIONSA . �] PPLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA � OUTLINETEXTMETRIC 2 �, JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 3 V0 SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION �/ LPCONTEXT ' EVENT_TRACE_SPINLOCK_INFORMATION �] PSYSTEM_VDM_INSTEMUL_INFO S NPEXTLOGFONTA >; _MMPFN_IDENTITY ) �] PACTIVATION_CONTEXT_NOTIFY_ROUTINE �] HICON & �] PPROCESS_POWER_THROTTLING_STATE * ;U _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY & FILE_FS_DRIVER_PATH_INFORMATION ' �] DISPLAYCONFIG_DESKTOP_IMAGE_INFO + �. SERVICE_CONTROL_STATUS_REASON_PARAMS �] PMESSAGE_TRACE_HEADER �F _cpinfoexA �Z _WMI_WAIT_OBJECT_RECORD �] PKINTERRUPT_ROUTINE : _RTL_DYNAMIC_HASH_TABLE 0 LPICONMETRICSA $ STYLEBUFA ^" _WATCHDOG_HANDLER_ACTION ' �[ RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR " HANDLE_PTR �T _RTL_MODULE_EXTENDED_INFO 3 oE SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE �] PHKEY h0 LPPROCESS_HEAP_ENTRY 5 �] PPROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY �4 EISA_MEMORY_CONFIGURATION G0 OBJECT_TYPE_LIST ) �Z _SYSTEM_PREFETCH_PATCH_INFORMATION ) �] PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR - J5 SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 % �] PSYSTEM_OBJECTTYPE_INFORMATION �5 tagTITLEBARINFO ! _STRING64 �A _PROCESS_PRIORITY_CLASS � _MCA_EXCEPTION �@ NPSTYLEBUFW �] PRTL_AVL_MATCH_FUNCTION ' � _PERFINFO_SAMPLED_PROFILE_CONFIG e" _SECURITY_DESCRIPTOR & �D _ALPC_MESSAGE_INFORMATION_CLASS �! _FILE_STREAM_INFORMATION �& TRACE_LOGFILE_HEADER32
p PSZ �] PETW_OBJECT_TYPE_EVENT �] PSID_IDENTIFIER_AUTHORITY ' �4 LOOKUP_STREAM_FROM_CLUSTER_INPUT @U _KTMOBJECT_CURSOR % �Y RTL_USER_PROCESS_INFORMATION64 " GEOTYPE fE _CONSOLE_CURSOR_INFO " @ PERFINFO_DEBUG_EVENT_REASON �, _CM_MONITOR_DEVICE_DATA ! �] PPERFINFO_MARK_INFORMATION �( IO_SESSION_EVENT �- HW_PROFILE_INFO �] PTHREAD_BASIC_INFORMATION | _DESCRIPTOR_TABLE_ENTRY ) � SYSTEM_VERIFIER_TRIAGE_INFORMATION �, SYSTEMTIME ) @F _WIM_PROVIDER_REMOVE_OVERLAY_INPUT �] PSL_HWID_DEVICE_INFO � CRITICAL_SECTION_DEBUG �] PISID � WIN32_FIND_DATA �' PEMRPOLYLINE16 �] PMUILANGLISTNODE �] PTRACE_GUID_REGISTRATION �] PMESSAGE_TRACE ! �] PEMREXTCREATEFONTINDIRECTW �] PEVENT_DATA_DESCRIPTOR % �] PPROCESS_DEVICEMAP_INFORMATION / + _PROCESS_REVOKE_FILE_HANDLES_INFORMATION �] PVRF_TRIAGE_CONTEXT ? ACTCTXA �] PETW_HEAP_EVENT_COMMON �6 PCONTEXT . �] PFILE_DESIRED_STORAGE_CLASS_INFORMATION SG PLUGPLAY_NOTIFY_HDR �] POSVERSIONINFO �' EMRPOLYBEZIERTO16 /% PERFINFO_CCSWAP_IDLE V DISPATCHER_CONTEXT_ARM64 �[ _FILE_STORAGE_TIER A �\ _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC �] LPLC_ID ) ;U IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY �] PFIND_BY_SID_OUTPUT - ND STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST �] PRTL_DYNAMIC_HASH_TABLE �) NPPOLYTEXTA * �! _RTL_ACTIVATION_CONTEXT_STACK_FRAME " �Q _ADMINISTRATOR_POWER_POLICY . �] PMEMORY_PARTITION_ATTRIBUTE_INFORMATION $ �] PTRACE_ENABLE_FLAG_EXT_HEADER �> _BOOT_AREA_INFO &+ LPPOWER_REQUEST_CONTEXT 4 �G _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE " �< CLAIM_SECURITY_ATTRIBUTE_V1 $ �! SYSTEM_FIRMWARE_TABLE_HANDLER �] PIO_RESOURCE_DESCRIPTOR �1 LPGLYPHMETRICSFLOAT � STREAM_EXTENT_ENTRY ! �@ _TXFS_QUERY_RM_INFORMATION � _JOBOBJECTINFOCLASS �] PPERFORMANCE_DATA % �] PFILE_FS_ATTRIBUTE_INFORMATION � _COMMTIMEOUTS $ %& _FILE_ID_FULL_DIR_INFORMATION SHANDLE_PTR �] PKLDR_DATA_TABLE_ENTRY !U STARTUPINFOEX 0 �] PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE A] HPALETTE__ � WIN32_FIND_DATAA (X VALENTW % �$ _SERVICE_LAUNCH_PROTECTED_INFO �] POBJECT_ATTRIBUTES32 KIRQL ! �B JOURNAL_CLIENT_INFORMATION �] WNDPROC �7 _IMAGE_AUX_SYMBOL_EX - �] PJOBOBJECT_LIMIT_VIOLATION_INFORMATION * sD _SYSTEM_PROCESSOR_POWER_INFORMATION ! vT _RTL_TIME_ZONE_INFORMATION �# _ETW_UMGL_KEY �C PWINDOWPOS " _TRACE_LOGFILE_HEADER64 �] PCACCESS_MASK �] PSD_ENUM_SDS_ENTRY M* REPARSE_GUID_DATA_BUFFER ; �] PRTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY Z LPBITMAPFILEHEADER " �] PETW_TIMER_EXPIRATION_EVENT $ � ETW_SESSION_NOTIFICATION_TYPE & ZY _FSCTL_QUERY_REGION_INFO_OUTPUT MY _SYSDBG_TRIAGE_DUMP " �= RTL_IMAGE_MITIGATION_POLICY �U _PERFINFO_MARK_EVENT �> LUID_AND_ATTRIBUTES_ARRAY . �] PMEMORY_PARTITION_NODE_PAGE_INFORMATION % �] PKEY_VALUE_PARTIAL_INFORMATION �, LPOSVERSIONINFOEX2W G �- _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING " �] PCACTCTX_SECTION_KEYED_DATA _5 WMI_PNP_RECORD_V4 $ C@ _SILOOBJECT_BASIC_INFORMATION �] LPMEMORYSTATUSEX �] PRPC_SEC_CONTEXT_KEY_INFO ) B _RESOURCEMANAGER_INFORMATION_CLASS + MDINEXTMENU " �Y ETW_COVERAGE_SAMPLER_STATUS �] PCACTCTXW * �T SYSTEM_FEATURE_CONFIGURATION_UPDATE y' OFSTRUCT b _OVERLAPPED_ENTRY �& HELPWININFOW �F MUIREGISTRYINFO & 0= _ACTIVATION_CONTEXT_QUERY_INDEX � _WMI_THREAD_INFORMATION 0 �] PIMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER G/ EMRTRANSPARENTBLT �\ LPHARDWAREINPUT �] PCOVERAGE_MODULE_INFO �] PRTL_SPARSE_BITMAP_RANGE ) �] PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT ] PEMRTRANSPARENTBLT ( tagMEASUREITEMSTRUCT , � _EVENT_TRACE_PROFILE_LIST_INFORMATION $ A9 _SYSTEM_TIMEOFDAY_INFORMATION % ~] PNTPSS_MEMORY_BULK_INFORMATION " POINTER_INPUT_TYPE �V PAGEDIR_INFORMATION ) }] PEVENT_EXTENDED_ITEM_STACK_TRACE64 |] PHEAP_SUMMARY ! V PS_BNO_ISOLATION_PARAMETER ' ^: REMOTE_LINK_TRACKING_INFORMATION {] PPO_WAKE_SOURCE_DEVICE �+ _POWER_PLATFORM_ROLE �C PORT_INFORMATION_CLASS �! LPPAINTSTRUCT ' T _PROCESS_LEAP_SECOND_INFORMATION 2 z] PPROCESS_MITIGATION_BINARY_SIGNATURE_POLICY V SUPPORTED_OS_INFO - _MEMORY_RESERVE_TYPE 0 y] PJOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 jU _REPARSE_INDEX_KEY ) x] PRTL_FEATURE_ENABLED_STATE_OPTIONS �. CI_WINDOWS_LOCKDOWN_MODE $ �Y FILE_FS_ATTRIBUTE_INFORMATION � tagENUMLOGFONTW ( ] _SYSTEM_BOOT_GRAPHICS_INFORMATION ( w] PEVENT_EXTENDED_ITEM_PMC_COUNTERS " v] PPERFINFO_IDLE_STATE_CHANGE D Q! _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED �# tagLOCALESIGNATURE ; PLOGPALETTE 81 MINMAXINFO � IMEMENUITEMINFOA handle_t 4 � _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION k" PERFINFO_CCSWAP_BUFFER u] PCSV_MGMT_LOCK 1 GD _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX ( t] PRTL_FEATURE_CONFIGURATION_UPDATE s] PMCA_EXCEPTION r] PRTL_HASH_TABLE �; tagEMRFILLRGN $ BS FILE_FS_FULL_SIZE_INFORMATION $ V PERFINFO_SET_POWER_ACTION_RET �A MUILANGINFO $ 8V PROCESS_MITIGATION_DEP_POLICY �% THREAD_ENERGY_VALUES ' �R _FILE_END_OF_FILE_INFORMATION_EX \R _PORT_VIEW � PBITMAPCOREHEADER FIBER 1 q] PPLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED � TABLE_SEARCH_RESULT ) �/ SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT p] PRTL_RVA_LIST �& RTL_CRITICAL_SECTION ' <: _HEAP_BLOCK_SETTABLE_INFORMATION o] LPENCLAVE_ROUTINE M\ PPALETTEENTRY " � _BY_HANDLE_FILE_INFORMATION �T BLENDFUNCTION n] NOTIFICATIONCALLBACK j] HWINSTA � tagENHMETAHEADER ^% _SYSTEM_POOL_ENTRY ' i] PCACTCTX_SECTION_KEYED_DATA_2600 RPC_SECURITY_QOS_V2_W g] LPSTYLEBUF f] PIMAGE_DEBUG_MISC $ h _SYSTEM_NET_RATE_CONTROL_TYPE j DIBSECTION ' < _PROCESS_HANDLE_TABLE_ENTRY_INFO e] LPCOMMCONFIG d] PEMRALPHABLEND �U MONITORINFOEXW * �Q _PROCESS_EXTENDED_BASIC_INFORMATION % � _TRANSACTION_BASIC_INFORMATION c] LPAXESLIST b] EXCEPTION_ROUTINE a] PTP_LOG_ROUTINE u DWORD32 " @Z ENCLAVE_INIT_INFO_VBS_BASIC 8 ^] PASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_ROUTINE 09 tagBITMAP F9 TRACKMOUSEEVENT � _MIDL_METHOD_PROPERTY # �/ FILE_SFIO_VOLUME_INFORMATION Z] PKTMOBJECT_TYPE + �: _EVENT_TRACE_PERFORMANCE_INFORMATION B _PROCESSINFOCLASS ' _PROCESS_EXCEPTION_PORT /E ETW_HEAP_EVENT_FREE _PORT_MESSAGE ) Y] PSYSTEM_POWER_STATE_DISABLE_REASON , I SYSTEM_PROCESSOR_FEATURES_INFORMATION ) �. _SYSTEM_PROCESSOR_IDLE_INFORMATION S PEXTLOGFONTA X] LANGGROUPLOCALE_ENUMPROCW �2 _ACL ) � PERFINFO_FILENAME_SAME_INFORMATION R] PUIMAGE_OS2_HEADER / c6 _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION �? PEMRABORTPATH % �F _IMAGE_LOAD_CONFIG_DIRECTORY64 # _OBJECT_NAME_INFORMATION �* _RTL_BITMAP ) R CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG % � _TRANSACTION_INFORMATION_CLASS �D tagHW_PROFILE_INFOW P] PEMRPOLYDRAW16 O] LPCDLGTEMPLATE N] PCSV_QUERY_MDS_PATH ^Y PMSGBOXPARAMSW " � _PERFINFO_CCSWAP_IDLE_SHORT M] PWMI_TRACE_PACKET # L] PTOKEN_SECURITY_ATTRIBUTE_V1 �4 _HARDERROR_MSG �! FP_IEEE_ROUNDING_MODE d( CPU_SET_INFORMATION_TYPE K] PEVENTSFORLOGFILE J] LPCLIENTCREATESTRUCT + 4U JOBOBJECT_IO_ATTRIBUTION_INFORMATION �? _RTL_HEAP_INFORMATION & , PUBLIC_OBJECT_BASIC_INFORMATION ( I] PDELAYLOAD_FAILURE_SYSTEM_ROUTINE + F] PCSV_QUERY_FILE_REVISION_FILE_ID_128 E] PGESTUREINFO :* PEXTLOGPEN32 o TEB_ACTIVE_FRAME �+ _CM_PARTIAL_RESOURCE_LIST " D] RTL_GENERIC_COMPARE_ROUTINE �, _FINDEX_INFO_LEVELS @ RTL_RXACT_CONTEXT # C] PETW_COVERAGE_SAMPLER_SAMPLE �2 _SYSTEM_ALARM_ACE �/ ENUMLOGFONTEXDVW ?] HPALETTE ' _ICONINFOEXW - 1S _FILE_FS_PERSISTENT_VOLUME_INFORMATION �U PEMRRECTANGLE \R PORT_VIEW # �= _RTL_IMAGE_MITIGATION_POLICY ' _FILE_ID_TYPE X" tagENUMTEXTMETRICW =] PWNODE_METHOD_ITEM ! = _RPC_HTTP_REDIRECTOR_STAGE <] PAUDIT_EVENT_TYPE �= CM_EXTENDED_PARAMETER ;] PLOAD_ASDATA_TABLE :] PEXCEPTION_RECORD32 ' 9] PFILE_END_OF_FILE_INFORMATION_EX \ PSE_TOKEN_USER > _UNICODE_STRING 5Z PEMREXCLUDECLIPRECT " 8] PPPM_PERFSTATE_DOMAIN_EVENT k$ APPCONTAINER_SID_TYPE 7] LPCMENUITEMINFO �A CI_LOG_MMCSS_START b tagGESTURENOTIFYSTRUCT �: EVENT_INSTANCE_HEADER �: FILE_LAYOUT_NAME_ENTRY 6] PTP_TASK_CALLBACKS � ETW_BUFFER_STATE gS IMAGE_IMPORT_BY_NAME �[ _NON_PAGED_DEBUG_INFO " SAVEPOINT_ID � tagRAWMOUSE * � RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W F _CI_LOG_SCHEDULER_WAKEUP �/ tagNCCALCSIZE_PARAMS �Z WMI_WAIT_OBJECT_RECORD = _SYSTEM_VERIFIER_ISSUE � WIN32_FIND_DATAW 5] LPTTPOLYCURVE 4] PKEY_EVENT_RECORD lV TOKEN_LINKED_TOKEN " � _POWER_PLATFORM_INFORMATION 4 C SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION &\ STUB_THUNK 'T tagINPUT_MESSAGE_SOURCE ? _SYSTEM_BASIC_INFORMATION �? PEMRENDPATH u; _COVERAGE_SECTION_HEADER ! ^B tagTOUCH_HIT_TESTING_INPUT POOLINDEX _5 _WMI_PNP_RECORD_V4 5 _SYSTEM_NUMA_INFORMATION m FILE_INFO_BY_HANDLE_CLASS � TRIVERTEX 3] PEMRSETWORLDTRANSFORM 1 _ETW_STACK_CACHING_CONFIG 2] PTOKEN_ELEVATION_TYPE �T _TOKEN_PRIVILEGES 1] PFAT_STATISTICS
�' PPOINT H8 _POINTFLOAT V* tagDRAWITEMSTRUCT 3 K@ _IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION 0] PWNF_DELIVERY_DESCRIPTOR & /] PPROCESS_EXTENDED_ENERGY_VALUES ( | RTL_FEATURE_ENABLED_STATE_OPTIONS *Y PIMEMENUITEMINFOW �: TIMEFMT_ENUMPROCEX # .] PETW_KERNEL_HEADER_EXTENSION ) �A _SYSTEM_ENTROPY_TIMING_INFORMATION �> PDLGITEMTEMPLATEW �@ PSTYLEBUFW �% CSV_QUERY_REDIRECT_STATE " Y RTL_ALLOCATE_STRING_ROUTINE -] LPNETINFOSTRUCT Z _RGNDATAHEADER CD LPNONCLIENTMETRICSA �T ETW_WNF_EVENT_PUBLISH ! x@ _WIN32_FILE_ATTRIBUTE_DATA ,] SC_HANDLE $ B _WIM_PROVIDER_START_INTEGRITY �4 NPWNDCLASSA FW _TOKEN_CONTROL $ +] RTL_UMS_SCHEDULER_ENTRY_POINT ? EVENT_TRACE $ �6 RPC_BINDING_HANDLE_OPTIONS_V1 " >% ACCESS_ALLOWED_CALLBACK_ACE �G TOKEN_PRIMARY_GROUP ' �3 FILE_REMOTE_PROTOCOL_INFORMATION z _SYSTEM_POWER_POLICY � SYSTEM_VA_TYPE / v JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V1 &3 _FILE_REGION_OUTPUT *] PIRQ_GROUP_POLICY R tagEMRRESIZEPALETTE . )] PEVENT_EXTENDED_ITEM_RELATED_ACTIVITYID ! (] PPROCESS_BASIC_INFORMATION '] PFILE_FULL_EA_INFORMATION �" WMI_BUFFER_HEADER / 5S _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA - &] PCACTIVATION_CONTEXT_BASIC_INFORMATION �< tagCBT_CREATEWNDA RPC_BINDING_HANDLE $ $] PPERFINFO_PAGE_RANGE_IDENTITY #] PLDT_ENTRY "] PHIBERFILE_BUCKET_SIZE + MOUSEHOOKSTRUCT �T WNF_DELIVERY_DESCRIPTOR �A _IMAGE_FUNCTION_ENTRY64 $ !] PCONSOLE_SCREEN_BUFFER_INFOEX J# tagWNODE_TOO_SMALL , ] PSYSTEM_HYPERVISOR_DETAIL_INFORMATION I KCRM_PROTOCOL_BLOB �' EMRPOLYGON16 �, _SYSTEMTIME � EVENT_RECORD ( �4 EVENT_TRACE_IPT_EVENT_INFORMATION ] PENCLAVE_INIT_INFO_VBS ] PRPC_SECURITY_QOS_V3_A �Z _WMI_RESOURCE $ ] PDEFINE_STORAGE_RESERVE_INPUT $ � _SharedVirtualDiskHandleState �) FAT_STATISTICS �& LPCRITICAL_SECTION_DEBUG ] PMIDL_STUB_DESC LRESULT � tagENUMLOGFONTEXDVA �< EMREXTCREATEPEN I= PS_CPU_QUOTA_QUERY_ENTRY P# PS_STD_HANDLE_STATE ] PEMREXTSELECTCLIPRGN ! <R _KEY_SET_LAYER_INFORMATION # ] PBAD_MEMORY_CALLBACK_ROUTINE *2 tagCIEXYZ E tagPOLYTEXTW ] PUSAGE_PROPERTIES Z GROUP_RELATIONSHIP �5 _SYSTEM_PREFETCH_STATS ] LPNLSVERSIONINFO �F _DECRYPTION_STATUS_BUFFER ] PARM64_NT_CONTEXT ] PPOWER_MONITOR_INVOCATION $ ] PETW_TP_EVENT_TIMER_CANCELLED )E MALLOC_FREE_STRUCT ) ] PEVENT_EXTENDED_ITEM_STACK_TRACE32 * ] PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX �X PFN_NT_COMMIT_TRANSACTION s2 CBT_CREATEWNDW <B LDR_DATA_TABLE_ENTRY32 " J _SUBSYSTEM_INFORMATION_TYPE ] PREQUESTER_TYPE 2X PLOGBRUSH32 ) CV _STREAMS_ASSOCIATE_ID_INPUT_BUFFER . ] PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS �$ _XSTATE_FEATURE 3 !# SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION " =G I_RpcProxyCallbackInterface _LUTF8_STRING % r- COVERAGE_UNLOADED_MODULE_ENTRY ] PWMIREGINFOW RTL_CIRCULAR_LIST_ENTRY $ �3 _ETW_UMS_EVENT_CONTEXT_SWITCH , �+ _JOURNAL_SET_KEY_SECURITY_INFORMATION ] PIMAGE_EXPORT_DIRECTORY % �? SYSTEM_CPU_SET_TAG_INFORMATION INT64 ' �R RTL_IMAGE_MITIGATION_HEAP_POLICY ,
] PEVENT_TRACE_HEAP_TRACING_INFORMATION �G ALPC_SERVER_INFORMATION I k@ ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING K' tagMENUBARINFO F% PCOMPOSITIONFORM / �' IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER \$ _RTL_AVL_TABLE # �? _COMPOUND_ACCESS_ALLOWED_ACE / �* _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 - � SECURE_SPECULATION_CONTROL_INFORMATION �4 CREATE_THREAD_DEBUG_INFO �F HENHMETAFILE__ R9 WMI_DISKIO_FLUSH_BUFFERS �8 PROCESS_JOB_MEMORY_INFO " � IMAGE_ARCHIVE_MEMBER_HEADER ] PLUID_AND_ATTRIBUTES U _CSV_MGMT_LOCK . � _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA $ �Q _PROCESS_AFFINITY_UPDATE_MODE ] PBULK_SECURITY_TEST_DATA 1 G4 _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY ( �A SYSTEM_ENTROPY_TIMING_INFORMATION )
] PPROCESS_CHILD_PROCESS_INFORMATION ", LPLOGPEN % ] PIMAGE_DYNAMIC_RELOCATION64_V2 �3 _PATHNAME_BUFFER " :% _UNIQUE_PROCESS_INFORMATION & �> _FILE_PIPE_CREATE_SYMLINK_INPUT �\ PEMRDRAWESCAPE ( ] PRPC_BINDING_HANDLE_TEMPLATE_V1_W ] PWMI_IMAGEID_INFORMATION & PSECURITY_CONTEXT_TRACKING_MODE ' �( _QUERY_PERFORMANCE_COUNTER_FLAGS ( ] PSYSTEM_BOOT_GRAPHICS_INFORMATION " ] PRTL_QUERY_REGISTRY_ROUTINE # PPOINTS 81 tagMINMAXINFO LSTATUS �V POWER_SESSION_CONNECT ! ] PTP_TASK_UNPOSTED_CALLBACK A tagDESIGNVECTOR # BT _FILE_FS_CONTROL_INFORMATION A �\ PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC ' �> EVENT_EXTENDED_ITEM_PMC_COUNTERS �\ PREMOTE_PORT_VIEW EMRSETTEXTALIGN � _WMI_UDP % �8 _ETW_TP_EVENT_TIMER_EXPIRATION # D PERFINFO_DOMAIN_CHANGE_EVENT " KSPIN_LOCK � ENUMLOGFONTEXDVA ) �R _FILE_PIPE_EVENT_ENUM_INPUT_BUFFER �V SL_KMEM_CACHE �\ RPC_IF_CALLBACK_FN �C _LBR_TRACE_EVENT_DATA �\ PPEB $ �\ PTRANSACTION_LIST_INFORMATION �Z _XSAVE_FORMAT ! �W FILE_ZERO_DATA_INFORMATION &= tagENUMUILANG OB tagEMRALPHABLEND ! @* _HEAP_AFFINITY_SLOT_ASSIGN �U PERFINFO_MARK_EVENT XW USAGE_PROPERTIES �\ LPNUMBERFMTA > _MEMORY_BASIC_INFORMATION �+ _SERVICE_NOTIFY_2A " �? ETW_KERNEL_HEADER_EXTENSION �\ PPS_PROTECTED_TYPE �0 IMAGE_FILE_HEADER Z GENERIC_MAPPING � JOBOBJECTINFOCLASS � _SERVERSILO_STATE �\ PPPM_WMI_IDLE_STATES_EX & C/ _ETW_AUTOBOOST_NO_ENTRIES_EVENT �: _KAFFINITY_EX % �\ PPROCESS_FOREGROUND_BACKGROUND { PROCESS_DISK_COUNTERS X _FILE_REFERENCE_RANGE OU PS_STD_HANDLE_INFO yU GLYPHMETRICS y DEBUGHOOKINFO �\ PSYSTEM_TPM_INFORMATION �\ PENABLE_TRACE_PARAMETERS �B FILE_OBJECTID_INFORMATION & �\ PSYSTEM_HANDLE_TABLE_ENTRY_INFO 2 � TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT " D; _JOBOBJECT_WAKE_INFORMATION $ �\ PRTL_RETPOLINE_CHECK_FUNCTION 3 , PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION $ �\ PRTLP_HEAP_SERIALIZED_MAPPING w= PSFEATURE_OUTPUT J( CREATESTRUCTW �\ GEO_ENUMNAMEPROC �\ PETW_REGNOTIF_REGISTER ! �\ PETW_IDEAL_PROCESSOR_EVENT : PERFINFO_PROCESS_PERFCTR �\ LPSTARTUPINFOEXA � PFN_SC_NOTIFY_CALLBACK �6 tagTTPOLYCURVE % *& _PERFINFO_PPM_IDLE_STATE_ENTER �\ PSTRING �\ PHARDWAREINPUT " �\ PJOURNAL_CLIENT_INFORMATION ( <- _FILE_NOTIFY_EXTENDED_INFORMATION & �U _RTL_PROCESS_BACKTRACES_CONTROL ' S1 _RTLP_PROCESS_REFLECTION_CONTEXT t PINT
p PCH " �& FILE_COMPLETION_INFORMATION " �\ LDR_MANIFEST_PROBER_ROUTINE �. POWER_MONITOR_INVOCATION �> LPPIXELFORMATDESCRIPTOR & �\ PETW_TP_EVENT_TIMER_SET_NTTIMER * �\ PSYSTEM_VERIFIER_FAULTS_INFORMATION �\ PIMAGE_ENCLAVE_CONFIG32 �> LDR_VERIFY_IMAGE_INFO ? �\ PACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA ! �\ PREPARSE_POINT_INFORMATION ) MC SYSTEM_VERIFIER_FAULTS_INFORMATION !Y ATOM_TABLE_INFORMATION �\ PWNF_TYPE_ID )
> PFN_RTL_IS_NTDDI_VERSION_AVAILABLE � _XSAVE_VENDOR # �< _CLAIM_SECURITY_ATTRIBUTE_V1 _PS_ATTRIBUTE_NUM �W LPDLGTEMPLATEA &E POWER_REQUEST_TYPE �\ PRTL_BSD_ITEM_TYPE �X RPC_SEC_CONTEXT_KEY_INFO ) �\ PPERFINFO_DYNAMIC_TICK_VETO_REASON D( SCOPE_TABLE_ARM64 `* tagKBDLLHOOKSTRUCT �\ PPOWER_SESSION_RIT_STATE [? PO_WAKE_SOURCE_INTERNAL ! vS EMRCREATEDIBPATTERNBRUSHPT " �- ETW_OPTICALIO_FLUSH_BUFFERS ! + UNICODE_PREFIX_TABLE_ENTRY , RGNDATA *@ DISCDLGSTRUCTA �\ PRPC_SECURITY_QOS_V2_A ) �\ PETW_COVERAGE_SAMPLER_BLOOM_FILTER " PULONG_PTR 4 �\ PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION ) yG _EVENT_EXTENDED_ITEM_STACK_TRACE64 �% _THREAD_ENERGY_VALUES
�( DCB R+ ENUMLOGFONTEX 6 _NETRESOURCEW $ �6 _FILE_FS_OBJECTID_INFORMATION �\ PRTL_UMS_SCHEDULER_REASON l? SMALL_RECT �\ PPOWER_REQUEST_TYPE ) �\ PFN_NT_SET_INFORMATION_TRANSACTION [ IMAGE_POLICY_ENTRY �X PFIBER_CALLOUT_ROUTINE * �\ LPSERVICE_REQUIRED_PRIVILEGES_INFOW �W IMAGE_DATA_DIRECTORY " �\ PMEMORY_COMBINE_INFORMATION " �\ PREQUEST_RAW_ENCRYPTED_DATA ) �\ PPERFINFO_VIRTUAL_ALLOC_XPARTITION # �\ PTOKEN_GROUPS_AND_PRIVILEGES sE _FILE_ID_BOTH_DIR_INFO �\ PFILE_REFERENCE_RANGE + �V SYSTEM_PROCESS_INFORMATION_EXTENSION �= _BOOT_RECORD �: HEAP_INFORMATION_ITEM * �\ PCFINDFIRSTACTIVATIONCONTEXTSECTION 2 MULTIKEYHELPA - v _JOBOBJECT_LIMIT_VIOLATION_INFORMATION $ X _SYSTEM_LOOKASIDE_INFORMATION - �5 JOURNAL_SET_KEY_USER_FLAGS_INFORMATION 0X _PERFINFO_VAD_ROTATE_INFO + eA EVENT_TRACE_HEAP_TRACING_INFORMATION B? PKCRM_TRANSACTION_BLOB u rsize_t �# HARDERROR_RESPONSE $ �F IMAGE_LOAD_CONFIG_DIRECTORY64 �2 FINDEX_SEARCH_OPS + 6 _SYSTEM_DMA_GUARD_POLICY_INFORMATION � _PERFINFO_PO_PRESLEEP ) �\ PSYSTEM_REGISTRY_QUOTA_INFORMATION �\ LPLOAD_DLL_DEBUG_INFO TR PABCFLOAT A LOGICAL_DISK_EXTENTS S THREAD_PERFORMANCE_DATA L) LPMULTIKEYHELPW " �\ PENTER_STATE_NOTIFY_HANDLER [4 GENERATE_NAME_CONTEXT �@ PERFORMANCE_DATA �F EMRMODIFYWORLDTRANSFORM % �\ PFILE_SFIO_RESERVE_INFORMATION + i _SYSTEM_PROCESSOR_POLICY_INFORMATION & tG _SL_KMEM_CACHE_VALUE_DESCRIPTOR
X _VCN_RANGE_INPUT_BUFFER
�# LPSIZE �\ LPEXTLOGFONT �) ALPC_MESSAGE_ATTRIBUTES � _FILE_GET_EA_INFORMATION � COVERAGE_MODULES X" ENUMTEXTMETRICW �\ PQUERY_BAD_RANGES_OUTPUT � _SHUFFLE_FILE_DATA �\ PLIST_ENTRY64 �Y PACKEDEVENTINFO & �\ PWIM_PROVIDER_CONTROL_INTEGRITY �\ LPPROGRESS_ROUTINE 5 PAXISINFOA �D PEMRSTROKEANDFILLPATH # �\ PSHARED_VIRTUAL_DISK_SUPPORT % �> FILE_PIPE_CREATE_SYMLINK_INPUT ! �6 QUERY_SERVICE_LOCK_STATUSA & F _PERFINFO_PPM_IDLE_EXIT_LATENCY 5 �\ PPROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY _CSV_NAMESPACE_INFO , �\ PSYSTEM_PROCESS_INFORMATION_EXTENSION �\ PMESSAGE_RESOURCE_ENTRY �$ _PS_WAKE_REASON # �( _PARTITION_INFORMATION_CLASS $ �/ _KEY_OPEN_SUBKEYS_INFORMATION �\ PSYSTEM_ALARM_ACE $ H) _PROCESS_HANDLE_TRACING_QUERY �S _NTFS_STATISTICS � EISA_DMA_CONFIGURATION �\ PEMREXTESCAPE & �\ PFILE_ATTRIBUTE_TAG_INFORMATION �\ PSYSDBG_BUS_DATA �\ PTOKEN_USER �- tagHW_PROFILE_INFOA �\ LPWNDCLASS # " _PERFINFO_SYSCALL_ENTER_DATA <@ KEY_VALUE_ENTRY & �1 _ETW_WNF_EVENT_NAME_SUB_RUNDOWN .+ REASON_CONTEXT �B tagEMRGLSBOUNDEDRECORD V _SUPPORTED_OS_INFO % �\ PUMS_SYSTEM_THREAD_INFORMATION & �\ PPERFINFO_SET_DEVICES_STATE_RET �\ PSL_APPX_CACHE 5, ETW_TP_EVENT_POOL_CREATE ' �+ FILE_METADATA_OPTIMIZATION_STATE ! 6 _HARDERROR_RESPONSE_OPTION & �\ RTLP_UNHANDLED_EXCEPTION_FILTER PUMS_CONTEXT - �R FILE_NETWORK_PHYSICAL_NAME_INFORMATION H* TIMEFMT_ENUMPROCW W _WMI_WAIT_SINGLE # �- _FILE_LINK_ENTRY_INFORMATION # X SYSTEM_LOOKASIDE_INFORMATION �\ PEVENT_RECORD_CALLBACK & �\ PCIMAGE_BOUND_IMPORT_DESCRIPTOR mU _IO_STATUS_BLOCK �\ PWOF_EXTERNAL_INFO �: USER_ACTIVITY_PRESENCE , �\ PPLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA RTL_HASH_BUCKET_TYPE �\ PATOM_TABLE_INFORMATION 9 CM_FLOPPY_DEVICE_DATA ' 2 JOURNAL_CHANGE_INFORMATION_CLASS " DWORD_PTR A _XSAVE_VENDORS - �\ PSYSTEM_ISOLATED_USER_MODE_INFORMATION .+ POWER_REQUEST_CONTEXT U[ PLAYERPLANEDESCRIPTOR ,9 tagNEWTEXTMETRICEXW G CPU_CONFIG_RECORD & U _SYSTEM_PROCESS_TRUST_LABEL_ACE �) ACCESS_REASONS �U _EXCEPTION_RECORD32 LCSGAMUTMATCH |< PMODEMSETTINGS ( �4 EVENT_TRACE_LBR_EVENT_INFORMATION ' �: _ETW_COVERAGE_SAMPLER_PERF_STATS �\ LPFILTERKEYS !
A IMAGE_DYNAMIC_RELOCATION64 �\ PTIME_FIELDS �/ LPEXCEPTION_RECORD �A RPC_SECURITY_QOS_V5_A �R _ACCESS_DENIED_ACE �@ _COMSTAT �) POLYTEXT RS SE_ACCESS_REPLY * > JOBOBJECT_ASSOCIATE_COMPLETION_PORT $ �\ PHEAP_AFFINITY_SLOT_ACTIVATED $ �\ PETW_TP_EVENT_POOL_TH_MAX_SET k _MESSAGE_RESOURCE_BLOCK �\ PRTL_PROCESS_BACKTRACES WB _OBJECT_TYPES_INFORMATION '! _RPC_STRING FY DL_EUI48 $ ' _PERFINFO_PPM_IDLE_STATE_EXIT ! 7E _FILE_FULL_DIR_INFORMATION / _MEMORY_WORKING_SET_BLOCK �\ PHEAP_INFORMATION_ITEM 69 _VIDEO_RECORD # < JOBOBJECT_JOBSET_INFORMATION �\ PWNODE_HEADER
t LONG32 �\ PPROCESSOR_RELATIONSHIP , �# KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 , t( EVENT_EXTENDED_ITEM_PROCESS_START_KEY �8 ETW_OPTICALIO_INIT T FILE_EA_INFORMATION �% HELPINFO % �\ PWORKER_FACTORY_CALLBACK_CLASS , _RTL_HASH_TABLE > RTL_RETPOLINE_BINARY_INFO �' NPPOINT 0 APP_MEMORY_INFORMATION �\ PRPC_ENDPOINT_TEMPLATEW , bW CLAIM_SECURITY_ATTRIBUTES_INFORMATION / �U _FILE_PROCESS_IDS_USING_FILE_INFORMATION �> PPELARRAY �Q _MESSAGE_TRACE �\ PWOF_VERSION_INFO �\ PNLSTABLEINFO �\ PWMI_PNP_RECORD_V5 �\ PIMAGE_SYMBOL # rW _ENCLAVE_LOAD_DATA_VBS_BASIC r9 TRACE_LOGFILE_HEADER ( �\ PPERFINFO_MEMORY_NODE_INFORMATION �D _WMI_LOGGER_INFORMATION # �1 _SHRINK_VOLUME_REQUEST_TYPES �\ DISPLAYCONFIG_SOURCE_MODE & _Z _FILE_STANDARD_LINK_INFORMATION $ �\ APPLICATION_RECOVERY_CALLBACK � LEARNING_MODE_LOG_LEVEL " �\ PSYSTEM_POOLTAG_INFORMATION LANGINDEX * �# DIALOG_CONTROL_DPI_CHANGE_BEHAVIORS % �\ PSYSTEM_ACPI_AUDIT_INFORMATION �% LPWNDCLASSW # ,$ ETW_COVERAGE_SAMPLER_OPTIONS ( �+ _FILE_METADATA_OPTIMIZATION_STATE �\ LPCONNECTDLGSTRUCTW ! Q" FILE_ALIGNMENT_INFORMATION 0X PERFINFO_VAD_ROTATE_INFO �5 tagCBTACTIVATESTRUCT ) �! JOBOBJECT_INTERFERENCE_INFORMATION L4 tagDRAWTEXTPARAMS 6 NETRESOURCEW # �\ PPROCESS_WORKING_SET_CONTROL �\ PHEAP_RANGE_INFORMATION �F RIP_INFO % � PROCESS_POWER_THROTTLING_STATE , bY SYSTEM_FIRMWARE_PARTITION_INFORMATION ! �B tagUPDATELAYEREDWINDOWINFO >) _ETW_RT_EVENT_LOSS . �* _MEMORY_PHYSICAL_CONTIGUITY_INFORMATION s2 tagCBT_CREATEWNDW V PORT_DATA_ENTRY �8 _COVERAGE_MODULE_REQUEST h! ICONINFOEXA ( �V _PROCESS_DEVICEMAP_INFORMATION_EX ( EVENT_INFORMATION_CLASS �V _SL_KMEM_CACHE �\ PCIMAGE_POLICY_ENTRY ! J SUBSYSTEM_INFORMATION_TYPE �W tagAUDIODESCRIPTION � SERVICE_FAILURE_ACTIONS # �U _IMAGE_RESOURCE_DIR_STRING_U �C _PORT_INFORMATION_CLASS 0 JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL " �\ PTXFS_GET_METADATA_INFO_OUT <* PO_SLEEP_DISABLE_REASON � WNF_DLLUNLOAD_CALLBACK % tagPOINTS �C LPEVENTMSGMSG EMRSETBKMODE �\ LPNCCALCSIZE_PARAMS �\ PSERVICE_TIMECHANGE_INFO ] _SYSTEM_INFORMATION_CLASS . �\ PJOBOBJECT_NET_RATE_CONTROL_INFORMATION % @ PO_CS_DEVICE_NOTIFICATION_TYPE ! �5 _EVENTLOG_FULL_INFORMATION a< tagENUMLOGFONTA ) E _SERVICE_REQUIRED_PRIVILEGES_INFOA �\ PRTL_RXACT_CONTEXT B$ TOKEN_TYPE " � _ETW_FINALIZE_KTIMER2_EVENT # � DELETE_STORAGE_RESERVE_INPUT �\ PKEY_FLAGS_INFORMATION �\ PCACTIVATION_CONTEXT " PUCSSTR �C SINGLE_LIST_ENTRY32 �! QUERY_FILE_LAYOUT_OUTPUT @ �\ RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC �\ HMETAFILE $ � _ETW_PROCESS_HANDLE_INFO_TYPE ! �\ PCPS_SYSTEM_DLL_INIT_BLOCK 1 �\ PSYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION �Y SEC_WINNT_AUTH_IDENTITY_W & � CI_LOG_SCHEDULER_SLEEP_RESPONSE & :+ _PERFINFO_FILE_SIMPLE_OPERATION
q PUWSTR �\ PUSN_RECORD_V3 ' �? TIMER_SET_COALESCABLE_TIMER_INFO % �T _SYSTEM_OBJECTTYPE_INFORMATION �\ PFILE_LINKS_INFORMATION + �\ PSYSTEM_SYSTEM_PARTITION_INFORMATION WV tagHARDWAREHOOKSTRUCT �R PEMREXTTEXTOUTW �[ FILE_STORAGE_TIER ]D LPAXESLISTA ) �\ PETW_UMS_EVENT_DIRECTED_SWITCH_END Y SYSTEM_AUDIT_CALLBACK_ACE = �6 PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION $ D= _SYSTEM_INTERRUPT_INFORMATION \ PEVENT_FILTER_LEVEL_KW , �0 _TRANSACTIONMANAGER_BASIC_INFORMATION " COLORREF �@ INPUT_RECORD # ~\ PETW_COVERAGE_SAMPLER_STATUS ) }\ PFILE_PIPE_EVENT_ENUM_INPUT_BUFFER |\ PUSER_ACTIVITY_PRESENCE �U _SYSTEM_WORKINGSET_ENTRY ' {\ PBOOT_ENTROPY_SOURCE_RESULT_CODE $ g IMAGE_DYNAMIC_RELOCATION64_V2 z\ PRPC_SYNTAX_IDENTIFIER -\ XSAVE_CPU_INFO RTL_FEATURE_VARIANT ' 0 _BOOT_ENTROPY_SOURCE_RESULT_CODE p+ _OSVERSIONINFOEXW ! y\ PFILE_INTERNAL_INFORMATION x\ PSYSTEM_POWER_STATE " �9 _SYSTEM_POOLTAG_INFORMATION $ mW IMAGE_BOUND_IMPORT_DESCRIPTOR ' PROCESS_EXCEPTION_PORT $ w\ PFILE_ID_FULL_DIR_INFORMATION �0 PCTCH 3 �1 PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION * v\ PTRANSACTIONMANAGER_LOG_INFORMATION ' u\ I_RpcProxyGetConnectionTimeoutFn ! � BY_HANDLE_FILE_INFORMATION " �! _SYSTEM_MANDATORY_LABEL_ACE t\ PCPU_SET_INFORMATION_TYPE " Q[ PROCESSOR_POWER_INFORMATION * B6 SYSTEM_ELAM_CERTIFICATE_INFORMATION # �U CM_DISK_GEOMETRY_DEVICE_DATA 3 _RTL_QUERY_REGISTRY_TABLE s\ PSTRING64 # r\ PIMAGE_ARCHIVE_MEMBER_HEADER ( � _LDR_DLL_LOADED_NOTIFICATION_DATA �R RTL_HEAP_WALK_ENTRY 4 q\ PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V1 ! p\ PSTARTING_VCN_INPUT_BUFFER Y IRQ_DEVICE_POLICY �, _IMAGE_CHPE_RANGE_ENTRY $ D _RTL_PROCESS_VERIFIER_OPTIONS 6 � _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION o\ ENUMRESNAMEPROCW s TRACE_GUID_INFO KPRIORITY l\ PTOKEN_TYPE 1R _KEY_LAYER_INFORMATION
j\ _Ea �S PRAWHID �8 WMI_TXR h\ POBJECT_TYPE_INFORMATION " g\ PSYSTEM_MEMORY_LIST_COMMAND ! � _SEC_WINNT_AUTH_IDENTITY_A �1 CACHE_DESCRIPTOR $ x8 _SYSTEM_BOOT_LOGO_INFORMATION R _RDR_CALLOUT_STATE ( �W JOB_OBJECT_NET_RATE_CONTROL_FLAGS & _CM_PARTIAL_RESOURCE_DESCRIPTOR �A _CONNECTDLGSTRUCTA f\ PMIDL_SERVER_INFO e\ PVM_COUNTERS " � _RTL_HEAP_MEMORY_LIMIT_DATA [2 NPMSG & �3 _PERFINFO_CC_LOGGED_STREAM_INFO d\ LPSERVICE_DESCRIPTIONA , c\ PPERFINFO_CLOCK_INTERRUPT_INFORMATION #? IO_RESOURCE_LIST b\ PMUILANGUAGES 7 NPIMECHARPOSITION 2 <\ PEVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION & �T _TOKEN_APPCONTAINER_INFORMATION �' _RTL_BSD_ITEM , �4 EVENT_TRACE_PROFILE_EVENT_INFORMATION & ? LEAP_SECOND_DATA_REGISTRY_ENTRY $ � _RTL_CRITICAL_SECTION_DEBUG32 � SHUFFLE_FILE_DATA - `\ JOBOBJECT_NET_RATE_CONTROL_INFORMATION �' _POWER_USER_PRESENCE # RTL_FEATURE_CHANGE_STAMP ( ]\ PSYSTEM_ACTIVITY_MODERATION_STATE " �- _OPERATION_START_PARAMETERS @ AR_STATE ! \\ PPERFINFO_WORKINGSET_ENTRY S SYSTEM_POWER_STATE # �R RTLP_HEAP_SERIALIZED_MAPPING % �G OBJECT_HANDLE_FLAG_INFORMATION + �. _SYSTEM_HYPERVISOR_QUERY_INFORMATION [\ ENUMRESTYPEPROCW $ �F _ETW_PARTITION_INFO_EXTENSION
X\ PUQUAD �V _POWER_SESSION_CONNECT % _PROCESS_WORKING_SET_OPERATION LIST_ENTRY32 - W\ PFILE_FS_PERSISTENT_VOLUME_INFORMATION �, NPDEBUGHOOKINFO U\ ANON_OBJECT_HEADER � RTL_RESOURCE R\ PEXTLOGFONT # Q\ PSD_CHANGE_MACHINE_SID_INPUT 3 P\ PMEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION O\ FONTENUMPROC �@ _ETW_SET_KTIMER2_EVENT ( N\ PIMAGE_ARM_RUNTIME_FUNCTION_ENTRY M\ LPPALETTEENTRY g2 _IMAGE_NT_HEADERS64 " L\ PSYSTEM_VA_LIST_INFORMATION K\ PRTL_ENUM_HEAPS_ROUTINE I\ PDECRYPTION_STATUS_BUFFER H\ PTP_IO_CALLBACK E\ PEMRTEXT D\ PTOKEN_PRIMARY_GROUP C\ PPSINJECTDATA B\ MSGBOXCALLBACK - '< JOBOBJECT_BASIC_ACCOUNTING_INFORMATION �0 tagCOLORADJUSTMENT
5 PERFINFO_MEM_RESET_INFO ! A\ PFSCTL_OFFLOAD_READ_OUTPUT �( PATTERN �? PEMRBEGINPATH `* KBDLLHOOKSTRUCT =S NT_TIB32 �S tagMENUGETOBJECTINFO @\ PRTL_RVA_LIST_ITERATOR $ _ENUM_SERVICE_STATUS_PROCESSA l& RPC_VERSION � ENUMLOGFONTW L PEMRPOLYPOLYGON ?\ LPSOUNDSENTRY ! QV _PERFINFO_MARK_INFORMATION >\ SC_NOTIFICATION_CALLBACK =\ PWNODE_EVENT_REFERENCE . <\ PEVENT_TRACE_POOLTAG_FILTER_INFORMATION 0 ;\ PSYSTEM_VERIFIER_CANCELLATION_INFORMATION � UMS_SCHEDULER_REASON �) PBITMAPV4HEADER S POUTLINETEXTMETRICA % o! _FILE_FS_DATA_COPY_INFORMATION W IMAGE_SYMBOL $ :\ PFILE_STORAGE_TIER_MEDIA_TYPE �" _RPC_SECURITY_QOS_V3_W 9\ PPERFINFO_DPC_INFORMATION 8\ PFILESYSTEM_STATISTICS_EX .F SYSTEM_ALARM_OBJECT_ACE VC RTL_PROCESS_BACKTRACES X PRAWKEYBOARD ; RPC_ADDRESS_CHANGE_FN % q _SYSTEM_RESOURCE_ATTRIBUTE_ACE �$ _PEBS_DS_SAVE_AREA 7\ PCFOUR_PART_VERSION 5\ GEO_ENUMPROC �X LPIMEMENUITEMINFOA , PROCESS_LDT_INFORMATION . J5 _SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 2\ PATOM_BASIC_INFORMATION �* RTL_UNLOAD_EVENT_TRACE �T tagRAWINPUTHEADER , $" _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY { _PROCESS_DISK_COUNTERS ; LOGPALETTE �' tagEMRPOLYLINE16 A PNEWTEXTMETRICA 1\ ABORTPROC ' �3 _PERFINFO_PO_SESSION_CALLOUT_RET +\ PXSAVE_CPU_INFO �" POWER_SESSION_TIMEOUTS " &. _SYSTEM_BASIC_INFORMATION64 *\ PEMRSETPALETTEENTRIES 3 x SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT 7 )\ PRTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY GEOID �" _CSVFS_DISK_CONNECTIVITY ! �E _STORAGE_RESERVE_AREA_INFO (\ DPI_AWARENESS_CONTEXT '\ OLDFONTENUMPROCA X# _VIDEOPARAMETERS �# ENUM_SERVICE_STATUS �; ETW_BUFFER_CONTEXT &\ XMIT_HELPER_ROUTINE , �) _PERFINFO_SAMPLED_PROFILE_INFORMATION ' �1 _SYSTEM_MEMORY_USAGE_INFORMATION PEMRSETLAYOUT & �8 _PROCESS_EXTENDED_ENERGY_VALUES 9> _EVENT_HEADER / PERFINFO_TRACE_HEADER %\ PNON_PAGED_DEBUG_INFO ! $\ PSYSTEM_THREAD_INFORMATION � TP_CALLBACK_INSTANCE #\ RPC_OBJECT_INQ_FN * �U _SYSTEM_MEMORY_TOPOLOGY_INFORMATION �4 LPCOMPAREITEMSTRUCT % .T PLUGPLAY_CONTROL_CONFLICT_DATA �< NETRESOURCE �6 _FULL_PTR_XLAT_TABLES �D _TXFS_LIST_TRANSACTIONS % �V _EXTENT_READ_CACHE_INFO_BUFFER �# NUMA_NODE_RELATIONSHIP !\ PEVENT_CALLBACK " \ PFILE_ZERO_DATA_INFORMATION & 3Z _PROCESS_CYCLE_TIME_INFORMATION $ \ PPROCESS_AFFINITY_UPDATE_MODE , o6 _FILE_IOSTATUSBLOCK_RANGE_INFORMATION & \ PFILE_PROVIDER_EXTERNAL_INFO_V1 7 �- _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY !
( SYSTEM_BIGPOOL_INFORMATION % \ PPLUGPLAY_CONTROL_INSTALL_DATA \ LPENUMLOGFONTEX �' PEMRPOLYBEZIER16 # \ PKEY_VALUE_BASIC_INFORMATION �T LPRAWINPUTHEADER % \ LPENUM_SERVICE_STATUS_PROCESSW ! \ PWMI_IMAGELOAD_INFORMATION ([ _RTL_RVA_LIST + ETW_SET_TIMER_EVENT \ PCONTEXT_CHUNK V? IMAGE_TLS_DIRECTORY64 % \ PIO_RESOURCE_REQUIREMENTS_LIST \ PCRAWINPUTDEVICE # $V EVENT_EXTENDED_ITEM_INSTANCE # y4 SERVERSILO_BASIC_INFORMATION ' \ PPS_MITIGATION_AUDIT_OPTIONS_MAP
< XSTATE_CONTEXT 2 U% JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION $ & tagPOINTER_BUTTON_CHANGE_TYPE �* CM_SHARE_DISPOSITION & \ PRTL_DISK_WRITE_CONSTRAINT_INFO \ ICMENUMPROCA \ PWNODE_ALL_DATA # @ _PERFINFO_DEBUG_EVENT_REASON �U FILE_END_OF_FILE_INFO \ LPMETAFILEPICT ' �% TXFS_READ_BACKUP_INFORMATION_OUT \ PXSTATE_FEATURE
\ REGISTERWORDENUMPROCW
\ PUNWIND_HISTORY_TABLE \ PMUTANT_OWNER_INFORMATION MENUTEMPLATEW \ LPWNDCLASSEX ( Y PERFINFO_CONTIGUOUS_PAGE_GENERATE |Y _HV_DETAILS ! \ PHEAP_EXTENDED_INFORMATION �/ tagEMRSELECTPALETTE \ PRTL_TREE_WALK_FUNCTION !* _KEY_EVENT_RECORD % pvalueW *@ DISCDLGSTRUCT & 2 SERVICE_DELAYED_AUTO_START_INFO \ PETW_CLOCK_TIME_UPDATE * -1 _PROCESS_COMMIT_RELEASE_INFORMATION \ PVALENT & T SYSTEM_ACTIVITY_MODERATION_INFO % 3T _PROCESS_FOREGROUND_BACKGROUND ( N< PERFINFO_KERNELMEMORY_RANGE_USAGE & �W FILE_DISPOSITION_INFORMATION_EX # yX ENLISTMENT_BASIC_INFORMATION !U _STARTUPINFOEXA �= FILE_ALL_INFORMATION ) \ PMEMORY_PARTITION_NODE_INFORMATION S2 _DMA_CONFIGURATION_BYTE1 ( \ PPROCESS_DEVICEMAP_INFORMATION_EX �[ PWNF_STATE_NAME_LIFETIME $ �# _PERFINFO_PPM_STATE_SELECTION ) �V _RTL_IMAGE_MITIGATION_SEHOP_POLICY $ 2& _RTL_CRITICAL_SECTION_DEBUG64
nA PSIZEL LCSCSTYPE �[ PETW_CLOSE_HANDLE_EVENT $ �[ RTL_REALLOCATE_STRING_ROUTINE > tagDROPSTRUCT �+ XSAVE_CET_U_FORMAT 0 �[ PEVENT_TRACE_COVERAGE_SAMPLER_INFORMATION Z) UNICODE_STRING32 �> _PRIVILEGE_SET �' ACTIVATION_CONTEXT_STACK . � _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY �[ PENUMTEXTMETRIC # G SD_CHANGE_MACHINE_SID_OUTPUT �[ PIMAGE_NT_HEADERS * u0 SYSTEM_WRITE_CONSTRAINT_INFORMATION �R PEXTLOGPEN �, tagRECONVERTSTRING �6 HEAP_EVENT_RANGE " �. _PERFINFO_MEMORY_NODE_ENTRY ! �U _REPARSE_POINT_INFORMATION % � LOGICAL_PROCESSOR_RELATIONSHIP ^' EMRPOLYTEXTOUTW ) �C PERFINFO_PO_CALIBRATED_PERFCOUNTER EMRSETROP2 MY SYSDBG_TRIAGE_DUMP �[ PTRACE_GUID_PROPERTIES # �[ PPERFINFO_SYSCALL_ENTER_DATA ! e _RTL_FEATURE_ENABLED_STATE YE _OPTICAL_MEDIA_RECORD - �[ PSYSTEM_FIRMWARE_PARTITION_INFORMATION *= EVENT_FILTER_EVENT_ID # �[ PIMAGE_RESOURCE_DIR_STRING_U 0 sC RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY �C NEWTEXTMETRICEX ! �[ PTOUCHPREDICTIONPARAMETERS LONG_PTR �V XSAVE_CPU_ERRATA |( _TOKEN_DEVICE_CLAIMS ! � TXFS_SAVEPOINT_INFORMATION # �[ PPROCESSOR_POWER_INFORMATION " 9D PLUGPLAY_CONTROL_DEPTH_DATA �[ LPSYSTEM_POWER_STATUS f tagHIGHCONTRASTW �[ PETW_KQUEUE_ENQUEUE_EVENT * �[ PACCESS_ALLOWED_CALLBACK_OBJECT_ACE % ( _TIME_DYNAMIC_ZONE_INFORMATION ! �[ DISPLAYCONFIG_ADAPTER_NAME �[ PEMRPLGBLT |+ CLIENT_CALL_RETURN �; ACL_REVISION_INFORMATION �[ PMEMORY_RESERVE_TYPE / �+ _FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT }- tagNONCLIENTMETRICSW �[ PETW_WAKE_COUNTER_EVENT / �[ PJOBOBJECT_EXTENDED_LIMIT_INFORMATION_V1 . PALPC_HANDLE_ATTR32 �[ PREASON_BUFFER �[ RTL_AVL_MATCH_FUNCTION % �[ PPERFINFO_CC_WORKITEM_COMPLETE z< _EVENT_TRACE_LOGFILEA LANGNAMEINDEX �[ HRSRC �[ PCWNF_TYPE_ID �[ EDITWORDBREAKPROCA xE IMAGE_POLICY_METADATA �* _ETW_HEAP_EVENT_CREATE ( o" _PERFINFO_CC_EXTRA_WB_THREAD_INFO
o/ CURDIR ! �B _FILE_OBJECTID_INFORMATION " �' PROCESS_WORKING_SET_CONTROL $ �[ PCM_EISA_FUNCTION_INFORMATION gC _FILE_ALLOCATION_INFO ! �7 _WINDOW_BUFFER_SIZE_RECORD � _IO_RESOURCE_DESCRIPTOR ' lX _ETW_ANTI_STARVATION_BOOST_EVENT * eZ PROCESS_SECURITY_DOMAIN_INFORMATION EMRSETICMMODE �[ PFILE_STORAGE_TIER ( �[ PWORKER_FACTORY_BASIC_INFORMATION �[ LPSYSTEM_INFO 4 UNIVERSAL_NAME_INFOW 3 RPC_ADDRESS_CHANGE_TYPE 1 ) _EVENT_TRACE_IPT_CONFIGURATION_INFORMATION & �[ PETW_COVERAGE_SAMPLER_PERF_INFO u PUINT_PTR �[ PIMAGE_TLS_DIRECTORY64 ' r: MEMORY_SHARED_COMMIT_INFORMATION � PEMRPOLYPOLYLINE16 ! j# _SECURITY_OBJECT_AI_PARAMS � _EVENT_DATA_DESCRIPTOR * ?# _PERFINFO_HARDPAGEFAULT_INFORMATION . FA JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V1 � tagEXTLOGPEN32 # �[ PIMAGE_DYNAMIC_RELOCATION_V2 �[ PREFS_VOLUME_DATA_BUFFER 1 sC _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY $ /D _CONSOLE_SCREEN_BUFFER_INFOEX �[ PPROVIDER |Y HV_DETAILS , �6 MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES & �[ PRTL_USER_PROCESS_INFORMATION64 ! ATOM �[ PEMROFFSETCLIPRGN + �[ PFILE_LINK_ENTRY_FULL_ID_INFORMATION + �[ PSYSTEM_BOOT_ENVIRONMENT_INFORMATION * �2 SYSTEM_KERNEL_VA_SHADOW_INFORMATION # �G ETW_CLOCK_STATE_CHANGE_EVENT * �[ PPERFINFO_SYSTEM_MEMORY_INFORMATION ' �[ PSTORAGE_RESERVE_AREA_DEFINITION + 0 _TRANSACTION_ENLISTMENTS_INFORMATION �[ PTP_WIN32_IO_CALLBACK � ORIENTATION_PREFERENCE / r4 SYSTEM_VERIFIER_CANCELLATION_INFORMATION ! m- QUERY_SERVICE_LOCK_STATUSW F SERVICE_NOTIFYW & .T _PLUGPLAY_CONTROL_CONFLICT_DATA �[ PEMREOF &$ _CI_LOG_SCHEDULER_EVENT 4 �[ PSYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE KX MUILANGLIST $ �[ PRTL_USER_PROCESS_INFORMATION �[ LPPOLYTEXT
�S PEB � INTERFACE_TYPE SG _PLUGPLAY_NOTIFY_HDR MZ LPBITMAPCOREINFO �[ PSC_NOTIFICATION_CALLBACK +7 MENU_EVENT_RECORD �[ PUSN_RECORD_EXTENT �[ _Reparse ( �[ PMEMORY_SHARED_COMMIT_INFORMATION , �[ PSYSTEM_LOGICAL_PROCESSOR_INFORMATION �[ PETW_OPTICALIO_INIT _CSV_CONTROL_PARAM % � _REFS_SMR_VOLUME_GC_PARAMETERS �[ PLDR_DLL_LOAD_REASON + �[ PEVENT_TRACE_SPINLOCK_INFORMATION_V1 WU _IMAGE_RELOCATION � _VRF_RULE_CLASS_ID 2 �> SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION ( �[ PACTIVATION_CONTEXT_ASSEMBLY_DATA $ �[ PTRACE_PROVIDER_INSTANCE_INFO �[ PNDR_ASYNC_MESSAGE $ �% _QUERY_BAD_RANGES_INPUT_RANGE � _FIRMWARE_TYPE �D ETW_UMS_EVENT_PARK �U _SID % _Z FILE_STANDARD_LINK_INFORMATION % �T WIM_PROVIDER_ADD_OVERLAY_INPUT % 8( _SYSTEM_CALL_COUNT_INFORMATION % �U KEY_VIRTUALIZATION_INFORMATION N FIXED �[ PAR_STATE " rW ENCLAVE_LOAD_DATA_VBS_BASIC �8 tagCOMBOBOXINFO �[ LPSERVICE_DESCRIPTION " ULONG_PTR % �[ PEVENT_EXTENDED_ITEM_EVENT_KEY + �; _ALPC_PORT_ASSOCIATE_COMPLETION_PORT ) <[ _EVENT_EXTENDED_ITEM_STACK_TRACE32 - �[ PPERFINFO_PFMAPPED_SECTION_INFORMATION d _LUNICODE_STRING }X _CSV_IS_OWNED_BY_CSVFS . �[ PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION $ �# ETW_TP_EVENT_CALLBACK_DEQUEUE ' �[ PETW_SESSION_NOTIFICATION_PACKET �5 tagWINDOWPLACEMENT $ (Y _FILE_STANDARD_INFORMATION_EX ) �[ PTXFS_ROLLFORWARD_REDO_INFORMATION �[ PCSV_IS_OWNED_BY_CSVFS �[ NON_PAGED_DEBUG_INFO " �[ PMEMORY_BASIC_INFORMATION64 % �[ PQUERY_BAD_RANGES_OUTPUT_RANGE % �[ PEXTENT_READ_CACHE_INFO_BUFFER ! q& _ENCRYPTION_KEY_CTRL_INPUT + �3 _REFS_DEALLOCATE_RANGES_INPUT_BUFFER ! �[ PSECURE_SETTING_VALUE_TYPE �[ PRTL_UNLOAD_EVENT_TRACE64 3 �[ PCLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE �[ PALPC_SERVER_INFORMATION
�[ PFNFTH ! � _SECTION_INFORMATION_CLASS �[ I_RpcPerformCalloutFn ' �/ _TOKEN_BNO_ISOLATION_INFORMATION &E _POWER_REQUEST_TYPE �% _LDR_ENUM_RESOURCE_ENTRY : FSCTL_OFFLOAD_READ_OUTPUT % �[ PSYSTEM_GDI_DRIVER_INFORMATION 0 _MUILANGUAGES u PULONG32 # V _PS_BNO_ISOLATION_PARAMETERS ! � ALPC_WORK_ON_BEHALF_TICKET �* _WAKE_TIMER_INFO �[ PEVENT_RECORD �/ PROCESS_WAKE_FILTER < tagENUMLOGFONTEXW , I _LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION Z RGNDATAHEADER INT16 AD _XSAVE_FEATURE �[ PWRITE_USN_REASON_INPUT + ' SYSTEM_HYPERVISOR_DETAIL_INFORMATION �[ PRTL_TRACE_DATABASE �T _SCRUB_PARITY_EXTENT �B CFG_CALL_TARGET_INFO ) 'C _PERFINFO_VIRTUAL_ALLOC_XPARTITION 5F PERFINFO_FLT_OPERATION �[ PTP_CLEANUP_GROUP �C PEVENTMSG # �[ RTL_HEAP_STACK_WRITE_ROUTINE (9 NDR_USER_MARSHAL_INFO " PUCSCHAR ! �[ I_RpcProxyIsValidMachineFn �3 TTPOLYGONHEADER �[ PROPENUMPROCW 3' _NDR_CS_ROUTINES |. _MAXVERSIONTESTED_INFO a= tagFONTSIGNATURE �[ PSD_GLOBAL_CHANGE_OUTPUT - V _MEMORY_PARTITION_TRANSFER_INFORMATION � _ALPC_WORK_ON_BEHALF_ATTR # �0 SYSTEM_HIBERFILE_INFORMATION �[ LPCSCROLLINFO �[ HRAWINPUT ! �[ PFILE_QUERY_SPARING_BUFFER 0> tagEMREXTFLOODFILL $ �[ PEVENT_EXTENDED_ITEM_INSTANCE & � JOBOBJECT_ENERGY_TRACKING_STATE �[ PIO_SESSION_CONNECT_INFO & Y _WIM_PROVIDER_CONTROL_INTEGRITY % - _PO_HIBER_FORCE_DISABLE_REASON + �[ PMEM_SECTION_EXTENDED_PARAMETER_TYPE �T LPTITLEBARINFO # �[ PSEMAPHORE_BASIC_INFORMATION % �6 _RPC_BINDING_HANDLE_OPTIONS_V1 �[ PWMI_IDE_CHANNEL_RECORD 9 �[ PPROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION 6 �[ PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY �[ PPLUGPLAY_APC_ROUTINE . PLOGBRUSH *Y LPIMEMENUITEMINFOW ( �[ _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR �[ PXSAVE_FEATURE << IMAGE_FUNCTION_ENTRY .9 PBITMAP �[ PKLDR_DATA_TABLE_ENTRY32 J( tagCREATESTRUCTW DATEFMT_ENUMPROCEXW Z _MUTANT_OWNER_INFORMATION T HTOUCHINPUT__ u _RTL_BALANCED_NODE Z _GROUP_RELATIONSHIP L! EMRWIDENPATH " �[ PFILE_NUMA_NODE_INFORMATION # �[ PSYSTEM_VHD_BOOT_INFORMATION Z _CM_PCCARD_DEVICE_DATA [ _IMAGE_POLICY_ENTRY �5 _FILE_NAMES_INFORMATION w= _PSFEATURE_OUTPUT " R DRIVER_VERIFIER_THUNK_PAIRS 7 TIME_FIELDS ' }[ PSYSTEM_ACTIVITY_MODERATION_INFO fR tagRGBQUAD ! COLOR16 ( KB _PERFINFO_DRIVER_COMPLETE_REQUEST , {[ PPERFINFO_DRIVER_COMPLETE_REQUEST_RET # � RTL_WORK_ON_BEHALF_TICKET_EX � LPHANDLE �* CREATESTRUCT x[ PIMAGE_VXD_HEADER B PROCESSINFOCLASS ( b FILE_FS_METADATA_SIZE_INFORMATION '* TP_TIMER " CALTYPE w[ PKHETERO_CPU_POLICY v[ IELF_HANDLE % u[ PSYSTEM_SECUREBOOT_INFORMATION �< CBT_CREATEWND + � TRANSACTIONMANAGER_INFORMATION_CLASS
D STRING '! RPC_STRING p PCHAR r[ PMOVE_FILE_RECORD_DATA 4 q[ PRTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY " J TXFS_GET_TRANSACTED_VERSION �& _SD_GLOBAL_CHANGE_OUTPUT p[ LPENCLAVE_TARGET_FUNCTION k8 _WMI_PUSHLOCK ) _RTL_PROCESS_BACKTRACE_INFORMATION 2 �< SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION l[ PRETRIEVAL_POINTER_BASE j[ PPO_WAKE_SOURCE_HEADER �0 ENCLAVE_CREATE_INFO_VBS a FILE_BASIC_INFO i[ PDLL_INIT_ROUTINE ! 2 _WMI_DISKIO_READWRITE_INIT & g[ PSL_APPX_CACHE_VALUE_DESCRIPTOR ! ( PRTL_UMS_THREAD_INFO_CLASS ,# RTL_CRITICAL_SECTION32 l _DEVICE_POWER_STATE �9 _MULTI_TIME $ f[ PJOBOBJECT_JOBSET_INFORMATION % e[ PPROCESS_ENERGY_TRACKING_STATE + d[ PRPC_HTTP_TRANSPORT_CREDENTIALS_V2_W c[ PWMI_FILE_IO ) � PETW_COVERAGE_SAMPLER_OPTION_FLAGS ) b[ PGET_FILTER_FILE_IDENTIFIER_OUTPUT # a[ PPROCESS_SESSION_INFORMATION " `[ PFSCTL_OFFLOAD_WRITE_OUTPUT & b) _PERFINFO_PPM_PERF_STATE_CHANGE # 7 _PERFINFO_MEMORY_INFORMATION �Z OBJECT_TYPE_INFORMATION � SYSTEM_BIGPOOL_ENTRY UR WINSTAENUMPROCW 8 �9 _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION ) _[ PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX �* PEMRSETBRUSHORGEX ^[ PETW_RT_EVENT_LOSS 6 \[ JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 ) Y[ PSTREAMS_ASSOCIATE_ID_INPUT_BUFFER ( �4 SYSTEM_POWER_STATE_DISABLE_REASON 3 EMRFRAMERGN �9 _PERFINFO_FILE_CREATE e RTL_HEAP_ENTRY �( _DCB . X[ PFILE_NETWORK_PHYSICAL_NAME_INFORMATION . W[ PTRANSACTIONMANAGER_LOGPATH_INFORMATION �# _ENUM_SERVICE_STATUSA �- _RTL_BALANCED_LINKS V[ LPEXIT_THREAD_DEBUG_INFO 8 _NTFS_STATISTICS_EX 7 �C _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION �E _EVENTSFORLOGFILE U[ LPLAYERPLANEDESCRIPTOR .$ NPREGISTERWORDA O% PCUWCHAR ' �# _SYSTEM_DPC_BEHAVIOR_INFORMATION $ T[ PKEY_OPEN_SUBKEYS_INFORMATION 1 S[ PEVENT_TRACE_LBR_CONFIGURATION_INFORMATION v. NPDEVMODEA � _GUID # Q[ _PROCESSOR_POWER_INFORMATION % N[ PINVERTED_FUNCTION_TABLE_ENTRY $A _EVENT_FILTER_DESCRIPTOR M[ PKLDR_DATA_TABLE_ENTRY64 ' oF _IO_COMPLETION_INFORMATION_CLASS L[ PETW_CANCEL_KTIMER2_EVENT ! y; _PERFINFO_PO_NOTIFY_DEVICE ) q? _JOBOBJECT_CONTAINER_IDENTIFIER_V2 � FILE_DISPOSITION_INFO_EX " �U ETW_COVERAGE_SAMPLER_SAMPLE �R PALTTABINFO �9 _CM_SERIAL_DEVICE_DATA �% INIT_ONCE K[ LPAUDIODESCRIPTION pZ PWMI_DISKIO_FLUSH_BUFFERS �A _RPC_SECURITY_QOS_V5_A : Q! RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME ^' EMRPOLYTEXTOUTA �" PROCESS_LEAP_SECOND_INFO J[ PEMRRESTOREDC � SUITE_TYPE � tagBITMAPINFO p LPCH ! �B PO_SPR_ACTIVE_SESSION_DATA % I[ PSYSDBG_LIVEDUMP_CONTROL_FLAGS �: FILE_STORAGE_INFO p0 PROCESS_HEAP_ENTRY " STARTUPINFOA �) MDICREATESTRUCTA � SID_AND_ATTRIBUTES_HASH ! % CM_EXTENDED_PARAMETER_TYPE H[ PTP_DIRECT_CALLBACK G[ PIO_STATUS_BLOCK ) F[ PFILE_ID_GLOBAL_TX_DIR_INFORMATION �+ CM_PARTIAL_RESOURCE_LIST �G TP_POOL_STACK_INFORMATION RPC_INTERFACE_GROUP ! E[ PPERFINFO_SET_POWER_ACTION $ x) _PERFINFO_FILE_PATH_OPERATION � _FILE_MODE_INFORMATION �R LPPROCESS_INFORMATION �? UUID_VECTOR JS NETCONNECTINFOSTRUCT I& _SPARSE_OVERALLOCATE_DATA oB HTASK__ �Q tagEMRMASKBLT ) �4 KEY_SET_VIRTUALIZATION_INFORMATION ! �4 _EISA_MEMORY_CONFIGURATION AW LPRID_DEVICE_INFO � _LARGE_INTEGER ) �% WIM_PROVIDER_SUSPEND_OVERLAY_INPUT �A _SYSDBG_BUS_DATA & D[ PMANAGE_HOT_PATCH_QUERY_PATCHES ! JW SYSTEM_POWER_LOGGING_ENTRY J B[ ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL - @[ PFSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER " ?[ PSE_PACKAGE_CAPABILITY_INFO ? EMRCOLORCORRECTPALETTE % >[ _PIMAGE_RUNTIME_FUNCTION_ENTRY �+ _TOKEN_ELEVATION_TYPE � _WNF_DATA_SCOPE " �B MANAGE_HOT_PATCH_LOAD_PATCH ( <[ EVENT_EXTENDED_ITEM_STACK_TRACE32 �U SECURITY_SEED_AND_LENGTH S GDI_HANDLE_BUFFER32 e RTL_FEATURE_ENABLED_STATE o@ TP_DEBUG_FREE_INFO ! �" _WMI_IMAGEID_INFORMATION64 S _SYSTEM_POWER_STATE ?X _OPERATION_END_PARAMETERS & {W _FILE_PROVIDER_EXTERNAL_INFO_V0 �C PEVENTMSGMSG 9[ POBJECT_ATTRIBUTES �- _VM_COUNTERS_EX �* _FOCUS_EVENT_RECORD # 7[ _ETW_DISKIO_FLUSH_BUFFERS_V2 �4 COVERAGE_REQUEST_CODES - 2[ PSERVICE_CONTROL_STATUS_REASON_PARAMSW & S@ _PS_CPU_QUOTA_QUERY_INFORMATION �D _RPC_SERVER_INTERFACE
0[ HKEY__
�Y HPEN__ Y RPC_SECURITY_QOS_V2_A �@ PETW_DISKIO_READWRITE_V3 -[ PBATTERY_REPORTING_SCALE �T _FILE_FULL_DIR_INFO W tagLAYERPLANEDESCRIPTOR ,[ PPERFINFO_FILE_CREATE PROC_THREAD_ATTRIBUTE_NUM 0 tagSCROLLBARINFO " CLONG � HANDLER_FUNCTION_EX % � _WORKER_FACTORY_CALLBACK_CLASS boolean 0 +[ PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + �$ _HEAP_OPTIMIZE_RESOURCES_INFORMATION ,
_PERFINFO_CLOCK_INTERRUPT_INFORMATION *[ PTOKEN_DEFAULT_DACL ( 10 _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE �9 tagCHANGEFILTERSTRUCT �" _ETW_OBJECT_TYPE_EVENT * dV ETW_TP_EVENT_WORKER_NUMANODE_SWITCH . �& _SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE ([ RTL_RVA_LIST
gY HRGN__ * �7 _SYSTEM_LOW_PRIORITY_IO_INFORMATION %[ PACL_SIZE_INFORMATION �Y FILESYSTEM_STATISTICS_EX $[ DLL_INIT_ROUTINE % {W FILE_PROVIDER_EXTERNAL_INFO_V0 " "[ PCLDR_DLL_NOTIFICATION_DATA �Y _FILE_NAME_INFO + tagMDINEXTMENU ' �V SYSTEM_LEGACY_DRIVER_INFORMATION # �T _PROCESS_LOGGING_INFORMATION �C THREAD_TLS_INFORMATION & oF IO_COMPLETION_INFORMATION_CLASS + /Y SYSTEM_VERIFIER_COUNTERS_INFORMATION ' =0 _PLUGPLAY_CONTROL_CONFLICT_ENTRY 1 : TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT n+ LPOSVERSIONINFOEXW - �4 SYSTEM_SESSION_MAPPED_VIEW_INFORMATION 5 WIN32_STREAM_ID 47 PS_MEMORY_RESERVE W@ tagMENUITEMINFOW �# _SERVICE_TIMECHANGE_INFO �* SHUTDOWN_ACTION �X HACCEL__ ![ LPOVERLAPPED �> LPDLGITEMTEMPLATEW k: LPRECONVERTSTRING ! [ PIMAGE_RESOURCE_DATA_ENTRY 5? SYSTEM_ACCESS_FILTER_ACE �U ETW_KQUEUE_ENQUEUE_EVENT = USN_JOURNAL_DATA � _KEY_INFORMATION_CLASS ", NPLOGPEN �, EMRANGLEARC ' _RESUME_PERFORMANCE , [ PSYSTEM_INTERRUPT_CPU_SET_INFORMATION [ PCLDR_DATA_TABLE_ENTRY 1 �T _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION �8 RTL_DEBUG_INFORMATION ' [ PIMAGE_CE_RUNTIME_FUNCTION_ENTRY [ PPPM_WMI_PERF_STATE [ HRSRC__ [ PMENUGETOBJECTINFO , � _PROCESS_EXTENDED_BASIC_INFORMATION64 x? _OSVERSIONINFOEX2A " � ETW_DFSS_START_NEW_INTERVAL � _EVENT_DESCRIPTOR �6 _FILE_LEVEL_TRIM $ �R NTPSS_MEMORY_BULK_INFORMATION % [ WIN32_MEMORY_INFORMATION_CLASS , [ PFILE_IO_PRIORITY_HINT_INFORMATION_EX
X VCN_RANGE_INPUT_BUFFER ) � _TRACE_PERIODIC_CAPTURE_STATE_INFO
�R _FP_32 % �B _POWER_THROTTLING_THREAD_STATE ) [ PSYSTEM_PREFETCH_PATCH_INFORMATION ) [ PJOBOBJECT_BASIC_LIMIT_INFORMATION PPS_APC_ROUTINE IG EVENT_EXTENDED_ITEM_TS_ID 4 [ PFSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE �# tagWINDOWINFO �* GET_FILEEX_INFO_LEVELS �E EMREXCLUDECLIPRECT [ PPO_WAKE_SOURCE_FIXED # �C JOURNAL_ABSOLUTE_INFORMATION � LOCALE_ENUMPROCA ! wchar_t ( E SERVICE_REQUIRED_PRIVILEGES_INFOA #
[ PPERFINFO_PO_SESSION_CALLOUT �9 MEMORY_EXHAUSTION_TYPE �Z COMMCONFIG . d8 _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT ( [ PETW_TIMER_EXPIRATION_START_EVENT �: RTLP_TAG_INFO / �B EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION . [ PJOBOBJECT_CPU_RATE_CONTROL_INFORMATION
[ PRTL_AVL_FREE_ROUTINE # �& _ETW_TP_EVENT_CALLBACK_START � _PERFINFO_HV_HYPERCALL �T _PERFINFO_IO_TIMER ) �> PERFINFO_SESSIONCREATE_INFORMATION 2 �. FILE_IO_COMPLETION_NOTIFICATION_INFORMATION u RTL_FEATURE_ID [ PRTL_OKAY_TO_LOCK_ROUTINE $ a' ACTIVATION_CONTEXT_INFO_CLASS ! [ PFILE_POSITION_INFORMATION ( [ PRPC_HTTP_TRANSPORT_CREDENTIALS_W sU WMI_IRQ_RECORD # � _REQUEST_OPLOCK_INPUT_BUFFER [ PPACKEDEVENTINFO x? OSVERSIONINFOEX2 �D _RTL_SPARSE_BITMAP_CTX n ICONMETRICSA * rR PERFINFO_PAGECOMBINE_ITERATION_STAT * [ PFILE_VALID_DATA_LENGTH_INFORMATION �% QUERY_FILE_LAYOUT_INPUT + [ PSYSTEM_KERNEL_VA_SHADOW_INFORMATION - � SYSTEM_CODEINTEGRITYPOLICY_INFORMATION [ PSYSDBG_MSR �A CONNECTDLGSTRUCT 1R KEY_LAYER_INFORMATION ); READ_USN_JOURNAL_DATA
q LPWORD % Z _THREAD_POWER_THROTTLING_STATE dF WNODE_HEADER /< _KERNEL_USER_TIMES �Z PWINDOWPLACEMENT " [ PALPC_WORK_ON_BEHALF_TICKET # [ PTXFS_GET_TRANSACTED_VERSION �Z LPCIEXYZ �D SECTION_IMAGE_INFORMATION �* PEMRSETVIEWPORTORGEX ! �X _PERFINFO_WORKINGSET_ENTRY �, IMAGE_COFF_SYMBOLS_HEADER ( �Z PLOOKUP_STREAM_FROM_CLUSTER_ENTRY 7 �Z PSYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION :0 RTL_STACK_CONTEXT �@ ETW_DISKIO_READWRITE_V3 PRUNTIME_FUNCTION * _COPYFILE2_COPY_PHASE $ a _FILE_STORAGE_TIER_MEDIA_TYPE ;' _DISPLAY_DEVICEW & �Z PRTL_PROCESS_MODULE_INFORMATION 2 �, JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V1 c% WMI_REGISTRY � _ETW_KQUEUE_DEQUEUE_EVENT �" PROCESS_HEAP_INFORMATION �Z _OBJECT_TYPE_INFORMATION �& COUNTER_READING $ �Z PTXFS_CREATE_MINIVERSION_INFO ( �Z SYSTEM_PREFETCH_PATCH_INFORMATION ! �Z PETW_DISABLE_KTIMER2_EVENT �Z PSYSTEM_POOL_INFORMATION E NPPOLYTEXTW g% STACK_WALK_EVENT_DATA & �' _SYSTEM_VERIFIER_INFORMATION_EX �! EMRMOVETOEX # � ETW_PROCESS_HANDLE_INFO_TYPE �Z PRETRIEVAL_POINTER_COUNT �Z PETW_POOL_EVENT � SE_AUDIT_OPERATION �Z PGENERATE_NAME_CONTEXT �Z PETW_HEAP_EVENT_FREE 0& PRTL_RESOURCE_DEBUG64 " \ SE_WS_APPX_SIGNATURE_ORIGIN " �Z PPROCESS_UPTIME_INFORMATION �X _IMAGE_OPTIONAL_HEADER64 * nD _TOKEN_SECURITY_ATTRIBUTE_OPERATION �Z PTHREAD_WORKLOAD_CLASS ! .2 SYSTEM_ERROR_PORT_TIMEOUTS �9 LPCANDIDATELIST \ _SE_TOKEN_USER . '< _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION \ _IRQ_PRIORITY % �> _PERFINFO_FLT_OPERATION_STATUS % �Y MEMORY_COMBINE_INFORMATION_EX2 �Z PWMI_RESOURCE 4. THREAD_NAME_INFORMATION �Z PTP_DIRECT ' #C _RTL_IMAGE_MITIGATION_DEP_POLICY �Z PMARK_HANDLE_INFO _WOW64_FUNCTION_CODE64 �! LDR_DDAG_NODE �3 PERFINFO_CC_FLUSH_SECTION �+ QUAD 5 _FILE_STORAGE_TIER_CLASS % ZY FSCTL_QUERY_REGION_INFO_OUTPUT 0 �Z PSYSTEM_FEATURE_CONFIGURATION_INFORMATION �6 FILE_ID_EXTD_DIR_INFO D ANSI_STRING
�Z PFP_32 " *D _TXFS_GET_METADATA_INFO_OUT ! �< _CONTAINER_ROOT_INFO_INPUT ) b _FILE_FS_METADATA_SIZE_INFORMATION EMRSETSTRETCHBLTMODE �, _REARRANGE_FILE_DATA �Z LPSTARTUPINFOA �Z PCONSOLE_SELECTION_INFO # �& _FILE_COMPLETION_INFORMATION % �U _COMPATIBILITY_CONTEXT_ELEMENT w5 SCRUB_PARITY_EXTENT_DATA * � _PERFINFO_FILENAME_SAME_INFORMATION "
A _IMAGE_DYNAMIC_RELOCATION64 , �Z PSYSTEM_VERIFIER_COUNTERS_INFORMATION " �Z PCIMAGE_BOUND_FORWARDER_REF ( S: RTL_IMAGE_MITIGATION_OPTION_STATE ! \V WIM_PROVIDER_EXTERNAL_INFO + �Z PSYSTEM_NET_RATE_CONTROL_SET_CONTEXT $ �Z PSYSTEM_PROCESSOR_INFORMATION 1 �Z PCACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION �R NPEXTLOGPEN � _cpinfo
�Z PFIBER # 4@ _SEMAPHORE_BASIC_INFORMATION �$ REG_PROVIDER * �Z PETW_TRACE_PARTITION_INFORMATION_V2 5, _ETW_TP_EVENT_POOL_CREATE �T _BLENDFUNCTION + �- _SYSTEM_SYSTEM_PARTITION_INFORMATION �Z _COMMCONFIG ) �Z LPSERVICE_REQUIRED_PRIVILEGES_INFO � RPC_MESSAGE \< SYSTEM_HANDLE_INFORMATION � _TIME_ZONE_INFORMATION " � _HEAP_EVENT_COMMIT_DECOMMIT " � PERFINFO_PO_SESSION_CALLOUT ! �Z PNTFS_EXTENDED_VOLUME_DATA 9 _KTMOBJECT_TYPE �Z HINSTANCE $ �Z PGET_SYSTEM_WOW64_DIRECTORY_W & v _FILE_REPARSE_POINT_INFORMATION �Z OLDFONTENUMPROCW 4 MENUITEMINFOA
< _XSTATE_CONTEXT �< NEWTEXTMETRIC S NPOUTLINETEXTMETRICA # �Z PENCLAVE_INIT_INFO_VBS_BASIC f LPDIBSECTION �4 MSGBOXPARAMSW �Z PETW_CANCEL_TIMER_EVENT �E _CM_SCSI_DEVICE_DATA �Y FILE_NAME_INFO � _FILE_STAT_LX_INFORMATION �Z PUSN_JOURNAL_DATA_V1 ( �& PLUGPLAY_CONTROL_CONFLICT_STRINGS �Z PFILE_QUOTA_INFORMATION + �( PLUGPLAY_CONTROL_RELATED_DEVICE_DATA �Z PRTL_RXACT_OPERATION ' �Z PETW_ANTI_STARVATION_BOOST_EVENT 4 �1 _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION : _KCRM_MARSHAL_HEADER �+ LPSECURITY_CAPABILITIES ' �Z RTL_WALK_IMAGE_POLICIES_CALLBACK PLANGNAMEINDEX � NPTEXTMETRICA 4 'R PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY IO_PRIORITY_HINT �& _CONSOLE_FONT_INFO (A PERFINFO_BOOT_PHASE_START �X ALPC_DATA_VIEW_ATTR & �? _SL_APPX_CACHE_VALUE_DESCRIPTOR �Q SERVICE_DESCRIPTION a EFI_DRIVER_ENTRY_LIST � STORAGE_RESERVE_ID �Z PREFS_SMR_VOLUME_GC_STATE ) �Z PRTL_IMAGE_MITIGATION_SEHOP_POLICY �Z PPO_SLEEP_DISABLE_REASON �Z XSAVE_FORMAT [9 FILE_NAME_INFORMATION UV LPHARDWAREHOOKSTRUCT �Z PPOWER_IDLE_RESILIENCY ^ RTL_IMAGE_POLICY_METADATA �C _PS_ATTRIBUTE _D TP_DEBUG_CLASS ; �X _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY �B VM_COUNTERS_EX2 + �T _SYSTEM_FEATURE_CONFIGURATION_UPDATE � _HSM_OPCODE ( �Z PFILE_METADATA_OPTIMIZATION_STATE ! �Z PETW_NOTIFICATION_CALLBACK 2 �Z PSYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE � PENHMETAHEADER ' �@ RPC_BINDING_HANDLE_SECURITY_V1_A ! �D MEMORY_BASIC_INFORMATION32 * X2 _FILE_INITIATE_REPAIR_OUTPUT_BUFFER " GR _KEY_WRITE_TIME_INFORMATION �X NPIMEMENUITEMINFOA �C CSV_QUERY_FILE_REVISION �Z PFILE_PIPE_EVENT_BUFFER �% LOGCOLORSPACEA �# LOCALESIGNATURE 2 _HEAP_RANGE_LOG *W _RTL_BUFFER $ �Z PPO_INTERNAL_WAKE_SOURCE_TYPE �3 tagPOINTER_TOUCH_INFO �Z PRTL_DISK_SPEED_INFO ' E SERVICE_REQUIRED_PRIVILEGES_INFO ( � _IMAGE_LOAD_CONFIG_CODE_INTEGRITY �Z PRTL_MODULE_EXTENDED_INFO �; _PS_ATTRIBUTE_LIST �" _CSV_QUERY_MDS_PATH_V2 �< NETRESOURCEA �Z PRPC_SECURITY_QOS_V5_W �Z PENCRYPTED_DATA_INFO # �B _SHARED_VIRTUAL_DISK_SUPPORT ( �Z PSYSTEM_SINGLE_MODULE_INFORMATION H! GCP_RESULTS �Z PTP_TIMER �Z HDESK 1 �Z PEVENT_TRACE_IPT_CONFIGURATION_INFORMATION " SA FILE_PROVIDER_EXTERNAL_INFO V# PVIDEOPARAMETERS
TEB ' N3 FILE_FS_FULL_SIZE_INFORMATION_EX �Z LPDOCINFOW ! �Z PFILE_TRACKING_INFORMATION �C tagEMRFILLPATH �# ENUM_SERVICE_STATUSA ! �. PERFINFO_MEMORY_NODE_ENTRY ! �& ETW_TP_EVENT_CALLBACK_STOP $ �X PERFINFO_CC_WORKITEM_COMPLETE
$, LOGPEN ! W SYSTEM_MEMORY_LIST_COMMAND # �Z RTL_RETPOLINE_CHECK_FUNCTION �Z PETW_STACK_CACHING_CONFIG � TIMER_TYPE �& _TOKEN_MANDATORY_LABEL �Z PLDR_FAILURE_DATA B EMREXTCREATEFONTINDIRECTW rA PO_WAKE_SOURCE_INFO 4 ! _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION 5 �% RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY �> NPPELARRAY ?E ETW_CRITSEC_EVENT_INIT * SE _JOBOBJECT_MEMORY_USAGE_INFORMATION $ yX _ENLISTMENT_BASIC_INFORMATION �Z PINIT_ONCE_FN B _WMI_TCPIP _U WMI_WAIT_MULTIPLE ) �Q PROCESS_EXTENDED_BASIC_INFORMATION �R _PROCESS_INFORMATION �Z LANGUAGEGROUP_ENUMPROCA 2 �Z PACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 0 RTL_LFG_RNG_STATE % PEMRARC _LIST_ENTRY 3 ! SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION ! WORD ?! EMRSETVIEWPORTORGEX " M> _SYSTEM_POWER_STATE_CONTEXT �Z PWMI_WAIT_OBJECT_RECORD " # ETW_COVERAGE_SAMPLER_HANDLE ( �Z PLEARNING_MODE_OBJECT_INFORMATION
7 IMECHARPOSITION �Z PRPC_SECURITY_QOS_V2_W �Z WMI_RESOURCE > UNICODE_STRING " �Z LDR_CREATE_ACT_CTX_LANGUAGE �" _BUS_DATA_TYPE # @& _SYSTEM_VERIFIER_INFORMATION �Z GOBJENUMPROC , �Z PRTL_FEATURE_USAGE_SUBSCRIPTION_TABLE �) _MAT2 �8 _RPC_SECURITY_QOS_V5_W �U EMRCREATEPALETTE $ �Z PFILE_END_OF_FILE_INFORMATION . �5 _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION _V LOAD_DLL_DEBUG_INFO % GV _EVENT_EXTENDED_ITEM_EVENT_KEY + �) PERFINFO_SAMPLED_PROFILE_INFORMATION * 2* _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX # �Z PETW_TP_EVENT_CALLBACK_START ! }F SE_PACKAGE_CAPABILITY_INFO �Z PWIN32_MEMORY_RANGE_ENTRY �Q EMRSETCOLORADJUSTMENT c: ALPC_BASIC_INFORMATION C _RTL_TRACE_BLOCK RPC_SS_THREAD_HANDLE �9 _MEMORY_EXHAUSTION_TYPE �Z PAXISINFO �' EMRPOLYLINE16 & �9 _PERFINFO_PPM_IDLE_STATE_CHANGE � VRF_RULE_CLASS_ID H WMI_SPINLOCK p; _ETW_HEAP_EVENT_COMMON $ u/ FILE_SFIO_RESERVE_INFORMATION ' �Z PFILE_MAILSLOT_QUERY_INFORMATION �Q _CSV_QUERY_MDS_PATH �9 _EISA_MEMORY_TYPE Y _ETW_CANCEL_TIMER_EVENT .U _RTL_PHYSICAL_MEMORY_INFO ,C USEROBJECTFLAGS �Z LPWINDOWPLACEMENT ! �Y _SEC_WINNT_AUTH_IDENTITY_W �% PEMRSELECTCOLORSPACE & �+ _IMAGE_RESOURCE_DIRECTORY_ENTRY �Z PTHREAD_START_ROUTINE ! �Z PFSCTL_OFFLOAD_WRITE_INPUT / DG MEMORY_PARTITION_INITIAL_ADD_INFORMATION & $ ETW_PARTITION_INFO_EXTENSION_V2 �Z PMEM_ADDRESS_REQUIREMENTS �Z PCM_PCCARD_DEVICE_DATA �0 _PERFINFO_PROCESS_INSWAP ' �Z PIO_COMPLETION_BASIC_INFORMATION �3 EVENT_FILTER_EVENT_NAME �T _ETW_WNF_EVENT_PUBLISH �Z PSE_IMAGE_SIGNATURE_TYPE �Z PFILE_ID_EXTD_DIR_INFO LPMENUTEMPLATE u PEN_MASK � tagPOINTER_TYPE_INFO
�Z PFP_64 �C _THREAD_TLS_INFORMATION \( HELPWININFO $ �Z PSYSTEM_INTERRUPT_INFORMATION & �Z PFSCTL_UNMAP_SPACE_INPUT_BUFFER - Z PWMI_JOB_SEND_NOTIFICATION_INFORMATION & ~/ _PERFINFO_SET_DEVICES_STATE_RET ~Z PRTL_HASH_ENTRY }Z PCONDITION_VARIABLE �# NEWTEXTMETRICW |Z PWMI_DELAY_EXECUTION " � _IMAGE_DELAYLOAD_DESCRIPTOR �$ DMA_WIDTH V COUNTED_REASON_CONTEXT {Z PRTL_ENCLAVE_LAUNCH_TOKEN 4 LPINPUT 0 zZ PJOBOBJECT_LIMIT_VIOLATION_INFORMATION_V1
]2 tagMSG yZ PETW_TP_EVENT_POOL_CLOSE aS FILE_LEVEL_TRIM_OUTPUT * vZ PSYSTEM_MEMORY_TOPOLOGY_INFORMATION kE WMI_TRACE_MESSAGE_PACKET �F PMUIREGISTRYINFO #! _WMI_JOB_INFORMATION $ )F _WOW64_DESCRIPTOR_TABLE_ENTRY P6 _TOKEN_SOURCE % @ _FSCTL_QUERY_REGION_INFO_INPUT �* CREATESTRUCTA " � KEY_WOW64_FLAGS_INFORMATION w2 _CM_COMPONENT_INFORMATION z< EVENT_TRACE_LOGFILEA % r _INVERTED_FUNCTION_TABLE_ENTRY % 3Z PROCESS_CYCLE_TIME_INFORMATION SU _QUOTA_LIMITS_EX / uZ PFSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT & tZ PJOURNAL_RENAME_KEY_INFORMATION +7 _MENU_EVENT_RECORD # �V _ETW_CRITSEC_EVENT_COLLISION " � _FILE_FS_VOLUME_INFORMATION + �V RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE � _GROUP_AFFINITY
? PO_WAKE_SOURCE_DEVICE A COMM_FAULT_OFFSETS sZ PFIND_BY_SID_DATA rZ PPERFINFO_PROCESS_INSWAP + eZ _PROCESS_SECURITY_DOMAIN_INFORMATION kY LPKEYBDINPUT qZ PPS_ATTRIBUTE_LIST # pZ PETW_DISKIO_FLUSH_BUFFERS_V3 ( �@ ETW_COVERAGE_SAMPLER_BLOOM_FILTER ) oZ PRESOURCEMANAGER_BASIC_INFORMATION ' �A _IR_TIMER_EXTRA_CREATE_PARAMETER PDLL_DIRECTORY_COOKIE � FILE_ID_INFO nZ WMIDPREQUEST 2 WMI_DISKIO_READWRITE_INIT �< TOKEN_STATISTICS �R _FILE_REGION_INPUT * �$ HEAP_OPTIMIZE_RESOURCES_INFORMATION �S TEB_ACTIVE_FRAME_EX kZ PRTL_SPARSE_BITMAP_CTX jZ PFILE_END_OF_FILE_INFO ) N< _PERFINFO_KERNELMEMORY_RANGE_USAGE 3( IMAGE_SECTION_HEADER iZ PEMRGLSBOUNDEDRECORD hZ PPROCESSOR_IDLE_HANDLER 2 �X SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX � _RASTERIZER_STATUS r PLDR_SERVICE_TAG_RECORD kD HUMPD__ gZ PLUTF8_STRING + cZ PPROCESS_SECURITY_DOMAIN_INFORMATION " \- PROCESSOR_POWER_POLICY_INFO �Q _THREAD_BASIC_INFORMATION a= FONTSIGNATURE ! aZ PETW_THREAD_AFFINITY_EVENT & ]Z PFILE_STANDARD_LINK_INFORMATION $ xB BOOT_ENTROPY_SOURCE_NT_RESULT �6 FILE_LEVEL_TRIM b5 SERVICE_NODE_TYPE ! �? _FILE_BOTH_DIR_INFORMATION ! �F tagEMRMODIFYWORLDTRANSFORM �9 MOF_FIELD V _DISPATCHER_CONTEXT_ARM64 & 6+ SYSTEM_POOL_ZEROING_INFORMATION G SERVICE_DIRECTORY_TYPE ! _TRACE_ENABLE_CONTEXT_EX - 5 _SYSTEM_ISOLATED_USER_MODE_INFORMATION [Z PEMREXTCREATEPEN , ZZ PACTIVATION_CONTEXT_BASIC_INFORMATION �4 DATEFMT_ENUMPROCEXA $ STYLEBUF & �@ PERFINFO_WORKINGSET_INFORMATION ! > _RTL_RETPOLINE_BINARY_INFO YZ LPNEWTEXTMETRIC XZ SENDASYNCPROC 6! SID_AND_ATTRIBUTES * UZ PFILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER % S@ PS_CPU_QUOTA_QUERY_INFORMATION - B< SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER �5 MUILANGCFGLIST �B SYSTEM_VDM_INSTEMUL_INFO $ M; SYSTEM_PROCESS_ID_INFORMATION ' �3 _ETW_TRACE_PARTITION_INFORMATION IC _IMAGE_DEBUG_DIRECTORY TZ PSE_AUDIT_OPERATION ' SZ PRTL_FEATURE_CONFIGURATION_TABLE ) � _SYSTEM_SECURITY_MODEL_INFORMATION �* _ENCLAVE_LOAD_INFO_VBS V* DRAWITEMSTRUCT R UNWIND_HISTORY_TABLE � _MIDL_FORMAT_STRING % U SYSTEM_PROCESS_TRUST_LABEL_ACE � CURRENCYFMTA
_SID_NAME_USE �* OUTLINETEXTMETRICW �= IMAGE_DEBUG_MISC # (Y FILE_STANDARD_INFORMATION_EX , 9/ VIRTUALIZATION_INSTANCE_INFO_INPUT_EX " RZ PADMINISTRATOR_POWER_POLICY QZ PSLIST_HEADER �9 PLOGFONTA
�* HIMC__ � PHYSICAL_ADDRESS * ^7 SYSTEM_ACTIVITY_APP_MODERATION_TYPE PZ RTL_AVL_ALLOCATE_ROUTINE 3 � PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION ) X2 FILE_INITIATE_REPAIR_OUTPUT_BUFFER ? OZ PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY U TP_DIRECT �= POINTER_PEN_INFO hA ETW_NOTIFICATION_HEADER ) y" _MEMORY_PARTITION_NODE_INFORMATION �F _RIP_INFO �/ tagPIXELFORMATDESCRIPTOR � REMOTE_NAME_INFOW * NZ PPERFINFO_DPC_EXECUTION_INFORMATION �= _OBJECTID �6 _PORT_DATA_INFORMATION �E PCUNZTCH * �> SYSTEM_CRASH_DUMP_STATE_INFORMATION MZ PBITMAPCOREINFO ( iB WMI_EXTENDED_THREAD_INFORMATION64 O% PCUWSTR �' POWER_USER_PRESENCE LZ PPERFINFO_DEBUG_EVENT �X PMETAHEADER KZ LPDLGITEMTEMPLATE 7 LPIMECHARPOSITION �3 _RTL_HEAP_TAG_INFO JZ LPFNDEVMODE A LPDESIGNVECTOR GZ LPMDICREATESTRUCTA _CHAR_INFO �A LPNETRESOURCE � SID_AND_ATTRIBUTES_ARRAY �S NTFS_STATISTICS / 53 SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS SERVICE_STATUS_HANDLE__
p PNZTCH FZ PIMAGE_SYMBOL_EX ` PS_MITIGATION_OPTION " IE PRTL_CRITICAL_SECTION_DEBUG [6 _HARDWARE_COUNTER # EZ PPROCESS_LOGGING_INFORMATION DZ PKCONTINUE_TYPE CZ LPOSVERSIONINFOEX 9, _IMAGE_POLICY_ENTRY_TYPE ) BZ PETW_TP_EVENT_TIMER_CANCEL_NTTIMER # @Z _ENCLAVE_INIT_INFO_VBS_BASIC �$ HCURSOR , NPRGNDATA =Z LPSTYLESTRUCT <Z CS_TAG_GETTING_ROUTINE + ;Z PPERFINFO_PAGECOMBINE_ITERATION_STAT : _PERFINFO_PROCESS_PERFCTR ' :Z PPLUGPLAY_CONTROL_CONFLICT_ENTRY 9Z PMOFRESOURCEINFOA ! K/ PERFINFO_SET_DEVICES_STATE ' � _ETW_COVERAGE_SAMPLER_QUERY_INFO 8Z PCOUNTER_READING / 7Z PFILE_PROCESS_IDS_USING_FILE_INFORMATION 6Z PAPPCONTAINER_SID_TYPE �* POUTLINETEXTMETRICW 5Z PEMRINTERSECTCLIPRECT F _TOKEN_INFORMATION_CLASS & 1Z PPROCESS_CYCLE_TIME_INFORMATION & /Z PNTFS_FILE_RECORD_OUTPUT_BUFFER .Z PPERFINFO_FILE_DIRENUM -Z PCURDIR ,Z PBOOT_ENTRY & �Y _MEMORY_COMBINE_INFORMATION_EX2 e" SECURITY_DESCRIPTOR �Y LDR_FAILURE_DATA �; RATE_QUOTA_LIMIT +Z HHOOK # B _ALPC_PORT_INFORMATION_CLASS �5 FILE_NAMES_INFORMATION *Z PEVENTLOGRECORD % mW _IMAGE_BOUND_IMPORT_DESCRIPTOR ;V MCI_STATS �/ GDI_TEB_BATCH $ )Z PSYSTEM_REF_TRACE_INFORMATION * �= _PERFINFO_DPC_EXECUTION_INFORMATION (Z PIMAGE_OPTIONAL_HEADER64 �& LINK_TRACKING_INFORMATION 'Z PRPC_ENDPOINT_TEMPLATEA * &Z PPERFINFO_PO_CALIBRATED_PERFCOUNTER %Z PWOW64_FLOATING_SAVE_AREA " � _RTL_CRITICAL_SECTION_DEBUG $Z PPPM_WMI_PERF_STATES_EX #Z PQUOTA_LIMITS_EX ( e _PROCESS_TELEMETRY_ID_INFORMATION : _REDIRECTION_DESCRIPTOR "Z PEMR 6 !Z LDR_LOADED_MODULE_ENUMERATION_CALLBACK_FUNCTION u FILE_REGION_INFO Z PGROUP_RELATIONSHIP �, _NLSTABLEINFO % a' _ACTIVATION_CONTEXT_INFO_CLASS * Z PSYSTEM_EXTENDED_THREAD_INFORMATION $ �U COMPATIBILITY_CONTEXT_ELEMENT ' � JOB_OBJECT_IO_RATE_CONTROL_FLAGS F _SYSTEM_POOLTAG Z LPSERIALKEYSA Z PFILE_PIPE_INFORMATION ' -S PERFINFO_MEMORY_NODE_INFORMATION % �< _SE_SET_FILE_CACHE_INFORMATION 5 Z PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION $ Z THREAD_POWER_THROTTLING_STATE b2 _LDR_DATA_TABLE_ENTRY64 ) Z PFILE_IO_PRIORITY_HINT_INFORMATION Z PSYSDBG_COMMAND # r PROCESS_TLS_INFORMATION_TYPE ) R _GET_FILTER_FILE_IDENTIFIER_OUTPUT Z PRC_CONFIG
� UOW # ENUM_SERVICE_STATUS_PROCESSA Z PRPC_PROTSEQ_ENDPOINT �T _IMAGE_VXD_HEADER �: _USER_ACTIVITY_PRESENCE Z PXSAVE_POLICY , Z PPLUGPLAY_CONTROL_INTERFACE_LIST_DATA > DROPSTRUCT ( _POWER_STATE_TYPE Z CM_PCCARD_DEVICE_DATA ) AR VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT 8. _HEAP_RANGE_DESTROY # Z PMEM_EXTENDED_PARAMETER_TYPE Z PRGNDATAHEADER �Y tagEMRTEXT PEMRSETICMMODE Z PETW_HEAP_EVENT_EXPANSION Z _GENERIC_MAPPING / y> TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY �# _WORKERFACTORYINFOCLASS Z PBITMAPFILEHEADER �F CPINFOEXA � _HIBERFILE_BUCKET G PKCRM_PROTOCOL_BLOB �8 ACTCTXW �Y PPROCESSOR_IDLESTATE_INFO " �Y LPCREATE_PROCESS_DEBUG_INFO �Y PEMRROUNDRECT �Y PTOUCH_HIT_TESTING_INPUT . WNF_STATE_NAME_LIFETIME 2 : _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT �Y PPROCESS_TLS_INFORMATION & �Y _RTL_USER_PROCESS_INFORMATION64 �= RPC_BINDING_VECTOR ! �Y PSEC_WINNT_AUTH_IDENTITY_W �Y PIMAGE_TLS_DIRECTORY32 ) ^: _REMOTE_LINK_TRACKING_INFORMATION_ . ^) _SYSTEM_THREAD_CID_PRIORITY_INFORMATION ! UHALF_PTR �Y LPOSVERSIONINFOEX2 �; EMROFFSETCLIPRGN � EMRPOLYGON �Y PEMRGLSRECORD ! : _PERFINFO_SET_POWER_ACTION * �Y PTXFS_LIST_TRANSACTION_LOCKED_FILES 06 SD_ENUM_SDS_OUTPUT oT _ETW_CLOCK_TIME_UPDATE �Y _PACKEDEVENTINFO ) �0 _FINDFIRSTACTIVATIONCONTEXTSECTION � LPWIN32_FIND_DATAA " � SEMAPHORE_INFORMATION_CLASS �# PLOCALESIGNATURE � OBJECT_INFORMATION_CLASS �R _RTL_ELEVATION_FLAGS �Y PFILE_NAME_INFO \$ RTL_AVL_TABLE k$ _APPCONTAINER_SID_TYPE �Y PRTL_STACK_CONTEXT_ENTRY ,> PUNICODE_STRING * r= _MIDL_WINRT_TYPE_SERIALIZATION_INFO ! �Y PLINK_TRACKING_INFORMATION # C2 CM_EISA_FUNCTION_INFORMATION $ r _PROCESS_TLS_INFORMATION_TYPE # � _PROCESS_BASIC_INFORMATION64 �Y DLGPROC �Y NPPOLYTEXT �Y PFXSAVE_FORMAT 4 !# _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION �R _RTL_RVA_LIST_ITERATOR �Y PLDR_DATA_TABLE_ENTRY32 �Y PWMI_JOB_REMOVE_PROCESS Q _WMI_FILE_IO aF FP_IEEE_VALUE �Y HPEN . tagCHARSETINFO % �Y PPERFINFO_SET_POWER_ACTION_RET % 8V _PROCESS_MITIGATION_DEP_POLICY �' tagEMRCREATECOLORSPACEW �Y LPSOUNDSENTRYA l2 ETW_HEAP_EVENT_ALLOC �# PCANSI_STRING % �Y PSYSTEM_PROCESS_CLASSIFICATION & �Y PPROCESS_MEMORY_EXHAUSTION_TYPE ) sD SYSTEM_PROCESSOR_POWER_INFORMATION �( _SYSTEM_PREFETCH_OPTIONS �Y PPPM_PERFSTATE_EVENT 3 �6 SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION ,! tagIMEMENUITEMINFOW PLONG / �F ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT �U SYSTEM_WORKINGSET_ENTRY �* _SHUTDOWN_ACTION L" ACCESSTIMEOUT �S GCP_RESULTSW " \V _WIM_PROVIDER_EXTERNAL_INFO �Y LPTHREAD_START_ROUTINE c/ IMAGE_LINENUMBER " �+ MEMORY_PARTITION_PAGE_RANGE # � ENLISTMENT_INFORMATION_CLASS 8 �Y PACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION PBOOLEAN �W WOF_EXTERNAL_INFO ' RESUME_PERFORMANCE % � RTL_SPARSE_BITMAP_FREE_ROUTINE �Y NPLOGFONT ( �Y PFILE_REMOTE_PROTOCOL_INFORMATION %G RTL_HEAP_PARAMETERS �Y PFS_INFORMATION_CLASS �- KEY_BASIC_INFORMATION # �Y PRTL_SEGMENT_HEAP_PARAMETERS & � SYSTEM_HOT_PATCH_REGISTRY_VALUE �Y LPNONCLIENTMETRICS ' �Y PTOKEN_BNO_ISOLATION_INFORMATION ) SE JOBOBJECT_MEMORY_USAGE_INFORMATION 3 �Y PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX �6 HANDEDNESS " �Y PUNWIND_HISTORY_TABLE_ENTRY : RTL_DYNAMIC_HASH_TABLE # �Y PSYSTEM_SCOPED_POLICY_ID_ACE :Y PRPC_STRING �Y PCSTRING N5 WNF_STATE_NAME % �Y PRTL_REALLOCATE_STRING_ROUTINE � RTL_RESOURCE_POLICY_FLAGS ' �$ ETW_COVERAGE_SAMPLER_CREATE_INFO 7 �Y PSYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION $ � PRTL_CRITICAL_SECTION_DEBUG32 ! �X _FILE_POSITION_INFORMATION �E CM_SCSI_DEVICE_DATA �# _RTL_SPARSE_BITMAP_RUN W> EMRSETTEXTCOLOR �Y PCOBJECT_ATTRIBUTES �Y _LDR_FAILURE_DATA " �Y PPO_SPR_ACTIVE_SESSION_DATA d4 BITMAPFILEHEADER u- PEMRPOLYLINETO �( IMAGE_THUNK_DATA32 $ K? _EXTENDED_ENCRYPTED_DATA_INFO p PUNZTCH �8 _WMI_TXR �Y PETW_PER_SESSION_QUOTA $ F FILE_ZERO_DATA_INFORMATION_EX ! �% _SYSTEM_OBJECT_INFORMATION � TEXTMETRICA �Y PIELF_HANDLE ' m> CFG_CALL_TARGET_LIST_INFORMATION SC_LOCK �Y PCZPSTR G VALENTA }S _IMAGE_ROM_HEADERS $ G _SD_CHANGE_MACHINE_SID_OUTPUT �Y PBOOT_ENTROPY_NT_RESULT �' EMRPOLYBEZIER16 �Y PCONTAINER_VOLUME_STATE < _KCONTINUE_TYPE / �* _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION �Y PEX_WNF_CALLBACK � XFORM % �Y PETW_CLOCK_CONFIGURATION_EVENT �> PERFINFO_PO_POSTSLEEP %> TIMELINE_BITMAP X; FILE_PATH " /) MEMORY_WORKING_SET_EX_BLOCK ! �Y PSTARTING_LCN_INPUT_BUFFER ' ? _LEAP_SECOND_DATA_REGISTRY_ENTRY * -B _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM �? ETW_REF_CLOCK . B< _SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER _E WIN32K_SYSCALL_FILTER �; SCRUB_DATA_OUTPUT $ M# QUERY_FILE_LAYOUT_FILTER_TYPE % �= MEMORY_WORKING_SET_EX_LOCATION " #- RTL_SPARSE_BITMAP_PARAMETER � LPTEXTMETRICA �Y LPCPINFOEXA ! ~G _WMI_PROCESS_INFORMATION64 # R _DRIVER_VERIFIER_THUNK_PAIRS �+ _FILETIME " POINTER_64_INT �Y PCREATE_USN_JOURNAL_DATA xF _SL_HWID_DEVICE_INFO �Y PMESSAGE_RESOURCE_DATA [D _REPAIR_COPIES_OUTPUT �Y PVOLUME_REFS_INFO_BUFFER . �Y PSYSTEM_SPECULATION_CONTROL_INFORMATION $ �? _RTL_PROCESS_LOCK_INFORMATION �* _VOLUME_REFS_INFO_BUFFER ;' DISPLAY_DEVICEW �T _QUERY_SERVICE_CONFIGW �Y PCIMAGE_TLS_DIRECTORY64 �Y PKCONTINUE_ARGUMENT �Y PENCLAVE_INIT_INFO_SGX HPOWERNOTIFY 2# _PROCESSOR_NUMBER �' _MIDL_SERVER_INFO_ p va_list �Y _FILESYSTEM_STATISTICS_EX _SINGLE_LIST_ENTRY # ~U SYSTEM_EXCEPTION_INFORMATION �Y PMULTI_TIME �U _FILE_FULL_EA_INFORMATION �Y PRTL_HEAP_STACK_CONTROL " SID_HASH_ENTRY B1 PVALUEA �Y PQUERYHANDLER WMI_PAGE_FAULT $ _REG_ACTION ! @= POINTER_DEVICE_CURSOR_INFO q PPARAM_OFFSETTABLE ! �Y PRTL_RVA_LIST_RAW_ITERATOR " PSIZE_T - �Y PCLAIM_SECURITY_ATTRIBUTES_INFORMATION & �G _OBJECT_HANDLE_FLAG_INFORMATION ! �Y PCACTIVATION_CONTEXT_STACK FW TOKEN_CONTROL 1 �Y PTRANSACTION_NOTIFICATION_PROMOTE_ARGUMENT �Y LPENUMLOGFONTEXDV 7 tagWNODE_EVENT_ITEM �< _WMI_CONTEXTSWAP # �< _SYSTEM_SCOPED_POLICY_ID_ACE �" LPLOGFONTW �3 SE_AUDIT_INFO % �Y _FILE_FS_ATTRIBUTE_INFORMATION ( �? _TIMER_SET_COALESCABLE_TIMER_INFO >/ EMRSETDIBITSTODEVICE + _ETW_REGNOTIF_REGISTER ) � IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY ( FILE_ID_EXTD_BOTH_DIR_INFORMATION � RTL_UMS_THREAD_INFO_CLASS �Y EMRTEXT �W DESKTOPENUMPROCA �T QUERY_SERVICE_CONFIGW " PSECURITY_INFORMATION � _KPROFILE_SOURCE _IO_PRIORITY_HINT �Y LPSERVICE_MAIN_FUNCTIONW # PTRACEHANDLE �Y PMOFRESOURCEINFOW ! �Y RPC_NEW_HTTP_PROXY_CHANNEL {3 MIDL_STUB_MESSAGE PCLAIMS_BLOB - �& SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE �Y PSYSTEM_AUDIT_OBJECT_ACE �1 _PROCESS_TLS_INFORMATION G RTL_BITMAP_RUN RPC_IF_HANDLE % �6 PEXCEPTION_REGISTRATION_RECORD �9 CM_SERIAL_DEVICE_DATA �Y PCM_SONIC_DEVICE_DATA 2 U, TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT # �Y _ETW_COVERAGE_SAMPLER_STATUS & �Y PMEMORY_COMBINE_INFORMATION_EX2 �* _RTL_CIRCULAR_LIST_HEAD �! PEMRMOVETOEX �Y WINEVENTPROC + _CONNECTDLGSTRUCTW ' & _ETW_DFSS_RELEASE_THREAD_ON_IDLE b IMAGE_DOS_HEADER ) �9 _SYSTEM_VSM_PROTECTION_INFORMATION $ 5 KEY_CONTROL_FLAGS_INFORMATION 1W FILE_STORAGE_TIER_REGION �< CONTAINER_ROOT_INFO_INPUT ! g _PS_MITIGATION_OPTIONS_MAP # K TXFS_LIST_TRANSACTIONS_ENTRY {T RTL_ENCLAVE_LAUNCH_TOKEN � WMI_THREAD_INFORMATION zY PHV_DETAILS wY PRTL_UNLOAD_EVENT_TRACE32 �/ VARIABLE_NAME vY PRTL_GENERIC_TABLE .* TOUCHINPUT % uY PKAFFINITY_ENUMERATION_CONTEXT ' tY PSYSTEM_SPECIAL_POOL_INFORMATION �? PEMRSETMETARGN * sY PMIDL_WINRT_TYPE_SERIALIZATION_INFO y7 _EISA_IRQ_DESCRIPTOR �8 _devicemodeW s@ tagPOINTFX pY PNTFS_VOLUME_DATA_BUFFER �> RTL_UNLOAD_EVENT_TRACE64 oY LINEDDAPROC �B UPDATELAYEREDWINDOWINFO �A ALPC_DIRECT_ATTR lY PROPENUMPROCA �& TRACE_GUID_PROPERTIES �W EVENT_TRACE_LOGFILEW - A: _MEMORY_PARTITION_PAGEFILE_INFORMATION & �. _MANAGE_HOT_PATCH_QUERY_PATCHES kY PKEYBDINPUT $ �W _TRACE_ENABLE_FLAG_EXT_HEADER $ � EVENT_TRACE_INFORMATION_CLASS jY PACCESS_DENIED_ACE �X LDR_IMPORT_CALLBACK_INFO ) ; _PROCESS_CHILD_PROCESS_INFORMATION iY PPROCESS_PRIORITY_CLASS
LPARAM eY HRGN �" LOGFONTW - bY _SYSTEM_FIRMWARE_PARTITION_INFORMATION oG LPOSVERSIONINFOEX2A 0> EMREXTFLOODFILL @ tagAR_STATE BYTE L! tagABORTPATH ', tagPOINTER_DEVICE_TYPE RPC_STATUS -V _SLIST_HEADER bG tagEMRNAMEDESCAPE rA _PO_WAKE_SOURCE_INFO 4 > PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY ! _Y RTL_QUERY_REGISTRY_ROUTINE 0 _APP_MEMORY_INFORMATION �@ threadlocaleinfostruct ' =5 _ETW_COVERAGE_SAMPLER_BLOOM_INFO ) }4 TRANSACTIONMANAGER_LOG_INFORMATION "
) WMI_IMAGELOAD_INFORMATION64 nX PWCRANGE ^Y LPMSGBOXPARAMSW ! Y _SYSTEM_AUDIT_CALLBACK_ACE ( �2 FILE_IO_PRIORITY_HINT_INFORMATION ' ]Y PSYSTEM_SHADOW_STACK_INFORMATION 7 \Y LDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION �B _CONSOLE_SELECTION_INFO RS _SE_ACCESS_REPLY & WY PFSCTL_QUERY_REGION_INFO_OUTPUT � KUSER_SHARED_DATA <R KEY_SET_LAYER_INFORMATION � _system_handle_t �4 tagCOMPAREITEMSTRUCT * UY PPROCESS_SYSTEM_RESOURCE_MANAGEMENT TY PENUMUILANG ! SY PSHRINK_VOLUME_INFORMATION 4 RY PSYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION QY PENCLAVE_TARGET_FUNCTION # PULONGLONG OY PSE_AUDIT_INFO ! � WNF_STATE_NAME_INFORMATION Y PENHMETARECORD KY PSYSDBG_TRIAGE_DUMP / IY PPLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA 7 RTL_RXACT_LOG A NPNEWTEXTMETRICA HY PWMI_IRQ_RECORD �F _CALL_FRAME % _KEY_NODE_INFORMATION GY PDL_EUI48 ! �% PERFINFO_BATTERY_LIFE_INFO * �: EVENT_TRACE_PERFORMANCE_INFORMATION ! �0 PROCESS_WINDOW_INFORMATION �? FP_IEEE_RECORD 9 _SYSTEM_POWER_INFORMATION EY PMCI_STATS g) GESTURECONFIG �= SYSTEM_INFO ?X OPERATION_END_PARAMETERS EMRSETPOLYFILLMODE [> val_context DY PTOKEN_ACCESS_INFORMATION + C _CSV_QUERY_FILE_REVISION_FILE_ID_128 byte " PERFINFO_MASK CY PALPC_DATA_VIEW_ATTR .U RTL_PHYSICAL_MEMORY_INFO > ^ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT �7 ENCLAVE_INIT_INFO_SGX 3 BY PTRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION AY PTP_ALPC �D PEMRSTROKEPATH ! ] WMI_JOB_SET_QUERY_NET_RATE @Y PIMAGE_IMPORT_BY_NAME >Y APP_LOCAL_DEVICE_ID
O% PCWSTR ;Y PPO_WAKE_SOURCE_TIMER 9 _IMAGE_HOT_PATCH_BASE :Y PRPC_ANSI_STRING �5 _CONTEXT_EX �- HGLRC__ 2 K@ IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION * 9Y PALPC_PORT_MESSAGE_ZONE_INFORMATION $ 8Y PPPM_IDLE_STATE_ACCOUNTING_EX �F _RC_CONFIG COPYFILE2_MESSAGE_ACTION 7Y PWMIREGINFO �. _MIDL_METHOD_PROPERTY_MAP �S ETW_CPU_CACHE_FLUSH_EVENT 6Y PNT_PRODUCT_TYPE 5Y PHARDWARE_COUNTER �= PO_WAKE_SOURCE_TIMER � _LDR_DDAG_STATE ) �V _RTL_DYNAMIC_TIME_ZONE_INFORMATION �% _ETW_CANCEL_KTIMER2_EVENT & 4Y PPERFINFO_PPM_IDLE_EXIT_LATENCY - t( _EVENT_EXTENDED_ITEM_PROCESS_START_KEY . 3Y PPROCESS_MITIGATION_FONT_DISABLE_POLICY �F CALL_FRAME 2Y LPCIEXYZTRIPLE ' 1Y PWMI_EXTENDED_THREAD_INFORMATION �2 RPC_PROTSEQ_ENDPOINT , /Y _SYSTEM_VERIFIER_COUNTERS_INFORMATION ,Y PPS_WAKE_REASON %0 HMENU__ $ +Y PFILE_TYPE_NOTIFICATION_INPUT �E EMREXTESCAPE *Y NPIMEMENUITEMINFOW $ &Y PFILE_STANDARD_INFORMATION_EX �! _nlsversioninfoex " � _PERFINFO_PROCESS_PERFCTR64 !Y _ATOM_TABLE_INFORMATION " _STARTUPINFOA Y PETW_CREATE_HANDLE_EVENT + �W SYSTEM_BASIC_PERFORMANCE_INFORMATION � tagENUMTEXTMETRICA �9 _LDT_ENTRY * 9 TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE ) Y RTL_SPARSE_BITMAP_ALLOCATE_ROUTINE 6 5B IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION ' �1 SYSTEM_CODEINTEGRITY_INFORMATION wC SYSTEM_THREAD_INFORMATION l BITMAPINFOHEADER �E TEB_ACTIVE_FRAME_CONTEXT - Y PVIRTUALIZATION_INSTANCE_INFO_INPUT_EX # _> REPAIR_STORAGE_RESERVE_INPUT 7 tagAXISINFOA Y LPENHMETARECORD R+ tagENUMLOGFONTEXA IU WRITE_USN_REASON_INPUT Y LPNUMBERFMTW
CSHORT % Y WIM_PROVIDER_CONTROL_INTEGRITY " �8 _ETW_HEAP_EVENT_CONTRACTION Y PTOKEN_LINKED_TOKEN SE_SIGNING_LEVEL $ V _TXFS_CREATE_MINIVERSION_INFO �D SYSTEM_POWER_STATUS @ tagFILTERKEYS Y _RPC_SECURITY_QOS_V2_A Y PLDR_VERIFY_IMAGE_INFO ' Y PIR_TIMER_EXTRA_CREATE_PARAMETER
Y PPERFINFO_CC_FLUSH_CACHE
! wint_t + Y PKNONVOLATILE_CONTEXT_POINTERS_ARM64 Y PLDR_DATA_TABLE_ENTRY + ^7 _SYSTEM_ACTIVITY_MODERATION_APP_TYPE �3 ENABLE_TRACE_PARAMETERS ' �W _FILE_DISPOSITION_INFORMATION_EX $ g? _PLUGPLAY_CUSTOM_NOTIFICATION
Y PFOUR_PART_VERSION Y NPREGISTERWORD ! 9 PERFINFO_SYSCALL_EXIT_DATA ) �4 PEVENT_TRACE_LBR_EVENT_INFORMATION " �? COMPOUND_ACCESS_ALLOWED_ACE Y ETW_CANCEL_TIMER_EVENT " Y PPERFINFO_CCSWAP_IDLE_SHORT , \C _ACTIVATION_CONTEXT_BASIC_INFORMATION ) Y _PERFINFO_CONTIGUOUS_PAGE_GENERATE : �X RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY �X _RPC_SEC_CONTEXT_KEY_INFO * �X PTOKEN_SECURITY_ATTRIBUTE_OPERATION ( �. _DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK �X IMAGE_OPTIONAL_HEADER64 �X PFN_NT_CREATE_TRANSACTION > LPDROPSTRUCT
�X HACCEL �X LPSERVICE_TABLE_ENTRYA ! �X PFILE_STANDARD_INFORMATION �T TOKEN_PRIVILEGES �? REQUESTER_TYPE / C SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION !U STARTUPINFOEXA � _STATE_LOCATION_TYPE % ?? _ENCLAVE_CREATE_INFO_VBS_BASIC CM_KEYBOARD_DEVICE_DATA - +6 _HEAP_PERFORMANCE_COUNTERS_INFORMATION LUTF8_STRING . �X PSTREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER PEMRSETSTRETCHBLTMODE , �X PSERVICE_CONTROL_STATUS_REASON_PARAMS �X PEVENT_TRACE_LOGFILEW �X PWOW64_LDT_ENTRY F _SERVICE_NOTIFY_2W 0 �F _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT + dV _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH ' #E _IMAGE_CE_RUNTIME_FUNCTION_ENTRY & E# JOBOBJECT_BASIC_PROCESS_ID_LIST �X PPPM_THERMAL_POLICY_EVENT F _SYSDBG_PHYSICAL #= PHANDLETABLE � UNIVERSAL_NAME_INFO ( �S ETW_TP_EVENT_TIMER_EXPIRATION_END �( _IO_SESSION_EVENT # �X PSECTION_IMAGE_INFORMATION64 N SYNCHRONIZATION_BARRIER �X PIMEMENUITEMINFOA + �6 PROCESS_STACK_ALLOCATION_INFORMATION �A _MUILANGINFO ! �X PRTL_WORK_ON_BEHALF_TICKET % �X _PERFINFO_CC_WORKITEM_COMPLETE ) �5 SYSTEM_SESSION_POOLTAG_INFORMATION 0 � MEMORY_PARTITION_PAGE_COMBINE_INFORMATION & �A FILE_MAILSLOT_QUERY_INFORMATION , � RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET $ ~U _SYSTEM_EXCEPTION_INFORMATION �X LPHW_PROFILE_INFOW �X PFILE_ATTRIBUTE_TAG_INFO �* PMDINEXTMENU ' �; RPC_BINDING_HANDLE_TEMPLATE_V1_W " �X PFN_NT_ROLLBACK_TRANSACTION | DESCRIPTOR_TABLE_ENTRY * 6 SYSTEM_DMA_GUARD_POLICY_INFORMATION e= FILE_PREFETCH t PBOOL p PRTL_BALANCED_NODE �X PKEY_CACHED_INFORMATION �X PFPO_DATA �X PCIMAGE_IMPORT_BY_NAME / �X PSYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION �9 PCANDIDATELIST p LPUTSTR . �X PFSCTL_SET_INTEGRITY_INFORMATION_BUFFER s _TRANSACTION_NOTIFICATION 2 �F ACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA & �X PALPC_PORT_CALLBACK_INFORMATION �V _SERVICE_FAILURE_ACTIONSW E$ _TOKEN_ACCESS_INFORMATION : X TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION - U! _JOBOBJECT_END_OF_JOB_TIME_INFORMATION . �& _TRANSACTIONMANAGER_LOGPATH_INFORMATION
" PCLONG �D TOKEN_ELEVATION t+ PMUICCENTRY �# tagNEWTEXTMETRICW �F tagEMRSETPALETTEENTRIES F9 tagTRACKMOUSEEVENT �X PMEMORY_WORKING_SET_BLOCK �X PFXSAVE_FORMAT_WX86 �# SIZEL �5 MESSAGE_TRACE_USER & �X PSYSTEM_PAGEFILE_INFORMATION_EX �X PRTL_BSD_ITEM �' EMRPOLYLINETO16 * s* _SYSTEM_SESSION_PROCESS_INFORMATION # ?W _SECTION_IMAGE_INFORMATION64 j PBITMAPINFOHEADER \A SERVICE_TABLE_ENTRYA LONG , �/ _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER 2 �6 _FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX ; NPLOGPALETTE � _EFI_DRIVER_ENTRY �X PENCLAVE_ROUTINE (X value_entW �X PHEAP_COMMIT_DECOMMIT " C' TOKEN_GROUPS_AND_PRIVILEGES �X PSYMBOLIC_LINK_INFO_CLASS �> _PERFINFO_PO_POSTSLEEP PSSIZE_T w6 LOGICAL_DISK_DEFRAG �X _ALPC_DATA_VIEW_ATTR �X PIMAGE_ARCHITECTURE_ENTRY `4 ETW_CREATE_HANDLE_EVENT �X PLDR_IMPORT_CALLBACK_INFO " �X PSYSTEM_POWER_STATE_CONTEXT ) � RTL_FEATURE_CONFIGURATION_PRIORITY �= MONITORINFOEXA ' �X PJOBOBJECT_BASIC_UI_RESTRICTIONS $ � _FILE_PIPE_REMOTE_INFORMATION 3 t. FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX ( POWER_STATE_TYPE G COVERAGE_MODULE_INFO # _MUICCHEADER �X PCNTSTATUS /: _SID_IDENTIFIER_AUTHORITY *W RTL_BUFFER t, _DOCINFOW �E STORAGE_RESERVE_AREA_INFO , �X PJOURNAL_SET_DELETE_VALUE_INFORMATION �X PDEVMODE ?E _ETW_CRITSEC_EVENT_INIT �G FILE_FS_LABEL_INFORMATION ! GR KEY_WRITE_TIME_INFORMATION F EXCEPTION_DISPOSITION $ � _SECURITY_IMPERSONATION_LEVEL �X LPSERIALKEYS �; _PEB_LDR_DATA �X PCIMAGE_IMPORT_DESCRIPTOR �= _SD_QUERY_STATS_INPUT �X PGHOSTED_FILE_EXTENT 0 �% _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES % �X PIMAGE_DYNAMIC_RELOCATION32_V2 �5 EVENT_BASIC_INFORMATION � CLIENTCREATESTRUCT " L% _WMI_JOB_SET_QUERY_CPU_RATE $ �X PREPAIR_STORAGE_RESERVE_INPUT 1 �V RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER R EMRRESIZEPALETTE �X HSYNTHETICPOINTERDEVICE + 9 _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE ?! tagEMRSETVIEWPORTORGEX }- NONCLIENTMETRICSW % �X PBOOT_ENTROPY_SOURCE_NT_RESULT - �E _JOURNAL_CREATE_DELETE_KEY_INFORMATION �X RTL_TREE_DELETE_FUNCTION 5 �X PPROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY �C EMRSTROKEANDFILLPATH �X NPWNDCLASSEXA � REFS_SMR_VOLUME_GC_METHOD % �U RTL_PROCESS_BACKTRACES_CONTROL ( �X PRTL_IMAGE_MITIGATION_HEAP_POLICY �7 SOUNDSENTRYW �X PWNDCLASSEXA p1 STYLEBUFW �Q tagWNODE_EVENT_REFERENCE \X _MEMORY_FRAME_INFORMATION $ �X PWORKER_FACTORY_DEFERRED_WORK ! �X PSECTION_IMAGE_INFORMATION �X PSCOPE_TABLE hV DIAGNOSTIC_BUFFER >/ tagEMRSETDIBITSTODEVICE �) NORM_FORM �1 _STREAM_INFO_LEVELS b, DRAWPATRECT �X PSMALL_RECT �X PSE_IMPERSONATION_STATE �X LPMETAHEADER �X LPHIGHCONTRASTA / �X PPROCESS_REVOKE_FILE_HANDLES_INFORMATION + u0 _SYSTEM_WRITE_CONSTRAINT_INFORMATION @ MUILANGCFGNODE $ �X PCTEB_ACTIVE_FRAME_CONTEXT_EX �X FILE_POSITION_INFORMATION �Q RTL_FEATURE_CONFIGURATION
_REMOTE_PORT_VIEW " NLS_FUNCTION % �X PTXFS_WRITE_BACKUP_INFORMATION 9 �X PCACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION " TRACE_LOGFILE_HEADER64 �2 _FILE_STREAM_INFO RpcPerfCounters * �( ETW_UMS_EVENT_DIRECTED_SWITCH_START ! _TRANSACTION_STATE �7 RPC_SYNTAX_IDENTIFIER �? FILE_BOTH_DIR_INFORMATION - �X PJOURNAL_CREATE_DELETE_KEY_INFORMATION , � _TRANSACTIONMANAGER_INFORMATION_CLASS 1 �X RTL_SPARSE_BITMAP_UPDATE_METADATA_CALLBACK �8 DEVMODEW " W' tagRID_DEVICE_INFO_KEYBOARD i1 IMAGE_ENCLAVE_CONFIG32 $ �E _FILE_PIPE_SILO_ARRIVAL_INPUT ! �- OPERATION_START_PARAMETERS ' �X DISPLAYCONFIG_TARGET_DEVICE_NAME �X PIMAGE_FUNCTION_ENTRY �X PPROCESS_LDT_INFORMATION ! �X PPO_FIXED_WAKE_SOURCE_TYPE �! CM_VIDEO_DEVICE_DATA $ � _ENLISTMENT_INFORMATION_CLASS �' WOW64_LDT_ENTRY �- LPSECURITY_ATTRIBUTES # �X PETW_OPTICALIO_FLUSH_BUFFERS �+ _QUAD ) �D ALPC_PORT_MESSAGE_ZONE_INFORMATION �" _KEY_FULL_INFORMATION [/ _INITIAL_TEB ( �7 _MEMORY_ENCLAVE_IMAGE_INFORMATION � _TP_CALLBACK_ENVIRON_V3 : � PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION ; tagHANDLETABLE ) �X PSE_LEARNING_MODE_USER_OBJECT_DATA % �D ALPC_MESSAGE_INFORMATION_CLASS �- DEDUP_FILE_OPERATION # �X PPERFINFO_MEMORY_INFORMATION - l ETW_COVERAGE_SAMPLER_INFORMATION_CLASS 3 �X PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE # �" _TEB_ACTIVE_FRAME_CONTEXT_EX 3 �X _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX L0 tagNONCLIENTMETRICSA �> PCPE_EXCEPTION �; EMRFILLRGN S _THREAD_PERFORMANCE_DATA cB _WOF_EXTERNAL_FILE_ID " �X PSYSTEM_PROCESS_INFORMATION * �6 MEM_SECTION_EXTENDED_PARAMETER_TYPE � CPE_EXCEPTION �V POSVERSIONINFOA �; _PHYSICAL_DISK_RECORD �; CM_Power_Data_s �X PEMRPOLYDRAW # 5> PROCESS_WS_WATCH_INFORMATION ) �3 FSCTL_QUERY_STORAGE_CLASSES_OUTPUT �W _IMAGE_DATA_DIRECTORY � FILE_FS_SIZE_INFORMATION # �X I_RpcProxyGetClientAddressFn � _ULARGE_INTEGER �X PERFINFO_WORKINGSET_ENTRY }X CSV_IS_OWNED_BY_CSVFS p EVENTLOG_HANDLE_A $ wX PENLISTMENT_BASIC_INFORMATION � _TP_LOG_LEVEL � _RTL_TRACE_ENUMERATE p NPSTR �< SYSTEM_AUDIT_OBJECT_ACE �) _ACCESS_REASONS uX PCI_LOG_MMCSS_STOP � _SID_AND_ATTRIBUTES_HASH tX PPS_STD_HANDLE_INFO sX PLOAD_DLL_EVENT_DATA �5 CONTEXT_EX V _COUNTED_REASON_CONTEXT rX PACTCTXW ' qX PRTL_SPARSE_BITMAP_CTX_OPERATION " �( PARTITION_INFORMATION_CLASS # �6 FILE_FS_OBJECTID_INFORMATION , �$ REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER pX PPPM_THERMALCHANGE_EVENT �E _KEY_CACHED_INFORMATION �$ _DMA_WIDTH oX PRTL_RUN_ONCE �W MESSAGE_RESOURCE_DATA * PLARGE_INTEGER ^% SYSTEM_POOL_ENTRY nX LPWCRANGE EMRSETMAPMODE PSID & lX ETW_ANTI_STARVATION_BOOST_EVENT A5 CI_LOG_SCHEDULER_SLEEP �# _TIMER_INFORMATION_CLASS +' _LDR_DLL_LOAD_REASON �# _WOW64_FLOATING_SAVE_AREA 3 iX PTRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT ' hX PREDIRECTION_FUNCTION_DESCRIPTOR # PERFINFO_TIMESTAMP eX PSYSDBG_VIRTUAL dX PRTL_HANDLE_TABLE N) MULTIKEYHELPW % _PROCESS_HANDLE_TRACING_ENABLE cX PCSV_QUERY_MDS_PATH_V2 2 FE CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE & bX PMEMORY_WORKING_SET_EX_LOCATION PCWPSTRUCT aX PPERFINFO_FLT_OPERATION # PDWORD64 9, IMAGE_POLICY_ENTRY_TYPE PEMRSELECTCLIPPATH �# tagCURSORINFO ) v DIRECTORY_NOTIFY_INFORMATION_CLASS gC FILE_ALLOCATION_INFO `X PMIDL_METHOD_PROPERTY_MAP # !B PERFINFO_CC_WORKITEM_DEQUEUE ) _X PCLDR_DLL_LOADED_NOTIFICATION_DATA \X MEMORY_FRAME_INFORMATION 0 SCROLLBARINFO SX HIMCC S; PPERFINFO_TRACE_ENTRY % RX PPERFINFO_FLT_OPERATION_STATUS �S BOOT_OPTIONS 5 �: _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST & QX PRTL_DYNAMIC_HASH_TABLE_CONTEXT PX PACTCTXA
7 tagIMECHARPOSITION OX PFP_IEEE_RECORD M+ RTLP_HEAP_TAGGING_INFO NX LPCPINFOEX ! �F _PERFINFO_FILE_INFORMATION MX PENCLAVE_CREATE_INFO_VBS GX PMUILANGLIST �T PERFINFO_IO_TIMER u ULONG32 FX PSINGLE_LIST_ENTRY32 * �8 EVENT_TRACE_PROFILE_ADD_INFORMATION ! �G _FILE_FS_LABEL_INFORMATION * �* _SYSTEM_FEATURE_CONFIGURATION_QUERY EX LPMDICREATESTRUCTW $ DX PETW_KTIMER2_EXPIRATION_EVENT CX PPHYSICAL_DISK_RECORD & �& _LINK_TRACKING_INFORMATION_TYPE x MEM_EXTENDED_PARAMETER . �D READ_DIRECTORY_NOTIFY_INFORMATION_CLASS * � ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN R SILO_USER_SHARED_DATA � _FSINFOCLASS X HINSTANCE__ �; _ETW_BUFFER_CONTEXT ! U- MEMORY_COMBINE_INFORMATION , �( _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA =X POPERATION_END_PARAMETERS . ;X PRTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY � UNIVERSAL_NAME_INFOA F% LPCOMPOSITIONFORM |( TOKEN_DEVICE_CLAIMS �> PGLYPHSET , :X PPERFINFO_DYNAMIC_TICK_DISABLE_REASON ' 9X PSYSTEM_DPC_BEHAVIOR_INFORMATION ( �V _SYSTEM_LEGACY_DRIVER_INFORMATION ( �V _MIDL_INTERFACE_METHOD_PROPERTIES " � _WATCHDOG_INFORMATION_CLASS + 8X PRPC_HTTP_TRANSPORT_CREDENTIALS_V2_A # �= UMS_CREATE_THREAD_ATTRIBUTES ' 7X PCRITICAL_PROCESS_EXCEPTION_DATA MT _EXIT_PROCESS_DEBUG_INFO �A PERFINFO_SPINLOCK_CONFIG & �U _KEY_VIRTUALIZATION_INFORMATION n2 LPDISPLAY_DEVICEA HDEVNOTIFY �U tagMONITORINFOEXW [D REPAIR_COPIES_OUTPUT , �< _SYSTEM_INTERRUPT_CPU_SET_INFORMATION $ �E _PLUGPLAY_CONTROL_STATUS_DATA + 6X PFSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT ! 1 tagWTSSESSION_NOTIFICATION 5X PTEB_ACTIVE_FRAME_EX 9 _LPC_CLIENT_DIED_MSG # 4X PPROCESSOR_POWER_POLICY_INFO �- _SD_QUERY_STATS_OUTPUT � _WIN32_FIND_DATAW �8 FILE_CASE_SENSITIVE_INFO 2X LPLOGBRUSH32 " O$ RTL_GENERIC_COMPARE_RESULTS #D tagPOINTER_INFO 5? _SYSTEM_ACCESS_FILTER_ACE 3X PSERVICE_NOTIFY_2A 2X NPLOGBRUSH32 ,X PPERFINFO_VAD_ROTATE_INFO *X LPMSGBOXPARAMS &X PVALENTW RTL_REFERENCE_COUNT32
p PCCHAR STARTUPINFOW , "X PCSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT ) � _PERFINFO_DYNAMIC_TICK_VETO_REASON � HMODULE � _WIN32_FIND_DATAA X FILE_REFERENCE_RANGE & X PPROCESS_MEMORY_EXHAUSTION_INFO X PSPARSE_OVERALLOCATE_DATA MOFHANDLE �F _RPC_IF_ID X PPPM_IDLE_STATE_BUCKET_EX , A: MEMORY_PARTITION_PAGEFILE_INFORMATION % �8 PROCESS_MEMORY_EXHAUSTION_INFO X PSE_SECURITY_DESCRIPTOR X PPS_PKG_CLAIM & X PWIM_PROVIDER_ADD_OVERLAY_INPUT $ X PSYSTEM_LOOKASIDE_INFORMATION - X PPLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA �, _TP_TASK_CALLBACKS ( [S _LOOKUP_STREAM_FROM_CLUSTER_ENTRY # X RTL_GENERIC_ALLOCATE_ROUTINE ! vW UNWIND_HISTORY_TABLE_ENTRY / FILE_RENAME_INFORMATION X PVCN_RANGE_INPUT_BUFFER �? PEMRCLOSEFIGURE uU LPMODEMDEVCAPS R PERFINFO_CCSWAP ; X PTOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION ) � SYSTEM_SESSION_BIGPOOL_INFORMATION X LPRAWKEYBOARD X LPNMHDR yU _GLYPHMETRICS ) y0 _TXFS_ROLLFORWARD_REDO_INFORMATION X FSCTL_OFFLOAD_WRITE_INPUT �8 LPFILETIME X PMMPFN_IDENTITY �W PKTMOBJECT_CURSOR �W _EVENT_TRACE_LOGFILEW � _SYSTEM_PIXEL_FORMAT � SECTION_INFORMATION_CLASS [? _PO_WAKE_SOURCE_INTERNAL R RTL_FEATURE_USAGE_DATA $ 4: _WORKER_FACTORY_DEFERRED_WORK ' � JOBOBJECT_RATE_CONTROL_TOLERANCE �S tagEMRROUNDRECT �W PEMRFORMAT �W _FILE_QUOTA_INFORMATION " � _REQUEST_RAW_ENCRYPTED_DATA �W PMEMORY_IMAGE_INFORMATION 0 �; TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT �W LPEXIT_PROCESS_DEBUG_INFO + �W PCLDR_DLL_UNLOADED_NOTIFICATION_DATA # �W PREFS_SMR_VOLUME_INFO_OUTPUT & �W PPERFINFO_SAMPLED_PROFILE_CACHE 3 �W PSYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION >, FLOAT128 # �W PFILE_ALLOCATED_RANGE_BUFFER �. LPINIT_ONCE �< NEWTEXTMETRICA 4 �& _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM ! �W PEVENT_EXTENDED_ITEM_TS_ID GB _DEBUG_EVENT �W PLOGICAL_DISK_DEFRAG YE OPTICAL_MEDIA_RECORD 0 OE STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY �W PFIRMWARE_TYPE Y _SYSTEM_TPM_INFORMATION U _ACL_INFORMATION_CLASS ! �W PTXFS_QUERY_RM_INFORMATION iF _RTL_FEATURE_USAGE_REPORT �W PTP_JOB ( �F LPCREATEFILE2_EXTENDED_PARAMETERS �W PALPC_DIRECT_ATTR ! �; _JOURNAL_INFORMATION_CLASS + y _PLUGPLAY_CONTROL_USER_RESPONSE_DATA �W LPNETCONNECTINFOSTRUCT & $: _EVENT_EXTENDED_ITEM_PEBS_INDEX ,, HCOLORSPACE__ �W PRPC_IMPORT_CONTEXT_P $ W6 VIRTUAL_STORAGE_BEHAVIOR_CODE �W PIO_RESOURCE_LIST M/ PENUMTEXTMETRICA " #9 _ENABLE_TRACE_PARAMETERS_V1 " �W _FILE_ZERO_DATA_INFORMATION 5 �W PRTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY & Y@ PRTL_PROCESS_REFLECTION_ROUTINE �W LPREMOTE_NAME_INFOA c: _ALPC_BASIC_INFORMATION 0 GD FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX " �W PSYSTEM_POWER_LOGGING_ENTRY �W _MESSAGE_RESOURCE_DATA �U tagEMRCREATEPALETTE �W AUDIODESCRIPTION p PTSTR ( �W PIMAGE_LOAD_CONFIG_CODE_INTEGRITY �W PCPTABLEINFO , �+ _RTL_USER_PROCESS_EXTENDED_PARAMETERS �W PIMAGE_THUNK_DATA32 & XG _SYSTEM_PERFORMANCE_INFORMATION & �W WIN32_MEMORY_REGION_INFORMATION WV HARDWAREHOOKSTRUCT # � _KEY_VALUE_LAYER_INFORMATION _WOW64_CONTEXT �W KENTROPY_TIMING_ROUTINE # )F WOW64_DESCRIPTOR_TABLE_ENTRY HBRUSH__ �W PDIAGNOSTIC_BUFFER # �W TRACE_ENABLE_FLAG_EXT_HEADER " �D _MEMORY_BASIC_INFORMATION32 �W WINSTAENUMPROCA 4 �C _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION �W PREDIRECTION_DESCRIPTOR L! EMRABORTPATH
3 PCUUCSCHAR �> _FP_128 �W LPCMENUITEMINFOW ! D; JOBOBJECT_WAKE_INFORMATION " BT FILE_FS_CONTROL_INFORMATION ! �W ENTER_STATE_NOTIFY_HANDLER 0 �T SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION & �W PCM_PNP_BIOS_INSTALLATION_CHECK # ULONG64 EMRSETCOLORSPACE �W LPDLGTEMPLATEW 7 WNODE_EVENT_ITEM ( @F WIM_PROVIDER_REMOVE_OVERLAY_INPUT & , CI_WINDOWS_LOCKDOWN_RESTRICTION ) �W PRTL_YIELD_UNTIL_CONDITION_ROUTINE % �W DISPLAYCONFIG_TARGET_BASE_TYPE �W LPFMTID * �1 _SECTION_INTERNAL_IMAGE_INFORMATION �D CONSOLE_HISTORY_INFO # �W PPARTITION_INFORMATION_CLASS � FP_OPERATION_CODE " {D _FSCTL_QUERY_FAT_BPB_BUFFER $ �W PEXTENDED_ENCRYPTED_DATA_INFO ' 6+ _SYSTEM_POOL_ZEROING_INFORMATION " �1 SHRINK_VOLUME_REQUEST_TYPES + �W PFN_NT_QUERY_INFORMATION_TRANSACTION % � PUBLIC_OBJECT_TYPE_INFORMATION ? _KCONTINUE_ARGUMENT �5 SERVICE_ERROR_TYPE �! _SERVICE_DESCRIPTIONW �W PFSCTL_OFFLOAD_READ_INPUT �W PIMAGE_RELOCATION �W PWNF_DATA_SCOPE R+ ENUMLOGFONTEXA tagCWPSTRUCT �/ PERFINFO_MM_STAT 2 R _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION fD _LDRP_CSLIST 5 L8 SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY �W PCPU_CONFIG_RECORD + 40 PERFINFO_DYNAMIC_TICK_DISABLE_REASON � _SUITE_TYPE �5 _FILE_OBJECTID_BUFFER �! _POWER_STATE * �W PSYSTEM_SESSION_POOLTAG_INFORMATION +' LDR_DLL_LOAD_REASON �W PEMRCREATEBRUSHINDIRECT �W PETW_HEAP_EVENT_CREATE �7 IMAGE_AUX_SYMBOL_EX # �4 SECURITY_DESCRIPTOR_RELATIVE �2 FILE_STREAM_INFO �S _IMAGE_RESOURCE_DIRECTORY � _PS_PROTECTION �A CONNECTDLGSTRUCTA , �W PSYSTEM_BASIC_PERFORMANCE_INFORMATION �W LOCALE_ENUMPROCEX )
W FILE_QUERY_ON_DISK_VOL_INFO_BUFFER � RTL_UMS_SCHEDULER_REASON HF LPWINDOWINFO p PNZCH �, SD_ENUM_SDS_ENTRY EMRDELETECOLORSPACE # �3 ETW_UMS_EVENT_CONTEXT_SWITCH �W PREAD_USN_JOURNAL_DATA_V1 % e- _SYSDBG_LIVEDUMP_CONTROL_FLAGS $ �G _TRACE_PROVIDER_INSTANCE_INFO � _ETW_BUFFER_STATE �W PETW_HEAP_EVENT_SNAPSHOT $ �C _JOURNAL_ABSOLUTE_INFORMATION ( �W PRTL_IMAGE_MITIGATION_ASLR_POLICY " �W PSYSDBG_KD_PULL_REMOTE_FILE ) iB _WMI_EXTENDED_THREAD_INFORMATION64 ?" _HIBERFILE_BUCKET_SIZE �W _WOF_EXTERNAL_INFO �W PRTL_FEATURE_USAGE_DATA �W PCM_KEYBOARD_DEVICE_DATA �W PIMAGE_DATA_DIRECTORY # �W PSYSTEM_PAGEFILE_INFORMATION Z* RTL_DRIVE_LETTER_CURDIR �/ _VARIABLE_NAME # �W PRTL_GENERIC_COMPARE_ROUTINE " R9 ETW_DISKIO_FLUSH_BUFFERS_V3 " N SERVERSILO_INIT_INFORMATION & �W PFILE_IO_COMPLETION_INFORMATION �W PETW_READY_THREAD_EVENT �# _IO_STATUS_BLOCK32 �W PERFINFO_CC_FLUSH_CACHE * ; PERFINFO_DOMAIN_CHANGE_EVENT_REASON
" SIZE_T ! �% _KEY_SET_INFORMATION_CLASS U tagICONMETRICSW & �V _PERFINFO_SAMPLED_PROFILE_CACHE �0 IMAGE_OPTIONAL_HEADER32 �W FILE_QUOTA_INFORMATION �' SERVICE_LOAD_TYPE 2 �W PRTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER ' ~W PFILE_DISPOSITION_INFORMATION_EX & yW PFILE_PROVIDER_EXTERNAL_INFO_V0 h& RTL_UMS_CONTEXT $ �# ETW_TP_EVENT_CALLBACK_ENQUEUE u ETW_WNF_EVENT_SUBSCRIBE " vW _UNWIND_HISTORY_TABLE_ENTRY 0 �; JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION cB WOF_EXTERNAL_FILE_ID * tW PSYSTEM_KERNEL_DEBUGGER_INFORMATION PLUGPLAY_CONTROL_CLASS %G _RTL_HEAP_PARAMETERS
@ PFLOAT # pW PENCLAVE_LOAD_DATA_VBS_BASIC
HLOCAL % kW PIMAGE_BOUND_IMPORT_DESCRIPTOR iW PUSN_RECORD_V2 &U _RTL_HANDLE_TABLE ( hW PSYSTEM_MANUFACTURING_INFORMATION
- EMREXTTEXTOUTW �V SERVICE_FAILURE_ACTIONSW ! gW PWMI_IMAGEID_INFORMATION32 # fW PFILE_SET_DEFECT_MGMT_BUFFER b5 _CM_SERVICE_NODE_TYPE eW LPRGBQUAD 03 SRWLOCK dW PFILE_DISPOSITION_INFO - bW _CLAIM_SECURITY_ATTRIBUTES_INFORMATION
_W PTP_IO � _IMAGE_MITIGATION_POLICY �" CWPRETSTRUCT " ^W PSYSTEM_MANDATORY_LABEL_ACE $ � JOBOBJECT_WAKE_INFORMATION_V1 & T PROCESS_LEAP_SECOND_INFORMATION " ]W PFILE_GET_QUOTA_INFORMATION \W PETW_REF_CLOCK [W PKERNEL_USER_TIMES 0 ZW PSYSTEM_NET_RATE_CONTROL_DISPATCH_ROUTINE kT _KEY_NAME_INFORMATION \G _RPC_POLICY # 6 GENERIC_BINDING_ROUTINE_PAIR _WGLSWAP XW tagUSAGE_PROPERTIES
5 _PERFINFO_MEM_RESET_INFO , UT ACTIVATION_CONTEXT_SECTION_KEYED_DATA �, LPSYSTEMTIME �: EMRCREATEPEN - �0 _TRANSACTIONMANAGER_OLDEST_INFORMATION UW MONITORENUMPROC $ @ FSCTL_QUERY_REGION_INFO_INPUT ' k RTL_FEATURE_CONFIGURATION_UPDATE �1 WINDOWS_OS_OPTIONS �@ CM_EISA_SLOT_INFORMATION QW LPDLGTEMPLATE NG _SC_ACTION A XSAVE_VENDORS # �R _TIMER_SET_INFORMATION_CLASS 7 G _MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION �< tagNEWTEXTMETRICA �T MESSAGE_TRACE_HEADER �) NT_TIB64 / PW PPROCESS_READWRITEVM_LOGGING_INFORMATION , $; SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT PRTL_UMS_COMPLETION_LIST � PROCESSOR_CACHE_TYPE / >4 RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY �= _FILE_ALL_INFORMATION OW PSTRING32 NW PT2_SET_PARAMETERS & MW PSYSTEM_LEAP_SECOND_INFORMATION 0 �0 SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION LW PETW_WNF_EVENT_CALLBACK " JW _SYSTEM_POWER_LOGGING_ENTRY & � _PROCESSOR_PROFILE_CONTROL_AREA & #C RTL_IMAGE_MITIGATION_DEP_POLICY DW PTOKEN_CONTROL " BW PWIM_PROVIDER_OVERLAY_ENTRY �= tagMONITORINFOEXA K LUID % �< _FILE_PIPE_EVENT_SELECT_BUFFER " � BAD_MEMORY_CALLBACK_ROUTINE AW PRID_DEVICE_INFO 1W _FILE_STORAGE_TIER_REGION " ?W SECTION_IMAGE_INFORMATION64 �C NPEVENTMSG 9W LPMONITORINFOEX ) �@ _ETW_UMS_EVENT_DIRECTED_SWITCH_END �0 SYSTEM_FLUSH_INFORMATION $ 8W PETW_TP_EVENT_POOL_TH_MIN_SET 47 _PS_MEMORY_RESERVE $ 7W POBJECT_DIRECTORY_INFORMATION � DISPLAYCONFIG_TOPOLOGY_ID �5 CBTACTIVATESTRUCT ' �@ _PERFINFO_WORKINGSET_INFORMATION � PNP_QUERY_RELATION % �7 SYSTEM_LEAP_SECOND_INFORMATION # & HEAP_BLOCK_EXTRA_INFORMATION # �D PROCESS_HANDLE_TRACING_ENTRY W8 _ETW_HEAP_EVENT_RUNDOWN �. TXFS_START_RM_INFORMATION f< _MEM_ADDRESS_REQUIREMENTS Q- _DEVICE_FLAGS ^' tagEMRPOLYTEXTOUTA � PERFINFO_GROUPMASK i- _MEMORYSTATUSEX u POINTER_FLAGS /W PFILE_STORAGE_TIER_REGION -W PPROFILE_SOURCE_INFO 06 _SD_ENUM_SDS_OUTPUT B1 pvalueA �4 MEMORY_INFORMATION_CLASS �V NDR_NOTIFY_ROUTINE & ,W PLINK_TRACKING_INFORMATION_TYPE (W PRTL_BUFFER 'W FONTENUMPROCW W _IMAGE_SYMBOL ! {D FSCTL_QUERY_FAT_BPB_BUFFER 8 # SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION tagSOUNDSENTRYA + % _SYSTEM_BOOT_ENVIRONMENT_INFORMATION W ENHMFENUMPROC U< POINTER_DEVICE_INFO �S _BOOT_OPTIONS �$ PMOUSEHOOKSTRUCTEX |$ ETW_READY_THREAD_EVENT W WNF_META_CALLBACK �T _KLDR_DATA_TABLE_ENTRY32 ! �2 _SYSTEM_MEMORY_INFORMATION |. MAXVERSIONTESTED_INFO W LAYERPLANEDESCRIPTOR W PPVALUE D* EVENT_TYPE ' (V SYSTEM_MANUFACTURING_INFORMATION W PEVENT_BASIC_INFORMATION @ _MUILANGCFGNODE + �+ RTL_USER_PROCESS_EXTENDED_PARAMETERS � KERNINGPAIR W PEMRSTRETCHBLT *
W _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER � _WMI_PNP_RECORD_V5 * AR _VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT % �* RTL_FEATURE_CONFIGURATION_TYPE X PDELETEITEMSTRUCT � _WMI_JOB_ASSIGN_PROCESS PTUCHAR % W PFILE_ZERO_DATA_INFORMATION_EX * � FILE_STORAGE_RESERVE_ID_INFORMATION + SERIALKEYS ( &4 _RPC_HTTP_TRANSPORT_CREDENTIALS_A a1 STICKYKEYS �# tagSIZE * �4 _KEY_SET_VIRTUALIZATION_INFORMATION " IO_SESSION_STATE W PCI_WINDOWS_LOCKDOWN_MODE �R RTL_ELEVATION_FLAGS 0 l. _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION �! _FP__IEEE_ROUNDING_MODE # W PETW_CRITSEC_EVENT_COLLISION � XSAVE_VENDOR ! �, _IMAGE_COFF_SYMBOLS_HEADER W PCIMAGE_TLS_DIRECTORY32 �D TXFS_LIST_TRANSACTIONS � TRANSACTION_OUTCOME $ W PEVENT_TRACE_BUFFER_CALLBACKW �+ SERVICE_NOTIFY_2A ' IMAGE_HOT_PATCH_INFO # + ReplacesCorHdrNumericDefines � SE_IMPERSONATION_STATE �F FILE_SET_SPARSE_BUFFER �V PRTL_TICK_LOCK
# UINT64 �- IMAGE_TLS_DIRECTORY ' �V PROCESS_DEVICEMAP_INFORMATION_EX - �? PROCESS_MITIGATION_DYNAMIC_CODE_POLICY �V PCM_MONITOR_DEVICE_DATA $ ( DYNAMIC_TIME_ZONE_INFORMATION �3 tagTTPOLYGONHEADER �U LPGUITHREADINFO B _ETW_DEBUG_PRINT_EVENT � SYSTEM_AUDIT_ACE �4 _MEMORY_INFORMATION_CLASS �V LPDISCDLGSTRUCTA + �0 _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO ( �V PSYSTEM_LEGACY_DRIVER_INFORMATION 2 �V _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER 0 8 _EVENT_TRACE_SESSION_SECURITY_INFORMATION 0 y> _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY �V PPOWER_SESSION_CONNECT ! �G _TP_POOL_STACK_INFORMATION � PREGISTERWORDW �V PETW_WNF_EVENT_SUBSCRIBE 3 g; _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT �: RTL_RELATIVE_NAME_U T _RTL_HEAP_STACK_QUERY 87 WNODE_METHOD_ITEM � EMRPOLYBEZIERTO ) �4 PEVENT_TRACE_IPT_EVENT_INFORMATION q PWCH # ` FILE_TYPE_NOTIFICATION_INPUT {2 EMRCREATECOLORSPACE �* tagCREATESTRUCTA �V _PERFINFO_DEBUG_EVENT
�1 _FP_80 �V ENTER_STATE_HANDLER �V PRPC_SERVER_INTERFACE � RTL_RESOURCE_DEBUG32 " DWORD �V PCTEB_ACTIVE_FRAME_EX �( tagLOGBRUSH # �V LPTOP_LEVEL_EXCEPTION_FILTER # N _SERVERSILO_INIT_INFORMATION �V PUSN_RECORD �V PSL_KMEM_CACHE %7 UNICODE_PREFIX_TABLE
" RULONG �V PXSAVE_CPU_ERRATA �V PFILE_PREFETCH J# WNODE_TOO_SMALL . 4 PROCESS_STACK_ALLOCATION_INFORMATION_EX 5 C _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION �V PERFINFO_DEBUG_EVENT " y IMAGE_DYNAMIC_RELOCATION_V2 , +6 HEAP_PERFORMANCE_COUNTERS_INFORMATION � _STREAM_EXTENT_ENTRY �V PFILE_ALIGNMENT_INFO � MENUINFO # �8 ENUM_SERVICE_STATUS_PROCESSW
! UINT16 �( _ALPC_SECURITY_ATTR $ �V EXTENT_READ_CACHE_INFO_BUFFER 7 _POWER_SESSION_RIT_STATE a< ENUMLOGFONT L! EMRENDPATH ' �V MIDL_INTERFACE_METHOD_PROPERTIES C ETW_OBJECT_HANDLE_EVENT �+ SECURITY_CAPABILITIES ( �V RTL_IMAGE_MITIGATION_SEHOP_POLICY �8 IPT_TRACE_EVENT_DATA ( �V PETW_COVERAGE_SAMPLER_STATUS_INFO ) �V PRTL_DYNAMIC_TIME_ZONE_INFORMATION ! �V LPSERVICE_FAILURE_ACTIONSW l2 _ETW_HEAP_EVENT_ALLOC - �V PSERVICE_CONTROL_STATUS_REASON_PARAMSA jU REPARSE_INDEX_KEY $ �= MANAGE_HOT_PATCH_UNLOAD_PATCH �V LPOSVERSIONINFOA � RAWMOUSE " �V ETW_CRITSEC_EVENT_COLLISION % �V PERFINFO_SAMPLED_PROFILE_CACHE ( � TRACE_PERIODIC_CAPTURE_STATE_INFO �1 PCSTR w LPENUMLOGFONTEXDVA " � _FILE_FS_DEVICE_INFORMATION Y@ PRTL_ACQUIRE_LOCK_ROUTINE 9= IMAGE_IMPORT_DESCRIPTOR
/ SE_SID * !T FILE_LINK_ENTRY_FULL_ID_INFORMATION / REPAIR_COPIES_INPUT * FP_IEEE_FORMAT , �V _SYSTEM_PROCESS_INFORMATION_EXTENSION - UT _ACTIVATION_CONTEXT_SECTION_KEYED_DATA
�1 LPCSTR D EXCEPTION_LOG A PARSE_MESSAGE_CONTEXT PLONG_PTR " o( _SYSTEM_CPU_SET_INFORMATION , �V _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE �, ACCESS_ALLOWED_ACE # A3 DEFINE_STORAGE_RESERVE_INPUT D! HIGHCONTRAST + �% _PROCESS_KEEPALIVE_COUNT_INFORMATION �= SD_QUERY_STATS_INPUT WMIHANDLE �V PCULONG $ �V PREFS_DEALLOCATE_RANGES_RANGE �V PFN_NT_OPEN_TRANSACTION PRTL_UMS_CONTEXT u TOUCH_MASK �V LPSC_ACTION + o6 FILE_IOSTATUSBLOCK_RANGE_INFORMATION �V _PAGEDIR_INFORMATION ! �+ ENLISTMENT_CRM_INFORMATION �V PRTL_FREE_STRING_ROUTINE + �V PRTL_IS_THREAD_WITHIN_LOADER_CALLOUT % B4 SYSTEM_DEVICE_DATA_INFORMATION �V LPHW_PROFILE_INFOA � RAWINPUT �V RPC_MGMT_AUTHORIZATION_FN ! 7 _ETW_COVERAGE_SAMPLER_DATA 6 FARPROC ! . EVENT_INSTANCE_GUID_HEADER $ �V PPS_POST_PROCESS_INIT_ROUTINE 7E FILE_FULL_DIR_INFORMATION # �E PLUGPLAY_CONTROL_STATUS_DATA ! �V PPPM_IDLE_STATE_ACCOUNTING �8 _RTL_HEAP_STACK_CONTROL " }V PPS_BNO_ISOLATION_PARAMETER �< LASTINPUTINFO � _CM_PERF_COUNTERS * _FP__IEEE_FORMAT d( _CPU_SET_INFORMATION_TYPE yV PTP_CALLBACK_INSTANCE xV PEMRGRADIENTFILL wV PIMAGE_ROM_HEADERS vV PGET_MODULE_HANDLE_EXA DLL_DIRECTORY_COOKIE
PSHORT � _FILE_SEGMENT_ELEMENT � PINTERFACE_DEREFERENCE % �$ _PROCESS_ENERGY_TRACKING_STATE sV LANGGROUPLOCALE_ENUMPROCA pV PRID_DEVICE_INFO_KEYBOARD � AXESLISTW oV PBOOT_RECORD 9 IMAGE_HOT_PATCH_BASE �T RAWINPUTHEADER nV PCI_LOG_SCHEDULER_WAKEUP lV _TOKEN_LINKED_TOKEN hV _DIAGNOSTIC_BUFFER ! �1 PERFINFO_IDLE_STATE_CHANGE _KSPIN_LOCK_QUEUE_NUMBER $ fV PQUERY_STORAGE_RESERVE_OUTPUT 6 PROC $ UD EXCEPTION_REGISTRATION_RECORD � _VRF_TRIAGE_CONTEXT ! �R ETW_TIMER_EXPIRATION_EVENT + bV PETW_TP_EVENT_WORKER_NUMANODE_SWITCH �S _MESSAGE_RESOURCE_ENTRY _V _LOAD_DLL_DEBUG_INFO T* LPDRAWITEMSTRUCT Z) STRING32 )0 GHOSTED_FILE_EXTENT ' �F _CREATEFILE2_EXTENDED_PARAMETERS + #S _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W ' _EVENT_HEADER_EXTENDED_DATA_ITEM V _PORT_DATA_ENTRY " ZV PWIM_PROVIDER_EXTERNAL_INFO ! �; KEY_VALUE_FULL_INFORMATION ! � _REFS_SMR_VOLUME_GC_METHOD ;) ARM64_NT_CONTEXT d CACHE_RELATIONSHIP UV PHARDWAREHOOKSTRUCT � PRTL_CRITICAL_SECTION y RPC_CLIENT_ALLOC �9 LDT_ENTRY � _NT_TIB �4 _RTL_PROCESS_LOCKS SV PFLS_DATA ! � PUMS_SCHEDULER_ENTRY_POINT QV PERFINFO_MARK_INFORMATION & @ _PO_CS_DEVICE_NOTIFICATION_TYPE " TP_VERSION NV PRAWINPUTDEVICELIST , 40 _PERFINFO_DYNAMIC_TICK_DISABLE_REASON u PUINT32 , �A _PROCESS_MITIGATION_IMAGE_LOAD_POLICY �S tagMDICREATESTRUCTW 5 TOKEN_USER_CLAIMS ! LV PREFS_SMR_VOLUME_GC_METHOD JV PACTCTX C _ETW_OBJECT_HANDLE_EVENT T. SI_COPYFILE �( XSAVE_POLICY ! _REFS_SMR_VOLUME_GC_ACTION IV PEMRMASKBLT ! <( _FILE_INTERNAL_INFORMATION � ENUMTEXTMETRICA UINT8 vT RTL_TIME_ZONE_INFORMATION �9 _TRACE_VERSION_INFO $ GV EVENT_EXTENDED_ITEM_EVENT_KEY � _CLIENT_ID ( CV STREAMS_ASSOCIATE_ID_INPUT_BUFFER ! @V PPS_MITIGATION_OPTIONS_MAP 0 !< _SYSTEM_FEATURE_CONFIGURATION_INFORMATION � tagAXESLISTA ?V PINPUT_RECORD " �A FILE_ALLOCATED_RANGE_BUFFER , <A _SYSTEM_LOGICAL_PROCESSOR_INFORMATION >V LPCOMSTAT ? _IMAGE_CHPE_METADATA_X86 =V PSCRUB_PARITY_EXTENT_DATA � IMAGE_POLICY_ID �S PO_WAKE_SOURCE_HEADER �T T2_SET_PARAMETERS ;V _MCI_STATS u1 EMRSETMAPPERFLAGS #T PRPC_SID % 3V PPROCESS_MITIGATION_DEP_POLICY ` _PS_MITIGATION_OPTION 1V PCONSOLE_FONT_INFOEX 0V PCZPCWSTR �1 LPCCH -V SLIST_HEADER $ +V PSECURITY_IMPERSONATION_LEVEL - eU _FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER ( �> SYSTEM_WATCHDOG_TIMER_INFORMATION - *V PPLUGPLAY_CONTROL_TARGET_RELATION_DATA ( �? SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX ( (V _SYSTEM_MANUFACTURING_INFORMATION $ $V _EVENT_EXTENDED_ITEM_INSTANCE F. ETW_THREAD_SET_NAME_EVENT � tagMSGBOXPARAMSA # !V PFILE_LINK_ENTRY_INFORMATION # �Q SYSTEM_FEATURE_CONFIGURATION # � ACTIVATION_CONTEXT_MSIX_INFO O% PCZZWSTR � KPROFILE_SOURCE V PDISPATCHER_CONTEXT_ARM64 + � PROCESS_EXTENDED_BASIC_INFORMATION64 % V _PERFINFO_SET_POWER_ACTION_RET
O% LPCWCH 7 HEAP_SUBSEGMENT_ACTIVATED �5 EVENTLOG_FULL_INFORMATION kS NETINFOSTRUCT X: WMIGUIDINFORMATION ) ETW_WAKE_COUNTER_EVENT 0 DG _MEMORY_PARTITION_INITIAL_ADD_INFORMATION V LPSCROLLINFO # V POFFSETINSTANCEDATAANDLENGTH PLANGINDEX ) �4 FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER V PHELPWININFO , V PJOBOBJECT_IO_ATTRIBUTION_INFORMATION �B LPCRECT �> CPTABLEINFO V DRAWSTATEPROC
V PPORT_DATA_ENTRY , �: _SYSTEM_SECUREBOOT_POLICY_INFORMATION 2 G? _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE O. tagEMRCREATEBRUSHINDIRECT
l) _M128A �? PCOUNTED_REASON_CONTEXT V PSUPPORTED_OS_INFO �U HGESTUREINFO__ - _IMAGE_THUNK_DATA64 # V TXFS_CREATE_MINIVERSION_INFO - � PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA & _REPARSE_DATA_BUFFER �0 _SYSTEM_FLUSH_INFORMATION �@ FILE_ID_DESCRIPTOR � BITMAPCOREHEADER
p PUTSTR . �U FILE_PROCESS_IDS_USING_FILE_INFORMATION �U PSYSTEM_WORKINGSET_ENTRY �U LPGCP_RESULTS �: tagEMRCREATEPEN # �U _ETW_COVERAGE_SAMPLER_SAMPLE
�U SID ( B7 _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES & p, PERFINFO_CC_SCHEDULE_READ_AHEAD % �U PPOWER_THROTTLING_THREAD_STATE �U PSYSDBG_IO_SPACE B OVERLAPPED �U LPMONITORINFOEXW ) ?# PERFINFO_HARDPAGEFAULT_INFORMATION $ 9F FILE_MOVE_CLUSTER_INFORMATION �U PPNP_QUERY_RELATION � LPMSGBOXPARAMSA $ �6 _OBJECT_DIRECTORY_INFORMATION �C tagLOGBRUSH32 �Q SERVICE_DESCRIPTIONA �U PEMRELLIPSE $ �/ _ETW_TP_EVENT_POOL_TH_MIN_SET & =5 ETW_COVERAGE_SAMPLER_BLOOM_INFO �: _RTL_PROCESS_MODULES & �1 SYSTEM_MEMORY_USAGE_INFORMATION �U SERVICE_MAIN_FUNCTIONA �> _XSAVE_AREA_HEADER ! PROCESS_HANDLE_INFORMATION �U HGESTUREINFO ' E5 _WMI_EXTENDED_THREAD_INFORMATION � _SYMBOLIC_LINK_INFO_CLASS �' PEMRPOLYBEZIERTO16 �B EMRPOLYDRAW16 $ �U PETW_PARTITION_INFO_EXTENSION l) M128A 0 PSCROLLBARINFO e0 PERFINFO_CCSWAP_LITE �U PREG_NOTIFY_INFORMATION �U _FILE_END_OF_FILE_INFO �U PPERFINFO_MARK_EVENT ( � PERFINFO_DRIVER_COMPLETIONROUTINE
7 PCTSTR �U EXCEPTION_RECORD32 _STREAM_INFORMATION_ENTRY � EVENT_TRACE_HEADER 0 �" _JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 �( PERFINFO_IPI_RECEIVE_DATA Z IMAGE_NT_HEADERS32 " �U IMAGE_RESOURCE_DIR_STRING_U �C NEWTEXTMETRICEXA _devicemodeA �U PCZPWSTR �U PKSPIN_LOCK_QUEUE_NUMBER D( _SCOPE_TABLE_ARM64 �U PSECURITY_SEED_AND_LENGTH �E _VARIABLE_NAME_AND_VALUE $ �U _CM_DISK_GEOMETRY_DEVICE_DATA � _FILE_ID_128 o _SYSDBG_CONTROL_SPACE T RTL_HEAP_STACK_QUERY " PDWORD_PTR ) �U SYSTEM_MEMORY_TOPOLOGY_INFORMATION " �U PWNF_STATE_NAME_INFORMATION % PEMRCHORD �U PTOKEN_MANDATORY_POLICY �# FSCTL_UNMAP_SPACE_OUTPUT * .5 _SYSTEM_EXTENDED_THREAD_INFORMATION 1 _JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL �U PLBR_TRACE_EVENT_DATA % �T TOKEN_APPCONTAINER_INFORMATION �U PEMRCREATEPALETTE �U PACL_REVISION_INFORMATION +: FILE_ID_INFORMATION �U REPARSE_POINT_INFORMATION & �U PRTL_PROCESS_BACKTRACES_CONTROL � PRTL_RB_NODE
% POINTS U LPICONMETRICSW % BS _FILE_FS_FULL_SIZE_INFORMATION �% KEY_SET_INFORMATION_CLASS cs_byte �@ ETW_REFDEREF_OBJECT_EVENT ( �C EVENT_TRACE_GROUPMASK_INFORMATION . �U PCACTIVATION_CONTEXT_SECTION_KEYED_DATA �* _CM_SHARE_DISPOSITION � PEMRSETVIEWPORTEXTEX 8 tagEMRSTRETCHBLT u PDWORD32 ( �U PMEMORY_ENCLAVE_IMAGE_INFORMATION % �U PWIM_PROVIDER_INTEGRITY_STATUS " �U PETW_COVERAGE_SAMPLER_STATS # �, FILE_COMPRESSION_INFORMATION �U FILE_FULL_EA_INFORMATION _MUTANT_INFORMATION_CLASS % XG SYSTEM_PERFORMANCE_INFORMATION �# WORKERFACTORYINFOCLASS �U PNTFS_STATISTICS_EX & �U PKEY_VIRTUALIZATION_INFORMATION �U PGUITHREADINFO �U _ETW_KQUEUE_ENQUEUE_EVENT _ACL_SIZE_INFORMATION �U PTHREAD_TEB_INFORMATION �; tagINPUT_TRANSFORM �U PETW_UMS_EVENT_PARK & �U PCCOMPATIBILITY_CONTEXT_ELEMENT �U PCONSOLE_HISTORY_INFO �U PWMI_WAIT_MULTIPLE �U PQUAD & 6 _PERFINFO_INTERRUPT_INFORMATION �U PEXCEPTION_RECORD64 $ |U PSYSTEM_EXCEPTION_INFORMATION wU LPGLYPHMETRICS uU PMODEMDEVCAPS sU _WMI_IRQ_RECORD # q PSECURITY_DESCRIPTOR_CONTROL : KCRM_MARSHAL_HEADER pU PFILE_ID_BOTH_DIR_INFO 3 tagLOGFONTA oU LPNLSVERSIONINFOEX �T FILE_FULL_DIR_INFO mU IO_STATUS_BLOCK hU PREPARSE_INDEX_KEY % n FILE_PIPE_DELETE_SYMLINK_INPUT , eU FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER �4 PROCESSOR_RECORD % �& LINK_TRACKING_INFORMATION_TYPE bU PRTL_BACKOFF / aU PJOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 �$ SE_ACCESS_REQUEST * �; ALPC_PORT_ASSOCIATE_COMPLETION_PORT �! MIDL_INTERCEPTION_INFO _U _WMI_WAIT_MULTIPLE % % PLUGPLAY_CONTROL_PROPERTY_DATA . �, _RESOURCEMANAGER_COMPLETION_INFORMATION 9' PDISPLAY_DEVICEW �R _FLOATING_SAVE_AREA %> _TIMELINE_BITMAP * �. SYSTEM_HYPERVISOR_QUERY_INFORMATION `4 ETW_CLOSE_HANDLE_EVENT YU PRTL_AVL_ALLOCATE_ROUTINE �5 PEMRSELECTOBJECT /# _PLUGPLAY_EVENT_CATEGORY �& _cpinfoexW WU IMAGE_RELOCATION SU QUOTA_LIMITS_EX OU _PS_STD_HANDLE_INFO IU _WRITE_USN_REASON_INPUT FU PCONSOLE_CURSOR_INFO �7 RPC_SECURITY_QOS �- _PROCESSOR_IDLE_STATES �> LPDLGITEMTEMPLATEA ! 32 _FILE_STANDARD_INFORMATION DU HRAWINPUT__ @U KTMOBJECT_CURSOR " UCSCHAR =U PPVALUEA �B INVERTED_FUNCTION_TABLE * 9U PIMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY 7U PEVENT_FILTER_EVENT_NAME # 6U PPLUGPLAY_CONTROL_DEPTH_DATA (S tagINPUT_INJECTION_VALUE H% COMPOSITIONFORM , 4U _JOBOBJECT_IO_ATTRIBUTION_INFORMATION 1U PFILE_REGION_OUTPUT 0U PBOOT_ENTRY_LIST �C NPEVENTMSGMSG ,U PRTL_PHYSICAL_MEMORY_INFO 5 �F tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA v* LPEXTLOGFONTW # � _FILE_PIPE_LOCAL_INFORMATION *U LPNETRESOURCEA CHAR_INFO )U PSERVICE_NOTIFY c% _WMI_REGISTRY ! (U PETW_WNF_EVENT_UNSUBSCRIBE q PWORD " Q" _FILE_ALIGNMENT_INFORMATION aS _FILE_LEVEL_TRIM_OUTPUT � WMI_PNP_RECORD &U RTL_HANDLE_TABLE U LPSTARTUPINFOEX p CCHAR �- LPEXCEPTION_POINTERS Z tagDELETEITEMSTRUCT U PRTL_AVL_TREE �G RTL_CRITICAL_SECTION64 ' U PPROCESS_WS_WATCH_INFORMATION_EX � FILE_SEGMENT_ELEMENT LPMENUTEMPLATEA % � _ETW_SESSION_NOTIFICATION_TYPE ! : CONSOLE_SCREEN_BUFFER_INFO U PEXCEPTION_ROUTINE - U PMEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE U NPOUTLINETEXTMETRIC ' p HEAP_EVENT_SUBSEGMENT_ALLOC_FREE b _IMAGE_DOS_HEADER U CSV_MGMT_LOCK $ U PSYSTEM_ROOT_SILO_INFORMATION & �? _SYSTEM_CPU_SET_TAG_INFORMATION 7 AXISINFOA D- MIDL_STUBLESS_PROXY_INFO % wA _MEMORY_EXHAUSTION_INFORMATION U PRTL_RELATIVE_NAME_U U PICONMETRICSW &
U PSYSTEM_PROCESS_TRUST_LABEL_ACE U PCSVFS_DISK_CONNECTIVITY U _TP_DIRECT K _LUID LANGSPEC �T GDI_HANDLE_BUFFER64 " �T PFILE_DIRECTORY_INFORMATION * * _VIRTUALIZATION_INSTANCE_INFO_INPUT �T LPGCP_RESULTSW ) �S _ETW_TP_EVENT_TIMER_EXPIRATION_END �I WMIREGINFO ' �E _ALPC_SERVER_SESSION_INFORMATION & �F CREATEFILE2_EXTENDED_PARAMETERS �D FILE_ATTRIBUTE_TAG_INFO �T PEMRSETCOLORADJUSTMENT ! �T PETW_CPU_CACHE_FLUSH_EVENT $ �T SYSTEM_OBJECTTYPE_INFORMATION $ RTL_DISK_SPACE_INFO 0 PRECT ! �T PIMAGE_ARCHITECTURE_HEADER & �T PTOKEN_APPCONTAINER_INFORMATION b2 LDR_DATA_TABLE_ENTRY64 " �4 RTL_USER_PROCESS_PARAMETERS 6 POWER_SESSION_WINLOGON �! tagEMRLINETO & - FILE_CASE_SENSITIVE_INFORMATION ! �T PRTL_TREE_COMPARE_FUNCTION B LPCANDIDATEFORM �T _MESSAGE_TRACE_HEADER �. CLASSIC_EVENT_ID +
_EVENT_TRACE_SPINLOCK_INFORMATION_V1 !0 tagRECT ' �T PRTL_QUERY_DEBUG_VIRTUAL_PROCESS �S IMAGE_RESOURCE_DIRECTORY g PS_MITIGATION_OPTIONS_MAP " i: IMAGE_SEPARATE_DEBUG_HEADER $ �T PSYSTEM_BOOT_LOGO_INFORMATION ? _MM_ETW_PAGE_INFO + ; PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT 0 �T PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION �T SCRUB_PARITY_EXTENT � _ETW_NOTIFICATION_TYPE �T PVOLUME_BITMAP_BUFFER # �T PSHRINK_VOLUME_REQUEST_TYPES �T PETW_WNF_EVENT_PUBLISH ' �T PETW_COVERAGE_SAMPLER_PERF_STATS �# PANSI_STRING �T PDELETE_USN_JOURNAL_DATA �T PTP_JOB_CALLBACK �> tagPELARRAY & ! _HEAP_REUSE_THRESHOLD_ACTIVATED SSIZE_T � _ALPC_TOKEN_ATTR " @& SYSTEM_VERIFIER_INFORMATION ( AA SYSTEM_CONTEXT_SWITCH_INFORMATION * � _RTL_FEATURE_CONFIGURATION_PRIORITY X: _WMIGUIDINFORMATION Z _IMAGE_NT_HEADERS ' �T PRTL_STACK_TRACE_DATABASE_CREATE $ �T PRTL_PROCESS_LOCK_INFORMATION g) tagGESTURECONFIG � ULARGE_INTEGER w. TP_IO 4 HEAP_EXTENDED_INFORMATION d! _MM_ETW_PAGE_EXTRA_INFO & �T _WIM_PROVIDER_ADD_OVERLAY_INPUT �T LPKERNINGPAIR �T PPERFINFO_IO_TIMER & �T PPROCESS_MEMORY_ALLOCATION_MODE $ � _SYSTEM_PROCESSOR_INFORMATION + �T PSYSTEM_FEATURE_CONFIGURATION_UPDATE �T RTL_MODULE_EXTENDED_INFO �T _T2_SET_PARAMETERS_V0 � TP_CALLBACK_PRIORITY �T PTITLEBARINFO �% tagWNDCLASSW " �T PEVENT_INSTANCE_GUID_HEADER 1 �T PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION - RTL_HEAP_TAG # g? PLUGPLAY_CUSTOM_NOTIFICATION �T PETW_NOTIFICATION_HEADER ! �T PACCESS_ALLOWED_OBJECT_ACE � SECURE_SETTING_VALUE_TYPE �T KLDR_DATA_TABLE_ENTRY32 �C _ETW_HEAP_EVENT_EXPANSION �T PTOKEN_PRIVILEGES [/ INITIAL_TEB �T PFILE_NAME_INFORMATION 9 KTMOBJECT_TYPE 3 �Q PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY � FILE_STAT_LX_INFORMATION % �T PWMI_JOB_SET_QUERY_INFORMATION �T _locale_t " LOGICAL $ �T PPERFINFO_MEM_RESET_INFO_TYPE 1 % MEMORY_PARTITION_CONFIGURATION_INFORMATION W1 _RTL_BACKOFF , �D SERVICE_CONTROL_STATUS_REASON_PARAMSW {: _OBJECT_ATTRIBUTES64 a< ENUMLOGFONTA �T PBLENDFUNCTION > _ETW_PER_SESSION_QUOTA + � _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN " E _WIM_PROVIDER_OVERLAY_ENTRY �T PSCRUB_PARITY_EXTENT . ETW_OPTICALIO_READWRITE " �T PPERFINFO_CC_CAN_WRITE_FAIL ( �% SYSTEM_REGISTRY_QUOTA_INFORMATION ( m> _CFG_CALL_TARGET_LIST_INFORMATION % c MEMORY_WORKING_SET_INFORMATION �E _FOUR_PART_VERSION HGDIOBJ �T LPQUERY_SERVICE_CONFIGW �( EMRCOLORMATCHTOTARGET % 1- MM_ETW_WORKING_SET_PFN_RUNDOWN ( B RESOURCEMANAGER_INFORMATION_CLASS �T PRTL_DEBUG_INFORMATION % PEMRARCTO �4 tagWNDCLASSEXW �# POEM_STRING iF RTL_FEATURE_USAGE_REPORT �* _MCI_ADDR � _SECURITY_ATTRIBUTES & �T LPOVERLAPPED_COMPLETION_ROUTINE �9 CANDIDATELIST " �T PTRACE_ENABLE_FLAG_EXT_ITEM �T PRAWINPUTHEADER �T PFILE_FULL_DIR_INFO ! �@ ETW_COVERAGE_SAMPLER_STATS ' _SYSTEM_SHADOW_STACK_INFORMATION �T PMEMORY_RANGE_ENTRY ) �T PMEMORY_WORKING_SET_EX_INFORMATION � WMI_JOB_ASSIGN_PROCESS �T _WNF_DELIVERY_DESCRIPTOR 9? _COMPRESSED_DATA_INFO ' &4 RPC_HTTP_TRANSPORT_CREDENTIALS_A �T IMAGE_VXD_HEADER ! �Q _RTL_FEATURE_CONFIGURATION $ K _TXFS_LIST_TRANSACTIONS_ENTRY 9= _IMAGE_IMPORT_DESCRIPTOR �5 PTEXTMETRICW " �T PROCESS_LOGGING_INFORMATION - �S _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX j, IMAGE_HOT_PATCH_HASHES R CLIENT_ID64 $ `A _ETW_TP_EVENT_TIMER_CANCELLED % }T PFILE_PIPE_ASSIGN_EVENT_BUFFER G _RTL_BITMAP_RUN D _EXCEPTION_LOG {T _RTL_ENCLAVE_LAUNCH_TOKEN u4 WNF_TYPE_ID _STARTUPINFOW E8 _LDR_DATA_TABLE_ENTRY �6 tagEXTLOGFONTA + �% JOURNAL_SET_DELETE_VALUE_INFORMATION ! tT PRTL_TIME_ZONE_INFORMATION �9 CHANGEFILTERSTRUCT � _FILE_DISPOSITION_INFO_EX V9 VS_FIXEDFILEINFO rT PSE_SID ) S: _RTL_IMAGE_MITIGATION_OPTION_STATE
qT HLSURF oT ETW_CLOCK_TIME_UPDATE 9 �/ _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION iT PKEY_NAME_INFORMATION $ gT PTRANSACTION_BIND_INFORMATION � ETW_DISABLE_KTIMER2_EVENT ' fT PPROCESS_HANDLE_TABLE_ENTRY_INFO _FILE_INFORMATION_CLASS N) tagMULTIKEYHELPW " PUUCSCHAR + G PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA t' RID_DEVICE_INFO_MOUSE # REGHANDLE ! eT PSECTION_BASIC_INFORMATION HDWP + bT PSYSTEM_CRASH_DUMP_STATE_INFORMATION >, _FLOAT128 4 aT PJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE `T NAMEENUMPROCA _T LPENUM_SERVICE_STATUSW " _DISPLAY_DEVICEA �) tagPOLYTEXTA �- _IMAGE_TLS_DIRECTORY32 EC _ImageArchitectureHeader , LDR_DLL_NOTIFICATION_DATA 1 4/ _SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE ^T PETW_UMGL_KEY WIN32_MEMORY_RANGE_ENTRY �8 _CONTEXT Y. PHYSICAL_CHANNEL_RUN �E _HEAP_BLOCK_INFORMATION ]T HWND \T PGET_MODULE_HANDLE_EXW XT PPOINTFLOAT 1 WT PMEMORY_PARTITION_PAGE_COMBINE_INFORMATION - ST PACTIVATION_CONTEXT_SECTION_KEYED_DATA �7 _FILE_NOTIFY_INFORMATION ) s* SYSTEM_SESSION_PROCESS_INFORMATION QT PTRACE_ENABLE_CONTEXT " PT PIMAGE_DELAYLOAD_DESCRIPTOR �" _RTL_MODULE_BASIC_INFO , OT PPROCESS_MITIGATION_IMAGE_LOAD_POLICY B SC_ACTION_TYPE bE IMAGE_EXPORT_DIRECTORY ~R tagEMRGRADIENTFILL � KLOCK_QUEUE_HANDLE MT EXIT_PROCESS_DEBUG_INFO KT PEVENT_DESCRIPTOR JT PWNODE_SINGLE_INSTANCE fD LDRP_CSLIST A LPBITMAPV5HEADER A _PARSE_MESSAGE_CONTEXT IT PUNICODE_STRING64 �E EMRDRAWESCAPE -0 _KCRM_TRANSACTION_BLOB 0 �Q _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION �$ EMRCHORD 6 PCUZZTSTR HT PCFG_CALL_TARGET_INFO FT tagWCRANGE �R PEMRSETBKCOLOR DT PIMAGE_ENCLAVE_CONFIG64 �? PEMRWIDENPATH # @T PFILE_FS_CONTROL_INFORMATION �? _GRADIENT_TRIANGLE �+ UQUAD >T PINTERFACE_TYPE �" MEMORY_RANGE_ENTRY � _TABLE_SEARCH_RESULT =T WOW64_REMOTE_FUNCTION64 v. LPDEVMODEA :T WNF_USER_CALLBACK _ARM64_NT_NEON128 ' E# _JOBOBJECT_BASIC_PROCESS_ID_LIST �R PROCESSOR_RELATIONSHIP 9T PICONINFOEXA ' ICONINFOEXW 3 8T PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V1 ] SYSTEM_INFORMATION_CLASS ! 7T PWINDOW_BUFFER_SIZE_RECORD � WNODE_ALL_DATA " WNF_CHANGE_STAMP 0 _HARDWARE_COUNTER_TYPE �F _FILE_SET_SPARSE_BUFFER ) 6T PSYSTEM_MEMORY_CHANNEL_INFORMATION �@ _CM_EISA_SLOT_INFORMATION �$ HEAP_RANGE_INFORMATION �C LPBITMAPINFO 5T PETW_DEBUG_PRINT_EVENT $ 3T PROCESS_FOREGROUND_BACKGROUND & 0T PSL_KMEM_CACHE_VALUE_DESCRIPTOR n+ POSVERSIONINFOEXW & *T PPLUGPLAY_CONTROL_CONFLICT_DATA q# _RTL_CONDITION_VARIABLE 'T INPUT_MESSAGE_SOURCE � _currencyfmtA $ :E _NDR_USER_MARSHAL_INFO_LEVEL1 $T PPRPC_SID - �2 FSCTL_GET_INTEGRITY_INFORMATION_BUFFER # � DISPLAYCONFIG_COLOR_ENCODING + !T _FILE_LINK_ENTRY_FULL_ID_INFORMATION �A _WIN32_FIND_STREAM_DATA T PPOWERBROADCAST_SETTING - T PPROCESS_MITIGATION_POLICY_INFORMATION , T PEVENT_TRACE_SYSTEM_EVENT_INFORMATION 4 �Q _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY T PRTL_HEAP_STACK_QUERY � PACTIVATION_CONTEXT & T PIMAGE_DYNAMIC_RELOCATION_TABLE / _PERFINFO_TRACE_HEADER $ T PWIM_PROVIDER_START_INTEGRITY ' T _SYSTEM_ACTIVITY_MODERATION_INFO ? 5 _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA $ �G _ETW_CLOCK_STATE_CHANGE_EVENT T PMM_ETW_WORKING_SET_TYPE $ PROCESS_WORKING_SET_OPERATION '
T PQUERY_PERFORMANCE_COUNTER_FLAGS // POSVERSIONINFOW , T PDEDUP_QUERY_FILE_HASHES_INPUT_BUFFER REFS_SMR_VOLUME_GC_STATE T PNT_TIB32 ! |A _CREATE_PROCESS_DEBUG_INFO T HTOUCHINPUT $ l; KNONVOLATILE_CONTEXT_POINTERS , T PJOBOBJECT_SECURITY_LIMIT_INFORMATION $ � _FILE_ID_EXTD_DIR_INFORMATION �C _CSV_QUERY_FILE_REVISION �S tagBITMAPCOREINFO $ 5> _PROCESS_WS_WATCH_INFORMATION + �: SYSTEM_SECUREBOOT_POLICY_INFORMATION
" FEEDBACK_TYPE �B _VM_COUNTERS_EX2 �= _FSCTL_OFFLOAD_READ_INPUT �' EMRCREATECOLORSPACEW �+ TOKEN_ELEVATION_TYPE b; tagPALETTEENTRY M EMRPOLYDRAW ' T PPROCESS_LEAP_SECOND_INFORMATION � FILE_QUERY_SPARING_BUFFER & �* _FSCTL_UNMAP_SPACE_INPUT_BUFFER �9 _WMI_IDE_CHANNEL_RECORD 3 �S PJOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION
p LPTSTR �8 _PROCESS_JOB_MEMORY_INFO }# REPARSE_DATA_BUFFER_EX �S PBOOT_OPTIONS �D WMI_LOGGER_INFORMATION F' PMENUBARINFO ? PS_PROTECTED_SIGNER " �S PPOWER_STATE_NOTIFY_HANDLER $ �B KEY_VALUE_PARTIAL_INFORMATION �S PPREFIX_TABLE_ENTRY "8 _HARDWARE_COUNTER_DATA ! 1% ENTER_STATE_SYSTEM_HANDLER � KEY_INFORMATION_CLASS �S BITMAPCOREINFO % �1 ETW_WNF_EVENT_NAME_SUB_RUNDOWN ! �= _PROCESS_FAULT_INFORMATION TP_TRACE_TYPE �S _PEB �? PEMRFLATTENPATH ' G" ETW_TIMER_EXPIRATION_START_EVENT �" MONITOR_DISPLAY_STATE " �S PTXFS_SAVEPOINT_INFORMATION �S MDICREATESTRUCTW �. WMI_PROCESS_INFORMATION ) �S PEVENT_TRACE_GROUPMASK_INFORMATION �S MESSAGE_RESOURCE_ENTRY _WMI_PAGE_FAULT �S PWAKE_TIMER_INFO �S MENUGETOBJECTINFO �S UILANGUAGE_ENUMPROCW ( �B JOBOBJECT_BASIC_LIMIT_INFORMATION % �; STREAMS_QUERY_ID_OUTPUT_BUFFER ! e' _SYSTEM_NUMA_PROXIMITY_MAP �S PDISPLAY_DEVICE �S tagGCP_RESULTSW �S SERVER_ROUTINE % �S PREFS_SMR_VOLUME_GC_PARAMETERS �< CBT_CREATEWNDA # � PS_CPU_QUOTA_SET_INFORMATION �- SD_QUERY_STATS_OUTPUT �S PRPC_SECURITY_QOS �S PEVENT_HEADER �+ _SECURITY_CAPABILITIES , �S SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX �S LPFIBER_START_ROUTINE �> TOUCHPREDICTIONPARAMETERS �S _TEB_ACTIVE_FRAME_EX �, OSVERSIONINFOEX2W �S PNTFS_STATISTICS �S PEMRSETMITERLIMIT �S EMRROUNDRECT �S LPRAWHID �S PIMAGE_RESOURCE_DIRECTORY $ �> _FILE_VOLUME_NAME_INFORMATION �S _PO_WAKE_SOURCE_HEADER % �D ETW_COVERAGE_SAMPLER_PERF_INFO % �7 _WMI_DISKIO_IO_REDIRECTED_INIT * �: SYSTEM_NET_RATE_CONTROL_SET_CONTEXT �S PRTL_QUERY_REGISTRY_TABLE & �+ _SYSTEM_MEMORY_LIST_INFORMATION �1 STREAM_INFO_LEVELS �" PCWPRETSTRUCT ! �S _ETW_CPU_CACHE_FLUSH_EVENT * � _PERFINFO_BOOT_PREFETCH_INFORMATION # �> FILE_VOLUME_NAME_INFORMATION �S PTOKEN_ELEVATION �S LPCURRENCYFMTA N= _HEAP_COMMIT_DECOMMIT + �( _ETW_UMS_EVENT_DIRECTED_SWITCH_START �% tagLOGCOLORSPACEA ) �S PETW_TP_EVENT_TIMER_EXPIRATION_END ( �S PPROCESS_HANDLE_TRACING_ENABLE_EX �S PTP_WORK j tagDIBSECTION �S PROPENUMPROC # �@ JOBOBJECT_FREEZE_INFORMATION ! �S PRTL_FEATURE_CONFIGURATION _D _TP_DEBUG_CLASS + �S PROCESS_PROTECTION_LEVEL_INFORMATION " PKAFFINITY }S IMAGE_ROM_HEADERS xR ATOM_BASIC_INFORMATION ! zS PFILE_REMOTE_PROTOCOL_INFO . �: _FILE_DESIRED_STORAGE_CLASS_INFORMATION # O$ _RTL_GENERIC_COMPARE_RESULTS . � _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA & % _PLUGPLAY_CONTROL_PROPERTY_DATA 03 RTL_SRWLOCK " xS PETW_UMS_EVENT_DISASSOCIATE $ vS tagEMRCREATEDIBPATTERNBRUSHPT ! F PROCESS_UPTIME_INFORMATION sS PUSN_RECORD_UNION � _FILE_ID_INFO qS ETW_THREAD_AFFINITY_EVENT nS PRPC_DISPATCH_TABLE " % PERFINFO_CC_LAZY_WRITE_SCAN �@ WMI_DISKIO_READWRITE mS PSYSDBG_PHYSICAL TR LPABCFLOAT kS _NETINFOSTRUCT gS _IMAGE_IMPORT_BY_NAME � _DMA_SPEED dS PSYSTEM_PREFETCH_STATS � _SYSTEM_VA_TYPE t PLONG32 " ACCESS_REASON cS PFILE_EA_INFORMATION _S PFILE_LEVEL_TRIM_OUTPUT % . RTL_DYNAMIC_HASH_TABLE_CONTEXT % ]S PRTL_UMS_SCHEDULER_ENTRY_POINT = TITLEBARINFOEX ' [S LOOKUP_STREAM_FROM_CLUSTER_ENTRY ) XS PSYSTEM_SECURITY_MODEL_INFORMATION �% NPWNDCLASSW WS PFILEMUIINFO 1 R EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION VS EDITWORDBREAKPROC [2 LPMSG % C/ ETW_AUTOBOOST_NO_ENTRIES_EVENT * �5 _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE MS PSE_ACCESS_REPLY - �2 FSCTL_SET_INTEGRITY_INFORMATION_BUFFER I _KCRM_PROTOCOL_BLOB JS _NETCONNECTINFOSTRUCT D _IMAGE_SYMBOL_EX + GS PCASSEMBLY_FILE_DETAILED_INFORMATION ! ES PPERFINFO_FILE_INFORMATION ! |8 _PAGE_PRIORITY_INFORMATION �C LPMETARECORD j6 RPC_SECURITY_QOS_V3_A DS LPMONITORINFO �- __GENERIC_BINDING_INFO ;3 _IO_ERROR_LOG_MESSAGE % @S PFILE_FS_FULL_SIZE_INFORMATION =S _NT_TIB32
> FILE_BASIC_INFORMATION 9S FILE_PIPE_INFORMATION . 5S PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA , 1S FILE_FS_PERSISTENT_VOLUME_INFORMATION �R FILE_REGION_INPUT + tagMOUSEHOOKSTRUCT �C tagMETARECORD ( -S _PERFINFO_MEMORY_NODE_INFORMATION (S INPUT_INJECTION_VALUE %S PWX86TIB # � SharedVirtualDiskHandleState " "$ _POWER_MONITOR_REQUEST_TYPE * #S RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W S PFLOATING_SAVE_AREA S PRTL_RXACT_LOG ! j= _SILOOBJECT_ROOT_DIRECTORY + S PPLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA S PPNP_VETO_TYPE �3 RTL_HEAP_TAG_INFO k/ PROCESS_ENERGY_VALUES � SCONTEXT_QUEUE $ S PRTL_GENERIC_ALLOCATE_ROUTINE S PPOWER_SESSION_WINLOGON � PROCESS_ACTIVITY_TYPE S PRTL_STACK_CONTEXT �G _RTL_CRITICAL_SECTION64 ( S PFILE_FS_VOLUME_FLAGS_INFORMATION ' �2 _REDIRECTION_FUNCTION_DESCRIPTOR $ �D _PROCESS_HANDLE_TRACING_ENTRY " S PUNICODE_PREFIX_TABLE_ENTRY 3 _DEP_SYSTEM_POLICY_TYPE S LPEXTLOGFONTA S PTHREAD_PERFORMANCE_DATA ) �( _FILE_ID_GLOBAL_TX_DIR_INFORMATION � LPRAWINPUTDEVICE ! S LPOUTPUT_DEBUG_STRING_INFO $ S PTXFS_TRANSACTION_ACTIVE_INFO # S PMEMORY_PRIORITY_INFORMATION ]= _RTL_GENERIC_TABLE " LPDWORD � LPRAWINPUT ! _OSVERSIONINFOA S CALINFO_ENUMPROCEXEX S LPIMEMENUITEMINFO �. _CI_WINDOWS_LOCKDOWN_MODE # !@ tagACTCTX_SECTION_KEYED_DATA 2
S PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 S LPEXCEPTION_DEBUG_INFO S _EVENT_FILTER_LEVEL_KW S PALPC_HANDLE_ATTR S LPOUTLINETEXTMETRICA & SA _FILE_PROVIDER_EXTERNAL_INFO_V1 �B TOKEN_OWNER & � APPLICATIONLAUNCH_SETTING_VALUE �R _RTL_HEAP_WALK_ENTRY S GDI_HANDLE_BUFFER S PEISA_IRQ_DESCRIPTOR S PWMI_CONTEXTSWAP + �R PCLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE . �R _FILE_NETWORK_PHYSICAL_NAME_INFORMATION
: SYSDBG_MSR 7- _QUERY_BAD_RANGES_INPUT �R PTPP_THREAD_DATA_CALLBACK �R PROPENUMPROCEXA �R PRPC_POLICY ' �R PPERFINFO_CC_SCHEDULE_READ_AHEAD " _PROCESS_HANDLE_INFORMATION �, _OSVERSIONINFOEX2W ( d _RTL_QUERY_DEBUG_INFORMATION_INFO �! _DOCINFOA - �R PALPC_PORT_COMPLETION_LIST_INFORMATION % �R _NTPSS_MEMORY_BULK_INFORMATION �R PEISA_PORT_CONFIGURATION �R RTL_RVA_LIST_ITERATOR �R PPROCESS_INFORMATION �R _PROCESSOR_RELATIONSHIP % �: CM_PNP_BIOS_INSTALLATION_CHECK �R PTP_ALPC_CALLBACK_EX % $: EVENT_EXTENDED_ITEM_PEBS_INDEX 0 U, TRANSACTION_NOTIFICATION_PROMOTE_ARGUMENT �R PRTL_ELEVATION_FLAGS " �R _ETW_TIMER_EXPIRATION_EVENT ( �B _SYSTEM_ACTIVITY_MODERATION_STATE 1 FF _PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED �R LPSERIALKEYSW ( �R FILE_PIPE_EVENT_ENUM_INPUT_BUFFER & EVENTLOGRECORD u- PEMRPOLYBEZIER " �R PETW_DUPLICATE_HANDLE_EVENT �R LPEXTLOGPEN �R IMCENUMPROC & jR _RTL_DISK_WRITE_CONSTRAINT_INFO E POLYTEXTW
PRLIST_ENTRY % �R PFILE_MAILSLOT_SET_INFORMATION & �R FILE_END_OF_FILE_INFORMATION_EX �R PFILE_REGION_INPUT HGLOBAL } RTL_RESOURCE_CATEGORY �R HFONT % �R PFILE_MOVE_CLUSTER_INFORMATION # �R PFILE_PROVIDER_EXTERNAL_INFO 1 �R PSYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION # }E SYSTEM_ROOT_SILO_INFORMATION �R PLDR_RESLOADER_RET $ �R _RTLP_HEAP_SERIALIZED_MAPPING & �B PROCESS_ENERGY_VALUES_EXTENSION �4 _COVERAGE_REQUEST_CODES NR MEMORY_IMAGE_INFORMATION + �R PTRANSACTION_ENLISTMENTS_INFORMATION �R ACCESS_DENIED_ACE �6 _Wx86TIB % `R _FILE_PIPE_ASSIGN_EVENT_BUFFER ) -1 PROCESS_COMMIT_RELEASE_INFORMATION
3 RGBTRIPLE 1/ RTL_OSVERSIONINFOW * �R PRTL_SPARSE_BITMAP_ALLOCATE_ROUTINE � CM_ROM_BLOCK �R HWINEVENTHOOK 4. _THREAD_NAME_INFORMATION R VIRTUAL_STORAGE_TYPE �R FLOATING_SAVE_AREA ! _RPC_CLIENT_INTERFACE : S SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION ) �E _SYSTEM_MEMORY_CHANNEL_INFORMATION �R PIRQ_PRIORITY ) �R PRTL_PROCESS_BACKTRACE_INFORMATION �: _RTLP_TAG_INFO � _PEBS_DS_SAVE_AREA64 �R PEMREXTTEXTOUTA ( �) SE_LEARNING_MODE_USER_OBJECT_DATA ) 0, _RTL_PROCESS_MODULE_INFORMATION_EX % 6 JOURNAL_RENAME_KEY_INFORMATION �E HMONITOR__ �: PERFINFO_FILE_READ_WRITE �R PCSV_QUERY_REDIRECT_STATE �R HMETAFILE__ �R PMENUITEMTEMPLATE ( & _RPC_BINDING_HANDLE_TEMPLATE_V1_A �R PALPC_WORK_ON_BEHALF_ATTR �R LPALTTABINFO �R PFILE_FS_SIZE_INFORMATION �R LPCREATESTRUCT �R FP_32 0 �R PSYSTEM_REGISTRY_APPEND_STRING_PARAMETERS # � SECURITY_IMPERSONATION_LEVEL # �< _SD_CHANGE_MACHINE_SID_INPUT F TOKEN_INFORMATION_CLASS �R PFILE_LAYOUT_ENTRY ! �R PFILE_MAILSLOT_PEEK_BUFFER �R PRTL_HEAP_WALK_ENTRY " �R TIMER_SET_INFORMATION_CLASS ( �R _RTL_IMAGE_MITIGATION_HEAP_POLICY y' _OFSTRUCT �9 LPLOGFONTA ) �R PWIM_PROVIDER_UPDATE_OVERLAY_INPUT ! �D _FILE_PIPE_WAIT_FOR_BUFFER �R MFENUMPROC �R PEMRSETTEXTCOLOR 3 �R PPROCESS_MITIGATION_USER_SHADOW_STACK_POLICY /% _PERFINFO_CCSWAP_IDLE 1 �R PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY � tagTEXTMETRICA ~R EMRGRADIENTFILL & zR PMEMORY_WORKING_SET_INFORMATION � _OSVERSIONINFOEXA ! �: SYSDBG_KD_PULL_REMOTE_FILE xR _ATOM_BASIC_INFORMATION �B EXTLOGPEN � XSAVE_AREA uR PSYSTEM_BATTERY_STATE tR PSERVICE_NOTIFY_2 (. POSVERSIONINFOEXA �5 _MESSAGE_TRACE_USER + rR _PERFINFO_PAGECOMBINE_ITERATION_STAT mR RTL_GENERIC_FREE_ROUTINE + lR PRTL_FEATURE_CONFIGURATION_OPERATION % jR RTL_DISK_WRITE_CONSTRAINT_INFO fR RGBQUAD N tagEMRPOLYPOLYLINE - � _PROCESS_MITIGATION_POLICY_INFORMATION �F tagSTYLESTRUCT ( - _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY - _THREAD_WORKLOAD_CLASS $ dR PSYSTEM_FILECACHE_INFORMATION cR PCIMAGE_EXPORT_DIRECTORY �/ _JOBOBJECT_WAKE_FILTER $ `R FILE_PIPE_ASSIGN_EVENT_BUFFER � tagBITMAPCOREHEADER + �5 EVENT_TRACE_TIME_PROFILE_INFORMATION ZR PPORT_VIEW �% ALPC_CONTEXT_ATTR XR PWNF_META_CALLBACK UR DESKTOPENUMPROCW , lA _PERFINFO_DRIVER_COMPLETE_REQUEST_RET $ RTL_RXACT_OPERATION TR NPABCFLOAT SR PEMRCREATECOLORSPACE Y, HEAP_EVENT_RANGE_CREATE , RR PPROCESS_STACK_ALLOCATION_INFORMATION QR PHARDERROR_MSG � SERIALKEYSW �B _INVERTED_FUNCTION_TABLE / PR PSTORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE NR _MEMORY_IMAGE_INFORMATION " ER PKEY_WRITE_TIME_INFORMATION �0 IMAGE_OPTIONAL_HEADER 9 � _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY CR PIMAGE_FUNCTION_ENTRY64 * ?R PVIRTUAL_STORAGE_SET_BEHAVIOR_INPUT ! 5R PKEY_SET_LAYER_INFORMATION 6' _SC_STATUS_TYPE % 3R PFILE_NETWORK_OPEN_INFORMATION *R PKEY_LAYER_INFORMATION # ' PERFINFO_PPM_IDLE_STATE_EXIT 5 'R _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY $ �@ _JOBOBJECT_FREEZE_INFORMATION . "R PPROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE # C@ SILOOBJECT_BASIC_INFORMATION �A WIN32_FIND_STREAM_DATA R PEMRRESIZEPALETTE # R PDRIVER_VERIFIER_THUNK_PAIRS R _RTL_FEATURE_USAGE_DATA " �/ ETW_COVERAGE_SAMPLER_MODULE
�% _COORD R RDR_CALLOUT_STATE 2 R PEVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION R _UNWIND_HISTORY_TABLE R PIO_ERROR_LOG_PACKET p. _ETW_HEAP_EVENT_REALLOC u; COVERAGE_SECTION_HEADER �; PEB_LDR_DATA �8 COMBOBOXINFO
PUINT8 $ : _FILE_DISPOSITION_INFORMATION ( R GET_FILTER_FILE_IDENTIFIER_OUTPUT �Q PWMI_TRACE_MESSAGE_PACKET �Q CSV_QUERY_MDS_PATH Z DELETEITEMSTRUCT �Q WNODE_EVENT_REFERENCE �Q _SERVICE_DESCRIPTIONA # DWORD64 ! �Q CS_TYPE_FROM_NETCS_ROUTINE $ �8 ETW_TP_EVENT_TIMER_EXPIRATION �Q PTOKEN_AUDIT_POLICY ! �Q ADMINISTRATOR_POWER_POLICY �Q PEMRNAMEDESCAPE E1 tagHARDWAREINPUT
H. PRECTL ! �Q PWMI_IMAGEID_INFORMATION64 �Q PWNF_STATE_NAME # H) PROCESS_HANDLE_TRACING_QUERY " PEXECUTION_STATE �Q PZPCSTR �Q tagEMRSETCOLORADJUSTMENT 0 �Q I_RpcProxyGetClientSessionAndResourceUUID �? _FNSAVE_FORMAT �Q PFP_IEEE_VALUE �/ _FILE_PREFETCH_EX " P8 _SYSTEM_PROCESS_INFORMATION �2 _KLDR_DATA_TABLE_ENTRY64 �Q THREAD_BASIC_INFORMATION ! �Q PSYSTEM_ALARM_CALLBACK_ACE & k+ RTL_QUERY_DEBUG_VIRTUAL_PROCESS �Q GENERIC_BINDING_ROUTINE �: _PERFINFO_FILE_READ_WRITE * �Q PPROCESS_EXTENDED_BASIC_INFORMATION 4 �Q PPROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY �$ RTL_MEMORY_TYPE �Q PFILE_BASIC_INFO & �Q PPOWER_THROTTLING_PROCESS_STATE q PARAM_OFFSETTABLE �Q MESSAGE_TRACE � TOKEN_USER A _HEAP_SUMMARY LA _RPC_PROTSEQ_VECTORA �E tagEMREXCLUDECLIPRECT PWMIHANDLE # �Q PROCESS_AFFINITY_UPDATE_MODE ( ( PERFINFO_DRIVER_MAJORFUNCTION_RET D CANSI_STRING 0 �Q PJOURNAL_TRANSACTION_BOUNDARY_INFORMATION # � RTL_XPRESS_CALLBACK_FUNCTION �Q LPCRECTL c. PERFINFO_VIRTUAL_ALLOC ' �2 GET_FILTER_FILE_IDENTIFIER_INPUT � RTL_AVL_TREE % � RTL_UMS_SCHEDULER_STARTUP_INFO �" _SE_SECURITY_DESCRIPTOR ' �$ _FILE_PIPE_CLIENT_PROCESS_BUFFER $ �Q PSYSTEM_FEATURE_CONFIGURATION # �Q LPQUERY_SERVICE_LOCK_STATUSW �/ TOKEN_SID_INFORMATION x@ WIN32_FILE_ATTRIBUTE_DATA �Q EMRMASKBLT �M NTFS_VOLUME_DATA_BUFFER # f# STARTING_LCN_INPUT_BUFFER_EX �M VOLUME_BITMAP_BUFFER �( MOVE_FILE_DATA �M MOVE_FILE_RECORD_DATA = MFT_ENUM_DATA_V0 � MFT_ENUM_DATA_V1 �< READ_FILE_USN_DATA �2 READ_USN_JOURNAL_DATA_V0 ); READ_USN_JOURNAL_DATA_V1 �G USN_RANGE_TRACK_OUTPUT �M USN_RECORD_V3 N& USN_RECORD_COMMON_HEADER 1C USN_RECORD_V4 �A USN_JOURNAL_DATA_V0 = USN_JOURNAL_DATA_V1 �M DELETE_USN_JOURNAL_DATA POWER_ACTION # � POWER_MONITOR_REQUEST_REASON � SYSTEM_POWER_CONDITION � SET_POWER_SETTING_VALUE � NOTIFY_USER_POWER_SETTING ;M BATTERY_REPORTING_SCALE r! POWER_STATE_HANDLER_TYPE 3" POWER_STATE_HANDLER ! 8M POWER_STATE_NOTIFY_HANDLER �G PPM_WMI_LEGACY_PERFSTATE PPM_WMI_IDLE_STATES 1M PPM_WMI_IDLE_STATES_EX �5 PPM_WMI_PERF_STATES -M PPM_IDLE_STATE_ACCOUNTING �! PPM_IDLE_ACCOUNTING # )M PPM_IDLE_STATE_ACCOUNTING_EX �F PPM_IDLE_ACCOUNTING_EX %M PPM_PERFSTATE_EVENT ! !M PPM_PERFSTATE_DOMAIN_EVENT �* PPM_IDLESTATE_EVENT M PPM_THERMALCHANGE_EVENT M PPM_THERMAL_POLICY_EVENT R) POWER_ACTION_POLICY �7 SYSTEM_POWER_LEVEL A) PO_WAKE_SOURCE_TYPE # � PO_INTERNAL_WAKE_SOURCE_TYPE ,K PTP_WAIT_CALLBACK � MCA_EXCEPTION_TYPE $ RTL_DISK_SPACE_POLICY ' �F RTL_DISK_WRITE_CONSTRAINT_POLICY �' RTL_BSD_ITEM_TYPE 0@ RTL_ACE_DATA ! � ACTCTX_REQUESTED_RUN_LEVEL ( ': ACTCTX_COMPATIBILITY_ELEMENT_TYPE & |J RTLWOW64_CROSSPROCESS_WORK_HEAD !A BITMAPV5HEADER & �2 DISPLAYCONFIG_SCANLINE_ORDERING # DISPLAYCONFIG_SCALING �I SHELLHOOKINFO �I POWERBROADCAST_SETTING �* BSMINFO �+ FLASHWINFO & �I SERVICE_TRIGGER_CUSTOM_STATE_ID �+ SERVICE_NOTIFY_2 �2 WMIREGGUIDW �I WMIREGINFOW � WMIDPREQUESTCODE I MOFRESOURCEINFOW �2 MOFRESOURCEINFOA I RPC_ENDPOINT_TEMPLATEW I RPC_ENDPOINT_TEMPLATEA I RPC_INTERFACE_TEMPLATEA �0 RPC_INTERFACE_TEMPLATEW
I RPC_DISPATCH_TABLE �6 XLAT_SIDE . ND _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST �G PRTL_CRITICAL_SECTION64 # �G TRACE_PROVIDER_INSTANCE_INFO �G PQUOTA_LIMITS �G PUSN_RANGE_TRACK_OUTPUT # �? DISPLAYCONFIG_MODE_INFO_TYPE /! STUB_PHASE �G _ALPC_SERVER_INFORMATION J6 USN_RECORD �? PEMRREALIZEPALETTE & �G POBJECT_HANDLE_FLAG_INFORMATION k FILEMUIINFO 7 �4 PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY �G FIND_BY_SID_OUTPUT . CHARSETINFO �G PPPM_WMI_LEGACY_PERFSTATE � _RTL_PROTECTED_ACCESS , �G JOBOBJECT_IO_RATE_CONTROL_INFORMATION - � _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET $ �G PPERFINFO_DOMAIN_CHANGE_EVENT �G _TOKEN_PRIMARY_GROUP ! �G PFILE_FS_LABEL_INFORMATION # �B _MANAGE_HOT_PATCH_LOAD_PATCH �D FILE_PIPE_WAIT_FOR_BUFFER �G PRTL_CIRCULAR_LIST_HEAD �C LPGRADIENT_TRIANGLE ' �5 LEARNING_MODE_OBJECT_INFORMATION $ �G PETW_CLOCK_STATE_CHANGE_EVENT 0 _RTL_LFG_RNG_STATE �G PLOGFONT ! �G PSECURITY_OBJECT_AI_PARAMS $ #5 _FILE_ID_BOTH_DIR_INFORMATION / �D _READ_DIRECTORY_NOTIFY_INFORMATION_CLASS ) �B FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 3 �G FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE ( �$ _ETW_COVERAGE_SAMPLER_CREATE_INFO �G PANSI_STRING32 ! �G PTP_POOL_STACK_INFORMATION xE _IMAGE_POLICY_METADATA ! |G PWMI_PROCESS_INFORMATION64 �) ETWTRACECONTROLCODE ( yG EVENT_EXTENDED_ITEM_STACK_TRACE64 vG PFILE_STAT_INFORMATION ( N3 _FILE_FS_FULL_SIZE_INFORMATION_EX % tG SL_KMEM_CACHE_VALUE_DESCRIPTOR L! EMRREALIZEPALETTE qG PCTOUCHINPUT 2 = PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY oG POSVERSIONINFOEX2A " RTL_PERTHREAD_CURDIR
LPBYTE nG PRPC_SECURITY_QOS_V4_A mG PSID_AND_ATTRIBUTES_ARRAY kG PTP_SIMPLE_CALLBACK - iG DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE dG PWMI_PUSHLOCK bG EMRNAMEDESCAPE & � ETW_COVERAGE_SAMPLER_QUERY_INFO PT2_CANCEL_PARAMETERS & _G PSYSTEM_MEMORY_LIST_INFORMATION ^G PTEB_ACTIVE_FRAME_CONTEXT I= _PS_CPU_QUOTA_QUERY_ENTRY ]& LPJIT_DEBUG_INFO64 \G RPC_POLICY & VG PSYSTEM_PERFORMANCE_INFORMATION QG PPLUGPLAY_NOTIFY_HDR " PG PCONSOLE_SCREEN_BUFFER_INFO NG SC_ACTION LG PHEAP_BLOCK_INFORMATION g. MOUSEINPUT & � ALPC_MESSAGE_HANDLE_INFORMATION q# RTL_CONDITION_VARIABLE KG PHPOWERNOTIFY ! IG _EVENT_EXTENDED_ITEM_TS_ID � _PERFINFO_CCSWAP_TYPE �E _TEB_ACTIVE_FRAME_CONTEXT 9 FG PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION d _CACHE_RELATIONSHIP # PS_SECURITY_DOMAIN 0 AG PMEMORY_PARTITION_INITIAL_ADD_INFORMATION 4 ?G PSEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION % 0= ACTIVATION_CONTEXT_QUERY_INDEX % =G tagI_RpcProxyCallbackInterface 4= IMAGE_ENCLAVE_CONFIG64 'G PTOKEN_OWNER u: SERVICE_STATUS # PDWORDLONG "G PRTL_HEAP_PARAMETERS G PRTLP_CURDIR_REF P' USER_MARSHAL_CB_TYPE �' GESTUREINFO $ G PFILE_PIPE_SILO_ARRIVAL_INPUT ' � RTL_FEATURE_VARIANT_PAYLOAD_KIND �E BOOT_ENTRY_LIST � _PERFINFO_GROUPMASK �6 tagMONITORINFO D tagCANDIDATEFORM G PGENERIC_BINDING_INFO $ G PSD_CHANGE_MACHINE_SID_OUTPUT " G PFILE_FS_VOLUME_INFORMATION
_AUDIT_EVENT_TYPE G PRTL_BITMAP_RUN �$ tagEMRARC G PVARIABLE_NAME_AND_VALUE G _CPU_CONFIG_RECORD G _COVERAGE_MODULE_INFO G RPC_DISPATCH_FUNCTION G PTOKEN_INFORMATION_CLASS �E _CM_RESOURCE_LIST , G _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA p+ RTL_OSVERSIONINFOEXW ' �F PCREATEFILE2_EXTENDED_PARAMETERS % P: _FILE_NETWORK_OPEN_INFORMATION + Y5 _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA
0 NPRECT # �F ETW_PARTITION_INFO_EXTENSION + � _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA �4 WNDCLASS �F CPINFOEX ) AA _SYSTEM_CONTEXT_SWITCH_INFORMATION �E CM_RESOURCE_LIST �* _OUTLINETEXTMETRICW � FS_INFORMATION_CLASS � _EVENT_RECORD $ �& IMAGE_LOAD_CONFIG_DIRECTORY32 �F PCALL_FRAME & <: HEAP_BLOCK_SETTABLE_INFORMATION �F LPRIP_INFO �A _FILE_RENAME_INFO & E JOBOBJECT_BASIC_UI_RESTRICTIONS �F DECRYPTION_STATUS_BUFFER �1 SHRINK_VOLUME_INFORMATION ' 2 _SERVICE_DELAYED_AUTO_START_INFO �F RPC_IF_ID �F RC_CONFIG �F PEMRMODIFYWORLDTRANSFORM 0 �F PETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT $ �F PSECURE_MEMORY_CACHE_CALLBACK �F HENHMETAFILE �F PERFINFO_FILE_INFORMATION
t INT * �/ _SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT - �F PREFS_VOLUME_COUNTER_INFO_INPUT_BUFFER �; _FILE_ALIGNMENT_INFO * �3 REFS_DEALLOCATE_RANGES_INPUT_BUFFER F PROCESSOR_IDLE_TIMES % �F PTRANSACTION_BASIC_INFORMATION �) _ALPC_MESSAGE_ATTRIBUTES % �( ACTCTX_SECTION_KEYED_DATA_2600 % �F PSYSTEM_RESOURCE_ATTRIBUTE_ACE �F PTIMERAPCROUTINE u PEN_FLAGS ( �% _SYSTEM_ALARM_CALLBACK_OBJECT_ACE � COMMPROP % �# _ETW_TP_EVENT_CALLBACK_ENQUEUE �F _ETW_TP_EVENT_TIMER_SET 4 �F PCACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA PEMRSETTEXTALIGN �F PSERVICE_TRIGGER �F LPIID �F PTHREAD_UMS_INFORMATION ' �B _PROCESS_ENERGY_VALUES_EXTENSION �F PSYSTEM_BASIC_INFORMATION �F PCM_INT13_DRIVE_PARAMETER �F STYLESTRUCT q8 LUID_AND_ATTRIBUTES = CONTAINER_VOLUME_STATE �8 _XSTATE_CONFIGURATION 5 �F PASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA �F ETW_TP_EVENT_TIMER_SET v* PEXTLOGFONTW �F LPSERVICE_MAIN_FUNCTIONA � NPREGISTERWORDW P# _PS_STD_HANDLE_STATE 4 �F PFILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX =D PO_WAKE_SOURCE_FIXED ! �F PSYSTEM_NUMA_PROXIMITY_MAP J LAST_EXCEPTION_LOG u- PEMRPOLYBEZIERTO �, REARRANGE_FILE_DATA �F EMRSETPALETTEENTRIES �8 PMOUSEMOVEPOINT % �> POWER_THROTTLING_PROCESS_STATE & �* _RTL_FEATURE_CONFIGURATION_TYPE �F LPSERVICE_STATUS * PPHYSICAL_ADDRESS �- OBJECT_BASIC_INFORMATION . �? _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY 3 �F PACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA �) POLYTEXTA _PLUGPLAY_CONTROL_CLASS �F _MUIREGISTRYINFO �F PIMAGE_CHPE_METADATA_X86 6 �9 SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION " �F PKEY_VALUE_FULL_INFORMATION �" tagEMREXTSELECTCLIPRGN �F PHEAP_SUBSEGMENT_ALLOC �F PPPM_IDLE_ACCOUNTING_EX CE LDR_RESLOADER_RET $ PROCESS_HANDLE_TRACING_ENABLE �> XSAVE_AREA_HEADER � ACCEL O% PCUNZWCH # C" _FILE_ALLOCATION_INFORMATION �F PFILE_SET_SPARSE_BUFFER % �E _DISPLAYCONFIG_SDR_WHITE_LEVEL $ < _SERVICE_FAILURE_ACTIONS_FLAG % �F PIMAGE_LOAD_CONFIG_DIRECTORY64 ( 2! _VIRTUAL_MEMORY_INFORMATION_CLASS �F NPNEWTEXTMETRIC F PPROCESSOR_NUMBER " }F _SE_PACKAGE_CAPABILITY_INFO �? SYSTEM_POWER_CAPABILITIES zF PPROCESSOR_POWER_POLICY 0 �= _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS xF SL_HWID_DEVICE_INFO �* LPOUTLINETEXTMETRICW _E _WIN32K_SYSCALL_FILTER # � SYSTEM_FILECACHE_INFORMATION �4 tagWNDCLASSA ! uF PDUPLICATE_EXTENTS_DATA_EX �) MDICREATESTRUCT PNTSTATUS % 5 _KEY_CONTROL_FLAGS_INFORMATION %6 tagPOINTER_INPUT_TYPE Y@ PRTL_DELETE_LOCK_ROUTINE & �E ALPC_SERVER_SESSION_INFORMATION tF WAITORTIMERCALLBACK +( ACCESS_DENIED_OBJECT_ACE & qF PSTREAMS_QUERY_ID_OUTPUT_BUFFER mF PSERVICE_TRIGGER_INFO . lF PSYSTEM_THREAD_CID_PRIORITY_INFORMATION }C PRTL_TRACE_BLOCK D OEM_STRING - kF PJOBOBJECT_MEMORY_USAGE_INFORMATION_V2 gF PRTL_FEATURE_USAGE_REPORT �" _WMI_TRACE_PACKET 3 �, _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 + B6 _SYSTEM_ELAM_CERTIFICATE_INFORMATION dF _WNODE_HEADER � HIBERFILE_BUCKET " {6 KEY_VALUE_BASIC_INFORMATION " �> SYSTEM_VHD_BOOT_INFORMATION - IMAGE_THUNK_DATA64 aF _FP_IEEE_VALUE ' ^ _PERFINFO_PPM_THERMAL_CONSTRAINT LF PIO_STATUS_BLOCK32 ' _FILE_FS_DRIVER_PATH_INFORMATION KF GRAYSTRINGPROC HF PWINDOWINFO � LPTIME_ZONE_INFORMATION & �> _ETW_TP_EVENT_TIMER_SET_NTTIMER �# _HARDERROR_RESPONSE C _FILE_DISPOSITION_INFO 3 G+ ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION �C _OUTPUT_DEBUG_STRING_INFO k< REASON_BUFFER 0 FF PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED � MIDL_STUB_DESC 6 P RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY MENUTEMPLATE CF LPREMOTE_NAME_INFO �E FILE_LAYOUT_ENTRY BF PRTL_AVL_COMPARE_ROUTINE ) >F PWIM_PROVIDER_REMOVE_OVERLAY_INPUT <F PNV_MEMORY_RANGE ;F PPOOLED_USAGE_AND_LIMITS % 9F _FILE_MOVE_CLUSTER_INFORMATION X; _FILE_PATH � _CM_MCA_POS_DATA .$ LPREGISTERWORDA 5F _PERFINFO_FLT_OPERATION 2F PFILE_LEVEL_TRIM_RANGE % 1F PFILE_PIPE_EVENT_SELECT_BUFFER 0F LPCURRENCYFMT G _PERFINFO_IPI_SEND_DATA .F _SYSTEM_ALARM_OBJECT_ACE ) +F PSYSTEM_WATCHDOG_TIMER_INFORMATION $ 'F PWOW64_DESCRIPTOR_TABLE_ENTRY 7 AXISINFO ( p _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE "F ETW_HEAP_EVENT_SNAPSHOT F CI_LOG_SCHEDULER_WAKEUP ' �, SYSTEM_SINGLE_MODULE_INFORMATION 0 F PEVENT_TRACE_SESSION_SECURITY_INFORMATION � WAIT_TYPE % F _FILE_ZERO_DATA_INFORMATION_EX F SYSDBG_PHYSICAL F PEMRSETPIXELV F PEISA_MEMORY_TYPE / F PTRANSACTIONMANAGER_RECOVERY_INFORMATION ) G< SYSTEM_SET_TIME_ADJUST_INFORMATION ! F PRTL_UNICODE_STRING_BUFFER �C PS_ATTRIBUTE � tagEMRSETVIEWPORTEXTEX �= GUITHREADINFO )? DPI_HOSTING_BEHAVIOR F PPERFINFO_SPINLOCK_CONFIG �. FXSAVE_FORMAT �/ _PERFINFO_MM_STAT $
F PREQUEST_OPLOCK_OUTPUT_BUFFER " F _PROCESS_UPTIME_INFORMATION & F PSYSTEM_DEVICE_DATA_INFORMATION ) F PPLUGPLAY_CONTROL_CONFLICT_STRINGS F PHDEVNOTIFY " (% TOKEN_SECURITY_ATTRIBUTE_V1 �E HMONITOR
A DOUBLE ) �* SYSTEM_FEATURE_CONFIGURATION_QUERY + �E RTL_SPARSE_BITMAP_ENUMERATE_CALLBACK |= tagSCROLLINFO # �) ETW_TP_EVENT_CALLBACK_CANCEL & � IMAGE_RESOURCE_DIRECTORY_STRING �E _FILE_LAYOUT_ENTRY # �E FILE_PIPE_SILO_ARRIVAL_INPUT ! �@ _ETW_REFDEREF_OBJECT_EVENT ! � _SECURE_SETTING_VALUE_TYPE �E _BOOT_ENTRY_LIST $ �E DISPLAYCONFIG_SDR_WHITE_LEVEL �E PRID_DEVICE_INFO_MOUSE �2 SYSTEM_MEMORY_INFORMATION �E KEY_CACHED_INFORMATION �E PHEAP_EVENT_RANGE_CREATE � TP_TASK y* EXTLOGFONTW UCHAR Z* _RTL_DRIVE_LETTER_CURDIR . �. _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION ' �E PALPC_SERVER_SESSION_INFORMATION ! �$ FILE_NUMA_NODE_INFORMATION > o SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY �E PMSGBOXPARAMS �E PCNZTCH # �D _SYSTEM_PAGEFILE_INFORMATION Y@ PRTL_RELEASE_LOCK_ROUTINE �E HEAP_BLOCK_INFORMATION �E EMRINTERSECTCLIPRECT +. IMAGE_DYNAMIC_RELOCATION �E PPLUGPLAY_EVENT_BLOCK ! �E PSTORAGE_RESERVE_AREA_INFO � FMTID ! �E PCTEB_ACTIVE_FRAME_CONTEXT % �E PNTFS_FILE_RECORD_INPUT_BUFFER 1 �E PSYSTEM_FEATURE_CONFIGURATION_UPDATE_ENTRY X+ MM_ETW_PAGE_INFO_EX ( �E SYSTEM_MEMORY_CHANNEL_INFORMATION �E FOUR_PART_VERSION �E PFILE_ID_128 X# VIDEOPARAMETERS $ � KAFFINITY_ENUMERATION_CONTEXT �E PCM_SCSI_DEVICE_DATA �6 EXTLOGFONT �E PIMAGE_NT_HEADERS32 �; CM_SONIC_DEVICE_DATA �4 COMPAREITEMSTRUCT # �E PSECURITY_QUALITY_OF_SERVICE �E PENCLAVE_CREATE_INFO_SGX �E LPJIT_DEBUG_INFO �E PEMRPIXELFORMAT 8 LPCOMBOBOXINFO q8 _LUID_AND_ATTRIBUTES ( �E PTXFS_READ_BACKUP_INFORMATION_OUT " �E PPERFINFO_BATTERY_LIFE_INFO ( �1 _PERFINFO_KERNELMEMORY_USAGE_TYPE �E PLUID �E LPPOINTFX �E PWNDCLASSEX $ U4 FILE_MAILSLOT_SET_INFORMATION $
@ SYSTEM_SECUREBOOT_INFORMATION 1 WTSSESSION_NOTIFICATION ( �< FILE_IS_REMOTE_DEVICE_INFORMATION , �E JOURNAL_CREATE_DELETE_KEY_INFORMATION e$ RTL_DISK_SPEED_POLICY �1 tagLOGCOLORSPACEW �E tagEMREXTESCAPE & �C STORAGE_RESERVE_AREA_DEFINITION &# IO_ERROR_LOG_PACKET - � MEMORY_PARTITION_NODE_PAGE_INFORMATION + _; _PERFINFO_PAGECOMBINE_AGGREGATE_STAT + QC FILE_IO_PRIORITY_HINT_INFORMATION_EX , �E PJOURNAL_SET_KEY_SECURITY_INFORMATION E LPPOLYTEXTW �E PCM_PNP_BIOS_DEVICE_NODE _THREAD_UMS_INFORMATION & �E DISPLAYCONFIG_VIDEO_SIGNAL_INFO �3 PATHNAME_BUFFER �E EVENTSFORLOGFILE �E PCM_RESOURCE_LIST $ �E PPLUGPLAY_CONTROL_STATUS_DATA " LCID BOOLEAN �E PTP_CALLBACK_ENVIRON L! EMRCLOSEFIGURE �5 tagEMRSELECTOBJECT �4 WNDCLASSEXW �E VARIABLE_NAME_AND_VALUE �E PRPC_SECURITY_QOS_V3_W $ 5) _THREAD_PROFILING_INFORMATION ! " RTL_SPARSE_BITMAP_CTX_LOCK �E DISPLAYCONFIG_TARGET_MODE t ptrdiff_t $ }E _SYSTEM_ROOT_SILO_INFORMATION � _TRANSACTION_OUTCOME zE PUNICODE_PREFIX_TABLE # Y@ PRTL_INITIALIZE_LOCK_ROUTINE a1 tagSTICKYKEYS �> PELARRAY �1 FP_80 �? _REQUESTER_TYPE < _ALPC_HANDLE_ATTR32 uE PCIMAGE_POLICY_METADATA �& PCRITICAL_SECTION_DEBUG p PINT8 7 LPCTSTR sE FILE_ID_BOTH_DIR_INFO �4 WNDCLASSA 4 oE _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE Y _IRQ_DEVICE_POLICY ( R _PERFINFO_DPC_ENQUEUE_INFORMATION {: OBJECT_ATTRIBUTES64 {B LPMULTIKEYHELPA kE _WMI_TRACE_MESSAGE_PACKET " �C _TRACE_ENABLE_FLAG_EXT_ITEM . � _SYSTEM_SPECULATION_CONTROL_INFORMATION hE PFILE_RENAME_INFO % p DISPLAYCONFIG_DEVICE_INFO_TYPE fE CONSOLE_CURSOR_INFO � STATE_LOCATION_TYPE bE _IMAGE_EXPORT_DIRECTORY O% PCWCH ! UNICODE_STRING64 ]E PWIN32K_SYSCALL_FILTER �" tagEMRSETMITERLIMIT ; TRACE_PROFILE_INTERVAL B WMI_TCPIP [E PETW_PRIORITY_EVENT n: CSTRING + �0 TRANSACTIONMANAGER_BASIC_INFORMATION WE POPTICAL_MEDIA_RECORD UE PULARGE_INTEGER * QE PJOBOBJECT_MEMORY_USAGE_INFORMATION 1 OE _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY 3 �C RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY �$ tagWNDCLASSEXA H* LOCALE_ENUMPROCW # ME LPQUERY_SERVICE_LOCK_STATUSA & �> PROCESS_WS_WATCH_INFORMATION_EX ! #9 ENABLE_TRACE_PARAMETERS_V1 c. _PERFINFO_VIRTUAL_ALLOC f/ DPI_AWARENESS �= LPMSLLHOOKSTRUCT 4 �: SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST LE RTL_HEAP_COMMIT_ROUTINE KE PIMAGE_HOT_PATCH_HASHES MUTANT_INFORMATION_CLASS ' JE PETW_DFSS_RELEASE_THREAD_ON_IDLE IE PRTL_RESOURCE_DEBUG HE PCUNICODE_STRING 3 �" _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION L" tagACCESSTIMEOUT ' Q> _CSV_QUERY_VOLUME_REDIRECT_STATE 3 FE _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE CE _LDR_RESLOADER_RET �5 EXCEPTION_DEBUG_INFO
" tagFEEDBACK_TYPE =E PETW_CRITSEC_EVENT_INIT
USN & �1 _PROCESS_MITIGATION_ASLR_POLICY �< _STREAM_LAYOUT_ENTRY $ ?? ENCLAVE_CREATE_INFO_VBS_BASIC # :E NDR_USER_MARSHAL_INFO_LEVEL1 ( � PERFINFO_DYNAMIC_TICK_VETO_REASON �9 tagCANDIDATELIST " CALID " RPC_LENGTH - d8 ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT ! 5E PFILE_FULL_DIR_INFORMATION 2E SYSNLS_FUNCTION /E _ETW_HEAP_EVENT_FREE 3( _IMAGE_SECTION_HEADER ! BOOT_ENTRY ! ,E LDR_IMPORT_MODULE_CALLBACK +E PRTL_DEBUG_INFORMATION32 �" BUS_DATA_TYPE � _ImageArchitectureEntry )E _MALLOC_FREE_STRUCT �6 tagHANDEDNESS �/ POINTER_DEVICE_PROPERTY �( tagCOLORMATCHTOTARGET & #E IMAGE_CE_RUNTIME_FUNCTION_ENTRY E PUSEROBJECTFLAGS �5 PROCESSOR_POWER_POLICY ' E PJOBOBJECT_ENERGY_TRACKING_STATE ! E WIM_PROVIDER_OVERLAY_ENTRY E PSYSTEM_FLAGS_INFORMATION $ _REG_NOTIFY_INFORMATION ' E _JOBOBJECT_BASIC_UI_RESTRICTIONS + E PEVENT_TRACE_PROFILE_ADD_INFORMATION E PIMAGE_DEBUG_DIRECTORY # E PLDR_MANIFEST_PROBER_ROUTINE O? _REMOTE_NAME_INFOA ; E PPROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION
7 tagEMR �1 LOGCOLORSPACEW ( E PPERFINFO_DRIVER_COMPLETE_REQUEST � FILESYSTEM_STATISTICS ( 2 _JOURNAL_CHANGE_INFORMATION_CLASS $
E PRTL_XPRESS_CALLBACK_FUNCTION * E LPSERVICE_REQUIRED_PRIVILEGES_INFOA �: RTL_PROCESS_MODULES E PPOLYTEXTW �C PROXY_PHASE �D PWMI_LOGGER_INFORMATION �D PCOVERAGE_MODULE_REQUEST _RTL_PATH_TYPE �A LPRGBTRIPLE �D _ETW_UMS_EVENT_PARK $ �D PPROCESS_HANDLE_TRACING_ENTRY ! �8 _FILE_MAILSLOT_PEEK_BUFFER # D RTL_PROCESS_VERIFIER_OPTIONS �D LPDISCDLGSTRUCT �D PSERVERSILO_STATE " �D PMEMORY_BASIC_INFORMATION32 - �D PMANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES �@ _ETW_DISKIO_READWRITE_V3 # �D PCIMAGE_DELAYLOAD_DESCRIPTOR / �D PREAD_DIRECTORY_NOTIFY_INFORMATION_CLASS { MOUSEHOOKSTRUCTEX # t" PERFINFO_CC_WORKITEM_ENQUEUE q PUINT16 �D _CONSOLE_HISTORY_INFO ( �@ _RPC_BINDING_HANDLE_SECURITY_V1_A ( q? JOBOBJECT_CONTAINER_IDENTIFIER_V2 / �D PSYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX - �D _SERVICE_CONTROL_STATUS_REASON_PARAMSW �D RPC_SERVER_INTERFACE ! 5C _ACCESS_ALLOWED_OBJECT_ACE �D STARTING_VCN_INPUT_BUFFER �D _FILE_ATTRIBUTE_TAG_INFO �D DESKTOPENUMPROC
! USHORT �D PPROCESS_ENERGY_VALUES & �D PPLUGPLAY_CONTROL_CONFLICT_LIST �D PEMRFILLPATH �@ _NIC_RECORD �D PMFT_ENUM_DATA " �D SYSTEM_PAGEFILE_INFORMATION ! �D _SECTION_IMAGE_INFORMATION
]2 MSG �D PRTL_BALANCED_LINKS �D RTL_SPARSE_BITMAP_CTX �' _ACTIVATION_CONTEXT_STACK �D PTXFS_LIST_TRANSACTIONS & �D _ETW_COVERAGE_SAMPLER_PERF_INFO / l. ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION �7 DISCDLGSTRUCTW +( _ACCESS_DENIED_OBJECT_ACE � _FILE_STANDARD_INFO , !> EVENT_TRACE_STACK_CACHING_INFORMATION �D HW_PROFILE_INFOW �* EMRSETICMPROFILE �+ SERVICE_NOTIFYA �, IMAGE_RESOURCE_DATA_ENTRY ! �D PFILE_PIPE_WAIT_FOR_BUFFER �D PEVENT_FILTER_EVENT_ID 8 �4 _PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY �D PSCRUB_DATA_INPUT �D PCTEB_ACTIVE_FRAME � PROCESS_BASIC_INFORMATION D IO_SESSION_CONNECT_INFO !6 SCRUB_DATA_INPUT � RTL_RESOURCE_DEBUG " _IO_SESSION_STATE �& PREFIX_TABLE_ENTRY �7 ETW_PRIORITY_EVENT 1 �; _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION , �0 TRANSACTIONMANAGER_OLDEST_INFORMATION � TRACE_ENABLE_CONTEXT
SID_NAME_USE 2 _CI_LOG_MMCSS_STOP ( �D PPERFINFO_CC_EXTRA_WB_THREAD_INFO �D _TOKEN_ELEVATION $ z ALTERNATIVE_ARCHITECTURE_TYPE �D LPHELPWININFO �D PBOOT_AREA_INFO �D _SYSTEM_POWER_STATUS �D pthreadlocinfo % � IMAGE_DYNAMIC_RELOCATION_TABLE �< STREAM_LAYOUT_ENTRY � RTL_FREE_STRING_ROUTINE B MIDL_SYNTAX_INFO ! wctype_t * �D _ALPC_PORT_MESSAGE_ZONE_INFORMATION ?" HIBERFILE_BUCKET_SIZE * �D PSECTION_INTERNAL_IMAGE_INFORMATION �D PCOMPRESSED_DATA_INFO �> KEYBDINPUT V tagRAWINPUTDEVICELIST �' tagLC_ID D _IO_SESSION_CONNECT_INFO " xD PFSCTL_QUERY_FAT_BPB_BUFFER ( vD PSYSTEM_CODEINTEGRITY_INFORMATION ' �% _EVENT_TRACE_VERSION_INFORMATION uD PCLIENT_ID * qD PSYSTEM_PROCESSOR_POWER_INFORMATION $ � _DISPLAYCONFIG_COLOR_ENCODING D- _MIDL_STUBLESS_PROXY_INFO ) nD TOKEN_SECURITY_ATTRIBUTE_OPERATION iD HUMPD
�2 ACL dD PLDRP_CSLIST cD PKUSER_SHARED_DATA bD LPMENUITEMINFOW � CRM_PROTOCOL_ID # �@ ETW_KTIMER2_EXPIRATION_EVENT aD PTP_DEBUG_CLASS ]D PAXESLISTA YD PREPAIR_COPIES_OUTPUT RPC_AUTHZ_HANDLE ( � FILE_MEMORY_PARTITION_INFORMATION z5 _HEAP_INFORMATION WD PDRAWPATRECT �? PIMAGE_TLS_CALLBACK # i: _IMAGE_SEPARATE_DEBUG_HEADER �/ _GDI_TEB_BATCH % UD _EXCEPTION_REGISTRATION_RECORD . LD PSTORAGE_QUERY_DEPENDENT_VOLUME_REQUEST H _WMI_SPINLOCK �A CM_PNP_BIOS_DEVICE_NODE / JD PHEAP_QUERY_INFORMATION_CALLBACK_ROUTINE
ID PCOORD 1 ED PFSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX �) _PLUGPLAY_EVENT_BLOCK CD PNONCLIENTMETRICSA * � _LDR_DLL_UNLOADED_NOTIFICATION_DATA - ^. PROCESS_DYNAMIC_EH_CONTINUATION_TARGET {& VM_COUNTERS $ O( _RTL_USER_PROCESS_INFORMATION 61 LPMINMAXINFO PMIDL_XMIT_TYPE + � _FILE_SYSTEM_RECOGNITION_INFORMATION T PZPCWSTR AD XSAVE_FEATURE l RTL_RB_TREE =D _PO_WAKE_SOURCE_FIXED # 9D _PLUGPLAY_CONTROL_DEPTH_DATA 6D PROPENUMPROCEX Z) _STRING32 3D LPTOGGLEKEYS & 2D PHEAP_REUSE_THRESHOLD_ACTIVATED 1D PKEY_VALUE_ENTRY # /D CONSOLE_SCREEN_BUFFER_INFOEX " �. WMI_IMAGELOAD_INFORMATION32 �= MONITORINFOEX ^, RPC_SID ! *D TXFS_GET_METADATA_INFO_OUT #D POINTER_INFO D PEXCEPTION_LOG # h _FILE_MAKE_COMPATIBLE_BUFFER 0 >4 _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY � TP_CALLBACK_ENVIRON D PRTL_HEAP_COMMIT_ROUTINE $ D PRTL_PROCESS_VERIFIER_OPTIONS $ D _PERFINFO_DOMAIN_CHANGE_EVENT % D PMEMORY_EXHAUSTION_INFORMATION D PSYSTEM_VERIFIER_ISSUE '
D PCI_LOG_SCHEDULER_SLEEP_RESPONSE q LPUWSTR �9 PCURSORINFO !2 _HEAP_RANGE_CREATE D IMAGE_SYMBOL_EX D PIMAGE_AUX_SYMBOL D PPOWER_USER_PRESENCE_TYPE D LPTPMPARAMS �C _StreamInformation 6 �C SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION % �6 _WMI_JOB_SET_QUERY_INFORMATION �C POBJECT_TYPES_INFORMATION �C PPS_ATTRIBUTE � TP_CLEANUP_GROUP �C tagNEWTEXTMETRICEXA �C PCSV_QUERY_FILE_REVISION t8 EISA_PORT_CONFIGURATION �C OUTPUT_DEBUG_STRING_INFO �C EMRFILLPATH ! [0 LPC_UNREGISTER_PROCESS_MSG 3 �C SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION �C METARECORD " �C OFFSETINSTANCEDATAANDLENGTH ' �C _STORAGE_RESERVE_AREA_DEFINITION �C _SINGLE_LIST_ENTRY32 �" CSVFS_DISK_CONNECTIVITY & S1 RTLP_PROCESS_REFLECTION_CONTEXT ) M _PROCESS_ENERGY_COMPONENT_TYPE_NUM �- _RPC_SECURITY_QOS_V4_A �$ IDL_CS_CONVERT -& _SYSTEM_TRACE_HEADER k" _PERFINFO_CCSWAP_BUFFER ) �C _EVENT_TRACE_GROUPMASK_INFORMATION 3 _IMAGE_AUX_SYMBOL ! �C PFILE_INFO_BY_HANDLE_CLASS �C LPEVENTMSG ! �C TRACE_ENABLE_FLAG_EXT_ITEM �C PENCRYPTION_BUFFER % m* FILE_IO_COMPLETION_INFORMATION �C PETW_HEAP_EVENT_REALLOC �C POSVERSIONINFOEX �C PBITMAPINFO & SYSTEM_ALARM_CALLBACK_ACE , FA _JOBOBJECT_EXTENDED_LIMIT_INFORMATION $ �C PJOURNAL_ABSOLUTE_INFORMATION �C PFNSAVE_FORMAT �C PTHREAD_TLS_INFORMATION z9 PROCESSOR_IDLE_STATE �C ETW_HEAP_EVENT_EXPANSION � _HEAP_SUBSEGMENT_INIT 5 _TOKEN_USER_CLAIMS !@ ACTCTX_SECTION_KEYED_DATA � _KLOCK_QUEUE_HANDLE 4 �C _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY �C LBR_TRACE_EVENT_DATA
� NT_TIB ( k _RTL_FEATURE_CONFIGURATION_UPDATE �C LPHEAP_SUMMARY " o7 _PERFINFO_PROCESS_PERFCTR32
� LPGUID � RTL_TRACE_ENUMERATE ; �C PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME * �C _PERFINFO_PO_CALIBRATED_PERFCOUNTER & �C PFILE_PIPE_DELETE_SYMLINK_INPUT �C PGRADIENT_TRIANGLE �C LPWINDOWPOS PVOID �C PCSV_CONTROL_OP �C PMETARECORD % �C PTHREAD_CYCLE_TIME_INFORMATION ! �C PPERFINFO_IPI_RECEIVE_DATA �C PLDR_SECTION_INFO �C _DataStream �C SYSTEM_BATTERY_STATE �C RTL_RUN_ONCE_INIT_FN
> _FILE_BASIC_INFORMATION �C LOGBRUSH32 � WORKERCALLBACKFUNC �C PRTLP_EXIT_THREAD 4 tagEMRPIXELFORMAT % M; _SYSTEM_PROCESS_ID_INFORMATION � tagMENUINFO �C _ETW_DISKIO_READWRITE_V2 C RTL_TRACE_BLOCK {C BULK_SECURITY_TEST_DATA ! wC _SYSTEM_THREAD_INFORMATION �+ LOAD_DLL_EVENT_DATA � _TRACE_QUERY_INFO_CLASS uC RPCLT_PDU_FILTER_FUNC PCSZ 1 qC PRTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY oC LPQUERY_SERVICE_CONFIG nC I_RpcFreeCalloutStateFn $ y IMAGE_DYNAMIC_RELOCATION32_V2 iC PMM_ETW_PAGE_INFO k MESSAGE_RESOURCE_BLOCK eC PFILE_ALLOCATION_INFO ]9 PEMRSETICMPROFILE �! _QUERY_FILE_LAYOUT_OUTPUT cC PIMAGE_NT_HEADERS64 bC UILANGUAGE_ENUMPROCA & _THREAD_UMS_INFORMATION_COMMAND _C PHEAP_INFORMATION �" NPLOGFONTW ) ^C PFILE_IS_REMOTE_DEVICE_INFORMATION + \C ACTIVATION_CONTEXT_BASIC_INFORMATION �- PROCESSOR_IDLE_STATES M1 tagENHMETARECORD XC PCI_LOG_SCHEDULER_EVENT VC _RTL_PROCESS_BACKTRACES SC PGESTURENOTIFYSTRUCT , QC _FILE_IO_PRIORITY_HINT_INFORMATION_EX * MC _SYSTEM_VERIFIER_FAULTS_INFORMATION , �4 _EVENT_TRACE_SYSTEM_EVENT_INFORMATION IC IMAGE_DEBUG_DIRECTORY �1 GLYPHMETRICSFLOAT EC IMAGE_ARCHITECTURE_HEADER . ?C PROCESS_READWRITEVM_LOGGING_INFORMATION 9C PPROCESS_ACCESS_TOKEN
8C HKL g7 EVENT_TRACE_PROPERTIES . 7C PEVENT_TRACE_PROFILE_CONFIG_INFORMATION 5C ACCESS_ALLOWED_OBJECT_ACE ' _IMAGE_HOT_PATCH_INFO .C PUSN_RECORD_V4 * J _SYSTEM_PHYSICAL_MEMORY_INFORMATION ( _IRQ_GROUP_POLICY ,C tagUSEROBJECTFLAGS )C GENERIC_UNBIND_ROUTINE ( 'C PERFINFO_VIRTUAL_ALLOC_XPARTITION ' !C PRTL_IMAGE_MITIGATION_DEP_POLICY C LPDEBUG_EVENT & C PPERFINFO_PPM_IDLE_STATE_CHANGE C PPO_WAKE_SOURCE_TYPE � MCA_EXCEPTION / C DISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION ) n= _ACCESS_DENIED_CALLBACK_OBJECT_ACE $ �< SE_SET_FILE_CACHE_INFORMATION C PFILESYSTEM_STATISTICS 5 C PSYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION C LPSERVICE_STATUS_PROCESS ; TP_WORK �? RTL_HEAP_INFORMATION C PALPC_SECURITY_ATTR ! C PPERFINFO_BOOT_PHASE_START 0 C _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION C FILE_DISPOSITION_INFO C PRPC_CLIENT_ID �A PRGBTRIPLE * C CSV_QUERY_FILE_REVISION_FILE_ID_128 �B PINVERTED_FUNCTION_TABLE LPFXPT16DOT16 < tagEMRBITBLT �B PXSAVE_SUPPORTED_CPU :$ tagEMREOF 0 �B _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION & o$ IO_COMPLETION_BASIC_INFORMATION " �B _PO_SPR_ACTIVE_SESSION_DATA .+ _REASON_CONTEXT t errno_t # H; _FILE_SET_DEFECT_MGMT_BUFFER % �B _KEY_VALUE_PARTIAL_INFORMATION ! � PERFINFO_PROCESS_PERFCTR64 �B PEVENT_FILTER_DESCRIPTOR ! �0 PPOWER_STATE_DISABLED_TYPE
; _SYSDBG_VIRTUAL �A tagEMRRESTOREDC " SECURITY_INFORMATION �B PVM_COUNTERS_EX2 �B PRTL_GENERIC_FREE_ROUTINE �B tagEXTLOGPEN k: PRECONVERTSTRING B _MIDL_SYNTAX_INFO q WCHAR ! �B PFILE_OBJECTID_INFORMATION �B PMOUSE_EVENT_RECORD �' MANDATORY_LEVEL �B CONSOLE_SELECTION_INFO + _? EVENT_TRACE_SOFT_RESTART_INFORMATION �B _TOKEN_OWNER , �# MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE PBYTE �B PMEMORY_EXHAUSTION_TYPE $ �B PSYSTEM_TIMEOFDAY_INFORMATION ( $ MEMORY_RESOURCE_NOTIFICATION_TYPE " �: _SE_LEARNING_MODE_DATA_TYPE ' �B SYSTEM_ACTIVITY_MODERATION_STATE �4 _CREATE_THREAD_DEBUG_INFO �B PDLGITEMTEMPLATE # �# ETW_TP_EVENT_POOL_TH_MAX_SET / �B PEVENT_TRACE_PROFILE_COUNTER_INFORMATION � tagCOPYDATASTRUCT N SD_GLOBAL_CHANGE_INPUT �B _SYSTEM_VDM_INSTEMUL_INFO # �B PMANAGE_HOT_PATCH_LOAD_PATCH ) �B _JOBOBJECT_BASIC_LIMIT_INFORMATION & �B PRTL_FEATURE_CONFIGURATION_TYPE �B LPMOUSEKEYS ( _EVENT_TRACE_SPINLOCK_INFORMATION * �B PEVENT_TRACE_TAG_FILTER_INFORMATION . # _EVENT_TRACE_PROFILE_REMOVE_INFORMATION , � _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 " �B SHARED_VIRTUAL_DISK_SUPPORT " EXECUTION_STATE �B TPP_THREAD_DATA_CALLBACK x? OSVERSIONINFOEX2A \A _SERVICE_TABLE_ENTRYA $ �B POWER_THROTTLING_THREAD_STATE �B PFILE_INFORMATION_CLASS 4 �B PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION 6 SECTION_BASIC_INFORMATION �B _CFG_CALL_TARGET_INFO 5 � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA �B DISPLAYCONFIG_2DREGION 7 PPM_WMI_IDLE_STATE ) -B SERVICE_TRIGGER_SPECIFIC_DATA_ITEM �B PCLASSIC_EVENT_ID �B _ENCRYPTION_BUFFER �" _POWER_SESSION_TIMEOUTS �< _SERVICE_STATUS_PROCESS
�B PZPSTR ' 2! VIRTUAL_MEMORY_INFORMATION_CLASS Q; RPC_TRANSFER_SYNTAX ' �B PPROCESS_ENERGY_VALUES_EXTENSION * �B PFILE_PIPE_CLIENT_PROCESS_BUFFER_V2 �B PTP_LOG_LEVEL �B EMRGLSBOUNDEDRECORD � ETW_KQUEUE_DEQUEUE_EVENT # . SYSTEM_HANDLE_INFORMATION_EX " �B _JOURNAL_CLIENT_INFORMATION �B tagEMRPOLYDRAW16 " PWNF_CHANGE_STAMP , +< _SYSTEM_QUERY_TIME_ADJUST_INFORMATION & �B PRTL_SEGMENT_HEAP_MEMORY_SOURCE �B LPHW_PROFILE_INFO }B PUPDATELAYEREDWINDOWINFO � _LEARNING_MODE_LOG_LEVEL ! ^ _RTL_IMAGE_POLICY_METADATA {B PMULTIKEYHELPA % zB PVIRTUAL_STORAGE_BEHAVIOR_CODE % xB _BOOT_ENTROPY_SOURCE_NT_RESULT u _ETW_WNF_EVENT_SUBSCRIBE �A _CI_LOG_MMCSS_START ' uB PCSV_QUERY_VOLUME_REDIRECT_STATE # tB PRTL_SPARSE_BITMAP_PARAMETER $ �$ SERVICE_LAUNCH_PROTECTED_INFO LIST_ENTRY64 . rB _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE ) � _WIM_PROVIDER_UPDATE_OVERLAY_INPUT mB HTASK % kB PETW_LAST_DROPPED_EVENT_STRUCT � PCUSHORT 3 �< _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION 1 f9 MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION � _PNP_QUERY_RELATION ) gB PWMI_EXTENDED_THREAD_INFORMATION64 " eB PPERFINFO_SET_DEVICES_STATE �@ NIC_RECORD aB PWOF_EXTERNAL_FILE_ID 4 P SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION # m4 _CM_FULL_RESOURCE_DESCRIPTOR �A _RTL_STACK_CONTEXT_ENTRY W> tagEMRSETTEXTCOLOR ^B TOUCH_HIT_TESTING_INPUT " [B PPERFINFO_PROCESS_PERFCTR32 $ � TRANSACTION_INFORMATION_CLASS ZB PNONCLIENTMETRICS YB PETW_SET_KTIMER2_EVENT WB OBJECT_TYPES_INFORMATION * i SYSTEM_PROCESSOR_POLICY_INFORMATION \ _SERVICE_SID_INFO % TB PISECURITY_DESCRIPTOR_RELATIVE SB PENABLECALLBACK OB EMRALPHABLEND ' KB PERFINFO_DRIVER_COMPLETE_REQUEST GB DEBUG_EVENT <B _LDR_DATA_TABLE_ENTRY32 8 9B PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION 2 HEAP_RANGE_LOG 7 5B _IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION % _ENERGY_STATE_DURATION �= PROCESS_FAULT_INFORMATION < POWER_IDLE_RESILIENCY * +B PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM + ; _PERFINFO_DOMAIN_CHANGE_EVENT_REASON j _SERVICE_TRIGGER_INFO *B PHEAP_RANGE_CREATE 'B RTL_UNICODE_STRING_BUFFER � NETWORK_APP_INSTANCE_EA x+ _MUICCENTRY $ B PPERFINFO_CC_WORKITEM_DEQUEUE 2& RTL_RESOURCE_DEBUG64 B _SC_ACTION_TYPE B ETW_DEBUG_PRINT_EVENT B PIO_SESSION_EVENT # B WIM_PROVIDER_START_INTEGRITY B PRTL_PROTECTED_ACCESS # B tagEMREXTCREATEFONTINDIRECTW �@ RTL_DEBUG_INFORMATION32 B _OVERLAPPED \A SERVICE_TABLE_ENTRY B PMIDL_SYNTAX_INFO ! � _PROCESS_MITIGATION_POLICY � CSV_CONTROL_OP �! SERVICE_DESCRIPTIONW �A PWMI_TCPIP 9 LPC_CLIENT_DIED_MSG �A _ALPC_DIRECT_ATTR �A SYSDBG_BUS_DATA " PSECURITY_ATTRIBUTES_OPAQUE �A NPRGBTRIPLE # �A _FILE_ALLOCATED_RANGE_BUFFER � _KUSER_SHARED_DATA % l; _KNONVOLATILE_CONTEXT_POINTERS # # RTL_DYNAMIC_HASH_TABLE_ENTRY 4 �A PACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION j= SILOOBJECT_ROOT_DIRECTORY �A PETW_BUFFER_STATE & �A IR_TIMER_EXTRA_CREATE_PARAMETER �A LPAXISINFO " �A PSUBSYSTEM_INFORMATION_TYPE ) �A PSYSTEM_ENTROPY_TIMING_INFORMATION A �A PRTL_QUERY_DEBUG_VIRTUAL_PROCESS_QUERY_INFORMATION_ROUTINE �A LPGCP_RESULTSA �A PARRAY_INFO �A PCI_LOG_MMCSS_START � PFLS_CALLBACK_FUNCTION � AXESLISTA " _LDT_SIZE # Q _HOT_PATCH_INFORMATION_CLASS �A PSERVICE_NOTIFY_1 RTL_REFERENCE_COUNT � EMRPOLYLINE " LDR_EXTERNAL_DLL_PATH �A _PERFINFO_SPINLOCK_CONFIG % �& _IMAGE_LOAD_CONFIG_DIRECTORY32 9 _THREADINFOCLASS X+ _MM_ETW_PAGE_INFO_EX # �A PTRANSACTION_ENLISTMENT_PAIR * �% PROCESS_KEEPALIVE_COUNT_INFORMATION ' �A _FILE_MAILSLOT_QUERY_INFORMATION " � _FILE_GET_QUOTA_INFORMATION .? _QUERY_BAD_RANGES_OUTPUT 6 � SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION �A PROCESS_PRIORITY_CLASS _PROCESSOR_GROUP_INFO �A PTRACE_LOGFILE_HEADER �A NDR_NOTIFY2_ROUTINE �A _CM_PNP_BIOS_DEVICE_NODE �A PMUILANGINFO �A LPSC_HANDLE �A PRPC_SECURITY_QOS_V5_A * �A PVIRTUALIZATION_INSTANCE_INFO_INPUT % �+ RTL_SEGMENT_HEAP_MEMORY_SOURCE % 4 _ETW_LAST_DROPPED_EVENT_STRUCT �* MCI_ADDR �A LPCONNECTDLGSTRUCTA " JOB_SET_ARRAY �A RTL_STACK_CONTEXT_ENTRY c> ABCFLOAT �# _NUMA_NODE_RELATIONSHIP , PRGNDATA $ == tagPOINTER_DEVICE_CURSOR_TYPE # �A USER_MARSHAL_FREEING_ROUTINE �A IMAGE_FUNCTION_ENTRY64 " �A PSYSTEM_CPU_SET_INFORMATION
3 PCUUCSSTR & �A PACTCTX_SECTION_KEYED_DATA_2600 �A EMRRESTOREDC �! EMRLINETO �. _WMI_PROCESS_INFORMATION �A PUSN_JOURNAL_DATA_V0 J _LAST_EXCEPTION_LOG �A PWIN32_FIND_STREAM_DATA �A FILE_RENAME_INFO , �5 _EVENT_TRACE_TIME_PROFILE_INFORMATION 3 �' JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 �A PFILE_LAYOUT_NAME_ENTRY + �A PRPC_HTTP_TRANSPORT_CREDENTIALS_V3_W 1 PERFINFO_DPC_INFORMATION �A PTP_DEBUG_FREE_INFO �A PRTL_CIRCULAR_LIST_ENTRY c EISA_PORT_DESCRIPTOR �; RTL_HASH_ENTRY �A PCOMPARTMENT_ID a+ _IMAGE_BASE_RELOCATION + �A PROCESS_MITIGATION_IMAGE_LOAD_POLICY * �: _ETW_TRACE_PARTITION_INFORMATION_V2 |A CREATE_PROCESS_DEBUG_INFO
. ALPC_HANDLE_ATTR yA PEFI_DRIVER_ENTRY_LIST W TRACE_ENABLE_INFO $ wA MEMORY_EXHAUSTION_INFORMATION EMRSETLAYOUT & �$ FILE_PIPE_CLIENT_PROCESS_BUFFER �$ PGRADIENT_RECT " �& ETW_TP_EVENT_CALLBACK_START <* _PO_SLEEP_DISABLE_REASON ! tA PPERFINFO_PO_NOTIFY_DEVICE pA PPO_WAKE_SOURCE_INFO nA LPSIZEL + lA PERFINFO_DRIVER_COMPLETE_REQUEST_RET $ t" _PERFINFO_CC_WORKITEM_ENQUEUE hA _ETW_NOTIFICATION_HEADER , eA _EVENT_TRACE_HEAP_TRACING_INFORMATION �; _RATE_QUOTA_LIMIT � _SYSDBG_COMMAND 4 CORRELATION_VECTOR $ bA PACTIVATION_CONTEXT_MSIX_INFO # `A ETW_TP_EVENT_TIMER_CANCELLED VA LPSERVICE_TABLE_ENTRY " F@ PVECTORED_EXCEPTION_HANDLER �& LPCRITICAL_SECTION BCHAR L9 ETW_WNF_EVENT_CALLBACK ! �3 _FILE_TRACKING_INFORMATION % SA FILE_PROVIDER_EXTERNAL_INFO_V1 NA PRTL_RETPOLINE_ROUTINES a# _SYSDBG_IO_SPACE LA RPC_PROTSEQ_VECTORA - HA PJOBOBJECT_END_OF_JOB_TIME_INFORMATION , DA PJOBOBJECT_EXTENDED_LIMIT_INFORMATION � PROCESS_WAKE_INFORMATION ) ?A PSYSTEM_CONTEXT_SWITCH_INFORMATION $, tagLOGPEN " GEOCLASS �' _XMIT_ROUTINE_QUINTUPLE + <A SYSTEM_LOGICAL_PROCESSOR_INFORMATION ' 3A PPERFINFO_PPM_THERMAL_CONSTRAINT � TOKEN_GROUPS PSE_SIGNING_LEVEL # 2A PETW_DFSS_START_NEW_INTERVAL # #5 FILE_ID_BOTH_DIR_INFORMATION +- SYSTEM_FLAGS_INFORMATION - 1A PTOKEN_SECURITY_ATTRIBUTES_INFORMATION ? RTL_UNLOAD_EVENT_TRACE32 @ _COMPUTER_NAME_FORMAT ' & RPC_BINDING_HANDLE_TEMPLATE_V1_A " �# _PERFINFO_CC_CAN_WRITE_FAIL ! �: SE_LEARNING_MODE_DATA_TYPE + /A DISPLAYCONFIG_SET_TARGET_PERSISTENCE
� IID �< BOOT_ENTROPY_NT_RESULT $ �. UMS_SYSTEM_THREAD_INFORMATION *A LPRASTERIZER_STATUS a@ _RPC_PROTSEQ_VECTORW ! (A _PERFINFO_BOOT_PHASE_START ! R _IMAGE_ROM_OPTIONAL_HEADER $A EVENT_FILTER_DESCRIPTOR A PBITMAPV5HEADER =1 _EXCEPTION_RECORD64 3 MEMORY_SCRUB_INFORMATION A LPNEWTEXTMETRICA " h* SECTION_IMAGE_INFORMATION32 + A PVIRTUALIZATION_INSTANCE_INFO_OUTPUT & A PSYSTEM_VERIFIER_INFORMATION_EX
? ACTCTX W( tagRID_DEVICE_INFO A _COMM_FAULT_OFFSETS A PPERFINFO_PO_PRESLEEP + SD_ENUM_SDS_INPUT . �- TRANSACTIONMANAGER_RECOVERY_INFORMATION A PDESIGNVECTOR � _RPC_CLIENT_ID
A PXSAVE_VENDORS " A PIMAGE_DYNAMIC_RELOCATION64 # A PIMAGE_LOAD_CONFIG_DIRECTORY A HEAP_SUMMARY �@ HWINEVENTHOOK__ + �4 EVENT_TRACE_SYSTEM_EVENT_INFORMATION �@ PWMI_DISKIO_READWRITE $ �@ PJOBOBJECT_FREEZE_INFORMATION �( TIMER_BASIC_INFORMATION �$ EMRARCTO ? MENUITEMTEMPLATEHEADER �@ PPM_WMI_PERF_STATES_EX �@ LPFILE_ID_DESCRIPTOR ( �@ PRPC_BINDING_HANDLE_SECURITY_V1_A � _WMI_POWER_RECORD �@ LPSTYLEBUFW ' �0 WORKER_FACTORY_BASIC_INFORMATION ) �@ PSYSTEM_VSM_PROTECTION_INFORMATION L! EMRSAVEDC > _ENCLAVE_CREATE_INFO_SGX 9 _CM_FLOPPY_DEVICE_DATA �@ _INPUT_RECORD % �@ LPSERVICE_FAILURE_ACTIONS_FLAG , I3 TOKEN_SECURITY_ATTRIBUTES_INFORMATION $ �@ PSERVERSILO_BASIC_INFORMATION �@ HFONT__ �@ PCM_EISA_SLOT_INFORMATION �@ WNDENUMPROC L0 NONCLIENTMETRICS �@ PEMRSELECTPALETTE " �@ _ETW_COVERAGE_SAMPLER_STATS � _KLDR_DATA_TABLE_ENTRY �@ threadlocinfo �@ PSCRUB_DATA_OUTPUT �% RTL_RUN_ONCE �@ _RTL_DEBUG_INFORMATION32 \# IMPORT_OBJECT_TYPE 3 ( _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT U" LPENUMTEXTMETRICW ( � _JOBOBJECT_RATE_CONTROL_TOLERANCE " �@ PENTER_STATE_SYSTEM_HANDLER ( �@ ETW_UMS_EVENT_DIRECTED_SWITCH_END �@ TXFS_QUERY_RM_INFORMATION > MEMORY_BASIC_INFORMATION �@ PNIC_RECORD ! �@ PETW_REFDEREF_OBJECT_EVENT �@ PXSTATE_CONFIGURATION �@ COMSTAT �@ ETW_SET_KTIMER2_EVENT ) �@ _ETW_COVERAGE_SAMPLER_BLOOM_FILTER �@ _PERFORMANCE_DATA $ �= _UMS_CREATE_THREAD_ATTRIBUTES �) ENCLAVE_INIT_INFO_VBS / 2 RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY ' |@ PPERFINFO_WORKINGSET_INFORMATION / � _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX ! z@ PETW_THREAD_SET_NAME_EVENT " v@ LPWIN32_FILE_ATTRIBUTE_DATA s@ POINTFX ( q@ PSYSTEM_AUDIT_CALLBACK_OBJECT_ACE o@ _TP_DEBUG_FREE_INFO J k@ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING h@ DISPLAYCONFIG_MODE_INFO # c@ PFILE_ALLOCATION_INFORMATION EVENT_INFO_CLASS � PTEB PVOID64 a@ RPC_PROTSEQ_VECTORW _REFS_SMR_VOLUME_GC_STATE ]@ PRTL_RUN_ONCE_INIT_FN �* EMRSETICMPROFILEA Z@ PCM_POWER_DATA ! Y@ PUSER_THREAD_START_ROUTINE W@ MENUITEMINFOW & P@ PPS_CPU_QUOTA_QUERY_INFORMATION w' POFSTRUCT N@ PPERFINFO_GROUPMASK �/ EXCEPTION_POINTERS 03 _RTL_SRWLOCK [" tagPOINT " � TRACE_ENABLE_FLAG_EXTENSION ) �7 SYSTEM_LOW_PRIORITY_IO_INFORMATION M@ PLIST_ENTRY32 3 �; JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V1 3 G@ PIMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION " F@ PTOP_LEVEL_EXCEPTION_FILTER �4 _PROCESSOR_RECORD $ A@ PSILOOBJECT_BASIC_INFORMATION 1 ?@ PTRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT �" tagCWPRETSTRUCT " u RTL_FEATURE_VARIANT_PAYLOAD , �8 _JOBOBJECT_SECURITY_LIMIT_INFORMATION " >@ PRTL_HEAP_MEMORY_LIMIT_DATA O? REMOTE_NAME_INFO % �+ _PERFINFO_DRIVER_MAJORFUNCTION POWER_INFORMATION_LEVEL s> BREAK_ON_STATUS_BUFFER : FILE_PIPE_EVENT_BUFFER <@ _KEY_VALUE_ENTRY $ 9@ PGET_SYSTEM_WOW64_DIRECTORY_A 6@ PIO_COUNTERS = USN_JOURNAL_DATA_V2 " 4@ SEMAPHORE_BASIC_INFORMATION -@ PRTL_ACE_DATA *@ _DISCDLGSTRUCTA $ *& PERFINFO_PPM_IDLE_STATE_ENTER > '@ PPROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION $@ PWNF_DLLUNLOAD_CALLBACK ?! EMRSETWINDOWORGEX CSV_NAMESPACE_INFO } _RTL_RESOURCE_CATEGORY " DISPLAY_DEVICEA � PROCESS_MITIGATION_POLICY ! @ PACTCTX_SECTION_KEYED_DATA @ FILTERKEYS ? _EVENT_TRACE � _RPC_MESSAGE @ PMIDL_INTERCEPTION_INFO @ PSYSTEM_TRACE_HEADER * @ PPERFINFO_SESSIONCREATE_INFORMATION 0 _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE ' _NV_MEMORY_RANGE �0 ETW_TP_EVENT_POOL_CLOSE % � _IO_RESOURCE_REQUIREMENTS_LIST @ PMUILANGCFGNODE ; tagLOGPALETTE $ �7 WMI_DISKIO_IO_REDIRECTED_INIT �: KAFFINITY_EX @ _RTL_RXACT_CONTEXT l tagBITMAPINFOHEADER
" LCTYPE
p PZZSTR �( _IMAGE_THUNK_DATA32 �- _OBJECT_BASIC_INFORMATION %
@ _SYSTEM_SECUREBOOT_INFORMATION @ PSERVICE_START_REASON % @ PFSCTL_QUERY_REGION_INFO_INPUT ! �# IMAGE_AUX_SYMBOL_TOKEN_DEF 1 DMA_CONFIGURATION_BYTE0 �? _UUID_VECTOR # �= FILE_END_OF_FILE_INFORMATION � _TRANSACTION_LIST_ENTRY �? PSCONTEXT_QUEUE $ (5 _TRANSACTION_BIND_INFORMATION # �$ NDR_CS_SIZE_CONVERT_ROUTINES �? FIND_BY_SID_DATA �% _QUERY_FILE_LAYOUT_INPUT �? PALPC_CONTEXT_ATTR P6 TOKEN_SOURCE 3 �6 JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE �, POSVERSIONINFOEX2W �? PRTL_HEAP_INFORMATION = tagTITLEBARINFOEX # �? PCOMPOUND_ACCESS_ALLOWED_ACE
t LPBOOL �- _UNLOAD_DLL_DEBUG_INFO h! ICONINFOEX % PVALUEW , �' PERFINFO_PFMAPPED_SECTION_INFORMATION , �? PCLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 �? PCI_LOG_SCHEDULER_SLEEP + �? PCRTL_ACTIVATION_CONTEXT_STACK_FRAME - �4 PEVENT_TRACE_STACK_TRACING_INFORMATION ( �? PTIMER_SET_COALESCABLE_TIMER_INFO " PSAVEPOINT_ID + 4 _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A �? FNSAVE_FORMAT G0 _OBJECT_TYPE_LIST + h _RTL_FEATURE_CONFIGURATION_OPERATION ; LPENUMLOGFONTEXDVW �! PPAINTSTRUCT �$ ARM64_FNPDATA_FLAGS �? GRADIENT_TRIANGLE �! DOCINFOA �? PEMRSTRETCHDIBITS i5 SC_EVENT_TYPE ! �? PSYSTEM_POWER_CAPABILITIES 9 SYSTEM_POWER_INFORMATION ; S _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION �? SC_HANDLE__ : T3 PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION �7 FILE_NOTIFY_INFORMATION 2 g; TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT # �? _ETW_KERNEL_HEADER_EXTENSION 8 _IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION �6 FPO_DATA " PSID_HASH_ENTRY � EVENT_DESCRIPTOR & �? KENTROPY_INITIALIZATION_ROUTINE �& tagHELPWININFOW & �? ETW_COMPRESSION_RESUMPTION_MODE ( �? PLOOKUP_STREAM_FROM_CLUSTER_INPUT , �? PPLUGPLAY_CONTROL_DEVICE_CONTROL_DATA + �4 EVENT_TRACE_PEBS_TRACING_INFORMATION & �? PCSE_SET_FILE_CACHE_INFORMATION a$ LPSYNCHRONIZATION_BARRIER �! tagEMRPLGBLT �/ _TOKEN_SID_INFORMATION . �? PPROCESS_MITIGATION_DYNAMIC_CODE_POLICY / �? PPROCESS_MITIGATION_CHILD_PROCESS_POLICY ! �? PUSN_TRACK_MODIFIED_RANGES �? PEMRSAVEDC $ �? PPS_CPU_QUOTA_SET_INFORMATION �? _FP_IEEE_RECORD �? PCM_MCA_POS_DATA �? PTP_NBQ_FREE_ROUTINE �? RPC_FORWARD_FUNCTION $ �? PTHREAD_PROFILING_INFORMATION ! �? PFILE_BOTH_DIR_INFORMATION ) �? _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX & �? PSYSTEM_CPU_SET_TAG_INFORMATION �? DATEFMT_ENUMPROCEXEX � _FILE_LINK_INFORMATION % �? SL_APPX_CACHE_VALUE_DESCRIPTOR �? LPQUERY_SERVICE_CONFIGA ' �0 _PERFINFO_PMC_SAMPLE_INFORMATION �? PFILE_ID_INFORMATION # �? RTL_PROCESS_LOCK_INFORMATION \ SERVICE_SID_INFO �? _ETW_REF_CLOCK !4 _VIRTUALIZATION_RECORD " � MEM_EXTENDED_PARAMETER_TYPE
- EMREXTTEXTOUTA 7 �? PLDR_LOADED_MODULE_ENUMERATION_CALLBACK_FUNCTION �! EMRPAINTRGN ! : MEMORY_BASIC_INFORMATION64 - �! _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS ( �* MEMORY_WORKING_SET_EX_INFORMATION {? LPDISCDLGSTRUCTW " 9 _PERFINFO_SYSCALL_EXIT_DATA , z? PEVENT_TRACE_SOFT_RESTART_INFORMATION v? POSVERSIONINFOEX2 ( t? PRTL_QUERY_DEBUG_INFORMATION_INFO s? LPCURRENCYFMTW ) o? PJOBOBJECT_CONTAINER_IDENTIFIER_V2 l? _SMALL_RECT * �3 _PERFINFO_EXECUTIVE_RESOURCE_CONFIG j? PTP_NBQ_ALLOC_ROUTINE " �6 _QUERY_SERVICE_LOCK_STATUSA * G< _SYSTEM_SET_TIME_ADJUST_INFORMATION $ d? PPLUGPLAY_CUSTOM_NOTIFICATION b? PCGESTUREINFO ! RTL_STRING_LENGTH_TYPE , _? _EVENT_TRACE_SOFT_RESTART_INFORMATION Y? PPO_WAKE_SOURCE_INTERNAL > tagICEXYZTRIPLE V? _IMAGE_TLS_DIRECTORY64 O? REMOTE_NAME_INFOA ' �5 PROCESS_HANDLE_TRACING_ENABLE_EX # K? EXTENDED_ENCRYPTED_DATA_INFO " �+ _ENLISTMENT_CRM_INFORMATION HRESULT 1 G? SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE B? PRKCRM_TRANSACTION_BLOB g. tagMOUSEINPUT A? LPCPINFOEXW % �7 WOW64_ARCHITECTURE_INFORMATION % =? PENCLAVE_CREATE_INFO_VBS_BASIC ;? PIMAGE_ENCLAVE_IMPORT 9? COMPRESSED_DATA_INFO % =+ _SYSTEM_PROCESS_CLASSIFICATION RID_DEVICE_INFO_HID 3? PSYSTEM_ACCESS_FILTER_ACE , 1? PSYSTEM_QUERY_TIME_ADJUST_INFORMATION �$ tagEMRGLSRECORD 0? PIMAGE_FILE_HEADER .? QUERY_BAD_RANGES_OUTPUT S# _SE_IMAGE_SIGNATURE_TYPE 3 U, _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT " �* _ETW_UMS_EVENT_DISASSOCIATE � FILE_LINK_INFORMATION '? PCACTCTXA & @> _SYSTEM_HANDLE_TABLE_ENTRY_INFO ! &? PSYSTEM_OBJECT_INFORMATION ! �3 _IMAGE_BOUND_FORWARDER_REF 2 �7 _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 %? PMANDATORY_LEVEL 6 �% _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY [+ INPUT_MESSAGE_ORIGIN_ID )" MOUSE_EVENT_RECORD #? _IO_RESOURCE_LIST �1 _EXIT_THREAD_DEBUG_INFO .9 NPBITMAP ? IMAGE_AUX_SYMBOL_TYPE � _LDR_SECTION_INFO $ ? PSET_PURGE_FAILURE_MODE_INPUT ? PMENUITEMTEMPLATEHEADER ' 5 USER_MARSHAL_MARSHALLING_ROUTINE ? SYSTEM_BASIC_INFORMATION . U PROCESS_MITIGATION_CHILD_PROCESS_POLICY c7 THREAD_TEB_INFORMATION - � MEMORY_PARTITION_ATTRIBUTE_INFORMATION ? _RTL_UNLOAD_EVENT_TRACE32 �< tagLASTINPUTINFO ? PEVENT_TRACE
" LGRPID . �7 _STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER
? _PO_WAKE_SOURCE_DEVICE �" _TOKEN_ORIGIN ,
6 SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA ? MM_ETW_PAGE_INFO tagEMRSELECTCLIPPATH ] NUMBERFMTA
u LPUINT " �3 _ETW_DUPLICATE_HANDLE_EVENT ? IMAGE_CHPE_METADATA_X86 ? PIMAGE_ENCLAVE_CONFIG �> PDLGITEMTEMPLATEA �> tagKEYBDINPUT V) _X86_CALL_FRAME �> PIO_APC_ROUTINE + �> _SYSTEM_CRASH_DUMP_STATE_INFORMATION 8 PKCRM_MARSHAL_HEADER y* tagEXTLOGFONTW - �. _SERVICE_CONTROL_STATUS_REASON_PARAMSA + 2 _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE �> PWNF_USER_CALLBACK & �> PPERFINFO_CC_LOGGED_STREAM_INFO " �> PSYSTEM_ERROR_PORT_TIMEOUTS <. _SERVICE_START_REASON �> PHARDWARE_COUNTER_TYPE $ �> PFILE_VOLUME_NAME_INFORMATION ) �> _SYSTEM_WATCHDOG_TIMER_INFORMATION & [ RTL_STACK_TRACE_DATABASE_CREATE # �> tagTouchPredictionParameters - �> PEVENT_TRACE_STACK_CACHING_INFORMATION �> PXSAVE_AREA_HEADER �> PRTL_MEMORY_TYPE ]9 PEMRSETICMPROFILEA " �> PETW_HEAP_EVENT_CONTRACTION �> PRIVILEGE_SET " �> PPROCESSOR_IDLESTATE_POLICY �> _CPTABLEINFO # � RTL_CRITICAL_SECTION_DEBUG32 �0 SERVICE_TRIGGER �> _LDR_VERIFY_IMAGE_INFO & �> PFILE_PIPE_CREATE_SYMLINK_INPUT �> _RTL_UNLOAD_EVENT_TRACE64 �> PCMC_EXCEPTION �> PRTL_UNLOAD_EVENT_TRACE �> LPGLYPHSET * _; PERFINFO_PAGECOMBINE_AGGREGATE_STAT # �> PKEY_WOW64_FLAGS_INFORMATION * �> _PERFINFO_SESSIONCREATE_INFORMATION ( PPATTERN �> PPRIVILEGE_SET N EMRPOLYPOLYLINE " �. PERFINFO_FILE_OPERATION_END �> PTXFS_MODIFY_RM �> BOOT_AREA_INFO �> LPPELARRAY �! _EXFAT_STATISTICS �* _GET_FILEEX_INFO_LEVELS f HIGHCONTRASTW
�> FP_128 3 �> _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION ! UMS_SCHEDULER_STARTUP_INFO $ �> PERFINFO_FLT_OPERATION_STATUS SLIST_ENTRY ' �> _PROCESS_WS_WATCH_INFORMATION_EX 0 �> PPOWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES < ENUMLOGFONTEXW �> PPERFINFO_PO_POSTSLEEP $ MEMORY_COMBINE_INFORMATION_EX # �> _SYSTEM_VHD_BOOT_INFORMATION �: _EVENT_INSTANCE_HEADER ( �> _EVENT_EXTENDED_ITEM_PMC_COUNTERS ' � _PERFINFO_FILEOBJECT_INFORMATION & �> _POWER_THROTTLING_PROCESS_STATE �> PPIXELFORMATDESCRIPTOR % �> ETW_TP_EVENT_TIMER_SET_NTTIMER 5 > _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY 0 w> PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY + u> PRPC_HTTP_TRANSPORT_CREDENTIALS_V3_A + > _JOBOBJECT_ASSOCIATE_COMPLETION_PORT i SECTION_INHERIT p> PBREAK_ON_STATUS_BUFFER ( i> PCFG_CALL_TARGET_LIST_INFORMATION ' f> DISPLAYCONFIG_DEVICE_INFO_HEADER c> _ABCFLOAT $ _> _REPAIR_STORAGE_RESERVE_INPUT � SYSDBG_COMMAND Y> PVALCONTEXT & |1 PERFINFO_CC_READ_AHEAD_COMPLETE # 1 SYSTEM_CALL_TIME_INFORMATION W> EMRSETBKCOLOR T> LPCBT_CREATEWND ! S> PETW_COVERAGE_SAMPLER_DATA $ ACCESS_REASON_TYPE & Q> CSV_QUERY_VOLUME_REDIRECT_STATE ! M> SYSTEM_POWER_STATE_CONTEXT % @> SYSTEM_HANDLE_TABLE_ENTRY_INFO ! >> PEVENT_TRACE_PROPERTIES_V2 ' => PPERFINFO_PO_SESSION_CALLOUT_RET 7 _ETW_POOL_EVENT �# KSYSTEM_TIME 9> EVENT_HEADER 7> PVIRTUALIZATION_RECORD $ 3> PPROCESS_WS_WATCH_INFORMATION + j PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA $ �. _SYSTEM_FIRMWARE_TABLE_ACTION .> PEMREXTFLOODFILL ,> PRPC_UNICODE_STRING PHALF_PTR *> ANON_OBJECT_HEADER_V2 ! '> PSYSTEM_POLICY_INFORMATION #> PTIMELINE_BITMAP �3 _PREFIX_TABLE - !> _EVENT_TRACE_STACK_CACHING_INFORMATION > PMEMORY_BASIC_INFORMATION > PDROPSTRUCT > ETW_PER_SESSION_QUOTA # > PLDR_CREATE_ACT_CTX_LANGUAGE > PFILE_BASIC_INFORMATION s _TXFS_MODIFY_RM ! I1 FSCTL_OFFLOAD_WRITE_OUTPUT 0
> PFN_RTL_IS_SERVICE_PACK_VERSION_INSTALLED � tagEMRPOLYLINE > PACCESS_ALLOWED_ACE � _STARTUPINFOEXW " 99 DIALOG_DPI_CHANGE_BEHAVIORS + > PJOBOBJECT_ASSOCIATE_COMPLETION_PORT � _LOAD_ASDATA_TABLE ! �= PRTL_RETPOLINE_BINARY_INFO 3 tagEMRSETARCDIRECTION % EXCEPTION_RECORD " +. _IMAGE_DYNAMIC_RELOCATION32 + �= CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT > 5 ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA �= PROCESSOR_IDLE_HANDLER �= tagGUITHREADINFO ' �. DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK �8 NPDEVMODEW # �= PRTL_IMAGE_MITIGATION_POLICY % �= PMANAGE_HOT_PATCH_UNLOAD_PATCH �* FOCUS_EVENT_RECORD �= _SYSTEM_INFO Q* WNODE_SINGLE_ITEM ! �= PPROCESS_FAULT_INFORMATION �= tagPOINTER_PEN_INFO �+ POWER_PLATFORM_ROLE - �= PSYSTEM_PROCESSOR_PROFILE_CONTROL_AREA e0 _PERFINFO_CCSWAP_LITE * [ VIRTUALIZATION_INSTANCE_INFO_OUTPUT . � _SECURE_SPECULATION_CONTROL_INFORMATION �2 _EISA_IRQ_CONFIGURATION �= LPLOGCOLORSPACEA . l _ETW_COVERAGE_SAMPLER_INFORMATION_CLASS ) 14 MANAGE_WRITES_TO_EXECUTABLE_MEMORY �= _PO_WAKE_SOURCE_TIMER NDR_CCONTEXT " �= PLDR_IMPORT_MODULE_CALLBACK ' � _IMAGE_RESOURCE_DIRECTORY_STRING _TEB �= LPMONITORINFOEXA �= PPM_WMI_PERF_STATE ) �= PERFINFO_DPC_EXECUTION_INFORMATION �= _IMAGE_DEBUG_MISC $ �= PUMS_CREATE_THREAD_ATTRIBUTES $ �= _FILE_END_OF_FILE_INFORMATION & �= _MEMORY_WORKING_SET_EX_LOCATION �= NPTEXTMETRIC - tagMOUSEKEYS �= RPC_SETFILTER_FUNC �= OBJECTID �= BOOT_RECORD �= PCM_EXTENDED_PARAMETER ) ~* TRANSACTION_PROPERTIES_INFORMATION �6 _MUILANGLISTNODE �= PFILE_ALL_INFORMATION � SYSGEOCLASS �= PSD_QUERY_STATS_INPUT / �= SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS # 1+ _OS_DEPLOYEMENT_STATE_VALUES �= PMSLLHOOKSTRUCT �4 LPWNDCLASSEXW �= FSCTL_OFFLOAD_READ_INPUT �# DISPLAYCONFIG_ROTATION # : FILE_DISPOSITION_INFORMATION � _JIT_DEBUG_INFO �= _RPC_BINDING_VECTOR I7 PS_SYSTEM_DLL_INIT_BLOCK , �4 EVENT_TRACE_STACK_TRACING_INFORMATION �1 PCZZSTR 4 Y7 PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY $ � _SYSTEM_REF_TRACE_INFORMATION |= SCROLLINFO y= PWMI_PNP_RECORD_V3 �7 SYSDBG_LIVEDUMP_CONTROL u= PPSFEATURE_OUTPUT _= LPFONTSIGNATURE ) r= MIDL_WINRT_TYPE_SERIALIZATION_INFO ( n= ACCESS_DENIED_CALLBACK_OBJECT_ACE ! h= PSILOOBJECT_ROOT_DIRECTORY e= _FILE_PREFETCH _= PFONTSIGNATURE ]= RTL_GENERIC_TABLE p+ OSVERSIONINFOEXW ) [1 FILE_VALID_DATA_LENGTH_INFORMATION ) P= PSYSTEM_FIRMWARE_TABLE_INFORMATION �$ PS_WAKE_REASON & �/ FILE_FS_SECTOR_SIZE_INFORMATION � SYSTEM_POOL_INFORMATION N= HEAP_COMMIT_DECOMMIT � ETW_LBR_ENTRY & K= PPERFINFO_FILE_SIMPLE_OPERATION G= PPS_CPU_QUOTA_QUERY_ENTRY # D= SYSTEM_INTERRUPT_INFORMATION - tagWINDOWPOS RPC_NS_HANDLE �< METAFILEPICT $ @= tagPOINTER_DEVICE_CURSOR_INFO
' HSTR__ " * MEMORY_PRIORITY_INFORMATION 7= PIMAGE_IMPORT_DESCRIPTOR 4= _IMAGE_ENCLAVE_CONFIG64 & .= PACTIVATION_CONTEXT_QUERY_INDEX ! �. _TXFS_START_RM_INFORMATION & ,= PRTL_UMS_SCHEDULER_STARTUP_INFO *= _EVENT_FILTER_EVENT_ID &= ENUMUILANG #= LPHANDLETABLE �4 tagMSLLHOOKSTRUCT 3 "= PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION ' �1 PERFINFO_KERNELMEMORY_USAGE_TYPE = PMFT_ENUM_DATA_V0 = _CONTAINER_VOLUME_STATE 3 = _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY = PUSN_JOURNAL_DATA_V2 u _FILE_REGION_INFO ! STRING64 �! _HEAP_INFORMATION_CLASS ) �5 PERFINFO_PO_NOTIFY_DEVICE_COMPLETE �, IMAGE_CHPE_RANGE_ENTRY = PUSN_JOURNAL_DATA ;3 IO_ERROR_LOG_MESSAGE p _KEY_TRUST_INFORMATION �; JOURNAL_INFORMATION_CLASS & �0 PERFINFO_PMC_SAMPLE_INFORMATION � _RTL_RESOURCE = PSERVICE_NOTIFYA �< PPS_CREATE_INFO �< PNEWTEXTMETRIC s6 tagEMRSETPIXELV � NDR_EXPR_DESC % S5 _ETW_CLOCK_CONFIGURATION_EVENT " � _ACCESS_DENIED_CALLBACK_ACE �< _SYSTEM_AUDIT_OBJECT_ACE ! �< _SYSTEM_POLICY_INFORMATION �< PCOEM_STRING �< PTOKEN_STATISTICS �7 tagSOUNDSENTRYW PLONGLONG �1 XSAVE_SUPPORTED_CPU �< PVM_COUNTERS_EX ! �< PCONTAINER_ROOT_INFO_INPUT - :! EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID �< SYSTEM_POLICY_INFORMATION p0 _PROCESS_HEAP_ENTRY � tagEMRPOLYPOLYLINE16 �< PREPARSE_DATA_BUFFER_EX �< PLASTINPUTINFO % �< PSE_SET_FILE_CACHE_INFORMATION =6 _PROCESS_ACCESS_TOKEN 1 �< JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 " �< SYSTEM_SCOPED_POLICY_ID_ACE �< tagEMREXTCREATEPEN �< SERVICE_STATUS_PROCESS # x) PERFINFO_FILE_PATH_OPERATION �< PREAD_FILE_USN_DATA "( _PO_WAKE_SOURCE_HISTORY �< WMI_CONTEXTSWAP �< PSCOPE_TABLE_ARM64 �< PSTREAM_LAYOUT_ENTRY ' �< PSYSTEM_HOT_PATCH_REGISTRY_VALUE " PTP_VERSION �< PFILE_STORAGE_INFO �& CONSOLE_FONT_INFO "
( _SYSTEM_BIGPOOL_INFORMATION ! [ SYSTEM_VA_LIST_INFORMATION ! � _RTL_UMS_THREAD_INFO_CLASS �1 _CACHE_DESCRIPTOR " &2 CONSOLE_READCONSOLE_CONTROL ) �< _FILE_IS_REMOTE_DEVICE_INFORMATION 3 �< PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION �( ATOM_INFORMATION_CLASS N RTL_BARRIER �< POBJECT_ATTRIBUTES64 " �< SD_CHANGE_MACHINE_SID_INPUT $ �< FILE_PIPE_EVENT_SELECT_BUFFER �< _BOOT_ENTROPY_NT_RESULT �< _NETRESOURCEA �< LPCBT_CREATEWNDA �< PPOWER_STATE_TYPE - $; _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT + �< SYSTEM_INTERRUPT_CPU_SET_INFORMATION �/ ANIMATIONINFO
LONG64 �< _TOKEN_STATISTICS �) FILE_PIPE_PEEK_BUFFER �" tagLOGFONTW Q0 tagEMRCREATEMONOBRUSH 0 G4 STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY - �< PSYSTEM_PROCESSOR_FEATURES_INFORMATION # 45 QUERY_STORAGE_RESERVE_OUTPUT 1 �< PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION
�' _FP_64 � DMA_SPEED �< tagMETAFILEPICT # ~< PCLAIM_SECURITY_ATTRIBUTE_V1 & r- _COVERAGE_UNLOADED_MODULE_ENTRY �! HSAVEDUILANGUAGES__ |< LPMODEMSETTINGS n< PEVENT_TRACE_LOGFILEA �9 RPC_CLIENT_INFORMATION1
09 BITMAP ( m< PGET_FILTER_FILE_IDENTIFIER_INPUT k< _REASON_BUFFER " h< PSYSTEM_CONSOLE_INFORMATION f< MEM_ADDRESS_REQUIREMENTS O% LPCWCHAR . J ACTIVATION_CONTEXT_DETAILED_INFORMATION ! c< PPAGE_PRIORITY_INFORMATION �# SIZE �8 _FILE_CASE_SENSITIVE_INFO _< LPENUMLOGFONT # OBJECT_NAME_INFORMATION FILE_INFORMATION_CLASS "( PO_WAKE_SOURCE_HISTORY �5 _HOT_PATCH_IMAGE_INFO O% LPCUWSTR $ �( _SET_PURGE_FAILURE_MODE_INPUT ! \< _SYSTEM_HANDLE_INFORMATION !0 RECT �0 COLORADJUSTMENT �" RTL_MODULE_BASIC_INFO # W< PRTL_USER_PROCESS_PARAMETERS � FILE_STAT_INFORMATION U< tagPOINTER_DEVICE_INFO ) J< PPERFINFO_KERNELMEMORY_RANGE_USAGE " ULONG * E< PSYSTEM_SET_TIME_ADJUST_INFORMATION � PERFINFO_CCSWAP_TYPE . @< PSYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER " 1+ OS_DEPLOYEMENT_STATE_VALUES 3 �& SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM << _IMAGE_FUNCTION_ENTRY 9< PCIMAGE_THUNK_DATA32 �1 _WMI_JOB_REMOVE_PROCESS , 6< _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 ! �4 CONTAINER_ROOT_INFO_OUTPUT � _ABC � _REMOTE_NAME_INFOW /< KERNEL_USER_TIMES + +< SYSTEM_QUERY_TIME_ADJUST_INFORMATION . %< PJOBOBJECT_BASIC_ACCOUNTING_INFORMATION " [0 _LPC_UNREGISTER_PROCESS_MSG $< PREPARSE_GUID_DATA_BUFFER #< PSYSTEM_NUMA_INFORMATION / !< SYSTEM_FEATURE_CONFIGURATION_INFORMATION � _MM_ETW_WORKING_SET_TYPE # < SERVICE_FAILURE_ACTIONS_FLAG & < PROCESS_HANDLE_TABLE_ENTRY_INFO < ALPC_HANDLE_ATTR32
< PXSTATE_CONTEXT ( �; _ETW_COVERAGE_SAMPLER_STATUS_INFO & < PPUBLIC_OBJECT_TYPE_INFORMATION $ < _JOBOBJECT_JOBSET_INFORMATION % ) DEDUP_CHUNK_INFORMATION_HASH32 < PEISA_IRQ_CONFIGURATION �; LPENUMLOGFONTEXW �0 RAWKEYBOARD 1/ _OSVERSIONINFOW �; tagEMROFFSETCLIPRGN �; PETW_BUFFER_CONTEXT W8 ETW_HEAP_EVENT_RUNDOWN �; PPEB_LDR_DATA �; PEMRFILLRGN SECURITY_STATUS 9 _ENCRYPTED_DATA_INFO �; PHYSICAL_DISK_RECORD �; PRATE_QUOTA_LIMIT �; PS_ATTRIBUTE_LIST ( �. SYSTEM_FIRMWARE_TABLE_INFORMATION �; _RTL_HASH_ENTRY . NPCHARSETINFO ' �; ETW_COVERAGE_SAMPLER_STATUS_INFO �; PNETWORK_APP_INSTANCE_EA " �; _KEY_VALUE_FULL_INFORMATION �; CM_POWER_DATA W WMI_WAIT_SINGLE $ 8( SYSTEM_CALL_COUNT_INFORMATION 0 4/ SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE �; _CM_SONIC_DEVICE_DATA �; PTRACE_VERSION_INFO ' �; PFILE_FS_SECTOR_SIZE_INFORMATION �; PRTL_TREE_DELETE_FUNCTION ( M PROCESS_ENERGY_COMPONENT_TYPE_NUM tagEMRSETCOLORSPACE ) _FILE_ID_EXTD_BOTH_DIR_INFORMATION �; ENUMRESLANGPROCW �; INPUT_TRANSFORM $ �) _ETW_TP_EVENT_CALLBACK_CANCEL �8 LPDEVMODEW ( �; _RPC_BINDING_HANDLE_TEMPLATE_V1_W �; PCM_COMPONENT_INFORMATION �; FILE_ALIGNMENT_INFO # &2 _CONSOLE_READCONSOLE_CONTROL + �; PALPC_PORT_ASSOCIATE_COMPLETION_PORT �; RPC_STATS_VECTOR & �; _STREAMS_QUERY_ID_OUTPUT_BUFFER �- IMAGE_TLS_DIRECTORY32 1 �; _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT H* DATEFMT_ENUMPROCW �; PSTYLEBUF �; _ACL_REVISION_INFORMATION �; HLSURF__ � LPRAWMOUSE �; _SCRUB_DATA_OUTPUT # �; PMEMORY_PARTITION_PAGE_RANGE t BOOL � LPXFORM 1 �; PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION % CM_PARTIAL_RESOURCE_DESCRIPTOR 7 � _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION ! � ETW_FINALIZE_KTIMER2_EVENT / ; PPROCESS_STACK_ALLOCATION_INFORMATION_EX ~; PIMEMENUITEMINFO 1 }; I_RpcProxyUpdatePerfCounterBackendServerFn y; PERFINFO_PO_NOTIFY_DEVICE s; PCOVERAGE_SECTION_HEADER * 14 _MANAGE_WRITES_TO_EXECUTABLE_MEMORY . PCHARSETINFO p; ETW_HEAP_EVENT_COMMON Z IMAGE_NT_HEADERS % j; PKNONVOLATILE_CONTEXT_POINTERS 3 e; PTRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT �0 EMRSETWORLDTRANSFORM
�1 PCNZCH . ^. _PROCESS_DYNAMIC_EH_CONTINUATION_TARGET b; PALETTEENTRY + [; PPERFINFO_PAGECOMBINE_AGGREGATE_STAT V; PFILE_PATH T; PEVENT_FILTER_HEADER S; PPERFINFO_TRACE_HEADER Q; _RPC_TRANSFER_SYNTAX % K; PSYSTEM_PROCESS_ID_INFORMATION ! �: _WMI_IMAGELOAD_INFORMATION " PKSPIN_LOCK �& tagNMHDR " H; FILE_SET_DEFECT_MGMT_BUFFER " A; PJOBOBJECT_WAKE_INFORMATION o SYSDBG_CONTROL_SPACE >; MMPFN_IDENTITY '; PREAD_USN_JOURNAL_DATA - "; PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT N EMRPOLYPOLYGON $ ; LPENUM_SERVICE_STATUS_PROCESS
q PWCHAR ; PENUMLOGFONTEXDVW i5 _SC_EVENT_TYPE $ ; PETW_HEAP_EVENT_RUNDOWN_RANGE + ; PPERFINFO_DOMAIN_CHANGE_EVENT_REASON ; LPLOGPALETTE ( ; PROCESS_CHILD_PROCESS_INFORMATION �# NPNEWTEXTMETRICW �4 PWNDCLASSEXW
; SYSDBG_VIRTUAL
; NPEXTLOGFONT , ; _PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT & ; PDEDUP_CHUNK_INFORMATION_HASH32 ; PTP_WORK_CALLBACK �: WMI_IMAGELOAD_INFORMATION 4 �' _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 �6 QUERY_SERVICE_LOCK_STATUS & �: ETW_COVERAGE_SAMPLER_PERF_STATS �2 WMIREGGUID �: PX86_CALL_FRAME �: PMEMORY_SCRUB_INFORMATION H% tagCOMPOSITIONFORM . �: PRETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER * � _SYSTEM_SESSION_BIGPOOL_INFORMATION " �: _SYSDBG_KD_PULL_REMOTE_FILE
NUMBERFMTW 4 �: PPROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY �: PEMRCREATEPEN �: _FILE_LAYOUT_NAME_ENTRY ! �: KENTROPY_RAW_DATA_CALLBACK �: PSTORAGE_RESERVE_ID & �: _CM_PNP_BIOS_INSTALLATION_CHECK �: PWOW64_FUNCTION_CODE64 �: LPHELPINFO �: PEVENT_INSTANCE_HEADER �: PRTL_RB_TREE �: _HEAP_INFORMATION_ITEM 2 tagMULTIKEYHELPA + �: PEVENT_TRACE_PERFORMANCE_INFORMATION �: PSYSTEM_PREFETCH_OPTIONS RPC_BUFPTR �: _RTL_RELATIVE_NAME_U 1 �6 FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX CURSORSHAPE �: PCIMAGE_SECTION_HEADER . �: STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE �: PRTLP_TAG_INFO � TEXTMETRIC S' USER_MARSHAL_CB $ 1 _SYSTEM_CALL_TIME_INFORMATION , � _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA �5 _CM_ERROR_CONTROL_TYPE - �: FILE_DESIRED_STORAGE_CLASS_INFORMATION �: _FILE_STORAGE_INFO �: NAMEENUMPROCW . C0 _PROCESS_MITIGATION_FONT_DISABLE_POLICY � tagREGISTERWORDW �: PPERFINFO_FILE_READ_WRITE # _REFS_SMR_VOLUME_INFO_OUTPUT �: PTRANSACTION_NOTIFICATION ) �: ETW_TRACE_PARTITION_INFORMATION_V2 5 �: PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST ! �: PMEMORY_REGION_INFORMATION 1 �( EVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION �: PKAFFINITY_EX + �: _SYSTEM_NET_RATE_CONTROL_SET_CONTEXT �: PRTL_PROCESS_MODULES , : PSYSTEM_SECUREBOOT_POLICY_INFORMATION 3 DEP_SYSTEM_POLICY_TYPE ~: PEMRFRAMERGN " }: PWMI_JOB_SET_QUERY_NET_RATE y: PCOBJECT_ATTRIBUTES64 u: _SERVICE_STATUS ( r: _MEMORY_SHARED_COMMIT_INFORMATION G value_entA n: _CSTRING k: NPRECONVERTSTRING # g: PIMAGE_SEPARATE_DEBUG_HEADER Z' PEMRPOLYTEXTOUTW e: PCEVENT_DESCRIPTOR p TCHAR � MIDL_METHOD_PROPERTY a: PALPC_BASIC_INFORMATION . NPLOGBRUSH ( \: PREMOTE_LINK_TRACKING_INFORMATION Z: PEMRCOLORCORRECTPALETTE V: PWMIGUIDINFORMATION " �) SERVICE_REGISTRY_STATE_TYPE $ P: FILE_NETWORK_OPEN_INFORMATION ! L: PROCESSOR_IDLESTATE_POLICY - ?: PMEMORY_PARTITION_PAGEFILE_INFORMATION �4 RTL_PROCESS_LOCKS ' :: PHEAP_BLOCK_SETTABLE_INFORMATION + 7: PPERFINFO_IMAGELOAD_IN_PAGEFILE_INFO ! �+ FILE_DIRECTORY_INFORMATION ( �. SYSTEM_PROCESSOR_IDLE_INFORMATION
6: HDC �9 _MOF_FIELD # 4: WORKER_FACTORY_DEFERRED_WORK /: SID_IDENTIFIER_AUTHORITY * }! PRTL_ACTIVATION_CONTEXT_STACK_FRAME �4 PWNDCLASSA -: ENCLAVE_TARGET_FUNCTION +: _FILE_ID_INFORMATION # M SharedVirtualDiskSupportType �6 _HEAP_EVENT_RANGE % z _ALTERNATIVE_ARCHITECTURE_TYPE �% PEMRSETCOLORSPACE & ": PEVENT_EXTENDED_ITEM_PEBS_INDEX : PERFINFO_SET_POWER_ACTION : PPOINTL : PXMIT_ROUTINE_QUINTUPLE �# _POOLED_USAGE_AND_LIMITS 2 : PTRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT : PHEAP_RANGE_DESTROY : PPERFINFO_PROCESS_PERFCTR �/ FILE_PREFETCH_EX : _FILE_PIPE_EVENT_BUFFER
: _SYSDBG_MSR � _DPFLTR_TYPE " : _CONSOLE_SCREEN_BUFFER_INFO ! : _FSCTL_OFFLOAD_READ_OUTPUT $ P, SYSTEM_ACPI_AUDIT_INFORMATION �9 LPLDT_ENTRY �9 PCM_SERIAL_DEVICE_DATA �9 PCHANGEFILTERSTRUCT �9 RPC_IF_ID_VECTOR �9 PEX_WNF_SUBSCRIPTION �9 NPLOGFONTA �1 _GLYPHMETRICSFLOAT # �. _PERFINFO_FILE_OPERATION_END ! �9 SYSTEM_POOLTAG_INFORMATION �9 PRTL_HEAP_TAG �9 LANGUAGEGROUP_ENUMPROCW SERVICE_MAIN_FUNCTIONW �9 NPCANDIDATELIST �9 PARM64_NT_NEON128 �9 MULTI_TIME �9 TRACE_VERSION_INFO 7 LPCUTSTR ( �9 SYSTEM_VSM_PROTECTION_INFORMATION % �9 PERFINFO_PPM_IDLE_STATE_CHANGE # �9 PRTL_ALLOCATE_STRING_ROUTINE �9 LPCURSORINFO O% LPCWSTR
3 PCUCSSTR 7 �9 ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION �0 LPCOLORADJUSTMENT �9 PMOF_FIELD �9 EISA_MEMORY_TYPE 5 FILE_STORAGE_TIER_CLASS
g8 RAWHID �9 PPERFINFO_MM_STAT ! �9 PIMAGE_BOUND_FORWARDER_REF �& TOKEN_MANDATORY_LABEL 0 �9 PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION LPCWPSTRUCT �9 _IMAGE_ENCLAVE_IMPORT q5 DUPLICATE_EXTENTS_DATA_EX �9 PFILE_OBJECTID_BUFFER �9 PPOWER_ACTION � TP_POOL ]+ PAXESLISTW " �4 _CONTAINER_ROOT_INFO_OUTPUT � TEXTMETRICW @ FLOAT � REGISTERWORDW �9 PRPC_CLIENT_INFORMATION1 �9 WMI_IDE_CHANNEL_RECORD �9 PERFINFO_FILE_CREATE �9 PLDR_RELEASE_ACT_CTX 7 �9 _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION & . _RTL_DYNAMIC_HASH_TABLE_CONTEXT 9 DISPLAYCONFIG_PATH_INFO |9 PFSCTL_UNMAP_SPACE_OUTPUT t9 PPROCESSOR_IDLE_STATE " KAFFINITY P4 HBITMAP__ r9 _TRACE_LOGFILE_HEADER # �/ _ETW_COVERAGE_SAMPLER_MODULE l9 PCOBJECT_ATTRIBUTES32 h9 PTOUCHINPUT \( tagHELPWININFOA �& _RTL_CRITICAL_SECTION " �0 RTL_SEGMENT_HEAP_PARAMETERS � _HEAP_REGION_INFORMATION $1 FILEOFFSET_INFORMATION 2 _9 PMEMORY_PARTITION_MEMORY_EVENTS_INFORMATION ]9 PEMRSETICMPROFILEW - � _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 [9 _FILE_NAME_INFORMATION ^* LPKBDLLHOOKSTRUCT V9 tagVS_FIXEDFILEINFO # R9 _ETW_DISKIO_FLUSH_BUFFERS_V3 0 WX86THREAD O9 PSRWLOCK # N9 PCM_FULL_RESOURCE_DESCRIPTOR L9 _ETW_WNF_EVENT_CALLBACK ) � _FILE_MEMORY_PARTITION_INFORMATION I, MODEMDEVCAPS I9 PEVENT_TRACE_PROPERTIES * H9 PFSCTL_QUERY_STORAGE_CLASSES_OUTPUT D9 LPTRACKMOUSEEVENT # A9 SYSTEM_TIMEOFDAY_INFORMATION ' =9 DISPLAYCONFIG_SOURCE_DEVICE_NAME 5 �* _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION % 6 PERFINFO_INTERRUPT_INFORMATION ## PARM64_RUNTIME_FUNCTION 49 PVIDEO_RECORD
q PNZWCH . 29 PFSCTL_GET_INTEGRITY_INFORMATION_BUFFER .9 LPBITMAP ,9 NEWTEXTMETRICEXW *9 PPOLYTEXT �, PDEBUGHOOKINFO (9 _NDR_USER_MARSHAL_INFO �5 EMRDELETEOBJECT " !9 PENABLE_TRACE_PARAMETERS_V1 * COPYFILE2_COPY_PHASE + 9 PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE 9 THREADINFOCLASS - 5* JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS 9 PMUILANGCFGLIST 2 MULTIKEYHELP 9 PIMAGE_HOT_PATCH_BASE 9 ENCRYPTED_DATA_INFO 9 PLPC_CLIENT_DIED_MSG �7 LPHELPWININFOA " 9 PPERFINFO_SYSCALL_EXIT_DATA 9 PENCLAVE_LOAD_INFO_VBS 9 PCM_FLOPPY_DEVICE_DATA �8 PFILE_CASE_SENSITIVE_INFO HEAP_SUBSEGMENT_ALLOC 0 �' _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER �8 RTL_HEAP_STACK_CONTROL �8 _RTL_DEBUG_INFORMATION
u WPARAM �8 NPSTYLEBUF / _WMI_QUEUE �8 PLDR_ENUM_RESOURCE_ENTRY �8 XSTATE_CONFIGURATION * K _ASSEMBLY_FILE_DETAILED_INFORMATION # �# PERFINFO_PPM_STATE_SELECTION 7- QUERY_BAD_RANGES_INPUT �8 PFILETIME �8 PACE_HEADER % �8 PROCESS_EXTENDED_ENERGY_VALUES $ �8 _ENUM_SERVICE_STATUS_PROCESSW �8 PWMI_TXR �8 HICON__ �8 PDEVMODEW �8 QUERYHANDLER ) _ETW_SET_MARK_INFORMATION �8 PPROCESS_JOB_MEMORY_INFO & �8 PSYSTEM_SYSTEM_DISK_INFORMATION + �8 JOBOBJECT_SECURITY_LIMIT_INFORMATION �8 PPEBS_DS_SAVE_AREA64 �8 _ETW_OPTICALIO_INIT �& CONTEXT_CHUNK �8 _IPT_TRACE_EVENT_DATA % �8 PETW_TP_EVENT_TIMER_EXPIRATION % | _WIM_PROVIDER_INTEGRITY_STATUS & �8 _PROCESS_MEMORY_EXHAUSTION_INFO �8 FILE_MAILSLOT_PEEK_BUFFER �8 RPC_SECURITY_QOS_V5_W �8 COVERAGE_MODULE_REQUEST �8 tagACTCTXW �8 CONTEXT % LDR_RELOCATE_IMAGE_RETURN_TYPE �8 PHSM_OPCODE 4 �8 PSYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT �8 LPMOUSEMOVEPOINT n tagICONMETRICSA ! �8 ETW_HEAP_EVENT_CONTRACTION + �8 _EVENT_TRACE_PROFILE_ADD_INFORMATION �8 RTL_AVL_COMPARE_ROUTINE �# RTL_SPARSE_BITMAP_RUN " OPERATION_ID �! PEMRPAINTRGN � tagRAWINPUTDEVICE % v FILE_REPARSE_POINT_INFORMATION 8 PCOMBOBOXINFO |8 PAGE_PRIORITY_INFORMATION # x8 SYSTEM_BOOT_LOGO_INFORMATION t8 _EISA_PORT_CONFIGURATION ! o8 PLUID_AND_ATTRIBUTES_ARRAY ( m8 PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES /# PLUGPLAY_EVENT_CATEGORY �& CRITICAL_SECTION k8 WMI_PUSHLOCK W SYSTEM_DEVICE_INFORMATION $ �. LDR_DLL_NOTIFICATION_FUNCTION �3 PREFIX_TABLE g8 tagRAWHID . Z8 PETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT T8 PETW_HEAP_EVENT_RUNDOWN $ �/ _FILE_SFIO_VOLUME_INFORMATION R8 NPWNDCLASS �! POWER_STATE - � RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS ; T3 _PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION CSV_CONTROL_PARAM ! P8 SYSTEM_PROCESS_INFORMATION �& EMRSTRETCHDIBITS � WMI_POWER_RECORD 3 �( _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE ! s) SYSTEM_CONSOLE_INFORMATION 6 L8 _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY # J8 PMEMORY_WORKING_SET_EX_BLOCK & 1- _MM_ETW_WORKING_SET_PFN_RUNDOWN H8 POINTFLOAT E8 LDR_DATA_TABLE_ENTRY 8 PHARDWARE_COUNTER_DATA 8 PFILE_ACCESS_INFORMATION 8 EMRSTRETCHBLT + 8 RPC_INTERFACE_GROUP_IDLE_CALLBACK_FN % � _EVENT_TRACE_INFORMATION_CLASS / 8 EVENT_TRACE_SESSION_SECURITY_INFORMATION ) � LDR_DLL_UNLOADED_NOTIFICATION_DATA 8 NTFS_STATISTICS_EX �1 _locale_tstruct ) �7 _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT + �) _FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT ' �7 MEMORY_ENCLAVE_IMAGE_INFORMATION D �7 PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED & �7 RTLWOW64_CROSSPROCESS_WORK_ITEM
J. _RECTL 2 �7 PMEMORY_PARTITION_CONFIGURATION_INFORMATION L4 DRAWTEXTPARAMS PEXCEPTION_POINTERS * �7 PSYSTEM_LOW_PRIORITY_IO_INFORMATION �7 _ETW_PRIORITY_EVENT �5 EMRSELECTOBJECT �7 _RPC_SECURITY_QOS t errcode !/ IMPORT_OBJECT_NAME_TYPE ! , _LDR_DLL_NOTIFICATION_DATA & �7 _WOW64_ARCHITECTURE_INFORMATION 3 �7 PCACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 �7 tagALTTABINFO % �7 PWMI_DISKIO_IO_REDIRECTED_INIT �7 LPSOUNDSENTRYW �0 _WMI_IMAGEID_INFORMATION - �7 STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER ' `( _SYSTEM_SPECIAL_POOL_INFORMATION �7 _DISCDLGSTRUCTW �7 PIMAGE_AUX_SYMBOL_EX �" tagEVENTMSG & �7 _SYSTEM_LEAP_SECOND_INFORMATION " z, KEY_HANDLE_TAGS_INFORMATION �) LPPOLYTEXTA �7 WINDOW_BUFFER_SIZE_RECORD �7 PSYSTEM_POWER_LEVEL L! EMRBEGINPATH �7 _RPC_SYNTAX_IDENTIFIER �7 PFILE_NOTIFY_INFORMATION 0 53 _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS 1 �7 ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 LPFXPT2DOT30 j PTEB_ACTIVE_FRAME ) h4 TXFS_LIST_TRANSACTION_LOCKED_FILES �7 _ENCLAVE_INIT_INFO_SGX �4 SERVICE_NOTIFY_1 �7 PIMAGE_DYNAMIC_RELOCATION $ � _DELETE_STORAGE_RESERVE_INPUT �7 PHELPWININFOA �7 _SYSDBG_LIVEDUMP_CONTROL |7 ARM64_FNPDATA_CR y7 EISA_IRQ_DESCRIPTOR ( r7 PPERFINFO_DPC_ENQUEUE_INFORMATION " q7 PPROC_THREAD_ATTRIBUTE_LIST ! o7 PERFINFO_PROCESS_PERFCTR32 �0 _IMAGE_OPTIONAL_HEADER l7 PKEY_BASIC_INFORMATION ) PMEASUREITEMSTRUCT & �- CRITICAL_PROCESS_EXCEPTION_DATA k7 TIMERPROC g7 _EVENT_TRACE_PROPERTIES FCHAR c7 _THREAD_TEB_INFORMATION + `7 PSYSTEM_ACTIVITY_MODERATION_APP_TYPE \7 PMUISTRINGPOOL [7 PTEXTMETRIC 5 Y7 _PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY I7 _PS_SYSTEM_DLL_INIT_BLOCK % D7 PPO_HIBER_FORCE_DISABLE_REASON ' B7 SYSDBG_LIVEDUMP_CONTROL_ADDPAGES =7 PPORT_DATA_INFORMATION :7 PWMIREGGUIDW 87 tagWNODE_METHOD_ITEM 27 PPS_MEMORY_RESERVE /7 HWINSTA__ )7 PMENU_EVENT_RECORD ! '7 PPERFINFO_CC_FLUSH_SECTION � _CSV_CONTROL_OP J) LPSTYLEBUFA ) � PERFINFO_BOOT_PREFETCH_INFORMATION � FILE_LINKS_INFORMATION %7 _UNICODE_PREFIX_TABLE � EMRPOLYPOLYLINE16 ' l1 RPC_HTTP_TRANSPORT_CREDENTIALS_W �0 POWER_STATE_DISABLED_TYPE 7 _TIME_FIELDS 7 ETW_POOL_EVENT 7 ETW_COVERAGE_SAMPLER_DATA 7 POWER_SESSION_RIT_STATE
7 EMR 7 _RTL_RXACT_LOG b3 PFULL_PTR_XLAT_TABLES % � USER_MARSHAL_ROUTINE_QUADRUPLE 3 LOGFONT 7 PIMECHARPOSITION " �( SECURITY_QUALITY_OF_SERVICE 7 PPPM_WMI_IDLE_STATE ! _SERVICE_TABLE_ENTRYW " 7 PERFINFO_MEMORY_INFORMATION > �6 _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION �6 RTL_TRACE_HASH_FUNCTION # �6 OBJECT_DIRECTORY_INFORMATION
� ABC �6 MONITORINFO �6 PWNF_USER_SUBSCRIPTION 4 �6 _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION �6 PHANDEDNESS * �% _WIM_PROVIDER_SUSPEND_OVERLAY_INPUT � STARTUPINFOEXW �6 _FILE_ID_EXTD_DIR_INFO FXPT16DOT16 $ �6 WMI_JOB_SET_QUERY_INFORMATION PRTL_REFERENCE_COUNT ) B PIMAGE_IA64_RUNTIME_FUNCTION_ENTRY # % _PERFINFO_CC_LAZY_WRITE_SCAN �6 PORT_DATA_INFORMATION �6 TTPOLYCURVE �6 PHEAP_EVENT_RANGE ( �6 PPERFINFO_KERNELMEMORY_USAGE_TYPE ' � LDR_DLL_LOADED_NOTIFICATION_DATA 2 �6 PFILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX " W _SYSTEM_MEMORY_LIST_COMMAND - �6 _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES $ REG_ACTION �6 EXTLOGFONTA MENUTEMPLATEA H* CODEPAGE_ENUMPROCW �# _KSYSTEM_TIME u1 tagEMRSETMAPPERFLAGS �6 LPMENUITEMINFOA �3 SC_ENUM_TYPE �6 PSID_AND_ATTRIBUTES WELL_KNOWN_SID_TYPE e1 FILE_LEVEL_TRIM_RANGE �/ tagANIMATIONINFO " �6 LPQUERY_SERVICE_LOCK_STATUS �6 QUOTA_LIMITS # �6 PKEY_VALUE_LAYER_INFORMATION , � PLUGPLAY_CONTROL_TARGET_RELATION_DATA C _TOKEN_MANDATORY_POLICY f MINIMIZEDMETRICS % �6 PRPC_BINDING_HANDLE_OPTIONS_V1 �6 _FPO_DATA - �6 PSYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT �6 PNDR_CORRELATION_INFO # �3 _PROCESS_SESSION_INFORMATION �6 WX86TIB D! HIGHCONTRASTA �6 FULL_PTR_XLAT_TABLES �1 tagEMRELLIPSE �6 PIMAGE_TLS_DIRECTORY $ �6 PFILE_FS_OBJECTID_INFORMATION �6 MUILANGLISTNODE �6 PWNDCLASS KSPIN_LOCK_QUEUE_NUMBER 6 �6 JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V1 , �6 _PROCESS_STACK_ALLOCATION_INFORMATION ~6 PFILE_LEVEL_TRIM # {6 _KEY_VALUE_BASIC_INFORMATION ! � RTL_HEAP_MEMORY_LIMIT_INFO w6 _LOGICAL_DISK_DEFRAG . �+ FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT s6 EMRSETPIXELV , m6 PFILE_IOSTATUSBLOCK_RANGE_INFORMATION � NPABC ) �" _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER j6 _RPC_SECURITY_QOS_V3_A . c6 SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION P' _USER_MARSHAL_CB_TYPE [6 HARDWARE_COUNTER % W6 _VIRTUAL_STORAGE_BEHAVIOR_CODE U6 PFE_EXPORT_FUNC AXISINFOW �- PSFEATURE_CUSTPAPER A _LOGICAL_DISK_EXTENTS ) $ _MEMORY_RESOURCE_NOTIFICATION_TYPE q PWSTR M6 PTOKEN_SOURCE J6 USN_RECORD_V2 G6 PO_FIXED_WAKE_SOURCE_TYPE ' E6 PETW_PARTITION_INFO_EXTENSION_V2 D6 PKSPIN_LOCK_QUEUE + @6 PSYSTEM_ELAM_CERTIFICATE_INFORMATION 1$ WMI_DELAY_EXECUTION � tagINPUT __time64_t =6 PROCESS_ACCESS_TOKEN P PS_CREATE_STATE :6 LPMEMORYSTATUS - 86 DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS -6 PSD_ENUM_SDS_OUTPUT - (6 PHEAP_PERFORMANCE_COUNTERS_INFORMATION #6 PWMI_DPI_RECORD !6 _SCRUB_DATA_INPUT 6 _SECTIONBASICINFO 6 WINSTAENUMPROC �$ WNDCLASSEX ! 6 PRETRIEVAL_POINTERS_BUFFER 6 NEARPROC 6 _POWER_SESSION_WINLOGON
6 KEY_PID_ARRAY -
6 _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA + 6 PSYSTEM_DMA_GUARD_POLICY_INFORMATION �5 LPNETRESOURCEW �5 PHOT_PATCH_IMAGE_INFO 94 HKL__ * �5 PPERFINFO_PO_NOTIFY_DEVICE_COMPLETE �5 PPERFINFO_VTL_CHANGE �5 SYSTEM_PREFETCH_STATS , �4 PEVENT_TRACE_PEBS_TRACING_INFORMATION �5 PIMAGE_OPTIONAL_HEADER32 ) �. PROCESS_SYSTEM_RESOURCE_MANAGEMENT 2 TP_ALPC �5 PWINDOWS_OS_OPTIONS ) 5 _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR �5 LPCBTACTIVATESTRUCT D! tagHIGHCONTRASTA
u UINT32 ! | _EVENT_TRACE_PROPERTIES_V2 ' �5 PTHREAD_LAST_SYSCALL_INFORMATION �5 _PROCESSOR_POWER_POLICY " PACCESS_MASK * �5 _SYSTEM_SESSION_POOLTAG_INFORMATION �5 PIRQ_DEVICE_POLICY 1/ OSVERSIONINFOW �$ _IDL_CS_CONVERT
! _PERFINFO_FILE_DIRENUM �5 PCONTEXT_EX % � _ETW_CREATEDELETE_OBJECT_EVENT ( �5 _PROCESS_HANDLE_TRACING_ENABLE_EX D CANDIDATEFORM ) �( EVENT_TRACE_TAG_FILTER_INFORMATION % �1 PROCESS_MITIGATION_ASLR_POLICY ( �* SYSTEM_FEATURE_CONFIGURATION_TYPE � ENHMETAHEADER , �5 PEVENT_TRACE_TIME_PROFILE_INFORMATION �5 PIO_SESSION_STATE �5 HDC__ �5 _EXCEPTION_DEBUG_INFO �5 WINDOWPLACEMENT �5 _EVENT_BASIC_INFORMATION �5 NPTEXTMETRICW �5 PEMRDELETEOBJECT * �5 PSYSTEM_PLATFORM_BINARY_INFORMATION � MM_ETW_WORKING_SET_TYPE Q0 EMRCREATEMONOBRUSH ( �5 _LEARNING_MODE_OBJECT_INFORMATION $ M _SharedVirtualDiskSupportType �5 PPPM_WMI_PERF_STATES " �5 LPEVENTLOG_FULL_INFORMATION , _RGNDATA $ 6 _GENERIC_BINDING_ROUTINE_PAIR :* LPEXTLOGPEN32 � AXESLIST �5 TITLEBARINFO 3 LOGFONTA % �5 DISPLAYCONFIG_PATH_SOURCE_INFO ' l _PS_MITIGATION_AUDIT_OPTIONS_MAP . � _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION � UMS_THREAD_INFO_CLASS �) _NT_TIB64 1 KEY_FLAGS_INFORMATION �5 PMESSAGE_TRACE_USER �5 FILE_OBJECTID_BUFFER . �5 PJOURNAL_SET_KEY_USER_FLAGS_INFORMATION �5 _MUILANGCFGLIST 5 PFILE_NAMES_INFORMATION }5 PFILE_RENAME_INFORMATION # � FILE_PIPE_REMOTE_INFORMATION |5 PEXFAT_STATISTICS z5 HEAP_INFORMATION � tagRAWINPUT w5 _SCRUB_PARITY_EXTENT_DATA J. RECTL ' � _THREAD_LAST_SYSCALL_INFORMATION ! q5 _DUPLICATE_EXTENTS_DATA_EX n5 LPCURSORSHAPE k5 PSC_EVENT_TYPE g5 PAPCFUNC d5 LPCLSID ! W _SYSTEM_DEVICE_INFORMATION j tagEMRGDICOMMENT �1 EMRELLIPSE ]5 PWMI_PNP_RECORD_V4 #
) _WMI_IMAGELOAD_INFORMATION64 % [5 PETW_TP_EVENT_CALLBACK_DEQUEUE
t PINT32 + $" IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY * Y5 PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA $ �0 _SYSTEM_HIBERFILE_INFORMATION $ S5 ETW_CLOCK_CONFIGURATION_EVENT b OVERLAPPED_ENTRY * P5 PPERFINFO_EXECUTIVE_RESOURCE_CONFIG L5 PCWNF_STATE_NAME . H5 PSYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 � PHANDLE & E5 WMI_EXTENDED_THREAD_INFORMATION A5 _CI_LOG_SCHEDULER_SLEEP ' ;5 PETW_COVERAGE_SAMPLER_BLOOM_INFO � PS_PROTECTION 85 HSYNTHETICPOINTERDEVICE__ $ D _IMAGE_RUNTIME_FUNCTION_ENTRY $ 45 _QUERY_STORAGE_RESERVE_OUTPUT ) .5 SYSTEM_EXTENDED_THREAD_INFORMATION *5 PENUMLOGFONTEXDV * X3 KNONVOLATILE_CONTEXT_POINTERS_ARM64 # (5 TRANSACTION_BIND_INFORMATION GLOBALHANDLE �! EMRINVERTRGN # �+ PERFINFO_PAGE_RANGE_IDENTITY $ %5 PFILE_COMPRESSION_INFORMATION $ !5 PFILE_ID_BOTH_DIR_INFORMATION 5 SYSTEM_NUMA_INFORMATION % 5 PKEY_CONTROL_FLAGS_INFORMATION @ 5 PCACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA ) 5 USER_MARSHAL_UNMARSHALLING_ROUTINE 5 PPERFINFO_MEM_RESET_INFO 5 PTOKEN_USER_CLAIMS � FIRMWARE_TYPE * �4 PKEY_SET_VIRTUALIZATION_INFORMATION Z% EMRSCALEWINDOWEXTEX �4 PIMAGE_THUNK_DATA ( �4 _LOOKUP_STREAM_FROM_CLUSTER_INPUT * ~* _TRANSACTION_PROPERTIES_INFORMATION 6 ' RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY �4 PCOMPAREITEMSTRUCT �4 tagMSGBOXPARAMSW ) �4 SYSTEM_KERNEL_DEBUGGER_INFORMATION . �4 _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION ! M FILE_IO_PRIORITY_HINT_INFO - �4 PEVENT_TRACE_PROFILE_EVENT_INFORMATION $ �4 _SECURITY_DESCRIPTOR_RELATIVE : �% _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION �4 PFILE_STANDARD_INFO " �4 PCONTAINER_ROOT_INFO_OUTPUT ! �4 PEISA_MEMORY_CONFIGURATION �4 PVALENTA _SE_VALIDATE_MAPPING_TYPE , _$ DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY {- LPNONCLIENTMETRICSW d LUNICODE_STRING $ G2 THREAD_CYCLE_TIME_INFORMATION �4 PCOVERAGE_REQUEST_CODES �4 CALINFO_ENUMPROCEXA " �4 PPROCESSOR_PERFSTATE_POLICY ) �4 _SYSTEM_POWER_STATE_DISABLE_REASON ! �4 LPCREATE_THREAD_DEBUG_INFO �2 MOFRESOURCEINFO 0 HARDWARE_COUNTER_TYPE �4 MSLLHOOKSTRUCT * �4 _FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER �4 PRTL_PROCESS_LOCKS " �4 USER_MARSHAL_SIZING_ROUTINE * y PLUGPLAY_CONTROL_USER_RESPONSE_DATA �4 PPROCESSOR_RECORD # �4 _RTL_USER_PROCESS_PARAMETERS �4 HARDERROR_MSG $ _RTL_RXACT_OPERATION �4 NPWNDCLASSEXW ! �4 PPROCESS_MITIGATION_POLICY �4 LPWNDCLASSA �4 _SERVICE_NOTIFY_1 8 4 PPROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY ' - _FILE_CASE_SENSITIVE_INFORMATION * }4 _TRANSACTIONMANAGER_LOG_INFORMATION DEVMODEA $ y4 _SERVERSILO_BASIC_INFORMATION F SYSTEM_POOLTAG u4 _WNF_TYPE_ID 0 r4 _SYSTEM_VERIFIER_CANCELLATION_INFORMATION " m4 CM_FULL_RESOURCE_DESCRIPTOR j4 LPMENUITEMINFO * h4 _TXFS_LIST_TRANSACTION_LOCKED_FILES d4 tagBITMAPFILEHEADER `4 _ETW_CREATE_HANDLE_EVENT # V ETW_HEAP_EVENT_RUNDOWN_RANGE ]4 PTOKEN_GROUPS [4 _GENERATE_NAME_CONTEXT % U4 _FILE_MAILSLOT_SET_INFORMATION N4 HBITMAP J4 LPDRAWTEXTPARAMS R IMAGE_ROM_OPTIONAL_HEADER 1 E4 PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY & B4 _SYSTEM_DEVICE_DATA_INFORMATION 0 <4 PRTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY �) MAT2 � DLGTEMPLATE 74 LPHKL 8" REGISTERWORD < NDR_RUNDOWN � tagACCEL ) � _PERFINFO_DRIVER_COMPLETIONROUTINE _KSPIN_LOCK_QUEUE
44 TP_JOB 34 PRTL_BARRIER * +4 PMANAGE_WRITES_TO_EXECUTABLE_MEMORY " )4 PSYSTEM_BASIC_INFORMATION64 (4 PICONINFOEX ( $4 PRPC_HTTP_TRANSPORT_CREDENTIALS_A #4 CS_TYPE_NET_SIZE_ROUTINE !4 VIRTUALIZATION_RECORD ' 4 PETW_TRACE_PARTITION_INFORMATION � PMIDL_STUB_MESSAGE ! 4 _HEAP_EXTENDED_INFORMATION o _FILE_COMPRESSION_INFO * 4 RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A 4 PETW_OPTICALIO_READWRITE � PERFINFO_VTL_CHANGE $ 4 ETW_LAST_DROPPED_EVENT_STRUCT ( & _RTL_IMAGE_MITIGATION_ASLR_POLICY q# CONDITION_VARIABLE - �! _WMI_JOB_SEND_NOTIFICATION_INFORMATION . 4 PMEMORY_PHYSICAL_CONTIGUITY_INFORMATION 4 PCORRELATION_VECTOR �) BITMAPV4HEADER 4 EMRPIXELFORMAT ' �3 PPERFINFO_CC_READ_AHEAD_COMPLETE % �3 PERFINFO_CC_LOGGED_STREAM_INFO e PAINTSTRUCT �3 IMAGE_BOUND_FORWARDER_REF " �3 PROCESS_SESSION_INFORMATION �3 _EVENT_FILTER_EVENT_NAME ? _PS_PROTECTED_SIGNER �3 FILE_TRACKING_INFORMATION ' �3 PCI_WINDOWS_LOCKDOWN_RESTRICTION + �3 PREFS_DEALLOCATE_RANGES_INPUT_BUFFER � CLSID �" _MONITOR_DISPLAY_STATE ! �3 _PERFINFO_CC_FLUSH_SECTION # �3 PPERFINFO_DEBUG_EVENT_REASON
TUCHAR �3 PSE_ACCESS_REQUEST 9 LPTITLEBARINFOEX & �3 PERFINFO_PO_SESSION_CALLOUT_RET ( �3 _FILE_REMOTE_PROTOCOL_INFORMATION �3 POINTER_TOUCH_INFO ) �3 PERFINFO_EXECUTIVE_RESOURCE_CONFIG * v% _PERFINFO_SYSTEM_MEMORY_INFORMATION �3 PRTL_HEAP_TAG_INFO ; �3 PRTL_QUERY_DEBUG_VIRTUAL_PROCESS_READ_MEMORY_ROUTINE �3 LPTTPOLYGONHEADER ( D IMAGE_IA64_RUNTIME_FUNCTION_ENTRY ! �3 ETW_DUPLICATE_HANDLE_EVENT $ �3 PETW_UMS_EVENT_CONTEXT_SWITCH �3 PALPC_TOKEN_ATTR �3 _ENABLE_TRACE_PARAMETERS �3 PRTL_BITMAP ! �3 LPSERVICE_PRESHUTDOWN_INFO & �3 ETW_TRACE_PARTITION_INFORMATION �3 _SC_ENUM_TYPE * �3 _FSCTL_QUERY_STORAGE_CLASSES_OUTPUT 0 # SYSTEM_FEATURE_CONFIGURATION_CHANGE_STAMP * %/ _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE �3 PPREFIX_TABLE �3 PPATHNAME_BUFFER SOUNDSENTRYA �3 _SE_AUDIT_INFO ( E, RESOURCEMANAGER_BASIC_INFORMATION �3 HSPRITE �) _PROFILE_SOURCE_INFO # �" _HEAP_AFINITY_MANAGER_ENABLE 3 PHANDLER_ROUTINE ! }3 PHEAP_AFFINITY_SLOT_ASSIGN {3 _MIDL_STUB_MESSAGE + X3 _KNONVOLATILE_CONTEXT_POINTERS_ARM64 ; Q3 PPROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION ( L3 PFILE_FS_FULL_SIZE_INFORMATION_EX D IO_COUNTERS � SERVERSILO_STATE � KINTERRUPT_ROUTINE - I3 _TOKEN_SECURITY_ATTRIBUTES_INFORMATION $ A3 _DEFINE_STORAGE_RESERVE_INPUT 93 PIO_ERROR_LOG_MESSAGE " 73 PIMAGE_DYNAMIC_RELOCATION32 0 33 PSYSTEM_ACTIVITY_MODERATION_USER_SETTINGS )3 PRTL_SRWLOCK % �+ FILE_ATTRIBUTE_TAG_INFORMATION &3 FILE_REGION_OUTPUT �! _CM_VIDEO_DEVICE_DATA "3 PPLUGPLAY_EVENT_CATEGORY 3 LPLOGFONT 3 tagEMRFRAMERGN 3 PCM_PERF_COUNTERS 3 _MEMORY_SCRUB_INFORMATION 3 PFIBER_START_ROUTINE
3 tagRGBTRIPLE
3 PCUCSCHAR 3 IMAGE_AUX_SYMBOL ( �2 _GET_FILTER_FILE_IDENTIFIER_INPUT 4 tagMENUITEMINFOA �2 _RPC_PROTSEQ_ENDPOINT e. LPMOUSEINPUT " � FILE_PIPE_LOCAL_INFORMATION � FILE_GET_EA_INFORMATION ) �2 _FILE_IO_PRIORITY_HINT_INFORMATION & �2 REDIRECTION_FUNCTION_DESCRIPTOR ( �2 PRPC_BINDING_HANDLE_SECURITY_V1_W �2 PCZPCSTR �2 _FINDEX_SEARCH_OPS �2 KLDR_DATA_TABLE_ENTRY64 �2 EISA_IRQ_CONFIGURATION �2 PACL �2 PROPENUMPROCEXW �2 SYSTEM_ALARM_ACE �2 PREAD_USN_JOURNAL_DATA_V0 / �2 PSYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION t CM_RESOURCE_TYPE , �2 PPERFINFO_YIELD_PROCESSOR_INFORMATION ! �2 PSYSTEM_MEMORY_INFORMATION % �2 DISPLAYCONFIG_PATH_TARGET_INFO
" REGSAM . �2 _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER �2 PFILE_STREAM_INFO �2 PWMIREGGUID u uintptr_t �+ _MODEMSETTINGS �2 PPOWER_PLATFORM_ROLE . �2 _FSCTL_GET_INTEGRITY_INFORMATION_BUFFER + �2 _SYSTEM_KERNEL_VA_SHADOW_INFORMATION Q- DEVICE_FLAGS �2 PMOFRESOURCEINFO & � RTL_FEATURE_CONFIGURATION_TABLE 2 METAHEADER {2 tagEMRCREATECOLORSPACE w2 CM_COMPONENT_INFORMATION q2 LPCBT_CREATEWNDW ) o2 PFINDFIRSTACTIVATIONCONTEXTSECTION n2 PDISPLAY_DEVICEA q RPC_WSTR j2 PETW_HEAP_EVENT_ALLOC g2 IMAGE_NT_HEADERS64 `2 PLDR_DATA_TABLE_ENTRY64 [2 PMSG * V2 PFILE_INITIATE_REPAIR_OUTPUT_BUFFER S2 DMA_CONFIGURATION_BYTE1 $ M2 PEVENT_TRACE_BUFFER_CALLBACKA % G2 _THREAD_CYCLE_TIME_INFORMATION �( _TIMER_BASIC_INFORMATION $ C2 _CM_EISA_FUNCTION_INFORMATION 72 PMUICCHEADER 62 PCREDIRECTION_DESCRIPTOR 32 FILE_STANDARD_INFORMATION T. _SI_COPYFILE # CLSN 02 PSID_NAME_USE " .2 _SYSTEM_ERROR_PORT_TIMEOUTS �% WNDCLASSW
q LPWSTR ' FILE_ID_TYPE
*2 CIEXYZ S0 PAXISINFOW # $2 PCONSOLE_READCONSOLE_CONTROL !2 HEAP_RANGE_CREATE 2 CI_LOG_MMCSS_STOP * 2 CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE 2 RETRIEVAL_POINTERS_BUFFER 2 PTP_ALPC_CALLBACK
2 PRTLP_HEAP_TAGGING_INFO 2 PHEAP_RANGE_LOG �# _TOKEN_DEFAULT_DACL ! 2 PWMI_DISKIO_READWRITE_INIT � _PLEX_READ_DATA_REQUEST �1 PWNODE_SINGLE_ITEM #! WMI_JOB_INFORMATION �1 PQUERYACTCTXW_FUNC & l _ETW_THREAD_EVENT_SUBPROCESSTAG u UINT_PTR �1 PCCH 4 �1 PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION ' �1 PSYSTEM_MEMORY_USAGE_INFORMATION ) �1 SECTION_INTERNAL_IMAGE_INFORMATION �1 LPOUTLINETEXTMETRIC / �1 PJOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 �1 PCACHE_DESCRIPTOR �1 _XSAVE_SUPPORTED_CPU �1 PJOB_SET_ARRAY & �1 PETW_WNF_EVENT_NAME_SUB_RUNDOWN & �1 PPROCESS_MITIGATION_ASLR_POLICY
�1 PFP_80 ! �1 _SHRINK_VOLUME_INFORMATION ( �1 _SYSTEM_CODEINTEGRITY_INFORMATION �1 PCIMAGE_THUNK_DATA E& _RTL_HANDLE_TABLE_ENTRY c/ _IMAGE_LINENUMBER � BOOT_ENTROPY_SOURCE_ID �1 LPOSVERSIONINFO � POINTER_TYPE_INFO �1 LPLOGCOLORSPACEW �1 EMRRECTANGLE " �1 _PERFINFO_IDLE_STATE_CHANGE z SYSTEM_POWER_POLICY �! OBJECT_ATTRIBUTES32 �1 PROCESS_TLS_INFORMATION � _FP_IEEE_OPERATION_CODE �1 localeinfo_struct �1 _WINDOWS_OS_OPTIONS �1 WMI_JOB_REMOVE_PROCESS i1 _IMAGE_ENCLAVE_CONFIG32 �1 DLGITEMTEMPLATE �1 EXIT_THREAD_DEBUG_INFO u _PNP_VETO_TYPE $ � _RTL_WORK_ON_BEHALF_TICKET_EX . GLYPHSET �1 PGLYPHMETRICSFLOAT & � PERFINFO_FILEOBJECT_INFORMATION |1 _PERFINFO_CC_READ_AHEAD y1 PTP_POOL s1 PEMRSETMAPPERFLAGS � SERVICE_FAILURE_ACTIONSA p1 tagSTYLEBUFW ( l1 _RPC_HTTP_TRANSPORT_CREDENTIALS_W i1 IMAGE_ENCLAVE_CONFIG e1 _FILE_LEVEL_TRIM_RANGE u SYSTEM_FEATURE_ID _1 LPSTICKYKEYS S( TRACE_GUID_REGISTRATION ]1 PUNICODE_STRING32 $ X PROCESS_DEVICEMAP_INFORMATION * [1 _FILE_VALID_DATA_LENGTH_INFORMATION W1 RTL_BACKOFF ' P1 PRTLP_PROCESS_REFLECTION_CONTEXT � _UNIVERSAL_NAME_INFOA " ! SECURITY_DESCRIPTOR_CONTROL M1 ENHMETARECORD " I1 _FSCTL_OFFLOAD_WRITE_OUTPUT
LPVOID E1 HARDWAREINPUT
B1 PVALUE �. RPC_SECURITY_QOS_V4_W �. PRPC_INTERFACE_GROUP ) ?1 PRTL_PROCESS_MODULE_INFORMATION_EX =1 EXCEPTION_RECORD64 61 PMINMAXINFO 31 HIMCC__ 01 LPWIN32_STREAM_ID # /1 PWMI_IMAGELOAD_INFORMATION32 * '1 PPROCESS_COMMIT_RELEASE_INFORMATION $1 _FILEOFFSET_INFORMATION 1 _KEY_FLAGS_INFORMATION a+ IMAGE_BASE_RELOCATION 1 PWTSSESSION_NOTIFICATION $ 1 PSYSTEM_CALL_TIME_INFORMATION 1 ETW_STACK_CACHING_CONFIG % 1 PFILE_FS_DATA_COPY_INFORMATION ' <- FILE_NOTIFY_EXTENDED_INFORMATION
1 USN_TRACK_MODIFIED_RANGES 1 _DMA_CONFIGURATION_BYTE0 � GUID �0 tagRAWKEYBOARD �0 _IELF_HANDLE NTSTATUS $ �0 PSYSTEM_HIBERFILE_INFORMATION * R _CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG � RAWINPUTDEVICE �0 PCOLORADJUSTMENT �0 LPREGISTERWORD , �0 PTRANSACTIONMANAGER_BASIC_INFORMATION ; RPC_SECURITY_CALLBACK_FN �0 PSTACK_WALK_EVENT_DATA q LPWCH �0 PERFINFO_PROCESS_INSWAP
�0 LPCTCH �0 _SERVICE_TRIGGER ' �0 PPERFINFO_PMC_SAMPLE_INFORMATION * �0 PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO " �0 PPROCESS_WINDOW_INFORMATION �/ JOBOBJECT_WAKE_FILTER �0 PSYSTEM_FLUSH_INFORMATION # �0 _RTL_SEGMENT_HEAP_PARAMETERS �0 PRPC_INTERFACE_TEMPLATEW �0 PIMAGE_OPTIONAL_HEADER � FILE_ACCESS_INFORMATION �0 _ENCLAVE_CREATE_INFO_VBS - �0 PTRANSACTIONMANAGER_OLDEST_INFORMATION �0 I_RpcProxyFilterIfFn 1 �0 _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION - �, RESOURCEMANAGER_COMPLETION_INFORMATION �0 WMI_IMAGEID_INFORMATION & �0 PPERFINFO_PPM_PERF_STATE_CHANGE % M# _QUERY_FILE_LAYOUT_FILTER_TYPE + � _FILE_STORAGE_RESERVE_ID_INFORMATION �0 _ETW_TP_EVENT_POOL_CLOSE / �, JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION ( �0 _WORKER_FACTORY_BASIC_INFORMATION ( �0 FINDFIRSTACTIVATIONCONTEXTSECTION �0 tagEMRSETWORLDTRANSFORM �0 _IMAGE_FILE_HEADER R _SILO_USER_SHARED_DATA �0 PEFI_DRIVER_ENTRY * 0 TRANSACTION_ENLISTMENTS_INFORMATION {0 RTL_TREE_WALK_FUNCTION ~ LPTRIVERTEX ( y0 TXFS_ROLLFORWARD_REDO_INFORMATION + s0 PSYSTEM_WRITE_CONSTRAINT_INFORMATION h0 PPROCESS_HEAP_ENTRY $ & _HEAP_BLOCK_EXTRA_INFORMATION ^0 PPERFINFO_CCSWAP_LITE " Y0 PLPC_UNREGISTER_PROCESS_MSG 4 V0 _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION �, RTL_OSVERSIONINFOEX2W h$ RTL_DISK_SPEED_INFO S0 LPAXISINFOW O0 PEMRCREATEMONOBRUSH $ _RTL_DISK_SPACE_INFO L0 NONCLIENTMETRICSA ' I0 PPERFINFO_SAMPLED_PROFILE_CONFIG E0 POBJECT_TYPE_LIST - C0 PROCESS_MITIGATION_FONT_DISABLE_POLICY & =0 PLUGPLAY_CONTROL_CONFLICT_ENTRY :0 _RTL_STACK_CONTEXT ' 10 SYSTEM_AUDIT_CALLBACK_OBJECT_ACE / � SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION -0 KCRM_TRANSACTION_BLOB )0 _GHOSTED_FILE_EXTENT #0 HMENU
0 LPRECT 0 MUILANGUAGES 0 PICONMETRICSA 0 LPSCROLLBARINFO 0 PWX86THREAD % 0 SYSTEM_PAGEFILE_INFORMATION_EX & 0 BOOT_ENTROPY_SOURCE_RESULT_CODE 0 PRTL_LFG_RNG_STATE , �/ _PERFINFO_YIELD_PROCESSOR_INFORMATION # �/ ETW_TP_EVENT_POOL_TH_MIN_SET ' � FILE_FS_VOLUME_FLAGS_INFORMATION ! �/ PREFS_SMR_VOLUME_GC_ACTION 1 ~ _EVENT_TRACE_LBR_CONFIGURATION_INFORMATION # �/ KEY_OPEN_SUBKEYS_INFORMATION � TP_CALLBACK_ENVIRON_V3 � LPWIN32_FIND_DATAW �/ tagENUMLOGFONTEXDVW # �/ PETW_COVERAGE_SAMPLER_MODULE & � _PROCESS_MEMORY_ALLOCATION_MODE �/ PJOBOBJECT_WAKE_FILTER �/ _EXCEPTION_POINTERS �/ LPANIMATIONINFO ! �/ tagPOINTER_DEVICE_PROPERTY $ �/ PFILE_SFIO_VOLUME_INFORMATION % �/ PSYSTEM_FIRMWARE_TABLE_HANDLER �/ PGDI_TEB_BATCH �/ PVARIABLE_NAME Y. _PHYSICAL_CHANNEL_RUN 8 �/ PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION $ �/ PQUERY_BAD_RANGES_INPUT_RANGE �/ LPDOCINFO �/ PTOKEN_SID_INFORMATION & �/ TOKEN_BNO_ISOLATION_INFORMATION + �/ PPROCESS_HANDLE_SNAPSHOT_INFORMATION * �/ PSET_DAX_ALLOC_ALIGNMENT_HINT_INPUT �/ PSERVICE_NOTIFYW ' �/ _FILE_FS_SECTOR_SIZE_INFORMATION ' �/ PAPPLICATIONLAUNCH_SETTING_VALUE 0 2 _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY F( PMINIMIZEDMETRICS # �/ PREQUEST_OPLOCK_INPUT_BUFFER ) J SYSTEM_PHYSICAL_MEMORY_INFORMATION � QUERY_SERVICE_CONFIGA �/ PETW_SET_TIMER_EVENT # h* _SECTION_IMAGE_INFORMATION32 �/ NCCALCSIZE_PARAMS % �/ PIMAGE_LOAD_CONFIG_DIRECTORY32 �/ PIXELFORMATDESCRIPTOR �/ FONTENUMPROCA �/ EMRSELECTPALETTE ' �/ PEVENT_TRACE_VERSION_INFORMATION �/ PFILE_PREFETCH_EX + �/ DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER % ~/ PERFINFO_SET_DEVICES_STATE_RET $ {/ PRTL_DYNAMIC_HASH_TABLE_ENTRY y/ HSPRITE__ � PUOW ] NUMBERFMT % u/ _FILE_SFIO_RESERVE_INFORMATION % �- _TXFS_WRITE_BACKUP_INFORMATION o/ _CURDIR k/ _PROCESS_ENERGY_VALUES h/ LPPANOSE ^/ PIMAGE_LINENUMBER V/ PINITIAL_TEB S/ USN_RECORD_UNION B$ _TOKEN_TYPE M/ LPENUMTEXTMETRICA " K/ _PERFINFO_SET_DEVICES_STATE 1 � PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY � LDR_RELEASE_ACT_CTX u RTL_AVL_NODE
�+ POINTL # �. SYSTEM_FIRMWARE_TABLE_ACTION & M RTL_SPARSE_BITMAP_CTX_OPERATION '- TPMPARAMS % r% _QUERY_BAD_RANGES_OUTPUT_RANGE G/ tagEMRTRANSPARENTBLT & A/ PETW_AUTOBOOST_NO_ENTRIES_EVENT �& EMRFORMAT � VRF_TRIAGE_CONTEXT </ PEMRSETDIBITSTODEVICE - 9/ _VIRTUALIZATION_INSTANCE_INFO_INPUT_EX 1 6/ PSYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE // PRTL_OSVERSIONINFOW -/ LPUNLOAD_DLL_DEBUG_INFO ,/ PPSFEATURE_CUSTPAPER * */ DISPLAYCONFIG_TARGET_PREFERRED_MODE ) %/ ACCESS_ALLOWED_CALLBACK_OBJECT_ACE + � EVENT_TRACE_PROFILE_LIST_INFORMATION / _SE_SID / PWMI_QUEUE / _FILE_RENAME_INFORMATION / MEMORY_WORKING_SET_BLOCK / HHOOK__ � EMRPOLYLINETO / PERFINFO_TRACE_ENTRY / LPWIN32_FIND_DATA " �. PPERFINFO_MEMORY_NODE_ENTRY �. _FXSAVE_FORMAT PUMS_COMPLETION_LIST ! �. PROCESSOR_PERFSTATE_POLICY " �" SERVICE_PREFERRED_NODE_INFO 8" REGISTERWORDA # �. PACCESS_ALLOWED_CALLBACK_ACE - �. JOBOBJECT_CPU_RATE_CONTROL_INFORMATION * �. _PROCESS_SYSTEM_RESOURCE_MANAGEMENT �. PRPC_SECURITY_QOS_V4_W �. MIDL_METHOD_PROPERTY_MAP , �. SERVICE_CONTROL_STATUS_REASON_PARAMSA - �. PRTL_PROCESS_DLL_NOTIFICATION_FUNCTION
p PTCHAR � __C_ASSERT__ �. RPC_AUTH_KEY_RETRIEVAL_FN # �" SYSTEM_KERNEL_DEBUGGER_FLAGS �. _POWER_MONITOR_INVOCATION % �. _UMS_SYSTEM_THREAD_INFORMATION �. PWMI_PROCESS_INFORMATION , V MEMORY_PARTITION_TRANSFER_INFORMATION �. PPLUGPLAY_CONTROL_CLASS �. _CLASSIC_EVENT_ID % �. MANAGE_HOT_PATCH_QUERY_PATCHES ) �. PSYSTEM_PROCESSOR_IDLE_INFORMATION # �. _WMI_IMAGELOAD_INFORMATION32 3 �. _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION �. PINIT_ONCE � LARGE_INTEGER ) �. _SYSTEM_FIRMWARE_TABLE_INFORMATION + �. PSYSTEM_HYPERVISOR_QUERY_INFORMATION " PROCESS_LDT_SIZE ! �. PTXFS_START_RM_INFORMATION �. PEMRGDICOMMENT # �. PPERFINFO_FILE_OPERATION_END " PUUCSSTR ( . PDPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK � ARM64_RUNTIME_FUNCTION z. PMAXVERSIONTESTED_INFO x. PREASON_CONTEXT ' _RTL_SPLAY_LINKS v. PDEVMODEA 4 t. _FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX $ RTL_RETPOLINE_ROUTINES p. ETW_HEAP_EVENT_REALLOC q PUSHORT z _ACE_HEADER & �, _PLUGPLAY_CONTROL_CONFLICT_LIST 0 j. PACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION e. PMOUSEINPUT � NLSVERSIONINFO a. PPERFINFO_VIRTUAL_ALLOC . \. PPROCESS_DYNAMIC_EH_CONTINUATION_TARGET W. PPHYSICAL_CHANNEL_RUN R. PSI_COPYFILE �( LOGBRUSH O. EMRCREATEBRUSHINDIRECT H. LPRECTL ! F. _ETW_THREAD_SET_NAME_EVENT B. NTFS_EXTENDED_VOLUME_DATA + ?. PFILE_SYSTEM_RECOGNITION_INFORMATION >. PSD_GLOBAL_CHANGE_INPUT <. SERVICE_START_REASON 8. HEAP_RANGE_DESTROY 2. PTHREAD_NAME_INFORMATION /. _DesiredStorageClass CM_INT13_DRIVE_PARAMETER ! +. IMAGE_DYNAMIC_RELOCATION32 (. LPOSVERSIONINFOEXA # PROCESS_INFORMATION_CLASS L! EMRFLATTENPATH ! &. SYSTEM_BASIC_INFORMATION64 � ENUMTEXTMETRIC . #. PETW_COVERAGE_SAMPLER_INFORMATION_CLASS - THREAD_WORKLOAD_CLASS ". PRTL_PROCESS_HEAPS . _ETW_OPTICALIO_READWRITE $ . _SYSTEM_HANDLE_INFORMATION_EX . _WNF_STATE_NAME_LIFETIME . LPCHARSETINFO . LPLOGBRUSH
. pthreadmbcinfo
. _ALPC_HANDLE_ATTR ' Q% ACTIVATION_CONTEXT_ASSEMBLY_DATA �- GENERIC_BINDING_INFO t INT32 �- _PSFEATURE_CUSTPAPER �- RPC_SECURITY_QOS_V4_A # �- _ETW_OPTICALIO_FLUSH_BUFFERS - [& EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 ' �- _CRITICAL_PROCESS_EXCEPTION_DATA �- PRTL_SPLAY_LINKS �- PREGISTERCLASSNAMEW 6 �- RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY J) NPSTYLEBUFA $ �+ PERFINFO_DRIVER_MAJORFUNCTION �- PDEBUG_PRINT_CALLBACK �- PEMRANGLEARC �- PSD_QUERY_STATS_OUTPUT TP_WAIT_RESULT �- UNLOAD_DLL_DEBUG_INFO " �- POPERATION_START_PARAMETERS �- POBJECT_BASIC_INFORMATION �( _PS_PROTECTED_TYPE F �- ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING � _OUTLINETEXTMETRICA $ �- TXFS_WRITE_BACKUP_INFORMATION �- RTL_BALANCED_LINKS �- PCIMAGE_TLS_DIRECTORY " QUERY_STORAGE_RESERVE_INPUT * �- SYSTEM_SYSTEM_PARTITION_INFORMATION / �- _TRANSACTIONMANAGER_RECOVERY_INFORMATION 4 � RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY
HANDLE / �- PRTL_READ_MAPPED_MEMORY_EXCEPTION_FILTER �- PFE_IMPORT_FUNC _TP_TRACE_TYPE �- PSECURITY_ATTRIBUTES # � _TRACE_ENABLE_FLAG_EXTENSION p INT8 �- PDEDUP_FILE_OPERATION �- HGLRC % �- NTFS_FILE_RECORD_OUTPUT_BUFFER �- _KEY_BASIC_INFORMATION �- VM_COUNTERS_EX % �- PPROCESS_WORKING_SET_OPERATION �- HW_PROFILE_INFOA �% LOGCOLORSPACE # �" _SERVICE_PREFERRED_NODE_INFO " �- FILE_LINK_ENTRY_INFORMATION �- PPROCESSOR_IDLE_STATES # 2& RTL_CRITICAL_SECTION_DEBUG64 {- PNONCLIENTMETRICSW x- STARTING_LCN_INPUT_BUFFER u- PEMRPOLYGON p PZZTSTR & p- PCOVERAGE_UNLOADED_MODULE_ENTRY " m- _QUERY_SERVICE_LOCK_STATUSW # ULONGLONG i- MEMORYSTATUSEX $ e- SYSDBG_LIVEDUMP_CONTROL_FLAGS # \- _PROCESSOR_POWER_POLICY_INFO �+ _XSAVE_CET_U_FORMAT PROCESSOR_GROUP_INFO " U- _MEMORY_COMBINE_INFORMATION H- PDEVICE_FLAGS " LPCOLORREF � CODEPAGE_ENUMPROCA F- PENTER_STATE_HANDLER B- PMIDL_STUBLESS_PROXY_INFO @- PZPWSTR ?- PCLUNICODE_STRING __time32_t ( :- PFILE_NOTIFY_EXTENDED_INFORMATION �$ GRADIENT_RECT 4- PQUERY_BAD_RANGES_INPUT & .- PMM_ETW_WORKING_SET_PFN_RUNDOWN ( �' _RPC_BINDING_HANDLE_SECURITY_V1_W . � FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT �' POWER_USER_PRESENCE_TYPE +- _SYSTEM_FLAGS_INFORMATION PSLIST_ENTRY '- tagTPMPARAMS # #- _RTL_SPARSE_BITMAP_PARAMETER (' _RTL_PROCESS_HEAPS - WINDOWPOS % �+ IMAGE_RESOURCE_DIRECTORY_ENTRY - MEMORY_RESERVE_TYPE $ - PO_HIBER_FORCE_DISABLE_REASON �! DOCINFO - �# _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64
- tagEMREXTTEXTOUTA - MOUSEKEYS - _RTL_HEAP_TAG - PTRACE_ENABLE_CONTEXT_EX ' M _RTL_SPARSE_BITMAP_CTX_OPERATION % �, PLUGPLAY_CONTROL_CONFLICT_LIST ! �, _IMAGE_RESOURCE_DATA_ENTRY � _STORAGE_RESERVE_ID �, PDMA_SPEED �, NLSTABLEINFO 0 �, _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION � _FP_IEEE_COMPARE_RESULT :# _FILE_LAYOUT_INFO_ENTRY :# FILE_LAYOUT_INFO_ENTRY �, EX_WNF_CALLBACK �, TP_TASK_CALLBACKS * � PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA "' WMI_DPI_RECORD �, tagEMRANGLEARC �, LPDEBUGHOOKINFO ! # _PROCESS_INFORMATION_CLASS $ �, PSC_NOTIFICATION_REGISTRATION �, _SD_ENUM_SDS_ENTRY �, CM_MONITOR_DEVICE_DATA �, FINDEX_INFO_LEVELS * �( _EVENT_TRACE_TAG_FILTER_INFORMATION �, _ACCESS_ALLOWED_ACE �, PIMAGE_CHPE_RANGE_ENTRY + SERIALKEYSA 3 �, PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 �, CREATE_USN_JOURNAL_DATA �, PREARRANGE_FILE_DATA �, PEISA_PORT_DESCRIPTOR ( �, _SYSTEM_SINGLE_MODULE_INFORMATION . �, PRESOURCEMANAGER_COMPLETION_INFORMATION �, PRTL_OSVERSIONINFOEX2W �' PEMRPOLYLINETO16 �, RECONVERTSTRING �, PETW_LBR_ENTRY $ �, NTFS_FILE_RECORD_INPUT_BUFFER ( �, PTP_CLEANUP_GROUP_CANCEL_CALLBACK * �, PASSEMBLY_FILE_DETAILED_INFORMATION �, PSYSTEMTIME �, PCOVERAGE_MODULES �, MENUITEMTEMPLATE 6 �, JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 �" KEY_FULL_INFORMATION ! �, PIMAGE_COFF_SYMBOLS_HEADER $ �, _FILE_COMPRESSION_INFORMATION $ ~, _REFS_DEALLOCATE_RANGES_RANGE # z, _KEY_HANDLE_TAGS_INFORMATION t, DOCINFOW ' p, _PERFINFO_CC_SCHEDULE_READ_AHEAD j, _IMAGE_HOT_PATCH_HASHES � MFT_ENUM_DATA
e, PLBLOB d, LPCOMMTIMEOUTS b, _DRAWPATRECT ^, _RPC_SID Y, _HEAP_EVENT_RANGE_CREATE 3 S, PTRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT % P, _SYSTEM_ACPI_AUDIT_INFORMATION w& _SL_APPX_CACHE I, _MODEMDEVCAPS % %* _PLUGPLAY_CONTROL_INSTALL_DATA ) E, _RESOURCEMANAGER_BASIC_INFORMATION � RTL_WORK_ON_BEHALF_TICKET B, EDITWORDBREAKPROCW <, PFLOAT128 7, LPSERVICE_TABLE_ENTRYW 3, PETW_TP_EVENT_POOL_CREATE ( 0, RTL_PROCESS_MODULE_INFORMATION_EX *, HCOLORSPACE � RPC_CWSTR PACCESS_TOKEN ', POINTER_DEVICE_TYPE ", PLOGPEN W _TRACE_ENABLE_INFO 4 , _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION , REFS_VOLUME_DATA_BUFFER -
& _SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT , _LDT_INFORMATION ' , _PUBLIC_OBJECT_BASIC_INFORMATION �$ _RTL_UMS_COMPLETION_LIST
, PFILE_MODE_INFORMATION , LPRGNDATA , HDESK__ �+ _POINTL
�$ EMRARC �+ LPENUM_SERVICE_STATUSA �+ SERVICE_NOTIFY �+ PPERFINFO_IPI_SEND_DATA + i' _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A & �+ _FILE_ATTRIBUTE_TAG_INFORMATION % �+ SYSTEM_MEMORY_LIST_INFORMATION �+ _LOAD_DLL_EVENT_DATA �+ PXSAVE_CET_U_FORMAT / �+ PFILE_QUERY_METADATA_OPTIMIZATION_OUTPUT " �+ PENLISTMENT_CRM_INFORMATION �+ PVIRTUAL_STORAGE_TYPE �+ PREPAIR_COPIES_INPUT RpcProxyPerfCounters � EVENT_DATA_DESCRIPTOR $ �+ _PERFINFO_PAGE_RANGE_IDENTITY & �+ PIMAGE_RESOURCE_DIRECTORY_ENTRY �+ PSECURITY_CAPABILITIES �! _LDR_DDAG_NODE t HFILE �+ PCUQUAD �+ PPM_IDLE_STATE_BUCKET_EX ^" WATCHDOG_HANDLER_ACTION + �+ JOURNAL_SET_KEY_SECURITY_INFORMATION , �+ PRTL_USER_PROCESS_EXTENDED_PARAMETERS � UUID O% LPCUWCHAR �* EMRSETICMPROFILEW �+ PFLASHWINFO �+ PCM_PARTIAL_RESOURCE_LIST �! FILE_STREAM_INFORMATION � DPFLTR_TYPE �+ FILETIME & �+ _RTL_SEGMENT_HEAP_MEMORY_SOURCE " �+ _FILE_DIRECTORY_INFORMATION �+ LPMDICREATESTRUCT �+ MODEMSETTINGS �+ REGISTERWORDENUMPROCA % �+ PPERFINFO_DRIVER_MAJORFUNCTION # �+ _MEMORY_PARTITION_PAGE_RANGE |+ _CLIENT_CALL_RETURN x+ MUICCENTRY r+ NPIMEMENUITEMINFO n+ PRTL_OSVERSIONINFOEXW ' k+ _RTL_QUERY_DEBUG_VIRTUAL_PROCESS t LDR_SERVICE_TAG_RECORD _ICONINFO _+ PIMAGE_BASE_RELOCATION �$ PEBS_DS_SAVE_AREA ]+ LPAXESLISTW U+ PMM_ETW_PAGE_INFO_EX J PRIORITY_HINT O+ LPENUMLOGFONTEXA M+ _RTLP_HEAP_TAGGING_INFO 5 C+ PCACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION @+ PCLBLOB $ =+ SYSTEM_PROCESS_CLASSIFICATION % :+ PERFINFO_FILE_SIMPLE_OPERATION ' 4+ PSYSTEM_POOL_ZEROING_INFORMATION &+ PPOWER_REQUEST_CONTEXT #+ IMPORT_OBJECT_HEADER + LPMOUSEHOOKSTRUCT + tagSERIALKEYSA + ETW_REGNOTIF_REGISTER + PGROUP_AFFINITY f _MUISTRINGPOOL + CONNECTDLGSTRUCTW % _EXCEPTION_RECORD + _ETW_SET_TIMER_EVENT
PINT16 . + PROCESS_REVOKE_FILE_HANDLES_INFORMATION �& COPYFILE2_MESSAGE_TYPE " SYSINF_PAGE_COUNT �* LPMDINEXTMENU �* PBSMINFO PORT_MESSAGE �* WAKE_TIMER_INFO �* ENCLAVE_LOAD_INFO_VBS �* tagEMRSETICMPROFILE . �* PTOUCH_HIT_TESTING_PROXIMITY_EVALUATION # TRACEHANDLE �* HIMC � _INTERFACE_TYPE * �* PSYSTEM_FEATURE_CONFIGURATION_QUERY �* RTL_BITMAP 4 �* JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION % �* FSCTL_UNMAP_SPACE_INPUT_BUFFER �* RTL_CIRCULAR_LIST_HEAD �* _RTL_UNLOAD_EVENT_TRACE � TIME_ZONE_INFORMATION . �* SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION �* PMCI_ADDR �* PEMRSETWINDOWORGEX �* VOLUME_REFS_INFO_BUFFER �* PPPM_IDLESTATE_EVENT $ �* PSYSTEM_KERNEL_DEBUGGER_FLAGS - �* MEMORY_PHYSICAL_CONTIGUITY_INFORMATION . �* JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 ) �* _MEMORY_WORKING_SET_EX_INFORMATION �* NPOUTLINETEXTMETRICW �* LPCREATESTRUCTA �* ETW_HEAP_EVENT_CREATE " Q HOT_PATCH_INFORMATION_CLASS ! �* ETW_UMS_EVENT_DISASSOCIATE �* PWOW64_CONTEXT �* PFOCUS_EVENT_RECORD / m' IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER * |* PTRANSACTION_PROPERTIES_INFORMATION v* NPEXTLOGFONTW * q* PSYSTEM_SESSION_PROCESS_INFORMATION _THREAD_INFORMATION_CLASS ' o* PALPC_MESSAGE_HANDLE_INFORMATION & m* _FILE_IO_COMPLETION_INFORMATION # D IMAGE_RUNTIME_FUNCTION_ENTRY # c* PSECTION_IMAGE_INFORMATION32 �# PNEWTEXTMETRICW ^* PKBDLLHOOKSTRUCT \* PEVENT_INSTANCE_INFO X* PRTL_DRIVE_LETTER_CURDIR T* PDRAWITEMSTRUCT Q* tagWNODE_SINGLE_ITEM M* _REPARSE_GUID_DATA_BUFFER " NOTIFICATION_MASK H* CALINFO_ENUMPROCW D* _EVENT_TYPE . B* PEVENT_TRACE_PROFILE_REMOVE_INFORMATION
p _LBLOB @* HEAP_AFFINITY_SLOT_ASSIGN :* NPEXTLOGPEN32 8* DISPLAYCONFIG_PIXELFORMAT ) 2* FILE_PIPE_CLIENT_PROCESS_BUFFER_EX ! � WATCHDOG_INFORMATION_CLASS # �& TRANSACTION_LIST_INFORMATION ! � _FILE_REMOTE_PROTOCOL_INFO .* tagTOUCHINPUT +* PTP_TIMER_CALLBACK $ %* PLUGPLAY_CONTROL_INSTALL_DATA $ � WORKER_FACTORY_CALLBACK_CLASS 3 EMRSETARCDIRECTION !* KEY_EVENT_RECORD * PTP_TIMESTAMP # * _MEMORY_PRIORITY_INFORMATION _COPYFILE2_MESSAGE_ACTION * COPYFILE2_MESSAGE �) _FILE_PIPE_PEEK_BUFFER $ �) PETW_TP_EVENT_CALLBACK_CANCEL 2 ( SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT q& ENCRYPTION_KEY_CTRL_INPUT * �) FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT F _EXCEPTION_DISPOSITION U ACL_INFORMATION_CLASS �) _ENCLAVE_INIT_INFO_VBS , �) PPERFINFO_SAMPLED_PROFILE_INFORMATION �) PPOLYTEXTA �) tagMDICREATESTRUCTA �) _NORM_FORM �) PALPC_MESSAGE_ATTRIBUTES u RTL_RB_NODE �" LPCWPRETSTRUCT �) PENERGY_STATE_DURATION n% CLUSTER_RANGE �) PLUGPLAY_EVENT_BLOCK �) LPBITMAPV4HEADER
�) LPMAT2 �) PWMI_BUFFER_HEADER �) PWMI_UDP �) _FAT_STATISTICS �) PROFILE_SOURCE_INFO �) PACCESS_REASONS ) �) _SE_LEARNING_MODE_USER_OBJECT_DATA ~) PNT_TIB64 |) PPOWER_STATE_HANDLER_TYPE � tagIMEMENUITEMINFOA C FXSAVE_FORMAT_WX86 & E _RTL_RETPOLINE_RELOCATION_INDEX �& LPHELPWININFOW $ v) PPERFINFO_FILE_PATH_OPERATION " s) _SYSTEM_CONSOLE_INFORMATION 3$ LPWGLSWAP � DATEFMT_ENUMPROCA % " JOBOBJECT_IO_ATTRIBUTION_STATS % ( _SYSTEM_GDI_DRIVER_INFORMATION
j) PM128A e) PGESTURECONFIG % b) PERFINFO_PPM_PERF_STATE_CHANGE - ^) SYSTEM_THREAD_CID_PRIORITY_INFORMATION Z) ANSI_STRING32 V) X86_CALL_FRAME P) PPOWER_ACTION_POLICY L) PMULTIKEYHELPW J) PSTYLEBUFA $ D) PPROCESS_HANDLE_TRACING_QUERY � EXCEPTION_LOG_TYPE n% _CLUSTER_RANGE >) ETW_RT_EVENT_LOSS q PUNZWCH % KEY_NODE_INFORMATION ;) _ARM64_NT_CONTEXT # 5) THREAD_PROFILING_INFORMATION # /) _MEMORY_WORKING_SET_EX_BLOCK ) _ETW_WAKE_COUNTER_EVENT : ) PSYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION ) LPMEASUREITEMSTRUCT # ) PWMI_IMAGELOAD_INFORMATION64 ) ETW_SET_MARK_INFORMATION 0 ) EVENT_TRACE_IPT_CONFIGURATION_INFORMATION �( PMOVE_FILE_DATA % �( PJOBOBJECT_WAKE_INFORMATION_V1 # �( SET_PURGE_FAILURE_MODE_INPUT �( _XSAVE_POLICY - �( EVENT_TRACE_POOLTAG_FILTER_INFORMATION |' _OBJECT_ATTRIBUTES �( IMAGE_THUNK_DATA �( PTIMER_BASIC_INFORMATION , �( PPLUGPLAY_CONTROL_RELATED_DEVICE_DATA
! LANGID # �( _SECURITY_QUALITY_OF_SERVICE �( PTRACE_LOGFILE_HEADER32 9 �( PPROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY & l PS_MITIGATION_AUDIT_OPTIONS_MAP ( �( tagACTCTX_SECTION_KEYED_DATA_2600 + �( PETW_UMS_EVENT_DIRECTED_SWITCH_START ! �( _PERFINFO_IPI_RECEIVE_DATA �( SYSTEM_PREFETCH_OPTIONS �( ALPC_SECURITY_ATTR �( PEMRCOLORMATCHTOTARGET �( _WOF_VERSION_INFO �( LPDCB
p PSCHAR ( �( FILE_ID_GLOBAL_TX_DIR_INFORMATION �( _ATOM_INFORMATION_CLASS & �( QUERY_PERFORMANCE_COUNTER_FLAGS % p' PROCESS_MEMORY_EXHAUSTION_TYPE H! tagGCP_RESULTSA 2 �( TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE �( WOF_VERSION_INFO �( PMM_ETW_PAGE_EXTRA_INFO ( NPPATTERN z% ETW_IDEAL_PROCESSOR_EVENT
PINT64 z( PTOKEN_DEVICE_CLAIMS x( APC_CALLBACK_FUNCTION - r( PEVENT_EXTENDED_ITEM_PROCESS_START_KEY ! o( SYSTEM_CPU_SET_INFORMATION & `( SYSTEM_SPECIAL_POOL_INFORMATION \( HELPWININFOA W( RID_DEVICE_INFO S( _TRACE_GUID_REGISTRATION # O( RTL_USER_PROCESS_INFORMATION H( LPCREATESTRUCTW F( LPMINIMIZEDMETRICS D( SCOPE_TABLE <( FILE_INTERNAL_INFORMATION % 6( PSYSTEM_CALL_COUNT_INFORMATION
U PANOSE .( PIMAGE_SECTION_HEADER )( PACCESS_DENIED_OBJECT_ACE " � PROCESS_BASIC_INFORMATION64 &( ARRAY_INFO ( PPO_WAKE_SOURCE_HISTORY $ ( SYSTEM_GDI_DRIVER_INFORMATION ( PUMS_THREAD_INFO_CLASS O% PCWCHAR % ( PDYNAMIC_TIME_ZONE_INFORMATION �% PEMRSCALEWINDOWEXTEX ( _EVENT_INFORMATION_CLASS " ( PSYSTEM_BIGPOOL_INFORMATION 3 ( PSYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT ( MEASUREITEMSTRUCT �' XMIT_ROUTINE_QUINTUPLE �' RTL_BSD_ITEM FXPT2DOT30 �' _MANDATORY_LEVEL �' LPPOINT " �' PWMI_JOB_SET_QUERY_CPU_RATE ( �' PPROCESS_TELEMETRY_ID_INFORMATION 4 �' PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 �' MIDL_SERVER_INFO �' PPS_PROTECTED_SIGNER �' _WOW64_LDT_ENTRY �' PRTL_PERTHREAD_CURDIR �' PCIMAGE_THUNK_DATA64 # �' PTEB_ACTIVE_FRAME_CONTEXT_EX u PUINT �' PEMRPOLYGON16 �' tagGESTUREINFO ' �' RPC_BINDING_HANDLE_SECURITY_V1_W �! RTL_SPARSE_BITMAP_RANGE - � _DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO �' PEMRCREATECOLORSPACEW �' PPOWER_USER_PRESENCE 0 �' PIMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER �' _CM_SERVICE_LOAD_TYPE �' FP_64 # �' _PROCESS_WORKING_SET_CONTROL PACTIVATION_CONTEXT_STACK % 6$ ALPC_PORT_CALLBACK_INFORMATION % �' SYSTEM_VERIFIER_INFORMATION_EX 5 P _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION - �' _PERFINFO_PFMAPPED_SECTION_INFORMATION �' LC_ID |' OBJECT_ATTRIBUTES � _PEBS_DS_SAVE_AREA32 & p' _PROCESS_MEMORY_EXHAUSTION_TYPE w' LPOFSTRUCT t' tagRID_DEVICE_INFO_MOUSE 0 m' _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER * i' RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A e' SYSTEM_NUMA_PROXIMITY_MAP Z' PEMRPOLYTEXTOUTA W' RID_DEVICE_INFO_KEYBOARD S' _USER_MARSHAL_CB F' LPMENUBARINFO # C' _TOKEN_GROUPS_AND_PRIVILEGES � _EISA_DMA_CONFIGURATION 9' LPDISPLAY_DEVICEW 6' SC_STATUS_TYPE 3' NDR_CS_ROUTINES ~ _HEAP_SUBSEGMENT_FREE . � EVENT_TRACE_PROFILE_COUNTER_INFORMATION (' RTL_PROCESS_HEAPS � tagTOGGLEKEYS # � tagINPUT_MESSAGE_DEVICE_TYPE "' _WMI_DPI_RECORD , ' _SYSTEM_HYPERVISOR_DETAIL_INFORMATION ' HSTR J _PRIORITY_HINT Z% EMRSCALEVIEWPORTEXTEX ' PIMAGE_HOT_PATCH_INFO ' NV_MEMORY_RANGE " M _FILE_IO_PRIORITY_HINT_INFO S# SE_IMAGE_SIGNATURE_TYPE ' PICONINFOEXW ! RPC_CLIENT_INTERFACE $ _ACCESS_REASON_TYPE ' PPROCESS_EXCEPTION_PORT �& NPDEVMODE �& CPINFOEXW �& _CONTEXT_CHUNK �& NMHDR �& PHELPWININFOW 8" tagREGISTERWORDA �& SD_GLOBAL_CHANGE_OUTPUT 1 �& PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS �& PCRITICAL_SECTION
" PULONG �& PCONSOLE_FONT_INFO - N _ALPC_PORT_COMPLETION_LIST_INFORMATION - �& TRANSACTIONMANAGER_LOGPATH_INFORMATION l _RTL_RB_TREE " �& PETW_TP_EVENT_CALLBACK_STOP ' � _ETW_SESSION_NOTIFICATION_PACKET # �& PFILE_COMPLETION_INFORMATION $ �& _TRANSACTION_LIST_INFORMATION �& tagEMRSTRETCHDIBITS �& _TRACE_GUID_PROPERTIES " �& IMAGE_LOAD_CONFIG_DIRECTORY ! �& _LINK_TRACKING_INFORMATION �& _COPYFILE2_MESSAGE_TYPE u TOUCH_FLAGS � HEAP_SUBSEGMENT_INIT & " _JOBOBJECT_IO_ATTRIBUTION_STATS . �& PSYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE ) �& _PLUGPLAY_CONTROL_CONFLICT_STRINGS �& tagEMRFORMAT 5 �& LPSERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM �& PTOKEN_MANDATORY_LABEL �& _TRACE_LOGFILE_HEADER32 �& _COUNTER_READING REFS_SMR_VOLUME_GC_ACTION �& _PREFIX_TABLE_ENTRY {& _VM_COUNTERS w& SL_APPX_CACHE ! o& PENCRYPTION_KEY_CTRL_INPUT + v RTLWOW64_CROSSPROCESS_WORK_OPERATION RPC_AUTH_IDENTITY_HANDLE l& _RPC_VERSION h& _RTL_UMS_CONTEXT ]& LPJIT_DEBUG_INFO32 . [& _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 L& PUSN_RECORD_COMMON_HEADER I& SPARSE_OVERALLOCATE_DATA & - _SYSTEM_SYSTEM_DISK_INFORMATION C& PRTL_HANDLE_TABLE_ENTRY # 5& PSYSTEM_VERIFIER_INFORMATION $ 0& PRTL_CRITICAL_SECTION_DEBUG64 �$ CONSOLE_FONT_INFOEX -& SYSTEM_TRACE_HEADER % (& PPERFINFO_PPM_IDLE_STATE_ENTER # %& FILE_ID_FULL_DIR_INFORMATION & _EVENTLOGRECORD ( & PRPC_BINDING_HANDLE_TEMPLATE_V1_A & & ETW_DFSS_RELEASE_THREAD_ON_IDLE ,
& SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT $ & PHEAP_BLOCK_EXTRA_INFORMATION ! & POINTER_BUTTON_CHANGE_TYPE ! & PSEC_WINNT_AUTH_IDENTITY_A & �% EVENT_TRACE_VERSION_INFORMATION �% PICONMETRICS �% COORD ' �% SYSTEM_ALARM_CALLBACK_OBJECT_ACE $ �% COPYFILE2_EXTENDED_PARAMETERS �% LPMENUINFO �% SYSTEM_OBJECT_INFORMATION �% LPLOGCOLORSPACE }" WMI_IMAGEID_INFORMATION32 �% PWNDCLASSW �% tagHELPINFO 6 �% PRTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY # �% QUERY_BAD_RANGES_INPUT_RANGE �% _RTL_RUN_ONCE / �% POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES ) �% PCACTIVATION_CONTEXT_ASSEMBLY_DATA �% _CSV_QUERY_REDIRECT_STATE �% PQUERY_FILE_LAYOUT_INPUT , �% _JOURNAL_SET_DELETE_VALUE_INFORMATION �% PEMRSCALEVIEWPORTEXTEX ) � _SERVICE_REQUIRED_PRIVILEGES_INFOW �% _ALPC_CONTEXT_ATTR * �% PWIM_PROVIDER_SUSPEND_OVERLAY_INPUT " �% _PERFINFO_BATTERY_LIFE_INFO ) �% _SYSTEM_REGISTRY_QUOTA_INFORMATION O% PCNZWCH �% LDR_ENUM_RESOURCE_ENTRY 9 �% SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION �% PTHREAD_ENERGY_VALUES ( �% _TXFS_READ_BACKUP_INFORMATION_OUT �" _PROCESS_HEAP_INFORMATION �% PEMRDELETECOLORSPACE �% ETW_CANCEL_KTIMER2_EVENT + ~% PPROCESS_KEEPALIVE_COUNT_INFORMATION |% NDR_SCONTEXT ! z% _ETW_IDEAL_PROCESSOR_EVENT
u size_t B PCANDIDATEFORM ) v% PERFINFO_SYSTEM_MEMORY_INFORMATION $ r% QUERY_BAD_RANGES_OUTPUT_RANGE l% PCLUSTER_RANGE � IMAGE_MITIGATION_POLICY j% RTLP_EXIT_THREAD g% _STACK_WALK_EVENT_DATA � _ALPC_PORT_ATTRIBUTES a% PWMI_REGISTRY \% PSYSTEM_POOL_ENTRY Z% tagEMRSCALEVIEWPORTEXTEX W% PICONINFO 3 U% _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION ( Q% _ACTIVATION_CONTEXT_ASSEMBLY_DATA ! L% WMI_JOB_SET_QUERY_CPU_RATE ' RTL_SPLAY_LINKS F% NPCOMPOSITIONFORM % D% PLDR_DLL_NOTIFICATION_FUNCTION # >% _ACCESS_ALLOWED_CALLBACK_ACE ! :% UNIQUE_PROCESS_INFORMATION 4% RTLP_START_THREAD +% PPERFINFO_CCSWAP_IDLE # (% _TOKEN_SECURITY_ATTRIBUTE_V1 % PEXCEPTION_RECORD 2 % _MEMORY_PARTITION_CONFIGURATION_INFORMATION % PEMRPIE " % PCM_EXTENDED_PARAMETER_TYPE
% PPVALUEW �! tagEMRINVERTRGN % PKEY_NODE_INFORMATION % LPFNDEVCAPS �$ EMRGLSRECORD % THREAD_UMS_INFORMATION_COMMAND # � TXFS_TRANSACTION_ACTIVE_INFO �$ RTL_UMS_COMPLETION_LIST �$ ENUMRESTYPEPROCA � OUTLINETEXTMETRICA �$ LPMOUSEHOOKSTRUCTEX �$ WNDCLASSEXA �$ provider_info
time_t - �$ _REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER �$ XSTATE_FEATURE ,# _RTL_CRITICAL_SECTION32 �$ LPGRADIENT_RECT # PULONG64 �$ _SE_ACCESS_REQUEST �$ _CONSOLE_FONT_INFOEX + I LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION $ �$ _NDR_CS_SIZE_CONVERT_ROUTINES �$ _RTL_MEMORY_TYPE " �$ _FILE_NUMA_NODE_INFORMATION * h RTL_FEATURE_CONFIGURATION_OPERATION % _MEMORY_COMBINE_INFORMATION_EX % �$ PSERVICE_LAUNCH_PROTECTED_INFO $ �$ PROCESS_ENERGY_TRACKING_STATE + �$ PHEAP_OPTIMIZE_RESOURCES_INFORMATION �$ _HEAP_RANGE_INFORMATION � PABC q _PS_CREATE_INFO ' �$ PFILE_PIPE_CLIENT_PROCESS_BUFFER �$ PDMA_WIDTH � TP_TIMESTAMP �$ _GRADIENT_RECT
�$ EMRPIE + � TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 �$ LPUNIVERSAL_NAME_INFOW ( �$ PETW_COVERAGE_SAMPLER_CREATE_INFO p SCHAR $ PPEBS_DS_SAVE_AREA - ~$ PSYSTEM_CRASH_DUMP_CONFIGURATION_CLASS LONGLONG |$ _ETW_READY_THREAD_EVENT s$ RETRIEVAL_POINTER_COUNT ' o$ _IO_COMPLETION_BASIC_INFORMATION h$ _RTL_DISK_SPEED_INFO b$ PHEAP_SUBSEGMENT_FREE 0 � RTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK a$ PSYNCHRONIZATION_BARRIER K$ PRTL_AVL_TABLE " H$ KEY_VALUE_INFORMATION_CLASS E$ TOKEN_ACCESS_INFORMATION ( � _RTL_FEATURE_VARIANT_PAYLOAD_KIND " error_status_t <$ LPCOMMPROP
:$ EMREOF & 6$ _ALPC_PORT_CALLBACK_INFORMATION 3$ PWGLSWAP 1$ _WMI_DELAY_EXECUTION 1 ~ _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION .$ PREGISTERWORDA $ ,$ _ETW_COVERAGE_SAMPLER_OPTIONS &$ CI_LOG_SCHEDULER_EVENT ! "$ POWER_MONITOR_REQUEST_TYPE $ tagSTYLEBUFA ' $ _ETW_PARTITION_INFO_EXTENSION_V2 $ PRTL_DISK_SPACE_INFO l DEVICE_POWER_STATE $ REG_NOTIFY_INFORMATION $ _RTL_RETPOLINE_ROUTINES " �# PIMAGE_AUX_SYMBOL_TOKEN_DEF �# PDEVICE_POWER_STATE �# PRTL_SPARSE_BITMAP_RUN �# PSIZE $ �# PPERFINFO_PPM_STATE_SELECTION 0 1 SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION �# WOW64_FLOATING_SAVE_AREA $ �# _ETW_TP_EVENT_POOL_TH_MAX_SET ! �# PERFINFO_CC_CAN_WRITE_FAIL �# ETW_UMGL_KEY �# POOLED_USAGE_AND_LIMITS �# PNUMA_NODE_RELATIONSHIP & �# SYSTEM_DPC_BEHAVIOR_INFORMATION � HEAP_REGION_INFORMATION % �# PETW_TP_EVENT_CALLBACK_ENQUEUE �# _FSCTL_UNMAP_SPACE_OUTPUT �# TIMER_INFORMATION_CLASS - �# PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64 � _CM_ROM_BLOCK ! _PROC_THREAD_ATTRIBUTE_NUM �# CURSORINFO �# SERVICE_TIMECHANGE_INFO . � _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS - �# _MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE � TP_LOG_LEVEL �# LPLOCALESIGNATURE � INPUT_MESSAGE_DEVICE_TYPE # PREGHANDLE & �# PETW_THREAD_EVENT_SUBPROCESSTAG �# PUTF8_STRING % �# PDRIVER_VERIFIER_THUNK_ROUTINE � EMRSETWINDOWEXTEX �# TOKEN_DEFAULT_DACL �# WINDOWINFO �# LPENUM_SERVICE_STATUS �# PZPTSTR �# PKSYSTEM_TIME �# LPNEWTEXTMETRICW �# IO_STATUS_BLOCK32 # PTOKEN_ORIGIN � PFORMAT_STRING }# _REPARSE_DATA_BUFFER_EX ( y# PRTL_WALK_IMAGE_POLICIES_CALLBACK � _SYSTEM_BIGPOOL_ENTRY m# PRTL_CONDITION_VARIABLE j# SECURITY_OBJECT_AI_PARAMS $ d# PSTARTING_LCN_INPUT_BUFFER_EX a# SYSDBG_IO_SPACE " � PBY_HANDLE_FILE_INFORMATION ^# PPROCESS_LEAP_SECOND_INFO V# LPVIDEOPARAMETERS H# PWNODE_TOO_SMALL ' B# PJOBOBJECT_BASIC_PROCESS_ID_LIST * =# PPERFINFO_HARDPAGEFAULT_INFORMATION � JIT_DEBUG_INFO 5# PFILE_LAYOUT_INFO_ENTRY t LPINT 2# PROCESSOR_NUMBER *# PRTL_CRITICAL_SECTION32 &# _IO_ERROR_LOG_PACKET * ## PIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY 4 # PSYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION # POBJECT_NAME_INFORMATION $ # _RTL_DYNAMIC_HASH_TABLE_ENTRY - # EVENT_TRACE_PROFILE_REMOVE_INFORMATION � COPYDATASTRUCT # MUICCHEADER 9 # _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION ) # PPERFINFO_DRIVER_MAJORFUNCTION_RET �" WMI_TRACE_PACKET �" PRTL_MODULE_BASIC_INFO �" RPC_SECURITY_QOS_V3_W �" _WMI_BUFFER_HEADER p PSTR " �" TEB_ACTIVE_FRAME_CONTEXT_EX �" PPROCESS_HEAP_INFORMATION
" ETW_PROVIDER_TRAIT_TYPE $ �" PFILTER_BOOT_OPTION_OPERATION 4 u _PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY $ �" LPSERVICE_PREFERRED_NODE_INFO PMOFHANDLE �" SE_SECURITY_DESCRIPTOR / �" JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 ( �" ETW_TP_EVENT_TIMER_CANCEL_NTTIMER �" PMONITOR_DISPLAY_STATE $ �" _SYSTEM_KERNEL_DEBUGGER_FLAGS 2 �" TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION �" NPCWPRETSTRUCT
� CPINFO �" _MEMORY_RANGE_ENTRY �" PBUS_DATA_TYPE �" TOKEN_ORIGIN * v _DIRECTORY_NOTIFY_INFORMATION_CLASS �" CSV_QUERY_MDS_PATH_V2 �" WMI_IMAGEID_INFORMATION64 �" EMRSETMITERLIMIT �" EMREXTSELECTCLIPRGN �" LPNUMBERFMT - � EVENT_TRACE_PROFILE_CONFIG_INFORMATION �" PPOWER_SESSION_TIMEOUTS # �" HEAP_AFFINITY_MANAGER_ENABLE �" PLOGFONTW �" EVENTMSG �" ETW_OBJECT_TYPE_EVENT �" PKEY_FULL_INFORMATION �" _PROCESS_LEAP_SECOND_INFO ! }" _WMI_IMAGEID_INFORMATION32 % � PROCESSOR_PROFILE_CONTROL_AREA 2 MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION ( y" MEMORY_PARTITION_NODE_INFORMATION $ r" PPERFINFO_CC_WORKITEM_ENQUEUE ' o" PERFINFO_CC_EXTRA_WB_THREAD_INFO h" PPERFINFO_CCSWAP_BUFFER a" PISECURITY_DESCRIPTOR [" POINT U" PENUMTEXTMETRICW S" PPROCESS_WAKE_INFORMATION � WMI_PNP_RECORD_V5 " O" PFILE_ALIGNMENT_INFORMATION J" LPACCESSTIMEOUT ( G" _ETW_TIMER_EXPIRATION_START_EVENT u _NT_PRODUCT_TYPE " C" FILE_ALLOCATION_INFORMATION =" PTP_TASK_EXECUTE_CALLBACK ! m _FILE_INFO_BY_HANDLE_CLASS 6" PREGISTERWORD
PLIST_ENTRY ," PPOWER_STATE_HANDLER )" _MOUSE_EVENT_RECORD , "" PIMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY " PPROCESS_LDT_SIZE " " PERFINFO_SYSCALL_ENTER_DATA " _JOB_SET_ARRAY & " PJOBOBJECT_IO_ATTRIBUTION_STATS " _RTL_PERTHREAD_CURDIR " DISPLAY_DEVICE �! CS_TYPE_TO_NETCS_ROUTINE * �! PJOBOBJECT_INTERFERENCE_INFORMATION �! PEMRLINETO �! NPPAINTSTRUCT �! LPICONMETRICS �! PQUERY_FILE_LAYOUT_OUTPUT �! PTIMER_APC_ROUTINE �! HEAP_INFORMATION_CLASS �! HSAVEDUILANGUAGES �! EXFAT_STATISTICS � _BOOT_ENTROPY_SOURCE_ID " STARTUPINFO �! _MIDL_INTERCEPTION_INFO �! PFILE_STREAM_INFORMATION , �! SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS �! PCM_VIDEO_DEVICE_DATA �! _RTL_SPARSE_BITMAP_RANGE �! NLSVERSIONINFOEX , �! WMI_JOB_SEND_NOTIFICATION_INFORMATION & REPARSE_DATA_BUFFER �! LPDOCINFOA ! �! SYSTEM_MANDATORY_LABEL_ACE �! PPOWER_STATE ! � POWER_PLATFORM_INFORMATION �! PPPM_IDLE_ACCOUNTING �! LPSERVICE_DESCRIPTIONW " TRANSACTION_ENLISTMENT_PAIR �! _OBJECT_ATTRIBUTES32 % �! _SYSTEM_FIRMWARE_TABLE_HANDLER �! PEMRINVERTRGN �! EMRPLGBLT * �! _JOBOBJECT_INTERFERENCE_INFORMATION �! PLDR_DDAG_NODE ) �! RTL_ACTIVATION_CONTEXT_STACK_FRAME & |! PFILE_LINKS_FULL_ID_INFORMATION � _RTL_AVL_TREE � EMRSETVIEWPORTEXTEX - z! RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER $ o! FILE_FS_DATA_COPY_INFORMATION k! OFFER_PRIORITY h! _ICONINFOEXA d! MM_ETW_PAGE_EXTRA_INFO * W! PCUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG , U! JOBOBJECT_END_OF_JOB_TIME_INFORMATION C Q! RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED L! EMRSETMETARGN � JIT_DEBUG_INFO64 H! GCP_RESULTSA B! LPHIGHCONTRAST ?! EMRSETBRUSHORGEX <! LPHANDLER_FUNCTION . :! _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID 6! _SID_AND_ATTRIBUTES 4! PCLIENT_ID64 ,! IMEMENUITEMINFOW '! RPC_ANSI_STRING !! PWMI_JOB_INFORMATION ! TRANSACTION_STATE 4 ! PSYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION ! PRPC_CLIENT_INTERFACE
! PERFINFO_FILE_DIRENUM ! _BOOT_ENTRY ! � FILE_FS_DEVICE_INFORMATION ! OSVERSIONINFOA . ! JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 � LPSTARTUPINFOEXW � LPMULTIKEYHELP ! � PERFINFO_CCSWAP_IDLE_SHORT ' � _ALPC_MESSAGE_HANDLE_INFORMATION � LPCMENUINFO # � LPBY_HANDLE_FILE_INFORMATION � _PROCESS_ACTIVITY_TYPE � LPTEXTMETRIC � KLDR_DATA_TABLE_ENTRY ' � _SYSTEM_HOT_PATCH_REGISTRY_VALUE - � TOUCH_HIT_TESTING_PROXIMITY_EVALUATION ( � PLDR_DLL_LOADED_NOTIFICATION_DATA ( � SERVICE_REQUIRED_PRIVILEGES_INFOW # � _ETW_DFSS_START_NEW_INTERVAL < KCONTINUE_TYPE � _SYSTEM_POOL_INFORMATION + � PLUGPLAY_CONTROL_INTERFACE_LIST_DATA & � _PROCESS_POWER_THROTTLING_STATE � PPERFINFO_CCSWAP ( � WIM_PROVIDER_UPDATE_OVERLAY_INPUT � _MUTANT_BASIC_INFORMATION � PEBS_DS_SAVE_AREA64 . � _MEMORY_PARTITION_ATTRIBUTE_INFORMATION - � PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA 4 � ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA � _PROCESS_WAKE_INFORMATION $ � PDELETE_STORAGE_RESERVE_INPUT 0 ~ EVENT_TRACE_LBR_CONFIGURATION_INFORMATION u PSYSTEM_POWER_POLICY p LPSERVICE_FAILURE_ACTIONS & n _FILE_PIPE_DELETE_SYMLINK_INPUT j EMRGDICOMMENT D UTF8_STRING $ i _REQUEST_OPLOCK_OUTPUT_BUFFER f tagMINIMIZEDMETRICS b GESTURENOTIFYSTRUCT _ LPCGUID 7 IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION ^ PSYSTEM_AUDIT_ACE # � FILE_ID_EXTD_DIR_INFORMATION Z LPSERVICE_SID_INFO U PWMI_WAIT_SINGLE # o PERFINFO_MEM_RESET_INFO_TYPE R _CLIENT_ID64 , N ALPC_PORT_COMPLETION_LIST_INFORMATION # J _TXFS_GET_TRANSACTED_VERSION D PSYSTEM_POOLTAG @ COMPUTER_NAME_FORMAT = RPC_HTTP_REDIRECTOR_STAGE " ACCESS_MASK 8 PRKCRM_MARSHAL_HEADER 6 PCZZTSTR / 4 _PROCESS_STACK_ALLOCATION_INFORMATION_EX / _REPAIR_COPIES_INPUT " + _UNICODE_PREFIX_TABLE_ENTRY ' & RTL_IMAGE_MITIGATION_ASLR_POLICY LPSTARTUPINFO / SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE - _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA
HBRUSH _RPC_SECURITY_QOS_V2_W # PQUERY_STORAGE_RESERVE_INPUT > PSINJECTDATA � LPBITMAPCOREHEADER � tagCLIENTCREATESTRUCT � PMUTANT_BASIC_INFORMATION # � SYSTEM_REF_TRACE_INFORMATION � _SCONTEXT_QUEUE � _TIMER_TYPE ! � RPC_HTTP_PROXY_FREE_STRING + � PETW_TP_EVENT_TIMER_EXPIRATION_BEGIN � FILE_MODE_INFORMATION & � PPROCESSOR_PROFILE_CONTROL_AREA � PTIME_ZONE_INFORMATION � SYMBOLIC_LINK_INFO_CLASS * � PROCESS_HANDLE_SNAPSHOT_INFORMATION ' � PETW_COVERAGE_SAMPLER_QUERY_INFO $ � REFS_SMR_VOLUME_GC_PARAMETERS - � SYSTEM_SPECULATION_CONTROL_INFORMATION $ � IO_RESOURCE_REQUIREMENTS_LIST { RTL_TREE_COMPARE_FUNCTION % y _IMAGE_DYNAMIC_RELOCATION32_V2 � TRANSACTION_LIST_ENTRY ' � RTL_STACK_TRACE_DATABASE_CONTROL s PFILE_REGION_INFO p KEY_TRUST_INFORMATION j SERVICE_TRIGGER_INFO b PLUNICODE_STRING _ PROCESSOR_IDLESTATE_INFO " [ _SYSTEM_VA_LIST_INFORMATION : TOKEN_AUDIT_POLICY U PSYSTEM_VA_TYPE ; Q PSYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION L PEMRPOLYPOLYLINE % F PERFINFO_PPM_IDLE_EXIT_LATENCY " B ALPC_PORT_INFORMATION_CLASS ? tagCOLORCORRECTPALETTE ; HANDLETABLE & 4 PPERFINFO_INTERRUPT_INFORMATION 1 1 _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION % - SYSTEM_SYSTEM_DISK_INFORMATION & ) _DEDUP_CHUNK_INFORMATION_HASH32 SHORT * % SYSTEM_BOOT_ENVIRONMENT_INFORMATION 3 _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION � PCRM_PROTOCOL_ID PTRACE_GUID_INFO " PACCESS_DENIED_CALLBACK_ACE MOUSEMOVEPOINT +
PERFINFO_CLOCK_INTERRUPT_INFORMATION � PPORT_MESSAGE ; _TRACE_PROFILE_INTERVAL 3 � _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT � PTP_TASK
� PXFORM . � _MEMORY_PARTITION_NODE_PAGE_INFORMATION � _RTL_TICK_LOCK * � PPERFINFO_FILENAME_SAME_INFORMATION , � PTOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 ' � _JOBOBJECT_ENERGY_TRACKING_STATE � EXPR_EVAL u RTL_BALANCED_NODE # � SYSTEM_PROCESSOR_INFORMATION � ETW_NOTIFICATION_TYPE � CMC_EXCEPTION � BITMAPINFO � _SYSTEM_AUDIT_ACE # � PPROCESS_BASIC_INFORMATION64 � _FILE_LINKS_INFORMATION 8 � PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY � _MIDL_STUB_DESC u ETW_WNF_EVENT_UNSUBSCRIBE r PCACTCTX o _TEB_ACTIVE_FRAME # h SYSTEM_NET_RATE_CONTROL_TYPE Z PRTL_HEAP_ENTRY X PWIN32_FIND_DATA $ V _ETW_HEAP_EVENT_RUNDOWN_RANGE ' R PERFINFO_DPC_ENQUEUE_INFORMATION # L PSERVERSILO_INIT_INFORMATION - I _SYSTEM_PROCESSOR_FEATURES_INFORMATION ! � HEAP_EVENT_COMMIT_DECOMMIT % SECURITY_CONTEXT_TRACKING_MODE $ B PIMAGE_RUNTIME_FUNCTION_ENTRY ? KCONTINUE_ARGUMENT LOCALHANDLE 5 LPAXISINFOA
4 PINPUT 0 PMULTIKEYHELP ( PIMAGE_THUNK_DATA64 � LDR_DDAG_STATE % ENERGY_STATE_DURATION % PMEMORY_COMBINE_INFORMATION_EX & � PCM_PARTIAL_RESOURCE_DESCRIPTOR � PTEXTMETRICA � PEVENT_TRACE_HEADER � ALPC_WORK_ON_BEHALF_ATTR $ � PRTL_WORK_ON_BEHALF_TICKET_EX � _NDR_EXPR_DESC ) � _ETW_COVERAGE_SAMPLER_OPTION_FLAGS / � _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT � tagWNODE_ALL_DATA ; RPC_CLIENT_FREE 1 � _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION . � PPLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA � RPC_IMPORT_CONTEXT_P t PINT_PTR � _FILE_FS_SIZE_INFORMATION ! � REQUEST_RAW_ENCRYPTED_DATA � LPUNIVERSAL_NAME_INFOA ) � PTRACE_PERIODIC_CAPTURE_STATE_INFO � PTRANSACTION_LIST_ENTRY { tagWNODE_SINGLE_INSTANCE � PHEAP_SUBSEGMENT_INIT LPCVOID # � PTRACE_ENABLE_FLAG_EXTENSION % � RTL_PROCESS_MODULE_INFORMATION " _UMS_SCHEDULER_STARTUP_INFO ; � _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION $ � _TXFS_TRANSACTION_ACTIVE_INFO - � _PLUGPLAY_CONTROL_TARGET_RELATION_DATA PLONG64 $ | WIM_PROVIDER_INTEGRITY_STATUS 4 x _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT p LBLOB k _FILEMUIINFO ' e PROCESS_TELEMETRY_ID_INFORMATION # a FILE_STORAGE_TIER_MEDIA_TYPE ! Y PRTL_IMAGE_POLICY_METADATA � PCUCHAR V RAWINPUTDEVICELIST PCSHORT R _VIRTUAL_STORAGE_TYPE N _SD_GLOBAL_CHANGE_INPUT
G VALENT A PETW_OBJECT_HANDLE_EVENT > _PSINJECTDATA : _TOKEN_AUDIT_POLICY 5 _WIN32_STREAM_ID 1 _PERFINFO_DPC_INFORMATION ' + PFILE_CASE_SENSITIVE_INFORMATION 6 HARDERROR_RESPONSE_OPTION ( IRQ_GROUP_POLICY & # PPLUGPLAY_CONTROL_PROPERTY_DATA EMRSELECTCOLORSPACE PIMAGE_COR20_HEADER MEMORYSTATUS PCLUTF8_STRING PCSV_NAMESPACE_INFO
_KHETERO_CPU_POLICY 7 P _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY
_numberfmtW % PPROCESS_HANDLE_TRACING_ENABLE � PCSV_CONTROL_PARAM 7 � PSYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION � tagAXESLISTW HPCON � LDR_SECTION_INFO $ � TRANSACTION_BASIC_INFORMATION � SEC_WINNT_AUTH_IDENTITY_A ! ANSI_STRING64 � PFILE_STAT_LX_INFORMATION � _TRACE_ENABLE_CONTEXT � PSID_AND_ATTRIBUTES_HASH � SPHANDLE � LPENUMTEXTMETRIC I_RPC_HANDLE " � PETW_FINALIZE_KTIMER2_EVENT ! � _PROCESS_BASIC_INFORMATION " � PPOWER_PLATFORM_INFORMATION � PCSCHAR � _FILE_ACCESS_INFORMATION 0 � _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION # � _KEY_WOW64_FLAGS_INFORMATION � _IMAGE_POLICY_ID � EMRPOLYPOLYGON16 * � PSYSTEM_SESSION_BIGPOOL_INFORMATION � _nlsversioninfo p LPTCH ! � PNOTIFY_USER_POWER_SETTING ! � RTL_HEAP_MEMORY_LIMIT_DATA _EVENT_INFO_CLASS # � _PERFINFO_PO_SESSION_CALLOUT � PXSAVE_AREA " � PHEAP_EVENT_COMMIT_DECOMMIT 2 � _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY , � DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO w PENUMLOGFONTEXDVA v PCEVENT_RECORD # u PFILE_MAKE_COMPATIBLE_BUFFER s TRANSACTION_NOTIFICATION o FILE_COMPRESSION_INFO 0 k SYSTEM_FEATURE_CONFIGURATION_UPDATE_ENTRY a _FILE_BASIC_INFO " ] _WMI_JOB_SET_QUERY_NET_RATE Y SYSTEM_TPM_INFORMATION U tagPANOSE ! P PIMAGE_ROM_OPTIONAL_HEADER \ IRQ_PRIORITY G PRKCRM_PROTOCOL_BLOB C _FXSAVE_FORMAT_WX86 9 PTRACE_PROFILE_INTERVAL ) * VIRTUALIZATION_INSTANCE_INFO_INPUT PREPARSE_DATA_BUFFER tagRID_DEVICE_INFO_HID ACL_SIZE_INFORMATION ( 5 RTL_DYNAMIC_HASH_TABLE_ENUMERATOR
REMOTE_PORT_VIEW " REFS_SMR_VOLUME_INFO_OUTPUT � _NETWORK_APP_INSTANCE_EA ! RTL_ATOM - � RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY � PWMI_THREAD_INFORMATION � PLEX_READ_DATA_REQUEST STREAM_INFORMATION_ENTRY � PSYSTEM_BIGPOOL_ENTRY � CM_MCA_POS_DATA / � PACTIVATION_CONTEXT_DETAILED_INFORMATION � PHIBERFILE_BUCKET . � SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX � FILE_STANDARD_INFO � ICMENUMPROCW RPC_CSTR $ � _SYSTEM_FILECACHE_INFORMATION � MSGBOXPARAMSA � system_handle_t " � PRTL_HEAP_MEMORY_LIMIT_INFO � PRTL_RESOURCE � EXTLOGPEN32 � tagSERIALKEYSW ' � IMAGE_LOAD_CONFIG_CODE_INTEGRITY , � JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 � PKLOCK_QUEUE_HANDLE � PXSAVE_VENDOR # � FILTER_BOOT_OPTION_OPERATION ) � PPERFINFO_DRIVER_COMPLETIONROUTINE � PFILE_LINK_INFORMATION u PNP_VETO_TYPE � LPENUMLOGFONTW � LPCPINFO ~ HEAP_SUBSEGMENT_FREE z ACE_HEADER * x PDIRECTORY_NOTIFY_INFORMATION_CLASS s TXFS_MODIFY_RM m PSYSDBG_CONTROL_SPACE , j _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA ' d RTL_QUERY_DEBUG_INFORMATION_INFO $ ` _FILE_TYPE_NOTIFICATION_INPUT + [ _VIRTUALIZATION_INSTANCE_INFO_OUTPUT U PTRACE_ENABLE_INFO & _FILE_LINKS_FULL_ID_INFORMATION R _PERFINFO_CCSWAP C PWMI_SPINLOCK 9 PTITLEBARINFOEX 7 PFILE_STORAGE_TIER_CLASS 0 0 PRTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY , RTL_HASH_TABLE # LPPOINTS " HOOKPROC ' PEVENT_HEADER_EXTENDED_DATA_ITEM IMAGE_COR20_HEADER ARM64_NT_NEON128 $ I_RpcProxyUpdatePerfCounterFn & SYSTEM_SHADOW_STACK_INFORMATION � PRTL_RESOURCE_DEBUG32 � LPDEVMODE ' � __PUBLIC_OBJECT_TYPE_INFORMATION � PWIN32_FIND_DATAW & � THREAD_LAST_SYSCALL_INFORMATION ' � _RTL_FEATURE_CONFIGURATION_TABLE $ � PFILE_PIPE_REMOTE_INFORMATION ! � RTL_CRITICAL_SECTION_DEBUG � PFILE_ID_INFO PEMRSETROP2 + � PFILE_STORAGE_RESERVE_ID_INFORMATION � RTL_TICK_LOCK � COMMTIMEOUTS " � _WNF_STATE_NAME_INFORMATION � PFILE_SEGMENT_ELEMENT ! � _RTL_RESOURCE_POLICY_FLAGS $ � _PS_CPU_QUOTA_SET_INFORMATION � PMFT_ENUM_DATA_V1 6 G MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION � RTL_PROTECTED_ACCESS � PCOPYDATASTRUCT , � PPROCESS_EXTENDED_BASIC_INFORMATION64 ( � PRTL_FEATURE_VARIANT_PAYLOAD_KIND � PRAWINPUT � TOGGLEKEYS y PDESCRIPTOR_TABLE_ENTRY , v JOBOBJECT_LIMIT_VIOLATION_INFORMATION $ r INVERTED_FUNCTION_TABLE_ENTRY n ICONMETRICS + f PSYSTEM_PROCESSOR_POLICY_INFORMATION c _EISA_PORT_DESCRIPTOR ' [ _RTL_STACK_TRACE_DATABASE_CREATE t intptr_t ! U PSYSTEM_DEVICE_INFORMATION # S PHOT_PATCH_INFORMATION_CLASS
N _FIXED C PLAST_EXCEPTION_LOG > CIEXYZTRIPLE 7 PSYSTEM_POWER_INFORMATION 0 LPCMENUITEMINFOA ! ) PLDR_DLL_NOTIFICATION_DATA PSINGLE_LIST_ENTRY ' PSD_ENUM_SDS_INPUT # # PPERFINFO_CC_LAZY_WRITE_SCAN KSPIN_LOCK_QUEUE WOW64_CONTEXT tagAXISINFOW $ � _FILTER_BOOT_OPTION_OPERATION _MEMORYSTATUS
_FIBER � RASTERIZER_STATUS ! � _FILE_QUERY_SPARING_BUFFER � PSHUFFLE_FILE_DATA � HANDLER_FUNCTION � COMPARTMENT_ID � _TOKEN_USER � OSVERSIONINFOEX � PETW_KQUEUE_DEQUEUE_EVENT � _TOKEN_GROUPS / � _EVENT_TRACE_PROFILE_COUNTER_INFORMATION & � PERFINFO_SAMPLED_PROFILE_CONFIG 4 RTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION � DISK_SPACE_INFORMATION & � _LOGICAL_PROCESSOR_RELATIONSHIP 4 � PPERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION ( � ETW_COVERAGE_SAMPLER_OPTION_FLAGS % � PETW_CREATEDELETE_OBJECT_EVENT & � ETW_SESSION_NOTIFICATION_PACKET ( � _FILE_FS_VOLUME_FLAGS_INFORMATION � LPHANDLER_FUNCTION_EX � SECURITY_ATTRIBUTES � POINTER_FEEDBACK_MODE � EVENTSECURITYOPERATION " � PPERFINFO_PROCESS_PERFCTR64 & � _RTL_PROCESS_MODULE_INFORMATION * � PRTL_FEATURE_CONFIGURATION_PRIORITY t INT_PTR . ~ PSYSTEM_CODEINTEGRITYPOLICY_INFORMATION y PPROCESS_DISK_COUNTERS s _TRACE_GUID_INFO $ o _PERFINFO_MEM_RESET_INFO_TYPE � _SERVICE_PRESHUTDOWN_INFO d LPHIGHCONTRASTW a _EFI_DRIVER_ENTRY_LIST % ^ LPENUM_SERVICE_STATUS_PROCESSA \ SE_TOKEN_USER / U _PROCESS_MITIGATION_CHILD_PROCESS_POLICY N _RTL_BARRIER F SERVICE_NOTIFY_2W WMI_PNP_RECORD_V3 = PLOGICAL_DISK_EXTENTS $ 8 PFILE_DISPOSITION_INFORMATION , 5 SYSTEM_ISOLATED_USER_MODE_INFORMATION ! & _SYSTEM_ALARM_CALLBACK_ACE EVENT_INSTANCE_INFO LIST_ENTRY THREAD_UMS_INFORMATION THREAD_INFORMATION_CLASS PCHAR_INFO � PWMI_PAGE_FAULT ' � _CI_LOG_SCHEDULER_SLEEP_RESPONSE � PFILE_GET_EA_INFORMATION � CLIENT_ID % E RTL_RETPOLINE_RELOCATION_INDEX � _SERVICE_FAILURE_ACTIONSA � PWMI_POWER_RECORD " � _ALPC_WORK_ON_BEHALF_TICKET < EMRBITBLT � LPREMOTE_NAME_INFOW � PALPC_PORT_ATTRIBUTES ! � FILE_GET_QUOTA_INFORMATION HALF_PTR u NT_PRODUCT_TYPE ! 0 _MEMORY_REGION_INFORMATION � PHEAP_REGION_INFORMATION � PAXESLIST � PERFINFO_PO_PRESLEEP p PUZZTSTR � PRAWINPUTDEVICE � CURRENCYFMT � PNT_TIB � PRPC_MESSAGE � RPC_EP_INQ_HANDLE > RPC_UNICODE_STRING " � _TXFS_SAVEPOINT_INFORMATION � PFILE_DISPOSITION_INFO_EX � INPUT ! � ACCESS_DENIED_CALLBACK_ACE � _COVERAGE_MODULES � PIMAGE_MITIGATION_POLICY � IMAGE_ARCHITECTURE_ENTRY | PSTREAM_INFORMATION_ENTRY y tagDEBUGHOOKINFO � _PS_PKG_CLAIM 3 u PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY " PTP_MILLISECONDS ( n PHEAP_EVENT_SUBSEGMENT_ALLOC_FREE % l ETW_THREAD_EVENT_SUBPROCESSTAG " h FILE_MAKE_COMPATIBLE_BUFFER a PCACHE_RELATIONSHIP = ^ ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT X LPDELETEITEMSTRUCT q EVENTLOG_HANDLE_W P PSILO_USER_SHARED_DATA 7 E PMEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION ? tagACTCTXA < PRPC_RUNDOWN & 6 _JOURNAL_RENAME_KEY_INFORMATION . tagGLYPHSET � QUERY_SERVICE_CONFIG # PUINT64 % DPI_AWARENESS_CONTEXT__ ! SERVICE_TABLE_ENTRYW
PUCHAR MARK_HANDLE_INFO _CM_KEYBOARD_DEVICE_DATA DEVMODE CWPSTRUCT *
EVENT_TRACE_SPINLOCK_INFORMATION_V1 LPSTARTUPINFOW SOUNDSENTRY ( RTL_PROCESS_BACKTRACE_INFORMATION . � PSECURE_SPECULATION_CONTROL_INFORMATION � LPREGISTERWORDW � _RTL_UMS_SCHEDULER_REASON � LPABC � VERIFIER_MODE � USN_RECORD_EXTENT � PSTREAM_EXTENT_ENTRY � _EXCEPTION_LOG_TYPE * � PPERFINFO_BOOT_PREFETCH_INFORMATION � _WAIT_TYPE ( � PJOBOBJECT_RATE_CONTROL_TOLERANCE # � _SEMAPHORE_INFORMATION_CLASS � WNF_DATA_SCOPE � CALINFO_ENUMPROCA 1 � PJOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL PPOOLINDEX
PKIRQL * � FILE_SYSTEM_RECOGNITION_INFORMATION / � IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA � _DUPLICATE_EXTENTS_DATA * � _SYSTEM_PLATFORM_BINARY_INFORMATION � LPACCEL 7 PCUTSTR " � REQUEST_OPLOCK_INPUT_BUFFER � TRACE_QUERY_INFO_CLASS � GROUP_AFFINITY � _XSAVE_AREA � FILE_ID_128 � JIT_DEBUG_INFO32 EMRSELECTCLIPPATH � EMRPOLYBEZIER � PRAWMOUSE PWMI_PNP_RECORD ) | _RTL_FEATURE_ENABLED_STATE_OPTIONS + s PPLUGPLAY_CONTROL_USER_RESPONSE_DATA � CURRENCYFMTW f PDIBSECTION � _EVENT_FILTER_HEADER & c _MEMORY_WORKING_SET_INFORMATION ] _numberfmtA ! W PSYSTEM_AUDIT_CALLBACK_ACE T _FILE_EA_INFORMATION 5 N PSYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION $ I PTXFS_LIST_TRANSACTIONS_ENTRY D PPROCESSOR_IDLE_TIMES ? PPARSE_MESSAGE_CONTEXT : PEMRBITBLT ! 7 _HEAP_SUBSEGMENT_ACTIVATED 3 RTL_QUERY_REGISTRY_TABLE + _SD_ENUM_SDS_INPUT 7 $ PRTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY / J _ACTIVATION_CONTEXT_DETAILED_INFORMATION PANSI_STRING64 WGLSWAP NPCWPSTRUCT tagCURSORSHAPE _CM_INT13_DRIVE_PARAMETER q FLS_DATA SE_VALIDATE_MAPPING_TYPE � _TP_TASK � PEMRPOLYPOLYGON16 � FILE_REMOTE_PROTOCOL_INFO � PMSGBOXPARAMSA * � PLDR_DLL_UNLOADED_NOTIFICATION_DATA ' � _APPLICATIONLAUNCH_SETTING_VALUE � IMEMENUITEMINFO � RPC_CLIENT_ID � LATENCY_TIME � SERVICE_PRESHUTDOWN_INFO � PINTERFACE_REFERENCE � _COMMPROP � ENUMLOGFONTEXDV , � PROCESS_MITIGATION_POLICY_INFORMATION ~ PTRIVERTEX { WNODE_SINGLE_INSTANCE & t PFILE_REPARSE_POINT_INFORMATION q _FLS_DATA # i REQUEST_OPLOCK_OUTPUT_BUFFER e tagPAINTSTRUCT & ^ PERFINFO_PPM_THERMAL_CONSTRAINT Z MUTANT_OWNER_INFORMATION - T PMEMORY_PARTITION_TRANSFER_INFORMATION Q WMI_FILE_IO * H PSYSTEM_PHYSICAL_MEMORY_INFORMATION & > PRTL_RETPOLINE_RELOCATION_INDEX : REDIRECTION_DESCRIPTOR 1 PEMRSETARCDIRECTION " . _EVENT_INSTANCE_GUID_HEADER $ % PPERFINFO_PPM_IDLE_STATE_EXIT ! TRACE_ENABLE_CONTEXT_EX PPPM_WMI_IDLE_STATES PPROCESSOR_GROUP_INFO # _TRANSACTION_ENLISTMENT_PAIR 8 PIMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION ' PRTLP_UNHANDLED_EXCEPTION_FILTER � PWIN32_FIND_DATAA # � _IMAGE_ARCHIVE_MEMBER_HEADER � PDUPLICATE_EXTENTS_DATA RTL_PATH_TYPE � PRTL_TRACE_ENUMERATE � EDIT_CONTROL_FEATURE � LOAD_ASDATA_TABLE � PCM_ROM_BLOCK " HELPPOLY ! � FILE_FS_VOLUME_INFORMATION " � PFILE_FS_DEVICE_INFORMATION � _ETW_LBR_ENTRY � FP_IEEE_COMPARE_RESULT - � PRTL_FEATURE_USAGE_SUBSCRIPTION_TARGET � SYSTEM_PIXEL_FORMAT � PEBS_DS_SAVE_AREA32 ! � _ETW_DISABLE_KTIMER2_EVENT � PS_PKG_CLAIM p CHAR ! � IMAGE_DELAYLOAD_DESCRIPTOR ( � _RTL_STACK_TRACE_DATABASE_CONTROL � tagTEXTMETRICW � _EVENT_TRACE_HEADER � CM_PERF_COUNTERS % � PROCESS_MEMORY_ALLOCATION_MODE � _ENUM_SERVICE_STATUSW | EVENT_TRACE_PROPERTIES_V2 $ q SYSTEM_RESOURCE_ATTRIBUTE_ACE j LPBITMAPINFOHEADER % g _IMAGE_DYNAMIC_RELOCATION64_V2 ^ LPOVERLAPPED_ENTRY [ SYSGEOTYPE % X _PROCESS_DEVICEMAP_INFORMATION M tagEMRPOLYDRAW C TOKEN_MANDATORY_POLICY < _POWER_IDLE_RESILIENCY 4 PWNODE_EVENT_ITEM . PAPP_MEMORY_INFORMATION % PRESUME_PERFORMANCE PTRACE_LOGFILE_HEADER64 ( PEVENT_TRACE_SPINLOCK_INFORMATION " PPROCESS_HANDLE_INFORMATION ) PFILE_ID_EXTD_BOTH_DIR_INFORMATION _WMI_PNP_RECORD_V3 " PUMS_SCHEDULER_STARTUP_INFO � tagKERNINGPAIR % � _KAFFINITY_ENUMERATION_CONTEXT $ � PFILE_ID_EXTD_DIR_INFORMATION � PPOINTER_TYPE_INFO + � _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W ' � PPERFINFO_FILEOBJECT_INFORMATION SINGLE_LIST_ENTRY � _FILE_STAT_INFORMATION $ � _ACTIVATION_CONTEXT_MSIX_INFO � tagXFORM � PPEBS_DS_SAVE_AREA32 " � KEY_VALUE_LAYER_INFORMATION � MSGBOXPARAMS � _QUERY_SERVICE_CONFIGA � _PROCESSOR_CACHE_TYPE � PEMRSETWINDOWEXTEX � LPCDLGTEMPLATEW ' � PIMAGE_RESOURCE_DIRECTORY_STRING # � PFILE_PIPE_LOCAL_INFORMATION 5 � _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY 6 � PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION ( � SYSTEM_SECURITY_MODEL_INFORMATION � IO_RESOURCE_DESCRIPTOR " H PFILE_IO_PRIORITY_HINT_INFO p LPSTR B NPCANDIDATEFORM I_RPC_MUTEX ' = PLEAP_SECOND_DATA_REGISTRY_ENTRY " : _MEMORY_BASIC_INFORMATION64 $ . PGENERIC_BINDING_ROUTINE_PAIR ) ( _PERFINFO_DRIVER_MAJORFUNCTION_RET D _STRING % ! HEAP_REUSE_THRESHOLD_ACTIVATED CALINFO_ENUMPROCEXW SERVICE_STATUS_HANDLE " ENUM_SERVICE_STATUS_PROCESS PS_ATTRIBUTE_NUM & � _IMAGE_DYNAMIC_RELOCATION_TABLE � _OBJECT_INFORMATION_CLASS � LPENHMETAHEADER & � _USER_MARSHAL_ROUTINE_QUADRUPLE � LPUNIVERSAL_NAME_INFO � PERFINFO_HV_HYPERCALL " TP_MILLISECONDS � WMI_UDP * � _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY � HSM_OPCODE & � PRTL_SPARSE_BITMAP_FREE_ROUTINE � POUTLINETEXTMETRIC � PPS_PROTECTION � _FILESYSTEM_STATISTICS q PRTL_ATOM PEMRSETPOLYFILLMODE � _PERFINFO_VTL_CHANGE � PSET_POWER_SETTING_VALUE � OSVERSIONINFOEXA q PUZZWSTR � _SE_IMPERSONATION_STATE * ~ PSYSTEM_VERIFIER_TRIAGE_INFORMATION { tagMOUSEHOOKSTRUCTEX t _LDR_SERVICE_TAG_RECORD ? o _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY i PMESSAGE_RESOURCE_BLOCK f MUISTRINGPOOL ) ` PFILE_FS_METADATA_SIZE_INFORMATION q PZZWSTR ! X _FSCTL_OFFLOAD_WRITE_INPUT 7 M PRTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY 0 H PCACTIVATION_CONTEXT_DETAILED_INFORMATION D _IO_COUNTERS = SYSTEM_VERIFIER_ISSUE ! 8 RTL_PHYSICAL_MEMORY_POLICY 4 _UNIVERSAL_NAME_INFOW 0 MEMORY_REGION_INFORMATION " # PCOPYFILE2_PROGRESS_ROUTINE PEMRSETMAPMODE ' PFILE_FS_DRIVER_PATH_INFORMATION WOW64_FUNCTION_CODE64 _HEAP_SUBSEGMENT_ALLOC & � _RTL_UMS_SCHEDULER_STARTUP_INFO � _currencyfmtW � EVENT_FILTER_HEADER � EFI_DRIVER_ENTRY , � PEVENT_TRACE_PROFILE_LIST_INFORMATION % � _JOBOBJECT_WAKE_INFORMATION_V1 5 � RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION ) � PFILE_MEMORY_PARTITION_INFORMATION ) � SYSTEM_PLATFORM_BINARY_INFORMATION + � PPLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA � MIDL_FORMAT_STRING q PUHALF_PTR 0 � SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS � PRTL_AVL_NODE � PWMI_JOB_ASSIGN_PROCESS � PEISA_DMA_CONFIGURATION
" PDWORD � TRACE_INFO_CLASS � PMIDL_METHOD_PROPERTY # DWORDLONG � ALPC_TOKEN_ATTR 0 ~ SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION t PMEM_EXTENDED_PARAMETER q PS_CREATE_INFO ) K ASSEMBLY_FILE_DETAILED_INFORMATION G PERFINFO_IPI_SEND_DATA > ENCLAVE_CREATE_INFO_SGX : ENUMRESLANGPROCA ( 0 LPSERVICE_DELAYED_AUTO_START_INFO ' - IMAGE_ARM_RUNTIME_FUNCTION_ENTRY % FILE_LINKS_FULL_ID_INFORMATION
LPLONG _WIN32_MEMORY_RANGE_ENTRY LPMENUTEMPLATEW ICONINFO
HWND__ � � �y��� qtY��-l��|��+!so�$&� ( `���[4dx���By%�Г��� z�&K�-�pW I e��i�45���̯Zo�� ���q�+�<�� l ���{�$��N�� ��~p��o7��T�1*���. � F?�Z#��.Wi�/0��=�� �9*W�-� � O �2
�ש Tg���FF��ݼ�-�BS�� � 5��`&N_� |�<�$���!�O]}��" ��.b��)���]Ý2�tW���Q�*� 3 [��t'Q��A���2��9\���h��fcY�!�?8 \ ������A$խ�0� NG�%+�*�
!7�=b � |�8�>�$�;�@�[VP��sVf*wۭg � �2 Ԃ�sr |R_e(�� V�����z,v�y� � m��] ~_�B �3�쌰��l]��(��Q��@�
.6oA�}4�ؐ,��ǣ�
+h��4�Q�X3� / Ҥ��\��}7 �O~aD��0��-x���x�`<� g ܇h���6
���d3�����:iW�jG^��t� � m����Wc�L����z0� ���ٶ�$< � �G�/�m��hB-����-q�b}��Y�~Y � T�@�
2��U��p�|��� ��k����[p*& � ��z!��<y5�1�aF�=)�;ђ�)Y bčW $ C���4�h��y��t:;K�͑\�Df��1 � G ����̫��2r�WQ��K��TI�Up��/�z l � F9�6K�v�/�|S��]t�RF�W2��I � PH<��R�N�-Ulֵ��S�O�7g�n�䯲*�� � � ]�����W ��}Ν�� �lq����ϋN�Z 3E �� �r`QQ���e��e����`z� i > �.ו+�8W(M��6[���Z\��~���[� d �k@�ʘM� p�?ho�7���Z��� �j�H� � E~/EX"�-�p-���i����`��.�z#�0� � �f�u�Jn\��zx�\�G����q*�V�,� � ��`�\��7A���)����F)J� )��%��7 H�}ӰWU����f1O_�d ��Hf�
��N�nZ @ �O�3tk#�L-�1�
��M �H�sx?�� k p
y��f�9����|= 6���4 ��n`�RM� � M�d�Q�?����:��ޅǧ8�M�%�i_&� � X�Y
��m�kּg�L��~�g���x�5�
� 焙v GI��� ����P�
��W� )\��u��ݡ�_6 mV����*���[�1�l&�! I ��%|�#o5a�0i�^�{�ơz[ l���HR o )G�xS�l�F,�yV���6�}�����ָ@��j � n*�\T�uM�fk �<�t���L�ee�#a�� � ���O.@=4L�C�ي�m�;_�iM %q� � �����y�Q+���{"WÌ�R~̟���H���? � �4y4[G�c �c��e��U�W,Qᨵ7�� �t�T�`���Niu�$�I8FQ@e�}&f�S��E�� ; �D�rlBsm�DE�cQ����}W� �w��±� e N�Q� 4O&K�� +l;x�2�%��ݮ�pZ,� � ��������0TcIC4�U��m��sF'<�Z � �4Y����|��B�N��m#��*�sE��Bp�� � ����o� }�+4qt*Y lռ��́dq�X � �� ��/�5h��d�����,�]0�f& (� , �5�-��MTo>���cߤ�K���� ͏��.~�! P �kE9OӨ��.I F��SY9G&��.��?堳( n �D&<�@)�Z?��as� z�����A��? p� � S���M�"��S��U}h�g�c�q�c5w�k���8 � �.r�� �A6
؇Sz�I��x{_K�<ކ�� � ~��$P �<�tv��AHE/��)�}�yS� , S�O����SXn�� T�F����ZS�kk!m� Y @ȍl2��X�1��}���e��C��>�ȢF)� z �A+��z'����k��mD�XL���t � �YY�c*��}+�;hs�(s��f�i@��n��ܱ� � B-<y�� ��9P/�M�#��_��<�� φ6R^ � �*�����ou��M+K�Ŋ�;��qh�
� �ý3NP� ��eb�nM `I����<�F ;
�:B{m�n=�g���\c*�ӏ���Z" ��Y ]
��3)�J�$��{�.
w ~�/�l���M� �
I�(��+�S�u��]?�z�9NP�3Q�MJ�B �
j�v��b~�ۥ�)0M�/�띡e��� \� @Z �
����ɵ\|5 ��Z��b���Q 3 ���kb���B ����FAP�icû����;�|" B7�㙨^ �9 C ���� k|)�E@���B�#���b�V�<�2Ǡ3 f 3*�ָ䊀��DJ՝�� ��q/�=M�f�t� � � �S:c٭ؙo߮ ���qO>�)o��Z� � ;�]� ��)J��5م��s<`Γ|��� � �m�%:�|l�����h��D�m��-� �[ � OHa]R���s���&���\��:�yE� 0 �-h/� S��~����
a!�1k��j S �N�4�!Z�j��_ƒ���ﳝ3�Hf���e ~ ��ˎ�jy*ƱT1A��`��#^$L �
�Ӭ �c � ��#YV^b%�}��/'p�O�Gʈ?��z��� � �G�jp)X} ��L�{&<ĥ ��) oܽ� � �n�cil�S��8�r%��V�l ��4��q��FT
��V��� Ť��ڃ "��?�f�R�s�[Y�%=� >
4(���+C�h5J$t�J���h 8�ϽgX�� e
�ܟ��-@��Q�ǩ��g:��y���G�J� �
D�n��q���9��a�_�G���H�E���-W��xZ �
�$�����+`�.?�ʿA��=Gݗ��'Lm �
��ꪄ<}��}�^|�{�)D��Xh�;�� @�J���ۊ�މ
��H��s��P��˓YH� - �>� j�t�&~8^�B��J2�/Ru�~ P p�& ;Tt<�ѝ0捶�K߿#56�f� � w ����#��ZF��-�wRϵI
5I�گ�Q�[d � � 8����}ڥ��#�J�7�����"��Ѻ��^� � X�s.��Z���-�Ó��Q�iL0pIH� &��8�i_u& ��>�-Z%�f�>R69ϓ5�%� / %:��qI0fI�J� �ͪ�� �< Q N���NE���\�H3�K4��9�|f�U �Ӹ�r p B��V�v4�'���xܺky�3m�F�k z � *�7�C
TQ�� ?R����֪¸��FHc�� � -�?bF��,U1�.Er;H�Ԡ`p I��4M � _H��i�%0�eTu ˔���3��E�+ �_� ��dk߲#���Jq��x9���iF���>b/���� G } ��da�nGۛ'�*���M���G�]����" m ��܆�f؇��"xU. @����;2}X��}H � ��o�ۗ��.�F��F9�37 ���9�0 �x2� � ���L� ���g�;�[������r���ؓ� ��� � �~����.P�t�OWsP-"�x#N�:�&��� ${E&Cv�wdGa�|}� oj�b�P�<�/ 3 ���r��Axa?E$��N�:���i�ٯa5.�P� W ���巪�� ���0v�};��?$�N�� a � 2��j�/@�R�?�_A��w�?���g�|��*c� � �:��2K] �
j����e�
ʪ�3k�ӭ� � �k�s���ӢC� �S�-z��=<� k�� � �Ѩ��@<���k�x+"7�><n��^� ' �*ʡZ�4��D��?� e�A� fa��A��; I ��@\קĒ��$Ir�͢�)��|�u���� w ˬ6�MDmc�Y � �Z���D�˸J ��2� � �fس!�m���o�0�(P5i�W��x��3� Ob � G�*㥬2����M���}�b�R�̫�)�� � ��(��ڲ�M�<K:��R� �-�`�#��� *s�4��bc�v�7���h\Sř�_s� �4�h� < �*f{�ً��n��2D�x?����s>���%�؞� j y3�
6$��g涧i0����
�E�g$E��$ � ������Q�;�[$��ۅ=@��� �,�� � �J��W6���,�)J dɫ7�%eڭ�� � �����C��ґtE� �W3�ې�����o� � hV
>.r��h�#��Y��e� �y��f:h?� ' 43� $���s`!?GQ61�D�� +�BNk�� Y /��J��5\�Z��_g4�4�%]�L�� ��3h� | �p[F����ll�<��A�=��l}�K���R� � k�3 �G�� ��F2#�)� ER�O|��v\;� � h҄� �3(/�e��f��`�z&�e$P��MD� � �F��B�6�0A��(|� C��F�7 f߹��R�|��ڕ����G/S�6�<��� 6 o�&���-�},��'�w��_�BIS;�§g
�7; [ 0�i�dܾ�[~uz"*���B�:�ٝy�!($� � '�N� 8t����A��d�W�G$���l�0"$�& � �M��wK�58�� �5h2�
/�U���R�:Jf � �Jd��hy��R�*��Ll11�{SI� [ *��Q � K�o��]�R2cj��
��K?C��9s�PH.] ym�Z���y M����w�\lOU��3��)H� P W|A
w�O�?�pU]~-�2�!�\O����5� w �A�T:�U 3�QZ� j-r76y�c~���� � E���ҷ ��;j�A!'���FR5��k �� � ���^br�ee��� ���Nǐ����5�j�Ja � ��*
Y,�}��Ƴ�������X���� �- ��}n�5��L���:I����R��~(�y 0 ��'��,��@H4sS�k�!Ȫ:ݬ���"fE) W �0:s�0pV�eҐ����lj� �6�Ȗ0 � z ƨ��T ��� Ȓ� ���)n���y��aP`I � ��[��P���q�s���k̍�R���`�L � ��a�;.+�!6�%ri� E�Q�p�u�G�g�.� � ����8�����L�v���X m*����I/i��
�U��Q�u"��w�!� �fB"���`ru^���9 4 �*�o�&�\b_-=�-���~���I V��� [ �o ��#�V����|G%D�VH� ,= Q�� � '���8�#�qf �N�g����X���P���� � #^�S� q�9�s"-0#�H��'�N�"Y
�:i � �u�Մ��+�5�5�f �s�a{�:˨���Za
�
���mcJAt�qe�el��]�;�L�� 3 Zڤ�~����̓s���� ��* ���k��)C� \ ��� [r�"��衷� �R ��ҹ�� �� � ����w�^��ȯ�
?���;��f���B(H� � 0T�]�yǥ˘�0�H��I��G(����� � NM�1C����+e#����
�S�x������� � �[��=�
Tǜ�
]����>d��Wƫ��� # �۠�Җ �{���� ���n"]�,$J�� S �[�-%`4�����o2�>�'�q.qg�Gn��) w 5�y�.b�X�W�?�dT�bՃ綕<$QD1��q � ��7 ��������3] ��"F���:�,�U� � ��wkO'�l�5l�c���~|�� ��o�O� � oL>
�P� ��VrɑE.�(�d�jФW��� � onecore\external\sdk\inc\wincontypes.h onecore\external\ddk\inc\ntnls.h onecore\external\sdk\inc\windows.h onecore\internal\sdk\inc\ntconfig.h onecore\external\shared\inc\guiddef.h onecore\admin\wmi\events\idl\elf\objfre\i386\elf.h onecore\external\shared\inc\windef.h onecore\external\shared\inc\rpcndr.h onecore\external\sdk\inc\minwin\jobapi.h onecore\external\shared\inc\minwin\minwindef.h onecore\external\sdk\inc\rpcnsip.h onecore\external\sdk\inc\minwin\threadpoollegacyapiset.h onecore\external\sdk\inc\ntarm64.h onecore\external\sdk\inc\ntarm64_x.h onecore\admin\wmi\events\advapi\objfre\i386\pch_hdr.src onecore\external\ddk\inc\ntimage.h onecore\external\shared\inc\ntstatus.h onecore\internal\sdk\inc\ntwow64.h onecore\internal\sdk\inc\minwin\umstls.h onecore\external\shared\inc\pshpack4.h onecore\internal\sdk\inc\ntkeapi.h onecore\internal\sdk\inc\ntwow64_x.h onecore\external\shared\inc\pshpack2.h onecore\internal\sdk\inc\ntkeapi_x.h onecore\admin\wmi\events\advapi\objfre\i386\precomp.pch onecore\external\sdk\inc\mincore\jobapi2.h onecore\internal\sdk\inc\ntpsapi.h onecore\external\shared\inc\rpcdcep.h onecore\external\sdk\inc\mincore\processtopologyapi.h onecore\internal\sdk\inc\ntpsapi_x.h onecore\external\sdk\inc\rpcnsi.h onecore\external\sdk\inc\mincore\consoleapi3.h onecore\external\sdk\inc\minwin\rtlsupportapi.h onecore\external\sdk\inc\minwin\synchapi.h onecore\external\shared\inc\minwin\apiset.h onecore\external\sdk\inc\minwin\libloaderapi.h onecore\external\shared\inc\minwin\apisetcconv.h onecore\external\sdk\inc\crt\string.h onecore\internal\sdk\inc\minwin\xstateapi.h onecore\internal\sdk\inc\rtlhashdef.h onecore\internal\sdk\inc\minwin\ntpnpapi.h onecore\external\shared\inc\cfg.h shared\inc\winapifamily.h onecore\internal\sdk\inc\ntrtlpath.h onecore\internal\sdk\inc\nxi386.h shared\inc\winpackagefamily.h onecore\external\shared\inc\kernelspecs.h onecore\internal\sdk\inc\warning.h onecore\external\shared\inc\basetsd.h onecore\internal\sdk\inc\suppress_x.h onecore\admin\wmi\events\advapi\precomp.h onecore\external\sdk\inc\minwin\minappmodel.h onecore\external\shared\inc\tvout.h onecore\internal\sdk\inc\nt.h onecore\internal\sdk\inc\rtlfeatureconfigtypes.h onecore\external\sdk\inc\crt\excpt.h onecore\external\sdk\inc\minwin\securityappcontainer.h onecore\external\sdk\inc\minwin\interlockedapi.h onecore\external\sdk\inc\minwin\utilapiset.h onecore\internal\sdk\inc\ntrtl.h onecore\external\sdk\inc\crt\crtdefs.h onecore\external\shared\inc\rpcsal.h onecore\internal\sdk\inc\ntrtl_x.h onecore\external\shared\inc\specstrings.h onecore\external\shared\inc\ip2string.h onecore\external\shared\inc\sal.h onecore\external\shared\inc\concurrencysal.h onecore\external\shared\inc\specstrings_strict.h onecore\external\shared\inc\specstrings_undef.h onecore\external\shared\inc\driverspecs.h onecore\external\shared\inc\sdv_driverspecs.h onecore\internal\sdk\inc\ntexapi.h onecore\external\sdk\inc\crt\vadefs.h onecore\internal\sdk\inc\ntexapi_x.h onecore\external\shared\inc\rpc.h onecore\external\sdk\inc\minwin\realtimeapiset.h onecore\external\sdk\inc\minwin\fibersapi.h onecore\internal\sdk\inc\ntobapi.h onecore\admin\wmi\events\advapi\elfcommn.h onecore\external\shared\inc\rpcdce.h onecore\internal\sdk\inc\ntobapi_x.h onecore\internal\sdk\inc\minwin\ntetw.h onecore\external\sdk\inc\evntcons.h onecore\internal\sdk\inc\minwin\ntioapi.h onecore\external\shared\inc\evntprov.h onecore\admin\wmi\events\idl\imports.h onecore\internal\sdk\inc\nttpapi.h onecore\external\shared\inc\devioctl.h onecore\external\sdk\inc\minwin\ioapiset.h onecore\internal\sdk\inc\minwin\ntioapi_x.h onecore\internal\sdk\inc\ntiolog.h onecore\external\shared\inc\stralign.h onecore\external\sdk\inc\minwin\enclaveapi.h onecore\external\sdk\inc\minwin\threadpoolapiset.h onecore\external\sdk\inc\minwin\processthreadsapi.h onecore\external\sdk\inc\ntassert.h onecore\external\sdk\inc\winsvc.h onecore\external\sdk\inc\mcx.h onecore\external\sdk\inc\minwin\namedpipeapi.h onecore\internal\sdk\inc\minwin\ntregapi.h onecore\internal\sdk\inc\affinity.h onecore\external\sdk\inc\minwin\profileapi.h onecore\external\sdk\inc\minwin\handleapi.h onecore\internal\sdk\inc\ntregapi_x.h onecore\internal\sdk\inc\volatile_accessors.h onecore\external\sdk\inc\wingdi.h onecore\external\sdk\inc\fileapifromapp.h onecore\external\sdk\inc\winver.h onecore\external\sdk\inc\minwin\fileapi.h onecore\external\sdk\inc\winnetwk.h onecore\external\sdk\inc\minwin\verrsrc.h onecore\external\sdk\inc\minwin\consoleapi.h onecore\external\shared\inc\wnnc.h onecore\external\sdk\inc\minwin\apiquery2.h onecore\external\sdk\inc\minwin\heapapi.h onecore\external\sdk\inc\winnls.h onecore\external\sdk\inc\minwin\datetimeapi.h onecore\external\sdk\inc\winbase.h onecore\external\sdk\inc\minwin\processenv.h onecore\external\shared\inc\pshpack8.h onecore\external\sdk\inc\minwin\minwinbase.h onecore\internal\sdk\inc\ntldr.h onecore\external\sdk\inc\minwin\wow64apiset.h onecore\internal\sdk\inc\nturtl.h onecore\external\shared\inc\rpcnterr.h onecore\external\ddk\inc\ntpoapi.h onecore\internal\com\inc\ntrpcp.h onecore\external\sdk\inc\mincore\consoleapi2.h onecore\external\sdk\inc\minwin\securitybaseapi.h onecore\internal\sdk\inc\ntmmapi.h onecore\internal\sdk\inc\nttmapi.h onecore\internal\sdk\inc\ntmmapi_x.h onecore\external\shared\inc\ktmtypes.h onecore\external\shared\inc\evntrace.h onecore\internal\sdk\inc\ntlpcapi.h onecore\internal\sdk\inc\rtlrbtree.h onecore\internal\sdk\inc\minwin\ntwmi.h onecore\external\sdk\inc\minwin\ime_cmodes.h onecore\internal\sdk\inc\minwin\ntwmi_x.h onecore\external\sdk\inc\wmium.h onecore\external\shared\inc\wmistr.h onecore\external\sdk\inc\mincore\namespaceapi.h onecore\external\shared\inc\dpfilter.h onecore\external\ddk\inc\mce.h onecore\external\sdk\inc\minwin\errhandlingapi.h onecore\internal\sdk\inc\pebteb.h onecore\external\shared\inc\sdkddkver.h onecore\external\sdk\inc\imm.h onecore\external\shared\inc\pshpack1.h onecore\internal\sdk\inc\ntseapi.h onecore\internal\sdk\inc\ntseapi_x.h onecore\external\sdk\inc\winuser.h onecore\internal\sdk\inc\ntxcapi.h onecore\internal\sdk\inc\ntxcapi_x.h onecore\internal\sdk\inc\minwin\ntdef_p.h onecore\external\shared\inc\winerror.h onecore\external\sdk\inc\minwin\sysinfoapi.h onecore\external\sdk\inc\minwin\memoryapi.h onecore\external\sdk\inc\minwin\timezoneapi.h onecore\external\sdk\inc\minwin\debugapi.h onecore\external\shared\inc\poppack.h onecore\external\sdk\inc\minwin\winreg.h onecore\external\sdk\inc\crt\stdarg.h onecore\external\shared\inc\minwin\ntdef.h onecore\external\sdk\inc\reason.h onecore\external\sdk\inc\minwin\stringapiset.h onecore\external\sdk\inc\crt\ctype.h onecore\internal\sdk\inc\ntrtlstringandbuffer.h onecore\internal\sdk\inc\ntelfapi.h onecore\internal\sdk\inc\nti386.h onecore\external\sdk\inc\wincon.h onecore\external\sdk\inc\mincore\systemtopologyapi.h onecore\internal\sdk\inc\nti386_x.h � L ^ |� ��
\ \ / / � ' %
> RtlNtPathSeperatorString
� 1 /
> RtlAlternateDosPathSeperatorString
� ) '
> RtlDosPathSeperatorsString
��
�
6 � LIST_ENTRY64 .?AULIST_ENTRY64@@ ��
� "
# Flink
# Blink 6 LIST_ENTRY64 .?AULIST_ENTRY64@@ ��2 onecore\external\shared\inc\minwin\ntdef.h � � 6 � LIST_ENTRY32 .?AULIST_ENTRY32@@ ��
� "
" Flink
" Blink 6 LIST_ENTRY32 .?AULIST_ENTRY32@@ �� �
p ��
� u u
�
q ��
� u u
�
��
�
�
�
��
�
��
�
�
p ��
!
�
p ��
#
�
��
%
�
��
'
�
��
)
�
��
+
�
" p -
.
�
��
0
�
��
2
� $ p 4
5
�
��
7
�
��
9
�
& ;
<
�
! ��
>
� ( @
A
�
! ��
C
�
* E
F
�
" ��
H
� J
K
�
" ��
M
�
, O
P
�
# ��
R
� T
U
�
# ��
W
�
�
Y
� � SE_WS_APPX_SIGNATURE_ORIGIN_NOT_VALIDATED SE_WS_APPX_SIGNATURE_ORIGIN_UNKNOWN �� SE_WS_APPX_SIGNATURE_ORIGIN_APPSTORE � SE_WS_APPX_SIGNATURE_ORIGIN_WINDOWS �� SE_WS_APPX_SIGNATURE_ORIGIN_ENTERPRISE ���N t [ SE_WS_APPX_SIGNATURE_ORIGIN .?AW4SE_WS_APPX_SIGNATURE_ORIGIN@@ �* onecore\internal\sdk\inc\ntseapi.h � \ ] � PS_MITIGATION_OPTION_NX �� PS_MITIGATION_OPTION_SEHOP ��� PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES ��� PS_MITIGATION_OPTION_HEAP_TERMINATE �� PS_MITIGATION_OPTION_BOTTOM_UP_ASLR �� PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR ��� PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE �� PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE � PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE ���
PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD �� PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES PS_MITIGATION_OPTION_FONT_DISABLE
PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL � PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32 �� PS_MITIGATION_OPTION_RETURN_FLOW_GUARD ��� PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY � PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD ��� PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT � PS_MITIGATION_OPTION_ROP_STACKPIVOT �� PS_MITIGATION_OPTION_ROP_CALLER_CHECK PS_MITIGATION_OPTION_ROP_SIMEXEC � PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER ��� PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS �� PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION � PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER ��� PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION � PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION � PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY � PS_MITIGATION_OPTION_CET_USER_SHADOW_STACKS �� PS_MITIGATION_OPTION_USER_CET_SET_CONTEXT_IP_VALIDATION �� ! PS_MITIGATION_OPTION_BLOCK_NON_CET_BINARIES �� $ PS_MITIGATION_OPTION_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY ���B # t _ _PS_MITIGATION_OPTION .?AW4_PS_MITIGATION_OPTION@@ �* onecore\internal\sdk\inc\ntpsapi.h � ` a �
#
� R � _PS_MITIGATION_OPTIONS_MAP .?AU_PS_MITIGATION_OPTIONS_MAP@@ �� # " �
e Map ��R f _PS_MITIGATION_OPTIONS_MAP .?AU_PS_MITIGATION_OPTIONS_MAP@@ �� g a m
d
� ^ � _PS_MITIGATION_AUDIT_OPTIONS_MAP .?AU_PS_MITIGATION_AUDIT_OPTIONS_MAP@@ ��
e Map ��^ k _PS_MITIGATION_AUDIT_OPTIONS_MAP .?AU_PS_MITIGATION_AUDIT_OPTIONS_MAP@@ �� l a �
j
� B � _KUSER_SHARED_DATA .?AU_KUSER_SHARED_DATA@@ ��
o
� 6 � _KSYSTEM_TIME .?AU_KSYSTEM_TIME@@
q �� q " �J NtProductWinNt ��� NtProductLanManNt NtProductServer ��: t t _NT_PRODUCT_TYPE .?AW4_NT_PRODUCT_TYPE@@ ��� u � " � " @ �B StandardDesign ��� NEC98x86 � EndAlternatives ��V t y _ALTERNATIVE_ARCHITECTURE_TYPE .?AW4_ALTERNATIVE_ARCHITECTURE_TYPE@@ ���. onecore\internal\sdk\inc\ntexapi_x.h ��� z { � 2 � _LARGE_INTEGER .?AT_LARGE_INTEGER@@ ��
��
��
��
�� " �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" �� " " � # " � " " � " " � ! " �
# ��F � _XSTATE_CONFIGURATION .?AU_XSTATE_CONFIGURATION@@ B
" TickCountLowDeprecated ���
" TickCountMultiplier ��
r InterruptTime
r SystemTime ���
r TimeZoneBias �
! , ImageNumberLow ���
! . ImageNumberHigh ��
s 0 NtSystemRoot �
" 8MaxStackTraceDepth ���
" <CryptoExponent ���
" @TimeZoneId ���
" DLargePageMinimum �
" HAitSamplingValue �
" LAppCompatFlag
# PRNGSeedVersion ���
" XGlobalValidationRunlevel �
\TimeZoneBiasStamp
" `NtBuildNumber
u dNtProductType
hProductTypeIsValid ���
w iReserved0
! jNativeProcessorArchitecture ��
" lNtMajorVersion ���
" pNtMinorVersion ���
x tProcessorFeatures
" �Reserved1
" �Reserved3
M �TimeSlip �
z �AlternativeArchitecture ��
" �BootId ���
} �SystemExpirationDate �
" �SuiteMask
�KdDebuggerEnabled
�MitigationPolicies ���
~ �NXSupportPolicy ��
�SEHValidationPolicy ��
� �CurDirDevicesSkippedForDlls ��
� �Reserved �
! �CyclesPerYield ���
M �ActiveConsoleId ��
M �DismountCount
" �ComPlusPackage ���
" �LastSystemRITEventTickCount ��
" �NumberOfPhysicalPages
�SafeBootMode �
�VirtualizationFlags ��
� �Reserved12 ���
" �SharedDataFlags ��
� �DbgErrorPortPresent ��
� �DbgElevationEnabled ��
� �DbgVirtEnabled ���
� �DbgInstallerDetectEnabled
� �DbgLkgEnabled
� �DbgDynProcessorEnabled ���
� �DbgConsoleBrokerEnabled ��
� �DbgSecureBootEnabled �
� �DbgMultiSessionSku ���
� �DbgMultiUsersInSessionSku
� �DbgStateSeparationEnabled
� �SpareBits
� �DataFlagsPad �
# �TestRetInstruction ���
QpcFrequency �
" SystemCall ���
" Reserved2
� SystemCallPad
r TickCount
W TickCountQuad
� ReservedTickCountOverlay �
� ,TickCountPad �
" 0Cookie ���
� 4CookiePad
8ConsoleSessionForegroundProcessId
# @TimeUpdateLock ���
# HBaselineSystemTimeQpc
# PBaselineInterruptTimeQpc �
# XQpcSystemTimeIncrement ���
# `QpcInterruptTimeIncrement
hQpcSystemTimeIncrementShift ��
iQpcInterruptTimeIncrementShift ���
! jUnparkedProcessorCount ���
� lEnclaveFeatureMask ���
" |TelemetryCoverageRound ���
� �UserModeGlobalLogger �
" �ImageFileExecutionOptions
" �LangGenerationCount ��
# �Reserved4
� �InterruptTimeBias
� �QpcBias ��
" �ActiveProcessorCount �
7 �ActiveGroupCount �
�Reserved9
! �QpcData ��
7 �QpcBypassEnabled �
�QpcShift �
} �TimeZoneBiasEffectiveStart ���
} �TimeZoneBiasEffectiveEnd �
� �XState ���
q FeatureConfigurationChangeStamp ��
" Spare B d � _KUSER_SHARED_DATA .?AU_KUSER_SHARED_DATA@@ �� � {
I " �
�
� 2 � _ULARGE_INTEGER .?AT_ULARGE_INTEGER@@ *
" LowPart ��
" HighPart �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � J
" LowPart ��
" HighPart �
� u
# QuadPart �2 � _ULARGE_INTEGER .?AT_ULARGE_INTEGER@@ � � *
" LowPart ��
HighPart �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � J
" LowPart ��
HighPart �
� u
QuadPart �2 � _LARGE_INTEGER .?AT_LARGE_INTEGER@@ �� � �
S # �
�
�
�
� # �
�
� J � _TP_CALLBACK_ENVIRON_V3 .?AU_TP_CALLBACK_ENVIRON_V3@@
�
� . � _TP_POOL .?AU_TP_POOL@@ ��
�
� > � _TP_CLEANUP_GROUP .?AU_TP_CLEANUP_GROUP@@
�
� �
�
� B � _ACTIVATION_CONTEXT .?AU_ACTIVATION_CONTEXT@@
�
� F � _TP_CALLBACK_INSTANCE .?AU_TP_CALLBACK_INSTANCE@@
�
� � �
�
�
" ��
" ��
" ��F
� LongFunction �
� Persistent ���
� Private ��: � <anonymous-tag> .?AU<anonymous-tag>@@ * onecore\internal\sdk\inc\nttpapi.h � � � !
" Flags
� s 2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � � TP_CALLBACK_PRIORITY_HIGH TP_CALLBACK_PRIORITY_NORMAL �� TP_CALLBACK_PRIORITY_LOW � TP_CALLBACK_PRIORITY_INVALID � TP_CALLBACK_PRIORITY_COUNT ���B t � _TP_CALLBACK_PRIORITY .?AW4_TP_CALLBACK_PRIORITY@@ � � � J �
" Version ��
� Pool �
� CleanupGroup �
� CleanupGroupCancelCallback ���
RaceDll ��
� ActivationContext
� FinalizationCallback �
� u
� CallbackPriority �
" $ Size �J
� ( _TP_CALLBACK_ENVIRON_V3 .?AU_TP_CALLBACK_ENVIRON_V3@@ � �
�
�
�
�
�
�
�
�
�
�
�
� & � _TEB .?AU_TEB@@ ��
�
� * � _NT_TIB .?AU_NT_TIB@@ 2 � _CLIENT_ID .?AU_CLIENT_ID@@ ��& � _PEB .?AU_PEB@@ ��
�
� " " h � " " � " @ � " h � p "
�N � _ACTIVATION_CONTEXT_STACK .?AU_ACTIVATION_CONTEXT_STACK@@ " �
�
� " �: � _GDI_TEB_BATCH .?AU_GDI_TEB_BATCH@@ �� " " � � " � � " " t �: � _UNICODE_STRING .?AU_UNICODE_STRING@@ q "
� " �2 � _LIST_ENTRY .?AU_LIST_ENTRY@@ " � " $ �& � _GUID .?AU_GUID@@ > � _PROCESSOR_NUMBER .?AU_PROCESSOR_NUMBER@@
� > � _TEB_ACTIVE_FRAME .?AU_TEB_ACTIVE_FRAME@@
�
�
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��
! ���
� NtTib
EnvironmentPointer ���
� ClientId �
( ActiveRpcHandle ��
, ThreadLocalStoragePointer
� 0 ProcessEnvironmentBlock ��
" 4 LastErrorValue ���
" 8 CountOfOwnedCriticalSections �
< CsrClientThread ��
@ Win32ThreadInfo ��
� D User32Reserved ���
� � UserReserved �
� WOW32Reserved
" � CurrentLocale
" � FpSoftwareStatusRegister �
� � ReservedForDebuggerInstrumentation ���
� SystemReserved1 ��
p tPlaceholderCompatibilityMode �
uPlaceholderHydrationAlwaysExplicit ���
� vPlaceholderReserved ��
" �ProxiedProcessId �
� �_ActivationStack �
� �WorkingOnBehalfTicket
�ExceptionCode
� �ActivationContextStackPointer
" �InstrumentationCallbackSp
" �InstrumentationCallbackPreviousPc
" �InstrumentationCallbackPreviousSp
�InstrumentationCallbackDisabled ��
� �SpareBytes ���
" �TxFsContext ��
� �GdiTebBatch ��
� �RealClientId �
�GdiCachedProcessHandle ���
" �GdiClientPID �
" �GdiClientTID �
�GdiThreadLocalInfo ���
� �Win32ClientInfo ��
� �glDispatchTable ��
� h glReserved1 ��
� glReserved2 ��
� glSectionInfo
� glSection
� glTable ��
� glCurrentRC ��
� glContext
" � LastStatusValue ��
� � StaticUnicodeString ��
� StaticUnicodeBuffer ��
DeallocationStack
� TlsSlots �
� TlsLinks �
Vdm ��
ReservedForNtRpc �
� DbgSsReserved
" (HardErrorMode
� ,Instrumentation ��
� PActivityId ���
`SubProcessTag
dPerflibData ��
hEtwTraceData �
lWinSockData ��
" pGdiBatchCount
� tCurrentIdealProcessor
" tIdealProcessorValue ��
tReservedPad0 �
uReservedPad1 �
vReservedPad2 �
wIdealProcessor ���
" xGuaranteedStackBytes �
|ReservedForPerf ��
�ReservedForOle ���
" �WaitingOnLoaderLock ��
�SavedPriorityState ���
" �ReservedForCodeCoverage ��
�ThreadPoolData ���
� �TlsExpansionSlots
" �MuiGeneration
" �IsImpersonating ��
�NlsCache �
�pShimData
" �HeapData �
�CurrentTransactionHandle �
� �ActiveFrame ��
�FlsData ��
�PreferredLanguages ���
�UserPrefLanguages
�MergedPrefLanguages ��
" �MuiImpersonation �
C �CrossTebFlags
� �SpareCrossTebBits
! �SameTebFlags �
� �SafeThunkCall
� �InDebugPrint �
� �HasFiberData �
� �SkipThreadAttach �
� �WerInShipAssertCode ��
� �RanProcessInit ���
� �ClonedThread �
� �SuppressDebugMsg �
� �DisableUserStackWalk �
� �RtlExceptionAttached �
� �InitialThread
�SessionAware �
�LoadOwner
�LoaderWorker �
�SkipLoaderInit ���
�SpareSameTebBits �
�TxnScopeEnterCallback
�TxnScopeExitCallback �
�TxnScopeContext ��
" �LockCount
�WowTebOffset �
�ResourceRetValue �
�ReservedForWdf ���
# �ReservedForCrt ���
� �EffectiveContainerId �& u _TEB .?AU_TEB@@ ��* onecore\internal\sdk\inc\pebteb.h �� �
�
�
�
� "
Flink
Blink 2 _LIST_ENTRY .?AU_LIST_ENTRY@@ Y
�
� ��
�
�
�
�
"
�
�
� B � _SINGLE_LIST_ENTRY .?AU_SINGLE_LIST_ENTRY@@ ��
�
�
Next �B _SINGLE_LIST_ENTRY .?AU_SINGLE_LIST_ENTRY@@ �� c
� > � _RTL_SPLAY_LINKS .?AU_RTL_SPLAY_LINKS@@ ��
#
�
#
� B
% Parent ���
% LeftChild
% RightChild ���> & _RTL_SPLAY_LINKS .?AU_RTL_SPLAY_LINKS@@ ��* onecore\internal\sdk\inc\ntrtl_x.h � ' ( x
%
� Z � _RTL_DYNAMIC_HASH_TABLE_CONTEXT .?AU_RTL_DYNAMIC_HASH_TABLE_CONTEXT@@
+
� B
ChainHead
PrevLinkage ��
" Signature Z - _RTL_DYNAMIC_HASH_TABLE_CONTEXT .?AU_RTL_DYNAMIC_HASH_TABLE_CONTEXT@@ . ( ,
� b � _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR .?AU_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR@@ ��
1
� V � _RTL_DYNAMIC_HASH_TABLE_ENTRY .?AU_RTL_DYNAMIC_HASH_TABLE_ENTRY@@ V
3 HashEntry
CurEntry �
ChainHead
" BucketIndex ��b 4 _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR .?AU_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR@@ �� 5 ( 2 J � _RTL_DYNAMIC_HASH_TABLE .?AU_RTL_DYNAMIC_HASH_TABLE@@
7
� �
" Flags
" Shift
" TableSize
" Pivot
" DivisorMask ��
" NumEntries ���
" NonEmptyBuckets ��
" NumEnumerators ���
Directory J 9 $ _RTL_DYNAMIC_HASH_TABLE .?AU_RTL_DYNAMIC_HASH_TABLE@@ : ( ;
�
� B
! Length ���
! MaximumLength
q Buffer ���: = _UNICODE_STRING .?AU_UNICODE_STRING@@ >
q
� * � _STRING .?AU_STRING@@
A
� B
! Length ���
! MaximumLength
p Buffer ���* C _STRING .?AU_STRING@@ D �
p
�
p ��
G
� & � _LUID .?AU_LUID@@ *
" LowPart ��
HighPart �& J _LUID .?AU_LUID@@ K � b � _CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG .?AU_CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG@@
M
�
q ��
O
� &
" Size �
P TriggerId b Q _CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG .?AU_CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG@@ R ( &
P
� > � _IMAGE_NT_HEADERS .?AU_IMAGE_NT_HEADERS@@
U
� B � _IMAGE_FILE_HEADER .?AU_IMAGE_FILE_HEADER@@ ��J � _IMAGE_OPTIONAL_HEADER .?AU_IMAGE_OPTIONAL_HEADER@@ ��J
" Signature
W FileHeader ���
X OptionalHeader ���> Y � _IMAGE_NT_HEADERS .?AU_IMAGE_NT_HEADERS@@ * onecore\external\ddk\inc\ntimage.h � Z [ | > � _IMAGE_DOS_HEADER .?AU_IMAGE_DOS_HEADER@@
]
� ! " � ! " �n
! e_magic ��
! e_cblp ���
! e_cp �
! e_crlc ���
! e_cparhdr
!
e_minalloc ���
! e_maxalloc ���
! e_ss �
! e_sp �
! e_csum ���
! e_ip �
! e_cs �
! e_lfarlc �
! e_ovno ���
_ e_res
! $ e_oemid ��
! & e_oeminfo
` ( e_res2 ���
< e_lfanew �> a @ _IMAGE_DOS_HEADER .?AU_IMAGE_DOS_HEADER@@ b [ E ! " � ! " �6 � _RTL_RB_TREE .?AU_RTL_RB_TREE@@ ��
f
� B � _RTL_BALANCED_NODE .?AU_RTL_BALANCED_NODE@@ ��
h
�
��6
i Root �
j Encoded ��
i Min ��6 k _RTL_RB_TREE .?AU_RTL_RB_TREE@@ ��. onecore\internal\sdk\inc\rtlrbtree.h ��� l m ,
i
�
h
� p " �
��
��r
q Children �
p Left �
p Right
r Red ��
s Balance ��
" ParentValue ��B t _RTL_BALANCED_NODE .?AU_RTL_BALANCED_NODE@@ �� u r
h
� w x
y
�
p
� i i " i |
}
�
h
� i �
�
� � " �
�
� i �
�
� � " �
�
� � " �
�
� � " �
�
� " �
�
� � " �
�
� g " �
�
�
g i �
�
� g i i �
�
� 6 � _RTL_AVL_TREE .?AU_RTL_AVL_TREE@@
�
�
h
�
� Root �6 � _RTL_AVL_TREE .?AU_RTL_AVL_TREE@@ � m 6
�
� � �
�
�
� �
�
� � �
�
� � �
�
� � � � �
�
�
�
� " �B
" Data1
! Data2
! Data3
� Data4 & � _GUID .?AU_GUID@@ . onecore\external\shared\inc\guiddef.h �� � �
� & # " " " " �
�
�
� �
�
� � � �
�
� � � � �
�
� � �
�
� � � �
�
�
O
� J � _EVENT_DATA_DESCRIPTOR .?AU_EVENT_DATA_DESCRIPTOR@@ ��
�
� n
# Ptr ��
" Size �
" Reserved �
Type �
Reserved1
! Reserved2 J � _EVENT_DATA_DESCRIPTOR .?AU_EVENT_DATA_DESCRIPTOR@@ ��. onecore\external\shared\inc\evntprov.h � � � � > � _EVENT_DESCRIPTOR .?AU_EVENT_DESCRIPTOR@@
�
� �
! Id ���
Version ��
Channel ��
Level
Opcode ���
! Task �
# Keyword ��> � _EVENT_DESCRIPTOR .?AU_EVENT_DESCRIPTOR@@ � � �
� ��
�
�
! ��
�
�
��
�
�
# ��
�
� 6 � _EVENT_RECORD .?AU_EVENT_RECORD@@
� ��
�
� 6 � _EVENT_HEADER .?AU_EVENT_HEADER@@ B � _ETW_BUFFER_CONTEXT .?AU_ETW_BUFFER_CONTEXT@@ ^ � _EVENT_HEADER_EXTENDED_DATA_ITEM .?AU_EVENT_HEADER_EXTENDED_DATA_ITEM@@ ��
�
� �
� EventHeader ��
� P BufferContext
! T ExtendedDataCount
! V UserDataLength ���
� X ExtendedData �
\ UserData �
` UserContext ��6 � h _EVENT_RECORD .?AU_EVENT_RECORD@@ * onecore\external\sdk\inc\evntcons.h � � �
p ��
�
� B � _PERFINFO_GROUPMASK .?AU_PERFINFO_GROUPMASK@@
�
� " " �
� Masks B � _PERFINFO_GROUPMASK .?AU_PERFINFO_GROUPMASK@@ . onecore\internal\sdk\inc\minwin\ntwmi.h � � �
"
�
�
� # # # �
�
�
� ��
�
� p " �� ProcThreadAttributeParentProcess � ProcThreadAttributeHandleList ProcThreadAttributeGroupAffinity � ProcThreadAttributePreferredNode � ProcThreadAttributeIdealProcessor ProcThreadAttributeUmsThread � ProcThreadAttributeMitigationPolicy �� ProcThreadAttributeSecurityCapabilities �� ProcThreadAttributeProtectionLevel ���
ProcThreadAttributeJobList ��� ProcThreadAttributeChildProcessPolicy ProcThreadAttributeAllApplicationPackagesPolicy �� ProcThreadAttributeWin32kFilter �� ProcThreadAttributeSafeOpenPromptOriginClaim � ProcThreadAttributeDesktopAppPolicy �� ProcThreadAttributePseudoConsole � ProcThreadAttributeMitigationAuditPolicy �N t _PROC_THREAD_ATTRIBUTE_NUM .?AW4_PROC_THREAD_ATTRIBUTE_NUM@@ ���* onecore\external\sdk\inc\winbase.h � �
* � HWND__ .?AUHWND__@@ ��
t unused ���* HWND__ .?AUHWND__@@ ��. onecore\external\shared\inc\windef.h ��� ' J AuditEventObjectAccess ��� AuditEventDirectoryServiceAccess �: t _AUDIT_EVENT_TYPE .?AW4_AUDIT_EVENT_TYPE@@ �. onecore\internal\sdk\inc\ntseapi_x.h ���
N . � _ICONINFO .?AU_ICONINFO@@ . � HBITMAP__ .?AUHBITMAP__@@
� b
t fIcon
" xHotspot �
" yHotspot �
hbmMask ��
hbmColor �. _ICONINFO .?AU_ICONINFO@@ * onecore\external\sdk\inc\winuser.h � �) N � _WIN32_MEMORY_RANGE_ENTRY .?AU_WIN32_MEMORY_RANGE_ENTRY@@ 6
VirtualAddress ���
" NumberOfBytes N _WIN32_MEMORY_RANGE_ENTRY .?AU_WIN32_MEMORY_RANGE_ENTRY@@ 2 onecore\external\sdk\inc\minwin\memoryapi.h � j SmrGcActionStart � SmrGcActionStartFullSpeed SmrGcActionPause � SmrGcActionStop ��N t _REFS_SMR_VOLUME_GC_ACTION .?AW4_REFS_SMR_VOLUME_GC_ACTION@@ ���2 onecore\internal\sdk\inc\minwin\ntioapi_x.h � Z � _FILE_LINKS_FULL_ID_INFORMATION .?AU_FILE_LINKS_FULL_ID_INFORMATION@@ f � _FILE_LINK_ENTRY_FULL_ID_INFORMATION .?AU_FILE_LINK_ENTRY_FULL_ID_INFORMATION@@ ��F
" BytesNeeded ��
" EntriesReturned ��
Entry Z $ _FILE_LINKS_FULL_ID_INFORMATION .?AU_FILE_LINKS_FULL_ID_INFORMATION@@ � ^ � _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM_RUNTIME_FUNCTION_ENTRY@@
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
"
���
" BeginAddress �
" UnwindData ���
# Flag �
$ FunctionLength ���
% Ret ��
& H
' Reg ��
( R
) L
* C
+ StackAdjust ��^ , _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM_RUNTIME_FUNCTION_ENTRY@@ - [ � ^ � _SERVICE_DELAYED_AUTO_START_INFO .?AU_SERVICE_DELAYED_AUTO_START_INFO@@ ��
/
�
t fDelayedAutostart ^ 1 _SERVICE_DELAYED_AUTO_START_INFO .?AU_SERVICE_DELAYED_AUTO_START_INFO@@ ��* onecore\external\sdk\inc\winsvc.h �� 2 3 < 2 � HINSTANCE__ .?AUHINSTANCE__@@
5
�
�
� 6 7 7 ! t 8
9
� N � _ENCLAVE_CREATE_INFO_SGX .?AU_ENCLAVE_CREATE_INFO_SGX@@ �� " �
< Secs �N = _ENCLAVE_CREATE_INFO_SGX .?AU_ENCLAVE_CREATE_INFO_SGX@@ ��. onecore\internal\sdk\inc\ntmmapi_x.h ��� > ? � �
ProcessBasicInformation �� ProcessQuotaLimits ��� ProcessIoCounters ProcessVmCounters ProcessTimes � ProcessBasePriority �� ProcessRaisePriority � ProcessDebugPort � ProcessExceptionPort � ProcessAccessToken ���
ProcessLdtInformation ProcessLdtSize ��� ProcessDefaultHardErrorMode ��
ProcessIoPortHandlers ProcessPooledUsageAndLimits �� ProcessWorkingSetWatch ��� ProcessUserModeIOPL �� ProcessEnableAlignmentFaultFixup � ProcessPriorityClass � ProcessWx86Information ��� ProcessHandleCount ��� ProcessAffinityMask �� ProcessPriorityBoost � ProcessDeviceMap � ProcessSessionInformation ProcessForegroundInformation � ProcessWow64Information �� ProcessImageFileName � ProcessLUIDDeviceMapsEnabled � ProcessBreakOnTermination ProcessDebugObjectHandle � ProcessDebugFlags ProcessHandleTracing � ! ProcessIoPriority " ProcessExecuteFlags �� # ProcessTlsInformation $ ProcessCookie % ProcessImageInformation �� & ProcessCycleTime � ' ProcessPagePriority �� ( ProcessInstrumentationCallback ��� ) ProcessThreadStackAllocation � * ProcessWorkingSetWatchEx � + ProcessImageFileNameWin32 , ProcessImageFileMapping �� - ProcessAffinityUpdateMode . ProcessMemoryAllocationMode �� / ProcessGroupInformation �� 0 ProcessTokenVirtualizationEnabled 1 ProcessOwnerInformation �� 2 ProcessWindowInformation � 3 ProcessHandleInformation � 4 ProcessMitigationPolicy �� 5 ProcessDynamicFunctionTableInformation ��� 6 ProcessHandleCheckingMode 7 ProcessKeepAliveCount 8 ProcessRevokeFileHandles � 9 ProcessWorkingSetControl � : ProcessHandleTable ��� ; ProcessCheckStackExtentsMode � < ProcessCommandLineInformation = ProcessProtectionInformation � > ProcessMemoryExhaustion �� ? ProcessFaultInformation �� @ ProcessTelemetryIdInformation A ProcessCommitReleaseInformation �� B ProcessDefaultCpuSetsInformation � C ProcessAllowedCpuSetsInformation � B ProcessReserved1Information �� C ProcessReserved2Information �� D ProcessSubsystemProcess �� E ProcessJobMemoryInformation �� F ProcessInPrivate � G ProcessRaiseUMExceptionOnInvalidHandleClose �� H ProcessIumChallengeResponse �� I ProcessChildProcessInformation ��� J ProcessHighGraphicsPriorityInformation ��� K ProcessSubsystemInformation �� L ProcessEnergyValues �� M ProcessPowerThrottlingState �� N ProcessReserved3Information �� O ProcessWin32kSyscallFilterInformation P ProcessDisableSystemAllowedCpuSets ��� Q ProcessWakeInformation ��� R ProcessEnergyTrackingState ��� S ProcessManageWritesToExecutableMemory T ProcessCaptureTrustletLiveDump ��� U ProcessTelemetryCoverage � V ProcessEnclaveInformation W ProcessEnableReadWriteVmLogging �� X ProcessUptimeInformation � Y ProcessImageSection �� Z ProcessDebugAuthInformation �� [ ProcessSystemResourceManagement �� \ ProcessSequenceNumber ] ProcessLoaderDetour �� ^ ProcessSecurityDomainInformation � _ ProcessCombineSecurityDomainsInformation � ` ProcessEnableLogging � a ProcessLeapSecondInformation � b ProcessFiberShadowStackAllocation c ProcessFreeFiberShadowStackAllocation d ProcessAltSystemCallInformation �� e ProcessDynamicEHContinuationTargets �� f ProcessDynamicEnforcedCetCompatibleRanges g MaxProcessInfoClass ��: j t A _PROCESSINFOCLASS .?AW4_PROCESSINFOCLASS@@ �. onecore\internal\sdk\inc\ntpsapi_x.h ��� B C ] J � _PERFINFO_IPI_SEND_DATA .?AU_PERFINFO_IPI_SEND_DATA@@ v
# InitialTime ��
WorkerRoutine
" RequestType ��
" IpiType ��
" TargetCount ��J F _PERFINFO_IPI_SEND_DATA .?AU_PERFINFO_IPI_SEND_DATA@@ G � 5 b � _ASSEMBLY_FILE_DETAILED_INFORMATION .?AU_ASSEMBLY_FILE_DETAILED_INFORMATION@@ z
" ulFlags ��
" ulFilenameLength �
" ulPathLength �
P lpFileName ���
P lpFilePath ���b J _ASSEMBLY_FILE_DETAILED_INFORMATION .?AU_ASSEMBLY_FILE_DETAILED_INFORMATION@@ * onecore\internal\sdk\inc\nturtl.h �� K L � : � _PS_CREATE_INFO .?AU_PS_CREATE_INFO@@ � PsCreateInitialState � PsCreateFailOnFileOpen ��� PsCreateFailOnSectionCreate �� PsCreateFailExeFormat PsCreateFailMachineMismatch �� PsCreateFailExeName �� PsCreateSuccess �� PsCreateMaximumStates 6 t O PS_CREATE_STATE .?AW4PS_CREATE_STATE@@ � P a )
��
��
��
��
��
��
! ��
" InitFlags
R WriteOutputOnExit
S DetectManifest ���
T IFEOSkipDebugger �
U IFEODoNotPropagateKeyState ���
V SpareBits1 ���
W SpareBits2 ���
X ProhibitedImageCharacteristics ���
" AdditionalFileAccess �: Y <anonymous-tag> .?AU<anonymous-tag>@@ Z a �
FileHandle ���: \ <anonymous-tag> .?AU<anonymous-tag>@@ ] a � "
! DllCharacteristics ���: _ <anonymous-tag> .?AU<anonymous-tag>@@ ` a �
IFEOKey ��: b <anonymous-tag> .?AU<anonymous-tag>@@ c a �
��
��
��
��
��
��
��
! ��
" OutputFlags ��
e ProtectedProcess �
f AddressSpaceOverride �
g DevOverrideEnabled ���
h ManifestDetected �
i ProtectedProcessLight
j SpareBits1 ���
k SpareBits2 ���
l SpareBits3 ���
FileHandle ���
SectionHandle
# UserProcessParametersNative ��
" UserProcessParametersWow64 ���
" CurrentParameterFlags
# PebAddressNative �
" ( PebAddressWow64 ��
# 0 ManifestAddress ��
" 8 ManifestSize �: m @ <anonymous-tag> .?AU<anonymous-tag>@@ n a � �
" Size �
P State
Z InitState
] FailSection ��
` ExeFormat
c ExeName ��
n SuccessState �: p H _PS_CREATE_INFO .?AU_PS_CREATE_INFO@@ q a � J � MEM_EXTENDED_PARAMETER .?AUMEM_EXTENDED_PARAMETER@@ ��
s
�
# ��
# 8��
u Type �
v Reserved �
# ULong64 ��
Pointer ��
" Size �
Handle ���
" ULong J w MEM_EXTENDED_PARAMETER .?AUMEM_EXTENDED_PARAMETER@@ �� x ? � r � _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION@@ ��f � _SYSTEM_SECUREBOOT_POLICY_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_INFORMATION@@ " �J
{ PolicyInformation
" PolicySize ���
| Policy ���r } _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION@@ ��* onecore\internal\sdk\inc\ntexapi.h � ~ � > � _ALPC_TOKEN_ATTR .?AU_ALPC_TOKEN_ATTR@@ ��J
I TokenId ��
I AuthenticationId �
I ModifiedId ���> � _ALPC_TOKEN_ATTR .?AU_ALPC_TOKEN_ATTR@@ ��* onecore\internal\sdk\inc\ntlpcapi.h � � ^ F � _MIDL_METHOD_PROPERTY .?AU_MIDL_METHOD_PROPERTY@@
�
� "
" Id ���
" Value F � _MIDL_METHOD_PROPERTY .?AU_MIDL_METHOD_PROPERTY@@ . onecore\external\shared\inc\rpcndr.h ��� � � [ ^ VrfSpecialPoolRuleClass �� VrfForceIrqlRuleClass VrfAllocationFailuresRuleClass ��� VrfTrackingPoolAllocationsRuleClass �� VrfIORuleClass ��� VrfDeadlockPreventionRuleClass ��� VrfEnhancedIORuleClass ��� VrfDMARuleClass �� VrfSecurityRuleClass � VrfForcePendingIORequestRuleClass
VrfIRPTrackingRuleClass �� VrfMiscellaneousRuleClass VrfMoreDebuggingRuleClass
VrfMDLInvariantStackRuleClass VrfMDLInvariantDriverRuleClass ��� VrfPowerDelayFuzzingRuleClass VrfPortMiniportRuleClass � VrfStandardDDIRuleClass �� VrfAutoFailRuleClass � VrfAdditionalDDIRuleClass VrfRuleClassBase � VrfNdisWifiRuleClass � VrfDriverLoggingRuleClass VrfSyncDelayFuzzingRuleClass � VrfVMSwitchingRuleClass �� VrfCodeIntegrityRuleClass VrfBelow4GBAllocationRuleClass ��� VrfProcessorBranchTraceRuleClass � VrfAdvancedMMRuleClass ��� VrfExtendingXDVTimeLimit � VrfSystemBIOSRuleClass ��� VrfHardwareRuleClass � VrfStateSepRuleClass � ! VrfWDFRuleClass �� " VrfMoreIrqlRuleClass � # VrfXDVPlatformMode ��� $ VrfStandalonePlatformMode % VrfPlatformModeTest �� & VrfInfoDisclosureIRPRule � ' VrfLwSpecialPool � ( VrfAVXCorruption � ) VrfAccessModeMismatch * ReservedForDVRF42 + ReservedForDVRF43 , ReservedForDVRF44 - ReservedForDVRF45 . ReservedForDVRF46 / ReservedForDVRF47 0 ReservedForDVRF48 1 ReservedForDVRF49 2 ReservedForDVRF50 3 ReservedForDVRF51 4 ReservedForDVRF52 5 ReservedForDVRF53 6 ReservedForDVRF54 7 ReservedForDVRF55 8 ReservedForDVRF56 9 ReservedForDVRF57 : ReservedForDVRF58 ; ReservedForDVRF59 < ReservedForDVRF60 = ReservedForDVRF61 > ReservedForDVRF62 ? ReservedForDVRF63 @ VrfRuleClassSizeMax ��> A t � _VRF_RULE_CLASS_ID .?AW4_VRF_RULE_CLASS_ID@@ ��� � w � TraceGuidQueryList ��� TraceGuidQueryInfo ��� TraceGuidQueryProcess TraceStackTracingInfo TraceSystemTraceEnableFlagsInfo �� TraceSampledProfileIntervalInfo �� TraceProfileSourceConfigInfo � TraceProfileSourceListInfo ��� TracePmcEventListInfo TracePmcCounterListInfo ��
TraceSetDisallowList � TraceVersionInfo � TraceGroupQueryList ��
TraceGroupQueryInfo �� TraceDisallowListQuery ��� TraceInfoReserved15 �� TracePeriodicCaptureStateListInfo TracePeriodicCaptureStateInfo TraceProviderBinaryTracking �� TraceMaxLoggersQuery � TraceLbrConfigurationInfo TraceLbrEventListInfo TraceMaxPmcCounterQuery �� MaxTraceSetInfoClass �F t � _TRACE_QUERY_INFO_CLASS .?AW4_TRACE_QUERY_INFO_CLASS@@ �. onecore\external\shared\inc\evntrace.h � � � E ImageDepPolicy ��� ImageAslrPolicy �� ImageDynamicCodePolicy ��� ImageStrictHandleCheckPolicy � ImageSystemCallDisablePolicy � ImageMitigationOptionsMask ��� ImageExtensionPointDisablePolicy � ImageControlFlowGuardPolicy �� ImageSignaturePolicy � ImageFontDisablePolicy ���
ImageImageLoadPolicy � ImagePayloadRestrictionPolicy ImageChildProcessPolicy ��
ImageSehopPolicy � ImageHeapPolicy �� ImageUserShadowStackPolicy ��� MaxImageMitigationPolicy �J t � _IMAGE_MITIGATION_POLICY .?AW4_IMAGE_MITIGATION_POLICY@@ ���* onecore\internal\sdk\inc\ntrtl.h ��� � � � J � _EISA_DMA_CONFIGURATION .?AU_EISA_DMA_CONFIGURATION@@
�
� N � _DMA_CONFIGURATION_BYTE0 .?AU_DMA_CONFIGURATION_BYTE0@@ ��N � _DMA_CONFIGURATION_BYTE1 .?AU_DMA_CONFIGURATION_BYTE1@@ ��B
� ConfigurationByte0 ���
� ConfigurationByte1 ���J � _EISA_DMA_CONFIGURATION .?AU_EISA_DMA_CONFIGURATION@@ * onecore\internal\sdk\inc\ntconfig.h � � DynamicTickVetoNone �� DynamicTickVetoProcBusy �� DynamicTickVetoSoftwareTimer � DynamicTickVetoClockConstraint ��� DynamicTickVetoClockOutOfSync DynamicTickVetoClockUpdateFailed � DynamicTickVetoNoDeepSleep ��� DynamicTickVetoMax ���^ t � _PERFINFO_DYNAMIC_TICK_VETO_REASON .?AW4_PERFINFO_DYNAMIC_TICK_VETO_REASON@@ ��� � � � J � _WMI_JOB_ASSIGN_PROCESS .?AU_WMI_JOB_ASSIGN_PROCESS@@
�
� Z
� ContainerId ��
" JobId
" UniqueProcessId ��
Status ���J � _WMI_JOB_ASSIGN_PROCESS .?AU_WMI_JOB_ASSIGN_PROCESS@@ � � �
h
� " � j � _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS@@ j � _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET@@ ��f
u FeatureId
! ReportingKind
! ReportingOptions �
� ReportingTarget ��j � _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS@@ : onecore\internal\sdk\inc\rtlfeatureconfigtypes.h ��� � � � B � _MIDL_FORMAT_STRING .?AU_MIDL_FORMAT_STRING@@ " �&
Pad ��
� Format ���B � _MIDL_FORMAT_STRING .?AU_MIDL_FORMAT_STRING@@ � � ? f � _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA .?AU_PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA@@ ��
�
� >
" DeviceInstanceLength �
q DeviceInstance ���f � _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA .?AU_PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA@@ ��2 onecore\internal\sdk\inc\minwin\ntpnpapi.h � � � � b � _SYSTEM_PLATFORM_BINARY_INFORMATION .?AU_SYSTEM_PLATFORM_BINARY_INFORMATION@@ �
# PhysicalAddress ��
HandoffBuffer
CommandLineBuffer
" HandoffBufferSize
" CommandLineBufferSize b � _SYSTEM_PLATFORM_BINARY_INFORMATION .?AU_SYSTEM_PLATFORM_BINARY_INFORMATION@@ � �
b � _FILE_MEMORY_PARTITION_INFORMATION .?AU_FILE_MEMORY_PARTITION_INFORMATION@@ ��
�
� " �J
NoCrossPartitionAccess ���
� Spare
" AllFlags �2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � 2
" OwnerPartitionHandle �
� Flags b � _FILE_MEMORY_PARTITION_INFORMATION .?AU_FILE_MEMORY_PARTITION_INFORMATION@@ �� � � z � _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION .?AU_RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION@@ j
ReflectionProcessHandle ��
ReflectionThreadHandle ���
� ReflectionClientId ���z � _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION .?AU_RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION@@ � L � Z � _JOBOBJECT_WAKE_INFORMATION_V1 .?AU_JOBOBJECT_WAKE_INFORMATION_V1@@ �� # " �:
# NotificationChannel ��
� WakeCounters �Z � ( _JOBOBJECT_WAKE_INFORMATION_V1 .?AU_JOBOBJECT_WAKE_INFORMATION_V1@@ �� � a - f � _EVENT_TRACE_PROFILE_LIST_INFORMATION .?AU_EVENT_TRACE_PROFILE_LIST_INFORMATION@@
�
� � EventTraceKernelVersionInformation ��� EventTraceGroupMaskInformation ��� EventTracePerformanceInformation � EventTraceTimeProfileInformation � EventTraceSessionSecurityInformation � EventTraceSpinlockInformation EventTraceStackTracingInformation EventTraceExecutiveResourceInformation ��� EventTraceHeapTracingInformation � EventTraceHeapSummaryTracingInformation ��
EventTracePoolTagFilterInformation ��� EventTracePebsTracingInformation � EventTraceProfileConfigInformation ���
EventTraceProfileSourceListInformation ��� EventTraceProfileEventListInformation EventTraceProfileCounterListInformation �� EventTraceStackCachingInformation EventTraceObjectTypeFilterInformation EventTraceSoftRestartInformation � EventTraceLastBranchConfigurationInformation � EventTraceLastBranchEventListInformation � EventTraceProfileSourceAddInformation EventTraceProfileSourceRemoveInformation � EventTraceProcessorTraceConfigurationInformation � EventTraceProcessorTraceEventListInformation � EventTraceCoverageSamplerInformation � MaxEventTraceInfoClass ���V t � _EVENT_TRACE_INFORMATION_CLASS .?AW4_EVENT_TRACE_INFORMATION_CLASS@@ ���. onecore\internal\sdk\inc\minwin\ntetw.h � � � F � _PROFILE_SOURCE_INFO .?AU_PROFILE_SOURCE_INFO@@ �� � " �N
� EventTraceInformationClass ���
" Spare
� Profile ��f � ( _EVENT_TRACE_PROFILE_LIST_INFORMATION .?AU_EVENT_TRACE_PROFILE_LIST_INFORMATION@@ � � @ � TP_LOG_LEVEL_ERROR ��� TP_LOG_LEVEL_WARNING � TP_LOG_LEVEL_INFO TP_LOG_LEVEL_TRACE_ENTER � TP_LOG_LEVEL_TRACE_LEAVE �2 t � _TP_LOG_LEVEL .?AW4_TP_LOG_LEVEL@@ � � � ? > � _EFI_DRIVER_ENTRY .?AU_EFI_DRIVER_ENTRY@@ z
" Version ��
" Length ���
" Id ���
" FriendlyNameOffset ���
" DriverFilePathOffset �> � _EFI_DRIVER_ENTRY .?AU_EFI_DRIVER_ENTRY@@ � F � _EVENT_FILTER_HEADER .?AU_EVENT_FILTER_HEADER@@ �� " �z
! Id ���
Version ��
� Reserved �
# InstanceId ���
" Size �
" NextOffset ���F � _EVENT_FILTER_HEADER .?AU_EVENT_FILTER_HEADER@@ �� � � T 6 � _currencyfmtW .?AU_currencyfmtW@@ �
u NumDigits
u LeadingZero ��
u Grouping �
q lpDecimalSep �
q lpThousandSep
u NegativeOrder
u PositiveOrder
q lpCurrencySymbol �6 � _currencyfmtW .?AU_currencyfmtW@@ * onecore\external\sdk\inc\winnls.h �� � � � Z � _RTL_UMS_SCHEDULER_STARTUP_INFO .?AU_RTL_UMS_SCHEDULER_STARTUP_INFO@@ N � _RTL_UMS_COMPLETION_LIST .?AU_RTL_UMS_COMPLETION_LIST@@ ��
�
� ^ UmsSchedulerStartup �� UmsSchedulerThreadBlocked UmsSchedulerThreadYield ��J t � _RTL_UMS_SCHEDULER_REASON .?AW4_RTL_UMS_SCHEDULER_REASON@@ � � ( �! � " �
�
� j
" UmsVersion ���
� CompletionList ���
� SchedulerProc
SchedulerParam ���Z � _RTL_UMS_SCHEDULER_STARTUP_INFO .?AU_RTL_UMS_SCHEDULER_STARTUP_INFO@@ � ( " B DPFLTR_SYSTEM_ID � DPFLTR_SMSS_ID ��� DPFLTR_SETUP_ID �� DPFLTR_NTFS_ID ��� DPFLTR_FSTUB_ID �� DPFLTR_CRASHDUMP_ID �� DPFLTR_CDAUDIO_ID DPFLTR_CDROM_ID �� DPFLTR_CLASSPNP_ID ��� DPFLTR_DISK_ID ���
DPFLTR_REDBOOK_ID DPFLTR_STORPROP_ID ��� DPFLTR_SCSIPORT_ID ���
DPFLTR_SCSIMINIPORT_ID ��� DPFLTR_CONFIG_ID � DPFLTR_I8042PRT_ID ��� DPFLTR_SERMOUSE_ID ��� DPFLTR_LSERMOUS_ID ��� DPFLTR_KBDHID_ID � DPFLTR_MOUHID_ID � DPFLTR_KBDCLASS_ID ��� DPFLTR_MOUCLASS_ID ��� DPFLTR_TWOTRACK_ID ��� DPFLTR_WMILIB_ID � DPFLTR_ACPI_ID ��� DPFLTR_AMLI_ID ��� DPFLTR_HALIA64_ID DPFLTR_VIDEO_ID �� DPFLTR_SVCHOST_ID DPFLTR_VIDEOPRT_ID ��� DPFLTR_TCPIP_ID �� DPFLTR_DMSYNTH_ID DPFLTR_NTOSPNP_ID ! DPFLTR_FASTFAT_ID " DPFLTR_SAMSS_ID �� # DPFLTR_PNPMGR_ID � $ DPFLTR_NETAPI_ID � % DPFLTR_SCSERVER_ID ��� & DPFLTR_SCCLIENT_ID ��� ' DPFLTR_SERIAL_ID � ( DPFLTR_SERENUM_ID ) DPFLTR_UHCD_ID ��� * DPFLTR_RPCPROXY_ID ��� + DPFLTR_AUTOCHK_ID , DPFLTR_DCOMSS_ID � - DPFLTR_UNIMODEM_ID ��� . DPFLTR_SIS_ID / DPFLTR_FLTMGR_ID � 0 DPFLTR_WMICORE_ID 1 DPFLTR_BURNENG_ID 2 DPFLTR_IMAPI_ID �� 3 DPFLTR_SXS_ID 4 DPFLTR_FUSION_ID � 5 DPFLTR_IDLETASK_ID ��� 6 DPFLTR_SOFTPCI_ID 7 DPFLTR_TAPE_ID ��� 8 DPFLTR_MCHGR_ID �� 9 DPFLTR_IDEP_ID ��� : DPFLTR_PCIIDE_ID � ; DPFLTR_FLOPPY_ID � < DPFLTR_FDC_ID = DPFLTR_TERMSRV_ID > DPFLTR_W32TIME_ID ? DPFLTR_PREFETCHER_ID � @ DPFLTR_RSFILTER_ID ��� A DPFLTR_FCPORT_ID � B DPFLTR_PCI_ID C DPFLTR_DMIO_ID ��� D DPFLTR_DMCONFIG_ID ��� E DPFLTR_DMADMIN_ID F DPFLTR_WSOCKTRANSPORT_ID � G DPFLTR_VSS_ID H DPFLTR_PNPMEM_ID � I DPFLTR_PROCESSOR_ID �� J DPFLTR_DMSERVER_ID ��� K DPFLTR_SR_ID � L DPFLTR_INFINIBAND_ID � M DPFLTR_IHVDRIVER_ID �� N DPFLTR_IHVVIDEO_ID ��� O DPFLTR_IHVAUDIO_ID ��� P DPFLTR_IHVNETWORK_ID � Q DPFLTR_IHVSTREAMING_ID ��� R DPFLTR_IHVBUS_ID � S DPFLTR_HPS_ID T DPFLTR_RTLTHREADPOOL_ID �� U DPFLTR_LDR_ID V DPFLTR_TCPIP6_ID � W DPFLTR_ISAPNP_ID � X DPFLTR_SHPC_ID ��� Y DPFLTR_STORPORT_ID ��� Z DPFLTR_STORMINIPORT_ID ��� [ DPFLTR_PRINTSPOOLER_ID ��� \ DPFLTR_VSSDYNDISK_ID � ] DPFLTR_VERIFIER_ID ��� ^ DPFLTR_VDS_ID _ DPFLTR_VDSBAS_ID � ` DPFLTR_VDSDYN_ID � a DPFLTR_VDSDYNDR_ID ��� b DPFLTR_VDSLDR_ID � c DPFLTR_VDSUTIL_ID d DPFLTR_DFRGIFC_ID e DPFLTR_DEFAULT_ID f DPFLTR_MM_ID � g DPFLTR_DFSC_ID ��� h DPFLTR_WOW64_ID �� i DPFLTR_ALPC_ID ��� j DPFLTR_WDI_ID k DPFLTR_PERFLIB_ID l DPFLTR_KTM_ID m DPFLTR_IOSTRESS_ID ��� n DPFLTR_HEAP_ID ��� o DPFLTR_WHEA_ID ��� p DPFLTR_USERGDI_ID q DPFLTR_MMCSS_ID �� r DPFLTR_TPM_ID s DPFLTR_THREADORDER_ID t DPFLTR_ENVIRON_ID u DPFLTR_EMS_ID v DPFLTR_WDT_ID w DPFLTR_FVEVOL_ID � x DPFLTR_NDIS_ID ��� y DPFLTR_NVCTRACE_ID ��� z DPFLTR_LUAFV_ID �� { DPFLTR_APPCOMPAT_ID �� | DPFLTR_USBSTOR_ID } DPFLTR_SBP2PORT_ID ��� ~ DPFLTR_COVERAGE_ID ��� DPFLTR_CACHEMGR_ID ��� � DPFLTR_MOUNTMGR_ID ��� � DPFLTR_CFR_ID � DPFLTR_TXF_ID � DPFLTR_KSECDD_ID � � DPFLTR_FLTREGRESS_ID � � DPFLTR_MPIO_ID ��� � DPFLTR_MSDSM_ID �� � DPFLTR_UDFS_ID ��� � DPFLTR_PSHED_ID �� � DPFLTR_STORVSP_ID � DPFLTR_LSASS_ID �� � DPFLTR_SSPICLI_ID � DPFLTR_CNG_ID � DPFLTR_EXFAT_ID �� � DPFLTR_FILETRACE_ID �� � DPFLTR_XSAVE_ID �� � DPFLTR_SE_ID � � DPFLTR_DRIVEEXTENDER_ID �� � DPFLTR_POWER_ID �� � DPFLTR_CRASHDUMPXHCI_ID �� � DPFLTR_GPIO_ID ��� � DPFLTR_REFS_ID ��� � DPFLTR_WER_ID � DPFLTR_CAPIMG_ID � � DPFLTR_VPCI_ID ��� � DPFLTR_STORAGECLASSMEMORY_ID � � DPFLTR_FSLIB_ID �� � DPFLTR_ENDOFTABLE_ID �2 � t � _DPFLTR_TYPE .?AW4_DPFLTR_TYPE@@ ���. onecore\external\shared\inc\dpfilter.h � � � J � _HEAP_SUBSEGMENT_ALLOC .?AU_HEAP_SUBSEGMENT_ALLOC@@ ��F � _SYSTEM_TRACE_HEADER .?AU_SYSTEM_TRACE_HEADER@@ ��^ � _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE .?AU_HEAP_EVENT_SUBSEGMENT_ALLOC_FREE@@ &
� Header ���
� Event J 0 _HEAP_SUBSEGMENT_ALLOC .?AU_HEAP_SUBSEGMENT_ALLOC@@ �� � M WOW64_FUNCTION_NOP ��� WOW64_FUNCTION_QUERY_PROCESS_DEBUG_INFO �� WOW64_FUNCTION_CPU_TURBO_THUNK_CONTROL ��� WOW64_FUNCTION_CPU_CFG_DISPATCH_CONTROL �� WOW64_FUNCTION_CPU_OPTIMIZE_CHPE_IMPORT_THUNKS ��� WOW64_FUNCTION_MAXIMUM ���F t _WOW64_FUNCTION_CODE64 .?AW4_WOW64_FUNCTION_CODE64@@ ��� L b ProcessWorkingSetSwap ProcessWorkingSetEmpty ��� ProcessWorkingSetOperationMax V t _PROCESS_WORKING_SET_OPERATION .?AW4_PROCESS_WORKING_SET_OPERATION@@ ���* onecore\internal\sdk\inc\ntmmapi.h � F � PowerActionNone �� PowerActionReserved �� PowerActionSleep � PowerActionHibernate � PowerActionShutdown �� PowerActionShutdownReset � PowerActionShutdownOff ��� PowerActionWarmEject � PowerActionDisplayOff 2 t
POWER_ACTION .?AW4POWER_ACTION@@ ���* onecore\external\ddk\inc\ntpoapi.h � � ^ � _FILE_FS_DRIVER_PATH_INFORMATION .?AU_FILE_FS_DRIVER_PATH_INFORMATION@@ ��
� q " �N
DriverInPath �
" DriverNameLength �
DriverName ���^ _FILE_FS_DRIVER_PATH_INFORMATION .?AU_FILE_FS_DRIVER_PATH_INFORMATION@@ �� � F � tagEMRSELECTCLIPPATH .?AUtagEMRSELECTCLIPPATH@@ ��
� * � tagEMR .?AUtagEMR@@ ��"
emr ��
" iMode F tagEMRSELECTCLIPPATH .?AUtagEMRSELECTCLIPPATH@@ ��* onecore\external\sdk\inc\wingdi.h �� a � COPYFILE2_PROGRESS_CONTINUE �� COPYFILE2_PROGRESS_CANCEL COPYFILE2_PROGRESS_STOP �� COPYFILE2_PROGRESS_QUIET � COPYFILE2_PROGRESS_PAUSE �J t _COPYFILE2_MESSAGE_ACTION .?AW4_COPYFILE2_MESSAGE_ACTION@@ � F > � COPYFILE2_MESSAGE .?AUCOPYFILE2_MESSAGE@@
��
� !
"
� R � _MEMORY_REGION_INFORMATION .?AU_MEMORY_REGION_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
AllocationBase ���
" AllocationProtect
" RegionType ���
% Private ��
& MappedDataFile ���
' MappedImage ��
( MappedPageFile ���
) MappedPhysical ���
* DirectMapped �
+ SoftwareEnclave ��
, PageSize64K ��
- PlaceholderReservation ���
. Reserved �
" RegionSize ���
" CommitSize ���
" PartitionId ��
" NodePreference ���R / _MEMORY_REGION_INFORMATION .?AU_MEMORY_REGION_INFORMATION@@ �� 0 � F � _UNIVERSAL_NAME_INFOW .?AU_UNIVERSAL_NAME_INFOW@@
q lpUniversalName ��F 3 _UNIVERSAL_NAME_INFOW .?AU_UNIVERSAL_NAME_INFOW@@ * onecore\external\sdk\inc\winnetwk.h 4 5 � J
RtlPhysicalMemoryPolicyLow ��� RtlPhysicalMemoryPolicyNormal N t 7 RTL_PHYSICAL_MEMORY_POLICY .?AW4RTL_PHYSICAL_MEMORY_POLICY@@ ��� 8 � J � _SYSTEM_VERIFIER_ISSUE .?AU_SYSTEM_VERIFIER_ISSUE@@ �� " " �B
" IssueType
Address ��
; Parameters ���J < _SYSTEM_VERIFIER_ISSUE .?AU_SYSTEM_VERIFIER_ISSUE@@ �� = � � PoCsDeviceNotificationStorage PoCsDeviceNotificationWiFi ��� PoCsDeviceNotificationMbn PoCsDeviceNotificationAudio �� PoCsDeviceNotificationEthernet ��� PoCsDeviceNotificationMaximum V t ? _PO_CS_DEVICE_NOTIFICATION_TYPE .?AW4_PO_CS_DEVICE_NOTIFICATION_TYPE@@ � @ ^
6 � _IO_COUNTERS .?AU_IO_COUNTERS@@ ��
# ReadOperationCount ���
# WriteOperationCount ��
# OtherOperationCount ��
# ReadTransferCount
# WriteTransferCount ���
# ( OtherTransferCount ���6 C 0 _IO_COUNTERS .?AU_IO_COUNTERS@@ �� D C � n � _ACTIVATION_CONTEXT_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_DETAILED_INFORMATION@@ ��
F ��
G
� z
" dwFlags ��
" ulFormatVersion ��
" ulAssemblyCount ��
" ulRootManifestPathType ���
" ulRootManifestPathChars ��
" ulRootConfigurationPathType ��
" ulRootConfigurationPathChars �
" ulAppDirPathType �
" ulAppDirPathChars
P $ lpRootManifestPath ���
P ( lpRootConfigurationPath ��
P , lpAppDirPath �n I 0 _ACTIVATION_CONTEXT_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_DETAILED_INFORMATION@@ �� J L ~ � _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ ��
L
� N � _RTL_IMAGE_MITIGATION_POLICY .?AT_RTL_IMAGE_MITIGATION_POLICY@@ ��&
N BlockWin32kSystemCalls ���~ O _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ �� P � P � PowerSystemUnspecified ��� PowerSystemWorking ��� PowerSystemSleeping1 � PowerSystemSleeping2 � PowerSystemSleeping3 � PowerSystemHibernate � PowerSystemShutdown �� PowerSystemMaximum ���> t R _SYSTEM_POWER_STATE .?AW4_SYSTEM_POWER_STATE@@ � S � R � _FSCTL_OFFLOAD_WRITE_INPUT .?AU_FSCTL_OFFLOAD_WRITE_INPUT@@ �� " �~
" Size �
" Flags
# FileOffset ���
# CopyLength ���
# TransferOffset ���
V Token R W _FSCTL_OFFLOAD_WRITE_INPUT .?AU_FSCTL_OFFLOAD_WRITE_INPUT@@ �� X � " " } Z # SystemBasicInformation ��� SystemProcessorInformation ��� SystemPerformanceInformation � SystemTimeOfDayInformation ��� SystemPathInformation SystemProcessInformation � SystemCallCountInformation ��� SystemDeviceInformation �� SystemProcessorPerformanceInformation SystemFlagsInformation ���
SystemCallTimeInformation SystemModuleInformation �� SystemLocksInformation ���
SystemStackTraceInformation �� SystemPagedPoolInformation ��� SystemNonPagedPoolInformation SystemHandleInformation �� SystemObjectInformation �� SystemPageFileInformation SystemVdmInstemulInformation � SystemVdmBopInformation �� SystemFileCacheInformation ��� SystemPoolTagInformation � SystemInterruptInformation ��� SystemDpcBehaviorInformation � SystemFullMemoryInformation �� SystemLoadGdiDriverInformation ��� SystemUnloadGdiDriverInformation � SystemTimeAdjustmentInformation �� SystemSummaryMemoryInformation ��� SystemMirrorMemoryInformation SystemPerformanceTraceInformation SystemObsolete0 �� ! SystemExceptionInformation ��� " SystemCrashDumpStateInformation �� # SystemKernelDebuggerInformation �� $ SystemContextSwitchInformation ��� % SystemRegistryQuotaInformation ��� & SystemExtendServiceTableInformation �� ' SystemPrioritySeperation � ( SystemVerifierAddDriverInformation ��� ) SystemVerifierRemoveDriverInformation * SystemProcessorIdleInformation ��� + SystemLegacyDriverInformation , SystemCurrentTimeZoneInformation � - SystemLookasideInformation ��� . SystemTimeSlipNotification ��� / SystemSessionCreate �� 0 SystemSessionDetach �� 1 SystemSessionInformation � 2 SystemRangeStartInformation �� 3 SystemVerifierInformation 4 SystemVerifierThunkExtend 5 SystemSessionProcessInformation �� 6 SystemLoadGdiDriverInSystemSpace � 7 SystemNumaProcessorMap ��� 8 SystemPrefetcherInformation �� 9 SystemExtendedProcessInformation � : SystemRecommendedSharedDataAlignment � ; SystemComPlusPackage � < SystemNumaAvailableMemory = SystemProcessorPowerInformation �� > SystemEmulationBasicInformation �� ? SystemEmulationProcessorInformation �� @ SystemExtendedHandleInformation �� A SystemLostDelayedWriteInformation B SystemBigPoolInformation � C SystemSessionPoolTagInformation �� D SystemSessionMappedViewInformation ��� E SystemHotpatchInformation F SystemObjectSecurityMode � G SystemWatchdogTimerHandler ��� H SystemWatchdogTimerInformation ��� I SystemLogicalProcessorInformation J SystemWow64SharedInformationObsolete � K SystemRegisterFirmwareTableInformationHandler L SystemFirmwareTableInformation ��� M SystemModuleInformationEx N SystemVerifierTriageInformation �� O SystemSuperfetchInformation �� P SystemMemoryListInformation �� Q SystemFileCacheInformationEx � R SystemThreadPriorityClientIdInformation �� S SystemProcessorIdleCycleTimeInformation �� T SystemVerifierCancellationInformation U SystemProcessorPowerInformationEx V SystemRefTraceInformation W SystemSpecialPoolInformation � X SystemProcessIdInformation ��� Y SystemErrorPortInformation ��� Z SystemBootEnvironmentInformation � [ SystemHypervisorInformation �� \ SystemVerifierInformationEx �� ] SystemTimeZoneInformation ^ SystemImageFileExecutionOptionsInformation ��� _ SystemCoverageInformation ` SystemPrefetchPatchInformation ��� a SystemVerifierFaultsInformation �� b SystemSystemPartitionInformation � c SystemSystemDiskInformation �� d SystemProcessorPerformanceDistribution ��� e SystemNumaProximityNodeInformation ��� f SystemDynamicTimeZoneInformation � g SystemCodeIntegrityInformation ��� h SystemProcessorMicrocodeUpdateInformation i SystemProcessorBrandString ��� j SystemVirtualAddressInformation �� k SystemLogicalProcessorAndGroupInformation l SystemProcessorCycleTimeInformation �� m SystemStoreInformation ��� n SystemRegistryAppendString ��� o SystemAitSamplingValue ��� p SystemVhdBootInformation � q SystemCpuQuotaInformation r SystemNativeBasicInformation � s SystemErrorPortTimeouts �� t SystemLowPriorityIoInformation ��� u SystemBootEntropyInformation � v SystemVerifierCountersInformation w SystemPagedPoolInformationEx � x SystemSystemPtesInformationEx y SystemNodeDistanceInformation z SystemAcpiAuditInformation ��� { SystemBasicPerformanceInformation | SystemQueryPerformanceCounterInformation � } SystemSessionBigPoolInformation �� ~ SystemBootGraphicsInformation SystemScrubPhysicalMemoryInformation � � SystemBadPageInformation � � SystemProcessorProfileControlArea � SystemCombinePhysicalMemoryInformation ��� � SystemEntropyInterruptTimingInformation �� � SystemConsoleInformation � � SystemPlatformBinaryInformation �� � SystemPolicyInformation �� � SystemHypervisorProcessorCountInformation � SystemDeviceDataInformation �� � SystemDeviceDataEnumerationInformation ��� � SystemMemoryTopologyInformation �� � SystemMemoryChannelInformation ��� � SystemBootLogoInformation � SystemProcessorPerformanceInformationEx �� � SystemCriticalProcessErrorLogInformation � � SystemSecureBootPolicyInformation � SystemPageFileInformationEx �� � SystemSecureBootInformation �� � SystemEntropyInterruptTimingRawInformation ��� � SystemPortableWorkspaceEfiLauncherInformation � SystemFullProcessInformation � � SystemKernelDebuggerInformationEx � SystemBootMetadataInformation � SystemSoftRebootInformation �� � SystemElamCertificateInformation � � SystemOfflineDumpConfigInformation ��� � SystemProcessorFeaturesInformation ��� � SystemRegistryReconciliationInformation �� � SystemEdidInformation � SystemManufacturingInformation ��� � SystemEnergyEstimationConfigInformation �� � SystemHypervisorDetailInformation � SystemProcessorCycleStatsInformation � � SystemVmGenerationCountInformation ��� � SystemTrustedPlatformModuleInformation ��� � SystemKernelDebuggerFlags � SystemCodeIntegrityPolicyInformation � � SystemIsolatedUserModeInformation � SystemHardwareSecurityTestInterfaceResultsInformation � SystemSingleModuleInformation � SystemAllowedCpuSetsInformation �� � SystemVsmProtectionInformation ��� � SystemInterruptCpuSetsInformation � SystemSecureBootPolicyFullInformation � SystemCodeIntegrityPolicyFullInformation � � SystemAffinitizedInterruptProcessorInformation ��� � SystemRootSiloInformation � SystemCpuSetInformation �� � SystemCpuSetTagInformation ��� � SystemWin32WerStartCallout ��� � SystemSecureKernelProfileInformation � � SystemCodeIntegrityPlatformManifestInformation ��� � SystemInterruptSteeringInformation ��� � SystemSupportedProcessorArchitectures � SystemMemoryUsageInformation � � SystemCodeIntegrityCertificateInformation � SystemPhysicalMemoryInformation �� � SystemControlFlowTransition �� � SystemKernelDebuggingAllowed � � SystemActivityModerationExeState � � SystemActivityModerationUserSettings � � SystemCodeIntegrityPoliciesFullInformation ��� � SystemCodeIntegrityUnlockInformation � � SystemIntegrityQuotaInformation �� � SystemFlushInformation ��� � SystemProcessorIdleMaskInformation ��� � SystemSecureDumpEncryptionInformation � SystemWriteConstraintInformation � � SystemKernelVaShadowInformation �� � SystemHypervisorSharedPageInformation � SystemFirmwareBootPerformanceInformation � � SystemCodeIntegrityVerificationInformation ��� � SystemFirmwarePartitionInformation ��� � SystemSpeculationControlInformation �� � SystemDmaGuardPolicyInformation �� � SystemEnclaveLaunchControlInformation � SystemWorkloadAllowedCpuSetsInformation �� � SystemCodeIntegrityUnlockModeInformation � � SystemLeapSecondInformation �� � SystemFlags2Information �� � SystemSecurityModelInformation ��� � SystemCodeIntegritySyntheticCacheInformation � � SystemFeatureConfigurationInformation � SystemFeatureConfigurationSectionInformation � � SystemFeatureUsageSubscriptionInformation � SystemSecureSpeculationControlInformation � SystemSpacesBootInformation �� � SystemFwRamdiskInformation ��� � SystemWheaIpmiHardwareInformation � SystemDifSetRuleClassInformation � � SystemDifClearRuleClassInformation ��� � SystemDifApplyPluginVerificationOnDriver � � SystemDifRemovePluginVerificationOnDriver � SystemShadowStackInformation � � SystemBuildVersionInformation � SystemPoolLimitInformation ��� � SystemCodeIntegrityAddDynamicStore ��� � SystemCodeIntegrityClearDynamicStores � SystemPoolZeroingInformation � � MaxSystemInfoClass ���J � t \ _SYSTEM_INFORMATION_CLASS .?AW4_SYSTEM_INFORMATION_CLASS@@ � ] � b � _FILE_FS_METADATA_SIZE_INFORMATION .?AU_FILE_FS_METADATA_SIZE_INFORMATION@@ ��
_
� j
} TotalMetadataAllocationUnits �
" SectorsPerAllocationUnit �
" BytesPerSector ���b a _FILE_FS_METADATA_SIZE_INFORMATION .?AU_FILE_FS_METADATA_SIZE_INFORMATION@@ �� b | : � _MUISTRINGPOOL .?AU_MUISTRINGPOOL@@ ��
u TotalSize
! MaxNumStrings
! NumStrings ���
! MaxNumCharsInPool
!
NumCharsInPool ���
Strings ��
q Pool �: e _MUISTRINGPOOL .?AU_MUISTRINGPOOL@@ �� f � t J � _MESSAGE_RESOURCE_BLOCK .?AU_MESSAGE_RESOURCE_BLOCK@@
h
� B
" LowId
" HighId ���
" OffsetToEntries ��J j _MESSAGE_RESOURCE_BLOCK .?AU_MESSAGE_RESOURCE_BLOCK@@ k ( � � � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY@@ ��>
# ChangeStamp ��
Section ��
" Size � n _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY@@ �� o s J � _LDR_SERVICE_TAG_RECORD .?AU_LDR_SERVICE_TAG_RECORD@@
q
� *
r Next �
" ServiceTag ���J s _LDR_SERVICE_TAG_RECORD .?AU_LDR_SERVICE_TAG_RECORD@@ * onecore\internal\sdk\inc\ntldr.h ��� t u i F � tagMOUSEHOOKSTRUCTEX .?AUtagMOUSEHOOKSTRUCTEX@@ ��. � tagPOINT .?AUtagPOINT@@ ��
� f
x pt ���
y hwnd �
u wHitTestCode �
" dwExtraInfo ��
" mouseData F z tagMOUSEHOOKSTRUCTEX .?AUtagMOUSEHOOKSTRUCTEX@@ �� { � b � _SYSTEM_VERIFIER_TRIAGE_INFORMATION .?AU_SYSTEM_VERIFIER_TRIAGE_INFORMATION@@
}
� " " � q " �z
" ActionTaken ��
CrashData
" VerifierMode �
" VerifierFlags
� VerifierTargets ��b � _SYSTEM_VERIFIER_TRIAGE_INFORMATION .?AU_SYSTEM_VERIFIER_TRIAGE_INFORMATION@@ � � J � _SE_IMPERSONATION_STATE .?AU_SE_IMPERSONATION_STATE@@ r SecurityAnonymous SecurityIdentification ��� SecurityImpersonation SecurityDelegation ���R t � _SECURITY_IMPERSONATION_LEVEL .?AW4_SECURITY_IMPERSONATION_LEVEL@@ � � � R
Token
CopyOnOpen ���
EffectiveOnly
� Level J � _SE_IMPERSONATION_STATE .?AU_SE_IMPERSONATION_STATE@@ � R
j EnlistmentBasicInformation ��� EnlistmentRecoveryInformation EnlistmentCrmInformation �R t � _ENLISTMENT_INFORMATION_CLASS .?AW4_ENLISTMENT_INFORMATION_CLASS@@ �* onecore\internal\sdk\inc\nttmapi.h � � � c > � _OSVERSIONINFOEXA .?AU_OSVERSIONINFOEXA@@ p " � �
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
� szCSDVersion �
! � wServicePackMajor
! � wServicePackMinor
! � wSuiteMask ���
� wProductType �
� wReserved > � � _OSVERSIONINFOEXA .?AU_OSVERSIONINFOEXA@@ � ( � J � SET_POWER_SETTING_VALUE .?AUSET_POWER_SETTING_VALUE@@
�
� B PoAc � PoDc � PoHot PoConditionMaximum ���F t � SYSTEM_POWER_CONDITION .?AW4SYSTEM_POWER_CONDITION@@ ��� � j j
" Version ��
� Guid �
� PowerCondition ���
" DataLength ���
| Data �J � SET_POWER_SETTING_VALUE .?AUSET_POWER_SETTING_VALUE@@ � q F � _PERFINFO_VTL_CHANGE .?AU_PERFINFO_VTL_CHANGE@@ ��2
! OperationCode
! ServiceCode ��F � _PERFINFO_VTL_CHANGE .?AU_PERFINFO_VTL_CHANGE@@ �� � � - J � _FILESYSTEM_STATISTICS .?AU_FILESYSTEM_STATISTICS@@ ��
! FileSystemType ���
! Version ��
" SizeOfCompleteStructure ��
" UserFileReads
" UserFileReadBytes
" UserDiskReads
" UserFileWrites ���
" UserFileWriteBytes ���
" UserDiskWrites ���
" MetaDataReads
" $ MetaDataReadBytes
" ( MetaDataDiskReads
" , MetaDataWrites ���
" 0 MetaDataWriteBytes ���
" 4 MetaDataDiskWrites ���J � 8 _FILESYSTEM_STATISTICS .?AU_FILESYSTEM_STATISTICS@@ �� � : � _PS_PROTECTION .?AU_PS_PROTECTION@@ ��
�
�
��
��
��F
Level
� Type �
� Audit
� Signer ���: � _PS_PROTECTION .?AU_PS_PROTECTION@@ �� � a [ B � _OUTLINETEXTMETRICA .?AU_OUTLINETEXTMETRICA@@
�
� : � tagTEXTMETRICA .?AUtagTEXTMETRICA@@ ��. � tagPANOSE .?AUtagPANOSE@@ * � tagRECT .?AUtagRECT@@ Z
u otmSize ��
� otmTextMetrics ���
< otmFiller
� = otmPanoseNumber ��
u H otmfsSelection ���
u L otmfsType
t P otmsCharSlopeRise
t T otmsCharSlopeRun �
t X otmItalicAngle ���
u \ otmEMSquare ��
t ` otmAscent
t d otmDescent ���
u h otmLineGap ���
u l otmsCapEmHeight ��
u p otmsXHeight ��
� t otmrcFontBox �
t � otmMacAscent �
t � otmMacDescent
u � otmMacLineGap
u � otmusMinimumPPEM �
x � otmptSubscriptSize ���
x � otmptSubscriptOffset �
x � otmptSuperscriptSize �
x � otmptSuperscriptOffset ���
u � otmsStrikeoutSize
t � otmsStrikeoutPosition
t � otmsUnderscoreSize ���
t � otmsUnderscorePosition ���
p � otmpFamilyName ���
p � otmpFaceName �
p � otmpStyleName
p � otmpFullName �B � � _OUTLINETEXTMETRICA .?AU_OUTLINETEXTMETRICA@@ � �
�
�
� � MonitorRequestReasonUnknown �� MonitorRequestReasonPowerButton �� MonitorRequestReasonRemoteConnection � MonitorRequestReasonScMonitorpower ��� MonitorRequestReasonUserInput MonitorRequestReasonAcDcDisplayBurst � MonitorRequestReasonUserDisplayBurst � MonitorRequestReasonPoSetSystemState � MonitorRequestReasonSetThreadExecutionState �� MonitorRequestReasonFullWake �
MonitorRequestReasonSessionUnlock MonitorRequestReasonScreenOffRequest � MonitorRequestReasonIdleTimeout ��
MonitorRequestReasonPolicyChange � MonitorRequestReasonSleepButton �� MonitorRequestReasonLid �� MonitorRequestReasonBatteryCountChange ��� MonitorRequestReasonGracePeriod �� MonitorRequestReasonPnP �� MonitorRequestReasonDP ��� MonitorRequestReasonSxTransition � MonitorRequestReasonSystemIdle ��� MonitorRequestReasonNearProximity MonitorRequestReasonThermalStandby ��� MonitorRequestReasonResumePdc MonitorRequestReasonResumeS4 � MonitorRequestReasonTerminal � MonitorRequestReasonPdcSignal MonitorRequestReasonAcDcDisplayBurstSuppressed ��� MonitorRequestReasonSystemStateEntered ��� MonitorRequestReasonWinrt MonitorRequestReasonUserInputKeyboard MonitorRequestReasonUserInputMouse ��� ! MonitorRequestReasonUserInputTouch ��� " MonitorRequestReasonUserInputPen � # MonitorRequestReasonUserInputAccelerometer ��� $ MonitorRequestReasonUserInputHid � % MonitorRequestReasonUserInputPoUserPresent ��� & MonitorRequestReasonUserInputSessionSwitch ��� ' MonitorRequestReasonUserInputInitialization �� ( MonitorRequestReasonPdcSignalWindowsMobilePwrNotif ��� ) MonitorRequestReasonPdcSignalWindowsMobileShell �� * MonitorRequestReasonPdcSignalHeyCortana �� + MonitorRequestReasonPdcSignalHolographicShell , MonitorRequestReasonPdcSignalFingerprint � - MonitorRequestReasonDirectedDrips . MonitorRequestReasonDim �� / MonitorRequestReasonBuiltinPanel � 0 MonitorRequestReasonDisplayRequiredUnDim � 1 MonitorRequestReasonBatteryCountChangeSuppressed � 2 MonitorRequestReasonResumeModernStandby �� 3 MonitorRequestReasonMax ��R 4 t � POWER_MONITOR_REQUEST_REASON .?AW4POWER_MONITOR_REQUEST_REASON@@ ��� � 2 � _HSM_OPCODE .?AU_HSM_OPCODE@@ "
" Tag ��
" Code �2 � _HSM_OPCODE .?AU_HSM_OPCODE@@ � �" b � _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY@@
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" BeginAddress �
" UnwindData ���
� Flag �
� FunctionLength ���
� RegF �
� RegI �
� H
� CR ���
� FrameSize b � _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY@@ � [ Z PerfCSwapIdleShort ��� PerfCSwapIdle PerfCSwapLite PerfCSwapFull B t � _PERFINFO_CCSWAP_TYPE .?AW4_PERFINFO_CCSWAP_TYPE@@ � � � { . � _WMI_UDP .?AU_WMI_UDP@@ ��r
" PID ��
! Size �
" DestAddr �
" SrcAddr ��
! DestPort �
! SrcPort ��. � _WMI_UDP .?AU_WMI_UDP@@ �� � � J � _PERFINFO_HV_HYPERCALL .?AU_PERFINFO_HV_HYPERCALL@@ ��>
u CallCode �
IsFast ���
IsNested �J � _PERFINFO_HV_HYPERCALL .?AU_PERFINFO_HV_HYPERCALL@@ �� � � @ F � _UNIVERSAL_NAME_INFOA .?AU_UNIVERSAL_NAME_INFOA@@
�
�
p lpUniversalName ��F � _UNIVERSAL_NAME_INFOA .?AU_UNIVERSAL_NAME_INFOA@@ � 5 ~ � ProfileTime �� ProfileAlignmentFixup ProfileTotalIssues ��� ProfilePipelineDry ��� ProfileLoadInstructions �� ProfilePipelineFrozen ProfileBranchInstructions ProfileTotalNonissues ProfileDcacheMisses �� ProfileIcacheMisses ��
ProfileCacheMisses ��� ProfileBranchMispredictions �� ProfileStoreInstructions �
ProfileFpInstructions ProfileIntegerInstructions ��� Profile2Issue Profile3Issue Profile4Issue ProfileSpecialInstructions ��� ProfileTotalCycles ��� ProfileIcacheIssues �� ProfileDcacheAccesses ProfileMemoryBarrierCycles ��� ProfileLoadLinkedIssues �� ProfileMaximum ���: t � _KPROFILE_SOURCE .?AW4_KPROFILE_SOURCE@@ ���. onecore\internal\sdk\inc\ntkeapi_x.h ��� � � � Z � _USER_MARSHAL_ROUTINE_QUADRUPLE .?AU_USER_MARSHAL_ROUTINE_QUADRUPLE@@ " " " �
�
� " �
�
�
�
� " �
�
� ^
� pfnBufferSize
� pfnMarshall ��
� pfnUnmarshall
� pfnFree ��Z � _USER_MARSHAL_ROUTINE_QUADRUPLE .?AU_USER_MARSHAL_ROUTINE_QUADRUPLE@@ � � n > � tagENHMETAHEADER .?AUtagENHMETAHEADER@@ ��
�
� * � _RECTL .?AU_RECTL@@ ��* � tagSIZE .?AUtagSIZE@@ �
" iType
" nSize
� rclBounds
� rclFrame �
" ( dSignature ���
" , nVersion �
" 0 nBytes ���
" 4 nRecords �
! 8 nHandles �
! : sReserved
" < nDescription �
" @ offDescription ���
" D nPalEntries ��
� H szlDevice
� P szlMillimeters ���
" X cbPixelFormat
" \ offPixelFormat ���
" ` bOpenGL ��
� d szlMicrometers ���> � l tagENHMETAHEADER .?AUtagENHMETAHEADER@@ �� � ; JobObjectBasicAccountingInformation �� JobObjectBasicLimitInformation ��� JobObjectBasicProcessIdList �� JobObjectBasicUIRestrictions � JobObjectSecurityLimitInformation JobObjectEndOfJobTimeInformation � JobObjectAssociateCompletionPortInformation �� JobObjectBasicAndIoAccountingInformation � JobObjectExtendedLimitInformation
JobObjectJobSetInformation ��� JobObjectGroupInformation JobObjectNotificationLimitInformation
JobObjectLimitViolationInformation ��� JobObjectGroupInformationEx �� JobObjectCpuRateControlInformation ��� JobObjectCompletionFilter JobObjectCompletionCounter ��� JobObjectFreezeInformation ��� JobObjectExtendedAccountingInformation ��� JobObjectWakeInformation � JobObjectBackgroundInformation ��� JobObjectSchedulingRankBiasInformation ��� JobObjectTimerVirtualizationInformation �� JobObjectCycleTimeNotification ��� JobObjectClearEvent �� JobObjectInterferenceInformation � JobObjectClearPeakJobMemoryUsed �� JobObjectMemoryUsageInformation �� JobObjectSharedCommit JobObjectContainerId � JobObjectIoRateControlInformation % JobObjectSiloRootDirectory ��� & JobObjectServerSiloBasicInformation �� ' JobObjectServerSiloUserSharedData ( JobObjectServerSiloInitialize ) JobObjectServerSiloRunningState �� * JobObjectIoAttribution ��� + JobObjectMemoryPartitionInformation �� , JobObjectContainerTelemetryId - JobObjectSiloSystemRoot �� . JobObjectEnergyTrackingState � / JobObjectThreadImpersonationInformation �� JobObjectReserved1Information JobObjectReserved2Information JobObjectReserved3Information JobObjectReserved4Information JobObjectReserved5Information JobObjectReserved6Information JobObjectReserved7Information JobObjectReserved8Information JobObjectReserved9Information JobObjectReserved10Information ��� JobObjectReserved11Information ��� JobObjectReserved12Information ��� JobObjectReserved13Information ��� JobObjectReserved14Information ��� JobObjectNetRateControlInformation ��� ! JobObjectNotificationLimitInformation2 ��� " JobObjectLimitViolationInformation2 �� # JobObjectCreateSilo �� $ JobObjectSiloBasicInformation % JobObjectReserved15Information ��� & JobObjectReserved16Information ��� ' JobObjectReserved17Information ��� ( JobObjectReserved18Information ��� ) JobObjectReserved19Information ��� * JobObjectReserved20Information ��� + JobObjectReserved21Information ��� , JobObjectReserved22Information ��� - JobObjectReserved23Information ��� . JobObjectReserved24Information ��� / JobObjectReserved25Information ��� 0 MaxJobObjectInfoClass > I t � _JOBOBJECTINFOCLASS .?AW4_JOBOBJECTINFOCLASS@@ � � C P ObjectBasicInformation ��� ObjectNameInformation ObjectTypeInformation ObjectTypesInformation ��� ObjectHandleFlagInformation �� ObjectSessionInformation � ObjectSessionObjectInformation ��� MaxObjectInfoClass ���J t � _OBJECT_INFORMATION_CLASS .?AW4_OBJECT_INFORMATION_CLASS@@ �. onecore\internal\sdk\inc\ntobapi_x.h ��� � � e Z � _IMAGE_DYNAMIC_RELOCATION_TABLE .?AU_IMAGE_DYNAMIC_RELOCATION_TABLE@@ &
" Version ��
" Size �Z � _IMAGE_DYNAMIC_RELOCATION_TABLE .?AU_IMAGE_DYNAMIC_RELOCATION_TABLE@@ � [ � � InternalWakeSourceDozeToHibernate InternalWakeSourcePredictedUserPresence �� InternalWakeSourceTimerOverride ��R t � PO_INTERNAL_WAKE_SOURCE_TYPE .?AW4PO_INTERNAL_WAKE_SOURCE_TYPE@@ ��� �
� PsAttributeParentProcess � PsAttributeDebugObject ��� PsAttributeToken � PsAttributeClientId �� PsAttributeTebAddress PsAttributeImageName � PsAttributeImageInfo � PsAttributeMemoryReserve � PsAttributePriorityClass � PsAttributeErrorMode �
PsAttributeStdHandleInfo � PsAttributeHandleList PsAttributeGroupAffinity �
PsAttributePreferredNode � PsAttributeIdealProcessor PsAttributeUmsThread � PsAttributeMitigationOptions � PsAttributeProtectionLevel ��� PsAttributeSecureProcess � PsAttributeJobList ��� PsAttributeChildProcessPolicy PsAttributeAllApplicationPackagesPolicy �� PsAttributeWin32kFilter �� PsAttributeSafeOpenPromptOriginClaim � PsAttributeBnoIsolation �� PsAttributeDesktopAppPolicy �� PsAttributeChpe �� PsAttributeMitigationAuditOptions PsAttributeMax ���: t _PS_ATTRIBUTE_NUM .?AW4_PS_ATTRIBUTE_NUM@@ � a � SystemPowerPolicyAc �� SystemPowerPolicyDc �� VerifySystemPolicyAc � VerifySystemPolicyDc � SystemPowerCapabilities �� SystemBatteryState ��� SystemPowerStateHandler �� ProcessorStateHandler SystemPowerPolicyCurrent � AdministratorPowerPolicy �
SystemReserveHiberFile ��� ProcessorInformation � SystemPowerInformation ���
ProcessorStateHandler2 ��� LastWakeTime � LastSleepTime SystemExecutionState � SystemPowerStateNotifyHandler ProcessorPowerPolicyAc ��� ProcessorPowerPolicyDc ��� VerifyProcessorPowerPolicyAc � VerifyProcessorPowerPolicyDc � ProcessorPowerPolicyCurrent �� SystemPowerStateLogging �� SystemPowerLoggingEntry �� SetPowerSettingValue � NotifyUserPowerSetting ��� PowerInformationLevelUnused0 � SystemMonitorHiberBootPowerOff ��� SystemVideoState � TraceApplicationPowerMessage � TraceApplicationPowerMessageEnd �� ProcessorPerfStates �� ! ProcessorIdleStates �� " ProcessorCap � # SystemWakeSource � $ SystemHiberFileInformation ��� % TraceServicePowerMessage � & ProcessorLoad ' PowerShutdownNotification ( MonitorCapabilities �� ) SessionPowerInit � * SessionDisplayState �� + PowerRequestCreate ��� , PowerRequestAction ��� - GetPowerRequestList �� . ProcessorInformationEx ��� / NotifyUserModeLegacyPowerEvent ��� 0 GroupPark 1 ProcessorIdleDomains � 2 WakeTimerList 3 SystemHiberFileSize �� 4 ProcessorIdleStatesHv 5 ProcessorPerfStatesHv 6 ProcessorPerfCapHv ��� 7 ProcessorSetIdle � 8 LogicalProcessorIdling ��� 9 UserPresence � : PowerSettingNotificationName � ; GetPowerSettingValue � < IdleResiliency ��� = SessionRITState �� > SessionConnectNotification ��� ? SessionPowerCleanup �� @ SessionLockState � A SystemHiberbootState � B PlatformInformation �� C PdcInvocation D MonitorInvocation E FirmwareTableInformationRegistered ��� F SetShutdownSelectedTime �� G SuspendResumeInvocation �� H PlmPowerRequestCreate I ScreenOff J CsDeviceNotification � K PlatformRole � L LastResumePerformance M DisplayBurst � N ExitLatencySamplingPercentage O RegisterSpmPowerSettings � P PlatformIdleStates ��� Q ProcessorIdleVeto R PlatformIdleVeto � S SystemBatteryStatePrecise T ThermalEvent � U PowerRequestActionInternal ��� V BatteryDeviceState ��� W PowerInformationInternal � X ThermalStandby ��� Y SystemHiberFileType �� Z PhysicalPowerButtonPress � [ QueryPotentialDripsConstraint \ EnergyTrackerCreate �� ] EnergyTrackerQuery ��� ^ UpdateBlackBoxRecorder ��� _ SessionAllowExternalDmaDevices ��� ` PowerInformationLevelMaximum �F a t POWER_INFORMATION_LEVEL .?AW4POWER_INFORMATION_LEVEL@@ � q ^
FileDirectoryInformation � FileFullDirectoryInformation � FileBothDirectoryInformation � FileBasicInformation � FileStandardInformation �� FileInternalInformation �� FileEaInformation FileAccessInformation FileNameInformation ��
FileRenameInformation FileLinkInformation �� FileNamesInformation �
FileDispositionInformation ��� FilePositionInformation �� FileFullEaInformation FileModeInformation �� FileAlignmentInformation � FileAllInformation ��� FileAllocationInformation FileEndOfFileInformation � FileAlternateNameInformation � FileStreamInformation FilePipeInformation �� FilePipeLocalInformation � FilePipeRemoteInformation FileMailslotQueryInformation � FileMailslotSetInformation ��� FileCompressionInformation ��� FileObjectIdInformation �� FileCompletionInformation FileMoveClusterInformation ��� FileQuotaInformation � ! FileReparsePointInformation �� " FileNetworkOpenInformation ��� # FileAttributeTagInformation �� $ FileTrackingInformation �� % FileIdBothDirectoryInformation ��� & FileIdFullDirectoryInformation ��� ' FileValidDataLengthInformation ��� ( FileShortNameInformation � ) FileIoCompletionNotificationInformation �� * FileIoStatusBlockRangeInformation + FileIoPriorityHintInformation , FileSfioReserveInformation ��� - FileSfioVolumeInformation . FileHardLinkInformation �� / FileProcessIdsUsingFileInformation ��� 0 FileNormalizedNameInformation 1 FileNetworkPhysicalNameInformation ��� 2 FileIdGlobalTxDirectoryInformation ��� 3 FileIsRemoteDeviceInformation 4 FileUnusedInformation 5 FileNumaNodeInformation �� 6 FileStandardLinkInformation �� 7 FileRemoteProtocolInformation 8 FileRenameInformationBypassAccessCheck ��� 9 FileLinkInformationBypassAccessCheck � : FileVolumeNameInformation ; FileIdInformation < FileIdExtdDirectoryInformation ��� = FileReplaceCompletionInformation � > FileHardLinkFullIdInformation ? FileIdExtdBothDirectoryInformation ��� @ FileDispositionInformationEx � A FileRenameInformationEx �� B FileRenameInformationExBypassAccessCheck � C FileDesiredStorageClassInformation ��� D FileStatInformation �� E FileMemoryPartitionInformation ��� F FileStatLxInformation G FileCaseSensitiveInformation � H FileLinkInformationEx I FileLinkInformationExBypassAccessCheck ��� J FileStorageReserveIdInformation �� K FileCaseSensitiveInformationForceAccessCheck � L FileMaximumInformation ���F L t _FILE_INFORMATION_CLASS .?AW4_FILE_INFORMATION_CLASS@@ � \ V � _ENUM_SERVICE_STATUS_PROCESSA .?AU_ENUM_SERVICE_STATUS_PROCESSA@@ J � _SERVICE_STATUS_PROCESS .?AU_SERVICE_STATUS_PROCESS@@ R
p lpServiceName
p lpDisplayName
ServiceStatusProcess �V , _ENUM_SERVICE_STATUS_PROCESSA .?AU_ENUM_SERVICE_STATUS_PROCESSA@@ 3 J � SERVICE_STATUS_HANDLE__ .?AUSERVICE_STATUS_HANDLE__@@
�
t unused ���J SERVICE_STATUS_HANDLE__ .?AUSERVICE_STATUS_HANDLE__@@ 3 � q " t
� � RtlPathTypeUnknown ��� RtlPathTypeUncAbsolute ��� RtlPathTypeDriveAbsolute � RtlPathTypeDriveRelative � RtlPathTypeRooted RtlPathTypeRelative �� RtlPathTypeLocalDevice ��� RtlPathTypeRootLocalDevice ���6 t _RTL_PATH_TYPE .?AW4_RTL_PATH_TYPE@@ ��� L g � PlugPlayControlEnumerateDevice ��� PlugPlayControlRegisterNewDevice � PlugPlayControlDeregisterDevice �� PlugPlayControlInitializeDevice �� PlugPlayControlStartDevice ��� PlugPlayControlUnlockDevice �� PlugPlayControlQueryAndRemoveDevice �� PlugPlayControlUserResponse �� PlugPlayControlGenerateLegacyDevice �� PlugPlayControlGetInterfaceDeviceList
PlugPlayControlProperty �� PlugPlayControlDeviceClassAssociation PlugPlayControlGetRelatedDevice ��
PlugPlayControlGetInterfaceDeviceAlias ��� PlugPlayControlDeviceStatus �� PlugPlayControlGetDeviceDepth PlugPlayControlQueryDeviceRelations �� PlugPlayControlTargetDeviceRelation �� PlugPlayControlQueryConflictList � PlugPlayControlRetrieveDock �� PlugPlayControlResetDevice ��� PlugPlayControlHaltDevice PlugPlayControlGetBlockedDriverList �� PlugPlayControlGetDeviceInterfaceEnabled � MaxPlugPlayControl ���F t _PLUGPLAY_CONTROL_CLASS .?AW4_PLUGPLAY_CONTROL_CLASS@@ � � � LockQueueUnusedSpare0 LockQueueUnusedSpare1 LockQueueUnusedSpare2 LockQueueUnusedSpare3 LockQueueVacbLock LockQueueMasterLock �� LockQueueNonPagedPoolLock LockQueueIoCancelLock LockQueueUnusedSpare8 LockQueueIoVpbLock ���
LockQueueIoDatabaseLock �� LockQueueIoCompletionLock LockQueueNtfsStructLock ��
LockQueueAfdWorkQueueLock LockQueueBcbLock � LockQueueUnusedSpare15 ��� LockQueueUnusedSpare16 ��� LockQueueMaximumLock �J t _KSPIN_LOCK_QUEUE_NUMBER .?AW4_KSPIN_LOCK_QUEUE_NUMBER@@ ��� � | Z � _HEAP_REUSE_THRESHOLD_ACTIVATED .?AU_HEAP_REUSE_THRESHOLD_ACTIVATED@@ ^
� Header ���
HeapHandle ���
$ SubSegment ���
" ( BucketIndex ��Z , _HEAP_REUSE_THRESHOLD_ACTIVATED .?AU_HEAP_REUSE_THRESHOLD_ACTIVATED@@ ! � � � AccessReasonNone � � AccessReasonAllowedAce ��� � AccessReasonDeniedAce � AccessReasonAllowedParentAce � � AccessReasonDeniedParentAce �� � AccessReasonNotGrantedByCape � � AccessReasonNotGrantedByParentCape ��� � AccessReasonNotGrantedToAppContainer � � AccessReasonMissingPrivilege � � AccessReasonFromPrivilege � 0 AccessReasonIntegrityLevel ��� � @ AccessReasonOwnership � P AccessReasonNullDacl � � ` AccessReasonEmptyDacl � p AccessReasonNoSD � � � AccessReasonNoGrant �� � � AccessReasonTrustLabel ��� � � AccessReasonFilterAce > t # _ACCESS_REASON_TYPE .?AW4_ACCESS_REASON_TYPE@@ � $ � b � _PERFINFO_DRIVER_MAJORFUNCTION_RET .?AU_PERFINFO_DRIVER_MAJORFUNCTION_RET@@ ��*
Irp ��
" UniqMatchId ��b ' _PERFINFO_DRIVER_MAJORFUNCTION_RET .?AU_PERFINFO_DRIVER_MAJORFUNCTION_RET@@ �� ( � � * COMIMAGE_FLAGS_ILONLY COMIMAGE_FLAGS_32BITREQUIRED � COMIMAGE_FLAGS_IL_LIBRARY COMIMAGE_FLAGS_STRONGNAMESIGNED �� COMIMAGE_FLAGS_NATIVE_ENTRYPOINT � � COMIMAGE_FLAGS_TRACKDEBUGDATA � COMIMAGE_FLAGS_32BITPREFERRED COR_VERSION_MAJOR_V2 � COR_VERSION_MAJOR COR_VERSION_MINOR COR_DELETED_NAME_LENGTH �� COR_VTABLEGAP_NAME_LENGTH NATIVE_TYPE_MAX_CB ��� � COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE � IMAGE_COR_MIH_METHODRVA �� IMAGE_COR_MIH_EHRVA �� IMAGE_COR_MIH_BASICBLOCK � COR_VTABLE_32BIT � COR_VTABLE_64BIT � COR_VTABLE_FROM_UNMANAGED COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN ��� COR_VTABLE_CALL_MOST_DERIVED � IMAGE_COR_EATJ_THUNK_SIZE MAX_CLASS_NAME ��� MAX_PACKAGE_NAME �R t * ReplacesCorHdrNumericDefines .?AW4ReplacesCorHdrNumericDefines@@ ��� + [ � V � _GENERIC_BINDING_ROUTINE_PAIR .?AU_GENERIC_BINDING_ROUTINE_PAIR@@
-
�
/
0
� 2
3
� *
1 pfnBind ��
4 pfnUnbind V 5 _GENERIC_BINDING_ROUTINE_PAIR .?AU_GENERIC_BINDING_ROUTINE_PAIR@@ 6 � 5 R � _MEMORY_BASIC_INFORMATION64 .?AU_MEMORY_BASIC_INFORMATION64@@ �
# BaseAddress ��
# AllocationBase ���
" AllocationProtect
" __alignment1 �
# RegionSize ���
" State
" $ Protect ��
" ( Type �
" , __alignment2 �R 9 0 _MEMORY_BASIC_INFORMATION64 .?AU_MEMORY_BASIC_INFORMATION64@@ : ? i ^ � _LEAP_SECOND_DATA_REGISTRY_ENTRY .?AU_LEAP_SECOND_DATA_REGISTRY_ENTRY@@ ��
<
� f
Year �
Month
Day ��
Hour �
Flags
Reserved �^ > _LEAP_SECOND_DATA_REGISTRY_ENTRY .?AU_LEAP_SECOND_DATA_REGISTRY_ENTRY@@ �� ? � > � tagCANDIDATEFORM .?AUtagCANDIDATEFORM@@ ��
A
� V
" dwIndex ��
" dwStyle ��
x ptCurrentPos �
� rcArea ���> C tagCANDIDATEFORM .?AUtagCANDIDATEFORM@@ ��& onecore\external\sdk\inc\imm.h � D E < R � _FILE_IO_PRIORITY_HINT_INFO .?AU_FILE_IO_PRIORITY_HINT_INFO@@
G
� r IoPriorityHintVeryLow IoPriorityHintLow IoPriorityHintNormal � MaximumIoPriorityHintType 6 t I _PRIORITY_HINT .?AW4_PRIORITY_HINT@@ ��� J �"
J PriorityHint �R L _FILE_IO_PRIORITY_HINT_INFO .?AU_FILE_IO_PRIORITY_HINT_INFO@@ M �" } } } O J � _IO_RESOURCE_DESCRIPTOR .?AU_IO_RESOURCE_DESCRIPTOR@@ b
" Length ���
" Alignment
} MinimumAddress ���
} MaximumAddress ���: R <anonymous-tag> .?AU<anonymous-tag>@@ S � � b
" Length ���
" Alignment
} MinimumAddress ���
} MaximumAddress ���: U <anonymous-tag> .?AU<anonymous-tag>@@ V � � IrqPolicyMachineDefault �� IrqPolicyAllCloseProcessors �� IrqPolicyOneCloseProcessor ��� IrqPolicyAllProcessorsInMachine �� IrqPolicySpecifiedProcessors � IrqPolicySpreadMessagesAcrossAllProcessors ��� IrqPolicyAllProcessorsInMachineWhenSteered ���> t X _IRQ_DEVICE_POLICY .?AW4_IRQ_DEVICE_POLICY@@ ��� Y � x f IrqPriorityUndefined � IrqPriorityLow ��� IrqPriorityNormal IrqPriorityHigh ��2 t [ _IRQ_PRIORITY .?AW4_IRQ_PRIORITY@@ � \ � � �
" MinimumVector
" MaximumVector
Y AffinityPolicy ���
\ PriorityPolicy ���
" TargetedProcessors ���: ^ <anonymous-tag> .?AU<anonymous-tag>@@ _ � � :
" MinimumChannel ���
" MaximumChannel ���: a <anonymous-tag> .?AU<anonymous-tag>@@ b � � Z
" RequestLine ��
" Reserved �
" Channel ��
" TransferWidth : d <anonymous-tag> .?AU<anonymous-tag>@@ e � � b
" Length ���
" Alignment
} MinimumAddress ���
} MaximumAddress ���: g <anonymous-tag> .?AU<anonymous-tag>@@ h � �
� Data �: j <anonymous-tag> .?AU<anonymous-tag>@@ k � � Z
" Length ���
" MinBusNumber �
" MaxBusNumber �
" Reserved �: m <anonymous-tag> .?AU<anonymous-tag>@@ n � � >
" Priority �
" Reserved1
" Reserved2 : p <anonymous-tag> .?AU<anonymous-tag>@@ q � � f
" Length40 �
" Alignment40 ��
} MinimumAddress ���
} MaximumAddress ���: s <anonymous-tag> .?AU<anonymous-tag>@@ t � � f
" Length48 �
" Alignment48 ��
} MinimumAddress ���
} MaximumAddress ���: v <anonymous-tag> .?AU<anonymous-tag>@@ w � � f
" Length64 �
" Alignment64 ��
} MinimumAddress ���
} MaximumAddress ���: y <anonymous-tag> .?AU<anonymous-tag>@@ z � � v
Class
Type �
Reserved1
Reserved2
" IdLowPart
" IdHighPart ���: | <anonymous-tag> .?AU<anonymous-tag>@@ } �
S Port �
V Memory ���
_ Interrupt
b Dma ��
e DmaV3
h Generic ��
k DevicePrivate
n BusNumber
q ConfigData ���
t Memory40 �
w Memory48 �
z Memory64 �
} Connection ���2
<anonymous-tag> .?AT<anonymous-tag>@@ � � � �
Option ���
Type �
ShareDisposition �
Spare1 ���
! Flags
! Spare2 ���
� u J � _IO_RESOURCE_DESCRIPTOR .?AU_IO_RESOURCE_DESCRIPTOR@@ � � � > KeyBasicInformation �� KeyNodeInformation ��� KeyFullInformation ��� KeyNameInformation ��� KeyCachedInformation � KeyFlagsInformation �� KeyVirtualizationInformation � KeyHandleTagsInformation � KeyTrustInformation �� KeyLayerInformation ��
MaxKeyInfoClass ��F t � _KEY_INFORMATION_CLASS .?AW4_KEY_INFORMATION_CLASS@@ ���. onecore\internal\sdk\inc\ntregapi_x.h �� � � b � _SYSTEM_SECURITY_MODEL_INFORMATION .?AU_SYSTEM_SECURITY_MODEL_INFORMATION@@ ��
" ��
" ��
" ��f
� SModeAdminlessEnabled
� AllowDeviceOwnerProtectionDowngrade ��
� Reserved �: � <anonymous-tag> .?AU<anonymous-tag>@@ � <
"
� SecurityModelFlags ���b � _SYSTEM_SECURITY_MODEL_INFORMATION .?AU_SYSTEM_SECURITY_MODEL_INFORMATION@@ �� � ;
�
� z � _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY@@ ��b
N UserShadowStack ��
N SetContextIpValidation ���
N BlockNonCetBinaries ��z � _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY@@ �� � � ^ V � _FILE_PIPE_LOCAL_INFORMATION .?AU_FILE_PIPE_LOCAL_INFORMATION@@ ��
�
�
" NamedPipeType
" NamedPipeConfiguration ���
" MaximumInstances �
" CurrentInstances �
" InboundQuota �
" ReadDataAvailable
" OutboundQuota
" WriteQuotaAvailable ��
" NamedPipeState ���
" $ NamedPipeEnd �V
� ( _FILE_PIPE_LOCAL_INFORMATION .?AU_FILE_PIPE_LOCAL_INFORMATION@@ �� � M � LearningModeLogLevelPassive �� LearningModeLogLevelNormalApc LearningModeLogLevelSpecialApc ��� LearningModeLogLevelMax ��J t � _LEARNING_MODE_LOG_LEVEL .?AW4_LEARNING_MODE_LOG_LEVEL@@ ��� � ] � ^ � _IMAGE_RESOURCE_DIRECTORY_STRING .?AU_IMAGE_RESOURCE_DIRECTORY_STRING@@ ��
�
� p " �.
! Length ���
� NameString ���^ � _IMAGE_RESOURCE_DIRECTORY_STRING .?AU_IMAGE_RESOURCE_DIRECTORY_STRING@@ �� � [ f 2 � DLGTEMPLATE .?AUDLGTEMPLATE@@
� ��
�
� v
" style
" dwExtendedStyle ��
! cdit �
x
y
cx ���
cy ���2 � DLGTEMPLATE .?AUDLGTEMPLATE@@ � ( J � tagEMRSETVIEWPORTEXTEX .?AUtagEMRSETVIEWPORTEXTEX@@ ��
�
� &
emr ��
� szlExtent J � tagEMRSETVIEWPORTEXTEX .?AUtagEMRSETVIEWPORTEXTEX@@ �� � � R CacheUnified � CacheInstruction � CacheData CacheTrace ���B t � _PROCESSOR_CACHE_TYPE .?AW4_PROCESSOR_CACHE_TYPE@@ � � { � J � _QUERY_SERVICE_CONFIGA .?AU_QUERY_SERVICE_CONFIGA@@ ���
" dwServiceType
" dwStartType ��
" dwErrorControl ���
p lpBinaryPathName �
p lpLoadOrderGroup �
" dwTagId ��
p lpDependencies ���
p lpServiceStartName ���
p lpDisplayName J � $ _QUERY_SERVICE_CONFIGA .?AU_QUERY_SERVICE_CONFIGA@@ �� � 3 0 > � tagMSGBOXPARAMSA .?AUtagMSGBOXPARAMSA@@ ��
5
� 2 � tagHELPINFO .?AUtagHELPINFO@@
�
�
� �
�
� �
u cbSize ���
y hwndOwner
� hInstance
7 lpszText �
7 lpszCaption ��
" dwStyle ��
7 lpszIcon �
" dwContextHelpId ��
� lpfnMsgBoxCallback ���
" $ dwLanguageId �>
� ( tagMSGBOXPARAMSA .?AUtagMSGBOXPARAMSA@@ �� � $ V � _KEY_VALUE_LAYER_INFORMATION .?AU_KEY_VALUE_LAYER_INFORMATION@@ ��
" ��
" ��.
� IsTombstone ��
� Reserved �V � _KEY_VALUE_LAYER_INFORMATION .?AU_KEY_VALUE_LAYER_INFORMATION@@ �� � � f F � _PEBS_DS_SAVE_AREA32 .?AU_PEBS_DS_SAVE_AREA32@@ ��
�
� # " @ �"
" BtsBufferBase
" BtsIndex �
" BtsAbsoluteMaximum ���
" BtsInterruptThreshold
" PebsBufferBase ���
" PebsIndex
" PebsAbsoluteMaximum ��
" PebsInterruptThreshold ���
� PebsGpCounterReset ���
� ` PebsFixedCounterReset F
� � _PEBS_DS_SAVE_AREA32 .?AU_PEBS_DS_SAVE_AREA32@@ �� � � . � tagXFORM .?AUtagXFORM@@ ��b
@ eM11 �
@ eM12 �
@ eM21 �
@ eM22 �
@ eDx ��
@ eDy ��.
� tagXFORM .?AUtagXFORM@@ �� � N V � _ACTIVATION_CONTEXT_MSIX_INFO .?AU_ACTIVATION_CONTEXT_MSIX_INFO@@ q " �&
� ApplicationUserModelId ���V � _ACTIVATION_CONTEXT_MSIX_INFO .?AU_ACTIVATION_CONTEXT_MSIX_INFO@@ � L / J � _FILE_STAT_INFORMATION .?AU_FILE_STAT_INFORMATION@@ ��
} FileId ���
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( AllocationSize ���
} 0 EndOfFile
" 8 FileAttributes ���
" < ReparseTag ���
" @ NumberOfLinks
" D EffectiveAccess ��J � H _FILE_STAT_INFORMATION .?AU_FILE_STAT_INFORMATION@@ �� � I ^ � _PERFINFO_FILEOBJECT_INFORMATION .?AU_PERFINFO_FILEOBJECT_INFORMATION@@ ��
�
�
FileObject ���^ � _PERFINFO_FILEOBJECT_INFORMATION .?AU_PERFINFO_FILEOBJECT_INFORMATION@@ �� � � c f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W@@ ��
TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
q ServerCertificateSubject �
ProxyCredentials �
" NumberOfProxyAuthnSchemes
" ProxyAuthnSchemes f � $ _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W@@ ��. onecore\external\shared\inc\rpcdce.h ��� � � � F � tagPOINTER_TYPE_INFO .?AUtagPOINTER_TYPE_INFO@@ ��
�
� F � tagPOINTER_TOUCH_INFO .?AUtagPOINTER_TOUCH_INFO@@ B � tagPOINTER_PEN_INFO .?AUtagPOINTER_PEN_INFO@@ :
" type �
� touchInfo
� penInfo ��F � � tagPOINTER_TYPE_INFO .?AUtagPOINTER_TYPE_INFO@@ �� � H � DISPLAYCONFIG_TOPOLOGY_INTERNAL �� DISPLAYCONFIG_TOPOLOGY_CLONE � DISPLAYCONFIG_TOPOLOGY_EXTEND DISPLAYCONFIG_TOPOLOGY_EXTERNAL �� ��DISPLAYCONFIG_TOPOLOGY_FORCE_UINT32 �J t � DISPLAYCONFIG_TOPOLOGY_ID .?AW4DISPLAYCONFIG_TOPOLOGY_ID@@ � � � V � V � _FILE_ID_EXTD_DIR_INFORMATION .?AU_FILE_ID_EXTD_DIR_INFORMATION@@
�
� 6 � _FILE_ID_128 .?AU_FILE_ID_128@@ ��V
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
" D ReparsePointTag ��
� H FileId ���
X FileName �V � ` _FILE_ID_EXTD_DIR_INFORMATION .?AU_FILE_ID_EXTD_DIR_INFORMATION@@ � @ Z � _KAFFINITY_ENUMERATION_CONTEXT .?AU_KAFFINITY_ENUMERATION_CONTEXT@@ ��6 � _KAFFINITY_EX .?AU_KAFFINITY_EX@@
�
� F
� Affinity �
" CurrentMask ��
! CurrentIndex �Z � _KAFFINITY_ENUMERATION_CONTEXT .?AU_KAFFINITY_ENUMERATION_CONTEXT@@ ��* onecore\internal\sdk\inc\affinity.h � � s : � tagKERNINGPAIR .?AUtagKERNINGPAIR@@ ��B
! wFirst ���
! wSecond ��
t iKernAmount ��: � tagKERNINGPAIR .?AUtagKERNINGPAIR@@ �� � $ R � _UMS_SCHEDULER_STARTUP_INFO .?AU_UMS_SCHEDULER_STARTUP_INFO@@
�
�
� j
" UmsVersion ���
CompletionList ���
SchedulerProc
SchedulerParam ���R _UMS_SCHEDULER_STARTUP_INFO .?AU_UMS_SCHEDULER_STARTUP_INFO@@ 2 B � _WMI_PNP_RECORD_V3 .?AU_WMI_PNP_RECORD_V3@@ ��f
" IDLength �
" DescriptionLength
" FriendlyNameLength ���
Strings ��B _WMI_PNP_RECORD_V3 .?AU_WMI_PNP_RECORD_V3@@ �� � � b � _FILE_ID_EXTD_BOTH_DIR_INFORMATION .?AU_FILE_ID_EXTD_BOTH_DIR_INFORMATION@@ ��
� q " �
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
" D ReparsePointTag ��
� H FileId ���
p X ShortNameLength ��
Z ShortName
r FileName �b x _FILE_ID_EXTD_BOTH_DIR_INFORMATION .?AU_FILE_ID_EXTD_BOTH_DIR_INFORMATION@@ �� Q R � _PROCESS_HANDLE_INFORMATION .?AU_PROCESS_HANDLE_INFORMATION@@
� >
" HandleCount ��
" HandleCountHighWatermark �R _PROCESS_HANDLE_INFORMATION .?AU_PROCESS_HANDLE_INFORMATION@@ a # ^ � _EVENT_TRACE_SPINLOCK_INFORMATION .?AU_EVENT_TRACE_SPINLOCK_INFORMATION@@
� �
� EventTraceInformationClass ���
" SpinLockSpinThreshold
" SpinLockAcquireSampleRate
" SpinLockContentionSampleRate �
" SpinLockHoldThreshold ^ _EVENT_TRACE_SPINLOCK_INFORMATION .?AU_EVENT_TRACE_SPINLOCK_INFORMATION@@ � J � _TRACE_LOGFILE_HEADER64 .?AU_TRACE_LOGFILE_HEADER64@@
� f
MajorVersion �
MinorVersion �
SubVersion ���
SubMinorVersion ��: <anonymous-tag> .?AU<anonymous-tag>@@ � J � _TIME_ZONE_INFORMATION .?AU_TIME_ZONE_INFORMATION@@ ��.
" BufferSize ���
" Version ��
VersionDetail
" ProviderVersion ��
" NumberOfProcessors ���
} EndTime ��
" TimerResolution ��
" MaximumFileSize ��
" LogFileMode ��
" $ BuffersWritten ���
� ( LogInstanceGuid ��
" ( StartBuffers �
" , PointerSize ��
" 0 EventsLost ���
" 4 CpuSpeedInMHz
# 8 LoggerName ���
# @ LogFileName ��
H TimeZone �
} � BootTime �
} PerfFreq �
} StartTime
" ReservedFlags
" BuffersLost ��J ! _TRACE_LOGFILE_HEADER64 .?AU_TRACE_LOGFILE_HEADER64@@ " � B � _RESUME_PERFORMANCE .?AU_RESUME_PERFORMANCE@@
$
� Z
" PostTimeMs ���
# TotalResumeTimeMs
# ResumeCompleteTimestamp ��B & _RESUME_PERFORMANCE .?AU_RESUME_PERFORMANCE@@ ' ` � FpFormatFp32 � FpFormatFp64 � FpFormatFp80 � FpFormatFp128 FpFormatI16 �� FpFormatI32 �� FpFormatI64 �� FpFormatU16 �� FpFormatU32 �� FpFormatU64 ��
FpFormatCompare �� FpFormatString ���: t ) _FP__IEEE_FORMAT .?AW4_FP__IEEE_FORMAT@@ ���* onecore\internal\sdk\inc\ntxcapi.h � * + U J � _APP_MEMORY_INFORMATION .?AU_APP_MEMORY_INFORMATION@@
-
� ~
# AvailableCommit ��
# PrivateCommitUsage ���
# PeakPrivateCommitUsage ���
# TotalCommitUsage �J / _APP_MEMORY_INFORMATION .?AU_APP_MEMORY_INFORMATION@@ : onecore\external\sdk\inc\minwin\processthreadsapi.h 0 1 � B � tagWNODE_EVENT_ITEM .?AUtagWNODE_EVENT_ITEM@@
3
� 6 � _WNODE_HEADER .?AU_WNODE_HEADER@@
5 WnodeHeader ��B 6 0 tagWNODE_EVENT_ITEM .?AUtagWNODE_EVENT_ITEM@@ . onecore\external\shared\inc\wmistr.h ��� 7 8 J � _POWER_IDLE_RESILIENCY .?AU_POWER_IDLE_RESILIENCY@@ ��>
" CoalescingTimeout
" IdleResiliencyPeriod �J ; _POWER_IDLE_RESILIENCY .?AU_POWER_IDLE_RESILIENCY@@ �� < > PsProtectedSignerNone PsProtectedSignerAuthenticode PsProtectedSignerCodeGen � PsProtectedSignerAntimalware � PsProtectedSignerLsa � PsProtectedSignerWindows � PsProtectedSignerWinTcb �� PsProtectedSignerWinSystem ��� PsProtectedSignerApp � PsProtectedSignerMax �B
t > _PS_PROTECTED_SIGNER .?AW4_PS_PROTECTED_SIGNER@@ ��� ? a j J � _TOKEN_MANDATORY_POLICY .?AU_TOKEN_MANDATORY_POLICY@@
" Policy ���J B _TOKEN_MANDATORY_POLICY .?AU_TOKEN_MANDATORY_POLICY@@ C � V TokenUser TokenGroups �� TokenPrivileges �� TokenOwner ��� TokenPrimaryGroup TokenDefaultDacl � TokenSource �� TokenType TokenImpersonationLevel ��
TokenStatistics �� TokenRestrictedSids �� TokenSessionId ���
TokenGroupsAndPrivileges � TokenSessionReference TokenSandBoxInert TokenAuditPolicy � TokenOrigin �� TokenElevationType ��� TokenLinkedToken � TokenElevation ��� TokenHasRestrictions � TokenAccessInformation ��� TokenVirtualizationAllowed ��� TokenVirtualizationEnabled ��� TokenIntegrityLevel �� TokenUIAccess TokenMandatoryPolicy � TokenLogonSid TokenIsAppContainer �� TokenCapabilities TokenAppContainerSid � TokenAppContainerNumber �� ! TokenUserClaimAttributes � " TokenDeviceClaimAttributes ��� # TokenRestrictedUserClaimAttributes ��� $ TokenRestrictedDeviceClaimAttributes � % TokenDeviceGroups & TokenRestrictedDeviceGroups �� ' TokenSecurityAttributes �� ( TokenIsRestricted ) TokenProcessTrustLevel ��� * TokenPrivateNameSpace + TokenSingletonAttributes � , TokenBnoIsolation - TokenChildProcessFlags ��� . TokenIsLessPrivilegedAppContainer / TokenIsSandboxed � 0 TokenOriginatingProcessTrustLevel 1 MaxTokenInfoClass J 1 t E _TOKEN_INFORMATION_CLASS .?AW4_TOKEN_INFORMATION_CLASS@@ ��� F 8 : � tagEMRPOLYDRAW .?AUtagEMRPOLYDRAW@@ ��* � _POINTL .?AU_POINTL@@ I " � " �Z
emr ��
� rclBounds
" cptl �
J aptl �
K $ abTypes ��: L ( tagEMRPOLYDRAW .?AUtagEMRPOLYDRAW@@ �� M Q Z � _PROCESS_DEVICEMAP_INFORMATION .?AU_PROCESS_DEVICEMAP_INFORMATION@@ ��
DirectoryHandle ��: P <anonymous-tag> .?AU<anonymous-tag>@@ Q C " �*
" DriveMap �
S DriveType : T $ <anonymous-tag> .?AU<anonymous-tag>@@ U C "
Q Set ��
U Query Z W $ _PROCESS_DEVICEMAP_INFORMATION .?AU_PROCESS_DEVICEMAP_INFORMATION@@ �� X C z GEO_NATION ��� GEO_LATITUDE � GEO_LONGITUDE GEO_ISO2 � GEO_ISO3 � GEO_RFC1766 �� GEO_LCID � GEO_FRIENDLYNAME � GEO_OFFICIALNAME �
GEO_TIMEZONES GEO_OFFICIALLANGUAGES GEO_ISO_UN_NUMBER
GEO_PARENT ��� GEO_DIALINGCODE �� GEO_CURRENCYCODE � GEO_CURRENCYSYMBOL ��� GEO_NAME � GEO_ID ���. t Z SYSGEOTYPE .?AW4SYSGEOTYPE@@ ��� [ � > � _OVERLAPPED_ENTRY .?AU_OVERLAPPED_ENTRY@@
]
� 2 � _OVERLAPPED .?AU_OVERLAPPED@@
_
� r
" lpCompletionKey ��
` lpOverlapped �
" Internal �
" dwNumberOfBytesTransferred ���> a _OVERLAPPED_ENTRY .?AU_OVERLAPPED_ENTRY@@ 6 onecore\external\sdk\inc\minwin\minwinbase.h ��� b c B Z � _IMAGE_DYNAMIC_RELOCATION64_V2 .?AU_IMAGE_DYNAMIC_RELOCATION64_V2@@ ��n
" HeaderSize ���
" FixupInfoSize
# Symbol ���
" SymbolGroup ��
" Flags Z f _IMAGE_DYNAMIC_RELOCATION64_V2 .?AU_IMAGE_DYNAMIC_RELOCATION64_V2@@ �� g [ � B � tagBITMAPINFOHEADER .?AUtagBITMAPINFOHEADER@@
i
�
" biSize ���
biWidth ��
biHeight �
! biPlanes �
! biBitCount ���
" biCompression
" biSizeImage ��
biXPelsPerMeter ��
biYPelsPerMeter ��
" biClrUsed
" $ biClrImportant ���B k ( tagBITMAPINFOHEADER .?AUtagBITMAPINFOHEADER@@ l , Z � _SYSTEM_RESOURCE_ATTRIBUTE_ACE .?AU_SYSTEM_RESOURCE_ATTRIBUTE_ACE@@ ��2 � _ACE_HEADER .?AU_ACE_HEADER@@ :
o Header ���
" Mask �
" SidStart �Z p _SYSTEM_RESOURCE_ATTRIBUTE_ACE .?AU_SYSTEM_RESOURCE_ATTRIBUTE_ACE@@ �� q � R � _EVENT_TRACE_PROPERTIES_V2 .?AU_EVENT_TRACE_PROPERTIES_V2@@ ��
" ��N � _EVENT_FILTER_DESCRIPTOR .?AU_EVENT_FILTER_DESCRIPTOR@@ ��
u
�
" ��
" ��
" ��
" ���
5 Wnode
" 0 BufferSize ���
" 4 MinimumBuffers ���
" 8 MaximumBuffers ���
" < MaximumFileSize ��
" @ LogFileMode ��
" D FlushTimer ���
" H EnableFlags ��
L AgeLimit �
L FlushThreshold ���
" P NumberOfBuffers ��
" T FreeBuffers ��
" X EventsLost ���
" \ BuffersWritten ���
" ` LogBuffersLost ���
" d RealTimeBuffersLost ��
h LoggerThreadId ���
" l LogFileNameOffset
" p LoggerNameOffset �
t t VersionNumber
" t V2Control
" x FilterDescCount ��
v | FilterDesc ���
w � Wow ��
x � QpcDeltaTracking �
y � LargeMdlPages
z � ExcludeKernelStack ���
# � V2Options R { � _EVENT_TRACE_PROPERTIES_V2 .?AU_EVENT_TRACE_PROPERTIES_V2@@ �� | � z F � _ENUM_SERVICE_STATUSW .?AU_ENUM_SERVICE_STATUSW@@ : � _SERVICE_STATUS .?AU_SERVICE_STATUS@@ J
q lpServiceName
q lpDisplayName
ServiceStatus F � $ _ENUM_SERVICE_STATUSW .?AU_ENUM_SERVICE_STATUSW@@ � 3 � R � _PROCESS_MEMORY_ALLOCATION_MODE .?AT_PROCESS_MEMORY_ALLOCATION_MODE@@
" ��
" ��:
" Flags
� TopDown ��
� Reserved �R � _PROCESS_MEMORY_ALLOCATION_MODE .?AT_PROCESS_MEMORY_ALLOCATION_MODE@@ � a � > � _CM_PERF_COUNTERS .?AU_CM_PERF_COUNTERS@@ *
# OpenedKeys ���
# DelayCloseKCBs ���
# PrivateAllocPages
# PrivateAllocFree �
# PrivateAllocUsed �
# ( LookupCacheHit ���
# 0 LookupCacheMissFound �
# 8 LookupCacheMissNotFound ��
# @ ViewMap ��
# H ViewUnMap
# P HiveShrink ���> � X _CM_PERF_COUNTERS .?AU_CM_PERF_COUNTERS@@ � � 0 B � _EVENT_TRACE_HEADER .?AU_EVENT_TRACE_HEADER@@ 6
Type �
Level
! Version ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � � + N
! Size �
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��
" Version ��
� Class
" ThreadId �
" ProcessId
} TimeStamp
� Guid �
# GuidPtr ��
" ( KernelTime ���
" , UserTime �
# ( ProcessorTime
" ( ClientContext
" , Flags B � 0 _EVENT_TRACE_HEADER .?AU_EVENT_TRACE_HEADER@@ � � : � tagTEXTMETRICW .?AUtagTEXTMETRICW@@ ���
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
q , tmFirstChar ��
q . tmLastChar ���
q 0 tmDefaultChar
q 2 tmBreakChar ��
4 tmItalic �
5 tmUnderlined �
6 tmStruckOut ��
7 tmPitchAndFamily �
8 tmCharSet : � < tagTEXTMETRICW .?AUtagTEXTMETRICW@@ �� � � � BackTraceDatabaseCreate �� BackTraceDatabaseDelete �� BackTraceDatabaseFlush ��� BackTraceDatabaseMaxControl ��Z t � _RTL_STACK_TRACE_DATABASE_CONTROL .?AW4_RTL_STACK_TRACE_DATABASE_CONTROL@@ � � � � � FpCodeUnspecified FpCodeAdd FpCodeSubtract ��� FpCodeMultiply ��� FpCodeDivide � FpCodeSquareRoot � FpCodeRemainder �� FpCodeCompare FpCodeConvert FpCodeRound ��
FpCodeTruncate ��� FpCodeFloor �� FpCodeCeil ���
FpCodeAcos ��� FpCodeAsin ��� FpCodeAtan ��� FpCodeAtan2 �� FpCodeCabs ��� FpCodeCos FpCodeCosh ��� FpCodeExp FpCodeFabs ��� FpCodeFmod ��� FpCodeFrexp �� FpCodeHypot �� FpCodeLdexp �� FpCodeLog FpCodeLog10 �� FpCodeModf ��� FpCodePow FpCodeSin FpCodeSinh ��� FpCodeTan ! FpCodeTanh ��� " FpCodeY0 � # FpCodeY1 � $ FpCodeYn �F % t � _FP_IEEE_OPERATION_CODE .?AW4_FP_IEEE_OPERATION_CODE@@ � � + h R � _IMAGE_DELAYLOAD_DESCRIPTOR .?AU_IMAGE_DELAYLOAD_DESCRIPTOR@@
" ��
" ��N
" AllAttributes
� RvaBased �
� ReservedAttributes ���2 � <anonymous-tag> .?AT<anonymous-tag>@@ � [ �
� Attributes ���
" DllNameRVA ���
" ModuleHandleRVA ��
" ImportAddressTableRVA
" ImportNameTableRVA ���
" BoundImportAddressTableRVA ���
" UnloadInformationTableRVA
" TimeDateStamp R � _IMAGE_DELAYLOAD_DESCRIPTOR .?AU_IMAGE_DELAYLOAD_DESCRIPTOR@@ � [ � SystemVaTypeAll �� SystemVaTypeNonPagedPool � SystemVaTypePagedPool SystemVaTypeSystemCache �� SystemVaTypeSystemPtes ��� SystemVaTypeSessionSpace � SystemVaTypeMax ��6 t � _SYSTEM_VA_TYPE .?AW4_SYSTEM_VA_TYPE@@ � � �
: VRF_TRIAGE_CONTEXT_NONE �� VRF_TRIAGE_CONTEXT_DEFAULT ��� VRF_TRIAGE_CONTEXT_DEVELOPMENT ��� VRF_TRIAGE_CONTEXT_CERTIFICATION � VRF_TRIAGE_CONTEXT_FLIGHT_TARGETED ��� VRF_TRIAGE_CONTEXT_FLIGHT_DIAGNOSTICS VRF_TRIAGE_CONTEXT_FLIGHT_MONITORING � NUM_VRF_TRIAGE_CONTEXTS ��> t � _VRF_TRIAGE_CONTEXT .?AW4_VRF_TRIAGE_CONTEXT@@ � � � 6 � _PS_PKG_CLAIM .?AU_PS_PKG_CLAIM@@
" ��&
" Flags
� Origin ���6 � _PS_PKG_CLAIM .?AU_PS_PKG_CLAIM@@ � a j
R � _ETW_DISABLE_KTIMER2_EVENT .?AU_ETW_DISABLE_KTIMER2_EVENT@@ ��^
" TimerKey �
" DisableCallback ��
" DisableContextKey
Flags R � _ETW_DISABLE_KTIMER2_EVENT .?AU_ETW_DISABLE_KTIMER2_EVENT@@ �� � � � � SystemPixelFormatUnknown � SystemPixelFormatR8G8B8 �� SystemPixelFormatR8G8B8X8 SystemPixelFormatB8G8R8 �� SystemPixelFormatB8G8R8X8 B t � _SYSTEM_PIXEL_FORMAT .?AW4_SYSTEM_PIXEL_FORMAT@@ ��� � U
�
� " " �
� Data �j � _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET@@ �� � � � b FpCompareEqual ��� FpCompareGreater � FpCompareLess FpCompareUnordered ���F t � _FP_IEEE_COMPARE_RESULT .?AW4_FP_IEEE_COMPARE_RESULT@@ � � + J : � _ETW_LBR_ENTRY .?AU_ETW_LBR_ENTRY@@ ��B
FromAddress ��
ToAddress
Reserved �: � _ETW_LBR_ENTRY .?AU_ETW_LBR_ENTRY@@ �� � � R � _FILE_FS_DEVICE_INFORMATION .?AU_FILE_FS_DEVICE_INFORMATION@@
�
� 6
" DeviceType ���
" Characteristics ��R � _FILE_FS_DEVICE_INFORMATION .?AU_FILE_FS_DEVICE_INFORMATION@@ � � R � _FILE_FS_VOLUME_INFORMATION .?AU_FILE_FS_VOLUME_INFORMATION@@ �
} VolumeCreationTime ���
" VolumeSerialNumber ���
" VolumeLabelLength
SupportsObjects ��
VolumeLabel ��R � _FILE_FS_VOLUME_INFORMATION .?AU_FILE_FS_VOLUME_INFORMATION@@ � � SmallBusiness Enterprise ��� BackOffice ��� CommunicationServer �� TerminalServer ��� SmallBusinessRestricted �� EmbeddedNT ��� DataCenter ��� SingleUserTS � Personal �
Blade EmbeddedRestricted ��� SecurityAppliance
StorageServer ComputeServer WHServer � PhoneNT �� MultiUserTS �� MaxSuiteType �. t � _SUITE_TYPE .?AW4_SUITE_TYPE@@ � � � & MemExtendedParameterInvalidType �� MemExtendedParameterAddressRequirements �� MemExtendedParameterNumaNode � MemExtendedParameterPartitionHandle �� MemExtendedParameterUserPhysicalHandle ��� MemExtendedParameterAttributeFlags ��� MemExtendedParameterMax ��N t � MEM_EXTENDED_PARAMETER_TYPE .?AW4MEM_EXTENDED_PARAMETER_TYPE@@ � � ? � � PnpQueryEjectRelations ��� PnpQueryRemovalRelations � PnpQueryPowerRelations ��� PnpQueryBusRelations � PnpQueryTransportRelations ��� MaxPnpQueryRelations �> t � _PNP_QUERY_RELATION .?AW4_PNP_QUERY_RELATION@@ � � � � 6 � _CM_ROM_BLOCK .?AU_CM_ROM_BLOCK@@
�
� &
" Address ��
" Size �6 � _CM_ROM_BLOCK .?AU_CM_ROM_BLOCK@@ � � � B � _LOAD_ASDATA_TABLE .?AU_LOAD_ASDATA_TABLE@@ ��
Module ���
q FilePath �
" Size �
Handle ���
RefCount �
� EntryPointActivationContext ��B � _LOAD_ASDATA_TABLE .?AU_LOAD_ASDATA_TABLE@@ �� � u P v EDIT_CONTROL_FEATURE_ENTERPRISE_DATA_PROTECTION_PASTE_SUPPORT EDIT_CONTROL_FEATURE_PASTE_NOTIFICATIONS �B t � EDIT_CONTROL_FEATURE .?AW4EDIT_CONTROL_FEATURE@@ ��� �
, F � _RTL_TRACE_ENUMERATE .?AU_RTL_TRACE_ENUMERATE@@ ��
�
� B � _RTL_TRACE_DATABASE .?AU_RTL_TRACE_DATABASE@@
�
� > � _RTL_TRACE_BLOCK .?AU_RTL_TRACE_BLOCK@@ ��
�
� 6
� Database �
" Index
� Block F � _RTL_TRACE_ENUMERATE .?AU_RTL_TRACE_ENUMERATE@@ �� � � ( J � _DUPLICATE_EXTENTS_DATA .?AU_DUPLICATE_EXTENTS_DATA@@
�
� f
FileHandle ���
} SourceFileOffset �
} TargetFileOffset �
} ByteCount J � _DUPLICATE_EXTENTS_DATA .?AU_DUPLICATE_EXTENTS_DATA@@ � O V � _IMAGE_ARCHIVE_MEMBER_HEADER .?AU_IMAGE_ARCHIVE_MEMBER_HEADER@@ �� " � " � " � "
�~
� Name �
� Date �
� UserID ���
� " GroupID ��
� ( Mode �
� 0 Size �
� : EndHeader V � < _IMAGE_ARCHIVE_MEMBER_HEADER .?AU_IMAGE_ARCHIVE_MEMBER_HEADER@@ �� � [ U > � _WIN32_FIND_DATAA .?AU_WIN32_FIND_DATAA@@
�
� . � _FILETIME .?AU_FILETIME@@ p " � p " �
" dwFileAttributes �
� ftCreationTime ���
� ftLastAccessTime �
� ftLastWriteTime ��
" nFileSizeHigh
" nFileSizeLow �
" $ dwReserved0 ��
" ( dwReserved1 ��
� , cFileName
� 0cAlternateFileName ���>
� @_WIN32_FIND_DATAA .?AU_WIN32_FIND_DATAA@@ � c f B � _EXCEPTION_POINTERS .?AU_EXCEPTION_POINTERS@@
�
"
� ~ � _IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@
�
" ��
" ��
"
��N
PageRelativeOffset ���
IndirectCall �
IATIndex �~ _IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@ [ � V � _TRANSACTION_ENLISTMENT_PAIR .?AU_TRANSACTION_ENLISTMENT_PAIR@@ ��6
� EnlistmentId �
� ResourceManagerId V _TRANSACTION_ENLISTMENT_PAIR .?AU_TRANSACTION_ENLISTMENT_PAIR@@ �� � F � _PROCESSOR_GROUP_INFO .?AU_PROCESSOR_GROUP_INFO@@
� " & �v
MaximumProcessorCount
ActiveProcessorCount �
Reserved �
" ( ActiveProcessorMask ��F , _PROCESSOR_GROUP_INFO .?AU_PROCESSOR_GROUP_INFO@@ { 5 B � PPM_WMI_IDLE_STATES .?AUPPM_WMI_IDLE_STATES@@
� B � PPM_WMI_IDLE_STATE .?AUPPM_WMI_IDLE_STATE@@ �� " �z
" Type �
" Count
" TargetState ��
" OldState �
# TargetProcessors �
State B 8 PPM_WMI_IDLE_STATES .?AUPPM_WMI_IDLE_STATES@@ � N � _TRACE_ENABLE_CONTEXT_EX .?AU_TRACE_ENABLE_CONTEXT_EX@@ ��
! LoggerId �
Level
InternalFlag �
" EnableFlags ��
" EnableFlagsHigh ��
" Reserved �N _TRACE_ENABLE_CONTEXT_EX .?AU_TRACE_ENABLE_CONTEXT_EX@@ ��2 onecore\internal\sdk\inc\minwin\ntwmi_x.h �� ! " > V � _PERFINFO_PPM_IDLE_STATE_EXIT .?AU_PERFINFO_PPM_IDLE_STATE_EXIT@@
$
� &
" State
" Status ���V & _PERFINFO_PPM_IDLE_STATE_EXIT .?AU_PERFINFO_PPM_IDLE_STATE_EXIT@@ ' � ' R � _EVENT_INSTANCE_GUID_HEADER .?AU_EVENT_INSTANCE_GUID_HEADER@@ 6
Type �
Level
! Version ��: * <anonymous-tag> .?AU<anonymous-tag>@@ + � �
! Size �
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��
" Version ��
+ Class
" ThreadId �
" ProcessId
} TimeStamp
� Guid �
# GuidPtr ��
" ( ClientContext
" , Flags
" ( KernelTime ���
" , UserTime �
# ( ProcessorTime
" 0 InstanceId ���
" 4 ParentInstanceId �
� 8 ParentGuid ���R - H _EVENT_INSTANCE_GUID_HEADER .?AU_EVENT_INSTANCE_GUID_HEADER@@ . � F � tagEMRSETARCDIRECTION .?AUtagEMRSETARCDIRECTION@@
0
� *
emr ��
" iArcDirection F 2 tagEMRSETARCDIRECTION .?AUtagEMRSETARCDIRECTION@@ 3 } J � _REDIRECTION_DESCRIPTOR .?AU_REDIRECTION_DESCRIPTOR@@ ^ � _REDIRECTION_FUNCTION_DESCRIPTOR .?AU_REDIRECTION_FUNCTION_DESCRIPTOR@@ ��
6 ��
7
� F
" Version ��
" FunctionCount
8 Redirections �J 9 _REDIRECTION_DESCRIPTOR .?AU_REDIRECTION_DESCRIPTOR@@ 6 onecore\external\sdk\inc\minwin\libloaderapi.h � : ; f Z � _RTL_RETPOLINE_RELOCATION_INDEX .?AU_RTL_RETPOLINE_RELOCATION_INDEX@@
=
� ~ � _IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@ ��v � _IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION .?AU_IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION@@ ��>
Import ���
? Indir
@ SwitchJump ���2 A <anonymous-tag> .?AT<anonymous-tag>@@ B � e �
! ImportRelocationSize �
! IndirectRelocationSize ���
! SwitchJumpRelocationSize �
! StraddleType �
B StraddleReloc Z D _RTL_RETPOLINE_RELOCATION_INDEX .?AU_RTL_RETPOLINE_RELOCATION_INDEX@@ E � ` b � _SYSTEM_PHYSICAL_MEMORY_INFORMATION .?AU_SYSTEM_PHYSICAL_MEMORY_INFORMATION@@
G
� f
# TotalPhysicalBytes ���
# LowestPhysicalAddress
# HighestPhysicalAddress ���b I _SYSTEM_PHYSICAL_MEMORY_INFORMATION .?AU_SYSTEM_PHYSICAL_MEMORY_INFORMATION@@ J � z PsEnergyComponentTypeCpu � PsEnergyComponentTypeStorage � PsEnergyComponentTypeNetwork � PsEnergyComponentTypeMBB � PsEnergyComponentTypeForegroundTime �� PsEnergyComponentTypeDesktopVisibleTime �� PsEnergyComponentTypeWindowResource �� PsEnergyComponentTypeCompositorResource �� PsEnergyComponentTypeTrackingState ��� PsEnergyComponentTypeInput ���
PsEnergyComponentTypeAudioIn � PsEnergyComponentTypeAudioOut PsEnergyComponentTypeDisplayRequired �
PsEnergyComponentTypeKeyboardInput ��� PsEnergyComponentTypeMouseInput �� PsEnergyComponentTypeMax �^ t L _PROCESS_ENERGY_COMPONENT_TYPE_NUM .?AW4_PROCESS_ENERGY_COMPONENT_TYPE_NUM@@ ��� M a � 6 � _WMI_FILE_IO .?AU_WMI_FILE_IO@@ ��.
FileObject ���
FileName �6 P _WMI_FILE_IO .?AU_WMI_FILE_IO@@ �� Q � j � _MEMORY_PARTITION_TRANSFER_INFORMATION .?AU_MEMORY_PARTITION_TRANSFER_INFORMATION@@ ��
S
� >
" NumberOfPages
" NumaNode �
" Flags j U _MEMORY_PARTITION_TRANSFER_INFORMATION .?AU_MEMORY_PARTITION_TRANSFER_INFORMATION@@ �� V � N � _MUTANT_OWNER_INFORMATION .?AU_MUTANT_OWNER_INFORMATION@@
� ClientId �N Y _MUTANT_OWNER_INFORMATION .?AU_MUTANT_OWNER_INFORMATION@@ Z 8 ^ � _PERFINFO_PPM_THERMAL_CONSTRAINT .?AU_PERFINFO_PPM_THERMAL_CONSTRAINT@@ ��2
" Constraint ���
# Processors ���^ ] _PERFINFO_PPM_THERMAL_CONSTRAINT .?AU_PERFINFO_PPM_THERMAL_CONSTRAINT@@ �� ^ � Z : � tagPAINTSTRUCT .?AUtagPAINTSTRUCT@@ ��& � HDC__ .?AUHDC__@@
a
� " �~
b hdc ��
t fErase ���
� rcPaint ��
t fRestore �
t fIncUpdate ���
c rgbReserved ��: d @ tagPAINTSTRUCT .?AUtagPAINTSTRUCT@@ �� e k V � _REQUEST_OPLOCK_OUTPUT_BUFFER .?AU_REQUEST_OPLOCK_OUTPUT_BUFFER@@ �
! StructureVersion �
! StructureLength ��
" OriginalOplockLevel ��
" NewOplockLevel ���
" Flags
" AccessMode ���
! ShareMode V h _REQUEST_OPLOCK_OUTPUT_BUFFER .?AU_REQUEST_OPLOCK_OUTPUT_BUFFER@@ i � EtwCoverageSamplerCreateInformation �� EtwCoverageSamplerQueryInformation ��� EtwCoverageSamplerBloomInformation ��� EtwCoverageSamplerPerfInformation EtwCoverageSamplerStatusInformation �� MaxEtwCoverageSamplerInfoClass ���f t k _ETW_COVERAGE_SAMPLER_INFORMATION_CLASS .?AW4_ETW_COVERAGE_SAMPLER_INFORMATION_CLASS@@ � l � � . � _FLS_DATA .?AU_FLS_DATA@@ " �"
� Entry
o Slots . p _FLS_DATA .?AU_FLS_DATA@@ q L �
Z � _FILE_REPARSE_POINT_INFORMATION .?AU_FILE_REPARSE_POINT_INFORMATION@@
s
� *
FileReference
" Tag ��Z u _FILE_REPARSE_POINT_INFORMATION .?AU_FILE_REPARSE_POINT_INFORMATION@@ v s N � tagWNODE_SINGLE_INSTANCE .?AUtagWNODE_SINGLE_INSTANCE@@ �� " �
5 WnodeHeader ��
" 0 OffsetInstanceName ���
" 4 InstanceIndex
" 8 DataBlockOffset ��
" < SizeDataBlock
y @ VariableData �N z @ tagWNODE_SINGLE_INSTANCE .?AUtagWNODE_SINGLE_INSTANCE@@ �� { 8 � 2 � _TRIVERTEX .?AU_TRIVERTEX@@ ��
}
� Z
x
y
! Red ��
!
Green
! Blue �
! Alpha 2 _TRIVERTEX .?AU_TRIVERTEX@@ �� � # j � _PROCESS_MITIGATION_POLICY_INFORMATION .?AU_PROCESS_MITIGATION_POLICY_INFORMATION@@ ��R ProcessDEPPolicy � ProcessASLRPolicy ProcessDynamicCodePolicy � ProcessStrictHandleCheckPolicy ��� ProcessSystemCallDisablePolicy ��� ProcessMitigationOptionsMask � ProcessExtensionPointDisablePolicy ��� ProcessControlFlowGuardPolicy ProcessSignaturePolicy ��� ProcessFontDisablePolicy �
ProcessImageLoadPolicy ��� ProcessSystemCallFilterPolicy ProcessPayloadRestrictionPolicy ��
ProcessChildProcessPolicy ProcessSideChannelIsolationPolicy ProcessUserShadowStackPolicy � MaxProcessMitigationPolicy ���N t � _PROCESS_MITIGATION_POLICY .?AW4_PROCESS_MITIGATION_POLICY@@ ��� � C & Z � _PROCESS_MITIGATION_ASLR_POLICY .?AU_PROCESS_MITIGATION_ASLR_POLICY@@ z � _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ ��z � _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ �� � _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ ��j � _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY .?AU_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY@@ v � _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@ r � _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY@@ j � _PROCESS_MITIGATION_FONT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_FONT_DISABLE_POLICY@@ f � _PROCESS_MITIGATION_IMAGE_LOAD_POLICY .?AU_PROCESS_MITIGATION_IMAGE_LOAD_POLICY@@ v � _PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY@@ z � _PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ ��n � _PROCESS_MITIGATION_CHILD_PROCESS_POLICY .?AU_PROCESS_MITIGATION_CHILD_PROCESS_POLICY@@ ��~ � _PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY .?AU_PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY@@ v � _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY@@ ���
� Policy ���
� ASLRPolicy ���
� StrictHandleCheckPolicy ��
� SystemCallDisablePolicy ��
� ExtensionPointDisablePolicy ��
� DynamicCodePolicy
� ControlFlowGuardPolicy ���
� SignaturePolicy ��
� FontDisablePolicy
� ImageLoadPolicy ��
� SystemCallFilterPolicy ���
� PayloadRestrictionPolicy �
� ChildProcessPolicy ���
� SideChannelIsolationPolicy ���
� UserShadowStackPolicy j � _PROCESS_MITIGATION_POLICY_INFORMATION .?AU_PROCESS_MITIGATION_POLICY_INFORMATION@@ �� � a " � FilterBootOptionOperationOpenSystemStore � FilterBootOptionOperationSetElement �� FilterBootOptionOperationDeleteElement ��� FilterBootOptionOperationMax �R t � _FILTER_BOOT_OPTION_OPERATION .?AW4_FILTER_BOOT_OPTION_OPERATION@@ � � ] � B � tagENUMLOGFONTEXDVA .?AUtagENUMLOGFONTEXDVA@@ > � tagENUMLOGFONTEXA .?AUtagENUMLOGFONTEXA@@ : � tagDESIGNVECTOR .?AUtagDESIGNVECTOR@@ :
� elfEnumLogfontEx �
� � elfDesignVector ��B � tagENUMLOGFONTEXDVA .?AUtagENUMLOGFONTEXDVA@@ � P . � _COMMPROP .?AU_COMMPROP@@ �
! wPacketLength
! wPacketVersion ���
" dwServiceMask
" dwReserved1 ��
" dwMaxTxQueue �
" dwMaxRxQueue �
" dwMaxBaud
" dwProvSubType
" dwProvCapabilities ���
" dwSettableParams �
" $ dwSettableBaud ���
! ( wSettableData
! * wSettableStopParity ��
" , dwCurrentTxQueue �
" 0 dwCurrentRxQueue �
" 4 dwProvSpec1 ��
" 8 dwProvSpec2 ��
< wcProvChar ���. � @ _COMMPROP .?AU_COMMPROP@@ � � � FileFsVolumeInformation �� FileFsLabelInformation ��� FileFsSizeInformation FileFsDeviceInformation �� FileFsAttributeInformation ��� FileFsControlInformation � FileFsFullSizeInformation FileFsObjectIdInformation FileFsDriverPathInformation ��
FileFsVolumeFlagsInformation � FileFsSectorSizeInformation �� FileFsDataCopyInformation
FileFsMetadataSizeInformation FileFsFullSizeInformationEx �� FileFsMaximumInformation �2 t � _FSINFOCLASS .?AW4_FSINFOCLASS@@ ��� � � �
�
� JOB_OBJECT_IO_RATE_CONTROL_ENABLE JOB_OBJECT_IO_RATE_CONTROL_STANDALONE_VOLUME � JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ALL � JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ON_SOFT_CAP � JOB_OBJECT_IO_RATE_CONTROL_VALID_FLAGS ���Z t � JOB_OBJECT_IO_RATE_CONTROL_FLAGS .?AW4JOB_OBJECT_IO_RATE_CONTROL_FLAGS@@ ��� � C N N � _SERVICE_PRESHUTDOWN_INFO .?AU_SERVICE_PRESHUTDOWN_INFO@@ "
" dwPreshutdownTimeout �N � _SERVICE_PRESHUTDOWN_INFO .?AU_SERVICE_PRESHUTDOWN_INFO@@ � 3 e � EtwQueryPartitionInformation � EtwQueryPartitionInformationV2 ��� EtwQueryLastDroppedTimes � EtwQueryProcessHandleInfoMax �R t � _ETW_PROCESS_HANDLE_INFO_TYPE .?AW4_ETW_PROCESS_HANDLE_INFO_TYPE@@ � � � w . LT_DONT_CARE � LT_LOWEST_LATENCY 2 t � LATENCY_TIME .?AW4LATENCY_TIME@@ ��� � - � MmEtwWorkingSetTypeUser �� MmEtwWorkingSetTypeSession ��� MmEtwWorkingSetTypeSystem MmEtwWorkingSetTypeMaximum ���J t � _MM_ETW_WORKING_SET_TYPE .?AW4_MM_ETW_WORKING_SET_TYPE@@ ��� � ; : � _RPC_CLIENT_ID .?AU_RPC_CLIENT_ID@@ ��2
" UniqueProcess
" UniqueThread �: � _RPC_CLIENT_ID .?AU_RPC_CLIENT_ID@@ ��: onecore\admin\wmi\events\idl\elf\objfre\i386\elf.h � � � Q 6 FeatureConfigurationPriorityImageDefault � FeatureConfigurationPriorityService �� FeatureConfigurationPriorityUser �
FeatureConfigurationPriorityUserPolicy ��� FeatureConfigurationPriorityTest � FeatureConfigurationPriorityImageOverride FeatureConfigurationPriorityMax ��^ t � _RTL_FEATURE_CONFIGURATION_PRIORITY .?AW4_RTL_FEATURE_CONFIGURATION_PRIORITY@@ � � � 6 ^ Compatible ��� TypeA TypeB TypeC TypeF MaximumDmaSpeed ��. t � _DMA_SPEED .?AW4_DMA_SPEED@@ ��� � �+ � AuditPrivilegeObject � AuditPrivilegeService AuditAccessCheck � AuditOpenObject �� AuditOpenObjectWithTransaction ��� AuditCloseObject � AuditDeleteObject AuditOpenObjectForDelete � AuditOpenObjectForDeleteWithTransaction �� AuditCloseNonObject ��
AuditOpenNonObject ��� AuditObjectReference � AuditHandleCreation ��>
t � _SE_AUDIT_OPERATION .?AW4_SE_AUDIT_OPERATION@@ � � B � tagIMEMENUITEMINFOA .?AUtagIMEMENUITEMINFOA@@ p " P �
u cbSize ���
u fType
u fState ���
u wID ��
hbmpChecked ��
hbmpUnchecked
" dwItemData ���
� szString �
l hbmpItem �B � p tagIMEMENUITEMINFOA .?AUtagIMEMENUITEMINFOA@@ � E � ^ � _APPLICATIONLAUNCH_SETTING_VALUE .?AU_APPLICATIONLAUNCH_SETTING_VALUE@@ ��J
} ActivationTime ���
" Flags
" ButtonInstanceID �^ � _APPLICATIONLAUNCH_SETTING_VALUE .?AU_APPLICATIONLAUNCH_SETTING_VALUE@@ �� � � b � _LDR_DLL_UNLOADED_NOTIFICATION_DATA .?AU_LDR_DLL_UNLOADED_NOTIFICATION_DATA@@
�
�
� ��
�
� n
" Flags
� FullDllName ��
� BaseDllName ��
DllBase ��
" SizeOfImage ��b � _LDR_DLL_UNLOADED_NOTIFICATION_DATA .?AU_LDR_DLL_UNLOADED_NOTIFICATION_DATA@@ � u �
�
� R � _FILE_REMOTE_PROTOCOL_INFO .?AU_FILE_REMOTE_PROTOCOL_INFO@@ ��
� Reserved �: � <anonymous-tag> .?AU<anonymous-tag>@@ � u#
" Capabilities �: � <anonymous-tag> .?AU<anonymous-tag>@@ � �# 2
" Capabilities �
" CachingFlags �: � <anonymous-tag> .?AU<anonymous-tag>@@ � �# &
� Server ���
� Share : � <anonymous-tag> .?AU<anonymous-tag>@@ � �# " " @ �&
� Smb2 �
� Reserved �2 � @ <anonymous-tag> .?AT<anonymous-tag>@@ � �#
! StructureVersion �
! StructureSize
" Protocol �
! ProtocolMajorVersion �
!
ProtocolMinorVersion �
! ProtocolRevision �
! Reserved �
" Flags
� GenericReserved ��
� 4 ProtocolSpecific �R
� t _FILE_REMOTE_PROTOCOL_INFO .?AU_FILE_REMOTE_PROTOCOL_INFO@@ �� � c# n TransactionOutcomeUndetermined ��� TransactionOutcomeCommitted �� TransactionOutcomeAborted B t � _TRANSACTION_OUTCOME .?AW4_TRANSACTION_OUTCOME@@ ��� � � � � ��LdrModulesMerged ��LdrModulesInitError � ��LdrModulesSnapError � ��LdrModulesUnloaded �� ��LdrModulesUnloading � LdrModulesPlaceHolder LdrModulesMapping LdrModulesMapped � LdrModulesWaitingForDependencies � LdrModulesSnapping ��� LdrModulesSnapped LdrModulesCondensed �� LdrModulesReadyToInit LdrModulesInitializing ��� LdrModulesReadyToRun �6 t � _LDR_DDAG_STATE .?AW4_LDR_DDAG_STATE@@ � � u n F � tagEMRPOLYPOLYLINE16 .?AUtagEMRPOLYPOLYLINE16@@ ��
�
� " " �. � tagPOINTS .?AUtagPOINTS@@ � " �r
emr ��
� rclBounds
" nPolys ���
" cpts �
� aPolyCounts ��
� $ apts �F � ( tagEMRPOLYPOLYLINE16 .?AUtagEMRPOLYPOLYLINE16@@ �� � n . � _TP_TASK .?AU_TP_TASK@@ ��B � _TP_TASK_CALLBACKS .?AU_TP_TASK_CALLBACKS@@ ��
� ��
�
� Z
� Callbacks
" NumaNode �
IdealProcessor ���
� ListEntry . � _TP_TASK .?AU_TP_TASK@@ �� � � � ^ ToleranceIntervalShort ��� ToleranceIntervalMedium �� ToleranceIntervalLong n t _JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL .?AW4_JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL@@ ��� C � � SE_VALIDATE_MAPPING_HEADER_ONLY �� SE_VALIDATE_MAPPING_ENTIRE_IMAGE � SE_VALIDATE_MAPPING_ENTIRE_IMAGE_CLEAN ���J t _SE_VALIDATE_MAPPING_TYPE .?AW4_SE_VALIDATE_MAPPING_TYPE@@ � ] � WinNullSid ��� WinWorldSid �� WinLocalSid �� WinCreatorOwnerSid ��� WinCreatorGroupSid ��� WinCreatorOwnerServerSid � WinCreatorGroupServerSid � WinNtAuthoritySid WinDialupSid � WinNetworkSid
WinBatchSid �� WinInteractiveSid WinServiceSid
WinAnonymousSid �� WinProxySid �� WinEnterpriseControllersSid �� WinSelfSid ��� WinAuthenticatedUserSid �� WinRestrictedCodeSid � WinTerminalServerSid � WinRemoteLogonIdSid �� WinLogonIdsSid ��� WinLocalSystemSid WinLocalServiceSid ��� WinNetworkServiceSid � WinBuiltinDomainSid �� WinBuiltinAdministratorsSid �� WinBuiltinUsersSid ��� WinBuiltinGuestsSid �� WinBuiltinPowerUsersSid �� WinBuiltinAccountOperatorsSid WinBuiltinSystemOperatorsSid � WinBuiltinPrintOperatorsSid �� ! WinBuiltinBackupOperatorsSid � " WinBuiltinReplicatorSid �� # WinBuiltinPreWindows2000CompatibleAccessSid �� $ WinBuiltinRemoteDesktopUsersSid �� % WinBuiltinNetworkConfigurationOperatorsSid ��� & WinAccountAdministratorSid ��� ' WinAccountGuestSid ��� ( WinAccountKrbtgtSid �� ) WinAccountDomainAdminsSid * WinAccountDomainUsersSid � + WinAccountDomainGuestsSid , WinAccountComputersSid ��� - WinAccountControllersSid � . WinAccountCertAdminsSid �� / WinAccountSchemaAdminsSid 0 WinAccountEnterpriseAdminsSid 1 WinAccountPolicyAdminsSid 2 WinAccountRasAndIasServersSid 3 WinNTLMAuthenticationSid � 4 WinDigestAuthenticationSid ��� 5 WinSChannelAuthenticationSid � 6 WinThisOrganizationSid ��� 7 WinOtherOrganizationSid �� 8 WinBuiltinIncomingForestTrustBuildersSid � 9 WinBuiltinPerfMonitoringUsersSid � : WinBuiltinPerfLoggingUsersSid ; WinBuiltinAuthorizationAccessSid � < WinBuiltinTerminalServerLicenseServersSid = WinBuiltinDCOMUsersSid ��� > WinBuiltinIUsersSid �� ? WinIUserSid �� @ WinBuiltinCryptoOperatorsSid � A WinUntrustedLabelSid � B WinLowLabelSid ��� C WinMediumLabelSid D WinHighLabelSid �� E WinSystemLabelSid F WinWriteRestrictedCodeSid G WinCreatorOwnerRightsSid � H WinCacheablePrincipalsGroupSid ��� I WinNonCacheablePrincipalsGroupSid J WinEnterpriseReadonlyControllersSid �� K WinAccountReadonlyControllersSid � L WinBuiltinEventLogReadersGroup ��� M WinNewEnterpriseReadonlyControllersSid ��� N WinBuiltinCertSvcDComAccessGroup � O WinMediumPlusLabelSid P WinLocalLogonSid � Q WinConsoleLogonSid ��� R WinThisOrganizationCertificateSid S WinApplicationPackageAuthoritySid T WinBuiltinAnyPackageSid �� U WinCapabilityInternetClientSid ��� V WinCapabilityInternetClientServerSid � W WinCapabilityPrivateNetworkClientServerSid ��� X WinCapabilityPicturesLibrarySid �� Y WinCapabilityVideosLibrarySid Z WinCapabilityMusicLibrarySid � [ WinCapabilityDocumentsLibrarySid � \ WinCapabilitySharedUserCertificatesSid ��� ] WinCapabilityEnterpriseAuthenticationSid � ^ WinCapabilityRemovableStorageSid � _ WinBuiltinRDSRemoteAccessServersSid �� ` WinBuiltinRDSEndpointServersSid �� a WinBuiltinRDSManagementServersSid b WinUserModeDriversSid c WinBuiltinHyperVAdminsSid d WinAccountCloneableControllersSid e WinBuiltinAccessControlAssistanceOperatorsSid f WinBuiltinRemoteManagementUsersSid ��� g WinAuthenticationAuthorityAssertedSid h WinAuthenticationServiceAssertedSid �� i WinLocalAccountSid ��� j WinLocalAccountAndAdministratorSid ��� k WinAccountProtectedUsersSid �� l WinCapabilityAppointmentsSid � m WinCapabilityContactsSid � n WinAccountDefaultSystemManagedSid o WinBuiltinDefaultSystemManagedGroupSid ��� p WinBuiltinStorageReplicaAdminsSid q WinAccountKeyAdminsSid ��� r WinAccountEnterpriseKeyAdminsSid � s WinAuthenticationKeyTrustSid � t WinAuthenticationKeyPropertyMFASid ��� u WinAuthenticationKeyPropertyAttestationSid ��� v WinAuthenticationFreshKeyAuthSid � w WinBuiltinDeviceOwnersSid > x t WELL_KNOWN_SID_TYPE .?AW4WELL_KNOWN_SID_TYPE@@ � � R TpTraceThreadPriority TpTraceThreadAffinity MaxTpTraceType ���6 t
_TP_TRACE_TYPE .?AW4_TP_TRACE_TYPE@@ ��� � u N � _CM_INT13_DRIVE_PARAMETER .?AU_CM_INT13_DRIVE_PARAMETER@@ z
! DriveSelect ��
" MaxCylinders �
! SectorsPerTrack ��
! MaxHeads �
!
NumberDrives �N _CM_INT13_DRIVE_PARAMETER .?AU_CM_INT13_DRIVE_PARAMETER@@ � � : � tagCURSORSHAPE .?AUtagCURSORSHAPE@@ ��
t xHotSpot �
t yHotSpot �
t cx ���
t cy ���
t cbWidth ��
Planes ���
BitsPixel : tagCURSORSHAPE .?AUtagCURSORSHAPE@@ �� * 6 � tagCWPSTRUCT .?AUtagCWPSTRUCT@@ ��
� N
lParam ���
u wParam ���
u message ��
y hwnd �6 tagCWPSTRUCT .?AUtagCWPSTRUCT@@ �� . . � _WGLSWAP .?AU_WGLSWAP@@ ��&
b hdc ��
u uiFlags ��. _WGLSWAP .?AU_WGLSWAP@@ �� � . � _STRING64 .?AU_STRING64@@
� B
! Length ���
! MaximumLength
# Buffer ���. _STRING64 .?AU_STRING64@@ ! � ~ � _RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ ��
#
� q " ��
N EnableExportAddressFilter
N EnableExportAddressFilterPlus
N EnableImportAddressFilter
N EnableRopStackPivot ��
N EnableRopCallerCheck �
N ( EnableRopSimExec �
% 0 EafPlusModuleList ~ & 0_RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ �� ' � � B � _SD_ENUM_SDS_INPUT .?AU_SD_ENUM_SDS_INPUT@@ ��>
# StartingOffset ���
# MaxSDEntriesToReturn �B * _SD_ENUM_SDS_INPUT .?AU_SD_ENUM_SDS_INPUT@@ �� + � N � _RTL_QUERY_REGISTRY_TABLE .?AU_RTL_QUERY_REGISTRY_TABLE@@ q " " /
0
� �
1 QueryRoutine �
" Flags
q Name �
EntryContext �
" DefaultType ��
DefaultData ��
" DefaultLength N 2 _RTL_QUERY_REGISTRY_TABLE .?AU_RTL_QUERY_REGISTRY_TABLE@@ 3 ( � R � _HEAP_SUBSEGMENT_ACTIVATED .?AU_HEAP_SUBSEGMENT_ACTIVATED@@ ��F
� Header ���
HeapHandle ���
$ SubSegment ���R 6 ( _HEAP_SUBSEGMENT_ACTIVATED .?AU_HEAP_SUBSEGMENT_ACTIVATED@@ �� 7 � � 6 � tagEMRBITBLT .?AUtagEMRBITBLT@@ ��
9
� 2
emr ��
� rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
� 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc 6 ; d tagEMRBITBLT .?AUtagEMRBITBLT@@ �� < � J � _PARSE_MESSAGE_CONTEXT .?AU_PARSE_MESSAGE_CONTEXT@@ ��
>
� ~
" fFlags ���
" cwSavColumn ��
" iwSrc
" iwDst
" iwDstSpace ���
p lpvArgStart ��J @ _PARSE_MESSAGE_CONTEXT .?AU_PARSE_MESSAGE_CONTEXT@@ �� A � � F � PROCESSOR_IDLE_TIMES .?AUPROCESSOR_IDLE_TIMES@@ ��
C
� >
# StartTime
# EndTime ��
� Reserved �F E PROCESSOR_IDLE_TIMES .?AUPROCESSOR_IDLE_TIMES@@ �� F _ V � _TXFS_LIST_TRANSACTIONS_ENTRY .?AU_TXFS_LIST_TRANSACTIONS_ENTRY@@
H
� r
� TransactionId
" TransactionState �
" Reserved1
" Reserved2
Reserved3 V J ( _TXFS_LIST_TRANSACTIONS_ENTRY .?AU_TXFS_LIST_TRANSACTIONS_ENTRY@@ K , z � _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION .?AU_SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION@@ ��
M
�
" Operation z O _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION .?AU_SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION@@ �� P �
F � _FILE_EA_INFORMATION .?AU_FILE_EA_INFORMATION@@ ��
" EaSize ���F S _FILE_EA_INFORMATION .?AU_FILE_EA_INFORMATION@@ �� T � R � _SYSTEM_AUDIT_CALLBACK_ACE .?AU_SYSTEM_AUDIT_CALLBACK_ACE@@ ��
V
� :
o Header ���
" Mask �
" SidStart �R X _SYSTEM_AUDIT_CALLBACK_ACE .?AU_SYSTEM_AUDIT_CALLBACK_ACE@@ �� Y 2 � _numberfmtA .?AU_numberfmtA@@ �
u NumDigits
u LeadingZero ��
u Grouping �
p lpDecimalSep �
p lpThousandSep
u NegativeOrder 2 \ _numberfmtA .?AU_numberfmtA@@ ] � � Z � _MEMORY_WORKING_SET_INFORMATION .?AU_MEMORY_WORKING_SET_INFORMATION@@ N � _MEMORY_WORKING_SET_BLOCK .?AU_MEMORY_WORKING_SET_BLOCK@@ ` " �:
" NumberOfEntries ��
a WorkingSetInfo ���Z b _MEMORY_WORKING_SET_INFORMATION .?AU_MEMORY_WORKING_SET_INFORMATION@@ c � 6 � tagDIBSECTION .?AUtagDIBSECTION@@
e
� . � tagBITMAP .?AUtagBITMAP@@ " " �j
g dsBm �
i dsBmih ���
h @ dsBitfields ��
L dshSection ���
" P dsOffset �6 i T tagDIBSECTION .?AUtagDIBSECTION@@ j # � FileBasicInfo FileStandardInfo � FileNameInfo � FileRenameInfo ��� FileDispositionInfo �� FileAllocationInfo ��� FileEndOfFileInfo FileStreamInfo ��� FileCompressionInfo �� FileAttributeTagInfo �
FileIdBothDirectoryInfo �� FileIdBothDirectoryRestartInfo ��� FileIoPriorityHintInfo ���
FileRemoteProtocolInfo ��� FileFullDirectoryInfo FileFullDirectoryRestartInfo � FileStorageInfo �� FileAlignmentInfo FileIdInfo ��� FileIdExtdDirectoryInfo �� FileIdExtdDirectoryRestartInfo ��� FileDispositionInfoEx FileRenameInfoEx � FileCaseSensitiveInfo FileNormalizedNameInfo ��� MaximumFileInfoByHandleClass �N t l _FILE_INFO_BY_HANDLE_CLASS .?AW4_FILE_INFO_BY_HANDLE_CLASS@@ ��� m c � � DISPLAYCONFIG_DEVICE_INFO_GET_SOURCE_NAME DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_NAME DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_PREFERRED_MODE �� DISPLAYCONFIG_DEVICE_INFO_GET_ADAPTER_NAME ��� DISPLAYCONFIG_DEVICE_INFO_SET_TARGET_PERSISTENCE � DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_BASE_TYPE ��� DISPLAYCONFIG_DEVICE_INFO_GET_SUPPORT_VIRTUAL_RESOLUTION � DISPLAYCONFIG_DEVICE_INFO_SET_SUPPORT_VIRTUAL_RESOLUTION � DISPLAYCONFIG_DEVICE_INFO_GET_ADVANCED_COLOR_INFO
DISPLAYCONFIG_DEVICE_INFO_SET_ADVANCED_COLOR_STATE ��� DISPLAYCONFIG_DEVICE_INFO_GET_SDR_WHITE_LEVEL ��DISPLAYCONFIG_DEVICE_INFO_FORCE_UINT32 ��V t o DISPLAYCONFIG_DEVICE_INFO_TYPE .?AW4DISPLAYCONFIG_DEVICE_INFO_TYPE@@ ��� p � f � _PLUGPLAY_CONTROL_USER_RESPONSE_DATA .?AU_PLUGPLAY_CONTROL_USER_RESPONSE_DATA@@ ��
r
� � PNP_VetoTypeUnknown �� PNP_VetoLegacyDevice � PNP_VetoPendingClose � PNP_VetoWindowsApp ��� PNP_VetoWindowsService ��� PNP_VetoOutstandingOpen �� PNP_VetoDevice ��� PNP_VetoDriver ��� PNP_VetoIllegalDeviceRequest � PNP_VetoInsufficientPower
PNP_VetoNonDisableable ��� PNP_VetoLegacyDriver � PNP_VetoInsufficientRights ���
PNP_VetoAlreadyRemoved ���6 t t _PNP_VETO_TYPE .?AW4_PNP_VETO_TYPE@@ ���* onecore\external\shared\inc\cfg.h �� u v / Z
" Response �
u VetoType �
q VetoName �
" VetoNameLength ���f x _PLUGPLAY_CONTROL_USER_RESPONSE_DATA .?AU_PLUGPLAY_CONTROL_USER_RESPONSE_DATA@@ �� y � V FeatureEnabledStateOptionsNone ��� FeatureEnabledStateOptionsWexpConfig �^ t { _RTL_FEATURE_ENABLED_STATE_OPTIONS .?AW4_RTL_FEATURE_ENABLED_STATE_OPTIONS@@ ��� | � A B � _WMI_PNP_RECORD_V5 .?AU_WMI_PNP_RECORD_V5@@ ��
~
� �
� ClassGuid
" UpperFilterCount �
" LowerFilterCount �
" DevStatus
" DevProblem ���
Strings ��B � $ _WMI_PNP_RECORD_V5 .?AU_WMI_PNP_RECORD_V5@@ �� � � � 2 � tagRAWMOUSE .?AUtagRAWMOUSE@@
�
� �
! usFlags ��
" ulButtons
! usButtonFlags
! usButtonData �
" ulRawButtons �
lLastX ���
lLastY ���
" ulExtraInformation ���2 � tagRAWMOUSE .?AUtagRAWMOUSE@@ � 9: : � tagEMRPOLYLINE .?AUtagEMRPOLYLINE@@ ��F
emr ��
� rclBounds
" cptl �
J aptl �: � $ tagEMRPOLYLINE .?AUtagEMRPOLYLINE@@ �� � 9 : � _JIT_DEBUG_INFO .?AU_JIT_DEBUG_INFO@@ �
" dwSize ���
" dwProcessorArchitecture ��
" dwThreadID ���
" dwReserved0 ��
# lpExceptionAddress ���
# lpExceptionRecord
# lpContextRecord ��: � ( _JIT_DEBUG_INFO .?AU_JIT_DEBUG_INFO@@ � � � ACTCTX_RUN_LEVEL_UNSPECIFIED � ACTCTX_RUN_LEVEL_AS_INVOKER �� ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE ��� ACTCTX_RUN_LEVEL_REQUIRE_ADMIN ��� ACTCTX_RUN_LEVEL_NUMBERS �N t � ACTCTX_REQUESTED_RUN_LEVEL .?AW4ACTCTX_REQUESTED_RUN_LEVEL@@ ��� � L �
� Identifier ���6 � _FILE_ID_128 .?AU_FILE_ID_128@@ �� � R 2 � _XSAVE_AREA .?AU_XSAVE_AREA@@ 6 � _XSAVE_FORMAT .?AU_XSAVE_FORMAT@@ B � _XSAVE_AREA_HEADER .?AU_XSAVE_AREA_HEADER@@ ��.
� LegacyState ��
� Header ���2 � @_XSAVE_AREA .?AU_XSAVE_AREA@@ � � : � _GROUP_AFFINITY .?AU_GROUP_AFFINITY@@ ! " �6
" Mask �
! Group
� Reserved �: � _GROUP_AFFINITY .?AU_GROUP_AFFINITY@@ � . WMI_GET_ALL_DATA � WMI_GET_SINGLE_INSTANCE �� WMI_SET_SINGLE_INSTANCE �� WMI_SET_SINGLE_ITEM �� WMI_ENABLE_EVENTS WMI_DISABLE_EVENTS ��� WMI_ENABLE_COLLECTION WMI_DISABLE_COLLECTION ��� WMI_REGINFO �� WMI_EXECUTE_METHOD ���
WMI_CAPTURE_STATE : t � WMIDPREQUESTCODE .?AW4WMIDPREQUESTCODE@@ ��� � 8 � V � _REQUEST_OPLOCK_INPUT_BUFFER .?AU_REQUEST_OPLOCK_INPUT_BUFFER@@ ��j
! StructureVersion �
! StructureLength ��
" RequestedOplockLevel �
" Flags V � _REQUEST_OPLOCK_INPUT_BUFFER .?AU_REQUEST_OPLOCK_INPUT_BUFFER@@ �� � � . � tagACCEL .?AUtagACCEL@@ ��
�
� 2
fVirt
! key ��
! cmd ��. � tagACCEL .?AUtagACCEL@@ �� � _ f � IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA .?ATIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" HeaderData ���
� FunctionLength ���
� Version ��
� ExceptionDataPresent �
� EpilogInHeader ���
� EpilogCount ��
� CodeWords f � IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA .?ATIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA@@ �� � [ f � _FILE_SYSTEM_RECOGNITION_INFORMATION .?AU_FILE_SYSTEM_RECOGNITION_INFORMATION@@ �� p " �
� FileSystem ���f � _FILE_SYSTEM_RECOGNITION_INFORMATION .?AU_FILE_SYSTEM_RECOGNITION_INFORMATION@@ �� � �
�
p t �
�
� � WnfDataScopeSystem ��� WnfDataScopeSession �� WnfDataScopeUser � WnfDataScopeProcess �� WnfDataScopeMachine �� WnfDataScopePhysicalMachine ��6 t � _WNF_DATA_SCOPE .?AW4_WNF_DATA_SCOPE@@ � � u " SemaphoreBasicInformation R t � _SEMAPHORE_INFORMATION_CLASS .?AW4_SEMAPHORE_INFORMATION_CLASS@@ ��� � � B ToleranceLow � ToleranceMedium �� ToleranceHigh Z t � _JOBOBJECT_RATE_CONTROL_TOLERANCE .?AW4_JOBOBJECT_RATE_CONTROL_TOLERANCE@@ � � C �
�
� N WaitAll �� WaitAny �� WaitNotification � WaitDequeue ��. t � _WAIT_TYPE .?AW4_WAIT_TYPE@@ ��� � � b � _PERFINFO_BOOT_PREFETCH_INFORMATION .?AU_PERFINFO_BOOT_PREFETCH_INFORMATION@@
�
� :
Action ���
Status ���
Pages b � _PERFINFO_BOOT_PREFETCH_INFORMATION .?AU_PERFINFO_BOOT_PREFETCH_INFORMATION@@ � � � R LogExceptionEmpty LogExceptionDispatch � LogExceptionHandler ��> t � _EXCEPTION_LOG_TYPE .?AW4_EXCEPTION_LOG_TYPE@@ � � �
F � _STREAM_EXTENT_ENTRY .?AU_STREAM_EXTENT_ENTRY@@ ��
�
� N � RETRIEVAL_POINTERS_BUFFER .?AURETRIEVAL_POINTERS_BUFFER@@
� RetrievalPointers 2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � .
" Flags
� ExtentInformation F � ( _STREAM_EXTENT_ENTRY .?AU_STREAM_EXTENT_ENTRY@@ �� � � > � USN_RECORD_EXTENT .?AUUSN_RECORD_EXTENT@@ *
Offset ���
Length ���> � USN_RECORD_EXTENT .?AUUSN_RECORD_EXTENT@@ � � � VERIFIER_MODE_UNUSED � VERIFIER_MODE_TRIAGE � VERIFIER_MODE_FIELD �� VERIFIER_MODE_LOGO ��� VERIFIER_MODE_TEST ���2 t � VERIFIER_MODE .?AW4VERIFIER_MODE@@ � � � & � _ABC .?AU_ABC@@ ��
�
� 2
t abcA �
u abcB �
t abcC �& � _ABC .?AU_ABC@@ �� � � > � tagREGISTERWORDW .?AUtagREGISTERWORDW@@ ��
�
� *
q lpReading
q lpWord ���> � tagREGISTERWORDW .?AUtagREGISTERWORDW@@ �� � E ` j � _SECURE_SPECULATION_CONTROL_INFORMATION .?AU_SECURE_SPECULATION_CONTROL_INFORMATION@@
�
�
" ��
" ��
" ��
" ��
" ��
" ��
� KvaShadowSupported ���
� KvaShadowEnabled �
� KvaShadowUserGlobal ��
� KvaShadowPcid
� MbClearEnabled ���
� Reserved �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � &
� SecureSpeculationFlags ���j � _SECURE_SPECULATION_CONTROL_INFORMATION .?AU_SECURE_SPECULATION_CONTROL_INFORMATION@@ � � b � _RTL_PROCESS_BACKTRACE_INFORMATION .?AU_RTL_PROCESS_BACKTRACE_INFORMATION@@ �� " � �j
p SymbolicBackTrace
" TraceCount ���
! Index
!
Depth
� BackTrace b � � _RTL_PROCESS_BACKTRACE_INFORMATION .?AU_RTL_PROCESS_BACKTRACE_INFORMATION@@ �� � � : � tagSOUNDSENTRYA .?AUtagSOUNDSENTRYA@@ R
u cbSize ���
" dwFlags ��
" iFSTextEffect
" iFSTextEffectMSec
" iFSTextEffectColorBits ���
" iFSGrafEffect
" iFSGrafEffectMSec
" iFSGrafEffectColor ���
" iWindowsEffect ���
" $ iWindowsEffectMSec ���
p ( lpszWindowsEffectDLL �
" , iWindowsEffectOrdinal : 0 tagSOUNDSENTRYA .?AUtagSOUNDSENTRYA@@ 4 6 � _STARTUPINFOW .?AU_STARTUPINFOW@@
� �
" cb ���
q lpReserved ���
q lpDesktop
q lpTitle ��
" dwX ��
" dwY ��
" dwXSize ��
" dwYSize ��
" dwXCountChars
" $ dwYCountChars
" ( dwFillAttribute ��
" , dwFlags ��
! 0 wShowWindow ��
! 2 cbReserved2 ��
4 lpReserved2 ��
8 hStdInput
< hStdOutput ���
@ hStdError 6 D _STARTUPINFOW .?AU_STARTUPINFOW@@ 1 7 f � _EVENT_TRACE_SPINLOCK_INFORMATION_V1 .?AU_EVENT_TRACE_SPINLOCK_INFORMATION_V1@@ ��
� EventTraceInformationClass ���
" SpinLockSpinThreshold
" SpinLockAcquireSampleRate
" SpinLockContentionSampleRate �f _EVENT_TRACE_SPINLOCK_INFORMATION_V1 .?AU_EVENT_TRACE_SPINLOCK_INFORMATION_V1@@ ��
� 6 � _devicemodeA .?AU_devicemodeA@@ ��
c dmDeviceName �
! dmSpecVersion
! " dmDriverVersion ��
! $ dmSize ���
! & dmDriverExtra
" ( dmFields �
, dmOrientation
. dmPaperSize ��
0 dmPaperLength
2 dmPaperWidth �
4 dmScale ��
6 dmCopies �
8 dmDefaultSource ��
: dmPrintQuality ���
I , dmPosition ���
" 4 dmDisplayOrientation �
" 8 dmDisplayFixedOutput �
< dmColor ��
> dmDuplex �
@ dmYResolution
B dmTTOption ���
D dmCollate
c F dmFormName ���
! f dmLogPixels ��
" h dmBitsPerPel �
" l dmPelsWidth ��
" p dmPelsHeight �
" t dmDisplayFlags ���
" t dmNup
" x dmDisplayFrequency ���
" | dmICMMethod ��
" � dmICMIntent ��
" � dmMediaType ��
" � dmDitherType �
" � dmReserved1 ��
" � dmReserved2 ��
" � dmPanningWidth ���
" � dmPanningHeight ��6 & � _devicemodeA .?AU_devicemodeA@@ �� � N � _CM_KEYBOARD_DEVICE_DATA .?AU_CM_KEYBOARD_DEVICE_DATA@@ ��f
! Version ��
! Revision �
Type �
Subtype ��
! KeyboardFlags N _CM_KEYBOARD_DEVICE_DATA .?AU_CM_KEYBOARD_DEVICE_DATA@@ �� � & > � MARK_HANDLE_INFO .?AUMARK_HANDLE_INFO@@ ��b
" UsnSourceInfo
" CopyNumber ���
VolumeHandle �
" HandleInfo ���> MARK_HANDLE_INFO .?AUMARK_HANDLE_INFO@@ �� . F � _SERVICE_TABLE_ENTRYW .?AU_SERVICE_TABLE_ENTRYW@@
q
� "
� 2
q lpServiceName
lpServiceProc F _SERVICE_TABLE_ENTRYW .?AU_SERVICE_TABLE_ENTRYW@@ ! 3 } J � DPI_AWARENESS_CONTEXT__ .?AUDPI_AWARENESS_CONTEXT__@@
t unused ���J $ DPI_AWARENESS_CONTEXT__ .?AUDPI_AWARENESS_CONTEXT__@@ % 2 SystemPowerState � DevicePowerState �: t ' _POWER_STATE_TYPE .?AW4_POWER_STATE_TYPE@@ � ( � 2 � tagGLYPHSET .?AUtagGLYPHSET@@ 2 � tagWCRANGE .?AUtagWCRANGE@@ �� + " �n
" cbThis ���
" flAccel ��
" cGlyphsSupported �
" cRanges ��
, ranges ���2 - tagGLYPHSET .?AUtagGLYPHSET@@ . � Z � _JOURNAL_RENAME_KEY_INFORMATION .?AU_JOURNAL_RENAME_KEY_INFORMATION@@ Z JournalCreateKey � JournalDeleteKey � JournalRenameKey � JournalSetValue �� JournalDeleteValue ��� JournalSetKeySecurity JournalSetKeyUserFlags ��� JournalSetLastWriteTime �� JournalBeginTransaction �� JournalCommitTransaction �
JournalAbortTransaction �� MaxJournalChangeAction ���Z t 1 _JOURNAL_CHANGE_INFORMATION_CLASS .?AW4_JOURNAL_CHANGE_INFORMATION_CLASS@@ �2 onecore\internal\sdk\inc\minwin\ntregapi.h � 2 3 � r
2 Action ���
# RecordNumber �
} TimeStamp
� KeyPathName ��
� KeyKeyName ���Z 5 ( _JOURNAL_RENAME_KEY_INFORMATION .?AU_JOURNAL_RENAME_KEY_INFORMATION@@ 6 3 � 2 ThreadBasicInformation ��� ThreadTimes �� ThreadPriority ��� ThreadBasePriority ��� ThreadAffinityMask ��� ThreadImpersonationToken � ThreadDescriptorTableEntry ��� ThreadEnableAlignmentFaultFixup �� ThreadEventPair_Reusable � ThreadQuerySetWin32StartAddress ��
ThreadZeroTlsCell ThreadPerformanceCount ��� ThreadAmILastThread ��
ThreadIdealProcessor � ThreadPriorityBoost �� ThreadSetTlsArrayAddress � ThreadIsIoPending ThreadHideFromDebugger ��� ThreadBreakOnTermination � ThreadSwitchLegacyState �� ThreadIsTerminated ��� ThreadLastSystemCall � ThreadIoPriority � ThreadCycleTime �� ThreadPagePriority ��� ThreadActualBasePriority � ThreadTebInformation � ThreadCSwitchMon � ThreadCSwitchPmu � ThreadWow64Context ��� ThreadGroupInformation ��� ThreadUmsInformation � ThreadCounterProfiling ��� ! ThreadIdealProcessorEx ��� " ThreadCpuAccountingInformation ��� # ThreadSuspendCount ��� $ ThreadHeterogeneousCpuPolicy � % ThreadContainerId & ThreadNameInformation ' ThreadSelectedCpuSets ( ThreadSystemThreadInformation ) ThreadActualGroupAffinity * ThreadDynamicCodePolicyInfo �� + ThreadExplicitCaseSensitivity , ThreadWorkOnBehalfTicket � - ThreadSubsystemInformation ��� . ThreadDbgkWerReportActive / ThreadAttachContainer 0 ThreadManageWritesToExecutableMemory � 1 ThreadPowerThrottlingState ��� 2 ThreadWorkloadClass �� 3 MaxThreadInfoClass ���: 4 t 8 _THREADINFOCLASS .?AW4_THREADINFOCLASS@@ ��� 9 C � /
;
� 2 � tagACTCTXA .?AUtagACTCTXA@@ ���
" cbSize ���
" dwFlags ��
7 lpSource �
! wProcessorArchitecture ���
! wLangId ��
7 lpAssemblyDirectory ��
7 lpResourceName ���
7 lpApplicationName
6 hModule ��2 > tagACTCTXA .?AUtagACTCTXA@@ �� ? F V ResourceManagerBasicInformation �� ResourceManagerCompletionInformation �^ t A _RESOURCEMANAGER_INFORMATION_CLASS .?AW4_RESOURCEMANAGER_INFORMATION_CLASS@@ ��� B � O ~ � _MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION .?AU_MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION@@ ��
D
� �
" Flags
" NumaNode �
" LargePageSize
" NumberOfLargePagesToCreate ���
" NumberOfLargePagesCreated ~ F _MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION .?AU_MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION@@ �� G � n SubsystemInformationTypeWin32 SubsystemInformationTypeWSL �� MaxSubsystemInformationType ��N t I _SUBSYSTEM_INFORMATION_TYPE .?AW4_SUBSYSTEM_INFORMATION_TYPE@@ � J C � � RtlSparseBitmapOperationClear RtlSparseBitmapOperationSet �� RtlSparseBitmapOperationAny �� RtlSparseBitmapOperationMax ��Z t L _RTL_SPARSE_BITMAP_CTX_OPERATION .?AW4_RTL_SPARSE_BITMAP_CTX_OPERATION@@ ��� M � � J � _SILO_USER_SHARED_DATA .?AU_SILO_USER_SHARED_DATA@@ ��
O
�
" ServiceSessionId �
" ActiveConsoleId ��
ConsoleSessionForegroundProcessId
u NtProductType
" SuiteMask
" SharedUserSessionId ��
IsMultiSessionSku
s NtSystemRoot �
� &UserModeGlobalLogger �J Q H_SILO_USER_SHARED_DATA .?AU_SILO_USER_SHARED_DATA@@ �� R a u
> AclRevisionInformation ��� AclSizeInformation ���F t T _ACL_INFORMATION_CLASS .?AW4_ACL_INFORMATION_CLASS@@ ��� U I B � tagDELETEITEMSTRUCT .?AUtagDELETEITEMSTRUCT@@
W
� b
u CtlType ��
u CtlID
u itemID ���
y hwndItem �
" itemData �B Y tagDELETEITEMSTRUCT .?AUtagDELETEITEMSTRUCT@@ Z !
� � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT@@ v
ResolutionContext
" RootIndex
CancelResolution �
NoMoreEntries
� Root � ] _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT@@ ^ L � B � _CACHE_RELATIONSHIP .?AU_CACHE_RELATIONSHIP@@
`
� " �
Level
Associativity
! LineSize �
" CacheSize
� Type �
b Reserved �
� GroupMask B c , _CACHE_RELATIONSHIP .?AU_CACHE_RELATIONSHIP@@ d { + V � _FILE_MAKE_COMPATIBLE_BUFFER .?AU_FILE_MAKE_COMPATIBLE_BUFFER@@ ��
CloseDisc V g _FILE_MAKE_COMPATIBLE_BUFFER .?AU_FILE_MAKE_COMPATIBLE_BUFFER@@ �� h Z � _ETW_THREAD_EVENT_SUBPROCESSTAG .?AU_ETW_THREAD_EVENT_SUBPROCESSTAG@@ >
� Header ���
" OldTag ���
" $ NewTag ���Z k ( _ETW_THREAD_EVENT_SUBPROCESSTAG .?AU_ETW_THREAD_EVENT_SUBPROCESSTAG@@ l � U
�
� b
HeapHandle ���
SubSegment ���
" SubSegmentSize ���
" BlockSize ^ o _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE .?AU_HEAP_EVENT_SUBSEGMENT_ALLOC_FREE@@ p � =
" ��
" ��>
" Flags
r FilterId �
s ReservedFlags v t _PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY@@ u C � > � tagDEBUGHOOKINFO .?AUtagDEBUGHOOKINFO@@ ��j
" idThread �
" idThreadInstaller
lParam ���
u wParam ���
t code �> x tagDEBUGHOOKINFO .?AUtagDEBUGHOOKINFO@@ �� y y N � _STREAM_INFORMATION_ENTRY .?AU_STREAM_INFORMATION_ENTRY@@
{
� : � _StreamInformation .?AT_StreamInformation@@ ��B
" Version ��
" Flags
} StreamInformation N ~ _STREAM_INFORMATION_ENTRY .?AU_STREAM_INFORMATION_ENTRY@@ p J � _ImageArchitectureEntry .?AU_ImageArchitectureEntry@@ .
" FixupInstRVA �
" NewInst ��J � _ImageArchitectureEntry .?AU_ImageArchitectureEntry@@ � [ c � EtwBufferStateFree ��� EtwBufferStateGeneralLogging � EtwBufferStateCSwitch EtwBufferStateFlush �� EtwBufferStatePendingCompression � EtwBufferStateCompressed � EtwBufferStatePlaceholder EtwBufferStateMaximum : t � _ETW_BUFFER_STATE .?AW4_ETW_BUFFER_STATE@@ � � � �
�
� > � _COVERAGE_MODULES .?AU_COVERAGE_MODULES@@ N � _COVERAGE_MODULE_REQUEST .?AU_COVERAGE_MODULE_REQUEST@@ ��F � _COVERAGE_MODULE_INFO .?AU_COVERAGE_MODULE_INFO@@ � " �f
" ListAndReset �
" NumberOfModules ��
� ModuleRequestInfo
� Modules ��> � 4 _COVERAGE_MODULES .?AU_COVERAGE_MODULES@@ � � R � _ACCESS_DENIED_CALLBACK_ACE .?AU_ACCESS_DENIED_CALLBACK_ACE@@ :
o Header ���
" Mask �
" SidStart �R � _ACCESS_DENIED_CALLBACK_ACE .?AU_ACCESS_DENIED_CALLBACK_ACE@@ � � . � tagINPUT .?AUtagINPUT@@ ��6 � tagMOUSEINPUT .?AUtagMOUSEINPUT@@ 6 � tagKEYBDINPUT .?AUtagKEYBDINPUT@@ > � tagHARDWAREINPUT .?AUtagHARDWAREINPUT@@ ��B
" type �
� mi ���
� ki ���
� hi ���. � tagINPUT .?AUtagINPUT@@ �� � � g � i � N � _FILE_DISPOSITION_INFO_EX .?AU_FILE_DISPOSITION_INFO_EX@@
�
�
" Flags N � _FILE_DISPOSITION_INFO_EX .?AU_FILE_DISPOSITION_INFO_EX@@ � �" R � _TXFS_SAVEPOINT_INFORMATION .?AU_TXFS_SAVEPOINT_INFORMATION@@ N
KtmTransaction ���
" ActionCode ���
" SavepointId ��R � _TXFS_SAVEPOINT_INFORMATION .?AU_TXFS_SAVEPOINT_INFORMATION@@ � �
� 6 � _RPC_MESSAGE .?AU_RPC_MESSAGE@@ ��
�
� J � _RPC_SYNTAX_IDENTIFIER .?AU_RPC_SYNTAX_IDENTIFIER@@ ��
�
�
Handle ���
" DataRepresentation ���
Buffer ���
u BufferLength �
u ProcNum ��
� TransferSyntax ���
RpcInterfaceInformation ��
ReservedForRuntime ���
ManagerEpv ���
$ ImportContext
" ( RpcFlags �6 � , _RPC_MESSAGE .?AU_RPC_MESSAGE@@ ��. onecore\external\shared\inc\rpcdcep.h �� � � 3
�
� Z � _EXCEPTION_REGISTRATION_RECORD .?AU_EXCEPTION_REGISTRATION_RECORD@@ ��
�
�
�
� �
� ExceptionList
StackBase
StackLimit ���
SubSystemTib �
FiberData
" Version ��
ArbitraryUserPointer �
� Self �* � _NT_TIB .?AU_NT_TIB@@ � C 6 � _currencyfmtA .?AU_currencyfmtA@@ �
u NumDigits
u LeadingZero ��
u Grouping �
p lpDecimalSep �
p lpThousandSep
u NegativeOrder
u PositiveOrder
p lpCurrencySymbol �6 � _currencyfmtA .?AU_currencyfmtA@@ � � � > � tagRAWINPUTDEVICE .?AUtagRAWINPUTDEVICE@@
�
� Z
! usUsagePage ��
! usUsage ��
" dwFlags ��
y hwndTarget ���> � tagRAWINPUTDEVICE .?AUtagRAWINPUTDEVICE@@ � ^; F � _PERFINFO_PO_PRESLEEP .?AU_PERFINFO_PO_PRESLEEP@@ B
} PerformanceCounter ���
} PerformanceFrequency �F � _PERFINFO_PO_PRESLEEP .?AU_PERFINFO_PO_PRESLEEP@@ � � � 6 � tagAXESLISTA .?AUtagAXESLISTA@@ ��
�
� 6 � tagAXISINFOA .?AUtagAXISINFOA@@ �� � " � �J
" axlReserved ��
" axlNumAxes ���
� axlAxisInfo ��6 � �tagAXESLISTA .?AUtagAXESLISTA@@ �� � 6 N � _HEAP_REGION_INFORMATION .?AU_HEAP_REGION_INFORMATION@@ ��
�
� �
" Address ��
" ReserveSize ��
" CommitSize ���
" FirstRangeInformationOffset ��
" NextRegionInformationOffset ��N � _HEAP_REGION_INFORMATION .?AU_HEAP_REGION_INFORMATION@@ �� � L � R � _FILE_GET_QUOTA_INFORMATION .?AU_FILE_GET_QUOTA_INFORMATION@@ & � _SID .?AU_SID@@ ��B
" NextEntryOffset ��
" SidLength
� Sid ��R � _FILE_GET_QUOTA_INFORMATION .?AU_FILE_GET_QUOTA_INFORMATION@@ � � F � _ALPC_PORT_ATTRIBUTES .?AU_ALPC_PORT_ATTRIBUTES@@
�
� V � _SECURITY_QUALITY_OF_SERVICE .?AU_SECURITY_QUALITY_OF_SERVICE@@ ���
" Flags
� SecurityQos ��
" MaxMessageLength �
" MemoryBandwidth ��
" MaxPoolUsage �
" MaxSectionSize ���
" MaxViewSize ��
" $ MaxTotalSectionSize ��
" ( DupObjectTypes ���F � , _ALPC_PORT_ATTRIBUTES .?AU_ALPC_PORT_ATTRIBUTES@@ � � � B � _REMOTE_NAME_INFOW .?AU_REMOTE_NAME_INFOW@@ ��
�
� V
q lpUniversalName ��
q lpConnectionName �
q lpRemainingPath ��B � _REMOTE_NAME_INFOW .?AU_REMOTE_NAME_INFOW@@ �� � 5 � R � _ALPC_WORK_ON_BEHALF_TICKET .?AU_ALPC_WORK_ON_BEHALF_TICKET@@ 6
" ThreadId �
" ThreadCreationTimeLow R � _ALPC_WORK_ON_BEHALF_TICKET .?AU_ALPC_WORK_ON_BEHALF_TICKET@@ � � l > � _WMI_POWER_RECORD .?AU_WMI_POWER_RECORD@@
�
� �
SystemS1 �
SystemS2 �
SystemS3 �
SystemS4 �
SystemS5 �
AoAc �
p Pad2 �
p Pad3 �> � _WMI_POWER_RECORD .?AU_WMI_POWER_RECORD@@ � � s N � _SERVICE_FAILURE_ACTIONSA .?AU_SERVICE_FAILURE_ACTIONSA@@ 2 � _SC_ACTION .?AU_SC_ACTION@@ ��
�
� r
" dwResetPeriod
p lpRebootMsg ��
p lpCommand
" cActions �
� lpsaActions ��N � _SERVICE_FAILURE_ACTIONSA .?AU_SERVICE_FAILURE_ACTIONSA@@ � 3 2
UniqueProcess
UniqueThread �2 � _CLIENT_ID .?AU_CLIENT_ID@@ �� � C � � SERVERSILO_INITING ��� SERVERSILO_STARTED ��� SERVERSILO_SHUTTING_DOWN � SERVERSILO_TERMINATING ��� SERVERSILO_TERMINATED : t � _SERVERSILO_STATE .?AW4_SERVERSILO_STATE@@ � � C � N � _FILE_GET_EA_INFORMATION .?AU_FILE_GET_EA_INFORMATION@@ ��
�
� J
" NextEntryOffset ��
EaNameLength �
� EaName ���N � _FILE_GET_EA_INFORMATION .?AU_FILE_GET_EA_INFORMATION@@ �� � � ^ � _CI_LOG_SCHEDULER_SLEEP_RESPONSE .?AU_CI_LOG_SCHEDULER_SLEEP_RESPONSE@@ ��
� Header ���^ � 0 _CI_LOG_SCHEDULER_SLEEP_RESPONSE .?AU_CI_LOG_SCHEDULER_SLEEP_RESPONSE@@ �� � � [ : � _WMI_PAGE_FAULT .?AU_WMI_PAGE_FAULT@@
�
� :
VirtualAddress ���
ProgramCounter ���: � _WMI_PAGE_FAULT .?AU_WMI_PAGE_FAULT@@ � 2 � _CHAR_INFO .?AU_CHAR_INFO@@ ��
� .
q UnicodeChar ��
p AsciiChar 2 <anonymous-tag> .?AT<anonymous-tag>@@ . onecore\external\sdk\inc\wincontypes.h � � *
Char �
! Attributes ���2 _CHAR_INFO .?AU_CHAR_INFO@@ �� � � ThreadMemoryPriority � ThreadAbsoluteCpuPriority ThreadDynamicCodePolicy �� ThreadPowerThrottling ThreadInformationClassMax J t _THREAD_INFORMATION_CLASS .?AW4_THREAD_INFORMATION_CLASS@@ � 1 0 � IoPriorityVeryLow IoPriorityLow IoPriorityNormal � IoPriorityHigh ��� IoPriorityCritical ��� MaxIoPriorityTypes ���: t _IO_PRIORITY_HINT .?AW4_IO_PRIORITY_HINT@@ � � J � _THREAD_UMS_INFORMATION .?AU_THREAD_UMS_INFORMATION@@ � UmsInformationCommandInvalid � UmsInformationCommandAttach �� UmsInformationCommandDetach �� UmsInformationCommandQuery ���V t _THREAD_UMS_INFORMATION_COMMAND .?AW4_THREAD_UMS_INFORMATION_COMMAND@@ � C
�
� > � _RTL_UMS_CONTEXT .?AU_RTL_UMS_CONTEXT@@ ��
�
" ��
" ��
Command ��
CompletionList ���
UmsContext ���
" Flags
IsUmsSchedulerThread �
IsUmsWorkerThread J _THREAD_UMS_INFORMATION .?AU_THREAD_UMS_INFORMATION@@ C ' B � EVENT_INSTANCE_INFO .?AUEVENT_INSTANCE_INFO@@ .
RegHandle
" InstanceId ���B EVENT_INSTANCE_INFO .?AUEVENT_INSTANCE_INFO@@ � D & IoSessionStateCreated IoSessionStateInitialized IoSessionStateConnected �� IoSessionStateDisconnected ��� IoSessionStateDisconnectedLoggedOn ��� IoSessionStateLoggedOn ��� IoSessionStateLoggedOff �� IoSessionStateTerminated � IoSessionStateMax : t ! _IO_SESSION_STATE .?AW4_IO_SESSION_STATE@@ � " R � _SYSTEM_ALARM_CALLBACK_ACE .?AU_SYSTEM_ALARM_CALLBACK_ACE@@ ��:
o Header ���
" Mask �
" SidStart �R % _SYSTEM_ALARM_CALLBACK_ACE .?AU_SYSTEM_ALARM_CALLBACK_ACE@@ �� & j � _SYSTEM_ISOLATED_USER_MODE_INFORMATION .?AU_SYSTEM_ISOLATED_USER_MODE_INFORMATION@@ ��
��
��
��
��
��
��
��
��
��
�� " �J
) SecureKernelRunning ��
* HvciEnabled ��
+ HvciStrictMode ���
, DebugEnabled �
- FirmwarePageProtection ���
. EncryptionKeyAvailable ���
/ SpareFlags ���
0 TrustletRunning ��
1 HvciDisableAllowed ���
2 SpareFlags2 ��
3 Spare0 ���
# Spare1 ���j 4 _SYSTEM_ISOLATED_USER_MODE_INFORMATION .?AU_SYSTEM_ISOLATED_USER_MODE_INFORMATION@@ �� 5 N V � _FILE_DISPOSITION_INFORMATION .?AU_FILE_DISPOSITION_INFORMATION@@
7
�
DeleteFile ���V 9 _FILE_DISPOSITION_INFORMATION .?AU_FILE_DISPOSITION_INFORMATION@@ : � F � _LOGICAL_DISK_EXTENTS .?AU_LOGICAL_DISK_EXTENTS@@
<
� q " � q " �b
# StartingOffset ���
# PartitionSize
" DiskNumber ���
" Size �
" DriveType
> DriveLetterString
" $ Pad ��
" ( PartitionNumber ��
" , SectorsPerCluster
" 0 BytesPerSector ���
8 NumberOfFreeClusters �
@ TotalNumberOfClusters
? H FileSystemType ���
" h VolumeExt F @ p _LOGICAL_DISK_EXTENTS .?AU_LOGICAL_DISK_EXTENTS@@ A � � B � _SERVICE_NOTIFY_2W .?AU_SERVICE_NOTIFY_2W@@ ��
�
� �
" dwVersion
D pfnNotifyCallback
pContext �
" dwNotificationStatus �
ServiceStatus
" 4 dwNotificationTriggered ��
q 8 pszServiceNames ��B E < _SERVICE_NOTIFY_2W .?AU_SERVICE_NOTIFY_2W@@ �� F 3 � 6 � _RTL_BARRIER .?AU_RTL_BARRIER@@ �� " �f
" Reserved1
" Reserved2
; Reserved3
" Reserved4
" Reserved5 : J <anonymous-tag> .?AU<anonymous-tag>@@ K ( g �
Barrier ��
LeftBarrier ��
I WaitEvent
TotalProcessors ��
" Spins
K DUMMYRESERVEDSTRUCTNAME ��6 M _RTL_BARRIER .?AU_RTL_BARRIER@@ �� N ( W
" ��
" ��
" ��
" ��
" Flags
P NoChildProcessCreation ���
Q AuditNoChildProcessCreation ��
R AllowSecureProcessCreation ���
S ReservedFlags n T _PROCESS_MITIGATION_CHILD_PROCESS_POLICY .?AU_PROCESS_MITIGATION_CHILD_PROCESS_POLICY@@ �� U C � : � _SE_TOKEN_USER .?AU_SE_TOKEN_USER@@ ��2 � _TOKEN_USER .?AU_TOKEN_USER@@ B � _SID_AND_ATTRIBUTES .?AU_SID_AND_ATTRIBUTES@@ " D �J
X TokenUser
Y User �
� Sid ��
Z Buffer ���: [ L _SE_TOKEN_USER .?AU_SE_TOKEN_USER@@ �� \ v
� J � _EFI_DRIVER_ENTRY_LIST .?AU_EFI_DRIVER_ENTRY_LIST@@ ��6
" NextEntryOffset ��
� DriverEntry ��J ` _EFI_DRIVER_ENTRY_LIST .?AU_EFI_DRIVER_ENTRY_LIST@@ �� a " > � tagHIGHCONTRASTW .?AUtagHIGHCONTRASTW@@ ��
c
� F
u cbSize ���
" dwFlags ��
q lpszDefaultScheme > e tagHIGHCONTRASTW .?AUtagHIGHCONTRASTW@@ �� f p2 " ViewShare ViewUnmap : t h _SECTION_INHERIT .?AW4_SECTION_INHERIT@@ ��� i ? � � PowerDeviceUnspecified ��� PowerDeviceD0 PowerDeviceD1 PowerDeviceD2 PowerDeviceD3 PowerDeviceMaximum ���> t k _DEVICE_POWER_STATE .?AW4_DEVICE_POWER_STATE@@ � l � v PerfInfoMemReset � PerfInfoMemResetUndo � PerfInfoMemResetUndoFailed ��� PerfInfoMemResetMax ��R t n _PERFINFO_MEM_RESET_INFO_TYPE .?AW4_PERFINFO_MEM_RESET_INFO_TYPE@@ � o � q > � _TRACE_GUID_INFO .?AU_TRACE_GUID_INFO@@ ��.
" InstanceCount
" Reserved �> r _TRACE_GUID_INFO .?AU_TRACE_GUID_INFO@@ �� s � � CrossProcOperationMemoryAllocPreNotify ��� CrossProcOperationMemoryAllocPostNotify �� CrossProcOperationMemoryFreePreNotify CrossProcOperationMemoryFreePostNotify ��� CrossProcOperationMemoryProtectPreNotify � CrossProcOperationMemoryProtectPostNotify CrossProcOperationInstructionCacheFlush �� CrossProcOperationInstructionCacheFlushHeavy � CrossProcOperationMemoryDirtyNotify ��b t u RTLWOW64_CROSSPROCESS_WORK_OPERATION .?AW4RTLWOW64_CROSSPROCESS_WORK_OPERATION@@ ��� v L � J � _PROCESS_DISK_COUNTERS .?AU_PROCESS_DISK_COUNTERS@@ ��
x
� �
# BytesRead
# BytesWritten �
# ReadOperationCount ���
# WriteOperationCount ��
# FlushOperationCount ��J z ( _PROCESS_DISK_COUNTERS .?AU_PROCESS_DISK_COUNTERS@@ �� { a � j � _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION .?AU_SYSTEM_CODEINTEGRITYPOLICY_INFORMATION@@
}
� Z
" Options ��
" HVCIOptions ��
# Version ��
� PolicyGuid ���j _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION .?AU_SYSTEM_CODEINTEGRITYPOLICY_INFORMATION@@ � � n BootEntropySourceNone BootEntropySourceSeedfile BootEntropySourceExternal BootEntropySourceTpm � BootEntropySourceRdrand �� BootEntropySourceTime BootEntropySourceAcpiOem0 BootEntropySourceUefi BootEntropySourceCng � BootEntropySourceTcbTpm ��
BootEntropySourceTcbRdrand ���
BootMaxEntropySources F t � _BOOT_ENTROPY_SOURCE_ID .?AW4_BOOT_ENTROPY_SOURCE_ID@@ � �
�
� Z � _RTL_PROCESS_MODULE_INFORMATION .?AU_RTL_PROCESS_MODULE_INFORMATION@@ " ��
Section ��
MappedBase ���
ImageBase
" ImageSize
" Flags
! LoadOrderIndex ���
! InitOrderIndex ���
! LoadCount
! OffsetToFileName �
� FullPathName �Z
� _RTL_PROCESS_MODULE_INFORMATION .?AU_RTL_PROCESS_MODULE_INFORMATION@@ � u � R � _PERFINFO_PROCESS_PERFCTR64 .?AU_PERFINFO_PROCESS_PERFCTR64@@
�
� �
" ProcessId
" PageFaultCount ���
" HandleCount ��
" Reserved �
# PeakVirtualSize ��
# PeakWorkingSetSize ���
# PeakPagefileUsage
# ( QuotaPeakPagedPoolUsage ��
# 0 QuotaPeakNonPagedPoolUsage ���
# 8 VirtualSize ��
# @ WorkingSetSize ���
# H PagefileUsage
# P QuotaPagedPoolUsage ��
# X QuotaNonPagedPoolUsage ���
# ` PrivatePageCount �R � h _PERFINFO_PROCESS_PERFCTR64 .?AU_PERFINFO_PROCESS_PERFCTR64@@ � � � EventSecuritySetDACL � EventSecuritySetSACL � EventSecurityAddDACL � EventSecurityAddSACL � EventSecurityMax �F t � EVENTSECURITYOPERATION .?AW4EVENTSECURITYOPERATION@@ ��� � � 2 ^ POINTER_FEEDBACK_DEFAULT � POINTER_FEEDBACK_INDIRECT POINTER_FEEDBACK_NONE B t � POINTER_FEEDBACK_MODE .?AW4POINTER_FEEDBACK_MODE@@ � � $ F � _SECURITY_ATTRIBUTES .?AU_SECURITY_ATTRIBUTES@@ ��R
" nLength ��
lpSecurityDescriptor �
t bInheritHandle ���F � _SECURITY_ATTRIBUTES .?AU_SECURITY_ATTRIBUTES@@ �� � c . � SectionBasicInformation �� SectionImageInformation �� SectionRelocationInformation � SectionOriginalBaseInformation ��� SectionInternalImageInformation �� MaxSectionInfoClass ��N t � _SECTION_INFORMATION_CLASS .?AW4_SECTION_INFORMATION_CLASS@@ ��� � ^ " " " �
�
� ^ � _FILE_FS_VOLUME_FLAGS_INFORMATION .?AU_FILE_FS_VOLUME_FLAGS_INFORMATION@@
" Flags ^ � _FILE_FS_VOLUME_FLAGS_INFORMATION .?AU_FILE_FS_VOLUME_FLAGS_INFORMATION@@ � � ^ � _ETW_SESSION_NOTIFICATION_PACKET .?AU_ETW_SESSION_NOTIFICATION_PACKET@@ ��N � _ETW_NOTIFICATION_HEADER .?AU_ETW_NOTIFICATION_HEADER@@ �� EtwSessionNotificationMediaChanged ��� EtwSessionNotificationSessionTerminated �� EtwSessionNotificationLogfileError ��� EtwSessionNotificationRealtimeError �� EtwSessionNotificationSessionStarted � EtwSessionNotificationMax V t � _ETW_SESSION_NOTIFICATION_TYPE .?AW4_ETW_SESSION_NOTIFICATION_TYPE@@ ��� � � h r
� NotificationHeader ���
� H Type �
L Status ���
# P TraceHandle ��
� X Reserved �^ � ` _ETW_SESSION_NOTIFICATION_PACKET .?AU_ETW_SESSION_NOTIFICATION_PACKET@@ �� � � q Z � _ETW_CREATEDELETE_OBJECT_EVENT .?AU_ETW_CREATEDELETE_OBJECT_EVENT@@ ��
�
� .
Object ���
! ObjectType ���Z � _ETW_CREATEDELETE_OBJECT_EVENT .?AU_ETW_CREATEDELETE_OBJECT_EVENT@@ �� � � v
Z � _ETW_COVERAGE_SAMPLER_OPTION_FLAGS .?AT_ETW_COVERAGE_SAMPLER_OPTION_FLAGS@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��n
" AllFlags �
� RequireProfileTotalIssuesSource ��
� ForceProfileTimeSource ���
� NoProfileSampling
� NoCSwitchSampling
� NoReadyThreadSampling
� NoFaultSampling ��
� NoStackCache �
� NoSampleBuffers ��
� NoPauseWhenFull ��
� NoLowPriority
� WithAppId
� FilterKernel �Z
� _ETW_COVERAGE_SAMPLER_OPTION_FLAGS .?AT_ETW_COVERAGE_SAMPLER_OPTION_FLAGS@@ �� � � � v � _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION@@
�
� .
SectionObject
RangeBase v � _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION@@ � � r � WorkerFactoryCallbackNormal �� WorkerFactoryCallbackLongRunning � WorkerFactoryCallbackIndependent � WorkerFactoryCallbackDetectedUnrecoverableError ��V t � _WORKER_FACTORY_CALLBACK_CLASS .?AW4_WORKER_FACTORY_CALLBACK_CLASS@@ ��� � � � � RelationProcessorCore RelationNumaNode � RelationCache RelationProcessorPackage � RelationGroup ���RelationAll V t � _LOGICAL_PROCESSOR_RELATIONSHIP .?AW4_LOGICAL_PROCESSOR_RELATIONSHIP@@ � � { � J � DISK_SPACE_INFORMATION .?AUDISK_SPACE_INFORMATION@@ ��
# ActualTotalAllocationUnits ���
# ActualAvailableAllocationUnits ���
# ActualPoolUnavailableAllocationUnits �
# CallerTotalAllocationUnits ���
# CallerAvailableAllocationUnits ���
# ( CallerPoolUnavailableAllocationUnits �
# 0 UsedAllocationUnits ��
# 8 TotalReservedAllocationUnits �
# @ VolumeStorageReserveAllocationUnits ��
# H AvailableCommittedAllocationUnits
# P PoolAvailableAllocationUnits �
" X SectorsPerAllocationUnit �
" \ BytesPerSector ���J
� ` DISK_SPACE_INFORMATION .?AUDISK_SPACE_INFORMATION@@ ��2 onecore\external\sdk\inc\minwin\fileapi.h �� � � � ^ � _PERFINFO_SAMPLED_PROFILE_CONFIG .?AU_PERFINFO_SAMPLED_PROFILE_CONFIG@@ ��F
" Source ���
" NewInterval ��
" OldInterval ��^ � _PERFINFO_SAMPLED_PROFILE_CONFIG .?AU_PERFINFO_SAMPLED_PROFILE_CONFIG@@ �� � � � z IMDT_UNAVAILABLE � IMDT_KEYBOARD IMDT_MOUSE ��� IMDT_TOUCH ��� IMDT_PEN � IMDT_TOUCHPAD R t � tagINPUT_MESSAGE_DEVICE_TYPE .?AW4tagINPUT_MESSAGE_DEVICE_TYPE@@ ��� � �= n � _EVENT_TRACE_PROFILE_COUNTER_INFORMATION .?AU_EVENT_TRACE_PROFILE_COUNTER_INFORMATION@@ ��Z
� EventTraceInformationClass ���
# TraceHandle ��
� ProfileSource n � _EVENT_TRACE_PROFILE_COUNTER_INFORMATION .?AU_EVENT_TRACE_PROFILE_COUNTER_INFORMATION@@ �� � � F 6 � _TOKEN_GROUPS .?AU_TOKEN_GROUPS@@ Y " �.
" GroupCount ���
� Groups ���6 � _TOKEN_GROUPS .?AU_TOKEN_GROUPS@@ � � N � _ETW_KQUEUE_DEQUEUE_EVENT .?AU_ETW_KQUEUE_DEQUEUE_EVENT@@
�
� " �B
" ThreadId �
" EntryCount ���
� Entries ��N � _ETW_KQUEUE_DEQUEUE_EVENT .?AU_ETW_KQUEUE_DEQUEUE_EVENT@@ � � �
Y User �2 � _TOKEN_USER .?AU_TOKEN_USER@@ � p � � � F GEOCLASS_NATION �� GEOCLASS_REGION �� GEOCLASS_ALL �. t � SYSGEOCLASS .?AW4SYSGEOCLASS@@ � � � ) F UNSPECIFIED_COMPARTMENT_ID ��� DEFAULT_COMPARTMENT_ID ���6 t � COMPARTMENT_ID .?AW4COMPARTMENT_ID@@ ��� � �
" � B � _SHUFFLE_FILE_DATA .?AU_SHUFFLE_FILE_DATA@@ ��
�
� B
StartingOffset ���
Length ���
" Flags B � _SHUFFLE_FILE_DATA .?AU_SHUFFLE_FILE_DATA@@ �� � Q( R � _FILE_QUERY_SPARING_BUFFER .?AU_FILE_QUERY_SPARING_BUFFER@@ ��r
" SparingUnitBytes �
SoftwareSparing ��
" TotalSpareBlocks �
" FreeSpareBlocks ��R � _FILE_QUERY_SPARING_BUFFER .?AU_FILE_QUERY_SPARING_BUFFER@@ �� � 1 B � _RASTERIZER_STATUS .?AU_RASTERIZER_STATUS@@ ��>
nSize
wFlags ���
nLanguageID ��B � _RASTERIZER_STATUS .?AU_RASTERIZER_STATUS@@ �� �
* � _FIBER .?AU_FIBER@@ ��. � _CONTEXT .?AU_CONTEXT@@ ��. � _Wx86TIB .?AU_Wx86TIB@@ ��
�
�
� B
FiberData
� ExceptionList
StackBase
StackLimit ���
DeallocationStack
FiberContext �
�Wx86Tib ��
�ActivationContextStackPointer
�FlsData ��
" �GuaranteedStackBytes �
! �TebFlags �
! �ReservedPad ��
" �FiberCookie ��*
�_FIBER .?AU_FIBER@@ �� a , 6 � _MEMORYSTATUS .?AU_MEMORYSTATUS@@ �
" dwLength �
" dwMemoryLoad �
" dwTotalPhys ��
" dwAvailPhys ��
" dwTotalPageFile ��
" dwAvailPageFile ��
" dwTotalVirtual ���
" dwAvailVirtual ���6
_MEMORYSTATUS .?AU_MEMORYSTATUS@@ V 6 � tagAXISINFOW .?AUtagAXISINFOW@@ ��J
axMinValue ���
axMaxValue ���
? axAxisName ���6 ( tagAXISINFOW .?AUtagAXISINFOW@@ �� & : � _WOW64_CONTEXT .?AU_WOW64_CONTEXT@@ ��N � _WOW64_FLOATING_SAVE_AREA .?AU_WOW64_FLOATING_SAVE_AREA@@ �
" ContextFlags �
" Dr0 ��
" Dr1 ��
" Dr2 ��
" Dr3 ��
" Dr6 ��
" Dr7 ��
FloatSave
" � SegGs
" � SegFs
" � SegEs
" � SegDs
" � Edi ��
" � Esi ��
" � Ebx ��
" � Edx ��
" � Ecx ��
" � Eax ��
" � Ebp ��
" � Eip ��
" � SegCs
" � EFlags ���
" � Esp ��
" � SegSs
V � ExtendedRegisters : �_WOW64_CONTEXT .?AU_WOW64_CONTEXT@@ ��. onecore\internal\sdk\inc\ntwow64_x.h ��� \
B MutantBasicInformation ��� MutantOwnerInformation ���J t _MUTANT_INFORMATION_CLASS .?AW4_MUTANT_INFORMATION_CLASS@@ � ) > � _KSPIN_LOCK_QUEUE .?AU_KSPIN_LOCK_QUEUE@@
�
"
� "
Next �
Lock �> _KSPIN_LOCK_QUEUE .?AU_KSPIN_LOCK_QUEUE@@ � � V � _PERFINFO_CC_LAZY_WRITE_SCAN .?AU_PERFINFO_CC_LAZY_WRITE_SCAN@@ ��
"
� r
" WorkItemKey ��
" ReasonForFlush ���
" PagesToWrite �
" TotalDirtyPages ��
" AvailablePages ���
" DirtyPageThreshold ���
" NumberOfMappedVacbs ��
" TopDirtyPageThreshold
" BottomDirtyPageThreshold �
" $ AverageAvailablePages
" ( AverageDirtyPages
" , ConsecutiveWorklessLazywriteScans V $ 0 _PERFINFO_CC_LAZY_WRITE_SCAN .?AU_PERFINFO_CC_LAZY_WRITE_SCAN@@ �� % � �
)
� J � _LDR_DLL_NOTIFICATION_DATA .?AT_LDR_DLL_NOTIFICATION_DATA@@ ��
(
� ^ � _LDR_DLL_LOADED_NOTIFICATION_DATA .?AU_LDR_DLL_LOADED_NOTIFICATION_DATA@@ *
* Loaded ���
� Unloaded �J + _LDR_DLL_NOTIFICATION_DATA .?AT_LDR_DLL_NOTIFICATION_DATA@@ �� , u � > � tagMENUITEMINFOA .?AUtagMENUITEMINFOA@@ ��
. ��
/
� * � HMENU__ .?AUHMENU__@@
1
� �
u cbSize ���
u fMask
u fType
u fState ���
u wID ��
2 hSubMenu �
hbmpChecked ��
hbmpUnchecked
" dwItemData ���
p $ dwTypeData ���
u ( cch ��
, hbmpItem �> 3 0 tagMENUITEMINFOA .?AUtagMENUITEMINFOA@@ �� 4 � N � _SYSTEM_POWER_INFORMATION .?AU_SYSTEM_POWER_INFORMATION@@
6
� f
" MaxIdlenessAllowed ���
" Idleness �
" TimeRemaining
CoolingMode ��N 8 _SYSTEM_POWER_INFORMATION .?AU_SYSTEM_POWER_INFORMATION@@ 9 � : � tagICEXYZTRIPLE .?AUtagICEXYZTRIPLE@@ . � tagCIEXYZ .?AUtagCIEXYZ@@ F
< ciexyzRed
< ciexyzGreen ��
< ciexyzBlue ���: = $ tagICEXYZTRIPLE .?AUtagICEXYZTRIPLE@@ > � � " " " @ B � _LAST_EXCEPTION_LOG .?AU_LAST_EXCEPTION_LOG@@
B
� > � _EXCEPTION_RECORD .?AU_EXCEPTION_RECORD@@ � ExceptionContinueExecution ��� ExceptionContinueSearch �� ExceptionNestedException � ExceptionCollidedUnwind ��F t E _EXCEPTION_DISPOSITION .?AW4_EXCEPTION_DISPOSITION@@ ���. onecore\external\sdk\inc\crt\excpt.h ��� F G ' z
D ExceptionRecord ��
P ContextRecord
" ControlPc
F Disposition ��
� $HandlerData ��B I 8_LAST_EXCEPTION_LOG .?AU_LAST_EXCEPTION_LOG@@ J � , * � _FIXED .?AU_FIXED@@ ��"
! fract
value * M _FIXED .?AU_FIXED@@ �� N c
ManageHotPatchLoadPatch �� ManageHotPatchUnloadPatch ManageHotPatchQueryPatches ��� ManageHotPatchLoadPatchForUser ��� ManageHotPatchUnloadPatchForUser � ManageHotPatchQueryPatchesForUser ManageHotPatchQueryActivePatches � ManageHotPatchMax R t P _HOT_PATCH_INFORMATION_CLASS .?AW4_HOT_PATCH_INFORMATION_CLASS@@ ��� Q :
Q
� R � _SYSTEM_DEVICE_INFORMATION .?AU_SYSTEM_DEVICE_INFORMATION@@ ��
T
� �
" NumberOfDisks
" NumberOfFloppies �
" NumberOfCdRoms ���
" NumberOfTapes
" NumberOfSerialPorts ��
" NumberOfParallelPorts R V _SYSTEM_DEVICE_INFORMATION .?AU_SYSTEM_DEVICE_INFORMATION@@ �� W x ^ � _RTL_STACK_TRACE_DATABASE_CREATE .?AU_RTL_STACK_TRACE_DATABASE_CREATE@@ ��J
CommitBase ���
" CommitSize ���
" ReserveSize ��^ Z _RTL_STACK_TRACE_DATABASE_CREATE .?AU_RTL_STACK_TRACE_DATABASE_CREATE@@ �� [ � � F � _EISA_PORT_DESCRIPTOR .?AU_EISA_PORT_DESCRIPTOR@@
��
��
��
��Z
^ NumberPorts ��
_ Reserved �
` Shared ���
a MoreEntries ��F b _EISA_PORT_DESCRIPTOR .?AU_EISA_PORT_DESCRIPTOR@@ c � f � _SYSTEM_PROCESSOR_POLICY_INFORMATION .?AU_SYSTEM_PROCESSOR_POLICY_INFORMATION@@ ��
e
� 6 � _XSAVE_POLICY .?AU_XSAVE_POLICY@@ >
" Length ���
" PolicyId �
g Policy ���f h 8 _SYSTEM_PROCESSOR_POLICY_INFORMATION .?AU_SYSTEM_PROCESSOR_POLICY_INFORMATION@@ �� i d : � tagICONMETRICSA .?AUtagICONMETRICSA@@ 2 � tagLOGFONTA .?AUtagLOGFONTA@@ r
u cbSize ���
t iHorzSpacing �
t iVertSpacing �
t iTitleWrap ���
l lfFont ���: m L tagICONMETRICSA .?AUtagICONMETRICSA@@ n &2 Z � _INVERTED_FUNCTION_TABLE_ENTRY .?AU_INVERTED_FUNCTION_TABLE_ENTRY@@ ��^
FunctionTable
ImageBase
" SizeOfImage ��
" SizeOfTable ��Z q _INVERTED_FUNCTION_TABLE_ENTRY .?AU_INVERTED_FUNCTION_TABLE_ENTRY@@ �� r � � j � _JOBOBJECT_LIMIT_VIOLATION_INFORMATION .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION@@ ��R
" LimitFlags ���
" ViolationLimitFlags ��
# IoReadBytes ��
# IoReadBytesLimit �
# IoWriteBytes �
# IoWriteBytesLimit
} ( PerJobUserTime ���
} 0 PerJobUserTimeLimit ��
# 8 JobMemory
# @ JobMemoryLimit ���
� H RateControlTolerance �
� L RateControlToleranceLimit j u P _JOBOBJECT_LIMIT_VIOLATION_INFORMATION .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION@@ �� v C � J � _DESCRIPTOR_TABLE_ENTRY .?AU_DESCRIPTOR_TABLE_ENTRY@@
x
� 2 � _LDT_ENTRY .?AU_LDT_ENTRY@@ ��.
" Selector �
z Descriptor ���J { _DESCRIPTOR_TABLE_ENTRY .?AU_DESCRIPTOR_TABLE_ENTRY@@ * onecore\internal\sdk\inc\nti386.h �� | } � 6 � tagTOGGLEKEYS .?AUtagTOGGLEKEYS@@ *
u cbSize ���
" dwFlags ��6 � tagTOGGLEKEYS .?AUtagTOGGLEKEYS@@ � Z4 2 � tagRAWINPUT .?AUtagRAWINPUT@@
�
� > � tagRAWINPUTHEADER .?AUtagRAWINPUTHEADER@@ : � tagRAWKEYBOARD .?AUtagRAWKEYBOARD@@ ��. � tagRAWHID .?AUtagRAWHID@@ 6
� mouse
� keyboard �
� hid ��2 � <anonymous-tag> .?AT<anonymous-tag>@@ � �: &
� header ���
� data �2 � ( tagRAWINPUT .?AUtagRAWINPUT@@ � �: v FeatureVariantPayloadKindNone FeatureVariantPayloadKindResident FeatureVariantPayloadKindExternal Z t � _RTL_FEATURE_VARIANT_PAYLOAD_KIND .?AW4_RTL_FEATURE_VARIANT_PAYLOAD_KIND@@ � � � M
�
� f � _PROCESS_EXTENDED_BASIC_INFORMATION64 .?AU_PROCESS_EXTENDED_BASIC_INFORMATION64@@
�
� V � _PROCESS_BASIC_INFORMATION64 .?AU_PROCESS_BASIC_INFORMATION64@@ ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��>
# Size �
� BasicInfo
u 8 Flags
� 8 IsProtectedProcess ���
� 8 IsWow64Process ���
� 8 IsProcessDeleting
� 8 IsCrossSessionCreate �
� 8 IsFrozen �
� 8 IsBackground �
� 8 IsStronglyNamed ��
� 8 IsSecureProcess ��
� 8 IsPicoProcess
� 8 SpareBits f
� @ _PROCESS_EXTENDED_BASIC_INFORMATION64 .?AU_PROCESS_EXTENDED_BASIC_INFORMATION64@@ � a � > � tagCOPYDATASTRUCT .?AUtagCOPYDATASTRUCT@@
�
� >
" dwData ���
" cbData ���
lpData ���> � tagCOPYDATASTRUCT .?AUtagCOPYDATASTRUCT@@ � ) F � _RTL_PROTECTED_ACCESS .?AU_RTL_PROTECTED_ACCESS@@ Z
" DominateMask �
" DeniedProcessAccess ��
" DeniedThreadAccess ���F � _RTL_PROTECTED_ACCESS .?AU_RTL_PROTECTED_ACCESS@@ � � � > � MFT_ENUM_DATA_V1 .?AUMFT_ENUM_DATA_V1@@ ��
�
� �
# StartFileReferenceNumber �
LowUsn ���
HighUsn ��
! MinMajorVersion ��
! MaxMajorVersion ��> � MFT_ENUM_DATA_V1 .?AUMFT_ENUM_DATA_V1@@ �� � �
V � _PS_CPU_QUOTA_SET_INFORMATION .?AU_PS_CPU_QUOTA_SET_INFORMATION@@ .
SessionHandle
" Weight ���V � _PS_CPU_QUOTA_SET_INFORMATION .?AU_PS_CPU_QUOTA_SET_INFORMATION@@ � a * RTL_RESOURCE_POLICY_FLAGS_NONE ���N t � _RTL_RESOURCE_POLICY_FLAGS .?AW4_RTL_RESOURCE_POLICY_FLAGS@@ ��� � � C > � _FILE_SEGMENT_ELEMENT .?AT_FILE_SEGMENT_ELEMENT@@
�
� *
Buffer ���
# Alignment > � _FILE_SEGMENT_ELEMENT .?AT_FILE_SEGMENT_ELEMENT@@ � Z WnfInfoStateNameExist WnfInfoSubscribersPresent WnfInfoIsQuiescent ���N t � _WNF_STATE_NAME_INFORMATION .?AW4_WNF_STATE_NAME_INFORMATION@@ � �
6 � _COMMTIMEOUTS .?AU_COMMTIMEOUTS@@ �
" ReadIntervalTimeout ��
" ReadTotalTimeoutMultiplier ���
" ReadTotalTimeoutConstant �
" WriteTotalTimeoutMultiplier ��
" WriteTotalTimeoutConstant 6 � _COMMTIMEOUTS .?AU_COMMTIMEOUTS@@ � 2 � _RTL_TICK_LOCK .?AT_RTL_TICK_LOCK@@ ��
# ��
# ?��6
# AsULong64
� Busy �
� Ticks 2 � _RTL_TICK_LOCK .?AT_RTL_TICK_LOCK@@ �� � � � f � _FILE_STORAGE_RESERVE_ID_INFORMATION .?AU_FILE_STORAGE_RESERVE_ID_INFORMATION@@ ��
�
� � StorageReserveIdNone � StorageReserveIdHard � StorageReserveIdSoft � StorageReserveIdUpdateScratch StorageReserveIdMax ��> t � _STORAGE_RESERVE_ID .?AW4_STORAGE_RESERVE_ID@@ � �
� StorageReserveId �f � _FILE_STORAGE_RESERVE_ID_INFORMATION .?AU_FILE_STORAGE_RESERVE_ID_INFORMATION@@ �� � S+ 6 � _FILE_ID_INFO .?AU_FILE_ID_INFO@@
�
� 6
# VolumeSerialNumber ���
� FileId ���6 � _FILE_ID_INFO .?AU_FILE_ID_INFO@@ � &# R � _RTL_CRITICAL_SECTION_DEBUG .?AU_RTL_CRITICAL_SECTION_DEBUG@@ F � _RTL_CRITICAL_SECTION .?AU_RTL_CRITICAL_SECTION@@
�
� �
! Type �
! CreatorBackTraceIndex
� CriticalSection ��
� ProcessLocksList �
" EntryCount ���
" ContentionCount ��
" Flags
! CreatorBackTraceIndexHigh
! SpareUSHORT ��R � _RTL_CRITICAL_SECTION_DEBUG .?AU_RTL_CRITICAL_SECTION_DEBUG@@ � L < V � _FILE_PIPE_REMOTE_INFORMATION .?AU_FILE_PIPE_REMOTE_INFORMATION@@
�
� B
} CollectDataTime ��
" MaximumCollectionCount ���V � _FILE_PIPE_REMOTE_INFORMATION .?AU_FILE_PIPE_REMOTE_INFORMATION@@ � \ ^ � _RTL_FEATURE_CONFIGURATION_TABLE .?AU_RTL_FEATURE_CONFIGURATION_TABLE@@ ��R � _RTL_FEATURE_CONFIGURATION .?AU_RTL_FEATURE_CONFIGURATION@@ �� � " �.
" FeatureCount �
� Features �^ � _RTL_FEATURE_CONFIGURATION_TABLE .?AU_RTL_FEATURE_CONFIGURATION_TABLE@@ �� � � o ^ � _THREAD_LAST_SYSCALL_INFORMATION .?AU_THREAD_LAST_SYSCALL_INFORMATION@@ �� ! " �Z
FirstArgument
! SystemCallNumber �
� Pad ��
# WaitTime �^ � _THREAD_LAST_SYSCALL_INFORMATION .?AU_THREAD_LAST_SYSCALL_INFORMATION@@ �� � a � > � _WIN32_FIND_DATAW .?AU_WIN32_FIND_DATAW@@
�
� q " �
" dwFileAttributes �
� ftCreationTime ���
� ftLastAccessTime �
� ftLastWriteTime ��
" nFileSizeHigh
" nFileSizeLow �
" $ dwReserved0 ��
" ( dwReserved1 ��
s , cFileName
� 4cAlternateFileName ���>
� P_WIN32_FIND_DATAW .?AU_WIN32_FIND_DATAW@@ � c w ^ � __PUBLIC_OBJECT_TYPE_INFORMATION .?AU__PUBLIC_OBJECT_TYPE_INFORMATION@@ �� " " X �*
� TypeName �
� Reserved �^ � ` __PUBLIC_OBJECT_TYPE_INFORMATION .?AU__PUBLIC_OBJECT_TYPE_INFORMATION@@ �� � � �
� V � _RTL_CRITICAL_SECTION_DEBUG32 .?AU_RTL_CRITICAL_SECTION_DEBUG32@@
�
� �
! Type �
! CreatorBackTraceIndex
" CriticalSection ��
ProcessLocksList �
" EntryCount ���
" ContentionCount ��
� Spare V � _RTL_CRITICAL_SECTION_DEBUG32 .?AU_RTL_CRITICAL_SECTION_DEBUG32@@ � L q ^ � _SYSTEM_SHADOW_STACK_INFORMATION .?AU_SYSTEM_SHADOW_STACK_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
� CetCapable ���
� UserCetAllowed ���
ReservedForUserCet ���
KernelCetEnabled �
ReservedForKernelCet �
Reserved �^ _SYSTEM_SHADOW_STACK_INFORMATION .?AU_SYSTEM_SHADOW_STACK_INFORMATION@@ �� )
j RpcCurrentUniqueUser � RpcBackEndConnectionAttempts � RpcBackEndConnectionFailed ��� RpcRequestsPerSecond � RpcIncomingConnections ��� RpcIncomingBandwidth � RpcOutgoingBandwidth � RpcAttemptedLbsDecisions � RpcFailedLbsDecisions
RpcAttemptedLbsMessages �� RpcFailedLbsMessages � RpcLastCounter ���B t RpcProxyPerfCounters .?AW4RpcProxyPerfCounters@@ ��� � ` t "
� 6 � _ARM64_NT_NEON128 .?AT_ARM64_NT_NEON128@@ A " � @ " � ! " �R
# Low ��
High �
D
S
H
� B 6 _ARM64_NT_NEON128 .?AT_ARM64_NT_NEON128@@ . onecore\external\sdk\inc\ntarm64_x.h ��� B � IMAGE_COR20_HEADER .?AUIMAGE_COR20_HEADER@@ ��F � _IMAGE_DATA_DIRECTORY .?AU_IMAGE_DATA_DIRECTORY@@ V
" cb ���
! MajorRuntimeVersion ��
! MinorRuntimeVersion ��
MetaData �
" Flags
" EntryPointToken ��
" EntryPointRVA
Resources
StrongNameSignature ��
( CodeManagerTable �
0 VTableFixups �
8 ExportAddressTableJumps ��
@ ManagedNativeHeader ��B
H IMAGE_COR20_HEADER .?AUIMAGE_COR20_HEADER@@ �� [ �
�
�
! ��
! ��z
! Reserved1
! ExtType ��
Linkage ��
Reserved2
! DataSize �
# DataPtr ��^ _EVENT_HEADER_EXTENDED_DATA_ITEM .?AU_EVENT_HEADER_EXTENDED_DATA_ITEM@@ �� � G t u
!
�
�
�
x
y . $ tagPOINTS .?AUtagPOINTS@@ % � : � _RTL_HASH_TABLE .?AU_RTL_HASH_TABLE@@
" ��
" ��
� ^
" EntryCount ���
( MaskBitCount �
) BucketCount ��
* Buckets ��: + _RTL_HASH_TABLE .?AU_RTL_HASH_TABLE@@ . onecore\internal\sdk\inc\rtlhashdef.h �� , - n � _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY@@
/
� "
N DisableNonSystemFonts n 1 _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY@@ 2 � � � FileStorageTierClassUnspecified �� FileStorageTierClassCapacity � FileStorageTierClassPerformance �� FileStorageTierClassMax ��J t 4 _FILE_STORAGE_TIER_CLASS .?AW4_FILE_STORAGE_TIER_CLASS@@ ��� 5 �
5
� > � tagTITLEBARINFOEX .?AUtagTITLEBARINFOEX@@
8
� " " � � " ` �V
" cbSize ���
� rcTitleBar ���
: rgstate ��
; , rgrect ���> < � tagTITLEBARINFOEX .?AUtagTITLEBARINFOEX@@ = 9 f PerfInfoDebugEventReceived ��� PerfInfoDebugEventContinued �� PerfInfoDebugEventMax R t ? _PERFINFO_DEBUG_EVENT_REASON .?AW4_PERFINFO_DEBUG_EVENT_REASON@@ ��� @ �
6 � _WMI_SPINLOCK .?AU_WMI_SPINLOCK@@
B
�
��
��
��Z
SpinLockAddress ��
CallerAddress
# AcquireTime ��
# ReleaseTime ��
" WaitTimeInCycles �
" SpinCount
" ThreadId �
" $ InterruptCount ���
( Irql �
) AcquireDepth �
D * AcquireMode ��
E * ExecuteDpc ���
F * ExecuteIsr ���
* Flags
� + Reserved �6 G 0 _WMI_SPINLOCK .?AU_WMI_SPINLOCK@@ H � D > � _PERFINFO_CCSWAP .?AU_PERFINFO_CCSWAP@@ ��
" ��
" ��
" ��
" ��
"
��
" ��
K DataType �
L TimeDelta
M OldThreadIdIndex �
N OldThreadStateWr �
O OldThreadPriority
P NewThreadWaitTime > Q _PERFINFO_CCSWAP .?AU_PERFINFO_CCSWAP@@ �� R � � B � _TRACE_ENABLE_INFO .?AU_TRACE_ENABLE_INFO@@ ��
T
� �
" IsEnabled
Level
Reserved1
! LoggerId �
" EnableProperty ���
" Reserved2
# MatchAnyKeyword ��
# MatchAllKeyword ��B V _TRACE_ENABLE_INFO .?AU_TRACE_ENABLE_INFO@@ �� W � � f � _VIRTUALIZATION_INSTANCE_INFO_OUTPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_OUTPUT@@ ��&
� VirtualizationInstanceID �f Z _VIRTUALIZATION_INSTANCE_INFO_OUTPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_OUTPUT@@ �� [ �" V � _FILE_TYPE_NOTIFICATION_INPUT .?AU_FILE_TYPE_NOTIFICATION_INPUT@@ � " �F
" Flags
" NumFileTypeIDs ���
^ FileTypeID ���V _ _FILE_TYPE_NOTIFICATION_INPUT .?AU_FILE_TYPE_NOTIFICATION_INPUT@@ ` ^ � _RTL_QUERY_DEBUG_INFORMATION_INFO .?AU_RTL_QUERY_DEBUG_INFORMATION_INFO@@ B
" UniqueProcessId ��
" Flags
# Buffer ���^ c _RTL_QUERY_DEBUG_INFORMATION_INFO .?AU_RTL_QUERY_DEBUG_INFORMATION_INFO@@ d L
< f f � _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA@@ .
� DeviceInstance ���
" Flags f i _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA@@ j � � F � _SYSDBG_CONTROL_SPACE .?AU_SYSDBG_CONTROL_SPACE@@
l
� R
# Address ��
Buffer ���
" Request ��
" Processor F n _SYSDBG_CONTROL_SPACE .?AU_SYSDBG_CONTROL_SPACE@@ o : � _TXFS_MODIFY_RM .?AU_TXFS_MODIFY_RM@@ �
" Flags
" LogContainerCountMax �
" LogContainerCountMin �
" LogContainerCount
" LogGrowthIncrement ���
" LogAutoShrinkPercentage ��
# Reserved �
! LoggingMode ��: r ( _TXFS_MODIFY_RM .?AU_TXFS_MODIFY_RM@@ s � R DirectoryNotifyInformation ��� DirectoryNotifyExtendedInformation ���^ t u _DIRECTORY_NOTIFY_INFORMATION_CLASS .?AW4_DIRECTORY_NOTIFY_INFORMATION_CLASS@@ � v �
v
� >
AceType ��
AceFlags �
! AceSize ��2 y _ACE_HEADER .?AU_ACE_HEADER@@ z � F � _HEAP_SUBSEGMENT_FREE .?AU_HEAP_SUBSEGMENT_FREE@@ &
� Header ���
� Event F } 0 _HEAP_SUBSEGMENT_FREE .?AU_HEAP_SUBSEGMENT_FREE@@ ~ � F * � _cpinfo .?AU_cpinfo@@
�
� " � " �F
u MaxCharSize ��
� DefaultChar ��
� LeadByte �* � _cpinfo .?AU_cpinfo@@ � � ? : � tagENUMLOGFONTW .?AUtagENUMLOGFONTW@@
�
� 2 � tagLOGFONTW .?AUtagLOGFONTW@@ q " � � q " @ �F
� elfLogFont ���
� \ elfFullName ��
� � elfStyle �: � tagENUMLOGFONTW .?AUtagENUMLOGFONTW@@ � � J � _FILE_LINK_INFORMATION .?AU_FILE_LINK_INFORMATION@@ ��
�
� v
ReplaceIfExists ��
" Flags
RootDirectory
" FileNameLength ���
FileName �J � _FILE_LINK_INFORMATION .?AU_FILE_LINK_INFORMATION@@ �� � � b � _PERFINFO_DRIVER_COMPLETIONROUTINE .?AU_PERFINFO_DRIVER_COMPLETIONROUTINE@@ ��
�
� B
Routine ��
IrpPtr ���
" UniqMatchId ��b � _PERFINFO_DRIVER_COMPLETIONROUTINE .?AU_PERFINFO_DRIVER_COMPLETIONROUTINE@@ �� � � % 6 � _XSAVE_VENDOR .?AU_XSAVE_VENDOR@@
�
� F � _XSAVE_SUPPORTED_CPU .?AU_XSAVE_SUPPORTED_CPU@@ ��.
� VendorId �
� SupportedCpu �6 � 8 _XSAVE_VENDOR .?AU_XSAVE_VENDOR@@ * onecore\internal\sdk\inc\ntkeapi.h � � � � B � _KLOCK_QUEUE_HANDLE .?AU_KLOCK_QUEUE_HANDLE@@
�
� *
LockQueue
OldIrql ��B � _KLOCK_QUEUE_HANDLE .?AU_KLOCK_QUEUE_HANDLE@@ � � � j � _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION_V2@@ ��b � _JOBOBJECT_MEMORY_USAGE_INFORMATION .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION@@ # " �F
� BasicInfo
# JobSharedMemory ��
� Reserved �j � ( _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION_V2@@ �� � a V ^ � _IMAGE_LOAD_CONFIG_CODE_INTEGRITY .?AU_IMAGE_LOAD_CONFIG_CODE_INTEGRITY@@ R
! Flags
! Catalog ��
" CatalogOffset
" Reserved �^ � _IMAGE_LOAD_CONFIG_CODE_INTEGRITY .?AU_IMAGE_LOAD_CONFIG_CODE_INTEGRITY@@ � [ � : � tagSERIALKEYSW .?AUtagSERIALKEYSW@@ ��
u cbSize ���
" dwFlags ��
q lpszActivePort ���
q lpszPort �
u iBaudRate
u iPortState ���
u iActive ��: � tagSERIALKEYSW .?AUtagSERIALKEYSW@@ �� � R2 : � tagEXTLOGPEN32 .?AUtagEXTLOGPEN32@@ ��
" elpPenStyle ��
" elpWidth �
u elpBrushStyle
" elpColor �
" elpHatch �
" elpNumEntries
� elpStyleEntry : � tagEXTLOGPEN32 .?AUtagEXTLOGPEN32@@ �� � � 6 � _RTL_RESOURCE .?AU_RTL_RESOURCE@@
�
�
�
� �
� CriticalSection ��
SharedSemaphore ��
M NumberOfWaitingShared
ExclusiveSemaphore ���
M $ NumberOfWaitingExclusive �
( NumberOfActive ���
, ExclusiveOwnerThread �
" 0 Flags
� 4 DebugInfo 6 � 8 _RTL_RESOURCE .?AU_RTL_RESOURCE@@ � L � R � _RTL_HEAP_MEMORY_LIMIT_INFO .?AU_RTL_HEAP_MEMORY_LIMIT_INFO@@
�
� R � _RTL_HEAP_MEMORY_LIMIT_DATA .?AU_RTL_HEAP_MEMORY_LIMIT_DATA@@ &
" Version ��
� Data �R � _RTL_HEAP_MEMORY_LIMIT_INFO .?AU_RTL_HEAP_MEMORY_LIMIT_INFO@@ � ( �
� SYSTEM_HANDLE_FILE ��� SYSTEM_HANDLE_SEMAPHORE �� SYSTEM_HANDLE_EVENT �� SYSTEM_HANDLE_MUTEX �� SYSTEM_HANDLE_PROCESS SYSTEM_HANDLE_TOKEN �� SYSTEM_HANDLE_SECTION SYSTEM_HANDLE_REG_KEY SYSTEM_HANDLE_THREAD � SYSTEM_HANDLE_COMPOSITION_OBJECT �
SYSTEM_HANDLE_SOCKET � SYSTEM_HANDLE_JOB SYSTEM_HANDLE_PIPE ��� SYSTEM_HANDLE_MAX � SYSTEM_HANDLE_INVALID : t � _system_handle_t .?AW4_system_handle_t@@ ��� � � � TransactionManagerBasicInformation ��� TransactionManagerLogInformation � TransactionManagerLogPathInformation � TransactionManagerRecoveryInformation TransactionManagerOnlineProbeInformation � TransactionManagerOldestTransactionInformation ���b t � _TRANSACTIONMANAGER_INFORMATION_CLASS .?AW4_TRANSACTIONMANAGER_INFORMATION_CLASS@@ � � � < V � _SYSTEM_FILECACHE_INFORMATION .?AU_SYSTEM_FILECACHE_INFORMATION@@
" CurrentSize ��
" PeakSize �
" PageFaultCount ���
" MinimumWorkingSet
" MaximumWorkingSet
" CurrentSizeIncludingTransitionInPages
" PeakSizeIncludingTransitionInPages ���
" TransitionRePurposeCount �
" Flags V � $ _SYSTEM_FILECACHE_INFORMATION .?AU_SYSTEM_FILECACHE_INFORMATION@@ �
q t �
�
� B � _FILE_STANDARD_INFO .?AU_FILE_STANDARD_INFO@@ v
} AllocationSize ���
} EndOfFile
" NumberOfLinks
DeletePending
Directory B � _FILE_STANDARD_INFO .?AU_FILE_STANDARD_INFO@@ � y" n � _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX@@ ��J � _PROCESSOR_RELATIONSHIP .?AU_PROCESSOR_RELATIONSHIP@@ J � _NUMA_NODE_RELATIONSHIP .?AU_NUMA_NODE_RELATIONSHIP@@ B � _GROUP_RELATIONSHIP .?AU_GROUP_RELATIONSHIP@@ r
� Relationship �
" Size �
� Processor
� NumaNode �
` Cache
� Group n � L _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX@@ �� � { C > � _HIBERFILE_BUCKET .?AU_HIBERFILE_BUCKET@@
�
� >
# MaxPhysicalMemory
� PhysicalMemoryPercent > � _HIBERFILE_BUCKET .?AU_HIBERFILE_BUCKET@@ � �
F
� > � _CM_MCA_POS_DATA .?AU_CM_MCA_POS_DATA@@ ��f
! AdapterId
PosData1 �
PosData2 �
PosData3 �
PosData4 �> � _CM_MCA_POS_DATA .?AU_CM_MCA_POS_DATA@@ �� � � � F � _SYSTEM_BIGPOOL_ENTRY .?AU_SYSTEM_BIGPOOL_ENTRY@@
�
�
" �� " �n
VirtualAddress ���
� NonPaged �
" SizeInBytes ��
� Tag ��
" TagUlong �F � _SYSTEM_BIGPOOL_ENTRY .?AU_SYSTEM_BIGPOOL_ENTRY@@ � �
J � _PLEX_READ_DATA_REQUEST .?AU_PLEX_READ_DATA_REQUEST@@ J
} ByteOffset ���
" ByteLength ���
" PlexNumber ���J � _PLEX_READ_DATA_REQUEST .?AU_PLEX_READ_DATA_REQUEST@@ � � J � _WMI_THREAD_INFORMATION .?AU_WMI_THREAD_INFORMATION@@
�
� *
" ProcessId
" ThreadId �J � _WMI_THREAD_INFORMATION .?AU_WMI_THREAD_INFORMATION@@ � � j � _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY .?AU_RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY@@ b
N BlockRemoteImageLoads
N BlockLowLabelImageLoads ��
N PreferSystem32 ���j � _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY .?AU_RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY@@ � � � f TableEmptyTree ��� TableFoundNode ��� TableInsertAsLeft TableInsertAsRight ���B t � _TABLE_SEARCH_RESULT .?AW4_TABLE_SEARCH_RESULT@@ ��� � ( D N � _NETWORK_APP_INSTANCE_EA .?AU_NETWORK_APP_INSTANCE_EA@@ ��.
� AppInstanceID
" CsvFlags �N � _NETWORK_APP_INSTANCE_EA .?AU_NETWORK_APP_INSTANCE_EA@@ �� � , V � _REFS_SMR_VOLUME_INFO_OUTPUT .?AU_REFS_SMR_VOLUME_INFO_OUTPUT@@ ��n SmrGcStateInactive ��� SmrGcStatePaused � SmrGcStateActive � SmrGcStateActiveFullSpeed J t _REFS_SMR_VOLUME_GC_STATE .?AW4_REFS_SMR_VOLUME_GC_STATE@@ � � # " 8 �"
" Version ��
" Flags
} SizeOfRandomlyWritableTier ���
} FreeSpaceInRandomlyWritableTier ��
} SizeofSMRTier
} FreeSpaceInSMRTier ���
} ( UsableFreeSpaceInSMRTier �
0 VolumeGcState
4 VolumeGcLastStatus ���
8 Unused ���V
p _REFS_SMR_VOLUME_INFO_OUTPUT .?AU_REFS_SMR_VOLUME_INFO_OUTPUT@@ �� � > � _REMOTE_PORT_VIEW .?AU_REMOTE_PORT_VIEW@@ >
" Length ���
" ViewSize �
ViewBase �> _REMOTE_PORT_VIEW .?AU_REMOTE_PORT_VIEW@@
� � SidTypeUser �� SidTypeGroup � SidTypeDomain SidTypeAlias � SidTypeWellKnownGroup SidTypeDeletedAccount SidTypeInvalid ��� SidTypeUnknown ��� SidTypeComputer ��
SidTypeLabel � SidTypeLogonSession ��2 t _SID_NAME_USE .?AW4_SID_NAME_USE@@ �
; � EventProviderBinaryTrackInfo � EventProviderSetReserved1 EventProviderSetTraits ��� EventProviderUseDescriptorType ��� MaxEventInfo �: t _EVENT_INFO_CLASS .?AW4_EVENT_INFO_CLASS@@ � � � F � _ACL_SIZE_INFORMATION .?AU_ACL_SIZE_INFORMATION@@ F
" AceCount �
" AclBytesInUse
" AclBytesFree �F _ACL_SIZE_INFORMATION .?AU_ACL_SIZE_INFORMATION@@ \ J � tagRID_DEVICE_INFO_HID .?AUtagRID_DEVICE_INFO_HID@@ ��z
" dwVendorId ���
" dwProductId ��
" dwVersionNumber ��
! usUsagePage ��
! usUsage ��J tagRID_DEVICE_INFO_HID .?AUtagRID_DEVICE_INFO_HID@@ �� #; F � _REPARSE_DATA_BUFFER .?AU_REPARSE_DATA_BUFFER@@ ��
� �
! SubstituteNameOffset �
! SubstituteNameLength �
! PrintNameOffset ��
! PrintNameLength ��
" Flags
PathBuffer ���: <anonymous-tag> .?AU<anonymous-tag>@@ *# �
! SubstituteNameOffset �
! SubstituteNameLength �
! PrintNameOffset ��
! PrintNameLength ��
PathBuffer ���:
<anonymous-tag> .?AU<anonymous-tag>@@ 2#
| DataBuffer ���: " <anonymous-tag> .?AU<anonymous-tag>@@ # 9# �
" ReparseTag ���
! ReparseDataLength
! Reserved �
SymbolicLinkReparseBuffer
MountPointReparseBuffer ��
# GenericReparseBuffer �F % _REPARSE_DATA_BUFFER .?AU_REPARSE_DATA_BUFFER@@ �� & ## b � _VIRTUALIZATION_INSTANCE_INFO_INPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT@@ 2
" NumberOfWorkerThreads
" Flags b ) _VIRTUALIZATION_INSTANCE_INFO_INPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT@@ * �" j ThreadWorkloadClassDefault ��� ThreadWorkloadClassGraphics �� MaxThreadWorkloadClass ���F t , _THREAD_WORKLOAD_CLASS .?AW4_THREAD_WORKLOAD_CLASS@@ ��� - C � 6 PMCCounter ��� MaxHardwareCounterType ���F t / _HARDWARE_COUNTER_TYPE .?AW4_HARDWARE_COUNTER_TYPE@@ ��� 0 C � DEPPolicyAlwaysOff ��� DEPPolicyAlwaysOn DEPPolicyOptIn ��� DEPPolicyOptOut �� DEPTotalPolicyCount ��F t 2 _DEP_SYSTEM_POLICY_TYPE .?AW4_DEP_SYSTEM_POLICY_TYPE@@ � 3 R � OptionAbortRetryIgnore ��� OptionOk � OptionOkCancel ��� OptionRetryCancel OptionYesNo �� OptionYesNoCancel OptionShutdownSystem � OptionOkNoWait ��� OptionCancelTryContinue ��N t 5 _HARDERROR_RESPONSE_OPTION .?AW4_HARDERROR_RESPONSE_OPTION@@ ��� 6 � J � _TRACE_PROFILE_INTERVAL .?AU_TRACE_PROFILE_INTERVAL@@
8
� *
" Source ���
" Interval �J : _TRACE_PROFILE_INTERVAL .?AU_TRACE_PROFILE_INTERVAL@@ ; � ~ " # " " " = B � _FXSAVE_FORMAT_WX86 .?AU_FXSAVE_FORMAT_WX86@@ " � � " � �&
! ControlWord ��
! StatusWord ���
! TagWord ��
! ErrorOpcode ��
" ErrorOffset ��
" ErrorSelector
" DataOffset ���
" DataSelector �
" MXCsr
" MXCsr_Mask ���
@ RegisterArea �
@ � Reserved3
A Reserved4 B
B _FXSAVE_FORMAT_WX86 .?AU_FXSAVE_FORMAT_WX86@@ * onecore\internal\sdk\inc\ntwow64.h � C D < B � _KCRM_PROTOCOL_BLOB .?AU_KCRM_PROTOCOL_BLOB@@
F
� �
� ProtocolId ���
" StaticInfoLength �
" TransactionIdInfoLength ��
" Unused1 ��
" Unused2 ��B H _KCRM_PROTOCOL_BLOB .?AU_KCRM_PROTOCOL_BLOB@@ . onecore\external\shared\inc\ktmtypes.h � I J � � SharedVirtualDisksUnsupported SharedVirtualDisksSupported �� SharedVirtualDiskSnapshotsSupported �� SharedVirtualDiskCDPSnapshotsSupported ���R t L _SharedVirtualDiskSupportType .?AW4_SharedVirtualDiskSupportType@@ � M �' R � _IMAGE_ROM_OPTIONAL_HEADER .?AU_IMAGE_ROM_OPTIONAL_HEADER@@ ��
O
� N
! Magic
MajorLinkerVersion ���
MinorLinkerVersion ���
" SizeOfCode ���
" SizeOfInitializedData
" SizeOfUninitializedData ��
" AddressOfEntryPoint ��
" BaseOfCode ���
" BaseOfData ���
" BaseOfBss
" GprMask ��
� $ CprMask ��
" 4 GpValue ��R
Q 8 _IMAGE_ROM_OPTIONAL_HEADER .?AU_IMAGE_ROM_OPTIONAL_HEADER@@ �� R [ 7 �
bFamilyType ��
bSerifStyle ��
bWeight ��
bProportion ��
bContrast
bStrokeVariation �
bArmStyle
bLetterform ��
bMidline �
bXHeight �.
T
tagPANOSE .?AUtagPANOSE@@ U � J � _SYSTEM_TPM_INFORMATION .?AU_SYSTEM_TPM_INFORMATION@@
" Flags J X _SYSTEM_TPM_INFORMATION .?AU_SYSTEM_TPM_INFORMATION@@ Y � R � _WMI_JOB_SET_QUERY_NET_RATE .?AU_WMI_JOB_SET_QUERY_NET_RATE@@ >
" Flags
# MaxBandwidth �
DscpTag ��R \ _WMI_JOB_SET_QUERY_NET_RATE .?AU_WMI_JOB_SET_QUERY_NET_RATE@@ ] � � > � _FILE_BASIC_INFO .?AU_FILE_BASIC_INFO@@ ��
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
" FileAttributes ���> ` ( _FILE_BASIC_INFO .?AU_FILE_BASIC_INFO@@ �� a q" ^ � _RTL_FEATURE_CONFIGURATION_UPDATE .?AU_RTL_FEATURE_CONFIGURATION_UPDATE@@ n FeatureEnabledStateDefault ��� FeatureEnabledStateDisabled �� FeatureEnabledStateEnabled ���N t d _RTL_FEATURE_ENABLED_STATE .?AW4_RTL_FEATURE_ENABLED_STATE@@ ��� e � / � FeatureConfigurationOperationNone FeatureConfigurationOperationFeatureState FeatureConfigurationOperationVariantState FeatureConfigurationOperationResetState ��b t g _RTL_FEATURE_CONFIGURATION_OPERATION .?AW4_RTL_FEATURE_CONFIGURATION_OPERATION@@ ��� h � ! �
u FeatureId
� Priority �
e EnabledState �
| EnabledStateOptions ��
Variant ��
� Reserved �
� VariantPayloadKind ���
u VariantPayload ���
h Operation ^ j _RTL_FEATURE_CONFIGURATION_UPDATE .?AU_RTL_FEATURE_CONFIGURATION_UPDATE@@ k � W J � _FILE_COMPRESSION_INFO .?AU_FILE_COMPRESSION_INFO@@ ��
} CompressedFileSize ���
! CompressionFormat
CompressionUnitShift �
ChunkShift ���
ClusterShift �
�
Reserved �J n _FILE_COMPRESSION_INFO .?AU_FILE_COMPRESSION_INFO@@ �� o �" N � _TRANSACTION_NOTIFICATION .?AU_TRANSACTION_NOTIFICATION@@ z
TransactionKey ���
" TransactionNotification ��
} TmVirtualClock ���
" ArgumentLength ���N r _TRANSACTION_NOTIFICATION .?AU_TRANSACTION_NOTIFICATION@@ s J �
f
�
�
�
�
� j � _DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO .?AU_DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO@@ ��^ � DISPLAYCONFIG_DEVICE_INFO_HEADER .?AUDISPLAYCONFIG_DEVICE_INFO_HEADER@@ ��
u ��
u ��
u ��
u ��
u �� DISPLAYCONFIG_COLOR_ENCODING_RGB � DISPLAYCONFIG_COLOR_ENCODING_YCBCR444 DISPLAYCONFIG_COLOR_ENCODING_YCBCR422 DISPLAYCONFIG_COLOR_ENCODING_YCBCR420 DISPLAYCONFIG_COLOR_ENCODING_INTENSITY ��� ��DISPLAYCONFIG_COLOR_ENCODING_FORCE_UINT32 ���R t _DISPLAYCONFIG_COLOR_ENCODING .?AW4_DISPLAYCONFIG_COLOR_ENCODING@@ � � J �
y header ���
z advancedColorSupported ���
{ advancedColorEnabled �
| wideColorEnforced
} advancedColorForceDisabled ���
~ reserved �
u value
� colorEncoding
u bitsPerColorChannel ��j � _DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO .?AU_DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO@@ �� � T
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
� MicrosoftSignedOnly ��
� StoreSignedOnly ��
� MitigationOptIn ��
� AuditMicrosoftSignedOnly �
� AuditStoreSignedOnly �
� ReservedFlags r � _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY@@ � C � R � _HEAP_EVENT_COMMIT_DECOMMIT .?AU_HEAP_EVENT_COMMIT_DECOMMIT@@
�
� N
HeapHandle ���
Block
" Size �
" Caller ���R � _HEAP_EVENT_COMMIT_DECOMMIT .?AU_HEAP_EVENT_COMMIT_DECOMMIT@@ � � '
�
� V � _PERFINFO_PO_SESSION_CALLOUT .?AU_PERFINFO_PO_SESSION_CALLOUT@@ ��b
SystemAction �
S MinSystemState ���
" Flags
" PowerStateTask ���V � _PERFINFO_PO_SESSION_CALLOUT .?AU_PERFINFO_PO_SESSION_CALLOUT@@ �� � � � �
" CommitLimitBytes �
" CommitLimitFailureCode ���
" MaxAllocationSizeBytes ���
" AllocationLimitFailureCode ���R � _RTL_HEAP_MEMORY_LIMIT_DATA .?AU_RTL_HEAP_MEMORY_LIMIT_DATA@@ � ( �
N � NOTIFY_USER_POWER_SETTING .?AUNOTIFY_USER_POWER_SETTING@@
�
�
� Guid �N � NOTIFY_USER_POWER_SETTING .?AUNOTIFY_USER_POWER_SETTING@@ � � : � _nlsversioninfo .?AU_nlsversioninfo@@ �
" dwNLSVersionInfoSize �
" dwNLSVersion �
" dwDefinedVersion �
" dwEffectiveId
� guidCustomVersion : � _nlsversioninfo .?AU_nlsversioninfo@@ � � � N P � b � _SYSTEM_SESSION_BIGPOOL_INFORMATION .?AU_SYSTEM_SESSION_BIGPOOL_INFORMATION@@
�
� � " �Z
" NextEntryOffset ��
" SessionId
" Count
� AllocatedInfo b � _SYSTEM_SESSION_BIGPOOL_INFORMATION .?AU_SYSTEM_SESSION_BIGPOOL_INFORMATION@@ � �
~ ImagePolicyIdNone ImagePolicyIdEtw � ImagePolicyIdDebug ��� ImagePolicyIdCrashDump ��� ImagePolicyIdCrashDumpKey ImagePolicyIdCrashDumpKeyGuid ImagePolicyIdParentSd ImagePolicyIdParentSdRev � ImagePolicyIdSvn � ImagePolicyIdDeviceId
ImagePolicyIdCapability �� ImagePolicyIdScenarioId �� ImagePolicyIdMaximum �:
t � _IMAGE_POLICY_ID .?AW4_IMAGE_POLICY_ID@@ ��� � ( ]& V � _KEY_WOW64_FLAGS_INFORMATION .?AU_KEY_WOW64_FLAGS_INFORMATION@@ ��
" UserFlags V � _KEY_WOW64_FLAGS_INFORMATION .?AU_KEY_WOW64_FLAGS_INFORMATION@@ �� � � n � _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION@@ � " @ �
� Cycles ���n � @ _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION@@ � _ N � _FILE_ACCESS_INFORMATION .?AU_FILE_ACCESS_INFORMATION@@ ��
" AccessFlags ��N � _FILE_ACCESS_INFORMATION .?AU_FILE_ACCESS_INFORMATION@@ �� � �
p ��
�
� R � _POWER_PLATFORM_INFORMATION .?AU_POWER_PLATFORM_INFORMATION@@
�
�
AoAc �R � _POWER_PLATFORM_INFORMATION .?AU_POWER_PLATFORM_INFORMATION@@ � � R � _PROCESS_BASIC_INFORMATION .?AU_PROCESS_BASIC_INFORMATION@@ ��
ExitStatus ���
� PebBaseAddress ���
" AffinityMask �
BasePriority �
" UniqueProcessId ��
" InheritedFromUniqueProcessId �R � _PROCESS_BASIC_INFORMATION .?AU_PROCESS_BASIC_INFORMATION@@ �� � C � R � _ETW_FINALIZE_KTIMER2_EVENT .?AU_ETW_FINALIZE_KTIMER2_EVENT@@
�
� N
" TimerKey �
" DisableCallback ��
" DisableContextKey R � _ETW_FINALIZE_KTIMER2_EVENT .?AU_ETW_FINALIZE_KTIMER2_EVENT@@ � � � B � tagENUMTEXTMETRICA .?AUtagENUMTEXTMETRICA@@ ��
�
� B � tagNEWTEXTMETRICEXA .?AUtagNEWTEXTMETRICEXA@@ :
� etmNewTextMetricEx ���
� ` etmAxesList ��B � �tagENUMTEXTMETRICA .?AUtagENUMTEXTMETRICA@@ �� � m
� N � _SID_AND_ATTRIBUTES_HASH .?AU_SID_AND_ATTRIBUTES_HASH@@ ��
�
�
Y
� " " � �:
" SidCount �
� SidAttr ��
� Hash �N � � _SID_AND_ATTRIBUTES_HASH .?AU_SID_AND_ATTRIBUTES_HASH@@ �� � X F � _TRACE_ENABLE_CONTEXT .?AU_TRACE_ENABLE_CONTEXT@@ V
! LoggerId �
Level
InternalFlag �
" EnableFlags ��F � _TRACE_ENABLE_CONTEXT .?AU_TRACE_ENABLE_CONTEXT@@ � " 7 N � _FILE_STAT_LX_INFORMATION .?AU_FILE_STAT_LX_INFORMATION@@
�
� �
} FileId ���
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( AllocationSize ���
} 0 EndOfFile
" 8 FileAttributes ���
" < ReparseTag ���
" @ NumberOfLinks
" D EffectiveAccess ��
" H LxFlags ��
" L LxUid
" P LxGid
" T LxMode ���
" X LxDeviceIdMajor ��
" \ LxDeviceIdMinor ��N � ` _FILE_STAT_LX_INFORMATION .?AU_FILE_STAT_LX_INFORMATION@@ � b R � _SEC_WINNT_AUTH_IDENTITY_A .?AU_SEC_WINNT_AUTH_IDENTITY_A@@ ��
User �
" UserLength ���
Domain ���
" DomainLength �
Password �
" PasswordLength ���
" Flags R � _SEC_WINNT_AUTH_IDENTITY_A .?AU_SEC_WINNT_AUTH_IDENTITY_A@@ �� � � � Z � _TRANSACTION_BASIC_INFORMATION .?AU_TRANSACTION_BASIC_INFORMATION@@ ��>
� TransactionId
" State
" Outcome ��Z � _TRANSACTION_BASIC_INFORMATION .?AU_TRANSACTION_BASIC_INFORMATION@@ �� � � � > � _LDR_SECTION_INFO .?AU_LDR_SECTION_INFO@@ B � _OBJECT_ATTRIBUTES .?AU_OBJECT_ATTRIBUTES@@ ��
�
� �
SectionHandle
" DesiredAccess
� ObjA �
" SectionPageProtection
" AllocationAttributes �> � _LDR_SECTION_INFO .?AU_LDR_SECTION_INFO@@ � u � 6 � tagAXESLISTW .?AUtagAXESLISTW@@ ��
" � �J
" axlReserved ��
" axlNumAxes ���
� axlAxisInfo ��6 � �tagAXESLISTW .?AUtagAXESLISTW@@ �� � < ~ � _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION .?AU_SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION@@ ��
�
� 6
" FlagsToEnable
" FlagsToDisable ���~ � _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION .?AU_SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION@@ �� � )
B � _CSV_CONTROL_PARAM .?AU_CSV_CONTROL_PARAM@@ ��
�
� > CsvControlStartRedirectFile �� CsvControlStopRedirectFile ��� CsvControlQueryRedirectState � CsvControlQueryFileRevision �� CsvControlQueryMdsPath ��� CsvControlQueryFileRevisionFileId128 �
CsvControlQueryVolumeRedirectState ���
CsvControlEnableUSNRangeModificationTracking � CsvControlMarkHandleLocalVolumeMount � CsvControlUnmarkHandleLocalVolumeMount ��� CsvControlGetCsvFsMdsPathV2 �� CsvControlDisableCaching � CsvControlEnableCaching �� CsvControlStartForceDFO �� CsvControlStopForceDFO ���6 t � _CSV_CONTROL_OP .?AW4_CSV_CONTROL_OP@@ � � F *
� Operation
Unused ���B _CSV_CONTROL_PARAM .?AU_CSV_CONTROL_PARAM@@ �� X Z � _PROCESS_HANDLE_TRACING_ENABLE .?AU_PROCESS_HANDLE_TRACING_ENABLE@@ ��
�
" Flags Z _PROCESS_HANDLE_TRACING_ENABLE .?AU_PROCESS_HANDLE_TRACING_ENABLE@@ �� C > 2 � _numberfmtW .?AU_numberfmtW@@ �
u NumDigits
u LeadingZero ��
u Grouping �
q lpDecimalSep �
q lpThousandSep
u NegativeOrder 2 _numberfmtW .?AU_numberfmtW@@
� � b KHeteroCpuPolicyAll �� KHeteroCpuPolicyLarge KHeteroCpuPolicyLargeOrIdle �� KHeteroCpuPolicySmall KHeteroCpuPolicySmallOrIdle �� KHeteroCpuPolicyDynamic �� KHeteroCpuPolicyStaticMax KHeteroCpuPolicyBiasedSmall �� KHeteroCpuPolicyBiasedLarge �� KHeteroCpuPolicyDefault �� KHeteroCpuPolicyMax ��> t _KHETERO_CPU_POLICY .?AW4_KHETERO_CPU_POLICY@@ �
� ~ B � _CSV_NAMESPACE_INFO .?AU_CSV_NAMESPACE_INFO@@
� b
" Version ��
" DeviceNumber �
} StartingOffset ���
" SectorSize ���B _CSV_NAMESPACE_INFO .?AU_CSV_NAMESPACE_INFO@@ 6 6 � _LUTF8_STRING .?AU_LUTF8_STRING@@
��
� B
" Length ���
" MaximumLength
Buffer ���6 _LUTF8_STRING .?AU_LUTF8_STRING@@ 2 onecore\internal\sdk\inc\minwin\ntdef_p.h ��
� B � tagEMRSETCOLORSPACE .?AUtagEMRSETCOLORSPACE@@ "
emr ��
" ihCS �B tagEMRSETCOLORSPACE .?AUtagEMRSETCOLORSPACE@@ � Z � _PLUGPLAY_CONTROL_PROPERTY_DATA .?AU_PLUGPLAY_CONTROL_PROPERTY_DATA@@
"
� b
� DeviceInstance ���
" PropertyType �
Buffer ���
" BufferSize ���Z $ _PLUGPLAY_CONTROL_PROPERTY_DATA .?AU_PLUGPLAY_CONTROL_PROPERTY_DATA@@ % � 8 > GroupAffinityAllGroupZero GroupAffinityDontCare : t ' _IRQ_GROUP_POLICY .?AW4_IRQ_GROUP_POLICY@@ � ( � � ^ � _FILE_CASE_SENSITIVE_INFORMATION .?AU_FILE_CASE_SENSITIVE_INFORMATION@@ ��
*
�
" Flags ^ , _FILE_CASE_SENSITIVE_INFORMATION .?AU_FILE_CASE_SENSITIVE_INFORMATION@@ �� - � N � _PERFINFO_DPC_INFORMATION .?AU_PERFINFO_DPC_INFORMATION@@ 2
# InitialTime ��
DpcRoutine ���N 0 _PERFINFO_DPC_INFORMATION .?AU_PERFINFO_DPC_INFORMATION@@ 1 � � > � _WIN32_STREAM_ID .?AU_WIN32_STREAM_ID@@ ��~
" dwStreamId ���
" dwStreamAttributes ���
} Size �
" dwStreamNameSize �
cStreamName ��> 4 _WIN32_STREAM_ID .?AU_WIN32_STREAM_ID@@ �� 5 � B � _TOKEN_AUDIT_POLICY .?AU_TOKEN_AUDIT_POLICY@@ " �
8 PerUserPolicy B 9 _TOKEN_AUDIT_POLICY .?AU_TOKEN_AUDIT_POLICY@@ : � 6 � _PSINJECTDATA .?AU_PSINJECTDATA@@ J
" DataBytes
! InjectionPoint ���
! PageNumber ���6 = _PSINJECTDATA .?AU_PSINJECTDATA@@ > � N � _ETW_OBJECT_HANDLE_EVENT .?AU_ETW_OBJECT_HANDLE_EVENT@@ ��
@
� V
Object ���
" ProcessId
" Handle ���
! ObjectType ���N B _ETW_OBJECT_HANDLE_EVENT .?AU_ETW_OBJECT_HANDLE_EVENT@@ �� C � i
2 � value_entA .?AUvalue_entA@@ ��^
p ve_valuename �
" ve_valuelen ��
" ve_valueptr ��
" ve_type ��2 F value_entA .?AUvalue_entA@@ ��2 onecore\external\sdk\inc\minwin\winreg.h ��� G H � J � _SD_GLOBAL_CHANGE_INPUT .?AU_SD_GLOBAL_CHANGE_INPUT@@ V � _SD_CHANGE_MACHINE_SID_INPUT .?AU_SD_CHANGE_MACHINE_SID_INPUT@@ ��F � _SD_QUERY_STATS_INPUT .?AU_SD_QUERY_STATS_INPUT@@ j
" Flags
" ChangeType ���
K SdChange �
L SdQueryStats �
) SdEnumSds J M _SD_GLOBAL_CHANGE_INPUT .?AU_SD_GLOBAL_CHANGE_INPUT@@ N m F � _VIRTUAL_STORAGE_TYPE .?AU_VIRTUAL_STORAGE_TYPE@@ *
" DeviceId �
� VendorId �F Q _VIRTUAL_STORAGE_TYPE .?AU_VIRTUAL_STORAGE_TYPE@@ R 0 F � tagRAWINPUTDEVICELIST .?AUtagRAWINPUTDEVICELIST@@ *
hDevice ��
" dwType ���F U tagRAWINPUTDEVICELIST .?AUtagRAWINPUTDEVICELIST@@ V �; R � _RTL_IMAGE_POLICY_METADATA .?AU_RTL_IMAGE_POLICY_METADATA@@ ��
X
� J � _IMAGE_POLICY_METADATA .?AU_IMAGE_POLICY_METADATA@@ ��
Z ��
[
� F
\ PolicyMetadata ���
" LBound ���
" UBound ���R ] _RTL_IMAGE_POLICY_METADATA .?AU_RTL_IMAGE_POLICY_METADATA@@ �� ^ ( �& � FileStorageTierMediaTypeUnspecified �� FileStorageTierMediaTypeDisk � FileStorageTierMediaTypeSsd �� FileStorageTierMediaTypeScm �� FileStorageTierMediaTypeMax ��R t ` _FILE_STORAGE_TIER_MEDIA_TYPE .?AW4_FILE_STORAGE_TIER_MEDIA_TYPE@@ � a � ^ � _PROCESS_TELEMETRY_ID_INFORMATION .?AU_PROCESS_TELEMETRY_ID_INFORMATION@@ �
" HeaderSize ���
" ProcessId
# ProcessStartKey ��
# CreateTime ���
# CreateInterruptTime ��
# CreateUnbiasedInterruptTime ��
# ( ProcessSequenceNumber
# 0 SessionCreateTime
" 8 SessionId
" < BootId ���
" @ ImageChecksum
" D ImageTimeDateStamp ���
" H UserSidOffset
" L ImagePathOffset ��
" P PackageNameOffset
" T RelativeAppNameOffset
" X CommandLineOffset ^ d ` _PROCESS_TELEMETRY_ID_INFORMATION .?AU_PROCESS_TELEMETRY_ID_INFORMATION@@ e a k 6 � _FILEMUIINFO .?AU_FILEMUIINFO@@ �� " � " �Z
" dwSize ���
" dwVersion
" dwFileType ���
h pChecksum
h pServiceChecksum �
" , dwLanguageNameOffset �
" 0 dwTypeIDMainSize �
" 4 dwTypeIDMainOffset ���
" 8 dwTypeNameMainOffset �
" < dwTypeIDMUISize ��
" @ dwTypeIDMUIOffset
" D dwTypeNameMUIOffset ��
i H abBuffer �6
j P _FILEMUIINFO .?AU_FILEMUIINFO@@ �� k � � v � _ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION .?AU_ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION@@ * � _LBLOB .?AU_LBLOB@@ ��B
" Length ���
" MaximumLength
Buffer ���* o _LBLOB .?AU_LBLOB@@ �� p / " " " � r v � _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT@@
" ��
" ��>
u Enabled ��
v Reserved �
" AsULONG ��v w _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT@@ x
Z � _WIM_PROVIDER_INTEGRITY_STATUS .?AU_WIM_PROVIDER_INTEGRITY_STATUS@@ ��v
IntegrityComplete
IntegrityRunning �
# IntegrityAvailable ���
# IntegrityRequired Z { _WIM_PROVIDER_INTEGRITY_STATUS .?AU_WIM_PROVIDER_INTEGRITY_STATUS@@ �� | V" j � _PLUGPLAY_CONTROL_TARGET_RELATION_DATA .?AU_PLUGPLAY_CONTROL_TARGET_RELATION_DATA@@ ��j
UserFileHandle ���
Status ���
" DeviceInstanceLen
q DeviceInstance ���j _PLUGPLAY_CONTROL_TARGET_RELATION_DATA .?AU_PLUGPLAY_CONTROL_TARGET_RELATION_DATA@@ �� � � � V � _TXFS_TRANSACTION_ACTIVE_INFO .?AU_TXFS_TRANSACTION_ACTIVE_INFO@@ *
TransactionsActiveAtSnapshot �V � _TXFS_TRANSACTION_ACTIVE_INFO .?AU_TXFS_TRANSACTION_ACTIVE_INFO@@ � & � � _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION@@ ��j � _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE@@
�
� Z
! NumberOfRanges ���
! Reserved �
" Reserved2
� Ranges ��� � _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION@@ �� � C � V � _TRACE_ENABLE_FLAG_EXTENSION .?AU_TRACE_ENABLE_FLAG_EXTENSION@@ ��
�
� :
! Offset ���
Length ���
Flag �V � _TRACE_ENABLE_FLAG_EXTENSION .?AU_TRACE_ENABLE_FLAG_EXTENSION@@ �� � � F � _HEAP_SUBSEGMENT_INIT .?AU_HEAP_SUBSEGMENT_INIT@@
�
� �
� Header ���
HeapHandle ���
$ SubSegment ���
" ( BlockSize
" , BlockCount ���
" 0 AffinityIndex F � 4 _HEAP_SUBSEGMENT_INIT .?AU_HEAP_SUBSEGMENT_INIT@@ � � W f FirmwareTypeUnknown �� FirmwareTypeBios � FirmwareTypeUefi � FirmwareTypeMax ��6 t � _FIRMWARE_TYPE .?AW4_FIRMWARE_TYPE@@ ��� � { @ J � _TRANSACTION_LIST_ENTRY .?AU_TRANSACTION_LIST_ENTRY@@
�
�
� UOW ��J � _TRANSACTION_LIST_ENTRY .?AU_TRANSACTION_LIST_ENTRY@@ � � i b � _TRACE_PERIODIC_CAPTURE_STATE_INFO .?AU_TRACE_PERIODIC_CAPTURE_STATE_INFO@@ ��
�
� Z
" CaptureStateFrequencyInSeconds ���
! ProviderCount
! Reserved �b � _TRACE_PERIODIC_CAPTURE_STATE_INFO .?AU_TRACE_PERIODIC_CAPTURE_STATE_INFO@@ �� � � �
�
� R � _REQUEST_RAW_ENCRYPTED_DATA .?AU_REQUEST_RAW_ENCRYPTED_DATA@@ .
FileOffset ���
" Length ���R � _REQUEST_RAW_ENCRYPTED_DATA .?AU_REQUEST_RAW_ENCRYPTED_DATA@@ � N � _FILE_FS_SIZE_INFORMATION .?AU_FILE_FS_SIZE_INFORMATION@@ �
} TotalAllocationUnits �
} AvailableAllocationUnits �
" SectorsPerAllocationUnit �
" BytesPerSector ���N � _FILE_FS_SIZE_INFORMATION .?AU_FILE_FS_SIZE_INFORMATION@@ � F � RPC_IMPORT_CONTEXT_P .?AURPC_IMPORT_CONTEXT_P@@ ��B � _RPC_BINDING_VECTOR .?AU_RPC_BINDING_VECTOR@@
�
� J
LookupContext
ProposedHandle ���
� Bindings �F � RPC_IMPORT_CONTEXT_P .?AURPC_IMPORT_CONTEXT_P@@ ��* onecore\external\sdk\inc\rpcnsip.h � � � ! j � _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA@@
�
� ^
� DeviceInstance ���
� Operation
" BufferLength �
q Buffer ���j � _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA@@ � � � r � _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION .?AU_MEMORY_PARTITION_PAGE_COMBINE_INFORMATION@@ ��J
StopHandle ���
" Flags
" TotalNumberOfPages ���r � _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION .?AU_MEMORY_PARTITION_PAGE_COMBINE_INFORMATION@@ �� � � > � tagWNODE_ALL_DATA .?AUtagWNODE_ALL_DATA@@ R � OFFSETINSTANCEDATAANDLENGTH .?AUOFFSETINSTANCEDATAANDLENGTH@@ � " �
5 WnodeHeader ��
" 0 DataBlockOffset ��
" 4 InstanceCount
" 8 OffsetInstanceNameOffsets
" < FixedInstanceSize
� < OffsetInstanceDataAndLength ��> � H tagWNODE_ALL_DATA .?AUtagWNODE_ALL_DATA@@ � 8 � n � _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT@@ ��J
" ExtentCount ��
" TotalExtentCount �
| Extents ��n � _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT@@ �� � �* � SharedVirtualDiskHandleStateNone � SharedVirtualDiskHandleStateFileShared ��� SharedVirtualDiskHandleStateHandleShared �R t � _SharedVirtualDiskHandleState .?AW4_SharedVirtualDiskHandleState@@ � � �' : � _NDR_EXPR_DESC .?AU_NDR_EXPR_DESC@@ ��
! ��
�
�
��
�
� .
� pOffset ��
� pFormatExpr ��: � _NDR_EXPR_DESC .?AU_NDR_EXPR_DESC@@ �� � � � V � _RTL_WORK_ON_BEHALF_TICKET_EX .?AU_RTL_WORK_ON_BEHALF_TICKET_EX@@
�
�
" ��
" ��f
� Ticket ���
" Flags
� CurrentThread
� Reserved1
" Reserved2 V � _RTL_WORK_ON_BEHALF_TICKET_EX .?AU_RTL_WORK_ON_BEHALF_TICKET_EX@@ � � � SysDbgQueryModuleInformation � SysDbgQueryTraceInformation �� SysDbgSetTracepoint �� SysDbgSetSpecialCall � SysDbgClearSpecialCalls �� SysDbgQuerySpecialCalls �� SysDbgBreakPoint � SysDbgQueryVersion ��� SysDbgReadVirtual SysDbgWriteVirtual ���
SysDbgReadPhysical ��� SysDbgWritePhysical �� SysDbgReadControlSpace ���
SysDbgWriteControlSpace �� SysDbgReadIoSpace SysDbgWriteIoSpace ��� SysDbgReadMsr SysDbgWriteMsr ��� SysDbgReadBusData SysDbgWriteBusData ��� SysDbgCheckLowMemory � SysDbgEnableKernelDebugger ��� SysDbgDisableKernelDebugger �� SysDbgGetAutoKdEnable SysDbgSetAutoKdEnable SysDbgGetPrintBufferSize � SysDbgSetPrintBufferSize � SysDbgGetKdUmExceptionEnable � SysDbgSetKdUmExceptionEnable � SysDbgGetTriageDump �� SysDbgGetKdBlockEnable ��� SysDbgSetKdBlockEnable ��� SysDbgRegisterForUmBreakInfo � ! SysDbgGetUmBreakPid �� " SysDbgClearUmBreakPid # SysDbgGetUmAttachPid � $ SysDbgClearUmAttachPid ��� % SysDbgGetLiveKernelDump �� & SysDbgKdPullRemoteFile ���6 ' t � _SYSDBG_COMMAND .?AW4_SYSDBG_COMMAND@@ � � � N � _ALPC_WORK_ON_BEHALF_ATTR .?AU_ALPC_WORK_ON_BEHALF_ATTR@@
� Ticket ���N � _ALPC_WORK_ON_BEHALF_ATTR .?AU_ALPC_WORK_ON_BEHALF_ATTR@@ � � q
�
�
�
� �
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
, tmFirstChar ��
- tmLastChar ���
. tmDefaultChar
/ tmBreakChar ��
0 tmItalic �
1 tmUnderlined �
2 tmStruckOut ��
3 tmPitchAndFamily �
4 tmCharSet : � 8 tagTEXTMETRICA .?AUtagTEXTMETRICA@@ �� � � Z � _CM_PARTIAL_RESOURCE_DESCRIPTOR .?AU_CM_PARTIAL_RESOURCE_DESCRIPTOR@@
�
� &
} Start
" Length ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � &
} Start
" Length ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � :
" Level
" Vector ���
" Affinity �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � V
! Reserved �
! MessageCount �
" Vector ���
" Affinity �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � :
" Level
" Vector ���
" Affinity �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � *
� Raw ��
� Translated ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � &
} Start
" Length ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � :
" Channel ��
" Port �
" Reserved1 : � <anonymous-tag> .?AU<anonymous-tag>@@ � � � �
" Channel ��
" RequestLine ��
TransferWidth
Reserved1
Reserved2
Reserved3 : � <anonymous-tag> .?AU<anonymous-tag>@@ � �
� Data �: <anonymous-tag> .?AU<anonymous-tag>@@ � :
" Start
" Length ���
" Reserved �: <anonymous-tag> .?AU<anonymous-tag>@@ � >
" DataSize �
" Reserved1
" Reserved2 : <anonymous-tag> .?AU<anonymous-tag>@@ � $ &
} Start
" Length40 �:
<anonymous-tag> .?AU<anonymous-tag>@@ � , &
} Start
" Length48 �:
<anonymous-tag> .?AU<anonymous-tag>@@ � 1 &
} Start
" Length64 �: <anonymous-tag> .?AU<anonymous-tag>@@ � 6 v
Class
Type �
Reserved1
Reserved2
" IdLowPart
" IdHighPart ���: <anonymous-tag> .?AU<anonymous-tag>@@ � ; *
� Generic ��
� Port �
� Interrupt
� MessageInterrupt �
� Memory ���
� Dma ��
� DmaV3
DevicePrivate
BusNumber
DeviceSpecificData ���
Memory40 �
Memory48 �
Memory64 �
Connection ���2 <anonymous-tag> .?AT<anonymous-tag>@@ � � J
Type �
ShareDisposition �
! Flags
u Z _CM_PARTIAL_RESOURCE_DESCRIPTOR .?AU_CM_PARTIAL_RESOURCE_DESCRIPTOR@@ � � Z � _MEMORY_COMBINE_INFORMATION_EX .?AU_MEMORY_COMBINE_INFORMATION_EX@@ ��
� >
Handle ���
" PagesCombined
" Flags Z _MEMORY_COMBINE_INFORMATION_EX .?AU_MEMORY_COMBINE_INFORMATION_EX@@ �� � B � _ENERGY_STATE_DURATION .?AT_ENERGY_STATE_DURATION@@ ��
" ��
" ��V
# Value
" LastChangeTime ���
" Duration �
# IsInState B $ _ENERGY_STATE_DURATION .?AT_ENERGY_STATE_DURATION@@ �� % a � B � _IMAGE_THUNK_DATA64 .?AU_IMAGE_THUNK_DATA64@@
'
� ^
# ForwarderString ��
# Function �
# Ordinal ��
# AddressOfData 2 ) <anonymous-tag> .?AT<anonymous-tag>@@ * [ �
* u1 ���B , _IMAGE_THUNK_DATA64 .?AU_IMAGE_THUNK_DATA64@@ - [ � > � tagMULTIKEYHELPA .?AUtagMULTIKEYHELPA@@ ��
/
� B
" mkSize ���
p mkKeylist
� szKeyphrase ��> 1 tagMULTIKEYHELPA .?AUtagMULTIKEYHELPA@@ �� 2 �/
�
�
�
� J
axMinValue ���
axMaxValue ���
h axAxisName ���6 6 tagAXISINFOA .?AUtagAXISINFOA@@ �� 7 � B � _KCONTINUE_ARGUMENT .?AU_KCONTINUE_ARGUMENT@@ z KCONTINUE_UNWIND � KCONTINUE_RESUME � KCONTINUE_LONGJUMP ��� KCONTINUE_SET KCONTINUE_LAST ���6 t ; _KCONTINUE_TYPE .?AW4_KCONTINUE_TYPE@@ � < + � F
< ContinueType �
" ContinueFlags
; Reserved �B > _KCONTINUE_ARGUMENT .?AU_KCONTINUE_ARGUMENT@@ ? + V � _IMAGE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_RUNTIME_FUNCTION_ENTRY@@
A
� f
" BeginAddress �
" EndAddress ���
" UnwindInfoAddress
" UnwindData ���V C _IMAGE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_RUNTIME_FUNCTION_ENTRY@@ D [ 3 j � _SYSTEM_PROCESSOR_FEATURES_INFORMATION .?AU_SYSTEM_PROCESSOR_FEATURES_INFORMATION@@ �� # " �6
# ProcessorFeatureBits �
G Reserved �j H _SYSTEM_PROCESSOR_FEATURES_INFORMATION .?AU_SYSTEM_PROCESSOR_FEATURES_INFORMATION@@ �� I < V � _SERVERSILO_INIT_INFORMATION .?AU_SERVERSILO_INIT_INFORMATION@@ ��
K
� :
DeleteEvent ��
IsDownlevelContainer �V M _SERVERSILO_INIT_INFORMATION .?AU_SERVERSILO_INIT_INFORMATION@@ �� N C � ^ � _PERFINFO_DPC_ENQUEUE_INFORMATION .?AU_PERFINFO_DPC_ENQUEUE_INFORMATION@@ �
" Key ��
DpcQueueDepth
" DpcCount �
" TargetProcessorIndex �
Importance ���
� Reserved �^ Q _PERFINFO_DPC_ENQUEUE_INFORMATION .?AU_PERFINFO_DPC_ENQUEUE_INFORMATION@@ R � � V � _ETW_HEAP_EVENT_RUNDOWN_RANGE .?AU_ETW_HEAP_EVENT_RUNDOWN_RANGE@@ &
Address ��
" Size �V U _ETW_HEAP_EVENT_RUNDOWN_RANGE .?AU_ETW_HEAP_EVENT_RUNDOWN_RANGE@@ V � �
�
� : � _RTL_HEAP_ENTRY .?AU_RTL_HEAP_ENTRY@@
Y
� &
" Settable �
" Tag ��: [ <anonymous-tag> .?AU<anonymous-tag>@@ \ L 2
" CommittedSize
FirstBlock ���: ^ <anonymous-tag> .?AU<anonymous-tag>@@ _ L "
\ s1 ���
_ s2 ���2 a <anonymous-tag> .?AT<anonymous-tag>@@ b L R
" Size �
! Flags
! AllocatorBackTraceIndex ��
b u : d _RTL_HEAP_ENTRY .?AU_RTL_HEAP_ENTRY@@ e L
B SystemNetRateControlSet �� SystemNetRateControlQuota R t g _SYSTEM_NET_RATE_CONTROL_TYPE .?AW4_SYSTEM_NET_RATE_CONTROL_TYPE@@ � h { �
�
� N � _TEB_ACTIVE_FRAME_CONTEXT .?AU_TEB_ACTIVE_FRAME_CONTEXT@@
k ��
l
� :
" Flags
j Previous �
m Context ��> n _TEB_ACTIVE_FRAME .?AU_TEB_ACTIVE_FRAME@@ o �
= ��
q
� N � _ETW_WNF_EVENT_SUBSCRIBE .?AU_ETW_WNF_EVENT_SUBSCRIBE@@ ��
� Header ���
} StateName
( Subscription �
, NameSub ��
0 Callback �
" 4 RefCount �
" 8 DeliveryFlags N t @ _ETW_WNF_EVENT_SUBSCRIBE .?AU_ETW_WNF_EVENT_SUBSCRIBE@@ �� u � _ : � _MIDL_STUB_DESC .?AU_MIDL_STUB_DESC@@
u x
y
�
� J � __GENERIC_BINDING_INFO .?AU__GENERIC_BINDING_INFO@@ ��
|
� V
{ pAutoHandle ��
{ pPrimitiveHandle �
} pGenericBindingInfo ��2 ~ <anonymous-tag> .?AT<anonymous-tag>@@ �
;
�
�
�
- ��
�
� B � _MIDL_STUB_MESSAGE .?AU_MIDL_STUB_MESSAGE@@ ��
�
�
� �
�
�
�
� J � _XMIT_ROUTINE_QUINTUPLE .?AU_XMIT_ROUTINE_QUINTUPLE@@
� ��
�
�
�
� B � _MALLOC_FREE_STRUCT .?AU_MALLOC_FREE_STRUCT@@
�
� B � _COMM_FAULT_OFFSETS .?AU_COMM_FAULT_OFFSETS@@
� ��
�
�
� ��
�
� �
�
�
�
� > � _NDR_CS_ROUTINES .?AU_NDR_CS_ROUTINES@@ ��
� ��
�
�
� ��
�
� &
RpcInterfaceInformation ��
z pfnAllocate ��
< pfnFree ��
IMPLICIT_HANDLE_INFO �
� apfnNdrRundownRoutines ���
� aGenericBindingRoutinePairs ��
� apfnExprEval �
� aXmitQuintuple ���
� pFormatTypes �
t $ fCheckBounds �
" ( Version ��
� , pMallocFreeStruct
0 MIDLVersion ��
� 4 CommFaultOffsets �
� 8 aUserMarshalQuadruple
� < NotifyRoutineTable ���
" @ mFlags ���
� D CsRoutineTables ��
H ProxyServerInfo ��
� L pExprInfo : � P _MIDL_STUB_DESC .?AU_MIDL_STUB_DESC@@ � � � � TransactionBasicInformation �� TransactionPropertiesInformation � TransactionEnlistmentInformation � TransactionSuperiorEnlistmentInformation � TransactionBindInformation ��� TransactionDTCPrivateInformation �V t � _TRANSACTION_INFORMATION_CLASS .?AW4_TRANSACTION_INFORMATION_CLASS@@ ��� � � , � WdInfoTimeoutValue ��� WdInfoResetTimer � WdInfoStopTimer �� WdInfoStartTimer � WdInfoTriggerAction �� WdInfoState �� WdInfoTriggerReset ��� WdInfoNop WdInfoGeneratedLastReset � WdInfoInvalid N
t � _WATCHDOG_INFORMATION_CLASS .?AW4_WATCHDOG_INFORMATION_CLASS@@ � � @
" ��
" ��N
" Flags
� DisableExtensionPoints ���
� ReservedFlags � � _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ �� � C n J � _FILE_LINKS_INFORMATION .?AU_FILE_LINKS_INFORMATION@@ V � _FILE_LINK_ENTRY_INFORMATION .?AU_FILE_LINK_ENTRY_INFORMATION@@ ��F
" BytesNeeded ��
" EntriesReturned ��
� Entry J � _FILE_LINKS_INFORMATION .?AU_FILE_LINKS_INFORMATION@@ � �
�
� �
ExitStatus ���
u Pad1 �
# PebBaseAddress ���
# AffinityMask �
BasePriority �
u Pad2 �
# UniqueProcessId ��
# ( InheritedFromUniqueProcessId �V � 0 _PROCESS_BASIC_INFORMATION64 .?AU_PROCESS_BASIC_INFORMATION64@@ �� � a � > � _SYSTEM_AUDIT_ACE .?AU_SYSTEM_AUDIT_ACE@@ :
o Header ���
" Mask �
" SidStart �> � _SYSTEM_AUDIT_ACE .?AU_SYSTEM_AUDIT_ACE@@ � � 6 � tagBITMAPINFO .?AUtagBITMAPINFO@@ 2 � tagRGBQUAD .?AUtagRGBQUAD@@ �� � " �*
i bmiHeader
� ( bmiColors 6 � , tagBITMAPINFO .?AUtagBITMAPINFO@@ � � Z LocationTypeRegistry � LocationTypeFileSystem ��� LocationTypeMaximum ��B t � _STATE_LOCATION_TYPE .?AW4_STATE_LOCATION_TYPE@@ ��� � ( ($ : � _MCA_EXCEPTION .?AU_MCA_EXCEPTION@@ ��2 HAL_MCE_RECORD ��� HAL_MCA_RECORD ���> t � MCA_EXCEPTION_TYPE .?AW4MCA_EXCEPTION_TYPE@@ ���& onecore\external\ddk\inc\mce.h � � � $ " �* � _MCI_STATS .?AT_MCI_STATS@@ ��& � _MCI_ADDR .?AT_MCI_ADDR@@ f
BankNumber ���
� Reserved2
� Status ���
� Address ��
# Misc �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � &
# Address ��
# Type �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � "
� Mca ��
� Mce ��2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � � # " � �
" VersionNumber
� ExceptionType
} TimeStamp
" ProcessorNumber ��
" Reserved1
� u
" 8 ExtCnt ���
" < Reserved3
� @ ExtReg ���: � _MCA_EXCEPTION .?AU_MCA_EXCEPTION@@ �� � � � � EtwNotificationTypeNoReply ��� EtwNotificationTypeLegacyEnable �� EtwNotificationTypeEnable EtwNotificationTypePrivateLogger � EtwNotificationTypePerflib ��� EtwNotificationTypeAudio � EtwNotificationTypeSession ��� EtwNotificationTypeReserved �� EtwNotificationTypeCredentialUI ��
EtwNotificationTypeInProcSession � EtwNotificationTypeFilteredPrivateLogger � EtwNotificationTypeMax ���F t � _ETW_NOTIFICATION_TYPE .?AW4_ETW_NOTIFICATION_TYPE@@ ��� � � * V � _SYSTEM_PROCESSOR_INFORMATION .?AU_SYSTEM_PROCESSOR_INFORMATION@@ �
! ProcessorArchitecture
! ProcessorLevel ���
! ProcessorRevision
! MaximumProcessors
" ProcessorFeatureBits �V � _SYSTEM_PROCESSOR_INFORMATION .?AU_SYSTEM_PROCESSOR_INFORMATION@@ � �
�
� V � _JOBOBJECT_ENERGY_TRACKING_STATE .?AT_JOBOBJECT_ENERGY_TRACKING_STATE@@ ��B
# Value
" UpdateMask ���
" DesiredState �V � _JOBOBJECT_ENERGY_TRACKING_STATE .?AT_JOBOBJECT_ENERGY_TRACKING_STATE@@ �� � a G f � _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1@@
�
� f
� pInt64 ���
� pUint64 ��
� ppString �
� pFqbn
� pOctetString �2 � <anonymous-tag> .?AT<anonymous-tag>@@ � ] v
" Name �
! ValueType
! Reserved �
" Flags
" ValueCount ���
� Values ���f � _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1@@ � ] � b � _PERFINFO_FILENAME_SAME_INFORMATION .?AU_PERFINFO_FILENAME_SAME_INFORMATION@@
�
� *
OldFile ��
NewFile ��b � _PERFINFO_FILENAME_SAME_INFORMATION .?AU_PERFINFO_FILENAME_SAME_INFORMATION@@ � � g j � _MEMORY_PARTITION_NODE_PAGE_INFORMATION .?AU_MEMORY_PARTITION_NODE_PAGE_INFORMATION@@
# TotalPageCount ���
# SmallFreePageCount ���
# SmallZeroPageCount ���
# MediumFreePageCount ��
# MediumZeroPageCount ��
# ( LargeFreePageCount ���
# 0 LargeZeroPageCount ���
# 8 HugeFreePageCount
# @ HugeZeroPageCount j � H _MEMORY_PARTITION_NODE_PAGE_INFORMATION .?AU_MEMORY_PARTITION_NODE_PAGE_INFORMATION@@ � �
�
�
�
� v � _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT@@ ��*
� TmIdentity ���
" Flags v � _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT@@ �� � J � 6 � _PORT_MESSAGE .?AU_PORT_MESSAGE@@
�
� 2
DataLength ���
TotalLength ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � � < &
� s1 ���
" Length ���2 � <anonymous-tag> .?AT<anonymous-tag>@@ � ; .
Type �
DataInfoOffset ���: <anonymous-tag> .?AU<anonymous-tag>@@ � C &
s2 ���
" ZeroInit �2 <anonymous-tag> .?AT<anonymous-tag>@@ � B �
u1 ���
u2 ���
� ClientId �
A DoNotUseThisField
" MessageId
" ClientViewSize ���
" CallbackId ���6 _PORT_MESSAGE .?AU_PORT_MESSAGE@@ � : f � _PERFINFO_CLOCK_INTERRUPT_INFORMATION .?AU_PERFINFO_CLOCK_INTERRUPT_INFORMATION@@ *
# InterruptTime
Flags f _PERFINFO_CLOCK_INTERRUPT_INFORMATION .?AU_PERFINFO_CLOCK_INTERRUPT_INFORMATION@@
� � > � tagMOUSEMOVEPOINT .?AUtagMOUSEMOVEPOINT@@ B
t x
t y
" time �
" dwExtraInfo ��> tagMOUSEMOVEPOINT .?AUtagMOUSEMOVEPOINT@@ 2
�
�
q
� v � _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION@@ ��
" ��
" ��B
State
Reserved �
" AllInformation ���v _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION@@ �� � f � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION@@ ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��J
� BootIdentifier ���
� FirmwareType �
# BootFlags
DbgMenuOsSelection ���
DbgHiberBoot �
DbgSoftBoot ��
DbgMeasuredLaunch
DbgMeasuredLaunchCapable �
! DbgSystemHiveReplace �
" DbgMeasuredLaunchSmmProtections ��
# DbgMeasuredLaunchSmmLevel f $ _SYSTEM_BOOT_ENVIRONMENT_INFORMATION .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION@@ �� %
Z � _DEDUP_CHUNK_INFORMATION_HASH32 .?AU_DEDUP_CHUNK_INFORMATION_HASH32@@ ^
" ChunkFlags ���
ChunkOffsetInFile
ChunkSize
S HashVal ��Z ( 8 _DEDUP_CHUNK_INFORMATION_HASH32 .?AU_DEDUP_CHUNK_INFORMATION_HASH32@@ ) Z � _SYSTEM_SYSTEM_DISK_INFORMATION .?AU_SYSTEM_SYSTEM_DISK_INFORMATION@@
� SystemDisk ���Z , _SYSTEM_SYSTEM_DISK_INFORMATION .?AU_SYSTEM_SYSTEM_DISK_INFORMATION@@ - ]
r � _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION@@ ��2
" ProcessorCount ���
� Offsets ��r 0 _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION@@ �� 1 Z � _PERFINFO_INTERRUPT_INFORMATION .?AU_PERFINFO_INTERRUPT_INFORMATION@@
3
� v
# InitialTime ��
ServiceRoutine ���
ReturnValue ��
!
Vector ���
Reserved �Z 5 _PERFINFO_INTERRUPT_INFORMATION .?AU_PERFINFO_INTERRUPT_INFORMATION@@ 6 � � : � tagHANDLETABLE .?AUtagHANDLETABLE@@ �� " �
9 objectHandle �: : tagHANDLETABLE .?AUtagHANDLETABLE@@ �� ; � J � tagCOLORCORRECTPALETTE .?AUtagCOLORCORRECTPALETTE@@ ��j
emr ��
" ihPalette
" nFirstEntry ��
" nPalEntries ��
" nReserved J > tagCOLORCORRECTPALETTE .?AUtagCOLORCORRECTPALETTE@@ �� ? � � AlpcBasicInformation � AlpcPortInformation �� AlpcAssociateCompletionPortInformation ��� AlpcConnectedSIDInformation �� AlpcServerInformation AlpcMessageZoneInformation ��� AlpcRegisterCompletionListInformation AlpcUnregisterCompletionListInformation �� AlpcAdjustCompletionListConcurrencyCountInformation �� AlpcRegisterCallbackInformation ��
AlpcCompletionListRundownInformation � AlpcWaitForPortReferences AlpcServerSessionInformation �R
t A _ALPC_PORT_INFORMATION_CLASS .?AW4_ALPC_PORT_INFORMATION_CLASS@@ ��� B � Z � _PERFINFO_PPM_IDLE_EXIT_LATENCY .?AU_PERFINFO_PPM_IDLE_EXIT_LATENCY@@ v
" Flags
" PlatformState
" ProcessorState ���
" ReturnLatency
" TotalLatency �Z E _PERFINFO_PPM_IDLE_EXIT_LATENCY .?AU_PERFINFO_PPM_IDLE_EXIT_LATENCY@@ F � G B MarshalDirectionMarshal �� MarshalDirectionUnmarshal b t H _LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION .?AW4_LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION@@ � I � � B � tagEMRPOLYPOLYLINE .?AUtagEMRPOLYPOLYLINE@@ ��
K
� r
emr ��
� rclBounds
" nPolys ���
" cptl �
� aPolyCounts ��
J $ aptl �B M , tagEMRPOLYPOLYLINE .?AUtagEMRPOLYPOLYLINE@@ �� N c � � _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION .?AU_SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION@@ ��
P
� ~
" ExtentCount ��
" ValidStructureSize ���
" NextExtentIndex ��
" ExtentRestart
" CycleCount ���
" TimeoutCount �
# CycleTime
# CycleTimeMax �
# ( ExtentTime ���
" 0 ExtentTimeIndex ��
" 4 ExtentTimeMaxIndex ���
# 8 ExtentTimeMax
# @ HyperFlushTimeMax
# H TranslateVaTimeMax ���
# P DebugExemptionCount ��
# X TbHitCount ���
# ` TbMissCount ��
# h VinaPendingYield �
# p HashCycles ���
" x HistogramOffset ��
" | HistogramBuckets �
" � HistogramShift ���
" � Reserved1
# � PageNotPresentCount �� R � _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION .?AU_SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION@@ �� S �
�
� � MemoryCaptureAccessedBits MemoryCaptureAndResetAccessedBits MemoryEmptyWorkingSets ��� MemoryFlushModifiedList �� MemoryPurgeStandbyList ��� MemoryPurgeLowPriorityStandbyList MemoryCommandMax �N t V _SYSTEM_MEMORY_LIST_COMMAND .?AW4_SYSTEM_MEMORY_LIST_COMMAND@@ � W � R � _SYSTEM_VA_LIST_INFORMATION .?AU_SYSTEM_VA_LIST_INFORMATION@@ j
" VirtualSize ��
" VirtualPeak ��
" VirtualLimit �
" AllocationFailures ���R Z _SYSTEM_VA_LIST_INFORMATION .?AU_SYSTEM_VA_LIST_INFORMATION@@ [ �
N � PROCESSOR_IDLESTATE_INFO .?AUPROCESSOR_IDLESTATE_INFO@@ ��Z
" TimeCheck
DemotePercent
PromotePercent ���
� Spare N ^ PROCESSOR_IDLESTATE_INFO .?AUPROCESSOR_IDLESTATE_INFO@@ �� _ 3 > � _LUNICODE_STRING .?AU_LUNICODE_STRING@@ ��
a
� B
" Length ���
" MaximumLength
q Buffer ���> c _LUNICODE_STRING .?AU_LUNICODE_STRING@@ �� d
F � _SERVICE_TRIGGER_INFO .?AU_SERVICE_TRIGGER_INFO@@ > � _SERVICE_TRIGGER .?AU_SERVICE_TRIGGER@@ ��
g
� >
" cTriggers
h pTriggers
pReserved F i _SERVICE_TRIGGER_INFO .?AU_SERVICE_TRIGGER_INFO@@ j 3 � J � _KEY_TRUST_INFORMATION .?AU_KEY_TRUST_INFORMATION@@ ��
" ��
" ��.
m TrustedKey ���
n Reserved �J o _KEY_TRUST_INFORMATION .?AU_KEY_TRUST_INFORMATION@@ �� p � ~ > � _FILE_REGION_INFO .?AU_FILE_REGION_INFO@@
r
� R
FileOffset ���
Length ���
" Usage
" Reserved �> t _FILE_REGION_INFO .?AU_FILE_REGION_INFO@@ u i Z � _IMAGE_DYNAMIC_RELOCATION32_V2 .?AU_IMAGE_DYNAMIC_RELOCATION32_V2@@ ��n
" HeaderSize ���
" FixupInfoSize
" Symbol ���
" SymbolGroup ��
" Flags Z x _IMAGE_DYNAMIC_RELOCATION32_V2 .?AU_IMAGE_DYNAMIC_RELOCATION32_V2@@ �� y [ � � � RtlResTypePhysicalMemoryTier � RtlResTypeDiskSpaceTier �� RtlResTypeDiskSpeedTier �� RtlResTypeDiskWriteConstraintTier RtlResTypeMax F t | _RTL_RESOURCE_CATEGORY .?AW4_RTL_RESOURCE_CATEGORY@@ ��� } � ;
$ Z � _IO_RESOURCE_REQUIREMENTS_LIST .?AU_IO_RESOURCE_REQUIREMENTS_LIST@@ ��b ��InterfaceTypeUndefined �� Internal � Isa �� Eisa � MicroChannel � TurboChannel � PCIBus ��� VMEBus ��� NuBus PCMCIABus CBus �
MPIBus ��� MPSABus �� ProcessorInternal
InternalPowerBus � PNPISABus PNPBus ��� Vmcs � ACPIBus �� MaximumInterfaceType �6 t � _INTERFACE_TYPE .?AW4_INTERFACE_TYPE@@ � � �+ > � _IO_RESOURCE_LIST .?AU_IO_RESOURCE_LIST@@ � " ( �
" ListSize �
� InterfaceType
" BusNumber
" SlotNumber ���
� Reserved �
" AlternativeLists �
� List �Z � H _IO_RESOURCE_REQUIREMENTS_LIST .?AU_IO_RESOURCE_REQUIREMENTS_LIST@@ �� � � j � _SYSTEM_SPECULATION_CONTROL_INFORMATION .?AU_SYSTEM_SPECULATION_CONTROL_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
� BpbEnabled ���
� BpbDisabledSystemPolicy ��
� BpbDisabledNoHardwareSupport �
� SpecCtrlEnumerated ���
� SpecCmdEnumerated
� IbrsPresent ��
� StibpPresent �
� SmepPresent ��
� SpeculativeStoreBypassDisableAvailable ���
� SpeculativeStoreBypassDisableSupported ���
� SpeculativeStoreBypassDisabledSystemWide �
� SpeculativeStoreBypassDisabledKernel �
� SpeculativeStoreBypassDisableRequired
� BpbDisabledKernelToUser ��
� SpecCtrlRetpolineEnabled �
� SpecCtrlImportOptimizationEnabled
� EnhancedIbrs �
� HvL1tfStatusAvailable
� HvL1tfProcessorNotAffected ���
� HvL1tfMigitationEnabled ��
� HvL1tfMigitationNotEnabled_Hardware ��
� HvL1tfMigitationNotEnabled_LoadOption
� HvL1tfMigitationNotEnabled_CoreScheduler �
� EnhancedIbrsReported �
� MdsHardwareProtected �
� MbClearEnabled ���
� MbClearReported ��
� Reserved �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � &
� SpeculationControlFlags ��j � _SYSTEM_SPECULATION_CONTROL_INFORMATION .?AU_SYSTEM_SPECULATION_CONTROL_INFORMATION@@ � � Z � _REFS_SMR_VOLUME_GC_PARAMETERS .?AU_REFS_SMR_VOLUME_GC_PARAMETERS@@ ��Z SmrGcMethodCompaction SmrGcMethodCompression ��� SmrGcMethodRotation ��N t � _REFS_SMR_VOLUME_GC_METHOD .?AW4_REFS_SMR_VOLUME_GC_METHOD@@ ��� � � # " @ �
" Version ��
" Flags
Action ���
� Method ���
" IoGranularity
" CompressionFormat
� Unused ���Z � X _REFS_SMR_VOLUME_GC_PARAMETERS .?AU_REFS_SMR_VOLUME_GC_PARAMETERS@@ �� � � ^ � _ETW_COVERAGE_SAMPLER_QUERY_INFO .?AU_ETW_COVERAGE_SAMPLER_QUERY_INFO@@ ��
�
� n � _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION .?AU_EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION@@
" ��R � _ETW_COVERAGE_SAMPLER_DATA .?AU_ETW_COVERAGE_SAMPLER_DATA@@ ��F
� Common ���
� EmptyStackCache ��
� Header ���^ � @ _ETW_COVERAGE_SAMPLER_QUERY_INFO .?AU_ETW_COVERAGE_SAMPLER_QUERY_INFO@@ �� � � ^ f � _PROCESS_HANDLE_SNAPSHOT_INFORMATION .?AU_PROCESS_HANDLE_SNAPSHOT_INFORMATION@@ ��^ � _PROCESS_HANDLE_TABLE_ENTRY_INFO .?AU_PROCESS_HANDLE_TABLE_ENTRY_INFO@@ �� � " �F
" NumberOfHandles ��
" Reserved �
� Handles ��f � $ _PROCESS_HANDLE_SNAPSHOT_INFORMATION .?AU_PROCESS_HANDLE_SNAPSHOT_INFORMATION@@ �� � a � F SymbolicLinkGlobalInformation SymbolicLinkAccessMask ���J t � _SYMBOLIC_LINK_INFO_CLASS .?AW4_SYMBOLIC_LINK_INFO_CLASS@@ �* onecore\internal\sdk\inc\ntobapi.h � � � � ORIENTATION_PREFERENCE_NONE �� ORIENTATION_PREFERENCE_LANDSCAPE � ORIENTATION_PREFERENCE_PORTRAIT �� ORIENTATION_PREFERENCE_LANDSCAPE_FLIPPED � ORIENTATION_PREFERENCE_PORTRAIT_FLIPPED ��F t � ORIENTATION_PREFERENCE .?AW4ORIENTATION_PREFERENCE@@ ��� � �=
� 2 � _SYSTEMTIME .?AU_SYSTEMTIME@@ �
Bias �
� StandardName �
� D StandardDate �
T StandardBias �
� X DaylightName �
� � DaylightDate �
� DaylightBias �J � � _TIME_ZONE_INFORMATION .?AU_TIME_ZONE_INFORMATION@@ ��6 onecore\external\sdk\inc\minwin\timezoneapi.h �� � � # Z � _PROCESSOR_PROFILE_CONTROL_AREA .?AU_PROCESSOR_PROFILE_CONTROL_AREA@@
�
� B � _PEBS_DS_SAVE_AREA .?AU_PEBS_DS_SAVE_AREA@@ ��
� PebsDsSaveArea ���Z � � _PROCESSOR_PROFILE_CONTROL_AREA .?AU_PROCESSOR_PROFILE_CONTROL_AREA@@ � � J � _FILE_MODE_INFORMATION .?AU_FILE_MODE_INFORMATION@@ ��
" Mode �J � _FILE_MODE_INFORMATION .?AU_FILE_MODE_INFORMATION@@ �� � � f � _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN@@ ��
�
� *
� Header ���
SubQueue �f � $ _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN@@ �� � � 6
q �
�
� 6 NotificationTimer SynchronizationTimer �. t � _TIMER_TYPE .?AW4_TIMER_TYPE@@ � � � : � _SCONTEXT_QUEUE .?AU_SCONTEXT_QUEUE@@ " �*
� pad ��
userContext ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � �
�
�
�
� :
" NumberOfObjects ��
� ArrayOfObjects ���: � _SCONTEXT_QUEUE .?AU_SCONTEXT_QUEUE@@ � � # V � _SYSTEM_REF_TRACE_INFORMATION .?AU_SYSTEM_REF_TRACE_INFORMATION@@ j
TraceEnable ��
TracePermanent ���
� TraceProcessName �
� TracePoolTags V � _SYSTEM_REF_TRACE_INFORMATION .?AU_SYSTEM_REF_TRACE_INFORMATION@@ � � N � _MUTANT_BASIC_INFORMATION .?AU_MUTANT_BASIC_INFORMATION@@
�
� N
CurrentCount �
OwnedByCaller
AbandonedState ���N � _MUTANT_BASIC_INFORMATION .?AU_MUTANT_BASIC_INFORMATION@@ � 2 F � tagCLIENTCREATESTRUCT .?AUtagCLIENTCREATESTRUCT@@ 2
hWindowMenu ��
u idFirstChild �F � tagCLIENTCREATESTRUCT .?AUtagCLIENTCREATESTRUCT@@ � / B � tagBITMAPCOREHEADER .?AUtagBITMAPCOREHEADER@@
�
� j
" bcSize ���
! bcWidth ��
! bcHeight �
! bcPlanes �
!
bcBitCount ���B � tagBITMAPCOREHEADER .?AUtagBITMAPCOREHEADER@@ � V � _QUERY_STORAGE_RESERVE_INPUT .?AU_QUERY_STORAGE_RESERVE_INPUT@@ ��
� � " �j
" Version ��
" Flags
" AreaIdOffset �
" AreaIdCount ��
AreaId ���V _QUERY_STORAGE_RESERVE_INPUT .?AU_QUERY_STORAGE_RESERVE_INPUT@@ �� + J � _RPC_SECURITY_QOS_V2_W .?AU_RPC_SECURITY_QOS_V2_W@@ ��^ � _RPC_HTTP_TRANSPORT_CREDENTIALS_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_W@@
�
HttpCredentials ��2
<anonymous-tag> .?AT<anonymous-tag>@@ � �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
u J
_RPC_SECURITY_QOS_V2_W .?AU_RPC_SECURITY_QOS_V2_W@@ �� � . � HBRUSH__ .?AUHBRUSH__@@ ��
�
t unused ���. HBRUSH__ .?AUHBRUSH__@@ �� J j � _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA@@ ��
� SymbolicLinkName �
� AliasClassGuid ���
q AliasSymbolicLinkName
" AliasSymbolicLinkNameLength ��j _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA@@ �� � v n � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE@@ z � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY@@ " �.
" UpdateCount ��
Updates ��n _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE@@ � 6 � _STARTUPINFOA .?AU_STARTUPINFOA@@
� �
" cb ���
p lpReserved ���
p lpDesktop
p lpTitle ��
" dwX ��
" dwY ��
" dwXSize ��
" dwYSize ��
" dwXCountChars
" $ dwYCountChars
" ( dwFillAttribute ��
" , dwFlags ��
! 0 wShowWindow ��
! 2 cbReserved2 ��
4 lpReserved2 ��
8 hStdInput
< hStdOutput ���
@ hStdError 6 ! D _STARTUPINFOA .?AU_STARTUPINFOA@@ " 1 # ^ � _RTL_IMAGE_MITIGATION_ASLR_POLICY .?AU_RTL_IMAGE_MITIGATION_ASLR_POLICY@@ f
N ForceRelocateImages ��
N BottomUpRandomization
N HighEntropyRandomization �^ % _RTL_IMAGE_MITIGATION_ASLR_POLICY .?AU_RTL_IMAGE_MITIGATION_ASLR_POLICY@@ & � R � _UNICODE_PREFIX_TABLE_ENTRY .?AU_UNICODE_PREFIX_TABLE_ENTRY@@
(
� �
NodeTypeCode �
NameLength ���
) NextPrefixTree ���
) CaseMatch
# Links
< Prefix ���R * _UNICODE_PREFIX_TABLE_ENTRY .?AU_UNICODE_PREFIX_TABLE_ENTRY@@ + ( R F � _REPAIR_COPIES_INPUT .?AU_REPAIR_COPIES_INPUT@@ ��
" Size �
" Flags
} FileOffset ���
" Length ���
" SourceCopy ���
" NumberOfRepairCopies �
� RepairCopies �F . _REPAIR_COPIES_INPUT .?AU_REPAIR_COPIES_INPUT@@ �� / 4 n � _PROCESS_STACK_ALLOCATION_INFORMATION_EX .?AU_PROCESS_STACK_ALLOCATION_INFORMATION_EX@@ ��f � _PROCESS_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_STACK_ALLOCATION_INFORMATION@@ j
" PreferredNode
" Reserved0
" Reserved1
" Reserved2
2 AllocInfo n 3 _PROCESS_STACK_ALLOCATION_INFORMATION_EX .?AU_PROCESS_STACK_ALLOCATION_INFORMATION_EX@@ �� 4 a �
�
� F � _KCRM_MARSHAL_HEADER .?AU_KCRM_MARSHAL_HEADER@@ ��
7
� ^
" VersionMajor �
" VersionMinor �
" NumProtocols �
" Unused ���F 9 _KCRM_MARSHAL_HEADER .?AU_KCRM_MARSHAL_HEADER@@ �� : J � � RPCHTTP_RS_REDIRECT �� RPCHTTP_RS_ACCESS_1 �� RPCHTTP_RS_SESSION ��� RPCHTTP_RS_ACCESS_2 �� RPCHTTP_RS_INTERFACE �N t < _RPC_HTTP_REDIRECTOR_STAGE .?AW4_RPC_HTTP_REDIRECTOR_STAGE@@ ��� = � � 2 ComputerNameNetBIOS �� ComputerNameDnsHostname �� ComputerNameDnsDomain ComputerNameDnsFullyQualified ComputerNamePhysicalNetBIOS �� ComputerNamePhysicalDnsHostname �� ComputerNamePhysicalDnsDomain ComputerNamePhysicalDnsFullyQualified ComputerNameMax ��B t ? _COMPUTER_NAME_FORMAT .?AW4_COMPUTER_NAME_FORMAT@@ �6 onecore\external\sdk\inc\minwin\sysinfoapi.h ��� @ A R : � _SYSTEM_POOLTAG .?AU_SYSTEM_POOLTAG@@
C
� �
� Tag ��
" TagUlong �
" PagedAllocs ��
" PagedFrees ���
" PagedUsed
" NonPagedAllocs ���
" NonPagedFrees
" NonPagedUsed �: E _SYSTEM_POOLTAG .?AU_SYSTEM_POOLTAG@@ F u
V � _TXFS_GET_TRANSACTED_VERSION .?AU_TXFS_GET_TRANSACTED_VERSION@@ ��
" ThisBaseVersion ��
" LatestVersion
! ThisMiniVersion ��
!
FirstMiniVersion �
! LatestMiniVersion V I _TXFS_GET_TRANSACTED_VERSION .?AU_TXFS_GET_TRANSACTED_VERSION@@ �� J � j � _ALPC_PORT_COMPLETION_LIST_INFORMATION .?AU_ALPC_PORT_COMPLETION_LIST_INFORMATION@@ ��^
Buffer ���
" Size �
" ConcurrencyCount �
" AttributeFlags ���j M _ALPC_PORT_COMPLETION_LIST_INFORMATION .?AU_ALPC_PORT_COMPLETION_LIST_INFORMATION@@ �� N � 6 � _CLIENT_ID64 .?AU_CLIENT_ID64@@ ��2
# UniqueProcess
# UniqueThread �6 Q _CLIENT_ID64 .?AU_CLIENT_ID64@@ �� R C } > � _WMI_WAIT_SINGLE .?AU_WMI_WAIT_SINGLE@@ ��
T
� B
" ThreadId �
Object ���
ObjectType ���> V _WMI_WAIT_SINGLE .?AU_WMI_WAIT_SINGLE@@ �� W � � > � _SERVICE_SID_INFO .?AU_SERVICE_SID_INFO@@
Y
�
" dwServiceSidType �> [ _SERVICE_SID_INFO .?AU_SERVICE_SID_INFO@@ \ 3 J
�
�
�
� J � tagGESTURENOTIFYSTRUCT .?AUtagGESTURENOTIFYSTRUCT@@ ��r
u cbSize ���
" dwFlags ��
y hwndTarget ���
� ptsLocation ��
" dwInstanceID �J a tagGESTURENOTIFYSTRUCT .?AUtagGESTURENOTIFYSTRUCT@@ �� b �< B � tagMINIMIZEDMETRICS .?AUtagMINIMIZEDMETRICS@@ f
u cbSize ���
t iWidth ���
t iHorzGap �
t iVertGap �
t iArrange �B e tagMINIMIZEDMETRICS .?AUtagMINIMIZEDMETRICS@@ f 2 > � tagEMRGDICOMMENT .?AUtagEMRGDICOMMENT@@ ��6
emr ��
" cbData ���
K Data �> i tagEMRGDICOMMENT .?AUtagEMRGDICOMMENT@@ �� j � Z � _FILE_PIPE_DELETE_SYMLINK_INPUT .?AU_FILE_PIPE_DELETE_SYMLINK_INPUT@@ 2
! NameOffset ���
! NameLength ���Z m _FILE_PIPE_DELETE_SYMLINK_INPUT .?AU_FILE_PIPE_DELETE_SYMLINK_INPUT@@ n �)
�
� b ProcessTlsReplaceIndex ��� ProcessTlsReplaceVector �� MaxProcessTlsOperation ���R t q _PROCESS_TLS_INFORMATION_TYPE .?AW4_PROCESS_TLS_INFORMATION_TYPE@@ � r a Y F � _SYSTEM_POWER_POLICY .?AU_SYSTEM_POWER_POLICY@@ ��
t
� B � POWER_ACTION_POLICY .?AUPOWER_ACTION_POLICY@@ B � SYSTEM_POWER_LEVEL .?AUSYSTEM_POWER_LEVEL@@ �� w " ` �
" Revision �
v PowerButton ��
v SleepButton ��
v LidClose �
S ( LidOpenWake ��
" , Reserved �
v 0 Idle �
" < IdleTimeout ��
@ IdleSensitivity ��
A DynamicThrottle ��
� B Spare2 ���
S D MinSleep �
S H MaxSleep �
S L ReducedLatencySleep ��
" P WinLogonFlags
" T Spare3 ���
" X DozeS4Timeout
" \ BroadcastCapacityResolution ��
x ` DischargePolicy ��
" � VideoTimeout �
� VideoDimDisplay ��
� � VideoReserved
" � SpindownTimeout ��
� OptimizeForPower �
� FanThrottleTolerance �
� ForcedThrottle ���
� MinThrottle ��
v � OverThrottled F y � _SYSTEM_POWER_POLICY .?AU_SYSTEM_POWER_POLICY@@ �� z �
r � _EVENT_TRACE_LBR_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_LBR_CONFIGURATION_INFORMATION@@ ��b
� EventTraceInformationClass ���
# TraceHandle ��
" ConfigurationOptions �r } _EVENT_TRACE_LBR_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_LBR_CONFIGURATION_INFORMATION@@ �� ~ � r V � _DELETE_STORAGE_RESERVE_INPUT .?AU_DELETE_STORAGE_RESERVE_INPUT@@
�
� j
" Version ��
" Flags
" AreaIdOffset �
" AreaIdCount ��
AreaId ���V � _DELETE_STORAGE_RESERVE_INPUT .?AU_DELETE_STORAGE_RESERVE_INPUT@@ � ,+ N � _PROCESS_WAKE_INFORMATION .?AU_PROCESS_WAKE_INFORMATION@@ " " �J � _JOBOBJECT_WAKE_FILTER .?AU_JOBOBJECT_WAKE_FILTER@@ ��R
# NotificationChannel ��
� WakeCounters �
� $ WakeFilter ���N � 0 _PROCESS_WAKE_INFORMATION .?AU_PROCESS_WAKE_INFORMATION@@ � a 8 r � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA .?AT_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA@@ �� � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING@@ � � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL@@ �� � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING@@ ��r
� ResolutionBeginning ��
\ GetRoot ��
� ResolutionSuccessful �
� ResolutionEnding �r � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA .?AT_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA@@ �� � L � > � _RTLP_CURDIR_REF .?AU_RTLP_CURDIR_REF@@ ��j � _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA .?AU_PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA@@ r
� DeviceInstance ���
" Flags
u VetoType �
q VetoName �
" VetoNameLength ���j � _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA .?AU_PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA@@ � � � UmsThreadInvalidInfoClass UmsThreadUserContext � UmsThreadPriority UmsThreadAffinity UmsThreadTeb � UmsThreadIsSuspended � UmsThreadIsTerminated UmsThreadMaxInfoClass N t � _RTL_UMS_THREAD_INFO_CLASS .?AW4_RTL_UMS_THREAD_INFO_CLASS@@ ��� � ( �! j � _MEMORY_PARTITION_ATTRIBUTE_INFORMATION .?AU_MEMORY_PARTITION_ATTRIBUTE_INFORMATION@@
# Flags j � _MEMORY_PARTITION_ATTRIBUTE_INFORMATION .?AU_MEMORY_PARTITION_ATTRIBUTE_INFORMATION@@ � � F � _PEBS_DS_SAVE_AREA64 .?AU_PEBS_DS_SAVE_AREA64@@ ��"
# BtsBufferBase
# BtsIndex �
# BtsAbsoluteMaximum ���
# BtsInterruptThreshold
# PebsBufferBase ���
# ( PebsIndex
# 0 PebsAbsoluteMaximum ��
# 8 PebsInterruptThreshold ���
� @ PebsGpCounterReset ���
� � PebsFixedCounterReset F
� � _PEBS_DS_SAVE_AREA64 .?AU_PEBS_DS_SAVE_AREA64@@ �� � � b � _WIM_PROVIDER_UPDATE_OVERLAY_INPUT .?AU_WIM_PROVIDER_UPDATE_OVERLAY_INPUT@@ ��R
} DataSourceId �
" WimFileNameOffset
" WimFileNameLength b � _WIM_PROVIDER_UPDATE_OVERLAY_INPUT .?AU_WIM_PROVIDER_UPDATE_OVERLAY_INPUT@@ �� � -" � SecureSettingValueTypeBoolean SecureSettingValueTypeUlong �� SecureSettingValueTypeBinary � SecureSettingValueTypeString � SecureSettingValueTypeUnknown N t � _SECURE_SETTING_VALUE_TYPE .?AW4_SECURE_SETTING_VALUE_TYPE@@ ��� � ] b
J
� Z � _PROCESS_POWER_THROTTLING_STATE .?AU_PROCESS_POWER_THROTTLING_STATE@@ B
" Version ��
" ControlMask ��
" StateMask Z � _PROCESS_POWER_THROTTLING_STATE .?AU_PROCESS_POWER_THROTTLING_STATE@@ � 1 � f � _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_LIST_DATA@@ z
� DeviceInstance ���
� InterfaceGuid
q InterfaceList
" InterfaceListSize
" Flags f � _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_LIST_DATA@@ � � + N � _SYSTEM_POOL_INFORMATION .?AU_SYSTEM_POOL_INFORMATION@@ ��B � _SYSTEM_POOL_ENTRY .?AU_SYSTEM_POOL_ENTRY@@ �� � " �
" TotalSize
FirstEntry ���
! EntryOverhead
PoolTagPresent ���
Spare0 ���
" NumberOfEntries ��
� Entries ��N � _SYSTEM_POOL_INFORMATION .?AU_SYSTEM_POOL_INFORMATION@@ �� � k
V � _ETW_DFSS_START_NEW_INTERVAL .?AU_ETW_DFSS_START_NEW_INTERVAL@@ ��J � _ETW_PER_SESSION_QUOTA .?AU_ETW_PER_SESSION_QUOTA@@ �� � " �
" CurrentGeneration
" SessionCount �
# TotalCycleCredit �
# TotalCyclesAccumulated ���
� SessionQuota �V � 0 _ETW_DFSS_START_NEW_INTERVAL .?AU_ETW_DFSS_START_NEW_INTERVAL@@ �� � � 3
b � _SERVICE_REQUIRED_PRIVILEGES_INFOW .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOW@@ ��&
q pmszRequiredPrivileges ���b � _SERVICE_REQUIRED_PRIVILEGES_INFOW .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOW@@ �� � 3 W
*
� n
" Flags
� FullDllName ��
� BaseDllName ��
DllBase ��
" SizeOfImage ��^ � _LDR_DLL_LOADED_NOTIFICATION_DATA .?AU_LDR_DLL_LOADED_NOTIFICATION_DATA@@ � u � n � tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION .?AUtagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION@@ *
! score
x adjustedPoint n � tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION .?AUtagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION@@ � " ^ � _SYSTEM_HOT_PATCH_REGISTRY_VALUE .?AU_SYSTEM_HOT_PATCH_REGISTRY_VALUE@@ ��2
! ImageNameLength ��
ImageName ^ � _SYSTEM_HOT_PATCH_REGISTRY_VALUE .?AU_SYSTEM_HOT_PATCH_REGISTRY_VALUE@@ ��2 onecore\internal\sdk\inc\minwin\ntioapi.h �� � �
J � _KLDR_DATA_TABLE_ENTRY .?AU_KLDR_DATA_TABLE_ENTRY@@ ��F � _NON_PAGED_DEBUG_INFO .?AU_NON_PAGED_DEBUG_INFO@@
�
�
! ��
! ��
! ��b
� SignatureLevel ���
� SignatureType
� Unused ���
! EntireField ��2 � <anonymous-tag> .?AT<anonymous-tag>@@ � u �
� InLoadOrderLinks �
ExceptionTable ���
" ExceptionTableSize ���
GpValue ��
� NonPagedDebugInfo
DllBase ��
EntryPoint ���
" SizeOfImage ��
� $ FullDllName ��
� , BaseDllName ��
" 4 Flags
! 8 LoadCount
� : u1 ���
< SectionPointer ���
" @ CheckSum �
" D CoverageSectionSize ��
H CoverageSection ��
L LoadedImports
P Spare
" T SizeOfImageNotRounded
" X TimeDateStamp J � \ _KLDR_DATA_TABLE_ENTRY .?AU_KLDR_DATA_TABLE_ENTRY@@ �� � u �
�
� B ProcessActivityTypeAudio � ProcessActivityTypeMax ���F t � _PROCESS_ACTIVITY_TYPE .?AW4_PROCESS_ACTIVITY_TYPE@@ ��� � a &
R � _BY_HANDLE_FILE_INFORMATION .?AU_BY_HANDLE_FILE_INFORMATION@@
�
�
" dwFileAttributes �
� ftCreationTime ���
� ftLastAccessTime �
� ftLastWriteTime ��
" dwVolumeSerialNumber �
" nFileSizeHigh
" $ nFileSizeLow �
" ( nNumberOfLinks ���
" , nFileIndexHigh ���
" 0 nFileIndexLow R
� 4 _BY_HANDLE_FILE_INFORMATION .?AU_BY_HANDLE_FILE_INFORMATION@@ � � � 2 � tagMENUINFO .?AUtagMENUINFO@@
� ��
�
�
� �
" cbSize ���
" fMask
" dwStyle ��
u cyMax
� hbrBack ��
" dwContextHelpID ��
" dwMenuData ���2 � tagMENUINFO .?AUtagMENUINFO@@ � B g z � ^ � _ALPC_MESSAGE_HANDLE_INFORMATION .?AU_ALPC_MESSAGE_HANDLE_INFORMATION@@ ��f
" Index
" Flags
" Handle ���
" ObjectType ���
" GrantedAccess ^ � _ALPC_MESSAGE_HANDLE_INFORMATION .?AU_ALPC_MESSAGE_HANDLE_INFORMATION@@ �� � � R � _PERFINFO_CCSWAP_IDLE_SHORT .?AU_PERFINFO_CCSWAP_IDLE_SHORT@@
! ��
! ��*
� DataType �
� TimeDelta R � _PERFINFO_CCSWAP_IDLE_SHORT .?AU_PERFINFO_CCSWAP_IDLE_SHORT@@ � � �
/
� : � _STARTUPINFOEXW .?AU_STARTUPINFOEXW@@
�
� R � _PROC_THREAD_ATTRIBUTE_LIST .?AU_PROC_THREAD_ATTRIBUTE_LIST@@
�
� 6
StartupInfo ��
� D lpAttributeList ��: � H _STARTUPINFOEXW .?AU_STARTUPINFOEXW@@ � 5 j � JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 .?AUJOBOBJECT_LIMIT_VIOLATION_INFORMATION_2@@ r
" LimitFlags ���
" ViolationLimitFlags ��
# IoReadBytes ��
# IoReadBytesLimit �
# IoWriteBytes �
# IoWriteBytesLimit
} ( PerJobUserTime ���
} 0 PerJobUserTimeLimit ��
# 8 JobMemory
# @ JobHighMemoryLimit ���
# @ JobMemoryLimit ���
� H RateControlTolerance �
� H CpuRateControlTolerance ��
� L RateControlToleranceLimit
� L CpuRateControlToleranceLimit �
# P JobLowMemoryLimit
� X IoRateControlTolerance ���
� \ IoRateControlToleranceLimit ��
� ` NetRateControlTolerance ��
� d NetRateControlToleranceLimit �j ! h JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 .?AUJOBOBJECT_LIMIT_VIOLATION_INFORMATION_2@@ ! C � : � _OSVERSIONINFOA .?AU_OSVERSIONINFOA@@ �
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
� szCSDVersion �: ! � _OSVERSIONINFOA .?AU_OSVERSIONINFOA@@ ! ( � 2 � _BOOT_ENTRY .?AU_BOOT_ENTRY@@ �
" Version ��
" Length ���
" Id ���
" Attributes ���
" FriendlyNameOffset ���
" BootFilePathOffset ���
" OsOptionsLength ��
| OsOptions 2 ! _BOOT_ENTRY .?AU_BOOT_ENTRY@@ ! � J � _PERFINFO_FILE_DIRENUM .?AU_PERFINFO_FILE_DIRENUM@@ ��
" Irp ��
" FileObject ���
" FileKey ��
" IssuingThreadId ��
" Length ���
" InfoClass
" FileIndex
FileName �J ! _PERFINFO_FILE_DIRENUM .?AU_PERFINFO_FILE_DIRENUM@@ ��
! � i F � _RPC_CLIENT_INTERFACE .?AU_RPC_CLIENT_INTERFACE@@
!
� B � RPC_DISPATCH_TABLE .?AURPC_DISPATCH_TABLE@@ ��
!
� F � _RPC_PROTSEQ_ENDPOINT .?AU_RPC_PROTSEQ_ENDPOINT@@
!
� �
u Length ���
� InterfaceId ��
� TransferSyntax ���
! , DispatchTable
u 0 RpcProtseqEndpointCount ��
! 4 RpcProtseqEndpoint ���
" 8 Reserved �
< InterpreterInfo ��
u @ Flags F ! D _RPC_CLIENT_INTERFACE .?AU_RPC_CLIENT_INTERFACE@@ ! � � v � _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION@@
!
�
# CycleTime v ! _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION@@ !
j TransactionStateNormal ��� TransactionStateIndoubt �� TransactionStateCommittedNotify ��> t ! _TRANSACTION_STATE .?AW4_TRANSACTION_STATE@@ ��� ! � � F � _WMI_JOB_INFORMATION .?AU_WMI_JOB_INFORMATION@@ ��
!
� N
� ContainerId ��
" JobId
" Flags
Status ���F "! _WMI_JOB_INFORMATION .?AU_WMI_JOB_INFORMATION@@ �� #! � � 2 � _RPC_STRING .?AU_RPC_STRING@@ B
! Length ���
! MaximumLength
p Buffer ���2 &! _RPC_STRING .?AU_RPC_STRING@@ '! � D B � tagIMEMENUITEMINFOW .?AUtagIMEMENUITEMINFOW@@ q " � �
u cbSize ���
u fType
u fState ���
u wID ��
hbmpChecked ��
hbmpUnchecked
" dwItemData ���
*! szString �
� hbmpItem �B +! � tagIMEMENUITEMINFOW .?AUtagIMEMENUITEMINFOW@@ ,! E � j STUB_UNMARSHAL ��� STUB_CALL_SERVER � STUB_MARSHAL � STUB_CALL_SERVER_NO_HRESULT ��. t .! STUB_PHASE .?AW4STUB_PHASE@@ ��� /! � G
VmPrefetchInformation VmPagePriorityInformation VmCfgCallTargetInformation ��� VmPageDirtyStateInformation �� VmImageHotPatchInformation ��� VmPhysicalContiguityInformation �� VmVirtualMachinePrepopulateInformation ���Z t 1! _VIRTUAL_MEMORY_INFORMATION_CLASS .?AW4_VIRTUAL_MEMORY_INFORMATION_CLASS@@ � 2! ? 1
P
� *
Sid ��
" Attributes ���B 5! _SID_AND_ATTRIBUTES .?AU_SID_AND_ATTRIBUTES@@ 6! I j � _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID .?AU_EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID@@
� RelatedActivityId j 9! _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID .?AU_EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID@@ :! � `
�
� J � tagEMRSETVIEWPORTORGEX .?AUtagEMRSETVIEWPORTORGEX@@ ��&
emr ��
I ptlOrigin J >! tagEMRSETVIEWPORTORGEX .?AUtagEMRSETVIEWPORTORGEX@@ �� ?! � > � tagHIGHCONTRASTA .?AUtagHIGHCONTRASTA@@ ��
A!
� F
u cbSize ���
" dwFlags ��
p lpszDefaultScheme > C! tagHIGHCONTRASTA .?AUtagHIGHCONTRASTA@@ �� D! j2 : � tagGCP_RESULTSA .?AUtagGCP_RESULTSA@@ �
" lStructSize ��
p lpOutString ��
u lpOrder ��
t lpDx �
t lpCaretPos ���
p lpClass ��
q lpGlyphs �
u nGlyphs ��
t nMaxFit ��: G! $ tagGCP_RESULTSA .?AUtagGCP_RESULTSA@@ H! �
6 � tagABORTPATH .?AUtagABORTPATH@@ ��
emr ��6 K! tagABORTPATH .?AUtagABORTPATH@@ �� L! T � � _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED@@ b � _RTL_ACTIVATION_CONTEXT_STACK_FRAME .?AU_RTL_ACTIVATION_CONTEXT_STACK_FRAME@@ �
" Size �
" Format ���
O! Frame
Extra1 ���
Extra2 ���
Extra3 ���
Extra4 ��� P! $ _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED@@ Q! L
j � _JOBOBJECT_END_OF_JOB_TIME_INFORMATION .?AU_JOBOBJECT_END_OF_JOB_TIME_INFORMATION@@ ��"
" EndOfJobTimeAction ���j T! _JOBOBJECT_END_OF_JOB_TIME_INFORMATION .?AU_JOBOBJECT_END_OF_JOB_TIME_INFORMATION@@ �� U! C �
M
� B � _MM_ETW_PAGE_EXTRA_INFO .?AT_MM_ETW_PAGE_EXTRA_INFO@@
" ��
Y! SharedInitial : Z! <anonymous-tag> .?AU<anonymous-tag>@@ [! C
" ��
" ��
" ��J
]! WorkingSetType ���
^! NotAddedtoWS �
_! COWFault �: `! <anonymous-tag> .?AU<anonymous-tag>@@ a! F R
[! e1 ���
a! e2 ���
" ProtoPte �
VirtualAddress ���B c! _MM_ETW_PAGE_EXTRA_INFO .?AT_MM_ETW_PAGE_EXTRA_INFO@@ d! B 6 � _ICONINFOEXA .?AU_ICONINFOEXA@@ ��
" cbSize ���
t fIcon
" xHotspot �
" yHotspot �
hbmMask ��
hbmColor �
! wResID ���
� szModName
� szResName 6 g! $_ICONINFOEXA .?AU_ICONINFOEXA@@ �� h! �* ~ VmOfferPriorityVeryLow ��� VmOfferPriorityLow ��� VmOfferPriorityBelowNormal ��� VmOfferPriorityNormal 6 t j! OFFER_PRIORITY .?AW4OFFER_PRIORITY@@ ��� k! � Z � _FILE_FS_DATA_COPY_INFORMATION .?AU_FILE_FS_DATA_COPY_INFORMATION@@ ��
" NumberOfCopies ���Z n! _FILE_FS_DATA_COPY_INFORMATION .?AU_FILE_FS_DATA_COPY_INFORMATION@@ �� o! � PowerStateSleeping1 �� PowerStateSleeping2 �� PowerStateSleeping3 �� PowerStateSleeping4 �� PowerStateShutdownOff PowerStateShutdownReset �� PowerStateSleeping4Firmware �� PowerStateMaximum J t q! POWER_STATE_HANDLER_TYPE .?AW4POWER_STATE_HANDLER_TYPE@@ ��� r! � j � RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER .?AURETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER@@ ��B
} NextVcn ��
} Lcn ��
" ReferenceCount ���: u! <anonymous-tag> .?AU<anonymous-tag>@@ v! u
v! " �F
" ExtentCount ��
} StartingVcn ��
x! Extents ��j y! ( RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER .?AURETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER@@ �� z! q
�
O!
�
�
� B
}! Previous �
~! ActivationContext
" Flags b ! _RTL_ACTIVATION_CONTEXT_STACK_FRAME .?AU_RTL_ACTIVATION_CONTEXT_STACK_FRAME@@ �! L o
: � _LDR_DDAG_NODE .?AU_LDR_DDAG_NODE@@ ��
�!
�
q
� 6 � _LDRP_CSLIST .?AU_LDRP_CSLIST@@ ��
� Modules ��
�! ServiceTagList ���
" LoadCount
" LoadWhileUnloadingCount ��
" LowestLink ���
�! Dependencies �
�! IncomingDependencies �
� State
$ CondenseLink �
" ( PreorderNumber ���:
�! , _LDR_DDAG_NODE .?AU_LDR_DDAG_NODE@@ �� �! u � b � _JOBOBJECT_INTERFERENCE_INFORMATION .?AU_JOBOBJECT_INTERFERENCE_INFORMATION@@
# Count b �! _JOBOBJECT_INTERFERENCE_INFORMATION .?AU_JOBOBJECT_INTERFERENCE_INFORMATION@@ �! a C 6 � tagEMRPLGBLT .?AUtagEMRPLGBLT@@ �� I " �
emr ��
� rclBounds
�! aptlDest �
0 xSrc �
4 ySrc �
8 cxSrc
< cySrc
� @ xformSrc �
" X crBkColorSrc �
" \ iUsageSrc
" ` offBmiSrc
" d cbBmiSrc �
" h offBitsSrc ���
" l cbBitsSrc
p xMask
t yMask
" x iUsageMask ���
" | offBmiMask ���
" � cbBmiMask
" � offBitsMask ��
" � cbBitsMask ���6 �! � tagEMRPLGBLT .?AUtagEMRPLGBLT@@ �� �! � : � tagEMRINVERTRGN .?AUtagEMRINVERTRGN@@
�!
� N
emr ��
� rclBounds
" cbRgnData
K RgnData ��: �! tagEMRINVERTRGN .?AUtagEMRINVERTRGN@@ �! y Z � _SYSTEM_FIRMWARE_TABLE_HANDLER .?AU_SYSTEM_FIRMWARE_TABLE_HANDLER@@ ��b � _SYSTEM_FIRMWARE_TABLE_INFORMATION .?AU_SYSTEM_FIRMWARE_TABLE_INFORMATION@@ ��
�!
�
�! �!
�!
� j
" ProviderSignature
Register �
�! FirmwareTableHandler �
DriverObject �Z �! _SYSTEM_FIRMWARE_TABLE_HANDLER .?AU_SYSTEM_FIRMWARE_TABLE_HANDLER@@ �� �! { d F � _OBJECT_ATTRIBUTES32 .?AU_OBJECT_ATTRIBUTES32@@ ��
" Length ���
" RootDirectory
" ObjectName ���
" Attributes ���
" SecurityDescriptor ���
" SecurityQualityOfService �F �! _OBJECT_ATTRIBUTES32 .?AU_OBJECT_ATTRIBUTES32@@ �� �! F � _SERVICE_DESCRIPTIONW .?AU_SERVICE_DESCRIPTIONW@@
�!
�
q lpDescription F �! _SERVICE_DESCRIPTIONW .?AU_SERVICE_DESCRIPTIONW@@ �! 3 � B � PPM_IDLE_ACCOUNTING .?AUPPM_IDLE_ACCOUNTING@@
�!
� N � PPM_IDLE_STATE_ACCOUNTING .?AUPPM_IDLE_STATE_ACCOUNTING@@ �! " 0 �r
" StateCount ���
" TotalTransitions �
" ResetCount ���
# StartTime
�! State B �! H PPM_IDLE_ACCOUNTING .?AUPPM_IDLE_ACCOUNTING@@ �!
. � _POWER_STATE .?AT_POWER_STATE@@ ��
�!
� 2
S SystemState ��
l DeviceState ��. �! _POWER_STATE .?AT_POWER_STATE@@ �� �! � R � _SYSTEM_MANDATORY_LABEL_ACE .?AU_SYSTEM_MANDATORY_LABEL_ACE@@ :
o Header ���
" Mask �
" SidStart �R �! _SYSTEM_MANDATORY_LABEL_ACE .?AU_SYSTEM_MANDATORY_LABEL_ACE@@ �! � . � _DOCINFOA .?AU_DOCINFOA@@
�!
� r
t cbSize ���
7 lpszDocName ��
7 lpszOutput ���
7 lpszDatatype �
" fwType ���. �! _DOCINFOA .?AU_DOCINFOA@@ �! � j � _WMI_JOB_SEND_NOTIFICATION_INFORMATION .?AU_WMI_JOB_SEND_NOTIFICATION_INFORMATION@@ ��F
� ContainerId ��
" JobId
" NotificationId ���j �! _WMI_JOB_SEND_NOTIFICATION_INFORMATION .?AU_WMI_JOB_SEND_NOTIFICATION_INFORMATION@@ �� �! � � > � _nlsversioninfoex .?AU_nlsversioninfoex@@ �
" dwNLSVersionInfoSize �
" dwNLSVersion �
" dwDefinedVersion �
" dwEffectiveId
� guidCustomVersion > �! _nlsversioninfoex .?AU_nlsversioninfoex@@ �! � � N � _RTL_SPARSE_BITMAP_RANGE .?AU_RTL_SPARSE_BITMAP_RANGE@@ ��2 � _RTL_BITMAP .?AU_RTL_BITMAP@@ :
" Lock �
�! RangeBitmap ��
Next �N �! _RTL_SPARSE_BITMAP_RANGE .?AU_RTL_SPARSE_BITMAP_RANGE@@ �� �! � � F � _CM_VIDEO_DEVICE_DATA .?AU_CM_VIDEO_DEVICE_DATA@@
�!
� B
! Version ��
! Revision �
" VideoClock ���F �! _CM_VIDEO_DEVICE_DATA .?AU_CM_VIDEO_DEVICE_DATA@@ �! � � r SystemCrashDumpDisable ��� SystemCrashDumpReconfigure ��� SystemCrashDumpInitializationComplete f t �! _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS .?AW4_SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS@@ ��� �! & N � _FILE_STREAM_INFORMATION .?AU_FILE_STREAM_INFORMATION@@ ��
�!
� �
" NextEntryOffset ��
" StreamNameLength �
} StreamSize ���
} StreamAllocationSize �
StreamName ���N �! _FILE_STREAM_INFORMATION .?AU_FILE_STREAM_INFORMATION@@ �� �! - J � _MIDL_INTERCEPTION_INFO .?AU_MIDL_INTERCEPTION_INFO@@ z
" Version ��
� ProcString ���
� ProcFormatOffsetTable
" ProcCount
� TypeString ���J �! _MIDL_INTERCEPTION_INFO .?AU_MIDL_INTERCEPTION_INFO@@ �! � � > � _EXFAT_STATISTICS .?AU_EXFAT_STATISTICS@@
" CreateHits ���
" SuccessfulCreates
" FailedCreates
" NonCachedReads ���
" NonCachedReadBytes ���
" NonCachedWrites ��
" NonCachedWriteBytes ��
" NonCachedDiskReads ���
" NonCachedDiskWrites ��> �! $ _EXFAT_STATISTICS .?AU_EXFAT_STATISTICS@@ �! N j FpRoundNearest ��� FpRoundMinusInfinity � FpRoundPlusInfinity �� FpRoundChopped ���F t �! _FP__IEEE_ROUNDING_MODE .?AW4_FP__IEEE_ROUNDING_MODE@@ � �! + � B � HSAVEDUILANGUAGES__ .?AUHSAVEDUILANGUAGES__@@
�!
�
t unused ���B �! HSAVEDUILANGUAGES__ .?AUHSAVEDUILANGUAGES__@@ �! �
. HeapCompatibilityInformation � HeapEnableTerminationOnCorruption HeapExtendedInformation �� HeapOptimizeResources HeapTaggingInformation ��� HeapStackDatabase HeapMemoryLimit �� � �HeapDetailedFailureInformation ��� � �HeapSetDebuggingInformation ��F t �! _HEAP_INFORMATION_CLASS .?AW4_HEAP_INFORMATION_CLASS@@ � �! L Q " �!
�!
� N � _QUERY_FILE_LAYOUT_OUTPUT .?AU_QUERY_FILE_LAYOUT_OUTPUT@@
�!
� ^
" FileEntryCount ���
" FirstFileOffset ��
" Flags
" Reserved �N �! _QUERY_FILE_LAYOUT_OUTPUT .?AU_QUERY_FILE_LAYOUT_OUTPUT@@ �! Y
k
�
`
� 6 � tagEMRLINETO .?AUtagEMRLINETO@@ ��
�!
� "
emr ��
I ptl ��6 �! tagEMRLINETO .?AUtagEMRLINETO@@ �� �! �
�!
� " " " " " �!
�!
� > � _DISPLAY_DEVICEA .?AU_DISPLAY_DEVICEA@@ �� p " �
" cb ���
�! DeviceName ���
� $ DeviceString �
" � StateFlags ���
� � DeviceID �
� (DeviceKey > " �_DISPLAY_DEVICEA .?AU_DISPLAY_DEVICEA@@ �� " �
F � _RTL_PERTHREAD_CURDIR .?AU_RTL_PERTHREAD_CURDIR@@ N � _RTL_DRIVE_LETTER_CURDIR .?AU_RTL_DRIVE_LETTER_CURDIR@@ ��
"
� N
" CurrentDirectories ���
< ImageName
Environment ��F " _RTL_PERTHREAD_CURDIR .?AU_RTL_PERTHREAD_CURDIR@@ " L 4 f EtwProviderTraitTypeGroup EtwProviderTraitDecodeGuid ��� EtwProviderTraitTypeMax ��F t " ETW_PROVIDER_TRAIT_TYPE .?AW4ETW_PROVIDER_TRAIT_TYPE@@ �
" � � � FEEDBACK_TOUCH_CONTACTVISUALIZATION �� FEEDBACK_PEN_BARRELVISUALIZATION � FEEDBACK_PEN_TAP � FEEDBACK_PEN_DOUBLETAP ��� FEEDBACK_PEN_PRESSANDHOLD FEEDBACK_PEN_RIGHTTAP FEEDBACK_TOUCH_TAP ��� FEEDBACK_TOUCH_DOUBLETAP � FEEDBACK_TOUCH_PRESSANDHOLD ��
FEEDBACK_TOUCH_RIGHTTAP �� FEEDBACK_GESTURE_PRESSANDTAP � ��FEEDBACK_MAX : t " tagFEEDBACK_TYPE .?AW4tagFEEDBACK_TYPE@@ ���
" R Z � _JOBOBJECT_IO_ATTRIBUTION_STATS .?AU_JOBOBJECT_IO_ATTRIBUTION_STATS@@
"
� z
" IoCount ��
# TotalNonOverlappedQueueTime ��
# TotalNonOverlappedServiceTime
# TotalSize Z " _JOBOBJECT_IO_ATTRIBUTION_STATS .?AU_JOBOBJECT_IO_ATTRIBUTION_STATS@@ " C � : � _JOB_SET_ARRAY .?AU_JOB_SET_ARRAY@@ ��>
JobHandle
" MemberLevel ��
" Flags : " _JOB_SET_ARRAY .?AU_JOB_SET_ARRAY@@ �� " C � V � _PERFINFO_SYSCALL_ENTER_DATA .?AU_PERFINFO_SYSCALL_ENTER_DATA@@ ��
SysCallAddr ��V " _PERFINFO_SYSCALL_ENTER_DATA .?AU_PERFINFO_SYSCALL_ENTER_DATA@@ �� " � & . � _LDT_SIZE .?AU_LDT_SIZE@@
"
�
" Length ���. " _LDT_SIZE .?AU_LDT_SIZE@@ " } � f � _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY@@
!"
� �
# BeginAddress �
# EndAddress ���
# ExceptionHandler �
# HandlerData ��
# PrologEndAddress �f #" ( _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY@@ $" [ # B � _MOUSE_EVENT_RECORD .?AU_MOUSE_EVENT_RECORD@@ * � _COORD .?AU_COORD@@ ��j
'" dwMousePosition ��
" dwButtonState
" dwControlKeyState
" dwEventFlags �B (" _MOUSE_EVENT_RECORD .?AU_MOUSE_EVENT_RECORD@@ )" R B � POWER_STATE_HANDLER .?AUPOWER_STATE_HANDLER@@
+"
� �
-"
� ." /"
0"
� ^
r! Type �
RtcWake ��
� Spare
1" Handler ��
Context ��B 2" POWER_STATE_HANDLER .?AUPOWER_STATE_HANDLER@@ 3" - > � tagREGISTERWORDA .?AUtagREGISTERWORDA@@ ��
5"
� *
p lpReading
p lpWord ���> 7" tagREGISTERWORDA .?AUtagREGISTERWORDA@@ �� 8" E \
�
� � :" ;"
<"
� � HiberFileBucket1GB ��� HiberFileBucket2GB ��� HiberFileBucket4GB ��� HiberFileBucket8GB ��� HiberFileBucket16GB �� HiberFileBucket32GB �� HiberFileBucketUnlimited � HiberFileBucketMax ���F t >" _HIBERFILE_BUCKET_SIZE .?AW4_HIBERFILE_BUCKET_SIZE@@ ��� ?" � V � _FILE_ALLOCATION_INFORMATION .?AU_FILE_ALLOCATION_INFORMATION@@ ��
} AllocationSize ���V B" _FILE_ALLOCATION_INFORMATION .?AU_FILE_ALLOCATION_INFORMATION@@ �� C" � ^ � _ETW_TIMER_EXPIRATION_START_EVENT .?AU_ETW_TIMER_EXPIRATION_START_EVENT@@ :
# InterruptTime
HrTimerExpirationOnly ^ F" _ETW_TIMER_EXPIRATION_START_EVENT .?AU_ETW_TIMER_EXPIRATION_START_EVENT@@ G" � � > � tagACCESSTIMEOUT .?AUtagACCESSTIMEOUT@@ ��
I"
� B
u cbSize ���
" dwFlags ��
" iTimeOutMSec �> K" tagACCESSTIMEOUT .?AUtagACCESSTIMEOUT@@ �� L" �3 R � _FILE_ALIGNMENT_INFORMATION .?AU_FILE_ALIGNMENT_INFORMATION@@
N"
� "
" AlignmentRequirement �R P" _FILE_ALIGNMENT_INFORMATION .?AU_FILE_ALIGNMENT_INFORMATION@@ Q" �
�
� B � tagENUMTEXTMETRICW .?AUtagENUMTEXTMETRICW@@ ��
T"
� B � tagNEWTEXTMETRICEXW .?AUtagNEWTEXTMETRICEXW@@ :
V" etmNewTextMetricEx ���
� d etmAxesList ��B W" �tagENUMTEXTMETRICW .?AUtagENUMTEXTMETRICW@@ �� X" r
x
y . Z" tagPOINT .?AUtagPOINT@@ �� [" � : WdActionSetTimeoutValue �� WdActionQueryTimeoutValue WdActionResetTimer ��� WdActionStopTimer WdActionStartTimer ��� WdActionSetTriggerAction � WdActionQueryTriggerAction ��� WdActionQueryState ��� WdActionSleep WdActionWake �
WdActionMarkHiberPhase ���J t ]" _WATCHDOG_HANDLER_ACTION .?AW4_WATCHDOG_HANDLER_ACTION@@ ��� ^" 2
F � _SECURITY_DESCRIPTOR .?AU_SECURITY_DESCRIPTOR@@ ��
`"
� & � _ACL .?AU_ACL@@ ��
b"
� z
Revision �
Sbz1 �
! Control ��
Owner
Group
c" Sacl �
c" Dacl �F d" _SECURITY_DESCRIPTOR .?AU_SECURITY_DESCRIPTOR@@ �� e" � J � _PERFINFO_CCSWAP_BUFFER .?AU_PERFINFO_CCSWAP_BUFFER@@
g"
� p " �R
FirstTimeStamp ���
� TidTable �
i" H ThreadBasePriority ���J j" X _PERFINFO_CCSWAP_BUFFER .?AU_PERFINFO_CCSWAP_BUFFER@@ k" � � ^ � _PERFINFO_CC_EXTRA_WB_THREAD_INFO .?AU_PERFINFO_CC_EXTRA_WB_THREAD_INFO@@ �
" ThreadAction �
" ActiveExtraWBThreads �
" TotalDirtyPages ��
" DirtyPageThreshold ���
" AvailablePages ���^ n" _PERFINFO_CC_EXTRA_WB_THREAD_INFO .?AU_PERFINFO_CC_EXTRA_WB_THREAD_INFO@@ o" � V � _PERFINFO_CC_WORKITEM_ENQUEUE .?AU_PERFINFO_CC_WORKITEM_ENQUEUE@@
q"
� �
" WorkItemKey ��
" FileObjectKey
QueueType
WorkItemType �
Requeue ��
Reserved �V s" _PERFINFO_CC_WORKITEM_ENQUEUE .?AU_PERFINFO_CC_WORKITEM_ENQUEUE@@ t" � � b � _MEMORY_PARTITION_NODE_INFORMATION .?AU_MEMORY_PARTITION_NODE_INFORMATION@@ ��
�
� J
" NumaNodeCount
" Flags
w" NodePageInformation ��b x" _MEMORY_PARTITION_NODE_INFORMATION .?AU_MEMORY_PARTITION_NODE_INFORMATION@@ �� y" � R � _WMI_IMAGEID_INFORMATION32 .?AU_WMI_IMAGEID_INFORMATION32@@ ��z
u ImageBase32 ��
u ImageSize32 ��
" ProcessId
" TimeDateStamp
OriginalFileName �R |" _WMI_IMAGEID_INFORMATION32 .?AU_WMI_IMAGEID_INFORMATION32@@ �� }" � � N � _PROCESS_LEAP_SECOND_INFO .?AU_PROCESS_LEAP_SECOND_INFO@@ &
" Flags
" Reserved �N �" _PROCESS_LEAP_SECOND_INFO .?AU_PROCESS_LEAP_SECOND_INFO@@ �" 1 � F � _KEY_FULL_INFORMATION .?AU_KEY_FULL_INFORMATION@@
�"
�
} LastWriteTime
" TitleIndex ���
" ClassOffset ��
" ClassLength ��
" SubKeys ��
" MaxNameLen ���
" MaxClassLen ��
" Values ���
" $ MaxValueNameLen ��
" ( MaxValueDataLen ��
, Class F �" 0 _KEY_FULL_INFORMATION .?AU_KEY_FULL_INFORMATION@@ �" � � J � _ETW_OBJECT_TYPE_EVENT .?AU_ETW_OBJECT_TYPE_EVENT@@ ��>
! ObjectType ���
! Reserved �
Name �J �" _ETW_OBJECT_TYPE_EVENT .?AU_ETW_OBJECT_TYPE_EVENT@@ �� �" � c
2 � tagEVENTMSG .?AUtagEVENTMSG@@ ^
u message ��
u paramL ���
u paramH ���
" time �
y hwnd �2 �" tagEVENTMSG .?AUtagEVENTMSG@@ �" !
�
� F
lfHeight �
lfWidth ��
lfEscapement �
lfOrientation
lfWeight �
lfItalic �
lfUnderline ��
lfStrikeOut ��
lfCharSet
lfOutPrecision ���
lfClipPrecision ��
lfQuality
lfPitchAndFamily �
� lfFaceName ���2 �" \ tagLOGFONTW .?AUtagLOGFONTW@@ �" � V � _HEAP_AFINITY_MANAGER_ENABLE .?AU_HEAP_AFINITY_MANAGER_ENABLE@@ ��F
� Header ���
HeapHandle ���
" $ BucketIndex ��V �" ( _HEAP_AFINITY_MANAGER_ENABLE .?AU_HEAP_AFINITY_MANAGER_ENABLE@@ �� �" � g J � _POWER_SESSION_TIMEOUTS .?AU_POWER_SESSION_TIMEOUTS@@
�"
� 6
" InputTimeout �
" DisplayTimeout ���J �" _POWER_SESSION_TIMEOUTS .?AU_POWER_SESSION_TIMEOUTS@@ �" �
[
� J � tagEMREXTSELECTCLIPRGN .?AUtagEMREXTSELECTCLIPRGN@@ ��J
emr ��
" cbRgnData
" iMode
K RgnData ��J �" tagEMREXTSELECTCLIPRGN .?AUtagEMREXTSELECTCLIPRGN@@ �� �" � B � tagEMRSETMITERLIMIT .?AUtagEMRSETMITERLIMIT@@ *
emr ��
@ eMiterLimit ��B �" tagEMRSETMITERLIMIT .?AUtagEMRSETMITERLIMIT@@ �" q R � _WMI_IMAGEID_INFORMATION64 .?AU_WMI_IMAGEID_INFORMATION64@@ ��z
# ImageBase64 ��
# ImageSize64 ��
" ProcessId
" TimeDateStamp
OriginalFileName �R �" _WMI_IMAGEID_INFORMATION64 .?AU_WMI_IMAGEID_INFORMATION64@@ �� �" � � J � _CSV_QUERY_MDS_PATH_V2 .?AU_CSV_QUERY_MDS_PATH_V2@@ �� CsvFsDiskConnectivityNone CsvFsDiskConnectivityMdsNodeOnly � CsvFsDiskConnectivitySubsetOfNodes ��� CsvFsDiskConnectivityAllNodes J t �" _CSVFS_DISK_CONNECTIVITY .?AW4_CSVFS_DISK_CONNECTIVITY@@ ��� �" � �
Version ��
" RequiredSize �
" MdsNodeId
" DsNodeId �
" Flags
�" DiskConnectivity �
� VolumeId �
" , IpAddressOffset ��
" 0 IpAddressLength ��
" 4 PathOffset ���
" 8 PathLength ���J �" @ _CSV_QUERY_MDS_PATH_V2 .?AU_CSV_QUERY_MDS_PATH_V2@@ �� �" � 6 � _TOKEN_ORIGIN .?AU_TOKEN_ORIGIN@@ &
I OriginatingLogonSession ��6 �" _TOKEN_ORIGIN .?AU_TOKEN_ORIGIN@@ �" ^ ��ConfigurationSpaceUndefined � Cmos � EisaConfiguration Pos �� CbusConfiguration PCIConfiguration � VMEConfiguration � NuBusConfiguration ��� PCMCIAConfiguration �� MPIConfiguration � MPSAConfiguration
PNPISAConfiguration �� SgiInternalConfiguration � MaximumBusDataType ���6 t �" _BUS_DATA_TYPE .?AW4_BUS_DATA_TYPE@@ ��� �" �+
�"
� B � _MEMORY_RANGE_ENTRY .?AU_MEMORY_RANGE_ENTRY@@ 6
VirtualAddress ���
" NumberOfBytes B �" _MEMORY_RANGE_ENTRY .?AU_MEMORY_RANGE_ENTRY@@ �" ? � : � tagCWPRETSTRUCT .?AUtagCWPRETSTRUCT@@
�"
� b
lResult ��
lParam ���
u wParam ���
u message ��
y hwnd �: �" tagCWPRETSTRUCT .?AUtagCWPRETSTRUCT@@ �" 9 v � _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION .?AU_TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION@@ ��&
SuperiorEnlistmentPair ���v �" _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION .?AU_TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION@@ �� �" � V � _SYSTEM_KERNEL_DEBUGGER_FLAGS .?AU_SYSTEM_KERNEL_DEBUGGER_FLAGS@@ .
KernelDebuggerIgnoreUmExceptions �V �" _SYSTEM_KERNEL_DEBUGGER_FLAGS .?AU_SYSTEM_KERNEL_DEBUGGER_FLAGS@@ �" � J PowerMonitorOff �� PowerMonitorOn ��� PowerMonitorDim ��F t �" _MONITOR_DISPLAY_STATE .?AW4_MONITOR_DISPLAY_STATE@@ ��� �" �
�"
� b � _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER .?AU_ETW_TP_EVENT_TIMER_CANCEL_NTTIMER@@ ��*
� Header ���
SubQueue �b �" $ _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER .?AU_ETW_TP_EVENT_TIMER_CANCEL_NTTIMER@@ �� �" � / n � _JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2@@ r
" LimitFlags ���
" ViolationLimitFlags ��
# IoReadBytes ��
# IoReadBytesLimit �
# IoWriteBytes �
# IoWriteBytesLimit
} ( PerJobUserTime ���
} 0 PerJobUserTimeLimit ��
# 8 JobMemory
# @ JobLowMemoryLimit
# H JobHighMemoryLimit ���
� P RateControlTolerance �
� T RateControlToleranceLimit n
�" X _JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2@@ �" a � J � _SE_SECURITY_DESCRIPTOR .?AU_SE_SECURITY_DESCRIPTOR@@ B
" Size �
" Flags
SecurityDescriptor ���J �" _SE_SECURITY_DESCRIPTOR .?AU_SE_SECURITY_DESCRIPTOR@@ �" � V � _SERVICE_PREFERRED_NODE_INFO .?AU_SERVICE_PREFERRED_NODE_INFO@@ ��
�"
� 2
! usPreferredNode ��
fDelete ��V �" _SERVICE_PREFERRED_NODE_INFO .?AU_SERVICE_PREFERRED_NODE_INFO@@ �� �" 3 �
�
� N � _PROCESS_HEAP_INFORMATION .?AU_PROCESS_HEAP_INFORMATION@@
�"
� r
" ReserveSize ��
" CommitSize ���
" NumberOfHeaps
" FirstHeapInformationOffset ���N �" _PROCESS_HEAP_INFORMATION .?AU_PROCESS_HEAP_INFORMATION@@ �" L � V � _TEB_ACTIVE_FRAME_CONTEXT_EX .?AU_TEB_ACTIVE_FRAME_CONTEXT_EX@@ ��6
k BasicContext �
� SourceLocation ���V �" _TEB_ACTIVE_FRAME_CONTEXT_EX .?AU_TEB_ACTIVE_FRAME_CONTEXT_EX@@ �� �" � B � _WMI_BUFFER_HEADER .?AU_WMI_BUFFER_HEADER@@ ��
# ��
# =��
�"
� : � _ETW_REF_CLOCK .?AU_ETW_REF_CLOCK@@ ���
" BufferSize ���
" SavedOffset ��
M CurrentOffset
ReferenceCount ���
} TimeStamp
SequenceNumber ���
�" ClockType
�" Frequency
SlistEntry ���
�" NextBuffer ���
� ( ClientContext
� , State
" 0 Offset ���
! 4 BufferFlag ���
! 6 BufferType ���
� 8 Padding1 �
�" 8 ReferenceTime
� 8 GlobalEntry ��
8 Pointer0 �
< Pointer1 �B �" H _WMI_BUFFER_HEADER .?AU_WMI_BUFFER_HEADER@@ �� �" � � J � _RPC_SECURITY_QOS_V3_W .?AU_RPC_SECURITY_QOS_V3_W@@ ��
HttpCredentials ��2 �" <anonymous-tag> .?AT<anonymous-tag>@@ �" � . �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
�" u
Sid ��J �" _RPC_SECURITY_QOS_V3_W .?AU_RPC_SECURITY_QOS_V3_W@@ �� �" � ' J � _RTL_MODULE_BASIC_INFO .?AU_RTL_MODULE_BASIC_INFO@@ ��
�"
�
ImageBase J �" _RTL_MODULE_BASIC_INFO .?AU_RTL_MODULE_BASIC_INFO@@ �� �" u � > � _WMI_TRACE_PACKET .?AU_WMI_TRACE_PACKET@@ F
! Size �
! HookId ���
Type �
Group > �" _WMI_TRACE_PACKET .?AU_WMI_TRACE_PACKET@@ �" �
&
� & DISPLAYCONFIG_SCALING_IDENTITY ��� DISPLAYCONFIG_SCALING_CENTERED ��� DISPLAYCONFIG_SCALING_STRETCHED �� DISPLAYCONFIG_SCALING_ASPECTRATIOCENTEREDMAX � DISPLAYCONFIG_SCALING_CUSTOM � � DISPLAYCONFIG_SCALING_PREFERRED �� ��DISPLAYCONFIG_SCALING_FORCE_UINT32 ��B t # DISPLAYCONFIG_SCALING .?AW4DISPLAYCONFIG_SCALING@@ � # 6 > ProcessMemoryPriority ProcessMemoryExhaustionInfo �� ProcessAppMemoryInfo � ProcessInPrivateInfo � ProcessPowerThrottling ��� ProcessReservedValue1 ProcessTelemetryCoverageInfo � ProcessProtectionLevelInfo ��� ProcessLeapSecondInfo ProcessInformationClassMax ���N
t # _PROCESS_INFORMATION_CLASS .?AW4_PROCESS_INFORMATION_CLASS@@ ��� # 1 � � � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION@@ �� m " 0 �:
# OverallChangeStamp ���
# Descriptors ��
# 8 _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION@@ �� # � 6 � _MUICCHEADER .?AU_MUICCHEADER@@ ���
u ulMaxStringsSize �
u ulSizeStrings
u ulMaxNumInstalledCultures
u ulNumInstalledCultures ���
u ulMaxNumUnverifiedCultures ���
u ulNumUnverifiedCultures ��6 # _MUICCHEADER .?AU_MUICCHEADER@@ �� # � j � _EVENT_TRACE_PROFILE_REMOVE_INFORMATION .?AU_EVENT_TRACE_PROFILE_REMOVE_INFORMATION@@ ^
� EventTraceInformationClass ���
� ProfileSource
� CpuInfoHierarchy �j # _EVENT_TRACE_PROFILE_REMOVE_INFORMATION .?AU_EVENT_TRACE_PROFILE_REMOVE_INFORMATION@@ # � � *
� Linkage ��
" Signature V # _RTL_DYNAMIC_HASH_TABLE_ENTRY .?AU_RTL_DYNAMIC_HASH_TABLE_ENTRY@@ # ( N � _OBJECT_NAME_INFORMATION .?AU_OBJECT_NAME_INFORMATION@@ ��
#
�
� Name �N # _OBJECT_NAME_INFORMATION .?AU_OBJECT_NAME_INFORMATION@@ �� # � N v � _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION .?AU_SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION@@
#
� ^ � _QUERY_PERFORMANCE_COUNTER_FLAGS .?AU_QUERY_PERFORMANCE_COUNTER_FLAGS@@ ��>
" Version ��
# Flags
# ValidFlags ���v # _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION .?AU_SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION@@ !# �
�
� F � _IO_ERROR_LOG_PACKET .?AU_IO_ERROR_LOG_PACKET@@ ��B
MajorFunctionCode
RetryCount ���
! DumpDataSize �
! NumberOfStrings ��
! StringOffset �
! EventCategory
ErrorCode
" UniqueErrorValue �
FinalStatus ��
" SequenceNumber ���
" IoControlCode
} DeviceOffset �
� ( DumpData �F
%# 0 _IO_ERROR_LOG_PACKET .?AU_IO_ERROR_LOG_PACKET@@ ��* onecore\internal\sdk\inc\ntiolog.h � &# '# / J � _RTL_CRITICAL_SECTION32 .?AU_RTL_CRITICAL_SECTION32@@
)#
� �
" DebugInfo
LockCount
RecursionCount ���
" OwningThread �
" LockSemaphore
" SpinCount J +# _RTL_CRITICAL_SECTION32 .?AU_RTL_CRITICAL_SECTION32@@ ,# L � ~ HardwareProfileChangeEvent ��� TargetDeviceChangeEvent �� DeviceClassChangeEvent ��� CustomDeviceEvent DeviceInstallEvent ��� DeviceArrivalEvent ��� VetoEvent BlockedDriverEvent ��� InvalidIDEvent ��� DevicePropertyChangeEvent
DeviceInstanceRemovalEvent ��� DeviceInstanceStartedEvent ��� MaxPlugEventCategory �J
t .# _PLUGPLAY_EVENT_CATEGORY .?AW4_PLUGPLAY_EVENT_CATEGORY@@ ��� /# � / :
! Group
Number ���
Reserved �> 1# _PROCESSOR_NUMBER .?AU_PROCESSOR_NUMBER@@ 2# J � _FILE_LAYOUT_INFO_ENTRY .?AU_FILE_LAYOUT_INFO_ENTRY@@
4#
� �
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
" FileAttributes ���: 6# ( <anonymous-tag> .?AU<anonymous-tag>@@ 7# � v
7# BasicInformation �
" ( OwnerId ��
" , SecurityId ���
0 Usn ��
� 8 StorageReserveId �J 9# @ _FILE_LAYOUT_INFO_ENTRY .?AU_FILE_LAYOUT_INFO_ENTRY@@ :# � b � _PERFINFO_HARDPAGEFAULT_INFORMATION .?AU_PERFINFO_HARDPAGEFAULT_INFORMATION@@
<#
� v
} ReadOffset ���
VirtualAddress ���
FileObject ���
" ThreadId �
" ByteCount b ># _PERFINFO_HARDPAGEFAULT_INFORMATION .?AU_PERFINFO_HARDPAGEFAULT_INFORMATION@@ ?# � M ^ � _JOBOBJECT_BASIC_PROCESS_ID_LIST .?AU_JOBOBJECT_BASIC_PROCESS_ID_LIST@@ ��
A#
� " " �b
" NumberOfAssignedProcesses
" NumberOfProcessIdsInList �
C# ProcessIdList ^ D# _JOBOBJECT_BASIC_PROCESS_ID_LIST .?AU_JOBOBJECT_BASIC_PROCESS_ID_LIST@@ �� E# C � B � tagWNODE_TOO_SMALL .?AUtagWNODE_TOO_SMALL@@ ��
G#
� 2
5 WnodeHeader ��
" 0 SizeNeeded ���B I# 8 tagWNODE_TOO_SMALL .?AUtagWNODE_TOO_SMALL@@ �� J# 8 " � QUERY_FILE_LAYOUT_FILTER_TYPE_NONE ��� QUERY_FILE_LAYOUT_FILTER_TYPE_CLUSTERS ��� QUERY_FILE_LAYOUT_FILTER_TYPE_FILEID � QUERY_FILE_LAYOUT_FILTER_TYPE_STORAGE_RESERVE_ID � QUERY_FILE_LAYOUT_NUM_FILTER_TYPES ���V t L# _QUERY_FILE_LAYOUT_FILTER_TYPE .?AW4_QUERY_FILE_LAYOUT_FILTER_TYPE@@ ��� M# � j PsNeverDuplicate � PsRequestDuplicate ��� PsAlwaysDuplicate PsMaxStdHandleStates �B t O# _PS_STD_HANDLE_STATE .?AW4_PS_STD_HANDLE_STATE@@ ��� P# a F � SeImageSignatureNone � SeImageSignatureEmbedded � SeImageSignatureCache SeImageSignatureCatalogCached SeImageSignatureCatalogNotCached � SeImageSignatureCatalogHint �� SeImageSignaturePackageCatalog ���J t R# _SE_IMAGE_SIGNATURE_TYPE .?AW4_SE_IMAGE_SIGNATURE_TYPE@@ ��� S# �
> � _VIDEOPARAMETERS .?AU_VIDEOPARAMETERS@@ ��
U#
� 2
� Guid �
" dwOffset �
" dwCommand
" dwFlags ��
" dwMode ���
" dwTVStandard �
" $ dwAvailableModes �
" ( dwAvailableTVStandard
" , dwFlickerFilter ��
" 0 dwOverScanX ��
" 4 dwOverScanY ��
" 8 dwMaxUnscaledX ���
" < dwMaxUnscaledY ���
" @ dwPositionX ��
" D dwPositionY ��
" H dwBrightness �
" L dwContrast ���
" P dwCPType �
" T dwCPCommand ��
" X dwCPStandard �
" \ dwCPKey ��
" ` bCP_APSTriggerBits ���
� d bOEMCopyProtection ���> W# d_VIDEOPARAMETERS .?AU_VIDEOPARAMETERS@@ ��* onecore\external\shared\inc\tvout.h X# Y# V IMPORT_OBJECT_CODE ��� IMPORT_OBJECT_DATA ��� IMPORT_OBJECT_CONST ��> t [# IMPORT_OBJECT_TYPE .?AW4IMPORT_OBJECT_TYPE@@ ��� \# [ �
"
� > � _SYSDBG_IO_SPACE .?AU_SYSDBG_IO_SPACE@@ ��
# Address ��
Buffer ���
" Request ��
� InterfaceType
" BusNumber
" AddressSpace �> `# _SYSDBG_IO_SPACE .?AU_SYSDBG_IO_SPACE@@ �� a# V � STARTING_LCN_INPUT_BUFFER_EX .?AUSTARTING_LCN_INPUT_BUFFER_EX@@ ��
c#
� *
} StartingLcn ��
" Flags V e# STARTING_LCN_INPUT_BUFFER_EX .?AUSTARTING_LCN_INPUT_BUFFER_EX@@ �� f# ;
R � _SECURITY_OBJECT_AI_PARAMS .?AU_SECURITY_OBJECT_AI_PARAMS@@ ��.
" Size �
" ConstraintMask ���R i# _SECURITY_OBJECT_AI_PARAMS .?AU_SECURITY_OBJECT_AI_PARAMS@@ �� j# J � _RTL_CONDITION_VARIABLE .?AU_RTL_CONDITION_VARIABLE@@
l#
�
" ��
" ��J
n# WakeCount
o# Waking ���
" Value
Ptr ��J p# _RTL_CONDITION_VARIABLE .?AU_RTL_CONDITION_VARIABLE@@ q# L <
X
� B � _IMAGE_POLICY_ENTRY .?AU_IMAGE_POLICY_ENTRY@@
t# ��
u#
� s# v# w#
x#
� J � _REPARSE_DATA_BUFFER_EX .?AU_REPARSE_DATA_BUFFER_EX@@ N � _REPARSE_GUID_DATA_BUFFER .?AU_REPARSE_GUID_DATA_BUFFER@@ �
" Flags
" ExistingReparseTag ���
� ExistingReparseGuid ��
# Reserved �
ReparseDataBuffer
{# ReparseGuidDataBuffer J |# @ _REPARSE_DATA_BUFFER_EX .?AU_REPARSE_DATA_BUFFER_EX@@ }# C&
�"
� B � _IO_STATUS_BLOCK32 .?AU_IO_STATUS_BLOCK32@@ ��.
Status ���
" Information ��B �# _IO_STATUS_BLOCK32 .?AU_IO_STATUS_BLOCK32@@ �� �# � > � tagNEWTEXTMETRICW .?AUtagNEWTEXTMETRICW@@
�#
� F
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
q , tmFirstChar ��
q . tmLastChar ���
q 0 tmDefaultChar
q 2 tmBreakChar ��
4 tmItalic �
5 tmUnderlined �
6 tmStruckOut ��
7 tmPitchAndFamily �
8 tmCharSet
" < ntmFlags �
u @ ntmSizeEM
u D ntmCellHeight
u H ntmAvgWidth ��> �# L tagNEWTEXTMETRICW .?AUtagNEWTEXTMETRICW@@ �# �
q
� >
" LowPart ��
High1Time
High2Time 6 �# _KSYSTEM_TIME .?AU_KSYSTEM_TIME@@ �# � /
p
� F � _ENUM_SERVICE_STATUSA .?AU_ENUM_SERVICE_STATUSA@@
�#
� J
p lpServiceName
p lpDisplayName
ServiceStatus F �# $ _ENUM_SERVICE_STATUSA .?AU_ENUM_SERVICE_STATUSA@@ �# 3 � 6 � tagWINDOWINFO .?AUtagWINDOWINFO@@ �
" cbSize ���
� rcWindow �
� rcClient �
" $ dwStyle ��
" ( dwExStyle
" , dwWindowStatus ���
u 0 cxWindowBorders ��
u 4 cyWindowBorders ��
! 8 atomWindowType ���
! : wCreatorVersion ��6
�# < tagWINDOWINFO .?AUtagWINDOWINFO@@ �# �8 B � _TOKEN_DEFAULT_DACL .?AU_TOKEN_DEFAULT_DACL@@
c" DefaultDacl ��B �# _TOKEN_DEFAULT_DACL .?AU_TOKEN_DEFAULT_DACL@@ �# � " �
�#
�
A
�
j
� B WorkerFactoryTimeout � WorkerFactoryRetryTimeout WorkerFactoryIdleTimeout � WorkerFactoryBindingCount WorkerFactoryThreadMinimum ��� WorkerFactoryThreadMaximum ��� WorkerFactoryPaused �� WorkerFactoryBasicInformation WorkerFactoryAdjustThreadGoal WorkerFactoryCallbackType
WorkerFactoryStackInformation WorkerFactoryThreadBasePriority �� WorkerFactoryTimeoutWaiters ��
WorkerFactoryFlags ��� WorkerFactoryThreadSoftMaximum ��� WorkerFactoryThreadCpuSets ��� MaxWorkerFactoryInfoClass F t �# _WORKERFACTORYINFOCLASS .?AW4_WORKERFACTORYINFOCLASS@@ � �# � � ResponseReturnToCaller ��� ResponseNotHandled ��� ResponseAbort ResponseCancel ��� ResponseIgnore ��� ResponseNo ��� ResponseOk ��� ResponseRetry ResponseYes �� ResponseTryAgain �
ResponseContinue �> t �# _HARDERROR_RESPONSE .?AW4_HARDERROR_RESPONSE@@ � �# � B � tagLOCALESIGNATURE .?AUtagLOCALESIGNATURE@@ ��
�#
� " " � " " �F
�# lsUsb
�# lsCsbDefault �
�# lsCsbSupported ���B �# tagLOCALESIGNATURE .?AUtagLOCALESIGNATURE@@ �� �# � � MemoryNotContiguous �� MemoryAlignedAndContiguous ��� MemoryNotResident MemoryNotEligibleToMakeContiguous MemoryContiguityStateMax �f t �# _MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE .?AW4_MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE@@ ��� �# � R DCDC_DEFAULT � DCDC_DISABLE_FONT_UPDATE � DCDC_DISABLE_RELAYOUT ^ t �# DIALOG_CONTROL_DPI_CHANGE_BEHAVIORS .?AW4DIALOG_CONTROL_DPI_CHANGE_BEHAVIORS@@ � �# � N � _SERVICE_TIMECHANGE_INFO .?AU_SERVICE_TIMECHANGE_INFO@@ ��*
} liNewTime
} liOldTime N �# _SERVICE_TIMECHANGE_INFO .?AU_SERVICE_TIMECHANGE_INFO@@ �� �# 3 � 6 � tagCURSORINFO .?AUtagCURSORINFO@@ * � HICON__ .?AUHICON__@@
�#
� R
" cbSize ���
" flags
�# hCursor ��
x ptScreenPos ��6 �# tagCURSORINFO .?AUtagCURSORINFO@@ �# �8 � DISPLAYCONFIG_ROTATION_IDENTITY �� DISPLAYCONFIG_ROTATION_ROTATE90 �� DISPLAYCONFIG_ROTATION_ROTATE180 � DISPLAYCONFIG_ROTATION_ROTATE270 � ��DISPLAYCONFIG_ROTATION_FORCE_UINT32 �F t �# DISPLAYCONFIG_ROTATION .?AW4DISPLAYCONFIG_ROTATION@@ ��� �# A j � _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 .?AU_KEY_VALUE_PARTIAL_INFORMATION_ALIGN64@@ ��
�#
� :
" Type �
" DataLength ���
| Data �j �# _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 .?AU_KEY_VALUE_PARTIAL_INFORMATION_ALIGN64@@ �� �# � ` TimerBasicInformation J t �# _TIMER_INFORMATION_CLASS .?AW4_TIMER_INFORMATION_CLASS@@ ��� �# � N � _FSCTL_UNMAP_SPACE_OUTPUT .?AU_FSCTL_UNMAP_SPACE_OUTPUT@@
} BytesUnmapped N �# _FSCTL_UNMAP_SPACE_OUTPUT .?AU_FSCTL_UNMAP_SPACE_OUTPUT@@ �# �* Z � _ETW_TP_EVENT_CALLBACK_ENQUEUE .?AU_ETW_TP_EVENT_CALLBACK_ENQUEUE@@ ��
�#
� ~
� Header ���
PoolId ���
$ TaskId ���
( Callback �
, Context ��
0 SubProcessTag Z �# 8 _ETW_TP_EVENT_CALLBACK_ENQUEUE .?AU_ETW_TP_EVENT_CALLBACK_ENQUEUE@@ �� �# � � ^ � _SYSTEM_DPC_BEHAVIOR_INFORMATION .?AU_SYSTEM_DPC_BEHAVIOR_INFORMATION@@ ��~
" Spare
" DpcQueueDepth
" MinimumDpcRate ���
" AdjustDpcThreshold ���
" IdealDpcRate �^ �# _SYSTEM_DPC_BEHAVIOR_INFORMATION .?AU_SYSTEM_DPC_BEHAVIOR_INFORMATION@@ �� �# �
�
� B
" NodeNumber ���
b Reserved �
� GroupMask J �# $ _NUMA_NODE_RELATIONSHIP .?AU_NUMA_NODE_RELATIONSHIP@@ �# { % N � _POOLED_USAGE_AND_LIMITS .?AU_POOLED_USAGE_AND_LIMITS@@ ��
" PeakPagedPoolUsage ���
" PagedPoolUsage ���
" PagedPoolLimit ���
" PeakNonPagedPoolUsage
" NonPagedPoolUsage
" NonPagedPoolLimit
" PeakPagefileUsage
" PagefileUsage
" PagefileLimit N �# $ _POOLED_USAGE_AND_LIMITS .?AU_POOLED_USAGE_AND_LIMITS@@ �� �# C l 6 � _ETW_UMGL_KEY .?AU_ETW_UMGL_KEY@@ &
LoggerId �
Flags 6 �# _ETW_UMGL_KEY .?AU_ETW_UMGL_KEY@@ �# � R R � _PERFINFO_CC_CAN_WRITE_FAIL .?AU_PERFINFO_CC_CAN_WRITE_FAIL@@ n
" FileObjectKey
" TotalDirtyPages ��
" DirtyPageThreshold ���
" BytesToWrite �R �# _PERFINFO_CC_CAN_WRITE_FAIL .?AU_PERFINFO_CC_CAN_WRITE_FAIL@@ �# � � V � _ETW_TP_EVENT_POOL_TH_MAX_SET .?AU_ETW_TP_EVENT_POOL_TH_MAX_SET@@ >
� Header ���
PoolId ���
" $ ThreadNum V �# ( _ETW_TP_EVENT_POOL_TH_MAX_SET .?AU_ETW_TP_EVENT_POOL_TH_MAX_SET@@ �# � � " P ��
" ControlWord ��
" StatusWord ���
" TagWord ��
" ErrorOffset ��
" ErrorSelector
" DataOffset ���
" DataSelector �
�# RegisterArea �
" l Cr0NpxState ��N �# p _WOW64_FLOATING_SAVE_AREA .?AU_WOW64_FLOATING_SAVE_AREA@@ �# B V � _PERFINFO_PPM_STATE_SELECTION .?AU_PERFINFO_PPM_STATE_SELECTION@@
�#
� J
" SelectedState
" VetoedStates �
� VetoReason ���V �# _PERFINFO_PPM_STATE_SELECTION .?AU_PERFINFO_PPM_STATE_SELECTION@@ �# � ,
�
� "
cx ���
cy ���* �# tagSIZE .?AUtagSIZE@@ �# � J � _RTL_SPARSE_BITMAP_RUN .?AU_RTL_SPARSE_BITMAP_RUN@@ ��
�#
� b
" StartingIndexLow �
" StartingIndexHigh
" Length ���
Metadata �J �# _RTL_SPARSE_BITMAP_RUN .?AU_RTL_SPARSE_BITMAP_RUN@@ �� �# � �
l
� R � IMAGE_AUX_SYMBOL_TOKEN_DEF .?AUIMAGE_AUX_SYMBOL_TOKEN_DEF@@ ��
�#
� ^
bAuxType �
bReserved
" SymbolTableIndex �
� rgbReserved ��R �# IMAGE_AUX_SYMBOL_TOKEN_DEF .?AUIMAGE_AUX_SYMBOL_TOKEN_DEF@@ �� �# [ J � _RTL_RETPOLINE_ROUTINES .?AU_RTL_RETPOLINE_ROUTINES@@ �
" UnwindDataOffset �
� SwitchtableJump ��
" D CfgIndirectRax ���
" H NonCfgIndirectRax
" L ImportR10 J $ P _RTL_RETPOLINE_ROUTINES .?AU_RTL_RETPOLINE_ROUTINES@@ $ � X J � _REG_NOTIFY_INFORMATION .?AU_REG_NOTIFY_INFORMATION@@ : KeyAdded � KeyRemoved ��� KeyModified ��. t $ _REG_ACTION .?AW4_REG_ACTION@@ � $ 3 b V
" NextEntryOffset ��
$ Action ���
" KeyLength
Key ��J $ _REG_NOTIFY_INFORMATION .?AU_REG_NOTIFY_INFORMATION@@ $ 3 h N LowMemoryResourceNotification HighMemoryResourceNotification ���^ t $ _MEMORY_RESOURCE_NOTIFICATION_TYPE .?AW4_MEMORY_RESOURCE_NOTIFICATION_TYPE@@ ��� $ � F � _RTL_DISK_SPACE_INFO .?AU_RTL_DISK_SPACE_INFO@@ ��
$
� � RtlDiskSpacePolicyVeryLow
RtlDiskSpacePolicyLow RtlDiskSpacePolicyBelowNormal RtlDiskSpacePolicyNormal �B t $ RTL_DISK_SPACE_POLICY .?AW4RTL_DISK_SPACE_POLICY@@ � $ � '
$ Policy ���F $ _RTL_DISK_SPACE_INFO .?AU_RTL_DISK_SPACE_INFO@@ �� $ � . ^ � _ETW_PARTITION_INFO_EXTENSION_V2 .?AU_ETW_PARTITION_INFO_EXTENSION_V2@@ ��b
! EventVersion �
! Reserved �
" PartitionType
} QpcOffsetFromRoot ^ $ _ETW_PARTITION_INFO_EXTENSION_V2 .?AU_ETW_PARTITION_INFO_EXTENSION_V2@@ �� $ � � 6 � tagSTYLEBUFA .?AUtagSTYLEBUFA@@ ��.
" dwStyle ��
�! szDescription 6 $ $ tagSTYLEBUFA .?AUtagSTYLEBUFA@@ �� $ E � � RtlRXactOperationDelete �� RtlRXactOperationSetValue RtlRXactOperationDelAttribute RtlRXactOperationSetAttribute B t $ _RTL_RXACT_OPERATION .?AW4_RTL_RXACT_OPERATION@@ ��� $ L � j MonitorRequestTypeOff MonitorRequestTypeOnAndPresent ��� MonitorRequestTypeToggleOn ���N t !$ _POWER_MONITOR_REQUEST_TYPE .?AW4_POWER_MONITOR_REQUEST_TYPE@@ � "$ N J � _CI_LOG_SCHEDULER_EVENT .?AU_CI_LOG_SCHEDULER_EVENT@@ f
� Header ���
" 0 ProcessId
" 4 ThreadId �
" 8 Priority �
" < TaskIndex J %$ @ _CI_LOG_SCHEDULER_EVENT .?AU_CI_LOG_SCHEDULER_EVENT@@ &$ � B 2 � _WOW64INFO .?AU_WOW64INFO@@ ��V � _ETW_COVERAGE_SAMPLER_OPTIONS .?AU_ETW_COVERAGE_SAMPLER_OPTIONS@@ q " �
� Flags
" HashSeed �
" ImageLruSize �
" SampleTableMinEntries
" SampleTableMaxEntries
" SampleTableMaxQueued �
" SampleBufferSize �
" SampleBufferMaxCountPerProc ��
" CaptureBufferMaxCountPerProc �
" $ ApcMaxCountPerProc ���
" ( ProfileSamplePeriodUS
" , ProfileSampleCountPerPeriod ��
" 0 CSwitchSamplePeriodUS
" 4 CSwitchSampleCountPerPeriod ��
" 8 RThreadSamplePeriodUS
" < RThreadSampleCountPerPeriod ��
" @ PGFaultSamplePeriodUS
" D PGFaultSampleCountPerPeriod ��
" H StackDepth ���
" L StackCacheEntries
*$ P PathInclusionList
*$ PPathExclusionList V +$ P_ETW_COVERAGE_SAMPLER_OPTIONS .?AU_ETW_COVERAGE_SAMPLER_OPTIONS@@ ,$ �
5"
� F � _WMI_DELAY_EXECUTION .?AU_WMI_DELAY_EXECUTION@@ ��&
" ThreadId �
# Delta F 0$ _WMI_DELAY_EXECUTION .?AU_WMI_DELAY_EXECUTION@@ �� 1$ � �
� Z � _ALPC_PORT_CALLBACK_INFORMATION .?AU_ALPC_PORT_CALLBACK_INFORMATION@@ 2
CallbackObject ���
Context ��Z 5$ _ALPC_PORT_CALLBACK_INFORMATION .?AU_ALPC_PORT_CALLBACK_INFORMATION@@ 6$ � , . � tagEMREOF .?AUtagEMREOF@@ V
emr ��
" nPalEntries ��
" offPalEntries
" nSizeLast . 9$ tagEMREOF .?AUtagEMREOF@@ :$ �
�
� N � _TOKEN_ACCESS_INFORMATION .?AU_TOKEN_ACCESS_INFORMATION@@
�
� > � _TOKEN_PRIVILEGES .?AU_TOKEN_PRIVILEGES@@
?$
� 2 TokenPrimary � TokenImpersonation ���. t A$ _TOKEN_TYPE .?AW4_TOKEN_TYPE@@ � B$ ! R
>$ SidHash ��
>$ RestrictedSidHash
@$ Privileges ���
I AuthenticationId �
B$ TokenType
� ImpersonationLevel ���
A MandatoryPolicy ��
" Flags
" $ AppContainerNumber ���
( PackageSid ���
>$ , CapabilitiesHash �
0 TrustLevelSid
4 SecurityAttributes ���N
D$ 8 _TOKEN_ACCESS_INFORMATION .?AU_TOKEN_ACCESS_INFORMATION@@ E$ � � KeyValueBasicInformation � KeyValueFullInformation �� KeyValuePartialInformation ��� KeyValueFullInformationAlign64 ��� KeyValuePartialInformationAlign64 KeyValueLayerInformation � MaxKeyValueInfoClass �R t G$ _KEY_VALUE_INFORMATION_CLASS .?AW4_KEY_VALUE_INFORMATION_CLASS@@ ��� H$ � r : � _RTL_AVL_TABLE .?AU_RTL_AVL_TABLE@@ ��
J$
� B � _RTL_BALANCED_LINKS .?AU_RTL_BALANCED_LINKS@@
L$
� J GenericLessThan �� GenericGreaterThan ��� GenericEqual �R t N$ _RTL_GENERIC_COMPARE_RESULTS .?AW4_RTL_GENERIC_COMPARE_RESULTS@@ ��� O$ ( O
J$
� Q$ O$ R$
S$
� Q$ " U$
V$
� Q$ X$
Y$
� .
L$ BalancedRoot �
OrderedPointer ���
" WhichOrderedElement ��
" NumberGenericTableElements ���
" DepthOfTree ��
M$ RestartKey ���
" $ DeleteCount ��
T$ ( CompareRoutine ���
W$ , AllocateRoutine ��
Z$ 0 FreeRoutine ��
4 TableContext �: [$ 8 _RTL_AVL_TABLE .?AU_RTL_AVL_TABLE@@ �� \$ ( � � ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_OTHER ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HD15 � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SVIDEO ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPOSITE_VIDEO �� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPONENT_VIDEO �� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DVI �� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HDMI � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_LVDS � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_D_JPN DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDI ��
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EXTERNAL � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EMBEDDED � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EXTERNAL �
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EMBEDDED � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDTVDONGLE ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_MIRACAST � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_WIRED ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_VIRTUAL � � �DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INTERNAL � ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_FORCE_UINT32 b t ^$ DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY .?AW4DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY@@ � _$ �
H
�
|
� F � _RTL_DISK_SPEED_INFO .?AU_RTL_DISK_SPEED_INFO@@ ��B
RtlDiskSpeedPolicyNormal � RtlDiskSpeedPolicyFast ���B t d$ RTL_DISK_SPEED_POLICY .?AW4RTL_DISK_SPEED_POLICY@@ � e$ �
e$ Policy ���F g$ _RTL_DISK_SPEED_INFO .?AU_RTL_DISK_SPEED_INFO@@ �� h$ � # � NotAppContainerSidType ��� ChildAppContainerSidType � ParentAppContainerSidType InvalidAppContainerSidType ��� MaxAppContainerSidType ���F t j$ _APPCONTAINER_SID_TYPE .?AW4_APPCONTAINER_SID_TYPE@@ ��� k$ ( �" ^ � _IO_COMPLETION_BASIC_INFORMATION .?AU_IO_COMPLETION_BASIC_INFORMATION@@ ��
Depth ^ n$ _IO_COMPLETION_BASIC_INFORMATION .?AU_IO_COMPLETION_BASIC_INFORMATION@@ �� o$ � C J � RETRIEVAL_POINTER_COUNT .?AURETRIEVAL_POINTER_COUNT@@
" ExtentCount ��J r$ RETRIEVAL_POINTER_COUNT .?AURETRIEVAL_POINTER_COUNT@@ s$ �
J � _ETW_READY_THREAD_EVENT .?AU_ETW_READY_THREAD_EVENT@@
��
��
��
��
��
" ThreadId �
AdjustReason �
p AdjustIncrement ��
v$ ExecutingDpc �
w$ KernelStackNotResident ���
x$ ProcessOutOfMemory ���
y$ DirectSwitchAttempt ��
z$ Reserved �
Flags
SpareByte J
{$ _ETW_READY_THREAD_EVENT .?AU_ETW_READY_THREAD_EVENT@@ |$ � �
�!
�
�
� *
� As32Bit ��
� As64Bit ��B �$ � _PEBS_DS_SAVE_AREA .?AU_PEBS_DS_SAVE_AREA@@ �� �$ � � PsWakeReasonUser � PsWakeReasonExecutionRequired PsWakeReasonKernel ��� PsWakeReasonInstrumentation �� PsWakeReasonPreserveProcess �� PsWakeReasonActivityReference PsWakeReasonWorkOnBehalf � PsMaxWakeReasons �6 t �$ _PS_WAKE_REASON .?AW4_PS_WAKE_REASON@@ � �$ a ^ � _ETW_COVERAGE_SAMPLER_CREATE_INFO .?AU_ETW_COVERAGE_SAMPLER_CREATE_INFO@@
�$
� b � _ETW_COVERAGE_SAMPLER_BLOOM_FILTER .?AU_ETW_COVERAGE_SAMPLER_BLOOM_FILTER@@ ��V
� Common ���
)$ Options ��
�$ `Bloom
# xSamplesReadyEvent ^ �$ �_ETW_COVERAGE_SAMPLER_CREATE_INFO .?AU_ETW_COVERAGE_SAMPLER_CREATE_INFO@@ �$ �
2
� . � tagEMRARC .?AUtagEMRARC@@ N
emr ��
� rclBox ���
I ptlStart �
I ptlEnd ���. �$ ( tagEMRARC .?AUtagEMRARC@@ �$ % : � _GRADIENT_RECT .?AU_GRADIENT_RECT@@ ��.
" UpperLeft
" LowerRight ���: �$ _GRADIENT_RECT .?AU_GRADIENT_RECT@@ �� �$ : ~ Width8Bits ��� Width16Bits �� Width32Bits �� Width64Bits �� WidthNoWrap �� MaximumDmaWidth ��. t �$ _DMA_WIDTH .?AW4_DMA_WIDTH@@ ��� �$ �+
�$
� ^ � _FILE_PIPE_CLIENT_PROCESS_BUFFER .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER@@ ��
�$
� 2
ClientSession
ClientProcess ^ �$ _FILE_PIPE_CLIENT_PROCESS_BUFFER .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER@@ �� �$ 1) J � _HEAP_RANGE_INFORMATION .?AU_HEAP_RANGE_INFORMATION@@ �
" Address ��
" Size �
" Type �
" Protection ���
" FirstBlockInformationOffset ��
" NextRangeInformationOffset ���J �$ _HEAP_RANGE_INFORMATION .?AU_HEAP_RANGE_INFORMATION@@ �$ L � f � _HEAP_OPTIMIZE_RESOURCES_INFORMATION .?AU_HEAP_OPTIMIZE_RESOURCES_INFORMATION@@ ��
�$
� &
" Version ��
" Flags f �$ _HEAP_OPTIMIZE_RESOURCES_INFORMATION .?AU_HEAP_OPTIMIZE_RESOURCES_INFORMATION@@ �� �$ L | Z � _PROCESS_ENERGY_TRACKING_STATE .?AU_PROCESS_ENERGY_TRACKING_STATE@@ ��
" ��v
" StateUpdateMask ��
" StateDesiredValue
" StateSequence
�$ UpdateTag
� Tag ��Z �$ � _PROCESS_ENERGY_TRACKING_STATE .?AU_PROCESS_ENERGY_TRACKING_STATE@@ �� �$ a p Z � _SERVICE_LAUNCH_PROTECTED_INFO .?AU_SERVICE_LAUNCH_PROTECTED_INFO@@ ��
�$
�
" dwLaunchProtected Z �$ _SERVICE_LAUNCH_PROTECTED_INFO .?AU_SERVICE_LAUNCH_PROTECTED_INFO@@ �� �$ 3 � R � _FILE_NUMA_NODE_INFORMATION .?AU_FILE_NUMA_NODE_INFORMATION@@
! NodeNumber ���R �$ _FILE_NUMA_NODE_INFORMATION .?AU_FILE_NUMA_NODE_INFORMATION@@ �$
� MemoryTypePaged �� MemoryTypeNonPaged ��� MemoryTypeLargePage �� MemoryTypeHugePage ��� MemoryTypeMax : t �$ _RTL_MEMORY_TYPE .?AW4_RTL_MEMORY_TYPE@@ ��� �$ ( �
V � _NDR_CS_SIZE_CONVERT_ROUTINES .?AU_NDR_CS_SIZE_CONVERT_ROUTINES@@ Z IDL_CS_NO_CONVERT IDL_CS_IN_PLACE_CONVERT �� IDL_CS_NEW_BUFFER_CONVERT 6 t �$ _IDL_CS_CONVERT .?AW4_IDL_CS_CONVERT@@ � �$ � �
�$
� " " �$ " " �$
�$
�
�!
�
�$
� & " " " " " �$
�$
� b
�$ pfnNetSize ���
�$ pfnToNetCs ���
�$ pfnLocalSize �
�$ pfnFromNetCs �V �$ _NDR_CS_SIZE_CONVERT_ROUTINES .?AU_NDR_CS_SIZE_CONVERT_ROUTINES@@ �$ � � F � _CONSOLE_FONT_INFOEX .?AU_CONSOLE_FONT_INFOEX@@ ��
" cbSize ���
" nFont
'" dwFontSize ���
u FontFamily ���
u FontWeight ���
� FaceName �F �$ T _CONSOLE_FONT_INFOEX .?AU_CONSOLE_FONT_INFOEX@@ ��6 onecore\external\sdk\inc\mincore\consoleapi3.h � �$ �$ B B � _SE_ACCESS_REQUEST .?AU_SE_ACCESS_REQUEST@@ ��
�"
� > � _GENERIC_MAPPING .?AU_GENERIC_MAPPING@@ ��
�$
� > � _OBJECT_TYPE_LIST .?AU_OBJECT_TYPE_LIST@@
�$
� �
" Size �
�$ SeSecurityDescriptor �
" DesiredAccess
" PreviouslyGrantedAccess ��
PrincipalSelfSid �
�$ GenericMapping ���
" ObjectTypeListCount ��
�$ ObjectTypeList ���B �$ _SE_ACCESS_REQUEST .?AU_SE_ACCESS_REQUEST@@ �� �$ �
�$
� � �$ : � _XSTATE_FEATURE .?AU_XSTATE_FEATURE@@ &
" Offset ���
" Size �: �$ _XSTATE_FEATURE .?AU_XSTATE_FEATURE@@ �$ { _ j � _REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER .?AU_REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER@@ ��
ResetCounters j �$ _REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER .?AU_REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER@@ �� �$ �) ^ PdataRefToFullXdata �� PdataPackedUnwindFunction PdataPackedUnwindFragment > t �$ ARM64_FNPDATA_FLAGS .?AW4ARM64_FNPDATA_FLAGS@@ � �$ [ � 6 � provider_info .?AUprovider_info@@ 2 � val_context .?AUval_context@@
�$
� �$ " " " " �$
�$
� �
�$ pi_R0_1val ���
�$ pi_R0_allvals
�$ pi_R3_1val ���
�$ pi_R3_allvals
" pi_flags �
pi_key_context ���6 �$ provider_info .?AUprovider_info@@ �$ H � : � tagWNDCLASSEXA .?AUtagWNDCLASSEXA@@ �� y u u �$
�$
�
�#
�
u cbSize ���
u style
�$ lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
� hInstance
�$ hIcon
�# hCursor ��
� hbrBackground
7 $ lpszMenuName �
7 ( lpszClassName
�$ , hIconSm ��: �$ 0 tagWNDCLASSEXA .?AUtagWNDCLASSEXA@@ �� �$ �
w
� 6 p t �$
�$
� r
ThreadListHead ���
CompletionEvent ��
" CompletionFlags ��
InternalListHead �N �$ _RTL_UMS_COMPLETION_LIST .?AU_RTL_UMS_COMPLETION_LIST@@ �� �$ ( �! : � tagEMRGLSRECORD .?AUtagEMRGLSRECORD@@ 6
emr ��
" cbData ���
K Data �: �$ tagEMRGLSRECORD .?AUtagEMRGLSRECORD@@ �$ �
� p p u p % " %
%
� F � _KEY_NODE_INFORMATION .?AU_KEY_NODE_INFORMATION@@
%
� �
} LastWriteTime
" TitleIndex ���
" ClassOffset ��
" ClassLength ��
" NameLength ���
Name �F % _KEY_NODE_INFORMATION .?AU_KEY_NODE_INFORMATION@@ % � � * � pvalueW .?AUpvalueW@@
%
� b
q pv_valuename �
t pv_valuelen ��
pv_value_context �
" pv_type ��* % pvalueW .?AUpvalueW@@ % H � � CmExtendedParameterInvalidType ��� CmExtendedParameterTrustClassKey � CmExtendedParameterEvent � CmExtendedParameterFileAccessToken ��� CmExtendedParameterMax ���N t % CM_EXTENDED_PARAMETER_TYPE .?AW4CM_EXTENDED_PARAMETER_TYPE@@ ��� % 3
%
�
�$
� r � _MEMORY_PARTITION_CONFIGURATION_INFORMATION .?AU_MEMORY_PARTITION_CONFIGURATION_INFORMATION@@ " " ��
" Flags
" NumaNode �
" Channel ��
" NumberOfNumaNodes
" ResidentAvailablePages ���
" CommittedPages ���
" CommitLimit ��
" PeakCommitment ���
" TotalNumberOfPages ���
" $ AvailablePages ���
" ( ZeroPages
" , FreePages
" 0 StandbyPages �
% 4 StandbyPageCountByPriority ���
% T RepurposedPagesByPriority
" t MaximumCommitLimit ���
" x DonatedPagesToPartitions �
" | PartitionId ��r % � _MEMORY_PARTITION_CONFIGURATION_INFORMATION .?AU_MEMORY_PARTITION_CONFIGURATION_INFORMATION@@ % �
D
�
D
� " " < �
ExceptionCode
" ExceptionFlags ���
% ExceptionRecord ��
ExceptionAddress �
" NumberParameters �
% ExceptionInformation �> % P _EXCEPTION_RECORD .?AU_EXCEPTION_RECORD@@ . onecore\internal\sdk\inc\ntxcapi_x.h ��� % % M V � _TOKEN_SECURITY_ATTRIBUTE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_V1@@ ��f � _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE@@ ��
%
� v � _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ ��
"%
� f
pInt64 ���
# pUint64 ��
< pString ��
!% pFqbn
#% pOctetString �2 $% <anonymous-tag> .?AT<anonymous-tag>@@ %% ] � v
� Name �
! ValueType
!
Reserved �
" Flags
" ValueCount ���
%% Values ���V '% _TOKEN_SECURITY_ATTRIBUTE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_V1@@ �� (% ] � F � _PERFINFO_CCSWAP_IDLE .?AU_PERFINFO_CCSWAP_IDLE@@
*%
�
" ��
" ��*
,% DataType �
-% TimeDelta F .% _PERFINFO_CCSWAP_IDLE .?AU_PERFINFO_CCSWAP_IDLE@@ /% � � �
1%
� 2% � 3% R � _UNIQUE_PROCESS_INFORMATION .?AU_UNIQUE_PROCESS_INFORMATION@@
# ��
# 0 ��
# 9��F
6% DontUse ��
7% UniqueProcessKey �
8% Reserved �R 9% _UNIQUE_PROCESS_INFORMATION .?AU_UNIQUE_PROCESS_INFORMATION@@ :% V � _ACCESS_ALLOWED_CALLBACK_ACE .?AU_ACCESS_ALLOWED_CALLBACK_ACE@@ ��:
o Header ���
" Mask �
" SidStart �V =% _ACCESS_ALLOWED_CALLBACK_ACE .?AU_ACCESS_ALLOWED_CALLBACK_ACE@@ �� >% �
( ��
@%
� " A% B%
C%
� B � tagCOMPOSITIONFORM .?AUtagCOMPOSITIONFORM@@ ��
E%
� B
" dwStyle ��
x ptCurrentPos �
� rcArea ���B G% tagCOMPOSITIONFORM .?AUtagCOMPOSITIONFORM@@ �� H% E 5 R � _WMI_JOB_SET_QUERY_CPU_RATE .?AU_WMI_JOB_SET_QUERY_CPU_RATE@@ &
" AllFlags �
" Value R K% _WMI_JOB_SET_QUERY_CPU_RATE .?AU_WMI_JOB_SET_QUERY_CPU_RATE@@ L% � � ^ � _ACTIVATION_CONTEXT_ASSEMBLY_DATA .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DATA@@
O
� �
" Size �
" Flags
O% AssemblyName �
" AssemblyNameLength ���
" HashAlgorithm
" PseudoKey ^ P% _ACTIVATION_CONTEXT_ASSEMBLY_DATA .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DATA@@ Q% L
v � _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION .?AU_JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION@@ ��
2 Action ���
# RecordNumber �
} TimeStamp
� KeyPathName ��
} OldLastWriteTime �
} ( NewLastWriteTime �v T% 0 _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION .?AU_JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION@@ �� U% 3 �
� N � tagEMRSCALEVIEWPORTEXTEX .?AUtagEMRSCALEVIEWPORTEXTEX@@ ��Z
emr ��
xNum �
xDenom ���
yNum �
yDenom ���N Y% tagEMRSCALEVIEWPORTEXTEX .?AUtagEMRSCALEVIEWPORTEXTEX@@ �� Z% �
�
� �
Allocated
Spare0 ���
! AllocatorBackTraceIndex ��
" Size �
� Tag ��
" TagUlong �
ProcessChargedQuota ��B ]% _SYSTEM_POOL_ENTRY .?AU_SYSTEM_POOL_ENTRY@@ �� ^% _
6 � _WMI_REGISTRY .?AU_WMI_REGISTRY@@
`%
� r
InitialTime ��
" Status ���
" Index
" InfoClass
Kcb ��
Name �6 b% _WMI_REGISTRY .?AU_WMI_REGISTRY@@ c% � � J � _STACK_WALK_EVENT_DATA .?AU_STACK_WALK_EVENT_DATA@@ ��R
# TimeStamp
" ProcessId
" ThreadId �
� Addresses J f% _STACK_WALK_EVENT_DATA .?AU_STACK_WALK_EVENT_DATA@@ �� g% �
i% : � _CLUSTER_RANGE .?AU_CLUSTER_RANGE@@ ��
k%
� 6
} StartingCluster ��
} ClusterCount �: m% _CLUSTER_RANGE .?AU_CLUSTER_RANGE@@ �� n% � Z � _QUERY_BAD_RANGES_OUTPUT_RANGE .?AU_QUERY_BAD_RANGES_OUTPUT_RANGE@@ ��V
" Flags
" Reserved �
# StartOffset ��
# LengthInBytes Z q% _QUERY_BAD_RANGES_OUTPUT_RANGE .?AU_QUERY_BAD_RANGES_OUTPUT_RANGE@@ �� r% 7! b � _PERFINFO_SYSTEM_MEMORY_INFORMATION .?AU_PERFINFO_SYSTEM_MEMORY_INFORMATION@@ z
" PagedPoolCommitPageCount �
" NonPagedPoolPageCount
" MdlPageCount �
" CommitPageCount ��b u% _PERFINFO_SYSTEM_MEMORY_INFORMATION .?AU_PERFINFO_SYSTEM_MEMORY_INFORMATION@@ v% � � R � _ETW_IDEAL_PROCESSOR_EVENT .?AU_ETW_IDEAL_PROCESSOR_EVENT@@ ��N
" ThreadId �
" OldIdealProcessor
" NewIdealProcessor R y% _ETW_IDEAL_PROCESSOR_EVENT .?AU_ETW_IDEAL_PROCESSOR_EVENT@@ �� z% �
�
� f � _PROCESS_KEEPALIVE_COUNT_INFORMATION .?AU_PROCESS_KEEPALIVE_COUNT_INFORMATION@@ ��
}%
� .
" WakeCount
" NoWakeCount ��f % _PROCESS_KEEPALIVE_COUNT_INFORMATION .?AU_PROCESS_KEEPALIVE_COUNT_INFORMATION@@ �� �% C 1 N � _ETW_CANCEL_KTIMER2_EVENT .?AU_ETW_CANCEL_KTIMER2_EVENT@@
" TimerKey �N �% _ETW_CANCEL_KTIMER2_EVENT .?AU_ETW_CANCEL_KTIMER2_EVENT@@ �% � �
� ^ � _TXFS_READ_BACKUP_INFORMATION_OUT .?AU_TXFS_READ_BACKUP_INFORMATION_OUT@@ .
" BufferLength �
| Buffer ���^ �% _TXFS_READ_BACKUP_INFORMATION_OUT .?AU_TXFS_READ_BACKUP_INFORMATION_OUT@@ �% ` F � _THREAD_ENERGY_VALUES .?AU_THREAD_ENERGY_VALUES@@
�%
� 6 � _TIMELINE_BITMAP .?AT_TIMELINE_BITMAP@@ ��j
� Cycles ���
� @ AttributedCycles �
� � WorkOnBehalfCycles ���
�% � CpuTimeline ��F �% � _THREAD_ENERGY_VALUES .?AU_THREAD_ENERGY_VALUES@@ �% a � � _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION .?AU_SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION@@ "
EfiLauncherEnabled ��� �% _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION .?AU_SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION@@ �% � N � _LDR_ENUM_RESOURCE_ENTRY .?AU_LDR_ENUM_RESOURCE_ENTRY@@ ��
�
� N
" NameOrId �
�% Name �
! Id ���
! NameIsPresent 2 �% <anonymous-tag> .?AT<anonymous-tag>@@ �% u a �% " �F
�% Path �
Data �
" Size �
" Reserved �N �% _LDR_ENUM_RESOURCE_ENTRY .?AU_LDR_ENUM_RESOURCE_ENTRY@@ �� �% u ` b � _SYSTEM_REGISTRY_QUOTA_INFORMATION .?AU_SYSTEM_REGISTRY_QUOTA_INFORMATION@@ ��V
" RegistryQuotaAllowed �
" RegistryQuotaUsed
" PagedPoolSize b �% _SYSTEM_REGISTRY_QUOTA_INFORMATION .?AU_SYSTEM_REGISTRY_QUOTA_INFORMATION@@ �� �% � R � _PERFINFO_BATTERY_LIFE_INFO .?AU_PERFINFO_BATTERY_LIFE_INFO@@ .
" RemainingCapacity
" Rate �R �% _PERFINFO_BATTERY_LIFE_INFO .?AU_PERFINFO_BATTERY_LIFE_INFO@@ �% � / b � _WIM_PROVIDER_SUSPEND_OVERLAY_INPUT .?AU_WIM_PROVIDER_SUSPEND_OVERLAY_INPUT@@
�%
�
} DataSourceId �b �% _WIM_PROVIDER_SUSPEND_OVERLAY_INPUT .?AU_WIM_PROVIDER_SUSPEND_OVERLAY_INPUT@@ �% 7" B � _ALPC_CONTEXT_ATTR .?AU_ALPC_CONTEXT_ATTR@@ ��v
PortContext ��
MessageContext ���
" Sequence �
" MessageId
" CallbackId ���B �% _ALPC_CONTEXT_ATTR .?AU_ALPC_CONTEXT_ATTR@@ �� �% �
X%
� f � _JOURNAL_SET_DELETE_VALUE_INFORMATION .?AU_JOURNAL_SET_DELETE_VALUE_INFORMATION@@ �
2 Action ���
# RecordNumber �
} TimeStamp
� KeyPathName ��
� ValueName
" ( OldValueType �
" , OldDataLength
0 OldData ��
" 4 NewValueType �
" 8 NewDataLength
< NewData ��f �% @ _JOURNAL_SET_DELETE_VALUE_INFORMATION .?AU_JOURNAL_SET_DELETE_VALUE_INFORMATION@@ �% 3 � KeyWriteTimeInformation �� KeyWow64FlagsInformation � KeyControlFlagsInformation ��� KeySetVirtualizationInformation �� KeySetDebugInformation ��� KeySetHandleTagsInformation �� KeySetLayerInformation ��� MaxKeySetInfoClass ���N t �% _KEY_SET_INFORMATION_CLASS .?AW4_KEY_SET_INFORMATION_CLASS@@ ��� �% � 8 N � _QUERY_FILE_LAYOUT_INPUT .?AU_QUERY_FILE_LAYOUT_INPUT@@ ��
�%
� k% " �F � _FILE_REFERENCE_RANGE .?AU_FILE_REFERENCE_RANGE@@ �% " �V
�% ClusterRanges
�% FileReferenceRanges ��
StorageReserveIds 2 �% <anonymous-tag> .?AT<anonymous-tag>@@ �% 0 �
" FilterEntryCount �
" NumberOfPairs
" Flags
M# FilterType ���
" Reserved �
�% Filter ���N �% _QUERY_FILE_LAYOUT_INPUT .?AU_QUERY_FILE_LAYOUT_INPUT@@ �� �% N � _CSV_QUERY_REDIRECT_STATE .?AU_CSV_QUERY_REDIRECT_STATE@@ F
" MdsNodeId
" DsNodeId �
FileRedirected ���N �% _CSV_QUERY_REDIRECT_STATE .?AU_CSV_QUERY_REDIRECT_STATE@@ �% `
N% ��
�%
� n � _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES .?AU_POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES@@
IsAllowed n �% _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES .?AU_POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES@@ �% D ! �% . � _RTL_RUN_ONCE .?AT_RTL_RUN_ONCE@@
" ��2
Ptr ��
" Value
�% State . �% _RTL_RUN_ONCE .?AT_RTL_RUN_ONCE@@ �% ( V � _QUERY_BAD_RANGES_INPUT_RANGE .?AU_QUERY_BAD_RANGES_INPUT_RANGE@@ 2
# StartOffset ��
# LengthInBytes V �% _QUERY_BAD_RANGES_INPUT_RANGE .?AU_QUERY_BAD_RANGES_INPUT_RANGE@@ �% ! z � _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@
�%
� B
N ControlFlowGuard �
N StrictControlFlowGuard ���z �% _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@ �% � x �
u cbSize ���
t iContextType �
t iCtrlId ��
hItemHandle ��
" dwContextId ��
x MousePos �2 �% tagHELPINFO .?AUtagHELPINFO@@ �% K# 6 � tagWNDCLASSW .?AUtagWNDCLASSW@@ ��
�%
�
O
� �
u style
�$ lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
� hInstance
�$ hIcon
�# hCursor ��
� hbrBackground
�% lpszMenuName �
�% $ lpszClassName 6
�% ( tagWNDCLASSW .?AUtagWNDCLASSW@@ �� �% J � _WNF_USER_SUBSCRIPTION .?AU_WNF_USER_SUBSCRIPTION@@ ��> � tagLOGCOLORSPACEA .?AUtagLOGCOLORSPACEA@@
�%
� �
" lcsSignature �
" lcsVersion ���
" lcsSize ��
lcsCSType
lcsIntent
; lcsEndpoints �
" 8 lcsGammaRed ��
" < lcsGammaGreen
" @ lcsGammaBlue �
� D lcsFilename ��>
�% HtagLOGCOLORSPACEA .?AUtagLOGCOLORSPACEA@@ �% � R � _SYSTEM_OBJECT_INFORMATION .?AU_SYSTEM_OBJECT_INFORMATION@@ ��B
" NextEntryOffset ��
Object ���
CreatorUniqueProcess �
! CreatorBackTraceIndex
! Flags
PointerCount �
HandleCount ��
" PagedPoolCharge ��
" NonPagedPoolCharge ���
ExclusiveProcessId ���
$ SecurityDescriptor ���
# ( NameInfo �R �% 0 _SYSTEM_OBJECT_INFORMATION .?AU_SYSTEM_OBJECT_INFORMATION@@ �� �% 0
�
� V � COPYFILE2_EXTENDED_PARAMETERS .?AUCOPYFILE2_EXTENDED_PARAMETERS@@
"
� z
" dwSize ���
" dwCopyFlags ��
t pfCancel �
�% pProgressRoutine �
pvCallbackContext V �% COPYFILE2_EXTENDED_PARAMETERS .?AUCOPYFILE2_EXTENDED_PARAMETERS@@ �% � ^ � _SYSTEM_ALARM_CALLBACK_OBJECT_ACE .?AU_SYSTEM_ALARM_CALLBACK_OBJECT_ACE@@ �
o Header ���
" Mask �
" Flags
� ObjectType ���
� InheritedObjectType ��
" , SidStart �^ �% 0 _SYSTEM_ALARM_CALLBACK_OBJECT_ACE .?AU_SYSTEM_ALARM_CALLBACK_OBJECT_ACE@@ �% 1
X
Y * �% _COORD .?AU_COORD@@ �� �% $
k
� ^ � _EVENT_TRACE_VERSION_INFORMATION .?AU_EVENT_TRACE_VERSION_INFORMATION@@ ��N
� EventTraceInformationClass ���
" EventTraceKernelVersion ��^ �% _EVENT_TRACE_VERSION_INFORMATION .?AU_EVENT_TRACE_VERSION_INFORMATION@@ �� �% � �
�
� � POINTER_CHANGE_NONE �� POINTER_CHANGE_FIRSTBUTTON_DOWN �� POINTER_CHANGE_FIRSTBUTTON_UP POINTER_CHANGE_SECONDBUTTON_DOWN � POINTER_CHANGE_SECONDBUTTON_UP ��� POINTER_CHANGE_THIRDBUTTON_DOWN �� POINTER_CHANGE_THIRDBUTTON_UP POINTER_CHANGE_FOURTHBUTTON_DOWN � POINTER_CHANGE_FOURTHBUTTON_UP ��� POINTER_CHANGE_FIFTHBUTTON_DOWN ��
POINTER_CHANGE_FIFTHBUTTON_UP R t & tagPOINTER_BUTTON_CHANGE_TYPE .?AW4tagPOINTER_BUTTON_CHANGE_TYPE@@ � & � V � _HEAP_BLOCK_EXTRA_INFORMATION .?AU_HEAP_BLOCK_EXTRA_INFORMATION@@
&
� 2
Next �
" Type �
" Size �V & _HEAP_BLOCK_EXTRA_INFORMATION .?AU_HEAP_BLOCK_EXTRA_INFORMATION@@ & L � j � _SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT@@ ��j � _SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER .?AU_SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER@@ j
& Header ���
# OverQuotaHistory �
" IntervalLength ���
" NumberOfIntervals j & _SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT@@ ��
& { � n LdrpNoDevice � LdrpWebDAV ��� LdrpRemote ��� ��LdrpAnyDevice ��� LdrpAnyDevice2bit N t & <unnamed-enum-LdrpNoDevice> .?AW4<unnamed-enum-LdrpNoDevice>@@ � & u � ^ � _ETW_DFSS_RELEASE_THREAD_ON_IDLE .?AU_ETW_DFSS_RELEASE_THREAD_ON_IDLE@@ ��z
" CurrentGeneration
" SessionSelectedToRun �
# CycleBaseAllowance ���
CyclesRemaining ��^ & _ETW_DFSS_RELEASE_THREAD_ON_IDLE .?AU_ETW_DFSS_RELEASE_THREAD_ON_IDLE@@ �� & � B
^ � _RPC_BINDING_HANDLE_TEMPLATE_V1_A .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_A@@
&
�
Reserved �2 & <anonymous-tag> .?AT<anonymous-tag>@@ & � �
" Version ��
" Flags
" ProtocolSequence �
NetworkAddress ���
StringEndpoint ���
& u1 ���
� ObjectUuid ���^ & ( _RPC_BINDING_HANDLE_TEMPLATE_V1_A .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_A@@ & � : � _EVENTLOGRECORD .?AU_EVENTLOGRECORD@@ z
" Length ���
" Reserved �
" RecordNumber �
" TimeGenerated
" TimeWritten ��
" EventID ��
! EventType
! NumStrings ���
! EventCategory
! ReservedFlags
" ClosingRecordNumber ��
" $ StringOffset �
" ( UserSidLength
" , UserSidOffset
" 0 DataLength ���
" 4 DataOffset ���: & 8 _EVENTLOGRECORD .?AU_EVENTLOGRECORD@@ * onecore\internal\sdk\inc\ntelfapi.h & !& E V � _FILE_ID_FULL_DIR_INFORMATION .?AU_FILE_ID_FULL_DIR_INFORMATION@@ :
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
} H FileId ���
P FileName �V
$& X _FILE_ID_FULL_DIR_INFORMATION .?AU_FILE_ID_FULL_DIR_INFORMATION@@ %& � Z � _PERFINFO_PPM_IDLE_STATE_ENTER .?AU_PERFINFO_PPM_IDLE_STATE_ENTER@@ ��
'&
� �
" State
! Properties ���
ExpectedWakeReason ���
Reserved �
" Flags
# ExpectedDuration �Z )& _PERFINFO_PPM_IDLE_STATE_ENTER .?AU_PERFINFO_PPM_IDLE_STATE_ENTER@@ �� *& � �
" Marker ���
! Version ��
HeaderType ���
Flags
" Header ���
�" Packet ���
" ThreadId �
" ProcessId
} SystemTime ���
" KernelTime ���
" UserTime �F ,& _SYSTEM_TRACE_HEADER .?AU_SYSTEM_TRACE_HEADER@@ �� -& � _ V � _RTL_CRITICAL_SECTION_DEBUG64 .?AU_RTL_CRITICAL_SECTION_DEBUG64@@
/&
� �
! Type �
! CreatorBackTraceIndex
# CriticalSection ��
ProcessLocksList �
" EntryCount ���
" $ ContentionCount ��
� ( Spare V 1& 0 _RTL_CRITICAL_SECTION_DEBUG64 .?AU_RTL_CRITICAL_SECTION_DEBUG64@@ 2& L { V � _SYSTEM_VERIFIER_INFORMATION .?AU_SYSTEM_VERIFIER_INFORMATION@@ ��
4&
�
" ��
" ��
" ��V
6& AreAllDriversBeingVerified ���
7& DisabledFromCrash
8& Spare : 9& <anonymous-tag> .?AU<anonymous-tag>@@ :& V "
:& Flags
" Whole 2 <& <anonymous-tag> .?AT<anonymous-tag>@@ =& T >
" NextEntryOffset ��
" Level
� RuleClasses ��
" TriageContext
=& u1 ���
� DriverName ���
" RaiseIrqls ���
" $ AcquireSpinLocks �
" ( SynchronizeExecutions
" , AllocationsAttempted �
" 0 AllocationsSucceeded �
" 4 AllocationsSucceededSpecialPool ��
" 8 AllocationsWithNoTag �
" < TrimRequests �
" @ Trims
" D AllocationsFailed
" H AllocationsFailedDeliberately
" L Loads
" P Unloads ��
" T UnTrackedPool
" X CurrentPagedPoolAllocations ��
" \ CurrentNonPagedPoolAllocations ���
" ` PeakPagedPoolAllocations �
" d PeakNonPagedPoolAllocations ��
" h PagedPoolUsageInBytes
" l NonPagedPoolUsageInBytes �
" p PeakPagedPoolUsageInBytes
" t PeakNonPagedPoolUsageInBytes �V ?& x _SYSTEM_VERIFIER_INFORMATION .?AU_SYSTEM_VERIFIER_INFORMATION@@ �� @& N J � _RTL_HANDLE_TABLE_ENTRY .?AU_RTL_HANDLE_TABLE_ENTRY@@
B&
� &
" Flags
C& NextFree �J D& _RTL_HANDLE_TABLE_ENTRY .?AU_RTL_HANDLE_TABLE_ENTRY@@ E& L � N � _SPARSE_OVERALLOCATE_DATA .?AU_SPARSE_OVERALLOCATE_DATA@@ &
" SparseOverAllocateSize ���N H& _SPARSE_OVERALLOCATE_DATA .?AU_SPARSE_OVERALLOCATE_DATA@@ I& j( N � USN_RECORD_COMMON_HEADER .?AUUSN_RECORD_COMMON_HEADER@@ ��
K&
� J
" RecordLength �
! MajorVersion �
! MinorVersion �N M& USN_RECORD_COMMON_HEADER .?AUUSN_RECORD_COMMON_HEADER@@ �� N& � j � _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION_V2@@ �
PerfEvtEventSelect ���
PerfEvtUnitSelect
PerfEvtCMask �
PerfEvtCInv ��
PerfEvtAnyThread �
PerfEvtEdgeDetect : Q& <anonymous-tag> .?AU<anonymous-tag>@@ R& � | >
PerfEvtEventSelect ���
PerfEvtUnitSelect : T& <anonymous-tag> .?AU<anonymous-tag>@@ U& � � 2
" PerfEvtType ��
AllowsHalt ���: W& <anonymous-tag> .?AU<anonymous-tag>@@ X& � � 2
R& Intel
U& Amd ��
X& Arm ��j Z& _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION_V2@@ [& � z
�
�
M ��
M ��
M ��
M ��
M ��
M ��
M ��
W ��
W >���
Link �
Context ��
�Teb ��
�UserContext ��
^& �ScheduledThread ��
_& �Suspended
`& �VolatileContext ��
a& �Terminated ���
b& �DebugActive ��
c& �RunningOnSelfThread ��
d& �DenyRunningOnSelfThread ��
�Flags
e& �KernelUpdateLock �
f& �PrimaryClientID ��
W �ContextLock ��
�PrimaryUmsContext
" �SwitchCount ��
" �KernelYieldCount �
" �MixedYieldCount ��
" �YieldCount ���> g& _RTL_UMS_CONTEXT .?AU_RTL_UMS_CONTEXT@@ �� h& ( ! 6 � _RPC_VERSION .?AU_RPC_VERSION@@ ��2
! MajorVersion �
! MinorVersion �6 k& _RPC_VERSION .?AU_RPC_VERSION@@ �� l& � ) R � _ENCRYPTION_KEY_CTRL_INPUT .?AU_ENCRYPTION_KEY_CTRL_INPUT@@ ��
n&
� �
" HeaderSize ���
" StructureSize
! KeyOffset
!
KeySize ��
" DplLock ��
# DplUserId
# DplCredentialId ��R p& _ENCRYPTION_KEY_CTRL_INPUT .?AU_ENCRYPTION_KEY_CTRL_INPUT@@ �� q& �! : � _SL_APPX_CACHE .?AU_SL_APPX_CACHE@@ ��Z � _SL_APPX_CACHE_VALUE_DESCRIPTOR .?AU_SL_APPX_CACHE_VALUE_DESCRIPTOR@@ t& " 0 �j
" Version ��
" Flags
" DataSize �
# DataCheckSum �
u& Descriptors ��: v& H _SL_APPX_CACHE .?AU_SL_APPX_CACHE@@ �� w& � 6 � _VM_COUNTERS .?AU_VM_COUNTERS@@ ��R
" PeakVirtualSize ��
" VirtualSize ��
" PageFaultCount ���
" PeakWorkingSetSize ���
" WorkingSetSize ���
" QuotaPeakPagedPoolUsage ��
" QuotaPagedPoolUsage ��
" QuotaPeakNonPagedPoolUsage ���
" QuotaNonPagedPoolUsage ���
" $ PagefileUsage
" ( PeakPagefileUsage 6 z& , _VM_COUNTERS .?AU_VM_COUNTERS@@ �� {& C � B � _PREFIX_TABLE_ENTRY .?AU_PREFIX_TABLE_ENTRY@@
}&
� r
NodeTypeCode �
NameLength ���
~& NextPrefixTree ���
# Links
�# Prefix ���B & _PREFIX_TABLE_ENTRY .?AU_PREFIX_TABLE_ENTRY@@ �& ( > � _COUNTER_READING .?AU_COUNTER_READING@@ ��B
0 Type �
" Index
# Start
# Total > �& _COUNTER_READING .?AU_COUNTER_READING@@ �� �& a | J � _TRACE_LOGFILE_HEADER32 .?AU_TRACE_LOGFILE_HEADER32@@ f
MajorVersion �
MinorVersion �
SubVersion ���
SubMinorVersion ��: �& <anonymous-tag> .?AU<anonymous-tag>@@ �& � � .
" BufferSize ���
" Version ��
�& VersionDetail
" ProviderVersion ��
" NumberOfProcessors ���
} EndTime ��
" TimerResolution ��
" MaximumFileSize ��
" LogFileMode ��
" $ BuffersWritten ���
� ( LogInstanceGuid ��
" ( StartBuffers �
" , PointerSize ��
" 0 EventsLost ���
" 4 CpuSpeedInMHz
u 8 LoggerName ���
u < LogFileName ��
@ TimeZone �
} � BootTime �
} � PerfFreq �
} StartTime
" ReservedFlags
" BuffersLost ��J �& _TRACE_LOGFILE_HEADER32 .?AU_TRACE_LOGFILE_HEADER32@@ �& � � J � _TOKEN_MANDATORY_LABEL .?AU_TOKEN_MANDATORY_LABEL@@ ��
�&
�
Y Label J �& _TOKEN_MANDATORY_LABEL .?AU_TOKEN_MANDATORY_LABEL@@ �� �& � v � _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM .?AU_SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM@@
�&
� Z � SERVICE_TRIGGER_CUSTOM_STATE_ID .?AUSERVICE_TRIGGER_CUSTOM_STATE_ID@@ *
" DataOffset ���
K Data �: �& <anonymous-tag> .?AU<anonymous-tag>@@ �& 3 � &
�& CustomStateId
�& s 2 �& <anonymous-tag> .?AT<anonymous-tag>@@ �& 3 �
�& u v �& _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM .?AU_SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM@@ �& 3 � 6 � tagEMRFORMAT .?AUtagEMRFORMAT@@ ��V
" dSignature ���
" nVersion �
" cbData ���
" offData ��6 �& tagEMRFORMAT .?AUtagEMRFORMAT@@ �� �& � b � _PLUGPLAY_CONTROL_CONFLICT_STRINGS .?AU_PLUGPLAY_CONTROL_CONFLICT_STRINGS@@ ��B
" NullDeviceInstance ���
DeviceInstanceStrings b �& _PLUGPLAY_CONTROL_CONFLICT_STRINGS .?AU_PLUGPLAY_CONTROL_CONFLICT_STRINGS@@ �� �& � � j � _SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE .?AU_SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE@@
�&
�
&
�
�& �&
�&
� &
�& NetRateControlDispatch ���j �& _SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE .?AU_SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE@@ �& { � . COPYFILE2_CALLBACK_NONE �� COPYFILE2_CALLBACK_CHUNK_STARTED � COPYFILE2_CALLBACK_CHUNK_FINISHED COPYFILE2_CALLBACK_STREAM_STARTED COPYFILE2_CALLBACK_STREAM_FINISHED ��� COPYFILE2_CALLBACK_POLL_CONTINUE � COPYFILE2_CALLBACK_ERROR � COPYFILE2_CALLBACK_MAX ���F t �& _COPYFILE2_MESSAGE_TYPE .?AW4_COPYFILE2_MESSAGE_TYPE@@ � �& ; R � _LINK_TRACKING_INFORMATION .?AU_LINK_TRACKING_INFORMATION@@ ��J NtfsLinkTrackingInformation �� DfsLinkTrackingInformation ���V t �& _LINK_TRACKING_INFORMATION_TYPE .?AW4_LINK_TRACKING_INFORMATION_TYPE@@ � �& �) &
�& Type �
� VolumeId �R �& _LINK_TRACKING_INFORMATION .?AU_LINK_TRACKING_INFORMATION@@ �� �& �) Z � _IMAGE_LOAD_CONFIG_DIRECTORY32 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY32@@ ��
" Size �
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" GlobalFlagsClear �
" GlobalFlagsSet ���
" CriticalSectionDefaultTimeout
" DeCommitFreeBlockThreshold ���
" DeCommitTotalFreeThreshold ���
" LockPrefixTable ��
" $ MaximumAllocationSize
" ( VirtualMemoryThreshold ���
" , ProcessHeapFlags �
" 0 ProcessAffinityMask ��
! 4 CSDVersion ���
! 6 DependentLoadFlags ���
" 8 EditList �
" < SecurityCookie ���
" @ SEHandlerTable ���
" D SEHandlerCount ���
" H GuardCFCheckFunctionPointer ��
" L GuardCFDispatchFunctionPointer ���
" P GuardCFFunctionTable �
" T GuardCFFunctionCount �
" X GuardFlags ���
� \ CodeIntegrity
" h GuardAddressTakenIatEntryTable ���
" l GuardAddressTakenIatEntryCount ���
" p GuardLongJumpTargetTable �
" t GuardLongJumpTargetCount �
" x DynamicValueRelocTable ���
" | CHPEMetadataPointer ��
" � GuardRFFailureRoutine
" � GuardRFFailureRoutineFunctionPointer �
" � DynamicValueRelocTableOffset �
! � DynamicValueRelocTableSection
! � Reserved2
" � GuardRFVerifyStackPointerFunctionPointer �
" � HotPatchTableOffset ��
" � Reserved3
" � EnclaveConfigurationPointer ��
" � VolatileMetadataPointer ��
" � GuardEHContinuationTable �
" � GuardEHContinuationCount �Z , �& � _IMAGE_LOAD_CONFIG_DIRECTORY32 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY32@@ �� �& [ J � _TRACE_GUID_PROPERTIES .?AU_TRACE_GUID_PROPERTIES@@ ��~
� Guid �
" GuidType �
" LoggerId �
" EnableLevel ��
" EnableFlags ��
IsEnable �J �& $ _TRACE_GUID_PROPERTIES .?AU_TRACE_GUID_PROPERTIES@@ �� �& � � B � tagEMRSTRETCHDIBITS .?AUtagEMRSTRETCHDIBITS@@ &
emr ��
� rclBounds
xDest
yDest
xSrc �
$ ySrc �
( cxSrc
, cySrc
" 0 offBmiSrc
" 4 cbBmiSrc �
" 8 offBitsSrc ���
" < cbBitsSrc
" @ iUsageSrc
" D dwRop
H cxDest ���
L cyDest ���B �& P tagEMRSTRETCHDIBITS .?AUtagEMRSTRETCHDIBITS@@ �& + V � _TRANSACTION_LIST_INFORMATION .?AU_TRANSACTION_LIST_INFORMATION@@ � " �F
" NumberOfTransactions �
�& TransactionInformation ���V �& _TRANSACTION_LIST_INFORMATION .?AU_TRANSACTION_LIST_INFORMATION@@ �& � m V � _FILE_COMPLETION_INFORMATION .?AU_FILE_COMPLETION_INFORMATION@@ ��
�&
� "
Port �
Key ��V �& _FILE_COMPLETION_INFORMATION .?AU_FILE_COMPLETION_INFORMATION@@ �� �& ? V � _ETW_TP_EVENT_CALLBACK_START .?AU_ETW_TP_EVENT_CALLBACK_START@@ ��
�&
� ~
� Header ���
PoolId ���
$ TaskId ���
( Callback �
, Context ��
0 SubProcessTag V �& 8 _ETW_TP_EVENT_CALLBACK_START .?AU_ETW_TP_EVENT_CALLBACK_START@@ �� �& � � j � _TRANSACTIONMANAGER_LOGPATH_INFORMATION .?AU_TRANSACTIONMANAGER_LOGPATH_INFORMATION@@ .
" LogPathLength
LogPath ��j �& _TRANSACTIONMANAGER_LOGPATH_INFORMATION .?AU_TRANSACTIONMANAGER_LOGPATH_INFORMATION@@ �& � � B � _CONSOLE_FONT_INFO .?AU_CONSOLE_FONT_INFO@@ ��
�&
� *
" nFont
'" dwFontSize ���B �& _CONSOLE_FONT_INFO .?AU_CONSOLE_FONT_INFO@@ �� �& �
�
�
�
� �
�& DebugInfo
LockCount
RecursionCount ���
OwningThread �
LockSemaphore
" SpinCount F �& _RTL_CRITICAL_SECTION .?AU_RTL_CRITICAL_SECTION@@ �& L Z
�
� N � _SD_GLOBAL_CHANGE_OUTPUT .?AU_SD_GLOBAL_CHANGE_OUTPUT@@ ��V � _SD_CHANGE_MACHINE_SID_OUTPUT .?AU_SD_CHANGE_MACHINE_SID_OUTPUT@@ J � _SD_QUERY_STATS_OUTPUT .?AU_SD_QUERY_STATS_OUTPUT@@ ��B � _SD_ENUM_SDS_OUTPUT .?AU_SD_ENUM_SDS_OUTPUT@@ j
" Flags
" ChangeType ���
�& SdChange �
�& SdQueryStats �
�& SdEnumSds N �& H _SD_GLOBAL_CHANGE_OUTPUT .?AU_SD_GLOBAL_CHANGE_OUTPUT@@ �� �& � : � tagHELPWININFOW .?AUtagHELPWININFOW@@
�&
� q " �z
t wStructSize ��
t x
t y
t dx ���
t dy ���
t wMax �
�& rgchMember ���: �& tagHELPWININFOW .?AUtagHELPWININFOW@@ �& �/ . � tagNMHDR .?AUtagNMHDR@@ ��:
y hwndFrom �
u idFrom ���
u code �. �& tagNMHDR .?AUtagNMHDR@@ �� �& �
�& : � _CONTEXT_CHUNK .?AU_CONTEXT_CHUNK@@ ��*
Offset ���
" Length ���: �& _CONTEXT_CHUNK .?AU_CONTEXT_CHUNK@@ �� �& � B 2 � _cpinfoexW .?AU_cpinfoexW@@ ��
u MaxCharSize ��
� DefaultChar ��
� LeadByte �
q UnicodeDefaultChar ���
u CodePage �
s CodePageName �2 �& _cpinfoexW .?AU_cpinfoexW@@ �� �& � l
� J � _PROCESS_EXCEPTION_PORT .?AU_PROCESS_EXCEPTION_PORT@@
�&
� :
ExceptionPortHandle ��
" StateFlags ���J ' _PROCESS_EXCEPTION_PORT .?AU_PROCESS_EXCEPTION_PORT@@ ' C � 6 � _ICONINFOEXW .?AU_ICONINFOEXW@@ ��
'
� �
" cbSize ���
t fIcon
" xHotspot �
" yHotspot �
hbmMask ��
hbmColor �
! wResID ���
s szModName
s "szResName 6 ' ,_ICONINFOEXW .?AU_ICONINFOEXW@@ �� ' �* > � _NV_MEMORY_RANGE .?AU_NV_MEMORY_RANGE@@ ��.
BaseAddress ��
" Length ���>
' _NV_MEMORY_RANGE .?AU_NV_MEMORY_RANGE@@ �� ' ( �$ F � _IMAGE_HOT_PATCH_INFO .?AU_IMAGE_HOT_PATCH_INFO@@
'
� �
" Version ��
" Size �
" SequenceNumber ���
" BaseImageList
" BaseImageCount ���
" BufferOffset �
" ExtraPatchSize ���F ' _IMAGE_HOT_PATCH_INFO .?AU_IMAGE_HOT_PATCH_INFO@@ ' [ � ^ FileIdType ��� ObjectIdType � ExtendedFileIdType ��� MaximumFileIdType 2 t ' _FILE_ID_TYPE .?AW4_FILE_ID_TYPE@@ � ' �# * � HSTR__ .?AUHSTR__@@ ��
'
�
t unused ���* ' HSTR__ .?AUHSTR__@@ ��6 onecore\external\shared\inc\minwin\minwindef.h � ' ' f � _SYSTEM_HYPERVISOR_DETAIL_INFORMATION .?AU_SYSTEM_HYPERVISOR_DETAIL_INFORMATION@@ 2 � _HV_DETAILS .?AU_HV_DETAILS@@ �
' HvVendorAndMaxFunction ���
' HypervisorInterface ��
' HypervisorVersion
' 0 HvFeatures ���
' @ HwFeatures ���
' P EnlightenmentInfo
' ` ImplementationLimits �f ' p _SYSTEM_HYPERVISOR_DETAIL_INFORMATION .?AU_SYSTEM_HYPERVISOR_DETAIL_INFORMATION@@ ' = : � _WMI_DPI_RECORD .?AU_WMI_DPI_RECORD@@ .
" MachineDPI ���
" UserDPI ��: !' _WMI_DPI_RECORD .?AU_WMI_DPI_RECORD@@ "' � j B � _RTL_PROCESS_HEAPS .?AU_RTL_PROCESS_HEAPS@@ ��F � _RTL_HEAP_INFORMATION .?AU_RTL_HEAP_INFORMATION@@ %' " @ �*
" NumberOfHeaps
&' Heaps B '' D _RTL_PROCESS_HEAPS .?AU_RTL_PROCESS_HEAPS@@ �� (' L F V LoadReasonStaticDependency ��� LoadReasonStaticForwarderDependency �� LoadReasonDynamicForwarderDependency � LoadReasonDelayloadDependency LoadReasonDynamicLoad LoadReasonAsImageLoad LoadReasonAsDataLoad � LoadReasonEnclavePrimary � LoadReasonEnclaveDependency �� ��LoadReasonUnknown ���B
t *' _LDR_DLL_LOAD_REASON .?AW4_LDR_DLL_LOAD_REASON@@ ��� +' u �
�$
� t " " " " .'
/'
�
0'
� B
-' pSizeConvertRoutines �
1' pTagGettingRoutines ��> 2' _NDR_CS_ROUTINES .?AU_NDR_CS_ROUTINES@@ �� 3' � � " SC_STATUS_PROCESS_INFO ���6 t 5' _SC_STATUS_TYPE .?AW4_SC_STATUS_TYPE@@ � 6' 3 � > � _DISPLAY_DEVICEW .?AU_DISPLAY_DEVICEW@@ ��
8'
� �
" cb ���
� DeviceName ���
*$ D DeviceString �
" DStateFlags ���
*$ HDeviceID �
*$ HDeviceKey > :' H_DISPLAY_DEVICEW .?AU_DISPLAY_DEVICEW@@ �� ;' �
n ` =' V � _TOKEN_GROUPS_AND_PRIVILEGES .?AU_TOKEN_GROUPS_AND_PRIVILEGES@@ ��F � _LUID_AND_ATTRIBUTES .?AU_LUID_AND_ATTRIBUTES@@ ��
@'
�
" SidCount �
" SidLength
� Sids �
" RestrictedSidCount ���
" RestrictedSidLength ��
� RestrictedSids ���
" PrivilegeCount ���
" PrivilegeLength ��
A' Privileges ���
I $ AuthenticationId �V
B' , _TOKEN_GROUPS_AND_PRIVILEGES .?AU_TOKEN_GROUPS_AND_PRIVILEGES@@ �� C' � : � tagMENUBARINFO .?AUtagMENUBARINFO@@ ��
E'
�
t ��
t ��
t ��
" cbSize ���
� rcBar
2 hMenu
y hwndMenu �
G' fBarFocused ��
H' fFocused �
I' fUnused ��: J' tagMENUBARINFO .?AUtagMENUBARINFO@@ �� K' 9 > � _USER_MARSHAL_CB .?AU_USER_MARSHAL_CB@@ ��
�
� � USER_MARSHAL_CB_BUFFER_SIZE �� USER_MARSHAL_CB_MARSHALL � USER_MARSHAL_CB_UNMARSHALL ��� USER_MARSHAL_CB_FREE �B t O' _USER_MARSHAL_CB_TYPE .?AW4_USER_MARSHAL_CB_TYPE@@ � P' � x �
" Flags
N' pStubMsg �
� pReserve �
" Signature
P' CBType ���
� pFormat ��
� pTypeFormat ��> R' _USER_MARSHAL_CB .?AU_USER_MARSHAL_CB@@ �� S' � � R � tagRID_DEVICE_INFO_KEYBOARD .?AUtagRID_DEVICE_INFO_KEYBOARD@@ �
" dwType ���
" dwSubType
" dwKeyboardMode ���
" dwNumberOfFunctionKeys ���
" dwNumberOfIndicators �
" dwNumberOfKeysTotal ��R V' tagRID_DEVICE_INFO_KEYBOARD .?AUtagRID_DEVICE_INFO_KEYBOARD@@ W' ; B � tagEMRPOLYTEXTOUTA .?AUtagEMRPOLYTEXTOUTA@@ ��
Y'
� 2 � tagEMRTEXT .?AUtagEMRTEXT@@ �� [' " ( �
emr ��
� rclBounds
" iGraphicsMode
@ exScale ��
@ eyScale ��
$ cStrings �
\' ( aemrtext �B ]' P tagEMRPOLYTEXTOUTA .?AUtagEMRPOLYTEXTOUTA@@ �� ^' � � ActivationContextBasicInformation ActivationContextDetailedInformation � AssemblyDetailedInformationInActivationContext ��� FileInformationInAssemblyOfAssemblyInActivationContext ��� RunlevelInformationInActivationContext ��� CompatibilityInformationInActivationContext �� ActivationContextManifestResourceName MaxActivationContextInfoClass AssemblyDetailedInformationInActivationContxt FileInformationInAssemblyOfAssemblyInActivationContxt V
t `' _ACTIVATION_CONTEXT_INFO_CLASS .?AW4_ACTIVATION_CONTEXT_INFO_CLASS@@ ��� a' L D R � _SYSTEM_NUMA_PROXIMITY_MAP .?AU_SYSTEM_NUMA_PROXIMITY_MAP@@ ��6
" NodeProximityId ��
! NodeNumber ���R d' _SYSTEM_NUMA_PROXIMITY_MAP .?AU_SYSTEM_NUMA_PROXIMITY_MAP@@ �� e' 5 f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A@@ ��
TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
ServerCertificateSubject �
ProxyCredentials �
" NumberOfProxyAuthnSchemes
" ProxyAuthnSchemes f h' $ _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A@@ �� i' � � n � _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER@@
PrologueByteCount n l' _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER@@ m' [ � > PMETypeFailFastOnCommitFailure ��� PMETypeMax ���V t o' _PROCESS_MEMORY_EXHAUSTION_TYPE .?AW4_PROCESS_MEMORY_EXHAUSTION_TYPE@@ � p' 1 � N � tagRID_DEVICE_INFO_MOUSE .?AUtagRID_DEVICE_INFO_MOUSE@@ ��f
" dwId �
" dwNumberOfButtons
" dwSampleRate �
t fHasHorizontalWheel ��N s' tagRID_DEVICE_INFO_MOUSE .?AUtagRID_DEVICE_INFO_MOUSE@@ �� t' ; . � _OFSTRUCT .?AU_OFSTRUCT@@
v'
� �
cBytes ���
fFixedDisk ���
! nErrCode �
! Reserved1
! Reserved2
� szPathName ���. x' � _OFSTRUCT .?AU_OFSTRUCT@@ y' � �
" Length ���
RootDirectory
< ObjectName ���
" Attributes ���
SecurityDescriptor ���
SecurityQualityOfService �B {' _OBJECT_ATTRIBUTES .?AU_OBJECT_ATTRIBUTES@@ �� |' . � tagLC_ID .?AUtagLC_ID@@ ��>
! wLanguage
! wCountry �
! wCodePage . ' tagLC_ID .?AUtagLC_ID@@ ��. onecore\external\sdk\inc\crt\crtdefs.h � �' �' � j � _PERFINFO_PFMAPPED_SECTION_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_INFORMATION@@ ��F
RangeBase
RangeEnd �
" CreatingProcessId j �' _PERFINFO_PFMAPPED_SECTION_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_INFORMATION@@ �� �' � l Z � _SYSTEM_VERIFIER_INFORMATION_EX .?AU_SYSTEM_VERIFIER_INFORMATION_EX@@ �
" VerifyMode ���
" OptionChanges
� PreviousBucketName ���
" IrpCancelTimeoutMsec �
" VerifierExtensionEnabled �
� Reserved �Z �' $ _SYSTEM_VERIFIER_INFORMATION_EX .?AU_SYSTEM_VERIFIER_INFORMATION_EX@@ �' � ~
}! ActiveFrame ��
� FrameListCache ���
" Flags
" NextCookieSequenceNumber �
" StackId ��N �' _ACTIVATION_CONTEXT_STACK .?AU_ACTIVATION_CONTEXT_STACK@@ �' � V � _PROCESS_WORKING_SET_CONTROL .?AU_PROCESS_WORKING_SET_CONTROL@@ ��:
" Version ��
Operation
" Flags V �' _PROCESS_WORKING_SET_CONTROL .?AU_PROCESS_WORKING_SET_CONTROL@@ �� �' W * � _FP_64 .?AU_FP_64@@ ��
� W * �' _FP_64 .?AU_FP_64@@ �� �' + : ^ BootLoad � SystemLoad ��� AutoLoad � DemandLoad ��� DisableLoad ��B t �' _CM_SERVICE_LOAD_TYPE .?AW4_CM_SERVICE_LOAD_TYPE@@ � �' � n � _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER@@
�'
� ~
" EpilogueCount
EpilogueByteCount
BranchDescriptorElementSize ��
! BranchDescriptorCount n �' _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER@@ �' [ � F � _POWER_USER_PRESENCE .?AU_POWER_USER_PRESENCE@@ ��
�'
� B UserNotPresent ��� UserPresent �� � UserUnknown ��J t �' POWER_USER_PRESENCE_TYPE .?AW4POWER_USER_PRESENCE_TYPE@@ ��� �' �
�' UserPresence �F �' _POWER_USER_PRESENCE .?AU_POWER_USER_PRESENCE@@ �� �' � J � tagEMRCREATECOLORSPACEW .?AUtagEMRCREATECOLORSPACEW@@
�'
� > � tagLOGCOLORSPACEW .?AUtagLOGCOLORSPACEW@@ j
emr ��
" ihCS �
�' lcs ��
" XdwFlags ��
" \cbData ���
K `Data �J �' dtagEMRCREATECOLORSPACEW .?AUtagEMRCREATECOLORSPACEW@@ �' � ^ � _RPC_BINDING_HANDLE_SECURITY_V1_W .?AU_RPC_BINDING_HANDLE_SECURITY_V1_W@@ R � _SEC_WINNT_AUTH_IDENTITY_W .?AU_SEC_WINNT_AUTH_IDENTITY_W@@ ��
�'
� > � _RPC_SECURITY_QOS .?AU_RPC_SECURITY_QOS@@
�'
� �
" Version ��
q ServerPrincName ��
" AuthnLevel ���
" AuthnSvc �
�' AuthIdentity �
�' SecurityQos ��^ �' _RPC_BINDING_HANDLE_SECURITY_V1_W .?AU_RPC_BINDING_HANDLE_SECURITY_V1_W@@ �' � : � tagGESTUREINFO .?AUtagGESTUREINFO@@ ���
u cbSize ���
" dwFlags ��
" dwID �
y hwndTarget ���
� ptsLocation ��
" dwInstanceID �
" dwSequenceID �
# ullArguments �
u ( cbExtraArgs ��: �' 0 tagGESTUREINFO .?AUtagGESTUREINFO@@ �� �' �< > � tagEMRPOLYLINE16 .?AUtagEMRPOLYLINE16@@ ��
�'
� F
emr ��
� rclBounds
" cpts �
� apts �> �' tagEMRPOLYLINE16 .?AUtagEMRPOLYLINE16@@ �� �' E
�"
�
' ��
�'
�
"
� > � _WOW64_LDT_ENTRY .?AU_WOW64_LDT_ENTRY@@ ��R
BaseMid ��
Flags1 ���
Flags2 ���
BaseHi ���: �' <anonymous-tag> .?AU<anonymous-tag>@@ �' �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
�' BaseMid ��
�' Type �
�' Dpl ��
�' Pres �
�' LimitHi ��
�' Sys ��
�' Reserved_0 ���
�' Default_Big ��
�' Granularity ��
�' BaseHi ���:
�' <anonymous-tag> .?AU<anonymous-tag>@@ �' � "
�' Bytes
�' Bits �2 �' <anonymous-tag> .?AT<anonymous-tag>@@ �' � >
! LimitLow �
! BaseLow ��
�' HighWord �> �' _WOW64_LDT_ENTRY .?AU_WOW64_LDT_ENTRY@@ �� �' �
?
� B � _MIDL_SERVER_INFO_ .?AU_MIDL_SERVER_INFO_@@ ��
w ��
�'
�
�'
�'
�
�'
�
N' �'
�'
�
�'
� > � _MIDL_SYNTAX_INFO .?AU_MIDL_SYNTAX_INFO@@
�'
� �
�' pStubDesc
�' DispatchTable
� ProcString ���
� FmtStringOffset ��
�' ThunkTable ���
� pTransferSyntax ��
" nCount ���
�' pSyntaxInfo ��B �' _MIDL_SERVER_INFO_ .?AU_MIDL_SERVER_INFO_@@ �� �' � p v � _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2@@
�'
� j � _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_ACCOUNTING_INFORMATION@@ J � _PROCESS_ENERGY_VALUES .?AU_PROCESS_ENERGY_VALUES@@ ���
�' BasicInfo
B 0 IoInfo ���
x ` DiskIoInfo ���
# � ContextSwitches ��
} � TotalCycleTime ���
# � ReadyTime
�' � EnergyValues �
# �KernelWaitTime ���
# �UserWaitTime �v �' �_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2@@ �' a �
c
�
J%
�
x
� � MandatoryLevelUntrusted �� MandatoryLevelLow MandatoryLevelMedium � MandatoryLevelHigh ��� MandatoryLevelSystem � MandatoryLevelSecureProcess �� MandatoryLevelCount ��: t �' _MANDATORY_LEVEL .?AW4_MANDATORY_LEVEL@@ ��� �' 6 � _RTL_BSD_ITEM .?AU_RTL_BSD_ITEM@@ ^ RtlBsdItemVersionNumber �� RtlBsdItemProductType RtlBsdItemAabEnabled � RtlBsdItemAabTimeout � RtlBsdItemBootGood ��� RtlBsdItemBootShutdown ��� RtlBsdSleepInProgress RtlBsdPowerTransition RtlBsdItemBootAttemptCount ��� RtlBsdItemBootCheckpoint �
RtlBsdItemBootId � RtlBsdItemShutdownBootId � RtlBsdItemReportedAbnormalShutdownBootId �
RtlBsdItemErrorInfo �� RtlBsdItemPowerButtonPressInfo ��� RtlBsdItemChecksum ��� RtlBsdPowerTransitionExtension ��� RtlBsdItemFeatureConfigurationState �� RtlBsdItemMax : t �' RTL_BSD_ITEM_TYPE .?AW4RTL_BSD_ITEM_TYPE@@ � �' � B B
�' Type �
DataBuffer ���
" DataLength ���6 �' _RTL_BSD_ITEM .?AU_RTL_BSD_ITEM@@ �' � X
�'
� r
�' pfnTranslateToXmit ���
�' pfnTranslateFromXmit �
�' pfnFreeXmit ��
�' pfnFreeInst ��J �' _XMIT_ROUTINE_QUINTUPLE .?AU_XMIT_ROUTINE_QUINTUPLE@@ �' � P F � tagMEASUREITEMSTRUCT .?AUtagMEASUREITEMSTRUCT@@ ��z
u CtlType ��
u CtlID
u itemID ���
u itemWidth
u itemHeight ���
" itemData �F ( tagMEASUREITEMSTRUCT .?AUtagMEASUREITEMSTRUCT@@ �� (
v � _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT@@ ��
(
� �
" Gsiv �
ControllerInterrupt ��
EdgeInterrupt
IsPrimaryInterrupt ���
� TargetAffinity ���v ( _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT@@ �� ( R � _SYSTEM_BIGPOOL_INFORMATION .?AU_SYSTEM_BIGPOOL_INFORMATION@@
(
� *
" Count
� AllocatedInfo R ( _SYSTEM_BIGPOOL_INFORMATION .?AU_SYSTEM_BIGPOOL_INFORMATION@@
( �
EventBasicInformation J t ( _EVENT_INFORMATION_CLASS .?AW4_EVENT_INFORMATION_CLASS@@ ��� ( a F � _NDR_CORRELATION_INFO .?AU_NDR_CORRELATION_INFO@@ Z � _TIME_DYNAMIC_ZONE_INFORMATION .?AU_TIME_DYNAMIC_ZONE_INFORMATION@@ ��
(
� �
Bias �
� StandardName �
� D StandardDate �
T StandardBias �
� X DaylightName �
� � DaylightDate �
� DaylightBias �
*$ � TimeZoneKeyName ��
�DynamicDaylightTimeDisabled ��Z ( �_TIME_DYNAMIC_ZONE_INFORMATION .?AU_TIME_DYNAMIC_ZONE_INFORMATION@@ �� ( � -
�
� Z � _SYSTEM_GDI_DRIVER_INFORMATION .?AU_SYSTEM_GDI_DRIVER_INFORMATION@@ ��J � _IMAGE_EXPORT_DIRECTORY .?AU_IMAGE_EXPORT_DIRECTORY@@
(
� �
� DriverName ���
ImageAddress �
SectionPointer ���
EntryPoint ���
( ExportSectionPointer �
" ImageLength ��Z ( _SYSTEM_GDI_DRIVER_INFORMATION .?AU_SYSTEM_GDI_DRIVER_INFORMATION@@ �� ( � J � _PO_WAKE_SOURCE_HISTORY .?AU_PO_WAKE_SOURCE_HISTORY@@
(
� &
" Count
� Offsets ��J !( _PO_WAKE_SOURCE_HISTORY .?AU_PO_WAKE_SOURCE_HISTORY@@ "( :
2 � ARRAY_INFO .?AUARRAY_INFO@@ ��
Dimension
" BufferConformanceMark
" BufferVarianceMark ���
" MaxCountArray
" OffsetArray ��
" ActualCountArray �2 %( ARRAY_INFO .?AUARRAY_INFO@@ �� &( � 5 N � _ACCESS_DENIED_OBJECT_ACE .?AU_ACCESS_DENIED_OBJECT_ACE@@
((
� �
o Header ���
" Mask �
" Flags
� ObjectType ���
� InheritedObjectType ��
" , SidStart �N *( 0 _ACCESS_DENIED_OBJECT_ACE .?AU_ACCESS_DENIED_OBJECT_ACE@@ +( � F � _IMAGE_SECTION_HEADER .?AU_IMAGE_SECTION_HEADER@@
-(
� 6
" PhysicalAddress ��
" VirtualSize ��2 /( <anonymous-tag> .?AT<anonymous-tag>@@ 0( [
� Name �
0( Misc �
" VirtualAddress ���
" SizeOfRawData
" PointerToRawData �
" PointerToRelocations �
" PointerToLinenumbers �
! NumberOfRelocations ��
! " NumberOfLinenumbers ��
" $ Characteristics ��F
2( ( _IMAGE_SECTION_HEADER .?AU_IMAGE_SECTION_HEADER@@ 3( [ Z � _SYSTEM_CALL_COUNT_INFORMATION .?AU_SYSTEM_CALL_COUNT_INFORMATION@@ ��
5(
� 2
" Length ���
" NumberOfTables ���Z 7( _SYSTEM_CALL_COUNT_INFORMATION .?AU_SYSTEM_CALL_COUNT_INFORMATION@@ �� 8( e R � _FILE_INTERNAL_INFORMATION .?AU_FILE_INTERNAL_INFORMATION@@ ��
} IndexNumber ��R ;( _FILE_INTERNAL_INFORMATION .?AU_FILE_INTERNAL_INFORMATION@@ �� <( � B � _SCOPE_TABLE_ARM64 .?AU_SCOPE_TABLE_ARM64@@ ��f
" BeginAddress �
" EndAddress ���
" HandlerAddress ���
" JumpTarget ���: ?( <anonymous-tag> .?AU<anonymous-tag>@@ @( # @( " �*
" Count
B( ScopeRecord ��B C( _SCOPE_TABLE_ARM64 .?AU_SCOPE_TABLE_ARM64@@ �� D(
d
� > � tagCREATESTRUCTW .?AUtagCREATESTRUCTW@@ ��
G(
� �
lpCreateParams ���
� hInstance
2 hMenu
y hwndParent ���
t cy ���
t cx ���
t y
t x
style
�% $ lpszName �
�% ( lpszClass
" , dwExStyle > I( 0 tagCREATESTRUCTW .?AUtagCREATESTRUCTW@@ �� J( � V � _RTL_USER_PROCESS_INFORMATION .?AU_RTL_USER_PROCESS_INFORMATION@@ R � _SECTION_IMAGE_INFORMATION .?AU_SECTION_IMAGE_INFORMATION@@ ��n
" Length ���
Process ��
Thread ���
� ClientId �
M( ImageInformation �V N( D _RTL_USER_PROCESS_INFORMATION .?AU_RTL_USER_PROCESS_INFORMATION@@ O( � - N � _TRACE_GUID_REGISTRATION .?AU_TRACE_GUID_REGISTRATION@@ ��&
� Guid �
RegHandle N R( _TRACE_GUID_REGISTRATION .?AU_TRACE_GUID_REGISTRATION@@ �� S( � � B � tagRID_DEVICE_INFO .?AUtagRID_DEVICE_INFO@@ ��^
" cbSize ���
" dwType ���
r' mouse
U' keyboard �
hid ��B V( tagRID_DEVICE_INFO .?AUtagRID_DEVICE_INFO@@ �� W( /; : � tagHELPWININFOA .?AUtagHELPWININFOA@@ p " �z
t wStructSize ��
t x
t y
t dx ���
t dy ���
t wMax �
Z( rgchMember ���: [( tagHELPWININFOA .?AUtagHELPWININFOA@@ \( �/ ^ � _SYSTEM_SPECIAL_POOL_INFORMATION .?AU_SYSTEM_SPECIAL_POOL_INFORMATION@@ ��&
" PoolTag ��
" Flags ^ _( _SYSTEM_SPECIAL_POOL_INFORMATION .?AU_SYSTEM_SPECIAL_POOL_INFORMATION@@ �� `( "
R � _SYSTEM_CPU_SET_INFORMATION .?AU_SYSTEM_CPU_SET_INFORMATION@@ CpuSetInformation J t c( _CPU_SET_INFORMATION_TYPE .?AW4_CPU_SET_INFORMATION_TYPE@@ � d( { P
��
��
��
��
��~
" Id ���
! Group
LogicalProcessorIndex
CoreIndex
LastLevelCacheIndex ��
NumaNodeIndex
EfficiencyClass ��
AllFlags �
f( Parked ���
g( Allocated
h( AllocatedToTargetProcess �
i( RealTime �
j( ReservedFlags
" Reserved �
SchedulingClass ��
# AllocationTag : k( <anonymous-tag> .?AU<anonymous-tag>@@ l( { X 6
" Size �
d( Type �
l( CpuSet ���R n( _SYSTEM_CPU_SET_INFORMATION .?AU_SYSTEM_CPU_SET_INFORMATION@@ o( { T j � _EVENT_EXTENDED_ITEM_PROCESS_START_KEY .?AU_EVENT_EXTENDED_ITEM_PROCESS_START_KEY@@ ��
q(
�
# ProcessStartKey ��j s( _EVENT_EXTENDED_ITEM_PROCESS_START_KEY .?AU_EVENT_EXTENDED_ITEM_PROCESS_START_KEY@@ �� t( � z v(
w(
� F � _TOKEN_DEVICE_CLAIMS .?AU_TOKEN_DEVICE_CLAIMS@@ ��
y(
�
DeviceClaims �F {( _TOKEN_DEVICE_CLAIMS .?AU_TOKEN_DEVICE_CLAIMS@@ �� |( � 2 � tagLOGBRUSH .?AUtagLOGBRUSH@@
~(
� >
u lbStyle ��
" lbColor ��
" lbHatch ��2 �( tagLOGBRUSH .?AUtagLOGBRUSH@@ �( K
X!
� > � _WOF_VERSION_INFO .?AU_WOF_VERSION_INFO@@
" WofVersion ���> �( _WOF_VERSION_INFO .?AU_WOF_VERSION_INFO@@ �( " .
pValue ���
" ValueLength ��v �( _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ �� �( ]
" ��
" ��B
�( KernelTransition �
�( Reserved �
" ul ���^ �( _QUERY_PERFORMANCE_COUNTER_FLAGS .?AU_QUERY_PERFORMANCE_COUNTER_FLAGS@@ �� �( �
~ PsProtectedTypeNone �� PsProtectedTypeProtectedLight PsProtectedTypeProtected � PsProtectedTypeMax ���> t �( _PS_PROTECTED_TYPE .?AW4_PS_PROTECTED_TYPE@@ ��� �( a { : AtomBasicInformation � AtomTableInformation �F t �( _ATOM_INFORMATION_CLASS .?AW4_ATOM_INFORMATION_CLASS@@ � �( b � _FILE_ID_GLOBAL_TX_DIR_INFORMATION .?AU_FILE_ID_GLOBAL_TX_DIR_INFORMATION@@ ��^
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
} @ FileId ���
� H LockingTransactionId �
" X TxInfoFlags ��
\ FileName �b �( ` _FILE_ID_GLOBAL_TX_DIR_INFORMATION .?AU_FILE_ID_GLOBAL_TX_DIR_INFORMATION@@ �� �( + & � _DCB .?AU_DCB@@ ��
�(
�
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ��
" ��
" ��R
" DCBlength
" BaudRate �
�( fBinary ��
�( fParity ��
�( fOutxCtsFlow �
�( fOutxDsrFlow �
�( fDtrControl ��
�( fDsrSensitivity ��
�( fTXContinueOnXoff
�( fOutX
�( fInX �
�( fErrorChar ���
�( fNull
�( fRtsControl ��
�( fAbortOnError
�( fDummy2 ��
! wReserved
! XonLim ���
! XoffLim ��
ByteSize �
Parity ���
StopBits �
p XonChar ��
p XoffChar �
p ErrorChar
p EofChar ��
p EvtChar ��
! wReserved1 ���& �( _DCB .?AU_DCB@@ �� �( � F � tagCOLORMATCHTOTARGET .?AUtagCOLORMATCHTOTARGET@@
�(
� r
emr ��
" dwAction �
" dwFlags ��
" cbName ���
" cbData ���
K Data �F �( tagCOLORMATCHTOTARGET .?AUtagCOLORMATCHTOTARGET@@ �( � B � _ALPC_SECURITY_ATTR .?AU_ALPC_SECURITY_ATTR@@
�
� :
" Flags
�( QoS ��
ContextHandle B �( _ALPC_SECURITY_ATTR .?AU_ALPC_SECURITY_ATTR@@ �( � � N � _SYSTEM_PREFETCH_OPTIONS .?AU_SYSTEM_PREFETCH_OPTIONS@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
�( LowerPriority
�( VirtualOffsets ���
�( TrickleIOs ���
�( SkipInStorePages �
�( PrefetchFilesByVa
�( SkipMemoryStorePages �
�( Spare
�( ScenarioType �N �( _SYSTEM_PREFETCH_OPTIONS .?AU_SYSTEM_PREFETCH_OPTIONS@@ �� �( � R � _PERFINFO_IPI_RECEIVE_DATA .?AU_PERFINFO_IPI_RECEIVE_DATA@@ ��J
# InitialTime ��
WorkerRoutine
" RequestType ��R �( _PERFINFO_IPI_RECEIVE_DATA .?AU_PERFINFO_IPI_RECEIVE_DATA@@ �� �( � > f � _ETW_UMS_EVENT_DIRECTED_SWITCH_START .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_START@@ ��
�(
� f
" ProcessId
" ScheduledThreadId
" PrimaryThreadId ��
" SwitchFlags ��f �( _ETW_UMS_EVENT_DIRECTED_SWITCH_START .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_START@@ �� �( � s ^ � tagACTCTX_SECTION_KEYED_DATA_2600 .?AUtagACTCTX_SECTION_KEYED_DATA_2600@@
" cbSize ���
" ulDataFormatVersion ��
lpData ���
" ulLength �
lpSectionGlobalData ��
" ulSectionGlobalDataLength
lpSectionBase
" ulSectionTotalLength �
hActCtx ��
" $ ulAssemblyRosterIndex ^
�( ( tagACTCTX_SECTION_KEYED_DATA_2600 .?AUtagACTCTX_SECTION_KEYED_DATA_2600@@ �( �
�
�
�&
� � IoSessionEventIgnore � IoSessionEventCreated IoSessionEventTerminated � IoSessionEventConnected �� IoSessionEventDisconnected ��� IoSessionEventLogon �� IoSessionEventLogoff � IoSessionEventMax : t �( _IO_SESSION_EVENT .?AW4_IO_SESSION_EVENT@@ � �( � � SystemMemoryPartitionInformation � SystemMemoryPartitionMoveMemory �� SystemMemoryPartitionAddPagefile � SystemMemoryPartitionCombineMemory ��� SystemMemoryPartitionInitialAddMemory SystemMemoryPartitionGetMemoryEvents � SystemMemoryPartitionSetAttributes ��� SystemMemoryPartitionNodeInformation � SystemMemoryPartitionCreateLargePages SystemMemoryPartitionMax �R
t �( _PARTITION_INFORMATION_CLASS .?AW4_PARTITION_INFORMATION_CLASS@@ ��� �( a �
n
" Length ���
� ImpersonationLevel ���
ContextTrackingMode ��
EffectiveOnly V �( _SECURITY_QUALITY_OF_SERVICE .?AU_SECURITY_QUALITY_OF_SERVICE@@ �� �( D
f � _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA .?AU_PLUGPLAY_CONTROL_RELATED_DEVICE_DATA@@
�(
� ~
� TargetDeviceInstance �
" Relation �
q RelatedDeviceInstance
" RelatedDeviceInstanceLength ��f �( _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA .?AU_PLUGPLAY_CONTROL_RELATED_DEVICE_DATA@@ �( � c N � _TIMER_BASIC_INFORMATION .?AU_TIMER_BASIC_INFORMATION@@ ��
�(
� 2
} RemainingTime
TimerState ���N �( _TIMER_BASIC_INFORMATION .?AU_TIMER_BASIC_INFORMATION@@ �� �( � B � _IMAGE_THUNK_DATA32 .?AU_IMAGE_THUNK_DATA32@@ ^
" ForwarderString ��
" Function �
" Ordinal ��
" AddressOfData 2 �( <anonymous-tag> .?AT<anonymous-tag>@@ �( [ �
�( u1 ���B �( _IMAGE_THUNK_DATA32 .?AU_IMAGE_THUNK_DATA32@@ �( [ � b � _EVENT_TRACE_TAG_FILTER_INFORMATION .?AU_EVENT_TRACE_TAG_FILTER_INFORMATION@@ V
� EventTraceInformationClass ���
# TraceHandle ��
� Filter ���b �( _EVENT_TRACE_TAG_FILTER_INFORMATION .?AU_EVENT_TRACE_TAG_FILTER_INFORMATION@@ �( � : � _XSAVE_FEATURE .?AU_XSAVE_FEATURE@@ �� �( " �
" Version ��
" Size �
" Flags
" MaxSaveAreaLength
# FeatureBitmask ���
" NumberOfFeatures �
�( Features �6 �( 0 _XSAVE_POLICY .?AU_XSAVE_POLICY@@ �( � � V � _SET_PURGE_FAILURE_MODE_INPUT .?AU_SET_PURGE_FAILURE_MODE_INPUT@@
" Flags V �( _SET_PURGE_FAILURE_MODE_INPUT .?AU_SET_PURGE_FAILURE_MODE_INPUT@@ �( �
�
� : � MOVE_FILE_DATA .?AUMOVE_FILE_DATA@@ ��
�(
� b
FileHandle ���
} StartingVcn ��
} StartingLcn ��
" ClusterCount �: �( MOVE_FILE_DATA .?AUMOVE_FILE_DATA@@ �� �( �
r � _EVENT_TRACE_IPT_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_IPT_CONFIGURATION_INFORMATION@@ ��b
� EventTraceInformationClass ���
# TraceHandle ��
# ConfigurationOptions �r ) _EVENT_TRACE_IPT_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_IPT_CONFIGURATION_INFORMATION@@ �� ) � � N � _ETW_SET_MARK_INFORMATION .?AU_ETW_SET_MARK_INFORMATION@@ "
" Flag �
Mark �N ) _ETW_SET_MARK_INFORMATION .?AU_ETW_SET_MARK_INFORMATION@@ ) � � V � _WMI_IMAGELOAD_INFORMATION64 .?AU_WMI_IMAGELOAD_INFORMATION64@@ ��
)
� :
# ImageBase64 ��
# ImageSize64 ��
" ProcessId
" ImageChecksum
" TimeDateStamp
SignatureLevel ���
SignatureType
! Reserved0
# DefaultBase64
" ( Reserved1
" , Reserved2
" 0 Reserved3
" 4 Reserved4
8 FileName �V ) @ _WMI_IMAGELOAD_INFORMATION64 .?AU_WMI_IMAGELOAD_INFORMATION64@@ ��
) � f
(
�
8 "
)
�%
� J � _ETW_WAKE_COUNTER_EVENT .?AU_ETW_WAKE_COUNTER_EVENT@@ J
Object ���
" Tag ��
" ProcessId
Count J ) _ETW_WAKE_COUNTER_EVENT .?AU_ETW_WAKE_COUNTER_EVENT@@ ) �
V � _MEMORY_WORKING_SET_EX_BLOCK .?AU_MEMORY_WORKING_SET_EX_BLOCK@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
) Valid
!) Reserved0
") Shared ���
#) Reserved1
$) PageTable
%) Location �
&) Priority �
') ModifiedList �
() Reserved2
)) SharedOriginal ���
*) Bad ��: +) <anonymous-tag> .?AU<anonymous-tag>@@ ,) ^ �
) Valid
) ShareCount ���
) Win32Protection ��
) Shared ���
) Node �
) Locked ���
) LargePage
) Priority �
) Reserved �
) SharedOriginal ���
) Bad ��
,) Invalid ��V .) _MEMORY_WORKING_SET_EX_BLOCK .?AU_MEMORY_WORKING_SET_EX_BLOCK@@ �� /) J V � _THREAD_PROFILING_INFORMATION .?AU_THREAD_PROFILING_INFORMATION@@ N � _THREAD_PERFORMANCE_DATA .?AU_THREAD_PERFORMANCE_DATA@@ ��
2)
� ^
# HardwareCounters �
" Flags
" Enable ���
3) PerformanceData ��V 4) _THREAD_PROFILING_INFORMATION .?AU_THREAD_PROFILING_INFORMATION@@ 5) a � > � _ARM64_NT_CONTEXT .?AU_ARM64_NT_CONTEXT@@ # " � �
" �
" ContextFlags �
" Cpsr �
# X0 ���
# X1 ���
# X2 ���
# X3 ���
# ( X4 ���
# 0 X5 ���
# 8 X6 ���
# @ X7 ���
# H X8 ���
# P X9 ���
# X X10 ��
# ` X11 ��
# h X12 ��
# p X13 ��
# x X14 ��
# � X15 ��
# � X16 ��
# � X17 ��
# � X18 ��
# � X19 ��
# � X20 ��
# � X21 ��
# � X22 ��
# � X23 ��
# � X24 ��
# � X25 ��
# � X26 ��
# � X27 ��
# � X28 ��
# � Fp ���
# � Lr ���
8) X
# Sp ���
# Pc ���
9) V
" Fpcr �
" Fpsr �
� Bcr ��
� 8Bvr ��
� xWcr ��
� �Wvr ��> + :) �_ARM64_NT_CONTEXT .?AU_ARM64_NT_CONTEXT@@ ;) 7 z EtwRtEventNoLoss � EtwRtEventLost ��� EtwRtBufferLost �� EtwRtBackupLost �� EtwRtEventLossMax > t =) _ETW_RT_EVENT_LOSS .?AW4_ETW_RT_EVENT_LOSS@@ ��� >) � � � DeviceWakeSourceType � FixedWakeSourceType �� TimerWakeSourceType �� TimerPresumedWakeSourceType �� InternalWakeSourceType ���> t @) PO_WAKE_SOURCE_TYPE .?AW4PO_WAKE_SOURCE_TYPE@@ � A)
V � _PROCESS_HANDLE_TRACING_QUERY .?AU_PROCESS_HANDLE_TRACING_QUERY@@
C)
� V � _PROCESS_HANDLE_TRACING_ENTRY .?AU_PROCESS_HANDLE_TRACING_ENTRY@@ E) " P �F
Handle ���
" TotalTraces ��
F) HandleTrace ��V G) X _PROCESS_HANDLE_TRACING_QUERY .?AU_PROCESS_HANDLE_TRACING_QUERY@@ H) C U
$
� > � tagMULTIKEYHELPW .?AUtagMULTIKEYHELPW@@ ��
K)
� B
" mkSize ���
q mkKeylist
szKeyphrase ��> M) tagMULTIKEYHELPW .?AUtagMULTIKEYHELPW@@ �� N) �/
v
� :
Action ���
" Flags
" EventCode B Q) POWER_ACTION_POLICY .?AUPOWER_ACTION_POLICY@@ R) �
: � _X86_CALL_FRAME .?AU_X86_CALL_FRAME@@ ^
" ReturnAddress
" Param1 ���
" Param2 ���
" CompatibilityArea : U) _X86_CALL_FRAME .?AU_X86_CALL_FRAME@@ V) a �
. � _STRING32 .?AU_STRING32@@ B
! Length ���
! MaximumLength
" Buffer ���. Y) _STRING32 .?AU_STRING32@@ Z) � j � _SYSTEM_THREAD_CID_PRIORITY_INFORMATION .?AU_SYSTEM_THREAD_CID_PRIORITY_INFORMATION@@ *
� ClientId �
Priority �j ]) _SYSTEM_THREAD_CID_PRIORITY_INFORMATION .?AU_SYSTEM_THREAD_CID_PRIORITY_INFORMATION@@ ^)
Z � _PERFINFO_PPM_PERF_STATE_CHANGE .?AU_PERFINFO_PPM_PERF_STATE_CHANGE@@ f
" Type �
" NewState �
" OldState �
Result ���
# Processors ���Z a) _PERFINFO_PPM_PERF_STATE_CHANGE .?AU_PERFINFO_PPM_PERF_STATE_CHANGE@@ b) � R > � tagGESTURECONFIG .?AUtagGESTURECONFIG@@ ��
d)
� :
" dwID �
" dwWant ���
" dwBlock ��> f) tagGESTURECONFIG .?AUtagGESTURECONFIG@@ �� g) = * � _M128A .?AU_M128A@@ ��
i)
� "
# Low ��
High �* k) _M128A .?AU_M128A@@ �� l) � � T R � _SYSTEM_CONSOLE_INFORMATION .?AU_SYSTEM_CONSOLE_INFORMATION@@
" ��
" ��*
p) DriverLoaded �
q) Spare R r) _SYSTEM_CONSOLE_INFORMATION .?AU_SYSTEM_CONSOLE_INFORMATION@@ s) � V � _PERFINFO_FILE_PATH_OPERATION .?AU_PERFINFO_FILE_PATH_OPERATION@@
u)
� �
" Irp ��
" FileObject ���
" FileKey ��
" ExtraInformation �
" IssuingThreadId ��
" InfoClass
Path �V w) _PERFINFO_FILE_PATH_OPERATION .?AU_PERFINFO_FILE_PATH_OPERATION@@ x) � t � " " z)
r!
� . � _NT_TIB64 .?AU_NT_TIB64@@
})
� �
# ExceptionList
# StackBase
# StackLimit ���
# SubSystemTib �
# FiberData
" Version ��
# ( ArbitraryUserPointer �
# 0 Self �. ) 8 _NT_TIB64 .?AU_NT_TIB64@@ �) C ? b � _SE_LEARNING_MODE_USER_OBJECT_DATA .?AU_SE_LEARNING_MODE_USER_OBJECT_DATA@@ ��F
" Cookie ���
< ObjectType ���
< ObjectName ���b �) _SE_LEARNING_MODE_USER_OBJECT_DATA .?AU_SE_LEARNING_MODE_USER_OBJECT_DATA@@ �� �) ] : � _ACCESS_REASONS .?AU_ACCESS_REASONS@@
�)
� " " � �
�) Data �: �) � _ACCESS_REASONS .?AU_ACCESS_REASONS@@ �) � �
" NextEntryOffset ��
" Source ���
" MinInterval ��
" MaxInterval ��
# Reserved �
Description ��F �) _PROFILE_SOURCE_INFO .?AU_PROFILE_SOURCE_INFO@@ �� �) � : � _FAT_STATISTICS .?AU_FAT_STATISTICS@@
" CreateHits ���
" SuccessfulCreates
" FailedCreates
" NonCachedReads ���
" NonCachedReadBytes ���
" NonCachedWrites ��
" NonCachedWriteBytes ��
" NonCachedDiskReads ���
" NonCachedDiskWrites ��: �) $ _FAT_STATISTICS .?AU_FAT_STATISTICS@@ �) @
�
�
�"
� & � _MAT2 .?AU_MAT2@@
�)
� B
L eM11 �
L eM12 �
L eM21 �
L eM22 �& �) _MAT2 .?AU_MAT2@@ �) n
: � BITMAPV4HEADER .?AUBITMAPV4HEADER@@ ��
�)
� �
" bV4Size ��
bV4Width �
bV4Height
! bV4Planes
! bV4BitCount ��
" bV4V4Compression �
" bV4SizeImage �
bV4XPelsPerMeter �
bV4YPelsPerMeter �
" bV4ClrUsed ���
" $ bV4ClrImportant ��
" ( bV4RedMask ���
" , bV4GreenMask �
" 0 bV4BlueMask ��
" 4 bV4AlphaMask �
" 8 bV4CSType
; < bV4Endpoints �
" ` bV4GammaRed ��
" d bV4GammaGreen
" h bV4GammaBlue �: �) l BITMAPV4HEADER .?AUBITMAPV4HEADER@@ �� �) B F � _PLUGPLAY_EVENT_BLOCK .?AU_PLUGPLAY_EVENT_BLOCK@@ 2
� ClassGuid
SymbolicLinkName �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � L
DeviceId �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � Q
DeviceId �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � U 6
NotificationStructure
DeviceId �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � Y
Notification �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � ^ :
" NotificationCode �
" NotificationData �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � b :
u VetoType �
DeviceIdVetoNameBuffer ���: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � g
� BlockedDriverGuid : �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � l
ParentId �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � p j
� PowerSettingGuid �
" Flags
" SessionId
" DataLength ���
| Data �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � t
DeviceId �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � |
DeviceId �: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) � � z
�) DeviceClass ��
�) TargetDevice �
�) InstallDevice
�) CustomNotification ���
�) ProfileNotification ��
�) PowerNotification
�) VetoNotification �
�) BlockedDriverNotification
�) InvalidIDNotification
�) PowerSettingNotification �
�) PropertyChangeNotification ���
�) DeviceInstanceNotification ���2 �) <anonymous-tag> .?AT<anonymous-tag>@@ �) � J �
� EventGuid
/# EventCategory
" Result ���
" Flags
" TotalSize
DeviceObject �
�) $ u F �) D _PLUGPLAY_EVENT_BLOCK .?AU_PLUGPLAY_EVENT_BLOCK@@ �) � ?
!
� N � _ALPC_MESSAGE_ATTRIBUTES .?AU_ALPC_MESSAGE_ATTRIBUTES@@ ��
�)
� >
" AllocatedAttributes ��
" ValidAttributes ��N �) _ALPC_MESSAGE_ATTRIBUTES .?AU_ALPC_MESSAGE_ATTRIBUTES@@ �� �) � � ~ NormalizationOther ��� NormalizationC ��� NormalizationD ��� NormalizationKC �� NormalizationKD ��. t �) _NORM_FORM .?AW4_NORM_FORM@@ ��� �) � A B � tagMDICREATESTRUCTA .?AUtagMDICREATESTRUCTA@@ �
7 szClass ��
7 szTitle ��
hOwner ���
t x
t y
t cx ���
t cy ���
" style
lParam ���B �) $ tagMDICREATESTRUCTA .?AUtagMDICREATESTRUCTA@@ �) �. 6 � tagPOLYTEXTA .?AUtagPOLYTEXTA@@ ��
�)
� j
t x
t y
u n
7 lpstr
u uiFlags ��
� rcl ��
t $ pdx ��6 �) ( tagPOLYTEXTA .?AUtagPOLYTEXTA@@ �� �) =
� EtwStartLoggerCode ��� EtwStopLoggerCode EtwQueryLoggerCode ��� EtwUpdateLoggerCode �� EtwFlushLoggerCode ��� EtwIncrementFileCode � EtwActivityIdCreate ��
EtwWdiScenarioCode ��� EtwWdiSemUpdate ��> t �) ETWTRACECONTROLCODE .?AW4ETWTRACECONTROLCODE@@ � �) � < f � _PERFINFO_SAMPLED_PROFILE_INFORMATION .?AU_PERFINFO_SAMPLED_PROFILE_INFORMATION@@
�)
�
��
��
��
��
InstructionPointer ���
" ThreadId �
! Count
�)
ExecutingDpc �
�)
ExecutingIsr �
�)
Reserved �
�)
Priority �
Flags
Rank �f �) _PERFINFO_SAMPLED_PROFILE_INFORMATION .?AU_PERFINFO_SAMPLED_PROFILE_INFORMATION@@ �) � { v ServiceRegistryStateParameters ��� ServiceRegistryStatePersistent ��� MaxServiceRegistryStateType ��N t �) SERVICE_REGISTRY_STATE_TYPE .?AW4SERVICE_REGISTRY_STATE_TYPE@@ � �) 3 J � _ENCLAVE_INIT_INFO_VBS .?AU_ENCLAVE_INIT_INFO_VBS@@ ��.
" Length ���
" ThreadCount ��J �) _ENCLAVE_INIT_INFO_VBS .?AU_ENCLAVE_INIT_INFO_VBS@@ �� �) ? � f � _FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT .?AU_FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT@@ ��
" NumaNode �f �) _FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT .?AU_FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT@@ �� �) �* V � _ETW_TP_EVENT_CALLBACK_CANCEL .?AU_ETW_TP_EVENT_CALLBACK_CANCEL@@
�)
� �
� Header ���
PoolId ���
$ TaskId ���
( Callback �
, Context ��
0 SubProcessTag
" 4 CancelCount ��V �) 8 _ETW_TP_EVENT_CALLBACK_CANCEL .?AU_ETW_TP_EVENT_CALLBACK_CANCEL@@ �) � � J � _FILE_PIPE_PEEK_BUFFER .?AU_FILE_PIPE_PEEK_BUFFER@@ ��~
" NamedPipeState ���
" ReadDataAvailable
" NumberOfMessages �
" MessageLength
� Data �J �) _FILE_PIPE_PEEK_BUFFER .?AU_FILE_PIPE_PEEK_BUFFER@@ �� �) ) �
" dwStreamNumber ���
" dwReserved ���
hSourceFile ��
hDestinationFile �
� uliChunkNumber ���
� uliChunkSize �
� uliStreamSize
� ( uliTotalFileSize �: �) 0 <anonymous-tag> .?AU<anonymous-tag>@@ �) c
" dwStreamNumber ���
" dwFlags ��
hSourceFile ��
hDestinationFile �
� uliChunkNumber ���
� uliChunkSize �
� uliStreamSize
� ( uliStreamBytesTransferred
� 0 uliTotalFileSize �
� 8 uliTotalBytesTransferred �:
�) @ <anonymous-tag> .?AU<anonymous-tag>@@ * n �
" dwStreamNumber ���
" dwReserved ���
hSourceFile ��
hDestinationFile �
� uliStreamSize
� uliTotalFileSize �: * <anonymous-tag> .?AU<anonymous-tag>@@ * { �
" dwStreamNumber ���
" dwReserved ���
hSourceFile ��
hDestinationFile �
� uliStreamSize
� uliStreamBytesTransferred
� uliTotalFileSize �
� ( uliTotalBytesTransferred �: * 0 <anonymous-tag> .?AU<anonymous-tag>@@ * �
" dwReserved ���: * <anonymous-tag> .?AU<anonymous-tag>@@ * � COPYFILE2_PHASE_NONE � COPYFILE2_PHASE_PREPARE_SOURCE ��� COPYFILE2_PHASE_PREPARE_DEST � COPYFILE2_PHASE_READ_SOURCE �� COPYFILE2_PHASE_WRITE_DESTINATION COPYFILE2_PHASE_SERVER_COPY �� COPYFILE2_PHASE_NAMEGRAFT_COPY ��� COPYFILE2_PHASE_MAX ��B t * _COPYFILE2_COPY_PHASE .?AW4_COPYFILE2_COPY_PHASE@@ � * N �
* CopyPhase
" dwStreamNumber ���
hrFailure
" dwReserved ���
� uliChunkNumber ���
� uliStreamSize
� uliStreamBytesTransferred
� ( uliTotalFileSize �
� 0 uliTotalBytesTransferred �: * 8 <anonymous-tag> .?AU<anonymous-tag>@@ * � �
�) ChunkStarted �
* ChunkFinished
* StreamStarted
* StreamFinished ���
* PollContinue �
* Error 2 * @ <anonymous-tag> .?AT<anonymous-tag>@@ * a 6
�& Type �
" dwPadding
* Info �> * H COPYFILE2_MESSAGE .?AUCOPYFILE2_MESSAGE@@ * \ V � _MEMORY_PRIORITY_INFORMATION .?AU_MEMORY_PRIORITY_INFORMATION@@ ��
" MemoryPriority ���V * _MEMORY_PRIORITY_INFORMATION .?AU_MEMORY_PRIORITY_INFORMATION@@ �� * 1 :
}
� > � _KEY_EVENT_RECORD .?AU_KEY_EVENT_RECORD@@ .
q UnicodeChar ��
p AsciiChar 2 * <anonymous-tag> .?AT<anonymous-tag>@@ * 5 �
t bKeyDown �
! wRepeatCount �
! wVirtualKeyCode ��
! wVirtualScanCode �
*
uChar
" dwControlKeyState > * _KEY_EVENT_RECORD .?AU_KEY_EVENT_RECORD@@ !* 0 Z � _PLUGPLAY_CONTROL_INSTALL_DATA .?AU_PLUGPLAY_CONTROL_INSTALL_DATA@@ ��.
" BufferLength �
q Buffer ���Z $* _PLUGPLAY_CONTROL_INSTALL_DATA .?AU_PLUGPLAY_CONTROL_INSTALL_DATA@@ �� %* � � . � _TP_TIMER .?AU_TP_TIMER@@
'*
� � (* )*
**
� 6 � tagTOUCHINPUT .?AUtagTOUCHINPUT@@ �
x
y
hSource ��
" dwID �
" dwFlags ��
" dwMask ���
" dwTime ���
" dwExtraInfo ��
" cxContact
" $ cyContact 6
-* ( tagTOUCHINPUT .?AUtagTOUCHINPUT@@ .* b � _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_EX@@ v
ClientSession
ClientProcess
! ClientComputerNameLength �
?
ClientComputerBuffer �b 1* , _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_EX@@ 2* K) � JOBOBJECT_IO_ATTRIBUTION_CONTROL_ENABLE �� JOBOBJECT_IO_ATTRIBUTION_CONTROL_DISABLE � JOBOBJECT_IO_ATTRIBUTION_CONTROL_VALID_FLAGS �f t 4* JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS .?AW4JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS@@ ��� 5* C � � DISPLAYCONFIG_PIXELFORMAT_8BPP ��� DISPLAYCONFIG_PIXELFORMAT_16BPP �� DISPLAYCONFIG_PIXELFORMAT_24BPP �� DISPLAYCONFIG_PIXELFORMAT_32BPP �� DISPLAYCONFIG_PIXELFORMAT_NONGDI � ��DISPLAYCONFIG_PIXELFORMAT_FORCE_UINT32 ��J t 7* DISPLAYCONFIG_PIXELFORMAT .?AW4DISPLAYCONFIG_PIXELFORMAT@@ � 8* R
�
� PoSleepDisableReasonVideo PoSleepDisableReasonHypervisor ��� PoSleepDisableReasonVhdBoot �� PoSleepDisableReasonPortableWorkspace PoSleepDisableReasonPolicy ��� PoSleepDisableReasonGuardedHost �� PoSleepDisableReasonMax ��J t ;* _PO_SLEEP_DISABLE_REASON .?AW4_PO_SLEEP_DISABLE_REASON@@ ��� <* F
R � _HEAP_AFFINITY_SLOT_ASSIGN .?AU_HEAP_AFFINITY_SLOT_ASSIGN@@ ��Z
� Header ���
HeapHandle ���
$ SubSegment ���
" ( SlotIndex R ?* , _HEAP_AFFINITY_SLOT_ASSIGN .?AU_HEAP_AFFINITY_SLOT_ASSIGN@@ �� @* � t
#
� 6 NotificationEvent SynchronizationEvent �. t C* _EVENT_TYPE .?AW4_EVENT_TYPE@@ � D* �
q t F*
G*
�
| DataBuffer ���: I* <anonymous-tag> .?AU<anonymous-tag>@@ J* V# �
" ReparseTag ���
! ReparseDataLength
! Reserved �
� ReparseGuid ��
J* GenericReparseBuffer �N L* _REPARSE_GUID_DATA_BUFFER .?AU_REPARSE_GUID_DATA_BUFFER@@ M* Q# F � tagWNODE_SINGLE_ITEM .?AUtagWNODE_SINGLE_ITEM@@ ��
5 WnodeHeader ��
" 0 OffsetInstanceName ���
" 4 InstanceIndex
" 8 ItemId ���
" < DataBlockOffset ��
" @ SizeDataItem �
y D VariableData �F P* H tagWNODE_SINGLE_ITEM .?AUtagWNODE_SINGLE_ITEM@@ �� Q* 8 � > � tagDRAWITEMSTRUCT .?AUtagDRAWITEMSTRUCT@@
S*
� �
u CtlType ��
u CtlID
u itemID ���
u itemAction ���
u itemState
y hwndItem �
b hDC ��
� rcItem ���
" , itemData �> U* 0 tagDRAWITEMSTRUCT .?AUtagDRAWITEMSTRUCT@@ V*
"
� N
! Flags
! Length ���
" TimeStamp
A DosPath ��N Y* _RTL_DRIVE_LETTER_CURDIR .?AU_RTL_DRIVE_LETTER_CURDIR@@ �� Z*
� B � tagKBDLLHOOKSTRUCT .?AUtagKBDLLHOOKSTRUCT@@ ��
]*
� b
" vkCode ���
" scanCode �
" flags
" time �
" dwExtraInfo ��B _* tagKBDLLHOOKSTRUCT .?AUtagKBDLLHOOKSTRUCT@@ �� `* [ V � _SECTION_IMAGE_INFORMATION32 .?AU_SECTION_IMAGE_INFORMATION32@@ ��
b*
�
��
��
��n
" TransferAddress ��
" ZeroBits �
" MaximumStackSize �
" CommittedStackSize ���
" SubSystemType
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���
! ImageCharacteristics �
! DllCharacteristics ���
! Machine ��
" ImageContainsCode
# ImageFlags ���
d* # ComPlus ��
e* # ImageDynamicallyRelocated
f* # Reserved �
" $ LoaderFlags ��
" ( ImageFileSize
" , CheckSum �V g* 0 _SECTION_IMAGE_INFORMATION32 .?AU_SECTION_IMAGE_INFORMATION32@@ �� h* � Z � _FILE_IO_COMPLETION_INFORMATION .?AU_FILE_IO_COMPLETION_INFORMATION@@ > � _IO_STATUS_BLOCK .?AU_IO_STATUS_BLOCK@@ ��J
KeyContext ���
ApcContext ���
k* IoStatusBlock Z l* _FILE_IO_COMPLETION_INFORMATION .?AU_FILE_IO_COMPLETION_INFORMATION@@ m* � �
�
� b � _SYSTEM_SESSION_PROCESS_INFORMATION .?AU_SYSTEM_SESSION_PROCESS_INFORMATION@@
p*
� >
" SessionId
" SizeOfBuf
Buffer ���b r* _SYSTEM_SESSION_PROCESS_INFORMATION .?AU_SYSTEM_SESSION_PROCESS_INFORMATION@@ s* @ : � tagEXTLOGFONTW .?AUtagEXTLOGFONTW@@ ��
u*
� " ��
� elfLogFont ���
� \ elfFullName ��
� � elfStyle �
" elfVersion ���
" elfStyleSize �
" $elfMatch �
" (elfReserved ��
w* ,elfVendorId ��
" 0elfCulture ���
� 4elfPanose :
x* @tagEXTLOGFONTW .?AUtagEXTLOGFONTW@@ �� y* b � _TRANSACTION_PROPERTIES_INFORMATION .?AU_TRANSACTION_PROPERTIES_INFORMATION@@
{*
� �
" IsolationLevel ���
" IsolationFlags ���
} Timeout ��
" Outcome ��
" DescriptionLength
Description ��b }* _TRANSACTION_PROPERTIES_INFORMATION .?AU_TRANSACTION_PROPERTIES_INFORMATION@@ ~* � � B � _FOCUS_EVENT_RECORD .?AU_FOCUS_EVENT_RECORD@@
�*
�
t bSetFocus B �* _FOCUS_EVENT_RECORD .?AU_FOCUS_EVENT_RECORD@@ �* v
� R � _ETW_UMS_EVENT_DISASSOCIATE .?AU_ETW_UMS_EVENT_DISASSOCIATE@@ �
" ProcessId
" ScheduledThreadId
" PrimaryThreadId ��
" UmsApcControlFlags ���
Status ���R �* _ETW_UMS_EVENT_DISASSOCIATE .?AU_ETW_UMS_EVENT_DISASSOCIATE@@ �* � � J � _ETW_HEAP_EVENT_CREATE .?AU_ETW_HEAP_EVENT_CREATE@@ ��
� Header ���
HeapHandle ���
" $ Flags
" ( ReserveSize ��
" , CommitSize ���
" 0 AllocatedSize J �* 4 _ETW_HEAP_EVENT_CREATE .?AU_ETW_HEAP_EVENT_CREATE@@ �� �* � > � tagCREATESTRUCTA .?AUtagCREATESTRUCTA@@ ��
�*
� �
lpCreateParams ���
� hInstance
2 hMenu
y hwndParent ���
t cy ���
t cx ���
t y
t x
style
7 $ lpszName �
7 ( lpszClass
" , dwExStyle > �* 0 tagCREATESTRUCTA .?AUtagCREATESTRUCTA@@ �� �* z B � _OUTLINETEXTMETRICW .?AU_OUTLINETEXTMETRICW@@
�*
� Z
u otmSize ��
� otmTextMetrics ���
@ otmFiller
� A otmPanoseNumber ��
u L otmfsSelection ���
u P otmfsType
t T otmsCharSlopeRise
t X otmsCharSlopeRun �
t \ otmItalicAngle ���
u ` otmEMSquare ��
t d otmAscent
t h otmDescent ���
u l otmLineGap ���
u p otmsCapEmHeight ��
u t otmsXHeight ��
� x otmrcFontBox �
t � otmMacAscent �
t � otmMacDescent
u � otmMacLineGap
u � otmusMinimumPPEM �
x � otmptSubscriptSize ���
x � otmptSubscriptOffset �
x � otmptSuperscriptSize �
x � otmptSuperscriptOffset ���
u � otmsStrikeoutSize
t � otmsStrikeoutPosition
t � otmsUnderscoreSize ���
t � otmsUnderscorePosition ���
p � otmpFamilyName ���
p � otmpFaceName �
p � otmpStyleName
p � otmpFullName �B �* � _OUTLINETEXTMETRICW .?AU_OUTLINETEXTMETRICW@@ �*
� CmResourceShareUndetermined �� CmResourceShareDeviceExclusive ��� CmResourceShareDriverExclusive ��� CmResourceShareShared B t �* _CM_SHARE_DISPOSITION .?AW4_CM_SHARE_DISPOSITION@@ � �* � b � _MEMORY_WORKING_SET_EX_INFORMATION .?AU_MEMORY_WORKING_SET_EX_INFORMATION@@ ��.
) VirtualAttributes
" Long �2 �* <anonymous-tag> .?AT<anonymous-tag>@@ �* z .
VirtualAddress ���
�* u1 ���b �* _MEMORY_WORKING_SET_EX_INFORMATION .?AU_MEMORY_WORKING_SET_EX_INFORMATION@@ �� �* x n � _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2@@ ��b � _JOBOBJECT_BASIC_LIMIT_INFORMATION .?AU_JOBOBJECT_BASIC_LIMIT_INFORMATION@@ ���
�* BasicLimitInformation
B 0 IoInfo ���
" ` ProcessMemoryLimit ���
" d JobMemoryLimit ���
" h PeakProcessMemoryUsed
" l PeakJobMemoryUsed
" p JobTotalMemoryLimit ��n �* x _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2@@ �� �* C o j � _MEMORY_PHYSICAL_CONTIGUITY_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_INFORMATION@@
� �
VirtualAddress ���
" Size �
" ContiguityUnitSize ���
" Flags
�* ContiguityUnitInformation j �* _MEMORY_PHYSICAL_CONTIGUITY_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_INFORMATION@@ �* �
�"
� B � PPM_IDLESTATE_EVENT .?AUPPM_IDLESTATE_EVENT@@
�*
� B
" NewState �
" OldState �
# Processors ���B �* PPM_IDLESTATE_EVENT .?AUPPM_IDLESTATE_EVENT@@ �* �
N � _VOLUME_REFS_INFO_BUFFER .?AU_VOLUME_REFS_INFO_BUFFER@@ ��b
} CacheSizeInBytes �
} AllocatedCacheInBytes
} PopulatedCacheInBytes
} InErrorCacheInBytes ��
} MemoryUsedForCacheMetadata ���
" ( CacheLineSize
, CacheTransactionsOutstanding �
0 CacheLinesFree ���
4 CacheLinesInError
} 8 CacheHitsInBytes �
} @ CacheMissesInBytes ���
} H CachePopulationUpdatesInBytes
} P CacheWriteThroughUpdatesInBytes ��
} X CacheInvalidationsInBytes
} ` CacheOverReadsInBytes
} h MetadataWrittenBytes �
p CacheHitCounter ��
t CacheMissCounter �
x CacheLineAllocationCounter ���
| CacheInvalidationsCounter
� CachePopulationUpdatesCounter
� CacheWriteThroughUpdatesCounter ��
� MaxCacheTransactionsOutstanding ��
� DataWritesReallocationCount ��
� DataInPlaceWriteCount
� MetadataAllocationsFastTierCount �
� MetadataAllocationsSlowTierCount �
� DataAllocationsFastTierCount �
� DataAllocationsSlowTierCount �
� DestagesSlowTierToFastTier ���
� DestagesFastTierToSlowTier ���
� SlowTierDataFillRatio
� FastTierDataFillRatio
� SlowTierMetadataFillRatio
� FastTierMetadataFillRatio
� SlowToFastDestageReadLatency �
� SlowToFastDestageReadLatencyBase �
� SlowToFastDestageWriteLatency
� SlowToFastDestageWriteLatencyBase
� FastToSlowDestageReadLatency �
� FastToSlowDestageReadLatencyBase �
� FastToSlowDestageWriteLatency
� FastToSlowDestageWriteLatencyBase
� SlowTierContainerFillRatio ���
� SlowTierContainerFillRatioBase ���
� FastTierContainerFillRatio ���
� FastTierContainerFillRatioBase ���
� TreeUpdateLatency
� TreeUpdateLatencyBase
� CheckpointLatency
� CheckpointLatencyBase
� TreeUpdateCount ��
CheckpointCount ��
LogWriteCount
LogFillRatio �
ReadCacheInvalidationsForOverwrite ���
ReadCacheInvalidationsForReuse ���
ReadCacheInvalidationsGeneral
ReadCacheChecksOnMount ���
ReadCacheIssuesOnMount ���
TrimLatency ��
$TrimLatencyBase ��
(DataCompactionCount ��
,CompactionReadLatency
0CompactionReadLatencyBase
4CompactionWriteLatency ���
8CompactionWriteLatencyBase ���
} @DataInPlaceWriteClusterCount �
HCompactionFailedDueToIneligibleContainer �
LCompactionFailedDueToMaxFragmentation
PCompactedContainerFillRatio ��
TCompactedContainerFillRatioBase ��
XContainerMoveRetryCount ��
\ContainerMoveFailedDueToIneligibleContainer ��
`CompactionFailureCount ���
dContainerMoveFailureCount
} hNumberOfDirtyMetadataPages ���
pNumberOfDirtyTableListEntries
tNumberOfDeleteQueueEntries ���N O �* x_VOLUME_REFS_INFO_BUFFER .?AU_VOLUME_REFS_INFO_BUFFER@@ �� �* �)
=!
�
�
� >
" Address ��
" Reserved �
# QuadPart �& �* _MCI_ADDR .?AT_MCI_ADDR@@ �* � / n � _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION@@ ��
# CycleTime n �* _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION@@ �� �* { � J � _RTL_UNLOAD_EVENT_TRACE .?AU_RTL_UNLOAD_EVENT_TRACE@@ �
BaseAddress ��
" SizeOfImage ��
" Sequence �
" TimeDateStamp
" CheckSum �
� ImageName
� T Version ��J �* \ _RTL_UNLOAD_EVENT_TRACE .?AU_RTL_UNLOAD_EVENT_TRACE@@ �* L � J � _RTL_CIRCULAR_LIST_HEAD .?AU_RTL_CIRCULAR_LIST_HEAD@@
�
�
�* HeadEntry J �* _RTL_CIRCULAR_LIST_HEAD .?AU_RTL_CIRCULAR_LIST_HEAD@@ �* � � j ShutdownNoReboot � ShutdownReboot ��� ShutdownPowerOff � ShutdownRebootForRecovery : t �* _SHUTDOWN_ACTION .?AW4_SHUTDOWN_ACTION@@ ��� �* 9 Z � _FSCTL_UNMAP_SPACE_INPUT_BUFFER .?AU_FSCTL_UNMAP_SPACE_INPUT_BUFFER@@
} BytesToUnmap �Z �* _FSCTL_UNMAP_SPACE_INPUT_BUFFER .?AU_FSCTL_UNMAP_SPACE_INPUT_BUFFER@@ �* �* z � _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION@@ ��*
�' BasicInfo
B 0 IoInfo ���z �* ` _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION@@ �� �* C � .
" SizeOfBitMap �
" Buffer ���2 �* _RTL_BITMAP .?AU_RTL_BITMAP@@ �* ( f b � _SYSTEM_FEATURE_CONFIGURATION_QUERY .?AU_SYSTEM_FEATURE_CONFIGURATION_QUERY@@
�*
� r RtlFeatureConfigurationBoot �� RtlFeatureConfigurationRuntime ��� RtlFeatureConfigurationCount �V t �* _RTL_FEATURE_CONFIGURATION_TYPE .?AW4_RTL_FEATURE_CONFIGURATION_TYPE@@ � �* � t 2
�* ConfigurationType
u FeatureId b �* _SYSTEM_FEATURE_CONFIGURATION_QUERY .?AU_SYSTEM_FEATURE_CONFIGURATION_QUERY@@ �* ^
�* * � HIMC__ .?AUHIMC__@@ ��
�*
�
t unused ���* �* HIMC__ .?AUHIMC__@@ �� �* E : GetFileExInfoStandard GetFileExMaxInfoLevel F t �* _GET_FILEEX_INFO_LEVELS .?AW4_GET_FILEEX_INFO_LEVELS@@ � �* c �
�
� B � tagEMRSETICMPROFILE .?AUtagEMRSETICMPROFILE@@ ^
emr ��
" dwFlags ��
" cbName ���
" cbData ���
K Data �B �* tagEMRSETICMPROFILE .?AUtagEMRSETICMPROFILE@@ �* � J � _ENCLAVE_LOAD_INFO_VBS .?AU_ENCLAVE_LOAD_INFO_VBS@@ ��V
ImageHandle ��
# Unused ���
! NameLength ���
Name �J �* _ENCLAVE_LOAD_INFO_VBS .?AU_ENCLAVE_LOAD_INFO_VBS@@ �� �* ? � > � _WAKE_TIMER_INFO .?AU_WAKE_TIMER_INFO@@ ��B � _DIAGNOSTIC_BUFFER .?AU_DIAGNOSTIC_BUFFER@@ ��Z
" OffsetToNext �
� DueTime ��
" Period ���
�* ReasonContext > �* 0 _WAKE_TIMER_INFO .?AU_WAKE_TIMER_INFO@@ �� �* � * � BSMINFO .?AUBSMINFO@@
�*
� * � HDESK__ .?AUHDESK__@@
�*
� F
u cbSize ���
�* hdesk
y hwnd �
I luid �* �* BSMINFO .?AUBSMINFO@@ �* � : � tagMDINEXTMENU .?AUtagMDINEXTMENU@@ ��
�*
� >
2 hmenuIn ��
2 hmenuNext
y hwndNext �: �* tagMDINEXTMENU .?AUtagMDINEXTMENU@@ �� + 0 n � _PROCESS_REVOKE_FILE_HANDLES_INFORMATION .?AU_PROCESS_REVOKE_FILE_HANDLES_INFORMATION@@ ��
� TargetDevicePath �n + _PROCESS_REVOKE_FILE_HANDLES_INFORMATION .?AU_PROCESS_REVOKE_FILE_HANDLES_INFORMATION@@ �� + C : F � _ETW_SET_TIMER_EVENT .?AU_ETW_SET_TIMER_EVENT@@ ���
# ExpectedDueTime ��
" TimerAddress �
! TargetProcessorGroup �
TargetProcessorIndex �
Flags
" Period ���
EncodedDelay �
Reserved0
! UniqueProcessId ��F + _ETW_SET_TIMER_EVENT .?AU_ETW_SET_TIMER_EVENT@@ �� + � � B � _CONNECTDLGSTRUCTW .?AU_CONNECTDLGSTRUCTW@@ ��6 � _NETRESOURCEW .?AU_NETRESOURCEW@@
+
� j
" cbStructure ��
y hwndOwner
+ lpConnRes
" dwFlags ��
" dwDevNum �B
+ _CONNECTDLGSTRUCTW .?AU_CONNECTDLGSTRUCTW@@ �� + 5 �
�
� J � _ETW_REGNOTIF_REGISTER .?AU_ETW_REGNOTIF_REGISTER@@ ��b
Notification �
Kcb ��
Type �
WatchTree
Primary ��J + _ETW_REGNOTIF_REGISTER .?AU_ETW_REGNOTIF_REGISTER@@ �� + � � : � tagSERIALKEYSA .?AUtagSERIALKEYSA@@ ��
u cbSize ���
" dwFlags ��
p lpszActivePort ���
p lpszPort �
u iBaudRate
u iPortState ���
u iActive ��: + tagSERIALKEYSA .?AUtagSERIALKEYSA@@ �� + H2 B � tagMOUSEHOOKSTRUCT .?AUtagMOUSEHOOKSTRUCT@@ ��
+
� R
x pt ���
y hwnd �
u wHitTestCode �
" dwExtraInfo ��B + tagMOUSEHOOKSTRUCT .?AUtagMOUSEHOOKSTRUCT@@ �� + � F � IMPORT_OBJECT_HEADER .?AUIMPORT_OBJECT_HEADER@@ ��
! ��
! ��
! ���
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
" SizeOfData ���
! Ordinal ��
! Hint �
+ Type �
+ NameType �
!+ Reserved �F "+ IMPORT_OBJECT_HEADER .?AUIMPORT_OBJECT_HEADER@@ �� #+ [ q : � _REASON_CONTEXT .?AU_REASON_CONTEXT@@
%+
� r
6 LocalizedReasonModule
" LocalizedReasonId
" ReasonStringCount
ReasonStrings : '+ <anonymous-tag> .?AU<anonymous-tag>@@ (+ c
6
(+ Detailed �
q SimpleReasonString ���2 *+ <anonymous-tag> .?AT<anonymous-tag>@@ ++ c :
" Version ��
" Flags
++ Reason ���: -+ _REASON_CONTEXT .?AU_REASON_CONTEXT@@ .+ c > OS_DEPLOYMENT_STANDARD ��� OS_DEPLOYMENT_COMPACT R t 0+ _OS_DEPLOYEMENT_STATE_VALUES .?AW4_OS_DEPLOYEMENT_STATE_VALUES@@ ��� 1+ ( �# ^ � _SYSTEM_POOL_ZEROING_INFORMATION .?AU_SYSTEM_POOL_ZEROING_INFORMATION@@ ��
3+
� &
PoolZeroingSupportPresent ^ 5+ _SYSTEM_POOL_ZEROING_INFORMATION .?AU_SYSTEM_POOL_ZEROING_INFORMATION@@ �� 6+ { � Z � _PERFINFO_FILE_SIMPLE_OPERATION .?AU_PERFINFO_FILE_SIMPLE_OPERATION@@ Z
" Irp ��
" FileObject ���
" FileKey ��
" IssuingThreadId ��Z 9+ _PERFINFO_FILE_SIMPLE_OPERATION .?AU_PERFINFO_FILE_SIMPLE_OPERATION@@ :+ � �
SystemProcessClassificationNormal SystemProcessClassificationSystem SystemProcessClassificationSecureSystem �� SystemProcessClassificationMemCompression SystemProcessClassificationRegistry �� SystemProcessClassificationMaximum ���V t <+ _SYSTEM_PROCESS_CLASSIFICATION .?AW4_SYSTEM_PROCESS_CLASSIFICATION@@ ��� =+
n ��
?+
� v � _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION .?AU_ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION@@
A+ ��
B+
� Z � _COMPATIBILITY_CONTEXT_ELEMENT .?AU_COMPATIBILITY_CONTEXT_ELEMENT@@ �� D+ " �.
" ElementCount �
E+ Elements �v F+ _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION .?AU_ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION@@ G+ L J � _RTLP_HEAP_TAGGING_INFO .?AU_RTLP_HEAP_TAGGING_INFO@@ : � _RTLP_TAG_INFO .?AU_RTLP_TAG_INFO@@ �� J+ " �f
! Version ��
! Flags
Process ��
" EntriesCount �
K+ Entries ��J L+ _RTLP_HEAP_TAGGING_INFO .?AU_RTLP_HEAP_TAGGING_INFO@@ M+ L �
�
� " @ �Z
l elfLogFont ���
P+ < elfFullName ��
c | elfStyle �
c � elfScript > Q+ � tagENUMLOGFONTEXA .?AUtagENUMLOGFONTEXA@@ R+ � F � _MM_ETW_PAGE_INFO_EX .?AU_MM_ETW_PAGE_INFO_EX@@ ��
T+
� > � _MM_ETW_PAGE_INFO .?AU_MM_ETW_PAGE_INFO@@ &
V+ PageInfo �
X! Info �F W+ _MM_ETW_PAGE_INFO_EX .?AU_MM_ETW_PAGE_INFO_EX@@ �� X+ S V IMO_UNAVAILABLE �� IMO_HARDWARE � IMO_INJECTED � IMO_SYSTEM ���N t Z+ tagINPUT_MESSAGE_ORIGIN_ID .?AW4tagINPUT_MESSAGE_ORIGIN_ID@@ ��� [+ �=
�
� J � _IMAGE_BASE_RELOCATION .?AU_IMAGE_BASE_RELOCATION@@ ��
^+
� 6
" VirtualAddress ���
" SizeOfBlock ��J `+ _IMAGE_BASE_RELOCATION .?AU_IMAGE_BASE_RELOCATION@@ �� a+ [ $ ^ � _RTL_QUERY_DEBUG_VIRTUAL_PROCESS .?AU_RTL_QUERY_DEBUG_VIRTUAL_PROCESS@@ �� " " d+
e+
� B " " g+
h+
� V
Context ��
f+ ReadMemoryRoutine
i+ QueryInformationRoutine ��^ j+ _RTL_QUERY_DEBUG_VIRTUAL_PROCESS .?AU_RTL_QUERY_DEBUG_VIRTUAL_PROCESS@@ �� k+ L . > � _OSVERSIONINFOEXW .?AU_OSVERSIONINFOEXW@@
m+
�
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
*$ szCSDVersion �
! wServicePackMajor
! wServicePackMinor
! wSuiteMask ���
wProductType �
wReserved > o+ _OSVERSIONINFOEXW .?AU_OSVERSIONINFOEXW@@ p+ ( �
�
� 2 � _MUICCENTRY .?AU_MUICCENTRY@@
s+
� t+ " � t " �
u lCultureNameOffset ���
u ulCultureID ��
" ulLanguageType ���
t+ pNeutralCulture ��
u+ lBaseLanguageIndices �
v+ lParentLanguageIndices ���2 w+ 0 _MUICCENTRY .?AU_MUICCENTRY@@ x+ � : � _CLIENT_CALL_RETURN .?AT_CLIENT_CALL_RETURN@@ *
Pointer ��
Simple ���: {+ _CLIENT_CALL_RETURN .?AT_CLIENT_CALL_RETURN@@ |+ � � V � _MEMORY_PARTITION_PAGE_RANGE .?AU_MEMORY_PARTITION_PAGE_RANGE@@ ��.
" StartPage
" NumberOfPages V + _MEMORY_PARTITION_PAGE_RANGE .?AU_MEMORY_PARTITION_PAGE_RANGE@@ �� �+ � Z � _PERFINFO_DRIVER_MAJORFUNCTION .?AU_PERFINFO_DRIVER_MAJORFUNCTION@@ ��
�+
� �
" MajorFunction
" MinorFunction
RoutineAddr ��
FileNamePointer ��
Irp ��
" UniqMatchId ��Z �+ _PERFINFO_DRIVER_MAJORFUNCTION .?AU_PERFINFO_DRIVER_MAJORFUNCTION@@ �� �+ � � 7 " 7 t �+
�+
� : � _MODEMSETTINGS .?AU_MODEMSETTINGS@@ ��j
" dwActualSize �
" dwRequiredSize ���
" dwDevSpecificOffset ��
" dwDevSpecificSize
" dwCallSetupFailTimer �
" dwInactivityTimeout ��
" dwSpeakerVolume ��
" dwSpeakerMode
" dwPreferredModemOptions ��
" $ dwNegotiatedModemOptions �
" ( dwNegotiatedDCERate ��
K , abVariablePortion : �+ 0 _MODEMSETTINGS .?AU_MODEMSETTINGS@@ ��& onecore\external\sdk\inc\mcx.h � �+ �+ 2
�)
� R � _FILE_DIRECTORY_INFORMATION .?AU_FILE_DIRECTORY_INFORMATION@@
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
@ FileName �R �+ H _FILE_DIRECTORY_INFORMATION .?AU_FILE_DIRECTORY_INFORMATION@@ �+ � Z � _RTL_SEGMENT_HEAP_MEMORY_SOURCE .?AU_RTL_SEGMENT_HEAP_MEMORY_SOURCE@@ " " �r
" Flags
" MemoryTypeMask ���
" NumaNode �
PartitionHandle ��
�+ Reserved �Z �+ _RTL_SEGMENT_HEAP_MEMORY_SOURCE .?AU_RTL_SEGMENT_HEAP_MEMORY_SOURCE@@ �+ ( �
6
" dwLowDateTime
" dwHighDateTime ���. �+ _FILETIME .?AU_FILETIME@@ �+ ' N � _CM_PARTIAL_RESOURCE_LIST .?AU_CM_PARTIAL_RESOURCE_LIST@@
�+
� � " �Z
! Version ��
! Revision �
" Count
�+ PartialDescriptors ���N �+ _CM_PARTIAL_RESOURCE_LIST .?AU_CM_PARTIAL_RESOURCE_LIST@@ �+ � U 2 � FLASHWINFO .?AUFLASHWINFO@@ ��
�+
� b
u cbSize ���
y hwnd �
" dwFlags ��
u uCount ���
" dwTimeout 2 �+ FLASHWINFO .?AUFLASHWINFO@@ �� �+ : N " �+ f � _RTL_USER_PROCESS_EXTENDED_PARAMETERS .?AU_RTL_USER_PROCESS_EXTENDED_PARAMETERS@@
�+
� �
! Version ��
! NodeNumber ���
ProcessSecurityDescriptor
ThreadSecurityDescriptor �
ParentProcess
DebugPort
TokenHandle ��
JobHandle f �+ _RTL_USER_PROCESS_EXTENDED_PARAMETERS .?AU_RTL_USER_PROCESS_EXTENDED_PARAMETERS@@ �+ � W f � _JOURNAL_SET_KEY_SECURITY_INFORMATION .?AU_JOURNAL_SET_KEY_SECURITY_INFORMATION@@ �
2 Action ���
# RecordNumber �
} TimeStamp
� KeyPathName ��
" OldSecurityDescriptorLength ��
$ OldSecurityDescriptor
" ( NewSecurityDescriptorLength ��
, NewSecurityDescriptor f �+ 0 _JOURNAL_SET_KEY_SECURITY_INFORMATION .?AU_JOURNAL_SET_KEY_SECURITY_INFORMATION@@ �+ 3 � N � PPM_IDLE_STATE_BUCKET_EX .?AUPPM_IDLE_STATE_BUCKET_EX@@ ��R
# TotalTimeUs ��
" MinTimeUs
" MaxTimeUs
" Count N �+ PPM_IDLE_STATE_BUCKET_EX .?AUPPM_IDLE_STATE_BUCKET_EX@@ �� �+
& � _QUAD .?AU_QUAD@@
�+ ��
�+
� >
UseThisFieldToCopy ���
A DoNotUseThisField & �+ _QUAD .?AU_QUAD@@ �+ � J � _SECURITY_CAPABILITIES .?AU_SECURITY_CAPABILITIES@@ ��
�+
� f
AppContainerSid ��
� Capabilities �
" CapabilityCount ��
" Reserved �J �+ _SECURITY_CAPABILITIES .?AU_SECURITY_CAPABILITIES@@ �� �+ ; Z � _IMAGE_RESOURCE_DIRECTORY_ENTRY .?AU_IMAGE_RESOURCE_DIRECTORY_ENTRY@@
�+
�
" ��
" ��
" ��
" ��
�+ NameOffset ���
�+ NameIsString �
" Name �
! Id ���
" OffsetToData �
�+ OffsetToDirectory
�+ DataIsDirectory ��Z �+ _IMAGE_RESOURCE_DIRECTORY_ENTRY .?AU_IMAGE_RESOURCE_DIRECTORY_ENTRY@@ �+ [ K V � _PERFINFO_PAGE_RANGE_IDENTITY .?AU_PERFINFO_PAGE_RANGE_IDENTITY@@
# ��
# 0��
# 4��
�+ UseDescription ���
�+ UniqueKey
�+ Reserved �
ProtoPteAddress ��
" PageFrameIndex ���
VirtualAddress ���
" PageCount V �+ _PERFINFO_PAGE_RANGE_IDENTITY .?AU_PERFINFO_PAGE_RANGE_IDENTITY@@ �+ � � b TokenElevationTypeDefault TokenElevationTypeFull ��� TokenElevationTypeLimited B t �+ _TOKEN_ELEVATION_TYPE .?AW4_TOKEN_ELEVATION_TYPE@@ � �+ -
-
�
P
� R � _ENLISTMENT_CRM_INFORMATION .?AU_ENLISTMENT_CRM_INFORMATION@@
�+
� b
� CrmTransactionManagerId ��
� CrmResourceManagerId �
� CrmEnlistmentId ��R �+ 0 _ENLISTMENT_CRM_INFORMATION .?AU_ENLISTMENT_CRM_INFORMATION@@ �+ � [ n � _FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT .?AU_FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT@@ ��
�+
� z FileMetadataOptimizationNone � FileMetadataOptimizationInProgress ��� FileMetadataOptimizationPending ��Z t �+ _FILE_METADATA_OPTIMIZATION_STATE .?AW4_FILE_METADATA_OPTIMIZATION_STATE@@ � �+ �(
�+ State
" AttributeListSize
" MetadataSpaceUsed
" MetadataSpaceAllocated ���
" NumberOfFileRecords ��
" NumberOfResidentAttributes ���
" NumberOfNonresidentAttributes
" TotalInProgress ��
" TotalPending �n �+ $ _FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT .?AU_FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT@@ �� �+ �( B � _XSAVE_CET_U_FORMAT .?AU_XSAVE_CET_U_FORMAT@@
�+
� 2
# Ia32CetUMsr ��
# Ia32Pl3SspMsr B �+ _XSAVE_CET_U_FORMAT .?AU_XSAVE_CET_U_FORMAT@@ �+ � F � _LOAD_DLL_EVENT_DATA .?AU_LOAD_DLL_EVENT_DATA@@ ��
ImageName F �+ _LOAD_DLL_EVENT_DATA .?AU_LOAD_DLL_EVENT_DATA@@ �� �+ � * Z � _SYSTEM_MEMORY_LIST_INFORMATION .?AU_SYSTEM_MEMORY_LIST_INFORMATION@@ " " ��
" ZeroPageCount
" FreePageCount
" ModifiedPageCount
" ModifiedNoWritePageCount �
" BadPageCount �
�+ PageCountByPriority ��
�+ 4 RepurposedPagesByPriority
" T ModifiedPageCountPageFile Z �+ X _SYSTEM_MEMORY_LIST_INFORMATION .?AU_SYSTEM_MEMORY_LIST_INFORMATION@@ �+ � Z � _FILE_ATTRIBUTE_TAG_INFORMATION .?AU_FILE_ATTRIBUTE_TAG_INFORMATION@@ 6
" FileAttributes ���
" ReparseTag ���Z �+ _FILE_ATTRIBUTE_TAG_INFORMATION .?AU_FILE_ATTRIBUTE_TAG_INFORMATION@@ �+ ? 6 PlatformRoleUnspecified �� PlatformRoleDesktop �� PlatformRoleMobile ��� PlatformRoleWorkstation �� PlatformRoleEnterpriseServer � PlatformRoleSOHOServer ��� PlatformRoleAppliancePC �� PlatformRolePerformanceServer PlatformRoleSlate PlatformRoleMaximum ��B
t �+ _POWER_PLATFORM_ROLE .?AW4_POWER_PLATFORM_ROLE@@ ��� �+ �
E
� B � _SERVICE_NOTIFY_2A .?AU_SERVICE_NOTIFY_2A@@ ��
" dwVersion
D pfnNotifyCallback
pContext �
" dwNotificationStatus �
ServiceStatus
" 4 dwNotificationTriggered ��
p 8 pszServiceNames ��B �+ < _SERVICE_NOTIFY_2A .?AU_SERVICE_NOTIFY_2A@@ �� �+ 3 �
�#
�
x
y * �+ _POINTL .?AU_POINTL@@ �+ �
t unused ���* , HDESK__ .?AUHDESK__@@ , S . � _RGNDATA .?AU_RGNDATA@@ ��
,
� : � _RGNDATAHEADER .?AU_RGNDATAHEADER@@ ��&
, rdh ��
� Buffer ���. , $ _RGNDATA .?AU_RGNDATA@@ �� , � � CI_WINDOWS_LOCKDOWN_RESTRICTION_NONE � CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK � CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK_PERMANENT ��� CI_WINDOWS_LOCKDOWN_RESTRICTION_MAX ��V t
, CI_WINDOWS_LOCKDOWN_RESTRICTION .?AW4CI_WINDOWS_LOCKDOWN_RESTRICTION@@ � , �
�
� ^ � _PUBLIC_OBJECT_BASIC_INFORMATION .?AU_PUBLIC_OBJECT_BASIC_INFORMATION@@ �� " " ( �v
" Attributes ���
" GrantedAccess
" HandleCount ��
" PointerCount �
, Reserved �^ , 8 _PUBLIC_OBJECT_BASIC_INFORMATION .?AU_PUBLIC_OBJECT_BASIC_INFORMATION@@ �� , � � > � _LDT_INFORMATION .?AU_LDT_INFORMATION@@ �� z " �>
" Start
" Length ���
, LdtEntries ���> , _LDT_INFORMATION .?AU_LDT_INFORMATION@@ �� , } � J � REFS_VOLUME_DATA_BUFFER .?AUREFS_VOLUME_DATA_BUFFER@@ } " H ��
" ByteCount
" MajorVersion �
" MinorVersion �
" BytesPerPhysicalSector ���
} VolumeSerialNumber ���
} NumberSectors
} TotalClusters
} ( FreeClusters �
} 0 TotalReserved
" 8 BytesPerSector ���
" < BytesPerCluster ��
} @ MaximumSizeOfResidentFile
! H FastTierDataFillRatio
! J SlowTierDataFillRatio
" L DestagesFastTierToSlowTierRate ���
, P Reserved �J , � REFS_VOLUME_DATA_BUFFER .?AUREFS_VOLUME_DATA_BUFFER@@ ,
v � _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION .?AU_PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION@@ >
" Version ��
" Reserved �
" Callback �v , _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION .?AU_PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION@@ , a � . � tagLOGPEN .?AUtagLOGPEN@@
!,
� >
u lopnStyle
x lopnWidth
" lopnColor . #, tagLOGPEN .?AUtagLOGPEN@@ $, k � POINTER_DEVICE_TYPE_INTEGRATED_PEN ��� POINTER_DEVICE_TYPE_EXTERNAL_PEN � POINTER_DEVICE_TYPE_TOUCH POINTER_DEVICE_TYPE_TOUCH_PAD ��POINTER_DEVICE_TYPE_MAX �F t &, tagPOINTER_DEVICE_TYPE .?AW4tagPOINTER_DEVICE_TYPE@@ ��� ', �; 6 � HCOLORSPACE__ .?AUHCOLORSPACE__@@
),
�
t unused ���6 +, HCOLORSPACE__ .?AUHCOLORSPACE__@@ ,, M b � _RTL_PROCESS_MODULE_INFORMATION_EX .?AU_RTL_PROCESS_MODULE_INFORMATION_EX@@ ��v
! NextOffset ���
� BaseInfo �
" ImageChecksum
" $TimeDateStamp
(DefaultBase ��b /, ,_RTL_PROCESS_MODULE_INFORMATION_EX .?AU_RTL_PROCESS_MODULE_INFORMATION_EX@@ �� 0, u � N � _ETW_TP_EVENT_POOL_CREATE .?AU_ETW_TP_EVENT_POOL_CREATE@@
2,
� *
� Header ���
PoolId ���N 4, ( _ETW_TP_EVENT_POOL_CREATE .?AU_ETW_TP_EVENT_POOL_CREATE@@ 5, � �
� � ImagePolicyEntryTypeNone � ImagePolicyEntryTypeBool � ImagePolicyEntryTypeInt8 � ImagePolicyEntryTypeUInt8 ImagePolicyEntryTypeInt16 ImagePolicyEntryTypeUInt16 ��� ImagePolicyEntryTypeInt32 ImagePolicyEntryTypeUInt32 ��� ImagePolicyEntryTypeInt64 ImagePolicyEntryTypeUInt64 ���
ImagePolicyEntryTypeAnsiString ��� ImagePolicyEntryTypeUnicodeString ImagePolicyEntryTypeOverride �
ImagePolicyEntryTypeMaximum ��J t 8, _IMAGE_POLICY_ENTRY_TYPE .?AW4_IMAGE_POLICY_ENTRY_TYPE@@ ��� 9, ( L& . � _FLOAT128 .?AU_FLOAT128@@
;,
� *
LowPart ��
HighPart �. =, _FLOAT128 .?AU_FLOAT128@@ >, U q t t t t @,
A,
� b � _RESOURCEMANAGER_BASIC_INFORMATION .?AU_RESOURCEMANAGER_BASIC_INFORMATION@@ ��R
� ResourceManagerId
" DescriptionLength
Description ��b D, _RESOURCEMANAGER_BASIC_INFORMATION .?AU_RESOURCEMANAGER_BASIC_INFORMATION@@ �� E, � 6 � _MODEMDEVCAPS .?AU_MODEMDEVCAPS@@ N
" dwActualSize �
" dwRequiredSize ���
" dwDevSpecificOffset ��
" dwDevSpecificSize
" dwModemProviderVersion ���
" dwModemManufacturerOffset
" dwModemManufacturerSize ��
" dwModemModelOffset ���
" dwModemModelSize �
" $ dwModemVersionOffset �
" ( dwModemVersionSize ���
" , dwDialOptions
" 0 dwCallSetupFailTimer �
" 4 dwInactivityTimeout ��
" 8 dwSpeakerVolume ��
" < dwSpeakerMode
" @ dwModemOptions ���
" D dwMaxDTERate �
" H dwMaxDCERate �
K L abVariablePortion 6 H, P _MODEMDEVCAPS .?AU_MODEMDEVCAPS@@ I, �+ Z � _SYSTEM_ACPI_AUDIT_INFORMATION .?AU_SYSTEM_ACPI_AUDIT_INFORMATION@@ ��
" ��
" ��
" ��Z
" RsdpCount
L, SameRsdt �
M, SlicPresent ��
N, SlicDifferent Z O, _SYSTEM_ACPI_AUDIT_INFORMATION .?AU_SYSTEM_ACPI_AUDIT_INFORMATION@@ �� P, �
v � _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT@@ ��
R,
� ^
" PropagationCookie
� UOW ��
� TmIdentity ���
" $ BufferLength �v T, ( _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT@@ �� U, J � N � _HEAP_EVENT_RANGE_CREATE .?AU_HEAP_EVENT_RANGE_CREATE@@ ��F
HeapHandle ���
" FirstRangeSize ���
" Flags N X, _HEAP_EVENT_RANGE_CREATE .?AU_HEAP_EVENT_RANGE_CREATE@@ �� Y, � � . � _RPC_SID .?AU_RPC_SID@@ ��N � _SID_IDENTIFIER_AUTHORITY .?AU_SID_IDENTIFIER_AUTHORITY@@ j
Revision �
SubAuthorityCount
\, IdentifierAuthority ��
� SubAuthority �. ], _RPC_SID .?AU_RPC_SID@@ �� ^, � 8 6 � _DRAWPATRECT .?AU_DRAWPATRECT@@ ��V
x ptPosition ���
x ptSize ���
! wStyle ���
! wPattern �6 a, _DRAWPATRECT .?AU_DRAWPATRECT@@ �� b, %
�
�
n
�
} } f, J � _IMAGE_HOT_PATCH_HASHES .?AU_IMAGE_HOT_PATCH_HASHES@@ &
S SHA256 ���
b SHA1 �J i, 4 _IMAGE_HOT_PATCH_HASHES .?AU_IMAGE_HOT_PATCH_HASHES@@ j, [ � ^ � _PERFINFO_CC_SCHEDULE_READ_AHEAD .?AU_PERFINFO_CC_SCHEDULE_READ_AHEAD@@ ��
" ��
" ��j
" WorkItemKey ��
" FileObjectKey
# FileOffset ���
" Length ���
" ReadAheadUnit
" ReadAheadLength ��
# ReadAheadOffset ��
# ( ReadAheadBeyondLastByte ��
0 ReadPattern ��
" 4 SequentialReadCount ��
" 8 SharedCacheMapFlags ��
m, < ReadAheadSettingsChanged �
n, < ReadAheadActive ��^
o, @ _PERFINFO_CC_SCHEDULE_READ_AHEAD .?AU_PERFINFO_CC_SCHEDULE_READ_AHEAD@@ �� p, � � . � _DOCINFOW .?AU_DOCINFOW@@ r
t cbSize ���
�% lpszDocName ��
�% lpszOutput ���
�% lpszDatatype �
" fwType ���. s, _DOCINFOW .?AU_DOCINFOW@@ t, � " v, V � _KEY_HANDLE_TAGS_INFORMATION .?AU_KEY_HANDLE_TAGS_INFORMATION@@ ��
" HandleTags ���V y, _KEY_HANDLE_TAGS_INFORMATION .?AU_KEY_HANDLE_TAGS_INFORMATION@@ �� z, 3 Z V � _REFS_DEALLOCATE_RANGES_RANGE .?AU_REFS_DEALLOCATE_RANGES_RANGE@@ 2
# StartOfRange �
# CountOfRange �V }, _REFS_DEALLOCATE_RANGES_RANGE .?AU_REFS_DEALLOCATE_RANGES_RANGE@@ ~, �* V � _FILE_COMPRESSION_INFORMATION .?AU_FILE_COMPRESSION_INFORMATION@@ �
} CompressedFileSize ���
! CompressionFormat
CompressionUnitShift �
ChunkShift ���
ClusterShift �
�
Reserved �V �, _FILE_COMPRESSION_INFORMATION .?AU_FILE_COMPRESSION_INFORMATION@@ �, � R � _IMAGE_COFF_SYMBOLS_HEADER .?AU_IMAGE_COFF_SYMBOLS_HEADER@@ ��
�,
� �
" NumberOfSymbols ��
" LvaToFirstSymbol �
" NumberOfLinenumbers ��
" LvaToFirstLinenumber �
" RvaToFirstByteOfCode �
" RvaToLastByteOfCode ��
" RvaToFirstByteOfData �
" RvaToLastByteOfData ��R �, _IMAGE_COFF_SYMBOLS_HEADER .?AU_IMAGE_COFF_SYMBOLS_HEADER@@ �� �, [ � z � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2@@ �
MaxIops ��
MaxBandwidth �
ReservationIops ��
q VolumeName ���
" BaseIoSize ���
� ControlFlags �
! $ VolumeNameLength �
( CriticalReservationIops ��
0 ReservationBandwidth �
8 CriticalReservationBandwidth �
@ MaxTimePercent ���
H ReservationTimePercent ���
P CriticalReservationTimePercent ���z
�, X JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2@@ �, C l > � MENUITEMTEMPLATE .?AUMENUITEMTEMPLATE@@ ��:
! mtOption �
! mtID �
mtString �> �, MENUITEMTEMPLATE .?AUMENUITEMTEMPLATE@@ �� �, �(
�
�
�
� �
! wYear
! wMonth ���
! wDayOfWeek ���
! wDay �
! wHour
!
wMinute ��
! wSecond ��
! wMilliseconds 2 �, _SYSTEMTIME .?AU_SYSTEMTIME@@ �, c Z
I
�
�
� V � NTFS_FILE_RECORD_INPUT_BUFFER .?AUNTFS_FILE_RECORD_INPUT_BUFFER@@ "
} FileReferenceNumber ��V �, NTFS_FILE_RECORD_INPUT_BUFFER .?AUNTFS_FILE_RECORD_INPUT_BUFFER@@ �, �
�
� B � tagRECONVERTSTRING .?AUtagRECONVERTSTRING@@ ���
" dwSize ���
" dwVersion
" dwStrLen �
" dwStrOffset ��
" dwCompStrLen �
" dwCompStrOffset ��
" dwTargetStrLen ���
" dwTargetStrOffset B �, tagRECONVERTSTRING .?AUtagRECONVERTSTRING@@ �� �, E x B � _OSVERSIONINFOEX2W .?AU_OSVERSIONINFOEX2W@@ ��
�,
� N
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
*$ szCSDVersion �
! wServicePackMajor
! wServicePackMinor
! wSuiteMask ���
wProductType �
wReserved
" wSuiteMaskEx �
" wReserved2 ���B
�, $_OSVERSIONINFOEX2W .?AU_OSVERSIONINFOEX2W@@ �� �, ( � j � _RESOURCEMANAGER_COMPLETION_INFORMATION .?AU_RESOURCEMANAGER_COMPLETION_INFORMATION@@
�,
� >
IoCompletionPortHandle ���
" CompletionKey j �, _RESOURCEMANAGER_COMPLETION_INFORMATION .?AU_RESOURCEMANAGER_COMPLETION_INFORMATION@@ �, � $ ^ � _SYSTEM_SINGLE_MODULE_INFORMATION .?AU_SYSTEM_SINGLE_MODULE_INFORMATION@@ 6
TargetModuleAddress ��
., ExInfo ���^ �, 0_SYSTEM_SINGLE_MODULE_INFORMATION .?AU_SYSTEM_SINGLE_MODULE_INFORMATION@@ �, ]
]
� F � _REARRANGE_FILE_DATA .?AU_REARRANGE_FILE_DATA@@ ��
�,
� z
# SourceStartingOffset �
# TargetOffset �
SourceFileHandle �
" Length ���
" Flags F �, _REARRANGE_FILE_DATA .?AU_REARRANGE_FILE_DATA@@ �� �, ( J � CREATE_USN_JOURNAL_DATA .?AUCREATE_USN_JOURNAL_DATA@@ 6
# MaximumSize ��
# AllocationDelta ��J �, CREATE_USN_JOURNAL_DATA .?AUCREATE_USN_JOURNAL_DATA@@ �,
v � _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2@@ ��
�,
� �
# IoReadBytesLimit �
# IoWriteBytesLimit
} PerJobUserTimeLimit ��
# JobLowMemoryLimit
# JobHighMemoryLimit ���
� ( RateControlTolerance �
, RateControlToleranceInterval �
" 0 LimitFlags ���v �, 8 _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2@@ �� �, a � J � _IMAGE_CHPE_RANGE_ENTRY .?AU_IMAGE_CHPE_RANGE_ENTRY@@
�,
�
" ��
" ��^
" StartOffset ��
�, NativeCode ���
�, AddressBits ��
" Length ���J �, _IMAGE_CHPE_RANGE_ENTRY .?AU_IMAGE_CHPE_RANGE_ENTRY@@ �, [ v B � _ACCESS_ALLOWED_ACE .?AU_ACCESS_ALLOWED_ACE@@ :
o Header ���
" Mask �
" SidStart �B �, _ACCESS_ALLOWED_ACE .?AU_ACCESS_ALLOWED_ACE@@ �, V FindExInfoStandard ��� FindExInfoBasic �� FindExInfoMaxInfoLevel ���> t �, _FINDEX_INFO_LEVELS .?AW4_FINDEX_INFO_LEVELS@@ � �, c � J � _CM_MONITOR_DEVICE_DATA .?AU_CM_MONITOR_DEVICE_DATA@@ J
! Version ��
! Revision �
! HorizontalScreenSize �
! VerticalScreenSize ���
! HorizontalResolution �
!
VerticalResolution ���
! HorizontalDisplayTimeLow �
! HorizontalDisplayTime
! HorizontalDisplayTimeHigh
! HorizontalBackPorchLow ���
! HorizontalBackPorch ��
! HorizontalBackPorchHigh ��
! HorizontalFrontPorchLow ��
! HorizontalFrontPorch �
! HorizontalFrontPorchHigh �
! HorizontalSyncLow
! HorizontalSync ���
! " HorizontalSyncHigh ���
! $ VerticalBackPorchLow �
! & VerticalBackPorch
! ( VerticalBackPorchHigh
! * VerticalFrontPorchLow
! , VerticalFrontPorch ���
! . VerticalFrontPorchHigh ���
! 0 VerticalSyncLow ��
! 2 VerticalSync �
! 4 VerticalSyncHigh �J �, 6 _CM_MONITOR_DEVICE_DATA .?AU_CM_MONITOR_DEVICE_DATA@@ �, � � B � _SD_ENUM_SDS_ENTRY .?AU_SD_ENUM_SDS_ENTRY@@ ��j
" Hash �
" SecurityId ���
# Offset ���
" Length ���
| Descriptor ���B �, _SD_ENUM_SDS_ENTRY .?AU_SD_ENUM_SDS_ENTRY@@ �� �, V � _SC_NOTIFICATION_REGISTRATION .?AU_SC_NOTIFICATION_REGISTRATION@@
�,
�
w
� : � tagEMRANGLEARC .?AUtagEMRANGLEARC@@ ��j
emr ��
I ptlCenter
" nRadius ��
@ eStartAngle ��
@ eSweepAngle ��: �, tagEMRANGLEARC .?AUtagEMRANGLEARC@@ �� �, 0
<"
� :" � �,
�,
� 2
�, ExecuteCallback ��
�, Unposted �B �, _TP_TASK_CALLBACKS .?AU_TP_TASK_CALLBACKS@@ �� �, � � F � _EX_WNF_SUBSCRIPTION .?AU_EX_WNF_SUBSCRIPTION@@ ��
�,
� : � _WNF_STATE_NAME .?AU_WNF_STATE_NAME@@
�, ��
�,
� 6 � _WNF_TYPE_ID .?AU_WNF_TYPE_ID@@ ��
�, ��
�,
� �, �, " " �, �, n � _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION@@ �
# IoReadBytesLimit �
# IoWriteBytesLimit
} PerJobUserTimeLimit ��
# JobMemoryLimit ���
� RateControlTolerance �
$ RateControlToleranceInterval �
" ( LimitFlags ���n �, 0 _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION@@ �, C � 6 � _NLSTABLEINFO .?AU_NLSTABLEINFO@@ 6 � _CPTABLEINFO .?AU_CPTABLEINFO@@ ��j
�, OemTableInfo �
�, , AnsiTableInfo
q X UpperCaseTable ���
q \ LowerCaseTable ���6 �, ` _NLSTABLEINFO .?AU_NLSTABLEINFO@@ * onecore\external\ddk\inc\ntnls.h ��� �, �, 3
�
� R � _IMAGE_RESOURCE_DATA_ENTRY .?AU_IMAGE_RESOURCE_DATA_ENTRY@@ ��R
" OffsetToData �
" Size �
" CodePage �
" Reserved �R �, _IMAGE_RESOURCE_DATA_ENTRY .?AU_IMAGE_RESOURCE_DATA_ENTRY@@ �� �, [ | Z � _PLUGPLAY_CONTROL_CONFLICT_LIST .?AU_PLUGPLAY_CONTROL_CONFLICT_LIST@@ ^ � _PLUGPLAY_CONTROL_CONFLICT_ENTRY .?AU_PLUGPLAY_CONTROL_CONFLICT_ENTRY@@ �� �, " ( �
" Reserved1
" Reserved2
" ConflictsCounted �
" ConflictsListed ��
" RequiredBufferSize ���
�, ConflictEntry Z �, @ _PLUGPLAY_CONTROL_CONFLICT_LIST .?AU_PLUGPLAY_CONTROL_CONFLICT_LIST@@ �, � �
� 6 � _RTL_HEAP_TAG .?AU_RTL_HEAP_TAG@@ q " 0 �
" NumberOfAllocations ��
" NumberOfFrees
" BytesAllocated ���
! TagIndex �
! CreatorBackTraceIndex
- TagName ��6 - @ _RTL_HEAP_TAG .?AU_RTL_HEAP_TAG@@ - L - 6 � tagMOUSEKEYS .?AUtagMOUSEKEYS@@ ��
u cbSize ���
" dwFlags ��
" iMaxSpeed
" iTimeToMaxSpeed ��
" iCtrlSpeed ���
" dwReserved1 ��
" dwReserved2 ��6 - tagMOUSEKEYS .?AUtagMOUSEKEYS@@ �� - �3 > � tagEMREXTTEXTOUTA .?AUtagEMREXTTEXTOUTA@@ z
emr ��
� rclBounds
" iGraphicsMode
@ exScale ��
@ eyScale ��
[' $ emrtext ��> - L tagEMREXTTEXTOUTA .?AUtagEMREXTTEXTOUTA@@
- � z PoHiberForceDisableReasonPolicy �� PoHiberForceDisableReasonGuardedHost � PoHiberForceDisableReasonMax �V t - _PO_HIBER_FORCE_DISABLE_REASON .?AW4_PO_HIBER_FORCE_DISABLE_REASON@@ ��� - S
Z MemoryReserveUserApc � MemoryReserveIoCompletion MemoryReserveTypeMax �B t - _MEMORY_RESERVE_TYPE .?AW4_MEMORY_RESERVE_TYPE@@ ��� - a
6 � tagWINDOWPOS .?AUtagWINDOWPOS@@ ��v
y hwnd �
y hwndInsertAfter ��
t x
t y
t cx ���
t cy ���
u flags 6 - tagWINDOWPOS .?AUtagWINDOWPOS@@ �� - y
V � _RTL_SPARSE_BITMAP_PARAMETER .?AU_RTL_SPARSE_BITMAP_PARAMETER@@ ��
" -
-
�
�
�
" ��
" ��
" ��
" ��
# BitCountMax ��
" MetadataSizePerBit ���
" BitsPerRange �
" RangeCountMax
- AllocateRoutine ��
- FreeRoutine ��
- DefaultBitsSet ���
- SparseRangeArray �
- NoInternalLocking
!- SpareFlags ���V
"- _RTL_SPARSE_BITMAP_PARAMETER .?AU_RTL_SPARSE_BITMAP_PARAMETER@@ �� #- � � 6 � tagTPMPARAMS .?AUtagTPMPARAMS@@ ��*
u cbSize ���
� rcExclude 6 &- tagTPMPARAMS .?AUtagTPMPARAMS@@ �� '- N � _SYSTEM_FLAGS_INFORMATION .?AU_SYSTEM_FLAGS_INFORMATION@@
" Flags N *- _SYSTEM_FLAGS_INFORMATION .?AU_SYSTEM_FLAGS_INFORMATION@@ +- � Z � _MM_ETW_WORKING_SET_PFN_RUNDOWN .?AU_MM_ETW_WORKING_SET_PFN_RUNDOWN@@
--
� T+ " �J
" ProcessId
" EntryCount ���
/- WorkingSetInfo ���Z 0- _MM_ETW_WORKING_SET_PFN_RUNDOWN .?AU_MM_ETW_WORKING_SET_PFN_RUNDOWN@@ 1- X J � _QUERY_BAD_RANGES_INPUT .?AU_QUERY_BAD_RANGES_INPUT@@
3-
� �% " �:
" Flags
" NumRanges
5- Ranges ���J 6- _QUERY_BAD_RANGES_INPUT .?AU_QUERY_BAD_RANGES_INPUT@@ 7- !! ^ � _FILE_NOTIFY_EXTENDED_INFORMATION .?AU_FILE_NOTIFY_EXTENDED_INFORMATION@@
9-
� f
" NextEntryOffset ��
" Action ���
} CreationTime �
} LastModificationTime �
} LastChangeTime ���
} LastAccessTime ���
} ( AllocatedLength ��
} 0 FileSize �
" 8 FileAttributes ���
" < ReparsePointTag ��
} @ FileId ���
} H ParentFileId �
" P FileNameLength ���
T FileName �^ ;- X _FILE_NOTIFY_EXTENDED_INFORMATION .?AU_FILE_NOTIFY_EXTENDED_INFORMATION@@ <- @
a ��
>-
�
q
� N � _MIDL_STUBLESS_PROXY_INFO .?AU_MIDL_STUBLESS_PROXY_INFO@@
A-
� �
�' pStubDesc
� ProcFormatString �
� FormatStringOffset ���
� pTransferSyntax ��
" nCount ���
�' pSyntaxInfo ��N C- _MIDL_STUBLESS_PROXY_INFO .?AU_MIDL_STUBLESS_PROXY_INFO@@ D- � �
0"
� 6 � _DEVICE_FLAGS .?AU_DEVICE_FLAGS@@
G-
�
" ��
" ��
" ��
" ��
" ��
" ��
" ��
I- Failed ���
J- ReadOnly �
K- Removable
L- ConsoleIn
M- ConsoleOut ���
N- Input
O- Output ���6 P- _DEVICE_FLAGS .?AU_DEVICE_FLAGS@@ Q- � � R � _MEMORY_COMBINE_INFORMATION .?AU_MEMORY_COMBINE_INFORMATION@@ .
Handle ���
" PagesCombined R T- _MEMORY_COMBINE_INFORMATION .?AU_MEMORY_COMBINE_INFORMATION@@ U- � V � _PROCESSOR_POWER_POLICY_INFO .?AU_PROCESSOR_POWER_POLICY_INFO@@ ��
" ��
" ��
" ���
" TimeCheck
" DemoteLimit ��
" PromoteLimit �
DemotePercent
PromotePercent ���
� Spare
X- AllowDemotion
Y- AllowPromotion ���
Z- Reserved �V [- _PROCESSOR_POWER_POLICY_INFO .?AU_PROCESSOR_POWER_POLICY_INFO@@ �� \- V R � _SYSDBG_LIVEDUMP_CONTROL_FLAGS .?AT_SYSDBG_LIVEDUMP_CONTROL_FLAGS@@ ��
" ��
" ��
" ��
" ��
" ��
_- UseDumpStorageStack ��
`- CompressMemoryPagesData ��
a- IncludeUserSpaceMemoryPages ��
b- AbortIfMemoryPressure
c- Reserved �
" AsUlong ��R d- _SYSDBG_LIVEDUMP_CONTROL_FLAGS .?AT_SYSDBG_LIVEDUMP_CONTROL_FLAGS@@ �� e- < : � _MEMORYSTATUSEX .?AU_MEMORYSTATUSEX@@ �
" dwLength �
" dwMemoryLoad �
# ullTotalPhys �
# ullAvailPhys �
# ullTotalPageFile �
# ullAvailPageFile �
# ( ullTotalVirtual ��
# 0 ullAvailVirtual ��
# 8 ullAvailExtendedVirtual ��: h- @ _MEMORYSTATUSEX .?AU_MEMORYSTATUSEX@@ i- A B R � _QUERY_SERVICE_LOCK_STATUSW .?AU_QUERY_SERVICE_LOCK_STATUSW@@ J
" fIsLocked
q lpLockOwner ��
" dwLockDuration ���R l- _QUERY_SERVICE_LOCK_STATUSW .?AU_QUERY_SERVICE_LOCK_STATUSW@@ m- 3 Z � _COVERAGE_UNLOADED_MODULE_ENTRY .?AU_COVERAGE_UNLOADED_MODULE_ENTRY@@
o-
� �
� NextEntry
� BaseDllName ��
� FullDllName ��
" CoverageSectionSize ��
CoverageSection ��Z q- _COVERAGE_UNLOADED_MODULE_ENTRY .?AU_COVERAGE_UNLOADED_MODULE_ENTRY@@ r- l �
�
� N � STARTING_LCN_INPUT_BUFFER .?AUSTARTING_LCN_INPUT_BUFFER@@
} StartingLcn ��N w- STARTING_LCN_INPUT_BUFFER .?AUSTARTING_LCN_INPUT_BUFFER@@ x- 1
F � tagNONCLIENTMETRICSW .?AUtagNONCLIENTMETRICSW@@ ��
z-
� �
u cbSize ���
t iBorderWidth �
t iScrollWidth �
t iScrollHeight
t iCaptionWidth
t iCaptionHeight ���
� lfCaptionFont
t t iSmCaptionWidth ��
t x iSmCaptionHeight �
� | lfSmCaptionFont ��
t � iMenuWidth ���
t � iMenuHeight ��
� � lfMenuFont ���
� <lfStatusFont �
� �lfMessageFont
t �iPaddedBorderWidth ���F |- �tagNONCLIENTMETRICSW .?AUtagNONCLIENTMETRICSW@@ �� }- �1 J � _PROCESSOR_IDLE_STATES .?AU_PROCESSOR_IDLE_STATES@@ ��
-
� F � _PROCESSOR_IDLE_STATE .?AU_PROCESSOR_IDLE_STATE@@ �- " �r
" Size �
" Revision �
" Count
" Type �
" TargetProcessors �
�- State J �- , _PROCESSOR_IDLE_STATES .?AU_PROCESSOR_IDLE_STATES@@ �� �- � f
" NextEntryOffset ��
ParentFileId �
" FileNameLength ���
FileName �V �- _FILE_LINK_ENTRY_INFORMATION .?AU_FILE_LINK_ENTRY_INFORMATION@@ �� �- z B � tagHW_PROFILE_INFOA .?AUtagHW_PROFILE_INFOA@@ p " ' �R
" dwDockInfo ���
�- szHwProfileGuid ��
� + szHwProfileName ��B �- | tagHW_PROFILE_INFOA .?AUtagHW_PROFILE_INFOA@@ �- �
� : � _VM_COUNTERS_EX .?AU_VM_COUNTERS_EX@@ j
" PeakVirtualSize ��
" VirtualSize ��
" PageFaultCount ���
" PeakWorkingSetSize ���
" WorkingSetSize ���
" QuotaPeakPagedPoolUsage ��
" QuotaPagedPoolUsage ��
" QuotaPeakNonPagedPoolUsage ���
" QuotaNonPagedPoolUsage ���
" $ PagefileUsage
" ( PeakPagefileUsage
" , PrivateUsage �: �- 0 _VM_COUNTERS_EX .?AU_VM_COUNTERS_EX@@ �- C � J � _KEY_BASIC_INFORMATION .?AU_KEY_BASIC_INFORMATION@@ ��Z
} LastWriteTime
" TitleIndex ���
" NameLength ���
Name �J �- _KEY_BASIC_INFORMATION .?AU_KEY_BASIC_INFORMATION@@ �� �- � � Z � NTFS_FILE_RECORD_OUTPUT_BUFFER .?AUNTFS_FILE_RECORD_OUTPUT_BUFFER@@ ��Z
} FileReferenceNumber ��
" FileRecordLength �
| FileRecordBuffer �Z �- NTFS_FILE_RECORD_OUTPUT_BUFFER .?AUNTFS_FILE_RECORD_OUTPUT_BUFFER@@ �� �- �
* � HGLRC__ .?AUHGLRC__@@
�-
�
t unused ���* �- HGLRC__ .?AUHGLRC__@@ �- R F � _DEDUP_FILE_OPERATION .?AU_DEDUP_FILE_OPERATION@@
�-
�
" Code �F �- _DEDUP_FILE_OPERATION .?AU_DEDUP_FILE_OPERATION@@ �-
�
� " " �-
�-
�
� �- �-
�-
� n � _TRANSACTIONMANAGER_RECOVERY_INFORMATION .?AU_TRANSACTIONMANAGER_RECOVERY_INFORMATION@@ ��
# LastRecoveredLsn �n �- _TRANSACTIONMANAGER_RECOVERY_INFORMATION .?AU_TRANSACTIONMANAGER_RECOVERY_INFORMATION@@ �� �- � � f � _SYSTEM_SYSTEM_PARTITION_INFORMATION .?AU_SYSTEM_SYSTEM_PARTITION_INFORMATION@@ ��
� SystemPartition ��f �- _SYSTEM_SYSTEM_PARTITION_INFORMATION .?AU_SYSTEM_SYSTEM_PARTITION_INFORMATION@@ �� �- Y
J � _IMAGE_TLS_DIRECTORY32 .?AU_IMAGE_TLS_DIRECTORY32@@ ��
�- ��
�-
�
" ��
" ��
" ���
" StartAddressOfRawData
" EndAddressOfRawData ��
" AddressOfIndex ���
" AddressOfCallBacks ���
" SizeOfZeroFill ���
" Characteristics ��
�- Reserved0
�- Alignment
�- Reserved1 J �- _IMAGE_TLS_DIRECTORY32 .?AU_IMAGE_TLS_DIRECTORY32@@ �� �- [ �
L$
� j
�- Parent ���
�- LeftChild
�- RightChild ���
p Balance ��
�
Reserved �B �- _RTL_BALANCED_LINKS .?AU_RTL_BALANCED_LINKS@@ �- ( � Z � _TXFS_WRITE_BACKUP_INFORMATION .?AU_TXFS_WRITE_BACKUP_INFORMATION@@ ��
| Buffer ���Z �- _TXFS_WRITE_BACKUP_INFORMATION .?AU_TXFS_WRITE_BACKUP_INFORMATION@@ �� �- }
ResolutionContext � �- _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING@@ �� �- L � � N � _OBJECT_BASIC_INFORMATION .?AU_OBJECT_BASIC_INFORMATION@@
�-
�
" Attributes ���
" GrantedAccess
" HandleCount ��
" PointerCount �
" PagedPoolCharge ��
" NonPagedPoolCharge ���
� Reserved �
" $ NameInfoSize �
" ( TypeInfoSize �
" , SecurityDescriptorSize ���
} 0 CreationTime �N �- 8 _OBJECT_BASIC_INFORMATION .?AU_OBJECT_BASIC_INFORMATION@@ �- � ) R � _OPERATION_START_PARAMETERS .?AU_OPERATION_START_PARAMETERS@@
�-
� >
" Version ��
" OperationId ��
" Flags R �- _OPERATION_START_PARAMETERS .?AU_OPERATION_START_PARAMETERS@@ �- � J � _UNLOAD_DLL_DEBUG_INFO .?AU_UNLOAD_DLL_DEBUG_INFO@@ ��
lpBaseOfDll ��J �- _UNLOAD_DLL_DEBUG_INFO .?AU_UNLOAD_DLL_DEBUG_INFO@@ �� �- c Y
�&
� �
# SdsStreamSize
# SdsAllocationSize
# SiiStreamSize
# SiiAllocationSize
# SdhStreamSize
# ( SdhAllocationSize
# 0 NumSDTotal ���
# 8 NumSDUnused ��J �- @ _SD_QUERY_STATS_OUTPUT .?AU_SD_QUERY_STATS_OUTPUT@@ �� �- �
�,
� �# " " �-
�-
� ~ � _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ ��"
N StrictHandleChecks ���~ �- _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ �� �- � E
�% �-
�-
�
#
� ^ � _CRITICAL_PROCESS_EXCEPTION_DATA .?AU_CRITICAL_PROCESS_EXCEPTION_DATA@@ ��v
� ReportId �
� ModuleName ���
" ModuleTimestamp ��
" ModuleSize ���
# Offset ���^ �- ( _CRITICAL_PROCESS_EXCEPTION_DATA .?AU_CRITICAL_PROCESS_EXCEPTION_DATA@@ �� �- V � _ETW_OPTICALIO_FLUSH_BUFFERS .?AU_ETW_OPTICALIO_FLUSH_BUFFERS@@ ��~
" DiskNumber ���
" IrpFlags �
# HighResResponseTime ��
IrpAddr ��
" IssuingThreadId ��V �- _ETW_OPTICALIO_FLUSH_BUFFERS .?AU_ETW_OPTICALIO_FLUSH_BUFFERS@@ �� �- � � J � _RPC_SECURITY_QOS_V4_A .?AU_RPC_SECURITY_QOS_V4_A@@ ��^ � _RPC_HTTP_TRANSPORT_CREDENTIALS_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_A@@
�-
�
�- HttpCredentials ��2 �- <anonymous-tag> .?AT<anonymous-tag>@@ �- � [ �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
�- u
Sid ��
u EffectiveOnly J �- _RPC_SECURITY_QOS_V4_A .?AU_RPC_SECURITY_QOS_V4_A@@ �� �- � T F � _PSFEATURE_CUSTPAPER .?AU_PSFEATURE_CUSTPAPER@@ ��r
lOrientation �
lWidth ���
lHeight ��
lWidthOffset �
lHeightOffset F �- _PSFEATURE_CUSTPAPER .?AU_PSFEATURE_CUSTPAPER@@ �� �- J
pObj �
u Size �
1 pfnBind ��
4 pfnUnbind J �- __GENERIC_BINDING_INFO .?AU__GENERIC_BINDING_INFO@@ �� �- � ; > � _ALPC_HANDLE_ATTR .?AU_ALPC_HANDLE_ATTR@@
" ��
" ��
" ��
" ��
" ��
" ��B � _ALPC_HANDLE_ATTR32 .?AU_ALPC_HANDLE_ATTR32@@
.
� &
" Flags
. Reserved0
. SameAccess ���
. SameAttributes ���
. Indirect �
. Inherit ��
. Reserved1
Handle ���
. HandleAttrArray ��
" ObjectType ���
" HandleCount ��
" DesiredAccess
" GrantedAccess >
. _ALPC_HANDLE_ATTR .?AU_ALPC_HANDLE_ATTR@@
. � ? B � threadmbcinfostruct .?AUthreadmbcinfostruct@@
.
�
~(
� : � tagCHARSETINFO .?AUtagCHARSETINFO@@ ��
.
� > � tagFONTSIGNATURE .?AUtagFONTSIGNATURE@@ ��6
u ciCharset
u ciACP
. fs ���: . tagCHARSETINFO .?AUtagCHARSETINFO@@ �� . � v WnfWellKnownStateName WnfPermanentStateName WnfPersistentStateName ��� WnfTemporaryStateName J t . _WNF_STATE_NAME_LIFETIME .?AW4_WNF_STATE_NAME_LIFETIME@@ ��� . @ V � _SYSTEM_HANDLE_INFORMATION_EX .?AU_SYSTEM_HANDLE_INFORMATION_EX@@ b � _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX@@ �� . " �F
" NumberOfHandles ��
" Reserved �
. Handles ��V . $ _SYSTEM_HANDLE_INFORMATION_EX .?AU_SYSTEM_HANDLE_INFORMATION_EX@@ . N � _ETW_OPTICALIO_READWRITE .?AU_ETW_OPTICALIO_READWRITE@@ ���
" DiskNumber ���
" IrpFlags �
" Size �
" Reserved �
# ByteOffset ���
FileObject ���
IrpAddr ��
# HighResResponseTime ��
" ( IssuingThreadId ��N . 0 _ETW_OPTICALIO_READWRITE .?AU_ETW_OPTICALIO_READWRITE@@ �� . � �
$'
�
l
� R � _SYSTEM_BASIC_INFORMATION64 .?AU_SYSTEM_BASIC_INFORMATION64@@ ^
" Reserved �
" TimerResolution ��
" PageSize �
" NumberOfPhysicalPages
" LowestPhysicalPageNumber �
" HighestPhysicalPageNumber
" AllocationGranularity
# MinimumUserModeAddress ���
# ( MaximumUserModeAddress ���
# 0 ActiveProcessorsAffinityMask �
p 8 NumberOfProcessors ���R %. @ _SYSTEM_BASIC_INFORMATION64 .?AU_SYSTEM_BASIC_INFORMATION64@@ &. �
�
� R � _IMAGE_DYNAMIC_RELOCATION32 .?AU_IMAGE_DYNAMIC_RELOCATION32@@ .
" Symbol ���
" BaseRelocSize R *. _IMAGE_DYNAMIC_RELOCATION32 .?AU_IMAGE_DYNAMIC_RELOCATION32@@ +. [ � F � _DesiredStorageClass .?AU_DesiredStorageClass@@ ��"
5 Class
" Flags F .. _DesiredStorageClass .?AU_DesiredStorageClass@@ �� /. � N � _THREAD_NAME_INFORMATION .?AU_THREAD_NAME_INFORMATION@@ ��
1.
�
� ThreadName ���N 3. _THREAD_NAME_INFORMATION .?AU_THREAD_NAME_INFORMATION@@ �� 4. a � B � _HEAP_RANGE_DESTROY .?AU_HEAP_RANGE_DESTROY@@ .
� Header ���
HeapHandle ���B 7. ( _HEAP_RANGE_DESTROY .?AU_HEAP_RANGE_DESTROY@@ 8. � � F � _SERVICE_START_REASON .?AU_SERVICE_START_REASON@@
" dwReason �F ;. _SERVICE_START_REASON .?AU_SERVICE_START_REASON@@ <. 3 �
J
�
�
� N � NTFS_EXTENDED_VOLUME_DATA .?AUNTFS_EXTENDED_VOLUME_DATA@@ 2
" ByteCount
! MajorVersion �
! MinorVersion �
" BytesPerPhysicalSector ���
! LfsMajorVersion ��
! LfsMinorVersion ��
" MaxDeviceTrimExtentCount �
" MaxDeviceTrimByteCount ���
" MaxVolumeTrimExtentCount �
" MaxVolumeTrimByteCount ���N
A. NTFS_EXTENDED_VOLUME_DATA .?AUNTFS_EXTENDED_VOLUME_DATA@@ B. � R � _ETW_THREAD_SET_NAME_EVENT .?AU_ETW_THREAD_SET_NAME_EVENT@@ ��B
" ProcessId
" ThreadId �
ThreadName ���R E. _ETW_THREAD_SET_NAME_EVENT .?AU_ETW_THREAD_SET_NAME_EVENT@@ �� F. � ,
�
� F
left �
top ��
right
bottom ���* I. _RECTL .?AU_RECTL@@ �� J. � N � tagEMRCREATEBRUSHINDIRECT .?AUtagEMRCREATEBRUSHINDIRECT@@ 6 � tagLOGBRUSH32 .?AUtagLOGBRUSH32@@ 6
emr ��
" ihBrush ��
M. lb ���N N. tagEMRCREATEBRUSHINDIRECT .?AUtagEMRCREATEBRUSHINDIRECT@@ O. b 6 � _SI_COPYFILE .?AU_SI_COPYFILE@@ ��
Q.
� r
" SourceFileNameLength �
" DestinationFileNameLength
" Flags
FileNameBuffer ���6 S. _SI_COPYFILE .?AU_SI_COPYFILE@@ �� T. F � _PHYSICAL_CHANNEL_RUN .?AU_PHYSICAL_CHANNEL_RUN@@
V.
� j
" NodeNumber ���
" ChannelNumber
# BasePage �
# PageCount
" Flags F X. _PHYSICAL_CHANNEL_RUN .?AU_PHYSICAL_CHANNEL_RUN@@ Y. j � _PROCESS_DYNAMIC_EH_CONTINUATION_TARGET .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGET@@
[.
� *
" TargetAddress
" Flags j ]. _PROCESS_DYNAMIC_EH_CONTINUATION_TARGET .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGET@@ ^. C r J � _PERFINFO_VIRTUAL_ALLOC .?AU_PERFINFO_VIRTUAL_ALLOC@@
`.
� ^
CapturedBase �
" CapturedRegionSize ���
" ProcessId
" Flags J b. _PERFINFO_VIRTUAL_ALLOC .?AU_PERFINFO_VIRTUAL_ALLOC@@ c. � Y
�
� r
dx ���
dy ���
" mouseData
" dwFlags ��
" time �
" dwExtraInfo ��6 f. tagMOUSEINPUT .?AUtagMOUSEINPUT@@ g. � n � _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION .?AU_ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION@@
i.
� >
" ulFlags ��
� RunLevel �
" UiAccess �n k. _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION .?AU_ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION@@ l. L � J � _ETW_HEAP_EVENT_REALLOC .?AU_ETW_HEAP_EVENT_REALLOC@@ �
� Header ���
HeapHandle ���
$ NewAddress ���
( OldAddress ���
" , NewSize ��
" 0 OldSize ��
" 4 Source ���J o. 8 _ETW_HEAP_EVENT_REALLOC .?AU_ETW_HEAP_EVENT_REALLOC@@ p. � �
v � _FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX@@ 2
� StorageReserveId �
SpaceUsed v s. _FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX@@ t. s+
� * � _TP_IO .?AU_TP_IO@@ ��
%+
� J � _MAXVERSIONTESTED_INFO .?AU_MAXVERSIONTESTED_INFO@@ ��
y.
�
# MaxVersionTested �J {. _MAXVERSIONTESTED_INFO .?AU_MAXVERSIONTESTED_INFO@@ �� |. L ^ � _DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK .?AU_DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK@@
~.
� �
" Signature
! Revision �
! Size �
! DpcWatchdogProfileOffset �
" DpcWatchdogProfileLength �^ �. _DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK .?AU_DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK@@ �. � � V � _PERFINFO_FILE_OPERATION_END .?AU_PERFINFO_FILE_OPERATION_END@@ ��
�.
� B
" Irp ��
" ExtraInformation �
Status ���V �. _PERFINFO_FILE_OPERATION_END .?AU_PERFINFO_FILE_OPERATION_END@@ �� �. � �
h
� R � _TXFS_START_RM_INFORMATION .?AU_TXFS_START_RM_INFORMATION@@ ��
�.
� B
" Flags
# LogContainerSize �
" LogContainerCountMin �
" LogContainerCountMax �
" LogGrowthIncrement ���
" LogAutoShrinkPercentage ��
" TmLogPathOffset ��
! $ TmLogPathLength ��
! & LoggingMode ��
! ( LogPathLength
! * Reserved �
, LogPath ��R �. 0 _TXFS_START_RM_INFORMATION .?AU_TXFS_START_RM_INFORMATION@@ �� �. N f � _SYSTEM_HYPERVISOR_QUERY_INFORMATION .?AU_SYSTEM_HYPERVISOR_QUERY_INFORMATION@@ ��
�.
� " �
HypervisorConnected ��
HypervisorDebuggingEnabled ���
HypervisorPresent
HypervisorSchedulerType ��
�. Spare0 ���
# EnabledEnlightenments f �. _SYSTEM_HYPERVISOR_QUERY_INFORMATION .?AU_SYSTEM_HYPERVISOR_QUERY_INFORMATION@@ �� �. 0 F SystemFirmwareTable_Enumerate SystemFirmwareTable_Get ��R t �. _SYSTEM_FIRMWARE_TABLE_ACTION .?AW4_SYSTEM_FIRMWARE_TABLE_ACTION@@ � �. { Q z
" ProviderSignature
�. Action ���
" TableID ��
" TableBufferLength
| TableBuffer ��b �. _SYSTEM_FIRMWARE_TABLE_INFORMATION .?AU_SYSTEM_FIRMWARE_TABLE_INFORMATION@@ �� �. { V
�%
� v � _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION .?AU_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION@@ ��
" Flags v �. _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION .?AU_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION@@ �� �. V � _WMI_IMAGELOAD_INFORMATION32 .?AU_WMI_IMAGELOAD_INFORMATION32@@ ��:
u ImageBase32 ��
u ImageSize32 ��
" ProcessId
" ImageChecksum
" TimeDateStamp
SignatureLevel ���
SignatureType
! Reserved0
u DefaultBase32
" Reserved1
" Reserved2
" $ Reserved3
" ( Reserved4
, FileName �V �. 0 _WMI_IMAGELOAD_INFORMATION32 .?AU_WMI_IMAGELOAD_INFORMATION32@@ �� �. � U b � _SYSTEM_PROCESSOR_IDLE_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_INFORMATION@@ ��
�.
� �
# IdleTime �
# C1Time ���
# C2Time ���
# C3Time ���
" C1Transitions
" $ C2Transitions
" ( C3Transitions
" , Padding ��b �. 0 _SYSTEM_PROCESSOR_IDLE_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_INFORMATION@@ �� �. Z � _MANAGE_HOT_PATCH_QUERY_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_PATCHES@@ &
� Sid ��
Z Buffer ���2 �. D <anonymous-tag> .?AT<anonymous-tag>@@ �. � F � _HOT_PATCH_IMAGE_INFO .?AU_HOT_PATCH_IMAGE_INFO@@
�.
� r
" Version ��
�. UserSid ��
" H PatchCount ���
< L PatchPathStrings �
�. P BaseInfos Z �. T _MANAGE_HOT_PATCH_QUERY_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_PATCHES@@ �. � > � _CLASSIC_EVENT_ID .?AU_CLASSIC_EVENT_ID@@ :
� EventGuid
Type �
� Reserved �> �. _CLASSIC_EVENT_ID .?AU_CLASSIC_EVENT_ID@@ �. � x
� N � _WMI_PROCESS_INFORMATION .?AU_WMI_PROCESS_INFORMATION@@ ��
�.
� �
" UniqueProcessKey �
" ProcessId
" ParentId �
" SessionId
ExitStatus ���
" DirectoryTableBase ���
" Flags
" Sid ��N �. _WMI_PROCESS_INFORMATION .?AU_WMI_PROCESS_INFORMATION@@ �� �. � � Z � _UMS_SYSTEM_THREAD_INFORMATION .?AU_UMS_SYSTEM_THREAD_INFORMATION@@ ��
" ��
" ��r
" UmsVersion ���
�. IsUmsSchedulerThread �
�. IsUmsWorkerThread
" ThreadUmsFlags ���Z �. _UMS_SYSTEM_THREAD_INFORMATION .?AU_UMS_SYSTEM_THREAD_INFORMATION@@ �� �. K N � _POWER_MONITOR_INVOCATION .?AU_POWER_MONITOR_INVOCATION@@ .
Console ��
� RequestReason N �. _POWER_MONITOR_INVOCATION .?AU_POWER_MONITOR_INVOCATION@@ �. W
� q " �. �.
�.
� B%
�.
� � CI_WINDOWS_LOCKDOWN_MODE_UNLOCKED CI_WINDOWS_LOCKDOWN_MODE_TRIAL ��� CI_WINDOWS_LOCKDOWN_MODE_LOCKED �� CI_WINDOWS_LOCKDOWN_MODE_MAX �J t �. _CI_WINDOWS_LOCKDOWN_MODE .?AW4_CI_WINDOWS_LOCKDOWN_MODE@@ � �. � j � _SERVICE_CONTROL_STATUS_REASON_PARAMSA .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSA@@ ��F
" dwReason �
p pszComment ���
ServiceStatus j �. , _SERVICE_CONTROL_STATUS_REASON_PARAMSA .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSA@@ �� �. 3 � N � _MIDL_METHOD_PROPERTY_MAP .?AU_MIDL_METHOD_PROPERTY_MAP@@
� ��
�.
� *
" Count
�. Properties ���N �. _MIDL_METHOD_PROPERTY_MAP .?AU_MIDL_METHOD_PROPERTY_MAP@@ �. � a J � _RPC_SECURITY_QOS_V4_W .?AU_RPC_SECURITY_QOS_V4_W@@ ��
�.
�
HttpCredentials ��2 �. <anonymous-tag> .?AT<anonymous-tag>@@ �. � M �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
�. u
Sid ��
u EffectiveOnly J �. _RPC_SECURITY_QOS_V4_W .?AU_RPC_SECURITY_QOS_V4_W@@ �� �. � F Z � _PROCESS_SYSTEM_RESOURCE_MANAGEMENT .?AT_PROCESS_SYSTEM_RESOURCE_MANAGEMENT@@
" ��
" ��>
" Flags
�. Foreground ���
�. Reserved �Z �. _PROCESS_SYSTEM_RESOURCE_MANAGEMENT .?AT_PROCESS_SYSTEM_RESOURCE_MANAGEMENT@@ �. a B j � _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION .?AU_JOBOBJECT_CPU_RATE_CONTROL_INFORMATION@@ j
" ControlFlags �
" CpuRate ��
" Weight ���
! MinRate ��
! MaxRate ��j �. _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION .?AU_JOBOBJECT_CPU_RATE_CONTROL_INFORMATION@@ �. C
<%
� R � PROCESSOR_PERFSTATE_POLICY .?AUPROCESSOR_PERFSTATE_POLICY@@ ��
��
��
��
��
AsUCHAR ��
�. NoDomainAccounting ���
�. IncreasePolicy ���
�. DecreasePolicy ���
�. Reserved �2 �. <anonymous-tag> .?AT<anonymous-tag>@@ �. � �
" Revision �
MaxThrottle ��
MinThrottle ��
BusyAdjThreshold �
Spare
�. Flags
" TimeCheck
" IncreaseTime �
" DecreaseTime �
" IncreasePercent ��
" DecreasePercent ��R �. PROCESSOR_PERFSTATE_POLICY .?AUPROCESSOR_PERFSTATE_POLICY@@ �� �. � : � _FXSAVE_FORMAT .?AU_FXSAVE_FORMAT@@ �� " � �"
! ControlWord ��
! StatusWord ���
! TagWord ��
! ErrorOpcode ��
" ErrorOffset ��
" ErrorSelector
" DataOffset ���
" DataSelector �
" MXCsr
" MXCsrMask
@ RegisterArea �
@ � Reserved3
�. Reserved4 :
�. �_FXSAVE_FORMAT .?AU_FXSAVE_FORMAT@@ �� �. } [ R � _PERFINFO_MEMORY_NODE_ENTRY .?AU_PERFINFO_MEMORY_NODE_ENTRY@@
�.
� .
" NodeNumber ���
# TotalPageCount ���
# SmallFreePageCount ���
# SmallZeroPageCount ���
# MediumFreePageCount ��
# $ MediumZeroPageCount ��
# , LargeFreePageCount ���
# 4 LargeZeroPageCount ���
# < HugeFreePageCount
# D HugeZeroPageCount R
�. L _PERFINFO_MEMORY_NODE_ENTRY .?AU_PERFINFO_MEMORY_NODE_ENTRY@@ �. � �
�
� J � _PERFINFO_TRACE_HEADER .?AU_PERFINFO_TRACE_HEADER@@ ��
" Marker ���
! Version ��
HeaderType ���
Flags
" Header ���
�" Packet ���
# TS ���
} SystemTime ���
| Data �J / _PERFINFO_TRACE_HEADER .?AU_PERFINFO_TRACE_HEADER@@ �� / � G
� / * � HHOOK__ .?AUHHOOK__@@
t unused ���* / HHOOK__ .?AUHHOOK__@@ / (
" ��
" ��
" ��
" ��
" ��n
/ Protection ���
/ ShareCount ���
/ Shared ���
/ Node �
/ VirtualPage ��N / _MEMORY_WORKING_SET_BLOCK .?AU_MEMORY_WORKING_SET_BLOCK@@ / 2 N � _FILE_RENAME_INFORMATION .?AU_FILE_RENAME_INFORMATION@@ ��v
ReplaceIfExists ��
" Flags
RootDirectory
" FileNameLength ���
FileName �N / _FILE_RENAME_INFORMATION .?AU_FILE_RENAME_INFORMATION@@ �� / 2 � _WMI_QUEUE .?AU_WMI_QUEUE@@ ��
/
� :
Queue
" ThreadId �
Action ���2 / _WMI_QUEUE .?AU_WMI_QUEUE@@ �� / � � " � _SE_SID .?AT_SE_SID@@ &
� Sid ��
Z Buffer ���" / D _SE_SID .?AT_SE_SID@@ / 3 � IMPORT_OBJECT_ORDINAL IMPORT_OBJECT_NAME ��� IMPORT_OBJECT_NAME_NO_PREFIX � IMPORT_OBJECT_NAME_UNDECORATE IMPORT_OBJECT_NAME_EXPORTAS ��F t / IMPORT_OBJECT_NAME_TYPE .?AW4IMPORT_OBJECT_NAME_TYPE@@ � !/ [ � b � _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE .?AU_ACCESS_ALLOWED_CALLBACK_OBJECT_ACE@@ �
o Header ���
" Mask �
" Flags
� ObjectType ���
� InheritedObjectType ��
" , SidStart �b $/ 0 _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE .?AU_ACCESS_ALLOWED_CALLBACK_OBJECT_ACE@@ %/ b � DISPLAYCONFIG_TARGET_PREFERRED_MODE .?AUDISPLAYCONFIG_TARGET_PREFERRED_MODE@@ N � DISPLAYCONFIG_TARGET_MODE .?AUDISPLAYCONFIG_TARGET_MODE@@ R
y header ���
u width
u height ���
(/ targetMode ���b )/ P DISPLAYCONFIG_TARGET_PREFERRED_MODE .?AUDISPLAYCONFIG_TARGET_PREFERRED_MODE@@ */
�-
�
�-
� : � _OSVERSIONINFOW .?AU_OSVERSIONINFOW@@
./
� �
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
*$ szCSDVersion �: 0/ _OSVERSIONINFOW .?AU_OSVERSIONINFOW@@ 1/ ( � � SystemFeatureConfigurationSectionTypeBoot SystemFeatureConfigurationSectionTypeRuntime � SystemFeatureConfigurationSectionTypeUsageTriggers ��� SystemFeatureConfigurationSectionTypeCount ���n t 3/ _SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE .?AW4_SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE@@ ��� 4/ y
4/
� j � _VIRTUALIZATION_INSTANCE_INFO_INPUT_EX .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT_EX@@ ��
! HeaderSize ���
" Flags
" NotificationInfoSize �
! NotificationInfoOffset ���
! ProviderMajorVersion �j 8/ _VIRTUALIZATION_INSTANCE_INFO_INPUT_EX .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT_EX@@ �� 9/ �" J � tagEMRSETDIBITSTODEVICE .?AUtagEMRSETDIBITSTODEVICE@@
;/
�
emr ��
� rclBounds
xDest
yDest
xSrc �
$ ySrc �
( cxSrc
, cySrc
" 0 offBmiSrc
" 4 cbBmiSrc �
" 8 offBitsSrc ���
" < cbBitsSrc
" @ iUsageSrc
" D iStartScan ���
" H cScans ���J =/ L tagEMRSETDIBITSTODEVICE .?AUtagEMRSETDIBITSTODEVICE@@ >/ Z � _ETW_AUTOBOOST_NO_ENTRIES_EVENT .?AU_ETW_AUTOBOOST_NO_ENTRIES_EVENT@@
@/
� &
Lock �
" ThreadId �Z B/ _ETW_AUTOBOOST_NO_ENTRIES_EVENT .?AU_ETW_AUTOBOOST_NO_ENTRIES_EVENT@@ C/ �
F � tagEMRTRANSPARENTBLT .?AUtagEMRTRANSPARENTBLT@@ ��R
emr ��
� rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
� 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d cxSrc
h cySrc F F/ l tagEMRTRANSPARENTBLT .?AUtagEMRTRANSPARENTBLT@@ �� G/ R � _PERFINFO_SET_DEVICES_STATE .?AU_PERFINFO_SET_DEVICES_STATE@@ V
" SystemState ��
Waking ���
Shutdown �
IrpMinor �R J/ _PERFINFO_SET_DEVICES_STATE .?AU_PERFINFO_SET_DEVICES_STATE@@ K/ � Z
�
� 6 � USN_RECORD_UNION .?ATUSN_RECORD_UNION@@ ��6 � USN_RECORD_V2 .?AUUSN_RECORD_V2@@ 6 � USN_RECORD_V3 .?AUUSN_RECORD_V3@@ 6 � USN_RECORD_V4 .?AUUSN_RECORD_V4@@ F
K& Header ���
O/ V2 ���
P/ V3 ���
Q/ V4 ���6 R/ P USN_RECORD_UNION .?ATUSN_RECORD_UNION@@ �� S/ � 6 � _INITIAL_TEB .?AU_INITIAL_TEB@@ ��
U/
� 2
OldStackBase �
OldStackLimit : W/ <anonymous-tag> .?AU<anonymous-tag>@@ X/ a " f
X/ OldInitialTeb
StackBase
StackLimit ���
StackAllocationBase ��6 Z/ _INITIAL_TEB .?AU_INITIAL_TEB@@ �� [/ a ! > � _IMAGE_LINENUMBER .?AU_IMAGE_LINENUMBER@@
]/
� :
" SymbolTableIndex �
" VirtualAddress ���2 _/ <anonymous-tag> .?AT<anonymous-tag>@@ `/ [ *
`/ Type �
! Linenumber ���> b/ _IMAGE_LINENUMBER .?AU_IMAGE_LINENUMBER@@ c/ [ � ��DPI_AWARENESS_INVALID ��� DPI_AWARENESS_UNAWARE DPI_AWARENESS_SYSTEM_AWARE ��� DPI_AWARENESS_PER_MONITOR_AWARE ��2 t e/ DPI_AWARENESS .?AW4DPI_AWARENESS@@ � f/
�
� ! " ��
� Cycles ���
# @ DiskEnergy ���
# H NetworkTailEnergy
# P MBBTailEnergy
# X NetworkTxRxBytes �
# ` MBBTxRxBytes �
i/ h Durations
! h ForegroundDuration ���
! p DesktopVisibleDuration ���
! x PSMForegroundDuration
" � CompositionRendered ��
" � CompositionDirtyGenerated
" � CompositionDirtyPropagated ���
" � Reserved1
� � AttributedCycles �
� � WorkOnBehalfCycles ���J j/ _PROCESS_ENERGY_VALUES .?AU_PROCESS_ENERGY_VALUES@@ �� k/ a $ * � _CURDIR .?AU_CURDIR@@ *
� DosPath ��
Handle ���* n/ _CURDIR .?AU_CURDIR@@ o/ �
Z q/ Z � _FILE_SFIO_RESERVE_INFORMATION .?AU_FILE_SFIO_RESERVE_INFORMATION@@ ��
" RequestsPerPeriod
" Period ���
RetryFailures
Discardable ��
" RequestSize ��
" NumOutstandingRequests ���Z t/ _FILE_SFIO_RESERVE_INFORMATION .?AU_FILE_SFIO_RESERVE_INFORMATION@@ �� u/ � . � HSPRITE__ .?AUHSPRITE__@@
t unused ���. x/ HSPRITE__ .?AUHSPRITE__@@ y/ ' �
3
� Z � _PERFINFO_SET_DEVICES_STATE_RET .?AU_PERFINFO_SET_DEVICES_STATE_RET@@
Status ���Z }/ _PERFINFO_SET_DEVICES_STATE_RET .?AU_PERFINFO_SET_DEVICES_STATE_RET@@ ~/ � e f � _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER .?AU_DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER@@ z
" Version ��
" QueryFlags ���
" HashAlgorithm
} RangeOffsetInFile
} RangeLength ��f �/ _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER .?AU_DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER@@ �/ > � _FILE_PREFETCH_EX .?AU_FILE_PREFETCH_EX@@
�/
� # " �J
" Type �
" Count
Context ��
�/ Prefetch �> �/ _FILE_PREFETCH_EX .?AU_FILE_PREFETCH_EX@@ �/
�%
� B � tagEMRSELECTPALETTE .?AUtagEMRSELECTPALETTE@@ "
emr ��
" ihPal B �/ tagEMRSELECTPALETTE .?AUtagEMRSELECTPALETTE@@ �/ �
l ��
�/
�
� ��
�/
� �/ �/ " t �/
�/
� N � tagPIXELFORMATDESCRIPTOR .?AUtagPIXELFORMATDESCRIPTOR@@ ��^
! nSize
! nVersion �
" dwFlags ��
iPixelType ���
cColorBits ���
cRedBits �
cRedShift
cGreenBits ���
cGreenShift ��
cBlueBits
cBlueShift ���
cAlphaBits ���
cAlphaShift ��
cAccumBits ���
cAccumRedBits
cAccumGreenBits ��
cAccumBlueBits ���
cAccumAlphaBits ��
cDepthBits ���
cStencilBits �
cAuxBuffers ��
iLayerType ���
bReserved
" dwLayerMask ��
" dwVisibleMask
" $ dwDamageMask �N �/ ( tagPIXELFORMATDESCRIPTOR .?AUtagPIXELFORMATDESCRIPTOR@@ �� �/
�&
� F � tagNCCALCSIZE_PARAMS .?AUtagNCCALCSIZE_PARAMS@@ �� � " 0 �
-
� "
�/ rgrc �
�/ 0 lppos F �/ 4 tagNCCALCSIZE_PARAMS .?AUtagNCCALCSIZE_PARAMS@@ �� �/ �
� � � �/
+
�
�
�
�
� ^ � _FILE_FS_SECTOR_SIZE_INFORMATION .?AU_FILE_FS_SECTOR_SIZE_INFORMATION@@ ��&
" LogicalBytesPerSector
" PhysicalBytesPerSectorForAtomicity ���
" PhysicalBytesPerSectorForPerformance �
" FileSystemEffectivePhysicalBytesPerSectorForAtomicity
" Flags
" ByteOffsetForSectorAlignment �
" ByteOffsetForPartitionAlignment ��^ �/ _FILE_FS_SECTOR_SIZE_INFORMATION .?AU_FILE_FS_SECTOR_SIZE_INFORMATION@@ �� �/ �
C
� b � _SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT .?AU_SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT@@
�/
� n
" Flags
" AlignmentShift ���
# FileOffsetToAlign
" FallbackAlignmentShift ���b �/ _SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT .?AU_SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT@@ �/ �!
�
� ^ � _TOKEN_BNO_ISOLATION_INFORMATION .?AU_TOKEN_BNO_ISOLATION_INFORMATION@@ ��:
q IsolationPrefix ��
IsolationEnabled �^ �/ _TOKEN_BNO_ISOLATION_INFORMATION .?AU_TOKEN_BNO_ISOLATION_INFORMATION@@ �� �/ - J � _TOKEN_SID_INFORMATION .?AU_TOKEN_SID_INFORMATION@@ ��
�/
�
Sid ��J �/ _TOKEN_SID_INFORMATION .?AU_TOKEN_SID_INFORMATION@@ �� �/ )
�!
�
�%
� � � _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@ ��n
" ReserveSize ��
" CommitSize ���
" PreferredNode
" Reserved �
Ssp �� �/ _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@ �� �/ a
� PerfInfoMMStatNotUsed PerfInfoMMStatAggregatePageCombine ��� PerfInfoMMStatIterationPageCombine ��� PerfInfoMMStatMax : t �/ _PERFINFO_MM_STAT .?AW4_PERFINFO_MM_STAT@@ � �/ � : � _VARIABLE_NAME .?AU_VARIABLE_NAME@@ ��
�/
� F
" NextEntryOffset ��
� VendorGuid ���
Name �: �/ _VARIABLE_NAME .?AU_VARIABLE_NAME@@ �� �/ { -
�
�
" ��
" �� " " � �Z
�/ Offset ���
�/ HasRenderingCommand ��
" HDC ��
�/ Buffer ���: �/ �_GDI_TEB_BATCH .?AU_GDI_TEB_BATCH@@ �� �/ C Z
�!
� V � _FILE_SFIO_VOLUME_INFORMATION .?AU_FILE_SFIO_VOLUME_INFORMATION@@
�/
� ^
" MaximumRequestsPerPeriod �
" MinimumPeriod
" MinimumTransferSize ��V �/ _FILE_SFIO_VOLUME_INFORMATION .?AU_FILE_SFIO_VOLUME_INFORMATION@@ �/ � R � tagPOINTER_DEVICE_PROPERTY .?AUtagPOINTER_DEVICE_PROPERTY@@ ��
t logicalMin ���
t logicalMax ���
t physicalMin ��
t physicalMax ��
u unit �
u unitExponent �
! usagePageId ��
! usageId ��R �/ tagPOINTER_DEVICE_PROPERTY .?AUtagPOINTER_DEVICE_PROPERTY@@ �� �/ �; > � tagANIMATIONINFO .?AUtagANIMATIONINFO@@ ��
�/
� .
u cbSize ���
t iMinAnimate ��> �/ tagANIMATIONINFO .?AUtagANIMATIONINFO@@ �� �/ B2
D
�
� 6
�/ ExceptionRecord ��
�/ ContextRecord B �/ _EXCEPTION_POINTERS .?AU_EXCEPTION_POINTERS@@ �/ % o
�
� 6
" HighEdgeFilter ���
" LowEdgeFilter J �/ _JOBOBJECT_WAKE_FILTER .?AU_JOBOBJECT_WAKE_FILTER@@ �� �/ a � V � _ETW_COVERAGE_SAMPLER_MODULE .?AU_ETW_COVERAGE_SAMPLER_MODULE@@ ��
�/
� *
" PathOffset ���
" PathLength ���
" DebugInfoOffset ��
" DebugInfoLength ��
" TimeDateStamp
" ImageChecksum
" ImageSize
" ModuleId �
" ModuleSequence ���
" $ ExeModuleId ��
" ( ExeModuleSequence
" , ExeProcessId �V �/ 0 _ETW_COVERAGE_SAMPLER_MODULE .?AU_ETW_COVERAGE_SAMPLER_MODULE@@ �� �/ � 2 B � tagENUMLOGFONTEXDVW .?AUtagENUMLOGFONTEXDVW@@ > � tagENUMLOGFONTEXW .?AUtagENUMLOGFONTEXW@@ :
�/ elfEnumLogfontEx �
� \elfDesignVector ��B �/ �tagENUMLOGFONTEXDVW .?AUtagENUMLOGFONTEXDVW@@ �/ U V � _KEY_OPEN_SUBKEYS_INFORMATION .?AU_KEY_OPEN_SUBKEYS_INFORMATION@@ 6 � KEY_PID_ARRAY .?AUKEY_PID_ARRAY@@ �/ " �&
" Count
�/ KeyArray �V �/ _KEY_OPEN_SUBKEYS_INFORMATION .?AU_KEY_OPEN_SUBKEYS_INFORMATION@@ �/ 3 t
� V � _ETW_TP_EVENT_POOL_TH_MIN_SET .?AU_ETW_TP_EVENT_POOL_TH_MIN_SET@@ >
� Header ���
PoolId ���
" $ ThreadNum V �/ ( _ETW_TP_EVENT_POOL_TH_MIN_SET .?AU_ETW_TP_EVENT_POOL_TH_MIN_SET@@ �/ � � f � _PERFINFO_YIELD_PROCESSOR_INFORMATION .?AU_PERFINFO_YIELD_PROCESSOR_INFORMATION@@ N
" YieldReason ��
" DpcWatchdogCount �
" DpcTimeCount �f �/ _PERFINFO_YIELD_PROCESSOR_INFORMATION .?AU_PERFINFO_YIELD_PROCESSOR_INFORMATION@@ �/ � � B � _RTL_LFG_RNG_STATE .?AU_RTL_LFG_RNG_STATE@@ ��
0
� " " � �6
0 SeedArray
" � Next �
" � NextP B 0 � _RTL_LFG_RNG_STATE .?AU_RTL_LFG_RNG_STATE@@ �� 0 ( �
� BootEntropySourceStructureUninitialized �� BootEntropySourceDisabledByPolicy BootEntropySourceNotPresent �� BootEntropySourceError ��� BootEntropySourceSuccess �Z t 0 _BOOT_ENTROPY_SOURCE_RESULT_CODE .?AW4_BOOT_ENTROPY_SOURCE_RESULT_CODE@@ ��� 0 Z � _SYSTEM_PAGEFILE_INFORMATION_EX .?AU_SYSTEM_PAGEFILE_INFORMATION_EX@@ V � _SYSTEM_PAGEFILE_INFORMATION .?AU_SYSTEM_PAGEFILE_INFORMATION@@ ��B
0 Info �
" MinimumSize ��
" MaximumSize ��Z 0 _SYSTEM_PAGEFILE_INFORMATION_EX .?AU_SYSTEM_PAGEFILE_INFORMATION_EX@@ 0 G > � _Wx86ThreadState .?AU_Wx86ThreadState@@ ��
0
� n
" CallBx86Eip ��
DeallocationCpu ��
UseKnownWx86Dll ��
p OleStubInvoked ���> 0 _Wx86ThreadState .?AU_Wx86ThreadState@@ �� 0 C g > � tagSCROLLBARINFO .?AUtagSCROLLBARINFO@@ ��
0
� �
" cbSize ���
� rcScrollBar ��
t dxyLineButton
t xyThumbTop ���
t xyThumbBottom
t reserved �
: $ rgstate ��> 0 < tagSCROLLBARINFO .?AUtagSCROLLBARINFO@@ �� 0 79
k
� 6 � _MUILANGUAGES .?AU_MUILANGUAGES@@ 6 � _MUILANGINFO .?AU_MUILANGINFO@@ ��
0
� ~
u TotalSize
! MaxNumLanguages ��
! NumLanguages �
! NumInstalledLanguages
0 LangInfos 6 0 _MUILANGUAGES .?AU_MUILANGUAGES@@ 0 � <
�
� F
left �
top ��
right
bottom ���* 0 tagRECT .?AUtagRECT@@ !0 �
1
�
t unused ���* $0 HMENU__ .?AUHMENU__@@ %0 Z F � _GHOSTED_FILE_EXTENT .?AU_GHOSTED_FILE_EXTENT@@ ��
} FileOffset ���
} ByteCount
� RecallOwnerGuid ��
" NextEntryOffset ��
" $ RecallMetadataBufferSize �
| ( RecallMetadataBuffer �F (0 0 _GHOSTED_FILE_EXTENT .?AU_GHOSTED_FILE_EXTENT@@ �� )0 �* J � _KCRM_TRANSACTION_BLOB .?AU_KCRM_TRANSACTION_BLOB@@ ��
� UOW ��
� TmIdentity ���
" IsolationLevel ���
" $ IsolationFlags ���
" ( Timeout ��
� , Description ��J ,0 � _KCRM_TRANSACTION_BLOB .?AU_KCRM_TRANSACTION_BLOB@@ �� -0 J � ^ � _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE .?AU_SYSTEM_AUDIT_CALLBACK_OBJECT_ACE@@ �
o Header ���
" Mask �
" Flags
� ObjectType ���
� InheritedObjectType ��
" , SidStart �^ 00 0 _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE .?AU_SYSTEM_AUDIT_CALLBACK_OBJECT_ACE@@ 10 ' � DynamicTickDisableReasonNone � DynamicTickDisableReasonBcdOverride �� DynamicTickDisableReasonNoHwSupport �� DynamicTickDisableReasonEmOverride ��� DynamicTickDisableReasonMax ��b t 30 _PERFINFO_DYNAMIC_TICK_DISABLE_REASON .?AW4_PERFINFO_DYNAMIC_TICK_DISABLE_REASON@@ � 40 �
B � _RTL_STACK_CONTEXT .?AU_RTL_STACK_CONTEXT@@ ��N � _RTL_STACK_CONTEXT_ENTRY .?AU_RTL_STACK_CONTEXT_ENTRY@@ �� 70 " �.
" NumberOfEntries ��
80 Entry B 90 _RTL_STACK_CONTEXT .?AU_RTL_STACK_CONTEXT@@ �� :0 � � �
" DeviceInstance ���
" DeviceFlags ��
" ResourceType �
# ResourceStart
# ResourceEnd ��
" ResourceFlags ^ <0 ( _PLUGPLAY_CONTROL_CONFLICT_ENTRY .?AU_PLUGPLAY_CONTROL_CONFLICT_ENTRY@@ �� =0 � �
" ��
" ��
" ��n
" Flags
?0 DisableNonSystemFonts
@0 AuditNonSystemFontLoading
A0 ReservedFlags j B0 _PROCESS_MITIGATION_FONT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_FONT_DISABLE_POLICY@@ C0 C �
�$
� :
! Level
! Sbz ��
� ObjectType ���> F0 _OBJECT_TYPE_LIST .?AU_OBJECT_TYPE_LIST@@ G0 :
�
� F � tagNONCLIENTMETRICSA .?AUtagNONCLIENTMETRICSA@@ ��
u cbSize ���
t iBorderWidth �
t iScrollWidth �
t iScrollHeight
t iCaptionWidth
t iCaptionHeight ���
l lfCaptionFont
t T iSmCaptionWidth ��
t X iSmCaptionHeight �
l \ lfSmCaptionFont ��
t � iMenuWidth ���
t � iMenuHeight ��
l � lfMenuFont ���
l � lfStatusFont �
l lfMessageFont
t TiPaddedBorderWidth ���F K0 XtagNONCLIENTMETRICSA .?AUtagNONCLIENTMETRICSA@@ �� L0 �1 F � tagEMRCREATEMONOBRUSH .?AUtagEMRCREATEMONOBRUSH@@
N0
� �
emr ��
" ihBrush ��
" iUsage ���
" offBmi ���
" cbBmi
" offBits ��
" cbBits ���F P0 tagEMRCREATEMONOBRUSH .?AUtagEMRCREATEMONOBRUSH@@ Q0 j
� v � _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION@@ &
ImageFile
" Type �v U0 _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION@@ V0 3 R � _LPC_UNREGISTER_PROCESS_MSG .?AU_LPC_UNREGISTER_PROCESS_MSG@@
X0
� 2
� PortMsg ��
UniqueProcessId ��R Z0 _LPC_UNREGISTER_PROCESS_MSG .?AU_LPC_UNREGISTER_PROCESS_MSG@@ [0 � � F � _PERFINFO_CCSWAP_LITE .?AU_PERFINFO_CCSWAP_LITE@@
]0
�
" ��
" ��
" ��
" ��
" ��~
_0 DataType �
`0 OldThreadIdIndex �
a0 OldThreadPriInc ��
b0 OldThreadStateWr �
c0 TimeDelta F d0 _PERFINFO_CCSWAP_LITE .?AU_PERFINFO_CCSWAP_LITE@@ e0 � � B � _PROCESS_HEAP_ENTRY .?AU_PROCESS_HEAP_ENTRY@@
g0
� *
hMem �
h dwReserved ���: i0 <anonymous-tag> .?AU<anonymous-tag>@@ j0 c � j
" dwCommittedSize ��
" dwUnCommittedSize
lpFirstBlock �
lpLastBlock ��: l0 <anonymous-tag> .?AU<anonymous-tag>@@ m0 c � �
lpData ���
" cbData ���
cbOverhead ���
iRegionIndex �
!
wFlags ���
j0 Block
m0 Region ���B o0 _PROCESS_HEAP_ENTRY .?AU_PROCESS_HEAP_ENTRY@@ p0 c � f � _SYSTEM_WRITE_CONSTRAINT_INFORMATION .?AU_SYSTEM_WRITE_CONSTRAINT_INFORMATION@@ ��
r0
� 6
" WriteConstraintPolicy
" Reserved �f t0 _SYSTEM_WRITE_CONSTRAINT_INFORMATION .?AU_SYSTEM_WRITE_CONSTRAINT_INFORMATION@@ �� u0 s b � _TXFS_ROLLFORWARD_REDO_INFORMATION .?AU_TXFS_ROLLFORWARD_REDO_INFORMATION@@ ��f
} LastVirtualClock �
# LastRedoLsn ��
# HighestRecoveryLsn ���
" Flags b x0 _TXFS_ROLLFORWARD_REDO_INFORMATION .?AU_TXFS_ROLLFORWARD_REDO_INFORMATION@@ �� y0 x f � _TRANSACTION_ENLISTMENTS_INFORMATION .?AU_TRANSACTION_ENLISTMENTS_INFORMATION@@ �� " �>
" NumberOfEnlistments ��
}0 EnlistmentPair ���f ~0 $ _TRANSACTION_ENLISTMENTS_INFORMATION .?AU_TRANSACTION_ENLISTMENTS_INFORMATION@@ �� 0 �
�
� �
! Machine ��
! NumberOfSections �
" TimeDateStamp
" PointerToSymbolTable �
" NumberOfSymbols ��
! SizeOfOptionalHeader �
! Characteristics ��B �0 _IMAGE_FILE_HEADER .?AU_IMAGE_FILE_HEADER@@ �� �0 [ � J � tagEMRSETWORLDTRANSFORM .?AUtagEMRSETWORLDTRANSFORM@@ "
emr ��
� xform J �0 tagEMRSETWORLDTRANSFORM .?AUtagEMRSETWORLDTRANSFORM@@ �0 � b � _FINDFIRSTACTIVATIONCONTEXTSECTION .?AU_FINDFIRSTACTIVATIONCONTEXTSECTION@@ ��n
" Size �
" Flags
_ ExtensionGuid
" Id ���
" Depth
" OutFlags �b �0 _FINDFIRSTACTIVATIONCONTEXTSECTION .?AU_FINDFIRSTACTIVATIONCONTEXTSECTION@@ �� �0 L 3 ^ � _WORKER_FACTORY_BASIC_INFORMATION .?AU_WORKER_FACTORY_BASIC_INFORMATION@@
1%
� ^
} Timeout ��
} RetryTimeout �
} IdleTimeout ��
Paused ���
TimerSet �
QueuedToExWorker �
MayCreate
CreateInProgress �
InsertedIntoQueue
Shutdown �
" BindingCount �
" $ ThreadMinimum
" ( ThreadMaximum
" , PendingWorkerCount ���
" 0 WaitingWorkerCount ���
" 4 TotalWorkerCount �
" 8 ReleaseCount �
@ InfiniteWaitGoal �
�0 H StartRoutine �
L StartParameter ���
P ProcessId
" T StackReserve �
" X StackCommit ��
\ LastThreadCreationStatus �^ �0 ` _WORKER_FACTORY_BASIC_INFORMATION .?AU_WORKER_FACTORY_BASIC_INFORMATION@@ �0 � � PoDisabledStateSleeping1 � PoDisabledStateSleeping2 � PoDisabledStateSleeping3 � PoDisabledStateSleeping4 � PoDisabledStateSleeping0Idle � PoDisabledStateReserved5 � PoDisabledStateSleeping4Firmware � PoDisabledStateMaximum ���J t �0 POWER_STATE_DISABLED_TYPE .?AW4POWER_STATE_DISABLED_TYPE@@ � �0 N � _ETW_TP_EVENT_POOL_CLOSE .?AU_ETW_TP_EVENT_POOL_CLOSE@@ ��*
� Header ���
PoolId ���N �0 ( _ETW_TP_EVENT_POOL_CLOSE .?AU_ETW_TP_EVENT_POOL_CLOSE@@ �� �0 � �
`)
� N � _WMI_IMAGEID_INFORMATION .?AU_WMI_IMAGEID_INFORMATION@@ ��r
ImageBase
" ImageSize
" ProcessId
" TimeDateStamp
OriginalFileName �N �0 _WMI_IMAGEID_INFORMATION .?AU_WMI_IMAGEID_INFORMATION@@ �� �0 � y r � _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION .?AU_SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION@@ ��"
S EnclaveLaunchSigner ��r �0 _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION .?AU_SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION@@ �� �0 N
�
� �0 ! t �0
�0
� j � _TRANSACTIONMANAGER_OLDEST_INFORMATION .?AU_TRANSACTIONMANAGER_OLDEST_INFORMATION@@ ��
�0
� "
� OldestTransactionGuid j �0 _TRANSACTIONMANAGER_OLDEST_INFORMATION .?AU_TRANSACTIONMANAGER_OLDEST_INFORMATION@@ �� �0 � � N � _ENCLAVE_CREATE_INFO_VBS .?AU_ENCLAVE_CREATE_INFO_VBS@@ ��&
" Flags
S OwnerID ��N �0 $ _ENCLAVE_CREATE_INFO_VBS .?AU_ENCLAVE_CREATE_INFO_VBS@@ �� �0 ? �
X
� " � �f
! Magic
MajorLinkerVersion ���
MinorLinkerVersion ���
" SizeOfCode ���
" SizeOfInitializedData
" SizeOfUninitializedData ��
" AddressOfEntryPoint ��
" BaseOfCode ���
" BaseOfData ���
" ImageBase
" SectionAlignment �
" $ FileAlignment
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
! , MajorImageVersion
! . MinorImageVersion
! 0 MajorSubsystemVersion
! 2 MinorSubsystemVersion
" 4 Win32VersionValue
" 8 SizeOfImage ��
" < SizeOfHeaders
" @ CheckSum �
! D Subsystem
! F DllCharacteristics ���
" H SizeOfStackReserve ���
" L SizeOfStackCommit
" P SizeOfHeapReserve
" T SizeOfHeapCommit �
" X LoaderFlags ��
" \ NumberOfRvaAndSizes ��
�0 ` DataDirectory J �0 � _IMAGE_OPTIONAL_HEADER .?AU_IMAGE_OPTIONAL_HEADER@@ �� �0 [ J � RPC_INTERFACE_TEMPLATEW .?AURPC_INTERFACE_TEMPLATEW@@
�0
� �0
�0
� 6 � _UUID_VECTOR .?AU_UUID_VECTOR@@ ��
�0
� �
" Version ��
IfSpec ���
�0 MgrTypeUuid ��
MgrEpv ���
u Flags
u MaxCalls �
u MaxRpcSize ���
�0 IfCallback ���
�0 UuidVector ���
q $ Annotation ���
( SecurityDescriptor ���J �0 , RPC_INTERFACE_TEMPLATEW .?AURPC_INTERFACE_TEMPLATEW@@ �0 � V � _RTL_SEGMENT_HEAP_PARAMETERS .?AU_RTL_SEGMENT_HEAP_PARAMETERS@@ �� " " �b
! Version ��
! Size �
" Flags
�+ MemorySource �
�0 Reserved �V �0 0 _RTL_SEGMENT_HEAP_PARAMETERS .?AU_RTL_SEGMENT_HEAP_PARAMETERS@@ �� �0 ( �
N � _SYSTEM_FLUSH_INFORMATION .?AU_SYSTEM_FLUSH_INFORMATION@@
�0
� ~
" SupportedFlushMethods
" ProcessorCacheFlushSize ��
# SystemFlushCapabilities ��
� Reserved �N �0 _SYSTEM_FLUSH_INFORMATION .?AU_SYSTEM_FLUSH_INFORMATION@@ �0 Q R � _PROCESS_WINDOW_INFORMATION .?AU_PROCESS_WINDOW_INFORMATION@@
�0
� N
" WindowFlags ��
! WindowTitleLength
WindowTitle ��R �0 _PROCESS_WINDOW_INFORMATION .?AU_PROCESS_WINDOW_INFORMATION@@ �0 a � f � _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO .?AU_PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO@@ ��
! ��
! ��
! ��j
! Flags
�0 ActiveDataReference ��
�0 DeviceEjectable ��
�0 WritableHandles ��2 �0 <anonymous-tag> .?AT<anonymous-tag>@@ �0 � j
FileObject ���
" DeviceCharacteristics
! FileCharacteristics ��
�0
Flags f �0 _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO .?AU_PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO@@ �� �0 � ^ � _PERFINFO_PMC_SAMPLE_INFORMATION .?AU_PERFINFO_PMC_SAMPLE_INFORMATION@@ ��
�0
� b
InstructionPointer ���
" ThreadId �
! ProfileSource
!
Reserved �^ �0 _PERFINFO_PMC_SAMPLE_INFORMATION .?AU_PERFINFO_PMC_SAMPLE_INFORMATION@@ �� �0 � � b � _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM .?AU_SERVICE_TRIGGER_SPECIFIC_DATA_ITEM@@
�0
� z
" dwTriggerType
" dwAction �
� pTriggerSubtype ��
" cDataItems ���
�0 pDataItems ���> �0 _SERVICE_TRIGGER .?AU_SERVICE_TRIGGER@@ �� �0 3 | : �0
�
� N � _PERFINFO_PROCESS_INSWAP .?AU_PERFINFO_PROCESS_INSWAP@@ ��6
" DirectoryTableBase ���
" ProcessId N �0 _PERFINFO_PROCESS_INSWAP .?AU_PERFINFO_PROCESS_INSWAP@@ �� �0 � #
e%
� f � _TRANSACTIONMANAGER_BASIC_INFORMATION .?AU_TRANSACTIONMANAGER_BASIC_INFORMATION@@
�0
� 2
� TmIdentity ���
} VirtualClock �f �0 _TRANSACTIONMANAGER_BASIC_INFORMATION .?AU_TRANSACTIONMANAGER_BASIC_INFORMATION@@ �0 � �
5"
� B � tagCOLORADJUSTMENT .?AUtagCOLORADJUSTMENT@@ ��
�0
� .
! caSize ���
! caFlags ��
! caIlluminantIndex
! caRedGamma ���
! caGreenGamma �
!
caBlueGamma ��
! caReferenceBlack �
! caReferenceWhite �
caContrast ���
caBrightness �
caColorfulness ���
caRedGreenTint ���B �0 tagCOLORADJUSTMENT .?AUtagCOLORADJUSTMENT@@ �� �0 p V � _SYSTEM_HIBERFILE_INFORMATION .?AU_SYSTEM_HIBERFILE_INFORMATION@@
�0
� } " �.
" NumberOfMcbPairs �
�0 Mcb ��V �0 _SYSTEM_HIBERFILE_INFORMATION .?AU_SYSTEM_HIBERFILE_INFORMATION@@ �0 � 6 � _IELF_HANDLE .?AU_IELF_HANDLE@@ ��
� Next �
# LastRecordRead ���
WorkItem �
LogPublisher �
LogModule
" RefCount �
" Signature
" $ Flags
" ( MajorVersion �
" , MinorVersion �
" 0 dwNotifyRequests �
" 4 NameLength ���
8 Name �6
�0 @ _IELF_HANDLE .?AU_IELF_HANDLE@@ �� �0 � _ z
! MakeCode �
! Flags
! Reserved �
! VKey �
u Message ��
" ExtraInformation �: �0 tagRAWKEYBOARD .?AUtagRAWKEYBOARD@@ �� �0 �:
��
��
��
��V
1 Channel ��
1 Reserved �
1 Shared ���
1 MoreEntries ��N 1 _DMA_CONFIGURATION_BYTE0 .?AU_DMA_CONFIGURATION_BYTE0@@ �� 1 � � N � USN_TRACK_MODIFIED_RANGES .?AUUSN_TRACK_MODIFIED_RANGES@@ V
" Flags
" Unused ���
# ChunkSize
FileSizeThreshold N 1 USN_TRACK_MODIFIED_RANGES .?AUUSN_TRACK_MODIFIED_RANGES@@
1 R
m!
� N � _ETW_STACK_CACHING_CONFIG .?AU_ETW_STACK_CACHING_CONFIG@@ .
" CacheSize
" BucketCount ��N 1 _ETW_STACK_CACHING_CONFIG .?AU_ETW_STACK_CACHING_CONFIG@@ 1 � > V � _SYSTEM_CALL_TIME_INFORMATION .?AU_SYSTEM_CALL_TIME_INFORMATION@@
1
� F
" Length ���
" TotalCalls ���
�0 TimeOfCalls ��V 1 _SYSTEM_CALL_TIME_INFORMATION .?AU_SYSTEM_CALL_TIME_INFORMATION@@ 1 � R � tagWTSSESSION_NOTIFICATION .?AUtagWTSSESSION_NOTIFICATION@@ ��
1
� .
" cbSize ���
" dwSessionId ��R 1 tagWTSSESSION_NOTIFICATION .?AUtagWTSSESSION_NOTIFICATION@@ �� 1 ~ J � _KEY_FLAGS_INFORMATION .?AU_KEY_FLAGS_INFORMATION@@ ��F
" Wow64Flags ���
" KeyFlags �
" ControlFlags �J 1 _KEY_FLAGS_INFORMATION .?AU_KEY_FLAGS_INFORMATION@@ �� 1 3 R J � _FILEOFFSET_INFORMATION .?AU_FILEOFFSET_INFORMATION@@
# ��
# 0 ��
# 9��>
1 DontUse ��
!1 Offset ���
"1 Reserved �J #1 _FILEOFFSET_INFORMATION .?AU_FILEOFFSET_INFORMATION@@ $1 b � _PROCESS_COMMIT_RELEASE_INFORMATION .?AU_PROCESS_COMMIT_RELEASE_INFORMATION@@
&1
�
" ��
" ��
" ��
" ���
" Version ��
(1 Eligible �
)1 ReleaseRepurposedMemResetCommit ��
*1 ForceReleaseMemResetCommit ���
+1 Spare
" CommitDebt ���
" CommittedMemResetSize
" RepurposedMemResetSize ���b ,1 _PROCESS_COMMIT_RELEASE_INFORMATION .?AU_PROCESS_COMMIT_RELEASE_INFORMATION@@ -1 a �
�.
�
3
� * � HIMCC__ .?AUHIMCC__@@
t unused ���* 21 HIMCC__ .?AUHIMCC__@@ 31 E 6 � tagMINMAXINFO .?AUtagMINMAXINFO@@
51
� ~
x ptReserved ���
x ptMaxSize
x ptMaxPosition
x ptMinTrackSize ���
x ptMaxTrackSize ���6 71 ( tagMINMAXINFO .?AUtagMINMAXINFO@@ 81 � B � _EXCEPTION_RECORD64 .?AU_EXCEPTION_RECORD64@@ # " x ��
ExceptionCode
" ExceptionFlags ���
# ExceptionRecord ��
# ExceptionAddress �
" NumberParameters �
" __unusedAlignment
;1 ExceptionInformation �B <1 � _EXCEPTION_RECORD64 .?AU_EXCEPTION_RECORD64@@ =1 % a
.,
� * � pvalueA .?AUpvalueA@@ b
p pv_valuename �
t pv_valuelen ��
pv_value_context �
" pv_type ��* A1 pvalueA .?AUpvalueA@@ B1 H � :
" uMsg �
! wParamL ��
! wParamH ��> D1 tagHARDWAREINPUT .?AUtagHARDWAREINPUT@@ �� E1 � R � _FSCTL_OFFLOAD_WRITE_OUTPUT .?AU_FSCTL_OFFLOAD_WRITE_OUTPUT@@ :
" Size �
" Flags
# LengthWritten R H1 _FSCTL_OFFLOAD_WRITE_OUTPUT .?AU_FSCTL_OFFLOAD_WRITE_OUTPUT@@ I1 � > � tagENHMETARECORD .?AUtagENHMETARECORD@@ ��2
" iType
" nSize
� dParm > L1 tagENHMETARECORD .?AUtagENHMETARECORD@@ �� M1 4 ^ � _RTLP_PROCESS_REFLECTION_CONTEXT .?AU_RTLP_PROCESS_REFLECTION_CONTEXT@@ ��
O1
�
1%
�
" ReflectionContextSize
" ReflectionFlags ��
Q1 ReflectionRoutine
ReflectionParameter ��
ReflectedProcessCreatedEvent �
ReflectedProcessHandlesDuplicatedEvent ���
ReflectionStartEvent �
� ReflectionInformation ^ R1 , _RTLP_PROCESS_REFLECTION_CONTEXT .?AU_RTLP_PROCESS_REFLECTION_CONTEXT@@ �� S1 L � 6 � _RTL_BACKOFF .?AU_RTL_BACKOFF@@ ��
" Delay 6 V1 _RTL_BACKOFF .?AU_RTL_BACKOFF@@ �� W1 � � b � _FILE_VALID_DATA_LENGTH_INFORMATION .?AU_FILE_VALID_DATA_LENGTH_INFORMATION@@
} ValidDataLength ��b Z1 _FILE_VALID_DATA_LENGTH_INFORMATION .?AU_FILE_VALID_DATA_LENGTH_INFORMATION@@ [1 �
X)
� 6 � tagSTICKYKEYS .?AUtagSTICKYKEYS@@
^1
� *
u cbSize ���
" dwFlags ��6 `1 tagSTICKYKEYS .?AUtagSTICKYKEYS@@ a1 �3 J � _FILE_LEVEL_TRIM_RANGE .?AU_FILE_LEVEL_TRIM_RANGE@@ ��*
# Offset ���
# Length ���J d1 _FILE_LEVEL_TRIM_RANGE .?AU_FILE_LEVEL_TRIM_RANGE@@ �� e1 9 J � _IMAGE_ENCLAVE_CONFIG32 .?AU_IMAGE_ENCLAVE_CONFIG32@@ F
" Size �
" MinimumRequiredConfigSize
" PolicyFlags ��
" NumberOfImports ��
" ImportList ���
" ImportEntrySize ��
� FamilyID �
� ( ImageID ��
" 8 ImageVersion �
" < SecurityVersion ��
" @ EnclaveSize ��
" D NumberOfThreads ��
" H EnclaveFlags �J
h1 L _IMAGE_ENCLAVE_CONFIG32 .?AU_IMAGE_ENCLAVE_CONFIG32@@ i1 [ c �
�' TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
q ServerCertificateSubject �^ k1 _RPC_HTTP_TRANSPORT_CREDENTIALS_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_W@@ l1 � � 6 � tagSTYLEBUFW .?AUtagSTYLEBUFW@@ ��.
" dwStyle ��
� szDescription 6 o1 D tagSTYLEBUFW .?AUtagSTYLEBUFW@@ �� p1 E � F � tagEMRSETMAPPERFLAGS .?AUtagEMRSETMAPPERFLAGS@@ ��
r1
� &
emr ��
" dwFlags ��F t1 tagEMRSETMAPPERFLAGS .?AUtagEMRSETMAPPERFLAGS@@ �� u1 � } w1
�
� J � _PERFINFO_CC_READ_AHEAD .?AU_PERFINFO_CC_READ_AHEAD@@ �
" WorkItemKey ��
# FileOffset ���
" Size �
" PagePriority �
" DetectedPattern ��
" Reserved �J {1 _PERFINFO_CC_READ_AHEAD .?AU_PERFINFO_CC_READ_AHEAD@@ |1 � � # / B � _GLYPHMETRICSFLOAT .?AU_GLYPHMETRICSFLOAT@@ ��
1
� 2 � _POINTFLOAT .?AU_POINTFLOAT@@ ~
@ gmfBlackBoxX �
@ gmfBlackBoxY �
�1 gmfptGlyphOrigin �
@ gmfCellIncX ��
@ gmfCellIncY ��B
�1 _GLYPHMETRICSFLOAT .?AU_GLYPHMETRICSFLOAT@@ �� �1 U J � _EXIT_THREAD_DEBUG_INFO .?AU_EXIT_THREAD_DEBUG_INFO@@
" dwExitCode ���J �1 _EXIT_THREAD_DEBUG_INFO .?AU_EXIT_THREAD_DEBUG_INFO@@ �1 c H : � DLGITEMTEMPLATE .?AUDLGITEMTEMPLATE@@ v
" style
" dwExtendedStyle ��
x
y
cx ���
cy ���
! id ���: �1 DLGITEMTEMPLATE .?AUDLGITEMTEMPLATE@@ �1 X J � _WMI_JOB_REMOVE_PROCESS .?AU_WMI_JOB_REMOVE_PROCESS@@ v
� ContainerId ��
" JobId
" UniqueProcessId ��
" RemovalFlags �
ExitStatus ���J �1 _WMI_JOB_REMOVE_PROCESS .?AU_WMI_JOB_REMOVE_PROCESS@@ �1 � � B � _WINDOWS_OS_OPTIONS .?AU_WINDOWS_OS_OPTIONS@@ r
� Signature
" Version ��
" Length ���
" OsLoadPathOffset �
OsLoadOptions B �1 _WINDOWS_OS_OPTIONS .?AU_WINDOWS_OS_OPTIONS@@ �1 � > � localeinfo_struct .?AUlocaleinfo_struct@@ J � threadlocaleinfostruct .?AUthreadlocaleinfostruct@@ ��
�1
�
.
� *
�1 locinfo ��
�1 mbcinfo ��> �1 localeinfo_struct .?AUlocaleinfo_struct@@ �1 �' � N � _PROCESS_TLS_INFORMATION .?AU_PROCESS_TLS_INFORMATION@@ ��J � _THREAD_TLS_INFORMATION .?AU_THREAD_TLS_INFORMATION@@ �1 " �
" Flags
" OperationType
" ThreadDataCount ��
" TlsIndex �
" PreviousCount
�1 ThreadData ���N �1 _PROCESS_TLS_INFORMATION .?AU_PROCESS_TLS_INFORMATION@@ �� �1 a o B PerfInfoMemUsagePfnMetadata �� PerfInfoMemUsageMax ��Z t �1 _PERFINFO_KERNELMEMORY_USAGE_TYPE .?AW4_PERFINFO_KERNELMEMORY_USAGE_TYPE@@ � �1 � R � _PERFINFO_IDLE_STATE_CHANGE .?AU_PERFINFO_IDLE_STATE_CHANGE@@ :
" State
" Throttle �
" Direction R �1 _PERFINFO_IDLE_STATE_CHANGE .?AU_PERFINFO_IDLE_STATE_CHANGE@@ �1 � 4 6 � tagEMRELLIPSE .?AUtagEMRELLIPSE@@ &
emr ��
� rclBox ���6 �1 tagEMRELLIPSE .?AUtagEMRELLIPSE@@ �1
�'
� �
" lcsSignature �
" lcsVersion ���
" lcsSize ��
lcsCSType
lcsIntent
; lcsEndpoints �
" 8 lcsGammaRed ��
" < lcsGammaGreen
" @ lcsGammaBlue �
s D lcsFilename ��>
�1 LtagLOGCOLORSPACEW .?AUtagLOGCOLORSPACEW@@ �1
!
�
�( ��
�1
� ^ � _SYSTEM_CODEINTEGRITY_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_INFORMATION@@ 6
" Length ���
" CodeIntegrityOptions �^ �1 _SYSTEM_CODEINTEGRITY_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_INFORMATION@@ �1 �
R � _SHRINK_VOLUME_INFORMATION .?AU_SHRINK_VOLUME_INFORMATION@@ ��> ShrinkPrepare ShrinkCommit � ShrinkAbort ��R t �1 _SHRINK_VOLUME_REQUEST_TYPES .?AW4_SHRINK_VOLUME_REQUEST_TYPES@@ ��� �1 � N
�1 ShrinkRequestType
# Flags
NewNumberOfSectors ���R �1 _SHRINK_VOLUME_INFORMATION .?AU_SHRINK_VOLUME_INFORMATION@@ �� �1 � * � _FP_80 .?AU_FP_80@@ ��
�1
�
� W * �1 _FP_80 .?AU_FP_80@@ �� �1 + >
�
�
" ��
" ��
" ��
" ��
" ��
" Flags
�1 EnableBottomUpRandomization ��
�1 EnableForceRelocateImages
�1 EnableHighEntropy
�1 DisallowStrippedImages ���
�1 ReservedFlags Z �1 _PROCESS_MITIGATION_ASLR_POLICY .?AU_PROCESS_MITIGATION_ASLR_POLICY@@ �1 C ? Z � _ETW_WNF_EVENT_NAME_SUB_RUNDOWN .?AU_ETW_WNF_EVENT_NAME_SUB_RUNDOWN@@
�1
� >
� Header ���
} StateName
( NameSub ��Z �1 0 _ETW_WNF_EVENT_NAME_SUB_RUNDOWN .?AU_ETW_WNF_EVENT_NAME_SUB_RUNDOWN@@ �1 � � F FindStreamInfoStandard ��� FindStreamInfoMaxInfoLevel ���> t �1 _STREAM_INFO_LEVELS .?AW4_STREAM_INFO_LEVELS@@ � �1 � L
"
� : � XSAVE_CPU_INFO .?AUXSAVE_CPU_INFO@@ ��> � XSAVE_CPU_ERRATA .?AUXSAVE_CPU_ERRATA@@ ��
�1
� >
�1 CpuInfo ��
�1 CpuErrata
# Unused ���F �1 ( _XSAVE_SUPPORTED_CPU .?AU_XSAVE_SUPPORTED_CPU@@ �� �1 � � > � _CACHE_DESCRIPTOR .?AU_CACHE_DESCRIPTOR@@
�1
� ^
Level
Associativity
! LineSize �
" Size �
� Type �> �1 _CACHE_DESCRIPTOR .?AU_CACHE_DESCRIPTOR@@ �1 {
�
�
�
� b � _SECTION_INTERNAL_IMAGE_INFORMATION .?AU_SECTION_INTERNAL_IMAGE_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
M( SectionInformation ���
" 0 ExtendedFlags
�1 0 ImageExportSuppressionEnabled
�1 0 ImageCetShadowStacksReady
�1 0 ImageXfgEnabled ��
�1 0 ImageCetShadowStacksStrictMode ���
�1 0 ImageCetSetContextIpValidationRelaxedMode
�1 0 ImageCetDynamicApisAllowInProc ���
�1 0 ImageCetDowngradeReserved1 ���
�1 0 ImageCetDowngradeReserved2 ���
�1 0 Reserved �b �1 4 _SECTION_INTERNAL_IMAGE_INFORMATION .?AU_SECTION_INTERNAL_IMAGE_INFORMATION@@ �1 � ^ � _SYSTEM_MEMORY_USAGE_INFORMATION .?AU_SYSTEM_MEMORY_USAGE_INFORMATION@@ ��
�1
� �
# TotalPhysicalBytes ���
# AvailableBytes ���
ResidentAvailableBytes ���
# CommittedBytes ���
# SharedCommittedBytes �
# ( CommitLimitBytes �
# 0 PeakCommitmentBytes ��^ �1 8 _SYSTEM_MEMORY_USAGE_INFORMATION .?AU_SYSTEM_MEMORY_USAGE_INFORMATION@@ �� �1 y v � _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION .?AU_PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION@@
�1
�
ProcessHandle v �1 _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION .?AU_PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION@@ �1 a P
�
� " " " " " t �1
�1
�
O*
� R � _WMI_DISKIO_READWRITE_INIT .?AU_WMI_DISKIO_READWRITE_INIT@@ ��
�1
� .
Irp ��
" IssuingThreadId ��R 2 _WMI_DISKIO_READWRITE_INIT .?AU_WMI_DISKIO_READWRITE_INIT@@ �� 2 � � : � _HEAP_RANGE_LOG .?AU_HEAP_RANGE_LOG@@
2
� > � _HEAP_EVENT_RANGE .?AU_HEAP_EVENT_RANGE@@ &
� Header ���
2 Range : 2 0 _HEAP_RANGE_LOG .?AU_HEAP_RANGE_LOG@@ 2 � �
I+
� . � _TP_ALPC .?AU_TP_ALPC@@ ��
2
� � 2
2
2
� &
} NextVcn ��
} Lcn ��: 2 <anonymous-tag> .?AU<anonymous-tag>@@ 2 ^
2 " �F
" ExtentCount ��
} StartingVcn ��
2 Extents ��N 2 RETRIEVAL_POINTERS_BUFFER .?AURETRIEVAL_POINTERS_BUFFER@@ 2 Z
f � _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE@@ ��&
# Version ��
q Name �f 2 _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE@@ �� 2 O B � _CI_LOG_MMCSS_STOP .?AU_CI_LOG_MMCSS_STOP@@ ��
� Header ���B 2 0 _CI_LOG_MMCSS_STOP .?AU_CI_LOG_MMCSS_STOP@@ �� 2 � g B � _HEAP_RANGE_CREATE .?AU_HEAP_RANGE_CREATE@@ ��&
� Header ���
W, Event B 2 0 _HEAP_RANGE_CREATE .?AU_HEAP_RANGE_CREATE@@ �� !2 � � V � _CONSOLE_READCONSOLE_CONTROL .?AU_CONSOLE_READCONSOLE_CONTROL@@ ��
#2
� f
" nLength ��
" nInitialChars
" dwCtrlWakeupMask �
" dwControlKeyState V %2 _CONSOLE_READCONSOLE_CONTROL .?AU_CONSOLE_READCONSOLE_CONTROL@@ ��6 onecore\external\sdk\inc\minwin\consoleapi.h ��� &2 '2 � >
ciexyzX ��
ciexyzY ��
ciexyzZ ��. )2 tagCIEXYZ .?AUtagCIEXYZ@@ *2 � R � _SYSTEM_ERROR_PORT_TIMEOUTS .?AU_SYSTEM_ERROR_PORT_TIMEOUTS@@ 2
" StartTimeout �
" CommTimeout ��R -2 _SYSTEM_ERROR_PORT_TIMEOUTS .?AU_SYSTEM_ERROR_PORT_TIMEOUTS@@ .2
� R � _FILE_STANDARD_INFORMATION .?AU_FILE_STANDARD_INFORMATION@@ ��v
} AllocationSize ���
} EndOfFile
" NumberOfLinks
DeletePending
Directory R 22 _FILE_STANDARD_INFORMATION .?AU_FILE_STANDARD_INFORMATION@@ �� 32 �
5 ��
52
�
#
� V � _CM_EISA_FUNCTION_INFORMATION .?AU_CM_EISA_FUNCTION_INFORMATION@@ " �R � _EISA_MEMORY_CONFIGURATION .?AU_EISA_MEMORY_CONFIGURATION@@ �� :2 " ? �J � _EISA_IRQ_CONFIGURATION .?AU_EISA_IRQ_CONFIGURATION@@ <2 " � � " �N � _EISA_PORT_CONFIGURATION .?AU_EISA_PORT_CONFIGURATION@@ �� ?2 " < � " < �6
" CompressedId �
IdSlotFlags1 �
IdSlotFlags2 �
MinorRevision
MajorRevision
92 Selections ���
" FunctionFlags
�# # TypeString ���
;2 s EisaMemory ���
=2 � EisaIrq ��
>2 � EisaDma ��
@2 � EisaPort �
A2 InitializationData ���V
B2 @_CM_EISA_FUNCTION_INFORMATION .?AU_CM_EISA_FUNCTION_INFORMATION@@ C2 � 9 Z � _THREAD_CYCLE_TIME_INFORMATION .?AU_THREAD_CYCLE_TIME_INFORMATION@@ ��:
# AccumulatedCycles
# CurrentCycleCount Z F2 _THREAD_CYCLE_TIME_INFORMATION .?AU_THREAD_CYCLE_TIME_INFORMATION@@ �� G2 a � F � _EVENT_TRACE_LOGFILEA .?AU_EVENT_TRACE_LOGFILEA@@
I2
�
J2 " K2
L2
�
��
��
��
��V
N2 Reserved0
O2 TransferSize �
P2 Timing ���
Q2 Reserved1 N R2 _DMA_CONFIGURATION_BYTE1 .?AU_DMA_CONFIGURATION_BYTE1@@ �� S2 � b � _FILE_INITIATE_REPAIR_OUTPUT_BUFFER .?AU_FILE_INITIATE_REPAIR_OUTPUT_BUFFER@@
U2
� F
# Hint1
# Hint2
# Clsn �
Status ���b W2 _FILE_INITIATE_REPAIR_OUTPUT_BUFFER .?AU_FILE_INITIATE_REPAIR_OUTPUT_BUFFER@@ X2 � * � tagMSG .?AUtagMSG@@ ��
Z2
� n
y hwnd �
u message ��
u wParam ���
lParam ���
" time �
x pt ���* \2 tagMSG .?AUtagMSG@@ �� ]2 P J � _LDR_DATA_TABLE_ENTRY64 .?AU_LDR_DATA_TABLE_ENTRY64@@
_2
� �
InLoadOrderLinks �
InMemoryOrderLinks ���
InInitializationOrderLinks ���
# 0 DllBase ��
# 8 EntryPoint ���
" @ SizeOfImage ��
H FullDllName ��
X BaseDllName ��
" h Flags
! l LoadCount
! n TlsIndex �
p HashLinks
# p SectionPointer ���
" x CheckSum �
" � TimeDateStamp
# � LoadedImports J a2 � _LDR_DATA_TABLE_ENTRY64 .?AU_LDR_DATA_TABLE_ENTRY64@@ b2 u > B � _IMAGE_NT_HEADERS64 .?AU_IMAGE_NT_HEADERS64@@ N � _IMAGE_OPTIONAL_HEADER64 .?AU_IMAGE_OPTIONAL_HEADER64@@ ��J
" Signature
W FileHeader ���
e2 OptionalHeader ���B f2 _IMAGE_NT_HEADERS64 .?AU_IMAGE_NT_HEADERS64@@ g2 [ v F � _ETW_HEAP_EVENT_ALLOC .?AU_ETW_HEAP_EVENT_ALLOC@@
i2
� f
� Header ���
HeapHandle ���
" $ Size �
( Address ��
" , Source ���F k2 0 _ETW_HEAP_EVENT_ALLOC .?AU_ETW_HEAP_EVENT_ALLOC@@ l2 � �
�!
�
�0
� > � tagCBT_CREATEWNDW .?AUtagCBT_CREATEWNDW@@
p2
� .
H( lpcs �
y hwndInsertAfter ��> r2 tagCBT_CREATEWNDW .?AUtagCBT_CREATEWNDW@@ s2 ] N � _CM_COMPONENT_INFORMATION .?AU_CM_COMPONENT_INFORMATION@@ N
G- Flags
" Version ��
" Key ��
" AffinityMask �N v2 _CM_COMPONENT_INFORMATION .?AU_CM_COMPONENT_INFORMATION@@ w2 � � J � tagEMRCREATECOLORSPACE .?AUtagEMRCREATECOLORSPACE@@ ��2
emr ��
" ihCS �
�% lcs ��J z2 TtagEMRCREATECOLORSPACE .?AUtagEMRCREATECOLORSPACE@@ �� {2 � 6 � tagMETAHEADER .?AUtagMETAHEADER@@ �
! mtType ���
! mtHeaderSize �
! mtVersion
" mtSize ���
!
mtNoObjects ��
" mtMaxRecord ��
! mtNoParameters ���6 ~2 tagMETAHEADER .?AUtagMETAHEADER@@ 2 > � MOFRESOURCEINFOA .?AUMOFRESOURCEINFOA@@ ��
�2
� b
p ImagePath
p ResourceName �
" ResourceSize �
ResourceBuffer ���> �2 MOFRESOURCEINFOA .?AUMOFRESOURCEINFOA@@ ��* onecore\external\sdk\inc\wmium.h ��� �2 �2 L f � _SYSTEM_KERNEL_VA_SHADOW_INFORMATION .?AU_SYSTEM_KERNEL_VA_SHADOW_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��2
�2 KvaShadowEnabled �
�2 KvaShadowUserGlobal ��
�2 KvaShadowPcid
�2 KvaShadowInvpcid �
�2 KvaShadowRequired
�2 KvaShadowRequiredAvailable ���
�2 InvalidPteBit
�2 L1DataCacheFlushSupported
�2 L1TerminalFaultMitigationPresent �
�2 Reserved �:
�2 <anonymous-tag> .?AU<anonymous-tag>@@ �2 �
�2 KvaShadowFlags ���f �2 _SYSTEM_KERNEL_VA_SHADOW_INFORMATION .?AU_SYSTEM_KERNEL_VA_SHADOW_INFORMATION@@ �� �2 � j � _FSCTL_GET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_GET_INTEGRITY_INFORMATION_BUFFER@@ �
! ChecksumAlgorithm
! Reserved �
" Flags
" ChecksumChunkSizeInBytes �
" ClusterSizeInBytes ���j �2 _FSCTL_GET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_GET_INTEGRITY_INFORMATION_BUFFER@@ �2 �
�+
� 2 � WMIREGGUIDW .?AUWMIREGGUIDW@@
�2
� �
� Guid �
" Flags
" InstanceCount
" InstanceNameList �
" BaseNameOffset ���
" Pdo ��
" InstanceInfo �2 �2 WMIREGGUIDW .?AUWMIREGGUIDW@@ �2 8 * > � _FILE_STREAM_INFO .?AU_FILE_STREAM_INFO@@
�2
� �
" NextEntryOffset ��
" StreamNameLength �
} StreamSize ���
} StreamAllocationSize �
StreamName ���> �2 _FILE_STREAM_INFO .?AU_FILE_STREAM_INFO@@ �2 �" j � _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER@@ B
! ChecksumAlgorithm
! Reserved �
" Flags j �2 _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER@@ �2 � Z � DISPLAYCONFIG_PATH_TARGET_INFO .?AUDISPLAYCONFIG_PATH_TARGET_INFO@@ ��
u ��
u ��J � DISPLAYCONFIG_RATIONAL .?AUDISPLAYCONFIG_RATIONAL@@ ��Z DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED �� DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE �� DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED ��� DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST ��� DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST ��� ��DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 V t �2 DISPLAYCONFIG_SCANLINE_ORDERING .?AW4DISPLAYCONFIG_SCANLINE_ORDERING@@ � �2 &
I adapterId
u id ���
u modeInfoIdx ��
�2 desktopModeInfoIdx ���
�2 targetModeInfoIdx
_$ outputTechnology �
�# rotation �
# scaling ��
�2 refreshRate ��
�2 $ scanLineOrdering �
t ( targetAvailable ��
u , statusFlags ��Z �2 0 DISPLAYCONFIG_PATH_TARGET_INFO .?AUDISPLAYCONFIG_PATH_TARGET_INFO@@ �� �2 � R � _SYSTEM_MEMORY_INFORMATION .?AU_SYSTEM_MEMORY_INFORMATION@@ ��
�2
� z
" PagedPoolCommitPageCount �
" NonPagedPoolPageCount
" MdlPageCount �
" CommitPageCount ��R �2 _SYSTEM_MEMORY_INFORMATION .?AU_SYSTEM_MEMORY_INFORMATION@@ �� �2 �
�/
�
�*
� N � READ_USN_JOURNAL_DATA_V0 .?AUREAD_USN_JOURNAL_DATA_V0@@ ��
�2
� �
StartUsn �
" ReasonMask ���
" ReturnOnlyOnClose
# Timeout ��
# BytesToWaitFor ���
# UsnJournalID �N �2 ( READ_USN_JOURNAL_DATA_V0 .?AUREAD_USN_JOURNAL_DATA_V0@@ �� �2 . > � _SYSTEM_ALARM_ACE .?AU_SYSTEM_ALARM_ACE@@ :
o Header ���
" Mask �
" SidStart �> �2 _SYSTEM_ALARM_ACE .?AU_SYSTEM_ALARM_ACE@@ �2 � y q " t �2
�2
�
b"
� b
AclRevision ��
Sbz1 �
! AclSize ��
! AceCount �
! Sbz2 �& �2 _ACL .?AU_ACL@@ �� �2 � F � _EISA_IRQ_DESCRIPTOR .?AU_EISA_IRQ_DESCRIPTOR@@ ��2
�2 ConfigurationByte
Reserved �J �2 _EISA_IRQ_CONFIGURATION .?AU_EISA_IRQ_CONFIGURATION@@ �2 � � N � _KLDR_DATA_TABLE_ENTRY64 .?AU_KLDR_DATA_TABLE_ENTRY64@@ ��
InLoadOrderLinks �
# __Undefined1 �
# __Undefined2 �
# __Undefined3 �
# ( NonPagedDebugInfo
# 0 DllBase ��
# 8 EntryPoint ���
" @ SizeOfImage ��
H FullDllName ��
X BaseDllName ��
" h Flags
! l LoadCount
! n __Undefined5 �
# p __Undefined6 �
" x CheckSum �
" | __padding1 ���
" � TimeDateStamp
" � __padding2 ���N �2 � _KLDR_DATA_TABLE_ENTRY64 .?AU_KLDR_DATA_TABLE_ENTRY64@@ �� �2 u z � FindExSearchNameMatch FindExSearchLimitToDirectories ��� FindExSearchLimitToDevices ��� FindExSearchMaxSearchOp ��> t �2 _FINDEX_SEARCH_OPS .?AW4_FINDEX_SEARCH_OPS@@ ��� �2 c �
�
�
�2
�
�'
� J
� DllName ��
� FunctionName �
RedirectionTarget ^ �2 _REDIRECTION_FUNCTION_DESCRIPTOR .?AU_REDIRECTION_FUNCTION_DESCRIPTOR@@ �� �2 ; ^ b � _FILE_IO_PRIORITY_HINT_INFORMATION .?AU_FILE_IO_PRIORITY_HINT_INFORMATION@@ ��
PriorityHint �b �2 _FILE_IO_PRIORITY_HINT_INFORMATION .?AU_FILE_IO_PRIORITY_HINT_INFORMATION@@ �� �2 � 6
RpcProtocolSequence ��
Endpoint �F �2 _RPC_PROTSEQ_ENDPOINT .?AU_RPC_PROTSEQ_ENDPOINT@@ �2 � � ^ � _GET_FILTER_FILE_IDENTIFIER_INPUT .?AU_GET_FILTER_FILE_IDENTIFIER_INPUT@@ 2
! AltitudeLength ���
Altitude �^ �2 _GET_FILTER_FILE_IDENTIFIER_INPUT .?AU_GET_FILTER_FILE_IDENTIFIER_INPUT@@ �2 �" 6 � _IMAGE_AUX_SYMBOL .?AT_IMAGE_AUX_SYMBOL@@ *
! Linenumber ���
! Size �: �2 <anonymous-tag> .?AU<anonymous-tag>@@ �2 [ &
�2 LnSz �
" TotalSize 2 �2 <anonymous-tag> .?AT<anonymous-tag>@@ �2 [ B
" PointerToLinenumber ��
" PointerToNextFunction : �2 <anonymous-tag> .?AU<anonymous-tag>@@ �2 [
_ Dimension : �2 <anonymous-tag> .?AU<anonymous-tag>@@ �2 [ ! &
�2 Function �
�2 Array 2 �2 <anonymous-tag> .?AT<anonymous-tag>@@ �2 [ N
" TagIndex �
�2 Misc �
�2 FcnAry ���
! TvIndex ��: �2 <anonymous-tag> .?AU<anonymous-tag>@@ �2 [ " �
�2 Name �: �2 <anonymous-tag> .?AU<anonymous-tag>@@ �2 [ ' �
" Length ���
! NumberOfRelocations ��
! NumberOfLinenumbers ��
" CheckSum �
Number ���
Selection
bReserved
HighNumber ���: �2 <anonymous-tag> .?AU<anonymous-tag>@@ 3 [ * " �*
" crc ��
3 rgbReserved ��: 3 <anonymous-tag> .?AU<anonymous-tag>@@ 3 [ 5 Z
�2 Sym ��
�2 File �
3 Section ��
�# TokenDef �
3 CRC ��6 3 _IMAGE_AUX_SYMBOL .?AT_IMAGE_AUX_SYMBOL@@ 3 [
" ��
3
� 6 � tagRGBTRIPLE .?AUtagRGBTRIPLE@@ ��>
rgbtBlue �
rgbtGreen
rgbtRed ��6 3 tagRGBTRIPLE .?AUtagRGBTRIPLE@@ ��
3 l
3
3
� N � _MEMORY_SCRUB_INFORMATION .?AU_MEMORY_SCRUB_INFORMATION@@ .
Handle ���
" PagesScrubbed N 3 _MEMORY_SCRUB_INFORMATION .?AU_MEMORY_SCRUB_INFORMATION@@ 3 � V PROTOCOL_NOT_LOADED �� PROTOCOL_LOADED �� PROTOCOL_ADDRESS_CHANGE ��F t 3 RPC_ADDRESS_CHANGE_TYPE .?AW4RPC_ADDRESS_CHANGE_TYPE@@ � 3 � P
�
� : � tagEMRFRAMERGN .?AUtagEMRFRAMERGN@@ ��v
emr ��
� rclBounds
" cbRgnData
" ihBrush ��
� szlStroke
K ( RgnData ��: 3 , tagEMRFRAMERGN .?AUtagEMRFRAMERGN@@ �� 3 �
l
� F
lfHeight �
lfWidth ��
lfEscapement �
lfOrientation
lfWeight �
lfItalic �
lfUnderline ��
lfStrikeOut ��
lfCharSet
lfOutPrecision ���
lfClipPrecision ��
lfQuality
lfPitchAndFamily �
�! lfFaceName ���2 3 < tagLOGFONTA .?AUtagLOGFONTA@@ 3 �
/#
� B � _FILE_REGION_OUTPUT .?AU_FILE_REGION_OUTPUT@@ r " �v
" Flags
" TotalRegionEntryCount
" RegionEntryCount �
" Reserved �
$3 Region ���B %3 ( _FILE_REGION_OUTPUT .?AU_FILE_REGION_OUTPUT@@ &3 p 6 � _RTL_SRWLOCK .?AU_RTL_SRWLOCK@@ ��
(3
�
" ��
" ��
" ��
" ��
" ��
*3 Locked ���
+3 Waiting ��
,3 Waking ���
-3 MultipleShared ���
.3 Shared ���
" Value
Ptr ��6 /3 _RTL_SRWLOCK .?AU_RTL_SRWLOCK@@ �� 03 L � n � _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS .?AU_SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS@@
23
�
UserKeyHandle n 43 _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS .?AU_SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS@@ 53 0
).
� F � _IO_ERROR_LOG_MESSAGE .?AU_IO_ERROR_LOG_MESSAGE@@
83
� �
! Type �
! Size �
! DriverNameLength �
} TimeStamp
" DriverNameOffset �
$# EntryData F :3 H _IO_ERROR_LOG_MESSAGE .?AU_IO_ERROR_LOG_MESSAGE@@ ;3 '# D V � _DEFINE_STORAGE_RESERVE_INPUT .?AU_DEFINE_STORAGE_RESERVE_INPUT@@ ^ � _STORAGE_RESERVE_AREA_DEFINITION .?AU_STORAGE_RESERVE_AREA_DEFINITION@@ �� >3 " �
" Version ��
" Flags
" AreaDefinitionOffset �
" AreaDefinitionCount ��
?3 AreaDefinition ���V @3 _DEFINE_STORAGE_RESERVE_INPUT .?AU_DEFINE_STORAGE_RESERVE_INPUT@@ A3 + j � _TOKEN_SECURITY_ATTRIBUTES_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_INFORMATION@@ ��
%
�
D3 pAttributeV1 �2 E3 <anonymous-tag> .?AT<anonymous-tag>@@ F3 ] 1 Z
! Version ��
! Reserved �
" AttributeCount ���
F3 Attribute j H3 _TOKEN_SECURITY_ATTRIBUTES_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_INFORMATION@@ �� I3 ] " ^ � _FILE_FS_FULL_SIZE_INFORMATION_EX .?AU_FILE_FS_FULL_SIZE_INFORMATION_EX@@
K3
�
# ActualTotalAllocationUnits ���
# ActualAvailableAllocationUnits ���
# ActualPoolUnavailableAllocationUnits �
# CallerTotalAllocationUnits ���
# CallerAvailableAllocationUnits ���
# ( CallerPoolUnavailableAllocationUnits �
# 0 UsedAllocationUnits ��
# 8 TotalReservedAllocationUnits �
# @ VolumeStorageReserveAllocationUnits ��
# H AvailableCommittedAllocationUnits
# P PoolAvailableAllocationUnits �
" X SectorsPerAllocationUnit �
" \ BytesPerSector ���^
M3 ` _FILE_FS_FULL_SIZE_INFORMATION_EX .?AU_FILE_FS_FULL_SIZE_INFORMATION_EX@@ N3 $ � � _PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION@@ ��
P3
�
[.
� Z
! NumberOfTargets ��
! Reserved �
" Reserved2
R3 Targets �� S3 _PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION@@ �� T3 C w f � _KNONVOLATILE_CONTEXT_POINTERS_ARM64 .?AU_KNONVOLATILE_CONTEXT_POINTERS_ARM64@@ ��B
# X19 ��
# X20 ��
# X21 ��
# X22 ��
# X23 ��
# X24 ��
# X25 ��
# X26 ��
# X27 ��
# $ X28 ��
# ( Fp ���
# , Lr ���
# 0 D8 ���
# 4 D9 ���
# 8 D10 ��
# < D11 ��
# @ D12 ��
# D D13 ��
# H D14 ��
# L D15 ��f W3 P _KNONVOLATILE_CONTEXT_POINTERS_ARM64 .?AU_KNONVOLATILE_CONTEXT_POINTERS_ARM64@@ �� X3 '
�
� R � NDR_ALLOC_ALL_NODES_CONTEXT .?AUNDR_ALLOC_ALL_NODES_CONTEXT@@
[3
� J � NDR_POINTER_QUEUE_STATE .?AUNDR_POINTER_QUEUE_STATE@@
]3
�
w ��
_3
� F � _FULL_PTR_XLAT_TABLES .?AU_FULL_PTR_XLAT_TABLES@@
a3
�
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t
��
t ��
t ��
t
��
t ��> � IRpcChannelBuffer .?AUIRpcChannelBuffer@@
r3
�
$(
� B � _NDR_ASYNC_MESSAGE .?AU_NDR_ASYNC_MESSAGE@@ ��
u3
�
(
� > � _NDR_PROC_CONTEXT .?AU_NDR_PROC_CONTEXT@@
x3
� �
Z3 RpcMsg ���
Buffer ���
BufferStart ��
BufferEnd
BufferMark ���
" BufferLength �
" MemorySize ���
Memory ���
IsClient �
! Pad ��
! " uFlags2 ��
t $ ReuseBuffer ��
\3 ( pAllocAllNodesContext
^3 , pPointerQueueState ���
t 0 IgnoreEmbeddedPointers ���
4 PointerBufferMark
8 CorrDespIncrement
9 uFlags ���
! : UniquePtrCount ���
" < MaxCount �
" @ Offset ���
" D ActualCount ��
z H pfnAllocate ��
< L pfnFree ��
P StackTop �
T pPresentedType ���
X pTransmitType
\ SavedHandle ��
`3 ` StubDesc �
b3 d FullPtrXlatTables
" h FullPtrRefId �
" l PointerLength
c3 p fInDontFree ��
d3 p fDontCallFreeInst
e3 p fUnused1 �
f3 p fHasReturn ���
g3 p fHasExtensions ���
h3 p fHasNewCorrDesc ��
i3 p fIsIn
j3 p fIsOut ���
k3 p fIsOicf ��
l3 p fBufferValid �
m3 p fHasMemoryValidateCallback ���
n3 p fInFree ��
o3 p fNeedMCCP
p3 p fUnused2 �
q3 p fUnused3 �
" t dwDestContext
x pvDestContext
� | SavedContextHandles ��
� ParamNumber ��
s3 � pRpcChannelBuffer
t3 � pArrayInfo ���
" � SizePtrCountArray
" � SizePtrOffsetArray ���
" � SizePtrLengthArray ���
� pArgQueue
" � dwStubPhase ��
� LowStackMark �
v3 � pAsyncMsg
w3 � pCorrInfo
� pCorrMemory ��
� pMemoryList ��
t � pCSInfo ��
� ConformanceMark ��
� VarianceMark �
t � Unused ���
y3 � pContext �
� ContextHandleHash
� pUserMarshalList �
t � Reserved51_3 �
t � Reserved51_4 �
t � Reserved51_5 �B I z3 � _MIDL_STUB_MESSAGE .?AU_MIDL_STUB_MESSAGE@@ �� {3 � Q
>*
� t �
~3
�
w/
� : � _SE_AUDIT_INFO .?AU_SE_AUDIT_INFO@@ ��
I
� "
" Size �
AuditType
� AuditOperation ���
" AuditFlags ���
� SubsystemName
� ObjectTypeName ���
� ObjectName ���
( HandleId �
� , TransactionId
�3 0 OperationId ��
4 ObjectCreation ���
5 GenerateOnClose ��: �3 8 _SE_AUDIT_INFO .?AU_SE_AUDIT_INFO@@ �� �3 & �
�3
� > � _PATHNAME_BUFFER .?AU_PATHNAME_BUFFER@@ ��
�3
� .
" PathNameLength ���
Name �> �3 _PATHNAME_BUFFER .?AU_PATHNAME_BUFFER@@ �� �3 � 6 � _PREFIX_TABLE .?AU_PREFIX_TABLE@@
�3
�
}&
� N
NodeTypeCode �
NameLength ���
�3 NextPrefixTree ���6 �3 _PREFIX_TABLE .?AU_PREFIX_TABLE@@ �3 ( b � _FSCTL_QUERY_STORAGE_CLASSES_OUTPUT .?AU_FSCTL_QUERY_STORAGE_CLASSES_OUTPUT@@ B � _FILE_STORAGE_TIER .?AU_FILE_STORAGE_TIER@@ �� �3 " ( �
" Version ��
" Size �
" Flags
" TotalNumberOfTiers ���
" NumberOfTiersReturned
�3 Tiers b �3 @_FSCTL_QUERY_STORAGE_CLASSES_OUTPUT .?AU_FSCTL_QUERY_STORAGE_CLASSES_OUTPUT@@ �3 8 SC_ENUM_PROCESS_INFO �2 t �3 _SC_ENUM_TYPE .?AW4_SC_ENUM_TYPE@@ � �3 3 � ^ � _ETW_TRACE_PARTITION_INFORMATION .?AU_ETW_TRACE_PARTITION_INFORMATION@@ ��b
� PartitionId ��
� ParentId �
QpcOffsetFromRoot
" ( PartitionType ^ �3 0 _ETW_TRACE_PARTITION_INFORMATION .?AU_ETW_TRACE_PARTITION_INFORMATION@@ �� �3 � ~
�
�
�!
� N � _ENABLE_TRACE_PARAMETERS .?AU_ENABLE_TRACE_PARAMETERS@@ ��
" Version ��
" EnableProperty ���
" ControlFlags �
� SourceId �
v EnableFilterDesc �
" FilterDescCount ��N �3 $ _ENABLE_TRACE_PARAMETERS .?AU_ENABLE_TRACE_PARAMETERS@@ �� �3 �
�
� V � _ETW_UMS_EVENT_CONTEXT_SWITCH .?AU_ETW_UMS_EVENT_CONTEXT_SWITCH@@
�3
� �
� Header ���
" ScheduledThreadId
" $ SwitchCount ��
" ( KernelYieldCount �
" , MixedYieldCount ��
" 0 YieldCount ���V �3 8 _ETW_UMS_EVENT_CONTEXT_SWITCH .?AU_ETW_UMS_EVENT_CONTEXT_SWITCH@@ �3 � � R � _ETW_DUPLICATE_HANDLE_EVENT .?AU_ETW_DUPLICATE_HANDLE_EVENT@@ �
Object ���
" SourceHandle �
" TargetHandle �
" TargetProcessId ��
! ObjectType ���
" SourceProcessId ��R �3 _ETW_DUPLICATE_HANDLE_EVENT .?AU_ETW_DUPLICATE_HANDLE_EVENT@@ �3 � X
B � tagTTPOLYGONHEADER .?AUtagTTPOLYGONHEADER@@ ��
�3
� 2 � tagPOINTFX .?AUtagPOINTFX@@ ��:
" cb ���
" dwType ���
�3 pfxStart �B �3 tagTTPOLYGONHEADER .?AUtagTTPOLYGONHEADER@@ �� �3 �
e+
� B � _RTL_HEAP_TAG_INFO .?AU_RTL_HEAP_TAG_INFO@@ ��
�3
� V
" NumberOfAllocations ��
" NumberOfFrees
" BytesAllocated ���B �3 _RTL_HEAP_TAG_INFO .?AU_RTL_HEAP_TAG_INFO@@ �� �3 L � b � _PERFINFO_EXECUTIVE_RESOURCE_CONFIG .?AU_PERFINFO_EXECUTIVE_RESOURCE_CONFIG@@ j
" ReleaseSamplingRate ��
" ContentionSamplingRate ���
" NumberOfExcessiveTimeouts b �3 _PERFINFO_EXECUTIVE_RESOURCE_CONFIG .?AU_PERFINFO_EXECUTIVE_RESOURCE_CONFIG@@ �3 � � : � tagPOINTER_INFO .?AUtagPOINTER_INFO@@ �
�3 pointerInfo ��
u X touchFlags ���
u \ touchMask
� ` rcContact
� p rcContactRaw �
u � orientation ��
u � pressure �F �3 � tagPOINTER_TOUCH_INFO .?AUtagPOINTER_TOUCH_INFO@@ �3 � ^ � _FILE_REMOTE_PROTOCOL_INFORMATION .?AU_FILE_REMOTE_PROTOCOL_INFORMATION@@
� Reserved �: �3 <anonymous-tag> .?AU<anonymous-tag>@@ �3 t
" Capabilities �: �3 <anonymous-tag> .?AU<anonymous-tag>@@ �3 � n
" Capabilities �
" CachingFlags �
ShareType
� Reserved0
" Reserved1 : �3 <anonymous-tag> .?AU<anonymous-tag>@@ �3 � &
�3 Server ���
�3 Share : �3 <anonymous-tag> .?AU<anonymous-tag>@@ �3 � &
�3 Smb2 �
� Reserved �2 �3 @ <anonymous-tag> .?AT<anonymous-tag>@@ �3 �
! StructureVersion �
! StructureSize
" Protocol �
! ProtocolMajorVersion �
!
ProtocolMinorVersion �
! ProtocolRevision �
! Reserved �
" Flags
�3 GenericReserved ��
�3 4 ProtocolSpecific �^
�3 t _FILE_REMOTE_PROTOCOL_INFORMATION .?AU_FILE_REMOTE_PROTOCOL_INFORMATION@@ �3 b ^ � _PERFINFO_PO_SESSION_CALLOUT_RET .?AU_PERFINFO_PO_SESSION_CALLOUT_RET@@ ��
Status ���^ �3 _PERFINFO_PO_SESSION_CALLOUT_RET .?AU_PERFINFO_PO_SESSION_CALLOUT_RET@@ �� �3 � �
�$
�
�3
@
� R � _PERFINFO_CC_FLUSH_SECTION .?AU_PERFINFO_CC_FLUSH_SECTION@@ ��r
" WorkItemKey ��
" FileObjectKey
# Offset ���
" Length ���
" MmFlushFlags �R �3 _PERFINFO_CC_FLUSH_SECTION .?AU_PERFINFO_CC_FLUSH_SECTION@@ �� �3 � � f � _REFS_DEALLOCATE_RANGES_INPUT_BUFFER .?AU_REFS_DEALLOCATE_RANGES_INPUT_BUFFER@@ ��
�3
� |, " �.
" RangeCount ���
�3 Ranges ���f �3 _REFS_DEALLOCATE_RANGES_INPUT_BUFFER .?AU_REFS_DEALLOCATE_RANGES_INPUT_BUFFER@@ �� �3 �*
,
� R � _FILE_TRACKING_INFORMATION .?AU_FILE_TRACKING_INFORMATION@@ ��^
DestinationFile ��
" ObjectInformationLength ��
� ObjectInformation R �3 _FILE_TRACKING_INFORMATION .?AU_FILE_TRACKING_INFORMATION@@ �� �3 7 N � _EVENT_FILTER_EVENT_NAME .?AU_EVENT_FILTER_EVENT_NAME@@ ��
# MatchAnyKeyword ��
# MatchAllKeyword ��
Level
FilterIn �
! NameCount
| Names N �3 _EVENT_FILTER_EVENT_NAME .?AU_EVENT_FILTER_EVENT_NAME@@ �� �3 � z V � _PROCESS_SESSION_INFORMATION .?AU_PROCESS_SESSION_INFORMATION@@ ��
" SessionId V �3 _PROCESS_SESSION_INFORMATION .?AU_PROCESS_SESSION_INFORMATION@@ �� �3 C : R � _IMAGE_BOUND_FORWARDER_REF .?AU_IMAGE_BOUND_FORWARDER_REF@@ ��J
" TimeDateStamp
! OffsetModuleName �
! Reserved �R �3 _IMAGE_BOUND_FORWARDER_REF .?AU_IMAGE_BOUND_FORWARDER_REF@@ �� �3 [ Z � _PERFINFO_CC_LOGGED_STREAM_INFO .?AU_PERFINFO_CC_LOGGED_STREAM_INFO@@ �
" FileObjectKey
" ReasonForFlush ���
" PagesToWrite �
" DirtyLoggedPages �
" DirtyLoggedPageThreshold �
} LargestLsnForLWS �Z �3 _PERFINFO_CC_LOGGED_STREAM_INFO .?AU_PERFINFO_CC_LOGGED_STREAM_INFO@@ �3 � �
z1
� > � tagEMRPIXELFORMAT .?AUtagEMRPIXELFORMAT@@ "
emr ��
�/ pfd ��> 4 0 tagEMRPIXELFORMAT .?AUtagEMRPIXELFORMAT@@ 4 � B � CORRELATION_VECTOR .?AUCORRELATION_VECTOR@@ ��
4
� p " � �*
p Version ��
4 Vector ���B 4 � CORRELATION_VECTOR .?AUCORRELATION_VECTOR@@ �� 4 ( �%
�*
� Z � _ETW_LAST_DROPPED_EVENT_STRUCT .?AU_ETW_LAST_DROPPED_EVENT_STRUCT@@ ��6
" Count
" Padding ��
�0 Times Z 4 _ETW_LAST_DROPPED_EVENT_STRUCT .?AU_ETW_LAST_DROPPED_EVENT_STRUCT@@ �� 4 � �
.
� f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A@@ ��
�
�
4 TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
ServerCertificateSubject �
4 ProxyCredentials �
" NumberOfProxyAuthnSchemes
" ProxyAuthnSchemes f 4 $ _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A@@ �� 4 � � R � _HEAP_EXTENDED_INFORMATION .?AU_HEAP_EXTENDED_INFORMATION@@ ��J � _HEAP_INFORMATION_ITEM .?AU_HEAP_INFORMATION_ITEM@@ ��
4
� 4 4
4
� > � _HEAP_INFORMATION .?AU_HEAP_INFORMATION@@ �
Process ��
" Heap �
" Level
4 CallbackRoutine ��
CallbackContext ��
�" ProcessHeapInformation ���
4 HeapInformation ��R 4 , _HEAP_EXTENDED_INFORMATION .?AU_HEAP_EXTENDED_INFORMATION@@ �� 4 L X
�3
� J � _VIRTUALIZATION_RECORD .?AU_VIRTUALIZATION_RECORD@@ ��b
VbsEnabled ���
HvciEnabled ��
HyperVisorEnabled
Reserved �J 4 _VIRTUALIZATION_RECORD .?AU_VIRTUALIZATION_RECORD@@ �� !4 � �
�$
�
�-
� �
4 TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
ServerCertificateSubject �^ %4 _RPC_HTTP_TRANSPORT_CREDENTIALS_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_A@@ &4 � �
f!
�
$.
� b � _MANAGE_WRITES_TO_EXECUTABLE_MEMORY .?AU_MANAGE_WRITES_TO_EXECUTABLE_MEMORY@@
*4
�
" ��
" ��
" ��
"
��
,4 Version ��
-4 ProcessEnableWriteExceptions �
.4 ThreadAllowWrites
/4 Spare
KernelWriteToExecutableSignal b 04 _MANAGE_WRITES_TO_EXECUTABLE_MEMORY .?AU_MANAGE_WRITES_TO_EXECUTABLE_MEMORY@@ 14 a �
H
� * � _TP_JOB .?AU_TP_JOB@@ & � HKL__ .?AUHKL__@@
54
�
64
�
t unused ���& 84 HKL__ .?AUHKL__@@ 94 ' n � _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY .?AU_RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY@@
;4
�
N BlockDynamicCode �n =4 _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY .?AU_RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY@@ >4 � f Z � _SYSTEM_DEVICE_DATA_INFORMATION .?AU_SYSTEM_DEVICE_DATA_INFORMATION@@ r
� DeviceId �
� DataName �
" DataType �
" DataBufferLength �
DataBuffer ���Z A4 _SYSTEM_DEVICE_DATA_INFORMATION .?AU_SYSTEM_DEVICE_DATA_INFORMATION@@ B4 n r � _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY@@ ��
D4
� z
" EntryLength ��
" DependencyTypeFlags ��
" ProviderSpecificFlags
P VirtualStorageType ���r F4 _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY@@ �� G4 C > � tagDRAWTEXTPARAMS .?AUtagDRAWTEXTPARAMS@@
I4
� v
u cbSize ���
t iTabLength ���
t iLeftMargin ��
t iRightMargin �
u uiLengthDrawn > K4 tagDRAWTEXTPARAMS .?AUtagDRAWTEXTPARAMS@@ L4 �
�
t unused ���. O4 HBITMAP__ .?AUHBITMAP__@@ P4 I Z � _FILE_MAILSLOT_SET_INFORMATION .?AU_FILE_MAILSLOT_SET_INFORMATION@@ ��
}
�
S4 ReadTimeout ��Z T4 _FILE_MAILSLOT_SET_INFORMATION .?AU_FILE_MAILSLOT_SET_INFORMATION@@ �� U4 m � J � _GENERATE_NAME_CONTEXT .?AU_GENERATE_NAME_CONTEXT@@ �� q " �
! Checksum �
ChecksumInserted �
NameLength ���
Y4 NameBuffer ���
" ExtensionLength ��
> ExtensionBuffer ��
" LastIndexValue ���J Z4 $ _GENERATE_NAME_CONTEXT .?AU_GENERATE_NAME_CONTEXT@@ �� [4 ( �
�
� N � _ETW_CREATE_HANDLE_EVENT .?AU_ETW_CREATE_HANDLE_EVENT@@ ��B
Object ���
" Handle ���
! ObjectType ���N _4 _ETW_CREATE_HANDLE_EVENT .?AU_ETW_CREATE_HANDLE_EVENT@@ �� `4 � M
B � tagBITMAPFILEHEADER .?AUtagBITMAPFILEHEADER@@ n
! bfType ���
" bfSize ���
! bfReserved1 ��
! bfReserved2 ��
"
bfOffBits B c4 tagBITMAPFILEHEADER .?AUtagBITMAPFILEHEADER@@ d4 � b � _TXFS_LIST_TRANSACTION_LOCKED_FILES .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES@@ j
� KtmTransaction ���
# NumberOfFiles
# BufferSizeRequired ���
# Offset ���b g4 ( _TXFS_LIST_TRANSACTION_LOCKED_FILES .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES@@ h4
.
� V � _CM_FULL_RESOURCE_DESCRIPTOR .?AU_CM_FULL_RESOURCE_DESCRIPTOR@@ ��N
� InterfaceType
" BusNumber
�+ PartialResourceList ��V l4 _CM_FULL_RESOURCE_DESCRIPTOR .?AU_CM_FULL_RESOURCE_DESCRIPTOR@@ �� m4 � m n � _SYSTEM_VERIFIER_CANCELLATION_INFORMATION .?AU_SYSTEM_VERIFIER_CANCELLATION_INFORMATION@@ : " �
" CancelProbability
" CancelThreshold ��
" CompletionThreshold ��
" CancellationVerifierDisabled �
" AvailableIssues ��
p4 Issues ���n q4 _SYSTEM_VERIFIER_CANCELLATION_INFORMATION .?AU_SYSTEM_VERIFIER_CANCELLATION_INFORMATION@@ r4 �
� TypeId ���6 t4 _WNF_TYPE_ID .?AU_WNF_TYPE_ID@@ �� u4 � V � _SERVERSILO_BASIC_INFORMATION .?AU_SERVERSILO_BASIC_INFORMATION@@ �
" ServiceSessionId �
� State
ExitStatus ���
IsDownlevelContainer �
ApiSetSchema �
HostApiSetSchema �V x4 _SERVERSILO_BASIC_INFORMATION .?AU_SERVERSILO_BASIC_INFORMATION@@ y4 C � b � _TRANSACTIONMANAGER_LOG_INFORMATION .?AU_TRANSACTIONMANAGER_LOG_INFORMATION@@
� LogIdentity ��b |4 _TRANSACTIONMANAGER_LOG_INFORMATION .?AU_TRANSACTIONMANAGER_LOG_INFORMATION@@ }4 � �
�
�
" ��
" ��
" ��
" ��
" ��
" Flags
�4 SmtBranchTargetIsolation �
�4 IsolateSecurityDomain
�4 DisablePageCombine ���
�4 SpeculativeStoreBypassDisable
�4 ReservedFlags ~ �4 _PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY .?AU_PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY@@ �4 C � > � _SERVICE_NOTIFY_1 .?AU_SERVICE_NOTIFY_1@@ ~
" dwVersion
D pfnNotifyCallback
pContext �
" dwNotificationStatus �
ServiceStatus > �4 4 _SERVICE_NOTIFY_1 .?AU_SERVICE_NOTIFY_1@@ �4 3 � 6 � tagWNDCLASSA .?AUtagWNDCLASSA@@ ��
�4
� �
u style
�$ lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
� hInstance
�$ hIcon
�# hCursor ��
� hbrBackground
7 lpszMenuName �
7 $ lpszClassName 6
�4 ( tagWNDCLASSA .?AUtagWNDCLASSA@@ �� �4
�
� : � tagWNDCLASSEXW .?AUtagWNDCLASSEXW@@ ��
�4
�
u cbSize ���
u style
�$ lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
� hInstance
�$ hIcon
�# hCursor ��
� hbrBackground
�% $ lpszMenuName �
�% ( lpszClassName
�$ , hIconSm ��: �4 0 tagWNDCLASSEXW .?AUtagWNDCLASSEXW@@ �� �4 � : � _HARDERROR_MSG .?AU_HARDERROR_MSG@@ ���
� h
Status ���
} ErrorTime
" ( ValidResponseOptions �
" , Response �
" 0 NumberOfParameters ���
" 4 UnicodeStringParameterMask ���
8 Parameters ���: �4 P _HARDERROR_MSG .?AU_HARDERROR_MSG@@ �� �4 � V � _RTL_USER_PROCESS_PARAMETERS .?AU_RTL_USER_PROCESS_PARAMETERS@@ �� " " ��
" MaximumLength
" Length ���
" Flags
" DebugFlags ���
ConsoleHandle
" ConsoleFlags �
StandardInput
StandardOutput ���
StandardError
m/ $ CurrentDirectory �
� 0 DllPath ��
� 8 ImagePathName
� @ CommandLine ��
H Environment ��
" L StartingX
" P StartingY
" T CountX ���
" X CountY ���
" \ CountCharsX ��
" ` CountCharsY ��
" d FillAttribute
" h WindowFlags ��
" l ShowWindowFlags ��
� p WindowTitle ��
� x DesktopInfo ��
� � ShellInfo
� � RuntimeData ��
�4 � CurrentDirectores
" �EnvironmentSize ��
" �EnvironmentVersion ���
�PackageDependencyData
" �ProcessGroupId ���
" �LoaderThreads
� �RedirectionDllName ���
� �HeapPartitionName
# �DefaultThreadpoolCpuSetMasks �
" �DefaultThreadpoolCpuSetMaskCount �
" �DefaultThreadpoolThreadMaximum ���V & �4 �_RTL_USER_PROCESS_PARAMETERS .?AU_RTL_USER_PROCESS_PARAMETERS@@ �� �4 k > � _PROCESSOR_RECORD .?AU_PROCESSOR_RECORD@@
�4
� �
" Index
" FeatureSet ���
" ProcessorSpeed ���
� ProcessorName
*$ � ProcessorIdentifier ��
? �VendorIdentifier �> �4 �_PROCESSOR_RECORD .?AU_PROCESSOR_RECORD@@ �4 � �
�
� B � _RTL_PROCESS_LOCKS .?AU_RTL_PROCESS_LOCKS@@ ��
�4
� V � _RTL_PROCESS_LOCK_INFORMATION .?AU_RTL_PROCESS_LOCK_INFORMATION@@ �4 " $ �*
" NumberOfLocks
�4 Locks B �4 ( _RTL_PROCESS_LOCKS .?AU_RTL_PROCESS_LOCKS@@ �� �4 � � b � _FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER@@
" EventTypes ���b �4 _FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER@@ �4 �) > � tagMSLLHOOKSTRUCT .?AUtagMSLLHOOKSTRUCT@@ ^
x pt ���
" mouseData
" flags
" time �
" dwExtraInfo ��> �4 tagMSLLHOOKSTRUCT .?AUtagMSLLHOOKSTRUCT@@ �4 f N � _CREATE_THREAD_DEBUG_INFO .?AU_CREATE_THREAD_DEBUG_INFO@@
�4
� " 3
�4
� N
hThread ��
lpThreadLocalBase
�4 lpStartAddress ���N �4 _CREATE_THREAD_DEBUG_INFO .?AU_CREATE_THREAD_DEBUG_INFO@@ �4 c 5 b � _SYSTEM_POWER_STATE_DISABLE_REASON .?AU_SYSTEM_POWER_STATE_DISABLE_REASON@@ �� " �R
�4 AffectedState
" PowerReasonCode ��
" PowerReasonLength b �4 _SYSTEM_POWER_STATE_DISABLE_REASON .?AU_SYSTEM_POWER_STATE_DISABLE_REASON@@ �� �4
�.
� p " t �4
�4
� V CoverageAllModules ��� CoverageSearchByHash � CoverageSearchByName �F t �4 _COVERAGE_REQUEST_CODES .?AW4_COVERAGE_REQUEST_CODES@@ � �4 �
�4
�
E
�
:2
� > � _EISA_MEMORY_TYPE .?AU_EISA_MEMORY_TYPE@@ �
�4 ConfigurationByte
DataSize �
! AddressLowWord ���
AddressHighByte ��
! MemorySize ���R �4 _EISA_MEMORY_CONFIGURATION .?AU_EISA_MEMORY_CONFIGURATION@@ �� �4 � � R � _CONTAINER_ROOT_INFO_OUTPUT .?AU_CONTAINER_ROOT_INFO_OUTPUT@@
�4
� >
! ContainerRootIdLength
| ContainerRootId ��R �4 _CONTAINER_ROOT_INFO_OUTPUT .?AU_CONTAINER_ROOT_INFO_OUTPUT@@ �4 �"
�
� V � _SECURITY_DESCRIPTOR_RELATIVE .?AU_SECURITY_DESCRIPTOR_RELATIVE@@ z
Revision �
Sbz1 �
! Control ��
" Owner
" Group
" Sacl �
" Dacl �V �4 _SECURITY_DESCRIPTOR_RELATIVE .?AU_SECURITY_DESCRIPTOR_RELATIVE@@ �4 � f � _EVENT_TRACE_SYSTEM_EVENT_INFORMATION .?AU_EVENT_TRACE_SYSTEM_EVENT_INFORMATION@@
�4
� V
� EventTraceInformationClass ���
# TraceHandle ��
� HookId ���f �4 _EVENT_TRACE_SYSTEM_EVENT_INFORMATION .?AU_EVENT_TRACE_SYSTEM_EVENT_INFORMATION@@ �4 � j � _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION .?AU_SYSTEM_SESSION_MAPPED_VIEW_INFORMATION@@ �
" NextEntryOffset ��
" SessionId
" ViewFailures �
" NumberOfBytesAvailable ���
" NumberOfBytesAvailableContiguous �j �4 _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION .?AU_SYSTEM_SESSION_MAPPED_VIEW_INFORMATION@@ �4 �
b � _SYSTEM_KERNEL_DEBUGGER_INFORMATION .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION@@ F
KernelDebuggerEnabled
KernelDebuggerNotPresent �b �4 _SYSTEM_KERNEL_DEBUGGER_INFORMATION .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION@@ �4 � > � tagMSGBOXPARAMSW .?AUtagMSGBOXPARAMSW@@ ���
u cbSize ���
y hwndOwner
� hInstance
�% lpszText �
�% lpszCaption ��
" dwStyle ��
�% lpszIcon �
" dwContextHelpId ��
� lpfnMsgBoxCallback ���
" $ dwLanguageId �>
�4 ( tagMSGBOXPARAMSW .?AUtagMSGBOXPARAMSW@@ �� �4 $ F � tagCOMPAREITEMSTRUCT .?AUtagCOMPAREITEMSTRUCT@@ ��
�4
� �
u CtlType ��
u CtlID
y hwndItem �
u itemID1 ��
" itemData1
u itemID2 ��
" itemData2
" dwLocaleId ���F �4 tagCOMPAREITEMSTRUCT .?AUtagCOMPAREITEMSTRUCT@@ �� �4 ,
^ � _LOOKUP_STREAM_FROM_CLUSTER_INPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_INPUT@@ B
" Flags
" NumberOfClusters �
�0 Cluster ��^ �4 _LOOKUP_STREAM_FROM_CLUSTER_INPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_INPUT@@ �4 � � MemoryBasicInformation ��� MemoryWorkingSetInformation �� MemoryMappedFilenameInformation �� MemoryRegionInformation �� MemoryWorkingSetExInformation MemorySharedCommitInformation MemoryImageInformation ��� MemoryRegionInformationEx MemoryPrivilegedBasicInformation � MemoryEnclaveImageInformation
MemoryBasicInformationCapped � MemoryPhysicalContiguityInformation ��J t �4 _MEMORY_INFORMATION_CLASS .?AW4_MEMORY_INFORMATION_CLASS@@ � �4 ?
�(
� b � _KEY_SET_VIRTUALIZATION_INFORMATION .?AU_KEY_SET_VIRTUALIZATION_INFORMATION@@
�4
�
" ��
" ��
" ��
" ��^
�4 VirtualTarget
�4 VirtualStore �
�4 VirtualSource
�4 Reserved �b �4 _KEY_SET_VIRTUALIZATION_INFORMATION .?AU_KEY_SET_VIRTUALIZATION_INFORMATION@@ �4 � % B � _TOKEN_USER_CLAIMS .?AU_TOKEN_USER_CLAIMS@@ ��
5
�
UserClaims ���B 5 _TOKEN_USER_CLAIMS .?AU_TOKEN_USER_CLAIMS@@ �� 5 � N � _PERFINFO_MEM_RESET_INFO .?AU_PERFINFO_MEM_RESET_INFO@@ ��
5
�
" ��
" ��f
BaseAddress ��
" SizeInBytes ��
5 TypeInfo �
5 Spare
" Flags N 5 _PERFINFO_MEM_RESET_INFO .?AU_PERFINFO_MEM_RESET_INFO@@ ��
5 � x
�
� � � _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ ��
5 ��
5
�
m
� �
5 Information ��
SectionBase ��
" SectionLength
SectionGlobalDataBase
" SectionGlobalDataLength �� 5 _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ �� 5 L � Z � _KEY_CONTROL_FLAGS_INFORMATION .?AU_KEY_CONTROL_FLAGS_INFORMATION@@ ��
5
�
" ControlFlags �Z 5 _KEY_CONTROL_FLAGS_INFORMATION .?AU_KEY_CONTROL_FLAGS_INFORMATION@@ �� 5 � ! N � _SYSTEM_NUMA_INFORMATION .?AU_SYSTEM_NUMA_INFORMATION@@ �� � " � � # " � � # " �
" HighestNodeNumber
" Reserved �
5 ActiveProcessorsGroupAffinity
5 AvailableMemory ��
5 Pad ��N 5 _SYSTEM_NUMA_INFORMATION .?AU_SYSTEM_NUMA_INFORMATION@@ �� 5 : V � _FILE_ID_BOTH_DIR_INFORMATION .?AU_FILE_ID_BOTH_DIR_INFORMATION@@
5
� j
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
p D ShortNameLength ��
F ShortName
} ` FileId ���
h FileName �V "5 p _FILE_ID_BOTH_DIR_INFORMATION .?AU_FILE_ID_BOTH_DIR_INFORMATION@@ #5
�,
� V � _TRANSACTION_BIND_INFORMATION .?AU_TRANSACTION_BIND_INFORMATION@@
TmHandle �V '5 _TRANSACTION_BIND_INFORMATION .?AU_TRANSACTION_BIND_INFORMATION@@ (5 �
�
� b � _SYSTEM_EXTENDED_THREAD_INFORMATION .?AU_SYSTEM_EXTENDED_THREAD_INFORMATION@@ R � _SYSTEM_THREAD_INFORMATION .?AU_SYSTEM_THREAD_INFORMATION@@ ��
,5 ThreadInfo ���
@ StackBase
D StackLimit ���
H Win32StartAddress
L TebBase ��
" P Reserved2
" T Reserved3
" X Reserved4 b -5 ` _SYSTEM_EXTENDED_THREAD_INFORMATION .?AU_SYSTEM_EXTENDED_THREAD_INFORMATION@@ .5 U V � _QUERY_STORAGE_RESERVE_OUTPUT .?AU_QUERY_STORAGE_RESERVE_OUTPUT@@ R � _STORAGE_RESERVE_AREA_INFO .?AU_STORAGE_RESERVE_AREA_INFO@@ �� 15 " �B
" Version ��
" AreaInfoCount
25 AreaInfo �V 35 _QUERY_STORAGE_RESERVE_OUTPUT .?AU_QUERY_STORAGE_RESERVE_OUTPUT@@ 45 + N � HSYNTHETICPOINTERDEVICE__ .?AUHSYNTHETICPOINTERDEVICE__@@
t unused ���N 75 HSYNTHETICPOINTERDEVICE__ .?AUHSYNTHETICPOINTERDEVICE__@@ 85 � ^ � _ETW_COVERAGE_SAMPLER_BLOOM_INFO .?AU_ETW_COVERAGE_SAMPLER_BLOOM_INFO@@ ��
:5
� &
� Common ���
�$ Bloom ^ <5 ( _ETW_COVERAGE_SAMPLER_BLOOM_INFO .?AU_ETW_COVERAGE_SAMPLER_BLOOM_INFO@@ �� =5 � # J � _CI_LOG_SCHEDULER_SLEEP .?AU_CI_LOG_SCHEDULER_SLEEP@@
� Header ���J @5 0 _CI_LOG_SCHEDULER_SLEEP .?AU_CI_LOG_SCHEDULER_SLEEP@@ A5 � U ^ � _WMI_EXTENDED_THREAD_INFORMATION .?AU_WMI_EXTENDED_THREAD_INFORMATION@@ ��j
" ProcessId
" ThreadId �
StackBase
StackLimit ���
UserStackBase
UserStackLimit ���
StartAddr
" Affinity �
Win32StartAddr ���
TebBase ��
" $ SubProcessTag
p ( BasePriority �
) PagePriority �
* IoPriority ���
+ Flags
, ThreadName ���^ D5 0 _WMI_EXTENDED_THREAD_INFORMATION .?AU_WMI_EXTENDED_THREAD_INFORMATION@@ �� E5 � j � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1@@
G5
� 6
� BootIdentifier ���
� FirmwareType �j I5 _SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1@@ J5
�,
�
� Data �: M5 _WNF_STATE_NAME .?AU_WNF_STATE_NAME@@ N5 �
�3
� Z � _ETW_CLOCK_CONFIGURATION_EVENT .?AU_ETW_CLOCK_CONFIGURATION_EVENT@@ ��F
" KnownType
" Capabilities �
40 DisableReason Z R5 _ETW_CLOCK_CONFIGURATION_EVENT .?AU_ETW_CLOCK_CONFIGURATION_EVENT@@ �� S5 �
U5 f � _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA .?AU_PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA@@ ��V
� ServiceName ��
q DeviceInstance ���
" DeviceInstanceLength �f X5 _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA .?AU_PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA@@ �� Y5 � !
�#
� B � _WMI_PNP_RECORD_V4 .?AU_WMI_PNP_RECORD_V4@@ ��
\5
� b
� ClassGuid
" UpperFilterCount �
" LowerFilterCount �
Strings ��B ^5 _WMI_PNP_RECORD_V4 .?AU_WMI_PNP_RECORD_V4@@ �� _5 � � � DriverType ��� FileSystemType ��� Win32ServiceOwnProcess ��� Win32ServiceShareProcess � AdapterType �� RecognizerType ���B t a5 _CM_SERVICE_NODE_TYPE .?AW4_CM_SERVICE_NODE_TYPE@@ � b5 � v
�
�
" e5
f5
� b SC_EVENT_DATABASE_CHANGE � SC_EVENT_PROPERTY_CHANGE � SC_EVENT_STATUS_CHANGE ���6 t h5 _SC_EVENT_TYPE .?AW4_SC_EVENT_TYPE@@ ��� i5 3 �
i5
�
l5
� R � _DUPLICATE_EXTENTS_DATA_EX .?AU_DUPLICATE_EXTENTS_DATA_EX@@ ��
" Size �
FileHandle ���
} SourceFileOffset �
} TargetFileOffset �
} ByteCount
" Flags R p5 ( _DUPLICATE_EXTENTS_DATA_EX .?AU_DUPLICATE_EXTENTS_DATA_EX@@ �� q5 r N � _SCRUB_PARITY_EXTENT_DATA .?AU_SCRUB_PARITY_EXTENT_DATA@@ F � _SCRUB_PARITY_EXTENT .?AU_SCRUB_PARITY_EXTENT@@ �� t5 " �
! Size �
! Flags
! NumberOfParityExtents
! MaximumNumberOfParityExtents �
u5 ParityExtents N v5 _SCRUB_PARITY_EXTENT_DATA .?AU_SCRUB_PARITY_EXTENT_DATA@@ w5 ' �
" Address ��
" Mode �
" ReserveSize ��
" CommitSize ���
" FirstRegionInformationOffset �
" NextHeapInformationOffset > y5 _HEAP_INFORMATION .?AU_HEAP_INFORMATION@@ z5 L �
�!
�
/
� J � _FILE_NAMES_INFORMATION .?AU_FILE_NAMES_INFORMATION@@
~5
� b
" NextEntryOffset ��
" FileIndex
" FileNameLength ���
FileName �J �5 _FILE_NAMES_INFORMATION .?AU_FILE_NAMES_INFORMATION@@ �5 $ : � _MUILANGCFGLIST .?AU_MUILANGCFGLIST@@ : � _MUILANGCFGNODE .?AU_MUILANGCFGNODE@@
�5
� f
u TotalSize
! NumLanguages �
! MaxNumLanguages ��
�5 LanguageConfigs ��: �5 _MUILANGCFGLIST .?AU_MUILANGCFGLIST@@ �5 � K j � _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION .?AU_JOURNAL_SET_KEY_USER_FLAGS_INFORMATION@@
�5
� �
2 Action ���
# RecordNumber �
} TimeStamp
� KeyPathName ��
" OldFlags �
" $ NewFlags �j �5 ( _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION .?AU_JOURNAL_SET_KEY_USER_FLAGS_INFORMATION@@ �5 3 � F � _FILE_OBJECTID_BUFFER .?AU_FILE_OBJECTID_BUFFER@@ " 0 �r
� ObjectId �
� BirthVolumeId
� BirthObjectId
� 0 DomainId �
�5 ExtendedInfo �F �5 @ _FILE_OBJECTID_BUFFER .?AU_FILE_OBJECTID_BUFFER@@ �5 ~ B � _MESSAGE_TRACE_USER .?AU_MESSAGE_TRACE_USER@@
�5
� F � _MESSAGE_TRACE_HEADER .?AU_MESSAGE_TRACE_HEADER@@ n
�5 MessageHeader
� MessageGuid ��
" MessageFlags �
" DataSize �
# Data �B �5 ( _MESSAGE_TRACE_USER .?AU_MESSAGE_TRACE_USER@@ �5 � � Z � DISPLAYCONFIG_PATH_SOURCE_INFO .?AUDISPLAYCONFIG_PATH_SOURCE_INFO@@ ��
u ��
u ��
I adapterId
u id ���
u modeInfoIdx ��
�5 cloneGroupId �
�5 sourceModeInfoIdx
u statusFlags ��Z �5 DISPLAYCONFIG_PATH_SOURCE_INFO .?AUDISPLAYCONFIG_PATH_SOURCE_INFO@@ �� �5 � : � tagTITLEBARINFO .?AUtagTITLEBARINFO@@ B
" cbSize ���
� rcTitleBar ���
: rgstate ��: �5 , tagTITLEBARINFO .?AUtagTITLEBARINFO@@ �5 9 R � _EVENTLOG_FULL_INFORMATION .?AU_EVENTLOG_FULL_INFORMATION@@ ��
�5
�
" dwFull ���R �5 _EVENTLOG_FULL_INFORMATION .?AU_EVENTLOG_FULL_INFORMATION@@ �� �5 � B � PPM_WMI_PERF_STATES .?AUPPM_WMI_PERF_STATES@@
�5
� B � PPM_WMI_PERF_STATE .?AUPPM_WMI_PERF_STATE@@ �� �5 " @ ��
" Count
" MaxFrequency �
" CurrentState �
" MaxPerfState �
" MinPerfState �
" LowestPerfState ��
" ThermalConstraint
BusyAdjThreshold �
PolicyType ���
Type �
Reserved �
" TimerInterval
# ( TargetProcessors �
" 0 PStateHandler
" 4 PStateContext
" 8 TStateHandler
" < TStateContext
" @ FeedbackHandler ��
" D Reserved1
# H Reserved2
�5 P State B �5 � PPM_WMI_PERF_STATES .?AUPPM_WMI_PERF_STATES@@ �5 � ^ � _LEARNING_MODE_OBJECT_INFORMATION .?AU_LEARNING_MODE_OBJECT_INFORMATION@@ �
ListEntry
� LogLevel �
< ObjectType ���
< ObjectName ���
RootDirectory
� FullObjectName ���^ �5 _LEARNING_MODE_OBJECT_INFORMATION .?AU_LEARNING_MODE_OBJECT_INFORMATION@@ �5 ] �
�
� B � tagEMRSELECTOBJECT .?AUtagEMRSELECTOBJECT@@ ��
�5
� &
emr ��
" ihObject �B �5 tagEMRSELECTOBJECT .?AUtagEMRSELECTOBJECT@@ �� �5 �
�
� N � _EVENT_BASIC_INFORMATION .?AU_EVENT_BASIC_INFORMATION@@ ��.
D* EventType
EventState ���N �5 _EVENT_BASIC_INFORMATION .?AU_EVENT_BASIC_INFORMATION@@ �� �5 i B � tagWINDOWPLACEMENT .?AUtagWINDOWPLACEMENT@@ ��
u length ���
u flags
u showCmd ��
x ptMinPosition
x ptMaxPosition
� rcNormalPosition �B �5 , tagWINDOWPLACEMENT .?AUtagWINDOWPLACEMENT@@ �� �5 � F � _EXCEPTION_DEBUG_INFO .?AU_EXCEPTION_DEBUG_INFO@@ 6
D ExceptionRecord ��
" P dwFirstChance F �5 T _EXCEPTION_DEBUG_INFO .?AU_EXCEPTION_DEBUG_INFO@@ �5 c 0 R IgnoreError �� NormalError �� SevereError �� CriticalError F t �5 _CM_ERROR_CONTROL_TYPE .?AW4_CM_ERROR_CONTROL_TYPE@@ ��� �5 � �
t unused ���& �5 HDC__ .?AUHDC__@@ �5 P
"
� f � _EVENT_TRACE_TIME_PROFILE_INFORMATION .?AU_EVENT_TRACE_TIME_PROFILE_INFORMATION@@
�5
� F
� EventTraceInformationClass ���
" ProfileInterval ��f �5 _EVENT_TRACE_TIME_PROFILE_INFORMATION .?AU_EVENT_TRACE_TIME_PROFILE_INFORMATION@@ �5 � � ^ � _PROCESS_HANDLE_TRACING_ENABLE_EX .?AU_PROCESS_HANDLE_TRACING_ENABLE_EX@@ *
" Flags
" TotalSlots ���^ �5 _PROCESS_HANDLE_TRACING_ENABLE_EX .?AU_PROCESS_HANDLE_TRACING_ENABLE_EX@@ �5 C B 2 � _CONTEXT_EX .?AU_CONTEXT_EX@@
�5
� :
�& All ��
�& Legacy ���
�& XState ���2 �5 _CONTEXT_EX .?AU_CONTEXT_EX@@ �5 � `
Y
� b � _SYSTEM_SESSION_POOLTAG_INFORMATION .?AU_SYSTEM_SESSION_POOLTAG_INFORMATION@@ C " �V
" NextEntryOffset ��
" SessionId
" Count
�5 TagInfo ��b �5 ( _SYSTEM_SESSION_POOLTAG_INFORMATION .?AU_SYSTEM_SESSION_POOLTAG_INFORMATION@@ �5 �
J � _PROCESSOR_POWER_POLICY .?AU_PROCESSOR_POWER_POLICY@@
" ��
" �� W- " < �
" Revision �
DynamicThrottle ��
� Spare
�5 DisableCStates ���
�5 Reserved �
" PolicyCount ��
�5 Policy ���J �5 L _PROCESSOR_POWER_POLICY .?AU_PROCESSOR_POWER_POLICY@@ �5 j
�
� F � tagCBTACTIVATESTRUCT .?AUtagCBTACTIVATESTRUCT@@ ��
�5
� .
t fMouse ���
y hWndActive ���F �5 tagCBTACTIVATESTRUCT .?AUtagCBTACTIVATESTRUCT@@ �� �5 m
�1
�
X
� J � _SYSTEM_PREFETCH_STATS .?AU_SYSTEM_PREFETCH_STATS@@ ��
" DemandFilePageCount ��
" DemandFileIOCount
" TrickleFilePageCount �
" TrickleFileIOCount ���
" DemandPrivatePageCount ���
" DemandPrivateIOCount �
" TricklePrivatePageCount ��
" TricklePrivateIOCount J �5 _SYSTEM_PREFETCH_STATS .?AU_SYSTEM_PREFETCH_STATS@@ �� �5 �
�
� b � _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE .?AU_PERFINFO_PO_NOTIFY_DEVICE_COMPLETE@@
�5
� &
Irp ��
Status ���b �5 _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE .?AU_PERFINFO_PO_NOTIFY_DEVICE_COMPLETE@@ �5 � �
�.
� .
" CheckSum �
" TimeDateStamp F �5 _HOT_PATCH_IMAGE_INFO .?AU_HOT_PATCH_IMAGE_INFO@@ �5 E
+
� �
" dwScope ��
" dwType ���
" dwDisplayType
" dwUsage ��
q lpLocalName ��
q lpRemoteName �
q lpComment
q lpProvider ���6 �5 _NETRESOURCEW .?AU_NETRESOURCEW@@ 6 5 n f � _SYSTEM_DMA_GUARD_POLICY_INFORMATION .?AU_SYSTEM_DMA_GUARD_POLICY_INFORMATION@@ ��
6
� "
DmaGuardPolicyEnabled f 6 _SYSTEM_DMA_GUARD_POLICY_INFORMATION .?AU_SYSTEM_DMA_GUARD_POLICY_INFORMATION@@ �� 6 > j � _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA .?AU_SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA@@ ��
�
� >
6 ProcessorProfileControlArea ��
Allocate �j 6 _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA .?AU_SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA@@ ��
6 � &
PID ��
� KeyName ��6 6 KEY_PID_ARRAY .?AUKEY_PID_ARRAY@@
6 3 o J � _POWER_SESSION_WINLOGON .?AU_POWER_SESSION_WINLOGON@@ >
" SessionId
Console ��
Locked ���J 6 _POWER_SESSION_WINLOGON .?AU_POWER_SESSION_WINLOGON@@ 6 � t �'
6
�
�
� p t 6
6
� > � _SECTIONBASICINFO .?AU_SECTIONBASICINFO@@ R
BaseAddress ��
" AllocationAttributes �
} MaximumSize ��> 6 _SECTIONBASICINFO .?AU_SECTIONBASICINFO@@ 6 i > � _SCRUB_DATA_INPUT .?AU_SCRUB_DATA_INPUT@@ " " d � " 0 �z
" Size �
" Flags
" MaximumIos ���
� ObjectId �
6 Reserved �
6 � ResumeContext > 6 �_SCRUB_DATA_INPUT .?AU_SCRUB_DATA_INPUT@@ !6 �&
'
� Z PT_POINTER ��� PT_TOUCH � PT_PEN ��� PT_MOUSE � PT_TOUCHPAD ��B t $6 tagPOINTER_INPUT_TYPE .?AW4tagPOINTER_INPUT_TYPE@@ � %6 x j � _HEAP_PERFORMANCE_COUNTERS_INFORMATION .?AU_HEAP_PERFORMANCE_COUNTERS_INFORMATION@@ ��
'6
� v � _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION .?AU_SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION@@ �
" Size �
" Version ��
" HeapIndex
" LastHeapIndex
" BaseAddress ��
" ReserveSize ��
" CommitSize ���
" SegmentCount �
" LargeUCRMemory ���
" $ UCRLength
" ( AllocatedSpace ���
" , FreeSpace
" 0 FreeListLength ���
" 4 Contention ���
" 8 VirtualBlocks
" < CommitRate ���
" @ DecommitRate �
)6 D SegmentHeapPerfInformation ���j *6 \ _HEAP_PERFORMANCE_COUNTERS_INFORMATION .?AU_HEAP_PERFORMANCE_COUNTERS_INFORMATION@@ �� +6 L
�&
� �, " �n
# NextOffset ���
# NumSDEntriesReturned �
# NumSDBytesReturned ���
.6 SDEntry ��B /6 0 _SD_ENUM_SDS_OUTPUT .?AU_SD_ENUM_SDS_OUTPUT@@ 06 @ j � DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS@@ ��
u ��
u ��
u ��
u ��~
36 friendlyNameFromEdid �
46 friendlyNameForced ���
56 edidIdsValid �
66 reserved �
u value j 76 DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS@@ �� 86 �
� F � _PROCESS_ACCESS_TOKEN .?AU_PROCESS_ACCESS_TOKEN@@ &
Token
Thread ���F <6 _PROCESS_ACCESS_TOKEN .?AU_PROCESS_ACCESS_TOKEN@@ =6 C � f � _SYSTEM_ELAM_CERTIFICATE_INFORMATION .?AU_SYSTEM_ELAM_CERTIFICATE_INFORMATION@@ ��
?6
�
ElamDriverFile ���f A6 _SYSTEM_ELAM_CERTIFICATE_INFORMATION .?AU_SYSTEM_ELAM_CERTIFICATE_INFORMATION@@ �� B6 '
�
$
� � FixedWakeSourcePowerButton ��� FixedWakeSourceSleepButton ��� FixedWakeSourceRtc ��� FixedWakeSourceDozeToHibernate ���J t F6 PO_FIXED_WAKE_SOURCE_TYPE .?AW4PO_FIXED_WAKE_SOURCE_TYPE@@ � G6
^
" RecordLength �
! MajorVersion �
! MinorVersion �
# FileReferenceNumber ��
# ParentFileReferenceNumber
Usn ��
} TimeStamp
" ( Reason ���
" , SourceInfo ���
" 0 SecurityId ���
" 4 FileAttributes ���
! 8 FileNameLength ���
! : FileNameOffset ���
< FileName �6 I6 @ USN_RECORD_V2 .?AUUSN_RECORD_V2@@ J6 s 6 � _TOKEN_SOURCE .?AU_TOKEN_SOURCE@@
L6
� p " �6
N6 SourceName ���
I SourceIdentifier �6 O6 _TOKEN_SOURCE .?AU_TOKEN_SOURCE@@ P6 � . � _TP_WAIT .?AU_TP_WAIT@@ �� " " S6
T6
� � VirtualStorageBehaviorUndefined �� VirtualStorageBehaviorCacheWriteThrough �� VirtualStorageBehaviorCacheWriteBack �V t V6 _VIRTUAL_STORAGE_BEHAVIOR_CODE .?AW4_VIRTUAL_STORAGE_BEHAVIOR_CODE@@ ��� W6 �! > � _HARDWARE_COUNTER .?AU_HARDWARE_COUNTER@@ 6
0 Type �
" Reserved �
# Index > Z6 _HARDWARE_COUNTER .?AU_HARDWARE_COUNTER@@ [6 C n � _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION@@ ��
" ��
" ��
" ��
" ��~
" Flags
^6 Locked ���
_6 UnlockApplied
`6 UnlockIdValid
a6 Reserved �
S UnlockId �n b6 $ _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION@@ �� c6 �
J � _RPC_SECURITY_QOS_V3_A .?AU_RPC_SECURITY_QOS_V3_A@@ ��
�- HttpCredentials ��2 f6 <anonymous-tag> .?AT<anonymous-tag>@@ g6 � ; �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
g6 u
Sid ��J i6 _RPC_SECURITY_QOS_V3_A .?AU_RPC_SECURITY_QOS_V3_A@@ �� j6 � 4 f � _FILE_IOSTATUSBLOCK_RANGE_INFORMATION .?AU_FILE_IOSTATUSBLOCK_RANGE_INFORMATION@@
l6
� 6
IoStatusBlockRange ���
" Length ���f n6 _FILE_IOSTATUSBLOCK_RANGE_INFORMATION .?AU_FILE_IOSTATUSBLOCK_RANGE_INFORMATION@@ o6 � : � tagEMRSETPIXELV .?AUtagEMRSETPIXELV@@ :
emr ��
I ptlPixel �
" crColor ��: r6 tagEMRSETPIXELV .?AUtagEMRSETPIXELV@@ s6 F � _LOGICAL_DISK_DEFRAG .?AU_LOGICAL_DISK_DEFRAG@@ ��
# AlignmentClusters
# AvgFreeSpaceSize �
# ClustersPerSlab ��
# FragmentedDirectoryExtents ���
# FragmentedExtents
# ( FreeSpaceCount ���
# 0 LargestFreeSpaceSize �
# 8 LastRunActualPurgeClusters ���
# @ LastRunClustersTrimmed ���
# H LastRunFullDefragTime
# P LastRunTime ��
# X MFTSize ��
# ` TotalClusters
# h TotalUsedClusters
" p AvgFragmentsPerFile ��
" t BytesPerCluster ��
" x DirectoryCount ���
" | FragmentedDirectories
" � FragmentedFiles ��
" � FragmentedSpace ��
" � HardwareIssue
" � InUseMFTRecords ��
" � InUseSlabs ���
" � LastRunActualPurgeSlabs ��
" � LastRunInitialBackedSlabs
" � LastRunPercentFragmentation ��
" � LastRunPinnedSlabs ���
" � LastRunPotentialPurgeSlabs ���
" � LastRunSpaceInefficientSlabs �
" � LastRunTrimmedSlabs ��
" � LastRunUnknownEvictFailSlabs �
" � LastRunVolsnapPinnedSlabs
" � MFTFragmentCount �
" � MovableFiles �
" � TotalMFTRecords ��
" � TotalSlabs ���
" � UnmovableFiles ���
� � VolumeId �
� VolumePathNames ��F ' v6 � _LOGICAL_DISK_DEFRAG .?AU_LOGICAL_DISK_DEFRAG@@ �� w6 � V � _KEY_VALUE_BASIC_INFORMATION .?AU_KEY_VALUE_BASIC_INFORMATION@@ ��R
" TitleIndex ���
" Type �
" NameLength ���
Name �V z6 _KEY_VALUE_BASIC_INFORMATION .?AU_KEY_VALUE_BASIC_INFORMATION@@ �� {6 � H > � _FILE_LEVEL_TRIM .?AU_FILE_LEVEL_TRIM@@ ��
}6
� c1 " �:
" Key ��
" NumRanges
6 Ranges ���> �6 _FILE_LEVEL_TRIM .?AU_FILE_LEVEL_TRIM@@ �� �6 L B
" ReserveSize ��
" ZeroBits �
StackBase f �6 _PROCESS_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_STACK_ALLOCATION_INFORMATION@@ �6 a � v � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE@@ ��
MaxIops ��
MaxBandwidth �
ReservationIops ��
q VolumeName ���
" BaseIoSize ���
� ControlFlags �
! $ VolumeNameLength �v �6 ( JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE@@ �� �6 C _
�4
� > � _MUILANGLISTNODE .?AU_MUILANGLISTNODE@@ ��F
! LanguageType �
! Reserved �
LanguageSpec �> �6 _MUILANGLISTNODE .?AU_MUILANGLISTNODE@@ �� �6 � T V � _FILE_FS_OBJECTID_INFORMATION .?AU_FILE_FS_OBJECTID_INFORMATION@@
�6
� .
� ObjectId �
�5 ExtendedInfo �V �6 @ _FILE_FS_OBJECTID_INFORMATION .?AU_FILE_FS_OBJECTID_INFORMATION@@ �6 �
�-
� * XLAT_SERVER �� XLAT_CLIENT ��* t �6 XLAT_SIDE .?AW4XLAT_SIDE@@ � �6 � � b
RefIdToPointer ���
PointerToRefId ���
" NextRefId
�6 XlatSide �F �6 _FULL_PTR_XLAT_TABLES .?AU_FULL_PTR_XLAT_TABLES@@ �6 � �
�
�
� �
" Size �
" InitialPc
StackBase
StackLimit ���
DeallocationStack
" LogFlags �
" InitialSp
SimulationCount ��
InCpuSimulation ��
EmulateInitialPc �
Initialized ��
�6 ExceptionList
$ CpuContext ���
�6 ( InitialExceptionContext ��
, pCallersRIID �
0 pCallersUnknown ��
" 4 Flags
8 SelfRegDllName ���
< SelfRegDllHandle �. �6 @ _Wx86TIB .?AU_Wx86TIB@@ �� �6 a �
(
�
&
� . � _FPO_DATA .?AU_FPO_DATA@@
! ��
! ��
! ��
! ��
!
��
! ���
" ulOffStart ���
" cbProcSize ���
" cdwLocals
! cdwParams
�6 cbProlog �
�6 cbRegs ���
�6 fHasSEH ��
�6 fUseBP ���
�6 reserved �
�6 cbFrame ��.
�6 _FPO_DATA .?AU_FPO_DATA@@ �6 [ � Z � _RPC_BINDING_HANDLE_OPTIONS_V1 .?AU_RPC_BINDING_HANDLE_OPTIONS_V1@@ ��
�6
� V
" Version ��
" Flags
" ComTimeout ���
" CallTimeout ��Z �6 _RPC_BINDING_HANDLE_OPTIONS_V1 .?AU_RPC_BINDING_HANDLE_OPTIONS_V1@@ �� �6 � (
�
� 6 � _QUOTA_LIMITS .?AU_QUOTA_LIMITS@@ �
" PagedPoolLimit ���
" NonPagedPoolLimit
" MinimumWorkingSetSize
" MaximumWorkingSetSize
" PagefileLimit
} TimeLimit 6 �6 _QUOTA_LIMITS .?AU_QUOTA_LIMITS@@ �6 C � R � _QUERY_SERVICE_LOCK_STATUSA .?AU_QUERY_SERVICE_LOCK_STATUSA@@
�6
� J
" fIsLocked
p lpLockOwner ��
" dwLockDuration ���R �6 _QUERY_SERVICE_LOCK_STATUSA .?AU_QUERY_SERVICE_LOCK_STATUSA@@ �6 3
Y
�
.
� : � tagEXTLOGFONTA .?AUtagEXTLOGFONTA@@ ���
l elfLogFont ���
P+ < elfFullName ��
c | elfStyle �
" � elfVersion ���
" � elfStyleSize �
" � elfMatch �
" � elfReserved ��
w* � elfVendorId ��
" � elfCulture ���
� � elfPanose :
�6 � tagEXTLOGFONTA .?AUtagEXTLOGFONTA@@ �� �6 j � _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES@@ ��v
" Version ��
ProcessHandle
" PatchCount ���
< PatchPathStrings �
�. BaseInfos j �6 _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES@@ �� �6 � r � _FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX@@
�6
� .
� StorageReserveId �
" Flags r �6 _FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX@@ �6 i+
�1
�
2
� >
HeapHandle ���
Address ��
" Size �> �6 _HEAP_EVENT_RANGE .?AU_HEAP_EVENT_RANGE@@ �6 � � : � tagTTPOLYCURVE .?AUtagTTPOLYCURVE@@ �� �3 " �2
! wType
! cpfx �
�6 apfx �: �6 tagTTPOLYCURVE .?AUtagTTPOLYCURVE@@ �� �6 �
J � _PORT_DATA_INFORMATION .?AU_PORT_DATA_INFORMATION@@ ��> � _PORT_DATA_ENTRY .?AU_PORT_DATA_ENTRY@@ �� �6 " �6
" CountDataEntries �
�6 DataEntries ��J �6 _PORT_DATA_INFORMATION .?AU_PORT_DATA_INFORMATION@@ �� �6 � [ Z � _WMI_JOB_SET_QUERY_INFORMATION .?AU_WMI_JOB_SET_QUERY_INFORMATION@@ ��N
� ContainerId ��
" JobId
" JobObjectInformationClass Z �6 _WMI_JOB_SET_QUERY_INFORMATION .?AU_WMI_JOB_SET_QUERY_INFORMATION@@ �� �6 � � J � _FILE_ID_EXTD_DIR_INFO .?AU_FILE_ID_EXTD_DIR_INFO@@ ��V
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
" D ReparsePointTag ��
� H FileId ���
X FileName �J �6 ` _FILE_ID_EXTD_DIR_INFO .?AU_FILE_ID_EXTD_DIR_INFO@@ �� �6 .# 2 HANDEDNESS_LEFT �� HANDEDNESS_RIGHT �2 t �6 tagHANDEDNESS .?AW4tagHANDEDNESS@@ � �6 �1
�6
� v � _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION .?AU_SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION@@ >
FileHandle ���
" ImageSize
Image v �6 _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION .?AU_SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION@@ �6 4 � ! � �6
�%
� : � tagMONITORINFO .?AUtagMONITORINFO@@ ��R
" cbSize ���
� rcMonitor
� rcWork ���
" $ dwFlags ��: �6 ( tagMONITORINFO .?AUtagMONITORINFO@@ �� �6 �4 � MemSectionExtendedParameterInvalidType ��� MemSectionExtendedParameterUserPhysicalFlags � MemSectionExtendedParameterNumaNode �� MemSectionExtendedParameterMax ���^ t �6 MEM_SECTION_EXTENDED_PARAMETER_TYPE .?AW4MEM_SECTION_EXTENDED_PARAMETER_TYPE@@ � �6 ? & V � _OBJECT_DIRECTORY_INFORMATION .?AU_OBJECT_DIRECTORY_INFORMATION@@ &
� Name �
� TypeName �V �6 _OBJECT_DIRECTORY_INFORMATION .?AU_OBJECT_DIRECTORY_INFORMATION@@ �6 � � " " �6
�6
� � � _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@
Ssp �� �6 _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@ �6 a V � _PERFINFO_MEMORY_INFORMATION .?AU_PERFINFO_MEMORY_INFORMATION@@ ���
" ZeroPageCount
" FreePageCount
" ModifiedPageCount
" ModifiedNoWritePageCount �
" BadPageCount �
�+ PageCountByPriority ��
�+ 4 RepurposedPagesByPriority
" T ModifiedPageCountPageFile V 7 X _PERFINFO_MEMORY_INFORMATION .?AU_PERFINFO_MEMORY_INFORMATION@@ �� 7 � �
� �
" Latency ��
" Power
" TimeCheck
PromotePercent ���
DemotePercent
StateType
Reserved �
" StateFlags ���
" Context ��
" IdleHandler ��
" Reserved1 B 7 PPM_WMI_IDLE_STATE .?AUPPM_WMI_IDLE_STATE@@ �� 7 � B � tagIMECHARPOSITION .?AUtagIMECHARPOSITION@@ ��
7
� j
" dwSize ���
" dwCharPos
x pt ���
u cLineHeight ��
� rcDocument ���B 7 $ tagIMECHARPOSITION .?AUtagIMECHARPOSITION@@ ��
7 E � : � _RTL_RXACT_LOG .?AU_RTL_RXACT_LOG@@ ��J
" OperationCount ���
" LogSize ��
" LogSizeInUse �:
7 _RTL_RXACT_LOG .?AU_RTL_RXACT_LOG@@ �� 7 L � "
" iType
" nSize * 7 tagEMR .?AUtagEMR@@ �� 7 > N � _POWER_SESSION_RIT_STATE .?AU_POWER_SESSION_RIT_STATE@@ ��.
Active ���
" LastInputTime N 7 _POWER_SESSION_RIT_STATE .?AU_POWER_SESSION_RIT_STATE@@ �� 7 �
" HeaderSize ���
" TotalSize
" QuerySequence
" OptionsOffset
" OptionsSize ��
" StatsOffset ��
" StatsSize
" SamplesOffset
" SampleCount ��
" $ ModulesOffset
" ( ModuleCount ��R 7 , _ETW_COVERAGE_SAMPLER_DATA .?AU_ETW_COVERAGE_SAMPLER_DATA@@ �� 7 � N : � _ETW_POOL_EVENT .?AU_ETW_POOL_EVENT@@ N
" PoolType �
" Tag ��
" NumberOfBytes
Entry : 7 _ETW_POOL_EVENT .?AU_ETW_POOL_EVENT@@ 7 � @
6 � _TIME_FIELDS .?AU_TIME_FIELDS@@ ��
Year �
Month
Day ��
Hour �
Minute ���
Second ���
Milliseconds �
Weekday ��6 7 _TIME_FIELDS .?AU_TIME_FIELDS@@ �� 7 ( a F � _UNICODE_PREFIX_TABLE .?AU_UNICODE_PREFIX_TABLE@@
(
� f
NodeTypeCode �
NameLength ���
#7 NextPrefixTree ���
#7 LastNextEntry F $7 _UNICODE_PREFIX_TABLE .?AU_UNICODE_PREFIX_TABLE@@ %7 ( \
�3
� B � _MENU_EVENT_RECORD .?AU_MENU_EVENT_RECORD@@ ��
(7
�
u dwCommandId ��B *7 _MENU_EVENT_RECORD .?AU_MENU_EVENT_RECORD@@ �� +7 r . � HWINSTA__ .?AUHWINSTA__@@
t unused ���. .7 HWINSTA__ .?AUHWINSTA__@@ /7 ' B � _PS_MEMORY_RESERVE .?AU_PS_MEMORY_RESERVE@@ ��
17
� 6
ReserveAddress ���
" ReserveSize ��B 37 _PS_MEMORY_RESERVE .?AU_PS_MEMORY_RESERVE@@ �� 47 a $ F � tagWNODE_METHOD_ITEM .?AUtagWNODE_METHOD_ITEM@@ ��
5 WnodeHeader ��
" 0 OffsetInstanceName ���
" 4 InstanceIndex
" 8 MethodId �
" < DataBlockOffset ��
" @ SizeDataBlock
y D VariableData �F 77 H tagWNODE_METHOD_ITEM .?AUtagWNODE_METHOD_ITEM@@ �� 87 8 �
�2
� $ $ ;7
�6
� V � _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES .?AT_SYSDBG_LIVEDUMP_CONTROL_ADDPAGES@@
" ��
" ��F
?7 HypervisorPages ��
@7 Reserved �
" AsUlong ��V A7 _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES .?AT_SYSDBG_LIVEDUMP_CONTROL_ADDPAGES@@ B7 d
-
� N � _PS_SYSTEM_DLL_INIT_BLOCK .?AU_PS_SYSTEM_DLL_INIT_BLOCK@@
" ��
" ��z
" Size �
# SystemDllWowRelocation ���
# SystemDllNativeRelocation
5 Wow64SharedInformation ���
" � RngData ��
" � Flags
F7 � CfgOverride ��
G7 � Reserved �
d � MitigationOptionsMap �
# � CfgBitMap
# � CfgBitMapSize
# � Wow64CfgBitMap ���
# � Wow64CfgBitMapSize ���
j � MitigationAuditOptionsMap N H7 � _PS_SYSTEM_DLL_INIT_BLOCK .?AU_PS_SYSTEM_DLL_INIT_BLOCK@@ I7 a @
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ���
" Flags
K7 EnableExportAddressFilter
L7 AuditExportAddressFilter �
M7 EnableExportAddressFilterPlus
N7 AuditExportAddressFilterPlus �
O7 EnableImportAddressFilter
P7 AuditImportAddressFilter �
Q7 EnableRopStackPivot ��
R7 AuditRopStackPivot ���
S7 EnableRopCallerCheck �
T7 AuditRopCallerCheck ��
U7 EnableRopSimExec �
V7 AuditRopSimExec ��
W7 ReservedFlags z X7 _PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ �� Y7 C �
�
�
d
� � SystemActivityModerationAppTypeClassic ��� SystemActivityModerationAppTypePackaged �� MaxSystemActivityModerationAppType ���b t ]7 _SYSTEM_ACTIVITY_MODERATION_APP_TYPE .?AW4_SYSTEM_ACTIVITY_MODERATION_APP_TYPE@@ ��� ^7 $
^7
� J � _THREAD_TEB_INFORMATION .?AU_THREAD_TEB_INFORMATION@@ J
TebInformation ���
" TebOffset
" BytesToRead ��J b7 _THREAD_TEB_INFORMATION .?AU_THREAD_TEB_INFORMATION@@ c7 a � J � _EVENT_TRACE_PROPERTIES .?AU_EVENT_TRACE_PROPERTIES@@ �
5 Wnode
" 0 BufferSize ���
" 4 MinimumBuffers ���
" 8 MaximumBuffers ���
" < MaximumFileSize ��
" @ LogFileMode ��
" D FlushTimer ���
" H EnableFlags ��
L AgeLimit �
L FlushThreshold ���
" P NumberOfBuffers ��
" T FreeBuffers ��
" X EventsLost ���
" \ BuffersWritten ���
" ` LogBuffersLost ���
" d RealTimeBuffersLost ��
h LoggerThreadId ���
" l LogFileNameOffset
" p LoggerNameOffset �J f7 x _EVENT_TRACE_PROPERTIES .?AU_EVENT_TRACE_PROPERTIES@@ g7 � ^ y u u " i7
j7
�
�-
� R � _PERFINFO_PROCESS_PERFCTR32 .?AU_PERFINFO_PROCESS_PERFCTR32@@ �
" ProcessId
" PageFaultCount ���
" HandleCount ��
" Reserved �
u PeakVirtualSize ��
u PeakWorkingSetSize ���
u PeakPagefileUsage
u QuotaPeakPagedPoolUsage ��
u QuotaPeakNonPagedPoolUsage ���
u $ VirtualSize ��
u ( WorkingSetSize ���
u , PagefileUsage
u 0 QuotaPagedPoolUsage ��
u 4 QuotaNonPagedPoolUsage ���
u 8 PrivatePageCount �R n7 < _PERFINFO_PROCESS_PERFCTR32 .?AU_PERFINFO_PROCESS_PERFCTR32@@ o7 � �
�
�
P
�
��
��
��
��
��r
s7 Interrupt
t7 Reserved �
u7 LevelTriggered ���
v7 Shared ���
w7 MoreEntries ��F x7 _EISA_IRQ_DESCRIPTOR .?AU_EISA_IRQ_DESCRIPTOR@@ �� y7 � � n PdataCrUnchained � PdataCrUnchainedSavedLr �� PdataCrChainedWithPac PdataCrChained ���: t {7 ARM64_FNPDATA_CR .?AW4ARM64_FNPDATA_CR@@ ��� |7 [ N � _SYSDBG_LIVEDUMP_CONTROL .?AU_SYSDBG_LIVEDUMP_CONTROL@@ ��
" Version ��
" BugCheckCode �
" BugCheckParam1 ���
" BugCheckParam2 ���
" BugCheckParam3 ���
" BugCheckParam4 ���
DumpFileHandle ���
CancelEventHandle
^- Flags
>7 $ AddPagesControl ��N
7 ( _SYSDBG_LIVEDUMP_CONTROL .?AU_SYSDBG_LIVEDUMP_CONTROL@@ �� �7 v
Y(
�
).
� J � _ENCLAVE_INIT_INFO_SGX .?AU_ENCLAVE_INIT_INFO_SGX@@ �� " � " � � " 0 � " � �V
�7 SigStruct
�7 Reserved1
�7 EInitToken ���
�7 0 Reserved2 J �7 _ENCLAVE_INIT_INFO_SGX .?AU_ENCLAVE_INIT_INFO_SGX@@ �� �7 ? � r � _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600@@
" Size �
" DataFormatVersion
Data �
" Length ���
SectionGlobalData
" SectionGlobalDataLength ��
SectionBase ��
" SectionTotalLength ���
~! ActivationContext
" $ AssemblyRosterIndex ��
" ( Flags r �7 , _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600@@ �7 L � N � _FILE_NOTIFY_INFORMATION .?AU_FILE_NOTIFY_INFORMATION@@ ��
�7
� b
" NextEntryOffset ��
" Action ���
" FileNameLength ���
FileName �N �7 _FILE_NOTIFY_INFORMATION .?AU_FILE_NOTIFY_INFORMATION@@ �� �7 8 2
� SyntaxGUID ���
j& SyntaxVersion J �7 _RPC_SYNTAX_IDENTIFIER .?AU_RPC_SYNTAX_IDENTIFIER@@ �� �7 � .
w
� r
Enable ���
� Spare
" BatteryLevel �
v PowerPolicy ��
S MinSystemState ���B �7 SYSTEM_POWER_LEVEL .?AUSYSTEM_POWER_LEVEL@@ �� �7 �
R � _WINDOW_BUFFER_SIZE_RECORD .?AU_WINDOW_BUFFER_SIZE_RECORD@@ ��
'" dwSize ���R �7 _WINDOW_BUFFER_SIZE_RECORD .?AU_WINDOW_BUFFER_SIZE_RECORD@@ �� �7 n Z � _SYSTEM_LEAP_SECOND_INFORMATION .?AU_SYSTEM_LEAP_SECOND_INFORMATION@@ &
Enabled ��
" Flags Z �7 _SYSTEM_LEAP_SECOND_INFORMATION .?AU_SYSTEM_LEAP_SECOND_INFORMATION@@ �7 � > � _IMAGE_AUX_SYMBOL_EX .?AT_IMAGE_AUX_SYMBOL_EX@@ ��
�7
� V
" WeakDefaultSymIndex ��
" WeakSearchType ���
� rgbReserved ��: �7 <anonymous-tag> .?AU<anonymous-tag>@@ �7 [ =
b Name �: �7 <anonymous-tag> .?AU<anonymous-tag>@@ �7 [ B �
" Length ���
! NumberOfRelocations ��
! NumberOfLinenumbers ��
" CheckSum �
Number ���
Selection
bReserved
HighNumber ���
� rgbReserved ��: �7 <anonymous-tag> .?AU<anonymous-tag>@@ �7 [ E *
" crc ��
� rgbReserved ��: �7 <anonymous-tag> .?AU<anonymous-tag>@@ �7 [ T r
�7 Sym ��
�7 File �
�7 Section ��
�# TokenDef �
� rgbReserved ��
�7 CRC ��> �7 _IMAGE_AUX_SYMBOL_EX .?AT_IMAGE_AUX_SYMBOL_EX@@ �� �7 [ < : � _DISCDLGSTRUCTW .?AU_DISCDLGSTRUCTW@@ r
" cbStructure ��
y hwndOwner
q lpLocalName ��
q lpRemoteName �
" dwFlags ��: �7 _DISCDLGSTRUCTW .?AU_DISCDLGSTRUCTW@@ �7 5 � j � _STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER .?AU_STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER@@ n
" OptimalWriteSize �
" StreamGranularitySize
" StreamIdMin ��
" StreamIdMax ��j �7 _STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER .?AU_STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER@@ �7 � : � tagSOUNDSENTRYW .?AUtagSOUNDSENTRYW@@
�7
� R
u cbSize ���
" dwFlags ��
" iFSTextEffect
" iFSTextEffectMSec
" iFSTextEffectColorBits ���
" iFSGrafEffect
" iFSGrafEffectMSec
" iFSGrafEffectColor ���
" iWindowsEffect ���
" $ iWindowsEffectMSec ���
q ( lpszWindowsEffectDLL �
" , iWindowsEffectOrdinal : �7 0 tagSOUNDSENTRYW .?AUtagSOUNDSENTRYW@@ �7 ,4 Z � _WMI_DISKIO_IO_REDIRECTED_INIT .?AU_WMI_DISKIO_IO_REDIRECTED_INIT@@ ��
�7
� &
Irp ��
FileKey ��Z �7 _WMI_DISKIO_IO_REDIRECTED_INIT .?AU_WMI_DISKIO_IO_REDIRECTED_INIT@@ �� �7 � � 6 � tagALTTABINFO .?AUtagALTTABINFO@@ �
" cbSize ���
t cItems ���
t cColumns �
t cRows
t iColFocus
t iRowFocus
t cxItem ���
t cyItem ���
x ptStart ��6 �7 ( tagALTTABINFO .?AUtagALTTABINFO@@ �7 �9
�7 ��
�7
� Z � _WOW64_ARCHITECTURE_INFORMATION .?AU_WOW64_ARCHITECTURE_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
�7 Machine ��
�7 KernelMode ���
�7 UserMode �
�7 Native ���
�7 Process ��
�7 ReservedZero0 Z �7 _WOW64_ARCHITECTURE_INFORMATION .?AU_WOW64_ARCHITECTURE_INFORMATION@@ �7 C r f
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType > �7 _RPC_SECURITY_QOS .?AU_RPC_SECURITY_QOS@@ �7 � n B � _ETW_PRIORITY_EVENT .?AU_ETW_PRIORITY_EVENT@@ v
" ThreadId �
p OldPriority ��
p NewPriority ��
p DynamicPriority ��
p Reserved �B �7 _ETW_PRIORITY_EVENT .?AU_ETW_PRIORITY_EVENT@@ �7 �
b � _SYSTEM_LOW_PRIORITY_IO_INFORMATION .?AU_SYSTEM_LOW_PRIORITY_IO_INFORMATION@@
�7
� n
" LowPriReadOperations �
" LowPriWriteOperations
" KernelBumpedToNormalOperations ���
" LowPriPagingReadOperations ���
" KernelPagingReadsBumpedToNormal ��
" LowPriPagingWriteOperations ��
" KernelPagingWritesBumpedToNormal �
" BoostedIrpCount ��
" BoostedPagingIrpCount
" $ BlanketBoostCount b
�7 ( _SYSTEM_LOW_PRIORITY_IO_INFORMATION .?AU_SYSTEM_LOW_PRIORITY_IO_INFORMATION@@ �7 �
%
� Z � RTLWOW64_CROSSPROCESS_WORK_ITEM .?AURTLWOW64_CROSSPROCESS_WORK_ITEM@@ z
BaseAddress ��
# RegionSize ���
" AllocationType ���
" Protect ��
SyscallStatus : �7 <anonymous-tag> .?AU<anonymous-tag>@@ �7 L � ^
BaseAddress ��
# RegionSize ���
" FreeType �
SyscallStatus : �7 <anonymous-tag> .?AU<anonymous-tag>@@ �7 L � b
BaseAddress ��
# RegionSize ���
" NewProtect ���
SyscallStatus : �7 <anonymous-tag> .?AU<anonymous-tag>@@ �7 L � .
BaseAddress ��
# Length ���: �7 <anonymous-tag> .?AU<anonymous-tag>@@ �7 L � 2
BaseAddress ��
# RegionSize ���: �7 <anonymous-tag> .?AU<anonymous-tag>@@ �7 L � �
" Next �
v Operation
�7 MemoryAllocData ��
�7 MemoryFreeData ���
�7 MemoryProtectData
�7 InstructionCacheFlushData
�7 MemoryDirtyData ��Z �7 ( RTLWOW64_CROSSPROCESS_WORK_ITEM .?AURTLWOW64_CROSSPROCESS_WORK_ITEM@@ �7 L �
N!
� ^ � _MEMORY_ENCLAVE_IMAGE_INFORMATION .?AU_MEMORY_ENCLAVE_IMAGE_INFORMATION@@ N � _MEMORY_IMAGE_INFORMATION .?AU_MEMORY_IMAGE_INFORMATION@@ >
�7 ImageInfo
S UniqueID �
S , AuthorID �^ �7 L _MEMORY_ENCLAVE_IMAGE_INFORMATION .?AU_MEMORY_ENCLAVE_IMAGE_INFORMATION@@ �7 � b � _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_OUTPUT@@ ��R
" Offset ���
" NumberOfMatches ��
" BufferSizeRequired ���b �7 _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_OUTPUT@@ �� �7 � B � _NTFS_STATISTICS_EX .?AU_NTFS_STATISTICS_EX@@ J
" Write
" Create ���
" SetInfo ��
" Flush : 8 <anonymous-tag> .?AU<anonymous-tag>@@ 8 � J
" Write
" Create ���
" SetInfo ��
" Flush : 8 <anonymous-tag> .?AU<anonymous-tag>@@ 8 J
" Write
" Create ���
" SetInfo ��
" Flush : 8 <anonymous-tag> .?AU<anonymous-tag>@@ 8 J
" Write
" Create ���
" SetInfo ��
" Flush : 8 <anonymous-tag> .?AU<anonymous-tag>@@ 8 , �
" Calls
" RunsReturned �
" Hints
" HintsHonored �
" Cache
" CacheMiss
# Clusters �
# HintsClusters
# ( CacheClusters
# 0 CacheMissClusters :
8 8 <anonymous-tag> .?AU<anonymous-tag>@@ 8 A R
" LogFileFullExceptions
" OtherExceptions ��
# MftReads �
# MftReadBytes �
# MftWrites
# MftWriteBytes
8 ( MftWritesUserLevel ���
" 8 MftWritesFlushForLogFileFull �
" < MftWritesLazyWriter ��
" @ MftWritesUserRequest �
# H Mft2Writes ���
# P Mft2WriteBytes ���
8 X Mft2WritesUserLevel ��
" h Mft2WritesFlushForLogFileFull
" l Mft2WritesLazyWriter �
" p Mft2WritesUserRequest
# x RootIndexReads ���
# � RootIndexReadBytes ���
# � RootIndexWrites ��
# � RootIndexWriteBytes ��
# � BitmapReads ��
# � BitmapReadBytes ��
# � BitmapWrites �
# � BitmapWriteBytes �
" � BitmapWritesFlushForLogFileFull ��
" � BitmapWritesLazyWriter ���
" � BitmapWritesUserRequest ��
8 � BitmapWritesUserLevel
# � MftBitmapReads ���
# � MftBitmapReadBytes ���
# � MftBitmapWrites ��
# � MftBitmapWriteBytes ��
" � MftBitmapWritesFlushForLogFileFull ���
" � MftBitmapWritesLazyWriter
" MftBitmapWritesUserRequest ���
8 MftBitmapWritesUserLevel �
# UserIndexReads ���
# UserIndexReadBytes ���
# (UserIndexWrites ��
# 0UserIndexWriteBytes ��
# 8LogFileReads �
# @LogFileReadBytes �
# HLogFileWrites
# PLogFileWriteBytes
8 XAllocate �
" �DiskResourcesExhausted ���
# �VolumeTrimCount ��
# �VolumeTrimTime ���
# �VolumeTrimByteCount ��
# �FileLevelTrimCount ���
# �FileLevelTrimTime
# �FileLevelTrimByteCount ���
# �VolumeTrimSkippedCount ���
# �VolumeTrimSkippedByteCount ���
# �NtfsFillStatInfoFromMftRecordCalledCount �
# �NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount ���
# �NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount ��B 9 8 �_NTFS_STATISTICS_EX .?AU_NTFS_STATISTICS_EX@@ 8 � n � _EVENT_TRACE_SESSION_SECURITY_INFORMATION .?AU_EVENT_TRACE_SESSION_SECURITY_INFORMATION@@ �
� EventTraceInformationClass ���
" SecurityInformation ��
# TraceHandle ��
| SecurityDescriptor ���n 8 _EVENT_TRACE_SESSION_SECURITY_INFORMATION .?AU_EVENT_TRACE_SESSION_SECURITY_INFORMATION@@ 8 � � " 8 > � tagEMRSTRETCHBLT .?AUtagEMRSTRETCHBLT@@ ��R
emr ��
� rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
� 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d cxSrc
h cySrc > 8 l tagEMRSTRETCHBLT .?AUtagEMRSTRETCHBLT@@ �� 8 �
�
� J � _HARDWARE_COUNTER_DATA .?AU_HARDWARE_COUNTER_DATA@@ ��
8
� 6
0 Type �
" Reserved �
# Value J !8 _HARDWARE_COUNTER_DATA .?AU_HARDWARE_COUNTER_DATA@@ �� "8 L + F � _LDR_DATA_TABLE_ENTRY .?AU_LDR_DATA_TABLE_ENTRY@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�!
� B � _LDRP_LOAD_CONTEXT .?AU_LDRP_LOAD_CONTEXT@@ ��
B8
� "
� InLoadOrderLinks �
� InMemoryOrderLinks ���
� InInitializationOrderLinks ���
DllBase ��
EntryPoint ���
" SizeOfImage ��
� $ FullDllName ��
� , BaseDllName ��
� 4 FlagGroup
" 4 Flags
%8 4 PackagedBinary ���
&8 4 MarkedForRemoval �
'8 4 ImageDll �
(8 4 LoadNotificationsSent
)8 4 TelemetryEntryProcessed ��
*8 4 ProcessStaticImport ��
+8 4 InLegacyLists
,8 4 InIndexes
-8 4 ShimDll ��
.8 4 InExceptionTable �
/8 4 ReservedFlags1 ���
08 4 LoadInProgress ���
18 4 LoadConfigProcessed ��
28 4 EntryProcessed ���
38 4 ProtectDelayLoad �
48 4 ReservedFlags3 ���
58 4 DontCallForThreads ���
68 4 ProcessAttachCalled ��
78 4 ProcessAttachFailed ��
88 4 CorDeferredValidate ��
98 4 CorImage �
:8 4 DontRelocate �
;8 4 CorILOnly
<8 4 ChpeImage
=8 4 ReservedFlags5 ���
>8 4 Redirected ���
?8 4 ReservedFlags6 ���
@8 4 CompatDatabaseProcessed ��
! 8 ObsoleteLoadCount
! : TlsIndex �
� < HashLinks
" D TimeDateStamp
� H EntryPointActivationContext ��
L Lock �
A8 P DdagNode �
� T NodeModuleLink ���
C8 \ LoadContext ��
` ParentDllBase
d SwitchBackContext
h h BaseAddressIndexNode �
h t MappingInfoIndexNode �
" � OriginalBase �
} � LoadTime �
" � BaseNameHashValue
+' � LoadReason ���
" � ImplicitPathOptions ��
" � ReferenceCount ���
" � DependentLoadFlags ���
� SigningLevel �F ; D8 � _LDR_DATA_TABLE_ENTRY .?AU_LDR_DATA_TABLE_ENTRY@@ E8 u �
@ x
@ y 2
G8 _POINTFLOAT .?AU_POINTFLOAT@@ H8 P
)
� *
" Remove ���
� Details ��z K8 _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY@@ L8 � R � _SYSTEM_PROCESS_INFORMATION .?AU_SYSTEM_PROCESS_INFORMATION@@ �
" NextEntryOffset ��
" NumberOfThreads ��
} WorkingSetPrivateSize
" HardFaultCount ���
" NumberOfThreadsHighWatermark �
# CycleTime
} CreateTime ���
} ( UserTime �
} 0 KernelTime ���
� 8 ImageName
@ BasePriority �
D UniqueProcessId ��
H InheritedFromUniqueProcessId �
" L HandleCount ��
" P SessionId
" T UniqueProcessKey �
" X PeakVirtualSize ��
" \ VirtualSize ��
" ` PageFaultCount ���
" d PeakWorkingSetSize ���
" h WorkingSetSize ���
" l QuotaPeakPagedPoolUsage ��
" p QuotaPagedPoolUsage ��
" t QuotaPeakNonPagedPoolUsage ���
" x QuotaNonPagedPoolUsage ���
" | PagefileUsage
" � PeakPagefileUsage
" � PrivatePageCount �
} � ReadOperationCount ���
} � WriteOperationCount ��
} � OtherOperationCount ��
} � ReadTransferCount
} � WriteTransferCount ���
} � OtherTransferCount ���R " O8 � _SYSTEM_PROCESS_INFORMATION .?AU_SYSTEM_PROCESS_INFORMATION@@ P8 �
�4
� J � _ETW_HEAP_EVENT_RUNDOWN .?AU_ETW_HEAP_EVENT_RUNDOWN@@
S8
� T " �
� Header ���
HeapHandle ���
" $ Flags
" ( ProcessId
" , RangeCount ���
" 0 Reserved �
U8 4 Ranges ���J V8 < _ETW_HEAP_EVENT_RUNDOWN .?AU_ETW_HEAP_EVENT_RUNDOWN@@ W8 � � j � _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT@@
Y8
�
p ��
p ��
p ��
p ��
��
��
��
��f
Lock �
" ThreadId �
p NewCpuPriorityFloor ��
p OldCpuPriority ���
[8
NewIoPriorityFloor ���
\8
OldIoPriority
]8
NewIoQoSPriorityFloor
^8
OldIoQoSPriority �
p
IoPriorities �
_8 ExecutingDpc �
`8 WakeupBoost ��
a8 BoostedOutstandingIrps ���
b8 Reserved �
Flags j c8 _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT@@ d8 � � >
" dwSizeHid
" dwCount ��
K bRawData �. f8 tagRAWHID .?AUtagRAWHID@@ g8 �: 6 � _WMI_PUSHLOCK .?AU_WMI_PUSHLOCK@@ >
PushLock �
" ThreadId �
Action ���6 j8 _WMI_PUSHLOCK .?AU_WMI_PUSHLOCK@@ k8 � �
>7
� @' " �
n8
� *
I Luid �
" Attributes ���F p8 _LUID_AND_ATTRIBUTES .?AU_LUID_AND_ATTRIBUTES@@ �� q8 � 2
] Configuration
! PortAddress ��N s8 _EISA_PORT_CONFIGURATION .?AU_EISA_PORT_CONFIGURATION@@ �� t8 � V � _SYSTEM_BOOT_LOGO_INFORMATION .?AU_SYSTEM_BOOT_LOGO_INFORMATION@@ *
" Flags
" BitmapOffset �V w8 _SYSTEM_BOOT_LOGO_INFORMATION .?AU_SYSTEM_BOOT_LOGO_INFORMATION@@ x8 u R � _PAGE_PRIORITY_INFORMATION .?AU_PAGE_PRIORITY_INFORMATION@@ ��
" PagePriority �R {8 _PAGE_PRIORITY_INFORMATION .?AU_PAGE_PRIORITY_INFORMATION@@ �� |8 C � : � tagCOMBOBOXINFO .?AUtagCOMBOBOXINFO@@
~8
� �
" cbSize ���
� rcItem ���
� rcButton �
" $ stateButton ��
y ( hwndCombo
y , hwndItem �
y 0 hwndList �: �8 4 tagCOMBOBOXINFO .?AUtagCOMBOBOXINFO@@ �8 M9 O$ R$ f � _EVENT_TRACE_PROFILE_ADD_INFORMATION .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION@@ ��
� EventTraceInformationClass ���
Version ��
P& V2 ���
� CpuInfoHierarchy �
" InitialInterval ��
Persist ��
" ProfileSourceDescription �f �8 $ _EVENT_TRACE_PROFILE_ADD_INFORMATION .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION@@ �� �8 � � R � _ETW_HEAP_EVENT_CONTRACTION .?AU_ETW_HEAP_EVENT_CONTRACTION@@ �
� Header ���
HeapHandle ���
" $ DeCommitSize �
( DeCommitAddress ��
" , FreeSpace
" 0 CommittedSpace ���
" 4 ReservedSpace
" 8 NoOfUCRs �
" < AllocatedSpace ���R �8 @ _ETW_HEAP_EVENT_CONTRACTION .?AU_ETW_HEAP_EVENT_CONTRACTION@@ �8 � �
�
t
�
�
� B � _FLOATING_SAVE_AREA .?AU_FLOATING_SAVE_AREA@@ �
" ContextFlags �
" Dr0 ��
" Dr1 ��
" Dr2 ��
" Dr3 ��
" Dr6 ��
" Dr7 ��
�8 FloatSave
" � SegGs
" � SegFs
" � SegEs
" � SegDs
" � Edi ��
" � Esi ��
" � Ebx ��
" � Edx ��
" � Ecx ��
" � Eax ��
" � Ebp ��
" � Eip ��
" � SegCs
" � EFlags ���
" � Esp ��
" � SegSs
V � ExtendedRegisters . �8 �_CONTEXT .?AU_CONTEXT@@ ��* onecore\internal\sdk\inc\nti386_x.h �8 �8 � 2 � tagACTCTXW .?AUtagACTCTXW@@ ���
" cbSize ���
" dwFlags ��
�% lpSource �
! wProcessorArchitecture ���
! wLangId ��
�% lpAssemblyDirectory ��
�% lpResourceName ���
�% lpApplicationName
6 hModule ��2 �8 tagACTCTXW .?AUtagACTCTXW@@ �� �8 Q .
� MD5Hash ��
� ModuleName ���2 �8 <anonymous-tag> .?AT<anonymous-tag>@@ �8 � 2
�4 RequestType ��
�8 SearchInfo ���N �8 _COVERAGE_MODULE_REQUEST .?AU_COVERAGE_MODULE_REQUEST@@ �� �8 � J � _RPC_SECURITY_QOS_V5_W .?AU_RPC_SECURITY_QOS_V5_W@@ ��
HttpCredentials ��2 �8 <anonymous-tag> .?AT<anonymous-tag>@@ �8 � n �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
�8 u
Sid ��
u EffectiveOnly
ServerSecurityDescriptor �J �8 $ _RPC_SECURITY_QOS_V5_W .?AU_RPC_SECURITY_QOS_V5_W@@ �� �8 � g R � _FILE_MAILSLOT_PEEK_BUFFER .?AU_FILE_MAILSLOT_PEEK_BUFFER@@ ��R
" ReadDataAvailable
" NumberOfMessages �
" MessageLength R �8 _FILE_MAILSLOT_PEEK_BUFFER .?AU_FILE_MAILSLOT_PEEK_BUFFER@@ �� �8 � 1 Z � _PROCESS_MEMORY_EXHAUSTION_INFO .?AU_PROCESS_MEMORY_EXHAUSTION_INFO@@ J
! Version ��
! Reserved �
p' Type �
" Value Z �8 _PROCESS_MEMORY_EXHAUSTION_INFO .?AU_PROCESS_MEMORY_EXHAUSTION_INFO@@ �8 1 � Z � _ETW_TP_EVENT_TIMER_EXPIRATION .?AU_ETW_TP_EVENT_TIMER_EXPIRATION@@ ��
�8
� z
� Header ���
DueTime ��
( SubQueue �
, Timer
" 0 Period ���
" 4 WindowLength �Z �8 8 _ETW_TP_EVENT_TIMER_EXPIRATION .?AU_ETW_TP_EVENT_TIMER_EXPIRATION@@ �� �8 � D F � _IPT_TRACE_EVENT_DATA .?AU_IPT_TRACE_EVENT_DATA@@ �
# TimeStamp
" ProcessId
" ThreadId �
# IptOption
" IptTraceSize �
" IptTraceStopOffset ���
| IptTrace �F �8 ( _IPT_TRACE_EVENT_DATA .?AU_IPT_TRACE_EVENT_DATA@@ �8 � B � _ETW_OPTICALIO_INIT .?AU_ETW_OPTICALIO_INIT@@ .
Irp ��
" IssuingThreadId ��B �8 _ETW_OPTICALIO_INIT .?AU_ETW_OPTICALIO_INIT@@ �8 � �
�
� f � _JOBOBJECT_SECURITY_LIMIT_INFORMATION .?AU_JOBOBJECT_SECURITY_LIMIT_INFORMATION@@
�
� �
" SecurityLimitFlags ���
JobToken �
�8 SidsToDisable
@$ PrivilegesToDelete ���
�8 RestrictedSids ���f �8 _JOBOBJECT_SECURITY_LIMIT_INFORMATION .?AU_JOBOBJECT_SECURITY_LIMIT_INFORMATION@@ �8 C �
+
� N � _PROCESS_JOB_MEMORY_INFO .?AU_PROCESS_JOB_MEMORY_INFO@@ ��
�8
� �
# SharedCommitUsage
# PrivateCommitUsage ���
# PeakPrivateCommitUsage ���
# PrivateCommitLimit ���
# TotalCommitLimit �N �8 ( _PROCESS_JOB_MEMORY_INFO .?AU_PROCESS_JOB_MEMORY_INFO@@ �� �8 C � " �$ 6 � _devicemodeW .?AU_devicemodeW@@ ��
�8
� �
� dmDeviceName �
! @ dmSpecVersion
! B dmDriverVersion ��
! D dmSize ���
! F dmDriverExtra
" H dmFields �
L dmOrientation
N dmPaperSize ��
P dmPaperLength
R dmPaperWidth �
T dmScale ��
V dmCopies �
X dmDefaultSource ��
Z dmPrintQuality ���
I L dmPosition ���
" T dmDisplayOrientation �
" X dmDisplayFixedOutput �
\ dmColor ��
^ dmDuplex �
` dmYResolution
b dmTTOption ���
d dmCollate
� f dmFormName ���
! � dmLogPixels ��
" � dmBitsPerPel �
" � dmPelsWidth ��
" � dmPelsHeight �
" � dmDisplayFlags ���
" � dmNup
" � dmDisplayFrequency ���
" � dmICMMethod ��
" � dmICMIntent ��
" � dmMediaType ��
" � dmDitherType �
" � dmReserved1 ��
" � dmReserved2 ��
" � dmPanningWidth ���
" � dmPanningHeight ��6 & �8 � _devicemodeW .?AU_devicemodeW@@ �� �8 �
t unused ���* �8 HICON__ .?AUHICON__@@ �8 X . � _WMI_TXR .?AU_WMI_TXR@@ ��
�8
� f
InitialTime ��
� TxRGUID ��
" Status ���
" UowCount �
Hive �. �8 ( _WMI_TXR .?AU_WMI_TXR@@ �� �8 � � V � _ENUM_SERVICE_STATUS_PROCESSW .?AU_ENUM_SERVICE_STATUS_PROCESSW@@ R
q lpServiceName
q lpDisplayName
ServiceStatusProcess �V �8 , _ENUM_SERVICE_STATUS_PROCESSW .?AU_ENUM_SERVICE_STATUS_PROCESSW@@ �8 3 Z � _PROCESS_EXTENDED_ENERGY_VALUES .?AU_PROCESS_EXTENDED_ENERGY_VALUES@@ ^ � _PROCESS_ENERGY_VALUES_EXTENSION .?AU_PROCESS_ENERGY_VALUES_EXTENSION@@ ��&
�' Base �
�8 Extension Z �8 �_PROCESS_EXTENDED_ENERGY_VALUES .?AU_PROCESS_EXTENDED_ENERGY_VALUES@@ �8 a i
o
�
�
�
" ��
" �� �$ " � " " �V
# EnabledFeatures ��
# EnabledVolatileFeatures ��
" Size �
" ControlFlags �
�8 OptimizedSave
�8 CompactionEnabled
�8 Features �
# EnabledSupervisorFeatures
# AlignedFeatures ��
" (AllFeatureSize ���
�8 ,AllFeatures ��
# 0EnabledUserVisibleSupervisorFeatures �F �8 8_XSTATE_CONFIGURATION .?AU_XSTATE_CONFIGURATION@@ �8 { d
�%
�
$
� J � _RTL_DEBUG_INFORMATION .?AU_RTL_DEBUG_INFORMATION@@ ��F � _RTL_PROCESS_MODULES .?AU_RTL_PROCESS_MODULES@@ ��
�8
�
.,
� J � _RTL_PROCESS_BACKTRACES .?AU_RTL_PROCESS_BACKTRACES@@
�8
�
$'
�
�4
� V � _RTL_PROCESS_VERIFIER_OPTIONS .?AU_RTL_PROCESS_VERIFIER_OPTIONS@@
�8
� " �b
SectionHandleClient ��
ViewBaseClient ���
ViewBaseTarget ���
" ViewBaseDelta
EventPairClient ��
EventPairTarget ��
TargetProcessId ��
TargetThreadHandle ���
" Flags
" $ OffsetFree ���
" ( CommitSize ���
" , ViewSize �
�8 0 Modules ��
�8 0 ModulesEx
�8 4 BackTraces ���
�8 8 Heaps
�8 < Locks
@ SpecificHeap �
D TargetProcessHandle ��
�8 H VerifierOptions ��
L ProcessHeap ��
P CriticalSectionHandle
T CriticalSectionOwnerThread ���
�8 X Reserved �J �8 h _RTL_DEBUG_INFORMATION .?AU_RTL_DEBUG_INFORMATION@@ �� �8 L � J � _RTL_HEAP_STACK_CONTROL .?AU_RTL_HEAP_STACK_CONTROL@@ :
! Version ��
! Flags
Process ��J �8 _RTL_HEAP_STACK_CONTROL .?AU_RTL_HEAP_STACK_CONTROL@@ �8 L � N � _FILE_CASE_SENSITIVE_INFO .?AU_FILE_CASE_SENSITIVE_INFO@@
�8
�
" Flags N �8 _FILE_CASE_SENSITIVE_INFO .?AU_FILE_CASE_SENSITIVE_INFO@@ �8 �" � KTMOBJECT_TRANSACTION KTMOBJECT_TRANSACTION_MANAGER KTMOBJECT_RESOURCE_MANAGER ��� KTMOBJECT_ENLISTMENT � KTMOBJECT_INVALID 6 t �8 _KTMOBJECT_TYPE .?AW4_KTMOBJECT_TYPE@@ � 9 � w J � _CM_FLOPPY_DEVICE_DATA .?AU_CM_FLOPPY_DEVICE_DATA@@ ��
9
� �
! Version ��
! Revision �
N6 Size �
" MaxDensity ���
" MountDensity �
StepRateHeadUnloadTime ���
HeadLoadTime �
MotorOffTime �
SectorLengthCode �
SectorPerTrack ���
ReadWriteGapLength ���
DataTransferLength ���
FormatGapLength ��
FormatFillCharacter ��
HeadSettleTime ���
MotorSettleTime ��
MaximumTrackValue
DataTransferRate �J 9 $ _CM_FLOPPY_DEVICE_DATA .?AU_CM_FLOPPY_DEVICE_DATA@@ �� 9 �
�*
� R � _PERFINFO_SYSCALL_EXIT_DATA .?AU_PERFINFO_SYSCALL_EXIT_DATA@@
9
�
ReturnValue ��R
9 _PERFINFO_SYSCALL_EXIT_DATA .?AU_PERFINFO_SYSCALL_EXIT_DATA@@ 9 � * F � _LPC_CLIENT_DIED_MSG .?AU_LPC_CLIENT_DIED_MSG@@ ��
9
� .
� PortMsg ��
} CreateTime ���F 9 _LPC_CLIENT_DIED_MSG .?AU_LPC_CLIENT_DIED_MSG@@ �� 9 � � F � _ENCRYPTED_DATA_INFO .?AU_ENCRYPTED_DATA_INFO@@ ��B
# StartingFileOffset ���
" OutputBufferOffset ���
" BytesWithinFileSize ��
" BytesWithinValidDataLength ���
! CompressionFormat
DataUnitShift
ChunkShift ���
ClusterShift �
EncryptionFormat �
! NumberOfDataBlocks ���
� DataBlockSize F 9 _ENCRYPTED_DATA_INFO .?AU_ENCRYPTED_DATA_INFO@@ �� 9 @ F � _IMAGE_HOT_PATCH_BASE .?AU_IMAGE_HOT_PATCH_BASE@@
9
� �
" SequenceNumber ���
" Flags
" OriginalTimeDateStamp
" OriginalCheckSum �
" CodeIntegrityInfo
" CodeIntegritySize
" PatchTable ���
" BufferOffset �F 9 _IMAGE_HOT_PATCH_BASE .?AU_IMAGE_HOT_PATCH_BASE@@ 9 [ �
�5
�
%
� &
# Version ��
� Name �f 9 _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE@@ �� 9 ] R � _ENABLE_TRACE_PARAMETERS_V1 .?AU_ENABLE_TRACE_PARAMETERS_V1@@
9
� z
" Version ��
" EnableProperty ���
" ControlFlags �
� SourceId �
v EnableFilterDesc �R "9 _ENABLE_TRACE_PARAMETERS_V1 .?AU_ENABLE_TRACE_PARAMETERS_V1@@ #9 � J � _NDR_USER_MARSHAL_INFO .?AU_NDR_USER_MARSHAL_INFO@@ ��V � _NDR_USER_MARSHAL_INFO_LEVEL1 .?AU_NDR_USER_MARSHAL_INFO_LEVEL1@@ 2
" InformationLevel �
&9 Level1 ���J '9 , _NDR_USER_MARSHAL_INFO .?AU_NDR_USER_MARSHAL_INFO@@ �� (9 �
�)
� *
�# ntmTm
. L ntmFontSig ���B +9 d tagNEWTEXTMETRICEXW .?AUtagNEWTEXTMETRICEXW@@ ,9 %
g
� �
bmType ���
bmWidth ��
bmHeight �
bmWidthBytes �
! bmPlanes �
! bmBitsPixel ��
bmBits ���. /9 tagBITMAP .?AUtagBITMAP@@ 09 Y
�2
� 6 � _VIDEO_RECORD .?AU_VIDEO_RECORD@@
39
� �
" MemorySize ���
" XResolution ��
" YResolution ��
" BitsPerPixel �
" VRefresh �
� ChipType �
� DACType ��
� AdapterString
� BiosString ���
� DeviceId �
"
StateFlags ���6 59
_VIDEO_RECORD .?AU_VIDEO_RECORD@@ 69 � \ n DDC_DEFAULT �� DDC_DISABLE_ALL �� DDC_DISABLE_RESIZE ��� DDC_DISABLE_CONTROL_RELAYOUT �N t 89 DIALOG_DPI_CHANGE_BEHAVIORS .?AW4DIALOG_DPI_CHANGE_BEHAVIORS@@ � 99 � ^ � DISPLAYCONFIG_SOURCE_DEVICE_NAME .?AUDISPLAYCONFIG_SOURCE_DEVICE_NAME@@ ��2
y header ���
� viewGdiDeviceName ^ <9 T DISPLAYCONFIG_SOURCE_DEVICE_NAME .?AUDISPLAYCONFIG_SOURCE_DEVICE_NAME@@ �� =9 � V � _SYSTEM_TIMEOFDAY_INFORMATION .?AU_SYSTEM_TIMEOFDAY_INFORMATION@@ �
} BootTime �
} CurrentTime ��
} TimeZoneBias �
" TimeZoneId ���
" Reserved �
# BootTimeBias �
# ( SleepTimeBias V @9 0 _SYSTEM_TIMEOFDAY_INFORMATION .?AU_SYSTEM_TIMEOFDAY_INFORMATION@@ A9 � B � tagTRACKMOUSEEVENT .?AUtagTRACKMOUSEEVENT@@ ��
C9
� V
" cbSize ���
" dwFlags ��
y hwndTrack
" dwHoverTime ��B E9 tagTRACKMOUSEEVENT .?AUtagTRACKMOUSEEVENT@@ �� F9 �
�3
�
e7
� J � _ETW_WNF_EVENT_CALLBACK .?AU_ETW_WNF_EVENT_CALLBACK@@ �
� Header ���
} StateName
( Subscription �
, NameSub ��
0 Callback �
" 4 ChangeStamp ��
" 8 DeliveryFlags
" < Return ���J K9 @ _ETW_WNF_EVENT_CALLBACK .?AU_ETW_WNF_EVENT_CALLBACK@@ L9 � n
k4
�
(3
� V � _ETW_DISKIO_FLUSH_BUFFERS_V3 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V3@@ ��~
" DiskNumber ���
" IrpFlags �
# HighResResponseTime ��
IrpAddr ��
" IssuingThreadId ��V Q9 _ETW_DISKIO_FLUSH_BUFFERS_V3 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V3@@ �� R9 � � B � tagVS_FIXEDFILEINFO .?AUtagVS_FIXEDFILEINFO@@ V
" dwSignature ��
" dwStrucVersion ���
" dwFileVersionMS ��
" dwFileVersionLS ��
" dwProductVersionMS ���
" dwProductVersionLS ���
" dwFileFlagsMask ��
" dwFileFlags ��
" dwFileOS �
" $ dwFileType ���
" ( dwFileSubtype
" , dwFileDateMS �
" 0 dwFileDateLS �B
U9 4 tagVS_FIXEDFILEINFO .?AUtagVS_FIXEDFILEINFO@@ 2 onecore\external\sdk\inc\minwin\verrsrc.h �� V9 W9 � J � _FILE_NAME_INFORMATION .?AU_FILE_NAME_INFORMATION@@ ��2
" FileNameLength ���
FileName �J Z9 _FILE_NAME_INFORMATION .?AU_FILE_NAME_INFORMATION@@ �� [9
�*
� r � _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION .?AU_MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION@@
^9
�
" ��
" ��>
`9 CommitEvents �
a9 Spare
" AllFlags �2 b9 <anonymous-tag> .?AT<anonymous-tag>@@ c9 � �
c9 Flags
" HandleAttributes �
" DesiredAccess
LowCommitCondition ���
HighCommitCondition ��
MaximumCommitCondition ���r e9 _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION .?AU_MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION@@ f9 �
,*
� < q ! i9
�! ��
k9
� F � _TRACE_LOGFILE_HEADER .?AU_TRACE_LOGFILE_HEADER@@ f
MajorVersion �
MinorVersion �
SubVersion ���
SubMinorVersion ��: n9 <anonymous-tag> .?AU<anonymous-tag>@@ o9 � � .
" BufferSize ���
" Version ��
o9 VersionDetail
" ProviderVersion ��
" NumberOfProcessors ���
} EndTime ��
" TimerResolution ��
" MaximumFileSize ��
" LogFileMode ��
" $ BuffersWritten ���
� ( LogInstanceGuid ��
" ( StartBuffers �
" , PointerSize ��
" 0 EventsLost ���
" 4 CpuSpeedInMHz
q 8 LoggerName ���
q < LogFileName ��
@ TimeZone �
} � BootTime �
} � PerfFreq �
} StartTime
" ReservedFlags
" BuffersLost ��F q9 _TRACE_LOGFILE_HEADER .?AU_TRACE_LOGFILE_HEADER@@ r9 � �
�-
�
C
� " u9 v9
w9
� �
StateType
" StateFlags ���
" HardwareLatency ��
" Power
" Context ��
x9 Handler ��F y9 _PROCESSOR_IDLE_STATE .?AU_PROCESSOR_IDLE_STATE@@ z9 x
�#
� J � DISPLAYCONFIG_PATH_INFO .?AUDISPLAYCONFIG_PATH_INFO@@ B
�5 sourceInfo ���
�2 targetInfo ���
u D flags J ~9 H DISPLAYCONFIG_PATH_INFO .?AUDISPLAYCONFIG_PATH_INFO@@ 9 � ~ � _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION .?AU_SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION@@ ��>
" PlatformManifestSize �
| PlatformManifest �~ �9 _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION .?AU_SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION@@ �� �9 � �
�9
� F � _PERFINFO_FILE_CREATE .?AU_PERFINFO_FILE_CREATE@@ �
" Irp ��
" FileObject ���
" IssuingThreadId ��
" Options ��
" Attributes ���
" ShareAccess ��
OpenPath �F �9 _PERFINFO_FILE_CREATE .?AU_PERFINFO_FILE_CREATE@@ �9 � V J � _WMI_IDE_CHANNEL_RECORD .?AU_WMI_IDE_CHANNEL_RECORD@@ �
" TargetId �
" DeviceType ���
" DeviceTimingMode �
" LocationInformationLen ���
LocationInformation ��J �9 _WMI_IDE_CHANNEL_RECORD .?AU_WMI_IDE_CHANNEL_RECORD@@ �9 � � J � RPC_CLIENT_INFORMATION1 .?AURPC_CLIENT_INFORMATION1@@
�9
� V
UserName �
ComputerName �
! Privilege
" AuthFlags J �9 RPC_CLIENT_INFORMATION1 .?AURPC_CLIENT_INFORMATION1@@ �9 � D
V MemoryExhaustionTypeFailFastOnCommitFailure �� MemoryExhaustionTypeMax ��F t �9 _MEMORY_EXHAUSTION_TYPE .?AW4_MEMORY_EXHAUSTION_TYPE@@ � �9 C �
�
�5
� F � _IMAGE_ENCLAVE_IMPORT .?AU_IMAGE_ENCLAVE_IMPORT@@ �
" MatchType
" MinimumSecurityVersion ���
S UniqueOrAuthorID �
� ( FamilyID �
� 8 ImageID ��
" H ImportName ���
" L Reserved �F �9 P _IMAGE_ENCLAVE_IMPORT .?AU_IMAGE_ENCLAVE_IMPORT@@ �9 [ �
�
�
�3
�
�/
�
��
��
��
��
��
��
��
�9 ReadWrite
�9 Cached ���
�9 Reserved0
�9 Type �
�9 Shared ���
�9 Reserved1
�9 MoreEntries ��> �9 _EISA_MEMORY_TYPE .?AU_EISA_MEMORY_TYPE@@ �9 � � 2 � _MOF_FIELD .?AU_MOF_FIELD@@ ��
�9
� >
# DataPtr ��
" Length ���
" DataType �2 �9 _MOF_FIELD .?AU_MOF_FIELD@@ �� �9 � � ~ � _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION@@ �
" ulFlags ��
" ulEncodedAssemblyIdentityLength ��
" ulManifestPathType ���
" ulManifestPathLength �
} liManifestLastWriteTime ��
" ulPolicyPathType �
" ulPolicyPathLength ���
} liPolicyLastWriteTime
" ( ulMetadataSatelliteRosterIndex ���
" , ulManifestVersionMajor ���
" 0 ulManifestVersionMinor ���
" 4 ulPolicyVersionMajor �
" 8 ulPolicyVersionMinor �
" < ulAssemblyDirectoryNameLength
P @ lpAssemblyEncodedAssemblyIdentity
P D lpAssemblyManifestPath ���
P H lpAssemblyPolicyPath �
P L lpAssemblyDirectoryName ��
" P ulFileCount ��~ �9 X _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION@@ �9 L �
�#
� -
�9
� Z � _PERFINFO_PPM_IDLE_STATE_CHANGE .?AU_PERFINFO_PPM_IDLE_STATE_CHANGE@@ B
" NewState �
" OldState �
# Processors ���Z �9 _PERFINFO_PPM_IDLE_STATE_CHANGE .?AU_PERFINFO_PPM_IDLE_STATE_CHANGE@@ �9 � � b � _SYSTEM_VSM_PROTECTION_INFORMATION .?AU_SYSTEM_VSM_PROTECTION_INFORMATION@@ ��
DmaProtectionsAvailable ��
DmaProtectionsInUse ��
HardwareMbecAvailable
ApicVirtualizationAvailable ��b �9 _SYSTEM_VSM_PROTECTION_INFORMATION .?AU_SYSTEM_VSM_PROTECTION_INFORMATION@@ �� �9 G B � _TRACE_VERSION_INFO .?AU_TRACE_VERSION_INFO@@ :
u EtwTraceProcessingVersion
u Reserved �B �9 _TRACE_VERSION_INFO .?AU_TRACE_VERSION_INFO@@ �9 � � 2 � _MULTI_TIME .?AU_MULTI_TIME@@ >
} Qpc ��
} HostQpc ��
SystemTime ���2 �9 _MULTI_TIME .?AU_MULTI_TIME@@ �9 � �
� > � tagCANDIDATELIST .?AUtagCANDIDATELIST@@ ��
�9
� �
" dwSize ���
" dwStyle ��
" dwCount ��
" dwSelection ��
" dwPageStart ��
" dwPageSize ���
� dwOffset �> �9 tagCANDIDATELIST .?AUtagCANDIDATELIST@@ �� �9 E K " q q " t �9
�9
�
-
� R � _SYSTEM_POOLTAG_INFORMATION .?AU_SYSTEM_POOLTAG_INFORMATION@@ &
" Count
�5 TagInfo ��R �9 _SYSTEM_POOLTAG_INFORMATION .?AU_SYSTEM_POOLTAG_INFORMATION@@ �9 �
l
�
�,
� > � RPC_IF_ID_VECTOR .?AURPC_IF_ID_VECTOR@@ ��2 � _RPC_IF_ID .?AU_RPC_IF_ID@@ ��
�9
� �9 " �"
" Count
�9 IfId �> �9 RPC_IF_ID_VECTOR .?AURPC_IF_ID_VECTOR@@ �� �9 � F � tagCHANGEFILTERSTRUCT .?AUtagCHANGEFILTERSTRUCT@@
�9
� *
" cbSize ���
" ExtStatus F �9 tagCHANGEFILTERSTRUCT .?AUtagCHANGEFILTERSTRUCT@@ �9 [< J � _CM_SERIAL_DEVICE_DATA .?AU_CM_SERIAL_DEVICE_DATA@@ ��
�9
� >
! Version ��
! Revision �
" BaudClock J �9 _CM_SERIAL_DEVICE_DATA .?AU_CM_SERIAL_DEVICE_DATA@@ �� �9 � �
z
� R
BaseMid ��
Flags1 ���
Flags2 ���
BaseHi ���: �9 <anonymous-tag> .?AU<anonymous-tag>@@ �9 �8 Y
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
�9 BaseMid ��
�9 Type �
�9 Dpl ��
�9 Pres �
�9 LimitHi ��
�9 Sys ��
�9 Reserved_0 ���
�9 Default_Big ��
�9 Granularity ��
�9 BaseHi ���:
�9 <anonymous-tag> .?AU<anonymous-tag>@@ �9 �8 _ "
�9 Bytes
�9 Bits �2 �9 <anonymous-tag> .?AT<anonymous-tag>@@ �9 �8 X >
! LimitLow �
! BaseLow ��
�9 HighWord �2 �9 _LDT_ENTRY .?AU_LDT_ENTRY@@ �� �9 �8 U R � _FSCTL_OFFLOAD_READ_OUTPUT .?AU_FSCTL_OFFLOAD_READ_OUTPUT@@ ��N
" Size �
" Flags
# TransferLength ���
V Token R �9 _FSCTL_OFFLOAD_READ_OUTPUT .?AU_FSCTL_OFFLOAD_READ_OUTPUT@@ �� : � R � _CONSOLE_SCREEN_BUFFER_INFO .?AU_CONSOLE_SCREEN_BUFFER_INFO@@ 2 � _SMALL_RECT .?AU_SMALL_RECT@@ ~
'" dwSize ���
'" dwCursorPosition �
! wAttributes ��
:
srWindow �
'" dwMaximumWindowSize ��R : _CONSOLE_SCREEN_BUFFER_INFO .?AU_CONSOLE_SCREEN_BUFFER_INFO@@ 6 onecore\external\sdk\inc\mincore\consoleapi2.h � : : � 2 � _SYSDBG_MSR .?AU_SYSDBG_MSR@@ "
" Msr ��
# Data �2 : _SYSDBG_MSR .?AU_SYSDBG_MSR@@
: J � _FILE_PIPE_EVENT_BUFFER .?AU_FILE_PIPE_EVENT_BUFFER@@ v
" NamedPipeState ���
" EntryType
" ByteCount
" KeyValue �
" NumberRequests ���J
: _FILE_PIPE_EVENT_BUFFER .?AU_FILE_PIPE_EVENT_BUFFER@@ : ) N � _PERFINFO_PROCESS_PERFCTR .?AU_PERFINFO_PROCESS_PERFCTR@@
:
� �
" ProcessId
" PageFaultCount ���
" HandleCount ��
" Reserved �
" PeakVirtualSize ��
" PeakWorkingSetSize ���
" PeakPagefileUsage
" QuotaPeakPagedPoolUsage ��
" QuotaPeakNonPagedPoolUsage ���
" $ VirtualSize ��
" ( WorkingSetSize ���
" , PagefileUsage
" 0 QuotaPagedPoolUsage ��
" 4 QuotaNonPagedPoolUsage ���
" 8 PrivatePageCount �N : < _PERFINFO_PROCESS_PERFCTR .?AU_PERFINFO_PROCESS_PERFCTR@@ : � �
6.
� r � _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT@@
:
� *
� EnlistmentId �
� UOW ��r : _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT@@ : J �
�
�
I
� R � _PERFINFO_SET_POWER_ACTION .?AU_PERFINFO_SET_POWER_ACTION@@ ��F
Trigger ��
" PowerAction ��
" LightestState R : _PERFINFO_SET_POWER_ACTION .?AU_PERFINFO_SET_POWER_ACTION@@ �� : � ? Z � _EVENT_EXTENDED_ITEM_PEBS_INDEX .?AU_EVENT_EXTENDED_ITEM_PEBS_INDEX@@
!:
�
# PebsIndex Z #: _EVENT_EXTENDED_ITEM_PEBS_INDEX .?AU_EVENT_EXTENDED_ITEM_PEBS_INDEX@@ $: � r � ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS � ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION � ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MAXVERSIONTESTED ���Z t &: ACTCTX_COMPATIBILITY_ELEMENT_TYPE .?AW4ACTCTX_COMPATIBILITY_ELEMENT_TYPE@@ � ': L � F � _FILE_ID_INFORMATION .?AU_FILE_ID_INFORMATION@@ ��6
# VolumeSerialNumber ���
� FileId ���F *: _FILE_ID_INFORMATION .?AU_FILE_ID_INFORMATION@@ �� +: � �
� Value N .: _SID_IDENTIFIER_AUTHORITY .?AU_SID_IDENTIFIER_AUTHORITY@@ /: V � _WORKER_FACTORY_DEFERRED_WORK .?AU_WORKER_FACTORY_DEFERRED_WORK@@
�
� n
2: AlpcSendMessage ��
AlpcSendMessagePort ��
" AlpcSendMessageFlags �
" Flags V 3: _WORKER_FACTORY_DEFERRED_WORK .?AU_WORKER_FACTORY_DEFERRED_WORK@@ 4: � �
a
�
�0
� I ^ � _HEAP_BLOCK_SETTABLE_INFORMATION .?AU_HEAP_BLOCK_SETTABLE_INFORMATION@@ ��
9:
� N
" Settable �
! TagIndex �
! AllocatorBackTraceIndex ��^ ;: _HEAP_BLOCK_SETTABLE_INFORMATION .?AU_HEAP_BLOCK_SETTABLE_INFORMATION@@ �� <: L j � _MEMORY_PARTITION_PAGEFILE_INFORMATION .?AU_MEMORY_PARTITION_PAGEFILE_INFORMATION@@ ��
>:
� Z
� PageFileName �
} MinimumSize ��
} MaximumSize ��
" Flags j @: _MEMORY_PARTITION_PAGEFILE_INFORMATION .?AU_MEMORY_PARTITION_PAGEFILE_INFORMATION@@ �� A: � R � PROCESSOR_IDLESTATE_POLICY .?AUPROCESSOR_IDLESTATE_POLICY@@ ��
! ��
! ��
! ��V
! AsUSHORT �
D: AllowScaling �
E: Disabled �
F: Reserved �2 G: <anonymous-tag> .?AT<anonymous-tag>@@ H: < ] " �R
! Revision �
H: Flags
" PolicyCount ��
J: Policy ���R K: PROCESSOR_IDLESTATE_POLICY .?AUPROCESSOR_IDLESTATE_POLICY@@ �� L: : Z � _FILE_NETWORK_OPEN_INFORMATION .?AU_FILE_NETWORK_OPEN_INFORMATION@@ ��
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} AllocationSize ���
} ( EndOfFile
" 0 FileAttributes ���Z O: 8 _FILE_NETWORK_OPEN_INFORMATION .?AU_FILE_NETWORK_OPEN_INFORMATION@@ �� P: 0 v RtlMitigationOptionStateNotConfigured RtlMitigationOptionStateOn ��� RtlMitigationOptionStateOff ��^ t R: _RTL_IMAGE_MITIGATION_OPTION_STATE .?AW4_RTL_IMAGE_MITIGATION_OPTION_STATE@@ ��� S: � � B � _WMIGUIDINFORMATION .?AU_WMIGUIDINFORMATION@@
U:
� B
" Size �
IsExpensive ��
IsEventOnly ��B W: _WMIGUIDINFORMATION .?AU_WMIGUIDINFORMATION@@ X: �2 �
=
� b � _REMOTE_LINK_TRACKING_INFORMATION_ .?AU_REMOTE_LINK_TRACKING_INFORMATION_@@ ��
[:
� ~
TargetFileObject �
" TargetLinkTrackingInformationLength ��
| TargetLinkTrackingInformationBuffer ��b ]: _REMOTE_LINK_TRACKING_INFORMATION_ .?AU_REMOTE_LINK_TRACKING_INFORMATION_@@ �� ^: �) J � _ALPC_BASIC_INFORMATION .?AU_ALPC_BASIC_INFORMATION@@
`:
� B
" Flags
" SequenceNo ���
PortContext ��J b: _ALPC_BASIC_INFORMATION .?AU_ALPC_BASIC_INFORMATION@@ c: � �
�
� V � _IMAGE_SEPARATE_DEBUG_HEADER .?AU_IMAGE_SEPARATE_DEBUG_HEADER@@ ��
f:
� 6
! Signature
! Flags
! Machine ��
! Characteristics ��
" TimeDateStamp
" CheckSum �
" ImageBase
" SizeOfImage ��
" NumberOfSections �
" ExportedNamesSize
" DebugDirectorySize ���
" $ SectionAlignment �
� ( Reserved �V
h: 0 _IMAGE_SEPARATE_DEBUG_HEADER .?AU_IMAGE_SEPARATE_DEBUG_HEADER@@ �� i: [ $
�,
� . � _CSTRING .?AU_CSTRING@@ ��B
! Length ���
! MaximumLength
Buffer ���. m: _CSTRING .?AU_CSTRING@@ �� n: ^ � _MEMORY_SHARED_COMMIT_INFORMATION .?AU_MEMORY_SHARED_COMMIT_INFORMATION@@
" CommitSize ���^ q: _MEMORY_SHARED_COMMIT_INFORMATION .?AU_MEMORY_SHARED_COMMIT_INFORMATION@@ r: � �
" dwServiceType
" dwCurrentState ���
" dwControlsAccepted ���
" dwWin32ExitCode ��
" dwServiceSpecificExitCode
" dwCheckPoint �
" dwWaitHint ���: t: _SERVICE_STATUS .?AU_SERVICE_STATUS@@ u: 3 � F � _OBJECT_ATTRIBUTES64 .?AU_OBJECT_ATTRIBUTES64@@ ��
w: ��
x:
� �
" Length ���
# RootDirectory
# ObjectName ���
" Attributes ���
# SecurityDescriptor ���
# ( SecurityQualityOfService �F z: 0 _OBJECT_ATTRIBUTES64 .?AU_OBJECT_ATTRIBUTES64@@ �� {:
[
�
3
�
{
� N
� PolicyPublisher ��
" PolicyVersion
" PolicyOptions f �: _SYSTEM_SECUREBOOT_POLICY_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_INFORMATION@@ �:
�8
� � " �2
" NumberOfModules ��
�: Modules ��F �: _RTL_PROCESS_MODULES .?AU_RTL_PROCESS_MODULES@@ �� �: u � f � _SYSTEM_NET_RATE_CONTROL_SET_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_SET_CONTEXT@@ ��
" ��
" ��
" ��
" ��
" ��
" ���
& Header ���
# MaxBandwidth �
� ContainerId ��
" Flags
�: Set ��
�: Update ���
�: Clear
�: DscpTagEnabled ���
�: MaxBandwidthEnabled ��
�: Reserved �
DscpTag ��f �: _SYSTEM_NET_RATE_CONTROL_SET_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_SET_CONTEXT@@ �� �: { �
�
� " " �J
! Count
! Size �
" Reserved �
�: Bitmap ���6 �: _KAFFINITY_EX .?AU_KAFFINITY_EX@@ �: � T
$
� z � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST@@ ��
�:
� # " �"
�: PreviousChangeStamps �z �: _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST@@ �� �: � b � _ETW_TRACE_PARTITION_INFORMATION_V2 .?AU_ETW_TRACE_PARTITION_INFORMATION_V2@@ b
QpcOffsetFromRoot
" PartitionType
q PartitionId ��
q ParentId �b �: _ETW_TRACE_PARTITION_INFORMATION_V2 .?AU_ETW_TRACE_PARTITION_INFORMATION_V2@@ �: � �
q
� N � _PERFINFO_FILE_READ_WRITE .?AU_PERFINFO_FILE_READ_WRITE@@
�:
� �
# Offset ���
" Irp ��
" FileObject ���
" FileKey ��
" IssuingThreadId ��
" Size �
" Flags
" ExtraFlags ���N �: $ _PERFINFO_FILE_READ_WRITE .?AU_PERFINFO_FILE_READ_WRITE@@ �: � � t �
�:
� B � _FILE_STORAGE_INFO .?AU_FILE_STORAGE_INFO@@ ��&
" LogicalBytesPerSector
" PhysicalBytesPerSectorForAtomicity ���
" PhysicalBytesPerSectorForPerformance �
" FileSystemEffectivePhysicalBytesPerSectorForAtomicity
" Flags
" ByteOffsetForSectorAlignment �
" ByteOffsetForPartitionAlignment ��B �: _FILE_STORAGE_INFO .?AU_FILE_STORAGE_INFO@@ �� �: # j � _FILE_DESIRED_STORAGE_CLASS_INFORMATION .?AU_FILE_DESIRED_STORAGE_CLASS_INFORMATION@@ "
5 Class
" Flags j �: _FILE_DESIRED_STORAGE_CLASS_INFORMATION .?AU_FILE_DESIRED_STORAGE_CLASS_INFORMATION@@ �: 2
J+
� 2
� Id ���
" CurrentAllocatedBytes : �: _RTLP_TAG_INFO .?AU_RTLP_TAG_INFO@@ �� �: L � n � _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE@@ �� D4 " �r � _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY@@ �� �: " �b
" ResponseLevel
" NumberEntries
�: Lev1Depends ��
�: Lev2Depends ��n �: L _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE@@ �� �: b
-( ��
�:
� F � _RTL_RELATIVE_NAME_U .?AU_RTL_RELATIVE_NAME_U@@ ��
�
� N
� RelativeName �
ContainingDirectory ��
�: CurDirRef F �: _RTL_RELATIVE_NAME_U .?AU_RTL_RELATIVE_NAME_U@@ �� �: L a
�(
� f � _EVENT_TRACE_PERFORMANCE_INFORMATION .?AU_EVENT_TRACE_PERFORMANCE_INFORMATION@@ ��
�:
� J
� EventTraceInformationClass ���
} LogfileBytesWritten ��f �: _EVENT_TRACE_PERFORMANCE_INFORMATION .?AU_EVENT_TRACE_PERFORMANCE_INFORMATION@@ �� �: � � J � _HEAP_BLOCK_INFORMATION .?AU_HEAP_BLOCK_INFORMATION@@ �
" Level
" Size �
�" ProcessHeapInformation ���
4 HeapInformation ��
� HeapRegionInformation
�$ HeapRangeInformation �
�: HeapBlockInformation �
'6 HeapPerfInformation ��
" DynamicStart �J �: d _HEAP_INFORMATION_ITEM .?AU_HEAP_INFORMATION_ITEM@@ �� �: L =
f
� J � _EVENT_INSTANCE_HEADER .?AU_EVENT_INSTANCE_HEADER@@ ��
�:
� 6
Type �
Level
! Version ��: �: <anonymous-tag> .?AU<anonymous-tag>@@ �: � S �
! Size �
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��
" Version ��
�: Class
" ThreadId �
" ProcessId
} TimeStamp
# RegHandle
" InstanceId ���
" $ ParentInstanceId �
" ( KernelTime ���
" , UserTime �
# ( ProcessorTime
" ( EventId ��
" , Flags
# 0 ParentRegHandle ��J �: 8 _EVENT_INSTANCE_HEADER .?AU_EVENT_INSTANCE_HEADER@@ �� �: � H
�
�
� Z � _CM_PNP_BIOS_INSTALLATION_CHECK .?AU_CM_PNP_BIOS_INSTALLATION_CHECK@@ v
� Signature
Revision �
Length ���
! ControlField �
Checksum �
" EventFlagAddress �
!
RealModeEntryOffset ��
! RealModeEntrySegment �
! ProtectedModeEntryOffset �
" ProtectedModeCodeBaseAddress �
" OemDeviceId ��
! RealModeDataBaseAddress ��
" ProtectedModeDataBaseAddress �Z
�: ! _CM_PNP_BIOS_INSTALLATION_CHECK .?AU_CM_PNP_BIOS_INSTALLATION_CHECK@@ �: � i
�
� " " �:
�:
� J � _FILE_LAYOUT_NAME_ENTRY .?AU_FILE_LAYOUT_NAME_ENTRY@@ �
" NextNameOffset ���
" Flags
# ParentFileReferenceNumber
" FileNameLength ���
" Reserved �
FileName �J �: _FILE_LAYOUT_NAME_ENTRY .?AU_FILE_LAYOUT_NAME_ENTRY@@ �: � : � tagEMRCREATEPEN .?AUtagEMRCREATEPEN@@
�:
� 2
emr ��
" ihPen
!, lopn �: �: tagEMRCREATEPEN .?AUtagEMRCREATEPEN@@ �: N
�
� R � _SYSDBG_KD_PULL_REMOTE_FILE .?AU_SYSDBG_KD_PULL_REMOTE_FILE@@
� ImageFileName R �: _SYSDBG_KD_PULL_REMOTE_FILE .?AU_SYSDBG_KD_PULL_REMOTE_FILE@@ �: � Z SeLearningModeInvalidType SeLearningModeSettings ��� SeLearningModeMax N t �: _SE_LEARNING_MODE_DATA_TYPE .?AW4_SE_LEARNING_MODE_DATA_TYPE@@ � �: 3
t!
�
3
� ~ PowerUserPresent � PowerUserNotPresent �� PowerUserInactive PowerUserMaximum � PowerUserInvalid �F t �: _USER_ACTIVITY_PRESENCE .?AW4_USER_ACTIVITY_PRESENCE@@ � �: �
T)
� ^ � _ETW_COVERAGE_SAMPLER_PERF_STATS .?AU_ETW_COVERAGE_SAMPLER_PERF_STATS@@ ��*
# RunTime ��
SampleProfile
SampleCSwitch
SampleRThread
SamplePGFault
CaptureSampleProfile �
CaptureSampleCSwitch �
CaptureSampleRThread �
$ CaptureSamplePGFault �
( CoverageSamplerCreated ���
, CoverageSamplerDeleted ���
0 CoverageSamplerStarted ���
4 CoverageSamplerPaused
8 CoverageSamplerResumed ���
< CoverageSamplerStopped ���
@ CoverageSamplerQueried ���
D CoverageSamplerQueryFailNotActive
H SamplesAdded �
L SamplesFound �
P SamplesDropped ���
T SamplesMappedUM ��
X SamplesMappedKM ��
\ SamplesTryMapUM ��
` SamplesTryMapKM ��
d SamplesAddedAlreadyMapped
h ModulesTrackedUM �
l ModulesMappedUM ��
p ModulesUnmappedUM
t ModulesTrackedKM �
x ModulesMappedKM ��
| ModulesUnmappedKM
� ModulesCleared ���
� ModulesPruned
� ModulesPrunedPendingDelete ���
� ModulesOutOfDatePendingDelete
� ModuleBucketsGrown ���
� ModuleDebugInfoFailedQuery ���
� ModuleDebugInfoTooLarge ��
� ModuleIdHashDuplicate
� ModuleIdHashConflict �
� ProcessesTracked �
� ProcessesIgnored �
� ProcessesDeleted �
� CaptureSampleAttempts
� CaptureSampleSamplingPaused ��
� CaptureKernelStack ���
� CaptureUserStack �
� CaptureIPNotInStack ��
� CaptureSampleIdle
� CaptureUserCheckSystemThread �
� CaptureUserCheckNullTeb ��
� CaptureUserCheckTerminating ��
� CaptureUserCheckSuspended
� CaptureApcNotInGoodEnvironment ���
� CaptureRebalanceQueue
� CaptureRebalance �
� CaptureApc ���
� CaptureApcNotAvailable ���
� CaptureApcThreadNotQueueable �
� CaptureApcAlreadyQueued ��
� CaptureThreadAlreadySampling �
� CaptureApcQueue ��
� CaptureApcQueueAtHighIrql
CaptureApcFailedToQueue ��
CaptureApcFailedToQueueAtHighIrql
CaptureApcFailedToQueueAtHighIrqlNotRunning ��
CaptureApcFailedToQueueAtHighIrqlNotApcQueueable �
CaptureApcRundown
CaptureApcCancel �
CaptureApcCancelFailRemove ���
CaptureBufferNotAvailable
CaptureBufferReleaseEmpty
$CaptureBufferQueued ��
(CaptureBufferCopied ��
,CaptureStartFailureCleanup ���
0SampleBufferNotAvailable �
4WorkerWakeUpForCaptureBuffer �
8WorkerWakeUpForRebalance �
<WorkerProcessCaptureBuffer ���
@WorkerProcessSampleBuffer
DWorkerProcessFlushBuffer �
HStackHashMiss
LStackHashHit �
PStackHashHitInHistory
TStackHashSwitchTables
XStackHashCollisionInAdd ��
\StackHashAddHitLoad ��
`StackHashAddHitMax ���
dBloomFilterExceptions
hBloomFilterSet ���
lBloomFilterOnCreate ��
pBloomFilterHit ���
tBloomFilterMiss ��
xBufferSamplesCopied ��
|BufferSamplesProcessed ���
�BufferSamplesAddedToSampler ��
�BufferAddressesCopied
�BufferAddressesProcessed �
�BufferAddressesAddedToSampler
�ReserveFailedAcquireLock �
�ReserveCaptureStopped
�ReserveNewBufferSet ��
�ReserveNewBufferFailed ���
�ReserveNewBufferAllocated
�ReserveNewBufferReleased �
�ReserveSucceeded �
�TableGrew
�TableGrow
�TableQueued ��
�TableHitInCurrent
�TableHitInOld ^ o �: �_ETW_COVERAGE_SAMPLER_PERF_STATS .?AU_ETW_COVERAGE_SAMPLER_PERF_STATS@@ �� �: � " R � _WMI_IMAGELOAD_INFORMATION .?AU_WMI_IMAGELOAD_INFORMATION@@ ��2
ImageBase
" ImageSize
" ProcessId
" ImageChecksum
" TimeDateStamp
SignatureLevel ���
SignatureType
! Reserved0
DefaultBase ��
" Reserved1
" Reserved2
" $ Reserved3
" ( Reserved4
, FileName �R �: 0 _WMI_IMAGELOAD_INFORMATION .?AU_WMI_IMAGELOAD_INFORMATION@@ �� �: � D . � _TP_WORK .?AU_TP_WORK@@ ��
;
� � ; ;
;
�
'
� f � _PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT .?AU_PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT@@
" TargetAddress f ; _PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT .?AU_PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT@@ ; � 8
�6
� : � _SYSDBG_VIRTUAL .?AU_SYSDBG_VIRTUAL@@ >
Address ��
Buffer ���
" Request ��: ; _SYSDBG_VIRTUAL .?AU_SYSDBG_VIRTUAL@@
; � b � _PROCESS_CHILD_PROCESS_INFORMATION .?AU_PROCESS_CHILD_PROCESS_INFORMATION@@ ��v
ProhibitChildProcesses ���
AlwaysAllowSecureChildProcess
AuditProhibitChildProcesses ��b ; _PROCESS_CHILD_PROCESS_INFORMATION .?AU_PROCESS_CHILD_PROCESS_INFORMATION@@ �� ; C � 6 � tagLOGPALETTE .?AUtagLOGPALETTE@@
;
� : � tagPALETTEENTRY .?AUtagPALETTEENTRY@@ ; " �J
! palVersion ���
! palNumEntries
; palPalEntry ��6 ; tagLOGPALETTE .?AUtagLOGPALETTE@@ ; � . PerfInfoDomainChangeEventIdleHalt PerfInfoDomainChangeEventIdleResume �� PerfInfoDomainChangeEventUserRestore � PerfInfoDomainChangeEventUserCallout � PerfInfoDomainChangeEventEnterSyscall PerfInfoDomainChangeEventEnterTrap ��� PerfInfoDomainChangeEventMaximum �b t ; _PERFINFO_DOMAIN_CHANGE_EVENT_REASON .?AW4_PERFINFO_DOMAIN_CHANGE_EVENT_REASON@@ ��� ; �
;
�
T
�
�/
�
� j � _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT .?AU_SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT@@ ��
!;
� .
# Hits �
PercentFrequency �j #; _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT .?AU_SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT@@ �� $; N � READ_USN_JOURNAL_DATA_V1 .?AUREAD_USN_JOURNAL_DATA_V1@@ ��
&;
� �
StartUsn �
" ReasonMask ���
" ReturnOnlyOnClose
# Timeout ��
# BytesToWaitFor ���
# UsnJournalID �
! ( MinMajorVersion ��
! * MaxMajorVersion ��N (; 0 READ_USN_JOURNAL_DATA_V1 .?AUREAD_USN_JOURNAL_DATA_V1@@ �� ); 9 : � _MMPFN_IDENTITY .?AU_MMPFN_IDENTITY@@ N � _MEMORY_FRAME_INFORMATION .?AU_MEMORY_FRAME_INFORMATION@@ F � _PAGEDIR_INFORMATION .?AU_PAGEDIR_INFORMATION@@ ��B
,; e1 ���
1 e2 ���
-; e3 ���
5% e4 ���2 .; <anonymous-tag> .?AT<anonymous-tag>@@ /; %
" ��
" ��&
1; Image
2; Mismatch �: 3; <anonymous-tag> .?AU<anonymous-tag>@@ 4; -
" ��
6; CombinedPage �: 7; <anonymous-tag> .?AU<anonymous-tag>@@ 8; 1 �
4; e1 ���
8; e2 ���
FileObject ���
UniqueFileObjectKey ��
ProtoPteAddress ��
VirtualAddress ���2 :; <anonymous-tag> .?AT<anonymous-tag>@@ ;; , >
/; u1 ���
" PageFrameIndex ���
;; u2 ���: =; _MMPFN_IDENTITY .?AU_MMPFN_IDENTITY@@ >; $ R � _JOBOBJECT_WAKE_INFORMATION .?AU_JOBOBJECT_WAKE_INFORMATION@@
@;
� # " 8 �:
# NotificationChannel ��
B; WakeCounters �R C; @ _JOBOBJECT_WAKE_INFORMATION .?AU_JOBOBJECT_WAKE_INFORMATION@@ D; a 3 V � _FILE_SET_DEFECT_MGMT_BUFFER .?AU_FILE_SET_DEFECT_MGMT_BUFFER@@ ��
Disable ��V G; _FILE_SET_DEFECT_MGMT_BUFFER .?AU_FILE_SET_DEFECT_MGMT_BUFFER@@ �� H; ' Z � _SYSTEM_PROCESS_ID_INFORMATION .?AU_SYSTEM_PROCESS_ID_INFORMATION@@ ��
J;
� *
ProcessId
� ImageName Z L; _SYSTEM_PROCESS_ID_INFORMATION .?AU_SYSTEM_PROCESS_ID_INFORMATION@@ �� M; ` F � _RPC_TRANSFER_SYNTAX .?AU_RPC_TRANSFER_SYNTAX@@ ��:
� Uuid �
! VersMajor
! VersMinor F P; _RPC_TRANSFER_SYNTAX .?AU_RPC_TRANSFER_SYNTAX@@ �� Q; � �
/
�
�
� 2 � _FILE_PATH .?AU_FILE_PATH@@ ��
U;
� N
" Version ��
" Length ���
" Type �
| FilePath �2 W; _FILE_PATH .?AU_FILE_PATH@@ �� X; s f � _PERFINFO_PAGECOMBINE_AGGREGATE_STAT .?AU_PERFINFO_PAGECOMBINE_AGGREGATE_STAT@@ ��
Z;
�
" ��
" ��
\; StatType �
]; Spare
" CombineScanCount �
# PagesScanned �
# PagesCombined
CombinedBlocksInUse ��
SumCombinedBlocksReferenceCount ��f ^; _PERFINFO_PAGECOMBINE_AGGREGATE_STAT .?AU_PERFINFO_PAGECOMBINE_AGGREGATE_STAT@@ �� _; � ( N
peRed
peGreen ��
peBlue ���
peFlags ��: a; tagPALETTEENTRY .?AUtagPALETTEENTRY@@ b; � v � _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT@@ ��
d;
�
" SavepointId ��v f; _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT@@ �� g; J � Z � _KNONVOLATILE_CONTEXT_POINTERS .?AU_KNONVOLATILE_CONTEXT_POINTERS@@ ��
i;
�
" Dummy Z k; _KNONVOLATILE_CONTEXT_POINTERS .?AU_KNONVOLATILE_CONTEXT_POINTERS@@ �� l; �8 & J � _ETW_HEAP_EVENT_COMMON .?AU_ETW_HEAP_EVENT_COMMON@@ ��*
� Header ���
Handle ���J o; $ _ETW_HEAP_EVENT_COMMON .?AU_ETW_HEAP_EVENT_COMMON@@ �� p; � �
N � _COVERAGE_SECTION_HEADER .?AU_COVERAGE_SECTION_HEADER@@ ��
r;
� �
" Signature
" CoverageType �
� MD5Hash ��
" CoverageSectionSize ��
" CoverageVectorSize ���
" CoverageVectorOffset �
" $ ExtraDataOffset ��N t; ( _COVERAGE_SECTION_HEADER .?AU_COVERAGE_SECTION_HEADER@@ �� u; u ' R � _PERFINFO_PO_NOTIFY_DEVICE .?AU_PERFINFO_PO_NOTIFY_DEVICE@@ ���
Irp ��
DriverStart ��
OrderLevel ���
MajorFunction
MinorFunction
( Type �
�! State
" DeviceNameLength �
DeviceName ���R x; _PERFINFO_PO_NOTIFY_DEVICE .?AU_PERFINFO_PO_NOTIFY_DEVICE@@ �� y; � n q t {;
|;
�
�
�
1
�
1 �; � � �; r � _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION@@ ��
�;
� �
�' BasicInfo
B 0 IoInfo ���
x ` DiskIoInfo ���
# � ContextSwitches ��
} � TotalCycleTime ���
# � ReadyTime
�' � EnergyValues �r �; �_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION@@ �� �; a �
~+
� B � _SCRUB_DATA_OUTPUT .?AU_SCRUB_DATA_OUTPUT@@ �� " " $ ��
" Size �
" Flags
" Status ���
# ErrorFileOffset ��
# ErrorLength ��
# NumberOfBytesRepaired
# ( NumberOfBytesFailed ��
# 0 InternalFileReference
! 8 ResumeContextLength ��
! : ParityExtentDataOffset ���
�; < Reserved �
# ` NumberOfMetadataBytesProcessed ���
# h NumberOfDataBytesProcessed ���
# p TotalNumberOfMetadataBytesInUse ��
# x TotalNumberOfDataBytesInUse ��
6 � ResumeContext B �; �_SCRUB_DATA_OUTPUT .?AU_SCRUB_DATA_OUTPUT@@ �� �; /' . � HLSURF__ .?AUHLSURF__@@ ��
t unused ���. �; HLSURF__ .?AUHLSURF__@@ �� �; ' � N � _ACL_REVISION_INFORMATION .?AU_ACL_REVISION_INFORMATION@@
" AclRevision ��N �; _ACL_REVISION_INFORMATION .?AU_ACL_REVISION_INFORMATION@@ �; S
$
� r � _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT@@ ��*
" MarshalCookie
� UOW ��r �; _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT@@ �� �; J � Z � _STREAMS_QUERY_ID_OUTPUT_BUFFER .?AU_STREAMS_QUERY_ID_OUTPUT_BUFFER@@
" StreamId �Z �; _STREAMS_QUERY_ID_OUTPUT_BUFFER .?AU_STREAMS_QUERY_ID_OUTPUT_BUFFER@@ �; � > � RPC_STATS_VECTOR .?AURPC_STATS_VECTOR@@ �� " " �"
u Count
�; Stats > �; RPC_STATS_VECTOR .?AURPC_STATS_VECTOR@@ �� �; � f � _ALPC_PORT_ASSOCIATE_COMPLETION_PORT .?AU_ALPC_PORT_ASSOCIATE_COMPLETION_PORT@@ ��
�;
� 6
CompletionKey
CompletionPort ���f �; _ALPC_PORT_ASSOCIATE_COMPLETION_PORT .?AU_ALPC_PORT_ASSOCIATE_COMPLETION_PORT@@ �� �; � F � _FILE_ALIGNMENT_INFO .?AU_FILE_ALIGNMENT_INFO@@ ��"
" AlignmentRequirement �F �; _FILE_ALIGNMENT_INFO .?AU_FILE_ALIGNMENT_INFO@@ �� �; #
u2
� ^ � _RPC_BINDING_HANDLE_TEMPLATE_V1_W .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_W@@
q Reserved �2 �; <anonymous-tag> .?AT<anonymous-tag>@@ �; � � �
" Version ��
" Flags
" ProtocolSequence �
q NetworkAddress ���
q StringEndpoint ���
�; u1 ���
� ObjectUuid ���^ �; ( _RPC_BINDING_HANDLE_TEMPLATE_V1_W .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_W@@ �; � � b JournalAbsoluteInformation ��� JournalClientInformation � MaxJournalInformation N t �; _JOURNAL_INFORMATION_CLASS .?AW4_JOURNAL_INFORMATION_CLASS@@ ��� �; 3 � B � tagINPUT_TRANSFORM .?AUtagINPUT_TRANSFORM@@ �� " @ �
@ _11 ��
@ _12 ��
@ _13 ��
@ _14 ��
@ _21 ��
@ _22 ��
@ _23 ��
@ _24 ��
@ _31 ��
@ $ _32 ��
@ ( _33 ��
@ , _34 ��
@ 0 _41 ��
@ 4 _42 ��
@ 8 _43 ��
@ < _44 ��
�; m B �; @ tagINPUT_TRANSFORM .?AUtagINPUT_TRANSFORM@@ �� �; � 6 �% �% ! t �;
�;
�
�
�
�/
�
�9
� F � _CM_SONIC_DEVICE_DATA .?AU_CM_SONIC_DEVICE_DATA@@ j
! Version ��
! Revision �
! DataConfigurationRegister
� EthernetAddress ��F �; _CM_SONIC_DEVICE_DATA .?AU_CM_SONIC_DEVICE_DATA@@ �; � � : � CM_Power_Data_s .?AUCM_Power_Data_s@@ l " ��
" PD_Size ��
l PD_MostRecentPowerState ��
" PD_Capabilities ��
" PD_D1Latency �
" PD_D2Latency �
" PD_D3Latency �
�; PD_PowerStateMapping �
S 4 PD_DeepestSystemWake �: �; 8 CM_Power_Data_s .?AUCM_Power_Data_s@@ �; b R � _KEY_VALUE_FULL_INFORMATION .?AU_KEY_VALUE_FULL_INFORMATION@@ �
" TitleIndex ���
" Type �
" DataOffset ���
" DataLength ���
" NameLength ���
Name �R �; _KEY_VALUE_FULL_INFORMATION .?AU_KEY_VALUE_FULL_INFORMATION@@ �; � O
�
� ^ � _ETW_COVERAGE_SAMPLER_STATUS_INFO .?AU_ETW_COVERAGE_SAMPLER_STATUS_INFO@@ V � _ETW_COVERAGE_SAMPLER_STATUS .?AU_ETW_COVERAGE_SAMPLER_STATUS@@ ��*
� Common ���
�; Status ���^ �; _ETW_COVERAGE_SAMPLER_STATUS_INFO .?AU_ETW_COVERAGE_SAMPLER_STATUS_INFO@@ �; � - : � _RTL_HASH_ENTRY .?AU_RTL_HASH_ENTRY@@ *
BucketLink ���
" Key ��: �; _RTL_HASH_ENTRY .?AU_RTL_HASH_ENTRY@@ �; - * B � _PS_ATTRIBUTE_LIST .?AU_PS_ATTRIBUTE_LIST@@ ��6 � _PS_ATTRIBUTE .?AU_PS_ATTRIBUTE@@ �; " �2
" TotalLength ��
�; Attributes ���B �; _PS_ATTRIBUTE_LIST .?AU_PS_ATTRIBUTE_LIST@@ �� �; a � 6 � _RATE_QUOTA_LIMIT .?AT_RATE_QUOTA_LIMIT@@
�;
�
" ��
" ��B
" RateData �
�; RatePercent ��
�; Reserved0 6 �; _RATE_QUOTA_LIMIT .?AT_RATE_QUOTA_LIMIT@@ �; C � F � _PHYSICAL_DISK_RECORD .?AU_PHYSICAL_DISK_RECORD@@ q " �N
" DiskNumber ���
" BytesPerSector ���
" SectorsPerTrack ��
" TracksPerCylinder
# Cylinders
" SCSIPortNumber ���
" SCSIPathId ���
" SCSITargetId �
" $ SCSILun ��
� ( Manufacturer �
" (PartitionCount ���
,WriteCacheEnabled
�; .BootDriveLetter ��F
�; 8_PHYSICAL_DISK_RECORD .?AU_PHYSICAL_DISK_RECORD@@ �; � � 6 � tagEMRFILLRGN .?AUtagEMRFILLRGN@@
�;
� b
emr ��
� rclBounds
" cbRgnData
" ihBrush ��
K RgnData ��6 �; $ tagEMRFILLRGN .?AUtagEMRFILLRGN@@ �; � 6 � _PEB_LDR_DATA .?AU_PEB_LDR_DATA@@
�;
�
" Length ���
Initialized ��
SsHandle �
� InLoadOrderModuleList
� InMemoryOrderModuleList ��
� InInitializationOrderModuleList ��
$ EntryInProgress ��
( ShutdownInProgress ���
, ShutdownThreadId �6 �; 0 _PEB_LDR_DATA .?AU_PEB_LDR_DATA@@ �; C ,
�
� b
ProcessorNumber ��
Alignment
! ProcessorIndex ���
! LoggerId �B �; _ETW_BUFFER_CONTEXT .?AU_ETW_BUFFER_CONTEXT@@ �; � � B � tagEMROFFSETCLIPRGN .?AUtagEMROFFSETCLIPRGN@@ &
emr ��
I ptlOffset B �; tagEMROFFSETCLIPRGN .?AUtagEMROFFSETCLIPRGN@@ �; �
�/
� Z
� elfLogFont ���
� \ elfFullName ��
� � elfStyle �
� elfScript > < \tagENUMLOGFONTEXW .?AUtagENUMLOGFONTEXW@@ < �
<2
� V � _JOBOBJECT_JOBSET_INFORMATION .?AU_JOBOBJECT_JOBSET_INFORMATION@@
" MemberLevel ��V < _JOBOBJECT_JOBSET_INFORMATION .?AU_JOBOBJECT_JOBSET_INFORMATION@@ < C �
�
� : � _XSTATE_CONTEXT .?AU_XSTATE_CONTEXT@@
<
�
�
� �
# Mask �
" Length ���
" Reserved1
< Area �
" Reserved2
Buffer ���
" Reserved3 : < _XSTATE_CONTEXT .?AU_XSTATE_CONTEXT@@
< � $
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
< Reserved0
< SameAccess ���
< SameAttributes ���
< Indirect �
< Inherit ��
< Reserved1
" Handle ���
" ObjectType ���
" DesiredAccess
" GrantedAccess B < _ALPC_HANDLE_ATTR32 .?AU_ALPC_HANDLE_ATTR32@@ < � ) �
HandleValue ��
" HandleCount ��
" PointerCount �
" GrantedAccess
" ObjectTypeIndex ��
" HandleAttributes �
" Reserved �^ < _PROCESS_HANDLE_TABLE_ENTRY_INFO .?AU_PROCESS_HANDLE_TABLE_ENTRY_INFO@@ �� < a � V � _SERVICE_FAILURE_ACTIONS_FLAG .?AU_SERVICE_FAILURE_ACTIONS_FLAG@@ .
t fFailureActionsOnNonCrashFailures V < _SERVICE_FAILURE_ACTIONS_FLAG .?AU_SERVICE_FAILURE_ACTIONS_FLAG@@ < 3 C n � _SYSTEM_FEATURE_CONFIGURATION_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_INFORMATION@@ 2
# ChangeStamp ��
� Configuration n < _SYSTEM_FEATURE_CONFIGURATION_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_INFORMATION@@ !< c
5
�
{#
�
�'
� �
} TotalUserTime
} TotalKernelTime ��
} ThisPeriodTotalUserTime ��
} ThisPeriodTotalKernelTime
" TotalPageFaultCount ��
" $ TotalProcesses ���
" ( ActiveProcesses ��
" , TotalTerminatedProcesses �j &< 0 _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_ACCOUNTING_INFORMATION@@ '< C I f � _SYSTEM_QUERY_TIME_ADJUST_INFORMATION .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION@@ J
" TimeAdjustment ���
" TimeIncrement
Enable ���f *< _SYSTEM_QUERY_TIME_ADJUST_INFORMATION .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION@@ +< c B � _KERNEL_USER_TIMES .?AU_KERNEL_USER_TIMES@@ ��Z
} CreateTime ���
} ExitTime �
} KernelTime ���
} UserTime �B .< _KERNEL_USER_TIMES .?AU_KERNEL_USER_TIMES@@ �� /< C � f � _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1@@ f
� pInt64 ���
� pUint64 ��
� ppString �
� pFqbn
� pOctetString �2 2< <anonymous-tag> .?AT<anonymous-tag>@@ 3<
v
" Name �
! ValueType
! Reserved �
" Flags
" ValueCount ���
3< Values ���f 5< _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1@@ 6< �
�( ��
8<
� F � _IMAGE_FUNCTION_ENTRY .?AU_IMAGE_FUNCTION_ENTRY@@ N
" StartingAddress ��
" EndingAddress
" EndOfPrologue F ;< _IMAGE_FUNCTION_ENTRY .?AU_IMAGE_FUNCTION_ENTRY@@ << [ � # � ><
&
� *
" PolicyCookie �
h Type �j A< _SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER .?AU_SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER@@ B< { � b � _SYSTEM_SET_TIME_ADJUST_INFORMATION .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION@@
D<
� 2
" TimeAdjustment ���
Enable ���b F< _SYSTEM_SET_TIME_ADJUST_INFORMATION .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION@@ G< o b � _PERFINFO_KERNELMEMORY_RANGE_USAGE .?AU_PERFINFO_KERNELMEMORY_RANGE_USAGE@@ ��
I<
�
" ��
" ��V
K< UsageType
L< Spare
VirtualAddress ���
" PageCount b M< _PERFINFO_KERNELMEMORY_RANGE_USAGE .?AU_PERFINFO_KERNELMEMORY_RANGE_USAGE@@ �� N< � J � tagPOINTER_DEVICE_INFO .?AUtagPOINTER_DEVICE_INFO@@ ��2 � HMONITOR__ .?AUHMONITOR__@@ ��
Q<
� q " �
" displayOrientation ���
device ���
', pointerDeviceType
R< monitor ��
" startingCursorId �
! maxActiveContacts
S< productString J T< (tagPOINTER_DEVICE_INFO .?AUtagPOINTER_DEVICE_INFO@@ �� U< �;
�4
� R � _SYSTEM_HANDLE_INFORMATION .?AU_SYSTEM_HANDLE_INFORMATION@@ ��Z � _SYSTEM_HANDLE_TABLE_ENTRY_INFO .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO@@ Y< " �2
" NumberOfHandles ��
Z< Handles ��R [< _SYSTEM_HANDLE_INFORMATION .?AU_SYSTEM_HANDLE_INFORMATION@@ �� \< : � tagENUMLOGFONTA .?AUtagENUMLOGFONTA@@
^<
� F
l elfLogFont ���
P+ < elfFullName ��
c | elfStyle �: `< � tagENUMLOGFONTA .?AUtagENUMLOGFONTA@@ a< �
z8
� N � _MEM_ADDRESS_REQUIREMENTS .?AU_MEM_ADDRESS_REQUIREMENTS@@ V
LowestStartingAddress
HighestEndingAddress �
" Alignment N e< _MEM_ADDRESS_REQUIREMENTS .?AU_MEM_ADDRESS_REQUIREMENTS@@ f< ? �
o)
� : � _REASON_BUFFER .?AU_REASON_BUFFER@@ ��
" Flags
" ResourceFileNameOffset ���
! ResourceReasonId �
" StringCount ��
" SubstitutionStringsOffset
" SimpleStringOffset ���: j< _REASON_BUFFER .?AU_REASON_BUFFER@@ �� k< �
�2
�
I2
� 6 � _EVENT_TRACE .?AU_EVENT_TRACE@@ ��
L2
�
o<
�
q< r<
s<
�
�
�
u< v<
w<
� �
p LogFileName ��
p LoggerName ���
CurrentTime ��
" BuffersRead ��
" LogFileMode ��
" ProcessTraceMode �
o< CurrentEvent �
m9 p LogfileHeader
p< �BufferCallback ���
" �BufferSize ���
" �Filled ���
" �EventsLost ���
t< �EventCallback
x< �EventRecordCallback ��
" �IsKernelTrace
�Context ��F y< �_EVENT_TRACE_LOGFILEA .?AU_EVENT_TRACE_LOGFILEA@@ z< � �
�+
� V � _CLAIM_SECURITY_ATTRIBUTE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_V1@@ ��
}<
�
2
� v � _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ ��
�<
� f
pInt64 ���
# pUint64 ��
@- ppString �
< pFqbn
�< pOctetString �2 �< <anonymous-tag> .?AT<anonymous-tag>@@ �< � v
q Name �
! ValueType
! Reserved �
" Flags
" ValueCount ���
�< Values ���V �< _CLAIM_SECURITY_ATTRIBUTE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_V1@@ �� �< � : � tagMETAFILEPICT .?AUtagMETAFILEPICT@@ 2 � HMETAFILE__ .?AUHMETAFILE__@@
�<
� B
mm ���
xExt �
yExt �
�< hMF ��: �< tagMETAFILEPICT .?AUtagMETAFILEPICT@@ �<
�0
�
F
� > � _TOKEN_STATISTICS .?AU_TOKEN_STATISTICS@@
I TokenId ��
I AuthenticationId �
} ExpirationTime ���
B$ TokenType
� ImpersonationLevel ���
" DynamicCharged ���
" $ DynamicAvailable �
" ( GroupCount ���
" , PrivilegeCount ���
I 0 ModifiedId ���>
�< 8 _TOKEN_STATISTICS .?AU_TOKEN_STATISTICS@@ �< � f � _SYSTEM_INTERRUPT_CPU_SET_INFORMATION .?AU_SYSTEM_INTERRUPT_CPU_SET_INFORMATION@@ 6
" Gsiv �
! Group
# CpuSets ��f �< _SYSTEM_INTERRUPT_CPU_SET_INFORMATION .?AU_SYSTEM_INTERRUPT_CPU_SET_INFORMATION@@ �< �
(
� > � tagCBT_CREATEWNDA .?AUtagCBT_CREATEWNDA@@
�<
� .
�* lpcs �
y hwndInsertAfter ��> �< tagCBT_CREATEWNDA .?AUtagCBT_CREATEWNDA@@ �< U 6 � _NETRESOURCEA .?AU_NETRESOURCEA@@ �
" dwScope ��
" dwType ���
" dwDisplayType
" dwUsage ��
p lpLocalName ��
p lpRemoteName �
p lpComment
p lpProvider ���6 �< _NETRESOURCEA .?AU_NETRESOURCEA@@ �< 5 d J � _BOOT_ENTROPY_NT_RESULT .?AU_BOOT_ENTROPY_NT_RESULT@@ Z � _BOOT_ENTROPY_SOURCE_NT_RESULT .?AU_BOOT_ENTROPY_SOURCE_NT_RESULT@@ �� �< " �Z
" maxEntropySources
�< EntropySourceResult ��
�5 SeedBytesForCng ��J �< H_BOOT_ENTROPY_NT_RESULT .?AU_BOOT_ENTROPY_NT_RESULT@@ �< N Z � _FILE_PIPE_EVENT_SELECT_BUFFER .?AU_FILE_PIPE_EVENT_SELECT_BUFFER@@ ��2
" EventTypes ���
# EventHandle ��Z �< _FILE_PIPE_EVENT_SELECT_BUFFER .?AU_FILE_PIPE_EVENT_SELECT_BUFFER@@ �� �< �) �
! CurrentMachineSIDOffset ��
! CurrentMachineSIDLength ��
! NewMachineSIDOffset ��
! NewMachineSIDLength ��V �< _SD_CHANGE_MACHINE_SID_INPUT .?AU_SD_CHANGE_MACHINE_SID_INPUT@@ �� �< �
w:
� v � _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION .?AU_SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION@@ ��
�<
� # " �.
# WorkloadClass
�< CpuSets ��v �< _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION .?AU_SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION@@ �� �< � b � _FILE_IS_REMOTE_DEVICE_INFORMATION .?AU_FILE_IS_REMOTE_DEVICE_INFORMATION@@ ��
IsRemote �b �< _FILE_IS_REMOTE_DEVICE_INFORMATION .?AU_FILE_IS_REMOTE_DEVICE_INFORMATION@@ �� �<
�:
�
�
� F � _STREAM_LAYOUT_ENTRY .?AU_STREAM_LAYOUT_ENTRY@@ ��
�<
� 2
" Version ��
" NextStreamOffset �
" Flags
" ExtentInformationOffset ��
} AllocationSize ���
} EndOfFile
" StreamInformationOffset ��
" $ AttributeTypeCode
" ( AttributeFlags ���
" , StreamIdentifierLength ���
0 StreamIdentifier �F �< 8 _STREAM_LAYOUT_ENTRY .?AU_STREAM_LAYOUT_ENTRY@@ �� �< 4
>(
� > � _WMI_CONTEXTSWAP .?AU_WMI_CONTEXTSWAP@@ ��
��
��
��
��
" NewThreadId ��
" OldThreadId ��
p NewThreadPriority
p OldThreadPriority
PreviousCState ���
OldThreadRank
p NewThreadPriorityDecrement ���
p SpareByte
OldThreadWaitReason ��
�<
OldThreadWaitMode
�<
OldThreadBamQosLevel �
�<
NewThreadBamQosLevel �
�<
Reserved �
Flags
OldThreadState ���
OldThreadIdealProcessor ��
" NewThreadWaitTime
OldThreadRemainingQuantum > �< _WMI_CONTEXTSWAP .?AU_WMI_CONTEXTSWAP@@ �� �< � B � READ_FILE_USN_DATA .?AUREAD_FILE_USN_DATA@@ ��
�<
� :
! MinMajorVersion ��
! MaxMajorVersion ��B �< READ_FILE_USN_DATA .?AUREAD_FILE_USN_DATA@@ �� �< �
" dwServiceType
" dwCurrentState ���
" dwControlsAccepted ���
" dwWin32ExitCode ��
" dwServiceSpecificExitCode
" dwCheckPoint �
" dwWaitHint ���
" dwProcessId ��
" dwServiceFlags ���J �< $ _SERVICE_STATUS_PROCESS .?AU_SERVICE_STATUS_PROCESS@@ �< 3 � B � tagEMREXTCREATEPEN .?AUtagEMREXTCREATEPEN@@ ��~
emr ��
" ihPen
" offBmi ���
" cbBmi
" offBits ��
" cbBits ���
� elp ��B �< 8 tagEMREXTCREATEPEN .?AUtagEMREXTCREATEPEN@@ �� �< U V � _SYSTEM_SCOPED_POLICY_ID_ACE .?AU_SYSTEM_SCOPED_POLICY_ID_ACE@@ ��:
o Header ���
" Mask �
" SidStart �V �< _SYSTEM_SCOPED_POLICY_ID_ACE .?AU_SYSTEM_SCOPED_POLICY_ID_ACE@@ �� �< � r � JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 .?AUJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2@@ ��
# IoReadBytesLimit �
# IoWriteBytesLimit
} PerJobUserTimeLimit ��
# JobHighMemoryLimit ���
# JobMemoryLimit ���
� RateControlTolerance �
� CpuRateControlTolerance ��
$ RateControlToleranceInterval �
$ CpuRateControlToleranceInterval ��
" ( LimitFlags ���
� , IoRateControlTolerance ���
# 0 JobLowMemoryLimit
8 IoRateControlToleranceInterval ���
� < NetRateControlTolerance ��
@ NetRateControlToleranceInterval ��r �< H JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 .?AUJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2@@ �� �< C � Z � _SE_SET_FILE_CACHE_INFORMATION .?AU_SE_SET_FILE_CACHE_INFORMATION@@ ��
�<
� 2
" Size �
� CatalogDirectoryPath �Z �< _SE_SET_FILE_CACHE_INFORMATION .?AU_SE_SET_FILE_CACHE_INFORMATION@@ �� �< ] � > � tagLASTINPUTINFO .?AUtagLASTINPUTINFO@@ ��
�<
� *
u cbSize ���
" dwTime ���> �< tagLASTINPUTINFO .?AUtagLASTINPUTINFO@@ �� �< �
z#
� R � _SYSTEM_POLICY_INFORMATION .?AU_SYSTEM_POLICY_INFORMATION@@ ��v
InputData
OutputData ���
" InputDataSize
" OutputDataSize ���
" Version ��R �< _SYSTEM_POLICY_INFORMATION .?AU_SYSTEM_POLICY_INFORMATION@@ �� �< R
R � _CONTAINER_ROOT_INFO_INPUT .?AU_CONTAINER_ROOT_INFO_INPUT@@ ��
�<
�
" Flags R �< _CONTAINER_ROOT_INFO_INPUT .?AU_CONTAINER_ROOT_INFO_INPUT@@ �� �< �"
�-
�
�<
�
A ��
�<
� N � _SYSTEM_AUDIT_OBJECT_ACE .?AU_SYSTEM_AUDIT_OBJECT_ACE@@ ��
o Header ���
" Mask �
" Flags
� ObjectType ���
� InheritedObjectType ��
" , SidStart �N �< 0 _SYSTEM_AUDIT_OBJECT_ACE .?AU_SYSTEM_AUDIT_OBJECT_ACE@@ �� �< � > � tagNEWTEXTMETRICA .?AUtagNEWTEXTMETRICA@@
�<
� F
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
, tmFirstChar ��
- tmLastChar ���
. tmDefaultChar
/ tmBreakChar ��
0 tmItalic �
1 tmUnderlined �
2 tmStruckOut ��
3 tmPitchAndFamily �
4 tmCharSet
" 8 ntmFlags �
u < ntmSizeEM
u @ ntmCellHeight
u D ntmAvgWidth ��> �< H tagNEWTEXTMETRICA .?AUtagNEWTEXTMETRICA@@ �< �
N
�
�+
� B � USN_JOURNAL_DATA_V1 .?AUUSN_JOURNAL_DATA_V1@@
=
� �
# UsnJournalID �
FirstUsn �
NextUsn ��
LowestValidUsn ���
MaxUsn ���
# ( MaximumSize ��
# 0 AllocationDelta ��
! 8 MinSupportedMajorVersion �
! : MaxSupportedMajorVersion �B = @ USN_JOURNAL_DATA_V1 .?AUUSN_JOURNAL_DATA_V1@@ = � B � USN_JOURNAL_DATA_V2 .?AUUSN_JOURNAL_DATA_V2@@
=
� F
# UsnJournalID �
FirstUsn �
NextUsn ��
LowestValidUsn ���
MaxUsn ���
# ( MaximumSize ��
# 0 AllocationDelta ��
! 8 MinSupportedMajorVersion �
! : MaxSupportedMajorVersion �
" < Flags
# @ RangeTrackChunkSize ��
H RangeTrackFileSizeThreshold ��B = P USN_JOURNAL_DATA_V2 .?AUUSN_JOURNAL_DATA_V2@@ = �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" Flags
= EnableUserShadowStack
= AuditUserShadowStack �
= SetContextIpValidation ���
= AuditSetContextIpValidation ��
= EnableUserShadowStackStrictMode ��
= BlockNonCetBinaries ��
= BlockNonCetBinariesNonEhcont �
= AuditBlockNonCetBinaries �
= CetDynamicApisOutOfProcOnly ��
= SetContextIpValidationRelaxedMode
= ReservedFlags v = _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY@@ �� = C J � _CONTAINER_VOLUME_STATE .?AU_CONTAINER_VOLUME_STATE@@
" Flags J = _CONTAINER_VOLUME_STATE .?AU_CONTAINER_VOLUME_STATE@@ = �" > � MFT_ENUM_DATA_V0 .?AUMFT_ENUM_DATA_V0@@ ��
=
� N
# StartFileReferenceNumber �
LowUsn ���
HighUsn ��> = MFT_ENUM_DATA_V0 .?AUMFT_ENUM_DATA_V0@@ �� = �
�.
�
8
� 6 � tagENUMUILANG .?AUtagENUMUILANG@@ V
" NumOfEnumUILang ��
" SizeOfEnumUIBuffer ���
q pEnumUIBuffer 6 %= tagENUMUILANG .?AUtagENUMUILANG@@ &= ; ( J � _EVENT_FILTER_EVENT_ID .?AU_EVENT_FILTER_EVENT_ID@@ ��N
FilterIn �
Reserved �
! Count
� Events ���J )= _EVENT_FILTER_EVENT_ID .?AU_EVENT_FILTER_EVENT_ID@@ �� *= � c
�
� Z � _ACTIVATION_CONTEXT_QUERY_INDEX .?AU_ACTIVATION_CONTEXT_QUERY_INDEX@@
-=
� >
" ulAssemblyIndex ��
" ulFileIndexInAssembly Z /= _ACTIVATION_CONTEXT_QUERY_INDEX .?AU_ACTIVATION_CONTEXT_QUERY_INDEX@@ 0= L a J � _IMAGE_ENCLAVE_CONFIG64 .?AU_IMAGE_ENCLAVE_CONFIG64@@ F
" Size �
" MinimumRequiredConfigSize
" PolicyFlags ��
" NumberOfImports ��
" ImportList ���
" ImportEntrySize ��
� FamilyID �
� ( ImageID ��
" 8 ImageVersion �
" < SecurityVersion ��
# @ EnclaveSize ��
" H NumberOfThreads ��
" L EnclaveFlags �J
3= P _IMAGE_ENCLAVE_CONFIG64 .?AU_IMAGE_ENCLAVE_CONFIG64@@ 4= [ s N � _IMAGE_IMPORT_DESCRIPTOR .?AU_IMAGE_IMPORT_DESCRIPTOR@@ ��
6=
� �
" Characteristics ��
" OriginalFirstThunk ���
" TimeDateStamp
" ForwarderChain ���
" Name �
" FirstThunk ���N 8= _IMAGE_IMPORT_DESCRIPTOR .?AU_IMAGE_IMPORT_DESCRIPTOR@@ �� 9= [ � V � tagPOINTER_DEVICE_CURSOR_INFO .?AUtagPOINTER_DEVICE_CURSOR_INFO@@ � POINTER_DEVICE_CURSOR_TYPE_UNKNOWN ��� POINTER_DEVICE_CURSOR_TYPE_TIP ��� POINTER_DEVICE_CURSOR_TYPE_ERASER ��POINTER_DEVICE_CURSOR_TYPE_MAX ��R t <= tagPOINTER_DEVICE_CURSOR_TYPE .?AW4tagPOINTER_DEVICE_CURSOR_TYPE@@ � == �; *
u cursorId �
== cursor ���V ?= tagPOINTER_DEVICE_CURSOR_INFO .?AUtagPOINTER_DEVICE_CURSOR_INFO@@ @= �; V � _SYSTEM_INTERRUPT_INFORMATION .?AU_SYSTEM_INTERRUPT_INFORMATION@@ �
" ContextSwitches ��
" DpcCount �
" DpcRate ��
" TimeIncrement
" DpcBypassCount ���
" ApcBypassCount ���V C= _SYSTEM_INTERRUPT_INFORMATION .?AU_SYSTEM_INTERRUPT_INFORMATION@@ D= �
N � _PS_CPU_QUOTA_QUERY_ENTRY .?AU_PS_CPU_QUOTA_QUERY_ENTRY@@
F=
� *
" SessionId
" Weight ���N H= _PS_CPU_QUOTA_QUERY_ENTRY .?AU_PS_CPU_QUOTA_QUERY_ENTRY@@ I= a
8+
� F � _HEAP_COMMIT_DECOMMIT .?AU_HEAP_COMMIT_DECOMMIT@@ &
� Header ���
� Event F M= 0 _HEAP_COMMIT_DECOMMIT .?AU_HEAP_COMMIT_DECOMMIT@@ N= � 1
�!
� B � _RTL_GENERIC_TABLE .?AU_RTL_GENERIC_TABLE@@ ��
Q=
� R= O$ S=
T=
� R= " V=
W=
� R= Y=
Z=
� �
$ TableRoot
� InsertOrderList ��
OrderedPointer ���
" WhichOrderedElement ��
" NumberGenericTableElements ���
U= CompareRoutine ���
X= AllocateRoutine ��
[= FreeRoutine ��
$ TableContext �B \= ( _RTL_GENERIC_TABLE .?AU_RTL_GENERIC_TABLE@@ �� ]= ( �
.
� "
�# fsUsb
�# fsCsb > `= tagFONTSIGNATURE .?AUtagFONTSIGNATURE@@ �� a= � : � _FILE_PREFETCH .?AU_FILE_PREFETCH@@ ��6
" Type �
" Count
�/ Prefetch �: d= _FILE_PREFETCH .?AU_FILE_PREFETCH@@ �� e= � R � _SILOOBJECT_ROOT_DIRECTORY .?AU_SILOOBJECT_ROOT_DIRECTORY@@ ��
g=
� *
" ControlFlags �
� Path �R i= _SILOOBJECT_ROOT_DIRECTORY .?AU_SILOOBJECT_ROOT_DIRECTORY@@ �� j= C � b � _ACCESS_DENIED_CALLBACK_OBJECT_ACE .?AU_ACCESS_DENIED_CALLBACK_OBJECT_ACE@@ ��
o Header ���
" Mask �
" Flags
� ObjectType ���
� InheritedObjectType ��
" , SidStart �b m= 0 _ACCESS_DENIED_CALLBACK_OBJECT_ACE .?AU_ACCESS_DENIED_CALLBACK_OBJECT_ACE@@ �� n= b � _MIDL_WINRT_TYPE_SERIALIZATION_INFO .?AU_MIDL_WINRT_TYPE_SERIALIZATION_INFO@@ z
" Version ��
� TypeFormatString �
! FormatStringSize �
!
TypeOffset ���
�' StubDesc �b q= _MIDL_WINRT_TYPE_SERIALIZATION_INFO .?AU_MIDL_WINRT_TYPE_SERIALIZATION_INFO@@ r= � � > � _PSFEATURE_OUTPUT .?AU_PSFEATURE_OUTPUT@@
t=
� :
t bPageIndependent �
t bSetPageDevice ���> v= _PSFEATURE_OUTPUT .?AU_PSFEATURE_OUTPUT@@ w=
� 6 � tagSCROLLINFO .?AUtagSCROLLINFO@@ z
u cbSize ���
u fMask
t nMin �
t nMax �
u nPage
t nPos �
t nTrackPos 6 {= tagSCROLLINFO .?AUtagSCROLLINFO@@ |= �. " �&
" Count
~= BindingH �B = _RPC_BINDING_VECTOR .?AU_RPC_BINDING_VECTOR@@ �= � _ N � _FSCTL_OFFLOAD_READ_INPUT .?AU_FSCTL_OFFLOAD_READ_INPUT@@ �
" Size �
" Flags
" TokenTimeToLive ��
" Reserved �
# FileOffset ���
# CopyLength ���N �= _FSCTL_OFFLOAD_READ_INPUT .?AU_FSCTL_OFFLOAD_READ_INPUT@@ �= �
�4
� n � _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS .?AU_SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS@@
KeyHandle
< ValueNamePointer �
" RequiredLengthPointer
Buffer ���
" BufferLength �
" Type �
AppendBuffer �
" AppendBufferLength ���
CreateIfDoesntExist ��
! TruncateExistingValue n
�= $ _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS .?AU_SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS@@ �= �
L
�
" Reserved �F �= _SD_QUERY_STATS_INPUT .?AU_SD_QUERY_STATS_INPUT@@ �= � F � _FILE_ALL_INFORMATION .?AU_FILE_ALL_INFORMATION@@
�=
� J � _FILE_BASIC_INFORMATION .?AU_FILE_BASIC_INFORMATION@@ R � _FILE_POSITION_INFORMATION .?AU_FILE_POSITION_INFORMATION@@ ��
�= BasicInformation �
12 ( StandardInformation ��
:( @ InternalInformation ��
R H EaInformation
� L AccessInformation
�= P PositionInformation ��
� X ModeInformation ��
N" \ AlignmentInformation �
Y9 ` NameInformation ��F �= h _FILE_ALL_INFORMATION .?AU_FILE_ALL_INFORMATION@@ �= F � CM_EXTENDED_PARAMETER .?AUCM_EXTENDED_PARAMETER@@
�=
�
# ��
# 8��
�= Type �
�= Reserved �
# ULong64 ��
Pointer ��
" Size �
Handle ���
" ULong
" AccessMask ���F �= CM_EXTENDED_PARAMETER .?AUCM_EXTENDED_PARAMETER@@ �= 3 6 � _BOOT_RECORD .?AU_BOOT_RECORD@@ ��
# BootFlags
" FirmwareType �
SecureBootEnabled
SecureBootCapable
Reserved1
Reserved2 6 �= _BOOT_RECORD .?AU_BOOT_RECORD@@ �� �= � � . � _OBJECTID .?AU_OBJECTID@@ .
� Lineage ��
" Uniquifier ���. �= _OBJECTID .?AU_OBJECTID@@ �= b u t �=
�=
�
�= �=
�=
�
�
� ~ MemoryLocationInvalid MemoryLocationResident ��� MemoryLocationPagefile ��� MemoryLocationReserved ���V t �= _MEMORY_WORKING_SET_EX_LOCATION .?AW4_MEMORY_WORKING_SET_EX_LOCATION@@ � �= C V � _FILE_END_OF_FILE_INFORMATION .?AU_FILE_END_OF_FILE_INFORMATION@@
} EndOfFile V �= _FILE_END_OF_FILE_INFORMATION .?AU_FILE_END_OF_FILE_INFORMATION@@ �= � V � _UMS_CREATE_THREAD_ATTRIBUTES .?AU_UMS_CREATE_THREAD_ATTRIBUTES@@
�=
� �
" UmsVersion ���
RtlUmsContext
UmsContext ���
RtlUmsCompletionList �
UmsCompletionList V �= _UMS_CREATE_THREAD_ATTRIBUTES .?AU_UMS_CREATE_THREAD_ATTRIBUTES@@ �= C R > � _IMAGE_DEBUG_MISC .?AU_IMAGE_DEBUG_MISC@@ b
" DataType �
" Length ���
Unicode ��
� Reserved �
| Data �> �= _IMAGE_DEBUG_MISC .?AU_IMAGE_DEBUG_MISC@@ �= [ � b � _PERFINFO_DPC_EXECUTION_INFORMATION .?AU_PERFINFO_DPC_EXECUTION_INFORMATION@@ *
DpcRoutine ���
" Key ��b �= _PERFINFO_DPC_EXECUTION_INFORMATION .?AU_PERFINFO_DPC_EXECUTION_INFORMATION@@ �= � � *
" Frequency
" Power
PercentFrequency �
IncreaseLevel
DecreaseLevel
Type �
" IncreaseTime �
" DecreaseTime �
# Control ��
# Status ���
" ( HitCount �
" , Reserved1
# 0 Reserved2
# 8 Reserved3 B �= @ PPM_WMI_PERF_STATE .?AUPPM_WMI_PERF_STATE@@ �� �= � > � tagMONITORINFOEXA .?AUtagMONITORINFOEXA@@
�=
� f
" cbSize ���
� rcMonitor
� rcWork ���
" $ dwFlags ��
�! ( szDevice �> �= H tagMONITORINFOEXA .?AUtagMONITORINFOEXA@@ �= �4 p �=
�=
� F � _PO_WAKE_SOURCE_TIMER .?AU_PO_WAKE_SOURCE_TIMER@@ J � _PO_WAKE_SOURCE_HEADER .?AU_PO_WAKE_SOURCE_HEADER@@ ��*
�= Header ���
�* Reason ���F �= _PO_WAKE_SOURCE_TIMER .?AU_PO_WAKE_SOURCE_TIMER@@ �= .
�%
�
6
� �
�3 pointerInfo ��
u X penFlags �
u \ penMask ��
u ` pressure �
u d rotation �
t h tiltX
t l tiltY B �= p tagPOINTER_PEN_INFO .?AUtagPOINTER_PEN_INFO@@ �= � R � _PROCESS_FAULT_INFORMATION .?AU_PROCESS_FAULT_INFORMATION@@ ��
�=
� 6
" FaultFlags ���
" AdditionalInfo ���R �= _PROCESS_FAULT_INFORMATION .?AU_PROCESS_FAULT_INFORMATION@@ �� �= a ` 6 � _SYSTEM_INFO .?AU_SYSTEM_INFO@@ ��r
" dwOemId ��
! wProcessorArchitecture ���
! wReserved
" dwPageSize ���
lpMinimumApplicationAddress ��
lpMaximumApplicationAddress ��
" dwActiveProcessorMask
" dwNumberOfProcessors �
" dwProcessorType ��
" dwAllocationGranularity ��
! wProcessorLevel ��
! " wProcessorRevision ���6 �= $ _SYSTEM_INFO .?AU_SYSTEM_INFO@@ �� �= A / Z � _MANAGE_HOT_PATCH_UNLOAD_PATCH .?AU_MANAGE_HOT_PATCH_UNLOAD_PATCH@@ ��
�=
� &
� Sid ��
Z Buffer ���2 �= D <anonymous-tag> .?AT<anonymous-tag>@@ �= } >
" Version ��
�. BaseInfo �
�= UserSid ��Z �= P _MANAGE_HOT_PATCH_UNLOAD_PATCH .?AU_MANAGE_HOT_PATCH_UNLOAD_PATCH@@ �� �= o
N
�
# ��
# ��
# ��
# <��
# ��
# ��
# ��
# <���
�= AuditState ���
�= AuditFlag
�= EnableAdditionalAuditingOption ���
�= Reserved �
�= PolicyState ��
�= AlwaysInherit
�= EnableAdditionalPolicyOption �
�= AuditReserved N �= _RTL_IMAGE_MITIGATION_POLICY .?AT_RTL_IMAGE_MITIGATION_POLICY@@ �� �= � � > � tagGUITHREADINFO .?AUtagGUITHREADINFO@@ ���
" cbSize ���
" flags
y hwndActive ���
y hwndFocus
y hwndCapture ��
y hwndMenuOwner
y hwndMoveSize �
y hwndCaret
� rcCaret ��> �= 0 tagGUITHREADINFO .?AUtagGUITHREADINFO@@ �� �= �7 v9 f � _CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT .?AU_CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT@@ b
# VetoedFromAltitudeIntegral ���
# VetoedFromAltitudeDecimal
� Reason ���f �= _CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT .?AU_CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT@@ �= R � _RTL_RETPOLINE_BINARY_INFO .?AU_RTL_RETPOLINE_BINARY_INFO@@ ��
�=
� " �
�=
� �
RetpolineStubsStartRva ���
" CfgDispatchFunctionPtrRva
" IATRva ���
ImportRvas ���
" IAT ��
ImageBase
�= CheckFunction R > _RTL_RETPOLINE_BINARY_INFO .?AU_RTL_RETPOLINE_BINARY_INFO@@ �� > � H f � _JOBOBJECT_ASSOCIATE_COMPLETION_PORT .?AU_JOBOBJECT_ASSOCIATE_COMPLETION_PORT@@ ��
>
� 6
CompletionKey
CompletionPort ���f > _JOBOBJECT_ASSOCIATE_COMPLETION_PORT .?AU_JOBOBJECT_ASSOCIATE_COMPLETION_PORT@@ �� > C �
�,
�
>
�
�=
� �
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
" FileAttributes ���J > ( _FILE_BASIC_INFORMATION .?AU_FILE_BASIC_INFORMATION@@
> � ! >
>
� n
" SessionId
" CpuShareWeight ���
CapturedWeightData ���
# CyclesAccumulated J > _ETW_PER_SESSION_QUOTA .?AU_ETW_PER_SESSION_QUOTA@@ �� > � (
6 � tagDROPSTRUCT .?AUtagDROPSTRUCT@@
>
� ~
y hwndSource ���
y hwndSink �
" wFmt �
" dwData ���
x ptDrop ���
" dwControlData 6 > tagDROPSTRUCT .?AUtagDROPSTRUCT@@ > g N � _MEMORY_BASIC_INFORMATION .?AU_MEMORY_BASIC_INFORMATION@@
>
� �
BaseAddress ��
AllocationBase ���
" AllocationProtect
" RegionSize ���
" State
" Protect ��
" Type �N > _MEMORY_BASIC_INFORMATION .?AU_MEMORY_BASIC_INFORMATION@@ > ? P j � _EVENT_TRACE_STACK_CACHING_INFORMATION .?AU_EVENT_TRACE_STACK_CACHING_INFORMATION@@ ��
� EventTraceInformationClass ���
# TraceHandle ��
Enabled ��
� Reserved �
" CacheSize
" BucketCount ��j > _EVENT_TRACE_STACK_CACHING_INFORMATION .?AU_EVENT_TRACE_STACK_CACHING_INFORMATION@@ �� !> � N
�%
� :
# Value
" EndTime ��
" Bitmap ���6 $> _TIMELINE_BITMAP .?AT_TIMELINE_BITMAP@@ �� %> a �
�<
� F � ANON_OBJECT_HEADER_V2 .?AUANON_OBJECT_HEADER_V2@@ �
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
� ClassID ��
" SizeOfData ���
" Flags
" $ MetaDataSize �
" ( MetaDataOffset ���F
)> , ANON_OBJECT_HEADER_V2 .?AUANON_OBJECT_HEADER_V2@@ *> [ �
�
� B � tagEMREXTFLOODFILL .?AUtagEMREXTFLOODFILL@@ ��
->
� J
emr ��
I ptlStart �
" crColor ��
" iMode B /> tagEMREXTFLOODFILL .?AUtagEMREXTFLOODFILL@@ �� 0> V � _PROCESS_WS_WATCH_INFORMATION .?AU_PROCESS_WS_WATCH_INFORMATION@@
2>
� 2
FaultingPc ���
FaultingVa ���V 4> _PROCESS_WS_WATCH_INFORMATION .?AU_PROCESS_WS_WATCH_INFORMATION@@ 5> C �
4
�
! Size �
! HeaderType ���
! Flags
! EventProperty
" ThreadId �
" ProcessId
} TimeStamp
� ProviderId ���
� ( EventDescriptor ��
" 8 KernelTime ���
" < UserTime �
# 8 ProcessorTime
� @ ActivityId ���6
8> P _EVENT_HEADER .?AU_EVENT_HEADER@@ 9> � � � � ;>
�3
�
s
� �
! UniqueProcessId ��
! CreatorBackTraceIndex
ObjectTypeIndex ��
HandleAttributes �
! HandleValue ��
Object ���
" GrantedAccess Z ?> _SYSTEM_HANDLE_TABLE_ENTRY_INFO .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO@@ @> R � _SYSTEM_POWER_STATE_CONTEXT .?AU_SYSTEM_POWER_STATE_CONTEXT@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
C> Reserved1
D> TargetSystemState
E> EffectiveSystemState �
F> CurrentSystemState ���
G> IgnoreHibernationPath
H> PseudoTransition �
I> KernelSoftReboot �
J> DirectedDripsTransition ��
K> Reserved2
" ContextAsUlong ���R
L> _SYSTEM_POWER_STATE_CONTEXT .?AU_SYSTEM_POWER_STATE_CONTEXT@@ M> � ^ � _CSV_QUERY_VOLUME_REDIRECT_STATE .?AU_CSV_QUERY_VOLUME_REDIRECT_STATE@@ ��
" MdsNodeId
" DsNodeId �
IsDiskConnected ��
ClusterEnableDirectIo
�" DiskConnectivity �^ P> _CSV_QUERY_VOLUME_REDIRECT_STATE .?AU_CSV_QUERY_VOLUME_REDIRECT_STATE@@ �� Q> �
�
�
�<
� B � tagEMRSETTEXTCOLOR .?AUtagEMRSETTEXTCOLOR@@ ��&
emr ��
" crColor ��B V> tagEMRSETTEXTCOLOR .?AUtagEMRSETTEXTCOLOR@@ �� W> �
�$
� F
t valuelen �
value_context
val_buff_ptr �2 Z> val_context .?AUval_context@@ [> H � V � _REPAIR_STORAGE_RESERVE_INPUT .?AU_REPAIR_STORAGE_RESERVE_INPUT@@ j
" Version ��
" Flags
" AreaIdOffset �
" AreaIdCount ��
AreaId ���V ^> _REPAIR_STORAGE_RESERVE_INPUT .?AU_REPAIR_STORAGE_RESERVE_INPUT@@ _> <+ . � _ABCFLOAT .?AU_ABCFLOAT@@ 2
@ abcfA
@ abcfB
@ abcfC .
b> _ABCFLOAT .?AU_ABCFLOAT@@ c> � F
p type �
u size �
I adapterId
u id ���^ e> DISPLAYCONFIG_DEVICE_INFO_HEADER .?AUDISPLAYCONFIG_DEVICE_INFO_HEADER@@ �� f> � ^ � _CFG_CALL_TARGET_LIST_INFORMATION .?AU_CFG_CALL_TARGET_LIST_INFORMATION@@
h>
� F � _CFG_CALL_TARGET_INFO .?AU_CFG_CALL_TARGET_INFO@@
j>
� �
" NumberOfEntries ��
" Reserved �
" NumberOfEntriesProcessed �
k> CallTargetInfo ���
Section ��
# FileOffset ���^ l> _CFG_CALL_TARGET_LIST_INFORMATION .?AU_CFG_CALL_TARGET_LIST_INFORMATION@@ m> ? � J � BREAK_ON_STATUS_BUFFER .?AUBREAK_ON_STATUS_BUFFER@@ ��
o>
� p " �n
NtStatus �
" Win32Error ���
" ThreadId �
" ProcessId
q> ImageFileName J r> BREAK_ON_STATUS_BUFFER .?AUBREAK_ON_STATUS_BUFFER@@ �� s> �
g'
� n � _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY@@
v>
� �
# Offset ���
" NameFlags
FileId ���
" Reserved1
" Reserved2
Reserved3
( FileName �n x> 0 _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY@@ y> �
" ��
" ��
" ��z
" Flags
{> DisallowWin32kSystemCalls
|> AuditDisallowWin32kSystemCalls ���
}> ReservedFlags z ~> _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ �� > C c Z � _ETW_TP_EVENT_TIMER_SET_NTTIMER .?AU_ETW_TP_EVENT_TIMER_SET_NTTIMER@@ Z
� Header ���
DueTime ��
( SubQueue �
" , TolerableDelay ���Z �> 0 _ETW_TP_EVENT_TIMER_SET_NTTIMER .?AU_ETW_TP_EVENT_TIMER_SET_NTTIMER@@ �> � &
�/
� Z � _POWER_THROTTLING_PROCESS_STATE .?AU_POWER_THROTTLING_PROCESS_STATE@@ B
" Version ��
" ControlMask ��
" StateMask Z �> _POWER_THROTTLING_PROCESS_STATE .?AU_POWER_THROTTLING_PROCESS_STATE@@ �> C � ^ � _EVENT_EXTENDED_ITEM_PMC_COUNTERS .?AU_EVENT_EXTENDED_ITEM_PMC_COUNTERS@@
�< Counter ��^ �> _EVENT_EXTENDED_ITEM_PMC_COUNTERS .?AU_EVENT_EXTENDED_ITEM_PMC_COUNTERS@@ �> � v V � _SYSTEM_VHD_BOOT_INFORMATION .?AU_SYSTEM_VHD_BOOT_INFORMATION@@ ��V
OsDiskIsVhd ��
" OsVhdFilePathOffset ��
OsVhdParentVolume V �> _SYSTEM_VHD_BOOT_INFORMATION .?AU_SYSTEM_VHD_BOOT_INFORMATION@@ �� �> �
J � _PERFINFO_PO_POSTSLEEP .?AU_PERFINFO_PO_POSTSLEEP@@ ��
�>
� "
} PerformanceCounter ���J �> _PERFINFO_PO_POSTSLEEP .?AU_PERFINFO_PO_POSTSLEEP@@ �� �> � �
�%
� ^ � _PROCESS_WS_WATCH_INFORMATION_EX .?AU_PROCESS_WS_WATCH_INFORMATION_EX@@ ��B
2> BasicInfo
" FaultingThreadId �
" Flags ^ �> _PROCESS_WS_WATCH_INFORMATION_EX .?AU_PROCESS_WS_WATCH_INFORMATION_EX@@ �� �> a � Z � _PERFINFO_FLT_OPERATION_STATUS .?AU_PERFINFO_FLT_OPERATION_STATUS@@ ��
RoutineAddr ��
FileObject ���
FsContext
IrpPtr ���
CbdPtr ���
MajorFunction
Status ���Z �> _PERFINFO_FLT_OPERATION_STATUS .?AU_PERFINFO_FLT_OPERATION_STATUS@@ �� �> � � v � _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION .?AU_SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION@@ ��
Enabled ��v �> _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION .?AU_SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION@@ �� �> [ * � _FP_128 .?AU_FP_128@@
� W * �> _FP_128 .?AU_FP_128@@ �> + B 2 � tagPELARRAY .?AUtagPELARRAY@@
�>
� f
paXCount �
paYCount �
paXExt ���
paYExt ���
paRGBs ���2 �> tagPELARRAY .?AUtagPELARRAY@@ �> ; : � _BOOT_AREA_INFO .?AU_BOOT_AREA_INFO@@
} Offset ���: �> <anonymous-tag> .?AU<anonymous-tag>@@ �> > �> " �6
" BootSectorCount ��
�> BootSectors ��: �> _BOOT_AREA_INFO .?AU_BOOT_AREA_INFO@@ �> ;
q
� : � _PRIVILEGE_SET .?AU_PRIVILEGE_SET@@ ��
�>
� @' " �F
" PrivilegeCount ���
" Control ��
�> Privilege : �> _PRIVILEGE_SET .?AU_PRIVILEGE_SET@@ �� �> � b � _PERFINFO_SESSIONCREATE_INFORMATION .?AU_PERFINFO_SESSIONCREATE_INFORMATION@@ 2
" UniqueSessionId ��
" SessionId b �> _PERFINFO_SESSIONCREATE_INFORMATION .?AU_PERFINFO_SESSIONCREATE_INFORMATION@@ �> � �
�
�
*
�
�*
�
�
� N � _RTL_UNLOAD_EVENT_TRACE64 .?AU_RTL_UNLOAD_EVENT_TRACE64@@ �
# BaseAddress ��
# SizeOfImage ��
" Sequence �
" TimeDateStamp
" CheckSum �
� ImageName
� \ Version ��N �> h _RTL_UNLOAD_EVENT_TRACE64 .?AU_RTL_UNLOAD_EVENT_TRACE64@@ �> L � Z � _FILE_PIPE_CREATE_SYMLINK_INPUT .?AU_FILE_PIPE_CREATE_SYMLINK_INPUT@@
�>
� �
! NameOffset ���
! NameLength ���
! SubstituteNameOffset �
! SubstituteNameLength �
" Flags Z �> _FILE_PIPE_CREATE_SYMLINK_INPUT .?AU_FILE_PIPE_CREATE_SYMLINK_INPUT@@ �> x) J � _LDR_VERIFY_IMAGE_INFO .?AU_LDR_VERIFY_IMAGE_INFO@@ ��N � _LDR_IMPORT_CALLBACK_INFO .?AU_LDR_IMPORT_CALLBACK_INFO@@ r
" Size �
" Flags
�> CallbackInfo �
� SectionInfo ��
! $ ImageCharacteristics �J �> ( _LDR_VERIFY_IMAGE_INFO .?AU_LDR_VERIFY_IMAGE_INFO@@ �� �> u � 6
! CodePage �
! MaximumCharacterSize �
! DefaultChar ��
! UniDefaultChar ���
! TransDefaultChar �
!
TransUniDefaultChar ��
! DBCSCodePage �
� LeadByte �
q MultiByteTable ���
WideCharTable
q $ DBCSRanges ���
q ( DBCSOffsets ��6 �> , _CPTABLEINFO .?AU_CPTABLEINFO@@ �� �> �, $
C:
�
�8
�
�$
�
�
� # " 0 �B
# Mask �
# CompactionMask ���
�> Reserved2 B �> @ _XSAVE_AREA_HEADER .?AU_XSAVE_AREA_HEADER@@ �� �> �
>
� V � tagTouchPredictionParameters .?AUtagTouchPredictionParameters@@ ��^
u cbSize ���
u dwLatency
u dwSampleTime �
u bUseHWTimeStamp ��V �> tagTouchPredictionParameters .?AUtagTouchPredictionParameters@@ �� �> �0 b � _SYSTEM_WATCHDOG_TIMER_INFORMATION .?AU_SYSTEM_WATCHDOG_TIMER_INFORMATION@@ ��.
� WdInfoClass ��
" DataValue b �> _SYSTEM_WATCHDOG_TIMER_INFORMATION .?AU_SYSTEM_WATCHDOG_TIMER_INFORMATION@@ �� �> M
V � _FILE_VOLUME_NAME_INFORMATION .?AU_FILE_VOLUME_NAME_INFORMATION@@
�>
� 6
" DeviceNameLength �
DeviceName ���V �> _FILE_VOLUME_NAME_INFORMATION .?AU_FILE_VOLUME_NAME_INFORMATION@@ �> �
0
�
,2
�
�3
�
�,
� �, " �> " �>
�>
� � � � �> f � _SYSTEM_CRASH_DUMP_STATE_INFORMATION .?AU_SYSTEM_CRASH_DUMP_STATE_INFORMATION@@ ��*
�! CrashDumpConfigurationClass ��f �> _SYSTEM_CRASH_DUMP_STATE_INFORMATION .?AU_SYSTEM_CRASH_DUMP_STATE_INFORMATION@@ �� �> ,
k*
� �> " �>
�>
� ^
! wVk ��
! wScan
" dwFlags ��
" time �
" dwExtraInfo ��6 �> tagKEYBDINPUT .?AUtagKEYBDINPUT@@ �> �
�1
�
g1
� N � _IMAGE_CHPE_METADATA_X86 .?AU_IMAGE_CHPE_METADATA_X86@@ ��
" Version ��
" CHPECodeAddressRangeOffset ���
" CHPECodeAddressRangeCount
" WowA64ExceptionHandlerFunctionPointer
" WowA64DispatchCallFunctionPointer
" WowA64DispatchIndirectCallFunctionPointer
" WowA64DispatchIndirectCallCfgFunctionPointer �
" WowA64DispatchRetFunctionPointer �
" WowA64DispatchRetLeafFunctionPointer �
" $ WowA64DispatchJumpFunctionPointer
" ( CompilerIATPointer ���
" , WowA64RdtscFunctionPointer ���N ? 0 _IMAGE_CHPE_METADATA_X86 .?AU_IMAGE_CHPE_METADATA_X86@@ �� ? [ g
+; PfnIdentity ��> ? _MM_ETW_PAGE_INFO .?AU_MM_ETW_PAGE_INFO@@ ? O J � _PO_WAKE_SOURCE_DEVICE .?AU_PO_WAKE_SOURCE_DEVICE@@ ��.
�= Header ���
InstancePath �J ? _PO_WAKE_SOURCE_DEVICE .?AU_PO_WAKE_SOURCE_DEVICE@@ ��
?
o<
� �
� Header ���
" 0 InstanceId ���
" 4 ParentInstanceId �
� 8 ParentGuid ���
H MofData ��
" L MofLength
" P ClientContext
� P BufferContext 6
? X _EVENT_TRACE .?AU_EVENT_TRACE@@ �� ? � N � _RTL_UNLOAD_EVENT_TRACE32 .?AU_RTL_UNLOAD_EVENT_TRACE32@@ �
" BaseAddress ��
" SizeOfImage ��
" Sequence �
" TimeDateStamp
" CheckSum �
� ImageName
� T Version ��N ? \ _RTL_UNLOAD_EVENT_TRACE32 .?AU_RTL_UNLOAD_EVENT_TRACE32@@ ? L � N � _SYSTEM_BASIC_INFORMATION .?AU_SYSTEM_BASIC_INFORMATION@@ ^
" Reserved �
" TimerResolution ��
" PageSize �
" NumberOfPhysicalPages
" LowestPhysicalPageNumber �
" HighestPhysicalPageNumber
" AllocationGranularity
" MinimumUserModeAddress ���
" MaximumUserModeAddress ���
" $ ActiveProcessorsAffinityMask �
p ( NumberOfProcessors ���N ? , _SYSTEM_BASIC_INFORMATION .?AU_SYSTEM_BASIC_INFORMATION@@ ? � J � MENUITEMTEMPLATEHEADER .?AUMENUITEMTEMPLATEHEADER@@ ��
?
� .
! versionNumber
! offset ���J ? MENUITEMTEMPLATEHEADER .?AUMENUITEMTEMPLATEHEADER@@ �� ? �(
�(
� * IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF ��B t ? IMAGE_AUX_SYMBOL_TYPE .?AW4IMAGE_AUX_SYMBOL_TYPE@@ � ? [ [ Q " �R
! Version ��
! Revision �
" Count
!? Descriptors ��> "? ( _IO_RESOURCE_LIST .?AU_IO_RESOURCE_LIST@@ #? �
�'
�
�%
�
q
� n ��DPI_HOSTING_BEHAVIOR_INVALID DPI_HOSTING_BEHAVIOR_DEFAULT � DPI_HOSTING_BEHAVIOR_MIXED ���B t (? DPI_HOSTING_BEHAVIOR .?AW4DPI_HOSTING_BEHAVIOR@@ ��� )? N � _QUERY_BAD_RANGES_OUTPUT .?AU_QUERY_BAD_RANGES_OUTPUT@@ �� p% " �^
" Flags
" NumBadRanges �
# NextOffsetToLookUp ���
,? BadRanges N -? ( _QUERY_BAD_RANGES_OUTPUT .?AU_QUERY_BAD_RANGES_OUTPUT@@ �� .? S!
W
�
)<
� N � _SYSTEM_ACCESS_FILTER_ACE .?AU_SYSTEM_ACCESS_FILTER_ACE@@
2?
� :
o Header ���
" Mask �
" SidStart �N 4? _SYSTEM_ACCESS_FILTER_ACE .?AU_SYSTEM_ACCESS_FILTER_ACE@@ 5? � F � _COMPRESSED_DATA_INFO .?AU_COMPRESSED_DATA_INFO@@ �
! CompressionFormatAndEngine ���
CompressionUnitShift �
ChunkShift ���
ClusterShift �
Reserved �
! NumberOfChunks ���
� CompressedChunkSizes �F 8? _COMPRESSED_DATA_INFO .?AU_COMPRESSED_DATA_INFO@@ 9? ( �
�9
� Z � _ENCLAVE_CREATE_INFO_VBS_BASIC .?AU_ENCLAVE_CREATE_INFO_VBS_BASIC@@ ��
<?
� &
" Flags
S OwnerID ��Z >? $ _ENCLAVE_CREATE_INFO_VBS_BASIC .?AU_ENCLAVE_CREATE_INFO_VBS_BASIC@@ �� ?? ? �
�&
�
+0
� 8 C? r � _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE@@ 2
# TimeAdjustment ���
Enable ���r F? _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE@@ G? t V � _EXTENDED_ENCRYPTED_DATA_INFO .?AU_EXTENDED_ENCRYPTED_DATA_INFO@@ R
" ExtendedCode �
" Length ���
" Flags
" Reserved �V J? _EXTENDED_ENCRYPTED_DATA_INFO .?AU_EXTENDED_ENCRYPTED_DATA_INFO@@ K? � B � _REMOTE_NAME_INFOA .?AU_REMOTE_NAME_INFOA@@ ��V
p lpUniversalName ��
p lpConnectionName �
p lpRemainingPath ��B N? _REMOTE_NAME_INFOA .?AU_REMOTE_NAME_INFOA@@ �� O? 5 � J � _IMAGE_TLS_DIRECTORY64 .?AU_IMAGE_TLS_DIRECTORY64@@ ��
" ��
" ��
" ���
# StartAddressOfRawData
# EndAddressOfRawData ��
# AddressOfIndex ���
# AddressOfCallBacks ���
" SizeOfZeroFill ���
" $ Characteristics ��
R? $ Reserved0
S? $ Alignment
T? $ Reserved1 J U? ( _IMAGE_TLS_DIRECTORY64 .?AU_IMAGE_TLS_DIRECTORY64@@ �� V? [ � N � _PO_WAKE_SOURCE_INTERNAL .?AU_PO_WAKE_SOURCE_INTERNAL@@ ��
X?
� :
�= Header ���
� InternalWakeSourceType ���N Z? _PO_WAKE_SOURCE_INTERNAL .?AU_PO_WAKE_SOURCE_INTERNAL@@ �� [? '
f � _EVENT_TRACE_SOFT_RESTART_INFORMATION .?AU_EVENT_TRACE_SOFT_RESTART_INFORMATION@@ v
� EventTraceInformationClass ���
# TraceHandle ��
PersistTraceBuffers ��
FileName �f ^? _EVENT_TRACE_SOFT_RESTART_INFORMATION .?AU_EVENT_TRACE_SOFT_RESTART_INFORMATION@@ _? � W
�' ��
a?
� V � _PLUGPLAY_CUSTOM_NOTIFICATION .?AU_PLUGPLAY_CUSTOM_NOTIFICATION@@
c?
� F � _PLUGPLAY_NOTIFY_HDR .?AU_PLUGPLAY_NOTIFY_HDR@@ ��j
e? HeaderInfo ���
FileObject ���
NameBufferOffset �
| CustomDataBuffer �V f? _PLUGPLAY_CUSTOM_NOTIFICATION .?AU_PLUGPLAY_CUSTOM_NOTIFICATION@@ g? � � Z
i?
� F
Left �
Top ��
Right
Bottom ���2 k? _SMALL_RECT .?AU_SMALL_RECT@@ l? ) b � _JOBOBJECT_CONTAINER_IDENTIFIER_V2 .?AU_JOBOBJECT_CONTAINER_IDENTIFIER_V2@@ ��
n?
� J
� ContainerId ��
� ContainerTelemetryId �
" JobId b p? $ _JOBOBJECT_CONTAINER_IDENTIFIER_V2 .?AU_JOBOBJECT_CONTAINER_IDENTIFIER_V2@@ �� q? a f
�
�
b
� B � _OSVERSIONINFOEX2A .?AU_OSVERSIONINFOEX2A@@ ��
u?
� N
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
� szCSDVersion �
! � wServicePackMajor
! � wServicePackMinor
! � wSuiteMask ���
� wProductType �
� wReserved
" � wSuiteMaskEx �
" � wReserved2 ���B
w? � _OSVERSIONINFOEX2A .?AU_OSVERSIONINFOEX2A@@ �� x? ( �
]?
�
�7
�
$8 ��
|?
� }? ~?
?
� 2
} StartTime
} StartPerfClock ���: �? _ETW_REF_CLOCK .?AU_ETW_REF_CLOCK@@ �� �? � �
Address ��
! Type �
! CreatorBackTraceIndex
OwningThread �
LockCount
" ContentionCount ��
" EntryCount ���
RecursionCount ���
" NumberOfWaitingShared
" NumberOfWaitingExclusive �V
�? $ _RTL_PROCESS_LOCK_INFORMATION .?AU_RTL_PROCESS_LOCK_INFORMATION@@ �? � �
):
�
�
� V
S HashedName ���
# Expiration ���
" ( DataSize �
| , Data �Z �? 0 _SL_APPX_CACHE_VALUE_DESCRIPTOR .?AU_SL_APPX_CACHE_VALUE_DESCRIPTOR@@ �? � q " t �?
�?
� � DISPLAYCONFIG_MODE_INFO_TYPE_SOURCE �� DISPLAYCONFIG_MODE_INFO_TYPE_TARGET �� DISPLAYCONFIG_MODE_INFO_TYPE_DESKTOP_IMAGE ��� ��DISPLAYCONFIG_MODE_INFO_TYPE_FORCE_UINT32 ���R t �? DISPLAYCONFIG_MODE_INFO_TYPE .?AW4DISPLAYCONFIG_MODE_INFO_TYPE@@ ��� �? J Z � _SYSTEM_CPU_SET_TAG_INFORMATION .?AU_SYSTEM_CPU_SET_TAG_INFORMATION@@
�?
� &
# Tag ��
�< CpuSets ��Z �? _SYSTEM_CPU_SET_TAG_INFORMATION .?AU_SYSTEM_CPU_SET_TAG_INFORMATION@@ �? � �
Object ���
" UniqueProcessId ��
" HandleValue ��
" GrantedAccess
! CreatorBackTraceIndex
! ObjectTypeIndex ��
" HandleAttributes �
" Reserved �b �? _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX@@ �� �? R � _FILE_BOTH_DIR_INFORMATION .?AU_FILE_BOTH_DIR_INFORMATION@@ ��
�?
� V
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
p D ShortNameLength ��
F ShortName
^ FileName �R �? ` _FILE_BOTH_DIR_INFORMATION .?AU_FILE_BOTH_DIR_INFORMATION@@ �� �?
1)
�
j&
� �0 �? �0 �. �? " " �?
�?
�
�
� : � _FP_IEEE_RECORD .?AU_FP_IEEE_RECORD@@ : � _FP_IEEE_VALUE .?AU_FP_IEEE_VALUE@@ ��>
�? Operand1 �
�? Operand2 �
�? 0 Result ���: �? H _FP_IEEE_RECORD .?AU_FP_IEEE_RECORD@@ �? + �
�
�
J!
�
1
�
�
�
�
�
" ��
" ��
" ��
" ��
" ��
" Flags
�? ProhibitDynamicCode ��
�? AllowThreadOptOut
�? AllowRemoteDowngrade �
�? AuditProhibitDynamicCode �
�? ReservedFlags j �? _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY .?AU_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY@@ �? C x
�< ��
�?
�
h
�
�4
� j EtwCompressionModeRestart EtwCompressionModeNoDisable �� EtwCompressionModeNoRestart ��V t �? ETW_COMPRESSION_RESUMPTION_MODE .?AW4ETW_COMPRESSION_RESUMPTION_MODE@@ � �? � " �?
�?
� V � _ETW_KERNEL_HEADER_EXTENSION .?AU_ETW_KERNEL_HEADER_EXTENSION@@ ��.
� GroupMasks ���
" Version ��V �? $ _ETW_KERNEL_HEADER_EXTENSION .?AU_ETW_KERNEL_HEADER_EXTENSION@@ �� �? � � 2 � SC_HANDLE__ .?AUSC_HANDLE__@@
t unused ���2 �? SC_HANDLE__ .?AUSC_HANDLE__@@ �? 3 � N � SYSTEM_POWER_CAPABILITIES .?AUSYSTEM_POWER_CAPABILITIES@@
�?
� J � BATTERY_REPORTING_SCALE .?AUBATTERY_REPORTING_SCALE@@ �? " �R
PowerButtonPresent ���
SleepButtonPresent ���
LidPresent ���
SystemS1 �
SystemS2 �
SystemS3 �
SystemS4 �
SystemS5 �
HiberFilePresent �
FullWake �
VideoDimPresent ��
ApmPresent ���
UpsPresent ���
ThermalControl ���
ProcessorThrottle
ProcessorMinThrottle �
ProcessorMaxThrottle �
FastSystemS4 �
Hiberboot
WakeAlarmPresent �
AoAc �
DiskSpinDown �
HiberFileType
AoAcConnectivitySupported
� spare3 ���
SystemBatteriesPresent ���
BatteriesAreShortTerm
�? BatteryScale �
S 8 AcOnLineWake �
S < SoftLidWake ��
S @ RtcWake ��
S D MinDeviceWakeState ���
S H DefaultLowLatencyWake N ! �? L SYSTEM_POWER_CAPABILITIES .?AUSYSTEM_POWER_CAPABILITIES@@ �? �
�&
� B � _GRADIENT_TRIANGLE .?AU_GRADIENT_TRIANGLE@@ ��>
" Vertex1 ��
" Vertex2 ��
" Vertex3 ��B �? _GRADIENT_TRIANGLE .?AU_GRADIENT_TRIANGLE@@ �� �? 3 : � _FNSAVE_FORMAT .?AU_FNSAVE_FORMAT@@ ��
" ControlWord ��
" StatusWord ���
" TagWord ��
" ErrorOffset ��
" ErrorSelector
" DataOffset ���
" DataSelector �
�# RegisterArea �: �? l _FNSAVE_FORMAT .?AU_FNSAVE_FORMAT@@ �� �? � � ^ � _TIMER_SET_COALESCABLE_TIMER_INFO .?AU_TIMER_SET_COALESCABLE_TIMER_INFO@@
�?
�
�!
� J � _COUNTED_REASON_CONTEXT .?AU_COUNTED_REASON_CONTEXT@@
�?
� �
} DueTime ��
�? TimerApcRoutine ��
TimerContext �
�? WakeContext ��
" Period ���
" TolerableDelay ���
PreviousState ^ �? _TIMER_SET_COALESCABLE_TIMER_INFO .?AU_TIMER_SET_COALESCABLE_TIMER_INFO@@ �? { �
O! ��
�?
� Z KernelRequester �� UserProcessRequester � UserSharedServiceRequester ���6 t �? _REQUESTER_TYPE .?AW4_REQUESTER_TYPE@@ � �? �
?5
�
1<
� V � _COMPOUND_ACCESS_ALLOWED_ACE .?AU_COMPOUND_ACCESS_ALLOWED_ACE@@ ��
�?
� j
o Header ���
" Mask �
! CompoundAceType ��
!
Reserved �
" SidStart �V �? _COMPOUND_ACCESS_ALLOWED_ACE .?AU_COMPOUND_ACCESS_ALLOWED_ACE@@ �� �? ] �
%'
�
-
�
Y
� F
BaseAddress ��
" Flags
! EntryOverhead
!
CreatorBackTraceIndex
" BytesAllocated ���
" BytesCommitted ���
" NumberOfTags �
" NumberOfEntries ��
" NumberOfPseudoTags ���
" PseudoTagGranularity �
� $ Reserved �
�? 8 Tags �
�? < Entries ��F
�? @ _RTL_HEAP_INFORMATION .?AU_RTL_HEAP_INFORMATION@@ �? L 6
�%
� > � FIND_BY_SID_DATA .?AUFIND_BY_SID_DATA@@ ��&
" Restart ��
� Sid ��> �? FIND_BY_SID_DATA .?AUFIND_BY_SID_DATA@@ �� �? �
�
� �0 " �"
" Count
�? Uuid �6 �? _UUID_VECTOR .?AU_UUID_VECTOR@@ �� �? � h Z � _FSCTL_QUERY_REGION_INFO_INPUT .?AU_FSCTL_QUERY_REGION_INFO_INPUT@@ ��
�?
� f
" Version ��
" Size �
" Flags
" NumberOfTierIds ��
^ TierIds ��Z @ _FSCTL_QUERY_REGION_INFO_INPUT .?AU_FSCTL_QUERY_REGION_INFO_INPUT@@ �� @ �
:.
� � AR_ENABLED ��� AR_DISABLED �� AR_SUPPRESSED AR_REMOTESESSION � AR_MULTIMON �� AR_NOSENSOR �� AR_NOT_SUPPORTED � @ AR_DOCKED � AR_LAPTOP . t @ tagAR_STATE .?AW4tagAR_STATE@@ � @ �= Z � _SYSTEM_SECUREBOOT_INFORMATION .?AU_SYSTEM_SECUREBOOT_INFORMATION@@ ��:
SecureBootEnabled
SecureBootCapable Z @ _SYSTEM_SECUREBOOT_INFORMATION .?AU_SYSTEM_SECUREBOOT_INFORMATION@@ ��
@ � B � _RTL_RXACT_CONTEXT .?AU_RTL_RXACT_CONTEXT@@ ��
7
� ^
RootRegistryKey ��
RXactKey �
HandlesValid �
@ RXactLog �B @ _RTL_RXACT_CONTEXT .?AU_RTL_RXACT_CONTEXT@@ �� @ L �
�5
� " �Z
LangSpec �
! FallbackTypes
! Reserved �
@ FallbackSpecs : @ _MUILANGCFGNODE .?AU_MUILANGCFGNODE@@ @ � D
�>
�
�
�
�!
� 6 � tagFILTERKEYS .?AUtagFILTERKEYS@@ �
u cbSize ���
" dwFlags ��
" iWaitMSec
" iDelayMSec ���
" iRepeatMSec ��
" iBounceMSec ��6 @ tagFILTERKEYS .?AUtagFILTERKEYS@@ @ �3 V � tagACTCTX_SECTION_KEYED_DATA .?AUtagACTCTX_SECTION_KEYED_DATA@@ ��
@
� z � tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AUtagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ ��>
" cbSize ���
" ulDataFormatVersion ��
lpData ���
" ulLength �
lpSectionGlobalData ��
" ulSectionGlobalDataLength
lpSectionBase
" ulSectionTotalLength �
hActCtx ��
" $ ulAssemblyRosterIndex
" ( ulFlags ��
@ , AssemblyMetadata �V @ @ tagACTCTX_SECTION_KEYED_DATA .?AUtagACTCTX_SECTION_KEYED_DATA@@ �� !@ � �
#@
�
� �� %@ " �
�6
� : � _DISCDLGSTRUCTA .?AU_DISCDLGSTRUCTA@@ r
" cbStructure ��
y hwndOwner
p lpLocalName ��
p lpRemoteName �
" dwFlags ��: )@ _DISCDLGSTRUCTA .?AU_DISCDLGSTRUCTA@@ *@ 5 � 6 � RTL_ACE_DATA .?AURTL_ACE_DATA@@ ��
,@
�
� b
AceType ��
InheritFlags �
AceFlags �
" Mask �
.@ Sid ��6 /@ RTL_ACE_DATA .?AURTL_ACE_DATA@@ �� 0@ L � V � _SEMAPHORE_BASIC_INFORMATION .?AU_SEMAPHORE_BASIC_INFORMATION@@ ��2
CurrentCount �
MaximumCount �V 3@ _SEMAPHORE_BASIC_INFORMATION .?AU_SEMAPHORE_BASIC_INFORMATION@@ �� 4@ �
B
� p u u 7@
8@
� > � _KEY_VALUE_ENTRY .?AU_KEY_VALUE_ENTRY@@ ��V
< ValueName
" DataLength ���
" DataOffset ���
" Type �> ;@ _KEY_VALUE_ENTRY .?AU_KEY_VALUE_ENTRY@@ �� <@ � k
�
�
�;
� V � _SILOOBJECT_BASIC_INFORMATION .?AU_SILOOBJECT_BASIC_INFORMATION@@
@@
� z
" SiloId ���
" SiloParentId �
" NumberOfProcesses
IsInServerSilo ���
�
Reserved �V B@ _SILOOBJECT_BASIC_INFORMATION .?AU_SILOOBJECT_BASIC_INFORMATION@@ C@ C �
E@
�
@
�
! ��
! ��>
H@ PageRelativeOffset ���
I@ RegisterNumber ���v J@ _IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION .?AU_IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION@@ �� K@ [ �
�
�
� Z � _PS_CPU_QUOTA_QUERY_INFORMATION .?AU_PS_CPU_QUOTA_QUERY_INFORMATION@@
O@
� F= " �:
" SessionCount �
Q@ SessionInformation ���Z R@ _PS_CPU_QUOTA_QUERY_INFORMATION .?AU_PS_CPU_QUOTA_QUERY_INFORMATION@@ S@ a > � tagMENUITEMINFOW .?AUtagMENUITEMINFOW@@ ���
u cbSize ���
u fMask
u fType
u fState ���
u wID ��
2 hSubMenu �
hbmpChecked ��
hbmpUnchecked
" dwItemData ���
q $ dwTypeData ���
u ( cch ��
, hbmpItem �> V@ 0 tagMENUITEMINFOW .?AUtagMENUITEMINFOW@@ �� W@ �
1%
�
�;
� �. " [@
\@
� F � _RPC_PROTSEQ_VECTORW .?AU_RPC_PROTSEQ_VECTORW@@ �� q " �&
u Count
_@ Protseq ��F `@ _RPC_PROTSEQ_VECTORW .?AU_RPC_PROTSEQ_VECTORW@@ �� a@ � �
A"
� J � DISPLAYCONFIG_MODE_INFO .?AUDISPLAYCONFIG_MODE_INFO@@ N � DISPLAYCONFIG_SOURCE_MODE .?AUDISPLAYCONFIG_SOURCE_MODE@@ ^ � DISPLAYCONFIG_DESKTOP_IMAGE_INFO .?AUDISPLAYCONFIG_DESKTOP_IMAGE_INFO@@ ��
�? infoType �
u id ���
I adapterId
(/ targetMode ���
e@ sourceMode ���
f@ desktopImageInfo �J g@ @ DISPLAYCONFIG_MODE_INFO .?AUDISPLAYCONFIG_MODE_INFO@@ h@ o �
Data �
" AssemblyRosterIndex ��
ResolutionContext
� Root �
KnownRoot
" RootCount
CancelResolution � j@ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING@@ k@ L z B � _TP_DEBUG_FREE_INFO .?AU_TP_DEBUG_FREE_INFO@@
" FreeListSize �B n@ _TP_DEBUG_FREE_INFO .?AU_TP_DEBUG_FREE_INFO@@ o@ � ;
/0
�
L x
L y 2 r@ tagPOINTFX .?AUtagPOINTFX@@ �� s@ �
R � _WIN32_FILE_ATTRIBUTE_DATA .?AU_WIN32_FILE_ATTRIBUTE_DATA@@ ��
u@
� �
" dwFileAttributes �
� ftCreationTime ���
� ftLastAccessTime �
� ftLastWriteTime ��
" nFileSizeHigh
" nFileSizeLow �R w@ $ _WIN32_FILE_ATTRIBUTE_DATA .?AU_WIN32_FILE_ATTRIBUTE_DATA@@ �� x@ � X
D.
� ^ � _PERFINFO_WORKINGSET_INFORMATION .?AU_PERFINFO_WORKINGSET_INFORMATION@@ ��
{@
� R � _PERFINFO_WORKINGSET_ENTRY .?AU_PERFINFO_WORKINGSET_ENTRY@@ �� }@ " $ �&
" Count
~@ WsEntry ��^ @ ( _PERFINFO_WORKINGSET_INFORMATION .?AU_PERFINFO_WORKINGSET_INFORMATION@@ �� �@ � � > � _PERFORMANCE_DATA .?AU_PERFORMANCE_DATA@@ 8 " ��
! Size �
Version ��
HwCountersCount ��
" ContextSwitchCount ���
# WaitReasonBitMap �
# CycleTime
" RetryCount ���
" Reserved �
�@ HwCounters ���> �@ _PERFORMANCE_DATA .?AU_PERFORMANCE_DATA@@ �@ L 3 R
# FileMapping ��
" Size �
" HashSeed �
" HashCount b �@ _ETW_COVERAGE_SAMPLER_BLOOM_FILTER .?AU_ETW_COVERAGE_SAMPLER_BLOOM_FILTER@@ �� �@ � � J � _ETW_SET_KTIMER2_EVENT .?AU_ETW_SET_KTIMER2_EVENT@@ ��
# DueTime ��
# MaximumDueTime ���
# Period ���
" TimerKey �
" Callback �
" CallbackContextKey ���
$ Flags J �@ ( _ETW_SET_KTIMER2_EVENT .?AU_ETW_SET_KTIMER2_EVENT@@ �� �@ � � . � _COMSTAT .?AU_COMSTAT@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
�@ fCtsHold �
�@ fDsrHold �
�@ fRlsdHold
�@ fXoffHold
�@ fXoffSent
�@ fEof �
�@ fTxim
�@ fReserved
" cbInQue ��
" cbOutQue �.
�@ _COMSTAT .?AU_COMSTAT@@ �� �@ �
�
� R � _ETW_REFDEREF_OBJECT_EVENT .?AU_ETW_REFDEREF_OBJECT_EVENT@@ ��
�@
� 6
Object ���
" Tag ��
" Count R �@ _ETW_REFDEREF_OBJECT_EVENT .?AU_ETW_REFDEREF_OBJECT_EVENT@@ �� �@ � p
2 � _NIC_RECORD .?AU_NIC_RECORD@@
�@
� " �"
� NICName ��
" Index
" PhysicalAddrLen ��
Y4 PhysicalAddr �
" Size �
IpAddress
SubnetMask ���
$DhcpServer ���
(Gateway ��
,PrimaryWinsServer
0SecondaryWinsServer ��
�@ 4DnsServer
" DData �2
�@ H_NIC_RECORD .?AU_NIC_RECORD@@ �@ � L R � _TXFS_QUERY_RM_INFORMATION .?AU_TXFS_QUERY_RM_INFORMATION@@ ��
" BytesRequired
# TailLsn ��
# CurrentLsn ���
# ArchiveTailLsn ���
# LogContainerSize �
} ( HighestVirtualClock ��
" 0 LogContainerCount
" 4 LogContainerCountMax �
" 8 LogContainerCountMin �
" < LogGrowthIncrement ���
" @ LogAutoShrinkPercentage ��
" D Flags
! H LoggingMode ��
! J Reserved �
" L RmState ��
# P LogCapacity ��
# X LogFree ��
# ` TopsSize �
# h TopsUsed �
# p TransactionCount �
# x OnePCCount ���
# � TwoPCCount ���
# � NumberLogFileFull
# � OldestTransactionAge �
� � RMName ���
" � TmLogPathOffset ��R �@ � _TXFS_QUERY_RM_INFORMATION .?AU_TXFS_QUERY_RM_INFORMATION@@ �� �@ W b � _ETW_UMS_EVENT_DIRECTED_SWITCH_END .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_END@@ ��f
" ProcessId
" ScheduledThreadId
" PrimaryThreadId ��
" SwitchFlags ��b �@ _ETW_UMS_EVENT_DIRECTED_SWITCH_END .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_END@@ �� �@ � |
-"
� N � _RTL_DEBUG_INFORMATION32 .?AU_RTL_DEBUG_INFORMATION32@@ ��b
" SectionHandleClient ��
" ViewBaseClient ���
" ViewBaseTarget ���
" ViewBaseDelta
" EventPairClient ��
" EventPairTarget ��
" TargetProcessId ��
" TargetThreadHandle ���
" Flags
" $ OffsetFree ���
" ( CommitSize ���
" , ViewSize �
" 0 Modules ��
" 0 ModulesEx
" 4 BackTraces ���
" 8 Heaps
" < Locks
" @ SpecificHeap �
" D TargetProcessHandle ��
" H VerifierOptions ��
" L ProcessHeap ��
" P CriticalSectionHandle
" T CriticalSectionOwnerThread ���
� X Reserved �N �@ h _RTL_DEBUG_INFORMATION32 .?AU_RTL_DEBUG_INFORMATION32@@ �� �@ L �
�;
� " " � ~' " $ �R
p locale ���
q wlocale ��
t refcount �
t wrefcount : �@ <anonymous-tag> .?AU<anonymous-tag>@@ �@ �' �@ " ` �& � lconv .?AUlconv@@
�@
� : � __lc_time_data .?AU__lc_time_data@@ ��
�@
� �
t refcount �
u lc_codepage ��
u lc_collate_cp
�@ lc_handle
�@ $ lc_id
�@ H lc_category ��
t � lc_clike �
t � mb_cur_max ���
t � lconv_intl_refcount ��
t � lconv_num_refcount ���
t � lconv_mon_refcount ���
�@ � lconv
t � ctype1_refcount ��
q � ctype1 ���
� � pctype ���
� � pclmap ���
� � pcumap ���
�@ � lc_time_curr �J �@ � threadlocaleinfostruct .?AUthreadlocaleinfostruct@@ �� �@ �' R � _ETW_COVERAGE_SAMPLER_STATS .?AU_ETW_COVERAGE_SAMPLER_STATS@@ �
SamplesAdded �
SamplesFound �
SamplesDropped ���
SamplesRaisedUM ��
SamplesMappedUM ��
SamplesRaisedKM ��
SamplesMappedKM ��
SamplingPaused ���
ApcNotAvailable ��
$ CaptureBufferNotAvailable
( SampleBufferNotAvailable �
, ProfileSampleCount ���
0 CSwitchSampleCount ���
4 RThreadSampleCount ���
8 PGFaultSampleCount ���R �@ < _ETW_COVERAGE_SAMPLER_STATS .?AU_ETW_COVERAGE_SAMPLER_STATS@@ �@ � �
� " �@
�/
� y t �@
�@
� N � _CM_EISA_SLOT_INFORMATION .?AU_CM_EISA_SLOT_INFORMATION@@
�@
� �
ReturnCode ���
ReturnFlags ��
MajorRevision
MinorRevision
! Checksum �
NumberFunctions ��
FunctionInformation ��
" CompressedId �N �@ _CM_EISA_SLOT_INFORMATION .?AU_CM_EISA_SLOT_INFORMATION@@ �@ � ) * � HFONT__ .?AUHFONT__@@
t unused ���* �@ HFONT__ .?AUHFONT__@@ �@ V
w4
�
<
� 6 � _INPUT_RECORD .?AU_INPUT_RECORD@@ z
* KeyEvent �
&" MouseEvent ���
�7 WindowBufferSizeEvent
(7 MenuEvent
�* FocusEvent ���2 �@ <anonymous-tag> .?AT<anonymous-tag>@@ �@ | &
! EventType
�@ Event 6 �@ _INPUT_RECORD .?AU_INPUT_RECORD@@ �@ z
�9
�
n1
� ^ � _RPC_BINDING_HANDLE_SECURITY_V1_A .?AU_RPC_BINDING_HANDLE_SECURITY_V1_A@@
�@
� �
" Version ��
ServerPrincName ��
" AuthnLevel ���
" AuthnSvc �
4 AuthIdentity �
�' SecurityQos ��^ �@ _RPC_BINDING_HANDLE_SECURITY_V1_A .?AU_RPC_BINDING_HANDLE_SECURITY_V1_A@@ �@ � B � FILE_ID_DESCRIPTOR .?AUFILE_ID_DESCRIPTOR@@ ��
�@
� j
" dwSize ���
' Type �
} FileId ���
� ObjectId �
� ExtendedFileId ���B �@ FILE_ID_DESCRIPTOR .?AUFILE_ID_DESCRIPTOR@@ �� �@ �# J � PPM_WMI_PERF_STATES_EX .?AUPPM_WMI_PERF_STATES_EX@@ ���
" Count
" MaxFrequency �
" CurrentState �
" MaxPerfState �
" MinPerfState �
" LowestPerfState ��
" ThermalConstraint
BusyAdjThreshold �
PolicyType ���
Type �
Reserved �
" TimerInterval
$ TargetProcessors �
" ( PStateHandler
" , PStateContext
" 0 TStateHandler
" 4 TStateContext
" 8 FeedbackHandler ��
" < Reserved1
# @ Reserved2
�5 H State J �@ � PPM_WMI_PERF_STATES_EX .?AUPPM_WMI_PERF_STATES_EX@@ �� �@ � V � _JOBOBJECT_FREEZE_INFORMATION .?AU_JOBOBJECT_FREEZE_INFORMATION@@
�@
�
" ��
" ��
" ��
" ���
" Flags
�@ FreezeOperation ��
�@ FilterOperation ��
�@ SwapOperation
�@ Reserved �
Freeze ���
Swap �
� Reserved0
� WakeFilter ���V �@ _JOBOBJECT_FREEZE_INFORMATION .?AU_JOBOBJECT_FREEZE_INFORMATION@@ �@ a N � _ETW_DISKIO_READWRITE_V3 .?AU_ETW_DISKIO_READWRITE_V3@@ ��
�@
� �
" DiskNumber ���
" IrpFlags �
" Size �
" Reserved �
# ByteOffset ���
FileObject ���
IrpAddr ��
# HighResResponseTime ��
" ( IssuingThreadId ��N �@ 0 _ETW_DISKIO_READWRITE_V3 .?AU_ETW_DISKIO_READWRITE_V3@@ �� �@ � � : � HWINEVENTHOOK__ .?AUHWINEVENTHOOK__@@
t unused ���: �@ HWINEVENTHOOK__ .?AUHWINEVENTHOOK__@@ �@ b \ �@ 6 � _HEAP_SUMMARY .?AU_HEAP_SUMMARY@@ r
" cb ���
" cbAllocated ��
" cbCommitted ��
" cbReserved ���
" cbMaxReserve �6 A _HEAP_SUMMARY .?AU_HEAP_SUMMARY@@ 2 onecore\external\sdk\inc\minwin\heapapi.h �� A A +
�&
� R � _IMAGE_DYNAMIC_RELOCATION64 .?AU_IMAGE_DYNAMIC_RELOCATION64@@
A
� .
# Symbol ���
" BaseRelocSize R A _IMAGE_DYNAMIC_RELOCATION64 .?AU_IMAGE_DYNAMIC_RELOCATION64@@
A [ � : � _XSAVE_VENDORS .?AU_XSAVE_VENDORS@@ ��
A
� � " 8 �2
" NumberOfVendors ��
A Vendor ���: A @ _XSAVE_VENDORS .?AU_XSAVE_VENDORS@@ �� A � �
�
� " @ �B
" dvReserved ���
" dvNumAxes
A dvValues �: A H tagDESIGNVECTOR .?AUtagDESIGNVECTOR@@ A �
�
� 2
CommOffset ���
FaultOffset ��B A _COMM_FAULT_OFFSETS .?AU_COMM_FAULT_OFFSETS@@ A � �
�'
�
Y
�
�<
� : � BITMAPV5HEADER .?AUBITMAPV5HEADER@@ ��
A
� B
" bV5Size ��
bV5Width �
bV5Height
! bV5Planes
! bV5BitCount ��
" bV5Compression ���
" bV5SizeImage �
bV5XPelsPerMeter �
bV5YPelsPerMeter �
" bV5ClrUsed ���
" $ bV5ClrImportant ��
" ( bV5RedMask ���
" , bV5GreenMask �
" 0 bV5BlueMask ��
" 4 bV5AlphaMask �
" 8 bV5CSType
; < bV5Endpoints �
" ` bV5GammaRed ��
" d bV5GammaGreen
" h bV5GammaBlue �
" l bV5Intent
" p bV5ProfileData ���
" t bV5ProfileSize ���
" x bV5Reserved ��: A | BITMAPV5HEADER .?AUBITMAPV5HEADER@@ �� !A a 2
# Ptr ��
" Size �
" Type �N #A _EVENT_FILTER_DESCRIPTOR .?AU_EVENT_FILTER_DESCRIPTOR@@ �� $A � H R � _PERFINFO_BOOT_PHASE_START .?AU_PERFINFO_BOOT_PHASE_START@@ ��
Phase R 'A _PERFINFO_BOOT_PHASE_START .?AU_PERFINFO_BOOT_PHASE_START@@ �� (A � �
�
� f � DISPLAYCONFIG_SET_TARGET_PERSISTENCE .?AUDISPLAYCONFIG_SET_TARGET_PERSISTENCE@@ ��
u ��
u ��V
y header ���
,A bootPersistenceOn
-A reserved �
u value f .A DISPLAYCONFIG_SET_TARGET_PERSISTENCE .?AUDISPLAYCONFIG_SET_TARGET_PERSISTENCE@@ �� /A .
C3
�
�
�
\
� f � _SYSTEM_LOGICAL_PROCESSOR_INFORMATION .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION@@
Flags : 5A <anonymous-tag> .?AU<anonymous-tag>@@ 6A {
" NodeNumber ���: 8A <anonymous-tag> .?AU<anonymous-tag>@@ 9A { �
" ProcessorMask
� Relationship �
6A ProcessorCore
9A NumaNode �
�1 Cache
� Reserved �f ;A _SYSTEM_LOGICAL_PROCESSOR_INFORMATION .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION@@ <A { b � _SYSTEM_CONTEXT_SWITCH_INFORMATION .?AU_SYSTEM_CONTEXT_SWITCH_INFORMATION@@ ��
>A
�
" ContextSwitches ��
" FindAny ��
" FindLast �
" FindIdeal
" IdleAny ��
" IdleCurrent ��
" IdleLast �
" IdleIdeal
" PreemptAny ���
" $ PreemptCurrent ���
" ( PreemptLast ��
" , SwitchToIdle �b @A 0 _SYSTEM_CONTEXT_SWITCH_INFORMATION .?AU_SYSTEM_CONTEXT_SWITCH_INFORMATION@@ �� AA �
f � _JOBOBJECT_EXTENDED_LIMIT_INFORMATION .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION@@
CA
� �
�* BasicLimitInformation
B 0 IoInfo ���
" ` ProcessMemoryLimit ���
" d JobMemoryLimit ���
" h PeakProcessMemoryUsed
" l PeakJobMemoryUsed f EA p _JOBOBJECT_EXTENDED_LIMIT_INFORMATION .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION@@ FA C `
S!
� F � _RPC_PROTSEQ_VECTORA .?AU_RPC_PROTSEQ_VECTORA@@ �� " �&
u Count
JA Protseq ��F KA _RPC_PROTSEQ_VECTORA .?AU_RPC_PROTSEQ_VECTORA@@ �� LA � �
$
�
� " OA Z � _FILE_PROVIDER_EXTERNAL_INFO_V1 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V1@@ :
" Version ��
" Algorithm
" Flags Z RA _FILE_PROVIDER_EXTERNAL_INFO_V1 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V1@@ SA }" F � _SERVICE_TABLE_ENTRYA .?AU_SERVICE_TABLE_ENTRYA@@
UA
�
p
� " WA XA
YA
� 2
p lpServiceName
ZA lpServiceProc F [A _SERVICE_TABLE_ENTRYA .?AU_SERVICE_TABLE_ENTRYA@@ \A 3 y V � _ETW_TP_EVENT_TIMER_CANCELLED .?AU_ETW_TP_EVENT_TIMER_CANCELLED@@ :
� Header ���
SubQueue �
$ Timer V _A ( _ETW_TP_EVENT_TIMER_CANCELLED .?AU_ETW_TP_EVENT_TIMER_CANCELLED@@ `A �
�
� f � _EVENT_TRACE_HEAP_TRACING_INFORMATION .?AU_EVENT_TRACE_HEAP_TRACING_INFORMATION@@ >
� EventTraceInformationClass ���
� ProcessId f dA _EVENT_TRACE_HEAP_TRACING_INFORMATION .?AU_EVENT_TRACE_HEAP_TRACING_INFORMATION@@ eA � #
� NotificationType �
" NotificationSize �
" Offset ���
ReplyRequested ���
" Timeout ��
" ReplyCount ���
" NotifyeeCount
# Reserved2
" TargetPID
" $ SourcePID
� ( DestinationGuid ��
� 8 SourceGuid ���N gA H _ETW_NOTIFICATION_HEADER .?AU_ETW_NOTIFICATION_HEADER@@ �� hA � H f � _PERFINFO_DRIVER_COMPLETE_REQUEST_RET .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST_RET@@ *
Irp ��
" UniqMatchId ��f kA _PERFINFO_DRIVER_COMPLETE_REQUEST_RET .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST_RET@@ lA �
�
� F � _PO_WAKE_SOURCE_INFO .?AU_PO_WAKE_SOURCE_INFO@@ ��
oA
� &
" Count
� Offsets ��F qA _PO_WAKE_SOURCE_INFO .?AU_PO_WAKE_SOURCE_INFO@@ �� rA 5
w;
� Z � _MEMORY_EXHAUSTION_INFORMATION .?AU_MEMORY_EXHAUSTION_INFORMATION@@ ��J
! Version ��
! Reserved �
�9 Type �
" Value Z vA _MEMORY_EXHAUSTION_INFORMATION .?AU_MEMORY_EXHAUSTION_INFORMATION@@ �� wA C �
_
� R � _CREATE_PROCESS_DEBUG_INFO .?AU_CREATE_PROCESS_DEBUG_INFO@@ ���
hFile
hProcess �
hThread ��
lpBaseOfImage
" dwDebugInfoFileOffset
" nDebugInfoSize ���
lpThreadLocalBase
�4 lpStartAddress ���
lpImageName ��
! $ fUnicode �R
{A ( _CREATE_PROCESS_DEBUG_INFO .?AU_CREATE_PROCESS_DEBUG_INFO@@ �� |A c ; ~A
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
�A NoRemoteImages ���
�A NoLowMandatoryLabelImages
�A PreferSystem32Images �
�A AuditNoRemoteImages ��
�A AuditNoLowMandatoryLabelImages ���
�A ReservedFlags f �A _PROCESS_MITIGATION_IMAGE_LOAD_POLICY .?AU_PROCESS_MITIGATION_IMAGE_LOAD_POLICY@@ �A C �
�
�
�
�
m@
�
�
�
�:
� > � _FILE_RENAME_INFO .?AU_FILE_RENAME_INFO@@ v
ReplaceIfExists ��
" Flags
RootDirectory
" FileNameLength ���
FileName �> �A _FILE_RENAME_INFO .?AU_FILE_RENAME_INFO@@ �A �" J � _WIN32_FIND_STREAM_DATA .?AU_WIN32_FIND_STREAM_DATA@@
�A
� q " P �2
} StreamSize ���
�A cStreamName ��J �A X_WIN32_FIND_STREAM_DATA .?AU_WIN32_FIND_STREAM_DATA@@ �A � S B � USN_JOURNAL_DATA_V0 .?AUUSN_JOURNAL_DATA_V0@@
�A
� �
# UsnJournalID �
FirstUsn �
NextUsn ��
LowestValidUsn ���
MaxUsn ���
# ( MaximumSize ��
# 0 AllocationDelta ��B �A 8 USN_JOURNAL_DATA_V0 .?AUUSN_JOURNAL_DATA_V0@@ �A � : � tagEMRRESTOREDC .?AUtagEMRRESTOREDC@@ &
emr ��
iRelative : �A tagEMRRESTOREDC .?AUtagEMRRESTOREDC@@ �A w
�(
�
b(
� J � _IMAGE_FUNCTION_ENTRY64 .?AU_IMAGE_FUNCTION_ENTRY64@@ j
# StartingAddress ��
# EndingAddress
# EndOfPrologue
# UnwindInfoAddress J �A _IMAGE_FUNCTION_ENTRY64 .?AU_IMAGE_FUNCTION_ENTRY64@@ �A [
�
� &
" Address ��
" Data �N �A _RTL_STACK_CONTEXT_ENTRY .?AU_RTL_STACK_CONTEXT_ENTRY@@ �� �A � � B � _CONNECTDLGSTRUCTA .?AU_CONNECTDLGSTRUCTA@@ ��
�A
�
�<
� j
" cbStructure ��
y hwndOwner
�A lpConnRes
" dwFlags ��
" dwDevNum �B �A _CONNECTDLGSTRUCTA .?AU_CONNECTDLGSTRUCTA@@ �� �A 5 �
(
� J � _RPC_SECURITY_QOS_V5_A .?AU_RPC_SECURITY_QOS_V5_A@@ ��
�A
�
�- HttpCredentials ��2 �A <anonymous-tag> .?AT<anonymous-tag>@@ �A � } �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
�A u
Sid ��
u EffectiveOnly
ServerSecurityDescriptor �J �A $ _RPC_SECURITY_QOS_V5_A .?AU_RPC_SECURITY_QOS_V5_A@@ �� �A � v
�?
�
�A
�
0
� " � " �
! Flags
! Reserved �
! LangId ���
LangNameIndex
! FallbackTypes
NeutralLangSpec ��
�A FallbackSpecs
�A AlternateCodePage 6 �A _MUILANGINFO .?AU_MUILANGINFO@@ �� �A � 1 N � _CM_PNP_BIOS_DEVICE_NODE .?AU_CM_PNP_BIOS_DEVICE_NODE@@ ��j
! Size �
Node �
" ProductId
� DeviceType ���
!
DeviceAttributes �N �A _CM_PNP_BIOS_DEVICE_NODE .?AU_CM_PNP_BIOS_DEVICE_NODE@@ �� �A � [
�A
�A
�
m9
� J � _PROCESS_PRIORITY_CLASS .?AU_PROCESS_PRIORITY_CLASS@@ 2
Foreground ���
PriorityClass J �A _PROCESS_PRIORITY_CLASS .?AU_PROCESS_PRIORITY_CLASS@@ �A a 9 ^ � _FILE_MAILSLOT_QUERY_INFORMATION .?AU_FILE_MAILSLOT_QUERY_INFORMATION@@ ��
" MaximumMessageSize ���
" MailslotQuota
" NextMessageSize ��
" MessagesAvailable
} ReadTimeout ��^ �A _FILE_MAILSLOT_QUERY_INFORMATION .?AU_FILE_MAILSLOT_QUERY_INFORMATION@@ �� �A c
� N � _PERFINFO_SPINLOCK_CONFIG .?AU_PERFINFO_SPINLOCK_CONFIG@@ �
" SpinLockSpinThreshold
" SpinLockContentionSampleRate �
" SpinLockAcquireSampleRate
" SpinLockHoldThreshold N �A _PERFINFO_SPINLOCK_CONFIG .?AU_PERFINFO_SPINLOCK_CONFIG@@ �A � �
�4
� B � _CI_LOG_MMCSS_START .?AU_CI_LOG_MMCSS_START@@
�A
�
� Header ���B �A 0 _CI_LOG_MMCSS_START .?AU_CI_LOG_MMCSS_START@@ �A � a
$(
�
F!
�
h+
� b � _SYSTEM_ENTROPY_TIMING_INFORMATION .?AU_SYSTEM_ENTROPY_TIMING_INFORMATION@@ ��
�A
� �?
�A
�
�?
� ^
�A EntropyRoutine ���
�A InitializationRoutine
InitializationContext b �A _SYSTEM_ENTROPY_TIMING_INFORMATION .?AU_SYSTEM_ENTROPY_TIMING_INFORMATION@@ �� �A
J
�
�
� ^ � _IR_TIMER_EXTRA_CREATE_PARAMETER .?AU_IR_TIMER_EXTRA_CREATE_PARAMETER@@ ��2
! ComponentId ��
! RelativeId ���^ �A _IR_TIMER_EXTRA_CREATE_PARAMETER .?AU_IR_TIMER_EXTRA_CREATE_PARAMETER@@ �� �A 9
�
�
A+
� V � _FILE_ALLOCATED_RANGE_BUFFER .?AU_FILE_ALLOCATED_RANGE_BUFFER@@ ��.
} FileOffset ���
} Length ���V �A _FILE_ALLOCATED_RANGE_BUFFER .?AU_FILE_ALLOCATED_RANGE_BUFFER@@ �� �A �
3
� > � _SYSDBG_BUS_DATA .?AU_SYSDBG_BUS_DATA@@ ��
" Address ��
Buffer ���
" Request ��
�" BusDataType ��
" BusNumber
" SlotNumber ���> �A _SYSDBG_BUS_DATA .?AU_SYSDBG_BUS_DATA@@ �� �A > � _ALPC_DIRECT_ATTR .?AU_ALPC_DIRECT_ATTR@@
Event > �A _ALPC_DIRECT_ATTR .?AU_ALPC_DIRECT_ATTR@@ �A � f 2 � _WMI_TCPIP .?AU_WMI_TCPIP@@ ��
�A
� v
" Context ��
" Size �
" DestAddr �
" SrcAddr ��
! DestPort �
! SrcPort ��2 �A _WMI_TCPIP .?AU_WMI_TCPIP@@ �� B �
�'
�
!
� ^ � _MIDL_INTERFACE_METHOD_PROPERTIES .?AU_MIDL_INTERFACE_METHOD_PROPERTIES@@
B ��
B
� �
� TransferSyntax ���
B DispatchTable
� ProcString ���
� FmtStringOffset ��
� TypeString ���
$ aUserMarshalQuadruple
B ( pMethodProperties
" , pReserved2 ���> B 0 _MIDL_SYNTAX_INFO .?AU_MIDL_SYNTAX_INFO@@ B � � �
" Internal �
" InternalHigh �
" Offset ���
" OffsetHigh ���
Pointer ��
hEvent ���2
B _OVERLAPPED .?AU_OVERLAPPED@@ B c 4 V � tagEMREXTCREATEFONTINDIRECTW .?AUtagEMREXTCREATEFONTINDIRECTW@@ ��6
emr ��
" ihFont ���
u* elfw �V B LtagEMREXTCREATEFONTINDIRECTW .?AUtagEMREXTCREATEFONTINDIRECTW@@ �� B ?
�
� V � _WIM_PROVIDER_START_INTEGRITY .?AU_WIM_PROVIDER_START_INTEGRITY@@
} DataSourceId �V B _WIM_PROVIDER_START_INTEGRITY .?AU_WIM_PROVIDER_START_INTEGRITY@@ B ]"
�(
� J � _ETW_DEBUG_PRINT_EVENT .?AU_ETW_DEBUG_PRINT_EVENT@@ ��:
" Component
" Level
� Message ��J B _ETW_DEBUG_PRINT_EVENT .?AU_ETW_DEBUG_PRINT_EVENT@@ �� B � 2
� SC_ACTION_NONE ��� SC_ACTION_RESTART SC_ACTION_REBOOT � SC_ACTION_RUN_COMMAND SC_ACTION_OWN_RESTART 6 t B _SC_ACTION_TYPE .?AW4_SC_ACTION_TYPE@@ � B 3
V � _PERFINFO_CC_WORKITEM_DEQUEUE .?AU_PERFINFO_CC_WORKITEM_DEQUEUE@@
B
�
" WorkItemKey ��V B _PERFINFO_CC_WORKITEM_DEQUEUE .?AU_PERFINFO_CC_WORKITEM_DEQUEUE@@ !B � � R � _RTL_UNICODE_STRING_BUFFER .?AU_RTL_UNICODE_STRING_BUFFER@@ ��2 � _RTL_BUFFER .?AU_RTL_BUFFER@@ Z
� String ���
%B ByteBuffer ���
� MinimumStaticBufferForTerminalNul R &B _RTL_UNICODE_STRING_BUFFER .?AU_RTL_UNICODE_STRING_BUFFER@@ ��6 onecore\internal\sdk\inc\ntrtlstringandbuffer.h 'B (B �
2
�
�0
� >
" dwDataType ���
" cbData ���
pData b ,B _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM .?AU_SERVICE_TRIGGER_SPECIFIC_DATA_ITEM@@ -B 3 l
! ��
! ��
!
��
! ��
! ��z
/B PageRelativeOffset ���
0B IndirectCall �
1B RexWPrefix ���
2B CfgCheck �
3B Reserved �~ 4B _IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@ �� 5B [ � " P P " @- 7B
8B
� J � _LDR_DATA_TABLE_ENTRY32 .?AU_LDR_DATA_TABLE_ENTRY32@@ �
InLoadOrderLinks �
InMemoryOrderLinks ���
InInitializationOrderLinks ���
" DllBase ��
" EntryPoint ���
" SizeOfImage ��
X) $ FullDllName ��
X) , BaseDllName ��
" 4 Flags
! 8 LoadCount
! : TlsIndex �
< HashLinks
" < SectionPointer ���
" @ CheckSum �
" D TimeDateStamp
" D LoadedImports J ;B H _LDR_DATA_TABLE_ENTRY32 .?AU_LDR_DATA_TABLE_ENTRY32@@ <B u 6 � _DEBUG_EVENT .?AU_DEBUG_EVENT@@ ��N � _EXIT_PROCESS_DEBUG_INFO .?AU_EXIT_PROCESS_DEBUG_INFO@@ ��F � _LOAD_DLL_DEBUG_INFO .?AU_LOAD_DLL_DEBUG_INFO@@ ��N � _OUTPUT_DEBUG_STRING_INFO .?AU_OUTPUT_DEBUG_STRING_INFO@@ . � _RIP_INFO .?AU_RIP_INFO@@ �
�5 Exception
�4 CreateThread �
zA CreateProcessInfo
�1 ExitThread ���
?B ExitProcess ��
@B LoadDll ��
�- UnloadDll
AB DebugString ��
BB RipInfo ��2 CB T <anonymous-tag> .?AT<anonymous-tag>@@ DB c m Z
" dwDebugEventCode �
" dwProcessId ��
" dwThreadId ���
DB u 6 FB ` _DEBUG_EVENT .?AU_DEBUG_EVENT@@ �� GB c i ^ � _PERFINFO_DRIVER_COMPLETE_REQUEST .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST@@ B
RoutineAddr ��
Irp ��
" UniqMatchId ��^ JB _PERFINFO_DRIVER_COMPLETE_REQUEST .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST@@ KB � > � tagEMRALPHABLEND .?AUtagEMRALPHABLEND@@ ��R
emr ��
� rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
� 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d cxSrc
h cySrc > NB l tagEMRALPHABLEND .?AUtagEMRALPHABLEND@@ �� OB � " � " # # v QB
RB
�
�4
� N � _OBJECT_TYPES_INFORMATION .?AU_OBJECT_TYPES_INFORMATION@@
" NumberOfTypes N VB _OBJECT_TYPES_INFORMATION .?AU_OBJECT_TYPES_INFORMATION@@ WB � R
�@
�
J0
�
m7
� R � tagTOUCH_HIT_TESTING_INPUT .?AUtagTOUCH_HIT_TESTING_INPUT@@ ��z
u pointerId
x point
� boundingBox ��
� nonOccludedBoundingBox ���
u , orientation ��R ]B 0 tagTOUCH_HIT_TESTING_INPUT .?AUtagTOUCH_HIT_TESTING_INPUT@@ �� ^B , F � _WOF_EXTERNAL_FILE_ID .?AU_WOF_EXTERNAL_FILE_ID@@
`B
�
� FileId ���F bB _WOF_EXTERNAL_FILE_ID .?AU_WOF_EXTERNAL_FILE_ID@@ cB �!
I/
� b � _WMI_EXTENDED_THREAD_INFORMATION64 .?AU_WMI_EXTENDED_THREAD_INFORMATION64@@ ��
fB
� v
" ProcessId
" ThreadId �
# StackBase64 ��
# StackLimit64 �
# UserStackBase64 ��
# UserStackLimit64 �
# ( StartAddr64 ��
# ( Affinity �
# 0 Win32StartAddr64 �
# 8 TebBase64
" @ SubProcessTag
p D BasePriority �
E PagePriority �
F IoPriority ���
G Flags
H ThreadName ���b hB P _WMI_EXTENDED_THREAD_INFORMATION64 .?AU_WMI_EXTENDED_THREAD_INFORMATION64@@ �� iB � (
4
� * � HTASK__ .?AUHTASK__@@
lB
�
t unused ���* nB HTASK__ .?AUHTASK__@@ oB ' :
" BaseAddress ��
" Size �
" Flags j qB _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE@@ rB C �
-
�
O>
� " @ �
� SourceId �
# Policy ���
0 ResultCode ���
ResultStatus �
# Time �
" EntropyLength
vB $ EntropyData ��Z wB h _BOOT_ENTROPY_SOURCE_NT_RESULT .?AU_BOOT_ENTROPY_SOURCE_NT_RESULT@@ �� xB D
W6
�
/
� R � tagUPDATELAYEREDWINDOWINFO .?AUtagUPDATELAYEREDWINDOWINFO@@ ��
|B
�
x ��
~B
�
� ��
�B
� : � _BLENDFUNCTION .?AU_BLENDFUNCTION@@ ��
�B ��
�B
�
� ��
�B
� �
" cbSize ���
b hdcDst ���
B pptDst ���
�B psize
b hdcSrc ���
B pptSrc ���
" crKey
�B pblend ���
" dwFlags ��
�B $ prcDirty �R
�B ( tagUPDATELAYEREDWINDOWINFO .?AUtagUPDATELAYEREDWINDOWINFO@@ �� �B �
�-
�
�+
� > � tagEMRPOLYDRAW16 .?AUtagEMRPOLYDRAW16@@ ��Z
emr ��
� rclBounds
" cpts �
� apts �
K abTypes ��> �B $ tagEMRPOLYDRAW16 .?AUtagEMRPOLYDRAW16@@ �� �B Z R � _JOURNAL_CLIENT_INFORMATION .?AU_JOURNAL_CLIENT_INFORMATION@@ r
} StartTimeStamp ���
} CurrentTimeStamp �
# RecordsToProcess �
" RelativeFillLevel R �B _JOURNAL_CLIENT_INFORMATION .?AU_JOURNAL_CLIENT_INFORMATION@@ �B 3 J � tagEMRGLSBOUNDEDRECORD .?AUtagEMRGLSBOUNDEDRECORD@@ ��J
emr ��
� rclBounds
" cbData ���
K Data �J �B tagEMRGLSBOUNDEDRECORD .?AUtagEMRGLSBOUNDEDRECORD@@ �� �B �
�
� b � _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_V2@@
�B
� 2
# ClientSession
ClientProcess b �B _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_V2@@ �B =)
�8
� �% " p � ! " ( �
�B Timelines
�% CpuTimeline ��
�% DiskTimeline �
�% NetworkTimeline ��
�% MBBTimeline ��
�% ForegroundTimeline ���
�% ( DesktopVisibleTimeline ���
�% 0 CompositionRenderedTimeline ��
�% 8 CompositionDirtyGeneratedTimeline
�% @ CompositionDirtyPropagatedTimeline ���
�% H InputTimeline
�% P AudioInTimeline ��
�% X AudioOutTimeline �
�% ` DisplayRequiredTimeline ��
�% h KeyboardInputTimeline
�B p Durations
! p InputDuration
! x AudioInDuration ��
! � AudioOutDuration �
! � DisplayRequiredDuration ��
! � PSMBackgroundDuration
" � KeyboardInput
" � MouseInput ���^ �B � _PROCESS_ENERGY_VALUES_EXTENSION .?AU_PROCESS_ENERGY_VALUES_EXTENSION@@ �� �B a E
p
� B � _ENCRYPTION_BUFFER .?AU_ENCRYPTION_BUFFER@@ ��6
" EncryptionOperation ��
| Private ��B �B _ENCRYPTION_BUFFER .?AU_ENCRYPTION_BUFFER@@ �� �B �
�.
� J � DISPLAYCONFIG_2DREGION .?AUDISPLAYCONFIG_2DREGION@@ ��"
u cx ���
u cy ���J �B DISPLAYCONFIG_2DREGION .?AUDISPLAYCONFIG_2DREGION@@ �� �B &
" Offset ���
" Flags F �B _CFG_CALL_TARGET_INFO .?AU_CFG_CALL_TARGET_INFO@@ �B ? �
,
�
� Z � _POWER_THROTTLING_THREAD_STATE .?AU_POWER_THROTTLING_THREAD_STATE@@ ��B
" Version ��
" ControlMask ��
" StateMask Z �B _POWER_THROTTLING_THREAD_STATE .?AU_POWER_THROTTLING_THREAD_STATE@@ �� �B C � N � _TPP_THREAD_DATA_CALLBACK .?AU_TPP_THREAD_DATA_CALLBACK@@ V � _SHARED_VIRTUAL_DISK_SUPPORT .?AU_SHARED_VIRTUAL_DISK_SUPPORT@@ ��>
M SharedVirtualDiskSupport �
� HandleState ��V �B _SHARED_VIRTUAL_DISK_SUPPORT .?AU_SHARED_VIRTUAL_DISK_SUPPORT@@ �� �B �'
�(
�
-
�
�*
�
} PerProcessUserTimeLimit ��
} PerJobUserTimeLimit ��
" LimitFlags ���
" MinimumWorkingSetSize
" MaximumWorkingSetSize
" ActiveProcessLimit ���
" Affinity �
" $ PriorityClass
" ( SchedulingClass ��b �B 0 _JOBOBJECT_BASIC_LIMIT_INFORMATION .?AU_JOBOBJECT_BASIC_LIMIT_INFORMATION@@ �� �B C T V � _MANAGE_HOT_PATCH_LOAD_PATCH .?AU_MANAGE_HOT_PATCH_LOAD_PATCH@@ ��
�B
� &
� Sid ��
Z Buffer ���2 �B D <anonymous-tag> .?AT<anonymous-tag>@@ �B ` R
" Version ��
� PatchPath
�B UserSid ��
�. P BaseInfo �V �B X _MANAGE_HOT_PATCH_LOAD_PATCH .?AU_MANAGE_HOT_PATCH_LOAD_PATCH@@ �� �B R N � _SYSTEM_VDM_INSTEMUL_INFO .?AU_SYSTEM_VDM_INSTEMUL_INFO@@ R
" SegmentNotPresent
" VdmOpcode0F ��
" OpcodeESPrefix ���
" OpcodeCSPrefix ���
" OpcodeSSPrefix ���
" OpcodeDSPrefix ���
" OpcodeFSPrefix ���
" OpcodeGSPrefix ���
" OpcodeOPER32Prefix ���
" $ OpcodeADDR32Prefix ���
" ( OpcodeINSB ���
" , OpcodeINSW ���
" 0 OpcodeOUTSB ��
" 4 OpcodeOUTSW ��
" 8 OpcodePUSHF ��
" < OpcodePOPF ���
" @ OpcodeINTnn ��
" D OpcodeINTO ���
" H OpcodeIRET ���
" L OpcodeINBimm �
" P OpcodeINWimm �
" T OpcodeOUTBimm
" X OpcodeOUTWimm
" \ OpcodeINB
" ` OpcodeINW
" d OpcodeOUTB ���
" h OpcodeOUTW ���
" l OpcodeLOCKPrefix �
" p OpcodeREPNEPrefix
" t OpcodeREPPrefix ��
" x OpcodeHLT
" | OpcodeCLI
" � OpcodeSTI
" � BopCount �N " �B � _SYSTEM_VDM_INSTEMUL_INFO .?AU_SYSTEM_VDM_INSTEMUL_INFO@@ �B �
�
�
�1
� � SystemActivityModerationStateSystemManaged ��� SystemActivityModerationStateUserManagedAllowThrottling �� SystemActivityModerationStateUserManagedDisableThrottling MaxSystemActivityModerationState �Z t �B _SYSTEM_ACTIVITY_MODERATION_STATE .?AW4_SYSTEM_ACTIVITY_MODERATION_STATE@@ � �B
?9
�
�9
� 6 � _TOKEN_OWNER .?AU_TOKEN_OWNER@@ ��
Owner 6 �B _TOKEN_OWNER .?AU_TOKEN_OWNER@@ �� �B � J � _CONSOLE_SELECTION_INFO .?AU_CONSOLE_SELECTION_INFO@@ J
" dwFlags ��
'" dwSelectionAnchor
: srSelection ��J �B _CONSOLE_SELECTION_INFO .?AU_CONSOLE_SELECTION_INFO@@ �B �$ k
&"
� R � _FILE_OBJECTID_INFORMATION .?AU_FILE_OBJECTID_INFORMATION@@ ��
�B
� �
FileReference
� ObjectId �
� BirthVolumeId
� ( BirthObjectId
� 8 DomainId �
�5 ExtendedInfo �R �B H _FILE_OBJECTID_INFORMATION .?AU_FILE_OBJECTID_INFORMATION@@ �� �B d 6 � tagEXTLOGPEN .?AUtagEXTLOGPEN@@ ��
" elpPenStyle ��
" elpWidth �
u elpBrushStyle
" elpColor �
" elpHatch �
" elpNumEntries
� elpStyleEntry 6 �B tagEXTLOGPEN .?AUtagEXTLOGPEN@@ �� �B x
Z=
� > � _VM_COUNTERS_EX2 .?AU_VM_COUNTERS_EX2@@ ��
�B
� V
�- CountersEx ���
" 0 PrivateWorkingSetSize
# 8 SharedCommitUsage > �B @ _VM_COUNTERS_EX2 .?AU_VM_COUNTERS_EX2@@ �� �B C
u
� Z � _KEY_VALUE_PARTIAL_INFORMATION .?AU_KEY_VALUE_PARTIAL_INFORMATION@@ ��R
" TitleIndex ���
" Type �
" DataLength ���
| Data �Z �B _KEY_VALUE_PARTIAL_INFORMATION .?AU_KEY_VALUE_PARTIAL_INFORMATION@@ �� �B � Y R � _PO_SPR_ACTIVE_SESSION_DATA .?AU_PO_SPR_ACTIVE_SESSION_DATA@@ .
Start
� ActiveSessionGuid R �B _PO_SPR_ACTIVE_SESSION_DATA .?AU_PO_SPR_ACTIVE_SESSION_DATA@@ �B ?
�
� EventTraceInformationClass ���
CoverageSamplerInformationClass ��
MajorVersion �
MinorVersion �
Reserved �
# SamplerHandle n �B _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION .?AU_EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION@@ �B � �
�
� N � _INVERTED_FUNCTION_TABLE .?AU_INVERTED_FUNCTION_TABLE@@ ��
�B
� p " �n
" CurrentSize ��
" MaximumSize ��
M Epoch
Overflow �
�B TableEntry ���N �B _INVERTED_FUNCTION_TABLE .?AU_INVERTED_FUNCTION_TABLE@@ �� �B � � f � _CSV_QUERY_FILE_REVISION_FILE_ID_128 .?AU_CSV_QUERY_FILE_REVISION_FILE_ID_128@@ �� " �.
� FileId ���
C FileRevision �f C ( _CSV_QUERY_FILE_REVISION_FILE_ID_128 .?AU_CSV_QUERY_FILE_REVISION_FILE_ID_128@@ �� C �
�
� J � _FILE_DISPOSITION_INFO .?AU_FILE_DISPOSITION_INFO@@ ��
DeleteFileA ��J C _FILE_DISPOSITION_INFO .?AU_FILE_DISPOSITION_INFO@@ �� C �" n � _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION@@ �
} IdleTime �
} KernelTime ���
} UserTime �
} DpcTime ��
} InterruptTime
" ( InterruptCount ���n C 0 _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION@@ C �
&A
�
�(
�
� z � _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION .?AU_SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION@@ ��
C
� >
" NumberOfLogicalProcessors
" NumberOfCores z C _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION .?AU_SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION@@ �� C
�
� n � DISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION .?AUDISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION@@ ��
u ��
u ��f
y header ���
C disableMonitorVirtualResolution ��
C reserved �
u value n C DISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION .?AUDISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION@@ �� C <
A)
�
�9
�
>B
� ^ � _RTL_IMAGE_MITIGATION_DEP_POLICY .?AU_RTL_IMAGE_MITIGATION_DEP_POLICY@@ ��
C
�
N Dep ��^ "C _RTL_IMAGE_MITIGATION_DEP_POLICY .?AU_RTL_IMAGE_MITIGATION_DEP_POLICY@@ �� #C � , b � _PERFINFO_VIRTUAL_ALLOC_XPARTITION .?AU_PERFINFO_VIRTUAL_ALLOC_XPARTITION@@ ��6
CapturedBase �
! TargetPartition ��b &C _PERFINFO_VIRTUAL_ALLOC_XPARTITION .?AU_PERFINFO_VIRTUAL_ALLOC_XPARTITION@@ �� 'C � `
3
� B � tagUSEROBJECTFLAGS .?AUtagUSEROBJECTFLAGS@@ ��>
t fInherit �
t fReserved
" dwFlags ��B +C tagUSEROBJECTFLAGS .?AUtagUSEROBJECTFLAGS@@ �� ,C �
Q/
� � " �
K& Header ���
� FileReferenceNumber ��
� ParentFileReferenceNumber
( Usn ��
" 0 Reason ���
" 4 SourceInfo ���
" 8 RemainingExtents �
! < NumberOfExtents ��
! > ExtentSize ���
/C @ Extents ��6
0C P USN_RECORD_V4 .?AUUSN_RECORD_V4@@ 1C � R � _ACCESS_ALLOWED_OBJECT_ACE .?AU_ACCESS_ALLOWED_OBJECT_ACE@@ ��
o Header ���
" Mask �
" Flags
� ObjectType ���
� InheritedObjectType ��
" , SidStart �R 4C 0 _ACCESS_ALLOWED_OBJECT_ACE .?AU_ACCESS_ALLOWED_OBJECT_ACE@@ �� 5C �
�
�
54
�
;6
� f � _PROCESS_READWRITEVM_LOGGING_INFORMATION .?AT_PROCESS_READWRITEVM_LOGGING_INFORMATION@@ ��
��
��
��f
Flags
;C EnableReadVmLogging ��
<C EnableWriteVmLogging �
=C Unused ���f >C _PROCESS_READWRITEVM_LOGGING_INFORMATION .?AT_PROCESS_READWRITEVM_LOGGING_INFORMATION@@ �� ?C C Q N � _ImageArchitectureHeader .?AU_ImageArchitectureHeader@@ ��
u ��
u ��J
BC AmaskValue ���
CC AmaskShift ���
" FirstEntryRVA N DC _ImageArchitectureHeader .?AU_ImageArchitectureHeader@@ �� EC [ Z J � _IMAGE_DEBUG_DIRECTORY .?AU_IMAGE_DEBUG_DIRECTORY@@ ���
" Characteristics ��
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" Type �
" SizeOfData ���
" AddressOfRawData �
" PointerToRawData �J HC _IMAGE_DEBUG_DIRECTORY .?AU_IMAGE_DEBUG_DIRECTORY@@ �� IC [ � b � _SYSTEM_VERIFIER_FAULTS_INFORMATION .?AU_SYSTEM_VERIFIER_FAULTS_INFORMATION@@ b
" Probability ��
" MaxProbability ���
� PoolTags �
� Applications �b LC _SYSTEM_VERIFIER_FAULTS_INFORMATION .?AU_SYSTEM_VERIFIER_FAULTS_INFORMATION@@ MC � f � _FILE_IO_PRIORITY_HINT_INFORMATION_EX .?AU_FILE_IO_PRIORITY_HINT_INFORMATION_EX@@ 6
PriorityHint �
BoostOutstanding �f PC _FILE_IO_PRIORITY_HINT_INFORMATION_EX .?AU_FILE_IO_PRIORITY_HINT_INFORMATION_EX@@ QC �
`
� � " � �
" CommittedMemory ��
" ReservedMemory ���
" NumberOfBackTraceLookups �
" NumberOfBackTraces ���
TC BackTraces ���J UC � _RTL_PROCESS_BACKTRACES .?AU_RTL_PROCESS_BACKTRACES@@ VC � �
$$
� J f � _ACTIVATION_CONTEXT_BASIC_INFORMATION .?AU_ACTIVATION_CONTEXT_BASIC_INFORMATION@@ V
� ActivationContext
hActCtx ��
" Flags
" dwFlags ��f [C _ACTIVATION_CONTEXT_BASIC_INFORMATION .?AU_ACTIVATION_CONTEXT_BASIC_INFORMATION@@ \C L �
�<
�
4
� p t `C
aC
�
d2
� F � _FILE_ALLOCATION_INFO .?AU_FILE_ALLOCATION_INFO@@
dC
�
} AllocationSize ���F fC _FILE_ALLOCATION_INFO .?AU_FILE_ALLOCATION_INFO@@ gC �"
V+
� B � _RDR_CALLOUT_STATE .?AU_RDR_CALLOUT_STATE@@ ��
jC
�
kC lC
mC
�
�
� r � _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY .?AU_RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY@@ ��
pC
� *
N DisallowChildProcessCreation �r rC _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY .?AU_RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY@@ �� sC � L
�=
� �
} KernelTime ���
} UserTime �
} CreateTime ���
" WaitTime �
StartAddress �
� ClientId �
( Priority �
, BasePriority �
" 0 ContextSwitches ��
" 4 ThreadState ��
" 8 WaitReason ���R vC @ _SYSTEM_THREAD_INFORMATION .?AU_SYSTEM_THREAD_INFORMATION@@ �� wC F J � BULK_SECURITY_TEST_DATA .?AUBULK_SECURITY_TEST_DATA@@ 2
" DesiredAccess
� SecurityIds ��J zC BULK_SECURITY_TEST_DATA .?AUBULK_SECURITY_TEST_DATA@@ {C �
�
� �
" Magic
" Count
" Size �
" UserCount
" UserSize �
UserContext ��
}C Next �
Trace > ~C _RTL_TRACE_BLOCK .?AU_RTL_TRACE_BLOCK@@ �� C � N � _ETW_DISKIO_READWRITE_V2 .?AU_ETW_DISKIO_READWRITE_V2@@ ��
" DiskNumber ���
" IrpFlags �
" Size �
" Reserved �
# ByteOffset ���
FileObject ���
IrpAddr ��
# HighResResponseTime ��N �C ( _ETW_DISKIO_READWRITE_V2 .?AU_ETW_DISKIO_READWRITE_V2@@ �� �C � � i%
�C
� >
u lbStyle ��
" lbColor ��
" lbHatch ��6 �C tagLOGBRUSH32 .?AUtagLOGBRUSH32@@ �C R
I �C : PortBasicInformation � PortDumpInformation ��F t �C _PORT_INFORMATION_CLASS .?AW4_PORT_INFORMATION_CLASS@@ � �C � � " [@ F � SYSTEM_BATTERY_STATE .?AUSYSTEM_BATTERY_STATE@@ �� " �
AcOnLine �
BatteryPresent ���
Charging �
Discharging ��
�C Spare1 ���
Tag ��
" MaxCapacity ��
" RemainingCapacity
" Rate �
" EstimatedTime
" DefaultAlert1
" DefaultAlert2 F �C SYSTEM_BATTERY_STATE .?AUSYSTEM_BATTERY_STATE@@ �� �C 0 2 � _DataStream .?AU_DataStream@@ J
! Length ���
! Flags
" Reserved �
# Vdl ��2 �C _DataStream .?AU_DataStream@@ �C �
�
�
�(
�
E2
� 6 � tagMETARECORD .?AUtagMETARECORD@@
�C
� ! " �B
" rdSize ���
! rdFunction ���
�C rdParm ���6 �C tagMETARECORD .?AUtagMETARECORD@@ �C �
�
�
-
�
�?
�
l
� b � _PERFINFO_PO_CALIBRATED_PERFCOUNTER .?AU_PERFINFO_PO_CALIBRATED_PERFCOUNTER@@ "
} PerformanceCounter ���b �C _PERFINFO_PO_CALIBRATED_PERFCOUNTER .?AU_PERFINFO_PO_CALIBRATED_PERFCOUNTER@@ �C � �
N!
�
A
� F � _LBR_TRACE_EVENT_DATA .?AU_LBR_TRACE_EVENT_DATA@@ � " �f
# TimeStamp
" ProcessId
" ThreadId �
" Options ��
�C Entries ��F �C _LBR_TRACE_EVENT_DATA .?AU_LBR_TRACE_EVENT_DATA@@ �C � v � _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY@@ ^
N BlockNonMicrosoftSignedBinaries ��
N EnforceSigningOnModuleDependencies ���v �C _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY@@ �C � � � � N � _ETW_HEAP_EVENT_EXPANSION .?AU_ETW_HEAP_EVENT_EXPANSION@@ �
� Header ���
HeapHandle ���
" $ CommittedSize
( Address ��
" , FreeSpace
" 0 CommittedSpace ���
" 4 ReservedSpace
" 8 NoOfUCRs �
" < AllocatedSpace ���N �C @ _ETW_HEAP_EVENT_EXPANSION .?AU_ETW_HEAP_EVENT_EXPANSION@@ �C � �
�1
� V
" Flags
NewTlsData ���
OldTlsData ���
ThreadId �J �C _THREAD_TLS_INFORMATION .?AU_THREAD_TLS_INFORMATION@@ �C a b
�?
� v PROXY_CALCSIZE ��� PROXY_GETBUFFER �� PROXY_MARSHAL PROXY_SENDRECEIVE PROXY_UNMARSHAL ��. t �C PROXY_PHASE .?AW4PROXY_PHASE@@ � �C � N
V � _JOURNAL_ABSOLUTE_INFORMATION .?AU_JOURNAL_ABSOLUTE_INFORMATION@@
�C
� f
} StartTimeStamp ���
} EndTimeStamp �
# NumberOfRecords ��
" FillLevel V �C _JOURNAL_ABSOLUTE_INFORMATION .?AU_JOURNAL_ABSOLUTE_INFORMATION@@ �C 3 �
�
�
�
�
n.
�
�B
� R � _TRACE_ENABLE_FLAG_EXT_ITEM .?AU_TRACE_ENABLE_FLAG_EXT_ITEM@@ &
! Offset ���
! Type �R �C _TRACE_ENABLE_FLAG_EXT_ITEM .?AU_TRACE_ENABLE_FLAG_EXT_ITEM@@ �C � $
�"
�
m
� b � _EVENT_TRACE_GROUPMASK_INFORMATION .?AU_EVENT_TRACE_GROUPMASK_INFORMATION@@ ��b
� EventTraceInformationClass ���
# TraceHandle ��
� EventTraceGroupMasks �b �C 0 _EVENT_TRACE_GROUPMASK_INFORMATION .?AU_EVENT_TRACE_GROUPMASK_INFORMATION@@ �� �C � � F � _SINGLE_LIST_ENTRY32 .?AU_SINGLE_LIST_ENTRY32@@ ��
" Next �F �C _SINGLE_LIST_ENTRY32 .?AU_SINGLE_LIST_ENTRY32@@ �� �C � >
� Id ���
" Flags
SpaceGuarantee ���^ �C _STORAGE_RESERVE_AREA_DEFINITION .?AU_STORAGE_RESERVE_AREA_DEFINITION@@ �� �C �* B
" OffsetInstanceData ���
" LengthInstanceData ���R �C OFFSETINSTANCEDATAANDLENGTH .?AUOFFSETINSTANCEDATAANDLENGTH@@ �C 8 � �
" SegmentReserveSize ���
" SegmentCommitSize
" SegmentCount �
" AllocatedSize
" LargeAllocReserveSize
" LargeAllocCommitSize �v �C _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION .?AU_SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION@@ �C L : � tagEMRFILLPATH .?AUtagEMRFILLPATH@@ ��&
emr ��
� rclBounds : �C tagEMRFILLPATH .?AUtagEMRFILLPATH@@ �� �C � R
p lpDebugStringData
! fUnicode �
! nDebugStringLength ���N �C _OUTPUT_DEBUG_STRING_INFO .?AU_OUTPUT_DEBUG_STRING_INFO@@ �C c ] N � _CSV_QUERY_FILE_REVISION .?AU_CSV_QUERY_FILE_REVISION@@ ��
�C
� .
FileId ���
C FileRevision �N �C _CSV_QUERY_FILE_REVISION .?AU_CSV_QUERY_FILE_REVISION@@ �� �C l *
�< ntmTm
. H ntmFontSig ���B �C ` tagNEWTEXTMETRICEXA .?AUtagNEWTEXTMETRICEXA@@ �C
�;
� b
" Attribute
" Size �
" Value
ValuePtr �
" ReturnLength �6 �C _PS_ATTRIBUTE .?AU_PS_ATTRIBUTE@@ �C a �
UB
� ~ � _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION@@ �� !; " �J
" ProcessorNumber ��
" StateCount ���
�C States ���~ �C _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION@@ �� �C . � _Reparse .?AU_Reparse@@ ��" � _Ea .?AU_Ea@@ ^
-. DesiredStorageClass ��
�C DataStream ���
�C Reparse ��
�C Ea ���: �C _StreamInformation .?AT_StreamInformation@@ �� �C �
%-
�
�'
�
�2
� > � _IMAGE_SYMBOL_EX .?AU_IMAGE_SYMBOL_EX@@ ��"
" Short
" Long �: D <anonymous-tag> .?AU<anonymous-tag>@@ D [ { :
� ShortName
D Name �
� LongName �2 D <anonymous-tag> .?AT<anonymous-tag>@@ D [ y ~
D N
" Value
SectionNumber
! Type �
StorageClass �
NumberOfAuxSymbols ���>
D _IMAGE_SYMBOL_EX .?AU_IMAGE_SYMBOL_EX@@ �� D [ x
�
�
:
� j ` D
uA
� V � _PERFINFO_DOMAIN_CHANGE_EVENT .?AU_PERFINFO_DOMAIN_CHANGE_EVENT@@ >
# NewDomain
; Reason ���
" ThreadId �V D _PERFINFO_DOMAIN_CHANGE_EVENT .?AU_PERFINFO_DOMAIN_CHANGE_EVENT@@ D � #
�8
� F
" SizeStruct ���
" Option ���
| OptionData ���V D _RTL_PROCESS_VERIFIER_OPTIONS .?AU_RTL_PROCESS_VERIFIER_OPTIONS@@ D � � " D
D
� : � _EXCEPTION_LOG .?AU_EXCEPTION_LOG@@ ��
D
� �
D ExceptionRecord ��
P ContextRecord
� Type �
Disposition ��
" $Thread ���
" (ControlPc
,Handler ��: D 0_EXCEPTION_LOG .?AU_EXCEPTION_LOG@@ �� D � �
" pointerType ��
u pointerId
u frameId ��
u pointerFlags �
sourceDevice �
y hwndTarget ���
x ptPixelLocation ��
x ptHimetricLocation ���
x ( ptPixelLocationRaw ���
x 0 ptHimetricLocationRaw
" 8 dwTime ���
u < historyCount �
t @ InputData
" D dwKeyStates ��
# H PerformanceCount �
& P ButtonChangeType �: "D X tagPOINTER_INFO .?AUtagPOINTER_INFO@@ #D � R � _TXFS_GET_METADATA_INFO_OUT .?AU_TXFS_GET_METADATA_INFO_OUT@@ *
LowPart ��
HighPart �: &D <anonymous-tag> .?AU<anonymous-tag>@@ 'D � f
'D TxfFileId
� LockingTransaction ���
# LastLsn ��
" ( TransactionState �R )D 0 _TXFS_GET_METADATA_INFO_OUT .?AU_TXFS_GET_METADATA_INFO_OUT@@ *D � V � _CONSOLE_SCREEN_BUFFER_INFOEX .?AU_CONSOLE_SCREEN_BUFFER_INFOEX@@ " " @ ��
" cbSize ���
'" dwSize ���
'" dwCursorPosition �
! wAttributes ��
: srWindow �
'" dwMaximumWindowSize ��
! wPopupAttributes �
t bFullscreenSupported �
-D ColorTable ���V .D ` _CONSOLE_SCREEN_BUFFER_INFOEX .?AU_CONSOLE_SCREEN_BUFFER_INFOEX@@ /D : �
:@
�
�
� y p " t 4D
5D
� V � _PLUGPLAY_CONTROL_DEPTH_DATA .?AU_PLUGPLAY_CONTROL_DEPTH_DATA@@ ��6
� DeviceInstance ���
" DeviceDepth ��V 8D _PLUGPLAY_CONTROL_DEPTH_DATA .?AU_PLUGPLAY_CONTROL_DEPTH_DATA@@ �� 9D � � F � _PO_WAKE_SOURCE_FIXED .?AU_PO_WAKE_SOURCE_FIXED@@ 6
�= Header ���
G6 FixedWakeSourceType ��F <D _PO_WAKE_SOURCE_FIXED .?AU_PO_WAKE_SOURCE_FIXED@@ =D "
A
� >
" FeatureId
?D Vendors ��
# Unused ���: @D _XSAVE_FEATURE .?AU_XSAVE_FEATURE@@ �� AD � �
J0
� r � _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX@@ ��
DD
� �
EnableIntegrity ��
KeepIntegrityStateUnchanged ��
! Reserved �
" Flags
Version ��
� Reserved2 r FD _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX@@ �� GD �
'"
�
4
� j � _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST@@
KD
� 2
" RequestLevel �
" RequestFlags �j MD _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST@@ ND ;
� % PD F QD
RD
� &
� Next �
SD Handler ��Z TD _EXCEPTION_REGISTRATION_RECORD .?AU_EXCEPTION_REGISTRATION_RECORD@@ �� UD C
`,
� F � _REPAIR_COPIES_OUTPUT .?AU_REPAIR_COPIES_OUTPUT@@
XD
� B
" Size �
Status ���
} ResumeFileOffset �F ZD _REPAIR_COPIES_OUTPUT .?AU_REPAIR_COPIES_OUTPUT@@ [D F
�
� TP_DEBUG_CLASS_POOL ��6 t ^D _TP_DEBUG_CLASS .?AW4_TP_DEBUG_CLASS@@ � _D � 5
_D
�
U@
�
o
�
�!
�
Tail �6 eD _LDRP_CSLIST .?AU_LDRP_CSLIST@@ �� fD u � * � HUMPD__ .?AUHUMPD__@@
hD
�
t unused ���* jD HUMPD__ .?AUHUMPD__@@ kD x � TOKEN_SECURITY_ATTRIBUTE_OPERATION_NONE �� TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL ��� TOKEN_SECURITY_ATTRIBUTE_OPERATION_ADD ��� TOKEN_SECURITY_ATTRIBUTE_OPERATION_DELETE TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE ���^ t mD _TOKEN_SECURITY_ATTRIBUTE_OPERATION .?AW4_TOKEN_SECURITY_ATTRIBUTE_OPERATION@@ � nD ] - b � _SYSTEM_PROCESSOR_POWER_INFORMATION .?AU_SYSTEM_PROCESSOR_POWER_INFORMATION@@
pD
� Z
CurrentFrequency �
ThermalLimitFrequency
ConstantThrottleFrequency
DegradedThrottleFrequency
LastBusyFrequency
LastC3Frequency ��
LastAdjustedBusyFrequency
ProcessorMinThrottle �
ProcessorMaxThrottle �
" NumberOfFrequencies ��
" PromotionCount ���
" DemotionCount
" ErrorCount ���
" RetryCount ���
# CurrentFrequencyTime �
# ( CurrentProcessorTime �
# 0 CurrentProcessorIdleTime �
# 8 LastProcessorTime
# @ LastProcessorIdleTime
# H Energy ���b rD P _SYSTEM_PROCESSOR_POWER_INFORMATION .?AU_SYSTEM_PROCESSOR_POWER_INFORMATION@@ sD D
�
�
�1
� R � _FSCTL_QUERY_FAT_BPB_BUFFER .?AU_FSCTL_QUERY_FAT_BPB_BUFFER@@
wD
� " $ �*
yD First0x24BytesOfBootSector ���R zD $ _FSCTL_QUERY_FAT_BPB_BUFFER .?AU_FSCTL_QUERY_FAT_BPB_BUFFER@@ {D � N � _IO_SESSION_CONNECT_INFO .?AU_IO_SESSION_CONNECT_INFO@@ ��.
" SessionId
LocalSession �N ~D _IO_SESSION_CONNECT_INFO .?AU_IO_SESSION_CONNECT_INFO@@ �� D *
7?
�
�1
� b � _ALPC_PORT_MESSAGE_ZONE_INFORMATION .?AU_ALPC_PORT_MESSAGE_ZONE_INFORMATION@@ &
Buffer ���
" Size �b �D _ALPC_PORT_MESSAGE_ZONE_INFORMATION .?AU_ALPC_PORT_MESSAGE_ZONE_INFORMATION@@ �D � & � AlpcMessageSidInformation AlpcMessageTokenModifiedIdInformation AlpcMessageDirectStatusInformation ��� AlpcMessageHandleInformation �V t �D _ALPC_MESSAGE_INFORMATION_CLASS .?AW4_ALPC_MESSAGE_INFORMATION_CLASS@@ � �D � �
�1
� F � _SYSTEM_POWER_STATUS .?AU_SYSTEM_POWER_STATUS@@ ��
ACLineStatus �
BatteryFlag ��
BatteryLifePercent ���
SystemStatusFlag �
" BatteryLifeTime ��
" BatteryFullLifeTime ��F �D _SYSTEM_POWER_STATUS .?AU_SYSTEM_POWER_STATUS@@ �� �D )
�>
�
Y(
� > � _TOKEN_ELEVATION .?AU_TOKEN_ELEVATION@@ ��
" TokenIsElevated ��> �D _TOKEN_ELEVATION .?AU_TOKEN_ELEVATION@@ �� �D �
m"
�
� ��
�D
�
6
�
(=
� R � _FILE_PIPE_WAIT_FOR_BUFFER .?AU_FILE_PIPE_WAIT_FOR_BUFFER@@ ��
�D
� Z
} Timeout ��
" NameLength ���
TimeoutSpecified �
Name �R �D _FILE_PIPE_WAIT_FOR_BUFFER .?AU_FILE_PIPE_WAIT_FOR_BUFFER@@ �� �D () B � tagHW_PROFILE_INFOW .?AUtagHW_PROFILE_INFOW@@ q " N �R
" dwDockInfo ���
�D szHwProfileGuid ��
*! R szHwProfileName ��B �D � tagHW_PROFILE_INFOW .?AUtagHW_PROFILE_INFOW@@ �D � Z � _ETW_COVERAGE_SAMPLER_PERF_INFO .?AU_ETW_COVERAGE_SAMPLER_PERF_INFO@@ *
� Common ���
�: PerfStats Z �D �_ETW_COVERAGE_SAMPLER_PERF_INFO .?AU_ETW_COVERAGE_SAMPLER_PERF_INFO@@ �D � ( J � _TXFS_LIST_TRANSACTIONS .?AU_TXFS_LIST_TRANSACTIONS@@
�D
� B
# NumberOfTransactions �
# BufferSizeRequired ���J �D _TXFS_LIST_TRANSACTIONS .?AU_TXFS_LIST_TRANSACTIONS@@ �D C J � _RTL_SPARSE_BITMAP_CTX .?AU_RTL_SPARSE_BITMAP_CTX@@ ��
�!
�
�D
�
" ��
" ��
" ��
" ��
" Lock �
�D BitmapRanges �
�! RangeArrayCommitStatus ���
- AllocateRoutine ��
- FreeRoutine ��
" RangeCount ���
" RangeIndexLimit ��
" BitsPerRange �
" $ RangeCountMax
" ( RangeMetadataOffset ��
" , MetadataSizePerBit ���
�D 0 DefaultBitsSet ���
�D 0 SparseRangeArray �
�D 0 NoInternalLocking
�D 0 SpareFlags ���J �D 4 _RTL_SPARSE_BITMAP_CTX .?AU_RTL_SPARSE_BITMAP_CTX@@ �� �D � �
L$
�
��
��
��
��
��
��
���
TransferAddress ��
" ZeroBits �
" MaximumStackSize �
" CommittedStackSize ���
" SubSystemType
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���
! ImageCharacteristics �
! DllCharacteristics ���
! Machine ��
" ImageContainsCode
# ImageFlags ���
�D # ComPlusNativeReady ���
�D # ComPlusILOnly
�D # ImageDynamicallyRelocated
�D # ImageMappedFlat ��
�D # BaseBelow4gb �
�D # ComPlusPrefer32bit ���
�D # Reserved �
" $ LoaderFlags ��
" ( ImageFileSize
" , CheckSum �R �D 0 _SECTION_IMAGE_INFORMATION .?AU_SECTION_IMAGE_INFORMATION@@ �� �D w v
" NextEntryOffset ��
" TotalSize
" TotalInUse ���
" PeakUsage
� PageFileName �V �D _SYSTEM_PAGEFILE_INFORMATION .?AU_SYSTEM_PAGEFILE_INFORMATION@@ �� �D ?
�
�
�C
�
�,
�
�'
�
6
� N � _FILE_ATTRIBUTE_TAG_INFO .?AU_FILE_ATTRIBUTE_TAG_INFO@@ ��6
" FileAttributes ���
" ReparseTag ���N �D _FILE_ATTRIBUTE_TAG_INFO .?AU_FILE_ATTRIBUTE_TAG_INFO@@ �� �D �" N � STARTING_VCN_INPUT_BUFFER .?AUSTARTING_VCN_INPUT_BUFFER@@
} StartingVcn ��N �D STARTING_VCN_INPUT_BUFFER .?AUSTARTING_VCN_INPUT_BUFFER@@ �D T
F � _RPC_SERVER_INTERFACE .?AU_RPC_SERVER_INTERFACE@@ �
u Length ���
� InterfaceId ��
� TransferSyntax ���
! , DispatchTable
u 0 RpcProtseqEndpointCount ��
! 4 RpcProtseqEndpoint ���
8 DefaultManagerEpv
< InterpreterInfo ��
u @ Flags F �D D _RPC_SERVER_INTERFACE .?AU_RPC_SERVER_INTERFACE@@ �D � � j � _SERVICE_CONTROL_STATUS_REASON_PARAMSW .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSW@@ ��F
" dwReason �
q pszComment ���
ServiceStatus j �D , _SERVICE_CONTROL_STATUS_REASON_PARAMSW .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSW@@ �� �D 3 �
�
� F � _CONSOLE_HISTORY_INFO .?AU_CONSOLE_HISTORY_INFO@@ j
u cbSize ���
u HistoryBufferSize
u NumberOfHistoryBuffers ���
" dwFlags ��F �D _CONSOLE_HISTORY_INFO .?AU_CONSOLE_HISTORY_INFO@@ �D �$ Z ReadDirectoryNotifyInformation ��� ReadDirectoryNotifyExtendedInformation ���j t �D _READ_DIRECTORY_NOTIFY_INFORMATION_CLASS .?AW4_READ_DIRECTORY_NOTIFY_INFORMATION_CLASS@@ ��� �D c �
�D
�
� ��
�D
�
�6
� R � _MEMORY_BASIC_INFORMATION32 .?AU_MEMORY_BASIC_INFORMATION32@@
�D
� �
" BaseAddress ��
" AllocationBase ���
" AllocationProtect
" RegionSize ���
" State
" Protect ��
" Type �R �D _MEMORY_BASIC_INFORMATION32 .?AU_MEMORY_BASIC_INFORMATION32@@ �D ? _
�
�
(@
�
E)
� N
Handle ���
� ClientId �
" Type �
� Stacks ���V �D P _PROCESS_HANDLE_TRACING_ENTRY .?AU_PROCESS_HANDLE_TRACING_ENTRY@@ �D C N B � _ETW_UMS_EVENT_PARK .?AU_ETW_UMS_EVENT_PARK@@ F
" ProcessId
" ScheduledThreadId
" ParkFlags B �D _ETW_UMS_EVENT_PARK .?AU_ETW_UMS_EVENT_PARK@@ �D � �
�
� J � _WMI_LOGGER_INFORMATION .?AU_WMI_LOGGER_INFORMATION@@
�D
�
# ��
# ��
# ��
# ��
5 Wnode
" 0 BufferSize ���
" 4 MinimumBuffers ���
" 8 MaximumBuffers ���
" < MaximumFileSize ��
" @ LogFileMode ��
" D FlushTimer ���
" H EnableFlags ��
L AgeLimit �
L FlushThreshold ���
�D P Wow ��
�D P QpcDeltaTracking �
�D P LargeMdlPages
�D P ExcludeKernelStack ���
# P V2Options
X LogFileHandle
# X LogFileHandle64 ��
" ` NumberOfBuffers ��
" ` InstanceCount
" d FreeBuffers ��
" d InstanceId ���
" h EventsLost ���
" h NumberOfProcessors ���
" l BuffersWritten ���
" p LogBuffersLost ���
" p Flags
" t RealTimeBuffersLost ��
x LoggerThreadId ���
# x LoggerThreadId64 �
� � LogFileName ��
� LogFileName64
� � LoggerName ���
� LoggerName64 �
" � RealTimeConsumerCount
" � SequenceNumber ���
� LoggerExtension ��
# � LoggerExtension64 J % �D � _WMI_LOGGER_INFORMATION .?AU_WMI_LOGGER_INFORMATION@@ �D � @ 6 � tagPOLYTEXTW .?AUtagPOLYTEXTW@@ ��
�D
� j
t x
t y
u n
�% lpstr
u uiFlags ��
� rcl ��
t $ pdx ��6 E ( tagPOLYTEXTW .?AUtagPOLYTEXTW@@ �� E G
b � _SERVICE_REQUIRED_PRIVILEGES_INFOA .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOA@@ ��
E
� &
p pmszRequiredPrivileges ���b E _SERVICE_REQUIRED_PRIVILEGES_INFOA .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOA@@ �� E 3 Q �
E
�
IB
�
�
� P
E
E
�
GC
�
�8
� ^ � _JOBOBJECT_BASIC_UI_RESTRICTIONS .?AU_JOBOBJECT_BASIC_UI_RESTRICTIONS@@ ��"
" UIRestrictionsClass ��^ E _JOBOBJECT_BASIC_UI_RESTRICTIONS .?AU_JOBOBJECT_BASIC_UI_RESTRICTIONS@@ �� E C �
)-
� R � _WIM_PROVIDER_OVERLAY_ENTRY .?AU_WIM_PROVIDER_OVERLAY_ENTRY@@ �
" NextEntryOffset ��
} DataSourceId �
� WimGuid ��
" WimFileNameOffset
" $ WimType ��
" ( WimIndex �
" , Flags R E 0 _WIM_PROVIDER_OVERLAY_ENTRY .?AU_WIM_PROVIDER_OVERLAY_ENTRY@@ E ;"
�
�
*C
� ^ � _IMAGE_CE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_CE_RUNTIME_FUNCTION_ENTRY@@ ��
" ��
" ��
" ��
" ��n
" FuncStart
E PrologLen
E FuncLen ��
E ThirtyTwoBit �
!E ExceptionFlag ^ "E _IMAGE_CE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_CE_RUNTIME_FUNCTION_ENTRY@@ �� #E [ � � PowerRequestDisplayRequired �� PowerRequestSystemRequired ��� PowerRequestAwayModeRequired � PowerRequestExecutionRequired > t %E _POWER_REQUEST_TYPE .?AW4_POWER_REQUEST_TYPE@@ � &E H .
z pfnAllocate ��
< pfnFree ��B (E _MALLOC_FREE_STRUCT .?AU_MALLOC_FREE_STRUCT@@ )E � �
�@
� �= F � _ETW_HEAP_EVENT_FREE .?AU_ETW_HEAP_EVENT_FREE@@ ��V
� Header ���
HeapHandle ���
$ Address ��
" ( Source ���F .E , _ETW_HEAP_EVENT_FREE .?AU_ETW_HEAP_EVENT_FREE@@ �� /E � �
COMPARE_STRING ���6 t 1E SYSNLS_FUNCTION .?AW4SYSNLS_FUNCTION@@ � 2E � � R � _FILE_FULL_DIR_INFORMATION .?AU_FILE_FULL_DIR_INFORMATION@@ ��
4E
� &
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
D FileName �R 6E H _FILE_FULL_DIR_INFORMATION .?AU_FILE_FULL_DIR_INFORMATION@@ �� 7E � �
Buffer ���
" BufferSize ���
z pfnAllocate ��
< pfnFree ��
s3 pRpcChannelBuffer
Reserved �V 9E ( _NDR_USER_MARSHAL_INFO_LEVEL1 .?AU_NDR_USER_MARSHAL_INFO_LEVEL1@@ :E � J � _ETW_CRITSEC_EVENT_INIT .?AU_ETW_CRITSEC_EVENT_INIT@@
<E
� >
� Header ���
SpinCount
$ Address ��J >E ( _ETW_CRITSEC_EVENT_INIT .?AU_ETW_CRITSEC_EVENT_INIT@@ ?E � � B � _LDR_RESLOADER_RET .?AU_LDR_RESLOADER_RET@@ ��B
Module ���
DataEntry
TargetModule �B BE _LDR_RESLOADER_RET .?AU_LDR_RESLOADER_RET@@ �� CE � b .
pValue ���
" ValueLength ��v EE _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ �� FE [
�
�
�
�
&
�
h,
� D
�6
� �
" EntryLength ��
" DependencyTypeFlags ��
" ProviderSpecificFlags
P VirtualStorageType ���
" AncestorLevel
" $ HostVolumeNameOffset �
" ( HostVolumeNameSize ���
" , DependentVolumeNameOffset
" 0 DependentVolumeNameSize ��
" 4 RelativePathOffset ���
" 8 RelativePathSize �
" < DependentDeviceNameOffset
" @ DependentDeviceNameSize ��r
NE D _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY@@ �� OE J
�
� 2
# JobMemory
# PeakJobMemoryUsed b RE _JOBOBJECT_MEMORY_USAGE_INFORMATION .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION@@ SE a O
�
� F � _OPTICAL_MEDIA_RECORD .?AU_OPTICAL_MEDIA_RECORD@@
VE
� ~
! DiskNumber ���
! BusType ��
! DeviceType ���
! MediaType
# StartingOffset ���
# Size �
# NumberOfFreeBlocks ���
# TotalNumberOfBlocks ��
# ( NextWritableAddress ��
" 0 NumberOfSessions �
" 4 NumberOfTracks ���
" 8 BytesPerSector ���
! < DiscStatus ���
! > LastSessionStatus
@ Data �F XE H _OPTICAL_MEDIA_RECORD .?AU_OPTICAL_MEDIA_RECORD@@ YE � 3
�7
� J � _WIN32K_SYSCALL_FILTER .?AU_WIN32K_SYSCALL_FILTER@@ ��
\E
� .
" FilterState ��
" FilterSet J ^E _WIN32K_SYSCALL_FILTER .?AU_WIN32K_SYSCALL_FILTER@@ �� _E C �
" Characteristics ��
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" Name �
" Base �
" NumberOfFunctions
" NumberOfNames
" AddressOfFunctions ���
" AddressOfNames ���
" $ AddressOfNameOrdinals J aE ( _IMAGE_EXPORT_DIRECTORY .?AU_IMAGE_EXPORT_DIRECTORY@@ bE [ j F � _CONSOLE_CURSOR_INFO .?AU_CONSOLE_CURSOR_INFO@@ ��*
" dwSize ���
t bVisible �F eE _CONSOLE_CURSOR_INFO .?AU_CONSOLE_CURSOR_INFO@@ �� fE : �
�A
� N � _WMI_TRACE_MESSAGE_PACKET .?AU_WMI_TRACE_MESSAGE_PACKET@@ 2
! MessageNumber
! OptionFlags ��N jE _WMI_TRACE_MESSAGE_PACKET .?AU_WMI_TRACE_MESSAGE_PACKET@@ kE � } v � _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE@@ J
# TimeAdjustment ���
# TimeIncrement
Enable ���v nE _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE@@ oE i J � _FILE_ID_BOTH_DIR_INFO .?AU_FILE_ID_BOTH_DIR_INFO@@ ��j
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
p D ShortNameLength ��
F ShortName
} ` FileId ���
h FileName �J rE p _FILE_ID_BOTH_DIR_INFO .?AU_FILE_ID_BOTH_DIR_INFO@@ �� sE �"
[
� t# " �V
Version ��
� Reserved0
# ApplicationId
vE Policies �J wE _IMAGE_POLICY_METADATA .?AU_IMAGE_POLICY_METADATA@@ �� xE ( �&
"7
� V � _SYSTEM_ROOT_SILO_INFORMATION .?AU_SYSTEM_ROOT_SILO_INFORMATION@@ 2
" NumberOfSilos
� SiloIdList ���V |E _SYSTEM_ROOT_SILO_INFORMATION .?AU_SYSTEM_ROOT_SILO_INFORMATION@@ }E � Z � DISPLAYCONFIG_VIDEO_SIGNAL_INFO .?AUDISPLAYCONFIG_VIDEO_SIGNAL_INFO@@ "
E targetVideoSignalInfo N �E 0 DISPLAYCONFIG_TARGET_MODE .?AUDISPLAYCONFIG_TARGET_MODE@@ �E c
�"
� N � _VARIABLE_NAME_AND_VALUE .?AU_VARIABLE_NAME_AND_VALUE@@ ��
" NextEntryOffset ��
" ValueOffset ��
" ValueLength ��
" Attributes ���
� VendorGuid ���
Name �N �E $ _VARIABLE_NAME_AND_VALUE .?AU_VARIABLE_NAME_AND_VALUE@@ �� �E { 3
�
� V � _PLUGPLAY_CONTROL_STATUS_DATA .?AU_PLUGPLAY_CONTROL_STATUS_DATA@@
�E
� �
� DeviceInstance ���
" Operation
" DeviceStatus �
" DeviceProblem
" Flags
ProblemStatus V �E _PLUGPLAY_CONTROL_STATUS_DATA .?AU_PLUGPLAY_CONTROL_STATUS_DATA@@ �E � � > � _CM_RESOURCE_LIST .?AU_CM_RESOURCE_LIST@@
�E
� k4 " �"
" Count
�E List �> �E $ _CM_RESOURCE_LIST .?AU_CM_RESOURCE_LIST@@ �E � x > � _EVENTSFORLOGFILE .?AU_EVENTSFORLOGFILE@@ & " �f
" ulSize ���
� szLogicalLogFile �
" ulNumRecords �
�E pEventLogRecords �> �E _EVENTSFORLOGFILE .?AU_EVENTSFORLOGFILE@@ �E !& t
u ��
u ��
u
��J
�E videoStandard
�E vSyncFreqDivider �
�E reserved �: �E <anonymous-tag> .?AU<anonymous-tag>@@ �E % �
# pixelRate
�2 hSyncFreq
�2 vSyncFreq
�B activeSize ���
�B totalSize
�E ( AdditionalSignalInfo �
u ( videoStandard
�2 , scanLineOrdering �Z �E 0 DISPLAYCONFIG_VIDEO_SIGNAL_INFO .?AUDISPLAYCONFIG_VIDEO_SIGNAL_INFO@@ �E
�A
�
�+
� : � tagEMREXTESCAPE .?AUtagEMREXTESCAPE@@ N
emr ��
t iEscape ��
t cbEscData
K EscData ��: �E tagEMREXTESCAPE .?AUtagEMREXTESCAPE@@ �E � j � _JOURNAL_CREATE_DELETE_KEY_INFORMATION .?AU_JOURNAL_CREATE_DELETE_KEY_INFORMATION@@ ���
2 Action ���
# RecordNumber �
} TimeStamp
� KeyPathName ��
" SecurityDescriptorLength �
$ SecurityDescriptor ���
! ( ClassLength ��
, ClassData
0 SymbolicLink �j �E 8 _JOURNAL_CREATE_DELETE_KEY_INFORMATION .?AU_JOURNAL_CREATE_DELETE_KEY_INFORMATION@@ �� �E 3 �
�$
�
�3
�
I
�
�%
�
�%
�
�3
�
�
�
;
�
�
�
U
� F � _CM_SCSI_DEVICE_DATA .?AU_CM_SCSI_DEVICE_DATA@@ ��
�E
� F
! Version ��
! Revision �
HostIdentifier ���F �E _CM_SCSI_DEVICE_DATA .?AU_CM_SCSI_DEVICE_DATA@@ �� �E � �
�
� : � _FOUR_PART_VERSION .?AT_FOUR_PART_VERSION@@ ��6
" BuildAndRevision �
" MajorAndMinor : �E <anonymous-tag> .?AU<anonymous-tag>@@ �E � : F
! Revision �
! Build
! Minor
! Major : �E <anonymous-tag> .?AU<anonymous-tag>@@ �E � > >
# Version64
�E Version32
�E Version16 : �E _FOUR_PART_VERSION .?AT_FOUR_PART_VERSION@@ �� �E � 8 b � _SYSTEM_MEMORY_CHANNEL_INFORMATION .?AU_SYSTEM_MEMORY_CHANNEL_INFORMATION@@ ��
" ChannelNumber
" ChannelHeatIndex �
# TotalPageCount ���
# ZeroPageCount
# FreePageCount
# StandbyPageCount �b �E ( _SYSTEM_MEMORY_CHANNEL_INFORMATION .?AU_SYSTEM_MEMORY_CHANNEL_INFORMATION@@ �� �E +
c
�
�,
�
l
� &
" Flags
� FrameName N �E _TEB_ACTIVE_FRAME_CONTEXT .?AU_TEB_ACTIVE_FRAME_CONTEXT@@ �E �
15
� R
� Id ���
" Flags
SpaceGuarantee ���
SpaceUsed R �E _STORAGE_RESERVE_AREA_INFO .?AU_STORAGE_RESERVE_AREA_INFO@@ �� �E �*
�)
� F � tagEMREXCLUDECLIPRECT .?AUtagEMREXCLUDECLIPRECT@@ &
emr ��
� rclClip ��F �E tagEMREXCLUDECLIPRECT .?AUtagEMREXCLUDECLIPRECT@@ �E � z
" Address ��
" Flags
" DataSize �
" OverheadSize �
" NextBlockInformationOffset ���J �E _HEAP_BLOCK_INFORMATION .?AU_HEAP_BLOCK_INFORMATION@@ �E L
�
�
�
� ^ � _ALPC_SERVER_SESSION_INFORMATION .?AU_ALPC_SERVER_SESSION_INFORMATION@@ ��
�E
� *
" SessionId
" ProcessId ^ �E _ALPC_SERVER_SESSION_INFORMATION .?AU_ALPC_SERVER_SESSION_INFORMATION@@ �� �E � �
W,
� J � _KEY_CACHED_INFORMATION .?AU_KEY_CACHED_INFORMATION@@ �
} LastWriteTime
" TitleIndex ���
" SubKeys ��
" MaxNameLen ���
" Values ���
" MaxValueNameLen ��
" MaxValueDataLen ��
" NameLength ���J �E ( _KEY_CACHED_INFORMATION .?AU_KEY_CACHED_INFORMATION@@ �E � �
r'
� Z � _DISPLAYCONFIG_SDR_WHITE_LEVEL .?AU_DISPLAYCONFIG_SDR_WHITE_LEVEL@@ ��.
y header ���
" SDRWhiteLevel Z �E _DISPLAYCONFIG_SDR_WHITE_LEVEL .?AU_DISPLAYCONFIG_SDR_WHITE_LEVEL@@ �� �E x > � _BOOT_ENTRY_LIST .?AU_BOOT_ENTRY_LIST@@ ��2
" NextEntryOffset ��
! BootEntry > �E $ _BOOT_ENTRY_LIST .?AU_BOOT_ENTRY_LIST@@ �� �E � V � _FILE_PIPE_SILO_ARRIVAL_INPUT .?AU_FILE_PIPE_SILO_ARRIVAL_INPUT@@
JobHandle V �E _FILE_PIPE_SILO_ARRIVAL_INPUT .?AU_FILE_PIPE_SILO_ARRIVAL_INPUT@@ �E Y) B � _FILE_LAYOUT_ENTRY .?AU_FILE_LAYOUT_ENTRY@@ ���
" Version ��
" NextFileOffset ���
" Flags
" FileAttributes ���
# FileReferenceNumber ��
" FirstNameOffset ��
" FirstStreamOffset
" ExtraInfoOffset ��
" $ ExtraInfoLength ��B �E ( _FILE_LAYOUT_ENTRY .?AU_FILE_LAYOUT_ENTRY@@ �� �E u # �3 " " �E
�E
�
Q<
�
t unused ���2 �E HMONITOR__ .?AUHMONITOR__@@ �� �E n
�
�&
�
@4
�
u " F R � _PROCESS_UPTIME_INFORMATION .?AU_PROCESS_UPTIME_INFORMATION@@
" ��
" ��
" ��
" ��
# QueryInterruptTime ���
# QueryUnbiasedTime
# EndInterruptTime �
# TimeSinceCreation
# Uptime ���
# ( SuspendedTime
F 0 HangCount
F 0 GhostCount ���
F 0 Crashed ��
F 0 Terminated ���R
F 8 _PROCESS_UPTIME_INFORMATION .?AU_PROCESS_UPTIME_INFORMATION@@ F a �
g
�
�A
�
$B
�
�-
�
�4
�
q6
� > � _SYSDBG_PHYSICAL .?AU_SYSDBG_PHYSICAL@@ ��>
} Address ��
Buffer ���
" Request ��> F _SYSDBG_PHYSICAL .?AU_SYSDBG_PHYSICAL@@ �� F � Z � _FILE_ZERO_DATA_INFORMATION_EX .?AU_FILE_ZERO_DATA_INFORMATION_EX@@ ��F
} FileOffset ���
} BeyondFinalZero ��
" Flags Z F _FILE_ZERO_DATA_INFORMATION_EX .?AU_FILE_ZERO_DATA_INFORMATION_EX@@ �� F �
8
� N � _CI_LOG_SCHEDULER_WAKEUP .?AU_CI_LOG_SCHEDULER_WAKEUP@@ ��*
� Header ���
" 0 Reason ���N F 8 _CI_LOG_SCHEDULER_WAKEUP .?AU_CI_LOG_SCHEDULER_WAKEUP@@ �� F � M N � _ETW_HEAP_EVENT_SNAPSHOT .?AU_ETW_HEAP_EVENT_SNAPSHOT@@ ��
� Header ���
HeapHandle ���
" $ FreeSpace
" ( CommittedSpace ���
" , ReservedSpace
" 0 Flags
" 4 ProcessId
" 8 LargeUCRSpace
" < FreeListLength ���
" @ UCRLength
" D AllocatedSpace ���N !F H _ETW_HEAP_EVENT_SNAPSHOT .?AU_ETW_HEAP_EVENT_SNAPSHOT@@ �� "F � �
u " $F V � _WOW64_DESCRIPTOR_TABLE_ENTRY .?AU_WOW64_DESCRIPTOR_TABLE_ENTRY@@
&F
� .
" Selector �
�' Descriptor ���V (F _WOW64_DESCRIPTOR_TABLE_ENTRY .?AU_WOW64_DESCRIPTOR_TABLE_ENTRY@@ )F �
�>
� N � _SYSTEM_ALARM_OBJECT_ACE .?AU_SYSTEM_ALARM_OBJECT_ACE@@ ��
o Header ���
" Mask �
" Flags
� ObjectType ���
� InheritedObjectType ��
" , SidStart �N -F 0 _SYSTEM_ALARM_OBJECT_ACE .?AU_SYSTEM_ALARM_OBJECT_ACE@@ �� .F �
�
�
�<
�
c1
� J � _PERFINFO_FLT_OPERATION .?AU_PERFINFO_FLT_OPERATION@@ �
RoutineAddr ��
FileObject ���
FsContext
IrpPtr ���
CbdPtr ���
MajorFunction J 4F _PERFINFO_FLT_OPERATION .?AU_PERFINFO_FLT_OPERATION@@ 5F � � Z � _FILE_MOVE_CLUSTER_INFORMATION .?AU_FILE_MOVE_CLUSTER_INFORMATION@@ ��b
" ClusterCount �
RootDirectory
" FileNameLength ���
FileName �Z 8F _FILE_MOVE_CLUSTER_INFORMATION .?AU_FILE_MOVE_CLUSTER_INFORMATION@@ �� 9F �
�#
�
'
� b � _WIM_PROVIDER_REMOVE_OVERLAY_INPUT .?AU_WIM_PROVIDER_REMOVE_OVERLAY_INPUT@@ ��
=F
�
} DataSourceId �b ?F _WIM_PROVIDER_REMOVE_OVERLAY_INPUT .?AU_WIM_PROVIDER_REMOVE_OVERLAY_INPUT@@ �� @F 3"
S$
�
M?
� r � _PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED .?AU_PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED@@ ��B
� DeviceInterface ��
" Flags
Enabled ��r EF _PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED .?AU_PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED@@ �� FF �
�#
� b t t IF
JF
�
�#
� * � _FP_32 .?AU_FP_32@@ ��
I16Value �
! U16Value �
I32Value �
" U32Value �
StringValue ��
" CompareValue �
MF Fp32Value
} I64Value �
� U64Value �
�' Fp64Value
�1 Fp80Value
�> Fp128Value ���2 NF <anonymous-tag> .?AT<anonymous-tag>@@ OF + �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
QF RoundingMode �
RF Inexact ��
SF Underflow
TF Overflow �
UF ZeroDivide ���
VF InvalidOperation �
WF OperandValid �
XF Format ���
YF Precision
ZF Operation
[F Spare
\F HardwareException : ]F <anonymous-tag> .?AU<anonymous-tag>@@ ^F + � &
OF Value
^F Control ��: `F _FP_IEEE_VALUE .?AU_FP_IEEE_VALUE@@ �� aF + � �
" BufferSize ���
" ProviderId ���
# HistoricalContext
" Version ��
" Linkage ��
" CountLost
KernelHandle �
} TimeStamp
� Guid �
" ( ClientContext
" , Flags 6 cF 0 _WNODE_HEADER .?AU_WNODE_HEADER@@ dF 8 N � _RTL_FEATURE_USAGE_REPORT .?AU_RTL_FEATURE_USAGE_REPORT@@
fF
� J
u FeatureId
! ReportingKind
! ReportingOptions �N hF _RTL_FEATURE_USAGE_REPORT .?AU_RTL_FEATURE_USAGE_REPORT@@ iF � �
�
�
\)
�
f
� & IoCompletionBasicInformation �Z t nF _IO_COMPLETION_INFORMATION_CLASS .?AW4_IO_COMPLETION_INFORMATION_CLASS@@ ��� oF � ;
�;
� rF
sF
�
o5
� F � _SL_HWID_DEVICE_INFO .?AU_SL_HWID_DEVICE_INFO@@ ��
" SizeBytes
Type �
DeviceRemovalPolicy ��
AuthenticationStatus �
Disposition ��
" DeviceNodeLevel ��
� Guid �
| Data �F wF _SL_HWID_DEVICE_INFO .?AU_SL_HWID_DEVICE_INFO@@ �� xF �
�5
� R � _SE_PACKAGE_CAPABILITY_INFO .?AU_SE_PACKAGE_CAPABILITY_INFO@@ 2
" Remaining
" PackageGrantedAccess �
" CapabilityGrantedAccess ��
" UserGroupsRemaining ��
" AllAppPackagesSkippedAccess ��
PackagesPresent ��
PackageMatch �
CapabilityMatch ��
LogPermissiveFailure �
AllAppPackagesSkipped R
|F _SE_PACKAGE_CAPABILITY_INFO .?AU_SE_PACKAGE_CAPABILITY_INFO@@ }F ]
�
�
�<
� Z � _IMAGE_LOAD_CONFIG_DIRECTORY64 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY64@@ ��
�F
� �
" Size �
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" GlobalFlagsClear �
" GlobalFlagsSet ���
" CriticalSectionDefaultTimeout
# DeCommitFreeBlockThreshold ���
# DeCommitTotalFreeThreshold ���
# ( LockPrefixTable ��
# 0 MaximumAllocationSize
# 8 VirtualMemoryThreshold ���
# @ ProcessAffinityMask ��
" H ProcessHeapFlags �
! L CSDVersion ���
! N DependentLoadFlags ���
# P EditList �
# X SecurityCookie ���
# ` SEHandlerTable ���
# h SEHandlerCount ���
# p GuardCFCheckFunctionPointer ��
# x GuardCFDispatchFunctionPointer ���
# � GuardCFFunctionTable �
# � GuardCFFunctionCount �
" � GuardFlags ���
� � CodeIntegrity
# � GuardAddressTakenIatEntryTable ���
# � GuardAddressTakenIatEntryCount ���
# � GuardLongJumpTargetTable �
# � GuardLongJumpTargetCount �
# � DynamicValueRelocTable ���
# � CHPEMetadataPointer ��
# � GuardRFFailureRoutine
# � GuardRFFailureRoutineFunctionPointer �
" � DynamicValueRelocTableOffset �
! � DynamicValueRelocTableSection
! � Reserved2
# � GuardRFVerifyStackPointerFunctionPointer �
" � HotPatchTableOffset ��
" � Reserved3
# � EnclaveConfigurationPointer ��
# VolatileMetadataPointer ��
# GuardEHContinuationTable �
# GuardEHContinuationCount �Z , �F _IMAGE_LOAD_CONFIG_DIRECTORY64 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY64@@ �� �F [ 5 J � _FILE_SET_SPARSE_BUFFER .?AU_FILE_SET_SPARSE_BUFFER@@
�F
�
SetSparse J �F _FILE_SET_SPARSE_BUFFER .?AU_FILE_SET_SPARSE_BUFFER@@ �F � J � PPM_IDLE_ACCOUNTING_EX .?AUPPM_IDLE_ACCOUNTING_EX@@ ��
�F
� V � PPM_IDLE_STATE_ACCOUNTING_EX .?AUPPM_IDLE_STATE_ACCOUNTING_EX@@ �� �F " � �
" StateCount ���
" TotalTransitions �
" ResetCount ���
" AbortCount ���
# StartTime
�F State J �F �PPM_IDLE_ACCOUNTING_EX .?AUPPM_IDLE_ACCOUNTING_EX@@ �� �F )
�
�
�;
�
?
� > � _MUIREGISTRYINFO .?AU_MUIREGISTRYINFO@@ �� ! " �
0
�
d
�
�5
� 6 � _MUILANGLIST .?AU_MUILANGLIST@@ ��
�F
�
�F
� v
u Owned
�F InstallLanguageFallback ��
" Generation ���
" ProcessGeneration
�F Installed
�F Strings ��
�F MachineConfig
�F UserConfig ���
�F $ MachinePreferred �
�F ( UserPreferred
�F , ProcessPreferred �
�F 0 MergedUser ���
�F 4 MergedMachine
�F 8 MergedFallback ���
�F < PrevRegInfo ��
" @ MUI_Locked ���
" D MUI_SE ���
" H MUI_NumberAllowed
q L MUI_AllowedLanguage ��
q P MUI_InstalledSKU �
" T cbInstalledSKU ���
" X cbAllowedLanguage
q \ MUI_DisallowedLanguage ���
" ` cbDisallowedLanguage �> �F d _MUIREGISTRYINFO .?AU_MUIREGISTRYINFO@@ �� �F � ~
@
� �
lpInformation
lpSectionBase
" ulSectionLength ��
lpSectionGlobalDataBase ��
" ulSectionGlobalDataLength z �F tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AUtagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ �� �F �
� J � tagEMRSETPALETTEENTRIES .?AUtagEMRSETPALETTEENTRIES@@ b
emr ��
" ihPal
" iStart ���
" cEntries �
; aPalEntries ��J �F tagEMRSETPALETTEENTRIES .?AUtagEMRSETPALETTEENTRIES@@ �F �
c'
�
r.
�
YA
� J � _ETW_TP_EVENT_TIMER_SET .?AU_ETW_TP_EVENT_TIMER_SET@@ �
� Header ���
DueTime ��
( SubQueue �
, Timer
" 0 Period ���
" 4 WindowLength �
" 8 Absolute �J �F < _ETW_TP_EVENT_TIMER_SET .?AU_ETW_TP_EVENT_TIMER_SET@@ �F �
�
� # " # �F Z 2 RtlDiskWriteConstraintPolicyLimited �� d RtlDiskWriteConstraintPolicyNormal ���Z t �F RTL_DISK_WRITE_CONSTRAINT_POLICY .?AW4RTL_DISK_WRITE_CONSTRAINT_POLICY@@ ��� �F � 2 : � tagSTYLESTRUCT .?AUtagSTYLESTRUCT@@ ��*
" styleOld �
" styleNew �: �F tagSTYLESTRUCT .?AUtagSTYLESTRUCT@@ �� �F �
�
?
�
�
�
�
g
�
@ ��
�F
� } p } �F " " �F
�F
�
n
�
�
�
�$
� R � _PERFINFO_FILE_INFORMATION .?AU_PERFINFO_FILE_INFORMATION@@ ��
" Irp ��
" FileObject ���
" FileKey ��
" ExtraInformation �
" IssuingThreadId ��
" InfoClass R �F _PERFINFO_FILE_INFORMATION .?AU_PERFINFO_FILE_INFORMATION@@ �� �F � ` : � HENHMETAFILE__ .?AUHENHMETAFILE__@@ ��
�F
�
t unused ���: �F HENHMETAFILE__ .?AUHENHMETAFILE__@@ �� �F T �
�F
� n � _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT@@
�F
� >
Lock �
" ThreadId �
" BoostBitmap ��n �F _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT@@ �F �
R � tagEMRMODIFYWORLDTRANSFORM .?AUtagEMRMODIFYWORLDTRANSFORM@@ ��
�F
� 2
emr ��
� xform
" iMode R �F $ tagEMRMODIFYWORLDTRANSFORM .?AUtagEMRMODIFYWORLDTRANSFORM@@ �� �F 2 � _RC_CONFIG .?AU_RC_CONFIG@@ ��R
" dwSignature ��
" dwLength �
" dwRCConfigVersion
" dwFilePathType ���
" dwFileType ���
" dwSystemAttributes ���
" dwUltimateFallbackLocation ���
� dwServiceCheckSum
� , dwChecksum ���
" < dwReserved1 ��
" @ dwReserved2 ��
" D dwMUIFileNameOffset ��
" H dwMUIFileNameLength ��
" L dwMUIFilePathOffset ��
" P dwMUIFilePathLength ��
" T dwMainResNameTypesOffset �
" X dwMainResNameTypesLength �
" \ dwMainResIDTypesOffset ���
" ` dwMainResIDTypesLength ���
" d dwMUIResNameTypesOffset ��
" h dwMUIResNameTypesLength ��
" l dwMUIResIDTypesOffset
" p dwMUIResIDTypesLength
" t dwLanguageOffset �
" x dwLanguageLength �
" | dwUltimateFallbackLanguageOffset �
" � dwUltimateFallbackLanguageLength �2 �F � _RC_CONFIG .?AU_RC_CONFIG@@ �� �F � � :
� Uuid �
! VersMajor
! VersMinor 2 �F _RPC_IF_ID .?AU_RPC_IF_ID@@ �� �F � { N � _DECRYPTION_STATUS_BUFFER .?AU_DECRYPTION_STATUS_BUFFER@@ "
NoEncryptedStreams ���N �F _DECRYPTION_STATUS_BUFFER .?AU_DECRYPTION_STATUS_BUFFER@@ �F
BB
� *
" dwError ��
" dwType ���. �F _RIP_INFO .?AU_RIP_INFO@@ �F c c 2 � _CALL_FRAME .?AU_CALL_FRAME@@
�F
� ^
ReturnAddress
Param1 ���
Param2 ���
CompatibilityArea 2 �F _CALL_FRAME .?AU_CALL_FRAME@@ �F a �
2 � _cpinfoexA .?AU_cpinfoexA@@ ��
u MaxCharSize ��
� DefaultChar ��
� LeadByte �
q UnicodeDefaultChar ���
u CodePage �
� CodePageName �2 �F _cpinfoexA .?AU_cpinfoexA@@ �� �F � c V � _ETW_PARTITION_INFO_EXTENSION .?AU_ETW_PARTITION_INFO_EXTENSION@@ �
! EventVersion �
! Reserved �
" PartitionType
} QpcOffsetFromRoot
� PartitionId ��
� ParentId �V �F 0 _ETW_PARTITION_INFO_EXTENSION .?AU_ETW_PARTITION_INFO_EXTENSION@@ �F � � ^ � _CREATEFILE2_EXTENDED_PARAMETERS .?AU_CREATEFILE2_EXTENDED_PARAMETERS@@ ��
�F
�
�
� �
" dwSize ���
" dwFileAttributes �
" dwFileFlags ��
" dwSecurityQosFlags ���
�F lpSecurityAttributes �
hTemplateFile ^ �F _CREATEFILE2_EXTENDED_PARAMETERS .?AU_CREATEFILE2_EXTENDED_PARAMETERS@@ �� �F � f � _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA .?AU_PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA@@ >
" Flags
" BufferLength �
Buffer ���f G _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA .?AU_PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA@@ G �
F
�
Z3 G
G
� �
" ModuleInfoSize ���
" IsBinaryLoaded ���
� ModulePathName ���
" CoverageSectionSize ��
| CoverageSection ��F G _COVERAGE_MODULE_INFO .?AU_COVERAGE_MODULE_INFO@@ G t B � _CPU_CONFIG_RECORD .?AU_CPU_CONFIG_RECORD@@ �� q " �
" ProcessorSpeed ���
" NumberOfProcessors ���
" MemorySize ���
" PageSize �
" AllocationGranularity
� ComputerName �
G DomainName ���
" HyperThreadingFlag ���
" $HighestUserAddress ���
! (ProcessorArchitecture
! *ProcessorLevel ���
! ,ProcessorRevision
.NxEnabled
/PaeEnabled ���
" 0MemorySpeed ��B
G 4_CPU_CONFIG_RECORD .?AU_CPU_CONFIG_RECORD@@ �� G � �
�E
� : � _RTL_BITMAP_RUN .?AU_RTL_BITMAP_RUN@@
G
� 2
" StartingIndex
" NumberOfBits �: G _RTL_BITMAP_RUN .?AU_RTL_BITMAP_RUN@@ G ( )
�
�
�&
� �
# NumSDChangedSuccess ��
# NumSDChangedFail �
# NumSDUnused ��
# NumSDTotal ���
# NumMftSDChangedSuccess ���
# ( NumMftSDChangedFail ��
# 0 NumMftSDTotal V G 8 _SD_CHANGE_MACHINE_SID_OUTPUT .?AU_SD_CHANGE_MACHINE_SID_OUTPUT@@ G �
|
� J ServiceDirectoryPersistentState �� ServiceDirectoryTypeMax ��F t G SERVICE_DIRECTORY_TYPE .?AW4SERVICE_DIRECTORY_TYPE@@ ��� G 3
�E
�
�
� F � _RTL_HEAP_PARAMETERS .?AU_RTL_HEAP_PARAMETERS@@ ��
!G
�
D
� >
" Length ���
" SegmentReserve ���
" SegmentCommit
" DeCommitFreeBlockThreshold ���
" DeCommitTotalFreeThreshold ���
" MaximumAllocationSize
" VirtualMemoryThreshold ���
" InitialCommit
" InitialReserve ���
#G $ CommitRoutine
�+ ( Reserved �F $G 0 _RTL_HEAP_PARAMETERS .?AU_RTL_HEAP_PARAMETERS@@ �� %G ( �
�B
� Z � tagI_RpcProxyCallbackInterface .?AUtagI_RpcProxyCallbackInterface@@ �� q q " )G
*G
� p " ,G
-G
�
" /G
0G
� kC = 2G
3G
�
mC
� t �0 t �0 6G
7G
�
�0
�
�
|;
� B
+G IsValidMachineFn �
.G GetClientAddressFn ���
1G GetConnectionTimeoutFn ���
4G PerformCalloutFn �
5G FreeCalloutStateFn ���
8G GetClientSessionAndResourceUUIDFn
9G ProxyFilterIfFn ��
:G RpcProxyUpdatePerfCounterFn ��
;G RpcProxyUpdatePerfCounterBackendServerFn �Z <G $ tagI_RpcProxyCallbackInterface .?AUtagI_RpcProxyCallbackInterface@@ �� =G � �
)6
� n � _MEMORY_PARTITION_INITIAL_ADD_INFORMATION .?AU_MEMORY_PARTITION_INITIAL_ADD_INFORMATION@@
@G
� ~+ " �j
" Flags
" NumberOfRanges ���
" NumberOfPagesAdded ���
BG PartitionRanges ��n CG _MEMORY_PARTITION_INITIAL_ADD_INFORMATION .?AU_MEMORY_PARTITION_INITIAL_ADD_INFORMATION@@ DG �
#
� R � _EVENT_EXTENDED_ITEM_TS_ID .?AU_EVENT_EXTENDED_ITEM_TS_ID@@ ��
" SessionId R HG _EVENT_EXTENDED_ITEM_TS_ID .?AU_EVENT_EXTENDED_ITEM_TS_ID@@ �� IG � d
�
�:
� "
B Type �
" Delay 2 MG _SC_ACTION .?AU_SC_ACTION@@ �� NG 3
:
�
e?
� 6
! Version ��
! Size �
� Event F RG _PLUGPLAY_NOTIFY_HDR .?AU_PLUGPLAY_NOTIFY_HDR@@ �� SG � � Z � _SYSTEM_PERFORMANCE_INFORMATION .?AU_SYSTEM_PERFORMANCE_INFORMATION@@
UG
�
} IdleProcessTime ��
} IoReadTransferCount ��
} IoWriteTransferCount �
} IoOtherTransferCount �
" IoReadOperationCount �
" $ IoWriteOperationCount
" ( IoOtherOperationCount
" , AvailablePages ���
" 0 CommittedPages ���
" 4 CommitLimit ��
" 8 PeakCommitment ���
" < PageFaultCount ���
" @ CopyOnWriteCount �
" D TransitionCount ��
" H CacheTransitionCount �
" L DemandZeroCount ��
" P PageReadCount
" T PageReadIoCount ��
" X CacheReadCount ���
" \ CacheIoCount �
" ` DirtyPagesWriteCount �
" d DirtyWriteIoCount
" h MappedPagesWriteCount
" l MappedWriteIoCount ���
" p PagedPoolPages ���
" t NonPagedPoolPages
" x PagedPoolAllocs ��
" | PagedPoolFrees ���
" � NonPagedPoolAllocs ���
" � NonPagedPoolFrees
" � FreeSystemPtes ���
" � ResidentSystemCodePage ���
" � TotalSystemDriverPages ���
" � TotalSystemCodePages �
" � NonPagedPoolLookasideHits
" � PagedPoolLookasideHits ���
" � AvailablePagedPoolPages ��
" � ResidentSystemCachePage ��
" � ResidentPagedPoolPage
" � ResidentSystemDriverPage �
" � CcFastReadNoWait �
" � CcFastReadWait ���
" � CcFastReadResourceMiss ���
" � CcFastReadNotPossible
" � CcFastMdlReadNoWait ��
" � CcFastMdlReadWait
" � CcFastMdlReadResourceMiss
" � CcFastMdlReadNotPossible �
" � CcMapDataNoWait ��
" � CcMapDataWait
" � CcMapDataNoWaitMiss ��
" � CcMapDataWaitMiss
" � CcPinMappedDataCount �
" � CcPinReadNoWait ��
" � CcPinReadWait
" � CcPinReadNoWaitMiss ��
" � CcPinReadWaitMiss
" � CcCopyReadNoWait �
" � CcCopyReadWait ���
" � CcCopyReadNoWaitMiss �
" CcCopyReadWaitMiss ���
" CcMdlReadNoWait ��
" CcMdlReadWait
" CcMdlReadNoWaitMiss ��
" CcMdlReadWaitMiss
" CcReadAheadIos ���
" CcLazyWriteIos ���
" CcLazyWritePages �
" CcDataFlushes
" $CcDataPages ��
" (ContextSwitches ��
" ,FirstLevelTbFills
" 0SecondLevelTbFills ���
" 4SystemCalls ��
# 8CcTotalDirtyPages
# @CcDirtyPageThreshold �
HResidentAvailablePages ���
# PSharedCommittedPages �Z N WG X_SYSTEM_PERFORMANCE_INFORMATION .?AU_SYSTEM_PERFORMANCE_INFORMATION@@ XG � 2 � _RPC_POLICY .?AU_RPC_POLICY@@ B
u Length ���
" EndpointFlags
" NICFlags �2 [G _RPC_POLICY .?AU_RPC_POLICY@@ \G � �
k
�
�+
� > � tagEMRNAMEDESCAPE .?AUtagEMRNAMEDESCAPE@@ b
emr ��
t iEscape ��
t cbDriver �
t cbEscData
K EscData ��> aG tagEMRNAMEDESCAPE .?AUtagEMRNAMEDESCAPE@@ bG �
i8
� j � _DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE .?AU_DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE@@
u ��
u ��Z
y header ���
fG enableAdvancedColor ��
gG reserved �
u value j hG _DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE .?AU_DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE@@ iG i
�
� Y " �
lG
�
�-
�
u?
�
,* ��
pG
� Z � _SL_KMEM_CACHE_VALUE_DESCRIPTOR .?AU_SL_KMEM_CACHE_VALUE_DESCRIPTOR@@ �
! Size �
! NameLength ���
! Type �
! DataLength ���
" Attributes ���
" Reserved �
Name �Z sG _SL_KMEM_CACHE_VALUE_DESCRIPTOR .?AU_SL_KMEM_CACHE_VALUE_DESCRIPTOR@@ tG i
�
� b � _EVENT_EXTENDED_ITEM_STACK_TRACE64 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE64@@ ��*
# MatchId ��
�< Address ��b xG _EVENT_EXTENDED_ITEM_STACK_TRACE64 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE64@@ �� yG � m R � _WMI_PROCESS_INFORMATION64 .?AU_WMI_PROCESS_INFORMATION64@@ ��
{G
� �
# UniqueProcessKey64 ���
" ProcessId
" ParentId �
" SessionId
ExitStatus ���
# DirectoryTableBase ���
" Flags
" $ Sid ��R }G ( _WMI_PROCESS_INFORMATION64 .?AU_WMI_PROCESS_INFORMATION64@@ �� ~G � R � _TP_POOL_STACK_INFORMATION .?AU_TP_POOL_STACK_INFORMATION@@ ��
�G
� 2
" StackReserve �
" StackCommit ��R �G _TP_POOL_STACK_INFORMATION .?AU_TP_POOL_STACK_INFORMATION@@ �� �G � R
X)
� v � _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE@@ .
} FileOffset ���
} ByteCount v �G _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE@@ �G �*
h#
�
l
� V � _ETW_CLOCK_STATE_CHANGE_EVENT .?AU_ETW_CLOCK_STATE_CHANGE_EVENT@@
�G
� �
NewState �
PrevState
� Reserved �
# DeliveredIncrement ���
# RequestedIncrement ���
# NextClockUpdateTime ��V �G _ETW_CLOCK_STATE_CHANGE_EVENT .?AU_ETW_CLOCK_STATE_CHANGE_EVENT@@ �G �
�*
� R � _FILE_FS_LABEL_INFORMATION .?AU_FILE_FS_LABEL_INFORMATION@@ ��
�G
� 6
" VolumeLabelLength
VolumeLabel ��R �G _FILE_FS_LABEL_INFORMATION .?AU_FILE_FS_LABEL_INFORMATION@@ �� �G F � _TOKEN_PRIMARY_GROUP .?AU_TOKEN_PRIMARY_GROUP@@ ��
PrimaryGroup �F �G _TOKEN_PRIMARY_GROUP .?AU_TOKEN_PRIMARY_GROUP@@ �� �G �
D
� f � JOBOBJECT_IO_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION@@ �
MaxIops ��
MaxBandwidth �
ReservationIops ��
P VolumeName ���
" BaseIoSize ���
" ControlFlags �f �G ( JOBOBJECT_IO_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION@@ 2 onecore\external\sdk\inc\mincore\jobapi2.h � �G �G N � PPM_WMI_LEGACY_PERFSTATE .?AUPPM_WMI_LEGACY_PERFSTATE@@ ��
�G
� B
" Frequency
" Flags
" PercentFrequency �N �G PPM_WMI_LEGACY_PERFSTATE .?AUPPM_WMI_LEGACY_PERFSTATE@@ �� �G � B � FIND_BY_SID_OUTPUT .?AUFIND_BY_SID_OUTPUT@@ ��b
" NextEntryOffset ��
" FileIndex
" FileNameLength ���
FileName �B �G FIND_BY_SID_OUTPUT .?AUFIND_BY_SID_OUTPUT@@ �� �G �
Z � _OBJECT_HANDLE_FLAG_INFORMATION .?AU_OBJECT_HANDLE_FLAG_INFORMATION@@
�G
� 2
Inherit ��
ProtectFromClose �Z �G _OBJECT_HANDLE_FLAG_INFORMATION .?AU_OBJECT_HANDLE_FLAG_INFORMATION@@ �G � W N � _ALPC_SERVER_INFORMATION .?AU_ALPC_SERVER_INFORMATION@@ ��
ThreadHandle �: �G <anonymous-tag> .?AU<anonymous-tag>@@ �G � � Z
ThreadBlocked
ConnectedProcessId ���
� ConnectionPortName ���: �G <anonymous-tag> .?AU<anonymous-tag>@@ �G � � "
�G In ���
�G Out ��N �G _ALPC_SERVER_INFORMATION .?AU_ALPC_SERVER_INFORMATION@@ �� �G � � J � USN_RANGE_TRACK_OUTPUT .?AUUSN_RANGE_TRACK_OUTPUT@@ ��
�G
�
Usn ��J �G USN_RANGE_TRACK_OUTPUT .?AUUSN_RANGE_TRACK_OUTPUT@@ �� �G Y
�6
� V � _TRACE_PROVIDER_INSTANCE_INFO .?AU_TRACE_PROVIDER_INSTANCE_INFO@@ R
" NextOffset ���
" EnableCount ��
" Pid ��
" Flags V �G _TRACE_PROVIDER_INSTANCE_INFO .?AU_TRACE_PROVIDER_INSTANCE_INFO@@ �G � � J � _RTL_CRITICAL_SECTION64 .?AU_RTL_CRITICAL_SECTION64@@
�G
� �
# DebugInfo
LockCount
RecursionCount ���
# OwningThread �
# LockSemaphore
# SpinCount J �G ( _RTL_CRITICAL_SECTION64 .?AU_RTL_CRITICAL_SECTION64@@ �G L �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��Z
�G RequireProfileTotalIssuesSource ��
�G ForceProfileTimeSource ���
�G NoProfileSampling
�G NoCSwitchSampling
�G NoReadyThreadSampling
�G NoFaultSampling ��
�G NoStackCache �
�G NoSampleBuffers ��
�G NoPauseWhenFull ��
�G NoLowPriority
�G WithAppId
�G FilterKernel �: �G <anonymous-tag> .?AU<anonymous-tag>@@ �G � �
P& V2 ���2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � � 2
R& Intel
U& Amd ��
X& Arm ��2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � { 2
" ReplyCount ���
" NotifyeeCount 2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � R :
LoggerExtension ��
# LoggerExtension64 2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � � 2
� LoggerName ���
LoggerName64 �2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � { 2
� LogFileName ��
LogFileName64 2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � u :
LoggerThreadId ���
# LoggerThreadId64 �2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � q .
" LogBuffersLost ���
" Flags 2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � k :
" EventsLost ���
" NumberOfProcessors ���2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � f 2
" FreeBuffers ��
" InstanceId ���2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � b 6
" NumberOfBuffers ��
" InstanceCount 2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � ^ 6
LogFileHandle
# LogFileHandle64 ��2 �G <anonymous-tag> .?AT<anonymous-tag>@@ �G � Z
# ��
# ��
# ��
# ��f
�G Wow ��
�G QpcDeltaTracking �
�G LargeMdlPages
�G ExcludeKernelStack ���: �G <anonymous-tag> .?AU<anonymous-tag>@@ H � N
# ��
# ��
# ��
# ��z
H Wow ��
H QpcDeltaTracking �
H LargeMdlPages
H ExcludeKernelStack ���
# V2Options 2 H <anonymous-tag> .?AT<anonymous-tag>@@ H � M 2
AgeLimit �
FlushThreshold ���2 H <anonymous-tag> .?AT<anonymous-tag>@@
H � I B
" PagedPoolPageCount ���
" VirtualSizeInPages ���2 H <anonymous-tag> .?AT<anonymous-tag>@@
H � � 2
" UniqueProcessId ��
" SessionId 2 H <anonymous-tag> .?AT<anonymous-tag>@@ H � �
! ��
! ��
! ��Z
H ActiveDataReference ��
H DeviceEjectable ��
H WritableHandles ��: H <anonymous-tag> .?AU<anonymous-tag>@@ H �
" ��
" ��&
H TypeInfo �
H Spare : H <anonymous-tag> .?AU<anonymous-tag>@@ H � |
" ��
" ��6
H TypeInfo �
H Spare
" Flags 2 H <anonymous-tag> .?AT<anonymous-tag>@@ H � {
" ��
" ��&
"H Direction
#H Spare : $H <anonymous-tag> .?AU<anonymous-tag>@@ %H � i
" ��
" ��6
'H Direction
(H Spare
" Flags 2 )H <anonymous-tag> .?AT<anonymous-tag>@@ *H � h V
ProtoPteAddress ��
" PageFrameIndex ���
VirtualAddress ���2 ,H <anonymous-tag> .?AT<anonymous-tag>@@ -H � �
# ��
# 0��
# 4��F
/H UseDescription ���
0H UniqueKey
1H Reserved �: 2H <anonymous-tag> .?AU<anonymous-tag>@@ 3H � �
��
��
��
��Z
5H ExecutingDpc �
6H ExecutingIsr �
7H Reserved �
8H Priority �: 9H <anonymous-tag> .?AU<anonymous-tag>@@ :H � �
��
��
��
��j
<H ExecutingDpc �
=H ExecutingIsr �
>H Reserved �
?H Priority �
Flags 2 @H <anonymous-tag> .?AT<anonymous-tag>@@ AH � N
! Properties ���
ExpectedWakeReason ���
Reserved �: CH <anonymous-tag> .?AU<anonymous-tag>@@ DH � ^
! Properties ���
ExpectedWakeReason ���
Reserved �
" Flags 2 FH <anonymous-tag> .?AT<anonymous-tag>@@ GH � B
# DeliveredIncrement ���
# RequestedIncrement ���: IH <anonymous-tag> .?AU<anonymous-tag>@@ JH �
b
# DeliveredIncrement ���
# RequestedIncrement ���
# NextClockUpdateTime ��2 LH <anonymous-tag> .?AT<anonymous-tag>@@ MH �
��
��
��
��j
OH ExecutingDpc �
PH WakeupBoost ��
QH BoostedOutstandingIrps ���
RH Reserved �: SH <anonymous-tag> .?AU<anonymous-tag>@@ TH � �
��
��
��
��z
VH ExecutingDpc �
WH WakeupBoost ��
XH BoostedOutstandingIrps ���
YH Reserved �
Flags 2 ZH <anonymous-tag> .?AT<anonymous-tag>@@ [H � �
p ��
p ��
p ��
p ��v
]H NewIoPriorityFloor ���
^H OldIoPriority
_H NewIoQoSPriorityFloor
`H OldIoQoSPriority �: aH <anonymous-tag> .?AU<anonymous-tag>@@ bH � �
p ��
p ��
p ��
p ��
dH NewIoPriorityFloor ���
eH OldIoPriority
fH NewIoQoSPriorityFloor
gH OldIoQoSPriority �
p IoPriorities �2 hH <anonymous-tag> .?AT<anonymous-tag>@@ iH � �
��
��
��
��
��
kH ExecutingDpc �
lH KernelStackNotResident ���
mH ProcessOutOfMemory ���
nH DirectSwitchAttempt ��
oH Reserved �: pH <anonymous-tag> .?AU<anonymous-tag>@@ qH � �
��
��
��
��
��
sH ExecutingDpc �
tH KernelStackNotResident ���
uH ProcessOutOfMemory ���
vH DirectSwitchAttempt ��
wH Reserved �
Flags 2 xH <anonymous-tag> .?AT<anonymous-tag>@@ yH � �
��
��
��J
{H AcquireMode ��
|H ExecuteDpc ���
}H ExecuteIsr ���: ~H <anonymous-tag> .?AU<anonymous-tag>@@ H � Q
��
��
��Z
�H AcquireMode ��
�H ExecuteDpc ���
�H ExecuteIsr ���
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � P
��
��
��
��r
�H OldThreadWaitMode
�H OldThreadBamQosLevel �
�H NewThreadBamQosLevel �
�H Reserved �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � /
��
��
��
��
�H OldThreadWaitMode
�H OldThreadBamQosLevel �
�H NewThreadBamQosLevel �
�H Reserved �
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � . >
p NewThreadPriorityDecrement ���
p SpareByte 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � ) 6
PreviousCState ���
OldThreadRank 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � % &
" Index
" InfoClass 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � � .
# StartAddr64 ��
# Affinity �2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � / *
StartAddr
" Affinity �2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � *
Pointer0 �
Pointer1 �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � n
� Padding1 �
�" ReferenceTime
� GlobalEntry ��
Pointer0 �
Pointer1 �2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H �
# ��
# =��*
�H ClockType
�H Frequency : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � �
# ��
# =��Z
�H ClockType
�H Frequency
SlistEntry ���
�" NextBuffer ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � � *
" Header ���
iE Packet ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � � :
! Size �
Reserved �
Version ��: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � � N
" Marker ���
! Size �
Reserved �
Version ��2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � � *
" Header ���
�" Packet ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � h >
! Version ��
HeaderType ���
Flags : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � b R
" Marker ���
! Version ��
HeaderType ���
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � ` *
# TS ���
} SystemTime ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � T *
" Header ���
�" Packet ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � P >
! Version ��
HeaderType ���
Flags : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � J R
" Marker ���
! Version ��
HeaderType ���
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � H .
" KernelTime ���
" UserTime �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � 0 *
" ClientContext
" Flags : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � , n
" ClientContext
" Flags
" KernelTime ���
" UserTime �
# ProcessorTime 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � + &
� Guid �
# GuidPtr ��2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � ' &
" Version ��
+ Class 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � 2
HeaderType ���
MarkerFlags ��: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � N
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � "
Type �
Group : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � 6
! HookId ���
Type �
Group 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � .
" KernelTime ���
" UserTime �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � � F
" KernelTime ���
" UserTime �
# ProcessorTime 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � �
! ��
! ��*
�H Linkage ��
�H Reserved2 : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � K :
Type �
Reserved1
! Reserved2 : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H � � N
" Reserved �
Type �
Reserved1
! Reserved2 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H � �
&9 Level1 ���2 �H ( <anonymous-tag> .?AT<anonymous-tag>@@ �H � 2 MidlWinrtTypeSerializationInfoVersionOne � t I <unnamed-enum-MidlWinrtTypeSerializationInfoVersionOne> .?AW4<unnamed-enum-MidlWinrtTypeSerializationInfoVersionOne>@@ � I � � * MidlInterceptionInfoVersionOne ���r t I <unnamed-enum-MidlInterceptionInfoVersionOne> .?AW4<unnamed-enum-MidlInterceptionInfoVersionOne>@@ � I � �
G
�
I
� N
u DispatchTableCount ���
I DispatchTable
Reserved �B I RPC_DISPATCH_TABLE .?AURPC_DISPATCH_TABLE@@ ��
I � � J � RPC_INTERFACE_TEMPLATEA .?AURPC_INTERFACE_TEMPLATEA@@ �
" Version ��
IfSpec ���
�0 MgrTypeUuid ��
MgrEpv ���
u Flags
u MaxCalls �
u MaxRpcSize ���
�0 IfCallback ���
�0 UuidVector ���
$ Annotation ���
( SecurityDescriptor ���J
I , RPC_INTERFACE_TEMPLATEA .?AURPC_INTERFACE_TEMPLATEA@@ I � p J � RPC_ENDPOINT_TEMPLATEA .?AURPC_ENDPOINT_TEMPLATEA@@ ��r
" Version ��
ProtSeq ��
Endpoint �
SecurityDescriptor ���
" Backlog ��J I RPC_ENDPOINT_TEMPLATEA .?AURPC_ENDPOINT_TEMPLATEA@@ �� I � S J � RPC_ENDPOINT_TEMPLATEW .?AURPC_ENDPOINT_TEMPLATEW@@ ��r
" Version ��
q ProtSeq ��
q Endpoint �
SecurityDescriptor ���
" Backlog ��J I RPC_ENDPOINT_TEMPLATEW .?AURPC_ENDPOINT_TEMPLATEW@@ �� I � J
�- HttpCredentials ��2 I <anonymous-tag> .?AT<anonymous-tag>@@ I � > � MOFRESOURCEINFOW .?AUMOFRESOURCEINFOW@@ ��b
q ImagePath
q ResourceName �
" ResourceSize �
ResourceBuffer ���> I MOFRESOURCEINFOW .?AUMOFRESOURCEINFOW@@ �� I �2 4 :
t< EventCallback
x< EventRecordCallback ��2 I <anonymous-tag> .?AT<anonymous-tag>@@ I � � 6
" LogFileMode ��
" ProcessTraceMode �2 "I <anonymous-tag> .?AT<anonymous-tag>@@ #I � � :
t< EventCallback
x< EventRecordCallback ��2 %I <anonymous-tag> .?AT<anonymous-tag>@@ &I � � 6
" LogFileMode ��
" ProcessTraceMode �2 (I <anonymous-tag> .?AT<anonymous-tag>@@ )I � p 2
" ClientContext
� BufferContext 2 +I <anonymous-tag> .?AT<anonymous-tag>@@ ,I � " 2
ProcessorNumber ��
Alignment : .I <anonymous-tag> .?AU<anonymous-tag>@@ /I � � N
ProcessorNumber ��
Alignment
! ProcessorIndex ���2 1I <anonymous-tag> .?AT<anonymous-tag>@@ 2I � �
" ��
" ��
" ��
" ��f
4I Wow ��
5I QpcDeltaTracking �
6I LargeMdlPages
7I ExcludeKernelStack ���: 8I <anonymous-tag> .?AU<anonymous-tag>@@ 9I � �
" ��
" ��
" ��
" ��z
;I Wow ��
<I QpcDeltaTracking �
=I LargeMdlPages
>I ExcludeKernelStack ���
# V2Options 2 ?I <anonymous-tag> .?AT<anonymous-tag>@@ @I � �
" ��
BI VersionNumber : CI <anonymous-tag> .?AU<anonymous-tag>@@ DI � �
" ��.
FI VersionNumber
" V2Control 2 GI <anonymous-tag> .?AT<anonymous-tag>@@ HI � � 2
AgeLimit �
FlushThreshold ���2 JI <anonymous-tag> .?AT<anonymous-tag>@@ KI � � 2
AgeLimit �
FlushThreshold ���2 MI <anonymous-tag> .?AT<anonymous-tag>@@ NI � i b
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz : PI <anonymous-tag> .?AU<anonymous-tag>@@ QI � # ~
� LogInstanceGuid ��
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz 2 SI <anonymous-tag> .?AT<anonymous-tag>@@ TI � ! .
" Version ��
VersionDetail 2 VI <anonymous-tag> .?AT<anonymous-tag>@@ WI � b
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz : YI <anonymous-tag> .?AU<anonymous-tag>@@ ZI � � ~
� LogInstanceGuid ��
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz 2 \I <anonymous-tag> .?AT<anonymous-tag>@@ ]I � � .
" Version ��
�& VersionDetail 2 _I <anonymous-tag> .?AT<anonymous-tag>@@ `I � � b
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz : bI <anonymous-tag> .?AU<anonymous-tag>@@ cI � � ~
� LogInstanceGuid ��
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz 2 eI <anonymous-tag> .?AT<anonymous-tag>@@ fI � � .
" Version ��
o9 VersionDetail 2 hI <anonymous-tag> .?AT<anonymous-tag>@@ iI � � &
" EventId ��
" Flags : kI <anonymous-tag> .?AU<anonymous-tag>@@ lI � e .
" KernelTime ���
" UserTime �: nI <anonymous-tag> .?AU<anonymous-tag>@@ oI � ` j
" KernelTime ���
" UserTime �
# ProcessorTime
" EventId ��
" Flags 2 qI <anonymous-tag> .?AT<anonymous-tag>@@ rI � _ &
" Version ��
�: Class 2 tI <anonymous-tag> .?AT<anonymous-tag>@@ uI � Q 2
HeaderType ���
MarkerFlags ��: wI <anonymous-tag> .?AU<anonymous-tag>@@ xI � L N
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��2 zI <anonymous-tag> .?AT<anonymous-tag>@@ {I � J *
" ClientContext
" Flags : }I <anonymous-tag> .?AU<anonymous-tag>@@ ~I � > .
" KernelTime ���
" UserTime �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � 9 n
" KernelTime ���
" UserTime �
# ProcessorTime
" ClientContext
" Flags 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � 8 &
� Guid �
# GuidPtr ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � 4 &
" Version ��
� Class 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � ) 2
HeaderType ���
MarkerFlags ��: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � $ N
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � " 2 � WMIREGINFOW .?AUWMIREGINFOW@@ �2 " �
" BufferSize ���
" NextWmiRegInfo ���
" RegistryPath �
" MofResourceName ��
" GuidCount
�I WmiRegGuid ���2 �I WMIREGINFOW .?AUWMIREGINFOW@@ �I 8 y b
" InstanceNameList �
" BaseNameOffset ���
" Pdo ��
" InstanceInfo �2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I 8 1 q " �B
" TargetInstanceIndex ��
�I TargetInstanceName ���2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I 8 F
" FixedInstanceSize
� OffsetInstanceDataAndLength ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I 8 � B
" CountLost
KernelHandle �
} TimeStamp 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I 8 - *
" Version ��
" Linkage ��: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I 8 & F
# HistoricalContext
" Version ��
" Linkage ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I 8 #
�# Data �Z �I SERVICE_TRIGGER_CUSTOM_STATE_ID .?AUSERVICE_TRIGGER_CUSTOM_STATE_ID@@ �I 3 � 6
r' mouse
U' keyboard �
hid ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I 2; 2
! usButtonFlags
! usButtonData �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I D: F
" ulButtons
! usButtonFlags
! usButtonData �2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I B:
@ _11 ��
@ _12 ��
@ _13 ��
@ _14 ��
@ _21 ��
@ _22 ��
@ _23 ��
@ _24 ��
@ _31 ��
@ $ _32 ��
@ ( _33 ��
@ , _34 ��
@ 0 _41 ��
@ 4 _42 ��
@ 8 _43 ��
@ < _44 ��:
�I @ <anonymous-tag> .?AU<anonymous-tag>@@ �I �
@ _11 ��
@ _12 ��
@ _13 ��
@ _14 ��
@ _21 ��
@ _22 ��
@ _23 ��
@ _24 ��
@ _31 ��
@ $ _32 ��
@ ( _33 ��
@ , _34 ��
@ 0 _41 ��
@ 4 _42 ��
@ 8 _43 ��
@ < _44 ��
�; m 2 �I @ <anonymous-tag> .?AT<anonymous-tag>@@ �I � *
� touchInfo
� penInfo ��2 �I � <anonymous-tag> .?AT<anonymous-tag>@@ �I J 2
� mi ���
� ki ���
� hi ���2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � J � POWERBROADCAST_SETTING .?AUPOWERBROADCAST_SETTING@@ ��B
� PowerSetting �
" DataLength ���
| Data �J �I POWERBROADCAST_SETTING .?AUPOWERBROADCAST_SETTING@@ �� �I / 6 � SHELLHOOKINFO .?AUSHELLHOOKINFO@@ "
y hwnd �
� rc ���6 �I SHELLHOOKINFO .?AUSHELLHOOKINFO@@ �I
u ��
u ��6
�I enableAdvancedColor ��
�I reserved �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I o
u ��
u ��F
�I enableAdvancedColor ��
�I reserved �
u value 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I m
u ��
u ��
u ��
u ��
u ��
�I advancedColorSupported ���
�I advancedColorEnabled �
�I wideColorEnforced
�I advancedColorForceDisabled ���
�I reserved �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I Z
u ��
u ��
u ��
u ��
u ��
�I advancedColorSupported ���
�I advancedColorEnabled �
�I wideColorEnforced
�I advancedColorForceDisabled ���
�I reserved �
u value 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I X
u ��
u ��B
�I disableMonitorVirtualResolution ��
�I reserved �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I B
u ��
u ��R
�I disableMonitorVirtualResolution ��
�I reserved �
u value 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I @
u ��
u ��2
�I bootPersistenceOn
�I reserved �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I 4
u ��
u ��B
�I bootPersistenceOn
�I reserved �
u value 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I 2
u ��
u ��
u ��
u ��n
�I friendlyNameFromEdid �
�I friendlyNameForced ���
�I edidIdsValid �
�I reserved �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I
u ��
u ��
u ��
u ��~
�I friendlyNameFromEdid �
J friendlyNameForced ���
J edidIdsValid �
J reserved �
u value 2 J <anonymous-tag> .?AT<anonymous-tag>@@ J
u ��
u ��>
J desktopModeInfoIdx ���
J targetModeInfoIdx : J <anonymous-tag> .?AU<anonymous-tag>@@ J �
u ��
u ��V
u modeInfoIdx ��
J desktopModeInfoIdx ���
J targetModeInfoIdx 2
J <anonymous-tag> .?AT<anonymous-tag>@@ J �
u ��
u ��6
J cloneGroupId �
J sourceModeInfoIdx : J <anonymous-tag> .?AU<anonymous-tag>@@ J �
u ��
u ��N
u modeInfoIdx ��
J cloneGroupId �
J sourceModeInfoIdx 2 J <anonymous-tag> .?AT<anonymous-tag>@@ J � N
(/ targetMode ���
e@ sourceMode ���
f@ desktopImageInfo �2 J 0 <anonymous-tag> .?AT<anonymous-tag>@@ J u :
�E AdditionalSignalInfo �
u videoStandard 2 J <anonymous-tag> .?AT<anonymous-tag>@@ J # .
" dmDisplayFlags ���
" dmNup 2 J <anonymous-tag> .?AT<anonymous-tag>@@ !J � Z
I dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �: #J <anonymous-tag> .?AU<anonymous-tag>@@ $J � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���: &J <anonymous-tag> .?AU<anonymous-tag>@@ 'J �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���
I dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �2 )J <anonymous-tag> .?AT<anonymous-tag>@@ *J � .
" dmDisplayFlags ���
" dmNup 2 ,J <anonymous-tag> .?AT<anonymous-tag>@@ -J � Z
I dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �: /J <anonymous-tag> .?AU<anonymous-tag>@@ 0J � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���: 2J <anonymous-tag> .?AU<anonymous-tag>@@ 3J �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���
I dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �2 5J <anonymous-tag> .?AT<anonymous-tag>@@ 6J � F
} FileId ���
� ObjectId �
� ExtendedFileId ���2 8J <anonymous-tag> .?AT<anonymous-tag>@@ 9J �# .
ReplaceIfExists ��
" Flags 2 ;J <anonymous-tag> .?AT<anonymous-tag>@@ <J �"
" ��
" ��>
>J IsUmsSchedulerThread �
?J IsUmsWorkerThread : @J <anonymous-tag> .?AU<anonymous-tag>@@ AJ N
" ��
" ��Z
CJ IsUmsSchedulerThread �
DJ IsUmsWorkerThread
" ThreadUmsFlags ���2 EJ <anonymous-tag> .?AT<anonymous-tag>@@ FJ M
" ��
" ��
" ��
" ��
" ��
" ��
" ��
HJ Private ��
IJ MappedDataFile ���
JJ MappedImage ��
KJ MappedPageFile ���
LJ MappedPhysical ���
MJ DirectMapped �
NJ Reserved �: OJ <anonymous-tag> .?AU<anonymous-tag>@@ PJ �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
RJ Private ��
SJ MappedDataFile ���
TJ MappedImage ��
UJ MappedPageFile ���
VJ MappedPhysical ���
WJ DirectMapped �
XJ Reserved �2 YJ <anonymous-tag> .?AT<anonymous-tag>@@ ZJ � :
! wProcessorArchitecture ���
! wReserved : \J <anonymous-tag> .?AU<anonymous-tag>@@ ]J A 2 N
" dwOemId ��
! wProcessorArchitecture ���
! wReserved 2 _J <anonymous-tag> .?AT<anonymous-tag>@@ `J A 0 &
j0 Block
m0 Region ���2 bJ <anonymous-tag> .?AT<anonymous-tag>@@ cJ c � .
" Offset ���
" OffsetHigh ���: eJ <anonymous-tag> .?AU<anonymous-tag>@@ fJ c 8 B
" Offset ���
" OffsetHigh ���
Pointer ��2 hJ <anonymous-tag> .?AT<anonymous-tag>@@ iJ c 7 �
�7 MemoryAllocData ��
�7 MemoryFreeData ���
�7 MemoryProtectData
�7 InstructionCacheFlushData
�7 MemoryDirtyData ��2 kJ <anonymous-tag> .?AT<anonymous-tag>@@ lJ L �
" ��
" ��>
nJ First
oJ HeavyFlush ���
" Sequence �: pJ <anonymous-tag> .?AU<anonymous-tag>@@ qJ L �
" ��
" ��N
sJ First
tJ HeavyFlush ���
" Sequence �
Value 2 uJ <anonymous-tag> .?AT<anonymous-tag>@@ vJ L � Z � RTLWOW64_CROSSPROCESS_WORK_HEAD .?AURTLWOW64_CROSSPROCESS_WORK_HEAD@@
" ��
" ��N
yJ First
zJ HeavyFlush ���
" Sequence �
Value Z {J RTLWOW64_CROSSPROCESS_WORK_HEAD .?AURTLWOW64_CROSSPROCESS_WORK_HEAD@@ |J L � &
" Flags
" dwFlags ��2 ~J <anonymous-tag> .?AT<anonymous-tag>@@ J L � 2
� ActivationContext
hActCtx ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J L � &
" Flags
C& NextFree �2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J L � *
" Modules ��
" ModulesEx 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J L *
�8 Modules ��
�8 ModulesEx 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J L � B
�" ProcessHeapInformation ���
4 HeapInformation ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J L ` �
�" ProcessHeapInformation ���
4 HeapInformation ��
� HeapRegionInformation
�$ HeapRangeInformation �
�: HeapBlockInformation �
'6 HeapPerfInformation ��
" DynamicStart �2 �J \ <anonymous-tag> .?AT<anonymous-tag>@@ �J L B b
" CommittedSize
" UnCommittedSize ��
FirstEntry ���
LastEntry : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J L � b
" Settable �
! TagIndex �
! AllocatorBackTraceIndex ��
� Reserved �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J L � &
�J Block
�J Segment ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J L �
" ��
" ��*
�J WakeCount
�J Waking ���: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J L E
" ��
" ��J
�J WakeCount
�J Waking ���
" Value
Ptr ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J L C
" ��
" ��
" ��
" ��
" ��n
�J Locked ���
�J Waiting ��
�J Waking ���
�J MultipleShared ���
�J Shared ���: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J L �
" ��
" ��
" ��
" ��
" ��
�J Locked ���
�J Waiting ��
�J Waking ���
�J MultipleShared ���
�J Shared ���
" Value
Ptr ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J L �
" ��
" ��.
�J CurrentThread
�J Reserved1 : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J �
" ��
" ��>
" Flags
�J CurrentThread
�J Reserved1 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J �
# ��
# ?��"
�J Busy �
�J Ticks : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
��&
�J Encoded ��
i Min ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J m . *
" Lock �
�! RangeBitmap ��: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � � :
" Lock �
�! RangeBitmap ��
Next �2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � �
# ��
# ��
# ��
# <��r
�J PolicyState ��
�J AlwaysInherit
�J EnableAdditionalPolicyOption �
�J AuditReserved : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
# ��
# ��
# ��
# <��n
�J AuditState ���
�J AuditFlag
�J EnableAdditionalAuditingOption ���
�J Reserved �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � � 6
| ControlData ��
Y DatabaseCreate ���2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � �
FunctionTable 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � �
None �
BoolValue
p Int8Value
UInt8Value ���
Int16Value ���
! UInt16Value ��
t Int32Value ���
u UInt32Value ��
Int64Value ���
# UInt64Value ��
� AnsiStringValue ��
P UnicodeStringValue ���2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J ( p&
W ��
W >��:
�J KernelUpdateLock �
�J PrimaryClientID ��: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J ( �!
W ��
W >��R
�J KernelUpdateLock �
�J PrimaryClientID ��
W ContextLock ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J ( �!
M ��
M ��
M ��
M ��
M ��
M ��
M ���
�J ScheduledThread ��
�J Suspended
�J VolatileContext ��
�J Terminated ���
�J DebugActive ��
�J RunningOnSelfThread ��
�J DenyRunningOnSelfThread ��: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J ( �!
M ��
M ��
M ��
M ��
M ��
M ��
M ���
�J ScheduledThread ��
�J Suspended
�J VolatileContext ��
�J Terminated ���
�J DebugActive ��
�J RunningOnSelfThread ��
K DenyRunningOnSelfThread ��
Flags 2 K <anonymous-tag> .?AT<anonymous-tag>@@ K ( �! *
3 HashEntry
CurEntry �2 K <anonymous-tag> .?AT<anonymous-tag>@@ K ( 3
" ��
" ��
" ��
" ��z
K ElevationEnabled �
K VirtualizationEnabled
K InstallerDetectEnabled ���
K ReservedBits �: K <anonymous-tag> .?AU<anonymous-tag>@@ K ( n
Barrier ��
LeftBarrier ��
I WaitEvent
TotalProcessors ��
" Spins : K <anonymous-tag> .?AU<anonymous-tag>@@ K ( Y �
Barrier ��
LeftBarrier ��
I WaitEvent
TotalProcessors ��
" Spins
K DUMMYRESERVEDSTRUCTNAME ��2 K <anonymous-tag> .?AT<anonymous-tag>@@ K ( X
" ��
K State : K <anonymous-tag> .?AU<anonymous-tag>@@ K ( 2
Next �
! Depth
! CpuId : K <anonymous-tag> .?AU<anonymous-tag>@@ K ( �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
! McaCod ���
! MsCod
K OtherInfo
K Damage ���
K AddressValid �
K MiscValid
K Enabled ��
K UnCorrected ��
!K OverFlow �
"K Valid :
#K <anonymous-tag> .?AU<anonymous-tag>@@ $K � l *
" Address ��
" Reserved �: &K <anonymous-tag> .?AU<anonymous-tag>@@ 'K � 0
R6
� � )K *K
+K
� *
� Raw ��
� Translated ���2 -K <anonymous-tag> .?AT<anonymous-tag>@@ .K � � v
# ULong64 ��
Pointer ��
" Size �
Handle ���
" ULong
" AccessMask ���2 0K <anonymous-tag> .?AT<anonymous-tag>@@ 1K 3
# ��
# 8��&
3K Type �
4K Reserved �: 5K <anonymous-tag> .?AU<anonymous-tag>@@ 6K 3
" ��
" ��*
8K CommitEvents �
9K Spare : :K <anonymous-tag> .?AU<anonymous-tag>@@ ;K �
��
��
��N
=K ComPlus ��
>K ImageDynamicallyRelocated
?K Reserved �: @K <anonymous-tag> .?AU<anonymous-tag>@@ AK �
��
��
��f
ImageFlags ���
CK ComPlus ��
DK ImageDynamicallyRelocated
EK Reserved �2 FK <anonymous-tag> .?AT<anonymous-tag>@@ GK � R
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��: IK <anonymous-tag> .?AU<anonymous-tag>@@ JK � v
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���2 LK <anonymous-tag> .?AT<anonymous-tag>@@ MK � B
! SubSystemMinorVersion
! SubSystemMajorVersion : OK <anonymous-tag> .?AU<anonymous-tag>@@ PK � ^
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �2 RK <anonymous-tag> .?AT<anonymous-tag>@@ SK �
��
��
��N
UK ComPlus ��
VK ImageDynamicallyRelocated
WK Reserved �: XK <anonymous-tag> .?AU<anonymous-tag>@@ YK �
��
��
��f
ImageFlags ���
[K ComPlus ��
\K ImageDynamicallyRelocated
]K Reserved �2 ^K <anonymous-tag> .?AT<anonymous-tag>@@ _K � R
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��: aK <anonymous-tag> .?AU<anonymous-tag>@@ bK � v
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���2 dK <anonymous-tag> .?AT<anonymous-tag>@@ eK � B
! SubSystemMinorVersion
! SubSystemMajorVersion : gK <anonymous-tag> .?AU<anonymous-tag>@@ hK � ^
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �2 jK <anonymous-tag> .?AT<anonymous-tag>@@ kK �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��Z
mK ImageExportSuppressionEnabled
nK ImageCetShadowStacksReady
oK ImageXfgEnabled ��
pK ImageCetShadowStacksStrictMode ���
qK ImageCetSetContextIpValidationRelaxedMode
rK ImageCetDynamicApisAllowInProc ���
sK ImageCetDowngradeReserved1 ���
tK ImageCetDowngradeReserved2 ���
uK Reserved �: vK <anonymous-tag> .?AU<anonymous-tag>@@ wK �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��r
" ExtendedFlags
yK ImageExportSuppressionEnabled
zK ImageCetShadowStacksReady
{K ImageXfgEnabled ��
|K ImageCetShadowStacksStrictMode ���
}K ImageCetSetContextIpValidationRelaxedMode
~K ImageCetDynamicApisAllowInProc ���
K ImageCetDowngradeReserved1 ���
�K ImageCetDowngradeReserved2 ���
�K Reserved �2
�K <anonymous-tag> .?AT<anonymous-tag>@@ �K �
��
��
��
��
��
��
���
�K ComPlusNativeReady ���
�K ComPlusILOnly
�K ImageDynamicallyRelocated
�K ImageMappedFlat ��
�K BaseBelow4gb �
�K ComPlusPrefer32bit ���
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K �
��
��
��
��
��
��
���
ImageFlags ���
�K ComPlusNativeReady ���
�K ComPlusILOnly
�K ImageDynamicallyRelocated
�K ImageMappedFlat ��
�K BaseBelow4gb �
�K ComPlusPrefer32bit ���
�K Reserved �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K � R
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K � v
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K � B
! SubSystemMinorVersion
! SubSystemMajorVersion : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K ~ ^
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K }
" ��
" ��&
�K State
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K �
" ��
" ��B
�K State
�K Reserved �
" AllInformation ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K �
" ��
" ��
" ��
" ��n
�K ImagePartialMap ��
�K ImageNotExecutable ���
�K ImageSigningLevel
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K �
" ��
" ��
" ��
" ��
" ImageFlags ���
�K ImagePartialMap ��
�K ImageNotExecutable ���
�K ImageSigningLevel
�K Reserved �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�K Private ��
�K MappedDataFile ���
�K MappedImage ��
�K MappedPageFile ���
�K MappedPhysical ���
�K DirectMapped �
�K SoftwareEnclave ��
�K PageSize64K ��
�K PlaceholderReservation ���
�K Reserved �:
�K <anonymous-tag> .?AU<anonymous-tag>@@ �K �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" RegionType ���
�K Private ��
�K MappedDataFile ���
�K MappedImage ��
�K MappedPageFile ���
�K MappedPhysical ���
�K DirectMapped �
�K SoftwareEnclave ��
�K PageSize64K ��
�K PlaceholderReservation ���
�K Reserved �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
�K Valid
�K ShareCount ���
�K Win32Protection ��
�K Shared ���
�K Node �
�K Locked ���
�K LargePage
�K Priority �
�K Reserved �
�K SharedOriginal ���
�K Bad ��: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K L
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�K Valid
�K ShareCount ���
�K Win32Protection ��
�K Shared ���
�K Node �
�K Locked ���
�K LargePage
�K Priority �
�K Reserved �
�K SharedOriginal ���
�K Bad ��
,) Invalid ��2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K K .
ImageHandle ��
# Unused ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K ? � 6
SignatureInfoHandle ��
# Unused ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K ? � ^
# ULong64 ��
Pointer ��
" Size �
Handle ���
" ULong 2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K ? �
# ��
# 8��&
�K Type �
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K ? �
" ��
" ��2
L HypervisorPages ��
L Reserved �: L <anonymous-tag> .?AU<anonymous-tag>@@ L f
" ��
" ��
" ��
" ��
" ��
L UseDumpStorageStack ��
L CompressMemoryPagesData ��
L IncludeUserSpaceMemoryPages ��
L AbortIfMemoryPressure
L Reserved �: L <anonymous-tag> .?AU<anonymous-tag>@@ L >
" ��
" ��*
L Enabled ��
L Reserved �: L <anonymous-tag> .?AU<anonymous-tag>@@ L
" ��
" ��>
L Enabled ��
L Reserved �
" AsULONG ��2 L <anonymous-tag> .?AT<anonymous-tag>@@ L
� PebsDsSaveArea ���2 L � <anonymous-tag> .?AT<anonymous-tag>@@ L � *
� As32Bit ��
� As64Bit ��2 L � <anonymous-tag> .?AT<anonymous-tag>@@ L �
" ��
" ��2
L KernelTransition �
L Reserved �: L <anonymous-tag> .?AU<anonymous-tag>@@ !L �
" ��
" ��B
#L KernelTransition �
$L Reserved �
" ul ���2 %L <anonymous-tag> .?AT<anonymous-tag>@@ &L �
" ��
" ��
" ��F
(L SameRsdt �
)L SlicPresent ��
*L SlicDifferent : +L <anonymous-tag> .?AU<anonymous-tag>@@ ,L �
" ��
" ��
" ��
" ��Z
.L Locked ���
/L UnlockApplied
0L UnlockIdValid
1L Reserved �: 2L <anonymous-tag> .?AU<anonymous-tag>@@ 3L �
" ��
" ��
" ��
" ��j
" Flags
5L Locked ���
6L UnlockApplied
7L UnlockIdValid
8L Reserved �2 9L <anonymous-tag> .?AT<anonymous-tag>@@ :L �
" ��
" ��
" ��
" ��
" ��
" ��
<L CetCapable ���
=L UserCetAllowed ���
>L ReservedForUserCet ���
?L KernelCetEnabled �
@L ReservedForKernelCet �
AL Reserved �: BL <anonymous-tag> .?AU<anonymous-tag>@@ CL ,
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
EL CetCapable ���
FL UserCetAllowed ���
GL ReservedForUserCet ���
HL KernelCetEnabled �
IL ReservedForKernelCet �
JL Reserved �2 KL <anonymous-tag> .?AT<anonymous-tag>@@ LL *
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
NL DbgMenuOsSelection ���
OL DbgHiberBoot �
PL DbgSoftBoot ��
QL DbgMeasuredLaunch
RL DbgMeasuredLaunchCapable �
SL DbgSystemHiveReplace �
TL DbgMeasuredLaunchSmmProtections ��
UL DbgMeasuredLaunchSmmLevel : VL <anonymous-tag> .?AU<anonymous-tag>@@ WL
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# BootFlags
YL DbgMenuOsSelection ���
ZL DbgHiberBoot �
[L DbgSoftBoot ��
\L DbgMeasuredLaunch
]L DbgMeasuredLaunchCapable �
^L DbgSystemHiveReplace �
_L DbgMeasuredLaunchSmmProtections ��
`L DbgMeasuredLaunchSmmLevel 2 aL <anonymous-tag> .?AT<anonymous-tag>@@ bL
&
� Tag ��
" TagUlong �2 dL <anonymous-tag> .?AT<anonymous-tag>@@ eL �
" ��2
VirtualAddress ���
gL NonPaged �2 hL <anonymous-tag> .?AT<anonymous-tag>@@ iL �
&
� Tag ��
" TagUlong �2 kL <anonymous-tag> .?AT<anonymous-tag>@@ lL v
F
� Tag ��
" TagUlong �
ProcessChargedQuota ��2 nL <anonymous-tag> .?AT<anonymous-tag>@@ oL d
B
" PagedPoolPageCount ���
" VirtualSizeInPages ���2 qL <anonymous-tag> .?AT<anonymous-tag>@@ rL � 2
" UniqueProcessId ��
" SessionId 2 tL <anonymous-tag> .?AT<anonymous-tag>@@ uL �
" ��
" ��
" ��
" ��n
wL HasStrongId ��
xL Classification ���
yL BackgroundActivityModerated ��
zL Spare : {L <anonymous-tag> .?AU<anonymous-tag>@@ |L /
" ��
" ��
" ��
" ��~
" Flags
~L HasStrongId ��
L Classification ���
�L BackgroundActivityModerated ��
�L Spare 2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L - V
5 ActiveProcessorsGroupAffinity
5 AvailableMemory ��
5 Pad ��2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L =
" ��
" ��
" ��
" ��
" ��
" ��
�L Set ��
�L Update ���
�L Clear
�L DscpTagEnabled ���
�L MaxBandwidthEnabled ��
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L { �
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
�L Set ��
�L Update ���
�L Clear
�L DscpTagEnabled ���
�L MaxBandwidthEnabled ��
�L Reserved �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L { � 2
7 QpcBypassEnabled �
QpcShift �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L { � F
! QpcData ��
7 QpcBypassEnabled �
QpcShift �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L { � >
� ReservedTickCountOverlay �
� TickCountPad �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L { ^ j
r TickCount
W TickCountQuad
� ReservedTickCountOverlay �
� TickCountPad �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L { [
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��~
�L DbgErrorPortPresent ��
�L DbgElevationEnabled ��
�L DbgVirtEnabled ���
�L DbgInstallerDetectEnabled
�L DbgLkgEnabled
�L DbgDynProcessorEnabled ���
�L DbgConsoleBrokerEnabled ��
�L DbgSecureBootEnabled �
�L DbgMultiSessionSku ���
�L DbgMultiUsersInSessionSku
�L DbgStateSeparationEnabled
�L SpareBits : �L <anonymous-tag> .?AU<anonymous-tag>@@ �L { "
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" SharedDataFlags ��
�L DbgErrorPortPresent ��
�L DbgElevationEnabled ��
�L DbgVirtEnabled ���
�L DbgInstallerDetectEnabled
�L DbgLkgEnabled
�L DbgDynProcessorEnabled ���
�L DbgConsoleBrokerEnabled ��
�L DbgSecureBootEnabled �
�L DbgMultiSessionSku ���
�L DbgMultiUsersInSessionSku
�L DbgStateSeparationEnabled
�L SpareBits 2
�L <anonymous-tag> .?AT<anonymous-tag>@@ �L {
��
��
��
��z
�L NXSupportPolicy ��
�L SEHValidationPolicy ��
�L CurDirDevicesSkippedForDlls ��
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L { �
��
��
��
��
MitigationPolicies ���
�L NXSupportPolicy ��
�L SEHValidationPolicy ��
�L CurDirDevicesSkippedForDlls ��
�L Reserved �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L { �
" ��
" ��6
�L OptimizedSave
�L CompactionEnabled : �L <anonymous-tag> .?AU<anonymous-tag>@@ �L { r
" ��
" ��N
" ControlFlags �
�L OptimizedSave
�L CompactionEnabled 2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L { o 2
" Reserved �
SchedulingClass ��2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L { q
��
��
��
��
��z
�L Parked ���
�L Allocated
�L AllocatedToTargetProcess �
�L RealTime �
�L ReservedFlags : �L <anonymous-tag> .?AU<anonymous-tag>@@ �L { h
��
��
��
��
��
AllFlags �
�L Parked ���
�L Allocated
�L AllocatedToTargetProcess �
�L RealTime �
�L ReservedFlags 2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L { `
l( CpuSet ���2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L { W J
� Processor
� NumaNode �
` Cache
� Group 2 �L D <anonymous-tag> .?AT<anonymous-tag>@@ �L { F R
6A ProcessorCore
9A NumaNode �
�1 Cache
� Reserved �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L { B
" DeviceDescriptionOffset ��
" DevicePathOffset �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � R
" ProcessImageNameOffset ���
" ProcessId
" ServiceTag ���: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � �
" ProcessImageNameOffset ���
" ProcessId
" ServiceTag ���
" DeviceDescriptionOffset ��
" DevicePathOffset �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � ~
" ResourceFileNameOffset ���
! ResourceReasonId �
" StringCount ��
" SubstitutionStringsOffset : M <anonymous-tag> .?AU<anonymous-tag>@@ M � �
" ResourceFileNameOffset ���
! ResourceReasonId �
" StringCount ��
" SubstitutionStringsOffset
" SimpleStringOffset ���2 M <anonymous-tag> .?AT<anonymous-tag>@@ M �
��
��
��
��n
M NoDomainAccounting ���
M IncreasePolicy ���
M DecreasePolicy ���
M Reserved �: M <anonymous-tag> .?AU<anonymous-tag>@@ M � "
Spare
�. Flags 2 M <anonymous-tag> .?AT<anonymous-tag>@@ M �
! ��
! ��
! ��B
M AllowScaling �
M Disabled �
M Reserved �: M <anonymous-tag> .?AU<anonymous-tag>@@ M > N � PPM_THERMAL_POLICY_EVENT .?AUPPM_THERMAL_POLICY_EVENT@@ ��*
Mode �
# Processors ���N M PPM_THERMAL_POLICY_EVENT .?AUPPM_THERMAL_POLICY_EVENT@@ �� M �
J � PPM_THERMALCHANGE_EVENT .?AUPPM_THERMALCHANGE_EVENT@@ 6
" ThermalConstraint
# Processors ���J M PPM_THERMALCHANGE_EVENT .?AUPPM_THERMALCHANGE_EVENT@@ M �
R � PPM_PERFSTATE_DOMAIN_EVENT .?AUPPM_PERFSTATE_DOMAIN_EVENT@@ ��N
" State
" Latency ��
" Speed
# Processors ���R M PPM_PERFSTATE_DOMAIN_EVENT .?AUPPM_PERFSTATE_DOMAIN_EVENT@@ �� !M �
B � PPM_PERFSTATE_EVENT .?AUPPM_PERFSTATE_EVENT@@ ^
" State
" Status ���
" Latency ��
" Speed
" Processor B $M PPM_PERFSTATE_EVENT .?AUPPM_PERFSTATE_EVENT@@ %M �
�+ " � ��
# TotalTime
" IdleTransitions ��
" FailedTransitions
" InvalidBucketIndex ���
" MinTimeUs
" MaxTimeUs
" CancelledTransitions �
'M IdleTimeBuckets ��V (M �PPM_IDLE_STATE_ACCOUNTING_EX .?AUPPM_IDLE_STATE_ACCOUNTING_EX@@ �� )M
" " �
" IdleTransitions ��
" FailedTransitions
" InvalidBucketIndex ���
# TotalTime
+M IdleTimeBuckets ��N ,M 0 PPM_IDLE_STATE_ACCOUNTING .?AUPPM_IDLE_STATE_ACCOUNTING@@ -M
J � PPM_WMI_IDLE_STATES_EX .?AUPPM_WMI_IDLE_STATES_EX@@ ��z
" Type �
" Count
" TargetState ��
" OldState �
TargetProcessors �
State J 0M 4 PPM_WMI_IDLE_STATES_EX .?AUPPM_WMI_IDLE_STATES_EX@@ �� 1M � R � POWER_STATE_NOTIFY_HANDLER .?AUPOWER_STATE_NOTIFY_HANDLER@@ �� r! 4M
5M
� *
6M Handler ��
Context ��R 7M POWER_STATE_NOTIFY_HANDLER .?AUPOWER_STATE_NOTIFY_HANDLER@@ �� 8M D .
" Granularity ��
" Capacity �J :M BATTERY_REPORTING_SCALE .?AUBATTERY_REPORTING_SCALE@@ ;M � j
� ResourceFileName �
! ResourceReasonId �
" StringCount ��
< ReasonStrings : =M <anonymous-tag> .?AU<anonymous-tag>@@ >M �
� ResourceFileName �
! ResourceReasonId �
" StringCount ��
< ReasonStrings
� SimpleString �2 @M <anonymous-tag> .?AT<anonymous-tag>@@ AM
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
CM Reserved1
DM TargetSystemState
EM EffectiveSystemState �
FM CurrentSystemState ���
GM IgnoreHibernationPath
HM PseudoTransition �
IM KernelSoftReboot �
JM DirectedDripsTransition ��
KM Reserved2 : LM <anonymous-tag> .?AU<anonymous-tag>@@ MM �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
OM Reserved1
PM TargetSystemState
QM EffectiveSystemState �
RM CurrentSystemState ���
SM IgnoreHibernationPath
TM PseudoTransition �
UM KernelSoftReboot �
VM DirectedDripsTransition ��
WM Reserved2
" ContextAsUlong ���2
XM <anonymous-tag> .?AT<anonymous-tag>@@ YM � >
ReparseDataBuffer
{# ReparseGuidDataBuffer 2 [M <anonymous-tag> .?AT<anonymous-tag>@@ \M u& j
SymbolicLinkReparseBuffer
MountPointReparseBuffer ��
# GenericReparseBuffer �2 ^M <anonymous-tag> .?AT<anonymous-tag>@@ _M )# 6
" FilterEntryCount �
" NumberOfPairs 2 aM <anonymous-tag> .?AT<anonymous-tag>@@ bM B
�& SdChange �
�& SdQueryStats �
�& SdEnumSds 2 dM @ <anonymous-tag> .?AT<anonymous-tag>@@ eM � B
K SdChange �
L SdQueryStats �
) SdEnumSds 2 gM <anonymous-tag> .?AT<anonymous-tag>@@ hM | 2
�: Lev1Depends ��
�: Lev2Depends ��2 jM D <anonymous-tag> .?AT<anonymous-tag>@@ kM e .
" BufferLength �
| Buffer ���2 mM <anonymous-tag> .?AT<anonymous-tag>@@ nM a F
� BirthVolumeId
� BirthObjectId
� DomainId �: pM 0 <anonymous-tag> .?AU<anonymous-tag>@@ qM � ^
� BirthVolumeId
� BirthObjectId
� DomainId �
�5 ExtendedInfo �2 sM 0 <anonymous-tag> .?AT<anonymous-tag>@@ tM � �
" Calls
" Clusters �
" Hints
" RunsReturned �
" HintsHonored �
" HintsClusters
" Cache
" CacheClusters
" CacheMiss
" $ CacheMissClusters :
vM ( <anonymous-tag> .?AU<anonymous-tag>@@ wM � J
! Write
! Create ���
! SetInfo ��
! Flush : yM <anonymous-tag> .?AU<anonymous-tag>@@ zM � :
! Write
! Create ���
! SetInfo ��: |M <anonymous-tag> .?AU<anonymous-tag>@@ }M � J
! Write
! Create ���
! SetInfo ��
! Flush : M <anonymous-tag> .?AU<anonymous-tag>@@ �M v J
! Write
! Create ���
! SetInfo ��
! Flush : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M i 2
" UsnSourceInfo
" CopyNumber ���2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M 1 J � DELETE_USN_JOURNAL_DATA .?AUDELETE_USN_JOURNAL_DATA@@ 2
# UsnJournalID �
" DeleteFlags ��J �M DELETE_USN_JOURNAL_DATA .?AUDELETE_USN_JOURNAL_DATA@@ �M ^
" RecordLength �
! MajorVersion �
! MinorVersion �
� FileReferenceNumber ��
� ParentFileReferenceNumber
( Usn ��
} 0 TimeStamp
" 8 Reason ���
" < SourceInfo ���
" @ SecurityId ���
" D FileAttributes ���
! H FileNameLength ���
! J FileNameOffset ���
L FileName �6 �M P USN_RECORD_V3 .?AUUSN_RECORD_V3@@ �M � F � MOVE_FILE_RECORD_DATA .?AUMOVE_FILE_RECORD_DATA@@ R
FileHandle ���
} SourceFileRecord �
} TargetFileRecord �F �M MOVE_FILE_RECORD_DATA .?AUMOVE_FILE_RECORD_DATA@@ �M �
F � VOLUME_BITMAP_BUFFER .?AUVOLUME_BITMAP_BUFFER@@ ��F
} StartingLcn ��
} BitmapSize ���
| Buffer ���F �M VOLUME_BITMAP_BUFFER .?AUVOLUME_BITMAP_BUFFER@@ �� �M D
J � NTFS_VOLUME_DATA_BUFFER .?AUNTFS_VOLUME_DATA_BUFFER@@ �
} VolumeSerialNumber ���
} NumberSectors
} TotalClusters
} FreeClusters �
} TotalReserved
" ( BytesPerSector ���
" , BytesPerCluster ��
" 0 BytesPerFileRecordSegment
" 4 ClustersPerFileRecordSegment �
} 8 MftValidDataLength ���
} @ MftStartLcn ��
} H Mft2StartLcn �
} P MftZoneStart �
} X MftZoneEnd ���J �M ` NTFS_VOLUME_DATA_BUFFER .?AUNTFS_VOLUME_DATA_BUFFER@@ �M � 6
NoCrossPartitionAccess ���
� Spare : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M � .
ReplaceIfExists ��
" Flags 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M .
ReplaceIfExists ��
" Flags 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � F
� BirthVolumeId
� BirthObjectId
� DomainId �: �M 0 <anonymous-tag> .?AU<anonymous-tag>@@ �M h ^
� BirthVolumeId
� BirthObjectId
� DomainId �
�5 ExtendedInfo �2 �M 0 <anonymous-tag> .?AT<anonymous-tag>@@ �M g *
Status ���
Pointer ��2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � "
�G In ���
�G Out ��2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � � 2
" DesiredAccess
" GrantedAccess 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � V 2
" ObjectType ���
" HandleCount ��2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � Q 2
Handle ���
. HandleAttrArray ��2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � L
" ��
" ��
" ��
" ��
" ��
" ��
�M Reserved0
�M SameAccess ���
�M SameAttributes ���
�M Indirect �
�M Inherit ��
�M Reserved1 : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M � B
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
�M Reserved0
�M SameAccess ���
�M SameAttributes ���
�M Indirect �
�M Inherit ��
�M Reserved1 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � @ 2
" DesiredAccess
" GrantedAccess 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � 8
" ��
" ��
" ��
" ��
" ��
" ��
�M Reserved0
�M SameAccess ���
�M SameAttributes ���
�M Indirect �
�M Inherit ��
�M Reserved1 : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M � ,
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
�M Reserved0
�M SameAccess ���
�M SameAttributes ���
�M Indirect �
�M Inherit ��
�M Reserved1 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � * 6
" ClientViewSize ���
" CallbackId ���2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � N 2
� ClientId �
A DoNotUseThisField 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � I
" ��
" ��.
�M CfgOverride ��
�M Reserved �: �M <anonymous-tag> .?AU<anonymous-tag>@@ �M a H
" ��
" ��>
" Flags
�M CfgOverride ��
�M Reserved �2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M a F
2
" UpdateMask ���
" DesiredState �: �M <anonymous-tag> .?AU<anonymous-tag>@@ �M a I
" ��
" ��
" ��
" ��f
�M FreezeOperation ��
�M FilterOperation ��
�M SwapOperation
�M Reserved �: �M <anonymous-tag> .?AU<anonymous-tag>@@ �M a
" ��
" ��
" ��
" ��v
" Flags
�M FreezeOperation ��
�M FilterOperation ��
�M SwapOperation
�M Reserved �2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M a 6
# ManifestAddress ��
" ManifestSize �: N <anonymous-tag> .?AU<anonymous-tag>@@ N a � 6
# ManifestAddress ��
" ManifestSize �2 N <anonymous-tag> .?AT<anonymous-tag>@@ N a �
��
��
��
��
��
��
��
! ���
N ProtectedProcess �
N AddressSpaceOverride �
N DevOverrideEnabled ���
N ManifestDetected �
N ProtectedProcessLight
N SpareBits1 ���
N SpareBits2 ���
N SpareBits3 ���: N <anonymous-tag> .?AU<anonymous-tag>@@ N a �
��
��
��
��
��
��
��
! ��
" OutputFlags ��
N ProtectedProcess �
N AddressSpaceOverride �
N DevOverrideEnabled ���
N ManifestDetected �
N ProtectedProcessLight
N SpareBits1 ���
N SpareBits2 ���
N SpareBits3 ���2 N <anonymous-tag> .?AT<anonymous-tag>@@ N a �
��
��
��
��
��
��
! ���
N WriteOutputOnExit
N DetectManifest ���
N IFEOSkipDebugger �
N IFEODoNotPropagateKeyState ���
!N SpareBits1 ���
"N SpareBits2 ���
#N ProhibitedImageCharacteristics ���: $N <anonymous-tag> .?AU<anonymous-tag>@@ %N a �
��
��
��
��
��
��
! ���
" InitFlags
'N WriteOutputOnExit
(N DetectManifest ���
)N IFEOSkipDebugger �
*N IFEODoNotPropagateKeyState ���
+N SpareBits1 ���
,N SpareBits2 ���
-N ProhibitedImageCharacteristics ���2 .N <anonymous-tag> .?AT<anonymous-tag>@@ /N a � n
Z InitState
] FailSection ��
` ExeFormat
c ExeName ��
n SuccessState �2 1N @ <anonymous-tag> .?AT<anonymous-tag>@@ 2N a �
��
��
��6
4N Type �
5N Audit
6N Signer ���: 7N <anonymous-tag> .?AU<anonymous-tag>@@ 8N a ^
��
��
��F
Level
:N Type �
;N Audit
<N Signer ���2 =N <anonymous-tag> .?AT<anonymous-tag>@@ >N a \ &
" StdHandleSubsystemType ���2 @N <anonymous-tag> .?AT<anonymous-tag>@@ AN a U
" ��
" ��:
CN StdHandleState ���
DN PseudoHandleMask �: EN <anonymous-tag> .?AU<anonymous-tag>@@ FN a P
" ��
" ��J
" Flags
HN StdHandleState ���
IN PseudoHandleMask �2 JN <anonymous-tag> .?AT<anonymous-tag>@@ KN a N &
" Value
ValuePtr �2 MN <anonymous-tag> .?AT<anonymous-tag>@@ NN a � �
� ASLRPolicy ���
� StrictHandleCheckPolicy ��
� SystemCallDisablePolicy ��
� ExtensionPointDisablePolicy ��
� DynamicCodePolicy
� ControlFlowGuardPolicy ���
� SignaturePolicy ��
� FontDisablePolicy
� ImageLoadPolicy ��
� SystemCallFilterPolicy ���
� PayloadRestrictionPolicy �
� ChildProcessPolicy ���
� SideChannelIsolationPolicy ���
� UserShadowStackPolicy 2 PN <anonymous-tag> .?AT<anonymous-tag>@@ QN a $
" ��
" ��*
SN TopDown ��
TN Reserved �: UN <anonymous-tag> .?AU<anonymous-tag>@@ VN a �
" ��
" ��
" ��F
XN EnableAutoUpdate �
YN Permanent
ZN Reserved �: [N <anonymous-tag> .?AU<anonymous-tag>@@ \N a � �
! InputDuration
! AudioInDuration ��
! AudioOutDuration �
! DisplayRequiredDuration ��
! PSMBackgroundDuration : ^N ( <anonymous-tag> .?AU<anonymous-tag>@@ _N a \ �
�B Durations
! InputDuration
! AudioInDuration ��
! AudioOutDuration �
! DisplayRequiredDuration ��
! PSMBackgroundDuration 2 aN ( <anonymous-tag> .?AT<anonymous-tag>@@ bN a Z �
�% CpuTimeline ��
�% DiskTimeline �
�% NetworkTimeline ��
�% MBBTimeline ��
�% ForegroundTimeline ���
�% ( DesktopVisibleTimeline ���
�% 0 CompositionRenderedTimeline ��
�% 8 CompositionDirtyGeneratedTimeline
�% @ CompositionDirtyPropagatedTimeline ���
�% H InputTimeline
�% P AudioInTimeline ��
�% X AudioOutTimeline �
�% ` DisplayRequiredTimeline ��
�% h KeyboardInputTimeline : dN p <anonymous-tag> .?AU<anonymous-tag>@@ eN a H �
�B Timelines
�% CpuTimeline ��
�% DiskTimeline �
�% NetworkTimeline ��
�% MBBTimeline ��
�% ForegroundTimeline ���
�% ( DesktopVisibleTimeline ���
�% 0 CompositionRenderedTimeline ��
�% 8 CompositionDirtyGeneratedTimeline
�% @ CompositionDirtyPropagatedTimeline ���
�% H InputTimeline
�% P AudioInTimeline ��
�% X AudioOutTimeline �
�% ` DisplayRequiredTimeline ��
�% h KeyboardInputTimeline 2 gN p <anonymous-tag> .?AT<anonymous-tag>@@ hN a F f
! ForegroundDuration ���
! DesktopVisibleDuration ���
! PSMForegroundDuration : jN <anonymous-tag> .?AU<anonymous-tag>@@ kN a / z
i/ Durations
! ForegroundDuration ���
! DesktopVisibleDuration ���
! PSMForegroundDuration 2 mN <anonymous-tag> .?AT<anonymous-tag>@@ nN a +
" ��
" ��F
" LastChangeTime ���
pN Duration �
qN IsInState : rN <anonymous-tag> .?AU<anonymous-tag>@@ sN a � *
" EndTime ��
" Bitmap ���: uN <anonymous-tag> .?AU<anonymous-tag>@@ vN a �
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
xN IsProtectedProcess ���
yN IsWow64Process ���
zN IsProcessDeleting
{N IsCrossSessionCreate �
|N IsFrozen �
}N IsBackground �
~N IsStronglyNamed ��
N IsSecureProcess ��
�N IsPicoProcess
�N SpareBits :
�N <anonymous-tag> .?AU<anonymous-tag>@@ �N a �
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u Flags
�N IsProtectedProcess ���
�N IsWow64Process ���
�N IsProcessDeleting
�N IsCrossSessionCreate �
�N IsFrozen �
�N IsBackground �
�N IsStronglyNamed ��
�N IsSecureProcess ��
�N IsPicoProcess
�N SpareBits 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N a � .
" TlsIndex �
" PreviousCount 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N a s
ThreadId �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N a h 2
NewTlsData ���
OldTlsData ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N a d
" ��
" ��.
�N Foreground ���
�N Reserved �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N a D *
" ControlFlags �
� Path �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C � *
! MinRate ��
! MaxRate ��: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N C R
" CpuRate ��
" Weight ���
! MinRate ��
! MaxRate ��2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C N
� RateControlToleranceLimit
� CpuRateControlToleranceLimit �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C F
� RateControlTolerance �
� CpuRateControlTolerance ��2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C >
# JobHighMemoryLimit ���
# JobMemoryLimit ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C � V
RateControlToleranceInterval �
CpuRateControlToleranceInterval ��2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C � F
� RateControlTolerance �
� CpuRateControlTolerance ��2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C � >
# JobHighMemoryLimit ���
# JobMemoryLimit ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C �
" ��
" ��
" ��
" ��
" ��
�N EnableReadVmLogging ��
�N EnableWriteVmLogging �
�N EnableProcessSuspendResumeLogging
�N EnableThreadSuspendResumeLogging �
�N Reserved �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N C \
��
��
��V
�N EnableReadVmLogging ��
�N EnableWriteVmLogging �
�N Unused ���: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N C S
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
�N EnableUserShadowStack
�N AuditUserShadowStack �
�N SetContextIpValidation ���
�N AuditSetContextIpValidation ��
�N EnableUserShadowStackStrictMode ��
�N BlockNonCetBinaries ��
�N BlockNonCetBinariesNonEhcont �
�N AuditBlockNonCetBinaries �
�N CetDynamicApisOutOfProcOnly ��
�N SetContextIpValidationRelaxedMode
�N ReservedFlags : �N <anonymous-tag> .?AU<anonymous-tag>@@ �N C
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" Flags
�N EnableUserShadowStack
�N AuditUserShadowStack �
�N SetContextIpValidation ���
�N AuditSetContextIpValidation ��
�N EnableUserShadowStackStrictMode ��
�N BlockNonCetBinaries ��
�N BlockNonCetBinariesNonEhcont �
�N AuditBlockNonCetBinaries �
�N CetDynamicApisOutOfProcOnly ��
�N SetContextIpValidationRelaxedMode
�N ReservedFlags 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C
" ��
" ��
" ��
" ��
" ��
�N SmtBranchTargetIsolation �
�N IsolateSecurityDomain
�N DisablePageCombine ���
�N SpeculativeStoreBypassDisable
�N ReservedFlags : �N <anonymous-tag> .?AU<anonymous-tag>@@ �N C �
" ��
" ��
" ��
" ��
" ��
" Flags
�N SmtBranchTargetIsolation �
�N IsolateSecurityDomain
�N DisablePageCombine ���
�N SpeculativeStoreBypassDisable
�N ReservedFlags 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N C �
" ��
" ��
" ��
" ��
�N NoChildProcessCreation ���
�N AuditNoChildProcessCreation ��
�N AllowSecureProcessCreation ���
�N ReservedFlags : �N <anonymous-tag> .?AU<anonymous-tag>@@ �N C �
" ��
" ��
" ��
" ��
" Flags
�N NoChildProcessCreation ���
�N AuditNoChildProcessCreation ��
�N AllowSecureProcessCreation ���
�N ReservedFlags 2 O <anonymous-tag> .?AT<anonymous-tag>@@ O C �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ��
O EnableExportAddressFilter
O AuditExportAddressFilter �
O EnableExportAddressFilterPlus
O AuditExportAddressFilterPlus �
O EnableImportAddressFilter
O AuditImportAddressFilter �
O EnableRopStackPivot ��
O AuditRopStackPivot ���
O EnableRopCallerCheck �
O AuditRopCallerCheck ��
O EnableRopSimExec �
O AuditRopSimExec ��
O ReservedFlags :
O <anonymous-tag> .?AU<anonymous-tag>@@ O C �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ���
" Flags
O EnableExportAddressFilter
O AuditExportAddressFilter �
O EnableExportAddressFilterPlus
O AuditExportAddressFilterPlus �
O EnableImportAddressFilter
O AuditImportAddressFilter �
O EnableRopStackPivot ��
O AuditRopStackPivot ���
O EnableRopCallerCheck �
O AuditRopCallerCheck ��
O EnableRopSimExec �
O AuditRopSimExec ��
O ReservedFlags 2 O <anonymous-tag> .?AT<anonymous-tag>@@ !O C �
" ��
" ��.
#O FilterId �
$O ReservedFlags : %O <anonymous-tag> .?AU<anonymous-tag>@@ &O C �
" ��
" ��>
" Flags
(O FilterId �
)O ReservedFlags 2 *O <anonymous-tag> .?AT<anonymous-tag>@@ +O C �
" ��
" ��
" ��
" ��
" ��
" ���
-O NoRemoteImages ���
.O NoLowMandatoryLabelImages
/O PreferSystem32Images �
0O AuditNoRemoteImages ��
1O AuditNoLowMandatoryLabelImages ���
2O ReservedFlags : 3O <anonymous-tag> .?AU<anonymous-tag>@@ 4O C �
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
6O NoRemoteImages ���
7O NoLowMandatoryLabelImages
8O PreferSystem32Images �
9O AuditNoRemoteImages ��
:O AuditNoLowMandatoryLabelImages ���
;O ReservedFlags 2 <O <anonymous-tag> .?AT<anonymous-tag>@@ =O C �
" ��
" ��
" ��^
?O DisableNonSystemFonts
@O AuditNonSystemFontLoading
AO ReservedFlags : BO <anonymous-tag> .?AU<anonymous-tag>@@ CO C �
" ��
" ��
" ��n
" Flags
EO DisableNonSystemFonts
FO AuditNonSystemFontLoading
GO ReservedFlags 2 HO <anonymous-tag> .?AT<anonymous-tag>@@ IO C �
" ��
" ��
" ��
" ��
" ��
" ��
KO MicrosoftSignedOnly ��
LO StoreSignedOnly ��
MO MitigationOptIn ��
NO AuditMicrosoftSignedOnly �
OO AuditStoreSignedOnly �
PO ReservedFlags : QO <anonymous-tag> .?AU<anonymous-tag>@@ RO C �
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
TO MicrosoftSignedOnly ��
UO StoreSignedOnly ��
VO MitigationOptIn ��
WO AuditMicrosoftSignedOnly �
XO AuditStoreSignedOnly �
YO ReservedFlags 2 ZO <anonymous-tag> .?AT<anonymous-tag>@@ [O C �
" ��
" ��
" ��
" ��z
]O EnableControlFlowGuard ���
^O EnableExportSuppression ��
_O StrictMode ���
`O ReservedFlags : aO <anonymous-tag> .?AU<anonymous-tag>@@ bO C �
" ��
" ��
" ��
" ��
" Flags
dO EnableControlFlowGuard ���
eO EnableExportSuppression ��
fO StrictMode ���
gO ReservedFlags 2 hO <anonymous-tag> .?AT<anonymous-tag>@@ iO C �
" ��
" ��
" ��
" ��
" ��
kO ProhibitDynamicCode ��
lO AllowThreadOptOut
mO AllowRemoteDowngrade �
nO AuditProhibitDynamicCode �
oO ReservedFlags : pO <anonymous-tag> .?AU<anonymous-tag>@@ qO C {
" ��
" ��
" ��
" ��
" ��
" Flags
sO ProhibitDynamicCode ��
tO AllowThreadOptOut
uO AllowRemoteDowngrade �
vO AuditProhibitDynamicCode �
wO ReservedFlags 2 xO <anonymous-tag> .?AT<anonymous-tag>@@ yO C y
" ��
" ��>
{O DisableExtensionPoints ���
|O ReservedFlags : }O <anonymous-tag> .?AU<anonymous-tag>@@ ~O C q
" ��
" ��N
" Flags
�O DisableExtensionPoints ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C o
" ��
" ��
" ��j
�O DisallowWin32kSystemCalls
�O AuditDisallowWin32kSystemCalls ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O C f
" ��
" ��
" ��z
" Flags
�O DisallowWin32kSystemCalls
�O AuditDisallowWin32kSystemCalls ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C d
" ��
" ��
" ��~
�O RaiseExceptionOnInvalidHandleReference ���
�O HandleExceptionsPermanentlyEnabled ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O C [
" ��
" ��
" ��
" Flags
�O RaiseExceptionOnInvalidHandleReference ���
�O HandleExceptionsPermanentlyEnabled ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C Y
" ��
" ��
" ��R
�O Enable ���
�O DisableAtlThunkEmulation �
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O C O
" ��
" ��
" ��b
" Flags
�O Enable ���
�O DisableAtlThunkEmulation �
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C M
" ��
" ��
" ��
" ��
" ��
�O EnableBottomUpRandomization ��
�O EnableForceRelocateImages
�O EnableHighEntropy
�O DisallowStrippedImages ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O C B
" ��
" ��
" ��
" ��
" ��
" Flags
�O EnableBottomUpRandomization ��
�O EnableForceRelocateImages
�O EnableHighEntropy
�O DisallowStrippedImages ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C @
" ��
" ��.
�O RatePercent ��
�O Reserved0 : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O C � *
" DriveMap �
S DriveType : �O $ <anonymous-tag> .?AU<anonymous-tag>@@ �O C (
DirectoryHandle ��: �O <anonymous-tag> .?AU<anonymous-tag>@@ �O C % "
�O Set ��
�O Query 2 �O $ <anonymous-tag> .?AT<anonymous-tag>@@ �O C $ "
Q Set ��
U Query 2 �O $ <anonymous-tag> .?AT<anonymous-tag>@@ �O C
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�O IsProtectedProcess ���
�O IsWow64Process ���
�O IsProcessDeleting
�O IsCrossSessionCreate �
�O IsFrozen �
�O IsBackground �
�O IsStronglyNamed ��
�O IsSecureProcess ��
�O IsSubsystemProcess ���
�O SpareBits :
�O <anonymous-tag> .?AU<anonymous-tag>@@ �O C �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��"
" Flags
�O IsProtectedProcess ���
�O IsWow64Process ���
�O IsProcessDeleting
�O IsCrossSessionCreate �
�O IsFrozen �
�O IsBackground �
�O IsStronglyNamed ��
�O IsSecureProcess ��
�O IsSubsystemProcess ���
�O SpareBits 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C � >
RtlUmsCompletionList �
UmsCompletionList 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C f 2
RtlUmsContext
UmsContext ���2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C ]
" ��
" ��>
�O IsUmsSchedulerThread �
�O IsUmsWorkerThread : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O C E
" ��
" ��N
" Flags
�O IsUmsSchedulerThread �
�O IsUmsWorkerThread 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C C 6
CompletionList ���
UmsContext ���: �O <anonymous-tag> .?AU<anonymous-tag>@@ �O C 0
" ��
" ��
CompletionList ���
UmsContext ���
" Flags
�O IsUmsSchedulerThread �
�O IsUmsWorkerThread 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O C .
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��
! ��
�O SafeThunkCall
�O InDebugPrint �
�O HasFiberData �
�O SkipThreadAttach �
P WerInShipAssertCode ��
P RanProcessInit ���
P ClonedThread �
P SuppressDebugMsg �
P DisableUserStackWalk �
P RtlExceptionAttached �
P InitialThread
P SessionAware �
P LoadOwner
P LoaderWorker �
P SkipLoaderInit ���
P SpareSameTebBits �: P <anonymous-tag> .?AU<anonymous-tag>@@
P �
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��
! ���
! SameTebFlags �
P SafeThunkCall
P InDebugPrint �
P HasFiberData �
P SkipThreadAttach �
P WerInShipAssertCode ��
P RanProcessInit ���
P ClonedThread �
P SuppressDebugMsg �
P DisableUserStackWalk �
P RtlExceptionAttached �
P InitialThread
P SessionAware �
P LoadOwner
P LoaderWorker �
P SkipLoaderInit ���
P SpareSameTebBits �2 P <anonymous-tag> .?AT<anonymous-tag>@@ P z
! ��
"P SpareCrossTebBits : #P <anonymous-tag> .?AU<anonymous-tag>@@ $P r
! ��6
C CrossTebFlags
&P SpareCrossTebBits 2 'P <anonymous-tag> .?AT<anonymous-tag>@@ (P p f
ReservedPad0 �
ReservedPad1 �
ReservedPad2 �
IdealProcessor ���: *P <anonymous-tag> .?AU<anonymous-tag>@@ +P G �
� CurrentIdealProcessor
" IdealProcessorValue ��
ReservedPad0 �
ReservedPad1 �
ReservedPad2 �
IdealProcessor ���2 -P <anonymous-tag> .?AT<anonymous-tag>@@ .P D
" ��
" ��6
0P SixtySecondEnabled ���
1P Reserved �: 2P <anonymous-tag> .?AU<anonymous-tag>@@ 3P �
" ��
" ��R
" LeapSecondFlags ��
5P SixtySecondEnabled ���
6P Reserved �2 7P <anonymous-tag> .?AT<anonymous-tag>@@ 8P �
" ��
" ��
" ��
" ��
:P HeapTracingEnabled ���
;P CritSecTracingEnabled
<P LibLoaderTracingEnabled ��
=P SpareTracingBits �: >P <anonymous-tag> .?AU<anonymous-tag>@@ ?P I
" ��
" ��
" ��
" ��
" TracingFlags �
AP HeapTracingEnabled ���
BP CritSecTracingEnabled
CP LibLoaderTracingEnabled ��
DP SpareTracingBits �2 EP <anonymous-tag> .?AT<anonymous-tag>@@ FP G >
KernelCallbackTable ��
UserSharedInfoPtr 2 HP <anonymous-tag> .?AT<anonymous-tag>@@ IP �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
KP ProcessInJob �
LP ProcessInitializing ��
MP ProcessUsingVEH ��
NP ProcessUsingVCH ��
OP ProcessUsingFTH ��
PP ProcessPreviouslyThrottled ���
QP ProcessCurrentlyThrottled
RP ProcessImagesHotPatched ��
SP ReservedBits0 : TP <anonymous-tag> .?AU<anonymous-tag>@@ UP �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��2
" CrossProcessFlags
WP ProcessInJob �
XP ProcessInitializing ��
YP ProcessUsingVEH ��
ZP ProcessUsingVCH ��
[P ProcessUsingFTH ��
\P ProcessPreviouslyThrottled ���
]P ProcessCurrentlyThrottled
^P ProcessImagesHotPatched ��
_P ReservedBits0 2
`P <anonymous-tag> .?AT<anonymous-tag>@@ aP �
��
��
��
��
��
��
��
��
cP ImageUsesLargePages ��
dP IsProtectedProcess ���
eP IsImageDynamicallyRelocated ��
fP SkipPatchingUser32Forwarders �
gP IsPackagedProcess
hP IsAppContainer ���
iP IsProtectedProcessLight ��
jP IsLongPathAwareProcess ���: kP <anonymous-tag> .?AU<anonymous-tag>@@ lP s
��
��
��
��
��
��
��
��&
BitField �
nP ImageUsesLargePages ��
oP IsProtectedProcess ���
pP IsImageDynamicallyRelocated ��
qP SkipPatchingUser32Forwarders �
rP IsPackagedProcess
sP IsAppContainer ���
tP IsProtectedProcessLight ��
uP IsLongPathAwareProcess ���2 vP <anonymous-tag> .?AT<anonymous-tag>@@ wP q *
# FiberData
" Version ��2 yP <anonymous-tag> .?AT<anonymous-tag>@@ zP C F *
" FiberData
" Version ��2 |P <anonymous-tag> .?AT<anonymous-tag>@@ }P C 3 *
FiberData
" Version ��2 P <anonymous-tag> .?AT<anonymous-tag>@@ �P C *
! Id ���
! NameIsPresent : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P u d
# LoadedImports : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P u U
" TimeDateStamp : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P u R 2
" TimeDateStamp
# LoadedImports 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P u Q 2
# SectionPointer ���
" CheckSum �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P u L F
HashLinks
# SectionPointer ���
" CheckSum �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P u J
" LoadedImports : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P u 2
" TimeDateStamp : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P u / 2
" TimeDateStamp
" LoadedImports 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P u . 2
" SectionPointer ���
" CheckSum �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P u ) F
HashLinks
" SectionPointer ���
" CheckSum �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P u '
! ��
! ��
! ��J
�P SignatureLevel ���
�P SignatureType
�P Unused ���: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P u
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�P PackagedBinary ���
�P MarkedForRemoval �
�P ImageDll �
�P LoadNotificationsSent
�P TelemetryEntryProcessed ��
�P ProcessStaticImport ��
�P InLegacyLists
�P InIndexes
�P ShimDll ��
�P InExceptionTable �
�P ReservedFlags1 ���
�P LoadInProgress ���
�P LoadConfigProcessed ��
�P EntryProcessed ���
�P ProtectDelayLoad �
�P ReservedFlags3 ���
�P DontCallForThreads ���
�P ProcessAttachCalled ��
�P ProcessAttachFailed ��
�P CorDeferredValidate ��
�P CorImage �
�P DontRelocate �
�P CorILOnly
�P ChpeImage
�P ReservedFlags5 ���
�P Redirected ���
�P ReservedFlags6 ���
�P CompatDatabaseProcessed ��: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P u �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��&
� FlagGroup
" Flags
�P PackagedBinary ���
�P MarkedForRemoval �
�P ImageDll �
�P LoadNotificationsSent
�P TelemetryEntryProcessed ��
�P ProcessStaticImport ��
�P InLegacyLists
�P InIndexes
�P ShimDll ��
�P InExceptionTable �
�P ReservedFlags1 ���
�P LoadInProgress ���
�P LoadConfigProcessed ��
�P EntryProcessed ���
�P ProtectDelayLoad �
�P ReservedFlags3 ���
�P DontCallForThreads ���
�P ProcessAttachCalled ��
�P ProcessAttachFailed ��
�P CorDeferredValidate ��
�P CorImage �
�P DontRelocate �
�P CorILOnly
�P ChpeImage
�P ReservedFlags5 ���
�P Redirected ���
�P ReservedFlags6 ���
�P CompatDatabaseProcessed ��2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P u �
}<
�
�P pAttributeV1 �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P ,
&
� Sid ��
Z Buffer ���2 �P D <anonymous-tag> .?AT<anonymous-tag>@@ �P | &
X TokenUser
Y User �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P w �
# X0 ���
# X1 ���
# X2 ���
# X3 ���
# X4 ���
# ( X5 ���
# 0 X6 ���
# 8 X7 ���
# @ X8 ���
# H X9 ���
# P X10 ��
# X X11 ��
# ` X12 ��
# h X13 ��
# p X14 ��
# x X15 ��
# � X16 ��
# � X17 ��
# � X18 ��
# � X19 ��
# � X20 ��
# � X21 ��
# � X22 ��
# � X23 ��
# � X24 ��
# � X25 ��
# � X26 ��
# � X27 ��
# � X28 ��
# � Fp ���
# � Lr ���: �P � <anonymous-tag> .?AU<anonymous-tag>@@ �P E �
# X0 ���
# X1 ���
# X2 ���
# X3 ���
# X4 ���
# ( X5 ���
# 0 X6 ���
# 8 X7 ���
# @ X8 ���
# H X9 ���
# P X10 ��
# X X11 ��
# ` X12 ��
# h X13 ��
# p X14 ��
# x X15 ��
# � X16 ��
# � X17 ��
# � X18 ��
# � X19 ��
# � X20 ��
# � X21 ��
# � X22 ��
# � X23 ��
# � X24 ��
# � X25 ��
# � X26 ��
# � X27 ��
# � X28 ��
# � Fp ���
# � Lr ���
8) X 2 �P � <anonymous-tag> .?AT<anonymous-tag>@@ �P D "
# Low ��
High �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P 6
" EntryPointToken ��
" EntryPointRVA 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P [ � &
! Ordinal ��
! Hint �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P [ y 6
# EndOfPrologue
# UnwindInfoAddress 2 Q <anonymous-tag> .?AT<anonymous-tag>@@ Q [
6
" UnwindInfoAddress
" UnwindData ���2 Q <anonymous-tag> .?AT<anonymous-tag>@@ Q [ 6
" ��
" ��
" ��
" ��
" ��
" ��
Q FunctionLength ���
Q Version ��
Q ExceptionDataPresent �
Q EpilogInHeader ���
Q EpilogCount ��
Q CodeWords : Q <anonymous-tag> .?AU<anonymous-tag>@@
Q [
" ��
" ��
"
��
" ��
" ��
" ��
" ��~
Q Flag �
Q FunctionLength ���
Q RegF �
Q RegI �
Q H
Q CR ���
Q FrameSize : Q <anonymous-tag> .?AU<anonymous-tag>@@ Q [
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" UnwindData ���
Q Flag �
Q FunctionLength ���
Q RegF �
Q RegI �
Q H
Q CR ���
Q FrameSize 2 Q <anonymous-tag> .?AT<anonymous-tag>@@ !Q [
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
"
��
#Q Flag �
$Q FunctionLength ���
%Q Ret ��
&Q H
'Q Reg ��
(Q R
)Q L
*Q C
+Q StackAdjust ��: ,Q <anonymous-tag> .?AU<anonymous-tag>@@ -Q [ �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
"
��
" UnwindData ���
/Q Flag �
0Q FunctionLength ���
1Q Ret ��
2Q H
3Q Reg ��
4Q R
5Q L
6Q C
7Q StackAdjust ��2
8Q <anonymous-tag> .?AT<anonymous-tag>@@ 9Q [ �
" ��
" ��2
;Q NativeCode ���
<Q AddressBits ��: =Q <anonymous-tag> .?AU<anonymous-tag>@@ >Q [ y
" ��
" ��J
" StartOffset ��
@Q NativeCode ���
AQ AddressBits ��2 BQ <anonymous-tag> .?AT<anonymous-tag>@@ CQ [ w
" ��
" ��:
EQ OffsetToDirectory
FQ DataIsDirectory ��: GQ <anonymous-tag> .?AU<anonymous-tag>@@ HQ [ V
" ��
" ��R
" OffsetToData �
JQ OffsetToDirectory
KQ DataIsDirectory ��2 LQ <anonymous-tag> .?AT<anonymous-tag>@@ MQ [ T
" ��
" ��2
OQ NameOffset ���
PQ NameIsString �: QQ <anonymous-tag> .?AU<anonymous-tag>@@ RQ [ M
" ��
" ��R
TQ NameOffset ���
UQ NameIsString �
" Name �
! Id ���2 VQ <anonymous-tag> .?AT<anonymous-tag>@@ WQ [ L
" ��
" ��6
YQ RvaBased �
ZQ ReservedAttributes ���: [Q <anonymous-tag> .?AU<anonymous-tag>@@ \Q [
>
" Characteristics ��
" OriginalFirstThunk ���2 ^Q <anonymous-tag> .?AT<anonymous-tag>@@ _Q [ �
" ��
" ��
" ��>
aQ Reserved0
bQ Alignment
cQ Reserved1 : dQ <anonymous-tag> .?AU<anonymous-tag>@@ eQ [ �
" ��
" ��
" ��Z
" Characteristics ��
gQ Reserved0
hQ Alignment
iQ Reserved1 2 jQ <anonymous-tag> .?AT<anonymous-tag>@@ kQ [ �
" ��
" ��
" ��>
mQ Reserved0
nQ Alignment
oQ Reserved1 : pQ <anonymous-tag> .?AU<anonymous-tag>@@ qQ [ �
" ��
" ��
" ��Z
" Characteristics ��
sQ Reserved0
tQ Alignment
uQ Reserved1 2 vQ <anonymous-tag> .?AT<anonymous-tag>@@ wQ [ � 6
" VirtualAddress ���
" RelocCount ���2 yQ <anonymous-tag> .?AT<anonymous-tag>@@ zQ [ v .
�# TokenDef �
� rgbReserved ��: |Q <anonymous-tag> .?AU<anonymous-tag>@@ }Q [ P "
" Short
" Long �: Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q [ h :
� ShortName
�Q Name �
� LongName �2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q [ f *
?D Vendors ��
# Unused ���2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � � *
�1 CpuErrata
# Unused ���2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � �
p x
} test �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q
��
��>
�Q Red ��
�Q Balance ��
" ParentValue ��2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q } "
p Left �
p Right : �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q u 6
q Children �
p Left �
p Right 2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q s *
" LowPart ��
" HighPart �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � *
" LowPart ��
HighPart �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � >
UseThisFieldToCopy ���
A DoNotUseThisField 2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � 6 � tagEMRMASKBLT .?AUtagEMRMASKBLT@@ �
emr ��
� rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
� 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d xMask
h yMask
" l iUsageMask ���
" p offBmiMask ���
" t cbBmiMask
" x offBitsMask ��
" | cbBitsMask ���6 �Q � tagEMRMASKBLT .?AUtagEMRMASKBLT@@ �Q �
k-
�
�
�
u ��
u ��
u ��
u ��
u ��
u ���
u FeatureId
�Q Priority �
�Q EnabledState �
�Q IsWexpConfiguration ��
�Q HasSubscriptions �
�Q Variant ��
�Q VariantPayloadKind ���
u VariantPayload ���R �Q _RTL_FEATURE_CONFIGURATION .?AU_RTL_FEATURE_CONFIGURATION@@ �� �Q � c
� ��
�Q
� n � _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION .?AU_JOURNAL_TRANSACTION_BOUNDARY_INFORMATION@@
�Q
� Z
2 Action ���
# RecordNumber �
} TimeStamp
� TransactionID n �Q ( _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION .?AU_JOURNAL_TRANSACTION_BOUNDARY_INFORMATION@@ �Q 3 � N � _PROCESS_AFFINITY_UPDATE_MODE .?AT_PROCESS_AFFINITY_UPDATE_MODE@@
" ��
" ��
" ��V
" Flags
�Q EnableAutoUpdate �
�Q Permanent
�Q Reserved �N �Q _PROCESS_AFFINITY_UPDATE_MODE .?AT_PROCESS_AFFINITY_UPDATE_MODE@@ �Q a � : � _MESSAGE_TRACE .?AU_MESSAGE_TRACE@@ ��*
�5 MessageHeader
Data �: �Q _MESSAGE_TRACE .?AU_MESSAGE_TRACE@@ �� �Q � �
�>
�
_
�
�
�
" ��
" ��
" ��
" ��
" Flags
�Q EnableControlFlowGuard ���
�Q EnableExportSuppression ��
�Q StrictMode ���
�Q ReservedFlags v �Q _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@ �Q C � b � _PROCESS_EXTENDED_BASIC_INFORMATION .?AU_PROCESS_EXTENDED_BASIC_INFORMATION@@
�Q
�
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��F
" Size �
� BasicInfo
" Flags
�Q IsProtectedProcess ���
�Q IsWow64Process ���
�Q IsProcessDeleting
�Q IsCrossSessionCreate �
�Q IsFrozen �
�Q IsBackground �
�Q IsStronglyNamed ��
�Q IsSecureProcess ��
�Q IsSubsystemProcess ���
�Q SpareBits b
�Q _PROCESS_EXTENDED_BASIC_INFORMATION .?AU_PROCESS_EXTENDED_BASIC_INFORMATION@@ �Q C �
0
�
$
� N � _THREAD_BASIC_INFORMATION .?AU_THREAD_BASIC_INFORMATION@@
�
� �
ExitStatus ���
�Q TebBaseAddress ���
� ClientId �
" AffinityMask �
Priority �
BasePriority �N �Q _THREAD_BASIC_INFORMATION .?AU_THREAD_BASIC_INFORMATION@@ �Q a �
�?
�
7G
� N � tagEMRSETCOLORADJUSTMENT .?AUtagEMRSETCOLORADJUSTMENT@@ ��.
emr ��
�0 ColorAdjustment ��N �Q tagEMRSETCOLORADJUSTMENT .?AUtagEMRSETCOLORADJUSTMENT@@ �� �Q �
�
�
�,
�
�"
�
`G
� R � _ADMINISTRATOR_POWER_POLICY .?AU_ADMINISTRATOR_POWER_POLICY@@ �
S MinSleep �
S MaxSleep �
" MinVideoTimeout ��
" MaxVideoTimeout ��
" MinSpindownTimeout ���
" MaxSpindownTimeout ���R �Q _ADMINISTRATOR_POWER_POLICY .?AU_ADMINISTRATOR_POWER_POLICY@@ �Q �
7
�
�$
� F � _SERVICE_DESCRIPTIONA .?AU_SERVICE_DESCRIPTIONA@@
p lpDescription F �Q _SERVICE_DESCRIPTIONA .?AU_SERVICE_DESCRIPTIONA@@ �Q 3 � N � tagWNODE_EVENT_REFERENCE .?AUtagWNODE_EVENT_REFERENCE@@ ��
5 WnodeHeader ��
� 0 TargetGuid ���
" @ TargetDataBlockSize ��
" D TargetInstanceIndex ��
�I D TargetInstanceName ���N �Q H tagWNODE_EVENT_REFERENCE .?AUtagWNODE_EVENT_REFERENCE@@ �� �Q 8 B � _CSV_QUERY_MDS_PATH .?AU_CSV_QUERY_MDS_PATH@@ R
" MdsNodeId
" DsNodeId �
" PathLength ���
Path �B �Q _CSV_QUERY_MDS_PATH .?AU_CSV_QUERY_MDS_PATH@@ �Q �
iE
� b � _GET_FILTER_FILE_IDENTIFIER_OUTPUT .?AU_GET_FILTER_FILE_IDENTIFIER_OUTPUT@@ ��J
! FilterFileIdentifierLength ���
| FilterFileIdentifier �b R _GET_FILTER_FILE_IDENTIFIER_OUTPUT .?AU_GET_FILTER_FILE_IDENTIFIER_OUTPUT@@ �� R �"
$#
� F � _UNWIND_HISTORY_TABLE .?AU_UNWIND_HISTORY_TABLE@@ R � _UNWIND_HISTORY_TABLE_ENTRY .?AU_UNWIND_HISTORY_TABLE_ENTRY@@ R " � �
" Count
LocalHint
GlobalHint ���
Search ���
Once �
# LowAddress ���
# HighAddress ��
R Entry F R � _UNWIND_HISTORY_TABLE .?AU_UNWIND_HISTORY_TABLE@@ R � r � _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION .?AU_EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION@@
R
� �
� EventTraceInformationClass ���
" ReleaseSamplingRate ��
" ContentionSamplingRate ���
" NumberOfExcessiveTimeouts r
R _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION .?AU_EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION@@ R � V
LastError
LastEEInfo ���
= LastCalledStage ��
q ServerName ���
q ServerPort ���
q RemoteUser ���
q AuthType �
ResourceTypePresent ��
SessionIdPresent �
InterfacePresent �
� ResourceType �
� 0 SessionId
� @ Interface
T CertContext ��B R X _RDR_CALLOUT_STATE .?AU_RDR_CALLOUT_STATE@@ �� R � J � _RTL_FEATURE_USAGE_DATA .?AU_RTL_FEATURE_USAGE_DATA@@ B
u FeatureId
! ReportingKind
! Reserved �J R _RTL_FEATURE_USAGE_DATA .?AU_RTL_FEATURE_USAGE_DATA@@ R � z V � _DRIVER_VERIFIER_THUNK_PAIRS .?AU_DRIVER_VERIFIER_THUNK_PAIRS@@ ��
R
�
�#
� 6
R PristineRoutine ��
R NewRoutine ���V R _DRIVER_VERIFIER_THUNK_PAIRS .?AU_DRIVER_VERIFIER_THUNK_PAIRS@@ �� R { � B � tagEMRRESIZEPALETTE .?AUtagEMRRESIZEPALETTE@@
R
� 6
emr ��
" ihPal
" cEntries �B R tagEMRRESIZEPALETTE .?AUtagEMRRESIZEPALETTE@@ R �
�
�
" ��
" ��
" ��
" Flags
#R RaiseExceptionOnInvalidHandleReference ���
$R HandleExceptionsPermanentlyEnabled ���
%R ReservedFlags z &R _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ �� 'R C X J � _KEY_LAYER_INFORMATION .?AU_KEY_LAYER_INFORMATION@@ ��
)R
�
" ��
" ��
" ��
" ��
" ��
+R IsTombstone ��
,R IsSupersedeLocal �
-R IsSupersedeTree ��
.R ClassIsInherited �
/R Reserved �J 0R _KEY_LAYER_INFORMATION .?AU_KEY_LAYER_INFORMATION@@ �� 1R �
N:
� R � _KEY_SET_LAYER_INFORMATION .?AU_KEY_SET_LAYER_INFORMATION@@ ��
4R
�
" ��
" ��
" ��
" ��
" ��
6R IsTombstone ��
7R IsSupersedeLocal �
8R IsSupersedeTree ��
9R ClassIsInherited �
:R Reserved �R ;R _KEY_SET_LAYER_INFORMATION .?AU_KEY_SET_LAYER_INFORMATION@@ �� <R � . b � _VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT .?AU_VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT@@
>R
� *
" Size �
W6 BehaviorCode �b @R _VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT .?AU_VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT@@ AR �!
�A
� R � _KEY_WRITE_TIME_INFORMATION .?AU_KEY_WRITE_TIME_INFORMATION@@
DR
�
} LastWriteTime R FR _KEY_WRITE_TIME_INFORMATION .?AU_KEY_WRITE_TIME_INFORMATION@@ GR �
" ��
" ��
" ��
" ��
ImageBase
" SizeOfImage ��
" ImageFlags ���
IR ImagePartialMap ��
JR ImageNotExecutable ���
KR ImageSigningLevel
LR Reserved �N MR _MEMORY_IMAGE_INFORMATION .?AU_MEMORY_IMAGE_INFORMATION@@ NR �
�:
�
�4
�
2
�
y2
�
a>
�
�:
� �, " VR
WR
� 2 � _PORT_VIEW .?AU_PORT_VIEW@@ ��
YR
� �
" Length ���
SectionHandle
" SectionOffset
" ViewSize �
ViewBase �
ViewRemoteBase ���2 [R _PORT_VIEW .?AU_PORT_VIEW@@ �� \R � � Z � _FILE_PIPE_ASSIGN_EVENT_BUFFER .?AU_FILE_PIPE_ASSIGN_EVENT_BUFFER@@ ��.
EventHandle ��
" KeyValue �Z _R _FILE_PIPE_ASSIGN_EVENT_BUFFER .?AU_FILE_PIPE_ASSIGN_EVENT_BUFFER@@ �� `R
)
( ��
bR
�
�
� V
rgbBlue ��
rgbGreen �
rgbRed ���
rgbReserved ��2 eR tagRGBQUAD .?AUtagRGBQUAD@@ �� fR z Z � _RTL_DISK_WRITE_CONSTRAINT_INFO .?AU_RTL_DISK_WRITE_CONSTRAINT_INFO@@
�F Policy ���Z iR _RTL_DISK_WRITE_CONSTRAINT_INFO .?AU_RTL_DISK_WRITE_CONSTRAINT_INFO@@ jR � 7
h
� Y= f � _PERFINFO_PAGECOMBINE_ITERATION_STAT .?AU_PERFINFO_PAGECOMBINE_ITERATION_STAT@@ ��
" ��
" ��V
oR StatType �
pR Spare
" PagesScanned �
" PagesCombined f qR _PERFINFO_PAGECOMBINE_ITERATION_STAT .?AU_PERFINFO_PAGECOMBINE_ITERATION_STAT@@ �� rR � @
�+
�
�C
� J � _ATOM_BASIC_INFORMATION .?AU_ATOM_BASIC_INFORMATION@@ R
! UsageCount ���
! Flags
! NameLength ���
Name �J wR _ATOM_BASIC_INFORMATION .?AU_ATOM_BASIC_INFORMATION@@ xR
_
� B � tagEMRGRADIENTFILL .?AUtagEMRGRADIENTFILL@@ �� } " �j
emr ��
� rclBounds
" nVer �
" nTri �
" ulMode ���
|R $ Ver ��B }R 4 tagEMRGRADIENTFILL .?AUtagEMRGRADIENTFILL@@ �� ~R
�:
�
�
�
U>
�
8
�
�C
� b �R �R t t �R
�R
�
�
� ^ � _RTL_IMAGE_MITIGATION_HEAP_POLICY .?AU_RTL_IMAGE_MITIGATION_HEAP_POLICY@@ "
N TerminateOnHeapErrors ^ �R _RTL_IMAGE_MITIGATION_HEAP_POLICY .?AU_RTL_IMAGE_MITIGATION_HEAP_POLICY@@ �R � = : TimerSetCoalescableTimer � MaxTimerInfoClass R t �R _TIMER_SET_INFORMATION_CLASS .?AW4_TIMER_SET_INFORMATION_CLASS@@ ��� �R { � F � _RTL_HEAP_WALK_ENTRY .?AU_RTL_HEAP_WALK_ENTRY@@ ��
�R
� �
DataAddress ��
" DataSize �
OverheadBytes
SegmentIndex �
!
Flags
�J Block
�J Segment ��F �R _RTL_HEAP_WALK_ENTRY .?AU_RTL_HEAP_WALK_ENTRY@@ �� �R L �
�8
�
�E
�
�=
�
� W * �R _FP_32 .?AU_FP_32@@ �� �R + 6
�*
�
�
�
�7
�
�
�
�,
�
t unused ���2 �R HMETAFILE__ .?AUHMETAFILE__@@ �R ' �
�%
�
-
� i ` �R
�
�
\
� �
" ControlWord ��
" StatusWord ���
" TagWord ��
" ErrorOffset ��
" ErrorSelector
" DataOffset ���
" DataSelector �
�# RegisterArea �
" l Spare0 ���B �R p _FLOATING_SAVE_AREA .?AU_FLOATING_SAVE_AREA@@ �R �8 �
�@
�
-
� > � _LEAP_SECOND_DATA .?AU_LEAP_SECOND_DATA@@
� �R B � _ACCESS_DENIED_ACE .?AU_ACCESS_DENIED_ACE@@ ��:
o Header ���
" Mask �
" SidStart �B �R _ACCESS_DENIED_ACE .?AU_ACCESS_DENIED_ACE@@ �� �R �
|0
� V � _RTLP_HEAP_SERIALIZED_MAPPING .?AU_RTLP_HEAP_SERIALIZED_MAPPING@@ F
" Allocation ���
StackReference ���
" Size �V �R _RTLP_HEAP_SERIALIZED_MAPPING .?AU_RTLP_HEAP_SERIALIZED_MAPPING@@ �R L z
AE
�
/
�
QA
�
7F
�
�@
� B � _FILE_REGION_INPUT .?AU_FILE_REGION_INPUT@@ ��
�R
� F
FileOffset ���
Length ���
" DesiredUsage �B �R _FILE_REGION_INPUT .?AU_FILE_REGION_INPUT@@ �� �R } ^ � _FILE_END_OF_FILE_INFORMATION_EX .?AU_FILE_END_OF_FILE_INFORMATION_EX@@ ��b
} EndOfFile
} PagingFileSizeInMM ���
} PagingFileMaxSize
" Flags ^ �R _FILE_END_OF_FILE_INFORMATION_EX .?AU_FILE_END_OF_FILE_INFORMATION_EX@@ �� �R $
R4
�
�*
� �R t �R
�R
�
�B
�
�3
� b � _FILE_PIPE_EVENT_ENUM_INPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_INPUT_BUFFER@@ ��
# EventHandle ��b �R _FILE_PIPE_EVENT_ENUM_INPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_INPUT_BUFFER@@ �� �R �)
�
� R � _ETW_TIMER_EXPIRATION_EVENT .?AU_ETW_TIMER_EXPIRATION_EVENT@@ j
# ExpectedDueTime ��
" TimerAddress �
" DeferredRoutine ��
EncodedDelay �R �R _ETW_TIMER_EXPIRATION_EVENT .?AU_ETW_TIMER_EXPIRATION_EVENT@@ �R � � > � _RTL_ELEVATION_FLAGS .?AT_RTL_ELEVATION_FLAGS@@ ��
�R
�
" ��
" ��
" ��
" ��
" Flags
�R ElevationEnabled �
�R VirtualizationEnabled
�R InstallerDetectEnabled ���
�R ReservedBits �> �R _RTL_ELEVATION_FLAGS .?AT_RTL_ELEVATION_FLAGS@@ �� �R ( } � 2 �R
�R
� � " �n
Flags
EfficiencyClass ��
b Reserved �
! GroupCount ���
�R GroupMask J �R $ _PROCESSOR_RELATIONSHIP .?AU_PROCESSOR_RELATIONSHIP@@ �R { F � _PROCESS_INFORMATION .?AU_PROCESS_INFORMATION@@ ��
�R
� Z
hProcess �
hThread ��
" dwProcessId ��
" dwThreadId ���F �R _PROCESS_INFORMATION .?AU_PROCESS_INFORMATION@@ �� �R 1 J � _RTL_RVA_LIST_ITERATOR .?AU_RTL_RVA_LIST_ITERATOR@@ ��Z
" CurrentRva ���
" CurrentRvaIndex ��
" CompressedRvaDataOffset ��J �R _RTL_RVA_LIST_ITERATOR .?AU_RTL_RVA_LIST_ITERATOR@@ �� �R � r
?2
� Z � _NTPSS_MEMORY_BULK_INFORMATION .?AU_NTPSS_MEMORY_BULK_INFORMATION@@ ��R
" QueryFlags ���
" NumberOfEntries ��
NextValidAddress �Z �R _NTPSS_MEMORY_BULK_INFORMATION .?AU_NTPSS_MEMORY_BULK_INFORMATION@@ �� �R *
L
�
l,
�
ZG
�
5D
�
�B
� j � _FILE_NETWORK_PHYSICAL_NAME_INFORMATION .?AU_FILE_NETWORK_PHYSICAL_NAME_INFORMATION@@ 2
" FileNameLength ���
FileName �j �R _FILE_NETWORK_PHYSICAL_NAME_INFORMATION .?AU_FILE_NETWORK_PHYSICAL_NAME_INFORMATION@@ �R �
2
�
�<
�
�2
� " " � �
�
�
.
� J � _EVENT_FILTER_LEVEL_KW .?AU_EVENT_FILTER_LEVEL_KW@@ ��^
# MatchAnyKeyword ��
# MatchAllKeyword ��
Level
FilterIn �J S _EVENT_FILTER_LEVEL_KW .?AU_EVENT_FILTER_LEVEL_KW@@ �� S � �
�5
�
�<
�
�
� q " q t S
S
�
*
�
�
�
AB
�
2)
� �& " � �
! Size �
! Version ��
� ProcessorNumber ��
" ContextSwitches ��
" HwCountersCount ��
W UpdateCount ��
# WaitReasonBitMap �
# HardwareCounters �
�& ( CycleTime
S @ HwCounters ���N
S �_THREAD_PERFORMANCE_DATA .?AU_THREAD_PERFORMANCE_DATA@@ �� S a �
�6
�
(
�
�
�
60
�
6
�
W=
�
u
�
W5
�
7
�
�8
� f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W@@ ��
�' TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
q ServerCertificateSubject �
�' ProxyCredentials �
" NumberOfProxyAuthnSchemes
" ProxyAuthnSchemes f "S $ _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W@@ �� #S � �
� N � tagINPUT_INJECTION_VALUE .?AUtagINPUT_INJECTION_VALUE@@ ��B
! page �
! usage
t value
! index N 'S tagINPUT_INJECTION_VALUE .?AUtagINPUT_INJECTION_VALUE@@ �� (S P ^ � _PERFINFO_MEMORY_NODE_INFORMATION .?AU_PERFINFO_MEMORY_NODE_INFORMATION@@ �. " L �>
" PartitionId ��
" Count
+S NodeEntry ^ ,S T _PERFINFO_MEMORY_NODE_INFORMATION .?AU_PERFINFO_MEMORY_NODE_INFORMATION@@ -S � � j � _FILE_FS_PERSISTENT_VOLUME_INFORMATION .?AU_FILE_FS_PERSISTENT_VOLUME_INFORMATION@@ ��V
" VolumeFlags ��
" FlagMask �
" Version ��
" Reserved �j 0S _FILE_FS_PERSISTENT_VOLUME_INFORMATION .?AU_FILE_FS_PERSISTENT_VOLUME_INFORMATION@@ �� 1S W n � _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA .?AU_PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA@@ ��
� DeviceInstance ���
� InterfaceGuid
� Reference
Register �
q SymLink ��
" SymLinkLength n 4S _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA .?AU_PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA@@ �� 5S � V J � _FILE_PIPE_INFORMATION .?AU_FILE_PIPE_INFORMATION@@ ��2
" ReadMode �
" CompletionMode ���J 8S _FILE_PIPE_INFORMATION .?AU_FILE_PIPE_INFORMATION@@ �� 9S F . � _NT_TIB32 .?AU_NT_TIB32@@ �
" ExceptionList
" StackBase
" StackLimit ���
" SubSystemTib �
" FiberData
" Version ��
" ArbitraryUserPointer �
" Self �. <S _NT_TIB32 .?AU_NT_TIB32@@ =S C , Z � _FILE_FS_FULL_SIZE_INFORMATION .?AU_FILE_FS_FULL_SIZE_INFORMATION@@ ��
?S
� �
} TotalAllocationUnits �
} CallerAvailableAllocationUnits ���
} ActualAvailableAllocationUnits ���
" SectorsPerAllocationUnit �
" BytesPerSector ���Z AS _FILE_FS_FULL_SIZE_INFORMATION .?AU_FILE_FS_FULL_SIZE_INFORMATION@@ �� BS
�6
�
�F
�
I ��
FS
� F � _NETCONNECTINFOSTRUCT .?AU_NETCONNECTINFOSTRUCT@@ n
" cbStructure ��
" dwFlags ��
" dwSpeed ��
" dwDelay ��
" dwOptDataSize F IS _NETCONNECTINFOSTRUCT .?AU_NETCONNECTINFOSTRUCT@@ JS 5 u > � _SE_ACCESS_REPLY .?AU_SE_ACCESS_REPLY@@ ��
LS
�
�)
�
�>
�
OS
� �
" Size �
" ResultListCount ��
" GrantedAccess
AccessStatus �
NS AccessReason �
PS Privileges ���> QS _SE_ACCESS_REPLY .?AU_SE_ACCESS_REPLY@@ �� RS p t t t t TS
US
�
g
�
�
� ^ � _LOOKUP_STREAM_FROM_CLUSTER_ENTRY .?AU_LOOKUP_STREAM_FROM_CLUSTER_ENTRY@@ f
" OffsetToNext �
" Flags
} Reserved �
} Cluster ��
FileName �^ ZS _LOOKUP_STREAM_FROM_CLUSTER_ENTRY .?AU_LOOKUP_STREAM_FROM_CLUSTER_ENTRY@@ [S �
�
� J � _FILE_LEVEL_TRIM_OUTPUT .?AU_FILE_LEVEL_TRIM_OUTPUT@@
^S
� "
" NumRangesProcessed ���J `S _FILE_LEVEL_TRIM_OUTPUT .?AU_FILE_LEVEL_TRIM_OUTPUT@@ aS g
R
�
�5
� F � _IMAGE_IMPORT_BY_NAME .?AU_IMAGE_IMPORT_BY_NAME@@ "
! Hint �
� Name �F fS _IMAGE_IMPORT_BY_NAME .?AU_IMAGE_IMPORT_BY_NAME@@ gS [ } : � _NETINFOSTRUCT .?AU_NETINFOSTRUCT@@ ��
" cbStructure ��
" dwProviderVersion
" dwStatus �
" dwCharacteristics
" dwHandle �
! wNetType �
" dwPrinters ���
" dwDrives �: jS _NETINFOSTRUCT .?AU_NETINFOSTRUCT@@ �� kS 5 �
F
�
!
� R � _ETW_THREAD_AFFINITY_EVENT .?AU_ETW_THREAD_AFFINITY_EVENT@@ ��J
" Mask �
" ThreadId �
! Group
!
Reserved �R pS _ETW_THREAD_AFFINITY_EVENT .?AU_ETW_THREAD_AFFINITY_EVENT@@ �� qS � %
N/
� V � tagEMRCREATEDIBPATTERNBRUSHPT .?AUtagEMRCREATEDIBPATTERNBRUSHPT@@ �
emr ��
" ihBrush ��
" iUsage ���
" offBmi ���
" cbBmi
" offBits ��
" cbBits ���V uS tagEMRCREATEDIBPATTERNBRUSHPT .?AUtagEMRCREATEDIBPATTERNBRUSHPT@@ vS u
�*
�
�9
�
�
� B � _IMAGE_ROM_HEADERS .?AU_IMAGE_ROM_HEADERS@@ ��6
W FileHeader ���
O OptionalHeader ���B |S L _IMAGE_ROM_HEADERS .?AU_IMAGE_ROM_HEADERS@@ �� }S [ � f � PROCESS_PROTECTION_LEVEL_INFORMATION .?AUPROCESS_PROTECTION_LEVEL_INFORMATION@@ ��
" ProtectionLevel ��f �S PROCESS_PROTECTION_LEVEL_INFORMATION .?AUPROCESS_PROTECTION_LEVEL_INFORMATION@@ �� �S 1 �
�
� y 7 t �S
�S
�
;
�
�5
� b � _ETW_TP_EVENT_TIMER_EXPIRATION_END .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_END@@ ��
�S
� *
� Header ���
SubQueue �b �S $ _ETW_TP_EVENT_TIMER_EXPIRATION_END .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_END@@ �� �S � =
�
�
�D
� R � _ETW_CPU_CACHE_FLUSH_EVENT .?AU_ETW_CPU_CACHE_FLUSH_EVENT@@ ��
Address ��
" Bytes
Clean
FullFlush
Rectangle
Reserved0
" Reserved1 R �S _ETW_CPU_CACHE_FLUSH_EVENT .?AU_ETW_CPU_CACHE_FLUSH_EVENT@@ �� �S � N
.
� "
A) Type �
" Size �J �S _PO_WAKE_SOURCE_HEADER .?AU_PO_WAKE_SOURCE_HEADER@@ �� �S
N � _IMAGE_RESOURCE_DIRECTORY .?AU_IMAGE_RESOURCE_DIRECTORY@@
�S
� �
" Characteristics ��
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
! NumberOfNamedEntries �
! NumberOfIdEntries N �S _IMAGE_RESOURCE_DIRECTORY .?AU_IMAGE_RESOURCE_DIRECTORY@@ �S [ /
�
� : � tagEMRROUNDRECT .?AUtagEMRROUNDRECT@@ :
emr ��
� rclBox ���
� szlCorner : �S tagEMRROUNDRECT .?AUtagEMRROUNDRECT@@ �S
�"
� > � _NTFS_STATISTICS .?AU_NTFS_STATISTICS@@ ��
�S
� ~
" LogFileFullExceptions
" OtherExceptions ��
" MftReads �
" MftReadBytes �
" MftWrites
" MftWriteBytes
�M MftWritesUserLevel ���
! MftWritesFlushForLogFileFull �
! " MftWritesLazyWriter ��
! $ MftWritesUserRequest �
" ( Mft2Writes ���
" , Mft2WriteBytes ���
�M 0 Mft2WritesUserLevel ��
! 8 Mft2WritesFlushForLogFileFull
! : Mft2WritesLazyWriter �
! < Mft2WritesUserRequest
" @ RootIndexReads ���
" D RootIndexReadBytes ���
" H RootIndexWrites ��
" L RootIndexWriteBytes ��
" P BitmapReads ��
" T BitmapReadBytes ��
" X BitmapWrites �
" \ BitmapWriteBytes �
! ` BitmapWritesFlushForLogFileFull ��
! b BitmapWritesLazyWriter ���
! d BitmapWritesUserRequest ��
}M f BitmapWritesUserLevel
" l MftBitmapReads ���
" p MftBitmapReadBytes ���
" t MftBitmapWrites ��
" x MftBitmapWriteBytes ��
! | MftBitmapWritesFlushForLogFileFull ���
! ~ MftBitmapWritesLazyWriter
! � MftBitmapWritesUserRequest ���
zM � MftBitmapWritesUserLevel �
" � UserIndexReads ���
" � UserIndexReadBytes ���
" � UserIndexWrites ��
" � UserIndexWriteBytes ��
" � LogFileReads �
" � LogFileReadBytes �
" � LogFileWrites
" � LogFileWriteBytes
wM � Allocate �
" � DiskResourcesExhausted ���> . �S � _NTFS_STATISTICS .?AU_NTFS_STATISTICS@@ �� �S \ F � _TEB_ACTIVE_FRAME_EX .?AU_TEB_ACTIVE_FRAME_EX@@ ��:
� BasicFrame ���
ExtensionIdentifier ��F �S _TEB_ACTIVE_FRAME_EX .?AU_TEB_ACTIVE_FRAME_EX@@ �� �S �
3
� j � _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX@@ ��V
DebuggerAllowed ��
DebuggerEnabled ��
DebuggerPresent ��j �S _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX@@ �� �S �
�
�
�'
�
�
�
�'
� : � tagGCP_RESULTSW .?AUtagGCP_RESULTSW@@ �
" lStructSize ��
q lpOutString ��
u lpOrder ��
t lpDx �
t lpCaretPos ���
p lpClass ��
q lpGlyphs �
u nGlyphs ��
t nMaxFit ��: �S $ tagGCP_RESULTSW .?AUtagGCP_RESULTSW@@ �S �
�!
� q t �S
�S
� F � tagMENUGETOBJECTINFO .?AUtagMENUGETOBJECTINFO@@ ��V
" dwFlags ��
u uPos �
2 hmenu
riid �
pvObj F �S tagMENUGETOBJECTINFO .?AUtagMENUGETOBJECTINFO@@ �� �S h
�*
� J � _MESSAGE_RESOURCE_ENTRY .?AU_MESSAGE_RESOURCE_ENTRY@@ 6
! Length ���
! Flags
| Text �J �S _MESSAGE_RESOURCE_ENTRY .?AU_MESSAGE_RESOURCE_ENTRY@@ �S ( �
�C
� B � tagMDICREATESTRUCTW .?AUtagMDICREATESTRUCTW@@ �
�% szClass ��
�% szTitle ��
hOwner ���
t x
t y
t cx ���
t cy ���
" style
lParam ���B �S $ tagMDICREATESTRUCTW .?AUtagMDICREATESTRUCTW@@ �S �.
�
�
��
��
��
��
��
��
��
��
�;
� . � _SLIST_HEADER .?AT_SLIST_HEADER@@
�S
�
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" �� " " � �
�
� " " � �N � _ACTIVATION_CONTEXT_DATA .?AU_ACTIVATION_CONTEXT_DATA@@ ��
�S ��
�S
� F � _ASSEMBLY_STORAGE_MAP .?AU_ASSEMBLY_STORAGE_MAP@@
�S
�
" ��
" ��
" ��
" �� p " �
�R
�
" ��
" ��
InheritedAddressSpace
ReadImageFileExecOptions �
BeingDebugged
BitField �
�S ImageUsesLargePages ��
�S IsProtectedProcess ���
�S IsImageDynamicallyRelocated ��
�S SkipPatchingUser32Forwarders �
�S IsPackagedProcess
�S IsAppContainer ���
�S IsProtectedProcessLight ��
�S IsLongPathAwareProcess ���
Mutant ���
ImageBaseAddress �
�S Ldr ��
W< ProcessParameters
SubSystemData
ProcessHeap ��
� FastPebLock ��
�S AtlThunkSListPtr �
$ IFEOKey ��
" ( CrossProcessFlags
�S ( ProcessInJob �
�S ( ProcessInitializing ��
�S ( ProcessUsingVEH ��
�S ( ProcessUsingVCH ��
�S ( ProcessUsingFTH ��
�S ( ProcessPreviouslyThrottled ���
�S ( ProcessCurrentlyThrottled
�S ( ProcessImagesHotPatched ��
�S ( ReservedBits0
, KernelCallbackTable ��
, UserSharedInfoPtr
" 0 SystemReserved ���
�S 4 AtlThunkSListPtr32 ���
8 ApiSetMap
" < TlsExpansionCounter ��
@ TlsBitmap
� D TlsBitmapBits
L ReadOnlySharedMemoryBase �
P SharedData ���
� T ReadOnlyStaticServerData �
X AnsiCodePageData �
\ OemCodePageData ��
` UnicodeCaseTableData �
" d NumberOfProcessors ���
" h NtGlobalFlag �
} p CriticalSectionTimeout ���
" x HeapSegmentReserve ���
" | HeapSegmentCommit
" � HeapDeCommitTotalFreeThreshold ���
" � HeapDeCommitFreeBlockThreshold ���
" � NumberOfHeaps
" � MaximumNumberOfHeaps �
� � ProcessHeaps �
� GdiSharedHandleTable �
� ProcessStarterHelper �
" � GdiDCAttributeList ���
� � LoaderLock ���
" � OSMajorVersion ���
" � OSMinorVersion ���
! � OSBuildNumber
! � OSCSDVersion �
" � OSPlatformId �
" � ImageSubsystem ���
" � ImageSubsystemMajorVersion ���
" � ImageSubsystemMinorVersion ���
" � ActiveProcessAffinityMask
�S � GdiHandleBuffer ��
�S LPostProcessInitRoutine ���
PTlsExpansionBitmap ���
�S TTlsExpansionBitmapBits ���
" �SessionId
� �AppCompatFlags ���
� �AppCompatFlagsUser ���
�pShimData
�AppCompatInfo
� �CSDVersion ���
�S �ActivationContextData
�S �ProcessAssemblyStorageMap
�S SystemDefaultActivationContextData ���
�S SystemAssemblyStorageMap �
" MinimumStackCommit ���
�8 SparePointers
� SpareUlongs ��
0WerRegistrationData ��
4WerShipAssertPtr �
8pUnused ��
<pImageHeaderHash �
" @TracingFlags �
�S @HeapTracingEnabled ���
�S @CritSecTracingEnabled
�S @LibLoaderTracingEnabled ��
�S @SpareTracingBits �
# HCsrServerReadOnlySharedMemoryBase
" PTppWorkerpListLock ���
� TTppWorkerpList ���
o \WaitOnAddressHashTable ���
\TelemetryCoverageHeader ��
" `CloudFileFlags ���
" dCloudFileDiagFlags ���
p hPlaceholderCompatibilityMode �
�S iPlaceholderCompatibilityModeReserved �
�S pLeapSecondData ���
" tLeapSecondFlags ��
�S tSixtySecondEnabled ���
�S tReserved �
" xNtGlobalFlag2 & l �S �_PEB .?AU_PEB@@ �� �S m > � tagBITMAPCOREINFO .?AUtagBITMAPCOREINFO@@ 3 " �2
� bmciHeader ���
�S bmciColors ���> �S tagBITMAPCOREINFO .?AUtagBITMAPCOREINFO@@ �S �
}&
�
3M
� 6 � _BOOT_OPTIONS .?AU_BOOT_OPTIONS@@
�S
� �
" Version ��
" Length ���
" Timeout ��
" CurrentBootEntryId ���
" NextBootEntryId ��
HeadlessRedirection ��6 �S _BOOT_OPTIONS .?AU_BOOT_OPTIONS@@ �S �
S%
� ^ � _PROCESS_LEAP_SECOND_INFORMATION .?AU_PROCESS_LEAP_SECOND_INFORMATION@@ ��
T
� &
" Flags
" Reserved �^ T _PROCESS_LEAP_SECOND_INFORMATION .?AU_PROCESS_LEAP_SECOND_INFORMATION@@ �� T C
�8
� 6 � HTOUCHINPUT__ .?AUHTOUCHINPUT__@@
T
�
t unused ���6 T HTOUCHINPUT__ .?AUHTOUCHINPUT__@@ T
;S
�
�/
�
#
�
�
� ^ � _SYSTEM_ACTIVITY_MODERATION_INFO .?AU_SYSTEM_ACTIVITY_MODERATION_INFO@@ ��J
� Identifier ���
�B ModerationState ��
^7 AppType ��^ T _SYSTEM_ACTIVITY_MODERATION_INFO .?AU_SYSTEM_ACTIVITY_MODERATION_INFO@@ �� T *
B
�
�
� F � _RTL_HEAP_STACK_QUERY .?AU_RTL_HEAP_STACK_QUERY@@
T
� " T
T
� �
" Version ��
Process ��
T WriteRoutine �
SerializationContext �
QueryLevel ���
Flags F T _RTL_HEAP_STACK_QUERY .?AU_RTL_HEAP_STACK_QUERY@@ T L �
�4
�
�
�
�I
� f
" NextEntryOffset ��
� ParentFileId �
" FileNameLength ���
FileName �f T _FILE_LINK_ENTRY_FULL_ID_INFORMATION .?AU_FILE_LINK_ENTRY_FULL_ID_INFORMATION@@ �� !T �
[,
�
#T
� J � tagINPUT_MESSAGE_SOURCE .?AUtagINPUT_MESSAGE_SOURCE@@ .
� deviceType ���
[+ originId �J &T tagINPUT_MESSAGE_SOURCE .?AUtagINPUT_MESSAGE_SOURCE@@ 'T �= Z � _PLUGPLAY_CONTROL_CONFLICT_DATA .?AU_PLUGPLAY_CONTROL_CONFLICT_DATA@@
)T
�
�E
�
�,
� �
� DeviceInstance ���
+T ResourceList �
" ResourceListSize �
,T ConflictBuffer ���
" ConflictBufferSize ���
" Flags
Status ���Z -T _PLUGPLAY_CONTROL_CONFLICT_DATA .?AU_PLUGPLAY_CONTROL_CONFLICT_DATA@@ .T � �
rG
� Z � _PROCESS_FOREGROUND_BACKGROUND .?AU_PROCESS_FOREGROUND_BACKGROUND@@ ��
Foreground ���Z 2T _PROCESS_FOREGROUND_BACKGROUND .?AU_PROCESS_FOREGROUND_BACKGROUND@@ �� 3T a >
B
�
�E
�
�7
�
�,
�
f!
� �> " " " " ;T
<T
�
�
� V � _FILE_FS_CONTROL_INFORMATION .?AU_FILE_FS_CONTROL_INFORMATION@@ ��
?T
� �
} FreeSpaceStartFiltering ��
} FreeSpaceThreshold ���
} FreeSpaceStopFiltering ���
} DefaultQuotaThreshold
} DefaultQuotaLimit
" ( FileSystemControlFlags ���V AT 0 _FILE_FS_CONTROL_INFORMATION .?AU_FILE_FS_CONTROL_INFORMATION@@ �� BT �
2=
� &
q wcLow
! cGlyphs ��2 ET tagWCRANGE .?AUtagWCRANGE@@ �� FT �
j>
�
�
x
�
�
�
" dwExitCode ���N LT _EXIT_PROCESS_DEBUG_INFO .?AU_EXIT_PROCESS_DEBUG_INFO@@ �� MT c L
�
�
�
�
�
� j � _ACTIVATION_CONTEXT_SECTION_KEYED_DATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA@@ ��
RT
� 2
" Size �
" DataFormatVersion
Data �
" Length ���
SectionGlobalData
" SectionGlobalDataLength ��
SectionBase ��
" SectionTotalLength ���
~! ActivationContext
" $ AssemblyRosterIndex ��
" ( Flags
5 , AssemblyMetadata �j TT @ _ACTIVATION_CONTEXT_SECTION_KEYED_DATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA@@ �� UT L �
�
�
�1
�
6
� " �% YT t ZT
[T
�
�
�#
�
~
�
6
�
�6
�
�>
� cT
6
�
�
�
&5
� F � _KEY_NAME_INFORMATION .?AU_KEY_NAME_INFORMATION@@
hT
� *
" NameLength ���
Name �F jT _KEY_NAME_INFORMATION .?AU_KEY_NAME_INFORMATION@@ kT � � J � _ETW_CLOCK_TIME_UPDATE .?AU_ETW_CLOCK_TIME_UPDATE@@ ��2
# InterruptTime
" ClockOwner ���J nT _ETW_CLOCK_TIME_UPDATE .?AU_ETW_CLOCK_TIME_UPDATE@@ �� oT �
�;
�
/
� R � _RTL_TIME_ZONE_INFORMATION .?AU_RTL_TIME_ZONE_INFORMATION@@ ��
sT
� �
Bias �
� StandardName �
7 D StandardStart
T StandardBias �
� X DaylightName �
7 � DaylightStart
� DaylightBias �R uT � _RTL_TIME_ZONE_INFORMATION .?AU_RTL_TIME_ZONE_INFORMATION@@ �� vT � � } N � _RTL_ENCLAVE_LAUNCH_TOKEN .?AU_RTL_ENCLAVE_LAUNCH_TOKEN@@ �
S Measurement ��
S AuthorId �
� @ FamilyId �
� P ImageId ��
# ` EnclaveSize ��
" h EnclaveSvn ���
" l PolicyFlags ��N zT p _RTL_ENCLAVE_LAUNCH_TOKEN .?AU_RTL_ENCLAVE_LAUNCH_TOKEN@@ {T �
^R
� N � _PROCESS_LOGGING_INFORMATION .?AT_PROCESS_LOGGING_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" Flags
T EnableReadVmLogging ��
�T EnableWriteVmLogging �
�T EnableProcessSuspendResumeLogging
�T EnableThreadSuspendResumeLogging �
�T Reserved �N �T _PROCESS_LOGGING_INFORMATION .?AT_PROCESS_LOGGING_INFORMATION@@ �� �T C Z > � _IMAGE_VXD_HEADER .?AU_IMAGE_VXD_HEADER@@ �
! e32_magic
e32_border ���
e32_worder ���
" e32_level
! e32_cpu ��
!
e32_os ���
" e32_ver ��
" e32_mflags ���
" e32_mpages ���
" e32_startobj �
" e32_eip ��
" e32_stackobj �
" $ e32_esp ��
" ( e32_pagesize �
" , e32_lastpagesize �
" 0 e32_fixupsize
" 4 e32_fixupsum �
" 8 e32_ldrsize ��
" < e32_ldrsum ���
" @ e32_objtab ���
" D e32_objcnt ���
" H e32_objmap ���
" L e32_itermap ��
" P e32_rsrctab ��
" T e32_rsrccnt ��
" X e32_restab ���
" \ e32_enttab ���
" ` e32_dirtab ���
" d e32_dircnt ���
" h e32_fpagetab �
" l e32_frectab ��
" p e32_impmod ���
" t e32_impmodcnt
" x e32_impproc ��
" | e32_pagesum ��
" � e32_datapage �
" � e32_preload ��
" � e32_nrestab ��
" � e32_cbnrestab
" � e32_nressum ��
" � e32_autodata �
" � e32_debuginfo
" � e32_debuglen �
" � e32_instpreload ��
" � e32_instdemand ���
" � e32_heapsize �
� � e32_res3 �
" � e32_winresoff
" � e32_winreslen
! � e32_devid
! � e32_ddkver ���> 3 �T � _IMAGE_VXD_HEADER .?AU_IMAGE_VXD_HEADER@@ �T [ | N � _WNF_DELIVERY_DESCRIPTOR .?AU_WNF_DELIVERY_DESCRIPTOR@@ ��
# SubscriptionId ���
�, StateName
" ChangeStamp ��
" StateDataSize
" EventMask
�, TypeId ���
" , StateDataOffset ��N �T 0 _WNF_DELIVERY_DESCRIPTOR .?AU_WNF_DELIVERY_DESCRIPTOR@@ �� �T 6
�*
�
�"
� B � _FILE_FULL_DIR_INFO .?AU_FILE_FULL_DIR_INFO@@
�T
� &
" NextEntryOffset ��
" FileIndex
} CreationTime �
} LastAccessTime ���
} LastWriteTime
} ChangeTime ���
} ( EndOfFile
} 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
D FileName �B �T H _FILE_FULL_DIR_INFO .?AU_FILE_FULL_DIR_INFO@@ �T �"
�
� R
" dwType ���
" dwSize ���
hDevice ��
u wParam ���> �T tagRAWINPUTHEADER .?AUtagRAWINPUTHEADER@@ �T :
�C
� " " ` �T
�T
�
�8
� J � _QUERY_SERVICE_CONFIGW .?AU_QUERY_SERVICE_CONFIGW@@ ��
�T
� �
" dwServiceType
" dwStartType ��
" dwErrorControl ���
q lpBinaryPathName �
q lpLoadOrderGroup �
" dwTagId ��
q lpDependencies ���
q lpServiceStartName ���
q lpDisplayName J �T $ _QUERY_SERVICE_CONFIGW .?AU_QUERY_SERVICE_CONFIGW@@ �� �T 3 ;
�#
�
t5
� *
Offset ���
# Length ���F �T _SCRUB_PARITY_EXTENT .?AU_SCRUB_PARITY_EXTENT@@ �� �T '
�B
� f
BlendOp ��
BlendFlags ���
SourceConstantAlpha ��
AlphaFormat ��: �T _BLENDFUNCTION .?AU_BLENDFUNCTION@@ �� �T F
o
�
�1
�
�6
�
Y9
�
?$
� 6
" PrivilegeCount ���
�> Privileges ���> �T _TOKEN_PRIVILEGES .?AU_TOKEN_PRIVILEGES@@ �T � N � _KLDR_DATA_TABLE_ENTRY32 .?AU_KLDR_DATA_TABLE_ENTRY32@@ ��v
InLoadOrderLinks �
" __Undefined1 �
" __Undefined2 �
" __Undefined3 �
" NonPagedDebugInfo
" DllBase ��
" EntryPoint ���
" SizeOfImage ��
X) $ FullDllName ��
X) , BaseDllName ��
" 4 Flags
! 8 LoadCount
! : __Undefined5 �
" < __Undefined6 �
" @ CheckSum �
" D TimeDateStamp N �T H _KLDR_DATA_TABLE_ENTRY32 .?AU_KLDR_DATA_TABLE_ENTRY32@@ �� �T u a
3C
�
�
� r � _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION .?AU_SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION@@ ��
�T
� &
HypervisorSharedUserVa ���r �T _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION .?AU_SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION@@ �� �T D
)
�
�5
� F � _T2_SET_PARAMETERS_V0 .?AU_T2_SET_PARAMETERS_V0@@ F
" Version ��
" Reserved �
NoWakeTolerance ��F �T _T2_SET_PARAMETERS_V0 .?AU_T2_SET_PARAMETERS_V0@@ �T � N � _RTL_MODULE_EXTENDED_INFO .?AU_RTL_MODULE_EXTENDED_INFO@@ ^
�" BasicInfo
" ImageSize
! FileNameOffset ���
�
FullPathName �N �T _RTL_MODULE_EXTENDED_INFO .?AU_RTL_MODULE_EXTENDED_INFO@@ �T u � f � _SYSTEM_FEATURE_CONFIGURATION_UPDATE .?AU_SYSTEM_FEATURE_CONFIGURATION_UPDATE@@ ��
�T
� c " �j
# PreviousChangeStamp ��
�* ConfigurationType
" UpdateCount ��
�T Updates ��f �T 0 _SYSTEM_FEATURE_CONFIGURATION_UPDATE .?AU_SYSTEM_FEATURE_CONFIGURATION_UPDATE@@ �� �T j
�
� B � _PERFINFO_IO_TIMER .?AU_PERFINFO_IO_TIMER@@ ��
�T
� 6
DeviceObject �
RoutineAddress ���B �T _PERFINFO_IO_TIMER .?AU_PERFINFO_IO_TIMER@@ �� �T � .
�
� Z � _WIM_PROVIDER_ADD_OVERLAY_INPUT .?AU_WIM_PROVIDER_ADD_OVERLAY_INPUT@@ b
" WimType ��
" WimIndex �
" WimFileNameOffset
" WimFileNameLength Z �T _WIM_PROVIDER_ADD_OVERLAY_INPUT .?AU_WIM_PROVIDER_ADD_OVERLAY_INPUT@@ �T &"
�4
�
Y
�
44
� � �T " �T
�T
�
�M
�
�:
� J � _ETW_WNF_EVENT_PUBLISH .?AU_ETW_WNF_EVENT_PUBLISH@@ ��
�T
� B
� Header ���
} StateName
" ( DataLength ���J �T 0 _ETW_WNF_EVENT_PUBLISH .?AU_ETW_WNF_EVENT_PUBLISH@@ �� �T � {
�1
�
�M
�
�,
�
v8
�
c+
� v
" Marker ���
! Size �
Reserved �
Version ��
" Header ���
iE Packet ���F �T _MESSAGE_TRACE_HEADER .?AU_MESSAGE_TRACE_HEADER@@ �T � �
�
� Z � _TOKEN_APPCONTAINER_INFORMATION .?AU_TOKEN_APPCONTAINER_INFORMATION@@
�T
�
TokenAppContainer Z �T _TOKEN_APPCONTAINER_INFORMATION .?AU_TOKEN_APPCONTAINER_INFORMATION@@ �T !
AC
� Z � _SYSTEM_OBJECTTYPE_INFORMATION .?AU_SYSTEM_OBJECTTYPE_INFORMATION@@ ��
" NextEntryOffset ��
" NumberOfObjects ��
" NumberOfHandles ��
" TypeIndex
" InvalidAttributes
�$ GenericMapping ���
" $ ValidAccessMask ��
" ( PoolType �
, SecurityRequired �
- WaitableObject ���
� 0 TypeName �Z �T 8 _SYSTEM_OBJECTTYPE_INFORMATION .?AU_SYSTEM_OBJECTTYPE_INFORMATION@@ �� �T "
�S
�
�Q
�
�S
�
�+
� " " � �2 � _TP_DIRECT .?AU_TP_DIRECT@@ ��
U
� � U �> U
U
� �
� Task �
" Lock �
� IoCompletionInformationList ��
U Callback �
" $ NumaNode �
( IdealProcessor ���2 U , _TP_DIRECT .?AU_TP_DIRECT@@ �� U �
�"
� Z � _SYSTEM_PROCESS_TRUST_LABEL_ACE .?AU_SYSTEM_PROCESS_TRUST_LABEL_ACE@@
U
� :
o Header ���
" Mask �
" SidStart �Z U _SYSTEM_PROCESS_TRUST_LABEL_ACE .?AU_SYSTEM_PROCESS_TRUST_LABEL_ACE@@ U � : � tagICONMETRICSW .?AUtagICONMETRICSW@@
U
� r
u cbSize ���
t iHorzSpacing �
t iVertSpacing �
t iTitleWrap ���
� lfFont ���: U l tagICONMETRICSW .?AUtagICONMETRICSW@@ U .2
�:
�
{E
� : � _CSV_MGMT_LOCK .?AU_CSV_MGMT_LOCK@@ ��
" Flags : U _CSV_MGMT_LOCK .?AU_CSV_MGMT_LOCK@@ �� U ,
�
�
�#
�
RD
�
�>
�
�
� : � _STARTUPINFOEXA .?AU_STARTUPINFOEXA@@
U
� 6
StartupInfo ��
� D lpAttributeList ��: U H _STARTUPINFOEXA .?AU_STARTUPINFOEXA@@ !U 1 > � _RTL_HANDLE_TABLE .?AU_RTL_HANDLE_TABLE@@
B&
� �
" MaximumNumberOfHandles ���
" SizeOfHandleTableEntry ���
" UseHeap ��
" TableSize
$U FreeHandles ��
$U CommittedHandles �
$U UnCommittedHandles ���
$U MaxReservedHandles ���> %U _RTL_HANDLE_TABLE .?AU_RTL_HANDLE_TABLE@@ &U L �
s
�
�+
�
�<
� N � _RTL_PHYSICAL_MEMORY_INFO .?AU_RTL_PHYSICAL_MEMORY_INFO@@
+U
�
8 Policy ���N -U _RTL_PHYSICAL_MEMORY_INFO .?AU_RTL_PHYSICAL_MEMORY_INFO@@ .U �
�E
�
#3
� f � _JOBOBJECT_IO_ATTRIBUTION_INFORMATION .?AU_JOBOBJECT_IO_ATTRIBUTION_INFORMATION@@ F
" ControlFlags �
" ReadStats
" ( WriteStats ���f 3U H _JOBOBJECT_IO_ATTRIBUTION_INFORMATION .?AU_JOBOBJECT_IO_ATTRIBUTION_INFORMATION@@ 4U C �
7D
�
�3
� b � _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY@@
8U
� �
" BeginAddress �
" EndAddress ���
" ExceptionHandler �
" HandlerData ��
" PrologEndAddress �b :U _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY@@ ;U [ +
@1
� > � _KTMOBJECT_CURSOR .?AU_KTMOBJECT_CURSOR@@ B
� LastQuery
" ObjectIdCount
^ ObjectIds > ?U $ _KTMOBJECT_CURSOR .?AU_KTMOBJECT_CURSOR@@ @U � � 2 � HRAWINPUT__ .?AUHRAWINPUT__@@
t unused ���2 CU HRAWINPUT__ .?AUHRAWINPUT__@@ DU �9
dE
� J � _WRITE_USN_REASON_INPUT .?AU_WRITE_USN_REASON_INPUT@@ .
" Flags
" UsnReasonToWrite �J HU _WRITE_USN_REASON_INPUT .?AU_WRITE_USN_REASON_INPUT@@ IU � B � _PS_STD_HANDLE_INFO .?AU_PS_STD_HANDLE_INFO@@
" ��
" ��n
" Flags
LU StdHandleState ���
MU PseudoHandleMask �
" StdHandleSubsystemType ���B NU _PS_STD_HANDLE_INFO .?AU_PS_STD_HANDLE_INFO@@ OU a M > � _QUOTA_LIMITS_EX .?AU_QUOTA_LIMITS_EX@@ ��&
" PagedPoolLimit ���
" NonPagedPoolLimit
" MinimumWorkingSetSize
" MaximumWorkingSetSize
" PagefileLimit
} TimeLimit
" WorkingSetLimit ��
" $ Reserved2
" ( Reserved3
" , Reserved4
" 0 Flags
�; 4 CpuRateLimit �> RU 8 _QUOTA_LIMITS_EX .?AU_QUOTA_LIMITS_EX@@ �� SU C � > � _IMAGE_RELOCATION .?AU_IMAGE_RELOCATION@@ b
" VirtualAddress ���
" RelocCount ���
" SymbolTableIndex �
! Type �> VU
_IMAGE_RELOCATION .?AU_IMAGE_RELOCATION@@ WU [ u
V$
� . � in6_addr .?AUin6_addr@@ ��B � _WMI_WAIT_MULTIPLE .?AU_WMI_WAIT_MULTIPLE@@ ��J � _WMI_WAIT_OBJECT_RECORD .?AU_WMI_WAIT_OBJECT_RECORD@@ \U " �Z
" ThreadId �
WaitType �
ObjectCount ��
]U ObjectRecord �B ^U _WMI_WAIT_MULTIPLE .?AU_WMI_WAIT_MULTIPLE@@ �� _U � �
�*
�
U1
� j � _FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER .?AU_FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER@@ ��
} FileOffset ���
} ByteCount
� RecallOwnerGuid ��
" RecallMetadataBufferSize �
| $ RecallMetadataBuffer �j dU ( _FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER .?AU_FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER@@ �� eU o* B � _REPARSE_INDEX_KEY .?AU_REPARSE_INDEX_KEY@@ ��
gU
� 2
" FileReparseTag ���
} FileId ���B iU _REPARSE_INDEX_KEY .?AU_REPARSE_INDEX_KEY@@ �� jU (& B
Status ���
Pointer ��
" Information ��> lU _IO_STATUS_BLOCK .?AU_IO_STATUS_BLOCK@@ �� mU �
�!
�
qE
� : � _WMI_IRQ_RECORD .?AU_WMI_IRQ_RECORD@@ �
# IRQAffinity ��
! IRQGroup �
!
Reserved �
" IRQNum ���
" DeviceDescriptionLen �
DeviceDescription : rU _WMI_IRQ_RECORD .?AU_WMI_IRQ_RECORD@@ sU � �
G,
� 6 � _GLYPHMETRICS .?AU_GLYPHMETRICS@@
vU
� ~
u gmBlackBoxX ��
u gmBlackBoxY ��
x gmptGlyphOrigin ��
gmCellIncX ���
gmCellIncY ���6 xU _GLYPHMETRICS .?AU_GLYPHMETRICS@@ yU w
V � _SYSTEM_EXCEPTION_INFORMATION .?AU_SYSTEM_EXCEPTION_INFORMATION@@
{U
� �
" AlignmentFixupCount ��
" ExceptionDispatchCount ���
" FloatingEmulationCount ���
" ByteWordEmulationCount ���V }U _SYSTEM_EXCEPTION_INFORMATION .?AU_SYSTEM_EXCEPTION_INFORMATION@@ ~U �
:1
�
�+
�
[U
�
�D
�
D+ ��
�U
� >
� Id ���
': Type �
# MaxVersionTested �Z �U _COMPATIBILITY_CONTEXT_ELEMENT .?AU_COMPATIBILITY_CONTEXT_ELEMENT@@ �� �U L �
�D
�
a7
� N � _ETW_KQUEUE_ENQUEUE_EVENT .?AU_ETW_KQUEUE_ENQUEUE_EVENT@@ &
Entry
" ThreadId �N �U _ETW_KQUEUE_ENQUEUE_EVENT .?AU_ETW_KQUEUE_ENQUEUE_EVENT@@ �U � �
�=
� Z � _KEY_VIRTUALIZATION_INFORMATION .?AU_KEY_VIRTUALIZATION_INFORMATION@@
�U
�
" ��
" ��
" ��
" ��
" ��
" ��
�U VirtualizationCandidate ��
�U VirtualizationEnabled
�U VirtualTarget
�U VirtualStore �
�U VirtualSource
�U Reserved �Z �U _KEY_VIRTUALIZATION_INFORMATION .?AU_KEY_VIRTUALIZATION_INFORMATION@@ �U � �
8
� N � _FILE_FULL_EA_INFORMATION .?AU_FILE_FULL_EA_INFORMATION@@ r
" NextEntryOffset ��
Flags
EaNameLength �
! EaValueLength
� EaName ���N �U _FILE_FULL_EA_INFORMATION .?AU_FILE_FULL_EA_INFORMATION@@ �U �
�@
�
z
�
�7
�
RT ��
�U
� Z � _RTL_PROCESS_BACKTRACES_CONTROL .?AU_RTL_PROCESS_BACKTRACES_CONTROL@@
�U
� f
" ControlCode ��
" ControlSize ��
| ControlData ��
Y DatabaseCreate ���Z �U _RTL_PROCESS_BACKTRACES_CONTROL .?AU_RTL_PROCESS_BACKTRACES_CONTROL@@ �U � � R � _REPARSE_POINT_INFORMATION .?AU_REPARSE_POINT_INFORMATION@@ ��>
! ReparseDataLength
! UnparsedNameLength ���R �U _REPARSE_POINT_INFORMATION .?AU_REPARSE_POINT_INFORMATION@@ �� �U �
�;
� B � tagEMRCREATEPALETTE .?AUtagEMRCREATEPALETTE@@
�U
� 2
emr ��
" ihPal
; lgpl �B �U tagEMRCREATEPALETTE .?AUtagEMRCREATEPALETTE@@ �U F
�C
�
A
�
�
� b � _SYSTEM_MEMORY_TOPOLOGY_INFORMATION .?AU_SYSTEM_MEMORY_TOPOLOGY_INFORMATION@@ V. " �^
# NumberOfRuns �
" NumberOfNodes
" NumberOfChannels �
�U Run ��b �U 0 _SYSTEM_MEMORY_TOPOLOGY_INFORMATION .?AU_SYSTEM_MEMORY_TOPOLOGY_INFORMATION@@ �U V � _CM_DISK_GEOMETRY_DEVICE_DATA .?AU_CM_DISK_GEOMETRY_DEVICE_DATA@@ n
" BytesPerSector ���
" NumberOfCylinders
" SectorsPerTrack ��
" NumberOfHeads V �U _CM_DISK_GEOMETRY_DEVICE_DATA .?AU_CM_DISK_GEOMETRY_DEVICE_DATA@@ �U � 2 N � _SECURITY_SEED_AND_LENGTH .?AU_SECURITY_SEED_AND_LENGTH@@
�U
� &
Length ���
Seed �N �U _SECURITY_SEED_AND_LENGTH .?AU_SECURITY_SEED_AND_LENGTH@@ �U ] �
�
q
�
�U
� V � _IMAGE_RESOURCE_DIR_STRING_U .?AU_IMAGE_RESOURCE_DIR_STRING_U@@ ��.
! Length ���
NameString ���V �U _IMAGE_RESOURCE_DIR_STRING_U .?AU_IMAGE_RESOURCE_DIR_STRING_U@@ �� �U [ l B � _EXCEPTION_RECORD32 .?AU_EXCEPTION_RECORD32@@ " " < �
ExceptionCode
" ExceptionFlags ���
" ExceptionRecord ��
" ExceptionAddress �
" NumberParameters �
�U ExceptionInformation �B �U P _EXCEPTION_RECORD32 .?AU_EXCEPTION_RECORD32@@ �U % X F � _PERFINFO_MARK_EVENT .?AU_PERFINFO_MARK_EVENT@@ ��
�U
� V
" TranId ���
Level
AppId
! OpId �
Text �F �U _PERFINFO_MARK_EVENT .?AU_PERFINFO_MARK_EVENT@@ �� �U � � J � _FILE_END_OF_FILE_INFO .?AU_FILE_END_OF_FILE_INFO@@ ��
} EndOfFile J �U _FILE_END_OF_FILE_INFO .?AU_FILE_END_OF_FILE_INFO@@ �� �U �"
$
�
�F
� : � HGESTUREINFO__ .?AUHGESTUREINFO__@@ ��
�U
�
t unused ���: �U HGESTUREINFO__ .?AUHGESTUREINFO__@@ �� �U �<
p
� " �U �U
�1
�
�
� > � tagMONITORINFOEXW .?AUtagMONITORINFOEXW@@
�U
� f
" cbSize ���
� rcMonitor
� rcWork ���
" $ dwFlags ��
� ( szDevice �> �U h tagMONITORINFOEXW .?AUtagMONITORINFOEXW@@ �U 5
_#
�
�B
� j
Revision �
SubAuthorityCount
\, IdentifierAuthority ��
� SubAuthority �& �U _SID .?AU_SID@@ �� �U V � _ETW_COVERAGE_SAMPLER_SAMPLE .?AU_ETW_COVERAGE_SAMPLER_SAMPLE@@ ��*
" ModuleId �
" Offset ���V �U _ETW_COVERAGE_SAMPLER_SAMPLE .?AU_ETW_COVERAGE_SAMPLER_SAMPLE@@ �� �U � G
F!
� N � _SYSTEM_WORKINGSET_ENTRY .?AU_SYSTEM_WORKINGSET_ENTRY@@ ��
�U
� �
" UniqueProcessId ��
" SessionId
" WorkingSetPageCount ��
" CommitPageCount ��
" PagedPoolPageCount ���
" VirtualSizeInPages ���
" PrivateWorkingSetPageCount ���N �U _SYSTEM_WORKINGSET_ENTRY .?AU_SYSTEM_WORKINGSET_ENTRY@@ �� �U � n � _FILE_PROCESS_IDS_USING_FILE_INFORMATION .?AU_FILE_PROCESS_IDS_USING_FILE_INFORMATION@@ ��>
" NumberOfProcessIdsInList �
C# ProcessIdList n �U _FILE_PROCESS_IDS_USING_FILE_INFORMATION .?AU_FILE_PROCESS_IDS_USING_FILE_INFORMATION@@ �� �U V � _TXFS_CREATE_MINIVERSION_INFO .?AU_TXFS_CREATE_MINIVERSION_INFO@@ j
! StructureVersion �
! StructureLength ��
" BaseVersion ��
! MiniVersion ��V �U _TXFS_CREATE_MINIVERSION_INFO .?AU_TXFS_CREATE_MINIVERSION_INFO@@ V B � _SUPPORTED_OS_INFO .?AU_SUPPORTED_OS_INFO@@ ��
V
� 2
! MajorVersion �
! MinorVersion �B V _SUPPORTED_OS_INFO .?AU_SUPPORTED_OS_INFO@@ �� V L �
" Version ��
" Flags
� ResourceFileName �
! ResourceReasonId �
" StringCount ��
< ReasonStrings
� SimpleString �J V _COUNTED_REASON_CONTEXT .?AU_COUNTED_REASON_CONTEXT@@ V
�6
� "
Base �
" Size �> V _PORT_DATA_ENTRY .?AU_PORT_DATA_ENTRY@@ �� V � U b u t t t V
V
�
2U
�
Y(
�
�
�
z=
� Z � _PERFINFO_SET_POWER_ACTION_RET .?AU_PERFINFO_SET_POWER_ACTION_RET@@ ��*
Trigger ��
Status ���Z V _PERFINFO_SET_POWER_ACTION_RET .?AU_PERFINFO_SET_POWER_ACTION_RET@@ �� V � O N � _DISPATCHER_CONTEXT_ARM64 .?AU_DISPATCHER_CONTEXT_ARM64@@
V
�
�
�
7)
�
R
� .
" ControlPc
" ImageBase
V FunctionEntry
" EstablisherFrame �
" TargetPc �
V ContextRecord
SD LanguageHandler ��
HandlerData ��
V HistoryTable �
" $ ScopeIndex ���
( ControlPcIsUnwound ���
, NonVolatileRegisters �N V 0 _DISPATCHER_CONTEXT_ARM64 .?AU_DISPATCHER_CONTEXT_ARM64@@ V �
�
� V � _EVENT_EXTENDED_ITEM_INSTANCE .?AU_EVENT_EXTENDED_ITEM_INSTANCE@@ N
" InstanceId ���
" ParentInstanceId �
� ParentGuid ���V #V _EVENT_EXTENDED_ITEM_INSTANCE .?AU_EVENT_EXTENDED_ITEM_INSTANCE@@ $V � Z ^ � _SYSTEM_MANUFACTURING_INFORMATION .?AU_SYSTEM_MANUFACTURING_INFORMATION@@ .
" Options ��
� ProfileName ��^ 'V _SYSTEM_MANUFACTURING_INFORMATION .?AU_SYSTEM_MANUFACTURING_INFORMATION@@ (V ~
~
�
�
� F
# Alignment
Next �
! Depth
! CpuId . ,V _SLIST_HEADER .?AT_SLIST_HEADER@@ -V ( �
O
�
/V
�
�$
� Z � _PROCESS_MITIGATION_DEP_POLICY .?AU_PROCESS_MITIGATION_DEP_POLICY@@ ��
2V
�
" ��
" ��
" ��v
" Flags
4V Enable ���
5V DisableAtlThunkEmulation �
6V ReservedFlags
Permanent Z 7V _PROCESS_MITIGATION_DEP_POLICY .?AU_PROCESS_MITIGATION_DEP_POLICY@@ �� 8V C L *
$K MciStats �
# QuadPart �* :V _MCI_STATS .?AT_MCI_STATS@@ �� ;V � k
s5
�
�@
�
�@
�
d
� b � _STREAMS_ASSOCIATE_ID_INPUT_BUFFER .?AU_STREAMS_ASSOCIATE_ID_INPUT_BUFFER@@ ��&
" Flags
" StreamId �b BV _STREAMS_ASSOCIATE_ID_INPUT_BUFFER .?AU_STREAMS_ASSOCIATE_ID_INPUT_BUFFER@@ �� CV � Z � _EVENT_EXTENDED_ITEM_EVENT_KEY .?AU_EVENT_EXTENDED_ITEM_EVENT_KEY@@ ��
# Key ��Z FV _EVENT_EXTENDED_ITEM_EVENT_KEY .?AU_EVENT_EXTENDED_ITEM_EVENT_KEY@@ �� GV � ~
�Q
�
=
� �
�
� � �
T
� R � _PERFINFO_MARK_INFORMATION .?AU_PERFINFO_MARK_INFORMATION@@ ��
� Name �R PV _PERFINFO_MARK_INFORMATION .?AU_PERFINFO_MARK_INFORMATION@@ �� QV � J
n
� F � tagHARDWAREHOOKSTRUCT .?AUtagHARDWAREHOOKSTRUCT@@
TV
� N
y hwnd �
u message ��
u wParam ���
lParam ���F VV tagHARDWAREHOOKSTRUCT .?AUtagHARDWAREHOOKSTRUCT@@ WV � R � _WIM_PROVIDER_EXTERNAL_INFO .?AU_WIM_PROVIDER_EXTERNAL_INFO@@
YV
� V
" Version ��
" Flags
} DataSourceId �
b ResourceHash �R [V ( _WIM_PROVIDER_EXTERNAL_INFO .?AU_WIM_PROVIDER_EXTERNAL_INFO@@ \V " �
hFile
lpBaseOfDll ��
" dwDebugInfoFileOffset
" nDebugInfoSize ���
lpImageName ��
! fUnicode �F ^V _LOAD_DLL_DEBUG_INFO .?AU_LOAD_DLL_DEBUG_INFO@@ �� _V c P f � _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH .?AU_ETW_TP_EVENT_WORKER_NUMANODE_SWITCH@@ ��
aV
� �
� Header ���
PoolId ���
" $ CurrentNode ��
" ( NextNode �
! , CurrentGroup �
! . NextGroup
" 0 CurrentWorkerCount ���
" 4 NextWorkerCount ��f cV 8 _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH .?AU_ETW_TP_EVENT_WORKER_NUMANODE_SWITCH@@ �� dV �
05
� �
" Size �
�? CallerType ���
" ProcessImageNameOffset ���
" ProcessId
" ServiceTag ���
" DeviceDescriptionOffset ��
" DevicePathOffset �
" ReasonOffset �B gV _DIAGNOSTIC_BUFFER .?AU_DIAGNOSTIC_BUFFER@@ �� hV � B � _TOKEN_LINKED_TOKEN .?AU_TOKEN_LINKED_TOKEN@@
LinkedToken ��B kV _TOKEN_LINKED_TOKEN .?AU_TOKEN_LINKED_TOKEN@@ lV �
F
�
�=
�
U'
� " " p t qV
rV
� " 7 YT t tV
uV
�
{S
�
{R
�
�
� zV V � _PS_BNO_ISOLATION_PARAMETERS .?AU_PS_BNO_ISOLATION_PARAMETERS@@ ��
|V
� f
� IsolationPrefix ��
" HandleCount ��
� Handles ��
IsolationEnabled �V ~V _PS_BNO_ISOLATION_PARAMETERS .?AU_PS_BNO_ISOLATION_PARAMETERS@@ �� V a �
�!
�
�
� " t �V
�V
�
�-
� �
�V
�
�3
�
# ��
# 0 ��
# 9��F
�V DontUse ��
�V PageDirectoryBase
�V Reserved �F �V _PAGEDIR_INFORMATION .?AU_PAGEDIR_INFORMATION@@ �� �V
�
�
�
�
� �V " � �V �V
�V
�
|,
�
" ��
�V
� ! / f � _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE@@ � " �6
" SubscriptionCount
�V Subscriptions f �V _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE@@ �V � � f � _SYSTEM_PROCESS_INFORMATION_EXTENSION .?AU_SYSTEM_PROCESS_INFORMATION_EXTENSION@@
" ��
" ��
" ��
" ��
x DiskCounters �
# ( ContextSwitches ��
" 0 Flags
�V 0 HasStrongId ��
�V 0 Classification ���
�V 0 BackgroundActivityModerated ��
�V 0 Spare
" 4 UserSidOffset
" 8 PackageFullNameOffset
�' @ EnergyValues �
" PAppIdOffset ��
" TSharedCommitCharge ���
" XJobObjectId ��
" \SpareUlong ���
# `ProcessSequenceNumber f �V h_SYSTEM_PROCESS_INFORMATION_EXTENSION .?AU_SYSTEM_PROCESS_INFORMATION_EXTENSION@@ �V * Z � _PERFINFO_SAMPLED_PROFILE_CACHE .?AU_PERFINFO_SAMPLED_PROFILE_CACHE@@ �) " � �*
" Entries ��
�V Sample ���Z �V � _PERFINFO_SAMPLED_PROFILE_CACHE .?AU_PERFINFO_SAMPLED_PROFILE_CACHE@@ �V � � V � _ETW_CRITSEC_EVENT_COLLISION .?AU_ETW_CRITSEC_EVENT_COLLISION@@ ��j
� Header ���
" LockCount
" $ SpinCount
( OwningThread �
, Address ��V �V 0 _ETW_CRITSEC_EVENT_COLLISION .?AU_ETW_CRITSEC_EVENT_COLLISION@@ �� �V � �
!
� d ` �V
�.
�
, �V N � _SERVICE_FAILURE_ACTIONSW .?AU_SERVICE_FAILURE_ACTIONSW@@
�V
� r
" dwResetPeriod
q lpRebootMsg ��
q lpCommand
" cActions �
� lpsaActions ��N �V _SERVICE_FAILURE_ACTIONSW .?AU_SERVICE_FAILURE_ACTIONSW@@ �V 3 $ b � _RTL_DYNAMIC_TIME_ZONE_INFORMATION .?AU_RTL_DYNAMIC_TIME_ZONE_INFORMATION@@ ��
�V
� V
sT tzi ��
*$ � TimeZoneKeyName ��
�DynamicDaylightTimeDisabled ��b �V �_RTL_DYNAMIC_TIME_ZONE_INFORMATION .?AU_RTL_DYNAMIC_TIME_ZONE_INFORMATION@@ �� �V � �
�;
� b � _RTL_IMAGE_MITIGATION_SEHOP_POLICY .?AU_RTL_IMAGE_MITIGATION_SEHOP_POLICY@@ ��
N Sehop b �V _RTL_IMAGE_MITIGATION_SEHOP_POLICY .?AU_RTL_IMAGE_MITIGATION_SEHOP_POLICY@@ �� �V �
�. ��
�V
�
�V
� 6
! MethodCount ��
�V MethodProperties �^ �V _MIDL_INTERFACE_METHOD_PROPERTIES .?AU_MIDL_INTERFACE_METHOD_PROPERTIES@@ �V � g Z � _EXTENT_READ_CACHE_INFO_BUFFER .?AU_EXTENT_READ_CACHE_INFO_BUFFER@@ ��R
} AllocatedCache ���
} PopulatedCache ���
} InErrorCache �Z �V _EXTENT_READ_CACHE_INFO_BUFFER .?AU_EXTENT_READ_CACHE_INFO_BUFFER@@ �� �V �) �V
�;
� , 2 �V F � _PERFINFO_DEBUG_EVENT .?AU_PERFINFO_DEBUG_EVENT@@ >
" ProcessId
" ThreadId �
@ Reason ���F �V _PERFINFO_DEBUG_EVENT .?AU_PERFINFO_DEBUG_EVENT@@ �V �
c=
�
�1
� �1 " �2
" NumberOfErrata ���
�V Errata ���> �V ( XSAVE_CPU_ERRATA .?AUXSAVE_CPU_ERRATA@@ �� �V � � : � _SL_KMEM_CACHE .?AU_SL_KMEM_CACHE@@ ��
�V
� rG " �
" TotalSize
" SizeOfData ���
" SignatureSize
" Flags
" Version ��
�V Descriptors ��: �V ( _SL_KMEM_CACHE .?AU_SL_KMEM_CACHE@@ �� �V u
O/
�
E@
�
�S ��
�V
�
�D
� /"
s
� J � _POWER_SESSION_CONNECT .?AU_POWER_SESSION_CONNECT@@ ��
�V
� *
Connected
Console ��J �V _POWER_SESSION_CONNECT .?AU_POWER_SESSION_CONNECT@@ �� �V � r � _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER .?AU_RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER@@ n
! Version ��
! PointerSize ��
" Heap �
" TotalCommit ��
" TotalReserve �r �V _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER .?AU_RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER@@ �V L q ^ � _SYSTEM_LEGACY_DRIVER_INFORMATION .?AU_SYSTEM_LEGACY_DRIVER_INFORMATION@@
�V
� *
" VetoType �
� VetoList �^ �V _SYSTEM_LEGACY_DRIVER_INFORMATION .?AU_SYSTEM_LEGACY_DRIVER_INFORMATION@@ �V �
(@
�
�,
� ^ � _PROCESS_DEVICEMAP_INFORMATION_EX .?AU_PROCESS_DEVICEMAP_INFORMATION_EX@@ 2
�O Set ��
�O Query
" $ Flags ^ �V ( _PROCESS_DEVICEMAP_INFORMATION_EX .?AU_PROCESS_DEVICEMAP_INFORMATION_EX@@ �V C #
�
� F � _EVENT_TRACE_LOGFILEW .?AU_EVENT_TRACE_LOGFILEW@@
W
�
W " W
W
�
�- ��
W
�
�V
�
�.
�
F
� b � _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER .?AU_FILE_QUERY_ON_DISK_VOL_INFO_BUFFER@@ q " D �B
} DirectoryCount ���
} FileCount
! FsFormatMajVersion ���
! FsFormatMinVersion ���
FsFormatName �
} 0 FormatTime ���
} 8 LastUpdateTime ���
W @ CopyrightInfo
W � AbstractInfo �
W � FormattingImplementationInfo �
W LastModifyingImplementationInfo ��b W P_FILE_QUERY_ON_DISK_VOL_INFO_BUFFER .?AU_FILE_QUERY_ON_DISK_VOL_INFO_BUFFER@@
W >
8
�
�5
�
@1
� J � tagLAYERPLANEDESCRIPTOR .?AUtagLAYERPLANEDESCRIPTOR@@ .
! nSize
! nVersion �
" dwFlags ��
iPixelType ���
cColorBits ���
cRedBits �
cRedShift
cGreenBits ���
cGreenShift ��
cBlueBits
cBlueShift ���
cAlphaBits ���
cAlphaShift ��
cAccumBits ���
cAccumRedBits
cAccumGreenBits ��
cAccumBlueBits ���
cAccumAlphaBits ��
cDepthBits ���
cStencilBits �
cAuxBuffers ��
iLayerPlane ��
bReserved
" crTransparent J W tagLAYERPLANEDESCRIPTOR .?AUtagLAYERPLANEDESCRIPTOR@@ W j VR
K1 ��
W
� b �R W t t W
W
� : � IRpcStubBuffer .?AUIRpcStubBuffer@@ ��6 � _IMAGE_SYMBOL .?AU_IMAGE_SYMBOL@@ ~
�Q N
" Value
SectionNumber
! Type �
StorageClass �
NumberOfAuxSymbols ���6 W _IMAGE_SYMBOL .?AU_IMAGE_SYMBOL@@ W [ e
� ��
!W
�
� ��
#W
� "W $W " t %W
&W
�
%B
� V
Buffer ���
StaticBuffer �
" Size �
" StaticSize ���2 )W _RTL_BUFFER .?AU_RTL_BUFFER@@ *W (B r
�&
�
�
� N � _FILE_STORAGE_TIER_REGION .?AU_FILE_STORAGE_TIER_REGION@@
.W
� >
� TierId ���
# Offset ���
# Length ���N 0W _FILE_STORAGE_TIER_REGION .?AU_FILE_STORAGE_TIER_REGION@@ 1W X # 3W
5W
�6
�
�/
�
�=
� V � _SECTION_IMAGE_INFORMATION64 .?AU_SECTION_IMAGE_INFORMATION64@@ ��
��
��
��n
# TransferAddress ��
" ZeroBits �
# MaximumStackSize �
# CommittedStackSize ���
" SubSystemType
! $ SubSystemMinorVersion
! & SubSystemMajorVersion
" $ SubSystemVersion �
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
" ( OperatingSystemVersion ���
! , ImageCharacteristics �
! . DllCharacteristics ���
! 0 Machine ��
2 ImageContainsCode
3 ImageFlags ���
;W 3 ComPlus ��
<W 3 ImageDynamicallyRelocated
=W 3 Reserved �
" 4 LoaderFlags ��
" 8 ImageFileSize
" < CheckSum �V >W @ _SECTION_IMAGE_INFORMATION64 .?AU_SECTION_IMAGE_INFORMATION64@@ �� ?W �
U(
�
E
� : � _TOKEN_CONTROL .?AU_TOKEN_CONTROL@@ ��
CW
� b
I TokenId ��
I AuthenticationId �
I ModifiedId ���
L6 TokenSource ��: EW ( _TOKEN_CONTROL .?AU_TOKEN_CONTROL@@ �� FW R � _SYSTEM_POWER_LOGGING_ENTRY .?AU_SYSTEM_POWER_LOGGING_ENTRY@@ *
" Reason ���
" States ���R IW _SYSTEM_POWER_LOGGING_ENTRY .?AU_SYSTEM_POWER_LOGGING_ENTRY@@ JW y
J9
�
�7
�
�T
�
X)
�
:C
�
�
�
�
� R< b RW t SW
TW
� B � tagUSAGE_PROPERTIES .?AUtagUSAGE_PROPERTIES@@ �
! level
! page �
! usage
t logicalMinimum ���
t logicalMaximum ���
! unit �
! exponent �
count
t physicalMinimum ��
t physicalMaximum ��B
WW tagUSAGE_PROPERTIES .?AUtagUSAGE_PROPERTIES@@ XW ;
�&
�
-<
�
�"
�
�
�
�!
�
w.
� j � _CLAIM_SECURITY_ATTRIBUTES_INFORMATION .?AU_CLAIM_SECURITY_ATTRIBUTES_INFORMATION@@ ��Z
! Version ��
! Reserved �
" AttributeCount ���
�P Attribute j aW _CLAIM_SECURITY_ATTRIBUTES_INFORMATION .?AU_CLAIM_SECURITY_ATTRIBUTES_INFORMATION@@ �� bW
C
�
�
�
F;
�
{"
�
&V
�
O/
� Z � _IMAGE_BOUND_IMPORT_DESCRIPTOR .?AU_IMAGE_BOUND_IMPORT_DESCRIPTOR@@ ��
jW
� ^
" TimeDateStamp
! OffsetModuleName �
! NumberOfModuleForwarderRefs ��Z lW _IMAGE_BOUND_IMPORT_DESCRIPTOR .?AU_IMAGE_BOUND_IMPORT_DESCRIPTOR@@ �� mW [ � V � _ENCLAVE_LOAD_DATA_VBS_BASIC .?AU_ENCLAVE_LOAD_DATA_VBS_BASIC@@ ��
oW
�
" PageType �V qW _ENCLAVE_LOAD_DATA_VBS_BASIC .?AU_ENCLAVE_LOAD_DATA_VBS_BASIC@@ �� rW ? �
�4
� .
# ImageBase
V FunctionEntry R uW _UNWIND_HISTORY_TABLE_ENTRY .?AU_UNWIND_HISTORY_TABLE_ENTRY@@ vW � Z � _FILE_PROVIDER_EXTERNAL_INFO_V0 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V0@@
xW
� *
" Version ��
" Algorithm Z zW _FILE_PROVIDER_EXTERNAL_INFO_V0 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V0@@ {W x" ^ � _FILE_DISPOSITION_INFORMATION_EX .?AU_FILE_DISPOSITION_INFORMATION_EX@@ ��
}W
�
" Flags ^ W _FILE_DISPOSITION_INFORMATION_EX .?AU_FILE_DISPOSITION_INFORMATION_EX@@ �� �W �
�V
� J � _FILE_QUOTA_INFORMATION .?AU_FILE_QUOTA_INFORMATION@@ �
" NextEntryOffset ��
" SidLength
} ChangeTime ���
} QuotaUsed
} QuotaThreshold ���
} QuotaLimit ���
� ( Sid ��J �W 8 _FILE_QUOTA_INFORMATION .?AU_FILE_QUOTA_INFORMATION@@ �W � N � _PERFINFO_CC_FLUSH_CACHE .?AU_PERFINFO_CC_FLUSH_CACHE@@ ��
" WorkItemKey ��
" FileObjectKey
# Offset ���
" Length ���
" SharedCacheMapFlags ��
" Flags
" Reserved �N �W _PERFINFO_CC_FLUSH_CACHE .?AU_PERFINFO_CC_FLUSH_CACHE@@ �� �W � �
u$
� } �C
j*
�
T=
�
0
� � JOB_OBJECT_NET_RATE_CONTROL_ENABLE ��� JOB_OBJECT_NET_RATE_CONTROL_MAX_BANDWIDTH JOB_OBJECT_NET_RATE_CONTROL_DSCP_TAG � JOB_OBJECT_NET_RATE_CONTROL_VALID_FLAGS ��Z t �W JOB_OBJECT_NET_RATE_CONTROL_FLAGS .?AW4JOB_OBJECT_NET_RATE_CONTROL_FLAGS@@ � �W C )
� .
" VirtualAddress ���
" Size �F �W _IMAGE_DATA_DIRECTORY .?AU_IMAGE_DATA_DIRECTORY@@ �W [
�
R
� B � _WOF_EXTERNAL_INFO .?AU_WOF_EXTERNAL_INFO@@ ��*
" Version ��
" Provider �B �W _WOF_EXTERNAL_INFO .?AU_WOF_EXTERNAL_INFO@@ �� �W �!
�:
�
$
�
F
� g � i �W
&;
� q " t �W
�W
� f � _SYSTEM_BASIC_PERFORMANCE_INFORMATION .?AU_SYSTEM_BASIC_PERFORMANCE_INFORMATION@@
�W
� n
" AvailablePages ���
" CommittedPages ���
" CommitLimit ��
" PeakCommitment ���f �W _SYSTEM_BASIC_PERFORMANCE_INFORMATION .?AU_SYSTEM_BASIC_PERFORMANCE_INFORMATION@@ �W �
�*
�
L.
�
�5
�
G
�
�
�
UU
�
�=
� � " " �W
�W
�
I?
�
�(
�
�
� Z � DISPLAYCONFIG_TARGET_BASE_TYPE .?AUDISPLAYCONFIG_TARGET_BASE_TYPE@@ ��6
y header ���
_$ baseOutputTechnology �Z �W DISPLAYCONFIG_TARGET_BASE_TYPE .?AUDISPLAYCONFIG_TARGET_BASE_TYPE@@ �� �W ( �
�W
�
�
�
�:
� 4M
U@ ��
�W
�
5
�
6
� V � _TRACE_ENABLE_FLAG_EXT_HEADER .?AU_TRACE_ENABLE_FLAG_EXT_HEADER@@ &
! Length ���
! Items V �W _TRACE_ENABLE_FLAG_EXT_HEADER .?AU_TRACE_ENABLE_FLAG_EXT_HEADER@@ �W �
�*
�
�A
� Z � WIN32_MEMORY_REGION_INFORMATION .?AUWIN32_MEMORY_REGION_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��&
AllocationBase ���
" AllocationProtect
" Flags
�W Private ��
�W MappedDataFile ���
�W MappedImage ��
�W MappedPageFile ���
�W MappedPhysical ���
�W DirectMapped �
�W Reserved �
" RegionSize ���
" CommitSize ���Z �W WIN32_MEMORY_REGION_INFORMATION .?AUWIN32_MEMORY_REGION_INFORMATION@@ �W �
�(
�
�,
�
�
� B � tagAUDIODESCRIPTION .?AUtagAUDIODESCRIPTION@@ >
u cbSize ���
t Enabled ��
" Locale ���B �W tagAUDIODESCRIPTION .?AUtagAUDIODESCRIPTION@@ �W q4 J � _MESSAGE_RESOURCE_DATA .?AU_MESSAGE_RESOURCE_DATA@@ �� h " �2
" NumberOfBlocks ���
�W Blocks ���J �W _MESSAGE_RESOURCE_DATA .?AU_MESSAGE_RESOURCE_DATA@@ �� �W ( �
HW
�
M?
�
�
� R � _FILE_ZERO_DATA_INFORMATION .?AU_FILE_ZERO_DATA_INFORMATION@@ 6
} FileOffset ���
} BeyondFinalZero ��R �W _FILE_ZERO_DATA_INFORMATION .?AU_FILE_ZERO_DATA_INFORMATION@@ �W �
�
�
�
�
HS
�
�A
�
44
�
�@
�
�
�
u6
�
GG
�
�A
�
�>
�
�V
�
�
� ��
�W
�
?B
�
�7
�
�&
�
W
� �
q LogFileName ��
q LoggerName ���
CurrentTime ��
" BuffersRead ��
" LogFileMode ��
" ProcessTraceMode �
o< CurrentEvent �
m9 p LogfileHeader
�W �BufferCallback ���
" �BufferSize ���
" �Filled ���
" �EventsLost ���
t< �EventCallback
x< �EventRecordCallback ��
" �IsKernelTrace
�Context ��F �W �_EVENT_TRACE_LOGFILEW .?AU_EVENT_TRACE_LOGFILEW@@ �W � k
>U
�
+;
�
�&
�
�
� � � _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION@@ ��
X
�
C3
�
nD
� 2
X Attributes ���
X Operations ��� X _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION@@ �� X ] 6 J � _VCN_RANGE_INPUT_BUFFER .?AU_VCN_RANGE_INPUT_BUFFER@@
X
� 2
} StartingVcn ��
} ClusterCount �J X _VCN_RANGE_INPUT_BUFFER .?AU_VCN_RANGE_INPUT_BUFFER@@
X �) V=
� V � _SYSTEM_LOOKASIDE_INFORMATION .?AU_SYSTEM_LOOKASIDE_INFORMATION@@
X
� �
! CurrentDepth �
! MaximumDepth �
" TotalAllocates ���
" AllocateMisses ���
" TotalFrees ���
" FreeMisses ���
" Type �
" Tag ��
" Size �V X _SYSTEM_LOOKASIDE_INFORMATION .?AU_SYSTEM_LOOKASIDE_INFORMATION@@ X �
�T
�
�
�
�"
�
�+
�
G&
�
�8
� N
# StartingFileReferenceNumber ��
# EndingFileReferenceNumber F X _FILE_REFERENCE_RANGE .?AU_FILE_REFERENCE_RANGE@@ X �
t unused ���2 X HINSTANCE__ .?AUHINSTANCE__@@ X ' �
�=
� � #X 2 � value_entW .?AUvalue_entW@@ ��
%X
� ^
q ve_valuename �
" ve_valuelen ��
" ve_valueptr ��
" ve_type ��2 'X value_entW .?AUvalue_entW@@ �� (X H �
�
� N � _PERFINFO_VAD_ROTATE_INFO .?AU_PERFINFO_VAD_ROTATE_INFO@@
+X
�
" ��
" ��f
BaseAddress ��
" SizeInBytes ��
-X Direction
.X Spare
" Flags N /X _PERFINFO_VAD_ROTATE_INFO .?AU_PERFINFO_VAD_ROTATE_INFO@@ 0X � e
M.
�
�+
�
W-
�
�S
�
�)
�
�-
�
4
�
�#
�
40
�
�
� N � _OPERATION_END_PARAMETERS .?AU_OPERATION_END_PARAMETERS@@
<X
� >
" Version ��
" OperationId ��
" Flags N >X _OPERATION_END_PARAMETERS .?AU_OPERATION_END_PARAMETERS@@ ?X � AX
�;
�
�@
�
�S
�
�C
�
�F
�
�6
� q " ��
u TotalSize
! NumLanguages �
! MaxNumLanguages ��
bUseUseMachineConfigList �
�F RegInfo ��
HX Languages
# ullMask ��
u uConsoleFlag �
IX $ Checksum �6 JX 8 _MUILANGLIST .?AU_MUILANGLIST@@ �� KX � h
�0
�
�F
�
�?
�
=
�
+
�
�>
�
11
�
# ��
# ��
# ��
# ��
# 0 ��
# 9��
# <��
TX UseDescription ���
UX ListDescription ��
VX Cold �
WX Pinned ���
XX DontUse ��
YX Priority �
ZX Reserved �N [X _MEMORY_FRAME_INFORMATION .?AU_MEMORY_FRAME_INFORMATION@@ \X
* ��
^X
�
�.
�
3F
�
�=
�
�"
�
#U
�
;
� � " fX
6
�
�
� ^ � _ETW_ANTI_STARVATION_BOOST_EVENT .?AU_ETW_ANTI_STARVATION_BOOST_EVENT@@ ��^
" ThreadId �
! ProcessorIndex ���
p OldPriority ��
SpareByte ^ kX _ETW_ANTI_STARVATION_BOOST_EVENT .?AU_ETW_ANTI_STARVATION_BOOST_EVENT@@ �� lX � �
+
�
�%
�
M
�
M
�
�8
�
�+
�
KU
�
2
� V � _ENLISTMENT_BASIC_INFORMATION .?AU_ENLISTMENT_BASIC_INFORMATION@@
vX
� N
� EnlistmentId �
� TransactionId
� ResourceManagerId V xX 0 _ENLISTMENT_BASIC_INFORMATION .?AU_ENLISTMENT_BASIC_INFORMATION@@ yX � U J � _CSV_IS_OWNED_BY_CSVFS .?AU_CSV_IS_OWNED_BY_CSVFS@@ ��
OwnedByCSVFS �J |X _CSV_IS_OWNED_BY_CSVFS .?AU_CSV_IS_OWNED_BY_CSVFS@@ �� }X / J
" UniqueProcessId ��
" SessionId
" WorkingSetPageCount ��
" CommitPageCount ��
" PagedPoolPageCount ���
" VirtualSizeInPages ���
" PrivateWorkingSetPageCount ���
" StoreSizeInPages �
" StoredPageCount ��
" CommitDebtInPages
" SharedCommitInPages ��R X $ _PERFINFO_WORKINGSET_ENTRY .?AU_PERFINFO_WORKINGSET_ENTRY@@ �� �X � � & � ! ! # �X
-G
�
H
�
N8
� v � _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX@@ ���
} IdleTime �
} KernelTime ���
} UserTime �
} DpcTime ��
} InterruptTime
" ( InterruptCount ���
" , Spare0 ���
} 0 AvailableTime
} 8 Spare1 ���
} @ Spare2 ���v
�X H _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX@@ �� �X �
"%
�
�6
�
�)
�
�-
�
G6
�
,
�
:<
� ^ � DISPLAYCONFIG_TARGET_DEVICE_NAME .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME@@ ���
y header ���
26 flags
_$ outputTechnology �
! edidManufactureId
! edidProductCodeId
u connectorInstance
� $ monitorFriendlyDeviceName
*$ � monitorDevicePath ^ �X �DISPLAYCONFIG_TARGET_DEVICE_NAME .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME@@ �� �X " " �X
�X
�
�E
� " # �X
�9 ��
�X
�
�-
�
} CurrentByteOffset R �X _FILE_POSITION_INFORMATION .?AU_FILE_POSITION_INFORMATION@@ �� �X �
�" ��
�X
�
+
�
A!
�
}2
�
�
�
:
�
>(
�
M(
�
1:
�
�$
�
�R
�
�
� �
�<
�
65
�
]>
�
w
�
'0
�
6= ��
�X
�
+
�
�
�%
�
��
�X
�
E
�
B>
�
�>
�
�=
� F
�X ImportCallbackRoutine
ImportCallbackParameter ��N �X _LDR_IMPORT_CALLBACK_INFO .?AU_LDR_IMPORT_CALLBACK_INFO@@ �X u �
�
� F � _ALPC_DATA_VIEW_ATTR .?AU_ALPC_DATA_VIEW_ATTR@@ ��R
" Flags
SectionHandle
ViewBase �
" ViewSize �F �X _ALPC_DATA_VIEW_ATTR .?AU_ALPC_DATA_VIEW_ATTR@@ �� �X � �
�
�
L=
� 3
�X
�
�'
�
0
�
?
�
`
�
4$
�
�2
�
]6
�
eS ��
�X
�
�6
�
�E
� �X
�X
�
�D
�
�D
� Z � _PERFINFO_CC_WORKITEM_COMPLETE .?AU_PERFINFO_CC_WORKITEM_COMPLETE@@ ��
" WorkItemKey ��Z �X _PERFINFO_CC_WORKITEM_COMPLETE .?AU_PERFINFO_CC_WORKITEM_COMPLETE@@ �� �X � �
�
�
�
�
:W
�
M
�
�'
�
W
�
�.
�
�7
�
12
�
UA
� . � HACCEL__ .?AUHACCEL__@@ ��
�X
�
t unused ���. �X HACCEL__ .?AUHACCEL__@@ �� �X F .
�V " � �V " " " S4 <
�X
�X
� N
! Magic
MajorLinkerVersion ���
MinorLinkerVersion ���
" SizeOfCode ���
" SizeOfInitializedData
" SizeOfUninitializedData ��
" AddressOfEntryPoint ��
" BaseOfCode ���
# ImageBase
" SectionAlignment �
" $ FileAlignment
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
! , MajorImageVersion
! . MinorImageVersion
! 0 MajorSubsystemVersion
! 2 MinorSubsystemVersion
" 4 Win32VersionValue
" 8 SizeOfImage ��
" < SizeOfHeaders
" @ CheckSum �
! D Subsystem
! F DllCharacteristics ���
# H SizeOfStackReserve ���
# P SizeOfStackCommit
# X SizeOfHeapReserve
# ` SizeOfHeapCommit �
" h LoaderFlags ��
" l NumberOfRvaAndSizes ��
�0 p DataDirectory N �X � _IMAGE_OPTIONAL_HEADER64 .?AU_IMAGE_OPTIONAL_HEADER64@@ �� �X [ G
nD
� N � _RPC_SEC_CONTEXT_KEY_INFO .?AU_RPC_SEC_CONTEXT_KEY_INFO@@ R
" EncryptAlgorithm �
" KeySize ��
" SignatureAlgorithm ���N �X _RPC_SEC_CONTEXT_KEY_INFO .?AU_RPC_SEC_CONTEXT_KEY_INFO@@ �X � � � _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ ��&
N DisableExtensionPoints ��� �X _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ �� �X � Z b � _PERFINFO_CONTIGUOUS_PAGE_GENERATE .?AU_PERFINFO_CONTIGUOUS_PAGE_GENERATE@@ ��.
# ThreadId �
# NumberOfBytes b �X _PERFINFO_CONTIGUOUS_PAGE_GENERATE .?AU_PERFINFO_CONTIGUOUS_PAGE_GENERATE@@ �� Y �
�
� J � _ETW_CANCEL_TIMER_EVENT .?AU_ETW_CANCEL_TIMER_EVENT@@
" TimerAddress �J Y _ETW_CANCEL_TIMER_EVENT .?AU_ETW_CANCEL_TIMER_EVENT@@ Y � �
5"
� g � Y
�E
�
$8
�
V3
�
�W
�
�A
�
�>
� J � _RPC_SECURITY_QOS_V2_A .?AU_RPC_SECURITY_QOS_V2_A@@ ��
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
I u J Y _RPC_SECURITY_QOS_V2_A .?AU_RPC_SECURITY_QOS_V2_A@@ �� Y �
jV
� Z � _WIM_PROVIDER_CONTROL_INTEGRITY .?AU_WIM_PROVIDER_CONTROL_INTEGRITY@@
" ControlCode ��Z Y _WIM_PROVIDER_CONTROL_INTEGRITY .?AU_WIM_PROVIDER_CONTROL_INTEGRITY@@ Y L"
�
K1
�
7/
� -
^4
� J � _ATOM_TABLE_INFORMATION .?AU_ATOM_TABLE_INFORMATION@@ ! " �*
" NumberOfAtoms
Y Atoms J Y _ATOM_TABLE_INFORMATION .?AU_ATOM_TABLE_INFORMATION@@ !Y
# #Y V � _FILE_STANDARD_INFORMATION_EX .?AU_FILE_STANDARD_INFORMATION_EX@@
%Y
� �
} AllocationSize ���
} EndOfFile
" NumberOfLinks
DeletePending
Directory
AlternateStream ��
MetadataAttribute V 'Y _FILE_STANDARD_INFORMATION_EX .?AU_FILE_STANDARD_INFORMATION_EX@@ (Y �
)!
�
]
�
�$
� f � _SYSTEM_VERIFIER_COUNTERS_INFORMATION .?AU_SYSTEM_VERIFIER_COUNTERS_INFORMATION@@ �
4& Legacy ���
" x RaiseIrqls ���
" | AcquireSpinLocks �
" � SynchronizeExecutions
" � AllocationsWithNoTag �
" � AllocationsFailed
" � AllocationsFailedDeliberately
" � LockedBytes ��
" � PeakLockedBytes ��
" � MappedLockedBytes
" � PeakMappedLockedBytes
" � MappedIoSpaceBytes ���
" � PeakMappedIoSpaceBytes ���
" � PagesForMdlBytes �
" � PeakPagesForMdlBytes �
" � ContiguousMemoryBytes
" � PeakContiguousMemoryBytes
" � ExecutePoolTypes �
" � ExecutePageProtections ���
" � ExecutePageMappings ��
" � ExecuteWriteSections �
" � SectionAlignmentFailures �
" � IATInExecutableSection ���f .Y � _SYSTEM_VERIFIER_COUNTERS_INFORMATION .?AU_SYSTEM_VERIFIER_COUNTERS_INFORMATION@@ /Y y
C5
�
;
�
�
�
D
�
Y6
�
u
�
�I
�
�F
�
�D
�
%!
�
�=
� B � APP_LOCAL_DEVICE_ID .?AUAPP_LOCAL_DEVICE_ID@@
c value B =Y APP_LOCAL_DEVICE_ID .?AUAPP_LOCAL_DEVICE_ID@@ >Y �
eS
�
2
�
�"
�
�X
�
=$
�
�
� & � _DL_EUI48 .?AT_DL_EUI48@@
FY
�
qU
�
3S
� B � _SYSDBG_TRIAGE_DUMP .?AU_SYSDBG_TRIAGE_DUMP@@
JY
� �
" Flags
" BugCheckCode �
" BugCheckParam1 ���
" BugCheckParam2 ���
" BugCheckParam3 ���
" BugCheckParam4 ���
" ProcessHandles ���
" ThreadHandles
� Handles ��B LY $ _SYSDBG_TRIAGE_DUMP .?AU_SYSDBG_TRIAGE_DUMP@@ MY *
�3
� �
PY
�
T0
�
�1
�
$=
�
�.
� Z � _FSCTL_QUERY_REGION_INFO_OUTPUT .?AU_FSCTL_QUERY_REGION_INFO_OUTPUT@@
VY
� .W " �
" Version ��
" Size �
" Flags
" Reserved �
# Alignment
" TotalNumberOfRegions �
" NumberOfRegionsReturned ��
XY Regions ��Z YY @ _FSCTL_QUERY_REGION_INFO_OUTPUT .?AU_FSCTL_QUERY_REGION_INFO_OUTPUT@@ ZY 7B
�
�
�4
� / j � _SYSTEM_FIRMWARE_PARTITION_INFORMATION .?AU_SYSTEM_FIRMWARE_PARTITION_INFORMATION@@ ��
� FirmwarePartition j aY _SYSTEM_FIRMWARE_PARTITION_INFORMATION .?AU_SYSTEM_FIRMWARE_PARTITION_INFORMATION@@ �� bY e
* � HRGN__ .?AUHRGN__@@ ��
dY
�
t unused ���* fY HRGN__ .?AUHRGN__@@ �� gY ' �
�A
�
�R
�
�
�
�S
� t t mY
nY
�
�M
� " " " " " � " qY
p=
�
^(
�
�
�
Q=
�
?
�
xY
'
�
� Data �2 {Y _HV_DETAILS .?AU_HV_DETAILS@@ |Y 9
�@
� " ~Y " y " " Y
�Y
� Z � _MEMORY_COMBINE_INFORMATION_EX2 .?AU_MEMORY_COMBINE_INFORMATION_EX2@@
�Y
� V
Handle ���
" PagesCombined
" Flags
ProcessHandle Z �Y _MEMORY_COMBINE_INFORMATION_EX2 .?AU_MEMORY_COMBINE_INFORMATION_EX2@@ �Y �
Active ���V �Y _ETW_COVERAGE_SAMPLER_STATUS .?AU_ETW_COVERAGE_SAMPLER_STATUS@@ �� �Y � �
�;
�
�<
�
q
� 6 = q q q q " �Y �Y �Y
�Y
�
I
�
� v
I ptlReference �
" nChars ���
" offString
" fOptions �
� rcl ��
" $ offDx 2 �Y ( tagEMRTEXT .?AUtagEMRTEXT@@ �� �Y G Z � _FILE_FS_ATTRIBUTE_INFORMATION .?AU_FILE_FS_ATTRIBUTE_INFORMATION@@ ��
" FileSystemAttributes �
MaximumComponentNameLength ���
" FileSystemNameLength �
FileSystemName ���Z �Y _FILE_FS_ATTRIBUTE_INFORMATION .?AU_FILE_FS_ATTRIBUTE_INFORMATION@@ �� �Y �
�
�
R,
�
� ��
�Y
�
`W
� " " �Y
�Y
�
�$
�
�8
�
�9
� N � _FILESYSTEM_STATISTICS_EX .?AU_FILESYSTEM_STATISTICS_EX@@ �
! FileSystemType ���
! Version ��
" SizeOfCompleteStructure ��
# UserFileReads
# UserFileReadBytes
# UserDiskReads
# UserFileWrites ���
# ( UserFileWriteBytes ���
# 0 UserDiskWrites ���
# 8 MetaDataReads
# @ MetaDataReadBytes
# H MetaDataDiskReads
# P MetaDataWrites ���
# X MetaDataWriteBytes ���
# ` MetaDataDiskWrites ���N �Y h _FILESYSTEM_STATISTICS_EX .?AU_FILESYSTEM_STATISTICS_EX@@ �Y �
�7
�
:
�
Q? ��
�Y
�
�
�
�*
�
�W
�
�,
�
�F
�
v-
�
Q5
� �,
�Y
�
=
�
�<
�
p
�
�Y
�
�0
�
�Y
�
�
�
�B
� > � _LDR_FAILURE_DATA .?AU_LDR_FAILURE_DATA@@ F
Status ���
� ImageName
� D AdditionalInfo ���> �Y � _LDR_FAILURE_DATA .?AU_LDR_FAILURE_DATA@@ �Y u �
� ��
�Y
�
�C
� " �Y
�Y
�
l:
�
�<
�
R
�
�X
�
�/
�
J0
�
�0
�
�
�
�3
�
l
�
�9
�
�4
�
#M
�
p'
�
=+
�
�
V
� * � HPEN__ .?AUHPEN__@@ ��
�Y
�
t unused ���* �Y HPEN__ .?AUHPEN__@@ �� �Y ^
�1
�
:B
�
�.
�
�)
� t �$
�Y
�
�&
�
70
� : � _FILE_NAME_INFO .?AU_FILE_NAME_INFO@@
�Y
� 2
" FileNameLength ���
FileName �: �Y _FILE_NAME_INFO .?AU_FILE_NAME_INFO@@ �Y �" > � _PACKEDEVENTINFO .?AU_PACKEDEVENTINFO@@ �� " " �J
" ulSize ���
" ulNumEventsForLogFile
�Y ulOffsets > �Y _PACKEDEVENTINFO .?AU_PACKEDEVENTINFO@@ �� �Y !& |
f4
�
�$
�
u?
�
�-
�
�'
� �
q User �
" UserLength ���
q Domain ���
" DomainLength �
q Password �
" PasswordLength ���
" Flags R �Y _SEC_WINNT_AUTH_IDENTITY_W .?AU_SEC_WINNT_AUTH_IDENTITY_W@@ �� �Y � { Z � _RTL_USER_PROCESS_INFORMATION64 .?AU_RTL_USER_PROCESS_INFORMATION64@@ n
" Length ���
Process ��
Thread ���
P ClientId �
:W ( ImageInformation �Z �Y h _RTL_USER_PROCESS_INFORMATION64 .?AU_RTL_USER_PROCESS_INFORMATION64@@ �Y � <
�1
�
\B
�
�S
�
zA
�
]
�
b4
� f
" GenericRead ��
" GenericWrite �
" GenericExecute ���
" GenericAll ���> Z _GENERIC_MAPPING .?AU_GENERIC_MAPPING@@ �� Z �
�C
�
,
� b
" dwSize ���
" iType
" nCount ���
" nRgnSize �
� rcBound ��: Z _RGNDATAHEADER .?AU_RGNDATAHEADER@@ �� Z �
�
� J � _CM_PCCARD_DEVICE_DATA .?AU_CM_PCCARD_DEVICE_DATA@@ ��
Flags
ErrorCode
! Reserved �
" BusData ��
" DeviceId �
" LegacyBaseAddress
� IRQMap ���J Z _CM_PCCARD_DEVICE_DATA .?AU_CM_PCCARD_DEVICE_DATA@@ �� Z � ?
�
�
g
�
!
�
�F
�
�
�
�2
� Z � _THREAD_POWER_THROTTLING_STATE .?AU_THREAD_POWER_THROTTLING_STATE@@ ��B
" Version ��
" ControlMask ��
" StateMask Z Z _THREAD_POWER_THROTTLING_STATE .?AU_THREAD_POWER_THROTTLING_STATE@@ �� Z 1 ^
�*
�
7S
�
+
�
+5
�
�
� " , �b
! MaximumGroupCount
! ActiveGroupCount �
b Reserved �
Z GroupInfo B Z D _GROUP_RELATIONSHIP .?AU_GROUP_RELATIONSHIP@@ Z { < ~?
�
QU
�
�@
�
�
�C
�
I
�
e2
�
�
�
&
�
/
�
!
�
m/
�
!
�
�-
� Z � _PROCESS_CYCLE_TIME_INFORMATION .?AU_PROCESS_CYCLE_TIME_INFORMATION@@
0Z
� :
# AccumulatedCycles
# CurrentCycleCount Z 2Z _PROCESS_CYCLE_TIME_INFORMATION .?AU_PROCESS_CYCLE_TIME_INFORMATION@@ 3Z a �
�E
�
k$
�
�U
�
�&
�
�2
�
�,
�
nR
�
/'
�
�F
� V � _ENCLAVE_INIT_INFO_VBS_BASIC .?AU_ENCLAVE_INIT_INFO_VBS_BASIC@@ ��
� FamilyId �
� ImageId ��
# EnclaveSize ��
" ( EnclaveSvn ���
" , Reserved �
0 SignatureInfoHandle ��
# 0 Unused ���V ?Z 8 _ENCLAVE_INIT_INFO_VBS_BASIC .?AU_ENCLAVE_INIT_INFO_VBS_BASIC@@ �� @Z ? �
�"
�
�
�
<
�
~T
�
D
�
�)
� & y 6 % p p % p u u HZ
IZ
�
�1
�
�V
�
�S
�
�=
�
m
� U$
�S
�
�Q
�
�
�
�
�
�4
� y u " VZ
WZ
�
�<
�
ZC
�
�<
� Z � _FILE_STANDARD_LINK_INFORMATION .?AU_FILE_STANDARD_LINK_INFORMATION@@
\Z
� r
" NumberOfAccessibleLinks ��
" TotalNumberOfLinks ���
DeletePending
Directory Z ^Z _FILE_STANDARD_LINK_INFORMATION .?AU_FILE_STANDARD_LINK_INFORMATION@@ _Z �
oS
� f � _PROCESS_SECURITY_DOMAIN_INFORMATION .?AU_PROCESS_SECURITY_DOMAIN_INFORMATION@@ ��
bZ
�
# SecurityDomain ���f dZ _PROCESS_SECURITY_DOMAIN_INFORMATION .?AU_PROCESS_SECURITY_DOMAIN_INFORMATION@@ �� eZ a L
�
w9
�
�B
�
�U
�
�D
� � " " lZ
mZ
�
C,
�
P9
�
�;
�
�0
�
�?
�
0
�
�
�
�U
�
? ! wZ
�0
�
t
�
yT
�
/$
�
l#
�
�;
�
�!
�
�*
�
B=
�
�'
�
�6
�
S#
�
m$
� q �Z
Z
�
d<
�
U
�
�4
�
�5
�
�A
�
�
�
�
�&
�
�=
�
�V
� t �Z
�Z
� > 6 � _WMI_RESOURCE .?AU_WMI_RESOURCE@@ �
# AcquireTime ��
# HoldTime �
# WaitTime �
" MaxRecursionDepth
" ThreadId �
Resource �
" $ Action ���
" ( ContentionDelta ��6 �Z 0 _WMI_RESOURCE .?AU_WMI_RESOURCE@@ �Z � y
�
�5
�
\U
� .
Object ���
ObjectType ���J �Z _WMI_WAIT_OBJECT_RECORD .?AU_WMI_WAIT_OBJECT_RECORD@@ �Z � �
�7
� " p p " t �Z
�Z
�
�%
� �Z t �Z
�Z
�
�Y
�
1
� " �
�3
�
r,
�
�(
�
�*
�
'*
� " Z
�,
�
9
�
�8
�
�T
�
c$
�
�
�
:
�
E?
�
�
� �Z " �Z
�Z
�
�+
�
:
� i) " � �j
! ControlWord ��
! StatusWord ���
TagWord ��
Reserved1
! ErrorOpcode ��
" ErrorOffset ��
! ErrorSelector
! Reserved2
" DataOffset ���
! DataSelector �
! Reserved3
" MxCsr
" MxCsr_Mask ���
�Z FloatRegisters ���
�Z � XmmRegisters �
A Reserved4 6 �Z _XSAVE_FORMAT .?AU_XSAVE_FORMAT@@ �Z � �
<*
�
�V
�
� w#
jX
�
$
�
�W
�
=
� � � �Z
Y
�
>Z
�
&W
� q u u �Z
�Z
�
5
�
@.
�
E
� 2 � _COMMCONFIG .?AU_COMMCONFIG@@ �
" dwSize ���
! wVersion �
! wReserved
�( dcb ��
" $ dwProviderSubType
" ( dwProviderOffset �
" , dwProviderSize ���
0 wcProviderData ���2 �Z 4 _COMMCONFIG .?AU_COMMCONFIG@@ �Z
�:
�
�
i. ��
�Z
�
�
�
�:
�
�3 ��
�Z
�
-Y
�
�B
�
�
MF
�
<
�
�
U
�
�Z
�
-
�
F
�
-E
�
X4
�
7
�
q$
�
�
�
�
� b � _SYSTEM_PREFETCH_PATCH_INFORMATION .?AU_SYSTEM_PREFETCH_PATCH_INFORMATION@@ ��"
" PrefetchPatchCount ���b �Z _SYSTEM_PREFETCH_PATCH_INFORMATION .?AU_SYSTEM_PREFETCH_PATCH_INFORMATION@@ �� �Z �
�U
� N � _OBJECT_TYPE_INFORMATION .?AU_OBJECT_TYPE_INFORMATION@@ ���
� TypeName �
" TotalNumberOfObjects �
" TotalNumberOfHandles �
" TotalPagedPoolUsage ��
" TotalNonPagedPoolUsage ���
" TotalNamePoolUsage ���
" TotalHandleTableUsage
" HighWaterNumberOfObjects �
" $ HighWaterNumberOfHandles �
" ( HighWaterPagedPoolUsage ��
" , HighWaterNonPagedPoolUsage ���
" 0 HighWaterNamePoolUsage ���
" 4 HighWaterHandleTableUsage
" 8 InvalidAttributes
�$ < GenericMapping ���
" L ValidAccessMask ��
P SecurityRequired �
Q MaintainHandleCount ��
R TypeIndex
p S ReservedByte �
" T PoolType �
" X DefaultPagedPoolCharge ���
" \ DefaultNonPagedPoolCharge N �Z ` _OBJECT_TYPE_INFORMATION .?AU_OBJECT_TYPE_INFORMATION@@ �� �Z � 8
�
�
�9
�
YS
�
<
�
H
�
�
�
:
�
�2
�
Y1
�
�Y
�
�
�=
� �
[
�
Y$
�
�.
�
E"
�
�
�
;D
�
�G
�
�*
� * � in_addr .?AUin_addr@@
�Z
�
OC
� MemoryRegionInfo �V t [ WIN32_MEMORY_INFORMATION_CLASS .?AW4WIN32_MEMORY_INFORMATION_CLASS@@ ��� [ |
�S
� * � HRSRC__ .?AUHRSRC__@@
t unused ���* [ HRSRC__ .?AUHRSRC__@@ [ ' �
�5
�
E
�
|?
�
�<
�
�,
�
_
�
@%
� " �/ #[
� 6 � _RTL_RVA_LIST .?AU_RTL_RVA_LIST@@ �
" RvaCount �
" StateBitsPerRva ��
CompressedBuffer �
" CompressedBufferSize �
�! RvaStateBitMap ���
" StateBitValueMap �
ExtensionBuffer ��6 '[ _RTL_RVA_LIST .?AU_RTL_RVA_LIST@@ ([ � N
�#
�
C
�
�9
�
�?
� * � HKEY__ .?AUHKEY__@@ ��
t unused ���* /[ HKEY__ .?AUHKEY__@@ �� 0[ ' �
�D
� " " " 3[ V � _ETW_DISKIO_FLUSH_BUFFERS_V2 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V2@@ ��b
" DiskNumber ���
" IrpFlags �
# HighResResponseTime ��
IrpAddr ��V 6[ _ETW_DISKIO_FLUSH_BUFFERS_V2 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V2@@ �� 7[ � �
�
� b � _EVENT_EXTENDED_ITEM_STACK_TRACE32 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE32@@ ��*
# MatchId ��
� Address ��b ;[ _EVENT_EXTENDED_ITEM_STACK_TRACE32 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE32@@ �� <[ � h
A
�
{F
�
cU
� 6
ResolutionContext
" RootIndexUsed � A[ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL@@ �� B[ L �
�.
�
:
�
�(
�
k*
�
U
�
^-
�
�A
�
�W
�
�%
�
�2
�
p
� V � _PROCESSOR_POWER_INFORMATION .?AU_PROCESSOR_POWER_INFORMATION@@ ��
" Number ���
" MaxMhz ���
" CurrentMhz ���
" MhzLimit �
" MaxIdleState �
" CurrentIdleState �V P[ _PROCESSOR_POWER_INFORMATION .?AU_PROCESSOR_POWER_INFORMATION@@ �� Q[ �
|
�
�/
�
W
�
�1
�
�&
�
�R
�
AV
� z � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3@@ J
MaxIops ��
MaxBandwidth �
ReservationIops ��
q VolumeName ���
" BaseIoSize ���
� ControlFlags �
! $ VolumeNameLength �
( CriticalReservationIops ��
0 ReservationBandwidth �
8 CriticalReservationBandwidth �
@ MaxTimePercent ���
H ReservationTimePercent ���
P CriticalReservationTimePercent ���
X SoftMaxIops ��
` SoftMaxBandwidth �
h SoftMaxTimePercent ���
p LimitExcessNotifyIops
x LimitExcessNotifyBandwidth ���
� LimitExcessNotifyTimePercent �z [[ � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3@@ \[ C |
>)
�
.
�
G1
�
�3
�
R
�
O
�
!S
�
�$
�
<
�
t&
� #[
h[
�
�=
� J � _RETRIEVAL_POINTER_BASE .?AU_RETRIEVAL_POINTER_BASE@@
k[
�
} FileAreaOffset ���J m[ _RETRIEVAL_POINTER_BASE .?AU_RETRIEVAL_POINTER_BASE@@ n[ J
PY
�
�C
�
�M
� " � s[
@
�
�0
�
�
�T
� q � q y[
jA
� " �
T
� 2
9, Type �
� PolicyId �
�J u B ~[ _IMAGE_POLICY_ENTRY .?AU_IMAGE_POLICY_ENTRY@@ [ ( m&
�>
�
�$
�
�T
�
�(
� ^ � _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR .?AU_RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR@@ .
" BufferSize ���
p Buffer ���^ �[ _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR .?AU_RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR@@ �[ �
�)
� �[ �[
�[
�
�
�/
�
�9
�
2@
�
�6
�
}D
�
"V
�
�
�
BU
�
z= ��
�[
�
�&
� y �% t �[
�[
�
*G
� T
�
�
�
�
GU
�
3 �[
�
�
(
�
3G
�
�!
�
�G
�
�<
�
�>
�
�
�
�V
�
p%
�
8
� �
! Signature
! Flags
" Size �
! Machine ��
!
Characteristics ��
" TimeDateStamp
" CheckSum �
" SizeOfImage ��
# ImageBase F �[ _NON_PAGED_DEBUG_INFO .?AU_NON_PAGED_DEBUG_INFO@@ �[ [ 6
{X
�
w0
�
�
�
�4
�
�'
�
EV
�
�Q
�
@
�
u3
�
�G
�
N%
�
�
+'
�
�8
�
4A
�
p:
� ^
! Length ���
! Flags
" ReparseDataSize ��
" ReparseDataOffset . �[ _Reparse .?AU_Reparse@@ �� �[ �
�
� " �[
�[
�
�)
�
L(
�
mE
�
8$
�
w.
� � " " �[ �[
�[
�
>3
�
t%
�
�
�
�;
�
�Y
�
�$
�
,
�
w
�
�Y
�
Q?
�
�D
�
�=
�
�0
�
�3
� �
� Id ���
� Name �
� Description ��
# Flags
# ProvisionedCapacity ��
a MediaType
5 $Class B �[ (_FILE_STORAGE_TIER .?AU_FILE_STORAGE_TIER@@ �� �[ �
82
�
US
�
�,
�
[
�
�X
� R$
i<
�
CA
�
)
�
-
�
�!
� R � DISPLAYCONFIG_ADAPTER_NAME .?AUDISPLAYCONFIG_ADAPTER_NAME@@ ��2
y header ���
*$ adapterDevicePath R �[ DISPLAYCONFIG_ADAPTER_NAME .?AUDISPLAYCONFIG_ADAPTER_NAME@@ �� �[ "
#/
�
�U
�
�D
�
O[
�
�>
�
�U
�
`Y
�
"
�
�&
�
U
�
�
�
�
� �Y
^4
�
.
�
�V
� B p ! \
v"
�
E
�
mT
�
y
�
4
�
�$
�
X
�
R
� �% " �% t \
\
�
�$
�
�<
�
�
� t 6
\
�
hR
�
j
�
� ��
\
�
�
�
�&
�
�:
�
�8
�
y6
�
�
�
#*
�
QA
�
�Q
�
�W
�
s<
� �0 �0 "\
,5
�
�
�
�'
�
�/
�
#
�
�-
�
�F
�
�1
� �
Processor
! Family ���
! Model
! Stepping �
! ExtendedModel
" ExtendedFamily ���
# MicrocodeVersion �
" Reserved �: ,\ XSAVE_CPU_INFO .?AUXSAVE_CPU_INFO@@ �� -\ � � b t t /\
0\
�
vR
�
t 3\
4\
�
�E ��
6\
�
�Y
�
/
�
a
�
o4
�
�(
�
�Q
� �[
�
�R
�
�9
�
�
�
<
�
�G
�
['
� � �> �[ F\
G\
�
�F
� �
J\
�
Y
�
;
�
"
�
�/
�
�
K
�
�6
� B � ANON_OBJECT_HEADER .?AUANON_OBJECT_HEADER@@ ��
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
� ClassID ��
" SizeOfData ���B T\ ANON_OBJECT_HEADER .?AUANON_OBJECT_HEADER@@ �� U\ [ �
/S
�
�+
� 6 q t Y\
Z\
�
}@
�
�B
� j � JOBOBJECT_NET_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_NET_RATE_CONTROL_INFORMATION@@ ��F
# MaxBandwidth �
�W ControlFlags �
DscpTag ��j _\ JOBOBJECT_NET_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_NET_RATE_CONTROL_INFORMATION@@ �� `\ C <
0
�
�
�Q
�
y&
�
�'
�
W
�
�Z
� Z
! Length ���
! Flags
" EaSize ���
" EaInformationOffset ��" i\ _Ea .?AU_Ea@@ j\ �
B$
� 6 �% q t m\
n\
�
�D
�
�;
�
�
�
�
d(
�
0G
�
{4
�
#&
�
S
�
:(
�
�
�
0
�
�:
�
�R
�
�;
�
S
�
�@
�
�-
�
�
�
P/
�
z
�
E7 ��
�\
�
�<
� � � _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC@@ ��6
" Size �
" Format ���
O! Frame � �\ _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC@@ �� �\ L y
� ��
�\
�
1
�
@
�
^\
�
�#
�
�/
�
%D
�
u#
�
�$
�
�'
�
+
�
K,
�
�9
� " �
�\
� R
u width
u height ���
8* pixelFormat ��
I position �N �\ DISPLAYCONFIG_SOURCE_MODE .?AUDISPLAYCONFIG_SOURCE_MODE@@ �\ [
*S
�
W
�
~
�
�,
�
�(
�
I
�
�
�
�
�
5
�
4
�
�8
�
�#
�
5
�
7
�
@
�
(
�
Y
�
G
�
�W
�
jW ��
�\
�
w<
� "
s&
�
|/
�
�.
�
�4
�
X
�
�A
�
�+
�
�E
�
�2
�
�S
� ~A
�V
�
�
�
�B
� * } } } } " " " �\
�\
�
Y
�
�
+?
�
�6
�
s/
�
5M
�
@B
�
�%
�
�0 ��
�\
�
�%
�
?'
�
%C
�
�
�
S-
�
�
� � " �\
�\
�
&E
�
�
�
�6
�
�$
�
Y
�
7
�
�
�
�'
�
�,
�
�U
�
5
�
g1
�
KC
�
�>
�
E
�B
�
�
�
A
�
U
�
x%
�
+
� q t �\
�\
�
�R
�
�=
�
Y<
�
�3
�
W
�
1T
�
/M
�
�(
�
[
�
�&
�
�
� �0
�
�\
�
�,
�
0
� ^ � _SYSTEM_BOOT_GRAPHICS_INFORMATION .?AU_SYSTEM_BOOT_GRAPHICS_INFORMATION@@
]
� �
} FrameBuffer ��
" Width
" Height ���
" PixelStride ��
" Flags
� Format ���
" DisplayRotation ��^ ] _SYSTEM_BOOT_GRAPHICS_INFORMATION .?AU_SYSTEM_BOOT_GRAPHICS_INFORMATION@@ ] e
�0
�
�;
�
e
�
;
�
yC
�
@'
�
cA
�
(
�
�I
�
�
�
�?
�
0*
�
:[
�
^A
�
�.
�
7)
�
�
�
VW
� �
]
�
�"
�
�'
�
=3
�
e6
�
�)
�
'
�
,D
�
?"
�
z
�
�+
�
ZC ��
%]
�
�U
�
�
�
8!
�
(
� �
�?
�
iS
�
�?
�
�8
�
�T
�
�)
�
�+
�
�0
�
*
�
�6
�
�
�
/
�
M
�
�R
�
�U
�
�
�
�
67
� 2 � HPALETTE__ .?AUHPALETTE__@@ ��
>]
�
t unused ���2 @] HPALETTE__ .?AUHPALETTE__@@ �� A] ]
�U
� O$ S=
�'
�
C
� 7 7 G]
H]
�
�
�
�E
�
%
�
�"
�
�Q
�
�
�
�B
� > � _IMAGE_OS2_HEADER .?AU_IMAGE_OS2_HEADER@@
Q]
� �
! ne_magic �
p ne_ver ���
p ne_rev ���
! ne_enttab
! ne_cbenttab ��
ne_crc ���
! ne_flags �
! ne_autodata ��
! ne_heap ��
! ne_stack �
ne_csip ��
ne_sssp ��
! ne_cseg ��
! ne_cmod ��
! ne_cbnrestab �
! " ne_segtab
! $ ne_rsrctab ���
! & ne_restab
! ( ne_modtab
! * ne_imptab
, ne_nrestab ���
! 0 ne_cmovent ���
! 2 ne_align �
! 4 ne_cres ��
6 ne_exetyp
7 ne_flagsothers ���
! 8 ne_pretthunks
! : ne_psegrefbytes ��
! < ne_swaparea ��
! > ne_expver > S] @ _IMAGE_OS2_HEADER .?AU_IMAGE_OS2_HEADER@@ T] [ [ " " q t V]
W]
�
�4
�
9
�
�
� " [] \]
]]
� � " � � � _]
`]
� F QD
�
�
MB
�
�Z
�
�=
�
$
�
�( ��
h]
�
-7
�
5
� k] u l]
m]
�
�X
�
&[
�
DF
�
'
�
�
�
c
�
U
�
�1
�
�>
�
|
�
�"
�
�
�
?
�
A
�
wG
�
�R
�
E/
�
�7
�
�!
�
�
�
k'
�
" �]
�8 ��
�]
�
�X
�
g-
�
@ ��
�]
�
�B
�
�
�
�R
�
�X
�
�,
�
" ��
�]
�
t
�
�$
�
�!
�
�
�
�
�Y
�
�@
�
Q
�
�W
�
�
�
7
�
�G
�
~'
�
!
�
�:
�
n;
�
�
�
O
�
�
�
B
�
�Q
�
Q(
�
�6
�
�
�
vF
�
�Q
�
OV
�
\,
�
�"
� R$
�]
�
�T
�
1
�
�
�
.[
�
�]
� �
�]
�
�5
� " Z
I PathSourceSize ���
� DesktopImageRegion ���
� DesktopImageClip �^ �] ( DISPLAYCONFIG_DESKTOP_IMAGE_INFO .?AUDISPLAYCONFIG_DESKTOP_IMAGE_INFO@@ �� �] h
�
�
�#
� " ~! �]
�]
�
�B
�
�
�
�
� 3%
�]
�
)$
�
C
�
7
�
W
�
,F
�
�I
�
�A
�
]
�
�
�F
�
D+
�
x,
�
Q]
�
tS
�
R6
�
�U
�
l
�
I
�
�!
� 6 7 p t �]
�]
�
X<
�
�
�
)
� .
u Numerator
u Denominator ��J �] DISPLAYCONFIG_RATIONAL .?AUDISPLAYCONFIG_RATIONAL@@ �� �] �
�
�
sF
�
h
�
.
�
�8
�
,
�
�$
�
m
�
&S
�
?
�
l=
�
^<
� X$
�>
�
.[
�
�)
�
'
�
�S
�
�%
� N � ANON_OBJECT_HEADER_BIGOBJ .?AUANON_OBJECT_HEADER_BIGOBJ@@ *
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
� ClassID ��
" SizeOfData ���
" Flags
" $ MetaDataSize �
" ( MetaDataOffset ���
" , NumberOfSections �
" 0 PointerToSymbolTable �
" 4 NumberOfSymbols ��N
�] 8 ANON_OBJECT_HEADER_BIGOBJ .?AUANON_OBJECT_HEADER_BIGOBJ@@ �] [ �
�$
�
�
�
~7
�
-= ��
�]
�
�"
� ���
���
���
���
���� -MT -c -Zl -Zp8 -Gy -Gm- -W4 -Gz -hotpatch -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 ��
^ f ^ -arch:IA32 -Gw -wd4316 -wd4973 -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -TC -X � ^ ^ ^ ^ ^ ��� a!VBʷ��{ �j�n�M���'��Aі�f�2������Z2������Z����/�o��K�d�ʭ�R�x�u��C��� (q5� @comp.idk�� @feat.00� ��� @vol.md �� .debug$S �� e .rdata �ہ e e .rdata �w � e ~ .rdata h�Q� e � .rdata kE�� e � .rdata kE�� e � .rdata ��R e � .debug$S 4 e .debug$S @ e .debug$S
8 e .debug$P X] e .chks64 h e ___@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUrDIGUkivxlnkOlyq@elfapi ??_C@_13FPGAJAPJ@?$AA?2@ ??_C@_15MNCACJLI@?$AA?2?$AA?1@ ??_C@_13CGOKJPIL@?$AA?1@ _RtlNtPathSeperatorString _RtlAlternateDosPathSeperatorString _RtlDosPathSeperatorsString