| Server IP : 209.209.40.120 / Your IP : 216.73.217.112 Web Server : Microsoft-IIS/10.0 System : Windows NT NEWWWW 10.0 build 17763 (Windows Server 2019) i586 User : NEWWWW$ ( 0) PHP Version : 8.3.30 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : C:/Program Files (x86)/Windows Kits/10/Lib/10.0.19041.0/um/arm/ |
Upload File : |
!<arch>
/ 1606894170 0 4363 `
� # # # # # # # # # G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� G� �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �Z �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� �� }H }H }H }H }H }H }H??_C@_13JOFGPIOO@?$AA?4@ ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4@ ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc@ ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG@ ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg@ EVENTLOG_HANDLE_A_bind EVENTLOG_HANDLE_A_unbind EVENTLOG_HANDLE_W_bind EVENTLOG_HANDLE_W_unbind ??_C@_08EDKKPLCC@Security@ ??_C@_0M@NJALGCHB@Application@ ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy@ CHANNEL_POLICY_APPLICATION_ERROR EVENTLOG EVENTLOG_Context EVENT_ABNORMAL_SHUTDOWN EVENT_AUDIT_AUTO_BACKUP EVENT_AUDIT_EVENTS_DROPPED EVENT_AUDIT_FAILURE EVENT_AUDIT_LOG_CLEARED EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL EVENT_AUDIT_LOG_FULL EVENT_AUDIT_PROCESSING EVENT_AUDIT_PUBLISHER_META_DATA EVENT_AUTO_BACKUP EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY EVENT_EVENTS_DROPPED EVENT_LOG_CLEARED EVENT_LOG_FULL EVENT_OPENEVENTLOG EVENT_PROCESSING EVENT_PUBLISHER_META_DATA EVENT_PUBLISHER_TLG_INVALID_META_DATA EVENT_PULLSUB_CREATE EVENT_PUSHSUB_CREATE EVENT_REGISTEREVENTSOURCE EVENT_REPORTEVENT EVENT_REPORTEVENT_ANSI EVENT_SHUTDOWN ElfAssertThreadPrivilege ElfBackupEventLogFileA ElfBackupEventLogFileW ElfChangeNotify ElfClearEventLogFileA ElfClearEventLogFileW ElfCloseEventLog ElfCreateReconnInfo ElfDeregisterClusterSvc ElfDeregisterEventSource ElfDestroyReconnectionInfo ElfFlushEventLog ElfGetLogInformation ElfGetModuleName ElfGetTheRpcHandle ElfGetUseLegacyReportEvent ElfNumberOfRecords ElfOldestRecord ElfOpenBackupEventLogA ElfOpenBackupEventLogW ElfOpenEventLogA ElfOpenEventLogW ElfReadEventLogA ElfReadEventLogW ElfReconnect ElfRegisterClusterSvc ElfRegisterEventSourceA ElfRegisterEventSourceW ElfReportEventA ElfReportEventAndSourceW ElfReportEventW ElfRevertThreadPrivilege ElfSetUseLegacyReportEvent ElfWriteClusterEvents EventDataDescCreate INIT_CHANNEL INIT_CHANNEL_CONFIG_ERROR INIT_CHANNEL_LOGFILE_WARNING INIT_CHANNEL_LOGFILTER_WARNING INIT_CHANNEL_LOGGING INIT_CHANNEL_MOVED_CORRUPT_LOG INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE INIT_CHANNEL_PUBLISHING LOG_DROPPED_CHUNK McGenControlCallbackV2 McGenEventRegister_EtwEventRegister McGenEventUnregister_EtwEventUnregister McGenEventWrite_EtwEventWriteTransfer McGenLevelKeywordEnabled McTemplateU0usr0_EtwEventWriteTransfer McTemplateU0uzr0_EtwEventWriteTransfer Microsoft_Windows_EventlogEnableBits Microsoft_Windows_EventlogKeywords Microsoft_Windows_EventlogLevels NtCurrentTeb PRIMARY_CHANNEL_CONFIGURATION_WARNING PRIMARY_CHANNEL_FATAL_ERROR WevtInitialize BackupEventLogA BackupEventLogW BaseSetLastNTError CheckEventLogBuffer ClearEventLogA ClearEventLogW CloseEventLog DeregisterEventSource GetEventLogInformation GetNumberOfEventLogRecords GetOldestEventLogRecord InitAnsiString InitUnicodeString NotifyChangeEventLog OpenBackupEventLogA OpenBackupEventLogW OpenEventLogA OpenEventLogW ReadEventLogA ReadEventLogW RegisterEventSourceA RegisterEventSourceW ReportEventA ReportEventW StringCheck ElfrBackupELFA ElfrBackupELFW ElfrChangeNotify ElfrClearELFA ElfrClearELFW ElfrCloseEL ElfrDeregisterClusterSvc ElfrDeregisterEventSource ElfrFlushEL ElfrGetLogInformation ElfrNumberOfRecords ElfrOldestRecord ElfrOpenBELA ElfrOpenBELW ElfrOpenELA ElfrOpenELW ElfrReadELA ElfrReadELW ElfrRegisterClusterSvc ElfrRegisterEventSourceA ElfrRegisterEventSourceW ElfrReportEventA ElfrReportEventAndSourceW ElfrReportEventExA ElfrReportEventExW ElfrReportEventW ElfrWriteClusterEvents eventlog_ClientIfHandle ??_C@_13CGOKJPIL@?$AA?1@ ??_C@_13FPGAJAPJ@?$AA?2@ ??_C@_15MNCACJLI@?$AA?2?$AA?1@ RtlAlternateDosPathSeperatorString RtlDosPathSeperatorsString RtlNtPathSeperatorString __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinUkivxlnkOlyq@elfapi
/ 1606894170 0 4071 `
# �G Z� س H} � ??_C@_08EDKKPLCC@Security@ ??_C@_0M@NJALGCHB@Application@ ??_C@_13CGOKJPIL@?$AA?1@ ??_C@_13FPGAJAPJ@?$AA?2@ ??_C@_13JOFGPIOO@?$AA?4@ ??_C@_15MNCACJLI@?$AA?2?$AA?1@ ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4@ ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc@ ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy@ ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG@ ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg@ BackupEventLogA BackupEventLogW BaseSetLastNTError CHANNEL_POLICY_APPLICATION_ERROR CheckEventLogBuffer ClearEventLogA ClearEventLogW CloseEventLog DeregisterEventSource EVENTLOG EVENTLOG_Context EVENTLOG_HANDLE_A_bind EVENTLOG_HANDLE_A_unbind EVENTLOG_HANDLE_W_bind EVENTLOG_HANDLE_W_unbind EVENT_ABNORMAL_SHUTDOWN EVENT_AUDIT_AUTO_BACKUP EVENT_AUDIT_EVENTS_DROPPED EVENT_AUDIT_FAILURE EVENT_AUDIT_LOG_CLEARED EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL EVENT_AUDIT_LOG_FULL EVENT_AUDIT_PROCESSING EVENT_AUDIT_PUBLISHER_META_DATA EVENT_AUTO_BACKUP EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY EVENT_EVENTS_DROPPED EVENT_LOG_CLEARED EVENT_LOG_FULL EVENT_OPENEVENTLOG EVENT_PROCESSING EVENT_PUBLISHER_META_DATA EVENT_PUBLISHER_TLG_INVALID_META_DATA EVENT_PULLSUB_CREATE EVENT_PUSHSUB_CREATE EVENT_REGISTEREVENTSOURCE EVENT_REPORTEVENT EVENT_REPORTEVENT_ANSI EVENT_SHUTDOWN ElfAssertThreadPrivilege ElfBackupEventLogFileA ElfBackupEventLogFileW ElfChangeNotify ElfClearEventLogFileA ElfClearEventLogFileW ElfCloseEventLog ElfCreateReconnInfo ElfDeregisterClusterSvc ElfDeregisterEventSource ElfDestroyReconnectionInfo ElfFlushEventLog ElfGetLogInformation ElfGetModuleName ElfGetTheRpcHandle ElfGetUseLegacyReportEvent ElfNumberOfRecords ElfOldestRecord ElfOpenBackupEventLogA ElfOpenBackupEventLogW ElfOpenEventLogA ElfOpenEventLogW ElfReadEventLogA ElfReadEventLogW ElfReconnect ElfRegisterClusterSvc ElfRegisterEventSourceA ElfRegisterEventSourceW ElfReportEventA ElfReportEventAndSourceW ElfReportEventW ElfRevertThreadPrivilege ElfSetUseLegacyReportEvent ElfWriteClusterEvents ElfrBackupELFA ElfrBackupELFW ElfrChangeNotify ElfrClearELFA ElfrClearELFW ElfrCloseEL ElfrDeregisterClusterSvc ElfrDeregisterEventSource ElfrFlushEL ElfrGetLogInformation ElfrNumberOfRecords ElfrOldestRecord ElfrOpenBELA ElfrOpenBELW ElfrOpenELA ElfrOpenELW ElfrReadELA ElfrReadELW ElfrRegisterClusterSvc ElfrRegisterEventSourceA ElfrRegisterEventSourceW ElfrReportEventA ElfrReportEventAndSourceW ElfrReportEventExA ElfrReportEventExW ElfrReportEventW ElfrWriteClusterEvents EventDataDescCreate GetEventLogInformation GetNumberOfEventLogRecords GetOldestEventLogRecord INIT_CHANNEL INIT_CHANNEL_CONFIG_ERROR INIT_CHANNEL_LOGFILE_WARNING INIT_CHANNEL_LOGFILTER_WARNING INIT_CHANNEL_LOGGING INIT_CHANNEL_MOVED_CORRUPT_LOG INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE INIT_CHANNEL_PUBLISHING InitAnsiString InitUnicodeString LOG_DROPPED_CHUNK McGenControlCallbackV2 McGenEventRegister_EtwEventRegister McGenEventUnregister_EtwEventUnregister McGenEventWrite_EtwEventWriteTransfer McGenLevelKeywordEnabled McTemplateU0usr0_EtwEventWriteTransfer McTemplateU0uzr0_EtwEventWriteTransfer Microsoft_Windows_EventlogEnableBits Microsoft_Windows_EventlogKeywords Microsoft_Windows_EventlogLevels NotifyChangeEventLog NtCurrentTeb OpenBackupEventLogA OpenBackupEventLogW OpenEventLogA OpenEventLogW PRIMARY_CHANNEL_CONFIGURATION_WARNING PRIMARY_CHANNEL_FATAL_ERROR ReadEventLogA ReadEventLogW RegisterEventSourceA RegisterEventSourceW ReportEventA ReportEventW RtlAlternateDosPathSeperatorString RtlDosPathSeperatorsString RtlNtPathSeperatorString StringCheck WevtInitialize __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinUkivxlnkOlyq@elfapi eventlog_ClientIfHandle
// 1606894170 0 364 `
d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\rpcbind.obj d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\apistub.obj d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\eventapi.obj d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\elf_client.obj d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\precomp.obj /0 1606894170 100666 9343 `
� ZB�_2 Q .debug$S � \ @ B.rdata 8 @0@.rdata @ @0@.rdata D @0@.rdata V @0@.rdata f @0@.text$mn P x � 2`.debug$S � � | @B.text$mn � � 2`.debug$S , � @B.text$mn � R � 2`.debug$S � P H 0 @B.text$mn ( 8 2`.debug$S , B n @B.pdata � � @@@.pdata � � @@@.pdata � � @@@.pdata � � @@@.debug$T � @ B.chks64 � �
.drectve l �
� � N d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\rpcbind.obj : < � � k k
Microsoft (R) Optimizing Compiler � ` 8 o ����o� }�+4qt*Y lռ��́dq�X � N~ط �K��� �h��-l��A��D�� � � onecore\admin\wmi\events\advapi\objfre\arm\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\arm\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\admin\wmi\events\advapi\rpcbind.c � L�^ \ \ . . e v e n t l o g n c a l r p c E V E N T L O G -�H
� ��KF�h�G #� K"�hhF�G (�� � �KFhFh�G � $ F���� * . D H L � < G P
P �^ �EVENTLOG_HANDLE_A_bind >p ServerName A
>} ServerNameU C
E P > bindingHandle A 2 A < >� ServerNameA E P > Status A
$ A
<
Z r^ B!
u
u
u p ServerName } ServerNameU � ServerNameA 9 �^ 9" �^ 96 �^ O� h P 8
\ � �
� � � � � �$ � �( � �. � �8 � �: � �< � �, , 0 , g , k , � , � , � , � , � , � , � , � , , , ( , , , < , @ , v 2 z 2 � 3 � 3 � 4 � 4 � , � , � , , , , $ , ( , -� H�FF�� H � � � � > G i^ �EVENTLOG_HANDLE_A_unbind >p ServerName A
> BindingHandle A
Z l^ B! p ServerName BindingHandle O� ( 8 � � � �, + 0 + i + m + � + � + + + -�H
� ��F #��� I � �h�#�[�I F � �0�I� " F � ���L� #I$h � K " �G`� K��h�GKF�h�G �� � ���� / " / 0 p t x | � � � � � a < G �
� r^ �EVENTLOG_HANDLE_W_bind >q ServerName A
A . A d > bindingHandle A
A
6 E � > status A
L A \ A
h A d >q sb E �
Z v^ B!
u
u
u
u
u
u
u
u q ServerName bindingHandle q sb 9J y^ 9V |^ 9` ^ O � � � 8
t 9 � : � A �( \ �4 a �6 F �L M �N O �X Q �b S �d b �h Y �j b �, . 0 . g . k . w . { . � . � . � . � . � . � . � . � . � . � . . . . . ( . , . I . M . � 9 � 9 � : � : � ; � ; � < � < � = � = � > � > � ? � ? � @ � @ = . A . M . Q . ] . a . x . | . -� H�FF�� H � � � � > G o^ �EVENTLOG_HANDLE_W_unbind >q ServerName A
> BindingHandle A
Z l^ B! q ServerName BindingHandle O� ( 8 { � ~ �, - 0 - i - m - � - � - - - !@? + � p , !@? - � p . R gN �٤%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\arm\precomp.obj p g^ & h^ EVENTLOG_HANDLE_A_unbind ���
j^ k^ RpcpUnbindRpc �� q m^ & n^ EVENTLOG_HANDLE_W_unbind ���
q p^ " q^ EVENTLOG_HANDLE_W_bind �
� q q q s^ t^ u^ RpcpBindRpc q q q q q �Y w^
x^
� q s^ z^
{^
�
�Y }^
~^
�
p �^ " �^ EVENTLOG_HANDLE_A_bind �
� � �^ �^
�^
�
�
� { �^ �^
�^
�
�
�
���
���
���
���� -FC -MT -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 -Gw -wd4316 -wd4973 �
�^ � �^ -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -wd4366 -wd4746 -Gs4096 -wd4064 -volatile:ms -arch:vfpv3-d16 -TC -X ��� �^ �^ �^ �^ �^ ���Ή��,k:Qӌ�E��Y7�3dxe� �}�K�< �>1T�_+�pʥ(Wk�$��)L���S(.�F$Ud�~m��.�ur��n�E�s��S(.�FY�cj��`���@��u�v�mD����@�� �#�>k@��E{�Ѷ -INCLUDE:__@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� .debug$S � e .rdata �(9 e .rdata
��@ e ) .rdata ;�na e B .rdata �֗] e .rdata �d�� e � � 2 J X d y � .text$mn P ��> e .debug$S � e .text$mn ��_ e .debug$S
, e .text$mn � ���b e .debug$S � 0 e .text$mn
��_ e .debug$S ,
e � � �
wcscmp $LN1 < $LN5 : $LN12 L $LN11 H $LN10 D $LN1 j $LN5 h $LN7 d $LN3 6 $LN18 � $LN17 � $LN16 � $LN15 � $LN14 | $LN13 x $LN12 t $LN11 p .pdata �o�0 e .pdata Ѱi� e < .pdata �o�0
e [ .pdata =o�6 e | .debug$T � e .chks64 � e � ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4@ ??_C@_13JOFGPIOO@?$AA?4@ ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg@ ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc@ ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG@ __imp_RtlFreeUnicodeString __imp_RtlAnsiStringToUnicodeString __imp_RtlInitAnsiString RpcpUnbindRpc RpcpBindRpc __imp_RpcStringFreeW __imp_RpcBindingFromStringBindingW __imp_RpcStringBindingComposeW EVENTLOG_HANDLE_A_unbind EVENTLOG_HANDLE_A_bind EVENTLOG_HANDLE_W_unbind EVENTLOG_HANDLE_W_bind $pdata1$EVENTLOG_HANDLE_A_unbind $pdata1$EVENTLOG_HANDLE_A_bind $pdata1$EVENTLOG_HANDLE_W_unbind $pdata1$EVENTLOG_HANDLE_W_bind
/72 1606894170 100666 168773 `
� ZB�_� ` .debug$S � �, �2 @ B.rdata �2 @0@.rdata �2 @0@.rdata �2 @0@.data 8 3 ;3 @@�.rdata
Y3 @0@.rdata h f3 @@@.rdata �3 @@@.rdata �3 @@@.rdata �3 @@@.rdata �3 @@@.rdata 4 @@@.rdata 4 @@@.rdata .4 @@@.rdata >4 @@@.rdata N4 @@@.rdata ^4 @@@.rdata n4 @@@.rdata ~4 @@@.rdata �4 @@@.rdata �4 @@@.rdata �4 @@@.rdata �4 @@@.rdata �4 @@@.rdata �4 @@@.rdata �4 @@@.rdata �4 @@@.rdata 5 @@@.rdata 5 @@@.rdata .5 @@@.rdata >5 @@@.rdata N5 @@@.rdata ^5 @@@.rdata n5 @@@.rdata ~5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata �5 @@@.rdata 6 @@@.rdata 6 @0@.text$mn \ .6 �6 2`.debug$S � �6 ^8 @B.text$mn | :9 �9 2`.debug$S � : �? T @B.text$x2 .C BC 2`.text$mn | LC �C 2`.debug$S � D �I T @B.text$x2 @M TM 2`.text$mn | ^M �M 2`.debug$S � *N &T X @B.text$x2 �W �W 2`.text$mn l �W X 2`.debug$S t pX �] L @B.text$x2 �` �` 2`.text$mn l �` fa 2`.debug$S t �a *g L @B.text$x2 "j 6j 2`.text$mn P @j �j 2`.debug$S � �j To D @B.text$x2 �q r 2`.text$mn ( r Bs 2`.debug$S � ts Dx > @B.text$mn �z 2`.debug$S � �z �{ @B.text$mn P | X| 2`.debug$S � �| ,� D @B.text$x2 ԃ � 2`.text$mn < � .� 2`.debug$S ` B� �� @B.text$mn j� 2`.debug$S � z� f� @B.text$mn � �� >� 2`.debug$S � �� R� n @B.text$x2 �� �� 2`.text$mn �� 2`.debug$S � ܔ `�
@B.text$mn ( Ė 2`.debug$S X � D� @B.text$mn И 2`.debug$S � � ڙ @B.text$mn x � �� 2`.debug$S � ޚ �� T @B.text$x2 � �� 2`.text$mn x � �� 2`.debug$S � Ф �� T @B.text$x2 � �� 2`.text$mn � � �� 2`.debug$S � �� d� \ @B.text$x2 �� � 2`.text$mn � � �� 2`.debug$S � ع �� ` @B.text$x2 x� �� 2`.text$mn $ �� �� 2`.debug$S (
P� x� � @B.text$x2 �� �� 2`.text$mn | �� v� 2`.debug$S h *� �� � @B.text$x2 �� �� 2`.text$mn � �� d� 2`.debug$S � �� �� � @B.text$x2 � � 2`.text$mn � �� �� 2`.debug$S � �� � � @B.text$x2
6
2`.text$mn � @
< 2`.debug$S � � : Z @B.text$x2 � � 2`.text$mn � 2`.debug$S | � h @B.text$mn � � � 2`.debug$S � � b j @B.text$x2 �$ �$ 2`.text$mn �$ �%
2`.debug$S P & d/ � @B.text$x2 �4 �4 2`.text$mn � �4 �6
2`.debug$S � ,7 K @B.text$x2 �U �U 2`.text$mn V 2`.debug$S H V ^[ : @B.text$mn � �] J` 2`.debug$S a x B @B.text$x2 �� �� 2`.text$mn @ Ƅ � 2`.debug$S X � r� @B.text$mn � 2`.debug$S @ � `� @B.text$mn �� 2`.debug$S � �� H� @B.text$mn �� 2`.debug$S l Ԋ @�
@B.text$mn � �� x� 2`.debug$S �� �� * @B.text$mn $ B� f� 2`.debug$S H p� �� @B.text$mn , �� � 2`.debug$S X � J� @B.text$mn L ֘ "� 2`.debug$S � ,� Л @B.text$mn @ Ԝ 2`.debug$S � � � @B.text$mn H � <� 2`.debug$S � Z� "� @B.text$mn L £ � 2`.debug$S � ,� (� @B.text$mn ܧ 2`.debug$S � � �� @B.text$mn 4 �� � 2`.debug$S � � � @B.pdata �� � @@@.pdata
� � @@@.pdata � $� @@@.pdata .� 6� @@@.pdata @� H� @@@.pdata R� Z� @@@.pdata d� l� @@@.pdata �� �� @@@.xdata 0 �� ¬ @@@.pdata � �� @@@.pdata � � @@@.xdata , "� N� @@@.pdata �� �� @@@.pdata �� �� @@@.xdata 0 �� ޭ @@@.pdata � � @@@.pdata ,� 4� @@@.xdata 0 >� n� @@@.pdata �� �� @@@.pdata �� Į @@@.xdata ( ή �� @@@.pdata (� 0� @@@.pdata D� L� @@@.xdata ( V� ~� @@@.pdata �� �� @@@.pdata ̯ ԯ @@@.xdata 0 ޯ � @@@.pdata @� H� @@@.pdata R� Z� @@@.pdata n� v� @@@.xdata 0 �� �� @@@.pdata � � @@@.pdata �� � @@@.xdata , � <� @@@.pdata n� v� @@@.pdata �� �� @@@.xdata ( �� ı @@@.pdata �� �� @@@.pdata � � @@@.xdata ( $� L� @@@.pdata ~� �� @@@.pdata �� �� @@@.xdata 0 �� ܲ @@@.pdata � � @@@.pdata *� 2� @@@.xdata 0 <� l� @@@.pdata �� �� @@@.pdata �� ³ @@@.xdata ( ̳ � @@@.pdata &� .� @@@.pdata B� J� @@@.xdata 0 T� �� @@@.pdata �� �� @@@.pdata Ҵ ڴ @@@.xdata 0 � � @@@.pdata F� N� @@@.pdata b� j� @@@.xdata 0 t� �� @@@.pdata ֵ @@@.pdata � �� @@@.xdata 0 � 4� @@@.pdata f� n� @@@.pdata �� �� @@@.xdata 0 �� Ķ @@@.pdata �� �� @@@.pdata � � @@@.xdata 0 $� T� @@@.pdata �� �� @@@.pdata �� �� @@@.pdata �� �� @@@.xdata ( Ʒ � @@@.pdata � (� @@@.pdata 2� :� @@@.pdata D� L� @@@.pdata V� ^� @@@.pdata h� p� @@@.gfids$y z� @0@.pdata ~� �� @@@.pdata �� �� @@@.pdata �� �� @@@.pdata �� �� @@@.xdata и � @@@.pdata �� �� @@@.xdata � .� @@@.pdata 8� @� @@@.pdata J� R� @@@.pdata \� d� @@@.pdata n� v� @@@.pdata �� �� @@@.debug$S , �� �� @B.debug$S < ҹ � @B.debug$S @ "� b� @B.debug$S , v� �� @B.debug$S 4 �� � @B.debug$S < �� :� @B.debug$S 0 N� ~� @B.debug$S 4 �� ƻ @B.debug$S 0 ڻ
� @B.debug$S @ � ^� @B.debug$S 4 r� �� @B.debug$S 8 �� � @B.debug$S , � 2� @B.debug$S 4 F� z� @B.debug$S , �� �� @B.debug$S 4 ν � @B.debug$S 0 � F� @B.debug$S 0 Z� �� @B.debug$S 0 �� ξ @B.debug$S @ � "� @B.debug$S @ 6� v� @B.debug$S 4 �� �� @B.debug$S , ҿ �� @B.debug$S , � >� @B.debug$S , R� ~� @B.debug$S 0 �� � @B.debug$S 4 �
� @B.debug$S , � J� @B.debug$S < ^� �� @B.debug$S @ �� � @B.debug$S @ � B� @B.debug$S 8 V� �� @B.debug$S < �� �� @B.debug$S 8 �� *� @B.debug$S H >� �� @B.debug$S < �� �� @B.debug$S 0 �� � @B.debug$S 4 .� b� @B.debug$S 4 v� �� @B.debug$S ( �� �� @B.debug$S $ �� � @B.debug$T 0 2� @ B.chks64 � b�
.drectve l 2
� � N d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\apistub.obj : < � � k k
Microsoft (R) Optimizing Compiler � ? � ComputerNameNetBIOS " �^ ApiElfOpenBackupEventLogA # �^ ApiElfRegisterEventSourceA �^ ApiElfOpenEventLogA " �^ ApiElfOpenBackupEventLogW # �^ ApiElfRegisterEventSourceW �^ ApiElfOpenEventLogW � SecurityImpersonation 1
� Microsoft_Windows_EventlogEnableBits � B �^ MCGEN_TRACE_CONTEXT `_ PMCGEN_TRACE_CONTEXT �^ _MCGEN_TRACE_CONTEXT �^ ELF_API_TYPE |^ STRING_STORAGE a_ PSTRING_STORAGE �^ PRIVILEGE_STATUS b_ PPRIVILEGE_STATUS �^ tagPrivilegeStatus c_ PRECONN_INFO �^ tagElfApiType |^ tagStringStorage �^ tagReconnInfo � � 8 o ����o� }�+4qt*Y lռ��́dq�X � ���Ug�gWd�Dt�Y� ݚgxHt�$�Njw�a � . �<��� 5�)ڀ�~B�G?_�M�MZ��{� � �^h����j[�|�-� ������0f'�M{Ft # 4(���+C�h5J$t�J���h 8�ϽgX�� � d g^ 8 = q^ � ' �^ ` > �^ ` , �^ ` �^ � �^ � � �^ � w � J onecore\admin\wmi\events\advapi\objfre\arm\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\arm\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\external\sdk\inc\nxarm.h onecore\admin\wmi\events\advapi\apistub.c onecore\admin\wmi\events\manifests\objfre\arm\EventLogEvents.h onecore\external\shared\inc\evntprov.h � Lk_ � 7 � 7 S e c u r i t y Application Security
, 7 0 @ 4 = � � � � � � � @ @p �T
e @S
e @R
e @Q
i @P
e @O
e @N
h @M
e @L
g @� m � m � m � m � m � m � m m e l l �j �i i �h h �g e f e d e ( � d � d � � d � d � d � d � d � d � d � d ���e���bI��n\���H-�0H
�
FF �P?��?;�K h�G (��# � #��C F L�"$h!�G (��#�� #�`K+`��0�AvrP T 5 X 6 � Z > G \ \ �^ �ElfAssertThreadPrivilege > Privilege A
A $
>�^ p A
A
F M g^ N B!
h g^
u
u
u Privilege �^ p 9 �^ 9: �^ O � P \ ` D 1 � 2 � : �& = �, > �H B �L C �, � 0 � h � l � x � | � � � � � � � � � � � � � � � � � F � J � V � Z � p � t � -�H
� � ���oF FF� " ! � ��#��� � �(F � �h�!F � �F<`� Kh�GF<`�|h�L� � � �L F� � ��谈��
� � � � , � 2 � : Z � f � x ' � � < G | | �^ �ElfBackupEventLogFileA > LogHandle A
A N 0 B
A V
E 7 | >� BackupFileName A A P . D
E 7 |
>�^ Priv E | > RpcHandle A
6 A
V > status A @ A V
E | Z �^ �^ �^ �^ @�"
:( $LN34 $LN32
u
u
u
u $LN10 $LN14 $LN13 $LN20@ElfBackupE 7 LogHandle 7 � BackupFileName �^ Priv status 9H �^ O � � | ` � � � � � � �& �0 �6 �8 �B �D ! �P �T ' �V . �^ 0 �` �b 1 �� C F �ElfBackupEventLogFileA$filt$0 > LogHandle E 7 >� BackupFileName E 7
>�^ Priv E > status E @�" $LN34 $LN32
u
u
u
u $LN22 $LN12 $LN9 7 LogHandle 7 � BackupFileName �^ Priv status 9
�^ O � ( ` 1 � �, � 0 � f � j � v � z � � � � � � � � � � � � � � � � � � � � � � " � B � F � V � Z � w � { � � � � � � � � � � � & * 5 9 D H O S ` ! d ! q " u " � # � # � � � � � � � � � � � � > � B � a � e � � � � � � � � � � � � � � � # 0 4 � � � � � � � � �hhKh�G��� ( -�H
� � ���oF FF� " ! � ��#��� � �(F � �h�!F � �F<`� Kh�GF<`�|h�L� � � �L F� � ��谈��
� � � � , � 2 � : Z � f � x ' � � < G | | _ �ElfBackupEventLogFileW > LogHandle A
A N 0 B
A V
E 7 | >{ BackupFileName A A P . D
E 7 |
>�^ Priv E | > RpcHandle A
6 A
V > status A @ A V
E | Z �^ �^
_ �^ @�"
:( $LN34 $LN32
u
u
u
u $LN10 $LN14 $LN13 $LN20@ElfBackupE 7 LogHandle 7 { BackupFileName �^ Priv status 9H �^ O � � | ` � P � S � Y �& i �0 p �6 q �8 u �B x �D { �P y �T � �V � �^ � �` [ �b � �� C F �ElfBackupEventLogFileW$filt$0 > LogHandle E 7 >{ BackupFileName E 7
>�^ Priv E > status E @�" $LN34 $LN32
u
u
u
u $LN22 $LN12 $LN9 7 LogHandle 7 { BackupFileName �^ Priv status 9
�^ O � ( ` � � y �, � 0 � f � j � v � z � � � � � � � � � � � � � � � � � � � � � � " � B � F � V � Z � w � { � � � � � � � � � � � � � � � � � & � * � 5 � 9 � D � H � O � S � ` � d � q � u � � � � � � � � � � � � � � � � � > � B � a � e � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � # � 0 � 4 � � � � � � � � � �hhKh�G��� ( -��I
� � ���oF
FF� " ! � � �P? j�$�� � � F � �x�+FBF1F � �F<`�
Kh�GF<`�|h�L� � � F� � ����� � � � 0 � 6 � B $ b � j � x ' � T 5 G | | _ �ElfChangeNotify > LogHandle A
A J 4 E ? | > Event A A L : A ^ E ? |
>�^ Priv E | > RpcHandle A
: $ A
^ >o ClientId C & 8 & C * 4 " C ^ C ^ > status A H A ^ E | M g^ N Z �^ �^ !_ �^ @�"
h g^
:@ $LN33 $LN31
u
u
u $LN8 $LN12 $LN11 $LN20@ElfChangeN ? LogHandle ? Event �^ Priv status 9P �^ O� � | `
t $ � * � 0 �* 7 �4 ? �: @ �< D �J F �L I �X G �\ O �^ R �f U �� � < F �ElfChangeNotify$filt$0 > LogHandle E ? > Event E ?
>�^ Priv E > status E @�" $LN33 $LN31
u
u
u $LN22 $LN10 $LN7 ? LogHandle ? Event �^ Priv status 9
�^ O � ( ` U � G �, � 0 � _ � c � o � s � � � � � � � � � � � � � � � � � � � � � � � & � * � : � > � a � e � y � } � � � � � � � � � � � � � � � � � � � � � _ f c f p g t g � h � h � l � l � m � m � t � t � u � u � v � v � w � w P � T � h � l � � � N � R � r � v � � � � � � � � � � f � f � g � g
h h l l ( m , m 3 p 7 p D q H q U r Y r � � � � � � � � �hhKh�G��� ( -�H
� � ���oF
FF� " ! � �� � � F � �h�)F � �F<`�
Kh�GF<`�|h�L� � � F� � ��谈 � � � & � , � 4 T � \ � h ' � � ; G l l �^ �ElfClearEventLogFileA > LogHandle A
A < & E 7 l >� BackupFileName A A > , A P E 7 l
>�^ Priv E l > RpcHandle A
0 A
P > status A : A P E l Z �^ �^ �^ �^ @�"
:( $LN29
u
u
u $LN8 $LN12 $LN11 $LN18@ElfClearEv 7 LogHandle 7 � BackupFileName �^ Priv status 9B �^ O � x l ` l � � � � � �* � �0 � �2 � �< � �> � �J � �N � �P � �X � �� � B F �ElfClearEventLogFileA$filt$0 > LogHandle E 7 >� BackupFileName E 7
>�^ Priv E > status E @�" $LN29
u
u
u $LN20 $LN10 $LN7 7 LogHandle 7 � BackupFileName �^ Priv status 9
�^ O� ( ` � � � �, � 0 � e � i � u � y � � � � � � � � � � � � � � � � � � � � � � � 5 � 9 � I � M � j � n � ~ � � � � � � � � $ � $ � % � % ) ) * * 1 " 1 . 2 2 2 ? 3 C 3 P 4 T 4 � � � � � � � � � � � � � � � � � � � � � � = � A � g $ k $ | % � % � ) � ) � * � * � - � - � . � . � / � / 4 � 8 � L � P � �hhKh�G��� ( -�H
� � ���oF
FF� " ! � �� � � F � �h�)F � �F<`�
Kh�GF<`�|h�L� � � F� � ��谈 � � � & � , � 4 T � \ � h ' � � ; G l l _ �ElfClearEventLogFileW > LogHandle A
A < & E 7 l >{ BackupFileName A A > , A P E 7 l
>�^ Priv E l > RpcHandle A
0 A
P > status A : A P E l Z �^ �^ _ �^ @�"
:( $LN29
u
u
u $LN8 $LN12 $LN11 $LN18@ElfClearEv 7 LogHandle 7 { BackupFileName �^ Priv status 9B �^ O � x l ` l � � �* �0 �2 �< ! �> $ �J " �N * �P - �X 0 �� � B F �ElfClearEventLogFileW$filt$0 > LogHandle E 7 >{ BackupFileName E 7
>�^ Priv E > status E @�" $LN29
u
u
u $LN20 $LN10 $LN7 7 LogHandle 7 { BackupFileName �^ Priv status 9
�^ O� ( ` 0 � " �, � 0 � e � i � u � y � � � � � � � � � � � � � � � � � � � � � � � 5 � 9 � I � M � j � n � ~ � � � � � � � � � � � � � � � � � � � � " � . 2 ? C P T � � � � � � � � � � � � � � � � � � � � � � = � A � g � k � | � � � � � � � � � � � � � � � � � � � � � � � 4 � 8 � L � P � �hhKh�G��� ( �-�H
� oFF=b � �8`��8F � �F|`� Kh�GF|`=j(F � ��<h �L F��]� � � � 2 � L ' � H 6 G P P �^ �ElfCloseEventLog > LogHandle A
A 0 A 0 E P > RpcHandle A
* " A
> B * > status A A > E P Z �^ �^ �^ @�" $LN29
u
u
u $LN8 $LN12 $LN11 $LN18@ElfCloseEv LogHandle RpcHandle status 9( �^ O� p P ` d � � � � � � � �" � �$ � �0 � �6 � �8 � �< � �> � �� � = F �ElfCloseEventLog$filt$0 > LogHandle E > RpcHandle B
> status E @�" $LN29
u
u
u $LN20 $LN10 $LN7 LogHandle RpcHandle status 9
�^ O � ( ` � � � �, � 0 � ` � d � p � t � � � � � � � � � � � � � � � � � � � � �
� � ! � % � 5 � 9 � s � w � � � � � � � � � � � � � � � � � � � � � � � � � � � � � D � H � \ � ` � � � � � 3 � 7 � W � [ � | � � � � � � � � � � � � � � � � � � � � � � � � � � � �
� [ � _ � t � x � �hhKh�G��� ( -��K
� F�FFFO�( �th �t��D �lh �l��D:Kh�G=KBF!h�GF ,c�g` �P?��? �# � #�` /O�/!�/K� '��sh{��(#as���1F�*K� h�Gr�#iD�a}�khk��i��(�ak��!K � '��sh{��(#as���1F�K� h�Gr�#iD�a}�khk��i��(�ak��K��h)F� �G����cb K#`�Kh�GK"F !h�G $ F���� CflE / 2 1 0 $ 3 � l 9 G ( ( �^ �ElfCreateReconnInfo >�^ ApiType A
A � P > � V A >^ UNCServerName A
A
>^ ModuleName A A >t IsSecurityLog A
A > RpcHandle E E >�^ recInfo A : � A >" structSize A � M g^ @ N B!
h g^ $LN34
u
u
u
u
u
u �^ ApiType ^ UNCServerName ^ ModuleName t IsSecurityLog RpcHandle 9, �^ 96 �^ ^6 �^ 9| �^ 9� �^ 9� �^ 9� �^ 9 �^ O� P ( ` ' D � �
� � � � � �$ � �( � �: � �> � �@ � �R � �^ � �f � �l � �n � �p � �~ � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � �, � 0 � a � e � q � u � � � � � � � � � � � � � � � � � � � � � � " � . � 2 � V � Z � j � n � � � � � � � � � � � � � � � # � ' � 2 � 6 � A � E � P � T � _ � c � n � r � � � � � � � � � ( � , � 8 � < � H � L � X � \ � h � l � � � � � -� H�FH�� � � � � = G m^ �ElfDeregisterClusterSvc >{ UNCServerName A
B!
u { UNCServerName O� 0 ` $ L � P � Q �, � 0 � k � o � � � � � � � � � �-�H
� oFF=b � �8`��8F � �F|`� Kh�GF|`=j(F � ��<h �L F��]� � � � 2 � L ' � P > G P P �^ �ElfDeregisterEventSource > LogHandle A
A 0 A 0 E P > RpcHandle A
* " A
> B * > status A A > E P Z �^ �^ �^ @�" $LN29
u
u
u $LN8 $LN12 $LN11 $LN18@ElfDeregis LogHandle RpcHandle status 9( �^ O� p P ` d � � � � � � � �" � �$ � �0 � �6 � �8 � �< �> �� � E F �ElfDeregisterEventSource$filt$0 > LogHandle E > RpcHandle B
> status E @�" $LN29
u
u
u $LN20 $LN10 $LN7 LogHandle RpcHandle status 9
�^ O � ( ` � � �, � 0 � h � l � x � | � � � � � � � � � � � � � � � � � � � � � � � ) � - � = � A � { � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � L � P � d � h � � � � C � G � g � k � � � � � � � � � � � � � � � � � � � � � � � � � � � � � k � o � � � � � �hhKh�G��� ( -�H
� Fl�"h
K�B �K#`Kh�GK"F !h�G��� CdaBCflE, / 0 2 � @ G < < �^ �ElfDestroyReconnectionInfo > LogHandle A
A
" B!
u
u
u
u LogHandle 9 �^ 9& �^ O� @ < ` 4 � �
� � � � � �( � �, � 0 � j � n � z � ~ � � � � � � � � � � � � � � � � � � � � � � � � $ � -� H�FH�� �" � � � 6 G p^ �ElfFlushEventLog > LogHandle A
B!
u LogHandle O � 0 ` $ w � | � � �, � 0 � ` � d � � � � � � � � � -��K
� � ���oF�� F�F FF�@�� " ! � �� � � �L�(F � ���� �3FBF ! � �F<`�
Kh�GF<`�|h�L� � � F � � ���� � H � � & � 0 � < � L # l � t � � ' � > : G � � _ �ElfGetLogInformation > LogHandle A
A N < A h E ? � >" InfoLevel A A P : E ? � > lpBuffer A A R @ A h E ? � >" cbBufSize A
A T B A h E ? � >" pcbBytesNeeded A J 8 A h E E @ �
>�^ Priv E � > RpcHandle A
@ ( A
h > status A R A h E � Z �^ �^ _ �^ $ @�"
:, $LN34
u
u
u
u $LN12 $LN16 $LN15 $LN22@ElfGetLogI ? LogHandle ? " InfoLevel ? lpBuffer ? " cbBufSize @ " pcbBytesNeeded �^ Priv status 9Z �^ O � � � ` | _ � b �* g �4 m �6 � �: p �@ q �B u �T w �V z �b x �f � �h � �p � �� � A F �ElfGetLogInformation$filt$0 > LogHandle E ? >" InfoLevel E ? > lpBuffer E ? >" cbBufSize E ? >" pcbBytesNeeded E @
>�^ Priv E > status E @�" $LN34
u
u
u
u $LN24 $LN14 $LN11 ? LogHandle ? " InfoLevel ? lpBuffer ? " cbBufSize @ " pcbBytesNeeded �^ Priv status 9
�^ O � ( ` � � x �, � 0 � d � h � t � x � � � � � � � � � � � � � � � � � � � � � � � � # � 3 � 7 � G � K � k � o � { � � � � � � � � � � � � � � � � � � � � � � � � + � / � O � S � c � g � � � � � � � � � � � � � � S � S T T Y " Y - Z 1 Z < [ @ [ G b K b X c \ c i d m d z e ~ e : � > � T � X � � � G � K � o � s � � � � � � � � � � � � � � � 3 � 7 � ] S a S r T v T � Y � Y � Z � Z � [ � [ � ^ � ^ � _ � _ � ` � ` � � � � � � � � �hhKh�G ��� ( -� H�F� �Ch+��#�� # `0�� � � 6 G �^ �ElfGetModuleName > LogHandle A
" >t ModuleNameIsUnicodeString A >^ result A
J! LogHandle & t ModuleNameIsUnicodeString O � X ` L 5 � 9 � ; � > � C � F � I � L �, � 0 � ` � d � � � � � � � � � , � 0 � -� H�FF A���?�
hK�B�Hj � �� �CflE � � 8 G ( ( �^ �ElfGetTheRpcHandle > LogHandle A
A > result A
A
B!
u LogHandle O� X ( ` L � �
� � � �
� �, � 0 � b � f � r � v � � � � � � � � � � � � � � � -� H�F� � j�� � � � @ G �^ �ElfGetUseLegacyReportEvent > LogHandle A
J! LogHandle O� @ ` 4 � � � $ � % �, � 0 � j � n � � � � � -�H
� � ���oF FF� " ! � � �L�� � �(F � �h�!F � �F<`�
Kh�GF<`�|h�L� � � F� � ��谈�� �
� � � , � 2 � : & Z � b � p ' � � 8 G x x "_ �ElfNumberOfRecords > LogHandle A
A B 0 A V E 7 x >" NumberOfRecords A A D . E 7 x
>�^ Priv E x > RpcHandle A
6 A
V > status A @ A V E x Z �^ �^ #_ �^ @�"
:( $LN33 $LN31
u
u
u
u $LN9 $LN13 $LN12 $LN19@ElfNumberO 7 LogHandle 7 " NumberOfRecords �^ Priv status 9H �^ O� � x ` | � � � � � �" � �& � �0 � �6 � �8 � �B � �D � �P � �T � �V � �^ � �� � ? F �ElfNumberOfRecords$filt$0 > LogHandle E 7 >" NumberOfRecords E 7
>�^ Priv E > status E @�" $LN33 $LN31
u
u
u
u $LN21 $LN11 $LN8 7 LogHandle 7 " NumberOfRecords �^ Priv status 9
�^ O � ( ` � � � �, � 0 � b � f � r � v � � � � � � � � � � � � � � � � � � � � � � � 7 � ; � K � O � l � p � � � � � � � � � � � � � � � � � � � � � & � * � 5 � 9 � @ � D � P � T � a � e � r � v � � � � � � � � � � � � � � � # � ' � F � J � k � o � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �hhKh�G��� ( -�H
� � ���oF FF� " ! � � �L�� � �(F � �h�!F � �F<`�
Kh�GF<`�|h�L� � � F� � ��谈�� �
� � � , � 2 � : % Z � b � p ' � � 5 G x x _ �ElfOldestRecord > LogHandle A
A B 0 A V E 7 x >" OldestRecordNumber A A D . E 7 x
>�^ Priv E x > RpcHandle A
6 A
V > status A @ A V E x Z �^ �^ _ �^ @�"
:( $LN33 $LN31
u
u
u
u $LN9 $LN13 $LN12 $LN19@ElfOldestR 7 LogHandle 7 " OldestRecordNumber �^ Priv status 9H �^ O � � x ` | � � � � � �" � �& �0 �6 �8 �B �D �P �T �V �^ �� < F �ElfOldestRecord$filt$0 > LogHandle E 7 >" OldestRecordNumber E 7
>�^ Priv E > status E @�" $LN33 $LN31
u
u
u
u $LN21 $LN11 $LN8 7 LogHandle 7 " OldestRecordNumber �^ Priv status 9
�^ O � ( ` � �, � 0 � _ � c � o � s � � � � � � � � � � � � � � � � � � � � � � � 7 � ; � K � O � l � p � � � � � � � � � � x � x � y � y z z & � * � 5 � 9 � @ � D � P � T � a � e � r � v � � � � � � � � � � � � � � � ' � + � J � N � o � s � � x � x � y � y � z � z � � � � � � � � � � � � � � � � � � � � � � � � � � �hhKh�G��� ( �-�I
� oF���F:cF�bF�b����3�{� �+� �hh � #;`;F �#"1F � �F|`�Kh�GF|`�0��j�j , �;h � #2F)F � �� @�L� #� 0�<h �L F���� ]��
� � < h � � ' � o < G � � &_ �ElfOpenBackupEventLogA >� UNCServerName A
A l . < A X 4 & E ( � >� FileName A A p 2 < A X 4 & E , � >�V LogHandle A A t 6 < A X 4 & E 0 � > RpcHandle A
0 B @ P > > status A B < 2 A � E � >p ServerNameString A
* Z )_ �^ @�" $LN35
u
u
u
u $LN13 $LN17 $LN16 $LN23@ElfOpenBac ( � UNCServerName , � FileName 0 �V LogHandle RpcHandle status 9J �^ O � � � ` � [ � d �" i �( k �* l �, o �. r �2 v �D | �F �X � �\ � �p � �r � �t � �v � �| � �~ } �� f �� � �� 3 C F �ElfOpenBackupEventLogA$filt$0 >� UNCServerName E ( >� FileName E , >�V LogHandle E 0 > RpcHandle B
> status E @�" $LN35
u
u
u
u $LN25 $LN15 $LN12 ( � UNCServerName , � FileName 0 �V LogHandle RpcHandle status 9
�^ O � ( ` � � } �, � 0 � j � n � z � ~ � � � � � � � � � � � � � � � � � � � � � � � ) � - � 9 � = � M � Q � e � i � � � � � � � � � � � � � � � � � � � � � � � W 5 [ 5 l 6 p 6 { = = � > � > � ? � ? � F � F � G � G � H � H � I � I k � o � � � � � d � h � � � � � � � � � � � � � $ � E � I � o 5 s 5 � 6 � 6 � = � = � > � > � ? � ? � B � B � C � C � D � D g � k � � � � � �hhKh�G ��� ( �-�I
� oF���F:cF�bF�b����3���%�+�+�hh � #;`;F �#"1F � �F|`�Kh�GF|`�0��j�j , �;h � #2F)F � �� @�L� #� 0�<h �L F���� ]����
� � > ! j � � ' � � < G � � -_ �ElfOpenBackupEventLogW >{ UNCServerName A
A n 0 < A Z 4 & E ( � >{ BackupFileName A A r 4 < A Z 4 & E , � >�V LogHandle A A v 8 < A Z 4 & E 0 � > RpcHandle A
2 B B P > > status A D < 2 A � E � >q ServerNameString A
, Z 0_ �^ @�" $LN37 $LN35
u
u
u
u $LN13 $LN17 $LN16 $LN23@ElfOpenBac ( { UNCServerName , { BackupFileName 0 �V LogHandle RpcHandle status 9L �^ O� � � ` � � � � �" � �* � �, � �. � �0 � �4 � �F � �H � �Z � �^ � �r � �t � �v � �x � �~ � �� � �� � �� � �� P C F �ElfOpenBackupEventLogW$filt$0 >{ UNCServerName E ( >{ BackupFileName E , >�V LogHandle E 0 > RpcHandle B
> status E @�" $LN37 $LN35
u
u
u
u $LN25 $LN15 $LN12 ( { UNCServerName , { BackupFileName 0 �V LogHandle RpcHandle status 9
�^ O� ( ` � � � �, � 0 � j � n � z � ~ � � � � � � � � � � � � � � � � � � � � � � � / � 3 � ? � C � S � W � k � o � � � � � � � � � � � � � � � � � � � � � � # � ] a n r � � � � �
�
� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � " � B � F � g � k � � � � � � � � � �
�
� � � � � � � � � � � � �hhKh�G ��� ( -��K
� � ���oF���F�FF>aya�`�8 " ! � �� " ! � ��� _и� \и� 0 +X� �3� �th � $2I� /Kh�G #{`�+H � �8�%=`�8 � �� %=`� � �; �# ��AF F � �F�`
�Kh�GF�`=h>i����� � � ��8 � � , �zh �+FBF1F � �� @�L� #� 0�h �L F� � �����
� � � & � 2 � l | � � � � * � � � � � � � ' - � - 6 G $ $ 1_ �ElfOpenEventLogA >� UNCServerName E $ A
A � � R A � J 8 E o $ >� LogName E $ A A � � R A � J 8 E o $ >�V LogHandle A A � � R A � J 8 E o $ >t fIsSecurityLog A t 6 A � J 8 E $ > RpcHandle A
d E $ >� RegModuleName E $ >�^ BackPriv E $ > status A � R H A � E $ >�^ SecPriv E 8 $ >p ServerNameString A R T " Z 4_ �^ �^ �^ �^ �^ �^ T @�"
:X $LN45 $LN43
u
u
u
u
u
u
u $LN17 $LN21 $LN20 $LN28@ElfOpenEve o � UNCServerName o � LogName o �V LogHandle t fIsSecurityLog RpcHandle � RegModuleName �^ BackPriv status 8 �^ SecPriv 9` �^ 9� �^ O � $ ` � s � y �* z �6 � �J � �P � �R � �T � �V � �b � �f � �v � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � = F �ElfOpenEventLogA$filt$0 >� UNCServerName E E o >� LogName E E o >�V LogHandle E o >t fIsSecurityLog E > RpcHandle E >� RegModuleName E >�^ BackPriv E > status E >�^ SecPriv E 8 @�" $LN45 $LN43
u
u
u
u
u
u
u $LN30 $LN19 $LN16 o � UNCServerName o � LogName o �V LogHandle t fIsSecurityLog RpcHandle � RegModuleName �^ BackPriv status 8 �^ SecPriv 9
�^ O � ( ` � � � �, � 0 � h � l � x � | � � � � � � � � � � � � � � � � � � � � � � � � � � � & � * � J � N � Z � ^ � n � r � � � � � � � � � � � � � � � � � � � � � � ? � C � f � j � � � � � � � � � � � � � � � � � � � b a f a s b w b � c � c � m � m � n � n � o � o � p � p � q � q � r � r � y � y � z z { { | $ | � � ) � - � D � H � t � x � � � � � � � � � � � � � � � - � 1 � Z � ^ � � � � � � � � � � � � � � � � � � $ � J a N a [ b _ b p c t c m � m � n � n � o � o � p � p � q � q � r � r � u � u � v � v � w � w � � � �
�
� �hhKh�G ��� ( -��K
� � ���oF���FF�Fxa�a�` #{`�@ " ! � ��( " ! � ��� � . �2� *~и� и� 0+��@ � $DKh�o �qhSڲ:p;F�f #�f#;g #{gS �g "�g��0 #��0�X �5I3H# � � !� /Kh�G #{`qh+H � �8�%�`�@ � �� %�`�( � �; �# �� 1F F � �F<a
�Kh�GF<a�h���i� ��( � � ��@ � � , �zh �+F2FAF � �� @�L� #� 0�h �L F%� � �����
� � � * � 6 � � � � " � � � � � , � � 2 � R � d ' h l . p : t j x 7 � D 6 G | | 7_ �ElfOpenEventLogW >{ UNCServerName E | A
A 6� R A J 8 E � | >{ LogName E | A A 8� R A J 8 E � | >�V LogHandle A A :� R A J 8 E � | >t fIsSecurityLog A � 6 A J 8 E | > RpcHandle A
� � E | >} RegModuleName E | >�^ BackPriv E ( | > status A � R H A N E | >�^ SecPriv E @ | >q ServerNameString A ` � M �^ v
Z �^ >/ _Arg0 A t E | >�^ EventData E X | M q^ �� & >" DataSize A
� N M q^ v ( N N" Z 8_ �^ �^ �^ �^ �^ �^ � @�" h q^ �^
:� $LN55 $LN53
u
u
u
u
u
u
u
u
u $LN19 $LN23 $LN22 $LN36@ElfOpenEve � { UNCServerName � { LogName � �V LogHandle t fIsSecurityLog RpcHandle } RegModuleName ( �^ BackPriv status @ �^ SecPriv 9� �^ 9� �^ O� | ` � � � �" � �. � �: � �N � �\ � �` � �b � �d � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � �" �&
�: �< �> �@ �F �H � �L � �N �� � = F �ElfOpenEventLogW$filt$0 >{ UNCServerName E E � >{ LogName E E � >�V LogHandle E � >t fIsSecurityLog E > RpcHandle E >} RegModuleName E >�^ BackPriv E ( > status E >�^ SecPriv E @ @�" $LN55 $LN53
u
u
u
u
u
u
u
u
u $LN38 $LN21 $LN18 � { UNCServerName � { LogName � �V LogHandle t fIsSecurityLog RpcHandle } RegModuleName ( �^ BackPriv status @ �^ SecPriv 9
�^ O � ( ` � � �, � 0 � h � l � x � | � � � � � � � � � � � � � � � � � � � � � � � � � � � & � * � J � N � Z � ^ � n � r � � � � � � � � � � � � � � � � � � � � � � C � G � j � n � � � � � � � � � � � � � � � � � � � S � W � g � k � � � � � � � � � [ 4 _ 4 l 5 p 5 � 6 � 6 � A � A � B � B � C � C � D � D � E � E � F � F � G � G � H � H O O P P & Q * Q 7 R ; R 0 � 4 � @ � D � X � \ � � � � � � � � � � � � � � � ) � - � Q � U � ~ � � � � � � � � � � � � � � � � " � D � H � n 4 r 4 5 � 5 � 6 � 6 � A � A � B � B � C � C � D � D � E � E � F � F � G
G
H
H
K
K (
L ,
L 9
M =
M ' � + � @ � D � �hhKh�G ��� ( -��O
� � ���oF���F:`
F�F�l�P�� " ! � ��� 1І��� -��,)�D�� +$��� � �HF � ������� ��l:h)F � �F|`� Kh�GF|`�<h�L� � � �L F � � ����
� � � ( � T � Z � p � � � � � ' � � 6 G � � _ �ElfReadEventLogA > LogHandle A
A ~ ` r
A �
E G � >" ReadFlags A A � b t
A �
E G � >" RecordNumber A t & H E G � > Buffer A
A � f x
A �
E G � >" NumberOfBytesToRead E E H � >" NumberOfBytesRead A | ^ p
A �
E E L � >" MinNumberOfBytesNeeded A x Z l
A �
E E P �
>�^ Priv E � > RpcHandle A
^ . A
� >" FlagBits A
H A >
A
�
A � > status A v A �
E � Z �^ �^ _ �^ 0 @�"
:8 $LN37
u
u
u
u $LN14 $LN18 $LN17 $LN25@ElfReadEve G LogHandle G " ReadFlags G " RecordNumber G Buffer H " NumberOfBytesToRead L " NumberOfBytesRead # P " MinNumberOfBytesNeeded �^ Priv status 9~ �^ O � � � ` � N � R �, X �: a �> d �D i �H l �N t �X v �^ w �` { �x � �z � �� � �� � �� � �� n �� � �� _ = F �ElfReadEventLogA$filt$0 > LogHandle E G >" ReadFlags E G >" RecordNumber E G > Buffer E G >" NumberOfBytesToRead E H >" NumberOfBytesRead E L >" MinNumberOfBytesNeeded E P
>�^ Priv E > status E @�" $LN37
u
u
u
u $LN27 $LN16 $LN13 G LogHandle G " ReadFlags G " RecordNumber G Buffer H " NumberOfBytesToRead L " NumberOfBytesRead # P " MinNumberOfBytesNeeded �^ Priv status 9 �^ O � ( ` � � � �, � 0 � ` � d � p � t � � � � � � � � � � � � � � � � � � � � � � � + � / � C � G � d � h � t � x � � � � � � � � � � � � � � � � � � � . � 2 � F � J � Z � ^ � � � � � � � � � � � � � � � � � � � � � � � * � . � M � Q � ] � a � m � q � } � � � � � � � � � � � � � � � � � - � 1 � < @ K O Z ^ e i v
z
� � � � � � � � � � � � � � � � � � � � � � � � � " � C � G � u � y � � � � � � � � � � � � " � & � L � P � a � e � p t � � � � � � � �
�
� � � � � � � � ���hhKh�G���� ( -��O
� � ���oF���F:`
F�F�l�P�� " ! � ��� 1І��� -��,)�D�� +$��� � �HF � ������� ��l:h)F � �F|`� Kh�GF|`�<h�L� � � �L F � � ����
� � � ( � T � Z � p � � � � � ' � � 6 G � � _ �ElfReadEventLogW > LogHandle A
A ~ ` r
A �
E G � >" ReadFlags A A � b t
A �
E G � >" RecordNumber A t & H E G � > Buffer A
A � f x
A �
E G � >" NumberOfBytesToRead E E H � >" NumberOfBytesRead A | ^ p
A �
E E L � >" MinNumberOfBytesNeeded A x Z l
A �
E E P �
>�^ Priv E � > RpcHandle A
^ . A
� >" FlagBits A
H A >
A
�
A � > status A v A �
E � Z �^ �^ _ �^ 0 @�"
:8 $LN37
u
u
u
u $LN14 $LN18 $LN17 $LN25@ElfReadEve G LogHandle G " ReadFlags G " RecordNumber G Buffer H " NumberOfBytesToRead L " NumberOfBytesRead # P " MinNumberOfBytesNeeded �^ Priv status 9~ �^ O � � � ` � % � ) �, / �: 8 �> : �D ? �H A �N I �X K �^ L �` P �x X �z [ �� Y �� a �� d �� C �� g �� _ = F �ElfReadEventLogW$filt$0 > LogHandle E G >" ReadFlags E G >" RecordNumber E G > Buffer E G >" NumberOfBytesToRead E H >" NumberOfBytesRead E L >" MinNumberOfBytesNeeded E P
>�^ Priv E > status E @�" $LN37
u
u
u
u $LN27 $LN16 $LN13 G LogHandle G " ReadFlags G " RecordNumber G Buffer H " NumberOfBytesToRead L " NumberOfBytesRead # P " MinNumberOfBytesNeeded �^ Priv status 9 �^ O � ( ` g � Y �, � 0 � ` � d � p � t � � � � � � � � � � � � � � � � � � � � � � � + � / � C � G � d � h � t � x � � � � � � � � � � � � � � � � � � � . � 2 � F � J � Z � ^ � � � � � � � � � � � � � � � � � � � � � � � * � . � M � Q � ] � a � m � q � } � � � � � � � � � � � � � � � � � - � 1 � < � @ � K � O � Z � ^ � e � i � v � z � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � " � C � G � u � y � � � � � � � � � � � � " � & � L � P � a � e � p � t � � � � � � � � � � � � � � � � � � � � � � � � � � � � ���hhKh�G���� ( �-�H
� ��oF��F�b #;` ,_�"h6K�B[� �P?��? +Uѣh +R� !� -Kh�G !� )Kh�Gch[�+ �+�+�#H.�;F�# ��� i � �"�;F�# ��� i � ��;F�# ��� i � �
�;F�# ��� i � �x`�Kh�Gx`�j (8h�`b�8h � ���]� � � CflEt ) � * � + � , � ' � - � . � I 2 G � � �^ �ElfReconnect > LogHandle A
A � � A �
E ( � >} RegModuleNameW E � >� RegModuleNameA E � > RpcHandle A
A
� B ( � � � > status " A
` r 2 J d E � M g^ $ N Z �^ �^ �^ �^ @�"
h g^ $LN48
u
u
u
u
u
u $LN20 $LN24 $LN23 $LN34@ElfReconne ( LogHandle } RegModuleNameW � RegModuleNameA RpcHandle status 9@ �^ 9L �^ 9� �^ O � � � ` � O � U � Z �$ ` �6 h �B i �N m �^ � �b � �x � �z � �� � �� z �� � �� p �� � �� � �� � �� � �� � �� � �� � �� U 9 F �ElfReconnect$filt$0 > LogHandle E ( >} RegModuleNameW E >� RegModuleNameA E > RpcHandle B
> status E @�" $LN48
u
u
u
u
u
u $LN36 $LN22 $LN19 ( LogHandle } RegModuleNameW � RegModuleNameA RpcHandle status 9
�^ O � ( ` � � � �, � 0 � \ � ` � l � p � � � � � � � � � � � � � � � � � � � & � * � 6 � : � _ � c � � � � � � � � � � � � � � # � . � 2 � = � A � L � P � W � [ � h � l � y � } � � � � � % � ) � 5 � 9 � E � I � ` � d � P � T � � � � � � � � � � � � � �
� . � 2 � X � \ � m � q � | � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � u � y � � � � � �hhKh�G ��� ( -� H�FH�� � � � 6 ; G u^ �ElfRegisterClusterSvc >{ UNCServerName A
>" pulSize A >r^ ppPackedEventInfo A B!
u { UNCServerName " pulSize r^ ppPackedEventInfo O � 0 ` $ ? � E � F �, � 0 � i � m � � � � � � � � � � � � � L � P � �-��I
� ��oF���F�cF~cF=cڳֳ3�ó �+� �lh � $ I� Kh�G #;`;F�# ��1F F � �F|`�Kh�GF|`�8�~k=k , �;h � #2F)F � �� @�L� #� 0�<h �L F���� ]��
� � P ) | � � ' � - � � � = G � � *_ �ElfRegisterEventSourceA >� UNCServerName A
A ~ @ < A l 4 & E 0 � >� ModuleName A A � D < A l 4 & E 4 � >�V LogHandle A A � H < A l 4 & E 8 � > RpcHandle A
> B : j X >� RegModuleName E � > status A V < 2 A � E � >p ServerNameString A , * Z �^ �^ @�" $LN37
u
u
u
u
u
u $LN13 $LN17 $LN16 $LN23@ElfRegiste 0 � UNCServerName 4 � ModuleName 8 �V LogHandle RpcHandle � RegModuleName status 9: �^ 9^ �^ O � � � ` � � � �$ �* �,
�.
�0 �< �@ �X �Z ! �l & �p ( �� , �� . �� 0 �� 3 �� 6 �� �� �� 7 �� � D F �ElfRegisterEventSourceA$filt$0 >� UNCServerName E 0 >� ModuleName E 4 >�V LogHandle E 8 > RpcHandle B
>� RegModuleName E > status E @�" $LN37
u
u
u
u
u
u $LN25 $LN15 $LN12 0 � UNCServerName 4 � ModuleName 8 �V LogHandle RpcHandle � RegModuleName status 9
�^ O � ( ` 7 � �, � 0 � k � o � { � � � � � � � � � � � � � � � � � � � � � � � � , � 0 � < � @ � P � T � h � l � � � � � � � � � � � � � � � � � �
� � ! � H � L � � J � J � K � K � R � R � S � S � T � T � U � U � V � V � ] � ] ^ ^ _ _ $ ` ( ` � � � � � � � � � � � � � � 2 � 6 � [ � _ � � � � � � � � � � � � � � � � � " J & J 7 K ; K F R J R U S Y S d T h T s U w U � V � V � Y � Y � Z � Z � [ � [ V � Z � p � t � �hhKh�G ��� ( -��I
� � ���oF���FFF=a~a�` *^� .\�2� *Y�%�+�+�lh � $3Kh�o�qhSڲ:p;F;c #{c#�c #�cS 9d "zd�d #�d� �$I#H# � � !� Kh�G #{`; �# ��1F F � �F�`�Kh�GF�`=i~i�� , �{h � #2F)F � �� @�L� #� 0�h �L F� � �����
� � � v � � + � � � � � ' � . : g 7 � = = G 5_ �ElfRegisterEventSourceW >{ UNCServerName E A
A � � < A � 8 & E o >{ ModuleName E A A � � < A � 8 & E o >�V LogHandle A A � � < A � 8 & E o > RpcHandle A
� E >} RegModuleName E > status A � < 2 A � E >q ServerNameString A 6 j M �^ L
Z �^ >/ _Arg0 A J E >�^ EventData E M q^ ^ & >" DataSize A
^
N M q^ L ( N N Z �^ �^ X @�" h q^ �^
:l $LN49 $LN47
u
u
u
u
u
u
u
u $LN15 $LN19 $LN18 $LN31@ElfRegiste o { UNCServerName o { ModuleName o �V LogHandle RpcHandle } RegModuleName status 9� �^ 9� �^ O � � ` � A � K �, P �4 R �6 S �8 V �: Y �z [ �� _ �� h �� o �� r �� w �� y �� } �� �� � �� � �� � �� p �� M �� � �� � D F �ElfRegisterEventSourceW$filt$0 >{ UNCServerName E E o >{ ModuleName E E o >�V LogHandle E o > RpcHandle E >} RegModuleName E > status E @�" $LN49 $LN47
u
u
u
u
u
u
u
u $LN33 $LN17 $LN14 o { UNCServerName o { ModuleName o �V LogHandle RpcHandle } RegModuleName status 9
�^ O � ( ` � � p �, � 0 � o � s � � � � � � � � � � � � � � � � � � � � � � � � � � � � 0 � 4 � T � X � d � h � x � | � � � � � � � � � � � � � � � � � � � - � 1 � A � E � l � p � � � � � � � � � � � � � / � 3 � � � � � � � � # � # � $ � $ � % % & & ' ' * ( . ( 9 ) = ) D 0 H 0 U 1 Y 1 f 2 j 2 w 3 { 3 ) � - � 9 � = � T � X � D � H � � � � � � � � � � � � � � � � � � � / � 3 � [ � _ � � � � � � � � � � � � # � # � $ � $ � % % & & ' ' * ( . ( 9 ) = ) D , H , U - Y - f . j .
� � ( � , � �hhKh�G ��� ( �-��O
� � ���oF��{`��0�`��� �`����F�d��0;a�d��0{a;e��0�a{e��0�a�e��0�b{c #�c�c;c�8 bKh�G#;d #;f{f�f�f�@�` YKh�G � ��Fxd ��`SKh�GPL@F � �F�b�� � &�� `>b�������9`�� -w�� �� ���(F�h~��i��i�{i�;i�{h ��8�h � ��j ��i��i�{i�;i�{h ��h9k � �F|b�� 9h$�,Kh�GF|b������ ���9`��0{`���0�`���0�`>j�D��j�H��l;a;m{a{m�a�m�a{k�bK�B�@F � �F�b�K�Bю��0�8 Kh�G�� �#� 0&>b|j9h�� %�b��|k�HF � � F&� � ����]�� . � � �
� � � � �
v � � � � � � ' � - � � � 5 G � � <_ �ElfReportEventA > LogHandle E H � A
( A ( � A �
f J � E � � >! EventType E � A d A � B E � � >! EventCategory E � A d A
� & E � � >" EventID E � A
. � � E � � > UserSid E � E L � A
. � � � E E � � >! NumStrings E � A " � � " A � � 2 V Z � � � E E � � >" DataSize E E � � >9_ Strings E � E P � A
6 � � � E E � �
> Data E � E T � A
> � � � E E � � >! Flags E E � � >" RecordNumber E � E X � A
F � � � E E � � >" TimeWritten E , � A
N � � E E � � >t fUseLegacyReportEvent A � � � A �
f J � � E � > RpcHandle A � � � . A �
f J � � E ( � >" nSize A
f E @ � >�> szComputerNameA E ` � >� pComputerNameA A � 4 A �
f J � E D � >" EventTime E 0 � > status A
� $ A �
� A �
8 Z � �
E $ �
>� Time C
T E 8 � M �^ �� F
N M �^ ��
N Z =_ �^ C_ F_ �^ G_ � @�" h �^ �^
:\ $LN61
u
u
u
u
u
u
u
u
u $LN15 $LN19 $LN18 $LN44@ElfReportE � LogHandle � ! EventType � ! EventCategory � " EventID � UserSid � ! NumStrings � " DataSize � 9_ Strings � Data � ! Flags � " RecordNumber � " TimeWritten " t fUseLegacyReportEvent ( RpcHandle @ " nSize ` �> szComputerNameA D � pComputerNameA 0 " EventTime $ status 8 � Time 9b J_ 9� M_ 9� �^ 9( �^ 9� P_ O� ( � ` " � �R � �X � �Z � �d � �h � �r � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� �� � �$ �n �t ! �~ " �� # �� ) �� * �� + �� , �� � �� 0 �� 2 �� �� 4 �� 7 �� ] < F �ElfReportEventA$filt$0 > LogHandle E H E � >! EventType E E � >! EventCategory E E � >" EventID E E � > UserSid E E L E � >! NumStrings E E � >" DataSize E � >9_ Strings E E P E �
> Data E E T E � >! Flags E � >" RecordNumber E E X E � >" TimeWritten E , E � >t fUseLegacyReportEvent E > RpcHandle E ( >" nSize E @ >�> szComputerNameA E ` >� pComputerNameA E D >" EventTime E 0 > status E $
>� Time E 8 @�" $LN61
u
u
u
u
u
u
u
u
u $LN46 $LN17 $LN14 � LogHandle � ! EventType � ! EventCategory � " EventID � UserSid � ! NumStrings � " DataSize � 9_ Strings � Data � ! Flags � " RecordNumber � " TimeWritten " t fUseLegacyReportEvent ( RpcHandle @ " nSize ` �> szComputerNameA D � pComputerNameA 0 " EventTime $ status 8 � Time 9 �^ O � ( ` 7 � �, � 0 � c � g � s � w � � � � � � � � � � � � � � � � � � � � � � � � � � � ; � ? � K � O � [ � _ � s � w � � � � � � � � � � � � � � � � � � � � � � + � / � ? � C � h � l � x � | � � � � � � � � � � � � � � � � � � � ) � - � = � A � M � Q � i � m � } � � � � � � � � � � � � � � � � � � � � � � � � � , � 0 � W � [ � k � o � { � � � � � � � � � � � � � � � � � � � � � � � A � E � Y � ] � y � } � � � � � � � � � � � � � � � � � �
� 7 � ; � ` � d � p � t � � � � � � � � � � � � � � � � � � � ! � % � D � H � X � \ � � � � �
� � � � + � / � : � > � I � M � X � \ � g � k � v � z � � � � � � � � � � � � � � � � � � � � � �
� �
� �
� �
� �
� �
� �
� �
� � � � � l � p � � � � � � � � � � � � � � � � � &
� *
� :
� >
� `
� d
� t
� x
� �
� �
� �
� �
� �
� �
� �
� �
� �
� � & � * � L � P � ` � d � t � x � � � � � � � � � � � � � � � � � � � " � & � 6 � : � ` � d � t � x � � � � � � � � � � � � � " � & � O � S � w � { � � � � � � � � � � � � � � � �
� � � � + � / � : � > � I � M � X � \ � g � k � v � z � � � � � � � � � � � � � � � � � � � � � ���hhKh�G
���� ( -� H�FH�� � � � > G y^ �ElfReportEventAndSourceW > LogHandle A
>" EventTime A >{ pComputerNameU A >! EventType A
>! EventCategory E E >" EventID E E > UserSid E E >{ UNCSourceName E E >! NumStrings E E >" DataSize E E >v^ Strings E E
> Data E E $ >! Flags E E ( >" RecordNumber E $ E , >" TimeWritten E ( E 0 B!
u LogHandle " EventTime { pComputerNameU ! EventType ! EventCategory " EventID UserSid { UNCSourceName ! NumStrings " DataSize v^ Strings $ Data ( ! Flags , " RecordNumber 0 " TimeWritten O � 0 ` $ 7 � I � J �, � 0 � h � l � � � � � � � � � � � � � � � � � ? � C � S � W � y � } � � � � � � � � � � � � � � � � �
� � 1 � 5 � E � I � k � o � � � � � � � � � � � � � � � � � � � � � � - � 1 � W � [ � k � o � � } � } � � �-��O
� � ���oF���`� 1:a��!ya��F>e� 1�a{e�,1�a�e�01;b�e�81{b;f�<1;c�c #;d{d{c��L ��@ �Kh�G#�d�� " ! � ��H�� �Kh�G � ��F�d ( ����Kh�G|L0F � �F�b� ��8�sh+�# � # +sKh ��oAбi��۲Z:p;F�g #�g#��0 #��0S �� "�� ��0 #��0�haI ��o вi��ٲ9q; ��0 #��0#��0 #��0�� ��0����0�PI �# "MH � ���4���$�`�(! -wй� � �� ���(Fzi�{j�;j��i��i��h ��@;i � ��;k �{j�;j��i��i��h �;iyk � �F�b�(!�h$�.Kh�GF�b��4��(!��$�`� 1�`��1;a��1{a�8��L��j>m{m�a�m�a�m;b;n{b�k;cK�B�0F � �F�b�K�Bѹ�
��4�@ Kh�G#3b�F�c�j�h�� %�b��k�@F � � �L FD� � ����]���� � . � � �
� v � � � � R � � � � Z f � x � ' � : � a � d � 7 � . � � � �
5 G � � S_ �ElfReportEventW > LogHandle E P � A
( A ( :8 A ` j J � E � >! EventType E � A j A | B A b E � >! EventCategory E � A j A
� & A b E � >" EventID E � A
�. b� E � > UserSid E � E T � A
. � Vb E E � >! NumStrings E � A � � � " A ` � 6 Z Z � � � E E $ � >" DataSize E E ( � >v^ Strings E � E X � A
6 z JV E E , �
> Data E � E \ � A
> n >J E E 0 � >! Flags E E 4 � >" RecordNumber E $ � E ` � A
F b 2> E E 8 � >" TimeWritten E 0 � A
N V L E E < � >t fUseLegacyReportEvent A � �� � A ` j J � � E 8 � >� szComputerNameU E � � > RpcHandle A � �� � x* A ` j J � � E , � >" nSize A
l E H � >" EventTime E 4 � > status A
� $ A � �
� A ` < ^ � �
E ( � >{ pComputerNameU A � �� A ` j J � E L �
>� Time C
T C
b E @ � >t fWide A
� M �^ �� N M �^ ��
" N M �^ �� >/ _Arg0 E � >�^ EventData E h � M q^ �� * >" DataSize A
� N M q^ �� ( N N M �^ �
Z �^ >/ _Arg0 A 0 E � >�^ EventData E � � M q^ �4 ( N M q^ � , N N M �^
�@ N Z =_ �^ W_ Z_ �^ G_ @�" h q^ �^ �^ �^ �^ �^
: $LN97 $LN95
u
u
u
u
u
u
u
u
u
u
u
u
u
u $LN23 $LN27 $LN26 $LN73@ElfReportE LogHandle ! EventType ! EventCategory " EventID UserSid $ ! NumStrings ( " DataSize , v^ Strings 0 Data 4 ! Flags 8 " RecordNumber < " TimeWritten " 8 t fUseLegacyReportEvent � � szComputerNameU , RpcHandle H " nSize 4 " EventTime ( status L { pComputerNameU @ � Time 9h J_ 9� ]_ 9� �^ 9� �^ 9> P_ O � p � ` + d � �R � �X � �Z � �\ � �` � �j � �n � �z � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � �` � �h � �~ � �� � �� � �� �� � �
�$ �& �2 �@ �D �H �J � �N �R �T �X �^ " �` � �b # �� � < F �ElfReportEventW$filt$0 > LogHandle E P E >! EventType E E >! EventCategory E E >" EventID E E > UserSid E E T E >! NumStrings E E $ >" DataSize E ( >v^ Strings E E X E ,
> Data E E \ E 0 >! Flags E 4 >" RecordNumber E $ E ` E 8 >" TimeWritten E 0 E < >t fUseLegacyReportEvent E 8 >� szComputerNameU E � > RpcHandle E , >" nSize E H >" EventTime E 4 > status E ( >{ pComputerNameU E L
>� Time E @ @�" $LN97 $LN95
u
u
u
u
u
u
u
u
u
u
u
u
u
u $LN75 $LN25 $LN22 LogHandle ! EventType ! EventCategory " EventID UserSid $ ! NumStrings ( " DataSize , v^ Strings 0 Data 4 ! Flags 8 " RecordNumber < " TimeWritten " 8 t fUseLegacyReportEvent � � szComputerNameU , RpcHandle H " nSize 4 " EventTime ( status L { pComputerNameU @ � Time 9 �^ O � ( ` # � �, � 0 � c � g � s � w � � � � � � � � � � � � � � � � � � � � � � � � � � ' � + � S � W � c � g � s � w � � � � � � � � � � � � � � � � � � � � � � � ' � + � 7 � ; � S � W � g � k � � � � � � � � � � � � � � � � � � � � � � � + � / � Q � U � e � i � u � y � � � � � � � � � � � � � � � � � � � � � � � � � @ � D � T � X � � � � � � � � � � � � � � � � � � � � � � �
� � % � ) � 9 � = � i � m � } � � � � � � � � � � � � � � � � � / � 3 � O � S � c � g � � � � � � � � � � � � � � � � � � � � % � ) � 9 � = � Y � ] � | � � � � � � � � � � � � � � � D � H � l � p � � � � � � � + � / � S � W � #
~ '
~ 4
8
I
� M
� X
� \
� g
� k
� v
� z
� �
� �
� �
� �
� �
� �
� �
� �
� �
� �
� �
� �
� �
� �
� �
� �
� �
� � � � � � ( � , � 9 � = � J � N � K
� O
� [
� _
� k
� o
� {
�
� �
� �
� �
� �
� < � @ � z � ~ � � � � � � � � � � � � � � � � �
� � 0 � 4 � D � H � j � n � ~ � � � � � � � � � � � � � � � � � � � � � 0 � 4 � D � H � g � k � { � � � � � � � � � � � � � � � � � � �
� 0 � 4 � D � H � x � | � � � � � � � � � � � � � � � ? � C � l � p � � � � � � ~ � ~ � � � � � � � � � � � � � � � � � * � . � 9 � = � H � L � W � [ � f � j � u � y � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � ���hhKh�G
���� ( -�0H
� F*h K�B��h;�L)| �hh$h"�G�h � � � #+`��0��� AvrP* 4 8 5 � � > G @ @ �^ �ElfRevertThreadPrivilege
>�^ p A
A
,
Z �^ B! $LN11
u
u �^ p 9$ �^ O � X @ ` L J �
L � N � P �& S �* U �. X �2 Y �, � 0 � ` � d � p � t � � � � � � � � � � � � � � � � � � � -� H�F �b�� � � � @ G
�^ �ElfSetUseLegacyReportEvent > LogHandle A
>t UseLegacyReportEvent A J! LogHandle ! t UseLegacyReportEvent O � 8 ` , ( � , � 1 �
2 �, � 0 � j � n � � � � � � � -� H�FH�� � � � D ; G k^ �ElfWriteClusterEvents >{ UNCServerName A
>" ulEventInfoSize A >h^ pPackedEventInfo A B!
u { UNCServerName " ulEventInfoSize h^ pPackedEventInfo O� 0 ` $ X � ^ � _ �, � 0 � i � m � � � � � � � � � � � � � X � \ � -� H�F #�� ��#�� � � 9 G q^ �EventDataDescCreate >: EventDataDescriptor A
> DataPtr A >" DataSize A J! : EventDataDescriptor DataPtr " DataSize O � 8 � , & � ' � ( � + �, � 0 � m � q � � � � � � � � � 4 � 8 � -��H
� � (`� )I�)\�� !��( a�Ca��a ��a#CbC� +L�'Ck��( [\�B �¹k��� ET��i�Ci+@C ���&��B�ѴB� " �"L *�j� ��R�$0�+C��CB�$0C�I �B��� #Cb��(0��3��3C�S�Z ��c[�j[ � ! � ����� � � o < G � � _ �McGenControlCallbackV2 >j SourceId A
>" ControlCode A � � A � > Level A � 8 n A 8 � � ># MatchAnyKeyword E E � ># MatchAllKeyword E E � >� FilterData E E ( � > CallbackContext E E , � >" Ix A � A � M �^ 8( ># Keyword C P " C P ( C x C x N B!
h �^ j SourceId " ControlCode Level # MatchAnyKeyword # MatchAllKeyword ( � FilterData , CallbackContext O � � � � � n � v � z � ~ � � �8 � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �, � 0 � e � i � � � � � � � � � � � � � � � � � � � � � G � K � [ � _ � � � � � � � � � � � � � � � � � � � � � � � M � Q � a � e � u � y � � � � � � � � � -�0H
� �� T,C� �L$h�G��0��� � � � I G $ $ �^ �McGenEventRegister_EtwEventRegister >j ProviderId A
>�^ EnableCallback A A > CallbackContext A A ># RegHandle A
A
>" Error A
B! $LN9
u j ProviderId �^ EnableCallback CallbackContext # RegHandle 9 �^ O� @ $ � 4 O � R � T � X � \ �, � 0 � t � x � � � � � � � � � � � � � � � � � � � � � ; � ? � e � i � y � } � � � � � � � -�H
� F�� P�� �Kh�G #�� 3��� ( � � � M G , , �^ �McGenEventUnregister_EtwEventUnregister ># RegHandle A
A
>" Error A
B!
u # RegHandle 9 �^ O� H , � < w �
z � | � � � � �$ � �, � 0 � w � { � � � � � � � � � � � � � � � � � � � -�H
� F�h
��F.� %�� U��U� %�� e3��`#�`�LF8h
Fyh$h�� ��G���� H � � K G L L �^ �McGenEventWrite_EtwEventWriteTransfer >�^ Context A
A
> >E Descriptor A 8 >j ActivityId A 6 >" EventDataCount A
A 2 >�^ EventData E E ( H >\ Traits A < B!
u ' �^ Context ' E Descriptor ' j ActivityId ' " EventDataCount ( �^ EventData 9@ �^ O � p L � d
�
� � � � � �$ �( �, �B # �, � 0 � s � w � � � � � � � � � � � � � � � � � �
� . � 2 � B � F � c � g � � � � � � � 4 � 8 � -�H
� ��(@�B ٌ�R��i�Ai@!C���
@@�BуB� � ��� � � > G @ < �^ �McGenLevelKeywordEnabled >�^ EnableInfo A
* A
6 > Level A A 6
># Keyword A A
C , C
. C 6
C
6
J! �^ EnableInfo Level # Keyword O� H @ � < � � " �6 ) �: % �< * �, � 0 � i � m � y � } � � � � � � � � � � � � � � � � � � � � � � � � # � 3 � 7 � � � � � �-�H
� � �����
� $ #��� 2
�$�� � $��P # " � � �� � ���]��
� 6 � < � � L G H : �^ �McTemplateU0usr0_EtwEventWriteTransfer >�^ Context A
: >E Descriptor A : >/ _Arg0 A 4 E P : > _Arg1 A
>�^ EventData E : M q^ N' M q^
N
Z �^ 8 K!
h q^
:L H �^ Context L E Descriptor P / _Arg0 T _Arg1 �^ EventData O� � H � � r � w � y � w � y � w � y �" w �$ { �& w �( { �* w �, r �0 { �4 w �6 { �: | �, � 0 � t � x � � � � � � � � � � � � � � � � � � � ( � , � �-�H
� � ���
� # �S � �� # $
���$ ��#��P $ " � � �� � ���]��
� : � @ � � 8 L G L > �^ �McTemplateU0uzr0_EtwEventWriteTransfer >�^ Context A
> >E Descriptor A > >/ _Arg0 A 8 E P > >�% _Arg1 A
>�^ EventData E > M q^ >" DataSize A
N* M q^ N
Z �^ 8 K!
h q^
:L H �^ Context L E Descriptor P / _Arg0 T �% _Arg1 �^ EventData O� � L � � � � � � � � � � � � � � � �" � �$ � �& � �( � �* � �, � �. � �4 � �6 � �8 � �: � �> � �, � 0 � t � x � � � � � � � � � � � � � � � � � � � S � W � L � P � -� H�F �P�� � � V 2 G
g^ �NtCurrentTeb J! O � 0 8 $ < � = �
> �, � 0 � l � p � -� H�F)� IHKJ � ���H � � �� ��� � � ( : , � 0 � � � 4 G 4 4 6_ �WevtInitialize > DllBase A
A
>" Reason A A >�& Context A A Z �^ �^ B! $LN12
u
u
u DllBase " Reason �& Context O� X 4 ` L q � u �
w � x � y � { � ~ �" �, � 0 � \ � ` � p � t � � � � � � � � � � � � � � � � � � � * � . � 9 � = � H � L � � � � � )`? � `? � `? � `? � `? � `? � � % � � � 0D� �������� ��� � � � $ � ( � � " %
R �3������ ��� �
$ � + ` 7 0D���������� �� � " ! $ ( � 4 ` / 2 0D���������� �� � 3 2 $ / ( 1 � = `P� D H 03�������� � H G D $ F � F `P� [ R �3��������� � _ ^ [ $ ] � O `P� w � 0D�������� ��� � { z $ w ( y `? � � [ % � � 90D�:�������� ��� � � � $ � ( � � d % � R �3������ ��� � � � � $ � � m ` � $ 03������ � � � � $ � � v ` � $ 03������ � � � � $ � � ` � 7 0D���������� �� � � � $ � ( � � � ` � 2 0D���������� �� � $ � ( � � � `P� I 03�������� � $ � � `P� . w 0D�������� �� � 2 1 $ . ( 0 � � `P� M � 0D�#������� ��� � Q P $ M ( O � � `P� ` > 0D�������� ��� � d c $ ` ( b � � ` r 9 0D�������� �� � v u $ r ( t � � ` � 5 0D���������� �� � � � $ � ( � � � ` � 5 0D���������� �� � � � $ � ( � Y`0� � � � `P� � t �3��������� � � � � $ � A`? � `? � %`? � I`? � b5 � � M`? � m`1 � �`1 � � � & 0D�������� �� � � � $ 0D�������� �� � Q`0� � =`1 � � � � �a3 � �`0� � �
�^ EVENTLOG_Context : : � / -
^_ Microsoft_Windows_EventlogLevels = = � 1 /
__ Microsoft_Windows_EventlogKeywords @ @ �
B EVENT_LOG_FULL C C � % #
B EVENT_AUDIT_PROCESSING F F � . ,
B EVENT_AUDIT_PUBLISHER_META_DATA I I � "
B EVENT_AUDIT_FAILURE L L � & $
B EVENT_AUDIT_AUTO_BACKUP O O � # !
B EVENT_AUDIT_LOG_FULL R R � 4 2
B EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL U U � & $
B EVENT_AUDIT_LOG_CLEARED X X � ) '
B EVENT_AUDIT_EVENTS_DROPPED [ [ �
B EVENT_SHUTDOWN ^ ^ � % #
B EVENT_REPORTEVENT_ANSI a a �
B EVENT_REPORTEVENT d d � ( &
B EVENT_REGISTEREVENTSOURCE g g � !
B EVENT_OPENEVENTLOG j j � # !
B EVENT_PULLSUB_CREATE m m � # !
B EVENT_PUSHSUB_CREATE p p � 4 2
B EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY s s � 4 2
B EVENT_PUBLISHER_TLG_INVALID_META_DATA v v � & $
B EVENT_ABNORMAL_SHUTDOWN y y �
B LOG_DROPPED_CHUNK | | �
B EVENT_AUTO_BACKUP �
B EVENT_LOG_CLEARED � � � # !
B EVENT_EVENTS_DROPPED � � � ( &
B EVENT_PUBLISHER_META_DATA � � �
B EVENT_PROCESSING � � � / -
B CHANNEL_POLICY_APPLICATION_ERROR � � � 4 2
B PRIMARY_CHANNEL_CONFIGURATION_WARNING � � � 4 2
B INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE � � � * (
B PRIMARY_CHANNEL_FATAL_ERROR � � � - +
B INIT_CHANNEL_LOGFILTER_WARNING � � � + )
B INIT_CHANNEL_LOGFILE_WARNING � � � 9 7
B INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG � � � - +
B INIT_CHANNEL_MOVED_CORRUPT_LOG � � � # !
B INIT_CHANNEL_LOGGING � � � & $
B INIT_CHANNEL_PUBLISHING � � � ( &
B INIT_CHANNEL_CONFIG_ERROR � � �
B INIT_CHANNEL � � �
� EVENTLOG � � R gN �٤%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\arm\precomp.obj 'D NtCurrentTeb ���
9Z
� { " h^ i^ " j^ ElfWriteClusterEvents �� � " l^ ElfDeregisterClusterSvc
n^ o^ ElfFlushEventLog ��� �X EventDataDescCreate
h^
� { " r^ s^ " t^ ElfRegisterClusterSvc ��
{
� B " { ! ! " { ! " v^ ! " " w^ & x^ ElfReportEventAndSourceW ���6 � tagStringStorage .?ATtagStringStorage@@ ��
W
� A 6 {^ tagStringStorage .?ATtagStringStorage@@ ��2 onecore\admin\wmi\events\advapi\apistub.c �� |^ }^
z^
� t ^ �^ �^ ElfGetModuleName ��� t �^ & �^ ElfSetUseLegacyReportEvent � n^ & �^ ElfDestroyReconnectionInfo �
�
� " t �^
�^
� t n^ & �^ ElfGetUseLegacyReportEvent � n^ �^ ElfGetTheRpcHandle �B � tagPrivilegeStatus .?AUtagPrivilegeStatus@@ ��v
" Asserted �
" Privilege
t NeedsRevert ��
t PrivilegeAdjusted
WasEnabled ���B �^ tagPrivilegeStatus .?AUtagPrivilegeStatus@@ �� �^ }^
�^
�
�^ �^ & �^ ElfRevertThreadPrivilege ���
# " �^ 2 �^ McGenEventUnregister_EtwEventUnregister t � �^ RevertToSelf ��� " �^
�^
�
# " �^
�^
�
�B
� j �^ # " �^ . �^ McGenEventRegister_EtwEventRegister
�^
� F � _MCGEN_TRACE_CONTEXT .?AU_MCGEN_TRACE_CONTEXT@@ ��
# RegistrationHandle ���
# Logger ���
# MatchAnyKeyword ��
# MatchAllKeyword ��
" Flags
" $ IsEnabled
( Level
) Reserve ��
! * EnableBitsCount ��
" , EnableBitMask
K 0 EnableKeyWords ���
I 4 EnableLevel ��F �^ 8 _MCGEN_TRACE_CONTEXT .?AU_MCGEN_TRACE_CONTEXT@@ ��F onecore\admin\wmi\events\manifests\objfre\arm\EventLogEvents.h � �^ �^ �
�^
�
9
� �^ E j " �^ " �^ 2 �^ McGenEventWrite_EtwEventWriteTransfer �� # E j j " : " �^
�^
� �^ # �^ & �^ McGenLevelKeywordEnabled ��� �^ �^ & �^ ElfAssertThreadPrivilege ���
� �^
�^
� & o^ ElfDeregisterEventSource ���
Z
�
�^ �^ & �^ ElfrDeregisterEventSource ��
�^
�^
� t �]
�^
� o^ ElfCloseEventLog ��� �^ E / �% " �^ 2 �^ McTemplateU0uzr0_EtwEventWriteTransfer � 9 " 0 � �^ ElfrCloseEL � ApiElfOpenEventLogW �� ApiElfRegisterEventSourceW ��� ApiElfOpenBackupEventLogW ApiElfOpenEventLogA �� ApiElfRegisterEventSourceA ��� ApiElfOpenBackupEventLogA 2 t �^ tagElfApiType .?AW4tagElfApiType@@ � �^ }^ �^ ^ ^ t �^ �^ ElfCreateReconnInfo 6 � tagReconnInfo .?AUtagReconnInfo@@ �
" Signature
�^ ApiType ��
t IsImpersonating ��
z^ UNCServerName
z^ ModuleName ���
t IsSecurityLog
t UseLegacyReportEvent �
$ RpcHandle 6 �^ ( tagReconnInfo .?AUtagReconnInfo@@ �^ }^ [
�^
� " " �^
�^
� $ \= �^
�^
� { Y �^
�^
� �^ ElfReconnect ���
�!
� p �^ �^ " " �^ �^ & �^ ElfrRegisterEventSourceA ��� �^ ElfrOpenELA
� q �^ �^ " " �^ �^ & �^ ElfrRegisterEventSourceW ��� �^ ElfrOpenELW { � �^
�^
�
� � �^ �^
�^
� �^ E / " �^ 2 �^ McTemplateU0usr0_EtwEventWriteTransfer � � �^ " �^ ElfBackupEventLogFileA �" �^ ElfClearEventLogFileA �� Z �^ �^ �^ ElfrClearELFA �� �^ ElfrBackupELFA �" " " " " " �^ _ ElfReadEventLogA ���" Z " " " " " _ _ ElfrReadELA " �B McGenControlCallbackV2 � { _ " _ ElfClearEventLogFileW ��" _ ElfBackupEventLogFileW � Z �^
_ _ ElfrClearELFW �� _ ElfrBackupELFW � _ ElfReadEventLogW ��� _ ElfrReadELW " " " _ " _ ElfGetLogInformation ��� Z " " " _ " _ ElfrGetLogInformation �� " _ _ ElfOldestRecord Z " _ _ ElfrOldestRecord ��� _ _ ElfChangeNotify Z ? " _ _ ElfrChangeNotify ��� _ ElfNumberOfRecords � _ ElfrNumberOfRecords � � �V $_ " %_ ElfOpenBackupEventLogA � p �^ " " �^ '_ (_ ElfrOpenBELA ���" %_ ElfRegisterEventSourceA { { �V +_ " ,_ ElfOpenBackupEventLogW � q �^ " " �^ ._ /_ ElfrOpenBELW ��� %_ ElfOpenEventLogA ��� t 2_ 3_ _stricmp ���" ,_ ElfRegisterEventSourceW �[ WevtInitialize � ,_ ElfOpenEventLogW ��� 7 _wcsicmp ���
�
� 6 ! ! " ! " 9_ ! " " :_ ;_ ElfReportEventA � MIDL_user_allocate �
x
�
�,
�
�^
� :
Z >_ ! ! " ! " �^ ?_ @_ ! "
A_ B_ ElfrReportEventExA �> Z " ! ! " ! " �^ ?_ @_ ! " " D_ E_ ElfrReportEventA ��� � MIDL_user_free �
� H_
I_
� � p " t K_
L_
� � " N_
O_
� 6 ! ! " ! " v^ ! " " Q_ R_ ElfReportEventW
�^
� :
Z >_ ! ! " ! " �^ ?_ T_ ! "
U_ V_ ElfrReportEventExW �> Z " ! ! " ! " �^ ?_ T_ ! " " X_ Y_ ElfrReportEventW ��� � q " t [_
\_
� / "
� J " h �
�^
�
z^
�
�^
�
�^
�
���
���
���
���� -FC -MT -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 -Gw -wd4316 -wd4973 �
h_ � i_ -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -wd4366 -wd4746 -Gs4096 -wd4064 -volatile:ms -arch:vfpv3-d16 -TC -X ��� d_ e_ f_ g_ j_ ��.��� �' )�(��v��f
�ԯ�R 7�`,�BҐ�oA�<[R1A8�F �7n6�+o���j�P��W^ gC(��4����k�x|�-�4�X�dHJ��A� U��i�Z�/u!
{9Fl�g�qt��"�
�<~#��w>���0<̩0L`��$��V���
hԹ�:OW�ҥ\�պ-�j��{�� ?_�Ef�����.��H���,)\ ����_�(V�5w���9ȨZp!'7�Q�z��{�#Cu� ��G��72Om��.�)���s �f#���D�X| ��S8����H��^+Կ�0�7�6���t�O����~s�O�^^�{+78����Y�����S0w��� �Q �Z|�ؗt�ߑw�3bK�1��
�l.>����K���j/��ԡ�"8�
�l.>���; ��ЂȘ�ԡ�"8�XIr|��d� �Cx�¼V��ԡ�"8����}k�#�+�� ���ԡ�"8����}k��i? R�혲ԡ�"8�W�w ����h�ns����ԡ�"8�k"
|�� �UaDʳ|�7��p��zp ��tW�w ���"�s ��#,��ԡ�"8�� 4�ů��|C צ}� @ �9<1E`����u�>Q����� Bf3�s3�OGnk&V�s[`�]��¤x�S�� ��b��٩��O�b�� m�8`���X�{��g`'v<kFa��ԡ�"8�{��g`��c�l���ԡ�"8�eo�W���I����OGnk&V�m~�(_��qV�n���OGnk&V�?����� y�O��OGnk&V%�2.9МGk\�p����OGnk&V86@ �YȉM=7��!�o3�@7��,�0� Xa �_�L���o3�@7�:��a9�y�\�rj���OGnk&V�7��p�����o�q ɮ�����6�Vy �b��y�OGnk&V����n_�g��Ϙ} �OGnk&V#i����/���� ��(oO�άnV�7��p��I���4��u�5t�oU�٢` z�<a(oO�άnV6�? �*tإH��m"�3F���mjx�r��V��7��p�֮��+n�Ϋ����~��K�:;�Ý f�<�[�SL���� ��%�
�ి��Ԁ� ��]�v��o�J M��:i��":ќM~ r�z�+ksG���L��<W�����#��:>Zo(�i(ma�=��t���k�� �B��N8�`��8n�hm��n[u���2Q�{"U�����Ч�:P�U��5F��04�5F��04�5F��04�5F��04�Up��� z�=�0f�5V�=p� ,-��Up��� z�!쵝�x
��mSJO �Up��� z֬?$|��
�k��9��Up��� z֬?$|����@�X�Up��� zE(�_o�⿑��j �Up��� zE(�_o��<��nu_�Up��� zE(�_o��T�wp����5F��04�Up��� z�=�0f�5V ��b��Up��� z�!쵝�x
��mSJO �Up��� z֬?$|����"�6AY��Up��� z֬?$|����"�6AY��Up��� z֬?$|��
�k��9��Up��� z֬?$|����@�X�Up��� zE(�_o��o�Bd�L�Up��� zE(�_o�7=�� ���Up��� zE(�_o�������ͯUp��� zE(�_o���'�|"ӯUp��� z֬?$|���k�s@L>:�Up��� z֬?$|���=�m�$�Up��� z֬?$|���=�m�$�E'@�k�~�Up��� zE(�_o�� ��|p~�
�C~:P�U棟�4�TH�ݰ�K� ��+eá�̱H��/z�{��t�� f� ��k�[]s�6�L c�ӯUp��� z����_��Up��� z���T
���?{� tk|�[�>X�O�0)~sG��#����c03H�L��<
��h?�0O_��[mRgï�:�ʁ��A,�| ��k��<0���q��{<l%C1�r��"�M��ϭ��F��%�7 ���3�07]��·N�����.Q�����to�StD���_����+���R� p ߧ�ȳ;U%��(�ۅ}�[��}��&q.V}�a�Ĕ���h<�kb|����=̦�p N L� ��{�mv�ɟKJ��w��[�Z*QR$Mr�Y�7��d�h�]�8Bҽ��,?����v#��̴�z�}�^-��U3�X7�)&L���f �)�*����� �
'I�$g�9}|t�Ve�����⫾hӗ�?%7�X����d -INCLUDE:__@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� .debug$S � e .rdata i�y� e .rdata �[!] e A .rdata s\Z e ` { � � � � � � _stricmp � � . A T m � � � � � � _wcsicmp � � - G ` y � � � � � � 0 @ M f .data 8 [p�� e � .rdata
e�.� e � .rdata h T)�} e � .rdata ~H�� e � .rdata ?�� e .rdata
JK i e
.rdata ��w� e ? .rdata G+� e S .rdata
���@ e k
.rdata �'� e � .rdata ��� e � .rdata ��� e � .rdata 3g� e � .rdata �K� e � .rdata ��*� e � .rdata .�M� e .rdata [Q�M e + .rdata ��� e > .rdata 8t� e S .rdata ��|d e h .rdata ݤ�| e � .rdata �SV
e � .rdata rX�� e � .rdata ��u} e � .rdata ~=�< e � .rdata ���� e .rdata `�m& e .rdata �͡ e 1 .rdata ! �dr e B ! .rdata " ��� e c " .rdata # �� e � # .rdata $ �� e � $ .rdata % �(u� e � % .rdata & �1�� e � & .rdata ' ���3 e ' .rdata ( s^% e 2 ( .rdata ) 8
�� e Q ) .rdata * ���{ e f * .rdata + Mj�� e ~ + .rdata , ʹR� e � , .rdata - 2˵o e EVENTLOG - � � � .text$mn . \ 1�#� e .debug$S / � . e .text$mn 0 | �2u e .debug$S 1 � T 0 e .text$x2 2 u�v0 e .text$mn 3 | �2u e .debug$S 4 � T 3 e .text$x2 5 u�v3 e .text$mn 6 | �>�� e .debug$S 7 � X 6 e .text$x2 8 u�v6 e .text$mn 9 l Yj� e .debug$S : t L 9 e .text$x2 ; u�v9 e .text$mn < l Yj� e .debug$S = t L < e .text$x2 > u�v< e .text$mn ? P HF� e .debug$S @ � D ? e .text$x2 A u�v? e .text$mn B ( K [� e .debug$S C � > B e .text$mn D н� e .debug$S E � D e .text$mn F P HF� e .debug$S G � D F e .text$x2 H u�vF e .text$mn I < f �1 e .debug$S J ` I e .text$mn K �7c e .debug$S L � K e .text$mn M � F�� e .debug$S N � n M e .text$x2 O Ѣ��M e .text$mn P w��n e .debug$S Q �
P e .text$mn R ( �Q�3 e .debug$S S X R e .text$mn T ��-� e .debug$S U � T e .text$mn V x �֗ e .debug$S W � T V e .text$x2 X u�vV e .text$mn Y x �֗ e .debug$S Z � T Y e .text$x2 [ u�vY e .text$mn \ � ֧C� e .debug$S ] � \ \ e .text$x2 ^ Ѣ��\ e .text$mn _ � ���h e .debug$S ` � ` _ e .text$x2 a Ѣ��_ e .text$mn b $ 뽋 e .debug$S c (
� b e .text$x2 d Ѣ��b e .text$mn e | Oo�D e .debug$S f h � e e .text$x2 g Ѣ��e e .text$mn h � p�H e .debug$S i � � h e .text$x2 j @ �nh e .text$mn k � $$�� e .debug$S l � � k e .text$x2 m @ �nk e .text$mn n � JF� e .debug$S o � Z n e .text$x2 p Ѣ��n e .text$mn q н� e .debug$S r | q e .text$mn s � u�4 e .debug$S t � j s e .text$x2 u Ѣ��s e .text$mn v
,�b� e .debug$S w P � v e .text$x2 x Ѣ��v e .text$mn y �
G�C e .debug$S z � y e .text$x2 { sPһy e .text$mn | н� e .debug$S } H : | e .text$mn ~ � _,d� e .debug$S B ~ e .text$x2 � sPһ~ e .text$mn � @ �Gd e .debug$S � X � e .text$mn � R&�X e .debug$S � @ � e .text$mn � н� e .debug$S � � � e .text$mn � ��� e .debug$S � l
� e .text$mn � � �(4� e .debug$S � * � e .text$mn � $ �}gE e .debug$S � H � e .text$mn � , {Q�l e .debug$S � X � e .text$mn � L n.E� e .debug$S � � � e .text$mn � @ �9�T e .debug$S � � � e .text$mn � H ��+ e .debug$S � � � e .text$mn � L �� e .debug$S � � � e .text$mn � X��� e .debug$S � � � e .text$mn � 4 �)Ӡ e .debug$S � � � e � � � K # � 9 D Q q g y w h � 0 � 9 � \ � s � b � | ~ k / F H ? Y 3 p < � _ � v � e � M � 6 � Y � V
I )
n 6
P G
� b
T }
R �
B �
� �
� �
. �
� � 3 � [ � � � � � � � 2 � 5 8 ( ; E > b A z H � O � X � [ � ^
a #
d ;
g S
j k
m �
p �
u �
x �
{ �
� ) > T memset $LN6 K $LN6 � $LN6 D $LN6 q $LN61 { $LN60 { $LN13 � y $LL2 � y $LN42 � y $LN24 � y $LN10 � y $LN40 � y $LN8 � y $LN20 n y $LN41 y $LN6 � y $LN3 � y $LN39 � y $LN22 � y $LN4 � y $LN57 � y $LN56 � y $LN55 � y $LN54 � y $LN53 � y $LN52 � y $LN51 � y $LN50 � y $LN45 { $LN47 { $LN46 { $LN17 { $LN14 { $LN43 � y $LN15 $ y $LN19 y $LN18 � y k y $LN37 j $LN36 j $LN1 � h $LN9 � h $LN8 � h $LN3 � h $LN33 � h $LN32 � h $LN31 � h $LN26 j $LN28 j $LN27 j $LN16 j $LN13 j $LN24 � h $LN14 z h $LN18 x h $LN17 ` h | h $LN34 2 $LN32 n 0 $LN31 2 $LN1 b 0 $LN5 V 0 $LN4 T 0 $LN3 ` 0 $LN28 x 0 $LN27 t 0 $LN26 p 0 $LN21 2 $LN23 2 $LN22 2 $LN12 2 $LN9 2 $LN19 | 0 $LN10 D 0 $LN14 B 0 $LN13 8 0 � 0 $LN29 ; $LN28 ; $LN6 X 9 $LN3 P 9 $LN2 N 9 $LN25 h 9 $LN24 d 9 $LN19 ; $LN21 ; $LN20 ; $LN10 ; $LN7 ; $LN17 l 9 $LN8 > 9 $LN12 < 9 $LN11 2 9 � 9 $LN35 ^ $LN34 ^ $LN1 � \ $LN7 v \ $LN18 X \ $LN5 . \ $LN4 , \ $LN3 � \ $LN31 � \ $LN30 � \ $LN29 � \ $LN24 ^ $LN26 ^ $LN25 ^ $LN15 ^ $LN12 ^ $LN22 � \ $LN13 F \ $LN17 D \ $LN16 2 \ � \ $LN37 u $LN36 u $LN1 � s $LN7 � s $LN18 l s $LN5 0 s $LN4 . s $LN3 � s $LN33 � s $LN32 � s $LN31 � s $LN30 � s $LN29 � s $LN24 u $LN26 u $LN25 u $LN15 u $LN12 u $LN22 � s $LN13 Z s $LN17 X s $LN16 @ s � s $LN45 d $LN43
b $LN42 d $LN1 � b $LN9 � b $LN8 � b $LN22 � b $LN6 � b $LN13 � b $LN5 V b $LN4 T b $LN3 � b $LN39 b $LN38 b $LN37 b $LN36 b $LN35 b $LN34 b $LN29 d $LN31 d $LN30 d $LN19 d $LN16 d $LN27 $ b $LN17 � b $LN21 � b $LN20 � b � b $LN6 | $LN97 � $LN95 r ~ $LN94 � $LL2 d ~ $LN71 ` ~ $LN14 N ~ $LN69 J ~ $LN12 & ~ $LN28 ~ $LN70 � ~ $LN10 � ~ $LN3 X ~ $LN68 J ~ $LN66 V ~ $LN7 ~ $LN33 � ~ $LN37 � ~ $LN5 ` ~ $LN1 b ~ $LN4 ` ~ $LN91 � ~ $LN90 � ~ $LN89 � ~ $LN88 � ~ $LN87 � ~ $LN86 � ~ $LN85 � ~ $LN84 � ~ $LN83 � ~ $LN82 � ~ $LN81 | ~ $LN80 x ~ $LN79 t ~ $LN74 � $LN76 � $LN75 � $LN25 � $LN22 � $LN72 � ~ $LN23 � ~ $LN27 � ~ $LN26 h ~ � ~ $LN37 m $LN36 m $LN1 � k $LN9 � k $LN8 � k $LN3 � k $LN33 � k $LN32 � k $LN31 � k $LN26 m $LN28 m $LN27 m $LN16 m $LN13 m $LN24 � k $LN14 z k $LN18 x k $LN17 ` k | k $LN29 H $LN28 H $LN3 > F $LN13 0 F $LN2 < F $LN25 L F $LN24 H F $LN19 H $LN21 H $LN20 H $LN10 H $LN7 H $LN17 P F $LN8 $ F $LN12 " F $LN11 F � F $LN29 A $LN28 A $LN3 > ? $LN13 0 ? $LN2 < ? $LN25 L ? $LN24 H ? $LN19 A $LN21 A $LN20 A $LN10 A $LN7 A $LN17 P ? $LN8 $ ? $LN12 " ? $LN11 ? ? $LN34 5 $LN32 n 3 $LN31 5 $LN1 b 3 $LN5 V 3 $LN4 T 3 $LN3 ` 3 $LN28 x 3 $LN27 t 3 $LN26 p 3 $LN21 5 $LN23 5 $LN22 5 $LN12 5 $LN9 5 $LN19 | 3 $LN10 D 3 $LN14 B 3 $LN13 8 3 � 3 $LN29 > $LN28 > $LN6 X < $LN3 P < $LN2 N < $LN25 h < $LN24 d < $LN19 > $LN21 > $LN20 > $LN10 > $LN7 > $LN17 l < $LN8 > < $LN12 < < $LN11 2 < � < $LN37 a $LN35 � _ $LN34 a $LN1 � _ $LN7 x _ $LN18 Z _ $LN5 0 _ $LN4 . _ $LN3 � _ $LN31 � _ $LN30 � _ $LN29 � _ $LN24 a $LN26 a $LN25 a $LN15 a $LN12 a $LN22 � _ $LN13 H _ $LN17 F _ $LN16 4 _ � _ $LN49 x $LN47 � v $LN46 x $LN1 � v $LN7 � v $LN20 � v $LN11 z v $LN5 : v $LN4 8 v $LN3 � v $LN43 v $LN42 v $LN41 v $LN40 � v $LN39 � v $LN38 � v $LN37 � v $LN32 x $LN34 x $LN33 x $LN17 x $LN14 x $LN30 v $LN15 � v $LN19 � v $LN18 � v v $LN55 g $LN53 Z e $LN52 g $LN1 N e $LN9 @ e $LN8 " e $LN24 e $LN6 � e $LN15 � e $LN13 � e $LN5 d e $LN4 b e $LN3 L e $LN49 x e $LN48 t e $LN47 p e $LN46 l e $LN45 h e $LN44 d e $LN43 ` e $LN42 \ e $LN37 g $LN39 g $LN38 g $LN21 g $LN18 g $LN35 | e $LN19 � e $LN23 � e $LN22 � e & e $LN34 O $LN33 O $LN10 p M $LN5 f M $LN6 h M $LN4 : M $LN30 � M $LN29 � M $LN28 | M $LN23 O $LN25 O $LN24 O $LN14 O $LN11 O $LN21 � M $LN12 V M $LN16 T M $LN15 B M 7 M $LN33 8 $LN31 r 6 $LN30 8 $LN6 f 6 $LN3 ^ 6 $LN2 \ 6 $LN27 x 6 $LN26 t 6 $LN21 8 $LN23 8 $LN22 8 $LN10 8 $LN7 8 $LN19 | 6 $LN8 L 6 $LN12 J 6 $LN11 < 6 H 6 $LN33 [ $LN31 j Y $LN30 [ $LN4 V Y $LN3 T Y $LN1 ^ Y $LN2 & Y $LN27 t Y $LN26 p Y $LN25 l Y $LN20 [ $LN22 [ $LN21 [ $LN11 [ $LN8 [ $LN18 x Y $LN9 D Y $LN13 B Y $LN12 8 Y Y Y $LN33 X $LN31 j V $LN30 X $LN4 V V $LN3 T V $LN1 ^ V $LN2 & V $LN27 t V $LN26 p V $LN25 l V $LN20 X $LN22 X $LN21 X $LN11 X $LN8 X $LN18 x V $LN9 D V $LN13 B V $LN12 8 V j V $LN3 ( I $LN11 8 I $LN10 4 I $LN9 0 I $LN8 , I $LN48 p $LN47 p $LN1 � n $LN25 � n $LN32 � n $LN12 b n $LN11 z n $LN10 � n $LN9 � n $LN5 � n $LN44 � n $LN43 � n $LN42 � n $LN41 � n $LN40 � n $LN35 p $LN37 p $LN36 p $LN22 p $LN19 p $LN33 � n $LN20 � n $LN24 � n $LN23 N n { n $LN1 P $LN4 P $LN1
� $LN1 T $LN2 T $LN1 R $LN3 R $LN9 $ R $LN34 B $LN1 B $LN10 � B $LN8 � B $LN24 � B $LN14 � B $LN9 � B $LN12 � B $LN7 � B $LN15 � B $LN20 P B $LN19 N B $LN23 B $LN5 ( B $LN4 B $LN33 $ B $LN32 B $LN31 B $LN30 B $LN29 B $LN28 B $LN12 & � $LN4 � $LN2 � $LN11 0 � $LN10 , � $LN9 ( � $LN11 6 � $LN4 . � $LN3 & � $LN1 2 � $LN10 < � $LN9 8 � $LN8 ( . $LN7 & . $LN19 X . $LN18 T . $LN17 P . $LN3 $ � $LN8 ( � $LN9 � $LN3 � $LN8 � $LN3 , � $LN2 � $LN8 H � $LL6 8 � $LN15 ~ � $LN19 | � $LN25 x � $LN17 F � $LN11 � � $LN12 � � $LN1 < � $LN5 : � $LN7 6 � $LN3 � .pdata � �3͇ e � � .pdata � ^nz�� e � � .pdata � �=K e � � .pdata � �=� e � � .pdata � �=D e � � .pdata � �=q e � .pdata � y e 2 � .pdata � :��y e J � .xdata � 0 Tb� y e b � .pdata � h e { � .pdata � �})�h e � � .xdata � , Q!��h e � � .pdata � 0 e � � .pdata � 3Vf�0 e � � .xdata � 0 � �0 e � .pdata � 9 e % � .pdata � 3Vf�9 e C � .xdata � 0 ��i-9 e a � .pdata � \ e � � .pdata � ���\ e � � .xdata � ( ��a�\ e � � .pdata � s e � � .pdata � ���s e � � .xdata � ( ���s e � .pdata � b e ? � .pdata � ���b e X � .xdata � 0 �מob e q � .pdata � �=| e � � .pdata � ~ e � � .pdata � :��~ e � � .xdata � 0 k��~ e � � .pdata � k e � � .pdata � �})�k e � .xdata � , Q!��k e ' � .pdata � F e A � .pdata � 3Vf�F e b � .xdata � ( ş�F e � � .pdata � ? e � � .pdata � 3Vf�? e � � .xdata � ( ş�? e � � .pdata � 3 e � � .pdata � 3Vf�3 e � .xdata � 0 � �3 e / � .pdata � < e O � .pdata � 3Vf�< e m � .xdata � 0 ��i-< e � � .pdata � _ e � � .pdata � ���_ e � � .xdata � ( �G%u_ e � � .pdata � v e � .pdata � ���v e ( � .xdata � 0 �|�wv e H � .pdata � e e i � .pdata � ���e e � � .xdata � 0 ��çe e � � .pdata � M e � � .pdata � ���M e � � .xdata � 0 �`� M e � � .pdata � 6 e
� .pdata � 3Vf�6 e % � .xdata � 0 +ol�6 e = � .pdata � Y e V � .pdata � 3Vf�Y e n � .xdata � 0 � |�Y e � � .pdata � V e � � .pdata � 3Vf�V e � � .xdata � 0 � |�V e � � .pdata � Z3��I e � � .pdata � n e � .pdata � ���n e ) � .xdata � ( ��n e > � .pdata � Dޡ3P e T � .pdata � ^nz�� e m � .pdata � ��T e � � .pdata � ���R e � � .pdata � �RKB e � � .gfids$y � ��
s� e � � .pdata � �awy� e � .pdata � L��G� e � .pdata � �]{. e > � .pdata � � e _ � .xdata � Û聕 e � � .pdata � � e � � .xdata � �a��� e � � .pdata � �,'� e � .pdata � ��ˌ� e M � .pdata � �a�� e y � .pdata � �� �� e � � .pdata � ,�x� e � � .debug$S � , e .debug$S � < e .debug$S � @ e .debug$S � , e .debug$S � 4 e .debug$S � <
e .debug$S � 0 e .debug$S � 4 e .debug$S � 0
e .debug$S � @ e .debug$S � 4 e .debug$S � 8 e .debug$S , e .debug$S 4 e .debug$S , e .debug$S 4 e .debug$S 0 e .debug$S 0 e .debug$S 0 e .debug$S @ e .debug$S @ e .debug$S 4 e .debug$S
, e .debug$S , e .debug$S , e .debug$S
0 e .debug$S 4 e .debug$S , e .debug$S < ! e .debug$S @ " e .debug$S @ # e .debug$S 8 $ e .debug$S < % e .debug$S 8 & e .debug$S H ' e .debug$S < ( e .debug$S 0 ) e .debug$S 4 * e .debug$S 4 + e .debug$S ( , e .debug$S $ - e .debug$T 0 e .chks64 � e � ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy@ ??_C@_0M@NJALGCHB@Application@ ??_C@_08EDKKPLCC@Security@ ElfrReportEventA ElfrReportEventExA __imp_GetComputerNameExA ElfrReadELA ElfrBackupELFA ElfrClearELFA ElfrOpenBELA MIDL_user_free __imp_RtlTimeToSecondsSince1970 ElfrReportEventW ElfrReportEventExW MIDL_user_allocate __imp_GetComputerNameExW __imp_NtQuerySystemTime ElfrReadELW ElfrDeregisterEventSource ElfrCloseEL ElfrBackupELFW ElfrClearELFW ElfrOpenBELW ElfrGetLogInformation ElfrChangeNotify ElfrOldestRecord ElfrNumberOfRecords __imp_I_RpcMapWin32Status __imp_RpcExceptionFilter ElfrRegisterEventSourceA ElfrOpenELA ElfrRegisterEventSourceW ElfrOpenELW __imp_RtlInitAnsiString __imp_RtlInitUnicodeString __imp_HeapFree __imp_RtlCopyString __imp_RtlCopyUnicodeString __imp_GetProcessHeap __imp_HeapAlloc RevertToSelf __imp_RtlAdjustPrivilege __imp_RtlImpersonateSelf Microsoft_Windows_EventlogEnableBits EVENTLOG_Context Microsoft_Windows_EventlogLevels Microsoft_Windows_EventlogKeywords EVENT_LOG_FULL EVENT_AUDIT_PROCESSING EVENT_AUDIT_PUBLISHER_META_DATA EVENT_AUDIT_FAILURE EVENT_AUDIT_AUTO_BACKUP EVENT_AUDIT_LOG_FULL EVENT_AUDIT_LOG_EXCEEDS_WARNING_LEVEL EVENT_AUDIT_LOG_CLEARED EVENT_AUDIT_EVENTS_DROPPED EVENT_SHUTDOWN EVENT_REPORTEVENT_ANSI EVENT_REPORTEVENT EVENT_REGISTEREVENTSOURCE EVENT_OPENEVENTLOG EVENT_PULLSUB_CREATE EVENT_PUSHSUB_CREATE EVENT_ENABLE_CHANNEL_PROGRAMMATICALLY EVENT_PUBLISHER_TLG_INVALID_META_DATA EVENT_ABNORMAL_SHUTDOWN LOG_DROPPED_CHUNK EVENT_AUTO_BACKUP EVENT_LOG_CLEARED EVENT_EVENTS_DROPPED EVENT_PUBLISHER_META_DATA EVENT_PROCESSING CHANNEL_POLICY_APPLICATION_ERROR PRIMARY_CHANNEL_CONFIGURATION_WARNING INIT_CHANNEL_PUBLISHER_ENABLE_FAILURE PRIMARY_CHANNEL_FATAL_ERROR INIT_CHANNEL_LOGFILTER_WARNING INIT_CHANNEL_LOGFILE_WARNING INIT_CHANNEL_MOVED_UNSUPPORTED_VERSION_LOG INIT_CHANNEL_MOVED_CORRUPT_LOG INIT_CHANNEL_LOGGING INIT_CHANNEL_PUBLISHING INIT_CHANNEL_CONFIG_ERROR INIT_CHANNEL __imp_EtwEventUnregister __imp_EtwEventRegister __imp_EtwEventWriteTransfer EventDataDescCreate NtCurrentTeb ElfFlushEventLog ElfWriteClusterEvents ElfDeregisterClusterSvc ElfRegisterClusterSvc ElfReportEventA ElfReadEventLogA ElfBackupEventLogFileA ElfClearEventLogFileA ElfOpenBackupEventLogA ElfRegisterEventSourceA ElfOpenEventLogA ElfReportEventAndSourceW ElfReportEventW ElfReadEventLogW ElfDeregisterEventSource ElfCloseEventLog ElfBackupEventLogFileW ElfClearEventLogFileW ElfOpenBackupEventLogW ElfRegisterEventSourceW ElfOpenEventLogW ElfGetLogInformation ElfChangeNotify ElfOldestRecord ElfNumberOfRecords ElfDestroyReconnectionInfo ElfReconnect ElfGetModuleName ElfSetUseLegacyReportEvent ElfGetUseLegacyReportEvent ElfGetTheRpcHandle ElfCreateReconnInfo WevtInitialize ElfRevertThreadPrivilege ElfAssertThreadPrivilege McTemplateU0uzr0_EtwEventWriteTransfer McTemplateU0usr0_EtwEventWriteTransfer McGenEventUnregister_EtwEventUnregister McGenEventRegister_EtwEventRegister McGenEventWrite_EtwEventWriteTransfer McGenControlCallbackV2 McGenLevelKeywordEnabled ElfBackupEventLogFileA$filt$0 ElfBackupEventLogFileW$filt$0 ElfChangeNotify$filt$0 ElfClearEventLogFileA$filt$0 ElfClearEventLogFileW$filt$0 ElfCloseEventLog$filt$0 ElfDeregisterEventSource$filt$0 ElfGetLogInformation$filt$0 ElfNumberOfRecords$filt$0 ElfOldestRecord$filt$0 ElfOpenBackupEventLogA$filt$0 ElfOpenBackupEventLogW$filt$0 ElfOpenEventLogA$filt$0 ElfOpenEventLogW$filt$0 ElfReadEventLogA$filt$0 ElfReadEventLogW$filt$0 ElfReconnect$filt$0 ElfRegisterEventSourceA$filt$0 ElfRegisterEventSourceW$filt$0 ElfReportEventA$filt$0 ElfReportEventW$filt$0 __C_specific_handler __GSHandlerCheck __GSHandlerCheck_SEH __security_pop_cookie __security_push_cookie $LN44@ElfReportE $LN25@ElfReadEve $LN20@ElfBackupE $LN18@ElfClearEv $LN23@ElfOpenBac $LN23@ElfRegiste $LN28@ElfOpenEve $LN73@ElfReportE $LN18@ElfDeregis $LN18@ElfCloseEv $LN31@ElfRegiste $LN36@ElfOpenEve $LN22@ElfGetLogI $LN20@ElfChangeN $LN19@ElfOldestR $LN19@ElfNumberO $LN34@ElfReconne $pdata1$EventDataDescCreate $pdata1$NtCurrentTeb $pdata1$ElfFlushEventLog $pdata1$ElfWriteClusterEvents $pdata1$ElfDeregisterClusterSvc $pdata1$ElfRegisterClusterSvc $pdata2$ElfReportEventA $pdata3$ElfReportEventA $unwind4$ElfReportEventA $pdata2$ElfReadEventLogA $pdata3$ElfReadEventLogA $unwind4$ElfReadEventLogA $pdata2$ElfBackupEventLogFileA $pdata3$ElfBackupEventLogFileA $unwind4$ElfBackupEventLogFileA $pdata2$ElfClearEventLogFileA $pdata3$ElfClearEventLogFileA $unwind4$ElfClearEventLogFileA $pdata2$ElfOpenBackupEventLogA $pdata3$ElfOpenBackupEventLogA $unwind4$ElfOpenBackupEventLogA $pdata2$ElfRegisterEventSourceA $pdata3$ElfRegisterEventSourceA $unwind4$ElfRegisterEventSourceA $pdata2$ElfOpenEventLogA $pdata3$ElfOpenEventLogA $unwind4$ElfOpenEventLogA $pdata1$ElfReportEventAndSourceW $pdata2$ElfReportEventW $pdata3$ElfReportEventW $unwind4$ElfReportEventW $pdata2$ElfReadEventLogW $pdata3$ElfReadEventLogW $unwind4$ElfReadEventLogW $pdata2$ElfDeregisterEventSource $pdata3$ElfDeregisterEventSource $unwind4$ElfDeregisterEventSource $pdata2$ElfCloseEventLog $pdata3$ElfCloseEventLog $unwind4$ElfCloseEventLog $pdata2$ElfBackupEventLogFileW $pdata3$ElfBackupEventLogFileW $unwind4$ElfBackupEventLogFileW $pdata2$ElfClearEventLogFileW $pdata3$ElfClearEventLogFileW $unwind4$ElfClearEventLogFileW $pdata2$ElfOpenBackupEventLogW $pdata3$ElfOpenBackupEventLogW $unwind4$ElfOpenBackupEventLogW $pdata2$ElfRegisterEventSourceW $pdata3$ElfRegisterEventSourceW $unwind4$ElfRegisterEventSourceW $pdata2$ElfOpenEventLogW $pdata3$ElfOpenEventLogW $unwind4$ElfOpenEventLogW $pdata2$ElfGetLogInformation $pdata3$ElfGetLogInformation $unwind4$ElfGetLogInformation $pdata2$ElfChangeNotify $pdata3$ElfChangeNotify $unwind4$ElfChangeNotify $pdata2$ElfOldestRecord $pdata3$ElfOldestRecord $unwind4$ElfOldestRecord $pdata2$ElfNumberOfRecords $pdata3$ElfNumberOfRecords $unwind4$ElfNumberOfRecords $pdata1$ElfDestroyReconnectionInfo $pdata2$ElfReconnect $pdata3$ElfReconnect $unwind4$ElfReconnect $pdata1$ElfGetModuleName $pdata1$ElfSetUseLegacyReportEvent $pdata1$ElfGetUseLegacyReportEvent $pdata1$ElfGetTheRpcHandle $pdata1$ElfCreateReconnInfo __guard_fids_WevtInitialize $pdata2$WevtInitialize $pdata1$ElfRevertThreadPrivilege $pdata1$ElfAssertThreadPrivilege $pdata2$McTemplateU0uzr0_EtwEventWriteTransfer $unwind3$McTemplateU0uzr0_EtwEventWriteTransfer $pdata2$McTemplateU0usr0_EtwEventWriteTransfer $unwind3$McTemplateU0usr0_EtwEventWriteTransfer $pdata1$McGenEventUnregister_EtwEventUnregister $pdata1$McGenEventRegister_EtwEventRegister $pdata1$McGenEventWrite_EtwEventWriteTransfer $pdata1$McGenControlCallbackV2 $pdata1$McGenLevelKeywordEnabled
/144 1606894170 100666 55361 `
�W ZB�_�� � .debug$S � �
@ B.text$mn d < � 2`.debug$S � � � & @B.text$mn l P � 2`.debug$S � � & @B.text$mn $ r � 2`.debug$S D � � @B.text$mn � � 2`.debug$S D � �# H @B.text$mn d �& .' 2`.debug$S � j' ^* & @B.text$mn p �+ J, 2`.debug$S |, �/ & @B.text$mn 1 $1 2`.debug$S ` 81 �2
@B.text$mn �2 3 2`.debug$S h ,3 �4
@B.text$mn " �4 5 2`.debug$S L .5 z7 @B.text$mn .8 J8 2`.debug$S � ^8 : @B.text$mn �: �: 2`.debug$S � �: f< @B.text$mn H �< 2`.debug$S � &= �>
@B.text$mn D 2? 2`.debug$S � v? &A
@B.text$mn �A �A 2`.debug$S l �A &C
@B.text$mn �C 2`.debug$S � �C 4D @B.text$mn � \D �D 2`.debug$S 8E HI 6 @B.text$mn � dK �K 2`.debug$S � L �O , @B.text$mn D �Q �Q 2`.debug$S � �Q �T @B.text$mn @ �U V 2`.debug$S � 6V �X @B.text$mn B �Y <Z 2`.debug$S � ZZ �] " @B.text$mn B >_ �_ 2`.debug$S � �_ .c " @B.text$mn @ �d �d 2`.debug$S � �d �g @B.text$mn @ �h �h 2`.debug$S �
i �k @B.text$mn , �l n 2`.debug$S � 4n v f @B.text$mn 4 z L{ 2`.debug$S ~{ �� h @B.text$mn L �� 2`.debug$S � � �� @B.text$mn � ʋ Z� 2`.debug$S P �� � 0 @B.pdata Ƒ Α @@@.pdata ؑ � @@@.xdata ( � � @@@.pdata D� L� @@@.pdata V� ^� @@@.pdata h� p� @@@.pdata z� �� @@@.pdata �� �� @@@.pdata �� �� @@@.pdata �� �� @@@.xdata ( ̒ � @@@.pdata � $� @@@.pdata .� 6� @@@.pdata @� H� @@@.pdata R� Z� @@@.pdata d� l� @@@.pdata v� ~� @@@.pdata �� �� @@@.pdata �� �� @@@.pdata �� �� @@@.pdata �� Ɠ @@@.pdata Г ؓ @@@.pdata � � @@@.pdata � �� @@@.pdata � � @@@.pdata � � @@@.pdata *� 2� @@@.pdata <� D� @@@.pdata N� V� @@@.debug$T �
`� @ B.chks64 � �
.drectve l @�
� � O d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\eventapi.obj : < � � k k
Microsoft (R) Optimizing Compiler � � 8 o ����o� }�+4qt*Y lռ��́dq�X � ���Ug�gWd�Dt�Y� ݚgxHt�$�Njw�a � ��*�HRI �̏!�&�e�b ��E2b�^� � �;�,�9Y���dnB_ l��fp������L�5 � g^ 8 = � onecore\admin\wmi\events\advapi\objfre\arm\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\arm\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\external\sdk\inc\nxarm.h onecore\admin\wmi\events\advapi\eventapi.c onecore\external\shared\inc\intsafe.h � L�^ -�H
� ��Fy�K�h�GK"�hhF�G (� � � $
�
K !hFh�G� F � �KFhFh�G F������ & � < � T X \ `
� q 5 G d
d �^ �BackupEventLogA > hEventLog A
A 8 >� BackupFileName A 2 >� AnsiString E d >t ReturnValue A D >} UnicodeString E d > Status A
" A
8 Z ~^ �^ B! $LN13
u
u
u
u hEventLog � BackupFileName � AnsiString } UnicodeString 9 �^ 9 �^ 96 �^ 9H �^ O � p d ` d R � ] � ^ � _ �" a �& b �* c �. g �8 j �@ k �J n �, � 0 � _ � c � o � s � � � � � � � � � � � � � � � < � @ � L � P � � � � � � � � � � � � � � � � � � � � � = � A � M � Q � ] � a � m � q � � � � � -�<H
� FF�� FL # "$hiF�G��iF(F � � (� � � $ �$��0s� �P?k� !�iKh�G�KW h�G $ F��<��� " * � ` d h � [ 5 G l l �^ �BackupEventLogW > hEventLog A
A R > BackupFileName A
A
A N
>t ReturnValue A 0 A X >} Unicode E l > Status A
& A
4 & M g^ : N Z �^ ~^ B!
h g^ $LN17
u
u
u hEventLog BackupFileName } Unicode 9 �^ 9J �^ 9T �! O � � l ` � ( �
2 � 3 � 7 � < �& > �* ? �. @ �0 A �2 B �4 E �: F �L H �N 8 �V 9 �X J �, � 0 � _ � c � o � s � � � � � � � � � � � � � � � � � � � � � � � 9 � = � M � Q � � * � * � / � / � 0 � 0 � 1 � 1 7 � ; � G � K � W � [ � p � t � -�H
� Kh�GKFh�G F��� ! � � 8 G $ $ ~^ �BaseSetLastNTError > Status A
>" dwErrorCode A
B!
u
u Status 9 ^ 9 �! O � 8 $ ` , 2 � 5 � 6 � 8 �, � 0 � _ � c � � � � � � R � R � S � S � � � � � � � � � � -�O
�( FF F��F��SO�
GEk� /i�8/g� h�Bc��8 �V�<�B\�#*F1FhF � � (U�#*F1FhF � � (Mۢj� ���BEF��jCEC�HE@��B=سB;�1F � � (7�c�ñcjCE1���-�#DKE*� � %� #1FhF � � (!�c�m �B���#kc�CE�bkBE�"DJE�D�BسB �#h4F
�
������ � �H��� �D � T � � � � � � � 9 G �^ �CheckEventLogBuffer > lpBuffer A
" A
" � � >" nBytesBufferSize A A � >" nBytesRead A " A " � � >t isUnicode A �
A
A � � A � > pbTest A
2 E > pbTooFar A * � A " � � > pStartOfSid A
p A
� > pDataStart A � A " � � > pString A
� A
� X N > pPastEndOfBuffer A
� " � A
� >t NumRecordsRead A � > pPastEndOfData A
�
A
� > pPastEndOfSid A
v A
� >u cnt A � A � >t NumUncheckedBytes A
� > Status A
H � ( d A
" � � >�^ pEventRecord A � Z n^ n^ q^ n^ B!
u / lpBuffer / " nBytesBufferSize / " nBytesRead / t isUnicode pbTest O � � ` - t � � � � � � � �" � �& � �* � �. � �4 � �< � �H � �L � �X � �\ � �d � �n � �r � �t � �z � �~ � �� � �� �� �� �� ��
�� ��
�� �� ��
�� �� �� �� �� " �� $ �� ( �� ) �� * �� � �� - �� 0 �� . �� 2 �, � 0 � b � f � r � v � � � � � � � � � � � � � � � � � � � � " � . � 2 � B � F � c � g � w � { � � � � � � � � � � � � � � � � � �
� � � ? � C � O � S � ~ � � � � � � � � � � � � � � � � � � � � � , � 0 � J � N � Z � ^ � � � � � � � � � � � � � � � � � 4 8 � � � � -�H
� ��Fy�K�h�GK"�hhF�G (� � � $
�
K !hFh�G� F � �KFhFh�G F������ & � < � T X \ `
� p 4 G d
d �^ �ClearEventLogA > hEventLog A
A 8 >� BackupFileName A 2 >� AnsiString E d >t ReturnValue A D >} UnicodeString E d > Status A
" A
8 Z ~^ �^ B! $LN13
u
u
u
u hEventLog � BackupFileName � AnsiString } UnicodeString 9 �^ 9 �^ 96 �^ 9H �^ O� p d ` d � ! � " � # �" % �& & �* ' �. + �8 . �@ / �J 1 �, � 0 � ^ � b � n � r � � � � � � � � � � � � � � � ; � ? � K � O � � � � � � � � � � � � � � � � � � � � � < � @ � L � P � \ � ` � l � p � � � � � -�<H
� FFl� FL # "$hiF�G@�KW h�G $� #�� 3iF(F � � (� � � $ �$��0C� �P?k� !�iKh�G F��<� 4 < � d h l � a 4 G p p �^ �ClearEventLogW > hEventLog A
A X > BackupFileName A
A
8 A D >t ReturnValue A B A ^ >} Unicode C
, E p > Status A
8 A
F M g^ L N Z �^ ~^ B!
h g^
u
u
u hEventLog BackupFileName } Unicode 9 �^ 9$ �! 9\ �^ O � � p ` � � �
� � � � � � � �& � �* � �0 � �8 � �< � �@ � �B � �D � �F �L �^ �, � 0 � ^ � b � n � r � � � � � � � � � � � � � � � � � � � � � � � / � 3 � P � T � d � h � � 7 � 7 � 8 � 8 � 9 � 9 = � A � M � Q � ] � a � x � | � -� H�F � � (� � � � �� � � � � 3 G �^ �CloseEventLog > hEventLog A
>t ReturnValue A
> Status A
Z �^ ~^ B! hEventLog O � X ` L � � � �
� � � � � � � � � � � �, � 0 � ] � a � � � � � � � � � � � -� H�F � � (� � � � �� � � � � ; G �^ �DeregisterEventSource > hEventLog A
>t ReturnValue A
> Status A
Z �^ ~^ B! hEventLog O � X ` L � �
� � � � � �, � 0 � e � i � � � � � � � � � � � -� H
� � � � � (� � � � �� � � � � < G " �^ �GetEventLogInformation > hEventLog A
>" dwInfoLevel A > lpBuffer A >" cbBufSize A
>" pcbBytesNeeded E E " > ntStatus A
Z �^ ~^ B! hEventLog " dwInfoLevel lpBuffer " cbBufSize " pcbBytesNeeded O � P " ` D � � � � � � � � � � � � � �, � 0 � f � j � � � � � � � � � � � � � � � � � 7 � ; � � � � -� H�F � � (� � � � �� � � � G @ G �^ �GetNumberOfEventLogRecords > hEventLog A
>" NumberOfRecords A
>t ReturnValue A
> Status A
Z �^ ~^ B! hEventLog " NumberOfRecords O � X ` L Q � U �
W � X � Y � Z � [ � _ �, � 0 � j � n � � � � � � � � � � � � � \ � ` � -� H�F � � (� � � � �� � � � > = G �^ �GetOldestEventLogRecord > hEventLog A
>" OldestRecord A
>t ReturnValue A
> Status A
Z �^ ~^ B! hEventLog " OldestRecord O � X ` L � � �
� � � � � � � � � � � �, � 0 � g � k � � � � � � � � � � � � � T � X � -�H
� # "�A`���� 0k�G��tI �Bґ� 0R +�ѢB� �S C����C� #� ��� � 4 G H D �^ �InitAnsiString >� DestinationString A
D 2 >�^ SourceString A H >" Length A < B! � DestinationString �^ SourceString O � � H ` | \ � ^ � _ � ` � j �& k �, n �0 o �4 s �: u �< w �> x �@ { �D | �, � 0 � f � j � � � � � � � � � � $ � -�H
� # "�A`�� �c�O��t� �B� �� +�ѢB� � C����C� #� ��� � 7 G D @ j^ �InitUnicodeString >{ DestinationString A
@ . >� SourceString A D >" ByteLength A 8 B! { DestinationString � SourceString O � � D ` | � � � � � � � � � �" � �( � �, � �0 � �6 � �8 � �: � �< � �@ � �, � 0 � i � m � � � � � � � � � ( � , � -� H�F � � (� � � � �� � � � : G �^ �NotifyChangeEventLog > hEventLog A
> hEvent A
> Status A
Z �^ ~^ B! hEventLog hEvent O � P ` D ) � , �
. � / � 0 � 2 � 4 �, � 0 � d � h � � � � � � � � � � � -� H�F �P�� � � V 2 G
g^ �NtCurrentTeb J! O � 0 8 $ < � = �
> �, � 0 � l � p � -�H
� �� F��#KF�h�G K"�hhF�G (� � � $+�K !hFh�G��K!F�h�GK"�h��GF ,
�
KhFh�G F�� K !�h�G�� � �KFhFh�GK�h�G F���� ( � r � � � � �
� I 9 G �
� �^ �OpenBackupEventLogA >� UNCServerName A
6 >� FileName A A b H A ( R @ >� AnsiString E � >} UnicodeServerName E � > ReturnHandle A z >} UnicodeFileName E � > Status A
$ A T A
( B " A ( R @ Z ~^ �^ B!
u
u
u
u ' � UNCServerName ' � FileName � AnsiString } UnicodeServerName } UnicodeFileName 9 �^ 9" �^ 98 �^ 9D �^ 9P �^ 9^ �^ 9l �^ 9~ �^ 9� �^ O � � � ` � � � � �$ �( 7 �0 �: # �< $ �F % �T ' �X ( �` ) �b * �d . �n 1 �v 3 �� 4 �� 7 �, � 0 � g � k � � � � � � � � � � � � � � � � � � � : � > � h � l � � � � � � � � � � � � � � � � � � � � � ! � % � 0 � 4 � � � � � � � � � � � � � � � � � � � � � % � ) � 5 � 9 � E � I � ` � d � -�H
� �� # � K FFh��GK !�h�GL� FL # "$h��G�H�jF�� � � (� � � $ � ���
0C� �P?k� !�iKh�G F������ 3 � @ H � t | � � � 9 G �
� �^ �OpenBackupEventLogW > UNCServerName A
> FileName A A A : > LogHandle A
E � >} Unicode E � > ReturnHandle A N $ >} UnicodeFileName E � > Status A
8
A
R M g^ X N Z �^ ~^ B!
h g^ $LN20
u
u
u
u ' UNCServerName ' FileName LogHandle } Unicode } UnicodeFileName 9 �^ 9" �^ 92 �^ 9h �^ O � � � ` � � �
� � � � � �$ � �& � �6 � �8 � �: � �D �H �L �N �P �R �X
�j �, � 0 � g � k � � � � � � � � � � � � � � � � � � � � � � � 3 � 7 � e � i � � � � � � � � � � # ! ' ! 2 " 6 " A # E # � � � � � � � � � � � � � � � � � � -�H
� �� # � KF�h�G K!F�h�GjF�� � � (� � � � ����� ( 0 � @
� T 3 G D
D �^ �OpenEventLogA >� UNCServerName A
A . >� ModuleName A >� AnsiString E D >� AnsiModuleName E D > LogHandle A
E D > ReturnHandle A
6
> Status A
, Z �^ ~^ B!
u ' � UNCServerName ' � ModuleName � AnsiString � AnsiModuleName LogHandle 9 �^ 9 �^ O� p D ` d � �
� � � � � �" � �, � �0 � �4 � �6 � �8 � �: � �, � 0 � a � e � q � u � � � � � � � � � � � � � � � $ � ( � K � O � p � t � � � � � @ � D � P � T � h � l � -�H
� �� KF�h�G K!F�h�GjF�� � � (� � � � ����� $ , � < � D 3 G @
@ �^ �OpenEventLogW > UNCServerName A
A . > ModuleName A > LogHandle E @ >} Unicode E @ > ReturnHandle A
2
>} UnicodeModuleName E @ > Status A
( Z �^ ~^ B!
u ' UNCServerName ' ModuleName LogHandle } Unicode } UnicodeModuleName 9 �^ 9 �^ O� h @ `
\ l �
t � u � w �( } �, ~ �0 �2 � �4 � �6 � �, � 0 � a � e � q � u � � � � � � � � � � � � � � � ? � C � ` � d � � ) � ) 0 � 4 � @ � D � X � \ � -�pH
� �� �
� F� � �� � � (
�"h"� #1F(F � � (�� � � � ���p� * � 6 � � 3 G B
< �^ �ReadEventLogA > hEventLog A
>" dwReadFlags A >" dwRecordOffset A > lpBuffer A
A 2 >" nNumberOfBytesToRead E E ( B >" pnBytesRead E E , B ! >" pnMinNumberOfBytesNeeded E E 0 B >t ReturnValue A
4 A
6 > Status A
A
6 Z �^ �^ ~^ B! ' hEventLog ' " dwReadFlags ' " dwRecordOffset ' lpBuffer ! ( " nNumberOfBytesToRead , " pnBytesRead % 0 " pnMinNumberOfBytesNeeded O � ` B ` T X �
] � i �$ k �. n �0 r �6 o �: p �< v �, � 0 � ] � a � � � � � � � � � � � � � � � � � � � & � * � P � T � d � h � � � � � � � � � � � � � � � � �
� � � " � 0 � 4 � -�pH
� �� �
� F� � �� � � (
�"h"�#1F(F � � (�� � � � ���p�
* � 6 � � 3 G B
< �^ �ReadEventLogW > hEventLog A
>" dwReadFlags A >" dwRecordOffset A > lpBuffer A
A 2 >" nNumberOfBytesToRead E E ( B >" pnBytesRead E E , B ! >" pnMinNumberOfBytesNeeded E E 0 B >t ReturnValue A
4 A
6 > Status A
A
6 Z �^ �^ ~^ B! ' hEventLog ' " dwReadFlags ' " dwRecordOffset ' lpBuffer ! ( " nNumberOfBytesToRead , " pnBytesRead % 0 " pnMinNumberOfBytesNeeded O � ` B ` T O �
T � _ �$ a �. d �0 h �6 e �: f �< l �, � 0 � ] � a � � � � � � � � � � � � � � � � � � � & � * � P � T � d � h � � � � � � � � � � � � � � � � �
� � � " � 0 � 4 � -�H
� �� KF�h�G K!F�h�GjF�� � � (� � � � ����� $ , � <
� K : G @
@ �^ �RegisterEventSourceA >� UNCServerName A
A . >� ModuleName A >� AnsiString E @ >� AnsiModuleName E @ > LogHandle E @ > ReturnHandle A
2
> Status A
( Z �^ ~^ B!
u ' � UNCServerName ' � ModuleName � AnsiString � AnsiModuleName LogHandle 9 �^ 9 �^ O � h @ `
\ � �
� � � � � �( � �, � �0 � �2 � �4 � �6 � �, � 0 � h � l � x � | � � � � � � � � � � � � � � � B � F � g � k � � � � � 7 � ; � G � K � ` � d � -�H
� �� KF�h�G K!F�h�GjF�� � � (� � � � ����� $ , � < � K : G @
@ �^ �RegisterEventSourceW > UNCServerName A
A . > ModuleName A > LogHandle E @ >} Unicode E @ > ReturnHandle A
2
>} UnicodeModuleName E @ > Status A
( Z �^ ~^ B!
u ' UNCServerName ' ModuleName LogHandle } Unicode } UnicodeModuleName 9 �^ 9 �^ O � h @ `
\ � �
� � � � � �( � �, � �0 � �2 � �4 � �6 � �, � 0 � h � l � x � | � � � � � � � � � � � � � � � F � J � g � k � � & � & 7 � ; � G � K � ` � d � �-��O
� ��oF���F{d�F��@ �`���`�c #{`;` �PO��LP� !$k�i;L$h�GF>a .]��T�<h�B� �P?" !k�i2Kh�G<hF�$ �X�$ � ��d <`��d <`)K{` �{h�h�h �%K{`��LP�D���@����k<h>i�� #����m��;m���l �KFRF � �x`��5F�P�+hC� �P?*h !k�i� 0�G- d �� �P?2F !k�i Kh�Gxh �H (� � � �
����]�� �
� n � � � ( � � 2 G , , �^ �ReportEventA > hEventLog E , A
� 8 R A
� T " < E 8 , >! wType E , A � 4 T A � P " 8
E < , >! wCategory A A � v v A � t ^ E @ , >" dwEventID A
A � z v A � t ^ E D , > lpUserSid E E H , >! wNumStrings E E L , >" dwDataSize E E P , >�^ lpStrings E E T , > lpRawData E E X , >t ReturnValue A
>�^ pAStrings A @ � L v A � t ^ >" AllocatedStrings A v A L � @ � � E , > Status A
� A
$ � B `
A
� J 0 D A
� j " L E , M g^ ( N M g^ P N M g^ �� N M g^ �� N Z �^ �^ ~^ 4 @�"
h g^
u
u
u
u $LN20 $LN24 $LL23 $LN47@ReportEven 8 hEventLog < ! wType @ ! wCategory D " dwEventID H lpUserSid L ! wNumStrings P " dwDataSize T �^ lpStrings X lpRawData �^ pAStrings " AllocatedStrings Status 9< �^ 9` �^ 9� �^ 9� �^ O � , ` � � �" � �& � �( � �B � �L � �P � �h � �j � �t � �z � �~ � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � � � � � � � � � � � �, � 0 � ` � d � p � t � � � � � � � � � � � � � � � � � � � � � � � ( � , � 8 � < � L � P � d � h � � � � � � � � � � � � � � � � � � � � � � � * � . � > � B � g � k � { � � � � � � � � � � � � � � � � � � � � A � E � U � Y � � � � � � � � � � � � � � � � � � � � � � � ! � % � A � E � � � � � � � � � � � � % � ) � 6 � : � G � K � X � \ � � � � � � � � � � � � � � � � � � � � � �-��O
� ��oF���F{d�F��@ �`���`�c #;`{` �PO��L�O� !$k�i=L$h�GF>a ._�}m|hDE� �P?" !k�i4Kh�G|hF�$ �.K;` �U�$ � ��d |`��d |`)K��;h�h�h �&K;`��L��D���@����k|h>i�� #����m��;m����l �KFRF � �8`��5F�T�+hC� �P?*h !k�i� 0�G- d �� �P?2F !k�i
Kh�G8h �H (� � � �
����]���� �
� t � � � ( 0 � � 2 G 4 4 �^ �ReportEventW > hEventLog E 4 A
� : T A
� V $ > E 8 4 >! wType E 4 A � 6 V A � R $ :
E < 4 >! wCategory A A � z x A � v ` E @ 4 >" dwEventID A
A � ~ x A � v ` E D 4 > lpUserSid E E H 4 >! wNumStrings E E L 4 >" dwDataSize E E P 4 >�^ lpStrings E E T 4 > lpRawData E E X 4 >t ReturnValue A
>�^ pUStrings A B � N x A � v ` >" AllocatedStrings A | " A L � $ D � � E 4 > Status A
� A
$ � , L d
A
� J 0 D A
� l " " N E 4 M g^ ( N M g^ P N M g^ �� N M g^ �� N Z j^ �^ ~^ 4 @�"
h g^ $LN56
u
u
u
u $LN20 $LN24 $LL23 $LN48@ReportEven 8 hEventLog < ! wType @ ! wCategory D " dwEventID H lpUserSid L ! wNumStrings P " dwDataSize T �^ lpStrings X lpRawData �^ pUStrings " AllocatedStrings Status 9> �^ 9` �^ 9� �^ 9 �^ O� 4 ` � �" � �& � �( � �D � �L � �P � �h � �j � �l � �p � �z � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � �� � � � � � �
� � � � � � � � � � � �, � 0 � ` � d � p � t � � � � � � � � � � � � � � � � � � � � � � � ( � , � 8 � < � L � P � d � h � � � � � � � � � � � � � � � � � � � � � � � * � . � > � B � g � k � { � � � � � � � � � � � � � � � � � � � � A � E � U � Y � � � � � � � � � � � � � � � � � � � � �
� � ) � - � I � M � � � � � �
� � � $ � ( � 3 � 7 � > � B � O � S � ` � d � q � u � � � � � � � � � � � � � � � � � � � � � -�xH
� h % F�BҴ�:�"��� m �B�Ӥ �#x�d m �B��d �B���` �H��x�� � � 1 G L L n^ �StringCheck >k^ ppbTest A
D @ > pbTooFar A H >t isUnicode A 4 A 2 >t noEmptyAllowed A
A : >q puTest A
A 2 > pTest A
* A 2 >t len A < B!
u k^ ppbTest pbTooFar t isUnicode t noEmptyAllowed O � � L ` � o � s � u � w � { � | �" ~ �$ � �& � �, � �2 � �4 � �< � �> � �B v �D � �, � 0 � Y � ] � � � � � � � � � � � � � � � � � � � � � � � * � . � R � V � f � j � � � � � � � 0 � 4 � -�xH
� � �BFF0�D-.� -F�� ##D�B'�� �Kh�GK*F !h�GF�H�*F!F0F � �0F � � KFh�GK2F !h�G� F � �F � �H��x�� � � J � P j � � � � � - F � � q^ �TestSid > pbStartOfSid A
A ^ F A v > pbTooFar A n 2 6 A v >" sidLength A A l
>r^ pSid A > * A p > pOnePastEndOfSid A
>t valid A X A v Z u^ u^ B!
u
u
u
u
u pbStartOfSid pbTooFar " sidLength 90 v^ 9: y^ ^: 9Z v^ 9d |^ O � � � ` � + � 2 � 5 � 6 � 8 � : �& = �, ? �> @ �@ B �D D �N E �T F �f G �h K �p N �r O �v 3 �x R �, � 0 � Z � ^ � j � n � ~ � � � � � � � � � � � � � � � � � � � � � � � C � G � c � g � w � { � � � � � � � � � � � F � J � V � Z � f � j � v � z � � � � � � � � � `? � � \ � 03������� � � � $ � � r � !� � y � � � � � � p � � p � � t � 03������� � � � $ � � r � �a�� � �`2� � �`2� � � � � y � � y � � �`q� � �`q� � E`�� � 9`? � 9`? � 9`? � 9`? � 9`? � �`0� � �`0� � 9`0� � R gN �٤%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\arm\precomp.obj 'D NtCurrentTeb ��� { � t h^ i^ InitUnicodeString ��
� k^ t t l^ m^ StringCheck " o^ p^ TestSid
P
�
t s^ t^ IsValidSid �
�
� " " w^
x^
� " t z^
{^
� " �% }^ BaseSetLastNTError �
}^
�
� � �^ t �^ �^ InitAnsiString � �] " �^ RegisterEventSourceA ��� $ $ �V �^ " �^ ElfRegisterEventSourceA �^
�^
� �^ OpenEventLogA �� �^ ElfOpenEventLogA ��� " �^ RegisterEventSourceW ��� { { �V �^ " �^ ElfRegisterEventSourceW h^
�^
� �^ OpenBackupEventLogW " �^ ElfOpenBackupEventLogW � � { �- �^
�^
� " -@
�^
� �^ OpenEventLogW �� �^ ElfOpenEventLogW ��� t �^ �^ BackupEventLogW { �^ " �^ ElfBackupEventLogFileW � �^ ClearEventLogW � " " " t �^ " �^ GetEventLogInformation �" �^ ElfClearEventLogFileW �� " " " �^ " �^ ElfGetLogInformation ��� " " t �^ �^ CheckEventLogBuffer
�&
� " t �^ & �^ GetNumberOfEventLogRecords � " �^ �^ ElfNumberOfRecords �" �^ GetOldestEventLogRecord �^ ElfOldestRecord
� * ! ! " ! " �^ t �^ �^ ReportEventW ���
{
� 6 ! ! " ! " �^ ! " " �^ �^ ElfReportEventW " " �^
�^
� t �^ " �^ NotifyChangeEventLog ��� �^ �^ ElfChangeNotify
t �^ " �^ DeregisterEventSource �� �^ CloseEventLog �� �^ & �^ ElfDeregisterEventSource ��� �^ ElfCloseEventLog ��� � t �^ �^ BackupEventLogA �^ ClearEventLogA �
�
� { �^ �^
�^
�
�
� �^ OpenBackupEventLogA " " " " " " t �^ �^ ReadEventLogA �� �^ ReadEventLogW ��" " " " " " �^ �^ ElfReadEventLogA ��� �^ ElfReadEventLogW ���
�
� * ! ! " ! " �^ t �^ �^ ReportEventA ���
�
� 6 ! ! " ! " �^ ! " " �^ �^ ElfReportEventA
���
���
���
���� -FC -MT -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 -Gw -wd4316 -wd4973 �
�^ � �^ -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -wd4366 -wd4746 -Gs4096 -wd4064 -volatile:ms -arch:vfpv3-d16 -TC -X ��� �^ �^ �^ �^ �^ ���ۍ�p��ݵ$/ ;����!��r}`}��`���9�I��W_W�Pk����{?G�)?!~�'_�-&���ݵ$/ ;��:�;�4��yn)>ﳍ��� ����:S �ӭ�}���WѸT:S �ӭ�N��?�d?c��"&`�8�W��$�:S �ӭ�C�#S���):S �ӭ� @��{nd�q��ke'��wDg�!���� W��0��y�Q:S �ӭ�@ x1�?� �B��N8�`��8n�hm�a�d�NK���pO��(��i���z��w
F�^Ts�ģ��/�/M�|��r�|�S�W�tNeK�A�f�ۤok{�����T]A��t�����R��r�|�Sʣ�P����r�|�S��Q�U�,(�Ժ�[�7���GOj
�v��C����-)�8��H��Da� U��zpxo͆ �����E� C�:P�U棯Up��� z"�%m�G�Đ���N�0]BP�����" �3�!�*�O��
r�o�l��
r�o�l�Up��� z2m6�w�̜Đ����#N
�,� 1� � -a^�<E��MD�+�2P�����" P�����" m]�\�Haj��֕.ݫ5���y� 6�덜W�6�덜W�6�덜W�6�덜W�6�덜W�F����fʤ��[F��J`n���/w�!���o� -INCLUDE:__@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� .debug$S � e % = N i � � � � � � �
1 I Z u � � � � � � 8 I \ .text$mn d 1Z� e .debug$S � & e .text$mn l �un e .debug$S & e .text$mn $ G�N� e .debug$S D e .text$mn �P�} e .debug$S D H e .text$mn
d 1Z� e .debug$S � &
e .text$mn p &c e .debug$S
& e .text$mn g 4� e .debug$S `
e .text$mn g 4� e .debug$S h
e .text$mn " ��N e .debug$S L e .text$mn g 4� e .debug$S � e .text$mn g 4� e .debug$S � e .text$mn H �z�� e .debug$S �
e .text$mn D a�Y] e .debug$S �
e .text$mn g 4� e .debug$S l
e .text$mn X��� e .debug$S � e .text$mn � � ` e .debug$S ! 6 e .text$mn " � -�d� e .debug$S # � , " e .text$mn $ D I�ż e .debug$S % � $ e .text$mn & @ �&�� e .debug$S ' � & e .text$mn ( B %ҝ� e .debug$S ) � " ( e .text$mn * B -1�� e .debug$S + � " * e .text$mn , @ �&�� e .debug$S - � , e .text$mn . @ �&�� e .debug$S / � . e .text$mn 0 , �S�� e .debug$S 1 � f 0 e .text$mn 2 4 G��� e .debug$S 3 h 2 e .text$mn 4 L �5�� e .debug$S 5 � 4 e .text$mn 6 � �D#� e .debug$S 7 P 0 6 e x � 0 � ( � � , � $ � �
� 2 * % 4 TestSid 6 1 " E . Z & h x � � � � � �
+ > memcpy $LN16 0 $LN15 0 $LN9 0 $LL7 � 0 $LN5 � 0 $LN6 � 0 $LN13 � 0 $LN25 � 0 $LN36 z 0 $LN12 t 0 $LN44 � 0 $LN8 0 $LN54 ( 0 $LN53 $ 0 $LN52 0 $LN51 0 $LN46 , 0 $LN20 � 0 $LN24 � 0 $LL23 L 0 S 0 $LN4 < ( $LN2 . ( $LN6 6 ( $LN9 ( $LN6 n $LN5 d $LN1 � $LN3 : $LN2 0 $LN16 � $LN15 � $LN14 � $LN13 � $LN3 6 , $LN2 4 , $LN8 < , $LN3 : $ $LN2 8 $ $LN8 @ $ $LN13 R $LN1 J $LN3 8 $LN2 . $LN12 ` $LN11 \ $LN10 X $LN9 T $LN13 R
$LN1 J
$LN3 8
$LN2 .
$LN12 `
$LN11 \
$LN10 X
$LN9 T
$LN56 " 2 $LN16 2 $LN15 2 $LN9
2 $LL7 � 2 $LN5 � 2 $LN6 � 2 $LN13 � 2 $LN25 � 2 $LN46 l 2 $LN36 � 2 $LN11 p 2 $LN44 � 2 $LN8 2 $LN55 0 2 $LN54 , 2 $LN53 ( 2 $LN52 $ 2 $LN47 4 2 $LN20 � 2 $LN24 � 2 $LL23 L 2 d 2 $LN4 < * $LN2 . * $LN6 6 * $LL2 " $LN61 � $LN30 � $LL6 � $LN22 � $LN5 � $LN19 � $LN32 � $LN60 � $LN65 � $LN1 D 4 $LN14 < 4 $LN6 2 4 $LN31 4 4 $LL4 4 $LN3 " 4 $LL30 & 4 $LN9 B 4 $LN35 H 4 $LN8 p 6 $LN11 x 6 $LN9 D 6 $LN7 h 6 $LN3 v 6 $LN20 � 6 $LN19 � 6 $LN18 � 6 $LN17 � 6 $LN16 | 6 $LN20 r " $LN7 j " $LN6 R " $LN5 P " $LN11 H " $LN12 : " $LN19 � " $LN18 | " $LN17 x " $LN16 t " $LN3 6 . $LN2 4 . $LN8 < . $LN3 6 & $LN2 4 & $LN8 < & $LN17 ^ $LN1 X $LN6 4 $LN5 2 $LN4 N $LN16 h $LN15 d $LN14 ` $LN7 F $LN6 D $LN8 ^ $LN3 0 $LN2 * $LN17 l $LN16 h $LN15 d $LN1 $LN2 $LN3 $LN2 $LN3 $LN2 $LN3 $LN2 $LN3 $LN2 $LN3 $LN2 $LN5 < $LN1 @ $LL2 $LN13 , $LN6 0 $LN4 8 $LN5 @ $LN1 D $LL2 $LN13 0 $LN6 4 $LN4 < $LN7 $LN6 .pdata 8 ^nz� e u 8 .pdata 9 0 e � 9 .xdata : ( �H.0 e � : .pdata ; �m��( e � ; .pdata < Gs�z e � < .pdata = =>�u, e � = .pdata > u ^6$ e > .pdata ? W��" e ? .pdata @ W��"
e 2 @ .pdata A 2 e I A .xdata B ( N��Z2 e ^ B .pdata C �m��* e t C .pdata D ��� e � D .pdata E 1�Wc4 e � E .pdata F �Hŝ6 e � F .pdata G !`�" e � G .pdata H =>�u. e � H .pdata I =>�u& e I .pdata J q��R e J .pdata K ���� e 1 K .pdata L 6C�� e H L .pdata M 7V*� e g M .pdata N 7V*� e � N .pdata O 7V*� e � O .pdata P 7V*� e � P .pdata Q 7V*� e � Q .pdata R Ê�� e � R .pdata S ��aQ e S .pdata T Yľ� e , T .debug$T U �
e .chks64 V � e G ElfReportEventA ElfReadEventLogA ElfRegisterEventSourceA ElfOpenEventLogA __imp_RtlFreeUnicodeString __imp_RtlAnsiStringToUnicodeString __imp_RtlInitAnsiString ElfReportEventW __imp_RtlAllocateHeap ElfReadEventLogW __imp_HeapFree IsValidSid __imp_GetProcessHeap __imp_HeapAlloc ElfOpenBackupEventLogW ElfRegisterEventSourceW ElfOpenEventLogW __imp_RtlInitUnicodeString ElfBackupEventLogFileW __imp_RtlFreeHeap ElfClearEventLogFileW __imp_RtlDosPathNameToNtPathName_U ElfGetLogInformation ElfOldestRecord ElfNumberOfRecords ElfChangeNotify ElfDeregisterEventSource ElfCloseEventLog __imp_SetLastError __imp_RtlNtStatusToDosError NtCurrentTeb ReportEventA ReadEventLogA OpenBackupEventLogA RegisterEventSourceA OpenEventLogA BackupEventLogA ClearEventLogA ReportEventW ReadEventLogW CheckEventLogBuffer StringCheck OpenBackupEventLogW RegisterEventSourceW OpenEventLogW BackupEventLogW ClearEventLogW GetEventLogInformation GetOldestEventLogRecord GetNumberOfEventLogRecords NotifyChangeEventLog DeregisterEventSource CloseEventLog InitUnicodeString InitAnsiString BaseSetLastNTError __C_specific_handler $LN47@ReportEven $LN48@ReportEven $pdata1$NtCurrentTeb $pdata2$ReportEventA $unwind3$ReportEventA $pdata1$ReadEventLogA $pdata1$OpenBackupEventLogA $pdata1$RegisterEventSourceA $pdata1$OpenEventLogA $pdata1$BackupEventLogA $pdata1$ClearEventLogA $pdata2$ReportEventW $unwind3$ReportEventW $pdata1$ReadEventLogW $pdata1$CheckEventLogBuffer $pdata1$StringCheck $pdata1$TestSid $pdata1$OpenBackupEventLogW $pdata1$RegisterEventSourceW $pdata1$OpenEventLogW $pdata1$BackupEventLogW $pdata1$ClearEventLogW $pdata1$GetEventLogInformation $pdata1$GetOldestEventLogRecord $pdata1$GetNumberOfEventLogRecords $pdata1$NotifyChangeEventLog $pdata1$DeregisterEventSource $pdata1$CloseEventLog $pdata1$InitUnicodeString $pdata1$InitAnsiString $pdata1$BaseSetLastNTError
/217 1606894170 100666 51508 `
�h ZB�_ܪ Y .debug$S T d @ B.rdata 6 x @0@.rdata � � @0@.rdata � @@@.rdata P � < @@@.rdata x @@@.bss � 0�.data � � @0�.rdata D � @@@.rdata � @0@.gfids$y � @0@.gfids$y @0@.text$mn $ 4 2`.debug$S P R �! @B.text$mn ." N" 2`.debug$S @ l" �# @B.text$mn 4 $$ X$ 2`.debug$S � v$ V& @B.text$mn $ Z' ~' 2`.debug$S P �' �( @B.text$mn x) �) 2`.debug$S @ �) �* @B.text$mn n+ �+ 2`.debug$S � �+ �,
@B.text$mn - (- 2`.debug$S F- R.
@B.text$mn �. �. 2`.debug$S �. �/
@B.text$mn `0 �0 2`.debug$S � �0 �1
@B.text$mn 4 �1 .2 2`.debug$S L L2 �4 @B.text$mn �5 �5 2`.debug$S H �5 "7 @B.text$mn $ �7 �7 2`.debug$S \ �7 89 @B.text$mn 4 �9 �9 2`.debug$S L : b< @B.text$mn 4 f= �= 2`.debug$S X �= @ @B.text$mn 8 A LA 2`.debug$S � jA D @B.text$mn 8 BE zE 2`.debug$S � �E DH @B.text$mn < pI �I 2`.debug$S �I �L @B.text$mn < N VN 2`.debug$S tN �Q @B.text$mn ( �R �R 2`.debug$S �
S �T @B.text$mn 8 RU �U 2`.debug$S � �U `X @B.text$mn 8 �Y �Y 2`.debug$S � �Y �\ @B.text$mn \ �] "^ 2`.debug$S @^ Pc < @B.text$mn ` �e f 2`.debug$S p &f �k @ @B.text$mn X n nn 2`.debug$S � �n Xs 8 @B.text$mn X �u �u 2`.debug$S � �u �z 8 @B.text$mn \ �| V} 2`.debug$S t} �� < @B.text$mn ( ܄ � 2`.debug$S � "� �� @B.pdata R� Z� @@@.pdata d� l� @@@.pdata v� ~� @@@.pdata �� �� @@@.pdata �� �� @@@.pdata �� �� @@@.pdata �� Ƈ @@@.pdata Ї ؇ @@@.pdata � � @@@.pdata � �� @@@.pdata � � @@@.pdata � � @@@.pdata *� 2� @@@.pdata <� D� @@@.pdata N� V� @@@.pdata `� h� @@@.pdata r� z� @@@.pdata �� �� @@@.pdata �� �� @@@.pdata �� �� @@@.pdata �� @@@.pdata ̈ Ԉ @@@.pdata ވ � @@@.pdata � �� @@@.pdata �
� @@@.pdata � � @@@.pdata &� .� @@@.debug$S < 8� t� @B.debug$S , �� �� @B.debug$S 8 ȉ � @B.debug$S , � @� @B.debug$S 8 T� �� @B.debug$S 4 �� Ԋ @B.debug$S 8 � � @B.debug$S 0 4� d� @B.debug$T x x� @ B.chks64 @ �
.drectve l p�
� � Q d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\elf_client.obj : < � � k k
Microsoft (R) Optimizing Compiler � , * eventlog__MIDL_AutoBindHandle � � " �^ elf_MIDL_TYPE_FORMAT_STRING " �^ elf_MIDL_PROC_FORMAT_STRING # �^ _elf_MIDL_PROC_FORMAT_STRING # �^ _elf_MIDL_TYPE_FORMAT_STRING � � 8 o ����o� }�+4qt*Y lռ��́dq�X � ���@�R�ђ�e��<r = h��� a� � Lzɰ%ЅC��Y��Y�ŴŊ
��ɕ] � � onecore\admin\wmi\events\advapi\objfre\arm\pch_hdr.src onecore\admin\wmi\events\advapi\objfre\arm\precomp.pch onecore\admin\wmi\events\advapi\precomp.h onecore\admin\wmi\events\advapi\elf_client.c onecore\admin\wmi\events\idl\elf\objfre\arm\elf_c.c � L�^ � � 6 l � � � 4r�`�<r��L��r��b��
0I ( U U [ K\F\ �[\[ � 0� \ \[\ 0� � �� ) �� [� � � ( [ L �\[ �� [ �L �\[ ' K\HI .�[\[ ) � [\ [ K\F\ �[\[ �\� �� � � � ' K\HI ��[\[ � �� )T �� [� �� ) �� [ ) [� � � � ' K\HI �[\[ ) � [ �� � � ' K\HI v�[\[� � � ' K\HI D�[\[
n " H 0H $ FE �� p H 0H $ FE �� 0 p H 0� 8 @ D G � N p H 0� 8 @ D G � N p H 0H $ $ DE �� P! p H 0H $ $ DE �� P! p H 0H D DE ���� � V H p H 1 \* @ FG ������
^ 0 0 H H f p H 1 \* @ FG ������
^ 0 0 H H f p H 1 \* @ FG �����
^ 0 H H f p H
0H < @ EG ������� H H � j x P! P! p H < 0H � @ FE ������
H H H H � � � � 0 � $ � ( H , 0 " 4 "p 8 H 0H $ FE �� &p H
0H $ FE �� @p H 1 \) @ FG ������
Z @ @H H f p H 1 \) @ FG ������
Z @ @H H f p H 1 \) @ FG �����
Z @H H f p H 0H < @ EG ������� H H � ^ x P! P! p H < 0H � @ FE ������
H H H H � h� r @ � $ | ( H , 0 " 4 "p 8 H 1 \ $ EC ���
^ ! � �p H 1 \ D A �
^ p H 1 \" FE ���
^ � � �p H 0H 4 $ EG ����� H �� P! p H 0H $ D E � p H @ 0H � @ FE ������ H H H H 0 � � ( 0 $ � ( 2 , `H 0 4 " 8 "p < H 8 0H � $ FE
������
V H H H � ~� � 0 � $ � ( H , 0 "p 4 H 8 0H � $ FE
������
V H H H � �� � @ � $ � ( H , 0 "p 4 " D �?'�*��?x�y)�#� ]��� ��� +H` ]��� ��� +H`
-� H�F FIFH�]q�� H � ��� � 4 G $ $ �^ �ElfrBackupELFA >Z LogHandle A
>w^ BackupFileName A
Z l^ B! $LN8
u
u Z LogHandle w^ BackupFileName O� ( $ ` j � n �, � 0 � ^ � b � � � � � � � � � � � � � � � � � ( � , � -� H�F FIFH81�� H � � � 4 G �^ �ElfrBackupELFW >Z LogHandle A
>m^ BackupFileName A
Z l^ B!
u
u Z LogHandle m^ BackupFileName O� ( ` h � l �, � 0 � ^ � b � � � � � � � � � � � � � � � �-�<H
� F FIFFH��q� � � ���<]���� , 0 � � 6 G 4
4 �^ �ElfrChangeNotify >Z LogHandle A
>A ClientId A A C C E 4 >" Event A
A
Z l^ B! $LN8
u
u Z LogHandle A ClientId $ " Event O � 0 4 ` $ � � � �" � �, � 0 � ` � d � � � � � � � � � � � � � � � � � � � � � � � � � � � � 5 � 9 � I � M � X � \ � � � � � -� H�F FIFH�>1�� H � ��� � 3 G $ $ �^ �ElfrClearELFA >Z LogHandle A
>w^ BackupFileName A
Z l^ B! $LN8
u
u Z LogHandle w^ BackupFileName O � ( $ ` Y � ] �, � 0 � ] � a � � � � � � � � � � � � � � � � � ( � , � -� H�F FIFH� �� H � � � 3 G �^ �ElfrClearELFW >Z LogHandle A
>m^ BackupFileName A
Z l^ B!
u
u Z LogHandle m^ BackupFileName O � ( ` W � [ �, � 0 � ] � a � � � � � � � � � � � � � � � -� H�FKFH�n�� H � � � � 1 G �^ �ElfrCloseEL >�^ LogHandle A
Z l^ B!
u
u �^ LogHandle O � ( ` x � | �, � 0 � [ � _ � � � � � � � � � � � � � -� H�FKFH��a�� H � � � � > G �^ �ElfrDeregisterClusterSvc >q UNCServerName A
Z l^ B!
u
u q UNCServerName O� ( ` � �, � 0 � l � p � � � � � � � � � � � � � -� H�FKFH��� H � � � � ? G �^ �ElfrDeregisterEventSource >�^ LogHandle A
Z l^ B!
u
u �^ LogHandle O � ( ` � � � �, � 0 � i � m � � � � � � � � � � � � � -� H�FKFH�da�� H � � � � 1 G i^ �ElfrFlushEL >Z LogHandle A
Z l^ B!
u
u Z LogHandle O � ( ` S � W �, � 0 � [ � _ � � � � � � � � � � � � � -�?H
� F F�FF�IH��a � � ����0��� , 0 � ; G 4 4 ~^ �ElfrGetLogInformation >Z LogHandle A
>" InfoLevel A > lpBuffer A A >" cbBufSize A
A
>" pcbBytesNeeded E E *
Z l^ B! $LN8
u
u Z LogHandle " InfoLevel lpBuffer " cbBufSize " pcbBytesNeeded O � 0 4 ` $ @ � D �$ N �, � 0 � e � i � � � � � � � � � � � � � � � � � � � � � � ! � 1 � 5 � g � k � { � � � � � � � � -� H�F FIFH�1�� H � � � 9 G �^ �ElfrNumberOfRecords >Z LogHandle A
>" NumberOfRecords A
Z l^ B!
u
u Z LogHandle " NumberOfRecords O � ( ` � � � �, � 0 � c � g � � � � � � � � � � � � � � $ � -� H�F FIFH��q�� H � ��� � 6 G $ $ �^ �ElfrOldestRecord >Z LogHandle A
>" OldestRecordNumber A
Z l^ B! $LN8
u
u Z LogHandle " OldestRecordNumber O � ( $ ` � � � �, � 0 � ` � d � � � � � � � � � � � � � � � � � 4 � 8 � -�?H
� F F�FF�IH��NA � � ����0��� , 0 � 2 G 4 4 �^ �ElfrOpenBELA >p UNCServerName A
>w^ FileName A >" MajorVersion A A >" MinorVersion A
A
>�^ LogHandle E E *
Z l^ B! $LN8
u
u p UNCServerName w^ FileName " MajorVersion " MinorVersion �^ LogHandle O � 0 4 ` $ � � � �$ � �, � 0 � ` � d � � � � � � � � � � � � � � � � � � � � � � � - � 1 � c � g � w � { � � � � � � � -�?H
� F F�FF�IH��q � � ����0��� , 0 � 2 G 4 4 �^ �ElfrOpenBELW >q UNCServerName A
>m^ BackupFileName A >" MajorVersion A A >" MinorVersion A
A
>�^ LogHandle E E *
Z l^ B! $LN8
u
u q UNCServerName m^ BackupFileName " MajorVersion " MinorVersion �^ LogHandle O � 0 4 ` $ � �$ �, � 0 � ` � d � � � � � � � � � � � � � � � � � � � � � � # � 3 � 7 � i � m � } � � � � � � � ( � , � -�?H
� F F �FF��H��I ��1 � ����0��� $ 0 4 � e 1 G 8 8 �^ �ElfrOpenELA >p UNCServerName A
>w^ ModuleName A >w^ RegModuleName A A >" MajorVersion A
A
$ >" MinorVersion E E . >�^ LogHandle E E $ .
Z l^ B! $LN8
u
u p UNCServerName w^ ModuleName w^ RegModuleName " MajorVersion " MinorVersion $ �^ LogHandle O � 0 8 ` $ � � �( � �, � 0 � _ � c � � � � � � � � � � � � � � � � � � � � � � " � 2 � 6 � Z � ^ � n � r � � � � � � � � � � � � � | � � � -�?H
� F F �FF��H��I ���q � ����0��� $ 0 4 � e 1 G 8 8 �^ �ElfrOpenELW >q UNCServerName A
>m^ ModuleName A >m^ RegModuleName A A >" MajorVersion A
A
$ >" MinorVersion E E . >�^ LogHandle E E $ .
Z l^ B! $LN8
u
u q UNCServerName m^ ModuleName m^ RegModuleName " MajorVersion " MinorVersion $ �^ LogHandle O � 0 8 ` $ � � � �( � �, � 0 � _ � c � � � � � � � � � � � � � � � � � � � � � � " � 2 � 6 � Z � ^ � n � r � � � � � � � � � � � � � | � � � -�0H
� �� F F �FF� �H��
� ��I��a � ����0� * 4 8 � � 1 G <
< �^ �ElfrReadELA >Z LogHandle A
>" ReadFlags A >" RecordOffset A A " >" NumberOfBytesToRead A
A ( > Buffer E E ( 4 >" NumberOfBytesRead E E , 4 >" MinNumberOfBytesNeeded E E 0 4
Z l^ B!
u
u ' Z LogHandle ' " ReadFlags ' " RecordOffset ' " NumberOfBytesToRead ( Buffer , " NumberOfBytesRead # 0 " MinNumberOfBytesNeeded O � 0 < ` $ � � � �. � �, � 0 � [ � _ � � � � � � � � � � � � � � � � � � � � � � - � 1 � ] � a � q � u � � � � � � � � � � � � � � � � � � � -�0H
� �� F F �FF� �H��
� ��I�b! � ����0� * 4 8 � � 1 G <
< �^ �ElfrReadELW >Z LogHandle A
>" ReadFlags A >" RecordOffset A A " >" NumberOfBytesToRead A
A ( > Buffer E E ( 4 >" NumberOfBytesRead E E , 4 >" MinNumberOfBytesNeeded E E 0 4
Z l^ B!
u
u ' Z LogHandle ' " ReadFlags ' " RecordOffset ' " NumberOfBytesToRead ( Buffer , " NumberOfBytesRead # 0 " MinNumberOfBytesNeeded O � 0 < ` $ � �. * �, � 0 � [ � _ � � � � � � � � � � � � � � � � � � � � � � - � 1 � ] � a � q � u � � � � � � � � � � � � � � � � � � � -� H
� FIFFH�tQ � � ��� � $ � b < G ( ( �^ �ElfrRegisterClusterSvc >q UNCServerName A
>" pulSize A >�^ ppPackedEventInfo A A
Z l^ B!
u
u q UNCServerName " pulSize �^ ppPackedEventInfo O � 0 ( ` $ �
� �, � 0 � j � n � � � � � � � � � � � � � � � � � x � | � -�?H
� F F �FF��H��I ��q � ����0��� $ 0 4 � r > G 8 8 �^ �ElfrRegisterEventSourceA >p UNCServerName A
>w^ ModuleName A >w^ RegModuleName A A >" MajorVersion A
A
$ >" MinorVersion E E . >�^ LogHandle E E $ .
Z l^ B! $LN8
u
u p UNCServerName w^ ModuleName w^ RegModuleName " MajorVersion " MinorVersion $ �^ LogHandle O � 0 8 ` $ � � � �( � �, � 0 � l � p � � � � � � � � � � � � � � � � � � � + � / � ? � C � g � k � { � � � � � � � � � � � � � � � � � � -�?H
� F F �FF��H��I ���q � ����0��� $ 0 4 � r > G 8 8 �^ �ElfrRegisterEventSourceW >q UNCServerName A
>m^ ModuleName A >m^ RegModuleName A A >" MajorVersion A
A
$ >" MinorVersion E E . >�^ LogHandle E E $ .
Z l^ B! $LN8
u
u q UNCServerName m^ ModuleName m^ RegModuleName " MajorVersion " MinorVersion $ �^ LogHandle O � 0 8 ` $ � � � �( � �, � 0 � l � p � � � � � � � � � � � � � � � � � � � + � / � ? � C � g � k � { � � � � � � � � � � � � � � � � � � -�0H
� �� F F�FF ��H�
���\ � �������������D���I��a � � ���0� J T X � � 6 G \
\ �^ �ElfrReportEventA >Z LogHandle A
>" Time A >! EventType A A B >! EventCategory A
A H >" EventID E E @ T >! NumStrings E E D T >" DataSize E E H T >w^ ComputerName E E L T >n^ UserSID E E P T >x^ Strings E E T T
> Data E E X T >! Flags E E \ T >" RecordNumber E E ` T >" TimeWritten E $ E d T
Z l^ 0 B!
u
u ? Z LogHandle ? " Time ? ! EventType ? ! EventCategory @ " EventID D ! NumStrings H " DataSize L w^ ComputerName P n^ UserSID T x^ Strings X Data \ ! Flags ` " RecordNumber d " TimeWritten O� 0 \ ` $ � � � �N �, � 0 � ` � d � � � � � � � � � � � � � � � � � � � � � � % � ) � N � R � b � f � � � � � � � � � � � � � � � � � � � � � < � @ � P � T � s � w � � � � � � � � � � � � � � � � � � � � ( � , � < � @ � v � z � � � � � � � � � -�0H
� �� F F �FF ��H� ���h �
�� �����������P�����I�a � ����0� N X \ � + ? G `
` r^ �ElfrReportEventAndSourceW >Z LogHandle A
>" Time A >! EventType A A F >! EventCategory A
A L >" EventID E E H X >m^ SourceName E E L X >! NumStrings E E P X >" DataSize E E T X >m^ ComputerName E E X X >n^ UserSID E E \ X >o^ Strings E E ` X
> Data E E d X >! Flags E E h X >" RecordNumber E $ E l X >" TimeWritten E ( E p X
Z l^ 8 B!
u
u G Z LogHandle G " Time G ! EventType G ! EventCategory H " EventID L m^ SourceName P ! NumStrings T " DataSize X m^ ComputerName \ n^ UserSID ` o^ Strings d Data h ! Flags l " RecordNumber p " TimeWritten O � 0 ` ` $ p � t �R � �, � 0 � i � m � � � � � � � � � � � � � � � � � � � � � � � . � 2 � W � [ � k � o � � � � � � � � � � � � � � � � � � � " � & � H � L � \ � ` � � � � � � � � � � � � � � � � � � � � � � � 0 � 4 � D � H � n � r � � � � � � � � � � � � � @ � D � -�0H
� �� F F�FF
���\H� �� ������������D���I�q � � ���0� F P T � � 8 G X
X {^ �ElfrReportEventExA >Z LogHandle A
>s^ TimeGenerated A >! EventType A A > >! EventCategory A
A D >" EventID E E @ P >! NumStrings E E D P >" DataSize E E H P >w^ ComputerName E E L P >n^ UserSID E E P P >x^ Strings E E T P
> Data E E X P >! Flags E E \ P >" RecordNumber E E ` P
Z l^ 0 B!
u
u ? Z LogHandle ? s^ TimeGenerated ? ! EventType ? ! EventCategory @ " EventID D ! NumStrings H " DataSize L w^ ComputerName P n^ UserSID T x^ Strings X Data \ ! Flags ` " RecordNumber O� 0 X ` $ � � � �J � �, � 0 � b � f � � � � � � � � � � � � � � � � � � � � � � � 0 � 4 � Y � ] � m � q � � � � � � � � � � � � � � � � �
� � ! � % � G � K � [ � _ � ~ � � � � � � � � � � � � � � � � � � � �
� C � G � R � V � � � � � -�0H
� �� F F�FF
���\H� �� ������������D���I� q � � ���0� F P T � � 8 G X
X v^ �ElfrReportEventExW >Z LogHandle A
>s^ TimeGenerated A >! EventType A A > >! EventCategory A
A D >" EventID E E @ P >! NumStrings E E D P >" DataSize E E H P >m^ ComputerName E E L P >n^ UserSID E E P P >o^ Strings E E T P
> Data E E X P >! Flags E E \ P >" RecordNumber E E ` P
Z l^ 0 B!
u
u ? Z LogHandle ? s^ TimeGenerated ? ! EventType ? ! EventCategory @ " EventID D ! NumStrings H " DataSize L m^ ComputerName P n^ UserSID T o^ Strings X Data \ ! Flags ` " RecordNumber O� 0 X ` $ � � � �J � �, � 0 � b � f � � � � � � � � � � � � � � � � � � � � � � � 0 � 4 � Y � ] � m � q � � � � � � � � � � � � � � � � �
� � ! � % � G � K � [ � _ � ~ � � � � � � � � � � � � � � � � � � � �
� C � G � R � V � � � � � -�0H
� �� F F�FF ��H�
���\ � �������������D���I�! � � ���0� J T X � � 6 G \
\ �^ �ElfrReportEventW >Z LogHandle A
>" Time A >! EventType A A B >! EventCategory A
A H >" EventID E E @ T >! NumStrings E E D T >" DataSize E E H T >m^ ComputerName E E L T >n^ UserSID E E P T >o^ Strings E E T T
> Data E E X T >! Flags E E \ T >" RecordNumber E E ` T >" TimeWritten E $ E d T
Z l^ 0 B!
u
u ? Z LogHandle ? " Time ? ! EventType ? ! EventCategory @ " EventID D ! NumStrings H " DataSize L m^ ComputerName P n^ UserSID T o^ Strings X Data \ ! Flags ` " RecordNumber d " TimeWritten O� 0 \ ` $ < � @ �N S �, � 0 � ` � d � � � � � � � � � � � � � � � � � � � � � � % � ) � N � R � b � f � � � � � � � � � � � � � � � � � � � � � < � @ � P � T � s � w � � � � � � � � � � � � � � � � � � � � ( � , � < � @ � v � z � � � � � � � � � -� H
� FIFFH��Q � � ��� � $ � L < G ( ( �^ �ElfrWriteClusterEvents >q UNCServerName A
>" ulSize A > pBuffer A A
Z l^ B!
u
u q UNCServerName " ulSize pBuffer O� 0 ( ` $ + �
/ � 7 �, � 0 � j � n � � � � � � � � � � � � � � � � � �
� ` � d � � 1 � � 1 � � � � 1@? � U � � A`�� � 1@? � A`�� � � 1 � i � � U � � ] � � ] � � 5@? � 5@? � � 1 � i � � U � � ] � � ] � � U�q� � 5@? � 1@? � 1@? � 1@? � 1@? � 1@? � � / - �^ eventlog_FormatStringOffsetTable � �^ BindingRoutines � ) ' �^ elf__MIDL_TypeFormatString � eventlog_StubDesc � ) ' �^ elf__MIDL_ProcFormatString � & $
eventlog_ClientIfHandle � , * �! eventlog___RpcClientInterface " " � ! 8 _RpcTransferSyntax % % R gN �٤%OBJECT_ROOT%onecore\admin\wmi\events\advapi\objfre\arm\precomp.obj
Z g^ h^ ElfrFlushEL ^( J �+ j^ k^ NdrClientCall2 �
�
�,
�
m^
� B Z " ! ! " m^ ! " m^ n^ o^ ! " " p^ & q^ ElfrReportEventAndSourceW ��
x
� :
Z s^ ! ! " ! " m^ n^ o^ ! "
t^ u^ ElfrReportEventExW �
�!
�
w^
� :
Z s^ ! ! " ! " w^ n^ x^ ! "
y^ z^ ElfrReportEventExA � Z " " " |^ " }^ ElfrGetLogInformation �� q " ^ " �^ ElfrWriteClusterEvents �
q �^ & �^ ElfrDeregisterClusterSvc ���> Z " ! ! " ! " w^ n^ x^ ! " " �^ �^ ElfrReportEventA ���" Z " " " " " �^ �^ ElfrReadELA
Z
� p w^ " " �^ �^ �^ ElfrOpenBELA ���
� q " �^ �^ " �^ ElfrRegisterClusterSvc � Z w^ �^ �^ ElfrBackupELFA � p w^ w^ " " �^ �^ & �^ ElfrRegisterEventSourceA ��� �^ ElfrOpenELA �^ ElfrClearELFA �� �^ ElfrReadELW > Z " ! ! " ! " m^ n^ o^ ! " " �^ �^ ElfrReportEventW ��� q m^ " " �^ �^ �^ ElfrOpenBELW ��� q m^ m^ " " �^ �^ & �^ ElfrRegisterEventSourceW ��� �^ ElfrOpenELW Z ? " �^ �^ ElfrChangeNotify ��� Z " �^ �^ ElfrOldestRecord ���
�^ �^ & �^ ElfrDeregisterEventSource �� �^ ElfrNumberOfRecords �^ ElfrCloseEL Z m^ �^ �^ ElfrBackupELFW � �^ ElfrClearELFW �� 1 " 6 � � " � " �&
Pad ��
�^ Format ���V �^ _elf_MIDL_TYPE_FORMAT_STRING .?AU_elf_MIDL_TYPE_FORMAT_STRING@@ ��: onecore\admin\wmi\events\idl\elf\objfre\arm\elf_c.c �^ �^ " �&
Pad ��
�^ Format ���V �^ _elf_MIDL_PROC_FORMAT_STRING .?AU_elf_MIDL_PROC_FORMAT_STRING@@ �� �^ �^ $
���
���
���
���� -FC -MT -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 -Gw -wd4316 -wd4973 �
�^ � �^ -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -wd4366 -wd4746 -Gs4096 -wd4064 -volatile:ms -arch:vfpv3-d16 -TC -X ��� �^ �^ �^ �^ �^ ��i�>���� F��{�7G��q�����sMe� ��b�YβA�'K �?a��/۲��X��^�I#J��F��Δ.��`�e��Z��pTS�y"V�<Q�H� -���.�nV%.y���zN"��;'~0Tz�� }@@��A& ~\�'� �(�Ki�%<��zA��5B����`H� tGa�����;#r��N��h�S��@�g��t�r�]k7h��<��h�_��J�|U�o�u
DyF���Qs53� �\|��>��%�j�"�x�+�I��!ZW7O�O�!�>`��g�C8�f��� �`�q�D�bu����А oO�0�h�,[���Czw3
R�Y�Ii �_�u ݣ���2�a��Pt
�ۤ� �c% (�s
u�e8J� B[�%�$�T �Z����|� �������3
,.O1evzd�g iM�?�v �����ՙ�.����ے�G�z��p�����2bR)B��תl�s�S��˯�O��嵊&�S9�c%ԥ��/�� Y,ߺ� � Y,ߺ� �N���W��h6Cֱ[��z�\e;Yc���ƛ W��h6CֱYc���ƛ rf�9��R�XX��o�o[��z�\e;�}���#�f�}���#�f�2 /U�2�2 /U�2rf�9��R�XX��o�o[��z�\e;�}���#�f�}���#�fT�
�u|�2 /U�2W��h6CֱW��h6CֱW��h6CֱW��h6CֱW��h6Cֱ�p� ���CT5�,�G�A"�E����?J2���춏%8 �R�e�Nk��� ����4�qkB��)6��=IH -INCLUDE:__@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinUkivxlnkOlyq@elfapi @comp.idk�� @feat.00� ��� .debug$S e .rdata 6 �� e & G ` w � .rdata e � .rdata �`^r e � .rdata P M��� e � .rdata %�� e � � .bss e .data e , .rdata D w:� e D .rdata
c�s� e b
.gfids$y QE� e u .gfids$y ��� e u .text$mn
$ ��f� e .debug$S P
e .text$mn >d�| e .debug$S @ e .text$mn 4 �� e .debug$S � e .text$mn $ 4Y$x e .debug$S P e .text$mn �Axr e .debug$S @ e .text$mn v4�� e .debug$S �
e .text$mn o
cf e .debug$S
e .text$mn <--� e .debug$S
e .text$mn ^ � e .debug$S �
e .text$mn 4 W� e .debug$S L e .text$mn ! t}n e .debug$S " H ! e .text$mn # $ !�� e .debug$S $ \ # e .text$mn % 4 K� e .debug$S & L % e .text$mn ' 4 <�� e .debug$S ( X ' e .text$mn ) 8 �5�� e .debug$S * � ) e .text$mn + 8 �P� e .debug$S , � + e .text$mn - < �@� e .debug$S . - e .text$mn / < �
KV e .debug$S 0 / e .text$mn 1 ( b��� e .debug$S 2 � 1 e .text$mn 3 8 :?ze e .debug$S 4 � 3 e .text$mn 5 8 ���f e .debug$S 6 � 5 e .text$mn 7 \ 5+E e .debug$S 8 < 7 e .text$mn 9 ` �S e .debug$S : p @ 9 e .text$mn ; X H$�� e .debug$S < � 8 ; e .text$mn = X ��]> e .debug$S > � 8 = e .text$mn ? \ ��5 e .debug$S @ < ? e .text$mn A ( {:�� e .debug$S B � A e � ; � = � 9 � � � A � 1 - 7 > - J % W 3 p ) |
� � ? � / � ' � 5 � + � � #
! 8 D S $LN7 T ; $LN6 P ; $LN7 T = $LN6 P = $LN7 \ 9 $LN6 X 9 $LN7 $LN6 $LN8 * $LN7 0 $LN6 , $LN7 $ A $LN6 A $LN7 $LN6 $LN7 $ 1 $LN6 1 $LN7 X 7 $LN6 T 7 $LN7 8 - $LN6 4 - $LN8 * % $LN7 0 % $LN6 , % $LN8 . 3 $LN7 4 3 $LN6 0 3 $LN8 . ) $LN7 4 ) $LN6 0 ) $LN8
$LN7
$LN6
$LN8 $LN7 $LN6 $LN7 X ? $LN6 T ? $LN7 8 / $LN6 4 / $LN8 * ' $LN7 0 ' $LN6 , ' $LN8 . 5 $LN7 4 5 $LN6 0 5 $LN8 . + $LN7 4 + $LN6 0 + $LN8 * $LN7 0 $LN6 , $LN8 # $LN7 # $LN6 # $LN7 ! $LN6 ! $LN7 $LN6 $LN7 $LN6 $LN7 $LN6 $LN7 $LN6 .pdata C h(��; e a C .pdata D h(��= e | D .pdata E ���9 e � E .pdata F 88�` e � F .pdata G ͡x2 e � G .pdata H aԶLA e � H .pdata I 88�` e
I .pdata J aԶL1 e + J .pdata K � 7o7 e J K .pdata L ���- e c L .pdata M ͡x2% e w M .pdata N "��3 e � N .pdata O "��) e � O .pdata P o���
e � P .pdata Q o��� e � Q .pdata R � 7o? e � R .pdata S ���/ e S .pdata T ͡x2' e T .pdata U "��5 e 0 U .pdata V "��+ e Q V .pdata W *C� e e W .pdata X o���# e ~ X .pdata Y 88�`! e � Y .pdata Z 88�` e � Z .pdata [ 88�` e � [ .pdata \ 88�` e � \ .pdata ] 88�` e ] .debug$S ^ < e .debug$S _ , e .debug$S ` 8 e .debug$S a , e .debug$S b 8 e .debug$S c 4 e .debug$S d 8 e .debug$S e 0
e .debug$T f x e .chks64 g @ e MIDL_user_free MIDL_user_allocate eventlog_FormatStringOffsetTable EVENTLOG_HANDLE_A_unbind EVENTLOG_HANDLE_A_bind EVENTLOG_HANDLE_W_unbind EVENTLOG_HANDLE_W_bind BindingRoutines elf__MIDL_TypeFormatString eventlog_StubDesc elf__MIDL_ProcFormatString NdrClientCall2 eventlog__MIDL_AutoBindHandle eventlog_ClientIfHandle eventlog___RpcClientInterface _RpcTransferSyntax __guard_fids__ ElfrReportEventExA ElfrReportEventExW ElfrReportEventAndSourceW ElfrFlushEL ElfrGetLogInformation ElfrWriteClusterEvents ElfrDeregisterClusterSvc ElfrRegisterClusterSvc ElfrReportEventA ElfrReadELA ElfrOpenBELA ElfrRegisterEventSourceA ElfrOpenELA ElfrBackupELFA ElfrClearELFA ElfrReportEventW ElfrReadELW ElfrOpenBELW ElfrRegisterEventSourceW ElfrOpenELW ElfrChangeNotify ElfrOldestRecord ElfrNumberOfRecords ElfrDeregisterEventSource ElfrCloseEL ElfrBackupELFW ElfrClearELFW $pdata1$ElfrReportEventExA $pdata1$ElfrReportEventExW $pdata1$ElfrReportEventAndSourceW $pdata1$ElfrFlushEL $pdata1$ElfrGetLogInformation $pdata1$ElfrWriteClusterEvents $pdata1$ElfrDeregisterClusterSvc $pdata1$ElfrRegisterClusterSvc $pdata1$ElfrReportEventA $pdata1$ElfrReadELA $pdata1$ElfrOpenBELA $pdata1$ElfrRegisterEventSourceA $pdata1$ElfrOpenELA $pdata1$ElfrBackupELFA $pdata1$ElfrClearELFA $pdata1$ElfrReportEventW $pdata1$ElfrReadELW $pdata1$ElfrOpenBELW $pdata1$ElfrRegisterEventSourceW $pdata1$ElfrOpenELW $pdata1$ElfrChangeNotify $pdata1$ElfrOldestRecord $pdata1$ElfrNumberOfRecords $pdata1$ElfrDeregisterEventSource $pdata1$ElfrCloseEL $pdata1$ElfrBackupELFW $pdata1$ElfrClearELFW /292 1606894170 100666 1571285 `
�
ZB�_x� ! .debug$S � � @ B.rdata � @0@.rdata $� @0@.rdata *� @0@.rdata .� 6� @0@.rdata @� H� @0@.rdata R� Z� @0@.debug$S 4 d� �� @B.debug$S @ �� � @B.debug$S 8 � 8� @B.debug$P �Y L� @ B.chks64 h �
.drectve t�
� � N d:\os\obj\armfre\onecore\admin\wmi\events\advapi\objfre\arm\precomp.obj : < � � k k
Microsoft (R) Optimizing Compiler � l� 5 m ProcThreadAttributeSafeOpenPromptOriginClaim ) v AuditEventDirectoryServiceAccess � SmrGcActionStop " � ProcessBreakOnTermination � % VrfPlatformModeTest # � ImageMitigationOptionsMask ) DynamicTickVetoClockUpdateFailed � , ProcessImageFileMapping H TP_LOG_LEVEL_INFO e � DPFLTR_REFS_ID i _ARM_BANKED_R13_USR v ProcessWorkingSetSwap z PowerActionSleep # � PoCsDeviceNotificationWiFi � PowerSystemMaximum & � � SystemSingleModuleInformation ! � EnlistmentCrmInformation ( ( MonitorRequestReasonIdleTimeout : PerfCSwapLite e � DPFLTR_MPIO_ID J ProfileTotalIssues � 3 ReservedForDVRF51 & i JobObjectReserved2Information 0 t InternalWakeSourcePredictedUserPresence " z S SystemBatteryStatePrecise - } 9 FileLinkInformationBypassAccessCheck ! � RtlPathTypeDriveAbsolute # � PlugPlayControlStartDevice � LockQueueIoVpbLock } . FileHardLinkInformation & � � AccessReasonFromPrivilege � COR_VERSION_MAJOR z X ThermalStandby KeyBasicInformation LearningModeLogLevelMax � VrfStandardDDIRuleClass z ProcessorInformation % h DISPLAYCONFIG_TOPOLOGY_CLONE � NtProductWinNt � FpFormatI64 , � PlugPlayControlTargetDeviceRelation � PsProtectedSignerLsa � TokenSessionReference FpCodeSquareRoot % SystemVaTypePagedPool � GEO_ISO2 + ( VRF_TRIAGE_CONTEXT_FLIGHT_TARGETED i _ARM_BANKED_R13_SVC L SecurityAppliance , O MemExtendedParameterPartitionHandle # R PnpQueryTransportRelations z SystemVideoState } H FileLinkInformationEx , � PsEnergyComponentTypeWindowResource + � EtwCoverageSamplerQueryInformation 1 FilterBootOptionOperationOpenSystemStore 2 � SE_WS_APPX_SIGNATURE_ORIGIN_NOT_VALIDATED ' � H SystemWatchdogTimerInformation " + FileFsObjectIdInformation / 0 JOB_OBJECT_IO_RATE_CONTROL_VALID_FLAGS # MaxProcessMitigationPolicy ' 7 EtwQueryPartitionInformationV2 " = MmEtwWorkingSetTypeSystem i _ARM_BANKED_R14_ABT ) E FeatureConfigurationPriorityUser H TypeA K AuditDeleteObject �
LockQueueIoDatabaseLock % �
PsEnergyComponentTypeAudioIn $ s TransactionOutcomeCommitted ) v LdrModulesWaitingForDependencies � LockQueueUnusedSpare15 � ToleranceIntervalShort � D WinHighLabelSid � TpTraceThreadPriority & i JobObjectReserved9Information ( MonitorRequestReasonDP 2 � � SystemDifRemovePluginVerificationOnDriver � FileNameInfo z G SuspendResumeInvocation 2 � DISPLAYCONFIG_DEVICE_INFO_GET_SOURCE_NAME $ ACTCTX_RUN_LEVEL_AS_INVOKER ( WMI_GET_SINGLE_INSTANCE $ � k WinAccountProtectedUsersSid % � w SystemPagedPoolInformationEx ( MonitorRequestReasonLid . � O ProcessWin32kSyscallFilterInformation � SystemPowerState ! � ThreadActualBasePriority ( � ResourceManagerBasicInformation & � SubsystemInformationTypeWin32 $ � RtlSparseBitmapOperationAny � ? ProcessFaultInformation � AclSizeInformation i _ARM_BANKED_ELR_HYP ) EtwBufferStatePendingCompression e J DPFLTR_DMSERVER_ID i 0 MaxJobObjectInfoClass r SERVERSILO_TERMINATED � MaxTpTraceType � IoPriorityCritical � IoSessionStateCreated & � VrfPowerDelayFuzzingRuleClass � LockQueueNtfsStructLock � ViewUnmap � PowerDeviceMaximum , � CrossProcOperationMemoryDirtyNotify e � DPFLTR_LSASS_ID BootEntropySourceTpm ' SectionOriginalBaseInformation e & DPFLTR_SCCLIENT_ID
MaxKeyInfoClass " � � SystemRootSiloInformation ) L WorkerFactoryCallbackIndependent & ProcessSystemCallFilterPolicy [ IMDT_UNAVAILABLE " � � � AccessReasonFilterAce } FileStandardInformation 9 � PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION ! i JobObjectWakeInformation ( WMI_DISABLE_COLLECTION � GEOCLASS_REGION 3 � W WinCapabilityPrivateNetworkClientServerSid " s TransactionOutcomeAborted � MutantBasicInformation � IrqPriorityLow H TypeC � FpFormatString � 7 SystemNumaProcessorMap $ � MaxSubsystemInformationType � PsProtectedSignerWinTcb � FileIdExtdDirectoryInfo 2 � � SystemCodeIntegrityCertificateInformation ( i JobObjectClearPeakJobMemoryUsed � PS_MITIGATION_OPTION_NX � ViewShare # � PerfInfoDebugEventReceived � TokenLogonSid ' � U WinCapabilityInternetClientSid * � � SystemSecureBootPolicyInformation � IoPriorityVeryLow BackTraceDatabaseCreate 7 F TransactionManagerOldestTransactionInformation $ FpCodeYn � ThreadAmILastThread y TableInsertAsRight � SidTypeAlias ' � EventProviderUseDescriptorType # � ThreadWorkloadClassDefault � MaxHardwareCounterType � DEPPolicyOptOut � OptionOkNoWait $ � SharedVirtualDisksSupported ! w PsAttributeGroupAffinity : � DISPLAYCONFIG_DEVICE_INFO_GET_ADVANCED_COLOR_INFO � FpFormatI16 �
_ARM_BARRIER_ISHST � COPYFILE2_PROGRESS_STOP } ; FileIdInformation ' � ManageHotPatchLoadPatchForUser z 0 GroupPark � PNP_VetoTypeUnknown � SecurityDelegation $ � COPYFILE2_PROGRESS_CONTINUE " � PoCsDeviceNotificationMbn e DPFLTR_KBDCLASS_ID � � MaxSystemInfoClass Y LogExceptionDispatch e ! DPFLTR_FASTFAT_ID G WnfDataScopeSystem . DISPLAYCONFIG_COLOR_ENCODING_YCBCR422 i _ARM_BANKED_LR_UND FirmwareTypeMax � IoSessionStateLoggedOn � TokenLinkedToken H TypeB ) G SharedVirtualDiskHandleStateNone V SysDbgBreakPoint � B WinLowLabelSid � FileFullDirectoryInfo e DPFLTR_SCSIPORT_ID V SysDbgReadControlSpace + � DirectoryNotifyExtendedInformation $ TransactionBasicInformation WdInfoResetTimer 7 LocationTypeFileSystem V SysDbgQueryVersion ' i ) JobObjectReserved19Information ( � FileStorageTierClassUnspecified 0 ? EventTraceHeapSummaryTracingInformation V SysDbgReadMsr C SYSTEM_HANDLE_EVENT � MarshalDirectionMarshal % } FileFullDirectoryInformation � MemoryFlushModifiedList KeyTrustInformation * � RtlResTypeDiskWriteConstraintTier . DEBUG_CONTROL_SPACE_PCR ) 2 ORIENTATION_PREFERENCE_LANDSCAPE BackTraceDatabaseDelete V SysDbgWriteIoSpace � , ReservedForDVRF44 3 � PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES � 7 ReservedForDVRF55 � WinCreatorOwnerSid � MaxProcessTlsOperation ! UmsThreadAffinity % ! SecureSettingValueTypeBinary � F ProcessInPrivate ) � � AccessReasonNotGrantedByCape e 8 DPFLTR_MCHGR_ID * � � COMIMAGE_FLAGS_32BITPREFERRED e Q DPFLTR_IHVSTREAMING_ID ) � Z SystemBootEnvironmentInformation 1 2 ORIENTATION_PREFERENCE_LANDSCAPE_FLIPPED �! STUB_UNMARSHAL # �! VmCfgCallTargetInformation , � ? SystemEmulationProcessorInformation FpCodeModf / � CrossProcOperationMemoryFreePostNotify �! PowerStateSleeping2 5 0 JOB_OBJECT_IO_RATE_CONTROL_STANDALONE_VOLUME � LockQueueUnusedSpare1 C SYSTEM_HANDLE_SEMAPHORE + � PsEnergyComponentTypeTrackingState $ � [ SystemHypervisorInformation # i
JobObjectJobSetInformation + � EtwCoverageSamplerBloomInformation � � SystemFlushInformation % � AlpcServerSessionInformation Q" FpRoundMinusInfinity * i ' JobObjectServerSiloUserSharedData / � � AccessReasonNotGrantedByParentCape # � ExceptionContinueExecution ' i ( JobObjectReserved18Information z" EtwProviderTraitTypeMax ! }" FEEDBACK_TOUCH_DOUBLETAP 2 � f ProcessDynamicEnforcedCetCompatibleRanges �" HiberFileBucket1GB � RpcFailedLbsMessages � PowerDeviceD2 % � ProcessForegroundInformation " �" WdActionQueryTimeoutValue � GEO_FRIENDLYNAME # � FeatureEnabledStateEnabled v LdrModulesCondensed i _ARM_BANKED_LR_MON & ? EventTraceSpinlockInformation � E WinSystemLabelSid ! � 2 ProcessWindowInformation � q WinAccountKeyAdminsSid e L DPFLTR_INFINIBAND_ID V " SysDbgClearUmBreakPid % � W SystemSpecialPoolInformation e o DPFLTR_WHEA_ID � 1 ProcessOwnerInformation � VrfHardwareRuleClass } $ FileTrackingInformation < FpCompareGreater 1 � � SystemCodeIntegrityPolicyFullInformation $ � WinBuiltinAdministratorsSid % n# DISPLAYCONFIG_SCALING_CUSTOM # q# ProcessInformationClassMax ( � SE_VALIDATE_MAPPING_HEADER_ONLY � PsProtectedSignerApp # �#
DeviceInstanceRemovalEvent ' � $ SystemContextSwitchInformation # � � � AccessReasonTrustLabel " � - ProcessAffinityUpdateMode � TraceVersionInfo + �# QUERY_FILE_LAYOUT_NUM_FILTER_TYPES �# PsMaxStdHandleStates ' �# SeImageSignaturePackageCatalog i _ARM_BANKED_LR_ABT ( � TraceSampledProfileIntervalInfo �# IMPORT_OBJECT_DATA ! ProcessDynamicCodePolicy e | DPFLTR_USBSTOR_ID i
_ARM_BANKED_SP_FIQ ( E FeatureConfigurationPriorityMax ! $ WorkerFactoryIdleTimeout $ ResponseOk $ DCDC_DISABLE_RELAYOUT � MAX_CLASS_NAME ) ,$ DISPLAYCONFIG_ROTATION_ROTATE180 � FileStorageInfo � Q ProcessWakeInformation ' � ` SystemPrefetchPatchInformation ! z AdministratorPowerPolicy ' |$ HighMemoryResourceNotification & �$ RtlRXactOperationSetAttribute C SYSTEM_HANDLE_PIPE �" WdActionStopTimer ) TransactionDTCPrivateInformation 1 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_MIRACAST Q WaitNotification # �$ InvalidAppContainerSidType � SmrGcActionPause ) � ^ ProcessSecurityDomainInformation �! PowerStateSleeping1 * } * FileIoStatusBlockRangeInformation �$ PsMaxWakeReasons % i JobObjectBasicUIRestrictions $ i JobObjectGroupInformationEx # � 1 ThreadPowerThrottlingState i _ARM_BANKED_R11_FIQ W% PdataRefToFullXdata � TracePmcEventListInfo % 7 EtwQueryPartitionInformation z
ProcessorStateHandler2 # � ThreadDescriptorTableEntry $ } 6 FileStandardLinkInformation + Y" � �HeapDetailedFailureInformation * (
MonitorRequestReasonSessionUnlock � RtlPathTypeRooted / s WOW64_FUNCTION_CPU_TURBO_THUNK_CONTROL � / ThreadAttachContainer ' i * JobObjectReserved20Information * SymbolicLinkAccessMask *& MaxKeySetInfoClass $ } ! FileReparsePointInformation ( 2 ORIENTATION_PREFERENCE_PORTRAIT ! �" HiberFileBucketUnlimited � $ ProcessCookie � 4 ReservedForDVRF52 EtwBufferStateMaximum FpCodeTan �& LdrpAnyDevice2bit ' i % JobObjectReserved15Information w PsAttributeJobList � SidTypeWellKnownGroup # V SysDbgEnableKernelDebugger $ � ProcessDefaultHardErrorMode ( � COMIMAGE_FLAGS_STRONGNAMESIGNED $ � TraceProviderBinaryTracking FpCodeCos Y LogExceptionHandler "
ProcessChildProcessPolicy �' FileIdType , �' LoadReasonStaticForwarderDependency V SysDbgSetSpecialCall � IMAGE_COR_MIH_METHODRVA * �' ActivationContextBasicInformation � PNP_VetoDevice V SysDbgQuerySpecialCalls - � CsvControlMarkHandleLocalVolumeMount �' PMETypeMax / O MemExtendedParameterUserPhysicalHandle . � ) SystemVerifierRemoveDriverInformation . � PS_MITIGATION_OPTION_ROP_CALLER_CHECK PoHot !# VMEConfiguration e DPFLTR_VIDEOPRT_ID e � DPFLTR_XSAVE_ID e N DPFLTR_IHVVIDEO_ID $( UserNotPresent � SidTypeInvalid (
WMI_CAPTURE_STATE ! } ( FileShortNameInformation 2 � PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS # � . SystemTimeSlipNotification / �# QUERY_FILE_LAYOUT_FILTER_TYPE_CLUSTERS � L ProcessEnergyValues � o SystemAitSamplingValue " � COPYFILE2_PROGRESS_CANCEL + ( MonitorRequestReasonScMonitorpower e DPFLTR_NTFS_ID + � D SystemSessionMappedViewInformation ! � X ProcessUptimeInformation � / ReservedForDVRF47 $ ! SecureSettingValueTypeUlong ) � ^ WinCapabilityRemovableStorageSid & ) PsProtectedTypeProtectedLight # �! VmOfferPriorityBelowNormal # � � AccessReasonAllowedAce e r DPFLTR_TPM_ID �! PowerStateShutdownOff BootEntropySourceRdrand ) TransactionEnlistmentInformation �! PowerStateSleeping3 V) IoSessionEventLogoff + Y) SystemMemoryPartitionCombineMemory � GEO_NATION # � PsProtectedSignerWinSystem ! � PsEnergyComponentTypeCpu " � ProcessSessionInformation ! FpCodeTanh & i , JobObjectContainerTelemetryId ! � - WinAccountControllersSid * FeatureVariantPayloadKindExternal z PowerActionNone C SYSTEM_HANDLE_PROCESS �) DeviceWakeSourceType ! � PsEnergyComponentTypeMax 9 � DISPLAYCONFIG_DEVICE_INFO_SET_TARGET_PERSISTENCE � FileCompressionInfo % ACTCTX_RUN_LEVEL_UNSPECIFIED � PNP_VetoOutstandingOpen ( : EtwNotificationTypeCredentialUI s WOW64_FUNCTION_MAXIMUM " w PsAttributeIdealProcessor w( MandatoryLevelCount , �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DVI ( � @ SystemExtendedHandleInformation �
FpFormatCompare ! 4 SystemPixelFormatUnknown - ( MonitorRequestReasonScreenOffRequest C SYSTEM_HANDLE_JOB % � ImageStrictHandleCheckPolicy SectionBasicInformation � PsCreateFailExeFormat - �' ActivationContextDetailedInformation W*
EtwWdiScenarioCode $ c* MaxServiceRegistryStateType ) 2' COPYFILE2_CALLBACK_CHUNK_STARTED e 4 DPFLTR_FUSION_ID 1 ( 0 MonitorRequestReasonDisplayRequiredUnDim � _ARM_BARRIER_OSHST # � R ProcessEnergyTrackingState � 1 ReservedForDVRF49 KeyFullInformation � JournalRenameKey � D ProcessSubsystemProcess 0 �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_ENABLE " �* PoSleepDisableReasonVideo e t DPFLTR_ENVIRON_ID } 4 FileUnusedInformation # w PsAttributeProtectionLevel }" FEEDBACK_PEN_DOUBLETAP � VrfVMSwitchingRuleClass & z [ QueryPotentialDripsConstraint % � MaximumFileInfoByHandleClass ' + CmResourceShareDriverExclusive �# DeviceInstallEvent + � ( SystemVerifierAddDriverInformation ! K AuditOpenObjectForDelete C SYSTEM_HANDLE_REG_KEY >+ ShutdownReboot � FileEndOfFileInfo [+ GetFileExInfoStandard & � + SystemLegacyDriverInformation " � w WinBuiltinDeviceOwnersSid 0 � CrossProcOperationMemoryAllocPostNotify z L LastResumePerformance 1 ? EventTraceProfileSourceRemoveInformation y TableEmptyTree e { DPFLTR_APPCOMPAT_ID / E
FeatureConfigurationPriorityUserPolicy ! w PsAttributeParentProcess � ThreadWow64Context � ! VrfWDFRuleClass �+ OS_DEPLOYMENT_STANDARD ( z TraceApplicationPowerMessageEnd / i ! JobObjectNotificationLimitInformation2 � C WinMediumLabelSid # $ WorkerFactoryThreadMinimum � FileStorageTierClassMax �# PsNeverDuplicate # � RtlPathTypeRootLocalDevice � RpcFailedLbsDecisions + } / FileProcessIdsUsingFileInformation � ProcessDebugFlags �+ IMO_UNAVAILABLE ! z PowerActionShutdownReset +% MemoryTypeLargePage " � MemoryCaptureAccessedBits # � ManageHotPatchQueryPatches z PowerActionHibernate �) EtwRtBufferLost � ( VrfAVXCorruption � FileRenameInfoEx 0 � PsEnergyComponentTypeCompositorResource l ObjectTypesInformation - � J SystemWow64SharedInformationObsolete " � 3 SystemVerifierInformation � IoPriorityHigh I, TokenElevationTypeFull " i JobObjectCompletionFilter � ProcessDeviceMap # � UmsInformationCommandQuery � IrqPriorityUndefined m, PlatformRoleMaximum + FileFsVolumeInformation � # ThreadSuspendCount 4 � # WinBuiltinPreWindows2000CompatibleAccessSid " } : FileVolumeNameInformation , �, CI_WINDOWS_LOCKDOWN_RESTRICTION_MAX � KHeteroCpuPolicyLarge R PnpQueryBusRelations �' MaximumFileIdType % � FileFullDirectoryRestartInfo + } ? FileIdExtdBothDirectoryInformation " � SystemNetRateControlQuota � ThreadTebInformation " �, ImagePolicyEntryTypeInt64 m, PlatformRoleWorkstation # �$ MonitorRequestTypeToggleOn L SmallBusinessRestricted H WnfInfoStateNameExist / �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SVIDEO � , TokenBnoIsolation + � f WinBuiltinRemoteManagementUsersSid EtwBufferStateCSwitch � SidTypeDeletedAccount � VrfEnhancedIORuleClass � SystemObjectInformation ) � N WinBuiltinCertSvcDComAccessGroup �# DeviceClassChangeEvent Y" HeapTaggingInformation � TraceLbrEventListInfo L Personal + �, POINTER_DEVICE_TYPE_INTEGRATED_PEN % � TP_CALLBACK_PRIORITY_INVALID J ProfileTime ! � MaxImageMitigationPolicy �& LdrpRemote A � PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY . � c ProcessFreeFiberShadowStackAllocation $ � PsCreateFailOnSectionCreate " }" FEEDBACK_PEN_PRESSANDHOLD 3 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDTVDONGLE � SystemNetRateControlSet �) EtwRtEventNoLoss % KeyVirtualizationInformation # �$ KeyValuePartialInformation / � PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR � A WinUntrustedLabelSid � s SystemErrorPortTimeouts � 2 ReservedForDVRF50 8 � PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE . � � SystemFeatureConfigurationInformation & � SharedVirtualDisksUnsupported � TokenIntegrityLevel 2 � � SystemSecureSpeculationControlInformation ( � $ WinBuiltinRemoteDesktopUsersSid �' ��LoadReasonUnknown � DEPPolicyOptIn * w PsAttributeMitigationAuditOptions e ? DPFLTR_PREFETCHER_ID � PNPISABus $( UserPresent V) IoSessionEventConnected " � V SystemRefTraceInformation + U, FileMetadataOptimizationInProgress � ThreadPowerThrottling 5 n# DISPLAYCONFIG_SCALING_ASPECTRATIOCENTEREDMAX ! {( RtlBsdItemBootCheckpoint EventSecuritySetDACL , � PlugPlayControlGetBlockedDriverList � SmrGcStateInactive w( MandatoryLevelUntrusted � " WinBuiltinReplicatorSid / ImagePolicyIdNone e � DPFLTR_CRASHDUMPXHCI_ID - ,$ ��DISPLAYCONFIG_ROTATION_FORCE_UINT32 e � DPFLTR_PSHED_ID � TokenAppContainerSid * ? EventTraceStackCachingInformation & v ProcessWorkingSetOperationMax 1 ? EventTraceLastBranchEventListInformation � IrqPolicyMachineDefault v AuditEventObjectAccess }"
FEEDBACK_TOUCH_RIGHTTAP ( h DISPLAYCONFIG_TOPOLOGY_INTERNAL e � DPFLTR_FILETRACE_ID # } FileMailslotSetInformation � / SystemSessionCreate ) �% CmExtendedParameterTrustClassKey $ �
SystemStackTraceInformation ! � ThreadEventPair_Reusable " I, TokenElevationTypeLimited �' SC_STATUS_PROCESS_INFO % � VrfSyncDelayFuzzingRuleClass 1 � � SystemFirmwareBootPerformanceInformation FpCodeFrexp ' @/ CI_WINDOWS_LOCKDOWN_MODE_TRIAL ? MaxEventTraceInfoClass $ �* COPYFILE2_PHASE_READ_SOURCE # � & WinAccountAdministratorSid ' z SystemMonitorHiberBootPowerOff � WinInteractiveSid # � i SystemProcessorBrandString & �/ IMPORT_OBJECT_NAME_UNDECORATE � LockQueueUnusedSpare0 EventSecuritySetSACL z - GetPowerRequestList e DPFLTR_NTOSPNP_ID 1 E FeatureConfigurationPriorityImageDefault ! � ! TokenUserClaimAttributes FpCodeAtan �/ DPI_AWARENESS_UNAWARE % � SystemPerformanceInformation !# CbusConfiguration " �- MemoryReserveIoCompletion $ WorkerFactoryTimeout � PowerDeviceD3 8 � PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32 e c DPFLTR_VDSUTIL_ID + 30 PerfInfoMMStatAggregatePageCombine � WinLocalSystemSid - � : SystemRecommendedSharedDataAlignment & � y SystemNodeDistanceInformation / ImagePolicyIdEtw * � ManageHotPatchQueryPatchesForUser $ �0 DynamicTickDisableReasonMax # i JobObjectFreezeInformation , n# ��DISPLAYCONFIG_SCALING_FORCE_UINT32 ' i . JobObjectReserved24Information ! � WinCreatorOwnerServerSid ( . MonitorRequestReasonDim ' $ WorkerFactoryThreadSoftMaximum �' LoadReasonAsDataLoad ) ? EventTraceTimeProfileInformation ! 1 PoDisabledStateSleeping2 ' LearningModeLogLevelSpecialApc ! �, ImagePolicyEntryTypeNone �# VetoEvent ! �, ImagePolicyEntryTypeBool � FpFormatU32 l ObjectBasicInformation � PMCCounter � ProcessBasicInformation �
VrfIRPTrackingRuleClass r SERVERSILO_TERMINATING " � COR_VTABLEGAP_NAME_LENGTH & � ComputerNamePhysicalDnsDomain !# MPIConfiguration $ � CsvControlGetCsvFsMdsPathV2 ( � ComputerNamePhysicalDnsHostname Y" HeapOptimizeResources 2 E FeatureConfigurationPriorityImageOverride $ � PlugPlayControlUnlockDevice e � DPFLTR_UDFS_ID 3 � IrqPolicyAllProcessorsInMachineWhenSteered 0 � � SystemEntropyInterruptTimingInformation e R DPFLTR_IHVBUS_ID � SmrGcActionStart ) � � AccessReasonAllowedParentAce � ProcessQuotaLimits � SidTypeUnknown 2 PerfInfoMemUsageMax � VrfDMARuleClass z ProcessorPowerPolicyAc , � SE_WS_APPX_SIGNATURE_ORIGIN_WINDOWS � . WinAccountCertAdminsSid ( �* DISPLAYCONFIG_PIXELFORMAT_32BPP ( �* DISPLAYCONFIG_PIXELFORMAT_24BPP # E2 FindStreamInfoMaxInfoLevel � SystemObsolete0 � ThreadCSwitchPmu ' � ( ProcessInstrumentationCallback � ThreadCSwitchMon ( � SystemTimeAdjustmentInformation % Width8Bits � MemoryEmptyWorkingSets � WinBuiltinUsersSid e m DPFLTR_IOSTRESS_ID w PsAttributeClientId ) � ; WinBuiltinAuthorizationAccessSid # � G SystemWatchdogTimerHandler � VrfAutoFailRuleClass ' � VrfAllocationFailuresRuleClass DynamicTickVetoNone �$ RtlDiskSpeedPolicyFast ) 2' COPYFILE2_CALLBACK_POLL_CONTINUE q# ProcessReservedValue1 i
_ARM_BANKED_R10_FIQ ) � COMIMAGE_FLAGS_NATIVE_ENTRYPOINT �3 PROTOCOL_LOADED ) ? EventTraceSoftRestartInformation ! ProcessFontDisablePolicy ' � FileIdBothDirectoryRestartInfo ! UmsThreadPriority V SysDbgSetAutoKdEnable $ � � SystemControlFlowTransition ! �' USER_MARSHAL_CB_MARSHALL $ *& KeySetHandleTagsInformation $ l ObjectHandleFlagInformation � MicroChannel & ! SecureSettingValueTypeBoolean ! � ExceptionNestedException . �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_D_JPN � ThreadTimes e ' DPFLTR_SERIAL_ID � PsCreateSuccess ( � > SystemEmulationBasicInformation } FileBasicInformation e ] DPFLTR_VERIFIER_ID � = ReservedForDVRF61 � PCIBus * �+ SystemProcessClassificationSystem $ ResponseRetry � PowerSystemSleeping3 ! � ProcessDebugObjectHandle e n DPFLTR_HEAP_ID + �0 DynamicTickDisableReasonEmOverride ) DISPLAYCONFIG_COLOR_ENCODING_RGB ( � PlugPlayControlInitializeDevice ! H TP_LOG_LEVEL_TRACE_LEAVE � _ARM_BARRIER_OSH 7 LocationTypeRegistry $ + CmResourceShareUndetermined $ ResponseCancel ( Y) SystemMemoryPartitionMoveMemory DynamicTickVetoProcBusy e f DPFLTR_MM_ID 0 K AuditOpenObjectForDeleteWithTransaction ' � � 0 AccessReasonIntegrityLevel � PowerSystemWorking # � SystemTimeOfDayInformation
� CBus # � - ThreadSubsystemInformation J ProfileIcacheMisses m, PlatformRoleMobile ( ProcessPayloadRestrictionPolicy ' ProcessStrictHandleCheckPolicy 4 i JobObjectAssociateCompletionPortInformation $ � PerfInfoDebugEventContinued e _ DPFLTR_VDSBAS_ID $ �* PoSleepDisableReasonVhdBoot �' USER_MARSHAL_CB_FREE � TokenHasRestrictions - �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HDMI % ^5
MemoryBasicInformationCapped z P PlatformIdleStates � : ReservedForDVRF58 �
TokenStatistics /
ImagePolicyIdCapability �+ IMO_INJECTED % N+ RtlFeatureConfigurationCount e DPFLTR_LSERMOUS_ID ( WMI_ENABLE_COLLECTION � ` ProcessEnableLogging 3 3 DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED � ThreadDynamicCodePolicy 2 � CrossProcOperationMemoryProtectPostNotify �5 DriverType $ �$ PsWakeReasonInstrumentation & � 0 WinAccountEnterpriseAdminsSid � GEOCLASS_ALL �
MPIBus ! R PnpQueryRemovalRelations - ( VRF_TRIAGE_CONTEXT_FLIGHT_MONITORING / ImagePolicyIdCrashDump 16 SevereError z I ScreenOff & W StorageReserveIdUpdateScratch . ? EventTraceProfileSourceAddInformation ! � IoSessionStateTerminated } FileNamesInformation " � SystemPageFileInformation < FpCompareEqual � ProcessBasePriority � PNP_VetoPendingClose � PsCreateFailExeName e � DPFLTR_POWER_ID e , DPFLTR_DCOMSS_ID + � # TokenRestrictedUserClaimAttributes � ImageHeapPolicy & ( MonitorRequestReasonResumePdc e $ DPFLTR_NETAPI_ID * � MemoryCaptureAndResetAccessedBits & � : WinBuiltinPerfLoggingUsersSid z B PlatformInformation $ � P SystemMemoryListInformation # : EtwNotificationTypeSession �6 PT_TOUCH � ProcessHandleCount . ? EventTraceObjectTypeFilterInformation � TurboChannel ) ( / MonitorRequestReasonBuiltinPanel $ MemoryNotResident �6 _ARM_ROR O ���RelationAll � IMAGE_COR_MIH_EHRVA �" WdActionQueryState ' i JobObjectReserved12Information � ? ReservedForDVRF63 # } " FileNetworkOpenInformation / ( MonitorRequestReasonSystemStateEntered 0 , EtwSessionNotificationSessionTerminated ! � COPYFILE2_PROGRESS_PAUSE ) L WorkerFactoryCallbackLongRunning � SidTypeUser ) Y) SystemMemoryPartitionInformation " I, TokenElevationTypeDefault 4 SystemPixelFormatR8G8B8 7 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_WIRED � GEO_ISO_UN_NUMBER ( � N SystemVerifierTriageInformation � MaxTraceSetInfoClass ' b7 MemSectionExtendedParameterMax i _ARM_BANKED_SP_ABT � NtProductLanManNt ) m ProcThreadAttributeParentProcess {( RtlBsdItemAabTimeout ! � * ProcessWorkingSetWatchEx ( n# � DISPLAYCONFIG_SCALING_PREFERRED z SystemExecutionState � FileStandardInfo G! ProcessActivityTypeMax � FileIdInfo e DPFLTR_MOUCLASS_ID e DPFLTR_CLASSPNP_ID � ProcessImageFileName e 3 DPFLTR_SXS_ID � @ VrfRuleClassSizeMax � = WinBuiltinDCOMUsersSid , FilterBootOptionOperationSetElement � ) TokenProcessTrustLevel $ � WinBuiltinPrintOperatorsSid $ ResponseReturnToCaller ! r SERVERSILO_SHUTTING_DOWN [ IMDT_TOUCH " $ WorkerFactoryBindingCount # � - SystemLookasideInformation �+ OS_DEPLOYMENT_COMPACT ' �$ KeyValueFullInformationAlign64 ' � t SystemLowPriorityIoInformation e z DPFLTR_LUAFV_ID �# CustomDeviceEvent 0 m ProcThreadAttributeSecurityCapabilities e � DPFLTR_SSPICLI_ID i _ARM_BANKED_R14_SVC # �, ImagePolicyEntryTypeUInt16 ' ProcessSystemCallDisablePolicy " � AlpcWaitForPortReferences � GEO_RFC1766 � IoPriorityHintNormal 0 � � SystemEnergyEstimationConfigInformation " � � ` AccessReasonEmptyDacl 7 XLAT_CLIENT / DISPLAYCONFIG_COLOR_ENCODING_INTENSITY - � ResourceManagerCompletionInformation & w& POINTER_CHANGE_FIRSTBUTTON_UP �# InvalidIDEvent ( i ) JobObjectServerSiloRunningState ) w& POINTER_CHANGE_SECONDBUTTON_DOWN + �
PsEnergyComponentTypeKeyboardInput " � 6 ProcessHandleCheckingMode ) ? EventTracePerformanceInformation e D DPFLTR_DMCONFIG_ID - � SE_WS_APPX_SIGNATURE_ORIGIN_APPSTORE i JobObjectSharedCommit � WinSelfSid � ManageHotPatchLoadPatch 2 � FeatureConfigurationOperationFeatureState A" SystemCrashDumpDisable $
ResponseContinue y9 KTMOBJECT_TRANSACTION e d DPFLTR_DFRGIFC_ID * � EtwCoverageSamplerPerfInformation ! � COPYFILE2_PROGRESS_QUIET . � � SystemSecureBootPolicyFullInformation i _ARM_BANKED_LR_SVC V SysDbgReadVirtual �9 DDC_DISABLE_RESIZE
ProcessImageLoadPolicy ; �
DISPLAYCONFIG_DEVICE_INFO_SET_ADVANCED_COLOR_STATE & i JobObjectReserved3Information � RPCHTTP_RS_INTERFACE e � DPFLTR_SE_ID e B DPFLTR_PCI_ID J
ProfileFpInstructions 9 ? EventTraceProcessorTraceConfigurationInformation W* EtwStartLoggerCode Y LogExceptionEmpty ' �* COPYFILE2_PHASE_NAMEGRAFT_COPY ) � � AccessReasonMissingPrivilege $ DCDC_DEFAULT ! z W PowerInformationInternal , �0 DynamicTickDisableReasonNoHwSupport " >+ ShutdownRebootForRecovery FpCodeConvert 4 : MemoryExhaustionTypeFailFastOnCommitFailure + , EtwSessionNotificationLogfileError & i ( JobObjectServerSiloInitialize �$ TokenPrimary % � $ ThreadHeterogeneousCpuPolicy 6 �$ ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_FORCE_UINT32 � ! ThreadIdealProcessorEx �
RpcAttemptedLbsMessages < � AlpcAdjustCompletionListConcurrencyCountInformation � ProcessTlsReplaceIndex / �$ ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_OTHER ( ^5 MemoryMappedFilenameInformation ( � TraceSystemTraceEnableFlagsInfo & } 0 FileNormalizedNameInformation * � � SystemHypervisorDetailInformation z 2 WakeTimerList ! � U ProcessTelemetryCoverage * �+ SystemProcessClassificationNormal � ProcessWow64Information �3 PROTOCOL_NOT_LOADED $ � � SystemSecureBootInformation � OptionCancelTryContinue 8 m ProcThreadAttributeAllApplicationPackagesPolicy ; �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MAXVERSIONTESTED e h DPFLTR_WOW64_ID L WHServer " EtwBufferStatePlaceholder � GEO_LATITUDE * �$ KeyValuePartialInformationAlign64 ' � VrfDeadlockPreventionRuleClass � PsProtectedSignerMax . �: RtlMitigationOptionStateNotConfigured % EtwBufferStateGeneralLogging 6 � DISPLAYCONFIG_DEVICE_INFO_GET_SDR_WHITE_LEVEL � ; ReservedForDVRF59 2' COPYFILE2_CALLBACK_NONE � _ARM_BARRIER_ST ( � � SystemDmaGuardPolicyInformation ) �* DISPLAYCONFIG_PIXELFORMAT_NONGDI % MaximumDmaWidth " � � SystemBootLogoInformation ! z SystemPowerPolicyCurrent � ThreadPagePriority [ IMDT_MOUSE � 4 ProcessMitigationPolicy z ProcessorStateHandler ' � VrfBelow4GBAllocationRuleClass ( � � AccessReasonDeniedParentAce " �, ImagePolicyEntryTypeInt16 � JournalBeginTransaction & / SystemFirmwareTable_Enumerate e v DPFLTR_WDT_ID � * ReservedForDVRF42 # i JobObjectCompletionCounter v LdrModulesSnapped X; SeLearningModeMax ]; PowerUserNotPresent . i JobObjectNotificationLimitInformation # � RpcBackEndConnectionFailed " �
SystemCallTimeInformation L SmallBusiness # � IoSessionStateDisconnected / ImagePolicyIdScenarioId * ( MonitorRequestReasonNearProximity 0 �7 SystemActivityModerationAppTypePackaged � DEPPolicyAlwaysOff v LdrModulesSnapping 2 � < WinBuiltinTerminalServerLicenseServersSid � MaximumInterfaceType % � PsProtectedSignerAntimalware C � SYSTEM_HANDLE_INVALID # � PlugPlayControlResetDevice / �7 SystemActivityModerationAppTypeClassic * � TracePeriodicCaptureStateListInfo + �+ SystemProcessClassificationMaximum " � + WinAccountDomainGuestsSid - �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HD15 5 �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION e Y DPFLTR_STORPORT_ID � ManageHotPatchMax ! � & VrfInfoDisclosureIRPRule e * DPFLTR_RPCPROXY_ID 5 �$
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EMBEDDED % �- PoHiberForceDisableReasonMax � TraceGroupQueryList ( WMI_SET_SINGLE_ITEM < MaxJournalInformation >+ ShutdownPowerOff 1 ^ EDIT_CONTROL_FEATURE_PASTE_NOTIFICATIONS z PowerActionReserved # i % JobObjectSiloRootDirectory J ProfileDcacheAccesses ' i ' JobObjectReserved17Information � KHeteroCpuPolicyDefault �! VmOfferPriorityVeryLow 30 PerfInfoMMStatNotUsed ) � C ProcessAllowedCpuSetsInformation � PowerDeviceUnspecified � LockQueueMaximumLock � PowerDeviceD0 � FpFormatU64 " } FilePipeRemoteInformation ' �* DISPLAYCONFIG_PIXELFORMAT_8BPP - CacheUnified �! PowerStateShutdownReset . �* PoSleepDisableReasonPortableWorkspace � LockQueueVacbLock z F SetShutdownSelectedTime + � � SystemProcessorIdleMaskInformation � ThreadHideFromDebugger " W% PdataPackedUnwindFragment � ImageChildProcessPolicy ( � # SystemKernelDebuggerInformation WdInfoState w PsAttributeToken 5 b7 MemSectionExtendedParameterUserPhysicalFlags & �$ PsWakeReasonActivityReference � ToleranceIntervalLong % � l WinCapabilityAppointmentsSid � ThreadGroupInformation & � RtlPhysicalMemoryPolicyNormal } FileStreamInformation z V BatteryDeviceState C SYSTEM_HANDLE_TOKEN - � 0 ThreadManageWritesToExecutableMemory �# IMPORT_OBJECT_CODE ! H TP_LOG_LEVEL_TRACE_ENTER 1 G SharedVirtualDiskHandleStateHandleShared � ProcessTlsReplaceVector ]; PowerUserInvalid J ProfileTotalCycles ( ( MonitorRequestReasonSleepButton v LdrModulesPlaceHolder J Profile3Issue e � DPFLTR_ENDOFTABLE_ID z R PlatformIdleVeto $ � FileStorageTierMediaTypeScm e q DPFLTR_MMCSS_ID " � < SystemNumaAvailableMemory ! z Z PhysicalPowerButtonPress e K DPFLTR_SR_ID 1 � _ ProcessCombineSecurityDomainsInformation % e � DPFLTR_STORAGECLASSMEMORY_ID 8 � PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS * � � COMIMAGE_FLAGS_TRACKDEBUGDATA 6 ( + MonitorRequestReasonPdcSignalHolographicShell �# SeImageSignatureNone ! UmsThreadUserContext � TokenIsAppContainer $ ^5 MemoryWorkingSetInformation $ �# SeImageSignatureCatalogHint & ( MonitorRequestReasonUserInput r SERVERSILO_STARTED + i JobObjectCpuRateControlInformation & ^5 MemoryWorkingSetExInformation �7 PdataCrUnchained � MemoryPurgeStandbyList O RelationNumaNode 1 i JobObjectBasicAndIoAccountingInformation e u DPFLTR_EMS_ID + ?
EventTracePoolTagFilterInformation % 1 PoDisabledStateSleeping0Idle � ThreadPriority ! : EtwNotificationTypeAudio i * JobObjectIoAttribution & � EnlistmentRecoveryInformation l MaxObjectInfoClass ! � CsvControlDisableCaching z J CsDeviceNotification 1 � � SystemCodeIntegrityUnlockModeInformation � _ARM_BARRIER_SY w PsAttributeUmsThread # � � SystemPoolLimitInformation ' i JobObjectReserved11Information 1 � � AccessReasonNotGrantedToAppContainer � PCMCIABus ! � * WinAccountDomainUsersSid FpCodeDivide ( � ThreadQuerySetWin32StartAddress . �' ActivationContextManifestResourceName " } FileAllocationInformation ( � ThreadEnableAlignmentFaultFixup � ProcessWx86Information � WinNetworkServiceSid ) � b SystemSystemPartitionInformation 9 ( 1 MonitorRequestReasonBatteryCountChangeSuppressed ' N+ RtlFeatureConfigurationRuntime ' @ RTL_RESOURCE_POLICY_FLAGS_NONE ' w& POINTER_CHANGE_FOURTHBUTTON_UP FirmwareTypeUefi " BootEntropySourceAcpiOem0 � DEPPolicyAlwaysOn C SYSTEM_HANDLE_MAX ( U, FileMetadataOptimizationPending L EmbeddedRestricted % !# ��ConfigurationSpaceUndefined z PowerActionShutdown & �# SeImageSignatureCatalogCached ( : EtwNotificationTypeLegacyEnable K* NormalizationC ! �5 Win32ServiceShareProcess FpCodeFabs z D MonitorInvocation
FpCodeAcos % � RpcBackEndConnectionAttempts $ z ProcessorPowerPolicyCurrent & i JobObjectReserved4Information � LockQueueUnusedSpare2 ) � ImageExtensionPointDisablePolicy ! �$ KeyValueBasicInformation ) � , SystemCurrentTimeZoneInformation L EmbeddedNT �* SynchronizationEvent & �? ��DPI_HOSTING_BEHAVIOR_INVALID � ImageDynamicCodePolicy + � j WinLocalAccountAndAdministratorSid :- FindExInfoStandard 3 � DISPLAYCONFIG_DEVICE_INFO_GET_ADAPTER_NAME i _ARM_BANKED_R14_FIQ � PerfInfoMemResetMax ' �6 FixedWakeSourceDozeToHibernate z ? SessionPowerCleanup : LT_LOWEST_LATENCY � OptionShutdownSystem $ i JobObjectBasicProcessIdList i > _ARM_BANKED_SPSR_HYP " � IoSessionStateInitialized � KHeteroCpuPolicyMax i _ARM_BANKED_R10_USR } FilePipeInformation e + DPFLTR_AUTOCHK_ID e DPFLTR_MOUHID_ID % � IrqPolicySpecifiedProcessors e DPFLTR_SMSS_ID 1 � � SystemDifApplyPluginVerificationOnDriver ) i JobObjectEndOfJobTimeInformation % ( MonitorRequestReasonFullWake J Profile4Issue � * TokenPrivateNameSpace � RPCHTTP_RS_ACCESS_1 , �? DISPLAYCONFIG_MODE_INFO_TYPE_TARGET # FpCodeY1 ! � 8 ProcessRevokeFileHandles % � ProcessLUIDDeviceMapsEnabled ! �$
RtlDiskSpeedPolicyNormal ]; PowerUserMaximum - ? EventTraceCoverageSamplerInformation O@ KernelRequester
PoDc z SystemPowerPolicyDc / ImagePolicyIdMaximum + � e SystemNumaProximityNodeInformation {( RtlBsdItemBootGood ( DisableLoad ! w
PsAttributeStdHandleInfo o@ AR_NOSENSOR & � PoCsDeviceNotificationMaximum � MaxEventInfo 4 � PS_MITIGATION_OPTION_CET_USER_SHADOW_STACKS K AuditObjectReference H TypeF {(
RtlBsdItemErrorInfo ! � m WinCapabilityContactsSid WdInfoTriggerReset ( @/ CI_WINDOWS_LOCKDOWN_MODE_LOCKED � AlpcBasicInformation # � TraceProfileSourceListInfo ProcessDEPPolicy J ProfileIcacheIssues 1 ( , MonitorRequestReasonPdcSignalFingerprint �
FileRemoteProtocolInfo 9 � PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY " �, POINTER_DEVICE_TYPE_TOUCH + ( ! MonitorRequestReasonUserInputTouch 0 ( 2 MonitorRequestReasonResumeModernStandby 5 �
CsvControlEnableUSNRangeModificationTracking � _ARM_BARRIER_NSH � LockQueueBcbLock � WinRestrictedCodeSid % � @ WinBuiltinCryptoOperatorsSid : PerfCSwapIdle ) ,$ DISPLAYCONFIG_ROTATION_ROTATE270 $ � CsvControlStartRedirectFile ! �$ KeyValueLayerInformation 3 � ^ SystemImageFileExecutionOptionsInformation 4 ( MonitorRequestReasonSetThreadExecutionState z 4 ProcessorIdleStatesHv � , WinAccountComputersSid $ � KHeteroCpuPolicyBiasedSmall � ) VrfAccessModeMismatch � ImageDepPolicy $ 2 PerfInfoMemUsagePfnMetadata �6 PT_POINTER ! UmsThreadIsTerminated 0 s WOW64_FUNCTION_CPU_CFG_DISPATCH_CONTROL ( AutoLoad � TokenAppContainerNumber q# ProcessLeapSecondInfo ) E FeatureConfigurationPriorityTest ) � ProcessEnableAlignmentFaultFixup {( RtlBsdItemMax + O MemExtendedParameterAttributeFlags ( �- PoHiberForceDisableReasonPolicy � . ReservedForDVRF46
PoAc J
ProfileCacheMisses " � MarshalDirectionUnmarshal Q" FpRoundChopped e DPFLTR_CDROM_ID *& KeySetDebugInformation " � ) WinAccountDomainAdminsSid � GEO_LONGITUDE / b7 MemSectionExtendedParameterInvalidType � ExceptionCollidedUnwind � TraceInfoReserved15 � # VrfXDVPlatformMode % z ` PowerInformationLevelMaximum � WinTerminalServerSid � MaxPlugPlayControl }" FEEDBACK_PEN_TAP �6 PT_PEN . �; PerfInfoDomainChangeEventEnterSyscall . � PlugPlayControlDeviceClassAssociation / } 8 FileRenameInformationBypassAccessCheck , � & SystemExtendServiceTableInformation & � ~ SystemBootGraphicsInformation J ProfileAlignmentFixup ) AtomTableInformation & � @ ProcessTelemetryIdInformation �
InternalPowerBus w PsAttributeTebAddress �" WdActionSleep � FileRenameInfo e DPFLTR_CRASHDUMP_ID !# PCMCIAConfiguration > MemoryLocationResident $ � KHeteroCpuPolicyBiasedLarge 2 � � SystemFeatureUsageSubscriptionInformation & ^5 MemoryEnclaveImageInformation �" WdActionResetTimer v LdrModulesMapped � SystemLocksInformation � SecurityImpersonation ,2 ShrinkPrepare . � T SystemVerifierCancellationInformation e DPFLTR_KBDHID_ID �# DeviceArrivalEvent $ � 8 SystemPrefetcherInformation / � d SystemProcessorPerformanceDistribution � PowerDeviceD1 z PowerActionShutdownOff & �' LoadReasonDelayloadDependency !# PCIConfiguration J Profile2Issue e G DPFLTR_VSS_ID " � _ SystemCoverageInformation z ^ UpdateBlackBoxRecorder 1 �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_DISABLE H TP_LOG_LEVEL_ERROR - �, CI_WINDOWS_LOCKDOWN_RESTRICTION_NONE e DPFLTR_DMSYNTH_ID �) TimerWakeSourceType � PowerSystemShutdown L
Blade e DPFLTR_SERMOUSE_ID ) C SYSTEM_HANDLE_COMPOSITION_OBJECT � VrfIORuleClass * � R WinThisOrganizationCertificateSid e " DPFLTR_SAMSS_ID % WidthNoWrap ! � TP_CALLBACK_PRIORITY_LOW � MAX_PACKAGE_NAME # � PsEnergyComponentTypeInput ! � , ThreadWorkOnBehalfTicket , � EtwCoverageSamplerStatusInformation 6 3 ��DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 l ObjectNameInformation ! �% CmExtendedParameterEvent 1 TransactionSuperiorEnlistmentInformation �3 PROTOCOL_ADDRESS_CHANGE ( SystemLoad 3 ( # MonitorRequestReasonUserInputAccelerometer & �$ RtlDiskSpacePolicyBelowNormal � SystemDeviceInformation � NtProductServer � PNP_VetoWindowsService m, PlatformRoleDesktop $ �! PowerStateSleeping4Firmware �. WnfWellKnownStateName < � DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_PREFERRED_MODE m, PlatformRoleSlate � 6 ReservedForDVRF54 �$ GenericLessThan e y DPFLTR_NVCTRACE_ID �! TransactionStateIndoubt " � � SystemKernelDebuggerFlags }
FileRenameInformation r SERVERSILO_INITING W StorageReserveIdSoft " � VrfDriverLoggingRuleClass � ' WinAccountGuestSid ! $ MemoryContiguityStateMax ) � r WinAccountEnterpriseKeyAdminsSid v LdrModulesReadyToInit # DynamicTickVetoNoDeepSleep # y9 KTMOBJECT_RESOURCE_MANAGER � RpcOutgoingBandwidth e C DPFLTR_DMIO_ID + �= POINTER_DEVICE_CURSOR_TYPE_UNKNOWN ( m ProcThreadAttributeWin32kFilter ) <C MaxSystemActivityModerationState & � + ThreadExplicitCaseSensitivity i _ARM_BANKED_R13_HYP * m ProcThreadAttributeIdealProcessor ! w PsAttributeSecureProcess FpCodeCompare � TokenOrigin � COR_VERSION_MINOR EtwBufferStateFree $ WorkerFactoryPaused ( MonitorRequestReasonPnP + � IoSessionStateDisconnectedLoggedOn SmrGcMethodRotation $ � RtlSparseBitmapOperationSet 6 � � SystemPortableWorkspaceEfiLauncherInformation $ � & TokenRestrictedDeviceGroups , {( RtlBsdItemFeatureConfigurationState � VrfSecurityRuleClass ( i JobObjectMemoryUsageInformation �C PortDumpInformation A3 FindExSearchMaxSearchOp SmrGcMethodCompaction ! e F DPFLTR_WSOCKTRANSPORT_ID ! EtwBufferStateCompressed ) m ProcThreadAttributePreferredNode / ImagePolicyIdParentSd POINTER_FEEDBACK_NONE V SysDbgGetKdBlockEnable �7 PdataCrChainedWithPac L DataCenter 1D PROXY_UNMARSHAL *& KeySetLayerInformation e P DPFLTR_IHVNETWORK_ID . DISPLAYCONFIG_COLOR_ENCODING_YCBCR420 5 � CrossProcOperationInstructionCacheFlushHeavy e � DPFLTR_FLTREGRESS_ID # � DirectoryNotifyInformation ! � RpcAttemptedLbsDecisions : PerfCSwapIdleShort } D FileStatInformation M NotificationTimer �8 _ARM_CPS_CHANGE_MODE � \ ProcessSequenceNumber e DPFLTR_SETUP_ID % z PowerInformationLevelUnused0 {( RtlBsdItemVersionNumber � SystemHandleInformation � RpcLastCounter �6 _ARM_ASR # � EnlistmentBasicInformation + � � SystemFirmwarePartitionInformation �5 RecognizerType ( � j SystemVirtualAddressInformation * � d WinAccountCloneableControllersSid & � TracePeriodicCaptureStateInfo � VrfSpecialPoolRuleClass �# PsRequestDuplicate ( � PlugPlayControlDeregisterDevice � PNP_VetoWindowsApp ( � 5 SystemSessionProcessInformation �# IMPORT_OBJECT_CONST � FpFormatFp80 9 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_VIRTUAL ' } ' FileValidDataLengthInformation 0 � S SystemProcessorIdleCycleTimeInformation � RtlResTypeDiskSpeedTier z SystemBatteryState $ + FileFsFullSizeInformationEx " �D AlpcMessageSidInformation � CsvControlQueryMdsPath # � Y SystemErrorPortInformation Y" HeapExtendedInformation �$ GenericEqual % } @ FileDispositionInformationEx �& LdrpNoDevice $ � M ProcessPowerThrottlingState 6 � K SystemRegisterFirmwareTableInformationHandler � / ProcessGroupInformation " � ThreadAbsoluteCpuPriority $ � SystemFullMemoryInformation K AuditAccessCheck K* NormalizationD ( �/ DPI_AWARENESS_PER_MONITOR_AWARE } FileObjectIdInformation , �0 DynamicTickDisableReasonBcdOverride ! �" WdActionSetTriggerAction 3 �? ��DISPLAYCONFIG_MODE_INFO_TYPE_FORCE_UINT32 z SystemPowerPolicyAc � ProcessIoCounters O RelationCache � VrfStateSepRuleClass * � PS_MITIGATION_OPTION_FONT_DISABLE . � S ProcessManageWritesToExecutableMemory " # CsvFsDiskConnectivityNone + �# QUERY_FILE_LAYOUT_FILTER_TYPE_NONE FpCodeFmod i 2 _ARM_BANKED_SPSR_SVC 5 ? EventTraceProcessorTraceEventListInformation ) ( VRF_TRIAGE_CONTEXT_CERTIFICATION � TraceGuidQueryProcess ! �# SeImageSignatureEmbedded ( w& POINTER_CHANGE_FIFTHBUTTON_DOWN 1 � PlugPlayControlGetDeviceInterfaceEnabled i VERIFIER_MODE_TRIAGE 0 � AlpcUnregisterCompletionListInformation > MemoryLocationInvalid & } + FileIoPriorityHintInformation 0 � � SystemWorkloadAllowedCpuSetsInformation $ �E PowerRequestDisplayRequired ( w& POINTER_CHANGE_THIRDBUTTON_DOWN & / ImagePolicyIdCrashDumpKeyGuid & $
WorkerFactoryStackInformation o@ AR_REMOTESESSION # �? DPI_HOSTING_BEHAVIOR_MIXED ) � SystemUnloadGdiDriverInformation . DISPLAYCONFIG_COLOR_ENCODING_YCBCR444 ( DemandLoad % } FileBothDirectoryInformation " POINTER_FEEDBACK_INDIRECT 9 �# QUERY_FILE_LAYOUT_FILTER_TYPE_STORAGE_RESERVE_ID ' � L SystemFirmwareTableInformation e E DPFLTR_DMADMIN_ID * 2' COPYFILE2_CALLBACK_CHUNK_FINISHED EtwBufferStateFlush & � 2 WinAccountRasAndIasServersSid � TokenDefaultDacl � FileIoPriorityHintInfo & } 7 FileRemoteProtocolInformation / � o WinBuiltinDefaultSystemManagedGroupSid A3 FindExSearchNameMatch 0 � � SystemProcessorPerformanceInformationEx + 30 PerfInfoMMStatIterationPageCombine * i JobObjectIoRateControlInformation i VERIFIER_MODE_UNUSED q# ProcessInPrivateInfo � < ReservedForDVRF60 W* EtwUpdateLoggerCode & �' MaxActivationContextInfoClass ( � FileStorageTierClassPerformance � ? WinIUserSid z PowerActionDisplayOff / � SharedVirtualDiskCDPSnapshotsSupported % � ; ProcessCheckStackExtentsMode - ? EventTraceSessionSecurityInformation �D TP_DEBUG_CLASS_POOL �$ TokenImpersonation �' ExtendedFileIdType + FileFsDeviceInformation . � � SystemSecureDumpEncryptionInformation � FileAttributeTagInfo $ � � SystemPageFileInformationEx z Q ProcessorIdleVeto � ( TokenIsRestricted � RpcCurrentUniqueUser � KCONTINUE_LONGJUMP J ProfilePipelineDry # : EtwNotificationTypeNoReply WdInfoStartTimer � > ProcessMemoryExhaustion " � COMIMAGE_FLAGS_IL_LIBRARY w( MandatoryLevelMedium K AuditHandleCreation / FilterBootOptionOperationDeleteElement " i JobObjectGroupInformation ' � � SystemMemoryChannelInformation w PsAttributeErrorMode / � SE_VALIDATE_MAPPING_ENTIRE_IMAGE_CLEAN � ComputerNameNetBIOS KeyLayerInformation . � � SystemEnclaveLaunchControlInformation FpCodeAsin � TokenElevationType 0 O MemExtendedParameterAddressRequirements ' � % SystemRegistryQuotaInformation i _ARM_BANKED_R14_IRQ 7 XLAT_SERVER � Internal " � ManageHotPatchUnloadPatch i _ARM_BANKED_R9_USR {( RtlBsdSleepInProgress & ProcessControlFlowGuardPolicy , � PlugPlayControlQueryDeviceRelations o@ AR_DISABLED � FpFormatU16 � LockQueueUnusedSpare3 � 6 WinThisOrganizationSid % w PsAttributeMitigationOptions � WinNullSid % �F IoCompletionBasicInformation & � � SystemBootMetadataInformation , � _ WinBuiltinRDSRemoteAccessServersSid � 0 ReservedForDVRF48 # � n SystemRegistryAppendString � GEO_ISO3 M ToleranceHigh � ProcessDebugPort \ UmsSchedulerThreadYield , G 2 RtlDiskWriteConstraintPolicyLimited ! � p SystemVhdBootInformation C
SYSTEM_HANDLE_SOCKET $ +@ EtwCompressionModeNoDisable �
ImageSehopPolicy �$ NotAppContainerSidType 0G HAL_MCA_RECORD !# NuBusConfiguration & w&
POINTER_CHANGE_FIFTHBUTTON_UP : � PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES [ IMDT_TOUCHPAD ) �, POINTER_DEVICE_TYPE_EXTERNAL_PEN ! V SysDbgGetPrintBufferSize # �: RtlMitigationOptionStateOn - ( MonitorRequestReasonAcDcDisplayBurst + F TransactionManagerBasicInformation ) ( $ MonitorRequestReasonUserInputHid / ?
EventTraceProfileSourceListInformation ( �G ServiceDirectoryPersistentState } FileEaInformation [ IMDT_KEYBOARD e s DPFLTR_THREADORDER_ID z " ProcessorCap " ^5 MemoryRegionInformationEx G WnfDataScopeProcess $ ResponseAbort FpCodeSinh & �
VrfMDLInvariantStackRuleClass & i JobObjectReserved8Information � KHeteroCpuPolicySmall z < IdleResiliency � FileDispositionInfo � ThreadCounterProfiling v ��LdrModulesMerged ) � [ WinCapabilityDocumentsLibrarySid " � q SystemCpuQuotaInformation FpCodePow z Y SystemHiberFileType V) IoSessionEventCreated - �; PerfInfoDomainChangeEventUserRestore ' z _ SessionAllowExternalDmaDevices K* NormalizationKD WdInfoNop $ + FileFsDriverPathInformation FpCodeRemainder - Y) SystemMemoryPartitionNodeInformation � ProcessExceptionPort ( � ` WinBuiltinRDSEndpointServersSid 5 ? EventTraceLastBranchConfigurationInformation % z : PowerSettingNotificationName * �, ImagePolicyEntryTypeUnicodeString ' � � SystemManufacturingInformation �7 PdataCrUnchainedSavedLr . ( MonitorRequestReasonUserInputKeyboard V) IoSessionEventMax z @ SessionLockState ( WMI_EXECUTE_METHOD # � " TokenDeviceClaimAttributes EventSecurityAddSACL 6# PowerMonitorOff % V SysDbgSetKdUmExceptionEnable ( VRF_TRIAGE_CONTEXT_NONE ' ( MonitorRequestReasonSystemIdle ) m ProcThreadAttributePseudoConsole 2 � k SystemLogicalProcessorAndGroupInformation e � DPFLTR_MSDSM_ID 7 � PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD :- FindExInfoBasic } FileQuotaInformation % � = ProcessProtectionInformation , i " JobObjectLimitViolationInformation2 ! } FileEndOfFileInformation + 2' COPYFILE2_CALLBACK_STREAM_FINISHED �% CmExtendedParameterMax / } I FileLinkInformationExBypassAccessCheck & �$ RtlRXactOperationDelAttribute K
AuditOpenNonObject - h ��DISPLAYCONFIG_TOPOLOGY_FORCE_UINT32 " � VrfMoreDebuggingRuleClass 1 hI MidlWinrtTypeSerializationInfoVersionOne , E FeatureConfigurationPriorityService w( MandatoryLevelHigh " � ThreadInformationClassMax ( � � SystemAllowedCpuSetsInformation ! � ' SystemPrioritySeperation % z TraceApplicationPowerMessage 4 � ! PS_MITIGATION_OPTION_BLOCK_NON_CET_BINARIES . m ProcThreadAttributeChildProcessPolicy �$ PsWakeReasonUser ' i , JobObjectReserved22Information KeyCachedInformation + z E FirmwareTableInformationRegistered � SidTypeLogonSession z & ProcessorLoad �B SC_ACTION_OWN_RESTART # = MmEtwWorkingSetTypeMaximum ' } < FileIdExtdDirectoryInformation ^5 MemoryBasicInformation 4 SystemPixelFormatB8G8R8 ( � � SystemPhysicalMemoryInformation � ThreadUmsInformation > � � SystemHardwareSecurityTestInterfaceResultsInformation
!# Cmos ( � W ProcessEnableReadWriteVmLogging $ �' USER_MARSHAL_CB_BUFFER_SIZE �! VmOfferPriorityLow >+ ShutdownNoReboot � FpFormatFp128 . Y) SystemMemoryPartitionCreateLargePages � MaxThreadWorkloadClass FpCodeHypot ! UmsThreadMaxInfoClass G WnfDataScopeSession + ( MonitorRequestReasonUserInputMouse + i JobObjectNetRateControlInformation �
ThreadIdealProcessor ( � [ ProcessSystemResourceManagement � > WinBuiltinIUsersSid � RtlResTypeDiskSpaceTier $ � E ProcessJobMemoryInformation ) ? EventTracePebsTracingInformation - � $ TokenRestrictedDeviceClaimAttributes �
PNP_VetoAlreadyRemoved - � PsEnergyComponentTypeDisplayRequired K* NormalizationKC # 6' DfsLinkTrackingInformation # �6 FixedWakeSourceSleepButton e x DPFLTR_NDIS_ID % � RtlResTypePhysicalMemoryTier $ � TP_CALLBACK_PRIORITY_NORMAL . � � SystemHypervisorSharedPageInformation � ThreadSwitchLegacyState �/ ��DPI_AWARENESS_INVALID # z > SessionConnectNotification ) } = FileReplaceCompletionInformation o@ AR_ENABLED $ }" FEEDBACK_TOUCH_PRESSANDHOLD �* NotificationEvent " � SmrGcStateActiveFullSpeed K AuditOpenObject � WinNetworkSid � WinBuiltinGuestsSid /% IDL_CS_NO_CONVERT ( � � SystemPlatformBinaryInformation ) Y) SystemMemoryPartitionAddPagefile H MaximumDmaSpeed , i JobObjectBasicAccountingInformation ) � SE_VALIDATE_MAPPING_ENTIRE_IMAGE ! � � P AccessReasonNullDacl , , EtwSessionNotificationRealtimeError % � ) ProcessThreadStackAllocation ) TransactionPropertiesInformation e ( DPFLTR_SERENUM_ID % � FileStorageTierClassCapacity � TokenPrimaryGroup % � WinBuiltinSystemOperatorsSid e X DPFLTR_SHPC_ID * � VrfForcePendingIORequestRuleClass � OptionYesNo �! PowerStateSleeping4 �) EtwRtEventLossMax + ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE 1 PoDisabledStateMaximum � VMEBus 5 � PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL � WinAuthenticatedUserSid ! $ DCDC_DISABLE_FONT_UPDATE # �" WdActionQueryTriggerAction ' � * SystemProcessorIdleInformation # J ProfileSpecialInstructions e : DPFLTR_PCIIDE_ID v LdrModulesMapping = � PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION � WinCreatorGroupSid e 1 DPFLTR_BURNENG_ID ) PsProtectedTypeNone � JournalSetLastWriteTime " vS _ARM_CPS_INTERRUPT_FLAG_A " � 1 WinAccountPolicyAdminsSid m, PlatformRoleUnspecified i 6 _ARM_BANKED_SPSR_UND � & ProcessCycleTime ' FeatureEnabledStateOptionsNone � Isa ( �! TransactionStateCommittedNotify e 5 DPFLTR_IDLETASK_ID $ � N ProcessReserved3Information KeyNameInformation � IrqPriorityNormal % � r SystemNativeBasicInformation $ � WinEnterpriseControllersSid ) ^5 MemoryPrivilegedBasicInformation � ExceptionContinueSearch �
FileIdBothDirectoryInfo � ' ProcessPagePriority � IoPriorityHintLow � SystemBasicInformation � MutantOwnerInformation + � P ProcessDisableSystemAllowedCpuSets K AuditCloseNonObject 0 � ��DISPLAYCONFIG_DEVICE_INFO_FORCE_UINT32 ' w& POINTER_CHANGE_SECONDBUTTON_UP �" HiberFileBucket16GB � FileAllocationInfo i
_ARM_BANKED_R13_FIQ s WOW64_FUNCTION_NOP % � � SystemShadowStackInformation z ProcessorPowerPolicyDc � JournalSetKeyUserFlags ' ACTCTX_RUN_LEVEL_REQUIRE_ADMIN ) � � SystemDifSetRuleClassInformation ) � � SystemActivityModerationExeState 3 � IrqPolicySpreadMessagesAcrossAllProcessors # } , FileSfioReserveInformation 3 �D TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE ( � AlpcRegisterCallbackInformation % � PsEnergyComponentTypeNetwork $ � ImageControlFlowGuardPolicy 2 �
PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE /% IDL_CS_IN_PLACE_CONVERT , � h WinAuthenticationServiceAssertedSid ) }" FEEDBACK_PEN_BARRELVISUALIZATION �# BlockedDriverEvent ' s TransactionOutcomeUndetermined W StorageReserveIdNone L SingleUserTS z 8 LogicalProcessorIdling ! � 1 SystemSessionInformation V SysDbgGetAutoKdEnable R PnpQueryPowerRelations ! KeyHandleTagsInformation 8 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPOSITE_VIDEO W* EtwFlushLoggerCode ) # CsvFsDiskConnectivityMdsNodeOnly ! {( RtlBsdItemShutdownBootId 0 } ) FileIoCompletionNotificationInformation # }
FileDispositionInformation " X; SeLearningModeInvalidType 7 s WOW64_FUNCTION_CPU_OPTIMIZE_CHPE_IMPORT_THUNKS i _ARM_BANKED_R13_UND � TraceDisallowListQuery ! � SystemPoolTagInformation DynamicTickVetoMax V SysDbgSetKdBlockEnable ( 3 MonitorRequestReasonMax e p DPFLTR_USERGDI_ID � VrfForceIrqlRuleClass $ ( MonitorRequestReasonUnknown :- FindExInfoMaxInfoLevel 0 � � SystemRegistryReconciliationInformation , � EtwCoverageSamplerCreateInformation " � PNP_VetoInsufficientPower ' � MaxEtwCoverageSamplerInfoClass ( � = SystemProcessorPowerInformation i VERIFIER_MODE_LOGO FpCodeRound z SystemPowerInformation ' � g SystemCodeIntegrityInformation V & SysDbgKdPullRemoteFile , � J WinEnterpriseReadonlyControllersSid * 0 JOB_OBJECT_IO_RATE_CONTROL_ENABLE w( MandatoryLevelSystem $ MemoryNotContiguous �. WnfPersistentStateName ) � v WinAuthenticationFreshKeyAuthSid & � Y WinCapabilityVideosLibrarySid 2 � � SystemHypervisorProcessorCountInformation V SysDbgReadBusData � IrqPriorityHigh % Width64Bits � TraceMaxPmcCounterQuery z H PlmPowerRequestCreate $ � UmsInformationCommandAttach # q# ProcessProtectionLevelInfo e l DPFLTR_KTM_ID i _ARM_BANKED_R13_MON ! �5 SC_EVENT_PROPERTY_CHANGE $ ResponseIgnore % � ! WinBuiltinBackupOperatorsSid " � LockQueueNonPagedPoolLock # + FileFsAttributeInformation ( � PsEnergyComponentTypeMouseInput ' i - JobObjectReserved23Information 0 w PsAttributeAllApplicationPackagesPolicy v$ KeyRemoved V # SysDbgGetUmAttachPid $ V SysDbgQueryTraceInformation 4 ( ' MonitorRequestReasonUserInputInitialization - � � SystemProcessorCycleStatsInformation �
PlugPlayControlProperty ' + CmResourceShareDeviceExclusive 6# PowerMonitorOn $ $ WorkerFactoryTimeoutWaiters ' JE ReadDirectoryNotifyInformation � GEO_OFFICIALLANGUAGES V SysDbgWriteMsr $ � CsvControlQueryFileRevision / SystemFirmwareTable_Get � RPCHTTP_RS_REDIRECT ' c* ServiceRegistryStatePersistent z ) SessionPowerInit w PsAttributeMax ' ? EventTraceGroupMaskInformation e DPFLTR_CONFIG_ID , � PlugPlayControlQueryAndRemoveDevice � ' VrfLwSpecialPool e
DPFLTR_REDBOOK_ID X; SeLearningModeSettings i _ARM_BANKED_SP_HYP � Y ProcessImageSection i _ARM_BANKED_R14_USR w PsAttributeImageName % @/ CI_WINDOWS_LOCKDOWN_MODE_MAX + FileFsSizeInformation ' � VrfMDLInvariantDriverRuleClass & * SymbolicLinkGlobalInformation e DPFLTR_WMILIB_ID � PNP_VetoLegacyDriver � � SystemCpuSetInformation " �, ImagePolicyEntryTypeInt32 e DPFLTR_TWOTRACK_ID ) ? EventTraceHeapTracingInformation \ UmsSchedulerStartup w PsAttributeBnoIsolation - �
AlpcCompletionListRundownInformation !#
PNPISAConfiguration z = SessionRITState ( WMI_ENABLE_EVENTS v ��LdrModulesSnapError � - TokenChildProcessFlags ' i JobObjectBasicLimitInformation 3 � u WinAuthenticationKeyPropertyAttestationSid � KHeteroCpuPolicyDynamic � T WinBuiltinAnyPackageSid ( t InternalWakeSourceTimerOverride % z VerifyProcessorPowerPolicyAc ! � RtlPathTypeDriveRelative �
ProcessIoPortHandlers 4 3 DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED � " ProcessExecuteFlags & } > FileHardLinkFullIdInformation " \ UmsSchedulerThreadBlocked ! V) IoSessionEventTerminated w PsAttributeWin32kFilter � � p AccessReasonNoSD % � PsEnergyComponentTypeStorage � TokenUIAccess # �* PoSleepDisableReasonPolicy # O@ UserSharedServiceRequester % � s WinAuthenticationKeyTrustSid " W% PdataPackedUnwindFunction Q WaitAll
FpCodeTruncate v$ KeyModified WdInfoStopTimer ' i JobObjectReserved13Information ( � PlugPlayControlGetRelatedDevice & DynamicTickVetoClockOutOfSync � ProcessUserModeIOPL ( � } SystemSessionBigPoolInformation � PerfInfoDebugEventMax o@ AR_SUPPRESSED BootEntropySourceUefi � JournalCreateKey & � ( ThreadSystemThreadInformation - �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS > � PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE # $ MemoryAlignedAndContiguous + } C FileDesiredStorageClassInformation e i DPFLTR_ALPC_ID " J SemaphoreBasicInformation - ( MonitorRequestReasonUserDisplayBurst i _ARM_BANKED_LR_IRQ i _ARM_BANKED_SP_SVC " } FileCompletionInformation o@ @ AR_DOCKED 7 LocationTypeMaximum � GEO_DIALINGCODE � 2 ThreadWorkloadClass BootEntropySourceTcbTpm ( � " SystemCrashDumpStateInformation � ThreadIoPriority �$ RtlRXactOperationDelete FpCodeSubtract �6 PT_TOUCHPAD # < JournalAbsoluteInformation z # SystemWakeSource J ProfilePipelineFrozen �. WnfPermanentStateName � _ARM_BARRIER_NSHST ! POINTER_FEEDBACK_DEFAULT % �, ImagePolicyEntryTypeOverride � ThreadBasicInformation K* NormalizationOther ' � T ProcessCaptureTrustletLiveDump % ( MonitorRequestReasonTerminal % U, FileMetadataOptimizationNone * � FeatureConfigurationOperationNone # A3 FindExSearchLimitToDevices * � I SystemLogicalProcessorInformation . � AlpcRegisterCompletionListInformation � COR_VTABLE_32BIT e DPFLTR_FSTUB_ID . � � SystemCodeIntegrityClearDynamicStores �! PowerStateMaximum z LastWakeTime L CommunicationServer ! � 3 WinNTLMAuthenticationSid FpCodeLog10 e k DPFLTR_PERFLIB_ID 0 �6 VirtualStorageBehaviorCacheWriteThrough # � z SystemAcpiAuditInformation # �# DeviceInstanceStartedEvent �
JournalAbortTransaction 1D PROXY_MARSHAL / �' RunlevelInformationInActivationContext � StandardDesign ' l ObjectSessionObjectInformation % � � SystemPoolZeroingInformation �& ��LdrpAnyDevice % SystemVaTypeAll ! � ThreadSetTlsArrayAddress ! } FilePipeLocalInformation z SystemPowerLoggingEntry {( RtlBsdItemChecksum $ � KHeteroCpuPolicyLargeOrIdle * 2' COPYFILE2_CALLBACK_STREAM_STARTED % �* COPYFILE2_PHASE_PREPARE_DEST + � t WinAuthenticationKeyPropertyMFASid e j DPFLTR_WDI_ID � RF_UNSORTED ! *& KeyWow64FlagsInformation # A" SystemCrashDumpReconfigure . F TransactionManagerRecoveryInformation < FpCompareUnordered & z SystemPowerStateNotifyHandler � ImageAslrPolicy � GEO_LCID �$ MaxAppContainerSidType & �, POINTER_DEVICE_TYPE_TOUCH_PAD ! + FileFsMaximumInformation $ w PsAttributeDesktopAppPolicy ' �* COPYFILE2_PHASE_PREPARE_SOURCE y TableFoundNode } FileAccessInformation C SYSTEM_HANDLE_THREAD � ! ProcessIoPriority � % ThreadContainerId + ? EventTraceProfileConfigInformation 3 � � SystemEntropyInterruptTimingRawInformation � RtlPathTypeUnknown # � PerfInfoMemResetUndoFailed $( � UserUnknown $ � AlpcConnectedSIDInformation , � e ProcessDynamicEHContinuationTargets ( Y" � �HeapSetDebuggingInformation FirmwareTypeUnknown # � IrqPolicyOneCloseProcessor � CsvControlStartForceDFO } L FileMaximumInformation K AuditPrivilegeObject y9 KTMOBJECT_INVALID � ProcessAffinityMask � ProcessVmCounters �R MaxTimerInfoClass � ImageFontDisablePolicy # {( RtlBsdItemBootAttemptCount $ G WnfDataScopePhysicalMachine e DPFLTR_I8042PRT_ID # $ WorkerFactoryThreadMaximum � SmrGcStateActive w PsAttributeDebugObject WdInfoInvalid & i JobObjectReserved1Information e � DPFLTR_WER_ID z \ EnergyTrackerCreate � & ThreadNameInformation � 9 ReservedForDVRF57 � OptionOk " $ WorkerFactoryCallbackType i _ARM_BANKED_SP_USR ( WMI_REGINFO - � V WinCapabilityInternetClientServerSid & � SystemNonPagedPoolInformation �E COMPARE_STRING $ � � SystemLeapSecondInformation , � PS_MITIGATION_OPTION_HEAP_TERMINATE + m ProcThreadAttributeProtectionLevel � NuBus & w PsAttributeChildProcessPolicy w( MandatoryLevelLow ' n# DISPLAYCONFIG_SCALING_IDENTITY $ � PoCsDeviceNotificationAudio V) IoSessionEventLogon +% MemoryTypeHugePage i 0 _ARM_BANKED_SPSR_IRQ $ �$ PsWakeReasonPreserveProcess * � a WinBuiltinRDSManagementServersSid Y" HeapStackDatabase # � � SystemWin32WerStartCallout # � AlpcMessageZoneInformation $ �! VmPageDirtyStateInformation } FileAllInformation �) InternalWakeSourceType e � DPFLTR_GPIO_ID % � 5 WinSChannelAuthenticationSid B <C SystemActivityModerationStateUserManagedDisableThrottling % m, PlatformRoleEnterpriseServer ! G! ProcessActivityTypeAudio � EventProviderSetTraits $ q# ProcessMemoryExhaustionInfo w PsAttributeHandleList e 7 DPFLTR_TAPE_ID � AlpcPortInformation � RtlPathTypeLocalDevice & i JobObjectReserved6Information e DPFLTR_ACPI_ID � AclRevisionInformation e 6 DPFLTR_SOFTPCI_ID i _ARM_BANKED_R14_MON ! % SystemVaTypeNonPagedPool z ! ProcessorIdleStates � PerfInfoMemReset z SystemPowerStateHandler - � � SystemCodeIntegrityUnlockInformation ' � L WinBuiltinEventLogReadersGroup J ProfileLoadLinkedIssues ,2 ShrinkAbort / � J ProcessHighGraphicsPriorityInformation � PsCreateInitialState � % ProcessImageInformation % � ImageSystemCallDisablePolicy i _ARM_BANKED_SP_IRQ � PNP_VetoDriver WdInfoTriggerAction W* EtwStopLoggerCode 3 � % WinBuiltinNetworkConfigurationOperatorsSid ( WMI_GET_ALL_DATA } FileModeInformation � WinRemoteLogonIdSid ! ACTCTX_RUN_LEVEL_NUMBERS V % SysDbgGetLiveKernelDump i _ARM_BANKED_R8_USR , � PlugPlayControlGenerateLegacyDevice " H WnfInfoSubscribersPresent 3 ( & MonitorRequestReasonUserInputSessionSwitch # �
RtlPhysicalMemoryPolicyLow V) IoSessionEventIgnore i _ARM_BANKED_SP_MON ! z O RegisterSpmPowerSettings ( w& POINTER_CHANGE_FIRSTBUTTON_DOWN ( � X WinCapabilityPicturesLibrarySid " � COR_VTABLE_FROM_UNMANAGED C 3 DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST 5 �$ � �DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INTERNAL ( � d ProcessAltSystemCallInformation % V SysDbgQueryModuleInformation e e DPFLTR_DEFAULT_ID FpCodeSin � TokenMandatoryPolicy � KCONTINUE_RESUME w PsAttributeChpe 0 �W JOB_OBJECT_NET_RATE_CONTROL_VALID_FLAGS � O WinMediumPlusLabelSid * Y" HeapEnableTerminationOnCorruption % 7 EtwQueryProcessHandleInfoMax e ^ DPFLTR_VDS_ID 9 0 JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ALL " � VrfMiscellaneousRuleClass & � SystemMirrorMemoryInformation * � { SystemBasicPerformanceInformation e T DPFLTR_RTLTHREADPOOL_ID ) � ManageHotPatchUnloadPatchForUser # } FileMoveClusterInformation i _ARM_BANKED_R8_FIQ e a DPFLTR_VDSDYNDR_ID $ � * ThreadDynamicCodePolicyInfo " � � AccessReasonDeniedAce i VERIFIER_MODE_TEST - �6 VirtualStorageBehaviorCacheWriteBack + � � SystemInterruptSteeringInformation i JobObjectClearEvent ' z / NotifyUserModeLegacyPowerEvent m, PlatformRoleAppliancePC $ � . ProcessMemoryAllocationMode � TokenSource $ �/ IMPORT_OBJECT_NAME_EXPORTAS � JournalDeleteKey ' } E FileMemoryPartitionInformation {( RtlBsdItemProductType # �, ImagePolicyEntryTypeUInt64 ' � PlugPlayControlEnumerateDevice 4 3 DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE � 7 ProcessKeepAliveCount * � � SystemWheaIpmiHardwareInformation � _ARM_BARRIER_ISH V SysDbgGetTriageDump � ] ProcessLoaderDetour 0 � R SystemThreadPriorityClientIdInformation e ; DPFLTR_FLOPPY_ID # �! VmImageHotPatchInformation " + FileFsDataCopyInformation � SecurityIdentification & i JobObjectReserved5Information 1 � ] WinCapabilityEnterpriseAuthenticationSid � TracePmcCounterListInfo & � PoCsDeviceNotificationStorage > �' FileInformationInAssemblyOfAssemblyInActivationContxt , � PsEnergyComponentTypeForegroundTime ,2 ShrinkCommit $ � H ProcessIumChallengeResponse ! . DEBUG_CONTROL_SPACE_PRCB � 0 SystemSessionDetach e DPFLTR_CACHEMGR_ID � FileNormalizedNameInfo � COMIMAGE_FLAGS_ILONLY W* EtwWdiSemUpdate , � l SystemProcessorCycleTimeInformation # z U PowerRequestActionInternal L PhoneNT e A DPFLTR_FCPORT_ID " z ' PowerShutdownNotification {( RtlBsdPowerTransition ( �* PoSleepDisableReasonGuardedHost * � . TokenIsLessPrivilegedAppContainer FpCodeAtan2 K AuditCloseObject & � ComputerNameDnsFullyQualified � 5 ReservedForDVRF53 z VerifySystemPolicyDc " �# DevicePropertyChangeEvent - � � COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE +% MemoryTypeMax } FilePositionInformation ' � � SystemVsmProtectionInformation 0 �
PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD % � a ProcessLeapSecondInformation � WinLogonIdsSid ( WMI_DISABLE_EVENTS z SystemPowerStateLogging / � AlpcAssociateCompletionPortInformation , �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDI % �/ IMPORT_OBJECT_NAME_NO_PREFIX - , EtwSessionNotificationSessionStarted " �$ ParentAppContainerSidType + �
CsvControlQueryVolumeRedirectState �$ MaxKeyValueInfoClass % O MemExtendedParameterNumaNode 3 � PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE ! z % TraceServicePowerMessage w PsAttributeImageInfo # � ImageUserShadowStackPolicy
BootMaxEntropySources � RpcRequestsPerSecond � b WinUserModeDriversSid $ ResponseNo � KCONTINUE_LAST WdInfoTimeoutValue ! V SysDbgSetPrintBufferSize * � � SystemProcessorProfileControlArea z SetPowerSettingValue % ProcessUserShadowStackPolicy # � UNSPECIFIED_COMPARTMENT_ID * $ MemoryNotEligibleToMakeContiguous % � CsvControlQueryRedirectState - ( MonitorRequestReasonPoSetSystemState !# Pos 2 � DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_NAME � 8 ReservedForDVRF56 . ( VRF_TRIAGE_CONTEXT_FLIGHT_DIAGNOSTICS z NotifyUserPowerSetting � CsvControlEnableCaching ! �5 SC_EVENT_DATABASE_CHANGE $ BackTraceDatabaseMaxControl � TokenCapabilities " vS _ARM_CPS_INTERRUPT_FLAG_I & i JobObjectReserved7Information y9 KTMOBJECT_ENLISTMENT $ � IrqPolicyAllCloseProcessors " BootEntropySourceSeedfile � WinWorldSid 1 � 8 WinBuiltinIncomingForestTrustBuildersSid � RtlPathTypeRelative 05 CoverageAllModules 2 �D TOKEN_SECURITY_ATTRIBUTE_OPERATION_DELETE " 4 SystemPixelFormatB8G8R8X8 z VerifySystemPolicyAc FpCodeMultiply ( ,$ DISPLAYCONFIG_ROTATION_IDENTITY & ! SecureSettingValueTypeUnknown � TokenRestrictedSids - CacheTrace z PowerActionWarmEject 2 �W JOB_OBJECT_NET_RATE_CONTROL_MAX_BANDWIDTH * i JobObjectExtendedLimitInformation � WinLocalServiceSid , ^5 MemoryPhysicalContiguityInformation �" WdActionStartTimer % � EventProviderBinaryTrackInfo V SysDbgCheckLowMemory 0 ? EventTraceProfileCounterListInformation �
PNP_VetoNonDisableable e DPFLTR_SYSTEM_ID # TransactionBindInformation # �# HardwareProfileChangeEvent � - ReservedForDVRF45 � JournalSetValue ) � VrfProcessorBranchTraceRuleClass $ 6' NtfsLinkTrackingInformation �" WdActionSetTimeoutValue & � < ProcessCommandLineInformation ' � I ProcessChildProcessInformation " � LockQueueIoCompletionLock ! �$ RtlDiskSpacePolicyNormal e @ DPFLTR_RSFILTER_ID e w DPFLTR_FVEVOL_ID ! �' LoadReasonEnclavePrimary e DPFLTR_TCPIP_ID �# SeImageSignatureCache S7 HANDEDNESS_LEFT # � � SystemCpuSetTagInformation ) AtomBasicInformation & i $ JobObjectSiloBasicInformation �* COPYFILE2_PHASE_MAX V SysDbgWriteVirtual � ThreadPerformanceCount ! � VrfExtendingXDVTimeLimit / � � SystemDeviceDataEnumerationInformation � IoPriorityNormal . � PlugPlayControlGetInterfaceDeviceList 0 �* ��DISPLAYCONFIG_PIXELFORMAT_FORCE_UINT32 % � SystemDpcBehaviorInformation ! } FileAlignmentInformation � i WinLocalAccountSid ) i JobObjectInterferenceInformation + ? EventTraceKernelVersionInformation ' � SystemSummaryMemoryInformation ( $ WorkerFactoryThreadBasePriority A � DISPLAYCONFIG_DEVICE_INFO_SET_SUPPORT_VIRTUAL_RESOLUTION e DPFLTR_STORPROP_ID ' � PoCsDeviceNotificationEthernet ! � B SystemBigPoolInformation = MmEtwWorkingSetTypeUser - � CsvControlQueryFileRevisionFileId128 L ComputeServer � ThreadIsTerminated 05 CoverageSearchByName � > ReservedForDVRF62 , i & JobObjectServerSiloBasicInformation �G ServiceDirectoryTypeMax � AccessReasonNone e \ DPFLTR_VSSDYNDISK_ID SectionImageInformation � 3 MaxThreadInfoClass V SysDbgClearSpecialCalls % � � SystemFullProcessInformation � DevicePowerState ' K AuditOpenObjectWithTransaction {( RtlBsdItemBootShutdown $
WorkerFactoryFlags 3 ( % MonitorRequestReasonUserInputPoUserPresent " + FileFsFullSizeInformation C SYSTEM_HANDLE_MUTEX % SystemVaTypeSystemPtes z 1 ProcessorIdleDomains � TokenAccessInformation � WinDialupSid � TraceGuidQueryList ! �R TimerSetCoalescableTimer � GEO_ID � GEO_CURRENCYCODE 1 } B FileRenameInformationExBypassAccessCheck W* EtwIncrementFileCode � GEO_CURRENCYSYMBOL FpCodeCosh * �= POINTER_DEVICE_CURSOR_TYPE_ERASER % � SystemVdmInstemulInformation ( � A ProcessCommitReleaseInformation i JobObjectContainerId z C PdcInvocation - Y) SystemMemoryPartitionGetMemoryEvents + # CsvFsDiskConnectivitySubsetOfNodes + �; PerfInfoDomainChangeEventEnterTrap , m ProcThreadAttributeDesktopAppPolicy / � CsvControlUnmarkHandleLocalVolumeMount J ProfileMaximum Y" HeapMemoryLimit " $ MaxWorkerFactoryInfoClass " �$ RtlRXactOperationSetValue 0 i / JobObjectThreadImpersonationInformation � RF_SORTED 3 ��DISPLAYCONFIG_COLOR_ENCODING_FORCE_UINT32 �' LoadReasonDynamicLoad C SYSTEM_HANDLE_SECTION ( SectionInternalImageInformation 0 x0 BootEntropySourceStructureUninitialized � SystemPathInformation 3 � PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER , }" FEEDBACK_TOUCH_CONTACTVISUALIZATION i VERIFIER_MODE_FIELD e � DPFLTR_VPCI_ID �
GEO_PARENT $ �' LoadReasonEnclaveDependency i - JobObjectSiloSystemRoot % DynamicTickVetoSoftwareTimer e DPFLTR_SVCHOST_ID % ( MonitorRequestReasonResumeS4 � ' ThreadSelectedCpuSets - � � SystemCodeIntegrityPolicyInformation # �8 _ARM_CPS_ENABLE_INTERRUPTS # : EtwNotificationTypePerflib " � TP_CALLBACK_PRIORITY_HIGH � WinBuiltinDomainSid . � SystemProcessorPerformanceInformation ! Y) SystemMemoryPartitionMax � ComputerNameDnsDomain ' i JobObjectCycleTimeNotification * � SystemPerformanceTraceInformation z ] EnergyTrackerQuery % . DEBUG_CONTROL_SPACE_KSPECIAL ! 1 PoDisabledStateSleeping4 � AlpcServerInformation ' i JobObjectReserved10Information ! �, ��POINTER_DEVICE_TYPE_MAX ) � ManageHotPatchQueryActivePatches @ <C SystemActivityModerationStateUserManagedAllowThrottling � SidTypeDomain ' } % FileIdBothDirectoryInformation % Y" HeapCompatibilityInformation +% MemoryTypeNonPaged } F FileStatLxInformation ! w PsAttributePriorityClass �+ IMO_SYSTEM � IoPriorityLow $ � UmsInformationCommandDetach ! !# SgiInternalConfiguration - CacheInstruction � SystemFlagsInformation } FileFullEaInformation % � u SystemBootEntropyInformation - �' LoadReasonDynamicForwarderDependency $ ResponseNotHandled i _ARM_BANKED_R11_USR * @/ CI_WINDOWS_LOCKDOWN_MODE_UNLOCKED " FpCodeY0 * ( - MonitorRequestReasonDirectedDrips � TokenUser e I DPFLTR_PROCESSOR_ID ( } J FileStorageReserveIdInformation / JE ReadDirectoryNotifyExtendedInformation * � p WinBuiltinStorageReplicaAdminsSid z , PowerRequestAction �! STUB_MARSHAL ( n# DISPLAYCONFIG_SCALING_STRETCHED � TokenGroups % +
FileFsVolumeFlagsInformation � � SystemPolicyInformation ( � a SystemVerifierFaultsInformation � TokenSandBoxInert z
SystemReserveHiberFile , � PS_MITIGATION_OPTION_ROP_STACKPIVOT M ToleranceMedium ( O MemExtendedParameterInvalidType " � / WinAccountSchemaAdminsSid # $ WorkerFactoryThreadCpuSets � DEFAULT_COMPARTMENT_ID 7 �' AssemblyDetailedInformationInActivationContext * � 0 ProcessTokenVirtualizationEnabled " � MaximumIoPriorityHintType � FpFormatFp64 * ? EventTraceStackTracingInformation + �W JOB_OBJECT_NET_RATE_CONTROL_ENABLE i _ARM_BANKED_LR_FIQ 16 CriticalError % � FileStorageTierMediaTypeDisk , i + JobObjectMemoryPartitionInformation # �, ImagePolicyEntryTypeUInt32 ! 1 PoDisabledStateSleeping1 �$ KeyValueFullInformation 1D PROXY_CALCSIZE � IoSessionStateConnected ? � $ PS_MITIGATION_OPTION_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY � ThreadCycleTime i _ARM_BANKED_R12_FIQ / � CrossProcOperationMemoryAllocPreNotify � VrfRuleClassBase / ? EventTraceExecutiveResourceInformation * �; PerfInfoDomainChangeEventIdleHalt � JournalSetKeySecurity � KCONTINUE_SET ! l ObjectSessionInformation $ w( MandatoryLevelSecureProcess �# TargetDeviceChangeEvent � EndAlternatives . A" SystemCrashDumpInitializationComplete �) EtwRtBackupLost ! UmsThreadTeb � SecurityAnonymous ]; PowerUserPresent / ( MonitorRequestReasonBatteryCountChange ' {( RtlBsdItemPowerButtonPressInfo " ( MonitorRequestReasonWinrt * ProcessSideChannelIsolationPolicy % �9 DDC_DISABLE_CONTROL_RELAYOUT ) � 9 SystemExtendedProcessInformation �C PortBasicInformation * � � SystemInterruptCpuSetsInformation �$ MonitorRequestTypeOff BootEntropySourceCng ! � VrfPortMiniportRuleClass � WinServiceSid / � � SystemTrustedPlatformModuleInformation & w& POINTER_CHANGE_THIRDBUTTON_UP M SynchronizationTimer 16 IgnoreError �B SC_ACTION_RUN_COMMAND � MaxIoPriorityTypes " } - FileSfioVolumeInformation e
DPFLTR_SCSIMINIPORT_ID +% MemoryTypePaged / � PS_MITIGATION_OPTION_RETURN_FLOW_GUARD � TokenAuditPolicy �
GEO_TIMEZONES � � � AccessReasonNoGrant + , EtwSessionNotificationMediaChanged 16 NormalError ! } FileDirectoryInformation � ProcessAccessToken " �
LockQueueAfdWorkQueueLock ) � 6 SystemLoadGdiDriverInSystemSpace � ProcessLdtSize e DPFLTR_VIDEO_ID e � DPFLTR_KSECDD_ID $ N+ RtlFeatureConfigurationBoot ' � " ThreadCpuAccountingInformation ( � � SystemKernelVaShadowInformation �- MemoryReserveUserApc 1D PROXY_GETBUFFER " +@ EtwCompressionModeRestart K AuditPrivilegeService i _ARM_BANKED_R9_FIQ ! O RelationProcessorPackage , � SharedVirtualDiskSnapshotsSupported � RPCHTTP_RS_SESSION �' LoadReasonAsImageLoad + �D AlpcMessageDirectStatusInformation � FpFormatI32 $ �! STUB_CALL_SERVER_NO_HRESULT V ! SysDbgGetUmBreakPid ! 2' COPYFILE2_CALLBACK_ERROR ! UmsThreadIsSuspended % Width32Bits # � 4 WinDigestAuthenticationSid � FileAlignmentInfo 4 �' CompatibilityInformationInActivationContext � ��InterfaceTypeUndefined ( WMI_SET_SINGLE_INSTANCE � VrfNdisWifiRuleClass ( ,$ DISPLAYCONFIG_ROTATION_ROTATE90 z ; GetPowerSettingValue * � I WinNonCacheablePrincipalsGroupSid $ �: RtlMitigationOptionStateOff } 5 FileNumaNodeInformation e DPFLTR_HALIA64_ID � WinProxySid 5 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EXTERNAL 5 } K FileCaseSensitiveInformationForceAccessCheck e O DPFLTR_IHVAUDIO_ID A 0 JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ON_SOFT_CAP e } DPFLTR_SBP2PORT_ID * � MemoryPurgeLowPriorityStandbyList i _ARM_BANKED_SP_UND % � � SystemMemoryUsageInformation ' ( VRF_TRIAGE_CONTEXT_DEVELOPMENT V
SysDbgReadPhysical � P WinLocalLogonSid " / ImagePolicyIdCrashDumpKey " � c WinBuiltinHyperVAdminsSid ' c* ServiceRegistryStateParameters e - DPFLTR_UNIMODEM_ID � / TokenIsSandboxed L Enterprise BootEntropySourceTime
� Eisa # J ProfileIntegerInstructions e DPFLTR_AMLI_ID O RelationProcessorCore �" WdActionWake J ProfileTotalNonissues }" ��FEEDBACK_MAX " � SmrGcActionStartFullSpeed � ThreadLastSystemCall � � SystemFlags2Information % � COMIMAGE_FLAGS_32BITREQUIRED " �, ImagePolicyEntryTypeUInt8 ! J ProfileStoreInstructions � TraceMaxLoggersQuery o@ � AR_LAPTOP e � DPFLTR_CFR_ID $ � PlugPlayControlDeviceStatus q# ProcessPowerThrottling / G SharedVirtualDiskHandleStateFileShared SmrGcMethodCompression e � DPFLTR_STORVSP_ID ( � IrqPolicyAllProcessorsInMachine # � SystemFileCacheInformation ; �/ SystemFeatureConfigurationSectionTypeUsageTriggers 0 � PsEnergyComponentTypeDesktopVisibleTime � DEPTotalPolicyCount e 2 DPFLTR_IMAPI_ID �
TraceSetDisallowList �" HiberFileBucket8GB � GroupAffinityDontCare , � � SystemSpeculationControlInformation � SidTypeGroup e = DPFLTR_TERMSRV_ID # �E PowerRequestSystemRequired L
StorageServer 3 � PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER & # CsvFsDiskConnectivityAllNodes % � UmsInformationCommandInvalid # �6 FixedWakeSourcePowerButton ) :
EtwNotificationTypeInProcSession �" HiberFileBucket32GB �$ PsWakeReasonKernel % q# ProcessTelemetryCoverageInfo �. WnfTemporaryStateName % V SysDbgGetKdUmExceptionEnable e � DPFLTR_MOUNTMGR_ID 5 � � SystemCodeIntegritySyntheticCacheInformation # � X SystemProcessIdInformation * � 0 TokenOriginatingProcessTrustLevel 1 {( RtlBsdItemReportedAbnormalShutdownBootId , � VrfTrackingPoolAllocationsRuleClass � 7 WinOtherOrganizationSid � PowerSystemUnspecified " BootEntropySourceExternal & �E PowerRequestExecutionRequired ' n# DISPLAYCONFIG_SCALING_CENTERED � KCONTINUE_UNWIND " $ WorkerFactoryRetryTimeout e DPFLTR_DISK_ID � OptionAbortRetryIgnore ( � � SystemMemoryTopologyInformation q# ProcessAppMemoryInfo 3 <C SystemActivityModerationStateSystemManaged $ 2 ORIENTATION_PREFERENCE_NONE " /% IDL_CS_NEW_BUFFER_CONVERT $ � B ProcessReserved1Information ) � K WinAccountReadonlyControllersSid KeyFlagsInformation �9 DDC_DISABLE_ALL ' A3 FindExSearchLimitToDirectories �+ IMO_HARDWARE �( EventBasicInformation �) EtwRtEventLost # z $ SystemHiberFileInformation � COR_VTABLE_64BIT % Width16Bits ' {( RtlBsdPowerTransitionExtension % } FileMailslotQueryInformation ) m ProcThreadAttributeGroupAffinity ! 1 PoDisabledStateSleeping3 e [ DPFLTR_PRINTSPOOLER_ID $ V SysDbgDisableKernelDebugger # ( VRF_TRIAGE_CONTEXT_DEFAULT 5 �/ SystemFeatureConfigurationSectionTypeRuntime � # ProcessTlsInformation � NEC98x86 " � PlugPlayControlHaltDevice � " VrfMoreIrqlRuleClass �) FixedWakeSourceType # � TokenVirtualizationEnabled ) ( " MonitorRequestReasonUserInputPen / i JobObjectExtendedAccountingInformation % �0 DynamicTickDisableReasonNone + FileFsLabelInformation L TerminalServer & ^5 MemorySharedCommitInformation $ � FeatureEnabledStateDisabled ' �% CmExtendedParameterInvalidType H TP_LOG_LEVEL_WARNING 2 �+ SystemProcessClassificationMemCompression . � � SystemSupportedProcessorArchitectures PoConditionMaximum " �$ RtlDiskSpacePolicyVeryLow $ �) TimerPresumedWakeSourceType $ � PlugPlayControlUserResponse ; �, CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK_PERMANENT �B SC_ACTION_NONE v ��LdrModulesUnloaded O RelationGroup � GEO_OFFICIALNAME � RtlPathTypeUncAbsolute e H DPFLTR_PNPMEM_ID W* EtwQueryLoggerCode 0 s WOW64_FUNCTION_QUERY_PROCESS_DEBUG_INFO 4 � G ProcessRaiseUMExceptionOnInvalidHandleClose 0 � CrossProcOperationInstructionCacheFlush 4$ TimerBasicInformation ! � SystemProcessInformation ! � ThreadImpersonationToken # *& KeyControlFlagsInformation � SmrGcStatePaused % � Z WinCapabilityMusicLibrarySid : LT_DONT_CARE ]; PowerUserInactive & m, PlatformRolePerformanceServer + i
JobObjectLimitViolationInformation � IoPriorityHintVeryLow & h DISPLAYCONFIG_TOPOLOGY_EXTEND ( �= ��POINTER_DEVICE_CURSOR_TYPE_MAX # � PNP_VetoInsufficientRights � ProcessRaisePriority $ ResponseTryAgain 7 � DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_BASE_TYPE e / DPFLTR_FLTMGR_ID FpCodeExp �" HiberFileBucket4GB i _ARM_BANKED_R13_ABT ' � H WinCacheablePrincipalsGroupSid �$ GenericGreaterThan @ � PS_MITIGATION_OPTION_USER_CET_SET_CONTEXT_IP_VALIDATION � PsCreateFailOnFileOpen $ LearningModeLogLevelPassive �7 PdataCrChained ! 7 EtwQueryLastDroppedTimes � OptionOkCancel ! � PsProtectedSignerCodeGen , � SE_WS_APPX_SIGNATURE_ORIGIN_UNKNOWN , �+ SystemProcessClassificationRegistry 3 � � SystemCodeIntegrityVerificationInformation 7 � � SystemAffinitizedInterruptProcessorInformation e ` DPFLTR_VDSDYN_ID J ProfileLoadInstructions % � COR_VTABLE_CALL_MOST_DERIVED , �; PerfInfoDomainChangeEventIdleResume $ ResponseYes O@ UserProcessRequester �" HiberFileBucket2GB " , EtwSessionNotificationMax 8 �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPONENT_VIDEO " z" EtwProviderTraitTypeGroup G WnfDataScopeUser � RpcIncomingBandwidth $ � ComputerNamePhysicalNetBIOS # � ! SystemExceptionInformation % SectionRelocationInformation , �? DISPLAYCONFIG_MODE_INFO_TYPE_SOURCE 9 � PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT 7 ( MonitorRequestReasonAcDcDisplayBurstSuppressed ( �? IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF ! �$ ChildAppContainerSidType ! � G WinCreatorOwnerRightsSid & � x SystemSystemPtesInformationEx 7 � � SystemCodeIntegrityPlatformManifestInformation ! / ImagePolicyIdParentSdRev v ProcessWorkingSetEmpty R PnpQueryEjectRelations ' � � SystemSecurityModelInformation !# MaximumBusDataType ! WdInfoGeneratedLastReset * � � SystemIsolatedUserModeInformation ! � PsEnergyComponentTypeMBB � % TokenDeviceGroups � GEO_NAME {(
RtlBsdItemBootId 0 �D TOKEN_SECURITY_ATTRIBUTE_OPERATION_NONE �9 DDC_DEFAULT " � ] SystemTimeZoneInformation � TokenSessionId � PsCreateMaximumStates - FeatureEnabledStateOptionsWexpConfig ' � FileIdExtdDirectoryRestartInfo MaxSectionInfoClass * � U SystemProcessorPowerInformationEx + �% CmExtendedParameterFileAccessToken . ? EventTraceProfileEventListInformation ) w& POINTER_CHANGE_FOURTHBUTTON_DOWN $ � KHeteroCpuPolicySmallOrIdle % � TraceProfileSourceConfigInfo �* COPYFILE2_PHASE_NONE & � RtlSparseBitmapOperationClear �B SC_ACTION_RESTART & � WinBuiltinAccountOperatorsSid � : ProcessHandleTable % SystemVaTypeSystemCache � LockQueueUnusedSpare8 + � � SystemOfflineDumpConfigInformation � SystemModuleInformation *& KeyWriteTimeInformation C 3 DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST + � � SystemCodeIntegrityAddDynamicStore $ � � SystemSpacesBootInformation ! � PsProtectedSignerWindows % i . JobObjectEnergyTrackingState � ComputerNameDnsHostname $ � c SystemSystemDiskInformation ( �! VmPhysicalContiguityInformation ' �,
ImagePolicyEntryTypeAnsiString " 4 SystemPixelFormatR8G8B8X8 # � TP_CALLBACK_PRIORITY_COUNT � ThreadPriorityBoost $ � 2 SystemRangeStartInformation S7 HANDEDNESS_RIGHT . �D AlpcMessageTokenModifiedIdInformation % V SysDbgRegisterForUmBreakInfo " � E SystemHotpatchInformation � PowerSystemSleeping2 " vS _ARM_CPS_INTERRUPT_FLAG_F V SysDbgSetTracepoint F ^ EDIT_CONTROL_FEATURE_ENTERPRISE_DATA_PROTECTION_PASTE_SUPPORT e Z DPFLTR_STORMINIPORT_ID " � M SystemModuleInformationEx ! � 9 ProcessWorkingSetControl 2 � FeatureConfigurationOperationVariantState EventSecurityAddDACL " � TraceLbrConfigurationInfo $ L WorkerFactoryCallbackNormal � PNP_VetoLegacyDevice � CsvControlStopForceDFO FpCodeLdexp 6 � e WinBuiltinAccessControlAssistanceOperatorsSid / �! VmVirtualMachinePrepopulateInformation ) ( MonitorRequestReasonSxTransition � TokenType w& POINTER_CHANGE_NONE v LdrModulesInitializing : EtwNotificationTypeMax � ImageSignaturePolicy # � FeatureEnabledStateDefault e � DPFLTR_TXF_ID ( ( MonitorRequestReasonPowerButton o@ AR_MULTIMON e V DPFLTR_TCPIP6_ID # } FileCompressionInformation ' i + JobObjectReserved21Information i < _ARM_BANKED_SPSR_MON H WnfInfoIsQuiescent % ProcessMitigationOptionsMask e � DPFLTR_EXFAT_ID ( � C SystemSessionPoolTagInformation � COR_VERSION_MAJOR_V2 G WnfDataScopeMachine � RtlResTypeMax ' i / JobObjectReserved25Information 2 �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN " � IMAGE_COR_EATJ_THUNK_SIZE � GEOCLASS_NATION ' } & FileIdFullDirectoryInformation $ �,
ImagePolicyEntryTypeMaximum ( � � SystemIntegrityQuotaInformation 1 �, CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK ! � ThreadBreakOnTermination ! w PsAttributeMemoryReserve i # JobObjectCreateSilo ) � B ProcessDefaultCpuSetsInformation � ThreadAffinityMask * � n WinAccountDefaultSystemManagedSid � OptionRetryCancel [ IMDT_PEN Q" FpRoundPlusInfinity & LearningModeLogLevelNormalApc � TraceStackTracingInfo ) (
MonitorRequestReasonPolicyChange L MaxSuiteType z T ThermalEvent V
SysDbgWriteControlSpace $ +@ EtwCompressionModeNoRestart � MemoryCommandMax z * SessionDisplayState & m ProcThreadAttributeHandleList �
WinAnonymousSid � FileCaseSensitiveInfo ! < JournalClientInformation & |$ LowMemoryResourceNotification M ToleranceLow � TokenImpersonationLevel o@ AR_NOT_SUPPORTED A � DISPLAYCONFIG_DEVICE_INFO_GET_SUPPORT_VIRTUAL_RESOLUTION % � � SystemKernelDebuggingAllowed " : EtwNotificationTypeEnable V SysDbgWritePhysical z 5 ProcessorPerfStatesHv � ThreadIsIoPending 4 SC_ENUM_PROCESS_INFO ) 1 PoDisabledStateSleeping4Firmware 1 � CrossProcOperationMemoryProtectPreNotify �
TraceGroupQueryInfo % � Q SystemFileCacheInformationEx z LastSleepTime }" FEEDBACK_TOUCH_TAP e < DPFLTR_FDC_ID * t InternalWakeSourceDozeToHibernate & ( MonitorRequestReasonPdcSignal . � CrossProcOperationMemoryFreePreNotify FirmwareTypeBios - �# QUERY_FILE_LAYOUT_FILTER_TYPE_FILEID " � 4 SystemVerifierThunkExtend 6# PowerMonitorDim ! � � SystemBadPageInformation �$
RtlDiskSpacePolicyLow & $ WorkerFactoryBasicInformation FpCodeLog , m ProcThreadAttributeMitigationPolicy + } 2 FileIdGlobalTxDirectoryInformation z SystemPowerCapabilities ! �, ImagePolicyEntryTypeInt8 ) �; PerfInfoDomainChangeEventMaximum / � \ WinCapabilitySharedUserCertificatesSid v ��LdrModulesInitError - �- PoHiberForceDisableReasonGuardedHost $ � K ProcessSubsystemInformation e � DPFLTR_FSLIB_ID 1D PROXY_SENDRECEIVE e . DPFLTR_SIS_ID * x0 BootEntropySourceDisabledByPolicy & � PlugPlayControlGetDeviceDepth % �E PowerRequestAwayModeRequired �B SC_ACTION_REBOOT ( *& KeySetVirtualizationInformation & � PsEnergyComponentTypeAudioOut * � b ProcessFiberShadowStackAllocation e S DPFLTR_HPS_ID � WinLocalSid �/ IMPORT_OBJECT_NAME * � v SystemVerifierCountersInformation & �$ PsWakeReasonExecutionRequired / �D TOKEN_SECURITY_ATTRIBUTE_OPERATION_ADD z M DisplayBurst ' i & JobObjectReserved16Information � NATIVE_TYPE_MAX_CB $ � O SystemSuperfetchInformation z ( MonitorCapabilities e DPFLTR_CDAUDIO_ID i _ARM_BANKED_R13_IRQ # . DEBUG_CONTROL_SPACE_THREAD = �$
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EXTERNAL e ~ DPFLTR_COVERAGE_ID � OptionYesNoCancel �# MaxPlugEventCategory V SysDbgReadIoSpace �
ImageImageLoadPolicy � � SystemEdidInformation # � SystemProcessorInformation v ��LdrModulesUnloading J ProfileDcacheMisses 2' COPYFILE2_CALLBACK_MAX q# ProcessMemoryPriority " � ) ThreadActualGroupAffinity 3 � � SystemCodeIntegrityPoliciesFullInformation ) � PlugPlayControlRegisterNewDevice " � KHeteroCpuPolicyStaticMax ( �6 VirtualStorageBehaviorUndefined �/ IMPORT_OBJECT_ORDINAL " ! UmsThreadInvalidInfoClass e 0 DPFLTR_WMICORE_ID �5 Win32ServiceOwnProcess ' i JobObjectReserved14Information = �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EMBEDDED + CmResourceShareShared � PowerSystemSleeping1 + �7 MaxSystemActivityModerationAppType # � CsvControlStopRedirectFile $ x0 BootEntropySourceNotPresent & $ WorkerFactoryAdjustThreadGoal $ � FileStorageTierMediaTypeSsd }" FEEDBACK_PEN_RIGHTTAP " � GroupAffinityAllGroupZero � TraceGuidQueryInfo $ � C ProcessReserved2Information $ : EtwNotificationTypeReserved � FileBasicInfo � KHeteroCpuPolicyAll 3 �/ SystemFeatureConfigurationSectionTypeCount ! � � SystemConsoleInformation % m ProcThreadAttributeUmsThread - �; PerfInfoDomainChangeEventUserCallout �# PsAlwaysDuplicate � ProcessWorkingSetWatch i _ARM_BANKED_R14_UND � m SystemStoreInformation � ThreadBasePriority � TokenOwner % SystemVaTypeMax z 3 SystemHiberFileSize � WinNtAuthoritySid � TokenPrivileges 3 � COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN �6 FixedWakeSourceRtc & � PsProtectedSignerAuthenticode � 1 MaxTokenInfoClass � RpcIncomingConnections $ J ProfileBranchMispredictions �( CpuSetInformation # = MmEtwWorkingSetTypeSession , b7 MemSectionExtendedParameterNumaNode 5 � � SystemFeatureConfigurationSectionInformation 8 ( ) MonitorRequestReasonPdcSignalWindowsMobileShell ' i JobObjectBackgroundInformation W* EtwActivityIdCreate A � PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION . � ComputerNamePhysicalDnsFullyQualified # m
ProcThreadAttributeJobList ! + FileFsControlInformation z A SystemHiberbootState + G d RtlDiskWriteConstraintPolicyNormal ( BootLoad H Compatible ProcessSignaturePolicy � COR_DELETED_NAME_LENGTH � SystemVdmBopInformation & � ImagePayloadRestrictionPolicy + � � SystemProcessorFeaturesInformation � LockQueueUnusedSpare16 e M DPFLTR_IHVDRIVER_ID $ � ProcessPooledUsageAndLimits e b DPFLTR_VDSLDR_ID # V) IoSessionEventDisconnected BootEntropySourceNone - � � SystemSecureKernelProfileInformation & z N ExitLatencySamplingPercentage �5 SC_EVENT_STATUS_CHANGE ' �= POINTER_DEVICE_CURSOR_TYPE_TIP z 9 UserPresence ! x0 BootEntropySourceSuccess - ( MonitorRequestReasonRemoteConnection �
ThreadZeroTlsCell ! 1 PoDisabledStateReserved5 ! w
PsAttributePreferredNode & � � SystemBuildVersionInformation ! � + TokenSingletonAttributes e � DPFLTR_CAPIMG_ID !# MPSAConfiguration �! STUB_CALL_SERVER $ � PlugPlayControlRetrieveDock " � � @ AccessReasonOwnership ^5 MemoryImageInformation ) � f SystemDynamicTimeZoneInformation & +
FileFsMetadataSizeInformation ! % SystemVaTypeSessionSpace 0 �+ SystemProcessClassificationSecureSystem l ObjectTypeInformation i _ARM_BANKED_R12_USR � VrfSystemBIOSRuleClass FpCodeUnspecified ) � PS_MITIGATION_OPTION_ROP_SIMEXEC � ThreadMemoryPriority � Q WinConsoleLogonSid m, PlatformRoleSOHOServer FpCodeAdd * � S WinApplicationPackageAuthoritySid ' �$ MonitorRequestTypeOnAndPresent ! � WinCreatorGroupServerSid # � SystemPagedPoolInformation 2 � h SystemProcessorMicrocodeUpdateInformation 0 i JobObjectTimerVirtualizationInformation E2 FindStreamInfoStandard / � 5 ProcessDynamicFunctionTableInformation - w PsAttributeSafeOpenPromptOriginClaim �
SidTypeLabel � ProcessorInternal FpCodeFloor i 4 _ARM_BANKED_SPSR_ABT & y9 KTMOBJECT_TRANSACTION_MANAGER / � M WinNewEnterpriseReadonlyControllersSid ? �' FileInformationInAssemblyOfAssemblyInActivationContext L BackOffice � RPCHTTP_RS_ACCESS_2 e # DPFLTR_PNPMGR_ID $ � FileStorageTierMediaTypeMax i . _ARM_BANKED_SPSR_FIQ � ProcessHandleTracing : MemoryExhaustionTypeMax % �D AlpcMessageHandleInformation ( NUM_VRF_TRIAGE_CONTEXTS 0G HAL_MCE_RECORD �" HiberFileBucketMax 30 PerfInfoMMStatMax ! �
TokenGroupsAndPrivileges z 7 ProcessorSetIdle - �$ DISPLAYCONFIG_OUTPUT_TECHNOLOGY_LVDS �! VmOfferPriorityNormal z . ProcessorInformationEx % } FileAlternateNameInformation 1 � | SystemQueryPerformanceCounterInformation � ' TokenSecurityAttributes ' DynamicTickVetoClockConstraint e > DPFLTR_W32TIME_ID
� Vmcs % }" FEEDBACK_GESTURE_PRESSANDTAP �6 PT_MOUSE O MemExtendedParameterMax ' kI MidlInterceptionInfoVersionOne } A FileRenameInformationEx � WinBuiltinPowerUsersSid % �? DPI_HOSTING_BEHAVIOR_DEFAULT * � � SystemKernelDebuggerInformationEx W StorageReserveIdMax � MaxJournalChangeAction �
ProcessLdtInformation 1 m ProcThreadAttributeMitigationAuditPolicy / ImagePolicyIdDebug + } 1 FileNetworkPhysicalNameInformation y TableInsertAsLeft �5 AdapterType 0 � FeatureConfigurationOperationResetState x0 BootEntropySourceError " � VrfCodeIntegrityRuleClass * i JobObjectSecurityLimitInformation �5 FileSystemType $ � � SystemSoftRebootInformation ( ( MonitorRequestReasonGracePeriod 5 �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_VALID_FLAGS 1 F TransactionManagerOnlineProbeInformation z + PowerRequestCreate �6 _ARM_LSL ) F TransactionManagerLogInformation #
BootEntropySourceTcbRdrand $ + FileFsSectorSizeInformation Q" FpRoundNearest !# EisaConfiguration % FilterBootOptionOperationMax " � V ProcessEnclaveInformation 6 �' AssemblyDetailedInformationInActivationContxt W StorageReserveIdHard � LockQueueMasterLock $ �8 _ARM_CPS_DISABLE_INTERRUPTS ) � PlugPlayControlQueryConflictList # �/ DPI_AWARENESS_SYSTEM_AWARE 0 2 ORIENTATION_PREFERENCE_PORTRAIT_FLIPPED # � SystemCallCountInformation # �' USER_MARSHAL_CB_UNMARSHALL } FileNameInformation / ImagePolicyIdDeviceId �- MemoryReserveTypeMax ' � SystemLoadGdiDriverInformation �* PoSleepDisableReasonMax " � + ProcessImageFileNameWin32 5 � PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE + ProcessExtensionPointDisablePolicy ) �# SeImageSignatureCatalogNotCached * � A SystemLostDelayedWriteInformation � TokenElevation � TpTraceThreadAffinity ! ) PsProtectedTypeProtected i _ARM_BANKED_LR_USR Q WaitAny " � . ThreadDbgkWerReportActive �' ObjectIdType 05 CoverageSearchByHash $ � PsCreateFailMachineMismatch V $ SysDbgClearUmAttachPid � ProcessPriorityClass � ProcessTimes # � TokenVirtualizationAllowed � PerfInfoMemResetUndo & } 3 FileIsRemoteDeviceInformation L MultiUserTS � ACPIBus # � PS_MITIGATION_OPTION_SEHOP FpCodeCeil $ � � SystemDeviceDataInformation e W DPFLTR_ISAPNP_ID � RF_CALLBACK e � DPFLTR_CNG_ID % z VerifyProcessorPowerPolicyDc ) PsProtectedTypeMax % ! SecureSettingValueTypeString 7 �D TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL � ComputerNameMax + � � SystemVmGenerationCountInformation - �W JOB_OBJECT_NET_RATE_CONTROL_DSCP_TAG � g MaxProcessInfoClass � ( WinAccountKrbtgtSid ) � � SystemWriteConstraintInformation $ � ThreadWorkloadClassGraphics e g DPFLTR_DFSC_ID # �' LoadReasonStaticDependency / i JobObjectSchedulingRankBiasInformation $ � SubsystemInformationTypeWSL � ToleranceIntervalMedium ' �' PMETypeFailFastOnCommitFailure �! VmPrefetchInformation ) � � SystemElamCertificateInformation 1 � � SystemCriticalProcessErrorLogInformation ' �* PoSleepDisableReasonHypervisor R MaxPnpQueryRelations EventSecurityMax v$ KeyAdded / � � SystemCombinePhysicalMemoryInformation " J ProfileBranchInstructions * FeatureVariantPayloadKindResident � JournalDeleteValue - CacheData � ; SystemComPlusPackage e U DPFLTR_LDR_ID �6 _ARM_LSR > MemoryLocationPagefile 8 L WorkerFactoryCallbackDetectedUnrecoverableError z ProcessorPerfStates / � SE_WS_APPX_SIGNATURE_ORIGIN_ENTERPRISE < FpCompareLess � FileDispositionInfoEx # J ProfileMemoryBarrierCycles ProcessASLRPolicy . Y) SystemMemoryPartitionInitialAddMemory ^5 MemoryRegionInformation C SYSTEM_HANDLE_FILE - F TransactionManagerLogPathInformation 2 �/ SystemFeatureConfigurationSectionTypeBoot [+ GetFileExMaxInfoLevel ( h DISPLAYCONFIG_TOPOLOGY_EXTERNAL � IoSessionStateMax � IoSessionStateLoggedOff " � EventProviderSetReserved1 ( �* DISPLAYCONFIG_PIXELFORMAT_16BPP 3 �? DISPLAYCONFIG_MODE_INFO_TYPE_DESKTOP_IMAGE � FileStreamInfo {( RtlBsdItemAabEnabled ) � 9 WinBuiltinPerfMonitoringUsersSid % � PNP_VetoIllegalDeviceRequest 0 ( * MonitorRequestReasonPdcSignalHeyCortana & FeatureVariantPayloadKindNone e � DPFLTR_DRIVEEXTENDER_ID > MemoryLocationReserved p[ MemoryRegionInfo : PerfCSwapFull $ � RtlSparseBitmapOperationMax � RF_KERNEL_DYNAMIC - � � SystemActivityModerationUserSettings , � FileStorageTierMediaTypeUnspecified e % DPFLTR_SCSERVER_ID z K PlatformRole - � SystemScrubPhysicalMemoryInformation � + ReservedForDVRF43 � SidTypeComputer ! � 3 ProcessHandleInformation / �
PlugPlayControlGetInterfaceDeviceAlias ! �$ PsWakeReasonWorkOnBehalf e 9 DPFLTR_IDEP_ID . � g WinAuthenticationAuthorityAssertedSid Q WaitDequeue $ � Z ProcessDebugAuthInformation KeyNodeInformation v LdrModulesReadyToRun �"
WdActionMarkHiberPhase } FileInternalInformation " �! VmPagePriorityInformation $ � \ SystemVerifierInformationEx % } G FileCaseSensitiveInformation " � VrfAdditionalDDIRuleClass � PowerSystemHibernate + � � SystemDifClearRuleClassInformation FpCodeCabs " � F WinWriteRestrictedCodeSid # z" EtwProviderTraitDecodeGuid # � � SystemFwRamdiskInformation } FileLinkInformation , � PS_MITIGATION_OPTION_BOTTOM_UP_ASLR ; ( ( MonitorRequestReasonPdcSignalWindowsMobilePwrNotif ! � JournalCommitTransaction � VrfAdvancedMMRuleClass " � $ VrfStandalonePlatformMode $ �* COPYFILE2_PHASE_SERVER_COPY �& LdrpWebDAV $ . DEBUG_CONTROL_SPACE_MAXIMUM ! � F SystemObjectSecurityMode + Y) SystemMemoryPartitionSetAttributes � PsProtectedSignerNone � PNPBus ! � IMAGE_COR_MIH_BASICBLOCK �
WinBatchSid z 6 ProcessorPerfCapHv / ImagePolicyIdSvn � LockQueueIoCancelLock $ } # FileAttributeTagInformation ) : EtwNotificationTypePrivateLogger � ProcessPriorityBoost �! TransactionStateNormal # � SystemInterruptInformation 1 : EtwNotificationTypeFilteredPrivateLogger � FpFormatFp32 BackTraceDatabaseFlush � MPSABus + ( MonitorRequestReasonThermalStandby V SysDbgWriteBusData * �* COPYFILE2_PHASE_WRITE_DESTINATION e ) DPFLTR_UHCD_ID � m k
t __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinUkivxlnkOlyq@elfapi � \� # �$ _KEY_VALUE_INFORMATION_CLASS �G WMI_PROCESS_INFORMATION64 $ f^ PHEAP_AFFINITY_MANAGER_ENABLE * C _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 * N5 _SYSTEM_KERNEL_DEBUGGER_INFORMATION ' e^ PCACTIVATION_CONTEXT_QUERY_INDEX K �[ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL u UINT � MENUITEMINFO <8 ALTTABINFO c^ PSYSDBG_LIVEDUMP_CONTROL b^ PXSAVE_FORMAT � ENUM_SERVICE_STATUSW a^ PGENERIC_MAPPING 7 � _RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY ! �B _RTL_UNICODE_STRING_BUFFER �8 HARDWARE_COUNTER_DATA _^ ANON_OBJECT_HEADER_BIGOBJ + o0 PERFINFO_YIELD_PROCESSOR_INFORMATION ( \^ PSYSTEM_ALARM_CALLBACK_OBJECT_ACE K _SE_AUDIT_OPERATION - [^ PSYSTEM_KERNEL_DEBUGGER_INFORMATION_EX Z^ PFILE_ID_TYPE �+ PMOUSEHOOKSTRUCT E TIMEFMT_ENUMPROCA ! �= POINTER_DEVICE_CURSOR_TYPE Y^ PFILE_PIPE_PEEK_BUFFER X^ HKEY # LPCDLGTEMPLATEA & � EVENT_HEADER_EXTENDED_DATA_ITEM PRTL_REFERENCE_COUNT32 W^ PFP_128 , �W _SYSTEM_BASIC_PERFORMANCE_INFORMATION V^ RTL_AVL_FREE_ROUTINE v AUDIT_EVENT_TYPE ( t8 LOOKUP_STREAM_FROM_CLUSTER_OUTPUT h6 HOT_PATCH_IMAGE_INFO �@ PTPP_START_ROUTINE U^ LPENUMLOGFONTA �T WCRANGE ) T^ PACCESS_DENIED_CALLBACK_OBJECT_ACE 7 S^ PIMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION X ALPC_PORT_ATTRIBUTES . �G _DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE s tagMOUSEMOVEPOINT Q^ PINPUT_INJECTION_VALUE % L> _MANAGE_HOT_PATCH_UNLOAD_PATCH , � PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA # o _QUERY_STORAGE_RESERVE_INPUT P^ PFILE_COMPRESSION_INFO O^ NPWNDCLASSEX ! �S _ETW_THREAD_AFFINITY_EVENT ' N^ PPUBLIC_OBJECT_BASIC_INFORMATION M^ PIPT_TRACE_EVENT_DATA , PCUZZWSTR / #; _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE $ L^ PSYSTEM_HANDLE_INFORMATION_EX �0 _Wx86ThreadState �S _FILE_PIPE_INFORMATION #7 _QUOTA_LIMITS $ K^ PSYSTEM_NET_RATE_CONTROL_TYPE J^ WAITORTIMERCALLBACKFUNC yA DESIGNVECTOR " PLOGICAL I^ PVRF_RULE_CLASS_ID � uint8x8x4_t G^ DISPLAYCONFIG_RATIONAL �F _ETW_HEAP_EVENT_SNAPSHOT : IMAGE_ENCLAVE_IMPORT 4 �+ _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION �2 tagMETAHEADER 0 2! tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION " PLCID ' d] SYSTEM_BOOT_GRAPHICS_INFORMATION ( W RTL_DYNAMIC_TIME_ZONE_INFORMATION _TRIVERTEX �W _PERFINFO_CC_FLUSH_CACHE #6 LPTEXTMETRICW �5 _WNF_STATE_NAME
PPVOID . _DEDUP_FILE_OPERATION E^ PETW_SET_MARK_INFORMATION ! �4 CS_TYPE_LOCAL_SIZE_ROUTINE ` MUTANT_BASIC_INFORMATION �' MENUBARINFO ) PS_PROTECTED_TYPE D^ PPLEX_READ_DATA_REQUEST ! C^ PSYSTEM_HANDLE_INFORMATION �T KEY_NAME_INFORMATION / R JOURNAL_TRANSACTION_BOUNDARY_INFORMATION " @ _RTL_HEAP_MEMORY_LIMIT_INFO �& RTL_HANDLE_TABLE_ENTRY C ENCRYPTION_BUFFER & }0 _SYSTEM_PAGEFILE_INFORMATION_EX * � _SYSTEM_VERIFIER_TRIAGE_INFORMATION �/ WMI_QUEUE + ' _PROCESS_HANDLE_SNAPSHOT_INFORMATION 3S PROCESS_INFORMATION B^ ENUMRESNAMEPROCA � PEMRSETBKMODE p PTCH + �A JOBOBJECT_EXTENDED_LIMIT_INFORMATION �9 _PROCESSOR_IDLE_STATE ?^ LPDISPLAY_DEVICE >^ PRPC_INTERFACE_TEMPLATEA
! FSHORT PSECURITY_DESCRIPTOR ; OX _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION # �, REFS_DEALLOCATE_RANGES_RANGE OS EVENT_FILTER_LEVEL_KW - �B PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE 2 �9 _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION o! OSVERSIONINFO PLANGSPEC �X _MUILANGLIST # �7 LPPROC_THREAD_ATTRIBUTE_LIST " FLONG l DUPLICATE_EXTENTS_DATA , b> _CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT =^ PKEY_TRUST_INFORMATION $ <^ PCM_DISK_GEOMETRY_DEVICE_DATA ;^ PTP_WAIT � int32x2x4_t / �C _PROCESS_READWRITEVM_LOGGING_INFORMATION � _RTL_HEAP_ENTRY " :^ PEMRCREATEDIBPATTERNBRUSHPT 9^ PIMAGE_OS2_HEADER # 8^ PKEY_HANDLE_TAGS_INFORMATION + �< CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 % 7^ PCOMPATIBILITY_CONTEXT_ELEMENT R/ _RPC_SECURITY_QOS_V4_W 6^ PETW_TP_EVENT_TIMER_SET �[ RETRIEVAL_POINTER_BASE 5^ PRID_DEVICE_INFO_HID ! �+ tagINPUT_MESSAGE_ORIGIN_ID 4^ PIMAGE_DOS_HEADER �] IMAGE_OS2_HEADER 3^ LPCONNECTDLGSTRUCT � KHETERO_CPU_POLICY UD EMRSTROKEPATH � _TP_CALLBACK_PRIORITY �6 TP_WAIT 2^ LPSHELLHOOKINFO $ 4 ETW_CREATEDELETE_OBJECT_EVENT
q NWPSTR �[ _RETRIEVAL_POINTER_BASE 1^ PSYSTEM_ALARM_OBJECT_ACE �/ LPOSVERSIONINFOW �9 VIDEO_RECORD �] _IMAGE_OS2_HEADER ) LPPATTERN �- PEMRPOLYLINE ^U ICONMETRICSW $ �B _PERFINFO_CC_WORKITEM_DEQUEUE * 0^ PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER � _SECTION_INHERIT ( /^ PCREDIRECTION_FUNCTION_DESCRIPTOR .^ PSERVICE_NOTIFY_2W $ -^ PETW_COVERAGE_SAMPLER_OPTIONS ,^ PRTLP_START_THREAD
Y _LDR_IMPORT_CALLBACK_INFO V _SECURITY_SEED_AND_LENGTH " <1 _PROCESS_WINDOW_INFORMATION �X LPWNDCLASSEXA ! *^ LPSERVICE_FAILURE_ACTIONSA . )^ PPLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA " OUTLINETEXTMETRIC 2 ,- JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 3 �0 SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION �& LPCONTEXT ' � EVENT_TRACE_SPINLOCK_INFORMATION (^ PSYSTEM_VDM_INSTEMUL_INFO bS NPEXTLOGFONTA �; _MMPFN_IDENTITY ) '^ PACTIVATION_CONTEXT_NOTIFY_ROUTINE $^ HICON & #^ PPROCESS_POWER_THROTTLING_STATE * �U _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY & � FILE_FS_DRIVER_PATH_INFORMATION ' !^ DISPLAYCONFIG_DESKTOP_IMAGE_INFO + D/ SERVICE_CONTROL_STATUS_REASON_PARAMS ^ PMESSAGE_TRACE_HEADER ZG _cpinfoexA �Z _WMI_WAIT_OBJECT_RECORD ^ PKINTERRUPT_ROUTINE y _RTL_DYNAMIC_HASH_TABLE �0 LPICONMETRICSA �$ STYLEBUFA �" _WATCHDOG_HANDLER_ACTION ' �[ RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR " HANDLE_PTR U _RTL_MODULE_EXTENDED_INFO 3 �E SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE ^ PHKEY �0 LPPROCESS_HEAP_ENTRY 5 ^ PPROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY 75 EISA_MEMORY_CONFIGURATION �0 OBJECT_TYPE_LIST ) M[ _SYSTEM_PREFETCH_PATCH_INFORMATION ) ^ PRTL_DYNAMIC_HASH_TABLE_ENUMERATOR - �5 SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 % ^ PSYSTEM_OBJECTTYPE_INFORMATION 6 tagTITLEBARINFO � _STRING64 5B _PROCESS_PRIORITY_CLASS �C _MCA_EXCEPTION HA NPSTYLEBUFW ^ PRTL_AVL_MATCH_FUNCTION ' X _PERFINFO_SAMPLED_PROFILE_CONFIG �" _SECURITY_DESCRIPTOR & �D _ALPC_MESSAGE_INFORMATION_CLASS F" _FILE_STREAM_INFORMATION
' TRACE_LOGFILE_HEADER32
p PSZ ^ PETW_OBJECT_TYPE_EVENT ^ PSID_IDENTIFIER_AUTHORITY ' [5 LOOKUP_STREAM_FROM_CLUSTER_INPUT �U _KTMOBJECT_CURSOR % JZ RTL_USER_PROCESS_INFORMATION64 " GEOTYPE �E _CONSOLE_CURSOR_INFO " � PERFINFO_DEBUG_EVENT_REASON >- _CM_MONITOR_DEVICE_DATA ! ^ PPERFINFO_MARK_INFORMATION V) IO_SESSION_EVENT �- HW_PROFILE_INFO ^ PTHREAD_BASIC_INFORMATION ) � SYSTEM_VERIFIER_TRIAGE_INFORMATION - SYSTEMTIME ) �F _WIM_PROVIDER_REMOVE_OVERLAY_INPUT ^ PSL_HWID_DEVICE_INFO e CRITICAL_SECTION_DEBUG ^ PISID | WIN32_FIND_DATA <( PEMRPOLYLINE16 ^ PMUILANGLISTNODE
^ PTRACE_GUID_REGISTRATION ^ PMESSAGE_TRACE ! ^ PEMREXTCREATEFONTINDIRECTW
^ PEVENT_DATA_DESCRIPTOR % ^ PPROCESS_DEVICEMAP_INFORMATION / y+ _PROCESS_REVOKE_FILE_HANDLES_INFORMATION ^ PVRF_TRIAGE_CONTEXT � ACTCTXA ^ PETW_HEAP_EVENT_COMMON �& PCONTEXT . ^ PFILE_DESIRED_STORAGE_CLASS_INFORMATION �G PLUGPLAY_NOTIFY_HDR ^ POSVERSIONINFO >( EMRPOLYBEZIERTO16 �% PERFINFO_CCSWAP_IDLE :\ _FILE_STORAGE_TIER A �\ _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC ^ LPLC_ID ) �U IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY ^ PFIND_BY_SID_OUTPUT - �D STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST ^ PRTL_DYNAMIC_HASH_TABLE R* NPPOLYTEXTA * �! _RTL_ACTIVATION_CONTEXT_STACK_FRAME " ;R _ADMINISTRATOR_POWER_POLICY . ^ PMEMORY_PARTITION_ATTRIBUTE_INFORMATION $ ^ PTRACE_ENABLE_FLAG_EXT_HEADER ? _BOOT_AREA_INFO �+ LPPOWER_REQUEST_CONTEXT 4 �G _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE " �< CLAIM_SECURITY_ATTRIBUTE_V1 2 �] PPROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION $ " SYSTEM_FIRMWARE_TABLE_HANDLER �] PIO_RESOURCE_DESCRIPTOR �1 LPGLYPHMETRICSFLOAT b STREAM_EXTENT_ENTRY ! A _TXFS_QUERY_RM_INFORMATION i _JOBOBJECTINFOCLASS �] PPERFORMANCE_DATA % �] PFILE_FS_ATTRIBUTE_INFORMATION L _COMMTIMEOUTS $ �& _FILE_ID_FULL_DIR_INFORMATION SHANDLE_PTR �] PKLDR_DATA_TABLE_ENTRY tU STARTUPINFOEX 0 �] PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE �] HPALETTE__ | WIN32_FIND_DATAA oX VALENTW % $% _SERVICE_LAUNCH_PROTECTED_INFO �] POBJECT_ATTRIBUTES32 KIRQL ! �B JOURNAL_CLIENT_INFORMATION �] WNDPROC &8 _IMAGE_AUX_SYMBOL_EX - �] PJOBOBJECT_LIMIT_VIOLATION_INFORMATION * �D _SYSTEM_PROCESSOR_POWER_INFORMATION ! �T _RTL_TIME_ZONE_INFORMATION M$ _ETW_UMGL_KEY D PWINDOWPOS � _TRACE_LOGFILE_HEADER64 �] PCACCESS_MASK �] PSD_ENUM_SDS_ENTRY �* REPARSE_GUID_DATA_BUFFER ; �] PRTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY QZ LPBITMAPFILEHEADER " �] PETW_TIMER_EXPIRATION_EVENT $ , ETW_SESSION_NOTIFICATION_TYPE & �Y _FSCTL_QUERY_REGION_INFO_OUTPUT �Y _SYSDBG_TRIAGE_DUMP " X> RTL_IMAGE_MITIGATION_POLICY 'V _PERFINFO_MARK_EVENT ? LUID_AND_ATTRIBUTES_ARRAY . �] PMEMORY_PARTITION_NODE_PAGE_INFORMATION % �] PKEY_VALUE_PARTIAL_INFORMATION - LPOSVERSIONINFOEX2W G 9. _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING " �] PCACTCTX_SECTION_KEYED_DATA �5 WMI_PNP_RECORD_V4 $ �@ _SILOOBJECT_BASIC_INFORMATION �] LPMEMORYSTATUSEX �] PRPC_SEC_CONTEXT_KEY_INFO ) � _RESOURCEMANAGER_INFORMATION_CLASS u+ MDINEXTMENU " �Y ETW_COVERAGE_SAMPLER_STATUS �] PCACTCTXW * U SYSTEM_FEATURE_CONFIGURATION_UPDATE �' OFSTRUCT � _OVERLAPPED_ENTRY r' HELPWININFOW G MUIREGISTRYINFO & �= _ACTIVATION_CONTEXT_QUERY_INDEX r _WMI_THREAD_INFORMATION 0 �] PIMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER �/ EMRTRANSPARENTBLT I] LPHARDWAREINPUT �] PCOVERAGE_MODULE_INFO �] PRTL_SPARSE_BITMAP_RANGE ) �] PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT �] PEMRTRANSPARENTBLT �( tagMEASUREITEMSTRUCT , E _EVENT_TRACE_PROFILE_LIST_INFORMATION $ �9 _SYSTEM_TIMEOFDAY_INFORMATION % �] PNTPSS_MEMORY_BULK_INFORMATION " POINTER_INPUT_TYPE �V PAGEDIR_INFORMATION ) �] PEVENT_EXTENDED_ITEM_STACK_TRACE64 �] PHEAP_SUMMARY ! �V PS_BNO_ISOLATION_PARAMETER ' �: REMOTE_LINK_TRACKING_INFORMATION �] PPO_WAKE_SOURCE_DEVICE m, _POWER_PLATFORM_ROLE �C PORT_INFORMATION_CLASS d" LPPAINTSTRUCT ' PT _PROCESS_LEAP_SECOND_INFORMATION 2 �] PPROCESS_MITIGATION_BINARY_SIGNATURE_POLICY XV SUPPORTED_OS_INFO �- _MEMORY_RESERVE_TYPE 0 �] PJOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 �U _REPARSE_INDEX_KEY ) �] PRTL_FEATURE_ENABLED_STATE_OPTIONS @/ CI_WINDOWS_LOCKDOWN_MODE $ �Y FILE_FS_ATTRIBUTE_INFORMATION tagENUMLOGFONTW ( d] _SYSTEM_BOOT_GRAPHICS_INFORMATION ( �] PEVENT_EXTENDED_ITEM_PMC_COUNTERS " �] PPERFINFO_IDLE_STATE_CHANGE D �! _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED $ tagLOCALESIGNATURE |; PLOGPALETTE �1 MINMAXINFO P IMEMENUITEMINFOA handle_t 4 I _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION �" PERFINFO_CCSWAP_BUFFER TS _NEON128 �] PCSV_MGMT_LOCK 1 �D _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX ( �] PRTL_FEATURE_CONFIGURATION_UPDATE �] PMCA_EXCEPTION �] PRTL_HASH_TABLE X< tagEMRFILLRGN $ �S FILE_FS_FULL_SIZE_INFORMATION $ jV PERFINFO_SET_POWER_ACTION_RET )B MUILANGINFO $ �V PROCESS_MITIGATION_DEP_POLICY & THREAD_ENERGY_VALUES ' S _FILE_END_OF_FILE_INFORMATION_EX �R _PORT_VIEW g PBITMAPCOREHEADER � FIBER 1 �] PPLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED y TABLE_SEARCH_RESULT ) 0 SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT �] PRTL_RVA_LIST d' RTL_CRITICAL_SECTION ' �: _HEAP_BLOCK_SETTABLE_INFORMATION �] LPENCLAVE_ROUTINE �\ PPALETTEENTRY " L! _BY_HANDLE_FILE_INFORMATION �T BLENDFUNCTION �] NOTIFICATIONCALLBACK �] HWINSTA f tagENHMETAHEADER �% _SYSTEM_POOL_ENTRY ' �] PCACTCTX_SECTION_KEYED_DATA_2600 x RPC_SECURITY_QOS_V2_W �] LPSTYLEBUF �] PIMAGE_DEBUG_MISC $ � _SYSTEM_NET_RATE_CONTROL_TYPE � DIBSECTION ' �< _PROCESS_HANDLE_TABLE_ENTRY_INFO �] LPCOMMCONFIG �] PEMRALPHABLEND <V MONITORINFOEXW * &R _PROCESS_EXTENDED_BASIC_INFORMATION % k _TRANSACTION_BASIC_INFORMATION �] LPAXESLIST �] EXCEPTION_ROUTINE �] PTP_LOG_ROUTINE u DWORD32 " �Z ENCLAVE_INIT_INFO_VBS_BASIC 8 �] PASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_ROUTINE �9 tagBITMAP �9 TRACKMOUSEEVENT � _MIDL_METHOD_PROPERTY # E0 FILE_SFIO_VOLUME_INFORMATION �] PKTMOBJECT_TYPE + 0; _EVENT_TRACE_PERFORMANCE_INFORMATION � _PROCESSINFOCLASS �' _PROCESS_EXCEPTION_PORT �E ETW_HEAP_EVENT_FREE k _PORT_MESSAGE ) �] PSYSTEM_POWER_STATE_DISABLE_REASON , � SYSTEM_PROCESSOR_FEATURES_INFORMATION ) / _SYSTEM_PROCESSOR_IDLE_INFORMATION bS PEXTLOGFONTA �] LANGGROUPLOCALE_ENUMPROCW 63 _ACL ) P PERFINFO_FILENAME_SAME_INFORMATION �] PUIMAGE_OS2_HEADER / �6 _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION @ PEMRABORTPATH % �F _IMAGE_LOAD_CONFIG_DIRECTORY64 �# _OBJECT_NAME_INFORMATION I+ _RTL_BITMAP ) � CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG % _TRANSACTION_INFORMATION_CLASS E tagHW_PROFILE_INFOW �] PEMRPOLYDRAW16 �] LPCDLGTEMPLATE �] PCSV_QUERY_MDS_PATH �Y PMSGBOXPARAMSW " _! _PERFINFO_CCSWAP_IDLE_SHORT �] PWMI_TRACE_PACKET # �] PTOKEN_SECURITY_ATTRIBUTE_V1 5 _HARDERROR_MSG % �] PGET_RUNTIME_FUNCTION_CALLBACK Q" FP_IEEE_ROUNDING_MODE �( CPU_SET_INFORMATION_TYPE �] PEVENTSFORLOGFILE �] LPCLIENTCREATESTRUCT + �U JOBOBJECT_IO_ATTRIBUTION_INFORMATION \@ _RTL_HEAP_INFORMATION & �, PUBLIC_OBJECT_BASIC_INFORMATION ( �] PDELAYLOAD_FAILURE_SYSTEM_ROUTINE + �] PCSV_QUERY_FILE_REVISION_FILE_ID_128 �] PGESTUREINFO �* PEXTLOGPEN32 � TEB_ACTIVE_FRAME , _CM_PARTIAL_RESOURCE_LIST " �] RTL_GENERIC_COMPARE_ROUTINE :- _FINDEX_INFO_LEVELS x@ RTL_RXACT_CONTEXT # �] PETW_COVERAGE_SAMPLER_SAMPLE /3 _SYSTEM_ALARM_ACE `0 ENUMLOGFONTEXDVW �] HPALETTE �' _ICONINFOEXW - S _FILE_FS_PERSISTENT_VOLUME_INFORMATION 7V PEMRRECTANGLE �R PORT_VIEW # X> _RTL_IMAGE_MITIGATION_POLICY �' _FILE_ID_TYPE �" tagENUMTEXTMETRICW �] PWNODE_METHOD_ITEM ! � _RPC_HTTP_REDIRECTOR_STAGE �] PAUDIT_EVENT_TYPE > CM_EXTENDED_PARAMETER �] PLOAD_ASDATA_TABLE �] PEXCEPTION_RECORD32 ' �] PFILE_END_OF_FILE_INFORMATION_EX � PSE_TOKEN_USER } _UNICODE_STRING �Z PEMREXCLUDECLIPRECT " �] PPPM_PERFSTATE_DOMAIN_EVENT �$ APPCONTAINER_SID_TYPE �] LPCMENUITEMINFO DB CI_LOG_MMCSS_START � tagGESTURENOTIFYSTRUCT =; EVENT_INSTANCE_HEADER K; FILE_LAYOUT_NAME_ENTRY �] PTP_TASK_CALLBACKS ETW_BUFFER_STATE �S IMAGE_IMPORT_BY_NAME \ _NON_PAGED_DEBUG_INFO " SAVEPOINT_ID tagRAWMOUSE * ] RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W �F _CI_LOG_SCHEDULER_WAKEUP 0 tagNCCALCSIZE_PARAMS �Z WMI_WAIT_OBJECT_RECORD � _SYSTEM_VERIFIER_ISSUE { WIN32_FIND_DATAW �] LPTTPOLYCURVE �] PKEY_EVENT_RECORD �V TOKEN_LINKED_TOKEN " C _POWER_PLATFORM_INFORMATION 4 �C SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION �\ STUB_THUNK tT tagINPUT_MESSAGE_SOURCE �? _SYSTEM_BASIC_INFORMATION @ PEMRENDPATH �; _COVERAGE_SECTION_HEADER ! �B tagTOUCH_HIT_TESTING_INPUT POOLINDEX �5 _WMI_PNP_RECORD_V4 �5 _SYSTEM_NUMA_INFORMATION � FILE_INFO_BY_HANDLE_CLASS TRIVERTEX �] PEMRSETWORLDTRANSFORM �1 _ETW_STACK_CACHING_CONFIG �] PTOKEN_ELEVATION_TYPE U _TOKEN_PRIVILEGES �] PFAT_STATISTICS
u( PPOINT �8 _POINTFLOAT �* tagDRAWITEMSTRUCT 3 �@ _IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION �] PWNF_DELIVERY_DESCRIPTOR & �] PPROCESS_EXTENDED_ENERGY_VALUES ( RTL_FEATURE_ENABLED_STATE_OPTIONS yY PIMEMENUITEMINFOW ; TIMEFMT_ENUMPROCEX # �] PETW_KERNEL_HEADER_EXTENSION ) OB _SYSTEM_ENTROPY_TIMING_INFORMATION h? PDLGITEMTEMPLATEW HA PSTYLEBUFW 9& CSV_QUERY_REDIRECT_STATE " gY RTL_ALLOCATE_STRING_ROUTINE �] LPNETINFOSTRUCT XZ _RGNDATAHEADER �D LPNONCLIENTMETRICSA 3U ETW_WNF_EVENT_PUBLISH ! �@ _WIN32_FILE_ATTRIBUTE_DATA �] SC_HANDLE $ }B _WIM_PROVIDER_START_INTEGRITY �4 NPWNDCLASSA �W _TOKEN_CONTROL $ �] RTL_UMS_SCHEDULER_ENTRY_POINT y? EVENT_TRACE $ 7 RPC_BINDING_HANDLE_OPTIONS_V1 " �% ACCESS_ALLOWED_CALLBACK_ACE �G TOKEN_PRIMARY_GROUP ' A4 FILE_REMOTE_PROTOCOL_INFORMATION � _SYSTEM_POWER_POLICY % SYSTEM_VA_TYPE / JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V1 �3 _FILE_REGION_OUTPUT �] PIRQ_GROUP_POLICY kR tagEMRRESIZEPALETTE . �] PEVENT_EXTENDED_ITEM_RELATED_ACTIVITYID ! �] PPROCESS_BASIC_INFORMATION �] PFILE_FULL_EA_INFORMATION Z# WMI_BUFFER_HEADER / �S _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA - �] PCACTIVATION_CONTEXT_BASIC_INFORMATION = tagCBT_CREATEWNDA RPC_BINDING_HANDLE $ �] PPERFINFO_PAGE_RANGE_IDENTITY �] PHIBERFILE_BUCKET_SIZE �+ MOUSEHOOKSTRUCT �T WNF_DELIVERY_DESCRIPTOR B _IMAGE_FUNCTION_ENTRY64 $ �] PCONSOLE_SCREEN_BUFFER_INFOEX �# tagWNODE_TOO_SMALL , �] PSYSTEM_HYPERVISOR_DETAIL_INFORMATION � KCRM_PROTOCOL_BLOB >( EMRPOLYGON16 - _SYSTEMTIME T EVENT_RECORD ( F5 EVENT_TRACE_IPT_EVENT_INFORMATION ] PENCLAVE_INIT_INFO_VBS ~] PRPC_SECURITY_QOS_V3_A �Z _WMI_RESOURCE $ }] PDEFINE_STORAGE_RESERVE_INPUT $ G _SharedVirtualDiskHandleState * FAT_STATISTICS b' LPCRITICAL_SECTION_DEBUG |] PMIDL_STUB_DESC LRESULT $ tagENUMLOGFONTEXDVA ;= EMREXTCREATEPEN �= PS_CPU_QUOTA_QUERY_ENTRY �# PS_STD_HANDLE_STATE {] PEMREXTSELECTCLIPRGN ! �R _KEY_SET_LAYER_INFORMATION # z] PBAD_MEMORY_CALLBACK_ROUTINE �2 tagCIEXYZ lE tagPOLYTEXTW x] PUSAGE_PROPERTIES oZ GROUP_RELATIONSHIP ^6 _SYSTEM_PREFETCH_STATS w] LPNLSVERSIONINFO RG _DECRYPTION_STATUS_BUFFER v] PPOWER_MONITOR_INVOCATION $ u] PETW_TP_EVENT_TIMER_CANCELLED �E MALLOC_FREE_STRUCT ) t] PEVENT_EXTENDED_ITEM_STACK_TRACE32 * s] PFILE_PIPE_CLIENT_PROCESS_BUFFER_EX %Y PFN_NT_COMMIT_TRANSACTION �2 CBT_CREATEWNDW �B LDR_DATA_TABLE_ENTRY32 " � _SUBSYSTEM_INFORMATION_TYPE r] PREQUESTER_TYPE yX PLOGBRUSH32 ) �V _STREAMS_ASSOCIATE_ID_INPUT_BUFFER . q] PRTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS P% _XSTATE_FEATURE 3 �# SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION " �G I_RpcProxyCallbackInterface � _LUTF8_STRING % �- COVERAGE_UNLOADED_MODULE_ENTRY p] PWMIREGINFOW K RTL_CIRCULAR_LIST_ENTRY $ 4 _ETW_UMS_EVENT_CONTEXT_SWITCH , ', _JOURNAL_SET_KEY_SECURITY_INFORMATION o] PIMAGE_EXPORT_DIRECTORY % @ SYSTEM_CPU_SET_TAG_INFORMATION INT64 ' �R RTL_IMAGE_MITIGATION_HEAP_POLICY , n] PEVENT_TRACE_HEAP_TRACING_INFORMATION H ALPC_SERVER_INFORMATION I �@ ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING �' tagMENUBARINFO �% PCOMPOSITIONFORM / ( IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER �$ _RTL_AVL_TABLE # V@ _COMPOUND_ACCESS_ALLOWED_ACE / + _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 - � SECURE_SPECULATION_CONTROL_INFORMATION $5 CREATE_THREAD_DEBUG_INFO ;G HENHMETAFILE__ �9 WMI_DISKIO_FLUSH_BUFFERS =9 PROCESS_JOB_MEMORY_INFO " t IMAGE_ARCHIVE_MEMBER_HEADER m] PLUID_AND_ATTRIBUTES dU _CSV_MGMT_LOCK . 6 _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA $ R _PROCESS_AFFINITY_UPDATE_MODE l] PBULK_SECURITY_TEST_DATA 1 �4 _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY ( OB SYSTEM_ENTROPY_TIMING_INFORMATION ) i] PPROCESS_CHILD_PROCESS_INFORMATION �, LPLOGPEN % h] PIMAGE_DYNAMIC_RELOCATION64_V2 �3 _PATHNAME_BUFFER " �% _UNIQUE_PROCESS_INFORMATION & 2? _FILE_PIPE_CREATE_SYMLINK_INPUT ] PEMRDRAWESCAPE ( g] PRPC_BINDING_HANDLE_TEMPLATE_V1_W f] PWMI_IMAGEID_INFORMATION & PSECURITY_CONTEXT_TRACKING_MODE ' ) _QUERY_PERFORMANCE_COUNTER_FLAGS ( b] PSYSTEM_BOOT_GRAPHICS_INFORMATION " `] PRTL_QUERY_REGISTRY_ROUTINE � PPOINTS �1 tagMINMAXINFO LSTATUS �! poly8x16x3_t /W POWER_SESSION_CONNECT ! _] PTP_TASK_UNPOSTED_CALLBACK yA tagDESIGNVECTOR # �T _FILE_FS_CONTROL_INFORMATION A ^] PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC ' �> EVENT_EXTENDED_ITEM_PMC_COUNTERS ]] PREMOTE_PORT_VIEW � EMRSETTEXTALIGN > _WMI_UDP % )9 _ETW_TP_EVENT_TIMER_EXPIRATION # �D PERFINFO_DOMAIN_CHANGE_EVENT " KSPIN_LOCK $ ENUMLOGFONTEXDVA ) S _FILE_PIPE_EVENT_ENUM_INPUT_BUFFER #W SL_KMEM_CACHE \] RPC_IF_CALLBACK_FN !D _LBR_TRACE_EVENT_DATA [] PPEB $ Z] PTRANSACTION_LIST_INFORMATION [ _XSAVE_FORMAT ! -X FILE_ZERO_DATA_INFORMATION �= tagENUMUILANG _ int32x4x2_t �B tagEMRALPHABLEND ! �* _HEAP_AFFINITY_SLOT_ASSIGN 'V PERFINFO_MARK_EVENT �W USAGE_PROPERTIES Y] LPNUMBERFMTA �> _MEMORY_BASIC_INFORMATION r, _SERVICE_NOTIFY_2A " 2@ ETW_KERNEL_HEADER_EXTENSION X] PPS_PROTECTED_TYPE �0 IMAGE_FILE_HEADER SZ GENERIC_MAPPING i JOBOBJECTINFOCLASS r _SERVERSILO_STATE W] PPPM_WMI_IDLE_STATES_EX & �/ _ETW_AUTOBOOST_NO_ENTRIES_EVENT �: _KAFFINITY_EX % V] PPROCESS_FOREGROUND_BACKGROUND PROCESS_DISK_COUNTERS dX _FILE_REFERENCE_RANGE �U PS_STD_HANDLE_INFO �U GLYPHMETRICS � DEBUGHOOKINFO U] PSYSTEM_TPM_INFORMATION T] PENABLE_TRACE_PARAMETERS LC FILE_OBJECTID_INFORMATION & S] PSYSTEM_HANDLE_TABLE_ENTRY_INFO 2 Z TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT i _ARMINTR_BANKED_REG " �; _JOBOBJECT_WAKE_INFORMATION $ R] PRTL_RETPOLINE_CHECK_FUNCTION 3 �, PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION $ Q] PRTLP_HEAP_SERIALIZED_MAPPING �= PSFEATURE_OUTPUT �( CREATESTRUCTW P] GEO_ENUMNAMEPROC M] PETW_REGNOTIF_REGISTER ! L] PETW_IDEAL_PROCESSOR_EVENT y: PERFINFO_PROCESS_PERFCTR K] LPSTARTUPINFOEXA . PFN_SC_NOTIFY_CALLBACK A7 tagTTPOLYCURVE % �& _PERFINFO_PPM_IDLE_STATE_ENTER J] PSTRING I] PHARDWAREINPUT " H] PJOURNAL_CLIENT_INFORMATION ( �- _FILE_NOTIFY_EXTENDED_INFORMATION & �U _RTL_PROCESS_BACKTRACES_CONTROL ' �1 _RTLP_PROCESS_REFLECTION_CONTEXT t PINT
p PCH " O' FILE_COMPLETION_INFORMATION " G] LDR_MANIFEST_PROBER_ROUTINE 7/ POWER_MONITOR_INVOCATION �> LPPIXELFORMATDESCRIPTOR & F] PETW_TP_EVENT_TIMER_SET_NTTIMER * E] PSYSTEM_VERIFIER_FAULTS_INFORMATION D] PIMAGE_ENCLAVE_CONFIG32 7? LDR_VERIFY_IMAGE_INFO ? C] PACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA ! B] PREPARSE_POINT_INFORMATION ) �C SYSTEM_VERIFIER_FAULTS_INFORMATION nY ATOM_TABLE_INFORMATION A] PWNF_TYPE_ID ) r> PFN_RTL_IS_NTDDI_VERSION_AVAILABLE # �< _CLAIM_SECURITY_ATTRIBUTE_V1 w _PS_ATTRIBUTE_NUM X LPDLGTEMPLATEA �E POWER_REQUEST_TYPE @] PRTL_BSD_ITEM_TYPE DY RPC_SEC_CONTEXT_KEY_INFO ) ?] PPERFINFO_DYNAMIC_TICK_VETO_REASON �* tagKBDLLHOOKSTRUCT >] PPOWER_SESSION_RIT_STATE �? PO_WAKE_SOURCE_INTERNAL ! �S EMRCREATEDIBPATTERNBRUSHPT " _. ETW_OPTICALIO_FLUSH_BUFFERS ! � UNICODE_PREFIX_TABLE_ENTRY , RGNDATA �@ DISCDLGSTRUCTA =] PRPC_SECURITY_QOS_V2_A ) <] PETW_COVERAGE_SAMPLER_BLOOM_FILTER " PULONG_PTR 4 ;] PSYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION ) �G _EVENT_EXTENDED_ITEM_STACK_TRACE64 & _THREAD_ENERGY_VALUES
.) DCB �+ ENUMLOGFONTEX l6 _NETRESOURCEW $ 7 _FILE_FS_OBJECTID_INFORMATION :] PRTL_UMS_SCHEDULER_REASON �? SMALL_RECT 9] PPOWER_REQUEST_TYPE ) 6] PFN_NT_SET_INFORMATION_TRANSACTION �[ IMAGE_POLICY_ENTRY Y PFIBER_CALLOUT_ROUTINE * 3] LPSERVICE_REQUIRED_PRIVILEGES_INFOW �W IMAGE_DATA_DIRECTORY " 2] PMEMORY_COMBINE_INFORMATION " 1] PREQUEST_RAW_ENCRYPTED_DATA ) 0] PPERFINFO_VIRTUAL_ALLOC_XPARTITION # /] PTOKEN_GROUPS_AND_PRIVILEGES �E _FILE_ID_BOTH_DIR_INFO ,] PFILE_REFERENCE_RANGE + �V SYSTEM_PROCESS_INFORMATION_EXTENSION > _BOOT_RECORD 4; HEAP_INFORMATION_ITEM * +] PCFINDFIRSTACTIVATIONCONTEXTSECTION � MULTIKEYHELPA - _JOBOBJECT_LIMIT_VIOLATION_INFORMATION $ [X _SYSTEM_LOOKASIDE_INFORMATION - �5 JOURNAL_SET_KEY_USER_FLAGS_INFORMATION wX _PERFINFO_VAD_ROTATE_INFO + �A EVENT_TRACE_HEAP_TRACING_INFORMATION �? PKCRM_TRANSACTION_BLOB u rsize_t $ HARDERROR_RESPONSE $ �F IMAGE_LOAD_CONFIG_DIRECTORY64 A3 FINDEX_SEARCH_OPS + q6 _SYSTEM_DMA_GUARD_POLICY_INFORMATION A _PERFINFO_PO_PRESLEEP ) )] PSYSTEM_REGISTRY_QUOTA_INFORMATION (] LPLOAD_DLL_DEBUG_INFO �R PABCFLOAT � LOGICAL_DISK_EXTENTS `S THREAD_PERFORMANCE_DATA �) LPMULTIKEYHELPW " '] PENTER_STATE_NOTIFY_HANDLER �4 GENERATE_NAME_CONTEXT �@ PERFORMANCE_DATA GG EMRMODIFYWORLDTRANSFORM % &] PFILE_SFIO_RESERVE_INFORMATION & �G _SL_KMEM_CACHE_VALUE_DESCRIPTOR TX _VCN_RANGE_INPUT_BUFFER
`$ LPSIZE %] LPEXTLOGFONT H* ALPC_MESSAGE_ATTRIBUTES w _FILE_GET_EA_INFORMATION COVERAGE_MODULES �" ENUMTEXTMETRICW $] PQUERY_BAD_RANGES_OUTPUT � _SHUFFLE_FILE_DATA #] PLIST_ENTRY64 <Z PACKEDEVENTINFO & "] PWIM_PROVIDER_CONTROL_INTEGRITY !] LPPROGRESS_ROUTINE � PAXISINFOA 0E PEMRSTROKEANDFILLPATH # ] PSHARED_VIRTUAL_DISK_SUPPORT % 2? FILE_PIPE_CREATE_SYMLINK_INPUT ! (7 QUERY_SERVICE_LOCK_STATUSA & � _PERFINFO_PPM_IDLE_EXIT_LATENCY 5 ] PPROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY � _CSV_NAMESPACE_INFO , ] PSYSTEM_PROCESS_INFORMATION_EXTENSION ] PMESSAGE_RESOURCE_ENTRY �$ _PS_WAKE_REASON # Y) _PARTITION_INFORMATION_CLASS $ f0 _KEY_OPEN_SUBKEYS_INFORMATION ] PSYSTEM_ALARM_ACE $ �) _PROCESS_HANDLE_TRACING_QUERY �S _NTFS_STATISTICS EISA_DMA_CONFIGURATION ] PEMREXTESCAPE & ] PFILE_ATTRIBUTE_TAG_INFORMATION ] PSYSDBG_BUS_DATA ] PTOKEN_USER �- tagHW_PROFILE_INFOA ] LPWNDCLASS # �" _PERFINFO_SYSCALL_ENTER_DATA �@ KEY_VALUE_ENTRY & B2 _ETW_WNF_EVENT_NAME_SUB_RUNDOWN �+ REASON_CONTEXT C tagEMRGLSBOUNDEDRECORD XV _SUPPORTED_OS_INFO % ] PUMS_SYSTEM_THREAD_INFORMATION & ] PPERFINFO_SET_DEVICES_STATE_RET ] PSL_APPX_CACHE �, ETW_TP_EVENT_POOL_CREATE ' U, FILE_METADATA_OPTIMIZATION_STATE ! � _HARDERROR_RESPONSE_OPTION & ] RTLP_UNHANDLED_EXCEPTION_FILTER PUMS_CONTEXT - ES FILE_NETWORK_PHYSICAL_NAME_INFORMATION �* TIMEFMT_ENUMPROCW � _WMI_WAIT_SINGLE # �- _FILE_LINK_ENTRY_INFORMATION # [X SYSTEM_LOOKASIDE_INFORMATION ] PEVENT_RECORD_CALLBACK & ] PCIMAGE_BOUND_IMPORT_DESCRIPTOR �U _IO_STATUS_BLOCK
] PWOF_EXTERNAL_INFO ]; USER_ACTIVITY_PRESENCE , ] PPLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA _ RTL_HASH_BUCKET_TYPE ] PATOM_TABLE_INFORMATION ~9 CM_FLOPPY_DEVICE_DATA ' � JOURNAL_CHANGE_INFORMATION_CLASS " DWORD_PTR -
] PSYSTEM_ISOLATED_USER_MODE_INFORMATION �+ POWER_REQUEST_CONTEXT �[ PLAYERPLANEDESCRIPTOR �9 tagNEWTEXTMETRICEXW tG CPU_CONFIG_RECORD & YU _SYSTEM_PROCESS_TRUST_LABEL_ACE * ACCESS_REASONS "V _EXCEPTION_RECORD32 LCSGAMUTMATCH �< PMODEMSETTINGS ( F5 EVENT_TRACE_LBR_EVENT_INFORMATION ' b; _ETW_COVERAGE_SAMPLER_PERF_STATS ] LPFILTERKEYS ! tA IMAGE_DYNAMIC_RELOCATION64 ] PTIME_FIELDS T0 LPEXCEPTION_RECORD !B RPC_SECURITY_QOS_V5_A �R _ACCESS_DENIED_ACE A _COMSTAT T* POLYTEXT �S SE_ACCESS_REPLY * n> JOBOBJECT_ASSOCIATE_COMPLETION_PORT $ ] PHEAP_AFFINITY_SLOT_ACTIVATED $ ] PETW_TP_EVENT_POOL_TH_MAX_SET � _MESSAGE_RESOURCE_BLOCK ] PRTL_PROCESS_BACKTRACES �B _OBJECT_TYPES_INFORMATION �! _RPC_STRING �Y DL_EUI48 $ � _PERFINFO_PPM_IDLE_STATE_EXIT ! �E _FILE_FULL_DIR_INFORMATION �/ _MEMORY_WORKING_SET_BLOCK ] PHEAP_INFORMATION_ITEM �9 _VIDEO_RECORD # n< JOBOBJECT_JOBSET_INFORMATION ] PWNODE_HEADER
t LONG32 ] PPROCESSOR_RELATIONSHIP , 1$ KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 , �( EVENT_EXTENDED_ITEM_PROCESS_START_KEY 19 ETW_OPTICALIO_INIT � FILE_EA_INFORMATION R& HELPINFO % ] PWORKER_FACTORY_CALLBACK_CLASS � _RTL_HASH_TABLE i> RTL_RETPOLINE_BINARY_INFO u( NPPOINT � APP_MEMORY_INFORMATION ] PRPC_ENDPOINT_TEMPLATEW , �W CLAIM_SECURITY_ATTRIBUTES_INFORMATION / OV _FILE_PROCESS_IDS_USING_FILE_INFORMATION ? PPELARRAY
R _MESSAGE_TRACE �\ PWOF_VERSION_INFO �\ PNLSTABLEINFO �\ PWMI_PNP_RECORD_V5 �\ PIMAGE_SYMBOL # �W _ENCLAVE_LOAD_DATA_VBS_BASIC �9 TRACE_LOGFILE_HEADER ( �\ PPERFINFO_MEMORY_NODE_INFORMATION gE _WMI_LOGGER_INFORMATION �$ float32x4x4_t # ,2 _SHRINK_VOLUME_REQUEST_TYPES �\ DISPLAYCONFIG_SOURCE_MODE & �Z _FILE_STANDARD_LINK_INFORMATION $ �\ APPLICATION_RECOVERY_CALLBACK LEARNING_MODE_LOG_LEVEL " �\ PSYSTEM_POOLTAG_INFORMATION LANGINDEX * $ DIALOG_CONTROL_DPI_CHANGE_BEHAVIORS % �\ PSYSTEM_ACPI_AUDIT_INFORMATION U& LPWNDCLASSW # �$ ETW_COVERAGE_SAMPLER_OPTIONS ( U, _FILE_METADATA_OPTIMIZATION_STATE �\ LPCONNECTDLGSTRUCTW �! uint16x8x3_t ! �" FILE_ALIGNMENT_INFORMATION wX PERFINFO_VAD_ROTATE_INFO X6 tagCBTACTIVATESTRUCT ) �! JOBOBJECT_INTERFERENCE_INFORMATION �4 tagDRAWTEXTPARAMS l6 NETRESOURCEW # �\ PPROCESS_WORKING_SET_CONTROL �\ PHEAP_RANGE_INFORMATION VG RIP_INFO % ! PROCESS_POWER_THROTTLING_STATE �$ poly16x8x4_t � int16x4x4_t , �Y SYSTEM_FIRMWARE_PARTITION_INFORMATION ! �B tagUPDATELAYEREDWINDOWINFO �) _ETW_RT_EVENT_LOSS . #+ _MEMORY_PHYSICAL_CONTIGUITY_INFORMATION �2 tagCBT_CREATEWNDW _V PORT_DATA_ENTRY 9 _COVERAGE_MODULE_REQUEST �! ICONINFOEXA ( >W _PROCESS_DEVICEMAP_INFORMATION_EX �( EVENT_INFORMATION_CLASS #W _SL_KMEM_CACHE �\ PCIMAGE_POLICY_ENTRY ! � SUBSYSTEM_INFORMATION_TYPE !X tagAUDIODESCRIPTION l SERVICE_FAILURE_ACTIONS # V _IMAGE_RESOURCE_DIR_STRING_U �C _PORT_INFORMATION_CLASS 0 � JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL " �\ PTXFS_GET_METADATA_INFO_OUT �* PO_SLEEP_DISABLE_REASON - WNF_DLLUNLOAD_CALLBACK � tagPOINTS @D LPEVENTMSGMSG � EMRSETBKMODE �\ LPNCCALCSIZE_PARAMS �\ PSERVICE_TIMECHANGE_INFO � _SYSTEM_INFORMATION_CLASS . �\ PJOBOBJECT_NET_RATE_CONTROL_INFORMATION % � PO_CS_DEVICE_NOTIFICATION_TYPE ! 6 _EVENTLOG_FULL_INFORMATION �< tagENUMLOGFONTA ) qE _SERVICE_REQUIRED_PRIVILEGES_INFOA �\ PRTL_RXACT_CONTEXT �$ TOKEN_TYPE " L _ETW_FINALIZE_KTIMER2_EVENT # � DELETE_STORAGE_RESERVE_INPUT �\ PKEY_FLAGS_INFORMATION �\ PCACTIVATION_CONTEXT " PUCSSTR HD SINGLE_LIST_ENTRY32 a" QUERY_FILE_LAYOUT_OUTPUT @ �\ RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC �\ HMETAFILE $ 7 _ETW_PROCESS_HANDLE_INFO_TYPE ! �\ PCPS_SYSTEM_DLL_INIT_BLOCK 1 �\ PSYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION FZ SEC_WINNT_AUTH_IDENTITY_W & { CI_LOG_SCHEDULER_SLEEP_RESPONSE & �+ _PERFINFO_FILE_SIMPLE_OPERATION
� PUWSTR �\ PUSN_RECORD_V3 ' J@ TIMER_SET_COALESCABLE_TIMER_INFO % FU _SYSTEM_OBJECTTYPE_INFORMATION �\ PFILE_LINKS_INFORMATION + �\ PSYSTEM_SYSTEM_PARTITION_INFORMATION �V tagHARDWAREHOOKSTRUCT �R PEMREXTTEXTOUTW :\ FILE_STORAGE_TIER �D LPAXESLISTA ) �\ PETW_UMS_EVENT_DIRECTED_SWITCH_END � SYSTEM_AUDIT_CALLBACK_ACE = m7 PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION $ �= _SYSTEM_INTERRUPT_INFORMATION �\ PEVENT_FILTER_LEVEL_KW , ]1 _TRANSACTIONMANAGER_BASIC_INFORMATION " COLORREF EA INPUT_RECORD # �\ PETW_COVERAGE_SAMPLER_STATUS ) �\ PFILE_PIPE_EVENT_ENUM_INPUT_BUFFER �\ PUSER_ACTIVITY_PRESENCE KV _SYSTEM_WORKINGSET_ENTRY ' �\ PBOOT_ENTROPY_SOURCE_RESULT_CODE $ � IMAGE_DYNAMIC_RELOCATION64_V2 �\ PRPC_SYNTAX_IDENTIFIER �! __n128x3 RTL_FEATURE_VARIANT ' x0 _BOOT_ENTROPY_SOURCE_RESULT_CODE �+ _OSVERSIONINFOEXW ! �\ PFILE_INTERNAL_INFORMATION �\ PSYSTEM_POWER_STATE " O: _SYSTEM_POOLTAG_INFORMATION $ �W IMAGE_BOUND_IMPORT_DESCRIPTOR �' PROCESS_EXCEPTION_PORT $ �\ PFILE_ID_FULL_DIR_INFORMATION T1 PCTCH 3 d2 PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION * �\ PTRANSACTIONMANAGER_LOG_INFORMATION ' �\ I_RpcProxyGetConnectionTimeoutFn ! L! BY_HANDLE_FILE_INFORMATION " '" _SYSTEM_MANDATORY_LABEL_ACE �\ PCPU_SET_INFORMATION_TYPE " �[ PROCESSOR_POWER_INFORMATION * �6 SYSTEM_ELAM_CERTIFICATE_INFORMATION # V CM_DISK_GEOMETRY_DEVICE_DATA � _RTL_QUERY_REGISTRY_TABLE �\ PSTRING64 # �\ PIMAGE_ARCHIVE_MEMBER_HEADER ( .! _LDR_DLL_LOADED_NOTIFICATION_DATA �R RTL_HEAP_WALK_ENTRY 4 �\ PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V1 ! �\ PSTARTING_VCN_INPUT_BUFFER � IRQ_DEVICE_POLICY 3- _IMAGE_CHPE_RANGE_ENTRY $ �D _RTL_PROCESS_VERIFIER_OPTIONS 6 5 _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION �\ ENUMRESNAMEPROCW � TRACE_GUID_INFO KPRIORITY �\ PTOKEN_TYPE |R _KEY_LAYER_INFORMATION
�\ _Ea �S PRAWHID K9 WMI_TXR �\ POBJECT_TYPE_INFORMATION " �\ PSYSTEM_MEMORY_LIST_COMMAND ! g _SEC_WINNT_AUTH_IDENTITY_A K2 CACHE_DESCRIPTOR $ �8 _SYSTEM_BOOT_LOGO_INFORMATION \R _RDR_CALLOUT_STATE ( �W JOB_OBJECT_NET_RATE_CONTROL_FLAGS & � _CM_PARTIAL_RESOURCE_DESCRIPTOR B _CONNECTDLGSTRUCTA �\ PMIDL_SERVER_INFO �\ PVM_COUNTERS " _RTL_HEAP_MEMORY_LIMIT_DATA �2 NPMSG & h4 _PERFINFO_CC_LOGGED_STREAM_INFO �\ LPSERVICE_DESCRIPTIONA , �\ PPERFINFO_CLOCK_INTERRUPT_INFORMATION �? IO_RESOURCE_LIST �\ PMUILANGUAGES x7 NPIMECHARPOSITION 2 �\ PEVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION & AU _TOKEN_APPCONTAINER_INFORMATION ~( _RTL_BSD_ITEM , F5 EVENT_TRACE_PROFILE_EVENT_INFORMATION & � LEAP_SECOND_DATA_REGISTRY_ENTRY $ � _RTL_CRITICAL_SECTION_DEBUG32 � SHUFFLE_FILE_DATA - �\ JOBOBJECT_NET_RATE_CONTROL_INFORMATION '( _POWER_USER_PRESENCE # RTL_FEATURE_CHANGE_STAMP ( �\ PSYSTEM_ACTIVITY_MODERATION_STATE " D. _OPERATION_START_PARAMETERS o@ AR_STATE ! �\ PPERFINFO_WORKINGSET_ENTRY � SYSTEM_POWER_STATE # S RTLP_HEAP_SERIALIZED_MAPPING % H OBJECT_HANDLE_FLAG_INFORMATION + / _SYSTEM_HYPERVISOR_QUERY_INFORMATION �\ ENUMRESTYPEPROCW $ ^G _ETW_PARTITION_INFO_EXTENSION
�\ PUQUAD /W _POWER_SESSION_CONNECT % v _PROCESS_WORKING_SET_OPERATION LIST_ENTRY32 - �\ PFILE_FS_PERSISTENT_VOLUME_INFORMATION F- NPDEBUGHOOKINFO �\ ANON_OBJECT_HEADER : RTL_RESOURCE �\ PEXTLOGFONT # �\ PSD_CHANGE_MACHINE_SID_INPUT 3 �\ PMEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION �\ FONTENUMPROC �@ _ETW_SET_KTIMER2_EVENT ( U[ PIMAGE_ARM_RUNTIME_FUNCTION_ENTRY �\ LPPALETTEENTRY �2 _IMAGE_NT_HEADERS64 " �\ PSYSTEM_VA_LIST_INFORMATION �\ PRTL_ENUM_HEAPS_ROUTINE �\ PDECRYPTION_STATUS_BUFFER �\ PTP_IO_CALLBACK �\ PEMRTEXT �\ PTOKEN_PRIMARY_GROUP �\ PPSINJECTDATA �\ MSGBOXCALLBACK - �< JOBOBJECT_BASIC_ACCOUNTING_INFORMATION c1 tagCOLORADJUSTMENT t5 PERFINFO_MEM_RESET_INFO ! �\ PFSCTL_OFFLOAD_READ_OUTPUT ) PATTERN @ PEMRBEGINPATH �* KBDLLHOOKSTRUCT �S NT_TIB32
T tagMENUGETOBJECTINFO �\ PRTL_RVA_LIST_ITERATOR $ � _ENUM_SERVICE_STATUS_PROCESSA �& RPC_VERSION ENUMLOGFONTW � PEMRPOLYPOLYGON �\ LPSOUNDSENTRY ! �V _PERFINFO_MARK_INFORMATION �\ SC_NOTIFICATION_CALLBACK �\ PWNODE_EVENT_REFERENCE . �\ PEVENT_TRACE_POOLTAG_FILTER_INFORMATION 0 �\ PSYSTEM_VERIFIER_CANCELLATION_INFORMATION \ UMS_SCHEDULER_REASON * PBITMAPV4HEADER KS POUTLINETEXTMETRICA % �! _FILE_FS_DATA_COPY_INFORMATION `W IMAGE_SYMBOL $ �\ PFILE_STORAGE_TIER_MEDIA_TYPE a# _RPC_SECURITY_QOS_V3_W �\ PPERFINFO_DPC_INFORMATION �\ PFILESYSTEM_STATISTICS_EX �F SYSTEM_ALARM_OBJECT_ACE �C RTL_PROCESS_BACKTRACES IX PRAWKEYBOARD � RPC_ADDRESS_CHANGE_FN % � _SYSTEM_RESOURCE_ATTRIBUTE_ACE �$ _PEBS_DS_SAVE_AREA �\ PCFOUR_PART_VERSION �\ GEO_ENUMPROC -Y LPIMEMENUITEMINFOA . �5 _SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 �\ PATOM_BASIC_INFORMATION 6+ RTL_UNLOAD_EVENT_TRACE �T tagRAWINPUTHEADER , �" _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY _PROCESS_DISK_COUNTERS �; LOGPALETTE >( tagEMRPOLYLINE16 �A PNEWTEXTMETRICA �\ ABORTPROC ' E4 _PERFINFO_PO_SESSION_CALLOUT_RET # POWER_SESSION_TIMEOUTS " �. _SYSTEM_BASIC_INFORMATION64 �\ PEMRSETPALETTEENTRIES 3 � SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT 7 �\ PRTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY GEOID # _CSVFS_DISK_CONNECTIVITY ! @F _STORAGE_RESERVE_AREA_INFO �\ DPI_AWARENESS_CONTEXT �\ OLDFONTENUMPROCA �# _VIDEOPARAMETERS �# ENUM_SERVICE_STATUS a< ETW_BUFFER_CONTEXT �\ XMIT_HELPER_ROUTINE , `* _PERFINFO_SAMPLED_PROFILE_INFORMATION ' _2 _SYSTEM_MEMORY_USAGE_INFORMATION � PEMRSETLAYOUT & T9 _PROCESS_EXTENDED_ENERGY_VALUES �> _EVENT_HEADER r/ PERFINFO_TRACE_HEADER \ PNON_PAGED_DEBUG_INFO ! ~\ PSYSTEM_THREAD_INFORMATION � TP_CALLBACK_INSTANCE }\ RPC_OBJECT_INQ_FN *
V _SYSTEM_MEMORY_TOPOLOGY_INFORMATION U5 LPCOMPAREITEMSTRUCT % {T PLUGPLAY_CONTROL_CONFLICT_DATA = NETRESOURCE 7 _FULL_PTR_XLAT_TABLES E _TXFS_LIST_TRANSACTIONS % W _EXTENT_READ_CACHE_INFO_BUFFER E$ NUMA_NODE_RELATIONSHIP {\ PEVENT_CALLBACK " z\ PFILE_ZERO_DATA_INFORMATION & �Z _PROCESS_CYCLE_TIME_INFORMATION $ y\ PPROCESS_AFFINITY_UPDATE_MODE , �6 _FILE_IOSTATUSBLOCK_RANGE_INFORMATION & x\ PFILE_PROVIDER_EXTERNAL_INFO_V1 7 T. _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY ! �( SYSTEM_BIGPOOL_INFORMATION % w\ PPLUGPLAY_CONTROL_INSTALL_DATA v\ LPENUMLOGFONTEX <( PEMRPOLYBEZIER16 # u\ PKEY_VALUE_BASIC_INFORMATION �T LPRAWINPUTHEADER % t\ LPENUM_SERVICE_STATUS_PROCESSW ! s\ PWMI_IMAGELOAD_INFORMATION �[ _RTL_RVA_LIST }+ ETW_SET_TIMER_EVENT r\ PCONTEXT_CHUNK �? IMAGE_TLS_DIRECTORY64 % q\ PIO_RESOURCE_REQUIREMENTS_LIST p\ PCRAWINPUTDEVICE # oV EVENT_EXTENDED_ITEM_INSTANCE # �4 SERVERSILO_BASIC_INFORMATION ' n\ PPS_MITIGATION_AUDIT_OPTIONS_MAP u< XSTATE_CONTEXT 2 �% JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION $ w& tagPOINTER_BUTTON_CHANGE_TYPE + CM_SHARE_DISPOSITION & m\ PRTL_DISK_WRITE_CONSTRAINT_INFO l\ ICMENUMPROCA j\ PWNODE_ALL_DATA # � _PERFINFO_DEBUG_EVENT_REASON +V FILE_END_OF_FILE_INFO i\ LPMETAFILEPICT ' �% TXFS_READ_BACKUP_INFORMATION_OUT h\ PXSTATE_FEATURE g\ REGISTERWORDENUMPROCW d\ PUNWIND_HISTORY_TABLE c\ PMUTANT_OWNER_INFORMATION MENUTEMPLATEW b\ LPWNDCLASSEX ( LY PERFINFO_CONTIGUOUS_PAGE_GENERATE �Y _HV_DETAILS ! a\ PHEAP_EXTENDED_INFORMATION �/ tagEMRSELECTPALETTE `\ PRTL_TREE_WALK_FUNCTION �* _KEY_EVENT_RECORD �% pvalueW �@ DISCDLGSTRUCT & � SERVICE_DELAYED_AUTO_START_INFO _\ PETW_CLOCK_TIME_UPDATE * �1 _PROCESS_COMMIT_RELEASE_INFORMATION ^\ PVALENT & ^T SYSTEM_ACTIVITY_MODERATION_INFO % �T _PROCESS_FOREGROUND_BACKGROUND ( �< PERFINFO_KERNELMEMORY_RANGE_USAGE & �W FILE_DISPOSITION_INFORMATION_EX # �X ENLISTMENT_BASIC_INFORMATION tU _STARTUPINFOEXA �= FILE_ALL_INFORMATION ) ]\ PMEMORY_PARTITION_NODE_INFORMATION �2 _DMA_CONFIGURATION_BYTE1 ( Z\ PPROCESS_DEVICEMAP_INFORMATION_EX Y\ PWNF_STATE_NAME_LIFETIME $ ^$ _PERFINFO_PPM_STATE_SELECTION ) W _RTL_IMAGE_MITIGATION_SEHOP_POLICY $ �& _RTL_CRITICAL_SECTION_DEBUG64
�A PSIZEL LCSCSTYPE X\ PETW_CLOSE_HANDLE_EVENT $ W\ RTL_REALLOCATE_STRING_ROUTINE �> tagDROPSTRUCT ], XSAVE_CET_U_FORMAT 0 V\ PEVENT_TRACE_COVERAGE_SAMPLER_INFORMATION �) UNICODE_STRING32 "? _PRIVILEGE_SET ( ACTIVATION_CONTEXT_STACK . v _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY U\ PENUMTEXTMETRIC # G SD_CHANGE_MACHINE_SID_OUTPUT T\ PIMAGE_NT_HEADERS * �0 SYSTEM_WRITE_CONSTRAINT_INFORMATION S PEXTLOGPEN - tagRECONVERTSTRING <7 HEAP_EVENT_RANGE " m/ _PERFINFO_MEMORY_NODE_ENTRY ! �U _REPARSE_POINT_INFORMATION % O LOGICAL_PROCESSOR_RELATIONSHIP �' EMRPOLYTEXTOUTW ) D PERFINFO_PO_CALIBRATED_PERFCOUNTER � EMRSETROP2 �Y SYSDBG_TRIAGE_DUMP S\ PTRACE_GUID_PROPERTIES # R\ PPERFINFO_SYSCALL_ENTER_DATA ! � _RTL_FEATURE_ENABLED_STATE �E _OPTICAL_MEDIA_RECORD - Q\ PSYSTEM_FIRMWARE_PARTITION_INFORMATION �= EVENT_FILTER_EVENT_ID # P\ PIMAGE_RESOURCE_DIR_STRING_U 0 �C RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY `D NEWTEXTMETRICEX ! O\ PTOUCHPREDICTIONPARAMETERS LONG_PTR �( _TOKEN_DEVICE_CLAIMS ! * TXFS_SAVEPOINT_INFORMATION # N\ PPROCESSOR_POWER_INFORMATION " �D PLUGPLAY_CONTROL_DEPTH_DATA M\ LPSYSTEM_POWER_STATUS � tagHIGHCONTRASTW L\ PETW_KQUEUE_ENQUEUE_EVENT * K\ PACCESS_ALLOWED_CALLBACK_OBJECT_ACE % �( _TIME_DYNAMIC_ZONE_INFORMATION ! I\ DISPLAYCONFIG_ADAPTER_NAME F\ PEMRPLGBLT �+ CLIENT_CALL_RETURN �; ACL_REVISION_INFORMATION E\ PMEMORY_RESERVE_TYPE / X, _FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT �- tagNONCLIENTMETRICSW D\ PETW_WAKE_COUNTER_EVENT / C\ PJOBOBJECT_EXTENDED_LIMIT_INFORMATION_V1 y. PALPC_HANDLE_ATTR32 B\ PREASON_BUFFER A\ RTL_AVL_MATCH_FUNCTION % @\ PPERFINFO_CC_WORKITEM_COMPLETE �< _EVENT_TRACE_LOGFILEA LANGNAMEINDEX ?\ HRSRC >\ PCWNF_TYPE_ID =\ EDITWORDBREAKPROCA �E IMAGE_POLICY_METADATA + _ETW_HEAP_EVENT_CREATE ( �" _PERFINFO_CC_EXTRA_WB_THREAD_INFO
�/ CURDIR ! LC _FILE_OBJECTID_INFORMATION " ( PROCESS_WORKING_SET_CONTROL $ <\ PCM_EISA_FUNCTION_INFORMATION �C _FILE_ALLOCATION_INFO ! 8 _WINDOW_BUFFER_SIZE_RECORD � _IO_RESOURCE_DESCRIPTOR ' �X _ETW_ANTI_STARVATION_BOOST_EVENT * �Z PROCESS_SECURITY_DOMAIN_INFORMATION � EMRSETICMMODE 8\ PFILE_STORAGE_TIER ( 7\ PWORKER_FACTORY_BASIC_INFORMATION 6\ LPSYSTEM_INFO � UNIVERSAL_NAME_INFOW �3 RPC_ADDRESS_CHANGE_TYPE 1 �) _EVENT_TRACE_IPT_CONFIGURATION_INFORMATION & 5\ PETW_COVERAGE_SAMPLER_PERF_INFO u PUINT_PTR 4\ PIMAGE_TLS_DIRECTORY64 ' �: MEMORY_SHARED_COMMIT_INFORMATION y PEMRPOLYPOLYLINE16 ! �# _SECURITY_OBJECT_AI_PARAMS < _EVENT_DATA_DESCRIPTOR * �# _PERFINFO_HARDPAGEFAULT_INFORMATION . �A JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V1 4 tagEXTLOGPEN32 # 2\ PIMAGE_DYNAMIC_RELOCATION_V2 1\ PREFS_VOLUME_DATA_BUFFER 1 �C _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY $ �D _CONSOLE_SCREEN_BUFFER_INFOEX 0\ PPROVIDER �Y HV_DETAILS , 27 MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES & /\ PRTL_USER_PROCESS_INFORMATION64 ! ATOM .\ PEMROFFSETCLIPRGN + -\ PFILE_LINK_ENTRY_FULL_ID_INFORMATION + ,\ PSYSTEM_BOOT_ENVIRONMENT_INFORMATION * 3 SYSTEM_KERNEL_VA_SHADOW_INFORMATION # �G ETW_CLOCK_STATE_CHANGE_EVENT * +\ PPERFINFO_SYSTEM_MEMORY_INFORMATION ' *\ PSTORAGE_RESERVE_AREA_DEFINITION + �0 _TRANSACTION_ENLISTMENTS_INFORMATION )\ PTP_WIN32_IO_CALLBACK 2 ORIENTATION_PREFERENCE / �4 SYSTEM_VERIFIER_CANCELLATION_INFORMATION ! �- QUERY_SERVICE_LOCK_STATUSW � SERVICE_NOTIFYW & {T _PLUGPLAY_CONTROL_CONFLICT_DATA %\ PEMREOF �$ _CI_LOG_SCHEDULER_EVENT 4 $\ PSYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE �X MUILANGLIST $ #\ PRTL_USER_PROCESS_INFORMATION "\ LPPOLYTEXT
>T PEB � INTERFACE_TYPE �G _PLUGPLAY_NOTIFY_HDR �Z LPBITMAPCOREINFO !\ PSC_NOTIFICATION_CALLBACK �7 MENU_EVENT_RECORD \ PUSN_RECORD_EXTENT \ _Reparse ( \ PMEMORY_SHARED_COMMIT_INFORMATION , \ PSYSTEM_LOGICAL_PROCESSOR_INFORMATION \ PETW_OPTICALIO_INIT � _CSV_CONTROL_PARAM % _REFS_SMR_VOLUME_GC_PARAMETERS \ PLDR_DLL_LOAD_REASON + \ PEVENT_TRACE_SPINLOCK_INFORMATION_V1 �U _IMAGE_RELOCATION � _VRF_RULE_CLASS_ID 2
? SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION ( \ PACTIVATION_CONTEXT_ASSEMBLY_DATA $ \ PTRACE_PROVIDER_INSTANCE_INFO \ PNDR_ASYNC_MESSAGE $ J& _QUERY_BAD_RANGES_INPUT_RANGE _FIRMWARE_TYPE ]E ETW_UMS_EVENT_PARK AV _SID % �Z FILE_STANDARD_LINK_INFORMATION % &U WIM_PROVIDER_ADD_OVERLAY_INPUT % �( _SYSTEM_CALL_COUNT_INFORMATION �$ uint64x2x4_t % �U KEY_VIRTUALIZATION_INFORMATION � FIXED \ PAR_STATE " �W ENCLAVE_LOAD_DATA_VBS_BASIC �8 tagCOMBOBOXINFO \ LPSERVICE_DESCRIPTION " ULONG_PTR % \ PEVENT_EXTENDED_ITEM_EVENT_KEY + < _ALPC_PORT_ASSOCIATE_COMPLETION_PORT ) �[ _EVENT_EXTENDED_ITEM_STACK_TRACE32 - \ PPERFINFO_PFMAPPED_SECTION_INFORMATION � _LUNICODE_STRING �X _CSV_IS_OWNED_BY_CSVFS . \ PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION $ =$ ETW_TP_EVENT_CALLBACK_DEQUEUE '
\ PETW_SESSION_NOTIFICATION_PACKET *6 tagWINDOWPLACEMENT $ wY _FILE_STANDARD_INFORMATION_EX ) \ PTXFS_ROLLFORWARD_REDO_INFORMATION \ PCSV_IS_OWNED_BY_CSVFS \ NON_PAGED_DEBUG_INFO " \ PMEMORY_BASIC_INFORMATION64 % \ PQUERY_BAD_RANGES_OUTPUT_RANGE % \ PEXTENT_READ_CACHE_INFO_BUFFER ! �& _ENCRYPTION_KEY_CTRL_INPUT + S4 _REFS_DEALLOCATE_RANGES_INPUT_BUFFER ! \ PSECURE_SETTING_VALUE_TYPE \ PRTL_UNLOAD_EVENT_TRACE64 3 \ PCLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE \ PALPC_SERVER_INFORMATION
\ PFNFTH ! _SECTION_INFORMATION_CLASS �[ I_RpcPerformCalloutFn ' %0 _TOKEN_BNO_ISOLATION_INFORMATION �E _POWER_REQUEST_TYPE & _LDR_ENUM_RESOURCE_ENTRY f: FSCTL_OFFLOAD_READ_OUTPUT % �[ PSYSTEM_GDI_DRIVER_INFORMATION �0 _MUILANGUAGES u PULONG32 # �V _PS_BNO_ISOLATION_PARAMETERS ! a ALPC_WORK_ON_BEHALF_TICKET i+ _WAKE_TIMER_INFO � PUWSTR_C �[ PEVENT_RECORD R0 PROCESS_WAKE_FILTER i< tagENUMLOGFONTEXW , � _LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION XZ RGNDATAHEADER INT16 �[ PWRITE_USN_REASON_INPUT + �' SYSTEM_HYPERVISOR_DETAIL_INFORMATION �[ PRTL_TRACE_DATABASE �T _SCRUB_PARITY_EXTENT C CFG_CALL_TARGET_INFO ) �C _PERFINFO_VIRTUAL_ALLOC_XPARTITION �F PERFINFO_FLT_OPERATION �[ PTP_CLEANUP_GROUP @D PEVENTMSG # �[ RTL_HEAP_STACK_WRITE_ROUTINE �9 NDR_USER_MARSHAL_INFO " PUCSCHAR ! �[ I_RpcProxyIsValidMachineFn 4 TTPOLYGONHEADER �[ PROPENUMPROCW �' _NDR_CS_ROUTINES �. _MAXVERSIONTESTED_INFO �= tagFONTSIGNATURE �[ PSD_GLOBAL_CHANGE_OUTPUT - � _MEMORY_PARTITION_TRANSFER_INFORMATION Z _ALPC_WORK_ON_BEHALF_ATTR # i1 SYSTEM_HIBERFILE_INFORMATION �[ LPCSCROLLINFO �[ HRAWINPUT ! �[ PFILE_QUERY_SPARING_BUFFER �> tagEMREXTFLOODFILL $ �[ PEVENT_EXTENDED_ITEM_INSTANCE & C JOBOBJECT_ENERGY_TRACKING_STATE �[ PIO_SESSION_CONNECT_INFO & bY _WIM_PROVIDER_CONTROL_INTEGRITY % �- _PO_HIBER_FORCE_DISABLE_REASON + �[ PMEM_SECTION_EXTENDED_PARAMETER_TYPE U LPTITLEBARINFO # �[ PSEMAPHORE_BASIC_INFORMATION % 7 _RPC_BINDING_HANDLE_OPTIONS_V1 �[ PWMI_IDE_CHANNEL_RECORD 9 �[ PPROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION 6 �[ PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY �[ PPLUGPLAY_APC_ROUTINE . PLOGBRUSH yY LPIMEMENUITEMINFOW ( �[ _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR �< IMAGE_FUNCTION_ENTRY �9 PBITMAP �[ PKLDR_DATA_TABLE_ENTRY32 �( tagCREATESTRUCTW � DATEFMT_ENUMPROCEXW � _MUTANT_OWNER_INFORMATION VT HTOUCHINPUT__ � _RTL_BALANCED_NODE oZ _GROUP_RELATIONSHIP �! EMRWIDENPATH " �[ PFILE_NUMA_NODE_INFORMATION # �[ PSYSTEM_VHD_BOOT_INFORMATION ]Z _CM_PCCARD_DEVICE_DATA �[ _IMAGE_POLICY_ENTRY �5 _FILE_NAMES_INFORMATION �= _PSFEATURE_OUTPUT " fR DRIVER_VERIFIER_THUNK_PAIRS �7 TIME_FIELDS ' �[ PSYSTEM_ACTIVITY_MODERATION_INFO �R tagRGBQUAD ! COLOR16 ( �B _PERFINFO_DRIVER_COMPLETE_REQUEST , �[ PPERFINFO_DRIVER_COMPLETE_REQUEST_RET # S RTL_WORK_ON_BEHALF_TICKET_EX T LPHANDLE
+ CREATESTRUCT �[ PIMAGE_VXD_HEADER � PROCESSINFOCLASS ( � FILE_FS_METADATA_SIZE_INFORMATION �* TP_TIMER " CALTYPE �[ PKHETERO_CPU_POLICY �[ IELF_HANDLE % �[ PSYSTEM_SECUREBOOT_INFORMATION = CBT_CREATEWND + F TRANSACTIONMANAGER_INFORMATION_CLASS
� STRING �! RPC_STRING p PCHAR �[ PMOVE_FILE_RECORD_DATA 4 �[ PRTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY " � TXFS_GET_TRANSACTED_VERSION l' _SD_GLOBAL_CHANGE_OUTPUT �[ LPENCLAVE_TARGET_FUNCTION �8 _WMI_PUSHLOCK ) � _RTL_PROCESS_BACKTRACE_INFORMATION 2 = SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION �[ PRETRIEVAL_POINTER_BASE �[ PPO_WAKE_SOURCE_HEADER 1 ENCLAVE_CREATE_INFO_VBS � FILE_BASIC_INFO �[ PDLL_INIT_ROUTINE ! n2 _WMI_DISKIO_READWRITE_INIT & �[ PSL_APPX_CACHE_VALUE_DESCRIPTOR ! �( PRTL_UMS_THREAD_INFO_CLASS �# RTL_CRITICAL_SECTION32 � _DEVICE_POWER_STATE B: _MULTI_TIME $ �[ PJOBOBJECT_JOBSET_INFORMATION % �[ PPROCESS_ENERGY_TRACKING_STATE + �[ PRPC_HTTP_TRANSPORT_CREDENTIALS_V2_W �[ PWMI_FILE_IO ) D PETW_COVERAGE_SAMPLER_OPTION_FLAGS ) �[ PGET_FILTER_FILE_IDENTIFIER_OUTPUT # �[ PPROCESS_SESSION_INFORMATION " �[ PFSCTL_OFFLOAD_WRITE_OUTPUT & �) _PERFINFO_PPM_PERF_STATE_CHANGE # q7 _PERFINFO_MEMORY_INFORMATION R[ OBJECT_TYPE_INFORMATION i SYSTEM_BIGPOOL_ENTRY �R WINSTAENUMPROCW 8 /: _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION ) �[ PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX /+ PEMRSETBRUSHORGEX �[ PETW_RT_EVENT_LOSS 6 �[ JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 ) �[ PSTREAMS_ASSOCIATE_ID_INPUT_BUFFER ( )5 SYSTEM_POWER_STATE_DISABLE_REASON �3 EMRFRAMERGN : _PERFINFO_FILE_CREATE � RTL_HEAP_ENTRY .) _DCB . �[ PFILE_NETWORK_PHYSICAL_NAME_INFORMATION . �[ PTRANSACTIONMANAGER_LOGPATH_INFORMATION �# _ENUM_SERVICE_STATUSA 2. _RTL_BALANCED_LINKS �[ LPEXIT_THREAD_DEBUG_INFO �! int16x8x3_t �8 _NTFS_STATISTICS_EX 7 jD _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION F _EVENTSFORLOGFILE �[ LPLAYERPLANEDESCRIPTOR �$ NPREGISTERWORDA , PCUWCHAR ' A$ _SYSTEM_DPC_BEHAVIOR_INFORMATION $ �[ PKEY_OPEN_SUBKEYS_INFORMATION 1 �[ PEVENT_TRACE_LBR_CONFIGURATION_INFORMATION �. NPDEVMODEA � _GUID # �[ _PROCESSOR_POWER_INFORMATION % �[ PINVERTED_FUNCTION_TABLE_ENTRY �A _EVENT_FILTER_DESCRIPTOR �[ PKLDR_DATA_TABLE_ENTRY64 ' �F _IO_COMPLETION_INFORMATION_CLASS �[ PETW_CANCEL_KTIMER2_EVENT ! �; _PERFINFO_PO_NOTIFY_DEVICE ) �? _JOBOBJECT_CONTAINER_IDENTIFIER_V2 & FILE_DISPOSITION_INFO_EX " EV ETW_COVERAGE_SAMPLER_SAMPLE �R PALTTABINFO b: _CM_SERIAL_DEVICE_DATA F& INIT_ONCE �[ LPAUDIODESCRIPTION �Z PWMI_DISKIO_FLUSH_BUFFERS !B _RPC_SECURITY_QOS_V5_A : �! RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME �' EMRPOLYTEXTOUTA �" PROCESS_LEAP_SECOND_INFO �[ PEMRRESTOREDC L SUITE_TYPE 4 tagBITMAPINFO p LPCH ! aC PO_SPR_ACTIVE_SESSION_DATA % �[ PSYSDBG_LIVEDUMP_CONTROL_FLAGS ; FILE_STORAGE_INFO �0 PROCESS_HEAP_ENTRY � STARTUPINFOA O* MDICREATESTRUCTA float32x2x2_t Z SID_AND_ATTRIBUTES_HASH ! �% CM_EXTENDED_PARAMETER_TYPE �[ PTP_DIRECT_CALLBACK �[ PIO_STATUS_BLOCK ) �[ PFILE_ID_GLOBAL_TX_DIR_INFORMATION , CM_PARTIAL_RESOURCE_LIST �G TP_POOL_STACK_INFORMATION RPC_INTERFACE_GROUP ! �[ PPERFINFO_SET_POWER_ACTION $ �) _PERFINFO_FILE_PATH_OPERATION B _FILE_MODE_INFORMATION 1S LPPROCESS_INFORMATION f@ UUID_VECTOR �S NETCONNECTINFOSTRUCT �& _SPARSE_OVERALLOCATE_DATA �B HTASK__ �Q tagEMRMASKBLT ) h5 KEY_SET_VIRTUALIZATION_INFORMATION ! 75 _EISA_MEMORY_CONFIGURATION �W LPRID_DEVICE_INFO � _LARGE_INTEGER ) & WIM_PROVIDER_SUSPEND_OVERLAY_INPUT `B _SYSDBG_BUS_DATA & �[ PMANAGE_HOT_PATCH_QUERY_PATCHES ! �W SYSTEM_POWER_LOGGING_ENTRY J �[ ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL - �[ PFSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER " �[ PSE_PACKAGE_CAPABILITY_INFO � EMRCOLORCORRECTPALETTE % �[ _PIMAGE_RUNTIME_FUNCTION_ENTRY I, _TOKEN_ELEVATION_TYPE G _WNF_DATA_SCOPE " 3C MANAGE_HOT_PATCH_LOAD_PATCH ( �[ EVENT_EXTENDED_ITEM_STACK_TRACE32 V SECURITY_SEED_AND_LENGTH JS GDI_HANDLE_BUFFER32 � RTL_FEATURE_ENABLED_STATE �@ TP_DEBUG_FREE_INFO ! # _WMI_IMAGEID_INFORMATION64 � _SYSTEM_POWER_STATE �X _OPERATION_END_PARAMETERS & �W _FILE_PROVIDER_EXTERNAL_INFO_V0 @D PEVENTMSGMSG �[ POBJECT_ATTRIBUTES . _VM_COUNTERS_EX �* _FOCUS_EVENT_RECORD # �[ _ETW_DISKIO_FLUSH_BUFFERS_V2 05 COVERAGE_REQUEST_CODES - �[ PSERVICE_CONTROL_STATUS_REASON_PARAMSW & �@ _PS_CPU_QUOTA_QUERY_INFORMATION >E _RPC_SERVER_INTERFACE
�[ HKEY__
+Z HPEN__ ]Y RPC_SECURITY_QOS_V2_A cA PETW_DISKIO_READWRITE_V3 �[ PBATTERY_REPORTING_SCALE �T _FILE_FULL_DIR_INFO UW tagLAYERPLANEDESCRIPTOR �[ PPERFINFO_FILE_CREATE m PROC_THREAD_ATTRIBUTE_NUM �0 tagSCROLLBARINFO " CLONG # HANDLER_FUNCTION_EX % L _WORKER_FACTORY_CALLBACK_CLASS boolean 0 �[ PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION + % _HEAP_OPTIMIZE_RESOURCES_INFORMATION , o _PERFINFO_CLOCK_INTERRUPT_INFORMATION �[ PTOKEN_DEFAULT_DACL ( �0 _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE ]: tagCHANGEFILTERSTRUCT �" _ETW_OBJECT_TYPE_EVENT * �V ETW_TP_EVENT_WORKER_NUMANODE_SWITCH . /' _SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE �[ RTL_RVA_LIST
�Y HRGN__ * V8 _SYSTEM_LOW_PRIORITY_IO_INFORMATION �[ PACL_SIZE_INFORMATION �Y FILESYSTEM_STATISTICS_EX �[ DLL_INIT_ROUTINE % �W FILE_PROVIDER_EXTERNAL_INFO_V0 " [ PCLDR_DLL_NOTIFICATION_DATA 7Z _FILE_NAME_INFO u+ tagMDINEXTMENU ' 8W SYSTEM_LEGACY_DRIVER_INFORMATION # �T _PROCESS_LOGGING_INFORMATION .D THREAD_TLS_INFORMATION & �F IO_COMPLETION_INFORMATION_CLASS + ~Y SYSTEM_VERIFIER_COUNTERS_INFORMATION ' �0 _PLUGPLAY_CONTROL_CONFLICT_ENTRY 1 : TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT �+ LPOSVERSIONINFOEXW - J5 SYSTEM_SESSION_MAPPED_VIEW_INFORMATION � WIN32_STREAM_ID �7 PS_MEMORY_RESERVE �@ tagMENUITEMINFOW #$ _SERVICE_TIMECHANGE_INFO >+ SHUTDOWN_ACTION 9Y HACCEL__ |[ LPOVERLAPPED h? LPDLGITEMTEMPLATEW �: LPRECONVERTSTRING ! {[ PIMAGE_RESOURCE_DATA_ENTRY �6 _ARMINTR_SHIFT_T �? SYSTEM_ACCESS_FILTER_ACE �U ETW_KQUEUE_ENQUEUE_EVENT k= USN_JOURNAL_DATA _KEY_INFORMATION_CLASS �, NPLOGPEN I- EMRANGLEARC $ uint32x2_t � _RESUME_PERFORMANCE , z[ PSYSTEM_INTERRUPT_CPU_SET_INFORMATION y[ PCLDR_DATA_TABLE_ENTRY 1 U _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION m9 RTL_DEBUG_INFORMATION ' x[ PIMAGE_CE_RUNTIME_FUNCTION_ENTRY w[ PPPM_WMI_PERF_STATE u[ HRSRC__ r[ PMENUGETOBJECTINFO , + _PROCESS_EXTENDED_BASIC_INFORMATION64 �? _OSVERSIONINFOEX2A " &! ETW_DFSS_START_NEW_INTERVAL B _EVENT_DESCRIPTOR �6 _FILE_LEVEL_TRIM $ <S NTPSS_MEMORY_BULK_INFORMATION % p[ WIN32_MEMORY_INFORMATION_CLASS , n[ PFILE_IO_PRIORITY_HINT_INFORMATION_EX TX VCN_RANGE_INPUT_BUFFER ) ! _TRACE_PERIODIC_CAPTURE_STATE_INFO
�R _FP_32 % C _POWER_THROTTLING_THREAD_STATE ) m[ PSYSTEM_PREFETCH_PATCH_INFORMATION ) k[ PJOBOBJECT_BASIC_LIMIT_INFORMATION s poly8x16_t W PPS_APC_ROUTINE �G EVENT_EXTENDED_ITEM_TS_ID 4 j[ PFSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE $ tagWINDOWINFO [+ GET_FILEEX_INFO_LEVELS EF EMREXCLUDECLIPRECT i[ PPO_WAKE_SOURCE_FIXED # 6D JOURNAL_ABSOLUTE_INFORMATION E LOCALE_ENUMPROCA ! wchar_t ( qE SERVICE_REQUIRED_PRIVILEGES_INFOA # h[ PPERFINFO_PO_SESSION_CALLOUT : MEMORY_EXHAUSTION_TYPE 1[ COMMCONFIG . �8 _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT ( g[ PETW_TIMER_EXPIRATION_START_EVENT ; RTLP_TAG_INFO / dC EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION . f[ PJOBOBJECT_CPU_RATE_CONTROL_INFORMATION e[ PRTL_AVL_FREE_ROUTINE # T' _ETW_TP_EVENT_CALLBACK_START B _PERFINFO_HV_HYPERCALL !U _PERFINFO_IO_TIMER ) &? PERFINFO_SESSIONCREATE_INFORMATION 2 / FILE_IO_COMPLETION_NOTIFICATION_INFORMATION u RTL_FEATURE_ID d[ PRTL_OKAY_TO_LOCK_ROUTINE $ �' ACTIVATION_CONTEXT_INFO_CLASS ! b[ PFILE_POSITION_INFORMATION ( a[ PRPC_HTTP_TRANSPORT_CREDENTIALS_W �U WMI_IRQ_RECORD # , _REQUEST_OPLOCK_INPUT_BUFFER ^[ PPACKEDEVENTINFO �? OSVERSIONINFOEX2 E _RTL_SPARSE_BITMAP_CTX � ICONMETRICSA * �R PERFINFO_PAGECOMBINE_ITERATION_STAT * ][ PFILE_VALID_DATA_LENGTH_INFORMATION 5& QUERY_FILE_LAYOUT_INPUT + \[ PSYSTEM_KERNEL_VA_SHADOW_INFORMATION - SYSTEM_CODEINTEGRITYPOLICY_INFORMATION [[ PSYSDBG_MSR B CONNECTDLGSTRUCT |R KEY_LAYER_INFORMATION �; READ_USN_JOURNAL_DATA
q LPWORD % fZ _THREAD_POWER_THROTTLING_STATE �F WNODE_HEADER �< _KERNEL_USER_TIMES �Z PWINDOWPLACEMENT " Z[ PALPC_WORK_ON_BEHALF_TICKET # Y[ PTXFS_GET_TRANSACTED_VERSION X[ LPCIEXYZ *E SECTION_IMAGE_INFORMATION /+ PEMRSETVIEWPORTORGEX ! �X _PERFINFO_WORKINGSET_ENTRY �, IMAGE_COFF_SYMBOLS_HEADER ( W[ PLOOKUP_STREAM_FROM_CLUSTER_ENTRY 7 V[ PSYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION �0 RTL_STACK_CONTEXT cA ETW_DISKIO_READWRITE_V3 U[ PRUNTIME_FUNCTION �* _COPYFILE2_COPY_PHASE $ � _FILE_STORAGE_TIER_MEDIA_TYPE �' _DISPLAY_DEVICEW & T[ PRTL_PROCESS_MODULE_INFORMATION 2 ^- JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V1 �% WMI_REGISTRY y _ETW_KQUEUE_DEQUEUE_EVENT N# PROCESS_HEAP_INFORMATION R[ _OBJECT_TYPE_INFORMATION ' COUNTER_READING $ O[ PTXFS_CREATE_MINIVERSION_INFO ( M[ SYSTEM_PREFETCH_PATCH_INFORMATION ! J[ PETW_DISABLE_KTIMER2_EVENT � uint16x4x3_t I[ PSYSTEM_POOL_INFORMATION jE NPPOLYTEXTW �% STACK_WALK_EVENT_DATA & ( _SYSTEM_VERIFIER_INFORMATION_EX h" EMRMOVETOEX # 7 ETW_PROCESS_HANDLE_INFO_TYPE H[ PRETRIEVAL_POINTER_COUNT G[ PETW_POOL_EVENT K SE_AUDIT_OPERATION F[ PGENERATE_NAME_CONTEXT E[ PETW_HEAP_EVENT_FREE �& PRTL_RESOURCE_DEBUG64 " � SE_WS_APPX_SIGNATURE_ORIGIN " D[ PPROCESS_UPTIME_INFORMATION ?Y _IMAGE_OPTIONAL_HEADER64 * �D _TOKEN_SECURITY_ATTRIBUTE_OPERATION C[ PTHREAD_WORKLOAD_CLASS ! �2 SYSTEM_ERROR_PORT_TIMEOUTS E: LPCANDIDATELIST � _SE_TOKEN_USER . �< _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION � _IRQ_PRIORITY % ? _PERFINFO_FLT_OPERATION_STATUS % �Y MEMORY_COMBINE_INFORMATION_EX2 B[ PWMI_RESOURCE �. THREAD_NAME_INFORMATION A[ PTP_DIRECT ' �C _RTL_IMAGE_MITIGATION_DEP_POLICY � uint64x1x4_t @[ PMARK_HANDLE_INFO s _WOW64_FUNCTION_CODE64 �! LDR_DDAG_NODE M4 PERFINFO_CC_FLUSH_SECTION 1, QUAD � _FILE_STORAGE_TIER_CLASS % �Y FSCTL_QUERY_REGION_INFO_OUTPUT 0 ?[ PSYSTEM_FEATURE_CONFIGURATION_INFORMATION P7 FILE_ID_EXTD_DIR_INFO � ANSI_STRING
>[ PFP_32 " �D _TXFS_GET_METADATA_INFO_OUT ! W= _CONTAINER_ROOT_INFO_INPUT ) � _FILE_FS_METADATA_SIZE_INFORMATION � EMRSETSTRETCHBLTMODE #- _REARRANGE_FILE_DATA =[ LPSTARTUPINFOA <[ PCONSOLE_SELECTION_INFO # O' _FILE_COMPLETION_INFORMATION % �U _COMPATIBILITY_CONTEXT_ELEMENT �5 SCRUB_PARITY_EXTENT_DATA * P _PERFINFO_FILENAME_SAME_INFORMATION " tA _IMAGE_DYNAMIC_RELOCATION64 , ;[ PSYSTEM_VERIFIER_COUNTERS_INFORMATION " :[ PCIMAGE_BOUND_FORWARDER_REF ( �: RTL_IMAGE_MITIGATION_OPTION_STATE ! �V WIM_PROVIDER_EXTERNAL_INFO + 8[ PSYSTEM_NET_RATE_CONTROL_SET_CONTEXT $ 7[ PSYSTEM_PROCESSOR_INFORMATION 1 6[ PCACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION S NPEXTLOGPEN _cpinfo
4[ PFIBER # �@ _SEMAPHORE_BASIC_INFORMATION `% REG_PROVIDER * 3[ PETW_TRACE_PARTITION_INFORMATION_V2 �, _ETW_TP_EVENT_POOL_CREATE �T _BLENDFUNCTION + %. _SYSTEM_SYSTEM_PARTITION_INFORMATION 1[ _COMMCONFIG ) .[ LPSERVICE_REQUIRED_PRIVILEGES_INFO 2 RPC_MESSAGE �< SYSTEM_HANDLE_INFORMATION 7 _TIME_ZONE_INFORMATION " _HEAP_EVENT_COMMIT_DECOMMIT " PERFINFO_PO_SESSION_CALLOUT ! -[ PNTFS_EXTENDED_VOLUME_DATA y9 _KTMOBJECT_TYPE ,[ HINSTANCE $ +[ PGET_SYSTEM_WOW64_DIRECTORY_W & � _FILE_REPARSE_POINT_INFORMATION ([ OLDFONTENUMPROCW � MENUITEMINFOA u< _XSTATE_CONTEXT d= NEWTEXTMETRIC KS NPOUTLINETEXTMETRICA # '[ PENCLAVE_INIT_INFO_VBS_BASIC � LPDIBSECTION R5 MSGBOXPARAMSW &[ PETW_CANCEL_TIMER_EVENT 'F _CM_SCSI_DEVICE_DATA 7Z FILE_NAME_INFO c _FILE_STAT_LX_INFORMATION ![ PUSN_JOURNAL_DATA_V1 ( &' PLUGPLAY_CONTROL_CONFLICT_STRINGS [ PFILE_QUOTA_INFORMATION + a) PLUGPLAY_CONTROL_RELATED_DEVICE_DATA [ PRTL_RXACT_OPERATION ' [ PETW_ANTI_STARVATION_BOOST_EVENT 4 d2 _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION � _KCRM_MARSHAL_HEADER 4, LPSECURITY_CAPABILITIES ' [ RTL_WALK_IMAGE_POLICIES_CALLBACK PLANGNAMEINDEX ] NPTEXTMETRICA 4 rR PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY � IO_PRIORITY_HINT ]' _CONSOLE_FONT_INFO �A PERFINFO_BOOT_PHASE_START Y ALPC_DATA_VIEW_ATTR & �? _SL_APPX_CACHE_VALUE_DESCRIPTOR AR SERVICE_DESCRIPTION � EFI_DRIVER_ENTRY_LIST W STORAGE_RESERVE_ID [ PREFS_SMR_VOLUME_GC_STATE ) [ PRTL_IMAGE_MITIGATION_SEHOP_POLICY [ PPO_SLEEP_DISABLE_REASON [ XSAVE_FORMAT [ PEXCEPTION_FILTER �9 FILE_NAME_INFORMATION �V LPHARDWAREHOOKSTRUCT [ PPOWER_IDLE_RESILIENCY � RTL_IMAGE_POLICY_METADATA dD _PS_ATTRIBUTE �D TP_DEBUG_CLASS ; HY _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY VC VM_COUNTERS_EX2 + U _SYSTEM_FEATURE_CONFIGURATION_UPDATE , _HSM_OPCODE ( [ PFILE_METADATA_OPTIMIZATION_STATE ! [ PETW_NOTIFICATION_CALLBACK 2
[ PSYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE b PENHMETAHEADER ' LA RPC_BINDING_HANDLE_SECURITY_V1_A ! SE MEMORY_BASIC_INFORMATION32 * �2 _FILE_INITIATE_REPAIR_OUTPUT_BUFFER " �R _KEY_WRITE_TIME_INFORMATION -Y NPIMEMENUITEMINFOA ]D CSV_QUERY_FILE_REVISION [ PFILE_PIPE_EVENT_BUFFER ]& LOGCOLORSPACEA $ LOCALESIGNATURE t2 _HEAP_RANGE_LOG kW _RTL_BUFFER $ [ PPO_INTERNAL_WAKE_SOURCE_TYPE .4 tagPOINTER_TOUCH_INFO : _DYNAMIC_FUNCTION_TABLE [ PRTL_DISK_SPEED_INFO ' qE SERVICE_REQUIRED_PRIVILEGES_INFO ( , _IMAGE_LOAD_CONFIG_CODE_INTEGRITY [ PRTL_MODULE_EXTENDED_INFO G< _PS_ATTRIBUTE_LIST # _CSV_QUERY_MDS_PATH_V2 = NETRESOURCEA [ PRPC_SECURITY_QOS_V5_W [ PENCRYPTED_DATA_INFO # %C _SHARED_VIRTUAL_DISK_SUPPORT ( [ PSYSTEM_SINGLE_MODULE_INFORMATION �! GCP_RESULTS [ PTP_TIMER [ HDESK 1 �Z PEVENT_TRACE_IPT_CONFIGURATION_INFORMATION " �A FILE_PROVIDER_EXTERNAL_INFO �# PVIDEOPARAMETERS
; TEB ' �3 FILE_FS_FULL_SIZE_INFORMATION_EX �Z LPDOCINFOW ! �Z PFILE_TRACKING_INFORMATION UD tagEMRFILLPATH �# ENUM_SERVICE_STATUSA ! m/ PERFINFO_MEMORY_NODE_ENTRY ! T' ETW_TP_EVENT_CALLBACK_STOP $ *Y PERFINFO_CC_WORKITEM_COMPLETE
�, LOGPEN ! � SYSTEM_MEMORY_LIST_COMMAND # �Z RTL_RETPOLINE_CHECK_FUNCTION �Z PETW_STACK_CACHING_CONFIG M TIMER_TYPE ' _TOKEN_MANDATORY_LABEL �Z PLDR_FAILURE_DATA xB EMREXTCREATEFONTINDIRECTW �A PO_WAKE_SOURCE_INFO 4 �! _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION 5 O& RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY ? NPPELARRAY �E ETW_CRITSEC_EVENT_INIT * �E _JOBOBJECT_MEMORY_USAGE_INFORMATION $ �X _ENLISTMENT_BASIC_INFORMATION �Z PINIT_ONCE_FN iB _WMI_TCPIP �U WMI_WAIT_MULTIPLE ) &R PROCESS_EXTENDED_BASIC_INFORMATION 3S _PROCESS_INFORMATION �Z LANGUAGEGROUP_ENUMPROCA 2 �Z PACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 u0 RTL_LFG_RNG_STATE �% PEMRARC K _LIST_ENTRY 3 �! SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION ! WORD �! EMRSETVIEWPORTORGEX " �> _SYSTEM_POWER_STATE_CONTEXT �Z PWMI_WAIT_OBJECT_RECORD " # ETW_COVERAGE_SAMPLER_HANDLE ( �Z PLEARNING_MODE_OBJECT_INFORMATION z7 IMECHARPOSITION �Z PRPC_SECURITY_QOS_V2_W �Z WMI_RESOURCE } UNICODE_STRING " �Z LDR_CREATE_ACT_CTX_LANGUAGE !# _BUS_DATA_TYPE # �& _SYSTEM_VERIFIER_INFORMATION �Z GOBJENUMPROC , �Z PRTL_FEATURE_USAGE_SUBSCRIPTION_TABLE * _MAT2 9 _RPC_SECURITY_QOS_V5_W V EMRCREATEPALETTE $ �Z PFILE_END_OF_FILE_INFORMATION . �5 _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION �V LOAD_DLL_DEBUG_INFO % �V _EVENT_EXTENDED_ITEM_EVENT_KEY + `* PERFINFO_SAMPLED_PROFILE_INFORMATION * �* _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX # �Z PETW_TP_EVENT_CALLBACK_START ! �F SE_PACKAGE_CAPABILITY_INFO �Z PWIN32_MEMORY_RANGE_ENTRY 3R EMRSETCOLORADJUSTMENT �: ALPC_BASIC_INFORMATION �C _RTL_TRACE_BLOCK RPC_SS_THREAD_HANDLE : _MEMORY_EXHAUSTION_TYPE �Z PAXISINFO >( EMRPOLYLINE16 & 6: _PERFINFO_PPM_IDLE_STATE_CHANGE �$ uint32x4x4_t � VRF_RULE_CLASS_ID � WMI_SPINLOCK �; _ETW_HEAP_EVENT_COMMON $ �/ FILE_SFIO_RESERVE_INFORMATION ' �Z PFILE_MAILSLOT_QUERY_INFORMATION IR _CSV_QUERY_MDS_PATH &: _EISA_MEMORY_TYPE QY _ETW_CANCEL_TIMER_EVENT �U _RTL_PHYSICAL_MEMORY_INFO �C USEROBJECTFLAGS �Z LPWINDOWPLACEMENT ! FZ _SEC_WINNT_AUTH_IDENTITY_W �% PEMRSELECTCOLORSPACE & ?, _IMAGE_RESOURCE_DIRECTORY_ENTRY �Z PTHREAD_START_ROUTINE ! �Z PFSCTL_OFFLOAD_WRITE_INPUT / �G MEMORY_PARTITION_INITIAL_ADD_INFORMATION & �$ ETW_PARTITION_INFO_EXTENSION_V2 �Z PMEM_ADDRESS_REQUIREMENTS �Z PCM_PCCARD_DEVICE_DATA W1 _PERFINFO_PROCESS_INSWAP ' �Z PIO_COMPLETION_BASIC_INFORMATION \4 EVENT_FILTER_EVENT_NAME 3U _ETW_WNF_EVENT_PUBLISH �Z PSE_IMAGE_SIGNATURE_TYPE �Z PFILE_ID_EXTD_DIR_INFO LPMENUTEMPLATE u PEN_MASK e tagPOINTER_TYPE_INFO
�Z PFP_64 .D _THREAD_TLS_INFORMATION �( HELPWININFO $ �Z PSYSTEM_INTERRUPT_INFORMATION & �Z PFSCTL_UNMAP_SPACE_INPUT_BUFFER - �Z PWMI_JOB_SEND_NOTIFICATION_INFORMATION & �/ _PERFINFO_SET_DEVICES_STATE_RET �Z PRTL_HASH_ENTRY �Z PCONDITION_VARIABLE �# NEWTEXTMETRICW �Z PWMI_DELAY_EXECUTION " " _IMAGE_DELAYLOAD_DESCRIPTOR % DMA_WIDTH [V COUNTED_REASON_CONTEXT �Z PRTL_ENCLAVE_LAUNCH_TOKEN � LPINPUT 0 �Z PJOBOBJECT_LIMIT_VIOLATION_INFORMATION_V1
�2 tagMSG �Z PETW_TP_EVENT_POOL_CLOSE �S FILE_LEVEL_TRIM_OUTPUT * �Z PSYSTEM_MEMORY_TOPOLOGY_INFORMATION �E WMI_TRACE_MESSAGE_PACKET G PMUIREGISTRYINFO �! _WMI_JOB_INFORMATION $ �F _WOW64_DESCRIPTOR_TABLE_ENTRY �6 _TOKEN_SOURCE % k@ _FSCTL_QUERY_REGION_INFO_INPUT
+ CREATESTRUCTA " 3 KEY_WOW64_FLAGS_INFORMATION �2 _CM_COMPONENT_INFORMATION �< EVENT_TRACE_LOGFILEA % _INVERTED_FUNCTION_TABLE_ENTRY % �Z PROCESS_CYCLE_TIME_INFORMATION �U _QUOTA_LIMITS_EX / �Z PFSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT & �Z PJOURNAL_RENAME_KEY_INFORMATION �7 _MENU_EVENT_RECORD # �V _ETW_CRITSEC_EVENT_COLLISION " I _FILE_FS_VOLUME_INFORMATION + �V RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE % _GROUP_AFFINITY u? PO_WAKE_SOURCE_DEVICE }A COMM_FAULT_OFFSETS �Z PFIND_BY_SID_DATA �Z PPERFINFO_PROCESS_INSWAP + �Z _PROCESS_SECURITY_DOMAIN_INFORMATION �Y LPKEYBDINPUT �Z PPS_ATTRIBUTE_LIST # �Z PETW_DISKIO_FLUSH_BUFFERS_V3 ( �@ ETW_COVERAGE_SAMPLER_BLOOM_FILTER ) �Z PRESOURCEMANAGER_BASIC_INFORMATION ' UB _IR_TIMER_EXTRA_CREATE_PARAMETER PDLL_DIRECTORY_COOKIE _ FILE_ID_INFO �Z WMIDPREQUEST n2 WMI_DISKIO_READWRITE_INIT �< TOKEN_STATISTICS
S _FILE_REGION_INPUT * % HEAP_OPTIMIZE_RESOURCES_INFORMATION �S TEB_ACTIVE_FRAME_EX �Z PRTL_SPARSE_BITMAP_CTX �Z PFILE_END_OF_FILE_INFO ) �< _PERFINFO_KERNELMEMORY_RANGE_USAGE �( IMAGE_SECTION_HEADER �Z PEMRGLSBOUNDEDRECORD �Z PPROCESSOR_IDLE_HANDLER 2 �X SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX � _RASTERIZER_STATUS � PLDR_SERVICE_TAG_RECORD �D HUMPD__ �Z PLUTF8_STRING + �Z PPROCESS_SECURITY_DOMAIN_INFORMATION " �- PROCESSOR_POWER_POLICY_INFO -R _THREAD_BASIC_INFORMATION �= FONTSIGNATURE ! �Z PETW_THREAD_AFFINITY_EVENT & �Z PFILE_STANDARD_LINK_INFORMATION $ �B BOOT_ENTROPY_SOURCE_NT_RESULT �6 FILE_LEVEL_TRIM �5 SERVICE_NODE_TYPE !
@ _FILE_BOTH_DIR_INFORMATION ! GG tagEMRMODIFYWORLDTRANSFORM +: MOF_FIELD & �+ SYSTEM_POOL_ZEROING_INFORMATION �G SERVICE_DIRECTORY_TYPE � _TRACE_ENABLE_CONTEXT_EX - � _SYSTEM_ISOLATED_USER_MODE_INFORMATION �Z PEMREXTCREATEPEN , �Z PACTIVATION_CONTEXT_BASIC_INFORMATION .5 DATEFMT_ENUMPROCEXA �$ STYLEBUF & �@ PERFINFO_WORKINGSET_INFORMATION ! i> _RTL_RETPOLINE_BINARY_INFO �Z LPNEWTEXTMETRIC �Z SENDASYNCPROC �! SID_AND_ATTRIBUTES * �Z PFILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER % �@ PS_CPU_QUOTA_QUERY_INFORMATION - �< SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER �5 MUILANGCFGLIST 7C SYSTEM_VDM_INSTEMUL_INFO $ �; SYSTEM_PROCESS_ID_INFORMATION ' 4 _ETW_TRACE_PARTITION_INFORMATION �C _IMAGE_DEBUG_DIRECTORY �Z PSE_AUDIT_OPERATION ' �Z PRTL_FEATURE_CONFIGURATION_TABLE ) _SYSTEM_SECURITY_MODEL_INFORMATION d+ _ENCLAVE_LOAD_INFO_VBS �* DRAWITEMSTRUCT TR UNWIND_HISTORY_TABLE _MIDL_FORMAT_STRING % YU SYSTEM_PROCESS_TRUST_LABEL_ACE 8 CURRENCYFMTA � _SID_NAME_USE + OUTLINETEXTMETRICW "> IMAGE_DEBUG_MISC # wY FILE_STANDARD_INFORMATION_EX , �/ VIRTUALIZATION_INSTANCE_INFO_INPUT_EX " �Z PADMINISTRATOR_POWER_POLICY �Z PSLIST_HEADER Q: PLOGFONTA
X+ HIMC__ � PHYSICAL_ADDRESS * �7 SYSTEM_ACTIVITY_APP_MODERATION_TYPE �Z RTL_AVL_ALLOCATE_ROUTINE 3 I PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION ) �2 FILE_INITIATE_REPAIR_OUTPUT_BUFFER ? �Z PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY SU TP_DIRECT ;> POINTER_PEN_INFO �A ETW_NOTIFICATION_HEADER ) �" _MEMORY_PARTITION_NODE_INFORMATION VG _RIP_INFO
0 tagPIXELFORMATDESCRIPTOR ] REMOTE_NAME_INFOW * �Z PPERFINFO_DPC_EXECUTION_INFORMATION > _OBJECTID G7 _PORT_DATA_INFORMATION JF PCUNZTCH * _? SYSTEM_CRASH_DUMP_STATE_INFORMATION �Z PBITMAPCOREINFO ( �B WMI_EXTENDED_THREAD_INFORMATION64 , PCUWSTR '( POWER_USER_PRESENCE �Z PPERFINFO_DEBUG_EVENT �X PMETAHEADER �Z LPDLGITEMTEMPLATE x7 LPIMECHARPOSITION &4 _RTL_HEAP_TAG_INFO �Z LPFNDEVMODE vA LPDESIGNVECTOR �Z LPMDICREATESTRUCTA � _CHAR_INFO B LPNETRESOURCE b SID_AND_ATTRIBUTES_ARRAY �S NTFS_STATISTICS / �3 SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS � SERVICE_STATUS_HANDLE__
p PNZTCH �Z PIMAGE_SYMBOL_EX � PS_MITIGATION_OPTION " �E PRTL_CRITICAL_SECTION_DEBUG �6 _HARDWARE_COUNTER # �Z PPROCESS_LOGGING_INFORMATION �Z PKCONTINUE_TYPE �Z LPOSVERSIONINFOEX �, _IMAGE_POLICY_ENTRY_TYPE ) �Z PETW_TP_EVENT_TIMER_CANCEL_NTTIMER # �Z _ENCLAVE_INIT_INFO_VBS_BASIC f% HCURSOR |, NPRGNDATA �Z LPSTYLESTRUCT �Z CS_TAG_GETTING_ROUTINE + �Z PPERFINFO_PAGECOMBINE_ITERATION_STAT y: _PERFINFO_PROCESS_PERFCTR ' �Z PPLUGPLAY_CONTROL_CONFLICT_ENTRY �Z PMOFRESOURCEINFOA ! �/ PERFINFO_SET_DEVICES_STATE ' ! _ETW_COVERAGE_SAMPLER_QUERY_INFO �Z PCOUNTER_READING / �Z PFILE_PROCESS_IDS_USING_FILE_INFORMATION �Z PAPPCONTAINER_SID_TYPE
+ POUTLINETEXTMETRICW �Z PEMRINTERSECTCLIPRECT � _TOKEN_INFORMATION_CLASS & �Z PPROCESS_CYCLE_TIME_INFORMATION & Z PNTFS_FILE_RECORD_OUTPUT_BUFFER ~Z PPERFINFO_FILE_DIRENUM }Z PCURDIR |Z PBOOT_ENTRY & �Y _MEMORY_COMBINE_INFORMATION_EX2 �" SECURITY_DESCRIPTOR
Z LDR_FAILURE_DATA N< RATE_QUOTA_LIMIT {Z HHOOK # � _ALPC_PORT_INFORMATION_CLASS �5 FILE_NAMES_INFORMATION zZ PEVENTLOGRECORD �& DISPATCHER_CONTEXT % �W _IMAGE_BOUND_IMPORT_DESCRIPTOR ?0 GDI_TEB_BATCH $ yZ PSYSTEM_REF_TRACE_INFORMATION * &> _PERFINFO_DPC_EXECUTION_INFORMATION xZ PIMAGE_OPTIONAL_HEADER64 9' LINK_TRACKING_INFORMATION wZ PRPC_ENDPOINT_TEMPLATEA * vZ PPERFINFO_PO_CALIBRATED_PERFCOUNTER uZ PWOW64_FLOATING_SAVE_AREA " e _RTL_CRITICAL_SECTION_DEBUG tZ PPPM_WMI_PERF_STATES_EX sZ PQUOTA_LIMITS_EX ( � _PROCESS_TELEMETRY_ID_INFORMATION � _REDIRECTION_DESCRIPTOR rZ PEMR 6 qZ LDR_LOADED_MODULE_ENUMERATION_CALLBACK_FUNCTION � FILE_REGION_INFO lZ PGROUP_RELATIONSHIP c- _NLSTABLEINFO % �' _ACTIVATION_CONTEXT_INFO_CLASS * kZ PSYSTEM_EXTENDED_THREAD_INFORMATION $ �U COMPATIBILITY_CONTEXT_ELEMENT ' 0 JOB_OBJECT_IO_RATE_CONTROL_FLAGS � _SYSTEM_POOLTAG jZ LPSERIALKEYSA iZ PFILE_PIPE_INFORMATION ' {S PERFINFO_MEMORY_NODE_INFORMATION % H= _SE_SET_FILE_CACHE_INFORMATION 5 hZ PJOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION $ fZ THREAD_POWER_THROTTLING_STATE �2 _LDR_DATA_TABLE_ENTRY64 ) cZ PFILE_IO_PRIORITY_HINT_INFORMATION bZ PSYSDBG_COMMAND # � PROCESS_TLS_INFORMATION_TYPE ) NR _GET_FILTER_FILE_IDENTIFIER_OUTPUT aZ PRC_CONFIG
� UOW # � ENUM_SERVICE_STATUS_PROCESSA `Z PRPC_PROTSEQ_ENDPOINT �T _IMAGE_VXD_HEADER ]; _USER_ACTIVITY_PRESENCE , _Z PPLUGPLAY_CONTROL_INTERFACE_LIST_DATA �> DROPSTRUCT � _POWER_STATE_TYPE ]Z CM_PCCARD_DEVICE_DATA ) �R VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT �. _HEAP_RANGE_DESTROY # ZZ PMEM_EXTENDED_PARAMETER_TYPE VZ PRGNDATAHEADER �Y tagEMRTEXT � PEMRSETICMMODE UZ PETW_HEAP_EVENT_EXPANSION SZ _GENERIC_MAPPING / �> TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY $ _WORKERFACTORYINFOCLASS QZ PBITMAPFILEHEADER ZG CPINFOEXA ] _HIBERFILE_BUCKET � PKCRM_PROTOCOL_BLOB 9 ACTCTXW PZ PPROCESSOR_IDLESTATE_INFO " OZ LPCREATE_PROCESS_DEBUG_INFO NZ PEMRROUNDRECT MZ PTOUCH_HIT_TESTING_INPUT �. WNF_STATE_NAME_LIFETIME 2 : _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT LZ PPROCESS_TLS_INFORMATION & JZ _RTL_USER_PROCESS_INFORMATION64 �= RPC_BINDING_VECTOR ! DZ PSEC_WINNT_AUTH_IDENTITY_W CZ PIMAGE_TLS_DIRECTORY32 ) �: _REMOTE_LINK_TRACKING_INFORMATION_ . �) _SYSTEM_THREAD_CID_PRIORITY_INFORMATION ! UHALF_PTR BZ LPOSVERSIONINFOEX2 e< EMROFFSETCLIPRGN EMRPOLYGON AZ PEMRGLSRECORD ! �: _PERFINFO_SET_POWER_ACTION * @Z PTXFS_LIST_TRANSACTION_LOCKED_FILES �6 SD_ENUM_SDS_OUTPUT �T _ETW_CLOCK_TIME_UPDATE <Z _PACKEDEVENTINFO ) �0 _FINDFIRSTACTIVATIONCONTEXTSECTION w LPWIN32_FIND_DATAA " J SEMAPHORE_INFORMATION_CLASS $ PLOCALESIGNATURE l OBJECT_INFORMATION_CLASS 'S _RTL_ELEVATION_FLAGS 5Z PFILE_NAME_INFO �$ RTL_AVL_TABLE �$ _APPCONTAINER_SID_TYPE 3Z PRTL_STACK_CONTEXT_ENTRY �> PUNICODE_STRING * �= _MIDL_WINRT_TYPE_SERIALIZATION_INFO ! 2Z PLINK_TRACKING_INFORMATION # �2 CM_EISA_FUNCTION_INFORMATION $ � _PROCESS_TLS_INFORMATION_TYPE # * _PROCESS_BASIC_INFORMATION64 1Z DLGPROC /Z NPPOLYTEXT 4 �# _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION 7S _RTL_RVA_LIST_ITERATOR .Z PLDR_DATA_TABLE_ENTRY32 -Z PWMI_JOB_REMOVE_PROCESS � _WMI_FILE_IO �F FP_IEEE_VALUE )Z HPEN �. tagCHARSETINFO % 'Z PPERFINFO_SET_POWER_ACTION_RET % �V _PROCESS_MITIGATION_DEP_POLICY -( tagEMRCREATECOLORSPACEW &Z LPSOUNDSENTRYA �2 ETW_HEAP_EVENT_ALLOC $ PCANSI_STRING % %Z PSYSTEM_PROCESS_CLASSIFICATION & $Z PPROCESS_MEMORY_EXHAUSTION_TYPE ) �D SYSTEM_PROCESSOR_POWER_INFORMATION D) _SYSTEM_PREFETCH_OPTIONS #Z PPPM_PERFSTATE_EVENT 3 X7 SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION �! tagIMEMENUITEMINFOW PLONG / BG ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT KV SYSTEM_WORKINGSET_ENTRY >+ _SHUTDOWN_ACTION �" ACCESSTIMEOUT T GCP_RESULTSW " �V _WIM_PROVIDER_EXTERNAL_INFO Z LPTHREAD_START_ROUTINE �/ IMAGE_LINENUMBER " �+ MEMORY_PARTITION_PAGE_RANGE # � ENLISTMENT_INFORMATION_CLASS 8 Z PACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION PBOOLEAN �W WOF_EXTERNAL_INFO � RESUME_PERFORMANCE % - RTL_SPARSE_BITMAP_FREE_ROUTINE Z NPLOGFONT ( Z PFILE_REMOTE_PROTOCOL_INFORMATION �G RTL_HEAP_PARAMETERS Z PFS_INFORMATION_CLASS . KEY_BASIC_INFORMATION # Z PRTL_SEGMENT_HEAP_PARAMETERS & 6! SYSTEM_HOT_PATCH_REGISTRY_VALUE Z LPNONCLIENTMETRICS ' Z PTOKEN_BNO_ISOLATION_INFORMATION ) �E JOBOBJECT_MEMORY_USAGE_INFORMATION 3 Z PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX S7 HANDEDNESS " Z PUNWIND_HISTORY_TABLE_ENTRY y RTL_DYNAMIC_HASH_TABLE # Z PSYSTEM_SCOPED_POLICY_ID_ACE �Y PRPC_STRING Z PCSTRING �5 WNF_STATE_NAME % Z PRTL_REALLOCATE_STRING_ROUTINE @ RTL_RESOURCE_POLICY_FLAGS ' �$ ETW_COVERAGE_SAMPLER_CREATE_INFO 7 Z PSYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION $ � PRTL_CRITICAL_SECTION_DEBUG32 ! �X _FILE_POSITION_INFORMATION 'F CM_SCSI_DEVICE_DATA g$ _RTL_SPARSE_BITMAP_RUN �> EMRSETTEXTCOLOR Z PCOBJECT_ATTRIBUTES
Z _LDR_FAILURE_DATA "
Z PPO_SPR_ACTIVE_SESSION_DATA �4 BITMAPFILEHEADER �- PEMRPOLYLINETO p) IMAGE_THUNK_DATA32 $ �? _EXTENDED_ENCRYPTED_DATA_INFO p PUNZTCH K9 _WMI_TXR Z PETW_PER_SESSION_QUOTA $ �F FILE_ZERO_DATA_INFORMATION_EX ! a& _SYSTEM_OBJECT_INFORMATION _ TEXTMETRICA Z PIELF_HANDLE ' �> CFG_CALL_TARGET_LIST_INFORMATION SC_LOCK Z PCZPSTR � VALENTA �S _IMAGE_ROM_HEADERS $ G _SD_CHANGE_MACHINE_SID_OUTPUT Z PBOOT_ENTROPY_NT_RESULT >( EMRPOLYBEZIER16 Z PCONTAINER_VOLUME_STATE � _KCONTINUE_TYPE / 2+ _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION Z PEX_WNF_CALLBACK K XFORM % Z PETW_CLOCK_CONFIGURATION_EVENT �> PERFINFO_PO_POSTSLEEP �> TIMELINE_BITMAP �; FILE_PATH " �) MEMORY_WORKING_SET_EX_BLOCK ! �Y PSTARTING_LCN_INPUT_BUFFER ' � _LEAP_SECOND_DATA_REGISTRY_ENTRY * �B _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM �? ETW_REF_CLOCK . �< _SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER �E WIN32K_SYSCALL_FILTER �; SCRUB_DATA_OUTPUT $ �# QUERY_FILE_LAYOUT_FILTER_TYPE % > MEMORY_WORKING_SET_EX_LOCATION " �- RTL_SPARSE_BITMAP_PARAMETER ] LPTEXTMETRICA �Y LPCPINFOEXA ! �G _WMI_PROCESS_INFORMATION64 # fR _DRIVER_VERIFIER_THUNK_PAIRS , _FILETIME " POINTER_64_INT �Y PCREATE_USN_JOURNAL_DATA �F _SL_HWID_DEVICE_INFO �Y PMESSAGE_RESOURCE_DATA �D _REPAIR_COPIES_OUTPUT �Y PVOLUME_REFS_INFO_BUFFER . �Y PSYSTEM_SPECULATION_CONTROL_INFORMATION $ �? _RTL_PROCESS_LOCK_INFORMATION -+ _VOLUME_REFS_INFO_BUFFER �' DISPLAY_DEVICEW �T _QUERY_SERVICE_CONFIGW �Y PCIMAGE_TLS_DIRECTORY64 �Y PKCONTINUE_ARGUMENT �Y PENCLAVE_INIT_INFO_SGX HPOWERNOTIFY �# _PROCESSOR_NUMBER j( _MIDL_SERVER_INFO_ p va_list �Y _FILESYSTEM_STATISTICS_EX _ _SINGLE_LIST_ENTRY # �U SYSTEM_EXCEPTION_INFORMATION �Y PMULTI_TIME �U _FILE_FULL_EA_INFORMATION �Y PRTL_HEAP_STACK_CONTROL " SID_HASH_ENTRY �1 PVALUEA �Y PQUERYHANDLER � WMI_PAGE_FAULT v$ _REG_ACTION ! �= POINTER_DEVICE_CURSOR_INFO q PPARAM_OFFSETTABLE ! �Y PRTL_RVA_LIST_RAW_ITERATOR " PSIZE_T - �Y PCLAIM_SECURITY_ATTRIBUTES_INFORMATION & H _OBJECT_HANDLE_FLAG_INFORMATION ! �Y PCACTIVATION_CONTEXT_STACK �W TOKEN_CONTROL 1 �Y PTRANSACTION_NOTIFICATION_PROMOTE_ARGUMENT �Y LPENUMLOGFONTEXDV � tagWNODE_EVENT_ITEM /= _WMI_CONTEXTSWAP # ?= _SYSTEM_SCOPED_POLICY_ID_ACE �" LPLOGFONTW �3 SE_AUDIT_INFO % �Y _FILE_FS_ATTRIBUTE_INFORMATION ( J@ _TIMER_SET_COALESCABLE_TIMER_INFO �/ EMRSETDIBITSTODEVICE �+ _ETW_REGNOTIF_REGISTER ) 7 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY ( � FILE_ID_EXTD_BOTH_DIR_INFORMATION ! RTL_UMS_THREAD_INFO_CLASS �Y EMRTEXT X DESKTOPENUMPROCA �T QUERY_SERVICE_CONFIGW " PSECURITY_INFORMATION J _KPROFILE_SOURCE � _IO_PRIORITY_HINT �Y LPSERVICE_MAIN_FUNCTIONW # PTRACEHANDLE �Y PMOFRESOURCEINFOW ! �Y RPC_NEW_HTTP_PROXY_CHANNEL �3 MIDL_STUB_MESSAGE PCLAIMS_BLOB - /' SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE �Y PSYSTEM_AUDIT_OBJECT_ACE 2 _PROCESS_TLS_INFORMATION zG RTL_BITMAP_RUN RPC_IF_HANDLE %
7 PEXCEPTION_REGISTRATION_RECORD b: CM_SERIAL_DEVICE_DATA �Y PCM_SONIC_DEVICE_DATA 2 �, TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT # �Y _ETW_COVERAGE_SAMPLER_STATUS & �Y PMEMORY_COMBINE_INFORMATION_EX2 ;+ _RTL_CIRCULAR_LIST_HEAD f" PEMRMOVETOEX �Y WINEVENTPROC �+ _CONNECTDLGSTRUCTW ' �& _ETW_DFSS_RELEASE_THREAD_ON_IDLE � IMAGE_DOS_HEADER ) :: _SYSTEM_VSM_PROTECTION_INFORMATION $ �5 KEY_CONTROL_FLAGS_INFORMATION rW FILE_STORAGE_TIER_REGION W= CONTAINER_ROOT_INFO_INPUT ! � _PS_MITIGATION_OPTIONS_MAP # � TXFS_LIST_TRANSACTIONS_ENTRY �T RTL_ENCLAVE_LAUNCH_TOKEN r WMI_THREAD_INFORMATION �Y PHV_DETAILS �Y PRTL_UNLOAD_EVENT_TRACE32 80 VARIABLE_NAME �Y PRTL_GENERIC_TABLE �* TOUCHINPUT % �Y PKAFFINITY_ENUMERATION_CONTEXT ' �Y PSYSTEM_SPECIAL_POOL_INFORMATION @ PEMRSETMETARGN * �Y PMIDL_WINRT_TYPE_SERIALIZATION_INFO �7 _EISA_IRQ_DESCRIPTOR C9 _devicemodeW �@ tagPOINTFX �Y PNTFS_VOLUME_DATA_BUFFER -? RTL_UNLOAD_EVENT_TRACE64 �Y LINEDDAPROC �B UPDATELAYEREDWINDOWINFO dB ALPC_DIRECT_ATTR �Y PROPENUMPROCA A' TRACE_GUID_PROPERTIES DX EVENT_TRACE_LOGFILEW - �: _MEMORY_PARTITION_PAGEFILE_INFORMATION & "/ _MANAGE_HOT_PATCH_QUERY_PATCHES �Y PKEYBDINPUT $ X _TRACE_ENABLE_FLAG_EXT_HEADER $ ? EVENT_TRACE_INFORMATION_CLASS �Y PACCESS_DENIED_ACE
Y LDR_IMPORT_CALLBACK_INFO ) y; _PROCESS_CHILD_PROCESS_INFORMATION �Y PPROCESS_PRIORITY_CLASS
LPARAM �Y HRGN �" LOGFONTW - �Y _SYSTEM_FIRMWARE_PARTITION_INFORMATION �G LPOSVERSIONINFOEX2A �> EMREXTFLOODFILL o@ tagAR_STATE BYTE �! tagABORTPATH �, tagPOINTER_DEVICE_TYPE RPC_STATUS xV _SLIST_HEADER �G tagEMRNAMEDESCAPE �A _PO_WAKE_SOURCE_INFO 4 �> PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY ! �Y RTL_QUERY_REGISTRY_ROUTINE � _APP_MEMORY_INFORMATION )A threadlocaleinfostruct ' �5 _ETW_COVERAGE_SAMPLER_BLOOM_INFO ) �4 TRANSACTIONMANAGER_LOG_INFORMATION " �) WMI_IMAGELOAD_INFORMATION64 �X PWCRANGE �Y LPMSGBOXPARAMSW ! � _SYSTEM_AUDIT_CALLBACK_ACE ( K3 FILE_IO_PRIORITY_HINT_INFORMATION ' �Y PSYSTEM_SHADOW_STACK_INFORMATION 7 �Y LDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION FC _CONSOLE_SELECTION_INFO �S _SE_ACCESS_REPLY & �Y PFSCTL_QUERY_REGION_INFO_OUTPUT � KUSER_SHARED_DATA �R KEY_SET_LAYER_INFORMATION C _system_handle_t W5 tagCOMPAREITEMSTRUCT * �Y PPROCESS_SYSTEM_RESOURCE_MANAGEMENT �Y PENUMUILANG ! �Y PSHRINK_VOLUME_INFORMATION 4 �Y PSYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION �Y PENCLAVE_TARGET_FUNCTION # PULONGLONG poly8x8x2_t �Y PSE_AUDIT_INFO ! H WNF_STATE_NAME_INFORMATION eY PENHMETARECORD �Y PSYSDBG_TRIAGE_DUMP / �Y PPLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA ~7 RTL_RXACT_LOG �A NPNEWTEXTMETRICA �Y PWMI_IRQ_RECORD |% _KEY_NODE_INFORMATION �Y PDL_EUI48 ! & PERFINFO_BATTERY_LIFE_INFO * 0; EVENT_TRACE_PERFORMANCE_INFORMATION ! <1 PROCESS_WINDOW_INFORMATION @ FP_IEEE_RECORD � _SYSTEM_POWER_INFORMATION �) GESTURECONFIG D> SYSTEM_INFO �X OPERATION_END_PARAMETERS � EMRSETPOLYFILLMODE �> val_context �Y PTOKEN_ACCESS_INFORMATION + oC _CSV_QUERY_FILE_REVISION_FILE_ID_128 byte " PERFINFO_MASK �Y PALPC_DATA_VIEW_ATTR �U RTL_PHYSICAL_MEMORY_INFO > � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT �7 ENCLAVE_INIT_INFO_SGX 3 �Y PTRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION �Y PTP_ALPC 0E PEMRSTROKEPATH ! � WMI_JOB_SET_QUERY_NET_RATE �Y PIMAGE_IMPORT_BY_NAME �Y APP_LOCAL_DEVICE_ID
�% PCWSTR �Y PPO_WAKE_SOURCE_TIMER �9 _IMAGE_HOT_PATCH_BASE �Y PRPC_ANSI_STRING E6 _CONTEXT_EX . HGLRC__ 2 �@ IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION * �Y PALPC_PORT_MESSAGE_ZONE_INFORMATION $ �Y PPPM_IDLE_STATE_ACCOUNTING_EX KG _RC_CONFIG � COPYFILE2_MESSAGE_ACTION �Y PWMIREGINFO J/ _MIDL_METHOD_PROPERTY_MAP �S ETW_CPU_CACHE_FLUSH_EVENT �Y PNT_PRODUCT_TYPE �Y PHARDWARE_COUNTER 6> PO_WAKE_SOURCE_TIMER v _LDR_DDAG_STATE ) W _RTL_DYNAMIC_TIME_ZONE_INFORMATION �% _ETW_CANCEL_KTIMER2_EVENT & �Y PPERFINFO_PPM_IDLE_EXIT_LATENCY - �( _EVENT_EXTENDED_ITEM_PROCESS_START_KEY . �Y PPROCESS_MITIGATION_FONT_DISABLE_POLICY �Y LPCIEXYZTRIPLE ' �Y PWMI_EXTENDED_THREAD_INFORMATION N3 RPC_PROTSEQ_ENDPOINT _ int16x8x2_t , ~Y _SYSTEM_VERIFIER_COUNTERS_INFORMATION {Y PPS_WAKE_REASON �0 HMENU__ $ zY PFILE_TYPE_NOTIFICATION_INPUT F EMREXTESCAPE yY NPIMEMENUITEMINFOW $ uY PFILE_STANDARD_INFORMATION_EX 4" _nlsversioninfoex " _PERFINFO_PROCESS_PERFCTR64 nY _ATOM_TABLE_INFORMATION � _STARTUPINFOA jY PETW_CREATE_HANDLE_EVENT + �W SYSTEM_BASIC_PERFORMANCE_INFORMATION R tagENUMTEXTMETRICA * �9 TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE ) gY RTL_SPARSE_BITMAP_ALLOCATE_ROUTINE 6 �B IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION ' (2 SYSTEM_CODEINTEGRITY_INFORMATION �C SYSTEM_THREAD_INFORMATION � BITMAPINFOHEADER <F TEB_ACTIVE_FRAME_CONTEXT - fY PVIRTUALIZATION_INSTANCE_INFO_INPUT_EX # �> REPAIR_STORAGE_RESERVE_INPUT � tagAXISINFOA eY LPENHMETARECORD �+ tagENUMLOGFONTEXA �U WRITE_USN_REASON_INPUT dY LPNUMBERFMTW
CSHORT % bY WIM_PROVIDER_CONTROL_INTEGRITY " 9 _ETW_HEAP_EVENT_CONTRACTION _Y PTOKEN_LINKED_TOKEN SE_SIGNING_LEVEL $ SV _TXFS_CREATE_MINIVERSION_INFO �D SYSTEM_POWER_STATUS �@ tagFILTERKEYS ]Y _RPC_SECURITY_QOS_V2_A ZY PLDR_VERIFY_IMAGE_INFO ' YY PIR_TIMER_EXTRA_CREATE_PARAMETER XY PPERFINFO_CC_FLUSH_CACHE
! wint_t WY PLDR_DATA_TABLE_ENTRY + �7 _SYSTEM_ACTIVITY_MODERATION_APP_TYPE 4 ENABLE_TRACE_PARAMETERS int8x8x2_t ' �W _FILE_DISPOSITION_INFORMATION_EX $ �? _PLUGPLAY_CUSTOM_NOTIFICATION VY PFOUR_PART_VERSION SY NPREGISTERWORD ! �9 PERFINFO_SYSCALL_EXIT_DATA ) D5 PEVENT_TRACE_LBR_EVENT_INFORMATION " V@ COMPOUND_ACCESS_ALLOWED_ACE QY ETW_CANCEL_TIMER_EVENT " NY PPERFINFO_CCSWAP_IDLE_SHORT , �C _ACTIVATION_CONTEXT_BASIC_INFORMATION ) LY _PERFINFO_CONTIGUOUS_PAGE_GENERATE : HY RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY DY _RPC_SEC_CONTEXT_KEY_INFO * AY PTOKEN_SECURITY_ATTRIBUTE_OPERATION ( �. _DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK ?Y IMAGE_OPTIONAL_HEADER64 =Y PFN_NT_CREATE_TRANSACTION ~> LPDROPSTRUCT
7Y HACCEL 5Y LPSERVICE_TABLE_ENTRYA ! 4Y PFILE_STANDARD_INFORMATION U TOKEN_PRIVILEGES O@ REQUESTER_TYPE / xC SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION tU STARTUPINFOEXA 7 _STATE_LOCATION_TYPE % �? _ENCLAVE_CREATE_INFO_VBS_BASIC � CM_KEYBOARD_DEVICE_DATA - �6 _HEAP_PERFORMANCE_COUNTERS_INFORMATION � LUTF8_STRING . 3Y PSTREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER � PEMRSETSTRETCHBLTMODE , 2Y PSERVICE_CONTROL_STATUS_REASON_PARAMS 1Y PEVENT_TRACE_LOGFILEW 0Y PWOW64_LDT_ENTRY � _SERVICE_NOTIFY_2W 0 BG _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT + �V _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH ' �E _IMAGE_CE_RUNTIME_FUNCTION_ENTRY & �# JOBOBJECT_BASIC_PROCESS_ID_LIST /Y PPPM_THERMAL_POLICY_EVENT �F _SYSDBG_PHYSICAL �= PHANDLETABLE G UNIVERSAL_NAME_INFO ( �S ETW_TP_EVENT_TIMER_EXPIRATION_END V) _IO_SESSION_EVENT # .Y PSECTION_IMAGE_INFORMATION64 � SYNCHRONIZATION_BARRIER -Y PIMEMENUITEMINFOA + �6 PROCESS_STACK_ALLOCATION_INFORMATION $ int8x8_t )B _MUILANGINFO ! ,Y PRTL_WORK_ON_BEHALF_TICKET % *Y _PERFINFO_CC_WORKITEM_COMPLETE ) K6 SYSTEM_SESSION_POOLTAG_INFORMATION 0 : MEMORY_PARTITION_PAGE_COMBINE_INFORMATION & 9B FILE_MAILSLOT_QUERY_INFORMATION , 9 RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET $ �U _SYSTEM_EXCEPTION_INFORMATION 'Y LPHW_PROFILE_INFOW &Y PFILE_ATTRIBUTE_TAG_INFO s+ PMDINEXTMENU ' < RPC_BINDING_HANDLE_TEMPLATE_V1_W " %Y PFN_NT_ROLLBACK_TRANSACTION * q6 SYSTEM_DMA_GUARD_POLICY_INFORMATION �= FILE_PREFETCH t PBOOL � PRTL_BALANCED_NODE "Y PKEY_CACHED_INFORMATION !Y PFPO_DATA Y PCIMAGE_IMPORT_BY_NAME / Y PSYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION E: PCANDIDATELIST p LPUTSTR . Y PFSCTL_SET_INTEGRITY_INFORMATION_BUFFER � _TRANSACTION_NOTIFICATION 2 G ACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA & Y PALPC_PORT_CALLBACK_INFORMATION W _SERVICE_FAILURE_ACTIONSW �$ _TOKEN_ACCESS_INFORMATION : OX TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION - �! _JOBOBJECT_END_OF_JOB_TIME_INFORMATION . X' _TRANSACTIONMANAGER_LOGPATH_INFORMATION
" PCLONG �D TOKEN_ELEVATION �+ PMUICCENTRY �# tagNEWTEXTMETRICW G tagEMRSETPALETTEENTRIES �9 tagTRACKMOUSEEVENT Y PMEMORY_WORKING_SET_BLOCK Y PFXSAVE_FORMAT_WX86 b$ SIZEL 6 MESSAGE_TRACE_USER & Y PSYSTEM_PAGEFILE_INFORMATION_EX Y PRTL_BSD_ITEM >( EMRPOLYLINETO16 * �* _SYSTEM_SESSION_PROCESS_INFORMATION # �W _SECTION_IMAGE_INFORMATION64 � PBITMAPINFOHEADER �A SERVICE_TABLE_ENTRYA LONG , �/ _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER 2 77 _FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX |; NPLOGPALETTE L _EFI_DRIVER_ENTRY Y PENCLAVE_ROUTINE oX value_entW Y PHEAP_COMMIT_DECOMMIT s uint8x16_t " �' TOKEN_GROUPS_AND_PRIVILEGES Y PSYMBOLIC_LINK_INFO_CLASS �> _PERFINFO_PO_POSTSLEEP PSSIZE_T �6 LOGICAL_DISK_DEFRAG Y _ALPC_DATA_VIEW_ATTR Y PIMAGE_ARCHITECTURE_ENTRY �4 ETW_CREATE_HANDLE_EVENT
Y PLDR_IMPORT_CALLBACK_INFO " Y PSYSTEM_POWER_STATE_CONTEXT ) E RTL_FEATURE_CONFIGURATION_PRIORITY .> MONITORINFOEXA ' Y PJOBOBJECT_BASIC_UI_RESTRICTIONS $ j _FILE_PIPE_REMOTE_INFORMATION 3 �. FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX � POWER_STATE_TYPE oG COVERAGE_MODULE_INFO z# _MUICCHEADER Y PCNTSTATUS �: _SID_IDENTIFIER_AUTHORITY kW RTL_BUFFER �, _DOCINFOW @F STORAGE_RESERVE_AREA_INFO , Y PJOURNAL_SET_DELETE_VALUE_INFORMATION Y PDEVMODE �E _ETW_CRITSEC_EVENT_INIT �G FILE_FS_LABEL_INFORMATION ! �R KEY_WRITE_TIME_INFORMATION � EXCEPTION_DISPOSITION $ � _SECURITY_IMPERSONATION_LEVEL Y LPSERIALKEYS ]< _PEB_LDR_DATA Y PCIMAGE_IMPORT_DESCRIPTOR �= _SD_QUERY_STATS_INPUT Y PGHOSTED_FILE_EXTENT 0 ?& _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES % �X PIMAGE_DYNAMIC_RELOCATION32_V2 &6 EVENT_BASIC_INFORMATION d CLIENTCREATESTRUCT " �% _WMI_JOB_SET_QUERY_CPU_RATE $ �X PREPAIR_STORAGE_RESERVE_INPUT 1 3W RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER kR EMRRESIZEPALETTE �X HSYNTHETICPOINTERDEVICE + �9 _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE �! tagEMRSETVIEWPORTORGEX �- NONCLIENTMETRICSW % �X PBOOT_ENTROPY_SOURCE_NT_RESULT - F _JOURNAL_CREATE_DELETE_KEY_INFORMATION �X RTL_TREE_DELETE_FUNCTION 5 �X PPROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY UD EMRSTROKEANDFILLPATH �X NPWNDCLASSEXA REFS_SMR_VOLUME_GC_METHOD % �U RTL_PROCESS_BACKTRACES_CONTROL ( �X PRTL_IMAGE_MITIGATION_HEAP_POLICY 38 SOUNDSENTRYW �X PWNDCLASSEXA �1 STYLEBUFW ER tagWNODE_EVENT_REFERENCE �X _MEMORY_FRAME_INFORMATION $ �X PWORKER_FACTORY_DEFERRED_WORK ! �X PSECTION_IMAGE_INFORMATION �X PSCOPE_TABLE �V DIAGNOSTIC_BUFFER �/ tagEMRSETDIBITSTODEVICE K* NORM_FORM E2 _STREAM_INFO_LEVELS �, DRAWPATRECT �X PSMALL_RECT �X PSE_IMPERSONATION_STATE �X LPMETAHEADER �X LPHIGHCONTRASTA / �X PPROCESS_REVOKE_FILE_HANDLES_INFORMATION + �0 _SYSTEM_WRITE_CONSTRAINT_INFORMATION }@ MUILANGCFGNODE $ �X PCTEB_ACTIVE_FRAME_CONTEXT_EX �X FILE_POSITION_INFORMATION �Q RTL_FEATURE_CONFIGURATION � _REMOTE_PORT_VIEW " NLS_FUNCTION % �X PTXFS_WRITE_BACKUP_INFORMATION 9 �X PCACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION � TRACE_LOGFILE_HEADER64 3 _FILE_STREAM_INFO � RpcPerfCounters * M) ETW_UMS_EVENT_DIRECTED_SWITCH_START �! _TRANSACTION_STATE 8 RPC_SYNTAX_IDENTIFIER
@ FILE_BOTH_DIR_INFORMATION - �X PJOURNAL_CREATE_DELETE_KEY_INFORMATION , F _TRANSACTIONMANAGER_INFORMATION_CLASS 1 �X RTL_SPARSE_BITMAP_UPDATE_METADATA_CALLBACK C9 DEVMODEW " �' tagRID_DEVICE_INFO_KEYBOARD �1 IMAGE_ENCLAVE_CONFIG32 $ aF _FILE_PIPE_SILO_ARRIVAL_INPUT ! D. OPERATION_START_PARAMETERS ' �X DISPLAYCONFIG_TARGET_DEVICE_NAME �X PIMAGE_FUNCTION_ENTRY uint8x8x2_t ! �X PPO_FIXED_WAKE_SOURCE_TYPE >" CM_VIDEO_DEVICE_DATA $ � _ENLISTMENT_INFORMATION_CLASS Y( WOW64_LDT_ENTRY . LPSECURITY_ATTRIBUTES # �X PETW_OPTICALIO_FLUSH_BUFFERS 1, _QUAD ) �D ALPC_PORT_MESSAGE_ZONE_INFORMATION �" _KEY_FULL_INFORMATION �/ _INITIAL_TEB ( p8 _MEMORY_ENCLAVE_IMAGE_INFORMATION _TP_CALLBACK_ENVIRON_V3 :
PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION � tagHANDLETABLE ) �X PSE_LEARNING_MODE_USER_OBJECT_DATA % �D ALPC_MESSAGE_INFORMATION_CLASS . DEDUP_FILE_OPERATION # �X PPERFINFO_MEMORY_INFORMATION - � ETW_COVERAGE_SAMPLER_INFORMATION_CLASS 3 �X PTOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE # R# _TEB_ACTIVE_FRAME_CONTEXT_EX 3 �X _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX �0 tagNONCLIENTMETRICSA �X PTERMINATION_HANDLER X< EMRFILLRGN `S _THREAD_PERFORMANCE_DATA �B _WOF_EXTERNAL_FILE_ID " �X PSYSTEM_PROCESS_INFORMATION * b7 MEM_SECTION_EXTENDED_PARAMETER_TYPE �V POSVERSIONINFOA S< _PHYSICAL_DISK_RECORD � int8x8x4_t 3< CM_Power_Data_s �X PEMRPOLYDRAW # �> PROCESS_WS_WATCH_INFORMATION ) �3 FSCTL_QUERY_STORAGE_CLASSES_OUTPUT �W _IMAGE_DATA_DIRECTORY * FILE_FS_SIZE_INFORMATION # �X I_RpcProxyGetClientAddressFn � _ULARGE_INTEGER �X PERFINFO_WORKINGSET_ENTRY �X CSV_IS_OWNED_BY_CSVFS p EVENTLOG_HANDLE_A $ uint64x1_t $ �X PENLISTMENT_BASIC_INFORMATION H _TP_LOG_LEVEL g _RTL_TRACE_ENUMERATE p NPSTR _= SYSTEM_AUDIT_OBJECT_ACE * _ACCESS_REASONS �X PCI_LOG_MMCSS_STOP Z _SID_AND_ATTRIBUTES_HASH �X PPS_STD_HANDLE_INFO �X PLOAD_DLL_EVENT_DATA E6 CONTEXT_EX [V _COUNTED_REASON_CONTEXT �X PACTCTXW ' �X PRTL_SPARSE_BITMAP_CTX_OPERATION " Y) PARTITION_INFORMATION_CLASS # 7 FILE_FS_OBJECTID_INFORMATION , T% REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER �X PPPM_THERMALCHANGE_EVENT TF _KEY_CACHED_INFORMATION % _DMA_WIDTH �X PRTL_RUN_ONCE &X MESSAGE_RESOURCE_DATA �* PLARGE_INTEGER �% SYSTEM_POOL_ENTRY �X LPWCRANGE � EMRSETMAPMODE PSID & �X ETW_ANTI_STARVATION_BOOST_EVENT �5 CI_LOG_SCHEDULER_SLEEP 4$ _TIMER_INFORMATION_CLASS �' _LDR_DLL_LOAD_REASON Y$ _WOW64_FLOATING_SAVE_AREA 3 �X PTRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT ' �X PREDIRECTION_FUNCTION_DESCRIPTOR # PERFINFO_TIMESTAMP �X PSYSDBG_VIRTUAL �X PRTL_HANDLE_TABLE �) MULTIKEYHELPW % � _PROCESS_HANDLE_TRACING_ENABLE �X PCSV_QUERY_MDS_PATH_V2 2 �E CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE & �X PMEMORY_WORKING_SET_EX_LOCATION � PCWPSTRUCT �X PPERFINFO_FLT_OPERATION # PDWORD64 � uint32x2x3_t �, IMAGE_POLICY_ENTRY_TYPE � PEMRSELECTCLIPPATH )$ tagCURSORINFO ) � DIRECTORY_NOTIFY_INFORMATION_CLASS �C FILE_ALLOCATION_INFO �X PMIDL_METHOD_PROPERTY_MAP # �B PERFINFO_CC_WORKITEM_DEQUEUE ) �X PCLDR_DLL_LOADED_NOTIFICATION_DATA �X MEMORY_FRAME_INFORMATION �0 SCROLLBARINFO �X HIMCC �; PPERFINFO_TRACE_ENTRY % �X PPERFINFO_FLT_OPERATION_STATUS JT BOOT_OPTIONS 5 ; _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST & �X PRTL_DYNAMIC_HASH_TABLE_CONTEXT �X PACTCTXA z7 tagIMECHARPOSITION � int64x1x3_t �X PFP_IEEE_RECORD �+ RTLP_HEAP_TAGGING_INFO �X LPCPINFOEX ! 6G _PERFINFO_FILE_INFORMATION �X PENCLAVE_CREATE_INFO_VBS �X PMUILANGLIST !U PERFINFO_IO_TIMER u ULONG32 �X PSINGLE_LIST_ENTRY32 * �8 EVENT_TRACE_PROFILE_ADD_INFORMATION ! �G _FILE_FS_LABEL_INFORMATION * Q+ _SYSTEM_FEATURE_CONFIGURATION_QUERY �X LPMDICREATESTRUCTW $ �X PETW_KTIMER2_EXPIRATION_EVENT �! int8x16x3_t � _tag_ARMINTR_BARRIER_TYPE �X PPHYSICAL_DISK_RECORD & 6' _LINK_TRACKING_INFORMATION_TYPE �6 _tag_ARMINTR_SHIFT_T � MEM_EXTENDED_PARAMETER . JE READ_DIRECTORY_NOTIFY_INFORMATION_CLASS * G ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN � SILO_USER_SHARED_DATA + _FSINFOCLASS gX HINSTANCE__ a< _ETW_BUFFER_CONTEXT ! �- MEMORY_COMBINE_INFORMATION , a) _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA �X POPERATION_END_PARAMETERS . �X PRTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY G UNIVERSAL_NAME_INFOA �% LPCOMPOSITIONFORM �( TOKEN_DEVICE_CLAIMS )? PGLYPHSET , �X PPERFINFO_DYNAMIC_TICK_DISABLE_REASON ' �X PSYSTEM_DPC_BEHAVIOR_INFORMATION ( 8W _SYSTEM_LEGACY_DRIVER_INFORMATION ( W _MIDL_INTERFACE_METHOD_PROPERTIES " _WATCHDOG_INFORMATION_CLASS + X PRPC_HTTP_TRANSPORT_CREDENTIALS_V2_A # > UMS_CREATE_THREAD_ATTRIBUTES ' ~X PCRITICAL_PROCESS_EXCEPTION_DATA �T _EXIT_PROCESS_DEBUG_INFO >B PERFINFO_SPINLOCK_CONFIG & �U _KEY_VIRTUALIZATION_INFORMATION �2 LPDISPLAY_DEVICEA HDEVNOTIFY <V tagMONITORINFOEXW �D REPAIR_COPIES_OUTPUT , �< _SYSTEM_INTERRUPT_CPU_SET_INFORMATION $ �E _PLUGPLAY_CONTROL_STATUS_DATA + }X PFSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT ! �1 tagWTSSESSION_NOTIFICATION |X PTEB_ACTIVE_FRAME_EX �9 _LPC_CLIENT_DIED_MSG # {X PPROCESSOR_POWER_POLICY_INFO L. _SD_QUERY_STATS_OUTPUT { _WIN32_FIND_DATAW v9 FILE_CASE_SENSITIVE_INFO yX LPLOGBRUSH32 " �$ RTL_GENERIC_COMPARE_RESULTS �D tagPOINTER_INFO �? _SYSTEM_ACCESS_FILTER_ACE zX PSERVICE_NOTIFY_2A yX NPLOGBRUSH32 sX PPERFINFO_VAD_ROTATE_INFO qX LPMSGBOXPARAMS mX PVALENTW RTL_REFERENCE_COUNT32
p PCCHAR � STARTUPINFOW , iX PCSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT ) _PERFINFO_DYNAMIC_TICK_VETO_REASON 4 HMODULE | _WIN32_FIND_DATAA dX FILE_REFERENCE_RANGE & bX PPROCESS_MEMORY_EXHAUSTION_INFO aX PSPARSE_OVERALLOCATE_DATA MOFHANDLE NG _RPC_IF_ID `X PPPM_IDLE_STATE_BUCKET_EX , �: MEMORY_PARTITION_PAGEFILE_INFORMATION % $9 PROCESS_MEMORY_EXHAUSTION_INFO _X PSE_SECURITY_DESCRIPTOR ^X PPS_PKG_CLAIM & ]X PWIM_PROVIDER_ADD_OVERLAY_INPUT $ YX PSYSTEM_LOOKASIDE_INFORMATION - WX PPLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA P- _TP_TASK_CALLBACKS ( �S _LOOKUP_STREAM_FROM_CLUSTER_ENTRY # VX RTL_GENERIC_ALLOCATE_ROUTINE ! �W UNWIND_HISTORY_TABLE_ENTRY �/ FILE_RENAME_INFORMATION RX PVCN_RANGE_INPUT_BUFFER @ PEMRCLOSEFIGURE �U LPMODEMDEVCAPS � PERFINFO_CCSWAP ; KX PTOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION ) , SYSTEM_SESSION_BIGPOOL_INFORMATION IX LPRAWKEYBOARD HX LPNMHDR �U _GLYPHMETRICS ) �0 _TXFS_ROLLFORWARD_REDO_INFORMATION � FSCTL_OFFLOAD_WRITE_INPUT W9 LPFILETIME GX PMMPFN_IDENTITY FX PKTMOBJECT_CURSOR DX _EVENT_TRACE_LOGFILEW 4 _SYSTEM_PIXEL_FORMAT SECTION_INFORMATION_CLASS �? _PO_WAKE_SOURCE_INTERNAL `R RTL_FEATURE_USAGE_DATA $ �: _WORKER_FACTORY_DEFERRED_WORK ' M JOBOBJECT_RATE_CONTROL_TOLERANCE �S tagEMRROUNDRECT AX PEMRFORMAT �W _FILE_QUOTA_INFORMATION " & _REQUEST_RAW_ENCRYPTED_DATA @X PMEMORY_IMAGE_INFORMATION 0 < TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT ?X LPEXIT_PROCESS_DEBUG_INFO + >X PCLDR_DLL_UNLOADED_NOTIFICATION_DATA # <X PREFS_SMR_VOLUME_INFO_OUTPUT & ;X PPERFINFO_SAMPLED_PROFILE_CACHE 3 :X PSYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION �, FLOAT128 # 9X PFILE_ALLOCATED_RANGE_BUFFER
/ LPINIT_ONCE d= NEWTEXTMETRICA 4 ' _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM ! 8X PEVENT_EXTENDED_ITEM_TS_ID �B _DEBUG_EVENT 7X PLOGICAL_DISK_DEFRAG �E OPTICAL_MEDIA_RECORD 0 �E STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY 6X PFIRMWARE_TYPE � _SYSTEM_TPM_INFORMATION � _ACL_INFORMATION_CLASS ! 5X PTXFS_QUERY_RM_INFORMATION �F _RTL_FEATURE_USAGE_REPORT 4X PTP_JOB ( aG LPCREATEFILE2_EXTENDED_PARAMETERS $ float32x2_t 3X PALPC_DIRECT_ATTR ! < _JOURNAL_INFORMATION_CLASS + � _PLUGPLAY_CONTROL_USER_RESPONSE_DATA 2X LPNETCONNECTINFOSTRUCT & �: _EVENT_EXTENDED_ITEM_PEBS_INDEX 1X PDYNAMIC_FUNCTION_TABLE �, HCOLORSPACE__ 0X PRPC_IMPORT_CONTEXT_P $ �6 VIRTUAL_STORAGE_BEHAVIOR_CODE /X PIO_RESOURCE_LIST �/ PENUMTEXTMETRICA " �9 _ENABLE_TRACE_PARAMETERS_V1 " -X _FILE_ZERO_DATA_INFORMATION 5 *X PRTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY & �@ PRTL_PROCESS_REFLECTION_ROUTINE )X LPREMOTE_NAME_INFOA �: _ALPC_BASIC_INFORMATION 0 �D FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX " (X PSYSTEM_POWER_LOGGING_ENTRY &X _MESSAGE_RESOURCE_DATA V tagEMRCREATEPALETTE !X AUDIODESCRIPTION p PTSTR ( X PIMAGE_LOAD_CONFIG_CODE_INTEGRITY X PCPTABLEINFO , #, _RTL_USER_PROCESS_EXTENDED_PARAMETERS X PIMAGE_THUNK_DATA32 & �G _SYSTEM_PERFORMANCE_INFORMATION & X WIN32_MEMORY_REGION_INFORMATION �V HARDWAREHOOKSTRUCT # A _KEY_VALUE_LAYER_INFORMATION � _WOW64_CONTEXT X KENTROPY_TIMING_ROUTINE # �F WOW64_DESCRIPTOR_TABLE_ENTRY } HBRUSH__
X PDIAGNOSTIC_BUFFER # X TRACE_ENABLE_FLAG_EXT_HEADER " SE _MEMORY_BASIC_INFORMATION32 X WINSTAENUMPROCA 4 QD _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION X PREDIRECTION_DESCRIPTOR �! EMRABORTPATH
B PCUUCSCHAR ? _FP_128 X LPCMENUITEMINFOW ! �; JOBOBJECT_WAKE_INFORMATION " �T FILE_FS_CONTROL_INFORMATION ! X ENTER_STATE_NOTIFY_HANDLER 0 U SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION �$ poly8x16x4_t & X PCM_PNP_BIOS_INSTALLATION_CHECK # ULONG64 � EMRSETCOLORSPACE X LPDLGTEMPLATEW � WNODE_EVENT_ITEM ( �F WIM_PROVIDER_REMOVE_OVERLAY_INPUT & �, CI_WINDOWS_LOCKDOWN_RESTRICTION ) X PRTL_YIELD_UNTIL_CONDITION_ROUTINE % �W DISPLAYCONFIG_TARGET_BASE_TYPE �W LPFMTID * Z2 _SECTION_INTERNAL_IMAGE_INFORMATION GE CONSOLE_HISTORY_INFO # �W PPARTITION_INFORMATION_CLASS FP_OPERATION_CODE " �D _FSCTL_QUERY_FAT_BPB_BUFFER $ �W PEXTENDED_ENCRYPTED_DATA_INFO ' �+ _SYSTEM_POOL_ZEROING_INFORMATION " ,2 SHRINK_VOLUME_REQUEST_TYPES + �W PFN_NT_QUERY_INFORMATION_TRANSACTION % � PUBLIC_OBJECT_TYPE_INFORMATION � _KCONTINUE_ARGUMENT 16 SERVICE_ERROR_TYPE " _SERVICE_DESCRIPTIONW �$ int32x4x4_t �W PFSCTL_OFFLOAD_READ_INPUT �W PIMAGE_RELOCATION �W PWNF_DATA_SCOPE �+ ENUMLOGFONTEXA � tagCWPSTRUCT 30 PERFINFO_MM_STAT 2 YR _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION �D _LDRP_CSLIST 5 �8 SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY �W PCPU_CONFIG_RECORD + �0 PERFINFO_DYNAMIC_TICK_DISABLE_REASON L _SUITE_TYPE �5 _FILE_OBJECTID_BUFFER #" _POWER_STATE * �W PSYSTEM_SESSION_POOLTAG_INFORMATION �' LDR_DLL_LOAD_REASON �W PEMRCREATEBRUSHINDIRECT �W PETW_HEAP_EVENT_CREATE &8 IMAGE_AUX_SYMBOL_EX # A5 SECURITY_DESCRIPTOR_RELATIVE 3 FILE_STREAM_INFO �S _IMAGE_RESOURCE_DIRECTORY _PS_PROTECTION B CONNECTDLGSTRUCTA , �W PSYSTEM_BASIC_PERFORMANCE_INFORMATION �W LOCALE_ENUMPROCEX ) NW FILE_QUERY_ON_DISK_VOL_INFO_BUFFER \ RTL_UMS_SCHEDULER_REASON �F LPWINDOWINFO p PNZCH B- SD_ENUM_SDS_ENTRY � EMRDELETECOLORSPACE # 4 ETW_UMS_EVENT_CONTEXT_SWITCH �W PREAD_USN_JOURNAL_DATA_V1 % �- _SYSDBG_LIVEDUMP_CONTROL_FLAGS $ 'H _TRACE_PROVIDER_INSTANCE_INFO _ETW_BUFFER_STATE �W PETW_HEAP_EVENT_SNAPSHOT 1 $ PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION $ 6D _JOURNAL_ABSOLUTE_INFORMATION ( �W PRTL_IMAGE_MITIGATION_ASLR_POLICY " �W PSYSDBG_KD_PULL_REMOTE_FILE ) �B _WMI_EXTENDED_THREAD_INFORMATION64 �" _HIBERFILE_BUCKET_SIZE �W _WOF_EXTERNAL_INFO �W PRTL_FEATURE_USAGE_DATA �W PCM_KEYBOARD_DEVICE_DATA �W PIMAGE_DATA_DIRECTORY # �W PSYSTEM_PAGEFILE_INFORMATION �* RTL_DRIVE_LETTER_CURDIR 80 _VARIABLE_NAME # �W PRTL_GENERIC_COMPARE_ROUTINE " �9 ETW_DISKIO_FLUSH_BUFFERS_V3 " � SERVERSILO_INIT_INFORMATION & �W PFILE_IO_COMPLETION_INFORMATION �W PETW_READY_THREAD_EVENT �# _IO_STATUS_BLOCK32 �W PERFINFO_CC_FLUSH_CACHE * �; PERFINFO_DOMAIN_CHANGE_EVENT_REASON
" SIZE_T ! *& _KEY_SET_INFORMATION_CLASS ^U tagICONMETRICSW & �V _PERFINFO_SAMPLED_PROFILE_CACHE #1 IMAGE_OPTIONAL_HEADER32 �W FILE_QUOTA_INFORMATION ( SERVICE_LOAD_TYPE 2 �W PRTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER ' �W PFILE_DISPOSITION_INFORMATION_EX & �W PFILE_PROVIDER_EXTERNAL_INFO_V0 �& RTL_UMS_CONTEXT $ =$ ETW_TP_EVENT_CALLBACK_ENQUEUE � ETW_WNF_EVENT_SUBSCRIBE " �W _UNWIND_HISTORY_TABLE_ENTRY 0 �; JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION �B WOF_EXTERNAL_FILE_ID * �W PSYSTEM_KERNEL_DEBUGGER_INFORMATION � PLUGPLAY_CONTROL_CLASS �G _RTL_HEAP_PARAMETERS
@ PFLOAT # �W PENCLAVE_LOAD_DATA_VBS_BASIC
HLOCAL % �W PIMAGE_BOUND_IMPORT_DESCRIPTOR �W PUSN_RECORD_V2 yU _RTL_HANDLE_TABLE ( �W PSYSTEM_MANUFACTURING_INFORMATION }- EMREXTTEXTOUTW W SERVICE_FAILURE_ACTIONSW ! �W PWMI_IMAGEID_INFORMATION32 # �W PFILE_SET_DEFECT_MGMT_BUFFER �5 _CM_SERVICE_NODE_TYPE �W LPRGBQUAD �3 SRWLOCK �W PFILE_DISPOSITION_INFO - �W _CLAIM_SECURITY_ATTRIBUTES_INFORMATION
�W PTP_IO � _IMAGE_MITIGATION_POLICY +# CWPRETSTRUCT " �W PSYSTEM_MANDATORY_LABEL_ACE $ : JOBOBJECT_WAKE_INFORMATION_V1 & PT PROCESS_LEAP_SECOND_INFORMATION " �W PFILE_GET_QUOTA_INFORMATION �W PETW_REF_CLOCK �W PKERNEL_USER_TIMES 0 �W PSYSTEM_NET_RATE_CONTROL_DISPATCH_ROUTINE �T _KEY_NAME_INFORMATION �G _RPC_POLICY # � GENERIC_BINDING_ROUTINE_PAIR � _WGLSWAP �W tagUSAGE_PROPERTIES t5 _PERFINFO_MEM_RESET_INFO , �T ACTIVATION_CONTEXT_SECTION_KEYED_DATA - LPSYSTEMTIME P; EMRCREATEPEN - 1 _TRANSACTIONMANAGER_OLDEST_INFORMATION �W MONITORENUMPROC $ k@ FSCTL_QUERY_REGION_INFO_INPUT ' � RTL_FEATURE_CONFIGURATION_UPDATE 2 WINDOWS_OS_OPTIONS 8A CM_EISA_SLOT_INFORMATION �W LPDLGTEMPLATE �G _SC_ACTION # �R _TIMER_SET_INFORMATION_CLASS 7 � _MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION d= tagNEWTEXTMETRICA ;U MESSAGE_TRACE_HEADER �) NT_TIB64 / �W PPROCESS_READWRITEVM_LOGGING_INFORMATION , �; SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT � PRTL_UMS_COMPLETION_LIST - PROCESSOR_CACHE_TYPE / �4 RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY �= _FILE_ALL_INFORMATION �W PSTRING32 �W PT2_SET_PARAMETERS & �W PSYSTEM_LEAP_SECOND_INFORMATION 0 1 SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION �W PETW_WNF_EVENT_CALLBACK " �W _SYSTEM_POWER_LOGGING_ENTRY & > _PROCESSOR_PROFILE_CONTROL_AREA & �C RTL_IMAGE_MITIGATION_DEP_POLICY �W PTOKEN_CONTROL " �W PWIM_PROVIDER_OVERLAY_ENTRY .> tagMONITORINFOEXA � LUID % = _FILE_PIPE_EVENT_SELECT_BUFFER " � BAD_MEMORY_CALLBACK_ROUTINE �W PRID_DEVICE_INFO s int16x8_t rW _FILE_STORAGE_TIER_REGION " �W SECTION_IMAGE_INFORMATION64 @D NPEVENTMSG zW LPMONITORINFOEX ) A _ETW_UMS_EVENT_DIRECTED_SWITCH_END 71 SYSTEM_FLUSH_INFORMATION $ yW PETW_TP_EVENT_POOL_TH_MIN_SET �7 _PS_MEMORY_RESERVE $ xW POBJECT_DIRECTORY_INFORMATION h DISPLAYCONFIG_TOPOLOGY_ID X6 CBTACTIVATESTRUCT ' �@ _PERFINFO_WORKINGSET_INFORMATION R PNP_QUERY_RELATION % 8 SYSTEM_LEAP_SECOND_INFORMATION # |& HEAP_BLOCK_EXTRA_INFORMATION # YE PROCESS_HANDLE_TRACING_ENTRY �8 _ETW_HEAP_EVENT_RUNDOWN �. TXFS_START_RM_INFORMATION �< _MEM_ADDRESS_REQUIREMENTS �- _DEVICE_FLAGS �' tagEMRPOLYTEXTOUTA a PERFINFO_GROUPMASK �- _MEMORYSTATUSEX u POINTER_FLAGS pW PFILE_STORAGE_TIER_REGION nW PPROFILE_SOURCE_INFO �6 _SD_ENUM_SDS_OUTPUT �1 pvalueA ^5 MEMORY_INFORMATION_CLASS � NDR_NOTIFY_ROUTINE & mW PLINK_TRACKING_INFORMATION_TYPE iW PRTL_BUFFER hW FONTENUMPROCW `W _IMAGE_SYMBOL ! �D FSCTL_QUERY_FAT_BPB_BUFFER 8 v# SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION � tagSOUNDSENTRYA + � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION \W ENHMFENUMPROC �< POINTER_DEVICE_INFO � int8x8x3_t JT _BOOT_OPTIONS j% PMOUSEHOOKSTRUCTEX �$ ETW_READY_THREAD_EVENT WW WNF_META_CALLBACK U _KLDR_DATA_TABLE_ENTRY32 ! $3 _SYSTEM_MEMORY_INFORMATION �. MAXVERSIONTESTED_INFO UW LAYERPLANEDESCRIPTOR RW PPVALUE �* EVENT_TYPE ' sV SYSTEM_MANUFACTURING_INFORMATION QW PEVENT_BASIC_INFORMATION }@ _MUILANGCFGNODE + #, RTL_USER_PROCESS_EXTENDED_PARAMETERS z KERNINGPAIR PW PEMRSTRETCHBLT uint32x2x2_t * NW _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER _WMI_PNP_RECORD_V5 * �R _VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT % N+ RTL_FEATURE_CONFIGURATION_TYPE � PDELETEITEMSTRUCT _WMI_JOB_ASSIGN_PROCESS PTUCHAR % JW PFILE_ZERO_DATA_INFORMATION_EX * Z FILE_STORAGE_RESERVE_ID_INFORMATION �+ SERIALKEYS ( �4 _RPC_HTTP_TRANSPORT_CREDENTIALS_A �1 STICKYKEYS b$ tagSIZE �! poly16x8x3_t * h5 _KEY_SET_VIRTUALIZATION_INFORMATION � IO_SESSION_STATE IW PCI_WINDOWS_LOCKDOWN_MODE 'S RTL_ELEVATION_FLAGS 0 �. _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION Q" _FP__IEEE_ROUNDING_MODE # HW PETW_CRITSEC_EVENT_COLLISION ! �, _IMAGE_COFF_SYMBOLS_HEADER GW PCIMAGE_TLS_DIRECTORY32 E TXFS_LIST_TRANSACTIONS s TRANSACTION_OUTCOME $ EW PEVENT_TRACE_BUFFER_CALLBACKW r, SERVICE_NOTIFY_2A �' IMAGE_HOT_PATCH_INFO # � ReplacesCorHdrNumericDefines � SE_IMPERSONATION_STATE �F FILE_SET_SPARSE_BUFFER @W PRTL_TICK_LOCK
# UINT64 .. IMAGE_TLS_DIRECTORY ' >W PROCESS_DEVICEMAP_INFORMATION_EX - $@ PROCESS_MITIGATION_DYNAMIC_CODE_POLICY ;W PCM_MONITOR_DEVICE_DATA $ �( DYNAMIC_TIME_ZONE_INFORMATION 4 tagTTPOLYGONHEADER �U LPGUITHREADINFO �B _ETW_DEBUG_PRINT_EVENT . SYSTEM_AUDIT_ACE ^5 _MEMORY_INFORMATION_CLASS :W LPDISCDLGSTRUCTA + F1 _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO ( 6W PSYSTEM_LEGACY_DRIVER_INFORMATION 2 3W _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER 0 �8 _EVENT_TRACE_SESSION_SECURITY_INFORMATION 0 �> _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY -W PPOWER_SESSION_CONNECT ! �G _TP_POOL_STACK_INFORMATION q PREGISTERWORDW +W PETW_WNF_EVENT_SUBSCRIBE 3 �; _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT *; RTL_RELATIVE_NAME_U hT _RTL_HEAP_STACK_QUERY �7 WNODE_METHOD_ITEM EMRPOLYBEZIERTO ) D5 PEVENT_TRACE_IPT_EVENT_INFORMATION q PWCH # � FILE_TYPE_NOTIFICATION_INPUT �2 EMRCREATECOLORSPACE
+ tagCREATESTRUCTA W _PERFINFO_DEBUG_EVENT
42 _FP_80 *W ENTER_STATE_HANDLER )W PRPC_SERVER_INTERFACE � RTL_RESOURCE_DEBUG32 " DWORD (W PCTEB_ACTIVE_FRAME_EX ) tagLOGBRUSH # &W LPTOP_LEVEL_EXCEPTION_FILTER # � _SERVERSILO_INIT_INFORMATION %W PUSN_RECORD W PSL_KMEM_CACHE �7 UNICODE_PREFIX_TABLE
" RULONG W PFILE_PREFETCH �# WNODE_TOO_SMALL . � PROCESS_STACK_ALLOCATION_INFORMATION_EX 5 �C _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION W PERFINFO_DEBUG_EVENT " � IMAGE_DYNAMIC_RELOCATION_V2 , �6 HEAP_PERFORMANCE_COUNTERS_INFORMATION b _STREAM_EXTENT_ENTRY W PFILE_ALIGNMENT_INFO S! MENUINFO # O9 ENUM_SERVICE_STATUS_PROCESSW
! UINT16 8) _ALPC_SECURITY_ATTR $ W EXTENT_READ_CACHE_INFO_BUFFER �7 _POWER_SESSION_RIT_STATE �< ENUMLOGFONT �! EMRENDPATH ' W MIDL_INTERFACE_METHOD_PROPERTIES � ETW_OBJECT_HANDLE_EVENT 6, SECURITY_CAPABILITIES ( W RTL_IMAGE_MITIGATION_SEHOP_POLICY -9 IPT_TRACE_EVENT_DATA ( W PETW_COVERAGE_SAMPLER_STATUS_INFO ) W PRTL_DYNAMIC_TIME_ZONE_INFORMATION ! �V LPSERVICE_FAILURE_ACTIONSW �2 _ETW_HEAP_EVENT_ALLOC - �V PSERVICE_CONTROL_STATUS_REASON_PARAMSA �U REPARSE_INDEX_KEY $ L> MANAGE_HOT_PATCH_UNLOAD_PATCH �V LPOSVERSIONINFOA RAWMOUSE " �V ETW_CRITSEC_EVENT_COLLISION % �V PERFINFO_SAMPLED_PROFILE_CACHE ( ! TRACE_PERIODIC_CAPTURE_STATE_INFO f2 PCSTR � LPENUMLOGFONTEXDVA " E _FILE_FS_DEVICE_INFORMATION �@ PRTL_ACQUIRE_LOCK_ROUTINE �= IMAGE_IMPORT_DESCRIPTOR
�/ SE_SID * nT FILE_LINK_ENTRY_FULL_ID_INFORMATION � REPAIR_COPIES_INPUT � FP_IEEE_FORMAT , �V _SYSTEM_PROCESS_INFORMATION_EXTENSION - �T _ACTIVATION_CONTEXT_SECTION_KEYED_DATA
f2 LPCSTR �D EXCEPTION_LOG � PARSE_MESSAGE_CONTEXT PLONG_PTR " �( _SYSTEM_CPU_SET_INFORMATION , �V _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE 7- ACCESS_ALLOWED_ACE # �3 DEFINE_STORAGE_RESERVE_INPUT �! HIGHCONTRAST + �% _PROCESS_KEEPALIVE_COUNT_INFORMATION �= SD_QUERY_STATS_INPUT WMIHANDLE �V PCULONG $ �V PREFS_DEALLOCATE_RANGES_RANGE �V PFN_NT_OPEN_TRANSACTION � PRTL_UMS_CONTEXT u TOUCH_MASK �V LPSC_ACTION + �6 FILE_IOSTATUSBLOCK_RANGE_INFORMATION �V _PAGEDIR_INFORMATION ! P, ENLISTMENT_CRM_INFORMATION �V PRTL_FREE_STRING_ROUTINE + �V PRTL_IS_THREAD_WITHIN_LOADER_CALLOUT % �4 SYSTEM_DEVICE_DATA_INFORMATION �V LPHW_PROFILE_INFOA RAWINPUT �V RPC_MGMT_AUTHORIZATION_FN ! �7 _ETW_COVERAGE_SAMPLER_DATA �6 FARPROC ! � EVENT_INSTANCE_GUID_HEADER $ � PPS_POST_PROCESS_INIT_ROUTINE �E FILE_FULL_DIR_INFORMATION # �E PLUGPLAY_CONTROL_STATUS_DATA ! �V PPPM_IDLE_STATE_ACCOUNTING q9 _RTL_HEAP_STACK_CONTROL " �V PPS_BNO_ISOLATION_PARAMETER M= LASTINPUTINFO _CM_PERF_COUNTERS � _FP__IEEE_FORMAT �( _CPU_SET_INFORMATION_TYPE �V PTP_CALLBACK_INSTANCE �V PEMRGRADIENTFILL �V PIMAGE_ROM_HEADERS �V PGET_MODULE_HANDLE_EXA DLL_DIRECTORY_COOKIE
PSHORT E _FILE_SEGMENT_ELEMENT . PINTERFACE_DEREFERENCE % % _PROCESS_ENERGY_TRACKING_STATE �V LANGGROUPLOCALE_ENUMPROCA �V PRID_DEVICE_INFO_KEYBOARD v AXESLISTW �V PBOOT_RECORD �9 IMAGE_HOT_PATCH_BASE �T RAWINPUTHEADER �V PCI_LOG_SCHEDULER_WAKEUP �V _TOKEN_LINKED_TOKEN �V _DIAGNOSTIC_BUFFER ! 2 PERFINFO_IDLE_STATE_CHANGE � _KSPIN_LOCK_QUEUE_NUMBER $ �V PQUERY_STORAGE_RESERVE_OUTPUT �6 PROC $ �D EXCEPTION_REGISTRATION_RECORD ( _VRF_TRIAGE_CONTEXT ! S ETW_TIMER_EXPIRATION_EVENT + �V PETW_TP_EVENT_WORKER_NUMANODE_SWITCH T _MESSAGE_RESOURCE_ENTRY �V _LOAD_DLL_DEBUG_INFO �* LPDRAWITEMSTRUCT �) STRING32 �0 GHOSTED_FILE_EXTENT ' dG _CREATEFILE2_EXTENDED_PARAMETERS + nS _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W ' � _EVENT_HEADER_EXTENDED_DATA_ITEM _V _PORT_DATA_ENTRY " �V PWIM_PROVIDER_EXTERNAL_INFO ! 7< KEY_VALUE_FULL_INFORMATION ! _REFS_SMR_VOLUME_GC_METHOD � CACHE_RELATIONSHIP �V PHARDWAREHOOKSTRUCT c PRTL_CRITICAL_SECTION � RPC_CLIENT_ALLOC C _NT_TIB 5 _RTL_PROCESS_LOCKS �V PFLS_DATA ! ` PUMS_SCHEDULER_ENTRY_POINT �V PERFINFO_MARK_INFORMATION & � _PO_CS_DEVICE_NOTIFICATION_TYPE " TP_VERSION �V PRAWINPUTDEVICELIST , �0 _PERFINFO_DYNAMIC_TICK_DISABLE_REASON u PUINT32 , �A _PROCESS_MITIGATION_IMAGE_LOAD_POLICY T tagMDICREATESTRUCTW m5 TOKEN_USER_CLAIMS ! �V PREFS_SMR_VOLUME_GC_METHOD �V PACTCTX �V PNEON128 � _ETW_OBJECT_HANDLE_EVENT �. SI_COPYFILE ! � _REFS_SMR_VOLUME_GC_ACTION �V PEMRMASKBLT ! �( _FILE_INTERNAL_INFORMATION R ENUMTEXTMETRICA UINT8 �T RTL_TIME_ZONE_INFORMATION >: _TRACE_VERSION_INFO $ �V EVENT_EXTENDED_ITEM_EVENT_KEY o _CLIENT_ID ( �V STREAMS_ASSOCIATE_ID_INPUT_BUFFER ! �V PPS_MITIGATION_OPTIONS_MAP 0 �< _SYSTEM_FEATURE_CONFIGURATION_INFORMATION H tagAXESLISTA �V PINPUT_RECORD " [B FILE_ALLOCATED_RANGE_BUFFER , �A _SYSTEM_LOGICAL_PROCESSOR_INFORMATION �V LPCOMSTAT l? _IMAGE_CHPE_METADATA_X86 �V PSCRUB_PARITY_EXTENT_DATA / IMAGE_POLICY_ID �S PO_WAKE_SOURCE_HEADER U T2_SET_PARAMETERS �1 EMRSETMAPPERFLAGS pT PRPC_SID % ~V PPROCESS_MITIGATION_DEP_POLICY � _PS_MITIGATION_OPTION |V PCONSOLE_FONT_INFOEX {V PCZPCWSTR f2 LPCCH xV SLIST_HEADER $ vV PSECURITY_IMPERSONATION_LEVEL - �U _FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER ( M? SYSTEM_WATCHDOG_TIMER_INFORMATION - uV PPLUGPLAY_CONTROL_TARGET_RELATION_DATA ( @ SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX ( sV _SYSTEM_MANUFACTURING_INFORMATION $ oV _EVENT_EXTENDED_ITEM_INSTANCE �. ETW_THREAD_SET_NAME_EVENT ; tagMSGBOXPARAMSA # lV PFILE_LINK_ENTRY_INFORMATION # �Q SYSTEM_FEATURE_CONFIGURATION # P ACTIVATION_CONTEXT_MSIX_INFO �% PCZZWSTR J KPROFILE_SOURCE + + PROCESS_EXTENDED_BASIC_INFORMATION64 % jV _PERFINFO_SET_POWER_ACTION_RET
�% LPCWCH � HEAP_SUBSEGMENT_ACTIVATED 6 EVENTLOG_FULL_INFORMATION �S NETINFOSTRUCT �: WMIGUIDINFORMATION �) ETW_WAKE_COUNTER_EVENT 0 �G _MEMORY_PARTITION_INITIAL_ADD_INFORMATION gV LPSCROLLINFO # fV POFFSETINSTANCEDATAANDLENGTH PLANGINDEX ) 5 FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER eV PHELPWININFO , dV PJOBOBJECT_IO_ATTRIBUTION_INFORMATION �B LPCRECT :? CPTABLEINFO cV DRAWSTATEPROC ]V PPORT_DATA_ENTRY , �: _SYSTEM_SECUREBOOT_POLICY_INFORMATION 2 �? _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE �. tagEMRCREATEBRUSHINDIRECT
�) _M128A H@ PCOUNTED_REASON_CONTEXT VV PSUPPORTED_OS_INFO 2V HGESTUREINFO__ � _IMAGE_THUNK_DATA64 # SV TXFS_CREATE_MINIVERSION_INFO - 6 PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA � _REPARSE_DATA_BUFFER 71 _SYSTEM_FLUSH_INFORMATION QA FILE_ID_DESCRIPTOR i BITMAPCOREHEADER
p PUTSTR . OV FILE_PROCESS_IDS_USING_FILE_INFORMATION IV PSYSTEM_WORKINGSET_ENTRY GV LPGCP_RESULTS P; tagEMRCREATEPEN # EV _ETW_COVERAGE_SAMPLER_SAMPLE
AV SID ( �7 _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES & �, PERFINFO_CC_SCHEDULE_READ_AHEAD % ?V PPOWER_THROTTLING_THREAD_STATE >V PSYSDBG_IO_SPACE tB OVERLAPPED :V LPMONITORINFOEXW ) �# PERFINFO_HARDPAGEFAULT_INFORMATION $ �F FILE_MOVE_CLUSTER_INFORMATION 8V PPNP_QUERY_RELATION ] LPMSGBOXPARAMSA $ f7 _OBJECT_DIRECTORY_INFORMATION �C tagLOGBRUSH32 AR SERVICE_DESCRIPTIONA 7V PEMRELLIPSE $ k0 _ETW_TP_EVENT_POOL_TH_MIN_SET & �5 ETW_COVERAGE_SAMPLER_BLOOM_INFO �: _RTL_PROCESS_MODULES & _2 SYSTEM_MEMORY_USAGE_INFORMATION 6V SERVICE_MAIN_FUNCTIONA D? _XSAVE_AREA_HEADER ! � PROCESS_HANDLE_INFORMATION 0V HGESTUREINFO ' �5 _WMI_EXTENDED_THREAD_INFORMATION * _SYMBOLIC_LINK_INFO_CLASS <( PEMRPOLYBEZIERTO16 �B EMRPOLYDRAW16 $ .V PETW_PARTITION_INFO_EXTENSION �) M128A �0 PSCROLLBARINFO �0 PERFINFO_CCSWAP_LITE -V PREG_NOTIFY_INFORMATION +V _FILE_END_OF_FILE_INFO %V PPERFINFO_MARK_EVENT ( PERFINFO_DRIVER_COMPLETIONROUTINE
� PCTSTR "V EXCEPTION_RECORD32 _STREAM_INFORMATION_ENTRY EVENT_TRACE_HEADER 0 ?# _JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 H) PERFINFO_IPI_RECEIVE_DATA � IMAGE_NT_HEADERS32 " V IMAGE_RESOURCE_DIR_STRING_U `D NEWTEXTMETRICEXA � _devicemodeA V PCZPWSTR V PKSPIN_LOCK_QUEUE_NUMBER V PSECURITY_SEED_AND_LENGTH �E _VARIABLE_NAME_AND_VALUE $ V _CM_DISK_GEOMETRY_DEVICE_DATA _FILE_ID_128 � _SYSDBG_CONTROL_SPACE hT RTL_HEAP_STACK_QUERY " PDWORD_PTR )
V SYSTEM_MEMORY_TOPOLOGY_INFORMATION " V PWNF_STATE_NAME_INFORMATION �% PEMRCHORD vS _tag_ARMINTR_CPS_FLAG V PTOKEN_MANDATORY_POLICY 8$ FSCTL_UNMAP_SPACE_OUTPUT * �5 _SYSTEM_EXTENDED_THREAD_INFORMATION 1 � _JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL V PLBR_TRACE_EVENT_DATA % AU TOKEN_APPCONTAINER_INFORMATION V PEMRCREATEPALETTE V PACL_REVISION_INFORMATION �: FILE_ID_INFORMATION �U REPARSE_POINT_INFORMATION & �U PRTL_PROCESS_BACKTRACES_CONTROL PRTL_RB_NODE
� POINTS \U LPICONMETRICSW % �S _FILE_FS_FULL_SIZE_INFORMATION *& KEY_SET_INFORMATION_CLASS cs_byte A ETW_REFDEREF_OBJECT_EVENT ( DD EVENT_TRACE_GROUPMASK_INFORMATION . �U PCACTIVATION_CONTEXT_SECTION_KEYED_DATA + _CM_SHARE_DISPOSITION ( PEMRSETVIEWPORTEXTEX �8 tagEMRSTRETCHBLT u PDWORD32 ( �U PMEMORY_ENCLAVE_IMAGE_INFORMATION % �U PWIM_PROVIDER_INTEGRITY_STATUS " �U PETW_COVERAGE_SAMPLER_STATS # �, FILE_COMPRESSION_INFORMATION �U FILE_FULL_EA_INFORMATION � _MUTANT_INFORMATION_CLASS % �G SYSTEM_PERFORMANCE_INFORMATION $ WORKERFACTORYINFOCLASS �U PNTFS_STATISTICS_EX & �U PKEY_VIRTUALIZATION_INFORMATION �U PGUITHREADINFO �U _ETW_KQUEUE_ENQUEUE_EVENT � _ACL_SIZE_INFORMATION �U PTHREAD_TEB_INFORMATION $< tagINPUT_TRANSFORM �U PETW_UMS_EVENT_PARK & �U PCCOMPATIBILITY_CONTEXT_ELEMENT �U PCONSOLE_HISTORY_INFO �U PWMI_WAIT_MULTIPLE �U PQUAD & � _PERFINFO_INTERRUPT_INFORMATION �U PEXCEPTION_RECORD64 $ �U PSYSTEM_EXCEPTION_INFORMATION �U LPGLYPHMETRICS �U PMODEMDEVCAPS �U _WMI_IRQ_RECORD # q PSECURITY_DESCRIPTOR_CONTROL � KCRM_MARSHAL_HEADER �U PFILE_ID_BOTH_DIR_INFO �3 tagLOGFONTA �U LPNLSVERSIONINFOEX �T FILE_FULL_DIR_INFO �U IO_STATUS_BLOCK �U PREPARSE_INDEX_KEY % � FILE_PIPE_DELETE_SYMLINK_INPUT , �U FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER
5 PROCESSOR_RECORD % 6' LINK_TRACKING_INFORMATION_TYPE �U PRTL_BACKOFF / �U PJOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 I% SE_ACCESS_REQUEST * < ALPC_PORT_ASSOCIATE_COMPLETION_PORT J" MIDL_INTERCEPTION_INFO �U _WMI_WAIT_MULTIPLE % � PLUGPLAY_CONTROL_PROPERTY_DATA . - _RESOURCEMANAGER_COMPLETION_INFORMATION �' PDISPLAY_DEVICEW �> _TIMELINE_BITMAP * / SYSTEM_HYPERVISOR_QUERY_INFORMATION �4 ETW_CLOSE_HANDLE_EVENT �U PRTL_AVL_ALLOCATE_ROUTINE 6 PEMRSELECTOBJECT �# _PLUGPLAY_EVENT_CATEGORY ~' _cpinfoexW �U IMAGE_RELOCATION �U QUOTA_LIMITS_EX �U _PS_STD_HANDLE_INFO �U _WRITE_USN_REASON_INPUT �U PCONSOLE_CURSOR_INFO K8 RPC_SECURITY_QOS �- _PROCESSOR_IDLE_STATES h? LPDLGITEMTEMPLATEA ! �2 _FILE_STANDARD_INFORMATION �U HRAWINPUT__ �U KTMOBJECT_CURSOR " UCSCHAR �U PPVALUEA jC INVERTED_FUNCTION_TABLE * �U PIMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY �U PEVENT_FILTER_EVENT_NAME # �U PPLUGPLAY_CONTROL_DEPTH_DATA sS tagINPUT_INJECTION_VALUE �% COMPOSITIONFORM , �U _JOBOBJECT_IO_ATTRIBUTION_INFORMATION �U PFILE_REGION_OUTPUT �U PBOOT_ENTRY_LIST @D NPEVENTMSGMSG U PRTL_PHYSICAL_MEMORY_INFO 5 G tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA �* LPEXTLOGFONTW # _FILE_PIPE_LOCAL_INFORMATION }U LPNETRESOURCEA � CHAR_INFO |U PSERVICE_NOTIFY �% _WMI_REGISTRY ! {U PETW_WNF_EVENT_UNSUBSCRIBE q PWORD " �" _FILE_ALIGNMENT_INFORMATION �S _FILE_LEVEL_TRIM_OUTPUT WMI_PNP_RECORD yU RTL_HANDLE_TABLE rU LPSTARTUPINFOEX p CCHAR . LPEXCEPTION_POINTERS � tagDELETEITEMSTRUCT pU PRTL_AVL_TREE ,H RTL_CRITICAL_SECTION64 ' oU PPROCESS_WS_WATCH_INFORMATION_EX E FILE_SEGMENT_ELEMENT LPMENUTEMPLATEA % , _ETW_SESSION_NOTIFICATION_TYPE ! k: CONSOLE_SCREEN_BUFFER_INFO nU PEXCEPTION_ROUTINE kU _JUMP_BUFFER - gU PMEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE fU NPOUTLINETEXTMETRIC ' � HEAP_EVENT_SUBSEGMENT_ALLOC_FREE � _IMAGE_DOS_HEADER dU CSV_MGMT_LOCK $ aU PSYSTEM_ROOT_SILO_INFORMATION & @ _SYSTEM_CPU_SET_TAG_INFORMATION � AXISINFOA �- MIDL_STUBLESS_PROXY_INFO % �A _MEMORY_EXHAUSTION_INFORMATION `U PRTL_RELATIVE_NAME_U \U PICONMETRICSW & WU PSYSTEM_PROCESS_TRUST_LABEL_ACE UU PCSVFS_DISK_CONNECTIVITY SU _TP_DIRECT � _LUID LANGSPEC LU GDI_HANDLE_BUFFER64 " KU PFILE_DIRECTORY_INFORMATION * � _VIRTUALIZATION_INSTANCE_INFO_INPUT JU LPGCP_RESULTSW ) �S _ETW_TP_EVENT_TIMER_EXPIRATION_END �I WMIREGINFO ' OF _ALPC_SERVER_SESSION_INFORMATION & dG CREATEFILE2_EXTENDED_PARAMETERS 6E FILE_ATTRIBUTE_TAG_INFO IU PEMRSETCOLORADJUSTMENT ! HU PETW_CPU_CACHE_FLUSH_EVENT $ FU SYSTEM_OBJECTTYPE_INFORMATION �$ RTL_DISK_SPACE_INFO �0 PRECT ! CU PIMAGE_ARCHITECTURE_HEADER & ?U PTOKEN_APPCONTAINER_INFORMATION �2 LDR_DATA_TABLE_ENTRY64 " 5 RTL_USER_PROCESS_PARAMETERS }6 POWER_SESSION_WINLOGON h" tagEMRLINETO & � FILE_CASE_SENSITIVE_INFORMATION ! =U PRTL_TREE_COMPARE_FUNCTION � LPCANDIDATEFORM ;U _MESSAGE_TRACE_HEADER '/ CLASSIC_EVENT_ID + � _EVENT_TRACE_SPINLOCK_INFORMATION_V1 �0 tagRECT ' 9U PRTL_QUERY_DEBUG_VIRTUAL_PROCESS �S IMAGE_RESOURCE_DIRECTORY � PS_MITIGATION_OPTIONS_MAP " �: IMAGE_SEPARATE_DEBUG_HEADER $ 8U PSYSTEM_BOOT_LOGO_INFORMATION o? _MM_ETW_PAGE_INFO + p; PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT 0 7U PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION �T SCRUB_PARITY_EXTENT : _ETW_NOTIFICATION_TYPE 6U PVOLUME_BITMAP_BUFFER # 5U PSHRINK_VOLUME_REQUEST_TYPES 1U PETW_WNF_EVENT_PUBLISH ' /U PETW_COVERAGE_SAMPLER_PERF_STATS $ PANSI_STRING $ int16x4_t .U PDELETE_USN_JOURNAL_DATA -U PTP_JOB_CALLBACK ? tagPELARRAY & � _HEAP_REUSE_THRESHOLD_ACTIVATED SSIZE_T � _ALPC_TOKEN_ATTR " �& SYSTEM_VERIFIER_INFORMATION ( �A SYSTEM_CONTEXT_SWITCH_INFORMATION * E _RTL_FEATURE_CONFIGURATION_PRIORITY �: _WMIGUIDINFORMATION � _IMAGE_NT_HEADERS ' )U PRTL_STACK_TRACE_DATABASE_CREATE $ (U PRTL_PROCESS_LOCK_INFORMATION �) tagGESTURECONFIG � ULARGE_INTEGER �. TP_IO �4 HEAP_EXTENDED_INFORMATION �! _MM_ETW_PAGE_EXTRA_INFO & &U _WIM_PROVIDER_ADD_OVERLAY_INPUT #U LPKERNINGPAIR U PPERFINFO_IO_TIMER & U PPROCESS_MEMORY_ALLOCATION_MODE $ > _SYSTEM_PROCESSOR_INFORMATION + U PSYSTEM_FEATURE_CONFIGURATION_UPDATE U RTL_MODULE_EXTENDED_INFO U _T2_SET_PARAMETERS_V0 � TP_CALLBACK_PRIORITY U PTITLEBARINFO W& tagWNDCLASSW "
U PEVENT_INSTANCE_GUID_HEADER 1 U PSYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION u- RTL_HEAP_TAG # �? PLUGPLAY_CUSTOM_NOTIFICATION U PETW_NOTIFICATION_HEADER �8 _ARMINTR_CPS_OP ! U PACCESS_ALLOWED_OBJECT_ACE ! SECURE_SETTING_VALUE_TYPE U KLDR_DATA_TABLE_ENTRY32 *D _ETW_HEAP_EVENT_EXPANSION �T PTOKEN_PRIVILEGES �/ INITIAL_TEB �T PFILE_NAME_INFORMATION y9 KTMOBJECT_TYPE 3 R PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY c FILE_STAT_LX_INFORMATION % �T PWMI_JOB_SET_QUERY_INFORMATION �T _locale_t " LOGICAL $ �T PPERFINFO_MEM_RESET_INFO_TYPE 1 �% MEMORY_PARTITION_CONFIGURATION_INFORMATION �1 _RTL_BACKOFF , BE SERVICE_CONTROL_STATUS_REASON_PARAMSW �: _OBJECT_ATTRIBUTES64 �< ENUMLOGFONTA �T PBLENDFUNCTION {> _ETW_PER_SESSION_QUOTA + G _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN " �E _WIM_PROVIDER_OVERLAY_ENTRY �T PSCRUB_PARITY_EXTENT �. ETW_OPTICALIO_READWRITE " �T PPERFINFO_CC_CAN_WRITE_FAIL ( & SYSTEM_REGISTRY_QUOTA_INFORMATION ( �> _CFG_CALL_TARGET_LIST_INFORMATION % � MEMORY_WORKING_SET_INFORMATION 2F _FOUR_PART_VERSION HGDIOBJ �T LPQUERY_SERVICE_CONFIGW 3) EMRCOLORMATCHTOTARGET % �- MM_ETW_WORKING_SET_PFN_RUNDOWN ( � RESOURCEMANAGER_INFORMATION_CLASS �T PRTL_DEBUG_INFORMATION �% PEMRARCTO �4 tagWNDCLASSEXW $ POEM_STRING �F RTL_FEATURE_USAGE_REPORT _SECURITY_ATTRIBUTES & �T LPOVERLAPPED_COMPLETION_ROUTINE G: CANDIDATELIST " �T PTRACE_ENABLE_FLAG_EXT_ITEM �T PRAWINPUTHEADER �T PFILE_FULL_DIR_INFO ! -A ETW_COVERAGE_SAMPLER_STATS ' � _SYSTEM_SHADOW_STACK_INFORMATION �T PMEMORY_RANGE_ENTRY ) �T PMEMORY_WORKING_SET_EX_INFORMATION WMI_JOB_ASSIGN_PROCESS �T _WNF_DELIVERY_DESCRIPTOR �? _COMPRESSED_DATA_INFO ' �4 RPC_HTTP_TRANSPORT_CREDENTIALS_A �T IMAGE_VXD_HEADER ! �Q _RTL_FEATURE_CONFIGURATION $ � _TXFS_LIST_TRANSACTIONS_ENTRY �= _IMAGE_IMPORT_DESCRIPTOR #6 PTEXTMETRICW " �T PROCESS_LOGGING_INFORMATION - �S _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX �, IMAGE_HOT_PATCH_HASHES � CLIENT_ID64 $ �A _ETW_TP_EVENT_TIMER_CANCELLED % �T PFILE_PIPE_ASSIGN_EVENT_BUFFER zG _RTL_BITMAP_RUN �D _EXCEPTION_LOG �T _RTL_ENCLAVE_LAUNCH_TOKEN �4 WNF_TYPE_ID � _STARTUPINFOW �8 _LDR_DATA_TABLE_ENTRY .7 tagEXTLOGFONTA � poly8x8x4_t + '& JOURNAL_SET_DELETE_VALUE_INFORMATION ! �T PRTL_TIME_ZONE_INFORMATION ]: CHANGEFILTERSTRUCT & _FILE_DISPOSITION_INFO_EX �9 VS_FIXEDFILEINFO �T PSE_SID ) �: _RTL_IMAGE_MITIGATION_OPTION_STATE
�T HLSURF �T ETW_CLOCK_TIME_UPDATE 9 00 _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION �T PKEY_NAME_INFORMATION $ �T PTRANSACTION_BIND_INFORMATION 1 ETW_DISABLE_KTIMER2_EVENT ' �T PPROCESS_HANDLE_TABLE_ENTRY_INFO } _FILE_INFORMATION_CLASS �) tagMULTIKEYHELPW �. PUUCSCHAR + hG PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA �' RID_DEVICE_INFO_MOUSE # REGHANDLE ! �T PSECTION_BASIC_INFORMATION HDWP + �T PSYSTEM_CRASH_DUMP_STATE_INFORMATION �, _FLOAT128 4 �T PJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE �T NAMEENUMPROCA �T LPENUM_SERVICE_STATUSW q" _DISPLAY_DEVICEA T* tagPOLYTEXTA .. _IMAGE_TLS_DIRECTORY32 �C _ImageArchitectureHeader � LDR_DLL_NOTIFICATION_DATA 1 �/ _SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE �T PETW_UMGL_KEY � WIN32_MEMORY_RANGE_ENTRY 9 _CONTEXT �. PHYSICAL_CHANNEL_RUN HF _HEAP_BLOCK_INFORMATION �T HWND �T PGET_MODULE_HANDLE_EXW �T PPOINTFLOAT 1 �T PMEMORY_PARTITION_PAGE_COMBINE_INFORMATION - �T PACTIVATION_CONTEXT_SECTION_KEYED_DATA 8 _FILE_NOTIFY_INFORMATION ) �* SYSTEM_SESSION_PROCESS_INFORMATION �T PTRACE_ENABLE_CONTEXT " �T PIMAGE_DELAYLOAD_DESCRIPTOR f# _RTL_MODULE_BASIC_INFO , �T PPROCESS_MITIGATION_IMAGE_LOAD_POLICY �B SC_ACTION_TYPE �E IMAGE_EXPORT_DIRECTORY $ uint16x4_t �R tagEMRGRADIENTFILL " KLOCK_QUEUE_HANDLE �T EXIT_PROCESS_DEBUG_INFO �T PEVENT_DESCRIPTOR �T PWNODE_SINGLE_INSTANCE �D LDRP_CSLIST �A LPBITMAPV5HEADER � _PARSE_MESSAGE_CONTEXT �T PUNICODE_STRING64 F EMRDRAWESCAPE �0 _KCRM_TRANSACTION_BLOB 0 R _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION % EMRCHORD � PCUZZTSTR @ float32_t �T PCFG_CALL_TARGET_INFO �T tagWCRANGE �R PEMRSETBKCOLOR �T PIMAGE_ENCLAVE_CONFIG64 @ PEMRWIDENPATH # �T PFILE_FS_CONTROL_INFORMATION B@ _GRADIENT_TRIANGLE 1, UQUAD �T PINTERFACE_TYPE &# MEMORY_RANGE_ENTRY y _TABLE_SEARCH_RESULT �T WOW64_REMOTE_FUNCTION64 �. LPDEVMODEA �T WNF_USER_CALLBACK ' �# _JOBOBJECT_BASIC_PROCESS_ID_LIST .S PROCESSOR_RELATIONSHIP �T PICONINFOEXA �' ICONINFOEXW 3 �T PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V1 � SYSTEM_INFORMATION_CLASS ! �T PWINDOW_BUFFER_SIZE_RECORD @ WNODE_ALL_DATA " WNF_CHANGE_STAMP � _HARDWARE_COUNTER_TYPE �F _FILE_SET_SPARSE_BUFFER ) �T PSYSTEM_MEMORY_CHANNEL_INFORMATION 8A _CM_EISA_SLOT_INFORMATION % HEAP_RANGE_INFORMATION 8D LPBITMAPINFO �T PETW_DEBUG_PRINT_EVENT $ �T PROCESS_FOREGROUND_BACKGROUND & }T PSL_KMEM_CACHE_VALUE_DESCRIPTOR �+ POSVERSIONINFOEXW & wT PPLUGPLAY_CONTROL_CONFLICT_DATA �# _RTL_CONDITION_VARIABLE tT INPUT_MESSAGE_SOURCE 8 _currencyfmtA $ �E _NDR_USER_MARSHAL_INFO_LEVEL1 qT PPRPC_SID - 3 FSCTL_GET_INTEGRITY_INFORMATION_BUFFER # DISPLAYCONFIG_COLOR_ENCODING + nT _FILE_LINK_ENTRY_FULL_ID_INFORMATION �A _WIN32_FIND_STREAM_DATA lT PPOWERBROADCAST_SETTING - kT PPROCESS_MITIGATION_POLICY_INFORMATION , jT PEVENT_TRACE_SYSTEM_EVENT_INFORMATION 4 R _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY cT PRTL_HEAP_STACK_QUERY � PACTIVATION_CONTEXT & aT PIMAGE_DYNAMIC_RELOCATION_TABLE r/ _PERFINFO_TRACE_HEADER $ `T PWIM_PROVIDER_START_INTEGRITY ' ^T _SYSTEM_ACTIVITY_MODERATION_INFO ? |5 _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA $ �G _ETW_CLOCK_STATE_CHANGE_EVENT vS _ARMINTR_CPS_FLAG [T PMM_ETW_WORKING_SET_TYPE $ v PROCESS_WORKING_SET_OPERATION ' ZT PQUERY_PERFORMANCE_COUNTER_FLAGS �/ POSVERSIONINFOW , YT PDEDUP_QUERY_FILE_HASHES_INPUT_BUFFER � REFS_SMR_VOLUME_GC_STATE XT PNT_TIB32 ! �A _CREATE_PROCESS_DEBUG_INFO TT HTOUCHINPUT $ �; KNONVOLATILE_CONTEXT_POINTERS , RT PJOBOBJECT_SECURITY_LIMIT_INFORMATION $ o _FILE_ID_EXTD_DIR_INFORMATION ]D _CSV_QUERY_FILE_REVISION CT tagBITMAPCOREINFO $ �> _PROCESS_WS_WATCH_INFORMATION + �: SYSTEM_SECUREBOOT_POLICY_INFORMATION }" FEEDBACK_TYPE VC _VM_COUNTERS_EX2 �= _FSCTL_OFFLOAD_READ_INPUT -( EMRCREATECOLORSPACEW I, TOKEN_ELEVATION_TYPE �; tagPALETTEENTRY � EMRPOLYDRAW ' NT PPROCESS_LEAP_SECOND_INFORMATION � FILE_QUERY_SPARING_BUFFER & B+ _FSCTL_UNMAP_SPACE_INPUT_BUFFER : _WMI_IDE_CHANNEL_RECORD 3 LT PJOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION
p LPTSTR =9 _PROCESS_JOB_MEMORY_INFO �# REPARSE_DATA_BUFFER_EX HT PBOOT_OPTIONS gE WMI_LOGGER_INFORMATION �' PMENUBARINFO � PS_PROTECTED_SIGNER " FT PPOWER_STATE_NOTIFY_HANDLER $ ]C KEY_VALUE_PARTIAL_INFORMATION ET PPREFIX_TABLE_ENTRY �8 _HARDWARE_COUNTER_DATA ! �% ENTER_STATE_SYSTEM_HANDLER KEY_INFORMATION_CLASS CT BITMAPCOREINFO % B2 ETW_WNF_EVENT_NAME_SUB_RUNDOWN ! @> _PROCESS_FAULT_INFORMATION � TP_TRACE_TYPE >T _PEB @ PEMRFLATTENPATH ' �" ETW_TIMER_EXPIRATION_START_EVENT 6# MONITOR_DISPLAY_STATE " T PTXFS_SAVEPOINT_INFORMATION T MDICREATESTRUCTW -/ WMI_PROCESS_INFORMATION ) T PEVENT_TRACE_GROUPMASK_INFORMATION T MESSAGE_RESOURCE_ENTRY � _WMI_PAGE_FAULT T PWAKE_TIMER_INFO
T MENUGETOBJECTINFO
T UILANGUAGE_ENUMPROCW ( +C JOBOBJECT_BASIC_LIMIT_INFORMATION % < STREAMS_QUERY_ID_OUTPUT_BUFFER ! �' _SYSTEM_NUMA_PROXIMITY_MAP T PDISPLAY_DEVICE T tagGCP_RESULTSW T SERVER_ROUTINE % T PREFS_SMR_VOLUME_GC_PARAMETERS = CBT_CREATEWNDA # = PS_CPU_QUOTA_SET_INFORMATION L. SD_QUERY_STATS_OUTPUT T PRPC_SECURITY_QOS �S PEVENT_HEADER 6, _SECURITY_CAPABILITIES , �S SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX �S LPFIBER_START_ROUTINE I? TOUCHPREDICTIONPARAMETERS �S _TEB_ACTIVE_FRAME_EX - OSVERSIONINFOEX2W �S PNTFS_STATISTICS �S PEMRSETMITERLIMIT �S EMRROUNDRECT �S LPRAWHID �S PIMAGE_RESOURCE_DIRECTORY $ R? _FILE_VOLUME_NAME_INFORMATION �S _PO_WAKE_SOURCE_HEADER % E ETW_COVERAGE_SAMPLER_PERF_INFO % 88 _WMI_DISKIO_IO_REDIRECTED_INIT * �: SYSTEM_NET_RATE_CONTROL_SET_CONTEXT �S PRTL_QUERY_REGISTRY_TABLE & f, _SYSTEM_MEMORY_LIST_INFORMATION E2 STREAM_INFO_LEVELS )# PCWPRETSTRUCT ! �S _ETW_CPU_CACHE_FLUSH_EVENT * V _PERFINFO_BOOT_PREFETCH_INFORMATION # R? FILE_VOLUME_NAME_INFORMATION �S PTOKEN_ELEVATION �S LPCURRENCYFMTA �= _HEAP_COMMIT_DECOMMIT + M) _ETW_UMS_EVENT_DIRECTED_SWITCH_START ]& tagLOGCOLORSPACEA ) �S PETW_TP_EVENT_TIMER_EXPIRATION_END ( �S PPROCESS_HANDLE_TRACING_ENABLE_EX �S PTP_WORK � tagDIBSECTION �S PROPENUMPROC # ^A JOBOBJECT_FREEZE_INFORMATION ! �S PRTL_FEATURE_CONFIGURATION �D _TP_DEBUG_CLASS + �S PROCESS_PROTECTION_LEVEL_INFORMATION " PKAFFINITY �S IMAGE_ROM_HEADERS �R ATOM_BASIC_INFORMATION ! �S PFILE_REMOTE_PROTOCOL_INFO . ; _FILE_DESIRED_STORAGE_CLASS_INFORMATION # �$ _RTL_GENERIC_COMPARE_RESULTS . � _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA & � _PLUGPLAY_CONTROL_PROPERTY_DATA �3 RTL_SRWLOCK " �S PETW_UMS_EVENT_DISASSOCIATE $ �S tagEMRCREATEDIBPATTERNBRUSHPT ! wF PROCESS_UPTIME_INFORMATION �S PUSN_RECORD_UNION _ _FILE_ID_INFO �S ETW_THREAD_AFFINITY_EVENT �S PRPC_DISPATCH_TABLE " � PERFINFO_CC_LAZY_WRITE_SCAN cA WMI_DISKIO_READWRITE �S PSYSDBG_PHYSICAL �R LPABCFLOAT �S _NETINFOSTRUCT �S _IMAGE_IMPORT_BY_NAME H _DMA_SPEED �S PSYSTEM_PREFETCH_STATS % _SYSTEM_VA_TYPE t PLONG32 " ACCESS_REASON �S PFILE_EA_INFORMATION �S PFILE_LEVEL_TRIM_OUTPUT % m RTL_DYNAMIC_HASH_TABLE_CONTEXT % �S PRTL_UMS_SCHEDULER_ENTRY_POINT � TITLEBARINFOEX ' �S LOOKUP_STREAM_FROM_CLUSTER_ENTRY ) �S PSYSTEM_SECURITY_MODEL_INFORMATION U& NPWNDCLASSW �S PFILEMUIINFO 1 YR EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION �S EDITWORDBREAKPROC �2 LPMSG % �/ ETW_AUTOBOOST_NO_ENTRIES_EVENT * d6 _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE �S PSE_ACCESS_REPLY - 3 FSCTL_SET_INTEGRITY_INFORMATION_BUFFER � _KCRM_PROTOCOL_BLOB �S _NETCONNECTINFOSTRUCT }D _IMAGE_SYMBOL_EX + �S PCASSEMBLY_FILE_DETAILED_INFORMATION ! �S PPERFINFO_FILE_INFORMATION ! �8 _PAGE_PRIORITY_INFORMATION D LPMETARECORD �6 RPC_SECURITY_QOS_V3_A �S LPMONITORINFO o. __GENERIC_BINDING_INFO �3 _IO_ERROR_LOG_MESSAGE % �S PFILE_FS_FULL_SIZE_INFORMATION �S _NT_TIB32 u> FILE_BASIC_INFORMATION �S FILE_PIPE_INFORMATION . �S PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA , S FILE_FS_PERSISTENT_VOLUME_INFORMATION
S FILE_REGION_INPUT �+ tagMOUSEHOOKSTRUCT D tagMETARECORD ( {S _PERFINFO_MEMORY_NODE_INFORMATION sS INPUT_INJECTION_VALUE pS PWX86TIB # G SharedVirtualDiskHandleState " �$ _POWER_MONITOR_REQUEST_TYPE * nS RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W kS PRTL_RXACT_LOG ! �= _SILOOBJECT_ROOT_DIRECTORY + jS PPLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA iS PPNP_VETO_TYPE &4 RTL_HEAP_TAG_INFO �/ PROCESS_ENERGY_VALUES W SCONTEXT_QUEUE $ hS PRTL_GENERIC_ALLOCATE_ROUTINE gS PPOWER_SESSION_WINLOGON G! PROCESS_ACTIVITY_TYPE fS PRTL_STACK_CONTEXT ,H _RTL_CRITICAL_SECTION64 ( eS PFILE_FS_VOLUME_FLAGS_INFORMATION ' G3 _REDIRECTION_FUNCTION_DESCRIPTOR $ YE _PROCESS_HANDLE_TRACING_ENTRY " cS PUNICODE_PREFIX_TABLE_ENTRY � _DEP_SYSTEM_POLICY_TYPE bS LPEXTLOGFONTA ]S PTHREAD_PERFORMANCE_DATA ) ) _FILE_ID_GLOBAL_TX_DIR_INFORMATION ; LPRAWINPUTDEVICE ! \S LPOUTPUT_DEBUG_STRING_INFO $ [S PTXFS_TRANSACTION_ACTIVE_INFO # ZS PMEMORY_PRIORITY_INFORMATION �= _RTL_GENERIC_TABLE " LPDWORD LPRAWINPUT o! _OSVERSIONINFOA YS CALINFO_ENUMPROCEXEX VS LPIMEMENUITEMINFO TS NEON128 @/ _CI_WINDOWS_LOCKDOWN_MODE # �@ tagACTCTX_SECTION_KEYED_DATA 2 RS PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 QS LPEXCEPTION_DEBUG_INFO OS _EVENT_FILTER_LEVEL_KW LS PALPC_HANDLE_ATTR KS LPOUTLINETEXTMETRICA & �A _FILE_PROVIDER_EXTERNAL_INFO_V1 BC TOKEN_OWNER & T APPLICATIONLAUNCH_SETTING_VALUE �R _RTL_HEAP_WALK_ENTRY JS GDI_HANDLE_BUFFER IS PEISA_IRQ_DESCRIPTOR HS PWMI_CONTEXTSWAP + GS PCLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE . ES _FILE_NETWORK_PHYSICAL_NAME_INFORMATION p: SYSDBG_MSR �- _QUERY_BAD_RANGES_INPUT BS PTPP_THREAD_DATA_CALLBACK AS PROPENUMPROCEXA @S PRPC_POLICY ' ?S PPERFINFO_CC_SCHEDULE_READ_AHEAD " � _PROCESS_HANDLE_INFORMATION - _OSVERSIONINFOEX2W ( � _RTL_QUERY_DEBUG_INFORMATION_INFO ," _DOCINFOA - >S PALPC_PORT_COMPLETION_LIST_INFORMATION % <S _NTPSS_MEMORY_BULK_INFORMATION 9S PEISA_PORT_CONFIGURATION 7S RTL_RVA_LIST_ITERATOR 1S PPROCESS_INFORMATION .S _PROCESSOR_RELATIONSHIP % C; CM_PNP_BIOS_INSTALLATION_CHECK +S PTP_ALPC_CALLBACK_EX % �: EVENT_EXTENDED_ITEM_PEBS_INDEX 0 �, TRANSACTION_NOTIFICATION_PROMOTE_ARGUMENT !S PRTL_ELEVATION_FLAGS " S _ETW_TIMER_EXPIRATION_EVENT ( <C _SYSTEM_ACTIVITY_MODERATION_STATE 1 �F _PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED S LPSERIALKEYSW ( S FILE_PIPE_EVENT_ENUM_INPUT_BUFFER �& EVENTLOGRECORD �- PEMRPOLYBEZIER " S PETW_DUPLICATE_HANDLE_EVENT S LPEXTLOGPEN S IMCENUMPROC & �R _RTL_DISK_WRITE_CONSTRAINT_INFO lE POLYTEXTW I PRLIST_ENTRY % S PFILE_MAILSLOT_SET_INFORMATION & S FILE_END_OF_FILE_INFORMATION_EX S PFILE_REGION_INPUT HGLOBAL � RTL_RESOURCE_CATEGORY S HFONT % S PFILE_MOVE_CLUSTER_INFORMATION # S PFILE_PROVIDER_EXTERNAL_INFO 1 S PSYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION # �E SYSTEM_ROOT_SILO_INFORMATION S PLDR_RESLOADER_RET $ S _RTLP_HEAP_SERIALIZED_MAPPING &
C PROCESS_ENERGY_VALUES_EXTENSION 05 _COVERAGE_REQUEST_CODES �R MEMORY_IMAGE_INFORMATION + �R PTRANSACTION_ENLISTMENTS_INFORMATION �R ACCESS_DENIED_ACE
7 _Wx86TIB % �R _FILE_PIPE_ASSIGN_EVENT_BUFFER ) �1 PROCESS_COMMIT_RELEASE_INFORMATION y3 RGBTRIPLE �/ RTL_OSVERSIONINFOW * �R PRTL_SPARSE_BITMAP_ALLOCATE_ROUTINE W CM_ROM_BLOCK �R HWINEVENTHOOK �. _THREAD_NAME_INFORMATION � VIRTUAL_STORAGE_TYPE �! _RPC_CLIENT_INTERFACE : � SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION ) 6F _SYSTEM_MEMORY_CHANNEL_INFORMATION �R PIRQ_PRIORITY ) �R PRTL_PROCESS_BACKTRACE_INFORMATION ; _RTLP_TAG_INFO
! _PEBS_DS_SAVE_AREA64 �R PEMREXTTEXTOUTA ( �) SE_LEARNING_MODE_USER_OBJECT_DATA ) �, _RTL_PROCESS_MODULE_INFORMATION_EX % � JOURNAL_RENAME_KEY_INFORMATION lF HMONITOR__ ; PERFINFO_FILE_READ_WRITE �R PCSV_QUERY_REDIRECT_STATE �R HMETAFILE__ �R PMENUITEMTEMPLATE ( �& _RPC_BINDING_HANDLE_TEMPLATE_V1_A �R PALPC_WORK_ON_BEHALF_ATTR �R LPALTTABINFO �R PFILE_FS_SIZE_INFORMATION �R LPCREATESTRUCT �R FP_32 0 �R PSYSTEM_REGISTRY_APPEND_STRING_PARAMETERS # � SECURITY_IMPERSONATION_LEVEL # = _SD_CHANGE_MACHINE_SID_INPUT � TOKEN_INFORMATION_CLASS �R PFILE_LAYOUT_ENTRY ! �R PFILE_MAILSLOT_PEEK_BUFFER �R PRTL_HEAP_WALK_ENTRY " �R TIMER_SET_INFORMATION_CLASS ( �R _RTL_IMAGE_MITIGATION_HEAP_POLICY �' _OFSTRUCT Q: LPLOGFONTA ) �R PWIM_PROVIDER_UPDATE_OVERLAY_INPUT ! E _FILE_PIPE_WAIT_FOR_BUFFER �R MFENUMPROC �R PEMRSETTEXTCOLOR 3 �R PPROCESS_MITIGATION_USER_SHADOW_STACK_POLICY �% _PERFINFO_CCSWAP_IDLE 1 �R PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY _ tagTEXTMETRICA �R EMRGRADIENTFILL _ uint64x2x2_t & �R PMEMORY_WORKING_SET_INFORMATION _OSVERSIONINFOEXA ! U; SYSDBG_KD_PULL_REMOTE_FILE �R _ATOM_BASIC_INFORMATION PC EXTLOGPEN XSAVE_AREA �R PSYSTEM_BATTERY_STATE �R PSERVICE_NOTIFY_2 �. POSVERSIONINFOEXA 6 _MESSAGE_TRACE_USER + �R _PERFINFO_PAGECOMBINE_ITERATION_STAT �R RTL_GENERIC_FREE_ROUTINE + �R PRTL_FEATURE_CONFIGURATION_OPERATION % �R RTL_DISK_WRITE_CONSTRAINT_INFO �R RGBQUAD � tagEMRPOLYPOLYLINE - _PROCESS_MITIGATION_POLICY_INFORMATION G tagSTYLESTRUCT ( � _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY � _THREAD_WORKLOAD_CLASS $ �R PSYSTEM_FILECACHE_INFORMATION �R PCIMAGE_EXPORT_DIRECTORY R0 _JOBOBJECT_WAKE_FILTER $ �R FILE_PIPE_ASSIGN_EVENT_BUFFER i tagBITMAPCOREHEADER + <6 EVENT_TRACE_TIME_PROFILE_INFORMATION �R PPORT_VIEW "& ALPC_CONTEXT_ATTR �R PWNF_META_CALLBACK �R DESKTOPENUMPROCW , �A _PERFINFO_DRIVER_COMPLETE_REQUEST_RET �$ RTL_RXACT_OPERATION �R NPABCFLOAT �R PEMRCREATECOLORSPACE �, HEAP_EVENT_RANGE_CREATE , �R PPROCESS_STACK_ALLOCATION_INFORMATION �R PHARDERROR_MSG 0 SERIALKEYSW jC _INVERTED_FUNCTION_TABLE / �R PSTORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE �R _MEMORY_IMAGE_INFORMATION " �R PKEY_WRITE_TIME_INFORMATION #1 IMAGE_OPTIONAL_HEADER $ uint8x8_t 9 ! _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY �R PIMAGE_FUNCTION_ENTRY64 * �R PVIRTUAL_STORAGE_SET_BEHAVIOR_INPUT ! �R PKEY_SET_LAYER_INFORMATION �' _SC_STATUS_TYPE % ~R PFILE_NETWORK_OPEN_INFORMATION uR PKEY_LAYER_INFORMATION # � PERFINFO_PPM_IDLE_STATE_EXIT 5 rR _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY $ ^A _JOBOBJECT_FREEZE_INFORMATION . mR PPROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE # �@ SILOOBJECT_BASIC_INFORMATION �A WIN32_FIND_STREAM_DATA iR PEMRRESIZEPALETTE # cR PDRIVER_VERIFIER_THUNK_PAIRS `R _RTL_FEATURE_USAGE_DATA " [0 ETW_COVERAGE_SAMPLER_MODULE
n& _COORD \R RDR_CALLOUT_STATE 2 WR PEVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION TR _UNWIND_HISTORY_TABLE PR PIO_ERROR_LOG_PACKET �. _ETW_HEAP_EVENT_REALLOC �; COVERAGE_SECTION_HEADER ]< PEB_LDR_DATA �8 COMBOBOXINFO
PUINT8 $ � _FILE_DISPOSITION_INFORMATION ( NR GET_FILTER_FILE_IDENTIFIER_OUTPUT KR PWMI_TRACE_MESSAGE_PACKET _ int8x16x2_t IR CSV_QUERY_MDS_PATH � DELETEITEMSTRUCT ER WNODE_EVENT_REFERENCE AR _SERVICE_DESCRIPTIONA # DWORD64 ! >R CS_TYPE_FROM_NETCS_ROUTINE $ )9 ETW_TP_EVENT_TIMER_EXPIRATION =R PTOKEN_AUDIT_POLICY ! ;R ADMINISTRATOR_POWER_POLICY 8R PEMRNAMEDESCAPE �1 tagHARDWAREINPUT
�. PRECTL ! 7R PWMI_IMAGEID_INFORMATION64 6R PWNF_STATE_NAME # �) PROCESS_HANDLE_TRACING_QUERY " PEXECUTION_STATE 5R PZPCSTR 3R tagEMRSETCOLORADJUSTMENT 0 0R I_RpcProxyGetClientSessionAndResourceUUID /R PFP_IEEE_VALUE �/ _FILE_PREFETCH_EX s uint64x2_t " �8 _SYSTEM_PROCESS_INFORMATION >3 _KLDR_DATA_TABLE_ENTRY64 -R THREAD_BASIC_INFORMATION ! )R PSYSTEM_ALARM_CALLBACK_ACE & �+ RTL_QUERY_DEBUG_VIRTUAL_PROCESS (R GENERIC_BINDING_ROUTINE ; _PERFINFO_FILE_READ_WRITE * R PPROCESS_EXTENDED_BASIC_INFORMATION 4 R PPROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY +% RTL_MEMORY_TYPE R PFILE_BASIC_INFO & R PPOWER_THROTTLING_PROCESS_STATE q PARAM_OFFSETTABLE
R MESSAGE_TRACE | TOKEN_USER mA _HEAP_SUMMARY �A _RPC_PROTSEQ_VECTORA EF tagEMREXCLUDECLIPRECT PWMIHANDLE # R PROCESS_AFFINITY_UPDATE_MODE ( � PERFINFO_DRIVER_MAJORFUNCTION_RET � CANSI_STRING 0 R PJOURNAL_TRANSACTION_BOUNDARY_INFORMATION # - RTL_XPRESS_CALLBACK_FUNCTION �Q LPCRECTL �. PERFINFO_VIRTUAL_ALLOC ' R3 GET_FILTER_FILE_IDENTIFIER_INPUT � RTL_AVL_TREE % b RTL_UMS_SCHEDULER_STARTUP_INFO C# _SE_SECURITY_DESCRIPTOR ' % _FILE_PIPE_CLIENT_PROCESS_BUFFER $ �Q PSYSTEM_FEATURE_CONFIGURATION # �Q LPQUERY_SERVICE_LOCK_STATUSW *0 TOKEN_SID_INFORMATION �@ WIN32_FILE_ATTRIBUTE_DATA �Q EMRMASKBLT �M NTFS_VOLUME_DATA_BUFFER # �# STARTING_LCN_INPUT_BUFFER_EX �M VOLUME_BITMAP_BUFFER ~) MOVE_FILE_DATA �M MOVE_FILE_RECORD_DATA �= MFT_ENUM_DATA_V0 9 MFT_ENUM_DATA_V1 4= READ_FILE_USN_DATA +3 READ_USN_JOURNAL_DATA_V0 �; READ_USN_JOURNAL_DATA_V1 "H USN_RANGE_TRACK_OUTPUT �M USN_RECORD_V3 �& USN_RECORD_COMMON_HEADER �C USN_RECORD_V4 B USN_JOURNAL_DATA_V0 k= USN_JOURNAL_DATA_V1 �M DELETE_USN_JOURNAL_DATA z POWER_ACTION # ( POWER_MONITOR_REQUEST_REASON SYSTEM_POWER_CONDITION
SET_POWER_SETTING_VALUE NOTIFY_USER_POWER_SETTING �M BATTERY_REPORTING_SCALE �! POWER_STATE_HANDLER_TYPE �" POWER_STATE_HANDLER ! �M POWER_STATE_NOTIFY_HANDLER
H PPM_WMI_LEGACY_PERFSTATE � PPM_WMI_IDLE_STATES �M PPM_WMI_IDLE_STATES_EX 6 PPM_WMI_PERF_STATES �M PPM_IDLE_STATE_ACCOUNTING " PPM_IDLE_ACCOUNTING # �M PPM_IDLE_STATE_ACCOUNTING_EX �F PPM_IDLE_ACCOUNTING_EX }M PPM_PERFSTATE_EVENT ! yM PPM_PERFSTATE_DOMAIN_EVENT )+ PPM_IDLESTATE_EVENT uM PPM_THERMALCHANGE_EVENT qM PPM_THERMAL_POLICY_EVENT �) POWER_ACTION_POLICY
8 SYSTEM_POWER_LEVEL �) PO_WAKE_SOURCE_TYPE # t PO_INTERNAL_WAKE_SOURCE_TYPE �K PTP_WAIT_CALLBACK 0G MCA_EXCEPTION_TYPE �$ RTL_DISK_SPACE_POLICY ' G RTL_DISK_WRITE_CONSTRAINT_POLICY {( RTL_BSD_ITEM_TYPE �@ RTL_ACE_DATA ! ACTCTX_REQUESTED_RUN_LEVEL ( �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE & �J RTLWOW64_CROSSPROCESS_WORK_HEAD �A BITMAPV5HEADER & 3 DISPLAYCONFIG_SCANLINE_ORDERING n# DISPLAYCONFIG_SCALING .J SHELLHOOKINFO *J POWERBROADCAST_SETTING p+ BSMINFO , FLASHWINFO & J SERVICE_TRIGGER_CUSTOM_STATE_ID r, SERVICE_NOTIFY_2 3 WMIREGGUIDW �I WMIREGINFOW ( WMIDPREQUESTCODE �I MOFRESOURCEINFOW �2 MOFRESOURCEINFOA |I RPC_ENDPOINT_TEMPLATEW xI RPC_ENDPOINT_TEMPLATEA tI RPC_INTERFACE_TEMPLATEA -1 RPC_INTERFACE_TEMPLATEW pI RPC_DISPATCH_TABLE 7 XLAT_SIDE . �D _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST *H PRTL_CRITICAL_SECTION64 # 'H TRACE_PROVIDER_INSTANCE_INFO $H PQUOTA_LIMITS H PUSN_RANGE_TRACK_OUTPUT # �? DISPLAYCONFIG_MODE_INFO_TYPE �! STUB_PHASE H _ALPC_SERVER_INFORMATION �6 USN_RECORD @ PEMRREALIZEPALETTE & H POBJECT_HANDLE_FLAG_INFORMATION � FILEMUIINFO 7 �4 PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY H FIND_BY_SID_OUTPUT �. CHARSETINFO H PPPM_WMI_LEGACY_PERFSTATE 4 _RTL_PROTECTED_ACCESS , H JOBOBJECT_IO_RATE_CONTROL_INFORMATION - 9 _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET $ H PPERFINFO_DOMAIN_CHANGE_EVENT �G _TOKEN_PRIMARY_GROUP ! �G PFILE_FS_LABEL_INFORMATION # 3C _MANAGE_HOT_PATCH_LOAD_PATCH E FILE_PIPE_WAIT_FOR_BUFFER �G PRTL_CIRCULAR_LIST_HEAD D LPGRADIENT_TRIANGLE ' 6 LEARNING_MODE_OBJECT_INFORMATION $ �G PETW_CLOCK_STATE_CHANGE_EVENT u0 _RTL_LFG_RNG_STATE �G PLOGFONT ! �G PSECURITY_OBJECT_AI_PARAMS $ �5 _FILE_ID_BOTH_DIR_INFORMATION / JE _READ_DIRECTORY_NOTIFY_INFORMATION_CLASS ) C FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 3 �G FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE ( �$ _ETW_COVERAGE_SAMPLER_CREATE_INFO �G PANSI_STRING32 ! �G PTP_POOL_STACK_INFORMATION �E _IMAGE_POLICY_METADATA ! �G PWMI_PROCESS_INFORMATION64 W* ETWTRACECONTROLCODE ( �G EVENT_EXTENDED_ITEM_STACK_TRACE64 �G PFILE_STAT_INFORMATION ( �3 _FILE_FS_FULL_SIZE_INFORMATION_EX % �G SL_KMEM_CACHE_VALUE_DESCRIPTOR �! EMRREALIZEPALETTE �G PCTOUCHINPUT 2 ~= PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY �G POSVERSIONINFOEX2A w" RTL_PERTHREAD_CURDIR
LPBYTE �G PRPC_SECURITY_QOS_V4_A �G PSID_AND_ATTRIBUTES_ARRAY �G PTP_SIMPLE_CALLBACK - �G DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE �G PWMI_PUSHLOCK �G EMRNAMEDESCAPE & ! ETW_COVERAGE_SAMPLER_QUERY_INFO PT2_CANCEL_PARAMETERS & �G PSYSTEM_MEMORY_LIST_INFORMATION �G PTEB_ACTIVE_FRAME_CONTEXT �= _PS_CPU_QUOTA_QUERY_ENTRY �& LPJIT_DEBUG_INFO64 �G RPC_POLICY & �G PSYSTEM_PERFORMANCE_INFORMATION �G PPLUGPLAY_NOTIFY_HDR " �G PCONSOLE_SCREEN_BUFFER_INFO �G SC_ACTION �G PHEAP_BLOCK_INFORMATION �. MOUSEINPUT & Y! ALPC_MESSAGE_HANDLE_INFORMATION �# RTL_CONDITION_VARIABLE �G PHPOWERNOTIFY ! �G _EVENT_EXTENDED_ITEM_TS_ID : _PERFINFO_CCSWAP_TYPE <F _TEB_ACTIVE_FRAME_CONTEXT 9 �G PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION � _CACHE_RELATIONSHIP � float32x2x4_t # PS_SECURITY_DOMAIN 0 �G PMEMORY_PARTITION_INITIAL_ADD_INFORMATION 4 �G PSEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION % �= ACTIVATION_CONTEXT_QUERY_INDEX % �G tagI_RpcProxyCallbackInterface �= IMAGE_ENCLAVE_CONFIG64 �G PTOKEN_OWNER �: SERVICE_STATUS # PDWORDLONG � RUNTIME_FUNCTION �G PRTL_HEAP_PARAMETERS �G PRTLP_CURDIR_REF �' USER_MARSHAL_CB_TYPE 9( GESTUREINFO $ �G PFILE_PIPE_SILO_ARRIVAL_INPUT ' RTL_FEATURE_VARIANT_PAYLOAD_KIND ]F BOOT_ENTRY_LIST a _PERFINFO_GROUPMASK _7 tagMONITORINFO � tagCANDIDATEFORM �G PGENERIC_BINDING_INFO $ }G PSD_CHANGE_MACHINE_SID_OUTPUT " |G PFILE_FS_VOLUME_INFORMATION v _AUDIT_EVENT_TYPE xG PRTL_BITMAP_RUN % tagEMRARC vG PVARIABLE_NAME_AND_VALUE tG _CPU_CONFIG_RECORD oG _COVERAGE_MODULE_INFO mG RPC_DISPATCH_FUNCTION jG PTOKEN_INFORMATION_CLASS F _CM_RESOURCE_LIST , hG _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA �+ RTL_OSVERSIONINFOEXW ' aG PCREATEFILE2_EXTENDED_PARAMETERS % �: _FILE_NETWORK_OPEN_INFORMATION + �5 _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA
�0 NPRECT # ^G ETW_PARTITION_INFO_EXTENSION + # _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA �4 WNDCLASS ZG CPINFOEX ) �A _SYSTEM_CONTEXT_SWITCH_INFORMATION F CM_RESOURCE_LIST + _OUTLINETEXTMETRICW + FS_INFORMATION_CLASS T _EVENT_RECORD $ =' IMAGE_LOAD_CONFIG_DIRECTORY32 PCALL_FRAME & �: HEAP_BLOCK_SETTABLE_INFORMATION TG LPRIP_INFO �A _FILE_RENAME_INFO & ~E JOBOBJECT_BASIC_UI_RESTRICTIONS RG DECRYPTION_STATUS_BUFFER /2 SHRINK_VOLUME_INFORMATION ' � _SERVICE_DELAYED_AUTO_START_INFO NG RPC_IF_ID KG RC_CONFIG EG PEMRMODIFYWORLDTRANSFORM 0 @G PETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT � int64x1x4_t $ >G PSECURE_MEMORY_CACHE_CALLBACK 9G HENHMETAFILE 6G PERFINFO_FILE_INFORMATION
t INT * 0 _SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT - 3G PREFS_VOLUME_COUNTER_INFO_INPUT_BUFFER < _FILE_ALIGNMENT_INFO * S4 REFS_DEALLOCATE_RANGES_INPUT_BUFFER � PROCESSOR_IDLE_TIMES % 2G PTRANSACTION_BASIC_INFORMATION H* _ALPC_MESSAGE_ATTRIBUTES % Q) ACTCTX_SECTION_KEYED_DATA_2600 % .G PSYSTEM_RESOURCE_ATTRIBUTE_ACE -G PTIMERAPCROUTINE u PEN_FLAGS ( k& _SYSTEM_ALARM_CALLBACK_OBJECT_ACE ( COMMPROP % =$ _ETW_TP_EVENT_CALLBACK_ENQUEUE G _ETW_TP_EVENT_TIMER_SET 4 (G PCACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA � PEMRSETTEXTALIGN &G PSERVICE_TRIGGER %G LPIID $G PTHREAD_UMS_INFORMATION '
C _PROCESS_ENERGY_VALUES_EXTENSION #G PSYSTEM_BASIC_INFORMATION "G PCM_INT13_DRIVE_PARAMETER G STYLESTRUCT �8 LUID_AND_ATTRIBUTES �= CONTAINER_VOLUME_STATE ]9 _XSTATE_CONFIGURATION 5 G PASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA G ETW_TP_EVENT_TIMER_SET �* PEXTLOGFONTW G LPSERVICE_MAIN_FUNCTIONA q NPREGISTERWORDW �# _PS_STD_HANDLE_STATE 4 G PFILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX �D PO_WAKE_SOURCE_FIXED ! G PSYSTEM_NUMA_PROXIMITY_MAP � LAST_EXCEPTION_LOG �- PEMRPOLYBEZIERTO #- REARRANGE_FILE_DATA G EMRSETPALETTEENTRIES 9 PMOUSEMOVEPOINT % �> POWER_THROTTLING_PROCESS_STATE & N+ _RTL_FEATURE_CONFIGURATION_TYPE G LPSERVICE_STATUS �* PPHYSICAL_ADDRESS ?. OBJECT_BASIC_INFORMATION . $@ _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY 3
G PACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA T* POLYTEXTA � _PLUGPLAY_CONTROL_CLASS G _MUIREGISTRYINFO �F PIMAGE_CHPE_METADATA_X86 6 �9 SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION " �F PKEY_VALUE_FULL_INFORMATION # tagEMREXTSELECTCLIPRGN �F PHEAP_SUBSEGMENT_ALLOC � int16x4x3_t �F PPPM_IDLE_ACCOUNTING_EX �E LDR_RESLOADER_RET $ � PROCESS_HANDLE_TRACING_ENABLE D? XSAVE_AREA_HEADER 1 ACCEL , PCUNZWCH # �" _FILE_ALLOCATION_INFORMATION �F PFILE_SET_SPARSE_BUFFER % YF _DISPLAYCONFIG_SDR_WHITE_LEVEL $ �< _SERVICE_FAILURE_ACTIONS_FLAG % �F PIMAGE_LOAD_CONFIG_DIRECTORY64 ( �! _VIRTUAL_MEMORY_INFORMATION_CLASS �F NPNEWTEXTMETRIC �F PPROCESSOR_NUMBER " �F _SE_PACKAGE_CAPABILITY_INFO =@ SYSTEM_POWER_CAPABILITIES �F PPROCESSOR_POWER_POLICY 0 �= _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS �F SL_HWID_DEVICE_INFO
+ LPOUTLINETEXTMETRICW �E _WIN32K_SYSCALL_FILTER # J SYSTEM_FILECACHE_INFORMATION �4 tagWNDCLASSA ! �F PDUPLICATE_EXTENTS_DATA_EX O* MDICREATESTRUCT PNTSTATUS % �5 _KEY_CONTROL_FLAGS_INFORMATION �6 tagPOINTER_INPUT_TYPE �@ PRTL_DELETE_LOCK_ROUTINE & OF ALPC_SERVER_SESSION_INFORMATION �F WAITORTIMERCALLBACK �( ACCESS_DENIED_OBJECT_ACE & �F PSTREAMS_QUERY_ID_OUTPUT_BUFFER �F PSERVICE_TRIGGER_INFO . �F PSYSTEM_THREAD_CID_PRIORITY_INFORMATION �C PRTL_TRACE_BLOCK � OEM_STRING - �F PJOBOBJECT_MEMORY_USAGE_INFORMATION_V2 �F PRTL_FEATURE_USAGE_REPORT j# _WMI_TRACE_PACKET 3 ,- _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 + �6 _SYSTEM_ELAM_CERTIFICATE_INFORMATION �F _WNODE_HEADER ] HIBERFILE_BUCKET " �6 KEY_VALUE_BASIC_INFORMATION " �> SYSTEM_VHD_BOOT_INFORMATION � IMAGE_THUNK_DATA64 �F _FP_IEEE_VALUE ' � _PERFINFO_PPM_THERMAL_CONSTRAINT �F PIO_STATUS_BLOCK32 ' � _FILE_FS_DRIVER_PATH_INFORMATION �F GRAYSTRINGPROC �F PWINDOWINFO 4 LPTIME_ZONE_INFORMATION & �> _ETW_TP_EVENT_TIMER_SET_NTTIMER $ _HARDERROR_RESPONSE tC _FILE_DISPOSITION_INFO 3 �+ ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION XD _OUTPUT_DEBUG_STRING_INFO �< REASON_BUFFER 0 �F PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED MIDL_STUB_DESC 6 � RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY MENUTEMPLATE �F LPREMOTE_NAME_INFO eF FILE_LAYOUT_ENTRY �F PRTL_AVL_COMPARE_ROUTINE ) �F PWIM_PROVIDER_REMOVE_OVERLAY_INPUT �F PNV_MEMORY_RANGE �F PPOOLED_USAGE_AND_LIMITS % �F _FILE_MOVE_CLUSTER_INFORMATION �; _FILE_PATH b _CM_MCA_POS_DATA �$ LPREGISTERWORDA �F _PERFINFO_FLT_OPERATION �F PFILE_LEVEL_TRIM_RANGE % �F PFILE_PIPE_EVENT_SELECT_BUFFER �F LPCURRENCYFMT � _PERFINFO_IPI_SEND_DATA �F _SYSTEM_ALARM_OBJECT_ACE ) �F PSYSTEM_WATCHDOG_TIMER_INFORMATION $ �F PWOW64_DESCRIPTOR_TABLE_ENTRY � AXISINFO ( � _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE �F ETW_HEAP_EVENT_SNAPSHOT �F CI_LOG_SCHEDULER_WAKEUP ' - SYSTEM_SINGLE_MODULE_INFORMATION 0 �F PEVENT_TRACE_SESSION_SECURITY_INFORMATION Q WAIT_TYPE % �F _FILE_ZERO_DATA_INFORMATION_EX �F SYSDBG_PHYSICAL ~F PEMRSETPIXELV }F PEISA_MEMORY_TYPE / |F PTRANSACTIONMANAGER_RECOVERY_INFORMATION ) �< SYSTEM_SET_TIME_ADJUST_INFORMATION ! {F PRTL_UNICODE_STRING_BUFFER dD PS_ATTRIBUTE * tagEMRSETVIEWPORTEXTEX ]> GUITHREADINFO �? DPI_HOSTING_BEHAVIOR zF PPERFINFO_SPINLOCK_CONFIG 30 _PERFINFO_MM_STAT $ yF PREQUEST_OPLOCK_OUTPUT_BUFFER " wF _PROCESS_UPTIME_INFORMATION & pF PSYSTEM_DEVICE_DATA_INFORMATION ) oF PPLUGPLAY_CONTROL_CONFLICT_STRINGS nF PHDEVNOTIFY " �% TOKEN_SECURITY_ATTRIBUTE_V1 jF HMONITOR
A DOUBLE ) Q+ SYSTEM_FEATURE_CONFIGURATION_QUERY + iF RTL_SPARSE_BITMAP_ENUMERATE_CALLBACK �= tagSCROLLINFO # p* ETW_TP_EVENT_CALLBACK_CANCEL & IMAGE_RESOURCE_DIRECTORY_STRING eF _FILE_LAYOUT_ENTRY # aF FILE_PIPE_SILO_ARRIVAL_INPUT ! A _ETW_REFDEREF_OBJECT_EVENT ! ! _SECURE_SETTING_VALUE_TYPE ]F _BOOT_ENTRY_LIST $ YF DISPLAYCONFIG_SDR_WHITE_LEVEL VF PRID_DEVICE_INFO_MOUSE $3 SYSTEM_MEMORY_INFORMATION TF KEY_CACHED_INFORMATION QF PHEAP_EVENT_RANGE_CREATE � TP_TASK �* EXTLOGFONTW UCHAR �* _RTL_DRIVE_LETTER_CURDIR . \/ _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION ' MF PALPC_SERVER_SESSION_INFORMATION ! (% FILE_NUMA_NODE_INFORMATION > � SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY KF PMSGBOXPARAMS JF PCNZTCH # -E _SYSTEM_PAGEFILE_INFORMATION �@ PRTL_RELEASE_LOCK_ROUTINE HF HEAP_BLOCK_INFORMATION EF EMRINTERSECTCLIPRECT �. IMAGE_DYNAMIC_RELOCATION BF PPLUGPLAY_EVENT_BLOCK ! >F PSTORAGE_RESERVE_AREA_INFO � FMTID ! :F PCTEB_ACTIVE_FRAME_CONTEXT % 9F PNTFS_FILE_RECORD_INPUT_BUFFER 1 8F PSYSTEM_FEATURE_CONFIGURATION_UPDATE_ENTRY �+ MM_ETW_PAGE_INFO_EX ( 6F SYSTEM_MEMORY_CHANNEL_INFORMATION 2F FOUR_PART_VERSION )F PFILE_ID_128 �# VIDEOPARAMETERS $ u KAFFINITY_ENUMERATION_CONTEXT %F PCM_SCSI_DEVICE_DATA .7 EXTLOGFONT #F PIMAGE_NT_HEADERS32 .< CM_SONIC_DEVICE_DATA W5 COMPAREITEMSTRUCT # "F PSECURITY_QUALITY_OF_SERVICE !F PENCLAVE_CREATE_INFO_SGX F LPJIT_DEBUG_INFO F PEMRPIXELFORMAT �8 LPCOMBOBOXINFO �8 _LUID_AND_ATTRIBUTES ( F PTXFS_READ_BACKUP_INFORMATION_OUT " F PPERFINFO_BATTERY_LIFE_INFO ( 2 _PERFINFO_KERNELMEMORY_USAGE_TYPE F PLUID int64x1x2_t F LPPOINTFX F PWNDCLASSEX $ �4 FILE_MAILSLOT_SET_INFORMATION $ s@ SYSTEM_SECUREBOOT_INFORMATION �1 WTSSESSION_NOTIFICATION ( = FILE_IS_REMOTE_DEVICE_INFORMATION , F JOURNAL_CREATE_DELETE_KEY_INFORMATION �$ RTL_DISK_SPEED_POLICY !2 tagLOGCOLORSPACEW F tagEMREXTESCAPE int32x2x2_t & KD STORAGE_RESERVE_AREA_DEFINITION �# IO_ERROR_LOG_PACKET - T MEMORY_PARTITION_NODE_PAGE_INFORMATION + �; _PERFINFO_PAGECOMBINE_AGGREGATE_STAT + �C FILE_IO_PRIORITY_HINT_INFORMATION_EX , F PJOURNAL_SET_KEY_SECURITY_INFORMATION jE LPPOLYTEXTW F PCM_PNP_BIOS_DEVICE_NODE � _THREAD_UMS_INFORMATION & F DISPLAYCONFIG_VIDEO_SIGNAL_INFO �3 PATHNAME_BUFFER F EVENTSFORLOGFILE �E PCM_RESOURCE_LIST $ �E PPLUGPLAY_CONTROL_STATUS_DATA " LCID BOOLEAN �E PTP_CALLBACK_ENVIRON �! EMRCLOSEFIGURE !6 tagEMRSELECTOBJECT �4 WNDCLASSEXW �E VARIABLE_NAME_AND_VALUE �E PRPC_SECURITY_QOS_V3_W �( _SCOPE_TABLE_ARM $ �) _THREAD_PROFILING_INFORMATION ! " RTL_SPARSE_BITMAP_CTX_LOCK �E DISPLAYCONFIG_TARGET_MODE t ptrdiff_t $ �E _SYSTEM_ROOT_SILO_INFORMATION s _TRANSACTION_OUTCOME �E PUNICODE_PREFIX_TABLE # �@ PRTL_INITIALIZE_LOCK_ROUTINE �1 tagSTICKYKEYS ? PELARRAY 42 FP_80 O@ _REQUESTER_TYPE ~< _ALPC_HANDLE_ATTR32 �E PCIMAGE_POLICY_METADATA b' PCRITICAL_SECTION_DEBUG p PINT8 � LPCTSTR �E FILE_ID_BOTH_DIR_INFO �4 WNDCLASSA 4 �E _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE � _IRQ_DEVICE_POLICY ( � _PERFINFO_DPC_ENQUEUE_INFORMATION �: OBJECT_ATTRIBUTES64 �B LPMULTIKEYHELPA �E _WMI_TRACE_MESSAGE_PACKET " >D _TRACE_ENABLE_FLAG_EXT_ITEM . _SYSTEM_SPECULATION_CONTROL_INFORMATION �E PFILE_RENAME_INFO % � DISPLAYCONFIG_DEVICE_INFO_TYPE �E CONSOLE_CURSOR_INFO 7 STATE_LOCATION_TYPE �E _IMAGE_EXPORT_DIRECTORY �% PCWCH � UNICODE_STRING64 �E PWIN32K_SYSCALL_FILTER # tagEMRSETMITERLIMIT � TRACE_PROFILE_INTERVAL iB WMI_TCPIP �E PETW_PRIORITY_EVENT �: CSTRING + ]1 TRANSACTIONMANAGER_BASIC_INFORMATION �E POPTICAL_MEDIA_RECORD �E PULARGE_INTEGER * �E PJOBOBJECT_MEMORY_USAGE_INFORMATION 1 �E _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY 3 %D RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY h% tagWNDCLASSEXA � __n64x4 �* LOCALE_ENUMPROCW # �E LPQUERY_SERVICE_LOCK_STATUSA & ? PROCESS_WS_WATCH_INFORMATION_EX ! �9 ENABLE_TRACE_PARAMETERS_V1 �. _PERFINFO_VIRTUAL_ALLOC �/ DPI_AWARENESS �= LPMSLLHOOKSTRUCT 4 ; SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST �E RTL_HEAP_COMMIT_ROUTINE �E PIMAGE_HOT_PATCH_HASHES � MUTANT_INFORMATION_CLASS ' �E PETW_DFSS_RELEASE_THREAD_ON_IDLE �E PRTL_RESOURCE_DEBUG �E PCUNICODE_STRING 3 /# _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION �" tagACCESSTIMEOUT ' �> _CSV_QUERY_VOLUME_REDIRECT_STATE 3 �E _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE �E _LDR_RESLOADER_RET .6 EXCEPTION_DEBUG_INFO }" tagFEEDBACK_TYPE �E PETW_CRITSEC_EVENT_INIT
USN & =2 _PROCESS_MITIGATION_ASLR_POLICY '= _STREAM_LAYOUT_ENTRY $ �? ENCLAVE_CREATE_INFO_VBS_BASIC # �E NDR_USER_MARSHAL_INFO_LEVEL1 ( PERFINFO_DYNAMIC_TICK_VETO_REASON G: tagCANDIDATELIST " CALID " RPC_LENGTH - �8 ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT ! �E PFILE_FULL_DIR_INFORMATION �E SYSNLS_FUNCTION �E _ETW_HEAP_EVENT_FREE �( _IMAGE_SECTION_HEADER s! BOOT_ENTRY ! �E LDR_IMPORT_MODULE_CALLBACK �E PRTL_DEBUG_INFORMATION32 !# BUS_DATA_TYPE _ImageArchitectureEntry �E _MALLOC_FREE_STRUCT S7 tagHANDEDNESS I0 POINTER_DEVICE_PROPERTY 3) tagCOLORMATCHTOTARGET & �E IMAGE_CE_RUNTIME_FUNCTION_ENTRY �E PUSEROBJECTFLAGS R6 PROCESSOR_POWER_POLICY ' �E PJOBOBJECT_ENERGY_TRACKING_STATE ! �E WIM_PROVIDER_OVERLAY_ENTRY �E PSYSTEM_FLAGS_INFORMATION y$ _REG_NOTIFY_INFORMATION ' ~E _JOBOBJECT_BASIC_UI_RESTRICTIONS + {E PEVENT_TRACE_PROFILE_ADD_INFORMATION zE PIMAGE_DEBUG_DIRECTORY # yE PLDR_MANIFEST_PROBER_ROUTINE �? _REMOTE_NAME_INFOA ; vE PPROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION
�7 tagEMR !2 LOGCOLORSPACEW ( uE PPERFINFO_DRIVER_COMPLETE_REQUEST FILESYSTEM_STATISTICS ( � _JOURNAL_CHANGE_INFORMATION_CLASS $ tE PRTL_XPRESS_CALLBACK_FUNCTION * oE LPSERVICE_REQUIRED_PRIVILEGES_INFOA �: RTL_PROCESS_MODULES jE PPOLYTEXTW 1D PROXY_PHASE aE PWMI_LOGGER_INFORMATION _E PCOVERAGE_MODULE_REQUEST � _RTL_PATH_TYPE ]B LPRGBTRIPLE ]E _ETW_UMS_EVENT_PARK $ WE PPROCESS_HANDLE_TRACING_ENTRY ! 9 _FILE_MAILSLOT_PEEK_BUFFER # �D RTL_PROCESS_VERIFIER_OPTIONS VE LPDISCDLGSTRUCT UE PSERVERSILO_STATE " QE PMEMORY_BASIC_INFORMATION32 - OE PMANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES cA _ETW_DISKIO_READWRITE_V3 # NE PCIMAGE_DELAYLOAD_DESCRIPTOR / LE PREAD_DIRECTORY_NOTIFY_INFORMATION_CLASS � MOUSEHOOKSTRUCTEX # �" PERFINFO_CC_WORKITEM_ENQUEUE q PUINT16 GE _CONSOLE_HISTORY_INFO ( LA _RPC_BINDING_HANDLE_SECURITY_V1_A ( �? JOBOBJECT_CONTAINER_IDENTIFIER_V2 / DE PSYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX - BE _SERVICE_CONTROL_STATUS_REASON_PARAMSW >E RPC_SERVER_INTERFACE ! �C _ACCESS_ALLOWED_OBJECT_ACE :E STARTING_VCN_INPUT_BUFFER 6E _FILE_ATTRIBUTE_TAG_INFO 3E DESKTOPENUMPROC
! USHORT 2E PPROCESS_ENERGY_VALUES & 1E PPLUGPLAY_CONTROL_CONFLICT_LIST 0E PEMRFILLPATH A _NIC_RECORD /E PMFT_ENUM_DATA " -E SYSTEM_PAGEFILE_INFORMATION ! *E _SECTION_IMAGE_INFORMATION
�2 MSG !E PRTL_BALANCED_LINKS E RTL_SPARSE_BITMAP_CTX ( _ACTIVATION_CONTEXT_STACK E PTXFS_LIST_TRANSACTIONS & E _ETW_COVERAGE_SAMPLER_PERF_INFO / �. ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION *8 DISCDLGSTRUCTW �( _ACCESS_DENIED_OBJECT_ACE Q _FILE_STANDARD_INFO , �> EVENT_TRACE_STACK_CACHING_INFORMATION E HW_PROFILE_INFOW `+ EMRSETICMPROFILE r, SERVICE_NOTIFYA i- IMAGE_RESOURCE_DATA_ENTRY ! E PFILE_PIPE_WAIT_FOR_BUFFER E PEVENT_FILTER_EVENT_ID 8 �4 _PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY E PSCRUB_DATA_INPUT E PCTEB_ACTIVE_FRAME G PROCESS_BASIC_INFORMATION �D IO_SESSION_CONNECT_INFO �6 SCRUB_DATA_INPUT e RTL_RESOURCE_DEBUG � _IO_SESSION_STATE ' PREFIX_TABLE_ENTRY Q8 ETW_PRIORITY_EVENT 1 �; _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION int16x4x2_t , 1 TRANSACTIONMANAGER_OLDEST_INFORMATION ^ TRACE_ENABLE_CONTEXT � SID_NAME_USE �2 _CI_LOG_MMCSS_STOP ( �D PPERFINFO_CC_EXTRA_WB_THREAD_INFO �D _TOKEN_ELEVATION $ � ALTERNATIVE_ARCHITECTURE_TYPE �D LPHELPWININFO �D PBOOT_AREA_INFO �D _SYSTEM_POWER_STATUS �D pthreadlocinfo % q IMAGE_DYNAMIC_RELOCATION_TABLE '= STREAM_LAYOUT_ENTRY - RTL_FREE_STRING_ROUTINE qB MIDL_SYNTAX_INFO ! wctype_t * �D _ALPC_PORT_MESSAGE_ZONE_INFORMATION �" HIBERFILE_BUCKET_SIZE * �D PSECTION_INTERNAL_IMAGE_INFORMATION �D PCOMPRESSED_DATA_INFO f? KEYBDINPUT � tagRAWINPUTDEVICELIST ( tagLC_ID �D _IO_SESSION_CONNECT_INFO " �D PFSCTL_QUERY_FAT_BPB_BUFFER ( �D PSYSTEM_CODEINTEGRITY_INFORMATION ' s& _EVENT_TRACE_VERSION_INFORMATION �D PCLIENT_ID * �D PSYSTEM_PROCESSOR_POWER_INFORMATION $ _DISPLAYCONFIG_COLOR_ENCODING �- _MIDL_STUBLESS_PROXY_INFO ) �D TOKEN_SECURITY_ATTRIBUTE_OPERATION �D HUMPD
63 ACL �D PLDRP_CSLIST �D PKUSER_SHARED_DATA �D LPMENUITEMINFOW � CRM_PROTOCOL_ID # �@ ETW_KTIMER2_EXPIRATION_EVENT �D PTP_DEBUG_CLASS �D PAXESLISTA �D PREPAIR_COPIES_OUTPUT RPC_AUTHZ_HANDLE ( 1 FILE_MEMORY_PARTITION_INFORMATION �5 _HEAP_INFORMATION �D PDRAWPATRECT /@ PIMAGE_TLS_CALLBACK # �: _IMAGE_SEPARATE_DEBUG_HEADER ?0 _GDI_TEB_BATCH % �D _EXCEPTION_REGISTRATION_RECORD . �D PSTORAGE_QUERY_DEPENDENT_VOLUME_REQUEST � _WMI_SPINLOCK -B CM_PNP_BIOS_DEVICE_NODE / �D PHEAP_QUERY_INFORMATION_CALLBACK_ROUTINE
�D PCOORD 1 �D PFSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX B* _PLUGPLAY_EVENT_BLOCK �D PNONCLIENTMETRICSA * [ _LDR_DLL_UNLOADED_NOTIFICATION_DATA - �. PROCESS_DYNAMIC_EH_CONTINUATION_TARGET �& VM_COUNTERS $ �( _RTL_USER_PROCESS_INFORMATION �1 LPMINMAXINFO PMIDL_XMIT_TYPE + @ _FILE_SYSTEM_RECOGNITION_INFORMATION � PZPCWSTR � RTL_RB_TREE �D _PO_WAKE_SOURCE_FIXED # �D _PLUGPLAY_CONTROL_DEPTH_DATA �D PROPENUMPROCEX �) _STRING32 �D LPTOGGLEKEYS & �D PHEAP_REUSE_THRESHOLD_ACTIVATED �D PKEY_VALUE_ENTRY # �D CONSOLE_SCREEN_BUFFER_INFOEX " / WMI_IMAGELOAD_INFORMATION32 .> MONITORINFOEX �, RPC_SID ! �D TXFS_GET_METADATA_INFO_OUT �D POINTER_INFO �D PEXCEPTION_LOG # � _FILE_MAKE_COMPATIBLE_BUFFER 0 �4 _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY TP_CALLBACK_ENVIRON �D PRTL_HEAP_COMMIT_ROUTINE $ �D PRTL_PROCESS_VERIFIER_OPTIONS $ �D _PERFINFO_DOMAIN_CHANGE_EVENT % �D PMEMORY_EXHAUSTION_INFORMATION �D PSYSTEM_VERIFIER_ISSUE ' D PCI_LOG_SCHEDULER_SLEEP_RESPONSE � LPUWSTR 1: PCURSORINFO �2 _HEAP_RANGE_CREATE }D IMAGE_SYMBOL_EX tD PIMAGE_AUX_SYMBOL rD PPOWER_USER_PRESENCE_TYPE qD LPTPMPARAMS oD _StreamInformation 6 jD SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION % L7 _WMI_JOB_SET_QUERY_INFORMATION fD POBJECT_TYPES_INFORMATION bD PPS_ATTRIBUTE � TP_CLEANUP_GROUP `D tagNEWTEXTMETRICEXA [D PCSV_QUERY_FILE_REVISION �8 EISA_PORT_CONFIGURATION XD OUTPUT_DEBUG_STRING_INFO UD EMRFILLPATH ! �0 LPC_UNREGISTER_PROCESS_MSG 3 QD SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION D METARECORD " ND OFFSETINSTANCEDATAANDLENGTH ' KD _STORAGE_RESERVE_AREA_DEFINITION HD _SINGLE_LIST_ENTRY32 # CSVFS_DISK_CONNECTIVITY & �1 RTLP_PROCESS_REFLECTION_CONTEXT ) � _PROCESS_ENERGY_COMPONENT_TYPE_NUM h. _RPC_SECURITY_QOS_V4_A /% IDL_CS_CONVERT �& _SYSTEM_TRACE_HEADER �" _PERFINFO_CCSWAP_BUFFER ) DD _EVENT_TRACE_GROUPMASK_INFORMATION s3 _IMAGE_AUX_SYMBOL ! AD PFILE_INFO_BY_HANDLE_CLASS @D LPEVENTMSG ! >D TRACE_ENABLE_FLAG_EXT_ITEM ;D PENCRYPTION_BUFFER % �* FILE_IO_COMPLETION_INFORMATION :D PETW_HEAP_EVENT_REALLOC 9D POSVERSIONINFOEX 8D PBITMAPINFO � SYSTEM_ALARM_CALLBACK_ACE , �A _JOBOBJECT_EXTENDED_LIMIT_INFORMATION $ 4D PJOURNAL_ABSOLUTE_INFORMATION ,D PTHREAD_TLS_INFORMATION �9 PROCESSOR_IDLE_STATE *D ETW_HEAP_EVENT_EXPANSION _HEAP_SUBSEGMENT_INIT m5 _TOKEN_USER_CLAIMS �@ ACTCTX_SECTION_KEYED_DATA " _KLOCK_QUEUE_HANDLE 4 %D _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY !D LBR_TRACE_EVENT_DATA
C NT_TIB ( � _RTL_FEATURE_CONFIGURATION_UPDATE D LPHEAP_SUMMARY " �7 _PERFINFO_PROCESS_PERFCTR32
� LPGUID �$ uint16x8x4_t g RTL_TRACE_ENUMERATE ; D PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME * D _PERFINFO_PO_CALIBRATED_PERFCOUNTER & D PFILE_PIPE_DELETE_SYMLINK_INPUT D PGRADIENT_TRIANGLE D LPWINDOWPOS PVOID D PCSV_CONTROL_OP D PMETARECORD % D PTHREAD_CYCLE_TIME_INFORMATION ! D PPERFINFO_IPI_RECEIVE_DATA
D PLDR_SECTION_INFO D _DataStream D SYSTEM_BATTERY_STATE D RTL_RUN_ONCE_INIT_FN u> _FILE_BASIC_INFORMATION �C LOGBRUSH32 . WORKERCALLBACKFUNC �C PRTLP_EXIT_THREAD m4 tagEMRPIXELFORMAT % �; _SYSTEM_PROCESS_ID_INFORMATION S! tagMENUINFO �C _ETW_DISKIO_READWRITE_V2 �C RTL_TRACE_BLOCK �C BULK_SECURITY_TEST_DATA ! �C _SYSTEM_THREAD_INFORMATION a, LOAD_DLL_EVENT_DATA � _TRACE_QUERY_INFO_CLASS �C RPCLT_PDU_FILTER_FUNC PCSZ 1 �C PRTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY �C LPQUERY_SERVICE_CONFIG �C I_RpcFreeCalloutStateFn $ � IMAGE_DYNAMIC_RELOCATION32_V2 �C PMM_ETW_PAGE_INFO � MESSAGE_RESOURCE_BLOCK �C PFILE_ALLOCATION_INFO �9 PEMRSETICMPROFILE a" _QUERY_FILE_LAYOUT_OUTPUT �C PIMAGE_NT_HEADERS64 �C UILANGUAGE_ENUMPROCA & � _THREAD_UMS_INFORMATION_COMMAND �C PHEAP_INFORMATION �" NPLOGFONTW ) �C PFILE_IS_REMOTE_DEVICE_INFORMATION + �C ACTIVATION_CONTEXT_BASIC_INFORMATION �- PROCESSOR_IDLE_STATES �1 tagENHMETARECORD �C PCI_LOG_SCHEDULER_EVENT �C _RTL_PROCESS_BACKTRACES �C PGESTURENOTIFYSTRUCT , �C _FILE_IO_PRIORITY_HINT_INFORMATION_EX * �C _SYSTEM_VERIFIER_FAULTS_INFORMATION , F5 _EVENT_TRACE_SYSTEM_EVENT_INFORMATION �C IMAGE_DEBUG_DIRECTORY �1 GLYPHMETRICSFLOAT �C IMAGE_ARCHITECTURE_HEADER . �C PROCESS_READWRITEVM_LOGGING_INFORMATION �C PPROCESS_ACCESS_TOKEN
�C HKL �7 EVENT_TRACE_PROPERTIES . �C PEVENT_TRACE_PROFILE_CONFIG_INFORMATION �C ACCESS_ALLOWED_OBJECT_ACE �' _IMAGE_HOT_PATCH_INFO �C PUSN_RECORD_V4 * � _SYSTEM_PHYSICAL_MEMORY_INFORMATION � _IRQ_GROUP_POLICY �C tagUSEROBJECTFLAGS �C GENERIC_UNBIND_ROUTINE ( �C PERFINFO_VIRTUAL_ALLOC_XPARTITION ' �C PRTL_IMAGE_MITIGATION_DEP_POLICY �C LPDEBUG_EVENT & �C PPERFINFO_PPM_IDLE_STATE_CHANGE �C PPO_WAKE_SOURCE_TYPE �C MCA_EXCEPTION / �C DISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION ) �= _ACCESS_DENIED_CALLBACK_OBJECT_ACE $ H= SE_SET_FILE_CACHE_INFORMATION �C PFILESYSTEM_STATISTICS 5 C PSYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION }C LPSERVICE_STATUS_PROCESS h; TP_WORK \@ RTL_HEAP_INFORMATION |C PALPC_SECURITY_ATTR ! {C PPERFINFO_BOOT_PHASE_START zC PSCOPE_TABLE_ARM 0 xC _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION tC FILE_DISPOSITION_INFO qC PRPC_CLIENT_ID ]B PRGBTRIPLE * oC CSV_QUERY_FILE_REVISION_FILE_ID_128 gC PINVERTED_FUNCTION_TABLE LPFXPT16DOT16 � tagEMRBITBLT �$ tagEMREOF 0 dC _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION & �$ IO_COMPLETION_BASIC_INFORMATION " aC _PO_SPR_ACTIVE_SESSION_DATA �+ _REASON_CONTEXT t errno_t # �; _FILE_SET_DEFECT_MGMT_BUFFER % ]C _KEY_VALUE_PARTIAL_INFORMATION ! PERFINFO_PROCESS_PERFCTR64 ZC PEVENT_FILTER_DESCRIPTOR ! 1 PPOWER_STATE_DISABLED_TYPE u; _SYSDBG_VIRTUAL B tagEMRRESTOREDC " SECURITY_INFORMATION TC PVM_COUNTERS_EX2 RC PRTL_GENERIC_FREE_ROUTINE PC tagEXTLOGPEN �: PRECONVERTSTRING qB _MIDL_SYNTAX_INFO q WCHAR ! JC PFILE_OBJECTID_INFORMATION HC PMOUSE_EVENT_RECORD w( MANDATORY_LEVEL FC CONSOLE_SELECTION_INFO + �? EVENT_TRACE_SOFT_RESTART_INFORMATION BC _TOKEN_OWNER , $ MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE PBYTE ?C PMEMORY_EXHAUSTION_TYPE $ >C PSYSTEM_TIMEOFDAY_INFORMATION ( |$ MEMORY_RESOURCE_NOTIFICATION_TYPE " X; _SE_LEARNING_MODE_DATA_TYPE ' <C SYSTEM_ACTIVITY_MODERATION_STATE $5 _CREATE_THREAD_DEBUG_INFO :C PDLGITEMTEMPLATE # U$ ETW_TP_EVENT_POOL_TH_MAX_SET / 9C PEVENT_TRACE_PROFILE_COUNTER_INFORMATION 0 tagCOPYDATASTRUCT � SD_GLOBAL_CHANGE_INPUT 7C _SYSTEM_VDM_INSTEMUL_INFO # .C PMANAGE_HOT_PATCH_LOAD_PATCH ) +C _JOBOBJECT_BASIC_LIMIT_INFORMATION & )C PRTL_FEATURE_CONFIGURATION_TYPE (C LPMOUSEKEYS ( � _EVENT_TRACE_SPINLOCK_INFORMATION * 'C PEVENT_TRACE_TAG_FILTER_INFORMATION . ~# _EVENT_TRACE_PROFILE_REMOVE_INFORMATION , K _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 " %C SHARED_VIRTUAL_DISK_SUPPORT " EXECUTION_STATE "C TPP_THREAD_DATA_CALLBACK �? OSVERSIONINFOEX2A �A _SERVICE_TABLE_ENTRYA $ C POWER_THROTTLING_THREAD_STATE C PFILE_INFORMATION_CLASS 4 C PPROCESS_INSTRUMENTATION_CALLBACK_INFORMATION �6 SECTION_BASIC_INFORMATION s int64x2_t s uint32x4_t C _CFG_CALL_TARGET_INFO 5 � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA C DISPLAYCONFIG_2DREGION u7 PPM_WMI_IDLE_STATE ) �B SERVICE_TRIGGER_SPECIFIC_DATA_ITEM C PCLASSIC_EVENT_ID C _ENCRYPTION_BUFFER # _POWER_SESSION_TIMEOUTS 7= _SERVICE_STATUS_PROCESS
C PZPSTR ' �! VIRTUAL_MEMORY_INFORMATION_CLASS �; RPC_TRANSFER_SYNTAX �( SCOPE_TABLE_ARM ' C PPROCESS_ENERGY_VALUES_EXTENSION * C PFILE_PIPE_CLIENT_PROCESS_BUFFER_V2 C PTP_LOG_LEVEL C EMRGLSBOUNDEDRECORD y ETW_KQUEUE_DEQUEUE_EVENT # �. SYSTEM_HANDLE_INFORMATION_EX " �B _JOURNAL_CLIENT_INFORMATION �B tagEMRPOLYDRAW16 " PWNF_CHANGE_STAMP , �< _SYSTEM_QUERY_TIME_ADJUST_INFORMATION & �B PRTL_SEGMENT_HEAP_MEMORY_SOURCE �B LPHW_PROFILE_INFO �B PUPDATELAYEREDWINDOWINFO _LEARNING_MODE_LOG_LEVEL ! � _RTL_IMAGE_POLICY_METADATA �B PMULTIKEYHELPA % �B PVIRTUAL_STORAGE_BEHAVIOR_CODE % �B _BOOT_ENTROPY_SOURCE_NT_RESULT � _ETW_WNF_EVENT_SUBSCRIBE DB _CI_LOG_MMCSS_START ' �B PCSV_QUERY_VOLUME_REDIRECT_STATE # �B PRTL_SPARSE_BITMAP_PARAMETER $ $% SERVICE_LAUNCH_PROTECTED_INFO LIST_ENTRY64 . �B _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE ) ! _WIM_PROVIDER_UPDATE_OVERLAY_INPUT �B HTASK % �B PETW_LAST_DROPPED_EVENT_STRUCT G PCUSHORT 3 = _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION 1 �9 MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION R _PNP_QUERY_RELATION ) �B PWMI_EXTENDED_THREAD_INFORMATION64 " �B PPERFINFO_SET_DEVICES_STATE A NIC_RECORD �B PWOF_EXTERNAL_FILE_ID 4 � SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION # �4 _CM_FULL_RESOURCE_DESCRIPTOR B _RTL_STACK_CONTEXT_ENTRY �> tagEMRSETTEXTCOLOR �B TOUCH_HIT_TESTING_INPUT " �B PPERFINFO_PROCESS_PERFCTR32 $ TRANSACTION_INFORMATION_CLASS �B PNONCLIENTMETRICS �B PETW_SET_KTIMER2_EVENT $ poly8x8_t �B OBJECT_TYPES_INFORMATION � _SERVICE_SID_INFO % �B PISECURITY_DESCRIPTOR_RELATIVE �B PENABLECALLBACK �B EMRALPHABLEND ' �B PERFINFO_DRIVER_COMPLETE_REQUEST �B DEBUG_EVENT �B _LDR_DATA_TABLE_ENTRY32 8 �B PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION t2 HEAP_RANGE_LOG 7 �B _IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION � _ENERGY_STATE_DURATION @> PROCESS_FAULT_INFORMATION � POWER_IDLE_RESILIENCY * �B PSERVICE_TRIGGER_SPECIFIC_DATA_ITEM + �; _PERFINFO_DOMAIN_CHANGE_EVENT_REASON � _SERVICE_TRIGGER_INFO �B PHEAP_RANGE_CREATE �B RTL_UNICODE_STRING_BUFFER } NETWORK_APP_INSTANCE_EA �+ _MUICCENTRY $ �B PPERFINFO_CC_WORKITEM_DEQUEUE �& RTL_RESOURCE_DEBUG64 �B _SC_ACTION_TYPE �B ETW_DEBUG_PRINT_EVENT B PIO_SESSION_EVENT # }B WIM_PROVIDER_START_INTEGRITY zB PRTL_PROTECTED_ACCESS # xB tagEMREXTCREATEFONTINDIRECTW A RTL_DEBUG_INFORMATION32 tB _OVERLAPPED �A SERVICE_TABLE_ENTRY kB PMIDL_SYNTAX_INFO ! _PROCESS_MITIGATION_POLICY � CSV_CONTROL_OP " SERVICE_DESCRIPTIONW gB PWMI_TCPIP �9 LPC_CLIENT_DIED_MSG dB _ALPC_DIRECT_ATTR `B SYSDBG_BUS_DATA " PSECURITY_ATTRIBUTES_OPAQUE ]B NPRGBTRIPLE # [B _FILE_ALLOCATED_RANGE_BUFFER � _KUSER_SHARED_DATA % �; _KNONVOLATILE_CONTEXT_POINTERS # �# RTL_DYNAMIC_HASH_TABLE_ENTRY 4 XB PACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION �= SILOOBJECT_ROOT_DIRECTORY WB PETW_BUFFER_STATE & UB IR_TIMER_EXTRA_CREATE_PARAMETER RB LPAXISINFO " QB PSUBSYSTEM_INFORMATION_TYPE ) JB PSYSTEM_ENTROPY_TIMING_INFORMATION A HB PRTL_QUERY_DEBUG_VIRTUAL_PROCESS_QUERY_INFORMATION_ROUTINE GB LPGCP_RESULTSA FB PARRAY_INFO BB PCI_LOG_MMCSS_START . PFLS_CALLBACK_FUNCTION H AXESLISTA # � _HOT_PATCH_INFORMATION_CLASS @B PSERVICE_NOTIFY_1 RTL_REFERENCE_COUNT EMRPOLYLINE " LDR_EXTERNAL_DLL_PATH >B _PERFINFO_SPINLOCK_CONFIG % =' _IMAGE_LOAD_CONFIG_DIRECTORY32 � _THREADINFOCLASS �+ _MM_ETW_PAGE_INFO_EX # ;B PTRANSACTION_ENLISTMENT_PAIR * �% PROCESS_KEEPALIVE_COUNT_INFORMATION ' 9B _FILE_MAILSLOT_QUERY_INFORMATION " R _FILE_GET_QUOTA_INFORMATION �? _QUERY_BAD_RANGES_OUTPUT 6 { SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION 5B PROCESS_PRIORITY_CLASS � _PROCESSOR_GROUP_INFO 2B PTRACE_LOGFILE_HEADER 1B NDR_NOTIFY2_ROUTINE -B _CM_PNP_BIOS_DEVICE_NODE %B PMUILANGINFO $B LPSC_HANDLE B PRPC_SECURITY_QOS_V5_A * B PVIRTUALIZATION_INSTANCE_INFO_INPUT %
, RTL_SEGMENT_HEAP_MEMORY_SOURCE % x4 _ETW_LAST_DROPPED_EVENT_STRUCT B LPCONNECTDLGSTRUCTA �" JOB_SET_ARRAY B RTL_STACK_CONTEXT_ENTRY �> ABCFLOAT E$ _NUMA_NODE_RELATIONSHIP |, PRGNDATA $ �= tagPOINTER_DEVICE_CURSOR_TYPE # B USER_MARSHAL_FREEING_ROUTINE B IMAGE_FUNCTION_ENTRY64 " B PSYSTEM_CPU_SET_INFORMATION
B PCUUCSSTR & B PACTCTX_SECTION_KEYED_DATA_2600 B EMRRESTOREDC h" EMRLINETO -/ _WMI_PROCESS_INFORMATION B PUSN_JOURNAL_DATA_V0 � _LAST_EXCEPTION_LOG �A PWIN32_FIND_STREAM_DATA �A FILE_RENAME_INFO , <6 _EVENT_TRACE_TIME_PROFILE_INFORMATION 3 q( JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 �A PFILE_LAYOUT_NAME_ENTRY + �A PRPC_HTTP_TRANSPORT_CREDENTIALS_V3_W � PERFINFO_DPC_INFORMATION �A PTP_DEBUG_FREE_INFO �A PRTL_CIRCULAR_LIST_ENTRY � EISA_PORT_DESCRIPTOR A< RTL_HASH_ENTRY �A PCOMPARTMENT_ID �+ _IMAGE_BASE_RELOCATION + �A PROCESS_MITIGATION_IMAGE_LOAD_POLICY * ; _ETW_TRACE_PARTITION_INFORMATION_V2 �A CREATE_PROCESS_DEBUG_INFO {. ALPC_HANDLE_ATTR �A PEFI_DRIVER_ENTRY_LIST � TRACE_ENABLE_INFO $ �A MEMORY_EXHAUSTION_INFORMATION � EMRSETLAYOUT & % FILE_PIPE_CLIENT_PROCESS_BUFFER K% PGRADIENT_RECT " T' ETW_TP_EVENT_CALLBACK_START �* _PO_SLEEP_DISABLE_REASON ! �A PPERFINFO_PO_NOTIFY_DEVICE �A PPO_WAKE_SOURCE_INFO �A LPSIZEL + �A PERFINFO_DRIVER_COMPLETE_REQUEST_RET $ �" _PERFINFO_CC_WORKITEM_ENQUEUE �A _ETW_NOTIFICATION_HEADER , �A _EVENT_TRACE_HEAP_TRACING_INFORMATION N< _RATE_QUOTA_LIMIT V _SYSDBG_COMMAND s4 CORRELATION_VECTOR $ �A PACTIVATION_CONTEXT_MSIX_INFO # �A ETW_TP_EVENT_TIMER_CANCELLED �A LPSERVICE_TABLE_ENTRY " �@ PVECTORED_EXCEPTION_HANDLER a' LPCRITICAL_SECTION BCHAR �9 ETW_WNF_EVENT_CALLBACK ! X4 _FILE_TRACKING_INFORMATION % �A FILE_PROVIDER_EXTERNAL_INFO_V1 �A PRTL_RETPOLINE_ROUTINES �# _SYSDBG_IO_SPACE �A RPC_PROTSEQ_VECTORA - �A PJOBOBJECT_END_OF_JOB_TIME_INFORMATION , �A PJOBOBJECT_EXTENDED_LIMIT_INFORMATION � PROCESS_WAKE_INFORMATION ) �A PSYSTEM_CONTEXT_SWITCH_INFORMATION �, tagLOGPEN " GEOCLASS �( _XMIT_ROUTINE_QUINTUPLE + �A SYSTEM_LOGICAL_PROCESSOR_INFORMATION ' �A PPERFINFO_PPM_THERMAL_CONSTRAINT d TOKEN_GROUPS PSE_SIGNING_LEVEL # �A PETW_DFSS_START_NEW_INTERVAL # �5 FILE_ID_BOTH_DIR_INFORMATION �- SYSTEM_FLAGS_INFORMATION - �A PTOKEN_SECURITY_ATTRIBUTES_INFORMATION }? RTL_UNLOAD_EVENT_TRACE32 � _COMPUTER_NAME_FORMAT ' �& RPC_BINDING_HANDLE_TEMPLATE_V1_A " Q$ _PERFINFO_CC_CAN_WRITE_FAIL ! X; SE_LEARNING_MODE_DATA_TYPE + �A DISPLAYCONFIG_SET_TARGET_PERSISTENCE
� IID = BOOT_ENTROPY_NT_RESULT $ 3/ UMS_SYSTEM_THREAD_INFORMATION �A LPRASTERIZER_STATUS �@ _RPC_PROTSEQ_VECTORW ! �A _PERFINFO_BOOT_PHASE_START ! � _IMAGE_ROM_OPTIONAL_HEADER �A jmp_buf �A EVENT_FILTER_DESCRIPTOR �A PBITMAPV5HEADER �1 _EXCEPTION_RECORD64 �3 MEMORY_SCRUB_INFORMATION �A LPNEWTEXTMETRICA " �* SECTION_IMAGE_INFORMATION32 + �A PVIRTUALIZATION_INSTANCE_INFO_OUTPUT & A PSYSTEM_VERIFIER_INFORMATION_EX
� ACTCTX �( tagRID_DEVICE_INFO }A _COMM_FAULT_OFFSETS {A PPERFINFO_PO_PRESLEEP � SD_ENUM_SDS_INPUT . !. TRANSACTIONMANAGER_RECOVERY_INFORMATION vA PDESIGNVECTOR A _RPC_CLIENT_ID " rA PIMAGE_DYNAMIC_RELOCATION64 # pA PIMAGE_LOAD_CONFIG_DIRECTORY mA HEAP_SUMMARY gA HWINEVENTHOOK__ + F5 EVENT_TRACE_SYSTEM_EVENT_INFORMATION aA PWMI_DISKIO_READWRITE $ XA PJOBOBJECT_FREEZE_INFORMATION f) TIMER_BASIC_INFORMATION % EMRARCTO �? MENUITEMTEMPLATEHEADER UA PPM_WMI_PERF_STATES_EX OA LPFILE_ID_DESCRIPTOR ( JA PRPC_BINDING_HANDLE_SECURITY_V1_A f _WMI_POWER_RECORD HA LPSTYLEBUFW ' 1 WORKER_FACTORY_BASIC_INFORMATION ) GA PSYSTEM_VSM_PROTECTION_INFORMATION �! EMRSAVEDC � _ENCLAVE_CREATE_INFO_SGX ~9 _CM_FLOPPY_DEVICE_DATA EA _INPUT_RECORD % ?A LPSERVICE_FAILURE_ACTIONS_FLAG , �3 TOKEN_SECURITY_ATTRIBUTES_INFORMATION $ >A PSERVERSILO_BASIC_INFORMATION <A HFONT__ 6A PCM_EISA_SLOT_INFORMATION 4A WNDENUMPROC �0 NONCLIENTMETRICS 1A PEMRSELECTPALETTE " -A _ETW_COVERAGE_SAMPLER_STATS C! _KLDR_DATA_TABLE_ENTRY )A threadlocinfo A PSCRUB_DATA_OUTPUT F& RTL_RUN_ONCE A _RTL_DEBUG_INFORMATION32 �# IMPORT_OBJECT_TYPE 3 �( _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT �" LPENUMTEXTMETRICW ( M _JOBOBJECT_RATE_CONTROL_TOLERANCE " A PENTER_STATE_SYSTEM_HANDLER ( A ETW_UMS_EVENT_DIRECTED_SWITCH_END A TXFS_QUERY_RM_INFORMATION �> MEMORY_BASIC_INFORMATION A PNIC_RECORD ! A PETW_REFDEREF_OBJECT_EVENT A PXSTATE_CONFIGURATION A COMSTAT �@ ETW_SET_KTIMER2_EVENT ) �@ _ETW_COVERAGE_SAMPLER_BLOOM_FILTER �@ _PERFORMANCE_DATA $ > _UMS_CREATE_THREAD_ATTRIBUTES g* ENCLAVE_INIT_INFO_VBS / � RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY ' �@ PPERFINFO_WORKINGSET_INFORMATION / X _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX ! �@ PETW_THREAD_SET_NAME_EVENT " �@ LPWIN32_FILE_ATTRIBUTE_DATA �@ POINTFX ! poly16_t ( �@ PSYSTEM_AUDIT_CALLBACK_OBJECT_ACE �@ _TP_DEBUG_FREE_INFO J �@ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING �@ DISPLAYCONFIG_MODE_INFO # �@ PFILE_ALLOCATION_INFORMATION � EVENT_INFO_CLASS PTEB PVOID64 �@ RPC_PROTSEQ_VECTORW � _REFS_SMR_VOLUME_GC_STATE �@ PRTL_RUN_ONCE_INIT_FN `+ EMRSETICMPROFILEA �@ PCM_POWER_DATA ! �@ PUSER_THREAD_START_ROUTINE �@ MENUITEMINFOW & �@ PPS_CPU_QUOTA_QUERY_INFORMATION �' POFSTRUCT �@ PPERFINFO_GROUPMASK V0 EXCEPTION_POINTERS �3 _RTL_SRWLOCK �" tagPOINT " TRACE_ENABLE_FLAG_EXTENSION ) V8 SYSTEM_LOW_PRIORITY_IO_INFORMATION �@ PLIST_ENTRY32 3 �; JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V1 3 �@ PIMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION " �@ PTOP_LEVEL_EXCEPTION_FILTER
5 _PROCESSOR_RECORD $ �@ PSILOOBJECT_BASIC_INFORMATION 1 �@ PTRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT +# tagCWPRETSTRUCT " u RTL_FEATURE_VARIANT_PAYLOAD , 79 _JOBOBJECT_SECURITY_LIMIT_INFORMATION " �@ PRTL_HEAP_MEMORY_LIMIT_DATA �? REMOTE_NAME_INFO % �+ _PERFINFO_DRIVER_MAJORFUNCTION z POWER_INFORMATION_LEVEL �> BREAK_ON_STATUS_BUFFER t: FILE_PIPE_EVENT_BUFFER �@ _KEY_VALUE_ENTRY $ �@ PGET_SYSTEM_WOW64_DIRECTORY_A �@ PIO_COUNTERS p= USN_JOURNAL_DATA_V2 " �@ SEMAPHORE_BASIC_INFORMATION �@ PRTL_ACE_DATA �@ _DISCDLGSTRUCTA $ �& PERFINFO_PPM_IDLE_STATE_ENTER > �@ PPROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION �@ PWNF_DLLUNLOAD_CALLBACK �! EMRSETWINDOWORGEX � CSV_NAMESPACE_INFO � _RTL_RESOURCE_CATEGORY q" DISPLAY_DEVICEA PROCESS_MITIGATION_POLICY ! �@ PACTCTX_SECTION_KEYED_DATA �@ FILTERKEYS y? _EVENT_TRACE 2 _RPC_MESSAGE �@ PMIDL_INTERCEPTION_INFO �@ PSYSTEM_TRACE_HEADER * @ PPERFINFO_SESSIONCREATE_INFORMATION 0 � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE �' _NV_MEMORY_RANGE 1 ETW_TP_EVENT_POOL_CLOSE % � _IO_RESOURCE_REQUIREMENTS_LIST z@ PMUILANGCFGNODE �; tagLOGPALETTE $ 88 WMI_DISKIO_IO_REDIRECTED_INIT �: KAFFINITY_EX x@ _RTL_RXACT_CONTEXT � tagBITMAPINFOHEADER
" LCTYPE
p PZZSTR p) _IMAGE_THUNK_DATA32 ?. _OBJECT_BASIC_INFORMATION % s@ _SYSTEM_SECUREBOOT_INFORMATION m@ PSERVICE_START_REASON % i@ PFSCTL_QUERY_REGION_INFO_INPUT ! n$ IMAGE_AUX_SYMBOL_TOKEN_DEF w1 DMA_CONFIGURATION_BYTE0 f@ _UUID_VECTOR # > FILE_END_OF_FILE_INFORMATION _TRANSACTION_LIST_ENTRY c@ PSCONTEXT_QUEUE $ �5 _TRANSACTION_BIND_INFORMATION # ;% NDR_CS_SIZE_CONVERT_ROUTINES a@ FIND_BY_SID_DATA 5& _QUERY_FILE_LAYOUT_INPUT ^@ PALPC_CONTEXT_ATTR �6 TOKEN_SOURCE 3 �6 JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE - POSVERSIONINFOEX2W X@ PRTL_HEAP_INFORMATION � tagTITLEBARINFOEX # T@ PCOMPOUND_ACCESS_ALLOWED_ACE
t LPBOOL H. _UNLOAD_DLL_DEBUG_INFO �! ICONINFOEX �% PVALUEW , ( PERFINFO_PFMAPPED_SECTION_INFORMATION , R@ PCLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 Q@ PCI_LOG_SCHEDULER_SLEEP + M@ PCRTL_ACTIVATION_CONTEXT_STACK_FRAME - D5 PEVENT_TRACE_STACK_TRACING_INFORMATION ( E@ PTIMER_SET_COALESCABLE_TIMER_INFO " PSAVEPOINT_ID + ~4 _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A �0 _OBJECT_TYPE_LIST + � _RTL_FEATURE_CONFIGURATION_OPERATION �; LPENUMLOGFONTEXDVW d" PPAINTSTRUCT W% ARM64_FNPDATA_FLAGS B@ GRADIENT_TRIANGLE ," DOCINFOA ?@ PEMRSTRETCHDIBITS �5 SC_EVENT_TYPE ! 9@ PSYSTEM_POWER_CAPABILITIES � SYSTEM_POWER_INFORMATION ; � _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION 6@ SC_HANDLE__ : �3 PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION 8 FILE_NOTIFY_INFORMATION 2 �; TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT # 2@ _ETW_KERNEL_HEADER_EXTENSION 8 � _IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION 7 FPO_DATA " PSID_HASH_ENTRY B EVENT_DESCRIPTOR & /@ KENTROPY_INITIALIZATION_ROUTINE r' tagHELPWININFOW & +@ ETW_COMPRESSION_RESUMPTION_MODE ( )@ PLOOKUP_STREAM_FROM_CLUSTER_INPUT , (@ PPLUGPLAY_CONTROL_DEVICE_CONTROL_DATA + F5 EVENT_TRACE_PEBS_TRACING_INFORMATION & '@ PCSE_SET_FILE_CACHE_INFORMATION �$ LPSYNCHRONIZATION_BARRIER " tagEMRPLGBLT *0 _TOKEN_SID_INFORMATION . @ PPROCESS_MITIGATION_DYNAMIC_CODE_POLICY / @ PPROCESS_MITIGATION_CHILD_PROCESS_POLICY ! @ PUSN_TRACK_MODIFIED_RANGES @ PEMRSAVEDC $ @ PPS_CPU_QUOTA_SET_INFORMATION @ _FP_IEEE_RECORD @ PCM_MCA_POS_DATA @ PTP_NBQ_FREE_ROUTINE @ RPC_FORWARD_FUNCTION $ @ PTHREAD_PROFILING_INFORMATION ! @ PFILE_BOTH_DIR_INFORMATION ) @ _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX & @ PSYSTEM_CPU_SET_TAG_INFORMATION �? DATEFMT_ENUMPROCEXEX _FILE_LINK_INFORMATION % �? SL_APPX_CACHE_VALUE_DESCRIPTOR �? LPQUERY_SERVICE_CONFIGA ' K1 _PERFINFO_PMC_SAMPLE_INFORMATION �? PFILE_ID_INFORMATION # �? RTL_PROCESS_LOCK_INFORMATION � SERVICE_SID_INFO �? _ETW_REF_CLOCK �4 _VIRTUALIZATION_RECORD " O MEM_EXTENDED_PARAMETER_TYPE }- EMREXTTEXTOUTA 7 �? PLDR_LOADED_MODULE_ENUMERATION_CALLBACK_FUNCTION " EMRPAINTRGN ! � MEMORY_BASIC_INFORMATION64 - A" _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS ( + MEMORY_WORKING_SET_EX_INFORMATION �? LPDISCDLGSTRUCTW " �9 _PERFINFO_SYSCALL_EXIT_DATA , �? PEVENT_TRACE_SOFT_RESTART_INFORMATION �? POSVERSIONINFOEX2 ( �? PRTL_QUERY_DEBUG_INFORMATION_INFO �? LPCURRENCYFMTW ) �? PJOBOBJECT_CONTAINER_IDENTIFIER_V2 �? _SMALL_RECT * *4 _PERFINFO_EXECUTIVE_RESOURCE_CONFIG �? PTP_NBQ_ALLOC_ROUTINE " (7 _QUERY_SERVICE_LOCK_STATUSA * �< _SYSTEM_SET_TIME_ADJUST_INFORMATION $ �? PPLUGPLAY_CUSTOM_NOTIFICATION �? PCGESTUREINFO ! RTL_STRING_LENGTH_TYPE , �? _EVENT_TRACE_SOFT_RESTART_INFORMATION �? PPO_WAKE_SOURCE_INTERNAL � tagICEXYZTRIPLE �? _IMAGE_TLS_DIRECTORY64 �? REMOTE_NAME_INFOA ' @6 PROCESS_HANDLE_TRACING_ENABLE_EX # �? EXTENDED_ENCRYPTED_DATA_INFO " P, _ENLISTMENT_CRM_INFORMATION HRESULT 1 �? SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE �? PRKCRM_TRANSACTION_BLOB �. tagMOUSEINPUT �? LPCPINFOEXW % H8 WOW64_ARCHITECTURE_INFORMATION % �? PENCLAVE_CREATE_INFO_VBS_BASIC �? PIMAGE_ENCLAVE_IMPORT �? COMPRESSED_DATA_INFO % �+ _SYSTEM_PROCESS_CLASSIFICATION � RID_DEVICE_INFO_HID �? PSYSTEM_ACCESS_FILTER_ACE , �? PSYSTEM_QUERY_TIME_ADJUST_INFORMATION s% tagEMRGLSRECORD �? PIMAGE_FILE_HEADER �? QUERY_BAD_RANGES_OUTPUT �# _SE_IMAGE_SIGNATURE_TYPE 3 �, _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT " + _ETW_UMS_EVENT_DISASSOCIATE FILE_LINK_INFORMATION �? PCACTCTXA & �> _SYSTEM_HANDLE_TABLE_ENTRY_INFO ! �? PSYSTEM_OBJECT_INFORMATION ! d4 _IMAGE_BOUND_FORWARDER_REF 2 �7 _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 �? PMANDATORY_LEVEL 6 O& _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY �+ INPUT_MESSAGE_ORIGIN_ID �" MOUSE_EVENT_RECORD �? _IO_RESOURCE_LIST �1 _EXIT_THREAD_DEBUG_INFO �9 NPBITMAP �? IMAGE_AUX_SYMBOL_TYPE q _LDR_SECTION_INFO $ �? PSET_PURGE_FAILURE_MODE_INPUT �? PMENUITEMTEMPLATEHEADER ' v5 USER_MARSHAL_MARSHALLING_ROUTINE �? SYSTEM_BASIC_INFORMATION . � PROCESS_MITIGATION_CHILD_PROCESS_POLICY �7 THREAD_TEB_INFORMATION - ! MEMORY_PARTITION_ATTRIBUTE_INFORMATION }? _RTL_UNLOAD_EVENT_TRACE32 M= tagLASTINPUTINFO w? PEVENT_TRACE
" LGRPID . .8 _STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER u? _PO_WAKE_SOURCE_DEVICE # _TOKEN_ORIGIN , v6 SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA o? MM_ETW_PAGE_INFO � tagEMRSELECTCLIPPATH � NUMBERFMTA
u LPUINT " 4 _ETW_DUPLICATE_HANDLE_EVENT l? IMAGE_CHPE_METADATA_X86 i? PIMAGE_ENCLAVE_CONFIG h? PDLGITEMTEMPLATEA f? tagKEYBDINPUT �) _X86_CALL_FRAME d? PIO_APC_ROUTINE + _? _SYSTEM_CRASH_DUMP_STATE_INFORMATION � PKCRM_MARSHAL_HEADER �* tagEXTLOGFONTW - D/ _SERVICE_CONTROL_STATUS_REASON_PARAMSA + �2 _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE Z? PWNF_USER_CALLBACK & V? PPERFINFO_CC_LOGGED_STREAM_INFO " U? PSYSTEM_ERROR_PORT_TIMEOUTS �. _SERVICE_START_REASON T? PHARDWARE_COUNTER_TYPE $ P? PFILE_VOLUME_NAME_INFORMATION ) M? _SYSTEM_WATCHDOG_TIMER_INFORMATION & � RTL_STACK_TRACE_DATABASE_CREATE # I? tagTouchPredictionParameters - F? PEVENT_TRACE_STACK_CACHING_INFORMATION A? PXSAVE_AREA_HEADER @? PRTL_MEMORY_TYPE �9 PEMRSETICMPROFILEA " =? PETW_HEAP_EVENT_CONTRACTION "? PRIVILEGE_SET " <? PPROCESSOR_IDLESTATE_POLICY :? _CPTABLEINFO # � RTL_CRITICAL_SECTION_DEBUG32 P1 SERVICE_TRIGGER 7? _LDR_VERIFY_IMAGE_INFO & 0? PFILE_PIPE_CREATE_SYMLINK_INPUT -? _RTL_UNLOAD_EVENT_TRACE64 *? PRTL_UNLOAD_EVENT_TRACE )? LPGLYPHSET * �; PERFINFO_PAGECOMBINE_AGGREGATE_STAT # (? PKEY_WOW64_FLAGS_INFORMATION * &? _PERFINFO_SESSIONCREATE_INFORMATION ) PPATTERN ? PPRIVILEGE_SET � EMRPOLYPOLYLINE " �. PERFINFO_FILE_OPERATION_END ? PTXFS_MODIFY_RM ? BOOT_AREA_INFO ? LPPELARRAY N" _EXFAT_STATISTICS [+ _GET_FILEEX_INFO_LEVELS � HIGHCONTRASTW
? FP_128 3
? _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION ! � UMS_SCHEDULER_STARTUP_INFO $ ? PERFINFO_FLT_OPERATION_STATUS �! int32x4x3_t _ SLIST_ENTRY ' ? _PROCESS_WS_WATCH_INFORMATION_EX 0 �> PPOWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES i< ENUMLOGFONTEXW �> PPERFINFO_PO_POSTSLEEP $ � MEMORY_COMBINE_INFORMATION_EX # �> _SYSTEM_VHD_BOOT_INFORMATION =; _EVENT_INSTANCE_HEADER ( �> _EVENT_EXTENDED_ITEM_PMC_COUNTERS ' Y _PERFINFO_FILEOBJECT_INFORMATION & �> _POWER_THROTTLING_PROCESS_STATE �> PPIXELFORMATDESCRIPTOR % �> ETW_TP_EVENT_TIMER_SET_NTTIMER 5 �> _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY 0 �> PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY + �> PRPC_HTTP_TRANSPORT_CREDENTIALS_V3_A + n> _JOBOBJECT_ASSOCIATE_COMPLETION_PORT � SECTION_INHERIT $ int32x2_t �> PBREAK_ON_STATUS_BUFFER ( �> PCFG_CALL_TARGET_LIST_INFORMATION ' �> DISPLAYCONFIG_DEVICE_INFO_HEADER _ uint16x8x2_t �> _ABCFLOAT $ �> _REPAIR_STORAGE_RESERVE_INPUT V SYSDBG_COMMAND �> PVALCONTEXT & �1 PERFINFO_CC_READ_AHEAD_COMPLETE # �1 SYSTEM_CALL_TIME_INFORMATION �> EMRSETBKCOLOR �> LPCBT_CREATEWND ! �> PETW_COVERAGE_SAMPLER_DATA � ACCESS_REASON_TYPE & �> CSV_QUERY_VOLUME_REDIRECT_STATE ! �> SYSTEM_POWER_STATE_CONTEXT % �> SYSTEM_HANDLE_TABLE_ENTRY_INFO ! �> PEVENT_TRACE_PROPERTIES_V2 ' �> PPERFINFO_PO_SESSION_CALLOUT_RET �7 _ETW_POOL_EVENT �# KSYSTEM_TIME �> EVENT_HEADER �> PVIRTUALIZATION_RECORD $ �> PPROCESS_WS_WATCH_INFORMATION + � PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA �! uint64x2x3_t $ / _SYSTEM_FIRMWARE_TABLE_ACTION �> PEMREXTFLOODFILL �> PRPC_UNICODE_STRING PHALF_PTR �> ANON_OBJECT_HEADER_V2 ! �> PSYSTEM_POLICY_INFORMATION �> PTIMELINE_BITMAP �3 _PREFIX_TABLE - �> _EVENT_TRACE_STACK_CACHING_INFORMATION �> PMEMORY_BASIC_INFORMATION ~> PDROPSTRUCT {> ETW_PER_SESSION_QUOTA # y> PLDR_CREATE_ACT_CTX_LANGUAGE s> PFILE_BASIC_INFORMATION � _TXFS_MODIFY_RM ! �1 FSCTL_OFFLOAD_WRITE_OUTPUT 0 r> PFN_RTL_IS_SERVICE_PACK_VERSION_INSTALLED tagEMRPOLYLINE p> PACCESS_ALLOWED_ACE g! _STARTUPINFOEXW " �9 DIALOG_DPI_CHANGE_BEHAVIORS + l> PJOBOBJECT_ASSOCIATE_COMPLETION_PORT [ _LOAD_ASDATA_TABLE ! e> PRTL_RETPOLINE_BINARY_INFO � tagEMRSETARCDIRECTION �% EXCEPTION_RECORD " �. _IMAGE_DYNAMIC_RELOCATION32 + b> CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT > |5 ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA _> PROCESSOR_IDLE_HANDLER ]> tagGUITHREADINFO ' �. DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK A9 NPDEVMODEW # N> PRTL_IMAGE_MITIGATION_POLICY % G> PMANAGE_HOT_PATCH_UNLOAD_PATCH �* FOCUS_EVENT_RECORD D> _SYSTEM_INFO �* WNODE_SINGLE_ITEM ! >> PPROCESS_FAULT_INFORMATION ;> tagPOINTER_PEN_INFO m, POWER_PLATFORM_ROLE - 9> PSYSTEM_PROCESSOR_PROFILE_CONTROL_AREA �0 _PERFINFO_CCSWAP_LITE * � VIRTUALIZATION_INSTANCE_INFO_OUTPUT . � _SECURE_SPECULATION_CONTROL_INFORMATION :3 _EISA_IRQ_CONFIGURATION 8> LPLOGCOLORSPACEA . � _ETW_COVERAGE_SAMPLER_INFORMATION_CLASS ) �4 MANAGE_WRITES_TO_EXECUTABLE_MEMORY 6> _PO_WAKE_SOURCE_TIMER NDR_CCONTEXT " 2> PLDR_IMPORT_MODULE_CALLBACK ' _IMAGE_RESOURCE_DIRECTORY_STRING ; _TEB ,> LPMONITORINFOEXA )> PPM_WMI_PERF_STATE ) &> PERFINFO_DPC_EXECUTION_INFORMATION "> _IMAGE_DEBUG_MISC $ > PUMS_CREATE_THREAD_ATTRIBUTES $ > _FILE_END_OF_FILE_INFORMATION & > _MEMORY_WORKING_SET_EX_LOCATION > NPTEXTMETRIC y- tagMOUSEKEYS > RPC_SETFILTER_FUNC > OBJECTID > BOOT_RECORD �= PCM_EXTENDED_PARAMETER ) �* TRANSACTION_PROPERTIES_INFORMATION �6 _MUILANGLISTNODE �= PFILE_ALL_INFORMATION � SYSGEOCLASS �= PSD_QUERY_STATS_INPUT / �= SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS # �+ _OS_DEPLOYEMENT_STATE_VALUES �= PMSLLHOOKSTRUCT �4 LPWNDCLASSEXW �= FSCTL_OFFLOAD_READ_INPUT ,$ DISPLAYCONFIG_ROTATION # � FILE_DISPOSITION_INFORMATION _JIT_DEBUG_INFO �= _RPC_BINDING_VECTOR �7 PS_SYSTEM_DLL_INIT_BLOCK , F5 EVENT_TRACE_STACK_TRACING_INFORMATION f2 PCZZSTR 4 �7 PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY $ [ _SYSTEM_REF_TRACE_INFORMATION �= SCROLLINFO �= PWMI_PNP_RECORD_V3 �7 SYSDBG_LIVEDUMP_CONTROL �= PPSFEATURE_OUTPUT �= LPFONTSIGNATURE ) �= MIDL_WINRT_TYPE_SERIALIZATION_INFO ( �= ACCESS_DENIED_CALLBACK_OBJECT_ACE ! �= PSILOOBJECT_ROOT_DIRECTORY �= _FILE_PREFETCH �= PFONTSIGNATURE �= RTL_GENERIC_TABLE �+ OSVERSIONINFOEXW ) �1 FILE_VALID_DATA_LENGTH_INFORMATION ) �= PSYSTEM_FIRMWARE_TABLE_INFORMATION �$ PS_WAKE_REASON & 0 FILE_FS_SECTOR_SIZE_INFORMATION ! SYSTEM_POOL_INFORMATION �= HEAP_COMMIT_DECOMMIT @ ETW_LBR_ENTRY & �= PPERFINFO_FILE_SIMPLE_OPERATION �= PPS_CPU_QUOTA_QUERY_ENTRY # �= SYSTEM_INTERRUPT_INFORMATION �- tagWINDOWPOS RPC_NS_HANDLE �< METAFILEPICT $ �= tagPOINTER_DEVICE_CURSOR_INFO
�' HSTR__ " �* MEMORY_PRIORITY_INFORMATION �= PIMAGE_IMPORT_DESCRIPTOR �= _IMAGE_ENCLAVE_CONFIG64 & �= PACTIVATION_CONTEXT_QUERY_INDEX ! �. _TXFS_START_RM_INFORMATION & �= PRTL_UMS_SCHEDULER_STARTUP_INFO �= _EVENT_FILTER_EVENT_ID �= ENUMUILANG �= LPHANDLETABLE 5 tagMSLLHOOKSTRUCT 3 �= PFILE_IO_COMPLETION_NOTIFICATION_INFORMATION ' 2 PERFINFO_KERNELMEMORY_USAGE_TYPE �! float32x4x3_t �= PMFT_ENUM_DATA_V0 �= _CONTAINER_VOLUME_STATE 3 ~= _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY n= PUSN_JOURNAL_DATA_V2 � _FILE_REGION_INFO � STRING64 Y" _HEAP_INFORMATION_CLASS ) d6 PERFINFO_PO_NOTIFY_DEVICE_COMPLETE 3- IMAGE_CHPE_RANGE_ENTRY i= PUSN_JOURNAL_DATA �3 IO_ERROR_LOG_MESSAGE � _KEY_TRUST_INFORMATION < JOURNAL_INFORMATION_CLASS & K1 PERFINFO_PMC_SAMPLE_INFORMATION : _RTL_RESOURCE g= PSERVICE_NOTIFYA f= PPS_CREATE_INFO b= PNEWTEXTMETRIC �6 tagEMRSETPIXELV L NDR_EXPR_DESC % �5 _ETW_CLOCK_CONFIGURATION_EVENT " _ACCESS_DENIED_CALLBACK_ACE _= _SYSTEM_AUDIT_OBJECT_ACE ! R= _SYSTEM_POLICY_INFORMATION \= PCOEM_STRING Z= PTOKEN_STATISTICS 38 tagSOUNDSENTRYW PLONGLONG Y= PVM_COUNTERS_EX ! U= PCONTAINER_ROOT_INFO_INPUT - �! EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID R= SYSTEM_POLICY_INFORMATION �0 _PROCESS_HEAP_ENTRY ~ tagEMRPOLYPOLYLINE16 O= PREPARSE_DATA_BUFFER_EX K= PLASTINPUTINFO % F= PSE_SET_FILE_CACHE_INFORMATION �6 _PROCESS_ACCESS_TOKEN 1 C= JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 " ?= SYSTEM_SCOPED_POLICY_ID_ACE ;= tagEMREXTCREATEPEN 7= SERVICE_STATUS_PROCESS # �) PERFINFO_FILE_PATH_OPERATION 2= PREAD_FILE_USN_DATA �( _PO_WAKE_SOURCE_HISTORY /= WMI_CONTEXTSWAP poly16x4x2_t %= PSTREAM_LAYOUT_ENTRY ' #= PSYSTEM_HOT_PATCH_REGISTRY_VALUE " PTP_VERSION "= PFILE_STORAGE_INFO ]' CONSOLE_FONT_INFO " �( _SYSTEM_BIGPOOL_INFORMATION ! � SYSTEM_VA_LIST_INFORMATION ! ! _RTL_UMS_THREAD_INFO_CLASS K2 _CACHE_DESCRIPTOR " �2 CONSOLE_READCONSOLE_CONTROL ) = _FILE_IS_REMOTE_DEVICE_INFORMATION 3 = PSYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION ) ATOM_INFORMATION_CLASS � RTL_BARRIER = POBJECT_ATTRIBUTES64 " = SD_CHANGE_MACHINE_SID_INPUT $ = FILE_PIPE_EVENT_SELECT_BUFFER = _BOOT_ENTROPY_NT_RESULT = _NETRESOURCEA = LPCBT_CREATEWNDA = PPOWER_STATE_TYPE - �; _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT + �< SYSTEM_INTERRUPT_CPU_SET_INFORMATION N0 ANIMATIONINFO
LONG64 �< _TOKEN_STATISTICS t* FILE_PIPE_PEEK_BUFFER �" tagLOGFONTW �0 tagEMRCREATEMONOBRUSH 0 �4 STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY - �< PSYSTEM_PROCESSOR_FEATURES_INFORMATION # �5 QUERY_STORAGE_RESERVE_OUTPUT 1 �< PSYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION
( _FP_64 H DMA_SPEED �< tagMETAFILEPICT # �< PCLAIM_SECURITY_ATTRIBUTE_V1 & �- _COVERAGE_UNLOADED_MODULE_ENTRY V" HSAVEDUILANGUAGES__ �< LPMODEMSETTINGS �< PEVENT_TRACE_LOGFILEA : RPC_CLIENT_INFORMATION1
�9 BITMAP ( �< PGET_FILTER_FILE_IDENTIFIER_INPUT �< _REASON_BUFFER " �< PSYSTEM_CONSOLE_INFORMATION �< MEM_ADDRESS_REQUIREMENTS �% LPCWCHAR . � ACTIVATION_CONTEXT_DETAILED_INFORMATION ! �< PPAGE_PRIORITY_INFORMATION b$ SIZE v9 _FILE_CASE_SENSITIVE_INFO �< LPENUMLOGFONT �# OBJECT_NAME_INFORMATION } FILE_INFORMATION_CLASS �( PO_WAKE_SOURCE_HISTORY h6 _HOT_PATCH_IMAGE_INFO , LPCUWSTR $ x) _SET_PURGE_FAILURE_MODE_INPUT ! �< _SYSTEM_HANDLE_INFORMATION �0 RECT c1 COLORADJUSTMENT f# RTL_MODULE_BASIC_INFO # �< PRTL_USER_PROCESS_PARAMETERS T FILE_STAT_INFORMATION �< tagPOINTER_DEVICE_INFO ) �< PPERFINFO_KERNELMEMORY_RANGE_USAGE " ULONG * �< PSYSTEM_SET_TIME_ADJUST_INFORMATION : PERFINFO_CCSWAP_TYPE . �< PSYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER " �+ OS_DEPLOYEMENT_STATE_VALUES 3 ' SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM �< _IMAGE_FUNCTION_ENTRY �< PCIMAGE_THUNK_DATA32 2 _WMI_JOB_REMOVE_PROCESS , �< _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 ! <5 CONTAINER_ROOT_INFO_OUTPUT n _ABC ] _REMOTE_NAME_INFOW �< KERNEL_USER_TIMES + �< SYSTEM_QUERY_TIME_ADJUST_INFORMATION . �< PJOBOBJECT_BASIC_ACCOUNTING_INFORMATION " �0 _LPC_UNREGISTER_PROCESS_MSG �< PREPARSE_GUID_DATA_BUFFER �< PSYSTEM_NUMA_INFORMATION s poly16x8_t / �< SYSTEM_FEATURE_CONFIGURATION_INFORMATION = _MM_ETW_WORKING_SET_TYPE # �< SERVICE_FAILURE_ACTIONS_FLAG & �< PROCESS_HANDLE_TABLE_ENTRY_INFO ~< ALPC_HANDLE_ATTR32 r< PXSTATE_CONTEXT ( =< _ETW_COVERAGE_SAMPLER_STATUS_INFO & p< PPUBLIC_OBJECT_TYPE_INFORMATION $ n< _JOBOBJECT_JOBSET_INFORMATION % � DEDUP_CHUNK_INFORMATION_HASH32 k< PEISA_IRQ_CONFIGURATION g< LPENUMLOGFONTEXW p1 RAWKEYBOARD �/ _OSVERSIONINFOW e< tagEMROFFSETCLIPRGN _< PETW_BUFFER_CONTEXT �8 ETW_HEAP_EVENT_RUNDOWN [< PPEB_LDR_DATA V< PEMRFILLRGN SECURITY_STATUS �9 _ENCRYPTED_DATA_INFO S< PHYSICAL_DISK_RECORD J< PRATE_QUOTA_LIMIT G< PS_ATTRIBUTE_LIST ( / SYSTEM_FIRMWARE_TABLE_INFORMATION A< _RTL_HASH_ENTRY �. NPCHARSETINFO ' =< ETW_COVERAGE_SAMPLER_STATUS_INFO 9< PNETWORK_APP_INSTANCE_EA " 7< _KEY_VALUE_FULL_INFORMATION 3< CM_POWER_DATA � WMI_WAIT_SINGLE $ �( SYSTEM_CALL_COUNT_INFORMATION 0 �/ SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE .< _CM_SONIC_DEVICE_DATA +< PTRACE_VERSION_INFO ' *< PFILE_FS_SECTOR_SIZE_INFORMATION )< PRTL_TREE_DELETE_FUNCTION ( � PROCESS_ENERGY_COMPONENT_TYPE_NUM � tagEMRSETCOLORSPACE ) � _FILE_ID_EXTD_BOTH_DIR_INFORMATION (< ENUMRESLANGPROCW $< INPUT_TRANSFORM $ p* _ETW_TP_EVENT_CALLBACK_CANCEL A9 LPDEVMODEW ( < _RPC_BINDING_HANDLE_TEMPLATE_V1_W < PCM_COMPONENT_INFORMATION < FILE_ALIGNMENT_INFO # �2 _CONSOLE_READCONSOLE_CONTROL + < PALPC_PORT_ASSOCIATE_COMPLETION_PORT < RPC_STATS_VECTOR & < _STREAMS_QUERY_ID_OUTPUT_BUFFER .. IMAGE_TLS_DIRECTORY32 1 < _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT �* DATEFMT_ENUMPROCW �; PSTYLEBUF �; _ACL_REVISION_INFORMATION �; HLSURF__
LPRAWMOUSE �; _SCRUB_DATA_OUTPUT # �; PMEMORY_PARTITION_PAGE_RANGE t BOOL V LPXFORM 1 �; PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION % � CM_PARTIAL_RESOURCE_DESCRIPTOR 7 { _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION ! L ETW_FINALIZE_KTIMER2_EVENT / �; PPROCESS_STACK_ALLOCATION_INFORMATION_EX �; PIMEMENUITEMINFO 1 �; I_RpcProxyUpdatePerfCounterBackendServerFn �; PERFINFO_PO_NOTIFY_DEVICE �; PCOVERAGE_SECTION_HEADER * �4 _MANAGE_WRITES_TO_EXECUTABLE_MEMORY �. PCHARSETINFO �; ETW_HEAP_EVENT_COMMON � IMAGE_NT_HEADERS % �; PKNONVOLATILE_CONTEXT_POINTERS 3 �; PTRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT �0 EMRSETWORLDTRANSFORM
f2 PCNZCH . �. _PROCESS_DYNAMIC_EH_CONTINUATION_TARGET �; PALETTEENTRY + �; PPERFINFO_PAGECOMBINE_AGGREGATE_STAT �; PFILE_PATH �; PEVENT_FILTER_HEADER �; PPERFINFO_TRACE_HEADER �; _RPC_TRANSFER_SYNTAX % �; PSYSTEM_PROCESS_ID_INFORMATION ! f; _WMI_IMAGELOAD_INFORMATION " PKSPIN_LOCK v' tagNMHDR " �; FILE_SET_DEFECT_MGMT_BUFFER " �; PJOBOBJECT_WAKE_INFORMATION � SYSDBG_CONTROL_SPACE �; MMPFN_IDENTITY �; PREAD_USN_JOURNAL_DATA - �; PSYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT � EMRPOLYPOLYGON $ �; LPENUM_SERVICE_STATUS_PROCESS
q PWCHAR �; PENUMLOGFONTEXDVW �5 _SC_EVENT_TYPE $ �; PETW_HEAP_EVENT_RUNDOWN_RANGE + �; PPERFINFO_DOMAIN_CHANGE_EVENT_REASON |; LPLOGPALETTE ( y; PROCESS_CHILD_PROCESS_INFORMATION �# NPNEWTEXTMETRICW �4 PWNDCLASSEXW u; SYSDBG_VIRTUAL r; NPEXTLOGFONT , p; _PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT & m; PDEDUP_CHUNK_INFORMATION_HASH32 l; PTP_WORK_CALLBACK f; WMI_IMAGELOAD_INFORMATION 4 q( _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 (7 QUERY_SERVICE_LOCK_STATUS & b; ETW_COVERAGE_SAMPLER_PERF_STATS 3 WMIREGGUID �! int64x2x3_t _; PX86_CALL_FRAME [; PMEMORY_SCRUB_INFORMATION �% tagCOMPOSITIONFORM . Z; PRETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER * , _SYSTEM_SESSION_BIGPOOL_INFORMATION " U; _SYSDBG_KD_PULL_REMOTE_FILE � NUMBERFMTW 4 R; PPROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY N; PEMRCREATEPEN K; _FILE_LAYOUT_NAME_ENTRY ! H; KENTROPY_RAW_DATA_CALLBACK E; PSTORAGE_RESERVE_ID & C; _CM_PNP_BIOS_INSTALLATION_CHECK @; PWOW64_FUNCTION_CODE64 ?; LPHELPINFO 8; PEVENT_INSTANCE_HEADER �$ int64x2x4_t 6; PRTL_RB_TREE 4; _HEAP_INFORMATION_ITEM � tagMULTIKEYHELPA + .; PEVENT_TRACE_PERFORMANCE_INFORMATION ,; PSYSTEM_PREFETCH_OPTIONS RPC_BUFPTR *; _RTL_RELATIVE_NAME_U 1 77 FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX � CURSORSHAPE &; PCIMAGE_SECTION_HEADER . #; STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE ; PRTLP_TAG_INFO _ TEXTMETRIC �' USER_MARSHAL_CB $ �1 _SYSTEM_CALL_TIME_INFORMATION , ! _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA 16 _CM_ERROR_CONTROL_TYPE - ; FILE_DESIRED_STORAGE_CLASS_INFORMATION ; _FILE_STORAGE_INFO ; NAMEENUMPROCW . �0 _PROCESS_MITIGATION_FONT_DISABLE_POLICY s tagREGISTERWORDW ; PPERFINFO_FILE_READ_WRITE # � _REFS_SMR_VOLUME_INFO_OUTPUT
; PTRANSACTION_NOTIFICATION ) ; ETW_TRACE_PARTITION_INFORMATION_V2 5 ; PSYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST ! �: PMEMORY_REGION_INFORMATION 1 t) EVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION �: PKAFFINITY_EX + �: _SYSTEM_NET_RATE_CONTROL_SET_CONTEXT �: PRTL_PROCESS_MODULES , �: PSYSTEM_SECUREBOOT_POLICY_INFORMATION � DEP_SYSTEM_POLICY_TYPE �: PEMRFRAMERGN " �: PWMI_JOB_SET_QUERY_NET_RATE �: PCOBJECT_ATTRIBUTES64 . �: POUT_OF_PROCESS_FUNCTION_TABLE_CALLBACK �: _SERVICE_STATUS ( �: _MEMORY_SHARED_COMMIT_INFORMATION � value_entA �: _CSTRING �: NPRECONVERTSTRING # �: PIMAGE_SEPARATE_DEBUG_HEADER �' PEMRPOLYTEXTOUTW �: PCEVENT_DESCRIPTOR p TCHAR � MIDL_METHOD_PROPERTY �: PALPC_BASIC_INFORMATION . NPLOGBRUSH ( �: PREMOTE_LINK_TRACKING_INFORMATION �: PEMRCOLORCORRECTPALETTE �: PWMIGUIDINFORMATION " c* SERVICE_REGISTRY_STATE_TYPE $ �: FILE_NETWORK_OPEN_INFORMATION ! �: PROCESSOR_IDLESTATE_POLICY - �: PMEMORY_PARTITION_PAGEFILE_INFORMATION 5 RTL_PROCESS_LOCKS ' �: PHEAP_BLOCK_SETTABLE_INFORMATION + �: PPERFINFO_IMAGELOAD_IN_PAGEFILE_INFO ! , FILE_DIRECTORY_INFORMATION ( / SYSTEM_PROCESSOR_IDLE_INFORMATION
�: HDC +: _MOF_FIELD # �: WORKER_FACTORY_DEFERRED_WORK �: SID_IDENTIFIER_AUTHORITY * �! PRTL_ACTIVATION_CONTEXT_STACK_FRAME �4 PWNDCLASSA �: ENCLAVE_TARGET_FUNCTION �: _FILE_ID_INFORMATION # � SharedVirtualDiskSupportType <7 _HEAP_EVENT_RANGE % � _ALTERNATIVE_ARCHITECTURE_TYPE �% PEMRSETCOLORSPACE & �: PEVENT_EXTENDED_ITEM_PEBS_INDEX �: PERFINFO_SET_POWER_ACTION �: PPOINTL �: PXMIT_ROUTINE_QUINTUPLE I$ _POOLED_USAGE_AND_LIMITS 2 }: PTRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT {: PHEAP_RANGE_DESTROY w: PPERFINFO_PROCESS_PERFCTR �/ FILE_PREFETCH_EX t: _FILE_PIPE_EVENT_BUFFER p: _SYSDBG_MSR e _DPFLTR_TYPE " k: _CONSOLE_SCREEN_BUFFER_INFO ! f: _FSCTL_OFFLOAD_READ_OUTPUT $ �, SYSTEM_ACPI_AUDIT_INFORMATION LPLDT_ENTRY `: PCM_SERIAL_DEVICE_DATA [: PCHANGEFILTERSTRUCT X: RPC_IF_ID_VECTOR R: PEX_WNF_SUBSCRIPTION Q: NPLOGFONTA �1 _GLYPHMETRICSFLOAT # �. _PERFINFO_FILE_OPERATION_END ! O: SYSTEM_POOLTAG_INFORMATION L: PRTL_HEAP_TAG K: LANGUAGEGROUP_ENUMPROCW � SERVICE_MAIN_FUNCTIONW E: NPCANDIDATELIST B: MULTI_TIME >: TRACE_VERSION_INFO � LPCUTSTR ( :: SYSTEM_VSM_PROTECTION_INFORMATION % 6: PERFINFO_PPM_IDLE_STATE_CHANGE # 3: PRTL_ALLOCATE_STRING_ROUTINE 1: LPCURSORINFO �% LPCWSTR v3 PCUCSSTR 7 /: ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION a1 LPCOLORADJUSTMENT ): PMOF_FIELD &: EISA_MEMORY_TYPE � FILE_STORAGE_TIER_CLASS
�8 RAWHID : PPERFINFO_MM_STAT ! : PIMAGE_BOUND_FORWARDER_REF ' TOKEN_MANDATORY_LABEL 0 : PSYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION � LPCWPSTRUCT : _IMAGE_ENCLAVE_IMPORT �5 DUPLICATE_EXTENTS_DATA_EX : DYNAMIC_FUNCTION_TABLE : PFILE_OBJECTID_BUFFER : PPOWER_ACTION � TP_POOL �+ PAXESLISTW " <5 _CONTAINER_ROOT_INFO_OUTPUT TEXTMETRICW @ FLOAT s REGISTERWORDW : PRPC_CLIENT_INFORMATION1 : WMI_IDE_CHANNEL_RECORD : PERFINFO_FILE_CREATE �9 PLDR_RELEASE_ACT_CTX 7 �9 _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION & m _RTL_DYNAMIC_HASH_TABLE_CONTEXT �9 DISPLAYCONFIG_PATH_INFO �9 PFSCTL_UNMAP_SPACE_OUTPUT �9 PPROCESSOR_IDLE_STATE " KAFFINITY �4 HBITMAP__ �9 _TRACE_LOGFILE_HEADER # [0 _ETW_COVERAGE_SAMPLER_MODULE �9 PCOBJECT_ATTRIBUTES32 �9 PTOUCHINPUT �( tagHELPWININFOA d' _RTL_CRITICAL_SECTION " 21 RTL_SEGMENT_HEAP_PARAMETERS M _HEAP_REGION_INFORMATION �1 FILEOFFSET_INFORMATION 2 �9 PMEMORY_PARTITION_MEMORY_EVENTS_INFORMATION �9 PEMRSETICMPROFILEW - ( _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 �9 _FILE_NAME_INFORMATION �* LPKBDLLHOOKSTRUCT �9 tagVS_FIXEDFILEINFO # �9 _ETW_DISKIO_FLUSH_BUFFERS_V3 �0 WX86THREAD �9 PSRWLOCK # �9 PCM_FULL_RESOURCE_DESCRIPTOR �9 _ETW_WNF_EVENT_CALLBACK ) 1 _FILE_MEMORY_PARTITION_INFORMATION �, MODEMDEVCAPS �9 PEVENT_TRACE_PROPERTIES * �9 PFSCTL_QUERY_STORAGE_CLASSES_OUTPUT �9 LPTRACKMOUSEEVENT # �9 SYSTEM_TIMEOFDAY_INFORMATION ' �9 DISPLAYCONFIG_SOURCE_DEVICE_NAME 5 F+ _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION % � PERFINFO_INTERRUPT_INFORMATION �9 PVIDEO_RECORD
q PNZWCH . �9 PFSCTL_GET_INTEGRITY_INFORMATION_BUFFER �9 LPBITMAP �9 NEWTEXTMETRICEXW �9 PPOLYTEXT $ poly16x4_t F- PDEBUGHOOKINFO �9 _NDR_USER_MARSHAL_INFO !6 EMRDELETEOBJECT " �9 PENABLE_TRACE_PARAMETERS_V1 �* COPYFILE2_COPY_PHASE + �9 PTOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE � THREADINFOCLASS - �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS �9 PMUILANGCFGLIST � MULTIKEYHELP �9 PIMAGE_HOT_PATCH_BASE �9 ENCRYPTED_DATA_INFO �9 PLPC_CLIENT_DIED_MSG �7 LPHELPWININFOA " �9 PPERFINFO_SYSCALL_EXIT_DATA �9 PENCLAVE_LOAD_INFO_VBS |9 PCM_FLOPPY_DEVICE_DATA t9 PFILE_CASE_SENSITIVE_INFO p HEAP_SUBSEGMENT_ALLOC 0 ( _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER q9 RTL_HEAP_STACK_CONTROL m9 _RTL_DEBUG_INFORMATION
u WPARAM `9 NPSTYLEBUF �/ _WMI_QUEUE _9 PLDR_ENUM_RESOURCE_ENTRY ]9 XSTATE_CONFIGURATION * � _ASSEMBLY_FILE_DETAILED_INFORMATION # ^$ PERFINFO_PPM_STATE_SELECTION �- QUERY_BAD_RANGES_INPUT W9 PFILETIME V9 PACE_HEADER % T9 PROCESS_EXTENDED_ENERGY_VALUES $ O9 _ENUM_SERVICE_STATUS_PROCESSW I9 PWMI_TXR F9 HICON__ A9 PDEVMODEW ?9 QUERYHANDLER �) _ETW_SET_MARK_INFORMATION ;9 PPROCESS_JOB_MEMORY_INFO & 99 PSYSTEM_SYSTEM_DISK_INFORMATION + 79 JOBOBJECT_SECURITY_LIMIT_INFORMATION 39 PPEBS_DS_SAVE_AREA64 19 _ETW_OPTICALIO_INIT z' CONTEXT_CHUNK -9 _IPT_TRACE_EVENT_DATA � uint32x2x4_t % '9 PETW_TP_EVENT_TIMER_EXPIRATION % � _WIM_PROVIDER_INTEGRITY_STATUS & $9 _PROCESS_MEMORY_EXHAUSTION_INFO 9 FILE_MAILSLOT_PEEK_BUFFER 9 RPC_SECURITY_QOS_V5_W 9 COVERAGE_MODULE_REQUEST 9 tagACTCTXW 9 CONTEXT % LDR_RELOCATE_IMAGE_RETURN_TYPE 9 PHSM_OPCODE 4 9 PSYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT 9 LPMOUSEMOVEPOINT � tagICONMETRICSA ! 9 ETW_HEAP_EVENT_CONTRACTION + �8 _EVENT_TRACE_PROFILE_ADD_INFORMATION �8 RTL_AVL_COMPARE_ROUTINE g$ RTL_SPARSE_BITMAP_RUN " OPERATION_ID " PEMRPAINTRGN = tagRAWINPUTDEVICE % � FILE_REPARSE_POINT_INFORMATION �8 PCOMBOBOXINFO �8 PAGE_PRIORITY_INFORMATION # �8 SYSTEM_BOOT_LOGO_INFORMATION �8 _EISA_PORT_CONFIGURATION ! �8 PLUID_AND_ATTRIBUTES_ARRAY ( �8 PSYSDBG_LIVEDUMP_CONTROL_ADDPAGES �# PLUGPLAY_EVENT_CATEGORY d' CRITICAL_SECTION �8 WMI_PUSHLOCK � SYSTEM_DEVICE_INFORMATION $ =/ LDR_DLL_NOTIFICATION_FUNCTION �3 PREFIX_TABLE �8 tagRAWHID . �8 PETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT �8 PETW_HEAP_EVENT_RUNDOWN $ E0 _FILE_SFIO_VOLUME_INFORMATION �8 NPWNDCLASS #" POWER_STATE - RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS ; �3 _PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION � CSV_CONTROL_PARAM ! �8 SYSTEM_PROCESS_INFORMATION E' EMRSTRETCHDIBITS f WMI_POWER_RECORD _ poly8x16x2_t 3 ) _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE ! �) SYSTEM_CONSOLE_INFORMATION 6 �8 _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY # �8 PMEMORY_WORKING_SET_EX_BLOCK & �- _MM_ETW_WORKING_SET_PFN_RUNDOWN �8 POINTFLOAT �8 LDR_DATA_TABLE_ENTRY �8 PHARDWARE_COUNTER_DATA �8 _tag_ARMINTR_CPS_OP �8 PFILE_ACCESS_INFORMATION �8 EMRSTRETCHBLT + �8 RPC_INTERFACE_GROUP_IDLE_CALLBACK_FN % ? _EVENT_TRACE_INFORMATION_CLASS / �8 EVENT_TRACE_SESSION_SECURITY_INFORMATION ) [ LDR_DLL_UNLOADED_NOTIFICATION_DATA �8 NTFS_STATISTICS_EX 2 _locale_tstruct ) t8 _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT + k* _FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT ' p8 MEMORY_ENCLAVE_IMAGE_INFORMATION D l8 PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED & j8 RTLWOW64_CROSSPROCESS_WORK_ITEM
�. _RECTL 2 X8 PMEMORY_PARTITION_CONFIGURATION_INFORMATION �4 DRAWTEXTPARAMS PEXCEPTION_POINTERS * T8 PSYSTEM_LOW_PRIORITY_IO_INFORMATION Q8 _ETW_PRIORITY_EVENT !6 EMRSELECTOBJECT K8 _RPC_SECURITY_QOS t errcode �/ IMPORT_OBJECT_NAME_TYPE ! � _LDR_DLL_NOTIFICATION_DATA & H8 _WOW64_ARCHITECTURE_INFORMATION 3 ?8 PCACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 <8 tagALTTABINFO % 68 PWMI_DISKIO_IO_REDIRECTED_INIT 18 LPSOUNDSENTRYW
1 _WMI_IMAGEID_INFORMATION - .8 STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER ' �( _SYSTEM_SPECIAL_POOL_INFORMATION *8 _DISCDLGSTRUCTW 8 PIMAGE_AUX_SYMBOL_EX �" tagEVENTMSG & 8 _SYSTEM_LEAP_SECOND_INFORMATION " �, KEY_HANDLE_TAGS_INFORMATION R* LPPOLYTEXTA 8 WINDOW_BUFFER_SIZE_RECORD 8 PSYSTEM_POWER_LEVEL �! EMRBEGINPATH 8 _RPC_SYNTAX_IDENTIFIER 8 PFILE_NOTIFY_INFORMATION 0 �3 _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS 1 �7 ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 LPFXPT2DOT30 � PTEB_ACTIVE_FRAME ) �4 TXFS_LIST_TRANSACTION_LOCKED_FILES �7 _ENCLAVE_INIT_INFO_SGX �4 SERVICE_NOTIFY_1 �7 PIMAGE_DYNAMIC_RELOCATION $ � _DELETE_STORAGE_RESERVE_INPUT �7 PHELPWININFOA �7 _SYSDBG_LIVEDUMP_CONTROL �7 ARM64_FNPDATA_CR �7 EISA_IRQ_DESCRIPTOR ( �7 PPERFINFO_DPC_ENQUEUE_INFORMATION " �7 PPROC_THREAD_ATTRIBUTE_LIST ! �7 PERFINFO_PROCESS_PERFCTR32 #1 _IMAGE_OPTIONAL_HEADER �7 PKEY_BASIC_INFORMATION �) PMEASUREITEMSTRUCT & [. CRITICAL_PROCESS_EXCEPTION_DATA �7 TIMERPROC �7 _EVENT_TRACE_PROPERTIES FCHAR �7 _THREAD_TEB_INFORMATION + �7 PSYSTEM_ACTIVITY_MODERATION_APP_TYPE �7 PMUISTRINGPOOL �7 PTEXTMETRIC 5 �7 _PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY �7 _PS_SYSTEM_DLL_INIT_BLOCK % �7 PPO_HIBER_FORCE_DISABLE_REASON ' �7 SYSDBG_LIVEDUMP_CONTROL_ADDPAGES �7 PPORT_DATA_INFORMATION �7 PWMIREGGUIDW �7 tagWNODE_METHOD_ITEM �7 PPS_MEMORY_RESERVE �7 HWINSTA__ �7 PMENU_EVENT_RECORD ! �7 PPERFINFO_CC_FLUSH_SECTION � _CSV_CONTROL_OP �) LPSTYLEBUFA ) V PERFINFO_BOOT_PREFETCH_INFORMATION & FILE_LINKS_INFORMATION �7 _UNICODE_PREFIX_TABLE ~ EMRPOLYPOLYLINE16 ' �1 RPC_HTTP_TRANSPORT_CREDENTIALS_W 1 POWER_STATE_DISABLED_TYPE �7 _TIME_FIELDS �7 ETW_POOL_EVENT �7 ETW_COVERAGE_SAMPLER_DATA �7 POWER_SESSION_RIT_STATE
�7 EMR ~7 _RTL_RXACT_LOG �3 PFULL_PTR_XLAT_TABLES % Y USER_MARSHAL_ROUTINE_QUADRUPLE �3 LOGFONT x7 PIMECHARPOSITION " \) SECURITY_QUALITY_OF_SERVICE s7 PPPM_WMI_IDLE_STATE � _SERVICE_TABLE_ENTRYW " q7 PERFINFO_MEMORY_INFORMATION > m7 _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION j7 RTL_TRACE_HASH_FUNCTION # f7 OBJECT_DIRECTORY_INFORMATION
n ABC _7 MONITORINFO \7 PWNF_USER_SUBSCRIPTION 4 X7 _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION U7 PHANDEDNESS * & _WIM_PROVIDER_SUSPEND_OVERLAY_INPUT g! STARTUPINFOEXW P7 _FILE_ID_EXTD_DIR_INFO FXPT16DOT16 $ L7 WMI_JOB_SET_QUERY_INFORMATION PRTL_REFERENCE_COUNT ) I7 PIMAGE_IA64_RUNTIME_FUNCTION_ENTRY # � _PERFINFO_CC_LAZY_WRITE_SCAN G7 PORT_DATA_INFORMATION A7 TTPOLYCURVE :7 PHEAP_EVENT_RANGE ( 97 PPERFINFO_KERNELMEMORY_USAGE_TYPE ' .! LDR_DLL_LOADED_NOTIFICATION_DATA 2 57 PFILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX " � _SYSTEM_MEMORY_LIST_COMMAND - 27 _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES v$ REG_ACTION .7 EXTLOGFONTA MENUTEMPLATEA �* CODEPAGE_ENUMPROCW �# _KSYSTEM_TIME �1 tagEMRSETMAPPERFLAGS +7 LPMENUITEMINFOA 4 SC_ENUM_TYPE *7 PSID_AND_ATTRIBUTES � WELL_KNOWN_SID_TYPE �1 FILE_LEVEL_TRIM_RANGE N0 tagANIMATIONINFO " &7 LPQUERY_SERVICE_LOCK_STATUS #7 QUOTA_LIMITS # 7 PKEY_VALUE_LAYER_INFORMATION , PLUGPLAY_CONTROL_TARGET_RELATION_DATA � _TOKEN_MANDATORY_POLICY � MINIMIZEDMETRICS % 7 PRPC_BINDING_HANDLE_OPTIONS_V1 7 _FPO_DATA - 7 PSYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT 7 PNDR_CORRELATION_INFO # `4 _PROCESS_SESSION_INFORMATION
7 WX86TIB �! HIGHCONTRASTA 7 FULL_PTR_XLAT_TABLES 2 tagEMRELLIPSE 7 PIMAGE_TLS_DIRECTORY $ �6 PFILE_FS_OBJECTID_INFORMATION �6 MUILANGLISTNODE �6 PWNDCLASS � KSPIN_LOCK_QUEUE_NUMBER 6 �6 JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V1 , �6 _PROCESS_STACK_ALLOCATION_INFORMATION �6 PFILE_LEVEL_TRIM # �6 _KEY_VALUE_BASIC_INFORMATION ! @ RTL_HEAP_MEMORY_LIMIT_INFO �6 _LOGICAL_DISK_DEFRAG . X, FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT �6 EMRSETPIXELV , �6 PFILE_IOSTATUSBLOCK_RANGE_INFORMATION l NPABC ) ;# _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER �6 _RPC_SECURITY_QOS_V3_A . �6 SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION �' _USER_MARSHAL_CB_TYPE �6 HARDWARE_COUNTER % �6 _VIRTUAL_STORAGE_BEHAVIOR_CODE �6 PFE_EXPORT_FUNC � AXISINFOW l. PSFEATURE_CUSTPAPER � _LOGICAL_DISK_EXTENTS ) |$ _MEMORY_RESOURCE_NOTIFICATION_TYPE q PWSTR �6 PTOKEN_SOURCE �6 USN_RECORD_V2 �6 PO_FIXED_WAKE_SOURCE_TYPE ' �6 PETW_PARTITION_INFO_EXTENSION_V2 �6 PKSPIN_LOCK_QUEUE + �6 PSYSTEM_ELAM_CERTIFICATE_INFORMATION �$ WMI_DELAY_EXECUTION tagINPUT __time64_t �6 PROCESS_ACCESS_TOKEN � PS_CREATE_STATE �6 LPMEMORYSTATUS - �6 DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS �6 PSD_ENUM_SDS_OUTPUT - �6 PHEAP_PERFORMANCE_COUNTERS_INFORMATION �6 PWMI_DPI_RECORD �6 _SCRUB_DATA_INPUT �6 _SECTIONBASICINFO �6 WINSTAENUMPROC h% WNDCLASSEX ! �6 PRETRIEVAL_POINTERS_BUFFER �6 NEARPROC }6 _POWER_SESSION_WINLOGON y6 KEY_PID_ARRAY - v6 _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA + o6 PSYSTEM_DMA_GUARD_POLICY_INFORMATION j6 LPNETRESOURCEW f6 PHOT_PATCH_IMAGE_INFO �4 HKL__ * b6 PPERFINFO_PO_NOTIFY_DEVICE_COMPLETE `6 PPERFINFO_VTL_CHANGE ^6 SYSTEM_PREFETCH_STATS , D5 PEVENT_TRACE_PEBS_TRACING_INFORMATION [6 PIMAGE_OPTIONAL_HEADER32 ) X/ PROCESS_SYSTEM_RESOURCE_MANAGEMENT w2 TP_ALPC Z6 PWINDOWS_OS_OPTIONS ) t _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR V6 LPCBTACTIVATESTRUCT �! tagHIGHCONTRASTA
u UINT32 ! � _EVENT_TRACE_PROPERTIES_V2 ' T6 PTHREAD_LAST_SYSCALL_INFORMATION R6 _PROCESSOR_POWER_POLICY " PACCESS_MASK * K6 _SYSTEM_SESSION_POOLTAG_INFORMATION G6 PIRQ_DEVICE_POLICY �/ OSVERSIONINFOW /% _IDL_CS_CONVERT w! _PERFINFO_FILE_DIRENUM C6 PCONTEXT_EX % 4 _ETW_CREATEDELETE_OBJECT_EVENT ( @6 _PROCESS_HANDLE_TRACING_ENABLE_EX � CANDIDATEFORM ) t) EVENT_TRACE_TAG_FILTER_INFORMATION % =2 PROCESS_MITIGATION_ASLR_POLICY ( N+ SYSTEM_FEATURE_CONFIGURATION_TYPE f ENHMETAHEADER , :6 PEVENT_TRACE_TIME_PROFILE_INFORMATION 66 PIO_SESSION_STATE 46 HDC__ .6 _EXCEPTION_DEBUG_INFO *6 WINDOWPLACEMENT &6 _EVENT_BASIC_INFORMATION #6 NPTEXTMETRICW 6 PEMRDELETEOBJECT * 6 PSYSTEM_PLATFORM_BINARY_INFORMATION = MM_ETW_WORKING_SET_TYPE �0 EMRCREATEMONOBRUSH ( 6 _LEARNING_MODE_OBJECT_INFORMATION $ � _SharedVirtualDiskSupportType 6 PPPM_WMI_PERF_STATES " 6 LPEVENTLOG_FULL_INFORMATION , _RGNDATA $ � _GENERIC_BINDING_ROUTINE_PAIR �* LPEXTLOGPEN32 H AXESLIST 6 TITLEBARINFO �3 LOGFONTA % 6 DISPLAYCONFIG_PATH_SOURCE_INFO ' � _PS_MITIGATION_AUDIT_OPTIONS_MAP . _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION ! UMS_THREAD_INFO_CLASS �) _NT_TIB64 �1 KEY_FLAGS_INFORMATION �5 PMESSAGE_TRACE_USER �5 FILE_OBJECTID_BUFFER . �5 PJOURNAL_SET_KEY_USER_FLAGS_INFORMATION �5 _MUILANGCFGLIST �5 PFILE_NAMES_INFORMATION �5 PFILE_RENAME_INFORMATION # j FILE_PIPE_REMOTE_INFORMATION �5 PEXFAT_STATISTICS �5 HEAP_INFORMATION tagRAWINPUT �5 _SCRUB_PARITY_EXTENT_DATA �. RECTL ' u _THREAD_LAST_SYSCALL_INFORMATION ! �5 _DUPLICATE_EXTENTS_DATA_EX �5 LPCURSORSHAPE �5 PSC_EVENT_TYPE �5 PAPCFUNC �5 LPCLSID ! � _SYSTEM_DEVICE_INFORMATION � tagEMRGDICOMMENT 2 EMRELLIPSE �5 PWMI_PNP_RECORD_V4 # �) _WMI_IMAGELOAD_INFORMATION64 % �5 PETW_TP_EVENT_CALLBACK_DEQUEUE
t PINT32 + �" IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY * �5 PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA $ i1 _SYSTEM_HIBERFILE_INFORMATION $ �5 ETW_CLOCK_CONFIGURATION_EVENT � OVERLAPPED_ENTRY * �5 PPERFINFO_EXECUTIVE_RESOURCE_CONFIG �5 PCWNF_STATE_NAME . �5 PSYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 T PHANDLE & �5 WMI_EXTENDED_THREAD_INFORMATION �5 _CI_LOG_SCHEDULER_SLEEP ' �5 PETW_COVERAGE_SAMPLER_BLOOM_INFO PS_PROTECTION �5 HSYNTHETICPOINTERDEVICE__ $ 4 _IMAGE_RUNTIME_FUNCTION_ENTRY $ �5 _QUERY_STORAGE_RESERVE_OUTPUT ) �5 SYSTEM_EXTENDED_THREAD_INFORMATION �5 PENUMLOGFONTEXDV # �5 TRANSACTION_BIND_INFORMATION GLOBALHANDLE " EMRINVERTRGN # F, PERFINFO_PAGE_RANGE_IDENTITY $ �5 PFILE_COMPRESSION_INFORMATION $ �5 PFILE_ID_BOTH_DIR_INFORMATION �5 SYSTEM_NUMA_INFORMATION % 5 PKEY_CONTROL_FLAGS_INFORMATION @ y5 PCACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA ) v5 USER_MARSHAL_UNMARSHALLING_ROUTINE p5 PPERFINFO_MEM_RESET_INFO k5 PTOKEN_USER_CLAIMS FIRMWARE_TYPE * b5 PKEY_SET_VIRTUALIZATION_INFORMATION �% EMRSCALEWINDOWEXTEX `5 PIMAGE_THUNK_DATA ( [5 _LOOKUP_STREAM_FROM_CLUSTER_INPUT * �* _TRANSACTION_PROPERTIES_INFORMATION 6 � RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY U5 PCOMPAREITEMSTRUCT R5 tagMSGBOXPARAMSW ) N5 SYSTEM_KERNEL_DEBUGGER_INFORMATION . J5 _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION ! � FILE_IO_PRIORITY_HINT_INFO - D5 PEVENT_TRACE_PROFILE_EVENT_INFORMATION $ A5 _SECURITY_DESCRIPTOR_RELATIVE : & _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION >5 PFILE_STANDARD_INFO " :5 PCONTAINER_ROOT_INFO_OUTPUT ! 45 PEISA_MEMORY_CONFIGURATION 35 PVALENTA � _SE_VALIDATE_MAPPING_TYPE , �$ DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY �- LPNONCLIENTMETRICSW � LUNICODE_STRING $ �2 THREAD_CYCLE_TIME_INFORMATION 25 PCOVERAGE_REQUEST_CODES .5 CALINFO_ENUMPROCEXA " +5 PPROCESSOR_PERFSTATE_POLICY ) )5 _SYSTEM_POWER_STATE_DISABLE_REASON ! 5 LPCREATE_THREAD_DEBUG_INFO �2 MOFRESOURCEINFO � HARDWARE_COUNTER_TYPE 5 MSLLHOOKSTRUCT * 5 _FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER 5 PRTL_PROCESS_LOCKS " 5 USER_MARSHAL_SIZING_ROUTINE * � PLUGPLAY_CONTROL_USER_RESPONSE_DATA 5 PPROCESSOR_RECORD # 5 _RTL_USER_PROCESS_PARAMETERS 5 HARDERROR_MSG �$ _RTL_RXACT_OPERATION �4 NPWNDCLASSEXW ! �4 PPROCESS_MITIGATION_POLICY �4 LPWNDCLASSA �4 _SERVICE_NOTIFY_1 8 �4 PPROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY ' � _FILE_CASE_SENSITIVE_INFORMATION * �4 _TRANSACTIONMANAGER_LOG_INFORMATION � DEVMODEA $ �4 _SERVERSILO_BASIC_INFORMATION � SYSTEM_POOLTAG �4 _WNF_TYPE_ID 0 �4 _SYSTEM_VERIFIER_CANCELLATION_INFORMATION " �4 CM_FULL_RESOURCE_DESCRIPTOR �4 LPMENUITEMINFO * �4 _TXFS_LIST_TRANSACTION_LOCKED_FILES �4 tagBITMAPFILEHEADER �4 _ETW_CREATE_HANDLE_EVENT # � ETW_HEAP_EVENT_RUNDOWN_RANGE �4 PTOKEN_GROUPS �4 _GENERATE_NAME_CONTEXT % �4 _FILE_MAILSLOT_SET_INFORMATION �4 HBITMAP �4 LPDRAWTEXTPARAMS � IMAGE_ROM_OPTIONAL_HEADER 1 �4 PSTORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY & �4 _SYSTEM_DEVICE_DATA_INFORMATION 0 �4 PRTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY * MAT2 % DLGTEMPLATE �4 LPHKL �" REGISTERWORD � NDR_RUNDOWN 1 tagACCEL ) _PERFINFO_DRIVER_COMPLETIONROUTINE � _KSPIN_LOCK_QUEUE
�4 TP_JOB �4 PRTL_BARRIER * �4 PMANAGE_WRITES_TO_EXECUTABLE_MEMORY " �4 PSYSTEM_BASIC_INFORMATION64 �4 PICONINFOEX ( �4 PRPC_HTTP_TRANSPORT_CREDENTIALS_A �4 CS_TYPE_NET_SIZE_ROUTINE �4 VIRTUALIZATION_RECORD ' �4 PETW_TRACE_PARTITION_INFORMATION � PMIDL_STUB_MESSAGE ! �4 _HEAP_EXTENDED_INFORMATION � _FILE_COMPRESSION_INFO * ~4 RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A z4 PETW_OPTICALIO_READWRITE PERFINFO_VTL_CHANGE $ x4 ETW_LAST_DROPPED_EVENT_STRUCT ( � _RTL_IMAGE_MITIGATION_ASLR_POLICY �# CONDITION_VARIABLE - 0" _WMI_JOB_SEND_NOTIFICATION_INFORMATION . u4 PMEMORY_PHYSICAL_CONTIGUITY_INFORMATION p4 PCORRELATION_VECTOR * BITMAPV4HEADER m4 EMRPIXELFORMAT ' j4 PPERFINFO_CC_READ_AHEAD_COMPLETE % h4 PERFINFO_CC_LOGGED_STREAM_INFO � PAINTSTRUCT d4 IMAGE_BOUND_FORWARDER_REF " `4 PROCESS_SESSION_INFORMATION \4 _EVENT_FILTER_EVENT_NAME � _PS_PROTECTED_SIGNER X4 FILE_TRACKING_INFORMATION ' U4 PCI_WINDOWS_LOCKDOWN_RESTRICTION . DEBUG_CONTROL_SPACE_ITEM + P4 PREFS_DEALLOCATE_RANGES_INPUT_BUFFER � CLSID 6# _MONITOR_DISPLAY_STATE ! M4 _PERFINFO_CC_FLUSH_SECTION # J4 PPERFINFO_DEBUG_EVENT_REASON
TUCHAR G4 PSE_ACCESS_REQUEST � LPTITLEBARINFOEX & E4 PERFINFO_PO_SESSION_CALLOUT_RET ( A4 _FILE_REMOTE_PROTOCOL_INFORMATION .4 POINTER_TOUCH_INFO ) *4 PERFINFO_EXECUTIVE_RESOURCE_CONFIG * �% _PERFINFO_SYSTEM_MEMORY_INFORMATION $4 PRTL_HEAP_TAG_INFO ; "4 PRTL_QUERY_DEBUG_VIRTUAL_PROCESS_READ_MEMORY_ROUTINE 4 LPTTPOLYGONHEADER ( 4 IMAGE_IA64_RUNTIME_FUNCTION_ENTRY ! 4 ETW_DUPLICATE_HANDLE_EVENT $ 4 PETW_UMS_EVENT_CONTEXT_SWITCH 4 PALPC_TOKEN_ATTR 4 _ENABLE_TRACE_PARAMETERS 4 PRTL_BITMAP ! 4 LPSERVICE_PRESHUTDOWN_INFO & 4 ETW_TRACE_PARTITION_INFORMATION 4 _SC_ENUM_TYPE * �3 _FSCTL_QUERY_STORAGE_CLASSES_OUTPUT 0 # SYSTEM_FEATURE_CONFIGURATION_CHANGE_STAMP * �/ _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE �3 PPREFIX_TABLE �3 PPATHNAME_BUFFER � SOUNDSENTRYA �3 _SE_AUDIT_INFO ( �, RESOURCEMANAGER_BASIC_INFORMATION �3 HSPRITE * _PROFILE_SOURCE_INFO # # _HEAP_AFINITY_MANAGER_ENABLE �3 PHANDLER_ROUTINE ! �3 PHEAP_AFFINITY_SLOT_ASSIGN �3 _MIDL_STUB_MESSAGE ; �3 PPROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION ( �3 PFILE_FS_FULL_SIZE_INFORMATION_EX � IO_COUNTERS r SERVERSILO_STATE � KINTERRUPT_ROUTINE - �3 _TOKEN_SECURITY_ATTRIBUTES_INFORMATION $ �3 _DEFINE_STORAGE_RESERVE_INPUT �3 PIO_ERROR_LOG_MESSAGE " �3 PIMAGE_DYNAMIC_RELOCATION32 0 �3 PSYSTEM_ACTIVITY_MODERATION_USER_SETTINGS �3 PRTL_SRWLOCK uint16x4x2_t % j, FILE_ATTRIBUTE_TAG_INFORMATION �3 FILE_REGION_OUTPUT >" _CM_VIDEO_DEVICE_DATA �3 PPLUGPLAY_EVENT_CATEGORY �3 LPLOGFONT �3 tagEMRFRAMERGN �3 PCM_PERF_COUNTERS �3 _MEMORY_SCRUB_INFORMATION }3 PFIBER_START_ROUTINE y3 tagRGBTRIPLE v3 PCUCSCHAR s3 IMAGE_AUX_SYMBOL ( R3 _GET_FILTER_FILE_IDENTIFIER_INPUT � tagMENUITEMINFOA N3 _RPC_PROTSEQ_ENDPOINT �. LPMOUSEINPUT " FILE_PIPE_LOCAL_INFORMATION w FILE_GET_EA_INFORMATION ) K3 _FILE_IO_PRIORITY_HINT_INFORMATION & G3 REDIRECTION_FUNCTION_DESCRIPTOR ( E3 PRPC_BINDING_HANDLE_SECURITY_V1_W D3 PCZPCSTR A3 _FINDEX_SEARCH_OPS >3 KLDR_DATA_TABLE_ENTRY64 :3 EISA_IRQ_CONFIGURATION 43 PACL 33 PROPENUMPROCEXW /3 SYSTEM_ALARM_ACE )3 PREAD_USN_JOURNAL_DATA_V0 / '3 PSYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION t CM_RESOURCE_TYPE , &3 PPERFINFO_YIELD_PROCESSOR_INFORMATION ! "3 PSYSTEM_MEMORY_INFORMATION % 3 DISPLAYCONFIG_PATH_TARGET_INFO
" REGSAM . 3 _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER 3 PFILE_STREAM_INFO
3 PWMIREGGUID u uintptr_t _ float32x4x2_t , _MODEMSETTINGS 3 PPOWER_PLATFORM_ROLE . 3 _FSCTL_GET_INTEGRITY_INFORMATION_BUFFER + 3 _SYSTEM_KERNEL_VA_SHADOW_INFORMATION �- DEVICE_FLAGS �2 PMOFRESOURCEINFO & p RTL_FEATURE_CONFIGURATION_TABLE �2 METAHEADER �2 tagEMRCREATECOLORSPACE �2 CM_COMPONENT_INFORMATION �2 LPCBT_CREATEWNDW ) �2 PFINDFIRSTACTIVATIONCONTEXTSECTION �2 PDISPLAY_DEVICEA q RPC_WSTR �2 PETW_HEAP_EVENT_ALLOC �2 IMAGE_NT_HEADERS64 �2 PLDR_DATA_TABLE_ENTRY64 �2 PMSG * �2 PFILE_INITIATE_REPAIR_OUTPUT_BUFFER �2 DMA_CONFIGURATION_BYTE1 $ �2 PEVENT_TRACE_BUFFER_CALLBACKA % �2 _THREAD_CYCLE_TIME_INFORMATION f) _TIMER_BASIC_INFORMATION $ �2 _CM_EISA_FUNCTION_INFORMATION �2 PMUICCHEADER �2 PCREDIRECTION_DESCRIPTOR �2 FILE_STANDARD_INFORMATION �. _SI_COPYFILE # CLSN �2 PSID_NAME_USE " �2 _SYSTEM_ERROR_PORT_TIMEOUTS W& WNDCLASSW
q LPWSTR �' FILE_ID_TYPE
�2 CIEXYZ �0 PAXISINFOW # �2 PCONSOLE_READCONSOLE_CONTROL �2 HEAP_RANGE_CREATE �2 CI_LOG_MMCSS_STOP * �2 CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE �2 RETRIEVAL_POINTERS_BUFFER {2 PTP_ALPC_CALLBACK v2 PRTLP_HEAP_TAGGING_INFO q2 PHEAP_RANGE_LOG $ _TOKEN_DEFAULT_DACL ! l2 PWMI_DISKIO_READWRITE_INIT m _PLEX_READ_DATA_REQUEST j2 PWNODE_SINGLE_ITEM �! WMI_JOB_INFORMATION i2 PQUERYACTCTXW_FUNC & � _ETW_THREAD_EVENT_SUBPROCESSTAG u UINT_PTR f2 PCCH 4 b2 PPROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION ' ]2 PSYSTEM_MEMORY_USAGE_INFORMATION ) Z2 SECTION_INTERNAL_IMAGE_INFORMATION N2 LPOUTLINETEXTMETRIC / M2 PJOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 I2 PCACHE_DESCRIPTOR G2 PJOB_SET_ARRAY & @2 PETW_WNF_EVENT_NAME_SUB_RUNDOWN & 62 PPROCESS_MITIGATION_ASLR_POLICY
22 PFP_80 ! /2 _SHRINK_VOLUME_INFORMATION ( (2 _SYSTEM_CODEINTEGRITY_INFORMATION %2 PCIMAGE_THUNK_DATA �& _RTL_HANDLE_TABLE_ENTRY �/ _IMAGE_LINENUMBER BOOT_ENTROPY_SOURCE_ID #2 LPOSVERSIONINFO e POINTER_TYPE_INFO _ poly16x8x2_t 2 LPLOGCOLORSPACEW 2 EMRRECTANGLE " 2 _PERFINFO_IDLE_STATE_CHANGE 2 PDISPATCHER_CONTEXT � SYSTEM_POWER_POLICY " OBJECT_ATTRIBUTES32 2 PROCESS_TLS_INFORMATION _FP_IEEE_OPERATION_CODE 2 localeinfo_struct 2 _WINDOWS_OS_OPTIONS 2 WMI_JOB_REMOVE_PROCESS �1 _IMAGE_ENCLAVE_CONFIG32 �1 DLGITEMTEMPLATE �1 EXIT_THREAD_DEBUG_INFO � _PNP_VETO_TYPE $ S _RTL_WORK_ON_BEHALF_TICKET_EX � GLYPHSET �1 PGLYPHMETRICSFLOAT & Y PERFINFO_FILEOBJECT_INFORMATION �1 _PERFINFO_CC_READ_AHEAD �1 PTP_POOL �1 PEMRSETMAPPERFLAGS l SERVICE_FAILURE_ACTIONSA �1 tagSTYLEBUFW ( �1 _RPC_HTTP_TRANSPORT_CREDENTIALS_W �1 IMAGE_ENCLAVE_CONFIG �1 _FILE_LEVEL_TRIM_RANGE u SYSTEM_FEATURE_ID �1 LPSTICKYKEYS �( TRACE_GUID_REGISTRATION �1 PUNICODE_STRING32 $ � PROCESS_DEVICEMAP_INFORMATION * �1 _FILE_VALID_DATA_LENGTH_INFORMATION �1 RTL_BACKOFF ' �1 PRTLP_PROCESS_REFLECTION_CONTEXT G _UNIVERSAL_NAME_INFOA " ! SECURITY_DESCRIPTOR_CONTROL �1 ENHMETARECORD " �1 _FSCTL_OFFLOAD_WRITE_OUTPUT
LPVOID �1 HARDWAREINPUT
�1 PVALUE R/ RPC_SECURITY_QOS_V4_W 9/ PRPC_INTERFACE_GROUP ) �1 PRTL_PROCESS_MODULE_INFORMATION_EX �1 EXCEPTION_RECORD64 �1 PMINMAXINFO �1 HIMCC__ �1 LPWIN32_STREAM_ID # �1 PWMI_IMAGELOAD_INFORMATION32 * �1 PPROCESS_COMMIT_RELEASE_INFORMATION �1 _FILEOFFSET_INFORMATION �1 _KEY_FLAGS_INFORMATION �+ IMAGE_BASE_RELOCATION �1 PWTSSESSION_NOTIFICATION $ �1 PSYSTEM_CALL_TIME_INFORMATION �1 ETW_STACK_CACHING_CONFIG % }1 PFILE_FS_DATA_COPY_INFORMATION ' �- FILE_NOTIFY_EXTENDED_INFORMATION {1 USN_TRACK_MODIFIED_RANGES w1 _DMA_CONFIGURATION_BYTE0 � GUID p1 tagRAWKEYBOARD m1 _IELF_HANDLE NTSTATUS $ f1 PSYSTEM_HIBERFILE_INFORMATION * � _CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG = RAWINPUTDEVICE a1 PCOLORADJUSTMENT _1 LPREGISTERWORD , [1 PTRANSACTIONMANAGER_BASIC_INFORMATION � RPC_SECURITY_CALLBACK_FN Y1 PSTACK_WALK_EVENT_DATA q LPWCH W1 PERFINFO_PROCESS_INSWAP
T1 LPCTCH P1 _SERVICE_TRIGGER ' I1 PPERFINFO_PMC_SAMPLE_INFORMATION * F1 PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO " :1 PPROCESS_WINDOW_INFORMATION R0 JOBOBJECT_WAKE_FILTER 51 PSYSTEM_FLUSH_INFORMATION # 21 _RTL_SEGMENT_HEAP_PARAMETERS &1 PRPC_INTERFACE_TEMPLATEW 1 PIMAGE_OPTIONAL_HEADER poly8_t < FILE_ACCESS_INFORMATION 1 _ENCLAVE_CREATE_INFO_VBS - 1 PTRANSACTIONMANAGER_OLDEST_INFORMATION 1 I_RpcProxyFilterIfFn 1 1 _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION - - RESOURCEMANAGER_COMPLETION_INFORMATION
1 WMI_IMAGEID_INFORMATION &
1 PPERFINFO_PPM_PERF_STATE_CHANGE % �# _QUERY_FILE_LAYOUT_FILTER_TYPE + Z _FILE_STORAGE_RESERVE_ID_INFORMATION 1 _ETW_TP_EVENT_POOL_CLOSE / ^- JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION ( 1 _WORKER_FACTORY_BASIC_INFORMATION ( �0 FINDFIRSTACTIVATIONCONTEXTSECTION �0 tagEMRSETWORLDTRANSFORM �0 _IMAGE_FILE_HEADER � _SILO_USER_SHARED_DATA �0 PEFI_DRIVER_ENTRY * �0 TRANSACTION_ENLISTMENTS_INFORMATION �0 RTL_TREE_WALK_FUNCTION � LPTRIVERTEX ( �0 TXFS_ROLLFORWARD_REDO_INFORMATION + �0 PSYSTEM_WRITE_CONSTRAINT_INFORMATION �0 PPROCESS_HEAP_ENTRY $ |& _HEAP_BLOCK_EXTRA_INFORMATION �0 PPERFINFO_CCSWAP_LITE " �0 PLPC_UNREGISTER_PROCESS_MSG 4 �0 _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION � poly16x4x4_t - RTL_OSVERSIONINFOEX2W �$ RTL_DISK_SPEED_INFO �0 LPAXISINFOW �0 PEMRCREATEMONOBRUSH �$ _RTL_DISK_SPACE_INFO �0 NONCLIENTMETRICSA ' �0 PPERFINFO_SAMPLED_PROFILE_CONFIG �0 POBJECT_TYPE_LIST - �0 PROCESS_MITIGATION_FONT_DISABLE_POLICY & �0 PLUGPLAY_CONTROL_CONFLICT_ENTRY �0 _RTL_STACK_CONTEXT ' �0 SYSTEM_AUDIT_CALLBACK_OBJECT_ACE / 8 SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION �0 KCRM_TRANSACTION_BLOB �0 _GHOSTED_FILE_EXTENT �0 HMENU
�0 LPRECT �$ int8x16x4_t �0 MUILANGUAGES �0 PICONMETRICSA �0 LPSCROLLBARINFO �0 PWX86THREAD % }0 SYSTEM_PAGEFILE_INFORMATION_EX & x0 BOOT_ENTROPY_SOURCE_RESULT_CODE r0 PRTL_LFG_RNG_STATE , o0 _PERFINFO_YIELD_PROCESSOR_INFORMATION # k0 ETW_TP_EVENT_POOL_TH_MIN_SET ' ' FILE_FS_VOLUME_FLAGS_INFORMATION ! h0 PREFS_SMR_VOLUME_GC_ACTION 1 � _EVENT_TRACE_LBR_CONFIGURATION_INFORMATION # f0 KEY_OPEN_SUBKEYS_INFORMATION TP_CALLBACK_ENVIRON_V3 x LPWIN32_FIND_DATAW `0 tagENUMLOGFONTEXDVW # Y0 PETW_COVERAGE_SAMPLER_MODULE V0 _EXCEPTION_POINTERS & _PROCESS_MEMORY_ALLOCATION_MODE P0 PJOBOBJECT_WAKE_FILTER L0 LPANIMATIONINFO ! I0 tagPOINTER_DEVICE_PROPERTY $ C0 PFILE_SFIO_VOLUME_INFORMATION % A0 PSYSTEM_FIRMWARE_TABLE_HANDLER :0 PGDI_TEB_BATCH 60 PVARIABLE_NAME �. _PHYSICAL_CHANNEL_RUN 8 00 PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION $ -0 PQUERY_BAD_RANGES_INPUT_RANGE ,0 LPDOCINFO (0 PTOKEN_SID_INFORMATION & %0 TOKEN_BNO_ISOLATION_INFORMATION + "0 PPROCESS_HANDLE_SNAPSHOT_INFORMATION * 0 PSET_DAX_ALLOC_ALIGNMENT_HINT_INPUT 0 PSERVICE_NOTIFYW ' 0 _FILE_FS_SECTOR_SIZE_INFORMATION ' 0 PAPPLICATIONLAUNCH_SETTING_VALUE 0 � _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY �( PMINIMIZEDMETRICS # 0 PREQUEST_OPLOCK_INPUT_BUFFER ) � SYSTEM_PHYSICAL_MEMORY_INFORMATION 1 QUERY_SERVICE_CONFIGA 0 PETW_SET_TIMER_EVENT # �* _SECTION_IMAGE_INFORMATION32 0 NCCALCSIZE_PARAMS % 0 PIMAGE_LOAD_CONFIG_DIRECTORY32
0 PIXELFORMATDESCRIPTOR 0 FONTENUMPROCA �/ EMRSELECTPALETTE ' �/ PEVENT_TRACE_VERSION_INFORMATION �/ PFILE_PREFETCH_EX + �/ DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER % �/ PERFINFO_SET_DEVICES_STATE_RET $ �/ PRTL_DYNAMIC_HASH_TABLE_ENTRY �/ HSPRITE__ � PUOW � NUMBERFMT % �/ _FILE_SFIO_RESERVE_INFORMATION % 6. _TXFS_WRITE_BACKUP_INFORMATION �/ _CURDIR �/ _PROCESS_ENERGY_VALUES �/ LPPANOSE �/ PIMAGE_LINENUMBER �/ PINITIAL_TEB �/ USN_RECORD_UNION �$ _TOKEN_TYPE �/ LPENUMTEXTMETRICA " �/ _PERFINFO_SET_DEVICES_STATE 1 PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY - LDR_RELEASE_ACT_CTX � RTL_AVL_NODE
v, POINTL # / SYSTEM_FIRMWARE_TABLE_ACTION & � RTL_SPARSE_BITMAP_CTX_OPERATION �- TPMPARAMS % �% _QUERY_BAD_RANGES_OUTPUT_RANGE �/ tagEMRTRANSPARENTBLT & �/ PETW_AUTOBOOST_NO_ENTRIES_EVENT "' EMRFORMAT ( VRF_TRIAGE_CONTEXT �/ PEMRSETDIBITSTODEVICE - �/ _VIRTUALIZATION_INSTANCE_INFO_INPUT_EX 1 �/ PSYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE �/ PRTL_OSVERSIONINFOW �/ LPUNLOAD_DLL_DEBUG_INFO s int32x4_t �/ PPSFEATURE_CUSTPAPER * �/ DISPLAYCONFIG_TARGET_PREFERRED_MODE ) �/ ACCESS_ALLOWED_CALLBACK_OBJECT_ACE + E EVENT_TRACE_PROFILE_LIST_INFORMATION �/ _SE_SID �/ PWMI_QUEUE �/ _FILE_RENAME_INFORMATION �/ MEMORY_WORKING_SET_BLOCK x/ HHOOK__ EMRPOLYLINETO r/ PERFINFO_TRACE_ENTRY o/ LPWIN32_FIND_DATA " k/ PPERFINFO_MEMORY_NODE_ENTRY PUMS_COMPLETION_LIST ! h/ PROCESSOR_PERFSTATE_POLICY " H# SERVICE_PREFERRED_NODE_INFO �" REGISTERWORDA # ^/ PACCESS_ALLOWED_CALLBACK_ACE - \/ JOBOBJECT_CPU_RATE_CONTROL_INFORMATION * X/ _PROCESS_SYSTEM_RESOURCE_MANAGEMENT M/ PRPC_SECURITY_QOS_V4_W J/ MIDL_METHOD_PROPERTY_MAP , D/ SERVICE_CONTROL_STATUS_REASON_PARAMSA - >/ PRTL_PROCESS_DLL_NOTIFICATION_FUNCTION
p PTCHAR k __C_ASSERT__ </ RPC_AUTH_KEY_RETRIEVAL_FN �$ uint8x16x4_t # 3# SYSTEM_KERNEL_DEBUGGER_FLAGS 7/ _POWER_MONITOR_INVOCATION � uint64x1x3_t % 3/ _UMS_SYSTEM_THREAD_INFORMATION +/ PWMI_PROCESS_INFORMATION , � MEMORY_PARTITION_TRANSFER_INFORMATION )/ PPLUGPLAY_CONTROL_CLASS '/ _CLASSIC_EVENT_ID �! uint8x16x3_t % "/ MANAGE_HOT_PATCH_QUERY_PATCHES ) / PSYSTEM_PROCESSOR_IDLE_INFORMATION # / _WMI_IMAGELOAD_INFORMATION32 3 / _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION
/ PINIT_ONCE � LARGE_INTEGER ) / _SYSTEM_FIRMWARE_TABLE_INFORMATION + / PSYSTEM_HYPERVISOR_QUERY_INFORMATION ! �. PTXFS_START_RM_INFORMATION �. PEMRGDICOMMENT # �. PPERFINFO_FILE_OPERATION_END �. PUUCSSTR ( �. PDPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK �. PMAXVERSIONTESTED_INFO �. PREASON_CONTEXT f _RTL_SPLAY_LINKS �. PDEVMODEA 4 �. _FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX r$ RTL_RETPOLINE_ROUTINES �. ETW_HEAP_EVENT_REALLOC q PUSHORT _ACE_HEADER & o- _PLUGPLAY_CONTROL_CONFLICT_LIST 0 �. PACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION �. PMOUSEINPUT $ NLSVERSIONINFO �. PPERFINFO_VIRTUAL_ALLOC . �. PPROCESS_DYNAMIC_EH_CONTINUATION_TARGET �. PPHYSICAL_CHANNEL_RUN �. PSI_COPYFILE ) LOGBRUSH �. EMRCREATEBRUSHINDIRECT �. LPRECTL ! �. _ETW_THREAD_SET_NAME_EVENT �. NTFS_EXTENDED_VOLUME_DATA + �. PFILE_SYSTEM_RECOGNITION_INFORMATION �. PSD_GLOBAL_CHANGE_INPUT �. SERVICE_START_REASON �. HEAP_RANGE_DESTROY �. PTHREAD_NAME_INFORMATION �. _DesiredStorageClass � CM_INT13_DRIVE_PARAMETER ! �. IMAGE_DYNAMIC_RELOCATION32 �. LPOSVERSIONINFOEXA q# PROCESS_INFORMATION_CLASS �! EMRFLATTENPATH ! �. SYSTEM_BASIC_INFORMATION64 R ENUMTEXTMETRIC . �. PETW_COVERAGE_SAMPLER_INFORMATION_CLASS � THREAD_WORKLOAD_CLASS �. PRTL_PROCESS_HEAPS �. _ETW_OPTICALIO_READWRITE $ �. _SYSTEM_HANDLE_INFORMATION_EX �. _WNF_STATE_NAME_LIFETIME �. LPCHARSETINFO . LPLOGBRUSH ~. pthreadmbcinfo {. _ALPC_HANDLE_ATTR ' �% ACTIVATION_CONTEXT_ASSEMBLY_DATA o. GENERIC_BINDING_INFO t INT32 l. _PSFEATURE_CUSTPAPER h. RPC_SECURITY_QOS_V4_A # _. _ETW_OPTICALIO_FLUSH_BUFFERS - �& EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 ' [. _CRITICAL_PROCESS_EXCEPTION_DATA X. PRTL_SPLAY_LINKS W. PREGISTERCLASSNAMEW 6 T. RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY �) NPSTYLEBUFA $ �+ PERFINFO_DRIVER_MAJORFUNCTION Q. PDEBUG_PRINT_CALLBACK N. PEMRANGLEARC J. PSD_QUERY_STATS_OUTPUT TP_WAIT_RESULT H. UNLOAD_DLL_DEBUG_INFO " B. POPERATION_START_PARAMETERS =. POBJECT_BASIC_INFORMATION ) _PS_PROTECTED_TYPE F 9. ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING " _OUTLINETEXTMETRICA $ 6. TXFS_WRITE_BACKUP_INFORMATION 2. RTL_BALANCED_LINKS ). PCIMAGE_TLS_DIRECTORY " o QUERY_STORAGE_RESERVE_INPUT * %. SYSTEM_SYSTEM_PARTITION_INFORMATION / !. _TRANSACTIONMANAGER_RECOVERY_INFORMATION 4 RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY
HANDLE / . PRTL_READ_MAPPED_MEMORY_EXCEPTION_FILTER . PFE_IMPORT_FUNC � _TP_TRACE_TYPE . PSECURITY_ATTRIBUTES # _TRACE_ENABLE_FLAG_EXTENSION p INT8 . PDEDUP_FILE_OPERATION . HGLRC % . NTFS_FILE_RECORD_OUTPUT_BUFFER . _KEY_BASIC_INFORMATION . VM_COUNTERS_EX % �- PPROCESS_WORKING_SET_OPERATION �- HW_PROFILE_INFOA ]& LOGCOLORSPACE # H# _SERVICE_PREFERRED_NODE_INFO " �- FILE_LINK_ENTRY_INFORMATION �- PPROCESSOR_IDLE_STATES # �& RTL_CRITICAL_SECTION_DEBUG64 �- PNONCLIENTMETRICSW �- STARTING_LCN_INPUT_BUFFER �- PEMRPOLYGON p PZZTSTR & �- PCOVERAGE_UNLOADED_MODULE_ENTRY " �- _QUERY_SERVICE_LOCK_STATUSW # ULONGLONG __n64x2 �- MEMORYSTATUSEX $ �- SYSDBG_LIVEDUMP_CONTROL_FLAGS # �- _PROCESSOR_POWER_POLICY_INFO ], _XSAVE_CET_U_FORMAT � PROCESSOR_GROUP_INFO " �- _MEMORY_COMBINE_INFORMATION �- PDEVICE_FLAGS " LPCOLORREF E CODEPAGE_ENUMPROCA �- PENTER_STATE_HANDLER �- PMIDL_STUBLESS_PROXY_INFO �- PZPWSTR �- PCLUNICODE_STRING __time32_t ( �- PFILE_NOTIFY_EXTENDED_INFORMATION % GRADIENT_RECT �- PQUERY_BAD_RANGES_INPUT & �- PMM_ETW_WORKING_SET_PFN_RUNDOWN ( 5( _RPC_BINDING_HANDLE_SECURITY_V1_W � poly16x4x3_t . D FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT $( POWER_USER_PRESENCE_TYPE �- _SYSTEM_FLAGS_INFORMATION ] PSLIST_ENTRY �- tagTPMPARAMS # �- _RTL_SPARSE_BITMAP_PARAMETER �' _RTL_PROCESS_HEAPS �- WINDOWPOS % ?, IMAGE_RESOURCE_DIRECTORY_ENTRY �- MEMORY_RESERVE_TYPE $ �- PO_HIBER_FORCE_DISABLE_REASON ," DOCINFO - 1$ _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 }- tagEMREXTTEXTOUTA y- MOUSEKEYS u- _RTL_HEAP_TAG q- PTRACE_ENABLE_CONTEXT_EX ' � _RTL_SPARSE_BITMAP_CTX_OPERATION % o- PLUGPLAY_CONTROL_CONFLICT_LIST ! i- _IMAGE_RESOURCE_DATA_ENTRY W _STORAGE_RESERVE_ID f- PDMA_SPEED c- NLSTABLEINFO 0 ^- _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION < _FP_IEEE_COMPARE_RESULT �# _FILE_LAYOUT_INFO_ENTRY �# FILE_LAYOUT_INFO_ENTRY [- EX_WNF_CALLBACK P- TP_TASK_CALLBACKS * # PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA �' WMI_DPI_RECORD I- tagEMRANGLEARC F- LPDEBUGHOOKINFO ! q# _PROCESS_INFORMATION_CLASS $ E- PSC_NOTIFICATION_REGISTRATION B- _SD_ENUM_SDS_ENTRY >- CM_MONITOR_DEVICE_DATA :- FINDEX_INFO_LEVELS * t) _EVENT_TRACE_TAG_FILTER_INFORMATION s uint16x8_t 7- _ACCESS_ALLOWED_ACE /- PIMAGE_CHPE_RANGE_ENTRY �+ SERIALKEYSA 3 *- PJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 '- CREATE_USN_JOURNAL_DATA !- PREARRANGE_FILE_DATA - PEISA_PORT_DESCRIPTOR ( - _SYSTEM_SINGLE_MODULE_INFORMATION . - PRESOURCEMANAGER_COMPLETION_INFORMATION - PRTL_OSVERSIONINFOEX2W <( PEMRPOLYLINETO16 - RECONVERTSTRING - PETW_LBR_ENTRY $
- NTFS_FILE_RECORD_INPUT_BUFFER ( - PTP_CLEANUP_GROUP_CANCEL_CALLBACK * - PASSEMBLY_FILE_DETAILED_INFORMATION - PSYSTEMTIME - PCOVERAGE_MODULES �, MENUITEMTEMPLATE 6 �, JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 �" KEY_FULL_INFORMATION ! �, PIMAGE_COFF_SYMBOLS_HEADER . _DEBUG_CONTROL_SPACE_ITEM $ �, _FILE_COMPRESSION_INFORMATION $ �, _REFS_DEALLOCATE_RANGES_RANGE # �, _KEY_HANDLE_TAGS_INFORMATION �, DOCINFOW ' �, _PERFINFO_CC_SCHEDULE_READ_AHEAD �, _IMAGE_HOT_PATCH_HASHES 9 MFT_ENUM_DATA
�, PLBLOB �, LPCOMMTIMEOUTS �, _DRAWPATRECT �, _RPC_SID �, _HEAP_EVENT_RANGE_CREATE 3 �, PTRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT % �, _SYSTEM_ACPI_AUDIT_INFORMATION �& _SL_APPX_CACHE �, _MODEMDEVCAPS % �* _PLUGPLAY_CONTROL_INSTALL_DATA ) �, _RESOURCEMANAGER_BASIC_INFORMATION a RTL_WORK_ON_BEHALF_TICKET �, EDITWORDBREAKPROCW �, PFLOAT128 �, LPSERVICE_TABLE_ENTRYW �, PETW_TP_EVENT_POOL_CREATE ( �, RTL_PROCESS_MODULE_INFORMATION_EX �, HCOLORSPACE 2 RPC_CWSTR PACCESS_TOKEN �, POINTER_DEVICE_TYPE �, PLOGPEN � _TRACE_ENABLE_INFO 4 �, _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION �, REFS_VOLUME_DATA_BUFFER - �& _SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT ' �, _PUBLIC_OBJECT_BASIC_INFORMATION o% _RTL_UMS_COMPLETION_LIST �, PFILE_MODE_INFORMATION |, LPRGNDATA
s __n128 y, HDESK__ v, _POINTL
% EMRARC t, LPENUM_SERVICE_STATUSA r, SERVICE_NOTIFY o, PPERFINFO_IPI_SEND_DATA + �' _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A & j, _FILE_ATTRIBUTE_TAG_INFORMATION % f, SYSTEM_MEMORY_LIST_INFORMATION a, _LOAD_DLL_EVENT_DATA [, PXSAVE_CET_U_FORMAT / S, PFILE_QUERY_METADATA_OPTIMIZATION_OUTPUT " N, PENLISTMENT_CRM_INFORMATION L, PVIRTUAL_STORAGE_TYPE K, PREPAIR_COPIES_INPUT � RpcProxyPerfCounters < EVENT_DATA_DESCRIPTOR $ F, _PERFINFO_PAGE_RANGE_IDENTITY & 9, PIMAGE_RESOURCE_DIRECTORY_ENTRY 4, PSECURITY_CAPABILITIES �! _LDR_DDAG_NODE t HFILE /, PCUQUAD +, PPM_IDLE_STATE_BUCKET_EX �" WATCHDOG_HANDLER_ACTION + ', JOURNAL_SET_KEY_SECURITY_INFORMATION , !, PRTL_USER_PROCESS_EXTENDED_PARAMETERS � UUID , LPCUWCHAR `+ EMRSETICMPROFILEW , PFLASHWINFO , PCM_PARTIAL_RESOURCE_LIST F" FILE_STREAM_INFORMATION e DPFLTR_TYPE , FILETIME &
, _RTL_SEGMENT_HEAP_MEMORY_SOURCE " , _FILE_DIRECTORY_INFORMATION , LPMDICREATESTRUCT , MODEMSETTINGS �+ REGISTERWORDENUMPROCA % �+ PPERFINFO_DRIVER_MAJORFUNCTION # �+ _MEMORY_PARTITION_PAGE_RANGE �+ _CLIENT_CALL_RETURN �+ MUICCENTRY �+ NPIMEMENUITEMINFO �+ PRTL_OSVERSIONINFOEXW ' �+ _RTL_QUERY_DEBUG_VIRTUAL_PROCESS � LDR_SERVICE_TAG_RECORD } _ICONINFO �+ PIMAGE_BASE_RELOCATION �$ PEBS_DS_SAVE_AREA �+ LPAXESLISTW �+ PMM_ETW_PAGE_INFO_EX � PRIORITY_HINT �+ LPENUMLOGFONTEXA �+ _RTLP_HEAP_TAGGING_INFO 5 �+ PCACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION �+ PCLBLOB $ �+ SYSTEM_PROCESS_CLASSIFICATION % �+ PERFINFO_FILE_SIMPLE_OPERATION ' �+ PSYSTEM_POOL_ZEROING_INFORMATION �+ PPOWER_REQUEST_CONTEXT �+ IMPORT_OBJECT_HEADER �+ LPMOUSEHOOKSTRUCT �+ tagSERIALKEYSA �+ ETW_REGNOTIF_REGISTER �+ PGROUP_AFFINITY � _MUISTRINGPOOL �+ CONNECTDLGSTRUCTW �% _EXCEPTION_RECORD }+ _ETW_SET_TIMER_EVENT
PINT16 . y+ PROCESS_REVOKE_FILE_HANDLES_INFORMATION 2' COPYFILE2_MESSAGE_TYPE " SYSINF_PAGE_COUNT s+ LPMDINEXTMENU l+ PBSMINFO k PORT_MESSAGE i+ WAKE_TIMER_INFO d+ ENCLAVE_LOAD_INFO_VBS `+ tagEMRSETICMPROFILE . ]+ PTOUCH_HIT_TESTING_PROXIMITY_EVALUATION # TRACEHANDLE V+ HIMC � _INTERFACE_TYPE * L+ PSYSTEM_FEATURE_CONFIGURATION_QUERY I+ RTL_BITMAP 4 F+ JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION % B+ FSCTL_UNMAP_SPACE_INPUT_BUFFER ;+ RTL_CIRCULAR_LIST_HEAD 6+ _RTL_UNLOAD_EVENT_TRACE 7 TIME_ZONE_INFORMATION . 2+ SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION /+ PEMRSETWINDOWORGEX -+ VOLUME_REFS_INFO_BUFFER '+ PPPM_IDLESTATE_EVENT $ %+ PSYSTEM_KERNEL_DEBUGGER_FLAGS - #+ MEMORY_PHYSICAL_CONTIGUITY_INFORMATION . + JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 ) + _MEMORY_WORKING_SET_EX_INFORMATION
+ NPOUTLINETEXTMETRICW + LPCREATESTRUCTA + ETW_HEAP_EVENT_CREATE " � HOT_PATCH_INFORMATION_CLASS ! + ETW_UMS_EVENT_DISASSOCIATE �* PWOW64_CONTEXT �* PFOCUS_EVENT_RECORD / �' IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER * �* PTRANSACTION_PROPERTIES_INFORMATION �* NPEXTLOGFONTW * �* PSYSTEM_SESSION_PROCESS_INFORMATION � _THREAD_INFORMATION_CLASS ' �* PALPC_MESSAGE_HANDLE_INFORMATION & �* _FILE_IO_COMPLETION_INFORMATION # � IMAGE_RUNTIME_FUNCTION_ENTRY # �* PSECTION_IMAGE_INFORMATION32 �# PNEWTEXTMETRICW �* PKBDLLHOOKSTRUCT �* PEVENT_INSTANCE_INFO �* PRTL_DRIVE_LETTER_CURDIR �* PDRAWITEMSTRUCT �* tagWNODE_SINGLE_ITEM �* _REPARSE_GUID_DATA_BUFFER " NOTIFICATION_MASK �* CALINFO_ENUMPROCW �* _EVENT_TYPE . �* PEVENT_TRACE_PROFILE_REMOVE_INFORMATION
� _LBLOB �* HEAP_AFFINITY_SLOT_ASSIGN �* NPEXTLOGPEN32 �* DISPLAYCONFIG_PIXELFORMAT ) �* FILE_PIPE_CLIENT_PROCESS_BUFFER_EX ! WATCHDOG_INFORMATION_CLASS # J' TRANSACTION_LIST_INFORMATION ! p _FILE_REMOTE_PROTOCOL_INFO �* tagTOUCHINPUT �* PTP_TIMER_CALLBACK $ �* PLUGPLAY_CONTROL_INSTALL_DATA $ L WORKER_FACTORY_CALLBACK_CLASS � EMRSETARCDIRECTION �* KEY_EVENT_RECORD �* PTP_TIMESTAMP # �* _MEMORY_PRIORITY_INFORMATION � _COPYFILE2_MESSAGE_ACTION �* COPYFILE2_MESSAGE t* _FILE_PIPE_PEEK_BUFFER $ n* PETW_TP_EVENT_CALLBACK_CANCEL 2 �( SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT �& ENCRYPTION_KEY_CTRL_INPUT * k* FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT � _EXCEPTION_DISPOSITION � ACL_INFORMATION_CLASS g* _ENCLAVE_INIT_INFO_VBS , Z* PPERFINFO_SAMPLED_PROFILE_INFORMATION R* PPOLYTEXTA O* tagMDICREATESTRUCTA K* _NORM_FORM F* PALPC_MESSAGE_ATTRIBUTES � RTL_RB_NODE )# LPCWPRETSTRUCT D* PENERGY_STATE_DURATION �% CLUSTER_RANGE B* PLUGPLAY_EVENT_BLOCK * LPBITMAPV4HEADER
* LPMAT2 * PWMI_BUFFER_HEADER
* PWMI_UDP * _FAT_STATISTICS * PROFILE_SOURCE_INFO * PACCESS_REASONS ) �) _SE_LEARNING_MODE_USER_OBJECT_DATA �) PNT_TIB64 �) PPOWER_STATE_HANDLER_TYPE P tagIMEMENUITEMINFOA � FXSAVE_FORMAT_WX86 & � _RTL_RETPOLINE_RELOCATION_INDEX o' LPHELPWININFOW $ �) PPERFINFO_FILE_PATH_OPERATION " �) _SYSTEM_CONSOLE_INFORMATION �$ LPWGLSWAP E DATEFMT_ENUMPROCA % �" JOBOBJECT_IO_ATTRIBUTION_STATS % �( _SYSTEM_GDI_DRIVER_INFORMATION
�) PM128A �) PGESTURECONFIG % �) PERFINFO_PPM_PERF_STATE_CHANGE - �) SYSTEM_THREAD_CID_PRIORITY_INFORMATION �) ANSI_STRING32 �) X86_CALL_FRAME �) PPOWER_ACTION_POLICY �) PMULTIKEYHELPW �) PSTYLEBUFA $ �) PPROCESS_HANDLE_TRACING_QUERY Y EXCEPTION_LOG_TYPE �% _CLUSTER_RANGE �) ETW_RT_EVENT_LOSS � PUNZWCH |% KEY_NODE_INFORMATION # �) THREAD_PROFILING_INFORMATION # �) _MEMORY_WORKING_SET_EX_BLOCK �) _ETW_WAKE_COUNTER_EVENT : �) PSYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION �) LPMEASUREITEMSTRUCT # �) PWMI_IMAGELOAD_INFORMATION64 �) ETW_SET_MARK_INFORMATION 0 �) EVENT_TRACE_IPT_CONFIGURATION_INFORMATION |) PMOVE_FILE_DATA % z) PJOBOBJECT_WAKE_INFORMATION_V1 # x) SET_PURGE_FAILURE_MODE_INPUT - t) EVENT_TRACE_POOLTAG_FILTER_INFORMATION �' _OBJECT_ATTRIBUTES p) IMAGE_THUNK_DATA - j) OUT_OF_PROCESS_FUNCTION_TABLE_CALLBACK d) PTIMER_BASIC_INFORMATION , _) PPLUGPLAY_CONTROL_RELATED_DEVICE_DATA
! LANGID # \) _SECURITY_QUALITY_OF_SERVICE T) PTRACE_LOGFILE_HEADER32 9 S) PPROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY & � PS_MITIGATION_AUDIT_OPTIONS_MAP ( Q) tagACTCTX_SECTION_KEYED_DATA_2600 + K) PETW_UMS_EVENT_DIRECTED_SWITCH_START ! H) _PERFINFO_IPI_RECEIVE_DATA D) SYSTEM_PREFETCH_OPTIONS 8) ALPC_SECURITY_ATTR 1) PEMRCOLORMATCHTOTARGET ) _WOF_VERSION_INFO ) LPDCB
p PSCHAR ( ) FILE_ID_GLOBAL_TX_DIR_INFORMATION ) _ATOM_INFORMATION_CLASS & ) QUERY_PERFORMANCE_COUNTER_FLAGS % �' PROCESS_MEMORY_EXHAUSTION_TYPE �! tagGCP_RESULTSA 2 ) TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE ) WOF_VERSION_INFO ) PMM_ETW_PAGE_EXTRA_INFO ) NPPATTERN �% ETW_IDEAL_PROCESSOR_EVENT
PINT64 �( PTOKEN_DEVICE_CLAIMS �( APC_CALLBACK_FUNCTION - �( PEVENT_EXTENDED_ITEM_PROCESS_START_KEY ! �( SYSTEM_CPU_SET_INFORMATION & �( SYSTEM_SPECIAL_POOL_INFORMATION �( HELPWININFOA �( RID_DEVICE_INFO �( _TRACE_GUID_REGISTRATION # �( RTL_USER_PROCESS_INFORMATION �( LPCREATESTRUCTW �( LPMINIMIZEDMETRICS �( SCOPE_TABLE �( FILE_INTERNAL_INFORMATION % �( PSYSTEM_CALL_COUNT_INFORMATION
� PANOSE �( PIMAGE_SECTION_HEADER �( PACCESS_DENIED_OBJECT_ACE " * PROCESS_BASIC_INFORMATION64 �( ARRAY_INFO �( PPO_WAKE_SOURCE_HISTORY $ �( SYSTEM_GDI_DRIVER_INFORMATION �( PUMS_THREAD_INFO_CLASS �% PCWCHAR % �( PDYNAMIC_TIME_ZONE_INFORMATION $& PEMRSCALEWINDOWEXTEX �( _EVENT_INFORMATION_CLASS " �( PSYSTEM_BIGPOOL_INFORMATION 3 �( PSYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT �( MEASUREITEMSTRUCT �( XMIT_ROUTINE_QUINTUPLE ~( RTL_BSD_ITEM FXPT2DOT30 $ __n64 w( _MANDATORY_LEVEL u( LPPOINT " t( PWMI_JOB_SET_QUERY_CPU_RATE ( s( PPROCESS_TELEMETRY_ID_INFORMATION 4 m( PJOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 j( MIDL_SERVER_INFO [( PPS_PROTECTED_SIGNER Y( _WOW64_LDT_ENTRY C( PRTL_PERTHREAD_CURDIR B( PCIMAGE_THUNK_DATA64 # @( PTEB_ACTIVE_FRAME_CONTEXT_EX u PUINT <( PEMRPOLYGON16 9( tagGESTUREINFO ' 5( RPC_BINDING_HANDLE_SECURITY_V1_W 9" RTL_SPARSE_BITMAP_RANGE - _DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO *( PEMRCREATECOLORSPACEW "( PPOWER_USER_PRESENCE 0 ( PIMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER ( _CM_SERVICE_LOAD_TYPE ( FP_64 # ( _PROCESS_WORKING_SET_CONTROL � PACTIVATION_CONTEXT_STACK % �$ ALPC_PORT_CALLBACK_INFORMATION % ( SYSTEM_VERIFIER_INFORMATION_EX 5 � _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION - ( _PERFINFO_PFMAPPED_SECTION_INFORMATION ( LC_ID �' OBJECT_ATTRIBUTES G _PEBS_DS_SAVE_AREA32 & �' _PROCESS_MEMORY_EXHAUSTION_TYPE �' LPOFSTRUCT �' tagRID_DEVICE_INFO_MOUSE 0 �' _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER * �' RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A �' SYSTEM_NUMA_PROXIMITY_MAP �' PEMRPOLYTEXTOUTA �' RID_DEVICE_INFO_KEYBOARD �' _USER_MARSHAL_CB �' LPMENUBARINFO # �' _TOKEN_GROUPS_AND_PRIVILEGES _EISA_DMA_CONFIGURATION �' LPDISPLAY_DEVICEW �' SC_STATUS_TYPE �' NDR_CS_ROUTINES _HEAP_SUBSEGMENT_FREE . _ EVENT_TRACE_PROFILE_COUNTER_INFORMATION �' RTL_PROCESS_HEAPS tagTOGGLEKEYS # [ tagINPUT_MESSAGE_DEVICE_TYPE �' _WMI_DPI_RECORD , �' _SYSTEM_HYPERVISOR_DETAIL_INFORMATION �' HSTR � _PRIORITY_HINT �% EMRSCALEVIEWPORTEXTEX �' PIMAGE_HOT_PATCH_INFO �' NV_MEMORY_RANGE " � _FILE_IO_PRIORITY_HINT_INFO �# SE_IMAGE_SIGNATURE_TYPE �' PICONINFOEXW �! RPC_CLIENT_INTERFACE � _ACCESS_REASON_TYPE �' PPROCESS_EXCEPTION_PORT �' NPDEVMODE ~' CPINFOEXW z' _CONTEXT_CHUNK v' NMHDR o' PHELPWININFOW �" tagREGISTERWORDA l' SD_GLOBAL_CHANGE_OUTPUT 1 f' PSYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS a' PCRITICAL_SECTION
" PULONG [' PCONSOLE_FONT_INFO - � _ALPC_PORT_COMPLETION_LIST_INFORMATION - X' TRANSACTIONMANAGER_LOGPATH_INFORMATION � _RTL_RB_TREE " R' PETW_TP_EVENT_CALLBACK_STOP ' / _ETW_SESSION_NOTIFICATION_PACKET # M' PFILE_COMPLETION_INFORMATION $ J' _TRANSACTION_LIST_INFORMATION E' tagEMRSTRETCHDIBITS A' _TRACE_GUID_PROPERTIES " =' IMAGE_LOAD_CONFIG_DIRECTORY ! 9' _LINK_TRACKING_INFORMATION 2' _COPYFILE2_MESSAGE_TYPE u TOUCH_FLAGS HEAP_SUBSEGMENT_INIT & �" _JOBOBJECT_IO_ATTRIBUTION_STATS . )' PSYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE ) &' _PLUGPLAY_CONTROL_CONFLICT_STRINGS "' tagEMRFORMAT 5 ' LPSERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM ' PTOKEN_MANDATORY_LABEL
' _TRACE_LOGFILE_HEADER32 ' _COUNTER_READING � REFS_SMR_VOLUME_GC_ACTION ' _PREFIX_TABLE_ENTRY �& _VM_COUNTERS �& SL_APPX_CACHE ! �& PENCRYPTION_KEY_CTRL_INPUT + � RTLWOW64_CROSSPROCESS_WORK_OPERATION RPC_AUTH_IDENTITY_HANDLE �& _RPC_VERSION �& _DISPATCHER_CONTEXT �& _RTL_UMS_CONTEXT �& LPJIT_DEBUG_INFO32 . �& _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 �& PUSN_RECORD_COMMON_HEADER �& SPARSE_OVERALLOCATE_DATA & � _SYSTEM_SYSTEM_DISK_INFORMATION �& PRTL_HANDLE_TABLE_ENTRY � poly8x8x3_t # �& PSYSTEM_VERIFIER_INFORMATION $ �& PRTL_CRITICAL_SECTION_DEBUG64 ?% CONSOLE_FONT_INFOEX �& SYSTEM_TRACE_HEADER % �& PPERFINFO_PPM_IDLE_STATE_ENTER # �& FILE_ID_FULL_DIR_INFORMATION �& _EVENTLOGRECORD ( �& PRPC_BINDING_HANDLE_TEMPLATE_V1_A & �& ETW_DFSS_RELEASE_THREAD_ON_IDLE , �& SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT $ z& PHEAP_BLOCK_EXTRA_INFORMATION ! w& POINTER_BUTTON_CHANGE_TYPE ! u& PSEC_WINNT_AUTH_IDENTITY_A & s& EVENT_TRACE_VERSION_INFORMATION p& PICONMETRICS n& COORD ' k& SYSTEM_ALARM_CALLBACK_OBJECT_ACE $ g& COPYFILE2_EXTENDED_PARAMETERS c& LPMENUINFO a& SYSTEM_OBJECT_INFORMATION [& LPLOGCOLORSPACE �" WMI_IMAGEID_INFORMATION32 U& PWNDCLASSW R& tagHELPINFO 6 M& PRTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY # J& QUERY_BAD_RANGES_INPUT_RANGE F& _RTL_RUN_ONCE / ?& POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES ) <& PCACTIVATION_CONTEXT_ASSEMBLY_DATA 9& _CSV_QUERY_REDIRECT_STATE -& PQUERY_FILE_LAYOUT_INPUT , '& _JOURNAL_SET_DELETE_VALUE_INFORMATION $& PEMRSCALEVIEWPORTEXTEX ) *! _SERVICE_REQUIRED_PRIVILEGES_INFOW "& _ALPC_CONTEXT_ATTR * & PWIM_PROVIDER_SUSPEND_OVERLAY_INPUT " & _PERFINFO_BATTERY_LIFE_INFO ) & _SYSTEM_REGISTRY_QUOTA_INFORMATION �% PCNZWCH & LDR_ENUM_RESOURCE_ENTRY 9 & SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION _ int64x2x2_t & PTHREAD_ENERGY_VALUES ( �% _TXFS_READ_BACKUP_INFORMATION_OUT N# _PROCESS_HEAP_INFORMATION �% PEMRDELETECOLORSPACE �% ETW_CANCEL_KTIMER2_EVENT + �% PPROCESS_KEEPALIVE_COUNT_INFORMATION �% NDR_SCONTEXT ! �% _ETW_IDEAL_PROCESSOR_EVENT
u size_t � PCANDIDATEFORM ) �% PERFINFO_SYSTEM_MEMORY_INFORMATION $ �% QUERY_BAD_RANGES_OUTPUT_RANGE �% PCLUSTER_RANGE � IMAGE_MITIGATION_POLICY �% RTLP_EXIT_THREAD �% _STACK_WALK_EVENT_DATA X _ALPC_PORT_ATTRIBUTES �% PWMI_REGISTRY �% PSYSTEM_POOL_ENTRY �% tagEMRSCALEVIEWPORTEXTEX �% PICONINFO $ int64x1_t 3 �% _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION ( �% _ACTIVATION_CONTEXT_ASSEMBLY_DATA ! �% WMI_JOB_SET_QUERY_CPU_RATE f RTL_SPLAY_LINKS �% NPCOMPOSITIONFORM % �% PLDR_DLL_NOTIFICATION_FUNCTION # �% _ACCESS_ALLOWED_CALLBACK_ACE ! �% UNIQUE_PROCESS_INFORMATION �% RTLP_START_THREAD �% PPERFINFO_CCSWAP_IDLE # �% _TOKEN_SECURITY_ATTRIBUTE_V1 �% PEXCEPTION_RECORD 2 �% _MEMORY_PARTITION_CONFIGURATION_INFORMATION �% PEMRPIE " �% PCM_EXTENDED_PARAMETER_TYPE % PPVALUEW �$ int16x8x4_t " tagEMRINVERTRGN z% PKEY_NODE_INFORMATION x% LPFNDEVCAPS s% EMRGLSRECORD % � THREAD_UMS_INFORMATION_COMMAND # TXFS_TRANSACTION_ACTIVE_INFO o% RTL_UMS_COMPLETION_LIST m% ENUMRESTYPEPROCA " OUTLINETEXTMETRICA j% LPMOUSEHOOKSTRUCTEX h% WNDCLASSEXA `% provider_info
time_t - T% _REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER P% XSTATE_FEATURE �# _RTL_CRITICAL_SECTION32 K% LPGRADIENT_RECT # PULONG64 I% _SE_ACCESS_REQUEST � _FUNCTION_TABLE_TYPE ?% _CONSOLE_FONT_INFOEX + � LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION $ ;% _NDR_CS_SIZE_CONVERT_ROUTINES +% _RTL_MEMORY_TYPE " (% _FILE_NUMA_NODE_INFORMATION * � RTL_FEATURE_CONFIGURATION_OPERATION % � _MEMORY_COMBINE_INFORMATION_EX % "% PSERVICE_LAUNCH_PROTECTED_INFO $ % PROCESS_ENERGY_TRACKING_STATE + % PHEAP_OPTIMIZE_RESOURCES_INFORMATION % _HEAP_RANGE_INFORMATION l PABC � _PS_CREATE_INFO ' % PFILE_PIPE_CLIENT_PROCESS_BUFFER
% PDMA_WIDTH � TP_TIMESTAMP % _GRADIENT_RECT
% EMRPIE + K TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 % LPUNIVERSAL_NAME_INFOW ( �$ PETW_COVERAGE_SAMPLER_CREATE_INFO p SCHAR �$ PPEBS_DS_SAVE_AREA - �$ PSYSTEM_CRASH_DUMP_CONFIGURATION_CLASS LONGLONG �$ _ETW_READY_THREAD_EVENT �$ RETRIEVAL_POINTER_COUNT ' �$ _IO_COMPLETION_BASIC_INFORMATION �$ _RTL_DISK_SPEED_INFO �$ PHEAP_SUBSEGMENT_FREE 0 - RTL_FEATURE_CONFIGURATION_CHANGE_CALLBACK �$ PSYNCHRONIZATION_BARRIER �$ PRTL_AVL_TABLE " �$ KEY_VALUE_INFORMATION_CLASS �$ TOKEN_ACCESS_INFORMATION ( _RTL_FEATURE_VARIANT_PAYLOAD_KIND � _ARMINTR_BARRIER_TYPE " error_status_t �$ LPCOMMPROP
�$ EMREOF & �$ _ALPC_PORT_CALLBACK_INFORMATION �$ PWGLSWAP �$ _WMI_DELAY_EXECUTION �$ __n128x4 1 � _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION �$ PREGISTERWORDA $ �$ _ETW_COVERAGE_SAMPLER_OPTIONS �$ CI_LOG_SCHEDULER_EVENT ! �$ POWER_MONITOR_REQUEST_TYPE �$ tagSTYLEBUFA ' �$ _ETW_PARTITION_INFO_EXTENSION_V2 � uint8x8x3_t $ PRTL_DISK_SPACE_INFO i _tag_ARMINTR_BANKED_REG � DEVICE_POWER_STATE y$ REG_NOTIFY_INFORMATION r$ _RTL_RETPOLINE_ROUTINES " l$ PIMAGE_AUX_SYMBOL_TOKEN_DEF i$ PDEVICE_POWER_STATE e$ PRTL_SPARSE_BITMAP_RUN `$ PSIZE $ \$ PPERFINFO_PPM_STATE_SELECTION 0 � SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION Y$ WOW64_FLOATING_SAVE_AREA $ U$ _ETW_TP_EVENT_POOL_TH_MAX_SET ! Q$ PERFINFO_CC_CAN_WRITE_FAIL M$ ETW_UMGL_KEY I$ POOLED_USAGE_AND_LIMITS C$ PNUMA_NODE_RELATIONSHIP & A$ SYSTEM_DPC_BEHAVIOR_INFORMATION M HEAP_REGION_INFORMATION % ;$ PETW_TP_EVENT_CALLBACK_ENQUEUE 8$ _FSCTL_UNMAP_SPACE_OUTPUT 4$ TIMER_INFORMATION_CLASS - /$ PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64 W _CM_ROM_BLOCK ! m _PROC_THREAD_ATTRIBUTE_NUM )$ CURSORINFO #$ SERVICE_TIMECHANGE_INFO . _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS - $ _MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE H TP_LOG_LEVEL $ LPLOCALESIGNATURE [ INPUT_MESSAGE_DEVICE_TYPE # PREGHANDLE &
$ PETW_THREAD_EVENT_SUBPROCESSTAG $ PUTF8_STRING % $ PDRIVER_VERIFIER_THUNK_ROUTINE * EMRSETWINDOWEXTEX $ TOKEN_DEFAULT_DACL 2 $ _PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION $ WINDOWINFO �# LPENUM_SERVICE_STATUS �# PZPTSTR �# PKSYSTEM_TIME �# LPNEWTEXTMETRICW �# IO_STATUS_BLOCK32 �# PTOKEN_ORIGIN 0 PFORMAT_STRING �# _REPARSE_DATA_BUFFER_EX ( �# PRTL_WALK_IMAGE_POLICIES_CALLBACK i _SYSTEM_BIGPOOL_ENTRY �# PRTL_CONDITION_VARIABLE �# SECURITY_OBJECT_AI_PARAMS $ �# PSTARTING_LCN_INPUT_BUFFER_EX �# SYSDBG_IO_SPACE " J! PBY_HANDLE_FILE_INFORMATION �# PPROCESS_LEAP_SECOND_INFO �# LPVIDEOPARAMETERS �# PWNODE_TOO_SMALL ' �# PJOBOBJECT_BASIC_PROCESS_ID_LIST * �# PPERFINFO_HARDPAGEFAULT_INFORMATION JIT_DEBUG_INFO �# PFILE_LAYOUT_INFO_ENTRY t LPINT �# PROCESSOR_NUMBER �# PRTL_CRITICAL_SECTION32 �# _IO_ERROR_LOG_PACKET * �# PIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY 4 �# PSYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION �# POBJECT_NAME_INFORMATION $ �# _RTL_DYNAMIC_HASH_TABLE_ENTRY - ~# EVENT_TRACE_PROFILE_REMOVE_INFORMATION 0 COPYDATASTRUCT z# MUICCHEADER 9 v# _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION ) l# PPERFINFO_DRIVER_MAJORFUNCTION_RET j# WMI_TRACE_PACKET d# PRTL_MODULE_BASIC_INFO a# RPC_SECURITY_QOS_V3_W Z# _WMI_BUFFER_HEADER p PSTR " R# TEB_ACTIVE_FRAME_CONTEXT_EX L# PPROCESS_HEAP_INFORMATION z" ETW_PROVIDER_TRAIT_TYPE $ J# PFILTER_BOOT_OPTION_OPERATION 4 � _PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY $ F# LPSERVICE_PREFERRED_NODE_INFO PMOFHANDLE C# SE_SECURITY_DESCRIPTOR / ?# JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 ( ;# ETW_TP_EVENT_TIMER_CANCEL_NTTIMER 8# PMONITOR_DISPLAY_STATE $ 3# _SYSTEM_KERNEL_DEBUGGER_FLAGS 2 /# TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION )# NPCWPRETSTRUCT
CPINFO &# _MEMORY_RANGE_ENTRY ## PBUS_DATA_TYPE # TOKEN_ORIGIN * � _DIRECTORY_NOTIFY_INFORMATION_CLASS # CSV_QUERY_MDS_PATH_V2 # WMI_IMAGEID_INFORMATION64 # EMRSETMITERLIMIT # EMREXTSELECTCLIPRGN # LPNUMBERFMT - _ EVENT_TRACE_PROFILE_CONFIG_INFORMATION # PPOWER_SESSION_TIMEOUTS # # HEAP_AFFINITY_MANAGER_ENABLE �" PLOGFONTW �" EVENTMSG �" ETW_OBJECT_TYPE_EVENT �" PKEY_FULL_INFORMATION �" _PROCESS_LEAP_SECOND_INFO ! �" _WMI_IMAGEID_INFORMATION32 % > PROCESSOR_PROFILE_CONTROL_AREA 2 { MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION ( �" MEMORY_PARTITION_NODE_INFORMATION $ �" PPERFINFO_CC_WORKITEM_ENQUEUE ' �" PERFINFO_CC_EXTRA_WB_THREAD_INFO �" PPERFINFO_CCSWAP_BUFFER �" PISECURITY_DESCRIPTOR �" POINT �" PENUMTEXTMETRICW �" PPROCESS_WAKE_INFORMATION WMI_PNP_RECORD_V5 " �" PFILE_ALIGNMENT_INFORMATION �" LPACCESSTIMEOUT ( �" _ETW_TIMER_EXPIRATION_START_EVENT � _NT_PRODUCT_TYPE " �" FILE_ALLOCATION_INFORMATION �" PTP_TASK_EXECUTE_CALLBACK ! � _FILE_INFO_BY_HANDLE_CLASS �" PREGISTERWORD I PLIST_ENTRY �" PPOWER_STATE_HANDLER �" _MOUSE_EVENT_RECORD , �" PIMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY s int8x16_t " �" PERFINFO_SYSCALL_ENTER_DATA �" _JOB_SET_ARRAY & �" PJOBOBJECT_IO_ATTRIBUTION_STATS w" _RTL_PERTHREAD_CURDIR q" DISPLAY_DEVICE m" CS_TYPE_TO_NETCS_ROUTINE * j" PJOBOBJECT_INTERFERENCE_INFORMATION f" PEMRLINETO d" NPPAINTSTRUCT c" LPICONMETRICS _" PQUERY_FILE_LAYOUT_OUTPUT ]" PTIMER_APC_ROUTINE Y" HEAP_INFORMATION_CLASS T" HSAVEDUILANGUAGES N" EXFAT_STATISTICS _BOOT_ENTROPY_SOURCE_ID � STARTUPINFO J" _MIDL_INTERCEPTION_INFO D" PFILE_STREAM_INFORMATION , A" SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS <" PCM_VIDEO_DEVICE_DATA 9" _RTL_SPARSE_BITMAP_RANGE 4" NLSVERSIONINFOEX , 0" WMI_JOB_SEND_NOTIFICATION_INFORMATION � REPARSE_DATA_BUFFER *" LPDOCINFOA ! '" SYSTEM_MANDATORY_LABEL_ACE !" PPOWER_STATE ! C POWER_PLATFORM_INFORMATION " PPPM_IDLE_ACCOUNTING " LPSERVICE_DESCRIPTIONW " � TRANSACTION_ENLISTMENT_PAIR " _OBJECT_ATTRIBUTES32 % " _SYSTEM_FIRMWARE_TABLE_HANDLER " PEMRINVERTRGN " EMRPLGBLT * �! _JOBOBJECT_INTERFERENCE_INFORMATION �! PLDR_DDAG_NODE ) �! RTL_ACTIVATION_CONTEXT_STACK_FRAME & �! PFILE_LINKS_FULL_ID_INFORMATION � _RTL_AVL_TREE * EMRSETVIEWPORTEXTEX - �! RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER $ �! FILE_FS_DATA_COPY_INFORMATION �! OFFER_PRIORITY �! _ICONINFOEXA �! MM_ETW_PAGE_EXTRA_INFO * �! PCUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG , �! JOBOBJECT_END_OF_JOB_TIME_INFORMATION C �! RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED �! EMRSETMETARGN JIT_DEBUG_INFO64 �! GCP_RESULTSA �! LPHIGHCONTRAST �! uint32x4x3_t �! EMRSETBRUSHORGEX �! LPHANDLER_FUNCTION . �! _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID �! _SID_AND_ATTRIBUTES �! PCLIENT_ID64 �! IMEMENUITEMINFOW �! RPC_ANSI_STRING �! PWMI_JOB_INFORMATION �! TRANSACTION_STATE 4 �! PSYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION z! PRPC_CLIENT_INTERFACE w! PERFINFO_FILE_DIRENUM s! _BOOT_ENTRY ! E FILE_FS_DEVICE_INFORMATION o! OSVERSIONINFOA . k! JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 c! LPSTARTUPINFOEXW a! LPMULTIKEYHELP ! _! PERFINFO_CCSWAP_IDLE_SHORT ' Y! _ALPC_MESSAGE_HANDLE_INFORMATION P! LPCMENUINFO # J! LPBY_HANDLE_FILE_INFORMATION G! _PROCESS_ACTIVITY_TYPE E! LPTEXTMETRIC C! KLDR_DATA_TABLE_ENTRY ' 6! _SYSTEM_HOT_PATCH_REGISTRY_VALUE - 2! TOUCH_HIT_TESTING_PROXIMITY_EVALUATION ( ,! PLDR_DLL_LOADED_NOTIFICATION_DATA ( *! SERVICE_REQUIRED_PRIVILEGES_INFOW # &! _ETW_DFSS_START_NEW_INTERVAL � KCONTINUE_TYPE ! _SYSTEM_POOL_INFORMATION + ! PLUGPLAY_CONTROL_INTERFACE_LIST_DATA & ! _PROCESS_POWER_THROTTLING_STATE ! PPERFINFO_CCSWAP ( ! WIM_PROVIDER_UPDATE_OVERLAY_INPUT ` _MUTANT_BASIC_INFORMATION
! PEBS_DS_SAVE_AREA64 . ! _MEMORY_PARTITION_ATTRIBUTE_INFORMATION - � PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA 4 � ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA � _PROCESS_WAKE_INFORMATION $ � PDELETE_STORAGE_RESERVE_INPUT 0 � EVENT_TRACE_LBR_CONFIGURATION_INFORMATION � PSYSTEM_POWER_POLICY � LPSERVICE_FAILURE_ACTIONS & � _FILE_PIPE_DELETE_SYMLINK_INPUT � EMRGDICOMMENT � UTF8_STRING $ � _REQUEST_OPLOCK_OUTPUT_BUFFER � tagMINIMIZEDMETRICS � GESTURENOTIFYSTRUCT � LPCGUID 7 � IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION � PSYSTEM_AUDIT_ACE # o FILE_ID_EXTD_DIR_INFORMATION � LPSERVICE_SID_INFO � PWMI_WAIT_SINGLE # � PERFINFO_MEM_RESET_INFO_TYPE � _CLIENT_ID64 , � ALPC_PORT_COMPLETION_LIST_INFORMATION # � _TXFS_GET_TRANSACTED_VERSION � PSYSTEM_POOLTAG � COMPUTER_NAME_FORMAT � RPC_HTTP_REDIRECTOR_STAGE " ACCESS_MASK � PRKCRM_MARSHAL_HEADER � PCZZTSTR / � _PROCESS_STACK_ALLOCATION_INFORMATION_EX � _REPAIR_COPIES_INPUT " � _UNICODE_PREFIX_TABLE_ENTRY ' � RTL_IMAGE_MITIGATION_ASLR_POLICY � LPSTARTUPINFO / � SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE - � _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA
{ HBRUSH x _RPC_SECURITY_QOS_V2_W # l PQUERY_STORAGE_RESERVE_INPUT � PSINJECTDATA g LPBITMAPCOREHEADER d tagCLIENTCREATESTRUCT ^ PMUTANT_BASIC_INFORMATION # [ SYSTEM_REF_TRACE_INFORMATION W _SCONTEXT_QUEUE M _TIMER_TYPE ! K RPC_HTTP_PROXY_FREE_STRING + E PETW_TP_EVENT_TIMER_EXPIRATION_BEGIN B FILE_MODE_INFORMATION & ; PPROCESSOR_PROFILE_CONTROL_AREA 4 PTIME_ZONE_INFORMATION * SYMBOLIC_LINK_INFO_CLASS * ' PROCESS_HANDLE_SNAPSHOT_INFORMATION ' PETW_COVERAGE_SAMPLER_QUERY_INFO $ REFS_SMR_VOLUME_GC_PARAMETERS - SYSTEM_SPECULATION_CONTROL_INFORMATION $ � IO_RESOURCE_REQUIREMENTS_LIST � RTL_TREE_COMPARE_FUNCTION % � _IMAGE_DYNAMIC_RELOCATION32_V2 TRANSACTION_LIST_ENTRY ' RTL_STACK_TRACE_DATABASE_CONTROL � PFILE_REGION_INFO � KEY_TRUST_INFORMATION � SERVICE_TRIGGER_INFO � PLUNICODE_STRING � PROCESSOR_IDLESTATE_INFO " � _SYSTEM_VA_LIST_INFORMATION � TOKEN_AUDIT_POLICY � PSYSTEM_VA_TYPE ; � PSYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION � PEMRPOLYPOLYLINE % � PERFINFO_PPM_IDLE_EXIT_LATENCY " � ALPC_PORT_INFORMATION_CLASS � tagCOLORCORRECTPALETTE � HANDLETABLE & � PPERFINFO_INTERRUPT_INFORMATION 1 � _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION % � SYSTEM_SYSTEM_DISK_INFORMATION & � _DEDUP_CHUNK_INFORMATION_HASH32 SHORT * � SYSTEM_BOOT_ENVIRONMENT_INFORMATION 3 { _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION � PCRM_PROTOCOL_ID v PTRACE_GUID_INFO " u PACCESS_DENIED_CALLBACK_ACE s MOUSEMOVEPOINT + o PERFINFO_CLOCK_INTERRUPT_INFORMATION ] PPORT_MESSAGE � _TRACE_PROFILE_INTERVAL 3 Z _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT W PTP_TASK
V PXFORM . T _MEMORY_PARTITION_NODE_PAGE_INFORMATION R _RTL_TICK_LOCK * N PPERFINFO_FILENAME_SAME_INFORMATION , F PTOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 ' C _JOBOBJECT_ENERGY_TRACKING_STATE @ EXPR_EVAL � RTL_BALANCED_NODE # > SYSTEM_PROCESSOR_INFORMATION : ETW_NOTIFICATION_TYPE 4 BITMAPINFO . _SYSTEM_AUDIT_ACE # ( PPROCESS_BASIC_INFORMATION64 & _FILE_LINKS_INFORMATION 8 ! PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY _MIDL_STUB_DESC � ETW_WNF_EVENT_UNSUBSCRIBE � PCACTCTX � _TEB_ACTIVE_FRAME # � SYSTEM_NET_RATE_CONTROL_TYPE � PRTL_HEAP_ENTRY � PWIN32_FIND_DATA $ � _ETW_HEAP_EVENT_RUNDOWN_RANGE ' � PERFINFO_DPC_ENQUEUE_INFORMATION # � PSERVERSILO_INIT_INFORMATION - � _SYSTEM_PROCESSOR_FEATURES_INFORMATION ! HEAP_EVENT_COMMIT_DECOMMIT % SECURITY_CONTEXT_TRACKING_MODE $ � PIMAGE_RUNTIME_FUNCTION_ENTRY � KCONTINUE_ARGUMENT LOCALHANDLE � LPAXISINFOA
� PINPUT � PMULTIKEYHELP � PIMAGE_THUNK_DATA64 v LDR_DDAG_STATE � ENERGY_STATE_DURATION % � PMEMORY_COMBINE_INFORMATION_EX & b PCM_PARTIAL_RESOURCE_DESCRIPTOR ] PTEXTMETRICA \ PEVENT_TRACE_HEADER Z ALPC_WORK_ON_BEHALF_ATTR $ O PRTL_WORK_ON_BEHALF_TICKET_EX L _NDR_EXPR_DESC ) D _ETW_COVERAGE_SAMPLER_OPTION_FLAGS / D _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT @ tagWNODE_ALL_DATA � RPC_CLIENT_FREE 1 : _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION . 4 PPLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA 0 RPC_IMPORT_CONTEXT_P t PINT_PTR * _FILE_FS_SIZE_INFORMATION ! & REQUEST_RAW_ENCRYPTED_DATA # LPUNIVERSAL_NAME_INFOA ) PTRACE_PERIODIC_CAPTURE_STATE_INFO PTRANSACTION_LIST_ENTRY � tagWNODE_SINGLE_INSTANCE PHEAP_SUBSEGMENT_INIT LPCVOID #
PTRACE_ENABLE_FLAG_EXTENSION % RTL_PROCESS_MODULE_INFORMATION " � _UMS_SCHEDULER_STARTUP_INFO ;
_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION $ _TXFS_TRANSACTION_ACTIVE_INFO - _PLUGPLAY_CONTROL_TARGET_RELATION_DATA PLONG64 $ � WIM_PROVIDER_INTEGRITY_STATUS 4 � _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT � LBLOB � _FILEMUIINFO ' � PROCESS_TELEMETRY_ID_INFORMATION # � FILE_STORAGE_TIER_MEDIA_TYPE ! � PRTL_IMAGE_POLICY_METADATA I PCUCHAR � RAWINPUTDEVICELIST PCSHORT � _VIRTUAL_STORAGE_TYPE � _SD_GLOBAL_CHANGE_INPUT
� VALENT � PETW_OBJECT_HANDLE_EVENT � _PSINJECTDATA � _TOKEN_AUDIT_POLICY � _WIN32_STREAM_ID � _PERFINFO_DPC_INFORMATION ' � PFILE_CASE_SENSITIVE_INFORMATION � HARDERROR_RESPONSE_OPTION � IRQ_GROUP_POLICY & � PPLUGPLAY_CONTROL_PROPERTY_DATA � EMRSELECTCOLORSPACE � PIMAGE_COR20_HEADER � MEMORYSTATUS � PCLUTF8_STRING � PCSV_NAMESPACE_INFO � _KHETERO_CPU_POLICY 7 � _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY � _numberfmtW % � PPROCESS_HANDLE_TRACING_ENABLE ~ PCSV_CONTROL_PARAM 7 y PSYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION v tagAXESLISTW HPCON q LDR_SECTION_INFO $ k TRANSACTION_BASIC_INFORMATION g SEC_WINNT_AUTH_IDENTITY_A � ANSI_STRING64 a PFILE_STAT_LX_INFORMATION ^ _TRACE_ENABLE_CONTEXT V PSID_AND_ATTRIBUTES_HASH T SPHANDLE O LPENUMTEXTMETRIC I_RPC_HANDLE � __n64x3 " J PETW_FINALIZE_KTIMER2_EVENT ! G _PROCESS_BASIC_INFORMATION " A PPOWER_PLATFORM_INFORMATION ? PCSCHAR < _FILE_ACCESS_INFORMATION 0 8 _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION # 3 _KEY_WOW64_FLAGS_INFORMATION / _IMAGE_POLICY_ID ~ EMRPOLYPOLYGON16 * ) PSYSTEM_SESSION_BIGPOOL_INFORMATION $ _nlsversioninfo p LPTCH ! PNOTIFY_USER_POWER_SETTING ! RTL_HEAP_MEMORY_LIMIT_DATA � _EVENT_INFO_CLASS # _PERFINFO_PO_SESSION_CALLOUT PXSAVE_AREA " PHEAP_EVENT_COMMIT_DECOMMIT 2 _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY , DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO � PENUMLOGFONTEXDVA � PCEVENT_RECORD # � PFILE_MAKE_COMPATIBLE_BUFFER � TRANSACTION_NOTIFICATION � FILE_COMPRESSION_INFO 0 � SYSTEM_FEATURE_CONFIGURATION_UPDATE_ENTRY � _FILE_BASIC_INFO " � _WMI_JOB_SET_QUERY_NET_RATE � SYSTEM_TPM_INFORMATION � tagPANOSE ! � PIMAGE_ROM_OPTIONAL_HEADER � IRQ_PRIORITY � PRKCRM_PROTOCOL_BLOB � _FXSAVE_FORMAT_WX86 � PTRACE_PROFILE_INTERVAL ) � VIRTUALIZATION_INSTANCE_INFO_INPUT � PREPARSE_DATA_BUFFER � tagRID_DEVICE_INFO_HID � ACL_SIZE_INFORMATION ( t RTL_DYNAMIC_HASH_TABLE_ENUMERATOR � REMOTE_PORT_VIEW " � REFS_SMR_VOLUME_INFO_OUTPUT } _NETWORK_APP_INSTANCE_EA ! RTL_ATOM - v RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY p PWMI_THREAD_INFORMATION m PLEX_READ_DATA_REQUEST STREAM_INFORMATION_ENTRY e PSYSTEM_BIGPOOL_ENTRY b CM_MCA_POS_DATA / _ PACTIVATION_CONTEXT_DETAILED_INFORMATION [ PHIBERFILE_BUCKET . X SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX Q FILE_STANDARD_INFO N ICMENUMPROCW RPC_CSTR $ J _SYSTEM_FILECACHE_INFORMATION ; MSGBOXPARAMSA C system_handle_t " = PRTL_HEAP_MEMORY_LIMIT_INFO 7 PRTL_RESOURCE 4 EXTLOGPEN32 0 tagSERIALKEYSW ' , IMAGE_LOAD_CONFIG_CODE_INTEGRITY , ( JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 PKLOCK_QUEUE_HANDLE # FILTER_BOOT_OPTION_OPERATION ) PPERFINFO_DRIVER_COMPLETIONROUTINE PFILE_LINK_INFORMATION � PNP_VETO_TYPE LPENUMLOGFONTW LPCPINFO HEAP_SUBSEGMENT_FREE ACE_HEADER * � PDIRECTORY_NOTIFY_INFORMATION_CLASS � TXFS_MODIFY_RM � PSYSDBG_CONTROL_SPACE , � _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA ' � RTL_QUERY_DEBUG_INFORMATION_INFO $ � _FILE_TYPE_NOTIFICATION_INPUT + � _VIRTUALIZATION_INSTANCE_INFO_OUTPUT � PTRACE_ENABLE_INFO & � _FILE_LINKS_FULL_ID_INFORMATION � _PERFINFO_CCSWAP � PWMI_SPINLOCK � FUNCTION_TABLE_TYPE � PTITLEBARINFOEX � PFILE_STORAGE_TIER_CLASS 0 � PRTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY � RTL_HASH_TABLE � LPPOINTS � HOOKPROC ' � PEVENT_HEADER_EXTENDED_DATA_ITEM � IMAGE_COR20_HEADER $ � I_RpcProxyUpdatePerfCounterFn & � SYSTEM_SHADOW_STACK_INFORMATION � PRTL_RESOURCE_DEBUG32 � LPDEVMODE ' � __PUBLIC_OBJECT_TYPE_INFORMATION x PWIN32_FIND_DATAW & u THREAD_LAST_SYSCALL_INFORMATION ' p _RTL_FEATURE_CONFIGURATION_TABLE $ h PFILE_PIPE_REMOTE_INFORMATION ! e RTL_CRITICAL_SECTION_DEBUG ] PFILE_ID_INFO � PEMRSETROP2 + U PFILE_STORAGE_RESERVE_ID_INFORMATION R RTL_TICK_LOCK L COMMTIMEOUTS " H _WNF_STATE_NAME_INFORMATION C PFILE_SEGMENT_ELEMENT ! @ _RTL_RESOURCE_POLICY_FLAGS $ = _PS_CPU_QUOTA_SET_INFORMATION 7 PMFT_ENUM_DATA_V1 6 � MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION 4 RTL_PROTECTED_ACCESS . PCOPYDATASTRUCT , PPROCESS_EXTENDED_BASIC_INFORMATION64 ( PRTL_FEATURE_VARIANT_PAYLOAD_KIND PRAWINPUT TOGGLEKEYS , JOBOBJECT_LIMIT_VIOLATION_INFORMATION $ INVERTED_FUNCTION_TABLE_ENTRY � ICONMETRICS � _EISA_PORT_DESCRIPTOR ' � _RTL_STACK_TRACE_DATABASE_CREATE t intptr_t ! � PSYSTEM_DEVICE_INFORMATION # � PHOT_PATCH_INFORMATION_CLASS
� _FIXED � PLAST_EXCEPTION_LOG � CIEXYZTRIPLE � PSYSTEM_POWER_INFORMATION � LPCMENUITEMINFOA ! � PLDR_DLL_NOTIFICATION_DATA ] PSINGLE_LIST_ENTRY � PSD_ENUM_SDS_INPUT # � PPERFINFO_CC_LAZY_WRITE_SCAN � KSPIN_LOCK_QUEUE � WOW64_CONTEXT � tagAXISINFOW $ _FILTER_BOOT_OPTION_OPERATION � _MEMORYSTATUS � float32x2x3_t
� _FIBER � RASTERIZER_STATUS ! � _FILE_QUERY_SPARING_BUFFER � PSHUFFLE_FILE_DATA � HANDLER_FUNCTION � COMPARTMENT_ID | _TOKEN_USER OSVERSIONINFOEX v PETW_KQUEUE_DEQUEUE_EVENT s float32x4_t d _TOKEN_GROUPS / _ _EVENT_TRACE_PROFILE_COUNTER_INFORMATION & X PERFINFO_SAMPLED_PROFILE_CONFIG 4 RTL_FEATURE_CONFIGURATION_CHANGE_REGISTRATION S DISK_SPACE_INFORMATION & O _LOGICAL_PROCESSOR_RELATIONSHIP 4 G PPERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION ( D ETW_COVERAGE_SAMPLER_OPTION_FLAGS % 2 PETW_CREATEDELETE_OBJECT_EVENT & / ETW_SESSION_NOTIFICATION_PACKET ( ' _FILE_FS_VOLUME_FLAGS_INFORMATION $ LPHANDLER_FUNCTION_EX SECURITY_ATTRIBUTES POINTER_FEEDBACK_MODE EVENTSECURITYOPERATION " PPERFINFO_PROCESS_PERFCTR64 & _RTL_PROCESS_MODULE_INFORMATION *
PRTL_FEATURE_CONFIGURATION_PRIORITY t INT_PTR . PSYSTEM_CODEINTEGRITYPOLICY_INFORMATION � PPROCESS_DISK_COUNTERS � _TRACE_GUID_INFO $ � _PERFINFO_MEM_RESET_INFO_TYPE 4 _SERVICE_PRESHUTDOWN_INFO � LPHIGHCONTRASTW � _EFI_DRIVER_ENTRY_LIST % � LPENUM_SERVICE_STATUS_PROCESSA � SE_TOKEN_USER / � _PROCESS_MITIGATION_CHILD_PROCESS_POLICY � _RTL_BARRIER � SERVICE_NOTIFY_2W � WMI_PNP_RECORD_V3 � PLOGICAL_DISK_EXTENTS $ � PFILE_DISPOSITION_INFORMATION , � SYSTEM_ISOLATED_USER_MODE_INFORMATION ! � _SYSTEM_ALARM_CALLBACK_ACE � int32x2x3_t � EVENT_INSTANCE_INFO K LIST_ENTRY � THREAD_UMS_INFORMATION � THREAD_INFORMATION_CLASS � PCHAR_INFO ~ PWMI_PAGE_FAULT ' { _CI_LOG_SCHEDULER_SLEEP_RESPONSE u PFILE_GET_EA_INFORMATION o CLIENT_ID % � RTL_RETPOLINE_RELOCATION_INDEX l _SERVICE_FAILURE_ACTIONSA d PWMI_POWER_RECORD " a _ALPC_WORK_ON_BEHALF_TICKET � EMRBITBLT [ LPREMOTE_NAME_INFOW U PALPC_PORT_ATTRIBUTES ! R FILE_GET_QUOTA_INFORMATION HALF_PTR � NT_PRODUCT_TYPE ! � _MEMORY_REGION_INFORMATION K PHEAP_REGION_INFORMATION D PAXESLIST A PERFINFO_PO_PRESLEEP p PUZZTSTR ; PRAWINPUTDEVICE 8 CURRENCYFMT 5 PNT_TIB . PRPC_MESSAGE , RPC_EP_INQ_HANDLE } RPC_UNICODE_STRING " * _TXFS_SAVEPOINT_INFORMATION $ PFILE_DISPOSITION_INFO_EX INPUT ! ACCESS_DENIED_CALLBACK_ACE _COVERAGE_MODULES PIMAGE_MITIGATION_POLICY IMAGE_ARCHITECTURE_ENTRY PSTREAM_INFORMATION_ENTRY � tagDEBUGHOOKINFO - _PS_PKG_CLAIM 3 � PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY " PTP_MILLISECONDS ( � PHEAP_EVENT_SUBSEGMENT_ALLOC_FREE % � ETW_THREAD_EVENT_SUBPROCESSTAG " � FILE_MAKE_COMPATIBLE_BUFFER � PCACHE_RELATIONSHIP = � ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT � LPDELETEITEMSTRUCT q EVENTLOG_HANDLE_W � PSILO_USER_SHARED_DATA 7 � PMEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION � tagACTCTXA � PRPC_RUNDOWN & � _JOURNAL_RENAME_KEY_INFORMATION � tagGLYPHSET 1 QUERY_SERVICE_CONFIG # PUINT64 � DPI_AWARENESS_CONTEXT__ � SERVICE_TABLE_ENTRYW
PUCHAR � MARK_HANDLE_INFO � _CM_KEYBOARD_DEVICE_DATA � DEVMODE � CWPSTRUCT * � EVENT_TRACE_SPINLOCK_INFORMATION_V1 � LPSTARTUPINFOW � SOUNDSENTRY ( � RTL_PROCESS_BACKTRACE_INFORMATION . v PSECURE_SPECULATION_CONTROL_INFORMATION q LPREGISTERWORDW \ _RTL_UMS_SCHEDULER_REASON l LPABC i VERIFIER_MODE f USN_RECORD_EXTENT \ PSTREAM_EXTENT_ENTRY Y _EXCEPTION_LOG_TYPE * T PPERFINFO_BOOT_PREFETCH_INFORMATION Q _WAIT_TYPE ( O PJOBOBJECT_RATE_CONTROL_TOLERANCE # J _SEMAPHORE_INFORMATION_CLASS G WNF_DATA_SCOPE E CALINFO_ENUMPROCA 1 B PJOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL PPOOLINDEX
PKIRQL * @ FILE_SYSTEM_RECOGNITION_INFORMATION / ; IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA l _DUPLICATE_EXTENTS_DATA * ( _SYSTEM_PLATFORM_BINARY_INFORMATION / LPACCEL � PCUTSTR " , REQUEST_OPLOCK_INPUT_BUFFER � TRACE_QUERY_INFO_CLASS % GROUP_AFFINITY _XSAVE_AREA FILE_ID_128 JIT_DEBUG_INFO32 � EMRSELECTCLIPPATH EMRPOLYBEZIER
PRAWMOUSE PWMI_PNP_RECORD ) _RTL_FEATURE_ENABLED_STATE_OPTIONS + � PPLUGPLAY_CONTROL_USER_RESPONSE_DATA U CURRENCYFMTW � PDIBSECTION Q _EVENT_FILTER_HEADER & � _MEMORY_WORKING_SET_INFORMATION � _numberfmtA ! � PSYSTEM_AUDIT_CALLBACK_ACE � _FILE_EA_INFORMATION 5 � PSYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION $ � PTXFS_LIST_TRANSACTIONS_ENTRY � PPROCESSOR_IDLE_TIMES � PPARSE_MESSAGE_CONTEXT � PEMRBITBLT ! � _HEAP_SUBSEGMENT_ACTIVATED � RTL_QUERY_REGISTRY_TABLE � _SD_ENUM_SDS_INPUT 7 � PRTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY / � _ACTIVATION_CONTEXT_DETAILED_INFORMATION � PANSI_STRING64 � WGLSWAP � NPCWPSTRUCT � tagCURSORSHAPE � _CM_INT13_DRIVE_PARAMETER � FLS_DATA � SE_VALIDATE_MAPPING_TYPE � _TP_TASK y PEMRPOLYPOLYGON16 p FILE_REMOTE_PROTOCOL_INFO ] PMSGBOXPARAMSA * W PLDR_DLL_UNLOADED_NOTIFICATION_DATA ' T _APPLICATIONLAUNCH_SETTING_VALUE P IMEMENUITEMINFO A RPC_CLIENT_ID : LATENCY_TIME 4 SERVICE_PRESHUTDOWN_INFO . PINTERFACE_REFERENCE ( _COMMPROP $ ENUMLOGFONTEXDV uint64x1x2_t , PROCESS_MITIGATION_POLICY_INFORMATION � PTRIVERTEX � WNODE_SINGLE_INSTANCE & � PFILE_REPARSE_POINT_INFORMATION � _FLS_DATA # � REQUEST_OPLOCK_OUTPUT_BUFFER � tagPAINTSTRUCT & � PERFINFO_PPM_THERMAL_CONSTRAINT � MUTANT_OWNER_INFORMATION - � PMEMORY_PARTITION_TRANSFER_INFORMATION � WMI_FILE_IO * � PSYSTEM_PHYSICAL_MEMORY_INFORMATION & � PRTL_RETPOLINE_RELOCATION_INDEX � REDIRECTION_DESCRIPTOR _ uint32x4x2_t � PEMRSETARCDIRECTION $ � GET_RUNTIME_FUNCTION_CALLBACK " � _EVENT_INSTANCE_GUID_HEADER $ � PPERFINFO_PPM_IDLE_STATE_EXIT � TRACE_ENABLE_CONTEXT_EX � PPPM_WMI_IDLE_STATES � PPROCESSOR_GROUP_INFO # � _TRANSACTION_ENLISTMENT_PAIR 8 � PIMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION ' � PRTLP_UNHANDLED_EXCEPTION_FILTER w PWIN32_FIND_DATAA # t _IMAGE_ARCHIVE_MEMBER_HEADER j PDUPLICATE_EXTENTS_DATA � RTL_PATH_TYPE a PRTL_TRACE_ENUMERATE ^ EDIT_CONTROL_FEATURE [ LOAD_ASDATA_TABLE U PCM_ROM_BLOCK " HELPPOLY _ uint8x16x2_t ! I FILE_FS_VOLUME_INFORMATION " C PFILE_FS_DEVICE_INFORMATION @ _ETW_LBR_ENTRY < FP_IEEE_COMPARE_RESULT - 6 PRTL_FEATURE_USAGE_SUBSCRIPTION_TARGET 4 SYSTEM_PIXEL_FORMAT G PEBS_DS_SAVE_AREA32 ! 1 _ETW_DISABLE_KTIMER2_EVENT - PS_PKG_CLAIM p CHAR ! " IMAGE_DELAYLOAD_DESCRIPTOR ( _RTL_STACK_TRACE_DATABASE_CONTROL tagTEXTMETRICW _EVENT_TRACE_HEADER CM_PERF_COUNTERS % PROCESS_MEMORY_ALLOCATION_MODE � _ENUM_SERVICE_STATUSW � EVENT_TRACE_PROPERTIES_V2 $ � SYSTEM_RESOURCE_ATTRIBUTE_ACE � LPBITMAPINFOHEADER % � _IMAGE_DYNAMIC_RELOCATION64_V2 � LPOVERLAPPED_ENTRY � SYSGEOTYPE % � _PROCESS_DEVICEMAP_INFORMATION � tagEMRPOLYDRAW � TOKEN_MANDATORY_POLICY � _POWER_IDLE_RESILIENCY � PWNODE_EVENT_ITEM � PAPP_MEMORY_INFORMATION � PRESUME_PERFORMANCE � PTRACE_LOGFILE_HEADER64 ( � PEVENT_TRACE_SPINLOCK_INFORMATION " � PPROCESS_HANDLE_INFORMATION ) � PFILE_ID_EXTD_BOTH_DIR_INFORMATION � _WMI_PNP_RECORD_V3 " } PUMS_SCHEDULER_STARTUP_INFO z tagKERNINGPAIR % u _KAFFINITY_ENUMERATION_CONTEXT $ l PFILE_ID_EXTD_DIR_INFORMATION a PPOINTER_TYPE_INFO + ] _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W ' W PPERFINFO_FILEOBJECT_INFORMATION _ SINGLE_LIST_ENTRY T _FILE_STAT_INFORMATION $ P _ACTIVATION_CONTEXT_MSIX_INFO K tagXFORM D PPEBS_DS_SAVE_AREA32 " A KEY_VALUE_LAYER_INFORMATION ; MSGBOXPARAMS 1 _QUERY_SERVICE_CONFIGA - _PROCESSOR_CACHE_TYPE ( PEMRSETWINDOWEXTEX # LPCDLGTEMPLATEW ' PIMAGE_RESOURCE_DIRECTORY_STRING # PFILE_PIPE_LOCAL_INFORMATION 5 _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY 6 PRTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION ( SYSTEM_SECURITY_MODEL_INFORMATION � IO_RESOURCE_DESCRIPTOR " � PFILE_IO_PRIORITY_HINT_INFO p LPSTR � NPCANDIDATEFORM I_RPC_MUTEX � uint16x4x4_t ' � PLEAP_SECOND_DATA_REGISTRY_ENTRY " � _MEMORY_BASIC_INFORMATION64 $ � PGENERIC_BINDING_ROUTINE_PAIR ) � _PERFINFO_DRIVER_MAJORFUNCTION_RET � _STRING % � HEAP_REUSE_THRESHOLD_ACTIVATED � CALINFO_ENUMPROCEXW � SERVICE_STATUS_HANDLE " � ENUM_SERVICE_STATUS_PROCESS w PS_ATTRIBUTE_NUM & q _IMAGE_DYNAMIC_RELOCATION_TABLE l _OBJECT_INFORMATION_CLASS b LPENHMETAHEADER _ __n128x2 & Y _USER_MARSHAL_ROUTINE_QUADRUPLE E LPUNIVERSAL_NAME_INFO B PERFINFO_HV_HYPERCALL " TP_MILLISECONDS > WMI_UDP * 7 _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY , HSM_OPCODE & & PRTL_SPARSE_BITMAP_FREE_ROUTINE POUTLINETEXTMETRIC PPS_PROTECTION _FILESYSTEM_STATISTICS q PRTL_ATOM � PEMRSETPOLYFILLMODE _PERFINFO_VTL_CHANGE PSET_POWER_SETTING_VALUE OSVERSIONINFOEXA � PUZZWSTR � _SE_IMPERSONATION_STATE * � PSYSTEM_VERIFIER_TRIAGE_INFORMATION � tagMOUSEHOOKSTRUCTEX � _LDR_SERVICE_TAG_RECORD ? � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY � PMESSAGE_RESOURCE_BLOCK � MUISTRINGPOOL ) � PFILE_FS_METADATA_SIZE_INFORMATION q PZZWSTR ! � _FSCTL_OFFLOAD_WRITE_INPUT 7 � PRTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY 0 � PCACTIVATION_CONTEXT_DETAILED_INFORMATION � _IO_COUNTERS � SYSTEM_VERIFIER_ISSUE ! � RTL_PHYSICAL_MEMORY_POLICY � _UNIVERSAL_NAME_INFOW � MEMORY_REGION_INFORMATION " � PCOPYFILE2_PROGRESS_ROUTINE � PEMRSETMAPMODE ' ~ PFILE_FS_DRIVER_PATH_INFORMATION s WOW64_FUNCTION_CODE64 p _HEAP_SUBSEGMENT_ALLOC & b _RTL_UMS_SCHEDULER_STARTUP_INFO U _currencyfmtW Q EVENT_FILTER_HEADER L EFI_DRIVER_ENTRY , = PEVENT_TRACE_PROFILE_LIST_INFORMATION % : _JOBOBJECT_WAKE_INFORMATION_V1 5 5 RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION ) + PFILE_MEMORY_PARTITION_INFORMATION ) ( SYSTEM_PLATFORM_BINARY_INFORMATION + ! PPLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA MIDL_FORMAT_STRING q PUHALF_PTR 0 SYSTEM_FEATURE_USAGE_SUBSCRIPTION_DETAILS PRTL_AVL_NODE PWMI_JOB_ASSIGN_PROCESS PEISA_DMA_CONFIGURATION
" PDWORD � TRACE_INFO_CLASS � PMIDL_METHOD_PROPERTY # DWORDLONG � ALPC_TOKEN_ATTR 0 � SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION � PMEM_EXTENDED_PARAMETER � PS_CREATE_INFO ) � ASSEMBLY_FILE_DETAILED_INFORMATION � PERFINFO_IPI_SEND_DATA � ENCLAVE_CREATE_INFO_SGX � ENUMRESLANGPROCA ( � LPSERVICE_DELAYED_AUTO_START_INFO ' � IMAGE_ARM_RUNTIME_FUNCTION_ENTRY % � FILE_LINKS_FULL_ID_INFORMATION
LPLONG � _WIN32_MEMORY_RANGE_ENTRY LPMENUTEMPLATEW } ICONINFO
r HWND__ � ` � �ý3NP� ��eb�nM `I����<�F ) H�W����s~��\�����f�_��r"A� ��A% P �[�-%`4�����o2�>�'�q.qg�Gn��) t �YY�c*��}+�;hs�(s��f�i@��n��ܱ� � �O�3tk#�L-�1�
��M �H�sx?�� � M�d�Q�?����:��ޅǧ8�M�%�i_&� � )\��u��ݡ�_6 mV����*���[�1�l&�! `���[4dx���By%�Г��� z�&K�-�pW @ *s�4��bc�v�7���h\Sř�_s� �4�h� a �U��Q�u"��w�!� �fB"���`ru^���9 � ���{�$��N�� ��~p��o7��T�1*���. � �۠�Җ �{���� ���n"]�,$J�� � ;�]� ��)J��5م��s<`Γ|��� �G�/�m��hB-����-q�b}��Y�~Y $ ����̫��2r�WQ��K��TI�Up��/�z I ��ˎ�jy*ƱT1A��`��#^$L �
�Ӭ �c n �� ��/�5h��d�����,�]0�f& (� � �.r�� �A6
؇Sz�I��x{_K�<ކ�� � ~��$P �<�tv��AHE/��)�}�yS� S�O����SXn�� T�F����ZS�kk!m� 1 F?�Z#��.Wi�/0��=�� �9*W�-� W p�& ;Tt<�ѝ0捶�K߿#56�f� � ~ &��8�i_u& ��>�-Z%�f�>R69ϓ5�%� � )G�xS�l�F,�yV���6�}�����ָ@��j � n*�\T�uM�fk �<�t���L�ee�#a�� � ���^br�ee��� ���Nǐ����5�j�Ja G�*㥬2����M���}�b�R�̫�)�� 8 m����Wc�L����z0� ���ٶ�$< _ C���4�h��y��t:;K�͑\�Df��1 � � %:��qI0fI�J� �ͪ�� �< � �m�%:�|l�����h��D�m��-� �[ � �0:s�0pV�eҐ����lj� �6�Ȗ0 � � PH<��R�N�-Ulֵ��S�O�7g�n�䯲*�� N���NE���\�H3�K4��9�|f�U �Ӹ�r < ��a�;.+�!6�%ri� E�Q�p�u�G�g�.� _ ƨ��T ��� Ȓ� ���)n���y��aP`I � � OHa]R���s���&���\��:�yE� � ����8�����L�v���X m*����I/i�� � ��o�ۗ��.�F��F9�37 ���9�0 �x2� � ��%|�#o5a�0i�^�{�ơz[ l���HR 焙v GI��� ����P�
��W� C �~����.P�t�OWsP-"�x#N�:�&��� e ���r��Axa?E$��N�:���i�ٯa5.�P� � ���巪�� ���0v�};��?$�N�� a � 2��j�/@�R�?�_A��w�?���g�|��*c� � 0�i�dܾ�[~uz"*���B�:�ٝy�!($� �:��2K] �
j����e�
ʪ�3k�ӭ� + �M��wK�58�� �5h2�
/�U���R�:Jf U ��ꪄ<}��}�^|�{�)D��Xh�;�� � �����y�Q+���{"WÌ�R~̟���H���? � �D&<�@)�Z?��as� z�����A��? p� � �*ʡZ�4��D��?� e�A� fa��A��; � ��@\קĒ��$Ir�͢�)��|�u���� & ����#��ZF��-�wRϵI
5I�گ�Q�[d � S ��� [r�"��衷� �R ��ҹ�� �� y ����w�^��ȯ�
?���;��f���B(H� � 8����}ڥ��#�J�7�����"��Ѻ��^� � �[��=�
Tǜ�
]����>d��Wƫ��� � X�s.��Z���-�Ó��Q�iL0pIH� 0 ������Q�;�[$��ۅ=@��� �,�� W �����C��ґtE� �W3�ې�����o� y hV
>.r��h�#��Y��e� �y��f:h?� � B��V�v4�'���xܺky�3m�F�k z � ���� k|)�E@���B�#���b�V�<�2Ǡ3 � _H��i�%0�eTu ˔���3��E�+ �_� '
��dk߲#���Jq��x9���iF���>b/���� S
� �S:c٭ؙo߮ ���qO>�)o��Z� x
Ҥ��\��}7 �O~aD��0��-x���x�`<� �
���L� ���g�;�[������r���ؓ� ��� �
�F��B�6�0A��(|� C��F�7 ${E&Cv�wdGa�|}� oj�b�P�<�/ * D�n��q���9��a�_�G���H�E���-W��xZ M � �k�s���ӢC� �S�-z��=<� k�� � �Ѩ��@<���k�x+"7�><n��^� � ��'��,��@H4sS�k�!Ȫ:ݬ���"fE) '�N� 8t����A��d�W�G$���l�0"$�& . ��V��� Ť��ڃ "��?�f�R�s�[Y�%=� X �Jd��hy��R�*��Ll11�{SI� [ *��Q y �$�����+`�.?�ʿA��=Gݗ��'Lm � K�o��]�R2cj��
��K?C��9s�PH.] � ˬ6�MDmc�Y � �Z���D�˸J ��2� � �fس!�m���o�0�(P5i�W��x��3� Ob
@�J���ۊ�މ
��H��s��P��˓YH� A
��(��ڲ�M�<K:��R� �-�`�#��� n
T�@�
2��U��p�|��� ��k����[p*& �
�>� j�t�&~8^�B��J2�/Ru�~ �
3E �� �r`QQ���e��e����`z� i �
H�}ӰWU����f1O_�d ��Hf�
��N�nZ
E~/EX"�-�p-���i����`��.�z#�0� 2 �*f{�ً��n��2D�x?����s>���%�؞� ` y3�
6$��g涧i0����
�E�g$E��$ � p
y��f�9����|= 6���4 ��n`�RM� � *�7�C
TQ�� ?R����֪¸��FHc�� � X�Y
��m�kּg�L��~�g���x�5�
} ��da�nGۛ'�*���M���G�]����" 0 43� $���s`!?GQ61�D�� +�BNk�� b �- ��}n�5��L���:I����R��~(�y � ���O.@=4L�C�ي�m�;_�iM %q� � �
���mcJAt�qe�el��]�;�L�� � �t�T�`���Niu�$�I8FQ@e�}&f�S��E�� � N�Q� 4O&K�� +l;x�2�%��ݮ�pZ,� ��[��P���q�s���k̍�R���`�L % �D�rlBsm�DE�cQ����}W� �w��±� O �4Y����|��B�N��m#��*�sE��Bp�� u ����o� }�+4qt*Y lռ��́dq�X � ��������0TcIC4�U��m��sF'<�Z � �kE9OӨ��.I F��SY9G&��.��?堳( � S���M�"��S��U}h�g�c�q�c5w�k���8 ��܆�f؇��"xU. @����;2}X��}H 6 �A+��z'����k��mD�XL���t ] W|A
w�O�?�pU]~-�2�!�\O����5� � �*�����ou��M+K�Ŋ�;��qh� � ym�Z���y M����w�\lOU��3��)H� � �:B{m�n=�g���\c*�ӏ���Z" ��Y ��3)�J�$��{�.
w ~�/�l���M� - I�(��+�S�u��]?�z�9NP�3Q�MJ�B ^ j�v��b~�ۥ�)0M�/�띡e��� \� @Z � ?�9��X.��~�v�{ľ �J�_%�Z[�f��� � ����ɵ\|5 ��Z��b���Q 3 ���kb���B � /��J��5\�Z��_g4�4�%]�L�� ��3h� �˝u�׀߁\y�����x� �l���z3�t ' ����FAP�icû����;�|" B7�㙨^ �9 U E���ҷ ��;j�A!'���FR5��k �� � �p[F����ll�<��A�=��l}�K���R� � k�3 �G�� ��F2#�)� ER�O|��v\;� � 4V����7 �#r�`� ����n� Ƀ��F� � 3*�ָ䊀��DJ՝�� ��q/�=M�f�t� h҄� �3(/�e��f��`�z&�e$P��MD� < vOE~o0���ba�YJ+���y!���h� E��� _ Zڤ�~����̓s���� ��* ���k��)C� � ܇h���6
���d3�����:iW�jG^��t� � �J��W6���,�)J dɫ7�%eڭ�� � ��z!��<y5�1�aF�=)�;ђ�)Y bčW � 0T�]�yǥ˘�0�H��I��G(����� NM�1C����+e#����
�S�x������� F � F9�6K�v�/�|S��]t�RF�W2��I m ��7 ��������3] ��"F���:�,�U� � �y��� qtY��-l��|��+!so�$&� � O �2
�ש Tg���FF��ݼ�-�BS�� � f߹��R�|��ڕ����G/S�6�<��� ��.b��)���]Ý2�tW���Q�*� 1 �*�o�&�\b_-=�-���~���I V��� X �-h/� S��~����
a!�1k��j { |�8�>�$�;�@�[VP��sVf*wۭg � ��#YV^b%�}��/'p�O�Gʈ?��z��� � �A�T:�U 3�QZ� j-r76y�c~���� � �o ��#�V����|G%D�VH� ,= Q�� o�&���-�},��'�w��_�BIS;�§g
�7; 4 '���8�#�qf �N�g����X���P���� ` #^�S� q�9�s"-0#�H��'�N�"Y
�:i � �u�Մ��+�5�5�f �s�a{�:˨���Za � �.ו+�8W(M��6[���Z\��~���[� � �f�u�Jn\��zx�\�G����q*�V�,� ��`�\��7A���)����F)J� )��%��7 0 ���Ug�gWd�Dt�Y� ݚgxHt�$�Njw�a Q _��';�3*� v2��hz�x����B�H� w ��wkO'�l�5l�c���~|�� ��o�O� � e��i�45���̯Zo�� ���q�+�<�� � 5��`&N_� |�<�$���!�O]}��" � -�?bF��,U1�.Er;H�Ԡ`p I��4M [��t'Q��A���2��9\���h��fcY�!�?8 A ������A$խ�0� NG�%+�*�
!7�=b p HAbl� 5 ���,$pe� J����S� � �2 Ԃ�sr |R_e(�� V�����z,v�y� � �N�4�!Z�j��_ƒ���ﳝ3�Hf���e � �G�jp)X} ��L�{&<ĥ ��) oܽ� $ �n�cil�S��8�r%��V�l ��4��q��FT H ��*
Y,�}��Ƴ�������X���� p 4(���+C�h5J$t�J���h 8�ϽgX�� � �ܟ��-@��Q�ǩ��g:��y���G�J� � �5�-��MTo>���cߤ�K���� ͏��.~�! � ]�����W ��}Ν�� �lq����ϋN�Z
@ȍl2��X�1��}���e��C��>�ȢF)� . �k@�ʘM� p�?ho�7���Z��� �j�H� d B-<y�� ��9P/�M�#��_��<�� φ6R^ � � onecore\external\shared\inc\ip2string.h onecore\external\sdk\inc\crt\armintr.h onecore\internal\sdk\inc\ntelfapi.h onecore\external\shared\inc\rpcsal.h onecore\external\sdk\inc\minwin\synchapi.h onecore\external\sdk\inc\minwin\libloaderapi.h onecore\internal\sdk\inc\minwin\xstateapi.h onecore\external\ddk\inc\ntnls.h onecore\internal\sdk\inc\ntldr.h onecore\internal\sdk\inc\minwin\ntdef_p.h onecore\internal\sdk\inc\ntconfig.h onecore\internal\sdk\inc\ntrtlstringandbuffer.h onecore\external\shared\inc\rpc.h onecore\internal\sdk\inc\ntwow64.h onecore\internal\sdk\inc\ntwow64_x.h onecore\external\shared\inc\rpcdce.h onecore\external\sdk\inc\minwin\minappmodel.h onecore\external\sdk\inc\minwin\securityappcontainer.h onecore\external\sdk\inc\minwin\interlockedapi.h onecore\external\sdk\inc\minwin\utilapiset.h onecore\external\shared\inc\guiddef.h onecore\external\shared\inc\stralign.h onecore\external\sdk\inc\ntassert.h onecore\internal\sdk\inc\minwin\ntpnpapi.h onecore\external\shared\inc\cfg.h onecore\internal\sdk\inc\pebteb.h onecore\external\shared\inc\pshpack8.h onecore\external\shared\inc\ntstatus.h onecore\internal\sdk\inc\ntkeapi.h onecore\external\sdk\inc\winsvc.h onecore\external\sdk\inc\minwin\realtimeapiset.h onecore\internal\sdk\inc\ntseapi.h onecore\internal\sdk\inc\ntkeapi_x.h onecore\external\sdk\inc\mcx.h onecore\internal\sdk\inc\ntxcapi.h onecore\internal\sdk\inc\ntseapi_x.h onecore\external\sdk\inc\minwin\fibersapi.h onecore\internal\sdk\inc\ntxcapi_x.h onecore\external\sdk\inc\wingdi.h onecore\internal\sdk\inc\rtlhashdef.h onecore\external\sdk\inc\crt\string.h onecore\external\sdk\inc\winver.h onecore\external\sdk\inc\winnetwk.h onecore\external\sdk\inc\minwin\verrsrc.h onecore\external\sdk\inc\minwin\consoleapi.h onecore\internal\sdk\inc\minwin\ntwmi.h onecore\external\shared\inc\wnnc.h onecore\internal\sdk\inc\minwin\ntwmi_x.h onecore\external\sdk\inc\minwin\ioapiset.h onecore\internal\sdk\inc\ntrtlpath.h onecore\internal\sdk\inc\rtlfeatureconfigtypes.h onecore\external\sdk\inc\winnls.h onecore\external\sdk\inc\minwin\datetimeapi.h onecore\external\sdk\inc\minwin\enclaveapi.h onecore\external\sdk\inc\crt\stdarg.h onecore\external\shared\inc\minwin\ntdef.h onecore\external\sdk\inc\minwin\threadpoolapiset.h onecore\external\sdk\inc\crt\ctype.h onecore\external\sdk\inc\minwin\processthreadsapi.h onecore\external\shared\inc\rpcnterr.h onecore\internal\com\inc\ntrpcp.h onecore\external\sdk\inc\mincore\consoleapi2.h onecore\external\sdk\inc\minwin\namedpipeapi.h onecore\internal\sdk\inc\ntexapi.h onecore\external\sdk\inc\minwin\profileapi.h onecore\external\sdk\inc\minwin\handleapi.h onecore\internal\sdk\inc\ntexapi_x.h onecore\admin\wmi\events\advapi\objfre\arm\pch_hdr.src onecore\external\sdk\inc\fileapifromapp.h onecore\external\shared\inc\evntrace.h onecore\external\sdk\inc\minwin\fileapi.h onecore\internal\sdk\inc\nttpapi.h onecore\admin\wmi\events\advapi\objfre\arm\precomp.pch onecore\external\sdk\inc\minwin\apiquery2.h onecore\external\sdk\inc\minwin\heapapi.h onecore\external\shared\inc\pshpack1.h onecore\external\sdk\inc\minwin\ime_cmodes.h onecore\internal\sdk\inc\minwin\ntioapi.h onecore\external\sdk\inc\wmium.h onecore\external\shared\inc\devioctl.h onecore\external\shared\inc\wmistr.h onecore\external\sdk\inc\winbase.h onecore\external\sdk\inc\minwin\processenv.h onecore\internal\sdk\inc\minwin\ntioapi_x.h onecore\external\sdk\inc\minwin\minwinbase.h onecore\internal\sdk\inc\minwin\umstls.h onecore\internal\sdk\inc\ntiolog.h onecore\internal\sdk\inc\ntpsapi.h onecore\external\sdk\inc\minwin\rtlsupportapi.h onecore\internal\sdk\inc\ntpsapi_x.h onecore\external\sdk\inc\minwin\wow64apiset.h onecore\internal\sdk\inc\nturtl.h onecore\external\shared\inc\minwin\apiset.h onecore\internal\sdk\inc\minwin\ntregapi.h onecore\external\shared\inc\minwin\apisetcconv.h onecore\internal\sdk\inc\ntregapi_x.h onecore\external\sdk\inc\minwin\securitybaseapi.h onecore\external\sdk\inc\imm.h shared\inc\winapifamily.h onecore\external\shared\inc\poppack.h shared\inc\winpackagefamily.h onecore\internal\sdk\inc\warning.h onecore\external\sdk\inc\winuser.h onecore\external\shared\inc\kernelspecs.h onecore\internal\sdk\inc\suppress_x.h onecore\admin\wmi\events\advapi\precomp.h onecore\external\shared\inc\basetsd.h onecore\internal\sdk\inc\nt.h onecore\external\sdk\inc\crt\excpt.h onecore\internal\sdk\inc\volatile_accessors.h onecore\external\sdk\inc\crt\crtdefs.h onecore\external\shared\inc\dpfilter.h onecore\external\shared\inc\specstrings.h onecore\external\sdk\inc\mincore\namespaceapi.h onecore\external\shared\inc\sal.h onecore\external\shared\inc\concurrencysal.h onecore\external\shared\inc\specstrings_strict.h onecore\external\shared\inc\specstrings_undef.h onecore\external\sdk\inc\crt\intrin.h onecore\external\shared\inc\driverspecs.h onecore\internal\sdk\inc\ntmmapi.h onecore\external\sdk\inc\crt\setjmp.h onecore\external\shared\inc\sdv_driverspecs.h onecore\external\sdk\inc\minwin\errhandlingapi.h onecore\internal\sdk\inc\nttmapi.h onecore\internal\sdk\inc\ntmmapi_x.h onecore\external\sdk\inc\ntarm.h onecore\external\sdk\inc\crt\vadefs.h onecore\external\shared\inc\ktmtypes.h onecore\external\sdk\inc\ntarm_x.h onecore\external\sdk\inc\minwin\winreg.h onecore\external\ddk\inc\ntimage.h onecore\external\ddk\inc\ntpoapi.h onecore\external\shared\inc\pshpack4.h onecore\external\sdk\inc\reason.h onecore\external\sdk\inc\minwin\stringapiset.h onecore\external\shared\inc\pshpack2.h onecore\external\sdk\inc\wincon.h onecore\external\sdk\inc\wincontypes.h onecore\admin\wmi\events\idl\elf\objfre\arm\elf.h onecore\internal\sdk\inc\ntlpcapi.h onecore\external\shared\inc\rpcndr.h onecore\external\shared\inc\winerror.h onecore\internal\sdk\inc\ntobapi.h onecore\external\sdk\inc\rpcnsip.h onecore\internal\sdk\inc\ntobapi_x.h onecore\external\ddk\inc\mce.h onecore\external\sdk\inc\minwin\sysinfoapi.h onecore\internal\sdk\inc\rtlrbtree.h onecore\external\sdk\inc\minwin\memoryapi.h onecore\external\sdk\inc\minwin\timezoneapi.h onecore\external\sdk\inc\minwin\debugapi.h onecore\external\shared\inc\rpcdcep.h onecore\external\sdk\inc\rpcnsi.h onecore\external\sdk\inc\mincore\consoleapi3.h onecore\external\sdk\inc\nxarm.h onecore\external\sdk\inc\crt\stddef.h onecore\external\sdk\inc\mincore\systemtopologyapi.h onecore\external\sdk\inc\windows.h onecore\external\shared\inc\windef.h onecore\internal\sdk\inc\affinity.h onecore\external\sdk\inc\minwin\jobapi.h onecore\external\shared\inc\minwin\minwindef.h onecore\external\sdk\inc\crt\arm_neon.h onecore\external\sdk\inc\minwin\threadpoollegacyapiset.h onecore\admin\wmi\events\advapi\elfcommn.h onecore\internal\sdk\inc\minwin\ntetw.h onecore\external\sdk\inc\evntcons.h onecore\external\shared\inc\sdkddkver.h onecore\external\shared\inc\evntprov.h onecore\admin\wmi\events\idl\imports.h onecore\external\shared\inc\tvout.h onecore\external\sdk\inc\mincore\jobapi2.h onecore\internal\sdk\inc\ntrtl.h onecore\external\sdk\inc\mincore\processtopologyapi.h onecore\internal\sdk\inc\ntrtl_x.h � Lo^ � � \ \ / /
� ' %
} RtlNtPathSeperatorString � 1 /
} RtlAlternateDosPathSeperatorString � ) '
} RtlDosPathSeperatorsString
��
�
6 � LIST_ENTRY64 .?AULIST_ENTRY64@@ ��
� "
# Flink
# Blink 6 LIST_ENTRY64 .?AULIST_ENTRY64@@ ��2 onecore\external\shared\inc\minwin\ntdef.h � � 6 � LIST_ENTRY32 .?AULIST_ENTRY32@@ ��
� "
" Flink
" Blink 6 LIST_ENTRY32 .?AULIST_ENTRY32@@ �� �
p ��
� u u
�
q ��
� u u
� �" __n64 .?AT__n64@@
� # " � u " � ! " � " � " � t " � " � p " � @ " �
n64_u64 ��
n64_u32 ��
n64_u16 ��
n64_u8 ���
n64_i64 ��
n64_i32 ��
n64_i16 ��
! n64_i8 ���
" n64_f32 �� &# __n64 .?AT__n64@@ . onecore\external\sdk\inc\crt\arm_neon.h $ % +
��
'
�
��
)
�
t ��
+
�
��
-
�
��
/
�
! ��
1
�
u ��
3
�
# ��
5
�
��
7
�
! ��
9
�
@ ��
;
�
p ��
=
�
p ��
?
�
p ��
A
�
p ��
C
�
��
E
�
��
G
�
��
I
�
��
K
�
��
M
�
t ��
O
�
��
Q
�
t ��
S
�
��
U
�
��
W
�
��
Y
�
��
[
�
> p ]
^
�
��
`
�
��
b
� B p d
e
�
��
g
�
��
i
�
F k
l
�
! ��
n
� J p
q
�
! ��
s
�
N u
v
�
" ��
x
� R z
{
�
" ��
}
�
V
�
�
# ��
�
� Z �
�
�
# ��
�
�
�
�
�
�
�
� � SE_WS_APPX_SIGNATURE_ORIGIN_NOT_VALIDATED SE_WS_APPX_SIGNATURE_ORIGIN_UNKNOWN �� SE_WS_APPX_SIGNATURE_ORIGIN_APPSTORE � SE_WS_APPX_SIGNATURE_ORIGIN_WINDOWS �� SE_WS_APPX_SIGNATURE_ORIGIN_ENTERPRISE ���N t � SE_WS_APPX_SIGNATURE_ORIGIN .?AW4SE_WS_APPX_SIGNATURE_ORIGIN@@ �* onecore\internal\sdk\inc\ntseapi.h � � � � PS_MITIGATION_OPTION_NX �� PS_MITIGATION_OPTION_SEHOP ��� PS_MITIGATION_OPTION_FORCE_RELOCATE_IMAGES ��� PS_MITIGATION_OPTION_HEAP_TERMINATE �� PS_MITIGATION_OPTION_BOTTOM_UP_ASLR �� PS_MITIGATION_OPTION_HIGH_ENTROPY_ASLR ��� PS_MITIGATION_OPTION_STRICT_HANDLE_CHECKS PS_MITIGATION_OPTION_WIN32K_SYSTEM_CALL_DISABLE �� PS_MITIGATION_OPTION_EXTENSION_POINT_DISABLE � PS_MITIGATION_OPTION_PROHIBIT_DYNAMIC_CODE ���
PS_MITIGATION_OPTION_CONTROL_FLOW_GUARD �� PS_MITIGATION_OPTION_BLOCK_NON_MICROSOFT_BINARIES PS_MITIGATION_OPTION_FONT_DISABLE
PS_MITIGATION_OPTION_IMAGE_LOAD_NO_REMOTE PS_MITIGATION_OPTION_IMAGE_LOAD_NO_LOW_LABEL � PS_MITIGATION_OPTION_IMAGE_LOAD_PREFER_SYSTEM32 �� PS_MITIGATION_OPTION_RETURN_FLOW_GUARD ��� PS_MITIGATION_OPTION_LOADER_INTEGRITY_CONTINUITY � PS_MITIGATION_OPTION_STRICT_CONTROL_FLOW_GUARD ��� PS_MITIGATION_OPTION_RESTRICT_SET_THREAD_CONTEXT � PS_MITIGATION_OPTION_ROP_STACKPIVOT �� PS_MITIGATION_OPTION_ROP_CALLER_CHECK PS_MITIGATION_OPTION_ROP_SIMEXEC � PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER ��� PS_MITIGATION_OPTION_EXPORT_ADDRESS_FILTER_PLUS �� PS_MITIGATION_OPTION_RESTRICT_CHILD_PROCESS_CREATION � PS_MITIGATION_OPTION_IMPORT_ADDRESS_FILTER ��� PS_MITIGATION_OPTION_MODULE_TAMPERING_PROTECTION � PS_MITIGATION_OPTION_RESTRICT_INDIRECT_BRANCH_PREDICTION � PS_MITIGATION_OPTION_SPECULATIVE_STORE_BYPASS_DISABLE PS_MITIGATION_OPTION_ALLOW_DOWNGRADE_DYNAMIC_CODE_POLICY � PS_MITIGATION_OPTION_CET_USER_SHADOW_STACKS �� PS_MITIGATION_OPTION_USER_CET_SET_CONTEXT_IP_VALIDATION �� ! PS_MITIGATION_OPTION_BLOCK_NON_CET_BINARIES �� $ PS_MITIGATION_OPTION_CET_DYNAMIC_APIS_OUT_OF_PROC_ONLY ���B # t � _PS_MITIGATION_OPTION .?AW4_PS_MITIGATION_OPTION@@ �* onecore\internal\sdk\inc\ntpsapi.h � � � �
#
� R � _PS_MITIGATION_OPTIONS_MAP .?AU_PS_MITIGATION_OPTIONS_MAP@@ �� # " �
� Map ��R � _PS_MITIGATION_OPTIONS_MAP .?AU_PS_MITIGATION_OPTIONS_MAP@@ �� � � m
�
� ^ � _PS_MITIGATION_AUDIT_OPTIONS_MAP .?AU_PS_MITIGATION_AUDIT_OPTIONS_MAP@@ ��
� Map ��^ � _PS_MITIGATION_AUDIT_OPTIONS_MAP .?AU_PS_MITIGATION_AUDIT_OPTIONS_MAP@@ �� � � �
�
� B � _KUSER_SHARED_DATA .?AU_KUSER_SHARED_DATA@@ ��
�
� 6 � _KSYSTEM_TIME .?AU_KSYSTEM_TIME@@
� �� q " �J NtProductWinNt ��� NtProductLanManNt NtProductServer ��: t � _NT_PRODUCT_TYPE .?AW4_NT_PRODUCT_TYPE@@ ��� � � " � " @ �B StandardDesign ��� NEC98x86 � EndAlternatives ��V t � _ALTERNATIVE_ARCHITECTURE_TYPE .?AW4_ALTERNATIVE_ARCHITECTURE_TYPE@@ ���. onecore\internal\sdk\inc\ntexapi_x.h ��� � � � 2 � _LARGE_INTEGER .?AT_LARGE_INTEGER@@ ��
��
��
��
�� " �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" �� " " � # " � " " � " " � ! " �
# ��F � _XSTATE_CONFIGURATION .?AU_XSTATE_CONFIGURATION@@ B
" TickCountLowDeprecated ���
" TickCountMultiplier ��
� InterruptTime
� SystemTime ���
� TimeZoneBias �
! , ImageNumberLow ���
! . ImageNumberHigh ��
� 0 NtSystemRoot �
" 8MaxStackTraceDepth ���
" <CryptoExponent ���
" @TimeZoneId ���
" DLargePageMinimum �
" HAitSamplingValue �
" LAppCompatFlag
# PRNGSeedVersion ���
" XGlobalValidationRunlevel �
Q \TimeZoneBiasStamp
" `NtBuildNumber
� dNtProductType
hProductTypeIsValid ���
� iReserved0
! jNativeProcessorArchitecture ��
" lNtMajorVersion ���
" pNtMinorVersion ���
� tProcessorFeatures
" �Reserved1
" �Reserved3
} �TimeSlip �
� �AlternativeArchitecture ��
" �BootId ���
� �SystemExpirationDate �
" �SuiteMask
�KdDebuggerEnabled
�MitigationPolicies ���
� �NXSupportPolicy ��
� �SEHValidationPolicy ��
� �CurDirDevicesSkippedForDlls ��
� �Reserved �
! �CyclesPerYield ���
} �ActiveConsoleId ��
} �DismountCount
" �ComPlusPackage ���
" �LastSystemRITEventTickCount ��
" �NumberOfPhysicalPages
�SafeBootMode �
�VirtualizationFlags ��
� �Reserved12 ���
" �SharedDataFlags ��
� �DbgErrorPortPresent ��
� �DbgElevationEnabled ��
� �DbgVirtEnabled ���
� �DbgInstallerDetectEnabled
� �DbgLkgEnabled
� �DbgDynProcessorEnabled ���
� �DbgConsoleBrokerEnabled ��
� �DbgSecureBootEnabled �
� �DbgMultiSessionSku ���
� �DbgMultiUsersInSessionSku
� �DbgStateSeparationEnabled
� �SpareBits
� �DataFlagsPad �
# �TestRetInstruction ���
QpcFrequency �
" SystemCall ���
" Reserved2
� SystemCallPad
� TickCount
� TickCountQuad
� ReservedTickCountOverlay �
� ,TickCountPad �
" 0Cookie ���
� 4CookiePad
8ConsoleSessionForegroundProcessId
# @TimeUpdateLock ���
# HBaselineSystemTimeQpc
# PBaselineInterruptTimeQpc �
# XQpcSystemTimeIncrement ���
# `QpcInterruptTimeIncrement
hQpcSystemTimeIncrementShift ��
iQpcInterruptTimeIncrementShift ���
! jUnparkedProcessorCount ���
� lEnclaveFeatureMask ���
" |TelemetryCoverageRound ���
� �UserModeGlobalLogger �
" �ImageFileExecutionOptions
" �LangGenerationCount ��
# �Reserved4
� �InterruptTimeBias
� �QpcBias ��
" �ActiveProcessorCount �
g �ActiveGroupCount �
�Reserved9
! �QpcData ��
g �QpcBypassEnabled �
�QpcShift �
� �TimeZoneBiasEffectiveStart ���
� �TimeZoneBiasEffectiveEnd �
� �XState ���
� FeatureConfigurationChangeStamp ��
" Spare B d � _KUSER_SHARED_DATA .?AU_KUSER_SHARED_DATA@@ �� � �
y " �
�
� �
�
� 2 � _ULARGE_INTEGER .?AT_ULARGE_INTEGER@@ *
" LowPart ��
" HighPart �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � J
" LowPart ��
" HighPart �
� u
# QuadPart �2 � _ULARGE_INTEGER .?AT_ULARGE_INTEGER@@ � � *
" LowPart ��
HighPart �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � J
" LowPart ��
HighPart �
� u
QuadPart �2 � _LARGE_INTEGER .?AT_LARGE_INTEGER@@ �� � �
� # �
�
�
�
� # �
�
� J � _TP_CALLBACK_ENVIRON_V3 .?AU_TP_CALLBACK_ENVIRON_V3@@
�
� . � _TP_POOL .?AU_TP_POOL@@ ��
�
� > � _TP_CLEANUP_GROUP .?AU_TP_CLEANUP_GROUP@@
�
� �
�
� B � _ACTIVATION_CONTEXT .?AU_ACTIVATION_CONTEXT@@
�
� F � _TP_CALLBACK_INSTANCE .?AU_TP_CALLBACK_INSTANCE@@
�
� � �
�
�
" ��
" ��
" ��F
� LongFunction �
� Persistent ���
� Private ��: � <anonymous-tag> .?AU<anonymous-tag>@@ * onecore\internal\sdk\inc\nttpapi.h � � � !
" Flags
� s 2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � � TP_CALLBACK_PRIORITY_HIGH TP_CALLBACK_PRIORITY_NORMAL �� TP_CALLBACK_PRIORITY_LOW � TP_CALLBACK_PRIORITY_INVALID � TP_CALLBACK_PRIORITY_COUNT ���B t � _TP_CALLBACK_PRIORITY .?AW4_TP_CALLBACK_PRIORITY@@ � � � J �
" Version ��
� Pool �
� CleanupGroup �
� CleanupGroupCancelCallback ���
RaceDll ��
� ActivationContext
� FinalizationCallback �
� u
� CallbackPriority �
" $ Size �J
( _TP_CALLBACK_ENVIRON_V3 .?AU_TP_CALLBACK_ENVIRON_V3@@ �
�
�
�
�
�
�
�
�
�
�
�
�
� & � _TEB .?AU_TEB@@ ��
� * � _NT_TIB .?AU_NT_TIB@@ 2 � _CLIENT_ID .?AU_CLIENT_ID@@ ��& � _PEB .?AU_PEB@@ ��
� " " h � " " � " @ � " h � p "
�N � _ACTIVATION_CONTEXT_STACK .?AU_ACTIVATION_CONTEXT_STACK@@ " �
� " �: � _GDI_TEB_BATCH .?AU_GDI_TEB_BATCH@@ �� " " � � " � � " " t �: � _UNICODE_STRING .?AU_UNICODE_STRING@@ q "
� " �2 � _LIST_ENTRY .?AU_LIST_ENTRY@@ " � " $ �& � _GUID .?AU_GUID@@ > � _PROCESSOR_NUMBER .?AU_PROCESSOR_NUMBER@@
� > � _TEB_ACTIVE_FRAME .?AU_TEB_ACTIVE_FRAME@@
'
�
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��
! ���
NtTib
EnvironmentPointer ���
ClientId �
( ActiveRpcHandle ��
, ThreadLocalStoragePointer
0 ProcessEnvironmentBlock ��
" 4 LastErrorValue ���
" 8 CountOfOwnedCriticalSections �
< CsrClientThread ��
@ Win32ThreadInfo ��
D User32Reserved ���
� UserReserved �
� WOW32Reserved
" � CurrentLocale
" � FpSoftwareStatusRegister �
� ReservedForDebuggerInstrumentation ���
SystemReserved1 ��
p tPlaceholderCompatibilityMode �
uPlaceholderHydrationAlwaysExplicit ���
vPlaceholderReserved ��
" �ProxiedProcessId �
�_ActivationStack �
�WorkingOnBehalfTicket
�ExceptionCode
�ActivationContextStackPointer
" �InstrumentationCallbackSp
" �InstrumentationCallbackPreviousPc
" �InstrumentationCallbackPreviousSp
�InstrumentationCallbackDisabled ��
�SpareBytes ���
" �TxFsContext ��
�GdiTebBatch ��
�RealClientId �
�GdiCachedProcessHandle ���
" �GdiClientPID �
" �GdiClientTID �
�GdiThreadLocalInfo ���
�Win32ClientInfo ��
�glDispatchTable ��
h glReserved1 ��
� glReserved2 ��
� glSectionInfo
� glSection
� glTable ��
� glCurrentRC ��
� glContext
" � LastStatusValue ��
� StaticUnicodeString ��
StaticUnicodeBuffer ��
DeallocationStack
TlsSlots �
! TlsLinks �
Vdm ��
ReservedForNtRpc �
" DbgSsReserved
" (HardErrorMode
# ,Instrumentation ��
$ PActivityId ���
`SubProcessTag
dPerflibData ��
hEtwTraceData �
lWinSockData ��
" pGdiBatchCount
% tCurrentIdealProcessor
" tIdealProcessorValue ��
tReservedPad0 �
uReservedPad1 �
vReservedPad2 �
wIdealProcessor ���
" xGuaranteedStackBytes �
|ReservedForPerf ��
�ReservedForOle ���
" �WaitingOnLoaderLock ��
�SavedPriorityState ���
" �ReservedForCodeCoverage ��
�ThreadPoolData ���
& �TlsExpansionSlots
" �MuiGeneration
" �IsImpersonating ��
�NlsCache �
�pShimData
" �HeapData �
�CurrentTransactionHandle �
( �ActiveFrame ��
�FlsData ��
�PreferredLanguages ���
�UserPrefLanguages
�MergedPrefLanguages ��
" �MuiImpersonation �
s �CrossTebFlags
) �SpareCrossTebBits
! �SameTebFlags �
* �SafeThunkCall
+ �InDebugPrint �
, �HasFiberData �
- �SkipThreadAttach �
. �WerInShipAssertCode ��
/ �RanProcessInit ���
0 �ClonedThread �
1 �SuppressDebugMsg �
2 �DisableUserStackWalk �
3 �RtlExceptionAttached �
4 �InitialThread
5 �SessionAware �
6 �LoadOwner
7 �LoaderWorker �
8 �SkipLoaderInit ���
9 �SpareSameTebBits �
�TxnScopeEnterCallback
�TxnScopeExitCallback �
�TxnScopeContext ��
" �LockCount
�WowTebOffset �
�ResourceRetValue �
�ReservedForWdf ���
# �ReservedForCrt ���
$ �EffectiveContainerId �& u : _TEB .?AU_TEB@@ ��* onecore\internal\sdk\inc\pebteb.h �� ; < �
� Z � _EXCEPTION_REGISTRATION_RECORD .?AU_EXCEPTION_REGISTRATION_RECORD@@ ��
?
�
� �
@ ExceptionList
StackBase
StackLimit ���
SubSystemTib �
FiberData
" Version ��
ArbitraryUserPointer �
A Self �* B _NT_TIB .?AU_NT_TIB@@ . onecore\internal\sdk\inc\ntpsapi_x.h ��� C D �
F
�
!
�
!
� "
I Flink
I Blink 2 J _LIST_ENTRY .?AU_LIST_ENTRY@@ K Y
I
�
! ��
N
�
!
�
P
�
" R
S
� U
V
�
H X
Y
� B � _SINGLE_LIST_ENTRY .?AU_SINGLE_LIST_ENTRY@@ ��
[
�
[
�
] Next �B ^ _SINGLE_LIST_ENTRY .?AU_SINGLE_LIST_ENTRY@@ �� _ c
]
� > � _RTL_SPLAY_LINKS .?AU_RTL_SPLAY_LINKS@@ ��
b
�
b
� B
d Parent ���
d LeftChild
d RightChild ���> e _RTL_SPLAY_LINKS .?AU_RTL_SPLAY_LINKS@@ ��* onecore\internal\sdk\inc\ntrtl_x.h � f g x
d
� Z � _RTL_DYNAMIC_HASH_TABLE_CONTEXT .?AU_RTL_DYNAMIC_HASH_TABLE_CONTEXT@@
j
� B
H ChainHead
H PrevLinkage ��
" Signature Z l _RTL_DYNAMIC_HASH_TABLE_CONTEXT .?AU_RTL_DYNAMIC_HASH_TABLE_CONTEXT@@ m g ,
H
� b � _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR .?AU_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR@@ ��
p
� V � _RTL_DYNAMIC_HASH_TABLE_ENTRY .?AU_RTL_DYNAMIC_HASH_TABLE_ENTRY@@ V
r HashEntry
H CurEntry �
H ChainHead
" BucketIndex ��b s _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR .?AU_RTL_DYNAMIC_HASH_TABLE_ENUMERATOR@@ �� t g 2 J � _RTL_DYNAMIC_HASH_TABLE .?AU_RTL_DYNAMIC_HASH_TABLE@@
v
� �
" Flags
" Shift
" TableSize
" Pivot
" DivisorMask ��
" NumEntries ���
" NonEmptyBuckets ��
" NumEnumerators ���
Directory J x $ _RTL_DYNAMIC_HASH_TABLE .?AU_RTL_DYNAMIC_HASH_TABLE@@ y g ;
� B
! Length ���
! MaximumLength
q Buffer ���: | _UNICODE_STRING .?AU_UNICODE_STRING@@ }
q
� * � _STRING .?AU_STRING@@
�
� B
! Length ���
! MaximumLength
p Buffer ���* � _STRING .?AU_STRING@@ � �
p
�
�
� & � _LUID .?AU_LUID@@ *
" LowPart ��
HighPart �& � _LUID .?AU_LUID@@ � � b � _CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG .?AU_CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG@@
�
�
q ��
�
� &
" Size �
� TriggerId b � _CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG .?AU_CUSTOM_SYSTEM_EVENT_TRIGGER_CONFIG@@ � g &
�
� > � _IMAGE_NT_HEADERS .?AU_IMAGE_NT_HEADERS@@
�
� B � _IMAGE_FILE_HEADER .?AU_IMAGE_FILE_HEADER@@ ��J � _IMAGE_OPTIONAL_HEADER .?AU_IMAGE_OPTIONAL_HEADER@@ ��J
" Signature
� FileHeader ���
� OptionalHeader ���> � � _IMAGE_NT_HEADERS .?AU_IMAGE_NT_HEADERS@@ * onecore\external\ddk\inc\ntimage.h � � � | > � _IMAGE_DOS_HEADER .?AU_IMAGE_DOS_HEADER@@
�
� ! " � ! " �n
! e_magic ��
! e_cblp ���
! e_cp �
! e_crlc ���
! e_cparhdr
!
e_minalloc ���
! e_maxalloc ���
! e_ss �
! e_sp �
! e_csum ���
! e_ip �
! e_cs �
! e_lfarlc �
! e_ovno ���
� e_res
! $ e_oemid ��
! & e_oeminfo
� ( e_res2 ���
< e_lfanew �> � @ _IMAGE_DOS_HEADER .?AU_IMAGE_DOS_HEADER@@ � � E ! " � ! " �6 � _RTL_RB_TREE .?AU_RTL_RB_TREE@@ ��
�
� B � _RTL_BALANCED_NODE .?AU_RTL_BALANCED_NODE@@ ��
�
�
��6
� Root �
� Encoded ��
� Min ��6 � _RTL_RB_TREE .?AU_RTL_RB_TREE@@ ��. onecore\internal\sdk\inc\rtlrbtree.h ��� � � ,
�
�
�
� � " �
��
��r
� Children �
� Left �
� Right
� Red ��
� Balance ��
" ParentValue ��B � _RTL_BALANCED_NODE .?AU_RTL_BALANCED_NODE@@ �� � r
�
� � �
�
�
�
� � � " � �
�
�
�
� � �
�
� � � " �
�
� � �
�
� � � " � �
�
� � � " � �
�
� � � " � �
�
� � " � �
�
� � � " � �
�
� � " �
�
�
� � �
�
� � � � �
�
� 6 � _RTL_AVL_TREE .?AU_RTL_AVL_TREE@@
�
�
�
�
� Root �6 � _RTL_AVL_TREE .?AU_RTL_AVL_TREE@@ � � 6
�
� � � �
�
�
� �
�
� � � � �
�
� � � � �
�
� � � � �
�
�
$
� B
" Data1
! Data2
! Data3
Data4 & � _GUID .?AU_GUID@@ . onecore\external\shared\inc\guiddef.h �� � �
� & # " " " " �
�
�
� �
�
� � �
� � � �
� �
� � �
�
q q
�
q ��
�
�
�
� t
�
q ��
�
� t
�
t
�
t "
#
� q q %
&
�
�
� q ) *
+
� ) ) -
.
� q u t 0
1
�
u 3
4
� t 6
7
� J � _EVENT_DATA_DESCRIPTOR .?AU_EVENT_DATA_DESCRIPTOR@@ ��
9
� n
# Ptr ��
" Size �
" Reserved �
Type �
Reserved1
! Reserved2 J ; _EVENT_DATA_DESCRIPTOR .?AU_EVENT_DATA_DESCRIPTOR@@ ��. onecore\external\shared\inc\evntprov.h � < = � > � _EVENT_DESCRIPTOR .?AU_EVENT_DESCRIPTOR@@
?
� �
! Id ���
Version ��
Channel ��
Level
Opcode ���
! Task �
# Keyword ��> A _EVENT_DESCRIPTOR .?AU_EVENT_DESCRIPTOR@@ B = �
? ��
D
�
! ��
F
�
��
H
�
# ��
J
� 6 � _EVENT_RECORD .?AU_EVENT_RECORD@@
L ��
M
� 6 � _EVENT_HEADER .?AU_EVENT_HEADER@@ B � _ETW_BUFFER_CONTEXT .?AU_ETW_BUFFER_CONTEXT@@ ^ � _EVENT_HEADER_EXTENDED_DATA_ITEM .?AU_EVENT_HEADER_EXTENDED_DATA_ITEM@@ ��
Q
� �
O EventHeader ��
P P BufferContext
! T ExtendedDataCount
! V UserDataLength ���
R X ExtendedData �
\ UserData �
` UserContext ��6 S h _EVENT_RECORD .?AU_EVENT_RECORD@@ * onecore\external\sdk\inc\evntcons.h T U �
! ��
W
�
p ��
Y
�
! ��
[
� B � _PERFINFO_GROUPMASK .?AU_PERFINFO_GROUPMASK@@
]
� " " �
_ Masks B ` _PERFINFO_GROUPMASK .?AU_PERFINFO_GROUPMASK@@ . onecore\internal\sdk\inc\minwin\ntwmi.h a b �
"
�
�
� # # # f
g
�
$ ��
i
� p " �� ProcThreadAttributeParentProcess � ProcThreadAttributeHandleList ProcThreadAttributeGroupAffinity � ProcThreadAttributePreferredNode � ProcThreadAttributeIdealProcessor ProcThreadAttributeUmsThread � ProcThreadAttributeMitigationPolicy �� ProcThreadAttributeSecurityCapabilities �� ProcThreadAttributeProtectionLevel ���
ProcThreadAttributeJobList ��� ProcThreadAttributeChildProcessPolicy ProcThreadAttributeAllApplicationPackagesPolicy �� ProcThreadAttributeWin32kFilter �� ProcThreadAttributeSafeOpenPromptOriginClaim � ProcThreadAttributeDesktopAppPolicy �� ProcThreadAttributePseudoConsole � ProcThreadAttributeMitigationAuditPolicy �N t l _PROC_THREAD_ATTRIBUTE_NUM .?AW4_PROC_THREAD_ATTRIBUTE_NUM@@ ���* onecore\external\sdk\inc\winbase.h � m n �
* � HWND__ .?AUHWND__@@ ��
t unused ���* q HWND__ .?AUHWND__@@ ��. onecore\external\shared\inc\windef.h ��� r s ' J AuditEventObjectAccess ��� AuditEventDirectoryServiceAccess �: t u _AUDIT_EVENT_TYPE .?AW4_AUDIT_EVENT_TYPE@@ �. onecore\internal\sdk\inc\ntseapi_x.h ��� v w N . � _ICONINFO .?AU_ICONINFO@@ . � HBITMAP__ .?AUHBITMAP__@@
z
� b
t fIcon
" xHotspot �
" yHotspot �
{ hbmMask ��
{ hbmColor �. | _ICONINFO .?AU_ICONINFO@@ * onecore\external\sdk\inc\winuser.h � } ~ �) N � _WIN32_MEMORY_RANGE_ENTRY .?AU_WIN32_MEMORY_RANGE_ENTRY@@ 6
VirtualAddress ���
" NumberOfBytes N � _WIN32_MEMORY_RANGE_ENTRY .?AU_WIN32_MEMORY_RANGE_ENTRY@@ 2 onecore\external\sdk\inc\minwin\memoryapi.h � � � j SmrGcActionStart � SmrGcActionStartFullSpeed SmrGcActionPause � SmrGcActionStop ��N t � _REFS_SMR_VOLUME_GC_ACTION .?AW4_REFS_SMR_VOLUME_GC_ACTION@@ ���2 onecore\internal\sdk\inc\minwin\ntioapi_x.h � � � Z � _FILE_LINKS_FULL_ID_INFORMATION .?AU_FILE_LINKS_FULL_ID_INFORMATION@@ f � _FILE_LINK_ENTRY_FULL_ID_INFORMATION .?AU_FILE_LINK_ENTRY_FULL_ID_INFORMATION@@ ��F
" BytesNeeded ��
" EntriesReturned ��
� Entry Z � $ _FILE_LINKS_FULL_ID_INFORMATION .?AU_FILE_LINKS_FULL_ID_INFORMATION@@ � � � ^ � _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM_RUNTIME_FUNCTION_ENTRY@@
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
"
���
" BeginAddress �
" UnwindData ���
� Flag �
� FunctionLength ���
� Ret ��
� H
� Reg ��
� R
� L
� C
� StackAdjust ��^ � _IMAGE_ARM_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM_RUNTIME_FUNCTION_ENTRY@@ � � � ^ � _SERVICE_DELAYED_AUTO_START_INFO .?AU_SERVICE_DELAYED_AUTO_START_INFO@@ ��
�
�
t fDelayedAutostart ^ � _SERVICE_DELAYED_AUTO_START_INFO .?AU_SERVICE_DELAYED_AUTO_START_INFO@@ ��* onecore\external\sdk\inc\winsvc.h �� � � < 2 � HINSTANCE__ .?AUHINSTANCE__@@
�
�
Y
� � � � ! t �
�
� N � _ENCLAVE_CREATE_INFO_SGX .?AU_ENCLAVE_CREATE_INFO_SGX@@ �� " �
� Secs �N � _ENCLAVE_CREATE_INFO_SGX .?AU_ENCLAVE_CREATE_INFO_SGX@@ ��. onecore\internal\sdk\inc\ntmmapi_x.h ��� � � � �
ProcessBasicInformation �� ProcessQuotaLimits ��� ProcessIoCounters ProcessVmCounters ProcessTimes � ProcessBasePriority �� ProcessRaisePriority � ProcessDebugPort � ProcessExceptionPort � ProcessAccessToken ���
ProcessLdtInformation ProcessLdtSize ��� ProcessDefaultHardErrorMode ��
ProcessIoPortHandlers ProcessPooledUsageAndLimits �� ProcessWorkingSetWatch ��� ProcessUserModeIOPL �� ProcessEnableAlignmentFaultFixup � ProcessPriorityClass � ProcessWx86Information ��� ProcessHandleCount ��� ProcessAffinityMask �� ProcessPriorityBoost � ProcessDeviceMap � ProcessSessionInformation ProcessForegroundInformation � ProcessWow64Information �� ProcessImageFileName � ProcessLUIDDeviceMapsEnabled � ProcessBreakOnTermination ProcessDebugObjectHandle � ProcessDebugFlags ProcessHandleTracing � ! ProcessIoPriority " ProcessExecuteFlags �� # ProcessTlsInformation $ ProcessCookie % ProcessImageInformation �� & ProcessCycleTime � ' ProcessPagePriority �� ( ProcessInstrumentationCallback ��� ) ProcessThreadStackAllocation � * ProcessWorkingSetWatchEx � + ProcessImageFileNameWin32 , ProcessImageFileMapping �� - ProcessAffinityUpdateMode . ProcessMemoryAllocationMode �� / ProcessGroupInformation �� 0 ProcessTokenVirtualizationEnabled 1 ProcessOwnerInformation �� 2 ProcessWindowInformation � 3 ProcessHandleInformation � 4 ProcessMitigationPolicy �� 5 ProcessDynamicFunctionTableInformation ��� 6 ProcessHandleCheckingMode 7 ProcessKeepAliveCount 8 ProcessRevokeFileHandles � 9 ProcessWorkingSetControl � : ProcessHandleTable ��� ; ProcessCheckStackExtentsMode � < ProcessCommandLineInformation = ProcessProtectionInformation � > ProcessMemoryExhaustion �� ? ProcessFaultInformation �� @ ProcessTelemetryIdInformation A ProcessCommitReleaseInformation �� B ProcessDefaultCpuSetsInformation � C ProcessAllowedCpuSetsInformation � B ProcessReserved1Information �� C ProcessReserved2Information �� D ProcessSubsystemProcess �� E ProcessJobMemoryInformation �� F ProcessInPrivate � G ProcessRaiseUMExceptionOnInvalidHandleClose �� H ProcessIumChallengeResponse �� I ProcessChildProcessInformation ��� J ProcessHighGraphicsPriorityInformation ��� K ProcessSubsystemInformation �� L ProcessEnergyValues �� M ProcessPowerThrottlingState �� N ProcessReserved3Information �� O ProcessWin32kSyscallFilterInformation P ProcessDisableSystemAllowedCpuSets ��� Q ProcessWakeInformation ��� R ProcessEnergyTrackingState ��� S ProcessManageWritesToExecutableMemory T ProcessCaptureTrustletLiveDump ��� U ProcessTelemetryCoverage � V ProcessEnclaveInformation W ProcessEnableReadWriteVmLogging �� X ProcessUptimeInformation � Y ProcessImageSection �� Z ProcessDebugAuthInformation �� [ ProcessSystemResourceManagement �� \ ProcessSequenceNumber ] ProcessLoaderDetour �� ^ ProcessSecurityDomainInformation � _ ProcessCombineSecurityDomainsInformation � ` ProcessEnableLogging � a ProcessLeapSecondInformation � b ProcessFiberShadowStackAllocation c ProcessFreeFiberShadowStackAllocation d ProcessAltSystemCallInformation �� e ProcessDynamicEHContinuationTargets �� f ProcessDynamicEnforcedCetCompatibleRanges g MaxProcessInfoClass ��: j t � _PROCESSINFOCLASS .?AW4_PROCESSINFOCLASS@@ � � D ] J � _PERFINFO_IPI_SEND_DATA .?AU_PERFINFO_IPI_SEND_DATA@@ v
# InitialTime ��
WorkerRoutine
" RequestType ��
" IpiType ��
" TargetCount ��J � _PERFINFO_IPI_SEND_DATA .?AU_PERFINFO_IPI_SEND_DATA@@ � b 5 b � _ASSEMBLY_FILE_DETAILED_INFORMATION .?AU_ASSEMBLY_FILE_DETAILED_INFORMATION@@ z
" ulFlags ��
" ulFilenameLength �
" ulPathLength �
� lpFileName ���
� lpFilePath ���b � _ASSEMBLY_FILE_DETAILED_INFORMATION .?AU_ASSEMBLY_FILE_DETAILED_INFORMATION@@ * onecore\internal\sdk\inc\nturtl.h �� � � � : � _PS_CREATE_INFO .?AU_PS_CREATE_INFO@@ � PsCreateInitialState � PsCreateFailOnFileOpen ��� PsCreateFailOnSectionCreate �� PsCreateFailExeFormat PsCreateFailMachineMismatch �� PsCreateFailExeName �� PsCreateSuccess �� PsCreateMaximumStates 6 t � PS_CREATE_STATE .?AW4PS_CREATE_STATE@@ � � � )
��
��
��
��
��
��
! ��
" InitFlags
� WriteOutputOnExit
� DetectManifest ���
� IFEOSkipDebugger �
� IFEODoNotPropagateKeyState ���
� SpareBits1 ���
� SpareBits2 ���
� ProhibitedImageCharacteristics ���
" AdditionalFileAccess �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � �
FileHandle ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � � "
! DllCharacteristics ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � �
IFEOKey ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � � �
��
��
��
��
��
��
��
! ��
" OutputFlags ��
� ProtectedProcess �
� AddressSpaceOverride �
� DevOverrideEnabled ���
� ManifestDetected �
� ProtectedProcessLight
� SpareBits1 ���
� SpareBits2 ���
� SpareBits3 ���
FileHandle ���
SectionHandle
# UserProcessParametersNative ��
" UserProcessParametersWow64 ���
" CurrentParameterFlags
# PebAddressNative �
" ( PebAddressWow64 ��
# 0 ManifestAddress ��
" 8 ManifestSize �: � @ <anonymous-tag> .?AU<anonymous-tag>@@ � � � �
" Size �
� State
� InitState
� FailSection ��
� ExeFormat
� ExeName ��
� SuccessState �: � H _PS_CREATE_INFO .?AU_PS_CREATE_INFO@@ � � � J � MEM_EXTENDED_PARAMETER .?AUMEM_EXTENDED_PARAMETER@@ ��
�
�
# ��
# 8��
� Type �
� Reserved �
# ULong64 ��
Pointer ��
" Size �
Handle ���
" ULong J � MEM_EXTENDED_PARAMETER .?AUMEM_EXTENDED_PARAMETER@@ �� � � � r � _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION@@ ��f � _SYSTEM_SECUREBOOT_POLICY_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_INFORMATION@@ " �J
� PolicyInformation
" PolicySize ���
� Policy ���r � _SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION@@ ��* onecore\internal\sdk\inc\ntexapi.h � � � � > � _ALPC_TOKEN_ATTR .?AU_ALPC_TOKEN_ATTR@@ ��J
� TokenId ��
� AuthenticationId �
� ModifiedId ���> � _ALPC_TOKEN_ATTR .?AU_ALPC_TOKEN_ATTR@@ ��* onecore\internal\sdk\inc\ntlpcapi.h � � ^ F � _MIDL_METHOD_PROPERTY .?AU_MIDL_METHOD_PROPERTY@@
�
� "
" Id ���
" Value F � _MIDL_METHOD_PROPERTY .?AU_MIDL_METHOD_PROPERTY@@ . onecore\external\shared\inc\rpcndr.h ��� � � [ ^ VrfSpecialPoolRuleClass �� VrfForceIrqlRuleClass VrfAllocationFailuresRuleClass ��� VrfTrackingPoolAllocationsRuleClass �� VrfIORuleClass ��� VrfDeadlockPreventionRuleClass ��� VrfEnhancedIORuleClass ��� VrfDMARuleClass �� VrfSecurityRuleClass � VrfForcePendingIORequestRuleClass
VrfIRPTrackingRuleClass �� VrfMiscellaneousRuleClass VrfMoreDebuggingRuleClass
VrfMDLInvariantStackRuleClass VrfMDLInvariantDriverRuleClass ��� VrfPowerDelayFuzzingRuleClass VrfPortMiniportRuleClass � VrfStandardDDIRuleClass �� VrfAutoFailRuleClass � VrfAdditionalDDIRuleClass VrfRuleClassBase � VrfNdisWifiRuleClass � VrfDriverLoggingRuleClass VrfSyncDelayFuzzingRuleClass � VrfVMSwitchingRuleClass �� VrfCodeIntegrityRuleClass VrfBelow4GBAllocationRuleClass ��� VrfProcessorBranchTraceRuleClass � VrfAdvancedMMRuleClass ��� VrfExtendingXDVTimeLimit � VrfSystemBIOSRuleClass ��� VrfHardwareRuleClass � VrfStateSepRuleClass � ! VrfWDFRuleClass �� " VrfMoreIrqlRuleClass � # VrfXDVPlatformMode ��� $ VrfStandalonePlatformMode % VrfPlatformModeTest �� & VrfInfoDisclosureIRPRule � ' VrfLwSpecialPool � ( VrfAVXCorruption � ) VrfAccessModeMismatch * ReservedForDVRF42 + ReservedForDVRF43 , ReservedForDVRF44 - ReservedForDVRF45 . ReservedForDVRF46 / ReservedForDVRF47 0 ReservedForDVRF48 1 ReservedForDVRF49 2 ReservedForDVRF50 3 ReservedForDVRF51 4 ReservedForDVRF52 5 ReservedForDVRF53 6 ReservedForDVRF54 7 ReservedForDVRF55 8 ReservedForDVRF56 9 ReservedForDVRF57 : ReservedForDVRF58 ; ReservedForDVRF59 < ReservedForDVRF60 = ReservedForDVRF61 > ReservedForDVRF62 ? ReservedForDVRF63 @ VrfRuleClassSizeMax ��> A t � _VRF_RULE_CLASS_ID .?AW4_VRF_RULE_CLASS_ID@@ ��� � � w � TraceGuidQueryList ��� TraceGuidQueryInfo ��� TraceGuidQueryProcess TraceStackTracingInfo TraceSystemTraceEnableFlagsInfo �� TraceSampledProfileIntervalInfo �� TraceProfileSourceConfigInfo � TraceProfileSourceListInfo ��� TracePmcEventListInfo TracePmcCounterListInfo ��
TraceSetDisallowList � TraceVersionInfo � TraceGroupQueryList ��
TraceGroupQueryInfo �� TraceDisallowListQuery ��� TraceInfoReserved15 �� TracePeriodicCaptureStateListInfo TracePeriodicCaptureStateInfo TraceProviderBinaryTracking �� TraceMaxLoggersQuery � TraceLbrConfigurationInfo TraceLbrEventListInfo TraceMaxPmcCounterQuery �� MaxTraceSetInfoClass �F t � _TRACE_QUERY_INFO_CLASS .?AW4_TRACE_QUERY_INFO_CLASS@@ �. onecore\external\shared\inc\evntrace.h � � � E ImageDepPolicy ��� ImageAslrPolicy �� ImageDynamicCodePolicy ��� ImageStrictHandleCheckPolicy � ImageSystemCallDisablePolicy � ImageMitigationOptionsMask ��� ImageExtensionPointDisablePolicy � ImageControlFlowGuardPolicy �� ImageSignaturePolicy � ImageFontDisablePolicy ���
ImageImageLoadPolicy � ImagePayloadRestrictionPolicy ImageChildProcessPolicy ��
ImageSehopPolicy � ImageHeapPolicy �� ImageUserShadowStackPolicy ��� MaxImageMitigationPolicy �J t � _IMAGE_MITIGATION_POLICY .?AW4_IMAGE_MITIGATION_POLICY@@ ���* onecore\internal\sdk\inc\ntrtl.h ��� � � J � _EISA_DMA_CONFIGURATION .?AU_EISA_DMA_CONFIGURATION@@
� N � _DMA_CONFIGURATION_BYTE0 .?AU_DMA_CONFIGURATION_BYTE0@@ ��N � _DMA_CONFIGURATION_BYTE1 .?AU_DMA_CONFIGURATION_BYTE1@@ ��B
ConfigurationByte0 ���
ConfigurationByte1 ���J _EISA_DMA_CONFIGURATION .?AU_EISA_DMA_CONFIGURATION@@ * onecore\internal\sdk\inc\ntconfig.h DynamicTickVetoNone �� DynamicTickVetoProcBusy �� DynamicTickVetoSoftwareTimer � DynamicTickVetoClockConstraint ��� DynamicTickVetoClockOutOfSync DynamicTickVetoClockUpdateFailed � DynamicTickVetoNoDeepSleep ��� DynamicTickVetoMax ���^ t
_PERFINFO_DYNAMIC_TICK_VETO_REASON .?AW4_PERFINFO_DYNAMIC_TICK_VETO_REASON@@ ��� b � J � _WMI_JOB_ASSIGN_PROCESS .?AU_WMI_JOB_ASSIGN_PROCESS@@
� Z
$ ContainerId ��
" JobId
" UniqueProcessId ��
Status ���J _WMI_JOB_ASSIGN_PROCESS .?AU_WMI_JOB_ASSIGN_PROCESS@@ b �
�
� " j � _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS@@ j � _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET@@ ��f
u FeatureId
! ReportingKind
! ReportingOptions �
ReportingTarget ��j _RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_DETAILS@@ : onecore\internal\sdk\inc\rtlfeatureconfigtypes.h ��� � B � _MIDL_FORMAT_STRING .?AU_MIDL_FORMAT_STRING@@ " �&
Pad ��
Format ���B _MIDL_FORMAT_STRING .?AU_MIDL_FORMAT_STRING@@ � ? f � _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA .?AU_PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA@@ ��
� >
" DeviceInstanceLength �
q DeviceInstance ���f " _PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA .?AU_PLUGPLAY_CONTROL_RETRIEVE_DOCK_DATA@@ ��2 onecore\internal\sdk\inc\minwin\ntpnpapi.h � # $ � b � _SYSTEM_PLATFORM_BINARY_INFORMATION .?AU_SYSTEM_PLATFORM_BINARY_INFORMATION@@ �
# PhysicalAddress ��
HandoffBuffer
CommandLineBuffer
" HandoffBufferSize
" CommandLineBufferSize b ' _SYSTEM_PLATFORM_BINARY_INFORMATION .?AU_SYSTEM_PLATFORM_BINARY_INFORMATION@@ ( � �
b � _FILE_MEMORY_PARTITION_INFORMATION .?AU_FILE_MEMORY_PARTITION_INFORMATION@@ ��
*
� " �J
NoCrossPartitionAccess ���
, Spare
" AllFlags �2 - <anonymous-tag> .?AT<anonymous-tag>@@ . � � 2
" OwnerPartitionHandle �
. Flags b 0 _FILE_MEMORY_PARTITION_INFORMATION .?AU_FILE_MEMORY_PARTITION_INFORMATION@@ �� 1 � � z � _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION .?AU_RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION@@ j
ReflectionProcessHandle ��
ReflectionThreadHandle ���
ReflectionClientId ���z 4 _RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION .?AU_RTLP_PROCESS_REFLECTION_REFLECTION_INFORMATION@@ 5 � � Z � _JOBOBJECT_WAKE_INFORMATION_V1 .?AU_JOBOBJECT_WAKE_INFORMATION_V1@@ �� # " �:
# NotificationChannel ��
8 WakeCounters �Z 9 ( _JOBOBJECT_WAKE_INFORMATION_V1 .?AU_JOBOBJECT_WAKE_INFORMATION_V1@@ �� : � - f � _EVENT_TRACE_PROFILE_LIST_INFORMATION .?AU_EVENT_TRACE_PROFILE_LIST_INFORMATION@@
<
� � EventTraceKernelVersionInformation ��� EventTraceGroupMaskInformation ��� EventTracePerformanceInformation � EventTraceTimeProfileInformation � EventTraceSessionSecurityInformation � EventTraceSpinlockInformation EventTraceStackTracingInformation EventTraceExecutiveResourceInformation ��� EventTraceHeapTracingInformation � EventTraceHeapSummaryTracingInformation ��
EventTracePoolTagFilterInformation ��� EventTracePebsTracingInformation � EventTraceProfileConfigInformation ���
EventTraceProfileSourceListInformation ��� EventTraceProfileEventListInformation EventTraceProfileCounterListInformation �� EventTraceStackCachingInformation EventTraceObjectTypeFilterInformation EventTraceSoftRestartInformation � EventTraceLastBranchConfigurationInformation � EventTraceLastBranchEventListInformation � EventTraceProfileSourceAddInformation EventTraceProfileSourceRemoveInformation � EventTraceProcessorTraceConfigurationInformation � EventTraceProcessorTraceEventListInformation � EventTraceCoverageSamplerInformation � MaxEventTraceInfoClass ���V t > _EVENT_TRACE_INFORMATION_CLASS .?AW4_EVENT_TRACE_INFORMATION_CLASS@@ ���. onecore\internal\sdk\inc\minwin\ntetw.h ? @ � F � _PROFILE_SOURCE_INFO .?AU_PROFILE_SOURCE_INFO@@ �� B " �N
? EventTraceInformationClass ���
" Spare
C Profile ��f D ( _EVENT_TRACE_PROFILE_LIST_INFORMATION .?AU_EVENT_TRACE_PROFILE_LIST_INFORMATION@@ E @ @ � TP_LOG_LEVEL_ERROR ��� TP_LOG_LEVEL_WARNING � TP_LOG_LEVEL_INFO TP_LOG_LEVEL_TRACE_ENTER � TP_LOG_LEVEL_TRACE_LEAVE �2 t G _TP_LOG_LEVEL .?AW4_TP_LOG_LEVEL@@ � H � ? > � _EFI_DRIVER_ENTRY .?AU_EFI_DRIVER_ENTRY@@ z
" Version ��
" Length ���
" Id ���
" FriendlyNameOffset ���
" DriverFilePathOffset �> K _EFI_DRIVER_ENTRY .?AU_EFI_DRIVER_ENTRY@@ L � F � _EVENT_FILTER_HEADER .?AU_EVENT_FILTER_HEADER@@ �� " �z
! Id ���
Version ��
O Reserved �
# InstanceId ���
" Size �
" NextOffset ���F P _EVENT_FILTER_HEADER .?AU_EVENT_FILTER_HEADER@@ �� Q = T 6 � _currencyfmtW .?AU_currencyfmtW@@ �
u NumDigits
u LeadingZero ��
u Grouping �
q lpDecimalSep �
q lpThousandSep
u NegativeOrder
u PositiveOrder
q lpCurrencySymbol �6 T _currencyfmtW .?AU_currencyfmtW@@ * onecore\external\sdk\inc\winnls.h �� U V � Z � _RTL_UMS_SCHEDULER_STARTUP_INFO .?AU_RTL_UMS_SCHEDULER_STARTUP_INFO@@ N � _RTL_UMS_COMPLETION_LIST .?AU_RTL_UMS_COMPLETION_LIST@@ ��
Y
� ^ UmsSchedulerStartup �� UmsSchedulerThreadBlocked UmsSchedulerThreadYield ��J t [ _RTL_UMS_SCHEDULER_REASON .?AW4_RTL_UMS_SCHEDULER_REASON@@ � \ g �! \ " ^
_
� j
" UmsVersion ���
Z CompletionList ���
` SchedulerProc
SchedulerParam ���Z a _RTL_UMS_SCHEDULER_STARTUP_INFO .?AU_RTL_UMS_SCHEDULER_STARTUP_INFO@@ b g " B DPFLTR_SYSTEM_ID � DPFLTR_SMSS_ID ��� DPFLTR_SETUP_ID �� DPFLTR_NTFS_ID ��� DPFLTR_FSTUB_ID �� DPFLTR_CRASHDUMP_ID �� DPFLTR_CDAUDIO_ID DPFLTR_CDROM_ID �� DPFLTR_CLASSPNP_ID ��� DPFLTR_DISK_ID ���
DPFLTR_REDBOOK_ID DPFLTR_STORPROP_ID ��� DPFLTR_SCSIPORT_ID ���
DPFLTR_SCSIMINIPORT_ID ��� DPFLTR_CONFIG_ID � DPFLTR_I8042PRT_ID ��� DPFLTR_SERMOUSE_ID ��� DPFLTR_LSERMOUS_ID ��� DPFLTR_KBDHID_ID � DPFLTR_MOUHID_ID � DPFLTR_KBDCLASS_ID ��� DPFLTR_MOUCLASS_ID ��� DPFLTR_TWOTRACK_ID ��� DPFLTR_WMILIB_ID � DPFLTR_ACPI_ID ��� DPFLTR_AMLI_ID ��� DPFLTR_HALIA64_ID DPFLTR_VIDEO_ID �� DPFLTR_SVCHOST_ID DPFLTR_VIDEOPRT_ID ��� DPFLTR_TCPIP_ID �� DPFLTR_DMSYNTH_ID DPFLTR_NTOSPNP_ID ! DPFLTR_FASTFAT_ID " DPFLTR_SAMSS_ID �� # DPFLTR_PNPMGR_ID � $ DPFLTR_NETAPI_ID � % DPFLTR_SCSERVER_ID ��� & DPFLTR_SCCLIENT_ID ��� ' DPFLTR_SERIAL_ID � ( DPFLTR_SERENUM_ID ) DPFLTR_UHCD_ID ��� * DPFLTR_RPCPROXY_ID ��� + DPFLTR_AUTOCHK_ID , DPFLTR_DCOMSS_ID � - DPFLTR_UNIMODEM_ID ��� . DPFLTR_SIS_ID / DPFLTR_FLTMGR_ID � 0 DPFLTR_WMICORE_ID 1 DPFLTR_BURNENG_ID 2 DPFLTR_IMAPI_ID �� 3 DPFLTR_SXS_ID 4 DPFLTR_FUSION_ID � 5 DPFLTR_IDLETASK_ID ��� 6 DPFLTR_SOFTPCI_ID 7 DPFLTR_TAPE_ID ��� 8 DPFLTR_MCHGR_ID �� 9 DPFLTR_IDEP_ID ��� : DPFLTR_PCIIDE_ID � ; DPFLTR_FLOPPY_ID � < DPFLTR_FDC_ID = DPFLTR_TERMSRV_ID > DPFLTR_W32TIME_ID ? DPFLTR_PREFETCHER_ID � @ DPFLTR_RSFILTER_ID ��� A DPFLTR_FCPORT_ID � B DPFLTR_PCI_ID C DPFLTR_DMIO_ID ��� D DPFLTR_DMCONFIG_ID ��� E DPFLTR_DMADMIN_ID F DPFLTR_WSOCKTRANSPORT_ID � G DPFLTR_VSS_ID H DPFLTR_PNPMEM_ID � I DPFLTR_PROCESSOR_ID �� J DPFLTR_DMSERVER_ID ��� K DPFLTR_SR_ID � L DPFLTR_INFINIBAND_ID � M DPFLTR_IHVDRIVER_ID �� N DPFLTR_IHVVIDEO_ID ��� O DPFLTR_IHVAUDIO_ID ��� P DPFLTR_IHVNETWORK_ID � Q DPFLTR_IHVSTREAMING_ID ��� R DPFLTR_IHVBUS_ID � S DPFLTR_HPS_ID T DPFLTR_RTLTHREADPOOL_ID �� U DPFLTR_LDR_ID V DPFLTR_TCPIP6_ID � W DPFLTR_ISAPNP_ID � X DPFLTR_SHPC_ID ��� Y DPFLTR_STORPORT_ID ��� Z DPFLTR_STORMINIPORT_ID ��� [ DPFLTR_PRINTSPOOLER_ID ��� \ DPFLTR_VSSDYNDISK_ID � ] DPFLTR_VERIFIER_ID ��� ^ DPFLTR_VDS_ID _ DPFLTR_VDSBAS_ID � ` DPFLTR_VDSDYN_ID � a DPFLTR_VDSDYNDR_ID ��� b DPFLTR_VDSLDR_ID � c DPFLTR_VDSUTIL_ID d DPFLTR_DFRGIFC_ID e DPFLTR_DEFAULT_ID f DPFLTR_MM_ID � g DPFLTR_DFSC_ID ��� h DPFLTR_WOW64_ID �� i DPFLTR_ALPC_ID ��� j DPFLTR_WDI_ID k DPFLTR_PERFLIB_ID l DPFLTR_KTM_ID m DPFLTR_IOSTRESS_ID ��� n DPFLTR_HEAP_ID ��� o DPFLTR_WHEA_ID ��� p DPFLTR_USERGDI_ID q DPFLTR_MMCSS_ID �� r DPFLTR_TPM_ID s DPFLTR_THREADORDER_ID t DPFLTR_ENVIRON_ID u DPFLTR_EMS_ID v DPFLTR_WDT_ID w DPFLTR_FVEVOL_ID � x DPFLTR_NDIS_ID ��� y DPFLTR_NVCTRACE_ID ��� z DPFLTR_LUAFV_ID �� { DPFLTR_APPCOMPAT_ID �� | DPFLTR_USBSTOR_ID } DPFLTR_SBP2PORT_ID ��� ~ DPFLTR_COVERAGE_ID ��� DPFLTR_CACHEMGR_ID ��� � DPFLTR_MOUNTMGR_ID ��� � DPFLTR_CFR_ID � DPFLTR_TXF_ID � DPFLTR_KSECDD_ID � � DPFLTR_FLTREGRESS_ID � � DPFLTR_MPIO_ID ��� � DPFLTR_MSDSM_ID �� � DPFLTR_UDFS_ID ��� � DPFLTR_PSHED_ID �� � DPFLTR_STORVSP_ID � DPFLTR_LSASS_ID �� � DPFLTR_SSPICLI_ID � DPFLTR_CNG_ID � DPFLTR_EXFAT_ID �� � DPFLTR_FILETRACE_ID �� � DPFLTR_XSAVE_ID �� � DPFLTR_SE_ID � � DPFLTR_DRIVEEXTENDER_ID �� � DPFLTR_POWER_ID �� � DPFLTR_CRASHDUMPXHCI_ID �� � DPFLTR_GPIO_ID ��� � DPFLTR_REFS_ID ��� � DPFLTR_WER_ID � DPFLTR_CAPIMG_ID � � DPFLTR_VPCI_ID ��� � DPFLTR_STORAGECLASSMEMORY_ID � � DPFLTR_FSLIB_ID �� � DPFLTR_ENDOFTABLE_ID �2 � t d _DPFLTR_TYPE .?AW4_DPFLTR_TYPE@@ ���. onecore\external\shared\inc\dpfilter.h � e f B _ARM_BANKED_R8_USR ��� _ARM_BANKED_R9_USR ��� _ARM_BANKED_R10_USR �� _ARM_BANKED_R11_USR �� _ARM_BANKED_R12_USR �� _ARM_BANKED_R13_USR �� _ARM_BANKED_SP_USR ��� _ARM_BANKED_R14_USR �� _ARM_BANKED_LR_USR ��� _ARM_BANKED_R8_FIQ ��� _ARM_BANKED_R9_FIQ ���
_ARM_BANKED_R10_FIQ �� _ARM_BANKED_R11_FIQ �� _ARM_BANKED_R12_FIQ ��
_ARM_BANKED_R13_FIQ ��
_ARM_BANKED_SP_FIQ ��� _ARM_BANKED_R14_FIQ �� _ARM_BANKED_LR_FIQ ��� _ARM_BANKED_R14_IRQ �� _ARM_BANKED_LR_IRQ ��� _ARM_BANKED_R13_IRQ �� _ARM_BANKED_SP_IRQ ��� _ARM_BANKED_R14_SVC �� _ARM_BANKED_LR_SVC ��� _ARM_BANKED_R13_SVC �� _ARM_BANKED_SP_SVC ��� _ARM_BANKED_R14_ABT �� _ARM_BANKED_LR_ABT ��� _ARM_BANKED_R13_ABT �� _ARM_BANKED_SP_ABT ��� _ARM_BANKED_R14_UND �� _ARM_BANKED_LR_UND ��� _ARM_BANKED_R13_UND �� _ARM_BANKED_SP_UND ��� _ARM_BANKED_R14_MON �� _ARM_BANKED_LR_MON ��� _ARM_BANKED_R13_MON �� _ARM_BANKED_SP_MON ��� _ARM_BANKED_ELR_HYP �� _ARM_BANKED_R13_HYP �� _ARM_BANKED_SP_HYP ��� . _ARM_BANKED_SPSR_FIQ � 0 _ARM_BANKED_SPSR_IRQ � 2 _ARM_BANKED_SPSR_SVC � 4 _ARM_BANKED_SPSR_ABT � 6 _ARM_BANKED_SPSR_UND � < _ARM_BANKED_SPSR_MON � > _ARM_BANKED_SPSR_HYP �F 0 t h _tag_ARMINTR_BANKED_REG .?AW4_tag_ARMINTR_BANKED_REG@@ �. onecore\external\sdk\inc\crt\armintr.h � i j J � _HEAP_SUBSEGMENT_ALLOC .?AU_HEAP_SUBSEGMENT_ALLOC@@ ��F � _SYSTEM_TRACE_HEADER .?AU_SYSTEM_TRACE_HEADER@@ ��^ � _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE .?AU_HEAP_EVENT_SUBSEGMENT_ALLOC_FREE@@ &
m Header ���
n Event J o 0 _HEAP_SUBSEGMENT_ALLOC .?AU_HEAP_SUBSEGMENT_ALLOC@@ �� p b M WOW64_FUNCTION_NOP ��� WOW64_FUNCTION_QUERY_PROCESS_DEBUG_INFO �� WOW64_FUNCTION_CPU_TURBO_THUNK_CONTROL ��� WOW64_FUNCTION_CPU_CFG_DISPATCH_CONTROL �� WOW64_FUNCTION_CPU_OPTIMIZE_CHPE_IMPORT_THUNKS ��� WOW64_FUNCTION_MAXIMUM ���F t r _WOW64_FUNCTION_CODE64 .?AW4_WOW64_FUNCTION_CODE64@@ ��� s � b ProcessWorkingSetSwap ProcessWorkingSetEmpty ��� ProcessWorkingSetOperationMax V t u _PROCESS_WORKING_SET_OPERATION .?AW4_PROCESS_WORKING_SET_OPERATION@@ ���* onecore\internal\sdk\inc\ntmmapi.h � v w F � PowerActionNone �� PowerActionReserved �� PowerActionSleep � PowerActionHibernate � PowerActionShutdown �� PowerActionShutdownReset � PowerActionShutdownOff ��� PowerActionWarmEject � PowerActionDisplayOff 2 t y POWER_ACTION .?AW4POWER_ACTION@@ ���* onecore\external\ddk\inc\ntpoapi.h � z { � ^ � _FILE_FS_DRIVER_PATH_INFORMATION .?AU_FILE_FS_DRIVER_PATH_INFORMATION@@ ��
}
� q " �N
DriverInPath �
" DriverNameLength �
DriverName ���^ � _FILE_FS_DRIVER_PATH_INFORMATION .?AU_FILE_FS_DRIVER_PATH_INFORMATION@@ �� � � � F � tagEMRSELECTCLIPPATH .?AUtagEMRSELECTCLIPPATH@@ ��
�
� * � tagEMR .?AUtagEMR@@ ��"
� emr ��
" iMode F � tagEMRSELECTCLIPPATH .?AUtagEMRSELECTCLIPPATH@@ ��* onecore\external\sdk\inc\wingdi.h �� � � a � COPYFILE2_PROGRESS_CONTINUE �� COPYFILE2_PROGRESS_CANCEL COPYFILE2_PROGRESS_STOP �� COPYFILE2_PROGRESS_QUIET � COPYFILE2_PROGRESS_PAUSE �J t � _COPYFILE2_MESSAGE_ACTION .?AW4_COPYFILE2_MESSAGE_ACTION@@ � � n F > � COPYFILE2_MESSAGE .?AUCOPYFILE2_MESSAGE@@
� ��
�
� � � �
�
� R � _MEMORY_REGION_INFORMATION .?AU_MEMORY_REGION_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
AllocationBase ���
" AllocationProtect
" RegionType ���
� Private ��
� MappedDataFile ���
� MappedImage ��
� MappedPageFile ���
� MappedPhysical ���
� DirectMapped �
� SoftwareEnclave ��
� PageSize64K ��
� PlaceholderReservation ���
� Reserved �
" RegionSize ���
" CommitSize ���
" PartitionId ��
" NodePreference ���R � _MEMORY_REGION_INFORMATION .?AU_MEMORY_REGION_INFORMATION@@ �� � w � F � _UNIVERSAL_NAME_INFOW .?AU_UNIVERSAL_NAME_INFOW@@
q lpUniversalName ��F � _UNIVERSAL_NAME_INFOW .?AU_UNIVERSAL_NAME_INFOW@@ * onecore\external\sdk\inc\winnetwk.h � � � J
RtlPhysicalMemoryPolicyLow ��� RtlPhysicalMemoryPolicyNormal N t � RTL_PHYSICAL_MEMORY_POLICY .?AW4RTL_PHYSICAL_MEMORY_POLICY@@ ��� � J � _SYSTEM_VERIFIER_ISSUE .?AU_SYSTEM_VERIFIER_ISSUE@@ �� " " �B
" IssueType
Address ��
� Parameters ���J � _SYSTEM_VERIFIER_ISSUE .?AU_SYSTEM_VERIFIER_ISSUE@@ �� � � � � PoCsDeviceNotificationStorage PoCsDeviceNotificationWiFi ��� PoCsDeviceNotificationMbn PoCsDeviceNotificationAudio �� PoCsDeviceNotificationEthernet ��� PoCsDeviceNotificationMaximum V t � _PO_CS_DEVICE_NOTIFICATION_TYPE .?AW4_PO_CS_DEVICE_NOTIFICATION_TYPE@@ � � { ^
6 � _IO_COUNTERS .?AU_IO_COUNTERS@@ ��
# ReadOperationCount ���
# WriteOperationCount ��
# OtherOperationCount ��
# ReadTransferCount
# WriteTransferCount ���
# ( OtherTransferCount ���6 � 0 _IO_COUNTERS .?AU_IO_COUNTERS@@ �� � D � n � _ACTIVATION_CONTEXT_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_DETAILED_INFORMATION@@ ��
� ��
�
� z
" dwFlags ��
" ulFormatVersion ��
" ulAssemblyCount ��
" ulRootManifestPathType ���
" ulRootManifestPathChars ��
" ulRootConfigurationPathType ��
" ulRootConfigurationPathChars �
" ulAppDirPathType �
" ulAppDirPathChars
� $ lpRootManifestPath ���
� ( lpRootConfigurationPath ��
� , lpAppDirPath �n � 0 _ACTIVATION_CONTEXT_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_DETAILED_INFORMATION@@ �� � � ~ � _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ ��
�
� N � _RTL_IMAGE_MITIGATION_POLICY .?AT_RTL_IMAGE_MITIGATION_POLICY@@ ��&
� BlockWin32kSystemCalls ���~ � _RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ �� � P � PowerSystemUnspecified ��� PowerSystemWorking ��� PowerSystemSleeping1 � PowerSystemSleeping2 � PowerSystemSleeping3 � PowerSystemHibernate � PowerSystemShutdown �� PowerSystemMaximum ���> t � _SYSTEM_POWER_STATE .?AW4_SYSTEM_POWER_STATE@@ � � { � R � _FSCTL_OFFLOAD_WRITE_INPUT .?AU_FSCTL_OFFLOAD_WRITE_INPUT@@ �� " �~
" Size �
" Flags
# FileOffset ���
# CopyLength ���
# TransferOffset ���
� Token R � _FSCTL_OFFLOAD_WRITE_INPUT .?AU_FSCTL_OFFLOAD_WRITE_INPUT@@ �� � � � " " � � # SystemBasicInformation ��� SystemProcessorInformation ��� SystemPerformanceInformation � SystemTimeOfDayInformation ��� SystemPathInformation SystemProcessInformation � SystemCallCountInformation ��� SystemDeviceInformation �� SystemProcessorPerformanceInformation SystemFlagsInformation ���
SystemCallTimeInformation SystemModuleInformation �� SystemLocksInformation ���
SystemStackTraceInformation �� SystemPagedPoolInformation ��� SystemNonPagedPoolInformation SystemHandleInformation �� SystemObjectInformation �� SystemPageFileInformation SystemVdmInstemulInformation � SystemVdmBopInformation �� SystemFileCacheInformation ��� SystemPoolTagInformation � SystemInterruptInformation ��� SystemDpcBehaviorInformation � SystemFullMemoryInformation �� SystemLoadGdiDriverInformation ��� SystemUnloadGdiDriverInformation � SystemTimeAdjustmentInformation �� SystemSummaryMemoryInformation ��� SystemMirrorMemoryInformation SystemPerformanceTraceInformation SystemObsolete0 �� ! SystemExceptionInformation ��� " SystemCrashDumpStateInformation �� # SystemKernelDebuggerInformation �� $ SystemContextSwitchInformation ��� % SystemRegistryQuotaInformation ��� & SystemExtendServiceTableInformation �� ' SystemPrioritySeperation � ( SystemVerifierAddDriverInformation ��� ) SystemVerifierRemoveDriverInformation * SystemProcessorIdleInformation ��� + SystemLegacyDriverInformation , SystemCurrentTimeZoneInformation � - SystemLookasideInformation ��� . SystemTimeSlipNotification ��� / SystemSessionCreate �� 0 SystemSessionDetach �� 1 SystemSessionInformation � 2 SystemRangeStartInformation �� 3 SystemVerifierInformation 4 SystemVerifierThunkExtend 5 SystemSessionProcessInformation �� 6 SystemLoadGdiDriverInSystemSpace � 7 SystemNumaProcessorMap ��� 8 SystemPrefetcherInformation �� 9 SystemExtendedProcessInformation � : SystemRecommendedSharedDataAlignment � ; SystemComPlusPackage � < SystemNumaAvailableMemory = SystemProcessorPowerInformation �� > SystemEmulationBasicInformation �� ? SystemEmulationProcessorInformation �� @ SystemExtendedHandleInformation �� A SystemLostDelayedWriteInformation B SystemBigPoolInformation � C SystemSessionPoolTagInformation �� D SystemSessionMappedViewInformation ��� E SystemHotpatchInformation F SystemObjectSecurityMode � G SystemWatchdogTimerHandler ��� H SystemWatchdogTimerInformation ��� I SystemLogicalProcessorInformation J SystemWow64SharedInformationObsolete � K SystemRegisterFirmwareTableInformationHandler L SystemFirmwareTableInformation ��� M SystemModuleInformationEx N SystemVerifierTriageInformation �� O SystemSuperfetchInformation �� P SystemMemoryListInformation �� Q SystemFileCacheInformationEx � R SystemThreadPriorityClientIdInformation �� S SystemProcessorIdleCycleTimeInformation �� T SystemVerifierCancellationInformation U SystemProcessorPowerInformationEx V SystemRefTraceInformation W SystemSpecialPoolInformation � X SystemProcessIdInformation ��� Y SystemErrorPortInformation ��� Z SystemBootEnvironmentInformation � [ SystemHypervisorInformation �� \ SystemVerifierInformationEx �� ] SystemTimeZoneInformation ^ SystemImageFileExecutionOptionsInformation ��� _ SystemCoverageInformation ` SystemPrefetchPatchInformation ��� a SystemVerifierFaultsInformation �� b SystemSystemPartitionInformation � c SystemSystemDiskInformation �� d SystemProcessorPerformanceDistribution ��� e SystemNumaProximityNodeInformation ��� f SystemDynamicTimeZoneInformation � g SystemCodeIntegrityInformation ��� h SystemProcessorMicrocodeUpdateInformation i SystemProcessorBrandString ��� j SystemVirtualAddressInformation �� k SystemLogicalProcessorAndGroupInformation l SystemProcessorCycleTimeInformation �� m SystemStoreInformation ��� n SystemRegistryAppendString ��� o SystemAitSamplingValue ��� p SystemVhdBootInformation � q SystemCpuQuotaInformation r SystemNativeBasicInformation � s SystemErrorPortTimeouts �� t SystemLowPriorityIoInformation ��� u SystemBootEntropyInformation � v SystemVerifierCountersInformation w SystemPagedPoolInformationEx � x SystemSystemPtesInformationEx y SystemNodeDistanceInformation z SystemAcpiAuditInformation ��� { SystemBasicPerformanceInformation | SystemQueryPerformanceCounterInformation � } SystemSessionBigPoolInformation �� ~ SystemBootGraphicsInformation SystemScrubPhysicalMemoryInformation � � SystemBadPageInformation � � SystemProcessorProfileControlArea � SystemCombinePhysicalMemoryInformation ��� � SystemEntropyInterruptTimingInformation �� � SystemConsoleInformation � � SystemPlatformBinaryInformation �� � SystemPolicyInformation �� � SystemHypervisorProcessorCountInformation � SystemDeviceDataInformation �� � SystemDeviceDataEnumerationInformation ��� � SystemMemoryTopologyInformation �� � SystemMemoryChannelInformation ��� � SystemBootLogoInformation � SystemProcessorPerformanceInformationEx �� � SystemCriticalProcessErrorLogInformation � � SystemSecureBootPolicyInformation � SystemPageFileInformationEx �� � SystemSecureBootInformation �� � SystemEntropyInterruptTimingRawInformation ��� � SystemPortableWorkspaceEfiLauncherInformation � SystemFullProcessInformation � � SystemKernelDebuggerInformationEx � SystemBootMetadataInformation � SystemSoftRebootInformation �� � SystemElamCertificateInformation � � SystemOfflineDumpConfigInformation ��� � SystemProcessorFeaturesInformation ��� � SystemRegistryReconciliationInformation �� � SystemEdidInformation � SystemManufacturingInformation ��� � SystemEnergyEstimationConfigInformation �� � SystemHypervisorDetailInformation � SystemProcessorCycleStatsInformation � � SystemVmGenerationCountInformation ��� � SystemTrustedPlatformModuleInformation ��� � SystemKernelDebuggerFlags � SystemCodeIntegrityPolicyInformation � � SystemIsolatedUserModeInformation � SystemHardwareSecurityTestInterfaceResultsInformation � SystemSingleModuleInformation � SystemAllowedCpuSetsInformation �� � SystemVsmProtectionInformation ��� � SystemInterruptCpuSetsInformation � SystemSecureBootPolicyFullInformation � SystemCodeIntegrityPolicyFullInformation � � SystemAffinitizedInterruptProcessorInformation ��� � SystemRootSiloInformation � SystemCpuSetInformation �� � SystemCpuSetTagInformation ��� � SystemWin32WerStartCallout ��� � SystemSecureKernelProfileInformation � � SystemCodeIntegrityPlatformManifestInformation ��� � SystemInterruptSteeringInformation ��� � SystemSupportedProcessorArchitectures � SystemMemoryUsageInformation � � SystemCodeIntegrityCertificateInformation � SystemPhysicalMemoryInformation �� � SystemControlFlowTransition �� � SystemKernelDebuggingAllowed � � SystemActivityModerationExeState � � SystemActivityModerationUserSettings � � SystemCodeIntegrityPoliciesFullInformation ��� � SystemCodeIntegrityUnlockInformation � � SystemIntegrityQuotaInformation �� � SystemFlushInformation ��� � SystemProcessorIdleMaskInformation ��� � SystemSecureDumpEncryptionInformation � SystemWriteConstraintInformation � � SystemKernelVaShadowInformation �� � SystemHypervisorSharedPageInformation � SystemFirmwareBootPerformanceInformation � � SystemCodeIntegrityVerificationInformation ��� � SystemFirmwarePartitionInformation ��� � SystemSpeculationControlInformation �� � SystemDmaGuardPolicyInformation �� � SystemEnclaveLaunchControlInformation � SystemWorkloadAllowedCpuSetsInformation �� � SystemCodeIntegrityUnlockModeInformation � � SystemLeapSecondInformation �� � SystemFlags2Information �� � SystemSecurityModelInformation ��� � SystemCodeIntegritySyntheticCacheInformation � � SystemFeatureConfigurationInformation � SystemFeatureConfigurationSectionInformation � � SystemFeatureUsageSubscriptionInformation � SystemSecureSpeculationControlInformation � SystemSpacesBootInformation �� � SystemFwRamdiskInformation ��� � SystemWheaIpmiHardwareInformation � SystemDifSetRuleClassInformation � � SystemDifClearRuleClassInformation ��� � SystemDifApplyPluginVerificationOnDriver � � SystemDifRemovePluginVerificationOnDriver � SystemShadowStackInformation � � SystemBuildVersionInformation � SystemPoolLimitInformation ��� � SystemCodeIntegrityAddDynamicStore ��� � SystemCodeIntegrityClearDynamicStores � SystemPoolZeroingInformation � � MaxSystemInfoClass ���J � t � _SYSTEM_INFORMATION_CLASS .?AW4_SYSTEM_INFORMATION_CLASS@@ � � � � b � _FILE_FS_METADATA_SIZE_INFORMATION .?AU_FILE_FS_METADATA_SIZE_INFORMATION@@ ��
�
� j
� TotalMetadataAllocationUnits �
" SectorsPerAllocationUnit �
" BytesPerSector ���b � _FILE_FS_METADATA_SIZE_INFORMATION .?AU_FILE_FS_METADATA_SIZE_INFORMATION@@ �� � � | : � _MUISTRINGPOOL .?AU_MUISTRINGPOOL@@ ��
u TotalSize
! MaxNumStrings
! NumStrings ���
! MaxNumCharsInPool
!
NumCharsInPool ���
Strings ��
q Pool �: � _MUISTRINGPOOL .?AU_MUISTRINGPOOL@@ �� � t J � _MESSAGE_RESOURCE_BLOCK .?AU_MESSAGE_RESOURCE_BLOCK@@
�
� B
" LowId
" HighId ���
" OffsetToEntries ��J � _MESSAGE_RESOURCE_BLOCK .?AU_MESSAGE_RESOURCE_BLOCK@@ � g � � � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY@@ ��>
# ChangeStamp ��
Section ��
" Size � � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION_ENTRY@@ �� � � s J � _LDR_SERVICE_TAG_RECORD .?AU_LDR_SERVICE_TAG_RECORD@@
�
� *
� Next �
" ServiceTag ���J � _LDR_SERVICE_TAG_RECORD .?AU_LDR_SERVICE_TAG_RECORD@@ * onecore\internal\sdk\inc\ntldr.h ��� � � i F � tagMOUSEHOOKSTRUCTEX .?AUtagMOUSEHOOKSTRUCTEX@@ ��. � tagPOINT .?AUtagPOINT@@ ��
p
� f
� pt ���
� hwnd �
u wHitTestCode �
" dwExtraInfo ��
" mouseData F � tagMOUSEHOOKSTRUCTEX .?AUtagMOUSEHOOKSTRUCTEX@@ �� � ~ � b � _SYSTEM_VERIFIER_TRIAGE_INFORMATION .?AU_SYSTEM_VERIFIER_TRIAGE_INFORMATION@@
�
� " " � q " �z
" ActionTaken ��
� CrashData
" VerifierMode �
" VerifierFlags
� VerifierTargets ��b � _SYSTEM_VERIFIER_TRIAGE_INFORMATION .?AU_SYSTEM_VERIFIER_TRIAGE_INFORMATION@@ � � � J � _SE_IMPERSONATION_STATE .?AU_SE_IMPERSONATION_STATE@@ r SecurityAnonymous SecurityIdentification ��� SecurityImpersonation SecurityDelegation ���R t � _SECURITY_IMPERSONATION_LEVEL .?AW4_SECURITY_IMPERSONATION_LEVEL@@ � � w � R
Token
CopyOnOpen ���
EffectiveOnly
� Level J � _SE_IMPERSONATION_STATE .?AU_SE_IMPERSONATION_STATE@@ � w R
j EnlistmentBasicInformation ��� EnlistmentRecoveryInformation EnlistmentCrmInformation �R t � _ENLISTMENT_INFORMATION_CLASS .?AW4_ENLISTMENT_INFORMATION_CLASS@@ �* onecore\internal\sdk\inc\nttmapi.h � � � c
� > � _OSVERSIONINFOEXA .?AU_OSVERSIONINFOEXA@@ p " � �
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
szCSDVersion �
! � wServicePackMajor
! � wServicePackMinor
! � wSuiteMask ���
� wProductType �
� wReserved > � _OSVERSIONINFOEXA .?AU_OSVERSIONINFOEXA@@ g � J � SET_POWER_SETTING_VALUE .?AUSET_POWER_SETTING_VALUE@@
� B PoAc � PoDc � PoHot PoConditionMaximum ���F t SYSTEM_POWER_CONDITION .?AW4SYSTEM_POWER_CONDITION@@ ��� { j j
" Version ��
$ Guid �
PowerCondition ���
" DataLength ���
� Data �J SET_POWER_SETTING_VALUE .?AUSET_POWER_SETTING_VALUE@@
{ q F � _PERFINFO_VTL_CHANGE .?AU_PERFINFO_VTL_CHANGE@@ ��2
! OperationCode
! ServiceCode ��F
_PERFINFO_VTL_CHANGE .?AU_PERFINFO_VTL_CHANGE@@ �� b - J � _FILESYSTEM_STATISTICS .?AU_FILESYSTEM_STATISTICS@@ ��
! FileSystemType ���
! Version ��
" SizeOfCompleteStructure ��
" UserFileReads
" UserFileReadBytes
" UserDiskReads
" UserFileWrites ���
" UserFileWriteBytes ���
" UserDiskWrites ���
" MetaDataReads
" $ MetaDataReadBytes
" ( MetaDataDiskReads
" , MetaDataWrites ���
" 0 MetaDataWriteBytes ���
" 4 MetaDataDiskWrites ���J 8 _FILESYSTEM_STATISTICS .?AU_FILESYSTEM_STATISTICS@@ �� � : � _PS_PROTECTION .?AU_PS_PROTECTION@@ ��
�
��
��
��F
Level
Type �
Audit
Signer ���: _PS_PROTECTION .?AU_PS_PROTECTION@@ �� � [ B � _OUTLINETEXTMETRICA .?AU_OUTLINETEXTMETRICA@@
� : � tagTEXTMETRICA .?AUtagTEXTMETRICA@@ ��. � tagPANOSE .?AUtagPANOSE@@ * � tagRECT .?AUtagRECT@@ Z
u otmSize ��
otmTextMetrics ���
< otmFiller
= otmPanoseNumber ��
u H otmfsSelection ���
u L otmfsType
t P otmsCharSlopeRise
t T otmsCharSlopeRun �
t X otmItalicAngle ���
u \ otmEMSquare ��
t ` otmAscent
t d otmDescent ���
u h otmLineGap ���
u l otmsCapEmHeight ��
u p otmsXHeight ��
t otmrcFontBox �
t � otmMacAscent �
t � otmMacDescent
u � otmMacLineGap
u � otmusMinimumPPEM �
� � otmptSubscriptSize ���
� � otmptSubscriptOffset �
� � otmptSuperscriptSize �
� � otmptSuperscriptOffset ���
u � otmsStrikeoutSize
t � otmsStrikeoutPosition
t � otmsUnderscoreSize ���
t � otmsUnderscorePosition ���
p � otmpFamilyName ���
p � otmpFaceName �
p � otmpStyleName
p � otmpFullName �B ! � _OUTLINETEXTMETRICA .?AU_OUTLINETEXTMETRICA@@ " � �
$
%
� � MonitorRequestReasonUnknown �� MonitorRequestReasonPowerButton �� MonitorRequestReasonRemoteConnection � MonitorRequestReasonScMonitorpower ��� MonitorRequestReasonUserInput MonitorRequestReasonAcDcDisplayBurst � MonitorRequestReasonUserDisplayBurst � MonitorRequestReasonPoSetSystemState � MonitorRequestReasonSetThreadExecutionState �� MonitorRequestReasonFullWake �
MonitorRequestReasonSessionUnlock MonitorRequestReasonScreenOffRequest � MonitorRequestReasonIdleTimeout ��
MonitorRequestReasonPolicyChange � MonitorRequestReasonSleepButton �� MonitorRequestReasonLid �� MonitorRequestReasonBatteryCountChange ��� MonitorRequestReasonGracePeriod �� MonitorRequestReasonPnP �� MonitorRequestReasonDP ��� MonitorRequestReasonSxTransition � MonitorRequestReasonSystemIdle ��� MonitorRequestReasonNearProximity MonitorRequestReasonThermalStandby ��� MonitorRequestReasonResumePdc MonitorRequestReasonResumeS4 � MonitorRequestReasonTerminal � MonitorRequestReasonPdcSignal MonitorRequestReasonAcDcDisplayBurstSuppressed ��� MonitorRequestReasonSystemStateEntered ��� MonitorRequestReasonWinrt MonitorRequestReasonUserInputKeyboard MonitorRequestReasonUserInputMouse ��� ! MonitorRequestReasonUserInputTouch ��� " MonitorRequestReasonUserInputPen � # MonitorRequestReasonUserInputAccelerometer ��� $ MonitorRequestReasonUserInputHid � % MonitorRequestReasonUserInputPoUserPresent ��� & MonitorRequestReasonUserInputSessionSwitch ��� ' MonitorRequestReasonUserInputInitialization �� ( MonitorRequestReasonPdcSignalWindowsMobilePwrNotif ��� ) MonitorRequestReasonPdcSignalWindowsMobileShell �� * MonitorRequestReasonPdcSignalHeyCortana �� + MonitorRequestReasonPdcSignalHolographicShell , MonitorRequestReasonPdcSignalFingerprint � - MonitorRequestReasonDirectedDrips . MonitorRequestReasonDim �� / MonitorRequestReasonBuiltinPanel � 0 MonitorRequestReasonDisplayRequiredUnDim � 1 MonitorRequestReasonBatteryCountChangeSuppressed � 2 MonitorRequestReasonResumeModernStandby �� 3 MonitorRequestReasonMax ��R 4 t ' POWER_MONITOR_REQUEST_REASON .?AW4POWER_MONITOR_REQUEST_REASON@@ ��� ( { 2 � _HSM_OPCODE .?AU_HSM_OPCODE@@ "
" Tag ��
" Code �2 + _HSM_OPCODE .?AU_HSM_OPCODE@@ , � �" b � _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY@@
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" BeginAddress �
" UnwindData ���
/ Flag �
0 FunctionLength ���
1 RegF �
2 RegI �
3 H
4 CR ���
5 FrameSize b 6 _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY@@ 7 � Z PerfCSwapIdleShort ��� PerfCSwapIdle PerfCSwapLite PerfCSwapFull B t 9 _PERFINFO_CCSWAP_TYPE .?AW4_PERFINFO_CCSWAP_TYPE@@ � : b { . � _WMI_UDP .?AU_WMI_UDP@@ ��r
" PID ��
! Size �
" DestAddr �
" SrcAddr ��
! DestPort �
! SrcPort ��. = _WMI_UDP .?AU_WMI_UDP@@ �� > b J � _PERFINFO_HV_HYPERCALL .?AU_PERFINFO_HV_HYPERCALL@@ ��>
u CallCode �
IsFast ���
IsNested �J A _PERFINFO_HV_HYPERCALL .?AU_PERFINFO_HV_HYPERCALL@@ �� B b @ F � _UNIVERSAL_NAME_INFOA .?AU_UNIVERSAL_NAME_INFOA@@
D
�
p lpUniversalName ��F F _UNIVERSAL_NAME_INFOA .?AU_UNIVERSAL_NAME_INFOA@@ G � ~ � ProfileTime �� ProfileAlignmentFixup ProfileTotalIssues ��� ProfilePipelineDry ��� ProfileLoadInstructions �� ProfilePipelineFrozen ProfileBranchInstructions ProfileTotalNonissues ProfileDcacheMisses �� ProfileIcacheMisses ��
ProfileCacheMisses ��� ProfileBranchMispredictions �� ProfileStoreInstructions �
ProfileFpInstructions ProfileIntegerInstructions ��� Profile2Issue Profile3Issue Profile4Issue ProfileSpecialInstructions ��� ProfileTotalCycles ��� ProfileIcacheIssues �� ProfileDcacheAccesses ProfileMemoryBarrierCycles ��� ProfileLoadLinkedIssues �� ProfileMaximum ���: t I _KPROFILE_SOURCE .?AW4_KPROFILE_SOURCE@@ ���. onecore\internal\sdk\inc\ntkeapi_x.h ��� J K � Z � _USER_MARSHAL_ROUTINE_QUADRUPLE .?AU_USER_MARSHAL_ROUTINE_QUADRUPLE@@ " " " N
O
� " Q
R
�
R
� " U
V
� ^
P pfnBufferSize
S pfnMarshall ��
T pfnUnmarshall
W pfnFree ��Z X _USER_MARSHAL_ROUTINE_QUADRUPLE .?AU_USER_MARSHAL_ROUTINE_QUADRUPLE@@ Y � n . � __n128x2 .?AU__n128x2@@ ��" �" __n128 .?AT__n128@@ �� \ " �
] val ��. ^ __n128x2 .?AU__n128x2@@ �� _ % ` > � tagENHMETAHEADER .?AUtagENHMETAHEADER@@ ��
a
� * � _RECTL .?AU_RECTL@@ ��* � tagSIZE .?AUtagSIZE@@ �
" iType
" nSize
c rclBounds
c rclFrame �
" ( dSignature ���
" , nVersion �
" 0 nBytes ���
" 4 nRecords �
! 8 nHandles �
! : sReserved
" < nDescription �
" @ offDescription ���
" D nPalEntries ��
d H szlDevice
d P szlMillimeters ���
" X cbPixelFormat
" \ offPixelFormat ���
" ` bOpenGL ��
d d szlMicrometers ���> e l tagENHMETAHEADER .?AUtagENHMETAHEADER@@ �� f � ; JobObjectBasicAccountingInformation �� JobObjectBasicLimitInformation ��� JobObjectBasicProcessIdList �� JobObjectBasicUIRestrictions � JobObjectSecurityLimitInformation JobObjectEndOfJobTimeInformation � JobObjectAssociateCompletionPortInformation �� JobObjectBasicAndIoAccountingInformation � JobObjectExtendedLimitInformation
JobObjectJobSetInformation ��� JobObjectGroupInformation JobObjectNotificationLimitInformation
JobObjectLimitViolationInformation ��� JobObjectGroupInformationEx �� JobObjectCpuRateControlInformation ��� JobObjectCompletionFilter JobObjectCompletionCounter ��� JobObjectFreezeInformation ��� JobObjectExtendedAccountingInformation ��� JobObjectWakeInformation � JobObjectBackgroundInformation ��� JobObjectSchedulingRankBiasInformation ��� JobObjectTimerVirtualizationInformation �� JobObjectCycleTimeNotification ��� JobObjectClearEvent �� JobObjectInterferenceInformation � JobObjectClearPeakJobMemoryUsed �� JobObjectMemoryUsageInformation �� JobObjectSharedCommit JobObjectContainerId � JobObjectIoRateControlInformation % JobObjectSiloRootDirectory ��� & JobObjectServerSiloBasicInformation �� ' JobObjectServerSiloUserSharedData ( JobObjectServerSiloInitialize ) JobObjectServerSiloRunningState �� * JobObjectIoAttribution ��� + JobObjectMemoryPartitionInformation �� , JobObjectContainerTelemetryId - JobObjectSiloSystemRoot �� . JobObjectEnergyTrackingState � / JobObjectThreadImpersonationInformation �� JobObjectReserved1Information JobObjectReserved2Information JobObjectReserved3Information JobObjectReserved4Information JobObjectReserved5Information JobObjectReserved6Information JobObjectReserved7Information JobObjectReserved8Information JobObjectReserved9Information JobObjectReserved10Information ��� JobObjectReserved11Information ��� JobObjectReserved12Information ��� JobObjectReserved13Information ��� JobObjectReserved14Information ��� JobObjectNetRateControlInformation ��� ! JobObjectNotificationLimitInformation2 ��� " JobObjectLimitViolationInformation2 �� # JobObjectCreateSilo �� $ JobObjectSiloBasicInformation % JobObjectReserved15Information ��� & JobObjectReserved16Information ��� ' JobObjectReserved17Information ��� ( JobObjectReserved18Information ��� ) JobObjectReserved19Information ��� * JobObjectReserved20Information ��� + JobObjectReserved21Information ��� , JobObjectReserved22Information ��� - JobObjectReserved23Information ��� . JobObjectReserved24Information ��� / JobObjectReserved25Information ��� 0 MaxJobObjectInfoClass > I t h _JOBOBJECTINFOCLASS .?AW4_JOBOBJECTINFOCLASS@@ � i D P ObjectBasicInformation ��� ObjectNameInformation ObjectTypeInformation ObjectTypesInformation ��� ObjectHandleFlagInformation �� ObjectSessionInformation � ObjectSessionObjectInformation ��� MaxObjectInfoClass ���J t k _OBJECT_INFORMATION_CLASS .?AW4_OBJECT_INFORMATION_CLASS@@ �. onecore\internal\sdk\inc\ntobapi_x.h ��� l m e Z � _IMAGE_DYNAMIC_RELOCATION_TABLE .?AU_IMAGE_DYNAMIC_RELOCATION_TABLE@@ &
" Version ��
" Size �Z p _IMAGE_DYNAMIC_RELOCATION_TABLE .?AU_IMAGE_DYNAMIC_RELOCATION_TABLE@@ q � � � InternalWakeSourceDozeToHibernate InternalWakeSourcePredictedUserPresence �� InternalWakeSourceTimerOverride ��R t s PO_INTERNAL_WAKE_SOURCE_TYPE .?AW4PO_INTERNAL_WAKE_SOURCE_TYPE@@ ��� t {
� PsAttributeParentProcess � PsAttributeDebugObject ��� PsAttributeToken � PsAttributeClientId �� PsAttributeTebAddress PsAttributeImageName � PsAttributeImageInfo � PsAttributeMemoryReserve � PsAttributePriorityClass � PsAttributeErrorMode �
PsAttributeStdHandleInfo � PsAttributeHandleList PsAttributeGroupAffinity �
PsAttributePreferredNode � PsAttributeIdealProcessor PsAttributeUmsThread � PsAttributeMitigationOptions � PsAttributeProtectionLevel ��� PsAttributeSecureProcess � PsAttributeJobList ��� PsAttributeChildProcessPolicy PsAttributeAllApplicationPackagesPolicy �� PsAttributeWin32kFilter �� PsAttributeSafeOpenPromptOriginClaim � PsAttributeBnoIsolation �� PsAttributeDesktopAppPolicy �� PsAttributeChpe �� PsAttributeMitigationAuditOptions PsAttributeMax ���: t v _PS_ATTRIBUTE_NUM .?AW4_PS_ATTRIBUTE_NUM@@ � w � � SystemPowerPolicyAc �� SystemPowerPolicyDc �� VerifySystemPolicyAc � VerifySystemPolicyDc � SystemPowerCapabilities �� SystemBatteryState ��� SystemPowerStateHandler �� ProcessorStateHandler SystemPowerPolicyCurrent � AdministratorPowerPolicy �
SystemReserveHiberFile ��� ProcessorInformation � SystemPowerInformation ���
ProcessorStateHandler2 ��� LastWakeTime � LastSleepTime SystemExecutionState � SystemPowerStateNotifyHandler ProcessorPowerPolicyAc ��� ProcessorPowerPolicyDc ��� VerifyProcessorPowerPolicyAc � VerifyProcessorPowerPolicyDc � ProcessorPowerPolicyCurrent �� SystemPowerStateLogging �� SystemPowerLoggingEntry �� SetPowerSettingValue � NotifyUserPowerSetting ��� PowerInformationLevelUnused0 � SystemMonitorHiberBootPowerOff ��� SystemVideoState � TraceApplicationPowerMessage � TraceApplicationPowerMessageEnd �� ProcessorPerfStates �� ! ProcessorIdleStates �� " ProcessorCap � # SystemWakeSource � $ SystemHiberFileInformation ��� % TraceServicePowerMessage � & ProcessorLoad ' PowerShutdownNotification ( MonitorCapabilities �� ) SessionPowerInit � * SessionDisplayState �� + PowerRequestCreate ��� , PowerRequestAction ��� - GetPowerRequestList �� . ProcessorInformationEx ��� / NotifyUserModeLegacyPowerEvent ��� 0 GroupPark 1 ProcessorIdleDomains � 2 WakeTimerList 3 SystemHiberFileSize �� 4 ProcessorIdleStatesHv 5 ProcessorPerfStatesHv 6 ProcessorPerfCapHv ��� 7 ProcessorSetIdle � 8 LogicalProcessorIdling ��� 9 UserPresence � : PowerSettingNotificationName � ; GetPowerSettingValue � < IdleResiliency ��� = SessionRITState �� > SessionConnectNotification ��� ? SessionPowerCleanup �� @ SessionLockState � A SystemHiberbootState � B PlatformInformation �� C PdcInvocation D MonitorInvocation E FirmwareTableInformationRegistered ��� F SetShutdownSelectedTime �� G SuspendResumeInvocation �� H PlmPowerRequestCreate I ScreenOff J CsDeviceNotification � K PlatformRole � L LastResumePerformance M DisplayBurst � N ExitLatencySamplingPercentage O RegisterSpmPowerSettings � P PlatformIdleStates ��� Q ProcessorIdleVeto R PlatformIdleVeto � S SystemBatteryStatePrecise T ThermalEvent � U PowerRequestActionInternal ��� V BatteryDeviceState ��� W PowerInformationInternal � X ThermalStandby ��� Y SystemHiberFileType �� Z PhysicalPowerButtonPress � [ QueryPotentialDripsConstraint \ EnergyTrackerCreate �� ] EnergyTrackerQuery ��� ^ UpdateBlackBoxRecorder ��� _ SessionAllowExternalDmaDevices ��� ` PowerInformationLevelMaximum �F a t y POWER_INFORMATION_LEVEL .?AW4POWER_INFORMATION_LEVEL@@ � z { q ^
FileDirectoryInformation � FileFullDirectoryInformation � FileBothDirectoryInformation � FileBasicInformation � FileStandardInformation �� FileInternalInformation �� FileEaInformation FileAccessInformation FileNameInformation ��
FileRenameInformation FileLinkInformation �� FileNamesInformation �
FileDispositionInformation ��� FilePositionInformation �� FileFullEaInformation FileModeInformation �� FileAlignmentInformation � FileAllInformation ��� FileAllocationInformation FileEndOfFileInformation � FileAlternateNameInformation � FileStreamInformation FilePipeInformation �� FilePipeLocalInformation � FilePipeRemoteInformation FileMailslotQueryInformation � FileMailslotSetInformation ��� FileCompressionInformation ��� FileObjectIdInformation �� FileCompletionInformation FileMoveClusterInformation ��� FileQuotaInformation � ! FileReparsePointInformation �� " FileNetworkOpenInformation ��� # FileAttributeTagInformation �� $ FileTrackingInformation �� % FileIdBothDirectoryInformation ��� & FileIdFullDirectoryInformation ��� ' FileValidDataLengthInformation ��� ( FileShortNameInformation � ) FileIoCompletionNotificationInformation �� * FileIoStatusBlockRangeInformation + FileIoPriorityHintInformation , FileSfioReserveInformation ��� - FileSfioVolumeInformation . FileHardLinkInformation �� / FileProcessIdsUsingFileInformation ��� 0 FileNormalizedNameInformation 1 FileNetworkPhysicalNameInformation ��� 2 FileIdGlobalTxDirectoryInformation ��� 3 FileIsRemoteDeviceInformation 4 FileUnusedInformation 5 FileNumaNodeInformation �� 6 FileStandardLinkInformation �� 7 FileRemoteProtocolInformation 8 FileRenameInformationBypassAccessCheck ��� 9 FileLinkInformationBypassAccessCheck � : FileVolumeNameInformation ; FileIdInformation < FileIdExtdDirectoryInformation ��� = FileReplaceCompletionInformation � > FileHardLinkFullIdInformation ? FileIdExtdBothDirectoryInformation ��� @ FileDispositionInformationEx � A FileRenameInformationEx �� B FileRenameInformationExBypassAccessCheck � C FileDesiredStorageClassInformation ��� D FileStatInformation �� E FileMemoryPartitionInformation ��� F FileStatLxInformation G FileCaseSensitiveInformation � H FileLinkInformationEx I FileLinkInformationExBypassAccessCheck ��� J FileStorageReserveIdInformation �� K FileCaseSensitiveInformationForceAccessCheck � L FileMaximumInformation ���F L t | _FILE_INFORMATION_CLASS .?AW4_FILE_INFORMATION_CLASS@@ � } � \ V � _ENUM_SERVICE_STATUS_PROCESSA .?AU_ENUM_SERVICE_STATUS_PROCESSA@@ J � _SERVICE_STATUS_PROCESS .?AU_SERVICE_STATUS_PROCESS@@ R
p lpServiceName
p lpDisplayName
� ServiceStatusProcess �V � , _ENUM_SERVICE_STATUS_PROCESSA .?AU_ENUM_SERVICE_STATUS_PROCESSA@@ � � J � SERVICE_STATUS_HANDLE__ .?AUSERVICE_STATUS_HANDLE__@@
�
�
t unused ���J � SERVICE_STATUS_HANDLE__ .?AUSERVICE_STATUS_HANDLE__@@ � � � q " t �
�
� � RtlPathTypeUnknown ��� RtlPathTypeUncAbsolute ��� RtlPathTypeDriveAbsolute � RtlPathTypeDriveRelative � RtlPathTypeRooted RtlPathTypeRelative �� RtlPathTypeLocalDevice ��� RtlPathTypeRootLocalDevice ���6 t � _RTL_PATH_TYPE .?AW4_RTL_PATH_TYPE@@ ��� � � g � PlugPlayControlEnumerateDevice ��� PlugPlayControlRegisterNewDevice � PlugPlayControlDeregisterDevice �� PlugPlayControlInitializeDevice �� PlugPlayControlStartDevice ��� PlugPlayControlUnlockDevice �� PlugPlayControlQueryAndRemoveDevice �� PlugPlayControlUserResponse �� PlugPlayControlGenerateLegacyDevice �� PlugPlayControlGetInterfaceDeviceList
PlugPlayControlProperty �� PlugPlayControlDeviceClassAssociation PlugPlayControlGetRelatedDevice ��
PlugPlayControlGetInterfaceDeviceAlias ��� PlugPlayControlDeviceStatus �� PlugPlayControlGetDeviceDepth PlugPlayControlQueryDeviceRelations �� PlugPlayControlTargetDeviceRelation �� PlugPlayControlQueryConflictList � PlugPlayControlRetrieveDock �� PlugPlayControlResetDevice ��� PlugPlayControlHaltDevice PlugPlayControlGetBlockedDriverList �� PlugPlayControlGetDeviceInterfaceEnabled � MaxPlugPlayControl ���F t � _PLUGPLAY_CONTROL_CLASS .?AW4_PLUGPLAY_CONTROL_CLASS@@ � � $ � LockQueueUnusedSpare0 LockQueueUnusedSpare1 LockQueueUnusedSpare2 LockQueueUnusedSpare3 LockQueueVacbLock LockQueueMasterLock �� LockQueueNonPagedPoolLock LockQueueIoCancelLock LockQueueUnusedSpare8 LockQueueIoVpbLock ���
LockQueueIoDatabaseLock �� LockQueueIoCompletionLock LockQueueNtfsStructLock ��
LockQueueAfdWorkQueueLock LockQueueBcbLock � LockQueueUnusedSpare15 ��� LockQueueUnusedSpare16 ��� LockQueueMaximumLock �J t � _KSPIN_LOCK_QUEUE_NUMBER .?AW4_KSPIN_LOCK_QUEUE_NUMBER@@ ��� � K | Z � _HEAP_REUSE_THRESHOLD_ACTIVATED .?AU_HEAP_REUSE_THRESHOLD_ACTIVATED@@ ^
m Header ���
HeapHandle ���
$ SubSegment ���
" ( BucketIndex ��Z � , _HEAP_REUSE_THRESHOLD_ACTIVATED .?AU_HEAP_REUSE_THRESHOLD_ACTIVATED@@ � b � � AccessReasonNone � � AccessReasonAllowedAce ��� � AccessReasonDeniedAce � AccessReasonAllowedParentAce � � AccessReasonDeniedParentAce �� � AccessReasonNotGrantedByCape � � AccessReasonNotGrantedByParentCape ��� � AccessReasonNotGrantedToAppContainer � � AccessReasonMissingPrivilege � � AccessReasonFromPrivilege � 0 AccessReasonIntegrityLevel ��� � @ AccessReasonOwnership � P AccessReasonNullDacl � � ` AccessReasonEmptyDacl � p AccessReasonNoSD � � � AccessReasonNoGrant �� � � AccessReasonTrustLabel ��� � � AccessReasonFilterAce > t � _ACCESS_REASON_TYPE .?AW4_ACCESS_REASON_TYPE@@ � � w � b � _PERFINFO_DRIVER_MAJORFUNCTION_RET .?AU_PERFINFO_DRIVER_MAJORFUNCTION_RET@@ ��*
Irp ��
" UniqMatchId ��b � _PERFINFO_DRIVER_MAJORFUNCTION_RET .?AU_PERFINFO_DRIVER_MAJORFUNCTION_RET@@ �� � b � * COMIMAGE_FLAGS_ILONLY COMIMAGE_FLAGS_32BITREQUIRED � COMIMAGE_FLAGS_IL_LIBRARY COMIMAGE_FLAGS_STRONGNAMESIGNED �� COMIMAGE_FLAGS_NATIVE_ENTRYPOINT � � COMIMAGE_FLAGS_TRACKDEBUGDATA � COMIMAGE_FLAGS_32BITPREFERRED COR_VERSION_MAJOR_V2 � COR_VERSION_MAJOR COR_VERSION_MINOR COR_DELETED_NAME_LENGTH �� COR_VTABLEGAP_NAME_LENGTH NATIVE_TYPE_MAX_CB ��� � COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE � IMAGE_COR_MIH_METHODRVA �� IMAGE_COR_MIH_EHRVA �� IMAGE_COR_MIH_BASICBLOCK � COR_VTABLE_32BIT � COR_VTABLE_64BIT � COR_VTABLE_FROM_UNMANAGED COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN ��� COR_VTABLE_CALL_MOST_DERIVED � IMAGE_COR_EATJ_THUNK_SIZE MAX_CLASS_NAME ��� MAX_PACKAGE_NAME �R t � ReplacesCorHdrNumericDefines .?AW4ReplacesCorHdrNumericDefines@@ ��� � � � V � _GENERIC_BINDING_ROUTINE_PAIR .?AU_GENERIC_BINDING_ROUTINE_PAIR@@
�
�
�
�
� �
�
� *
� pfnBind ��
� pfnUnbind V � _GENERIC_BINDING_ROUTINE_PAIR .?AU_GENERIC_BINDING_ROUTINE_PAIR@@ � � 5 R � _MEMORY_BASIC_INFORMATION64 .?AU_MEMORY_BASIC_INFORMATION64@@ �
# BaseAddress ��
# AllocationBase ���
" AllocationProtect
" __alignment1 �
# RegionSize ���
" State
" $ Protect ��
" ( Type �
" , __alignment2 �R � 0 _MEMORY_BASIC_INFORMATION64 .?AU_MEMORY_BASIC_INFORMATION64@@ � � i ^ � _LEAP_SECOND_DATA_REGISTRY_ENTRY .?AU_LEAP_SECOND_DATA_REGISTRY_ENTRY@@ ��
�
� f
Year �
Month
Day ��
Hour �
Flags
Reserved �^ � _LEAP_SECOND_DATA_REGISTRY_ENTRY .?AU_LEAP_SECOND_DATA_REGISTRY_ENTRY@@ �� � � � * � __n64x4 .?AU__n64x4@@ " �
� val ��* � __n64x4 .?AU__n64x4@@ � % [ > � tagCANDIDATEFORM .?AUtagCANDIDATEFORM@@ ��
�
� V
" dwIndex ��
" dwStyle ��
� ptCurrentPos �
rcArea ���> � tagCANDIDATEFORM .?AUtagCANDIDATEFORM@@ ��& onecore\external\sdk\inc\imm.h � � � < R � _FILE_IO_PRIORITY_HINT_INFO .?AU_FILE_IO_PRIORITY_HINT_INFO@@
�
� r IoPriorityHintVeryLow IoPriorityHintLow IoPriorityHintNormal � MaximumIoPriorityHintType 6 t � _PRIORITY_HINT .?AW4_PRIORITY_HINT@@ ��� � n �"
� PriorityHint �R � _FILE_IO_PRIORITY_HINT_INFO .?AU_FILE_IO_PRIORITY_HINT_INFO@@ � n �" � � � � J � _IO_RESOURCE_DESCRIPTOR .?AU_IO_RESOURCE_DESCRIPTOR@@ b
" Length ���
" Alignment
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � b
" Length ���
" Alignment
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � IrqPolicyMachineDefault �� IrqPolicyAllCloseProcessors �� IrqPolicyOneCloseProcessor ��� IrqPolicyAllProcessorsInMachine �� IrqPolicySpecifiedProcessors � IrqPolicySpreadMessagesAcrossAllProcessors ��� IrqPolicyAllProcessorsInMachineWhenSteered ���> t � _IRQ_DEVICE_POLICY .?AW4_IRQ_DEVICE_POLICY@@ ��� � x f IrqPriorityUndefined � IrqPriorityLow ��� IrqPriorityNormal IrqPriorityHigh ��2 t � _IRQ_PRIORITY .?AW4_IRQ_PRIORITY@@ � � � �
" MinimumVector
" MaximumVector
� AffinityPolicy ���
� PriorityPolicy ���
" TargetedProcessors ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � :
" MinimumChannel ���
" MaximumChannel ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � Z
" RequestLine ��
" Reserved �
" Channel ��
" TransferWidth : � <anonymous-tag> .?AU<anonymous-tag>@@ � � b
" Length ���
" Alignment
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � �
� Data �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � Z
" Length ���
" MinBusNumber �
" MaxBusNumber �
" Reserved �: � <anonymous-tag> .?AU<anonymous-tag>@@ � � >
" Priority �
" Reserved1
" Reserved2 : � <anonymous-tag> .?AU<anonymous-tag>@@ � � f
" Length40 �
" Alignment40 ��
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � f
" Length48 �
" Alignment48 ��
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � f
" Length64 �
" Alignment64 ��
� MinimumAddress ���
� MaximumAddress ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � v
Class
Type �
Reserved1
Reserved2
" IdLowPart
" IdHighPart ���: � <anonymous-tag> .?AU<anonymous-tag>@@ �
� Port �
� Memory ���
� Interrupt
� Dma ��
� DmaV3
� Generic ��
� DevicePrivate
� BusNumber
� ConfigData ���
� Memory40 �
� Memory48 �
� Memory64 �
� Connection ���2
� <anonymous-tag> .?AT<anonymous-tag>@@ � � �
Option ���
Type �
ShareDisposition �
Spare1 ���
! Flags
! Spare2 ���
� u J � _IO_RESOURCE_DESCRIPTOR .?AU_IO_RESOURCE_DESCRIPTOR@@ � � > KeyBasicInformation �� KeyNodeInformation ��� KeyFullInformation ��� KeyNameInformation ��� KeyCachedInformation � KeyFlagsInformation �� KeyVirtualizationInformation � KeyHandleTagsInformation � KeyTrustInformation �� KeyLayerInformation ��
MaxKeyInfoClass ��F t _KEY_INFORMATION_CLASS .?AW4_KEY_INFORMATION_CLASS@@ ���. onecore\internal\sdk\inc\ntregapi_x.h �� b � _SYSTEM_SECURITY_MODEL_INFORMATION .?AU_SYSTEM_SECURITY_MODEL_INFORMATION@@ ��
" ��
" ��
" ��f
SModeAdminlessEnabled
AllowDeviceOwnerProtectionDowngrade ��
Reserved �: <anonymous-tag> .?AU<anonymous-tag>@@ � <
"
SecurityModelFlags ���b _SYSTEM_SECURITY_MODEL_INFORMATION .?AU_SYSTEM_SECURITY_MODEL_INFORMATION@@ �� � ;
3
� z � _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY@@ ��b
� UserShadowStack ��
� SetContextIpValidation ���
� BlockNonCetBinaries ��z _RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_RTL_IMAGE_MITIGATION_USER_SHADOW_STACK_POLICY@@ �� ^ V � _FILE_PIPE_LOCAL_INFORMATION .?AU_FILE_PIPE_LOCAL_INFORMATION@@ ��
�
" NamedPipeType
" NamedPipeConfiguration ���
" MaximumInstances �
" CurrentInstances �
" InboundQuota �
" ReadDataAvailable
" OutboundQuota
" WriteQuotaAvailable ��
" NamedPipeState ���
" $ NamedPipeEnd �V
( _FILE_PIPE_LOCAL_INFORMATION .?AU_FILE_PIPE_LOCAL_INFORMATION@@ �� � M � LearningModeLogLevelPassive �� LearningModeLogLevelNormalApc LearningModeLogLevelSpecialApc ��� LearningModeLogLevelMax ��J t _LEARNING_MODE_LOG_LEVEL .?AW4_LEARNING_MODE_LOG_LEVEL@@ ��� � � ^ � _IMAGE_RESOURCE_DIRECTORY_STRING .?AU_IMAGE_RESOURCE_DIRECTORY_STRING@@ ��
� p " �.
! Length ���
NameString ���^ _IMAGE_RESOURCE_DIRECTORY_STRING .?AU_IMAGE_RESOURCE_DIRECTORY_STRING@@ �� � f 2 � DLGTEMPLATE .?AUDLGTEMPLATE@@
! ��
"
� v
" style
" dwExtendedStyle ��
! cdit �
x
y
cx ���
cy ���2 $ DLGTEMPLATE .?AUDLGTEMPLATE@@ % ~ ( J � tagEMRSETVIEWPORTEXTEX .?AUtagEMRSETVIEWPORTEXTEX@@ ��
'
� &
� emr ��
d szlExtent J ) tagEMRSETVIEWPORTEXTEX .?AUtagEMRSETVIEWPORTEXTEX@@ �� * � � R CacheUnified � CacheInstruction � CacheData CacheTrace ���B t , _PROCESSOR_CACHE_TYPE .?AW4_PROCESSOR_CACHE_TYPE@@ � - � � J � _QUERY_SERVICE_CONFIGA .?AU_QUERY_SERVICE_CONFIGA@@ ���
" dwServiceType
" dwStartType ��
" dwErrorControl ���
p lpBinaryPathName �
p lpLoadOrderGroup �
" dwTagId ��
p lpDependencies ���
p lpServiceStartName ���
p lpDisplayName J 0 $ _QUERY_SERVICE_CONFIGA .?AU_QUERY_SERVICE_CONFIGA@@ �� 1 � 0 > � tagMSGBOXPARAMSA .?AUtagMSGBOXPARAMSA@@ ��
�
� 2 � tagHELPINFO .?AUtagHELPINFO@@
5
�
6 7
8
� �
u cbSize ���
� hwndOwner
4 hInstance
� lpszText �
� lpszCaption ��
" dwStyle ��
� lpszIcon �
" dwContextHelpId ��
9 lpfnMsgBoxCallback ���
" $ dwLanguageId �>
: ( tagMSGBOXPARAMSA .?AUtagMSGBOXPARAMSA@@ �� ; ~ $ V � _KEY_VALUE_LAYER_INFORMATION .?AU_KEY_VALUE_LAYER_INFORMATION@@ ��
" ��
" ��.
> IsTombstone ��
? Reserved �V @ _KEY_VALUE_LAYER_INFORMATION .?AU_KEY_VALUE_LAYER_INFORMATION@@ �� A f F � _PEBS_DS_SAVE_AREA32 .?AU_PEBS_DS_SAVE_AREA32@@ ��
C
� # " @ �"
" BtsBufferBase
" BtsIndex �
" BtsAbsoluteMaximum ���
" BtsInterruptThreshold
" PebsBufferBase ���
" PebsIndex
" PebsAbsoluteMaximum ��
" PebsInterruptThreshold ���
E PebsGpCounterReset ���
8 ` PebsFixedCounterReset F
F � _PEBS_DS_SAVE_AREA32 .?AU_PEBS_DS_SAVE_AREA32@@ �� G � � . � tagXFORM .?AUtagXFORM@@ ��b
@ eM11 �
@ eM12 �
@ eM21 �
@ eM22 �
@ eDx ��
@ eDy ��.
J tagXFORM .?AUtagXFORM@@ �� K � N V � _ACTIVATION_CONTEXT_MSIX_INFO .?AU_ACTIVATION_CONTEXT_MSIX_INFO@@ q " �&
N ApplicationUserModelId ���V O _ACTIVATION_CONTEXT_MSIX_INFO .?AU_ACTIVATION_CONTEXT_MSIX_INFO@@ P � / J � _FILE_STAT_INFORMATION .?AU_FILE_STAT_INFORMATION@@ ��
� FileId ���
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( AllocationSize ���
� 0 EndOfFile
" 8 FileAttributes ���
" < ReparseTag ���
" @ NumberOfLinks
" D EffectiveAccess ��J S H _FILE_STAT_INFORMATION .?AU_FILE_STAT_INFORMATION@@ �� T � I ^ � _PERFINFO_FILEOBJECT_INFORMATION .?AU_PERFINFO_FILEOBJECT_INFORMATION@@ ��
V
�
FileObject ���^ X _PERFINFO_FILEOBJECT_INFORMATION .?AU_PERFINFO_FILEOBJECT_INFORMATION@@ �� Y b c f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W@@ ��
TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
q ServerCertificateSubject �
ProxyCredentials �
" NumberOfProxyAuthnSchemes
" ProxyAuthnSchemes f \ $ _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_W@@ ��. onecore\external\shared\inc\rpcdce.h ��� ] ^ � F � tagPOINTER_TYPE_INFO .?AUtagPOINTER_TYPE_INFO@@ ��
`
� F � tagPOINTER_TOUCH_INFO .?AUtagPOINTER_TOUCH_INFO@@ B � tagPOINTER_PEN_INFO .?AUtagPOINTER_PEN_INFO@@ :
" type �
b touchInfo
c penInfo ��F d � tagPOINTER_TYPE_INFO .?AUtagPOINTER_TYPE_INFO@@ �� e ~ H � DISPLAYCONFIG_TOPOLOGY_INTERNAL �� DISPLAYCONFIG_TOPOLOGY_CLONE � DISPLAYCONFIG_TOPOLOGY_EXTEND DISPLAYCONFIG_TOPOLOGY_EXTERNAL �� ��DISPLAYCONFIG_TOPOLOGY_FORCE_UINT32 �J t g DISPLAYCONFIG_TOPOLOGY_ID .?AW4DISPLAYCONFIG_TOPOLOGY_ID@@ � h � � � $ V � _FILE_ID_EXTD_DIR_INFORMATION .?AU_FILE_ID_EXTD_DIR_INFORMATION@@
k
� 6 � _FILE_ID_128 .?AU_FILE_ID_128@@ ��V
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
" D ReparsePointTag ��
m H FileId ���
X FileName �V n ` _FILE_ID_EXTD_DIR_INFORMATION .?AU_FILE_ID_EXTD_DIR_INFORMATION@@ o � @ Z � _KAFFINITY_ENUMERATION_CONTEXT .?AU_KAFFINITY_ENUMERATION_CONTEXT@@ ��6 � _KAFFINITY_EX .?AU_KAFFINITY_EX@@
r
� F
s Affinity �
" CurrentMask ��
! CurrentIndex �Z t _KAFFINITY_ENUMERATION_CONTEXT .?AU_KAFFINITY_ENUMERATION_CONTEXT@@ ��* onecore\internal\sdk\inc\affinity.h u v s : � tagKERNINGPAIR .?AUtagKERNINGPAIR@@ ��B
! wFirst ���
! wSecond ��
t iKernAmount ��: y tagKERNINGPAIR .?AUtagKERNINGPAIR@@ �� z � $ R � _UMS_SCHEDULER_STARTUP_INFO .?AU_UMS_SCHEDULER_STARTUP_INFO@@
|
�
_
� j
" UmsVersion ���
CompletionList ���
~ SchedulerProc
SchedulerParam ���R _UMS_SCHEDULER_STARTUP_INFO .?AU_UMS_SCHEDULER_STARTUP_INFO@@ � n 2 B � _WMI_PNP_RECORD_V3 .?AU_WMI_PNP_RECORD_V3@@ ��f
" IDLength �
" DescriptionLength
" FriendlyNameLength ���
Strings ��B � _WMI_PNP_RECORD_V3 .?AU_WMI_PNP_RECORD_V3@@ �� � b � b � _FILE_ID_EXTD_BOTH_DIR_INFORMATION .?AU_FILE_ID_EXTD_BOTH_DIR_INFORMATION@@ ��
�
� q " �
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
" D ReparsePointTag ��
m H FileId ���
p X ShortNameLength ��
� Z ShortName
r FileName �b � x _FILE_ID_EXTD_BOTH_DIR_INFORMATION .?AU_FILE_ID_EXTD_BOTH_DIR_INFORMATION@@ �� � � Q R � _PROCESS_HANDLE_INFORMATION .?AU_PROCESS_HANDLE_INFORMATION@@
�
� >
" HandleCount ��
" HandleCountHighWatermark �R � _PROCESS_HANDLE_INFORMATION .?AU_PROCESS_HANDLE_INFORMATION@@ � � # ^ � _EVENT_TRACE_SPINLOCK_INFORMATION .?AU_EVENT_TRACE_SPINLOCK_INFORMATION@@
�
� �
? EventTraceInformationClass ���
" SpinLockSpinThreshold
" SpinLockAcquireSampleRate
" SpinLockContentionSampleRate �
" SpinLockHoldThreshold ^ � _EVENT_TRACE_SPINLOCK_INFORMATION .?AU_EVENT_TRACE_SPINLOCK_INFORMATION@@ � @ J � _TRACE_LOGFILE_HEADER64 .?AU_TRACE_LOGFILE_HEADER64@@
�
� f
MajorVersion �
MinorVersion �
SubVersion ���
SubMinorVersion ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � � J � _TIME_ZONE_INFORMATION .?AU_TIME_ZONE_INFORMATION@@ ��.
" BufferSize ���
" Version ��
� VersionDetail
" ProviderVersion ��
" NumberOfProcessors ���
� EndTime ��
" TimerResolution ��
" MaximumFileSize ��
" LogFileMode ��
" $ BuffersWritten ���
$ ( LogInstanceGuid ��
" ( StartBuffers �
" , PointerSize ��
" 0 EventsLost ���
" 4 CpuSpeedInMHz
# 8 LoggerName ���
# @ LogFileName ��
� H TimeZone �
� � BootTime �
� PerfFreq �
� StartTime
" ReservedFlags
" BuffersLost ��J � _TRACE_LOGFILE_HEADER64 .?AU_TRACE_LOGFILE_HEADER64@@ � � B � _RESUME_PERFORMANCE .?AU_RESUME_PERFORMANCE@@
�
� Z
" PostTimeMs ���
# TotalResumeTimeMs
# ResumeCompleteTimestamp ��B � _RESUME_PERFORMANCE .?AU_RESUME_PERFORMANCE@@ � { ` � FpFormatFp32 � FpFormatFp64 � FpFormatFp80 � FpFormatFp128 FpFormatI16 �� FpFormatI32 �� FpFormatI64 �� FpFormatU16 �� FpFormatU32 �� FpFormatU64 ��
FpFormatCompare �� FpFormatString ���: t � _FP__IEEE_FORMAT .?AW4_FP__IEEE_FORMAT@@ ���* onecore\internal\sdk\inc\ntxcapi.h � � � U J � _APP_MEMORY_INFORMATION .?AU_APP_MEMORY_INFORMATION@@
�
� ~
# AvailableCommit ��
# PrivateCommitUsage ���
# PeakPrivateCommitUsage ���
# TotalCommitUsage �J � _APP_MEMORY_INFORMATION .?AU_APP_MEMORY_INFORMATION@@ : onecore\external\sdk\inc\minwin\processthreadsapi.h � � � B � tagWNODE_EVENT_ITEM .?AUtagWNODE_EVENT_ITEM@@
�
� 6 � _WNODE_HEADER .?AU_WNODE_HEADER@@
� WnodeHeader ��B � 0 tagWNODE_EVENT_ITEM .?AUtagWNODE_EVENT_ITEM@@ . onecore\external\shared\inc\wmistr.h ��� � � J � _POWER_IDLE_RESILIENCY .?AU_POWER_IDLE_RESILIENCY@@ ��>
" CoalescingTimeout
" IdleResiliencyPeriod �J � _POWER_IDLE_RESILIENCY .?AU_POWER_IDLE_RESILIENCY@@ �� � { > PsProtectedSignerNone PsProtectedSignerAuthenticode PsProtectedSignerCodeGen � PsProtectedSignerAntimalware � PsProtectedSignerLsa � PsProtectedSignerWindows � PsProtectedSignerWinTcb �� PsProtectedSignerWinSystem ��� PsProtectedSignerApp � PsProtectedSignerMax �B
t � _PS_PROTECTED_SIGNER .?AW4_PS_PROTECTED_SIGNER@@ ��� � � j J � _TOKEN_MANDATORY_POLICY .?AU_TOKEN_MANDATORY_POLICY@@
" Policy ���J � _TOKEN_MANDATORY_POLICY .?AU_TOKEN_MANDATORY_POLICY@@ � w � V TokenUser TokenGroups �� TokenPrivileges �� TokenOwner ��� TokenPrimaryGroup TokenDefaultDacl � TokenSource �� TokenType TokenImpersonationLevel ��
TokenStatistics �� TokenRestrictedSids �� TokenSessionId ���
TokenGroupsAndPrivileges � TokenSessionReference TokenSandBoxInert TokenAuditPolicy � TokenOrigin �� TokenElevationType ��� TokenLinkedToken � TokenElevation ��� TokenHasRestrictions � TokenAccessInformation ��� TokenVirtualizationAllowed ��� TokenVirtualizationEnabled ��� TokenIntegrityLevel �� TokenUIAccess TokenMandatoryPolicy � TokenLogonSid TokenIsAppContainer �� TokenCapabilities TokenAppContainerSid � TokenAppContainerNumber �� ! TokenUserClaimAttributes � " TokenDeviceClaimAttributes ��� # TokenRestrictedUserClaimAttributes ��� $ TokenRestrictedDeviceClaimAttributes � % TokenDeviceGroups & TokenRestrictedDeviceGroups �� ' TokenSecurityAttributes �� ( TokenIsRestricted ) TokenProcessTrustLevel ��� * TokenPrivateNameSpace + TokenSingletonAttributes � , TokenBnoIsolation - TokenChildProcessFlags ��� . TokenIsLessPrivilegedAppContainer / TokenIsSandboxed � 0 TokenOriginatingProcessTrustLevel 1 MaxTokenInfoClass J 1 t � _TOKEN_INFORMATION_CLASS .?AW4_TOKEN_INFORMATION_CLASS@@ ��� � w 8 : � tagEMRPOLYDRAW .?AUtagEMRPOLYDRAW@@ ��* � _POINTL .?AU_POINTL@@ � " � " �Z
� emr ��
c rclBounds
" cptl �
� aptl �
� $ abTypes ��: � ( tagEMRPOLYDRAW .?AUtagEMRPOLYDRAW@@ �� � � Q Z � _PROCESS_DEVICEMAP_INFORMATION .?AU_PROCESS_DEVICEMAP_INFORMATION@@ ��
DirectoryHandle ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � D " �*
" DriveMap �
� DriveType : � $ <anonymous-tag> .?AU<anonymous-tag>@@ � D "
� Set ��
� Query Z � $ _PROCESS_DEVICEMAP_INFORMATION .?AU_PROCESS_DEVICEMAP_INFORMATION@@ �� � D z GEO_NATION ��� GEO_LATITUDE � GEO_LONGITUDE GEO_ISO2 � GEO_ISO3 � GEO_RFC1766 �� GEO_LCID � GEO_FRIENDLYNAME � GEO_OFFICIALNAME �
GEO_TIMEZONES GEO_OFFICIALLANGUAGES GEO_ISO_UN_NUMBER
GEO_PARENT ��� GEO_DIALINGCODE �� GEO_CURRENCYCODE � GEO_CURRENCYSYMBOL ��� GEO_NAME � GEO_ID ���. t � SYSGEOTYPE .?AW4SYSGEOTYPE@@ ��� � V > � _OVERLAPPED_ENTRY .?AU_OVERLAPPED_ENTRY@@
�
� 2 � _OVERLAPPED .?AU_OVERLAPPED@@
�
� r
" lpCompletionKey ��
� lpOverlapped �
" Internal �
" dwNumberOfBytesTransferred ���> � _OVERLAPPED_ENTRY .?AU_OVERLAPPED_ENTRY@@ 6 onecore\external\sdk\inc\minwin\minwinbase.h ��� � � B
� Z � _IMAGE_DYNAMIC_RELOCATION64_V2 .?AU_IMAGE_DYNAMIC_RELOCATION64_V2@@ ��n
" HeaderSize ���
" FixupInfoSize
# Symbol ���
" SymbolGroup ��
" Flags Z � _IMAGE_DYNAMIC_RELOCATION64_V2 .?AU_IMAGE_DYNAMIC_RELOCATION64_V2@@ �� � � � B � tagBITMAPINFOHEADER .?AUtagBITMAPINFOHEADER@@
�
�
" biSize ���
biWidth ��
biHeight �
! biPlanes �
! biBitCount ���
" biCompression
" biSizeImage ��
biXPelsPerMeter ��
biYPelsPerMeter ��
" biClrUsed
" $ biClrImportant ���B � ( tagBITMAPINFOHEADER .?AUtagBITMAPINFOHEADER@@ � � , Z � _SYSTEM_RESOURCE_ATTRIBUTE_ACE .?AU_SYSTEM_RESOURCE_ATTRIBUTE_ACE@@ ��2 � _ACE_HEADER .?AU_ACE_HEADER@@ :
� Header ���
" Mask �
" SidStart �Z � _SYSTEM_RESOURCE_ATTRIBUTE_ACE .?AU_SYSTEM_RESOURCE_ATTRIBUTE_ACE@@ �� � w � R � _EVENT_TRACE_PROPERTIES_V2 .?AU_EVENT_TRACE_PROPERTIES_V2@@ ��
" ��N � _EVENT_FILTER_DESCRIPTOR .?AU_EVENT_FILTER_DESCRIPTOR@@ ��
�
�
" ��
" ��
" ��
" ���
� Wnode
" 0 BufferSize ���
" 4 MinimumBuffers ���
" 8 MaximumBuffers ���
" < MaximumFileSize ��
" @ LogFileMode ��
" D FlushTimer ���
" H EnableFlags ��
L AgeLimit �
L FlushThreshold ���
" P NumberOfBuffers ��
" T FreeBuffers ��
" X EventsLost ���
" \ BuffersWritten ���
" ` LogBuffersLost ���
" d RealTimeBuffersLost ��
h LoggerThreadId ���
" l LogFileNameOffset
" p LoggerNameOffset �
� t VersionNumber
" t V2Control
" x FilterDescCount ��
� | FilterDesc ���
� � Wow ��
� � QpcDeltaTracking �
� � LargeMdlPages
� � ExcludeKernelStack ���
# � V2Options R � � _EVENT_TRACE_PROPERTIES_V2 .?AU_EVENT_TRACE_PROPERTIES_V2@@ �� � � z F � _ENUM_SERVICE_STATUSW .?AU_ENUM_SERVICE_STATUSW@@ : � _SERVICE_STATUS .?AU_SERVICE_STATUS@@ J
q lpServiceName
q lpDisplayName
� ServiceStatus F � $ _ENUM_SERVICE_STATUSW .?AU_ENUM_SERVICE_STATUSW@@ � � � R � _PROCESS_MEMORY_ALLOCATION_MODE .?AT_PROCESS_MEMORY_ALLOCATION_MODE@@
" ��
" ��:
" Flags
TopDown ��
Reserved �R _PROCESS_MEMORY_ALLOCATION_MODE .?AT_PROCESS_MEMORY_ALLOCATION_MODE@@ � � > � _CM_PERF_COUNTERS .?AU_CM_PERF_COUNTERS@@ *
# OpenedKeys ���
# DelayCloseKCBs ���
# PrivateAllocPages
# PrivateAllocFree �
# PrivateAllocUsed �
# ( LookupCacheHit ���
# 0 LookupCacheMissFound �
# 8 LookupCacheMissNotFound ��
# @ ViewMap ��
# H ViewUnMap
# P HiveShrink ���> X _CM_PERF_COUNTERS .?AU_CM_PERF_COUNTERS@@ b 0 B � _EVENT_TRACE_HEADER .?AU_EVENT_TRACE_HEADER@@ 6
Type �
Level
! Version ��: <anonymous-tag> .?AU<anonymous-tag>@@ � + N
! Size �
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��
" Version ��
Class
" ThreadId �
" ProcessId
� TimeStamp
$ Guid �
# GuidPtr ��
" ( KernelTime ���
" , UserTime �
# ( ProcessorTime
" ( ClientContext
" , Flags B 0 _EVENT_TRACE_HEADER .?AU_EVENT_TRACE_HEADER@@ � : � tagTEXTMETRICW .?AUtagTEXTMETRICW@@ ���
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
q , tmFirstChar ��
q . tmLastChar ���
q 0 tmDefaultChar
q 2 tmBreakChar ��
4 tmItalic �
5 tmUnderlined �
6 tmStruckOut ��
7 tmPitchAndFamily �
8 tmCharSet : < tagTEXTMETRICW .?AUtagTEXTMETRICW@@ �� � � � BackTraceDatabaseCreate �� BackTraceDatabaseDelete �� BackTraceDatabaseFlush ��� BackTraceDatabaseMaxControl ��Z t _RTL_STACK_TRACE_DATABASE_CONTROL .?AW4_RTL_STACK_TRACE_DATABASE_CONTROL@@ � � � FpCodeUnspecified FpCodeAdd FpCodeSubtract ��� FpCodeMultiply ��� FpCodeDivide � FpCodeSquareRoot � FpCodeRemainder �� FpCodeCompare FpCodeConvert FpCodeRound ��
FpCodeTruncate ��� FpCodeFloor �� FpCodeCeil ���
FpCodeAcos ��� FpCodeAsin ��� FpCodeAtan ��� FpCodeAtan2 �� FpCodeCabs ��� FpCodeCos FpCodeCosh ��� FpCodeExp FpCodeFabs ��� FpCodeFmod ��� FpCodeFrexp �� FpCodeHypot �� FpCodeLdexp �� FpCodeLog FpCodeLog10 �� FpCodeModf ��� FpCodePow FpCodeSin FpCodeSinh ��� FpCodeTan ! FpCodeTanh ��� " FpCodeY0 � # FpCodeY1 � $ FpCodeYn �F % t _FP_IEEE_OPERATION_CODE .?AW4_FP_IEEE_OPERATION_CODE@@ � � h R � _IMAGE_DELAYLOAD_DESCRIPTOR .?AU_IMAGE_DELAYLOAD_DESCRIPTOR@@
" ��
" ��N
" AllAttributes
RvaBased �
ReservedAttributes ���2 <anonymous-tag> .?AT<anonymous-tag>@@ � �
Attributes ���
" DllNameRVA ���
" ModuleHandleRVA ��
" ImportAddressTableRVA
" ImportNameTableRVA ���
" BoundImportAddressTableRVA ���
" UnloadInformationTableRVA
" TimeDateStamp R ! _IMAGE_DELAYLOAD_DESCRIPTOR .?AU_IMAGE_DELAYLOAD_DESCRIPTOR@@ " � � SystemVaTypeAll �� SystemVaTypeNonPagedPool � SystemVaTypePagedPool SystemVaTypeSystemCache �� SystemVaTypeSystemPtes ��� SystemVaTypeSessionSpace � SystemVaTypeMax ��6 t $ _SYSTEM_VA_TYPE .?AW4_SYSTEM_VA_TYPE@@ � % � �
: VRF_TRIAGE_CONTEXT_NONE �� VRF_TRIAGE_CONTEXT_DEFAULT ��� VRF_TRIAGE_CONTEXT_DEVELOPMENT ��� VRF_TRIAGE_CONTEXT_CERTIFICATION � VRF_TRIAGE_CONTEXT_FLIGHT_TARGETED ��� VRF_TRIAGE_CONTEXT_FLIGHT_DIAGNOSTICS VRF_TRIAGE_CONTEXT_FLIGHT_MONITORING � NUM_VRF_TRIAGE_CONTEXTS ��> t ' _VRF_TRIAGE_CONTEXT .?AW4_VRF_TRIAGE_CONTEXT@@ � ( � � 6 � _PS_PKG_CLAIM .?AU_PS_PKG_CLAIM@@
" ��&
" Flags
+ Origin ���6 , _PS_PKG_CLAIM .?AU_PS_PKG_CLAIM@@ - � j
R � _ETW_DISABLE_KTIMER2_EVENT .?AU_ETW_DISABLE_KTIMER2_EVENT@@ ��^
" TimerKey �
" DisableCallback ��
" DisableContextKey
Flags R 0 _ETW_DISABLE_KTIMER2_EVENT .?AU_ETW_DISABLE_KTIMER2_EVENT@@ �� 1 b � � SystemPixelFormatUnknown � SystemPixelFormatR8G8B8 �� SystemPixelFormatR8G8B8X8 SystemPixelFormatB8G8R8 �� SystemPixelFormatB8G8R8X8 B t 3 _SYSTEM_PIXEL_FORMAT .?AW4_SYSTEM_PIXEL_FORMAT@@ ��� 4 � U
� " " �
7 Data �j 8 _RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TARGET@@ �� 9 � b FpCompareEqual ��� FpCompareGreater � FpCompareLess FpCompareUnordered ���F t ; _FP_IEEE_COMPARE_RESULT .?AW4_FP_IEEE_COMPARE_RESULT@@ � < � J : � _ETW_LBR_ENTRY .?AU_ETW_LBR_ENTRY@@ ��B
FromAddress ��
ToAddress
Reserved �: ? _ETW_LBR_ENTRY .?AU_ETW_LBR_ENTRY@@ �� @ b R � _FILE_FS_DEVICE_INFORMATION .?AU_FILE_FS_DEVICE_INFORMATION@@
B
� 6
" DeviceType ���
" Characteristics ��R D _FILE_FS_DEVICE_INFORMATION .?AU_FILE_FS_DEVICE_INFORMATION@@ E � � R � _FILE_FS_VOLUME_INFORMATION .?AU_FILE_FS_VOLUME_INFORMATION@@ �
� VolumeCreationTime ���
" VolumeSerialNumber ���
" VolumeLabelLength
SupportsObjects ��
VolumeLabel ��R H _FILE_FS_VOLUME_INFORMATION .?AU_FILE_FS_VOLUME_INFORMATION@@ I � � SmallBusiness Enterprise ��� BackOffice ��� CommunicationServer �� TerminalServer ��� SmallBusinessRestricted �� EmbeddedNT ��� DataCenter ��� SingleUserTS � Personal �
Blade EmbeddedRestricted ��� SecurityAppliance
StorageServer ComputeServer WHServer � PhoneNT �� MultiUserTS �� MaxSuiteType �. t K _SUITE_TYPE .?AW4_SUITE_TYPE@@ � L � & MemExtendedParameterInvalidType �� MemExtendedParameterAddressRequirements �� MemExtendedParameterNumaNode � MemExtendedParameterPartitionHandle �� MemExtendedParameterUserPhysicalHandle ��� MemExtendedParameterAttributeFlags ��� MemExtendedParameterMax ��N t N MEM_EXTENDED_PARAMETER_TYPE .?AW4MEM_EXTENDED_PARAMETER_TYPE@@ � O � � � PnpQueryEjectRelations ��� PnpQueryRemovalRelations � PnpQueryPowerRelations ��� PnpQueryBusRelations � PnpQueryTransportRelations ��� MaxPnpQueryRelations �> t Q _PNP_QUERY_RELATION .?AW4_PNP_QUERY_RELATION@@ � R $ � 6 � _CM_ROM_BLOCK .?AU_CM_ROM_BLOCK@@
T
� &
" Address ��
" Size �6 V _CM_ROM_BLOCK .?AU_CM_ROM_BLOCK@@ W � B � _LOAD_ASDATA_TABLE .?AU_LOAD_ASDATA_TABLE@@ ��
Module ���
q FilePath �
" Size �
Handle ���
RefCount �
� EntryPointActivationContext ��B Z _LOAD_ASDATA_TABLE .?AU_LOAD_ASDATA_TABLE@@ �� [ � P v EDIT_CONTROL_FEATURE_ENTERPRISE_DATA_PROTECTION_PASTE_SUPPORT EDIT_CONTROL_FEATURE_PASTE_NOTIFICATIONS �B t ] EDIT_CONTROL_FEATURE .?AW4EDIT_CONTROL_FEATURE@@ ��� ^ ~
, F � _RTL_TRACE_ENUMERATE .?AU_RTL_TRACE_ENUMERATE@@ ��
`
� B � _RTL_TRACE_DATABASE .?AU_RTL_TRACE_DATABASE@@
b
� > � _RTL_TRACE_BLOCK .?AU_RTL_TRACE_BLOCK@@ ��
d
� 6
c Database �
" Index
e Block F f _RTL_TRACE_ENUMERATE .?AU_RTL_TRACE_ENUMERATE@@ �� g ( J � _DUPLICATE_EXTENTS_DATA .?AU_DUPLICATE_EXTENTS_DATA@@
i
� f
FileHandle ���
� SourceFileOffset �
� TargetFileOffset �
� ByteCount J k _DUPLICATE_EXTENTS_DATA .?AU_DUPLICATE_EXTENTS_DATA@@ l � O V � _IMAGE_ARCHIVE_MEMBER_HEADER .?AU_IMAGE_ARCHIVE_MEMBER_HEADER@@ �� " � " � " � "
�~
o Name �
p Date �
q UserID ���
q " GroupID ��
( Mode �
r 0 Size �
� : EndHeader V s < _IMAGE_ARCHIVE_MEMBER_HEADER .?AU_IMAGE_ARCHIVE_MEMBER_HEADER@@ �� t � U > � _WIN32_FIND_DATAA .?AU_WIN32_FIND_DATAA@@
v
� . � _FILETIME .?AU_FILETIME@@ p " � p " �
" dwFileAttributes �
x ftCreationTime ���
x ftLastAccessTime �
x ftLastWriteTime ��
" nFileSizeHigh
" nFileSizeLow �
" $ dwReserved0 ��
" ( dwReserved1 ��
y , cFileName
z 0cAlternateFileName ���>
{ @_WIN32_FIND_DATAA .?AU_WIN32_FIND_DATAA@@ | � f B � _EXCEPTION_POINTERS .?AU_EXCEPTION_POINTERS@@
~
�
" �
�
� ~ � _IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@
� ��
�
�
" ��
" ��
"
��N
� PageRelativeOffset ���
� IndirectCall �
� IATIndex �~ � _IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_IMPORT_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@ � � � V � _TRANSACTION_ENLISTMENT_PAIR .?AU_TRANSACTION_ENLISTMENT_PAIR@@ ��6
$ EnlistmentId �
$ ResourceManagerId V � _TRANSACTION_ENLISTMENT_PAIR .?AU_TRANSACTION_ENLISTMENT_PAIR@@ �� � � F � _PROCESSOR_GROUP_INFO .?AU_PROCESSOR_GROUP_INFO@@
�
� " & �v
MaximumProcessorCount
ActiveProcessorCount �
� Reserved �
" ( ActiveProcessorMask ��F � , _PROCESSOR_GROUP_INFO .?AU_PROCESSOR_GROUP_INFO@@ � � 5 B � PPM_WMI_IDLE_STATES .?AUPPM_WMI_IDLE_STATES@@
�
� B � PPM_WMI_IDLE_STATE .?AUPPM_WMI_IDLE_STATE@@ �� � " �z
" Type �
" Count
" TargetState ��
" OldState �
# TargetProcessors �
� State B � 8 PPM_WMI_IDLE_STATES .?AUPPM_WMI_IDLE_STATES@@ � { � N � _TRACE_ENABLE_CONTEXT_EX .?AU_TRACE_ENABLE_CONTEXT_EX@@ ��
! LoggerId �
Level
InternalFlag �
" EnableFlags ��
" EnableFlagsHigh ��
" Reserved �N � _TRACE_ENABLE_CONTEXT_EX .?AU_TRACE_ENABLE_CONTEXT_EX@@ ��2 onecore\internal\sdk\inc\minwin\ntwmi_x.h �� � � > V � _PERFINFO_PPM_IDLE_STATE_EXIT .?AU_PERFINFO_PPM_IDLE_STATE_EXIT@@
�
� &
" State
" Status ���V � _PERFINFO_PPM_IDLE_STATE_EXIT .?AU_PERFINFO_PPM_IDLE_STATE_EXIT@@ � b ' R � _EVENT_INSTANCE_GUID_HEADER .?AU_EVENT_INSTANCE_GUID_HEADER@@ 6
Type �
Level
! Version ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � b �
! Size �
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��
" Version ��
� Class
" ThreadId �
" ProcessId
� TimeStamp
$ Guid �
# GuidPtr ��
" ( ClientContext
" , Flags
" ( KernelTime ���
" , UserTime �
# ( ProcessorTime
" 0 InstanceId ���
" 4 ParentInstanceId �
$ 8 ParentGuid ���R � H _EVENT_INSTANCE_GUID_HEADER .?AU_EVENT_INSTANCE_GUID_HEADER@@ � b
�
� " � � F � tagEMRSETARCDIRECTION .?AUtagEMRSETARCDIRECTION@@
�
� *
� emr ��
" iArcDirection F � tagEMRSETARCDIRECTION .?AUtagEMRSETARCDIRECTION@@ � � } J � _REDIRECTION_DESCRIPTOR .?AU_REDIRECTION_DESCRIPTOR@@ ^ � _REDIRECTION_FUNCTION_DESCRIPTOR .?AU_REDIRECTION_FUNCTION_DESCRIPTOR@@ ��
� ��
�
� F
" Version ��
" FunctionCount
� Redirections �J � _REDIRECTION_DESCRIPTOR .?AU_REDIRECTION_DESCRIPTOR@@ 6 onecore\external\sdk\inc\minwin\libloaderapi.h � � � f Z � _RTL_RETPOLINE_RELOCATION_INDEX .?AU_RTL_RETPOLINE_RELOCATION_INDEX@@
�
� ~ � _IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@ ��v � _IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION .?AU_IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION@@ ��>
� Import ���
� Indir
� SwitchJump ���2 � <anonymous-tag> .?AT<anonymous-tag>@@ � e �
! ImportRelocationSize �
! IndirectRelocationSize ���
! SwitchJumpRelocationSize �
! StraddleType �
� StraddleReloc Z � _RTL_RETPOLINE_RELOCATION_INDEX .?AU_RTL_RETPOLINE_RELOCATION_INDEX@@ � ` b � _SYSTEM_PHYSICAL_MEMORY_INFORMATION .?AU_SYSTEM_PHYSICAL_MEMORY_INFORMATION@@
�
� f
# TotalPhysicalBytes ���
# LowestPhysicalAddress
# HighestPhysicalAddress ���b � _SYSTEM_PHYSICAL_MEMORY_INFORMATION .?AU_SYSTEM_PHYSICAL_MEMORY_INFORMATION@@ � � � z PsEnergyComponentTypeCpu � PsEnergyComponentTypeStorage � PsEnergyComponentTypeNetwork � PsEnergyComponentTypeMBB � PsEnergyComponentTypeForegroundTime �� PsEnergyComponentTypeDesktopVisibleTime �� PsEnergyComponentTypeWindowResource �� PsEnergyComponentTypeCompositorResource �� PsEnergyComponentTypeTrackingState ��� PsEnergyComponentTypeInput ���
PsEnergyComponentTypeAudioIn � PsEnergyComponentTypeAudioOut PsEnergyComponentTypeDisplayRequired �
PsEnergyComponentTypeKeyboardInput ��� PsEnergyComponentTypeMouseInput �� PsEnergyComponentTypeMax �^ t � _PROCESS_ENERGY_COMPONENT_TYPE_NUM .?AW4_PROCESS_ENERGY_COMPONENT_TYPE_NUM@@ ��� � � � 6 � _WMI_FILE_IO .?AU_WMI_FILE_IO@@ ��.
FileObject ���
FileName �6 � _WMI_FILE_IO .?AU_WMI_FILE_IO@@ �� � b j � _MEMORY_PARTITION_TRANSFER_INFORMATION .?AU_MEMORY_PARTITION_TRANSFER_INFORMATION@@ ��
�
� >
" NumberOfPages
" NumaNode �
" Flags j � _MEMORY_PARTITION_TRANSFER_INFORMATION .?AU_MEMORY_PARTITION_TRANSFER_INFORMATION@@ �� � w � N � _MUTANT_OWNER_INFORMATION .?AU_MUTANT_OWNER_INFORMATION@@
ClientId �N � _MUTANT_OWNER_INFORMATION .?AU_MUTANT_OWNER_INFORMATION@@ � � 8 ^ � _PERFINFO_PPM_THERMAL_CONSTRAINT .?AU_PERFINFO_PPM_THERMAL_CONSTRAINT@@ ��2
" Constraint ���
# Processors ���^ � _PERFINFO_PPM_THERMAL_CONSTRAINT .?AU_PERFINFO_PPM_THERMAL_CONSTRAINT@@ �� � b Z : � tagPAINTSTRUCT .?AUtagPAINTSTRUCT@@ ��& � HDC__ .?AUHDC__@@
�
� " �~
� hdc ��
t fErase ���
rcPaint ��
t fRestore �
t fIncUpdate ���
� rgbReserved ��: � @ tagPAINTSTRUCT .?AUtagPAINTSTRUCT@@ �� � ~ k V � _REQUEST_OPLOCK_OUTPUT_BUFFER .?AU_REQUEST_OPLOCK_OUTPUT_BUFFER@@ �
! StructureVersion �
! StructureLength ��
" OriginalOplockLevel ��
" NewOplockLevel ���
" Flags
" AccessMode ���
! ShareMode V � _REQUEST_OPLOCK_OUTPUT_BUFFER .?AU_REQUEST_OPLOCK_OUTPUT_BUFFER@@ � � � EtwCoverageSamplerCreateInformation �� EtwCoverageSamplerQueryInformation ��� EtwCoverageSamplerBloomInformation ��� EtwCoverageSamplerPerfInformation EtwCoverageSamplerStatusInformation �� MaxEtwCoverageSamplerInfoClass ���f t � _ETW_COVERAGE_SAMPLER_INFORMATION_CLASS .?AW4_ETW_COVERAGE_SAMPLER_INFORMATION_CLASS@@ � � @ � . � _FLS_DATA .?AU_FLS_DATA@@ " �"
! Entry
� Slots . � _FLS_DATA .?AU_FLS_DATA@@ � � �
Z � _FILE_REPARSE_POINT_INFORMATION .?AU_FILE_REPARSE_POINT_INFORMATION@@
�
� *
FileReference
" Tag ��Z � _FILE_REPARSE_POINT_INFORMATION .?AU_FILE_REPARSE_POINT_INFORMATION@@ � � s N � tagWNODE_SINGLE_INSTANCE .?AUtagWNODE_SINGLE_INSTANCE@@ �� " �
� WnodeHeader ��
" 0 OffsetInstanceName ���
" 4 InstanceIndex
" 8 DataBlockOffset ��
" < SizeDataBlock
� @ VariableData �N � @ tagWNODE_SINGLE_INSTANCE .?AUtagWNODE_SINGLE_INSTANCE@@ �� � � � 2 � _TRIVERTEX .?AU_TRIVERTEX@@ ��
�
� Z
x
y
! Red ��
!
Green
! Blue �
! Alpha 2 _TRIVERTEX .?AU_TRIVERTEX@@ �� � # j � _PROCESS_MITIGATION_POLICY_INFORMATION .?AU_PROCESS_MITIGATION_POLICY_INFORMATION@@ ��R ProcessDEPPolicy � ProcessASLRPolicy ProcessDynamicCodePolicy � ProcessStrictHandleCheckPolicy ��� ProcessSystemCallDisablePolicy ��� ProcessMitigationOptionsMask � ProcessExtensionPointDisablePolicy ��� ProcessControlFlowGuardPolicy ProcessSignaturePolicy ��� ProcessFontDisablePolicy �
ProcessImageLoadPolicy ��� ProcessSystemCallFilterPolicy ProcessPayloadRestrictionPolicy ��
ProcessChildProcessPolicy ProcessSideChannelIsolationPolicy ProcessUserShadowStackPolicy � MaxProcessMitigationPolicy ���N t _PROCESS_MITIGATION_POLICY .?AW4_PROCESS_MITIGATION_POLICY@@ ��� D & Z � _PROCESS_MITIGATION_ASLR_POLICY .?AU_PROCESS_MITIGATION_ASLR_POLICY@@ z � _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ ��z � _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ �� � _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ ��j � _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY .?AU_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY@@ v � _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@ r � _PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY@@ j � _PROCESS_MITIGATION_FONT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_FONT_DISABLE_POLICY@@ f � _PROCESS_MITIGATION_IMAGE_LOAD_POLICY .?AU_PROCESS_MITIGATION_IMAGE_LOAD_POLICY@@ v � _PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY@@ z � _PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ ��n � _PROCESS_MITIGATION_CHILD_PROCESS_POLICY .?AU_PROCESS_MITIGATION_CHILD_PROCESS_POLICY@@ ��~ � _PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY .?AU_PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY@@ v � _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY@@ ���
Policy ���
ASLRPolicy ���
StrictHandleCheckPolicy ��
SystemCallDisablePolicy ��
ExtensionPointDisablePolicy ��
DynamicCodePolicy
ControlFlowGuardPolicy ���
SignaturePolicy ��
FontDisablePolicy
ImageLoadPolicy ��
SystemCallFilterPolicy ���
PayloadRestrictionPolicy �
ChildProcessPolicy ���
SideChannelIsolationPolicy ���
UserShadowStackPolicy j _PROCESS_MITIGATION_POLICY_INFORMATION .?AU_PROCESS_MITIGATION_POLICY_INFORMATION@@ �� � " * � __n64x2 .?AU__n64x2@@ " �
val ��* __n64x2 .?AU__n64x2@@ % Q � FilterBootOptionOperationOpenSystemStore � FilterBootOptionOperationSetElement �� FilterBootOptionOperationDeleteElement ��� FilterBootOptionOperationMax �R t _FILTER_BOOT_OPTION_OPERATION .?AW4_FILTER_BOOT_OPTION_OPERATION@@ � � � B � tagENUMLOGFONTEXDVA .?AUtagENUMLOGFONTEXDVA@@ > � tagENUMLOGFONTEXA .?AUtagENUMLOGFONTEXA@@ : � tagDESIGNVECTOR .?AUtagDESIGNVECTOR@@ :
! elfEnumLogfontEx �
" � elfDesignVector ��B # tagENUMLOGFONTEXDVA .?AUtagENUMLOGFONTEXDVA@@ $ � P . � _COMMPROP .?AU_COMMPROP@@ �
! wPacketLength
! wPacketVersion ���
" dwServiceMask
" dwReserved1 ��
" dwMaxTxQueue �
" dwMaxRxQueue �
" dwMaxBaud
" dwProvSubType
" dwProvCapabilities ���
" dwSettableParams �
" $ dwSettableBaud ���
! ( wSettableData
! * wSettableStopParity ��
" , dwCurrentTxQueue �
" 0 dwCurrentRxQueue �
" 4 dwProvSpec1 ��
" 8 dwProvSpec2 ��
< wcProvChar ���. ' @ _COMMPROP .?AU_COMMPROP@@ ( n � � FileFsVolumeInformation �� FileFsLabelInformation ��� FileFsSizeInformation FileFsDeviceInformation �� FileFsAttributeInformation ��� FileFsControlInformation � FileFsFullSizeInformation FileFsObjectIdInformation FileFsDriverPathInformation ��
FileFsVolumeFlagsInformation � FileFsSectorSizeInformation �� FileFsDataCopyInformation
FileFsMetadataSizeInformation FileFsFullSizeInformationEx �� FileFsMaximumInformation �2 t * _FSINFOCLASS .?AW4_FSINFOCLASS@@ ��� + � � $
-
� JOB_OBJECT_IO_RATE_CONTROL_ENABLE JOB_OBJECT_IO_RATE_CONTROL_STANDALONE_VOLUME � JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ALL � JOB_OBJECT_IO_RATE_CONTROL_FORCE_UNIT_ACCESS_ON_SOFT_CAP � JOB_OBJECT_IO_RATE_CONTROL_VALID_FLAGS ���Z t / JOB_OBJECT_IO_RATE_CONTROL_FLAGS .?AW4JOB_OBJECT_IO_RATE_CONTROL_FLAGS@@ ��� 0 D N N � _SERVICE_PRESHUTDOWN_INFO .?AU_SERVICE_PRESHUTDOWN_INFO@@ "
" dwPreshutdownTimeout �N 3 _SERVICE_PRESHUTDOWN_INFO .?AU_SERVICE_PRESHUTDOWN_INFO@@ 4 � e � EtwQueryPartitionInformation � EtwQueryPartitionInformationV2 ��� EtwQueryLastDroppedTimes � EtwQueryProcessHandleInfoMax �R t 6 _ETW_PROCESS_HANDLE_INFO_TYPE .?AW4_ETW_PROCESS_HANDLE_INFO_TYPE@@ � 7 � w . LT_DONT_CARE � LT_LOWEST_LATENCY 2 t 9 LATENCY_TIME .?AW4LATENCY_TIME@@ ��� : { - � MmEtwWorkingSetTypeUser �� MmEtwWorkingSetTypeSession ��� MmEtwWorkingSetTypeSystem MmEtwWorkingSetTypeMaximum ���J t < _MM_ETW_WORKING_SET_TYPE .?AW4_MM_ETW_WORKING_SET_TYPE@@ ��� = w ; : � _RPC_CLIENT_ID .?AU_RPC_CLIENT_ID@@ ��2
" UniqueProcess
" UniqueThread �: @ _RPC_CLIENT_ID .?AU_RPC_CLIENT_ID@@ ��: onecore\admin\wmi\events\idl\elf\objfre\arm\elf.h �� A B Q 6 FeatureConfigurationPriorityImageDefault � FeatureConfigurationPriorityService �� FeatureConfigurationPriorityUser �
FeatureConfigurationPriorityUserPolicy ��� FeatureConfigurationPriorityTest � FeatureConfigurationPriorityImageOverride FeatureConfigurationPriorityMax ��^ t D _RTL_FEATURE_CONFIGURATION_PRIORITY .?AW4_RTL_FEATURE_CONFIGURATION_PRIORITY@@ � E 6 ^ Compatible ��� TypeA TypeB TypeC TypeF MaximumDmaSpeed ��. t G _DMA_SPEED .?AW4_DMA_SPEED@@ ��� H � �+ � AuditPrivilegeObject � AuditPrivilegeService AuditAccessCheck � AuditOpenObject �� AuditOpenObjectWithTransaction ��� AuditCloseObject � AuditDeleteObject AuditOpenObjectForDelete � AuditOpenObjectForDeleteWithTransaction �� AuditCloseNonObject ��
AuditOpenNonObject ��� AuditObjectReference � AuditHandleCreation ��>
t J _SE_AUDIT_OPERATION .?AW4_SE_AUDIT_OPERATION@@ � K w B � tagIMEMENUITEMINFOA .?AUtagIMEMENUITEMINFOA@@ p " P �
u cbSize ���
u fType
u fState ���
u wID ��
{ hbmpChecked ��
{ hbmpUnchecked
" dwItemData ���
N szString �
{ l hbmpItem �B O p tagIMEMENUITEMINFOA .?AUtagIMEMENUITEMINFOA@@ P � � ^ � _APPLICATIONLAUNCH_SETTING_VALUE .?AU_APPLICATIONLAUNCH_SETTING_VALUE@@ ��J
� ActivationTime ���
" Flags
" ButtonInstanceID �^ S _APPLICATIONLAUNCH_SETTING_VALUE .?AU_APPLICATIONLAUNCH_SETTING_VALUE@@ �� T { � b � _LDR_DLL_UNLOADED_NOTIFICATION_DATA .?AU_LDR_DLL_UNLOADED_NOTIFICATION_DATA@@
V
�
��
X
� n
" Flags
Y FullDllName ��
Y BaseDllName ��
DllBase ��
" SizeOfImage ��b Z _LDR_DLL_UNLOADED_NOTIFICATION_DATA .?AU_LDR_DLL_UNLOADED_NOTIFICATION_DATA@@ [ � �
3
� R � _FILE_REMOTE_PROTOCOL_INFO .?AU_FILE_REMOTE_PROTOCOL_INFO@@ ��
_ Reserved �: _ <anonymous-tag> .?AU<anonymous-tag>@@ ` n u#
" Capabilities �: b <anonymous-tag> .?AU<anonymous-tag>@@ c n �# 2
" Capabilities �
" CachingFlags �: e <anonymous-tag> .?AU<anonymous-tag>@@ f n �# &
c Server ���
f Share : h <anonymous-tag> .?AU<anonymous-tag>@@ i n �# " " @ �&
i Smb2 �
k Reserved �2 l @ <anonymous-tag> .?AT<anonymous-tag>@@ m n �#
! StructureVersion �
! StructureSize
" Protocol �
! ProtocolMajorVersion �
!
ProtocolMinorVersion �
! ProtocolRevision �
! Reserved �
" Flags
` GenericReserved ��
m 4 ProtocolSpecific �R
o t _FILE_REMOTE_PROTOCOL_INFO .?AU_FILE_REMOTE_PROTOCOL_INFO@@ �� p n c# n TransactionOutcomeUndetermined ��� TransactionOutcomeCommitted �� TransactionOutcomeAborted B t r _TRANSACTION_OUTCOME .?AW4_TRANSACTION_OUTCOME@@ ��� s � � � ��LdrModulesMerged ��LdrModulesInitError � ��LdrModulesSnapError � ��LdrModulesUnloaded �� ��LdrModulesUnloading � LdrModulesPlaceHolder LdrModulesMapping LdrModulesMapped � LdrModulesWaitingForDependencies � LdrModulesSnapping ��� LdrModulesSnapped LdrModulesCondensed �� LdrModulesReadyToInit LdrModulesInitializing ��� LdrModulesReadyToRun �6 t u _LDR_DDAG_STATE .?AW4_LDR_DDAG_STATE@@ � v � n F � tagEMRPOLYPOLYLINE16 .?AUtagEMRPOLYPOLYLINE16@@ ��
x
� " " �. � tagPOINTS .?AUtagPOINTS@@ { " �r
� emr ��
c rclBounds
" nPolys ���
" cpts �
z aPolyCounts ��
| $ apts �F } ( tagEMRPOLYPOLYLINE16 .?AUtagEMRPOLYPOLYLINE16@@ �� ~ � n . � _TP_TASK .?AU_TP_TASK@@ ��B � _TP_TASK_CALLBACKS .?AU_TP_TASK_CALLBACKS@@ ��
� ��
�
� Z
� Callbacks
" NumaNode �
IdealProcessor ���
! ListEntry . � _TP_TASK .?AU_TP_TASK@@ �� � � � ^ ToleranceIntervalShort ��� ToleranceIntervalMedium �� ToleranceIntervalLong n t � _JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL .?AW4_JOBOBJECT_RATE_CONTROL_TOLERANCE_INTERVAL@@ ��� � D � � SE_VALIDATE_MAPPING_HEADER_ONLY �� SE_VALIDATE_MAPPING_ENTIRE_IMAGE � SE_VALIDATE_MAPPING_ENTIRE_IMAGE_CLEAN ���J t � _SE_VALIDATE_MAPPING_TYPE .?AW4_SE_VALIDATE_MAPPING_TYPE@@ � � � � WinNullSid ��� WinWorldSid �� WinLocalSid �� WinCreatorOwnerSid ��� WinCreatorGroupSid ��� WinCreatorOwnerServerSid � WinCreatorGroupServerSid � WinNtAuthoritySid WinDialupSid � WinNetworkSid
WinBatchSid �� WinInteractiveSid WinServiceSid
WinAnonymousSid �� WinProxySid �� WinEnterpriseControllersSid �� WinSelfSid ��� WinAuthenticatedUserSid �� WinRestrictedCodeSid � WinTerminalServerSid � WinRemoteLogonIdSid �� WinLogonIdsSid ��� WinLocalSystemSid WinLocalServiceSid ��� WinNetworkServiceSid � WinBuiltinDomainSid �� WinBuiltinAdministratorsSid �� WinBuiltinUsersSid ��� WinBuiltinGuestsSid �� WinBuiltinPowerUsersSid �� WinBuiltinAccountOperatorsSid WinBuiltinSystemOperatorsSid � WinBuiltinPrintOperatorsSid �� ! WinBuiltinBackupOperatorsSid � " WinBuiltinReplicatorSid �� # WinBuiltinPreWindows2000CompatibleAccessSid �� $ WinBuiltinRemoteDesktopUsersSid �� % WinBuiltinNetworkConfigurationOperatorsSid ��� & WinAccountAdministratorSid ��� ' WinAccountGuestSid ��� ( WinAccountKrbtgtSid �� ) WinAccountDomainAdminsSid * WinAccountDomainUsersSid � + WinAccountDomainGuestsSid , WinAccountComputersSid ��� - WinAccountControllersSid � . WinAccountCertAdminsSid �� / WinAccountSchemaAdminsSid 0 WinAccountEnterpriseAdminsSid 1 WinAccountPolicyAdminsSid 2 WinAccountRasAndIasServersSid 3 WinNTLMAuthenticationSid � 4 WinDigestAuthenticationSid ��� 5 WinSChannelAuthenticationSid � 6 WinThisOrganizationSid ��� 7 WinOtherOrganizationSid �� 8 WinBuiltinIncomingForestTrustBuildersSid � 9 WinBuiltinPerfMonitoringUsersSid � : WinBuiltinPerfLoggingUsersSid ; WinBuiltinAuthorizationAccessSid � < WinBuiltinTerminalServerLicenseServersSid = WinBuiltinDCOMUsersSid ��� > WinBuiltinIUsersSid �� ? WinIUserSid �� @ WinBuiltinCryptoOperatorsSid � A WinUntrustedLabelSid � B WinLowLabelSid ��� C WinMediumLabelSid D WinHighLabelSid �� E WinSystemLabelSid F WinWriteRestrictedCodeSid G WinCreatorOwnerRightsSid � H WinCacheablePrincipalsGroupSid ��� I WinNonCacheablePrincipalsGroupSid J WinEnterpriseReadonlyControllersSid �� K WinAccountReadonlyControllersSid � L WinBuiltinEventLogReadersGroup ��� M WinNewEnterpriseReadonlyControllersSid ��� N WinBuiltinCertSvcDComAccessGroup � O WinMediumPlusLabelSid P WinLocalLogonSid � Q WinConsoleLogonSid ��� R WinThisOrganizationCertificateSid S WinApplicationPackageAuthoritySid T WinBuiltinAnyPackageSid �� U WinCapabilityInternetClientSid ��� V WinCapabilityInternetClientServerSid � W WinCapabilityPrivateNetworkClientServerSid ��� X WinCapabilityPicturesLibrarySid �� Y WinCapabilityVideosLibrarySid Z WinCapabilityMusicLibrarySid � [ WinCapabilityDocumentsLibrarySid � \ WinCapabilitySharedUserCertificatesSid ��� ] WinCapabilityEnterpriseAuthenticationSid � ^ WinCapabilityRemovableStorageSid � _ WinBuiltinRDSRemoteAccessServersSid �� ` WinBuiltinRDSEndpointServersSid �� a WinBuiltinRDSManagementServersSid b WinUserModeDriversSid c WinBuiltinHyperVAdminsSid d WinAccountCloneableControllersSid e WinBuiltinAccessControlAssistanceOperatorsSid f WinBuiltinRemoteManagementUsersSid ��� g WinAuthenticationAuthorityAssertedSid h WinAuthenticationServiceAssertedSid �� i WinLocalAccountSid ��� j WinLocalAccountAndAdministratorSid ��� k WinAccountProtectedUsersSid �� l WinCapabilityAppointmentsSid � m WinCapabilityContactsSid � n WinAccountDefaultSystemManagedSid o WinBuiltinDefaultSystemManagedGroupSid ��� p WinBuiltinStorageReplicaAdminsSid q WinAccountKeyAdminsSid ��� r WinAccountEnterpriseKeyAdminsSid � s WinAuthenticationKeyTrustSid � t WinAuthenticationKeyPropertyMFASid ��� u WinAuthenticationKeyPropertyAttestationSid ��� v WinAuthenticationFreshKeyAuthSid � w WinBuiltinDeviceOwnersSid > x t � WELL_KNOWN_SID_TYPE .?AW4WELL_KNOWN_SID_TYPE@@ � � w � R TpTraceThreadPriority TpTraceThreadAffinity MaxTpTraceType ���6 t � _TP_TRACE_TYPE .?AW4_TP_TRACE_TYPE@@ ��� � � u N � _CM_INT13_DRIVE_PARAMETER .?AU_CM_INT13_DRIVE_PARAMETER@@ z
! DriveSelect ��
" MaxCylinders �
! SectorsPerTrack ��
! MaxHeads �
!
NumberDrives �N � _CM_INT13_DRIVE_PARAMETER .?AU_CM_INT13_DRIVE_PARAMETER@@ � � : � tagCURSORSHAPE .?AUtagCURSORSHAPE@@ ��
t xHotSpot �
t yHotSpot �
t cx ���
t cy ���
t cbWidth ��
Planes ���
BitsPixel : � tagCURSORSHAPE .?AUtagCURSORSHAPE@@ �� � ~ * 6 � tagCWPSTRUCT .?AUtagCWPSTRUCT@@ ��
�
� N
lParam ���
u wParam ���
u message ��
� hwnd �6 � tagCWPSTRUCT .?AUtagCWPSTRUCT@@ �� � ~ . . � _WGLSWAP .?AU_WGLSWAP@@ ��&
� hdc ��
u uiFlags ��. � _WGLSWAP .?AU_WGLSWAP@@ �� � � � . � _STRING64 .?AU_STRING64@@
�
� B
! Length ���
! MaximumLength
# Buffer ���. � _STRING64 .?AU_STRING64@@ � � ~ � _RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ ��
�
� q " ��
� EnableExportAddressFilter
� EnableExportAddressFilterPlus
� EnableImportAddressFilter
� EnableRopStackPivot ��
� EnableRopCallerCheck �
� ( EnableRopSimExec �
� 0 EafPlusModuleList ~ � 0_RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_RTL_IMAGE_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ �� � � B � _SD_ENUM_SDS_INPUT .?AU_SD_ENUM_SDS_INPUT@@ ��>
# StartingOffset ���
# MaxSDEntriesToReturn �B � _SD_ENUM_SDS_INPUT .?AU_SD_ENUM_SDS_INPUT@@ �� � � � N � _RTL_QUERY_REGISTRY_TABLE .?AU_RTL_QUERY_REGISTRY_TABLE@@ q " " �
�
� �
� QueryRoutine �
" Flags
q Name �
EntryContext �
" DefaultType ��
DefaultData ��
" DefaultLength N � _RTL_QUERY_REGISTRY_TABLE .?AU_RTL_QUERY_REGISTRY_TABLE@@ � g � R � _HEAP_SUBSEGMENT_ACTIVATED .?AU_HEAP_SUBSEGMENT_ACTIVATED@@ ��F
m Header ���
HeapHandle ���
$ SubSegment ���R � ( _HEAP_SUBSEGMENT_ACTIVATED .?AU_HEAP_SUBSEGMENT_ACTIVATED@@ �� � b � 6 � tagEMRBITBLT .?AUtagEMRBITBLT@@ ��
�
� 2
� emr ��
c rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
I 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc 6 � d tagEMRBITBLT .?AUtagEMRBITBLT@@ �� � � � J � _PARSE_MESSAGE_CONTEXT .?AU_PARSE_MESSAGE_CONTEXT@@ ��
�
� ~
" fFlags ���
" cwSavColumn ��
" iwSrc
" iwDst
" iwDstSpace ���
p lpvArgStart ��J � _PARSE_MESSAGE_CONTEXT .?AU_PARSE_MESSAGE_CONTEXT@@ �� � � F � PROCESSOR_IDLE_TIMES .?AUPROCESSOR_IDLE_TIMES@@ ��
�
� >
# StartTime
# EndTime ��
� Reserved �F � PROCESSOR_IDLE_TIMES .?AUPROCESSOR_IDLE_TIMES@@ �� � { _ V � _TXFS_LIST_TRANSACTIONS_ENTRY .?AU_TXFS_LIST_TRANSACTIONS_ENTRY@@
�
� r
$ TransactionId
" TransactionState �
" Reserved1
" Reserved2
Reserved3 V � ( _TXFS_LIST_TRANSACTIONS_ENTRY .?AU_TXFS_LIST_TRANSACTIONS_ENTRY@@ � � , z � _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION .?AU_SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION@@ ��
�
�
" Operation z � _SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION .?AU_SYSTEM_PROCESSOR_MICROCODE_UPDATE_INFORMATION@@ �� � � �
F � _FILE_EA_INFORMATION .?AU_FILE_EA_INFORMATION@@ ��
" EaSize ���F � _FILE_EA_INFORMATION .?AU_FILE_EA_INFORMATION@@ �� � � � R � _SYSTEM_AUDIT_CALLBACK_ACE .?AU_SYSTEM_AUDIT_CALLBACK_ACE@@ ��
�
� :
� Header ���
" Mask �
" SidStart �R � _SYSTEM_AUDIT_CALLBACK_ACE .?AU_SYSTEM_AUDIT_CALLBACK_ACE@@ �� � w 2 � _numberfmtA .?AU_numberfmtA@@ �
u NumDigits
u LeadingZero ��
u Grouping �
p lpDecimalSep �
p lpThousandSep
u NegativeOrder 2 � _numberfmtA .?AU_numberfmtA@@ � V � Z � _MEMORY_WORKING_SET_INFORMATION .?AU_MEMORY_WORKING_SET_INFORMATION@@ N � _MEMORY_WORKING_SET_BLOCK .?AU_MEMORY_WORKING_SET_BLOCK@@ � " �:
" NumberOfEntries ��
� WorkingSetInfo ���Z � _MEMORY_WORKING_SET_INFORMATION .?AU_MEMORY_WORKING_SET_INFORMATION@@ � w � 6 � tagDIBSECTION .?AUtagDIBSECTION@@
�
� . � tagBITMAP .?AUtagBITMAP@@ " " �j
� dsBm �
� dsBmih ���
� @ dsBitfields ��
L dshSection ���
" P dsOffset �6 � T tagDIBSECTION .?AUtagDIBSECTION@@ � � # � FileBasicInfo FileStandardInfo � FileNameInfo � FileRenameInfo ��� FileDispositionInfo �� FileAllocationInfo ��� FileEndOfFileInfo FileStreamInfo ��� FileCompressionInfo �� FileAttributeTagInfo �
FileIdBothDirectoryInfo �� FileIdBothDirectoryRestartInfo ��� FileIoPriorityHintInfo ���
FileRemoteProtocolInfo ��� FileFullDirectoryInfo FileFullDirectoryRestartInfo � FileStorageInfo �� FileAlignmentInfo FileIdInfo ��� FileIdExtdDirectoryInfo �� FileIdExtdDirectoryRestartInfo ��� FileDispositionInfoEx FileRenameInfoEx � FileCaseSensitiveInfo FileNormalizedNameInfo ��� MaximumFileInfoByHandleClass �N t � _FILE_INFO_BY_HANDLE_CLASS .?AW4_FILE_INFO_BY_HANDLE_CLASS@@ ��� � � � � DISPLAYCONFIG_DEVICE_INFO_GET_SOURCE_NAME DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_NAME DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_PREFERRED_MODE �� DISPLAYCONFIG_DEVICE_INFO_GET_ADAPTER_NAME ��� DISPLAYCONFIG_DEVICE_INFO_SET_TARGET_PERSISTENCE � DISPLAYCONFIG_DEVICE_INFO_GET_TARGET_BASE_TYPE ��� DISPLAYCONFIG_DEVICE_INFO_GET_SUPPORT_VIRTUAL_RESOLUTION � DISPLAYCONFIG_DEVICE_INFO_SET_SUPPORT_VIRTUAL_RESOLUTION � DISPLAYCONFIG_DEVICE_INFO_GET_ADVANCED_COLOR_INFO
DISPLAYCONFIG_DEVICE_INFO_SET_ADVANCED_COLOR_STATE ��� DISPLAYCONFIG_DEVICE_INFO_GET_SDR_WHITE_LEVEL ��DISPLAYCONFIG_DEVICE_INFO_FORCE_UINT32 ��V t � DISPLAYCONFIG_DEVICE_INFO_TYPE .?AW4DISPLAYCONFIG_DEVICE_INFO_TYPE@@ ��� � � � f � _PLUGPLAY_CONTROL_USER_RESPONSE_DATA .?AU_PLUGPLAY_CONTROL_USER_RESPONSE_DATA@@ ��
�
� � PNP_VetoTypeUnknown �� PNP_VetoLegacyDevice � PNP_VetoPendingClose � PNP_VetoWindowsApp ��� PNP_VetoWindowsService ��� PNP_VetoOutstandingOpen �� PNP_VetoDevice ��� PNP_VetoDriver ��� PNP_VetoIllegalDeviceRequest � PNP_VetoInsufficientPower
PNP_VetoNonDisableable ��� PNP_VetoLegacyDriver � PNP_VetoInsufficientRights ���
PNP_VetoAlreadyRemoved ���6 t � _PNP_VETO_TYPE .?AW4_PNP_VETO_TYPE@@ ���* onecore\external\shared\inc\cfg.h �� � � / Z
" Response �
� VetoType �
q VetoName �
" VetoNameLength ���f � _PLUGPLAY_CONTROL_USER_RESPONSE_DATA .?AU_PLUGPLAY_CONTROL_USER_RESPONSE_DATA@@ �� � $ V FeatureEnabledStateOptionsNone ��� FeatureEnabledStateOptionsWexpConfig �^ t _RTL_FEATURE_ENABLED_STATE_OPTIONS .?AW4_RTL_FEATURE_ENABLED_STATE_OPTIONS@@ ��� A B � _WMI_PNP_RECORD_V5 .?AU_WMI_PNP_RECORD_V5@@ ��
� �
$ ClassGuid
" UpperFilterCount �
" LowerFilterCount �
" DevStatus
" DevProblem ���
Strings ��B $ _WMI_PNP_RECORD_V5 .?AU_WMI_PNP_RECORD_V5@@ �� b � 2 � tagRAWMOUSE .?AUtagRAWMOUSE@@
� �
! usFlags ��
" ulButtons
! usButtonFlags
! usButtonData �
" ulRawButtons �
lLastX ���
lLastY ���
" ulExtraInformation ���2 tagRAWMOUSE .?AUtagRAWMOUSE@@ ~ 9: : � tagEMRPOLYLINE .?AUtagEMRPOLYLINE@@ ��F
� emr ��
c rclBounds
" cptl �
� aptl �: $ tagEMRPOLYLINE .?AUtagEMRPOLYLINE@@ �� � 9 : � _JIT_DEBUG_INFO .?AU_JIT_DEBUG_INFO@@ �
" dwSize ���
" dwProcessorArchitecture ��
" dwThreadID ���
" dwReserved0 ��
# lpExceptionAddress ���
# lpExceptionRecord
# lpContextRecord ��: ( _JIT_DEBUG_INFO .?AU_JIT_DEBUG_INFO@@ n � � ACTCTX_RUN_LEVEL_UNSPECIFIED � ACTCTX_RUN_LEVEL_AS_INVOKER �� ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE ��� ACTCTX_RUN_LEVEL_REQUIRE_ADMIN ��� ACTCTX_RUN_LEVEL_NUMBERS �N t ACTCTX_REQUESTED_RUN_LEVEL .?AW4ACTCTX_REQUESTED_RUN_LEVEL@@ ��� � �
o Identifier ���6 _FILE_ID_128 .?AU_FILE_ID_128@@ �� � R 2 � _XSAVE_AREA .?AU_XSAVE_AREA@@ 6 � _XSAVE_FORMAT .?AU_XSAVE_FORMAT@@ B � _XSAVE_AREA_HEADER .?AU_XSAVE_AREA_HEADER@@ ��.
LegacyState ��
Header ���2 @_XSAVE_AREA .?AU_XSAVE_AREA@@ K : � _GROUP_AFFINITY .?AU_GROUP_AFFINITY@@ ! " �6
" Mask �
! Group
# Reserved �: $ _GROUP_AFFINITY .?AU_GROUP_AFFINITY@@ % . WMI_GET_ALL_DATA � WMI_GET_SINGLE_INSTANCE �� WMI_SET_SINGLE_INSTANCE �� WMI_SET_SINGLE_ITEM �� WMI_ENABLE_EVENTS WMI_DISABLE_EVENTS ��� WMI_ENABLE_COLLECTION WMI_DISABLE_COLLECTION ��� WMI_REGINFO �� WMI_EXECUTE_METHOD ���
WMI_CAPTURE_STATE : t ' WMIDPREQUESTCODE .?AW4WMIDPREQUESTCODE@@ ��� ( � � V � _REQUEST_OPLOCK_INPUT_BUFFER .?AU_REQUEST_OPLOCK_INPUT_BUFFER@@ ��j
! StructureVersion �
! StructureLength ��
" RequestedOplockLevel �
" Flags V + _REQUEST_OPLOCK_INPUT_BUFFER .?AU_REQUEST_OPLOCK_INPUT_BUFFER@@ �� , � � . � tagACCEL .?AUtagACCEL@@ ��
.
� 2
fVirt
! key ��
! cmd ��. 0 tagACCEL .?AUtagACCEL@@ �� 1 ~ _ f � IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA .?ATIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" HeaderData ���
4 FunctionLength ���
5 Version ��
6 ExceptionDataPresent �
7 EpilogInHeader ���
8 EpilogCount ��
9 CodeWords f : IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA .?ATIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA@@ �� ; � f � _FILE_SYSTEM_RECOGNITION_INFORMATION .?AU_FILE_SYSTEM_RECOGNITION_INFORMATION@@ �� p " �
> FileSystem ���f ? _FILE_SYSTEM_RECOGNITION_INFORMATION .?AU_FILE_SYSTEM_RECOGNITION_INFORMATION@@ �� @ � �
�
�
p t C
D
� � WnfDataScopeSystem ��� WnfDataScopeSession �� WnfDataScopeUser � WnfDataScopeProcess �� WnfDataScopeMachine �� WnfDataScopePhysicalMachine ��6 t F _WNF_DATA_SCOPE .?AW4_WNF_DATA_SCOPE@@ � G � u " SemaphoreBasicInformation R t I _SEMAPHORE_INFORMATION_CLASS .?AW4_SEMAPHORE_INFORMATION_CLASS@@ ��� J � � B ToleranceLow � ToleranceMedium �� ToleranceHigh Z t L _JOBOBJECT_RATE_CONTROL_TOLERANCE .?AW4_JOBOBJECT_RATE_CONTROL_TOLERANCE@@ � M D �
M
� N WaitAll �� WaitAny �� WaitNotification � WaitDequeue ��. t P _WAIT_TYPE .?AW4_WAIT_TYPE@@ ��� Q � b � _PERFINFO_BOOT_PREFETCH_INFORMATION .?AU_PERFINFO_BOOT_PREFETCH_INFORMATION@@
S
� :
Action ���
Status ���
Pages b U _PERFINFO_BOOT_PREFETCH_INFORMATION .?AU_PERFINFO_BOOT_PREFETCH_INFORMATION@@ V b � R LogExceptionEmpty LogExceptionDispatch � LogExceptionHandler ��> t X _EXCEPTION_LOG_TYPE .?AW4_EXCEPTION_LOG_TYPE@@ � Y
F � _STREAM_EXTENT_ENTRY .?AU_STREAM_EXTENT_ENTRY@@ ��
[
� N � RETRIEVAL_POINTERS_BUFFER .?AURETRIEVAL_POINTERS_BUFFER@@
] RetrievalPointers 2 ^ <anonymous-tag> .?AT<anonymous-tag>@@ _ � � .
" Flags
_ ExtentInformation F a ( _STREAM_EXTENT_ENTRY .?AU_STREAM_EXTENT_ENTRY@@ �� b � � > � USN_RECORD_EXTENT .?AUUSN_RECORD_EXTENT@@ *
Offset ���
Length ���> e USN_RECORD_EXTENT .?AUUSN_RECORD_EXTENT@@ f � � � VERIFIER_MODE_UNUSED � VERIFIER_MODE_TRIAGE � VERIFIER_MODE_FIELD �� VERIFIER_MODE_LOGO ��� VERIFIER_MODE_TEST ���2 t h VERIFIER_MODE .?AW4VERIFIER_MODE@@ � i � � & � _ABC .?AU_ABC@@ ��
k
� 2
t abcA �
u abcB �
t abcC �& m _ABC .?AU_ABC@@ �� n � � > � tagREGISTERWORDW .?AUtagREGISTERWORDW@@ ��
p
� *
q lpReading
q lpWord ���> r tagREGISTERWORDW .?AUtagREGISTERWORDW@@ �� s � ` j � _SECURE_SPECULATION_CONTROL_INFORMATION .?AU_SECURE_SPECULATION_CONTROL_INFORMATION@@
u
�
" ��
" ��
" ��
" ��
" ��
" ��
w KvaShadowSupported ���
x KvaShadowEnabled �
y KvaShadowUserGlobal ��
z KvaShadowPcid
{ MbClearEnabled ���
| Reserved �: } <anonymous-tag> .?AU<anonymous-tag>@@ ~ � � &
~ SecureSpeculationFlags ���j � _SECURE_SPECULATION_CONTROL_INFORMATION .?AU_SECURE_SPECULATION_CONTROL_INFORMATION@@ � � � b � _RTL_PROCESS_BACKTRACE_INFORMATION .?AU_RTL_PROCESS_BACKTRACE_INFORMATION@@ �� " � �j
p SymbolicBackTrace
" TraceCount ���
! Index
!
Depth
� BackTrace b � � _RTL_PROCESS_BACKTRACE_INFORMATION .?AU_RTL_PROCESS_BACKTRACE_INFORMATION@@ �� � � : � tagSOUNDSENTRYA .?AUtagSOUNDSENTRYA@@ R
u cbSize ���
" dwFlags ��
" iFSTextEffect
" iFSTextEffectMSec
" iFSTextEffectColorBits ���
" iFSGrafEffect
" iFSGrafEffectMSec
" iFSGrafEffectColor ���
" iWindowsEffect ���
" $ iWindowsEffectMSec ���
p ( lpszWindowsEffectDLL �
" , iWindowsEffectOrdinal : � 0 tagSOUNDSENTRYA .?AUtagSOUNDSENTRYA@@ � ~ 4 6 � _STARTUPINFOW .?AU_STARTUPINFOW@@
�
� �
" cb ���
q lpReserved ���
q lpDesktop
q lpTitle ��
" dwX ��
" dwY ��
" dwXSize ��
" dwYSize ��
" dwXCountChars
" $ dwYCountChars
" ( dwFillAttribute ��
" , dwFlags ��
! 0 wShowWindow ��
! 2 cbReserved2 ��
4 lpReserved2 ��
8 hStdInput
< hStdOutput ���
@ hStdError 6 � D _STARTUPINFOW .?AU_STARTUPINFOW@@ � � 7 f � _EVENT_TRACE_SPINLOCK_INFORMATION_V1 .?AU_EVENT_TRACE_SPINLOCK_INFORMATION_V1@@ ��
? EventTraceInformationClass ���
" SpinLockSpinThreshold
" SpinLockAcquireSampleRate
" SpinLockContentionSampleRate �f � _EVENT_TRACE_SPINLOCK_INFORMATION_V1 .?AU_EVENT_TRACE_SPINLOCK_INFORMATION_V1@@ �� � @ 6 � _devicemodeA .?AU_devicemodeA@@ ��
� dmDeviceName �
! dmSpecVersion
! " dmDriverVersion ��
! $ dmSize ���
! & dmDriverExtra
" ( dmFields �
, dmOrientation
. dmPaperSize ��
0 dmPaperLength
2 dmPaperWidth �
4 dmScale ��
6 dmCopies �
8 dmDefaultSource ��
: dmPrintQuality ���
� , dmPosition ���
" 4 dmDisplayOrientation �
" 8 dmDisplayFixedOutput �
< dmColor ��
> dmDuplex �
@ dmYResolution
B dmTTOption ���
D dmCollate
� F dmFormName ���
! f dmLogPixels ��
" h dmBitsPerPel �
" l dmPelsWidth ��
" p dmPelsHeight �
" t dmDisplayFlags ���
" t dmNup
" x dmDisplayFrequency ���
" | dmICMMethod ��
" � dmICMIntent ��
" � dmMediaType ��
" � dmDitherType �
" � dmReserved1 ��
" � dmReserved2 ��
" � dmPanningWidth ���
" � dmPanningHeight ��6 & � � _devicemodeA .?AU_devicemodeA@@ �� � � � N � _CM_KEYBOARD_DEVICE_DATA .?AU_CM_KEYBOARD_DEVICE_DATA@@ ��f
! Version ��
! Revision �
Type �
Subtype ��
! KeyboardFlags N � _CM_KEYBOARD_DEVICE_DATA .?AU_CM_KEYBOARD_DEVICE_DATA@@ �� � & > � MARK_HANDLE_INFO .?AUMARK_HANDLE_INFO@@ ��b
" UsnSourceInfo
" CopyNumber ���
VolumeHandle �
" HandleInfo ���> � MARK_HANDLE_INFO .?AUMARK_HANDLE_INFO@@ �� � � . F � _SERVICE_TABLE_ENTRYW .?AU_SERVICE_TABLE_ENTRYW@@
q
� " � �
�
� 2
q lpServiceName
� lpServiceProc F � _SERVICE_TABLE_ENTRYW .?AU_SERVICE_TABLE_ENTRYW@@ � � } J � DPI_AWARENESS_CONTEXT__ .?AUDPI_AWARENESS_CONTEXT__@@
t unused ���J � DPI_AWARENESS_CONTEXT__ .?AUDPI_AWARENESS_CONTEXT__@@ � s 2 SystemPowerState � DevicePowerState �: t � _POWER_STATE_TYPE .?AW4_POWER_STATE_TYPE@@ � � { � 2 � tagGLYPHSET .?AUtagGLYPHSET@@ 2 � tagWCRANGE .?AUtagWCRANGE@@ �� � " �n
" cbThis ���
" flAccel ��
" cGlyphsSupported �
" cRanges ��
� ranges ���2 � tagGLYPHSET .?AUtagGLYPHSET@@ � � � Z � _JOURNAL_RENAME_KEY_INFORMATION .?AU_JOURNAL_RENAME_KEY_INFORMATION@@ Z JournalCreateKey � JournalDeleteKey � JournalRenameKey � JournalSetValue �� JournalDeleteValue ��� JournalSetKeySecurity JournalSetKeyUserFlags ��� JournalSetLastWriteTime �� JournalBeginTransaction �� JournalCommitTransaction �
JournalAbortTransaction �� MaxJournalChangeAction ���Z t � _JOURNAL_CHANGE_INFORMATION_CLASS .?AW4_JOURNAL_CHANGE_INFORMATION_CLASS@@ �2 onecore\internal\sdk\inc\minwin\ntregapi.h � � � � r
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
KeyKeyName ���Z � ( _JOURNAL_RENAME_KEY_INFORMATION .?AU_JOURNAL_RENAME_KEY_INFORMATION@@ � � � 2 ThreadBasicInformation ��� ThreadTimes �� ThreadPriority ��� ThreadBasePriority ��� ThreadAffinityMask ��� ThreadImpersonationToken � ThreadDescriptorTableEntry ��� ThreadEnableAlignmentFaultFixup �� ThreadEventPair_Reusable � ThreadQuerySetWin32StartAddress ��
ThreadZeroTlsCell ThreadPerformanceCount ��� ThreadAmILastThread ��
ThreadIdealProcessor � ThreadPriorityBoost �� ThreadSetTlsArrayAddress � ThreadIsIoPending ThreadHideFromDebugger ��� ThreadBreakOnTermination � ThreadSwitchLegacyState �� ThreadIsTerminated ��� ThreadLastSystemCall � ThreadIoPriority � ThreadCycleTime �� ThreadPagePriority ��� ThreadActualBasePriority � ThreadTebInformation � ThreadCSwitchMon � ThreadCSwitchPmu � ThreadWow64Context ��� ThreadGroupInformation ��� ThreadUmsInformation � ThreadCounterProfiling ��� ! ThreadIdealProcessorEx ��� " ThreadCpuAccountingInformation ��� # ThreadSuspendCount ��� $ ThreadHeterogeneousCpuPolicy � % ThreadContainerId & ThreadNameInformation ' ThreadSelectedCpuSets ( ThreadSystemThreadInformation ) ThreadActualGroupAffinity * ThreadDynamicCodePolicyInfo �� + ThreadExplicitCaseSensitivity , ThreadWorkOnBehalfTicket � - ThreadSubsystemInformation ��� . ThreadDbgkWerReportActive / ThreadAttachContainer 0 ThreadManageWritesToExecutableMemory � 1 ThreadPowerThrottlingState ��� 2 ThreadWorkloadClass �� 3 MaxThreadInfoClass ���: 4 t � _THREADINFOCLASS .?AW4_THREADINFOCLASS@@ ��� � D � �
�
� 2 � tagACTCTXA .?AUtagACTCTXA@@ ���
" cbSize ���
" dwFlags ��
� lpSource �
! wProcessorArchitecture ���
! wLangId ��
� lpAssemblyDirectory ��
� lpResourceName ���
� lpApplicationName
� hModule ��2 � tagACTCTXA .?AUtagACTCTXA@@ �� � n F V ResourceManagerBasicInformation �� ResourceManagerCompletionInformation �^ t � _RESOURCEMANAGER_INFORMATION_CLASS .?AW4_RESOURCEMANAGER_INFORMATION_CLASS@@ ��� � � O ~ � _MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION .?AU_MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION@@ ��
�
� �
" Flags
" NumaNode �
" LargePageSize
" NumberOfLargePagesToCreate ���
" NumberOfLargePagesCreated ~ � _MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION .?AU_MEMORY_PARTITION_CREATE_LARGE_PAGES_INFORMATION@@ �� � w � n SubsystemInformationTypeWin32 SubsystemInformationTypeWSL �� MaxSubsystemInformationType ��N t � _SUBSYSTEM_INFORMATION_TYPE .?AW4_SUBSYSTEM_INFORMATION_TYPE@@ � � D � � RtlSparseBitmapOperationClear RtlSparseBitmapOperationSet �� RtlSparseBitmapOperationAny �� RtlSparseBitmapOperationMax ��Z t � _RTL_SPARSE_BITMAP_CTX_OPERATION .?AW4_RTL_SPARSE_BITMAP_CTX_OPERATION@@ ��� � � J � _SILO_USER_SHARED_DATA .?AU_SILO_USER_SHARED_DATA@@ ��
�
�
" ServiceSessionId �
" ActiveConsoleId ��
ConsoleSessionForegroundProcessId
� NtProductType
" SuiteMask
" SharedUserSessionId ��
IsMultiSessionSku
� NtSystemRoot �
� &UserModeGlobalLogger �J � H_SILO_USER_SHARED_DATA .?AU_SILO_USER_SHARED_DATA@@ �� � � u
> AclRevisionInformation ��� AclSizeInformation ���F t � _ACL_INFORMATION_CLASS .?AW4_ACL_INFORMATION_CLASS@@ ��� � w I B � tagDELETEITEMSTRUCT .?AUtagDELETEITEMSTRUCT@@
�
� b
u CtlType ��
u CtlID
u itemID ���
� hwndItem �
" itemData �B � tagDELETEITEMSTRUCT .?AUtagDELETEITEMSTRUCT@@ � ~ !
� � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT@@ v
ResolutionContext
" RootIndex
CancelResolution �
NoMoreEntries
Root � � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_GET_ROOT@@ � � � B � _CACHE_RELATIONSHIP .?AU_CACHE_RELATIONSHIP@@
�
� " �
Level
Associativity
! LineSize �
" CacheSize
- Type �
� Reserved �
" GroupMask B � , _CACHE_RELATIONSHIP .?AU_CACHE_RELATIONSHIP@@ � � + V � _FILE_MAKE_COMPATIBLE_BUFFER .?AU_FILE_MAKE_COMPATIBLE_BUFFER@@ ��
CloseDisc V � _FILE_MAKE_COMPATIBLE_BUFFER .?AU_FILE_MAKE_COMPATIBLE_BUFFER@@ �� � � Z � _ETW_THREAD_EVENT_SUBPROCESSTAG .?AU_ETW_THREAD_EVENT_SUBPROCESSTAG@@ >
m Header ���
" OldTag ���
" $ NewTag ���Z � ( _ETW_THREAD_EVENT_SUBPROCESSTAG .?AU_ETW_THREAD_EVENT_SUBPROCESSTAG@@ � b U
n
� b
HeapHandle ���
SubSegment ���
" SubSegmentSize ���
" BlockSize ^ � _HEAP_EVENT_SUBSEGMENT_ALLOC_FREE .?AU_HEAP_EVENT_SUBSEGMENT_ALLOC_FREE@@ � b =
" ��
" ��>
" Flags
� FilterId �
� ReservedFlags v � _PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY@@ � D � > � tagDEBUGHOOKINFO .?AUtagDEBUGHOOKINFO@@ ��j
" idThread �
" idThreadInstaller
lParam ���
u wParam ���
t code �> � tagDEBUGHOOKINFO .?AUtagDEBUGHOOKINFO@@ �� � ~ y N � _STREAM_INFORMATION_ENTRY .?AU_STREAM_INFORMATION_ENTRY@@
� : � _StreamInformation .?AT_StreamInformation@@ ��B
" Version ��
" Flags
StreamInformation N _STREAM_INFORMATION_ENTRY .?AU_STREAM_INFORMATION_ENTRY@@ � p J � _ImageArchitectureEntry .?AU_ImageArchitectureEntry@@ .
" FixupInstRVA �
" NewInst ��J _ImageArchitectureEntry .?AU_ImageArchitectureEntry@@ � c � EtwBufferStateFree ��� EtwBufferStateGeneralLogging � EtwBufferStateCSwitch EtwBufferStateFlush �� EtwBufferStatePendingCompression � EtwBufferStateCompressed � EtwBufferStatePlaceholder EtwBufferStateMaximum : t _ETW_BUFFER_STATE .?AW4_ETW_BUFFER_STATE@@ � b �
�
� > � _COVERAGE_MODULES .?AU_COVERAGE_MODULES@@ N � _COVERAGE_MODULE_REQUEST .?AU_COVERAGE_MODULE_REQUEST@@ ��F � _COVERAGE_MODULE_INFO .?AU_COVERAGE_MODULE_INFO@@ " �f
" ListAndReset �
" NumberOfModules ��
ModuleRequestInfo
Modules ��> 4 _COVERAGE_MODULES .?AU_COVERAGE_MODULES@@ � � R � _ACCESS_DENIED_CALLBACK_ACE .?AU_ACCESS_DENIED_CALLBACK_ACE@@ :
� Header ���
" Mask �
" SidStart �R _ACCESS_DENIED_CALLBACK_ACE .?AU_ACCESS_DENIED_CALLBACK_ACE@@ w � . � tagINPUT .?AUtagINPUT@@ ��6 � tagMOUSEINPUT .?AUtagMOUSEINPUT@@ 6 � tagKEYBDINPUT .?AUtagKEYBDINPUT@@ > � tagHARDWAREINPUT .?AUtagHARDWAREINPUT@@ ��B
" type �
mi ���
ki ���
hi ���. tagINPUT .?AUtagINPUT@@ �� ~ � � � � ! N � _FILE_DISPOSITION_INFO_EX .?AU_FILE_DISPOSITION_INFO_EX@@
#
�
" Flags N % _FILE_DISPOSITION_INFO_EX .?AU_FILE_DISPOSITION_INFO_EX@@ & n �" R � _TXFS_SAVEPOINT_INFORMATION .?AU_TXFS_SAVEPOINT_INFORMATION@@ N
KtmTransaction ���
" ActionCode ���
" SavepointId ��R ) _TXFS_SAVEPOINT_INFORMATION .?AU_TXFS_SAVEPOINT_INFORMATION@@ * � �
� 6 � _RPC_MESSAGE .?AU_RPC_MESSAGE@@ ��
-
� J � _RPC_SYNTAX_IDENTIFIER .?AU_RPC_SYNTAX_IDENTIFIER@@ ��
/
�
Handle ���
" DataRepresentation ���
Buffer ���
u BufferLength �
u ProcNum ��
0 TransferSyntax ���
RpcInterfaceInformation ��
ReservedForRuntime ���
ManagerEpv ���
$ ImportContext
" ( RpcFlags �6 1 , _RPC_MESSAGE .?AU_RPC_MESSAGE@@ ��. onecore\external\shared\inc\rpcdcep.h �� 2 3 3
� 6 � _currencyfmtA .?AU_currencyfmtA@@ �
u NumDigits
u LeadingZero ��
u Grouping �
p lpDecimalSep �
p lpThousandSep
u NegativeOrder
u PositiveOrder
p lpCurrencySymbol �6 7 _currencyfmtA .?AU_currencyfmtA@@ 8 V � > � tagRAWINPUTDEVICE .?AUtagRAWINPUTDEVICE@@
:
� Z
! usUsagePage ��
! usUsage ��
" dwFlags ��
� hwndTarget ���> < tagRAWINPUTDEVICE .?AUtagRAWINPUTDEVICE@@ = ~ ^; F � _PERFINFO_PO_PRESLEEP .?AU_PERFINFO_PO_PRESLEEP@@ B
� PerformanceCounter ���
� PerformanceFrequency �F @ _PERFINFO_PO_PRESLEEP .?AU_PERFINFO_PO_PRESLEEP@@ A b � 6 � tagAXESLISTA .?AUtagAXESLISTA@@ ��
C
� 6 � tagAXISINFOA .?AUtagAXISINFOA@@ �� E " � �J
" axlReserved ��
" axlNumAxes ���
F axlAxisInfo ��6 G �tagAXESLISTA .?AUtagAXESLISTA@@ �� H � 6 N � _HEAP_REGION_INFORMATION .?AU_HEAP_REGION_INFORMATION@@ ��
J
� �
" Address ��
" ReserveSize ��
" CommitSize ���
" FirstRangeInformationOffset ��
" NextRegionInformationOffset ��N L _HEAP_REGION_INFORMATION .?AU_HEAP_REGION_INFORMATION@@ �� M � � R � _FILE_GET_QUOTA_INFORMATION .?AU_FILE_GET_QUOTA_INFORMATION@@ & � _SID .?AU_SID@@ ��B
" NextEntryOffset ��
" SidLength
P Sid ��R Q _FILE_GET_QUOTA_INFORMATION .?AU_FILE_GET_QUOTA_INFORMATION@@ R � � F � _ALPC_PORT_ATTRIBUTES .?AU_ALPC_PORT_ATTRIBUTES@@
T
� V � _SECURITY_QUALITY_OF_SERVICE .?AU_SECURITY_QUALITY_OF_SERVICE@@ ���
" Flags
V SecurityQos ��
" MaxMessageLength �
" MemoryBandwidth ��
" MaxPoolUsage �
" MaxSectionSize ���
" MaxViewSize ��
" $ MaxTotalSectionSize ��
" ( DupObjectTypes ���F W , _ALPC_PORT_ATTRIBUTES .?AU_ALPC_PORT_ATTRIBUTES@@ X � � B � _REMOTE_NAME_INFOW .?AU_REMOTE_NAME_INFOW@@ ��
Z
� V
q lpUniversalName ��
q lpConnectionName �
q lpRemainingPath ��B \ _REMOTE_NAME_INFOW .?AU_REMOTE_NAME_INFOW@@ �� ] � � R � _ALPC_WORK_ON_BEHALF_TICKET .?AU_ALPC_WORK_ON_BEHALF_TICKET@@ 6
" ThreadId �
" ThreadCreationTimeLow R ` _ALPC_WORK_ON_BEHALF_TICKET .?AU_ALPC_WORK_ON_BEHALF_TICKET@@ a � l > � _WMI_POWER_RECORD .?AU_WMI_POWER_RECORD@@
c
� �
SystemS1 �
SystemS2 �
SystemS3 �
SystemS4 �
SystemS5 �
AoAc �
p Pad2 �
p Pad3 �> e _WMI_POWER_RECORD .?AU_WMI_POWER_RECORD@@ f b s N � _SERVICE_FAILURE_ACTIONSA .?AU_SERVICE_FAILURE_ACTIONSA@@ 2 � _SC_ACTION .?AU_SC_ACTION@@ ��
i
� r
" dwResetPeriod
p lpRebootMsg ��
p lpCommand
" cActions �
j lpsaActions ��N k _SERVICE_FAILURE_ACTIONSA .?AU_SERVICE_FAILURE_ACTIONSA@@ l � 2
UniqueProcess
UniqueThread �2 n _CLIENT_ID .?AU_CLIENT_ID@@ �� o D � � SERVERSILO_INITING ��� SERVERSILO_STARTED ��� SERVERSILO_SHUTTING_DOWN � SERVERSILO_TERMINATING ��� SERVERSILO_TERMINATED : t q _SERVERSILO_STATE .?AW4_SERVERSILO_STATE@@ � r D � N � _FILE_GET_EA_INFORMATION .?AU_FILE_GET_EA_INFORMATION@@ ��
t
� J
" NextEntryOffset ��
EaNameLength �
EaName ���N v _FILE_GET_EA_INFORMATION .?AU_FILE_GET_EA_INFORMATION@@ �� w � � ^ � _CI_LOG_SCHEDULER_SLEEP_RESPONSE .?AU_CI_LOG_SCHEDULER_SLEEP_RESPONSE@@ ��
Header ���^ z 0 _CI_LOG_SCHEDULER_SLEEP_RESPONSE .?AU_CI_LOG_SCHEDULER_SLEEP_RESPONSE@@ �� { b [ : � _WMI_PAGE_FAULT .?AU_WMI_PAGE_FAULT@@
}
� :
VirtualAddress ���
ProgramCounter ���: _WMI_PAGE_FAULT .?AU_WMI_PAGE_FAULT@@ � b 2 � _CHAR_INFO .?AU_CHAR_INFO@@ ��
�
� .
q UnicodeChar ��
p AsciiChar 2 � <anonymous-tag> .?AT<anonymous-tag>@@ . onecore\external\sdk\inc\wincontypes.h � � � � *
� Char �
! Attributes ���2 � _CHAR_INFO .?AU_CHAR_INFO@@ �� � � � � ThreadMemoryPriority � ThreadAbsoluteCpuPriority ThreadDynamicCodePolicy �� ThreadPowerThrottling ThreadInformationClassMax J t � _THREAD_INFORMATION_CLASS .?AW4_THREAD_INFORMATION_CLASS@@ � � � 0 � IoPriorityVeryLow IoPriorityLow IoPriorityNormal � IoPriorityHigh ��� IoPriorityCritical ��� MaxIoPriorityTypes ���: t � _IO_PRIORITY_HINT .?AW4_IO_PRIORITY_HINT@@ � � � � J � _THREAD_UMS_INFORMATION .?AU_THREAD_UMS_INFORMATION@@ � UmsInformationCommandInvalid � UmsInformationCommandAttach �� UmsInformationCommandDetach �� UmsInformationCommandQuery ���V t � _THREAD_UMS_INFORMATION_COMMAND .?AW4_THREAD_UMS_INFORMATION_COMMAND@@ � � D
Y
� > � _RTL_UMS_CONTEXT .?AU_RTL_UMS_CONTEXT@@ ��
�
�
" ��
" ��
� Command ��
� CompletionList ���
� UmsContext ���
" Flags
� IsUmsSchedulerThread �
� IsUmsWorkerThread J � _THREAD_UMS_INFORMATION .?AU_THREAD_UMS_INFORMATION@@ � D ' B � EVENT_INSTANCE_INFO .?AUEVENT_INSTANCE_INFO@@ .
RegHandle
" InstanceId ���B � EVENT_INSTANCE_INFO .?AUEVENT_INSTANCE_INFO@@ � � D & IoSessionStateCreated IoSessionStateInitialized IoSessionStateConnected �� IoSessionStateDisconnected ��� IoSessionStateDisconnectedLoggedOn ��� IoSessionStateLoggedOn ��� IoSessionStateLoggedOff �� IoSessionStateTerminated � IoSessionStateMax : t � _IO_SESSION_STATE .?AW4_IO_SESSION_STATE@@ � � � * � __n64x3 .?AU__n64x3@@ " �
� val ��* � __n64x3 .?AU__n64x3@@ � % V R � _SYSTEM_ALARM_CALLBACK_ACE .?AU_SYSTEM_ALARM_CALLBACK_ACE@@ ��:
� Header ���
" Mask �
" SidStart �R � _SYSTEM_ALARM_CALLBACK_ACE .?AU_SYSTEM_ALARM_CALLBACK_ACE@@ �� � w j � _SYSTEM_ISOLATED_USER_MODE_INFORMATION .?AU_SYSTEM_ISOLATED_USER_MODE_INFORMATION@@ ��
��
��
��
��
��
��
��
��
��
�� " �J
� SecureKernelRunning ��
� HvciEnabled ��
� HvciStrictMode ���
� DebugEnabled �
� FirmwarePageProtection ���
� EncryptionKeyAvailable ���
� SpareFlags ���
� TrustletRunning ��
� HvciDisableAllowed ���
� SpareFlags2 ��
� Spare0 ���
# Spare1 ���j � _SYSTEM_ISOLATED_USER_MODE_INFORMATION .?AU_SYSTEM_ISOLATED_USER_MODE_INFORMATION@@ �� � � N V � _FILE_DISPOSITION_INFORMATION .?AU_FILE_DISPOSITION_INFORMATION@@
�
�
DeleteFile ���V � _FILE_DISPOSITION_INFORMATION .?AU_FILE_DISPOSITION_INFORMATION@@ � � � F � _LOGICAL_DISK_EXTENTS .?AU_LOGICAL_DISK_EXTENTS@@
�
� q " � q " �b
# StartingOffset ���
# PartitionSize
" DiskNumber ���
" Size �
" DriveType
� DriveLetterString
" $ Pad ��
" ( PartitionNumber ��
" , SectorsPerCluster
" 0 BytesPerSector ���
8 NumberOfFreeClusters �
@ TotalNumberOfClusters
� H FileSystemType ���
" h VolumeExt F � p _LOGICAL_DISK_EXTENTS .?AU_LOGICAL_DISK_EXTENTS@@ � b � B � _SERVICE_NOTIFY_2W .?AU_SERVICE_NOTIFY_2W@@ ��
-
� �
" dwVersion
� pfnNotifyCallback
pContext �
" dwNotificationStatus �
� ServiceStatus
" 4 dwNotificationTriggered ��
q 8 pszServiceNames ��B � < _SERVICE_NOTIFY_2W .?AU_SERVICE_NOTIFY_2W@@ �� � � � 6 � _RTL_BARRIER .?AU_RTL_BARRIER@@ �� " �f
" Reserved1
" Reserved2
� Reserved3
" Reserved4
" Reserved5 : � <anonymous-tag> .?AU<anonymous-tag>@@ � g g �
Q Barrier ��
LeftBarrier ��
� WaitEvent
TotalProcessors ��
" Spins
� DUMMYRESERVEDSTRUCTNAME ��6 � _RTL_BARRIER .?AU_RTL_BARRIER@@ �� � g W
" ��
" ��
" ��
" ��
" Flags
� NoChildProcessCreation ���
� AuditNoChildProcessCreation ��
� AllowSecureProcessCreation ���
� ReservedFlags n � _PROCESS_MITIGATION_CHILD_PROCESS_POLICY .?AU_PROCESS_MITIGATION_CHILD_PROCESS_POLICY@@ �� � D � : � _SE_TOKEN_USER .?AU_SE_TOKEN_USER@@ ��2 � _TOKEN_USER .?AU_TOKEN_USER@@ B � _SID_AND_ATTRIBUTES .?AU_SID_AND_ATTRIBUTES@@ " D �J
� TokenUser
� User �
P Sid ��
� Buffer ���: � L _SE_TOKEN_USER .?AU_SE_TOKEN_USER@@ �� � w v
� J � _EFI_DRIVER_ENTRY_LIST .?AU_EFI_DRIVER_ENTRY_LIST@@ ��6
" NextEntryOffset ��
J DriverEntry ��J � _EFI_DRIVER_ENTRY_LIST .?AU_EFI_DRIVER_ENTRY_LIST@@ �� � � " > � tagHIGHCONTRASTW .?AUtagHIGHCONTRASTW@@ ��
�
� F
u cbSize ���
" dwFlags ��
q lpszDefaultScheme > � tagHIGHCONTRASTW .?AUtagHIGHCONTRASTW@@ �� � ~ p2 " ViewShare ViewUnmap : t � _SECTION_INHERIT .?AW4_SECTION_INHERIT@@ ��� � � � � PowerDeviceUnspecified ��� PowerDeviceD0 PowerDeviceD1 PowerDeviceD2 PowerDeviceD3 PowerDeviceMaximum ���> t � _DEVICE_POWER_STATE .?AW4_DEVICE_POWER_STATE@@ � � { � v PerfInfoMemReset � PerfInfoMemResetUndo � PerfInfoMemResetUndoFailed ��� PerfInfoMemResetMax ��R t � _PERFINFO_MEM_RESET_INFO_TYPE .?AW4_PERFINFO_MEM_RESET_INFO_TYPE@@ � � b q > � _TRACE_GUID_INFO .?AU_TRACE_GUID_INFO@@ ��.
" InstanceCount
" Reserved �> � _TRACE_GUID_INFO .?AU_TRACE_GUID_INFO@@ �� � � � CrossProcOperationMemoryAllocPreNotify ��� CrossProcOperationMemoryAllocPostNotify �� CrossProcOperationMemoryFreePreNotify CrossProcOperationMemoryFreePostNotify ��� CrossProcOperationMemoryProtectPreNotify � CrossProcOperationMemoryProtectPostNotify CrossProcOperationInstructionCacheFlush �� CrossProcOperationInstructionCacheFlushHeavy � CrossProcOperationMemoryDirtyNotify ��b t � RTLWOW64_CROSSPROCESS_WORK_OPERATION .?AW4RTLWOW64_CROSSPROCESS_WORK_OPERATION@@ ��� � � � J � _PROCESS_DISK_COUNTERS .?AU_PROCESS_DISK_COUNTERS@@ ��
�
� �
# BytesRead
# BytesWritten �
# ReadOperationCount ���
# WriteOperationCount ��
# FlushOperationCount ��J � ( _PROCESS_DISK_COUNTERS .?AU_PROCESS_DISK_COUNTERS@@ �� � � j � _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION .?AU_SYSTEM_CODEINTEGRITYPOLICY_INFORMATION@@
� Z
" Options ��
" HVCIOptions ��
# Version ��
$ PolicyGuid ���j _SYSTEM_CODEINTEGRITYPOLICY_INFORMATION .?AU_SYSTEM_CODEINTEGRITYPOLICY_INFORMATION@@ � � n BootEntropySourceNone BootEntropySourceSeedfile BootEntropySourceExternal BootEntropySourceTpm � BootEntropySourceRdrand �� BootEntropySourceTime BootEntropySourceAcpiOem0 BootEntropySourceUefi BootEntropySourceCng � BootEntropySourceTcbTpm ��
BootEntropySourceTcbRdrand ���
BootMaxEntropySources F t _BOOT_ENTROPY_SOURCE_ID .?AW4_BOOT_ENTROPY_SOURCE_ID@@ � �
E
� Z � _RTL_PROCESS_MODULE_INFORMATION .?AU_RTL_PROCESS_MODULE_INFORMATION@@ " ��
Section ��
MappedBase ���
ImageBase
" ImageSize
" Flags
! LoadOrderIndex ���
! InitOrderIndex ���
! LoadCount
! OffsetToFileName �
FullPathName �Z
_RTL_PROCESS_MODULE_INFORMATION .?AU_RTL_PROCESS_MODULE_INFORMATION@@ � � R � _PERFINFO_PROCESS_PERFCTR64 .?AU_PERFINFO_PROCESS_PERFCTR64@@
� �
" ProcessId
" PageFaultCount ���
" HandleCount ��
" Reserved �
# PeakVirtualSize ��
# PeakWorkingSetSize ���
# PeakPagefileUsage
# ( QuotaPeakPagedPoolUsage ��
# 0 QuotaPeakNonPagedPoolUsage ���
# 8 VirtualSize ��
# @ WorkingSetSize ���
# H PagefileUsage
# P QuotaPagedPoolUsage ��
# X QuotaNonPagedPoolUsage ���
# ` PrivatePageCount �R h _PERFINFO_PROCESS_PERFCTR64 .?AU_PERFINFO_PROCESS_PERFCTR64@@ b � EventSecuritySetDACL � EventSecuritySetSACL � EventSecurityAddDACL � EventSecurityAddSACL � EventSecurityMax �F t EVENTSECURITYOPERATION .?AW4EVENTSECURITYOPERATION@@ ��� U 2 ^ POINTER_FEEDBACK_DEFAULT � POINTER_FEEDBACK_INDIRECT POINTER_FEEDBACK_NONE B t POINTER_FEEDBACK_MODE .?AW4POINTER_FEEDBACK_MODE@@ � ~ $ F � _SECURITY_ATTRIBUTES .?AU_SECURITY_ATTRIBUTES@@ ��R
" nLength ��
lpSecurityDescriptor �
t bInheritHandle ���F _SECURITY_ATTRIBUTES .?AU_SECURITY_ATTRIBUTES@@ �� � . � SectionBasicInformation �� SectionImageInformation �� SectionRelocationInformation � SectionOriginalBaseInformation ��� SectionInternalImageInformation �� MaxSectionInfoClass ��N t _SECTION_INFORMATION_CLASS .?AW4_SECTION_INFORMATION_CLASS@@ ��� w ^ " " " "
#
� ^ � _FILE_FS_VOLUME_FLAGS_INFORMATION .?AU_FILE_FS_VOLUME_FLAGS_INFORMATION@@
" Flags ^ & _FILE_FS_VOLUME_FLAGS_INFORMATION .?AU_FILE_FS_VOLUME_FLAGS_INFORMATION@@ ' � � ^ � _ETW_SESSION_NOTIFICATION_PACKET .?AU_ETW_SESSION_NOTIFICATION_PACKET@@ ��N � _ETW_NOTIFICATION_HEADER .?AU_ETW_NOTIFICATION_HEADER@@ �� EtwSessionNotificationMediaChanged ��� EtwSessionNotificationSessionTerminated �� EtwSessionNotificationLogfileError ��� EtwSessionNotificationRealtimeError �� EtwSessionNotificationSessionStarted � EtwSessionNotificationMax V t + _ETW_SESSION_NOTIFICATION_TYPE .?AW4_ETW_SESSION_NOTIFICATION_TYPE@@ ��� , @ h r
* NotificationHeader ���
, H Type �
L Status ���
# P TraceHandle ��
7 X Reserved �^ . ` _ETW_SESSION_NOTIFICATION_PACKET .?AU_ETW_SESSION_NOTIFICATION_PACKET@@ �� / @ q Z � _ETW_CREATEDELETE_OBJECT_EVENT .?AU_ETW_CREATEDELETE_OBJECT_EVENT@@ ��
1
� .
Object ���
! ObjectType ���Z 3 _ETW_CREATEDELETE_OBJECT_EVENT .?AU_ETW_CREATEDELETE_OBJECT_EVENT@@ �� 4 b v
Z � _ETW_COVERAGE_SAMPLER_OPTION_FLAGS .?AT_ETW_COVERAGE_SAMPLER_OPTION_FLAGS@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��n
" AllFlags �
7 RequireProfileTotalIssuesSource ��
8 ForceProfileTimeSource ���
9 NoProfileSampling
: NoCSwitchSampling
; NoReadyThreadSampling
< NoFaultSampling ��
= NoStackCache �
> NoSampleBuffers ��
? NoPauseWhenFull ��
@ NoLowPriority
A WithAppId
B FilterKernel �Z
C _ETW_COVERAGE_SAMPLER_OPTION_FLAGS .?AT_ETW_COVERAGE_SAMPLER_OPTION_FLAGS@@ �� D @ � v � _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION@@
F
� .
SectionObject
RangeBase v H _PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_OBJECT_INFORMATION@@ I b r � WorkerFactoryCallbackNormal �� WorkerFactoryCallbackLongRunning � WorkerFactoryCallbackIndependent � WorkerFactoryCallbackDetectedUnrecoverableError ��V t K _WORKER_FACTORY_CALLBACK_CLASS .?AW4_WORKER_FACTORY_CALLBACK_CLASS@@ ��� L � � � RelationProcessorCore RelationNumaNode � RelationCache RelationProcessorPackage � RelationGroup ���RelationAll V t N _LOGICAL_PROCESSOR_RELATIONSHIP .?AW4_LOGICAL_PROCESSOR_RELATIONSHIP@@ � O � � J � DISK_SPACE_INFORMATION .?AUDISK_SPACE_INFORMATION@@ ��
# ActualTotalAllocationUnits ���
# ActualAvailableAllocationUnits ���
# ActualPoolUnavailableAllocationUnits �
# CallerTotalAllocationUnits ���
# CallerAvailableAllocationUnits ���
# ( CallerPoolUnavailableAllocationUnits �
# 0 UsedAllocationUnits ��
# 8 TotalReservedAllocationUnits �
# @ VolumeStorageReserveAllocationUnits ��
# H AvailableCommittedAllocationUnits
# P PoolAvailableAllocationUnits �
" X SectorsPerAllocationUnit �
" \ BytesPerSector ���J
R ` DISK_SPACE_INFORMATION .?AUDISK_SPACE_INFORMATION@@ ��2 onecore\external\sdk\inc\minwin\fileapi.h �� S T � ^ � _PERFINFO_SAMPLED_PROFILE_CONFIG .?AU_PERFINFO_SAMPLED_PROFILE_CONFIG@@ ��F
" Source ���
" NewInterval ��
" OldInterval ��^ W _PERFINFO_SAMPLED_PROFILE_CONFIG .?AU_PERFINFO_SAMPLED_PROFILE_CONFIG@@ �� X b � z IMDT_UNAVAILABLE � IMDT_KEYBOARD IMDT_MOUSE ��� IMDT_TOUCH ��� IMDT_PEN � IMDT_TOUCHPAD R t Z tagINPUT_MESSAGE_DEVICE_TYPE .?AW4tagINPUT_MESSAGE_DEVICE_TYPE@@ ��� [ ~ �= n � _EVENT_TRACE_PROFILE_COUNTER_INFORMATION .?AU_EVENT_TRACE_PROFILE_COUNTER_INFORMATION@@ ��Z
? EventTraceInformationClass ���
# TraceHandle ��
� ProfileSource n ^ _EVENT_TRACE_PROFILE_COUNTER_INFORMATION .?AU_EVENT_TRACE_PROFILE_COUNTER_INFORMATION@@ �� _ @ F 6 � _TOKEN_GROUPS .?AU_TOKEN_GROUPS@@ � " �.
" GroupCount ���
b Groups ���6 c _TOKEN_GROUPS .?AU_TOKEN_GROUPS@@ d w � # " � u " � ! " � " � " � t " � " � p " � @ " �&
low64
high64 ���: o <anonymous-tag> .?AU<anonymous-tag>@@ p % J �
f n128_u64 �
g n128_u32 �
h n128_u16 �
i n128_u8 ��
j n128_i64 �
k n128_i32 �
l n128_i16 �
m n128_i8 ��
n n128_f32 �
p s "
&r __n128 .?AT__n128@@ �� s % = N � _ETW_KQUEUE_DEQUEUE_EVENT .?AU_ETW_KQUEUE_DEQUEUE_EVENT@@
u
� " �B
" ThreadId �
" EntryCount ���
w Entries ��N x _ETW_KQUEUE_DEQUEUE_EVENT .?AU_ETW_KQUEUE_DEQUEUE_EVENT@@ y b �
� User �2 { _TOKEN_USER .?AU_TOKEN_USER@@ | w p @ @ ~ F GEOCLASS_NATION �� GEOCLASS_REGION �� GEOCLASS_ALL �. t � SYSGEOCLASS .?AW4SYSGEOCLASS@@ � � V ) F UNSPECIFIED_COMPARTMENT_ID ��� DEFAULT_COMPARTMENT_ID ���6 t � COMPARTMENT_ID .?AW4COMPARTMENT_ID@@ ��� � �
" � B � _SHUFFLE_FILE_DATA .?AU_SHUFFLE_FILE_DATA@@ ��
�
� B
StartingOffset ���
Length ���
" Flags B � _SHUFFLE_FILE_DATA .?AU_SHUFFLE_FILE_DATA@@ �� � � Q( R � _FILE_QUERY_SPARING_BUFFER .?AU_FILE_QUERY_SPARING_BUFFER@@ ��r
" SparingUnitBytes �
SoftwareSparing ��
" TotalSpareBlocks �
" FreeSpareBlocks ��R � _FILE_QUERY_SPARING_BUFFER .?AU_FILE_QUERY_SPARING_BUFFER@@ �� � � 1 B � _RASTERIZER_STATUS .?AU_RASTERIZER_STATUS@@ ��>
nSize
wFlags ���
nLanguageID ��B � _RASTERIZER_STATUS .?AU_RASTERIZER_STATUS@@ �� � �
* � _FIBER .?AU_FIBER@@ ��. � _CONTEXT .?AU_CONTEXT@@ ��. � _Wx86TIB .?AU_Wx86TIB@@ ��
�
�
� B
FiberData
@ ExceptionList
StackBase
StackLimit ���
DeallocationStack
� FiberContext �
� �Wx86Tib ��
� �ActivationContextStackPointer
�FlsData ��
" �GuaranteedStackBytes �
! �TebFlags �
! �ReservedPad ��
" �FiberCookie ��*
� �_FIBER .?AU_FIBER@@ �� � � , 6 � _MEMORYSTATUS .?AU_MEMORYSTATUS@@ �
" dwLength �
" dwMemoryLoad �
" dwTotalPhys ��
" dwAvailPhys ��
" dwTotalPageFile ��
" dwAvailPageFile ��
" dwTotalVirtual ���
" dwAvailVirtual ���6 � _MEMORYSTATUS .?AU_MEMORYSTATUS@@ � n V 6 � tagAXISINFOW .?AUtagAXISINFOW@@ ��J
axMinValue ���
axMaxValue ���
� axAxisName ���6 � ( tagAXISINFOW .?AUtagAXISINFOW@@ �� � � & : � _WOW64_CONTEXT .?AU_WOW64_CONTEXT@@ ��N � _WOW64_FLOATING_SAVE_AREA .?AU_WOW64_FLOATING_SAVE_AREA@@ �
" ContextFlags �
" Dr0 ��
" Dr1 ��
" Dr2 ��
" Dr3 ��
" Dr6 ��
" Dr7 ��
� FloatSave
" � SegGs
" � SegFs
" � SegEs
" � SegDs
" � Edi ��
" � Esi ��
" � Ebx ��
" � Edx ��
" � Ecx ��
" � Eax ��
" � Ebp ��
" � Eip ��
" � SegCs
" � EFlags ���
" � Esp ��
" � SegSs
� � ExtendedRegisters : � �_WOW64_CONTEXT .?AU_WOW64_CONTEXT@@ ��. onecore\internal\sdk\inc\ntwow64_x.h ��� � � \
� B MutantBasicInformation ��� MutantOwnerInformation ���J t � _MUTANT_INFORMATION_CLASS .?AW4_MUTANT_INFORMATION_CLASS@@ � � � ) > � _KSPIN_LOCK_QUEUE .?AU_KSPIN_LOCK_QUEUE@@
�
�
"
� "
� Next �
� Lock �> � _KSPIN_LOCK_QUEUE .?AU_KSPIN_LOCK_QUEUE@@ � K � V � _PERFINFO_CC_LAZY_WRITE_SCAN .?AU_PERFINFO_CC_LAZY_WRITE_SCAN@@ ��
�
� r
" WorkItemKey ��
" ReasonForFlush ���
" PagesToWrite �
" TotalDirtyPages ��
" AvailablePages ���
" DirtyPageThreshold ���
" NumberOfMappedVacbs ��
" TopDirtyPageThreshold
" BottomDirtyPageThreshold �
" $ AverageAvailablePages
" ( AverageDirtyPages
" , ConsecutiveWorklessLazywriteScans V � 0 _PERFINFO_CC_LAZY_WRITE_SCAN .?AU_PERFINFO_CC_LAZY_WRITE_SCAN@@ �� � b �
�
� J � _LDR_DLL_NOTIFICATION_DATA .?AT_LDR_DLL_NOTIFICATION_DATA@@ ��
�
� ^ � _LDR_DLL_LOADED_NOTIFICATION_DATA .?AU_LDR_DLL_LOADED_NOTIFICATION_DATA@@ *
� Loaded ���
V Unloaded �J � _LDR_DLL_NOTIFICATION_DATA .?AT_LDR_DLL_NOTIFICATION_DATA@@ �� � � �
. ( � > � tagMENUITEMINFOA .?AUtagMENUITEMINFOA@@ ��
� ��
�
� * � HMENU__ .?AUHMENU__@@
�
� �
u cbSize ���
u fMask
u fType
u fState ���
u wID ��
� hSubMenu �
{ hbmpChecked ��
{ hbmpUnchecked
" dwItemData ���
p $ dwTypeData ���
u ( cch ��
{ , hbmpItem �> � 0 tagMENUITEMINFOA .?AUtagMENUITEMINFOA@@ �� � ~ � N � _SYSTEM_POWER_INFORMATION .?AU_SYSTEM_POWER_INFORMATION@@
�
� f
" MaxIdlenessAllowed ���
" Idleness �
" TimeRemaining
CoolingMode ��N � _SYSTEM_POWER_INFORMATION .?AU_SYSTEM_POWER_INFORMATION@@ � { � : � tagICEXYZTRIPLE .?AUtagICEXYZTRIPLE@@ . � tagCIEXYZ .?AUtagCIEXYZ@@ F
� ciexyzRed
� ciexyzGreen ��
� ciexyzBlue ���: � $ tagICEXYZTRIPLE .?AUtagICEXYZTRIPLE@@ � � � � " " " � B � _LAST_EXCEPTION_LOG .?AU_LAST_EXCEPTION_LOG@@
�
� > � _EXCEPTION_RECORD .?AU_EXCEPTION_RECORD@@ � ExceptionContinueExecution ��� ExceptionContinueSearch �� ExceptionNestedException � ExceptionCollidedUnwind ��F t � _EXCEPTION_DISPOSITION .?AW4_EXCEPTION_DISPOSITION@@ ���. onecore\external\sdk\inc\crt\excpt.h ��� � � ' z
� ExceptionRecord ��
� P ContextRecord
" �ControlPc
� �Disposition ��
�HandlerData ��B � _LAST_EXCEPTION_LOG .?AU_LAST_EXCEPTION_LOG@@ � , * � _FIXED .?AU_FIXED@@ ��"
! fract
value * � _FIXED .?AU_FIXED@@ �� � � c
ManageHotPatchLoadPatch �� ManageHotPatchUnloadPatch ManageHotPatchQueryPatches ��� ManageHotPatchLoadPatchForUser ��� ManageHotPatchUnloadPatchForUser � ManageHotPatchQueryPatchesForUser ManageHotPatchQueryActivePatches � ManageHotPatchMax R t � _HOT_PATCH_INFORMATION_CLASS .?AW4_HOT_PATCH_INFORMATION_CLASS@@ ��� � w :
�
� R � _SYSTEM_DEVICE_INFORMATION .?AU_SYSTEM_DEVICE_INFORMATION@@ ��
�
� �
" NumberOfDisks
" NumberOfFloppies �
" NumberOfCdRoms ���
" NumberOfTapes
" NumberOfSerialPorts ��
" NumberOfParallelPorts R � _SYSTEM_DEVICE_INFORMATION .?AU_SYSTEM_DEVICE_INFORMATION@@ �� � � x ^ � _RTL_STACK_TRACE_DATABASE_CREATE .?AU_RTL_STACK_TRACE_DATABASE_CREATE@@ ��J
CommitBase ���
" CommitSize ���
" ReserveSize ��^ � _RTL_STACK_TRACE_DATABASE_CREATE .?AU_RTL_STACK_TRACE_DATABASE_CREATE@@ �� � � F � _EISA_PORT_DESCRIPTOR .?AU_EISA_PORT_DESCRIPTOR@@
��
��
��
��Z
� NumberPorts ��
� Reserved �
� Shared ���
� MoreEntries ��F � _EISA_PORT_DESCRIPTOR .?AU_EISA_PORT_DESCRIPTOR@@ � : � tagICONMETRICSA .?AUtagICONMETRICSA@@ 2 � tagLOGFONTA .?AUtagLOGFONTA@@ r
u cbSize ���
t iHorzSpacing �
t iVertSpacing �
t iTitleWrap ���
� lfFont ���: � L tagICONMETRICSA .?AUtagICONMETRICSA@@ � ~ &2 Z � _INVERTED_FUNCTION_TABLE_ENTRY .?AU_INVERTED_FUNCTION_TABLE_ENTRY@@ ��J � _DYNAMIC_FUNCTION_TABLE .?AU_DYNAMIC_FUNCTION_TABLE@@
� v
� FunctionTable
DynamicTable �
ImageBase
" SizeOfImage ��
" SizeOfTable ��Z _INVERTED_FUNCTION_TABLE_ENTRY .?AU_INVERTED_FUNCTION_TABLE_ENTRY@@ �� � j � _JOBOBJECT_LIMIT_VIOLATION_INFORMATION .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION@@ ��R
" LimitFlags ���
" ViolationLimitFlags ��
# IoReadBytes ��
# IoReadBytesLimit �
# IoWriteBytes �
# IoWriteBytesLimit
� ( PerJobUserTime ���
� 0 PerJobUserTimeLimit ��
# 8 JobMemory
# @ JobMemoryLimit ���
M H RateControlTolerance �
M L RateControlToleranceLimit j P _JOBOBJECT_LIMIT_VIOLATION_INFORMATION .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION@@ �� D � 6 � tagTOGGLEKEYS .?AUtagTOGGLEKEYS@@ *
u cbSize ���
" dwFlags ��6 tagTOGGLEKEYS .?AUtagTOGGLEKEYS@@ ~ Z4 2 � tagRAWINPUT .?AUtagRAWINPUT@@
� > � tagRAWINPUTHEADER .?AUtagRAWINPUTHEADER@@ : � tagRAWKEYBOARD .?AUtagRAWKEYBOARD@@ ��. � tagRAWHID .?AUtagRAWHID@@ 6
mouse
keyboard �
hid ��2 <anonymous-tag> .?AT<anonymous-tag>@@ ~ �: &
header ���
data �2 ( tagRAWINPUT .?AUtagRAWINPUT@@ ~ �: v FeatureVariantPayloadKindNone FeatureVariantPayloadKindResident FeatureVariantPayloadKindExternal Z t _RTL_FEATURE_VARIANT_PAYLOAD_KIND .?AW4_RTL_FEATURE_VARIANT_PAYLOAD_KIND@@ � M
� f � _PROCESS_EXTENDED_BASIC_INFORMATION64 .?AU_PROCESS_EXTENDED_BASIC_INFORMATION64@@
� V � _PROCESS_BASIC_INFORMATION64 .?AU_PROCESS_BASIC_INFORMATION64@@ ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��>
# Size �
BasicInfo
u 8 Flags
8 IsProtectedProcess ���
! 8 IsWow64Process ���
" 8 IsProcessDeleting
# 8 IsCrossSessionCreate �
$ 8 IsFrozen �
% 8 IsBackground �
& 8 IsStronglyNamed ��
' 8 IsSecureProcess ��
( 8 IsPicoProcess
) 8 SpareBits f
* @ _PROCESS_EXTENDED_BASIC_INFORMATION64 .?AU_PROCESS_EXTENDED_BASIC_INFORMATION64@@ + � � > � tagCOPYDATASTRUCT .?AUtagCOPYDATASTRUCT@@
-
� >
" dwData ���
" cbData ���
lpData ���> / tagCOPYDATASTRUCT .?AUtagCOPYDATASTRUCT@@ 0 ~ ) F � _RTL_PROTECTED_ACCESS .?AU_RTL_PROTECTED_ACCESS@@ Z
" DominateMask �
" DeniedProcessAccess ��
" DeniedThreadAccess ���F 3 _RTL_PROTECTED_ACCESS .?AU_RTL_PROTECTED_ACCESS@@ 4 � > � MFT_ENUM_DATA_V1 .?AUMFT_ENUM_DATA_V1@@ ��
6
� �
# StartFileReferenceNumber �
LowUsn ���
HighUsn ��
! MinMajorVersion ��
! MaxMajorVersion ��> 8 MFT_ENUM_DATA_V1 .?AUMFT_ENUM_DATA_V1@@ �� 9 � �
V � _PS_CPU_QUOTA_SET_INFORMATION .?AU_PS_CPU_QUOTA_SET_INFORMATION@@ .
SessionHandle
" Weight ���V < _PS_CPU_QUOTA_SET_INFORMATION .?AU_PS_CPU_QUOTA_SET_INFORMATION@@ = � * RTL_RESOURCE_POLICY_FLAGS_NONE ���N t ? _RTL_RESOURCE_POLICY_FLAGS .?AW4_RTL_RESOURCE_POLICY_FLAGS@@ ��� @ C > � _FILE_SEGMENT_ELEMENT .?AT_FILE_SEGMENT_ELEMENT@@
B
� *
Buffer ���
# Alignment > D _FILE_SEGMENT_ELEMENT .?AT_FILE_SEGMENT_ELEMENT@@ E � Z WnfInfoStateNameExist WnfInfoSubscribersPresent WnfInfoIsQuiescent ���N t G _WNF_STATE_NAME_INFORMATION .?AW4_WNF_STATE_NAME_INFORMATION@@ � H �
6 � _COMMTIMEOUTS .?AU_COMMTIMEOUTS@@ �
" ReadIntervalTimeout ��
" ReadTotalTimeoutMultiplier ���
" ReadTotalTimeoutConstant �
" WriteTotalTimeoutMultiplier ��
" WriteTotalTimeoutConstant 6 K _COMMTIMEOUTS .?AU_COMMTIMEOUTS@@ L n 2 � _RTL_TICK_LOCK .?AT_RTL_TICK_LOCK@@ ��
# ��
# ?��6
# AsULong64
O Busy �
P Ticks 2 Q _RTL_TICK_LOCK .?AT_RTL_TICK_LOCK@@ �� R � f � _FILE_STORAGE_RESERVE_ID_INFORMATION .?AU_FILE_STORAGE_RESERVE_ID_INFORMATION@@ ��
T
� � StorageReserveIdNone � StorageReserveIdHard � StorageReserveIdSoft � StorageReserveIdUpdateScratch StorageReserveIdMax ��> t V _STORAGE_RESERVE_ID .?AW4_STORAGE_RESERVE_ID@@ � W �
W StorageReserveId �f Y _FILE_STORAGE_RESERVE_ID_INFORMATION .?AU_FILE_STORAGE_RESERVE_ID_INFORMATION@@ �� Z � S+ 6 � _FILE_ID_INFO .?AU_FILE_ID_INFO@@
\
� 6
# VolumeSerialNumber ���
m FileId ���6 ^ _FILE_ID_INFO .?AU_FILE_ID_INFO@@ _ n &# R � _RTL_CRITICAL_SECTION_DEBUG .?AU_RTL_CRITICAL_SECTION_DEBUG@@ F � _RTL_CRITICAL_SECTION .?AU_RTL_CRITICAL_SECTION@@
b
� �
! Type �
! CreatorBackTraceIndex
c CriticalSection ��
! ProcessLocksList �
" EntryCount ���
" ContentionCount ��
" Flags
! CreatorBackTraceIndexHigh
! SpareUSHORT ��R d _RTL_CRITICAL_SECTION_DEBUG .?AU_RTL_CRITICAL_SECTION_DEBUG@@ e � < V � _FILE_PIPE_REMOTE_INFORMATION .?AU_FILE_PIPE_REMOTE_INFORMATION@@
g
� B
� CollectDataTime ��
" MaximumCollectionCount ���V i _FILE_PIPE_REMOTE_INFORMATION .?AU_FILE_PIPE_REMOTE_INFORMATION@@ j � \ ^ � _RTL_FEATURE_CONFIGURATION_TABLE .?AU_RTL_FEATURE_CONFIGURATION_TABLE@@ ��R � _RTL_FEATURE_CONFIGURATION .?AU_RTL_FEATURE_CONFIGURATION@@ �� m " �.
" FeatureCount �
n Features �^ o _RTL_FEATURE_CONFIGURATION_TABLE .?AU_RTL_FEATURE_CONFIGURATION_TABLE@@ �� p o ^ � _THREAD_LAST_SYSCALL_INFORMATION .?AU_THREAD_LAST_SYSCALL_INFORMATION@@ �� ! " �Z
FirstArgument
! SystemCallNumber �
s Pad ��
# WaitTime �^ t _THREAD_LAST_SYSCALL_INFORMATION .?AU_THREAD_LAST_SYSCALL_INFORMATION@@ �� u � � > � _WIN32_FIND_DATAW .?AU_WIN32_FIND_DATAW@@
w
� q " �
" dwFileAttributes �
x ftCreationTime ���
x ftLastAccessTime �
x ftLastWriteTime ��
" nFileSizeHigh
" nFileSizeLow �
" $ dwReserved0 ��
" ( dwReserved1 ��
� , cFileName
y 4cAlternateFileName ���>
z P_WIN32_FIND_DATAW .?AU_WIN32_FIND_DATAW@@ { � w ^ � __PUBLIC_OBJECT_TYPE_INFORMATION .?AU__PUBLIC_OBJECT_TYPE_INFORMATION@@ �� " " X �*
TypeName �
~ Reserved �^ ` __PUBLIC_OBJECT_TYPE_INFORMATION .?AU__PUBLIC_OBJECT_TYPE_INFORMATION@@ �� � m �
�
� V � _RTL_CRITICAL_SECTION_DEBUG32 .?AU_RTL_CRITICAL_SECTION_DEBUG32@@
�
� �
! Type �
! CreatorBackTraceIndex
" CriticalSection ��
ProcessLocksList �
" EntryCount ���
" ContentionCount ��
7 Spare V � _RTL_CRITICAL_SECTION_DEBUG32 .?AU_RTL_CRITICAL_SECTION_DEBUG32@@ � � q ^ � _SYSTEM_SHADOW_STACK_INFORMATION .?AU_SYSTEM_SHADOW_STACK_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
� CetCapable ���
� UserCetAllowed ���
� ReservedForUserCet ���
� KernelCetEnabled �
� ReservedForKernelCet �
� Reserved �^ � _SYSTEM_SHADOW_STACK_INFORMATION .?AU_SYSTEM_SHADOW_STACK_INFORMATION@@ �� � � )
j RpcCurrentUniqueUser � RpcBackEndConnectionAttempts � RpcBackEndConnectionFailed ��� RpcRequestsPerSecond � RpcIncomingConnections ��� RpcIncomingBandwidth � RpcOutgoingBandwidth � RpcAttemptedLbsDecisions � RpcFailedLbsDecisions
RpcAttemptedLbsMessages �� RpcFailedLbsMessages � RpcLastCounter ���B t � RpcProxyPerfCounters .?AW4RpcProxyPerfCounters@@ ��� � 3 ` � t " �
�
� B � IMAGE_COR20_HEADER .?AUIMAGE_COR20_HEADER@@ ��F � _IMAGE_DATA_DIRECTORY .?AU_IMAGE_DATA_DIRECTORY@@ V
" cb ���
! MajorRuntimeVersion ��
! MinorRuntimeVersion ��
� MetaData �
" Flags
" EntryPointToken ��
" EntryPointRVA
� Resources
� StrongNameSignature ��
� ( CodeManagerTable �
� 0 VTableFixups �
� 8 ExportAddressTableJumps ��
� @ ManagedNativeHeader ��B
� H IMAGE_COR20_HEADER .?AUIMAGE_COR20_HEADER@@ �� � � �
Q
�
! ��
! ��z
! Reserved1
! ExtType ��
� Linkage ��
� Reserved2
! DataSize �
# DataPtr ��^ � _EVENT_HEADER_EXTENDED_DATA_ITEM .?AU_EVENT_HEADER_EXTENDED_DATA_ITEM@@ �� � U G t u �
�
�
{
�
x
y . � tagPOINTS .?AUtagPOINTS@@ � s � : � _RTL_HASH_TABLE .?AU_RTL_HASH_TABLE@@
" ��
" ��
[
� ^
" EntryCount ���
� MaskBitCount �
� BucketCount ��
� Buckets ��: � _RTL_HASH_TABLE .?AU_RTL_HASH_TABLE@@ . onecore\internal\sdk\inc\rtlhashdef.h �� � � n � _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY@@
�
� "
� DisableNonSystemFonts n � _RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_FONT_DISABLE_POLICY@@ � � � FileStorageTierClassUnspecified �� FileStorageTierClassCapacity � FileStorageTierClassPerformance �� FileStorageTierClassMax ��J t � _FILE_STORAGE_TIER_CLASS .?AW4_FILE_STORAGE_TIER_CLASS@@ ��� � � �
�
� > � tagTITLEBARINFOEX .?AUtagTITLEBARINFOEX@@
�
� " " � " ` �V
" cbSize ���
rcTitleBar ���
� rgstate ��
� , rgrect ���> � � tagTITLEBARINFOEX .?AUtagTITLEBARINFOEX@@ � ~ 9 R RF_SORTED RF_UNSORTED �� RF_CALLBACK �� RF_KERNEL_DYNAMIC B t � _FUNCTION_TABLE_TYPE .?AW4_FUNCTION_TABLE_TYPE@@ ��� � D f PerfInfoDebugEventReceived ��� PerfInfoDebugEventContinued �� PerfInfoDebugEventMax R t � _PERFINFO_DEBUG_EVENT_REASON .?AW4_PERFINFO_DEBUG_EVENT_REASON@@ ��� � b
6 � _WMI_SPINLOCK .?AU_WMI_SPINLOCK@@
�
�
��
��
��Z
SpinLockAddress ��
CallerAddress
# AcquireTime ��
# ReleaseTime ��
" WaitTimeInCycles �
" SpinCount
" ThreadId �
" $ InterruptCount ���
( Irql �
) AcquireDepth �
� * AcquireMode ��
� * ExecuteDpc ���
� * ExecuteIsr ���
* Flags
O + Reserved �6 � 0 _WMI_SPINLOCK .?AU_WMI_SPINLOCK@@ � b D > � _PERFINFO_CCSWAP .?AU_PERFINFO_CCSWAP@@ ��
" ��
" ��
" ��
" ��
"
��
" ��
� DataType �
� TimeDelta
� OldThreadIdIndex �
� OldThreadStateWr �
� OldThreadPriority
� NewThreadWaitTime > � _PERFINFO_CCSWAP .?AU_PERFINFO_CCSWAP@@ �� � b � B � _TRACE_ENABLE_INFO .?AU_TRACE_ENABLE_INFO@@ ��
�
� �
" IsEnabled
Level
Reserved1
! LoggerId �
" EnableProperty ���
" Reserved2
# MatchAnyKeyword ��
# MatchAllKeyword ��B � _TRACE_ENABLE_INFO .?AU_TRACE_ENABLE_INFO@@ �� � � � f � _VIRTUALIZATION_INSTANCE_INFO_OUTPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_OUTPUT@@ ��&
$ VirtualizationInstanceID �f � _VIRTUALIZATION_INSTANCE_INFO_OUTPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_OUTPUT@@ �� � � �" V � _FILE_TYPE_NOTIFICATION_INPUT .?AU_FILE_TYPE_NOTIFICATION_INPUT@@ $ " �F
" Flags
" NumFileTypeIDs ���
� FileTypeID ���V � _FILE_TYPE_NOTIFICATION_INPUT .?AU_FILE_TYPE_NOTIFICATION_INPUT@@ � � ^ � _RTL_QUERY_DEBUG_INFORMATION_INFO .?AU_RTL_QUERY_DEBUG_INFORMATION_INFO@@ B
" UniqueProcessId ��
" Flags
# Buffer ���^ � _RTL_QUERY_DEBUG_INFORMATION_INFO .?AU_RTL_QUERY_DEBUG_INFORMATION_INFO@@ � �
{ � f � _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA@@ .
DeviceInstance ���
" Flags f � _PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_CONTROL_DATA@@ � $ � F � _SYSDBG_CONTROL_SPACE .?AU_SYSDBG_CONTROL_SPACE@@
�
� R
# Address ��
Buffer ���
" Request ��
" Processor F � _SYSDBG_CONTROL_SPACE .?AU_SYSDBG_CONTROL_SPACE@@ � � : � _TXFS_MODIFY_RM .?AU_TXFS_MODIFY_RM@@ �
" Flags
" LogContainerCountMax �
" LogContainerCountMin �
" LogContainerCount
" LogGrowthIncrement ���
" LogAutoShrinkPercentage ��
# Reserved �
! LoggingMode ��: � ( _TXFS_MODIFY_RM .?AU_TXFS_MODIFY_RM@@ � � � R DirectoryNotifyInformation ��� DirectoryNotifyExtendedInformation ���^ t � _DIRECTORY_NOTIFY_INFORMATION_CLASS .?AW4_DIRECTORY_NOTIFY_INFORMATION_CLASS@@ � � � �
�
� >
AceType ��
AceFlags �
! AceSize ��2 � _ACE_HEADER .?AU_ACE_HEADER@@ w � F � _HEAP_SUBSEGMENT_FREE .?AU_HEAP_SUBSEGMENT_FREE@@ &
m Header ���
n Event F 0 _HEAP_SUBSEGMENT_FREE .?AU_HEAP_SUBSEGMENT_FREE@@ b F * � _cpinfo .?AU_cpinfo@@
� " � " �F
u MaxCharSize ��
DefaultChar ��
LeadByte �*
_cpinfo .?AU_cpinfo@@ V ? : � tagENUMLOGFONTW .?AUtagENUMLOGFONTW@@
� 2 � tagLOGFONTW .?AUtagLOGFONTW@@ q " � � q " @ �F
elfLogFont ���
\ elfFullName ��
� elfStyle �: tagENUMLOGFONTW .?AUtagENUMLOGFONTW@@ � � J � _FILE_LINK_INFORMATION .?AU_FILE_LINK_INFORMATION@@ ��
� v
ReplaceIfExists ��
" Flags
RootDirectory
" FileNameLength ���
FileName �J _FILE_LINK_INFORMATION .?AU_FILE_LINK_INFORMATION@@ �� � � b � _PERFINFO_DRIVER_COMPLETIONROUTINE .?AU_PERFINFO_DRIVER_COMPLETIONROUTINE@@ ��
� B
Routine ��
IrpPtr ���
" UniqMatchId ��b _PERFINFO_DRIVER_COMPLETIONROUTINE .?AU_PERFINFO_DRIVER_COMPLETIONROUTINE@@ �� b % B � _KLOCK_QUEUE_HANDLE .?AU_KLOCK_QUEUE_HANDLE@@
� *
� LockQueue
OldIrql ��B ! _KLOCK_QUEUE_HANDLE .?AU_KLOCK_QUEUE_HANDLE@@ " K � j � _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION_V2@@ ��b � _JOBOBJECT_MEMORY_USAGE_INFORMATION .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION@@ # " �F
% BasicInfo
# JobSharedMemory ��
& Reserved �j ' ( _JOBOBJECT_MEMORY_USAGE_INFORMATION_V2 .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION_V2@@ �� ( � V ^ � _IMAGE_LOAD_CONFIG_CODE_INTEGRITY .?AU_IMAGE_LOAD_CONFIG_CODE_INTEGRITY@@ R
! Flags
! Catalog ��
" CatalogOffset
" Reserved �^ + _IMAGE_LOAD_CONFIG_CODE_INTEGRITY .?AU_IMAGE_LOAD_CONFIG_CODE_INTEGRITY@@ , � � : � tagSERIALKEYSW .?AUtagSERIALKEYSW@@ ��
u cbSize ���
" dwFlags ��
q lpszActivePort ���
q lpszPort �
u iBaudRate
u iPortState ���
u iActive ��: / tagSERIALKEYSW .?AUtagSERIALKEYSW@@ �� 0 ~ R2 : � tagEXTLOGPEN32 .?AUtagEXTLOGPEN32@@ ��
" elpPenStyle ��
" elpWidth �
u elpBrushStyle
" elpColor �
" elpHatch �
" elpNumEntries
z elpStyleEntry : 3 tagEXTLOGPEN32 .?AUtagEXTLOGPEN32@@ �� 4 � � 6 � _RTL_RESOURCE .?AU_RTL_RESOURCE@@
6
�
a
� �
b CriticalSection ��
SharedSemaphore ��
} NumberOfWaitingShared
ExclusiveSemaphore ���
} $ NumberOfWaitingExclusive �
Q ( NumberOfActive ���
, ExclusiveOwnerThread �
" 0 Flags
8 4 DebugInfo 6 9 8 _RTL_RESOURCE .?AU_RTL_RESOURCE@@ : � � R � _RTL_HEAP_MEMORY_LIMIT_INFO .?AU_RTL_HEAP_MEMORY_LIMIT_INFO@@
<
� R � _RTL_HEAP_MEMORY_LIMIT_DATA .?AU_RTL_HEAP_MEMORY_LIMIT_DATA@@ &
" Version ��
> Data �R ? _RTL_HEAP_MEMORY_LIMIT_INFO .?AU_RTL_HEAP_MEMORY_LIMIT_INFO@@ @ g �
� SYSTEM_HANDLE_FILE ��� SYSTEM_HANDLE_SEMAPHORE �� SYSTEM_HANDLE_EVENT �� SYSTEM_HANDLE_MUTEX �� SYSTEM_HANDLE_PROCESS SYSTEM_HANDLE_TOKEN �� SYSTEM_HANDLE_SECTION SYSTEM_HANDLE_REG_KEY SYSTEM_HANDLE_THREAD � SYSTEM_HANDLE_COMPOSITION_OBJECT �
SYSTEM_HANDLE_SOCKET � SYSTEM_HANDLE_JOB SYSTEM_HANDLE_PIPE ��� SYSTEM_HANDLE_MAX � SYSTEM_HANDLE_INVALID : t B _system_handle_t .?AW4_system_handle_t@@ ��� C � � TransactionManagerBasicInformation ��� TransactionManagerLogInformation � TransactionManagerLogPathInformation � TransactionManagerRecoveryInformation TransactionManagerOnlineProbeInformation � TransactionManagerOldestTransactionInformation ���b t E _TRANSACTIONMANAGER_INFORMATION_CLASS .?AW4_TRANSACTIONMANAGER_INFORMATION_CLASS@@ � F � < V � _SYSTEM_FILECACHE_INFORMATION .?AU_SYSTEM_FILECACHE_INFORMATION@@
" CurrentSize ��
" PeakSize �
" PageFaultCount ���
" MinimumWorkingSet
" MaximumWorkingSet
" CurrentSizeIncludingTransitionInPages
" PeakSizeIncludingTransitionInPages ���
" TransitionRePurposeCount �
" Flags V I $ _SYSTEM_FILECACHE_INFORMATION .?AU_SYSTEM_FILECACHE_INFORMATION@@ J �
q t L
M
� B � _FILE_STANDARD_INFO .?AU_FILE_STANDARD_INFO@@ v
� AllocationSize ���
� EndOfFile
" NumberOfLinks
DeletePending
Directory B P _FILE_STANDARD_INFO .?AU_FILE_STANDARD_INFO@@ Q n y" n � _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX@@ ��J � _PROCESSOR_RELATIONSHIP .?AU_PROCESSOR_RELATIONSHIP@@ J � _NUMA_NODE_RELATIONSHIP .?AU_NUMA_NODE_RELATIONSHIP@@ B � _GROUP_RELATIONSHIP .?AU_GROUP_RELATIONSHIP@@ r
O Relationship �
" Size �
T Processor
U NumaNode �
� Cache
V Group n W L _SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX@@ �� X � C > � _HIBERFILE_BUCKET .?AU_HIBERFILE_BUCKET@@
Z
� >
# MaxPhysicalMemory
� PhysicalMemoryPercent > \ _HIBERFILE_BUCKET .?AU_HIBERFILE_BUCKET@@ ] { �
�
� > � _CM_MCA_POS_DATA .?AU_CM_MCA_POS_DATA@@ ��f
! AdapterId
PosData1 �
PosData2 �
PosData3 �
PosData4 �> a _CM_MCA_POS_DATA .?AU_CM_MCA_POS_DATA@@ �� b � F � _SYSTEM_BIGPOOL_ENTRY .?AU_SYSTEM_BIGPOOL_ENTRY@@
d
�
" �� " �n
VirtualAddress ���
f NonPaged �
" SizeInBytes ��
g Tag ��
" TagUlong �F h _SYSTEM_BIGPOOL_ENTRY .?AU_SYSTEM_BIGPOOL_ENTRY@@ i � �
J � _PLEX_READ_DATA_REQUEST .?AU_PLEX_READ_DATA_REQUEST@@ J
� ByteOffset ���
" ByteLength ���
" PlexNumber ���J l _PLEX_READ_DATA_REQUEST .?AU_PLEX_READ_DATA_REQUEST@@ m � � J � _WMI_THREAD_INFORMATION .?AU_WMI_THREAD_INFORMATION@@
o
� *
" ProcessId
" ThreadId �J q _WMI_THREAD_INFORMATION .?AU_WMI_THREAD_INFORMATION@@ r b j � _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY .?AU_RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY@@ b
� BlockRemoteImageLoads
� BlockLowLabelImageLoads ��
� PreferSystem32 ���j u _RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY .?AU_RTL_IMAGE_MITIGATION_IMAGE_LOAD_POLICY@@ v � f TableEmptyTree ��� TableFoundNode ��� TableInsertAsLeft TableInsertAsRight ���B t x _TABLE_SEARCH_RESULT .?AW4_TABLE_SEARCH_RESULT@@ ��� y g D N � _NETWORK_APP_INSTANCE_EA .?AU_NETWORK_APP_INSTANCE_EA@@ ��.
$ AppInstanceID
" CsvFlags �N | _NETWORK_APP_INSTANCE_EA .?AU_NETWORK_APP_INSTANCE_EA@@ �� } � , V � _REFS_SMR_VOLUME_INFO_OUTPUT .?AU_REFS_SMR_VOLUME_INFO_OUTPUT@@ ��n SmrGcStateInactive ��� SmrGcStatePaused � SmrGcStateActive � SmrGcStateActiveFullSpeed J t � _REFS_SMR_VOLUME_GC_STATE .?AW4_REFS_SMR_VOLUME_GC_STATE@@ � � � � # " 8 �"
" Version ��
" Flags
� SizeOfRandomlyWritableTier ���
� FreeSpaceInRandomlyWritableTier ��
� SizeofSMRTier
� FreeSpaceInSMRTier ���
� ( UsableFreeSpaceInSMRTier �
� 0 VolumeGcState
4 VolumeGcLastStatus ���
� 8 Unused ���V
� p _REFS_SMR_VOLUME_INFO_OUTPUT .?AU_REFS_SMR_VOLUME_INFO_OUTPUT@@ �� � � � > � _REMOTE_PORT_VIEW .?AU_REMOTE_PORT_VIEW@@ >
" Length ���
" ViewSize �
ViewBase �> � _REMOTE_PORT_VIEW .?AU_REMOTE_PORT_VIEW@@ � � � SidTypeUser �� SidTypeGroup � SidTypeDomain SidTypeAlias � SidTypeWellKnownGroup SidTypeDeletedAccount SidTypeInvalid ��� SidTypeUnknown ��� SidTypeComputer ��
SidTypeLabel � SidTypeLogonSession ��2 t � _SID_NAME_USE .?AW4_SID_NAME_USE@@ � � w ; � EventProviderBinaryTrackInfo � EventProviderSetReserved1 EventProviderSetTraits ��� EventProviderUseDescriptorType ��� MaxEventInfo �: t � _EVENT_INFO_CLASS .?AW4_EVENT_INFO_CLASS@@ � � = � F � _ACL_SIZE_INFORMATION .?AU_ACL_SIZE_INFORMATION@@ F
" AceCount �
" AclBytesInUse
" AclBytesFree �F � _ACL_SIZE_INFORMATION .?AU_ACL_SIZE_INFORMATION@@ � w \ J � tagRID_DEVICE_INFO_HID .?AUtagRID_DEVICE_INFO_HID@@ ��z
" dwVendorId ���
" dwProductId ��
" dwVersionNumber ��
! usUsagePage ��
! usUsage ��J � tagRID_DEVICE_INFO_HID .?AUtagRID_DEVICE_INFO_HID@@ �� � ~ #; F � _REPARSE_DATA_BUFFER .?AU_REPARSE_DATA_BUFFER@@ ��
�
� �
! SubstituteNameOffset �
! SubstituteNameLength �
! PrintNameOffset ��
! PrintNameLength ��
" Flags
PathBuffer ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � *# �
! SubstituteNameOffset �
! SubstituteNameLength �
! PrintNameOffset ��
! PrintNameLength ��
PathBuffer ���: �
<anonymous-tag> .?AU<anonymous-tag>@@ � � 2#
� DataBuffer ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � 9# �
" ReparseTag ���
! ReparseDataLength
! Reserved �
� SymbolicLinkReparseBuffer
� MountPointReparseBuffer ��
� GenericReparseBuffer �F � _REPARSE_DATA_BUFFER .?AU_REPARSE_DATA_BUFFER@@ �� � � ## b � _VIRTUALIZATION_INSTANCE_INFO_INPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT@@ 2
" NumberOfWorkerThreads
" Flags b � _VIRTUALIZATION_INSTANCE_INFO_INPUT .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT@@ � � �" j ThreadWorkloadClassDefault ��� ThreadWorkloadClassGraphics �� MaxThreadWorkloadClass ���F t � _THREAD_WORKLOAD_CLASS .?AW4_THREAD_WORKLOAD_CLASS@@ ��� � D � 6 PMCCounter ��� MaxHardwareCounterType ���F t � _HARDWARE_COUNTER_TYPE .?AW4_HARDWARE_COUNTER_TYPE@@ ��� � D � DEPPolicyAlwaysOff ��� DEPPolicyAlwaysOn DEPPolicyOptIn ��� DEPPolicyOptOut �� DEPTotalPolicyCount ��F t � _DEP_SYSTEM_POLICY_TYPE .?AW4_DEP_SYSTEM_POLICY_TYPE@@ � � n R � OptionAbortRetryIgnore ��� OptionOk � OptionOkCancel ��� OptionRetryCancel OptionYesNo �� OptionYesNoCancel OptionShutdownSystem � OptionOkNoWait ��� OptionCancelTryContinue ��N t � _HARDERROR_RESPONSE_OPTION .?AW4_HARDERROR_RESPONSE_OPTION@@ ��� � � � J � _TRACE_PROFILE_INTERVAL .?AU_TRACE_PROFILE_INTERVAL@@
�
� *
" Source ���
" Interval �J � _TRACE_PROFILE_INTERVAL .?AU_TRACE_PROFILE_INTERVAL@@ � � ~ " # " " " � B � _FXSAVE_FORMAT_WX86 .?AU_FXSAVE_FORMAT_WX86@@ " � � " � �&
! ControlWord ��
! StatusWord ���
! TagWord ��
! ErrorOpcode ��
" ErrorOffset ��
" ErrorSelector
" DataOffset ���
" DataSelector �
" MXCsr
" MXCsr_Mask ���
� RegisterArea �
� � Reserved3
� Reserved4 B
� _FXSAVE_FORMAT_WX86 .?AU_FXSAVE_FORMAT_WX86@@ * onecore\internal\sdk\inc\ntwow64.h � � � < B � _KCRM_PROTOCOL_BLOB .?AU_KCRM_PROTOCOL_BLOB@@
�
� �
$ ProtocolId ���
" StaticInfoLength �
" TransactionIdInfoLength ��
" Unused1 ��
" Unused2 ��B � _KCRM_PROTOCOL_BLOB .?AU_KCRM_PROTOCOL_BLOB@@ . onecore\external\shared\inc\ktmtypes.h � � � � � SharedVirtualDisksUnsupported SharedVirtualDisksSupported �� SharedVirtualDiskSnapshotsSupported �� SharedVirtualDiskCDPSnapshotsSupported ���R t � _SharedVirtualDiskSupportType .?AW4_SharedVirtualDiskSupportType@@ � � � �' R � _IMAGE_ROM_OPTIONAL_HEADER .?AU_IMAGE_ROM_OPTIONAL_HEADER@@ ��
�
� N
! Magic
MajorLinkerVersion ���
MinorLinkerVersion ���
" SizeOfCode ���
" SizeOfInitializedData
" SizeOfUninitializedData ��
" AddressOfEntryPoint ��
" BaseOfCode ���
" BaseOfData ���
" BaseOfBss
" GprMask ��
� $ CprMask ��
" 4 GpValue ��R
� 8 _IMAGE_ROM_OPTIONAL_HEADER .?AU_IMAGE_ROM_OPTIONAL_HEADER@@ �� � � 7 �
bFamilyType ��
bSerifStyle ��
bWeight ��
bProportion ��
bContrast
bStrokeVariation �
bArmStyle
bLetterform ��
bMidline �
bXHeight �.
�
tagPANOSE .?AUtagPANOSE@@ � � � J � _SYSTEM_TPM_INFORMATION .?AU_SYSTEM_TPM_INFORMATION@@
" Flags J � _SYSTEM_TPM_INFORMATION .?AU_SYSTEM_TPM_INFORMATION@@ � � � R � _WMI_JOB_SET_QUERY_NET_RATE .?AU_WMI_JOB_SET_QUERY_NET_RATE@@ >
" Flags
# MaxBandwidth �
DscpTag ��R � _WMI_JOB_SET_QUERY_NET_RATE .?AU_WMI_JOB_SET_QUERY_NET_RATE@@ � b � > � _FILE_BASIC_INFO .?AU_FILE_BASIC_INFO@@ ��
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
" FileAttributes ���> � ( _FILE_BASIC_INFO .?AU_FILE_BASIC_INFO@@ �� � n q" ^ � _RTL_FEATURE_CONFIGURATION_UPDATE .?AU_RTL_FEATURE_CONFIGURATION_UPDATE@@ n FeatureEnabledStateDefault ��� FeatureEnabledStateDisabled �� FeatureEnabledStateEnabled ���N t � _RTL_FEATURE_ENABLED_STATE .?AW4_RTL_FEATURE_ENABLED_STATE@@ ��� � / � FeatureConfigurationOperationNone FeatureConfigurationOperationFeatureState FeatureConfigurationOperationVariantState FeatureConfigurationOperationResetState ��b t � _RTL_FEATURE_CONFIGURATION_OPERATION .?AW4_RTL_FEATURE_CONFIGURATION_OPERATION@@ ��� � ! �
u FeatureId
E Priority �
� EnabledState �
EnabledStateOptions ��
Variant ��
, Reserved �
VariantPayloadKind ���
u VariantPayload ���
� Operation ^ � _RTL_FEATURE_CONFIGURATION_UPDATE .?AU_RTL_FEATURE_CONFIGURATION_UPDATE@@ � W J � _FILE_COMPRESSION_INFO .?AU_FILE_COMPRESSION_INFO@@ ��
� CompressedFileSize ���
! CompressionFormat
CompressionUnitShift �
ChunkShift ���
ClusterShift �
,
Reserved �J � _FILE_COMPRESSION_INFO .?AU_FILE_COMPRESSION_INFO@@ �� � n �" N � _TRANSACTION_NOTIFICATION .?AU_TRANSACTION_NOTIFICATION@@ z
TransactionKey ���
" TransactionNotification ��
� TmVirtualClock ���
" ArgumentLength ���N � _TRANSACTION_NOTIFICATION .?AU_TRANSACTION_NOTIFICATION@@ � � �
�
� � _ARM_BARRIER_SY �� _ARM_BARRIER_ST �� _ARM_BARRIER_ISH �
_ARM_BARRIER_ISHST ��� _ARM_BARRIER_NSH � _ARM_BARRIER_NSHST ��� _ARM_BARRIER_OSH � _ARM_BARRIER_OSHST ���J t � _tag_ARMINTR_BARRIER_TYPE .?AW4_tag_ARMINTR_BARRIER_TYPE@@ � � j
M
�
� j � _DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO .?AU_DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO@@ ��^ � DISPLAYCONFIG_DEVICE_INFO_HEADER .?AUDISPLAYCONFIG_DEVICE_INFO_HEADER@@ ��
u ��
u ��
u ��
u ��
u �� DISPLAYCONFIG_COLOR_ENCODING_RGB � DISPLAYCONFIG_COLOR_ENCODING_YCBCR444 DISPLAYCONFIG_COLOR_ENCODING_YCBCR422 DISPLAYCONFIG_COLOR_ENCODING_YCBCR420 DISPLAYCONFIG_COLOR_ENCODING_INTENSITY ��� ��DISPLAYCONFIG_COLOR_ENCODING_FORCE_UINT32 ���R t _DISPLAYCONFIG_COLOR_ENCODING .?AW4_DISPLAYCONFIG_COLOR_ENCODING@@ � � J �
� header ���
� advancedColorSupported ���
� advancedColorEnabled �
� wideColorEnforced
� advancedColorForceDisabled ���
reserved �
u value
colorEncoding
u bitsPerColorChannel ��j _DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO .?AU_DISPLAYCONFIG_GET_ADVANCED_COLOR_INFO@@ �� � T
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
MicrosoftSignedOnly ��
StoreSignedOnly ��
MitigationOptIn ��
AuditMicrosoftSignedOnly �
AuditStoreSignedOnly �
ReservedFlags r
_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY@@ D � R � _HEAP_EVENT_COMMIT_DECOMMIT .?AU_HEAP_EVENT_COMMIT_DECOMMIT@@
� N
HeapHandle ���
Block
" Size �
" Caller ���R _HEAP_EVENT_COMMIT_DECOMMIT .?AU_HEAP_EVENT_COMMIT_DECOMMIT@@ b '
� V � _PERFINFO_PO_SESSION_CALLOUT .?AU_PERFINFO_PO_SESSION_CALLOUT@@ ��b
z SystemAction �
� MinSystemState ���
" Flags
" PowerStateTask ���V _PERFINFO_PO_SESSION_CALLOUT .?AU_PERFINFO_PO_SESSION_CALLOUT@@ �� b � �
" CommitLimitBytes �
" CommitLimitFailureCode ���
" MaxAllocationSizeBytes ���
" AllocationLimitFailureCode ���R _RTL_HEAP_MEMORY_LIMIT_DATA .?AU_RTL_HEAP_MEMORY_LIMIT_DATA@@ g �
N � NOTIFY_USER_POWER_SETTING .?AUNOTIFY_USER_POWER_SETTING@@
�
$ Guid �N NOTIFY_USER_POWER_SETTING .?AUNOTIFY_USER_POWER_SETTING@@ { � : � _nlsversioninfo .?AU_nlsversioninfo@@ �
" dwNLSVersionInfoSize �
" dwNLSVersion �
" dwDefinedVersion �
" dwEffectiveId
$ guidCustomVersion : # _nlsversioninfo .?AU_nlsversioninfo@@ $ V � � � & b � _SYSTEM_SESSION_BIGPOOL_INFORMATION .?AU_SYSTEM_SESSION_BIGPOOL_INFORMATION@@
(
� d " �Z
" NextEntryOffset ��
" SessionId
" Count
* AllocatedInfo b + _SYSTEM_SESSION_BIGPOOL_INFORMATION .?AU_SYSTEM_SESSION_BIGPOOL_INFORMATION@@ , � �
~ ImagePolicyIdNone ImagePolicyIdEtw � ImagePolicyIdDebug ��� ImagePolicyIdCrashDump ��� ImagePolicyIdCrashDumpKey ImagePolicyIdCrashDumpKeyGuid ImagePolicyIdParentSd ImagePolicyIdParentSdRev � ImagePolicyIdSvn � ImagePolicyIdDeviceId
ImagePolicyIdCapability �� ImagePolicyIdScenarioId �� ImagePolicyIdMaximum �:
t . _IMAGE_POLICY_ID .?AW4_IMAGE_POLICY_ID@@ ��� / g ]& V � _KEY_WOW64_FLAGS_INFORMATION .?AU_KEY_WOW64_FLAGS_INFORMATION@@ ��
" UserFlags V 2 _KEY_WOW64_FLAGS_INFORMATION .?AU_KEY_WOW64_FLAGS_INFORMATION@@ �� 3 n � _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION@@ & " @ �
6 Cycles ���n 7 @ _SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION@@ 8 � _ N � _FILE_ACCESS_INFORMATION .?AU_FILE_ACCESS_INFORMATION@@ ��
" AccessFlags ��N ; _FILE_ACCESS_INFORMATION .?AU_FILE_ACCESS_INFORMATION@@ �� < � �
p ��
>
� R � _POWER_PLATFORM_INFORMATION .?AU_POWER_PLATFORM_INFORMATION@@
@
�
AoAc �R B _POWER_PLATFORM_INFORMATION .?AU_POWER_PLATFORM_INFORMATION@@ C { � R � _PROCESS_BASIC_INFORMATION .?AU_PROCESS_BASIC_INFORMATION@@ ��
ExitStatus ���
PebBaseAddress ���
" AffinityMask �
BasePriority �
" UniqueProcessId ��
" InheritedFromUniqueProcessId �R F _PROCESS_BASIC_INFORMATION .?AU_PROCESS_BASIC_INFORMATION@@ �� G D � R � _ETW_FINALIZE_KTIMER2_EVENT .?AU_ETW_FINALIZE_KTIMER2_EVENT@@
I
� N
" TimerKey �
" DisableCallback ��
" DisableContextKey R K _ETW_FINALIZE_KTIMER2_EVENT .?AU_ETW_FINALIZE_KTIMER2_EVENT@@ L b � B � tagENUMTEXTMETRICA .?AUtagENUMTEXTMETRICA@@ ��
N
� B � tagNEWTEXTMETRICEXA .?AUtagNEWTEXTMETRICEXA@@ :
P etmNewTextMetricEx ���
C ` etmAxesList ��B Q �tagENUMTEXTMETRICA .?AUtagENUMTEXTMETRICA@@ �� R � m
� N � _SID_AND_ATTRIBUTES_HASH .?AU_SID_AND_ATTRIBUTES_HASH@@ ��
U
�
�
� " " � �:
" SidCount �
W SidAttr ��
X Hash �N Y � _SID_AND_ATTRIBUTES_HASH .?AU_SID_AND_ATTRIBUTES_HASH@@ �� Z w X F � _TRACE_ENABLE_CONTEXT .?AU_TRACE_ENABLE_CONTEXT@@ V
! LoggerId �
Level
InternalFlag �
" EnableFlags ��F ] _TRACE_ENABLE_CONTEXT .?AU_TRACE_ENABLE_CONTEXT@@ ^ � 7 N � _FILE_STAT_LX_INFORMATION .?AU_FILE_STAT_LX_INFORMATION@@
`
� �
� FileId ���
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( AllocationSize ���
� 0 EndOfFile
" 8 FileAttributes ���
" < ReparseTag ���
" @ NumberOfLinks
" D EffectiveAccess ��
" H LxFlags ��
" L LxUid
" P LxGid
" T LxMode ���
" X LxDeviceIdMajor ��
" \ LxDeviceIdMinor ��N b ` _FILE_STAT_LX_INFORMATION .?AU_FILE_STAT_LX_INFORMATION@@ c � b R � _SEC_WINNT_AUTH_IDENTITY_A .?AU_SEC_WINNT_AUTH_IDENTITY_A@@ ��
User �
" UserLength ���
Domain ���
" DomainLength �
Password �
" PasswordLength ���
" Flags R f _SEC_WINNT_AUTH_IDENTITY_A .?AU_SEC_WINNT_AUTH_IDENTITY_A@@ �� g ^ � Z � _TRANSACTION_BASIC_INFORMATION .?AU_TRANSACTION_BASIC_INFORMATION@@ ��>
$ TransactionId
" State
" Outcome ��Z j _TRANSACTION_BASIC_INFORMATION .?AU_TRANSACTION_BASIC_INFORMATION@@ �� k � � > � _LDR_SECTION_INFO .?AU_LDR_SECTION_INFO@@ B � _OBJECT_ATTRIBUTES .?AU_OBJECT_ATTRIBUTES@@ ��
n
� �
SectionHandle
" DesiredAccess
o ObjA �
" SectionPageProtection
" AllocationAttributes �> p _LDR_SECTION_INFO .?AU_LDR_SECTION_INFO@@ q � � 6 � tagAXESLISTW .?AUtagAXESLISTW@@ �� � " � �J
" axlReserved ��
" axlNumAxes ���
t axlAxisInfo ��6 u �tagAXESLISTW .?AUtagAXESLISTW@@ �� v � < ~ � _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION .?AU_SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION@@ ��
x
� 6
" FlagsToEnable
" FlagsToDisable ���~ z _SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION .?AU_SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION@@ �� { � )
B � _CSV_CONTROL_PARAM .?AU_CSV_CONTROL_PARAM@@ ��
}
� > CsvControlStartRedirectFile �� CsvControlStopRedirectFile ��� CsvControlQueryRedirectState � CsvControlQueryFileRevision �� CsvControlQueryMdsPath ��� CsvControlQueryFileRevisionFileId128 �
CsvControlQueryVolumeRedirectState ���
CsvControlEnableUSNRangeModificationTracking � CsvControlMarkHandleLocalVolumeMount � CsvControlUnmarkHandleLocalVolumeMount ��� CsvControlGetCsvFsMdsPathV2 �� CsvControlDisableCaching � CsvControlEnableCaching �� CsvControlStartForceDFO �� CsvControlStopForceDFO ���6 t _CSV_CONTROL_OP .?AW4_CSV_CONTROL_OP@@ � � � F *
� Operation
Unused ���B � _CSV_CONTROL_PARAM .?AU_CSV_CONTROL_PARAM@@ �� � � X Z � _PROCESS_HANDLE_TRACING_ENABLE .?AU_PROCESS_HANDLE_TRACING_ENABLE@@ ��
�
�
" Flags Z � _PROCESS_HANDLE_TRACING_ENABLE .?AU_PROCESS_HANDLE_TRACING_ENABLE@@ �� � D > 2 � _numberfmtW .?AU_numberfmtW@@ �
u NumDigits
u LeadingZero ��
u Grouping �
q lpDecimalSep �
q lpThousandSep
u NegativeOrder 2 � _numberfmtW .?AU_numberfmtW@@ � V � b KHeteroCpuPolicyAll �� KHeteroCpuPolicyLarge KHeteroCpuPolicyLargeOrIdle �� KHeteroCpuPolicySmall KHeteroCpuPolicySmallOrIdle �� KHeteroCpuPolicyDynamic �� KHeteroCpuPolicyStaticMax KHeteroCpuPolicyBiasedSmall �� KHeteroCpuPolicyBiasedLarge �� KHeteroCpuPolicyDefault �� KHeteroCpuPolicyMax ��> t � _KHETERO_CPU_POLICY .?AW4_KHETERO_CPU_POLICY@@ � � v ~ B � _CSV_NAMESPACE_INFO .?AU_CSV_NAMESPACE_INFO@@
�
� b
" Version ��
" DeviceNumber �
� StartingOffset ���
" SectorSize ���B � _CSV_NAMESPACE_INFO .?AU_CSV_NAMESPACE_INFO@@ � � 6 6 � _LUTF8_STRING .?AU_LUTF8_STRING@@
� ��
�
� B
" Length ���
" MaximumLength
Buffer ���6 � _LUTF8_STRING .?AU_LUTF8_STRING@@ 2 onecore\internal\sdk\inc\minwin\ntdef_p.h �� � �
�
� B � tagEMRSETCOLORSPACE .?AUtagEMRSETCOLORSPACE@@ "
� emr ��
" ihCS �B � tagEMRSETCOLORSPACE .?AUtagEMRSETCOLORSPACE@@ � � � Z � _PLUGPLAY_CONTROL_PROPERTY_DATA .?AU_PLUGPLAY_CONTROL_PROPERTY_DATA@@
�
� b
DeviceInstance ���
" PropertyType �
Buffer ���
" BufferSize ���Z � _PLUGPLAY_CONTROL_PROPERTY_DATA .?AU_PLUGPLAY_CONTROL_PROPERTY_DATA@@ � $ 8 > GroupAffinityAllGroupZero GroupAffinityDontCare : t � _IRQ_GROUP_POLICY .?AW4_IRQ_GROUP_POLICY@@ � � � ^ � _FILE_CASE_SENSITIVE_INFORMATION .?AU_FILE_CASE_SENSITIVE_INFORMATION@@ ��
�
�
" Flags ^ � _FILE_CASE_SENSITIVE_INFORMATION .?AU_FILE_CASE_SENSITIVE_INFORMATION@@ �� � � � N � _PERFINFO_DPC_INFORMATION .?AU_PERFINFO_DPC_INFORMATION@@ 2
# InitialTime ��
DpcRoutine ���N � _PERFINFO_DPC_INFORMATION .?AU_PERFINFO_DPC_INFORMATION@@ � b � > � _WIN32_STREAM_ID .?AU_WIN32_STREAM_ID@@ ��~
" dwStreamId ���
" dwStreamAttributes ���
� Size �
" dwStreamNameSize �
cStreamName ��> � _WIN32_STREAM_ID .?AU_WIN32_STREAM_ID@@ �� � n � B � _TOKEN_AUDIT_POLICY .?AU_TOKEN_AUDIT_POLICY@@ " �
� PerUserPolicy B � _TOKEN_AUDIT_POLICY .?AU_TOKEN_AUDIT_POLICY@@ � w � 6 � _PSINJECTDATA .?AU_PSINJECTDATA@@ J
" DataBytes
! InjectionPoint ���
! PageNumber ���6 � _PSINJECTDATA .?AU_PSINJECTDATA@@ � � � N � _ETW_OBJECT_HANDLE_EVENT .?AU_ETW_OBJECT_HANDLE_EVENT@@ ��
�
� V
Object ���
" ProcessId
" Handle ���
! ObjectType ���N � _ETW_OBJECT_HANDLE_EVENT .?AU_ETW_OBJECT_HANDLE_EVENT@@ �� � b i
2 � value_entA .?AUvalue_entA@@ ��^
p ve_valuename �
" ve_valuelen ��
" ve_valueptr ��
" ve_type ��2 � value_entA .?AUvalue_entA@@ ��2 onecore\external\sdk\inc\minwin\winreg.h ��� � � � J � _SD_GLOBAL_CHANGE_INPUT .?AU_SD_GLOBAL_CHANGE_INPUT@@ V � _SD_CHANGE_MACHINE_SID_INPUT .?AU_SD_CHANGE_MACHINE_SID_INPUT@@ ��F � _SD_QUERY_STATS_INPUT .?AU_SD_QUERY_STATS_INPUT@@ j
" Flags
" ChangeType ���
� SdChange �
� SdQueryStats �
� SdEnumSds J � _SD_GLOBAL_CHANGE_INPUT .?AU_SD_GLOBAL_CHANGE_INPUT@@ � � m F � _VIRTUAL_STORAGE_TYPE .?AU_VIRTUAL_STORAGE_TYPE@@ *
" DeviceId �
$ VendorId �F � _VIRTUAL_STORAGE_TYPE .?AU_VIRTUAL_STORAGE_TYPE@@ � � 0 F � tagRAWINPUTDEVICELIST .?AUtagRAWINPUTDEVICELIST@@ *
hDevice ��
" dwType ���F � tagRAWINPUTDEVICELIST .?AUtagRAWINPUTDEVICELIST@@ � ~ �; R � _RTL_IMAGE_POLICY_METADATA .?AU_RTL_IMAGE_POLICY_METADATA@@ ��
�
� J � _IMAGE_POLICY_METADATA .?AU_IMAGE_POLICY_METADATA@@ ��
� ��
�
� F
� PolicyMetadata ���
" LBound ���
" UBound ���R � _RTL_IMAGE_POLICY_METADATA .?AU_RTL_IMAGE_POLICY_METADATA@@ �� � g �& � FileStorageTierMediaTypeUnspecified �� FileStorageTierMediaTypeDisk � FileStorageTierMediaTypeSsd �� FileStorageTierMediaTypeScm �� FileStorageTierMediaTypeMax ��R t � _FILE_STORAGE_TIER_MEDIA_TYPE .?AW4_FILE_STORAGE_TIER_MEDIA_TYPE@@ � � � � ^ � _PROCESS_TELEMETRY_ID_INFORMATION .?AU_PROCESS_TELEMETRY_ID_INFORMATION@@ �
" HeaderSize ���
" ProcessId
# ProcessStartKey ��
# CreateTime ���
# CreateInterruptTime ��
# CreateUnbiasedInterruptTime ��
# ( ProcessSequenceNumber
# 0 SessionCreateTime
" 8 SessionId
" < BootId ���
" @ ImageChecksum
" D ImageTimeDateStamp ���
" H UserSidOffset
" L ImagePathOffset ��
" P PackageNameOffset
" T RelativeAppNameOffset
" X CommandLineOffset ^ � ` _PROCESS_TELEMETRY_ID_INFORMATION .?AU_PROCESS_TELEMETRY_ID_INFORMATION@@ � � k 6 � _FILEMUIINFO .?AU_FILEMUIINFO@@ �� " � " �Z
" dwSize ���
" dwVersion
" dwFileType ���
� pChecksum
� pServiceChecksum �
" , dwLanguageNameOffset �
" 0 dwTypeIDMainSize �
" 4 dwTypeIDMainOffset ���
" 8 dwTypeNameMainOffset �
" < dwTypeIDMUISize ��
" @ dwTypeIDMUIOffset
" D dwTypeNameMUIOffset ��
� H abBuffer �6
� P _FILEMUIINFO .?AU_FILEMUIINFO@@ �� � V � v � _ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION .?AU_ACTIVATION_CONTEXT_DATA_ASSEMBLY_INFORMATION@@ * � _LBLOB .?AU_LBLOB@@ ��B
" Length ���
" MaximumLength
Buffer ���* � _LBLOB .?AU_LBLOB@@ �� � � / " " " � � v � _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT@@
" ��
" ��>
� Enabled ��
� Reserved �
" AsULONG ��v � _SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_OUTPUT@@ � �
Z � _WIM_PROVIDER_INTEGRITY_STATUS .?AU_WIM_PROVIDER_INTEGRITY_STATUS@@ ��v
IntegrityComplete
IntegrityRunning �
# IntegrityAvailable ���
# IntegrityRequired Z � _WIM_PROVIDER_INTEGRITY_STATUS .?AU_WIM_PROVIDER_INTEGRITY_STATUS@@ �� � � V" j � _PLUGPLAY_CONTROL_TARGET_RELATION_DATA .?AU_PLUGPLAY_CONTROL_TARGET_RELATION_DATA@@ ��j
UserFileHandle ���
Status ���
" DeviceInstanceLen
q DeviceInstance ���j � _PLUGPLAY_CONTROL_TARGET_RELATION_DATA .?AU_PLUGPLAY_CONTROL_TARGET_RELATION_DATA@@ �� $ � V � _TXFS_TRANSACTION_ACTIVE_INFO .?AU_TXFS_TRANSACTION_ACTIVE_INFO@@ *
TransactionsActiveAtSnapshot �V _TXFS_TRANSACTION_ACTIVE_INFO .?AU_TXFS_TRANSACTION_ACTIVE_INFO@@ � & � � _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION@@ ��j � _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE@@
� Z
! NumberOfRanges ���
! Reserved �
" Reserved2
Ranges ��� _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGES_INFORMATION@@ ��
D � V � _TRACE_ENABLE_FLAG_EXTENSION .?AU_TRACE_ENABLE_FLAG_EXTENSION@@ ��
� :
! Offset ���
Length ���
Flag �V _TRACE_ENABLE_FLAG_EXTENSION .?AU_TRACE_ENABLE_FLAG_EXTENSION@@ �� b F � _HEAP_SUBSEGMENT_INIT .?AU_HEAP_SUBSEGMENT_INIT@@
� �
m Header ���
HeapHandle ���
$ SubSegment ���
" ( BlockSize
" , BlockCount ���
" 0 AffinityIndex F 4 _HEAP_SUBSEGMENT_INIT .?AU_HEAP_SUBSEGMENT_INIT@@ b W f FirmwareTypeUnknown �� FirmwareTypeBios � FirmwareTypeUefi � FirmwareTypeMax ��6 t _FIRMWARE_TYPE .?AW4_FIRMWARE_TYPE@@ ��� � @ J � _TRANSACTION_LIST_ENTRY .?AU_TRANSACTION_LIST_ENTRY@@
�
$ UOW ��J _TRANSACTION_LIST_ENTRY .?AU_TRANSACTION_LIST_ENTRY@@ � i b � _TRACE_PERIODIC_CAPTURE_STATE_INFO .?AU_TRACE_PERIODIC_CAPTURE_STATE_INFO@@ ��
� Z
" CaptureStateFrequencyInSeconds ���
! ProviderCount
! Reserved �b _TRACE_PERIODIC_CAPTURE_STATE_INFO .?AU_TRACE_PERIODIC_CAPTURE_STATE_INFO@@ �� ! � �
D
� R � _REQUEST_RAW_ENCRYPTED_DATA .?AU_REQUEST_RAW_ENCRYPTED_DATA@@ .
FileOffset ���
" Length ���R % _REQUEST_RAW_ENCRYPTED_DATA .?AU_REQUEST_RAW_ENCRYPTED_DATA@@ & � N � _FILE_FS_SIZE_INFORMATION .?AU_FILE_FS_SIZE_INFORMATION@@ �
� TotalAllocationUnits �
� AvailableAllocationUnits �
" SectorsPerAllocationUnit �
" BytesPerSector ���N ) _FILE_FS_SIZE_INFORMATION .?AU_FILE_FS_SIZE_INFORMATION@@ * � F � RPC_IMPORT_CONTEXT_P .?AURPC_IMPORT_CONTEXT_P@@ ��B � _RPC_BINDING_VECTOR .?AU_RPC_BINDING_VECTOR@@
-
� J
LookupContext
ProposedHandle ���
. Bindings �F / RPC_IMPORT_CONTEXT_P .?AURPC_IMPORT_CONTEXT_P@@ ��* onecore\external\sdk\inc\rpcnsip.h � 0 1 ! j � _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA@@
3
� ^
DeviceInstance ���
R Operation
" BufferLength �
q Buffer ���j 5 _PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA .?AU_PLUGPLAY_CONTROL_DEVICE_RELATIONS_DATA@@ 6 $ � r � _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION .?AU_MEMORY_PARTITION_PAGE_COMBINE_INFORMATION@@ ��J
StopHandle ���
" Flags
" TotalNumberOfPages ���r 9 _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION .?AU_MEMORY_PARTITION_PAGE_COMBINE_INFORMATION@@ �� : w � > � tagWNODE_ALL_DATA .?AUtagWNODE_ALL_DATA@@ R � OFFSETINSTANCEDATAANDLENGTH .?AUOFFSETINSTANCEDATAANDLENGTH@@ = " �
� WnodeHeader ��
" 0 DataBlockOffset ��
" 4 InstanceCount
" 8 OffsetInstanceNameOffsets
" < FixedInstanceSize
> < OffsetInstanceDataAndLength ��> ? H tagWNODE_ALL_DATA .?AUtagWNODE_ALL_DATA@@ @ � � n � _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT@@ ��J
" ExtentCount ��
" TotalExtentCount �
� Extents ��n C _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_OUTPUT@@ �� D � �* � SharedVirtualDiskHandleStateNone � SharedVirtualDiskHandleStateFileShared ��� SharedVirtualDiskHandleStateHandleShared �R t F _SharedVirtualDiskHandleState .?AW4_SharedVirtualDiskHandleState@@ � G � �' : � _NDR_EXPR_DESC .?AU_NDR_EXPR_DESC@@ ��
/
� .
2 pOffset ��
J pFormatExpr ��: K _NDR_EXPR_DESC .?AU_NDR_EXPR_DESC@@ �� L � � V � _RTL_WORK_ON_BEHALF_TICKET_EX .?AU_RTL_WORK_ON_BEHALF_TICKET_EX@@
N
�
" ��
" ��f
_ Ticket ���
" Flags
P CurrentThread
Q Reserved1
" Reserved2 V R _RTL_WORK_ON_BEHALF_TICKET_EX .?AU_RTL_WORK_ON_BEHALF_TICKET_EX@@ S � SysDbgQueryModuleInformation � SysDbgQueryTraceInformation �� SysDbgSetTracepoint �� SysDbgSetSpecialCall � SysDbgClearSpecialCalls �� SysDbgQuerySpecialCalls �� SysDbgBreakPoint � SysDbgQueryVersion ��� SysDbgReadVirtual SysDbgWriteVirtual ���
SysDbgReadPhysical ��� SysDbgWritePhysical �� SysDbgReadControlSpace ���
SysDbgWriteControlSpace �� SysDbgReadIoSpace SysDbgWriteIoSpace ��� SysDbgReadMsr SysDbgWriteMsr ��� SysDbgReadBusData SysDbgWriteBusData ��� SysDbgCheckLowMemory � SysDbgEnableKernelDebugger ��� SysDbgDisableKernelDebugger �� SysDbgGetAutoKdEnable SysDbgSetAutoKdEnable SysDbgGetPrintBufferSize � SysDbgSetPrintBufferSize � SysDbgGetKdUmExceptionEnable � SysDbgSetKdUmExceptionEnable � SysDbgGetTriageDump �� SysDbgGetKdBlockEnable ��� SysDbgSetKdBlockEnable ��� SysDbgRegisterForUmBreakInfo � ! SysDbgGetUmBreakPid �� " SysDbgClearUmBreakPid # SysDbgGetUmAttachPid � $ SysDbgClearUmAttachPid ��� % SysDbgGetLiveKernelDump �� & SysDbgKdPullRemoteFile ���6 ' t U _SYSDBG_COMMAND .?AW4_SYSDBG_COMMAND@@ � V � � N � _ALPC_WORK_ON_BEHALF_ATTR .?AU_ALPC_WORK_ON_BEHALF_ATTR@@
_ Ticket ���N Y _ALPC_WORK_ON_BEHALF_ATTR .?AU_ALPC_WORK_ON_BEHALF_ATTR@@ Z � q
�
� �
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
, tmFirstChar ��
- tmLastChar ���
. tmDefaultChar
/ tmBreakChar ��
0 tmItalic �
1 tmUnderlined �
2 tmStruckOut ��
3 tmPitchAndFamily �
4 tmCharSet : ^ 8 tagTEXTMETRICA .?AUtagTEXTMETRICA@@ �� _ � � Z � _CM_PARTIAL_RESOURCE_DESCRIPTOR .?AU_CM_PARTIAL_RESOURCE_DESCRIPTOR@@
a
� &
� Start
" Length ���: c <anonymous-tag> .?AU<anonymous-tag>@@ d � &
� Start
" Length ���: f <anonymous-tag> .?AU<anonymous-tag>@@ g � :
" Level
" Vector ���
" Affinity �: i <anonymous-tag> .?AU<anonymous-tag>@@ j � V
! Reserved �
! MessageCount �
" Vector ���
" Affinity �: l <anonymous-tag> .?AU<anonymous-tag>@@ m � :
" Level
" Vector ���
" Affinity �: o <anonymous-tag> .?AU<anonymous-tag>@@ p � *
m Raw ��
p Translated ���: r <anonymous-tag> .?AU<anonymous-tag>@@ s � &
� Start
" Length ���: u <anonymous-tag> .?AU<anonymous-tag>@@ v � :
" Channel ��
" Port �
" Reserved1 : x <anonymous-tag> .?AU<anonymous-tag>@@ y � �
" Channel ��
" RequestLine ��
TransferWidth
Reserved1
Reserved2
Reserved3 : { <anonymous-tag> .?AU<anonymous-tag>@@ |
� Data �: ~ <anonymous-tag> .?AU<anonymous-tag>@@ :
" Start
" Length ���
" Reserved �: � <anonymous-tag> .?AU<anonymous-tag>@@ � >
" DataSize �
" Reserved1
" Reserved2 : � <anonymous-tag> .?AU<anonymous-tag>@@ � $ &
� Start
" Length40 �: � <anonymous-tag> .?AU<anonymous-tag>@@ � , &
� Start
" Length48 �: � <anonymous-tag> .?AU<anonymous-tag>@@ � 1 &
� Start
" Length64 �: � <anonymous-tag> .?AU<anonymous-tag>@@ � 6 v
Class
Type �
Reserved1
Reserved2
" IdLowPart
" IdHighPart ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � ; *
d Generic ��
g Port �
j Interrupt
s MessageInterrupt �
v Memory ���
y Dma ��
| DmaV3
DevicePrivate
� BusNumber
� DeviceSpecificData ���
� Memory40 �
� Memory48 �
� Memory64 �
� Connection ���2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � J
Type �
ShareDisposition �
! Flags
� u Z � _CM_PARTIAL_RESOURCE_DESCRIPTOR .?AU_CM_PARTIAL_RESOURCE_DESCRIPTOR@@ � � Z � _MEMORY_COMBINE_INFORMATION_EX .?AU_MEMORY_COMBINE_INFORMATION_EX@@ ��
�
� >
Handle ���
" PagesCombined
" Flags Z � _MEMORY_COMBINE_INFORMATION_EX .?AU_MEMORY_COMBINE_INFORMATION_EX@@ �� � � � B � _ENERGY_STATE_DURATION .?AT_ENERGY_STATE_DURATION@@ ��
" ��
" ��V
# Value
" LastChangeTime ���
� Duration �
� IsInState B � _ENERGY_STATE_DURATION .?AT_ENERGY_STATE_DURATION@@ �� � � � B � _IMAGE_THUNK_DATA64 .?AU_IMAGE_THUNK_DATA64@@
�
� ^
# ForwarderString ��
# Function �
# Ordinal ��
# AddressOfData 2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � �
� u1 ���B � _IMAGE_THUNK_DATA64 .?AU_IMAGE_THUNK_DATA64@@ � � � > � tagMULTIKEYHELPA .?AUtagMULTIKEYHELPA@@ ��
�
� B
" mkSize ���
p mkKeylist
szKeyphrase ��> � tagMULTIKEYHELPA .?AUtagMULTIKEYHELPA@@ �� � ~ �/
�
E
� J
axMinValue ���
axMaxValue ���
� axAxisName ���6 � tagAXISINFOA .?AUtagAXISINFOA@@ �� � � � B � _KCONTINUE_ARGUMENT .?AU_KCONTINUE_ARGUMENT@@ z KCONTINUE_UNWIND � KCONTINUE_RESUME � KCONTINUE_LONGJUMP ��� KCONTINUE_SET KCONTINUE_LAST ���6 t � _KCONTINUE_TYPE .?AW4_KCONTINUE_TYPE@@ � � � � F
� ContinueType �
" ContinueFlags
� Reserved �B � _KCONTINUE_ARGUMENT .?AU_KCONTINUE_ARGUMENT@@ � �
�
� j � _SYSTEM_PROCESSOR_FEATURES_INFORMATION .?AU_SYSTEM_PROCESSOR_FEATURES_INFORMATION@@ �� # " �6
# ProcessorFeatureBits �
� Reserved �j � _SYSTEM_PROCESSOR_FEATURES_INFORMATION .?AU_SYSTEM_PROCESSOR_FEATURES_INFORMATION@@ �� � � < V � _SERVERSILO_INIT_INFORMATION .?AU_SERVERSILO_INIT_INFORMATION@@ ��
�
� :
DeleteEvent ��
IsDownlevelContainer �V � _SERVERSILO_INIT_INFORMATION .?AU_SERVERSILO_INIT_INFORMATION@@ �� � D � ^ � _PERFINFO_DPC_ENQUEUE_INFORMATION .?AU_PERFINFO_DPC_ENQUEUE_INFORMATION@@ �
" Key ��
DpcQueueDepth
" DpcCount �
" TargetProcessorIndex �
Importance ���
, Reserved �^ � _PERFINFO_DPC_ENQUEUE_INFORMATION .?AU_PERFINFO_DPC_ENQUEUE_INFORMATION@@ � b � V � _ETW_HEAP_EVENT_RUNDOWN_RANGE .?AU_ETW_HEAP_EVENT_RUNDOWN_RANGE@@ &
Address ��
" Size �V � _ETW_HEAP_EVENT_RUNDOWN_RANGE .?AU_ETW_HEAP_EVENT_RUNDOWN_RANGE@@ � b �
v
� : � _RTL_HEAP_ENTRY .?AU_RTL_HEAP_ENTRY@@
�
� &
" Settable �
" Tag ��: � <anonymous-tag> .?AU<anonymous-tag>@@ � � 2
" CommittedSize
FirstBlock ���: � <anonymous-tag> .?AU<anonymous-tag>@@ � � "
� s1 ���
� s2 ���2 � <anonymous-tag> .?AT<anonymous-tag>@@ � � R
" Size �
! Flags
! AllocatorBackTraceIndex ��
� u : � _RTL_HEAP_ENTRY .?AU_RTL_HEAP_ENTRY@@ � �
B SystemNetRateControlSet �� SystemNetRateControlQuota R t � _SYSTEM_NET_RATE_CONTROL_TYPE .?AW4_SYSTEM_NET_RATE_CONTROL_TYPE@@ � � � �
'
� N � _TEB_ACTIVE_FRAME_CONTEXT .?AU_TEB_ACTIVE_FRAME_CONTEXT@@
� ��
�
� :
" Flags
� Previous �
� Context ��> � _TEB_ACTIVE_FRAME .?AU_TEB_ACTIVE_FRAME@@ � < �
� ��
�
� N � _ETW_WNF_EVENT_SUBSCRIBE .?AU_ETW_WNF_EVENT_SUBSCRIBE@@ ��
m Header ���
� StateName
( Subscription �
, NameSub ��
0 Callback �
" 4 RefCount �
" 8 DeliveryFlags N � @ _ETW_WNF_EVENT_SUBSCRIBE .?AU_ETW_WNF_EVENT_SUBSCRIBE@@ �� � b _ : � _MIDL_STUB_DESC .?AU_MIDL_STUB_DESC@@
u �
�
�
� J � __GENERIC_BINDING_INFO .?AU__GENERIC_BINDING_INFO@@ ��
�
� V
� pAutoHandle ��
� pPrimitiveHandle �
� pGenericBindingInfo ��2 � <anonymous-tag> .?AT<anonymous-tag>@@ � �
�
�
�
�
� ��
�
� B � _MIDL_STUB_MESSAGE .?AU_MIDL_STUB_MESSAGE@@ ��
�
�
�
�
� J � _XMIT_ROUTINE_QUINTUPLE .?AU_XMIT_ROUTINE_QUINTUPLE@@
��
� B � _MALLOC_FREE_STRUCT .?AU_MALLOC_FREE_STRUCT@@
� B � _COMM_FAULT_OFFSETS .?AU_COMM_FAULT_OFFSETS@@
��
�
M ��
�
�
�
� > � _NDR_CS_ROUTINES .?AU_NDR_CS_ROUTINES@@ ��
��
�
I ��
� &
RpcInterfaceInformation ��
� pfnAllocate ��
� pfnFree ��
� IMPLICIT_HANDLE_INFO �
� apfnNdrRundownRoutines ���
� aGenericBindingRoutinePairs ��
apfnExprEval �
aXmitQuintuple ���
0 pFormatTypes �
t $ fCheckBounds �
" ( Version ��
, pMallocFreeStruct
0 MIDLVersion ��
4 CommFaultOffsets �
8 aUserMarshalQuadruple
< NotifyRoutineTable ���
" @ mFlags ���
D CsRoutineTables ��
H ProxyServerInfo ��
L pExprInfo : P _MIDL_STUB_DESC .?AU_MIDL_STUB_DESC@@ � � � TransactionBasicInformation �� TransactionPropertiesInformation � TransactionEnlistmentInformation � TransactionSuperiorEnlistmentInformation � TransactionBindInformation ��� TransactionDTCPrivateInformation �V t _TRANSACTION_INFORMATION_CLASS .?AW4_TRANSACTION_INFORMATION_CLASS@@ ��� � , � WdInfoTimeoutValue ��� WdInfoResetTimer � WdInfoStopTimer �� WdInfoStartTimer � WdInfoTriggerAction �� WdInfoState �� WdInfoTriggerReset ��� WdInfoNop WdInfoGeneratedLastReset � WdInfoInvalid N
t _WATCHDOG_INFORMATION_CLASS .?AW4_WATCHDOG_INFORMATION_CLASS@@ � � @
" ��
" ��N
" Flags
DisableExtensionPoints ���
ReservedFlags � _PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ �� ! D n J � _FILE_LINKS_INFORMATION .?AU_FILE_LINKS_INFORMATION@@ V � _FILE_LINK_ENTRY_INFORMATION .?AU_FILE_LINK_ENTRY_INFORMATION@@ ��F
" BytesNeeded ��
" EntriesReturned ��
$ Entry J % _FILE_LINKS_INFORMATION .?AU_FILE_LINKS_INFORMATION@@ & � �
� �
ExitStatus ���
u Pad1 �
# PebBaseAddress ���
# AffinityMask �
BasePriority �
u Pad2 �
# UniqueProcessId ��
# ( InheritedFromUniqueProcessId �V ) 0 _PROCESS_BASIC_INFORMATION64 .?AU_PROCESS_BASIC_INFORMATION64@@ �� * � � > � _SYSTEM_AUDIT_ACE .?AU_SYSTEM_AUDIT_ACE@@ :
� Header ���
" Mask �
" SidStart �> - _SYSTEM_AUDIT_ACE .?AU_SYSTEM_AUDIT_ACE@@ . w � 6 � tagBITMAPINFO .?AUtagBITMAPINFO@@ 2 � tagRGBQUAD .?AUtagRGBQUAD@@ �� 1 " �*
� bmiHeader
2 ( bmiColors 6 3 , tagBITMAPINFO .?AUtagBITMAPINFO@@ 4 � � Z LocationTypeRegistry � LocationTypeFileSystem ��� LocationTypeMaximum ��B t 6 _STATE_LOCATION_TYPE .?AW4_STATE_LOCATION_TYPE@@ ��� 7 g ($ � EtwNotificationTypeNoReply ��� EtwNotificationTypeLegacyEnable �� EtwNotificationTypeEnable EtwNotificationTypePrivateLogger � EtwNotificationTypePerflib ��� EtwNotificationTypeAudio � EtwNotificationTypeSession ��� EtwNotificationTypeReserved �� EtwNotificationTypeCredentialUI ��
EtwNotificationTypeInProcSession � EtwNotificationTypeFilteredPrivateLogger � EtwNotificationTypeMax ���F t 9 _ETW_NOTIFICATION_TYPE .?AW4_ETW_NOTIFICATION_TYPE@@ ��� : @ * V � _SYSTEM_PROCESSOR_INFORMATION .?AU_SYSTEM_PROCESSOR_INFORMATION@@ �
! ProcessorArchitecture
! ProcessorLevel ���
! ProcessorRevision
! MaximumProcessors
" ProcessorFeatureBits �V = _SYSTEM_PROCESSOR_INFORMATION .?AU_SYSTEM_PROCESSOR_INFORMATION@@ > � �
� V � _JOBOBJECT_ENERGY_TRACKING_STATE .?AT_JOBOBJECT_ENERGY_TRACKING_STATE@@ ��B
# Value
" UpdateMask ���
" DesiredState �V B _JOBOBJECT_ENERGY_TRACKING_STATE .?AT_JOBOBJECT_ENERGY_TRACKING_STATE@@ �� C � G f � _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1@@
E
� f
� pInt64 ���
� pUint64 ��
� ppString �
� pFqbn
� pOctetString �2 G <anonymous-tag> .?AT<anonymous-tag>@@ H � v
" Name �
! ValueType
! Reserved �
" Flags
" ValueCount ���
H Values ���f J _TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_RELATIVE_V1@@ K � � b � _PERFINFO_FILENAME_SAME_INFORMATION .?AU_PERFINFO_FILENAME_SAME_INFORMATION@@
M
� *
OldFile ��
NewFile ��b O _PERFINFO_FILENAME_SAME_INFORMATION .?AU_PERFINFO_FILENAME_SAME_INFORMATION@@ P b g j � _MEMORY_PARTITION_NODE_PAGE_INFORMATION .?AU_MEMORY_PARTITION_NODE_PAGE_INFORMATION@@
# TotalPageCount ���
# SmallFreePageCount ���
# SmallZeroPageCount ���
# MediumFreePageCount ��
# MediumZeroPageCount ��
# ( LargeFreePageCount ���
# 0 LargeZeroPageCount ���
# 8 HugeFreePageCount
# @ HugeZeroPageCount j S H _MEMORY_PARTITION_NODE_PAGE_INFORMATION .?AU_MEMORY_PARTITION_NODE_PAGE_INFORMATION@@ T w �
I
�
�
� v � _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT@@ ��*
$ TmIdentity ���
" Flags v Y _TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_TM_ONLINE_ARGUMENT@@ �� Z � � 6 � _PORT_MESSAGE .?AU_PORT_MESSAGE@@
\
� 2
DataLength ���
TotalLength ��: ^ <anonymous-tag> .?AU<anonymous-tag>@@ _ � < &
_ s1 ���
" Length ���2 a <anonymous-tag> .?AT<anonymous-tag>@@ b � ; .
Type �
DataInfoOffset ���: d <anonymous-tag> .?AU<anonymous-tag>@@ e � C &
e s2 ���
" ZeroInit �2 g <anonymous-tag> .?AT<anonymous-tag>@@ h � B �
b u1 ���
h u2 ���
ClientId �
A DoNotUseThisField
" MessageId
" ClientViewSize ���
" CallbackId ���6 j _PORT_MESSAGE .?AU_PORT_MESSAGE@@ k � : f � _PERFINFO_CLOCK_INTERRUPT_INFORMATION .?AU_PERFINFO_CLOCK_INTERRUPT_INFORMATION@@ *
# InterruptTime
Flags f n _PERFINFO_CLOCK_INTERRUPT_INFORMATION .?AU_PERFINFO_CLOCK_INTERRUPT_INFORMATION@@ o b � > � tagMOUSEMOVEPOINT .?AUtagMOUSEMOVEPOINT@@ B
t x
t y
" time �
" dwExtraInfo ��> r tagMOUSEMOVEPOINT .?AUtagMOUSEMOVEPOINT@@ s ~ 2
�
�
� v � _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION@@ ��
" ��
" ��B
x State
y Reserved �
" AllInformation ���v z _MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_UNIT_INFORMATION@@ �� { w � f � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION@@ ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��J
$ BootIdentifier ���
FirmwareType �
# BootFlags
~ DbgMenuOsSelection ���
DbgHiberBoot �
� DbgSoftBoot ��
� DbgMeasuredLaunch
� DbgMeasuredLaunchCapable �
� DbgSystemHiveReplace �
� DbgMeasuredLaunchSmmProtections ��
� DbgMeasuredLaunchSmmLevel f � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION@@ �� � �
Z � _DEDUP_CHUNK_INFORMATION_HASH32 .?AU_DEDUP_CHUNK_INFORMATION_HASH32@@ ^
" ChunkFlags ���
ChunkOffsetInFile
ChunkSize
� HashVal ��Z � 8 _DEDUP_CHUNK_INFORMATION_HASH32 .?AU_DEDUP_CHUNK_INFORMATION_HASH32@@ � � Z � _SYSTEM_SYSTEM_DISK_INFORMATION .?AU_SYSTEM_SYSTEM_DISK_INFORMATION@@
SystemDisk ���Z � _SYSTEM_SYSTEM_DISK_INFORMATION .?AU_SYSTEM_SYSTEM_DISK_INFORMATION@@ � � ]
r � _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION@@ ��2
" ProcessorCount ���
� Offsets ��r � _SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION@@ �� � � Z � _PERFINFO_INTERRUPT_INFORMATION .?AU_PERFINFO_INTERRUPT_INFORMATION@@
�
� v
# InitialTime ��
ServiceRoutine ���
ReturnValue ��
!
Vector ���
Reserved �Z � _PERFINFO_INTERRUPT_INFORMATION .?AU_PERFINFO_INTERRUPT_INFORMATION@@ � b � : � tagHANDLETABLE .?AUtagHANDLETABLE@@ �� " �
� objectHandle �: � tagHANDLETABLE .?AUtagHANDLETABLE@@ �� � � � t � J � tagCOLORCORRECTPALETTE .?AUtagCOLORCORRECTPALETTE@@ ��j
� emr ��
" ihPalette
" nFirstEntry ��
" nPalEntries ��
" nReserved J � tagCOLORCORRECTPALETTE .?AUtagCOLORCORRECTPALETTE@@ �� � � � � AlpcBasicInformation � AlpcPortInformation �� AlpcAssociateCompletionPortInformation ��� AlpcConnectedSIDInformation �� AlpcServerInformation AlpcMessageZoneInformation ��� AlpcRegisterCompletionListInformation AlpcUnregisterCompletionListInformation �� AlpcAdjustCompletionListConcurrencyCountInformation �� AlpcRegisterCallbackInformation ��
AlpcCompletionListRundownInformation � AlpcWaitForPortReferences AlpcServerSessionInformation �R
t � _ALPC_PORT_INFORMATION_CLASS .?AW4_ALPC_PORT_INFORMATION_CLASS@@ ��� � � Z � _PERFINFO_PPM_IDLE_EXIT_LATENCY .?AU_PERFINFO_PPM_IDLE_EXIT_LATENCY@@ v
" Flags
" PlatformState
" ProcessorState ���
" ReturnLatency
" TotalLatency �Z � _PERFINFO_PPM_IDLE_EXIT_LATENCY .?AU_PERFINFO_PPM_IDLE_EXIT_LATENCY@@ � b G B MarshalDirectionMarshal �� MarshalDirectionUnmarshal b t � _LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION .?AW4_LRPC_SYSTEM_HANDLE_MARSHAL_DIRECTION@@ � � 3 � B � tagEMRPOLYPOLYLINE .?AUtagEMRPOLYPOLYLINE@@ ��
�
� r
� emr ��
c rclBounds
" nPolys ���
" cptl �
z aPolyCounts ��
� $ aptl �B � , tagEMRPOLYPOLYLINE .?AUtagEMRPOLYPOLYLINE@@ �� � � c � � _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION .?AU_SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION@@ ��
�
� ~
" ExtentCount ��
" ValidStructureSize ���
" NextExtentIndex ��
" ExtentRestart
" CycleCount ���
" TimeoutCount �
# CycleTime
# CycleTimeMax �
# ( ExtentTime ���
" 0 ExtentTimeIndex ��
" 4 ExtentTimeMaxIndex ���
# 8 ExtentTimeMax
# @ HyperFlushTimeMax
# H TranslateVaTimeMax ���
# P DebugExemptionCount ��
# X TbHitCount ���
# ` TbMissCount ��
# h VinaPendingYield �
# p HashCycles ���
" x HistogramOffset ��
" | HistogramBuckets �
" � HistogramShift ���
" � Reserved1
# � PageNotPresentCount �� � � _SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION .?AU_SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION@@ �� � � �
%
� � MemoryCaptureAccessedBits MemoryCaptureAndResetAccessedBits MemoryEmptyWorkingSets ��� MemoryFlushModifiedList �� MemoryPurgeStandbyList ��� MemoryPurgeLowPriorityStandbyList MemoryCommandMax �N t � _SYSTEM_MEMORY_LIST_COMMAND .?AW4_SYSTEM_MEMORY_LIST_COMMAND@@ � � � � R � _SYSTEM_VA_LIST_INFORMATION .?AU_SYSTEM_VA_LIST_INFORMATION@@ j
" VirtualSize ��
" VirtualPeak ��
" VirtualLimit �
" AllocationFailures ���R � _SYSTEM_VA_LIST_INFORMATION .?AU_SYSTEM_VA_LIST_INFORMATION@@ � � �
N � PROCESSOR_IDLESTATE_INFO .?AUPROCESSOR_IDLESTATE_INFO@@ ��Z
" TimeCheck
DemotePercent
PromotePercent ���
� Spare N � PROCESSOR_IDLESTATE_INFO .?AUPROCESSOR_IDLESTATE_INFO@@ �� � { 3 > � _LUNICODE_STRING .?AU_LUNICODE_STRING@@ ��
�
� B
" Length ���
" MaximumLength
q Buffer ���> � _LUNICODE_STRING .?AU_LUNICODE_STRING@@ �� � �
F � _SERVICE_TRIGGER_INFO .?AU_SERVICE_TRIGGER_INFO@@ > � _SERVICE_TRIGGER .?AU_SERVICE_TRIGGER@@ ��
�
� >
" cTriggers
� pTriggers
pReserved F � _SERVICE_TRIGGER_INFO .?AU_SERVICE_TRIGGER_INFO@@ � � � J � _KEY_TRUST_INFORMATION .?AU_KEY_TRUST_INFORMATION@@ ��
" ��
" ��.
� TrustedKey ���
� Reserved �J � _KEY_TRUST_INFORMATION .?AU_KEY_TRUST_INFORMATION@@ �� � ~ > � _FILE_REGION_INFO .?AU_FILE_REGION_INFO@@
�
� R
FileOffset ���
Length ���
" Usage
" Reserved �> � _FILE_REGION_INFO .?AU_FILE_REGION_INFO@@ � � i
t t � Z � _IMAGE_DYNAMIC_RELOCATION32_V2 .?AU_IMAGE_DYNAMIC_RELOCATION32_V2@@ ��n
" HeaderSize ���
" FixupInfoSize
" Symbol ���
" SymbolGroup ��
" Flags Z � _IMAGE_DYNAMIC_RELOCATION32_V2 .?AU_IMAGE_DYNAMIC_RELOCATION32_V2@@ �� � � � � � RtlResTypePhysicalMemoryTier � RtlResTypeDiskSpaceTier �� RtlResTypeDiskSpeedTier �� RtlResTypeDiskWriteConstraintTier RtlResTypeMax F t � _RTL_RESOURCE_CATEGORY .?AW4_RTL_RESOURCE_CATEGORY@@ ��� � ;
c � Z � _IO_RESOURCE_REQUIREMENTS_LIST .?AU_IO_RESOURCE_REQUIREMENTS_LIST@@ ��b ��InterfaceTypeUndefined �� Internal � Isa �� Eisa � MicroChannel � TurboChannel � PCIBus ��� VMEBus ��� NuBus PCMCIABus CBus �
MPIBus ��� MPSABus �� ProcessorInternal
InternalPowerBus � PNPISABus PNPBus ��� Vmcs � ACPIBus �� MaximumInterfaceType �6 t � _INTERFACE_TYPE .?AW4_INTERFACE_TYPE@@ � � � �+ > � _IO_RESOURCE_LIST .?AU_IO_RESOURCE_LIST@@ � " ( �
" ListSize �
� InterfaceType
" BusNumber
" SlotNumber ���
� Reserved �
" AlternativeLists �
� List �Z � H _IO_RESOURCE_REQUIREMENTS_LIST .?AU_IO_RESOURCE_REQUIREMENTS_LIST@@ �� � j � _SYSTEM_SPECULATION_CONTROL_INFORMATION .?AU_SYSTEM_SPECULATION_CONTROL_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
� BpbEnabled ���
� BpbDisabledSystemPolicy ��
� BpbDisabledNoHardwareSupport �
� SpecCtrlEnumerated ���
� SpecCmdEnumerated
� IbrsPresent ��
� StibpPresent �
� SmepPresent ��
� SpeculativeStoreBypassDisableAvailable ���
� SpeculativeStoreBypassDisableSupported ���
� SpeculativeStoreBypassDisabledSystemWide �
� SpeculativeStoreBypassDisabledKernel �
� SpeculativeStoreBypassDisableRequired
� BpbDisabledKernelToUser ��
� SpecCtrlRetpolineEnabled �
SpecCtrlImportOptimizationEnabled
EnhancedIbrs �
HvL1tfStatusAvailable
HvL1tfProcessorNotAffected ���
HvL1tfMigitationEnabled ��
HvL1tfMigitationNotEnabled_Hardware ��
HvL1tfMigitationNotEnabled_LoadOption
HvL1tfMigitationNotEnabled_CoreScheduler �
EnhancedIbrsReported �
MdsHardwareProtected �
MbClearEnabled ���
MbClearReported ��
Reserved �:
<anonymous-tag> .?AU<anonymous-tag>@@ � � &
SpeculationControlFlags ��j _SYSTEM_SPECULATION_CONTROL_INFORMATION .?AU_SYSTEM_SPECULATION_CONTROL_INFORMATION@@ � � Z � _REFS_SMR_VOLUME_GC_PARAMETERS .?AU_REFS_SMR_VOLUME_GC_PARAMETERS@@ ��Z SmrGcMethodCompaction SmrGcMethodCompression ��� SmrGcMethodRotation ��N t _REFS_SMR_VOLUME_GC_METHOD .?AW4_REFS_SMR_VOLUME_GC_METHOD@@ ��� � � # " @ �
" Version ��
" Flags
� Action ���
Method ���
" IoGranularity
" CompressionFormat
Unused ���Z X _REFS_SMR_VOLUME_GC_PARAMETERS .?AU_REFS_SMR_VOLUME_GC_PARAMETERS@@ �� � � ^ � _ETW_COVERAGE_SAMPLER_QUERY_INFO .?AU_ETW_COVERAGE_SAMPLER_QUERY_INFO@@ ��
� n � _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION .?AU_EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION@@
" ��R � _ETW_COVERAGE_SAMPLER_DATA .?AU_ETW_COVERAGE_SAMPLER_DATA@@ ��F
Common ���
EmptyStackCache ��
Header ���^ @ _ETW_COVERAGE_SAMPLER_QUERY_INFO .?AU_ETW_COVERAGE_SAMPLER_QUERY_INFO@@ �� ! @ ^ f � _PROCESS_HANDLE_SNAPSHOT_INFORMATION .?AU_PROCESS_HANDLE_SNAPSHOT_INFORMATION@@ ��^ � _PROCESS_HANDLE_TABLE_ENTRY_INFO .?AU_PROCESS_HANDLE_TABLE_ENTRY_INFO@@ �� $ " �F
" NumberOfHandles ��
" Reserved �
% Handles ��f & $ _PROCESS_HANDLE_SNAPSHOT_INFORMATION .?AU_PROCESS_HANDLE_SNAPSHOT_INFORMATION@@ �� ' � � F SymbolicLinkGlobalInformation SymbolicLinkAccessMask ���J t ) _SYMBOLIC_LINK_INFO_CLASS .?AW4_SYMBOLIC_LINK_INFO_CLASS@@ �* onecore\internal\sdk\inc\ntobapi.h � * + � DEBUG_CONTROL_SPACE_PCR �� DEBUG_CONTROL_SPACE_PRCB � DEBUG_CONTROL_SPACE_KSPECIAL � DEBUG_CONTROL_SPACE_THREAD ��� DEBUG_CONTROL_SPACE_MAXIMUM ��J t - _DEBUG_CONTROL_SPACE_ITEM .?AW4_DEBUG_CONTROL_SPACE_ITEM@@ �* onecore\external\sdk\inc\ntarm.h ��� . / D � ORIENTATION_PREFERENCE_NONE �� ORIENTATION_PREFERENCE_LANDSCAPE � ORIENTATION_PREFERENCE_PORTRAIT �� ORIENTATION_PREFERENCE_LANDSCAPE_FLIPPED � ORIENTATION_PREFERENCE_PORTRAIT_FLIPPED ��F t 1 ORIENTATION_PREFERENCE .?AW4ORIENTATION_PREFERENCE@@ ��� 2 ~ �=
�
� 2 � _SYSTEMTIME .?AU_SYSTEMTIME@@ �
Bias �
StandardName �
5 D StandardDate �
T StandardBias �
X DaylightName �
5 � DaylightDate �
� DaylightBias �J 6 � _TIME_ZONE_INFORMATION .?AU_TIME_ZONE_INFORMATION@@ ��6 onecore\external\sdk\inc\minwin\timezoneapi.h �� 7 8 # Z � _PROCESSOR_PROFILE_CONTROL_AREA .?AU_PROCESSOR_PROFILE_CONTROL_AREA@@
:
� B � _PEBS_DS_SAVE_AREA .?AU_PEBS_DS_SAVE_AREA@@ ��
< PebsDsSaveArea ���Z = � _PROCESSOR_PROFILE_CONTROL_AREA .?AU_PROCESSOR_PROFILE_CONTROL_AREA@@ > � � J � _FILE_MODE_INFORMATION .?AU_FILE_MODE_INFORMATION@@ ��
" Mode �J A _FILE_MODE_INFORMATION .?AU_FILE_MODE_INFORMATION@@ �� B � � f � _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN@@ ��
D
� *
m Header ���
SubQueue �f F $ _ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_BEGIN@@ �� G b 6
q I
J
� 6 NotificationTimer SynchronizationTimer �. t L _TIMER_TYPE .?AW4_TIMER_TYPE@@ � M � : � _SCONTEXT_QUEUE .?AU_SCONTEXT_QUEUE@@ " �*
P pad ��
userContext ��: Q <anonymous-tag> .?AU<anonymous-tag>@@ R �
R
�
T
� :
" NumberOfObjects ��
U ArrayOfObjects ���: V _SCONTEXT_QUEUE .?AU_SCONTEXT_QUEUE@@ W � # V � _SYSTEM_REF_TRACE_INFORMATION .?AU_SYSTEM_REF_TRACE_INFORMATION@@ j
TraceEnable ��
TracePermanent ���
TraceProcessName �
TracePoolTags V Z _SYSTEM_REF_TRACE_INFORMATION .?AU_SYSTEM_REF_TRACE_INFORMATION@@ [ � � N � _MUTANT_BASIC_INFORMATION .?AU_MUTANT_BASIC_INFORMATION@@
]
� N
CurrentCount �
OwnedByCaller
AbandonedState ���N _ _MUTANT_BASIC_INFORMATION .?AU_MUTANT_BASIC_INFORMATION@@ ` � 2 F � tagCLIENTCREATESTRUCT .?AUtagCLIENTCREATESTRUCT@@ 2
hWindowMenu ��
u idFirstChild �F c tagCLIENTCREATESTRUCT .?AUtagCLIENTCREATESTRUCT@@ d ~ / B � tagBITMAPCOREHEADER .?AUtagBITMAPCOREHEADER@@
f
� j
" bcSize ���
! bcWidth ��
! bcHeight �
! bcPlanes �
!
bcBitCount ���B h tagBITMAPCOREHEADER .?AUtagBITMAPCOREHEADER@@ i � V � _QUERY_STORAGE_RESERVE_INPUT .?AU_QUERY_STORAGE_RESERVE_INPUT@@ ��
k
� W " �j
" Version ��
" Flags
" AreaIdOffset �
" AreaIdCount ��
m AreaId ���V n _QUERY_STORAGE_RESERVE_INPUT .?AU_QUERY_STORAGE_RESERVE_INPUT@@ �� o � + J � _RPC_SECURITY_QOS_V2_W .?AU_RPC_SECURITY_QOS_V2_W@@ ��^ � _RPC_HTTP_TRANSPORT_CREDENTIALS_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_W@@
r
�
s HttpCredentials ��2 t <anonymous-tag> .?AT<anonymous-tag>@@ u ^ �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
u u J w _RPC_SECURITY_QOS_V2_W .?AU_RPC_SECURITY_QOS_V2_W@@ �� x ^ . � HBRUSH__ .?AUHBRUSH__@@ ��
z
�
t unused ���. | HBRUSH__ .?AUHBRUSH__@@ �� } s J j � _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA@@ ��
SymbolicLinkName �
� AliasClassGuid ���
q AliasSymbolicLinkName
" AliasSymbolicLinkNameLength ��j � _PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_ALIAS_DATA@@ �� � $ v n � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE@@ z � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY@@ � " �.
" UpdateCount ��
� Updates ��n � _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE@@ � � � 6 � _STARTUPINFOA .?AU_STARTUPINFOA@@
�
� �
" cb ���
p lpReserved ���
p lpDesktop
p lpTitle ��
" dwX ��
" dwY ��
" dwXSize ��
" dwYSize ��
" dwXCountChars
" $ dwYCountChars
" ( dwFillAttribute ��
" , dwFlags ��
! 0 wShowWindow ��
! 2 cbReserved2 ��
4 lpReserved2 ��
8 hStdInput
< hStdOutput ���
@ hStdError 6 � D _STARTUPINFOA .?AU_STARTUPINFOA@@ � � # ^ � _RTL_IMAGE_MITIGATION_ASLR_POLICY .?AU_RTL_IMAGE_MITIGATION_ASLR_POLICY@@ f
� ForceRelocateImages ��
� BottomUpRandomization
� HighEntropyRandomization �^ � _RTL_IMAGE_MITIGATION_ASLR_POLICY .?AU_RTL_IMAGE_MITIGATION_ASLR_POLICY@@ � R � _UNICODE_PREFIX_TABLE_ENTRY .?AU_UNICODE_PREFIX_TABLE_ENTRY@@
�
� �
NodeTypeCode �
NameLength ���
� NextPrefixTree ���
� CaseMatch
b Links
{ Prefix ���R � _UNICODE_PREFIX_TABLE_ENTRY .?AU_UNICODE_PREFIX_TABLE_ENTRY@@ � g R F � _REPAIR_COPIES_INPUT .?AU_REPAIR_COPIES_INPUT@@ ��
" Size �
" Flags
� FileOffset ���
" Length ���
" SourceCopy ���
" NumberOfRepairCopies �
� RepairCopies �F � _REPAIR_COPIES_INPUT .?AU_REPAIR_COPIES_INPUT@@ �� � � 4 n � _PROCESS_STACK_ALLOCATION_INFORMATION_EX .?AU_PROCESS_STACK_ALLOCATION_INFORMATION_EX@@ ��f � _PROCESS_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_STACK_ALLOCATION_INFORMATION@@ j
" PreferredNode
" Reserved0
" Reserved1
" Reserved2
� AllocInfo n � _PROCESS_STACK_ALLOCATION_INFORMATION_EX .?AU_PROCESS_STACK_ALLOCATION_INFORMATION_EX@@ �� � � �
Y
� F � _KCRM_MARSHAL_HEADER .?AU_KCRM_MARSHAL_HEADER@@ ��
�
� ^
" VersionMajor �
" VersionMinor �
" NumProtocols �
" Unused ���F � _KCRM_MARSHAL_HEADER .?AU_KCRM_MARSHAL_HEADER@@ �� � � � � RPCHTTP_RS_REDIRECT �� RPCHTTP_RS_ACCESS_1 �� RPCHTTP_RS_SESSION ��� RPCHTTP_RS_ACCESS_2 �� RPCHTTP_RS_INTERFACE �N t � _RPC_HTTP_REDIRECTOR_STAGE .?AW4_RPC_HTTP_REDIRECTOR_STAGE@@ ��� � ^ � 2 ComputerNameNetBIOS �� ComputerNameDnsHostname �� ComputerNameDnsDomain ComputerNameDnsFullyQualified ComputerNamePhysicalNetBIOS �� ComputerNamePhysicalDnsHostname �� ComputerNamePhysicalDnsDomain ComputerNamePhysicalDnsFullyQualified ComputerNameMax ��B t � _COMPUTER_NAME_FORMAT .?AW4_COMPUTER_NAME_FORMAT@@ �6 onecore\external\sdk\inc\minwin\sysinfoapi.h ��� � � R : � _SYSTEM_POOLTAG .?AU_SYSTEM_POOLTAG@@
�
� �
g Tag ��
" TagUlong �
" PagedAllocs ��
" PagedFrees ���
" PagedUsed
" NonPagedAllocs ���
" NonPagedFrees
" NonPagedUsed �: � _SYSTEM_POOLTAG .?AU_SYSTEM_POOLTAG@@ � � u
V � _TXFS_GET_TRANSACTED_VERSION .?AU_TXFS_GET_TRANSACTED_VERSION@@ ��
" ThisBaseVersion ��
" LatestVersion
! ThisMiniVersion ��
!
FirstMiniVersion �
! LatestMiniVersion V � _TXFS_GET_TRANSACTED_VERSION .?AU_TXFS_GET_TRANSACTED_VERSION@@ �� � � � j � _ALPC_PORT_COMPLETION_LIST_INFORMATION .?AU_ALPC_PORT_COMPLETION_LIST_INFORMATION@@ ��^
Buffer ���
" Size �
" ConcurrencyCount �
" AttributeFlags ���j � _ALPC_PORT_COMPLETION_LIST_INFORMATION .?AU_ALPC_PORT_COMPLETION_LIST_INFORMATION@@ �� � � 6 � _CLIENT_ID64 .?AU_CLIENT_ID64@@ ��2
# UniqueProcess
# UniqueThread �6 � _CLIENT_ID64 .?AU_CLIENT_ID64@@ �� � D } > � _WMI_WAIT_SINGLE .?AU_WMI_WAIT_SINGLE@@ ��
�
� B
" ThreadId �
Object ���
ObjectType ���> � _WMI_WAIT_SINGLE .?AU_WMI_WAIT_SINGLE@@ �� � b � > � _SERVICE_SID_INFO .?AU_SERVICE_SID_INFO@@
�
�
" dwServiceSidType �> � _SERVICE_SID_INFO .?AU_SERVICE_SID_INFO@@ � � J
,
�
i
� J � tagGESTURENOTIFYSTRUCT .?AUtagGESTURENOTIFYSTRUCT@@ ��r
u cbSize ���
" dwFlags ��
� hwndTarget ���
{ ptsLocation ��
" dwInstanceID �J � tagGESTURENOTIFYSTRUCT .?AUtagGESTURENOTIFYSTRUCT@@ �� � ~ �< B � tagMINIMIZEDMETRICS .?AUtagMINIMIZEDMETRICS@@ f
u cbSize ���
t iWidth ���
t iHorzGap �
t iVertGap �
t iArrange �B � tagMINIMIZEDMETRICS .?AUtagMINIMIZEDMETRICS@@ � ~ 2 > � tagEMRGDICOMMENT .?AUtagEMRGDICOMMENT@@ ��6
� emr ��
" cbData ���
� Data �> � tagEMRGDICOMMENT .?AUtagEMRGDICOMMENT@@ �� � � � Z � _FILE_PIPE_DELETE_SYMLINK_INPUT .?AU_FILE_PIPE_DELETE_SYMLINK_INPUT@@ 2
! NameOffset ���
! NameLength ���Z � _FILE_PIPE_DELETE_SYMLINK_INPUT .?AU_FILE_PIPE_DELETE_SYMLINK_INPUT@@ � � �)
h
� b ProcessTlsReplaceIndex ��� ProcessTlsReplaceVector �� MaxProcessTlsOperation ���R t � _PROCESS_TLS_INFORMATION_TYPE .?AW4_PROCESS_TLS_INFORMATION_TYPE@@ � � � Y F � _SYSTEM_POWER_POLICY .?AU_SYSTEM_POWER_POLICY@@ ��
�
� B � POWER_ACTION_POLICY .?AUPOWER_ACTION_POLICY@@ B � SYSTEM_POWER_LEVEL .?AUSYSTEM_POWER_LEVEL@@ �� � " ` �
" Revision �
� PowerButton ��
� SleepButton ��
� LidClose �
� ( LidOpenWake ��
" , Reserved �
� 0 Idle �
" < IdleTimeout ��
@ IdleSensitivity ��
A DynamicThrottle ��
� B Spare2 ���
� D MinSleep �
� H MaxSleep �
� L ReducedLatencySleep ��
" P WinLogonFlags
" T Spare3 ���
" X DozeS4Timeout
" \ BroadcastCapacityResolution ��
� ` DischargePolicy ��
" � VideoTimeout �
� VideoDimDisplay ��
� � VideoReserved
" � SpindownTimeout ��
� OptimizeForPower �
� FanThrottleTolerance �
� ForcedThrottle ���
� MinThrottle ��
� � OverThrottled F � � _SYSTEM_POWER_POLICY .?AU_SYSTEM_POWER_POLICY@@ �� � { �
r � _EVENT_TRACE_LBR_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_LBR_CONFIGURATION_INFORMATION@@ ��b
? EventTraceInformationClass ���
# TraceHandle ��
" ConfigurationOptions �r � _EVENT_TRACE_LBR_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_LBR_CONFIGURATION_INFORMATION@@ �� � @ r V � _DELETE_STORAGE_RESERVE_INPUT .?AU_DELETE_STORAGE_RESERVE_INPUT@@
�
� j
" Version ��
" Flags
" AreaIdOffset �
" AreaIdCount ��
m AreaId ���V � _DELETE_STORAGE_RESERVE_INPUT .?AU_DELETE_STORAGE_RESERVE_INPUT@@ � � ,+ N � _PROCESS_WAKE_INFORMATION .?AU_PROCESS_WAKE_INFORMATION@@ " " �J � _JOBOBJECT_WAKE_FILTER .?AU_JOBOBJECT_WAKE_FILTER@@ ��R
# NotificationChannel ��
� WakeCounters �
� $ WakeFilter ���N � 0 _PROCESS_WAKE_INFORMATION .?AU_PROCESS_WAKE_INFORMATION@@ � � 8 r � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA .?AT_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA@@ �� � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING@@ � � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL@@ �� � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING@@ ��r
� ResolutionBeginning ��
� GetRoot ��
� ResolutionSuccessful �
� ResolutionEnding �r � _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA .?AT_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA@@ �� � � � > � _RTLP_CURDIR_REF .?AU_RTLP_CURDIR_REF@@ ��j � _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA .?AU_PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA@@ r
DeviceInstance ���
" Flags
� VetoType �
q VetoName �
" VetoNameLength ���j � _PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA .?AU_PLUGPLAY_CONTROL_QUERY_AND_REMOVE_DATA@@ � $ � UmsThreadInvalidInfoClass UmsThreadUserContext � UmsThreadPriority UmsThreadAffinity UmsThreadTeb � UmsThreadIsSuspended � UmsThreadIsTerminated UmsThreadMaxInfoClass N t ! _RTL_UMS_THREAD_INFO_CLASS .?AW4_RTL_UMS_THREAD_INFO_CLASS@@ ��� ! g �! j � _MEMORY_PARTITION_ATTRIBUTE_INFORMATION .?AU_MEMORY_PARTITION_ATTRIBUTE_INFORMATION@@
# Flags j ! _MEMORY_PARTITION_ATTRIBUTE_INFORMATION .?AU_MEMORY_PARTITION_ATTRIBUTE_INFORMATION@@ ! w � F � _PEBS_DS_SAVE_AREA64 .?AU_PEBS_DS_SAVE_AREA64@@ ��"
# BtsBufferBase
# BtsIndex �
# BtsAbsoluteMaximum ���
# BtsInterruptThreshold
# PebsBufferBase ���
# ( PebsIndex
# 0 PebsAbsoluteMaximum ��
# 8 PebsInterruptThreshold ���
E @ PebsGpCounterReset ���
8 � PebsFixedCounterReset F
! � _PEBS_DS_SAVE_AREA64 .?AU_PEBS_DS_SAVE_AREA64@@ ��
! � � b � _WIM_PROVIDER_UPDATE_OVERLAY_INPUT .?AU_WIM_PROVIDER_UPDATE_OVERLAY_INPUT@@ ��R
� DataSourceId �
" WimFileNameOffset
" WimFileNameLength b
! _WIM_PROVIDER_UPDATE_OVERLAY_INPUT .?AU_WIM_PROVIDER_UPDATE_OVERLAY_INPUT@@ �� ! � -" � SecureSettingValueTypeBoolean SecureSettingValueTypeUlong �� SecureSettingValueTypeBinary � SecureSettingValueTypeString � SecureSettingValueTypeUnknown N t ! _SECURE_SETTING_VALUE_TYPE .?AW4_SECURE_SETTING_VALUE_TYPE@@ ��� ! � b
�
� Z � _PROCESS_POWER_THROTTLING_STATE .?AU_PROCESS_POWER_THROTTLING_STATE@@ B
" Version ��
" ControlMask ��
" StateMask Z ! _PROCESS_POWER_THROTTLING_STATE .?AU_PROCESS_POWER_THROTTLING_STATE@@ ! � � f � _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_LIST_DATA@@ z
DeviceInstance ���
� InterfaceGuid
q InterfaceList
" InterfaceListSize
" Flags f ! _PLUGPLAY_CONTROL_INTERFACE_LIST_DATA .?AU_PLUGPLAY_CONTROL_INTERFACE_LIST_DATA@@ ! $ + N � _SYSTEM_POOL_INFORMATION .?AU_SYSTEM_POOL_INFORMATION@@ ��B � _SYSTEM_POOL_ENTRY .?AU_SYSTEM_POOL_ENTRY@@ �� ! " �
" TotalSize
FirstEntry ���
! EntryOverhead
PoolTagPresent ���
Spare0 ���
" NumberOfEntries ��
! Entries ��N ! _SYSTEM_POOL_INFORMATION .?AU_SYSTEM_POOL_INFORMATION@@ �� ! � k
V � _ETW_DFSS_START_NEW_INTERVAL .?AU_ETW_DFSS_START_NEW_INTERVAL@@ ��J � _ETW_PER_SESSION_QUOTA .?AU_ETW_PER_SESSION_QUOTA@@ �� #! " �
" CurrentGeneration
" SessionCount �
# TotalCycleCredit �
# TotalCyclesAccumulated ���
$! SessionQuota �V %! 0 _ETW_DFSS_START_NEW_INTERVAL .?AU_ETW_DFSS_START_NEW_INTERVAL@@ �� &! b 3
b � _SERVICE_REQUIRED_PRIVILEGES_INFOW .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOW@@ ��&
q pmszRequiredPrivileges ���b )! _SERVICE_REQUIRED_PRIVILEGES_INFOW .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOW@@ �� *! � W
�
� n
" Flags
Y FullDllName ��
Y BaseDllName ��
DllBase ��
" SizeOfImage ��^ -! _LDR_DLL_LOADED_NOTIFICATION_DATA .?AU_LDR_DLL_LOADED_NOTIFICATION_DATA@@ .! � � n � tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION .?AUtagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION@@ *
! score
� adjustedPoint n 1! tagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION .?AUtagTOUCH_HIT_TESTING_PROXIMITY_EVALUATION@@ 2! ~ " ^ � _SYSTEM_HOT_PATCH_REGISTRY_VALUE .?AU_SYSTEM_HOT_PATCH_REGISTRY_VALUE@@ ��2
! ImageNameLength ��
ImageName ^ 5! _SYSTEM_HOT_PATCH_REGISTRY_VALUE .?AU_SYSTEM_HOT_PATCH_REGISTRY_VALUE@@ ��2 onecore\internal\sdk\inc\minwin\ntioapi.h �� 6! 7!
J � _KLDR_DATA_TABLE_ENTRY .?AU_KLDR_DATA_TABLE_ENTRY@@ ��F � _NON_PAGED_DEBUG_INFO .?AU_NON_PAGED_DEBUG_INFO@@
:!
�
! ��
! ��
! ��b
<! SignatureLevel ���
=! SignatureType
>! Unused ���
! EntireField ��2 ?! <anonymous-tag> .?AT<anonymous-tag>@@ @! � �
! InLoadOrderLinks �
ExceptionTable ���
" ExceptionTableSize ���
GpValue ��
;! NonPagedDebugInfo
DllBase ��
EntryPoint ���
" SizeOfImage ��
$ FullDllName ��
, BaseDllName ��
" 4 Flags
! 8 LoadCount
@! : u1 ���
< SectionPointer ���
" @ CheckSum �
" D CoverageSectionSize ��
H CoverageSection ��
L LoadedImports
P Spare
" T SizeOfImageNotRounded
" X TimeDateStamp J B! \ _KLDR_DATA_TABLE_ENTRY .?AU_KLDR_DATA_TABLE_ENTRY@@ �� C! � �
� B ProcessActivityTypeAudio � ProcessActivityTypeMax ���F t F! _PROCESS_ACTIVITY_TYPE .?AW4_PROCESS_ACTIVITY_TYPE@@ ��� G! � &
R � _BY_HANDLE_FILE_INFORMATION .?AU_BY_HANDLE_FILE_INFORMATION@@
I!
�
" dwFileAttributes �
x ftCreationTime ���
x ftLastAccessTime �
x ftLastWriteTime ��
" dwVolumeSerialNumber �
" nFileSizeHigh
" $ nFileSizeLow �
" ( nNumberOfLinks ���
" , nFileIndexHigh ���
" 0 nFileIndexLow R
K! 4 _BY_HANDLE_FILE_INFORMATION .?AU_BY_HANDLE_FILE_INFORMATION@@ L! T � 2 � tagMENUINFO .?AUtagMENUINFO@@
N! ��
O!
�
z
� �
" cbSize ���
" fMask
" dwStyle ��
u cyMax
Q! hbrBack ��
" dwContextHelpID ��
" dwMenuData ���2 R! tagMENUINFO .?AUtagMENUINFO@@ S! ~ B � � U! ^ � _ALPC_MESSAGE_HANDLE_INFORMATION .?AU_ALPC_MESSAGE_HANDLE_INFORMATION@@ ��f
" Index
" Flags
" Handle ���
" ObjectType ���
" GrantedAccess ^ X! _ALPC_MESSAGE_HANDLE_INFORMATION .?AU_ALPC_MESSAGE_HANDLE_INFORMATION@@ �� Y! � R � _PERFINFO_CCSWAP_IDLE_SHORT .?AU_PERFINFO_CCSWAP_IDLE_SHORT@@
! ��
! ��*
\! DataType �
]! TimeDelta R ^! _PERFINFO_CCSWAP_IDLE_SHORT .?AU_PERFINFO_CCSWAP_IDLE_SHORT@@ _! b �
�
� : � _STARTUPINFOEXW .?AU_STARTUPINFOEXW@@
b!
� R � _PROC_THREAD_ATTRIBUTE_LIST .?AU_PROC_THREAD_ATTRIBUTE_LIST@@
d!
� 6
� StartupInfo ��
e! D lpAttributeList ��: f! H _STARTUPINFOEXW .?AU_STARTUPINFOEXW@@ g! n 5 j � JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 .?AUJOBOBJECT_LIMIT_VIOLATION_INFORMATION_2@@ r
" LimitFlags ���
" ViolationLimitFlags ��
# IoReadBytes ��
# IoReadBytesLimit �
# IoWriteBytes �
# IoWriteBytesLimit
� ( PerJobUserTime ���
� 0 PerJobUserTimeLimit ��
# 8 JobMemory
# @ JobHighMemoryLimit ���
# @ JobMemoryLimit ���
M H RateControlTolerance �
M H CpuRateControlTolerance ��
M L RateControlToleranceLimit
M L CpuRateControlToleranceLimit �
# P JobLowMemoryLimit
M X IoRateControlTolerance ���
M \ IoRateControlToleranceLimit ��
M ` NetRateControlTolerance ��
M d NetRateControlToleranceLimit �j j! h JOBOBJECT_LIMIT_VIOLATION_INFORMATION_2 .?AUJOBOBJECT_LIMIT_VIOLATION_INFORMATION_2@@ k! D � : � _OSVERSIONINFOA .?AU_OSVERSIONINFOA@@ �
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
szCSDVersion �: n! � _OSVERSIONINFOA .?AU_OSVERSIONINFOA@@ o! g � 2 � _BOOT_ENTRY .?AU_BOOT_ENTRY@@ �
" Version ��
" Length ���
" Id ���
" Attributes ���
" FriendlyNameOffset ���
" BootFilePathOffset ���
" OsOptionsLength ��
� OsOptions 2 r! _BOOT_ENTRY .?AU_BOOT_ENTRY@@ s! � � J � _PERFINFO_FILE_DIRENUM .?AU_PERFINFO_FILE_DIRENUM@@ ��
" Irp ��
" FileObject ���
" FileKey ��
" IssuingThreadId ��
" Length ���
" InfoClass
" FileIndex
FileName �J v! _PERFINFO_FILE_DIRENUM .?AU_PERFINFO_FILE_DIRENUM@@ �� w! b i F � _RPC_CLIENT_INTERFACE .?AU_RPC_CLIENT_INTERFACE@@
y!
� B � RPC_DISPATCH_TABLE .?AURPC_DISPATCH_TABLE@@ ��
{!
� F � _RPC_PROTSEQ_ENDPOINT .?AU_RPC_PROTSEQ_ENDPOINT@@
}!
� �
u Length ���
/ InterfaceId ��
/ TransferSyntax ���
|! , DispatchTable
u 0 RpcProtseqEndpointCount ��
~! 4 RpcProtseqEndpoint ���
" 8 Reserved �
< InterpreterInfo ��
u @ Flags F ! D _RPC_CLIENT_INTERFACE .?AU_RPC_CLIENT_INTERFACE@@ �! 3 � v � _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION@@
�!
�
# CycleTime v �! _SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION@@ �! �
j TransactionStateNormal ��� TransactionStateIndoubt �� TransactionStateCommittedNotify ��> t �! _TRANSACTION_STATE .?AW4_TRANSACTION_STATE@@ ��� �! � � F � _WMI_JOB_INFORMATION .?AU_WMI_JOB_INFORMATION@@ ��
�!
� N
$ ContainerId ��
" JobId
" Flags
Status ���F �! _WMI_JOB_INFORMATION .?AU_WMI_JOB_INFORMATION@@ �� �! b � 2 � _RPC_STRING .?AU_RPC_STRING@@ B
! Length ���
! MaximumLength
p Buffer ���2 �! _RPC_STRING .?AU_RPC_STRING@@ �! B D B � tagIMEMENUITEMINFOW .?AUtagIMEMENUITEMINFOW@@ q " � �
u cbSize ���
u fType
u fState ���
u wID ��
{ hbmpChecked ��
{ hbmpUnchecked
" dwItemData ���
�! szString �
{ � hbmpItem �B �! � tagIMEMENUITEMINFOW .?AUtagIMEMENUITEMINFOW@@ �! � � j STUB_UNMARSHAL ��� STUB_CALL_SERVER � STUB_MARSHAL � STUB_CALL_SERVER_NO_HRESULT ��. t �! STUB_PHASE .?AW4STUB_PHASE@@ ��� �! � G
VmPrefetchInformation VmPagePriorityInformation VmCfgCallTargetInformation ��� VmPageDirtyStateInformation �� VmImageHotPatchInformation ��� VmPhysicalContiguityInformation �� VmVirtualMachinePrepopulateInformation ���Z t �! _VIRTUAL_MEMORY_INFORMATION_CLASS .?AW4_VIRTUAL_MEMORY_INFORMATION_CLASS@@ � �! � 1
�
� *
Sid ��
" Attributes ���B �! _SID_AND_ATTRIBUTES .?AU_SID_AND_ATTRIBUTES@@ �! w I j � _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID .?AU_EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID@@
$ RelatedActivityId j �! _EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID .?AU_EVENT_EXTENDED_ITEM_RELATED_ACTIVITYID@@ �! U `
�
� J � tagEMRSETVIEWPORTORGEX .?AUtagEMRSETVIEWPORTORGEX@@ ��&
� emr ��
� ptlOrigin J �! tagEMRSETVIEWPORTORGEX .?AUtagEMRSETVIEWPORTORGEX@@ �� �! � � . � __n128x3 .?AU__n128x3@@ �� \ " 0 �
�! val ��. �! 0 __n128x3 .?AU__n128x3@@ �� �! % e > � tagHIGHCONTRASTA .?AUtagHIGHCONTRASTA@@ ��
�!
� F
u cbSize ���
" dwFlags ��
p lpszDefaultScheme > �! tagHIGHCONTRASTA .?AUtagHIGHCONTRASTA@@ �� �! ~ j2 : � tagGCP_RESULTSA .?AUtagGCP_RESULTSA@@ �
" lStructSize ��
p lpOutString ��
u lpOrder ��
t lpDx �
t lpCaretPos ���
p lpClass ��
q lpGlyphs �
u nGlyphs ��
t nMaxFit ��: �! $ tagGCP_RESULTSA .?AUtagGCP_RESULTSA@@ �! � �
6 � tagABORTPATH .?AUtagABORTPATH@@ ��
� emr ��6 �! tagABORTPATH .?AUtagABORTPATH@@ �� �! � T � � _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED@@ b � _RTL_ACTIVATION_CONTEXT_STACK_FRAME .?AU_RTL_ACTIVATION_CONTEXT_STACK_FRAME@@ �
" Size �
" Format ���
�! Frame
Extra1 ���
Extra2 ���
Extra3 ���
Extra4 ��� �! $ _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED@@ �! �
j � _JOBOBJECT_END_OF_JOB_TIME_INFORMATION .?AU_JOBOBJECT_END_OF_JOB_TIME_INFORMATION@@ ��"
" EndOfJobTimeAction ���j �! _JOBOBJECT_END_OF_JOB_TIME_INFORMATION .?AU_JOBOBJECT_END_OF_JOB_TIME_INFORMATION@@ �� �! D � ( *
�
� B � _MM_ETW_PAGE_EXTRA_INFO .?AT_MM_ETW_PAGE_EXTRA_INFO@@
" ��
�! SharedInitial : �! <anonymous-tag> .?AU<anonymous-tag>@@ �! w C
" ��
" ��
" ��J
�! WorkingSetType ���
�! NotAddedtoWS �
�! COWFault �: �! <anonymous-tag> .?AU<anonymous-tag>@@ �! w F R
�! e1 ���
�! e2 ���
" ProtoPte �
VirtualAddress ���B �! _MM_ETW_PAGE_EXTRA_INFO .?AT_MM_ETW_PAGE_EXTRA_INFO@@ �! w B 6 � _ICONINFOEXA .?AU_ICONINFOEXA@@ ��
" cbSize ���
t fIcon
" xHotspot �
" yHotspot �
{ hbmMask ��
{ hbmColor �
! wResID ���
y szModName
y szResName 6 �! $_ICONINFOEXA .?AU_ICONINFOEXA@@ �� �! ~ �* ~ VmOfferPriorityVeryLow ��� VmOfferPriorityLow ��� VmOfferPriorityBelowNormal ��� VmOfferPriorityNormal 6 t �! OFFER_PRIORITY .?AW4OFFER_PRIORITY@@ ��� �! � � Z � _FILE_FS_DATA_COPY_INFORMATION .?AU_FILE_FS_DATA_COPY_INFORMATION@@ ��
" NumberOfCopies ���Z �! _FILE_FS_DATA_COPY_INFORMATION .?AU_FILE_FS_DATA_COPY_INFORMATION@@ �� �! � � PowerStateSleeping1 �� PowerStateSleeping2 �� PowerStateSleeping3 �� PowerStateSleeping4 �� PowerStateShutdownOff PowerStateShutdownReset �� PowerStateSleeping4Firmware �� PowerStateMaximum J t �! POWER_STATE_HANDLER_TYPE .?AW4POWER_STATE_HANDLER_TYPE@@ ��� �! { � j � RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER .?AURETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER@@ ��B
� NextVcn ��
� Lcn ��
" ReferenceCount ���: �! <anonymous-tag> .?AU<anonymous-tag>@@ �! � u
�! " �F
" ExtentCount ��
� StartingVcn ��
�! Extents ��j �! ( RETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER .?AURETRIEVAL_POINTERS_AND_REFCOUNT_BUFFER@@ �� �! � q
�
�
�!
�
�
� B
�! Previous �
�! ActivationContext
" Flags b �! _RTL_ACTIVATION_CONTEXT_STACK_FRAME .?AU_RTL_ACTIVATION_CONTEXT_STACK_FRAME@@ �! � o
: � _LDR_DDAG_NODE .?AU_LDR_DDAG_NODE@@ ��
�!
�
�
� 6 � _LDRP_CSLIST .?AU_LDRP_CSLIST@@ ��
! Modules ��
�! ServiceTagList ���
" LoadCount
" LoadWhileUnloadingCount ��
" LowestLink ���
�! Dependencies �
�! IncomingDependencies �
v State
[ $ CondenseLink �
" ( PreorderNumber ���:
�! , _LDR_DDAG_NODE .?AU_LDR_DDAG_NODE@@ �� �! � � b � _JOBOBJECT_INTERFERENCE_INFORMATION .?AU_JOBOBJECT_INTERFERENCE_INFORMATION@@
# Count b �! _JOBOBJECT_INTERFERENCE_INFORMATION .?AU_JOBOBJECT_INTERFERENCE_INFORMATION@@ �! � C 6 � tagEMRPLGBLT .?AUtagEMRPLGBLT@@ �� � " �
� emr ��
c rclBounds
�! aptlDest �
0 xSrc �
4 ySrc �
8 cxSrc
< cySrc
I @ xformSrc �
" X crBkColorSrc �
" \ iUsageSrc
" ` offBmiSrc
" d cbBmiSrc �
" h offBitsSrc ���
" l cbBitsSrc
p xMask
t yMask
" x iUsageMask ���
" | offBmiMask ���
" � cbBmiMask
" � offBitsMask ��
" � cbBitsMask ���6 �! � tagEMRPLGBLT .?AUtagEMRPLGBLT@@ �� " � � : � tagEMRINVERTRGN .?AUtagEMRINVERTRGN@@
"
� N
� emr ��
c rclBounds
" cbRgnData
� RgnData ��: " tagEMRINVERTRGN .?AUtagEMRINVERTRGN@@ " � y Z � _SYSTEM_FIRMWARE_TABLE_HANDLER .?AU_SYSTEM_FIRMWARE_TABLE_HANDLER@@ ��b � _SYSTEM_FIRMWARE_TABLE_INFORMATION .?AU_SYSTEM_FIRMWARE_TABLE_INFORMATION@@ ��
"
�
"
"
"
� j
" ProviderSignature
Register �
" FirmwareTableHandler �
DriverObject �Z
" _SYSTEM_FIRMWARE_TABLE_HANDLER .?AU_SYSTEM_FIRMWARE_TABLE_HANDLER@@ �� " � d F � _OBJECT_ATTRIBUTES32 .?AU_OBJECT_ATTRIBUTES32@@ ��
" Length ���
" RootDirectory
" ObjectName ���
" Attributes ���
" SecurityDescriptor ���
" SecurityQualityOfService �F " _OBJECT_ATTRIBUTES32 .?AU_OBJECT_ATTRIBUTES32@@ �� " F � _SERVICE_DESCRIPTIONW .?AU_SERVICE_DESCRIPTIONW@@
"
�
q lpDescription F " _SERVICE_DESCRIPTIONW .?AU_SERVICE_DESCRIPTIONW@@ " � � B � PPM_IDLE_ACCOUNTING .?AUPPM_IDLE_ACCOUNTING@@
"
� N � PPM_IDLE_STATE_ACCOUNTING .?AUPPM_IDLE_STATE_ACCOUNTING@@ " " 0 �r
" StateCount ���
" TotalTransitions �
" ResetCount ���
# StartTime
" State B " H PPM_IDLE_ACCOUNTING .?AUPPM_IDLE_ACCOUNTING@@ " {
. � _POWER_STATE .?AT_POWER_STATE@@ ��
"
� 2
� SystemState ��
� DeviceState ��. "" _POWER_STATE .?AT_POWER_STATE@@ �� #" { � R � _SYSTEM_MANDATORY_LABEL_ACE .?AU_SYSTEM_MANDATORY_LABEL_ACE@@ :
� Header ���
" Mask �
" SidStart �R &" _SYSTEM_MANDATORY_LABEL_ACE .?AU_SYSTEM_MANDATORY_LABEL_ACE@@ '" w � . � _DOCINFOA .?AU_DOCINFOA@@
)"
� r
t cbSize ���
� lpszDocName ��
� lpszOutput ���
� lpszDatatype �
" fwType ���. +" _DOCINFOA .?AU_DOCINFOA@@ ," � � j � _WMI_JOB_SEND_NOTIFICATION_INFORMATION .?AU_WMI_JOB_SEND_NOTIFICATION_INFORMATION@@ ��F
$ ContainerId ��
" JobId
" NotificationId ���j /" _WMI_JOB_SEND_NOTIFICATION_INFORMATION .?AU_WMI_JOB_SEND_NOTIFICATION_INFORMATION@@ �� 0" b � > � _nlsversioninfoex .?AU_nlsversioninfoex@@ �
" dwNLSVersionInfoSize �
" dwNLSVersion �
" dwDefinedVersion �
" dwEffectiveId
$ guidCustomVersion > 3" _nlsversioninfoex .?AU_nlsversioninfoex@@ 4" V � N � _RTL_SPARSE_BITMAP_RANGE .?AU_RTL_SPARSE_BITMAP_RANGE@@ ��2 � _RTL_BITMAP .?AU_RTL_BITMAP@@ :
" Lock �
7" RangeBitmap ��
[ Next �N 8" _RTL_SPARSE_BITMAP_RANGE .?AU_RTL_SPARSE_BITMAP_RANGE@@ �� 9" � F � _CM_VIDEO_DEVICE_DATA .?AU_CM_VIDEO_DEVICE_DATA@@
;"
� B
! Version ��
! Revision �
" VideoClock ���F =" _CM_VIDEO_DEVICE_DATA .?AU_CM_VIDEO_DEVICE_DATA@@ >" � r SystemCrashDumpDisable ��� SystemCrashDumpReconfigure ��� SystemCrashDumpInitializationComplete f t @" _SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS .?AW4_SYSTEM_CRASH_DUMP_CONFIGURATION_CLASS@@ ��� A" � & N � _FILE_STREAM_INFORMATION .?AU_FILE_STREAM_INFORMATION@@ ��
C"
� �
" NextEntryOffset ��
" StreamNameLength �
� StreamSize ���
� StreamAllocationSize �
StreamName ���N E" _FILE_STREAM_INFORMATION .?AU_FILE_STREAM_INFORMATION@@ �� F" � - J � _MIDL_INTERCEPTION_INFO .?AU_MIDL_INTERCEPTION_INFO@@ z
" Version ��
J ProcString ���
2 ProcFormatOffsetTable
" ProcCount
J TypeString ���J I" _MIDL_INTERCEPTION_INFO .?AU_MIDL_INTERCEPTION_INFO@@ J" � � > � _EXFAT_STATISTICS .?AU_EXFAT_STATISTICS@@
" CreateHits ���
" SuccessfulCreates
" FailedCreates
" NonCachedReads ���
" NonCachedReadBytes ���
" NonCachedWrites ��
" NonCachedWriteBytes ��
" NonCachedDiskReads ���
" NonCachedDiskWrites ��> M" $ _EXFAT_STATISTICS .?AU_EXFAT_STATISTICS@@ N" � N j FpRoundNearest ��� FpRoundMinusInfinity � FpRoundPlusInfinity �� FpRoundChopped ���F t P" _FP__IEEE_ROUNDING_MODE .?AW4_FP__IEEE_ROUNDING_MODE@@ � Q" � � B � HSAVEDUILANGUAGES__ .?AUHSAVEDUILANGUAGES__@@
S"
�
t unused ���B U" HSAVEDUILANGUAGES__ .?AUHSAVEDUILANGUAGES__@@ V" V
. HeapCompatibilityInformation � HeapEnableTerminationOnCorruption HeapExtendedInformation �� HeapOptimizeResources HeapTaggingInformation ��� HeapStackDatabase HeapMemoryLimit �� � �HeapDetailedFailureInformation ��� � �HeapSetDebuggingInformation ��F t X" _HEAP_INFORMATION_CLASS .?AW4_HEAP_INFORMATION_CLASS@@ � Y" � Q " ["
\"
� N � _QUERY_FILE_LAYOUT_OUTPUT .?AU_QUERY_FILE_LAYOUT_OUTPUT@@
^"
� ^
" FileEntryCount ���
" FirstFileOffset ��
" Flags
" Reserved �N `" _QUERY_FILE_LAYOUT_OUTPUT .?AU_QUERY_FILE_LAYOUT_OUTPUT@@ a" � Y
�
�
�
� 6 � tagEMRLINETO .?AUtagEMRLINETO@@ ��
e"
� "
� emr ��
� ptl ��6 g" tagEMRLINETO .?AUtagEMRLINETO@@ �� h" � �
�!
� " " " " " k"
l"
� > � _DISPLAY_DEVICEA .?AU_DISPLAY_DEVICEA@@ �� p " �
" cb ���
o" DeviceName ���
$ DeviceString �
" � StateFlags ���
� DeviceID �
(DeviceKey > p" �_DISPLAY_DEVICEA .?AU_DISPLAY_DEVICEA@@ �� q" � �
F � _RTL_PERTHREAD_CURDIR .?AU_RTL_PERTHREAD_CURDIR@@ N � _RTL_DRIVE_LETTER_CURDIR .?AU_RTL_DRIVE_LETTER_CURDIR@@ ��
t"
� N
u" CurrentDirectories ���
{ ImageName
Environment ��F v" _RTL_PERTHREAD_CURDIR .?AU_RTL_PERTHREAD_CURDIR@@ w" � 4 f EtwProviderTraitTypeGroup EtwProviderTraitDecodeGuid ��� EtwProviderTraitTypeMax ��F t y" ETW_PROVIDER_TRAIT_TYPE .?AW4ETW_PROVIDER_TRAIT_TYPE@@ � z" U � � FEEDBACK_TOUCH_CONTACTVISUALIZATION �� FEEDBACK_PEN_BARRELVISUALIZATION � FEEDBACK_PEN_TAP � FEEDBACK_PEN_DOUBLETAP ��� FEEDBACK_PEN_PRESSANDHOLD FEEDBACK_PEN_RIGHTTAP FEEDBACK_TOUCH_TAP ��� FEEDBACK_TOUCH_DOUBLETAP � FEEDBACK_TOUCH_PRESSANDHOLD ��
FEEDBACK_TOUCH_RIGHTTAP �� FEEDBACK_GESTURE_PRESSANDTAP � ��FEEDBACK_MAX : t |" tagFEEDBACK_TYPE .?AW4tagFEEDBACK_TYPE@@ ��� }" ~ R Z � _JOBOBJECT_IO_ATTRIBUTION_STATS .?AU_JOBOBJECT_IO_ATTRIBUTION_STATS@@
"
� z
" IoCount ��
# TotalNonOverlappedQueueTime ��
# TotalNonOverlappedServiceTime
# TotalSize Z �" _JOBOBJECT_IO_ATTRIBUTION_STATS .?AU_JOBOBJECT_IO_ATTRIBUTION_STATS@@ �" D � : � _JOB_SET_ARRAY .?AU_JOB_SET_ARRAY@@ ��>
JobHandle
" MemberLevel ��
" Flags : �" _JOB_SET_ARRAY .?AU_JOB_SET_ARRAY@@ �� �" D � V � _PERFINFO_SYSCALL_ENTER_DATA .?AU_PERFINFO_SYSCALL_ENTER_DATA@@ ��
SysCallAddr ��V �" _PERFINFO_SYSCALL_ENTER_DATA .?AU_PERFINFO_SYSCALL_ENTER_DATA@@ �� �" b & f � _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY@@
�"
� �
# BeginAddress �
# EndAddress ���
# ExceptionHandler �
# HandlerData ��
# PrologEndAddress �f �" ( _IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA64_RUNTIME_FUNCTION_ENTRY@@ �" � # B � _MOUSE_EVENT_RECORD .?AU_MOUSE_EVENT_RECORD@@ * � _COORD .?AU_COORD@@ ��j
�" dwMousePosition ��
" dwButtonState
" dwControlKeyState
" dwEventFlags �B �" _MOUSE_EVENT_RECORD .?AU_MOUSE_EVENT_RECORD@@ �" � R B � POWER_STATE_HANDLER .?AUPOWER_STATE_HANDLER@@
�"
� $
�"
� �" R �"
�"
� ^
�! Type �
RtcWake ��
, Spare
�" Handler ��
Context ��B �" POWER_STATE_HANDLER .?AUPOWER_STATE_HANDLER@@ �" { - > � tagREGISTERWORDA .?AUtagREGISTERWORDA@@ ��
�"
� *
p lpReading
p lpWord ���> �" tagREGISTERWORDA .?AUtagREGISTERWORDA@@ �� �" � \
�
� � �" �"
�"
� � HiberFileBucket1GB ��� HiberFileBucket2GB ��� HiberFileBucket4GB ��� HiberFileBucket8GB ��� HiberFileBucket16GB �� HiberFileBucket32GB �� HiberFileBucketUnlimited � HiberFileBucketMax ���F t �" _HIBERFILE_BUCKET_SIZE .?AW4_HIBERFILE_BUCKET_SIZE@@ ��� �" { � V � _FILE_ALLOCATION_INFORMATION .?AU_FILE_ALLOCATION_INFORMATION@@ ��
� AllocationSize ���V �" _FILE_ALLOCATION_INFORMATION .?AU_FILE_ALLOCATION_INFORMATION@@ �� �" � � ^ � _ETW_TIMER_EXPIRATION_START_EVENT .?AU_ETW_TIMER_EXPIRATION_START_EVENT@@ :
# InterruptTime
HrTimerExpirationOnly ^ �" _ETW_TIMER_EXPIRATION_START_EVENT .?AU_ETW_TIMER_EXPIRATION_START_EVENT@@ �" b � > � tagACCESSTIMEOUT .?AUtagACCESSTIMEOUT@@ ��
�"
� B
u cbSize ���
" dwFlags ��
" iTimeOutMSec �> �" tagACCESSTIMEOUT .?AUtagACCESSTIMEOUT@@ �� �" ~ �3 R � _FILE_ALIGNMENT_INFORMATION .?AU_FILE_ALIGNMENT_INFORMATION@@
�"
� "
" AlignmentRequirement �R �" _FILE_ALIGNMENT_INFORMATION .?AU_FILE_ALIGNMENT_INFORMATION@@ �" � �
�
� B � tagENUMTEXTMETRICW .?AUtagENUMTEXTMETRICW@@ ��
�"
� B � tagNEWTEXTMETRICEXW .?AUtagNEWTEXTMETRICEXW@@ :
�" etmNewTextMetricEx ���
s d etmAxesList ��B �" �tagENUMTEXTMETRICW .?AUtagENUMTEXTMETRICW@@ �� �" � r
x
y . �" tagPOINT .?AUtagPOINT@@ �� �" s � : WdActionSetTimeoutValue �� WdActionQueryTimeoutValue WdActionResetTimer ��� WdActionStopTimer WdActionStartTimer ��� WdActionSetTriggerAction � WdActionQueryTriggerAction ��� WdActionQueryState ��� WdActionSleep WdActionWake �
WdActionMarkHiberPhase ���J t �" _WATCHDOG_HANDLER_ACTION .?AW4_WATCHDOG_HANDLER_ACTION@@ ��� �" � 2
F � _SECURITY_DESCRIPTOR .?AU_SECURITY_DESCRIPTOR@@ ��
�"
� & � _ACL .?AU_ACL@@ ��
�"
� z
Revision �
Sbz1 �
! Control ��
Owner
Group
�" Sacl �
�" Dacl �F �" _SECURITY_DESCRIPTOR .?AU_SECURITY_DESCRIPTOR@@ �� �" w � J � _PERFINFO_CCSWAP_BUFFER .?AU_PERFINFO_CCSWAP_BUFFER@@
�"
� p " �R
FirstTimeStamp ���
k TidTable �
�" H ThreadBasePriority ���J �" X _PERFINFO_CCSWAP_BUFFER .?AU_PERFINFO_CCSWAP_BUFFER@@ �" b � ^ � _PERFINFO_CC_EXTRA_WB_THREAD_INFO .?AU_PERFINFO_CC_EXTRA_WB_THREAD_INFO@@ �
" ThreadAction �
" ActiveExtraWBThreads �
" TotalDirtyPages ��
" DirtyPageThreshold ���
" AvailablePages ���^ �" _PERFINFO_CC_EXTRA_WB_THREAD_INFO .?AU_PERFINFO_CC_EXTRA_WB_THREAD_INFO@@ �" b V � _PERFINFO_CC_WORKITEM_ENQUEUE .?AU_PERFINFO_CC_WORKITEM_ENQUEUE@@
�"
� �
" WorkItemKey ��
" FileObjectKey
QueueType
WorkItemType �
Requeue ��
Reserved �V �" _PERFINFO_CC_WORKITEM_ENQUEUE .?AU_PERFINFO_CC_WORKITEM_ENQUEUE@@ �" b � b � _MEMORY_PARTITION_NODE_INFORMATION .?AU_MEMORY_PARTITION_NODE_INFORMATION@@ ��
R
� J
" NumaNodeCount
" Flags
�" NodePageInformation ��b �" _MEMORY_PARTITION_NODE_INFORMATION .?AU_MEMORY_PARTITION_NODE_INFORMATION@@ �� �" w � R � _WMI_IMAGEID_INFORMATION32 .?AU_WMI_IMAGEID_INFORMATION32@@ ��z
u ImageBase32 ��
u ImageSize32 ��
" ProcessId
" TimeDateStamp
OriginalFileName �R �" _WMI_IMAGEID_INFORMATION32 .?AU_WMI_IMAGEID_INFORMATION32@@ �� �" b � N � _PROCESS_LEAP_SECOND_INFO .?AU_PROCESS_LEAP_SECOND_INFO@@ &
" Flags
" Reserved �N �" _PROCESS_LEAP_SECOND_INFO .?AU_PROCESS_LEAP_SECOND_INFO@@ �" � � F � _KEY_FULL_INFORMATION .?AU_KEY_FULL_INFORMATION@@
�"
�
� LastWriteTime
" TitleIndex ���
" ClassOffset ��
" ClassLength ��
" SubKeys ��
" MaxNameLen ���
" MaxClassLen ��
" Values ���
" $ MaxValueNameLen ��
" ( MaxValueDataLen ��
, Class F �" 0 _KEY_FULL_INFORMATION .?AU_KEY_FULL_INFORMATION@@ �" � J � _ETW_OBJECT_TYPE_EVENT .?AU_ETW_OBJECT_TYPE_EVENT@@ ��>
! ObjectType ���
! Reserved �
Name �J �" _ETW_OBJECT_TYPE_EVENT .?AU_ETW_OBJECT_TYPE_EVENT@@ �� �" b c
2 � tagEVENTMSG .?AUtagEVENTMSG@@ ^
u message ��
u paramL ���
u paramH ���
" time �
� hwnd �2 �" tagEVENTMSG .?AUtagEVENTMSG@@ �" ~ !
� F
lfHeight �
lfWidth ��
lfEscapement �
lfOrientation
lfWeight �
lfItalic �
lfUnderline ��
lfStrikeOut ��
lfCharSet
lfOutPrecision ���
lfClipPrecision ��
lfQuality
lfPitchAndFamily �
lfFaceName ���2 �" \ tagLOGFONTW .?AUtagLOGFONTW@@ �" � � V � _HEAP_AFINITY_MANAGER_ENABLE .?AU_HEAP_AFINITY_MANAGER_ENABLE@@ ��F
m Header ���
HeapHandle ���
" $ BucketIndex ��V # ( _HEAP_AFINITY_MANAGER_ENABLE .?AU_HEAP_AFINITY_MANAGER_ENABLE@@ �� # b g J � _POWER_SESSION_TIMEOUTS .?AU_POWER_SESSION_TIMEOUTS@@
#
� 6
" InputTimeout �
" DisplayTimeout ���J # _POWER_SESSION_TIMEOUTS .?AU_POWER_SESSION_TIMEOUTS@@ # { �
�
� J � tagEMREXTSELECTCLIPRGN .?AUtagEMREXTSELECTCLIPRGN@@ ��J
� emr ��
" cbRgnData
" iMode
� RgnData ��J
# tagEMREXTSELECTCLIPRGN .?AUtagEMREXTSELECTCLIPRGN@@ �� # � � B � tagEMRSETMITERLIMIT .?AUtagEMRSETMITERLIMIT@@ *
� emr ��
@ eMiterLimit ��B # tagEMRSETMITERLIMIT .?AUtagEMRSETMITERLIMIT@@ # � q R � _WMI_IMAGEID_INFORMATION64 .?AU_WMI_IMAGEID_INFORMATION64@@ ��z
# ImageBase64 ��
# ImageSize64 ��
" ProcessId
" TimeDateStamp
OriginalFileName �R # _WMI_IMAGEID_INFORMATION64 .?AU_WMI_IMAGEID_INFORMATION64@@ �� # b � J � _CSV_QUERY_MDS_PATH_V2 .?AU_CSV_QUERY_MDS_PATH_V2@@ �� CsvFsDiskConnectivityNone CsvFsDiskConnectivityMdsNodeOnly � CsvFsDiskConnectivitySubsetOfNodes ��� CsvFsDiskConnectivityAllNodes J t # _CSVFS_DISK_CONNECTIVITY .?AW4_CSVFS_DISK_CONNECTIVITY@@ ��� # � � �
Version ��
" RequiredSize �
" MdsNodeId
" DsNodeId �
" Flags
# DiskConnectivity �
$ VolumeId �
" , IpAddressOffset ��
" 0 IpAddressLength ��
" 4 PathOffset ���
" 8 PathLength ���J # @ _CSV_QUERY_MDS_PATH_V2 .?AU_CSV_QUERY_MDS_PATH_V2@@ �� # � � 6 � _TOKEN_ORIGIN .?AU_TOKEN_ORIGIN@@ &
� OriginatingLogonSession ��6 # _TOKEN_ORIGIN .?AU_TOKEN_ORIGIN@@ # w ^ ��ConfigurationSpaceUndefined � Cmos � EisaConfiguration Pos �� CbusConfiguration PCIConfiguration � VMEConfiguration � NuBusConfiguration ��� PCMCIAConfiguration �� MPIConfiguration � MPSAConfiguration
PNPISAConfiguration �� SgiInternalConfiguration � MaximumBusDataType ���6 t # _BUS_DATA_TYPE .?AW4_BUS_DATA_TYPE@@ ��� !# � �+
!#
� B � _MEMORY_RANGE_ENTRY .?AU_MEMORY_RANGE_ENTRY@@ 6
VirtualAddress ���
" NumberOfBytes B %# _MEMORY_RANGE_ENTRY .?AU_MEMORY_RANGE_ENTRY@@ &# � � : � tagCWPRETSTRUCT .?AUtagCWPRETSTRUCT@@
(#
� b
lResult ��
lParam ���
u wParam ���
u message ��
� hwnd �: *# tagCWPRETSTRUCT .?AUtagCWPRETSTRUCT@@ +# ~ 9 v � _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION .?AU_TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION@@ ��&
� SuperiorEnlistmentPair ���v .# _TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION .?AU_TRANSACTION_SUPERIOR_ENLISTMENT_INFORMATION@@ �� /# � V � _SYSTEM_KERNEL_DEBUGGER_FLAGS .?AU_SYSTEM_KERNEL_DEBUGGER_FLAGS@@ .
KernelDebuggerIgnoreUmExceptions �V 2# _SYSTEM_KERNEL_DEBUGGER_FLAGS .?AU_SYSTEM_KERNEL_DEBUGGER_FLAGS@@ 3# � � J PowerMonitorOff �� PowerMonitorOn ��� PowerMonitorDim ��F t 5# _MONITOR_DISPLAY_STATE .?AW4_MONITOR_DISPLAY_STATE@@ ��� 6# { �
6#
� b � _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER .?AU_ETW_TP_EVENT_TIMER_CANCEL_NTTIMER@@ ��*
m Header ���
SubQueue �b :# $ _ETW_TP_EVENT_TIMER_CANCEL_NTTIMER .?AU_ETW_TP_EVENT_TIMER_CANCEL_NTTIMER@@ �� ;# b / n � _JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2@@ r
" LimitFlags ���
" ViolationLimitFlags ��
# IoReadBytes ��
# IoReadBytesLimit �
# IoWriteBytes �
# IoWriteBytesLimit
� ( PerJobUserTime ���
� 0 PerJobUserTimeLimit ��
# 8 JobMemory
# @ JobLowMemoryLimit
# H JobHighMemoryLimit ���
M P RateControlTolerance �
M T RateControlToleranceLimit n
># X _JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2 .?AU_JOBOBJECT_LIMIT_VIOLATION_INFORMATION_V2@@ ?# � � J � _SE_SECURITY_DESCRIPTOR .?AU_SE_SECURITY_DESCRIPTOR@@ B
" Size �
" Flags
SecurityDescriptor ���J B# _SE_SECURITY_DESCRIPTOR .?AU_SE_SECURITY_DESCRIPTOR@@ C# w � V � _SERVICE_PREFERRED_NODE_INFO .?AU_SERVICE_PREFERRED_NODE_INFO@@ ��
E#
� 2
! usPreferredNode ��
fDelete ��V G# _SERVICE_PREFERRED_NODE_INFO .?AU_SERVICE_PREFERRED_NODE_INFO@@ �� H# � �
� N � _PROCESS_HEAP_INFORMATION .?AU_PROCESS_HEAP_INFORMATION@@
K#
� r
" ReserveSize ��
" CommitSize ���
" NumberOfHeaps
" FirstHeapInformationOffset ���N M# _PROCESS_HEAP_INFORMATION .?AU_PROCESS_HEAP_INFORMATION@@ N# � � V � _TEB_ACTIVE_FRAME_CONTEXT_EX .?AU_TEB_ACTIVE_FRAME_CONTEXT_EX@@ ��6
� BasicContext �
Z SourceLocation ���V Q# _TEB_ACTIVE_FRAME_CONTEXT_EX .?AU_TEB_ACTIVE_FRAME_CONTEXT_EX@@ �� R# < � B � _WMI_BUFFER_HEADER .?AU_WMI_BUFFER_HEADER@@ ��
# ��
# =��
T#
� : � _ETW_REF_CLOCK .?AU_ETW_REF_CLOCK@@ ���
" BufferSize ���
" SavedOffset ��
} CurrentOffset
Q ReferenceCount ���
� TimeStamp
SequenceNumber ���
U# ClockType
V# Frequency
[ SlistEntry ���
W# NextBuffer ���
P ( ClientContext
, State
" 0 Offset ���
! 4 BufferFlag ���
! 6 BufferType ���
� 8 Padding1 �
X# 8 ReferenceTime
! 8 GlobalEntry ��
8 Pointer0 �
< Pointer1 �B Y# H _WMI_BUFFER_HEADER .?AU_WMI_BUFFER_HEADER@@ �� Z# b � J � _RPC_SECURITY_QOS_V3_W .?AU_RPC_SECURITY_QOS_V3_W@@ ��
s HttpCredentials ��2 ]# <anonymous-tag> .?AT<anonymous-tag>@@ ^# ^ . �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
^# u
Sid ��J `# _RPC_SECURITY_QOS_V3_W .?AU_RPC_SECURITY_QOS_V3_W@@ �� a# ^ ' J � _RTL_MODULE_BASIC_INFO .?AU_RTL_MODULE_BASIC_INFO@@ ��
c#
�
ImageBase J e# _RTL_MODULE_BASIC_INFO .?AU_RTL_MODULE_BASIC_INFO@@ �� f# � � > � _WMI_TRACE_PACKET .?AU_WMI_TRACE_PACKET@@ F
! Size �
! HookId ���
Type �
Group > i# _WMI_TRACE_PACKET .?AU_WMI_TRACE_PACKET@@ j# b
�
� & DISPLAYCONFIG_SCALING_IDENTITY ��� DISPLAYCONFIG_SCALING_CENTERED ��� DISPLAYCONFIG_SCALING_STRETCHED �� DISPLAYCONFIG_SCALING_ASPECTRATIOCENTEREDMAX � DISPLAYCONFIG_SCALING_CUSTOM � � DISPLAYCONFIG_SCALING_PREFERRED �� ��DISPLAYCONFIG_SCALING_FORCE_UINT32 ��B t m# DISPLAYCONFIG_SCALING .?AW4DISPLAYCONFIG_SCALING@@ � n# � 6 > ProcessMemoryPriority ProcessMemoryExhaustionInfo �� ProcessAppMemoryInfo � ProcessInPrivateInfo � ProcessPowerThrottling ��� ProcessReservedValue1 ProcessTelemetryCoverageInfo � ProcessProtectionLevelInfo ��� ProcessLeapSecondInfo ProcessInformationClassMax ���N
t p# _PROCESS_INFORMATION_CLASS .?AW4_PROCESS_INFORMATION_CLASS@@ ��� q# � � � � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION@@ �� � " 0 �:
# OverallChangeStamp ���
t# Descriptors �� u# 8 _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_INFORMATION@@ �� v# � � 6 � _MUICCHEADER .?AU_MUICCHEADER@@ ���
u ulMaxStringsSize �
u ulSizeStrings
u ulMaxNumInstalledCultures
u ulNumInstalledCultures ���
u ulMaxNumUnverifiedCultures ���
u ulNumUnverifiedCultures ��6 y# _MUICCHEADER .?AU_MUICCHEADER@@ �� z# j � _EVENT_TRACE_PROFILE_REMOVE_INFORMATION .?AU_EVENT_TRACE_PROFILE_REMOVE_INFORMATION@@ ^
? EventTraceInformationClass ���
J ProfileSource
� CpuInfoHierarchy �j }# _EVENT_TRACE_PROFILE_REMOVE_INFORMATION .?AU_EVENT_TRACE_PROFILE_REMOVE_INFORMATION@@ ~# @ � *
! Linkage ��
" Signature V �# _RTL_DYNAMIC_HASH_TABLE_ENTRY .?AU_RTL_DYNAMIC_HASH_TABLE_ENTRY@@ �# g N � _OBJECT_NAME_INFORMATION .?AU_OBJECT_NAME_INFORMATION@@ ��
�#
�
Name �N �# _OBJECT_NAME_INFORMATION .?AU_OBJECT_NAME_INFORMATION@@ �� �# m N v � _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION .?AU_SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION@@
�#
� ^ � _QUERY_PERFORMANCE_COUNTER_FLAGS .?AU_QUERY_PERFORMANCE_COUNTER_FLAGS@@ ��>
" Version ��
�# Flags
�# ValidFlags ���v �# _SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION .?AU_SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION@@ �# � �
.
� F � _IO_ERROR_LOG_PACKET .?AU_IO_ERROR_LOG_PACKET@@ ��B
MajorFunctionCode
RetryCount ���
! DumpDataSize �
! NumberOfStrings ��
! StringOffset �
! EventCategory
ErrorCode
" UniqueErrorValue �
FinalStatus ��
" SequenceNumber ���
" IoControlCode
� DeviceOffset �
� ( DumpData �F
�# 0 _IO_ERROR_LOG_PACKET .?AU_IO_ERROR_LOG_PACKET@@ ��* onecore\internal\sdk\inc\ntiolog.h � �# �# / J � _RTL_CRITICAL_SECTION32 .?AU_RTL_CRITICAL_SECTION32@@
�#
� �
" DebugInfo
LockCount
RecursionCount ���
" OwningThread �
" LockSemaphore
" SpinCount J �# _RTL_CRITICAL_SECTION32 .?AU_RTL_CRITICAL_SECTION32@@ �# � � ~ HardwareProfileChangeEvent ��� TargetDeviceChangeEvent �� DeviceClassChangeEvent ��� CustomDeviceEvent DeviceInstallEvent ��� DeviceArrivalEvent ��� VetoEvent BlockedDriverEvent ��� InvalidIDEvent ��� DevicePropertyChangeEvent
DeviceInstanceRemovalEvent ��� DeviceInstanceStartedEvent ��� MaxPlugEventCategory �J
t �# _PLUGPLAY_EVENT_CATEGORY .?AW4_PLUGPLAY_EVENT_CATEGORY@@ ��� �# $ / :
! Group
Number ���
Reserved �> �# _PROCESSOR_NUMBER .?AU_PROCESSOR_NUMBER@@ �# J � _FILE_LAYOUT_INFO_ENTRY .?AU_FILE_LAYOUT_INFO_ENTRY@@
�#
� �
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
" FileAttributes ���: �# ( <anonymous-tag> .?AU<anonymous-tag>@@ �# � � v
�# BasicInformation �
" ( OwnerId ��
" , SecurityId ���
0 Usn ��
W 8 StorageReserveId �J �# @ _FILE_LAYOUT_INFO_ENTRY .?AU_FILE_LAYOUT_INFO_ENTRY@@ �# � � b � _PERFINFO_HARDPAGEFAULT_INFORMATION .?AU_PERFINFO_HARDPAGEFAULT_INFORMATION@@
�#
� v
� ReadOffset ���
VirtualAddress ���
FileObject ���
" ThreadId �
" ByteCount b �# _PERFINFO_HARDPAGEFAULT_INFORMATION .?AU_PERFINFO_HARDPAGEFAULT_INFORMATION@@ �# b M ^ � _JOBOBJECT_BASIC_PROCESS_ID_LIST .?AU_JOBOBJECT_BASIC_PROCESS_ID_LIST@@ ��
�#
� " " �b
" NumberOfAssignedProcesses
" NumberOfProcessIdsInList �
�# ProcessIdList ^ �# _JOBOBJECT_BASIC_PROCESS_ID_LIST .?AU_JOBOBJECT_BASIC_PROCESS_ID_LIST@@ �� �# D � B � tagWNODE_TOO_SMALL .?AUtagWNODE_TOO_SMALL@@ ��
�#
� 2
� WnodeHeader ��
" 0 SizeNeeded ���B �# 8 tagWNODE_TOO_SMALL .?AUtagWNODE_TOO_SMALL@@ �� �# � " � QUERY_FILE_LAYOUT_FILTER_TYPE_NONE ��� QUERY_FILE_LAYOUT_FILTER_TYPE_CLUSTERS ��� QUERY_FILE_LAYOUT_FILTER_TYPE_FILEID � QUERY_FILE_LAYOUT_FILTER_TYPE_STORAGE_RESERVE_ID � QUERY_FILE_LAYOUT_NUM_FILTER_TYPES ���V t �# _QUERY_FILE_LAYOUT_FILTER_TYPE .?AW4_QUERY_FILE_LAYOUT_FILTER_TYPE@@ ��� �# � � j PsNeverDuplicate � PsRequestDuplicate ��� PsAlwaysDuplicate PsMaxStdHandleStates �B t �# _PS_STD_HANDLE_STATE .?AW4_PS_STD_HANDLE_STATE@@ ��� �# � F � SeImageSignatureNone � SeImageSignatureEmbedded � SeImageSignatureCache SeImageSignatureCatalogCached SeImageSignatureCatalogNotCached � SeImageSignatureCatalogHint �� SeImageSignaturePackageCatalog ���J t �# _SE_IMAGE_SIGNATURE_TYPE .?AW4_SE_IMAGE_SIGNATURE_TYPE@@ ��� �# w �
> � _VIDEOPARAMETERS .?AU_VIDEOPARAMETERS@@ ��
�#
� 2
$ Guid �
" dwOffset �
" dwCommand
" dwFlags ��
" dwMode ���
" dwTVStandard �
" $ dwAvailableModes �
" ( dwAvailableTVStandard
" , dwFlickerFilter ��
" 0 dwOverScanX ��
" 4 dwOverScanY ��
" 8 dwMaxUnscaledX ���
" < dwMaxUnscaledY ���
" @ dwPositionX ��
" D dwPositionY ��
" H dwBrightness �
" L dwContrast ���
" P dwCPType �
" T dwCPCommand ��
" X dwCPStandard �
" \ dwCPKey ��
" ` bCP_APSTriggerBits ���
d bOEMCopyProtection ���> �# d_VIDEOPARAMETERS .?AU_VIDEOPARAMETERS@@ ��* onecore\external\shared\inc\tvout.h �# �# V IMPORT_OBJECT_CODE ��� IMPORT_OBJECT_DATA ��� IMPORT_OBJECT_CONST ��> t �# IMPORT_OBJECT_TYPE .?AW4IMPORT_OBJECT_TYPE@@ ��� �# � �
�"
� > � _SYSDBG_IO_SPACE .?AU_SYSDBG_IO_SPACE@@ ��
# Address ��
Buffer ���
" Request ��
� InterfaceType
" BusNumber
" AddressSpace �> �# _SYSDBG_IO_SPACE .?AU_SYSDBG_IO_SPACE@@ �� �# � V � STARTING_LCN_INPUT_BUFFER_EX .?AUSTARTING_LCN_INPUT_BUFFER_EX@@ ��
�#
� *
� StartingLcn ��
" Flags V �# STARTING_LCN_INPUT_BUFFER_EX .?AUSTARTING_LCN_INPUT_BUFFER_EX@@ �� �# � ;
R � _SECURITY_OBJECT_AI_PARAMS .?AU_SECURITY_OBJECT_AI_PARAMS@@ ��.
" Size �
" ConstraintMask ���R �# _SECURITY_OBJECT_AI_PARAMS .?AU_SECURITY_OBJECT_AI_PARAMS@@ �� �# w J � _RTL_CONDITION_VARIABLE .?AU_RTL_CONDITION_VARIABLE@@
�#
�
" ��
" ��J
�# WakeCount
�# Waking ���
" Value
Ptr ��J �# _RTL_CONDITION_VARIABLE .?AU_RTL_CONDITION_VARIABLE@@ �# � <
�
� B � _IMAGE_POLICY_ENTRY .?AU_IMAGE_POLICY_ENTRY@@
�# ��
�#
� �# �# �#
�#
� J � _REPARSE_DATA_BUFFER_EX .?AU_REPARSE_DATA_BUFFER_EX@@ N � _REPARSE_GUID_DATA_BUFFER .?AU_REPARSE_GUID_DATA_BUFFER@@ �
" Flags
" ExistingReparseTag ���
$ ExistingReparseGuid ��
# Reserved �
� ReparseDataBuffer
�# ReparseGuidDataBuffer J �# @ _REPARSE_DATA_BUFFER_EX .?AU_REPARSE_DATA_BUFFER_EX@@ �# � C&
#
� B � _IO_STATUS_BLOCK32 .?AU_IO_STATUS_BLOCK32@@ ��.
Status ���
" Information ��B �# _IO_STATUS_BLOCK32 .?AU_IO_STATUS_BLOCK32@@ �� �# � � > � tagNEWTEXTMETRICW .?AUtagNEWTEXTMETRICW@@
�#
� F
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
q , tmFirstChar ��
q . tmLastChar ���
q 0 tmDefaultChar
q 2 tmBreakChar ��
4 tmItalic �
5 tmUnderlined �
6 tmStruckOut ��
7 tmPitchAndFamily �
8 tmCharSet
" < ntmFlags �
u @ ntmSizeEM
u D ntmCellHeight
u H ntmAvgWidth ��> �# L tagNEWTEXTMETRICW .?AUtagNEWTEXTMETRICW@@ �# � �
�
� >
" LowPart ��
High1Time
High2Time 6 �# _KSYSTEM_TIME .?AU_KSYSTEM_TIME@@ �# K /
p
� F � _ENUM_SERVICE_STATUSA .?AU_ENUM_SERVICE_STATUSA@@
�#
� J
p lpServiceName
p lpDisplayName
� ServiceStatus F �# $ _ENUM_SERVICE_STATUSA .?AU_ENUM_SERVICE_STATUSA@@ �# � � 6 � tagWINDOWINFO .?AUtagWINDOWINFO@@ �
" cbSize ���
rcWindow �
rcClient �
" $ dwStyle ��
" ( dwExStyle
" , dwWindowStatus ���
u 0 cxWindowBorders ��
u 4 cyWindowBorders ��
! 8 atomWindowType ���
! : wCreatorVersion ��6
�# < tagWINDOWINFO .?AUtagWINDOWINFO@@ $ ~ �8 r � _PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION .?AU_PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION@@ 6
DynamicFunctionTable �
Remove ���r $ _PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION .?AU_PROCESS_DYNAMIC_FUNCTION_TABLE_INFORMATION@@ $ � N B � _TOKEN_DEFAULT_DACL .?AU_TOKEN_DEFAULT_DACL@@
�" DefaultDacl ��B $ _TOKEN_DEFAULT_DACL .?AU_TOKEN_DEFAULT_DACL@@ $ w � " $
$
�
�
�
�
� B WorkerFactoryTimeout � WorkerFactoryRetryTimeout WorkerFactoryIdleTimeout � WorkerFactoryBindingCount WorkerFactoryThreadMinimum ��� WorkerFactoryThreadMaximum ��� WorkerFactoryPaused �� WorkerFactoryBasicInformation WorkerFactoryAdjustThreadGoal WorkerFactoryCallbackType
WorkerFactoryStackInformation WorkerFactoryThreadBasePriority �� WorkerFactoryTimeoutWaiters ��
WorkerFactoryFlags ��� WorkerFactoryThreadSoftMaximum ��� WorkerFactoryThreadCpuSets ��� MaxWorkerFactoryInfoClass F t $ _WORKERFACTORYINFOCLASS .?AW4_WORKERFACTORYINFOCLASS@@ � $ � � ResponseReturnToCaller ��� ResponseNotHandled ��� ResponseAbort ResponseCancel ��� ResponseIgnore ��� ResponseNo ��� ResponseOk ��� ResponseRetry ResponseYes �� ResponseTryAgain �
ResponseContinue �> t $ _HARDERROR_RESPONSE .?AW4_HARDERROR_RESPONSE@@ � $ � � B � tagLOCALESIGNATURE .?AUtagLOCALESIGNATURE@@ ��
$
� " " � " " �F
$ lsUsb
$ lsCsbDefault �
$ lsCsbSupported ���B $ tagLOCALESIGNATURE .?AUtagLOCALESIGNATURE@@ �� $ � � � MemoryNotContiguous �� MemoryAlignedAndContiguous ��� MemoryNotResident MemoryNotEligibleToMakeContiguous MemoryContiguityStateMax �f t $ _MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE .?AW4_MEMORY_PHYSICAL_CONTIGUITY_UNIT_STATE@@ ��� $ w � R DCDC_DEFAULT � DCDC_DISABLE_FONT_UPDATE � DCDC_DISABLE_RELAYOUT ^ t $ DIALOG_CONTROL_DPI_CHANGE_BEHAVIORS .?AW4DIALOG_CONTROL_DPI_CHANGE_BEHAVIORS@@ � $ ~ � N � _SERVICE_TIMECHANGE_INFO .?AU_SERVICE_TIMECHANGE_INFO@@ ��*
� liNewTime
� liOldTime N "$ _SERVICE_TIMECHANGE_INFO .?AU_SERVICE_TIMECHANGE_INFO@@ �� #$ � � 6 � tagCURSORINFO .?AUtagCURSORINFO@@ * � HICON__ .?AUHICON__@@
&$
� R
" cbSize ���
" flags
'$ hCursor ��
� ptScreenPos ��6 ($ tagCURSORINFO .?AUtagCURSORINFO@@ )$ ~ �8 � DISPLAYCONFIG_ROTATION_IDENTITY �� DISPLAYCONFIG_ROTATION_ROTATE90 �� DISPLAYCONFIG_ROTATION_ROTATE180 � DISPLAYCONFIG_ROTATION_ROTATE270 � ��DISPLAYCONFIG_ROTATION_FORCE_UINT32 �F t +$ DISPLAYCONFIG_ROTATION .?AW4DISPLAYCONFIG_ROTATION@@ ��� ,$ � A j � _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 .?AU_KEY_VALUE_PARTIAL_INFORMATION_ALIGN64@@ ��
.$
� :
" Type �
" DataLength ���
� Data �j 0$ _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 .?AU_KEY_VALUE_PARTIAL_INFORMATION_ALIGN64@@ �� 1$ ` TimerBasicInformation J t 3$ _TIMER_INFORMATION_CLASS .?AW4_TIMER_INFORMATION_CLASS@@ ��� 4$ � � N � _FSCTL_UNMAP_SPACE_OUTPUT .?AU_FSCTL_UNMAP_SPACE_OUTPUT@@
� BytesUnmapped N 7$ _FSCTL_UNMAP_SPACE_OUTPUT .?AU_FSCTL_UNMAP_SPACE_OUTPUT@@ 8$ � �* Z � _ETW_TP_EVENT_CALLBACK_ENQUEUE .?AU_ETW_TP_EVENT_CALLBACK_ENQUEUE@@ ��
:$
� ~
m Header ���
PoolId ���
$ TaskId ���
( Callback �
, Context ��
0 SubProcessTag Z <$ 8 _ETW_TP_EVENT_CALLBACK_ENQUEUE .?AU_ETW_TP_EVENT_CALLBACK_ENQUEUE@@ �� =$ b � ^ � _SYSTEM_DPC_BEHAVIOR_INFORMATION .?AU_SYSTEM_DPC_BEHAVIOR_INFORMATION@@ ��~
" Spare
" DpcQueueDepth
" MinimumDpcRate ���
" AdjustDpcThreshold ���
" IdealDpcRate �^ @$ _SYSTEM_DPC_BEHAVIOR_INFORMATION .?AU_SYSTEM_DPC_BEHAVIOR_INFORMATION@@ �� A$ � �
U
� B
" NodeNumber ���
� Reserved �
" GroupMask J D$ $ _NUMA_NODE_RELATIONSHIP .?AU_NUMA_NODE_RELATIONSHIP@@ E$ � % N � _POOLED_USAGE_AND_LIMITS .?AU_POOLED_USAGE_AND_LIMITS@@ ��
" PeakPagedPoolUsage ���
" PagedPoolUsage ���
" PagedPoolLimit ���
" PeakNonPagedPoolUsage
" NonPagedPoolUsage
" NonPagedPoolLimit
" PeakPagefileUsage
" PagefileUsage
" PagefileLimit N H$ $ _POOLED_USAGE_AND_LIMITS .?AU_POOLED_USAGE_AND_LIMITS@@ �� I$ D l 6 � _ETW_UMGL_KEY .?AU_ETW_UMGL_KEY@@ &
LoggerId �
Flags 6 L$ _ETW_UMGL_KEY .?AU_ETW_UMGL_KEY@@ M$ @ R R � _PERFINFO_CC_CAN_WRITE_FAIL .?AU_PERFINFO_CC_CAN_WRITE_FAIL@@ n
" FileObjectKey
" TotalDirtyPages ��
" DirtyPageThreshold ���
" BytesToWrite �R P$ _PERFINFO_CC_CAN_WRITE_FAIL .?AU_PERFINFO_CC_CAN_WRITE_FAIL@@ Q$ b � V � _ETW_TP_EVENT_POOL_TH_MAX_SET .?AU_ETW_TP_EVENT_POOL_TH_MAX_SET@@ >
m Header ���
PoolId ���
" $ ThreadNum V T$ ( _ETW_TP_EVENT_POOL_TH_MAX_SET .?AU_ETW_TP_EVENT_POOL_TH_MAX_SET@@ U$ b � " P ��
" ControlWord ��
" StatusWord ���
" TagWord ��
" ErrorOffset ��
" ErrorSelector
" DataOffset ���
" DataSelector �
W$ RegisterArea �
" l Cr0NpxState ��N X$ p _WOW64_FLOATING_SAVE_AREA .?AU_WOW64_FLOATING_SAVE_AREA@@ Y$ � B V � _PERFINFO_PPM_STATE_SELECTION .?AU_PERFINFO_PPM_STATE_SELECTION@@
[$
� J
" SelectedState
" VetoedStates �
� VetoReason ���V ]$ _PERFINFO_PPM_STATE_SELECTION .?AU_PERFINFO_PPM_STATE_SELECTION@@ ^$ b ,
d
� "
cx ���
cy ���* a$ tagSIZE .?AUtagSIZE@@ b$ s � J � _RTL_SPARSE_BITMAP_RUN .?AU_RTL_SPARSE_BITMAP_RUN@@ ��
d$
� b
" StartingIndexLow �
" StartingIndexHigh
" Length ���
Metadata �J f$ _RTL_SPARSE_BITMAP_RUN .?AU_RTL_SPARSE_BITMAP_RUN@@ �� g$ �
�
� R � IMAGE_AUX_SYMBOL_TOKEN_DEF .?AUIMAGE_AUX_SYMBOL_TOKEN_DEF@@ ��
j$ ��
k$
� ^
bAuxType �
bReserved
" SymbolTableIndex �
p rgbReserved ��R m$ IMAGE_AUX_SYMBOL_TOKEN_DEF .?AUIMAGE_AUX_SYMBOL_TOKEN_DEF@@ �� n$ � J � _RTL_RETPOLINE_ROUTINES .?AU_RTL_RETPOLINE_ROUTINES@@ �
" UnwindDataOffset �
k SwitchtableJump ��
" D CfgIndirectRax ���
" H NonCfgIndirectRax
" L ImportR10 J q$ P _RTL_RETPOLINE_ROUTINES .?AU_RTL_RETPOLINE_ROUTINES@@ r$ X J � _REG_NOTIFY_INFORMATION .?AU_REG_NOTIFY_INFORMATION@@ : KeyAdded � KeyRemoved ��� KeyModified ��. t u$ _REG_ACTION .?AW4_REG_ACTION@@ � v$ � b V
" NextEntryOffset ��
v$ Action ���
" KeyLength
Key ��J x$ _REG_NOTIFY_INFORMATION .?AU_REG_NOTIFY_INFORMATION@@ y$ � h N LowMemoryResourceNotification HighMemoryResourceNotification ���^ t {$ _MEMORY_RESOURCE_NOTIFICATION_TYPE .?AW4_MEMORY_RESOURCE_NOTIFICATION_TYPE@@ ��� |$ � � F � _RTL_DISK_SPACE_INFO .?AU_RTL_DISK_SPACE_INFO@@ ��
~$
� � RtlDiskSpacePolicyVeryLow
RtlDiskSpacePolicyLow RtlDiskSpacePolicyBelowNormal RtlDiskSpacePolicyNormal �B t �$ RTL_DISK_SPACE_POLICY .?AW4RTL_DISK_SPACE_POLICY@@ � �$ '
�$ Policy ���F �$ _RTL_DISK_SPACE_INFO .?AU_RTL_DISK_SPACE_INFO@@ �� �$ . ^ � _ETW_PARTITION_INFO_EXTENSION_V2 .?AU_ETW_PARTITION_INFO_EXTENSION_V2@@ ��b
! EventVersion �
! Reserved �
" PartitionType
� QpcOffsetFromRoot ^ �$ _ETW_PARTITION_INFO_EXTENSION_V2 .?AU_ETW_PARTITION_INFO_EXTENSION_V2@@ �� �$ @ � 6 � tagSTYLEBUFA .?AUtagSTYLEBUFA@@ ��.
" dwStyle ��
o" szDescription 6 �$ $ tagSTYLEBUFA .?AUtagSTYLEBUFA@@ �� �$ � � � RtlRXactOperationDelete �� RtlRXactOperationSetValue RtlRXactOperationDelAttribute RtlRXactOperationSetAttribute B t �$ _RTL_RXACT_OPERATION .?AW4_RTL_RXACT_OPERATION@@ ��� �$ � � j MonitorRequestTypeOff MonitorRequestTypeOnAndPresent ��� MonitorRequestTypeToggleOn ���N t �$ _POWER_MONITOR_REQUEST_TYPE .?AW4_POWER_MONITOR_REQUEST_TYPE@@ � �$ { N J � _CI_LOG_SCHEDULER_EVENT .?AU_CI_LOG_SCHEDULER_EVENT@@ f
Header ���
" 0 ProcessId
" 4 ThreadId �
" 8 Priority �
" < TaskIndex J �$ @ _CI_LOG_SCHEDULER_EVENT .?AU_CI_LOG_SCHEDULER_EVENT@@ �$ b B 2 � _WOW64INFO .?AU_WOW64INFO@@ ��V � _ETW_COVERAGE_SAMPLER_OPTIONS .?AU_ETW_COVERAGE_SAMPLER_OPTIONS@@ q " �
6 Flags
" HashSeed �
" ImageLruSize �
" SampleTableMinEntries
" SampleTableMaxEntries
" SampleTableMaxQueued �
" SampleBufferSize �
" SampleBufferMaxCountPerProc ��
" CaptureBufferMaxCountPerProc �
" $ ApcMaxCountPerProc ���
" ( ProfileSamplePeriodUS
" , ProfileSampleCountPerPeriod ��
" 0 CSwitchSamplePeriodUS
" 4 CSwitchSampleCountPerPeriod ��
" 8 RThreadSamplePeriodUS
" < RThreadSampleCountPerPeriod ��
" @ PGFaultSamplePeriodUS
" D PGFaultSampleCountPerPeriod ��
" H StackDepth ���
" L StackCacheEntries
�$ P PathInclusionList
�$ PPathExclusionList V �$ P_ETW_COVERAGE_SAMPLER_OPTIONS .?AU_ETW_COVERAGE_SAMPLER_OPTIONS@@ �$ @
�"
� . � __n128x4 .?AU__n128x4@@ �� \ " @ �
�$ val ��. �$ @ __n128x4 .?AU__n128x4@@ �� �$ % j F � _WMI_DELAY_EXECUTION .?AU_WMI_DELAY_EXECUTION@@ ��&
" ThreadId �
# Delta F �$ _WMI_DELAY_EXECUTION .?AU_WMI_DELAY_EXECUTION@@ �� �$ b �
�
� Z � _ALPC_PORT_CALLBACK_INFORMATION .?AU_ALPC_PORT_CALLBACK_INFORMATION@@ 2
CallbackObject ���
Context ��Z �$ _ALPC_PORT_CALLBACK_INFORMATION .?AU_ALPC_PORT_CALLBACK_INFORMATION@@ �$ � , . � tagEMREOF .?AUtagEMREOF@@ V
� emr ��
" nPalEntries ��
" offPalEntries
" nSizeLast . �$ tagEMREOF .?AUtagEMREOF@@ �$ � �
&
� N � _TOKEN_ACCESS_INFORMATION .?AU_TOKEN_ACCESS_INFORMATION@@
U
� > � _TOKEN_PRIVILEGES .?AU_TOKEN_PRIVILEGES@@
�$
� 2 TokenPrimary � TokenImpersonation ���. t �$ _TOKEN_TYPE .?AW4_TOKEN_TYPE@@ � �$ w ! R
�$ SidHash ��
�$ RestrictedSidHash
�$ Privileges ���
� AuthenticationId �
�$ TokenType
� ImpersonationLevel ���
� MandatoryPolicy ��
" Flags
" $ AppContainerNumber ���
( PackageSid ���
�$ , CapabilitiesHash �
0 TrustLevelSid
4 SecurityAttributes ���N
�$ 8 _TOKEN_ACCESS_INFORMATION .?AU_TOKEN_ACCESS_INFORMATION@@ �$ w � � KeyValueBasicInformation � KeyValueFullInformation �� KeyValuePartialInformation ��� KeyValueFullInformationAlign64 ��� KeyValuePartialInformationAlign64 KeyValueLayerInformation � MaxKeyValueInfoClass �R t �$ _KEY_VALUE_INFORMATION_CLASS .?AW4_KEY_VALUE_INFORMATION_CLASS@@ ��� �$ r : � _RTL_AVL_TABLE .?AU_RTL_AVL_TABLE@@ ��
�$
� B � _RTL_BALANCED_LINKS .?AU_RTL_BALANCED_LINKS@@
�$
� J GenericLessThan �� GenericGreaterThan ��� GenericEqual �R t �$ _RTL_GENERIC_COMPARE_RESULTS .?AW4_RTL_GENERIC_COMPARE_RESULTS@@ ��� �$ g O
�$
� �$ �$ �$
�$
� �$ " �$
�$
� �$ �$
�$
� .
�$ BalancedRoot �
OrderedPointer ���
" WhichOrderedElement ��
" NumberGenericTableElements ���
" DepthOfTree ��
�$ RestartKey ���
" $ DeleteCount ��
�$ ( CompareRoutine ���
�$ , AllocateRoutine ��
�$ 0 FreeRoutine ��
4 TableContext �: �$ 8 _RTL_AVL_TABLE .?AU_RTL_AVL_TABLE@@ �� �$ g � � ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_OTHER ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HD15 � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SVIDEO ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPOSITE_VIDEO �� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_COMPONENT_VIDEO �� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DVI �� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_HDMI � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_LVDS � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_D_JPN DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDI ��
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EXTERNAL � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_DISPLAYPORT_EMBEDDED � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EXTERNAL �
DISPLAYCONFIG_OUTPUT_TECHNOLOGY_UDI_EMBEDDED � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_SDTVDONGLE ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_MIRACAST � DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_WIRED ��� DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INDIRECT_VIRTUAL � � �DISPLAYCONFIG_OUTPUT_TECHNOLOGY_INTERNAL � ��DISPLAYCONFIG_OUTPUT_TECHNOLOGY_FORCE_UINT32 b t �$ DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY .?AW4DISPLAYCONFIG_VIDEO_OUTPUT_TECHNOLOGY@@ � �$ � �
�
�
� F � _RTL_DISK_SPEED_INFO .?AU_RTL_DISK_SPEED_INFO@@ ��B
RtlDiskSpeedPolicyNormal � RtlDiskSpeedPolicyFast ���B t �$ RTL_DISK_SPEED_POLICY .?AW4RTL_DISK_SPEED_POLICY@@ � �$
�$ Policy ���F �$ _RTL_DISK_SPEED_INFO .?AU_RTL_DISK_SPEED_INFO@@ �� �$ # � NotAppContainerSidType ��� ChildAppContainerSidType � ParentAppContainerSidType InvalidAppContainerSidType ��� MaxAppContainerSidType ���F t �$ _APPCONTAINER_SID_TYPE .?AW4_APPCONTAINER_SID_TYPE@@ ��� �$ g �" ^ � _IO_COMPLETION_BASIC_INFORMATION .?AU_IO_COMPLETION_BASIC_INFORMATION@@ ��
Depth ^ �$ _IO_COMPLETION_BASIC_INFORMATION .?AU_IO_COMPLETION_BASIC_INFORMATION@@ �� �$ 7! C J � RETRIEVAL_POINTER_COUNT .?AURETRIEVAL_POINTER_COUNT@@
" ExtentCount ��J �$ RETRIEVAL_POINTER_COUNT .?AURETRIEVAL_POINTER_COUNT@@ �$ � �
J � _ETW_READY_THREAD_EVENT .?AU_ETW_READY_THREAD_EVENT@@
��
��
��
��
��
" ThreadId �
AdjustReason �
p AdjustIncrement ��
�$ ExecutingDpc �
�$ KernelStackNotResident ���
�$ ProcessOutOfMemory ���
�$ DirectSwitchAttempt ��
�$ Reserved �
Flags
SpareByte J
�$ _ETW_READY_THREAD_EVENT .?AU_ETW_READY_THREAD_EVENT@@ �$ b �
A"
�
<
� *
C As32Bit ��
! As64Bit ��B �$ � _PEBS_DS_SAVE_AREA .?AU_PEBS_DS_SAVE_AREA@@ �� �$ � � � PsWakeReasonUser � PsWakeReasonExecutionRequired PsWakeReasonKernel ��� PsWakeReasonInstrumentation �� PsWakeReasonPreserveProcess �� PsWakeReasonActivityReference PsWakeReasonWorkOnBehalf � PsMaxWakeReasons �6 t �$ _PS_WAKE_REASON .?AW4_PS_WAKE_REASON@@ � �$ � ^ � _ETW_COVERAGE_SAMPLER_CREATE_INFO .?AU_ETW_COVERAGE_SAMPLER_CREATE_INFO@@
�$
� b � _ETW_COVERAGE_SAMPLER_BLOOM_FILTER .?AU_ETW_COVERAGE_SAMPLER_BLOOM_FILTER@@ ��V
Common ���
�$ Options ��
�$ `Bloom
# xSamplesReadyEvent ^ �$ �_ETW_COVERAGE_SAMPLER_CREATE_INFO .?AU_ETW_COVERAGE_SAMPLER_CREATE_INFO@@ �$ @
�
� . � tagEMRARC .?AUtagEMRARC@@ N
� emr ��
c rclBox ���
� ptlStart �
� ptlEnd ���. % ( tagEMRARC .?AUtagEMRARC@@ % � % : � _GRADIENT_RECT .?AU_GRADIENT_RECT@@ ��.
" UpperLeft
" LowerRight ���: % _GRADIENT_RECT .?AU_GRADIENT_RECT@@ �� % � : ~ Width8Bits ��� Width16Bits �� Width32Bits �� Width64Bits �� WidthNoWrap �� MaximumDmaWidth ��. t
% _DMA_WIDTH .?AW4_DMA_WIDTH@@ ��� % � �+
%
� ^ � _FILE_PIPE_CLIENT_PROCESS_BUFFER .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER@@ ��
%
� 2
ClientSession
ClientProcess ^ % _FILE_PIPE_CLIENT_PROCESS_BUFFER .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER@@ �� % � 1) J � _HEAP_RANGE_INFORMATION .?AU_HEAP_RANGE_INFORMATION@@ �
" Address ��
" Size �
" Type �
" Protection ���
" FirstBlockInformationOffset ��
" NextRangeInformationOffset ���J % _HEAP_RANGE_INFORMATION .?AU_HEAP_RANGE_INFORMATION@@ % � � f � _HEAP_OPTIMIZE_RESOURCES_INFORMATION .?AU_HEAP_OPTIMIZE_RESOURCES_INFORMATION@@ ��
%
� &
" Version ��
" Flags f % _HEAP_OPTIMIZE_RESOURCES_INFORMATION .?AU_HEAP_OPTIMIZE_RESOURCES_INFORMATION@@ �� % � | Z � _PROCESS_ENERGY_TRACKING_STATE .?AU_PROCESS_ENERGY_TRACKING_STATE@@ ��
" ��v
" StateUpdateMask ��
" StateDesiredValue
" StateSequence
% UpdateTag
Tag ��Z % � _PROCESS_ENERGY_TRACKING_STATE .?AU_PROCESS_ENERGY_TRACKING_STATE@@ �� % � p Z � _SERVICE_LAUNCH_PROTECTED_INFO .?AU_SERVICE_LAUNCH_PROTECTED_INFO@@ ��
!%
�
" dwLaunchProtected Z #% _SERVICE_LAUNCH_PROTECTED_INFO .?AU_SERVICE_LAUNCH_PROTECTED_INFO@@ �� $% � � R � _FILE_NUMA_NODE_INFORMATION .?AU_FILE_NUMA_NODE_INFORMATION@@
! NodeNumber ���R '% _FILE_NUMA_NODE_INFORMATION .?AU_FILE_NUMA_NODE_INFORMATION@@ (% �
� MemoryTypePaged �� MemoryTypeNonPaged ��� MemoryTypeLargePage �� MemoryTypeHugePage ��� MemoryTypeMax : t *% _RTL_MEMORY_TYPE .?AW4_RTL_MEMORY_TYPE@@ ��� +% g �
V � _NDR_CS_SIZE_CONVERT_ROUTINES .?AU_NDR_CS_SIZE_CONVERT_ROUTINES@@ Z IDL_CS_NO_CONVERT IDL_CS_IN_PLACE_CONVERT �� IDL_CS_NEW_BUFFER_CONVERT 6 t .% _IDL_CS_CONVERT .?AW4_IDL_CS_CONVERT@@ � /% � �
/%
� " " 1% " " 2%
3%
�
l"
�
3%
� & " " " " " 7%
8%
� b
4% pfnNetSize ���
5% pfnToNetCs ���
6% pfnLocalSize �
9% pfnFromNetCs �V :% _NDR_CS_SIZE_CONVERT_ROUTINES .?AU_NDR_CS_SIZE_CONVERT_ROUTINES@@ ;% � � F � _CONSOLE_FONT_INFOEX .?AU_CONSOLE_FONT_INFOEX@@ ��
" cbSize ���
" nFont
�" dwFontSize ���
u FontFamily ���
u FontWeight ���
FaceName �F >% T _CONSOLE_FONT_INFOEX .?AU_CONSOLE_FONT_INFOEX@@ ��6 onecore\external\sdk\inc\mincore\consoleapi3.h � ?% @% B B � _SE_ACCESS_REQUEST .?AU_SE_ACCESS_REQUEST@@ ��
A#
� > � _GENERIC_MAPPING .?AU_GENERIC_MAPPING@@ ��
D%
� > � _OBJECT_TYPE_LIST .?AU_OBJECT_TYPE_LIST@@
F%
� �
" Size �
C% SeSecurityDescriptor �
" DesiredAccess
" PreviouslyGrantedAccess ��
PrincipalSelfSid �
E% GenericMapping ���
" ObjectTypeListCount ��
G% ObjectTypeList ���B H% _SE_ACCESS_REQUEST .?AU_SE_ACCESS_REQUEST@@ �� I% w �
%
� � � � L% : � _XSTATE_FEATURE .?AU_XSTATE_FEATURE@@ &
" Offset ���
" Size �: O% _XSTATE_FEATURE .?AU_XSTATE_FEATURE@@ P% � _ j � _REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER .?AU_REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER@@ ��
ResetCounters j S% _REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER .?AU_REFS_VOLUME_COUNTER_INFO_INPUT_BUFFER@@ �� T% � �) ^ PdataRefToFullXdata �� PdataPackedUnwindFunction PdataPackedUnwindFragment > t V% ARM64_FNPDATA_FLAGS .?AW4ARM64_FNPDATA_FLAGS@@ � W% � � 6 � provider_info .?AUprovider_info@@ 2 � val_context .?AUval_context@@
Z%
� [% " " " " \%
]%
� �
^% pi_R0_1val ���
^% pi_R0_allvals
^% pi_R3_1val ���
^% pi_R3_allvals
" pi_flags �
pi_key_context ���6 _% provider_info .?AUprovider_info@@ `% � � : � tagWNDCLASSEXA .?AUtagWNDCLASSEXA@@ �� � u u c%
d%
�
&$
�
u cbSize ���
u style
e% lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
4 hInstance
f% hIcon
'$ hCursor ��
Q! hbrBackground
� $ lpszMenuName �
� ( lpszClassName
f% , hIconSm ��: g% 0 tagWNDCLASSEXA .?AUtagWNDCLASSEXA@@ �� h% ~ �
�
� � p t k%
l%
� r
\ ThreadListHead ���
CompletionEvent ��
" CompletionFlags ��
[ InternalListHead �N n% _RTL_UMS_COMPLETION_LIST .?AU_RTL_UMS_COMPLETION_LIST@@ �� o% g �! : � tagEMRGLSRECORD .?AUtagEMRGLSRECORD@@ 6
� emr ��
" cbData ���
� Data �: r% tagEMRGLSRECORD .?AUtagEMRGLSRECORD@@ s% � �
�
� p p u p u% " v%
w%
� F � _KEY_NODE_INFORMATION .?AU_KEY_NODE_INFORMATION@@
y%
� �
� LastWriteTime
" TitleIndex ���
" ClassOffset ��
" ClassLength ��
" NameLength ���
Name �F {% _KEY_NODE_INFORMATION .?AU_KEY_NODE_INFORMATION@@ |% � * � pvalueW .?AUpvalueW@@
~%
� b
q pv_valuename �
t pv_valuelen ��
pv_value_context �
" pv_type ��* �% pvalueW .?AUpvalueW@@ �% � � � CmExtendedParameterInvalidType ��� CmExtendedParameterTrustClassKey � CmExtendedParameterEvent � CmExtendedParameterFileAccessToken ��� CmExtendedParameterMax ���N t �% CM_EXTENDED_PARAMETER_TYPE .?AW4CM_EXTENDED_PARAMETER_TYPE@@ ��� �% �
�%
�
%
� r � _MEMORY_PARTITION_CONFIGURATION_INFORMATION .?AU_MEMORY_PARTITION_CONFIGURATION_INFORMATION@@ " " ��
" Flags
" NumaNode �
" Channel ��
" NumberOfNumaNodes
" ResidentAvailablePages ���
" CommittedPages ���
" CommitLimit ��
" PeakCommitment ���
" TotalNumberOfPages ���
" $ AvailablePages ���
" ( ZeroPages
" , FreePages
" 0 StandbyPages �
�% 4 StandbyPageCountByPriority ���
�% T RepurposedPagesByPriority
" t MaximumCommitLimit ���
" x DonatedPagesToPartitions �
" | PartitionId ��r �% � _MEMORY_PARTITION_CONFIGURATION_INFORMATION .?AU_MEMORY_PARTITION_CONFIGURATION_INFORMATION@@ �% w �
�
�
�
� " " < �
ExceptionCode
" ExceptionFlags ���
�% ExceptionRecord ��
ExceptionAddress �
" NumberParameters �
�% ExceptionInformation �> �% P _EXCEPTION_RECORD .?AU_EXCEPTION_RECORD@@ . onecore\internal\sdk\inc\ntxcapi_x.h ��� �% �% M V � _TOKEN_SECURITY_ATTRIBUTE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_V1@@ ��f � _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE@@ ��
�%
� v � _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ ��
�%
� f
pInt64 ���
# pUint64 ��
{ pString ��
�% pFqbn
�% pOctetString �2 �% <anonymous-tag> .?AT<anonymous-tag>@@ �% � � v
Name �
! ValueType
!
Reserved �
" Flags
" ValueCount ���
�% Values ���V �% _TOKEN_SECURITY_ATTRIBUTE_V1 .?AU_TOKEN_SECURITY_ATTRIBUTE_V1@@ �� �% � � F � _PERFINFO_CCSWAP_IDLE .?AU_PERFINFO_CCSWAP_IDLE@@
�%
�
" ��
" ��*
�% DataType �
�% TimeDelta F �% _PERFINFO_CCSWAP_IDLE .?AU_PERFINFO_CCSWAP_IDLE@@ �% b � $
�%
� �% T �% R � _UNIQUE_PROCESS_INFORMATION .?AU_UNIQUE_PROCESS_INFORMATION@@
# ��
# 0 ��
# 9��F
�% DontUse ��
�% UniqueProcessKey �
�% Reserved �R �% _UNIQUE_PROCESS_INFORMATION .?AU_UNIQUE_PROCESS_INFORMATION@@ �% w V � _ACCESS_ALLOWED_CALLBACK_ACE .?AU_ACCESS_ALLOWED_CALLBACK_ACE@@ ��:
� Header ���
" Mask �
" SidStart �V �% _ACCESS_ALLOWED_CALLBACK_ACE .?AU_ACCESS_ALLOWED_CALLBACK_ACE@@ �� �% w �
� ��
�%
� " �% �%
�%
� B � tagCOMPOSITIONFORM .?AUtagCOMPOSITIONFORM@@ ��
�%
� B
" dwStyle ��
� ptCurrentPos �
rcArea ���B �% tagCOMPOSITIONFORM .?AUtagCOMPOSITIONFORM@@ �� �% � 5 R � _WMI_JOB_SET_QUERY_CPU_RATE .?AU_WMI_JOB_SET_QUERY_CPU_RATE@@ &
" AllFlags �
" Value R �% _WMI_JOB_SET_QUERY_CPU_RATE .?AU_WMI_JOB_SET_QUERY_CPU_RATE@@ �% b � ^ � _ACTIVATION_CONTEXT_ASSEMBLY_DATA .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DATA@@
�
� �
" Size �
" Flags
�% AssemblyName �
" AssemblyNameLength ���
" HashAlgorithm
" PseudoKey ^ �% _ACTIVATION_CONTEXT_ASSEMBLY_DATA .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DATA@@ �% �
v � _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION .?AU_JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION@@ ��
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
� OldLastWriteTime �
� ( NewLastWriteTime �v �% 0 _JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION .?AU_JOURNAL_SET_KEY_LAST_WRITE_TIME_INFORMATION@@ �� �% � �
y
� N � tagEMRSCALEVIEWPORTEXTEX .?AUtagEMRSCALEVIEWPORTEXTEX@@ ��Z
� emr ��
xNum �
xDenom ���
yNum �
yDenom ���N �% tagEMRSCALEVIEWPORTEXTEX .?AUtagEMRSCALEVIEWPORTEXTEX@@ �� �% � �
!
� �
Allocated
Spare0 ���
! AllocatorBackTraceIndex ��
" Size �
g Tag ��
" TagUlong �
ProcessChargedQuota ��B �% _SYSTEM_POOL_ENTRY .?AU_SYSTEM_POOL_ENTRY@@ �� �% � _
6 � _WMI_REGISTRY .?AU_WMI_REGISTRY@@
�%
� r
InitialTime ��
" Status ���
" Index
" InfoClass
Kcb ��
Name �6 �% _WMI_REGISTRY .?AU_WMI_REGISTRY@@ �% b � J � _STACK_WALK_EVENT_DATA .?AU_STACK_WALK_EVENT_DATA@@ ��R
# TimeStamp
" ProcessId
" ThreadId �
w Addresses J �% _STACK_WALK_EVENT_DATA .?AU_STACK_WALK_EVENT_DATA@@ �� �% b
�% : � _CLUSTER_RANGE .?AU_CLUSTER_RANGE@@ ��
�%
� 6
� StartingCluster ��
� ClusterCount �: �% _CLUSTER_RANGE .?AU_CLUSTER_RANGE@@ �� �% � � Z � _QUERY_BAD_RANGES_OUTPUT_RANGE .?AU_QUERY_BAD_RANGES_OUTPUT_RANGE@@ ��V
" Flags
" Reserved �
# StartOffset ��
# LengthInBytes Z �% _QUERY_BAD_RANGES_OUTPUT_RANGE .?AU_QUERY_BAD_RANGES_OUTPUT_RANGE@@ �� �% � 7! b � _PERFINFO_SYSTEM_MEMORY_INFORMATION .?AU_PERFINFO_SYSTEM_MEMORY_INFORMATION@@ z
" PagedPoolCommitPageCount �
" NonPagedPoolPageCount
" MdlPageCount �
" CommitPageCount ��b �% _PERFINFO_SYSTEM_MEMORY_INFORMATION .?AU_PERFINFO_SYSTEM_MEMORY_INFORMATION@@ �% b � R � _ETW_IDEAL_PROCESSOR_EVENT .?AU_ETW_IDEAL_PROCESSOR_EVENT@@ ��N
" ThreadId �
" OldIdealProcessor
" NewIdealProcessor R �% _ETW_IDEAL_PROCESSOR_EVENT .?AU_ETW_IDEAL_PROCESSOR_EVENT@@ �� �% b
R
� f � _PROCESS_KEEPALIVE_COUNT_INFORMATION .?AU_PROCESS_KEEPALIVE_COUNT_INFORMATION@@ ��
�%
� .
" WakeCount
" NoWakeCount ��f �% _PROCESS_KEEPALIVE_COUNT_INFORMATION .?AU_PROCESS_KEEPALIVE_COUNT_INFORMATION@@ �� �% D 1 N � _ETW_CANCEL_KTIMER2_EVENT .?AU_ETW_CANCEL_KTIMER2_EVENT@@
" TimerKey �N �% _ETW_CANCEL_KTIMER2_EVENT .?AU_ETW_CANCEL_KTIMER2_EVENT@@ �% b �
�
� ^ � _TXFS_READ_BACKUP_INFORMATION_OUT .?AU_TXFS_READ_BACKUP_INFORMATION_OUT@@ .
" BufferLength �
� Buffer ���^ �% _TXFS_READ_BACKUP_INFORMATION_OUT .?AU_TXFS_READ_BACKUP_INFORMATION_OUT@@ �% � ` F � _THREAD_ENERGY_VALUES .?AU_THREAD_ENERGY_VALUES@@
&
� 6 � _TIMELINE_BITMAP .?AT_TIMELINE_BITMAP@@ ��j
6 Cycles ���
6 @ AttributedCycles �
6 � WorkOnBehalfCycles ���
& � CpuTimeline ��F & � _THREAD_ENERGY_VALUES .?AU_THREAD_ENERGY_VALUES@@ & � � � _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION .?AU_SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION@@ "
EfiLauncherEnabled ��� & _SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION .?AU_SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION@@ & � � N � _LDR_ENUM_RESOURCE_ENTRY .?AU_LDR_ENUM_RESOURCE_ENTRY@@ ��
� N
" NameOrId �
& Name �
! Id ���
! NameIsPresent 2 & <anonymous-tag> .?AT<anonymous-tag>@@
& � a
& " �F
& Path �
Data �
" Size �
" Reserved �N & _LDR_ENUM_RESOURCE_ENTRY .?AU_LDR_ENUM_RESOURCE_ENTRY@@ �� & � ` b � _SYSTEM_REGISTRY_QUOTA_INFORMATION .?AU_SYSTEM_REGISTRY_QUOTA_INFORMATION@@ ��V
" RegistryQuotaAllowed �
" RegistryQuotaUsed
" PagedPoolSize b & _SYSTEM_REGISTRY_QUOTA_INFORMATION .?AU_SYSTEM_REGISTRY_QUOTA_INFORMATION@@ �� & � � R � _PERFINFO_BATTERY_LIFE_INFO .?AU_PERFINFO_BATTERY_LIFE_INFO@@ .
" RemainingCapacity
" Rate �R & _PERFINFO_BATTERY_LIFE_INFO .?AU_PERFINFO_BATTERY_LIFE_INFO@@ & b / b � _WIM_PROVIDER_SUSPEND_OVERLAY_INPUT .?AU_WIM_PROVIDER_SUSPEND_OVERLAY_INPUT@@
&
�
� DataSourceId �b & _WIM_PROVIDER_SUSPEND_OVERLAY_INPUT .?AU_WIM_PROVIDER_SUSPEND_OVERLAY_INPUT@@ & � 7" B � _ALPC_CONTEXT_ATTR .?AU_ALPC_CONTEXT_ATTR@@ ��v
PortContext ��
MessageContext ���
" Sequence �
" MessageId
" CallbackId ���B !& _ALPC_CONTEXT_ATTR .?AU_ALPC_CONTEXT_ATTR@@ �� "& �
�%
� f � _JOURNAL_SET_DELETE_VALUE_INFORMATION .?AU_JOURNAL_SET_DELETE_VALUE_INFORMATION@@ �
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
ValueName
" ( OldValueType �
" , OldDataLength
0 OldData ��
" 4 NewValueType �
" 8 NewDataLength
< NewData ��f && @ _JOURNAL_SET_DELETE_VALUE_INFORMATION .?AU_JOURNAL_SET_DELETE_VALUE_INFORMATION@@ '& � � KeyWriteTimeInformation �� KeyWow64FlagsInformation � KeyControlFlagsInformation ��� KeySetVirtualizationInformation �� KeySetDebugInformation ��� KeySetHandleTagsInformation �� KeySetLayerInformation ��� MaxKeySetInfoClass ���N t )& _KEY_SET_INFORMATION_CLASS .?AW4_KEY_SET_INFORMATION_CLASS@@ ��� *& 8 N � _QUERY_FILE_LAYOUT_INPUT .?AU_QUERY_FILE_LAYOUT_INPUT@@ ��
,&
� �% " �F � _FILE_REFERENCE_RANGE .?AU_FILE_REFERENCE_RANGE@@ /& " �V
.& ClusterRanges
0& FileReferenceRanges ��
m StorageReserveIds 2 1& <anonymous-tag> .?AT<anonymous-tag>@@ 2& � 0 �
" FilterEntryCount �
" NumberOfPairs
" Flags
�# FilterType ���
" Reserved �
2& Filter ���N 4& _QUERY_FILE_LAYOUT_INPUT .?AU_QUERY_FILE_LAYOUT_INPUT@@ �� 5& � N � _CSV_QUERY_REDIRECT_STATE .?AU_CSV_QUERY_REDIRECT_STATE@@ F
" MdsNodeId
" DsNodeId �
FileRedirected ���N 8& _CSV_QUERY_REDIRECT_STATE .?AU_CSV_QUERY_REDIRECT_STATE@@ 9& � `
�% ��
;&
� n � _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES .?AU_POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES@@
IsAllowed n >& _POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES .?AU_POWER_SESSION_ALLOW_EXTERNAL_DMA_DEVICES@@ ?& { t ! A& . � _RTL_RUN_ONCE .?AT_RTL_RUN_ONCE@@
" ��2
Ptr ��
" Value
D& State . E& _RTL_RUN_ONCE .?AT_RTL_RUN_ONCE@@ F& g V � _QUERY_BAD_RANGES_INPUT_RANGE .?AU_QUERY_BAD_RANGES_INPUT_RANGE@@ 2
# StartOffset ��
# LengthInBytes V I& _QUERY_BAD_RANGES_INPUT_RANGE .?AU_QUERY_BAD_RANGES_INPUT_RANGE@@ J& � ! z � _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@
L&
� B
� ControlFlowGuard �
� StrictControlFlowGuard ���z N& _RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_RTL_IMAGE_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@ O& x �
u cbSize ���
t iContextType �
t iCtrlId ��
hItemHandle ��
" dwContextId ��
� MousePos �2 Q& tagHELPINFO .?AUtagHELPINFO@@ R& ~ K# 6 � tagWNDCLASSW .?AUtagWNDCLASSW@@ ��
T&
� �
u style
e% lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
4 hInstance
f% hIcon
'$ hCursor ��
Q! hbrBackground
lpszMenuName �
$ lpszClassName 6
V& ( tagWNDCLASSW .?AUtagWNDCLASSW@@ �� W& ~ J � _WNF_USER_SUBSCRIPTION .?AU_WNF_USER_SUBSCRIPTION@@ ��> � tagLOGCOLORSPACEA .?AUtagLOGCOLORSPACEA@@
Z&
� �
" lcsSignature �
" lcsVersion ���
" lcsSize ��
lcsCSType
lcsIntent
� lcsEndpoints �
" 8 lcsGammaRed ��
" < lcsGammaGreen
" @ lcsGammaBlue �
y D lcsFilename ��>
\& HtagLOGCOLORSPACEA .?AUtagLOGCOLORSPACEA@@ ]& � � R � _SYSTEM_OBJECT_INFORMATION .?AU_SYSTEM_OBJECT_INFORMATION@@ ��B
" NextEntryOffset ��
Object ���
CreatorUniqueProcess �
! CreatorBackTraceIndex
! Flags
PointerCount �
HandleCount ��
" PagedPoolCharge ��
" NonPagedPoolCharge ���
ExclusiveProcessId ���
$ SecurityDescriptor ���
�# ( NameInfo �R `& 0 _SYSTEM_OBJECT_INFORMATION .?AU_SYSTEM_OBJECT_INFORMATION@@ �� a& � 0
N!
� V � COPYFILE2_EXTENDED_PARAMETERS .?AUCOPYFILE2_EXTENDED_PARAMETERS@@
�
� z
" dwSize ���
" dwCopyFlags ��
t pfCancel �
e& pProgressRoutine �
pvCallbackContext V f& COPYFILE2_EXTENDED_PARAMETERS .?AUCOPYFILE2_EXTENDED_PARAMETERS@@ g& n � ^ � _SYSTEM_ALARM_CALLBACK_OBJECT_ACE .?AU_SYSTEM_ALARM_CALLBACK_OBJECT_ACE@@ �
� Header ���
" Mask �
" Flags
$ ObjectType ���
$ InheritedObjectType ��
" , SidStart �^ j& 0 _SYSTEM_ALARM_CALLBACK_OBJECT_ACE .?AU_SYSTEM_ALARM_CALLBACK_OBJECT_ACE@@ k& w 1
X
Y * m& _COORD .?AU_COORD@@ �� n& � $
�
� ^ � _EVENT_TRACE_VERSION_INFORMATION .?AU_EVENT_TRACE_VERSION_INFORMATION@@ ��N
? EventTraceInformationClass ���
" EventTraceKernelVersion ��^ r& _EVENT_TRACE_VERSION_INFORMATION .?AU_EVENT_TRACE_VERSION_INFORMATION@@ �� s& @ �
e
� � POINTER_CHANGE_NONE �� POINTER_CHANGE_FIRSTBUTTON_DOWN �� POINTER_CHANGE_FIRSTBUTTON_UP POINTER_CHANGE_SECONDBUTTON_DOWN � POINTER_CHANGE_SECONDBUTTON_UP ��� POINTER_CHANGE_THIRDBUTTON_DOWN �� POINTER_CHANGE_THIRDBUTTON_UP POINTER_CHANGE_FOURTHBUTTON_DOWN � POINTER_CHANGE_FOURTHBUTTON_UP ��� POINTER_CHANGE_FIFTHBUTTON_DOWN ��
POINTER_CHANGE_FIFTHBUTTON_UP R t v& tagPOINTER_BUTTON_CHANGE_TYPE .?AW4tagPOINTER_BUTTON_CHANGE_TYPE@@ � w& ~ � V � _HEAP_BLOCK_EXTRA_INFORMATION .?AU_HEAP_BLOCK_EXTRA_INFORMATION@@
y&
� 2
Next �
" Type �
" Size �V {& _HEAP_BLOCK_EXTRA_INFORMATION .?AU_HEAP_BLOCK_EXTRA_INFORMATION@@ |& � � j � _SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT@@ ��j � _SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER .?AU_SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER@@ j
& Header ���
# OverQuotaHistory �
" IntervalLength ���
" NumberOfIntervals j �& _SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_QUOTA_CONTEXT@@ �� �& � � n LdrpNoDevice � LdrpWebDAV ��� LdrpRemote ��� ��LdrpAnyDevice ��� LdrpAnyDevice2bit N t �& <unnamed-enum-LdrpNoDevice> .?AW4<unnamed-enum-LdrpNoDevice>@@ � �& � � ^ � _ETW_DFSS_RELEASE_THREAD_ON_IDLE .?AU_ETW_DFSS_RELEASE_THREAD_ON_IDLE@@ ��z
" CurrentGeneration
" SessionSelectedToRun �
# CycleBaseAllowance ���
CyclesRemaining ��^ �& _ETW_DFSS_RELEASE_THREAD_ON_IDLE .?AU_ETW_DFSS_RELEASE_THREAD_ON_IDLE@@ �� �& b B
^ � _RPC_BINDING_HANDLE_TEMPLATE_V1_A .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_A@@
�&
�
Reserved �2 �& <anonymous-tag> .?AT<anonymous-tag>@@ �& ^ �
" Version ��
" Flags
" ProtocolSequence �
NetworkAddress ���
StringEndpoint ���
�& u1 ���
$ ObjectUuid ���^ �& ( _RPC_BINDING_HANDLE_TEMPLATE_V1_A .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_A@@ �& ^ : � _EVENTLOGRECORD .?AU_EVENTLOGRECORD@@ z
" Length ���
" Reserved �
" RecordNumber �
" TimeGenerated
" TimeWritten ��
" EventID ��
! EventType
! NumStrings ���
! EventCategory
! ReservedFlags
" ClosingRecordNumber ��
" $ StringOffset �
" ( UserSidLength
" , UserSidOffset
" 0 DataLength ���
" 4 DataOffset ���: �& 8 _EVENTLOGRECORD .?AU_EVENTLOGRECORD@@ * onecore\internal\sdk\inc\ntelfapi.h �& �& E V � _FILE_ID_FULL_DIR_INFORMATION .?AU_FILE_ID_FULL_DIR_INFORMATION@@ :
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
� H FileId ���
P FileName �V
�& X _FILE_ID_FULL_DIR_INFORMATION .?AU_FILE_ID_FULL_DIR_INFORMATION@@ �& � � Z � _PERFINFO_PPM_IDLE_STATE_ENTER .?AU_PERFINFO_PPM_IDLE_STATE_ENTER@@ ��
�&
� �
" State
! Properties ���
ExpectedWakeReason ���
Reserved �
" Flags
# ExpectedDuration �Z �& _PERFINFO_PPM_IDLE_STATE_ENTER .?AU_PERFINFO_PPM_IDLE_STATE_ENTER@@ �� �& b �
" Marker ���
! Version ��
HeaderType ���
Flags
" Header ���
h# Packet ���
" ThreadId �
" ProcessId
� SystemTime ���
" KernelTime ���
" UserTime �F �& _SYSTEM_TRACE_HEADER .?AU_SYSTEM_TRACE_HEADER@@ �� �& b _ V � _RTL_CRITICAL_SECTION_DEBUG64 .?AU_RTL_CRITICAL_SECTION_DEBUG64@@
�&
� �
! Type �
! CreatorBackTraceIndex
# CriticalSection ��
ProcessLocksList �
" EntryCount ���
" $ ContentionCount ��
7 ( Spare V �& 0 _RTL_CRITICAL_SECTION_DEBUG64 .?AU_RTL_CRITICAL_SECTION_DEBUG64@@ �& � { V � _SYSTEM_VERIFIER_INFORMATION .?AU_SYSTEM_VERIFIER_INFORMATION@@ ��
�&
�
" ��
" ��
" ��V
�& AreAllDriversBeingVerified ���
�& DisabledFromCrash
�& Spare : �& <anonymous-tag> .?AU<anonymous-tag>@@ �& � V "
�& Flags
" Whole 2 �& <anonymous-tag> .?AT<anonymous-tag>@@ �& � T >
" NextEntryOffset ��
" Level
7 RuleClasses ��
" TriageContext
�& u1 ���
DriverName ���
" RaiseIrqls ���
" $ AcquireSpinLocks �
" ( SynchronizeExecutions
" , AllocationsAttempted �
" 0 AllocationsSucceeded �
" 4 AllocationsSucceededSpecialPool ��
" 8 AllocationsWithNoTag �
" < TrimRequests �
" @ Trims
" D AllocationsFailed
" H AllocationsFailedDeliberately
" L Loads
" P Unloads ��
" T UnTrackedPool
" X CurrentPagedPoolAllocations ��
" \ CurrentNonPagedPoolAllocations ���
" ` PeakPagedPoolAllocations �
" d PeakNonPagedPoolAllocations ��
" h PagedPoolUsageInBytes
" l NonPagedPoolUsageInBytes �
" p PeakPagedPoolUsageInBytes
" t PeakNonPagedPoolUsageInBytes �V �& x _SYSTEM_VERIFIER_INFORMATION .?AU_SYSTEM_VERIFIER_INFORMATION@@ �� �& � N J � _RTL_HANDLE_TABLE_ENTRY .?AU_RTL_HANDLE_TABLE_ENTRY@@
�&
� &
" Flags
�& NextFree �J �& _RTL_HANDLE_TABLE_ENTRY .?AU_RTL_HANDLE_TABLE_ENTRY@@ �& � � N � _SPARSE_OVERALLOCATE_DATA .?AU_SPARSE_OVERALLOCATE_DATA@@ &
" SparseOverAllocateSize ���N �& _SPARSE_OVERALLOCATE_DATA .?AU_SPARSE_OVERALLOCATE_DATA@@ �& � j( N � USN_RECORD_COMMON_HEADER .?AUUSN_RECORD_COMMON_HEADER@@ ��
�&
� J
" RecordLength �
! MajorVersion �
! MinorVersion �N �& USN_RECORD_COMMON_HEADER .?AUUSN_RECORD_COMMON_HEADER@@ �� �& � � j � _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION_V2@@ �
PerfEvtEventSelect ���
PerfEvtUnitSelect
PerfEvtCMask �
PerfEvtCInv ��
PerfEvtAnyThread �
PerfEvtEdgeDetect : �& <anonymous-tag> .?AU<anonymous-tag>@@ �& @ | >
PerfEvtEventSelect ���
PerfEvtUnitSelect : �& <anonymous-tag> .?AU<anonymous-tag>@@ �& @ � 2
" PerfEvtType ��
AllowsHalt ���: �& <anonymous-tag> .?AU<anonymous-tag>@@ �& @ � 2
�& Intel
�& Amd ��
�& Arm ��j �& _EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION_V2@@ �& @ z
�
} ��
} ��
} ��
} ��
} ��
} ��
} ��
� ��
� >���
[ Link �
� Context ��
�Teb ��
�UserContext ��
�& �ScheduledThread ��
�& �Suspended
�& �VolatileContext ��
�& �Terminated ���
�& �DebugActive ��
�& �RunningOnSelfThread ��
�& �DenyRunningOnSelfThread ��
Q �Flags
�& �KernelUpdateLock �
�& �PrimaryClientID ��
� �ContextLock ��
� �PrimaryUmsContext
" �SwitchCount ��
" �KernelYieldCount �
" �MixedYieldCount ��
" �YieldCount ���> �& �_RTL_UMS_CONTEXT .?AU_RTL_UMS_CONTEXT@@ �� �& g ! B � _DISPATCHER_CONTEXT .?AU_DISPATCHER_CONTEXT@@
�
�
�
� �% �& � �&
�&
� F � _UNWIND_HISTORY_TABLE .?AU_UNWIND_HISTORY_TABLE@@
�&
� B
" ControlPc
" ImageBase
� FunctionEntry
" EstablisherFrame �
" TargetPc �
�& ContextRecord
�& LanguageHandler ��
HandlerData ��
�& HistoryTable �
" $ ScopeIndex ���
( ControlPcIsUnwound ���
, NonVolatileRegisters �
" 0 Reserved �B
�& 4 _DISPATCHER_CONTEXT .?AU_DISPATCHER_CONTEXT@@ * onecore\external\sdk\inc\ntarm_x.h � �& �& � 6 � _RPC_VERSION .?AU_RPC_VERSION@@ ��2
! MajorVersion �
! MinorVersion �6 �& _RPC_VERSION .?AU_RPC_VERSION@@ �� �& 3 ) R � _ENCRYPTION_KEY_CTRL_INPUT .?AU_ENCRYPTION_KEY_CTRL_INPUT@@ ��
�&
� �
" HeaderSize ���
" StructureSize
! KeyOffset
!
KeySize ��
" DplLock ��
# DplUserId
# DplCredentialId ��R �& _ENCRYPTION_KEY_CTRL_INPUT .?AU_ENCRYPTION_KEY_CTRL_INPUT@@ �� �& � �! : � _SL_APPX_CACHE .?AU_SL_APPX_CACHE@@ ��Z � _SL_APPX_CACHE_VALUE_DESCRIPTOR .?AU_SL_APPX_CACHE_VALUE_DESCRIPTOR@@ �& " 0 �j
" Version ��
" Flags
" DataSize �
# DataCheckSum �
�& Descriptors ��: �& H _SL_APPX_CACHE .?AU_SL_APPX_CACHE@@ �� �& � � 6 � _VM_COUNTERS .?AU_VM_COUNTERS@@ ��R
" PeakVirtualSize ��
" VirtualSize ��
" PageFaultCount ���
" PeakWorkingSetSize ���
" WorkingSetSize ���
" QuotaPeakPagedPoolUsage ��
" QuotaPagedPoolUsage ��
" QuotaPeakNonPagedPoolUsage ���
" QuotaNonPagedPoolUsage ���
" $ PagefileUsage
" ( PeakPagefileUsage 6 �& , _VM_COUNTERS .?AU_VM_COUNTERS@@ �� �& D � B � _PREFIX_TABLE_ENTRY .?AU_PREFIX_TABLE_ENTRY@@
�&
� r
NodeTypeCode �
NameLength ���
�& NextPrefixTree ���
b Links
$ Prefix ���B �& _PREFIX_TABLE_ENTRY .?AU_PREFIX_TABLE_ENTRY@@ ' g > � _COUNTER_READING .?AU_COUNTER_READING@@ ��B
� Type �
" Index
# Start
# Total > ' _COUNTER_READING .?AU_COUNTER_READING@@ �� ' � |
! t ' J � _TRACE_LOGFILE_HEADER32 .?AU_TRACE_LOGFILE_HEADER32@@ f
MajorVersion �
MinorVersion �
SubVersion ���
SubMinorVersion ��: ' <anonymous-tag> .?AU<anonymous-tag>@@
' � � .
" BufferSize ���
" Version ��
' VersionDetail
" ProviderVersion ��
" NumberOfProcessors ���
� EndTime ��
" TimerResolution ��
" MaximumFileSize ��
" LogFileMode ��
" $ BuffersWritten ���
$ ( LogInstanceGuid ��
" ( StartBuffers �
" , PointerSize ��
" 0 EventsLost ���
" 4 CpuSpeedInMHz
u 8 LoggerName ���
u < LogFileName ��
� @ TimeZone �
� � BootTime �
� � PerfFreq �
� StartTime
" ReservedFlags
" BuffersLost ��J ' _TRACE_LOGFILE_HEADER32 .?AU_TRACE_LOGFILE_HEADER32@@
' � � J � _TOKEN_MANDATORY_LABEL .?AU_TOKEN_MANDATORY_LABEL@@ ��
'
�
� Label J ' _TOKEN_MANDATORY_LABEL .?AU_TOKEN_MANDATORY_LABEL@@ �� ' w � v � _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM .?AU_SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM@@
'
� Z � SERVICE_TRIGGER_CUSTOM_STATE_ID .?AUSERVICE_TRIGGER_CUSTOM_STATE_ID@@ *
" DataOffset ���
� Data �: ' <anonymous-tag> .?AU<anonymous-tag>@@ ' � � &
' CustomStateId
' s 2 ' <anonymous-tag> .?AT<anonymous-tag>@@ ' � �
' u v ' _SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM .?AU_SERVICE_CUSTOM_SYSTEM_STATE_CHANGE_DATA_ITEM@@ ' � � 6 � tagEMRFORMAT .?AUtagEMRFORMAT@@ ��V
" dSignature ���
" nVersion �
" cbData ���
" offData ��6 !' tagEMRFORMAT .?AUtagEMRFORMAT@@ �� "' � � b � _PLUGPLAY_CONTROL_CONFLICT_STRINGS .?AU_PLUGPLAY_CONTROL_CONFLICT_STRINGS@@ ��B
" NullDeviceInstance ���
DeviceInstanceStrings b %' _PLUGPLAY_CONTROL_CONFLICT_STRINGS .?AU_PLUGPLAY_CONTROL_CONFLICT_STRINGS@@ �� &' $ � j � _SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE .?AU_SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE@@
('
�
&
�
*' +'
,'
� &
-' NetRateControlDispatch ���j .' _SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE .?AU_SYSTEM_NET_RATE_CONTROL_CALLBACK_TABLE@@ /' � � . COPYFILE2_CALLBACK_NONE �� COPYFILE2_CALLBACK_CHUNK_STARTED � COPYFILE2_CALLBACK_CHUNK_FINISHED COPYFILE2_CALLBACK_STREAM_STARTED COPYFILE2_CALLBACK_STREAM_FINISHED ��� COPYFILE2_CALLBACK_POLL_CONTINUE � COPYFILE2_CALLBACK_ERROR � COPYFILE2_CALLBACK_MAX ���F t 1' _COPYFILE2_MESSAGE_TYPE .?AW4_COPYFILE2_MESSAGE_TYPE@@ � 2' n ; R � _LINK_TRACKING_INFORMATION .?AU_LINK_TRACKING_INFORMATION@@ ��J NtfsLinkTrackingInformation �� DfsLinkTrackingInformation ���V t 5' _LINK_TRACKING_INFORMATION_TYPE .?AW4_LINK_TRACKING_INFORMATION_TYPE@@ � 6' � �) &
6' Type �
o VolumeId �R 8' _LINK_TRACKING_INFORMATION .?AU_LINK_TRACKING_INFORMATION@@ �� 9' � �) Z � _IMAGE_LOAD_CONFIG_DIRECTORY32 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY32@@ ��
" Size �
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" GlobalFlagsClear �
" GlobalFlagsSet ���
" CriticalSectionDefaultTimeout
" DeCommitFreeBlockThreshold ���
" DeCommitTotalFreeThreshold ���
" LockPrefixTable ��
" $ MaximumAllocationSize
" ( VirtualMemoryThreshold ���
" , ProcessHeapFlags �
" 0 ProcessAffinityMask ��
! 4 CSDVersion ���
! 6 DependentLoadFlags ���
" 8 EditList �
" < SecurityCookie ���
" @ SEHandlerTable ���
" D SEHandlerCount ���
" H GuardCFCheckFunctionPointer ��
" L GuardCFDispatchFunctionPointer ���
" P GuardCFFunctionTable �
" T GuardCFFunctionCount �
" X GuardFlags ���
* \ CodeIntegrity
" h GuardAddressTakenIatEntryTable ���
" l GuardAddressTakenIatEntryCount ���
" p GuardLongJumpTargetTable �
" t GuardLongJumpTargetCount �
" x DynamicValueRelocTable ���
" | CHPEMetadataPointer ��
" � GuardRFFailureRoutine
" � GuardRFFailureRoutineFunctionPointer �
" � DynamicValueRelocTableOffset �
! � DynamicValueRelocTableSection
! � Reserved2
" � GuardRFVerifyStackPointerFunctionPointer �
" � HotPatchTableOffset ��
" � Reserved3
" � EnclaveConfigurationPointer ��
" � VolatileMetadataPointer ��
" � GuardEHContinuationTable �
" � GuardEHContinuationCount �Z , <' � _IMAGE_LOAD_CONFIG_DIRECTORY32 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY32@@ �� =' � J � _TRACE_GUID_PROPERTIES .?AU_TRACE_GUID_PROPERTIES@@ ��~
$ Guid �
" GuidType �
" LoggerId �
" EnableLevel ��
" EnableFlags ��
IsEnable �J @' $ _TRACE_GUID_PROPERTIES .?AU_TRACE_GUID_PROPERTIES@@ �� A' � � B � tagEMRSTRETCHDIBITS .?AUtagEMRSTRETCHDIBITS@@ &
� emr ��
c rclBounds
xDest
yDest
xSrc �
$ ySrc �
( cxSrc
, cySrc
" 0 offBmiSrc
" 4 cbBmiSrc �
" 8 offBitsSrc ���
" < cbBitsSrc
" @ iUsageSrc
" D dwRop
H cxDest ���
L cyDest ���B D' P tagEMRSTRETCHDIBITS .?AUtagEMRSTRETCHDIBITS@@ E' � + V � _TRANSACTION_LIST_INFORMATION .?AU_TRANSACTION_LIST_INFORMATION@@ " �F
" NumberOfTransactions �
H' TransactionInformation ���V I' _TRANSACTION_LIST_INFORMATION .?AU_TRANSACTION_LIST_INFORMATION@@ J' � m V � _FILE_COMPLETION_INFORMATION .?AU_FILE_COMPLETION_INFORMATION@@ ��
L'
� "
Port �
Key ��V N' _FILE_COMPLETION_INFORMATION .?AU_FILE_COMPLETION_INFORMATION@@ �� O' � ? V � _ETW_TP_EVENT_CALLBACK_START .?AU_ETW_TP_EVENT_CALLBACK_START@@ ��
Q'
� ~
m Header ���
PoolId ���
$ TaskId ���
( Callback �
, Context ��
0 SubProcessTag V S' 8 _ETW_TP_EVENT_CALLBACK_START .?AU_ETW_TP_EVENT_CALLBACK_START@@ �� T' b � j � _TRANSACTIONMANAGER_LOGPATH_INFORMATION .?AU_TRANSACTIONMANAGER_LOGPATH_INFORMATION@@ .
" LogPathLength
LogPath ��j W' _TRANSACTIONMANAGER_LOGPATH_INFORMATION .?AU_TRANSACTIONMANAGER_LOGPATH_INFORMATION@@ X' � � B � _CONSOLE_FONT_INFO .?AU_CONSOLE_FONT_INFO@@ ��
Z'
� *
" nFont
�" dwFontSize ���B \' _CONSOLE_FONT_INFO .?AU_CONSOLE_FONT_INFO@@ �� ]' � �
u _'
b
�
a
� �
b' DebugInfo
LockCount
RecursionCount ���
OwningThread �
LockSemaphore
" SpinCount F c' _RTL_CRITICAL_SECTION .?AU_RTL_CRITICAL_SECTION@@ d' � Z
� N � _SD_GLOBAL_CHANGE_OUTPUT .?AU_SD_GLOBAL_CHANGE_OUTPUT@@ ��V � _SD_CHANGE_MACHINE_SID_OUTPUT .?AU_SD_CHANGE_MACHINE_SID_OUTPUT@@ J � _SD_QUERY_STATS_OUTPUT .?AU_SD_QUERY_STATS_OUTPUT@@ ��B � _SD_ENUM_SDS_OUTPUT .?AU_SD_ENUM_SDS_OUTPUT@@ j
" Flags
" ChangeType ���
h' SdChange �
i' SdQueryStats �
j' SdEnumSds N k' H _SD_GLOBAL_CHANGE_OUTPUT .?AU_SD_GLOBAL_CHANGE_OUTPUT@@ �� l' � � : � tagHELPWININFOW .?AUtagHELPWININFOW@@
n'
� q " �z
t wStructSize ��
t x
t y
t dx ���
t dy ���
t wMax �
p' rgchMember ���: q' tagHELPWININFOW .?AUtagHELPWININFOW@@ r' ~ �/ . � tagNMHDR .?AUtagNMHDR@@ ��:
� hwndFrom �
u idFrom ���
u code �. u' tagNMHDR .?AUtagNMHDR@@ �� v' ~ � : � _CONTEXT_CHUNK .?AU_CONTEXT_CHUNK@@ ��*
Offset ���
" Length ���: y' _CONTEXT_CHUNK .?AU_CONTEXT_CHUNK@@ �� z' K B 2 � _cpinfoexW .?AU_cpinfoexW@@ ��
u MaxCharSize ��
DefaultChar ��
LeadByte �
q UnicodeDefaultChar ���
u CodePage �
� CodePageName �2 }' _cpinfoexW .?AU_cpinfoexW@@ �� ~' V l
�
� J � _PROCESS_EXCEPTION_PORT .?AU_PROCESS_EXCEPTION_PORT@@
�'
� :
ExceptionPortHandle ��
" StateFlags ���J �' _PROCESS_EXCEPTION_PORT .?AU_PROCESS_EXCEPTION_PORT@@ �' D � 6 � _ICONINFOEXW .?AU_ICONINFOEXW@@ ��
�'
� �
" cbSize ���
t fIcon
" xHotspot �
" yHotspot �
{ hbmMask ��
{ hbmColor �
! wResID ���
� szModName
� "szResName 6 �' ,_ICONINFOEXW .?AU_ICONINFOEXW@@ �� �' ~ �* > � _NV_MEMORY_RANGE .?AU_NV_MEMORY_RANGE@@ ��.
BaseAddress ��
" Length ���> �' _NV_MEMORY_RANGE .?AU_NV_MEMORY_RANGE@@ �� �' g �$ F � _IMAGE_HOT_PATCH_INFO .?AU_IMAGE_HOT_PATCH_INFO@@
�'
� �
" Version ��
" Size �
" SequenceNumber ���
" BaseImageList
" BaseImageCount ���
" BufferOffset �
" ExtraPatchSize ���F �' _IMAGE_HOT_PATCH_INFO .?AU_IMAGE_HOT_PATCH_INFO@@ �' � � ^ FileIdType ��� ObjectIdType � ExtendedFileIdType ��� MaximumFileIdType 2 t �' _FILE_ID_TYPE .?AW4_FILE_ID_TYPE@@ � �' n �# * � HSTR__ .?AUHSTR__@@ ��
�'
�
t unused ���* �' HSTR__ .?AUHSTR__@@ ��6 onecore\external\shared\inc\minwin\minwindef.h � �' �' f � _SYSTEM_HYPERVISOR_DETAIL_INFORMATION .?AU_SYSTEM_HYPERVISOR_DETAIL_INFORMATION@@ 2 � _HV_DETAILS .?AU_HV_DETAILS@@ �
�' HvVendorAndMaxFunction ���
�' HypervisorInterface ��
�' HypervisorVersion
�' 0 HvFeatures ���
�' @ HwFeatures ���
�' P EnlightenmentInfo
�' ` ImplementationLimits �f �' p _SYSTEM_HYPERVISOR_DETAIL_INFORMATION .?AU_SYSTEM_HYPERVISOR_DETAIL_INFORMATION@@ �' � = : � _WMI_DPI_RECORD .?AU_WMI_DPI_RECORD@@ .
" MachineDPI ���
" UserDPI ��: �' _WMI_DPI_RECORD .?AU_WMI_DPI_RECORD@@ �' b j B � _RTL_PROCESS_HEAPS .?AU_RTL_PROCESS_HEAPS@@ ��F � _RTL_HEAP_INFORMATION .?AU_RTL_HEAP_INFORMATION@@ �' " @ �*
" NumberOfHeaps
�' Heaps B �' D _RTL_PROCESS_HEAPS .?AU_RTL_PROCESS_HEAPS@@ �� �' � F V LoadReasonStaticDependency ��� LoadReasonStaticForwarderDependency �� LoadReasonDynamicForwarderDependency � LoadReasonDelayloadDependency LoadReasonDynamicLoad LoadReasonAsImageLoad LoadReasonAsDataLoad � LoadReasonEnclavePrimary � LoadReasonEnclaveDependency �� ��LoadReasonUnknown ���B
t �' _LDR_DLL_LOAD_REASON .?AW4_LDR_DLL_LOAD_REASON@@ ��� �' � �
-%
� t " " " " �'
�'
�
�'
� B
�' pSizeConvertRoutines �
�' pTagGettingRoutines ��> �' _NDR_CS_ROUTINES .?AU_NDR_CS_ROUTINES@@ �� �' � � " SC_STATUS_PROCESS_INFO ���6 t �' _SC_STATUS_TYPE .?AW4_SC_STATUS_TYPE@@ � �' � � > � _DISPLAY_DEVICEW .?AU_DISPLAY_DEVICEW@@ ��
�'
� �
" cb ���
DeviceName ���
�$ D DeviceString �
" DStateFlags ���
�$ HDeviceID �
�$ HDeviceKey > �' H_DISPLAY_DEVICEW .?AU_DISPLAY_DEVICEW@@ �� �' � �
� � �' V � _TOKEN_GROUPS_AND_PRIVILEGES .?AU_TOKEN_GROUPS_AND_PRIVILEGES@@ ��F � _LUID_AND_ATTRIBUTES .?AU_LUID_AND_ATTRIBUTES@@ ��
�'
�
" SidCount �
" SidLength
W Sids �
" RestrictedSidCount ���
" RestrictedSidLength ��
W RestrictedSids ���
" PrivilegeCount ���
" PrivilegeLength ��
�' Privileges ���
� $ AuthenticationId �V
�' , _TOKEN_GROUPS_AND_PRIVILEGES .?AU_TOKEN_GROUPS_AND_PRIVILEGES@@ �� �' w � : � tagMENUBARINFO .?AUtagMENUBARINFO@@ ��
�'
�
t ��
t ��
t ��
" cbSize ���
rcBar
� hMenu
� hwndMenu �
�' fBarFocused ��
�' fFocused �
�' fUnused ��: �' tagMENUBARINFO .?AUtagMENUBARINFO@@ �� �' ~ 9 > � _USER_MARSHAL_CB .?AU_USER_MARSHAL_CB@@ ��
�
� � USER_MARSHAL_CB_BUFFER_SIZE �� USER_MARSHAL_CB_MARSHALL � USER_MARSHAL_CB_UNMARSHALL ��� USER_MARSHAL_CB_FREE �B t �' _USER_MARSHAL_CB_TYPE .?AW4_USER_MARSHAL_CB_TYPE@@ � �' � x �
" Flags
�' pStubMsg �
J pReserve �
" Signature
�' CBType ���
J pFormat ��
J pTypeFormat ��> �' _USER_MARSHAL_CB .?AU_USER_MARSHAL_CB@@ �� �' � � R � tagRID_DEVICE_INFO_KEYBOARD .?AUtagRID_DEVICE_INFO_KEYBOARD@@ �
" dwType ���
" dwSubType
" dwKeyboardMode ���
" dwNumberOfFunctionKeys ���
" dwNumberOfIndicators �
" dwNumberOfKeysTotal ��R �' tagRID_DEVICE_INFO_KEYBOARD .?AUtagRID_DEVICE_INFO_KEYBOARD@@ �' ~ ; B � tagEMRPOLYTEXTOUTA .?AUtagEMRPOLYTEXTOUTA@@ ��
�'
� 2 � tagEMRTEXT .?AUtagEMRTEXT@@ �� �' " ( �
� emr ��
c rclBounds
" iGraphicsMode
@ exScale ��
@ eyScale ��
$ cStrings �
�' ( aemrtext �B �' P tagEMRPOLYTEXTOUTA .?AUtagEMRPOLYTEXTOUTA@@ �� �' � � � ActivationContextBasicInformation ActivationContextDetailedInformation � AssemblyDetailedInformationInActivationContext ��� FileInformationInAssemblyOfAssemblyInActivationContext ��� RunlevelInformationInActivationContext ��� CompatibilityInformationInActivationContext �� ActivationContextManifestResourceName MaxActivationContextInfoClass AssemblyDetailedInformationInActivationContxt FileInformationInAssemblyOfAssemblyInActivationContxt V
t �' _ACTIVATION_CONTEXT_INFO_CLASS .?AW4_ACTIVATION_CONTEXT_INFO_CLASS@@ ��� �' � D R � _SYSTEM_NUMA_PROXIMITY_MAP .?AU_SYSTEM_NUMA_PROXIMITY_MAP@@ ��6
" NodeProximityId ��
! NodeNumber ���R �' _SYSTEM_NUMA_PROXIMITY_MAP .?AU_SYSTEM_NUMA_PROXIMITY_MAP@@ �� �' � 5 f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A@@ ��
TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
ServerCertificateSubject �
ProxyCredentials �
" NumberOfProxyAuthnSchemes
" ProxyAuthnSchemes f �' $ _RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V3_A@@ �� �' ^ � n � _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER@@
PrologueByteCount n �' _IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_PROLOGUE_DYNAMIC_RELOCATION_HEADER@@ �' � � > PMETypeFailFastOnCommitFailure ��� PMETypeMax ���V t �' _PROCESS_MEMORY_EXHAUSTION_TYPE .?AW4_PROCESS_MEMORY_EXHAUSTION_TYPE@@ � �' � � N � tagRID_DEVICE_INFO_MOUSE .?AUtagRID_DEVICE_INFO_MOUSE@@ ��f
" dwId �
" dwNumberOfButtons
" dwSampleRate �
t fHasHorizontalWheel ��N �' tagRID_DEVICE_INFO_MOUSE .?AUtagRID_DEVICE_INFO_MOUSE@@ �� �' ~ ; . � _OFSTRUCT .?AU_OFSTRUCT@@
�'
� �
cBytes ���
fFixedDisk ���
! nErrCode �
! Reserved1
! Reserved2
szPathName ���. �' � _OFSTRUCT .?AU_OFSTRUCT@@ �' n � �
" Length ���
RootDirectory
{ ObjectName ���
" Attributes ���
SecurityDescriptor ���
SecurityQualityOfService �B �' _OBJECT_ATTRIBUTES .?AU_OBJECT_ATTRIBUTES@@ �� �' . � tagLC_ID .?AUtagLC_ID@@ ��>
! wLanguage
! wCountry �
! wCodePage . ( tagLC_ID .?AUtagLC_ID@@ ��. onecore\external\sdk\inc\crt\crtdefs.h � ( ( � j � _PERFINFO_PFMAPPED_SECTION_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_INFORMATION@@ ��F
RangeBase
RangeEnd �
" CreatingProcessId j ( _PERFINFO_PFMAPPED_SECTION_INFORMATION .?AU_PERFINFO_PFMAPPED_SECTION_INFORMATION@@ �� ( b l Z � _SYSTEM_VERIFIER_INFORMATION_EX .?AU_SYSTEM_VERIFIER_INFORMATION_EX@@ �
" VerifyMode ���
" OptionChanges
PreviousBucketName ���
" IrpCancelTimeoutMsec �
" VerifierExtensionEnabled �
� Reserved �Z
( $ _SYSTEM_VERIFIER_INFORMATION_EX .?AU_SYSTEM_VERIFIER_INFORMATION_EX@@ ( � � ~
�! ActiveFrame ��
! FrameListCache ���
" Flags
" NextCookieSequenceNumber �
" StackId ��N
( _ACTIVATION_CONTEXT_STACK .?AU_ACTIVATION_CONTEXT_STACK@@ ( < � V � _PROCESS_WORKING_SET_CONTROL .?AU_PROCESS_WORKING_SET_CONTROL@@ ��:
" Version ��
v Operation
" Flags V ( _PROCESS_WORKING_SET_CONTROL .?AU_PROCESS_WORKING_SET_CONTROL@@ �� ( w W * � _FP_64 .?AU_FP_64@@ ��
7 W * ( _FP_64 .?AU_FP_64@@ �� ( � : ^ BootLoad � SystemLoad ��� AutoLoad � DemandLoad ��� DisableLoad ��B t ( _CM_SERVICE_LOAD_TYPE .?AW4_CM_SERVICE_LOAD_TYPE@@ � ( n � _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER@@
( ��
(
� ~
" EpilogueCount
EpilogueByteCount
BranchDescriptorElementSize ��
! BranchDescriptorCount n ( _IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER .?AU_IMAGE_EPILOGUE_DYNAMIC_RELOCATION_HEADER@@ ( � � F � _POWER_USER_PRESENCE .?AU_POWER_USER_PRESENCE@@ ��
!(
� B UserNotPresent ��� UserPresent �� � UserUnknown ��J t #( POWER_USER_PRESENCE_TYPE .?AW4POWER_USER_PRESENCE_TYPE@@ ��� $( { �
$( UserPresence �F &( _POWER_USER_PRESENCE .?AU_POWER_USER_PRESENCE@@ �� '( { � J � tagEMRCREATECOLORSPACEW .?AUtagEMRCREATECOLORSPACEW@@
)(
� > � tagLOGCOLORSPACEW .?AUtagLOGCOLORSPACEW@@ j
� emr ��
" ihCS �
+( lcs ��
" XdwFlags ��
" \cbData ���
� `Data �J ,( dtagEMRCREATECOLORSPACEW .?AUtagEMRCREATECOLORSPACEW@@ -( � � ^ � _RPC_BINDING_HANDLE_SECURITY_V1_W .?AU_RPC_BINDING_HANDLE_SECURITY_V1_W@@ R � _SEC_WINNT_AUTH_IDENTITY_W .?AU_SEC_WINNT_AUTH_IDENTITY_W@@ ��
0(
� > � _RPC_SECURITY_QOS .?AU_RPC_SECURITY_QOS@@
2(
� �
" Version ��
q ServerPrincName ��
" AuthnLevel ���
" AuthnSvc �
1( AuthIdentity �
3( SecurityQos ��^ 4( _RPC_BINDING_HANDLE_SECURITY_V1_W .?AU_RPC_BINDING_HANDLE_SECURITY_V1_W@@ 5( ^ : � tagGESTUREINFO .?AUtagGESTUREINFO@@ ���
u cbSize ���
" dwFlags ��
" dwID �
� hwndTarget ���
{ ptsLocation ��
" dwInstanceID �
" dwSequenceID �
# ullArguments �
u ( cbExtraArgs ��: 8( 0 tagGESTUREINFO .?AUtagGESTUREINFO@@ �� 9( ~ �< > � tagEMRPOLYLINE16 .?AUtagEMRPOLYLINE16@@ ��
;(
� F
� emr ��
c rclBounds
" cpts �
| apts �> =( tagEMRPOLYLINE16 .?AUtagEMRPOLYLINE16@@ �� >( � E
P#
�
� ��
A(
�
s"
� > � _WOW64_LDT_ENTRY .?AU_WOW64_LDT_ENTRY@@ ��R
BaseMid ��
Flags1 ���
Flags2 ���
BaseHi ���: E( <anonymous-tag> .?AU<anonymous-tag>@@ F( � �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
H( BaseMid ��
I( Type �
J( Dpl ��
K( Pres �
L( LimitHi ��
M( Sys ��
N( Reserved_0 ���
O( Default_Big ��
P( Granularity ��
Q( BaseHi ���:
R( <anonymous-tag> .?AU<anonymous-tag>@@ S( � � "
F( Bytes
S( Bits �2 U( <anonymous-tag> .?AT<anonymous-tag>@@ V( � � >
! LimitLow �
! BaseLow ��
V( HighWord �> X( _WOW64_LDT_ENTRY .?AU_WOW64_LDT_ENTRY@@ �� Y( � �
�
� B � _MIDL_SERVER_INFO_ .?AU_MIDL_SERVER_INFO_@@ ��
� ��
](
�
_(
`(
�
a(
�
�' c(
d(
�
e(
� > � _MIDL_SYNTAX_INFO .?AU_MIDL_SYNTAX_INFO@@
g(
� �
^( pStubDesc
b( DispatchTable
J ProcString ���
2 FmtStringOffset ��
f( ThunkTable ���
0 pTransferSyntax ��
" nCount ���
h( pSyntaxInfo ��B i( _MIDL_SERVER_INFO_ .?AU_MIDL_SERVER_INFO_@@ �� j( � p v � _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2@@
l(
� j � _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_ACCOUNTING_INFORMATION@@ J � _PROCESS_ENERGY_VALUES .?AU_PROCESS_ENERGY_VALUES@@ ���
n( BasicInfo
� 0 IoInfo ���
� ` DiskIoInfo ���
# � ContextSwitches ��
� � TotalCycleTime ���
# � ReadyTime
o( � EnergyValues �
# �KernelWaitTime ���
# �UserWaitTime �v p( �_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION_V2@@ q( � �
�
�
�%
�
�
� � MandatoryLevelUntrusted �� MandatoryLevelLow MandatoryLevelMedium � MandatoryLevelHigh ��� MandatoryLevelSystem � MandatoryLevelSecureProcess �� MandatoryLevelCount ��: t v( _MANDATORY_LEVEL .?AW4_MANDATORY_LEVEL@@ ��� w( w 6 � _RTL_BSD_ITEM .?AU_RTL_BSD_ITEM@@ ^ RtlBsdItemVersionNumber �� RtlBsdItemProductType RtlBsdItemAabEnabled � RtlBsdItemAabTimeout � RtlBsdItemBootGood ��� RtlBsdItemBootShutdown ��� RtlBsdSleepInProgress RtlBsdPowerTransition RtlBsdItemBootAttemptCount ��� RtlBsdItemBootCheckpoint �
RtlBsdItemBootId � RtlBsdItemShutdownBootId � RtlBsdItemReportedAbnormalShutdownBootId �
RtlBsdItemErrorInfo �� RtlBsdItemPowerButtonPressInfo ��� RtlBsdItemChecksum ��� RtlBsdPowerTransitionExtension ��� RtlBsdItemFeatureConfigurationState �� RtlBsdItemMax : t z( RTL_BSD_ITEM_TYPE .?AW4RTL_BSD_ITEM_TYPE@@ � {( B B
{( Type �
DataBuffer ���
" DataLength ���6 }( _RTL_BSD_ITEM .?AU_RTL_BSD_ITEM@@ ~( X
d(
� r
�( pfnTranslateToXmit ���
�( pfnTranslateFromXmit �
�( pfnFreeXmit ��
�( pfnFreeInst ��J �( _XMIT_ROUTINE_QUINTUPLE .?AU_XMIT_ROUTINE_QUINTUPLE@@ �( � P F � tagMEASUREITEMSTRUCT .?AUtagMEASUREITEMSTRUCT@@ ��z
u CtlType ��
u CtlID
u itemID ���
u itemWidth
u itemHeight ���
" itemData �F �( tagMEASUREITEMSTRUCT .?AUtagMEASUREITEMSTRUCT@@ �� �( ~
v � _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT@@ ��
�(
� �
" Gsiv �
ControllerInterrupt ��
EdgeInterrupt
IsPrimaryInterrupt ���
" TargetAffinity ���v �( _SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT .?AU_SYSTEM_INTERRUPT_STEERING_INFORMATION_INPUT@@ �� �( � R � _SYSTEM_BIGPOOL_INFORMATION .?AU_SYSTEM_BIGPOOL_INFORMATION@@
�(
� *
" Count
* AllocatedInfo R �( _SYSTEM_BIGPOOL_INFORMATION .?AU_SYSTEM_BIGPOOL_INFORMATION@@ �( � �
EventBasicInformation J t �( _EVENT_INFORMATION_CLASS .?AW4_EVENT_INFORMATION_CLASS@@ ��� �( � a F � _NDR_CORRELATION_INFO .?AU_NDR_CORRELATION_INFO@@ Z � _TIME_DYNAMIC_ZONE_INFORMATION .?AU_TIME_DYNAMIC_ZONE_INFORMATION@@ ��
�(
� �
Bias �
StandardName �
5 D StandardDate �
T StandardBias �
X DaylightName �
5 � DaylightDate �
� DaylightBias �
�$ � TimeZoneKeyName ��
�DynamicDaylightTimeDisabled ��Z �( �_TIME_DYNAMIC_ZONE_INFORMATION .?AU_TIME_DYNAMIC_ZONE_INFORMATION@@ �� �( 8 -
!
� Z � _SYSTEM_GDI_DRIVER_INFORMATION .?AU_SYSTEM_GDI_DRIVER_INFORMATION@@ ��J � _IMAGE_EXPORT_DIRECTORY .?AU_IMAGE_EXPORT_DIRECTORY@@
�(
� �
DriverName ���
ImageAddress �
SectionPointer ���
EntryPoint ���
�( ExportSectionPointer �
" ImageLength ��Z �( _SYSTEM_GDI_DRIVER_INFORMATION .?AU_SYSTEM_GDI_DRIVER_INFORMATION@@ �� �( � � J � _PO_WAKE_SOURCE_HISTORY .?AU_PO_WAKE_SOURCE_HISTORY@@
�(
� &
" Count
� Offsets ��J �( _PO_WAKE_SOURCE_HISTORY .?AU_PO_WAKE_SOURCE_HISTORY@@ �( { :
2 � ARRAY_INFO .?AUARRAY_INFO@@ ��
Dimension
" BufferConformanceMark
" BufferVarianceMark ���
" MaxCountArray
" OffsetArray ��
" ActualCountArray �2 �( ARRAY_INFO .?AUARRAY_INFO@@ �� �( � 5 N � _ACCESS_DENIED_OBJECT_ACE .?AU_ACCESS_DENIED_OBJECT_ACE@@
�(
� �
� Header ���
" Mask �
" Flags
$ ObjectType ���
$ InheritedObjectType ��
" , SidStart �N �( 0 _ACCESS_DENIED_OBJECT_ACE .?AU_ACCESS_DENIED_OBJECT_ACE@@ �( w � F � _IMAGE_SECTION_HEADER .?AU_IMAGE_SECTION_HEADER@@
�(
� 6
" PhysicalAddress ��
" VirtualSize ��2 �( <anonymous-tag> .?AT<anonymous-tag>@@ �( �
Name �
�( Misc �
" VirtualAddress ���
" SizeOfRawData
" PointerToRawData �
" PointerToRelocations �
" PointerToLinenumbers �
! NumberOfRelocations ��
! " NumberOfLinenumbers ��
" $ Characteristics ��F
�( ( _IMAGE_SECTION_HEADER .?AU_IMAGE_SECTION_HEADER@@ �( � Z � _SYSTEM_CALL_COUNT_INFORMATION .?AU_SYSTEM_CALL_COUNT_INFORMATION@@ ��
�(
� 2
" Length ���
" NumberOfTables ���Z �( _SYSTEM_CALL_COUNT_INFORMATION .?AU_SYSTEM_CALL_COUNT_INFORMATION@@ �� �( � e R � _FILE_INTERNAL_INFORMATION .?AU_FILE_INTERNAL_INFORMATION@@ ��
� IndexNumber ��R �( _FILE_INTERNAL_INFORMATION .?AU_FILE_INTERNAL_INFORMATION@@ �� �( � � > � _SCOPE_TABLE_ARM .?AU_SCOPE_TABLE_ARM@@ ��f
" BeginAddress �
" EndAddress ���
" HandlerAddress ���
" JumpTarget ���: �( <anonymous-tag> .?AU<anonymous-tag>@@ �( �& # �( " �*
" Count
�( ScopeRecord ��> �( _SCOPE_TABLE_ARM .?AU_SCOPE_TABLE_ARM@@ �� �( �&
�
� > � tagCREATESTRUCTW .?AUtagCREATESTRUCTW@@ ��
�(
� �
lpCreateParams ���
4 hInstance
� hMenu
� hwndParent ���
t cy ���
t cx ���
t y
t x
style
$ lpszName �
( lpszClass
" , dwExStyle > �( 0 tagCREATESTRUCTW .?AUtagCREATESTRUCTW@@ �� �( ~ � V � _RTL_USER_PROCESS_INFORMATION .?AU_RTL_USER_PROCESS_INFORMATION@@ R � _SECTION_IMAGE_INFORMATION .?AU_SECTION_IMAGE_INFORMATION@@ ��n
" Length ���
Process ��
Thread ���
ClientId �
�( ImageInformation �V �( D _RTL_USER_PROCESS_INFORMATION .?AU_RTL_USER_PROCESS_INFORMATION@@ �( - N � _TRACE_GUID_REGISTRATION .?AU_TRACE_GUID_REGISTRATION@@ ��&
j Guid �
RegHandle N �( _TRACE_GUID_REGISTRATION .?AU_TRACE_GUID_REGISTRATION@@ �� �( � � B � tagRID_DEVICE_INFO .?AUtagRID_DEVICE_INFO@@ ��^
" cbSize ���
" dwType ���
�' mouse
�' keyboard �
� hid ��B �( tagRID_DEVICE_INFO .?AUtagRID_DEVICE_INFO@@ �� �( ~ /; : � tagHELPWININFOA .?AUtagHELPWININFOA@@ p " �z
t wStructSize ��
t x
t y
t dx ���
t dy ���
t wMax �
�( rgchMember ���: �( tagHELPWININFOA .?AUtagHELPWININFOA@@ �( ~ �/ ^ � _SYSTEM_SPECIAL_POOL_INFORMATION .?AU_SYSTEM_SPECIAL_POOL_INFORMATION@@ ��&
" PoolTag ��
" Flags ^ �( _SYSTEM_SPECIAL_POOL_INFORMATION .?AU_SYSTEM_SPECIAL_POOL_INFORMATION@@ �� �( � "
R � _SYSTEM_CPU_SET_INFORMATION .?AU_SYSTEM_CPU_SET_INFORMATION@@ CpuSetInformation J t �( _CPU_SET_INFORMATION_TYPE .?AW4_CPU_SET_INFORMATION_TYPE@@ � �( � P
��
��
��
��
��~
" Id ���
! Group
LogicalProcessorIndex
CoreIndex
LastLevelCacheIndex ��
NumaNodeIndex
EfficiencyClass ��
AllFlags �
�( Parked ���
�( Allocated
�( AllocatedToTargetProcess �
�( RealTime �
�( ReservedFlags
" Reserved �
SchedulingClass ��
# AllocationTag : �( <anonymous-tag> .?AU<anonymous-tag>@@ �( � X 6
" Size �
�( Type �
�( CpuSet ���R �( _SYSTEM_CPU_SET_INFORMATION .?AU_SYSTEM_CPU_SET_INFORMATION@@ �( � T j � _EVENT_EXTENDED_ITEM_PROCESS_START_KEY .?AU_EVENT_EXTENDED_ITEM_PROCESS_START_KEY@@ ��
�(
�
# ProcessStartKey ��j �( _EVENT_EXTENDED_ITEM_PROCESS_START_KEY .?AU_EVENT_EXTENDED_ITEM_PROCESS_START_KEY@@ �� �( U z �(
�(
� F � _TOKEN_DEVICE_CLAIMS .?AU_TOKEN_DEVICE_CLAIMS@@ ��
�(
�
DeviceClaims �F �( _TOKEN_DEVICE_CLAIMS .?AU_TOKEN_DEVICE_CLAIMS@@ �� �( w � 2 � tagLOGBRUSH .?AUtagLOGBRUSH@@
)
� >
u lbStyle ��
" lbColor ��
" lbHatch ��2 ) tagLOGBRUSH .?AUtagLOGBRUSH@@ ) � K
�!
� > � _WOF_VERSION_INFO .?AU_WOF_VERSION_INFO@@
" WofVersion ���> ) _WOF_VERSION_INFO .?AU_WOF_VERSION_INFO@@ ) � " .
pValue ���
" ValueLength ��v ) _TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ �� ) �
" ��
" ��B
) KernelTransition �
) Reserved �
" ul ���^ ) _QUERY_PERFORMANCE_COUNTER_FLAGS .?AU_QUERY_PERFORMANCE_COUNTER_FLAGS@@ �� ) � �
~ PsProtectedTypeNone �� PsProtectedTypeProtectedLight PsProtectedTypeProtected � PsProtectedTypeMax ���> t ) _PS_PROTECTED_TYPE .?AW4_PS_PROTECTED_TYPE@@ ��� ) � { : AtomBasicInformation � AtomTableInformation �F t ) _ATOM_INFORMATION_CLASS .?AW4_ATOM_INFORMATION_CLASS@@ � ) � b � _FILE_ID_GLOBAL_TX_DIR_INFORMATION .?AU_FILE_ID_GLOBAL_TX_DIR_INFORMATION@@ ��^
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
� @ FileId ���
$ H LockingTransactionId �
" X TxInfoFlags ��
\ FileName �b ) ` _FILE_ID_GLOBAL_TX_DIR_INFORMATION .?AU_FILE_ID_GLOBAL_TX_DIR_INFORMATION@@ �� ) � + & � _DCB .?AU_DCB@@ ��
)
�
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ��
" ��
" ��R
" DCBlength
" BaudRate �
) fBinary ��
) fParity ��
!) fOutxCtsFlow �
") fOutxDsrFlow �
#) fDtrControl ��
$) fDsrSensitivity ��
%) fTXContinueOnXoff
&) fOutX
') fInX �
() fErrorChar ���
)) fNull
*) fRtsControl ��
+) fAbortOnError
,) fDummy2 ��
! wReserved
! XonLim ���
! XoffLim ��
ByteSize �
Parity ���
StopBits �
p XonChar ��
p XoffChar �
p ErrorChar
p EofChar ��
p EvtChar ��
! wReserved1 ���& -) _DCB .?AU_DCB@@ �� .) n � F � tagCOLORMATCHTOTARGET .?AUtagCOLORMATCHTOTARGET@@
0)
� r
� emr ��
" dwAction �
" dwFlags ��
" cbName ���
" cbData ���
� Data �F 2) tagCOLORMATCHTOTARGET .?AUtagCOLORMATCHTOTARGET@@ 3) � � B � _ALPC_SECURITY_ATTR .?AU_ALPC_SECURITY_ATTR@@
V
� :
" Flags
6) QoS ��
ContextHandle B 7) _ALPC_SECURITY_ATTR .?AU_ALPC_SECURITY_ATTR@@ 8) � � N � _SYSTEM_PREFETCH_OPTIONS .?AU_SYSTEM_PREFETCH_OPTIONS@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
;) LowerPriority
<) VirtualOffsets ���
=) TrickleIOs ���
>) SkipInStorePages �
?) PrefetchFilesByVa
@) SkipMemoryStorePages �
A) Spare
B) ScenarioType �N C) _SYSTEM_PREFETCH_OPTIONS .?AU_SYSTEM_PREFETCH_OPTIONS@@ �� D) � � R � _PERFINFO_IPI_RECEIVE_DATA .?AU_PERFINFO_IPI_RECEIVE_DATA@@ ��J
# InitialTime ��
WorkerRoutine
" RequestType ��R G) _PERFINFO_IPI_RECEIVE_DATA .?AU_PERFINFO_IPI_RECEIVE_DATA@@ �� H) b > f � _ETW_UMS_EVENT_DIRECTED_SWITCH_START .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_START@@ ��
J)
� f
" ProcessId
" ScheduledThreadId
" PrimaryThreadId ��
" SwitchFlags ��f L) _ETW_UMS_EVENT_DIRECTED_SWITCH_START .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_START@@ �� M) b s ^ � tagACTCTX_SECTION_KEYED_DATA_2600 .?AUtagACTCTX_SECTION_KEYED_DATA_2600@@
" cbSize ���
" ulDataFormatVersion ��
lpData ���
" ulLength �
lpSectionGlobalData ��
" ulSectionGlobalDataLength
lpSectionBase
" ulSectionTotalLength �
hActCtx ��
" $ ulAssemblyRosterIndex ^
P) ( tagACTCTX_SECTION_KEYED_DATA_2600 .?AUtagACTCTX_SECTION_KEYED_DATA_2600@@ Q) n �
�
'
� � IoSessionEventIgnore � IoSessionEventCreated IoSessionEventTerminated � IoSessionEventConnected �� IoSessionEventDisconnected ��� IoSessionEventLogon �� IoSessionEventLogoff � IoSessionEventMax : t U) _IO_SESSION_EVENT .?AW4_IO_SESSION_EVENT@@ � V) � � � SystemMemoryPartitionInformation � SystemMemoryPartitionMoveMemory �� SystemMemoryPartitionAddPagefile � SystemMemoryPartitionCombineMemory ��� SystemMemoryPartitionInitialAddMemory SystemMemoryPartitionGetMemoryEvents � SystemMemoryPartitionSetAttributes ��� SystemMemoryPartitionNodeInformation � SystemMemoryPartitionCreateLargePages SystemMemoryPartitionMax �R
t X) _PARTITION_INFORMATION_CLASS .?AW4_PARTITION_INFORMATION_CLASS@@ ��� Y) � �
n
" Length ���
� ImpersonationLevel ���
ContextTrackingMode ��
EffectiveOnly V [) _SECURITY_QUALITY_OF_SERVICE .?AU_SECURITY_QUALITY_OF_SERVICE@@ �� \) w D
f � _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA .?AU_PLUGPLAY_CONTROL_RELATED_DEVICE_DATA@@
^)
� ~
TargetDeviceInstance �
" Relation �
q RelatedDeviceInstance
" RelatedDeviceInstanceLength ��f `) _PLUGPLAY_CONTROL_RELATED_DEVICE_DATA .?AU_PLUGPLAY_CONTROL_RELATED_DEVICE_DATA@@ a) $ c N � _TIMER_BASIC_INFORMATION .?AU_TIMER_BASIC_INFORMATION@@ ��
c)
� 2
� RemainingTime
TimerState ���N e) _TIMER_BASIC_INFORMATION .?AU_TIMER_BASIC_INFORMATION@@ �� f) � �
�
� " h) i) B � _IMAGE_THUNK_DATA32 .?AU_IMAGE_THUNK_DATA32@@ ^
" ForwarderString ��
" Function �
" Ordinal ��
" AddressOfData 2 l) <anonymous-tag> .?AT<anonymous-tag>@@ m) � �
m) u1 ���B o) _IMAGE_THUNK_DATA32 .?AU_IMAGE_THUNK_DATA32@@ p) � � b � _EVENT_TRACE_TAG_FILTER_INFORMATION .?AU_EVENT_TRACE_TAG_FILTER_INFORMATION@@ V
? EventTraceInformationClass ���
# TraceHandle ��
� Filter ���b s) _EVENT_TRACE_TAG_FILTER_INFORMATION .?AU_EVENT_TRACE_TAG_FILTER_INFORMATION@@ t) @ V � _SET_PURGE_FAILURE_MODE_INPUT .?AU_SET_PURGE_FAILURE_MODE_INPUT@@
" Flags V w) _SET_PURGE_FAILURE_MODE_INPUT .?AU_SET_PURGE_FAILURE_MODE_INPUT@@ x) � �
7
� : � MOVE_FILE_DATA .?AUMOVE_FILE_DATA@@ ��
{)
� b
FileHandle ���
� StartingVcn ��
� StartingLcn ��
" ClusterCount �: }) MOVE_FILE_DATA .?AUMOVE_FILE_DATA@@ �� ~) � �
r � _EVENT_TRACE_IPT_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_IPT_CONFIGURATION_INFORMATION@@ ��b
? EventTraceInformationClass ���
# TraceHandle ��
# ConfigurationOptions �r �) _EVENT_TRACE_IPT_CONFIGURATION_INFORMATION .?AU_EVENT_TRACE_IPT_CONFIGURATION_INFORMATION@@ �� �) @ � N � _ETW_SET_MARK_INFORMATION .?AU_ETW_SET_MARK_INFORMATION@@ "
" Flag �
Mark �N �) _ETW_SET_MARK_INFORMATION .?AU_ETW_SET_MARK_INFORMATION@@ �) @ � V � _WMI_IMAGELOAD_INFORMATION64 .?AU_WMI_IMAGELOAD_INFORMATION64@@ ��
�)
� :
# ImageBase64 ��
# ImageSize64 ��
" ProcessId
" ImageChecksum
" TimeDateStamp
SignatureLevel ���
SignatureType
! Reserved0
# DefaultBase64
" ( Reserved1
" , Reserved2
" 0 Reserved3
" 4 Reserved4
8 FileName �V �) @ _WMI_IMAGELOAD_INFORMATION64 .?AU_WMI_IMAGELOAD_INFORMATION64@@ �� �) b f
�(
�
w " �)
&
� J � _ETW_WAKE_COUNTER_EVENT .?AU_ETW_WAKE_COUNTER_EVENT@@ J
Object ���
" Tag ��
" ProcessId
Count J �) _ETW_WAKE_COUNTER_EVENT .?AU_ETW_WAKE_COUNTER_EVENT@@ �) b
V � _MEMORY_WORKING_SET_EX_BLOCK .?AU_MEMORY_WORKING_SET_EX_BLOCK@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
�) Valid
�) Reserved0
�) Shared ���
�) Reserved1
�) PageTable
�) Location �
�) Priority �
�) ModifiedList �
�) Reserved2
�) SharedOriginal ���
�) Bad ��: �) <anonymous-tag> .?AU<anonymous-tag>@@ �) w ^ �
�) Valid
�) ShareCount ���
�) Win32Protection ��
�) Shared ���
�) Node �
�) Locked ���
�) LargePage
�) Priority �
�) Reserved �
�) SharedOriginal ���
�) Bad ��
�) Invalid ��V �) _MEMORY_WORKING_SET_EX_BLOCK .?AU_MEMORY_WORKING_SET_EX_BLOCK@@ �� �) w J V � _THREAD_PROFILING_INFORMATION .?AU_THREAD_PROFILING_INFORMATION@@ N � _THREAD_PERFORMANCE_DATA .?AU_THREAD_PERFORMANCE_DATA@@ ��
�)
� ^
# HardwareCounters �
" Flags
" Enable ���
�) PerformanceData ��V �) _THREAD_PROFILING_INFORMATION .?AU_THREAD_PROFILING_INFORMATION@@ �) � � z EtwRtEventNoLoss � EtwRtEventLost ��� EtwRtBufferLost �� EtwRtBackupLost �� EtwRtEventLossMax > t �) _ETW_RT_EVENT_LOSS .?AW4_ETW_RT_EVENT_LOSS@@ ��� �) b � � DeviceWakeSourceType � FixedWakeSourceType �� TimerWakeSourceType �� TimerPresumedWakeSourceType �� InternalWakeSourceType ���> t �) PO_WAKE_SOURCE_TYPE .?AW4PO_WAKE_SOURCE_TYPE@@ � �) {
V � _PROCESS_HANDLE_TRACING_QUERY .?AU_PROCESS_HANDLE_TRACING_QUERY@@
�)
� V � _PROCESS_HANDLE_TRACING_ENTRY .?AU_PROCESS_HANDLE_TRACING_ENTRY@@ �) " P �F
Handle ���
" TotalTraces ��
�) HandleTrace ��V �) X _PROCESS_HANDLE_TRACING_QUERY .?AU_PROCESS_HANDLE_TRACING_QUERY@@ �) D U
�$
� > � tagMULTIKEYHELPW .?AUtagMULTIKEYHELPW@@ ��
�)
� B
" mkSize ���
q mkKeylist
szKeyphrase ��> �) tagMULTIKEYHELPW .?AUtagMULTIKEYHELPW@@ �� �) ~ �/
�
� :
z Action ���
" Flags
" EventCode B �) POWER_ACTION_POLICY .?AUPOWER_ACTION_POLICY@@ �) { �
: � _X86_CALL_FRAME .?AU_X86_CALL_FRAME@@ ^
" ReturnAddress
" Param1 ���
" Param2 ���
" CompatibilityArea : �) _X86_CALL_FRAME .?AU_X86_CALL_FRAME@@ �) � �
. � _STRING32 .?AU_STRING32@@ B
! Length ���
! MaximumLength
" Buffer ���. �) _STRING32 .?AU_STRING32@@ �) � j � _SYSTEM_THREAD_CID_PRIORITY_INFORMATION .?AU_SYSTEM_THREAD_CID_PRIORITY_INFORMATION@@ *
ClientId �
Priority �j �) _SYSTEM_THREAD_CID_PRIORITY_INFORMATION .?AU_SYSTEM_THREAD_CID_PRIORITY_INFORMATION@@ �) �
Z � _PERFINFO_PPM_PERF_STATE_CHANGE .?AU_PERFINFO_PPM_PERF_STATE_CHANGE@@ f
" Type �
" NewState �
" OldState �
Result ���
# Processors ���Z �) _PERFINFO_PPM_PERF_STATE_CHANGE .?AU_PERFINFO_PPM_PERF_STATE_CHANGE@@ �) b R > � tagGESTURECONFIG .?AUtagGESTURECONFIG@@ ��
�)
� :
" dwID �
" dwWant ���
" dwBlock ��> �) tagGESTURECONFIG .?AUtagGESTURECONFIG@@ �� �) ~ = * � _M128A .?AU_M128A@@ ��
�)
� "
# Low ��
High �* �) _M128A .?AU_M128A@@ �� �) K � R � _SYSTEM_CONSOLE_INFORMATION .?AU_SYSTEM_CONSOLE_INFORMATION@@
" ��
" ��*
�) DriverLoaded �
�) Spare R �) _SYSTEM_CONSOLE_INFORMATION .?AU_SYSTEM_CONSOLE_INFORMATION@@ �) � � V � _PERFINFO_FILE_PATH_OPERATION .?AU_PERFINFO_FILE_PATH_OPERATION@@
�)
� �
" Irp ��
" FileObject ���
" FileKey ��
" ExtraInformation �
" IssuingThreadId ��
" InfoClass
Path �V �) _PERFINFO_FILE_PATH_OPERATION .?AU_PERFINFO_FILE_PATH_OPERATION@@ �) b t e " " �)
�!
� . � _NT_TIB64 .?AU_NT_TIB64@@
�)
� �
# ExceptionList
# StackBase
# StackLimit ���
# SubSystemTib �
# FiberData
" Version ��
# ( ArbitraryUserPointer �
# 0 Self �. �) 8 _NT_TIB64 .?AU_NT_TIB64@@ �) D ? b � _SE_LEARNING_MODE_USER_OBJECT_DATA .?AU_SE_LEARNING_MODE_USER_OBJECT_DATA@@ ��F
" Cookie ���
{ ObjectType ���
{ ObjectName ���b �) _SE_LEARNING_MODE_USER_OBJECT_DATA .?AU_SE_LEARNING_MODE_USER_OBJECT_DATA@@ �� �) � : � _ACCESS_REASONS .?AU_ACCESS_REASONS@@
*
� " " � �
* Data �: * � _ACCESS_REASONS .?AU_ACCESS_REASONS@@ * w � �
" NextEntryOffset ��
" Source ���
" MinInterval ��
" MaxInterval ��
# Reserved �
Description ��F * _PROFILE_SOURCE_INFO .?AU_PROFILE_SOURCE_INFO@@ �� * � : � _FAT_STATISTICS .?AU_FAT_STATISTICS@@
" CreateHits ���
" SuccessfulCreates
" FailedCreates
" NonCachedReads ���
" NonCachedReadBytes ���
" NonCachedWrites ��
" NonCachedWriteBytes ��
" NonCachedDiskReads ���
" NonCachedDiskWrites ��:
* $ _FAT_STATISTICS .?AU_FAT_STATISTICS@@ * � @
<
�
T#
� & � _MAT2 .?AU_MAT2@@
*
� B
� eM11 �
� eM12 �
� eM21 �
� eM22 �& * _MAT2 .?AU_MAT2@@ * � n
: � BITMAPV4HEADER .?AUBITMAPV4HEADER@@ ��
*
� �
" bV4Size ��
bV4Width �
bV4Height
! bV4Planes
! bV4BitCount ��
" bV4V4Compression �
" bV4SizeImage �
bV4XPelsPerMeter �
bV4YPelsPerMeter �
" bV4ClrUsed ���
" $ bV4ClrImportant ��
" ( bV4RedMask ���
" , bV4GreenMask �
" 0 bV4BlueMask ��
" 4 bV4AlphaMask �
" 8 bV4CSType
� < bV4Endpoints �
" ` bV4GammaRed ��
" d bV4GammaGreen
" h bV4GammaBlue �: * l BITMAPV4HEADER .?AUBITMAPV4HEADER@@ �� * � B F � _PLUGPLAY_EVENT_BLOCK .?AU_PLUGPLAY_EVENT_BLOCK@@ 2
$ ClassGuid
SymbolicLinkName �: * <anonymous-tag> .?AU<anonymous-tag>@@ * $ L
DeviceId �: * <anonymous-tag> .?AU<anonymous-tag>@@ * $ Q
DeviceId �: * <anonymous-tag> .?AU<anonymous-tag>@@ !* $ U 6
NotificationStructure
DeviceId �: #* <anonymous-tag> .?AU<anonymous-tag>@@ $* $ Y
Notification �: &* <anonymous-tag> .?AU<anonymous-tag>@@ '* $ ^ :
" NotificationCode �
" NotificationData �: )* <anonymous-tag> .?AU<anonymous-tag>@@ ** $ b :
� VetoType �
DeviceIdVetoNameBuffer ���: ,* <anonymous-tag> .?AU<anonymous-tag>@@ -* $ g
$ BlockedDriverGuid : /* <anonymous-tag> .?AU<anonymous-tag>@@ 0* $ l
ParentId �: 2* <anonymous-tag> .?AU<anonymous-tag>@@ 3* $ p j
$ PowerSettingGuid �
" Flags
" SessionId
" DataLength ���
� Data �: 5* <anonymous-tag> .?AU<anonymous-tag>@@ 6* $ t
DeviceId �: 8* <anonymous-tag> .?AU<anonymous-tag>@@ 9* $ |
DeviceId �: ;* <anonymous-tag> .?AU<anonymous-tag>@@ <* $ � z
* DeviceClass ��
* TargetDevice �
!* InstallDevice
$* CustomNotification ���
'* ProfileNotification ��
** PowerNotification
-* VetoNotification �
0* BlockedDriverNotification
3* InvalidIDNotification
6* PowerSettingNotification �
9* PropertyChangeNotification ���
<* DeviceInstanceNotification ���2 >* <anonymous-tag> .?AT<anonymous-tag>@@ ?* $ J �
$ EventGuid
�# EventCategory
" Result ���
" Flags
" TotalSize
DeviceObject �
?* $ u F A* D _PLUGPLAY_EVENT_BLOCK .?AU_PLUGPLAY_EVENT_BLOCK@@ B* $ ?
�
� N � _ALPC_MESSAGE_ATTRIBUTES .?AU_ALPC_MESSAGE_ATTRIBUTES@@ ��
E*
� >
" AllocatedAttributes ��
" ValidAttributes ��N G* _ALPC_MESSAGE_ATTRIBUTES .?AU_ALPC_MESSAGE_ATTRIBUTES@@ �� H* � � ~ NormalizationOther ��� NormalizationC ��� NormalizationD ��� NormalizationKC �� NormalizationKD ��. t J* _NORM_FORM .?AW4_NORM_FORM@@ ��� K* V A B � tagMDICREATESTRUCTA .?AUtagMDICREATESTRUCTA@@ �
� szClass ��
� szTitle ��
hOwner ���
t x
t y
t cx ���
t cy ���
" style
lParam ���B N* $ tagMDICREATESTRUCTA .?AUtagMDICREATESTRUCTA@@ O* ~ �. 6 � tagPOLYTEXTA .?AUtagPOLYTEXTA@@ ��
Q*
� j
t x
t y
u n
� lpstr
u uiFlags ��
rcl ��
t $ pdx ��6 S* ( tagPOLYTEXTA .?AUtagPOLYTEXTA@@ �� T* � =
� EtwStartLoggerCode ��� EtwStopLoggerCode EtwQueryLoggerCode ��� EtwUpdateLoggerCode �� EtwFlushLoggerCode ��� EtwIncrementFileCode � EtwActivityIdCreate ��
EtwWdiScenarioCode ��� EtwWdiSemUpdate ��> t V* ETWTRACECONTROLCODE .?AW4ETWTRACECONTROLCODE@@ � W* @ < f � _PERFINFO_SAMPLED_PROFILE_INFORMATION .?AU_PERFINFO_SAMPLED_PROFILE_INFORMATION@@
Y*
�
��
��
��
��
InstructionPointer ���
" ThreadId �
! Count
[*
ExecutingDpc �
\*
ExecutingIsr �
]*
Reserved �
^*
Priority �
Flags
Rank �f _* _PERFINFO_SAMPLED_PROFILE_INFORMATION .?AU_PERFINFO_SAMPLED_PROFILE_INFORMATION@@ `* b { v ServiceRegistryStateParameters ��� ServiceRegistryStatePersistent ��� MaxServiceRegistryStateType ��N t b* SERVICE_REGISTRY_STATE_TYPE .?AW4SERVICE_REGISTRY_STATE_TYPE@@ � c* � J � _ENCLAVE_INIT_INFO_VBS .?AU_ENCLAVE_INIT_INFO_VBS@@ ��.
" Length ���
" ThreadCount ��J f* _ENCLAVE_INIT_INFO_VBS .?AU_ENCLAVE_INIT_INFO_VBS@@ �� g* � � f � _FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT .?AU_FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT@@ ��
" NumaNode �f j* _FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT .?AU_FSCTL_QUERY_VOLUME_NUMA_INFO_OUTPUT@@ �� k* � �* V � _ETW_TP_EVENT_CALLBACK_CANCEL .?AU_ETW_TP_EVENT_CALLBACK_CANCEL@@
m*
� �
m Header ���
PoolId ���
$ TaskId ���
( Callback �
, Context ��
0 SubProcessTag
" 4 CancelCount ��V o* 8 _ETW_TP_EVENT_CALLBACK_CANCEL .?AU_ETW_TP_EVENT_CALLBACK_CANCEL@@ p* b � J � _FILE_PIPE_PEEK_BUFFER .?AU_FILE_PIPE_PEEK_BUFFER@@ ��~
" NamedPipeState ���
" ReadDataAvailable
" NumberOfMessages �
" MessageLength
Data �J s* _FILE_PIPE_PEEK_BUFFER .?AU_FILE_PIPE_PEEK_BUFFER@@ �� t* � ) �
" dwStreamNumber ���
" dwReserved ���
hSourceFile ��
hDestinationFile �
� uliChunkNumber ���
� uliChunkSize �
� uliStreamSize
� ( uliTotalFileSize �: v* 0 <anonymous-tag> .?AU<anonymous-tag>@@ w* n c
" dwStreamNumber ���
" dwFlags ��
hSourceFile ��
hDestinationFile �
� uliChunkNumber ���
� uliChunkSize �
� uliStreamSize
� ( uliStreamBytesTransferred
� 0 uliTotalFileSize �
� 8 uliTotalBytesTransferred �:
y* @ <anonymous-tag> .?AU<anonymous-tag>@@ z* n n �
" dwStreamNumber ���
" dwReserved ���
hSourceFile ��
hDestinationFile �
� uliStreamSize
� uliTotalFileSize �: |* <anonymous-tag> .?AU<anonymous-tag>@@ }* n { �
" dwStreamNumber ���
" dwReserved ���
hSourceFile ��
hDestinationFile �
� uliStreamSize
� uliStreamBytesTransferred
� uliTotalFileSize �
� ( uliTotalBytesTransferred �: * 0 <anonymous-tag> .?AU<anonymous-tag>@@ �* n �
" dwReserved ���: �* <anonymous-tag> .?AU<anonymous-tag>@@ �* n � COPYFILE2_PHASE_NONE � COPYFILE2_PHASE_PREPARE_SOURCE ��� COPYFILE2_PHASE_PREPARE_DEST � COPYFILE2_PHASE_READ_SOURCE �� COPYFILE2_PHASE_WRITE_DESTINATION COPYFILE2_PHASE_SERVER_COPY �� COPYFILE2_PHASE_NAMEGRAFT_COPY ��� COPYFILE2_PHASE_MAX ��B t �* _COPYFILE2_COPY_PHASE .?AW4_COPYFILE2_COPY_PHASE@@ � �* n N �
�* CopyPhase
" dwStreamNumber ���
hrFailure
" dwReserved ���
� uliChunkNumber ���
� uliStreamSize
� uliStreamBytesTransferred
� ( uliTotalFileSize �
� 0 uliTotalBytesTransferred �: �* 8 <anonymous-tag> .?AU<anonymous-tag>@@ �* n � �
w* ChunkStarted �
z* ChunkFinished
}* StreamStarted
�* StreamFinished ���
�* PollContinue �
�* Error 2 �* @ <anonymous-tag> .?AT<anonymous-tag>@@ �* n a 6
2' Type �
" dwPadding
�* Info �> �* H COPYFILE2_MESSAGE .?AUCOPYFILE2_MESSAGE@@ �* n \ V � _MEMORY_PRIORITY_INFORMATION .?AU_MEMORY_PRIORITY_INFORMATION@@ ��
" MemoryPriority ���V �* _MEMORY_PRIORITY_INFORMATION .?AU_MEMORY_PRIORITY_INFORMATION@@ �� �* � :
�
� > � _KEY_EVENT_RECORD .?AU_KEY_EVENT_RECORD@@ .
q UnicodeChar ��
p AsciiChar 2 �* <anonymous-tag> .?AT<anonymous-tag>@@ �* � 5 �
t bKeyDown �
! wRepeatCount �
! wVirtualKeyCode ��
! wVirtualScanCode �
�*
uChar
" dwControlKeyState > �* _KEY_EVENT_RECORD .?AU_KEY_EVENT_RECORD@@ �* � 0 Z � _PLUGPLAY_CONTROL_INSTALL_DATA .?AU_PLUGPLAY_CONTROL_INSTALL_DATA@@ ��.
" BufferLength �
q Buffer ���Z �* _PLUGPLAY_CONTROL_INSTALL_DATA .?AU_PLUGPLAY_CONTROL_INSTALL_DATA@@ �� �* $ � . � _TP_TIMER .?AU_TP_TIMER@@
�*
� � �* �*
�*
� 6 � tagTOUCHINPUT .?AUtagTOUCHINPUT@@ �
x
y
hSource ��
" dwID �
" dwFlags ��
" dwMask ���
" dwTime ���
" dwExtraInfo ��
" cxContact
" $ cyContact 6
�* ( tagTOUCHINPUT .?AUtagTOUCHINPUT@@ �* ~ b � _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_EX@@ v
ClientSession
ClientProcess
! ClientComputerNameLength �
�
ClientComputerBuffer �b �* , _FILE_PIPE_CLIENT_PROCESS_BUFFER_EX .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_EX@@ �* � K) � JOBOBJECT_IO_ATTRIBUTION_CONTROL_ENABLE �� JOBOBJECT_IO_ATTRIBUTION_CONTROL_DISABLE � JOBOBJECT_IO_ATTRIBUTION_CONTROL_VALID_FLAGS �f t �* JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS .?AW4JOBOBJECT_IO_ATTRIBUTION_CONTROL_FLAGS@@ ��� �* D � � DISPLAYCONFIG_PIXELFORMAT_8BPP ��� DISPLAYCONFIG_PIXELFORMAT_16BPP �� DISPLAYCONFIG_PIXELFORMAT_24BPP �� DISPLAYCONFIG_PIXELFORMAT_32BPP �� DISPLAYCONFIG_PIXELFORMAT_NONGDI � ��DISPLAYCONFIG_PIXELFORMAT_FORCE_UINT32 ��J t �* DISPLAYCONFIG_PIXELFORMAT .?AW4DISPLAYCONFIG_PIXELFORMAT@@ � �* � R
2
� PoSleepDisableReasonVideo PoSleepDisableReasonHypervisor ��� PoSleepDisableReasonVhdBoot �� PoSleepDisableReasonPortableWorkspace PoSleepDisableReasonPolicy ��� PoSleepDisableReasonGuardedHost �� PoSleepDisableReasonMax ��J t �* _PO_SLEEP_DISABLE_REASON .?AW4_PO_SLEEP_DISABLE_REASON@@ ��� �* { F
R � _HEAP_AFFINITY_SLOT_ASSIGN .?AU_HEAP_AFFINITY_SLOT_ASSIGN@@ ��Z
m Header ���
HeapHandle ���
$ SubSegment ���
" ( SlotIndex R �* , _HEAP_AFFINITY_SLOT_ASSIGN .?AU_HEAP_AFFINITY_SLOT_ASSIGN@@ �� �* b t
|#
� 6 NotificationEvent SynchronizationEvent �. t �* _EVENT_TYPE .?AW4_EVENT_TYPE@@ � �* � t
�*
�
� DataBuffer ���: �* <anonymous-tag> .?AU<anonymous-tag>@@ �* � V# �
" ReparseTag ���
! ReparseDataLength
! Reserved �
$ ReparseGuid ��
�* GenericReparseBuffer �N �* _REPARSE_GUID_DATA_BUFFER .?AU_REPARSE_GUID_DATA_BUFFER@@ �* � Q# F � tagWNODE_SINGLE_ITEM .?AUtagWNODE_SINGLE_ITEM@@ ��
� WnodeHeader ��
" 0 OffsetInstanceName ���
" 4 InstanceIndex
" 8 ItemId ���
" < DataBlockOffset ��
" @ SizeDataItem �
� D VariableData �F �* H tagWNODE_SINGLE_ITEM .?AUtagWNODE_SINGLE_ITEM@@ �� �* � � > � tagDRAWITEMSTRUCT .?AUtagDRAWITEMSTRUCT@@
�*
� �
u CtlType ��
u CtlID
u itemID ���
u itemAction ���
u itemState
� hwndItem �
� hDC ��
rcItem ���
" , itemData �> �* 0 tagDRAWITEMSTRUCT .?AUtagDRAWITEMSTRUCT@@ �* ~
t"
� N
! Flags
! Length ���
" TimeStamp
� DosPath ��N �* _RTL_DRIVE_LETTER_CURDIR .?AU_RTL_DRIVE_LETTER_CURDIR@@ �� �* <
�
� B � tagKBDLLHOOKSTRUCT .?AUtagKBDLLHOOKSTRUCT@@ ��
�*
� b
" vkCode ���
" scanCode �
" flags
" time �
" dwExtraInfo ��B �* tagKBDLLHOOKSTRUCT .?AUtagKBDLLHOOKSTRUCT@@ �� �* ~ [ V � _SECTION_IMAGE_INFORMATION32 .?AU_SECTION_IMAGE_INFORMATION32@@ ��
�*
�
��
��
��n
" TransferAddress ��
" ZeroBits �
" MaximumStackSize �
" CommittedStackSize ���
" SubSystemType
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���
! ImageCharacteristics �
! DllCharacteristics ���
! Machine ��
" ImageContainsCode
# ImageFlags ���
�* # ComPlus ��
�* # ImageDynamicallyRelocated
�* # Reserved �
" $ LoaderFlags ��
" ( ImageFileSize
" , CheckSum �V �* 0 _SECTION_IMAGE_INFORMATION32 .?AU_SECTION_IMAGE_INFORMATION32@@ �� �* w � Z � _FILE_IO_COMPLETION_INFORMATION .?AU_FILE_IO_COMPLETION_INFORMATION@@ > � _IO_STATUS_BLOCK .?AU_IO_STATUS_BLOCK@@ ��J
KeyContext ���
ApcContext ���
�* IoStatusBlock Z �* _FILE_IO_COMPLETION_INFORMATION .?AU_FILE_IO_COMPLETION_INFORMATION@@ �* 7! �
W!
� b � _SYSTEM_SESSION_PROCESS_INFORMATION .?AU_SYSTEM_SESSION_PROCESS_INFORMATION@@
�*
� >
" SessionId
" SizeOfBuf
Buffer ���b �* _SYSTEM_SESSION_PROCESS_INFORMATION .?AU_SYSTEM_SESSION_PROCESS_INFORMATION@@ �* � @ : � tagEXTLOGFONTW .?AUtagEXTLOGFONTW@@ ��
�*
� " ��
elfLogFont ���
\ elfFullName ��
� elfStyle �
" elfVersion ���
" elfStyleSize �
" $elfMatch �
" (elfReserved ��
�* ,elfVendorId ��
" 0elfCulture ���
4elfPanose :
�* @tagEXTLOGFONTW .?AUtagEXTLOGFONTW@@ �� �* � b � _TRANSACTION_PROPERTIES_INFORMATION .?AU_TRANSACTION_PROPERTIES_INFORMATION@@
�*
� �
" IsolationLevel ���
" IsolationFlags ���
� Timeout ��
" Outcome ��
" DescriptionLength
Description ��b �* _TRANSACTION_PROPERTIES_INFORMATION .?AU_TRANSACTION_PROPERTIES_INFORMATION@@ �* � � B � _FOCUS_EVENT_RECORD .?AU_FOCUS_EVENT_RECORD@@
�*
�
t bSetFocus B �* _FOCUS_EVENT_RECORD .?AU_FOCUS_EVENT_RECORD@@ �* � v
�
� R � _ETW_UMS_EVENT_DISASSOCIATE .?AU_ETW_UMS_EVENT_DISASSOCIATE@@ �
" ProcessId
" ScheduledThreadId
" PrimaryThreadId ��
" UmsApcControlFlags ���
Status ���R + _ETW_UMS_EVENT_DISASSOCIATE .?AU_ETW_UMS_EVENT_DISASSOCIATE@@ + b � J � _ETW_HEAP_EVENT_CREATE .?AU_ETW_HEAP_EVENT_CREATE@@ ��
m Header ���
HeapHandle ���
" $ Flags
" ( ReserveSize ��
" , CommitSize ���
" 0 AllocatedSize J + 4 _ETW_HEAP_EVENT_CREATE .?AU_ETW_HEAP_EVENT_CREATE@@ �� + b > � tagCREATESTRUCTA .?AUtagCREATESTRUCTA@@ ��
+
� �
lpCreateParams ���
4 hInstance
� hMenu
� hwndParent ���
t cy ���
t cx ���
t y
t x
style
� $ lpszName �
� ( lpszClass
" , dwExStyle > + 0 tagCREATESTRUCTA .?AUtagCREATESTRUCTA@@ ��
+ ~ z B � _OUTLINETEXTMETRICW .?AU_OUTLINETEXTMETRICW@@
+
� Z
u otmSize ��
otmTextMetrics ���
@ otmFiller
A otmPanoseNumber ��
u L otmfsSelection ���
u P otmfsType
t T otmsCharSlopeRise
t X otmsCharSlopeRun �
t \ otmItalicAngle ���
u ` otmEMSquare ��
t d otmAscent
t h otmDescent ���
u l otmLineGap ���
u p otmsCapEmHeight ��
u t otmsXHeight ��
x otmrcFontBox �
t � otmMacAscent �
t � otmMacDescent
u � otmMacLineGap
u � otmusMinimumPPEM �
� � otmptSubscriptSize ���
� � otmptSubscriptOffset �
� � otmptSuperscriptSize �
� � otmptSuperscriptOffset ���
u � otmsStrikeoutSize
t � otmsStrikeoutPosition
t � otmsUnderscoreSize ���
t � otmsUnderscorePosition ���
p � otmpFamilyName ���
p � otmpFaceName �
p � otmpStyleName
p � otmpFullName �B + � _OUTLINETEXTMETRICW .?AU_OUTLINETEXTMETRICW@@ + �
� CmResourceShareUndetermined �� CmResourceShareDeviceExclusive ��� CmResourceShareDriverExclusive ��� CmResourceShareShared B t + _CM_SHARE_DISPOSITION .?AW4_CM_SHARE_DISPOSITION@@ � + b � _MEMORY_WORKING_SET_EX_INFORMATION .?AU_MEMORY_WORKING_SET_EX_INFORMATION@@ ��.
�) VirtualAttributes
" Long �2 + <anonymous-tag> .?AT<anonymous-tag>@@ + w z .
VirtualAddress ���
+ u1 ���b + _MEMORY_WORKING_SET_EX_INFORMATION .?AU_MEMORY_WORKING_SET_EX_INFORMATION@@ �� + w x n � _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2@@ ��b � _JOBOBJECT_BASIC_LIMIT_INFORMATION .?AU_JOBOBJECT_BASIC_LIMIT_INFORMATION@@ ���
+ BasicLimitInformation
� 0 IoInfo ���
" ` ProcessMemoryLimit ���
" d JobMemoryLimit ���
" h PeakProcessMemoryUsed
" l PeakJobMemoryUsed
" p JobTotalMemoryLimit ��n + x _JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION_V2@@ �� + D o j � _MEMORY_PHYSICAL_CONTIGUITY_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_INFORMATION@@
w
� �
VirtualAddress ���
" Size �
" ContiguityUnitSize ���
" Flags
!+ ContiguityUnitInformation j "+ _MEMORY_PHYSICAL_CONTIGUITY_INFORMATION .?AU_MEMORY_PHYSICAL_CONTIGUITY_INFORMATION@@ #+ w �
1#
� B � PPM_IDLESTATE_EVENT .?AUPPM_IDLESTATE_EVENT@@
&+
� B
" NewState �
" OldState �
# Processors ���B (+ PPM_IDLESTATE_EVENT .?AUPPM_IDLESTATE_EVENT@@ )+ { �
N � _VOLUME_REFS_INFO_BUFFER .?AU_VOLUME_REFS_INFO_BUFFER@@ ��b
� CacheSizeInBytes �
� AllocatedCacheInBytes
� PopulatedCacheInBytes
� InErrorCacheInBytes ��
� MemoryUsedForCacheMetadata ���
" ( CacheLineSize
, CacheTransactionsOutstanding �
0 CacheLinesFree ���
4 CacheLinesInError
� 8 CacheHitsInBytes �
� @ CacheMissesInBytes ���
� H CachePopulationUpdatesInBytes
� P CacheWriteThroughUpdatesInBytes ��
� X CacheInvalidationsInBytes
� ` CacheOverReadsInBytes
� h MetadataWrittenBytes �
p CacheHitCounter ��
t CacheMissCounter �
x CacheLineAllocationCounter ���
| CacheInvalidationsCounter
� CachePopulationUpdatesCounter
� CacheWriteThroughUpdatesCounter ��
� MaxCacheTransactionsOutstanding ��
� DataWritesReallocationCount ��
� DataInPlaceWriteCount
� MetadataAllocationsFastTierCount �
� MetadataAllocationsSlowTierCount �
� DataAllocationsFastTierCount �
� DataAllocationsSlowTierCount �
� DestagesSlowTierToFastTier ���
� DestagesFastTierToSlowTier ���
� SlowTierDataFillRatio
� FastTierDataFillRatio
� SlowTierMetadataFillRatio
� FastTierMetadataFillRatio
� SlowToFastDestageReadLatency �
� SlowToFastDestageReadLatencyBase �
� SlowToFastDestageWriteLatency
� SlowToFastDestageWriteLatencyBase
� FastToSlowDestageReadLatency �
� FastToSlowDestageReadLatencyBase �
� FastToSlowDestageWriteLatency
� FastToSlowDestageWriteLatencyBase
� SlowTierContainerFillRatio ���
� SlowTierContainerFillRatioBase ���
� FastTierContainerFillRatio ���
� FastTierContainerFillRatioBase ���
� TreeUpdateLatency
� TreeUpdateLatencyBase
� CheckpointLatency
� CheckpointLatencyBase
� TreeUpdateCount ��
CheckpointCount ��
LogWriteCount
LogFillRatio �
ReadCacheInvalidationsForOverwrite ���
ReadCacheInvalidationsForReuse ���
ReadCacheInvalidationsGeneral
ReadCacheChecksOnMount ���
ReadCacheIssuesOnMount ���
TrimLatency ��
$TrimLatencyBase ��
(DataCompactionCount ��
,CompactionReadLatency
0CompactionReadLatencyBase
4CompactionWriteLatency ���
8CompactionWriteLatencyBase ���
� @DataInPlaceWriteClusterCount �
HCompactionFailedDueToIneligibleContainer �
LCompactionFailedDueToMaxFragmentation
PCompactedContainerFillRatio ��
TCompactedContainerFillRatioBase ��
XContainerMoveRetryCount ��
\ContainerMoveFailedDueToIneligibleContainer ��
`CompactionFailureCount ���
dContainerMoveFailureCount
� hNumberOfDirtyMetadataPages ���
pNumberOfDirtyTableListEntries
tNumberOfDeleteQueueEntries ���N O ,+ x_VOLUME_REFS_INFO_BUFFER .?AU_VOLUME_REFS_INFO_BUFFER@@ �� -+ � �)
�!
� n � _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION@@ ��
# CycleTime n 1+ _SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION .?AU_SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION@@ �� 2+ � � J � _RTL_UNLOAD_EVENT_TRACE .?AU_RTL_UNLOAD_EVENT_TRACE@@ �
BaseAddress ��
" SizeOfImage ��
" Sequence �
" TimeDateStamp
" CheckSum �
ImageName
7 T Version ��J 5+ \ _RTL_UNLOAD_EVENT_TRACE .?AU_RTL_UNLOAD_EVENT_TRACE@@ 6+ � � J � _RTL_CIRCULAR_LIST_HEAD .?AU_RTL_CIRCULAR_LIST_HEAD@@
!
�
9+ HeadEntry J :+ _RTL_CIRCULAR_LIST_HEAD .?AU_RTL_CIRCULAR_LIST_HEAD@@ ;+ � j ShutdownNoReboot � ShutdownReboot ��� ShutdownPowerOff � ShutdownRebootForRecovery : t =+ _SHUTDOWN_ACTION .?AW4_SHUTDOWN_ACTION@@ ��� >+ � 9 Z � _FSCTL_UNMAP_SPACE_INPUT_BUFFER .?AU_FSCTL_UNMAP_SPACE_INPUT_BUFFER@@
� BytesToUnmap �Z A+ _FSCTL_UNMAP_SPACE_INPUT_BUFFER .?AU_FSCTL_UNMAP_SPACE_INPUT_BUFFER@@ B+ � �* z � _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION@@ ��*
n( BasicInfo
� 0 IoInfo ���z E+ ` _JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_AND_IO_ACCOUNTING_INFORMATION@@ �� F+ D � .
" SizeOfBitMap �
" Buffer ���2 H+ _RTL_BITMAP .?AU_RTL_BITMAP@@ I+ g f b � _SYSTEM_FEATURE_CONFIGURATION_QUERY .?AU_SYSTEM_FEATURE_CONFIGURATION_QUERY@@
K+
� r RtlFeatureConfigurationBoot �� RtlFeatureConfigurationRuntime ��� RtlFeatureConfigurationCount �V t M+ _RTL_FEATURE_CONFIGURATION_TYPE .?AW4_RTL_FEATURE_CONFIGURATION_TYPE@@ � N+ t 2
N+ ConfigurationType
u FeatureId b P+ _SYSTEM_FEATURE_CONFIGURATION_QUERY .?AU_SYSTEM_FEATURE_CONFIGURATION_QUERY@@ Q+ � ^
O S+ * � HIMC__ .?AUHIMC__@@ ��
U+
�
t unused ���* W+ HIMC__ .?AUHIMC__@@ �� X+ � : GetFileExInfoStandard GetFileExMaxInfoLevel F t Z+ _GET_FILEEX_INFO_LEVELS .?AW4_GET_FILEEX_INFO_LEVELS@@ � [+ � �
0!
� B � tagEMRSETICMPROFILE .?AUtagEMRSETICMPROFILE@@ ^
� emr ��
" dwFlags ��
" cbName ���
" cbData ���
� Data �B _+ tagEMRSETICMPROFILE .?AUtagEMRSETICMPROFILE@@ `+ � � J � _ENCLAVE_LOAD_INFO_VBS .?AU_ENCLAVE_LOAD_INFO_VBS@@ ��V
ImageHandle ��
# Unused ���
! NameLength ���
Name �J c+ _ENCLAVE_LOAD_INFO_VBS .?AU_ENCLAVE_LOAD_INFO_VBS@@ �� d+ � � > � _WAKE_TIMER_INFO .?AU_WAKE_TIMER_INFO@@ ��B � _DIAGNOSTIC_BUFFER .?AU_DIAGNOSTIC_BUFFER@@ ��Z
" OffsetToNext �
� DueTime ��
" Period ���
g+ ReasonContext > h+ 0 _WAKE_TIMER_INFO .?AU_WAKE_TIMER_INFO@@ �� i+ { � * � BSMINFO .?AUBSMINFO@@
k+
� * � HDESK__ .?AUHDESK__@@
m+
� F
u cbSize ���
n+ hdesk
� hwnd �
� luid �* o+ BSMINFO .?AUBSMINFO@@ p+ ~ � : � tagMDINEXTMENU .?AUtagMDINEXTMENU@@ ��
r+
� >
� hmenuIn ��
� hmenuNext
� hwndNext �: t+ tagMDINEXTMENU .?AUtagMDINEXTMENU@@ �� u+ ~ 0 n � _PROCESS_REVOKE_FILE_HANDLES_INFORMATION .?AU_PROCESS_REVOKE_FILE_HANDLES_INFORMATION@@ ��
TargetDevicePath �n x+ _PROCESS_REVOKE_FILE_HANDLES_INFORMATION .?AU_PROCESS_REVOKE_FILE_HANDLES_INFORMATION@@ �� y+ D : F � _ETW_SET_TIMER_EVENT .?AU_ETW_SET_TIMER_EVENT@@ ���
# ExpectedDueTime ��
" TimerAddress �
! TargetProcessorGroup �
TargetProcessorIndex �
Flags
" Period ���
EncodedDelay �
Reserved0
! UniqueProcessId ��F |+ _ETW_SET_TIMER_EVENT .?AU_ETW_SET_TIMER_EVENT@@ �� }+ b � B � _CONNECTDLGSTRUCTW .?AU_CONNECTDLGSTRUCTW@@ ��6 � _NETRESOURCEW .?AU_NETRESOURCEW@@
�+
� j
" cbStructure ��
� hwndOwner
�+ lpConnRes
" dwFlags ��
" dwDevNum �B �+ _CONNECTDLGSTRUCTW .?AU_CONNECTDLGSTRUCTW@@ �� �+ � �
"
� J � _ETW_REGNOTIF_REGISTER .?AU_ETW_REGNOTIF_REGISTER@@ ��b
Notification �
Kcb ��
Type �
WatchTree
Primary ��J �+ _ETW_REGNOTIF_REGISTER .?AU_ETW_REGNOTIF_REGISTER@@ �� �+ b � : � tagSERIALKEYSA .?AUtagSERIALKEYSA@@ ��
u cbSize ���
" dwFlags ��
p lpszActivePort ���
p lpszPort �
u iBaudRate
u iPortState ���
u iActive ��: �+ tagSERIALKEYSA .?AUtagSERIALKEYSA@@ �� �+ ~ H2 B � tagMOUSEHOOKSTRUCT .?AUtagMOUSEHOOKSTRUCT@@ ��
�+
� R
� pt ���
� hwnd �
u wHitTestCode �
" dwExtraInfo ��B �+ tagMOUSEHOOKSTRUCT .?AUtagMOUSEHOOKSTRUCT@@ �� �+ ~ � F � IMPORT_OBJECT_HEADER .?AUIMPORT_OBJECT_HEADER@@ ��
! ��
! ��
! ���
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
" SizeOfData ���
! Ordinal ��
! Hint �
�+ Type �
�+ NameType �
�+ Reserved �F �+ IMPORT_OBJECT_HEADER .?AUIMPORT_OBJECT_HEADER@@ �� �+ � q : � _REASON_CONTEXT .?AU_REASON_CONTEXT@@
�+
� r
� LocalizedReasonModule
" LocalizedReasonId
" ReasonStringCount
� ReasonStrings : �+ <anonymous-tag> .?AU<anonymous-tag>@@ �+ �
6
�+ Detailed �
q SimpleReasonString ���2 �+ <anonymous-tag> .?AT<anonymous-tag>@@ �+ � :
" Version ��
" Flags
�+ Reason ���: �+ _REASON_CONTEXT .?AU_REASON_CONTEXT@@ �+ � > OS_DEPLOYMENT_STANDARD ��� OS_DEPLOYMENT_COMPACT R t �+ _OS_DEPLOYEMENT_STATE_VALUES .?AW4_OS_DEPLOYEMENT_STATE_VALUES@@ ��� �+ g �# ^ � _SYSTEM_POOL_ZEROING_INFORMATION .?AU_SYSTEM_POOL_ZEROING_INFORMATION@@ ��
�+
� &
PoolZeroingSupportPresent ^ �+ _SYSTEM_POOL_ZEROING_INFORMATION .?AU_SYSTEM_POOL_ZEROING_INFORMATION@@ �� �+ � � Z � _PERFINFO_FILE_SIMPLE_OPERATION .?AU_PERFINFO_FILE_SIMPLE_OPERATION@@ Z
" Irp ��
" FileObject ���
" FileKey ��
" IssuingThreadId ��Z �+ _PERFINFO_FILE_SIMPLE_OPERATION .?AU_PERFINFO_FILE_SIMPLE_OPERATION@@ �+ b �
SystemProcessClassificationNormal SystemProcessClassificationSystem SystemProcessClassificationSecureSystem �� SystemProcessClassificationMemCompression SystemProcessClassificationRegistry �� SystemProcessClassificationMaximum ���V t �+ _SYSTEM_PROCESS_CLASSIFICATION .?AW4_SYSTEM_PROCESS_CLASSIFICATION@@ ��� �+ �
� ��
�+
� v � _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION .?AU_ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION@@
�+ ��
�+
� Z � _COMPATIBILITY_CONTEXT_ELEMENT .?AU_COMPATIBILITY_CONTEXT_ELEMENT@@ �� �+ " �.
" ElementCount �
�+ Elements �v �+ _ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION .?AU_ACTIVATION_CONTEXT_COMPATIBILITY_INFORMATION@@ �+ � J � _RTLP_HEAP_TAGGING_INFO .?AU_RTLP_HEAP_TAGGING_INFO@@ : � _RTLP_TAG_INFO .?AU_RTLP_TAG_INFO@@ �� �+ " �f
! Version ��
! Flags
Process ��
" EntriesCount �
�+ Entries ��J �+ _RTLP_HEAP_TAGGING_INFO .?AU_RTLP_HEAP_TAGGING_INFO@@ �+ � �
!
� " @ �Z
� elfLogFont ���
�+ < elfFullName ��
� | elfStyle �
� � elfScript > �+ � tagENUMLOGFONTEXA .?AUtagENUMLOGFONTEXA@@ �+ � � F � _MM_ETW_PAGE_INFO_EX .?AU_MM_ETW_PAGE_INFO_EX@@ ��
�+
� > � _MM_ETW_PAGE_INFO .?AU_MM_ETW_PAGE_INFO@@ &
�+ PageInfo �
�! Info �F �+ _MM_ETW_PAGE_INFO_EX .?AU_MM_ETW_PAGE_INFO_EX@@ �� �+ w S V IMO_UNAVAILABLE �� IMO_HARDWARE � IMO_INJECTED � IMO_SYSTEM ���N t �+ tagINPUT_MESSAGE_ORIGIN_ID .?AW4tagINPUT_MESSAGE_ORIGIN_ID@@ ��� �+ ~ �=
s
� J � _IMAGE_BASE_RELOCATION .?AU_IMAGE_BASE_RELOCATION@@ ��
�+ ��
�+
� 6
" VirtualAddress ���
" SizeOfBlock ��J �+ _IMAGE_BASE_RELOCATION .?AU_IMAGE_BASE_RELOCATION@@ �� �+ � $ ^ � _RTL_QUERY_DEBUG_VIRTUAL_PROCESS .?AU_RTL_QUERY_DEBUG_VIRTUAL_PROCESS@@ �� " " �+
�+
� � " " �+
�+
� V
Context ��
�+ ReadMemoryRoutine
�+ QueryInformationRoutine ��^ �+ _RTL_QUERY_DEBUG_VIRTUAL_PROCESS .?AU_RTL_QUERY_DEBUG_VIRTUAL_PROCESS@@ �� �+ � . > � _OSVERSIONINFOEXW .?AU_OSVERSIONINFOEXW@@
�+
�
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
�$ szCSDVersion �
! wServicePackMajor
! wServicePackMinor
! wSuiteMask ���
wProductType �
wReserved > �+ _OSVERSIONINFOEXW .?AU_OSVERSIONINFOEXW@@ �+ g �
M
� 2 � _MUICCENTRY .?AU_MUICCENTRY@@
�+
� �+ " � t " �
u lCultureNameOffset ���
u ulCultureID ��
" ulLanguageType ���
�+ pNeutralCulture ��
�+ lBaseLanguageIndices �
�+ lParentLanguageIndices ���2 �+ 0 _MUICCENTRY .?AU_MUICCENTRY@@ �+ : � _CLIENT_CALL_RETURN .?AT_CLIENT_CALL_RETURN@@ *
Pointer ��
Simple ���: �+ _CLIENT_CALL_RETURN .?AT_CLIENT_CALL_RETURN@@ �+ � � V � _MEMORY_PARTITION_PAGE_RANGE .?AU_MEMORY_PARTITION_PAGE_RANGE@@ ��.
" StartPage
" NumberOfPages V �+ _MEMORY_PARTITION_PAGE_RANGE .?AU_MEMORY_PARTITION_PAGE_RANGE@@ �� �+ w � Z � _PERFINFO_DRIVER_MAJORFUNCTION .?AU_PERFINFO_DRIVER_MAJORFUNCTION@@ ��
�+
� �
" MajorFunction
" MinorFunction
RoutineAddr ��
FileNamePointer ��
Irp ��
" UniqMatchId ��Z �+ _PERFINFO_DRIVER_MAJORFUNCTION .?AU_PERFINFO_DRIVER_MAJORFUNCTION@@ �� �+ b � � " � t �+
�+
� : � _MODEMSETTINGS .?AU_MODEMSETTINGS@@ ��j
" dwActualSize �
" dwRequiredSize ���
" dwDevSpecificOffset ��
" dwDevSpecificSize
" dwCallSetupFailTimer �
" dwInactivityTimeout ��
" dwSpeakerVolume ��
" dwSpeakerMode
" dwPreferredModemOptions ��
" $ dwNegotiatedModemOptions �
" ( dwNegotiatedDCERate ��
� , abVariablePortion : , 0 _MODEMSETTINGS .?AU_MODEMSETTINGS@@ ��& onecore\external\sdk\inc\mcx.h � , , 2
M*
� R � _FILE_DIRECTORY_INFORMATION .?AU_FILE_DIRECTORY_INFORMATION@@
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
@ FileName �R , H _FILE_DIRECTORY_INFORMATION .?AU_FILE_DIRECTORY_INFORMATION@@ , � � Z � _RTL_SEGMENT_HEAP_MEMORY_SOURCE .?AU_RTL_SEGMENT_HEAP_MEMORY_SOURCE@@ " " �r
" Flags
" MemoryTypeMask ���
" NumaNode �
PartitionHandle ��
, Reserved �Z , _RTL_SEGMENT_HEAP_MEMORY_SOURCE .?AU_RTL_SEGMENT_HEAP_MEMORY_SOURCE@@
, g �
6
" dwLowDateTime
" dwHighDateTime ���. , _FILETIME .?AU_FILETIME@@ , �' N � _CM_PARTIAL_RESOURCE_LIST .?AU_CM_PARTIAL_RESOURCE_LIST@@
,
� a " �Z
! Version ��
! Revision �
" Count
, PartialDescriptors ���N , _CM_PARTIAL_RESOURCE_LIST .?AU_CM_PARTIAL_RESOURCE_LIST@@ , U 2 � FLASHWINFO .?AUFLASHWINFO@@ ��
,
� b
u cbSize ���
� hwnd �
" dwFlags ��
u uCount ���
" dwTimeout 2 , FLASHWINFO .?AUFLASHWINFO@@ �� , ~ : ~ " ,
� f � _RTL_USER_PROCESS_EXTENDED_PARAMETERS .?AU_RTL_USER_PROCESS_EXTENDED_PARAMETERS@@
,
� �
! Version ��
! NodeNumber ���
ProcessSecurityDescriptor
ThreadSecurityDescriptor �
ParentProcess
DebugPort
TokenHandle ��
JobHandle f ", _RTL_USER_PROCESS_EXTENDED_PARAMETERS .?AU_RTL_USER_PROCESS_EXTENDED_PARAMETERS@@ #, W f � _JOURNAL_SET_KEY_SECURITY_INFORMATION .?AU_JOURNAL_SET_KEY_SECURITY_INFORMATION@@ �
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
" OldSecurityDescriptorLength ��
$ OldSecurityDescriptor
" ( NewSecurityDescriptorLength ��
, NewSecurityDescriptor f &, 0 _JOURNAL_SET_KEY_SECURITY_INFORMATION .?AU_JOURNAL_SET_KEY_SECURITY_INFORMATION@@ ', � � N � PPM_IDLE_STATE_BUCKET_EX .?AUPPM_IDLE_STATE_BUCKET_EX@@ ��R
# TotalTimeUs ��
" MinTimeUs
" MaxTimeUs
" Count N *, PPM_IDLE_STATE_BUCKET_EX .?AUPPM_IDLE_STATE_BUCKET_EX@@ �� +, {
& � _QUAD .?AU_QUAD@@
-, ��
.,
� >
UseThisFieldToCopy ���
A DoNotUseThisField & 0, _QUAD .?AU_QUAD@@ 1, � J � _SECURITY_CAPABILITIES .?AU_SECURITY_CAPABILITIES@@ ��
3,
� f
AppContainerSid ��
W Capabilities �
" CapabilityCount ��
" Reserved �J 5, _SECURITY_CAPABILITIES .?AU_SECURITY_CAPABILITIES@@ �� 6, w ; Z � _IMAGE_RESOURCE_DIRECTORY_ENTRY .?AU_IMAGE_RESOURCE_DIRECTORY_ENTRY@@
8,
�
" ��
" ��
" ��
" ��
:, NameOffset ���
;, NameIsString �
" Name �
! Id ���
" OffsetToData �
<, OffsetToDirectory
=, DataIsDirectory ��Z >, _IMAGE_RESOURCE_DIRECTORY_ENTRY .?AU_IMAGE_RESOURCE_DIRECTORY_ENTRY@@ ?, � K V � _PERFINFO_PAGE_RANGE_IDENTITY .?AU_PERFINFO_PAGE_RANGE_IDENTITY@@
# ��
# 0��
# 4��
B, UseDescription ���
C, UniqueKey
D, Reserved �
ProtoPteAddress ��
" PageFrameIndex ���
VirtualAddress ���
" PageCount V E, _PERFINFO_PAGE_RANGE_IDENTITY .?AU_PERFINFO_PAGE_RANGE_IDENTITY@@ F, b � b TokenElevationTypeDefault TokenElevationTypeFull ��� TokenElevationTypeLimited B t H, _TOKEN_ELEVATION_TYPE .?AW4_TOKEN_ELEVATION_TYPE@@ � I, w -
�
�
�
� R � _ENLISTMENT_CRM_INFORMATION .?AU_ENLISTMENT_CRM_INFORMATION@@
M,
� b
$ CrmTransactionManagerId ��
$ CrmResourceManagerId �
$ CrmEnlistmentId ��R O, 0 _ENLISTMENT_CRM_INFORMATION .?AU_ENLISTMENT_CRM_INFORMATION@@ P, � [ n � _FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT .?AU_FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT@@ ��
R,
� z FileMetadataOptimizationNone � FileMetadataOptimizationInProgress ��� FileMetadataOptimizationPending ��Z t T, _FILE_METADATA_OPTIMIZATION_STATE .?AW4_FILE_METADATA_OPTIMIZATION_STATE@@ � U, � �(
U, State
" AttributeListSize
" MetadataSpaceUsed
" MetadataSpaceAllocated ���
" NumberOfFileRecords ��
" NumberOfResidentAttributes ���
" NumberOfNonresidentAttributes
" TotalInProgress ��
" TotalPending �n W, $ _FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT .?AU_FILE_QUERY_METADATA_OPTIMIZATION_OUTPUT@@ �� X, � �( B � _XSAVE_CET_U_FORMAT .?AU_XSAVE_CET_U_FORMAT@@
Z,
� 2
# Ia32CetUMsr ��
# Ia32Pl3SspMsr B \, _XSAVE_CET_U_FORMAT .?AU_XSAVE_CET_U_FORMAT@@ ], K F � _LOAD_DLL_EVENT_DATA .?AU_LOAD_DLL_EVENT_DATA@@ ��
ImageName F `, _LOAD_DLL_EVENT_DATA .?AU_LOAD_DLL_EVENT_DATA@@ �� a, b * Z � _SYSTEM_MEMORY_LIST_INFORMATION .?AU_SYSTEM_MEMORY_LIST_INFORMATION@@ " " ��
" ZeroPageCount
" FreePageCount
" ModifiedPageCount
" ModifiedNoWritePageCount �
" BadPageCount �
d, PageCountByPriority ��
d, 4 RepurposedPagesByPriority
" T ModifiedPageCountPageFile Z e, X _SYSTEM_MEMORY_LIST_INFORMATION .?AU_SYSTEM_MEMORY_LIST_INFORMATION@@ f, � � Z � _FILE_ATTRIBUTE_TAG_INFORMATION .?AU_FILE_ATTRIBUTE_TAG_INFORMATION@@ 6
" FileAttributes ���
" ReparseTag ���Z i, _FILE_ATTRIBUTE_TAG_INFORMATION .?AU_FILE_ATTRIBUTE_TAG_INFORMATION@@ j, � ? 6 PlatformRoleUnspecified �� PlatformRoleDesktop �� PlatformRoleMobile ��� PlatformRoleWorkstation �� PlatformRoleEnterpriseServer � PlatformRoleSOHOServer ��� PlatformRoleAppliancePC �� PlatformRolePerformanceServer PlatformRoleSlate PlatformRoleMaximum ��B
t l, _POWER_PLATFORM_ROLE .?AW4_POWER_PLATFORM_ROLE@@ ��� m, { �
�
� B � _SERVICE_NOTIFY_2A .?AU_SERVICE_NOTIFY_2A@@ ��
" dwVersion
� pfnNotifyCallback
pContext �
" dwNotificationStatus �
� ServiceStatus
" 4 dwNotificationTriggered ��
p 8 pszServiceNames ��B q, < _SERVICE_NOTIFY_2A .?AU_SERVICE_NOTIFY_2A@@ �� r, � �
�#
�
x
y * u, _POINTL .?AU_POINTL@@ v, s �
t unused ���* x, HDESK__ .?AUHDESK__@@ y, s S . � _RGNDATA .?AU_RGNDATA@@ ��
{,
� : � _RGNDATAHEADER .?AU_RGNDATAHEADER@@ ��&
}, rdh ��
k Buffer ���. ~, $ _RGNDATA .?AU_RGNDATA@@ �� , � � � CI_WINDOWS_LOCKDOWN_RESTRICTION_NONE � CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK � CI_WINDOWS_LOCKDOWN_RESTRICTION_NOUNLOCK_PERMANENT ��� CI_WINDOWS_LOCKDOWN_RESTRICTION_MAX ��V t �, CI_WINDOWS_LOCKDOWN_RESTRICTION .?AW4CI_WINDOWS_LOCKDOWN_RESTRICTION@@ � �, � �
@
� ^ � _PUBLIC_OBJECT_BASIC_INFORMATION .?AU_PUBLIC_OBJECT_BASIC_INFORMATION@@ �� " " ( �v
" Attributes ���
" GrantedAccess
" HandleCount ��
" PointerCount �
�, Reserved �^ �, 8 _PUBLIC_OBJECT_BASIC_INFORMATION .?AU_PUBLIC_OBJECT_BASIC_INFORMATION@@ �� �, m � J � REFS_VOLUME_DATA_BUFFER .?AUREFS_VOLUME_DATA_BUFFER@@ � " H ��
" ByteCount
" MajorVersion �
" MinorVersion �
" BytesPerPhysicalSector ���
� VolumeSerialNumber ���
� NumberSectors
� TotalClusters
� ( FreeClusters �
� 0 TotalReserved
" 8 BytesPerSector ���
" < BytesPerCluster ��
� @ MaximumSizeOfResidentFile
! H FastTierDataFillRatio
! J SlowTierDataFillRatio
" L DestagesFastTierToSlowTierRate ���
�, P Reserved �J �, � REFS_VOLUME_DATA_BUFFER .?AUREFS_VOLUME_DATA_BUFFER@@ �, �
v � _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION .?AU_PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION@@ >
" Version ��
" Reserved �
" Callback �v �, _PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION .?AU_PROCESS_INSTRUMENTATION_CALLBACK_INFORMATION@@ �, � � . � tagLOGPEN .?AUtagLOGPEN@@
�,
� >
u lopnStyle
� lopnWidth
" lopnColor . �, tagLOGPEN .?AUtagLOGPEN@@ �, � k � POINTER_DEVICE_TYPE_INTEGRATED_PEN ��� POINTER_DEVICE_TYPE_EXTERNAL_PEN � POINTER_DEVICE_TYPE_TOUCH POINTER_DEVICE_TYPE_TOUCH_PAD ��POINTER_DEVICE_TYPE_MAX �F t �, tagPOINTER_DEVICE_TYPE .?AW4tagPOINTER_DEVICE_TYPE@@ ��� �, ~ �; 6 � HCOLORSPACE__ .?AUHCOLORSPACE__@@
�,
�
t unused ���6 �, HCOLORSPACE__ .?AUHCOLORSPACE__@@ �, s M b � _RTL_PROCESS_MODULE_INFORMATION_EX .?AU_RTL_PROCESS_MODULE_INFORMATION_EX@@ ��v
! NextOffset ���
BaseInfo �
" ImageChecksum
" $TimeDateStamp
(DefaultBase ��b �, ,_RTL_PROCESS_MODULE_INFORMATION_EX .?AU_RTL_PROCESS_MODULE_INFORMATION_EX@@ �� �, � � N � _ETW_TP_EVENT_POOL_CREATE .?AU_ETW_TP_EVENT_POOL_CREATE@@
�,
� *
m Header ���
PoolId ���N �, ( _ETW_TP_EVENT_POOL_CREATE .?AU_ETW_TP_EVENT_POOL_CREATE@@ �, b �
�
� � ImagePolicyEntryTypeNone � ImagePolicyEntryTypeBool � ImagePolicyEntryTypeInt8 � ImagePolicyEntryTypeUInt8 ImagePolicyEntryTypeInt16 ImagePolicyEntryTypeUInt16 ��� ImagePolicyEntryTypeInt32 ImagePolicyEntryTypeUInt32 ��� ImagePolicyEntryTypeInt64 ImagePolicyEntryTypeUInt64 ���
ImagePolicyEntryTypeAnsiString ��� ImagePolicyEntryTypeUnicodeString ImagePolicyEntryTypeOverride �
ImagePolicyEntryTypeMaximum ��J t �, _IMAGE_POLICY_ENTRY_TYPE .?AW4_IMAGE_POLICY_ENTRY_TYPE@@ ��� �, g L& . � _FLOAT128 .?AU_FLOAT128@@
�,
� *
LowPart ��
HighPart �. �, _FLOAT128 .?AU_FLOAT128@@ �, U q t t t t �,
�,
� b � _RESOURCEMANAGER_BASIC_INFORMATION .?AU_RESOURCEMANAGER_BASIC_INFORMATION@@ ��R
$ ResourceManagerId
" DescriptionLength
Description ��b �, _RESOURCEMANAGER_BASIC_INFORMATION .?AU_RESOURCEMANAGER_BASIC_INFORMATION@@ �� �, � 6 � _MODEMDEVCAPS .?AU_MODEMDEVCAPS@@ N
" dwActualSize �
" dwRequiredSize ���
" dwDevSpecificOffset ��
" dwDevSpecificSize
" dwModemProviderVersion ���
" dwModemManufacturerOffset
" dwModemManufacturerSize ��
" dwModemModelOffset ���
" dwModemModelSize �
" $ dwModemVersionOffset �
" ( dwModemVersionSize ���
" , dwDialOptions
" 0 dwCallSetupFailTimer �
" 4 dwInactivityTimeout ��
" 8 dwSpeakerVolume ��
" < dwSpeakerMode
" @ dwModemOptions ���
" D dwMaxDTERate �
" H dwMaxDCERate �
� L abVariablePortion 6 �, P _MODEMDEVCAPS .?AU_MODEMDEVCAPS@@ �, , Z � _SYSTEM_ACPI_AUDIT_INFORMATION .?AU_SYSTEM_ACPI_AUDIT_INFORMATION@@ ��
" ��
" ��
" ��Z
" RsdpCount
�, SameRsdt �
�, SlicPresent ��
�, SlicDifferent Z �, _SYSTEM_ACPI_AUDIT_INFORMATION .?AU_SYSTEM_ACPI_AUDIT_INFORMATION@@ �� �, � �
v � _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT@@ ��
�,
� ^
" PropagationCookie
$ UOW ��
$ TmIdentity ���
" $ BufferLength �v �, ( _TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_PROPAGATE_ARGUMENT@@ �� �, � � N � _HEAP_EVENT_RANGE_CREATE .?AU_HEAP_EVENT_RANGE_CREATE@@ ��F
HeapHandle ���
" FirstRangeSize ���
" Flags N �, _HEAP_EVENT_RANGE_CREATE .?AU_HEAP_EVENT_RANGE_CREATE@@ �� �, b � . � _RPC_SID .?AU_RPC_SID@@ ��N � _SID_IDENTIFIER_AUTHORITY .?AU_SID_IDENTIFIER_AUTHORITY@@ j
Revision �
SubAuthorityCount
�, IdentifierAuthority ��
� SubAuthority �. �, _RPC_SID .?AU_RPC_SID@@ �� �, B 8 6 � _DRAWPATRECT .?AU_DRAWPATRECT@@ ��V
� ptPosition ���
� ptSize ���
! wStyle ���
! wPattern �6 �, _DRAWPATRECT .?AU_DRAWPATRECT@@ �� �, � %
J
�
�
�
� � �, J � _IMAGE_HOT_PATCH_HASHES .?AU_IMAGE_HOT_PATCH_HASHES@@ &
� SHA256 ���
� SHA1 �J �, 4 _IMAGE_HOT_PATCH_HASHES .?AU_IMAGE_HOT_PATCH_HASHES@@ �, � � ^ � _PERFINFO_CC_SCHEDULE_READ_AHEAD .?AU_PERFINFO_CC_SCHEDULE_READ_AHEAD@@ ��
" ��
" ��j
" WorkItemKey ��
" FileObjectKey
# FileOffset ���
" Length ���
" ReadAheadUnit
" ReadAheadLength ��
# ReadAheadOffset ��
# ( ReadAheadBeyondLastByte ��
0 ReadPattern ��
" 4 SequentialReadCount ��
" 8 SharedCacheMapFlags ��
�, < ReadAheadSettingsChanged �
�, < ReadAheadActive ��^
�, @ _PERFINFO_CC_SCHEDULE_READ_AHEAD .?AU_PERFINFO_CC_SCHEDULE_READ_AHEAD@@ �� �, b � . � _DOCINFOW .?AU_DOCINFOW@@ r
t cbSize ���
lpszDocName ��
lpszOutput ���
lpszDatatype �
" fwType ���. �, _DOCINFOW .?AU_DOCINFOW@@ �, � � V � _KEY_HANDLE_TAGS_INFORMATION .?AU_KEY_HANDLE_TAGS_INFORMATION@@ ��
" HandleTags ���V �, _KEY_HANDLE_TAGS_INFORMATION .?AU_KEY_HANDLE_TAGS_INFORMATION@@ �� �, � Z V � _REFS_DEALLOCATE_RANGES_RANGE .?AU_REFS_DEALLOCATE_RANGES_RANGE@@ 2
# StartOfRange �
# CountOfRange �V �, _REFS_DEALLOCATE_RANGES_RANGE .?AU_REFS_DEALLOCATE_RANGES_RANGE@@ �, � �* V � _FILE_COMPRESSION_INFORMATION .?AU_FILE_COMPRESSION_INFORMATION@@ �
� CompressedFileSize ���
! CompressionFormat
CompressionUnitShift �
ChunkShift ���
ClusterShift �
,
Reserved �V �, _FILE_COMPRESSION_INFORMATION .?AU_FILE_COMPRESSION_INFORMATION@@ �, � � R � _IMAGE_COFF_SYMBOLS_HEADER .?AU_IMAGE_COFF_SYMBOLS_HEADER@@ ��
�,
� �
" NumberOfSymbols ��
" LvaToFirstSymbol �
" NumberOfLinenumbers ��
" LvaToFirstLinenumber �
" RvaToFirstByteOfCode �
" RvaToLastByteOfCode ��
" RvaToFirstByteOfData �
" RvaToLastByteOfData ��R �, _IMAGE_COFF_SYMBOLS_HEADER .?AU_IMAGE_COFF_SYMBOLS_HEADER@@ �� �, � � z � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2@@ �
MaxIops ��
MaxBandwidth �
ReservationIops ��
q VolumeName ���
" BaseIoSize ���
0 ControlFlags �
! $ VolumeNameLength �
( CriticalReservationIops ��
0 ReservationBandwidth �
8 CriticalReservationBandwidth �
@ MaxTimePercent ���
H ReservationTimePercent ���
P CriticalReservationTimePercent ���z
�, X JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2@@ �, D l > � MENUITEMTEMPLATE .?AUMENUITEMTEMPLATE@@ ��:
! mtOption �
! mtID �
mtString �> �, MENUITEMTEMPLATE .?AUMENUITEMTEMPLATE@@ �� �, ~ �(
�
5
� �
! wYear
! wMonth ���
! wDayOfWeek ���
! wDay �
! wHour
!
wMinute ��
! wSecond ��
! wMilliseconds 2 - _SYSTEMTIME .?AU_SYSTEMTIME@@ - � Z
�
�
�
� V � NTFS_FILE_RECORD_INPUT_BUFFER .?AUNTFS_FILE_RECORD_INPUT_BUFFER@@ "
� FileReferenceNumber ��V - NTFS_FILE_RECORD_INPUT_BUFFER .?AUNTFS_FILE_RECORD_INPUT_BUFFER@@
- � �
>
� B � tagRECONVERTSTRING .?AUtagRECONVERTSTRING@@ ���
" dwSize ���
" dwVersion
" dwStrLen �
" dwStrOffset ��
" dwCompStrLen �
" dwCompStrOffset ��
" dwTargetStrLen ���
" dwTargetStrOffset B - tagRECONVERTSTRING .?AUtagRECONVERTSTRING@@ �� - � x B � _OSVERSIONINFOEX2W .?AU_OSVERSIONINFOEX2W@@ ��
-
� N
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
�$ szCSDVersion �
! wServicePackMajor
! wServicePackMinor
! wSuiteMask ���
wProductType �
wReserved
" wSuiteMaskEx �
" wReserved2 ���B
- $_OSVERSIONINFOEX2W .?AU_OSVERSIONINFOEX2W@@ �� - g � j � _RESOURCEMANAGER_COMPLETION_INFORMATION .?AU_RESOURCEMANAGER_COMPLETION_INFORMATION@@
-
� >
IoCompletionPortHandle ���
" CompletionKey j - _RESOURCEMANAGER_COMPLETION_INFORMATION .?AU_RESOURCEMANAGER_COMPLETION_INFORMATION@@ - � $ ^ � _SYSTEM_SINGLE_MODULE_INFORMATION .?AU_SYSTEM_SINGLE_MODULE_INFORMATION@@ 6
TargetModuleAddress ��
�, ExInfo ���^ - 0_SYSTEM_SINGLE_MODULE_INFORMATION .?AU_SYSTEM_SINGLE_MODULE_INFORMATION@@ - � ]
�
� F � _REARRANGE_FILE_DATA .?AU_REARRANGE_FILE_DATA@@ ��
-
� z
# SourceStartingOffset �
# TargetOffset �
SourceFileHandle �
" Length ���
" Flags F "- _REARRANGE_FILE_DATA .?AU_REARRANGE_FILE_DATA@@ �� #- � ( J � CREATE_USN_JOURNAL_DATA .?AUCREATE_USN_JOURNAL_DATA@@ 6
# MaximumSize ��
# AllocationDelta ��J &- CREATE_USN_JOURNAL_DATA .?AUCREATE_USN_JOURNAL_DATA@@ '- �
v � _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2@@ ��
)-
� �
# IoReadBytesLimit �
# IoWriteBytesLimit
� PerJobUserTimeLimit ��
# JobLowMemoryLimit
# JobHighMemoryLimit ���
M ( RateControlTolerance �
� , RateControlToleranceInterval �
" 0 LimitFlags ���v +- 8 _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2 .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_V2@@ �� ,- � � J � _IMAGE_CHPE_RANGE_ENTRY .?AU_IMAGE_CHPE_RANGE_ENTRY@@
.-
�
" ��
" ��^
" StartOffset ��
0- NativeCode ���
1- AddressBits ��
" Length ���J 2- _IMAGE_CHPE_RANGE_ENTRY .?AU_IMAGE_CHPE_RANGE_ENTRY@@ 3- � v B � _ACCESS_ALLOWED_ACE .?AU_ACCESS_ALLOWED_ACE@@ :
� Header ���
" Mask �
" SidStart �B 6- _ACCESS_ALLOWED_ACE .?AU_ACCESS_ALLOWED_ACE@@ 7- w V FindExInfoStandard ��� FindExInfoBasic �� FindExInfoMaxInfoLevel ���> t 9- _FINDEX_INFO_LEVELS .?AW4_FINDEX_INFO_LEVELS@@ � :- � � J � _CM_MONITOR_DEVICE_DATA .?AU_CM_MONITOR_DEVICE_DATA@@ J
! Version ��
! Revision �
! HorizontalScreenSize �
! VerticalScreenSize ���
! HorizontalResolution �
!
VerticalResolution ���
! HorizontalDisplayTimeLow �
! HorizontalDisplayTime
! HorizontalDisplayTimeHigh
! HorizontalBackPorchLow ���
! HorizontalBackPorch ��
! HorizontalBackPorchHigh ��
! HorizontalFrontPorchLow ��
! HorizontalFrontPorch �
! HorizontalFrontPorchHigh �
! HorizontalSyncLow
! HorizontalSync ���
! " HorizontalSyncHigh ���
! $ VerticalBackPorchLow �
! & VerticalBackPorch
! ( VerticalBackPorchHigh
! * VerticalFrontPorchLow
! , VerticalFrontPorch ���
! . VerticalFrontPorchHigh ���
! 0 VerticalSyncLow ��
! 2 VerticalSync �
! 4 VerticalSyncHigh �J =- 6 _CM_MONITOR_DEVICE_DATA .?AU_CM_MONITOR_DEVICE_DATA@@ >- � B � _SD_ENUM_SDS_ENTRY .?AU_SD_ENUM_SDS_ENTRY@@ ��j
" Hash �
" SecurityId ���
# Offset ���
" Length ���
� Descriptor ���B A- _SD_ENUM_SDS_ENTRY .?AU_SD_ENUM_SDS_ENTRY@@ �� B- � V � _SC_NOTIFICATION_REGISTRATION .?AU_SC_NOTIFICATION_REGISTRATION@@
D-
�
�
� : � tagEMRANGLEARC .?AUtagEMRANGLEARC@@ ��j
� emr ��
� ptlCenter
" nRadius ��
@ eStartAngle ��
@ eSweepAngle ��: H- tagEMRANGLEARC .?AUtagEMRANGLEARC@@ �� I- � 0
�"
� �" � L-
M-
� 2
K- ExecuteCallback ��
N- Unposted �B O- _TP_TASK_CALLBACKS .?AU_TP_TASK_CALLBACKS@@ �� P- � � F � _EX_WNF_SUBSCRIPTION .?AU_EX_WNF_SUBSCRIPTION@@ ��
R-
� : � _WNF_STATE_NAME .?AU_WNF_STATE_NAME@@
T- ��
U-
� 6 � _WNF_TYPE_ID .?AU_WNF_TYPE_ID@@ ��
W- ��
X-
� S- V- " " Y- Z- n � _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION@@ �
# IoReadBytesLimit �
# IoWriteBytesLimit
� PerJobUserTimeLimit ��
# JobMemoryLimit ���
M RateControlTolerance �
� $ RateControlToleranceInterval �
" ( LimitFlags ���n ]- 0 _JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION .?AU_JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION@@ ^- D � 6 � _NLSTABLEINFO .?AU_NLSTABLEINFO@@ 6 � _CPTABLEINFO .?AU_CPTABLEINFO@@ ��j
a- OemTableInfo �
a- , AnsiTableInfo
q X UpperCaseTable ���
q \ LowerCaseTable ���6 b- ` _NLSTABLEINFO .?AU_NLSTABLEINFO@@ * onecore\external\ddk\inc\ntnls.h ��� c- d- 3
H
� R � _IMAGE_RESOURCE_DATA_ENTRY .?AU_IMAGE_RESOURCE_DATA_ENTRY@@ ��R
" OffsetToData �
" Size �
" CodePage �
" Reserved �R h- _IMAGE_RESOURCE_DATA_ENTRY .?AU_IMAGE_RESOURCE_DATA_ENTRY@@ �� i- � | Z � _PLUGPLAY_CONTROL_CONFLICT_LIST .?AU_PLUGPLAY_CONTROL_CONFLICT_LIST@@ ^ � _PLUGPLAY_CONTROL_CONFLICT_ENTRY .?AU_PLUGPLAY_CONTROL_CONFLICT_ENTRY@@ �� l- " ( �
" Reserved1
" Reserved2
" ConflictsCounted �
" ConflictsListed ��
" RequiredBufferSize ���
m- ConflictEntry Z n- @ _PLUGPLAY_CONTROL_CONFLICT_LIST .?AU_PLUGPLAY_CONTROL_CONFLICT_LIST@@ o- $ �
�
� 6 � _RTL_HEAP_TAG .?AU_RTL_HEAP_TAG@@ q " 0 �
" NumberOfAllocations ��
" NumberOfFrees
" BytesAllocated ���
! TagIndex �
! CreatorBackTraceIndex
s- TagName ��6 t- @ _RTL_HEAP_TAG .?AU_RTL_HEAP_TAG@@ u- � - 6 � tagMOUSEKEYS .?AUtagMOUSEKEYS@@ ��
u cbSize ���
" dwFlags ��
" iMaxSpeed
" iTimeToMaxSpeed ��
" iCtrlSpeed ���
" dwReserved1 ��
" dwReserved2 ��6 x- tagMOUSEKEYS .?AUtagMOUSEKEYS@@ �� y- ~ �3 > � tagEMREXTTEXTOUTA .?AUtagEMREXTTEXTOUTA@@ z
� emr ��
c rclBounds
" iGraphicsMode
@ exScale ��
@ eyScale ��
�' $ emrtext ��> |- L tagEMREXTTEXTOUTA .?AUtagEMREXTTEXTOUTA@@ }- � � z PoHiberForceDisableReasonPolicy �� PoHiberForceDisableReasonGuardedHost � PoHiberForceDisableReasonMax �V t - _PO_HIBER_FORCE_DISABLE_REASON .?AW4_PO_HIBER_FORCE_DISABLE_REASON@@ ��� �- { S
Z MemoryReserveUserApc � MemoryReserveIoCompletion MemoryReserveTypeMax �B t �- _MEMORY_RESERVE_TYPE .?AW4_MEMORY_RESERVE_TYPE@@ ��� �- �
6 � tagWINDOWPOS .?AUtagWINDOWPOS@@ ��v
� hwnd �
� hwndInsertAfter ��
t x
t y
t cx ���
t cy ���
u flags 6 �- tagWINDOWPOS .?AUtagWINDOWPOS@@ �� �- ~ y
V � _RTL_SPARSE_BITMAP_PARAMETER .?AU_RTL_SPARSE_BITMAP_PARAMETER@@ ��
" �-
�-
�
%
�
" ��
" ��
" ��
" ��
# BitCountMax ��
" MetadataSizePerBit ���
" BitsPerRange �
" RangeCountMax
�- AllocateRoutine ��
�- FreeRoutine ��
�- DefaultBitsSet ���
�- SparseRangeArray �
�- NoInternalLocking
�- SpareFlags ���V
�- _RTL_SPARSE_BITMAP_PARAMETER .?AU_RTL_SPARSE_BITMAP_PARAMETER@@ �� �- � 6 � tagTPMPARAMS .?AUtagTPMPARAMS@@ ��*
u cbSize ���
rcExclude 6 �- tagTPMPARAMS .?AUtagTPMPARAMS@@ �� �- ~ N � _SYSTEM_FLAGS_INFORMATION .?AU_SYSTEM_FLAGS_INFORMATION@@
" Flags N �- _SYSTEM_FLAGS_INFORMATION .?AU_SYSTEM_FLAGS_INFORMATION@@ �- � � Z � _MM_ETW_WORKING_SET_PFN_RUNDOWN .?AU_MM_ETW_WORKING_SET_PFN_RUNDOWN@@
�-
� �+ " �J
" ProcessId
" EntryCount ���
�- WorkingSetInfo ���Z �- _MM_ETW_WORKING_SET_PFN_RUNDOWN .?AU_MM_ETW_WORKING_SET_PFN_RUNDOWN@@ �- w X J � _QUERY_BAD_RANGES_INPUT .?AU_QUERY_BAD_RANGES_INPUT@@
�-
� H& " �:
" Flags
" NumRanges
�- Ranges ���J �- _QUERY_BAD_RANGES_INPUT .?AU_QUERY_BAD_RANGES_INPUT@@ �- � !! ^ � _FILE_NOTIFY_EXTENDED_INFORMATION .?AU_FILE_NOTIFY_EXTENDED_INFORMATION@@
�-
� f
" NextEntryOffset ��
" Action ���
� CreationTime �
� LastModificationTime �
� LastChangeTime ���
� LastAccessTime ���
� ( AllocatedLength ��
� 0 FileSize �
" 8 FileAttributes ���
" < ReparsePointTag ��
� @ FileId ���
� H ParentFileId �
" P FileNameLength ���
T FileName �^ �- X _FILE_NOTIFY_EXTENDED_INFORMATION .?AU_FILE_NOTIFY_EXTENDED_INFORMATION@@ �- � @
� ��
�-
�
q
� N � _MIDL_STUBLESS_PROXY_INFO .?AU_MIDL_STUBLESS_PROXY_INFO@@
�-
� �
^( pStubDesc
J ProcFormatString �
2 FormatStringOffset ���
0 pTransferSyntax ��
" nCount ���
h( pSyntaxInfo ��N �- _MIDL_STUBLESS_PROXY_INFO .?AU_MIDL_STUBLESS_PROXY_INFO@@ �- � �
�"
� 6 � _DEVICE_FLAGS .?AU_DEVICE_FLAGS@@
�-
�
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�- Failed ���
�- ReadOnly �
�- Removable
�- ConsoleIn
�- ConsoleOut ���
�- Input
�- Output ���6 �- _DEVICE_FLAGS .?AU_DEVICE_FLAGS@@ �- � R � _MEMORY_COMBINE_INFORMATION .?AU_MEMORY_COMBINE_INFORMATION@@ .
Handle ���
" PagesCombined R �- _MEMORY_COMBINE_INFORMATION .?AU_MEMORY_COMBINE_INFORMATION@@ �- � � V � _PROCESSOR_POWER_POLICY_INFO .?AU_PROCESSOR_POWER_POLICY_INFO@@ ��
" ��
" ��
" ���
" TimeCheck
" DemoteLimit ��
" PromoteLimit �
DemotePercent
PromotePercent ���
� Spare
�- AllowDemotion
�- AllowPromotion ���
�- Reserved �V �- _PROCESSOR_POWER_POLICY_INFO .?AU_PROCESSOR_POWER_POLICY_INFO@@ �� �- { V R � _SYSDBG_LIVEDUMP_CONTROL_FLAGS .?AT_SYSDBG_LIVEDUMP_CONTROL_FLAGS@@ ��
" ��
" ��
" ��
" ��
" ��
�- UseDumpStorageStack ��
�- CompressMemoryPagesData ��
�- IncludeUserSpaceMemoryPages ��
�- AbortIfMemoryPressure
�- Reserved �
" AsUlong ��R �- _SYSDBG_LIVEDUMP_CONTROL_FLAGS .?AT_SYSDBG_LIVEDUMP_CONTROL_FLAGS@@ �� �- � < : � _MEMORYSTATUSEX .?AU_MEMORYSTATUSEX@@ �
" dwLength �
" dwMemoryLoad �
# ullTotalPhys �
# ullAvailPhys �
# ullTotalPageFile �
# ullAvailPageFile �
# ( ullTotalVirtual ��
# 0 ullAvailVirtual ��
# 8 ullAvailExtendedVirtual ��: �- @ _MEMORYSTATUSEX .?AU_MEMORYSTATUSEX@@ �- � B R � _QUERY_SERVICE_LOCK_STATUSW .?AU_QUERY_SERVICE_LOCK_STATUSW@@ J
" fIsLocked
q lpLockOwner ��
" dwLockDuration ���R �- _QUERY_SERVICE_LOCK_STATUSW .?AU_QUERY_SERVICE_LOCK_STATUSW@@ �- � Z � _COVERAGE_UNLOADED_MODULE_ENTRY .?AU_COVERAGE_UNLOADED_MODULE_ENTRY@@
�-
� �
! NextEntry
BaseDllName ��
FullDllName ��
" CoverageSectionSize ��
CoverageSection ��Z �- _COVERAGE_UNLOADED_MODULE_ENTRY .?AU_COVERAGE_UNLOADED_MODULE_ENTRY@@ �- � l �
� N � STARTING_LCN_INPUT_BUFFER .?AUSTARTING_LCN_INPUT_BUFFER@@
� StartingLcn ��N �- STARTING_LCN_INPUT_BUFFER .?AUSTARTING_LCN_INPUT_BUFFER@@ �- � 1
F � tagNONCLIENTMETRICSW .?AUtagNONCLIENTMETRICSW@@ ��
�-
� �
u cbSize ���
t iBorderWidth �
t iScrollWidth �
t iScrollHeight
t iCaptionWidth
t iCaptionHeight ���
lfCaptionFont
t t iSmCaptionWidth ��
t x iSmCaptionHeight �
| lfSmCaptionFont ��
t � iMenuWidth ���
t � iMenuHeight ��
� lfMenuFont ���
<lfStatusFont �
�lfMessageFont
t �iPaddedBorderWidth ���F �- �tagNONCLIENTMETRICSW .?AUtagNONCLIENTMETRICSW@@ �� �- ~ �1 J � _PROCESSOR_IDLE_STATES .?AU_PROCESSOR_IDLE_STATES@@ ��
�-
� F � _PROCESSOR_IDLE_STATE .?AU_PROCESSOR_IDLE_STATE@@ �- " �r
" Size �
" Revision �
" Count
" Type �
" TargetProcessors �
�- State J �- , _PROCESSOR_IDLE_STATES .?AU_PROCESSOR_IDLE_STATES@@ �� �- { � f
" NextEntryOffset ��
ParentFileId �
" FileNameLength ���
FileName �V �- _FILE_LINK_ENTRY_INFORMATION .?AU_FILE_LINK_ENTRY_INFORMATION@@ �� �- � z B � tagHW_PROFILE_INFOA .?AUtagHW_PROFILE_INFOA@@ p " ' �R
" dwDockInfo ���
�- szHwProfileGuid ��
N + szHwProfileName ��B �- | tagHW_PROFILE_INFOA .?AUtagHW_PROFILE_INFOA@@ �- n �
v
� : � _VM_COUNTERS_EX .?AU_VM_COUNTERS_EX@@ j
" PeakVirtualSize ��
" VirtualSize ��
" PageFaultCount ���
" PeakWorkingSetSize ���
" WorkingSetSize ���
" QuotaPeakPagedPoolUsage ��
" QuotaPagedPoolUsage ��
" QuotaPeakNonPagedPoolUsage ���
" QuotaNonPagedPoolUsage ���
" $ PagefileUsage
" ( PeakPagefileUsage
" , PrivateUsage �: . 0 _VM_COUNTERS_EX .?AU_VM_COUNTERS_EX@@ . D � J � _KEY_BASIC_INFORMATION .?AU_KEY_BASIC_INFORMATION@@ ��Z
� LastWriteTime
" TitleIndex ���
" NameLength ���
Name �J . _KEY_BASIC_INFORMATION .?AU_KEY_BASIC_INFORMATION@@ �� . � Z � NTFS_FILE_RECORD_OUTPUT_BUFFER .?AUNTFS_FILE_RECORD_OUTPUT_BUFFER@@ ��Z
� FileReferenceNumber ��
" FileRecordLength �
� FileRecordBuffer �Z . NTFS_FILE_RECORD_OUTPUT_BUFFER .?AUNTFS_FILE_RECORD_OUTPUT_BUFFER@@ �� . � �
* � HGLRC__ .?AUHGLRC__@@
.
�
t unused ���*
. HGLRC__ .?AUHGLRC__@@ . s R � � � � . F � _DEDUP_FILE_OPERATION .?AU_DEDUP_FILE_OPERATION@@
.
�
" Code �F . _DEDUP_FILE_OPERATION .?AU_DEDUP_FILE_OPERATION@@ . �
� " " .
.
�
~
� . .
.
� n � _TRANSACTIONMANAGER_RECOVERY_INFORMATION .?AU_TRANSACTIONMANAGER_RECOVERY_INFORMATION@@ ��
# LastRecoveredLsn �n . _TRANSACTIONMANAGER_RECOVERY_INFORMATION .?AU_TRANSACTIONMANAGER_RECOVERY_INFORMATION@@ �� !. � � f � _SYSTEM_SYSTEM_PARTITION_INFORMATION .?AU_SYSTEM_SYSTEM_PARTITION_INFORMATION@@ ��
SystemPartition ��f $. _SYSTEM_SYSTEM_PARTITION_INFORMATION .?AU_SYSTEM_SYSTEM_PARTITION_INFORMATION@@ �� %. � Y
J � _IMAGE_TLS_DIRECTORY32 .?AU_IMAGE_TLS_DIRECTORY32@@ ��
'. ��
(.
�
" ��
" ��
" ���
" StartAddressOfRawData
" EndAddressOfRawData ��
" AddressOfIndex ���
" AddressOfCallBacks ���
" SizeOfZeroFill ���
" Characteristics ��
*. Reserved0
+. Alignment
,. Reserved1 J -. _IMAGE_TLS_DIRECTORY32 .?AU_IMAGE_TLS_DIRECTORY32@@ �� .. � �
�$
� j
0. Parent ���
0. LeftChild
0. RightChild ���
p Balance ��
,
Reserved �B 1. _RTL_BALANCED_LINKS .?AU_RTL_BALANCED_LINKS@@ 2. g � Z � _TXFS_WRITE_BACKUP_INFORMATION .?AU_TXFS_WRITE_BACKUP_INFORMATION@@ ��
� Buffer ���Z 5. _TXFS_WRITE_BACKUP_INFORMATION .?AU_TXFS_WRITE_BACKUP_INFORMATION@@ �� 6. � }
ResolutionContext � 8. _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_ENDING@@ �� 9. � � � N � _OBJECT_BASIC_INFORMATION .?AU_OBJECT_BASIC_INFORMATION@@
<.
�
" Attributes ���
" GrantedAccess
" HandleCount ��
" PointerCount �
" PagedPoolCharge ��
" NonPagedPoolCharge ���
� Reserved �
" $ NameInfoSize �
" ( TypeInfoSize �
" , SecurityDescriptorSize ���
� 0 CreationTime �N >. 8 _OBJECT_BASIC_INFORMATION .?AU_OBJECT_BASIC_INFORMATION@@ ?. + ) R � _OPERATION_START_PARAMETERS .?AU_OPERATION_START_PARAMETERS@@
A.
� >
" Version ��
" OperationId ��
" Flags R C. _OPERATION_START_PARAMETERS .?AU_OPERATION_START_PARAMETERS@@ D. n � J � _UNLOAD_DLL_DEBUG_INFO .?AU_UNLOAD_DLL_DEBUG_INFO@@ ��
lpBaseOfDll ��J G. _UNLOAD_DLL_DEBUG_INFO .?AU_UNLOAD_DLL_DEBUG_INFO@@ �� H. � Y
i'
� �
# SdsStreamSize
# SdsAllocationSize
# SiiStreamSize
# SiiAllocationSize
# SdhStreamSize
# ( SdhAllocationSize
# 0 NumSDTotal ���
# 8 NumSDUnused ��J K. @ _SD_QUERY_STATS_OUTPUT .?AU_SD_QUERY_STATS_OUTPUT@@ �� L. � �
G-
� $ " " O.
P.
� ~ � _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ ��"
� StrictHandleChecks ���~ S. _RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_RTL_IMAGE_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ �� T. E
V.
�
b
� ^ � _CRITICAL_PROCESS_EXCEPTION_DATA .?AU_CRITICAL_PROCESS_EXCEPTION_DATA@@ ��v
$ ReportId �
ModuleName ���
" ModuleTimestamp ��
" ModuleSize ���
# Offset ���^ Z. ( _CRITICAL_PROCESS_EXCEPTION_DATA .?AU_CRITICAL_PROCESS_EXCEPTION_DATA@@ �� [. � V � _ETW_OPTICALIO_FLUSH_BUFFERS .?AU_ETW_OPTICALIO_FLUSH_BUFFERS@@ ��~
" DiskNumber ���
" IrpFlags �
# HighResResponseTime ��
IrpAddr ��
" IssuingThreadId ��V ^. _ETW_OPTICALIO_FLUSH_BUFFERS .?AU_ETW_OPTICALIO_FLUSH_BUFFERS@@ �� _. b � J � _RPC_SECURITY_QOS_V4_A .?AU_RPC_SECURITY_QOS_V4_A@@ ��^ � _RPC_HTTP_TRANSPORT_CREDENTIALS_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_A@@
b.
�
c. HttpCredentials ��2 d. <anonymous-tag> .?AT<anonymous-tag>@@ e. ^ [ �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
e. u
Sid ��
u EffectiveOnly J g. _RPC_SECURITY_QOS_V4_A .?AU_RPC_SECURITY_QOS_V4_A@@ �� h. ^ T F � _PSFEATURE_CUSTPAPER .?AU_PSFEATURE_CUSTPAPER@@ ��r
lOrientation �
lWidth ���
lHeight ��
lWidthOffset �
lHeightOffset F k. _PSFEATURE_CUSTPAPER .?AU_PSFEATURE_CUSTPAPER@@ �� l. � J
pObj �
u Size �
� pfnBind ��
� pfnUnbind J n. __GENERIC_BINDING_INFO .?AU__GENERIC_BINDING_INFO@@ �� o. � ; > � _ALPC_HANDLE_ATTR .?AU_ALPC_HANDLE_ATTR@@
" ��
" ��
" ��
" ��
" ��
" ��B � _ALPC_HANDLE_ATTR32 .?AU_ALPC_HANDLE_ATTR32@@
x.
� &
" Flags
r. Reserved0
s. SameAccess ���
t. SameAttributes ���
u. Indirect �
v. Inherit ��
w. Reserved1
Handle ���
y. HandleAttrArray ��
" ObjectType ���
" HandleCount ��
" DesiredAccess
" GrantedAccess >
z. _ALPC_HANDLE_ATTR .?AU_ALPC_HANDLE_ATTR@@ {. � ? B � threadmbcinfostruct .?AUthreadmbcinfostruct@@
}.
�
)
� : � tagCHARSETINFO .?AUtagCHARSETINFO@@ ��
�.
� > � tagFONTSIGNATURE .?AUtagFONTSIGNATURE@@ ��6
u ciCharset
u ciACP
�. fs ���: �. tagCHARSETINFO .?AUtagCHARSETINFO@@ �� �. � � v WnfWellKnownStateName WnfPermanentStateName WnfPersistentStateName ��� WnfTemporaryStateName J t �. _WNF_STATE_NAME_LIFETIME .?AW4_WNF_STATE_NAME_LIFETIME@@ ��� �. � @ V � _SYSTEM_HANDLE_INFORMATION_EX .?AU_SYSTEM_HANDLE_INFORMATION_EX@@ b � _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX@@ �� �. " �F
" NumberOfHandles ��
" Reserved �
�. Handles ��V �. $ _SYSTEM_HANDLE_INFORMATION_EX .?AU_SYSTEM_HANDLE_INFORMATION_EX@@ �. � N � _ETW_OPTICALIO_READWRITE .?AU_ETW_OPTICALIO_READWRITE@@ ���
" DiskNumber ���
" IrpFlags �
" Size �
" Reserved �
# ByteOffset ���
FileObject ���
IrpAddr ��
# HighResResponseTime ��
" ( IssuingThreadId ��N �. 0 _ETW_OPTICALIO_READWRITE .?AU_ETW_OPTICALIO_READWRITE@@ �� �. b �
�'
�
�
� R � _SYSTEM_BASIC_INFORMATION64 .?AU_SYSTEM_BASIC_INFORMATION64@@ ^
" Reserved �
" TimerResolution ��
" PageSize �
" NumberOfPhysicalPages
" LowestPhysicalPageNumber �
" HighestPhysicalPageNumber
" AllocationGranularity
# MinimumUserModeAddress ���
# ( MaximumUserModeAddress ���
# 0 ActiveProcessorsAffinityMask �
p 8 NumberOfProcessors ���R �. @ _SYSTEM_BASIC_INFORMATION64 .?AU_SYSTEM_BASIC_INFORMATION64@@ �. � �
�
� R � _IMAGE_DYNAMIC_RELOCATION32 .?AU_IMAGE_DYNAMIC_RELOCATION32@@ .
" Symbol ���
" BaseRelocSize R �. _IMAGE_DYNAMIC_RELOCATION32 .?AU_IMAGE_DYNAMIC_RELOCATION32@@ �. � � F � _DesiredStorageClass .?AU_DesiredStorageClass@@ ��"
� Class
" Flags F �. _DesiredStorageClass .?AU_DesiredStorageClass@@ �� �. � � N � _THREAD_NAME_INFORMATION .?AU_THREAD_NAME_INFORMATION@@ ��
�.
�
ThreadName ���N �. _THREAD_NAME_INFORMATION .?AU_THREAD_NAME_INFORMATION@@ �� �. � � B � _HEAP_RANGE_DESTROY .?AU_HEAP_RANGE_DESTROY@@ .
m Header ���
HeapHandle ���B �. ( _HEAP_RANGE_DESTROY .?AU_HEAP_RANGE_DESTROY@@ �. b � F � _SERVICE_START_REASON .?AU_SERVICE_START_REASON@@
" dwReason �F �. _SERVICE_START_REASON .?AU_SERVICE_START_REASON@@ �. � �
�
�
=
� N � NTFS_EXTENDED_VOLUME_DATA .?AUNTFS_EXTENDED_VOLUME_DATA@@ 2
" ByteCount
! MajorVersion �
! MinorVersion �
" BytesPerPhysicalSector ���
! LfsMajorVersion ��
! LfsMinorVersion ��
" MaxDeviceTrimExtentCount �
" MaxDeviceTrimByteCount ���
" MaxVolumeTrimExtentCount �
" MaxVolumeTrimByteCount ���N
�. NTFS_EXTENDED_VOLUME_DATA .?AUNTFS_EXTENDED_VOLUME_DATA@@ �. � � R � _ETW_THREAD_SET_NAME_EVENT .?AU_ETW_THREAD_SET_NAME_EVENT@@ ��B
" ProcessId
" ThreadId �
ThreadName ���R �. _ETW_THREAD_SET_NAME_EVENT .?AU_ETW_THREAD_SET_NAME_EVENT@@ �� �. b ,
c
� F
left �
top ��
right
bottom ���* �. _RECTL .?AU_RECTL@@ �� �. s � N � tagEMRCREATEBRUSHINDIRECT .?AUtagEMRCREATEBRUSHINDIRECT@@ 6 � tagLOGBRUSH32 .?AUtagLOGBRUSH32@@ 6
� emr ��
" ihBrush ��
�. lb ���N �. tagEMRCREATEBRUSHINDIRECT .?AUtagEMRCREATEBRUSHINDIRECT@@ �. � b 6 � _SI_COPYFILE .?AU_SI_COPYFILE@@ ��
�.
� r
" SourceFileNameLength �
" DestinationFileNameLength
" Flags
FileNameBuffer ���6 �. _SI_COPYFILE .?AU_SI_COPYFILE@@ �� �. � F � _PHYSICAL_CHANNEL_RUN .?AU_PHYSICAL_CHANNEL_RUN@@
�.
� j
" NodeNumber ���
" ChannelNumber
# BasePage �
# PageCount
" Flags F �. _PHYSICAL_CHANNEL_RUN .?AU_PHYSICAL_CHANNEL_RUN@@ �. w j � _PROCESS_DYNAMIC_EH_CONTINUATION_TARGET .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGET@@
�.
� *
" TargetAddress
" Flags j �. _PROCESS_DYNAMIC_EH_CONTINUATION_TARGET .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGET@@ �. D r J � _PERFINFO_VIRTUAL_ALLOC .?AU_PERFINFO_VIRTUAL_ALLOC@@
�.
� ^
CapturedBase �
" CapturedRegionSize ���
" ProcessId
" Flags J �. _PERFINFO_VIRTUAL_ALLOC .?AU_PERFINFO_VIRTUAL_ALLOC@@ �. b Y
� r
dx ���
dy ���
" mouseData
" dwFlags ��
" time �
" dwExtraInfo ��6 �. tagMOUSEINPUT .?AUtagMOUSEINPUT@@ �. ~ � n � _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION .?AU_ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION@@
�.
� >
" ulFlags ��
RunLevel �
" UiAccess �n �. _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION .?AU_ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION@@ �. � � J � _ETW_HEAP_EVENT_REALLOC .?AU_ETW_HEAP_EVENT_REALLOC@@ �
m Header ���
HeapHandle ���
$ NewAddress ���
( OldAddress ���
" , NewSize ��
" 0 OldSize ��
" 4 Source ���J �. 8 _ETW_HEAP_EVENT_REALLOC .?AU_ETW_HEAP_EVENT_REALLOC@@ �. b �
v � _FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX@@ 2
W StorageReserveId �
SpaceUsed v �. _FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_QUERY_STORAGE_RESERVE_ID_INFORMATION_EX@@ �. � s+
�
� * � _TP_IO .?AU_TP_IO@@ ��
�+
� J � _MAXVERSIONTESTED_INFO .?AU_MAXVERSIONTESTED_INFO@@ ��
�.
�
# MaxVersionTested �J �. _MAXVERSIONTESTED_INFO .?AU_MAXVERSIONTESTED_INFO@@ �� �. � ^ � _DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK .?AU_DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK@@
�.
� �
" Signature
! Revision �
! Size �
! DpcWatchdogProfileOffset �
" DpcWatchdogProfileLength �^ �. _DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK .?AU_DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK@@ �. K �
" ��
�.
� V � _PERFINFO_FILE_OPERATION_END .?AU_PERFINFO_FILE_OPERATION_END@@ ��
�.
� B
" Irp ��
" ExtraInformation �
Status ���V �. _PERFINFO_FILE_OPERATION_END .?AU_PERFINFO_FILE_OPERATION_END@@ �� �. b �
�
� R � _TXFS_START_RM_INFORMATION .?AU_TXFS_START_RM_INFORMATION@@ ��
�.
� B
" Flags
# LogContainerSize �
" LogContainerCountMin �
" LogContainerCountMax �
" LogGrowthIncrement ���
" LogAutoShrinkPercentage ��
" TmLogPathOffset ��
! $ TmLogPathLength ��
! & LoggingMode ��
! ( LogPathLength
! * Reserved �
, LogPath ��R �. 0 _TXFS_START_RM_INFORMATION .?AU_TXFS_START_RM_INFORMATION@@ �� �. � N f � _SYSTEM_HYPERVISOR_QUERY_INFORMATION .?AU_SYSTEM_HYPERVISOR_QUERY_INFORMATION@@ ��
/
� " �
HypervisorConnected ��
HypervisorDebuggingEnabled ���
HypervisorPresent
HypervisorSchedulerType ��
/ Spare0 ���
# EnabledEnlightenments f / _SYSTEM_HYPERVISOR_QUERY_INFORMATION .?AU_SYSTEM_HYPERVISOR_QUERY_INFORMATION@@ �� / � 0 F SystemFirmwareTable_Enumerate SystemFirmwareTable_Get ��R t / _SYSTEM_FIRMWARE_TABLE_ACTION .?AW4_SYSTEM_FIRMWARE_TABLE_ACTION@@ � / � Q z
" ProviderSignature
/ Action ���
" TableID ��
" TableBufferLength
� TableBuffer ��b
/ _SYSTEM_FIRMWARE_TABLE_INFORMATION .?AU_SYSTEM_FIRMWARE_TABLE_INFORMATION@@ �� / � V
C&
� v � _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION .?AU_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION@@ ��
" Flags v / _FILE_IO_COMPLETION_NOTIFICATION_INFORMATION .?AU_FILE_IO_COMPLETION_NOTIFICATION_INFORMATION@@ �� / � V � _WMI_IMAGELOAD_INFORMATION32 .?AU_WMI_IMAGELOAD_INFORMATION32@@ ��:
u ImageBase32 ��
u ImageSize32 ��
" ProcessId
" ImageChecksum
" TimeDateStamp
SignatureLevel ���
SignatureType
! Reserved0
u DefaultBase32
" Reserved1
" Reserved2
" $ Reserved3
" ( Reserved4
, FileName �V / 0 _WMI_IMAGELOAD_INFORMATION32 .?AU_WMI_IMAGELOAD_INFORMATION32@@ �� / b U b � _SYSTEM_PROCESSOR_IDLE_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_INFORMATION@@ ��
/
� �
# IdleTime �
# C1Time ���
# C2Time ���
# C3Time ���
" C1Transitions
" $ C2Transitions
" ( C3Transitions
" , Padding ��b / 0 _SYSTEM_PROCESSOR_IDLE_INFORMATION .?AU_SYSTEM_PROCESSOR_IDLE_INFORMATION@@ �� / � Z � _MANAGE_HOT_PATCH_QUERY_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_PATCHES@@ &
P Sid ��
� Buffer ���2 / D <anonymous-tag> .?AT<anonymous-tag>@@ / w � F � _HOT_PATCH_IMAGE_INFO .?AU_HOT_PATCH_IMAGE_INFO@@
/
� r
" Version ��
/ UserSid ��
" H PatchCount ���
{ L PatchPathStrings �
/ P BaseInfos Z !/ T _MANAGE_HOT_PATCH_QUERY_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_PATCHES@@ "/ w � > � _CLASSIC_EVENT_ID .?AU_CLASSIC_EVENT_ID@@ " �:
$ EventGuid
Type �
%/ Reserved �> &/ _CLASSIC_EVENT_ID .?AU_CLASSIC_EVENT_ID@@ '/ � x
�
� N � _WMI_PROCESS_INFORMATION .?AU_WMI_PROCESS_INFORMATION@@ ��
*/
� �
" UniqueProcessKey �
" ProcessId
" ParentId �
" SessionId
ExitStatus ���
" DirectoryTableBase ���
" Flags
" Sid ��N ,/ _WMI_PROCESS_INFORMATION .?AU_WMI_PROCESS_INFORMATION@@ �� -/ b � Z � _UMS_SYSTEM_THREAD_INFORMATION .?AU_UMS_SYSTEM_THREAD_INFORMATION@@ ��
" ��
" ��r
" UmsVersion ���
0/ IsUmsSchedulerThread �
1/ IsUmsWorkerThread
" ThreadUmsFlags ���Z 2/ _UMS_SYSTEM_THREAD_INFORMATION .?AU_UMS_SYSTEM_THREAD_INFORMATION@@ �� 3/ n K N � _POWER_MONITOR_INVOCATION .?AU_POWER_MONITOR_INVOCATION@@ .
Console ��
( RequestReason N 6/ _POWER_MONITOR_INVOCATION .?AU_POWER_MONITOR_INVOCATION@@ 7/ { W
� q " 9/ :/
;/
� �%
=/
� � CI_WINDOWS_LOCKDOWN_MODE_UNLOCKED CI_WINDOWS_LOCKDOWN_MODE_TRIAL ��� CI_WINDOWS_LOCKDOWN_MODE_LOCKED �� CI_WINDOWS_LOCKDOWN_MODE_MAX �J t ?/ _CI_WINDOWS_LOCKDOWN_MODE .?AW4_CI_WINDOWS_LOCKDOWN_MODE@@ � @/ � � j � _SERVICE_CONTROL_STATUS_REASON_PARAMSA .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSA@@ ��F
" dwReason �
p pszComment ���
� ServiceStatus j C/ , _SERVICE_CONTROL_STATUS_REASON_PARAMSA .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSA@@ �� D/ � � N � _MIDL_METHOD_PROPERTY_MAP .?AU_MIDL_METHOD_PROPERTY_MAP@@
� ��
G/
� *
" Count
H/ Properties ���N I/ _MIDL_METHOD_PROPERTY_MAP .?AU_MIDL_METHOD_PROPERTY_MAP@@ J/ � a J � _RPC_SECURITY_QOS_V4_W .?AU_RPC_SECURITY_QOS_V4_W@@ ��
L/
�
s HttpCredentials ��2 N/ <anonymous-tag> .?AT<anonymous-tag>@@ O/ ^ M �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
O/ u
Sid ��
u EffectiveOnly J Q/ _RPC_SECURITY_QOS_V4_W .?AU_RPC_SECURITY_QOS_V4_W@@ �� R/ ^ F Z � _PROCESS_SYSTEM_RESOURCE_MANAGEMENT .?AT_PROCESS_SYSTEM_RESOURCE_MANAGEMENT@@
" ��
" ��>
" Flags
U/ Foreground ���
V/ Reserved �Z W/ _PROCESS_SYSTEM_RESOURCE_MANAGEMENT .?AT_PROCESS_SYSTEM_RESOURCE_MANAGEMENT@@ X/ � B j � _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION .?AU_JOBOBJECT_CPU_RATE_CONTROL_INFORMATION@@ j
" ControlFlags �
" CpuRate ��
" Weight ���
! MinRate ��
! MaxRate ��j [/ _JOBOBJECT_CPU_RATE_CONTROL_INFORMATION .?AU_JOBOBJECT_CPU_RATE_CONTROL_INFORMATION@@ \/ D
�%
� R � PROCESSOR_PERFSTATE_POLICY .?AUPROCESSOR_PERFSTATE_POLICY@@ ��
��
��
��
��
AsUCHAR ��
`/ NoDomainAccounting ���
a/ IncreasePolicy ���
b/ DecreasePolicy ���
c/ Reserved �2 d/ <anonymous-tag> .?AT<anonymous-tag>@@ e/ { � �
" Revision �
MaxThrottle ��
MinThrottle ��
BusyAdjThreshold �
Spare
e/ Flags
" TimeCheck
" IncreaseTime �
" DecreaseTime �
" IncreasePercent ��
" DecreasePercent ��R g/ PROCESSOR_PERFSTATE_POLICY .?AUPROCESSOR_PERFSTATE_POLICY@@ �� h/ { � R � _PERFINFO_MEMORY_NODE_ENTRY .?AU_PERFINFO_MEMORY_NODE_ENTRY@@
j/
� .
" NodeNumber ���
# TotalPageCount ���
# SmallFreePageCount ���
# SmallZeroPageCount ���
# MediumFreePageCount ��
# $ MediumZeroPageCount ��
# , LargeFreePageCount ���
# 4 LargeZeroPageCount ���
# < HugeFreePageCount
# D HugeZeroPageCount R
l/ L _PERFINFO_MEMORY_NODE_ENTRY .?AU_PERFINFO_MEMORY_NODE_ENTRY@@ m/ b �
v
� J � _PERFINFO_TRACE_HEADER .?AU_PERFINFO_TRACE_HEADER@@ ��
" Marker ���
! Version ��
HeaderType ���
Flags
" Header ���
h# Packet ���
# TS ���
� SystemTime ���
� Data �J q/ _PERFINFO_TRACE_HEADER .?AU_PERFINFO_TRACE_HEADER@@ �� r/ b G
E t/ * � HHOOK__ .?AUHHOOK__@@
t unused ���* w/ HHOOK__ .?AUHHOOK__@@ x/ s (
" ��
" ��
" ��
" ��
" ��n
z/ Protection ���
{/ ShareCount ���
|/ Shared ���
}/ Node �
~/ VirtualPage ��N / _MEMORY_WORKING_SET_BLOCK .?AU_MEMORY_WORKING_SET_BLOCK@@ �/ w 2 N � _FILE_RENAME_INFORMATION .?AU_FILE_RENAME_INFORMATION@@ ��v
ReplaceIfExists ��
" Flags
RootDirectory
" FileNameLength ���
FileName �N �/ _FILE_RENAME_INFORMATION .?AU_FILE_RENAME_INFORMATION@@ �� �/ � 2 � _WMI_QUEUE .?AU_WMI_QUEUE@@ ��
�/
� :
Queue
" ThreadId �
Action ���2 �/ _WMI_QUEUE .?AU_WMI_QUEUE@@ �� �/ b � " � _SE_SID .?AT_SE_SID@@ &
P Sid ��
� Buffer ���" �/ D _SE_SID .?AT_SE_SID@@ �/ w 3 � IMPORT_OBJECT_ORDINAL IMPORT_OBJECT_NAME ��� IMPORT_OBJECT_NAME_NO_PREFIX � IMPORT_OBJECT_NAME_UNDECORATE IMPORT_OBJECT_NAME_EXPORTAS ��F t �/ IMPORT_OBJECT_NAME_TYPE .?AW4IMPORT_OBJECT_NAME_TYPE@@ � �/ � � b � _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE .?AU_ACCESS_ALLOWED_CALLBACK_OBJECT_ACE@@ �
� Header ���
" Mask �
" Flags
$ ObjectType ���
$ InheritedObjectType ��
" , SidStart �b �/ 0 _ACCESS_ALLOWED_CALLBACK_OBJECT_ACE .?AU_ACCESS_ALLOWED_CALLBACK_OBJECT_ACE@@ �/ w b � DISPLAYCONFIG_TARGET_PREFERRED_MODE .?AUDISPLAYCONFIG_TARGET_PREFERRED_MODE@@ N � DISPLAYCONFIG_TARGET_MODE .?AUDISPLAYCONFIG_TARGET_MODE@@ R
� header ���
u width
u height ���
�/ targetMode ���b �/ P DISPLAYCONFIG_TARGET_PREFERRED_MODE .?AUDISPLAYCONFIG_TARGET_PREFERRED_MODE@@ �/ �
j.
�
F.
� : � _OSVERSIONINFOW .?AU_OSVERSIONINFOW@@
�/
� �
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
�$ szCSDVersion �: �/ _OSVERSIONINFOW .?AU_OSVERSIONINFOW@@ �/ g � � SystemFeatureConfigurationSectionTypeBoot SystemFeatureConfigurationSectionTypeRuntime � SystemFeatureConfigurationSectionTypeUsageTriggers ��� SystemFeatureConfigurationSectionTypeCount ���n t �/ _SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE .?AW4_SYSTEM_FEATURE_CONFIGURATION_SECTION_TYPE@@ ��� �/ � y
�/
� j � _VIRTUALIZATION_INSTANCE_INFO_INPUT_EX .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT_EX@@ ��
! HeaderSize ���
" Flags
" NotificationInfoSize �
! NotificationInfoOffset ���
! ProviderMajorVersion �j �/ _VIRTUALIZATION_INSTANCE_INFO_INPUT_EX .?AU_VIRTUALIZATION_INSTANCE_INFO_INPUT_EX@@ �� �/ � �" J � tagEMRSETDIBITSTODEVICE .?AUtagEMRSETDIBITSTODEVICE@@
�/
�
� emr ��
c rclBounds
xDest
yDest
xSrc �
$ ySrc �
( cxSrc
, cySrc
" 0 offBmiSrc
" 4 cbBmiSrc �
" 8 offBitsSrc ���
" < cbBitsSrc
" @ iUsageSrc
" D iStartScan ���
" H cScans ���J �/ L tagEMRSETDIBITSTODEVICE .?AUtagEMRSETDIBITSTODEVICE@@ �/ � Z � _ETW_AUTOBOOST_NO_ENTRIES_EVENT .?AU_ETW_AUTOBOOST_NO_ENTRIES_EVENT@@
�/
� &
Lock �
" ThreadId �Z �/ _ETW_AUTOBOOST_NO_ENTRIES_EVENT .?AU_ETW_AUTOBOOST_NO_ENTRIES_EVENT@@ �/ b
F � tagEMRTRANSPARENTBLT .?AUtagEMRTRANSPARENTBLT@@ ��R
� emr ��
c rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
I 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d cxSrc
h cySrc F �/ l tagEMRTRANSPARENTBLT .?AUtagEMRTRANSPARENTBLT@@ �� �/ � R � _PERFINFO_SET_DEVICES_STATE .?AU_PERFINFO_SET_DEVICES_STATE@@ V
" SystemState ��
Waking ���
Shutdown �
IrpMinor �R �/ _PERFINFO_SET_DEVICES_STATE .?AU_PERFINFO_SET_DEVICES_STATE@@ �/ b Z
N
� 6 � USN_RECORD_UNION .?ATUSN_RECORD_UNION@@ ��6 � USN_RECORD_V2 .?AUUSN_RECORD_V2@@ 6 � USN_RECORD_V3 .?AUUSN_RECORD_V3@@ 6 � USN_RECORD_V4 .?AUUSN_RECORD_V4@@ F
�& Header ���
�/ V2 ���
�/ V3 ���
�/ V4 ���6 �/ P USN_RECORD_UNION .?ATUSN_RECORD_UNION@@ �� �/ � � 6 � _INITIAL_TEB .?AU_INITIAL_TEB@@ ��
�/
� 2
OldStackBase �
OldStackLimit : �/ <anonymous-tag> .?AU<anonymous-tag>@@ �/ � " f
�/ OldInitialTeb
StackBase
StackLimit ���
StackAllocationBase ��6 �/ _INITIAL_TEB .?AU_INITIAL_TEB@@ �� �/ � ! > � _IMAGE_LINENUMBER .?AU_IMAGE_LINENUMBER@@
�/ ��
�/
� :
" SymbolTableIndex �
" VirtualAddress ���2 �/ <anonymous-tag> .?AT<anonymous-tag>@@ �/ � *
�/ Type �
! Linenumber ���> �/ _IMAGE_LINENUMBER .?AU_IMAGE_LINENUMBER@@ �/ � � ��DPI_AWARENESS_INVALID ��� DPI_AWARENESS_UNAWARE DPI_AWARENESS_SYSTEM_AWARE ��� DPI_AWARENESS_PER_MONITOR_AWARE ��2 t �/ DPI_AWARENESS .?AW4DPI_AWARENESS@@ � �/ s
� � " ��
6 Cycles ���
# @ DiskEnergy ���
# H NetworkTailEnergy
# P MBBTailEnergy
# X NetworkTxRxBytes �
# ` MBBTxRxBytes �
�/ h Durations
� h ForegroundDuration ���
� p DesktopVisibleDuration ���
� x PSMForegroundDuration
" � CompositionRendered ��
" � CompositionDirtyGenerated
" � CompositionDirtyPropagated ���
" � Reserved1
6 � AttributedCycles �
6 � WorkOnBehalfCycles ���J �/ _PROCESS_ENERGY_VALUES .?AU_PROCESS_ENERGY_VALUES@@ �� �/ � $ * � _CURDIR .?AU_CURDIR@@ *
DosPath ��
Handle ���* �/ _CURDIR .?AU_CURDIR@@ �/ < �
� �/ Z � _FILE_SFIO_RESERVE_INFORMATION .?AU_FILE_SFIO_RESERVE_INFORMATION@@ ��
" RequestsPerPeriod
" Period ���
RetryFailures
Discardable ��
" RequestSize ��
" NumOutstandingRequests ���Z �/ _FILE_SFIO_RESERVE_INFORMATION .?AU_FILE_SFIO_RESERVE_INFORMATION@@ �� �/ � �
p t �/ . � HSPRITE__ .?AUHSPRITE__@@
t unused ���. �/ HSPRITE__ .?AUHSPRITE__@@ �/ �' �
r
� Z � _PERFINFO_SET_DEVICES_STATE_RET .?AU_PERFINFO_SET_DEVICES_STATE_RET@@
Status ���Z �/ _PERFINFO_SET_DEVICES_STATE_RET .?AU_PERFINFO_SET_DEVICES_STATE_RET@@ �/ b e f � _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER .?AU_DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER@@ z
" Version ��
" QueryFlags ���
" HashAlgorithm
� RangeOffsetInFile
� RangeLength ��f �/ _DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER .?AU_DEDUP_QUERY_FILE_HASHES_INPUT_BUFFER@@ �/ � > � _FILE_PREFETCH_EX .?AU_FILE_PREFETCH_EX@@
�/
� # " �J
" Type �
" Count
Context ��
�/ Prefetch �> �/ _FILE_PREFETCH_EX .?AU_FILE_PREFETCH_EX@@ �/ �
q&
� B � tagEMRSELECTPALETTE .?AUtagEMRSELECTPALETTE@@ "
� emr ��
" ihPal B �/ tagEMRSELECTPALETTE .?AUtagEMRSELECTPALETTE@@ �/ � �
� ��
0
�
��
0
� 0 0 " t 0
0
� N � tagPIXELFORMATDESCRIPTOR .?AUtagPIXELFORMATDESCRIPTOR@@ ��^
! nSize
! nVersion �
" dwFlags ��
iPixelType ���
cColorBits ���
cRedBits �
cRedShift
cGreenBits ���
cGreenShift ��
cBlueBits
cBlueShift ���
cAlphaBits ���
cAlphaShift ��
cAccumBits ���
cAccumRedBits
cAccumGreenBits ��
cAccumBlueBits ���
cAccumAlphaBits ��
cDepthBits ���
cStencilBits �
cAuxBuffers ��
iLayerType ���
bReserved
" dwLayerMask ��
" dwVisibleMask
" $ dwDamageMask �N 0 ( tagPIXELFORMATDESCRIPTOR .?AUtagPIXELFORMATDESCRIPTOR@@ ��
0 �
;'
� F � tagNCCALCSIZE_PARAMS .?AUtagNCCALCSIZE_PARAMS@@ �� " 0 �
�-
� "
0 rgrc �
0 0 lppos F 0 4 tagNCCALCSIZE_PARAMS .?AUtagNCCALCSIZE_PARAMS@@ �� 0 ~ �
� � � 0
{+
�
*
�
R
� ^ � _FILE_FS_SECTOR_SIZE_INFORMATION .?AU_FILE_FS_SECTOR_SIZE_INFORMATION@@ ��&
" LogicalBytesPerSector
" PhysicalBytesPerSectorForAtomicity ���
" PhysicalBytesPerSectorForPerformance �
" FileSystemEffectivePhysicalBytesPerSectorForAtomicity
" Flags
" ByteOffsetForSectorAlignment �
" ByteOffsetForPartitionAlignment ��^ 0 _FILE_FS_SECTOR_SIZE_INFORMATION .?AU_FILE_FS_SECTOR_SIZE_INFORMATION@@ �� 0 � �
�
� b � _SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT .?AU_SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT@@
0
� n
" Flags
" AlignmentShift ���
# FileOffsetToAlign
" FallbackAlignmentShift ���b 0 _SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT .?AU_SET_DAX_ALLOC_ALIGNMENT_HINT_INPUT@@ 0 � �!
#
� ^ � _TOKEN_BNO_ISOLATION_INFORMATION .?AU_TOKEN_BNO_ISOLATION_INFORMATION@@ ��:
q IsolationPrefix ��
IsolationEnabled �^ $0 _TOKEN_BNO_ISOLATION_INFORMATION .?AU_TOKEN_BNO_ISOLATION_INFORMATION@@ �� %0 w - J � _TOKEN_SID_INFORMATION .?AU_TOKEN_SID_INFORMATION@@ ��
'0
�
Sid ��J )0 _TOKEN_SID_INFORMATION .?AU_TOKEN_SID_INFORMATION@@ �� *0 w )
)"
�
H&
� � � _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@ ��n
" ReserveSize ��
" CommitSize ���
" PreferredNode
" Reserved �
Ssp �� /0 _PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@ �� 00 �
� PerfInfoMMStatNotUsed PerfInfoMMStatAggregatePageCombine ��� PerfInfoMMStatIterationPageCombine ��� PerfInfoMMStatMax : t 20 _PERFINFO_MM_STAT .?AW4_PERFINFO_MM_STAT@@ � 30 b : � _VARIABLE_NAME .?AU_VARIABLE_NAME@@ ��
50
� F
" NextEntryOffset ��
$ VendorGuid ���
Name �: 70 _VARIABLE_NAME .?AU_VARIABLE_NAME@@ �� 80 � -
�
" ��
" �� " " � �Z
;0 Offset ���
<0 HasRenderingCommand ��
" HDC ��
=0 Buffer ���: >0 �_GDI_TEB_BATCH .?AU_GDI_TEB_BATCH@@ �� ?0 D Z
"
� V � _FILE_SFIO_VOLUME_INFORMATION .?AU_FILE_SFIO_VOLUME_INFORMATION@@
B0
� ^
" MaximumRequestsPerPeriod �
" MinimumPeriod
" MinimumTransferSize ��V D0 _FILE_SFIO_VOLUME_INFORMATION .?AU_FILE_SFIO_VOLUME_INFORMATION@@ E0 � � R � tagPOINTER_DEVICE_PROPERTY .?AUtagPOINTER_DEVICE_PROPERTY@@ ��
t logicalMin ���
t logicalMax ���
t physicalMin ��
t physicalMax ��
u unit �
u unitExponent �
! usagePageId ��
! usageId ��R H0 tagPOINTER_DEVICE_PROPERTY .?AUtagPOINTER_DEVICE_PROPERTY@@ �� I0 ~ �; > � tagANIMATIONINFO .?AUtagANIMATIONINFO@@ ��
K0
� .
u cbSize ���
t iMinAnimate ��> M0 tagANIMATIONINFO .?AUtagANIMATIONINFO@@ �� N0 ~ B2
�
� 6
" HighEdgeFilter ���
" LowEdgeFilter J Q0 _JOBOBJECT_WAKE_FILTER .?AU_JOBOBJECT_WAKE_FILTER@@ �� R0 � �
�
� 6
T0 ExceptionRecord ��
�& ContextRecord B U0 _EXCEPTION_POINTERS .?AU_EXCEPTION_POINTERS@@ V0 �% o V � _ETW_COVERAGE_SAMPLER_MODULE .?AU_ETW_COVERAGE_SAMPLER_MODULE@@ ��
X0
� *
" PathOffset ���
" PathLength ���
" DebugInfoOffset ��
" DebugInfoLength ��
" TimeDateStamp
" ImageChecksum
" ImageSize
" ModuleId �
" ModuleSequence ���
" $ ExeModuleId ��
" ( ExeModuleSequence
" , ExeProcessId �V Z0 0 _ETW_COVERAGE_SAMPLER_MODULE .?AU_ETW_COVERAGE_SAMPLER_MODULE@@ �� [0 @ 2 B � tagENUMLOGFONTEXDVW .?AUtagENUMLOGFONTEXDVW@@ > � tagENUMLOGFONTEXW .?AUtagENUMLOGFONTEXW@@ :
^0 elfEnumLogfontEx �
" \elfDesignVector ��B _0 �tagENUMLOGFONTEXDVW .?AUtagENUMLOGFONTEXDVW@@ `0 � U V � _KEY_OPEN_SUBKEYS_INFORMATION .?AU_KEY_OPEN_SUBKEYS_INFORMATION@@ 6 � KEY_PID_ARRAY .?AUKEY_PID_ARRAY@@ c0 " �&
" Count
d0 KeyArray �V e0 _KEY_OPEN_SUBKEYS_INFORMATION .?AU_KEY_OPEN_SUBKEYS_INFORMATION@@ f0 � t
�
� V � _ETW_TP_EVENT_POOL_TH_MIN_SET .?AU_ETW_TP_EVENT_POOL_TH_MIN_SET@@ >
m Header ���
PoolId ���
" $ ThreadNum V j0 ( _ETW_TP_EVENT_POOL_TH_MIN_SET .?AU_ETW_TP_EVENT_POOL_TH_MIN_SET@@ k0 b � f � _PERFINFO_YIELD_PROCESSOR_INFORMATION .?AU_PERFINFO_YIELD_PROCESSOR_INFORMATION@@ N
" YieldReason ��
" DpcWatchdogCount �
" DpcTimeCount �f n0 _PERFINFO_YIELD_PROCESSOR_INFORMATION .?AU_PERFINFO_YIELD_PROCESSOR_INFORMATION@@ o0 b � B � _RTL_LFG_RNG_STATE .?AU_RTL_LFG_RNG_STATE@@ ��
q0
� " " � �6
s0 SeedArray
" � Next �
" � NextP B t0 � _RTL_LFG_RNG_STATE .?AU_RTL_LFG_RNG_STATE@@ �� u0 g �
� BootEntropySourceStructureUninitialized �� BootEntropySourceDisabledByPolicy BootEntropySourceNotPresent �� BootEntropySourceError ��� BootEntropySourceSuccess �Z t w0 _BOOT_ENTROPY_SOURCE_RESULT_CODE .?AW4_BOOT_ENTROPY_SOURCE_RESULT_CODE@@ ��� x0 � Z � _SYSTEM_PAGEFILE_INFORMATION_EX .?AU_SYSTEM_PAGEFILE_INFORMATION_EX@@ V � _SYSTEM_PAGEFILE_INFORMATION .?AU_SYSTEM_PAGEFILE_INFORMATION@@ ��B
{0 Info �
" MinimumSize ��
" MaximumSize ��Z |0 _SYSTEM_PAGEFILE_INFORMATION_EX .?AU_SYSTEM_PAGEFILE_INFORMATION_EX@@ }0 � G > � _Wx86ThreadState .?AU_Wx86ThreadState@@ ��
0
� n
" CallBx86Eip ��
DeallocationCpu ��
UseKnownWx86Dll ��
p OleStubInvoked ���> �0 _Wx86ThreadState .?AU_Wx86ThreadState@@ �� �0 D g > � tagSCROLLBARINFO .?AUtagSCROLLBARINFO@@ ��
�0
� �
" cbSize ���
rcScrollBar ��
t dxyLineButton
t xyThumbTop ���
t xyThumbBottom
t reserved �
� $ rgstate ��> �0 < tagSCROLLBARINFO .?AUtagSCROLLBARINFO@@ �� �0 ~ 79
�
� 6 � _MUILANGUAGES .?AU_MUILANGUAGES@@ 6 � _MUILANGINFO .?AU_MUILANGINFO@@ ��
�0
� ~
u TotalSize
! MaxNumLanguages ��
! NumLanguages �
! NumInstalledLanguages
�0 LangInfos 6 �0 _MUILANGUAGES .?AU_MUILANGUAGES@@ �0 <
� F
left �
top ��
right
bottom ���* �0 tagRECT .?AUtagRECT@@ �0 s �
�
�
t unused ���* �0 HMENU__ .?AUHMENU__@@ �0 s Z F � _GHOSTED_FILE_EXTENT .?AU_GHOSTED_FILE_EXTENT@@ ��
� FileOffset ���
� ByteCount
$ RecallOwnerGuid ��
" NextEntryOffset ��
" $ RecallMetadataBufferSize �
� ( RecallMetadataBuffer �F �0 0 _GHOSTED_FILE_EXTENT .?AU_GHOSTED_FILE_EXTENT@@ �� �0 � �* J � _KCRM_TRANSACTION_BLOB .?AU_KCRM_TRANSACTION_BLOB@@ ��
$ UOW ��
$ TmIdentity ���
" IsolationLevel ���
" $ IsolationFlags ���
" ( Timeout ��
, Description ��J �0 � _KCRM_TRANSACTION_BLOB .?AU_KCRM_TRANSACTION_BLOB@@ �� �0 � � ^ � _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE .?AU_SYSTEM_AUDIT_CALLBACK_OBJECT_ACE@@ �
� Header ���
" Mask �
" Flags
$ ObjectType ���
$ InheritedObjectType ��
" , SidStart �^ �0 0 _SYSTEM_AUDIT_CALLBACK_OBJECT_ACE .?AU_SYSTEM_AUDIT_CALLBACK_OBJECT_ACE@@ �0 w ' � DynamicTickDisableReasonNone � DynamicTickDisableReasonBcdOverride �� DynamicTickDisableReasonNoHwSupport �� DynamicTickDisableReasonEmOverride ��� DynamicTickDisableReasonMax ��b t �0 _PERFINFO_DYNAMIC_TICK_DISABLE_REASON .?AW4_PERFINFO_DYNAMIC_TICK_DISABLE_REASON@@ � �0 b
B � _RTL_STACK_CONTEXT .?AU_RTL_STACK_CONTEXT@@ ��N � _RTL_STACK_CONTEXT_ENTRY .?AU_RTL_STACK_CONTEXT_ENTRY@@ �� �0 " �.
" NumberOfEntries ��
�0 Entry B �0 _RTL_STACK_CONTEXT .?AU_RTL_STACK_CONTEXT@@ �� �0 � �
" DeviceInstance ���
" DeviceFlags ��
" ResourceType �
# ResourceStart
# ResourceEnd ��
" ResourceFlags ^ �0 ( _PLUGPLAY_CONTROL_CONFLICT_ENTRY .?AU_PLUGPLAY_CONTROL_CONFLICT_ENTRY@@ �� �0 $ �
" ��
" ��
" ��n
" Flags
�0 DisableNonSystemFonts
�0 AuditNonSystemFontLoading
�0 ReservedFlags j �0 _PROCESS_MITIGATION_FONT_DISABLE_POLICY .?AU_PROCESS_MITIGATION_FONT_DISABLE_POLICY@@ �0 D �
F%
� :
! Level
! Sbz ��
� ObjectType ���> �0 _OBJECT_TYPE_LIST .?AU_OBJECT_TYPE_LIST@@ �0 w :
V
� F � tagNONCLIENTMETRICSA .?AUtagNONCLIENTMETRICSA@@ ��
u cbSize ���
t iBorderWidth �
t iScrollWidth �
t iScrollHeight
t iCaptionWidth
t iCaptionHeight ���
� lfCaptionFont
t T iSmCaptionWidth ��
t X iSmCaptionHeight �
� \ lfSmCaptionFont ��
t � iMenuWidth ���
t � iMenuHeight ��
� � lfMenuFont ���
� � lfStatusFont �
� lfMessageFont
t TiPaddedBorderWidth ���F �0 XtagNONCLIENTMETRICSA .?AUtagNONCLIENTMETRICSA@@ �� �0 ~ �1 F � tagEMRCREATEMONOBRUSH .?AUtagEMRCREATEMONOBRUSH@@
�0
� �
� emr ��
" ihBrush ��
" iUsage ���
" offBmi ���
" cbBmi
" offBits ��
" cbBits ���F �0 tagEMRCREATEMONOBRUSH .?AUtagEMRCREATEMONOBRUSH@@ �0 � j
�
� v � _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION@@ &
ImageFile
" Type �v �0 _SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION@@ �0 � 3 R � _LPC_UNREGISTER_PROCESS_MSG .?AU_LPC_UNREGISTER_PROCESS_MSG@@
�0
� 2
\ PortMsg ��
UniqueProcessId ��R �0 _LPC_UNREGISTER_PROCESS_MSG .?AU_LPC_UNREGISTER_PROCESS_MSG@@ �0 � � F � _PERFINFO_CCSWAP_LITE .?AU_PERFINFO_CCSWAP_LITE@@
�0
�
" ��
" ��
" ��
" ��
" ��~
�0 DataType �
�0 OldThreadIdIndex �
�0 OldThreadPriInc ��
�0 OldThreadStateWr �
�0 TimeDelta F �0 _PERFINFO_CCSWAP_LITE .?AU_PERFINFO_CCSWAP_LITE@@ �0 b � B � _PROCESS_HEAP_ENTRY .?AU_PROCESS_HEAP_ENTRY@@
�0
� *
hMem �
� dwReserved ���: �0 <anonymous-tag> .?AU<anonymous-tag>@@ �0 � � j
" dwCommittedSize ��
" dwUnCommittedSize
lpFirstBlock �
lpLastBlock ��: �0 <anonymous-tag> .?AU<anonymous-tag>@@ �0 � � �
lpData ���
" cbData ���
cbOverhead ���
iRegionIndex �
!
wFlags ���
�0 Block
�0 Region ���B �0 _PROCESS_HEAP_ENTRY .?AU_PROCESS_HEAP_ENTRY@@ �0 � � f � _SYSTEM_WRITE_CONSTRAINT_INFORMATION .?AU_SYSTEM_WRITE_CONSTRAINT_INFORMATION@@ ��
�0
� 6
" WriteConstraintPolicy
" Reserved �f �0 _SYSTEM_WRITE_CONSTRAINT_INFORMATION .?AU_SYSTEM_WRITE_CONSTRAINT_INFORMATION@@ �� �0 � s b � _TXFS_ROLLFORWARD_REDO_INFORMATION .?AU_TXFS_ROLLFORWARD_REDO_INFORMATION@@ ��f
� LastVirtualClock �
# LastRedoLsn ��
# HighestRecoveryLsn ���
" Flags b �0 _TXFS_ROLLFORWARD_REDO_INFORMATION .?AU_TXFS_ROLLFORWARD_REDO_INFORMATION@@ �� �0 � � f � _TRANSACTION_ENLISTMENTS_INFORMATION .?AU_TRANSACTION_ENLISTMENTS_INFORMATION@@ �� � " �>
" NumberOfEnlistments ��
�0 EnlistmentPair ���f �0 $ _TRANSACTION_ENLISTMENTS_INFORMATION .?AU_TRANSACTION_ENLISTMENTS_INFORMATION@@ �� �0 �
J
� �
! Machine ��
! NumberOfSections �
" TimeDateStamp
" PointerToSymbolTable �
" NumberOfSymbols ��
! SizeOfOptionalHeader �
! Characteristics ��B �0 _IMAGE_FILE_HEADER .?AU_IMAGE_FILE_HEADER@@ �� �0 � � J � tagEMRSETWORLDTRANSFORM .?AUtagEMRSETWORLDTRANSFORM@@ "
� emr ��
I xform J �0 tagEMRSETWORLDTRANSFORM .?AUtagEMRSETWORLDTRANSFORM@@ �0 � � b � _FINDFIRSTACTIVATIONCONTEXTSECTION .?AU_FINDFIRSTACTIVATIONCONTEXTSECTION@@ ��n
" Size �
" Flags
� ExtensionGuid
" Id ���
" Depth
" OutFlags �b �0 _FINDFIRSTACTIVATIONCONTEXTSECTION .?AU_FINDFIRSTACTIVATIONCONTEXTSECTION@@ �� �0 � 3 ^ � _WORKER_FACTORY_BASIC_INFORMATION .?AU_WORKER_FACTORY_BASIC_INFORMATION@@
�%
� ^
� Timeout ��
� RetryTimeout �
� IdleTimeout ��
Paused ���
TimerSet �
QueuedToExWorker �
MayCreate
CreateInProgress �
InsertedIntoQueue
Shutdown �
" BindingCount �
" $ ThreadMinimum
" ( ThreadMaximum
" , PendingWorkerCount ���
" 0 WaitingWorkerCount ���
" 4 TotalWorkerCount �
" 8 ReleaseCount �
@ InfiniteWaitGoal �
�0 H StartRoutine �
L StartParameter ���
P ProcessId
" T StackReserve �
" X StackCommit ��
\ LastThreadCreationStatus �^ 1 ` _WORKER_FACTORY_BASIC_INFORMATION .?AU_WORKER_FACTORY_BASIC_INFORMATION@@ 1 � � PoDisabledStateSleeping1 � PoDisabledStateSleeping2 � PoDisabledStateSleeping3 � PoDisabledStateSleeping4 � PoDisabledStateSleeping0Idle � PoDisabledStateReserved5 � PoDisabledStateSleeping4Firmware � PoDisabledStateMaximum ���J t 1 POWER_STATE_DISABLED_TYPE .?AW4POWER_STATE_DISABLED_TYPE@@ � 1 { N � _ETW_TP_EVENT_POOL_CLOSE .?AU_ETW_TP_EVENT_POOL_CLOSE@@ ��*
m Header ���
PoolId ���N 1 ( _ETW_TP_EVENT_POOL_CLOSE .?AU_ETW_TP_EVENT_POOL_CLOSE@@ �� 1 b �
�)
� N � _WMI_IMAGEID_INFORMATION .?AU_WMI_IMAGEID_INFORMATION@@ ��r
ImageBase
" ImageSize
" ProcessId
" TimeDateStamp
OriginalFileName �N 1 _WMI_IMAGEID_INFORMATION .?AU_WMI_IMAGEID_INFORMATION@@ ��
1 b y r � _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION .?AU_SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION@@ ��"
� EnclaveLaunchSigner ��r 1 _SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION .?AU_SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION@@ �� 1 � N
$
� 1 ! t 1
1
� j � _TRANSACTIONMANAGER_OLDEST_INFORMATION .?AU_TRANSACTIONMANAGER_OLDEST_INFORMATION@@ ��
1
� "
$ OldestTransactionGuid j 1 _TRANSACTIONMANAGER_OLDEST_INFORMATION .?AU_TRANSACTIONMANAGER_OLDEST_INFORMATION@@ �� 1 � � N � _ENCLAVE_CREATE_INFO_VBS .?AU_ENCLAVE_CREATE_INFO_VBS@@ ��&
" Flags
� OwnerID ��N 1 $ _ENCLAVE_CREATE_INFO_VBS .?AU_ENCLAVE_CREATE_INFO_VBS@@ �� 1 � �
�
� � " � �f
! Magic
MajorLinkerVersion ���
MinorLinkerVersion ���
" SizeOfCode ���
" SizeOfInitializedData
" SizeOfUninitializedData ��
" AddressOfEntryPoint ��
" BaseOfCode ���
" BaseOfData ���
" ImageBase
" SectionAlignment �
" $ FileAlignment
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
! , MajorImageVersion
! . MinorImageVersion
! 0 MajorSubsystemVersion
! 2 MinorSubsystemVersion
" 4 Win32VersionValue
" 8 SizeOfImage ��
" < SizeOfHeaders
" @ CheckSum �
! D Subsystem
! F DllCharacteristics ���
" H SizeOfStackReserve ���
" L SizeOfStackCommit
" P SizeOfHeapReserve
" T SizeOfHeapCommit �
" X LoaderFlags ��
" \ NumberOfRvaAndSizes ��
!1 ` DataDirectory J "1 � _IMAGE_OPTIONAL_HEADER .?AU_IMAGE_OPTIONAL_HEADER@@ �� #1 � J � RPC_INTERFACE_TEMPLATEW .?AURPC_INTERFACE_TEMPLATEW@@
%1
� '1
(1
� 6 � _UUID_VECTOR .?AU_UUID_VECTOR@@ ��
*1
� �
" Version ��
IfSpec ���
1 MgrTypeUuid ��
MgrEpv ���
u Flags
u MaxCalls �
u MaxRpcSize ���
)1 IfCallback ���
+1 UuidVector ���
q $ Annotation ���
( SecurityDescriptor ���J ,1 , RPC_INTERFACE_TEMPLATEW .?AURPC_INTERFACE_TEMPLATEW@@ -1 ^ V � _RTL_SEGMENT_HEAP_PARAMETERS .?AU_RTL_SEGMENT_HEAP_PARAMETERS@@ �� " " �b
! Version ��
! Size �
" Flags
, MemorySource �
01 Reserved �V 11 0 _RTL_SEGMENT_HEAP_PARAMETERS .?AU_RTL_SEGMENT_HEAP_PARAMETERS@@ �� 21 g �
N � _SYSTEM_FLUSH_INFORMATION .?AU_SYSTEM_FLUSH_INFORMATION@@
41
� ~
" SupportedFlushMethods
" ProcessorCacheFlushSize ��
# SystemFlushCapabilities ��
& Reserved �N 61 _SYSTEM_FLUSH_INFORMATION .?AU_SYSTEM_FLUSH_INFORMATION@@ 71 � Q R � _PROCESS_WINDOW_INFORMATION .?AU_PROCESS_WINDOW_INFORMATION@@
91
� N
" WindowFlags ��
! WindowTitleLength
WindowTitle ��R ;1 _PROCESS_WINDOW_INFORMATION .?AU_PROCESS_WINDOW_INFORMATION@@ <1 � � f � _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO .?AU_PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO@@ ��
! ��
! ��
! ��j
! Flags
?1 ActiveDataReference ��
@1 DeviceEjectable ��
A1 WritableHandles ��2 B1 <anonymous-tag> .?AT<anonymous-tag>@@ C1 b j
FileObject ���
" DeviceCharacteristics
! FileCharacteristics ��
C1
Flags f E1 _PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO .?AU_PERFINFO_IMAGELOAD_IN_PAGEFILE_INFO@@ �� F1 b ^ � _PERFINFO_PMC_SAMPLE_INFORMATION .?AU_PERFINFO_PMC_SAMPLE_INFORMATION@@ ��
H1
� b
InstructionPointer ���
" ThreadId �
! ProfileSource
!
Reserved �^ J1 _PERFINFO_PMC_SAMPLE_INFORMATION .?AU_PERFINFO_PMC_SAMPLE_INFORMATION@@ �� K1 b � b � _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM .?AU_SERVICE_TRIGGER_SPECIFIC_DATA_ITEM@@
M1
� z
" dwTriggerType
" dwAction �
� pTriggerSubtype ��
" cDataItems ���
N1 pDataItems ���> O1 _SERVICE_TRIGGER .?AU_SERVICE_TRIGGER@@ �� P1 � | j R1
Y
� N � _PERFINFO_PROCESS_INSWAP .?AU_PERFINFO_PROCESS_INSWAP@@ ��6
" DirectoryTableBase ���
" ProcessId N V1 _PERFINFO_PROCESS_INSWAP .?AU_PERFINFO_PROCESS_INSWAP@@ �� W1 b #
�%
� f � _TRANSACTIONMANAGER_BASIC_INFORMATION .?AU_TRANSACTIONMANAGER_BASIC_INFORMATION@@
Z1
� 2
$ TmIdentity ���
� VirtualClock �f \1 _TRANSACTIONMANAGER_BASIC_INFORMATION .?AU_TRANSACTIONMANAGER_BASIC_INFORMATION@@ ]1 � �
�"
� B � tagCOLORADJUSTMENT .?AUtagCOLORADJUSTMENT@@ ��
`1
� .
! caSize ���
! caFlags ��
! caIlluminantIndex
! caRedGamma ���
! caGreenGamma �
!
caBlueGamma ��
! caReferenceBlack �
! caReferenceWhite �
caContrast ���
caBrightness �
caColorfulness ���
caRedGreenTint ���B b1 tagCOLORADJUSTMENT .?AUtagCOLORADJUSTMENT@@ �� c1 � p V � _SYSTEM_HIBERFILE_INFORMATION .?AU_SYSTEM_HIBERFILE_INFORMATION@@
e1
� � " �.
" NumberOfMcbPairs �
g1 Mcb ��V h1 _SYSTEM_HIBERFILE_INFORMATION .?AU_SYSTEM_HIBERFILE_INFORMATION@@ i1 { � 6 � _IELF_HANDLE .?AU_IELF_HANDLE@@ ��
! Next �
# LastRecordRead ���
WorkItem �
LogPublisher �
LogModule
" RefCount �
" Signature
" $ Flags
" ( MajorVersion �
" , MinorVersion �
" 0 dwNotifyRequests �
" 4 NameLength ���
8 Name �6
l1 @ _IELF_HANDLE .?AU_IELF_HANDLE@@ �� m1 B _ z
! MakeCode �
! Flags
! Reserved �
! VKey �
u Message ��
" ExtraInformation �: o1 tagRAWKEYBOARD .?AUtagRAWKEYBOARD@@ �� p1 ~ �:
��
��
��
��V
r1 Channel ��
s1 Reserved �
t1 Shared ���
u1 MoreEntries ��N v1 _DMA_CONFIGURATION_BYTE0 .?AU_DMA_CONFIGURATION_BYTE0@@ �� w1 � N � USN_TRACK_MODIFIED_RANGES .?AUUSN_TRACK_MODIFIED_RANGES@@ V
" Flags
" Unused ���
# ChunkSize
FileSizeThreshold N z1 USN_TRACK_MODIFIED_RANGES .?AUUSN_TRACK_MODIFIED_RANGES@@ {1 � R
�!
� N � _ETW_STACK_CACHING_CONFIG .?AU_ETW_STACK_CACHING_CONFIG@@ .
" CacheSize
" BucketCount ��N 1 _ETW_STACK_CACHING_CONFIG .?AU_ETW_STACK_CACHING_CONFIG@@ �1 b > V � _SYSTEM_CALL_TIME_INFORMATION .?AU_SYSTEM_CALL_TIME_INFORMATION@@
�1
� F
" Length ���
" TotalCalls ���
g1 TimeOfCalls ��V �1 _SYSTEM_CALL_TIME_INFORMATION .?AU_SYSTEM_CALL_TIME_INFORMATION@@ �1 � � R � tagWTSSESSION_NOTIFICATION .?AUtagWTSSESSION_NOTIFICATION@@ ��
�1
� .
" cbSize ���
" dwSessionId ��R �1 tagWTSSESSION_NOTIFICATION .?AUtagWTSSESSION_NOTIFICATION@@ �� �1 ~ ~ J � _KEY_FLAGS_INFORMATION .?AU_KEY_FLAGS_INFORMATION@@ ��F
" Wow64Flags ���
" KeyFlags �
" ControlFlags �J �1 _KEY_FLAGS_INFORMATION .?AU_KEY_FLAGS_INFORMATION@@ �� �1 � R J � _FILEOFFSET_INFORMATION .?AU_FILEOFFSET_INFORMATION@@
# ��
# 0 ��
# 9��>
�1 DontUse ��
�1 Offset ���
�1 Reserved �J �1 _FILEOFFSET_INFORMATION .?AU_FILEOFFSET_INFORMATION@@ �1 w b � _PROCESS_COMMIT_RELEASE_INFORMATION .?AU_PROCESS_COMMIT_RELEASE_INFORMATION@@
�1
�
" ��
" ��
" ��
" ���
" Version ��
�1 Eligible �
�1 ReleaseRepurposedMemResetCommit ��
�1 ForceReleaseMemResetCommit ���
�1 Spare
" CommitDebt ���
" CommittedMemResetSize
" RepurposedMemResetSize ���b �1 _PROCESS_COMMIT_RELEASE_INFORMATION .?AU_PROCESS_COMMIT_RELEASE_INFORMATION@@ �1 � �
/
�
�
� * � HIMCC__ .?AUHIMCC__@@
t unused ���* �1 HIMCC__ .?AUHIMCC__@@ �1 � 6 � tagMINMAXINFO .?AUtagMINMAXINFO@@
�1
� ~
� ptReserved ���
� ptMaxSize
� ptMaxPosition
� ptMinTrackSize ���
� ptMaxTrackSize ���6 �1 ( tagMINMAXINFO .?AUtagMINMAXINFO@@ �1 ~ � B � _EXCEPTION_RECORD64 .?AU_EXCEPTION_RECORD64@@ # " x ��
ExceptionCode
" ExceptionFlags ���
# ExceptionRecord ��
# ExceptionAddress �
" NumberParameters �
" __unusedAlignment
�1 ExceptionInformation �B �1 � _EXCEPTION_RECORD64 .?AU_EXCEPTION_RECORD64@@ �1 �% a
�,
� * � pvalueA .?AUpvalueA@@ b
p pv_valuename �
t pv_valuelen ��
pv_value_context �
" pv_type ��* �1 pvalueA .?AUpvalueA@@ �1 � � :
" uMsg �
! wParamL ��
! wParamH ��> �1 tagHARDWAREINPUT .?AUtagHARDWAREINPUT@@ �� �1 ~ � R � _FSCTL_OFFLOAD_WRITE_OUTPUT .?AU_FSCTL_OFFLOAD_WRITE_OUTPUT@@ :
" Size �
" Flags
# LengthWritten R �1 _FSCTL_OFFLOAD_WRITE_OUTPUT .?AU_FSCTL_OFFLOAD_WRITE_OUTPUT@@ �1 � � > � tagENHMETARECORD .?AUtagENHMETARECORD@@ ��2
" iType
" nSize
z dParm > �1 tagENHMETARECORD .?AUtagENHMETARECORD@@ �� �1 � 4 ^ � _RTLP_PROCESS_REFLECTION_CONTEXT .?AU_RTLP_PROCESS_REFLECTION_CONTEXT@@ ��
�1
�
�%
�
" ReflectionContextSize
" ReflectionFlags ��
�1 ReflectionRoutine
ReflectionParameter ��
ReflectedProcessCreatedEvent �
ReflectedProcessHandlesDuplicatedEvent ���
ReflectionStartEvent �
3 ReflectionInformation ^ �1 , _RTLP_PROCESS_REFLECTION_CONTEXT .?AU_RTLP_PROCESS_REFLECTION_CONTEXT@@ �� �1 � � 6 � _RTL_BACKOFF .?AU_RTL_BACKOFF@@ ��
" Delay 6 �1 _RTL_BACKOFF .?AU_RTL_BACKOFF@@ �� �1 � b � _FILE_VALID_DATA_LENGTH_INFORMATION .?AU_FILE_VALID_DATA_LENGTH_INFORMATION@@
� ValidDataLength ��b �1 _FILE_VALID_DATA_LENGTH_INFORMATION .?AU_FILE_VALID_DATA_LENGTH_INFORMATION@@ �1 � �
�)
� 6 � tagSTICKYKEYS .?AUtagSTICKYKEYS@@
�1
� *
u cbSize ���
" dwFlags ��6 �1 tagSTICKYKEYS .?AUtagSTICKYKEYS@@ �1 ~ �3 J � _FILE_LEVEL_TRIM_RANGE .?AU_FILE_LEVEL_TRIM_RANGE@@ ��*
# Offset ���
# Length ���J �1 _FILE_LEVEL_TRIM_RANGE .?AU_FILE_LEVEL_TRIM_RANGE@@ �� �1 � 9 J � _IMAGE_ENCLAVE_CONFIG32 .?AU_IMAGE_ENCLAVE_CONFIG32@@ F
" Size �
" MinimumRequiredConfigSize
" PolicyFlags ��
" NumberOfImports ��
" ImportList ���
" ImportEntrySize ��
o FamilyID �
o ( ImageID ��
" 8 ImageVersion �
" < SecurityVersion ��
" @ EnclaveSize ��
" D NumberOfThreads ��
" H EnclaveFlags �J
�1 L _IMAGE_ENCLAVE_CONFIG32 .?AU_IMAGE_ENCLAVE_CONFIG32@@ �1 � c �
1( TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
q ServerCertificateSubject �^ �1 _RPC_HTTP_TRANSPORT_CREDENTIALS_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_W@@ �1 ^ � 6 � tagSTYLEBUFW .?AUtagSTYLEBUFW@@ ��.
" dwStyle ��
szDescription 6 �1 D tagSTYLEBUFW .?AUtagSTYLEBUFW@@ �� �1 � � F � tagEMRSETMAPPERFLAGS .?AUtagEMRSETMAPPERFLAGS@@ ��
�1
� &
� emr ��
" dwFlags ��F �1 tagEMRSETMAPPERFLAGS .?AUtagEMRSETMAPPERFLAGS@@ �� �1 � � � �1
�
� J � _PERFINFO_CC_READ_AHEAD .?AU_PERFINFO_CC_READ_AHEAD@@ �
" WorkItemKey ��
# FileOffset ���
" Size �
" PagePriority �
" DetectedPattern ��
" Reserved �J �1 _PERFINFO_CC_READ_AHEAD .?AU_PERFINFO_CC_READ_AHEAD@@ �1 b � # t/ B � _GLYPHMETRICSFLOAT .?AU_GLYPHMETRICSFLOAT@@ ��
�1
� 2 � _POINTFLOAT .?AU_POINTFLOAT@@ ~
@ gmfBlackBoxX �
@ gmfBlackBoxY �
�1 gmfptGlyphOrigin �
@ gmfCellIncX ��
@ gmfCellIncY ��B
�1 _GLYPHMETRICSFLOAT .?AU_GLYPHMETRICSFLOAT@@ �� �1 � U J � _EXIT_THREAD_DEBUG_INFO .?AU_EXIT_THREAD_DEBUG_INFO@@
" dwExitCode ���J �1 _EXIT_THREAD_DEBUG_INFO .?AU_EXIT_THREAD_DEBUG_INFO@@ �1 � H : � DLGITEMTEMPLATE .?AUDLGITEMTEMPLATE@@ v
" style
" dwExtendedStyle ��
x
y
cx ���
cy ���
! id ���: �1 DLGITEMTEMPLATE .?AUDLGITEMTEMPLATE@@ �1 ~ X J � _WMI_JOB_REMOVE_PROCESS .?AU_WMI_JOB_REMOVE_PROCESS@@ v
$ ContainerId ��
" JobId
" UniqueProcessId ��
" RemovalFlags �
ExitStatus ���J �1 _WMI_JOB_REMOVE_PROCESS .?AU_WMI_JOB_REMOVE_PROCESS@@ 2 b � B � _WINDOWS_OS_OPTIONS .?AU_WINDOWS_OS_OPTIONS@@ r
Signature
" Version ��
" Length ���
" OsLoadPathOffset �
OsLoadOptions B 2 _WINDOWS_OS_OPTIONS .?AU_WINDOWS_OS_OPTIONS@@ 2 � � > � localeinfo_struct .?AUlocaleinfo_struct@@ J � threadlocaleinfostruct .?AUthreadlocaleinfostruct@@ ��
2
�
}.
� *
2 locinfo ��
2 mbcinfo ��>
2 localeinfo_struct .?AUlocaleinfo_struct@@ 2 ( � N � _PROCESS_TLS_INFORMATION .?AU_PROCESS_TLS_INFORMATION@@ ��J � _THREAD_TLS_INFORMATION .?AU_THREAD_TLS_INFORMATION@@ 2 " �
" Flags
" OperationType
" ThreadDataCount ��
" TlsIndex �
" PreviousCount
2 ThreadData ���N 2 _PROCESS_TLS_INFORMATION .?AU_PROCESS_TLS_INFORMATION@@ �� 2 � o
�&
� B PerfInfoMemUsagePfnMetadata �� PerfInfoMemUsageMax ��Z t 2 _PERFINFO_KERNELMEMORY_USAGE_TYPE .?AW4_PERFINFO_KERNELMEMORY_USAGE_TYPE@@ � 2 b R � _PERFINFO_IDLE_STATE_CHANGE .?AU_PERFINFO_IDLE_STATE_CHANGE@@ :
" State
" Throttle �
" Direction R 2 _PERFINFO_IDLE_STATE_CHANGE .?AU_PERFINFO_IDLE_STATE_CHANGE@@ 2 b 4 6 � tagEMRELLIPSE .?AUtagEMRELLIPSE@@ &
� emr ��
c rclBox ���6 2 tagEMRELLIPSE .?AUtagEMRELLIPSE@@ 2 �
+(
� �
" lcsSignature �
" lcsVersion ���
" lcsSize ��
lcsCSType
lcsIntent
� lcsEndpoints �
" 8 lcsGammaRed ��
" < lcsGammaGreen
" @ lcsGammaBlue �
� D lcsFilename ��>
2 LtagLOGCOLORSPACEW .?AUtagLOGCOLORSPACEW@@ !2 �
m!
�
k) ��
$2
� ^ � _SYSTEM_CODEINTEGRITY_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_INFORMATION@@ 6
" Length ���
" CodeIntegrityOptions �^ '2 _SYSTEM_CODEINTEGRITY_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_INFORMATION@@ (2 � �
R � _SHRINK_VOLUME_INFORMATION .?AU_SHRINK_VOLUME_INFORMATION@@ ��> ShrinkPrepare ShrinkCommit � ShrinkAbort ��R t +2 _SHRINK_VOLUME_REQUEST_TYPES .?AW4_SHRINK_VOLUME_REQUEST_TYPES@@ ��� ,2 � � N
,2 ShrinkRequestType
# Flags
NewNumberOfSectors ���R .2 _SHRINK_VOLUME_INFORMATION .?AU_SHRINK_VOLUME_INFORMATION@@ �� /2 � � * � _FP_80 .?AU_FP_80@@ ��
12
�
� W * 32 _FP_80 .?AU_FP_80@@ �� 42 � >
�
" ��
" ��
" ��
" ��
" ��
" Flags
72 EnableBottomUpRandomization ��
82 EnableForceRelocateImages
92 EnableHighEntropy
:2 DisallowStrippedImages ���
;2 ReservedFlags Z <2 _PROCESS_MITIGATION_ASLR_POLICY .?AU_PROCESS_MITIGATION_ASLR_POLICY@@ =2 D ? Z � _ETW_WNF_EVENT_NAME_SUB_RUNDOWN .?AU_ETW_WNF_EVENT_NAME_SUB_RUNDOWN@@
?2
� >
m Header ���
� StateName
( NameSub ��Z A2 0 _ETW_WNF_EVENT_NAME_SUB_RUNDOWN .?AU_ETW_WNF_EVENT_NAME_SUB_RUNDOWN@@ B2 b � F FindStreamInfoStandard ��� FindStreamInfoMaxInfoLevel ���> t D2 _STREAM_INFO_LEVELS .?AW4_STREAM_INFO_LEVELS@@ � E2 T L
�"
� > � _CACHE_DESCRIPTOR .?AU_CACHE_DESCRIPTOR@@
H2
� ^
Level
Associativity
! LineSize �
" Size �
- Type �> J2 _CACHE_DESCRIPTOR .?AU_CACHE_DESCRIPTOR@@ K2 �
i!
�
� b � _SECTION_INTERNAL_IMAGE_INFORMATION .?AU_SECTION_INTERNAL_IMAGE_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�( SectionInformation ���
" 0 ExtendedFlags
P2 0 ImageExportSuppressionEnabled
Q2 0 ImageCetShadowStacksReady
R2 0 ImageXfgEnabled ��
S2 0 ImageCetShadowStacksStrictMode ���
T2 0 ImageCetSetContextIpValidationRelaxedMode
U2 0 ImageCetDynamicApisAllowInProc ���
V2 0 ImageCetDowngradeReserved1 ���
W2 0 ImageCetDowngradeReserved2 ���
X2 0 Reserved �b Y2 4 _SECTION_INTERNAL_IMAGE_INFORMATION .?AU_SECTION_INTERNAL_IMAGE_INFORMATION@@ Z2 w � ^ � _SYSTEM_MEMORY_USAGE_INFORMATION .?AU_SYSTEM_MEMORY_USAGE_INFORMATION@@ ��
\2
� �
# TotalPhysicalBytes ���
# AvailableBytes ���
ResidentAvailableBytes ���
# CommittedBytes ���
# SharedCommittedBytes �
# ( CommitLimitBytes �
# 0 PeakCommitmentBytes ��^ ^2 8 _SYSTEM_MEMORY_USAGE_INFORMATION .?AU_SYSTEM_MEMORY_USAGE_INFORMATION@@ �� _2 � y v � _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION .?AU_PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION@@
a2
�
ProcessHandle v c2 _PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION .?AU_PROCESS_COMBINE_SECURITY_DOMAINS_INFORMATION@@ d2 � P
Y
� " " " " " t g2
h2
�
�*
� R � _WMI_DISKIO_READWRITE_INIT .?AU_WMI_DISKIO_READWRITE_INIT@@ ��
k2
� .
Irp ��
" IssuingThreadId ��R m2 _WMI_DISKIO_READWRITE_INIT .?AU_WMI_DISKIO_READWRITE_INIT@@ �� n2 b � : � _HEAP_RANGE_LOG .?AU_HEAP_RANGE_LOG@@
p2
� > � _HEAP_EVENT_RANGE .?AU_HEAP_EVENT_RANGE@@ &
m Header ���
r2 Range : s2 0 _HEAP_RANGE_LOG .?AU_HEAP_RANGE_LOG@@ t2 b �
�+
� . � _TP_ALPC .?AU_TP_ALPC@@ ��
w2
� � x2 y2
z2
� &
� NextVcn ��
� Lcn ��: |2 <anonymous-tag> .?AU<anonymous-tag>@@ }2 � ^
}2 " �F
" ExtentCount ��
� StartingVcn ��
2 Extents ��N �2 RETRIEVAL_POINTERS_BUFFER .?AURETRIEVAL_POINTERS_BUFFER@@ �2 � Z
f � _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE@@ ��&
# Version ��
q Name �f �2 _CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_FQBN_VALUE@@ �� �2 w O B � _CI_LOG_MMCSS_STOP .?AU_CI_LOG_MMCSS_STOP@@ ��
Header ���B �2 0 _CI_LOG_MMCSS_STOP .?AU_CI_LOG_MMCSS_STOP@@ �� �2 b g B � _HEAP_RANGE_CREATE .?AU_HEAP_RANGE_CREATE@@ ��&
m Header ���
�, Event B �2 0 _HEAP_RANGE_CREATE .?AU_HEAP_RANGE_CREATE@@ �� �2 b � V � _CONSOLE_READCONSOLE_CONTROL .?AU_CONSOLE_READCONSOLE_CONTROL@@ ��
�2
� f
" nLength ��
" nInitialChars
" dwCtrlWakeupMask �
" dwControlKeyState V �2 _CONSOLE_READCONSOLE_CONTROL .?AU_CONSOLE_READCONSOLE_CONTROL@@ ��6 onecore\external\sdk\inc\minwin\consoleapi.h ��� �2 �2 � >
ciexyzX ��
ciexyzY ��
ciexyzZ ��. �2 tagCIEXYZ .?AUtagCIEXYZ@@ �2 � � R � _SYSTEM_ERROR_PORT_TIMEOUTS .?AU_SYSTEM_ERROR_PORT_TIMEOUTS@@ 2
" StartTimeout �
" CommTimeout ��R �2 _SYSTEM_ERROR_PORT_TIMEOUTS .?AU_SYSTEM_ERROR_PORT_TIMEOUTS@@ �2 �
�
� R � _FILE_STANDARD_INFORMATION .?AU_FILE_STANDARD_INFORMATION@@ ��v
� AllocationSize ���
� EndOfFile
" NumberOfLinks
DeletePending
Directory R �2 _FILE_STANDARD_INFORMATION .?AU_FILE_STANDARD_INFORMATION@@ �� �2 � �
� ��
�2
�
x#
� V � _CM_EISA_FUNCTION_INFORMATION .?AU_CM_EISA_FUNCTION_INFORMATION@@ " �R � _EISA_MEMORY_CONFIGURATION .?AU_EISA_MEMORY_CONFIGURATION@@ �� �2 " ? �J � _EISA_IRQ_CONFIGURATION .?AU_EISA_IRQ_CONFIGURATION@@ �2 " � " �N � _EISA_PORT_CONFIGURATION .?AU_EISA_PORT_CONFIGURATION@@ �� �2 " < � " < �6
" CompressedId �
IdSlotFlags1 �
IdSlotFlags2 �
MinorRevision
MajorRevision
�2 Selections ���
" FunctionFlags
W$ # TypeString ���
�2 s EisaMemory ���
�2 � EisaIrq ��
�2 � EisaDma ��
�2 � EisaPort �
�2 InitializationData ���V
�2 @_CM_EISA_FUNCTION_INFORMATION .?AU_CM_EISA_FUNCTION_INFORMATION@@ �2 9 Z � _THREAD_CYCLE_TIME_INFORMATION .?AU_THREAD_CYCLE_TIME_INFORMATION@@ ��:
# AccumulatedCycles
# CurrentCycleCount Z �2 _THREAD_CYCLE_TIME_INFORMATION .?AU_THREAD_CYCLE_TIME_INFORMATION@@ �� �2 � � F � _EVENT_TRACE_LOGFILEA .?AU_EVENT_TRACE_LOGFILEA@@
�2
�
�2 " �2
�2
�
��
��
��
��V
�2 Reserved0
�2 TransferSize �
�2 Timing ���
�2 Reserved1 N �2 _DMA_CONFIGURATION_BYTE1 .?AU_DMA_CONFIGURATION_BYTE1@@ �� �2 b � _FILE_INITIATE_REPAIR_OUTPUT_BUFFER .?AU_FILE_INITIATE_REPAIR_OUTPUT_BUFFER@@
�2
� F
# Hint1
# Hint2
# Clsn �
Status ���b �2 _FILE_INITIATE_REPAIR_OUTPUT_BUFFER .?AU_FILE_INITIATE_REPAIR_OUTPUT_BUFFER@@ �2 � � * � tagMSG .?AUtagMSG@@ ��
�2
� n
� hwnd �
u message ��
u wParam ���
lParam ���
" time �
� pt ���* �2 tagMSG .?AUtagMSG@@ �� �2 ~ P J � _LDR_DATA_TABLE_ENTRY64 .?AU_LDR_DATA_TABLE_ENTRY64@@
�2
� �
InLoadOrderLinks �
InMemoryOrderLinks ���
InInitializationOrderLinks ���
# 0 DllBase ��
# 8 EntryPoint ���
" @ SizeOfImage ��
� H FullDllName ��
� X BaseDllName ��
" h Flags
! l LoadCount
! n TlsIndex �
p HashLinks
# p SectionPointer ���
" x CheckSum �
" � TimeDateStamp
# � LoadedImports J �2 � _LDR_DATA_TABLE_ENTRY64 .?AU_LDR_DATA_TABLE_ENTRY64@@ �2 � > B � _IMAGE_NT_HEADERS64 .?AU_IMAGE_NT_HEADERS64@@ N � _IMAGE_OPTIONAL_HEADER64 .?AU_IMAGE_OPTIONAL_HEADER64@@ ��J
" Signature
� FileHeader ���
�2 OptionalHeader ���B �2 _IMAGE_NT_HEADERS64 .?AU_IMAGE_NT_HEADERS64@@ �2 � v F � _ETW_HEAP_EVENT_ALLOC .?AU_ETW_HEAP_EVENT_ALLOC@@
�2
� f
m Header ���
HeapHandle ���
" $ Size �
( Address ��
" , Source ���F �2 0 _ETW_HEAP_EVENT_ALLOC .?AU_ETW_HEAP_EVENT_ALLOC@@ �2 b �
n"
�
�0
� > � tagCBT_CREATEWNDW .?AUtagCBT_CREATEWNDW@@
�2
� .
�( lpcs �
� hwndInsertAfter ��> �2 tagCBT_CREATEWNDW .?AUtagCBT_CREATEWNDW@@ �2 ~ ] N � _CM_COMPONENT_INFORMATION .?AU_CM_COMPONENT_INFORMATION@@ N
�- Flags
" Version ��
" Key ��
" AffinityMask �N �2 _CM_COMPONENT_INFORMATION .?AU_CM_COMPONENT_INFORMATION@@ �2 � J � tagEMRCREATECOLORSPACE .?AUtagEMRCREATECOLORSPACE@@ ��2
� emr ��
" ihCS �
Z& lcs ��J �2 TtagEMRCREATECOLORSPACE .?AUtagEMRCREATECOLORSPACE@@ �� �2 � � 6 � tagMETAHEADER .?AUtagMETAHEADER@@ �
! mtType ���
! mtHeaderSize �
! mtVersion
" mtSize ���
!
mtNoObjects ��
" mtMaxRecord ��
! mtNoParameters ���6 �2 tagMETAHEADER .?AUtagMETAHEADER@@ �2 � > � MOFRESOURCEINFOA .?AUMOFRESOURCEINFOA@@ ��
�2
� b
p ImagePath
p ResourceName �
" ResourceSize �
ResourceBuffer ���> �2 MOFRESOURCEINFOA .?AUMOFRESOURCEINFOA@@ ��* onecore\external\sdk\inc\wmium.h ��� �2 �2 L f � _SYSTEM_KERNEL_VA_SHADOW_INFORMATION .?AU_SYSTEM_KERNEL_VA_SHADOW_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��2
�2 KvaShadowEnabled �
�2 KvaShadowUserGlobal ��
�2 KvaShadowPcid
�2 KvaShadowInvpcid �
�2 KvaShadowRequired
�2 KvaShadowRequiredAvailable ���
�2 InvalidPteBit
�2 L1DataCacheFlushSupported
�2 L1TerminalFaultMitigationPresent �
�2 Reserved �:
�2 <anonymous-tag> .?AU<anonymous-tag>@@ �2 � �
�2 KvaShadowFlags ���f 3 _SYSTEM_KERNEL_VA_SHADOW_INFORMATION .?AU_SYSTEM_KERNEL_VA_SHADOW_INFORMATION@@ �� 3 � � j � _FSCTL_GET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_GET_INTEGRITY_INFORMATION_BUFFER@@ �
! ChecksumAlgorithm
! Reserved �
" Flags
" ChecksumChunkSizeInBytes �
" ClusterSizeInBytes ���j 3 _FSCTL_GET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_GET_INTEGRITY_INFORMATION_BUFFER@@ 3 � �
m,
� 2 � WMIREGGUIDW .?AUWMIREGGUIDW@@
3
� �
$ Guid �
" Flags
" InstanceCount
" InstanceNameList �
" BaseNameOffset ���
" Pdo ��
" InstanceInfo �2 3 WMIREGGUIDW .?AUWMIREGGUIDW@@ 3 � * > � _FILE_STREAM_INFO .?AU_FILE_STREAM_INFO@@
3
� �
" NextEntryOffset ��
" StreamNameLength �
� StreamSize ���
� StreamAllocationSize �
StreamName ���> 3 _FILE_STREAM_INFO .?AU_FILE_STREAM_INFO@@ 3 n �" j � _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER@@ B
! ChecksumAlgorithm
! Reserved �
" Flags j 3 _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER@@ 3 � � Z � DISPLAYCONFIG_PATH_TARGET_INFO .?AUDISPLAYCONFIG_PATH_TARGET_INFO@@ ��
u ��
u ��J � DISPLAYCONFIG_RATIONAL .?AUDISPLAYCONFIG_RATIONAL@@ ��Z DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED �� DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE �� DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED ��� DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST ��� DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST ��� ��DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 V t 3 DISPLAYCONFIG_SCANLINE_ORDERING .?AW4DISPLAYCONFIG_SCANLINE_ORDERING@@ � 3 � &
� adapterId
u id ���
u modeInfoIdx ��
3 desktopModeInfoIdx ���
3 targetModeInfoIdx
�$ outputTechnology �
,$ rotation �
n# scaling ��
3 refreshRate ��
3 $ scanLineOrdering �
t ( targetAvailable ��
u , statusFlags ��Z 3 0 DISPLAYCONFIG_PATH_TARGET_INFO .?AUDISPLAYCONFIG_PATH_TARGET_INFO@@ �� 3 � � R � _SYSTEM_MEMORY_INFORMATION .?AU_SYSTEM_MEMORY_INFORMATION@@ ��
!3
� z
" PagedPoolCommitPageCount �
" NonPagedPoolPageCount
" MdlPageCount �
" CommitPageCount ��R #3 _SYSTEM_MEMORY_INFORMATION .?AU_SYSTEM_MEMORY_INFORMATION@@ �� $3 � �
m0
�
0+
� N � READ_USN_JOURNAL_DATA_V0 .?AUREAD_USN_JOURNAL_DATA_V0@@ ��
(3
� �
StartUsn �
" ReasonMask ���
" ReturnOnlyOnClose
# Timeout ��
# BytesToWaitFor ���
# UsnJournalID �N *3 ( READ_USN_JOURNAL_DATA_V0 .?AUREAD_USN_JOURNAL_DATA_V0@@ �� +3 � . > � _SYSTEM_ALARM_ACE .?AU_SYSTEM_ALARM_ACE@@ :
� Header ���
" Mask �
" SidStart �> .3 _SYSTEM_ALARM_ACE .?AU_SYSTEM_ALARM_ACE@@ /3 w � � q " t 13
23
�
�"
� b
AclRevision ��
Sbz1 �
! AclSize ��
! AceCount �
! Sbz2 �& 53 _ACL .?AU_ACL@@ �� 63 w � F � _EISA_IRQ_DESCRIPTOR .?AU_EISA_IRQ_DESCRIPTOR@@ ��2
83 ConfigurationByte
Reserved �J 93 _EISA_IRQ_CONFIGURATION .?AU_EISA_IRQ_CONFIGURATION@@ :3 � N � _KLDR_DATA_TABLE_ENTRY64 .?AU_KLDR_DATA_TABLE_ENTRY64@@ ��
InLoadOrderLinks �
# __Undefined1 �
# __Undefined2 �
# __Undefined3 �
# ( NonPagedDebugInfo
# 0 DllBase ��
# 8 EntryPoint ���
" @ SizeOfImage ��
� H FullDllName ��
� X BaseDllName ��
" h Flags
! l LoadCount
! n __Undefined5 �
# p __Undefined6 �
" x CheckSum �
" | __padding1 ���
" � TimeDateStamp
" � __padding2 ���N =3 � _KLDR_DATA_TABLE_ENTRY64 .?AU_KLDR_DATA_TABLE_ENTRY64@@ �� >3 � z � FindExSearchNameMatch FindExSearchLimitToDirectories ��� FindExSearchLimitToDevices ��� FindExSearchMaxSearchOp ��> t @3 _FINDEX_SEARCH_OPS .?AW4_FINDEX_SEARCH_OPS@@ ��� A3 � �
Y
�
C3
�
/(
� J
Z DllName ��
Z FunctionName �
RedirectionTarget ^ F3 _REDIRECTION_FUNCTION_DESCRIPTOR .?AU_REDIRECTION_FUNCTION_DESCRIPTOR@@ �� G3 � ^ b � _FILE_IO_PRIORITY_HINT_INFORMATION .?AU_FILE_IO_PRIORITY_HINT_INFORMATION@@ ��
� PriorityHint �b J3 _FILE_IO_PRIORITY_HINT_INFORMATION .?AU_FILE_IO_PRIORITY_HINT_INFORMATION@@ �� K3 � � 6
RpcProtocolSequence ��
Endpoint �F M3 _RPC_PROTSEQ_ENDPOINT .?AU_RPC_PROTSEQ_ENDPOINT@@ N3 3 � ^ � _GET_FILTER_FILE_IDENTIFIER_INPUT .?AU_GET_FILTER_FILE_IDENTIFIER_INPUT@@ 2
! AltitudeLength ���
Altitude �^ Q3 _GET_FILTER_FILE_IDENTIFIER_INPUT .?AU_GET_FILTER_FILE_IDENTIFIER_INPUT@@ R3 � �" 6 � _IMAGE_AUX_SYMBOL .?AT_IMAGE_AUX_SYMBOL@@ *
! Linenumber ���
! Size �: U3 <anonymous-tag> .?AU<anonymous-tag>@@ V3 � &
V3 LnSz �
" TotalSize 2 X3 <anonymous-tag> .?AT<anonymous-tag>@@ Y3 � B
" PointerToLinenumber ��
" PointerToNextFunction : [3 <anonymous-tag> .?AU<anonymous-tag>@@ \3 �
� Dimension : ^3 <anonymous-tag> .?AU<anonymous-tag>@@ _3 � ! &
\3 Function �
_3 Array 2 a3 <anonymous-tag> .?AT<anonymous-tag>@@ b3 � N
" TagIndex �
Y3 Misc �
b3 FcnAry ���
! TvIndex ��: d3 <anonymous-tag> .?AU<anonymous-tag>@@ e3 � " �
g3 Name �: h3 <anonymous-tag> .?AU<anonymous-tag>@@ i3 � ' �
" Length ���
! NumberOfRelocations ��
! NumberOfLinenumbers ��
" CheckSum �
Number ���
Selection
bReserved
HighNumber ���: k3 <anonymous-tag> .?AU<anonymous-tag>@@ l3 � * " �*
" crc ��
n3 rgbReserved ��: o3 <anonymous-tag> .?AU<anonymous-tag>@@ p3 � 5 Z
e3 Sym ��
i3 File �
l3 Section ��
j$ TokenDef �
p3 CRC ��6 r3 _IMAGE_AUX_SYMBOL .?AT_IMAGE_AUX_SYMBOL@@ s3 �
" ��
u3
� 6 � tagRGBTRIPLE .?AUtagRGBTRIPLE@@ ��>
rgbtBlue �
rgbtGreen
rgbtRed ��6 x3 tagRGBTRIPLE .?AUtagRGBTRIPLE@@ �� y3 � l
{3
|3
� N � _MEMORY_SCRUB_INFORMATION .?AU_MEMORY_SCRUB_INFORMATION@@ .
Handle ���
" PagesScrubbed N 3 _MEMORY_SCRUB_INFORMATION .?AU_MEMORY_SCRUB_INFORMATION@@ �3 � � V PROTOCOL_NOT_LOADED �� PROTOCOL_LOADED �� PROTOCOL_ADDRESS_CHANGE ��F t �3 RPC_ADDRESS_CHANGE_TYPE .?AW4RPC_ADDRESS_CHANGE_TYPE@@ � �3 3 P
� : � tagEMRFRAMERGN .?AUtagEMRFRAMERGN@@ ��v
� emr ��
c rclBounds
" cbRgnData
" ihBrush ��
d szlStroke
� ( RgnData ��: �3 , tagEMRFRAMERGN .?AUtagEMRFRAMERGN@@ �� �3 � �
�
� F
lfHeight �
lfWidth ��
lfEscapement �
lfOrientation
lfWeight �
lfItalic �
lfUnderline ��
lfStrikeOut ��
lfCharSet
lfOutPrecision ���
lfClipPrecision ��
lfQuality
lfPitchAndFamily �
o" lfFaceName ���2 �3 < tagLOGFONTA .?AUtagLOGFONTA@@ �3 � �
�#
� B � _FILE_REGION_OUTPUT .?AU_FILE_REGION_OUTPUT@@ � " �v
" Flags
" TotalRegionEntryCount
" RegionEntryCount �
" Reserved �
�3 Region ���B �3 ( _FILE_REGION_OUTPUT .?AU_FILE_REGION_OUTPUT@@ �3 � p 6 � _RTL_SRWLOCK .?AU_RTL_SRWLOCK@@ ��
�3
�
" ��
" ��
" ��
" ��
" ��
�3 Locked ���
�3 Waiting ��
�3 Waking ���
�3 MultipleShared ���
�3 Shared ���
" Value
Ptr ��6 �3 _RTL_SRWLOCK .?AU_RTL_SRWLOCK@@ �� �3 � � n � _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS .?AU_SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS@@
�3
�
UserKeyHandle n �3 _SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS .?AU_SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS@@ �3 � 0
�.
� F � _IO_ERROR_LOG_MESSAGE .?AU_IO_ERROR_LOG_MESSAGE@@
�3
� �
! Type �
! Size �
! DriverNameLength �
� TimeStamp
" DriverNameOffset �
�# EntryData F �3 H _IO_ERROR_LOG_MESSAGE .?AU_IO_ERROR_LOG_MESSAGE@@ �3 �# D V � _DEFINE_STORAGE_RESERVE_INPUT .?AU_DEFINE_STORAGE_RESERVE_INPUT@@ ^ � _STORAGE_RESERVE_AREA_DEFINITION .?AU_STORAGE_RESERVE_AREA_DEFINITION@@ �� �3 " �
" Version ��
" Flags
" AreaDefinitionOffset �
" AreaDefinitionCount ��
�3 AreaDefinition ���V �3 _DEFINE_STORAGE_RESERVE_INPUT .?AU_DEFINE_STORAGE_RESERVE_INPUT@@ �3 � + j � _TOKEN_SECURITY_ATTRIBUTES_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_INFORMATION@@ ��
�%
�
�3 pAttributeV1 �2 �3 <anonymous-tag> .?AT<anonymous-tag>@@ �3 � 1 Z
! Version ��
! Reserved �
" AttributeCount ���
�3 Attribute j �3 _TOKEN_SECURITY_ATTRIBUTES_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_INFORMATION@@ �� �3 � " ^ � _FILE_FS_FULL_SIZE_INFORMATION_EX .?AU_FILE_FS_FULL_SIZE_INFORMATION_EX@@
�3
�
# ActualTotalAllocationUnits ���
# ActualAvailableAllocationUnits ���
# ActualPoolUnavailableAllocationUnits �
# CallerTotalAllocationUnits ���
# CallerAvailableAllocationUnits ���
# ( CallerPoolUnavailableAllocationUnits �
# 0 UsedAllocationUnits ��
# 8 TotalReservedAllocationUnits �
# @ VolumeStorageReserveAllocationUnits ��
# H AvailableCommittedAllocationUnits
# P PoolAvailableAllocationUnits �
" X SectorsPerAllocationUnit �
" \ BytesPerSector ���^
�3 ` _FILE_FS_FULL_SIZE_INFORMATION_EX .?AU_FILE_FS_FULL_SIZE_INFORMATION_EX@@ �3 � $ � � _PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION@@ ��
�3
�
�.
� Z
! NumberOfTargets ��
! Reserved �
" Reserved2
�3 Targets �� �3 _PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION .?AU_PROCESS_DYNAMIC_EH_CONTINUATION_TARGETS_INFORMATION@@ �� �3 D w
-
� R � NDR_ALLOC_ALL_NODES_CONTEXT .?AUNDR_ALLOC_ALL_NODES_CONTEXT@@
�3
� J � NDR_POINTER_QUEUE_STATE .?AUNDR_POINTER_QUEUE_STATE@@
�3
�
� ��
�3
� F � _FULL_PTR_XLAT_TABLES .?AU_FULL_PTR_XLAT_TABLES@@
�3
�
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t ��
t
��
t ��
t ��
t
��
t ��> � IRpcChannelBuffer .?AUIRpcChannelBuffer@@
�3
�
�(
� B � _NDR_ASYNC_MESSAGE .?AU_NDR_ASYNC_MESSAGE@@ ��
�3
�
�(
� > � _NDR_PROC_CONTEXT .?AU_NDR_PROC_CONTEXT@@
�3
� �
�3 RpcMsg ���
Buffer ���
BufferStart ��
BufferEnd
BufferMark ���
" BufferLength �
" MemorySize ���
Memory ���
IsClient �
! Pad ��
! " uFlags2 ��
t $ ReuseBuffer ��
�3 ( pAllocAllNodesContext
�3 , pPointerQueueState ���
t 0 IgnoreEmbeddedPointers ���
4 PointerBufferMark
8 CorrDespIncrement
9 uFlags ���
! : UniquePtrCount ���
" < MaxCount �
" @ Offset ���
" D ActualCount ��
� H pfnAllocate ��
� L pfnFree ��
P StackTop �
T pPresentedType ���
X pTransmitType
\ SavedHandle ��
�3 ` StubDesc �
�3 d FullPtrXlatTables
" h FullPtrRefId �
" l PointerLength
�3 p fInDontFree ��
�3 p fDontCallFreeInst
�3 p fUnused1 �
�3 p fHasReturn ���
�3 p fHasExtensions ���
�3 p fHasNewCorrDesc ��
�3 p fIsIn
�3 p fIsOut ���
�3 p fIsOicf ��
�3 p fBufferValid �
�3 p fHasMemoryValidateCallback ���
�3 p fInFree ��
�3 p fNeedMCCP
�3 p fUnused2 �
�3 p fUnused3 �
" t dwDestContext
x pvDestContext
U | SavedContextHandles ��
� ParamNumber ��
�3 � pRpcChannelBuffer
�3 � pArrayInfo ���
" � SizePtrCountArray
" � SizePtrOffsetArray ���
" � SizePtrLengthArray ���
� pArgQueue
" � dwStubPhase ��
� LowStackMark �
�3 � pAsyncMsg
�3 � pCorrInfo
� pCorrMemory ��
� pMemoryList ��
t � pCSInfo ��
� ConformanceMark ��
� VarianceMark �
t � Unused ���
�3 � pContext �
� ContextHandleHash
� pUserMarshalList �
t � Reserved51_3 �
t � Reserved51_4 �
t � Reserved51_5 �B I �3 � _MIDL_STUB_MESSAGE .?AU_MIDL_STUB_MESSAGE@@ �� �3 � Q
�*
� t �
�3
�
�/
� : � _SE_AUDIT_INFO .?AU_SE_AUDIT_INFO@@ ��
�
� "
" Size �
v AuditType
K AuditOperation ���
" AuditFlags ���
SubsystemName
ObjectTypeName ���
ObjectName ���
( HandleId �
� , TransactionId
�3 0 OperationId ��
4 ObjectCreation ���
5 GenerateOnClose ��: �3 8 _SE_AUDIT_INFO .?AU_SE_AUDIT_INFO@@ �� �3 w & $
�3
� > � _PATHNAME_BUFFER .?AU_PATHNAME_BUFFER@@ ��
�3
� .
" PathNameLength ���
Name �> �3 _PATHNAME_BUFFER .?AU_PATHNAME_BUFFER@@ �� �3 � � 6 � _PREFIX_TABLE .?AU_PREFIX_TABLE@@
�3
�
�&
� N
NodeTypeCode �
NameLength ���
�3 NextPrefixTree ���6 �3 _PREFIX_TABLE .?AU_PREFIX_TABLE@@ �3 g b � _FSCTL_QUERY_STORAGE_CLASSES_OUTPUT .?AU_FSCTL_QUERY_STORAGE_CLASSES_OUTPUT@@ B � _FILE_STORAGE_TIER .?AU_FILE_STORAGE_TIER@@ �� �3 " ( �
" Version ��
" Size �
" Flags
" TotalNumberOfTiers ���
" NumberOfTiersReturned
�3 Tiers b �3 @_FSCTL_QUERY_STORAGE_CLASSES_OUTPUT .?AU_FSCTL_QUERY_STORAGE_CLASSES_OUTPUT@@ �3 � 8 SC_ENUM_PROCESS_INFO �2 t 4 _SC_ENUM_TYPE .?AW4_SC_ENUM_TYPE@@ � 4 � � ^ � _ETW_TRACE_PARTITION_INFORMATION .?AU_ETW_TRACE_PARTITION_INFORMATION@@ ��b
$ PartitionId ��
$ ParentId �
QpcOffsetFromRoot
" ( PartitionType ^ 4 0 _ETW_TRACE_PARTITION_INFORMATION .?AU_ETW_TRACE_PARTITION_INFORMATION@@ �� 4 � ~
2
�
7"
� N � _ENABLE_TRACE_PARAMETERS .?AU_ENABLE_TRACE_PARAMETERS@@ ��
" Version ��
" EnableProperty ���
" ControlFlags �
$ SourceId �
� EnableFilterDesc �
" FilterDescCount ��N 4 $ _ENABLE_TRACE_PARAMETERS .?AU_ENABLE_TRACE_PARAMETERS@@ �� 4 �
�
� V � _ETW_UMS_EVENT_CONTEXT_SWITCH .?AU_ETW_UMS_EVENT_CONTEXT_SWITCH@@
4
� �
m Header ���
" ScheduledThreadId
" $ SwitchCount ��
" ( KernelYieldCount �
" , MixedYieldCount ��
" 0 YieldCount ���V 4 8 _ETW_UMS_EVENT_CONTEXT_SWITCH .?AU_ETW_UMS_EVENT_CONTEXT_SWITCH@@ 4 b � R � _ETW_DUPLICATE_HANDLE_EVENT .?AU_ETW_DUPLICATE_HANDLE_EVENT@@ �
Object ���
" SourceHandle �
" TargetHandle �
" TargetProcessId ��
! ObjectType ���
" SourceProcessId ��R 4 _ETW_DUPLICATE_HANDLE_EVENT .?AU_ETW_DUPLICATE_HANDLE_EVENT@@ 4 b X
V � _IMAGE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_RUNTIME_FUNCTION_ENTRY@@ f
" BeginAddress �
" EndAddress ���
" UnwindInfoAddress
" UnwindData ���V 4 _IMAGE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_RUNTIME_FUNCTION_ENTRY@@ 4 � 3 B � tagTTPOLYGONHEADER .?AUtagTTPOLYGONHEADER@@ ��
4
� 2 � tagPOINTFX .?AUtagPOINTFX@@ ��:
" cb ���
" dwType ���
4 pfxStart �B 4 tagTTPOLYGONHEADER .?AUtagTTPOLYGONHEADER@@ �� 4 � �
�+
� B � _RTL_HEAP_TAG_INFO .?AU_RTL_HEAP_TAG_INFO@@ ��
#4
� V
" NumberOfAllocations ��
" NumberOfFrees
" BytesAllocated ���B %4 _RTL_HEAP_TAG_INFO .?AU_RTL_HEAP_TAG_INFO@@ �� &4 � � b � _PERFINFO_EXECUTIVE_RESOURCE_CONFIG .?AU_PERFINFO_EXECUTIVE_RESOURCE_CONFIG@@ j
" ReleaseSamplingRate ��
" ContentionSamplingRate ���
" NumberOfExcessiveTimeouts b )4 _PERFINFO_EXECUTIVE_RESOURCE_CONFIG .?AU_PERFINFO_EXECUTIVE_RESOURCE_CONFIG@@ *4 b � : � tagPOINTER_INFO .?AUtagPOINTER_INFO@@ �
,4 pointerInfo ��
u X touchFlags ���
u \ touchMask
` rcContact
p rcContactRaw �
u � orientation ��
u � pressure �F -4 � tagPOINTER_TOUCH_INFO .?AUtagPOINTER_TOUCH_INFO@@ .4 ~ � ^ � _FILE_REMOTE_PROTOCOL_INFORMATION .?AU_FILE_REMOTE_PROTOCOL_INFORMATION@@
_ Reserved �: 14 <anonymous-tag> .?AU<anonymous-tag>@@ 24 � t
" Capabilities �: 44 <anonymous-tag> .?AU<anonymous-tag>@@ 54 � � n
" Capabilities �
" CachingFlags �
ShareType
, Reserved0
" Reserved1 : 74 <anonymous-tag> .?AU<anonymous-tag>@@ 84 � � &
54 Server ���
84 Share : :4 <anonymous-tag> .?AU<anonymous-tag>@@ ;4 � � &
;4 Smb2 �
k Reserved �2 =4 @ <anonymous-tag> .?AT<anonymous-tag>@@ >4 � �
! StructureVersion �
! StructureSize
" Protocol �
! ProtocolMajorVersion �
!
ProtocolMinorVersion �
! ProtocolRevision �
! Reserved �
" Flags
24 GenericReserved ��
>4 4 ProtocolSpecific �^
@4 t _FILE_REMOTE_PROTOCOL_INFORMATION .?AU_FILE_REMOTE_PROTOCOL_INFORMATION@@ A4 � b ^ � _PERFINFO_PO_SESSION_CALLOUT_RET .?AU_PERFINFO_PO_SESSION_CALLOUT_RET@@ ��
Status ���^ D4 _PERFINFO_PO_SESSION_CALLOUT_RET .?AU_PERFINFO_PO_SESSION_CALLOUT_RET@@ �� E4 b �
B%
�
H4
�
� R � _PERFINFO_CC_FLUSH_SECTION .?AU_PERFINFO_CC_FLUSH_SECTION@@ ��r
" WorkItemKey ��
" FileObjectKey
# Offset ���
" Length ���
" MmFlushFlags �R L4 _PERFINFO_CC_FLUSH_SECTION .?AU_PERFINFO_CC_FLUSH_SECTION@@ �� M4 b � f � _REFS_DEALLOCATE_RANGES_INPUT_BUFFER .?AU_REFS_DEALLOCATE_RANGES_INPUT_BUFFER@@ ��
O4
� �, " �.
" RangeCount ���
Q4 Ranges ���f R4 _REFS_DEALLOCATE_RANGES_INPUT_BUFFER .?AU_REFS_DEALLOCATE_RANGES_INPUT_BUFFER@@ �� S4 � �*
�,
� R � _FILE_TRACKING_INFORMATION .?AU_FILE_TRACKING_INFORMATION@@ ��^
DestinationFile ��
" ObjectInformationLength ��
ObjectInformation R W4 _FILE_TRACKING_INFORMATION .?AU_FILE_TRACKING_INFORMATION@@ �� X4 � 7 N � _EVENT_FILTER_EVENT_NAME .?AU_EVENT_FILTER_EVENT_NAME@@ ��
# MatchAnyKeyword ��
# MatchAllKeyword ��
Level
FilterIn �
! NameCount
� Names N [4 _EVENT_FILTER_EVENT_NAME .?AU_EVENT_FILTER_EVENT_NAME@@ �� \4 = z V � _PROCESS_SESSION_INFORMATION .?AU_PROCESS_SESSION_INFORMATION@@ ��
" SessionId V _4 _PROCESS_SESSION_INFORMATION .?AU_PROCESS_SESSION_INFORMATION@@ �� `4 D : R � _IMAGE_BOUND_FORWARDER_REF .?AU_IMAGE_BOUND_FORWARDER_REF@@ ��J
" TimeDateStamp
! OffsetModuleName �
! Reserved �R c4 _IMAGE_BOUND_FORWARDER_REF .?AU_IMAGE_BOUND_FORWARDER_REF@@ �� d4 � Z � _PERFINFO_CC_LOGGED_STREAM_INFO .?AU_PERFINFO_CC_LOGGED_STREAM_INFO@@ �
" FileObjectKey
" ReasonForFlush ���
" PagesToWrite �
" DirtyLoggedPages �
" DirtyLoggedPageThreshold �
� LargestLsnForLWS �Z g4 _PERFINFO_CC_LOGGED_STREAM_INFO .?AU_PERFINFO_CC_LOGGED_STREAM_INFO@@ h4 b �
�1
� > � tagEMRPIXELFORMAT .?AUtagEMRPIXELFORMAT@@ "
� emr ��
0 pfd ��> l4 0 tagEMRPIXELFORMAT .?AUtagEMRPIXELFORMAT@@ m4 � � B � CORRELATION_VECTOR .?AUCORRELATION_VECTOR@@ ��
o4
� p " � �*
p Version ��
q4 Vector ���B r4 � CORRELATION_VECTOR .?AUCORRELATION_VECTOR@@ �� s4 g �%
+
� Z � _ETW_LAST_DROPPED_EVENT_STRUCT .?AU_ETW_LAST_DROPPED_EVENT_STRUCT@@ ��6
" Count
" Padding ��
g1 Times Z w4 _ETW_LAST_DROPPED_EVENT_STRUCT .?AU_ETW_LAST_DROPPED_EVENT_STRUCT@@ �� x4 @ �
�.
� f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A@@ ��
e
�
|4 TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
ServerCertificateSubject �
|4 ProxyCredentials �
" NumberOfProxyAuthnSchemes
" ProxyAuthnSchemes f }4 $ _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_A@@ �� ~4 ^ � R � _HEAP_EXTENDED_INFORMATION .?AU_HEAP_EXTENDED_INFORMATION@@ ��J � _HEAP_INFORMATION_ITEM .?AU_HEAP_INFORMATION_ITEM@@ ��
�4
� �4 �4
�4
� > � _HEAP_INFORMATION .?AU_HEAP_INFORMATION@@ �
Process ��
" Heap �
" Level
�4 CallbackRoutine ��
CallbackContext ��
K# ProcessHeapInformation ���
�4 HeapInformation ��R �4 , _HEAP_EXTENDED_INFORMATION .?AU_HEAP_EXTENDED_INFORMATION@@ �� �4 � X
4
� J � _VIRTUALIZATION_RECORD .?AU_VIRTUALIZATION_RECORD@@ ��b
VbsEnabled ���
HvciEnabled ��
HyperVisorEnabled
Reserved �J �4 _VIRTUALIZATION_RECORD .?AU_VIRTUALIZATION_RECORD@@ �� �4 b �
3%
�
b.
� �
|4 TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
ServerCertificateSubject �^ �4 _RPC_HTTP_TRANSPORT_CREDENTIALS_A .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_A@@ �4 ^ �
�!
�
�.
� b � _MANAGE_WRITES_TO_EXECUTABLE_MEMORY .?AU_MANAGE_WRITES_TO_EXECUTABLE_MEMORY@@
�4
�
" ��
" ��
" ��
"
��
�4 Version ��
�4 ProcessEnableWriteExceptions �
�4 ThreadAllowWrites
�4 Spare
KernelWriteToExecutableSignal b �4 _MANAGE_WRITES_TO_EXECUTABLE_MEMORY .?AU_MANAGE_WRITES_TO_EXECUTABLE_MEMORY@@ �4 � �
�
� * � _TP_JOB .?AU_TP_JOB@@ & � HKL__ .?AUHKL__@@
�4
�
�4
�
t unused ���& �4 HKL__ .?AUHKL__@@ �4 �' n � _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY .?AU_RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY@@
�4
�
� BlockDynamicCode �n �4 _RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY .?AU_RTL_IMAGE_MITIGATION_DYNAMIC_CODE_POLICY@@ �4 f Z � _SYSTEM_DEVICE_DATA_INFORMATION .?AU_SYSTEM_DEVICE_DATA_INFORMATION@@ r
DeviceId �
DataName �
" DataType �
" DataBufferLength �
DataBuffer ���Z �4 _SYSTEM_DEVICE_DATA_INFORMATION .?AU_SYSTEM_DEVICE_DATA_INFORMATION@@ �4 � n r � _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY@@ ��
�4
� z
" EntryLength ��
" DependencyTypeFlags ��
" ProviderSpecificFlags
� VirtualStorageType ���r �4 _STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV1_ENTRY@@ �� �4 � C > � tagDRAWTEXTPARAMS .?AUtagDRAWTEXTPARAMS@@
�4
� v
u cbSize ���
t iTabLength ���
t iLeftMargin ��
t iRightMargin �
u uiLengthDrawn > �4 tagDRAWTEXTPARAMS .?AUtagDRAWTEXTPARAMS@@ �4 ~ �
z
�
t unused ���. �4 HBITMAP__ .?AUHBITMAP__@@ �4 s I Z � _FILE_MAILSLOT_SET_INFORMATION .?AU_FILE_MAILSLOT_SET_INFORMATION@@ ��
� ReadTimeout ��Z �4 _FILE_MAILSLOT_SET_INFORMATION .?AU_FILE_MAILSLOT_SET_INFORMATION@@ �� �4 � m J � _GENERATE_NAME_CONTEXT .?AU_GENERATE_NAME_CONTEXT@@ �� q " �
! Checksum �
ChecksumInserted �
NameLength ���
�4 NameBuffer ���
" ExtensionLength ��
� ExtensionBuffer ��
" LastIndexValue ���J �4 $ _GENERATE_NAME_CONTEXT .?AU_GENERATE_NAME_CONTEXT@@ �� �4 g �
a
� N � _ETW_CREATE_HANDLE_EVENT .?AU_ETW_CREATE_HANDLE_EVENT@@ ��B
Object ���
" Handle ���
! ObjectType ���N �4 _ETW_CREATE_HANDLE_EVENT .?AU_ETW_CREATE_HANDLE_EVENT@@ �� �4 b M
B � tagBITMAPFILEHEADER .?AUtagBITMAPFILEHEADER@@ n
! bfType ���
" bfSize ���
! bfReserved1 ��
! bfReserved2 ��
"
bfOffBits B �4 tagBITMAPFILEHEADER .?AUtagBITMAPFILEHEADER@@ �4 � � b � _TXFS_LIST_TRANSACTION_LOCKED_FILES .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES@@ j
$ KtmTransaction ���
# NumberOfFiles
# BufferSizeRequired ���
# Offset ���b �4 ( _TXFS_LIST_TRANSACTION_LOCKED_FILES .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES@@ �4 �
�
� V � _CM_FULL_RESOURCE_DESCRIPTOR .?AU_CM_FULL_RESOURCE_DESCRIPTOR@@ ��N
� InterfaceType
" BusNumber
, PartialResourceList ��V �4 _CM_FULL_RESOURCE_DESCRIPTOR .?AU_CM_FULL_RESOURCE_DESCRIPTOR@@ �� �4 m n � _SYSTEM_VERIFIER_CANCELLATION_INFORMATION .?AU_SYSTEM_VERIFIER_CANCELLATION_INFORMATION@@ � " �
" CancelProbability
" CancelThreshold ��
" CompletionThreshold ��
" CancellationVerifierDisabled �
" AvailableIssues ��
�4 Issues ���n �4 _SYSTEM_VERIFIER_CANCELLATION_INFORMATION .?AU_SYSTEM_VERIFIER_CANCELLATION_INFORMATION@@ �4 � �
$ TypeId ���6 �4 _WNF_TYPE_ID .?AU_WNF_TYPE_ID@@ �� �4 � � V � _SERVERSILO_BASIC_INFORMATION .?AU_SERVERSILO_BASIC_INFORMATION@@ �
" ServiceSessionId �
r State
ExitStatus ���
IsDownlevelContainer �
ApiSetSchema �
HostApiSetSchema �V �4 _SERVERSILO_BASIC_INFORMATION .?AU_SERVERSILO_BASIC_INFORMATION@@ �4 D � b � _TRANSACTIONMANAGER_LOG_INFORMATION .?AU_TRANSACTIONMANAGER_LOG_INFORMATION@@
$ LogIdentity ��b �4 _TRANSACTIONMANAGER_LOG_INFORMATION .?AU_TRANSACTIONMANAGER_LOG_INFORMATION@@ �4 � �
�
" ��
" ��
" ��
" ��
" ��
" Flags
�4 SmtBranchTargetIsolation �
�4 IsolateSecurityDomain
�4 DisablePageCombine ���
�4 SpeculativeStoreBypassDisable
�4 ReservedFlags ~ �4 _PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY .?AU_PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY@@ �4 D � > � _SERVICE_NOTIFY_1 .?AU_SERVICE_NOTIFY_1@@ ~
" dwVersion
� pfnNotifyCallback
pContext �
" dwNotificationStatus �
� ServiceStatus > �4 4 _SERVICE_NOTIFY_1 .?AU_SERVICE_NOTIFY_1@@ �4 � � 6 � tagWNDCLASSA .?AUtagWNDCLASSA@@ ��
�4
� �
u style
e% lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
4 hInstance
f% hIcon
'$ hCursor ��
Q! hbrBackground
� lpszMenuName �
� $ lpszClassName 6
�4 ( tagWNDCLASSA .?AUtagWNDCLASSA@@ �� �4 ~
� : � tagWNDCLASSEXW .?AUtagWNDCLASSEXW@@ ��
�4
�
u cbSize ���
u style
e% lpfnWndProc ��
t cbClsExtra ���
t cbWndExtra ���
4 hInstance
f% hIcon
'$ hCursor ��
Q! hbrBackground
$ lpszMenuName �
( lpszClassName
f% , hIconSm ��: �4 0 tagWNDCLASSEXW .?AUtagWNDCLASSEXW@@ �� �4 ~ � : � _HARDERROR_MSG .?AU_HARDERROR_MSG@@ ���
\ h
Status ���
� ErrorTime
" ( ValidResponseOptions �
" , Response �
" 0 NumberOfParameters ���
" 4 UnicodeStringParameterMask ���
� 8 Parameters ���: 5 P _HARDERROR_MSG .?AU_HARDERROR_MSG@@ �� 5 � � V � _RTL_USER_PROCESS_PARAMETERS .?AU_RTL_USER_PROCESS_PARAMETERS@@ �� t" " ��
" MaximumLength
" Length ���
" Flags
" DebugFlags ���
ConsoleHandle
" ConsoleFlags �
StandardInput
StandardOutput ���
StandardError
�/ $ CurrentDirectory �
0 DllPath ��
8 ImagePathName
@ CommandLine ��
H Environment ��
" L StartingX
" P StartingY
" T CountX ���
" X CountY ���
" \ CountCharsX ��
" ` CountCharsY ��
" d FillAttribute
" h WindowFlags ��
" l ShowWindowFlags ��
p WindowTitle ��
x DesktopInfo ��
� ShellInfo
� RuntimeData ��
5 � CurrentDirectores
" �EnvironmentSize ��
" �EnvironmentVersion ���
�PackageDependencyData
" �ProcessGroupId ���
" �LoaderThreads
�RedirectionDllName ���
�HeapPartitionName
# �DefaultThreadpoolCpuSetMasks �
" �DefaultThreadpoolCpuSetMaskCount �
" �DefaultThreadpoolThreadMaximum ���V & 5 �_RTL_USER_PROCESS_PARAMETERS .?AU_RTL_USER_PROCESS_PARAMETERS@@ �� 5 < k > � _PROCESSOR_RECORD .?AU_PROCESSOR_RECORD@@
5
� �
" Index
" FeatureSet ���
" ProcessorSpeed ���
ProcessorName
�$ � ProcessorIdentifier ��
� �VendorIdentifier �> 5 �_PROCESSOR_RECORD .?AU_PROCESSOR_RECORD@@
5 b �
O
� B � _RTL_PROCESS_LOCKS .?AU_RTL_PROCESS_LOCKS@@ ��
5
� V � _RTL_PROCESS_LOCK_INFORMATION .?AU_RTL_PROCESS_LOCK_INFORMATION@@ 5 " $ �*
" NumberOfLocks
5 Locks B 5 ( _RTL_PROCESS_LOCKS .?AU_RTL_PROCESS_LOCKS@@ �� 5 � b � _FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER@@
" EventTypes ���b 5 _FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_OUTPUT_BUFFER@@ 5 � �) > � tagMSLLHOOKSTRUCT .?AUtagMSLLHOOKSTRUCT@@ ^
� pt ���
" mouseData
" flags
" time �
" dwExtraInfo ��> 5 tagMSLLHOOKSTRUCT .?AUtagMSLLHOOKSTRUCT@@ 5 ~ f N � _CREATE_THREAD_DEBUG_INFO .?AU_CREATE_THREAD_DEBUG_INFO@@
5
� " {3
!5
� N
hThread ��
lpThreadLocalBase
"5 lpStartAddress ���N #5 _CREATE_THREAD_DEBUG_INFO .?AU_CREATE_THREAD_DEBUG_INFO@@ $5 � 5 b � _SYSTEM_POWER_STATE_DISABLE_REASON .?AU_SYSTEM_POWER_STATE_DISABLE_REASON@@ �� " �R
'5 AffectedState
" PowerReasonCode ��
" PowerReasonLength b (5 _SYSTEM_POWER_STATE_DISABLE_REASON .?AU_SYSTEM_POWER_STATE_DISABLE_REASON@@ �� )5 {
_/
� p " t ,5
-5
� V CoverageAllModules ��� CoverageSearchByHash � CoverageSearchByName �F t /5 _COVERAGE_REQUEST_CODES .?AW4_COVERAGE_REQUEST_CODES@@ � 05 � �
05
�
�
�
�2
� > � _EISA_MEMORY_TYPE .?AU_EISA_MEMORY_TYPE@@ �
55 ConfigurationByte
DataSize �
! AddressLowWord ���
AddressHighByte ��
! MemorySize ���R 65 _EISA_MEMORY_CONFIGURATION .?AU_EISA_MEMORY_CONFIGURATION@@ �� 75 � R � _CONTAINER_ROOT_INFO_OUTPUT .?AU_CONTAINER_ROOT_INFO_OUTPUT@@
95
� >
! ContainerRootIdLength
� ContainerRootId ��R ;5 _CONTAINER_ROOT_INFO_OUTPUT .?AU_CONTAINER_ROOT_INFO_OUTPUT@@ <5 � �"
O
� V � _SECURITY_DESCRIPTOR_RELATIVE .?AU_SECURITY_DESCRIPTOR_RELATIVE@@ z
Revision �
Sbz1 �
! Control ��
" Owner
" Group
" Sacl �
" Dacl �V @5 _SECURITY_DESCRIPTOR_RELATIVE .?AU_SECURITY_DESCRIPTOR_RELATIVE@@ A5 w � f � _EVENT_TRACE_SYSTEM_EVENT_INFORMATION .?AU_EVENT_TRACE_SYSTEM_EVENT_INFORMATION@@
C5
� V
? EventTraceInformationClass ���
# TraceHandle ��
� HookId ���f E5 _EVENT_TRACE_SYSTEM_EVENT_INFORMATION .?AU_EVENT_TRACE_SYSTEM_EVENT_INFORMATION@@ F5 @ j � _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION .?AU_SYSTEM_SESSION_MAPPED_VIEW_INFORMATION@@ �
" NextEntryOffset ��
" SessionId
" ViewFailures �
" NumberOfBytesAvailable ���
" NumberOfBytesAvailableContiguous �j I5 _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION .?AU_SYSTEM_SESSION_MAPPED_VIEW_INFORMATION@@ J5 � �
b � _SYSTEM_KERNEL_DEBUGGER_INFORMATION .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION@@ F
KernelDebuggerEnabled
KernelDebuggerNotPresent �b M5 _SYSTEM_KERNEL_DEBUGGER_INFORMATION .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION@@ N5 � � > � tagMSGBOXPARAMSW .?AUtagMSGBOXPARAMSW@@ ���
u cbSize ���
� hwndOwner
4 hInstance
lpszText �
lpszCaption ��
" dwStyle ��
lpszIcon �
" dwContextHelpId ��
9 lpfnMsgBoxCallback ���
" $ dwLanguageId �>
Q5 ( tagMSGBOXPARAMSW .?AUtagMSGBOXPARAMSW@@ �� R5 ~ $ F � tagCOMPAREITEMSTRUCT .?AUtagCOMPAREITEMSTRUCT@@ ��
T5
� �
u CtlType ��
u CtlID
� hwndItem �
u itemID1 ��
" itemData1
u itemID2 ��
" itemData2
" dwLocaleId ���F V5 tagCOMPAREITEMSTRUCT .?AUtagCOMPAREITEMSTRUCT@@ �� W5 ~ ,
^ � _LOOKUP_STREAM_FROM_CLUSTER_INPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_INPUT@@ B
" Flags
" NumberOfClusters �
g1 Cluster ��^ Z5 _LOOKUP_STREAM_FROM_CLUSTER_INPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_INPUT@@ [5 � � � MemoryBasicInformation ��� MemoryWorkingSetInformation �� MemoryMappedFilenameInformation �� MemoryRegionInformation �� MemoryWorkingSetExInformation MemorySharedCommitInformation MemoryImageInformation ��� MemoryRegionInformationEx MemoryPrivilegedBasicInformation � MemoryEnclaveImageInformation
MemoryBasicInformationCapped � MemoryPhysicalContiguityInformation ��J t ]5 _MEMORY_INFORMATION_CLASS .?AW4_MEMORY_INFORMATION_CLASS@@ � ^5 �
k)
� b � _KEY_SET_VIRTUALIZATION_INFORMATION .?AU_KEY_SET_VIRTUALIZATION_INFORMATION@@
a5
�
" ��
" ��
" ��
" ��^
c5 VirtualTarget
d5 VirtualStore �
e5 VirtualSource
f5 Reserved �b g5 _KEY_SET_VIRTUALIZATION_INFORMATION .?AU_KEY_SET_VIRTUALIZATION_INFORMATION@@ h5 % B � _TOKEN_USER_CLAIMS .?AU_TOKEN_USER_CLAIMS@@ ��
j5
�
UserClaims ���B l5 _TOKEN_USER_CLAIMS .?AU_TOKEN_USER_CLAIMS@@ �� m5 w � N � _PERFINFO_MEM_RESET_INFO .?AU_PERFINFO_MEM_RESET_INFO@@ ��
o5
�
" ��
" ��f
BaseAddress ��
" SizeInBytes ��
q5 TypeInfo �
r5 Spare
" Flags N s5 _PERFINFO_MEM_RESET_INFO .?AU_PERFINFO_MEM_RESET_INFO@@ �� t5 b x
R
� � � _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ ��
w5 ��
x5
�
�
� �
z5 Information ��
SectionBase ��
" SectionLength
SectionGlobalDataBase
" SectionGlobalDataLength �� {5 _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ �� |5 � � Z � _KEY_CONTROL_FLAGS_INFORMATION .?AU_KEY_CONTROL_FLAGS_INFORMATION@@ ��
~5
�
" ControlFlags �Z �5 _KEY_CONTROL_FLAGS_INFORMATION .?AU_KEY_CONTROL_FLAGS_INFORMATION@@ �� �5 ! N � _SYSTEM_NUMA_INFORMATION .?AU_SYSTEM_NUMA_INFORMATION@@ �� " " � � # " � � # " �
" HighestNodeNumber
" Reserved �
�5 ActiveProcessorsGroupAffinity
�5 AvailableMemory ��
�5 Pad ��N �5 _SYSTEM_NUMA_INFORMATION .?AU_SYSTEM_NUMA_INFORMATION@@ �� �5 � : V � _FILE_ID_BOTH_DIR_INFORMATION .?AU_FILE_ID_BOTH_DIR_INFORMATION@@
�5
� j
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
p D ShortNameLength ��
� F ShortName
� ` FileId ���
h FileName �V �5 p _FILE_ID_BOTH_DIR_INFORMATION .?AU_FILE_ID_BOTH_DIR_INFORMATION@@ �5 �
�,
� V � _TRANSACTION_BIND_INFORMATION .?AU_TRANSACTION_BIND_INFORMATION@@
TmHandle �V �5 _TRANSACTION_BIND_INFORMATION .?AU_TRANSACTION_BIND_INFORMATION@@ �5 �
� b � _SYSTEM_EXTENDED_THREAD_INFORMATION .?AU_SYSTEM_EXTENDED_THREAD_INFORMATION@@ R � _SYSTEM_THREAD_INFORMATION .?AU_SYSTEM_THREAD_INFORMATION@@ ��
�5 ThreadInfo ���
@ StackBase
D StackLimit ���
H Win32StartAddress
L TebBase ��
" P Reserved2
" T Reserved3
" X Reserved4 b �5 ` _SYSTEM_EXTENDED_THREAD_INFORMATION .?AU_SYSTEM_EXTENDED_THREAD_INFORMATION@@ �5 � U V � _QUERY_STORAGE_RESERVE_OUTPUT .?AU_QUERY_STORAGE_RESERVE_OUTPUT@@ R � _STORAGE_RESERVE_AREA_INFO .?AU_STORAGE_RESERVE_AREA_INFO@@ �� �5 " �B
" Version ��
" AreaInfoCount
�5 AreaInfo �V �5 _QUERY_STORAGE_RESERVE_OUTPUT .?AU_QUERY_STORAGE_RESERVE_OUTPUT@@ �5 � + N � HSYNTHETICPOINTERDEVICE__ .?AUHSYNTHETICPOINTERDEVICE__@@
t unused ���N �5 HSYNTHETICPOINTERDEVICE__ .?AUHSYNTHETICPOINTERDEVICE__@@ �5 ~ � ^ � _ETW_COVERAGE_SAMPLER_BLOOM_INFO .?AU_ETW_COVERAGE_SAMPLER_BLOOM_INFO@@ ��
�5
� &
Common ���
�$ Bloom ^ �5 ( _ETW_COVERAGE_SAMPLER_BLOOM_INFO .?AU_ETW_COVERAGE_SAMPLER_BLOOM_INFO@@ �� �5 @ # J � _CI_LOG_SCHEDULER_SLEEP .?AU_CI_LOG_SCHEDULER_SLEEP@@
Header ���J �5 0 _CI_LOG_SCHEDULER_SLEEP .?AU_CI_LOG_SCHEDULER_SLEEP@@ �5 b U ^ � _WMI_EXTENDED_THREAD_INFORMATION .?AU_WMI_EXTENDED_THREAD_INFORMATION@@ ��j
" ProcessId
" ThreadId �
StackBase
StackLimit ���
UserStackBase
UserStackLimit ���
StartAddr
" Affinity �
Win32StartAddr ���
TebBase ��
" $ SubProcessTag
p ( BasePriority �
) PagePriority �
* IoPriority ���
+ Flags
, ThreadName ���^ �5 0 _WMI_EXTENDED_THREAD_INFORMATION .?AU_WMI_EXTENDED_THREAD_INFORMATION@@ �� �5 b j � _SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1@@
�5
� 6
$ BootIdentifier ���
FirmwareType �j �5 _SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1 .?AU_SYSTEM_BOOT_ENVIRONMENT_INFORMATION_V1@@ �5 �
U-
�
7 Data �: �5 _WNF_STATE_NAME .?AU_WNF_STATE_NAME@@ �5 �
(4
� Z � _ETW_CLOCK_CONFIGURATION_EVENT .?AU_ETW_CLOCK_CONFIGURATION_EVENT@@ ��F
" KnownType
" Capabilities �
�0 DisableReason Z �5 _ETW_CLOCK_CONFIGURATION_EVENT .?AU_ETW_CLOCK_CONFIGURATION_EVENT@@ �� �5 b
� � �5 f � _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA .?AU_PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA@@ ��V
ServiceName ��
q DeviceInstance ���
" DeviceInstanceLength �f �5 _PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA .?AU_PLUGPLAY_CONTROL_LEGACY_DEVGEN_DATA@@ �� �5 $ !
:$
� B � _WMI_PNP_RECORD_V4 .?AU_WMI_PNP_RECORD_V4@@ ��
�5
� b
$ ClassGuid
" UpperFilterCount �
" LowerFilterCount �
Strings ��B �5 _WMI_PNP_RECORD_V4 .?AU_WMI_PNP_RECORD_V4@@ �� �5 b � � DriverType ��� FileSystemType ��� Win32ServiceOwnProcess ��� Win32ServiceShareProcess � AdapterType �� RecognizerType ���B t �5 _CM_SERVICE_NODE_TYPE .?AW4_CM_SERVICE_NODE_TYPE@@ � �5 v
$
�
" �5
�5
� b SC_EVENT_DATABASE_CHANGE � SC_EVENT_PROPERTY_CHANGE � SC_EVENT_STATUS_CHANGE ���6 t �5 _SC_EVENT_TYPE .?AW4_SC_EVENT_TYPE@@ ��� �5 � �
�5
�
�5
�
� R � _DUPLICATE_EXTENTS_DATA_EX .?AU_DUPLICATE_EXTENTS_DATA_EX@@ ��
" Size �
FileHandle ���
� SourceFileOffset �
� TargetFileOffset �
� ByteCount
" Flags R �5 ( _DUPLICATE_EXTENTS_DATA_EX .?AU_DUPLICATE_EXTENTS_DATA_EX@@ �� �5 � r N � _SCRUB_PARITY_EXTENT_DATA .?AU_SCRUB_PARITY_EXTENT_DATA@@ F � _SCRUB_PARITY_EXTENT .?AU_SCRUB_PARITY_EXTENT@@ �� �5 " �
! Size �
! Flags
! NumberOfParityExtents
! MaximumNumberOfParityExtents �
�5 ParityExtents N �5 _SCRUB_PARITY_EXTENT_DATA .?AU_SCRUB_PARITY_EXTENT_DATA@@ �5 � ' �
" Address ��
" Mode �
" ReserveSize ��
" CommitSize ���
" FirstRegionInformationOffset �
" NextHeapInformationOffset > �5 _HEAP_INFORMATION .?AU_HEAP_INFORMATION@@ �5 � �
L"
�
�/
� J � _FILE_NAMES_INFORMATION .?AU_FILE_NAMES_INFORMATION@@
�5
� b
" NextEntryOffset ��
" FileIndex
" FileNameLength ���
FileName �J �5 _FILE_NAMES_INFORMATION .?AU_FILE_NAMES_INFORMATION@@ �5 � $ : � _MUILANGCFGLIST .?AU_MUILANGCFGLIST@@ : � _MUILANGCFGNODE .?AU_MUILANGCFGNODE@@
�5
� f
u TotalSize
! NumLanguages �
! MaxNumLanguages ��
�5 LanguageConfigs ��: �5 _MUILANGCFGLIST .?AU_MUILANGCFGLIST@@ �5 K j � _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION .?AU_JOURNAL_SET_KEY_USER_FLAGS_INFORMATION@@
�5
� �
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
" OldFlags �
" $ NewFlags �j �5 ( _JOURNAL_SET_KEY_USER_FLAGS_INFORMATION .?AU_JOURNAL_SET_KEY_USER_FLAGS_INFORMATION@@ �5 � � F � _FILE_OBJECTID_BUFFER .?AU_FILE_OBJECTID_BUFFER@@ " 0 �r
o ObjectId �
o BirthVolumeId
o BirthObjectId
o 0 DomainId �
�5 ExtendedInfo �F �5 @ _FILE_OBJECTID_BUFFER .?AU_FILE_OBJECTID_BUFFER@@ �5 � ~ B � _MESSAGE_TRACE_USER .?AU_MESSAGE_TRACE_USER@@
�5
� F � _MESSAGE_TRACE_HEADER .?AU_MESSAGE_TRACE_HEADER@@ n
�5 MessageHeader
$ MessageGuid ��
" MessageFlags �
" DataSize �
# Data �B 6 ( _MESSAGE_TRACE_USER .?AU_MESSAGE_TRACE_USER@@ 6 b � Z � DISPLAYCONFIG_PATH_SOURCE_INFO .?AUDISPLAYCONFIG_PATH_SOURCE_INFO@@ ��
u ��
u ��
� adapterId
u id ���
u modeInfoIdx ��
6 cloneGroupId �
6 sourceModeInfoIdx
u statusFlags ��Z 6 DISPLAYCONFIG_PATH_SOURCE_INFO .?AUDISPLAYCONFIG_PATH_SOURCE_INFO@@ �� 6 � � : � tagTITLEBARINFO .?AUtagTITLEBARINFO@@ B
" cbSize ���
rcTitleBar ���
� rgstate ��:
6 , tagTITLEBARINFO .?AUtagTITLEBARINFO@@ 6 ~ 9 R � _EVENTLOG_FULL_INFORMATION .?AU_EVENTLOG_FULL_INFORMATION@@ ��
6
�
" dwFull ���R 6 _EVENTLOG_FULL_INFORMATION .?AU_EVENTLOG_FULL_INFORMATION@@ �� 6 n � B � PPM_WMI_PERF_STATES .?AUPPM_WMI_PERF_STATES@@
6
� B � PPM_WMI_PERF_STATE .?AUPPM_WMI_PERF_STATE@@ �� 6 " @ ��
" Count
" MaxFrequency �
" CurrentState �
" MaxPerfState �
" MinPerfState �
" LowestPerfState ��
" ThermalConstraint
BusyAdjThreshold �
PolicyType ���
Type �
Reserved �
" TimerInterval
# ( TargetProcessors �
" 0 PStateHandler
" 4 PStateContext
" 8 TStateHandler
" < TStateContext
" @ FeedbackHandler ��
" D Reserved1
# H Reserved2
6 P State B 6 � PPM_WMI_PERF_STATES .?AUPPM_WMI_PERF_STATES@@ 6 { � ^ � _LEARNING_MODE_OBJECT_INFORMATION .?AU_LEARNING_MODE_OBJECT_INFORMATION@@ �
[ ListEntry
LogLevel �
{ ObjectType ���
{ ObjectName ���
RootDirectory
FullObjectName ���^ 6 _LEARNING_MODE_OBJECT_INFORMATION .?AU_LEARNING_MODE_OBJECT_INFORMATION@@ 6 � �
&
� B � tagEMRSELECTOBJECT .?AUtagEMRSELECTOBJECT@@ ��
6
� &
� emr ��
" ihObject �B 6 tagEMRSELECTOBJECT .?AUtagEMRSELECTOBJECT@@ �� !6 � �
� N � _EVENT_BASIC_INFORMATION .?AU_EVENT_BASIC_INFORMATION@@ ��.
�* EventType
EventState ���N %6 _EVENT_BASIC_INFORMATION .?AU_EVENT_BASIC_INFORMATION@@ �� &6 � i B � tagWINDOWPLACEMENT .?AUtagWINDOWPLACEMENT@@ ��
u length ���
u flags
u showCmd ��
� ptMinPosition
� ptMaxPosition
rcNormalPosition �B )6 , tagWINDOWPLACEMENT .?AUtagWINDOWPLACEMENT@@ �� *6 ~ � F � _EXCEPTION_DEBUG_INFO .?AU_EXCEPTION_DEBUG_INFO@@ 6
� ExceptionRecord ��
" P dwFirstChance F -6 T _EXCEPTION_DEBUG_INFO .?AU_EXCEPTION_DEBUG_INFO@@ .6 � 0 R IgnoreError �� NormalError �� SevereError �� CriticalError F t 06 _CM_ERROR_CONTROL_TYPE .?AW4_CM_ERROR_CONTROL_TYPE@@ ��� 16 �
t unused ���& 36 HDC__ .?AUHDC__@@ 46 s P
�
�
76 f � _EVENT_TRACE_TIME_PROFILE_INFORMATION .?AU_EVENT_TRACE_TIME_PROFILE_INFORMATION@@
96
� F
? EventTraceInformationClass ���
" ProfileInterval ��f ;6 _EVENT_TRACE_TIME_PROFILE_INFORMATION .?AU_EVENT_TRACE_TIME_PROFILE_INFORMATION@@ <6 @ � ^ � _PROCESS_HANDLE_TRACING_ENABLE_EX .?AU_PROCESS_HANDLE_TRACING_ENABLE_EX@@ *
" Flags
" TotalSlots ���^ ?6 _PROCESS_HANDLE_TRACING_ENABLE_EX .?AU_PROCESS_HANDLE_TRACING_ENABLE_EX@@ @6 D B 2 � _CONTEXT_EX .?AU_CONTEXT_EX@@
B6
� :
x' All ��
x' Legacy ���
x' XState ���2 D6 _CONTEXT_EX .?AU_CONTEXT_EX@@ E6 K `
�
� b � _SYSTEM_SESSION_POOLTAG_INFORMATION .?AU_SYSTEM_SESSION_POOLTAG_INFORMATION@@ � " �V
" NextEntryOffset ��
" SessionId
" Count
I6 TagInfo ��b J6 ( _SYSTEM_SESSION_POOLTAG_INFORMATION .?AU_SYSTEM_SESSION_POOLTAG_INFORMATION@@ K6 � �
J � _PROCESSOR_POWER_POLICY .?AU_PROCESSOR_POWER_POLICY@@
" ��
" �� �- " < �
" Revision �
DynamicThrottle ��
, Spare
N6 DisableCStates ���
O6 Reserved �
" PolicyCount ��
P6 Policy ���J Q6 L _PROCESSOR_POWER_POLICY .?AU_PROCESSOR_POWER_POLICY@@ R6 { j
r
� F � tagCBTACTIVATESTRUCT .?AUtagCBTACTIVATESTRUCT@@ ��
U6
� .
t fMouse ���
� hWndActive ���F W6 tagCBTACTIVATESTRUCT .?AUtagCBTACTIVATESTRUCT@@ �� X6 ~ m
2
�
�
� J � _SYSTEM_PREFETCH_STATS .?AU_SYSTEM_PREFETCH_STATS@@ ��
" DemandFilePageCount ��
" DemandFileIOCount
" TrickleFilePageCount �
" TrickleFileIOCount ���
" DemandPrivatePageCount ���
" DemandPrivateIOCount �
" TricklePrivatePageCount ��
" TricklePrivateIOCount J ]6 _SYSTEM_PREFETCH_STATS .?AU_SYSTEM_PREFETCH_STATS@@ �� ^6 � �
� b � _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE .?AU_PERFINFO_PO_NOTIFY_DEVICE_COMPLETE@@
a6
� &
Irp ��
Status ���b c6 _PERFINFO_PO_NOTIFY_DEVICE_COMPLETE .?AU_PERFINFO_PO_NOTIFY_DEVICE_COMPLETE@@ d6 b �
/
� .
" CheckSum �
" TimeDateStamp F g6 _HOT_PATCH_IMAGE_INFO .?AU_HOT_PATCH_IMAGE_INFO@@ h6 w E
�+
� �
" dwScope ��
" dwType ���
" dwDisplayType
" dwUsage ��
q lpLocalName ��
q lpRemoteName �
q lpComment
q lpProvider ���6 k6 _NETRESOURCEW .?AU_NETRESOURCEW@@ l6 � n f � _SYSTEM_DMA_GUARD_POLICY_INFORMATION .?AU_SYSTEM_DMA_GUARD_POLICY_INFORMATION@@ ��
n6
� "
DmaGuardPolicyEnabled f p6 _SYSTEM_DMA_GUARD_POLICY_INFORMATION .?AU_SYSTEM_DMA_GUARD_POLICY_INFORMATION@@ �� q6 � > j � _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA .?AU_SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA@@ ��
:
� >
t6 ProcessorProfileControlArea ��
Allocate �j u6 _SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA .?AU_SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA@@ �� v6 � � &
PID ��
KeyName ��6 x6 KEY_PID_ARRAY .?AUKEY_PID_ARRAY@@ y6 � o J � _POWER_SESSION_WINLOGON .?AU_POWER_SESSION_WINLOGON@@ >
" SessionId
Console ��
Locked ���J |6 _POWER_SESSION_WINLOGON .?AU_POWER_SESSION_WINLOGON@@ }6 { � t _(
6
�
]
� p t �6
�6
� > � _SECTIONBASICINFO .?AU_SECTIONBASICINFO@@ R
BaseAddress ��
" AllocationAttributes �
� MaximumSize ��> �6 _SECTIONBASICINFO .?AU_SECTIONBASICINFO@@ �6 w i > � _SCRUB_DATA_INPUT .?AU_SCRUB_DATA_INPUT@@ " " d � " 0 �z
" Size �
" Flags
" MaximumIos ���
� ObjectId �
�6 Reserved �
�6 � ResumeContext > �6 �_SCRUB_DATA_INPUT .?AU_SCRUB_DATA_INPUT@@ �6 � �&
�'
� Z PT_POINTER ��� PT_TOUCH � PT_PEN ��� PT_MOUSE � PT_TOUCHPAD ��B t �6 tagPOINTER_INPUT_TYPE .?AW4tagPOINTER_INPUT_TYPE@@ � �6 ~ x j � _HEAP_PERFORMANCE_COUNTERS_INFORMATION .?AU_HEAP_PERFORMANCE_COUNTERS_INFORMATION@@ ��
�6
� v � _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION .?AU_SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION@@ �
" Size �
" Version ��
" HeapIndex
" LastHeapIndex
" BaseAddress ��
" ReserveSize ��
" CommitSize ���
" SegmentCount �
" LargeUCRMemory ���
" $ UCRLength
" ( AllocatedSpace ���
" , FreeSpace
" 0 FreeListLength ���
" 4 Contention ���
" 8 VirtualBlocks
" < CommitRate ���
" @ DecommitRate �
�6 D SegmentHeapPerfInformation ���j �6 \ _HEAP_PERFORMANCE_COUNTERS_INFORMATION .?AU_HEAP_PERFORMANCE_COUNTERS_INFORMATION@@ �� �6 �
j'
� @- " �n
# NextOffset ���
# NumSDEntriesReturned �
# NumSDBytesReturned ���
�6 SDEntry ��B �6 0 _SD_ENUM_SDS_OUTPUT .?AU_SD_ENUM_SDS_OUTPUT@@ �6 � @ j � DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS@@ ��
u ��
u ��
u ��
u ��~
�6 friendlyNameFromEdid �
�6 friendlyNameForced ���
�6 edidIdsValid �
�6 reserved �
u value j �6 DISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME_FLAGS@@ �� �6 � �
�
� F � _PROCESS_ACCESS_TOKEN .?AU_PROCESS_ACCESS_TOKEN@@ &
Token
Thread ���F �6 _PROCESS_ACCESS_TOKEN .?AU_PROCESS_ACCESS_TOKEN@@ �6 D � f � _SYSTEM_ELAM_CERTIFICATE_INFORMATION .?AU_SYSTEM_ELAM_CERTIFICATE_INFORMATION@@ ��
�6
�
ElamDriverFile ���f �6 _SYSTEM_ELAM_CERTIFICATE_INFORMATION .?AU_SYSTEM_ELAM_CERTIFICATE_INFORMATION@@ �� �6 � ' B _ARM_LSR � _ARM_LSL � _ARM_ASR � _ARM_ROR �B t �6 _tag_ARMINTR_SHIFT_T .?AW4_tag_ARMINTR_SHIFT_T@@ ��� �6 j
�
�
�$
� � FixedWakeSourcePowerButton ��� FixedWakeSourceSleepButton ��� FixedWakeSourceRtc ��� FixedWakeSourceDozeToHibernate ���J t �6 PO_FIXED_WAKE_SOURCE_TYPE .?AW4PO_FIXED_WAKE_SOURCE_TYPE@@ � �6 {
^
" RecordLength �
! MajorVersion �
! MinorVersion �
# FileReferenceNumber ��
# ParentFileReferenceNumber
Usn ��
� TimeStamp
" ( Reason ���
" , SourceInfo ���
" 0 SecurityId ���
" 4 FileAttributes ���
! 8 FileNameLength ���
! : FileNameOffset ���
< FileName �6 �6 @ USN_RECORD_V2 .?AUUSN_RECORD_V2@@ �6 � s 6 � _TOKEN_SOURCE .?AU_TOKEN_SOURCE@@
�6
� p " �6
�6 SourceName ���
� SourceIdentifier �6 �6 _TOKEN_SOURCE .?AU_TOKEN_SOURCE@@ �6 w � . � _TP_WAIT .?AU_TP_WAIT@@ �� " " �6
�6
� � VirtualStorageBehaviorUndefined �� VirtualStorageBehaviorCacheWriteThrough �� VirtualStorageBehaviorCacheWriteBack �V t �6 _VIRTUAL_STORAGE_BEHAVIOR_CODE .?AW4_VIRTUAL_STORAGE_BEHAVIOR_CODE@@ ��� �6 � �! > � _HARDWARE_COUNTER .?AU_HARDWARE_COUNTER@@ 6
� Type �
" Reserved �
# Index > �6 _HARDWARE_COUNTER .?AU_HARDWARE_COUNTER@@ �6 D n � _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION@@ ��
" ��
" ��
" ��
" ��~
" Flags
�6 Locked ���
�6 UnlockApplied
�6 UnlockIdValid
�6 Reserved �
� UnlockId �n �6 $ _SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION .?AU_SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION@@ �� �6 � �
J � _RPC_SECURITY_QOS_V3_A .?AU_RPC_SECURITY_QOS_V3_A@@ ��
c. HttpCredentials ��2 �6 <anonymous-tag> .?AT<anonymous-tag>@@ �6 ^ ; �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
�6 u
Sid ��J �6 _RPC_SECURITY_QOS_V3_A .?AU_RPC_SECURITY_QOS_V3_A@@ �� �6 ^ 4 f � _FILE_IOSTATUSBLOCK_RANGE_INFORMATION .?AU_FILE_IOSTATUSBLOCK_RANGE_INFORMATION@@
�6
� 6
IoStatusBlockRange ���
" Length ���f �6 _FILE_IOSTATUSBLOCK_RANGE_INFORMATION .?AU_FILE_IOSTATUSBLOCK_RANGE_INFORMATION@@ �6 � � : � tagEMRSETPIXELV .?AUtagEMRSETPIXELV@@ :
� emr ��
� ptlPixel �
" crColor ��: �6 tagEMRSETPIXELV .?AUtagEMRSETPIXELV@@ �6 � F � _LOGICAL_DISK_DEFRAG .?AU_LOGICAL_DISK_DEFRAG@@ ��
# AlignmentClusters
# AvgFreeSpaceSize �
# ClustersPerSlab ��
# FragmentedDirectoryExtents ���
# FragmentedExtents
# ( FreeSpaceCount ���
# 0 LargestFreeSpaceSize �
# 8 LastRunActualPurgeClusters ���
# @ LastRunClustersTrimmed ���
# H LastRunFullDefragTime
# P LastRunTime ��
# X MFTSize ��
# ` TotalClusters
# h TotalUsedClusters
" p AvgFragmentsPerFile ��
" t BytesPerCluster ��
" x DirectoryCount ���
" | FragmentedDirectories
" � FragmentedFiles ��
" � FragmentedSpace ��
" � HardwareIssue
" � InUseMFTRecords ��
" � InUseSlabs ���
" � LastRunActualPurgeSlabs ��
" � LastRunInitialBackedSlabs
" � LastRunPercentFragmentation ��
" � LastRunPinnedSlabs ���
" � LastRunPotentialPurgeSlabs ���
" � LastRunSpaceInefficientSlabs �
" � LastRunTrimmedSlabs ��
" � LastRunUnknownEvictFailSlabs �
" � LastRunVolsnapPinnedSlabs
" � MFTFragmentCount �
" � MovableFiles �
" � TotalMFTRecords ��
" � TotalSlabs ���
" � UnmovableFiles ���
$ � VolumeId �
� VolumePathNames ��F ' �6 � _LOGICAL_DISK_DEFRAG .?AU_LOGICAL_DISK_DEFRAG@@ �� �6 b V � _KEY_VALUE_BASIC_INFORMATION .?AU_KEY_VALUE_BASIC_INFORMATION@@ ��R
" TitleIndex ���
" Type �
" NameLength ���
Name �V �6 _KEY_VALUE_BASIC_INFORMATION .?AU_KEY_VALUE_BASIC_INFORMATION@@ �� �6 H > � _FILE_LEVEL_TRIM .?AU_FILE_LEVEL_TRIM@@ ��
�6
� �1 " �:
" Key ��
" NumRanges
�6 Ranges ���> �6 _FILE_LEVEL_TRIM .?AU_FILE_LEVEL_TRIM@@ �� �6 � L B
" ReserveSize ��
" ZeroBits �
StackBase f �6 _PROCESS_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_STACK_ALLOCATION_INFORMATION@@ �6 � � v � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE@@ ��
MaxIops ��
MaxBandwidth �
ReservationIops ��
q VolumeName ���
" BaseIoSize ���
0 ControlFlags �
! $ VolumeNameLength �v �6 ( JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE@@ �� �6 D _
�4
� > � _MUILANGLISTNODE .?AU_MUILANGLISTNODE@@ ��F
! LanguageType �
! Reserved �
LanguageSpec �> �6 _MUILANGLISTNODE .?AU_MUILANGLISTNODE@@ �� �6 T V � _FILE_FS_OBJECTID_INFORMATION .?AU_FILE_FS_OBJECTID_INFORMATION@@
�6
� .
o ObjectId �
�5 ExtendedInfo �V 7 @ _FILE_FS_OBJECTID_INFORMATION .?AU_FILE_FS_OBJECTID_INFORMATION@@ 7 � �
'.
� * XLAT_SERVER �� XLAT_CLIENT ��* t 7 XLAT_SIDE .?AW4XLAT_SIDE@@ � 7 � � b
RefIdToPointer ���
PointerToRefId ���
" NextRefId
7 XlatSide �F 7 _FULL_PTR_XLAT_TABLES .?AU_FULL_PTR_XLAT_TABLES@@ 7 � �
?
�
�
� �
" Size �
" InitialPc
StackBase
StackLimit ���
DeallocationStack
" LogFlags �
" InitialSp
SimulationCount ��
InCpuSimulation ��
EmulateInitialPc �
Initialized ��
7 ExceptionList
$ CpuContext ���
7 ( InitialExceptionContext ��
, pCallersRIID �
0 pCallersUnknown ��
" 4 Flags
8 SelfRegDllName ���
< SelfRegDllHandle �. 7 @ _Wx86TIB .?AU_Wx86TIB@@ ��
7 � �
�(
�
~&
� . � _FPO_DATA .?AU_FPO_DATA@@
! ��
! ��
! ��
! ��
!
��
! ���
" ulOffStart ���
" cbProcSize ���
" cdwLocals
! cdwParams
7 cbProlog �
7 cbRegs ���
7 fHasSEH ��
7 fUseBP ���
7 reserved �
7 cbFrame ��.
7 _FPO_DATA .?AU_FPO_DATA@@ 7 � � Z � _RPC_BINDING_HANDLE_OPTIONS_V1 .?AU_RPC_BINDING_HANDLE_OPTIONS_V1@@ ��
7
� V
" Version ��
" Flags
" ComTimeout ���
" CallTimeout ��Z 7 _RPC_BINDING_HANDLE_OPTIONS_V1 .?AU_RPC_BINDING_HANDLE_OPTIONS_V1@@ �� 7 ^ (
=
� 6 � _QUOTA_LIMITS .?AU_QUOTA_LIMITS@@ �
" PagedPoolLimit ���
" NonPagedPoolLimit
" MinimumWorkingSetSize
" MaximumWorkingSetSize
" PagefileLimit
� TimeLimit 6 "7 _QUOTA_LIMITS .?AU_QUOTA_LIMITS@@ #7 D � R � _QUERY_SERVICE_LOCK_STATUSA .?AU_QUERY_SERVICE_LOCK_STATUSA@@
%7
� J
" fIsLocked
p lpLockOwner ��
" dwLockDuration ���R '7 _QUERY_SERVICE_LOCK_STATUSA .?AU_QUERY_SERVICE_LOCK_STATUSA@@ (7 �
�
�
�
� : � tagEXTLOGFONTA .?AUtagEXTLOGFONTA@@ ���
� elfLogFont ���
�+ < elfFullName ��
� | elfStyle �
" � elfVersion ���
" � elfStyleSize �
" � elfMatch �
" � elfReserved ��
�* � elfVendorId ��
" � elfCulture ���
� elfPanose :
-7 � tagEXTLOGFONTA .?AUtagEXTLOGFONTA@@ �� .7 � j � _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES@@ ��v
" Version ��
ProcessHandle
" PatchCount ���
{ PatchPathStrings �
/ BaseInfos j 17 _MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES .?AU_MANAGE_HOT_PATCH_QUERY_ACTIVE_PATCHES@@ �� 27 w � r � _FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX@@
47
� .
W StorageReserveId �
" Flags r 67 _FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX .?AU_FILE_SET_STORAGE_RESERVE_ID_INFORMATION_EX@@ 77 � i+
2
�
r2
� >
HeapHandle ���
Address ��
" Size �> ;7 _HEAP_EVENT_RANGE .?AU_HEAP_EVENT_RANGE@@ <7 b � : � tagTTPOLYCURVE .?AUtagTTPOLYCURVE@@ �� 4 " �2
! wType
! cpfx �
?7 apfx �: @7 tagTTPOLYCURVE .?AUtagTTPOLYCURVE@@ �� A7 � �
J � _PORT_DATA_INFORMATION .?AU_PORT_DATA_INFORMATION@@ ��> � _PORT_DATA_ENTRY .?AU_PORT_DATA_ENTRY@@ �� D7 " �6
" CountDataEntries �
E7 DataEntries ��J F7 _PORT_DATA_INFORMATION .?AU_PORT_DATA_INFORMATION@@ �� G7 � [
4
� Z � _WMI_JOB_SET_QUERY_INFORMATION .?AU_WMI_JOB_SET_QUERY_INFORMATION@@ ��N
$ ContainerId ��
" JobId
" JobObjectInformationClass Z K7 _WMI_JOB_SET_QUERY_INFORMATION .?AU_WMI_JOB_SET_QUERY_INFORMATION@@ �� L7 b � J � _FILE_ID_EXTD_DIR_INFO .?AU_FILE_ID_EXTD_DIR_INFO@@ ��V
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
" D ReparsePointTag ��
m H FileId ���
X FileName �J O7 ` _FILE_ID_EXTD_DIR_INFO .?AU_FILE_ID_EXTD_DIR_INFO@@ �� P7 n .# 2 HANDEDNESS_LEFT �� HANDEDNESS_RIGHT �2 t R7 tagHANDEDNESS .?AW4tagHANDEDNESS@@ � S7 ~ �1
S7
� v � _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION .?AU_SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION@@ >
FileHandle ���
" ImageSize
Image v W7 _SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION .?AU_SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION@@ X7 � 4 @ ! @ Z7
Y&
� : � tagMONITORINFO .?AUtagMONITORINFO@@ ��R
" cbSize ���
rcMonitor
rcWork ���
" $ dwFlags ��: ^7 ( tagMONITORINFO .?AUtagMONITORINFO@@ �� _7 ~ �4 � MemSectionExtendedParameterInvalidType ��� MemSectionExtendedParameterUserPhysicalFlags � MemSectionExtendedParameterNumaNode �� MemSectionExtendedParameterMax ���^ t a7 MEM_SECTION_EXTENDED_PARAMETER_TYPE .?AW4MEM_SECTION_EXTENDED_PARAMETER_TYPE@@ � b7 � & V � _OBJECT_DIRECTORY_INFORMATION .?AU_OBJECT_DIRECTORY_INFORMATION@@ &
Name �
TypeName �V e7 _OBJECT_DIRECTORY_INFORMATION .?AU_OBJECT_DIRECTORY_INFORMATION@@ f7 + � " " h7
i7
� � � _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@
Ssp �� l7 _PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION .?AU_PROCESS_FREE_FIBER_SHADOW_STACK_ALLOCATION_INFORMATION@@ m7 � V � _PERFINFO_MEMORY_INFORMATION .?AU_PERFINFO_MEMORY_INFORMATION@@ ���
" ZeroPageCount
" FreePageCount
" ModifiedPageCount
" ModifiedNoWritePageCount �
" BadPageCount �
d, PageCountByPriority ��
d, 4 RepurposedPagesByPriority
" T ModifiedPageCountPageFile V p7 X _PERFINFO_MEMORY_INFORMATION .?AU_PERFINFO_MEMORY_INFORMATION@@ �� q7 b �
�
� �
" Latency ��
" Power
" TimeCheck
PromotePercent ���
DemotePercent
StateType
Reserved �
" StateFlags ���
" Context ��
" IdleHandler ��
" Reserved1 B t7 PPM_WMI_IDLE_STATE .?AUPPM_WMI_IDLE_STATE@@ �� u7 { � B � tagIMECHARPOSITION .?AUtagIMECHARPOSITION@@ ��
w7
� j
" dwSize ���
" dwCharPos
� pt ���
u cLineHeight ��
rcDocument ���B y7 $ tagIMECHARPOSITION .?AUtagIMECHARPOSITION@@ �� z7 � � : � _RTL_RXACT_LOG .?AU_RTL_RXACT_LOG@@ ��J
" OperationCount ���
" LogSize ��
" LogSizeInUse �: }7 _RTL_RXACT_LOG .?AU_RTL_RXACT_LOG@@ �� ~7 � � "
" iType
" nSize * �7 tagEMR .?AUtagEMR@@ �� �7 � > N � _POWER_SESSION_RIT_STATE .?AU_POWER_SESSION_RIT_STATE@@ ��.
Active ���
" LastInputTime N �7 _POWER_SESSION_RIT_STATE .?AU_POWER_SESSION_RIT_STATE@@ �� �7 { �
" HeaderSize ���
" TotalSize
" QuerySequence
" OptionsOffset
" OptionsSize ��
" StatsOffset ��
" StatsSize
" SamplesOffset
" SampleCount ��
" $ ModulesOffset
" ( ModuleCount ��R �7 , _ETW_COVERAGE_SAMPLER_DATA .?AU_ETW_COVERAGE_SAMPLER_DATA@@ �� �7 @ N : � _ETW_POOL_EVENT .?AU_ETW_POOL_EVENT@@ N
" PoolType �
" Tag ��
" NumberOfBytes
Entry : �7 _ETW_POOL_EVENT .?AU_ETW_POOL_EVENT@@ �7 b @
6 � _TIME_FIELDS .?AU_TIME_FIELDS@@ ��
Year �
Month
Day ��
Hour �
Minute ���
Second ���
Milliseconds �
Weekday ��6 �7 _TIME_FIELDS .?AU_TIME_FIELDS@@ �� �7 g a F � _UNICODE_PREFIX_TABLE .?AU_UNICODE_PREFIX_TABLE@@
�
� f
NodeTypeCode �
NameLength ���
�7 NextPrefixTree ���
�7 LastNextEntry F �7 _UNICODE_PREFIX_TABLE .?AU_UNICODE_PREFIX_TABLE@@ �7 g \
K4
� B � _MENU_EVENT_RECORD .?AU_MENU_EVENT_RECORD@@ ��
�7
�
u dwCommandId ��B �7 _MENU_EVENT_RECORD .?AU_MENU_EVENT_RECORD@@ �� �7 � r . � HWINSTA__ .?AUHWINSTA__@@
t unused ���. �7 HWINSTA__ .?AUHWINSTA__@@ �7 �' B � _PS_MEMORY_RESERVE .?AU_PS_MEMORY_RESERVE@@ ��
�7
� 6
ReserveAddress ���
" ReserveSize ��B �7 _PS_MEMORY_RESERVE .?AU_PS_MEMORY_RESERVE@@ �� �7 � $ F � tagWNODE_METHOD_ITEM .?AUtagWNODE_METHOD_ITEM@@ ��
� WnodeHeader ��
" 0 OffsetInstanceName ���
" 4 InstanceIndex
" 8 MethodId �
" < DataBlockOffset ��
" @ SizeDataBlock
� D VariableData �F �7 H tagWNODE_METHOD_ITEM .?AUtagWNODE_METHOD_ITEM@@ �� �7 � �
3
� c c �7
C7
� V � _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES .?AT_SYSDBG_LIVEDUMP_CONTROL_ADDPAGES@@
" ��
" ��F
�7 HypervisorPages ��
�7 Reserved �
" AsUlong ��V �7 _SYSDBG_LIVEDUMP_CONTROL_ADDPAGES .?AT_SYSDBG_LIVEDUMP_CONTROL_ADDPAGES@@ �7 � d
�-
� N � _PS_SYSTEM_DLL_INIT_BLOCK .?AU_PS_SYSTEM_DLL_INIT_BLOCK@@
" ��
" ��z
" Size �
# SystemDllWowRelocation ���
# SystemDllNativeRelocation
�5 Wow64SharedInformation ���
" � RngData ��
" � Flags
�7 � CfgOverride ��
�7 � Reserved �
� � MitigationOptionsMap �
# � CfgBitMap
# � CfgBitMapSize
# � Wow64CfgBitMap ���
# � Wow64CfgBitMapSize ���
� � MitigationAuditOptionsMap N �7 � _PS_SYSTEM_DLL_INIT_BLOCK .?AU_PS_SYSTEM_DLL_INIT_BLOCK@@ �7 � @
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ���
" Flags
�7 EnableExportAddressFilter
�7 AuditExportAddressFilter �
�7 EnableExportAddressFilterPlus
�7 AuditExportAddressFilterPlus �
�7 EnableImportAddressFilter
�7 AuditImportAddressFilter �
�7 EnableRopStackPivot ��
�7 AuditRopStackPivot ���
�7 EnableRopCallerCheck �
�7 AuditRopCallerCheck ��
�7 EnableRopSimExec �
�7 AuditRopSimExec ��
�7 ReservedFlags z �7 _PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY .?AU_PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY@@ �� �7 D �
�
�
� � SystemActivityModerationAppTypeClassic ��� SystemActivityModerationAppTypePackaged �� MaxSystemActivityModerationAppType ���b t �7 _SYSTEM_ACTIVITY_MODERATION_APP_TYPE .?AW4_SYSTEM_ACTIVITY_MODERATION_APP_TYPE@@ ��� �7 � $
�7
� J � _THREAD_TEB_INFORMATION .?AU_THREAD_TEB_INFORMATION@@ J
TebInformation ���
" TebOffset
" BytesToRead ��J �7 _THREAD_TEB_INFORMATION .?AU_THREAD_TEB_INFORMATION@@ �7 � � J � _EVENT_TRACE_PROPERTIES .?AU_EVENT_TRACE_PROPERTIES@@ �
� Wnode
" 0 BufferSize ���
" 4 MinimumBuffers ���
" 8 MaximumBuffers ���
" < MaximumFileSize ��
" @ LogFileMode ��
" D FlushTimer ���
" H EnableFlags ��
L AgeLimit �
L FlushThreshold ���
" P NumberOfBuffers ��
" T FreeBuffers ��
" X EventsLost ���
" \ BuffersWritten ���
" ` LogBuffersLost ���
" d RealTimeBuffersLost ��
h LoggerThreadId ���
" l LogFileNameOffset
" p LoggerNameOffset �J �7 x _EVENT_TRACE_PROPERTIES .?AU_EVENT_TRACE_PROPERTIES@@ �7 � ^ � u u " �7
�7
�
.
� R � _PERFINFO_PROCESS_PERFCTR32 .?AU_PERFINFO_PROCESS_PERFCTR32@@ �
" ProcessId
" PageFaultCount ���
" HandleCount ��
" Reserved �
u PeakVirtualSize ��
u PeakWorkingSetSize ���
u PeakPagefileUsage
u QuotaPeakPagedPoolUsage ��
u QuotaPeakNonPagedPoolUsage ���
u $ VirtualSize ��
u ( WorkingSetSize ���
u , PagefileUsage
u 0 QuotaPagedPoolUsage ��
u 4 QuotaNonPagedPoolUsage ���
u 8 PrivatePageCount �R �7 < _PERFINFO_PROCESS_PERFCTR32 .?AU_PERFINFO_PROCESS_PERFCTR32@@ �7 b �
d!
�
�
�
��
��
��
��
��r
�7 Interrupt
�7 Reserved �
�7 LevelTriggered ���
�7 Shared ���
�7 MoreEntries ��F �7 _EISA_IRQ_DESCRIPTOR .?AU_EISA_IRQ_DESCRIPTOR@@ �� �7 � n PdataCrUnchained � PdataCrUnchainedSavedLr �� PdataCrChainedWithPac PdataCrChained ���: t �7 ARM64_FNPDATA_CR .?AW4ARM64_FNPDATA_CR@@ ��� �7 � N � _SYSDBG_LIVEDUMP_CONTROL .?AU_SYSDBG_LIVEDUMP_CONTROL@@ ��
" Version ��
" BugCheckCode �
" BugCheckParam1 ���
" BugCheckParam2 ���
" BugCheckParam3 ���
" BugCheckParam4 ���
DumpFileHandle ���
CancelEventHandle
�- Flags
�7 $ AddPagesControl ��N
�7 ( _SYSDBG_LIVEDUMP_CONTROL .?AU_SYSDBG_LIVEDUMP_CONTROL@@ �� �7 � v
�(
�
�.
� J � _ENCLAVE_INIT_INFO_SGX .?AU_ENCLAVE_INIT_INFO_SGX@@ �� " � " � � " 0 � " � �V
�7 SigStruct
�7 Reserved1
�7 EInitToken ���
�7 0 Reserved2 J �7 _ENCLAVE_INIT_INFO_SGX .?AU_ENCLAVE_INIT_INFO_SGX@@ �� �7 � � r � _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600@@
" Size �
" DataFormatVersion
Data �
" Length ���
SectionGlobalData
" SectionGlobalDataLength ��
SectionBase ��
" SectionTotalLength ���
�! ActivationContext
" $ AssemblyRosterIndex ��
" ( Flags r �7 , _ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600 .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA_2600@@ �7 � � N � _FILE_NOTIFY_INFORMATION .?AU_FILE_NOTIFY_INFORMATION@@ ��
8
� b
" NextEntryOffset ��
" Action ���
" FileNameLength ���
FileName �N 8 _FILE_NOTIFY_INFORMATION .?AU_FILE_NOTIFY_INFORMATION@@ �� 8 � 8 2
$ SyntaxGUID ���
�& SyntaxVersion J 8 _RPC_SYNTAX_IDENTIFIER .?AU_RPC_SYNTAX_IDENTIFIER@@ �� 8 3 .
�
� r
Enable ���
, Spare
" BatteryLevel �
� PowerPolicy ��
� MinSystemState ���B 8 SYSTEM_POWER_LEVEL .?AUSYSTEM_POWER_LEVEL@@ ��
8 { �
R � _WINDOW_BUFFER_SIZE_RECORD .?AU_WINDOW_BUFFER_SIZE_RECORD@@ ��
�" dwSize ���R
8 _WINDOW_BUFFER_SIZE_RECORD .?AU_WINDOW_BUFFER_SIZE_RECORD@@ �� 8 � n Z � _SYSTEM_LEAP_SECOND_INFORMATION .?AU_SYSTEM_LEAP_SECOND_INFORMATION@@ &
Enabled ��
" Flags Z 8 _SYSTEM_LEAP_SECOND_INFORMATION .?AU_SYSTEM_LEAP_SECOND_INFORMATION@@ 8 � �
! t 8 > � _IMAGE_AUX_SYMBOL_EX .?AT_IMAGE_AUX_SYMBOL_EX@@ ��
8 ��
8
� V
" WeakDefaultSymIndex ��
" WeakSearchType ���
p rgbReserved ��: 8 <anonymous-tag> .?AU<anonymous-tag>@@ 8 � =
� Name �: 8 <anonymous-tag> .?AU<anonymous-tag>@@ 8 � B �
" Length ���
! NumberOfRelocations ��
! NumberOfLinenumbers ��
" CheckSum �
Number ���
Selection
bReserved
HighNumber ���
� rgbReserved ��: 8 <anonymous-tag> .?AU<anonymous-tag>@@ 8 � E *
" crc ��
o rgbReserved ��: "8 <anonymous-tag> .?AU<anonymous-tag>@@ #8 � T r
8 Sym ��
8 File �
8 Section ��
j$ TokenDef �
� rgbReserved ��
#8 CRC ��> %8 _IMAGE_AUX_SYMBOL_EX .?AT_IMAGE_AUX_SYMBOL_EX@@ �� &8 � < : � _DISCDLGSTRUCTW .?AU_DISCDLGSTRUCTW@@ r
" cbStructure ��
� hwndOwner
q lpLocalName ��
q lpRemoteName �
" dwFlags ��: )8 _DISCDLGSTRUCTW .?AU_DISCDLGSTRUCTW@@ *8 � � j � _STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER .?AU_STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER@@ n
" OptimalWriteSize �
" StreamGranularitySize
" StreamIdMin ��
" StreamIdMax ��j -8 _STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER .?AU_STREAMS_QUERY_PARAMETERS_OUTPUT_BUFFER@@ .8 � � : � tagSOUNDSENTRYW .?AUtagSOUNDSENTRYW@@
08
� R
u cbSize ���
" dwFlags ��
" iFSTextEffect
" iFSTextEffectMSec
" iFSTextEffectColorBits ���
" iFSGrafEffect
" iFSGrafEffectMSec
" iFSGrafEffectColor ���
" iWindowsEffect ���
" $ iWindowsEffectMSec ���
q ( lpszWindowsEffectDLL �
" , iWindowsEffectOrdinal : 28 0 tagSOUNDSENTRYW .?AUtagSOUNDSENTRYW@@ 38 ~ ,4 Z � _WMI_DISKIO_IO_REDIRECTED_INIT .?AU_WMI_DISKIO_IO_REDIRECTED_INIT@@ ��
58
� &
Irp ��
FileKey ��Z 78 _WMI_DISKIO_IO_REDIRECTED_INIT .?AU_WMI_DISKIO_IO_REDIRECTED_INIT@@ �� 88 b � 6 � tagALTTABINFO .?AUtagALTTABINFO@@ �
" cbSize ���
t cItems ���
t cColumns �
t cRows
t iColFocus
t iRowFocus
t cxItem ���
t cyItem ���
� ptStart ��6 ;8 ( tagALTTABINFO .?AUtagALTTABINFO@@ <8 ~ �9
�7 ��
>8
� Z � _WOW64_ARCHITECTURE_INFORMATION .?AU_WOW64_ARCHITECTURE_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
A8 Machine ��
B8 KernelMode ���
C8 UserMode �
D8 Native ���
E8 Process ��
F8 ReservedZero0 Z G8 _WOW64_ARCHITECTURE_INFORMATION .?AU_WOW64_ARCHITECTURE_INFORMATION@@ H8 D r f
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType > J8 _RPC_SECURITY_QOS .?AU_RPC_SECURITY_QOS@@ K8 ^ n
q M8 B � _ETW_PRIORITY_EVENT .?AU_ETW_PRIORITY_EVENT@@ v
" ThreadId �
p OldPriority ��
p NewPriority ��
p DynamicPriority ��
p Reserved �B P8 _ETW_PRIORITY_EVENT .?AU_ETW_PRIORITY_EVENT@@ Q8 b
b � _SYSTEM_LOW_PRIORITY_IO_INFORMATION .?AU_SYSTEM_LOW_PRIORITY_IO_INFORMATION@@
S8
� n
" LowPriReadOperations �
" LowPriWriteOperations
" KernelBumpedToNormalOperations ���
" LowPriPagingReadOperations ���
" KernelPagingReadsBumpedToNormal ��
" LowPriPagingWriteOperations ��
" KernelPagingWritesBumpedToNormal �
" BoostedIrpCount ��
" BoostedPagingIrpCount
" $ BlanketBoostCount b
U8 ( _SYSTEM_LOW_PRIORITY_IO_INFORMATION .?AU_SYSTEM_LOW_PRIORITY_IO_INFORMATION@@ V8 � �
�%
� Z � RTLWOW64_CROSSPROCESS_WORK_ITEM .?AURTLWOW64_CROSSPROCESS_WORK_ITEM@@ z
BaseAddress ��
# RegionSize ���
" AllocationType ���
" Protect ��
SyscallStatus : Z8 <anonymous-tag> .?AU<anonymous-tag>@@ [8 � � ^
BaseAddress ��
# RegionSize ���
" FreeType �
SyscallStatus : ]8 <anonymous-tag> .?AU<anonymous-tag>@@ ^8 � � b
BaseAddress ��
# RegionSize ���
" NewProtect ���
SyscallStatus : `8 <anonymous-tag> .?AU<anonymous-tag>@@ a8 � � .
BaseAddress ��
# Length ���: c8 <anonymous-tag> .?AU<anonymous-tag>@@ d8 � � 2
BaseAddress ��
# RegionSize ���: f8 <anonymous-tag> .?AU<anonymous-tag>@@ g8 � � �
" Next �
� Operation
[8 MemoryAllocData ��
^8 MemoryFreeData ���
a8 MemoryProtectData
d8 InstructionCacheFlushData
g8 MemoryDirtyData ��Z i8 ( RTLWOW64_CROSSPROCESS_WORK_ITEM .?AURTLWOW64_CROSSPROCESS_WORK_ITEM@@ j8 � �
�!
� ^ � _MEMORY_ENCLAVE_IMAGE_INFORMATION .?AU_MEMORY_ENCLAVE_IMAGE_INFORMATION@@ N � _MEMORY_IMAGE_INFORMATION .?AU_MEMORY_IMAGE_INFORMATION@@ >
n8 ImageInfo
� UniqueID �
� , AuthorID �^ o8 L _MEMORY_ENCLAVE_IMAGE_INFORMATION .?AU_MEMORY_ENCLAVE_IMAGE_INFORMATION@@ p8 w � b � _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_OUTPUT@@ ��R
" Offset ���
" NumberOfMatches ��
" BufferSizeRequired ���b s8 _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT .?AU_LOOKUP_STREAM_FROM_CLUSTER_OUTPUT@@ �� t8 � � B � _NTFS_STATISTICS_EX .?AU_NTFS_STATISTICS_EX@@ J
" Write
" Create ���
" SetInfo ��
" Flush : w8 <anonymous-tag> .?AU<anonymous-tag>@@ x8 � � J
" Write
" Create ���
" SetInfo ��
" Flush : z8 <anonymous-tag> .?AU<anonymous-tag>@@ {8 � J
" Write
" Create ���
" SetInfo ��
" Flush : }8 <anonymous-tag> .?AU<anonymous-tag>@@ ~8 � J
" Write
" Create ���
" SetInfo ��
" Flush : �8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � , �
" Calls
" RunsReturned �
" Hints
" HintsHonored �
" Cache
" CacheMiss
# Clusters �
# HintsClusters
# ( CacheClusters
# 0 CacheMissClusters :
�8 8 <anonymous-tag> .?AU<anonymous-tag>@@ �8 � A R
" LogFileFullExceptions
" OtherExceptions ��
# MftReads �
# MftReadBytes �
# MftWrites
# MftWriteBytes
x8 ( MftWritesUserLevel ���
" 8 MftWritesFlushForLogFileFull �
" < MftWritesLazyWriter ��
" @ MftWritesUserRequest �
# H Mft2Writes ���
# P Mft2WriteBytes ���
{8 X Mft2WritesUserLevel ��
" h Mft2WritesFlushForLogFileFull
" l Mft2WritesLazyWriter �
" p Mft2WritesUserRequest
# x RootIndexReads ���
# � RootIndexReadBytes ���
# � RootIndexWrites ��
# � RootIndexWriteBytes ��
# � BitmapReads ��
# � BitmapReadBytes ��
# � BitmapWrites �
# � BitmapWriteBytes �
" � BitmapWritesFlushForLogFileFull ��
" � BitmapWritesLazyWriter ���
" � BitmapWritesUserRequest ��
~8 � BitmapWritesUserLevel
# � MftBitmapReads ���
# � MftBitmapReadBytes ���
# � MftBitmapWrites ��
# � MftBitmapWriteBytes ��
" � MftBitmapWritesFlushForLogFileFull ���
" � MftBitmapWritesLazyWriter
" MftBitmapWritesUserRequest ���
�8 MftBitmapWritesUserLevel �
# UserIndexReads ���
# UserIndexReadBytes ���
# (UserIndexWrites ��
# 0UserIndexWriteBytes ��
# 8LogFileReads �
# @LogFileReadBytes �
# HLogFileWrites
# PLogFileWriteBytes
�8 XAllocate �
" �DiskResourcesExhausted ���
# �VolumeTrimCount ��
# �VolumeTrimTime ���
# �VolumeTrimByteCount ��
# �FileLevelTrimCount ���
# �FileLevelTrimTime
# �FileLevelTrimByteCount ���
# �VolumeTrimSkippedCount ���
# �VolumeTrimSkippedByteCount ���
# �NtfsFillStatInfoFromMftRecordCalledCount �
# �NtfsFillStatInfoFromMftRecordBailedBecauseOfAttributeListCount ���
# �NtfsFillStatInfoFromMftRecordBailedBecauseOfNonResReparsePointCount ��B 9 �8 �_NTFS_STATISTICS_EX .?AU_NTFS_STATISTICS_EX@@ �8 � � n � _EVENT_TRACE_SESSION_SECURITY_INFORMATION .?AU_EVENT_TRACE_SESSION_SECURITY_INFORMATION@@ �
? EventTraceInformationClass ���
" SecurityInformation ��
# TraceHandle ��
� SecurityDescriptor ���n �8 _EVENT_TRACE_SESSION_SECURITY_INFORMATION .?AU_EVENT_TRACE_SESSION_SECURITY_INFORMATION@@ �8 @ � " �8 > � tagEMRSTRETCHBLT .?AUtagEMRSTRETCHBLT@@ ��R
� emr ��
c rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
I 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d cxSrc
h cySrc > �8 l tagEMRSTRETCHBLT .?AUtagEMRSTRETCHBLT@@ �� �8 � �
:
� f _ARM_CPS_ENABLE_INTERRUPTS ��� _ARM_CPS_DISABLE_INTERRUPTS �� _ARM_CPS_CHANGE_MODE �> t �8 _tag_ARMINTR_CPS_OP .?AW4_tag_ARMINTR_CPS_OP@@ � �8 j � J � _HARDWARE_COUNTER_DATA .?AU_HARDWARE_COUNTER_DATA@@ ��
�8
� 6
� Type �
" Reserved �
# Value J �8 _HARDWARE_COUNTER_DATA .?AU_HARDWARE_COUNTER_DATA@@ �� �8 � + F � _LDR_DATA_TABLE_ENTRY .?AU_LDR_DATA_TABLE_ENTRY@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�!
� B � _LDRP_LOAD_CONTEXT .?AU_LDRP_LOAD_CONTEXT@@ ��
�8
� "
! InLoadOrderLinks �
! InMemoryOrderLinks ���
! InInitializationOrderLinks ���
DllBase ��
EntryPoint ���
" SizeOfImage ��
$ FullDllName ��
, BaseDllName ��
g 4 FlagGroup
" 4 Flags
�8 4 PackagedBinary ���
�8 4 MarkedForRemoval �
�8 4 ImageDll �
�8 4 LoadNotificationsSent
�8 4 TelemetryEntryProcessed ��
�8 4 ProcessStaticImport ��
�8 4 InLegacyLists
�8 4 InIndexes
�8 4 ShimDll ��
�8 4 InExceptionTable �
�8 4 ReservedFlags1 ���
�8 4 LoadInProgress ���
�8 4 LoadConfigProcessed ��
�8 4 EntryProcessed ���
�8 4 ProtectDelayLoad �
�8 4 ReservedFlags3 ���
�8 4 DontCallForThreads ���
�8 4 ProcessAttachCalled ��
�8 4 ProcessAttachFailed ��
�8 4 CorDeferredValidate ��
�8 4 CorImage �
�8 4 DontRelocate �
�8 4 CorILOnly
�8 4 ChpeImage
�8 4 ReservedFlags5 ���
�8 4 Redirected ���
�8 4 ReservedFlags6 ���
�8 4 CompatDatabaseProcessed ��
! 8 ObsoleteLoadCount
! : TlsIndex �
! < HashLinks
" D TimeDateStamp
� H EntryPointActivationContext ��
L Lock �
�8 P DdagNode �
! T NodeModuleLink ���
�8 \ LoadContext ��
` ParentDllBase
d SwitchBackContext
� h BaseAddressIndexNode �
� t MappingInfoIndexNode �
" � OriginalBase �
� � LoadTime �
" � BaseNameHashValue
�' � LoadReason ���
" � ImplicitPathOptions ��
" � ReferenceCount ���
" � DependentLoadFlags ���
� SigningLevel �F ; �8 � _LDR_DATA_TABLE_ENTRY .?AU_LDR_DATA_TABLE_ENTRY@@ �8 � �
@ x
@ y 2
�8 _POINTFLOAT .?AU_POINTFLOAT@@ �8 � P
�)
� *
" Remove ���
Details ��z �8 _SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY .?AU_SYSTEM_FEATURE_USAGE_SUBSCRIPTION_UPDATE_ENTRY@@ �8 � � R � _SYSTEM_PROCESS_INFORMATION .?AU_SYSTEM_PROCESS_INFORMATION@@ �
" NextEntryOffset ��
" NumberOfThreads ��
� WorkingSetPrivateSize
" HardFaultCount ���
" NumberOfThreadsHighWatermark �
# CycleTime
� CreateTime ���
� ( UserTime �
� 0 KernelTime ���
8 ImageName
@ BasePriority �
D UniqueProcessId ��
H InheritedFromUniqueProcessId �
" L HandleCount ��
" P SessionId
" T UniqueProcessKey �
" X PeakVirtualSize ��
" \ VirtualSize ��
" ` PageFaultCount ���
" d PeakWorkingSetSize ���
" h WorkingSetSize ���
" l QuotaPeakPagedPoolUsage ��
" p QuotaPagedPoolUsage ��
" t QuotaPeakNonPagedPoolUsage ���
" x QuotaNonPagedPoolUsage ���
" | PagefileUsage
" � PeakPagefileUsage
" � PrivatePageCount �
� � ReadOperationCount ���
� � WriteOperationCount ��
� � OtherOperationCount ��
� � ReadTransferCount
� � WriteTransferCount ���
� � OtherTransferCount ���R " �8 � _SYSTEM_PROCESS_INFORMATION .?AU_SYSTEM_PROCESS_INFORMATION@@ �8 � �
�4
� J � _ETW_HEAP_EVENT_RUNDOWN .?AU_ETW_HEAP_EVENT_RUNDOWN@@
�8
� � " �
m Header ���
HeapHandle ���
" $ Flags
" ( ProcessId
" , RangeCount ���
" 0 Reserved �
�8 4 Ranges ���J �8 < _ETW_HEAP_EVENT_RUNDOWN .?AU_ETW_HEAP_EVENT_RUNDOWN@@ �8 b � j � _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT@@
�8
�
p ��
p ��
p ��
p ��
��
��
��
��f
Lock �
" ThreadId �
p NewCpuPriorityFloor ��
p OldCpuPriority ���
�8
NewIoPriorityFloor ���
�8
OldIoPriority
�8
NewIoQoSPriorityFloor
�8
OldIoQoSPriority �
p
IoPriorities �
�8 ExecutingDpc �
�8 WakeupBoost ��
�8 BoostedOutstandingIrps ���
�8 Reserved �
Flags j �8 _ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_SET_PRIORITY_FLOOR_EVENT@@ �8 b � >
" dwSizeHid
" dwCount ��
� bRawData �. �8 tagRAWHID .?AUtagRAWHID@@ �8 ~ �: 6 � _WMI_PUSHLOCK .?AU_WMI_PUSHLOCK@@ >
PushLock �
" ThreadId �
Action ���6 �8 _WMI_PUSHLOCK .?AU_WMI_PUSHLOCK@@ �8 b �
�7
� �' " �
�8
� *
� Luid �
" Attributes ���F �8 _LUID_AND_ATTRIBUTES .?AU_LUID_AND_ATTRIBUTES@@ �� �8 w � 2
� Configuration
! PortAddress ��N �8 _EISA_PORT_CONFIGURATION .?AU_EISA_PORT_CONFIGURATION@@ �� �8 V � _SYSTEM_BOOT_LOGO_INFORMATION .?AU_SYSTEM_BOOT_LOGO_INFORMATION@@ *
" Flags
" BitmapOffset �V �8 _SYSTEM_BOOT_LOGO_INFORMATION .?AU_SYSTEM_BOOT_LOGO_INFORMATION@@ �8 � u R � _PAGE_PRIORITY_INFORMATION .?AU_PAGE_PRIORITY_INFORMATION@@ ��
" PagePriority �R �8 _PAGE_PRIORITY_INFORMATION .?AU_PAGE_PRIORITY_INFORMATION@@ �� �8 D � : � tagCOMBOBOXINFO .?AUtagCOMBOBOXINFO@@
�8
� �
" cbSize ���
rcItem ���
rcButton �
" $ stateButton ��
� ( hwndCombo
� , hwndItem �
� 0 hwndList �: �8 4 tagCOMBOBOXINFO .?AUtagCOMBOBOXINFO@@ �8 ~ M9 �$ �$ f � _EVENT_TRACE_PROFILE_ADD_INFORMATION .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION@@ ��
? EventTraceInformationClass ���
Version ��
�& V2 ���
� CpuInfoHierarchy �
" InitialInterval ��
Persist ��
" ProfileSourceDescription �f �8 $ _EVENT_TRACE_PROFILE_ADD_INFORMATION .?AU_EVENT_TRACE_PROFILE_ADD_INFORMATION@@ �� �8 @ � R � _ETW_HEAP_EVENT_CONTRACTION .?AU_ETW_HEAP_EVENT_CONTRACTION@@ �
m Header ���
HeapHandle ���
" $ DeCommitSize �
( DeCommitAddress ��
" , FreeSpace
" 0 CommittedSpace ���
" 4 ReservedSpace
" 8 NoOfUCRs �
" < AllocatedSpace ���R 9 @ _ETW_HEAP_EVENT_CONTRACTION .?AU_ETW_HEAP_EVENT_CONTRACTION@@ 9 b �
q
�
�
�
*
� . � _NEON128 .?AU_NEON128@@ �� 9 " � " " � ��
" ContextFlags �
" R0 ���
" R1 ���
" R2 ���
" R3 ���
" R4 ���
" R5 ���
" R6 ���
" R7 ���
" $ R8 ���
" ( R9 ���
" , R10 ��
" 0 R11 ��
" 4 R12 ��
" 8 Sp ���
" < Lr ���
" @ Pc ���
" D Cpsr �
" H Fpscr
" L Padding ��
9 P Q
�5 P D
9 P S
_ PBvr ��
_ pBcr ��
� �Wvr ��
� �Wcr ��
7 �Padding2 �.
9 �_CONTEXT .?AU_CONTEXT@@ �� 9 �& g 2 � tagACTCTXW .?AUtagACTCTXW@@ ���
" cbSize ���
" dwFlags ��
lpSource �
! wProcessorArchitecture ���
! wLangId ��
lpAssemblyDirectory ��
lpResourceName ���
lpApplicationName
� hModule ��2 9 tagACTCTXW .?AUtagACTCTXW@@ �� 9 n Q .
o MD5Hash ��
ModuleName ���2 9 <anonymous-tag> .?AT<anonymous-tag>@@ 9 � � 2
05 RequestType ��
9 SearchInfo ���N 9 _COVERAGE_MODULE_REQUEST .?AU_COVERAGE_MODULE_REQUEST@@ �� 9 � � J � _RPC_SECURITY_QOS_V5_W .?AU_RPC_SECURITY_QOS_V5_W@@ ��
s HttpCredentials ��2 9 <anonymous-tag> .?AT<anonymous-tag>@@ 9 ^ n �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
9 u
Sid ��
u EffectiveOnly
ServerSecurityDescriptor �J 9 $ _RPC_SECURITY_QOS_V5_W .?AU_RPC_SECURITY_QOS_V5_W@@ �� 9 ^ g R � _FILE_MAILSLOT_PEEK_BUFFER .?AU_FILE_MAILSLOT_PEEK_BUFFER@@ ��R
" ReadDataAvailable
" NumberOfMessages �
" MessageLength R 9 _FILE_MAILSLOT_PEEK_BUFFER .?AU_FILE_MAILSLOT_PEEK_BUFFER@@ �� 9 7! 1 Z � _PROCESS_MEMORY_EXHAUSTION_INFO .?AU_PROCESS_MEMORY_EXHAUSTION_INFO@@ J
! Version ��
! Reserved �
�' Type �
" Value Z #9 _PROCESS_MEMORY_EXHAUSTION_INFO .?AU_PROCESS_MEMORY_EXHAUSTION_INFO@@ $9 � � Z � _ETW_TP_EVENT_TIMER_EXPIRATION .?AU_ETW_TP_EVENT_TIMER_EXPIRATION@@ ��
&9
� z
m Header ���
DueTime ��
( SubQueue �
, Timer
" 0 Period ���
" 4 WindowLength �Z (9 8 _ETW_TP_EVENT_TIMER_EXPIRATION .?AU_ETW_TP_EVENT_TIMER_EXPIRATION@@ �� )9 b D F � _IPT_TRACE_EVENT_DATA .?AU_IPT_TRACE_EVENT_DATA@@ �
# TimeStamp
" ProcessId
" ThreadId �
# IptOption
" IptTraceSize �
" IptTraceStopOffset ���
� IptTrace �F ,9 ( _IPT_TRACE_EVENT_DATA .?AU_IPT_TRACE_EVENT_DATA@@ -9 b B � _ETW_OPTICALIO_INIT .?AU_ETW_OPTICALIO_INIT@@ .
Irp ��
" IssuingThreadId ��B 09 _ETW_OPTICALIO_INIT .?AU_ETW_OPTICALIO_INIT@@ 19 b �
!
� f � _JOBOBJECT_SECURITY_LIMIT_INFORMATION .?AU_JOBOBJECT_SECURITY_LIMIT_INFORMATION@@
a
� �
" SecurityLimitFlags ���
JobToken �
59 SidsToDisable
�$ PrivilegesToDelete ���
59 RestrictedSids ���f 69 _JOBOBJECT_SECURITY_LIMIT_INFORMATION .?AU_JOBOBJECT_SECURITY_LIMIT_INFORMATION@@ 79 D �
�
� N � _PROCESS_JOB_MEMORY_INFO .?AU_PROCESS_JOB_MEMORY_INFO@@ ��
:9
� �
# SharedCommitUsage
# PrivateCommitUsage ���
# PeakPrivateCommitUsage ���
# PrivateCommitLimit ���
# TotalCommitLimit �N <9 ( _PROCESS_JOB_MEMORY_INFO .?AU_PROCESS_JOB_MEMORY_INFO@@ �� =9 D � " \% 6 � _devicemodeW .?AU_devicemodeW@@ ��
@9
� �
dmDeviceName �
! @ dmSpecVersion
! B dmDriverVersion ��
! D dmSize ���
! F dmDriverExtra
" H dmFields �
L dmOrientation
N dmPaperSize ��
P dmPaperLength
R dmPaperWidth �
T dmScale ��
V dmCopies �
X dmDefaultSource ��
Z dmPrintQuality ���
� L dmPosition ���
" T dmDisplayOrientation �
" X dmDisplayFixedOutput �
\ dmColor ��
^ dmDuplex �
` dmYResolution
b dmTTOption ���
d dmCollate
f dmFormName ���
! � dmLogPixels ��
" � dmBitsPerPel �
" � dmPelsWidth ��
" � dmPelsHeight �
" � dmDisplayFlags ���
" � dmNup
" � dmDisplayFrequency ���
" � dmICMMethod ��
" � dmICMIntent ��
" � dmMediaType ��
" � dmDitherType �
" � dmReserved1 ��
" � dmReserved2 ��
" � dmPanningWidth ���
" � dmPanningHeight ��6 & B9 � _devicemodeW .?AU_devicemodeW@@ �� C9 � �
t unused ���* E9 HICON__ .?AUHICON__@@ F9 s X . � _WMI_TXR .?AU_WMI_TXR@@ ��
H9
� f
InitialTime ��
$ TxRGUID ��
" Status ���
" UowCount �
Hive �. J9 ( _WMI_TXR .?AU_WMI_TXR@@ �� K9 b � V � _ENUM_SERVICE_STATUS_PROCESSW .?AU_ENUM_SERVICE_STATUS_PROCESSW@@ R
q lpServiceName
q lpDisplayName
� ServiceStatusProcess �V N9 , _ENUM_SERVICE_STATUS_PROCESSW .?AU_ENUM_SERVICE_STATUS_PROCESSW@@ O9 � Z � _PROCESS_EXTENDED_ENERGY_VALUES .?AU_PROCESS_EXTENDED_ENERGY_VALUES@@ ^ � _PROCESS_ENERGY_VALUES_EXTENSION .?AU_PROCESS_ENERGY_VALUES_EXTENSION@@ ��&
o( Base �
R9 Extension Z S9 �_PROCESS_EXTENDED_ENERGY_VALUES .?AU_PROCESS_EXTENDED_ENERGY_VALUES@@ T9 � i
�
�
x
�
" ��
" �� N% " � " " �V
# EnabledFeatures ��
# EnabledVolatileFeatures ��
" Size �
" ControlFlags �
X9 OptimizedSave
Y9 CompactionEnabled
Z9 Features �
# EnabledSupervisorFeatures
# AlignedFeatures ��
" (AllFeatureSize ���
[9 ,AllFeatures ��
# 0EnabledUserVisibleSupervisorFeatures �F \9 8_XSTATE_CONFIGURATION .?AU_XSTATE_CONFIGURATION@@ ]9 � d
&
�
�$
� J � _RTL_DEBUG_INFORMATION .?AU_RTL_DEBUG_INFORMATION@@ ��F � _RTL_PROCESS_MODULES .?AU_RTL_PROCESS_MODULES@@ ��
b9
�
�,
� J � _RTL_PROCESS_BACKTRACES .?AU_RTL_PROCESS_BACKTRACES@@
e9
�
�'
�
5
� V � _RTL_PROCESS_VERIFIER_OPTIONS .?AU_RTL_PROCESS_VERIFIER_OPTIONS@@
i9
� " �b
SectionHandleClient ��
ViewBaseClient ���
ViewBaseTarget ���
" ViewBaseDelta
EventPairClient ��
EventPairTarget ��
TargetProcessId ��
TargetThreadHandle ���
" Flags
" $ OffsetFree ���
" ( CommitSize ���
" , ViewSize �
c9 0 Modules ��
d9 0 ModulesEx
f9 4 BackTraces ���
g9 8 Heaps
h9 < Locks
@ SpecificHeap �
D TargetProcessHandle ��
j9 H VerifierOptions ��
L ProcessHeap ��
P CriticalSectionHandle
T CriticalSectionOwnerThread ���
k9 X Reserved �J l9 h _RTL_DEBUG_INFORMATION .?AU_RTL_DEBUG_INFORMATION@@ �� m9 � � J � _RTL_HEAP_STACK_CONTROL .?AU_RTL_HEAP_STACK_CONTROL@@ :
! Version ��
! Flags
Process ��J p9 _RTL_HEAP_STACK_CONTROL .?AU_RTL_HEAP_STACK_CONTROL@@ q9 � � N � _FILE_CASE_SENSITIVE_INFO .?AU_FILE_CASE_SENSITIVE_INFO@@
s9
�
" Flags N u9 _FILE_CASE_SENSITIVE_INFO .?AU_FILE_CASE_SENSITIVE_INFO@@ v9 n �" � KTMOBJECT_TRANSACTION KTMOBJECT_TRANSACTION_MANAGER KTMOBJECT_RESOURCE_MANAGER ��� KTMOBJECT_ENLISTMENT � KTMOBJECT_INVALID 6 t x9 _KTMOBJECT_TYPE .?AW4_KTMOBJECT_TYPE@@ � y9 � w J � _CM_FLOPPY_DEVICE_DATA .?AU_CM_FLOPPY_DEVICE_DATA@@ ��
{9
� �
! Version ��
! Revision �
�6 Size �
" MaxDensity ���
" MountDensity �
StepRateHeadUnloadTime ���
HeadLoadTime �
MotorOffTime �
SectorLengthCode �
SectorPerTrack ���
ReadWriteGapLength ���
DataTransferLength ���
FormatGapLength ��
FormatFillCharacter ��
HeadSettleTime ���
MotorSettleTime ��
MaximumTrackValue
DataTransferRate �J }9 $ _CM_FLOPPY_DEVICE_DATA .?AU_CM_FLOPPY_DEVICE_DATA@@ �� ~9
b+
� R � _PERFINFO_SYSCALL_EXIT_DATA .?AU_PERFINFO_SYSCALL_EXIT_DATA@@
�9
�
ReturnValue ��R �9 _PERFINFO_SYSCALL_EXIT_DATA .?AU_PERFINFO_SYSCALL_EXIT_DATA@@ �9 b * F � _LPC_CLIENT_DIED_MSG .?AU_LPC_CLIENT_DIED_MSG@@ ��
�9
� .
\ PortMsg ��
� CreateTime ���F �9 _LPC_CLIENT_DIED_MSG .?AU_LPC_CLIENT_DIED_MSG@@ �� �9 � � F � _ENCRYPTED_DATA_INFO .?AU_ENCRYPTED_DATA_INFO@@ ��B
# StartingFileOffset ���
" OutputBufferOffset ���
" BytesWithinFileSize ��
" BytesWithinValidDataLength ���
! CompressionFormat
DataUnitShift
ChunkShift ���
ClusterShift �
EncryptionFormat �
! NumberOfDataBlocks ���
� DataBlockSize F �9 _ENCRYPTED_DATA_INFO .?AU_ENCRYPTED_DATA_INFO@@ �� �9 � @ F � _IMAGE_HOT_PATCH_BASE .?AU_IMAGE_HOT_PATCH_BASE@@
�9
� �
" SequenceNumber ���
" Flags
" OriginalTimeDateStamp
" OriginalCheckSum �
" CodeIntegrityInfo
" CodeIntegritySize
" PatchTable ���
" BufferOffset �F �9 _IMAGE_HOT_PATCH_BASE .?AU_IMAGE_HOT_PATCH_BASE@@ �9 � �
�5
�
�%
� &
# Version ��
Name �f �9 _TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE .?AU_TOKEN_SECURITY_ATTRIBUTE_FQBN_VALUE@@ �� �9 � R � _ENABLE_TRACE_PARAMETERS_V1 .?AU_ENABLE_TRACE_PARAMETERS_V1@@
�9
� z
" Version ��
" EnableProperty ���
" ControlFlags �
$ SourceId �
� EnableFilterDesc �R �9 _ENABLE_TRACE_PARAMETERS_V1 .?AU_ENABLE_TRACE_PARAMETERS_V1@@ �9 � J � _NDR_USER_MARSHAL_INFO .?AU_NDR_USER_MARSHAL_INFO@@ ��V � _NDR_USER_MARSHAL_INFO_LEVEL1 .?AU_NDR_USER_MARSHAL_INFO_LEVEL1@@ 2
" InformationLevel �
�9 Level1 ���J �9 , _NDR_USER_MARSHAL_INFO .?AU_NDR_USER_MARSHAL_INFO@@ �� �9 �
Q*
� *
�# ntmTm
�. L ntmFontSig ���B �9 d tagNEWTEXTMETRICEXW .?AUtagNEWTEXTMETRICEXW@@ �9 � %
�
� �
bmType ���
bmWidth ��
bmHeight �
bmWidthBytes �
! bmPlanes �
! bmBitsPixel ��
bmBits ���. �9 tagBITMAP .?AUtagBITMAP@@ �9 � Y
3
� 6 � _VIDEO_RECORD .?AU_VIDEO_RECORD@@
�9
� �
" MemorySize ���
" XResolution ��
" YResolution ��
" BitsPerPixel �
" VRefresh �
� ChipType �
� DACType ��
� AdapterString
� BiosString ���
� DeviceId �
"
StateFlags ���6 �9
_VIDEO_RECORD .?AU_VIDEO_RECORD@@ �9 b \ n DDC_DEFAULT �� DDC_DISABLE_ALL �� DDC_DISABLE_RESIZE ��� DDC_DISABLE_CONTROL_RELAYOUT �N t �9 DIALOG_DPI_CHANGE_BEHAVIORS .?AW4DIALOG_DPI_CHANGE_BEHAVIORS@@ � �9 ~ � ^ � DISPLAYCONFIG_SOURCE_DEVICE_NAME .?AUDISPLAYCONFIG_SOURCE_DEVICE_NAME@@ ��2
� header ���
viewGdiDeviceName ^ �9 T DISPLAYCONFIG_SOURCE_DEVICE_NAME .?AUDISPLAYCONFIG_SOURCE_DEVICE_NAME@@ �� �9 � � V � _SYSTEM_TIMEOFDAY_INFORMATION .?AU_SYSTEM_TIMEOFDAY_INFORMATION@@ �
� BootTime �
� CurrentTime ��
� TimeZoneBias �
" TimeZoneId ���
" Reserved �
# BootTimeBias �
# ( SleepTimeBias V �9 0 _SYSTEM_TIMEOFDAY_INFORMATION .?AU_SYSTEM_TIMEOFDAY_INFORMATION@@ �9 � � B � tagTRACKMOUSEEVENT .?AUtagTRACKMOUSEEVENT@@ ��
�9
� V
" cbSize ���
" dwFlags ��
� hwndTrack
" dwHoverTime ��B �9 tagTRACKMOUSEEVENT .?AUtagTRACKMOUSEEVENT@@ �� �9 ~ �
�3
�
�7
� J � _ETW_WNF_EVENT_CALLBACK .?AU_ETW_WNF_EVENT_CALLBACK@@ �
m Header ���
� StateName
( Subscription �
, NameSub ��
0 Callback �
" 4 ChangeStamp ��
" 8 DeliveryFlags
" < Return ���J �9 @ _ETW_WNF_EVENT_CALLBACK .?AU_ETW_WNF_EVENT_CALLBACK@@ �9 b n
�4
�
�3
� V � _ETW_DISKIO_FLUSH_BUFFERS_V3 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V3@@ ��~
" DiskNumber ���
" IrpFlags �
# HighResResponseTime ��
IrpAddr ��
" IssuingThreadId ��V �9 _ETW_DISKIO_FLUSH_BUFFERS_V3 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V3@@ �� �9 b � B � tagVS_FIXEDFILEINFO .?AUtagVS_FIXEDFILEINFO@@ V
" dwSignature ��
" dwStrucVersion ���
" dwFileVersionMS ��
" dwFileVersionLS ��
" dwProductVersionMS ���
" dwProductVersionLS ���
" dwFileFlagsMask ��
" dwFileFlags ��
" dwFileOS �
" $ dwFileType ���
" ( dwFileSubtype
" , dwFileDateMS �
" 0 dwFileDateLS �B
�9 4 tagVS_FIXEDFILEINFO .?AUtagVS_FIXEDFILEINFO@@ 2 onecore\external\sdk\inc\minwin\verrsrc.h �� �9 �9 � J � _FILE_NAME_INFORMATION .?AU_FILE_NAME_INFORMATION@@ ��2
" FileNameLength ���
FileName �J �9 _FILE_NAME_INFORMATION .?AU_FILE_NAME_INFORMATION@@ �� �9 �
^+
� r � _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION .?AU_MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION@@
�9
�
" ��
" ��>
�9 CommitEvents �
�9 Spare
" AllFlags �2 �9 <anonymous-tag> .?AT<anonymous-tag>@@ �9 w � �
�9 Flags
" HandleAttributes �
" DesiredAccess
LowCommitCondition ���
HighCommitCondition ��
MaximumCommitCondition ���r �9 _MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION .?AU_MEMORY_PARTITION_MEMORY_EVENTS_INFORMATION@@ �9 w �
�*
� { q ! �9
" ��
�9
� F � _TRACE_LOGFILE_HEADER .?AU_TRACE_LOGFILE_HEADER@@ f
MajorVersion �
MinorVersion �
SubVersion ���
SubMinorVersion ��: �9 <anonymous-tag> .?AU<anonymous-tag>@@ �9 � � .
" BufferSize ���
" Version ��
�9 VersionDetail
" ProviderVersion ��
" NumberOfProcessors ���
� EndTime ��
" TimerResolution ��
" MaximumFileSize ��
" LogFileMode ��
" $ BuffersWritten ���
$ ( LogInstanceGuid ��
" ( StartBuffers �
" , PointerSize ��
" 0 EventsLost ���
" 4 CpuSpeedInMHz
q 8 LoggerName ���
q < LogFileName ��
� @ TimeZone �
� � BootTime �
� � PerfFreq �
� StartTime
" ReservedFlags
" BuffersLost ��F �9 _TRACE_LOGFILE_HEADER .?AU_TRACE_LOGFILE_HEADER@@ �9 � �
�-
�
�
� " �9 �9
�9
� �
StateType
" StateFlags ���
" HardwareLatency ��
" Power
" Context ��
�9 Handler ��F �9 _PROCESSOR_IDLE_STATE .?AU_PROCESSOR_IDLE_STATE@@ �9 { x
6$
� J � DISPLAYCONFIG_PATH_INFO .?AUDISPLAYCONFIG_PATH_INFO@@ B
6 sourceInfo ���
3 targetInfo ���
u D flags J �9 H DISPLAYCONFIG_PATH_INFO .?AUDISPLAYCONFIG_PATH_INFO@@ �9 � � ~ � _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION .?AU_SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION@@ ��>
" PlatformManifestSize �
� PlatformManifest �~ �9 _SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION .?AU_SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION@@ �� �9 � � $
�9
� F � _PERFINFO_FILE_CREATE .?AU_PERFINFO_FILE_CREATE@@ �
" Irp ��
" FileObject ���
" IssuingThreadId ��
" Options ��
" Attributes ���
" ShareAccess ��
OpenPath �F : _PERFINFO_FILE_CREATE .?AU_PERFINFO_FILE_CREATE@@ : b V J � _WMI_IDE_CHANNEL_RECORD .?AU_WMI_IDE_CHANNEL_RECORD@@ �
" TargetId �
" DeviceType ���
" DeviceTimingMode �
" LocationInformationLen ���
LocationInformation ��J : _WMI_IDE_CHANNEL_RECORD .?AU_WMI_IDE_CHANNEL_RECORD@@ : b � J � RPC_CLIENT_INFORMATION1 .?AURPC_CLIENT_INFORMATION1@@
:
� V
UserName �
ComputerName �
! Privilege
" AuthFlags J
: RPC_CLIENT_INFORMATION1 .?AURPC_CLIENT_INFORMATION1@@ : ^ D
V MemoryExhaustionTypeFailFastOnCommitFailure �� MemoryExhaustionTypeMax ��F t
: _MEMORY_EXHAUSTION_TYPE .?AW4_MEMORY_EXHAUSTION_TYPE@@ � : D �
z
�
�5
� � �
:
�
! ListEntry
� FunctionTable
� TimeStamp
" MinimumAddress ���
" MaximumAddress ���
" BaseAddress ��
: $ Callback �
( Context ��
q , OutOfProcessCallbackDll ��
� 0 Type �
" 4 EntryCount ���
� 8 TreeNode �J : H _DYNAMIC_FUNCTION_TABLE .?AU_DYNAMIC_FUNCTION_TABLE@@ : K F � _IMAGE_ENCLAVE_IMPORT .?AU_IMAGE_ENCLAVE_IMPORT@@ �
" MatchType
" MinimumSecurityVersion ���
� UniqueOrAuthorID �
o ( FamilyID �
o 8 ImageID ��
" H ImportName ���
" L Reserved �F : P _IMAGE_ENCLAVE_IMPORT .?AU_IMAGE_ENCLAVE_IMPORT@@ : � �
5
�
b4
�
30
�
��
��
��
��
��
��
��
: ReadWrite
: Cached ���
: Reserved0
!: Type �
": Shared ���
#: Reserved1
$: MoreEntries ��> %: _EISA_MEMORY_TYPE .?AU_EISA_MEMORY_TYPE@@ &: � 2 � _MOF_FIELD .?AU_MOF_FIELD@@ ��
(:
� >
# DataPtr ��
" Length ���
" DataType �2 *: _MOF_FIELD .?AU_MOF_FIELD@@ �� +: � � ~ � _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION@@ �
" ulFlags ��
" ulEncodedAssemblyIdentityLength ��
" ulManifestPathType ���
" ulManifestPathLength �
� liManifestLastWriteTime ��
" ulPolicyPathType �
" ulPolicyPathLength ���
� liPolicyLastWriteTime
" ( ulMetadataSatelliteRosterIndex ���
" , ulManifestVersionMajor ���
" 0 ulManifestVersionMinor ���
" 4 ulPolicyVersionMajor �
" 8 ulPolicyVersionMinor �
" < ulAssemblyDirectoryNameLength
� @ lpAssemblyEncodedAssemblyIdentity
� D lpAssemblyManifestPath ���
� H lpAssemblyPolicyPath �
� L lpAssemblyDirectoryName ��
" P ulFileCount ��~ .: X _ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION .?AU_ACTIVATION_CONTEXT_ASSEMBLY_DETAILED_INFORMATION@@ /: � �
%$
� �-
2:
� Z � _PERFINFO_PPM_IDLE_STATE_CHANGE .?AU_PERFINFO_PPM_IDLE_STATE_CHANGE@@ B
" NewState �
" OldState �
# Processors ���Z 5: _PERFINFO_PPM_IDLE_STATE_CHANGE .?AU_PERFINFO_PPM_IDLE_STATE_CHANGE@@ 6: b � b � _SYSTEM_VSM_PROTECTION_INFORMATION .?AU_SYSTEM_VSM_PROTECTION_INFORMATION@@ ��
DmaProtectionsAvailable ��
DmaProtectionsInUse ��
HardwareMbecAvailable
ApicVirtualizationAvailable ��b 9: _SYSTEM_VSM_PROTECTION_INFORMATION .?AU_SYSTEM_VSM_PROTECTION_INFORMATION@@ �� :: � G B � _TRACE_VERSION_INFO .?AU_TRACE_VERSION_INFO@@ :
u EtwTraceProcessingVersion
u Reserved �B =: _TRACE_VERSION_INFO .?AU_TRACE_VERSION_INFO@@ >: � � 2 � _MULTI_TIME .?AU_MULTI_TIME@@ >
� Qpc ��
� HostQpc ��
SystemTime ���2 A: _MULTI_TIME .?AU_MULTI_TIME@@ B: � > � tagCANDIDATELIST .?AUtagCANDIDATELIST@@ ��
D:
� �
" dwSize ���
" dwStyle ��
" dwCount ��
" dwSelection ��
" dwPageStart ��
" dwPageSize ���
z dwOffset �> F: tagCANDIDATELIST .?AUtagCANDIDATELIST@@ �� G: � K " q q " t I:
J:
�
r-
� R � _SYSTEM_POOLTAG_INFORMATION .?AU_SYSTEM_POOLTAG_INFORMATION@@ &
" Count
I6 TagInfo ��R N: _SYSTEM_POOLTAG_INFORMATION .?AU_SYSTEM_POOLTAG_INFORMATION@@ O: � �
�
�
R-
� > � RPC_IF_ID_VECTOR .?AURPC_IF_ID_VECTOR@@ ��2 � _RPC_IF_ID .?AU_RPC_IF_ID@@ ��
T:
� U: " �"
" Count
V: IfId �> W: RPC_IF_ID_VECTOR .?AURPC_IF_ID_VECTOR@@ �� X: ^ F � tagCHANGEFILTERSTRUCT .?AUtagCHANGEFILTERSTRUCT@@
Z:
� *
" cbSize ���
" ExtStatus F \: tagCHANGEFILTERSTRUCT .?AUtagCHANGEFILTERSTRUCT@@ ]: ~ [< J � _CM_SERIAL_DEVICE_DATA .?AU_CM_SERIAL_DEVICE_DATA@@ ��
_:
� >
! Version ��
! Revision �
" BaudClock J a: _CM_SERIAL_DEVICE_DATA .?AU_CM_SERIAL_DEVICE_DATA@@ �� b: � R � _FSCTL_OFFLOAD_READ_OUTPUT .?AU_FSCTL_OFFLOAD_READ_OUTPUT@@ ��N
" Size �
" Flags
# TransferLength ���
� Token R e: _FSCTL_OFFLOAD_READ_OUTPUT .?AU_FSCTL_OFFLOAD_READ_OUTPUT@@ �� f: � � R � _CONSOLE_SCREEN_BUFFER_INFO .?AU_CONSOLE_SCREEN_BUFFER_INFO@@ 2 � _SMALL_RECT .?AU_SMALL_RECT@@ ~
�" dwSize ���
�" dwCursorPosition �
! wAttributes ��
i:
srWindow �
�" dwMaximumWindowSize ��R j: _CONSOLE_SCREEN_BUFFER_INFO .?AU_CONSOLE_SCREEN_BUFFER_INFO@@ 6 onecore\external\sdk\inc\mincore\consoleapi2.h � k: l: � 2 � _SYSDBG_MSR .?AU_SYSDBG_MSR@@ "
" Msr ��
# Data �2 o: _SYSDBG_MSR .?AU_SYSDBG_MSR@@ p: � J � _FILE_PIPE_EVENT_BUFFER .?AU_FILE_PIPE_EVENT_BUFFER@@ v
" NamedPipeState ���
" EntryType
" ByteCount
" KeyValue �
" NumberRequests ���J s: _FILE_PIPE_EVENT_BUFFER .?AU_FILE_PIPE_EVENT_BUFFER@@ t: � ) N � _PERFINFO_PROCESS_PERFCTR .?AU_PERFINFO_PROCESS_PERFCTR@@
v:
� �
" ProcessId
" PageFaultCount ���
" HandleCount ��
" Reserved �
" PeakVirtualSize ��
" PeakWorkingSetSize ���
" PeakPagefileUsage
" QuotaPeakPagedPoolUsage ��
" QuotaPeakNonPagedPoolUsage ���
" $ VirtualSize ��
" ( WorkingSetSize ���
" , PagefileUsage
" 0 QuotaPagedPoolUsage ��
" 4 QuotaNonPagedPoolUsage ���
" 8 PrivatePageCount �N x: < _PERFINFO_PROCESS_PERFCTR .?AU_PERFINFO_PROCESS_PERFCTR@@ y: b �
�.
� r � _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT@@
|:
� *
$ EnlistmentId �
$ UOW ��r ~: _TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_RECOVERY_ARGUMENT@@ : � �
�
�
� R � _PERFINFO_SET_POWER_ACTION .?AU_PERFINFO_SET_POWER_ACTION@@ ��F
Trigger ��
" PowerAction ��
" LightestState R �: _PERFINFO_SET_POWER_ACTION .?AU_PERFINFO_SET_POWER_ACTION@@ �� �: b ? Z � _EVENT_EXTENDED_ITEM_PEBS_INDEX .?AU_EVENT_EXTENDED_ITEM_PEBS_INDEX@@
�:
�
# PebsIndex Z �: _EVENT_EXTENDED_ITEM_PEBS_INDEX .?AU_EVENT_EXTENDED_ITEM_PEBS_INDEX@@ �: U r � ACTCTX_COMPATIBILITY_ELEMENT_TYPE_UNKNOWN ACTCTX_COMPATIBILITY_ELEMENT_TYPE_OS � ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MITIGATION � ACTCTX_COMPATIBILITY_ELEMENT_TYPE_MAXVERSIONTESTED ���Z t �: ACTCTX_COMPATIBILITY_ELEMENT_TYPE .?AW4ACTCTX_COMPATIBILITY_ELEMENT_TYPE@@ � �: � � F � _FILE_ID_INFORMATION .?AU_FILE_ID_INFORMATION@@ ��6
# VolumeSerialNumber ���
m FileId ���F �: _FILE_ID_INFORMATION .?AU_FILE_ID_INFORMATION@@ �� �: � � $
q Value N �: _SID_IDENTIFIER_AUTHORITY .?AU_SID_IDENTIFIER_AUTHORITY@@ �: w V � _WORKER_FACTORY_DEFERRED_WORK .?AU_WORKER_FACTORY_DEFERRED_WORK@@
\
� n
�: AlpcSendMessage ��
AlpcSendMessagePort ��
" AlpcSendMessageFlags �
" Flags V �: _WORKER_FACTORY_DEFERRED_WORK .?AU_WORKER_FACTORY_DEFERRED_WORK@@ �: � �
�
�
>1
� � R ^ � _HEAP_BLOCK_SETTABLE_INFORMATION .?AU_HEAP_BLOCK_SETTABLE_INFORMATION@@ ��
�:
� N
" Settable �
! TagIndex �
! AllocatorBackTraceIndex ��^ �: _HEAP_BLOCK_SETTABLE_INFORMATION .?AU_HEAP_BLOCK_SETTABLE_INFORMATION@@ �� �: � j � _MEMORY_PARTITION_PAGEFILE_INFORMATION .?AU_MEMORY_PARTITION_PAGEFILE_INFORMATION@@ ��
�:
� Z
PageFileName �
� MinimumSize ��
� MaximumSize ��
" Flags j �: _MEMORY_PARTITION_PAGEFILE_INFORMATION .?AU_MEMORY_PARTITION_PAGEFILE_INFORMATION@@ �� �: w � R � PROCESSOR_IDLESTATE_POLICY .?AUPROCESSOR_IDLESTATE_POLICY@@ ��
! ��
! ��
! ��V
! AsUSHORT �
�: AllowScaling �
�: Disabled �
�: Reserved �2 �: <anonymous-tag> .?AT<anonymous-tag>@@ �: { < � " �R
! Revision �
�: Flags
" PolicyCount ��
�: Policy ���R �: PROCESSOR_IDLESTATE_POLICY .?AUPROCESSOR_IDLESTATE_POLICY@@ �� �: { : Z � _FILE_NETWORK_OPEN_INFORMATION .?AU_FILE_NETWORK_OPEN_INFORMATION@@ ��
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� AllocationSize ���
� ( EndOfFile
" 0 FileAttributes ���Z �: 8 _FILE_NETWORK_OPEN_INFORMATION .?AU_FILE_NETWORK_OPEN_INFORMATION@@ �� �: � 0 v RtlMitigationOptionStateNotConfigured RtlMitigationOptionStateOn ��� RtlMitigationOptionStateOff ��^ t �: _RTL_IMAGE_MITIGATION_OPTION_STATE .?AW4_RTL_IMAGE_MITIGATION_OPTION_STATE@@ ��� �: � B � _WMIGUIDINFORMATION .?AU_WMIGUIDINFORMATION@@
�:
� B
" Size �
IsExpensive ��
IsEventOnly ��B �: _WMIGUIDINFORMATION .?AU_WMIGUIDINFORMATION@@ �: �2 �
�
� b � _REMOTE_LINK_TRACKING_INFORMATION_ .?AU_REMOTE_LINK_TRACKING_INFORMATION_@@ ��
�:
� ~
TargetFileObject �
" TargetLinkTrackingInformationLength ��
� TargetLinkTrackingInformationBuffer ��b �: _REMOTE_LINK_TRACKING_INFORMATION_ .?AU_REMOTE_LINK_TRACKING_INFORMATION_@@ �� �: � �) J � _ALPC_BASIC_INFORMATION .?AU_ALPC_BASIC_INFORMATION@@
�:
� B
" Flags
" SequenceNo ���
PortContext ��J �: _ALPC_BASIC_INFORMATION .?AU_ALPC_BASIC_INFORMATION@@ �: � �
D
� V � _IMAGE_SEPARATE_DEBUG_HEADER .?AU_IMAGE_SEPARATE_DEBUG_HEADER@@ ��
�:
� 6
! Signature
! Flags
! Machine ��
! Characteristics ��
" TimeDateStamp
" CheckSum �
" ImageBase
" SizeOfImage ��
" NumberOfSections �
" ExportedNamesSize
" DebugDirectorySize ���
" $ SectionAlignment �
7 ( Reserved �V
�: 0 _IMAGE_SEPARATE_DEBUG_HEADER .?AU_IMAGE_SEPARATE_DEBUG_HEADER@@ �� �: � $
-
� . � _CSTRING .?AU_CSTRING@@ ��B
! Length ���
! MaximumLength
Buffer ���. �: _CSTRING .?AU_CSTRING@@ �� �: ^ � _MEMORY_SHARED_COMMIT_INFORMATION .?AU_MEMORY_SHARED_COMMIT_INFORMATION@@
" CommitSize ���^ �: _MEMORY_SHARED_COMMIT_INFORMATION .?AU_MEMORY_SHARED_COMMIT_INFORMATION@@ �: w � �
" dwServiceType
" dwCurrentState ���
" dwControlsAccepted ���
" dwWin32ExitCode ��
" dwServiceSpecificExitCode
" dwCheckPoint �
" dwWaitHint ���: �: _SERVICE_STATUS .?AU_SERVICE_STATUS@@ �: � � i)
�:
� F � _OBJECT_ATTRIBUTES64 .?AU_OBJECT_ATTRIBUTES64@@ ��
�: ��
�:
� �
" Length ���
# RootDirectory
# ObjectName ���
" Attributes ���
# SecurityDescriptor ���
# ( SecurityQualityOfService �F �: 0 _OBJECT_ATTRIBUTES64 .?AU_OBJECT_ATTRIBUTES64@@ �� �:
�
�
�3
�
�
� N
$ PolicyPublisher ��
" PolicyVersion
" PolicyOptions f �: _SYSTEM_SECUREBOOT_POLICY_INFORMATION .?AU_SYSTEM_SECUREBOOT_POLICY_INFORMATION@@ �: �
b9
� " �2
" NumberOfModules ��
�: Modules ��F �: _RTL_PROCESS_MODULES .?AU_RTL_PROCESS_MODULES@@ �� �: � � f � _SYSTEM_NET_RATE_CONTROL_SET_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_SET_CONTEXT@@ ��
" ��
" ��
" ��
" ��
" ��
" ���
& Header ���
# MaxBandwidth �
� ContainerId ��
" Flags
�: Set ��
�: Update ���
�: Clear
�: DscpTagEnabled ���
�: MaxBandwidthEnabled ��
�: Reserved �
DscpTag ��f �: _SYSTEM_NET_RATE_CONTROL_SET_CONTEXT .?AU_SYSTEM_NET_RATE_CONTROL_SET_CONTEXT@@ �� �: � �
r
� " " �J
! Count
! Size �
" Reserved �
�: Bitmap ���6 �: _KAFFINITY_EX .?AU_KAFFINITY_EX@@ �: v T
�
� z � _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST@@ ��
;
� # " �"
; PreviousChangeStamps �z ; _SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST .?AU_SYSTEM_FEATURE_CONFIGURATION_SECTIONS_REQUEST@@ �� ; � � b � _ETW_TRACE_PARTITION_INFORMATION_V2 .?AU_ETW_TRACE_PARTITION_INFORMATION_V2@@ b
QpcOffsetFromRoot
" PartitionType
q PartitionId ��
q ParentId �b ; _ETW_TRACE_PARTITION_INFORMATION_V2 .?AU_ETW_TRACE_PARTITION_INFORMATION_V2@@ ; � �
�
� N � _PERFINFO_FILE_READ_WRITE .?AU_PERFINFO_FILE_READ_WRITE@@
;
� �
# Offset ���
" Irp ��
" FileObject ���
" FileKey ��
" IssuingThreadId ��
" Size �
" Flags
" ExtraFlags ���N
; $ _PERFINFO_FILE_READ_WRITE .?AU_PERFINFO_FILE_READ_WRITE@@ ; b � t L
;
� B � _FILE_STORAGE_INFO .?AU_FILE_STORAGE_INFO@@ ��&
" LogicalBytesPerSector
" PhysicalBytesPerSectorForAtomicity ���
" PhysicalBytesPerSectorForPerformance �
" FileSystemEffectivePhysicalBytesPerSectorForAtomicity
" Flags
" ByteOffsetForSectorAlignment �
" ByteOffsetForPartitionAlignment ��B ; _FILE_STORAGE_INFO .?AU_FILE_STORAGE_INFO@@ �� ; n # j � _FILE_DESIRED_STORAGE_CLASS_INFORMATION .?AU_FILE_DESIRED_STORAGE_CLASS_INFORMATION@@ "
� Class
" Flags j ; _FILE_DESIRED_STORAGE_CLASS_INFORMATION .?AU_FILE_DESIRED_STORAGE_CLASS_INFORMATION@@ ; � 2
�+
� 2
$ Id ���
" CurrentAllocatedBytes : ; _RTLP_TAG_INFO .?AU_RTLP_TAG_INFO@@ �� ; � � n � _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE@@ �� �4 " �r � _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY@@ �� ; " �b
" ResponseLevel
" NumberEntries
; Lev1Depends ��
!; Lev2Depends ��n "; L _STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_RESPONSE@@ �� #; � b
�( ��
%;
� F � _RTL_RELATIVE_NAME_U .?AU_RTL_RELATIVE_NAME_U@@ ��
�
� N
RelativeName �
ContainingDirectory ��
(; CurDirRef F ); _RTL_RELATIVE_NAME_U .?AU_RTL_RELATIVE_NAME_U@@ �� *; � a
:)
� f � _EVENT_TRACE_PERFORMANCE_INFORMATION .?AU_EVENT_TRACE_PERFORMANCE_INFORMATION@@ ��
-;
� J
? EventTraceInformationClass ���
� LogfileBytesWritten ��f /; _EVENT_TRACE_PERFORMANCE_INFORMATION .?AU_EVENT_TRACE_PERFORMANCE_INFORMATION@@ �� 0; @ � J � _HEAP_BLOCK_INFORMATION .?AU_HEAP_BLOCK_INFORMATION@@ �
" Level
" Size �
K# ProcessHeapInformation ���
�4 HeapInformation ��
J HeapRegionInformation
% HeapRangeInformation �
2; HeapBlockInformation �
�6 HeapPerfInformation ��
" DynamicStart �J 3; d _HEAP_INFORMATION_ITEM .?AU_HEAP_INFORMATION_ITEM@@ �� 4; � =
�
� J � _EVENT_INSTANCE_HEADER .?AU_EVENT_INSTANCE_HEADER@@ ��
7;
� 6
Type �
Level
! Version ��: 9; <anonymous-tag> .?AU<anonymous-tag>@@ :; � S �
! Size �
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��
" Version ��
:; Class
" ThreadId �
" ProcessId
� TimeStamp
# RegHandle
" InstanceId ���
" $ ParentInstanceId �
" ( KernelTime ���
" , UserTime �
# ( ProcessorTime
" ( EventId ��
" , Flags
# 0 ParentRegHandle ��J <; 8 _EVENT_INSTANCE_HEADER .?AU_EVENT_INSTANCE_HEADER@@ �� =; � H
5
�
s
� Z � _CM_PNP_BIOS_INSTALLATION_CHECK .?AU_CM_PNP_BIOS_INSTALLATION_CHECK@@ v
g Signature
Revision �
Length ���
! ControlField �
Checksum �
" EventFlagAddress �
!
RealModeEntryOffset ��
! RealModeEntrySegment �
! ProtectedModeEntryOffset �
" ProtectedModeCodeBaseAddress �
" OemDeviceId ��
! RealModeDataBaseAddress ��
" ProtectedModeDataBaseAddress �Z
B; ! _CM_PNP_BIOS_INSTALLATION_CHECK .?AU_CM_PNP_BIOS_INSTALLATION_CHECK@@ C; i
W
� " " F;
G;
� J � _FILE_LAYOUT_NAME_ENTRY .?AU_FILE_LAYOUT_NAME_ENTRY@@ �
" NextNameOffset ���
" Flags
# ParentFileReferenceNumber
" FileNameLength ���
" Reserved �
FileName �J J; _FILE_LAYOUT_NAME_ENTRY .?AU_FILE_LAYOUT_NAME_ENTRY@@ K; � � : � tagEMRCREATEPEN .?AUtagEMRCREATEPEN@@
M;
� 2
� emr ��
" ihPen
�, lopn �: O; tagEMRCREATEPEN .?AUtagEMRCREATEPEN@@ P; � N
� R � _SYSDBG_KD_PULL_REMOTE_FILE .?AU_SYSDBG_KD_PULL_REMOTE_FILE@@
ImageFileName R T; _SYSDBG_KD_PULL_REMOTE_FILE .?AU_SYSDBG_KD_PULL_REMOTE_FILE@@ U; � � Z SeLearningModeInvalidType SeLearningModeSettings ��� SeLearningModeMax N t W; _SE_LEARNING_MODE_DATA_TYPE .?AW4_SE_LEARNING_MODE_DATA_TYPE@@ � X; w 3
�!
�
~3
� ~ PowerUserPresent � PowerUserNotPresent �� PowerUserInactive PowerUserMaximum � PowerUserInvalid �F t \; _USER_ACTIVITY_PRESENCE .?AW4_USER_ACTIVITY_PRESENCE@@ � ]; { �
�)
� ^ � _ETW_COVERAGE_SAMPLER_PERF_STATS .?AU_ETW_COVERAGE_SAMPLER_PERF_STATS@@ ��*
# RunTime ��
SampleProfile
SampleCSwitch
SampleRThread
SamplePGFault
CaptureSampleProfile �
CaptureSampleCSwitch �
CaptureSampleRThread �
$ CaptureSamplePGFault �
( CoverageSamplerCreated ���
, CoverageSamplerDeleted ���
0 CoverageSamplerStarted ���
4 CoverageSamplerPaused
8 CoverageSamplerResumed ���
< CoverageSamplerStopped ���
@ CoverageSamplerQueried ���
D CoverageSamplerQueryFailNotActive
H SamplesAdded �
L SamplesFound �
P SamplesDropped ���
T SamplesMappedUM ��
X SamplesMappedKM ��
\ SamplesTryMapUM ��
` SamplesTryMapKM ��
d SamplesAddedAlreadyMapped
h ModulesTrackedUM �
l ModulesMappedUM ��
p ModulesUnmappedUM
t ModulesTrackedKM �
x ModulesMappedKM ��
| ModulesUnmappedKM
� ModulesCleared ���
� ModulesPruned
� ModulesPrunedPendingDelete ���
� ModulesOutOfDatePendingDelete
� ModuleBucketsGrown ���
� ModuleDebugInfoFailedQuery ���
� ModuleDebugInfoTooLarge ��
� ModuleIdHashDuplicate
� ModuleIdHashConflict �
� ProcessesTracked �
� ProcessesIgnored �
� ProcessesDeleted �
� CaptureSampleAttempts
� CaptureSampleSamplingPaused ��
� CaptureKernelStack ���
� CaptureUserStack �
� CaptureIPNotInStack ��
� CaptureSampleIdle
� CaptureUserCheckSystemThread �
� CaptureUserCheckNullTeb ��
� CaptureUserCheckTerminating ��
� CaptureUserCheckSuspended
� CaptureApcNotInGoodEnvironment ���
� CaptureRebalanceQueue
� CaptureRebalance �
� CaptureApc ���
� CaptureApcNotAvailable ���
� CaptureApcThreadNotQueueable �
� CaptureApcAlreadyQueued ��
� CaptureThreadAlreadySampling �
� CaptureApcQueue ��
� CaptureApcQueueAtHighIrql
CaptureApcFailedToQueue ��
CaptureApcFailedToQueueAtHighIrql
CaptureApcFailedToQueueAtHighIrqlNotRunning ��
CaptureApcFailedToQueueAtHighIrqlNotApcQueueable �
CaptureApcRundown
CaptureApcCancel �
CaptureApcCancelFailRemove ���
CaptureBufferNotAvailable
CaptureBufferReleaseEmpty
$CaptureBufferQueued ��
(CaptureBufferCopied ��
,CaptureStartFailureCleanup ���
0SampleBufferNotAvailable �
4WorkerWakeUpForCaptureBuffer �
8WorkerWakeUpForRebalance �
<WorkerProcessCaptureBuffer ���
@WorkerProcessSampleBuffer
DWorkerProcessFlushBuffer �
HStackHashMiss
LStackHashHit �
PStackHashHitInHistory
TStackHashSwitchTables
XStackHashCollisionInAdd ��
\StackHashAddHitLoad ��
`StackHashAddHitMax ���
dBloomFilterExceptions
hBloomFilterSet ���
lBloomFilterOnCreate ��
pBloomFilterHit ���
tBloomFilterMiss ��
xBufferSamplesCopied ��
|BufferSamplesProcessed ���
�BufferSamplesAddedToSampler ��
�BufferAddressesCopied
�BufferAddressesProcessed �
�BufferAddressesAddedToSampler
�ReserveFailedAcquireLock �
�ReserveCaptureStopped
�ReserveNewBufferSet ��
�ReserveNewBufferFailed ���
�ReserveNewBufferAllocated
�ReserveNewBufferReleased �
�ReserveSucceeded �
�TableGrew
�TableGrow
�TableQueued ��
�TableHitInCurrent
�TableHitInOld ^ o a; �_ETW_COVERAGE_SAMPLER_PERF_STATS .?AU_ETW_COVERAGE_SAMPLER_PERF_STATS@@ �� b; @ " R � _WMI_IMAGELOAD_INFORMATION .?AU_WMI_IMAGELOAD_INFORMATION@@ ��2
ImageBase
" ImageSize
" ProcessId
" ImageChecksum
" TimeDateStamp
SignatureLevel ���
SignatureType
! Reserved0
DefaultBase ��
" Reserved1
" Reserved2
" $ Reserved3
" ( Reserved4
, FileName �R e; 0 _WMI_IMAGELOAD_INFORMATION .?AU_WMI_IMAGELOAD_INFORMATION@@ �� f; b D . � _TP_WORK .?AU_TP_WORK@@ ��
h;
� � i; j;
k;
�
�
� f � _PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT .?AU_PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT@@
" TargetAddress f o; _PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT .?AU_PERFINFO_SPEC_CONTROL_RETPOLINE_EXIT@@ p; b 8
,7
� : � _SYSDBG_VIRTUAL .?AU_SYSDBG_VIRTUAL@@ >
Address ��
Buffer ���
" Request ��: t; _SYSDBG_VIRTUAL .?AU_SYSDBG_VIRTUAL@@ u; � � b � _PROCESS_CHILD_PROCESS_INFORMATION .?AU_PROCESS_CHILD_PROCESS_INFORMATION@@ ��v
ProhibitChildProcesses ���
AlwaysAllowSecureChildProcess
AuditProhibitChildProcesses ��b x; _PROCESS_CHILD_PROCESS_INFORMATION .?AU_PROCESS_CHILD_PROCESS_INFORMATION@@ �� y; D � 6 � tagLOGPALETTE .?AUtagLOGPALETTE@@
{;
� : � tagPALETTEENTRY .?AUtagPALETTEENTRY@@ }; " �J
! palVersion ���
! palNumEntries
~; palPalEntry ��6 ; tagLOGPALETTE .?AUtagLOGPALETTE@@ �; � � . PerfInfoDomainChangeEventIdleHalt PerfInfoDomainChangeEventIdleResume �� PerfInfoDomainChangeEventUserRestore � PerfInfoDomainChangeEventUserCallout � PerfInfoDomainChangeEventEnterSyscall PerfInfoDomainChangeEventEnterTrap ��� PerfInfoDomainChangeEventMaximum �b t �; _PERFINFO_DOMAIN_CHANGE_EVENT_REASON .?AW4_PERFINFO_DOMAIN_CHANGE_EVENT_REASON@@ ��� �; b
�;
�
�
�
]0
�
� j � _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT .?AU_SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT@@ ��
�;
� .
# Hits �
PercentFrequency �j �; _SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT .?AU_SYSTEM_PROCESSOR_PERFORMANCE_HITCOUNT@@ �� �; � N � READ_USN_JOURNAL_DATA_V1 .?AUREAD_USN_JOURNAL_DATA_V1@@ ��
�;
� �
StartUsn �
" ReasonMask ���
" ReturnOnlyOnClose
# Timeout ��
# BytesToWaitFor ���
# UsnJournalID �
! ( MinMajorVersion ��
! * MaxMajorVersion ��N �; 0 READ_USN_JOURNAL_DATA_V1 .?AUREAD_USN_JOURNAL_DATA_V1@@ �� �; � 9 : � _MMPFN_IDENTITY .?AU_MMPFN_IDENTITY@@ N � _MEMORY_FRAME_INFORMATION .?AU_MEMORY_FRAME_INFORMATION@@ F � _PAGEDIR_INFORMATION .?AU_PAGEDIR_INFORMATION@@ ��B
�; e1 ���
�1 e2 ���
�; e3 ���
�% e4 ���2 �; <anonymous-tag> .?AT<anonymous-tag>@@ �; w %
" ��
" ��&
�; Image
�; Mismatch �: �; <anonymous-tag> .?AU<anonymous-tag>@@ �; w -
" ��
�; CombinedPage �: �; <anonymous-tag> .?AU<anonymous-tag>@@ �; w 1 �
�; e1 ���
�; e2 ���
FileObject ���
UniqueFileObjectKey ��
ProtoPteAddress ��
VirtualAddress ���2 �; <anonymous-tag> .?AT<anonymous-tag>@@ �; w , >
�; u1 ���
" PageFrameIndex ���
�; u2 ���: �; _MMPFN_IDENTITY .?AU_MMPFN_IDENTITY@@ �; w $ R � _JOBOBJECT_WAKE_INFORMATION .?AU_JOBOBJECT_WAKE_INFORMATION@@
�;
� # " 8 �:
# NotificationChannel ��
�; WakeCounters �R �; @ _JOBOBJECT_WAKE_INFORMATION .?AU_JOBOBJECT_WAKE_INFORMATION@@ �; � 3 V � _FILE_SET_DEFECT_MGMT_BUFFER .?AU_FILE_SET_DEFECT_MGMT_BUFFER@@ ��
Disable ��V �; _FILE_SET_DEFECT_MGMT_BUFFER .?AU_FILE_SET_DEFECT_MGMT_BUFFER@@ �� �; � ' Z � _SYSTEM_PROCESS_ID_INFORMATION .?AU_SYSTEM_PROCESS_ID_INFORMATION@@ ��
�;
� *
ProcessId
ImageName Z �; _SYSTEM_PROCESS_ID_INFORMATION .?AU_SYSTEM_PROCESS_ID_INFORMATION@@ �� �; � ` F � _RPC_TRANSFER_SYNTAX .?AU_RPC_TRANSFER_SYNTAX@@ ��:
$ Uuid �
! VersMajor
! VersMinor F �; _RPC_TRANSFER_SYNTAX .?AU_RPC_TRANSFER_SYNTAX@@ �� �; 3 �
p/
�
N
� 2 � _FILE_PATH .?AU_FILE_PATH@@ ��
�;
� N
" Version ��
" Length ���
" Type �
� FilePath �2 �; _FILE_PATH .?AU_FILE_PATH@@ �� �; � s f � _PERFINFO_PAGECOMBINE_AGGREGATE_STAT .?AU_PERFINFO_PAGECOMBINE_AGGREGATE_STAT@@ ��
�;
�
" ��
" ��
�; StatType �
�; Spare
" CombineScanCount �
# PagesScanned �
# PagesCombined
CombinedBlocksInUse ��
SumCombinedBlocksReferenceCount ��f �; _PERFINFO_PAGECOMBINE_AGGREGATE_STAT .?AU_PERFINFO_PAGECOMBINE_AGGREGATE_STAT@@ �� �; b ( N
peRed
peGreen ��
peBlue ���
peFlags ��: �; tagPALETTEENTRY .?AUtagPALETTEENTRY@@ �; � � v � _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT@@ ��
�;
�
" SavepointId ��v �; _TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_SAVEPOINT_ARGUMENT@@ �� �; � � Z � _KNONVOLATILE_CONTEXT_POINTERS .?AU_KNONVOLATILE_CONTEXT_POINTERS@@ ��
�;
�
" R4 ���
" R5 ���
" R6 ���
" R7 ���
" R8 ���
" R9 ���
" R10 ��
" R11 ��
" Lr ���
# $ D8 ���
# ( D9 ���
# , D10 ��
# 0 D11 ��
# 4 D12 ��
# 8 D13 ��
# < D14 ��
# @ D15 ��Z �; D _KNONVOLATILE_CONTEXT_POINTERS .?AU_KNONVOLATILE_CONTEXT_POINTERS@@ �� �; �& , J � _ETW_HEAP_EVENT_COMMON .?AU_ETW_HEAP_EVENT_COMMON@@ ��*
m Header ���
Handle ���J �; $ _ETW_HEAP_EVENT_COMMON .?AU_ETW_HEAP_EVENT_COMMON@@ �� �; b �
N � _COVERAGE_SECTION_HEADER .?AU_COVERAGE_SECTION_HEADER@@ ��
�;
� �
" Signature
" CoverageType �
o MD5Hash ��
" CoverageSectionSize ��
" CoverageVectorSize ���
" CoverageVectorOffset �
" $ ExtraDataOffset ��N �; ( _COVERAGE_SECTION_HEADER .?AU_COVERAGE_SECTION_HEADER@@ �� �; � ' R � _PERFINFO_PO_NOTIFY_DEVICE .?AU_PERFINFO_PO_NOTIFY_DEVICE@@ ���
Irp ��
DriverStart ��
OrderLevel ���
MajorFunction
MinorFunction
� Type �
" State
" DeviceNameLength �
DeviceName ���R �; _PERFINFO_PO_NOTIFY_DEVICE .?AU_PERFINFO_PO_NOTIFY_DEVICE@@ �� �; b n q t �;
�;
�
M
�
�
�
a �; � � �; r � _JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION@@ ��
�;
� �
n( BasicInfo
� 0 IoInfo ���
� ` DiskIoInfo ���
# � ContextSwitches ��
� � TotalCycleTime ���
# � ReadyTime
o( � EnergyValues �r �; �_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION@@ �� �; � �
�+
� B � _SCRUB_DATA_OUTPUT .?AU_SCRUB_DATA_OUTPUT@@ �� " " $ ��
" Size �
" Flags
" Status ���
# ErrorFileOffset ��
# ErrorLength ��
# NumberOfBytesRepaired
# ( NumberOfBytesFailed ��
# 0 InternalFileReference
! 8 ResumeContextLength ��
! : ParityExtentDataOffset ���
�; < Reserved �
# ` NumberOfMetadataBytesProcessed ���
# h NumberOfDataBytesProcessed ���
# p TotalNumberOfMetadataBytesInUse ��
# x TotalNumberOfDataBytesInUse ��
�6 � ResumeContext B �; �_SCRUB_DATA_OUTPUT .?AU_SCRUB_DATA_OUTPUT@@ �� �; � /' . � HLSURF__ .?AUHLSURF__@@ ��
t unused ���. �; HLSURF__ .?AUHLSURF__@@ �� �; �' � N � _ACL_REVISION_INFORMATION .?AU_ACL_REVISION_INFORMATION@@
" AclRevision ��N �; _ACL_REVISION_INFORMATION .?AU_ACL_REVISION_INFORMATION@@ �; w S
�$
� r � _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT@@ ��*
" MarshalCookie
$ UOW ��r < _TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT .?AU_TRANSACTION_NOTIFICATION_MARSHAL_ARGUMENT@@ �� < � � Z � _STREAMS_QUERY_ID_OUTPUT_BUFFER .?AU_STREAMS_QUERY_ID_OUTPUT_BUFFER@@
" StreamId �Z < _STREAMS_QUERY_ID_OUTPUT_BUFFER .?AU_STREAMS_QUERY_ID_OUTPUT_BUFFER@@ < � � > � RPC_STATS_VECTOR .?AURPC_STATS_VECTOR@@ �� " " �"
u Count
< Stats >
< RPC_STATS_VECTOR .?AURPC_STATS_VECTOR@@ �� < ^ f � _ALPC_PORT_ASSOCIATE_COMPLETION_PORT .?AU_ALPC_PORT_ASSOCIATE_COMPLETION_PORT@@ ��
<
� 6
CompletionKey
CompletionPort ���f < _ALPC_PORT_ASSOCIATE_COMPLETION_PORT .?AU_ALPC_PORT_ASSOCIATE_COMPLETION_PORT@@ �� < � F � _FILE_ALIGNMENT_INFO .?AU_FILE_ALIGNMENT_INFO@@ ��"
" AlignmentRequirement �F < _FILE_ALIGNMENT_INFO .?AU_FILE_ALIGNMENT_INFO@@ �� < n #
�2
� ^ � _RPC_BINDING_HANDLE_TEMPLATE_V1_W .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_W@@
q Reserved �2 < <anonymous-tag> .?AT<anonymous-tag>@@ < ^ � �
" Version ��
" Flags
" ProtocolSequence �
q NetworkAddress ���
q StringEndpoint ���
< u1 ���
$ ObjectUuid ���^ < ( _RPC_BINDING_HANDLE_TEMPLATE_V1_W .?AU_RPC_BINDING_HANDLE_TEMPLATE_V1_W@@ < ^ � b JournalAbsoluteInformation ��� JournalClientInformation � MaxJournalInformation N t < _JOURNAL_INFORMATION_CLASS .?AW4_JOURNAL_INFORMATION_CLASS@@ ��� < � � B � tagINPUT_TRANSFORM .?AUtagINPUT_TRANSFORM@@ �� n " @ �
@ _11 ��
@ _12 ��
@ _13 ��
@ _14 ��
@ _21 ��
@ _22 ��
@ _23 ��
@ _24 ��
@ _31 ��
@ $ _32 ��
@ ( _33 ��
@ , _34 ��
@ 0 _41 ��
@ 4 _42 ��
@ 8 _43 ��
@ < _44 ��
"< m B #< @ tagINPUT_TRANSFORM .?AUtagINPUT_TRANSFORM@@ �� $< ~ � � ! t &<
'<
�
�
�
0
�
<:
� F � _CM_SONIC_DEVICE_DATA .?AU_CM_SONIC_DEVICE_DATA@@ j
! Version ��
! Revision �
! DataConfigurationRegister
EthernetAddress ��F -< _CM_SONIC_DEVICE_DATA .?AU_CM_SONIC_DEVICE_DATA@@ .< � : � CM_Power_Data_s .?AUCM_Power_Data_s@@ � " ��
" PD_Size ��
� PD_MostRecentPowerState ��
" PD_Capabilities ��
" PD_D1Latency �
" PD_D2Latency �
" PD_D3Latency �
1< PD_PowerStateMapping �
� 4 PD_DeepestSystemWake �: 2< 8 CM_Power_Data_s .?AUCM_Power_Data_s@@ 3< { b R � _KEY_VALUE_FULL_INFORMATION .?AU_KEY_VALUE_FULL_INFORMATION@@ �
" TitleIndex ���
" Type �
" DataOffset ���
" DataLength ���
" NameLength ���
Name �R 6< _KEY_VALUE_FULL_INFORMATION .?AU_KEY_VALUE_FULL_INFORMATION@@ 7< O
{
� ^ � _ETW_COVERAGE_SAMPLER_STATUS_INFO .?AU_ETW_COVERAGE_SAMPLER_STATUS_INFO@@ V � _ETW_COVERAGE_SAMPLER_STATUS .?AU_ETW_COVERAGE_SAMPLER_STATUS@@ ��*
Common ���
;< Status ���^ << _ETW_COVERAGE_SAMPLER_STATUS_INFO .?AU_ETW_COVERAGE_SAMPLER_STATUS_INFO@@ =< @ - : � _RTL_HASH_ENTRY .?AU_RTL_HASH_ENTRY@@ *
[ BucketLink ���
" Key ��: @< _RTL_HASH_ENTRY .?AU_RTL_HASH_ENTRY@@ A< � * B � _PS_ATTRIBUTE_LIST .?AU_PS_ATTRIBUTE_LIST@@ ��6 � _PS_ATTRIBUTE .?AU_PS_ATTRIBUTE@@ D< " �2
" TotalLength ��
E< Attributes ���B F< _PS_ATTRIBUTE_LIST .?AU_PS_ATTRIBUTE_LIST@@ �� G< � � 6 � _RATE_QUOTA_LIMIT .?AT_RATE_QUOTA_LIMIT@@
I<
�
" ��
" ��B
" RateData �
K< RatePercent ��
L< Reserved0 6 M< _RATE_QUOTA_LIMIT .?AT_RATE_QUOTA_LIMIT@@ N< D � F � _PHYSICAL_DISK_RECORD .?AU_PHYSICAL_DISK_RECORD@@ q " �N
" DiskNumber ���
" BytesPerSector ���
" SectorsPerTrack ��
" TracksPerCylinder
# Cylinders
" SCSIPortNumber ���
" SCSIPathId ���
" SCSITargetId �
" $ SCSILun ��
� ( Manufacturer �
" (PartitionCount ���
,WriteCacheEnabled
Q< .BootDriveLetter ��F
R< 8_PHYSICAL_DISK_RECORD .?AU_PHYSICAL_DISK_RECORD@@ S< b � 6 � tagEMRFILLRGN .?AUtagEMRFILLRGN@@
U<
� b
� emr ��
c rclBounds
" cbRgnData
" ihBrush ��
� RgnData ��6 W< $ tagEMRFILLRGN .?AUtagEMRFILLRGN@@ X< � � 6 � _PEB_LDR_DATA .?AU_PEB_LDR_DATA@@
Z<
�
" Length ���
Initialized ��
SsHandle �
! InLoadOrderModuleList
! InMemoryOrderModuleList ��
! InInitializationOrderModuleList ��
$ EntryInProgress ��
( ShutdownInProgress ���
, ShutdownThreadId �6 \< 0 _PEB_LDR_DATA .?AU_PEB_LDR_DATA@@ ]< D ,
P
� b
ProcessorNumber ��
Alignment
! ProcessorIndex ���
! LoggerId �B `< _ETW_BUFFER_CONTEXT .?AU_ETW_BUFFER_CONTEXT@@ a< � � B � tagEMROFFSETCLIPRGN .?AUtagEMROFFSETCLIPRGN@@ &
� emr ��
� ptlOffset B d< tagEMROFFSETCLIPRGN .?AUtagEMROFFSETCLIPRGN@@ e< � �
^0
� Z
elfLogFont ���
\ elfFullName ��
� elfStyle �
elfScript > h< \tagENUMLOGFONTEXW .?AUtagENUMLOGFONTEXW@@ i< � �
�2
� V � _JOBOBJECT_JOBSET_INFORMATION .?AU_JOBOBJECT_JOBSET_INFORMATION@@
" MemberLevel ��V m< _JOBOBJECT_JOBSET_INFORMATION .?AU_JOBOBJECT_JOBSET_INFORMATION@@ n< D �
}
� : � _XSTATE_CONTEXT .?AU_XSTATE_CONTEXT@@
q<
�
� ^
# Mask �
" Length ���
" Reserved1
s< Area �
Buffer ���: t< _XSTATE_CONTEXT .?AU_XSTATE_CONTEXT@@ u< K $
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
w< Reserved0
x< SameAccess ���
y< SameAttributes ���
z< Indirect �
{< Inherit ��
|< Reserved1
" Handle ���
" ObjectType ���
" DesiredAccess
" GrantedAccess B }< _ALPC_HANDLE_ATTR32 .?AU_ALPC_HANDLE_ATTR32@@ ~< � ) �
HandleValue ��
" HandleCount ��
" PointerCount �
" GrantedAccess
" ObjectTypeIndex ��
" HandleAttributes �
" Reserved �^ �< _PROCESS_HANDLE_TABLE_ENTRY_INFO .?AU_PROCESS_HANDLE_TABLE_ENTRY_INFO@@ �� �< � � V � _SERVICE_FAILURE_ACTIONS_FLAG .?AU_SERVICE_FAILURE_ACTIONS_FLAG@@ .
t fFailureActionsOnNonCrashFailures V �< _SERVICE_FAILURE_ACTIONS_FLAG .?AU_SERVICE_FAILURE_ACTIONS_FLAG@@ �< � C n � _SYSTEM_FEATURE_CONFIGURATION_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_INFORMATION@@ 2
# ChangeStamp ��
m Configuration n �< _SYSTEM_FEATURE_CONFIGURATION_INFORMATION .?AU_SYSTEM_FEATURE_CONFIGURATION_INFORMATION@@ �< � c
�5
�
�#
�
n(
� �
� TotalUserTime
� TotalKernelTime ��
� ThisPeriodTotalUserTime ��
� ThisPeriodTotalKernelTime
" TotalPageFaultCount ��
" $ TotalProcesses ���
" ( ActiveProcesses ��
" , TotalTerminatedProcesses �j �< 0 _JOBOBJECT_BASIC_ACCOUNTING_INFORMATION .?AU_JOBOBJECT_BASIC_ACCOUNTING_INFORMATION@@ �< D I f � _SYSTEM_QUERY_TIME_ADJUST_INFORMATION .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION@@ J
" TimeAdjustment ���
" TimeIncrement
Enable ���f �< _SYSTEM_QUERY_TIME_ADJUST_INFORMATION .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION@@ �< � c B � _KERNEL_USER_TIMES .?AU_KERNEL_USER_TIMES@@ ��Z
� CreateTime ���
� ExitTime �
� KernelTime ���
� UserTime �B �< _KERNEL_USER_TIMES .?AU_KERNEL_USER_TIMES@@ �� �< D � f � _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1@@ f
� pInt64 ���
� pUint64 ��
� ppString �
� pFqbn
� pOctetString �2 �< <anonymous-tag> .?AT<anonymous-tag>@@ �< w
v
" Name �
! ValueType
! Reserved �
" Flags
" ValueCount ���
�< Values ���f �< _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1@@ �< w �
k) ��
�<
� F � _IMAGE_FUNCTION_ENTRY .?AU_IMAGE_FUNCTION_ENTRY@@ N
" StartingAddress ��
" EndingAddress
" EndOfPrologue F �< _IMAGE_FUNCTION_ENTRY .?AU_IMAGE_FUNCTION_ENTRY@@ �< � @ # @ �<
&
� *
" PolicyCookie �
� Type �j �< _SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER .?AU_SYSTEM_NET_RATE_CONTROL_CONTEXT_HEADER@@ �< � � b � _SYSTEM_SET_TIME_ADJUST_INFORMATION .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION@@
�<
� 2
" TimeAdjustment ���
Enable ���b �< _SYSTEM_SET_TIME_ADJUST_INFORMATION .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION@@ �< � o b � _PERFINFO_KERNELMEMORY_RANGE_USAGE .?AU_PERFINFO_KERNELMEMORY_RANGE_USAGE@@ ��
�<
�
" ��
" ��V
�< UsageType
�< Spare
VirtualAddress ���
" PageCount b �< _PERFINFO_KERNELMEMORY_RANGE_USAGE .?AU_PERFINFO_KERNELMEMORY_RANGE_USAGE@@ �� �< b J � tagPOINTER_DEVICE_INFO .?AUtagPOINTER_DEVICE_INFO@@ ��2 � HMONITOR__ .?AUHMONITOR__@@ ��
�<
� q " �
" displayOrientation ���
device ���
�, pointerDeviceType
�< monitor ��
" startingCursorId �
! maxActiveContacts
�< productString J �< (tagPOINTER_DEVICE_INFO .?AUtagPOINTER_DEVICE_INFO@@ �� �< ~ �;
5
� R � _SYSTEM_HANDLE_INFORMATION .?AU_SYSTEM_HANDLE_INFORMATION@@ ��Z � _SYSTEM_HANDLE_TABLE_ENTRY_INFO .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO@@ �< " �2
" NumberOfHandles ��
�< Handles ��R �< _SYSTEM_HANDLE_INFORMATION .?AU_SYSTEM_HANDLE_INFORMATION@@ �� �< � : � tagENUMLOGFONTA .?AUtagENUMLOGFONTA@@
�<
� F
� elfLogFont ���
�+ < elfFullName ��
� | elfStyle �: �< � tagENUMLOGFONTA .?AUtagENUMLOGFONTA@@ �< � �
�8
� N � _MEM_ADDRESS_REQUIREMENTS .?AU_MEM_ADDRESS_REQUIREMENTS@@ V
LowestStartingAddress
HighestEndingAddress �
" Alignment N �< _MEM_ADDRESS_REQUIREMENTS .?AU_MEM_ADDRESS_REQUIREMENTS@@ �< � �
�)
� : � _REASON_BUFFER .?AU_REASON_BUFFER@@ ��
" Flags
" ResourceFileNameOffset ���
! ResourceReasonId �
" StringCount ��
" SubstitutionStringsOffset
" SimpleStringOffset ���: �< _REASON_BUFFER .?AU_REASON_BUFFER@@ �� �< { �
P3
�
�2
� 6 � _EVENT_TRACE .?AU_EVENT_TRACE@@ ��
�2
�
�<
�
�< �<
�<
�
L
�
�< �<
�<
� �
p LogFileName ��
p LoggerName ���
CurrentTime ��
" BuffersRead ��
" LogFileMode ��
" ProcessTraceMode �
�< CurrentEvent �
�9 p LogfileHeader
�< �BufferCallback ���
" �BufferSize ���
" �Filled ���
" �EventsLost ���
�< �EventCallback
�< �EventRecordCallback ��
" �IsKernelTrace
�Context ��F �< �_EVENT_TRACE_LOGFILEA .?AU_EVENT_TRACE_LOGFILEA@@ �< � �
,
� V � _CLAIM_SECURITY_ATTRIBUTE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_V1@@ ��
�<
�
�2
� v � _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ ��
�<
� f
pInt64 ���
# pUint64 ��
�- ppString �
�< pFqbn
�< pOctetString �2 �< <anonymous-tag> .?AT<anonymous-tag>@@ �< w � v
q Name �
! ValueType
! Reserved �
" Flags
" ValueCount ���
�< Values ���V �< _CLAIM_SECURITY_ATTRIBUTE_V1 .?AU_CLAIM_SECURITY_ATTRIBUTE_V1@@ �� �< w � : � tagMETAFILEPICT .?AUtagMETAFILEPICT@@ 2 � HMETAFILE__ .?AUHMETAFILE__@@
�<
� B
mm ���
xExt �
yExt �
�< hMF ��: �< tagMETAFILEPICT .?AUtagMETAFILEPICT@@ �< �
1
�
�
� > � _TOKEN_STATISTICS .?AU_TOKEN_STATISTICS@@
� TokenId ��
� AuthenticationId �
� ExpirationTime ���
�$ TokenType
� ImpersonationLevel ���
" DynamicCharged ���
" $ DynamicAvailable �
" ( GroupCount ���
" , PrivilegeCount ���
� 0 ModifiedId ���>
�< 8 _TOKEN_STATISTICS .?AU_TOKEN_STATISTICS@@ �< w � f � _SYSTEM_INTERRUPT_CPU_SET_INFORMATION .?AU_SYSTEM_INTERRUPT_CPU_SET_INFORMATION@@ 6
" Gsiv �
! Group
# CpuSets ��f �< _SYSTEM_INTERRUPT_CPU_SET_INFORMATION .?AU_SYSTEM_INTERRUPT_CPU_SET_INFORMATION@@ �< � �
�
� > � tagCBT_CREATEWNDA .?AUtagCBT_CREATEWNDA@@
=
� .
+ lpcs �
� hwndInsertAfter ��> = tagCBT_CREATEWNDA .?AUtagCBT_CREATEWNDA@@ = ~ U 6 � _NETRESOURCEA .?AU_NETRESOURCEA@@ �
" dwScope ��
" dwType ���
" dwDisplayType
" dwUsage ��
p lpLocalName ��
p lpRemoteName �
p lpComment
p lpProvider ���6 = _NETRESOURCEA .?AU_NETRESOURCEA@@ = � d J � _BOOT_ENTROPY_NT_RESULT .?AU_BOOT_ENTROPY_NT_RESULT@@ Z � _BOOT_ENTROPY_SOURCE_NT_RESULT .?AU_BOOT_ENTROPY_SOURCE_NT_RESULT@@ �� = " �Z
" maxEntropySources
= EntropySourceResult ��
�5 SeedBytesForCng ��J
= H_BOOT_ENTROPY_NT_RESULT .?AU_BOOT_ENTROPY_NT_RESULT@@ = � N Z � _FILE_PIPE_EVENT_SELECT_BUFFER .?AU_FILE_PIPE_EVENT_SELECT_BUFFER@@ ��2
" EventTypes ���
# EventHandle ��Z = _FILE_PIPE_EVENT_SELECT_BUFFER .?AU_FILE_PIPE_EVENT_SELECT_BUFFER@@ �� = � �) �
! CurrentMachineSIDOffset ��
! CurrentMachineSIDLength ��
! NewMachineSIDOffset ��
! NewMachineSIDLength ��V = _SD_CHANGE_MACHINE_SID_INPUT .?AU_SD_CHANGE_MACHINE_SID_INPUT@@ �� = � �
�:
� v � _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION .?AU_SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION@@ ��
=
� # " �.
# WorkloadClass
= CpuSets ��v = _SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION .?AU_SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION@@ �� = � � b � _FILE_IS_REMOTE_DEVICE_INFORMATION .?AU_FILE_IS_REMOTE_DEVICE_INFORMATION@@ ��
IsRemote �b = _FILE_IS_REMOTE_DEVICE_INFORMATION .?AU_FILE_IS_REMOTE_DEVICE_INFORMATION@@ �� = �
;
�
4!
� F � _STREAM_LAYOUT_ENTRY .?AU_STREAM_LAYOUT_ENTRY@@ ��
$=
� 2
" Version ��
" NextStreamOffset �
" Flags
" ExtentInformationOffset ��
� AllocationSize ���
� EndOfFile
" StreamInformationOffset ��
" $ AttributeTypeCode
" ( AttributeFlags ���
" , StreamIdentifierLength ���
0 StreamIdentifier �F &= 8 _STREAM_LAYOUT_ENTRY .?AU_STREAM_LAYOUT_ENTRY@@ �� '= � 4 > � _WMI_CONTEXTSWAP .?AU_WMI_CONTEXTSWAP@@ ��
��
��
��
��
" NewThreadId ��
" OldThreadId ��
p NewThreadPriority
p OldThreadPriority
PreviousCState ���
OldThreadRank
p NewThreadPriorityDecrement ���
p SpareByte
OldThreadWaitReason ��
*=
OldThreadWaitMode
+=
OldThreadBamQosLevel �
,=
NewThreadBamQosLevel �
-=
Reserved �
Flags
OldThreadState ���
OldThreadIdealProcessor ��
" NewThreadWaitTime
OldThreadRemainingQuantum > .= _WMI_CONTEXTSWAP .?AU_WMI_CONTEXTSWAP@@ �� /= b B � READ_FILE_USN_DATA .?AUREAD_FILE_USN_DATA@@ ��
1=
� :
! MinMajorVersion ��
! MaxMajorVersion ��B 3= READ_FILE_USN_DATA .?AUREAD_FILE_USN_DATA@@ �� 4= � �
" dwServiceType
" dwCurrentState ���
" dwControlsAccepted ���
" dwWin32ExitCode ��
" dwServiceSpecificExitCode
" dwCheckPoint �
" dwWaitHint ���
" dwProcessId ��
" dwServiceFlags ���J 6= $ _SERVICE_STATUS_PROCESS .?AU_SERVICE_STATUS_PROCESS@@ 7= � � B � tagEMREXTCREATEPEN .?AUtagEMREXTCREATEPEN@@ ��~
� emr ��
" ihPen
" offBmi ���
" cbBmi
" offBits ��
" cbBits ���
2 elp ��B := 8 tagEMREXTCREATEPEN .?AUtagEMREXTCREATEPEN@@ �� ;= � U V � _SYSTEM_SCOPED_POLICY_ID_ACE .?AU_SYSTEM_SCOPED_POLICY_ID_ACE@@ ��:
� Header ���
" Mask �
" SidStart �V >= _SYSTEM_SCOPED_POLICY_ID_ACE .?AU_SYSTEM_SCOPED_POLICY_ID_ACE@@ �� ?= w � r � JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 .?AUJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2@@ ��
# IoReadBytesLimit �
# IoWriteBytesLimit
� PerJobUserTimeLimit ��
# JobHighMemoryLimit ���
# JobMemoryLimit ���
M RateControlTolerance �
M CpuRateControlTolerance ��
� $ RateControlToleranceInterval �
� $ CpuRateControlToleranceInterval ��
" ( LimitFlags ���
M , IoRateControlTolerance ���
# 0 JobLowMemoryLimit
� 8 IoRateControlToleranceInterval ���
M < NetRateControlTolerance ��
� @ NetRateControlToleranceInterval ��r B= H JOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2 .?AUJOBOBJECT_NOTIFICATION_LIMIT_INFORMATION_2@@ �� C= D � Z � _SE_SET_FILE_CACHE_INFORMATION .?AU_SE_SET_FILE_CACHE_INFORMATION@@ ��
E=
� 2
" Size �
CatalogDirectoryPath �Z G= _SE_SET_FILE_CACHE_INFORMATION .?AU_SE_SET_FILE_CACHE_INFORMATION@@ �� H= � � > � tagLASTINPUTINFO .?AUtagLASTINPUTINFO@@ ��
J=
� *
u cbSize ���
" dwTime ���> L= tagLASTINPUTINFO .?AUtagLASTINPUTINFO@@ �� M= ~ �
�#
� R � _SYSTEM_POLICY_INFORMATION .?AU_SYSTEM_POLICY_INFORMATION@@ ��v
InputData
OutputData ���
" InputDataSize
" OutputDataSize ���
" Version ��R Q= _SYSTEM_POLICY_INFORMATION .?AU_SYSTEM_POLICY_INFORMATION@@ �� R= � R
R � _CONTAINER_ROOT_INFO_INPUT .?AU_CONTAINER_ROOT_INFO_INPUT@@ ��
T=
�
" Flags R V= _CONTAINER_ROOT_INFO_INPUT .?AU_CONTAINER_ROOT_INFO_INPUT@@ �� W= � �"
�-
�
�<
�
� ��
[=
� N � _SYSTEM_AUDIT_OBJECT_ACE .?AU_SYSTEM_AUDIT_OBJECT_ACE@@ ��
� Header ���
" Mask �
" Flags
$ ObjectType ���
$ InheritedObjectType ��
" , SidStart �N ^= 0 _SYSTEM_AUDIT_OBJECT_ACE .?AU_SYSTEM_AUDIT_OBJECT_ACE@@ �� _= w � > � tagNEWTEXTMETRICA .?AUtagNEWTEXTMETRICA@@
a=
� F
tmHeight �
tmAscent �
tmDescent
tmInternalLeading
tmExternalLeading
tmAveCharWidth ���
tmMaxCharWidth ���
tmWeight �
tmOverhang ���
$ tmDigitizedAspectX ���
( tmDigitizedAspectY ���
, tmFirstChar ��
- tmLastChar ���
. tmDefaultChar
/ tmBreakChar ��
0 tmItalic �
1 tmUnderlined �
2 tmStruckOut ��
3 tmPitchAndFamily �
4 tmCharSet
" 8 ntmFlags �
u < ntmSizeEM
u @ ntmCellHeight
u D ntmAvgWidth ��> c= H tagNEWTEXTMETRICA .?AUtagNEWTEXTMETRICA@@ d= � �
�
�
p,
� B � USN_JOURNAL_DATA_V1 .?AUUSN_JOURNAL_DATA_V1@@
h=
� �
# UsnJournalID �
FirstUsn �
NextUsn ��
LowestValidUsn ���
MaxUsn ���
# ( MaximumSize ��
# 0 AllocationDelta ��
! 8 MinSupportedMajorVersion �
! : MaxSupportedMajorVersion �B j= @ USN_JOURNAL_DATA_V1 .?AUUSN_JOURNAL_DATA_V1@@ k= � � B � USN_JOURNAL_DATA_V2 .?AUUSN_JOURNAL_DATA_V2@@
m=
� F
# UsnJournalID �
FirstUsn �
NextUsn ��
LowestValidUsn ���
MaxUsn ���
# ( MaximumSize ��
# 0 AllocationDelta ��
! 8 MinSupportedMajorVersion �
! : MaxSupportedMajorVersion �
" < Flags
# @ RangeTrackChunkSize ��
H RangeTrackFileSizeThreshold ��B o= P USN_JOURNAL_DATA_V2 .?AUUSN_JOURNAL_DATA_V2@@ p= � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" Flags
r= EnableUserShadowStack
s= AuditUserShadowStack �
t= SetContextIpValidation ���
u= AuditSetContextIpValidation ��
v= EnableUserShadowStackStrictMode ��
w= BlockNonCetBinaries ��
x= BlockNonCetBinariesNonEhcont �
y= AuditBlockNonCetBinaries �
z= CetDynamicApisOutOfProcOnly ��
{= SetContextIpValidationRelaxedMode
|= ReservedFlags v }= _PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY .?AU_PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY@@ �� ~= D J � _CONTAINER_VOLUME_STATE .?AU_CONTAINER_VOLUME_STATE@@
" Flags J �= _CONTAINER_VOLUME_STATE .?AU_CONTAINER_VOLUME_STATE@@ �= � �" > � MFT_ENUM_DATA_V0 .?AUMFT_ENUM_DATA_V0@@ ��
�=
� N
# StartFileReferenceNumber �
LowUsn ���
HighUsn ��> �= MFT_ENUM_DATA_V0 .?AUMFT_ENUM_DATA_V0@@ �� �= � �
/
�
�
� 6 � tagENUMUILANG .?AUtagENUMUILANG@@ V
" NumOfEnumUILang ��
" SizeOfEnumUIBuffer ���
q pEnumUIBuffer 6 �= tagENUMUILANG .?AUtagENUMUILANG@@ �= � ( J � _EVENT_FILTER_EVENT_ID .?AU_EVENT_FILTER_EVENT_ID@@ ��N
FilterIn �
Reserved �
! Count
s Events ���J �= _EVENT_FILTER_EVENT_ID .?AU_EVENT_FILTER_EVENT_ID@@ �� �= = c
X
� Z � _ACTIVATION_CONTEXT_QUERY_INDEX .?AU_ACTIVATION_CONTEXT_QUERY_INDEX@@
�=
� >
" ulAssemblyIndex ��
" ulFileIndexInAssembly Z �= _ACTIVATION_CONTEXT_QUERY_INDEX .?AU_ACTIVATION_CONTEXT_QUERY_INDEX@@ �= � a J � _IMAGE_ENCLAVE_CONFIG64 .?AU_IMAGE_ENCLAVE_CONFIG64@@ F
" Size �
" MinimumRequiredConfigSize
" PolicyFlags ��
" NumberOfImports ��
" ImportList ���
" ImportEntrySize ��
o FamilyID �
o ( ImageID ��
" 8 ImageVersion �
" < SecurityVersion ��
# @ EnclaveSize ��
" H NumberOfThreads ��
" L EnclaveFlags �J
�= P _IMAGE_ENCLAVE_CONFIG64 .?AU_IMAGE_ENCLAVE_CONFIG64@@ �= � s N � _IMAGE_IMPORT_DESCRIPTOR .?AU_IMAGE_IMPORT_DESCRIPTOR@@ ��
�= ��
�=
� �
" Characteristics ��
" OriginalFirstThunk ���
" TimeDateStamp
" ForwarderChain ���
" Name �
" FirstThunk ���N �= _IMAGE_IMPORT_DESCRIPTOR .?AU_IMAGE_IMPORT_DESCRIPTOR@@ �� �= � � V � tagPOINTER_DEVICE_CURSOR_INFO .?AUtagPOINTER_DEVICE_CURSOR_INFO@@ � POINTER_DEVICE_CURSOR_TYPE_UNKNOWN ��� POINTER_DEVICE_CURSOR_TYPE_TIP ��� POINTER_DEVICE_CURSOR_TYPE_ERASER ��POINTER_DEVICE_CURSOR_TYPE_MAX ��R t �= tagPOINTER_DEVICE_CURSOR_TYPE .?AW4tagPOINTER_DEVICE_CURSOR_TYPE@@ � �= ~ �; *
u cursorId �
�= cursor ���V �= tagPOINTER_DEVICE_CURSOR_INFO .?AUtagPOINTER_DEVICE_CURSOR_INFO@@ �= ~ �; V � _SYSTEM_INTERRUPT_INFORMATION .?AU_SYSTEM_INTERRUPT_INFORMATION@@ �
" ContextSwitches ��
" DpcCount �
" DpcRate ��
" TimeIncrement
" DpcBypassCount ���
" ApcBypassCount ���V �= _SYSTEM_INTERRUPT_INFORMATION .?AU_SYSTEM_INTERRUPT_INFORMATION@@ �= � �
N � _PS_CPU_QUOTA_QUERY_ENTRY .?AU_PS_CPU_QUOTA_QUERY_ENTRY@@
�=
� *
" SessionId
" Weight ���N �= _PS_CPU_QUOTA_QUERY_ENTRY .?AU_PS_CPU_QUOTA_QUERY_ENTRY@@ �= �
�+
� F � _HEAP_COMMIT_DECOMMIT .?AU_HEAP_COMMIT_DECOMMIT@@ &
m Header ���
Event F �= 0 _HEAP_COMMIT_DECOMMIT .?AU_HEAP_COMMIT_DECOMMIT@@ �= b 1
"
� B � _RTL_GENERIC_TABLE .?AU_RTL_GENERIC_TABLE@@ ��
�=
� �= �$ �=
�=
� �= " �=
�=
� �= �=
�=
� �
c TableRoot
! InsertOrderList ��
H OrderedPointer ���
" WhichOrderedElement ��
" NumberGenericTableElements ���
�= CompareRoutine ���
�= AllocateRoutine ��
�= FreeRoutine ��
$ TableContext �B �= ( _RTL_GENERIC_TABLE .?AU_RTL_GENERIC_TABLE@@ �� �= g �
�.
� "
$ fsUsb
$ fsCsb > �= tagFONTSIGNATURE .?AUtagFONTSIGNATURE@@ �� �= � � : � _FILE_PREFETCH .?AU_FILE_PREFETCH@@ ��6
" Type �
" Count
�/ Prefetch �: �= _FILE_PREFETCH .?AU_FILE_PREFETCH@@ �� �= � � R � _SILOOBJECT_ROOT_DIRECTORY .?AU_SILOOBJECT_ROOT_DIRECTORY@@ ��
�=
� *
" ControlFlags �
Path �R �= _SILOOBJECT_ROOT_DIRECTORY .?AU_SILOOBJECT_ROOT_DIRECTORY@@ �� �= D � b � _ACCESS_DENIED_CALLBACK_OBJECT_ACE .?AU_ACCESS_DENIED_CALLBACK_OBJECT_ACE@@ ��
� Header ���
" Mask �
" Flags
$ ObjectType ���
$ InheritedObjectType ��
" , SidStart �b �= 0 _ACCESS_DENIED_CALLBACK_OBJECT_ACE .?AU_ACCESS_DENIED_CALLBACK_OBJECT_ACE@@ �� �= w b � _MIDL_WINRT_TYPE_SERIALIZATION_INFO .?AU_MIDL_WINRT_TYPE_SERIALIZATION_INFO@@ z
" Version ��
J TypeFormatString �
! FormatStringSize �
!
TypeOffset ���
^( StubDesc �b �= _MIDL_WINRT_TYPE_SERIALIZATION_INFO .?AU_MIDL_WINRT_TYPE_SERIALIZATION_INFO@@ �= � � > � _PSFEATURE_OUTPUT .?AU_PSFEATURE_OUTPUT@@
�=
� :
t bPageIndependent �
t bSetPageDevice ���> �= _PSFEATURE_OUTPUT .?AU_PSFEATURE_OUTPUT@@ �= �
�
� 6 � tagSCROLLINFO .?AUtagSCROLLINFO@@ z
u cbSize ���
u fMask
t nMin �
t nMax �
u nPage
t nPos �
t nTrackPos 6 �= tagSCROLLINFO .?AUtagSCROLLINFO@@ �= ~ �. " �&
" Count
�= BindingH �B �= _RPC_BINDING_VECTOR .?AU_RPC_BINDING_VECTOR@@ �= ^ _ N � _FSCTL_OFFLOAD_READ_INPUT .?AU_FSCTL_OFFLOAD_READ_INPUT@@ �
" Size �
" Flags
" TokenTimeToLive ��
" Reserved �
# FileOffset ���
# CopyLength ���N �= _FSCTL_OFFLOAD_READ_INPUT .?AU_FSCTL_OFFLOAD_READ_INPUT@@ �= � �
5
� n � _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS .?AU_SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS@@
KeyHandle
{ ValueNamePointer �
" RequiredLengthPointer
Buffer ���
" BufferLength �
" Type �
AppendBuffer �
" AppendBufferLength ���
CreateIfDoesntExist ��
! TruncateExistingValue n
�= $ _SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS .?AU_SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS@@ �= � �
�
�
" Reserved �F �= _SD_QUERY_STATS_INPUT .?AU_SD_QUERY_STATS_INPUT@@ �= � � F � _FILE_ALL_INFORMATION .?AU_FILE_ALL_INFORMATION@@
�=
� J � _FILE_BASIC_INFORMATION .?AU_FILE_BASIC_INFORMATION@@ R � _FILE_POSITION_INFORMATION .?AU_FILE_POSITION_INFORMATION@@ ��
�= BasicInformation �
�2 ( StandardInformation ��
�( @ InternalInformation ��
� H EaInformation
: L AccessInformation
�= P PositionInformation ��
@ X ModeInformation ��
�" \ AlignmentInformation �
�9 ` NameInformation ��F �= h _FILE_ALL_INFORMATION .?AU_FILE_ALL_INFORMATION@@ �= � F � CM_EXTENDED_PARAMETER .?AUCM_EXTENDED_PARAMETER@@
�=
�
# ��
# 8��
> Type �
> Reserved �
# ULong64 ��
Pointer ��
" Size �
Handle ���
" ULong
" AccessMask ���F > CM_EXTENDED_PARAMETER .?AUCM_EXTENDED_PARAMETER@@ > � 6 � _BOOT_RECORD .?AU_BOOT_RECORD@@ ��
# BootFlags
" FirmwareType �
SecureBootEnabled
SecureBootCapable
Reserved1
Reserved2 6 > _BOOT_RECORD .?AU_BOOT_RECORD@@ �� > b � . � _OBJECTID .?AU_OBJECTID@@ .
$ Lineage ��
" Uniquifier ���.
> _OBJECTID .?AU_OBJECTID@@ > b u t
>
>
�
> >
>
�
� ~ MemoryLocationInvalid MemoryLocationResident ��� MemoryLocationPagefile ��� MemoryLocationReserved ���V t > _MEMORY_WORKING_SET_EX_LOCATION .?AW4_MEMORY_WORKING_SET_EX_LOCATION@@ � > w C V � _FILE_END_OF_FILE_INFORMATION .?AU_FILE_END_OF_FILE_INFORMATION@@
� EndOfFile V > _FILE_END_OF_FILE_INFORMATION .?AU_FILE_END_OF_FILE_INFORMATION@@ > � � V � _UMS_CREATE_THREAD_ATTRIBUTES .?AU_UMS_CREATE_THREAD_ATTRIBUTES@@
>
� �
" UmsVersion ���
� RtlUmsContext
UmsContext ���
� RtlUmsCompletionList �
UmsCompletionList V > _UMS_CREATE_THREAD_ATTRIBUTES .?AU_UMS_CREATE_THREAD_ATTRIBUTES@@ > D R > � _IMAGE_DEBUG_MISC .?AU_IMAGE_DEBUG_MISC@@ b
" DataType �
" Length ���
Unicode ��
, Reserved �
� Data �> !> _IMAGE_DEBUG_MISC .?AU_IMAGE_DEBUG_MISC@@ "> � � b � _PERFINFO_DPC_EXECUTION_INFORMATION .?AU_PERFINFO_DPC_EXECUTION_INFORMATION@@ *
DpcRoutine ���
" Key ��b %> _PERFINFO_DPC_EXECUTION_INFORMATION .?AU_PERFINFO_DPC_EXECUTION_INFORMATION@@ &> b � *
" Frequency
" Power
PercentFrequency �
IncreaseLevel
DecreaseLevel
Type �
" IncreaseTime �
" DecreaseTime �
# Control ��
# Status ���
" ( HitCount �
" , Reserved1
# 0 Reserved2
# 8 Reserved3 B (> @ PPM_WMI_PERF_STATE .?AUPPM_WMI_PERF_STATE@@ �� )> { � > � tagMONITORINFOEXA .?AUtagMONITORINFOEXA@@
+>
� f
" cbSize ���
rcMonitor
rcWork ���
" $ dwFlags ��
o" ( szDevice �> -> H tagMONITORINFOEXA .?AUtagMONITORINFOEXA@@ .> ~ �4 p 0>
1>
� F � _PO_WAKE_SOURCE_TIMER .?AU_PO_WAKE_SOURCE_TIMER@@ J � _PO_WAKE_SOURCE_HEADER .?AU_PO_WAKE_SOURCE_HEADER@@ ��*
4> Header ���
g+ Reason ���F 5> _PO_WAKE_SOURCE_TIMER .?AU_PO_WAKE_SOURCE_TIMER@@ 6> { .
Z&
�
s6
� �
,4 pointerInfo ��
u X penFlags �
u \ penMask ��
u ` pressure �
u d rotation �
t h tiltX
t l tiltY B :> p tagPOINTER_PEN_INFO .?AUtagPOINTER_PEN_INFO@@ ;> ~ � R � _PROCESS_FAULT_INFORMATION .?AU_PROCESS_FAULT_INFORMATION@@ ��
=>
� 6
" FaultFlags ���
" AdditionalInfo ���R ?> _PROCESS_FAULT_INFORMATION .?AU_PROCESS_FAULT_INFORMATION@@ �� @> � ` 6 � _SYSTEM_INFO .?AU_SYSTEM_INFO@@ ��r
" dwOemId ��
! wProcessorArchitecture ���
! wReserved
" dwPageSize ���
lpMinimumApplicationAddress ��
lpMaximumApplicationAddress ��
" dwActiveProcessorMask
" dwNumberOfProcessors �
" dwProcessorType ��
" dwAllocationGranularity ��
! wProcessorLevel ��
! " wProcessorRevision ���6 C> $ _SYSTEM_INFO .?AU_SYSTEM_INFO@@ �� D> � / Z � _MANAGE_HOT_PATCH_UNLOAD_PATCH .?AU_MANAGE_HOT_PATCH_UNLOAD_PATCH@@ ��
F>
� &
P Sid ��
� Buffer ���2 H> D <anonymous-tag> .?AT<anonymous-tag>@@ I> w } >
" Version ��
/ BaseInfo �
I> UserSid ��Z K> P _MANAGE_HOT_PATCH_UNLOAD_PATCH .?AU_MANAGE_HOT_PATCH_UNLOAD_PATCH@@ �� L> w o
�
�
# ��
# ��
# ��
# <��
# ��
# ��
# ��
# <���
O> AuditState ���
P> AuditFlag
Q> EnableAdditionalAuditingOption ���
R> Reserved �
S> PolicyState ��
T> AlwaysInherit
U> EnableAdditionalPolicyOption �
V> AuditReserved N W> _RTL_IMAGE_MITIGATION_POLICY .?AT_RTL_IMAGE_MITIGATION_POLICY@@ �� X> � H X > � tagGUITHREADINFO .?AUtagGUITHREADINFO@@ ���
" cbSize ���
" flags
� hwndActive ���
� hwndFocus
� hwndCapture ��
� hwndMenuOwner
� hwndMoveSize �
� hwndCaret
rcCaret ��> \> 0 tagGUITHREADINFO .?AUtagGUITHREADINFO@@ �� ]> ~ �7 �9 f � _CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT .?AU_CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT@@ b
# VetoedFromAltitudeIntegral ���
# VetoedFromAltitudeDecimal
� Reason ���f a> _CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT .?AU_CSV_QUERY_VETO_FILE_DIRECT_IO_OUTPUT@@ b> � R � _RTL_RETPOLINE_BINARY_INFO .?AU_RTL_RETPOLINE_BINARY_INFO@@ ��
d>
� " $
f>
� �
RetpolineStubsStartRva ���
" CfgDispatchFunctionPtrRva
" IATRva ���
ImportRvas ���
" IAT ��
ImageBase
g> CheckFunction R h> _RTL_RETPOLINE_BINARY_INFO .?AU_RTL_RETPOLINE_BINARY_INFO@@ �� i> H f � _JOBOBJECT_ASSOCIATE_COMPLETION_PORT .?AU_JOBOBJECT_ASSOCIATE_COMPLETION_PORT@@ ��
k>
� 6
CompletionKey
CompletionPort ���f m> _JOBOBJECT_ASSOCIATE_COMPLETION_PORT .?AU_JOBOBJECT_ASSOCIATE_COMPLETION_PORT@@ �� n> D �
5-
� R
q>
�
�=
� �
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
" FileAttributes ���J t> ( _FILE_BASIC_INFORMATION .?AU_FILE_BASIC_INFORMATION@@ u> � � ! w>
x>
� n
" SessionId
" CpuShareWeight ���
CapturedWeightData ���
# CyclesAccumulated J z> _ETW_PER_SESSION_QUOTA .?AU_ETW_PER_SESSION_QUOTA@@ �� {> b (
6 � tagDROPSTRUCT .?AUtagDROPSTRUCT@@
}>
� ~
� hwndSource ���
� hwndSink �
" wFmt �
" dwData ���
� ptDrop ���
" dwControlData 6 > tagDROPSTRUCT .?AUtagDROPSTRUCT@@ �> ~ g N � _MEMORY_BASIC_INFORMATION .?AU_MEMORY_BASIC_INFORMATION@@
�>
� �
BaseAddress ��
AllocationBase ���
" AllocationProtect
" RegionSize ���
" State
" Protect ��
" Type �N �> _MEMORY_BASIC_INFORMATION .?AU_MEMORY_BASIC_INFORMATION@@ �> � P j � _EVENT_TRACE_STACK_CACHING_INFORMATION .?AU_EVENT_TRACE_STACK_CACHING_INFORMATION@@ ��
? EventTraceInformationClass ���
# TraceHandle ��
Enabled ��
, Reserved �
" CacheSize
" BucketCount ��j �> _EVENT_TRACE_STACK_CACHING_INFORMATION .?AU_EVENT_TRACE_STACK_CACHING_INFORMATION@@ �� �> @ N
&
� :
# Value
" EndTime ��
" Bitmap ���6 �> _TIMELINE_BITMAP .?AT_TIMELINE_BITMAP@@ �� �> � �
P=
� F � ANON_OBJECT_HEADER_V2 .?AUANON_OBJECT_HEADER_V2@@ �
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
$ ClassID ��
" SizeOfData ���
" Flags
" $ MetaDataSize �
" ( MetaDataOffset ���F
�> , ANON_OBJECT_HEADER_V2 .?AUANON_OBJECT_HEADER_V2@@ �> � �
� B � tagEMREXTFLOODFILL .?AUtagEMREXTFLOODFILL@@ ��
�>
� J
� emr ��
� ptlStart �
" crColor ��
" iMode B �> tagEMREXTFLOODFILL .?AUtagEMREXTFLOODFILL@@ �� �> � V � _PROCESS_WS_WATCH_INFORMATION .?AU_PROCESS_WS_WATCH_INFORMATION@@
�>
� 2
FaultingPc ���
FaultingVa ���V �> _PROCESS_WS_WATCH_INFORMATION .?AU_PROCESS_WS_WATCH_INFORMATION@@ �> D �
�4
�
! Size �
! HeaderType ���
! Flags
! EventProperty
" ThreadId �
" ProcessId
� TimeStamp
$ ProviderId ���
? ( EventDescriptor ��
" 8 KernelTime ���
" < UserTime �
# 8 ProcessorTime
$ @ ActivityId ���6
�> P _EVENT_HEADER .?AU_EVENT_HEADER@@ �> U � � � �>
C4
�
�
� �
! UniqueProcessId ��
! CreatorBackTraceIndex
ObjectTypeIndex ��
HandleAttributes �
! HandleValue ��
Object ���
" GrantedAccess Z �> _SYSTEM_HANDLE_TABLE_ENTRY_INFO .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO@@ �> � R � _SYSTEM_POWER_STATE_CONTEXT .?AU_SYSTEM_POWER_STATE_CONTEXT@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�> Reserved1
�> TargetSystemState
�> EffectiveSystemState �
�> CurrentSystemState ���
�> IgnoreHibernationPath
�> PseudoTransition �
�> KernelSoftReboot �
�> DirectedDripsTransition ��
�> Reserved2
" ContextAsUlong ���R
�> _SYSTEM_POWER_STATE_CONTEXT .?AU_SYSTEM_POWER_STATE_CONTEXT@@ �> { � ^ � _CSV_QUERY_VOLUME_REDIRECT_STATE .?AU_CSV_QUERY_VOLUME_REDIRECT_STATE@@ ��
" MdsNodeId
" DsNodeId �
IsDiskConnected ��
ClusterEnableDirectIo
# DiskConnectivity �^ �> _CSV_QUERY_VOLUME_REDIRECT_STATE .?AU_CSV_QUERY_VOLUME_REDIRECT_STATE@@ �� �> � �
�
=
� B � tagEMRSETTEXTCOLOR .?AUtagEMRSETTEXTCOLOR@@ ��&
� emr ��
" crColor ��B �> tagEMRSETTEXTCOLOR .?AUtagEMRSETTEXTCOLOR@@ �� �> � �
Z%
� F
t valuelen �
value_context
val_buff_ptr �2 �> val_context .?AUval_context@@ �> � � V � _REPAIR_STORAGE_RESERVE_INPUT .?AU_REPAIR_STORAGE_RESERVE_INPUT@@ j
" Version ��
" Flags
" AreaIdOffset �
" AreaIdCount ��
m AreaId ���V �> _REPAIR_STORAGE_RESERVE_INPUT .?AU_REPAIR_STORAGE_RESERVE_INPUT@@ �> � <+ . � _ABCFLOAT .?AU_ABCFLOAT@@ 2
@ abcfA
@ abcfB
@ abcfC .
�> _ABCFLOAT .?AU_ABCFLOAT@@ �> � � F
� type �
u size �
� adapterId
u id ���^ �> DISPLAYCONFIG_DEVICE_INFO_HEADER .?AUDISPLAYCONFIG_DEVICE_INFO_HEADER@@ �� �> � � ^ � _CFG_CALL_TARGET_LIST_INFORMATION .?AU_CFG_CALL_TARGET_LIST_INFORMATION@@
�>
� F � _CFG_CALL_TARGET_INFO .?AU_CFG_CALL_TARGET_INFO@@
�>
� �
" NumberOfEntries ��
" Reserved �
" NumberOfEntriesProcessed �
�> CallTargetInfo ���
Section ��
# FileOffset ���^ �> _CFG_CALL_TARGET_LIST_INFORMATION .?AU_CFG_CALL_TARGET_LIST_INFORMATION@@ �> � � J � BREAK_ON_STATUS_BUFFER .?AUBREAK_ON_STATUS_BUFFER@@ ��
�>
� p " �n
NtStatus �
" Win32Error ���
" ThreadId �
" ProcessId
�> ImageFileName J �> BREAK_ON_STATUS_BUFFER .?AUBREAK_ON_STATUS_BUFFER@@ �� �> � �
�'
� n � _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY@@
�>
� �
# Offset ���
" NameFlags
FileId ���
" Reserved1
" Reserved2
Reserved3
( FileName �n �> 0 _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY .?AU_TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY@@ �> � �
" ��
" ��
" ��z
" Flags
�> DisallowWin32kSystemCalls
�> AuditDisallowWin32kSystemCalls ���
�> ReservedFlags z �> _PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY .?AU_PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY@@ �� �> D c Z � _ETW_TP_EVENT_TIMER_SET_NTTIMER .?AU_ETW_TP_EVENT_TIMER_SET_NTTIMER@@ Z
m Header ���
DueTime ��
( SubQueue �
" , TolerableDelay ���Z �> 0 _ETW_TP_EVENT_TIMER_SET_NTTIMER .?AU_ETW_TP_EVENT_TIMER_SET_NTTIMER@@ �> b &
0
� Z � _POWER_THROTTLING_PROCESS_STATE .?AU_POWER_THROTTLING_PROCESS_STATE@@ B
" Version ��
" ControlMask ��
" StateMask Z �> _POWER_THROTTLING_PROCESS_STATE .?AU_POWER_THROTTLING_PROCESS_STATE@@ �> D � ^ � _EVENT_EXTENDED_ITEM_PMC_COUNTERS .?AU_EVENT_EXTENDED_ITEM_PMC_COUNTERS@@
= Counter ��^ �> _EVENT_EXTENDED_ITEM_PMC_COUNTERS .?AU_EVENT_EXTENDED_ITEM_PMC_COUNTERS@@ �> U v V � _SYSTEM_VHD_BOOT_INFORMATION .?AU_SYSTEM_VHD_BOOT_INFORMATION@@ ��V
OsDiskIsVhd ��
" OsVhdFilePathOffset ��
OsVhdParentVolume V �> _SYSTEM_VHD_BOOT_INFORMATION .?AU_SYSTEM_VHD_BOOT_INFORMATION@@ �� �> � �
J � _PERFINFO_PO_POSTSLEEP .?AU_PERFINFO_PO_POSTSLEEP@@ ��
�>
� "
� PerformanceCounter ���J �> _PERFINFO_PO_POSTSLEEP .?AU_PERFINFO_PO_POSTSLEEP@@ �� �> b �
=&
� ^ � _PROCESS_WS_WATCH_INFORMATION_EX .?AU_PROCESS_WS_WATCH_INFORMATION_EX@@ ��B
�> BasicInfo
" FaultingThreadId �
" Flags ^ ? _PROCESS_WS_WATCH_INFORMATION_EX .?AU_PROCESS_WS_WATCH_INFORMATION_EX@@ �� ? � � Z � _PERFINFO_FLT_OPERATION_STATUS .?AU_PERFINFO_FLT_OPERATION_STATUS@@ ��
RoutineAddr ��
FileObject ���
FsContext
IrpPtr ���
CbdPtr ���
MajorFunction
Status ���Z ? _PERFINFO_FLT_OPERATION_STATUS .?AU_PERFINFO_FLT_OPERATION_STATUS@@ �� ? b � v � _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION .?AU_SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION@@ ��
Enabled ��v ? _SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION .?AU_SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION@@ ��
? � [ * � _FP_128 .?AU_FP_128@@
� W *
? _FP_128 .?AU_FP_128@@ ? � B 2 � tagPELARRAY .?AUtagPELARRAY@@
?
� f
paXCount �
paYCount �
paXExt ���
paYExt ���
paRGBs ���2 ? tagPELARRAY .?AUtagPELARRAY@@ ? � ; : � _BOOT_AREA_INFO .?AU_BOOT_AREA_INFO@@
� Offset ���: ? <anonymous-tag> .?AU<anonymous-tag>@@ ? � > ? " �6
" BootSectorCount ��
? BootSectors ��: ? _BOOT_AREA_INFO .?AU_BOOT_AREA_INFO@@ ? � ;
�
� : � _PRIVILEGE_SET .?AU_PRIVILEGE_SET@@ ��
?
� �' " �F
" PrivilegeCount ���
" Control ��
? Privilege : !? _PRIVILEGE_SET .?AU_PRIVILEGE_SET@@ �� "? w � b � _PERFINFO_SESSIONCREATE_INFORMATION .?AU_PERFINFO_SESSIONCREATE_INFORMATION@@ 2
" UniqueSessionId ��
" SessionId b %? _PERFINFO_SESSIONCREATE_INFORMATION .?AU_PERFINFO_SESSIONCREATE_INFORMATION@@ &? b �
1
�
�
�
4+
� N � _RTL_UNLOAD_EVENT_TRACE64 .?AU_RTL_UNLOAD_EVENT_TRACE64@@ �
# BaseAddress ��
# SizeOfImage ��
" Sequence �
" TimeDateStamp
" CheckSum �
ImageName
7 \ Version ��N ,? h _RTL_UNLOAD_EVENT_TRACE64 .?AU_RTL_UNLOAD_EVENT_TRACE64@@ -? � � Z � _FILE_PIPE_CREATE_SYMLINK_INPUT .?AU_FILE_PIPE_CREATE_SYMLINK_INPUT@@
/?
� �
! NameOffset ���
! NameLength ���
! SubstituteNameOffset �
! SubstituteNameLength �
" Flags Z 1? _FILE_PIPE_CREATE_SYMLINK_INPUT .?AU_FILE_PIPE_CREATE_SYMLINK_INPUT@@ 2? � x) J � _LDR_VERIFY_IMAGE_INFO .?AU_LDR_VERIFY_IMAGE_INFO@@ ��N � _LDR_IMPORT_CALLBACK_INFO .?AU_LDR_IMPORT_CALLBACK_INFO@@ r
" Size �
" Flags
5? CallbackInfo �
m SectionInfo ��
! $ ImageCharacteristics �J 6? ( _LDR_VERIFY_IMAGE_INFO .?AU_LDR_VERIFY_IMAGE_INFO@@ �� 7? � � 6
! CodePage �
! MaximumCharacterSize �
! DefaultChar ��
! UniDefaultChar ���
! TransDefaultChar �
!
TransUniDefaultChar ��
! DBCSCodePage �
p LeadByte �
q MultiByteTable ���
WideCharTable
q $ DBCSRanges ���
q ( DBCSOffsets ��6 9? , _CPTABLEINFO .?AU_CPTABLEINFO@@ �� :? d- $
�:
�
9
�
u t >?
+%
�
� # " 0 �B
# Mask �
# CompactionMask ���
B? Reserved2 B C? @ _XSAVE_AREA_HEADER .?AU_XSAVE_AREA_HEADER@@ �� D? K
�>
� V � tagTouchPredictionParameters .?AUtagTouchPredictionParameters@@ ��^
u cbSize ���
u dwLatency
u dwSampleTime �
u bUseHWTimeStamp ��V H? tagTouchPredictionParameters .?AUtagTouchPredictionParameters@@ �� I? ~ �0 b � _SYSTEM_WATCHDOG_TIMER_INFORMATION .?AU_SYSTEM_WATCHDOG_TIMER_INFORMATION@@ ��.
WdInfoClass ��
" DataValue b L? _SYSTEM_WATCHDOG_TIMER_INFORMATION .?AU_SYSTEM_WATCHDOG_TIMER_INFORMATION@@ �� M? � M
V � _FILE_VOLUME_NAME_INFORMATION .?AU_FILE_VOLUME_NAME_INFORMATION@@
O?
� 6
" DeviceNameLength �
DeviceName ���V Q? _FILE_VOLUME_NAME_INFORMATION .?AU_FILE_VOLUME_NAME_INFORMATION@@ R? � �
�
�
�2
�
f4
�
W-
� T- " W? " X?
Y?
� � � � [? f � _SYSTEM_CRASH_DUMP_STATE_INFORMATION .?AU_SYSTEM_CRASH_DUMP_STATE_INFORMATION@@ ��*
A" CrashDumpConfigurationClass ��f ^? _SYSTEM_CRASH_DUMP_STATE_INFORMATION .?AU_SYSTEM_CRASH_DUMP_STATE_INFORMATION@@ �� _? � ,
�*
� a? " b?
c?
� ^
! wVk ��
! wScan
" dwFlags ��
" time �
" dwExtraInfo ��6 e? tagKEYBDINPUT .?AUtagKEYBDINPUT@@ f? ~ �
�1
�
�1
� N � _IMAGE_CHPE_METADATA_X86 .?AU_IMAGE_CHPE_METADATA_X86@@ ��
" Version ��
" CHPECodeAddressRangeOffset ���
" CHPECodeAddressRangeCount
" WowA64ExceptionHandlerFunctionPointer
" WowA64DispatchCallFunctionPointer
" WowA64DispatchIndirectCallFunctionPointer
" WowA64DispatchIndirectCallCfgFunctionPointer �
" WowA64DispatchRetFunctionPointer �
" WowA64DispatchRetLeafFunctionPointer �
" $ WowA64DispatchJumpFunctionPointer
" ( CompilerIATPointer ���
" , WowA64RdtscFunctionPointer ���N k? 0 _IMAGE_CHPE_METADATA_X86 .?AU_IMAGE_CHPE_METADATA_X86@@ �� l? � g
�; PfnIdentity ��> n? _MM_ETW_PAGE_INFO .?AU_MM_ETW_PAGE_INFO@@ o? w O
t q? J � _PO_WAKE_SOURCE_DEVICE .?AU_PO_WAKE_SOURCE_DEVICE@@ ��.
4> Header ���
InstancePath �J t? _PO_WAKE_SOURCE_DEVICE .?AU_PO_WAKE_SOURCE_DEVICE@@ �� u? {
�<
� �
Header ���
" 0 InstanceId ���
" 4 ParentInstanceId �
$ 8 ParentGuid ���
H MofData ��
" L MofLength
" P ClientContext
P P BufferContext 6 x? X _EVENT_TRACE .?AU_EVENT_TRACE@@ �� y? � N � _RTL_UNLOAD_EVENT_TRACE32 .?AU_RTL_UNLOAD_EVENT_TRACE32@@ �
" BaseAddress ��
" SizeOfImage ��
" Sequence �
" TimeDateStamp
" CheckSum �
ImageName
7 T Version ��N |? \ _RTL_UNLOAD_EVENT_TRACE32 .?AU_RTL_UNLOAD_EVENT_TRACE32@@ }? � � N � _SYSTEM_BASIC_INFORMATION .?AU_SYSTEM_BASIC_INFORMATION@@ ^
" Reserved �
" TimerResolution ��
" PageSize �
" NumberOfPhysicalPages
" LowestPhysicalPageNumber �
" HighestPhysicalPageNumber
" AllocationGranularity
" MinimumUserModeAddress ���
" MaximumUserModeAddress ���
" $ ActiveProcessorsAffinityMask �
p ( NumberOfProcessors ���N �? , _SYSTEM_BASIC_INFORMATION .?AU_SYSTEM_BASIC_INFORMATION@@ �? � � J � MENUITEMTEMPLATEHEADER .?AUMENUITEMTEMPLATEHEADER@@ ��
�?
� .
! versionNumber
! offset ���J �? MENUITEMTEMPLATEHEADER .?AUMENUITEMTEMPLATEHEADER@@ �� �? ~ �(
v)
� * IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF ��B t �? IMAGE_AUX_SYMBOL_TYPE .?AW4IMAGE_AUX_SYMBOL_TYPE@@ � �? � [ � " �R
! Version ��
! Revision �
" Count
�? Descriptors ��> �? ( _IO_RESOURCE_LIST .?AU_IO_RESOURCE_LIST@@ �?
w(
�
_&
�
�
� n ��DPI_HOSTING_BEHAVIOR_INVALID DPI_HOSTING_BEHAVIOR_DEFAULT � DPI_HOSTING_BEHAVIOR_MIXED ���B t �? DPI_HOSTING_BEHAVIOR .?AW4DPI_HOSTING_BEHAVIOR@@ ��� �? s N � _QUERY_BAD_RANGES_OUTPUT .?AU_QUERY_BAD_RANGES_OUTPUT@@ �� �% " �^
" Flags
" NumBadRanges �
# NextOffsetToLookUp ���
�? BadRanges N �? ( _QUERY_BAD_RANGES_OUTPUT .?AU_QUERY_BAD_RANGES_OUTPUT@@ �� �? � S!
�
�
�<
� N � _SYSTEM_ACCESS_FILTER_ACE .?AU_SYSTEM_ACCESS_FILTER_ACE@@
�?
� :
� Header ���
" Mask �
" SidStart �N �? _SYSTEM_ACCESS_FILTER_ACE .?AU_SYSTEM_ACCESS_FILTER_ACE@@ �? w � F � _COMPRESSED_DATA_INFO .?AU_COMPRESSED_DATA_INFO@@ �
! CompressionFormatAndEngine ���
CompressionUnitShift �
ChunkShift ���
ClusterShift �
Reserved �
! NumberOfChunks ���
� CompressedChunkSizes �F �? _COMPRESSED_DATA_INFO .?AU_COMPRESSED_DATA_INFO@@ �? g �
( �?
:
� Z � _ENCLAVE_CREATE_INFO_VBS_BASIC .?AU_ENCLAVE_CREATE_INFO_VBS_BASIC@@ ��
�?
� &
" Flags
� OwnerID ��Z �? $ _ENCLAVE_CREATE_INFO_VBS_BASIC .?AU_ENCLAVE_CREATE_INFO_VBS_BASIC@@ �� �? � �
|'
�
�0
� h �? r � _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE@@ 2
# TimeAdjustment ���
Enable ���r �? _SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_SET_TIME_ADJUST_INFORMATION_PRECISE@@ �? � t V � _EXTENDED_ENCRYPTED_DATA_INFO .?AU_EXTENDED_ENCRYPTED_DATA_INFO@@ R
" ExtendedCode �
" Length ���
" Flags
" Reserved �V �? _EXTENDED_ENCRYPTED_DATA_INFO .?AU_EXTENDED_ENCRYPTED_DATA_INFO@@ �? � � B � _REMOTE_NAME_INFOA .?AU_REMOTE_NAME_INFOA@@ ��V
p lpUniversalName ��
p lpConnectionName �
p lpRemainingPath ��B �? _REMOTE_NAME_INFOA .?AU_REMOTE_NAME_INFOA@@ �� �? � � J � _IMAGE_TLS_DIRECTORY64 .?AU_IMAGE_TLS_DIRECTORY64@@ ��
" ��
" ��
" ���
# StartAddressOfRawData
# EndAddressOfRawData ��
# AddressOfIndex ���
# AddressOfCallBacks ���
" SizeOfZeroFill ���
" $ Characteristics ��
�? $ Reserved0
�? $ Alignment
�? $ Reserved1 J �? ( _IMAGE_TLS_DIRECTORY64 .?AU_IMAGE_TLS_DIRECTORY64@@ �� �? � � N � _PO_WAKE_SOURCE_INTERNAL .?AU_PO_WAKE_SOURCE_INTERNAL@@ ��
�?
� :
4> Header ���
t InternalWakeSourceType ���N �? _PO_WAKE_SOURCE_INTERNAL .?AU_PO_WAKE_SOURCE_INTERNAL@@ �� �? { '
f � _EVENT_TRACE_SOFT_RESTART_INFORMATION .?AU_EVENT_TRACE_SOFT_RESTART_INFORMATION@@ v
? EventTraceInformationClass ���
# TraceHandle ��
PersistTraceBuffers ��
FileName �f �? _EVENT_TRACE_SOFT_RESTART_INFORMATION .?AU_EVENT_TRACE_SOFT_RESTART_INFORMATION@@ �? @ W
7( ��
�?
� V � _PLUGPLAY_CUSTOM_NOTIFICATION .?AU_PLUGPLAY_CUSTOM_NOTIFICATION@@
�?
� F � _PLUGPLAY_NOTIFY_HDR .?AU_PLUGPLAY_NOTIFY_HDR@@ ��j
�? HeaderInfo ���
FileObject ���
NameBufferOffset �
� CustomDataBuffer �V �? _PLUGPLAY_CUSTOM_NOTIFICATION .?AU_PLUGPLAY_CUSTOM_NOTIFICATION@@ �? $ � �
�?
� F
Left �
Top ��
Right
Bottom ���2 �? _SMALL_RECT .?AU_SMALL_RECT@@ �? � ) b � _JOBOBJECT_CONTAINER_IDENTIFIER_V2 .?AU_JOBOBJECT_CONTAINER_IDENTIFIER_V2@@ ��
�?
� J
$ ContainerId ��
$ ContainerTelemetryId �
" JobId b �? $ _JOBOBJECT_CONTAINER_IDENTIFIER_V2 .?AU_JOBOBJECT_CONTAINER_IDENTIFIER_V2@@ �� �? � f
S
�
�
� B � _OSVERSIONINFOEX2A .?AU_OSVERSIONINFOEX2A@@ ��
�?
� N
" dwOSVersionInfoSize ��
" dwMajorVersion ���
" dwMinorVersion ���
" dwBuildNumber
" dwPlatformId �
szCSDVersion �
! � wServicePackMajor
! � wServicePackMinor
! � wSuiteMask ���
� wProductType �
� wReserved
" � wSuiteMaskEx �
" � wReserved2 ���B
�? � _OSVERSIONINFOEX2A .?AU_OSVERSIONINFOEX2A@@ �� �? g �
�?
�
(8
�
�8 ��
�?
� �? �?
�?
� 2
� StartTime
� StartPerfClock ���: �? _ETW_REF_CLOCK .?AU_ETW_REF_CLOCK@@ �� �? b �
Address ��
! Type �
! CreatorBackTraceIndex
OwningThread �
LockCount
" ContentionCount ��
" EntryCount ���
RecursionCount ���
" NumberOfWaitingShared
" NumberOfWaitingExclusive �V
�? $ _RTL_PROCESS_LOCK_INFORMATION .?AU_RTL_PROCESS_LOCK_INFORMATION@@ �? �
�:
�
/
� V
� HashedName ���
# Expiration ���
" ( DataSize �
� , Data �Z �? 0 _SL_APPX_CACHE_VALUE_DESCRIPTOR .?AU_SL_APPX_CACHE_VALUE_DESCRIPTOR@@ �? � � q " t �?
�?
� � DISPLAYCONFIG_MODE_INFO_TYPE_SOURCE �� DISPLAYCONFIG_MODE_INFO_TYPE_TARGET �� DISPLAYCONFIG_MODE_INFO_TYPE_DESKTOP_IMAGE ��� ��DISPLAYCONFIG_MODE_INFO_TYPE_FORCE_UINT32 ���R t �? DISPLAYCONFIG_MODE_INFO_TYPE .?AW4DISPLAYCONFIG_MODE_INFO_TYPE@@ ��� �? � J Z � _SYSTEM_CPU_SET_TAG_INFORMATION .?AU_SYSTEM_CPU_SET_TAG_INFORMATION@@
�?
� &
# Tag ��
= CpuSets ��Z @ _SYSTEM_CPU_SET_TAG_INFORMATION .?AU_SYSTEM_CPU_SET_TAG_INFORMATION@@ @ � � �
Object ���
" UniqueProcessId ��
" HandleValue ��
" GrantedAccess
! CreatorBackTraceIndex
! ObjectTypeIndex ��
" HandleAttributes �
" Reserved �b @ _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX .?AU_SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX@@ �� @ � R � _FILE_BOTH_DIR_INFORMATION .?AU_FILE_BOTH_DIR_INFORMATION@@ ��
@
� V
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
p D ShortNameLength ��
� F ShortName
^ FileName �R @ ` _FILE_BOTH_DIR_INFORMATION .?AU_FILE_BOTH_DIR_INFORMATION@@ ��
@ �
�)
�
�&
� 1
@ 1 9/ @ " " @
@
�
`
� : � _FP_IEEE_RECORD .?AU_FP_IEEE_RECORD@@ : � _FP_IEEE_VALUE .?AU_FP_IEEE_VALUE@@ ��>
@ Operand1 �
@ Operand2 �
@ 0 Result ���: @ H _FP_IEEE_RECORD .?AU_FP_IEEE_RECORD@@ @ � �
;
�
�!
�
y1
�
�
�
" ��
" ��
" ��
" ��
" ��
" Flags
@ ProhibitDynamicCode ��
@ AllowThreadOptOut
@ AllowRemoteDowngrade �
!@ AuditProhibitDynamicCode �
"@ ReservedFlags j #@ _PROCESS_MITIGATION_DYNAMIC_CODE_POLICY .?AU_PROCESS_MITIGATION_DYNAMIC_CODE_POLICY@@ $@ D x
E= ��
&@
�
�
�
Y5
� j EtwCompressionModeRestart EtwCompressionModeNoDisable �� EtwCompressionModeNoRestart ��V t *@ ETW_COMPRESSION_RESUMPTION_MODE .?AW4ETW_COMPRESSION_RESUMPTION_MODE@@ � +@ � " -@
.@
� V � _ETW_KERNEL_HEADER_EXTENSION .?AU_ETW_KERNEL_HEADER_EXTENSION@@ ��.
] GroupMasks ���
" Version ��V 1@ $ _ETW_KERNEL_HEADER_EXTENSION .?AU_ETW_KERNEL_HEADER_EXTENSION@@ �� 2@ @ � 2 � SC_HANDLE__ .?AUSC_HANDLE__@@
t unused ���2 5@ SC_HANDLE__ .?AUSC_HANDLE__@@ 6@ � � N � SYSTEM_POWER_CAPABILITIES .?AUSYSTEM_POWER_CAPABILITIES@@
8@
� J � BATTERY_REPORTING_SCALE .?AUBATTERY_REPORTING_SCALE@@ :@ " �R
PowerButtonPresent ���
SleepButtonPresent ���
LidPresent ���
SystemS1 �
SystemS2 �
SystemS3 �
SystemS4 �
SystemS5 �
HiberFilePresent �
FullWake �
VideoDimPresent ��
ApmPresent ���
UpsPresent ���
ThermalControl ���
ProcessorThrottle
ProcessorMinThrottle �
ProcessorMaxThrottle �
FastSystemS4 �
Hiberboot
WakeAlarmPresent �
AoAc �
DiskSpinDown �
HiberFileType
AoAcConnectivitySupported
q spare3 ���
SystemBatteriesPresent ���
BatteriesAreShortTerm
;@ BatteryScale �
� 8 AcOnLineWake �
� < SoftLidWake ��
� @ RtcWake ��
� D MinDeviceWakeState ���
� H DefaultLowLatencyWake N ! <@ L SYSTEM_POWER_CAPABILITIES .?AUSYSTEM_POWER_CAPABILITIES@@ =@ { �
C'
� B � _GRADIENT_TRIANGLE .?AU_GRADIENT_TRIANGLE@@ ��>
" Vertex1 ��
" Vertex2 ��
" Vertex3 ��B A@ _GRADIENT_TRIANGLE .?AU_GRADIENT_TRIANGLE@@ �� B@ � 3 ^ � _TIMER_SET_COALESCABLE_TIMER_INFO .?AU_TIMER_SET_COALESCABLE_TIMER_INFO@@
D@
�
\"
� J � _COUNTED_REASON_CONTEXT .?AU_COUNTED_REASON_CONTEXT@@
G@
� �
� DueTime ��
F@ TimerApcRoutine ��
TimerContext �
H@ WakeContext ��
" Period ���
" TolerableDelay ���
PreviousState ^ I@ _TIMER_SET_COALESCABLE_TIMER_INFO .?AU_TIMER_SET_COALESCABLE_TIMER_INFO@@ J@ � �
�! ��
L@
� Z KernelRequester �� UserProcessRequester � UserSharedServiceRequester ���6 t N@ _REQUESTER_TYPE .?AW4_REQUESTER_TYPE@@ � O@ { �
�5
�
�<
� V � _COMPOUND_ACCESS_ALLOWED_ACE .?AU_COMPOUND_ACCESS_ALLOWED_ACE@@ ��
S@
� j
� Header ���
" Mask �
! CompoundAceType ��
!
Reserved �
" SidStart �V U@ _COMPOUND_ACCESS_ALLOWED_ACE .?AU_COMPOUND_ACCESS_ALLOWED_ACE@@ �� V@ � �
�'
�
r-
�
�
� F
BaseAddress ��
" Flags
! EntryOverhead
!
CreatorBackTraceIndex
" BytesAllocated ���
" BytesCommitted ���
" NumberOfTags �
" NumberOfEntries ��
" NumberOfPseudoTags ���
" PseudoTagGranularity �
$ Reserved �
Y@ 8 Tags �
Z@ < Entries ��F
[@ @ _RTL_HEAP_INFORMATION .?AU_RTL_HEAP_INFORMATION@@ \@ � 6
&
� > � FIND_BY_SID_DATA .?AUFIND_BY_SID_DATA@@ ��&
" Restart ��
P Sid ��> `@ FIND_BY_SID_DATA .?AUFIND_BY_SID_DATA@@ �� a@ � �
O
� 1 " �"
" Count
d@ Uuid �6 e@ _UUID_VECTOR .?AU_UUID_VECTOR@@ �� f@ ^ h Z � _FSCTL_QUERY_REGION_INFO_INPUT .?AU_FSCTL_QUERY_REGION_INFO_INPUT@@ ��
h@
� f
" Version ��
" Size �
" Flags
" NumberOfTierIds ��
� TierIds ��Z j@ _FSCTL_QUERY_REGION_INFO_INPUT .?AU_FSCTL_QUERY_REGION_INFO_INPUT@@ �� k@ � �
�.
� � AR_ENABLED ��� AR_DISABLED �� AR_SUPPRESSED AR_REMOTESESSION � AR_MULTIMON �� AR_NOSENSOR �� AR_NOT_SUPPORTED � @ AR_DOCKED � AR_LAPTOP . t n@ tagAR_STATE .?AW4tagAR_STATE@@ � o@ ~ �= Z � _SYSTEM_SECUREBOOT_INFORMATION .?AU_SYSTEM_SECUREBOOT_INFORMATION@@ ��:
SecureBootEnabled
SecureBootCapable Z r@ _SYSTEM_SECUREBOOT_INFORMATION .?AU_SYSTEM_SECUREBOOT_INFORMATION@@ �� s@ � � B � _RTL_RXACT_CONTEXT .?AU_RTL_RXACT_CONTEXT@@ ��
|7
� ^
RootRegistryKey ��
RXactKey �
HandlesValid �
v@ RXactLog �B w@ _RTL_RXACT_CONTEXT .?AU_RTL_RXACT_CONTEXT@@ �� x@ � �
�5
� " �Z
LangSpec �
! FallbackTypes
! Reserved �
{@ FallbackSpecs : |@ _MUILANGCFGNODE .?AU_MUILANGCFGNODE@@ }@ D
$?
�
m
�
H"
� 6 � tagFILTERKEYS .?AUtagFILTERKEYS@@ �
u cbSize ���
" dwFlags ��
" iWaitMSec
" iDelayMSec ���
" iRepeatMSec ��
" iBounceMSec ��6 �@ tagFILTERKEYS .?AUtagFILTERKEYS@@ �@ ~ �3 V � tagACTCTX_SECTION_KEYED_DATA .?AUtagACTCTX_SECTION_KEYED_DATA@@ ��
�@
� z � tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AUtagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ ��>
" cbSize ���
" ulDataFormatVersion ��
lpData ���
" ulLength �
lpSectionGlobalData ��
" ulSectionGlobalDataLength
lpSectionBase
" ulSectionTotalLength �
hActCtx ��
" $ ulAssemblyRosterIndex
" ( ulFlags ��
�@ , AssemblyMetadata �V �@ @ tagACTCTX_SECTION_KEYED_DATA .?AUtagACTCTX_SECTION_KEYED_DATA@@ �� �@ n � $
�@
�
2 �� �@ " �
k7
� : � _DISCDLGSTRUCTA .?AU_DISCDLGSTRUCTA@@ r
" cbStructure ��
� hwndOwner
p lpLocalName ��
p lpRemoteName �
" dwFlags ��: �@ _DISCDLGSTRUCTA .?AU_DISCDLGSTRUCTA@@ �@ � � 6 � RTL_ACE_DATA .?AURTL_ACE_DATA@@ ��
�@
�
� b
AceType ��
InheritFlags �
AceFlags �
" Mask �
�@ Sid ��6 �@ RTL_ACE_DATA .?AURTL_ACE_DATA@@ �� �@ � � V � _SEMAPHORE_BASIC_INFORMATION .?AU_SEMAPHORE_BASIC_INFORMATION@@ ��2
CurrentCount �
MaximumCount �V �@ _SEMAPHORE_BASIC_INFORMATION .?AU_SEMAPHORE_BASIC_INFORMATION@@ �� �@ � �
�
� p u u �@
�@
� > � _KEY_VALUE_ENTRY .?AU_KEY_VALUE_ENTRY@@ ��V
{ ValueName
" DataLength ���
" DataOffset ���
" Type �> �@ _KEY_VALUE_ENTRY .?AU_KEY_VALUE_ENTRY@@ �� �@ k
>
�
<
� V � _SILOOBJECT_BASIC_INFORMATION .?AU_SILOOBJECT_BASIC_INFORMATION@@
�@
� z
" SiloId ���
" SiloParentId �
" NumberOfProcesses
IsInServerSilo ���
,
Reserved �V �@ _SILOOBJECT_BASIC_INFORMATION .?AU_SILOOBJECT_BASIC_INFORMATION@@ �@ D � �
�@
�
� ��
�@
�
! ��
! ��>
�@ PageRelativeOffset ���
�@ RegisterNumber ���v �@ _IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION .?AU_IMAGE_SWITCHTABLE_BRANCH_DYNAMIC_RELOCATION@@ �� �@ � �
�
]
� Z � _PS_CPU_QUOTA_QUERY_INFORMATION .?AU_PS_CPU_QUOTA_QUERY_INFORMATION@@
�@
� �= " �:
" SessionCount �
�@ SessionInformation ���Z �@ _PS_CPU_QUOTA_QUERY_INFORMATION .?AU_PS_CPU_QUOTA_QUERY_INFORMATION@@ �@ � > � tagMENUITEMINFOW .?AUtagMENUITEMINFOW@@ ���
u cbSize ���
u fMask
u fType
u fState ���
u wID ��
� hSubMenu �
{ hbmpChecked ��
{ hbmpUnchecked
" dwItemData ���
q $ dwTypeData ���
u ( cch ��
{ , hbmpItem �> �@ 0 tagMENUITEMINFOW .?AUtagMENUITEMINFOW@@ �� �@ ~ �
�%
�
0<
�
/ " �@
�@
� F � _RPC_PROTSEQ_VECTORW .?AU_RPC_PROTSEQ_VECTORW@@ �� q " �&
u Count
�@ Protseq ��F �@ _RPC_PROTSEQ_VECTORW .?AU_RPC_PROTSEQ_VECTORW@@ �� �@ ^ �
�"
� J � DISPLAYCONFIG_MODE_INFO .?AUDISPLAYCONFIG_MODE_INFO@@ N � DISPLAYCONFIG_SOURCE_MODE .?AUDISPLAYCONFIG_SOURCE_MODE@@ ^ � DISPLAYCONFIG_DESKTOP_IMAGE_INFO .?AUDISPLAYCONFIG_DESKTOP_IMAGE_INFO@@ ��
�? infoType �
u id ���
� adapterId
�/ targetMode ���
�@ sourceMode ���
�@ desktopImageInfo �J �@ @ DISPLAYCONFIG_MODE_INFO .?AUDISPLAYCONFIG_MODE_INFO@@ �@ � o �
Data �
" AssemblyRosterIndex ��
ResolutionContext
Root �
KnownRoot
" RootCount
CancelResolution � �@ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_BEGINNING@@ �@ � z B � _TP_DEBUG_FREE_INFO .?AU_TP_DEBUG_FREE_INFO@@
" FreeListSize �B �@ _TP_DEBUG_FREE_INFO .?AU_TP_DEBUG_FREE_INFO@@ �@ � ;
�0
�
� x
� y 2 �@ tagPOINTFX .?AUtagPOINTFX@@ �� �@ � �
R � _WIN32_FILE_ATTRIBUTE_DATA .?AU_WIN32_FILE_ATTRIBUTE_DATA@@ ��
�@
� �
" dwFileAttributes �
x ftCreationTime ���
x ftLastAccessTime �
x ftLastWriteTime ��
" nFileSizeHigh
" nFileSizeLow �R �@ $ _WIN32_FILE_ATTRIBUTE_DATA .?AU_WIN32_FILE_ATTRIBUTE_DATA@@ �� �@ T X
�.
� ^ � _PERFINFO_WORKINGSET_INFORMATION .?AU_PERFINFO_WORKINGSET_INFORMATION@@ ��
�@
� R � _PERFINFO_WORKINGSET_ENTRY .?AU_PERFINFO_WORKINGSET_ENTRY@@ �� �@ " $ �&
" Count
�@ WsEntry ��^ �@ ( _PERFINFO_WORKINGSET_INFORMATION .?AU_PERFINFO_WORKINGSET_INFORMATION@@ �� �@ b � > � _PERFORMANCE_DATA .?AU_PERFORMANCE_DATA@@ �8 " ��
! Size �
Version ��
HwCountersCount ��
" ContextSwitchCount ���
# WaitReasonBitMap �
# CycleTime
" RetryCount ���
" Reserved �
�@ HwCounters ���> �@ _PERFORMANCE_DATA .?AU_PERFORMANCE_DATA@@ �@ � 3 R
# FileMapping ��
" Size �
" HashSeed �
" HashCount b �@ _ETW_COVERAGE_SAMPLER_BLOOM_FILTER .?AU_ETW_COVERAGE_SAMPLER_BLOOM_FILTER@@ �� �@ @ � J � _ETW_SET_KTIMER2_EVENT .?AU_ETW_SET_KTIMER2_EVENT@@ ��
# DueTime ��
# MaximumDueTime ���
# Period ���
" TimerKey �
" Callback �
" CallbackContextKey ���
$ Flags J �@ ( _ETW_SET_KTIMER2_EVENT .?AU_ETW_SET_KTIMER2_EVENT@@ �� �@ b � . � _COMSTAT .?AU_COMSTAT@@ ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
�@ fCtsHold �
�@ fDsrHold �
�@ fRlsdHold
�@ fXoffHold
�@ fXoffSent
�@ fEof �
�@ fTxim
A fReserved
" cbInQue ��
" cbOutQue �.
A _COMSTAT .?AU_COMSTAT@@ �� A n �
�
� R � _ETW_REFDEREF_OBJECT_EVENT .?AU_ETW_REFDEREF_OBJECT_EVENT@@ ��
A
� 6
Object ���
" Tag ��
" Count R A _ETW_REFDEREF_OBJECT_EVENT .?AU_ETW_REFDEREF_OBJECT_EVENT@@ �� A b p
2 � _NIC_RECORD .?AU_NIC_RECORD@@
A
� " �"
� NICName ��
" Index
" PhysicalAddrLen ��
�4 PhysicalAddr �
" Size �
IpAddress
SubnetMask ���
$DhcpServer ���
(Gateway ��
,PrimaryWinsServer
0SecondaryWinsServer ��
A 4DnsServer
" DData �2
A H_NIC_RECORD .?AU_NIC_RECORD@@ A b L R � _TXFS_QUERY_RM_INFORMATION .?AU_TXFS_QUERY_RM_INFORMATION@@ ��
" BytesRequired
# TailLsn ��
# CurrentLsn ���
# ArchiveTailLsn ���
# LogContainerSize �
� ( HighestVirtualClock ��
" 0 LogContainerCount
" 4 LogContainerCountMax �
" 8 LogContainerCountMin �
" < LogGrowthIncrement ���
" @ LogAutoShrinkPercentage ��
" D Flags
! H LoggingMode ��
! J Reserved �
" L RmState ��
# P LogCapacity ��
# X LogFree ��
# ` TopsSize �
# h TopsUsed �
# p TransactionCount �
# x OnePCCount ���
# � TwoPCCount ���
# � NumberLogFileFull
# � OldestTransactionAge �
$ � RMName ���
" � TmLogPathOffset ��R A � _TXFS_QUERY_RM_INFORMATION .?AU_TXFS_QUERY_RM_INFORMATION@@ �� A � W b � _ETW_UMS_EVENT_DIRECTED_SWITCH_END .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_END@@ ��f
" ProcessId
" ScheduledThreadId
" PrimaryThreadId ��
" SwitchFlags ��b A _ETW_UMS_EVENT_DIRECTED_SWITCH_END .?AU_ETW_UMS_EVENT_DIRECTED_SWITCH_END@@ �� A b |
�"
� N � _RTL_DEBUG_INFORMATION32 .?AU_RTL_DEBUG_INFORMATION32@@ ��b
" SectionHandleClient ��
" ViewBaseClient ���
" ViewBaseTarget ���
" ViewBaseDelta
" EventPairClient ��
" EventPairTarget ��
" TargetProcessId ��
" TargetThreadHandle ���
" Flags
" $ OffsetFree ���
" ( CommitSize ���
" , ViewSize �
" 0 Modules ��
" 0 ModulesEx
" 4 BackTraces ���
" 8 Heaps
" < Locks
" @ SpecificHeap �
" D TargetProcessHandle ��
" H VerifierOptions ��
" L ProcessHeap ��
" P CriticalSectionHandle
" T CriticalSectionOwnerThread ���
� X Reserved �N A h _RTL_DEBUG_INFORMATION32 .?AU_RTL_DEBUG_INFORMATION32@@ �� A � �
�;
� " " � ( " $ �R
p locale ���
q wlocale ��
t refcount �
t wrefcount : A <anonymous-tag> .?AU<anonymous-tag>@@ !A ( !A " ` �& � lconv .?AUlconv@@
$A
� : � __lc_time_data .?AU__lc_time_data@@ ��
&A
� �
t refcount �
u lc_codepage ��
u lc_collate_cp
A lc_handle
A $ lc_id
#A H lc_category ��
t � lc_clike �
t � mb_cur_max ���
t � lconv_intl_refcount ��
t � lconv_num_refcount ���
t � lconv_mon_refcount ���
%A � lconv
t � ctype1_refcount ��
q � ctype1 ���
2 � pctype ���
0 � pclmap ���
0 � pcumap ���
'A � lc_time_curr �J (A � threadlocaleinfostruct .?AUthreadlocaleinfostruct@@ �� )A ( R � _ETW_COVERAGE_SAMPLER_STATS .?AU_ETW_COVERAGE_SAMPLER_STATS@@ �
SamplesAdded �
SamplesFound �
SamplesDropped ���
SamplesRaisedUM ��
SamplesMappedUM ��
SamplesRaisedKM ��
SamplesMappedKM ��
SamplingPaused ���
ApcNotAvailable ��
$ CaptureBufferNotAvailable
( SampleBufferNotAvailable �
, ProfileSampleCount ���
0 CSwitchSampleCount ���
4 RThreadSampleCount ���
8 PGFaultSampleCount ���R ,A < _ETW_COVERAGE_SAMPLER_STATS .?AU_ETW_COVERAGE_SAMPLER_STATS@@ -A @ �
N " /A
�/
� � t 2A
3A
� N � _CM_EISA_SLOT_INFORMATION .?AU_CM_EISA_SLOT_INFORMATION@@
5A
� �
ReturnCode ���
ReturnFlags ��
MajorRevision
MinorRevision
! Checksum �
NumberFunctions ��
FunctionInformation ��
" CompressedId �N 7A _CM_EISA_SLOT_INFORMATION .?AU_CM_EISA_SLOT_INFORMATION@@ 8A ) * � HFONT__ .?AUHFONT__@@
t unused ���* ;A HFONT__ .?AUHFONT__@@ <A s V
�4
�
�<
� 6 � _INPUT_RECORD .?AU_INPUT_RECORD@@ z
�* KeyEvent �
�" MouseEvent ���
8 WindowBufferSizeEvent
�7 MenuEvent
�* FocusEvent ���2 AA <anonymous-tag> .?AT<anonymous-tag>@@ BA � | &
! EventType
BA Event 6 DA _INPUT_RECORD .?AU_INPUT_RECORD@@ EA � z
8:
�
�1
� ^ � _RPC_BINDING_HANDLE_SECURITY_V1_A .?AU_RPC_BINDING_HANDLE_SECURITY_V1_A@@
IA
� �
" Version ��
ServerPrincName ��
" AuthnLevel ���
" AuthnSvc �
|4 AuthIdentity �
3( SecurityQos ��^ KA _RPC_BINDING_HANDLE_SECURITY_V1_A .?AU_RPC_BINDING_HANDLE_SECURITY_V1_A@@ LA ^ B � FILE_ID_DESCRIPTOR .?AUFILE_ID_DESCRIPTOR@@ ��
NA
� j
" dwSize ���
�' Type �
� FileId ���
$ ObjectId �
m ExtendedFileId ���B PA FILE_ID_DESCRIPTOR .?AUFILE_ID_DESCRIPTOR@@ �� QA n �# J � PPM_WMI_PERF_STATES_EX .?AUPPM_WMI_PERF_STATES_EX@@ ���
" Count
" MaxFrequency �
" CurrentState �
" MaxPerfState �
" MinPerfState �
" LowestPerfState ��
" ThermalConstraint
BusyAdjThreshold �
PolicyType ���
Type �
Reserved �
" TimerInterval
$ TargetProcessors �
" ( PStateHandler
" , PStateContext
" 0 TStateHandler
" 4 TStateContext
" 8 FeedbackHandler ��
" < Reserved1
# @ Reserved2
6 H State J TA � PPM_WMI_PERF_STATES_EX .?AUPPM_WMI_PERF_STATES_EX@@ �� UA { � V � _JOBOBJECT_FREEZE_INFORMATION .?AU_JOBOBJECT_FREEZE_INFORMATION@@
WA
�
" ��
" ��
" ��
" ���
" Flags
YA FreezeOperation ��
ZA FilterOperation ��
[A SwapOperation
\A Reserved �
Freeze ���
Swap �
� Reserved0
� WakeFilter ���V ]A _JOBOBJECT_FREEZE_INFORMATION .?AU_JOBOBJECT_FREEZE_INFORMATION@@ ^A � N � _ETW_DISKIO_READWRITE_V3 .?AU_ETW_DISKIO_READWRITE_V3@@ ��
`A
� �
" DiskNumber ���
" IrpFlags �
" Size �
" Reserved �
# ByteOffset ���
FileObject ���
IrpAddr ��
# HighResResponseTime ��
" ( IssuingThreadId ��N bA 0 _ETW_DISKIO_READWRITE_V3 .?AU_ETW_DISKIO_READWRITE_V3@@ �� cA b � : � HWINEVENTHOOK__ .?AUHWINEVENTHOOK__@@
t unused ���: fA HWINEVENTHOOK__ .?AUHWINEVENTHOOK__@@ gA s b � iA 6 � _HEAP_SUMMARY .?AU_HEAP_SUMMARY@@ r
" cb ���
" cbAllocated ��
" cbCommitted ��
" cbReserved ���
" cbMaxReserve �6 lA _HEAP_SUMMARY .?AU_HEAP_SUMMARY@@ 2 onecore\external\sdk\inc\minwin\heapapi.h �� mA nA +
;'
� R � _IMAGE_DYNAMIC_RELOCATION64 .?AU_IMAGE_DYNAMIC_RELOCATION64@@
qA
� .
# Symbol ���
" BaseRelocSize R sA _IMAGE_DYNAMIC_RELOCATION64 .?AU_IMAGE_DYNAMIC_RELOCATION64@@ tA � �
"
� " @ �B
" dvReserved ���
" dvNumAxes
wA dvValues �: xA H tagDESIGNVECTOR .?AUtagDESIGNVECTOR@@ yA � �
?
� 2
CommOffset ���
FaultOffset ��B |A _COMM_FAULT_OFFSETS .?AU_COMM_FAULT_OFFSETS@@ }A � �
(
�
�
�
a=
� : � BITMAPV5HEADER .?AUBITMAPV5HEADER@@ ��
�A
� B
" bV5Size ��
bV5Width �
bV5Height
! bV5Planes
! bV5BitCount ��
" bV5Compression ���
" bV5SizeImage �
bV5XPelsPerMeter �
bV5YPelsPerMeter �
" bV5ClrUsed ���
" $ bV5ClrImportant ��
" ( bV5RedMask ���
" , bV5GreenMask �
" 0 bV5BlueMask ��
" 4 bV5AlphaMask �
" 8 bV5CSType
� < bV5Endpoints �
" ` bV5GammaRed ��
" d bV5GammaGreen
" h bV5GammaBlue �
" l bV5Intent
" p bV5ProfileData ���
" t bV5ProfileSize ���
" x bV5Reserved ��: �A | BITMAPV5HEADER .?AUBITMAPV5HEADER@@ �� �A � a 2
# Ptr ��
" Size �
" Type �N �A _EVENT_FILTER_DESCRIPTOR .?AU_EVENT_FILTER_DESCRIPTOR@@ �� �A = H t " p �R � _PERFINFO_BOOT_PHASE_START .?AU_PERFINFO_BOOT_PHASE_START@@ ��
Phase R �A _PERFINFO_BOOT_PHASE_START .?AU_PERFINFO_BOOT_PHASE_START@@ �� �A b �
�
� f � DISPLAYCONFIG_SET_TARGET_PERSISTENCE .?AUDISPLAYCONFIG_SET_TARGET_PERSISTENCE@@ ��
u ��
u ��V
� header ���
�A bootPersistenceOn
�A reserved �
u value f �A DISPLAYCONFIG_SET_TARGET_PERSISTENCE .?AUDISPLAYCONFIG_SET_TARGET_PERSISTENCE@@ �� �A � .
�3
�
"!
�
�
� f � _SYSTEM_LOGICAL_PROCESSOR_INFORMATION .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION@@
Flags : �A <anonymous-tag> .?AU<anonymous-tag>@@ �A �
" NodeNumber ���: �A <anonymous-tag> .?AU<anonymous-tag>@@ �A � �
" ProcessorMask
O Relationship �
�A ProcessorCore
�A NumaNode �
H2 Cache
� Reserved �f �A _SYSTEM_LOGICAL_PROCESSOR_INFORMATION .?AU_SYSTEM_LOGICAL_PROCESSOR_INFORMATION@@ �A � b � _SYSTEM_CONTEXT_SWITCH_INFORMATION .?AU_SYSTEM_CONTEXT_SWITCH_INFORMATION@@ ��
�A
�
" ContextSwitches ��
" FindAny ��
" FindLast �
" FindIdeal
" IdleAny ��
" IdleCurrent ��
" IdleLast �
" IdleIdeal
" PreemptAny ���
" $ PreemptCurrent ���
" ( PreemptLast ��
" , SwitchToIdle �b �A 0 _SYSTEM_CONTEXT_SWITCH_INFORMATION .?AU_SYSTEM_CONTEXT_SWITCH_INFORMATION@@ �� �A � �
f � _JOBOBJECT_EXTENDED_LIMIT_INFORMATION .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION@@
�A
� �
+ BasicLimitInformation
� 0 IoInfo ���
" ` ProcessMemoryLimit ���
" d JobMemoryLimit ���
" h PeakProcessMemoryUsed
" l PeakJobMemoryUsed f �A p _JOBOBJECT_EXTENDED_LIMIT_INFORMATION .?AU_JOBOBJECT_EXTENDED_LIMIT_INFORMATION@@ �A D `
�!
� F � _RPC_PROTSEQ_VECTORA .?AU_RPC_PROTSEQ_VECTORA@@ �� " �&
u Count
�A Protseq ��F �A _RPC_PROTSEQ_VECTORA .?AU_RPC_PROTSEQ_VECTORA@@ �� �A ^ �
p$
�
� " �A Z � _FILE_PROVIDER_EXTERNAL_INFO_V1 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V1@@ :
" Version ��
" Algorithm
" Flags Z �A _FILE_PROVIDER_EXTERNAL_INFO_V1 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V1@@ �A � }"
* ( �A F � _SERVICE_TABLE_ENTRYA .?AU_SERVICE_TABLE_ENTRYA@@
�A
�
p
� " �A �A
�A
� 2
p lpServiceName
�A lpServiceProc F �A _SERVICE_TABLE_ENTRYA .?AU_SERVICE_TABLE_ENTRYA@@ �A � y V � _ETW_TP_EVENT_TIMER_CANCELLED .?AU_ETW_TP_EVENT_TIMER_CANCELLED@@ :
m Header ���
SubQueue �
$ Timer V �A ( _ETW_TP_EVENT_TIMER_CANCELLED .?AU_ETW_TP_EVENT_TIMER_CANCELLED@@ �A b
M
� f � _EVENT_TRACE_HEAP_TRACING_INFORMATION .?AU_EVENT_TRACE_HEAP_TRACING_INFORMATION@@ >
? EventTraceInformationClass ���
� ProcessId f �A _EVENT_TRACE_HEAP_TRACING_INFORMATION .?AU_EVENT_TRACE_HEAP_TRACING_INFORMATION@@ �A @ #
: NotificationType �
" NotificationSize �
" Offset ���
ReplyRequested ���
" Timeout ��
" ReplyCount ���
" NotifyeeCount
# Reserved2
" TargetPID
" $ SourcePID
$ ( DestinationGuid ��
$ 8 SourceGuid ���N �A H _ETW_NOTIFICATION_HEADER .?AU_ETW_NOTIFICATION_HEADER@@ �� �A @ H f � _PERFINFO_DRIVER_COMPLETE_REQUEST_RET .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST_RET@@ *
Irp ��
" UniqMatchId ��f �A _PERFINFO_DRIVER_COMPLETE_REQUEST_RET .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST_RET@@ �A b
d
� F � _PO_WAKE_SOURCE_INFO .?AU_PO_WAKE_SOURCE_INFO@@ ��
�A
� &
" Count
� Offsets ��F �A _PO_WAKE_SOURCE_INFO .?AU_PO_WAKE_SOURCE_INFO@@ �� �A { 5
�;
� Z � _MEMORY_EXHAUSTION_INFORMATION .?AU_MEMORY_EXHAUSTION_INFORMATION@@ ��J
! Version ��
! Reserved �
: Type �
" Value Z �A _MEMORY_EXHAUSTION_INFORMATION .?AU_MEMORY_EXHAUSTION_INFORMATION@@ �� �A D �
�
� R � _CREATE_PROCESS_DEBUG_INFO .?AU_CREATE_PROCESS_DEBUG_INFO@@ ���
hFile
hProcess �
hThread ��
lpBaseOfImage
" dwDebugInfoFileOffset
" nDebugInfoSize ���
lpThreadLocalBase
"5 lpStartAddress ���
lpImageName ��
! $ fUnicode �R
�A ( _CREATE_PROCESS_DEBUG_INFO .?AU_CREATE_PROCESS_DEBUG_INFO@@ �� �A � ; � �A
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
�A NoRemoteImages ���
�A NoLowMandatoryLabelImages
�A PreferSystem32Images �
�A AuditNoRemoteImages ��
�A AuditNoLowMandatoryLabelImages ���
�A ReservedFlags f �A _PROCESS_MITIGATION_IMAGE_LOAD_POLICY .?AU_PROCESS_MITIGATION_IMAGE_LOAD_POLICY@@ �A D �
�
�
!
�
�@
�
[
�
I;
� > � _FILE_RENAME_INFO .?AU_FILE_RENAME_INFO@@ v
ReplaceIfExists ��
" Flags
RootDirectory
" FileNameLength ���
FileName �> �A _FILE_RENAME_INFO .?AU_FILE_RENAME_INFO@@ �A n �" J � _WIN32_FIND_STREAM_DATA .?AU_WIN32_FIND_STREAM_DATA@@
�A
� q " P �2
� StreamSize ���
�A cStreamName ��J �A X_WIN32_FIND_STREAM_DATA .?AU_WIN32_FIND_STREAM_DATA@@ �A T S B � USN_JOURNAL_DATA_V0 .?AUUSN_JOURNAL_DATA_V0@@
�A
� �
# UsnJournalID �
FirstUsn �
NextUsn ��
LowestValidUsn ���
MaxUsn ���
# ( MaximumSize ��
# 0 AllocationDelta ��B B 8 USN_JOURNAL_DATA_V0 .?AUUSN_JOURNAL_DATA_V0@@ B � � : � tagEMRRESTOREDC .?AUtagEMRRESTOREDC@@ &
� emr ��
iRelative : B tagEMRRESTOREDC .?AUtagEMRRESTOREDC@@ B � w
O)
�
" ��
B
�
�(
� J � _IMAGE_FUNCTION_ENTRY64 .?AU_IMAGE_FUNCTION_ENTRY64@@ j
# StartingAddress ��
# EndingAddress
# EndOfPrologue
# UnwindInfoAddress J
B _IMAGE_FUNCTION_ENTRY64 .?AU_IMAGE_FUNCTION_ENTRY64@@ B �
V
� &
" Address ��
" Data �N B _RTL_STACK_CONTEXT_ENTRY .?AU_RTL_STACK_CONTEXT_ENTRY@@ �� B � B � _CONNECTDLGSTRUCTA .?AU_CONNECTDLGSTRUCTA@@ ��
B
�
=
� j
" cbStructure ��
� hwndOwner
B lpConnRes
" dwFlags ��
" dwDevNum �B B _CONNECTDLGSTRUCTA .?AU_CONNECTDLGSTRUCTA@@ �� B � �
�
� J � _RPC_SECURITY_QOS_V5_A .?AU_RPC_SECURITY_QOS_V5_A@@ ��
B
�
c. HttpCredentials ��2 B <anonymous-tag> .?AT<anonymous-tag>@@ B ^ } �
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
B u
Sid ��
u EffectiveOnly
ServerSecurityDescriptor �J B $ _RPC_SECURITY_QOS_V5_A .?AU_RPC_SECURITY_QOS_V5_A@@ �� !B ^ v
4@
�
#B
�
�0
� " � " �
! Flags
! Reserved �
! LangId ���
LangNameIndex
! FallbackTypes
NeutralLangSpec ��
&B FallbackSpecs
'B AlternateCodePage 6 (B _MUILANGINFO .?AU_MUILANGINFO@@ �� )B 1 N � _CM_PNP_BIOS_DEVICE_NODE .?AU_CM_PNP_BIOS_DEVICE_NODE@@ ��j
! Size �
Node �
" ProductId
, DeviceType ���
!
DeviceAttributes �N ,B _CM_PNP_BIOS_DEVICE_NODE .?AU_CM_PNP_BIOS_DEVICE_NODE@@ �� -B [
/B
0B
�
�9
� J � _PROCESS_PRIORITY_CLASS .?AU_PROCESS_PRIORITY_CLASS@@ 2
Foreground ���
PriorityClass J 4B _PROCESS_PRIORITY_CLASS .?AU_PROCESS_PRIORITY_CLASS@@ 5B � 9 ^ � _FILE_MAILSLOT_QUERY_INFORMATION .?AU_FILE_MAILSLOT_QUERY_INFORMATION@@ ��
" MaximumMessageSize ���
" MailslotQuota
" NextMessageSize ��
" MessagesAvailable
� ReadTimeout ��^ 8B _FILE_MAILSLOT_QUERY_INFORMATION .?AU_FILE_MAILSLOT_QUERY_INFORMATION@@ �� 9B � c
�
� N � _PERFINFO_SPINLOCK_CONFIG .?AU_PERFINFO_SPINLOCK_CONFIG@@ �
" SpinLockSpinThreshold
" SpinLockContentionSampleRate �
" SpinLockAcquireSampleRate
" SpinLockHoldThreshold N =B _PERFINFO_SPINLOCK_CONFIG .?AU_PERFINFO_SPINLOCK_CONFIG@@ >B b �
�4
� B � _CI_LOG_MMCSS_START .?AU_CI_LOG_MMCSS_START@@
AB
�
Header ���B CB 0 _CI_LOG_MMCSS_START .?AU_CI_LOG_MMCSS_START@@ DB b a
�(
�
�!
�
�+
� b � _SYSTEM_ENTROPY_TIMING_INFORMATION .?AU_SYSTEM_ENTROPY_TIMING_INFORMATION@@ ��
IB
� @
KB
�
.@
� ^
LB EntropyRoutine ���
MB InitializationRoutine
InitializationContext b NB _SYSTEM_ENTROPY_TIMING_INFORMATION .?AU_SYSTEM_ENTROPY_TIMING_INFORMATION@@ �� OB �
�
�
E
� ^ � _IR_TIMER_EXTRA_CREATE_PARAMETER .?AU_IR_TIMER_EXTRA_CREATE_PARAMETER@@ ��2
! ComponentId ��
! RelativeId ���^ TB _IR_TIMER_EXTRA_CREATE_PARAMETER .?AU_IR_TIMER_EXTRA_CREATE_PARAMETER@@ �� UB � 9
�
�+
� V � _FILE_ALLOCATED_RANGE_BUFFER .?AU_FILE_ALLOCATED_RANGE_BUFFER@@ ��.
� FileOffset ���
� Length ���V ZB _FILE_ALLOCATED_RANGE_BUFFER .?AU_FILE_ALLOCATED_RANGE_BUFFER@@ �� [B � �
w3
� > � _SYSDBG_BUS_DATA .?AU_SYSDBG_BUS_DATA@@ ��
" Address ��
Buffer ���
" Request ��
!# BusDataType ��
" BusNumber
" SlotNumber ���> _B _SYSDBG_BUS_DATA .?AU_SYSDBG_BUS_DATA@@ �� `B � > � _ALPC_DIRECT_ATTR .?AU_ALPC_DIRECT_ATTR@@
Event > cB _ALPC_DIRECT_ATTR .?AU_ALPC_DIRECT_ATTR@@ dB � f 2 � _WMI_TCPIP .?AU_WMI_TCPIP@@ ��
fB
� v
" Context ��
" Size �
" DestAddr �
" SrcAddr ��
! DestPort �
! SrcPort ��2 hB _WMI_TCPIP .?AU_WMI_TCPIP@@ �� iB b
g(
�
{!
� ^ � _MIDL_INTERFACE_METHOD_PROPERTIES .?AU_MIDL_INTERFACE_METHOD_PROPERTIES@@
mB ��
nB
� �
/ TransferSyntax ���
lB DispatchTable
J ProcString ���
2 FmtStringOffset ��
J TypeString ���
$ aUserMarshalQuadruple
oB ( pMethodProperties
" , pReserved2 ���> pB 0 _MIDL_SYNTAX_INFO .?AU_MIDL_SYNTAX_INFO@@ qB � � �
" Internal �
" InternalHigh �
" Offset ���
" OffsetHigh ���
Pointer ��
hEvent ���2 sB _OVERLAPPED .?AU_OVERLAPPED@@ tB � 4 V � tagEMREXTCREATEFONTINDIRECTW .?AUtagEMREXTCREATEFONTINDIRECTW@@ ��6
� emr ��
" ihFont ���
�* elfw �V wB LtagEMREXTCREATEFONTINDIRECTW .?AUtagEMREXTCREATEFONTINDIRECTW@@ �� xB � ?
2
� V � _WIM_PROVIDER_START_INTEGRITY .?AU_WIM_PROVIDER_START_INTEGRITY@@
� DataSourceId �V |B _WIM_PROVIDER_START_INTEGRITY .?AU_WIM_PROVIDER_START_INTEGRITY@@ }B � ]"
V)
� J � _ETW_DEBUG_PRINT_EVENT .?AU_ETW_DEBUG_PRINT_EVENT@@ ��:
" Component
" Level
Message ��J �B _ETW_DEBUG_PRINT_EVENT .?AU_ETW_DEBUG_PRINT_EVENT@@ �� �B b 2
� SC_ACTION_NONE ��� SC_ACTION_RESTART SC_ACTION_REBOOT � SC_ACTION_RUN_COMMAND SC_ACTION_OWN_RESTART 6 t �B _SC_ACTION_TYPE .?AW4_SC_ACTION_TYPE@@ � �B �
V � _PERFINFO_CC_WORKITEM_DEQUEUE .?AU_PERFINFO_CC_WORKITEM_DEQUEUE@@
�B
�
" WorkItemKey ��V �B _PERFINFO_CC_WORKITEM_DEQUEUE .?AU_PERFINFO_CC_WORKITEM_DEQUEUE@@ �B b � X R � _RTL_UNICODE_STRING_BUFFER .?AU_RTL_UNICODE_STRING_BUFFER@@ ��2 � _RTL_BUFFER .?AU_RTL_BUFFER@@ Z
String ���
�B ByteBuffer ���
� MinimumStaticBufferForTerminalNul R �B _RTL_UNICODE_STRING_BUFFER .?AU_RTL_UNICODE_STRING_BUFFER@@ ��6 onecore\internal\sdk\inc\ntrtlstringandbuffer.h �B �B �
�2
�
M1
� >
" dwDataType ���
" cbData ���
pData b �B _SERVICE_TRIGGER_SPECIFIC_DATA_ITEM .?AU_SERVICE_TRIGGER_SPECIFIC_DATA_ITEM@@ �B � l
! ��
! ��
!
��
! ��
! ��z
�B PageRelativeOffset ���
�B IndirectCall �
�B RexWPrefix ���
�B CfgCheck �
�B Reserved �~ �B _IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION .?AU_IMAGE_INDIR_CONTROL_TRANSFER_DYNAMIC_RELOCATION@@ �� �B � � " � � " �- �B
�B
� J � _LDR_DATA_TABLE_ENTRY32 .?AU_LDR_DATA_TABLE_ENTRY32@@ �
InLoadOrderLinks �
InMemoryOrderLinks ���
InInitializationOrderLinks ���
" DllBase ��
" EntryPoint ���
" SizeOfImage ��
�) $ FullDllName ��
�) , BaseDllName ��
" 4 Flags
! 8 LoadCount
! : TlsIndex �
< HashLinks
" < SectionPointer ���
" @ CheckSum �
" D TimeDateStamp
" D LoadedImports J �B H _LDR_DATA_TABLE_ENTRY32 .?AU_LDR_DATA_TABLE_ENTRY32@@ �B � 6 � _DEBUG_EVENT .?AU_DEBUG_EVENT@@ ��N � _EXIT_PROCESS_DEBUG_INFO .?AU_EXIT_PROCESS_DEBUG_INFO@@ ��F � _LOAD_DLL_DEBUG_INFO .?AU_LOAD_DLL_DEBUG_INFO@@ ��N � _OUTPUT_DEBUG_STRING_INFO .?AU_OUTPUT_DEBUG_STRING_INFO@@ . � _RIP_INFO .?AU_RIP_INFO@@ �
,6 Exception
5 CreateThread �
�A CreateProcessInfo
�1 ExitThread ���
�B ExitProcess ��
�B LoadDll ��
F. UnloadDll
�B DebugString ��
�B RipInfo ��2 �B T <anonymous-tag> .?AT<anonymous-tag>@@ �B � m Z
" dwDebugEventCode �
" dwProcessId ��
" dwThreadId ���
�B u 6 �B ` _DEBUG_EVENT .?AU_DEBUG_EVENT@@ �� �B � i ^ � _PERFINFO_DRIVER_COMPLETE_REQUEST .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST@@ B
RoutineAddr ��
Irp ��
" UniqMatchId ��^ �B _PERFINFO_DRIVER_COMPLETE_REQUEST .?AU_PERFINFO_DRIVER_COMPLETE_REQUEST@@ �B b > � tagEMRALPHABLEND .?AUtagEMRALPHABLEND@@ ��R
� emr ��
c rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
I 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d cxSrc
h cySrc > �B l tagEMRALPHABLEND .?AUtagEMRALPHABLEND@@ �� �B � � " j " # # � �B
�B
�
?5
� N � _OBJECT_TYPES_INFORMATION .?AU_OBJECT_TYPES_INFORMATION@@
" NumberOfTypes N �B _OBJECT_TYPES_INFORMATION .?AU_OBJECT_TYPES_INFORMATION@@ �B + R
�@
�
�0
�
�7
� R � tagTOUCH_HIT_TESTING_INPUT .?AUtagTOUCH_HIT_TESTING_INPUT@@ ��z
u pointerId
� point
boundingBox ��
nonOccludedBoundingBox ���
u , orientation ��R �B 0 tagTOUCH_HIT_TESTING_INPUT .?AUtagTOUCH_HIT_TESTING_INPUT@@ �� �B ~ , F � _WOF_EXTERNAL_FILE_ID .?AU_WOF_EXTERNAL_FILE_ID@@
�B
�
m FileId ���F �B _WOF_EXTERNAL_FILE_ID .?AU_WOF_EXTERNAL_FILE_ID@@ �B � �!
�/
� b � _WMI_EXTENDED_THREAD_INFORMATION64 .?AU_WMI_EXTENDED_THREAD_INFORMATION64@@ ��
�B
� v
" ProcessId
" ThreadId �
# StackBase64 ��
# StackLimit64 �
# UserStackBase64 ��
# UserStackLimit64 �
# ( StartAddr64 ��
# ( Affinity �
# 0 Win32StartAddr64 �
# 8 TebBase64
" @ SubProcessTag
p D BasePriority �
E PagePriority �
F IoPriority ���
G Flags
H ThreadName ���b �B P _WMI_EXTENDED_THREAD_INFORMATION64 .?AU_WMI_EXTENDED_THREAD_INFORMATION64@@ �� �B b (
v4
� * � HTASK__ .?AUHTASK__@@
�B
�
t unused ���* �B HTASK__ .?AUHTASK__@@ �B �' :
" BaseAddress ��
" Size �
" Flags j �B _PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE .?AU_PROCESS_DYNAMIC_ENFORCED_ADDRESS_RANGE@@ �B D �
�-
�
�>
�
# �B " @ �
SourceId �
# Policy ���
x0 ResultCode ���
ResultStatus �
# Time �
" EntropyLength
�B $ EntropyData ��Z �B h _BOOT_ENTROPY_SOURCE_NT_RESULT .?AU_BOOT_ENTROPY_SOURCE_NT_RESULT@@ �� �B � D
�6
�
�
� R � tagUPDATELAYEREDWINDOWINFO .?AUtagUPDATELAYEREDWINDOWINFO@@ ��
�B
�
� ��
�B
�
d ��
�B
� : � _BLENDFUNCTION .?AU_BLENDFUNCTION@@ ��
�B ��
�B
�
��
�B
� �
" cbSize ���
� hdcDst ���
�B pptDst ���
�B psize
� hdcSrc ���
�B pptSrc ���
" crKey
�B pblend ���
" dwFlags ��
�B $ prcDirty �R
�B ( tagUPDATELAYEREDWINDOWINFO .?AUtagUPDATELAYEREDWINDOWINFO@@ �� �B ~ �
�-
�
,
� > � tagEMRPOLYDRAW16 .?AUtagEMRPOLYDRAW16@@ ��Z
� emr ��
c rclBounds
" cpts �
| apts �
� abTypes ��> �B $ tagEMRPOLYDRAW16 .?AUtagEMRPOLYDRAW16@@ �� �B � Z R � _JOURNAL_CLIENT_INFORMATION .?AU_JOURNAL_CLIENT_INFORMATION@@ r
� StartTimeStamp ���
� CurrentTimeStamp �
# RecordsToProcess �
" RelativeFillLevel R �B _JOURNAL_CLIENT_INFORMATION .?AU_JOURNAL_CLIENT_INFORMATION@@ �B � J � tagEMRGLSBOUNDEDRECORD .?AUtagEMRGLSBOUNDEDRECORD@@ ��J
� emr ��
c rclBounds
" cbData ���
� Data �J C tagEMRGLSBOUNDEDRECORD .?AUtagEMRGLSBOUNDEDRECORD@@ �� C � �
H
� b � _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_V2@@
C
� 2
# ClientSession
ClientProcess b C _FILE_PIPE_CLIENT_PROCESS_BUFFER_V2 .?AU_FILE_PIPE_CLIENT_PROCESS_BUFFER_V2@@ C � =)
R9
� & " p � � " ( �
C Timelines
& CpuTimeline ��
& DiskTimeline �
& NetworkTimeline ��
& MBBTimeline ��
& ForegroundTimeline ���
& ( DesktopVisibleTimeline ���
& 0 CompositionRenderedTimeline ��
& 8 CompositionDirtyGeneratedTimeline
& @ CompositionDirtyPropagatedTimeline ���
& H InputTimeline
& P AudioInTimeline ��
& X AudioOutTimeline �
& ` DisplayRequiredTimeline ��
& h KeyboardInputTimeline
C p Durations
� p InputDuration
� x AudioInDuration ��
� � AudioOutDuration �
� � DisplayRequiredDuration ��
� � PSMBackgroundDuration
" � KeyboardInput
" � MouseInput ���^ C � _PROCESS_ENERGY_VALUES_EXTENSION .?AU_PROCESS_ENERGY_VALUES_EXTENSION@@ ��
C � E
p
� B � _ENCRYPTION_BUFFER .?AU_ENCRYPTION_BUFFER@@ ��6
" EncryptionOperation ��
� Private ��B C _ENCRYPTION_BUFFER .?AU_ENCRYPTION_BUFFER@@ �� C � �
$/
� J � DISPLAYCONFIG_2DREGION .?AUDISPLAYCONFIG_2DREGION@@ ��"
u cx ���
u cy ���J C DISPLAYCONFIG_2DREGION .?AUDISPLAYCONFIG_2DREGION@@ �� C � &
" Offset ���
" Flags F C _CFG_CALL_TARGET_INFO .?AU_CFG_CALL_TARGET_INFO@@ C � �
�,
�
}
� Z � _POWER_THROTTLING_THREAD_STATE .?AU_POWER_THROTTLING_THREAD_STATE@@ ��B
" Version ��
" ControlMask ��
" StateMask Z C _POWER_THROTTLING_THREAD_STATE .?AU_POWER_THROTTLING_THREAD_STATE@@ �� C D � N � _TPP_THREAD_DATA_CALLBACK .?AU_TPP_THREAD_DATA_CALLBACK@@ V � _SHARED_VIRTUAL_DISK_SUPPORT .?AU_SHARED_VIRTUAL_DISK_SUPPORT@@ ��>
� SharedVirtualDiskSupport �
G HandleState ��V $C _SHARED_VIRTUAL_DISK_SUPPORT .?AU_SHARED_VIRTUAL_DISK_SUPPORT@@ �� %C � �'
r)
�
w-
�
N+
�
� PerProcessUserTimeLimit ��
� PerJobUserTimeLimit ��
" LimitFlags ���
" MinimumWorkingSetSize
" MaximumWorkingSetSize
" ActiveProcessLimit ���
" Affinity �
" $ PriorityClass
" ( SchedulingClass ��b *C 0 _JOBOBJECT_BASIC_LIMIT_INFORMATION .?AU_JOBOBJECT_BASIC_LIMIT_INFORMATION@@ �� +C D T V � _MANAGE_HOT_PATCH_LOAD_PATCH .?AU_MANAGE_HOT_PATCH_LOAD_PATCH@@ ��
-C
� &
P Sid ��
� Buffer ���2 /C D <anonymous-tag> .?AT<anonymous-tag>@@ 0C w ` R
" Version ��
PatchPath
0C UserSid ��
/ P BaseInfo �V 2C X _MANAGE_HOT_PATCH_LOAD_PATCH .?AU_MANAGE_HOT_PATCH_LOAD_PATCH@@ �� 3C w R N � _SYSTEM_VDM_INSTEMUL_INFO .?AU_SYSTEM_VDM_INSTEMUL_INFO@@ R
" SegmentNotPresent
" VdmOpcode0F ��
" OpcodeESPrefix ���
" OpcodeCSPrefix ���
" OpcodeSSPrefix ���
" OpcodeDSPrefix ���
" OpcodeFSPrefix ���
" OpcodeGSPrefix ���
" OpcodeOPER32Prefix ���
" $ OpcodeADDR32Prefix ���
" ( OpcodeINSB ���
" , OpcodeINSW ���
" 0 OpcodeOUTSB ��
" 4 OpcodeOUTSW ��
" 8 OpcodePUSHF ��
" < OpcodePOPF ���
" @ OpcodeINTnn ��
" D OpcodeINTO ���
" H OpcodeIRET ���
" L OpcodeINBimm �
" P OpcodeINWimm �
" T OpcodeOUTBimm
" X OpcodeOUTWimm
" \ OpcodeINB
" ` OpcodeINW
" d OpcodeOUTB ���
" h OpcodeOUTW ���
" l OpcodeLOCKPrefix �
" p OpcodeREPNEPrefix
" t OpcodeREPPrefix ��
" x OpcodeHLT
" | OpcodeCLI
" � OpcodeSTI
" � BopCount �N " 6C � _SYSTEM_VDM_INSTEMUL_INFO .?AU_SYSTEM_VDM_INSTEMUL_INFO@@ 7C � �
]
�
�1
� � SystemActivityModerationStateSystemManaged ��� SystemActivityModerationStateUserManagedAllowThrottling �� SystemActivityModerationStateUserManagedDisableThrottling MaxSystemActivityModerationState �Z t ;C _SYSTEM_ACTIVITY_MODERATION_STATE .?AW4_SYSTEM_ACTIVITY_MODERATION_STATE@@ � <C �
�9
�
:
� 6 � _TOKEN_OWNER .?AU_TOKEN_OWNER@@ ��
Owner 6 AC _TOKEN_OWNER .?AU_TOKEN_OWNER@@ �� BC w � J � _CONSOLE_SELECTION_INFO .?AU_CONSOLE_SELECTION_INFO@@ J
" dwFlags ��
�" dwSelectionAnchor
i: srSelection ��J EC _CONSOLE_SELECTION_INFO .?AU_CONSOLE_SELECTION_INFO@@ FC @% k
�"
� R � _FILE_OBJECTID_INFORMATION .?AU_FILE_OBJECTID_INFORMATION@@ ��
IC
� �
FileReference
o ObjectId �
o BirthVolumeId
o ( BirthObjectId
o 8 DomainId �
�5 ExtendedInfo �R KC H _FILE_OBJECTID_INFORMATION .?AU_FILE_OBJECTID_INFORMATION@@ �� LC � d 6 � tagEXTLOGPEN .?AUtagEXTLOGPEN@@ ��
" elpPenStyle ��
" elpWidth �
u elpBrushStyle
" elpColor �
" elpHatch �
" elpNumEntries
z elpStyleEntry 6 OC tagEXTLOGPEN .?AUtagEXTLOGPEN@@ �� PC � x
�=
� > � _VM_COUNTERS_EX2 .?AU_VM_COUNTERS_EX2@@ ��
SC
� V
�- CountersEx ���
" 0 PrivateWorkingSetSize
# 8 SharedCommitUsage > UC @ _VM_COUNTERS_EX2 .?AU_VM_COUNTERS_EX2@@ �� VC D
q XC
�
� Z � _KEY_VALUE_PARTIAL_INFORMATION .?AU_KEY_VALUE_PARTIAL_INFORMATION@@ ��R
" TitleIndex ���
" Type �
" DataLength ���
� Data �Z \C _KEY_VALUE_PARTIAL_INFORMATION .?AU_KEY_VALUE_PARTIAL_INFORMATION@@ �� ]C Y R � _PO_SPR_ACTIVE_SESSION_DATA .?AU_PO_SPR_ACTIVE_SESSION_DATA@@ .
Start
$ ActiveSessionGuid R `C _PO_SPR_ACTIVE_SESSION_DATA .?AU_PO_SPR_ACTIVE_SESSION_DATA@@ aC { ?
�
? EventTraceInformationClass ���
CoverageSamplerInformationClass ��
MajorVersion �
MinorVersion �
Reserved �
# SamplerHandle n cC _EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION .?AU_EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION@@ dC @ � N � _INVERTED_FUNCTION_TABLE .?AU_INVERTED_FUNCTION_TABLE@@ ��
fC
� " �n
" CurrentSize ��
" MaximumSize ��
} Epoch
Overflow �
hC TableEntry ���N iC _INVERTED_FUNCTION_TABLE .?AU_INVERTED_FUNCTION_TABLE@@ �� jC � f � _CSV_QUERY_FILE_REVISION_FILE_ID_128 .?AU_CSV_QUERY_FILE_REVISION_FILE_ID_128@@ �� " �.
m FileId ���
mC FileRevision �f nC ( _CSV_QUERY_FILE_REVISION_FILE_ID_128 .?AU_CSV_QUERY_FILE_REVISION_FILE_ID_128@@ �� oC � �
?
� J � _FILE_DISPOSITION_INFO .?AU_FILE_DISPOSITION_INFO@@ ��
DeleteFileA ��J sC _FILE_DISPOSITION_INFO .?AU_FILE_DISPOSITION_INFO@@ �� tC n �" n � _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION@@ �
� IdleTime �
� KernelTime ���
� UserTime �
� DpcTime ��
� InterruptTime
" ( InterruptCount ���n wC 0 _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION@@ xC � �
�(
�
�A
�
5)
�
�
� z � _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION .?AU_SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION@@ ��
~C
� >
" NumberOfLogicalProcessors
" NumberOfCores z �C _SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION .?AU_SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION@@ �� �C �
� n � DISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION .?AUDISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION@@ ��
u ��
u ��f
� header ���
�C disableMonitorVirtualResolution ��
�C reserved �
u value n �C DISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION .?AUDISPLAYCONFIG_SUPPORT_VIRTUAL_RESOLUTION@@ �� �C � < : � _MCA_EXCEPTION .?AU_MCA_EXCEPTION@@ ��
" Dummy : �C _MCA_EXCEPTION .?AU_MCA_EXCEPTION@@ ��& onecore\external\ddk\inc\mce.h � �C �C t
�)
�
4:
�
�B
� ^ � _RTL_IMAGE_MITIGATION_DEP_POLICY .?AU_RTL_IMAGE_MITIGATION_DEP_POLICY@@ ��
�C
�
� Dep ��^ �C _RTL_IMAGE_MITIGATION_DEP_POLICY .?AU_RTL_IMAGE_MITIGATION_DEP_POLICY@@ �� �C , b � _PERFINFO_VIRTUAL_ALLOC_XPARTITION .?AU_PERFINFO_VIRTUAL_ALLOC_XPARTITION@@ ��6
CapturedBase �
! TargetPartition ��b �C _PERFINFO_VIRTUAL_ALLOC_XPARTITION .?AU_PERFINFO_VIRTUAL_ALLOC_XPARTITION@@ �� �C b `
�
� B � tagUSEROBJECTFLAGS .?AUtagUSEROBJECTFLAGS@@ ��>
t fInherit �
t fReserved
" dwFlags ��B �C tagUSEROBJECTFLAGS .?AUtagUSEROBJECTFLAGS@@ �� �C ~ �
�/
� d " �
�& Header ���
m FileReferenceNumber ��
m ParentFileReferenceNumber
( Usn ��
" 0 Reason ���
" 4 SourceInfo ���
" 8 RemainingExtents �
! < NumberOfExtents ��
! > ExtentSize ���
�C @ Extents ��6
�C P USN_RECORD_V4 .?AUUSN_RECORD_V4@@ �C � � R � _ACCESS_ALLOWED_OBJECT_ACE .?AU_ACCESS_ALLOWED_OBJECT_ACE@@ ��
� Header ���
" Mask �
" Flags
$ ObjectType ���
$ InheritedObjectType ��
" , SidStart �R �C 0 _ACCESS_ALLOWED_OBJECT_ACE .?AU_ACCESS_ALLOWED_OBJECT_ACE@@ �� �C w �
]
�
�4
�
�6
� f � _PROCESS_READWRITEVM_LOGGING_INFORMATION .?AT_PROCESS_READWRITEVM_LOGGING_INFORMATION@@ ��
��
��
��f
Flags
�C EnableReadVmLogging ��
�C EnableWriteVmLogging �
�C Unused ���f �C _PROCESS_READWRITEVM_LOGGING_INFORMATION .?AT_PROCESS_READWRITEVM_LOGGING_INFORMATION@@ �� �C D Q N � _ImageArchitectureHeader .?AU_ImageArchitectureHeader@@ ��
u ��
u ��J
�C AmaskValue ���
�C AmaskShift ���
" FirstEntryRVA N �C _ImageArchitectureHeader .?AU_ImageArchitectureHeader@@ �� �C � Z J � _IMAGE_DEBUG_DIRECTORY .?AU_IMAGE_DEBUG_DIRECTORY@@ ���
" Characteristics ��
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" Type �
" SizeOfData ���
" AddressOfRawData �
" PointerToRawData �J �C _IMAGE_DEBUG_DIRECTORY .?AU_IMAGE_DEBUG_DIRECTORY@@ �� �C � � b � _SYSTEM_VERIFIER_FAULTS_INFORMATION .?AU_SYSTEM_VERIFIER_FAULTS_INFORMATION@@ b
" Probability ��
" MaxProbability ���
PoolTags �
Applications �b �C _SYSTEM_VERIFIER_FAULTS_INFORMATION .?AU_SYSTEM_VERIFIER_FAULTS_INFORMATION@@ �C � � f � _FILE_IO_PRIORITY_HINT_INFORMATION_EX .?AU_FILE_IO_PRIORITY_HINT_INFORMATION_EX@@ 6
� PriorityHint �
BoostOutstanding �f �C _FILE_IO_PRIORITY_HINT_INFORMATION_EX .?AU_FILE_IO_PRIORITY_HINT_INFORMATION_EX@@ �C � �
�
� � " � �
" CommittedMemory ��
" ReservedMemory ���
" NumberOfBackTraceLookups �
" NumberOfBackTraces ���
�C BackTraces ���J �C � _RTL_PROCESS_BACKTRACES .?AU_RTL_PROCESS_BACKTRACES@@ �C �
�$
� f � _ACTIVATION_CONTEXT_BASIC_INFORMATION .?AU_ACTIVATION_CONTEXT_BASIC_INFORMATION@@ V
� ActivationContext
hActCtx ��
" Flags
" dwFlags ��f �C _ACTIVATION_CONTEXT_BASIC_INFORMATION .?AU_ACTIVATION_CONTEXT_BASIC_INFORMATION@@ �C � �
=
�
�4
� p t �C
�C
�
�2
� F � _FILE_ALLOCATION_INFO .?AU_FILE_ALLOCATION_INFO@@
�C
�
� AllocationSize ���F �C _FILE_ALLOCATION_INFO .?AU_FILE_ALLOCATION_INFO@@ �C n �"
�+
� B � _RDR_CALLOUT_STATE .?AU_RDR_CALLOUT_STATE@@ ��
�C
�
�C �C
�C
�
/
� r � _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY .?AU_RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY@@ ��
�C
� *
� DisallowChildProcessCreation �r �C _RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY .?AU_RTL_IMAGE_MITIGATION_CHILD_PROCESS_POLICY@@ �� �C L
>
� �
� KernelTime ���
� UserTime �
� CreateTime ���
" WaitTime �
StartAddress �
ClientId �
( Priority �
, BasePriority �
" 0 ContextSwitches ��
" 4 ThreadState ��
" 8 WaitReason ���R �C @ _SYSTEM_THREAD_INFORMATION .?AU_SYSTEM_THREAD_INFORMATION@@ �� �C � F J � BULK_SECURITY_TEST_DATA .?AUBULK_SECURITY_TEST_DATA@@ 2
" DesiredAccess
� SecurityIds ��J �C BULK_SECURITY_TEST_DATA .?AUBULK_SECURITY_TEST_DATA@@ �C � �
d
� �
" Magic
" Count
" Size �
" UserCount
" UserSize �
UserContext ��
�C Next �
Trace > �C _RTL_TRACE_BLOCK .?AU_RTL_TRACE_BLOCK@@ �� �C N � _ETW_DISKIO_READWRITE_V2 .?AU_ETW_DISKIO_READWRITE_V2@@ ��
" DiskNumber ���
" IrpFlags �
" Size �
" Reserved �
# ByteOffset ���
FileObject ���
IrpAddr ��
# HighResResponseTime ��N �C ( _ETW_DISKIO_READWRITE_V2 .?AU_ETW_DISKIO_READWRITE_V2@@ �� �C b � �%
�C
� >
u lbStyle ��
" lbColor ��
" lbHatch ��6 �C tagLOGBRUSH32 .?AUtagLOGBRUSH32@@ �C � R
� �C : PortBasicInformation � PortDumpInformation ��F t �C _PORT_INFORMATION_CLASS .?AW4_PORT_INFORMATION_CLASS@@ � �C � � " �@ F � SYSTEM_BATTERY_STATE .?AUSYSTEM_BATTERY_STATE@@ �� " �
AcOnLine �
BatteryPresent ���
Charging �
Discharging ��
D Spare1 ���
Tag ��
" MaxCapacity ��
" RemainingCapacity
" Rate �
" EstimatedTime
" DefaultAlert1
" DefaultAlert2 F D SYSTEM_BATTERY_STATE .?AUSYSTEM_BATTERY_STATE@@ �� D { 0 2 � _DataStream .?AU_DataStream@@ J
! Length ���
! Flags
" Reserved �
# Vdl ��2 D _DataStream .?AU_DataStream@@ D � �
m
�
F)
�
�2
� 6 � tagMETARECORD .?AUtagMETARECORD@@
D ��
D
� ! " �B
" rdSize ���
! rdFunction ���
D rdParm ���6 D tagMETARECORD .?AUtagMETARECORD@@ D � �
�
�
�-
�
@@
�
�
� b � _PERFINFO_PO_CALIBRATED_PERFCOUNTER .?AU_PERFINFO_PO_CALIBRATED_PERFCOUNTER@@ "
� PerformanceCounter ���b D _PERFINFO_PO_CALIBRATED_PERFCOUNTER .?AU_PERFINFO_PO_CALIBRATED_PERFCOUNTER@@ D b �
�!
�
kA
� F � _LBR_TRACE_EVENT_DATA .?AU_LBR_TRACE_EVENT_DATA@@ > " �f
# TimeStamp
" ProcessId
" ThreadId �
" Options ��
D Entries ��F D _LBR_TRACE_EVENT_DATA .?AU_LBR_TRACE_EVENT_DATA@@ !D b v � _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY@@ ^
� BlockNonMicrosoftSignedBinaries ��
� EnforceSigningOnModuleDependencies ���v $D _RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY .?AU_RTL_IMAGE_MITIGATION_BINARY_SIGNATURE_POLICY@@ %D � � N � _ETW_HEAP_EVENT_EXPANSION .?AU_ETW_HEAP_EVENT_EXPANSION@@ �
m Header ���
HeapHandle ���
" $ CommittedSize
( Address ��
" , FreeSpace
" 0 CommittedSpace ���
" 4 ReservedSpace
" 8 NoOfUCRs �
" < AllocatedSpace ���N )D @ _ETW_HEAP_EVENT_EXPANSION .?AU_ETW_HEAP_EVENT_EXPANSION@@ *D b �
2
� V
" Flags
NewTlsData ���
OldTlsData ���
ThreadId �J -D _THREAD_TLS_INFORMATION .?AU_THREAD_TLS_INFORMATION@@ .D � b v PROXY_CALCSIZE ��� PROXY_GETBUFFER �� PROXY_MARSHAL PROXY_SENDRECEIVE PROXY_UNMARSHAL ��. t 0D PROXY_PHASE .?AW4PROXY_PHASE@@ � 1D � N
V � _JOURNAL_ABSOLUTE_INFORMATION .?AU_JOURNAL_ABSOLUTE_INFORMATION@@
3D
� f
� StartTimeStamp ���
� EndTimeStamp �
# NumberOfRecords ��
" FillLevel V 5D _JOURNAL_ABSOLUTE_INFORMATION .?AU_JOURNAL_ABSOLUTE_INFORMATION@@ 6D � �
0
�
�
�
�.
�
C
� R � _TRACE_ENABLE_FLAG_EXT_ITEM .?AU_TRACE_ENABLE_FLAG_EXT_ITEM@@ &
! Offset ���
! Type �R =D _TRACE_ENABLE_FLAG_EXT_ITEM .?AU_TRACE_ENABLE_FLAG_EXT_ITEM@@ >D b $
�"
�
�
� b � _EVENT_TRACE_GROUPMASK_INFORMATION .?AU_EVENT_TRACE_GROUPMASK_INFORMATION@@ ��b
? EventTraceInformationClass ���
# TraceHandle ��
] EventTraceGroupMasks �b CD 0 _EVENT_TRACE_GROUPMASK_INFORMATION .?AU_EVENT_TRACE_GROUPMASK_INFORMATION@@ �� DD @ � F � _SINGLE_LIST_ENTRY32 .?AU_SINGLE_LIST_ENTRY32@@ ��
" Next �F GD _SINGLE_LIST_ENTRY32 .?AU_SINGLE_LIST_ENTRY32@@ �� HD � >
W Id ���
" Flags
SpaceGuarantee ���^ JD _STORAGE_RESERVE_AREA_DEFINITION .?AU_STORAGE_RESERVE_AREA_DEFINITION@@ �� KD � �* B
" OffsetInstanceData ���
" LengthInstanceData ���R MD OFFSETINSTANCEDATAANDLENGTH .?AUOFFSETINSTANCEDATAANDLENGTH@@ ND � � �
" SegmentReserveSize ���
" SegmentCommitSize
" SegmentCount �
" AllocatedSize
" LargeAllocReserveSize
" LargeAllocCommitSize �v PD _SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION .?AU_SEGMENT_HEAP_PERFORMANCE_COUNTER_INFORMATION@@ QD � : � tagEMRFILLPATH .?AUtagEMRFILLPATH@@ ��&
� emr ��
c rclBounds : TD tagEMRFILLPATH .?AUtagEMRFILLPATH@@ �� UD � � R
p lpDebugStringData
! fUnicode �
! nDebugStringLength ���N WD _OUTPUT_DEBUG_STRING_INFO .?AU_OUTPUT_DEBUG_STRING_INFO@@ XD � ] N � _CSV_QUERY_FILE_REVISION .?AU_CSV_QUERY_FILE_REVISION@@ ��
ZD
� .
FileId ���
mC FileRevision �N \D _CSV_QUERY_FILE_REVISION .?AU_CSV_QUERY_FILE_REVISION@@ �� ]D � l *
a= ntmTm
�. H ntmFontSig ���B _D ` tagNEWTEXTMETRICEXA .?AUtagNEWTEXTMETRICEXA@@ `D �
D<
� b
" Attribute
" Size �
" Value
ValuePtr �
" ReturnLength �6 cD _PS_ATTRIBUTE .?AU_PS_ATTRIBUTE@@ dD � �
�B
� ~ � _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION@@ �� �; " �J
" ProcessorNumber ��
" StateCount ���
hD States ���~ iD _SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION .?AU_SYSTEM_PROCESSOR_PERFORMANCE_STATE_DISTRIBUTION@@ �� jD � . � _Reparse .?AU_Reparse@@ ��" � _Ea .?AU_Ea@@ ^
�. DesiredStorageClass ��
D DataStream ���
lD Reparse ��
mD Ea ���: nD _StreamInformation .?AT_StreamInformation@@ �� oD � �
�-
�
$(
�
T3 ��
sD
� > � _IMAGE_SYMBOL_EX .?AU_IMAGE_SYMBOL_EX@@ ��"
" Short
" Long �: vD <anonymous-tag> .?AU<anonymous-tag>@@ wD � { :
ShortName
wD Name �
7 LongName �2 yD <anonymous-tag> .?AT<anonymous-tag>@@ zD � y ~
zD N
" Value
SectionNumber
! Type �
StorageClass �
NumberOfAuxSymbols ���> |D _IMAGE_SYMBOL_EX .?AU_IMAGE_SYMBOL_EX@@ �� }D � x
y
�
�
� � � �D
�A
� V � _PERFINFO_DOMAIN_CHANGE_EVENT .?AU_PERFINFO_DOMAIN_CHANGE_EVENT@@ >
# NewDomain
�; Reason ���
" ThreadId �V �D _PERFINFO_DOMAIN_CHANGE_EVENT .?AU_PERFINFO_DOMAIN_CHANGE_EVENT@@ �D b #
i9
� F
" SizeStruct ���
" Option ���
� OptionData ���V �D _RTL_PROCESS_VERIFIER_OPTIONS .?AU_RTL_PROCESS_VERIFIER_OPTIONS@@ �D � " �D
�D
� : � _EXCEPTION_LOG .?AU_EXCEPTION_LOG@@ ��
�D
� �
� ExceptionRecord ��
� P ContextRecord
Y �Type �
�Disposition ��
" �Thread ���
" �ControlPc
Handler ��: �D _EXCEPTION_LOG .?AU_EXCEPTION_LOG@@ �� �D �
" pointerType ��
u pointerId
u frameId ��
u pointerFlags �
sourceDevice �
� hwndTarget ���
� ptPixelLocation ��
� ptHimetricLocation ���
� ( ptPixelLocationRaw ���
� 0 ptHimetricLocationRaw
" 8 dwTime ���
u < historyCount �
t @ InputData
" D dwKeyStates ��
# H PerformanceCount �
w& P ButtonChangeType �: �D X tagPOINTER_INFO .?AUtagPOINTER_INFO@@ �D ~ � R � _TXFS_GET_METADATA_INFO_OUT .?AU_TXFS_GET_METADATA_INFO_OUT@@ *
LowPart ��
HighPart �: �D <anonymous-tag> .?AU<anonymous-tag>@@ �D � � f
�D TxfFileId
$ LockingTransaction ���
# LastLsn ��
" ( TransactionState �R �D 0 _TXFS_GET_METADATA_INFO_OUT .?AU_TXFS_GET_METADATA_INFO_OUT@@ �D � � V � _CONSOLE_SCREEN_BUFFER_INFOEX .?AU_CONSOLE_SCREEN_BUFFER_INFOEX@@ " " @ ��
" cbSize ���
�" dwSize ���
�" dwCursorPosition �
! wAttributes ��
i: srWindow �
�" dwMaximumWindowSize ��
! wPopupAttributes �
t bFullscreenSupported �
�D ColorTable ���V �D ` _CONSOLE_SCREEN_BUFFER_INFOEX .?AU_CONSOLE_SCREEN_BUFFER_INFOEX@@ �D l: �
�@
�
�
�
� � p " t �D
�D
� V � _PLUGPLAY_CONTROL_DEPTH_DATA .?AU_PLUGPLAY_CONTROL_DEPTH_DATA@@ ��6
DeviceInstance ���
" DeviceDepth ��V �D _PLUGPLAY_CONTROL_DEPTH_DATA .?AU_PLUGPLAY_CONTROL_DEPTH_DATA@@ �� �D $ � F � _PO_WAKE_SOURCE_FIXED .?AU_PO_WAKE_SOURCE_FIXED@@ 6
4> Header ���
�6 FixedWakeSourceType ��F �D _PO_WAKE_SOURCE_FIXED .?AU_PO_WAKE_SOURCE_FIXED@@ �D { "
�0
� r � _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX@@ ��
�D
� �
EnableIntegrity ��
KeepIntegrityStateUnchanged ��
! Reserved �
" Flags
Version ��
%/ Reserved2 r �D _FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX .?AU_FSCTL_SET_INTEGRITY_INFORMATION_BUFFER_EX@@ �� �D � �
�"
�
�4
� j � _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST@@
�D
� 2
" RequestLevel �
" RequestFlags �j �D _STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_REQUEST@@ �D � ; &
@ Next �
�& Handler ��Z �D _EXCEPTION_REGISTRATION_RECORD .?AU_EXCEPTION_REGISTRATION_RECORD@@ �� �D D
�,
� F � _REPAIR_COPIES_OUTPUT .?AU_REPAIR_COPIES_OUTPUT@@
�D
� B
" Size �
Status ���
� ResumeFileOffset �F �D _REPAIR_COPIES_OUTPUT .?AU_REPAIR_COPIES_OUTPUT@@ �D � F
C
� TP_DEBUG_CLASS_POOL ��6 t �D _TP_DEBUG_CLASS .?AW4_TP_DEBUG_CLASS@@ � �D � 5
�D
�
�@
�
�
�
�!
�
\ Tail �6 �D _LDRP_CSLIST .?AU_LDRP_CSLIST@@ �� �D � � * � HUMPD__ .?AUHUMPD__@@
�D
�
t unused ���* �D HUMPD__ .?AUHUMPD__@@ �D s x � TOKEN_SECURITY_ATTRIBUTE_OPERATION_NONE �� TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL ��� TOKEN_SECURITY_ATTRIBUTE_OPERATION_ADD ��� TOKEN_SECURITY_ATTRIBUTE_OPERATION_DELETE TOKEN_SECURITY_ATTRIBUTE_OPERATION_REPLACE ���^ t �D _TOKEN_SECURITY_ATTRIBUTE_OPERATION .?AW4_TOKEN_SECURITY_ATTRIBUTE_OPERATION@@ � �D � - b � _SYSTEM_PROCESSOR_POWER_INFORMATION .?AU_SYSTEM_PROCESSOR_POWER_INFORMATION@@
�D
� Z
CurrentFrequency �
ThermalLimitFrequency
ConstantThrottleFrequency
DegradedThrottleFrequency
LastBusyFrequency
LastC3Frequency ��
LastAdjustedBusyFrequency
ProcessorMinThrottle �
ProcessorMaxThrottle �
" NumberOfFrequencies ��
" PromotionCount ���
" DemotionCount
" ErrorCount ���
" RetryCount ���
# CurrentFrequencyTime �
# ( CurrentProcessorTime �
# 0 CurrentProcessorIdleTime �
# 8 LastProcessorTime
# @ LastProcessorIdleTime
# H Energy ���b �D P _SYSTEM_PROCESSOR_POWER_INFORMATION .?AU_SYSTEM_PROCESSOR_POWER_INFORMATION@@ �D � D
�
&2
� R � _FSCTL_QUERY_FAT_BPB_BUFFER .?AU_FSCTL_QUERY_FAT_BPB_BUFFER@@
�D
� " $ �*
�D First0x24BytesOfBootSector ���R �D $ _FSCTL_QUERY_FAT_BPB_BUFFER .?AU_FSCTL_QUERY_FAT_BPB_BUFFER@@ �D � � N � _IO_SESSION_CONNECT_INFO .?AU_IO_SESSION_CONNECT_INFO@@ ��.
" SessionId
LocalSession �N �D _IO_SESSION_CONNECT_INFO .?AU_IO_SESSION_CONNECT_INFO@@ �� �D � *
�?
�
O2
� b � _ALPC_PORT_MESSAGE_ZONE_INFORMATION .?AU_ALPC_PORT_MESSAGE_ZONE_INFORMATION@@ &
Buffer ���
" Size �b �D _ALPC_PORT_MESSAGE_ZONE_INFORMATION .?AU_ALPC_PORT_MESSAGE_ZONE_INFORMATION@@ �D � & � AlpcMessageSidInformation AlpcMessageTokenModifiedIdInformation AlpcMessageDirectStatusInformation ��� AlpcMessageHandleInformation �V t �D _ALPC_MESSAGE_INFORMATION_CLASS .?AW4_ALPC_MESSAGE_INFORMATION_CLASS@@ � �D � �
2
� F � _SYSTEM_POWER_STATUS .?AU_SYSTEM_POWER_STATUS@@ ��
ACLineStatus �
BatteryFlag ��
BatteryLifePercent ���
SystemStatusFlag �
" BatteryLifeTime ��
" BatteryFullLifeTime ��F �D _SYSTEM_POWER_STATUS .?AU_SYSTEM_POWER_STATUS@@ �� �D n )
?
�
�(
� > � _TOKEN_ELEVATION .?AU_TOKEN_ELEVATION@@ ��
" TokenIsElevated ��> �D _TOKEN_ELEVATION .?AU_TOKEN_ELEVATION@@ �� �D w �
�"
�
' ��
E
�
�6
�
�=
� R � _FILE_PIPE_WAIT_FOR_BUFFER .?AU_FILE_PIPE_WAIT_FOR_BUFFER@@ ��
E
� Z
� Timeout ��
" NameLength ���
TimeoutSpecified �
Name �R E _FILE_PIPE_WAIT_FOR_BUFFER .?AU_FILE_PIPE_WAIT_FOR_BUFFER@@ �� E � () B � tagHW_PROFILE_INFOW .?AUtagHW_PROFILE_INFOW@@ q " N �R
" dwDockInfo ���
E szHwProfileGuid ��
�! R szHwProfileName ��B E � tagHW_PROFILE_INFOW .?AUtagHW_PROFILE_INFOW@@ E n � Z � _ETW_COVERAGE_SAMPLER_PERF_INFO .?AU_ETW_COVERAGE_SAMPLER_PERF_INFO@@ *
Common ���
`; PerfStats Z E �_ETW_COVERAGE_SAMPLER_PERF_INFO .?AU_ETW_COVERAGE_SAMPLER_PERF_INFO@@ E @ ( J � _TXFS_LIST_TRANSACTIONS .?AU_TXFS_LIST_TRANSACTIONS@@
E
� B
# NumberOfTransactions �
# BufferSizeRequired ���J E _TXFS_LIST_TRANSACTIONS .?AU_TXFS_LIST_TRANSACTIONS@@ E � C J � _RTL_SPARSE_BITMAP_CTX .?AU_RTL_SPARSE_BITMAP_CTX@@ ��
6"
�
E
�
" ��
" ��
" ��
" ��
" Lock �
E BitmapRanges �
7" RangeArrayCommitStatus ���
�- AllocateRoutine ��
�- FreeRoutine ��
" RangeCount ���
" RangeIndexLimit ��
" BitsPerRange �
" $ RangeCountMax
" ( RangeMetadataOffset ��
" , MetadataSizePerBit ���
E 0 DefaultBitsSet ���
E 0 SparseRangeArray �
E 0 NoInternalLocking
E 0 SpareFlags ���J E 4 _RTL_SPARSE_BITMAP_CTX .?AU_RTL_SPARSE_BITMAP_CTX@@ �� E �
�$
�
��
��
��
��
��
��
���
TransferAddress ��
" ZeroBits �
" MaximumStackSize �
" CommittedStackSize ���
" SubSystemType
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���
! ImageCharacteristics �
! DllCharacteristics ���
! Machine ��
" ImageContainsCode
# ImageFlags ���
"E # ComPlusNativeReady ���
#E # ComPlusILOnly
$E # ImageDynamicallyRelocated
%E # ImageMappedFlat ��
&E # BaseBelow4gb �
'E # ComPlusPrefer32bit ���
(E # Reserved �
" $ LoaderFlags ��
" ( ImageFileSize
" , CheckSum �R )E 0 _SECTION_IMAGE_INFORMATION .?AU_SECTION_IMAGE_INFORMATION@@ �� *E w w v
" NextEntryOffset ��
" TotalSize
" TotalInUse ���
" PeakUsage
PageFileName �V ,E _SYSTEM_PAGEFILE_INFORMATION .?AU_SYSTEM_PAGEFILE_INFORMATION@@ �� -E � ?
6
�
SD
�
k-
�
o(
�
�6
� N � _FILE_ATTRIBUTE_TAG_INFO .?AU_FILE_ATTRIBUTE_TAG_INFO@@ ��6
" FileAttributes ���
" ReparseTag ���N 5E _FILE_ATTRIBUTE_TAG_INFO .?AU_FILE_ATTRIBUTE_TAG_INFO@@ �� 6E n �" N � STARTING_VCN_INPUT_BUFFER .?AUSTARTING_VCN_INPUT_BUFFER@@
� StartingVcn ��N 9E STARTING_VCN_INPUT_BUFFER .?AUSTARTING_VCN_INPUT_BUFFER@@ :E � T
F � _RPC_SERVER_INTERFACE .?AU_RPC_SERVER_INTERFACE@@ �
u Length ���
/ InterfaceId ��
/ TransferSyntax ���
|! , DispatchTable
u 0 RpcProtseqEndpointCount ��
~! 4 RpcProtseqEndpoint ���
8 DefaultManagerEpv
< InterpreterInfo ��
u @ Flags F =E D _RPC_SERVER_INTERFACE .?AU_RPC_SERVER_INTERFACE@@ >E 3 � j � _SERVICE_CONTROL_STATUS_REASON_PARAMSW .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSW@@ ��F
" dwReason �
q pszComment ���
� ServiceStatus j AE , _SERVICE_CONTROL_STATUS_REASON_PARAMSW .?AU_SERVICE_CONTROL_STATUS_REASON_PARAMSW@@ �� BE � �
S
� F � _CONSOLE_HISTORY_INFO .?AU_CONSOLE_HISTORY_INFO@@ j
u cbSize ���
u HistoryBufferSize
u NumberOfHistoryBuffers ���
" dwFlags ��F FE _CONSOLE_HISTORY_INFO .?AU_CONSOLE_HISTORY_INFO@@ GE @% Z ReadDirectoryNotifyInformation ��� ReadDirectoryNotifyExtendedInformation ���j t IE _READ_DIRECTORY_NOTIFY_INFORMATION_CLASS .?AW4_READ_DIRECTORY_NOTIFY_INFORMATION_CLASS@@ ��� JE � �
JE
�
��
ME
�
07
� R � _MEMORY_BASIC_INFORMATION32 .?AU_MEMORY_BASIC_INFORMATION32@@
PE
� �
" BaseAddress ��
" AllocationBase ���
" AllocationProtect
" RegionSize ���
" State
" Protect ��
" Type �R RE _MEMORY_BASIC_INFORMATION32 .?AU_MEMORY_BASIC_INFORMATION32@@ SE � _
r
�
�@
�
�)
� N
Handle ���
ClientId �
" Type �
Stacks ���V XE P _PROCESS_HANDLE_TRACING_ENTRY .?AU_PROCESS_HANDLE_TRACING_ENTRY@@ YE D N B � _ETW_UMS_EVENT_PARK .?AU_ETW_UMS_EVENT_PARK@@ F
" ProcessId
" ScheduledThreadId
" ParkFlags B \E _ETW_UMS_EVENT_PARK .?AU_ETW_UMS_EVENT_PARK@@ ]E b �
� J � _WMI_LOGGER_INFORMATION .?AU_WMI_LOGGER_INFORMATION@@
`E
�
# ��
# ��
# ��
# ��
� Wnode
" 0 BufferSize ���
" 4 MinimumBuffers ���
" 8 MaximumBuffers ���
" < MaximumFileSize ��
" @ LogFileMode ��
" D FlushTimer ���
" H EnableFlags ��
L AgeLimit �
L FlushThreshold ���
bE P Wow ��
cE P QpcDeltaTracking �
dE P LargeMdlPages
eE P ExcludeKernelStack ���
# P V2Options
X LogFileHandle
# X LogFileHandle64 ��
" ` NumberOfBuffers ��
" ` InstanceCount
" d FreeBuffers ��
" d InstanceId ���
" h EventsLost ���
" h NumberOfProcessors ���
" l BuffersWritten ���
" p LogBuffersLost ���
" p Flags
" t RealTimeBuffersLost ��
x LoggerThreadId ���
# x LoggerThreadId64 �
� LogFileName ��
� � LogFileName64
� LoggerName ���
� � LoggerName64 �
" � RealTimeConsumerCount
" � SequenceNumber ���
� LoggerExtension ��
# � LoggerExtension64 J % fE � _WMI_LOGGER_INFORMATION .?AU_WMI_LOGGER_INFORMATION@@ gE b @ 6 � tagPOLYTEXTW .?AUtagPOLYTEXTW@@ ��
iE
� j
t x
t y
u n
lpstr
u uiFlags ��
rcl ��
t $ pdx ��6 kE ( tagPOLYTEXTW .?AUtagPOLYTEXTW@@ �� lE � G
b � _SERVICE_REQUIRED_PRIVILEGES_INFOA .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOA@@ ��
nE
� &
p pmszRequiredPrivileges ���b pE _SERVICE_REQUIRED_PRIVILEGES_INFOA .?AU_SERVICE_REQUIRED_PRIVILEGES_INFOA@@ �� qE � Q $
sE
�
�B
�
� � wE
xE
�
�C
�
�8
� ^ � _JOBOBJECT_BASIC_UI_RESTRICTIONS .?AU_JOBOBJECT_BASIC_UI_RESTRICTIONS@@ ��"
" UIRestrictionsClass ��^ }E _JOBOBJECT_BASIC_UI_RESTRICTIONS .?AU_JOBOBJECT_BASIC_UI_RESTRICTIONS@@ �� ~E D �
�-
� R � _WIM_PROVIDER_OVERLAY_ENTRY .?AU_WIM_PROVIDER_OVERLAY_ENTRY@@ �
" NextEntryOffset ��
� DataSourceId �
$ WimGuid ��
" WimFileNameOffset
" $ WimType ��
" ( WimIndex �
" , Flags R �E 0 _WIM_PROVIDER_OVERLAY_ENTRY .?AU_WIM_PROVIDER_OVERLAY_ENTRY@@ �E � ;"
A
�
�C
� ^ � _IMAGE_CE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_CE_RUNTIME_FUNCTION_ENTRY@@ ��
" ��
" ��
" ��
" ��n
" FuncStart
�E PrologLen
�E FuncLen ��
�E ThirtyTwoBit �
�E ExceptionFlag ^ �E _IMAGE_CE_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_CE_RUNTIME_FUNCTION_ENTRY@@ �� �E � � � PowerRequestDisplayRequired �� PowerRequestSystemRequired ��� PowerRequestAwayModeRequired � PowerRequestExecutionRequired > t �E _POWER_REQUEST_TYPE .?AW4_POWER_REQUEST_TYPE@@ � �E { H .
� pfnAllocate ��
� pfnFree ��B �E _MALLOC_FREE_STRUCT .?AU_MALLOC_FREE_STRUCT@@ �E � �
A
� 0> F � _ETW_HEAP_EVENT_FREE .?AU_ETW_HEAP_EVENT_FREE@@ ��V
m Header ���
HeapHandle ���
$ Address ��
" ( Source ���F �E , _ETW_HEAP_EVENT_FREE .?AU_ETW_HEAP_EVENT_FREE@@ �� �E b �
COMPARE_STRING ���6 t �E SYSNLS_FUNCTION .?AW4SYSNLS_FUNCTION@@ � �E V � R � _FILE_FULL_DIR_INFORMATION .?AU_FILE_FULL_DIR_INFORMATION@@ ��
�E
� &
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
D FileName �R �E H _FILE_FULL_DIR_INFORMATION .?AU_FILE_FULL_DIR_INFORMATION@@ �� �E � � �
Buffer ���
" BufferSize ���
� pfnAllocate ��
� pfnFree ��
�3 pRpcChannelBuffer
� Reserved �V �E ( _NDR_USER_MARSHAL_INFO_LEVEL1 .?AU_NDR_USER_MARSHAL_INFO_LEVEL1@@ �E � J � _ETW_CRITSEC_EVENT_INIT .?AU_ETW_CRITSEC_EVENT_INIT@@
�E
� >
m Header ���
SpinCount
$ Address ��J �E ( _ETW_CRITSEC_EVENT_INIT .?AU_ETW_CRITSEC_EVENT_INIT@@ �E b � B � _LDR_RESLOADER_RET .?AU_LDR_RESLOADER_RET@@ ��B
Module ���
DataEntry
TargetModule �B �E _LDR_RESLOADER_RET .?AU_LDR_RESLOADER_RET@@ �� �E b � " " � �E .
pValue ���
" ValueLength ��v �E _CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE .?AU_CLAIM_SECURITY_ATTRIBUTE_OCTET_STRING_VALUE@@ �� �E w [
X
�
a
�
�&
�
�,
� �D
%7
� �
" EntryLength ��
" DependencyTypeFlags ��
" ProviderSpecificFlags
� VirtualStorageType ���
" AncestorLevel
" $ HostVolumeNameOffset �
" ( HostVolumeNameSize ���
" , DependentVolumeNameOffset
" 0 DependentVolumeNameSize ��
" 4 RelativePathOffset ���
" 8 RelativePathSize �
" < DependentDeviceNameOffset
" @ DependentDeviceNameSize ��r
�E D _STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY .?AU_STORAGE_QUERY_DEPENDENT_VOLUME_LEV2_ENTRY@@ �� �E � J
%
� 2
# JobMemory
# PeakJobMemoryUsed b �E _JOBOBJECT_MEMORY_USAGE_INFORMATION .?AU_JOBOBJECT_MEMORY_USAGE_INFORMATION@@ �E � O
�
� F � _OPTICAL_MEDIA_RECORD .?AU_OPTICAL_MEDIA_RECORD@@
�E
� ~
! DiskNumber ���
! BusType ��
! DeviceType ���
! MediaType
# StartingOffset ���
# Size �
# NumberOfFreeBlocks ���
# TotalNumberOfBlocks ��
# ( NextWritableAddress ��
" 0 NumberOfSessions �
" 4 NumberOfTracks ���
" 8 BytesPerSector ���
! < DiscStatus ���
! > LastSessionStatus
@ Data �F �E H _OPTICAL_MEDIA_RECORD .?AU_OPTICAL_MEDIA_RECORD@@ �E b 3
O8
� J � _WIN32K_SYSCALL_FILTER .?AU_WIN32K_SYSCALL_FILTER@@ ��
�E
� .
" FilterState ��
" FilterSet J �E _WIN32K_SYSCALL_FILTER .?AU_WIN32K_SYSCALL_FILTER@@ �� �E D �
" Characteristics ��
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" Name �
" Base �
" NumberOfFunctions
" NumberOfNames
" AddressOfFunctions ���
" AddressOfNames ���
" $ AddressOfNameOrdinals J �E ( _IMAGE_EXPORT_DIRECTORY .?AU_IMAGE_EXPORT_DIRECTORY@@ �E � j F � _CONSOLE_CURSOR_INFO .?AU_CONSOLE_CURSOR_INFO@@ ��*
" dwSize ���
t bVisible �F �E _CONSOLE_CURSOR_INFO .?AU_CONSOLE_CURSOR_INFO@@ �� �E l: �
�A
� N � _WMI_TRACE_MESSAGE_PACKET .?AU_WMI_TRACE_MESSAGE_PACKET@@ 2
! MessageNumber
! OptionFlags ��N �E _WMI_TRACE_MESSAGE_PACKET .?AU_WMI_TRACE_MESSAGE_PACKET@@ �E b } v � _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE@@ J
# TimeAdjustment ���
# TimeIncrement
Enable ���v �E _SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE .?AU_SYSTEM_QUERY_TIME_ADJUST_INFORMATION_PRECISE@@ �E � i J � _FILE_ID_BOTH_DIR_INFO .?AU_FILE_ID_BOTH_DIR_INFO@@ ��j
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
p D ShortNameLength ��
� F ShortName
� ` FileId ���
h FileName �J �E p _FILE_ID_BOTH_DIR_INFO .?AU_FILE_ID_BOTH_DIR_INFO@@ �� �E n �"
�
� �# " �V
Version ��
%/ Reserved0
# ApplicationId
�E Policies �J �E _IMAGE_POLICY_METADATA .?AU_IMAGE_POLICY_METADATA@@ �� �E g �&
�7
� V � _SYSTEM_ROOT_SILO_INFORMATION .?AU_SYSTEM_ROOT_SILO_INFORMATION@@ 2
" NumberOfSilos
� SiloIdList ���V �E _SYSTEM_ROOT_SILO_INFORMATION .?AU_SYSTEM_ROOT_SILO_INFORMATION@@ �E � � Z � DISPLAYCONFIG_VIDEO_SIGNAL_INFO .?AUDISPLAYCONFIG_VIDEO_SIGNAL_INFO@@ "
�E targetVideoSignalInfo N �E 0 DISPLAYCONFIG_TARGET_MODE .?AUDISPLAYCONFIG_TARGET_MODE@@ �E � c
< ( �E
\#
� N � _VARIABLE_NAME_AND_VALUE .?AU_VARIABLE_NAME_AND_VALUE@@ ��
" NextEntryOffset ��
" ValueOffset ��
" ValueLength ��
" Attributes ���
$ VendorGuid ���
Name �N �E $ _VARIABLE_NAME_AND_VALUE .?AU_VARIABLE_NAME_AND_VALUE@@ �� �E � 3
�
� V � _PLUGPLAY_CONTROL_STATUS_DATA .?AU_PLUGPLAY_CONTROL_STATUS_DATA@@
�E
� �
DeviceInstance ���
" Operation
" DeviceStatus �
" DeviceProblem
" Flags
ProblemStatus V �E _PLUGPLAY_CONTROL_STATUS_DATA .?AU_PLUGPLAY_CONTROL_STATUS_DATA@@ �E $ � > � _CM_RESOURCE_LIST .?AU_CM_RESOURCE_LIST@@
�E
� �4 " �"
" Count
�E List �> �E $ _CM_RESOURCE_LIST .?AU_CM_RESOURCE_LIST@@ F x > � _EVENTSFORLOGFILE .?AU_EVENTSFORLOGFILE@@ �& " �f
" ulSize ���
� szLogicalLogFile �
" ulNumRecords �
F pEventLogRecords �> F _EVENTSFORLOGFILE .?AU_EVENTSFORLOGFILE@@ F �& t
u ��
u ��
u
��J
F videoStandard
F vSyncFreqDivider �
F reserved �:
F <anonymous-tag> .?AU<anonymous-tag>@@ F � % �
# pixelRate
3 hSyncFreq
3 vSyncFreq
C activeSize ���
C totalSize
F ( AdditionalSignalInfo �
u ( videoStandard
3 , scanLineOrdering �Z
F 0 DISPLAYCONFIG_VIDEO_SIGNAL_INFO .?AUDISPLAYCONFIG_VIDEO_SIGNAL_INFO@@ F �
+B
�
%,
� : � tagEMREXTESCAPE .?AUtagEMREXTESCAPE@@ N
� emr ��
t iEscape ��
t cbEscData
� EscData ��: F tagEMREXTESCAPE .?AUtagEMREXTESCAPE@@ F � � j � _JOURNAL_CREATE_DELETE_KEY_INFORMATION .?AU_JOURNAL_CREATE_DELETE_KEY_INFORMATION@@ ���
� Action ���
# RecordNumber �
� TimeStamp
KeyPathName ��
" SecurityDescriptorLength �
$ SecurityDescriptor ���
! ( ClassLength ��
, ClassData
0 SymbolicLink �j F 8 _JOURNAL_CREATE_DELETE_KEY_INFORMATION .?AU_JOURNAL_CREATE_DELETE_KEY_INFORMATION@@ �� F � �
b%
�
4
�
�
�
&
�
�%
�
k4
�
�
�
�
V
�
�
� F � _CM_SCSI_DEVICE_DATA .?AU_CM_SCSI_DEVICE_DATA@@ ��
$F
� F
! Version ��
! Revision �
HostIdentifier ���F &F _CM_SCSI_DEVICE_DATA .?AU_CM_SCSI_DEVICE_DATA@@ �� 'F �
m
� : � _FOUR_PART_VERSION .?AT_FOUR_PART_VERSION@@ ��6
" BuildAndRevision �
" MajorAndMinor : +F <anonymous-tag> .?AU<anonymous-tag>@@ ,F : F
! Revision �
! Build
! Minor
! Major : .F <anonymous-tag> .?AU<anonymous-tag>@@ /F > >
# Version64
,F Version32
/F Version16 : 1F _FOUR_PART_VERSION .?AT_FOUR_PART_VERSION@@ �� 2F 8 b � _SYSTEM_MEMORY_CHANNEL_INFORMATION .?AU_SYSTEM_MEMORY_CHANNEL_INFORMATION@@ ��
" ChannelNumber
" ChannelHeatIndex �
# TotalPageCount ���
# ZeroPageCount
# FreePageCount
# StandbyPageCount �b 5F ( _SYSTEM_MEMORY_CHANNEL_INFORMATION .?AU_SYSTEM_MEMORY_CHANNEL_INFORMATION@@ �� 6F w +
�
�
-
�
�
� &
" Flags
Z FrameName N ;F _TEB_ACTIVE_FRAME_CONTEXT .?AU_TEB_ACTIVE_FRAME_CONTEXT@@ <F < �
�5
� R
W Id ���
" Flags
SpaceGuarantee ���
SpaceUsed R ?F _STORAGE_RESERVE_AREA_INFO .?AU_STORAGE_RESERVE_AREA_INFO@@ �� @F � �*
*
� F � tagEMREXCLUDECLIPRECT .?AUtagEMREXCLUDECLIPRECT@@ &
� emr ��
c rclClip ��F DF tagEMREXCLUDECLIPRECT .?AUtagEMREXCLUDECLIPRECT@@ EF � � z
" Address ��
" Flags
" DataSize �
" OverheadSize �
" NextBlockInformationOffset ���J GF _HEAP_BLOCK_INFORMATION .?AU_HEAP_BLOCK_INFORMATION@@ HF �
Y
�
3
� ^ � _ALPC_SERVER_SESSION_INFORMATION .?AU_ALPC_SERVER_SESSION_INFORMATION@@ ��
LF
� *
" SessionId
" ProcessId ^ NF _ALPC_SERVER_SESSION_INFORMATION .?AU_ALPC_SERVER_SESSION_INFORMATION@@ �� OF � �
�,
� J � _KEY_CACHED_INFORMATION .?AU_KEY_CACHED_INFORMATION@@ �
� LastWriteTime
" TitleIndex ���
" SubKeys ��
" MaxNameLen ���
" Values ���
" MaxValueNameLen ��
" MaxValueDataLen ��
" NameLength ���J SF ( _KEY_CACHED_INFORMATION .?AU_KEY_CACHED_INFORMATION@@ TF �
�'
� Z � _DISPLAYCONFIG_SDR_WHITE_LEVEL .?AU_DISPLAYCONFIG_SDR_WHITE_LEVEL@@ ��.
� header ���
" SDRWhiteLevel Z XF _DISPLAYCONFIG_SDR_WHITE_LEVEL .?AU_DISPLAYCONFIG_SDR_WHITE_LEVEL@@ �� YF � x > � _BOOT_ENTRY_LIST .?AU_BOOT_ENTRY_LIST@@ ��2
" NextEntryOffset ��
q! BootEntry > \F $ _BOOT_ENTRY_LIST .?AU_BOOT_ENTRY_LIST@@ �� ]F � � V � _FILE_PIPE_SILO_ARRIVAL_INPUT .?AU_FILE_PIPE_SILO_ARRIVAL_INPUT@@
JobHandle V `F _FILE_PIPE_SILO_ARRIVAL_INPUT .?AU_FILE_PIPE_SILO_ARRIVAL_INPUT@@ aF � Y) B � _FILE_LAYOUT_ENTRY .?AU_FILE_LAYOUT_ENTRY@@ ���
" Version ��
" NextFileOffset ���
" Flags
" FileAttributes ���
# FileReferenceNumber ��
" FirstNameOffset ��
" FirstStreamOffset
" ExtraInfoOffset ��
" $ ExtraInfoLength ��B dF ( _FILE_LAYOUT_ENTRY .?AU_FILE_LAYOUT_ENTRY@@ �� eF � u # 4 " " gF
hF
�
�<
�
t unused ���2 kF HMONITOR__ .?AUHMONITOR__@@ �� lF s n
�
$'
�
�4
� R � _PROCESS_UPTIME_INFORMATION .?AU_PROCESS_UPTIME_INFORMATION@@
" ��
" ��
" ��
" ��
# QueryInterruptTime ���
# QueryUnbiasedTime
# EndInterruptTime �
# TimeSinceCreation
# Uptime ���
# ( SuspendedTime
rF 0 HangCount
sF 0 GhostCount ���
tF 0 Crashed ��
uF 0 Terminated ���R
vF 8 _PROCESS_UPTIME_INFORMATION .?AU_PROCESS_UPTIME_INFORMATION@@ wF � �
�
�
<B
�
�B
�
.
�
55
�
�6
� > � _SYSDBG_PHYSICAL .?AU_SYSDBG_PHYSICAL@@ ��>
� Address ��
Buffer ���
" Request ��> �F _SYSDBG_PHYSICAL .?AU_SYSDBG_PHYSICAL@@ �� �F � � Z � _FILE_ZERO_DATA_INFORMATION_EX .?AU_FILE_ZERO_DATA_INFORMATION_EX@@ ��F
� FileOffset ���
� BeyondFinalZero ��
" Flags Z �F _FILE_ZERO_DATA_INFORMATION_EX .?AU_FILE_ZERO_DATA_INFORMATION_EX@@ �� �F � �
�8
� N � _CI_LOG_SCHEDULER_WAKEUP .?AU_CI_LOG_SCHEDULER_WAKEUP@@ ��*
Header ���
" 0 Reason ���N �F 8 _CI_LOG_SCHEDULER_WAKEUP .?AU_CI_LOG_SCHEDULER_WAKEUP@@ �� �F b M N � _ETW_HEAP_EVENT_SNAPSHOT .?AU_ETW_HEAP_EVENT_SNAPSHOT@@ ��
m Header ���
HeapHandle ���
" $ FreeSpace
" ( CommittedSpace ���
" , ReservedSpace
" 0 Flags
" 4 ProcessId
" 8 LargeUCRSpace
" < FreeListLength ���
" @ UCRLength
" D AllocatedSpace ���N �F H _ETW_HEAP_EVENT_SNAPSHOT .?AU_ETW_HEAP_EVENT_SNAPSHOT@@ �� �F b � V � _WOW64_DESCRIPTOR_TABLE_ENTRY .?AU_WOW64_DESCRIPTOR_TABLE_ENTRY@@
�F
� .
" Selector �
D( Descriptor ���V �F _WOW64_DESCRIPTOR_TABLE_ENTRY .?AU_WOW64_DESCRIPTOR_TABLE_ENTRY@@ �F � �
K?
� N � _SYSTEM_ALARM_OBJECT_ACE .?AU_SYSTEM_ALARM_OBJECT_ACE@@ ��
� Header ���
" Mask �
" Flags
$ ObjectType ���
$ InheritedObjectType ��
" , SidStart �N �F 0 _SYSTEM_ALARM_OBJECT_ACE .?AU_SYSTEM_ALARM_OBJECT_ACE@@ �� �F w �
6
�
=
�
�1
� J � _PERFINFO_FLT_OPERATION .?AU_PERFINFO_FLT_OPERATION@@ �
RoutineAddr ��
FileObject ���
FsContext
IrpPtr ���
CbdPtr ���
MajorFunction J �F _PERFINFO_FLT_OPERATION .?AU_PERFINFO_FLT_OPERATION@@ �F b � Z � _FILE_MOVE_CLUSTER_INFORMATION .?AU_FILE_MOVE_CLUSTER_INFORMATION@@ ��b
" ClusterCount �
RootDirectory
" FileNameLength ���
FileName �Z �F _FILE_MOVE_CLUSTER_INFORMATION .?AU_FILE_MOVE_CLUSTER_INFORMATION@@ �� �F � �
G$
�
�'
� b � _WIM_PROVIDER_REMOVE_OVERLAY_INPUT .?AU_WIM_PROVIDER_REMOVE_OVERLAY_INPUT@@ ��
�F
�
� DataSourceId �b �F _WIM_PROVIDER_REMOVE_OVERLAY_INPUT .?AU_WIM_PROVIDER_REMOVE_OVERLAY_INPUT@@ �� �F � 3"
�$
�
�?
� r � _PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED .?AU_PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED@@ ��B
DeviceInterface ��
" Flags
Enabled ��r �F _PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED .?AU_PLUGPLAY_CONTROL_DEVICE_INTERFACE_ENABLED@@ �� �F $
�#
� � t t �F
�F
�
�#
� * � _FP_32 .?AU_FP_32@@ ��
I16Value �
! U16Value �
I32Value �
" U32Value �
StringValue ��
" CompareValue �
�F Fp32Value
� I64Value �
� U64Value �
( Fp64Value
12 Fp80Value
? Fp128Value ���2 �F <anonymous-tag> .?AT<anonymous-tag>@@ �F � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�F RoundingMode �
�F Inexact ��
�F Underflow
�F Overflow �
�F ZeroDivide ���
�F InvalidOperation �
�F OperandValid �
�F Format ���
�F Precision
�F Operation
�F Spare
�F HardwareException : �F <anonymous-tag> .?AU<anonymous-tag>@@ �F � � &
�F Value
�F Control ��: �F _FP_IEEE_VALUE .?AU_FP_IEEE_VALUE@@ �� �F � � �
" BufferSize ���
" ProviderId ���
# HistoricalContext
" Version ��
" Linkage ��
" CountLost
KernelHandle �
� TimeStamp
$ Guid �
" ( ClientContext
" , Flags 6 �F 0 _WNODE_HEADER .?AU_WNODE_HEADER@@ �F � N � _RTL_FEATURE_USAGE_REPORT .?AU_RTL_FEATURE_USAGE_REPORT@@
�F
� J
u FeatureId
! ReportingKind
! ReportingOptions �N �F _RTL_FEATURE_USAGE_REPORT .?AU_RTL_FEATURE_USAGE_REPORT@@ �F �
$
�
�)
�
�
� & IoCompletionBasicInformation �Z t �F _IO_COMPLETION_INFORMATION_CLASS .?AW4_IO_COMPLETION_INFORMATION_CLASS@@ ��� �F 7! ;
<
� �F
�F
�
�5
� F � _SL_HWID_DEVICE_INFO .?AU_SL_HWID_DEVICE_INFO@@ ��
" SizeBytes
Type �
DeviceRemovalPolicy ��
AuthenticationStatus �
Disposition ��
" DeviceNodeLevel ��
$ Guid �
� Data �F �F _SL_HWID_DEVICE_INFO .?AU_SL_HWID_DEVICE_INFO@@ �� �F � �
M6
� R � _SE_PACKAGE_CAPABILITY_INFO .?AU_SE_PACKAGE_CAPABILITY_INFO@@ 2
" Remaining
" PackageGrantedAccess �
" CapabilityGrantedAccess ��
" UserGroupsRemaining ��
" AllAppPackagesSkippedAccess ��
PackagesPresent ��
PackageMatch �
CapabilityMatch ��
LogPermissiveFailure �
AllAppPackagesSkipped R
�F _SE_PACKAGE_CAPABILITY_INFO .?AU_SE_PACKAGE_CAPABILITY_INFO@@ �F �
%
�
a=
� Z � _IMAGE_LOAD_CONFIG_DIRECTORY64 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY64@@ ��
�F
� �
" Size �
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
" GlobalFlagsClear �
" GlobalFlagsSet ���
" CriticalSectionDefaultTimeout
# DeCommitFreeBlockThreshold ���
# DeCommitTotalFreeThreshold ���
# ( LockPrefixTable ��
# 0 MaximumAllocationSize
# 8 VirtualMemoryThreshold ���
# @ ProcessAffinityMask ��
" H ProcessHeapFlags �
! L CSDVersion ���
! N DependentLoadFlags ���
# P EditList �
# X SecurityCookie ���
# ` SEHandlerTable ���
# h SEHandlerCount ���
# p GuardCFCheckFunctionPointer ��
# x GuardCFDispatchFunctionPointer ���
# � GuardCFFunctionTable �
# � GuardCFFunctionCount �
" � GuardFlags ���
* � CodeIntegrity
# � GuardAddressTakenIatEntryTable ���
# � GuardAddressTakenIatEntryCount ���
# � GuardLongJumpTargetTable �
# � GuardLongJumpTargetCount �
# � DynamicValueRelocTable ���
# � CHPEMetadataPointer ��
# � GuardRFFailureRoutine
# � GuardRFFailureRoutineFunctionPointer �
" � DynamicValueRelocTableOffset �
! � DynamicValueRelocTableSection
! � Reserved2
# � GuardRFVerifyStackPointerFunctionPointer �
" � HotPatchTableOffset ��
" � Reserved3
# � EnclaveConfigurationPointer ��
# VolatileMetadataPointer ��
# GuardEHContinuationTable �
# GuardEHContinuationCount �Z , �F _IMAGE_LOAD_CONFIG_DIRECTORY64 .?AU_IMAGE_LOAD_CONFIG_DIRECTORY64@@ �� �F � 5 J � _FILE_SET_SPARSE_BUFFER .?AU_FILE_SET_SPARSE_BUFFER@@
�F
�
SetSparse J �F _FILE_SET_SPARSE_BUFFER .?AU_FILE_SET_SPARSE_BUFFER@@ �F � � J � PPM_IDLE_ACCOUNTING_EX .?AUPPM_IDLE_ACCOUNTING_EX@@ ��
�F
� V � PPM_IDLE_STATE_ACCOUNTING_EX .?AUPPM_IDLE_STATE_ACCOUNTING_EX@@ �� �F " � �
" StateCount ���
" TotalTransitions �
" ResetCount ���
" AbortCount ���
# StartTime
�F State J �F �PPM_IDLE_ACCOUNTING_EX .?AUPPM_IDLE_ACCOUNTING_EX@@ �� �F { )
l
�
5<
�
j?
� > � _MUIREGISTRYINFO .?AU_MUIREGISTRYINFO@@ �� ! " �
�0
�
�
�
�5
� 6 � _MUILANGLIST .?AU_MUILANGLIST@@ ��
G
�
�F
� v
u Owned
G InstallLanguageFallback ��
" Generation ���
" ProcessGeneration
G Installed
G Strings ��
G MachineConfig
G UserConfig ���
G $ MachinePreferred �
G ( UserPreferred
G , ProcessPreferred �
G 0 MergedUser ���
G 4 MergedMachine
G 8 MergedFallback ���
G < PrevRegInfo ��
" @ MUI_Locked ���
" D MUI_SE ���
" H MUI_NumberAllowed
q L MUI_AllowedLanguage ��
q P MUI_InstalledSKU �
" T cbInstalledSKU ���
" X cbAllowedLanguage
q \ MUI_DisallowedLanguage ���
" ` cbDisallowedLanguage �> G d _MUIREGISTRYINFO .?AU_MUIREGISTRYINFO@@ �� G ~
�@
� �
lpInformation
lpSectionBase
" ulSectionLength ��
lpSectionGlobalDataBase ��
" ulSectionGlobalDataLength z G tagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA .?AUtagACTCTX_SECTION_KEYED_DATA_ASSEMBLY_METADATA@@ �� G n �
�
� J � tagEMRSETPALETTEENTRIES .?AUtagEMRSETPALETTEENTRIES@@ b
� emr ��
" ihPal
" iStart ���
" cEntries �
~; aPalEntries ��J G tagEMRSETPALETTEENTRIES .?AUtagEMRSETPALETTEENTRIES@@ G � �
�'
�
�.
�
�A
� J � _ETW_TP_EVENT_TIMER_SET .?AU_ETW_TP_EVENT_TIMER_SET@@ �
m Header ���
DueTime ��
( SubQueue �
, Timer
" 0 Period ���
" 4 WindowLength �
" 8 Absolute �J G < _ETW_TP_EVENT_TIMER_SET .?AU_ETW_TP_EVENT_TIMER_SET@@ G b
�
� Z 2 RtlDiskWriteConstraintPolicyLimited �� d RtlDiskWriteConstraintPolicyNormal ���Z t G RTL_DISK_WRITE_CONSTRAINT_POLICY .?AW4RTL_DISK_WRITE_CONSTRAINT_POLICY@@ ��� G 2 : � tagSTYLESTRUCT .?AUtagSTYLESTRUCT@@ ��*
" styleOld �
" styleNew �: G tagSTYLESTRUCT .?AUtagSTYLESTRUCT@@ �� G ~ �
�
�
?
�
�
�
$
�
�
�
�@ ��
'G
� � p � )G " " +G
,G
�
�
� 2 HAL_MCE_RECORD ��� HAL_MCA_RECORD ���> t /G MCA_EXCEPTION_TYPE .?AW4MCA_EXCEPTION_TYPE@@ ��� 0G �C $
i
�
R%
� R � _PERFINFO_FILE_INFORMATION .?AU_PERFINFO_FILE_INFORMATION@@ ��
" Irp ��
" FileObject ���
" FileKey ��
" ExtraInformation �
" IssuingThreadId ��
" InfoClass R 5G _PERFINFO_FILE_INFORMATION .?AU_PERFINFO_FILE_INFORMATION@@ �� 6G b ` : � HENHMETAFILE__ .?AUHENHMETAFILE__@@ ��
8G
�
t unused ���: :G HENHMETAFILE__ .?AUHENHMETAFILE__@@ �� ;G s T
=G
� n � _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT@@
?G
� >
Lock �
" ThreadId �
" BoostBitmap ��n AG _ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT .?AU_ETW_AUTOBOOST_CLEAR_PRIORITY_FLOOR_EVENT@@ BG b
R � tagEMRMODIFYWORLDTRANSFORM .?AUtagEMRMODIFYWORLDTRANSFORM@@ ��
DG
� 2
� emr ��
I xform
" iMode R FG $ tagEMRMODIFYWORLDTRANSFORM .?AUtagEMRMODIFYWORLDTRANSFORM@@ �� GG � 2 � _RC_CONFIG .?AU_RC_CONFIG@@ ��R
" dwSignature ��
" dwLength �
" dwRCConfigVersion
" dwFilePathType ���
" dwFileType ���
" dwSystemAttributes ���
" dwUltimateFallbackLocation ���
� dwServiceCheckSum
� , dwChecksum ���
" < dwReserved1 ��
" @ dwReserved2 ��
" D dwMUIFileNameOffset ��
" H dwMUIFileNameLength ��
" L dwMUIFilePathOffset ��
" P dwMUIFilePathLength ��
" T dwMainResNameTypesOffset �
" X dwMainResNameTypesLength �
" \ dwMainResIDTypesOffset ���
" ` dwMainResIDTypesLength ���
" d dwMUIResNameTypesOffset ��
" h dwMUIResNameTypesLength ��
" l dwMUIResIDTypesOffset
" p dwMUIResIDTypesLength
" t dwLanguageOffset �
" x dwLanguageLength �
" | dwUltimateFallbackLanguageOffset �
" � dwUltimateFallbackLanguageLength �2 JG � _RC_CONFIG .?AU_RC_CONFIG@@ �� KG � :
$ Uuid �
! VersMajor
! VersMinor 2 MG _RPC_IF_ID .?AU_RPC_IF_ID@@ �� NG ^ { N � _DECRYPTION_STATUS_BUFFER .?AU_DECRYPTION_STATUS_BUFFER@@ "
NoEncryptedStreams ���N QG _DECRYPTION_STATUS_BUFFER .?AU_DECRYPTION_STATUS_BUFFER@@ RG �
�B
� *
" dwError ��
" dwType ���. UG _RIP_INFO .?AU_RIP_INFO@@ VG � c 2 � _cpinfoexA .?AU_cpinfoexA@@ ��
u MaxCharSize ��
DefaultChar ��
LeadByte �
q UnicodeDefaultChar ���
u CodePage �
y CodePageName �2 YG _cpinfoexA .?AU_cpinfoexA@@ �� ZG V c V � _ETW_PARTITION_INFO_EXTENSION .?AU_ETW_PARTITION_INFO_EXTENSION@@ �
! EventVersion �
! Reserved �
" PartitionType
� QpcOffsetFromRoot
$ PartitionId ��
$ ParentId �V ]G 0 _ETW_PARTITION_INFO_EXTENSION .?AU_ETW_PARTITION_INFO_EXTENSION@@ ^G @ � ^ � _CREATEFILE2_EXTENDED_PARAMETERS .?AU_CREATEFILE2_EXTENDED_PARAMETERS@@ ��
`G
�
� �
" dwSize ���
" dwFileAttributes �
" dwFileFlags ��
" dwSecurityQosFlags ���
bG lpSecurityAttributes �
hTemplateFile ^ cG _CREATEFILE2_EXTENDED_PARAMETERS .?AU_CREATEFILE2_EXTENDED_PARAMETERS@@ �� dG T f � _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA .?AU_PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA@@ >
" Flags
" BufferLength �
Buffer ���f gG _PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA .?AU_PLUGPLAY_CONTROL_BLOCKED_DRIVER_DATA@@ hG $
�
�
�3 kG
lG
� �
" ModuleInfoSize ���
" IsBinaryLoaded ���
ModulePathName ���
" CoverageSectionSize ��
� CoverageSection ��F nG _COVERAGE_MODULE_INFO .?AU_COVERAGE_MODULE_INFO@@ oG � t B � _CPU_CONFIG_RECORD .?AU_CPU_CONFIG_RECORD@@ �� q " �
" ProcessorSpeed ���
" NumberOfProcessors ���
" MemorySize ���
" PageSize �
" AllocationGranularity
� ComputerName �
rG DomainName ���
" HyperThreadingFlag ���
" $HighestUserAddress ���
! (ProcessorArchitecture
! *ProcessorLevel ���
! ,ProcessorRevision
.NxEnabled
/PaeEnabled ���
" 0MemorySpeed ��B sG 4_CPU_CONFIG_RECORD .?AU_CPU_CONFIG_RECORD@@ �� tG b �
�E
� : � _RTL_BITMAP_RUN .?AU_RTL_BITMAP_RUN@@
wG
� 2
" StartingIndex
" NumberOfBits �: yG _RTL_BITMAP_RUN .?AU_RTL_BITMAP_RUN@@ zG g )
G
�
h'
� �
# NumSDChangedSuccess ��
# NumSDChangedFail �
# NumSDUnused ��
# NumSDTotal ���
# NumMftSDChangedSuccess ���
# ( NumMftSDChangedFail ��
# 0 NumMftSDTotal V ~G 8 _SD_CHANGE_MACHINE_SID_OUTPUT .?AU_SD_CHANGE_MACHINE_SID_OUTPUT@@ G � �
�
� J ServiceDirectoryPersistentState �� ServiceDirectoryTypeMax ��F t �G SERVICE_DIRECTORY_TYPE .?AW4SERVICE_DIRECTORY_TYPE@@ ��� �G �
_F
�
�
� F � _RTL_HEAP_PARAMETERS .?AU_RTL_HEAP_PARAMETERS@@ ��
�G
�
�D
� >
" Length ���
" SegmentReserve ���
" SegmentCommit
" DeCommitFreeBlockThreshold ���
" DeCommitTotalFreeThreshold ���
" MaximumAllocationSize
" VirtualMemoryThreshold ���
" InitialCommit
" InitialReserve ���
�G $ CommitRoutine
, ( Reserved �F �G 0 _RTL_HEAP_PARAMETERS .?AU_RTL_HEAP_PARAMETERS@@ �� �G g �
@C
� Z � tagI_RpcProxyCallbackInterface .?AUtagI_RpcProxyCallbackInterface@@ �� q q " �G
�G
� p " �G
�G
�
" �G
�G
� �C � �G
�G
�
�C
� t 1 t 1 �G
�G
�
1
�
�
�
�;
� B
�G IsValidMachineFn �
�G GetClientAddressFn ���
�G GetConnectionTimeoutFn ���
�G PerformCalloutFn �
�G FreeCalloutStateFn ���
�G GetClientSessionAndResourceUUIDFn
�G ProxyFilterIfFn ��
�G RpcProxyUpdatePerfCounterFn ��
�G RpcProxyUpdatePerfCounterBackendServerFn �Z �G $ tagI_RpcProxyCallbackInterface .?AUtagI_RpcProxyCallbackInterface@@ �� �G 3 �
�6
� n � _MEMORY_PARTITION_INITIAL_ADD_INFORMATION .?AU_MEMORY_PARTITION_INITIAL_ADD_INFORMATION@@
�G
� �+ " �j
" Flags
" NumberOfRanges ���
" NumberOfPagesAdded ���
�G PartitionRanges ��n �G _MEMORY_PARTITION_INITIAL_ADD_INFORMATION .?AU_MEMORY_PARTITION_INITIAL_ADD_INFORMATION@@ �G w �
s#
� R � _EVENT_EXTENDED_ITEM_TS_ID .?AU_EVENT_EXTENDED_ITEM_TS_ID@@ ��
" SessionId R �G _EVENT_EXTENDED_ITEM_TS_ID .?AU_EVENT_EXTENDED_ITEM_TS_ID@@ �� �G U d
�
2;
� "
�B Type �
" Delay 2 �G _SC_ACTION .?AU_SC_ACTION@@ �� �G �
h:
�
�?
� 6
! Version ��
! Size �
$ Event F �G _PLUGPLAY_NOTIFY_HDR .?AU_PLUGPLAY_NOTIFY_HDR@@ �� �G $ � Z � _SYSTEM_PERFORMANCE_INFORMATION .?AU_SYSTEM_PERFORMANCE_INFORMATION@@
�G
�
� IdleProcessTime ��
� IoReadTransferCount ��
� IoWriteTransferCount �
� IoOtherTransferCount �
" IoReadOperationCount �
" $ IoWriteOperationCount
" ( IoOtherOperationCount
" , AvailablePages ���
" 0 CommittedPages ���
" 4 CommitLimit ��
" 8 PeakCommitment ���
" < PageFaultCount ���
" @ CopyOnWriteCount �
" D TransitionCount ��
" H CacheTransitionCount �
" L DemandZeroCount ��
" P PageReadCount
" T PageReadIoCount ��
" X CacheReadCount ���
" \ CacheIoCount �
" ` DirtyPagesWriteCount �
" d DirtyWriteIoCount
" h MappedPagesWriteCount
" l MappedWriteIoCount ���
" p PagedPoolPages ���
" t NonPagedPoolPages
" x PagedPoolAllocs ��
" | PagedPoolFrees ���
" � NonPagedPoolAllocs ���
" � NonPagedPoolFrees
" � FreeSystemPtes ���
" � ResidentSystemCodePage ���
" � TotalSystemDriverPages ���
" � TotalSystemCodePages �
" � NonPagedPoolLookasideHits
" � PagedPoolLookasideHits ���
" � AvailablePagedPoolPages ��
" � ResidentSystemCachePage ��
" � ResidentPagedPoolPage
" � ResidentSystemDriverPage �
" � CcFastReadNoWait �
" � CcFastReadWait ���
" � CcFastReadResourceMiss ���
" � CcFastReadNotPossible
" � CcFastMdlReadNoWait ��
" � CcFastMdlReadWait
" � CcFastMdlReadResourceMiss
" � CcFastMdlReadNotPossible �
" � CcMapDataNoWait ��
" � CcMapDataWait
" � CcMapDataNoWaitMiss ��
" � CcMapDataWaitMiss
" � CcPinMappedDataCount �
" � CcPinReadNoWait ��
" � CcPinReadWait
" � CcPinReadNoWaitMiss ��
" � CcPinReadWaitMiss
" � CcCopyReadNoWait �
" � CcCopyReadWait ���
" � CcCopyReadNoWaitMiss �
" CcCopyReadWaitMiss ���
" CcMdlReadNoWait ��
" CcMdlReadWait
" CcMdlReadNoWaitMiss ��
" CcMdlReadWaitMiss
" CcReadAheadIos ���
" CcLazyWriteIos ���
" CcLazyWritePages �
" CcDataFlushes
" $CcDataPages ��
" (ContextSwitches ��
" ,FirstLevelTbFills
" 0SecondLevelTbFills ���
" 4SystemCalls ��
# 8CcTotalDirtyPages
# @CcDirtyPageThreshold �
HResidentAvailablePages ���
# PSharedCommittedPages �Z N �G X_SYSTEM_PERFORMANCE_INFORMATION .?AU_SYSTEM_PERFORMANCE_INFORMATION@@ �G � � 2 � _RPC_POLICY .?AU_RPC_POLICY@@ B
u Length ���
" EndpointFlags
" NICFlags �2 �G _RPC_POLICY .?AU_RPC_POLICY@@ �G ^ �
�
�
c,
� > � tagEMRNAMEDESCAPE .?AUtagEMRNAMEDESCAPE@@ b
� emr ��
t iEscape ��
t cbDriver �
t cbEscData
� EscData ��> �G tagEMRNAMEDESCAPE .?AUtagEMRNAMEDESCAPE@@ �G � �
�8
� j � _DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE .?AU_DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE@@
u ��
u ��Z
� header ���
�G enableAdvancedColor ��
�G reserved �
u value j �G _DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE .?AU_DISPLAYCONFIG_SET_ADVANCED_COLOR_STATE@@ �G � i
�
� � " �
�G
�
a.
�
�?
�
�* ��
�G
� Z � _SL_KMEM_CACHE_VALUE_DESCRIPTOR .?AU_SL_KMEM_CACHE_VALUE_DESCRIPTOR@@ �
! Size �
! NameLength ���
! Type �
! DataLength ���
" Attributes ���
" Reserved �
Name �Z �G _SL_KMEM_CACHE_VALUE_DESCRIPTOR .?AU_SL_KMEM_CACHE_VALUE_DESCRIPTOR@@ �G � i
R
� b � _EVENT_EXTENDED_ITEM_STACK_TRACE64 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE64@@ ��*
# MatchId ��
= Address ��b �G _EVENT_EXTENDED_ITEM_STACK_TRACE64 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE64@@ �� �G U m R � _WMI_PROCESS_INFORMATION64 .?AU_WMI_PROCESS_INFORMATION64@@ ��
�G
� �
# UniqueProcessKey64 ���
" ProcessId
" ParentId �
" SessionId
ExitStatus ���
# DirectoryTableBase ���
" Flags
" $ Sid ��R �G ( _WMI_PROCESS_INFORMATION64 .?AU_WMI_PROCESS_INFORMATION64@@ �� �G b R � _TP_POOL_STACK_INFORMATION .?AU_TP_POOL_STACK_INFORMATION@@ ��
�G
� 2
" StackReserve �
" StackCommit ��R �G _TP_POOL_STACK_INFORMATION .?AU_TP_POOL_STACK_INFORMATION@@ �� �G � R
�)
� v � _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE@@ .
� FileOffset ���
� ByteCount v �G _FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE .?AU_FSCTL_QUERY_GHOSTED_FILE_EXTENTS_INPUT_RANGE@@ �G � �*
�#
�
�
� V � _ETW_CLOCK_STATE_CHANGE_EVENT .?AU_ETW_CLOCK_STATE_CHANGE_EVENT@@
�G
� �
NewState �
PrevState
q Reserved �
# DeliveredIncrement ���
# RequestedIncrement ���
# NextClockUpdateTime ��V �G _ETW_CLOCK_STATE_CHANGE_EVENT .?AU_ETW_CLOCK_STATE_CHANGE_EVENT@@ �G b
8+
� R � _FILE_FS_LABEL_INFORMATION .?AU_FILE_FS_LABEL_INFORMATION@@ ��
�G
� 6
" VolumeLabelLength
VolumeLabel ��R �G _FILE_FS_LABEL_INFORMATION .?AU_FILE_FS_LABEL_INFORMATION@@ �� �G � F � _TOKEN_PRIMARY_GROUP .?AU_TOKEN_PRIMARY_GROUP@@ ��
PrimaryGroup �F �G _TOKEN_PRIMARY_GROUP .?AU_TOKEN_PRIMARY_GROUP@@ �� �G w �
�D
� f � JOBOBJECT_IO_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION@@ �
MaxIops ��
MaxBandwidth �
ReservationIops ��
� VolumeName ���
" BaseIoSize ���
" ControlFlags �f H ( JOBOBJECT_IO_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION@@ 2 onecore\external\sdk\inc\mincore\jobapi2.h � H H N � PPM_WMI_LEGACY_PERFSTATE .?AUPPM_WMI_LEGACY_PERFSTATE@@ ��
H
� B
" Frequency
" Flags
" PercentFrequency �N H PPM_WMI_LEGACY_PERFSTATE .?AUPPM_WMI_LEGACY_PERFSTATE@@ ��
H { � B � FIND_BY_SID_OUTPUT .?AUFIND_BY_SID_OUTPUT@@ ��b
" NextEntryOffset ��
" FileIndex
" FileNameLength ���
FileName �B
H FIND_BY_SID_OUTPUT .?AUFIND_BY_SID_OUTPUT@@ �� H � �
Z � _OBJECT_HANDLE_FLAG_INFORMATION .?AU_OBJECT_HANDLE_FLAG_INFORMATION@@
H
� 2
Inherit ��
ProtectFromClose �Z H _OBJECT_HANDLE_FLAG_INFORMATION .?AU_OBJECT_HANDLE_FLAG_INFORMATION@@ H + W N � _ALPC_SERVER_INFORMATION .?AU_ALPC_SERVER_INFORMATION@@ ��
ThreadHandle �: H <anonymous-tag> .?AU<anonymous-tag>@@ H � � Z
ThreadBlocked
ConnectedProcessId ���
ConnectionPortName ���: H <anonymous-tag> .?AU<anonymous-tag>@@ H � � "
H In ���
H Out ��N H _ALPC_SERVER_INFORMATION .?AU_ALPC_SERVER_INFORMATION@@ �� H � � J � USN_RANGE_TRACK_OUTPUT .?AUUSN_RANGE_TRACK_OUTPUT@@ ��
H
�
Usn ��J !H USN_RANGE_TRACK_OUTPUT .?AUUSN_RANGE_TRACK_OUTPUT@@ �� "H � Y
!7
� V � _TRACE_PROVIDER_INSTANCE_INFO .?AU_TRACE_PROVIDER_INSTANCE_INFO@@ R
" NextOffset ���
" EnableCount ��
" Pid ��
" Flags V &H _TRACE_PROVIDER_INSTANCE_INFO .?AU_TRACE_PROVIDER_INSTANCE_INFO@@ 'H � � J � _RTL_CRITICAL_SECTION64 .?AU_RTL_CRITICAL_SECTION64@@
)H
� �
# DebugInfo
LockCount
RecursionCount ���
# OwningThread �
# LockSemaphore
# SpinCount J +H ( _RTL_CRITICAL_SECTION64 .?AU_RTL_CRITICAL_SECTION64@@ ,H � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��Z
.H RequireProfileTotalIssuesSource ��
/H ForceProfileTimeSource ���
0H NoProfileSampling
1H NoCSwitchSampling
2H NoReadyThreadSampling
3H NoFaultSampling ��
4H NoStackCache �
5H NoSampleBuffers ��
6H NoPauseWhenFull ��
7H NoLowPriority
8H WithAppId
9H FilterKernel �: :H <anonymous-tag> .?AU<anonymous-tag>@@ ;H @ �
�& V2 ���2 =H <anonymous-tag> .?AT<anonymous-tag>@@ >H @ � 2
�& Intel
�& Amd ��
�& Arm ��2 @H <anonymous-tag> .?AT<anonymous-tag>@@ AH @ { 2
" ReplyCount ���
" NotifyeeCount 2 CH <anonymous-tag> .?AT<anonymous-tag>@@ DH @ R :
LoggerExtension ��
# LoggerExtension64 2 FH <anonymous-tag> .?AT<anonymous-tag>@@ GH b � 2
LoggerName ���
� LoggerName64 �2 IH <anonymous-tag> .?AT<anonymous-tag>@@ JH b { 2
LogFileName ��
� LogFileName64 2 LH <anonymous-tag> .?AT<anonymous-tag>@@ MH b u :
LoggerThreadId ���
# LoggerThreadId64 �2 OH <anonymous-tag> .?AT<anonymous-tag>@@ PH b q .
" LogBuffersLost ���
" Flags 2 RH <anonymous-tag> .?AT<anonymous-tag>@@ SH b k :
" EventsLost ���
" NumberOfProcessors ���2 UH <anonymous-tag> .?AT<anonymous-tag>@@ VH b f 2
" FreeBuffers ��
" InstanceId ���2 XH <anonymous-tag> .?AT<anonymous-tag>@@ YH b b 6
" NumberOfBuffers ��
" InstanceCount 2 [H <anonymous-tag> .?AT<anonymous-tag>@@ \H b ^ 6
LogFileHandle
# LogFileHandle64 ��2 ^H <anonymous-tag> .?AT<anonymous-tag>@@ _H b Z
# ��
# ��
# ��
# ��f
aH Wow ��
bH QpcDeltaTracking �
cH LargeMdlPages
dH ExcludeKernelStack ���: eH <anonymous-tag> .?AU<anonymous-tag>@@ fH b N
# ��
# ��
# ��
# ��z
hH Wow ��
iH QpcDeltaTracking �
jH LargeMdlPages
kH ExcludeKernelStack ���
# V2Options 2 lH <anonymous-tag> .?AT<anonymous-tag>@@ mH b M 2
AgeLimit �
FlushThreshold ���2 oH <anonymous-tag> .?AT<anonymous-tag>@@ pH b I B
" PagedPoolPageCount ���
" VirtualSizeInPages ���2 rH <anonymous-tag> .?AT<anonymous-tag>@@ sH b � 2
" UniqueProcessId ��
" SessionId 2 uH <anonymous-tag> .?AT<anonymous-tag>@@ vH b �
! ��
! ��
! ��Z
xH ActiveDataReference ��
yH DeviceEjectable ��
zH WritableHandles ��: {H <anonymous-tag> .?AU<anonymous-tag>@@ |H b
" ��
" ��&
~H TypeInfo �
H Spare : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b |
" ��
" ��6
�H TypeInfo �
�H Spare
" Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b {
" ��
" ��&
�H Direction
�H Spare : �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b i
" ��
" ��6
�H Direction
�H Spare
" Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b h V
ProtoPteAddress ��
" PageFrameIndex ���
VirtualAddress ���2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b �
# ��
# 0��
# 4��F
�H UseDescription ���
�H UniqueKey
�H Reserved �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b �
��
��
��
��Z
�H ExecutingDpc �
�H ExecutingIsr �
�H Reserved �
�H Priority �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b �
��
��
��
��j
�H ExecutingDpc �
�H ExecutingIsr �
�H Reserved �
�H Priority �
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b N
! Properties ���
ExpectedWakeReason ���
Reserved �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b ^
! Properties ���
ExpectedWakeReason ���
Reserved �
" Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b B
# DeliveredIncrement ���
# RequestedIncrement ���: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b
b
# DeliveredIncrement ���
# RequestedIncrement ���
# NextClockUpdateTime ��2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b
��
��
��
��j
�H ExecutingDpc �
�H WakeupBoost ��
�H BoostedOutstandingIrps ���
�H Reserved �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b �
��
��
��
��z
�H ExecutingDpc �
�H WakeupBoost ��
�H BoostedOutstandingIrps ���
�H Reserved �
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b �
p ��
p ��
p ��
p ��v
�H NewIoPriorityFloor ���
�H OldIoPriority
�H NewIoQoSPriorityFloor
�H OldIoQoSPriority �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b �
p ��
p ��
p ��
p ��
�H NewIoPriorityFloor ���
�H OldIoPriority
�H NewIoQoSPriorityFloor
�H OldIoQoSPriority �
p IoPriorities �2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b �
��
��
��
��
��
�H ExecutingDpc �
�H KernelStackNotResident ���
�H ProcessOutOfMemory ���
�H DirectSwitchAttempt ��
�H Reserved �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b �
��
��
��
��
��
�H ExecutingDpc �
�H KernelStackNotResident ���
�H ProcessOutOfMemory ���
�H DirectSwitchAttempt ��
�H Reserved �
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b �
��
��
��J
�H AcquireMode ��
�H ExecuteDpc ���
�H ExecuteIsr ���: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b Q
��
��
��Z
�H AcquireMode ��
�H ExecuteDpc ���
�H ExecuteIsr ���
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b P
��
��
��
��r
�H OldThreadWaitMode
�H OldThreadBamQosLevel �
�H NewThreadBamQosLevel �
�H Reserved �: �H <anonymous-tag> .?AU<anonymous-tag>@@ �H b /
��
��
��
��
�H OldThreadWaitMode
�H OldThreadBamQosLevel �
�H NewThreadBamQosLevel �
�H Reserved �
Flags 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b . >
p NewThreadPriorityDecrement ���
p SpareByte 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b ) 6
PreviousCState ���
OldThreadRank 2 �H <anonymous-tag> .?AT<anonymous-tag>@@ �H b % &
" Index
" InfoClass 2 I <anonymous-tag> .?AT<anonymous-tag>@@ I b � .
# StartAddr64 ��
# Affinity �2 I <anonymous-tag> .?AT<anonymous-tag>@@ I b / *
StartAddr
" Affinity �2 I <anonymous-tag> .?AT<anonymous-tag>@@ I b *
Pointer0 �
Pointer1 �:
I <anonymous-tag> .?AU<anonymous-tag>@@ I b n
� Padding1 �
X# ReferenceTime
! GlobalEntry ��
Pointer0 �
Pointer1 �2
I <anonymous-tag> .?AT<anonymous-tag>@@ I b
# ��
# =��*
I ClockType
I Frequency : I <anonymous-tag> .?AU<anonymous-tag>@@ I b �
# ��
# =��Z
I ClockType
I Frequency
[ SlistEntry ���
W# NextBuffer ���2 I <anonymous-tag> .?AT<anonymous-tag>@@ I b � *
" Header ���
�E Packet ���2 I <anonymous-tag> .?AT<anonymous-tag>@@ I b � :
! Size �
Reserved �
Version ��: I <anonymous-tag> .?AU<anonymous-tag>@@ I b � N
" Marker ���
! Size �
Reserved �
Version ��2 I <anonymous-tag> .?AT<anonymous-tag>@@ !I b � *
" Header ���
h# Packet ���2 #I <anonymous-tag> .?AT<anonymous-tag>@@ $I b h >
! Version ��
HeaderType ���
Flags : &I <anonymous-tag> .?AU<anonymous-tag>@@ 'I b b R
" Marker ���
! Version ��
HeaderType ���
Flags 2 )I <anonymous-tag> .?AT<anonymous-tag>@@ *I b ` *
# TS ���
� SystemTime ���2 ,I <anonymous-tag> .?AT<anonymous-tag>@@ -I b T *
" Header ���
h# Packet ���2 /I <anonymous-tag> .?AT<anonymous-tag>@@ 0I b P >
! Version ��
HeaderType ���
Flags : 2I <anonymous-tag> .?AU<anonymous-tag>@@ 3I b J R
" Marker ���
! Version ��
HeaderType ���
Flags 2 5I <anonymous-tag> .?AT<anonymous-tag>@@ 6I b H .
" KernelTime ���
" UserTime �: 8I <anonymous-tag> .?AU<anonymous-tag>@@ 9I b 0 *
" ClientContext
" Flags : ;I <anonymous-tag> .?AU<anonymous-tag>@@ <I b , n
" ClientContext
" Flags
" KernelTime ���
" UserTime �
# ProcessorTime 2 >I <anonymous-tag> .?AT<anonymous-tag>@@ ?I b + &
$ Guid �
# GuidPtr ��2 AI <anonymous-tag> .?AT<anonymous-tag>@@ BI b ' &
" Version ��
� Class 2 DI <anonymous-tag> .?AT<anonymous-tag>@@ EI b 2
HeaderType ���
MarkerFlags ��: GI <anonymous-tag> .?AU<anonymous-tag>@@ HI b N
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��2 JI <anonymous-tag> .?AT<anonymous-tag>@@ KI b "
Type �
Group : MI <anonymous-tag> .?AU<anonymous-tag>@@ NI b 6
! HookId ���
Type �
Group 2 PI <anonymous-tag> .?AT<anonymous-tag>@@ QI b .
" KernelTime ���
" UserTime �: SI <anonymous-tag> .?AU<anonymous-tag>@@ TI U � F
" KernelTime ���
" UserTime �
# ProcessorTime 2 VI <anonymous-tag> .?AT<anonymous-tag>@@ WI U �
! ��
! ��*
YI Linkage ��
ZI Reserved2 : [I <anonymous-tag> .?AU<anonymous-tag>@@ \I U K :
Type �
Reserved1
! Reserved2 : ^I <anonymous-tag> .?AU<anonymous-tag>@@ _I = � N
" Reserved �
Type �
Reserved1
! Reserved2 2 aI <anonymous-tag> .?AT<anonymous-tag>@@ bI = �
�9 Level1 ���2 dI ( <anonymous-tag> .?AT<anonymous-tag>@@ eI � 2 MidlWinrtTypeSerializationInfoVersionOne � t gI <unnamed-enum-MidlWinrtTypeSerializationInfoVersionOne> .?AW4<unnamed-enum-MidlWinrtTypeSerializationInfoVersionOne>@@ � hI � � * MidlInterceptionInfoVersionOne ���r t jI <unnamed-enum-MidlInterceptionInfoVersionOne> .?AW4<unnamed-enum-MidlInterceptionInfoVersionOne>@@ � kI � �
lG
�
mI
� N
u DispatchTableCount ���
nI DispatchTable
Reserved �B oI RPC_DISPATCH_TABLE .?AURPC_DISPATCH_TABLE@@ �� pI 3 � J � RPC_INTERFACE_TEMPLATEA .?AURPC_INTERFACE_TEMPLATEA@@ �
" Version ��
IfSpec ���
1 MgrTypeUuid ��
MgrEpv ���
u Flags
u MaxCalls �
u MaxRpcSize ���
)1 IfCallback ���
+1 UuidVector ���
$ Annotation ���
( SecurityDescriptor ���J sI , RPC_INTERFACE_TEMPLATEA .?AURPC_INTERFACE_TEMPLATEA@@ tI ^ p J � RPC_ENDPOINT_TEMPLATEA .?AURPC_ENDPOINT_TEMPLATEA@@ ��r
" Version ��
ProtSeq ��
Endpoint �
SecurityDescriptor ���
" Backlog ��J wI RPC_ENDPOINT_TEMPLATEA .?AURPC_ENDPOINT_TEMPLATEA@@ �� xI ^ S J � RPC_ENDPOINT_TEMPLATEW .?AURPC_ENDPOINT_TEMPLATEW@@ ��r
" Version ��
q ProtSeq ��
q Endpoint �
SecurityDescriptor ���
" Backlog ��J {I RPC_ENDPOINT_TEMPLATEW .?AURPC_ENDPOINT_TEMPLATEW@@ �� |I ^ J
c. HttpCredentials ��2 ~I <anonymous-tag> .?AT<anonymous-tag>@@ I ^ > � MOFRESOURCEINFOW .?AUMOFRESOURCEINFOW@@ ��b
q ImagePath
q ResourceName �
" ResourceSize �
ResourceBuffer ���> �I MOFRESOURCEINFOW .?AUMOFRESOURCEINFOW@@ �� �I �2 4 :
�< EventCallback
�< EventRecordCallback ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � 6
" LogFileMode ��
" ProcessTraceMode �2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � :
�< EventCallback
�< EventRecordCallback ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � 6
" LogFileMode ��
" ProcessTraceMode �2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � p 2
" ClientContext
P BufferContext 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � " 2
ProcessorNumber ��
Alignment : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � � N
ProcessorNumber ��
Alignment
! ProcessorIndex ���2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � �
" ��
" ��
" ��
" ��f
�I Wow ��
�I QpcDeltaTracking �
�I LargeMdlPages
�I ExcludeKernelStack ���: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � �
" ��
" ��
" ��
" ��z
�I Wow ��
�I QpcDeltaTracking �
�I LargeMdlPages
�I ExcludeKernelStack ���
# V2Options 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � �
" ��
�I VersionNumber : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � �
" ��.
�I VersionNumber
" V2Control 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � 2
AgeLimit �
FlushThreshold ���2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � 2
AgeLimit �
FlushThreshold ���2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � i b
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � # ~
$ LogInstanceGuid ��
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � ! .
" Version ��
� VersionDetail 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � b
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � � ~
$ LogInstanceGuid ��
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � .
" Version ��
' VersionDetail 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � b
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � � ~
$ LogInstanceGuid ��
" StartBuffers �
" PointerSize ��
" EventsLost ���
" CpuSpeedInMHz 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � .
" Version ��
�9 VersionDetail 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � � &
" EventId ��
" Flags : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � e .
" KernelTime ���
" UserTime �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � ` j
" KernelTime ���
" UserTime �
# ProcessorTime
" EventId ��
" Flags 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � _ &
" Version ��
:; Class 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � Q 2
HeaderType ���
MarkerFlags ��: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � L N
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � J *
" ClientContext
" Flags : �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � > .
" KernelTime ���
" UserTime �: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � 9 n
" KernelTime ���
" UserTime �
# ProcessorTime
" ClientContext
" Flags 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � 8 &
$ Guid �
# GuidPtr ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � 4 &
" Version ��
Class 2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � ) 2
HeaderType ���
MarkerFlags ��: �I <anonymous-tag> .?AU<anonymous-tag>@@ �I � $ N
! FieldTypeFlags ���
HeaderType ���
MarkerFlags ��2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � " 2 � WMIREGINFOW .?AUWMIREGINFOW@@ 3 " �
" BufferSize ���
" NextWmiRegInfo ���
" RegistryPath �
" MofResourceName ��
" GuidCount
�I WmiRegGuid ���2 �I WMIREGINFOW .?AUWMIREGINFOW@@ �I � y b
" InstanceNameList �
" BaseNameOffset ���
" Pdo ��
" InstanceInfo �2 �I <anonymous-tag> .?AT<anonymous-tag>@@ �I � 1 q " �B
" TargetInstanceIndex ��
J TargetInstanceName ���2 J <anonymous-tag> .?AT<anonymous-tag>@@ J � F
" FixedInstanceSize
> OffsetInstanceDataAndLength ��2 J <anonymous-tag> .?AT<anonymous-tag>@@ J � � B
" CountLost
KernelHandle �
� TimeStamp 2 J <anonymous-tag> .?AT<anonymous-tag>@@ J � - *
" Version ��
" Linkage ��:
J <anonymous-tag> .?AU<anonymous-tag>@@ J � & F
# HistoricalContext
" Version ��
" Linkage ��2
J <anonymous-tag> .?AT<anonymous-tag>@@ J � #
$ Data �Z J SERVICE_TRIGGER_CUSTOM_STATE_ID .?AUSERVICE_TRIGGER_CUSTOM_STATE_ID@@ J � � 6
�' mouse
�' keyboard �
� hid ��2 J <anonymous-tag> .?AT<anonymous-tag>@@ J ~ 2; 2
! usButtonFlags
! usButtonData �: J <anonymous-tag> .?AU<anonymous-tag>@@ J ~ D: F
" ulButtons
! usButtonFlags
! usButtonData �2 J <anonymous-tag> .?AT<anonymous-tag>@@ J ~ B:
@ _11 ��
@ _12 ��
@ _13 ��
@ _14 ��
@ _21 ��
@ _22 ��
@ _23 ��
@ _24 ��
@ _31 ��
@ $ _32 ��
@ ( _33 ��
@ , _34 ��
@ 0 _41 ��
@ 4 _42 ��
@ 8 _43 ��
@ < _44 ��:
J @ <anonymous-tag> .?AU<anonymous-tag>@@ J ~ �
@ _11 ��
@ _12 ��
@ _13 ��
@ _14 ��
@ _21 ��
@ _22 ��
@ _23 ��
@ _24 ��
@ _31 ��
@ $ _32 ��
@ ( _33 ��
@ , _34 ��
@ 0 _41 ��
@ 4 _42 ��
@ 8 _43 ��
@ < _44 ��
"< m 2 J @ <anonymous-tag> .?AT<anonymous-tag>@@ J ~ � *
b touchInfo
c penInfo ��2 "J � <anonymous-tag> .?AT<anonymous-tag>@@ #J ~ J 2
mi ���
ki ���
hi ���2 %J <anonymous-tag> .?AT<anonymous-tag>@@ &J ~ � J � POWERBROADCAST_SETTING .?AUPOWERBROADCAST_SETTING@@ ��B
$ PowerSetting �
" DataLength ���
� Data �J )J POWERBROADCAST_SETTING .?AUPOWERBROADCAST_SETTING@@ �� *J ~ / 6 � SHELLHOOKINFO .?AUSHELLHOOKINFO@@ "
� hwnd �
rc ���6 -J SHELLHOOKINFO .?AUSHELLHOOKINFO@@ .J ~
u ��
u ��6
0J enableAdvancedColor ��
1J reserved �: 2J <anonymous-tag> .?AU<anonymous-tag>@@ 3J � o
u ��
u ��F
5J enableAdvancedColor ��
6J reserved �
u value 2 7J <anonymous-tag> .?AT<anonymous-tag>@@ 8J � m
u ��
u ��
u ��
u ��
u ��
:J advancedColorSupported ���
;J advancedColorEnabled �
<J wideColorEnforced
=J advancedColorForceDisabled ���
>J reserved �: ?J <anonymous-tag> .?AU<anonymous-tag>@@ @J � Z
u ��
u ��
u ��
u ��
u ��
BJ advancedColorSupported ���
CJ advancedColorEnabled �
DJ wideColorEnforced
EJ advancedColorForceDisabled ���
FJ reserved �
u value 2 GJ <anonymous-tag> .?AT<anonymous-tag>@@ HJ � X
u ��
u ��B
JJ disableMonitorVirtualResolution ��
KJ reserved �: LJ <anonymous-tag> .?AU<anonymous-tag>@@ MJ � B
u ��
u ��R
OJ disableMonitorVirtualResolution ��
PJ reserved �
u value 2 QJ <anonymous-tag> .?AT<anonymous-tag>@@ RJ � @
u ��
u ��2
TJ bootPersistenceOn
UJ reserved �: VJ <anonymous-tag> .?AU<anonymous-tag>@@ WJ � 4
u ��
u ��B
YJ bootPersistenceOn
ZJ reserved �
u value 2 [J <anonymous-tag> .?AT<anonymous-tag>@@ \J � 2
u ��
u ��
u ��
u ��n
^J friendlyNameFromEdid �
_J friendlyNameForced ���
`J edidIdsValid �
aJ reserved �: bJ <anonymous-tag> .?AU<anonymous-tag>@@ cJ �
u ��
u ��
u ��
u ��~
eJ friendlyNameFromEdid �
fJ friendlyNameForced ���
gJ edidIdsValid �
hJ reserved �
u value 2 iJ <anonymous-tag> .?AT<anonymous-tag>@@ jJ �
u ��
u ��>
lJ desktopModeInfoIdx ���
mJ targetModeInfoIdx : nJ <anonymous-tag> .?AU<anonymous-tag>@@ oJ � �
u ��
u ��V
u modeInfoIdx ��
qJ desktopModeInfoIdx ���
rJ targetModeInfoIdx 2 sJ <anonymous-tag> .?AT<anonymous-tag>@@ tJ � �
u ��
u ��6
vJ cloneGroupId �
wJ sourceModeInfoIdx : xJ <anonymous-tag> .?AU<anonymous-tag>@@ yJ � �
u ��
u ��N
u modeInfoIdx ��
{J cloneGroupId �
|J sourceModeInfoIdx 2 }J <anonymous-tag> .?AT<anonymous-tag>@@ ~J � � N
�/ targetMode ���
�@ sourceMode ���
�@ desktopImageInfo �2 �J 0 <anonymous-tag> .?AT<anonymous-tag>@@ �J � u :
F AdditionalSignalInfo �
u videoStandard 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � # .
" dmDisplayFlags ���
" dmNup 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � Z
� dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���
� dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � .
" dmDisplayFlags ���
" dmNup 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � Z
� dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
dmOrientation
dmPaperSize ��
dmPaperLength
dmPaperWidth �
dmScale ��
dmCopies �
dmDefaultSource ��
dmPrintQuality ���
� dmPosition ���
" dmDisplayOrientation �
" dmDisplayFixedOutput �2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � F
� FileId ���
$ ObjectId �
m ExtendedFileId ���2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J n �# .
ReplaceIfExists ��
" Flags 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J n �"
" ��
" ��>
�J IsUmsSchedulerThread �
�J IsUmsWorkerThread : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J n N
" ��
" ��Z
�J IsUmsSchedulerThread �
�J IsUmsWorkerThread
" ThreadUmsFlags ���2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J n M
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�J Private ��
�J MappedDataFile ���
�J MappedImage ��
�J MappedPageFile ���
�J MappedPhysical ���
�J DirectMapped �
�J Reserved �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
�J Private ��
�J MappedDataFile ���
�J MappedImage ��
�J MappedPageFile ���
�J MappedPhysical ���
�J DirectMapped �
�J Reserved �2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � :
! wProcessorArchitecture ���
! wReserved : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � 2 N
" dwOemId ��
! wProcessorArchitecture ���
! wReserved 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � 0 &
�0 Block
�0 Region ���2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � .
" Offset ���
" OffsetHigh ���: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � 8 B
" Offset ���
" OffsetHigh ���
Pointer ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � 7 �
[8 MemoryAllocData ��
^8 MemoryFreeData ���
a8 MemoryProtectData
d8 InstructionCacheFlushData
g8 MemoryDirtyData ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � �
" ��
" ��>
�J First
�J HeavyFlush ���
" Sequence �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � �
" ��
" ��N
�J First
�J HeavyFlush ���
" Sequence �
Y Value 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � Z � RTLWOW64_CROSSPROCESS_WORK_HEAD .?AURTLWOW64_CROSSPROCESS_WORK_HEAD@@
" ��
" ��N
�J First
�J HeavyFlush ���
" Sequence �
Y Value Z �J RTLWOW64_CROSSPROCESS_WORK_HEAD .?AURTLWOW64_CROSSPROCESS_WORK_HEAD@@ �J � � &
" Flags
" dwFlags ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � 2
� ActivationContext
hActCtx ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � &
" Flags
�& NextFree �2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � *
" Modules ��
" ModulesEx 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � *
c9 Modules ��
d9 ModulesEx 2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � � B
K# ProcessHeapInformation ���
�4 HeapInformation ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ �J � ` �
K# ProcessHeapInformation ���
�4 HeapInformation ��
J HeapRegionInformation
% HeapRangeInformation �
2; HeapBlockInformation �
�6 HeapPerfInformation ��
" DynamicStart �2 �J \ <anonymous-tag> .?AT<anonymous-tag>@@ �J � B b
" CommittedSize
" UnCommittedSize ��
FirstEntry ���
LastEntry : �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � � b
" Settable �
! TagIndex �
! AllocatorBackTraceIndex ��
7 Reserved �: �J <anonymous-tag> .?AU<anonymous-tag>@@ �J � � &
�J Block
�J Segment ��2 �J <anonymous-tag> .?AT<anonymous-tag>@@ K � �
" ��
" ��*
K WakeCount
K Waking ���: K <anonymous-tag> .?AU<anonymous-tag>@@ K � E
" ��
" ��J
K WakeCount
K Waking ���
" Value
Ptr ��2 K <anonymous-tag> .?AT<anonymous-tag>@@
K � C
" ��
" ��
" ��
" ��
" ��n
K Locked ���
K Waiting ��
K Waking ���
K MultipleShared ���
K Shared ���: K <anonymous-tag> .?AU<anonymous-tag>@@ K � �
" ��
" ��
" ��
" ��
" ��
K Locked ���
K Waiting ��
K Waking ���
K MultipleShared ���
K Shared ���
" Value
Ptr ��2 K <anonymous-tag> .?AT<anonymous-tag>@@ K � �
" ��
" ��.
K CurrentThread
K Reserved1 : K <anonymous-tag> .?AU<anonymous-tag>@@ K
" ��
" ��>
" Flags
!K CurrentThread
"K Reserved1 2 #K <anonymous-tag> .?AT<anonymous-tag>@@ $K
# ��
# ?��"
&K Busy �
'K Ticks : (K <anonymous-tag> .?AU<anonymous-tag>@@ )K �
��&
+K Encoded ��
� Min ��2 ,K <anonymous-tag> .?AT<anonymous-tag>@@ -K � . *
" Lock �
7" RangeBitmap ��: /K <anonymous-tag> .?AU<anonymous-tag>@@ 0K � :
" Lock �
7" RangeBitmap ��
[ Next �2 2K <anonymous-tag> .?AT<anonymous-tag>@@ 3K �
# ��
# ��
# ��
# <��r
5K PolicyState ��
6K AlwaysInherit
7K EnableAdditionalPolicyOption �
8K AuditReserved : 9K <anonymous-tag> .?AU<anonymous-tag>@@ :K �
# ��
# ��
# ��
# <��n
<K AuditState ���
=K AuditFlag
>K EnableAdditionalAuditingOption ���
?K Reserved �: @K <anonymous-tag> .?AU<anonymous-tag>@@ AK � 6
� ControlData ��
� DatabaseCreate ���2 CK <anonymous-tag> .?AT<anonymous-tag>@@ DK � 2
� FunctionTable
DynamicTable �2 FK <anonymous-tag> .?AT<anonymous-tag>@@ GK �
None �
BoolValue
p Int8Value
UInt8Value ���
Int16Value ���
! UInt16Value ��
t Int32Value ���
u UInt32Value ��
Int64Value ���
# UInt64Value ��
Z AnsiStringValue ��
� UnicodeStringValue ���2 IK <anonymous-tag> .?AT<anonymous-tag>@@ JK g p&
� ��
� >��:
LK KernelUpdateLock �
MK PrimaryClientID ��: NK <anonymous-tag> .?AU<anonymous-tag>@@ OK g �!
� ��
� >��R
QK KernelUpdateLock �
RK PrimaryClientID ��
� ContextLock ��2 SK <anonymous-tag> .?AT<anonymous-tag>@@ TK g �!
} ��
} ��
} ��
} ��
} ��
} ��
} ���
VK ScheduledThread ��
WK Suspended
XK VolatileContext ��
YK Terminated ���
ZK DebugActive ��
[K RunningOnSelfThread ��
\K DenyRunningOnSelfThread ��: ]K <anonymous-tag> .?AU<anonymous-tag>@@ ^K g �!
} ��
} ��
} ��
} ��
} ��
} ��
} ���
`K ScheduledThread ��
aK Suspended
bK VolatileContext ��
cK Terminated ���
dK DebugActive ��
eK RunningOnSelfThread ��
fK DenyRunningOnSelfThread ��
Q Flags 2 gK <anonymous-tag> .?AT<anonymous-tag>@@ hK g �! *
r HashEntry
H CurEntry �2 jK <anonymous-tag> .?AT<anonymous-tag>@@ kK g 3
" ��
" ��
" ��
" ��z
mK ElevationEnabled �
nK VirtualizationEnabled
oK InstallerDetectEnabled ���
pK ReservedBits �: qK <anonymous-tag> .?AU<anonymous-tag>@@ rK g n
Q Barrier ��
LeftBarrier ��
� WaitEvent
TotalProcessors ��
" Spins : tK <anonymous-tag> .?AU<anonymous-tag>@@ uK g Y �
Q Barrier ��
LeftBarrier ��
� WaitEvent
TotalProcessors ��
" Spins
� DUMMYRESERVEDSTRUCTNAME ��2 wK <anonymous-tag> .?AT<anonymous-tag>@@ xK g X
" ��
zK State : {K <anonymous-tag> .?AU<anonymous-tag>@@ |K g 6
[ Next �
! Depth
! Reserved �: ~K <anonymous-tag> .?AU<anonymous-tag>@@ K g �
�6
� � �K �K
�K
� *
m Raw ��
p Translated ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K � v
# ULong64 ��
Pointer ��
" Size �
Handle ���
" ULong
" AccessMask ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K �
# ��
# 8��&
�K Type �
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K �
" ��
" ��*
�K CommitEvents �
�K Spare : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w �
��
��
��N
�K ComPlus ��
�K ImageDynamicallyRelocated
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w �
��
��
��f
ImageFlags ���
�K ComPlus ��
�K ImageDynamicallyRelocated
�K Reserved �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K w � R
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w � v
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K w � B
! SubSystemMinorVersion
! SubSystemMajorVersion : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w � ^
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K w �
��
��
��N
�K ComPlus ��
�K ImageDynamicallyRelocated
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w �
��
��
��f
ImageFlags ���
�K ComPlus ��
�K ImageDynamicallyRelocated
�K Reserved �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K w � R
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w � v
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K w � B
! SubSystemMinorVersion
! SubSystemMajorVersion : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w � ^
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K w �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��Z
�K ImageExportSuppressionEnabled
�K ImageCetShadowStacksReady
�K ImageXfgEnabled ��
�K ImageCetShadowStacksStrictMode ���
�K ImageCetSetContextIpValidationRelaxedMode
�K ImageCetDynamicApisAllowInProc ���
�K ImageCetDowngradeReserved1 ���
�K ImageCetDowngradeReserved2 ���
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��r
" ExtendedFlags
�K ImageExportSuppressionEnabled
�K ImageCetShadowStacksReady
�K ImageXfgEnabled ��
�K ImageCetShadowStacksStrictMode ���
�K ImageCetSetContextIpValidationRelaxedMode
�K ImageCetDynamicApisAllowInProc ���
�K ImageCetDowngradeReserved1 ���
�K ImageCetDowngradeReserved2 ���
�K Reserved �2
�K <anonymous-tag> .?AT<anonymous-tag>@@ �K w �
��
��
��
��
��
��
���
�K ComPlusNativeReady ���
�K ComPlusILOnly
�K ImageDynamicallyRelocated
�K ImageMappedFlat ��
�K BaseBelow4gb �
�K ComPlusPrefer32bit ���
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w �
��
��
��
��
��
��
���
ImageFlags ���
�K ComPlusNativeReady ���
�K ComPlusILOnly
�K ImageDynamicallyRelocated
�K ImageMappedFlat ��
�K BaseBelow4gb �
�K ComPlusPrefer32bit ���
�K Reserved �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K w � R
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��: �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w � v
! MajorOperatingSystemVersion ��
! MinorOperatingSystemVersion ��
" OperatingSystemVersion ���2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K w � B
! SubSystemMinorVersion
! SubSystemMajorVersion : �K <anonymous-tag> .?AU<anonymous-tag>@@ �K w ~ ^
! SubSystemMinorVersion
! SubSystemMajorVersion
" SubSystemVersion �2 �K <anonymous-tag> .?AT<anonymous-tag>@@ �K w }
" ��
" ��&
�K State
�K Reserved �: �K <anonymous-tag> .?AU<anonymous-tag>@@ L w �
" ��
" ��B
L State
L Reserved �
" AllInformation ���2 L <anonymous-tag> .?AT<anonymous-tag>@@ L w �
" ��
" ��
" ��
" ��n
L ImagePartialMap ��
L ImageNotExecutable ���
L ImageSigningLevel
L Reserved �: L <anonymous-tag> .?AU<anonymous-tag>@@ L w �
" ��
" ��
" ��
" ��
" ImageFlags ���
L ImagePartialMap ��
L ImageNotExecutable ���
L ImageSigningLevel
L Reserved �2 L <anonymous-tag> .?AT<anonymous-tag>@@ L w �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
L Private ��
L MappedDataFile ���
L MappedImage ��
L MappedPageFile ���
L MappedPhysical ���
L DirectMapped �
L SoftwareEnclave ��
L PageSize64K ��
L PlaceholderReservation ���
L Reserved �:
L <anonymous-tag> .?AU<anonymous-tag>@@ L w �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" RegionType ���
"L Private ��
#L MappedDataFile ���
$L MappedImage ��
%L MappedPageFile ���
&L MappedPhysical ���
'L DirectMapped �
(L SoftwareEnclave ��
)L PageSize64K ��
*L PlaceholderReservation ���
+L Reserved �2 ,L <anonymous-tag> .?AT<anonymous-tag>@@ -L w �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ���
/L Valid
0L ShareCount ���
1L Win32Protection ��
2L Shared ���
3L Node �
4L Locked ���
5L LargePage
6L Priority �
7L Reserved �
8L SharedOriginal ���
9L Bad ��: :L <anonymous-tag> .?AU<anonymous-tag>@@ ;L w L
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
=L Valid
>L ShareCount ���
?L Win32Protection ��
@L Shared ���
AL Node �
BL Locked ���
CL LargePage
DL Priority �
EL Reserved �
FL SharedOriginal ���
GL Bad ��
�) Invalid ��2 HL <anonymous-tag> .?AT<anonymous-tag>@@ IL w K .
ImageHandle ��
# Unused ���2 KL <anonymous-tag> .?AT<anonymous-tag>@@ LL � � 6
SignatureInfoHandle ��
# Unused ���2 NL <anonymous-tag> .?AT<anonymous-tag>@@ OL � � ^
# ULong64 ��
Pointer ��
" Size �
Handle ���
" ULong 2 QL <anonymous-tag> .?AT<anonymous-tag>@@ RL � �
# ��
# 8��&
TL Type �
UL Reserved �: VL <anonymous-tag> .?AU<anonymous-tag>@@ WL � �
" ��
" ��2
YL HypervisorPages ��
ZL Reserved �: [L <anonymous-tag> .?AU<anonymous-tag>@@ \L � f
" ��
" ��
" ��
" ��
" ��
^L UseDumpStorageStack ��
_L CompressMemoryPagesData ��
`L IncludeUserSpaceMemoryPages ��
aL AbortIfMemoryPressure
bL Reserved �: cL <anonymous-tag> .?AU<anonymous-tag>@@ dL � >
" ��
" ��*
fL Enabled ��
gL Reserved �: hL <anonymous-tag> .?AU<anonymous-tag>@@ iL �
" ��
" ��>
kL Enabled ��
lL Reserved �
" AsULONG ��2 mL <anonymous-tag> .?AT<anonymous-tag>@@ nL �
< PebsDsSaveArea ���2 pL � <anonymous-tag> .?AT<anonymous-tag>@@ qL � � *
C As32Bit ��
! As64Bit ��2 sL � <anonymous-tag> .?AT<anonymous-tag>@@ tL � �
" ��
" ��2
vL KernelTransition �
wL Reserved �: xL <anonymous-tag> .?AU<anonymous-tag>@@ yL � �
" ��
" ��B
{L KernelTransition �
|L Reserved �
" ul ���2 }L <anonymous-tag> .?AT<anonymous-tag>@@ ~L � �
" ��
" ��
" ��F
�L SameRsdt �
�L SlicPresent ��
�L SlicDifferent : �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � �
" ��
" ��
" ��
" ��Z
�L Locked ���
�L UnlockApplied
�L UnlockIdValid
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � �
" ��
" ��
" ��
" ��j
" Flags
�L Locked ���
�L UnlockApplied
�L UnlockIdValid
�L Reserved �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � �
" ��
" ��
" ��
" ��
" ��
" ��
�L CetCapable ���
�L UserCetAllowed ���
�L ReservedForUserCet ���
�L KernelCetEnabled �
�L ReservedForKernelCet �
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � ,
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
�L CetCapable ���
�L UserCetAllowed ���
�L ReservedForUserCet ���
�L KernelCetEnabled �
�L ReservedForKernelCet �
�L Reserved �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � *
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
�L DbgMenuOsSelection ���
�L DbgHiberBoot �
�L DbgSoftBoot ��
�L DbgMeasuredLaunch
�L DbgMeasuredLaunchCapable �
�L DbgSystemHiveReplace �
�L DbgMeasuredLaunchSmmProtections ��
�L DbgMeasuredLaunchSmmLevel : �L <anonymous-tag> .?AU<anonymous-tag>@@ �L �
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# ��
# BootFlags
�L DbgMenuOsSelection ���
�L DbgHiberBoot �
�L DbgSoftBoot ��
�L DbgMeasuredLaunch
�L DbgMeasuredLaunchCapable �
�L DbgSystemHiveReplace �
�L DbgMeasuredLaunchSmmProtections ��
�L DbgMeasuredLaunchSmmLevel 2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L �
&
g Tag ��
" TagUlong �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � �
" ��2
VirtualAddress ���
�L NonPaged �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � �
&
g Tag ��
" TagUlong �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � v
F
g Tag ��
" TagUlong �
ProcessChargedQuota ��2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � d
B
" PagedPoolPageCount ���
" VirtualSizeInPages ���2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � � 2
" UniqueProcessId ��
" SessionId 2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � �
" ��
" ��
" ��
" ��n
�L HasStrongId ��
�L Classification ���
�L BackgroundActivityModerated ��
�L Spare : �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � /
" ��
" ��
" ��
" ��~
" Flags
�L HasStrongId ��
�L Classification ���
�L BackgroundActivityModerated ��
�L Spare 2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � - V
�5 ActiveProcessorsGroupAffinity
�5 AvailableMemory ��
�5 Pad ��2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � =
" ��
" ��
" ��
" ��
" ��
" ��
�L Set ��
�L Update ���
�L Clear
�L DscpTagEnabled ���
�L MaxBandwidthEnabled ��
�L Reserved �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � �
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
�L Set ��
�L Update ���
�L Clear
�L DscpTagEnabled ���
�L MaxBandwidthEnabled ��
�L Reserved �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � � 2
g QpcBypassEnabled �
QpcShift �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � � F
! QpcData ��
g QpcBypassEnabled �
QpcShift �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � � >
� ReservedTickCountOverlay �
� TickCountPad �: �L <anonymous-tag> .?AU<anonymous-tag>@@ �L � ^ j
� TickCount
� TickCountQuad
� ReservedTickCountOverlay �
� TickCountPad �2 �L <anonymous-tag> .?AT<anonymous-tag>@@ �L � [
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��~
�L DbgErrorPortPresent ��
�L DbgElevationEnabled ��
M DbgVirtEnabled ���
M DbgInstallerDetectEnabled
M DbgLkgEnabled
M DbgDynProcessorEnabled ���
M DbgConsoleBrokerEnabled ��
M DbgSecureBootEnabled �
M DbgMultiSessionSku ���
M DbgMultiUsersInSessionSku
M DbgStateSeparationEnabled
M SpareBits :
M <anonymous-tag> .?AU<anonymous-tag>@@ M � "
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" SharedDataFlags ��
M DbgErrorPortPresent ��
M DbgElevationEnabled ��
M DbgVirtEnabled ���
M DbgInstallerDetectEnabled
M DbgLkgEnabled
M DbgDynProcessorEnabled ���
M DbgConsoleBrokerEnabled ��
M DbgSecureBootEnabled �
M DbgMultiSessionSku ���
M DbgMultiUsersInSessionSku
M DbgStateSeparationEnabled
M SpareBits 2
M <anonymous-tag> .?AT<anonymous-tag>@@ M �
��
��
��
��z
M NXSupportPolicy ��
M SEHValidationPolicy ��
M CurDirDevicesSkippedForDlls ��
M Reserved �: M <anonymous-tag> .?AU<anonymous-tag>@@ !M � �
��
��
��
��
MitigationPolicies ���
#M NXSupportPolicy ��
$M SEHValidationPolicy ��
%M CurDirDevicesSkippedForDlls ��
&M Reserved �2 'M <anonymous-tag> .?AT<anonymous-tag>@@ (M � �
" ��
" ��6
*M OptimizedSave
+M CompactionEnabled : ,M <anonymous-tag> .?AU<anonymous-tag>@@ -M � r
" ��
" ��N
" ControlFlags �
/M OptimizedSave
0M CompactionEnabled 2 1M <anonymous-tag> .?AT<anonymous-tag>@@ 2M � o 2
" Reserved �
SchedulingClass ��2 4M <anonymous-tag> .?AT<anonymous-tag>@@ 5M � q
��
��
��
��
��z
7M Parked ���
8M Allocated
9M AllocatedToTargetProcess �
:M RealTime �
;M ReservedFlags : <M <anonymous-tag> .?AU<anonymous-tag>@@ =M � h
��
��
��
��
��
AllFlags �
?M Parked ���
@M Allocated
AM AllocatedToTargetProcess �
BM RealTime �
CM ReservedFlags 2 DM <anonymous-tag> .?AT<anonymous-tag>@@ EM � `
�( CpuSet ���2 GM <anonymous-tag> .?AT<anonymous-tag>@@ HM � W J
T Processor
U NumaNode �
� Cache
V Group 2 JM D <anonymous-tag> .?AT<anonymous-tag>@@ KM � F R
�A ProcessorCore
�A NumaNode �
H2 Cache
� Reserved �2 MM <anonymous-tag> .?AT<anonymous-tag>@@ NM � B
" DeviceDescriptionOffset ��
" DevicePathOffset �: PM <anonymous-tag> .?AU<anonymous-tag>@@ QM { � R
" ProcessImageNameOffset ���
" ProcessId
" ServiceTag ���: SM <anonymous-tag> .?AU<anonymous-tag>@@ TM { � �
" ProcessImageNameOffset ���
" ProcessId
" ServiceTag ���
" DeviceDescriptionOffset ��
" DevicePathOffset �2 VM <anonymous-tag> .?AT<anonymous-tag>@@ WM { � ~
" ResourceFileNameOffset ���
! ResourceReasonId �
" StringCount ��
" SubstitutionStringsOffset : YM <anonymous-tag> .?AU<anonymous-tag>@@ ZM { � �
" ResourceFileNameOffset ���
! ResourceReasonId �
" StringCount ��
" SubstitutionStringsOffset
" SimpleStringOffset ���2 \M <anonymous-tag> .?AT<anonymous-tag>@@ ]M { �
��
��
��
��n
_M NoDomainAccounting ���
`M IncreasePolicy ���
aM DecreasePolicy ���
bM Reserved �: cM <anonymous-tag> .?AU<anonymous-tag>@@ dM { � "
Spare
e/ Flags 2 fM <anonymous-tag> .?AT<anonymous-tag>@@ gM { �
! ��
! ��
! ��B
iM AllowScaling �
jM Disabled �
kM Reserved �: lM <anonymous-tag> .?AU<anonymous-tag>@@ mM { > N � PPM_THERMAL_POLICY_EVENT .?AUPPM_THERMAL_POLICY_EVENT@@ ��*
Mode �
# Processors ���N pM PPM_THERMAL_POLICY_EVENT .?AUPPM_THERMAL_POLICY_EVENT@@ �� qM { �
J � PPM_THERMALCHANGE_EVENT .?AUPPM_THERMALCHANGE_EVENT@@ 6
" ThermalConstraint
# Processors ���J tM PPM_THERMALCHANGE_EVENT .?AUPPM_THERMALCHANGE_EVENT@@ uM { �
R � PPM_PERFSTATE_DOMAIN_EVENT .?AUPPM_PERFSTATE_DOMAIN_EVENT@@ ��N
" State
" Latency ��
" Speed
# Processors ���R xM PPM_PERFSTATE_DOMAIN_EVENT .?AUPPM_PERFSTATE_DOMAIN_EVENT@@ �� yM { �
B � PPM_PERFSTATE_EVENT .?AUPPM_PERFSTATE_EVENT@@ ^
" State
" Status ���
" Latency ��
" Speed
" Processor B |M PPM_PERFSTATE_EVENT .?AUPPM_PERFSTATE_EVENT@@ }M { �
), " � ��
# TotalTime
" IdleTransitions ��
" FailedTransitions
" InvalidBucketIndex ���
" MinTimeUs
" MaxTimeUs
" CancelledTransitions �
M IdleTimeBuckets ��V �M �PPM_IDLE_STATE_ACCOUNTING_EX .?AUPPM_IDLE_STATE_ACCOUNTING_EX@@ �� �M {
" " �
" IdleTransitions ��
" FailedTransitions
" InvalidBucketIndex ���
# TotalTime
�M IdleTimeBuckets ��N �M 0 PPM_IDLE_STATE_ACCOUNTING .?AUPPM_IDLE_STATE_ACCOUNTING@@ �M {
J � PPM_WMI_IDLE_STATES_EX .?AUPPM_WMI_IDLE_STATES_EX@@ ��z
" Type �
" Count
" TargetState ��
" OldState �
TargetProcessors �
� State J �M 4 PPM_WMI_IDLE_STATES_EX .?AUPPM_WMI_IDLE_STATES_EX@@ �� �M { � R � POWER_STATE_NOTIFY_HANDLER .?AUPOWER_STATE_NOTIFY_HANDLER@@ �� �! �M
�M
� *
�M Handler ��
Context ��R �M POWER_STATE_NOTIFY_HANDLER .?AUPOWER_STATE_NOTIFY_HANDLER@@ �� �M { D .
" Granularity ��
" Capacity �J �M BATTERY_REPORTING_SCALE .?AUBATTERY_REPORTING_SCALE@@ �M { � j
ResourceFileName �
! ResourceReasonId �
" StringCount ��
{ ReasonStrings : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M { �
ResourceFileName �
! ResourceReasonId �
" StringCount ��
{ ReasonStrings
SimpleString �2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M {
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�M Reserved1
�M TargetSystemState
�M EffectiveSystemState �
�M CurrentSystemState ���
�M IgnoreHibernationPath
�M PseudoTransition �
�M KernelSoftReboot �
�M DirectedDripsTransition ��
�M Reserved2 : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M { �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�M Reserved1
�M TargetSystemState
�M EffectiveSystemState �
�M CurrentSystemState ���
�M IgnoreHibernationPath
�M PseudoTransition �
�M KernelSoftReboot �
�M DirectedDripsTransition ��
�M Reserved2
" ContextAsUlong ���2
�M <anonymous-tag> .?AT<anonymous-tag>@@ �M { � >
� ReparseDataBuffer
�# ReparseGuidDataBuffer 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � u& j
� SymbolicLinkReparseBuffer
� MountPointReparseBuffer ��
� GenericReparseBuffer �2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � )# 6
" FilterEntryCount �
" NumberOfPairs 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � B
h' SdChange �
i' SdQueryStats �
j' SdEnumSds 2 �M @ <anonymous-tag> .?AT<anonymous-tag>@@ �M � � B
� SdChange �
� SdQueryStats �
� SdEnumSds 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � | 2
; Lev1Depends ��
!; Lev2Depends ��2 �M D <anonymous-tag> .?AT<anonymous-tag>@@ �M � e .
" BufferLength �
� Buffer ���2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � a F
o BirthVolumeId
o BirthObjectId
o DomainId �: �M 0 <anonymous-tag> .?AU<anonymous-tag>@@ �M � � ^
o BirthVolumeId
o BirthObjectId
o DomainId �
�5 ExtendedInfo �2 �M 0 <anonymous-tag> .?AT<anonymous-tag>@@ �M � � �
" Calls
" Clusters �
" Hints
" RunsReturned �
" HintsHonored �
" HintsClusters
" Cache
" CacheClusters
" CacheMiss
" $ CacheMissClusters :
�M ( <anonymous-tag> .?AU<anonymous-tag>@@ �M � � J
! Write
! Create ���
! SetInfo ��
! Flush : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M � � :
! Write
! Create ���
! SetInfo ��: �M <anonymous-tag> .?AU<anonymous-tag>@@ �M � � J
! Write
! Create ���
! SetInfo ��
! Flush : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M � v J
! Write
! Create ���
! SetInfo ��
! Flush : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M � i 2
" UsnSourceInfo
" CopyNumber ���2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � 1 J � DELETE_USN_JOURNAL_DATA .?AUDELETE_USN_JOURNAL_DATA@@ 2
# UsnJournalID �
" DeleteFlags ��J �M DELETE_USN_JOURNAL_DATA .?AUDELETE_USN_JOURNAL_DATA@@ �M � ^
" RecordLength �
! MajorVersion �
! MinorVersion �
m FileReferenceNumber ��
m ParentFileReferenceNumber
( Usn ��
� 0 TimeStamp
" 8 Reason ���
" < SourceInfo ���
" @ SecurityId ���
" D FileAttributes ���
! H FileNameLength ���
! J FileNameOffset ���
L FileName �6 �M P USN_RECORD_V3 .?AUUSN_RECORD_V3@@ �M � � F � MOVE_FILE_RECORD_DATA .?AUMOVE_FILE_RECORD_DATA@@ R
FileHandle ���
� SourceFileRecord �
� TargetFileRecord �F �M MOVE_FILE_RECORD_DATA .?AUMOVE_FILE_RECORD_DATA@@ �M � �
F � VOLUME_BITMAP_BUFFER .?AUVOLUME_BITMAP_BUFFER@@ ��F
� StartingLcn ��
� BitmapSize ���
� Buffer ���F �M VOLUME_BITMAP_BUFFER .?AUVOLUME_BITMAP_BUFFER@@ �� �M � D
J � NTFS_VOLUME_DATA_BUFFER .?AUNTFS_VOLUME_DATA_BUFFER@@ �
� VolumeSerialNumber ���
� NumberSectors
� TotalClusters
� FreeClusters �
� TotalReserved
" ( BytesPerSector ���
" , BytesPerCluster ��
" 0 BytesPerFileRecordSegment
" 4 ClustersPerFileRecordSegment �
� 8 MftValidDataLength ���
� @ MftStartLcn ��
� H Mft2StartLcn �
� P MftZoneStart �
� X MftZoneEnd ���J �M ` NTFS_VOLUME_DATA_BUFFER .?AUNTFS_VOLUME_DATA_BUFFER@@ �M � � 6
NoCrossPartitionAccess ���
, Spare : �M <anonymous-tag> .?AU<anonymous-tag>@@ �M � � .
ReplaceIfExists ��
" Flags 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � .
ReplaceIfExists ��
" Flags 2 �M <anonymous-tag> .?AT<anonymous-tag>@@ �M � � F
o BirthVolumeId
o BirthObjectId
o DomainId �: �M 0 <anonymous-tag> .?AU<anonymous-tag>@@ �M � h ^
o BirthVolumeId
o BirthObjectId
o DomainId �
�5 ExtendedInfo �2 �M 0 <anonymous-tag> .?AT<anonymous-tag>@@ N � g *
Status ���
Pointer ��2 N <anonymous-tag> .?AT<anonymous-tag>@@ N � � "
H In ���
H Out ��2 N <anonymous-tag> .?AT<anonymous-tag>@@ N � � 2
" DesiredAccess
" GrantedAccess 2 N <anonymous-tag> .?AT<anonymous-tag>@@ N � V 2
" ObjectType ���
" HandleCount ��2 N <anonymous-tag> .?AT<anonymous-tag>@@ N � Q 2
Handle ���
y. HandleAttrArray ��2 N <anonymous-tag> .?AT<anonymous-tag>@@ N � L
" ��
" ��
" ��
" ��
" ��
" ��
N Reserved0
N SameAccess ���
N SameAttributes ���
N Indirect �
N Inherit ��
N Reserved1 : N <anonymous-tag> .?AU<anonymous-tag>@@ N � B
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
N Reserved0
N SameAccess ���
N SameAttributes ���
N Indirect �
N Inherit ��
N Reserved1 2 N <anonymous-tag> .?AT<anonymous-tag>@@ !N � @ 2
" DesiredAccess
" GrantedAccess 2 #N <anonymous-tag> .?AT<anonymous-tag>@@ $N � 8
" ��
" ��
" ��
" ��
" ��
" ��
&N Reserved0
'N SameAccess ���
(N SameAttributes ���
)N Indirect �
*N Inherit ��
+N Reserved1 : ,N <anonymous-tag> .?AU<anonymous-tag>@@ -N � ,
" ��
" ��
" ��
" ��
" ��
" ��
" Flags
/N Reserved0
0N SameAccess ���
1N SameAttributes ���
2N Indirect �
3N Inherit ��
4N Reserved1 2 5N <anonymous-tag> .?AT<anonymous-tag>@@ 6N � * 6
" ClientViewSize ���
" CallbackId ���2 8N <anonymous-tag> .?AT<anonymous-tag>@@ 9N � N 2
ClientId �
A DoNotUseThisField 2 ;N <anonymous-tag> .?AT<anonymous-tag>@@ <N � I
" ��
" ��.
>N CfgOverride ��
?N Reserved �: @N <anonymous-tag> .?AU<anonymous-tag>@@ AN � H
" ��
" ��>
" Flags
CN CfgOverride ��
DN Reserved �2 EN <anonymous-tag> .?AT<anonymous-tag>@@ FN � F
2
" UpdateMask ���
" DesiredState �: HN <anonymous-tag> .?AU<anonymous-tag>@@ IN � I
" ��
" ��
" ��
" ��f
KN FreezeOperation ��
LN FilterOperation ��
MN SwapOperation
NN Reserved �: ON <anonymous-tag> .?AU<anonymous-tag>@@ PN �
" ��
" ��
" ��
" ��v
" Flags
RN FreezeOperation ��
SN FilterOperation ��
TN SwapOperation
UN Reserved �2 VN <anonymous-tag> .?AT<anonymous-tag>@@ WN � 6
# ManifestAddress ��
" ManifestSize �: YN <anonymous-tag> .?AU<anonymous-tag>@@ ZN � � 6
# ManifestAddress ��
" ManifestSize �2 \N <anonymous-tag> .?AT<anonymous-tag>@@ ]N � �
��
��
��
��
��
��
��
! ���
_N ProtectedProcess �
`N AddressSpaceOverride �
aN DevOverrideEnabled ���
bN ManifestDetected �
cN ProtectedProcessLight
dN SpareBits1 ���
eN SpareBits2 ���
fN SpareBits3 ���: gN <anonymous-tag> .?AU<anonymous-tag>@@ hN � �
��
��
��
��
��
��
��
! ��
" OutputFlags ��
jN ProtectedProcess �
kN AddressSpaceOverride �
lN DevOverrideEnabled ���
mN ManifestDetected �
nN ProtectedProcessLight
oN SpareBits1 ���
pN SpareBits2 ���
qN SpareBits3 ���2 rN <anonymous-tag> .?AT<anonymous-tag>@@ sN � �
��
��
��
��
��
��
! ���
uN WriteOutputOnExit
vN DetectManifest ���
wN IFEOSkipDebugger �
xN IFEODoNotPropagateKeyState ���
yN SpareBits1 ���
zN SpareBits2 ���
{N ProhibitedImageCharacteristics ���: |N <anonymous-tag> .?AU<anonymous-tag>@@ }N � �
��
��
��
��
��
��
! ���
" InitFlags
N WriteOutputOnExit
�N DetectManifest ���
�N IFEOSkipDebugger �
�N IFEODoNotPropagateKeyState ���
�N SpareBits1 ���
�N SpareBits2 ���
�N ProhibitedImageCharacteristics ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � � n
� InitState
� FailSection ��
� ExeFormat
� ExeName ��
� SuccessState �2 �N @ <anonymous-tag> .?AT<anonymous-tag>@@ �N � �
��
��
��6
�N Type �
�N Audit
�N Signer ���: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � ^
��
��
��F
Level
�N Type �
�N Audit
�N Signer ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � \ &
" StdHandleSubsystemType ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � U
" ��
" ��:
�N StdHandleState ���
�N PseudoHandleMask �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � P
" ��
" ��J
" Flags
�N StdHandleState ���
�N PseudoHandleMask �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � N &
" Value
ValuePtr �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � � �
ASLRPolicy ���
StrictHandleCheckPolicy ��
SystemCallDisablePolicy ��
ExtensionPointDisablePolicy ��
DynamicCodePolicy
ControlFlowGuardPolicy ���
SignaturePolicy ��
FontDisablePolicy
ImageLoadPolicy ��
SystemCallFilterPolicy ���
PayloadRestrictionPolicy �
ChildProcessPolicy ���
SideChannelIsolationPolicy ���
UserShadowStackPolicy 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � $
" ��
" ��*
�N TopDown ��
�N Reserved �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � �
" ��
" ��
" ��F
�N EnableAutoUpdate �
�N Permanent
�N Reserved �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � � �
� InputDuration
� AudioInDuration ��
� AudioOutDuration �
� DisplayRequiredDuration ��
� PSMBackgroundDuration : �N ( <anonymous-tag> .?AU<anonymous-tag>@@ �N � \ �
C Durations
� InputDuration
� AudioInDuration ��
� AudioOutDuration �
� DisplayRequiredDuration ��
� PSMBackgroundDuration 2 �N ( <anonymous-tag> .?AT<anonymous-tag>@@ �N � Z �
& CpuTimeline ��
& DiskTimeline �
& NetworkTimeline ��
& MBBTimeline ��
& ForegroundTimeline ���
& ( DesktopVisibleTimeline ���
& 0 CompositionRenderedTimeline ��
& 8 CompositionDirtyGeneratedTimeline
& @ CompositionDirtyPropagatedTimeline ���
& H InputTimeline
& P AudioInTimeline ��
& X AudioOutTimeline �
& ` DisplayRequiredTimeline ��
& h KeyboardInputTimeline : �N p <anonymous-tag> .?AU<anonymous-tag>@@ �N � H �
C Timelines
& CpuTimeline ��
& DiskTimeline �
& NetworkTimeline ��
& MBBTimeline ��
& ForegroundTimeline ���
& ( DesktopVisibleTimeline ���
& 0 CompositionRenderedTimeline ��
& 8 CompositionDirtyGeneratedTimeline
& @ CompositionDirtyPropagatedTimeline ���
& H InputTimeline
& P AudioInTimeline ��
& X AudioOutTimeline �
& ` DisplayRequiredTimeline ��
& h KeyboardInputTimeline 2 �N p <anonymous-tag> .?AT<anonymous-tag>@@ �N � F f
� ForegroundDuration ���
� DesktopVisibleDuration ���
� PSMForegroundDuration : �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � / z
�/ Durations
� ForegroundDuration ���
� DesktopVisibleDuration ���
� PSMForegroundDuration 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � +
" ��
" ��F
" LastChangeTime ���
�N Duration �
�N IsInState : �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � � *
" EndTime ��
" Bitmap ���: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � �
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
�N IsProtectedProcess ���
�N IsWow64Process ���
�N IsProcessDeleting
�N IsCrossSessionCreate �
�N IsFrozen �
�N IsBackground �
�N IsStronglyNamed ��
�N IsSecureProcess ��
�N IsPicoProcess
�N SpareBits :
�N <anonymous-tag> .?AU<anonymous-tag>@@ �N � �
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u ��
u Flags
�N IsProtectedProcess ���
�N IsWow64Process ���
�N IsProcessDeleting
�N IsCrossSessionCreate �
�N IsFrozen �
�N IsBackground �
�N IsStronglyNamed ��
�N IsSecureProcess ��
�N IsPicoProcess
�N SpareBits 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � � .
" TlsIndex �
" PreviousCount 2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � s
ThreadId �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � h 2
NewTlsData ���
OldTlsData ���2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N � d
" ��
" ��.
�N Foreground ���
�N Reserved �: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N � D *
" ControlFlags �
Path �2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N D � *
! MinRate ��
! MaxRate ��: �N <anonymous-tag> .?AU<anonymous-tag>@@ �N D R
" CpuRate ��
" Weight ���
! MinRate ��
! MaxRate ��2 �N <anonymous-tag> .?AT<anonymous-tag>@@ �N D N
M RateControlToleranceLimit
M CpuRateControlToleranceLimit �2 O <anonymous-tag> .?AT<anonymous-tag>@@ O D F
M RateControlTolerance �
M CpuRateControlTolerance ��2 O <anonymous-tag> .?AT<anonymous-tag>@@ O D >
# JobHighMemoryLimit ���
# JobMemoryLimit ���2 O <anonymous-tag> .?AT<anonymous-tag>@@ O D � V
� RateControlToleranceInterval �
� CpuRateControlToleranceInterval ��2
O <anonymous-tag> .?AT<anonymous-tag>@@ O D � F
M RateControlTolerance �
M CpuRateControlTolerance ��2
O <anonymous-tag> .?AT<anonymous-tag>@@ O D � >
# JobHighMemoryLimit ���
# JobMemoryLimit ���2 O <anonymous-tag> .?AT<anonymous-tag>@@ O D �
" ��
" ��
" ��
" ��
" ��
O EnableReadVmLogging ��
O EnableWriteVmLogging �
O EnableProcessSuspendResumeLogging
O EnableThreadSuspendResumeLogging �
O Reserved �: O <anonymous-tag> .?AU<anonymous-tag>@@ O D \
��
��
��V
O EnableReadVmLogging ��
O EnableWriteVmLogging �
O Unused ���: O <anonymous-tag> .?AU<anonymous-tag>@@ O D S
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
!O EnableUserShadowStack
"O AuditUserShadowStack �
#O SetContextIpValidation ���
$O AuditSetContextIpValidation ��
%O EnableUserShadowStackStrictMode ��
&O BlockNonCetBinaries ��
'O BlockNonCetBinariesNonEhcont �
(O AuditBlockNonCetBinaries �
)O CetDynamicApisOutOfProcOnly ��
*O SetContextIpValidationRelaxedMode
+O ReservedFlags : ,O <anonymous-tag> .?AU<anonymous-tag>@@ -O D
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" Flags
/O EnableUserShadowStack
0O AuditUserShadowStack �
1O SetContextIpValidation ���
2O AuditSetContextIpValidation ��
3O EnableUserShadowStackStrictMode ��
4O BlockNonCetBinaries ��
5O BlockNonCetBinariesNonEhcont �
6O AuditBlockNonCetBinaries �
7O CetDynamicApisOutOfProcOnly ��
8O SetContextIpValidationRelaxedMode
9O ReservedFlags 2 :O <anonymous-tag> .?AT<anonymous-tag>@@ ;O D
" ��
" ��
" ��
" ��
" ��
=O SmtBranchTargetIsolation �
>O IsolateSecurityDomain
?O DisablePageCombine ���
@O SpeculativeStoreBypassDisable
AO ReservedFlags : BO <anonymous-tag> .?AU<anonymous-tag>@@ CO D �
" ��
" ��
" ��
" ��
" ��
" Flags
EO SmtBranchTargetIsolation �
FO IsolateSecurityDomain
GO DisablePageCombine ���
HO SpeculativeStoreBypassDisable
IO ReservedFlags 2 JO <anonymous-tag> .?AT<anonymous-tag>@@ KO D �
" ��
" ��
" ��
" ��
MO NoChildProcessCreation ���
NO AuditNoChildProcessCreation ��
OO AllowSecureProcessCreation ���
PO ReservedFlags : QO <anonymous-tag> .?AU<anonymous-tag>@@ RO D �
" ��
" ��
" ��
" ��
" Flags
TO NoChildProcessCreation ���
UO AuditNoChildProcessCreation ��
VO AllowSecureProcessCreation ���
WO ReservedFlags 2 XO <anonymous-tag> .?AT<anonymous-tag>@@ YO D �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ��
[O EnableExportAddressFilter
\O AuditExportAddressFilter �
]O EnableExportAddressFilterPlus
^O AuditExportAddressFilterPlus �
_O EnableImportAddressFilter
`O AuditImportAddressFilter �
aO EnableRopStackPivot ��
bO AuditRopStackPivot ���
cO EnableRopCallerCheck �
dO AuditRopCallerCheck ��
eO EnableRopSimExec �
fO AuditRopSimExec ��
gO ReservedFlags :
hO <anonymous-tag> .?AU<anonymous-tag>@@ iO D �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
" ���
" Flags
kO EnableExportAddressFilter
lO AuditExportAddressFilter �
mO EnableExportAddressFilterPlus
nO AuditExportAddressFilterPlus �
oO EnableImportAddressFilter
pO AuditImportAddressFilter �
qO EnableRopStackPivot ��
rO AuditRopStackPivot ���
sO EnableRopCallerCheck �
tO AuditRopCallerCheck ��
uO EnableRopSimExec �
vO AuditRopSimExec ��
wO ReservedFlags 2 xO <anonymous-tag> .?AT<anonymous-tag>@@ yO D �
" ��
" ��.
{O FilterId �
|O ReservedFlags : }O <anonymous-tag> .?AU<anonymous-tag>@@ ~O D �
" ��
" ��>
" Flags
�O FilterId �
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D �
" ��
" ��
" ��
" ��
" ��
" ���
�O NoRemoteImages ���
�O NoLowMandatoryLabelImages
�O PreferSystem32Images �
�O AuditNoRemoteImages ��
�O AuditNoLowMandatoryLabelImages ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O D �
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
�O NoRemoteImages ���
�O NoLowMandatoryLabelImages
�O PreferSystem32Images �
�O AuditNoRemoteImages ��
�O AuditNoLowMandatoryLabelImages ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D �
" ��
" ��
" ��^
�O DisableNonSystemFonts
�O AuditNonSystemFontLoading
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O D �
" ��
" ��
" ��n
" Flags
�O DisableNonSystemFonts
�O AuditNonSystemFontLoading
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D �
" ��
" ��
" ��
" ��
" ��
" ��
�O MicrosoftSignedOnly ��
�O StoreSignedOnly ��
�O MitigationOptIn ��
�O AuditMicrosoftSignedOnly �
�O AuditStoreSignedOnly �
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O D �
" ��
" ��
" ��
" ��
" ��
" ���
" Flags
�O MicrosoftSignedOnly ��
�O StoreSignedOnly ��
�O MitigationOptIn ��
�O AuditMicrosoftSignedOnly �
�O AuditStoreSignedOnly �
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D �
" ��
" ��
" ��
" ��z
�O EnableControlFlowGuard ���
�O EnableExportSuppression ��
�O StrictMode ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O D �
" ��
" ��
" ��
" ��
" Flags
�O EnableControlFlowGuard ���
�O EnableExportSuppression ��
�O StrictMode ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D �
" ��
" ��
" ��
" ��
" ��
�O ProhibitDynamicCode ��
�O AllowThreadOptOut
�O AllowRemoteDowngrade �
�O AuditProhibitDynamicCode �
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O D {
" ��
" ��
" ��
" ��
" ��
" Flags
�O ProhibitDynamicCode ��
�O AllowThreadOptOut
�O AllowRemoteDowngrade �
�O AuditProhibitDynamicCode �
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D y
" ��
" ��>
�O DisableExtensionPoints ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O D q
" ��
" ��N
" Flags
�O DisableExtensionPoints ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D o
" ��
" ��
" ��j
�O DisallowWin32kSystemCalls
�O AuditDisallowWin32kSystemCalls ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O D f
" ��
" ��
" ��z
" Flags
�O DisallowWin32kSystemCalls
�O AuditDisallowWin32kSystemCalls ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D d
" ��
" ��
" ��~
�O RaiseExceptionOnInvalidHandleReference ���
�O HandleExceptionsPermanentlyEnabled ���
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O D [
" ��
" ��
" ��
" Flags
�O RaiseExceptionOnInvalidHandleReference ���
�O HandleExceptionsPermanentlyEnabled ���
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D Y
" ��
" ��
" ��R
�O Enable ���
�O DisableAtlThunkEmulation �
�O ReservedFlags : �O <anonymous-tag> .?AU<anonymous-tag>@@ �O D O
" ��
" ��
" ��b
" Flags
�O Enable ���
�O DisableAtlThunkEmulation �
�O ReservedFlags 2 �O <anonymous-tag> .?AT<anonymous-tag>@@ �O D M
" ��
" ��
" ��
" ��
" ��
P EnableBottomUpRandomization ��
P EnableForceRelocateImages
P EnableHighEntropy
P DisallowStrippedImages ���
P ReservedFlags : P <anonymous-tag> .?AU<anonymous-tag>@@ P D B
" ��
" ��
" ��
" ��
" ��
" Flags
P EnableBottomUpRandomization ��
P EnableForceRelocateImages
P EnableHighEntropy
P DisallowStrippedImages ���
P ReservedFlags 2 P <anonymous-tag> .?AT<anonymous-tag>@@ P D @
" ��
" ��.
P RatePercent ��
P Reserved0 : P <anonymous-tag> .?AU<anonymous-tag>@@ P D � *
" DriveMap �
� DriveType : P $ <anonymous-tag> .?AU<anonymous-tag>@@ P D (
DirectoryHandle ��: P <anonymous-tag> .?AU<anonymous-tag>@@ P D % "
P Set ��
P Query 2 P $ <anonymous-tag> .?AT<anonymous-tag>@@ P D $ "
� Set ��
� Query 2 P $ <anonymous-tag> .?AT<anonymous-tag>@@ P D
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"P IsProtectedProcess ���
#P IsWow64Process ���
$P IsProcessDeleting
%P IsCrossSessionCreate �
&P IsFrozen �
'P IsBackground �
(P IsStronglyNamed ��
)P IsSecureProcess ��
*P IsSubsystemProcess ���
+P SpareBits :
,P <anonymous-tag> .?AU<anonymous-tag>@@ -P D �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��"
" Flags
/P IsProtectedProcess ���
0P IsWow64Process ���
1P IsProcessDeleting
2P IsCrossSessionCreate �
3P IsFrozen �
4P IsBackground �
5P IsStronglyNamed ��
6P IsSecureProcess ��
7P IsSubsystemProcess ���
8P SpareBits 2 9P <anonymous-tag> .?AT<anonymous-tag>@@ :P D � >
� RtlUmsCompletionList �
UmsCompletionList 2 <P <anonymous-tag> .?AT<anonymous-tag>@@ =P D f 2
� RtlUmsContext
UmsContext ���2 ?P <anonymous-tag> .?AT<anonymous-tag>@@ @P D ]
" ��
" ��>
BP IsUmsSchedulerThread �
CP IsUmsWorkerThread : DP <anonymous-tag> .?AU<anonymous-tag>@@ EP D E
" ��
" ��N
" Flags
GP IsUmsSchedulerThread �
HP IsUmsWorkerThread 2 IP <anonymous-tag> .?AT<anonymous-tag>@@ JP D C 6
� CompletionList ���
� UmsContext ���: LP <anonymous-tag> .?AU<anonymous-tag>@@ MP D 0
" ��
" ��
� CompletionList ���
� UmsContext ���
" Flags
OP IsUmsSchedulerThread �
PP IsUmsWorkerThread 2 QP <anonymous-tag> .?AT<anonymous-tag>@@ RP D .
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��
! ��
TP SafeThunkCall
UP InDebugPrint �
VP HasFiberData �
WP SkipThreadAttach �
XP WerInShipAssertCode ��
YP RanProcessInit ���
ZP ClonedThread �
[P SuppressDebugMsg �
\P DisableUserStackWalk �
]P RtlExceptionAttached �
^P InitialThread
_P SessionAware �
`P LoadOwner
aP LoaderWorker �
bP SkipLoaderInit ���
cP SpareSameTebBits �: dP <anonymous-tag> .?AU<anonymous-tag>@@ eP < �
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
! ��
!
��
! ��
! ��
!
��
! ��
! ���
! SameTebFlags �
gP SafeThunkCall
hP InDebugPrint �
iP HasFiberData �
jP SkipThreadAttach �
kP WerInShipAssertCode ��
lP RanProcessInit ���
mP ClonedThread �
nP SuppressDebugMsg �
oP DisableUserStackWalk �
pP RtlExceptionAttached �
qP InitialThread
rP SessionAware �
sP LoadOwner
tP LoaderWorker �
uP SkipLoaderInit ���
vP SpareSameTebBits �2 wP <anonymous-tag> .?AT<anonymous-tag>@@ xP < z
! ��
zP SpareCrossTebBits : {P <anonymous-tag> .?AU<anonymous-tag>@@ |P < r
! ��6
s CrossTebFlags
~P SpareCrossTebBits 2 P <anonymous-tag> .?AT<anonymous-tag>@@ �P < p f
ReservedPad0 �
ReservedPad1 �
ReservedPad2 �
IdealProcessor ���: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P < G �
% CurrentIdealProcessor
" IdealProcessorValue ��
ReservedPad0 �
ReservedPad1 �
ReservedPad2 �
IdealProcessor ���2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P < D
" ��
" ��6
�P SixtySecondEnabled ���
�P Reserved �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P < �
" ��
" ��R
" LeapSecondFlags ��
�P SixtySecondEnabled ���
�P Reserved �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P < �
" ��
" ��
" ��
" ��
�P HeapTracingEnabled ���
�P CritSecTracingEnabled
�P LibLoaderTracingEnabled ��
�P SpareTracingBits �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P < I
" ��
" ��
" ��
" ��
" TracingFlags �
�P HeapTracingEnabled ���
�P CritSecTracingEnabled
�P LibLoaderTracingEnabled ��
�P SpareTracingBits �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P < G >
KernelCallbackTable ��
UserSharedInfoPtr 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P < �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
�P ProcessInJob �
�P ProcessInitializing ��
�P ProcessUsingVEH ��
�P ProcessUsingVCH ��
�P ProcessUsingFTH ��
�P ProcessPreviouslyThrottled ���
�P ProcessCurrentlyThrottled
�P ProcessImagesHotPatched ��
�P ReservedBits0 : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P < �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��2
" CrossProcessFlags
�P ProcessInJob �
�P ProcessInitializing ��
�P ProcessUsingVEH ��
�P ProcessUsingVCH ��
�P ProcessUsingFTH ��
�P ProcessPreviouslyThrottled ���
�P ProcessCurrentlyThrottled
�P ProcessImagesHotPatched ��
�P ReservedBits0 2
�P <anonymous-tag> .?AT<anonymous-tag>@@ �P < �
��
��
��
��
��
��
��
��
�P ImageUsesLargePages ��
�P IsProtectedProcess ���
�P IsImageDynamicallyRelocated ��
�P SkipPatchingUser32Forwarders �
�P IsPackagedProcess
�P IsAppContainer ���
�P IsProtectedProcessLight ��
�P IsLongPathAwareProcess ���: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P < s
��
��
��
��
��
��
��
��&
BitField �
�P ImageUsesLargePages ��
�P IsProtectedProcess ���
�P IsImageDynamicallyRelocated ��
�P SkipPatchingUser32Forwarders �
�P IsPackagedProcess
�P IsAppContainer ���
�P IsProtectedProcessLight ��
�P IsLongPathAwareProcess ���2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P < q *
# FiberData
" Version ��2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P D F *
" FiberData
" Version ��2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P D 3 *
FiberData
" Version ��2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P D *
! Id ���
! NameIsPresent : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P � d
# LoadedImports : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P � U
" TimeDateStamp : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P � R 2
" TimeDateStamp
# LoadedImports 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P � Q 2
# SectionPointer ���
" CheckSum �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P � L F
HashLinks
# SectionPointer ���
" CheckSum �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P � J
" LoadedImports : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P � 2
" TimeDateStamp : �P <anonymous-tag> .?AU<anonymous-tag>@@ �P � / 2
" TimeDateStamp
" LoadedImports 2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P � . 2
" SectionPointer ���
" CheckSum �: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P � ) F
HashLinks
" SectionPointer ���
" CheckSum �2 �P <anonymous-tag> .?AT<anonymous-tag>@@ �P � '
! ��
! ��
! ��J
�P SignatureLevel ���
�P SignatureType
�P Unused ���: �P <anonymous-tag> .?AU<anonymous-tag>@@ �P �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
Q PackagedBinary ���
Q MarkedForRemoval �
Q ImageDll �
Q LoadNotificationsSent
Q TelemetryEntryProcessed ��
Q ProcessStaticImport ��
Q InLegacyLists
Q InIndexes
Q ShimDll ��
Q InExceptionTable �
Q ReservedFlags1 ���
Q LoadInProgress ���
Q LoadConfigProcessed ��
Q EntryProcessed ���
Q ProtectDelayLoad �
Q ReservedFlags3 ���
Q DontCallForThreads ���
Q ProcessAttachCalled ��
Q ProcessAttachFailed ��
Q CorDeferredValidate ��
Q CorImage �
Q DontRelocate �
Q CorILOnly
Q ChpeImage
Q ReservedFlags5 ���
Q Redirected ���
Q ReservedFlags6 ���
Q CompatDatabaseProcessed ��: Q <anonymous-tag> .?AU<anonymous-tag>@@ Q � �
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
"
��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��&
g FlagGroup
" Flags
Q PackagedBinary ���
!Q MarkedForRemoval �
"Q ImageDll �
#Q LoadNotificationsSent
$Q TelemetryEntryProcessed ��
%Q ProcessStaticImport ��
&Q InLegacyLists
'Q InIndexes
(Q ShimDll ��
)Q InExceptionTable �
*Q ReservedFlags1 ���
+Q LoadInProgress ���
,Q LoadConfigProcessed ��
-Q EntryProcessed ���
.Q ProtectDelayLoad �
/Q ReservedFlags3 ���
0Q DontCallForThreads ���
1Q ProcessAttachCalled ��
2Q ProcessAttachFailed ��
3Q CorDeferredValidate ��
4Q CorImage �
5Q DontRelocate �
6Q CorILOnly
7Q ChpeImage
8Q ReservedFlags5 ���
9Q Redirected ���
:Q ReservedFlags6 ���
;Q CompatDatabaseProcessed ��2 <Q <anonymous-tag> .?AT<anonymous-tag>@@ =Q � �
�<
�
?Q pAttributeV1 �2 @Q <anonymous-tag> .?AT<anonymous-tag>@@ AQ w ,
&
P Sid ��
� Buffer ���2 CQ D <anonymous-tag> .?AT<anonymous-tag>@@ DQ w | &
� TokenUser
� User �2 FQ <anonymous-tag> .?AT<anonymous-tag>@@ GQ w w &
9 Q
�5 D
9 S 2 IQ <anonymous-tag> .?AT<anonymous-tag>@@ JQ �& � 6
" EntryPointToken ��
" EntryPointRVA 2 LQ <anonymous-tag> .?AT<anonymous-tag>@@ MQ � � &
! Ordinal ��
! Hint �2 OQ <anonymous-tag> .?AT<anonymous-tag>@@ PQ � y 6
# EndOfPrologue
# UnwindInfoAddress 2 RQ <anonymous-tag> .?AT<anonymous-tag>@@ SQ �
6
" UnwindInfoAddress
" UnwindData ���2 UQ <anonymous-tag> .?AT<anonymous-tag>@@ VQ � 6
" ��
" ��
" ��
" ��
" ��
" ��
XQ FunctionLength ���
YQ Version ��
ZQ ExceptionDataPresent �
[Q EpilogInHeader ���
\Q EpilogCount ��
]Q CodeWords : ^Q <anonymous-tag> .?AU<anonymous-tag>@@ _Q �
" ��
" ��
"
��
" ��
" ��
" ��
" ��~
aQ Flag �
bQ FunctionLength ���
cQ RegF �
dQ RegI �
eQ H
fQ CR ���
gQ FrameSize : hQ <anonymous-tag> .?AU<anonymous-tag>@@ iQ �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" UnwindData ���
kQ Flag �
lQ FunctionLength ���
mQ RegF �
nQ RegI �
oQ H
pQ CR ���
qQ FrameSize 2 rQ <anonymous-tag> .?AT<anonymous-tag>@@ sQ �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
"
��
uQ Flag �
vQ FunctionLength ���
wQ Ret ��
xQ H
yQ Reg ��
zQ R
{Q L
|Q C
}Q StackAdjust ��: ~Q <anonymous-tag> .?AU<anonymous-tag>@@ Q � �
" ��
" ��
"
��
" ��
" ��
" ��
" ��
" ��
"
��
" UnwindData ���
�Q Flag �
�Q FunctionLength ���
�Q Ret ��
�Q H
�Q Reg ��
�Q R
�Q L
�Q C
�Q StackAdjust ��2
�Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � �
" ��
" ��2
�Q NativeCode ���
�Q AddressBits ��: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � y
" ��
" ��J
" StartOffset ��
�Q NativeCode ���
�Q AddressBits ��2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � w
" ��
" ��:
�Q OffsetToDirectory
�Q DataIsDirectory ��: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � V
" ��
" ��R
" OffsetToData �
�Q OffsetToDirectory
�Q DataIsDirectory ��2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � T
" ��
" ��2
�Q NameOffset ���
�Q NameIsString �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � M
" ��
" ��R
�Q NameOffset ���
�Q NameIsString �
" Name �
! Id ���2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � L
" ��
" ��6
�Q RvaBased �
�Q ReservedAttributes ���: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q �
>
" Characteristics ��
" OriginalFirstThunk ���2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � �
" ��
" ��
" ��>
�Q Reserved0
�Q Alignment
�Q Reserved1 : �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � �
" ��
" ��
" ��Z
" Characteristics ��
�Q Reserved0
�Q Alignment
�Q Reserved1 2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � �
" ��
" ��
" ��>
�Q Reserved0
�Q Alignment
�Q Reserved1 : �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � �
" ��
" ��
" ��Z
" Characteristics ��
�Q Reserved0
�Q Alignment
�Q Reserved1 2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � � 6
" VirtualAddress ���
" RelocCount ���2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � v .
j$ TokenDef �
� rgbReserved ��: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � P "
" Short
" Long �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � h :
ShortName
�Q Name �
7 LongName �2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � f
p x
� test �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q
��
��>
�Q Red ��
�Q Balance ��
" ParentValue ��2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q } "
� Left �
� Right : �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q u 6
� Children �
� Left �
� Right 2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q s *
" LowPart ��
" HighPart �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � *
" LowPart ��
HighPart �: �Q <anonymous-tag> .?AU<anonymous-tag>@@ �Q � >
UseThisFieldToCopy ���
A DoNotUseThisField 2 �Q <anonymous-tag> .?AT<anonymous-tag>@@ �Q � 6 � tagEMRMASKBLT .?AUtagEMRMASKBLT@@ �
� emr ��
c rclBounds
xDest
yDest
cxDest ���
$ cyDest ���
" ( dwRop
, xSrc �
0 ySrc �
I 4 xformSrc �
" L crBkColorSrc �
" P iUsageSrc
" T offBmiSrc
" X cbBmiSrc �
" \ offBitsSrc ���
" ` cbBitsSrc
d xMask
h yMask
" l iUsageMask ���
" p offBmiMask ���
" t cbBmiMask
" x offBitsMask ��
" | cbBitsMask ���6 �Q � tagEMRMASKBLT .?AUtagEMRMASKBLT@@ �Q � �
�-
�
m
�
u ��
u ��
u ��
u ��
u ��
u ���
u FeatureId
�Q Priority �
�Q EnabledState �
�Q IsWexpConfiguration ��
�Q HasSubscriptions �
�Q Variant ��
�Q VariantPayloadKind ���
u VariantPayload ���R �Q _RTL_FEATURE_CONFIGURATION .?AU_RTL_FEATURE_CONFIGURATION@@ �� �Q c
c ��
�Q
� n � _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION .?AU_JOURNAL_TRANSACTION_BOUNDARY_INFORMATION@@
�Q
� Z
� Action ���
# RecordNumber �
� TimeStamp
$ TransactionID n R ( _JOURNAL_TRANSACTION_BOUNDARY_INFORMATION .?AU_JOURNAL_TRANSACTION_BOUNDARY_INFORMATION@@ R � � N � _PROCESS_AFFINITY_UPDATE_MODE .?AT_PROCESS_AFFINITY_UPDATE_MODE@@
" ��
" ��
" ��V
" Flags
R EnableAutoUpdate �
R Permanent
R Reserved �N R _PROCESS_AFFINITY_UPDATE_MODE .?AT_PROCESS_AFFINITY_UPDATE_MODE@@ R � � : � _MESSAGE_TRACE .?AU_MESSAGE_TRACE@@ ��*
�5 MessageHeader
Data �: R _MESSAGE_TRACE .?AU_MESSAGE_TRACE@@ ��
R b �
�>
�
�
�
�
" ��
" ��
" ��
" ��
" Flags
R EnableControlFlowGuard ���
R EnableExportSuppression ��
R StrictMode ���
R ReservedFlags v R _PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY .?AU_PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY@@ R D � b � _PROCESS_EXTENDED_BASIC_INFORMATION .?AU_PROCESS_EXTENDED_BASIC_INFORMATION@@
R
�
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��F
" Size �
E BasicInfo
" Flags
R IsProtectedProcess ���
R IsWow64Process ���
R IsProcessDeleting
R IsCrossSessionCreate �
R IsFrozen �
R IsBackground �
!R IsStronglyNamed ��
"R IsSecureProcess ��
#R IsSubsystemProcess ���
$R SpareBits b
%R _PROCESS_EXTENDED_BASIC_INFORMATION .?AU_PROCESS_EXTENDED_BASIC_INFORMATION@@ &R D �
�
�
�
� N � _THREAD_BASIC_INFORMATION .?AU_THREAD_BASIC_INFORMATION@@
� �
ExitStatus ���
+R TebBaseAddress ���
ClientId �
" AffinityMask �
Priority �
BasePriority �N ,R _THREAD_BASIC_INFORMATION .?AU_THREAD_BASIC_INFORMATION@@ -R � �
@
�
�G
� N � tagEMRSETCOLORADJUSTMENT .?AUtagEMRSETCOLORADJUSTMENT@@ ��.
� emr ��
`1 ColorAdjustment ��N 2R tagEMRSETCOLORADJUSTMENT .?AUtagEMRSETCOLORADJUSTMENT@@ �� 3R � �
Z
�
T-
�
#
�
�G
� R � _ADMINISTRATOR_POWER_POLICY .?AU_ADMINISTRATOR_POWER_POLICY@@ �
� MinSleep �
� MaxSleep �
" MinVideoTimeout ��
" MaxVideoTimeout ��
" MinSpindownTimeout ���
" MaxSpindownTimeout ���R :R _ADMINISTRATOR_POWER_POLICY .?AU_ADMINISTRATOR_POWER_POLICY@@ ;R { �
�
�
8%
� F � _SERVICE_DESCRIPTIONA .?AU_SERVICE_DESCRIPTIONA@@
p lpDescription F @R _SERVICE_DESCRIPTIONA .?AU_SERVICE_DESCRIPTIONA@@ AR � � N � tagWNODE_EVENT_REFERENCE .?AUtagWNODE_EVENT_REFERENCE@@ ��
� WnodeHeader ��
$ 0 TargetGuid ���
" @ TargetDataBlockSize ��
" D TargetInstanceIndex ��
J D TargetInstanceName ���N DR H tagWNODE_EVENT_REFERENCE .?AUtagWNODE_EVENT_REFERENCE@@ �� ER � B � _CSV_QUERY_MDS_PATH .?AU_CSV_QUERY_MDS_PATH@@ R
" MdsNodeId
" DsNodeId �
" PathLength ���
Path �B HR _CSV_QUERY_MDS_PATH .?AU_CSV_QUERY_MDS_PATH@@ IR � �
�E
� b � _GET_FILTER_FILE_IDENTIFIER_OUTPUT .?AU_GET_FILTER_FILE_IDENTIFIER_OUTPUT@@ ��J
! FilterFileIdentifierLength ���
� FilterFileIdentifier �b MR _GET_FILTER_FILE_IDENTIFIER_OUTPUT .?AU_GET_FILTER_FILE_IDENTIFIER_OUTPUT@@ �� NR � �"
�#
� R � _UNWIND_HISTORY_TABLE_ENTRY .?AU_UNWIND_HISTORY_TABLE_ENTRY@@ QR " ` �
" Count
LocalHint
GlobalHint ���
Search ���
Once �
" LowAddress ���
" HighAddress ��
RR Entry F SR p _UNWIND_HISTORY_TABLE .?AU_UNWIND_HISTORY_TABLE@@ TR �& � r � _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION .?AU_EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION@@
VR
� �
? EventTraceInformationClass ���
" ReleaseSamplingRate ��
" ContentionSamplingRate ���
" NumberOfExcessiveTimeouts r XR _EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION .?AU_EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION@@ YR @ V
LastError
LastEEInfo ���
� LastCalledStage ��
q ServerName ���
q ServerPort ���
q RemoteUser ���
q AuthType �
ResourceTypePresent ��
SessionIdPresent �
InterfacePresent �
$ ResourceType �
$ 0 SessionId
/ @ Interface
T CertContext ��B [R X _RDR_CALLOUT_STATE .?AU_RDR_CALLOUT_STATE@@ �� \R 3 J � _RTL_FEATURE_USAGE_DATA .?AU_RTL_FEATURE_USAGE_DATA@@ B
u FeatureId
! ReportingKind
! Reserved �J _R _RTL_FEATURE_USAGE_DATA .?AU_RTL_FEATURE_USAGE_DATA@@ `R z V � _DRIVER_VERIFIER_THUNK_PAIRS .?AU_DRIVER_VERIFIER_THUNK_PAIRS@@ ��
bR
�
$
� 6
dR PristineRoutine ��
dR NewRoutine ���V eR _DRIVER_VERIFIER_THUNK_PAIRS .?AU_DRIVER_VERIFIER_THUNK_PAIRS@@ �� fR � � B � tagEMRRESIZEPALETTE .?AUtagEMRRESIZEPALETTE@@
hR
� 6
� emr ��
" ihPal
" cEntries �B jR tagEMRRESIZEPALETTE .?AUtagEMRRESIZEPALETTE@@ kR � �
�
" ��
" ��
" ��
" Flags
nR RaiseExceptionOnInvalidHandleReference ���
oR HandleExceptionsPermanentlyEnabled ���
pR ReservedFlags z qR _PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY .?AU_PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY@@ �� rR D X J � _KEY_LAYER_INFORMATION .?AU_KEY_LAYER_INFORMATION@@ ��
tR
�
" ��
" ��
" ��
" ��
" ��
vR IsTombstone ��
wR IsSupersedeLocal �
xR IsSupersedeTree ��
yR ClassIsInherited �
zR Reserved �J {R _KEY_LAYER_INFORMATION .?AU_KEY_LAYER_INFORMATION@@ �� |R
�:
� R � _KEY_SET_LAYER_INFORMATION .?AU_KEY_SET_LAYER_INFORMATION@@ ��
R
�
" ��
" ��
" ��
" ��
" ��
�R IsTombstone ��
�R IsSupersedeLocal �
�R IsSupersedeTree ��
�R ClassIsInherited �
�R Reserved �R �R _KEY_SET_LAYER_INFORMATION .?AU_KEY_SET_LAYER_INFORMATION@@ �� �R . b � _VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT .?AU_VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT@@
�R
� *
" Size �
�6 BehaviorCode �b �R _VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT .?AU_VIRTUAL_STORAGE_SET_BEHAVIOR_INPUT@@ �R � �!
B
� R � _KEY_WRITE_TIME_INFORMATION .?AU_KEY_WRITE_TIME_INFORMATION@@
�R
�
� LastWriteTime R �R _KEY_WRITE_TIME_INFORMATION .?AU_KEY_WRITE_TIME_INFORMATION@@ �R
" ��
" ��
" ��
" ��
ImageBase
" SizeOfImage ��
" ImageFlags ���
�R ImagePartialMap ��
�R ImageNotExecutable ���
�R ImageSigningLevel
�R Reserved �N �R _MEMORY_IMAGE_INFORMATION .?AU_MEMORY_IMAGE_INFORMATION@@ �R w �
;
�
5
�
�
�
�2
�
�>
�
;
� T- " �R
�R
� 2 � _PORT_VIEW .?AU_PORT_VIEW@@ ��
�R
� �
" Length ���
SectionHandle
" SectionOffset
" ViewSize �
ViewBase �
ViewRemoteBase ���2 �R _PORT_VIEW .?AU_PORT_VIEW@@ �� �R � � Z � _FILE_PIPE_ASSIGN_EVENT_BUFFER .?AU_FILE_PIPE_ASSIGN_EVENT_BUFFER@@ ��.
EventHandle ��
" KeyValue �Z �R _FILE_PIPE_ASSIGN_EVENT_BUFFER .?AU_FILE_PIPE_ASSIGN_EVENT_BUFFER@@ �� �R �
)
�( ��
�R
�
H
� V
rgbBlue ��
rgbGreen �
rgbRed ���
rgbReserved ��2 �R tagRGBQUAD .?AUtagRGBQUAD@@ �� �R � z Z � _RTL_DISK_WRITE_CONSTRAINT_INFO .?AU_RTL_DISK_WRITE_CONSTRAINT_INFO@@
G Policy ���Z �R _RTL_DISK_WRITE_CONSTRAINT_INFO .?AU_RTL_DISK_WRITE_CONSTRAINT_INFO@@ �R 7
�
� �= f � _PERFINFO_PAGECOMBINE_ITERATION_STAT .?AU_PERFINFO_PAGECOMBINE_ITERATION_STAT@@ ��
" ��
" ��V
�R StatType �
�R Spare
" PagesScanned �
" PagesCombined f �R _PERFINFO_PAGECOMBINE_ITERATION_STAT .?AU_PERFINFO_PAGECOMBINE_ITERATION_STAT@@ �� �R b @
p,
�
D
� J � _ATOM_BASIC_INFORMATION .?AU_ATOM_BASIC_INFORMATION@@ R
! UsageCount ���
! Flags
! NameLength ���
Name �J �R _ATOM_BASIC_INFORMATION .?AU_ATOM_BASIC_INFORMATION@@ �R �
�
� B � tagEMRGRADIENTFILL .?AUtagEMRGRADIENTFILL@@ �� � " �j
� emr ��
c rclBounds
" nVer �
" nTri �
" ulMode ���
�R $ Ver ��B �R 4 tagEMRGRADIENTFILL .?AUtagEMRGRADIENTFILL@@ �� �R �
;
�
�
�>
�
�
�
D
� � �R �R t t �R
�R
�
!
� ^ � _RTL_IMAGE_MITIGATION_HEAP_POLICY .?AU_RTL_IMAGE_MITIGATION_HEAP_POLICY@@ "
� TerminateOnHeapErrors ^ �R _RTL_IMAGE_MITIGATION_HEAP_POLICY .?AU_RTL_IMAGE_MITIGATION_HEAP_POLICY@@ �R = : TimerSetCoalescableTimer � MaxTimerInfoClass R t �R _TIMER_SET_INFORMATION_CLASS .?AW4_TIMER_SET_INFORMATION_CLASS@@ ��� �R � � F � _RTL_HEAP_WALK_ENTRY .?AU_RTL_HEAP_WALK_ENTRY@@ ��
�R
� �
DataAddress ��
" DataSize �
OverheadBytes
SegmentIndex �
!
Flags
�J Block
�J Segment ��F �R _RTL_HEAP_WALK_ENTRY .?AU_RTL_HEAP_WALK_ENTRY@@ �� �R � �
9
�
cF
�
�=
�
� W * �R _FP_32 .?AU_FP_32@@ �� �R � 6
+
�
(
�
:8
�
X
�
�,
�
t unused ���2 �R HMETAFILE__ .?AUHMETAFILE__@@ �R �' �
7&
�
{-
� � � �R
�
�
�
�
eA
�
�-
� > � _LEAP_SECOND_DATA .?AU_LEAP_SECOND_DATA@@
@ �R B � _ACCESS_DENIED_ACE .?AU_ACCESS_DENIED_ACE@@ ��:
� Header ���
" Mask �
" SidStart �B �R _ACCESS_DENIED_ACE .?AU_ACCESS_DENIED_ACE@@ �� �R w �
�0
� V � _RTLP_HEAP_SERIALIZED_MAPPING .?AU_RTLP_HEAP_SERIALIZED_MAPPING@@ F
" Allocation ���
StackReference ���
" Size �V �R _RTLP_HEAP_SERIALIZED_MAPPING .?AU_RTLP_HEAP_SERIALIZED_MAPPING@@ S � z
�E
�
�
�
�A
�
�F
�
:A
� B � _FILE_REGION_INPUT .?AU_FILE_REGION_INPUT@@ ��
S
� F
FileOffset ���
Length ���
" DesiredUsage �B S _FILE_REGION_INPUT .?AU_FILE_REGION_INPUT@@ ��
S � } ^ � _FILE_END_OF_FILE_INFORMATION_EX .?AU_FILE_END_OF_FILE_INFORMATION_EX@@ ��b
� EndOfFile
� PagingFileSizeInMM ���
� PagingFileMaxSize
" Flags ^
S _FILE_END_OF_FILE_INFORMATION_EX .?AU_FILE_END_OF_FILE_INFORMATION_EX@@ �� S � $
�4
�
U+
� S t S
S
�
NC
�
4
� b � _FILE_PIPE_EVENT_ENUM_INPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_INPUT_BUFFER@@ ��
# EventHandle ��b S _FILE_PIPE_EVENT_ENUM_INPUT_BUFFER .?AU_FILE_PIPE_EVENT_ENUM_INPUT_BUFFER@@ �� S � �)
.
� R � _ETW_TIMER_EXPIRATION_EVENT .?AU_ETW_TIMER_EXPIRATION_EVENT@@ j
# ExpectedDueTime ��
" TimerAddress �
" DeferredRoutine ��
EncodedDelay �R S _ETW_TIMER_EXPIRATION_EVENT .?AU_ETW_TIMER_EXPIRATION_EVENT@@ S b � > � _RTL_ELEVATION_FLAGS .?AT_RTL_ELEVATION_FLAGS@@ ��
S
�
" ��
" ��
" ��
" ��
" Flags
"S ElevationEnabled �
#S VirtualizationEnabled
$S InstallerDetectEnabled ���
%S ReservedBits �> &S _RTL_ELEVATION_FLAGS .?AT_RTL_ELEVATION_FLAGS@@ �� 'S g } � x2 )S
*S
� " " �n
Flags
EfficiencyClass ��
� Reserved �
! GroupCount ���
,S GroupMask J -S $ _PROCESSOR_RELATIONSHIP .?AU_PROCESSOR_RELATIONSHIP@@ .S � F � _PROCESS_INFORMATION .?AU_PROCESS_INFORMATION@@ ��
0S
� Z
hProcess �
hThread ��
" dwProcessId ��
" dwThreadId ���F 2S _PROCESS_INFORMATION .?AU_PROCESS_INFORMATION@@ �� 3S � J � _RTL_RVA_LIST_ITERATOR .?AU_RTL_RVA_LIST_ITERATOR@@ ��Z
" CurrentRva ���
" CurrentRvaIndex ��
" CompressedRvaDataOffset ��J 6S _RTL_RVA_LIST_ITERATOR .?AU_RTL_RVA_LIST_ITERATOR@@ �� 7S r
�2
� Z � _NTPSS_MEMORY_BULK_INFORMATION .?AU_NTPSS_MEMORY_BULK_INFORMATION@@ ��R
" QueryFlags ���
" NumberOfEntries ��
NextValidAddress �Z ;S _NTPSS_MEMORY_BULK_INFORMATION .?AU_NTPSS_MEMORY_BULK_INFORMATION@@ �� <S � *
�
�
�,
�
�G
�
�D
�
"C
� j � _FILE_NETWORK_PHYSICAL_NAME_INFORMATION .?AU_FILE_NETWORK_PHYSICAL_NAME_INFORMATION@@ 2
" FileNameLength ���
FileName �j DS _FILE_NETWORK_PHYSICAL_NAME_INFORMATION .?AU_FILE_NETWORK_PHYSICAL_NAME_INFORMATION@@ ES � �
�2
�
)=
�
83
� " " � �
�
q.
� J � _EVENT_FILTER_LEVEL_KW .?AU_EVENT_FILTER_LEVEL_KW@@ ��^
# MatchAnyKeyword ��
# MatchAllKeyword ��
Level
FilterIn �J NS _EVENT_FILTER_LEVEL_KW .?AU_EVENT_FILTER_LEVEL_KW@@ �� OS = �
,6
�
A=
� "
# Low ��
High �. SS _NEON128 .?AU_NEON128@@ �� TS �& b
M
� q " q t WS
XS
�
�*
�
�
�B
�
�)
� ' " � �
! Size �
! Version ��
% ProcessorNumber ��
" ContextSwitches ��
" HwCountersCount ��
� UpdateCount ��
# WaitReasonBitMap �
# HardwareCounters �
' ( CycleTime
^S @ HwCounters ���N
_S �_THREAD_PERFORMANCE_DATA .?AU_THREAD_PERFORMANCE_DATA@@ �� `S � �
,7
�
�
� # R
%
�
�0
�
{6
�
�=
�
�
�
�5
�
|7
� f � _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W@@ ��
1( TransportCredentials �
" Flags
" AuthenticationTarget �
" NumberOfAuthnSchemes �
" AuthnSchemes �
q ServerCertificateSubject �
1( ProxyCredentials �
" NumberOfProxyAuthnSchemes
" ProxyAuthnSchemes f mS $ _RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W .?AU_RPC_HTTP_TRANSPORT_CREDENTIALS_V2_W@@ �� nS ^ �
�
� N � tagINPUT_INJECTION_VALUE .?AUtagINPUT_INJECTION_VALUE@@ ��B
! page �
! usage
t value
! index N rS tagINPUT_INJECTION_VALUE .?AUtagINPUT_INJECTION_VALUE@@ �� sS ~ P b _ARM_CPS_INTERRUPT_FLAG_F _ARM_CPS_INTERRUPT_FLAG_I _ARM_CPS_INTERRUPT_FLAG_A B t uS _tag_ARMINTR_CPS_FLAG .?AW4_tag_ARMINTR_CPS_FLAG@@ � vS j � ^ � _PERFINFO_MEMORY_NODE_INFORMATION .?AU_PERFINFO_MEMORY_NODE_INFORMATION@@ j/ " L �>
" PartitionId ��
" Count
yS NodeEntry ^ zS T _PERFINFO_MEMORY_NODE_INFORMATION .?AU_PERFINFO_MEMORY_NODE_INFORMATION@@ {S b � j � _FILE_FS_PERSISTENT_VOLUME_INFORMATION .?AU_FILE_FS_PERSISTENT_VOLUME_INFORMATION@@ ��V
" VolumeFlags ��
" FlagMask �
" Version ��
" Reserved �j ~S _FILE_FS_PERSISTENT_VOLUME_INFORMATION .?AU_FILE_FS_PERSISTENT_VOLUME_INFORMATION@@ �� S � W n � _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA .?AU_PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA@@ ��
DeviceInstance ���
� InterfaceGuid
Reference
Register �
q SymLink ��
" SymLinkLength n �S _PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA .?AU_PLUGPLAY_CONTROL_CLASS_ASSOCIATION_DATA@@ �� �S $ V J � _FILE_PIPE_INFORMATION .?AU_FILE_PIPE_INFORMATION@@ ��2
" ReadMode �
" CompletionMode ���J �S _FILE_PIPE_INFORMATION .?AU_FILE_PIPE_INFORMATION@@ �� �S � F . � _NT_TIB32 .?AU_NT_TIB32@@ �
" ExceptionList
" StackBase
" StackLimit ���
" SubSystemTib �
" FiberData
" Version ��
" ArbitraryUserPointer �
" Self �. �S _NT_TIB32 .?AU_NT_TIB32@@ �S D , Z � _FILE_FS_FULL_SIZE_INFORMATION .?AU_FILE_FS_FULL_SIZE_INFORMATION@@ ��
�S
� �
� TotalAllocationUnits �
� CallerAvailableAllocationUnits ���
� ActualAvailableAllocationUnits ���
" SectorsPerAllocationUnit �
" BytesPerSector ���Z �S _FILE_FS_FULL_SIZE_INFORMATION .?AU_FILE_FS_FULL_SIZE_INFORMATION@@ �� �S �
]7
�
4G
�
� ��
�S
� F � _NETCONNECTINFOSTRUCT .?AU_NETCONNECTINFOSTRUCT@@ n
" cbStructure ��
" dwFlags ��
" dwSpeed ��
" dwDelay ��
" dwOptDataSize F �S _NETCONNECTINFOSTRUCT .?AU_NETCONNECTINFOSTRUCT@@ �S � u > � _SE_ACCESS_REPLY .?AU_SE_ACCESS_REPLY@@ ��
�S
�
*
�
?
�
�S
� �
" Size �
" ResultListCount ��
" GrantedAccess
AccessStatus �
�S AccessReason �
�S Privileges ���> �S _SE_ACCESS_REPLY .?AU_SE_ACCESS_REPLY@@ �� �S w p t t t t �S
�S
�
�
�
� ^ � _LOOKUP_STREAM_FROM_CLUSTER_ENTRY .?AU_LOOKUP_STREAM_FROM_CLUSTER_ENTRY@@ f
" OffsetToNext �
" Flags
� Reserved �
� Cluster ��
FileName �^ �S _LOOKUP_STREAM_FROM_CLUSTER_ENTRY .?AU_LOOKUP_STREAM_FROM_CLUSTER_ENTRY@@ �S � �
_
� J � _FILE_LEVEL_TRIM_OUTPUT .?AU_FILE_LEVEL_TRIM_OUTPUT@@
�S
� "
" NumRangesProcessed ���J �S _FILE_LEVEL_TRIM_OUTPUT .?AU_FILE_LEVEL_TRIM_OUTPUT@@ �S � g
�
�
\6
� F � _IMAGE_IMPORT_BY_NAME .?AU_IMAGE_IMPORT_BY_NAME@@ "
! Hint �
Name �F �S _IMAGE_IMPORT_BY_NAME .?AU_IMAGE_IMPORT_BY_NAME@@ �S � } : � _NETINFOSTRUCT .?AU_NETINFOSTRUCT@@ ��
" cbStructure ��
" dwProviderVersion
" dwStatus �
" dwCharacteristics
" dwHandle �
! wNetType �
" dwPrinters ���
" dwDrives �: �S _NETINFOSTRUCT .?AU_NETINFOSTRUCT@@ �� �S � �
F
�
{!
� R � _ETW_THREAD_AFFINITY_EVENT .?AU_ETW_THREAD_AFFINITY_EVENT@@ ��J
" Mask �
" ThreadId �
! Group
!
Reserved �R �S _ETW_THREAD_AFFINITY_EVENT .?AU_ETW_THREAD_AFFINITY_EVENT@@ �� �S b %
�/
� V � tagEMRCREATEDIBPATTERNBRUSHPT .?AUtagEMRCREATEDIBPATTERNBRUSHPT@@ �
� emr ��
" ihBrush ��
" iUsage ���
" offBmi ���
" cbBmi
" offBits ��
" cbBits ���V �S tagEMRCREATEDIBPATTERNBRUSHPT .?AUtagEMRCREATEDIBPATTERNBRUSHPT@@ �S � u
�*
�
2:
�
^
� B � _IMAGE_ROM_HEADERS .?AU_IMAGE_ROM_HEADERS@@ ��6
� FileHeader ���
� OptionalHeader ���B �S L _IMAGE_ROM_HEADERS .?AU_IMAGE_ROM_HEADERS@@ �� �S � � f � PROCESS_PROTECTION_LEVEL_INFORMATION .?AUPROCESS_PROTECTION_LEVEL_INFORMATION@@ ��
" ProtectionLevel ��f �S PROCESS_PROTECTION_LEVEL_INFORMATION .?AUPROCESS_PROTECTION_LEVEL_INFORMATION@@ �� �S � �
m
� � � t �S
�S
�
h;
�
>6
� b � _ETW_TP_EVENT_TIMER_EXPIRATION_END .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_END@@ ��
�S
� *
m Header ���
SubQueue �b �S $ _ETW_TP_EVENT_TIMER_EXPIRATION_END .?AU_ETW_TP_EVENT_TIMER_EXPIRATION_END@@ �� �S b =
6
�
�D
� R � _ETW_CPU_CACHE_FLUSH_EVENT .?AU_ETW_CPU_CACHE_FLUSH_EVENT@@ ��
Address ��
" Bytes
Clean
FullFlush
Rectangle
Reserved0
" Reserved1 R �S _ETW_CPU_CACHE_FLUSH_EVENT .?AU_ETW_CPU_CACHE_FLUSH_EVENT@@ �� �S b N
�
� "
�) Type �
" Size �J �S _PO_WAKE_SOURCE_HEADER .?AU_PO_WAKE_SOURCE_HEADER@@ �� �S {
N � _IMAGE_RESOURCE_DIRECTORY .?AU_IMAGE_RESOURCE_DIRECTORY@@
�S
� �
" Characteristics ��
" TimeDateStamp
! MajorVersion �
!
MinorVersion �
! NumberOfNamedEntries �
! NumberOfIdEntries N �S _IMAGE_RESOURCE_DIRECTORY .?AU_IMAGE_RESOURCE_DIRECTORY@@ �S � /
� : � tagEMRROUNDRECT .?AUtagEMRROUNDRECT@@ :
� emr ��
c rclBox ���
d szlCorner : �S tagEMRROUNDRECT .?AUtagEMRROUNDRECT@@ �S �
#
� > � _NTFS_STATISTICS .?AU_NTFS_STATISTICS@@ ��
�S
� ~
" LogFileFullExceptions
" OtherExceptions ��
" MftReads �
" MftReadBytes �
" MftWrites
" MftWriteBytes
�M MftWritesUserLevel ���
! MftWritesFlushForLogFileFull �
! " MftWritesLazyWriter ��
! $ MftWritesUserRequest �
" ( Mft2Writes ���
" , Mft2WriteBytes ���
�M 0 Mft2WritesUserLevel ��
! 8 Mft2WritesFlushForLogFileFull
! : Mft2WritesLazyWriter �
! < Mft2WritesUserRequest
" @ RootIndexReads ���
" D RootIndexReadBytes ���
" H RootIndexWrites ��
" L RootIndexWriteBytes ��
" P BitmapReads ��
" T BitmapReadBytes ��
" X BitmapWrites �
" \ BitmapWriteBytes �
! ` BitmapWritesFlushForLogFileFull ��
! b BitmapWritesLazyWriter ���
! d BitmapWritesUserRequest ��
�M f BitmapWritesUserLevel
" l MftBitmapReads ���
" p MftBitmapReadBytes ���
" t MftBitmapWrites ��
" x MftBitmapWriteBytes ��
! | MftBitmapWritesFlushForLogFileFull ���
! ~ MftBitmapWritesLazyWriter
! � MftBitmapWritesUserRequest ���
�M � MftBitmapWritesUserLevel �
" � UserIndexReads ���
" � UserIndexReadBytes ���
" � UserIndexWrites ��
" � UserIndexWriteBytes ��
" � LogFileReads �
" � LogFileReadBytes �
" � LogFileWrites
" � LogFileWriteBytes
�M � Allocate �
" � DiskResourcesExhausted ���> . �S � _NTFS_STATISTICS .?AU_NTFS_STATISTICS@@ �� �S � \ F � _TEB_ACTIVE_FRAME_EX .?AU_TEB_ACTIVE_FRAME_EX@@ ��:
' BasicFrame ���
ExtensionIdentifier ��F �S _TEB_ACTIVE_FRAME_EX .?AU_TEB_ACTIVE_FRAME_EX@@ �� �S < �
|3
� j � _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX@@ ��V
DebuggerAllowed ��
DebuggerEnabled ��
DebuggerPresent ��j �S _SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX .?AU_SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX@@ �� �S � �
O
�
2(
�
�
`(
� : � tagGCP_RESULTSW .?AUtagGCP_RESULTSW@@ �
" lStructSize ��
q lpOutString ��
u lpOrder ��
t lpDx �
t lpCaretPos ���
p lpClass ��
q lpGlyphs �
u nGlyphs ��
t nMaxFit ��: T $ tagGCP_RESULTSW .?AUtagGCP_RESULTSW@@ T � �
n"
� q t T
T
� F � tagMENUGETOBJECTINFO .?AUtagMENUGETOBJECTINFO@@ ��V
" dwFlags ��
u uPos �
� hmenu
riid �
pvObj F T tagMENUGETOBJECTINFO .?AUtagMENUGETOBJECTINFO@@ ��
T ~ h
f+
� J � _MESSAGE_RESOURCE_ENTRY .?AU_MESSAGE_RESOURCE_ENTRY@@ 6
! Length ���
! Flags
� Text �J T _MESSAGE_RESOURCE_ENTRY .?AU_MESSAGE_RESOURCE_ENTRY@@ T g �
BD
� B � tagMDICREATESTRUCTW .?AUtagMDICREATESTRUCTW@@ �
szClass ��
szTitle ��
hOwner ���
t x
t y
t cx ���
t cy ���
" style
lParam ���B T $ tagMDICREATESTRUCTW .?AUtagMDICREATESTRUCTW@@ T ~ �.
(
�
��
��
��
��
��
��
��
��
Z<
� . � _SLIST_HEADER .?AT_SLIST_HEADER@@
#T
�
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" ��
" �� " " � �
�
� N � _ACTIVATION_CONTEXT_DATA .?AU_ACTIVATION_CONTEXT_DATA@@ ��
0T ��
1T
� F � _ASSEMBLY_STORAGE_MAP .?AU_ASSEMBLY_STORAGE_MAP@@
3T
�
" ��
" ��
" ��
" �� p " �
�R
�
" ��
" ��
InheritedAddressSpace
ReadImageFileExecOptions �
BeingDebugged
BitField �
T ImageUsesLargePages ��
T IsProtectedProcess ���
T IsImageDynamicallyRelocated ��
T SkipPatchingUser32Forwarders �
T IsPackagedProcess
T IsAppContainer ���
T IsProtectedProcessLight ��
!T IsLongPathAwareProcess ���
Mutant ���
ImageBaseAddress �
"T Ldr ��
�< ProcessParameters
SubSystemData
ProcessHeap ��
c FastPebLock ��
$T AtlThunkSListPtr �
$ IFEOKey ��
" ( CrossProcessFlags
%T ( ProcessInJob �
&T ( ProcessInitializing ��
'T ( ProcessUsingVEH ��
(T ( ProcessUsingVCH ��
)T ( ProcessUsingFTH ��
*T ( ProcessPreviouslyThrottled ���
+T ( ProcessCurrentlyThrottled
,T ( ProcessImagesHotPatched ��
-T ( ReservedBits0
, KernelCallbackTable ��
, UserSharedInfoPtr
" 0 SystemReserved ���
$T 4 AtlThunkSListPtr32 ���
8 ApiSetMap
" < TlsExpansionCounter ��
@ TlsBitmap
7 D TlsBitmapBits
L ReadOnlySharedMemoryBase �
P SharedData ���
& T ReadOnlyStaticServerData �
X AnsiCodePageData �
\ OemCodePageData ��
` UnicodeCaseTableData �
" d NumberOfProcessors ���
" h NtGlobalFlag �
� p CriticalSectionTimeout ���
" x HeapSegmentReserve ���
" | HeapSegmentCommit
" � HeapDeCommitTotalFreeThreshold ���
" � HeapDeCommitFreeBlockThreshold ���
" � NumberOfHeaps
" � MaximumNumberOfHeaps �
& � ProcessHeaps �
� GdiSharedHandleTable �
� ProcessStarterHelper �
" � GdiDCAttributeList ���
c � LoaderLock ���
" � OSMajorVersion ���
" � OSMinorVersion ���
! � OSBuildNumber
! � OSCSDVersion �
" � OSPlatformId �
" � ImageSubsystem ���
" � ImageSubsystemMajorVersion ���
" � ImageSubsystemMinorVersion ���
" � ActiveProcessAffinityMask
.T � GdiHandleBuffer ��
/T LPostProcessInitRoutine ���
PTlsExpansionBitmap ���
9 TTlsExpansionBitmapBits ���
" �SessionId
� �AppCompatFlags ���
� �AppCompatFlagsUser ���
�pShimData
�AppCompatInfo
�CSDVersion ���
2T �ActivationContextData
4T �ProcessAssemblyStorageMap
2T SystemDefaultActivationContextData ���
4T SystemAssemblyStorageMap �
" MinimumStackCommit ���
k9 SparePointers
SpareUlongs ��
0WerRegistrationData ��
4WerShipAssertPtr �
8pUnused ��
<pImageHeaderHash �
" @TracingFlags �
5T @HeapTracingEnabled ���
6T @CritSecTracingEnabled
7T @LibLoaderTracingEnabled ��
8T @SpareTracingBits �
# HCsrServerReadOnlySharedMemoryBase
" PTppWorkerpListLock ���
! TTppWorkerpList ���
� \WaitOnAddressHashTable ���
\TelemetryCoverageHeader ��
" `CloudFileFlags ���
" dCloudFileDiagFlags ���
p hPlaceholderCompatibilityMode �
9T iPlaceholderCompatibilityModeReserved �
:T pLeapSecondData ���
" tLeapSecondFlags ��
;T tSixtySecondEnabled ���
<T tReserved �
" xNtGlobalFlag2 & l =T �_PEB .?AU_PEB@@ �� >T < m > � tagBITMAPCOREINFO .?AUtagBITMAPCOREINFO@@ w3 " �2
f bmciHeader ���
AT bmciColors ���> BT tagBITMAPCOREINFO .?AUtagBITMAPCOREINFO@@ CT � �
�&
�
�M
� 6 � _BOOT_OPTIONS .?AU_BOOT_OPTIONS@@
GT
� �
" Version ��
" Length ���
" Timeout ��
" CurrentBootEntryId ���
" NextBootEntryId ��
HeadlessRedirection ��6 IT _BOOT_OPTIONS .?AU_BOOT_OPTIONS@@ JT � �
�%
� ^ � _PROCESS_LEAP_SECOND_INFORMATION .?AU_PROCESS_LEAP_SECOND_INFORMATION@@ ��
MT
� &
" Flags
" Reserved �^ OT _PROCESS_LEAP_SECOND_INFORMATION .?AU_PROCESS_LEAP_SECOND_INFORMATION@@ �� PT D
49
� 6 � HTOUCHINPUT__ .?AUHTOUCHINPUT__@@
ST
�
t unused ���6 UT HTOUCHINPUT__ .?AUHTOUCHINPUT__@@ VT ~
�S
�
�/
�
�#
�
=
� ^ � _SYSTEM_ACTIVITY_MODERATION_INFO .?AU_SYSTEM_ACTIVITY_MODERATION_INFO@@ ��J
Identifier ���
<C ModerationState ��
�7 AppType ��^ ]T _SYSTEM_ACTIVITY_MODERATION_INFO .?AU_SYSTEM_ACTIVITY_MODERATION_INFO@@ �� ^T � *
{B
�
o
� F � _RTL_HEAP_STACK_QUERY .?AU_RTL_HEAP_STACK_QUERY@@
bT
� " dT
eT
� �
" Version ��
Process ��
fT WriteRoutine �
SerializationContext �
QueryLevel ���
Flags F gT _RTL_HEAP_STACK_QUERY .?AU_RTL_HEAP_STACK_QUERY@@ hT � �
C5
�
�
(J
� f
" NextEntryOffset ��
m ParentFileId �
" FileNameLength ���
FileName �f mT _FILE_LINK_ENTRY_FULL_ID_INFORMATION .?AU_FILE_LINK_ENTRY_FULL_ID_INFORMATION@@ �� nT � �
�,
�
pT
� J � tagINPUT_MESSAGE_SOURCE .?AUtagINPUT_MESSAGE_SOURCE@@ .
[ deviceType ���
�+ originId �J sT tagINPUT_MESSAGE_SOURCE .?AUtagINPUT_MESSAGE_SOURCE@@ tT ~ �= Z � _PLUGPLAY_CONTROL_CONFLICT_DATA .?AU_PLUGPLAY_CONTROL_CONFLICT_DATA@@
vT
�
�E
�
k-
� �
DeviceInstance ���
xT ResourceList �
" ResourceListSize �
yT ConflictBuffer ���
" ConflictBufferSize ���
" Flags
Status ���Z zT _PLUGPLAY_CONTROL_CONFLICT_DATA .?AU_PLUGPLAY_CONTROL_CONFLICT_DATA@@ {T $ �
�G
� Z � _PROCESS_FOREGROUND_BACKGROUND .?AU_PROCESS_FOREGROUND_BACKGROUND@@ ��
Foreground ���Z T _PROCESS_FOREGROUND_BACKGROUND .?AU_PROCESS_FOREGROUND_BACKGROUND@@ �� �T � >
�B
�
4F
�
8
�
\-
�
�!
� X? " " " " �T
�T
�
�
� V � _FILE_FS_CONTROL_INFORMATION .?AU_FILE_FS_CONTROL_INFORMATION@@ ��
�T
� �
� FreeSpaceStartFiltering ��
� FreeSpaceThreshold ���
� FreeSpaceStopFiltering ���
� DefaultQuotaThreshold
� DefaultQuotaLimit
" ( FileSystemControlFlags ���V �T 0 _FILE_FS_CONTROL_INFORMATION .?AU_FILE_FS_CONTROL_INFORMATION@@ �� �T � �
�=
� &
q wcLow
! cGlyphs ��2 �T tagWCRANGE .?AUtagWCRANGE@@ �� �T � �
�>
�
�
�
�
�
?
�
" dwExitCode ���N �T _EXIT_PROCESS_DEBUG_INFO .?AU_EXIT_PROCESS_DEBUG_INFO@@ �� �T � L
�
�
\
� j � _ACTIVATION_CONTEXT_SECTION_KEYED_DATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA@@ ��
�T
� 2
" Size �
" DataFormatVersion
Data �
" Length ���
SectionGlobalData
" SectionGlobalDataLength ��
SectionBase ��
" SectionTotalLength ���
�! ActivationContext
" $ AssemblyRosterIndex ��
" ( Flags
w5 , AssemblyMetadata �j �T @ _ACTIVATION_CONTEXT_SECTION_KEYED_DATA .?AU_ACTIVATION_CONTEXT_SECTION_KEYED_DATA@@ �� �T � �
8
�
�1
�
�
� " �T t �T
�T
�
p
�
K$
�
�
�
�6
�
�6
�
]?
� Z �T
�6
�
$
�
�5
� F � _KEY_NAME_INFORMATION .?AU_KEY_NAME_INFORMATION@@
�T
� *
" NameLength ���
Name �F �T _KEY_NAME_INFORMATION .?AU_KEY_NAME_INFORMATION@@ �T � J � _ETW_CLOCK_TIME_UPDATE .?AU_ETW_CLOCK_TIME_UPDATE@@ ��2
# InterruptTime
" ClockOwner ���J �T _ETW_CLOCK_TIME_UPDATE .?AU_ETW_CLOCK_TIME_UPDATE@@ �� �T b
�;
�
�/
� R � _RTL_TIME_ZONE_INFORMATION .?AU_RTL_TIME_ZONE_INFORMATION@@ ��
�T
� �
Bias �
StandardName �
�7 D StandardStart
T StandardBias �
X DaylightName �
�7 � DaylightStart
� DaylightBias �R �T � _RTL_TIME_ZONE_INFORMATION .?AU_RTL_TIME_ZONE_INFORMATION@@ �� �T � � R N � _RTL_ENCLAVE_LAUNCH_TOKEN .?AU_RTL_ENCLAVE_LAUNCH_TOKEN@@ �
� Measurement ��
� AuthorId �
o @ FamilyId �
o P ImageId ��
# ` EnclaveSize ��
" h EnclaveSvn ���
" l PolicyFlags ��N �T p _RTL_ENCLAVE_LAUNCH_TOKEN .?AU_RTL_ENCLAVE_LAUNCH_TOKEN@@ �T
�R
� N � _PROCESS_LOGGING_INFORMATION .?AT_PROCESS_LOGGING_INFORMATION@@ ��
" ��
" ��
" ��
" ��
" ��
" Flags
�T EnableReadVmLogging ��
�T EnableWriteVmLogging �
�T EnableProcessSuspendResumeLogging
�T EnableThreadSuspendResumeLogging �
�T Reserved �N �T _PROCESS_LOGGING_INFORMATION .?AT_PROCESS_LOGGING_INFORMATION@@ �� �T D Z > � _IMAGE_VXD_HEADER .?AU_IMAGE_VXD_HEADER@@ �
! e32_magic
e32_border ���
e32_worder ���
" e32_level
! e32_cpu ��
!
e32_os ���
" e32_ver ��
" e32_mflags ���
" e32_mpages ���
" e32_startobj �
" e32_eip ��
" e32_stackobj �
" $ e32_esp ��
" ( e32_pagesize �
" , e32_lastpagesize �
" 0 e32_fixupsize
" 4 e32_fixupsum �
" 8 e32_ldrsize ��
" < e32_ldrsum ���
" @ e32_objtab ���
" D e32_objcnt ���
" H e32_objmap ���
" L e32_itermap ��
" P e32_rsrctab ��
" T e32_rsrccnt ��
" X e32_restab ���
" \ e32_enttab ���
" ` e32_dirtab ���
" d e32_dircnt ���
" h e32_fpagetab �
" l e32_frectab ��
" p e32_impmod ���
" t e32_impmodcnt
" x e32_impproc ��
" | e32_pagesum ��
" � e32_datapage �
" � e32_preload ��
" � e32_nrestab ��
" � e32_cbnrestab
" � e32_nressum ��
" � e32_autodata �
" � e32_debuginfo
" � e32_debuglen �
" � e32_instpreload ��
" � e32_instdemand ���
" � e32_heapsize �
p � e32_res3 �
" � e32_winresoff
" � e32_winreslen
! � e32_devid
! � e32_ddkver ���> 3 �T � _IMAGE_VXD_HEADER .?AU_IMAGE_VXD_HEADER@@ �T � | N � _WNF_DELIVERY_DESCRIPTOR .?AU_WNF_DELIVERY_DESCRIPTOR@@ ��
# SubscriptionId ���
T- StateName
" ChangeStamp ��
" StateDataSize
" EventMask
W- TypeId ���
" , StateDataOffset ��N �T 0 _WNF_DELIVERY_DESCRIPTOR .?AU_WNF_DELIVERY_DESCRIPTOR@@ �� �T � 6
+
�
$#
� B � _FILE_FULL_DIR_INFO .?AU_FILE_FULL_DIR_INFO@@
�T
� &
" NextEntryOffset ��
" FileIndex
� CreationTime �
� LastAccessTime ���
� LastWriteTime
� ChangeTime ���
� ( EndOfFile
� 0 AllocationSize ���
" 8 FileAttributes ���
" < FileNameLength ���
" @ EaSize ���
D FileName �B �T H _FILE_FULL_DIR_INFO .?AU_FILE_FULL_DIR_INFO@@ �T n �"
� R
" dwType ���
" dwSize ���
hDevice ��
u wParam ���> �T tagRAWINPUTHEADER .?AUtagRAWINPUTHEADER@@ �T ~ :
<D
� " " � �T
�T
�
a9
� J � _QUERY_SERVICE_CONFIGW .?AU_QUERY_SERVICE_CONFIGW@@ ��
�T
� �
" dwServiceType
" dwStartType ��
" dwErrorControl ���
q lpBinaryPathName �
q lpLoadOrderGroup �
" dwTagId ��
q lpDependencies ���
q lpServiceStartName ���
q lpDisplayName J �T $ _QUERY_SERVICE_CONFIGW .?AU_QUERY_SERVICE_CONFIGW@@ �� �T � ;
O$
�
�5
� *
Offset ���
# Length ���F �T _SCRUB_PARITY_EXTENT .?AU_SCRUB_PARITY_EXTENT@@ �� �T � '
�B
� f
BlendOp ��
BlendFlags ���
SourceConstantAlpha ��
AlphaFormat ��: �T _BLENDFUNCTION .?AU_BLENDFUNCTION@@ �� �T � F
�
�
2
�
J7
�
�9
�
�$
� 6
" PrivilegeCount ���
? Privileges ���> �T _TOKEN_PRIVILEGES .?AU_TOKEN_PRIVILEGES@@ U w � N � _KLDR_DATA_TABLE_ENTRY32 .?AU_KLDR_DATA_TABLE_ENTRY32@@ ��v
InLoadOrderLinks �
" __Undefined1 �
" __Undefined2 �
" __Undefined3 �
" NonPagedDebugInfo
" DllBase ��
" EntryPoint ���
" SizeOfImage ��
�) $ FullDllName ��
�) , BaseDllName ��
" 4 Flags
! 8 LoadCount
! : __Undefined5 �
" < __Undefined6 �
" @ CheckSum �
" D TimeDateStamp N U H _KLDR_DATA_TABLE_ENTRY32 .?AU_KLDR_DATA_TABLE_ENTRY32@@ �� U � a
�C
�
*
� r � _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION .?AU_SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION@@ ��
U
� &
HypervisorSharedUserVa ���r
U _SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION .?AU_SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION@@ �� U � D
�
�
6
� F � _T2_SET_PARAMETERS_V0 .?AU_T2_SET_PARAMETERS_V0@@ F
" Version ��
" Reserved �
NoWakeTolerance ��F U _T2_SET_PARAMETERS_V0 .?AU_T2_SET_PARAMETERS_V0@@ U � � N � _RTL_MODULE_EXTENDED_INFO .?AU_RTL_MODULE_EXTENDED_INFO@@ ^
c# BasicInfo
" ImageSize
! FileNameOffset ���
FullPathName �N U _RTL_MODULE_EXTENDED_INFO .?AU_RTL_MODULE_EXTENDED_INFO@@ U � � f � _SYSTEM_FEATURE_CONFIGURATION_UPDATE .?AU_SYSTEM_FEATURE_CONFIGURATION_UPDATE@@ ��
U
� � " �j
# PreviousChangeStamp ��
N+ ConfigurationType
" UpdateCount ��
U Updates ��f U 0 _SYSTEM_FEATURE_CONFIGURATION_UPDATE .?AU_SYSTEM_FEATURE_CONFIGURATION_UPDATE@@ �� U � j
� B � _PERFINFO_IO_TIMER .?AU_PERFINFO_IO_TIMER@@ ��
U
� 6
DeviceObject �
RoutineAddress ���B U _PERFINFO_IO_TIMER .?AU_PERFINFO_IO_TIMER@@ �� !U b .
x
� Z � _WIM_PROVIDER_ADD_OVERLAY_INPUT .?AU_WIM_PROVIDER_ADD_OVERLAY_INPUT@@ b
" WimType ��
" WimIndex �
" WimFileNameOffset
" WimFileNameLength Z %U _WIM_PROVIDER_ADD_OVERLAY_INPUT .?AU_WIM_PROVIDER_ADD_OVERLAY_INPUT@@ &U � &"
5
�
�
�
�4
� � *U " +U
,U
�
�M
�
`;
� J � _ETW_WNF_EVENT_PUBLISH .?AU_ETW_WNF_EVENT_PUBLISH@@ ��
0U
� B
m Header ���
� StateName
" ( DataLength ���J 2U 0 _ETW_WNF_EVENT_PUBLISH .?AU_ETW_WNF_EVENT_PUBLISH@@ �� 3U b {
,2
�
�M
�
\-
�
�8
�
�+
� v
" Marker ���
! Size �
Reserved �
Version ��
" Header ���
�E Packet ���F :U _MESSAGE_TRACE_HEADER .?AU_MESSAGE_TRACE_HEADER@@ ;U b �
�
� Z � _TOKEN_APPCONTAINER_INFORMATION .?AU_TOKEN_APPCONTAINER_INFORMATION@@
>U
�
TokenAppContainer Z @U _TOKEN_APPCONTAINER_INFORMATION .?AU_TOKEN_APPCONTAINER_INFORMATION@@ AU w !
�C
� Z � _SYSTEM_OBJECTTYPE_INFORMATION .?AU_SYSTEM_OBJECTTYPE_INFORMATION@@ ��
" NextEntryOffset ��
" NumberOfObjects ��
" NumberOfHandles ��
" TypeIndex
" InvalidAttributes
D% GenericMapping ���
" $ ValidAccessMask ��
" ( PoolType �
, SecurityRequired �
- WaitableObject ���
0 TypeName �Z EU 8 _SYSTEM_OBJECTTYPE_INFORMATION .?AU_SYSTEM_OBJECTTYPE_INFORMATION@@ �� FU � "
�S
�
1R
�
T
�
,
� " " � �2 � _TP_DIRECT .?AU_TP_DIRECT@@ ��
MU
� � NU a? OU
PU
� �
� Task �
" Lock �
! IoCompletionInformationList ��
QU Callback �
" $ NumaNode �
( IdealProcessor ���2 RU , _TP_DIRECT .?AU_TP_DIRECT@@ �� SU �
#
� Z � _SYSTEM_PROCESS_TRUST_LABEL_ACE .?AU_SYSTEM_PROCESS_TRUST_LABEL_ACE@@
VU
� :
� Header ���
" Mask �
" SidStart �Z XU _SYSTEM_PROCESS_TRUST_LABEL_ACE .?AU_SYSTEM_PROCESS_TRUST_LABEL_ACE@@ YU w � : � tagICONMETRICSW .?AUtagICONMETRICSW@@
[U
� r
u cbSize ���
t iHorzSpacing �
t iVertSpacing �
t iTitleWrap ���
lfFont ���: ]U l tagICONMETRICSW .?AUtagICONMETRICSW@@ ^U ~ .2
';
�
�E
� : � _CSV_MGMT_LOCK .?AU_CSV_MGMT_LOCK@@ ��
" Flags : cU _CSV_MGMT_LOCK .?AU_CSV_MGMT_LOCK@@ �� dU � ,
�
$
� 6 � _JUMP_BUFFER .?AU_JUMP_BUFFER@@ �� # " @ ��
" Frame
" R4 ���
" R5 ���
" R6 ���
" R7 ���
" R8 ���
" R9 ���
" R10 ��
" R11 ��
" $ Sp ���
" ( Pc ���
" , Fpscr
iU 0 D 6
jU p _JUMP_BUFFER .?AU_JUMP_BUFFER@@ ��. onecore\external\sdk\inc\crt\setjmp.h �� kU lU �
�&
�
?
�
�
� : � _STARTUPINFOEXA .?AU_STARTUPINFOEXA@@
qU
� 6
� StartupInfo ��
e! D lpAttributeList ��: sU H _STARTUPINFOEXA .?AU_STARTUPINFOEXA@@ tU n 1 > � _RTL_HANDLE_TABLE .?AU_RTL_HANDLE_TABLE@@
�&
� �
" MaximumNumberOfHandles ���
" SizeOfHandleTableEntry ���
" UseHeap ��
" TableSize
wU FreeHandles ��
wU CommittedHandles �
wU UnCommittedHandles ���
wU MaxReservedHandles ���> xU _RTL_HANDLE_TABLE .?AU_RTL_HANDLE_TABLE@@ yU � �
�
�
p,
�
=
� N � _RTL_PHYSICAL_MEMORY_INFO .?AU_RTL_PHYSICAL_MEMORY_INFO@@
~U
�
� Policy ���N �U _RTL_PHYSICAL_MEMORY_INFO .?AU_RTL_PHYSICAL_MEMORY_INFO@@ �U
[F
�
�3
� f � _JOBOBJECT_IO_ATTRIBUTION_INFORMATION .?AU_JOBOBJECT_IO_ATTRIBUTION_INFORMATION@@ F
" ControlFlags �
" ReadStats
" ( WriteStats ���f �U H _JOBOBJECT_IO_ATTRIBUTION_INFORMATION .?AU_JOBOBJECT_IO_ATTRIBUTION_INFORMATION@@ �U D �
�D
�
Z4
� b � _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY@@
�U
� �
" BeginAddress �
" EndAddress ���
" ExceptionHandler �
" HandlerData ��
" PrologEndAddress �b �U _IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY .?AU_IMAGE_ALPHA_RUNTIME_FUNCTION_ENTRY@@ �U � +
�1
� > � _KTMOBJECT_CURSOR .?AU_KTMOBJECT_CURSOR@@ B
$ LastQuery
" ObjectIdCount
� ObjectIds > �U $ _KTMOBJECT_CURSOR .?AU_KTMOBJECT_CURSOR@@ �U � � 2 � HRAWINPUT__ .?AUHRAWINPUT__@@
t unused ���2 �U HRAWINPUT__ .?AUHRAWINPUT__@@ �U ~ �9
�E
� J � _WRITE_USN_REASON_INPUT .?AU_WRITE_USN_REASON_INPUT@@ .
" Flags
" UsnReasonToWrite �J �U _WRITE_USN_REASON_INPUT .?AU_WRITE_USN_REASON_INPUT@@ �U � � B � _PS_STD_HANDLE_INFO .?AU_PS_STD_HANDLE_INFO@@
" ��
" ��n
" Flags
�U StdHandleState ���
�U PseudoHandleMask �
" StdHandleSubsystemType ���B �U _PS_STD_HANDLE_INFO .?AU_PS_STD_HANDLE_INFO@@ �U � M > � _QUOTA_LIMITS_EX .?AU_QUOTA_LIMITS_EX@@ ��&
" PagedPoolLimit ���
" NonPagedPoolLimit
" MinimumWorkingSetSize
" MaximumWorkingSetSize
" PagefileLimit
� TimeLimit
" WorkingSetLimit ��
" $ Reserved2
" ( Reserved3
" , Reserved4
" 0 Flags
I< 4 CpuRateLimit �> �U 8 _QUOTA_LIMITS_EX .?AU_QUOTA_LIMITS_EX@@ �� �U D � > � _IMAGE_RELOCATION .?AU_IMAGE_RELOCATION@@ b
" VirtualAddress ���
" RelocCount ���
" SymbolTableIndex �
! Type �> �U
_IMAGE_RELOCATION .?AU_IMAGE_RELOCATION@@ �U � u
�$
� . � in6_addr .?AUin6_addr@@ ��B � _WMI_WAIT_MULTIPLE .?AU_WMI_WAIT_MULTIPLE@@ ��J � _WMI_WAIT_OBJECT_RECORD .?AU_WMI_WAIT_OBJECT_RECORD@@ �U " �Z
" ThreadId �
WaitType �
ObjectCount ��
�U ObjectRecord �B �U _WMI_WAIT_MULTIPLE .?AU_WMI_WAIT_MULTIPLE@@ �� �U b �
+
�
�1
� j � _FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER .?AU_FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER@@ ��
� FileOffset ���
� ByteCount
$ RecallOwnerGuid ��
" RecallMetadataBufferSize �
� $ RecallMetadataBuffer �j �U ( _FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER .?AU_FSCTL_GHOST_FILE_EXTENTS_INPUT_BUFFER@@ �� �U � o* B � _REPARSE_INDEX_KEY .?AU_REPARSE_INDEX_KEY@@ ��
�U
� 2
" FileReparseTag ���
� FileId ���B �U _REPARSE_INDEX_KEY .?AU_REPARSE_INDEX_KEY@@ �� �U � (& B
Status ���
Pointer ��
" Information ��> �U _IO_STATUS_BLOCK .?AU_IO_STATUS_BLOCK@@ �� �U � �
2"
�
�E
� : � _WMI_IRQ_RECORD .?AU_WMI_IRQ_RECORD@@ �
# IRQAffinity ��
! IRQGroup �
!
Reserved �
" IRQNum ���
" DeviceDescriptionLen �
DeviceDescription : �U _WMI_IRQ_RECORD .?AU_WMI_IRQ_RECORD@@ �U b �
�,
� 6 � _GLYPHMETRICS .?AU_GLYPHMETRICS@@
�U
� ~
u gmBlackBoxX ��
u gmBlackBoxY ��
� gmptGlyphOrigin ��
gmCellIncX ���
gmCellIncY ���6 �U _GLYPHMETRICS .?AU_GLYPHMETRICS@@ �U � w
V � _SYSTEM_EXCEPTION_INFORMATION .?AU_SYSTEM_EXCEPTION_INFORMATION@@
�U
� �
" AlignmentFixupCount ��
" ExceptionDispatchCount ���
" FloatingEmulationCount ���
" ByteWordEmulationCount ���V �U _SYSTEM_EXCEPTION_INFORMATION .?AU_SYSTEM_EXCEPTION_INFORMATION@@ �U � �
�1
�
-,
�
�U
�
EE
�
�+ ��
�U
� >
$ Id ���
�: Type �
# MaxVersionTested �Z �U _COMPATIBILITY_CONTEXT_ELEMENT .?AU_COMPATIBILITY_CONTEXT_ELEMENT@@ �� �U � �
[E
�
�7
� N � _ETW_KQUEUE_ENQUEUE_EVENT .?AU_ETW_KQUEUE_ENQUEUE_EVENT@@ &
Entry
" ThreadId �N �U _ETW_KQUEUE_ENQUEUE_EVENT .?AU_ETW_KQUEUE_ENQUEUE_EVENT@@ �U b �
[>
� Z � _KEY_VIRTUALIZATION_INFORMATION .?AU_KEY_VIRTUALIZATION_INFORMATION@@
�U
�
" ��
" ��
" ��
" ��
" ��
" ��
�U VirtualizationCandidate ��
�U VirtualizationEnabled
�U VirtualTarget
�U VirtualStore �
�U VirtualSource
�U Reserved �Z �U _KEY_VIRTUALIZATION_INFORMATION .?AU_KEY_VIRTUALIZATION_INFORMATION@@ �U �
v8
� N � _FILE_FULL_EA_INFORMATION .?AU_FILE_FULL_EA_INFORMATION@@ r
" NextEntryOffset ��
Flags
EaNameLength �
! EaValueLength
EaName ���N �U _FILE_FULL_EA_INFORMATION .?AU_FILE_FULL_EA_INFORMATION@@ �U � �
+A
�
�
�
m8
�
�T ��
�U
� Z � _RTL_PROCESS_BACKTRACES_CONTROL .?AU_RTL_PROCESS_BACKTRACES_CONTROL@@
�U
� f
" ControlCode ��
" ControlSize ��
� ControlData ��
� DatabaseCreate ���Z �U _RTL_PROCESS_BACKTRACES_CONTROL .?AU_RTL_PROCESS_BACKTRACES_CONTROL@@ �U � R � _REPARSE_POINT_INFORMATION .?AU_REPARSE_POINT_INFORMATION@@ ��>
! ReparseDataLength
! UnparsedNameLength ���R �U _REPARSE_POINT_INFORMATION .?AU_REPARSE_POINT_INFORMATION@@ �� �U 7!
�;
� B � tagEMRCREATEPALETTE .?AUtagEMRCREATEPALETTE@@
V
� 2
� emr ��
" ihPal
{; lgpl �B V tagEMRCREATEPALETTE .?AUtagEMRCREATEPALETTE@@ V � F
D
�
�
�
H
� b � _SYSTEM_MEMORY_TOPOLOGY_INFORMATION .?AU_SYSTEM_MEMORY_TOPOLOGY_INFORMATION@@ �. " �^
# NumberOfRuns �
" NumberOfNodes
" NumberOfChannels �
V Run ��b V 0 _SYSTEM_MEMORY_TOPOLOGY_INFORMATION .?AU_SYSTEM_MEMORY_TOPOLOGY_INFORMATION@@
V w V � _CM_DISK_GEOMETRY_DEVICE_DATA .?AU_CM_DISK_GEOMETRY_DEVICE_DATA@@ n
" BytesPerSector ���
" NumberOfCylinders
" SectorsPerTrack ��
" NumberOfHeads V V _CM_DISK_GEOMETRY_DEVICE_DATA .?AU_CM_DISK_GEOMETRY_DEVICE_DATA@@ V 2 N � _SECURITY_SEED_AND_LENGTH .?AU_SECURITY_SEED_AND_LENGTH@@
V
� &
Length ���
Seed �N V _SECURITY_SEED_AND_LENGTH .?AU_SECURITY_SEED_AND_LENGTH@@ V � �
�
�
q
�
V
� V � _IMAGE_RESOURCE_DIR_STRING_U .?AU_IMAGE_RESOURCE_DIR_STRING_U@@ ��.
! Length ���
NameString ���V V _IMAGE_RESOURCE_DIR_STRING_U .?AU_IMAGE_RESOURCE_DIR_STRING_U@@ �� V � l B � _EXCEPTION_RECORD32 .?AU_EXCEPTION_RECORD32@@ " " < �
ExceptionCode
" ExceptionFlags ���
" ExceptionRecord ��
" ExceptionAddress �
" NumberParameters �
V ExceptionInformation �B !V P _EXCEPTION_RECORD32 .?AU_EXCEPTION_RECORD32@@ "V �% X F � _PERFINFO_MARK_EVENT .?AU_PERFINFO_MARK_EVENT@@ ��
$V
� V
" TranId ���
Level
AppId
! OpId �
Text �F &V _PERFINFO_MARK_EVENT .?AU_PERFINFO_MARK_EVENT@@ �� 'V b � J � _FILE_END_OF_FILE_INFO .?AU_FILE_END_OF_FILE_INFO@@ ��
� EndOfFile J *V _FILE_END_OF_FILE_INFO .?AU_FILE_END_OF_FILE_INFO@@ �� +V n �"
t$
�
\G
� : � HGESTUREINFO__ .?AUHGESTUREINFO__@@ ��
/V
�
t unused ���: 1V HGESTUREINFO__ .?AUHGESTUREINFO__@@ �� 2V ~ �<
p
� " 4V 5V
2
�
R
� > � tagMONITORINFOEXW .?AUtagMONITORINFOEXW@@
9V
� f
" cbSize ���
rcMonitor
rcWork ���
" $ dwFlags ��
( szDevice �> ;V h tagMONITORINFOEXW .?AUtagMONITORINFOEXW@@ <V ~ 5
�#
�
C
� j
Revision �
SubAuthorityCount
�, IdentifierAuthority ��
� SubAuthority �& @V _SID .?AU_SID@@ �� AV w V � _ETW_COVERAGE_SAMPLER_SAMPLE .?AU_ETW_COVERAGE_SAMPLER_SAMPLE@@ ��*
" ModuleId �
" Offset ���V DV _ETW_COVERAGE_SAMPLER_SAMPLE .?AU_ETW_COVERAGE_SAMPLER_SAMPLE@@ �� EV @ G
�!
� N � _SYSTEM_WORKINGSET_ENTRY .?AU_SYSTEM_WORKINGSET_ENTRY@@ ��
HV
� �
" UniqueProcessId ��
" SessionId
" WorkingSetPageCount ��
" CommitPageCount ��
" PagedPoolPageCount ���
" VirtualSizeInPages ���
" PrivateWorkingSetPageCount ���N JV _SYSTEM_WORKINGSET_ENTRY .?AU_SYSTEM_WORKINGSET_ENTRY@@ �� KV � � n � _FILE_PROCESS_IDS_USING_FILE_INFORMATION .?AU_FILE_PROCESS_IDS_USING_FILE_INFORMATION@@ ��>
" NumberOfProcessIdsInList �
�# ProcessIdList n NV _FILE_PROCESS_IDS_USING_FILE_INFORMATION .?AU_FILE_PROCESS_IDS_USING_FILE_INFORMATION@@ �� OV � V � _TXFS_CREATE_MINIVERSION_INFO .?AU_TXFS_CREATE_MINIVERSION_INFO@@ j
! StructureVersion �
! StructureLength ��
" BaseVersion ��
! MiniVersion ��V RV _TXFS_CREATE_MINIVERSION_INFO .?AU_TXFS_CREATE_MINIVERSION_INFO@@ SV � B � _SUPPORTED_OS_INFO .?AU_SUPPORTED_OS_INFO@@ ��
UV
� 2
! MajorVersion �
! MinorVersion �B WV _SUPPORTED_OS_INFO .?AU_SUPPORTED_OS_INFO@@ �� XV � �
" Version ��
" Flags
ResourceFileName �
! ResourceReasonId �
" StringCount ��
{ ReasonStrings
SimpleString �J ZV _COUNTED_REASON_CONTEXT .?AU_COUNTED_REASON_CONTEXT@@ [V {
D7
� "
Base �
" Size �> ^V _PORT_DATA_ENTRY .?AU_PORT_DATA_ENTRY@@ �� _V � U � u t t t aV
bV
�
�U
�
�(
�
=
�
�=
� Z � _PERFINFO_SET_POWER_ACTION_RET .?AU_PERFINFO_SET_POWER_ACTION_RET@@ ��*
Trigger ��
Status ���Z iV _PERFINFO_SET_POWER_ACTION_RET .?AU_PERFINFO_SET_POWER_ACTION_RET@@ �� jV b O
$
� V � _EVENT_EXTENDED_ITEM_INSTANCE .?AU_EVENT_EXTENDED_ITEM_INSTANCE@@ N
" InstanceId ���
" ParentInstanceId �
$ ParentGuid ���V nV _EVENT_EXTENDED_ITEM_INSTANCE .?AU_EVENT_EXTENDED_ITEM_INSTANCE@@ oV U Z ^ � _SYSTEM_MANUFACTURING_INFORMATION .?AU_SYSTEM_MANUFACTURING_INFORMATION@@ .
" Options ��
ProfileName ��^ rV _SYSTEM_MANUFACTURING_INFORMATION .?AU_SYSTEM_MANUFACTURING_INFORMATION@@ sV � ~
�
�
�
� J
# Alignment
[ Next �
! Depth
! Reserved �. wV _SLIST_HEADER .?AT_SLIST_HEADER@@ xV g �
�
�
zV
�
=%
� Z � _PROCESS_MITIGATION_DEP_POLICY .?AU_PROCESS_MITIGATION_DEP_POLICY@@ ��
}V
�
" ��
" ��
" ��v
" Flags
V Enable ���
�V DisableAtlThunkEmulation �
�V ReservedFlags
Permanent Z �V _PROCESS_MITIGATION_DEP_POLICY .?AU_PROCESS_MITIGATION_DEP_POLICY@@ �� �V D L
�5
�
�@
�
@A
�
�
� b � _STREAMS_ASSOCIATE_ID_INPUT_BUFFER .?AU_STREAMS_ASSOCIATE_ID_INPUT_BUFFER@@ ��&
" Flags
" StreamId �b �V _STREAMS_ASSOCIATE_ID_INPUT_BUFFER .?AU_STREAMS_ASSOCIATE_ID_INPUT_BUFFER@@ �� �V � � Z � _EVENT_EXTENDED_ITEM_EVENT_KEY .?AU_EVENT_EXTENDED_ITEM_EVENT_KEY@@ ��
# Key ��Z �V _EVENT_EXTENDED_ITEM_EVENT_KEY .?AU_EVENT_EXTENDED_ITEM_EVENT_KEY@@ �� �V U ~
�Q
�
9
�
�
� �
� � �
�
� R � _PERFINFO_MARK_INFORMATION .?AU_PERFINFO_MARK_INFORMATION@@ ��
k Name �R �V _PERFINFO_MARK_INFORMATION .?AU_PERFINFO_MARK_INFORMATION@@ �� �V b J
�
� F � tagHARDWAREHOOKSTRUCT .?AUtagHARDWAREHOOKSTRUCT@@
�V
� N
� hwnd �
u message ��
u wParam ���
lParam ���F �V tagHARDWAREHOOKSTRUCT .?AUtagHARDWAREHOOKSTRUCT@@ �V ~ � R � _WIM_PROVIDER_EXTERNAL_INFO .?AU_WIM_PROVIDER_EXTERNAL_INFO@@
�V
� V
" Version ��
" Flags
� DataSourceId �
� ResourceHash �R �V ( _WIM_PROVIDER_EXTERNAL_INFO .?AU_WIM_PROVIDER_EXTERNAL_INFO@@ �V � " �
hFile
lpBaseOfDll ��
" dwDebugInfoFileOffset
" nDebugInfoSize ���
lpImageName ��
! fUnicode �F �V _LOAD_DLL_DEBUG_INFO .?AU_LOAD_DLL_DEBUG_INFO@@ �� �V � P f � _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH .?AU_ETW_TP_EVENT_WORKER_NUMANODE_SWITCH@@ ��
�V
� �
m Header ���
PoolId ���
" $ CurrentNode ��
" ( NextNode �
! , CurrentGroup �
! . NextGroup
" 0 CurrentWorkerCount ���
" 4 NextWorkerCount ��f �V 8 _ETW_TP_EVENT_WORKER_NUMANODE_SWITCH .?AU_ETW_TP_EVENT_WORKER_NUMANODE_SWITCH@@ �� �V b
�5
� �
" Size �
O@ CallerType ���
" ProcessImageNameOffset ���
" ProcessId
" ServiceTag ���
" DeviceDescriptionOffset ��
" DevicePathOffset �
" ReasonOffset �B �V _DIAGNOSTIC_BUFFER .?AU_DIAGNOSTIC_BUFFER@@ �� �V { � B � _TOKEN_LINKED_TOKEN .?AU_TOKEN_LINKED_TOKEN@@
LinkedToken ��B �V _TOKEN_LINKED_TOKEN .?AU_TOKEN_LINKED_TOKEN@@ �V w �
�F
�
>
�
�'
� " " p t �V
�V
� " � �T t �V
�V
�
�S
�
�R
�
�
� H H �V V � _PS_BNO_ISOLATION_PARAMETERS .?AU_PS_BNO_ISOLATION_PARAMETERS@@ ��
�V
� f
IsolationPrefix ��
" HandleCount ��
T Handles ��
IsolationEnabled �V �V _PS_BNO_ISOLATION_PARAMETERS .?AU_PS_BNO_ISOLATION_PARAMETERS@@ �� �V � �
"
� " t �V
�V
�
�-
� �
�V
�
�3
�
# ��
# 0 ��
# 9��F
�V DontUse ��
�V PageDirectoryBase
�V Reserved �F �V _PAGEDIR_INFORMATION .?AU_PAGEDIR_INFORMATION@@ �� �V w
i
�
�
$
� �V " o �V �V
�V
�
�,
�
" ��
�V
� ! t/ f � _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE@@ " �6
" SubscriptionCount
�V Subscriptions f �V _RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE .?AU_RTL_FEATURE_USAGE_SUBSCRIPTION_TABLE@@ �V � f � _SYSTEM_PROCESS_INFORMATION_EXTENSION .?AU_SYSTEM_PROCESS_INFORMATION_EXTENSION@@
" ��
" ��
" ��
" ��
� DiskCounters �
# ( ContextSwitches ��
" 0 Flags
�V 0 HasStrongId ��
�V 0 Classification ���
�V 0 BackgroundActivityModerated ��
�V 0 Spare
" 4 UserSidOffset
" 8 PackageFullNameOffset
o( @ EnergyValues �
" PAppIdOffset ��
" TSharedCommitCharge ���
" XJobObjectId ��
" \SpareUlong ���
# `ProcessSequenceNumber f �V h_SYSTEM_PROCESS_INFORMATION_EXTENSION .?AU_SYSTEM_PROCESS_INFORMATION_EXTENSION@@ �V � * Z � _PERFINFO_SAMPLED_PROFILE_CACHE .?AU_PERFINFO_SAMPLED_PROFILE_CACHE@@ Y* " � �*
" Entries ��
�V Sample ���Z �V � _PERFINFO_SAMPLED_PROFILE_CACHE .?AU_PERFINFO_SAMPLED_PROFILE_CACHE@@ �V b � V � _ETW_CRITSEC_EVENT_COLLISION .?AU_ETW_CRITSEC_EVENT_COLLISION@@ ��j
m Header ���
" LockCount
" $ SpinCount
( OwningThread �
, Address ��V �V 0 _ETW_CRITSEC_EVENT_COLLISION .?AU_ETW_CRITSEC_EVENT_COLLISION@@ �� �V b �
m!
� � � �V
B/
�
k �V N � _SERVICE_FAILURE_ACTIONSW .?AU_SERVICE_FAILURE_ACTIONSW@@
�V
� r
" dwResetPeriod
q lpRebootMsg ��
q lpCommand
" cActions �
j lpsaActions ��N W _SERVICE_FAILURE_ACTIONSW .?AU_SERVICE_FAILURE_ACTIONSW@@ W � $ b � _RTL_DYNAMIC_TIME_ZONE_INFORMATION .?AU_RTL_DYNAMIC_TIME_ZONE_INFORMATION@@ ��
W
� V
�T tzi ��
�$ � TimeZoneKeyName ��
�DynamicDaylightTimeDisabled ��b W �_RTL_DYNAMIC_TIME_ZONE_INFORMATION .?AU_RTL_DYNAMIC_TIME_ZONE_INFORMATION@@ �� W �
:<
� b � _RTL_IMAGE_MITIGATION_SEHOP_POLICY .?AU_RTL_IMAGE_MITIGATION_SEHOP_POLICY@@ ��
� Sehop b
W _RTL_IMAGE_MITIGATION_SEHOP_POLICY .?AU_RTL_IMAGE_MITIGATION_SEHOP_POLICY@@ �� W
F/ ��
W
�
W
� 6
! MethodCount ��
W MethodProperties �^ W _MIDL_INTERFACE_METHOD_PROPERTIES .?AU_MIDL_INTERFACE_METHOD_PROPERTIES@@ W � g Z � _EXTENT_READ_CACHE_INFO_BUFFER .?AU_EXTENT_READ_CACHE_INFO_BUFFER@@ ��R
� AllocatedCache ���
� PopulatedCache ���
� InErrorCache �Z W _EXTENT_READ_CACHE_INFO_BUFFER .?AU_EXTENT_READ_CACHE_INFO_BUFFER@@ �� W � �)
<
� k q W F � _PERFINFO_DEBUG_EVENT .?AU_PERFINFO_DEBUG_EVENT@@ >
" ProcessId
" ThreadId �
� Reason ���F W _PERFINFO_DEBUG_EVENT .?AU_PERFINFO_DEBUG_EVENT@@ W b
�=
� : � _SL_KMEM_CACHE .?AU_SL_KMEM_CACHE@@ ��
W
� �G " �
" TotalSize
" SizeOfData ���
" SignatureSize
" Flags
" Version ��
!W Descriptors ��: "W ( _SL_KMEM_CACHE .?AU_SL_KMEM_CACHE@@ �� #W � u
�/
�
�@
�
�S ��
'W
�
<E
� �"
�
� J � _POWER_SESSION_CONNECT .?AU_POWER_SESSION_CONNECT@@ ��
,W
� *
Connected
Console ��J .W _POWER_SESSION_CONNECT .?AU_POWER_SESSION_CONNECT@@ �� /W { � r � _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER .?AU_RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER@@ n
! Version ��
! PointerSize ��
" Heap �
" TotalCommit ��
" TotalReserve �r 2W _RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER .?AU_RTLP_HEAP_STACK_TRACE_SERIALIZATION_HEADER@@ 3W � q ^ � _SYSTEM_LEGACY_DRIVER_INFORMATION .?AU_SYSTEM_LEGACY_DRIVER_INFORMATION@@
5W
� *
" VetoType �
VetoList �^ 7W _SYSTEM_LEGACY_DRIVER_INFORMATION .?AU_SYSTEM_LEGACY_DRIVER_INFORMATION@@ 8W � �
�@
�
<-
� ^ � _PROCESS_DEVICEMAP_INFORMATION_EX .?AU_PROCESS_DEVICEMAP_INFORMATION_EX@@ 2
P Set ��
P Query
" $ Flags ^ =W ( _PROCESS_DEVICEMAP_INFORMATION_EX .?AU_PROCESS_DEVICEMAP_INFORMATION_EX@@ >W D #
N
� F � _EVENT_TRACE_LOGFILEW .?AU_EVENT_TRACE_LOGFILEW@@
AW
�
BW " CW
DW
�
'. ��
FW
�
�V
�
@/
�
�F
� b � _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER .?AU_FILE_QUERY_ON_DISK_VOL_INFO_BUFFER@@ q " D �B
� DirectoryCount ���
� FileCount
! FsFormatMajVersion ���
! FsFormatMinVersion ���
� FsFormatName �
� 0 FormatTime ���
� 8 LastUpdateTime ���
LW @ CopyrightInfo
LW � AbstractInfo �
LW � FormattingImplementationInfo �
LW LastModifyingImplementationInfo ��b MW P_FILE_QUERY_ON_DISK_VOL_INFO_BUFFER .?AU_FILE_QUERY_ON_DISK_VOL_INFO_BUFFER@@ NW � >
�8
�
$6
�
�1
� J � tagLAYERPLANEDESCRIPTOR .?AUtagLAYERPLANEDESCRIPTOR@@ .
! nSize
! nVersion �
" dwFlags ��
iPixelType ���
cColorBits ���
cRedBits �
cRedShift
cGreenBits ���
cGreenShift ��
cBlueBits
cBlueShift ���
cAlphaBits ���
cAlphaShift ��
cAccumBits ���
cAccumRedBits
cAccumGreenBits ��
cAccumBlueBits ���
cAccumAlphaBits ��
cDepthBits ���
cStencilBits �
cAuxBuffers ��
iLayerPlane ��
bReserved
" crTransparent J TW tagLAYERPLANEDESCRIPTOR .?AUtagLAYERPLANEDESCRIPTOR@@ UW � j �R
�1 ��
XW
� � �R YW t t ZW
[W
� : � IRpcStubBuffer .?AUIRpcStubBuffer@@ ��6 � _IMAGE_SYMBOL .?AU_IMAGE_SYMBOL@@ ~
�Q N
" Value
SectionNumber
! Type �
StorageClass �
NumberOfAuxSymbols ���6 _W _IMAGE_SYMBOL .?AU_IMAGE_SYMBOL@@ `W � e
��
bW
�
��
dW
� cW eW " t fW
gW
�
�B
� V
Buffer ���
StaticBuffer �
" Size �
" StaticSize ���2 jW _RTL_BUFFER .?AU_RTL_BUFFER@@ kW �B r
6'
�
B
� N � _FILE_STORAGE_TIER_REGION .?AU_FILE_STORAGE_TIER_REGION@@
oW
� >
$ TierId ���
# Offset ���
# Length ���N qW _FILE_STORAGE_TIER_REGION .?AU_FILE_STORAGE_TIER_REGION@@ rW � � # tW
vW
d7
�
i0
�
+>
� V � _SECTION_IMAGE_INFORMATION64 .?AU_SECTION_IMAGE_INFORMATION64@@ ��
��
��
��n
# TransferAddress ��
" ZeroBits �
# MaximumStackSize �
# CommittedStackSize ���
" SubSystemType
! $ SubSystemMinorVersion
! & SubSystemMajorVersion
" $ SubSystemVersion �
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
" ( OperatingSystemVersion ���
! , ImageCharacteristics �
! . DllCharacteristics ���
! 0 Machine ��
2 ImageContainsCode
3 ImageFlags ���
|W 3 ComPlus ��
}W 3 ImageDynamicallyRelocated
~W 3 Reserved �
" 4 LoaderFlags ��
" 8 ImageFileSize
" < CheckSum �V W @ _SECTION_IMAGE_INFORMATION64 .?AU_SECTION_IMAGE_INFORMATION64@@ �� �W w �
�(
�
�E
� : � _TOKEN_CONTROL .?AU_TOKEN_CONTROL@@ ��
�W
� b
� TokenId ��
� AuthenticationId �
� ModifiedId ���
�6 TokenSource ��: �W ( _TOKEN_CONTROL .?AU_TOKEN_CONTROL@@ �� �W w R � _SYSTEM_POWER_LOGGING_ENTRY .?AU_SYSTEM_POWER_LOGGING_ENTRY@@ *
" Reason ���
" States ���R �W _SYSTEM_POWER_LOGGING_ENTRY .?AU_SYSTEM_POWER_LOGGING_ENTRY@@ �W { y
�9
�
8
�
U
�
�)
�
�C
�
!
�
� �< � �W t �W
�W
� B � tagUSAGE_PROPERTIES .?AUtagUSAGE_PROPERTIES@@ �
! level
! page �
! usage
t logicalMinimum ���
t logicalMaximum ���
! unit �
! exponent �
count
t physicalMinimum ��
t physicalMaximum ��B
�W tagUSAGE_PROPERTIES .?AUtagUSAGE_PROPERTIES@@ �W ~ ;
,'
�
�<
�
X#
�
O
�
%"
�
�.
� j � _CLAIM_SECURITY_ATTRIBUTES_INFORMATION .?AU_CLAIM_SECURITY_ATTRIBUTES_INFORMATION@@ ��Z
! Version ��
! Reserved �
" AttributeCount ���
AQ Attribute j �W _CLAIM_SECURITY_ATTRIBUTES_INFORMATION .?AU_CLAIM_SECURITY_ATTRIBUTES_INFORMATION@@ �� �W w
, ( �W
rC
�
1
�
�;
�
�"
�
qV
�
�/
� Z � _IMAGE_BOUND_IMPORT_DESCRIPTOR .?AU_IMAGE_BOUND_IMPORT_DESCRIPTOR@@ ��
�W
� ^
" TimeDateStamp
! OffsetModuleName �
! NumberOfModuleForwarderRefs ��Z �W _IMAGE_BOUND_IMPORT_DESCRIPTOR .?AU_IMAGE_BOUND_IMPORT_DESCRIPTOR@@ �� �W � � V � _ENCLAVE_LOAD_DATA_VBS_BASIC .?AU_ENCLAVE_LOAD_DATA_VBS_BASIC@@ ��
�W
�
" PageType �V �W _ENCLAVE_LOAD_DATA_VBS_BASIC .?AU_ENCLAVE_LOAD_DATA_VBS_BASIC@@ �� �W � �
L5
� .
" ImageBase
� FunctionEntry R �W _UNWIND_HISTORY_TABLE_ENTRY .?AU_UNWIND_HISTORY_TABLE_ENTRY@@ �W �& � Z � _FILE_PROVIDER_EXTERNAL_INFO_V0 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V0@@
�W
� *
" Version ��
" Algorithm Z �W _FILE_PROVIDER_EXTERNAL_INFO_V0 .?AU_FILE_PROVIDER_EXTERNAL_INFO_V0@@ �W � x" ^ � _FILE_DISPOSITION_INFORMATION_EX .?AU_FILE_DISPOSITION_INFORMATION_EX@@ ��
�W
�
" Flags ^ �W _FILE_DISPOSITION_INFORMATION_EX .?AU_FILE_DISPOSITION_INFORMATION_EX@@ �� �W � �
1W
� J � _FILE_QUOTA_INFORMATION .?AU_FILE_QUOTA_INFORMATION@@ �
" NextEntryOffset ��
" SidLength
� ChangeTime ���
� QuotaUsed
� QuotaThreshold ���
� QuotaLimit ���
P ( Sid ��J �W 8 _FILE_QUOTA_INFORMATION .?AU_FILE_QUOTA_INFORMATION@@ �W � � N � _PERFINFO_CC_FLUSH_CACHE .?AU_PERFINFO_CC_FLUSH_CACHE@@ ��
" WorkItemKey ��
" FileObjectKey
# Offset ���
" Length ���
" SharedCacheMapFlags ��
" Flags
" Reserved �N �W _PERFINFO_CC_FLUSH_CACHE .?AU_PERFINFO_CC_FLUSH_CACHE@@ �� �W b �
�$
� � �C
�*
�
�=
�
{0
� � JOB_OBJECT_NET_RATE_CONTROL_ENABLE ��� JOB_OBJECT_NET_RATE_CONTROL_MAX_BANDWIDTH JOB_OBJECT_NET_RATE_CONTROL_DSCP_TAG � JOB_OBJECT_NET_RATE_CONTROL_VALID_FLAGS ��Z t �W JOB_OBJECT_NET_RATE_CONTROL_FLAGS .?AW4JOB_OBJECT_NET_RATE_CONTROL_FLAGS@@ � �W D )
�
� .
" VirtualAddress ���
" Size �F �W _IMAGE_DATA_DIRECTORY .?AU_IMAGE_DATA_DIRECTORY@@ �W �
�
�
^R
� B � _WOF_EXTERNAL_INFO .?AU_WOF_EXTERNAL_INFO@@ ��*
" Version ��
" Provider �B �W _WOF_EXTERNAL_INFO .?AU_WOF_EXTERNAL_INFO@@ �� �W � �!
S;
�
�
�
�F
� � � � �W
�;
� q " t �W
�W
� f � _SYSTEM_BASIC_PERFORMANCE_INFORMATION .?AU_SYSTEM_BASIC_PERFORMANCE_INFORMATION@@
�W
� n
" AvailablePages ���
" CommittedPages ���
" CommitLimit ��
" PeakCommitment ���f �W _SYSTEM_BASIC_PERFORMANCE_INFORMATION .?AU_SYSTEM_BASIC_PERFORMANCE_INFORMATION@@ �W � �
+
�
�.
�
H6
�
qG
�
G
�
�U ��
�W
�
�=
� " " �W
�W
�
�?
�
Y)
�
$
� Z � DISPLAYCONFIG_TARGET_BASE_TYPE .?AUDISPLAYCONFIG_TARGET_BASE_TYPE@@ ��6
� header ���
�$ baseOutputTechnology �Z �W DISPLAYCONFIG_TARGET_BASE_TYPE .?AUDISPLAYCONFIG_TARGET_BASE_TYPE@@ �� �W � ( �
X
�
!
�
A;
� �M
�@ ��
X
�
�
�
�6
� V � _TRACE_ENABLE_FLAG_EXT_HEADER .?AU_TRACE_ENABLE_FLAG_EXT_HEADER@@ &
! Length ���
! Items V
X _TRACE_ENABLE_FLAG_EXT_HEADER .?AU_TRACE_ENABLE_FLAG_EXT_HEADER@@ X b
g+
�
X
KB
� Z � WIN32_MEMORY_REGION_INFORMATION .?AUWIN32_MEMORY_REGION_INFORMATION@@
" ��
" ��
" ��
" ��
" ��
" ��
" ��&
AllocationBase ���
" AllocationProtect
" Flags
X Private ��
X MappedDataFile ���
X MappedImage ��
X MappedPageFile ���
X MappedPhysical ���
X DirectMapped �
X Reserved �
" RegionSize ���
" CommitSize ���Z X WIN32_MEMORY_REGION_INFORMATION .?AUWIN32_MEMORY_REGION_INFORMATION@@ X � �
k)
�
a-
�
*
� B � tagAUDIODESCRIPTION .?AUtagAUDIODESCRIPTION@@ >
u cbSize ���
t Enabled ��
" Locale ���B X tagAUDIODESCRIPTION .?AUtagAUDIODESCRIPTION@@ !X ~ q4 J � _MESSAGE_RESOURCE_DATA .?AU_MESSAGE_RESOURCE_DATA@@ �� � " �2
" NumberOfBlocks ���
$X Blocks ���J %X _MESSAGE_RESOURCE_DATA .?AU_MESSAGE_RESOURCE_DATA@@ �� &X g �
�W
�
�?
�
� R � _FILE_ZERO_DATA_INFORMATION .?AU_FILE_ZERO_DATA_INFORMATION@@ 6
� FileOffset ���
� BeyondFinalZero ��R ,X _FILE_ZERO_DATA_INFORMATION .?AU_FILE_ZERO_DATA_INFORMATION@@ -X � �
�
�
,
�
�
�S
�
bB
�
�4
�
A
�
�
�6
�
�G
�
YB
�
?
�
�V
�
�
V ��
=X
�
�B
�
n8
�
'
�
DW
� �
q LogFileName ��
q LoggerName ���
CurrentTime ��
" BuffersRead ��
" LogFileMode ��
" ProcessTraceMode �
�< CurrentEvent �
�9 p LogfileHeader
BX �BufferCallback ���
" �BufferSize ���
" �Filled ���
" �EventsLost ���
�< �EventCallback
�< �EventRecordCallback ��
" �IsKernelTrace
�Context ��F CX �_EVENT_TRACE_LOGFILEW .?AU_EVENT_TRACE_LOGFILEW@@ DX � k
�U
�
�;
�
t'
�
� � � _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION@@ ��
JX
�
�3
�
�D
� 2
LX Attributes ���
MX Operations ��� NX _TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION .?AU_TOKEN_SECURITY_ATTRIBUTES_AND_OPERATION_INFORMATION@@ �� OX � 6 J � _VCN_RANGE_INPUT_BUFFER .?AU_VCN_RANGE_INPUT_BUFFER@@
QX
� 2
� StartingVcn ��
� ClusterCount �J SX _VCN_RANGE_INPUT_BUFFER .?AU_VCN_RANGE_INPUT_BUFFER@@ TX � �) �=
� V � _SYSTEM_LOOKASIDE_INFORMATION .?AU_SYSTEM_LOOKASIDE_INFORMATION@@
XX
� �
! CurrentDepth �
! MaximumDepth �
" TotalAllocates ���
" AllocateMisses ���
" TotalFrees ���
" FreeMisses ���
" Type �
" Tag ��
" Size �V ZX _SYSTEM_LOOKASIDE_INFORMATION .?AU_SYSTEM_LOOKASIDE_INFORMATION@@ [X � �
$U
�
*
�
A#
�
),
�
�&
�
"9
� N
# StartingFileReferenceNumber ��
# EndingFileReferenceNumber F cX _FILE_REFERENCE_RANGE .?AU_FILE_REFERENCE_RANGE@@ dX � �
t unused ���2 fX HINSTANCE__ .?AUHINSTANCE__@@ gX �' �
`>
� � � � jX 2 � value_entW .?AUvalue_entW@@ ��
lX
� ^
q ve_valuename �
" ve_valuelen ��
" ve_valueptr ��
" ve_type ��2 nX value_entW .?AUvalue_entW@@ �� oX � �
3
� N � _PERFINFO_VAD_ROTATE_INFO .?AU_PERFINFO_VAD_ROTATE_INFO@@
rX
�
" ��
" ��f
BaseAddress ��
" SizeInBytes ��
tX Direction
uX Spare
" Flags N vX _PERFINFO_VAD_ROTATE_INFO .?AU_PERFINFO_VAD_ROTATE_INFO@@ wX b e
�.
�
p,
�
�-
�
�S
�
i*
�
Y.
�
{4
�
?$
�
�0
�
t
� N � _OPERATION_END_PARAMETERS .?AU_OPERATION_END_PARAMETERS@@
�X
� >
" Version ��
" OperationId ��
" Flags N �X _OPERATION_END_PARAMETERS .?AU_OPERATION_END_PARAMETERS@@ �X n � \ \ �X
P<
�
�@
�
T
�
FD
�
G
�
�6
� q " ��
u TotalSize
! NumLanguages �
! MaxNumLanguages ��
bUseUseMachineConfigList �
G RegInfo ��
�X Languages
# ullMask ��
u uConsoleFlag �
�X $ Checksum �6 �X 8 _MUILANGLIST .?AU_MUILANGLIST@@ �� �X h
1
�
XG
�
@
�
�
�
j
�
?
�
�1
�
# ��
# ��
# ��
# ��
# 0 ��
# 9��
# <��
�X UseDescription ���
�X ListDescription ��
�X Cold �
�X Pinned ���
�X DontUse ��
�X Priority �
�X Reserved �N �X _MEMORY_FRAME_INFORMATION .?AU_MEMORY_FRAME_INFORMATION@@ �X w
� ��
�X
�
F/
�
�F
�
>
�
#
�
vU
�
s;
� : " �X
�
�
X
� ^ � _ETW_ANTI_STARVATION_BOOST_EVENT .?AU_ETW_ANTI_STARVATION_BOOST_EVENT@@ ��^
" ThreadId �
! ProcessorIndex ���
p OldPriority ��
SpareByte ^ �X _ETW_ANTI_STARVATION_BOOST_EVENT .?AU_ETW_ANTI_STARVATION_BOOST_EVENT@@ �� �X b �
�
�
C&
�
sM
�
�
�
9
�
_,
�
�U
�
�2
� V � _ENLISTMENT_BASIC_INFORMATION .?AU_ENLISTMENT_BASIC_INFORMATION@@
�X
� N
$ EnlistmentId �
$ TransactionId
$ ResourceManagerId V �X 0 _ENLISTMENT_BASIC_INFORMATION .?AU_ENLISTMENT_BASIC_INFORMATION@@ �X � U J � _CSV_IS_OWNED_BY_CSVFS .?AU_CSV_IS_OWNED_BY_CSVFS@@ ��
OwnedByCSVFS �J �X _CSV_IS_OWNED_BY_CSVFS .?AU_CSV_IS_OWNED_BY_CSVFS@@ �� �X � / J
" UniqueProcessId ��
" SessionId
" WorkingSetPageCount ��
" CommitPageCount ��
" PagedPoolPageCount ���
" VirtualSizeInPages ���
" PrivateWorkingSetPageCount ���
" StoreSizeInPages �
" StoredPageCount ��
" CommitDebtInPages
" SharedCommitInPages ��R �X $ _PERFINFO_WORKINGSET_ENTRY .?AU_PERFINFO_WORKINGSET_ENTRY@@ �� �X b � & @ ! ! # �X
�G
�
�
�
�8
� " �X
�X
� v � _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX@@ ���
� IdleTime �
� KernelTime ���
� UserTime �
� DpcTime ��
� InterruptTime
" ( InterruptCount ���
" , Spare0 ���
� 0 AvailableTime
� 8 Spare1 ���
� @ Spare2 ���v
�X H _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX .?AU_SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX@@ �� �X � �
�%
�
o7
�
�)
� � � �X
].
�
�6
�
�<
� ^ � DISPLAYCONFIG_TARGET_DEVICE_NAME .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME@@ ���
� header ���
�6 flags
�$ outputTechnology �
! edidManufactureId
! edidProductCodeId
u connectorInstance
$ monitorFriendlyDeviceName
�$ � monitorDevicePath ^ �X �DISPLAYCONFIG_TARGET_DEVICE_NAME .?AUDISPLAYCONFIG_TARGET_DEVICE_NAME@@ �� �X � " " �X
�X
�
F
� " # �X
-: ��
�X
�
4.
�
� CurrentByteOffset R �X _FILE_POSITION_INFORMATION .?AU_FILE_POSITION_INFORMATION@@ �� �X � �
P# ��
�X
�
w+
�
�!
�
�2 ��
�X
�
�
�
i:
�
�(
�
�(
�
�:
�
b%
�
�R
�
� �
=
�
�5
�
�>
�
�
�
�0
�
�= ��
Y
�
�+
�
�
�
%&
�
��
Y
�
|E
�
�>
�
5?
�
1>
� F
Y ImportCallbackRoutine
ImportCallbackParameter ��N Y _LDR_IMPORT_CALLBACK_INFO .?AU_LDR_IMPORT_CALLBACK_INFO@@
Y � �
� F � _ALPC_DATA_VIEW_ATTR .?AU_ALPC_DATA_VIEW_ATTR@@ ��R
" Flags
SectionHandle
ViewBase �
" ViewSize �F Y _ALPC_DATA_VIEW_ATTR .?AU_ALPC_DATA_VIEW_ATTR@@ �� Y � �
*
�
�=
� {3
Y
�
y(
�
z0
�
�
�
�
�
�$
�
3
�
�6
�
�S ��
Y
�
7
�
RF
� #Y
$Y
�
4E
�
E
� Z � _PERFINFO_CC_WORKITEM_COMPLETE .?AU_PERFINFO_CC_WORKITEM_COMPLETE@@ ��
" WorkItemKey ��Z )Y _PERFINFO_CC_WORKITEM_COMPLETE .?AU_PERFINFO_CC_WORKITEM_COMPLETE@@ �� *Y b �
_
�
M
�
{W
�
oM
�
D(
�
AW
�
B/
�
,8
�
�2
�
�A
� . � HACCEL__ .?AUHACCEL__@@ ��
6Y
�
t unused ���. 8Y HACCEL__ .?AUHACCEL__@@ �� 9Y s F .
�V " o �V " " " � {
;Y
<Y
� N
! Magic
MajorLinkerVersion ���
MinorLinkerVersion ���
" SizeOfCode ���
" SizeOfInitializedData
" SizeOfUninitializedData ��
" AddressOfEntryPoint ��
" BaseOfCode ���
# ImageBase
" SectionAlignment �
" $ FileAlignment
! ( MajorOperatingSystemVersion ��
! * MinorOperatingSystemVersion ��
! , MajorImageVersion
! . MinorImageVersion
! 0 MajorSubsystemVersion
! 2 MinorSubsystemVersion
" 4 Win32VersionValue
" 8 SizeOfImage ��
" < SizeOfHeaders
" @ CheckSum �
! D Subsystem
! F DllCharacteristics ���
# H SizeOfStackReserve ���
# P SizeOfStackCommit
# X SizeOfHeapReserve
# ` SizeOfHeapCommit �
" h LoaderFlags ��
" l NumberOfRvaAndSizes ��
!1 p DataDirectory N >Y � _IMAGE_OPTIONAL_HEADER64 .?AU_IMAGE_OPTIONAL_HEADER64@@ �� ?Y � G
�D
� N � _RPC_SEC_CONTEXT_KEY_INFO .?AU_RPC_SEC_CONTEXT_KEY_INFO@@ R
" EncryptAlgorithm �
" KeySize ��
" SignatureAlgorithm ���N CY _RPC_SEC_CONTEXT_KEY_INFO .?AU_RPC_SEC_CONTEXT_KEY_INFO@@ DY 3 � � _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ ��&
� DisableExtensionPoints ��� GY _RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY .?AU_RTL_IMAGE_MITIGATION_EXTENSION_POINT_DISABLE_POLICY@@ �� HY Z b � _PERFINFO_CONTIGUOUS_PAGE_GENERATE .?AU_PERFINFO_CONTIGUOUS_PAGE_GENERATE@@ ��.
# ThreadId �
# NumberOfBytes b KY _PERFINFO_CONTIGUOUS_PAGE_GENERATE .?AU_PERFINFO_CONTIGUOUS_PAGE_GENERATE@@ �� LY b
[!
� J � _ETW_CANCEL_TIMER_EVENT .?AU_ETW_CANCEL_TIMER_EVENT@@
" TimerAddress �J PY _ETW_CANCEL_TIMER_EVENT .?AU_ETW_CANCEL_TIMER_EVENT@@ QY b �
�"
� � � TY
*F
�
�8
�
�W
�
SB
�
4?
� J � _RPC_SECURITY_QOS_V2_A .?AU_RPC_SECURITY_QOS_V2_A@@ ��
" Version ��
" Capabilities �
" IdentityTracking �
" ImpersonationType
" AdditionalSecurityInfoType ���
I u J \Y _RPC_SECURITY_QOS_V2_A .?AU_RPC_SECURITY_QOS_V2_A@@ �� ]Y ^
�V
� Z � _WIM_PROVIDER_CONTROL_INTEGRITY .?AU_WIM_PROVIDER_CONTROL_INTEGRITY@@
" ControlCode ��Z aY _WIM_PROVIDER_CONTROL_INTEGRITY .?AU_WIM_PROVIDER_CONTROL_INTEGRITY@@ bY � L"
�
�
�1
�
�/
� �-
t hY
�4
� J � _ATOM_TABLE_INFORMATION .?AU_ATOM_TABLE_INFORMATION@@ ! " �*
" NumberOfAtoms
lY Atoms J mY _ATOM_TABLE_INFORMATION .?AU_ATOM_TABLE_INFORMATION@@ nY �
0 ( pY
Z # rY V � _FILE_STANDARD_INFORMATION_EX .?AU_FILE_STANDARD_INFORMATION_EX@@
tY
� �
� AllocationSize ���
� EndOfFile
" NumberOfLinks
DeletePending
Directory
AlternateStream ��
MetadataAttribute V vY _FILE_STANDARD_INFORMATION_EX .?AU_FILE_STANDARD_INFORMATION_EX@@ wY � �
�!
�
�
�
�$
� f � _SYSTEM_VERIFIER_COUNTERS_INFORMATION .?AU_SYSTEM_VERIFIER_COUNTERS_INFORMATION@@ �
�& Legacy ���
" x RaiseIrqls ���
" | AcquireSpinLocks �
" � SynchronizeExecutions
" � AllocationsWithNoTag �
" � AllocationsFailed
" � AllocationsFailedDeliberately
" � LockedBytes ��
" � PeakLockedBytes ��
" � MappedLockedBytes
" � PeakMappedLockedBytes
" � MappedIoSpaceBytes ���
" � PeakMappedIoSpaceBytes ���
" � PagesForMdlBytes �
" � PeakPagesForMdlBytes �
" � ContiguousMemoryBytes
" � PeakContiguousMemoryBytes
" � ExecutePoolTypes �
" � ExecutePageProtections ���
" � ExecutePageMappings ��
" � ExecuteWriteSections �
" � SectionAlignmentFailures �
" � IATInExecutableSection ���f }Y � _SYSTEM_VERIFIER_COUNTERS_INFORMATION .?AU_SYSTEM_VERIFIER_COUNTERS_INFORMATION@@ ~Y � y
�5
�
�
�
�
�
�
�6
�
�
�
�I
�
�F
�
�D
�
�!
�
3>
� B � APP_LOCAL_DEVICE_ID .?AUAPP_LOCAL_DEVICE_ID@@
� value B �Y APP_LOCAL_DEVICE_ID .?AUAPP_LOCAL_DEVICE_ID@@ �Y s �
�S
�
w2
�
-#
�
Y
�
�$
� & � _DL_EUI48 .?AT_DL_EUI48@@
�Y
�
�U
�
�S
� B � _SYSDBG_TRIAGE_DUMP .?AU_SYSDBG_TRIAGE_DUMP@@
�Y
� �
" Flags
" BugCheckCode �
" BugCheckParam1 ���
" BugCheckParam2 ���
" BugCheckParam3 ���
" BugCheckParam4 ���
" ProcessHandles ���
" ThreadHandles
T Handles ��B �Y $ _SYSDBG_TRIAGE_DUMP .?AU_SYSDBG_TRIAGE_DUMP@@ �Y � *
�3
� $
�Y
�
�0
�
*2
�
�=
�
T/
� Z � _FSCTL_QUERY_REGION_INFO_OUTPUT .?AU_FSCTL_QUERY_REGION_INFO_OUTPUT@@
�Y
� oW " �
" Version ��
" Size �
" Flags
" Reserved �
# Alignment
" TotalNumberOfRegions �
" NumberOfRegionsReturned ��
�Y Regions ��Z �Y @ _FSCTL_QUERY_REGION_INFO_OUTPUT .?AU_FSCTL_QUERY_REGION_INFO_OUTPUT@@ �Y � �B
�
�
P5
� � j � _SYSTEM_FIRMWARE_PARTITION_INFORMATION .?AU_SYSTEM_FIRMWARE_PARTITION_INFORMATION@@ ��
FirmwarePartition j �Y _SYSTEM_FIRMWARE_PARTITION_INFORMATION .?AU_SYSTEM_FIRMWARE_PARTITION_INFORMATION@@ �� �Y � e
* � HRGN__ .?AUHRGN__@@ ��
�Y
�
t unused ���* �Y HRGN__ .?AUHRGN__@@ �� �Y �' �
3B
�
�R
�
�
�S
� t t �Y
�Y
�
�M
� " " " " " j " �Y
�=
�
�(
�
q
�
�=
�
{?
�
\ \ �Y
�'
�
� Data �2 �Y _HV_DETAILS .?AU_HV_DETAILS@@ �Y � 9
eA
� " �Y " � " " �Y
�Y
� Z � _MEMORY_COMBINE_INFORMATION_EX2 .?AU_MEMORY_COMBINE_INFORMATION_EX2@@
�Y
� V
Handle ���
" PagesCombined
" Flags
ProcessHandle Z �Y _MEMORY_COMBINE_INFORMATION_EX2 .?AU_MEMORY_COMBINE_INFORMATION_EX2@@ �Y � �
Active ���V �Y _ETW_COVERAGE_SAMPLER_STATUS .?AU_ETW_COVERAGE_SAMPLER_STATUS@@ �� �Y @ �
,<
�
]=
�
q
� 6 � q q q q " �Y �Y �Y
�Y
�
�I
�
�
� v
� ptlReference �
" nChars ���
" offString
" fOptions �
c rcl ��
" $ offDx 2 �Y ( tagEMRTEXT .?AUtagEMRTEXT@@ �� �Y � G Z � _FILE_FS_ATTRIBUTE_INFORMATION .?AU_FILE_FS_ATTRIBUTE_INFORMATION@@ ��
" FileSystemAttributes �
MaximumComponentNameLength ���
" FileSystemNameLength �
FileSystemName ���Z �Y _FILE_FS_ATTRIBUTE_INFORMATION .?AU_FILE_FS_ATTRIBUTE_INFORMATION@@ �� �Y � �
�
�,
�
��
�Y
�
�W
� " " �Y
�Y
�
]%
�
o9
�
@:
� N � _FILESYSTEM_STATISTICS_EX .?AU_FILESYSTEM_STATISTICS_EX@@ �
! FileSystemType ���
! Version ��
" SizeOfCompleteStructure ��
# UserFileReads
# UserFileReadBytes
# UserDiskReads
# UserFileWrites ���
# ( UserFileWriteBytes ���
# 0 UserDiskWrites ���
# 8 MetaDataReads
# @ MetaDataReadBytes
# H MetaDataDiskReads
# P MetaDataWrites ���
# X MetaDataWriteBytes ���
# ` MetaDataDiskWrites ���N �Y h _FILESYSTEM_STATISTICS_EX .?AU_FILESYSTEM_STATISTICS_EX@@ �Y � �
�7
�
�
�
�? ��
�Y
�
�
�
++
�
#X
�
%-
�
XG
�
�-
�
�5
� Z-
Z
�
�=
�
=
�
p
�
Z
�
k1
�
Z
�
#!
�
_C
� > � _LDR_FAILURE_DATA .?AU_LDR_FAILURE_DATA@@ F
Status ���
ImageName
D AdditionalInfo ���> Z � _LDR_FAILURE_DATA .?AU_LDR_FAILURE_DATA@@
Z � �
n ��
Z
�
gD
� " Z
Z
�
�:
�
==
�
QR
�
�X
�
#0
�
�0
�
/1
�
+
�
04
�
�
�
-:
�
!5
�
t !Z
{M
�
�'
�
�+
�
�
�
hV
� * � HPEN__ .?AUHPEN__@@ ��
(Z
�
t unused ���* *Z HPEN__ .?AUHPEN__@@ �� +Z s ^
�1
�
�B
�
Q*
� t c%
0Z
�
4'
�
�0
� : � _FILE_NAME_INFO .?AU_FILE_NAME_INFO@@
4Z
� 2
" FileNameLength ���
FileName �: 6Z _FILE_NAME_INFO .?AU_FILE_NAME_INFO@@ 7Z n �" > � _PACKEDEVENTINFO .?AU_PACKEDEVENTINFO@@ �� " " �J
" ulSize ���
" ulNumEventsForLogFile
:Z ulOffsets > ;Z _PACKEDEVENTINFO .?AU_PACKEDEVENTINFO@@ �� <Z �& |
t >Z
�4
�
q%
�
�?
�
'.
�
0(
� �
q User �
" UserLength ���
q Domain ���
" DomainLength �
q Password �
" PasswordLength ���
" Flags R EZ _SEC_WINNT_AUTH_IDENTITY_W .?AU_SEC_WINNT_AUTH_IDENTITY_W@@ �� FZ ^ { Z � _RTL_USER_PROCESS_INFORMATION64 .?AU_RTL_USER_PROCESS_INFORMATION64@@ n
" Length ���
Process ��
Thread ���
� ClientId �
{W ( ImageInformation �Z IZ h _RTL_USER_PROCESS_INFORMATION64 .?AU_RTL_USER_PROCESS_INFORMATION64@@ JZ <
2
�
�B
�
�S
�
�A
�
�
�
�4
� f
" GenericRead ��
" GenericWrite �
" GenericExecute ���
" GenericAll ���> RZ _GENERIC_MAPPING .?AU_GENERIC_MAPPING@@ �� SZ w �
(D
�
},
� b
" dwSize ���
" iType
" nCount ���
" nRgnSize �
rcBound ��: WZ _RGNDATAHEADER .?AU_RGNDATAHEADER@@ �� XZ � �
O
� J � _CM_PCCARD_DEVICE_DATA .?AU_CM_PCCARD_DEVICE_DATA@@ ��
Flags
ErrorCode
! Reserved �
" BusData ��
" DeviceId �
" LegacyBaseAddress
o IRQMap ���J \Z _CM_PCCARD_DEVICE_DATA .?AU_CM_PCCARD_DEVICE_DATA@@ �� ]Z ?
!
�
}!
�
IG
�
V
�
I3
� Z � _THREAD_POWER_THROTTLING_STATE .?AU_THREAD_POWER_THROTTLING_STATE@@ ��B
" Version ��
" ControlMask ��
" StateMask Z eZ _THREAD_POWER_THROTTLING_STATE .?AU_THREAD_POWER_THROTTLING_STATE@@ �� fZ � ^
D+
�
�S
�
�+
�
�5
�
V
� � " , �b
! MaximumGroupCount
! ActiveGroupCount �
� Reserved �
mZ GroupInfo B nZ D _GROUP_RELATIONSHIP .?AU_GROUP_RELATIONSHIP@@ oZ � < �?
�
�
�U
�
SA
�
�
�
D
�
vI
�
�2
�
Y
�
�&
�
v/
�
q!
�
�/
�
u!
�
.
� Z � _PROCESS_CYCLE_TIME_INFORMATION .?AU_PROCESS_CYCLE_TIME_INFORMATION@@
�Z
� :
# AccumulatedCycles
# CurrentCycleCount Z �Z _PROCESS_CYCLE_TIME_INFORMATION .?AU_PROCESS_CYCLE_TIME_INFORMATION@@ �Z � �
CF
�
�$
�
MV
�
'
�
�2
�
l-
�
�R
�
�'
�
G
� V � _ENCLAVE_INIT_INFO_VBS_BASIC .?AU_ENCLAVE_INIT_INFO_VBS_BASIC@@ ��
o FamilyId �
o ImageId ��
# EnclaveSize ��
" ( EnclaveSvn ���
" , Reserved �
0 SignatureInfoHandle ��
# 0 Unused ���V �Z 8 _ENCLAVE_INIT_INFO_VBS_BASIC .?AU_ENCLAVE_INIT_INFO_VBS_BASIC@@ �� �Z � �
9#
�
�
�
�
�
�T
�
uD ��
�Z
�
M*
� & � � u% p p u% p u u �Z
�Z
�
�1
�
W
�
@T
�
$>
�
�
� �$
#T
�
9R
�
l
�
K
�
5
� � u " �Z
�Z
�
a=
�
�C
�
9=
� Z � _FILE_STANDARD_LINK_INFORMATION .?AU_FILE_STANDARD_LINK_INFORMATION@@
�Z
� r
" NumberOfAccessibleLinks ��
" TotalNumberOfLinks ���
DeletePending
Directory Z �Z _FILE_STANDARD_LINK_INFORMATION .?AU_FILE_STANDARD_LINK_INFORMATION@@ �Z � �
�S
� f � _PROCESS_SECURITY_DOMAIN_INFORMATION .?AU_PROCESS_SECURITY_DOMAIN_INFORMATION@@ ��
�Z
�
# SecurityDomain ���f �Z _PROCESS_SECURITY_DOMAIN_INFORMATION .?AU_PROCESS_SECURITY_DOMAIN_INFORMATION@@ �� �Z � L
�
�
�9
�
�B
�
)V
�
E
� ( " " �Z
�Z
�
�,
�
�9
�
C<
�
U1
�
_@
�
�
�
B
�
V
�
o ! �Z
1
�
�
�T
�
�$
�
�#
�
?<
�
."
�
@+
�
�=
�
(
�
N7
�
�#
�
�$
� q �Z
[Z
�
�<
�
�
�
!5
�
(6
�
7B
�
E
�
�
�
Q'
�
>
�
�V
� t �Z
�Z
� w> 6 � _WMI_RESOURCE .?AU_WMI_RESOURCE@@ �
# AcquireTime ��
# HoldTime �
# WaitTime �
" MaxRecursionDepth
" ThreadId �
Resource �
" $ Action ���
" ( ContentionDelta ��6 �Z 0 _WMI_RESOURCE .?AU_WMI_RESOURCE@@ �Z b y
q
�
6
�
�U
� .
Object ���
ObjectType ���J �Z _WMI_WAIT_OBJECT_RECORD .?AU_WMI_WAIT_OBJECT_RECORD@@ �Z b �
�7
� " p p " t �Z
�Z
�
C&
� �Z t �Z
�Z
�
Z
�
~1
� " $
V4
�
�,
�
�)
�
m+
�
�*
� " �
-
�
�9
�
9
�
U
�
�$
�
t
�
r:
�
�?
�
*
� [ " [
[
�
U,
�
�
� " [
[
� �) " � �j
! ControlWord ��
! StatusWord ���
TagWord ��
Reserved1
! ErrorOpcode ��
" ErrorOffset ��
! ErrorSelector
! Reserved2
" DataOffset ���
! DataSelector �
! Reserved3
" MxCsr
" MxCsr_Mask ���
[ FloatRegisters ���
[ � XmmRegisters �
� Reserved4 6 [ _XSAVE_FORMAT .?AU_XSAVE_FORMAT@@ [ K �
�*
�
W
�
�
�
# [ �#
�X
�
�$
�
�W
�
h=
�
p "[ � � $[
OY
�
�Z
�
gW
� q u u )[
*[
�
�
�
�.
�
nE
� 2 � _COMMCONFIG .?AU_COMMCONFIG@@ �
" dwSize ���
! wVersion �
! wReserved
) dcb ��
" $ dwProviderSubType
" ( dwProviderOffset �
" , dwProviderSize ���
0 wcProviderData ���2 0[ 4 _COMMCONFIG .?AU_COMMCONFIG@@ 1[ n
;
�
�
�
�. ��
5[
�
<
�
�:
�
b4 ��
9[
�
|Y
�
DC
�
�
�
�F
�
�<
�
�
�
MU
�
�Z
�
�
�
qF
�
�E
�
�4
�
�7
�
�$
�
!
�
/
� b � _SYSTEM_PREFETCH_PATCH_INFORMATION .?AU_SYSTEM_PREFETCH_PATCH_INFORMATION@@ ��"
" PrefetchPatchCount ���b L[ _SYSTEM_PREFETCH_PATCH_INFORMATION .?AU_SYSTEM_PREFETCH_PATCH_INFORMATION@@ �� M[ � �
QV
� N � _OBJECT_TYPE_INFORMATION .?AU_OBJECT_TYPE_INFORMATION@@ ���
TypeName �
" TotalNumberOfObjects �
" TotalNumberOfHandles �
" TotalPagedPoolUsage ��
" TotalNonPagedPoolUsage ���
" TotalNamePoolUsage ���
" TotalHandleTableUsage
" HighWaterNumberOfObjects �
" $ HighWaterNumberOfHandles �
" ( HighWaterPagedPoolUsage ��
" , HighWaterNonPagedPoolUsage ���
" 0 HighWaterNamePoolUsage ���
" 4 HighWaterHandleTableUsage
" 8 InvalidAttributes
D% < GenericMapping ���
" L ValidAccessMask ��
P SecurityRequired �
Q MaintainHandleCount ��
R TypeIndex
p S ReservedByte �
" T PoolType �
" X DefaultPagedPoolCharge ���
" \ DefaultNonPagedPoolCharge N Q[ ` _OBJECT_TYPE_INFORMATION .?AU_OBJECT_TYPE_INFORMATION@@ �� R[ + 8
�
�
�
�9
�
�S
�
�
�
�
�
_
�
n:
�
�2
�
�1
�
9Z
�
_[
r
�
�=
� $
c[
�
�$
�
Z/
�
�"
�
�
�D
�
�G
�
+
� * � in_addr .?AUin_addr@@
K[
�
�C
� MemoryRegionInfo �V t o[ WIN32_MEMORY_INFORMATION_CLASS .?AW4WIN32_MEMORY_INFORMATION_CLASS@@ ��� p[ � |
T
� * � HRSRC__ .?AUHRSRC__@@
t unused ���* t[ HRSRC__ .?AUHRSRC__@@ u[ �' �
6
�
�E
�
�?
�
�<
�
g-
�
�
�
6 ( }[
�%
� " �& �[
�
� 6 � _RTL_RVA_LIST .?AU_RTL_RVA_LIST@@ �
" RvaCount �
" StateBitsPerRva ��
CompressedBuffer �
" CompressedBufferSize �
7" RvaStateBitMap ���
" StateBitValueMap �
ExtensionBuffer ��6 �[ _RTL_RVA_LIST .?AU_RTL_RVA_LIST@@ �[ N
$
�
vC
�
:
�
:@
� * � HKEY__ .?AUHKEY__@@ ��
t unused ���* �[ HKEY__ .?AUHKEY__@@ �� �[ �' �
@E
� " " " �[ V � _ETW_DISKIO_FLUSH_BUFFERS_V2 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V2@@ ��b
" DiskNumber ���
" IrpFlags �
# HighResResponseTime ��
IrpAddr ��V �[ _ETW_DISKIO_FLUSH_BUFFERS_V2 .?AU_ETW_DISKIO_FLUSH_BUFFERS_V2@@ �� �[ b �
n
� b � _EVENT_EXTENDED_ITEM_STACK_TRACE32 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE32@@ ��*
# MatchId ��
� Address ��b �[ _EVENT_EXTENDED_ITEM_STACK_TRACE32 .?AU_EVENT_EXTENDED_ITEM_STACK_TRACE32@@ �� �[ U h
4
�
�F
�
�U
� 6
ResolutionContext
" RootIndexUsed � �[ _ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL .?AU_ASSEMBLY_STORAGE_MAP_RESOLUTION_CALLBACK_DATA_RESOLUTION_SUCCESSFUL@@ �� �[ � �
/
�
�:
�
)
�
�*
�
PU
�
�-
�
B
�
X
�
�%
�
<3
�
� V � _PROCESSOR_POWER_INFORMATION .?AU_PROCESSOR_POWER_INFORMATION@@ ��
" Number ���
" MaxMhz ���
" CurrentMhz ���
" MhzLimit �
" MaxIdleState �
" CurrentIdleState �V �[ _PROCESSOR_POWER_INFORMATION .?AU_PROCESSOR_POWER_INFORMATION@@ �� �[ { �
�
�
b0
�
SW
�
�1
�
V'
�
CS
�
�V
� z � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3@@ J
MaxIops ��
MaxBandwidth �
ReservationIops ��
q VolumeName ���
" BaseIoSize ���
0 ControlFlags �
! $ VolumeNameLength �
( CriticalReservationIops ��
0 ReservationBandwidth �
8 CriticalReservationBandwidth �
@ MaxTimePercent ���
H ReservationTimePercent ���
P CriticalReservationTimePercent ���
X SoftMaxIops ��
` SoftMaxBandwidth �
h SoftMaxTimePercent ���
p LimitExcessNotifyIops
x LimitExcessNotifyBandwidth ���
� LimitExcessNotifyTimePercent �z �[ � JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3 .?AUJOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V3@@ �[ D |
�)
�
�.
�
�1
�
^4
�
LR
�
�
�
lS
�
%
�
l<
�
�&
� �[
�[
�
4>
� J � _RETRIEVAL_POINTER_BASE .?AU_RETRIEVAL_POINTER_BASE@@
�[
�
� FileAreaOffset ���J �[ _RETRIEVAL_POINTER_BASE .?AU_RETRIEVAL_POINTER_BASE@@ �[ � J
�Y
�
#D
�
�M
� " ^ �[
q@
�
k1
�
�
�
�T
�
�A
� " �
\T
� 2
�, Type �
/ PolicyId �
JK u B �[ _IMAGE_POLICY_ENTRY .?AU_IMAGE_POLICY_ENTRY@@ �[ g m&
�>
�
&%
�
U
� ^ � _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR .?AU_RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR@@ .
" BufferSize ���
p Buffer ���^ �[ _RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR .?AU_RPC_C_OPT_COOKIE_AUTH_DESCRIPTOR@@ �[ 3
*
� �[ �[
�[
�
�
�
.0
�
:
�
�@
�
b7
�
�D
�
mV
�
�
�
�U
�
�= ��
�[
�
g'
� � t �[
�[
�
�G
� dT
�
�
b
�
�U
�
c �[
L
�
�(
�
�G
�
"
�
H
�
�<
�
+?
�
!
�
W
�
�%
�
�
� �
! Signature
! Flags
" Size �
! Machine ��
!
Characteristics ��
" TimeDateStamp
" CheckSum �
" SizeOfImage ��
# ImageBase F \ _NON_PAGED_DEBUG_INFO .?AU_NON_PAGED_DEBUG_INFO@@ \ � 6
�X
�
�0
�
)
�
H5
�
(
�
�V
�
?R
�
o@
�
�3
�
%H
�
�%
�
�
�
�'
�
/9
�
�A
�
�:
� ^
! Length ���
! Flags
" ReparseDataSize ��
" ReparseDataOffset . \ _Reparse .?AU_Reparse@@ �� \ � �
d
� " \
\
�
Q*
�
�(
�
�E
�
�$
�
�.
� � " " &\ '\
(\
�
�3
�
�%
�
}
�
�
�
c<
�
HZ
�
Y%
�
�,
�
�
�
Z
�
�?
�
E
�
B>
�
�0
�
�3
� �
$ Id ���
� Name �
� Description ��
# Flags
# ProvisionedCapacity ��
� MediaType
� $Class B 9\ (_FILE_STORAGE_TIER .?AU_FILE_STORAGE_TIER@@ �� :\ � �
�2
�
�S
�
X-
�
s[
�
(Y
� �$
�<
�
�A
�
�)
�
�-
�
�!
� R � DISPLAYCONFIG_ADAPTER_NAME .?AUDISPLAYCONFIG_ADAPTER_NAME@@ ��2
� header ���
�$ adapterDevicePath R H\ DISPLAYCONFIG_ADAPTER_NAME .?AUDISPLAYCONFIG_ADAPTER_NAME@@ �� I\ � "
�/
�
�U
�
�D
�
�[
�
G?
�
V
�
�Y
�
�"
�
?'
�
�
�
N
�
� Z
�4
�
�.
�
<W
� � p ! [\
�"
�
�
�
�T
�
�
�
�4
�
b%
�
�
�
�&
� " t e\
f\
�
N%
�
�<
�
<
� t �6
k\
�
�R
�
�
�
: ��
o\
�
�
�
x'
�
d;
�
M9
�
�6
�
!
�
�*
�
�A
�
R
�
+X
�
�<
� 1 1 |\
�5
�
:!
�
d(
�
0
�
�
�
R.
�
G
� � t t �\
�\
�
�R
�
t �\
�\
�
*F ��
�\
�
�Y
�
�
�
�
�
�4
�
r)
�
CR
� \
�
�
5S
�
d:
�
8
�
�
�
�G
�
�'
� � a? &\ �\
�\
�
PG
� �
�\
�
�
�
};
�
0
�
w
�
�
�
,7
� B � ANON_OBJECT_HEADER .?AUANON_OBJECT_HEADER@@ ��
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
$ ClassID ��
" SizeOfData ���B �\ ANON_OBJECT_HEADER .?AUANON_OBJECT_HEADER@@ �� �\ � �
}S
�
-,
� � q t �\
�\
�
�@
�
<C
� j � JOBOBJECT_NET_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_NET_RATE_CONTROL_INFORMATION@@ ��F
# MaxBandwidth �
�W ControlFlags �
DscpTag ��j �\ JOBOBJECT_NET_RATE_CONTROL_INFORMATION .?AUJOBOBJECT_NET_RATE_CONTROL_INFORMATION@@ �� �\ D <
�0
�
m
�
?R
�
�&
�
\(
�
�
�
P[
� Z
! Length ���
! Flags
" EaSize ���
" EaInformationOffset ��" �\ _Ea .?AU_Ea@@ �\ � �
�$
� � q t �\
�\
�
8E
�
�;
�
n
�
�
�
�(
�
�\
�G
� ) u ) �\
�4
�
�&
�
�
�
�(
�
/
�
x0
�
];
�
S
�
;<
�
MS
�
A
�
#.
�
#
�
�/
�
�
�
�7 ��
�\
�
�<
� � � _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC@@ ��6
" Size �
" Format ���
�! Frame � �\ _RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC .?AU_RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_BASIC@@ �� �\ � y
� ��
�\
�
�1
�
u@
�
�\
�
!$
�
0
�
: ( �\
�D
�
�#
�
%
�
(
�
+
�
�,
�
M:
� " $
�\
� R
u width
u height ���
�* pixelFormat ��
� position �N �\ DISPLAYCONFIG_SOURCE_MODE .?AUDISPLAYCONFIG_SOURCE_MODE@@ �\ � [
xS
�
^W ��
�\
�
�
`-
�
)
�
zI
�
L
�
T
�
�
�
�4
�
e9
�
S$
�
�
�
�7
�
�@
�
�
�
kY
�
fG
�
�W
�
�W ��
]
�
�<
� " �
�&
�
�/
�
//
�
�4
�
�
�
^B
�
h,
�
F
�
-3
�
T
�
�V
�
�
#C
� * � � � � " " " ]
]
�
`Y
�
�
�?
�
,7
�
�/
�
�M
�
�B
�
&
�
�0 ��
*]
�
/&
�
8 ( -]
�'
�
�C
�
$
�
�-
�
(!
� " 4]
5]
�
4 ( 7]
�E
�
\
�
V7
�
�$
�
[Y
�
�7
�
�
{(
�
W-
�
�U
�
w5
�
�1
�
�C
�
�>
� wE
�B
�
�
�
�
qU
�
�%
�
�+
� q t N]
O]
�
�R
�
f>
�
�<
�
4
�
�
�
~T
�
�M
�
)
�
�
�
G'
�
� '1
�
�
�\
�
M-
�
�
� ^ � _SYSTEM_BOOT_GRAPHICS_INFORMATION .?AU_SYSTEM_BOOT_GRAPHICS_INFORMATION@@
a]
� �
� FrameBuffer ��
" Width
" Height ���
" PixelStride ��
" Flags
4 Format ���
" DisplayRotation ��^ c] _SYSTEM_BOOT_GRAPHICS_INFORMATION .?AU_SYSTEM_BOOT_GRAPHICS_INFORMATION@@ d] � e
1
�
<
�
�
�
w;
�
@ j]
�C
�
�'
�
�A
�
�(
�
�I
�
�
O@
�
�*
�
�[
�
�A
�
5/
�
"
�
�W
� �
y]
�
#
�
](
�
�3
�
�6
�
e*
�
�'
�
�D
�
�"
�
A,
�
�C ��
�]
�
�U
�
E
�
�!
�
�
� ^
4@
�
�S
�
0@
�
Q9
�
�T
�
*
�
I,
�
�0
�
�*
�
>7
�
�
�
�
�
wM
�
S
�
V
�
Y
�
v
�
�7
� 2 � HPALETTE__ .?AUHPALETTE__@@ ��
�]
�
t unused ���2 �] HPALETTE__ .?AUHPALETTE__@@ �� �] s ]
CV
� �$ �=
7(
�
lC
� � � �]
�]
�
b
�
F
�
:
�
�%
�
h#
�
GR
�
"
�
�B
� > � _IMAGE_OS2_HEADER .?AU_IMAGE_OS2_HEADER@@
�] ��
�]
� �
! ne_magic �
p ne_ver ���
p ne_rev ���
! ne_enttab
! ne_cbenttab ��
ne_crc ���
! ne_flags �
! ne_autodata ��
! ne_heap ��
! ne_stack �
ne_csip ��
ne_sssp ��
! ne_cseg ��
! ne_cmod ��
! ne_cbnrestab �
! " ne_segtab
! $ ne_rsrctab ���
! & ne_restab
! ( ne_modtab
! * ne_imptab
, ne_nrestab ���
! 0 ne_cmovent ���
! 2 ne_align �
! 4 ne_cres ��
6 ne_exetyp
7 ne_flagsothers ���
! 8 ne_pretthunks
! : ne_psegrefbytes ��
! < ne_swaparea ��
! > ne_expver > �] @ _IMAGE_OS2_HEADER .?AU_IMAGE_OS2_HEADER@@ �] � [ " " q t �]
�]
�
&5
�
y9
�
�
� " �] �]
�]
� Z " Z H Z �]
�]
� � �&
C
�
�B
�
/[
�
>
�
�$
�
O) ��
�]
�
�7
�
�
� �] u �]
�]
�
Y
�
�[
�
�F
�
�
�
�C
�
�
�
bU
�
2
�
�>
�
�
=#
�
�
s?
�
kA
�
�G
�
:S
�
�/
�
r8
�
6"
�
�
�' ��
�]
�
" �]
9 ��
�]
�
BY
�
�-
�
�@ ��
�]
�
[C
�
R
�
S
�
FY
�
@-
�
" ��
�]
�
�
d%
�
"
�
�
�
9!
�
�Y
�
�@
�
2 ( �]
�
�
$
�
X
�
!
�
v
�
H
�
(
�
m!
�
;
�
�;
�
(
�
�
�
9
�
vB
�
R
�
�(
�
�6
�
P
�
�F
�
*R
�
�V
�
�,
�
�"
� �$
^
�
DU
�
p
�
�
�[
�
^
� �
^
�
�5
� " R Z
� PathSourceSize ���
c DesktopImageRegion ���
c DesktopImageClip �^ ^ ( DISPLAYCONFIG_DESKTOP_IMAGE_INFO .?AUDISPLAYCONFIG_DESKTOP_IMAGE_INFO@@ �� !^ � h
!
�
&$
� " �! %^
&^
�
5C
�
�
�
h
� �%
+^
�
�$
�
�
�
�
�
KW
�
�F
�
,J
�
B
�
�
�
�
�
G
�
�+
�
�,
�
�]
�
�S
�
�6
�
V
�
�
�
rI
�
n"
� � � p t @^
A^
�
�<
�
k
�
�)
� .
u Numerator
u Denominator ��J F^ DISPLAYCONFIG_RATIONAL .?AUDISPLAYCONFIG_RATIONAL@@ �� G^ � �
�
�
�F
�
�
�
�.
�
+9
�
�,
�
b%
�
�
�
qS
�
� ��
R^
�
�=
�
�<
� �$
?
�
�[
�
r*
�
�'
�
�S
�
i&
� N � ANON_OBJECT_HEADER_BIGOBJ .?AUANON_OBJECT_HEADER_BIGOBJ@@ *
! Sig1 �
! Sig2 �
! Version ��
! Machine ��
" TimeDateStamp
$ ClassID ��
" SizeOfData ���
" Flags
" $ MetaDataSize �
" ( MetaDataOffset ���
" , NumberOfSections �
" 0 PointerToSymbolTable �
" 4 NumberOfSymbols ��N
^^ 8 ANON_OBJECT_HEADER_BIGOBJ .?AUANON_OBJECT_HEADER_BIGOBJ@@ _^ � �
D%
�
�
�7
�
�= ��
d^
�
�"
� �٤
���
���
���
���� -MT -c -Zl -Zp8 -Gy -W4 -EHs- -EHc- -GR- -GF -GS -Ox -Os -GL -Oy- -Z7 -Zc:alignedNew- -Zc:noexceptTypes- -w15043 -Zc:rvalueCast -Zo -std:c++17 -ZH:SHA_256 -wd4986 -wd4987 -wd4471 -wd4369 -wd4309 -wd4754 -wd4427 -Gw -wd4316 -wd4973 �
l^ � m^ -Brepro -Zc:sizedDealloc- -Wv:19.11 -Qspectre -guard:cf -wd4366 -wd4746 -Gs4096 -wd4064 -volatile:ms -arch:vfpv3-d16 -TC -X ��� h^ i^ j^ k^ n^ ���U,e���{ �j�n�M���'��Aі�f�2������Z2������Z����/�7�9�� p����X��-c����TzA��͠[� @comp.idk�� @feat.00� ��� .debug$S � e .rdata �ہ e c .rdata �w � e | .rdata h�Q� e � .rdata kE�� e � .rdata kE�� e � .rdata ��R e � .debug$S 4 e .debug$S @ e .debug$S
8 e .debug$P �Y e .chks64 h e __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUvevmghUzwezkrUlyquivUzinUkivxlnkOlyq@elfapi ??_C@_13FPGAJAPJ@?$AA?2@ ??_C@_15MNCACJLI@?$AA?2?$AA?1@ ??_C@_13CGOKJPIL@?$AA?1@ RtlNtPathSeperatorString RtlAlternateDosPathSeperatorString RtlDosPathSeperatorsString