递归火山软件开发平台

标题: 发现了一个怪事。 [打印本页]
作者: urenai    时间: 2024-9-8 09:39
标题: 发现了一个怪事。
系统库好多APIrva值都是一样的

  1. Index:, 54, Name, BaseDumpAppcompatCacheWorker, Rva:, 226576
  2. Index:, 64, Name, BaseInitAppcompatCacheSupportWorker, Rva:, 105984
  3. Index:, 65, Name, BaseIsAppcompatInfrastructureDisabled, Rva:, 104064
  4. Index:, 66, Name, BaseIsAppcompatInfrastructureDisabledWorker, Rva:, 104064
  5. Index:, 127, Name, CancelDeviceWakeupRequest, Rva:, 236656
  6. Index:, 153, Name, CloseProfileUserMapping, Rva:, 105984
  7. Index:, 270, Name, CreateUmsCompletionList, Rva:, 271008
  8. Index:, 271, Name, CreateUmsThreadContext, Rva:, 271008
  9. Index:, 303, Name, DeleteUmsCompletionList, Rva:, 271056
  10. Index:, 304, Name, DeleteUmsThreadContext, Rva:, 271056
  11. Index:, 376, Name, ExecuteUmsThread, Rva:, 271200
  12. Index:, 473, Name, GetBinaryType, Rva:, 401344
  13. Index:, 474, Name, GetBinaryTypeA, Rva:, 401344
  14. Index:, 758, Name, GetStringTypeA, Rva:, 243888
  15. Index:, 759, Name, GetStringTypeExA, Rva:, 243888
  16. Index:, 864, Name, GlobalLock, Rva:, 103200
  17. Index:, 869, Name, GlobalUnWire, Rva:, 103168
  18. Index:, 871, Name, GlobalUnlock, Rva:, 103168
  19. Index:, 872, Name, GlobalWire, Rva:, 103200
  20. Index:, 986, Name, LZDone, Rva:, 226576
  21. Index:, 992, Name, LZStart, Rva:, 105984
  22. Index:, 1073, Name, OpenProfileUserMapping, Rva:, 105984
  23. Index:, 1113, Name, PssWalkMarkerGetPosition, Rva:, 245536
  24. Index:, 1114, Name, PssWalkMarkerRewind, Rva:, 245568
  25. Index:, 1115, Name, PssWalkMarkerSeek, Rva:, 245600
  26. Index:, 1116, Name, PssWalkMarkerSeekToBeginning, Rva:, 245568
  27. Index:, 1117, Name, PssWalkMarkerSetPosition, Rva:, 245600
  28. Index:, 1118, Name, PssWalkMarkerTell, Rva:, 245536
  29. Index:, 1255, Name, ReplaceFile, Rva:, 103552
  30. Index:, 1257, Name, ReplaceFileW, Rva:, 103552
  31. Index:, 1259, Name, RequestDeviceWakeup, Rva:, 236656
  32. Index:, 1510, Name, UmsThreadYield, Rva:, 271200
  33. Index:, 1563, Name, WerGetFlags, Rva:, 159664
  34. Index:, 1564, Name, WerGetFlagsWorker, Rva:, 159664
  35. Index:, 1575, Name, WerSetFlags, Rva:, 87568
  36. Index:, 1576, Name, WerSetFlagsWorker, Rva:, 87568
  37. Index:, 1632, Name, _hread, Rva:, 86816
  38. Index:, 1633, Name, _hwrite, Rva:, 128848
  39. Index:, 1639, Name, _lread, Rva:, 86816
  40. Index:, 1640, Name, _lwrite, Rva:, 128848
  41. Index:, 1641, Name, lstrcat, Rva:, 438064
  42. Index:, 1642, Name, lstrcatA, Rva:, 438064
  43. Index:, 1644, Name, lstrcmp, Rva:, 97424
  44. Index:, 1645, Name, lstrcmpA, Rva:, 97424
  45. Index:, 1646, Name, lstrcmpW, Rva:, 83088
  46. Index:, 1647, Name, lstrcmpi, Rva:, 83616
  47. Index:, 1648, Name, lstrcmpiA, Rva:, 83616
  48. Index:, 1649, Name, lstrcmpiW, Rva:, 80944
  49. Index:, 1650, Name, lstrcpy, Rva:, 162112
  50. Index:, 1651, Name, lstrcpyA, Rva:, 162112
  51. Index:, 1653, Name, lstrcpyn, Rva:, 159632
  52. Index:, 1654, Name, lstrcpynA, Rva:, 159632
  53. Index:, 1656, Name, lstrlen, Rva:, 78640
  54. Index:, 1657, Name, lstrlenA, Rva:, 78640
  55. Index:, 1664, Name, uaw_lstrcmpW, Rva:, 83088
  56. Index:, 1665, Name, uaw_lstrcmpiW, Rva:, 80944
复制代码
  1. 模块名称:KERNEL32.dll
  2.        
  3.   AcquireSRWLockExclusive rva: 000A2883 ord:   1  [forwarder RVA : NTDLL.RtlAcquireSRWLockExclusive]
  4.   AcquireSRWLockShared rva: 000A28B9 ord:   2  [forwarder RVA : NTDLL.RtlAcquireSRWLockShared]
  5.   ActivateActCtx rva: 00018A90 ord:   3
  6.   ActivateActCtxWorker rva: 00014750 ord:   4
  7.   ActivatePackageVirtualizationContext rva: 00021280 ord:   5
  8.   AddAtomA rva: 0005AA60 ord:   6
  9.   AddAtomW rva: 000045E0 ord:   7
  10.   AddConsoleAliasA rva: 00020F90 ord:   8
  11.   AddConsoleAliasW rva: 00020FA0 ord:   9
  12.   AddDllDirectory rva: 000A2964 ord:  10  [forwarder RVA : api-ms-win-core-libraryloader-l1-1-0.AddDllDirecto]
  13.   AddIntegrityLabelToBoundaryDescriptor rva: 0003CCF0 ord:  11
  14.   AddLocalAlternateComputerNameA rva: 0005AB80 ord:  12
  15.   AddLocalAlternateComputerNameW rva: 0005ABE0 ord:  13
  16.   AddRefActCtx rva: 0003AC50 ord:  14
  17.   AddRefActCtxWorker rva: 00016F60 ord:  15
  18.   AddResourceAttributeAce rva: 0003AC70 ord:  16
  19.   AddSIDToBoundaryDescriptor rva: 0001F590 ord:  17
  20.   AddScopedPolicyIDAce rva: 0003AC90 ord:  18
  21.   AddSecureMemoryCacheCallback rva: 000384C0 ord:  19
  22.   AddVectoredContinueHandler rva: 000A2A9D ord:  20  [forwarder RVA : NTDLL.RtlAddVectoredContinueHandler]
  23.   AddVectoredExceptionHandler rva: 000A2ADD ord:  21  [forwarder RVA : NTDLL.RtlAddVectoredExceptionHandler]
  24.   AdjustCalendarDate rva: 0004AD40 ord:  22
  25.   AllocConsole rva: 00020BE0 ord:  23
  26.   AllocateUserPhysicalPages rva: 0003ACD0 ord:  24
  27.   AllocateUserPhysicalPagesNuma rva: 0003ACB0 ord:  25
  28.   AppPolicyGetClrCompat rva: 000A2B70 ord:  26  [forwarder RVA : kernelbase.AppPolicyGetClrCompat]
  29.   AppPolicyGetCreateFileAccess rva: 000A2BAE ord:  27  [forwarder RVA : kernelbase.AppPolicyGetCreateFileAccess]
  30.   AppPolicyGetLifecycleManagement rva: 000A2BF6 ord:  28  [forwarder RVA : kernelbase.AppPolicyGetLifecycleManagement]
  31.   AppPolicyGetMediaFoundationCodecLoading rva: 000A2C49 ord:  29  [forwarder RVA : kernelbase.AppPolicyGetMediaFoundationCodecLoading]
  32.   AppPolicyGetProcessTerminationMethod rva: 000A2CA1 ord:  30  [forwarder RVA : kernelbase.AppPolicyGetProcessTerminationMethod]
  33.   AppPolicyGetShowDeveloperDiagnostic rva: 000A2CF5 ord:  31  [forwarder RVA : kernelbase.AppPolicyGetShowDeveloperDiagnostic]
  34.   AppPolicyGetThreadInitializationType rva: 000A2D49 ord:  32  [forwarder RVA : kernelbase.AppPolicyGetThreadInitializationType]
  35.   AppPolicyGetWindowingModel rva: 000A2D94 ord:  33  [forwarder RVA : kernelbase.AppPolicyGetWindowingModel]
  36.   AppXGetOSMaxVersionTested rva: 000A2DD4 ord:  34  [forwarder RVA : kernelbase.AppXGetOSMaxVersionTested]
  37.   ApplicationRecoveryFinished rva: 00043D40 ord:  35
  38.   ApplicationRecoveryInProgress rva: 00043D50 ord:  36
  39.   AreFileApisANSI rva: 00019050 ord:  37
  40.   AreShortNamesEnabled rva: 00059C10 ord:  38
  41.   AssignProcessToJobObject rva: 00018960 ord:  39
  42.   AttachConsole rva: 00020BF0 ord:  40
  43.   BackupRead rva: 0005D6D0 ord:  41
  44.   BackupSeek rva: 0005E900 ord:  42
  45.   BackupWrite rva: 0005EBE0 ord:  43
  46.   BaseCheckAppcompatCache rva: 0003AD50 ord:  44
  47.   BaseCheckAppcompatCacheEx rva: 0003ACF0 ord:  45
  48.   BaseCheckAppcompatCacheExWorker rva: 00072A00 ord:  46
  49.   BaseCheckAppcompatCacheWorker rva: 00072A10 ord:  47
  50.   BaseCheckElevation rva: 00013DB0 ord:  48
  51.   BaseCleanupAppcompatCacheSupport rva: 0003AD70 ord:  49
  52.   BaseCleanupAppcompatCacheSupportWorker rva: 00072A20 ord:  50
  53.   BaseDestroyVDMEnvironment rva: 00040730 ord:  51
  54.   BaseDllReadWriteIniFile rva: 0000B740 ord:  52
  55.   BaseDumpAppcompatCache rva: 0003AD90 ord:  53
  56.   BaseDumpAppcompatCacheWorker rva: 00037510 ord:  54
  57.   BaseElevationPostProcessing rva: 00016ED0 ord:  55
  58.   BaseFlushAppcompatCache rva: 0003ADB0 ord:  56
  59.   BaseFlushAppcompatCacheWorker rva: 00072A30 ord:  57
  60.   BaseFormatObjectAttributes rva: 00020140 ord:  58
  61.   BaseFormatTimeOut rva: 0005A450 ord:  59
  62.   BaseFreeAppCompatDataForProcessWorker rva: 00002510 ord:  60
  63.   BaseGenerateAppCompatData rva: 00012170 ord:  61
  64.   BaseGetNamedObjectDirectory rva: 0003ADD0 ord:  62
  65.   BaseInitAppcompatCacheSupport rva: 0003ADF0 ord:  63
  66.   BaseInitAppcompatCacheSupportWorker rva: 00019E00 ord:  64
  67.   BaseIsAppcompatInfrastructureDisabled rva: 00019680 ord:  65
  68.   BaseIsAppcompatInfrastructureDisabledWorker rva: 00019680 ord:  66
  69.   BaseIsDosApplication rva: 00061EB0 ord:  67
  70.   BaseQueryModuleData rva: 00072ED0 ord:  68
  71.   BaseReadAppCompatDataForProcessWorker rva: 00001440 ord:  69
  72.   BaseSetLastNTError rva: 00004D40 ord:  70
  73.   BaseThreadInitThunk rva: 00012560 ord:  71
  74.   BaseUpdateAppcompatCache rva: 0003AE10 ord:  72
  75.   BaseUpdateAppcompatCacheWorker rva: 00072A90 ord:  73
  76.   BaseUpdateVDMEntry rva: 00040A90 ord:  74
  77.   BaseVerifyUnicodeString rva: 0005A500 ord:  75
  78.   BaseWriteErrorElevationRequiredEvent rva: 00060070 ord:  76
  79.   Basep8BitStringToDynamicUnicodeString rva: 00016B80 ord:  77
  80.   BasepAllocateActivationContextActivationBlock rva: 0005A560 ord:  78
  81.   BasepAnsiStringToDynamicUnicodeString rva: 0005A480 ord:  79
  82.   BasepAppContainerEnvironmentExtension rva: 000133B0 ord:  80
  83.   BasepAppXExtension rva: 00019280 ord:  81
  84.   BasepCheckAppCompat rva: 00002060 ord:  82
  85.   BasepCheckWebBladeHashes rva: 00016960 ord:  83
  86.   BasepCheckWinSaferRestrictions rva: 0000B210 ord:  84
  87.   BasepConstructSxsCreateProcessMessage rva: 00009000 ord:  85
  88.   BasepCopyEncryption rva: 00037EE0 ord:  86
  89.   BasepFinishPackageActivation rva: 00039CD0 ord:  87
  90.   BasepFinishPackageActivationForSxS rva: 00001810 ord:  88
  91.   BasepFreeActivationContextActivationBlock rva: 0005A6F0 ord:  89
  92.   BasepFreeAppCompatData rva: 000153A0 ord:  90
  93.   BasepGetAppCompatData rva: 000117E0 ord:  91
  94.   BasepGetComputerNameFromNtPath rva: 00017A40 ord:  92
  95.   BasepGetExeArchType rva: 00002140 ord:  93
  96.   BasepGetPackageActivationTokenForFilePath rva: 00039CE0 ord:  94
  97.   BasepGetPackageActivationTokenForSxS rva: 00001850 ord:  95
  98.   BasepGetPackagedAppInfoForFile rva: 00002730 ord:  96
  99.   BasepInitAppCompatData rva: 00072BC0 ord:  97
  100.   BasepIsProcessAllowed rva: 00015A50 ord:  98
  101.   BasepMapModuleHandle rva: 00014DC0 ord:  99
  102.   BasepNotifyLoadStringResource rva: 00014520 ord: 100
  103.   BasepPostSuccessAppXExtension rva: 00019AC0 ord: 101
  104.   BasepProcessInvalidImage rva: 00039CF0 ord: 102
  105.   BasepQueryAppCompat rva: 000057C0 ord: 103
  106.   BasepQueryModuleChpeSettings rva: 00072C60 ord: 104
  107.   BasepReleaseAppXContext rva: 00019AA0 ord: 105
  108.   BasepReleasePackagedAppInfo rva: 0003A470 ord: 106
  109.   BasepReleaseSxsCreateProcessUtilityStruct rva: 00007B00 ord: 107
  110.   BasepReportFault rva: 00044000 ord: 108
  111.   BasepSetFileEncryptionCompression rva: 00017420 ord: 109
  112.   Beep rva: 00037230 ord: 110
  113.   BeginUpdateResourceA rva: 0004A2E0 ord: 111
  114.   BeginUpdateResourceW rva: 0004A350 ord: 112
  115.   BindIoCompletionCallback rva: 00027070 ord: 113
  116.   BuildCommDCBA rva: 000424C0 ord: 114
  117.   BuildCommDCBAndTimeoutsA rva: 00042520 ord: 115
  118.   BuildCommDCBAndTimeoutsW rva: 00042560 ord: 116
  119.   BuildCommDCBW rva: 000425F0 ord: 117
  120.   BuildIoRingCancelRequest rva: 000A36B8 ord: 118  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.BuildIoRingCancelReq]
  121.   BuildIoRingFlushFile rva: 000A3704 ord: 119  [forwarder RVA : api-ms-win-core-ioring-l1-1-1.BuildIoRingFlushFile]
  122.   BuildIoRingReadFile rva: 000A374B ord: 120  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.BuildIoRingReadFile]
  123.   BuildIoRingRegisterBuffers rva: 000A3798 ord: 121  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.BuildIoRingRegisterB]
  124.   BuildIoRingRegisterFileHandles rva: 000A37F0 ord: 122  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.BuildIoRingRegisterF]
  125.   BuildIoRingWriteFile rva: 000A3842 ord: 123  [forwarder RVA : api-ms-win-core-ioring-l1-1-1.BuildIoRingWriteFile]
  126.   CallNamedPipeA rva: 00062700 ord: 124
  127.   CallNamedPipeW rva: 00020970 ord: 125
  128.   CallbackMayRunLong rva: 000267A0 ord: 126
  129.   CancelDeviceWakeupRequest rva: 00039C70 ord: 127
  130.   CancelIo rva: 00019D60 ord: 128
  131.   CancelIoEx rva: 00018A70 ord: 129
  132.   CancelSynchronousIo rva: 0003AE30 ord: 130
  133.   CancelThreadpoolIo rva: 000A38FB ord: 131  [forwarder RVA : NTDLL.TpCancelAsyncIoOperation]
  134.   CancelTimerQueueTimer rva: 00043F60 ord: 132
  135.   CancelWaitableTimer rva: 00020220 ord: 133
  136.   CeipIsOptedIn rva: 000A3952 ord: 134  [forwarder RVA : kernelbase.CeipIsOptedIn]
  137.   ChangeTimerQueueTimer rva: 0001DD40 ord: 135
  138.   CheckAllowDecryptedRemoteDestinationPolicy rva: 0003AE50 ord: 136
  139.   CheckElevation rva: 00001E50 ord: 137
  140.   CheckElevationEnabled rva: 000190B0 ord: 138
  141.   CheckForReadOnlyResource rva: 00062B80 ord: 139
  142.   CheckForReadOnlyResourceFilter rva: 0003CD30 ord: 140
  143.   CheckNameLegalDOS8Dot3A rva: 00039A80 ord: 141
  144.   CheckNameLegalDOS8Dot3W rva: 00039B30 ord: 142
  145.   CheckRemoteDebuggerPresent rva: 00002660 ord: 143
  146.   CheckTokenCapability rva: 0003AE70 ord: 144
  147.   CheckTokenMembershipEx rva: 0003AE90 ord: 145
  148.   ClearCommBreak rva: 000209D0 ord: 146
  149.   ClearCommError rva: 000209E0 ord: 147
  150.   CloseConsoleHandle rva: 0006B330 ord: 148
  151.   CloseHandle rva: 000201E0 ord: 149
  152.   CloseIoRing rva: 000A3AC9 ord: 150  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.CloseIoRing]
  153.   ClosePackageInfo rva: 000A3B04 ord: 151  [forwarder RVA : kernelbase.ClosePackageInfo]
  154.   ClosePrivateNamespace rva: 0001FC20 ord: 152
  155.   CloseProfileUserMapping rva: 00019E00 ord: 153
  156.   ClosePseudoConsole rva: 00020C00 ord: 154
  157.   CloseState rva: 000A3B6C ord: 155  [forwarder RVA : kernelbase.CloseState]
  158.   CloseThreadpool rva: 000A3B92 ord: 156  [forwarder RVA : NTDLL.TpReleasePool]
  159.   CloseThreadpoolCleanupGroup rva: 000A3BC2 ord: 157  [forwarder RVA : NTDLL.TpReleaseCleanupGroup]
  160.   CloseThreadpoolCleanupGroupMembers rva: 000A3C01 ord: 158  [forwarder RVA : NTDLL.TpReleaseCleanupGroupMembers]
  161.   CloseThreadpoolIo rva: 000A3C36 ord: 159  [forwarder RVA : NTDLL.TpReleaseIoCompletion]
  162.   CloseThreadpoolTimer rva: 000A3C67 ord: 160  [forwarder RVA : NTDLL.TpReleaseTimer]
  163.   CloseThreadpoolWait rva: 000A3C90 ord: 161  [forwarder RVA : NTDLL.TpReleaseWait]
  164.   CloseThreadpoolWork rva: 000A3CB8 ord: 162  [forwarder RVA : NTDLL.TpReleaseWork]
  165.   CmdBatNotification rva: 0001ED40 ord: 163
  166.   CommConfigDialogA rva: 0003DB40 ord: 164
  167.   CommConfigDialogW rva: 0003DBF0 ord: 165
  168.   CompareCalendarDates rva: 0004B130 ord: 166
  169.   CompareFileTime rva: 00020410 ord: 167
  170.   CompareStringA rva: 00002470 ord: 168
  171.   CompareStringEx rva: 0001EEB0 ord: 169
  172.   CompareStringOrdinal rva: 000110A0 ord: 170
  173.   CompareStringW rva: 00015CA0 ord: 171
  174.   ConnectNamedPipe rva: 00019620 ord: 172
  175.   ConsoleMenuControl rva: 0006B480 ord: 173
  176.   ContinueDebugEvent rva: 000267E0 ord: 174
  177.   ConvertCalDateTimeToSystemTime rva: 0004B1E0 ord: 175
  178.   ConvertDefaultLocale rva: 0003AEB0 ord: 176
  179.   ConvertFiberToThread rva: 00020B30 ord: 177
  180.   ConvertNLSDayOfWeekToWin32DayOfWeek rva: 0004B300 ord: 178
  181.   ConvertSystemTimeToCalDateTime rva: 00002820 ord: 179
  182.   ConvertThreadToFiber rva: 00020B40 ord: 180
  183.   ConvertThreadToFiberEx rva: 00020B50 ord: 181
  184.   CopyContext rva: 0003AED0 ord: 182
  185.   CopyFile2 rva: 00026800 ord: 183
  186.   CopyFileA rva: 00062EE0 ord: 184
  187.   CopyFileExA rva: 00062F90 ord: 185
  188.   CopyFileExW rva: 0001FBE0 ord: 186
  189.   CopyFileTransactedA rva: 00063050 ord: 187
  190.   CopyFileTransactedW rva: 00063140 ord: 188
  191.   CopyFileW rva: 00020B20 ord: 189
  192.   CopyLZFile rva: 000373F0 ord: 190
  193.   CreateActCtxA rva: 00063B80 ord: 191
  194.   CreateActCtxW rva: 00019820 ord: 192
  195.   CreateActCtxWWorker rva: 00006410 ord: 193
  196.   CreateBoundaryDescriptorA rva: 00062D50 ord: 194
  197.   CreateBoundaryDescriptorW rva: 0001F570 ord: 195
  198.   CreateConsoleScreenBuffer rva: 00020D20 ord: 196
  199.   CreateDirectoryA rva: 00020420 ord: 197
  200.   CreateDirectoryExA rva: 00063EF0 ord: 198
  201.   CreateDirectoryExW rva: 0003AEF0 ord: 199
  202.   CreateDirectoryTransactedA rva: 00037780 ord: 200
  203.   CreateDirectoryTransactedW rva: 00063F90 ord: 201
  204.   CreateDirectoryW rva: 00020430 ord: 202
  205.   CreateEnclave rva: 000A3FD9 ord: 203  [forwarder RVA : api-ms-win-core-enclave-l1-1-0.CreateEnclave]
  206.   CreateEventA rva: 00020230 ord: 204
  207.   CreateEventExA rva: 00020240 ord: 205
  208.   CreateEventExW rva: 00020250 ord: 206
  209.   CreateEventW rva: 00020260 ord: 207
  210.   CreateFiber rva: 00020B60 ord: 208
  211.   CreateFiberEx rva: 00020B70 ord: 209
  212.   CreateFile2 rva: 00020440 ord: 210
  213.   CreateFileA rva: 00020450 ord: 211
  214.   CreateFileMappingA rva: 00015030 ord: 212
  215.   CreateFileMappingFromApp rva: 000A409C ord: 213  [forwarder RVA : api-ms-win-core-memory-l1-1-1.CreateFileMappingFro]
  216.   CreateFileMappingNumaA rva: 00064150 ord: 214
  217.   CreateFileMappingNumaW rva: 0003AF10 ord: 215
  218.   CreateFileMappingW rva: 00015CE0 ord: 216
  219.   CreateFileTransactedA rva: 00063240 ord: 217
  220.   CreateFileTransactedW rva: 00063300 ord: 218
  221.   CreateFileW rva: 00020460 ord: 219
  222.   CreateHardLinkA rva: 0003AF30 ord: 220
  223.   CreateHardLinkTransactedA rva: 00043700 ord: 221
  224.   CreateHardLinkTransactedW rva: 00064220 ord: 222
  225.   CreateHardLinkW rva: 00026820 ord: 223
  226.   CreateIoCompletionPort rva: 00018DE0 ord: 224
  227.   CreateIoRing rva: 000A41C4 ord: 225  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.CreateIoRing]
  228.   CreateJobObjectA rva: 0005CB60 ord: 226
  229.   CreateJobObjectW rva: 00017050 ord: 227
  230.   CreateJobSet rva: 0005CBD0 ord: 228
  231.   CreateMailslotA rva: 00064310 ord: 229
  232.   CreateMailslotW rva: 00064380 ord: 230
  233.   CreateMemoryResourceNotification rva: 0001F650 ord: 231
  234.   CreateMutexA rva: 00020270 ord: 232
  235.   CreateMutexExA rva: 00020280 ord: 233
  236.   CreateMutexExW rva: 00020290 ord: 234
  237.   CreateMutexW rva: 000202A0 ord: 235
  238.   CreateNamedPipeA rva: 000627A0 ord: 236
  239.   CreateNamedPipeW rva: 000188A0 ord: 237
  240.   CreatePackageVirtualizationContext rva: 00021320 ord: 238
  241.   CreatePipe rva: 0001E750 ord: 239
  242.   CreatePrivateNamespaceA rva: 00062DC0 ord: 240
  243.   CreatePrivateNamespaceW rva: 0001F550 ord: 241
  244.   CreateProcessA rva: 000022A0 ord: 242
  245.   CreateProcessAsUserA rva: 0003AF50 ord: 243
  246.   CreateProcessAsUserW rva: 00016DE0 ord: 244
  247.   CreateProcessInternalA rva: 0003AFD0 ord: 245
  248.   CreateProcessInternalW rva: 0003B050 ord: 246
  249.   CreateProcessW rva: 000161A0 ord: 247
  250.   CreatePseudoConsole rva: 00020C10 ord: 248
  251.   CreateRemoteThread rva: 0003B0D0 ord: 249
  252.   CreateRemoteThreadEx rva: 000A43C9 ord: 250  [forwarder RVA : api-ms-win-core-processthreads-l1-1-0.CreateRemote]
  253.   CreateSemaphoreA rva: 00018FA0 ord: 251
  254.   CreateSemaphoreExA rva: 00018FD0 ord: 252
  255.   CreateSemaphoreExW rva: 000202B0 ord: 253
  256.   CreateSemaphoreW rva: 000202C0 ord: 254
  257.   CreateSymbolicLinkA rva: 000648E0 ord: 255
  258.   CreateSymbolicLinkTransactedA rva: 000649A0 ord: 256
  259.   CreateSymbolicLinkTransactedW rva: 00064A60 ord: 257
  260.   CreateSymbolicLinkW rva: 0003B120 ord: 258
  261.   CreateTapePartition rva: 00043430 ord: 259
  262.   CreateThread rva: 000144B0 ord: 260
  263.   CreateThreadpool rva: 00019900 ord: 261
  264.   CreateThreadpoolCleanupGroup rva: 00019940 ord: 262
  265.   CreateThreadpoolIo rva: 0001F8F0 ord: 263
  266.   CreateThreadpoolTimer rva: 00015B30 ord: 264
  267.   CreateThreadpoolWait rva: 00018430 ord: 265
  268.   CreateThreadpoolWork rva: 00017100 ord: 266
  269.   CreateTimerQueue rva: 0001DD20 ord: 267
  270.   CreateTimerQueueTimer rva: 000188E0 ord: 268
  271.   CreateToolhelp32Snapshot rva: 000242D0 ord: 269
  272.   CreateUmsCompletionList rva: 000422A0 ord: 270
  273.   CreateUmsThreadContext rva: 000422A0 ord: 271
  274.   CreateWaitableTimerA rva: 00027230 ord: 272
  275.   CreateWaitableTimerExA rva: 00027260 ord: 273
  276.   CreateWaitableTimerExW rva: 000202D0 ord: 274
  277.   CreateWaitableTimerW rva: 00002270 ord: 275
  278.   CtrlRoutine rva: 000A4625 ord: 276  [forwarder RVA : kernelbase.CtrlRoutine]
  279.   DeactivateActCtx rva: 00018AF0 ord: 277
  280.   DeactivateActCtxWorker rva: 000148E0 ord: 278
  281.   DeactivatePackageVirtualizationContext rva: 00021340 ord: 279
  282.   DebugActiveProcess rva: 0003B160 ord: 280
  283.   DebugActiveProcessStop rva: 0003B140 ord: 281
  284.   DebugBreak rva: 0003B180 ord: 282
  285.   DebugBreakProcess rva: 00037650 ord: 283
  286.   DebugSetProcessKillOnExit rva: 00037690 ord: 284
  287.   DecodePointer rva: 000A46FA ord: 285  [forwarder RVA : NTDLL.RtlDecodePointer]
  288.   DecodeSystemPointer rva: 000A4725 ord: 286  [forwarder RVA : NTDLL.RtlDecodeSystemPointer]
  289.   DefineDosDeviceA rva: 000661E0 ord: 287
  290.   DefineDosDeviceW rva: 00020470 ord: 288
  291.   DelayLoadFailureHook rva: 0003B1A0 ord: 289
  292.   DeleteAtom rva: 00004260 ord: 290
  293.   DeleteBoundaryDescriptor rva: 0001F630 ord: 291
  294.   DeleteCriticalSection rva: 000A47B3 ord: 292  [forwarder RVA : NTDLL.RtlDeleteCriticalSection]
  295.   DeleteFiber rva: 00020B80 ord: 293
  296.   DeleteFileA rva: 00020480 ord: 294
  297.   DeleteFileTransactedA rva: 00064B40 ord: 295
  298.   DeleteFileTransactedW rva: 00064B90 ord: 296
  299.   DeleteFileW rva: 00020490 ord: 297
  300.   DeleteProcThreadAttributeList rva: 000A4840 ord: 298  [forwarder RVA : api-ms-win-core-processthreads-l1-1-0.DeleteProcTh]
  301.   DeleteSynchronizationBarrier rva: 0003B1C0 ord: 299
  302.   DeleteTimerQueue rva: 00020920 ord: 300
  303.   DeleteTimerQueueEx rva: 00019B80 ord: 301
  304.   DeleteTimerQueueTimer rva: 000194C0 ord: 302
  305.   DeleteUmsCompletionList rva: 000422D0 ord: 303
  306.   DeleteUmsThreadContext rva: 000422D0 ord: 304
  307.   DeleteVolumeMountPointA rva: 000664B0 ord: 305
  308.   DeleteVolumeMountPointW rva: 000204A0 ord: 306
  309.   DequeueUmsCompletionListItems rva: 00042300 ord: 307
  310.   DeviceIoControl rva: 00002770 ord: 308
  311.   DisableThreadLibraryCalls rva: 00018A30 ord: 309
  312.   DisableThreadProfiling rva: 00044040 ord: 310
  313.   DisassociateCurrentThreadFromCallback rva: 000A49BF ord: 311  [forwarder RVA : NTDLL.TpDisassociateCallback]
  314.   DiscardVirtualMemory rva: 000A49F1 ord: 312  [forwarder RVA : api-ms-win-core-memory-l1-1-2.DiscardVirtualMemory]
  315.   DisconnectNamedPipe rva: 000025D0 ord: 313
  316.   DnsHostnameToComputerNameA rva: 0005BAF0 ord: 314
  317.   DnsHostnameToComputerNameExW rva: 0003B1E0 ord: 315
  318.   DnsHostnameToComputerNameW rva: 0001E9E0 ord: 316
  319.   DosDateTimeToFileTime rva: 00004310 ord: 317
  320.   DosPathToSessionPathA rva: 000678F0 ord: 318
  321.   DosPathToSessionPathW rva: 00067AF0 ord: 319
  322.   DuplicateConsoleHandle rva: 0006B350 ord: 320
  323.   DuplicateEncryptionInfoFileExt rva: 00038290 ord: 321
  324.   DuplicateHandle rva: 000201F0 ord: 322
  325.   DuplicatePackageVirtualizationContext rva: 00021360 ord: 323
  326.   EnableProcessOptionalXStateFeatures rva: 0003B200 ord: 324
  327.   EnableThreadProfiling rva: 00044080 ord: 325
  328.   EncodePointer rva: 000A4B81 ord: 326  [forwarder RVA : NTDLL.RtlEncodePointer]
  329.   EncodeSystemPointer rva: 000A4BAC ord: 327  [forwarder RVA : NTDLL.RtlEncodeSystemPointer]
  330.   EndUpdateResourceA rva: 0004A5C0 ord: 328
  331.   EndUpdateResourceW rva: 0004A5D0 ord: 329
  332.   EnterCriticalSection rva: 000A4C04 ord: 330  [forwarder RVA : NTDLL.RtlEnterCriticalSection]
  333.   EnterSynchronizationBarrier rva: 0003B220 ord: 331
  334.   EnterUmsSchedulingMode rva: 00042330 ord: 332
  335.   EnumCalendarInfoA rva: 0004C030 ord: 333
  336.   EnumCalendarInfoExA rva: 0004C0D0 ord: 334
  337.   EnumCalendarInfoExEx rva: 0001DF10 ord: 335
  338.   EnumCalendarInfoExW rva: 0003B240 ord: 336
  339.   EnumCalendarInfoW rva: 0003B260 ord: 337
  340.   EnumDateFormatsA rva: 0004C170 ord: 338
  341.   EnumDateFormatsExA rva: 0004C1E0 ord: 339
  342.   EnumDateFormatsExEx rva: 0003B280 ord: 340
  343.   EnumDateFormatsExW rva: 0003B2A0 ord: 341
  344.   EnumDateFormatsW rva: 0003B2C0 ord: 342
  345.   EnumLanguageGroupLocalesA rva: 0004C250 ord: 343
  346.   EnumLanguageGroupLocalesW rva: 0003B2E0 ord: 344
  347.   EnumResourceLanguagesA rva: 00039370 ord: 345
  348.   EnumResourceLanguagesExA rva: 0003B300 ord: 346
  349.   EnumResourceLanguagesExW rva: 0003B320 ord: 347
  350.   EnumResourceLanguagesW rva: 000393B0 ord: 348
  351.   EnumResourceNamesA rva: 00020940 ord: 349
  352.   EnumResourceNamesExA rva: 0003B340 ord: 350
  353.   EnumResourceNamesExW rva: 0003B360 ord: 351
  354.   EnumResourceNamesW rva: 00020950 ord: 352
  355.   EnumResourceTypesA rva: 000393F0 ord: 353
  356.   EnumResourceTypesExA rva: 0003B380 ord: 354
  357.   EnumResourceTypesExW rva: 0003B3A0 ord: 355
  358.   EnumResourceTypesW rva: 00039420 ord: 356
  359.   EnumSystemCodePagesA rva: 0004C280 ord: 357
  360.   EnumSystemCodePagesW rva: 0003B3C0 ord: 358
  361.   EnumSystemFirmwareTables rva: 00038500 ord: 359
  362.   EnumSystemGeoID rva: 000554E0 ord: 360
  363.   EnumSystemGeoNames rva: 000555E0 ord: 361
  364.   EnumSystemLanguageGroupsA rva: 0004C2A0 ord: 362
  365.   EnumSystemLanguageGroupsW rva: 0003B3E0 ord: 363
  366.   EnumSystemLocalesA rva: 0003B400 ord: 364
  367.   EnumSystemLocalesEx rva: 0003B420 ord: 365
  368.   EnumSystemLocalesW rva: 0003B440 ord: 366
  369.   EnumTimeFormatsA rva: 0004C2C0 ord: 367
  370.   EnumTimeFormatsEx rva: 0001E730 ord: 368
  371.   EnumTimeFormatsW rva: 0003B460 ord: 369
  372.   EnumUILanguagesA rva: 0004C340 ord: 370
  373.   EnumUILanguagesW rva: 0003B480 ord: 371
  374.   EnumerateLocalComputerNamesA rva: 0005BBE0 ord: 372
  375.   EnumerateLocalComputerNamesW rva: 0005BD10 ord: 373
  376.   EraseTape rva: 00043490 ord: 374
  377.   EscapeCommFunction rva: 000209F0 ord: 375
  378.   ExecuteUmsThread rva: 00042360 ord: 376
  379.   ExitProcess rva: 00017FA0 ord: 377
  380.   ExitThread rva: 000A4FEF ord: 378  [forwarder RVA : NTDLL.RtlExitUserThread]
  381.   ExitVDM rva: 00040D40 ord: 379
  382.   ExpandEnvironmentStringsA rva: 00026840 ord: 380
  383.   ExpandEnvironmentStringsW rva: 00014DE0 ord: 381
  384.   ExpungeConsoleCommandHistoryA rva: 00020FB0 ord: 382
  385.   ExpungeConsoleCommandHistoryW rva: 00020FC0 ord: 383
  386.   FatalAppExitA rva: 0003B4A0 ord: 384
  387.   FatalAppExitW rva: 0003B4C0 ord: 385
  388.   FatalExit rva: 0003A660 ord: 386
  389.   FileTimeToDosDateTime rva: 00004B30 ord: 387
  390.   FileTimeToLocalFileTime rva: 000204B0 ord: 388
  391.   FileTimeToSystemTime rva: 00020990 ord: 389
  392.   FillConsoleOutputAttribute rva: 00020D30 ord: 390
  393.   FillConsoleOutputCharacterA rva: 00020D40 ord: 391
  394.   FillConsoleOutputCharacterW rva: 00020D50 ord: 392
  395.   FindActCtxSectionGuid rva: 00017FC0 ord: 393
  396.   FindActCtxSectionGuidWorker rva: 00004C00 ord: 394
  397.   FindActCtxSectionStringA rva: 00067C90 ord: 395
  398.   FindActCtxSectionStringW rva: 00019BC0 ord: 396
  399.   FindActCtxSectionStringWWorker rva: 000043F0 ord: 397
  400.   FindAtomA rva: 00002640 ord: 398
  401.   FindAtomW rva: 00004910 ord: 399
  402.   FindClose rva: 000204C0 ord: 400
  403.   FindCloseChangeNotification rva: 000204D0 ord: 401
  404.   FindFirstChangeNotificationA rva: 000204E0 ord: 402
  405.   FindFirstChangeNotificationW rva: 000204F0 ord: 403
  406.   FindFirstFileA rva: 00020500 ord: 404
  407.   FindFirstFileExA rva: 00020510 ord: 405
  408.   FindFirstFileExW rva: 00020520 ord: 406
  409.   FindFirstFileNameTransactedW rva: 00037880 ord: 407
  410.   FindFirstFileNameW rva: 00020530 ord: 408
  411.   FindFirstFileTransactedA rva: 00037960 ord: 409
  412.   FindFirstFileTransactedW rva: 00067D30 ord: 410
  413.   FindFirstFileW rva: 00020540 ord: 411
  414.   FindFirstStreamTransactedW rva: 00037A60 ord: 412
  415.   FindFirstStreamW rva: 000A5300 ord: 413  [forwarder RVA : api-ms-win-core-file-l1-2-2.FindFirstStreamW]
  416.   FindFirstVolumeA rva: 00066500 ord: 414
  417.   FindFirstVolumeMountPointA rva: 000666B0 ord: 415
  418.   FindFirstVolumeMountPointW rva: 000668B0 ord: 416
  419.   FindFirstVolumeW rva: 00020550 ord: 417
  420.   FindNLSString rva: 00026860 ord: 418
  421.   FindNLSStringEx rva: 0001EE90 ord: 419
  422.   FindNextChangeNotification rva: 00020560 ord: 420
  423.   FindNextFileA rva: 00020570 ord: 421
  424.   FindNextFileNameW rva: 00020580 ord: 422
  425.   FindNextFileW rva: 00020590 ord: 423
  426.   FindNextStreamW rva: 000A53FC ord: 424  [forwarder RVA : api-ms-win-core-file-l1-2-2.FindNextStreamW]
  427.   FindNextVolumeA rva: 00066B40 ord: 425
  428.   FindNextVolumeMountPointA rva: 00066CF0 ord: 426
  429.   FindNextVolumeMountPointW rva: 000673E0 ord: 427
  430.   FindNextVolumeW rva: 000205A0 ord: 428
  431.   FindPackagesByPackageFamily rva: 000A5498 ord: 429  [forwarder RVA : kernelbase.FindPackagesByPackageFamily]
  432.   FindResourceA rva: 00014BB0 ord: 430
  433.   FindResourceExA rva: 00014BD0 ord: 431
  434.   FindResourceExW rva: 00013B40 ord: 432
  435.   FindResourceW rva: 00016E60 ord: 433
  436.   FindStringOrdinal rva: 00017DA0 ord: 434
  437.   FindVolumeClose rva: 000205B0 ord: 435
  438.   FindVolumeMountPointClose rva: 000673F0 ord: 436
  439.   FlsAlloc rva: 00018B10 ord: 437
  440.   FlsFree rva: 00019100 ord: 438
  441.   FlsGetValue rva: 00013310 ord: 439
  442.   FlsSetValue rva: 000150F0 ord: 440
  443.   FlushConsoleInputBuffer rva: 00020D60 ord: 441
  444.   FlushFileBuffers rva: 000205C0 ord: 442
  445.   FlushInstructionCache rva: 00013CC0 ord: 443
  446.   FlushProcessWriteBuffers rva: 000A55B8 ord: 444  [forwarder RVA : NTDLL.NtFlushProcessWriteBuffers]
  447.   FlushViewOfFile rva: 00002590 ord: 445
  448.   FoldStringA rva: 0004C360 ord: 446
  449.   FoldStringW rva: 00026880 ord: 447
  450.   FormatApplicationUserModelId rva: 000A561E ord: 448  [forwarder RVA : kernelbase.FormatApplicationUserModelId]
  451.   FormatMessageA rva: 00019660 ord: 449
  452.   FormatMessageW rva: 00017010 ord: 450
  453.   FreeConsole rva: 00020C20 ord: 451
  454.   FreeEnvironmentStringsA rva: 0003B4E0 ord: 452
  455.   FreeEnvironmentStringsW rva: 00018880 ord: 453
  456.   FreeLibrary rva: 00015420 ord: 454
  457.   FreeLibraryAndExitThread rva: 000199A0 ord: 455
  458.   FreeLibraryWhenCallbackReturns rva: 000A56E4 ord: 456  [forwarder RVA : NTDLL.TpCallbackUnloadDllOnCompletion]
  459.   FreeMemoryJobObject rva: 0005CC10 ord: 457
  460.   FreeResource rva: 00019C20 ord: 458
  461.   FreeUserPhysicalPages rva: 0003B500 ord: 459
  462.   GenerateConsoleCtrlEvent rva: 00020D70 ord: 460
  463.   GetACP rva: 00018130 ord: 461
  464.   GetActiveProcessorCount rva: 00017150 ord: 462
  465.   GetActiveProcessorGroupCount rva: 0001FB80 ord: 463
  466.   GetAppContainerAce rva: 0003B520 ord: 464
  467.   GetAppContainerNamedObjectPath rva: 000268A0 ord: 465
  468.   GetApplicationRecoveryCallback rva: 0003B540 ord: 466
  469.   GetApplicationRecoveryCallbackWorker rva: 00043D60 ord: 467
  470.   GetApplicationRestartSettings rva: 0003B560 ord: 468
  471.   GetApplicationRestartSettingsWorker rva: 00043E20 ord: 469
  472.   GetApplicationUserModelId rva: 000A5868 ord: 470  [forwarder RVA : kernelbase.GetApplicationUserModelId]
  473.   GetAtomNameA rva: 0005AA80 ord: 471
  474.   GetAtomNameW rva: 00004060 ord: 472
  475.   GetBinaryType rva: 00061FC0 ord: 473
  476.   GetBinaryTypeA rva: 00061FC0 ord: 474
  477.   GetBinaryTypeW rva: 00062010 ord: 475
  478.   GetCPInfo rva: 00017E00 ord: 476
  479.   GetCPInfoExA rva: 0004C610 ord: 477
  480.   GetCPInfoExW rva: 0003B580 ord: 478
  481.   GetCachedSigningLevel rva: 0003B5A0 ord: 479
  482.   GetCalendarDateFormat rva: 0004B340 ord: 480
  483.   GetCalendarDateFormatEx rva: 00002E40 ord: 481
  484.   GetCalendarDaysInMonth rva: 0004B500 ord: 482
  485.   GetCalendarDifferenceInDays rva: 0004B760 ord: 483
  486.   GetCalendarInfoA rva: 0004C6F0 ord: 484
  487.   GetCalendarInfoEx rva: 000209A0 ord: 485
  488.   GetCalendarInfoW rva: 000209B0 ord: 486
  489.   GetCalendarMonthsInYear rva: 0004B8E0 ord: 487
  490.   GetCalendarSupportedDateRange rva: 00002880 ord: 488
  491.   GetCalendarWeekNumber rva: 0004B9E0 ord: 489
  492.   GetComPlusPackageInstallStatus rva: 00043C70 ord: 490
  493.   GetCommConfig rva: 00020A00 ord: 491
  494.   GetCommMask rva: 00020A10 ord: 492
  495.   GetCommModemStatus rva: 00020A20 ord: 493
  496.   GetCommProperties rva: 00020A30 ord: 494
  497.   GetCommState rva: 00020A40 ord: 495
  498.   GetCommTimeouts rva: 00020A50 ord: 496
  499.   GetCommandLineA rva: 00018AD0 ord: 497
  500.   GetCommandLineW rva: 00017DE0 ord: 498
  501.   GetCompressedFileSizeA rva: 0003B5C0 ord: 499
  502.   GetCompressedFileSizeTransactedA rva: 00064C50 ord: 500
  503.   GetCompressedFileSizeTransactedW rva: 00064CB0 ord: 501
  504.   GetCompressedFileSizeW rva: 000268C0 ord: 502
  505.   GetComputerNameA rva: 0001DF30 ord: 503
  506.   GetComputerNameExA rva: 0003B5E0 ord: 504
  507.   GetComputerNameExW rva: 000199C0 ord: 505
  508.   GetComputerNameW rva: 0000AA90 ord: 506
  509.   GetConsoleAliasA rva: 00020FD0 ord: 507
  510.   GetConsoleAliasExesA rva: 00020FE0 ord: 508
  511.   GetConsoleAliasExesLengthA rva: 00020FF0 ord: 509
  512.   GetConsoleAliasExesLengthW rva: 00021000 ord: 510
  513.   GetConsoleAliasExesW rva: 00021010 ord: 511
  514.   GetConsoleAliasW rva: 00021020 ord: 512
  515.   GetConsoleAliasesA rva: 00021030 ord: 513
  516.   GetConsoleAliasesLengthA rva: 00021040 ord: 514
  517.   GetConsoleAliasesLengthW rva: 00021050 ord: 515
  518.   GetConsoleAliasesW rva: 00021060 ord: 516
  519.   GetConsoleCP rva: 00020C30 ord: 517
  520.   GetConsoleCharType rva: 0006B9A0 ord: 518
  521.   GetConsoleCommandHistoryA rva: 00021070 ord: 519
  522.   GetConsoleCommandHistoryLengthA rva: 00021080 ord: 520
  523.   GetConsoleCommandHistoryLengthW rva: 00021090 ord: 521
  524.   GetConsoleCommandHistoryW rva: 000210A0 ord: 522
  525.   GetConsoleCursorInfo rva: 00020D80 ord: 523
  526.   GetConsoleCursorMode rva: 0006BA10 ord: 524
  527.   GetConsoleDisplayMode rva: 000210B0 ord: 525
  528.   GetConsoleFontInfo rva: 0006BDB0 ord: 526
  529.   GetConsoleFontSize rva: 000210C0 ord: 527
  530.   GetConsoleHardwareState rva: 0006B4E0 ord: 528
  531.   GetConsoleHistoryInfo rva: 000210D0 ord: 529
  532.   GetConsoleInputExeNameA rva: 000A5D5B ord: 530  [forwarder RVA : kernelbase.GetConsoleInputExeNameA]
  533.   GetConsoleInputExeNameW rva: 000A5D96 ord: 531  [forwarder RVA : kernelbase.GetConsoleInputExeNameW]
  534.   GetConsoleInputWaitHandle rva: 0006B3F0 ord: 532
  535.   GetConsoleKeyboardLayoutNameA rva: 0006BE60 ord: 533
  536.   GetConsoleKeyboardLayoutNameW rva: 0006BE80 ord: 534
  537.   GetConsoleMode rva: 00020C40 ord: 535
  538.   GetConsoleNlsMode rva: 0006BA90 ord: 536
  539.   GetConsoleOriginalTitleA rva: 00020D90 ord: 537
  540.   GetConsoleOriginalTitleW rva: 00020DA0 ord: 538
  541.   GetConsoleOutputCP rva: 00020C50 ord: 539
  542.   GetConsoleProcessList rva: 000210E0 ord: 540
  543.   GetConsoleScreenBufferInfo rva: 00020DB0 ord: 541
  544.   GetConsoleScreenBufferInfoEx rva: 00020DC0 ord: 542
  545.   GetConsoleSelectionInfo rva: 000210F0 ord: 543
  546.   GetConsoleTitleA rva: 00020DD0 ord: 544
  547.   GetConsoleTitleW rva: 00020DE0 ord: 545
  548.   GetConsoleWindow rva: 00021100 ord: 546
  549.   GetCurrencyFormatA rva: 0004C950 ord: 547
  550.   GetCurrencyFormatEx rva: 0003B600 ord: 548
  551.   GetCurrencyFormatW rva: 0003B620 ord: 549
  552.   GetCurrentActCtx rva: 0003B630 ord: 550
  553.   GetCurrentActCtxWorker rva: 00015110 ord: 551
  554.   GetCurrentApplicationUserModelId rva: 000A5F91 ord: 552  [forwarder RVA : kernelbase.GetCurrentApplicationUserModelId]
  555.   GetCurrentConsoleFont rva: 00021110 ord: 553
  556.   GetCurrentConsoleFontEx rva: 00021120 ord: 554
  557.   GetCurrentDirectoryA rva: 0001ED00 ord: 555
  558.   GetCurrentDirectoryW rva: 00018990 ord: 556
  559.   GetCurrentPackageFamilyName rva: 000A6031 ord: 557  [forwarder RVA : kernelbase.GetCurrentPackageFamilyName]
  560.   GetCurrentPackageFullName rva: 000A6072 ord: 558  [forwarder RVA : kernelbase.GetCurrentPackageFullName]
  561.   GetCurrentPackageId rva: 000A60AB ord: 559  [forwarder RVA : kernelbase.GetCurrentPackageId]
  562.   GetCurrentPackageInfo rva: 000A60E0 ord: 560  [forwarder RVA : kernelbase.GetCurrentPackageInfo]
  563.   GetCurrentPackagePath rva: 000A6117 ord: 561  [forwarder RVA : kernelbase.GetCurrentPackagePath]
  564.   GetCurrentPackageVirtualizationContext rva: 00021380 ord: 562
  565.   GetCurrentProcess rva: 00020160 ord: 563
  566.   GetCurrentProcessId rva: 00020170 ord: 564
  567.   GetCurrentProcessorNumber rva: 000A619F ord: 565  [forwarder RVA : NTDLL.RtlGetCurrentProcessorNumber]
  568.   GetCurrentProcessorNumberEx rva: 000A61DE ord: 566  [forwarder RVA : NTDLL.RtlGetCurrentProcessorNumberEx]
  569.   GetCurrentThread rva: 00010D90 ord: 567
  570.   GetCurrentThreadId rva: 00002750 ord: 568
  571.   GetCurrentThreadStackLimits rva: 000A6243 ord: 569  [forwarder RVA : api-ms-win-core-processthreads-l1-1-0.GetCurrentTh]
  572.   GetCurrentUmsThread rva: 00042390 ord: 570
  573.   GetDateFormatA rva: 000268E0 ord: 571
  574.   GetDateFormatAWorker rva: 0004CD50 ord: 572
  575.   GetDateFormatEx rva: 00026900 ord: 573
  576.   GetDateFormatW rva: 00019140 ord: 574
  577.   GetDateFormatWWorker rva: 00003A20 ord: 575
  578.   GetDefaultCommConfigA rva: 0003DE60 ord: 576
  579.   GetDefaultCommConfigW rva: 0003DF10 ord: 577
  580.   GetDevicePowerState rva: 000687F0 ord: 578
  581.   GetDiskFreeSpaceA rva: 000205D0 ord: 579
  582.   GetDiskFreeSpaceExA rva: 000205E0 ord: 580
  583.   GetDiskFreeSpaceExW rva: 000205F0 ord: 581
  584.   GetDiskFreeSpaceW rva: 00020600 ord: 582
  585.   GetDiskSpaceInformationA rva: 000A6396 ord: 583  [forwarder RVA : api-ms-win-core-file-l1-2-3.GetDiskSpaceInformatio]
  586.   GetDiskSpaceInformationW rva: 000A63E4 ord: 584  [forwarder RVA : api-ms-win-core-file-l1-2-3.GetDiskSpaceInformatio]
  587.   GetDllDirectoryA rva: 00039450 ord: 585
  588.   GetDllDirectoryW rva: 000199E0 ord: 586
  589.   GetDriveTypeA rva: 00020610 ord: 587
  590.   GetDriveTypeW rva: 00020620 ord: 588
  591.   GetDurationFormat rva: 0004E070 ord: 589
  592.   GetDurationFormatEx rva: 0003B650 ord: 590
  593.   GetDynamicTimeZoneInformation rva: 00019780 ord: 591
  594.   GetEnabledXStateFeatures rva: 0003B670 ord: 592
  595.   GetEncryptedFileVersionExt rva: 000383A0 ord: 593
  596.   GetEnvironmentStrings rva: 0003B690 ord: 594
  597.   GetEnvironmentStringsA rva: 000209C0 ord: 595
  598.   GetEnvironmentStringsW rva: 00018860 ord: 596
  599.   GetEnvironmentVariableA rva: 00019360 ord: 597
  600.   GetEnvironmentVariableW rva: 00014530 ord: 598
  601.   GetEraNameCountedString rva: 0003B6B0 ord: 599
  602.   GetErrorMode rva: 00026920 ord: 600
  603.   GetExitCodeProcess rva: 00016E80 ord: 601
  604.   GetExitCodeThread rva: 00018F80 ord: 602
  605.   GetExpandedNameA rva: 0003CEC0 ord: 603
  606.   GetExpandedNameW rva: 0003CFB0 ord: 604
  607.   GetFileAttributesA rva: 00020630 ord: 605
  608.   GetFileAttributesExA rva: 00020640 ord: 606
  609.   GetFileAttributesExW rva: 00020650 ord: 607
  610.   GetFileAttributesTransactedA rva: 00064D80 ord: 608
  611.   GetFileAttributesTransactedW rva: 00064DF0 ord: 609
  612.   GetFileAttributesW rva: 00020660 ord: 610
  613.   GetFileBandwidthReservation rva: 00037B40 ord: 611
  614.   GetFileInformationByHandle rva: 00020670 ord: 612
  615.   GetFileInformationByHandleEx rva: 000154D0 ord: 613
  616.   GetFileMUIInfo rva: 0003B6D0 ord: 614
  617.   GetFileMUIPath rva: 0001F510 ord: 615
  618.   GetFileSize rva: 00020680 ord: 616
  619.   GetFileSizeEx rva: 00020690 ord: 617
  620.   GetFileTime rva: 000206A0 ord: 618
  621.   GetFileType rva: 000206B0 ord: 619
  622.   GetFinalPathNameByHandleA rva: 000206C0 ord: 620
  623.   GetFinalPathNameByHandleW rva: 000206D0 ord: 621
  624.   GetFirmwareEnvironmentVariableA rva: 000688D0 ord: 622
  625.   GetFirmwareEnvironmentVariableExA rva: 000688F0 ord: 623
  626.   GetFirmwareEnvironmentVariableExW rva: 00002A50 ord: 624
  627.   GetFirmwareEnvironmentVariableW rva: 0001FC00 ord: 625
  628.   GetFirmwareType rva: 00068C70 ord: 626
  629.   GetFullPathNameA rva: 000206E0 ord: 627
  630.   GetFullPathNameTransactedA rva: 00037520 ord: 628
  631.   GetFullPathNameTransactedW rva: 00068CF0 ord: 629
  632.   GetFullPathNameW rva: 000206F0 ord: 630
  633.   GetGeoInfoA rva: 0004CFC0 ord: 631
  634.   GetGeoInfoEx rva: 00055720 ord: 632
  635.   GetGeoInfoW rva: 00003030 ord: 633
  636.   GetHandleInformation rva: 00020200 ord: 634
  637.   GetIoRingInfo rva: 000A6845 ord: 635  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.GetIoRingInfo]
  638.   GetLargePageMinimum rva: 0003B6F0 ord: 636
  639.   GetLargestConsoleWindowSize rva: 00020DF0 ord: 637
  640.   GetLastError rva: 00010DF0 ord: 638
  641.   GetLocalTime rva: 00017F80 ord: 639
  642.   GetLocaleInfoA rva: 0001E9C0 ord: 640
  643.   GetLocaleInfoEx rva: 000154B0 ord: 641
  644.   GetLocaleInfoW rva: 00019070 ord: 642
  645.   GetLogicalDriveStringsA rva: 00068DE0 ord: 643
  646.   GetLogicalDriveStringsW rva: 00020700 ord: 644
  647.   GetLogicalDrives rva: 00011790 ord: 645
  648.   GetLogicalProcessorInformation rva: 00019240 ord: 646
  649.   GetLogicalProcessorInformationEx rva: 000A696A ord: 647  [forwarder RVA : api-ms-win-core-sysinfo-l1-1-0.GetLogicalProcessor]
  650.   GetLongPathNameA rva: 0005A1A0 ord: 648
  651.   GetLongPathNameTransactedA rva: 00040DE0 ord: 649
  652.   GetLongPathNameTransactedW rva: 00062380 ord: 650
  653.   GetLongPathNameW rva: 00011150 ord: 651
  654.   GetMachineTypeAttributes rva: 000A6A1B ord: 652  [forwarder RVA : api-ms-win-core-processthreads-l1-1-7.GetMachineTy]
  655.   GetMailslotInfo rva: 00027140 ord: 653
  656.   GetMaximumProcessorCount rva: 00067FA0 ord: 654
  657.   GetMaximumProcessorGroupCount rva: 0001F670 ord: 655
  658.   GetMemoryErrorHandlingCapabilities rva: 0003B710 ord: 656
  659.   GetModuleFileNameA rva: 000189F0 ord: 657
  660.   GetModuleFileNameW rva: 00017030 ord: 658
  661.   GetModuleHandleA rva: 00018940 ord: 659
  662.   GetModuleHandleExA rva: 00019B60 ord: 660
  663.   GetModuleHandleExW rva: 000184A0 ord: 661
  664.   GetModuleHandleW rva: 000166B0 ord: 662
  665.   GetNLSVersion rva: 0003B750 ord: 663
  666.   GetNLSVersionEx rva: 0003B730 ord: 664
  667.   GetNamedPipeAttribute rva: 0003B770 ord: 665
  668.   GetNamedPipeClientComputerNameA rva: 00062850 ord: 666
  669.   GetNamedPipeClientComputerNameW rva: 0003B790 ord: 667
  670.   GetNamedPipeClientProcessId rva: 000184C0 ord: 668
  671.   GetNamedPipeClientSessionId rva: 00039700 ord: 669
  672.   GetNamedPipeHandleStateA rva: 000629A0 ord: 670
  673.   GetNamedPipeHandleStateW rva: 00026940 ord: 671
  674.   GetNamedPipeInfo rva: 000A6C21 ord: 672  [forwarder RVA : api-ms-win-core-namedpipe-l1-2-1.GetNamedPipeInfo]
  675.   GetNamedPipeServerProcessId rva: 00002490 ord: 673
  676.   GetNamedPipeServerSessionId rva: 00026680 ord: 674
  677.   GetNativeSystemInfo rva: 00019200 ord: 675
  678.   GetNextUmsListItem rva: 000423C0 ord: 676
  679.   GetNextVDMCommand rva: 00040EB0 ord: 677
  680.   GetNumaAvailableMemoryNode rva: 00039960 ord: 678
  681.   GetNumaAvailableMemoryNodeEx rva: 00069360 ord: 679
  682.   GetNumaHighestNodeNumber rva: 0001F610 ord: 680
  683.   GetNumaNodeNumberFromHandle rva: 00039970 ord: 681
  684.   GetNumaNodeProcessorMask rva: 000693F0 ord: 682
  685.   GetNumaNodeProcessorMask2 rva: 000A6D64 ord: 683  [forwarder RVA : api-ms-win-core-systemtopology-l1-1-2.GetNumaNodeP]
  686.   GetNumaNodeProcessorMaskEx rva: 0003B7B0 ord: 684
  687.   GetNumaProcessorNode rva: 000399D0 ord: 685
  688.   GetNumaProcessorNodeEx rva: 00069470 ord: 686
  689.   GetNumaProximityNode rva: 00039A40 ord: 687
  690.   GetNumaProximityNodeEx rva: 0003B7D0 ord: 688
  691.   GetNumberFormatA rva: 0004D090 ord: 689
  692.   GetNumberFormatEx rva: 00026960 ord: 690
  693.   GetNumberFormatW rva: 00026980 ord: 691
  694.   GetNumberOfConsoleFonts rva: 0006BF30 ord: 692
  695.   GetNumberOfConsoleInputEvents rva: 00020C60 ord: 693
  696.   GetNumberOfConsoleMouseButtons rva: 00021130 ord: 694
  697.   GetOEMCP rva: 00019700 ord: 695
  698.   GetOverlappedResult rva: 00012D90 ord: 696
  699.   GetOverlappedResultEx rva: 000A6ED3 ord: 697  [forwarder RVA : api-ms-win-core-io-l1-1-1.GetOverlappedResultEx]
  700.   GetPackageApplicationIds rva: 000A6F1C ord: 698  [forwarder RVA : kernelbase.GetPackageApplicationIds]
  701.   GetPackageFamilyName rva: 000A6F55 ord: 699  [forwarder RVA : kernelbase.GetPackageFamilyName]
  702.   GetPackageFullName rva: 000A6F88 ord: 700  [forwarder RVA : kernelbase.GetPackageFullName]
  703.   GetPackageId rva: 000A6FB3 ord: 701  [forwarder RVA : kernelbase.GetPackageId]
  704.   GetPackageInfo rva: 000A6FDA ord: 702  [forwarder RVA : kernelbase.GetPackageInfo]
  705.   GetPackagePath rva: 000A7003 ord: 703  [forwarder RVA : kernelbase.GetPackagePath]
  706.   GetPackagePathByFullName rva: 000A7036 ord: 704  [forwarder RVA : kernelbase.GetPackagePathByFullName]
  707.   GetPackagesByPackageFamily rva: 000A7075 ord: 705  [forwarder RVA : kernelbase.GetPackagesByPackageFamily]
  708.   GetPhysicallyInstalledSystemMemory rva: 000026F0 ord: 706
  709.   GetPriorityClass rva: 00019800 ord: 707
  710.   GetPrivateProfileIntA rva: 000033D0 ord: 708
  711.   GetPrivateProfileIntW rva: 0000DEE0 ord: 709
  712.   GetPrivateProfileSectionA rva: 00061590 ord: 710
  713.   GetPrivateProfileSectionNamesA rva: 00061650 ord: 711
  714.   GetPrivateProfileSectionNamesW rva: 00061680 ord: 712
  715.   GetPrivateProfileSectionW rva: 0001DC60 ord: 713
  716.   GetPrivateProfileStringA rva: 00003440 ord: 714
  717.   GetPrivateProfileStringW rva: 0000D830 ord: 715
  718.   GetPrivateProfileStructA rva: 000616B0 ord: 716
  719.   GetPrivateProfileStructW rva: 00061850 ord: 717
  720.   GetProcAddress rva: 00013C10 ord: 718
  721.   GetProcessAffinityMask rva: 00015560 ord: 719
  722.   GetProcessDEPPolicy rva: 0003A680 ord: 720
  723.   GetProcessDefaultCpuSetMasks rva: 000A7228 ord: 721  [forwarder RVA : api-ms-win-core-processthreads-l1-1-6.GetProcessDe]
  724.   GetProcessDefaultCpuSets rva: 000A7284 ord: 722  [forwarder RVA : api-ms-win-core-processthreads-l1-1-3.GetProcessDe]
  725.   GetProcessGroupAffinity rva: 0003B7F0 ord: 723
  726.   GetProcessHandleCount rva: 00019D40 ord: 724
  727.   GetProcessHeap rva: 00010DD0 ord: 725
  728.   GetProcessHeaps rva: 0003B810 ord: 726
  729.   GetProcessId rva: 00016710 ord: 727
  730.   GetProcessIdOfThread rva: 00019600 ord: 728
  731.   GetProcessInformation rva: 00020180 ord: 729
  732.   GetProcessIoCounters rva: 000191C0 ord: 730
  733.   GetProcessMitigationPolicy rva: 000A7378 ord: 731  [forwarder RVA : api-ms-win-core-processthreads-l1-1-1.GetProcessMi]
  734.   GetProcessPreferredUILanguages rva: 0001E9A0 ord: 732
  735.   GetProcessPriorityBoost rva: 0003B830 ord: 733
  736.   GetProcessShutdownParameters rva: 0003B850 ord: 734
  737.   GetProcessTimes rva: 00014500 ord: 735
  738.   GetProcessVersion rva: 0003B870 ord: 736
  739.   GetProcessWorkingSetSize rva: 000201C0 ord: 737
  740.   GetProcessWorkingSetSizeEx rva: 00019DC0 ord: 738
  741.   GetProcessesInVirtualizationContext rva: 000213A0 ord: 739
  742.   GetProcessorSystemCycleTime rva: 000A74A3 ord: 740  [forwarder RVA : api-ms-win-core-sysinfo-l1-2-2.GetProcessorSystemC]
  743.   GetProductInfo rva: 00019400 ord: 741
  744.   GetProfileIntA rva: 000033C0 ord: 742
  745.   GetProfileIntW rva: 0000E170 ord: 743
  746.   GetProfileSectionA rva: 00061A00 ord: 744
  747.   GetProfileSectionW rva: 00027060 ord: 745
  748.   GetProfileStringA rva: 00061A10 ord: 746
  749.   GetProfileStringW rva: 0001EE20 ord: 747
  750.   GetQueuedCompletionStatus rva: 00010DB0 ord: 748
  751.   GetQueuedCompletionStatusEx rva: 00026990 ord: 749
  752.   GetShortPathNameA rva: 00062450 ord: 750
  753.   GetShortPathNameW rva: 0001EF10 ord: 751
  754.   GetStagedPackagePathByFullName rva: 000A75CE ord: 752  [forwarder RVA : kernelbase.GetStagedPackagePathByFullName]
  755.   GetStartupInfoA rva: 0001EAC0 ord: 753
  756.   GetStartupInfoW rva: 000172C0 ord: 754
  757.   GetStateFolder rva: 000A7627 ord: 755  [forwarder RVA : kernelbase.GetStateFolder]
  758.   GetStdHandle rva: 00017D00 ord: 756
  759.   GetStringScripts rva: 0003B890 ord: 757
  760.   GetStringTypeA rva: 0003B8B0 ord: 758
  761.   GetStringTypeExA rva: 0003B8B0 ord: 759
  762.   GetStringTypeExW rva: 0001E980 ord: 760
  763.   GetStringTypeW rva: 000180A0 ord: 761
  764.   GetSystemAppDataKey rva: 000A76B3 ord: 762  [forwarder RVA : kernelbase.GetSystemAppDataKey]
  765.   GetSystemCpuSetInformation rva: 000A76ED ord: 763  [forwarder RVA : api-ms-win-core-processthreads-l1-1-3.GetSystemCpu]
  766.   GetSystemDEPPolicy rva: 0003A6D0 ord: 764
  767.   GetSystemDefaultLCID rva: 00019760 ord: 765
  768.   GetSystemDefaultLangID rva: 00019BE0 ord: 766
  769.   GetSystemDefaultLocaleName rva: 00002450 ord: 767
  770.   GetSystemDefaultUILanguage rva: 000196E0 ord: 768
  771.   GetSystemDirectoryA rva: 0003B8D0 ord: 769
  772.   GetSystemDirectoryW rva: 00013CE0 ord: 770
  773.   GetSystemFileCacheSize rva: 0003B8E0 ord: 771
  774.   GetSystemFirmwareTable rva: 0001ED20 ord: 772
  775.   GetSystemInfo rva: 00016DC0 ord: 773
  776.   GetSystemPowerStatus rva: 00015BD0 ord: 774
  777.   GetSystemPreferredUILanguages rva: 00019C00 ord: 775
  778.   GetSystemRegistryQuota rva: 0003A710 ord: 776
  779.   GetSystemTime rva: 00018920 ord: 777
  780.   GetSystemTimeAdjustment rva: 00019C80 ord: 778
  781.   GetSystemTimeAsFileTime rva: 00011100 ord: 779
  782.   GetSystemTimePreciseAsFileTime rva: 00020980 ord: 780
  783.   GetSystemTimes rva: 00019880 ord: 781
  784.   GetSystemWindowsDirectoryA rva: 0003B900 ord: 782
  785.   GetSystemWindowsDirectoryW rva: 0001DD10 ord: 783
  786.   GetSystemWow64DirectoryA rva: 00020AF0 ord: 784
  787.   GetSystemWow64DirectoryW rva: 00020B00 ord: 785
  788.   GetTapeParameters rva: 00069610 ord: 786
  789.   GetTapePosition rva: 000434D0 ord: 787
  790.   GetTapeStatus rva: 00043560 ord: 788
  791.   GetTempFileNameA rva: 00020710 ord: 789
  792.   GetTempFileNameW rva: 00020720 ord: 790
  793.   GetTempPath2A rva: 00020730 ord: 791
  794.   GetTempPath2W rva: 00020740 ord: 792
  795.   GetTempPathA rva: 00020750 ord: 793
  796.   GetTempPathW rva: 00020760 ord: 794
  797.   GetThreadContext rva: 00019860 ord: 795
  798.   GetThreadDescription rva: 000A79D3 ord: 796  [forwarder RVA : api-ms-win-core-processthreads-l1-1-3.GetThreadDes]
  799.   GetThreadEnabledXStateFeatures rva: 0003B910 ord: 797
  800.   GetThreadErrorMode rva: 000269B0 ord: 798
  801.   GetThreadGroupAffinity rva: 0003B930 ord: 799
  802.   GetThreadIOPendingFlag rva: 000269D0 ord: 800
  803.   GetThreadId rva: 00019980 ord: 801
  804.   GetThreadIdealProcessorEx rva: 000110E0 ord: 802
  805.   GetThreadInformation rva: 00020190 ord: 803
  806.   GetThreadLocale rva: 000132D0 ord: 804
  807.   GetThreadPreferredUILanguages rva: 00016F20 ord: 805
  808.   GetThreadPriority rva: 000150D0 ord: 806
  809.   GetThreadPriorityBoost rva: 000269F0 ord: 807
  810.   GetThreadSelectedCpuSetMasks rva: 000A7B1D ord: 808  [forwarder RVA : api-ms-win-core-processthreads-l1-1-6.GetThreadSel]
  811.   GetThreadSelectedCpuSets rva: 000A7B79 ord: 809  [forwarder RVA : api-ms-win-core-processthreads-l1-1-3.GetThreadSel]
  812.   GetThreadSelectorEntry rva: 00069670 ord: 810
  813.   GetThreadTimes rva: 00013D70 ord: 811
  814.   GetThreadUILanguage rva: 00019D20 ord: 812
  815.   GetTickCount rva: 00010D60 ord: 813
  816.   GetTickCount64 rva: 00010CE0 ord: 814
  817.   GetTimeFormatA rva: 00026A10 ord: 815
  818.   GetTimeFormatAWorker rva: 0004D410 ord: 816
  819.   GetTimeFormatEx rva: 00026A30 ord: 817
  820.   GetTimeFormatW rva: 000198C0 ord: 818
  821.   GetTimeFormatWWorker rva: 00003730 ord: 819
  822.   GetTimeZoneInformation rva: 00019220 ord: 820
  823.   GetTimeZoneInformationForYear rva: 0003B950 ord: 821
  824.   GetUILanguageInfo rva: 0003B970 ord: 822
  825.   GetUmsCompletionListEvent rva: 000423F0 ord: 823
  826.   GetUmsSystemThreadInformation rva: 00042420 ord: 824
  827.   GetUserDefaultGeoName rva: 00002340 ord: 825
  828.   GetUserDefaultLCID rva: 000193C0 ord: 826
  829.   GetUserDefaultLangID rva: 000024F0 ord: 827
  830.   GetUserDefaultLocaleName rva: 00016FB0 ord: 828
  831.   GetUserDefaultUILanguage rva: 00019460 ord: 829
  832.   GetUserGeoID rva: 00015D20 ord: 830
  833.   GetUserPreferredUILanguages rva: 00019380 ord: 831
  834.   GetVDMCurrentDirectories rva: 00041870 ord: 832
  835.   GetVersion rva: 000194A0 ord: 833
  836.   GetVersionExA rva: 00018F40 ord: 834
  837.   GetVersionExW rva: 00018480 ord: 835
  838.   GetVolumeInformationA rva: 00020770 ord: 836
  839.   GetVolumeInformationByHandleW rva: 00020780 ord: 837
  840.   GetVolumeInformationW rva: 00020790 ord: 838
  841.   GetVolumeNameForVolumeMountPointA rva: 00067470 ord: 839
  842.   GetVolumeNameForVolumeMountPointW rva: 00020150 ord: 840
  843.   GetVolumePathNameA rva: 000169D0 ord: 841
  844.   GetVolumePathNameW rva: 000207A0 ord: 842
  845.   GetVolumePathNamesForVolumeNameA rva: 00067660 ord: 843
  846.   GetVolumePathNamesForVolumeNameW rva: 000207B0 ord: 844
  847.   GetWindowsDirectoryA rva: 00026A50 ord: 845
  848.   GetWindowsDirectoryW rva: 00019CA0 ord: 846
  849.   GetWriteWatch rva: 000148C0 ord: 847
  850.   GetXStateFeaturesMask rva: 0003B990 ord: 848
  851.   GlobalAddAtomA rva: 000035F0 ord: 849
  852.   GlobalAddAtomExA rva: 0005AAB0 ord: 850
  853.   GlobalAddAtomExW rva: 00004020 ord: 851
  854.   GlobalAddAtomW rva: 000042F0 ord: 852
  855.   GlobalAlloc rva: 00015CC0 ord: 853
  856.   GlobalCompact rva: 00038520 ord: 854
  857.   GlobalDeleteAtom rva: 00004040 ord: 855
  858.   GlobalFindAtomA rva: 00027040 ord: 856
  859.   GlobalFindAtomW rva: 00004930 ord: 857
  860.   GlobalFix rva: 00038540 ord: 858
  861.   GlobalFlags rva: 0003B9B0 ord: 859
  862.   GlobalFree rva: 00013C80 ord: 860
  863.   GlobalGetAtomNameA rva: 0005AAD0 ord: 861
  864.   GlobalGetAtomNameW rva: 00004090 ord: 862
  865.   GlobalHandle rva: 000026D0 ord: 863
  866.   GlobalLock rva: 00019320 ord: 864
  867.   GlobalMemoryStatus rva: 00016BF0 ord: 865
  868.   GlobalMemoryStatusEx rva: 00018AB0 ord: 866
  869.   GlobalReAlloc rva: 00019C60 ord: 867
  870.   GlobalSize rva: 00019BA0 ord: 868
  871.   GlobalUnWire rva: 00019300 ord: 869
  872.   GlobalUnfix rva: 00038570 ord: 870
  873.   GlobalUnlock rva: 00019300 ord: 871
  874.   GlobalWire rva: 00019320 ord: 872
  875.   Heap32First rva: 00065800 ord: 873
  876.   Heap32ListFirst rva: 00065AD0 ord: 874
  877.   Heap32ListNext rva: 00065BD0 ord: 875
  878.   Heap32Next rva: 00065CD0 ord: 876
  879.   HeapAlloc rva: 000A809E ord: 877  [forwarder RVA : NTDLL.RtlAllocateHeap]
  880.   HeapCompact rva: 00026A70 ord: 878
  881.   HeapCreate rva: 00018F20 ord: 879
  882.   HeapDestroy rva: 00019A80 ord: 880
  883.   HeapFree rva: 00010D10 ord: 881
  884.   HeapLock rva: 00026A90 ord: 882
  885.   HeapQueryInformation rva: 0003B9D0 ord: 883
  886.   HeapReAlloc rva: 000A810A ord: 884  [forwarder RVA : NTDLL.RtlReAllocateHeap]
  887.   HeapSetInformation rva: 00018F60 ord: 885
  888.   HeapSize rva: 000A813E ord: 886  [forwarder RVA : NTDLL.RtlSizeHeap]
  889.   HeapSummary rva: 0003B9F0 ord: 887
  890.   HeapUnlock rva: 00026AB0 ord: 888
  891.   HeapValidate rva: 000011B0 ord: 889
  892.   HeapWalk rva: 00026AD0 ord: 890
  893.   IdnToAscii rva: 0003BA10 ord: 891
  894.   IdnToNameprepUnicode rva: 0003BA30 ord: 892
  895.   IdnToUnicode rva: 0003BA50 ord: 893
  896.   InitAtomTable rva: 0005AB00 ord: 894
  897.   InitOnceBeginInitialize rva: 000A81D0 ord: 895  [forwarder RVA : api-ms-win-core-synch-l1-2-0.InitOnceBeginInitiali]
  898.   InitOnceComplete rva: 000A8216 ord: 896  [forwarder RVA : api-ms-win-core-synch-l1-2-0.InitOnceComplete]
  899.   InitOnceExecuteOnce rva: 000A8258 ord: 897  [forwarder RVA : api-ms-win-core-synch-l1-2-0.InitOnceExecuteOnce]
  900.   InitOnceInitialize rva: 000A829C ord: 898  [forwarder RVA : NTDLL.RtlRunOnceInitialize]
  901.   InitializeConditionVariable rva: 000A82D3 ord: 899  [forwarder RVA : NTDLL.RtlInitializeConditionVariable]
  902.   InitializeContext rva: 0003BA90 ord: 900
  903.   InitializeContext2 rva: 0003BA70 ord: 901
  904.   InitializeCriticalSection rva: 000A8337 ord: 902  [forwarder RVA : NTDLL.RtlInitializeCriticalSection]
  905.   InitializeCriticalSectionAndSpinCount rva: 000202E0 ord: 903
  906.   InitializeCriticalSectionEx rva: 000202F0 ord: 904
  907.   InitializeEnclave rva: 000A83AE ord: 905  [forwarder RVA : api-ms-win-core-enclave-l1-1-0.InitializeEnclave]
  908.   InitializeProcThreadAttributeList rva: 000A8401 ord: 906  [forwarder RVA : api-ms-win-core-processthreads-l1-1-0.InitializePr]
  909.   InitializeSListHead rva: 000A845D ord: 907  [forwarder RVA : NTDLL.RtlInitializeSListHead]
  910.   InitializeSRWLock rva: 000A848C ord: 908  [forwarder RVA : NTDLL.RtlInitializeSRWLock]
  911.   InitializeSynchronizationBarrier rva: 0003BAB0 ord: 909
  912.   InstallELAMCertificateInfo rva: 000A84E3 ord: 910  [forwarder RVA : api-ms-win-core-sysinfo-l1-2-1.InstallELAMCertific]
  913.   InterlockedFlushSList rva: 000A8533 ord: 911  [forwarder RVA : NTDLL.RtlInterlockedFlushSList]
  914.   InterlockedPopEntrySList rva: 000A856B ord: 912  [forwarder RVA : NTDLL.RtlInterlockedPopEntrySList]
  915.   InterlockedPushEntrySList rva: 000A85A7 ord: 913  [forwarder RVA : NTDLL.RtlInterlockedPushEntrySList]
  916.   InterlockedPushListSList rva: 000A85E3 ord: 914  [forwarder RVA : NTDLL.RtlInterlockedPushListSList]
  917.   InterlockedPushListSListEx rva: 000A8620 ord: 915  [forwarder RVA : NTDLL.RtlInterlockedPushListSListEx]
  918.   InvalidateConsoleDIBits rva: 0006C060 ord: 916
  919.   IsBadCodePtr rva: 000266C0 ord: 917
  920.   IsBadHugeReadPtr rva: 0003A7A0 ord: 918
  921.   IsBadHugeWritePtr rva: 0003A7B0 ord: 919
  922.   IsBadReadPtr rva: 00027770 ord: 920
  923.   IsBadStringPtrA rva: 000266E0 ord: 921
  924.   IsBadStringPtrW rva: 00026740 ord: 922
  925.   IsBadWritePtr rva: 00027800 ord: 923
  926.   IsCalendarLeapDay rva: 0004BD00 ord: 924
  927.   IsCalendarLeapMonth rva: 0004BE10 ord: 925
  928.   IsCalendarLeapYear rva: 0004BF30 ord: 926
  929.   IsDBCSLeadByte rva: 00026B10 ord: 927
  930.   IsDBCSLeadByteEx rva: 00026AF0 ord: 928
  931.   IsDebuggerPresent rva: 00017F20 ord: 929
  932.   IsEnclaveTypeSupported rva: 000A8749 ord: 930  [forwarder RVA : api-ms-win-core-enclave-l1-1-0.IsEnclaveTypeSuppor]
  933.   IsIoRingOpSupported rva: 000A8793 ord: 931  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.IsIoRingOpSupported]
  934.   IsNLSDefinedString rva: 0003BAD0 ord: 932
  935.   IsNativeVhdBoot rva: 000372D0 ord: 933
  936.   IsNormalizedString rva: 00026B30 ord: 934
  937.   IsProcessCritical rva: 000A880D ord: 935  [forwarder RVA : api-ms-win-core-processthreads-l1-1-2.IsProcessCri]
  938.   IsProcessInJob rva: 0001F5F0 ord: 936
  939.   IsProcessorFeaturePresent rva: 00016F40 ord: 937
  940.   IsSystemResumeAutomatic rva: 00027890 ord: 938
  941.   IsThreadAFiber rva: 00016920 ord: 939
  942.   IsThreadpoolTimerSet rva: 000A88AA ord: 940  [forwarder RVA : NTDLL.TpIsTimerSet]
  943.   IsUserCetAvailableInEnvironment rva: 000A88DD ord: 941  [forwarder RVA : api-ms-win-core-sysinfo-l1-2-6.IsUserCetAvailableI]
  944.   IsValidCalDateTime rva: 00003360 ord: 942
  945.   IsValidCodePage rva: 000189B0 ord: 943
  946.   IsValidLanguageGroup rva: 0003BAF0 ord: 944
  947.   IsValidLocale rva: 000191A0 ord: 945
  948.   IsValidLocaleName rva: 0003BB10 ord: 946
  949.   IsValidNLSVersion rva: 0003BB30 ord: 947
  950.   IsWow64GuestMachineSupported rva: 000A89A3 ord: 948  [forwarder RVA : api-ms-win-core-wow64-l1-1-2.IsWow64GuestMachineSu]
  951.   IsWow64Process rva: 00019580 ord: 949
  952.   IsWow64Process2 rva: 000A89FC ord: 950  [forwarder RVA : api-ms-win-core-wow64-l1-1-1.IsWow64Process2]
  953.   K32EmptyWorkingSet rva: 0003BB50 ord: 951
  954.   K32EnumDeviceDrivers rva: 0003BB70 ord: 952
  955.   K32EnumPageFilesA rva: 0003BB90 ord: 953
  956.   K32EnumPageFilesW rva: 0003BBB0 ord: 954
  957.   K32EnumProcessModules rva: 0001DD60 ord: 955
  958.   K32EnumProcessModulesEx rva: 00026B50 ord: 956
  959.   K32EnumProcesses rva: 00026B70 ord: 957
  960.   K32GetDeviceDriverBaseNameA rva: 0003BBD0 ord: 958
  961.   K32GetDeviceDriverBaseNameW rva: 0003BBF0 ord: 959
  962.   K32GetDeviceDriverFileNameA rva: 0003BC10 ord: 960
  963.   K32GetDeviceDriverFileNameW rva: 0003BC30 ord: 961
  964.   K32GetMappedFileNameA rva: 0003BC50 ord: 962
  965.   K32GetMappedFileNameW rva: 00019440 ord: 963
  966.   K32GetModuleBaseNameA rva: 00026B90 ord: 964
  967.   K32GetModuleBaseNameW rva: 00026BB0 ord: 965
  968.   K32GetModuleFileNameExA rva: 00026BD0 ord: 966
  969.   K32GetModuleFileNameExW rva: 000195A0 ord: 967
  970.   K32GetModuleInformation rva: 00018E00 ord: 968
  971.   K32GetPerformanceInfo rva: 00019DA0 ord: 969
  972.   K32GetProcessImageFileNameA rva: 00026BF0 ord: 970
  973.   K32GetProcessImageFileNameW rva: 00018C00 ord: 971
  974.   K32GetProcessMemoryInfo rva: 000195E0 ord: 972
  975.   K32GetWsChanges rva: 0003BC90 ord: 973
  976.   K32GetWsChangesEx rva: 0003BC70 ord: 974
  977.   K32InitializeProcessForWsWatch rva: 0003BCB0 ord: 975
  978.   K32QueryWorkingSet rva: 00019CC0 ord: 976
  979.   K32QueryWorkingSetEx rva: 0003BCD0 ord: 977
  980.   LCIDToLocaleName rva: 000193E0 ord: 978
  981.   LCMapStringA rva: 0003BCF0 ord: 979
  982.   LCMapStringEx rva: 0001DAC0 ord: 980
  983.   LCMapStringW rva: 00013290 ord: 981
  984.   LZClose rva: 0003D0E0 ord: 982
  985.   LZCloseFile rva: 0003D1B0 ord: 983
  986.   LZCopy rva: 00037400 ord: 984
  987.   LZCreateFileW rva: 0003D290 ord: 985
  988.   LZDone rva: 00037510 ord: 986
  989.   LZInit rva: 0003D3E0 ord: 987
  990.   LZOpenFileA rva: 0003D5B0 ord: 988
  991.   LZOpenFileW rva: 0003D6A0 ord: 989
  992.   LZRead rva: 0003D760 ord: 990
  993.   LZSeek rva: 0003DA00 ord: 991
  994.   LZStart rva: 00019E00 ord: 992
  995.   LeaveCriticalSection rva: 000A8D46 ord: 993  [forwarder RVA : NTDLL.RtlLeaveCriticalSection]
  996.   LeaveCriticalSectionWhenCallbackReturns rva: 000A8D8C ord: 994  [forwarder RVA : NTDLL.TpCallbackLeaveCriticalSectionOnCompletion]
  997.   LoadAppInitDlls rva: 00012DB0 ord: 995
  998.   LoadEnclaveData rva: 000A8DDD ord: 996  [forwarder RVA : api-ms-win-core-enclave-l1-1-0.LoadEnclaveData]
  999.   LoadLibraryA rva: 000192C0 ord: 997
  1000.   LoadLibraryExA rva: 00018050 ord: 998
  1001.   LoadLibraryExW rva: 00013D90 ord: 999
  1002.   LoadLibraryW rva: 00018BE0 ord:1000
  1003.   LoadModule rva: 00068060 ord:1001
  1004.   LoadPackagedLibrary rva: 00020960 ord:1002
  1005.   LoadResource rva: 00013350 ord:1003
  1006.   LoadStringBaseExW rva: 0003BD10 ord:1004
  1007.   LoadStringBaseW rva: 00039340 ord:1005
  1008.   LocalAlloc rva: 00014790 ord:1006
  1009.   LocalCompact rva: 00039200 ord:1007
  1010.   LocalFileTimeToFileTime rva: 000207C0 ord:1008
  1011.   LocalFileTimeToLocalSystemTime rva: 000A8EE1 ord:1009  [forwarder RVA : api-ms-win-core-timezone-l1-1-1.LocalFileTimeToLoc]
  1012.   LocalFlags rva: 0003BD30 ord:1010
  1013.   LocalFree rva: 000132F0 ord:1011
  1014.   LocalHandle rva: 00039220 ord:1012
  1015.   LocalLock rva: 00026C10 ord:1013
  1016.   LocalReAlloc rva: 00018A50 ord:1014
  1017.   LocalShrink rva: 00039320 ord:1015
  1018.   LocalSize rva: 00019C40 ord:1016
  1019.   LocalSystemTimeToLocalFileTime rva: 000A8F8D ord:1017  [forwarder RVA : api-ms-win-core-timezone-l1-1-1.LocalSystemTimeToL]
  1020.   LocalUnlock rva: 00026C30 ord:1018
  1021.   LocaleNameToLCID rva: 00016FD0 ord:1019
  1022.   LocateXStateFeature rva: 0003BD50 ord:1020
  1023.   LockFile rva: 000207D0 ord:1021
  1024.   LockFileEx rva: 000207E0 ord:1022
  1025.   LockResource rva: 00013370 ord:1023
  1026.   MapUserPhysicalPages rva: 0003BD70 ord:1024
  1027.   MapUserPhysicalPagesScatter rva: 00043F20 ord:1025
  1028.   MapViewOfFile rva: 00016250 ord:1026
  1029.   MapViewOfFileEx rva: 00016FF0 ord:1027
  1030.   MapViewOfFileExNuma rva: 0003BD90 ord:1028
  1031.   MapViewOfFileFromApp rva: 000A9096 ord:1029  [forwarder RVA : api-ms-win-core-memory-l1-1-1.MapViewOfFileFromApp]
  1032.   Module32First rva: 00065F90 ord:1030
  1033.   Module32FirstW rva: 000016D0 ord:1031
  1034.   Module32Next rva: 00027330 ord:1032
  1035.   Module32NextW rva: 00001010 ord:1033
  1036.   MoveFileA rva: 00064EE0 ord:1034
  1037.   MoveFileExA rva: 00027300 ord:1035
  1038.   MoveFileExW rva: 0001EE50 ord:1036
  1039.   MoveFileTransactedA rva: 00064F10 ord:1037
  1040.   MoveFileTransactedW rva: 00065000 ord:1038
  1041.   MoveFileW rva: 000196B0 ord:1039
  1042.   MoveFileWithProgressA rva: 000650F0 ord:1040
  1043.   MoveFileWithProgressW rva: 0003BDB0 ord:1041
  1044.   MulDiv rva: 00020930 ord:1042
  1045.   MultiByteToWideChar rva: 00010D40 ord:1043
  1046.   NeedCurrentDirectoryForExePathA rva: 0003BDD0 ord:1044
  1047.   NeedCurrentDirectoryForExePathW rva: 0003BDF0 ord:1045
  1048.   NlsCheckPolicy rva: 00020BA0 ord:1046
  1049.   NlsGetCacheUpdateCount rva: 00020BB0 ord:1047
  1050.   NlsUpdateLocale rva: 00020BC0 ord:1048
  1051.   NlsUpdateSystemLocale rva: 00020BD0 ord:1049
  1052.   NormalizeString rva: 00026C50 ord:1050
  1053.   NotifyMountMgr rva: 0003BE10 ord:1051
  1054.   NotifyUILanguageChange rva: 0004F5F0 ord:1052
  1055.   NtVdm64CreateProcessInternalW rva: 0003A7C0 ord:1053
  1056.   OOBEComplete rva: 00016330 ord:1054
  1057.   OfferVirtualMemory rva: 000A929C ord:1055  [forwarder RVA : api-ms-win-core-memory-l1-1-2.OfferVirtualMemory]
  1058.   OpenConsoleW rva: 0006B410 ord:1056
  1059.   OpenConsoleWStub rva: 0003BE30 ord:1057
  1060.   OpenEventA rva: 00020300 ord:1058
  1061.   OpenEventW rva: 00020310 ord:1059
  1062.   OpenFile rva: 000634B0 ord:1060
  1063.   OpenFileById rva: 00026C70 ord:1061
  1064.   OpenFileMappingA rva: 000270B0 ord:1062
  1065.   OpenFileMappingW rva: 00019260 ord:1063
  1066.   OpenJobObjectA rva: 0005CC20 ord:1064
  1067.   OpenJobObjectW rva: 0005CCA0 ord:1065
  1068.   OpenMutexA rva: 00064580 ord:1066
  1069.   OpenMutexW rva: 00020320 ord:1067
  1070.   OpenPackageInfoByFullName rva: 000A9387 ord:1068  [forwarder RVA : kernelbase.OpenPackageInfoByFullName]
  1071.   OpenPrivateNamespaceA rva: 00062E40 ord:1069
  1072.   OpenPrivateNamespaceW rva: 0003BE40 ord:1070
  1073.   OpenProcess rva: 00014730 ord:1071
  1074.   OpenProcessToken rva: 000A93F5 ord:1072  [forwarder RVA : api-ms-win-core-processthreads-l1-1-0.OpenProcessT]
  1075.   OpenProfileUserMapping rva: 00019E00 ord:1073
  1076.   OpenSemaphoreA rva: 00064600 ord:1074
  1077.   OpenSemaphoreW rva: 00020330 ord:1075
  1078.   OpenState rva: 000A946B ord:1076  [forwarder RVA : kernelbase.OpenState]
  1079.   OpenStateExplicit rva: 000A9492 ord:1077  [forwarder RVA : kernelbase.OpenStateExplicit]
  1080.   OpenThread rva: 000169B0 ord:1078
  1081.   OpenThreadToken rva: 000A94CA ord:1079  [forwarder RVA : api-ms-win-core-processthreads-l1-1-0.OpenThreadTo]
  1082.   OpenWaitableTimerA rva: 00064680 ord:1080
  1083.   OpenWaitableTimerW rva: 00020340 ord:1081
  1084.   OutputDebugStringA rva: 00019720 ord:1082
  1085.   OutputDebugStringW rva: 00019640 ord:1083
  1086.   PackageFamilyNameFromFullName rva: 000A956A ord:1084  [forwarder RVA : kernelbase.PackageFamilyNameFromFullName]
  1087.   PackageFamilyNameFromId rva: 000A95AB ord:1085  [forwarder RVA : kernelbase.PackageFamilyNameFromId]
  1088.   PackageFullNameFromId rva: 000A95E4 ord:1086  [forwarder RVA : kernelbase.PackageFullNameFromId]
  1089.   PackageIdFromFullName rva: 000A961B ord:1087  [forwarder RVA : kernelbase.PackageIdFromFullName]
  1090.   PackageNameAndPublisherIdFromFamilyName rva: 000A9664 ord:1088  [forwarder RVA : kernelbase.PackageNameAndPublisherIdFromFamilyName]
  1091.   ParseApplicationUserModelId rva: 000A96B3 ord:1089  [forwarder RVA : kernelbase.ParseApplicationUserModelId]
  1092.   PeekConsoleInputA rva: 00020C70 ord:1090
  1093.   PeekConsoleInputW rva: 00020C80 ord:1091
  1094.   PeekNamedPipe rva: 00026C90 ord:1092
  1095.   PopIoRingCompletion rva: 000A9720 ord:1093  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.PopIoRingCompletion]
  1096.   PostQueuedCompletionStatus rva: 000147B0 ord:1094
  1097.   PowerClearRequest rva: 00018C20 ord:1095
  1098.   PowerCreateRequest rva: 00018170 ord:1096
  1099.   PowerSetRequest rva: 00018B50 ord:1097
  1100.   PrefetchVirtualMemory rva: 000A97B8 ord:1098  [forwarder RVA : api-ms-win-core-memory-l1-1-1.PrefetchVirtualMemor]
  1101.   PrepareTape rva: 00043590 ord:1099
  1102.   PrivCopyFileExW rva: 0001E960 ord:1100
  1103.   PrivMoveFileIdentityW rva: 00065200 ord:1101
  1104.   Process32First rva: 00027470 ord:1102
  1105.   Process32FirstW rva: 00018CB0 ord:1103
  1106.   Process32Next rva: 00027570 ord:1104
  1107.   Process32NextW rva: 00014550 ord:1105
  1108.   ProcessIdToSessionId rva: 000155F0 ord:1106
  1109.   PssCaptureSnapshot rva: 0003BE60 ord:1107
  1110.   PssDuplicateSnapshot rva: 0003BE80 ord:1108
  1111.   PssFreeSnapshot rva: 0003BEA0 ord:1109
  1112.   PssQuerySnapshot rva: 0003BEC0 ord:1110
  1113.   PssWalkMarkerCreate rva: 0003BEE0 ord:1111
  1114.   PssWalkMarkerFree rva: 0003BF00 ord:1112
  1115.   PssWalkMarkerGetPosition rva: 0003BF20 ord:1113
  1116.   PssWalkMarkerRewind rva: 0003BF40 ord:1114
  1117.   PssWalkMarkerSeek rva: 0003BF60 ord:1115
  1118.   PssWalkMarkerSeekToBeginning rva: 0003BF40 ord:1116
  1119.   PssWalkMarkerSetPosition rva: 0003BF60 ord:1117
  1120.   PssWalkMarkerTell rva: 0003BF20 ord:1118
  1121.   PssWalkSnapshot rva: 0003BF80 ord:1119
  1122.   PulseEvent rva: 00016730 ord:1120
  1123.   PurgeComm rva: 00020A60 ord:1121
  1124.   QueryActCtxSettingsW rva: 0003BFA0 ord:1122
  1125.   QueryActCtxSettingsWWorker rva: 00004770 ord:1123
  1126.   QueryActCtxW rva: 00017D80 ord:1124
  1127.   QueryActCtxWWorker rva: 00003EC0 ord:1125
  1128.   QueryDepthSList rva: 000A99EA ord:1126  [forwarder RVA : NTDLL.RtlQueryDepthSList]
  1129.   QueryDosDeviceA rva: 00066290 ord:1127
  1130.   QueryDosDeviceW rva: 000207F0 ord:1128
  1131.   QueryFullProcessImageNameA rva: 00026CB0 ord:1129
  1132.   QueryFullProcessImageNameW rva: 00016040 ord:1130
  1133.   QueryIdleProcessorCycleTime rva: 0003BFE0 ord:1131
  1134.   QueryIdleProcessorCycleTimeEx rva: 0003BFC0 ord:1132
  1135.   QueryInformationJobObject rva: 000172E0 ord:1133
  1136.   QueryIoRateControlInformationJobObject rva: 0005CD70 ord:1134
  1137.   QueryIoRingCapabilities rva: 000A9AEC ord:1135  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.QueryIoRingCapabilit]
  1138.   QueryMemoryResourceNotification rva: 00026CD0 ord:1136
  1139.   QueryPerformanceCounter rva: 00010E50 ord:1137
  1140.   QueryPerformanceFrequency rva: 00014470 ord:1138
  1141.   QueryProcessAffinityUpdateMode rva: 0003C000 ord:1139
  1142.   QueryProcessCycleTime rva: 00019840 ord:1140
  1143.   QueryProtectedPolicy rva: 000A9BBE ord:1141  [forwarder RVA : api-ms-win-core-processthreads-l1-1-2.QueryProtect]
  1144.   QueryThreadCycleTime rva: 00019120 ord:1142
  1145.   QueryThreadProfiling rva: 000440C0 ord:1143
  1146.   QueryThreadpoolStackInformation rva: 0003C020 ord:1144
  1147.   QueryUmsThreadInformation rva: 00042450 ord:1145
  1148.   QueryUnbiasedInterruptTime rva: 00015520 ord:1146
  1149.   QueueUserAPC rva: 00017C50 ord:1147
  1150.   QueueUserAPC2 rva: 000A9C93 ord:1148  [forwarder RVA : api-ms-win-core-processthreads-l1-1-5.QueueUserAPC]
  1151.   QueueUserWorkItem rva: 000197A0 ord:1149
  1152.   QuirkGetData2Worker rva: 00072F90 ord:1150
  1153.   QuirkGetDataWorker rva: 00073060 ord:1151
  1154.   QuirkIsEnabled2Worker rva: 00073120 ord:1152
  1155.   QuirkIsEnabled3Worker rva: 00010F00 ord:1153
  1156.   QuirkIsEnabledForPackage2Worker rva: 00027B20 ord:1154
  1157.   QuirkIsEnabledForPackage3Worker rva: 000055B0 ord:1155
  1158.   QuirkIsEnabledForPackage4Worker rva: 00005600 ord:1156
  1159.   QuirkIsEnabledForPackageWorker rva: 00003610 ord:1157
  1160.   QuirkIsEnabledForProcessWorker rva: 00001210 ord:1158
  1161.   QuirkIsEnabledWorker rva: 000050C0 ord:1159
  1162.   RaiseException rva: 00018030 ord:1160
  1163.   RaiseFailFastException rva: 000A9E05 ord:1161  [forwarder RVA : kernelbase.RaiseFailFastException]
  1164.   RaiseInvalid16BitExeError rva: 0003A9E0 ord:1162
  1165.   ReOpenFile rva: 0003C060 ord:1163
  1166.   ReadConsoleA rva: 00020C90 ord:1164
  1167.   ReadConsoleInputA rva: 00020CA0 ord:1165
  1168.   ReadConsoleInputExA rva: 000A9E7F ord:1166  [forwarder RVA : kernelbase.ReadConsoleInputExA]
  1169.   ReadConsoleInputExW rva: 000A9EB2 ord:1167  [forwarder RVA : kernelbase.ReadConsoleInputExW]
  1170.   ReadConsoleInputW rva: 00020CB0 ord:1168
  1171.   ReadConsoleOutputA rva: 00020E00 ord:1169
  1172.   ReadConsoleOutputAttribute rva: 00020E10 ord:1170
  1173.   ReadConsoleOutputCharacterA rva: 00020E20 ord:1171
  1174.   ReadConsoleOutputCharacterW rva: 00020E30 ord:1172
  1175.   ReadConsoleOutputW rva: 00020E40 ord:1173
  1176.   ReadConsoleW rva: 00020CC0 ord:1174
  1177.   ReadDirectoryChangesExW rva: 0003C080 ord:1175
  1178.   ReadDirectoryChangesW rva: 0001F6D0 ord:1176
  1179.   ReadFile rva: 00020800 ord:1177
  1180.   ReadFileEx rva: 00020810 ord:1178
  1181.   ReadFileScatter rva: 00020820 ord:1179
  1182.   ReadProcessMemory rva: 00015270 ord:1180
  1183.   ReadThreadProfilingData rva: 00044100 ord:1181
  1184.   ReclaimVirtualMemory rva: 000A9FFA ord:1182  [forwarder RVA : api-ms-win-core-memory-l1-1-2.ReclaimVirtualMemory]
  1185.   RegCloseKey rva: 00026CF0 ord:1183
  1186.   RegCopyTreeW rva: 0003C0A0 ord:1184
  1187.   RegCreateKeyExA rva: 0003C0C0 ord:1185
  1188.   RegCreateKeyExW rva: 000195C0 ord:1186
  1189.   RegDeleteKeyExA rva: 0003C0E0 ord:1187
  1190.   RegDeleteKeyExW rva: 0003C100 ord:1188
  1191.   RegDeleteTreeA rva: 0003C120 ord:1189
  1192.   RegDeleteTreeW rva: 0003C140 ord:1190
  1193.   RegDeleteValueA rva: 0003C160 ord:1191
  1194.   RegDeleteValueW rva: 0003C180 ord:1192
  1195.   RegDisablePredefinedCacheEx rva: 0003C1A0 ord:1193
  1196.   RegEnumKeyExA rva: 0003C1C0 ord:1194
  1197.   RegEnumKeyExW rva: 0003C210 ord:1195
  1198.   RegEnumValueA rva: 0003C260 ord:1196
  1199.   RegEnumValueW rva: 0003C2B0 ord:1197
  1200.   RegFlushKey rva: 0003C300 ord:1198
  1201.   RegGetKeySecurity rva: 0003C320 ord:1199
  1202.   RegGetValueA rva: 0003C340 ord:1200
  1203.   RegGetValueW rva: 00026D10 ord:1201
  1204.   RegLoadKeyA rva: 0003C360 ord:1202
  1205.   RegLoadKeyW rva: 0003C380 ord:1203
  1206.   RegLoadMUIStringA rva: 0003C3A0 ord:1204
  1207.   RegLoadMUIStringW rva: 00026D30 ord:1205
  1208.   RegNotifyChangeKeyValue rva: 0003C3C0 ord:1206
  1209.   RegOpenCurrentUser rva: 00019CE0 ord:1207
  1210.   RegOpenKeyExA rva: 00026D50 ord:1208
  1211.   RegOpenKeyExW rva: 00002680 ord:1209
  1212.   RegOpenUserClassesRoot rva: 00002570 ord:1210
  1213.   RegQueryInfoKeyA rva: 0003C3E0 ord:1211
  1214.   RegQueryInfoKeyW rva: 0003C470 ord:1212
  1215.   RegQueryValueExA rva: 0003C500 ord:1213
  1216.   RegQueryValueExW rva: 00026D70 ord:1214
  1217.   RegRestoreKeyA rva: 0003C520 ord:1215
  1218.   RegRestoreKeyW rva: 0003C540 ord:1216
  1219.   RegSaveKeyExA rva: 0003C560 ord:1217
  1220.   RegSaveKeyExW rva: 0003C580 ord:1218
  1221.   RegSetKeySecurity rva: 0003C5A0 ord:1219
  1222.   RegSetValueExA rva: 0003C5C0 ord:1220
  1223.   RegSetValueExW rva: 000198E0 ord:1221
  1224.   RegUnLoadKeyA rva: 0003C5E0 ord:1222
  1225.   RegUnLoadKeyW rva: 0003C600 ord:1223
  1226.   RegisterApplicationRecoveryCallback rva: 00043E30 ord:1224
  1227.   RegisterApplicationRestart rva: 00019D80 ord:1225
  1228.   RegisterBadMemoryNotification rva: 0003C620 ord:1226
  1229.   RegisterConsoleIME rva: 0006BB00 ord:1227
  1230.   RegisterConsoleOS2 rva: 0006BB30 ord:1228
  1231.   RegisterConsoleVDM rva: 0006B560 ord:1229
  1232.   RegisterWaitForInputIdle rva: 000188C0 ord:1230
  1233.   RegisterWaitForSingleObject rva: 00014860 ord:1231
  1234.   RegisterWaitForSingleObjectEx rva: 00019D00 ord:1232
  1235.   RegisterWaitUntilOOBECompleted rva: 00016270 ord:1233
  1236.   RegisterWowBaseHandlers rva: 000385A0 ord:1234
  1237.   RegisterWowExec rva: 00041E30 ord:1235
  1238.   ReleaseActCtx rva: 00019A60 ord:1236
  1239.   ReleaseActCtxWorker rva: 000166D0 ord:1237
  1240.   ReleaseMutex rva: 00020350 ord:1238
  1241.   ReleaseMutexWhenCallbackReturns rva: 000AA433 ord:1239  [forwarder RVA : NTDLL.TpCallbackReleaseMutexOnCompletion]
  1242.   ReleasePackageVirtualizationContext rva: 000213C0 ord:1240
  1243.   ReleaseSRWLockExclusive rva: 000AA498 ord:1241  [forwarder RVA : NTDLL.RtlReleaseSRWLockExclusive]
  1244.   ReleaseSRWLockShared rva: 000AA4CE ord:1242  [forwarder RVA : NTDLL.RtlReleaseSRWLockShared]
  1245.   ReleaseSemaphore rva: 00020360 ord:1243
  1246.   ReleaseSemaphoreWhenCallbackReturns rva: 000AA521 ord:1244  [forwarder RVA : NTDLL.TpCallbackReleaseSemaphoreOnCompletion]
  1247.   RemoveDirectoryA rva: 00020830 ord:1245
  1248.   RemoveDirectoryTransactedA rva: 00037830 ord:1246
  1249.   RemoveDirectoryTransactedW rva: 00064080 ord:1247
  1250.   RemoveDirectoryW rva: 00020840 ord:1248
  1251.   RemoveDllDirectory rva: 000AA5B9 ord:1249  [forwarder RVA : api-ms-win-core-libraryloader-l1-1-0.RemoveDllDire]
  1252.   RemoveLocalAlternateComputerNameA rva: 0005BF30 ord:1250
  1253.   RemoveLocalAlternateComputerNameW rva: 0005BF90 ord:1251
  1254.   RemoveSecureMemoryCacheCallback rva: 000385C0 ord:1252
  1255.   RemoveVectoredContinueHandler rva: 000AA673 ord:1253  [forwarder RVA : NTDLL.RtlRemoveVectoredContinueHandler]
  1256.   RemoveVectoredExceptionHandler rva: 000AA6B9 ord:1254  [forwarder RVA : NTDLL.RtlRemoveVectoredExceptionHandler]
  1257.   ReplaceFile rva: 00019480 ord:1255
  1258.   ReplaceFileA rva: 00063A40 ord:1256
  1259.   ReplaceFileW rva: 00019480 ord:1257
  1260.   ReplacePartitionUnit rva: 0003ABD0 ord:1258
  1261.   RequestDeviceWakeup rva: 00039C70 ord:1259
  1262.   RequestWakeupLatency rva: 00068850 ord:1260
  1263.   ResetEvent rva: 00020370 ord:1261
  1264.   ResetWriteWatch rva: 00015D00 ord:1262
  1265.   ResizePseudoConsole rva: 00020CD0 ord:1263
  1266.   ResolveDelayLoadedAPI rva: 000AA78A ord:1264  [forwarder RVA : NTDLL.LdrResolveDelayLoadedAPI]
  1267.   ResolveDelayLoadsFromDll rva: 000AA7C2 ord:1265  [forwarder RVA : NTDLL.LdrResolveDelayLoadsFromDll]
  1268.   ResolveLocaleName rva: 00019420 ord:1266
  1269.   RestoreLastError rva: 000AA807 ord:1267  [forwarder RVA : NTDLL.RtlRestoreLastWin32Error]
  1270.   ResumeThread rva: 00017BF0 ord:1268
  1271.   RtlAddFunctionTable rva: 0003C640 ord:1269
  1272.   RtlCaptureContext rva: 0001FF90 ord:1270
  1273.   RtlCaptureStackBackTrace rva: 000AA872 ord:1271  [forwarder RVA : NTDLL.RtlCaptureStackBackTrace]
  1274.   RtlCompareMemory rva: 00026D90 ord:1272
  1275.   RtlCopyMemory rva: 0003C660 ord:1273
  1276.   RtlDeleteFunctionTable rva: 0003C670 ord:1274
  1277.   RtlFillMemory rva: 00026DB0 ord:1275
  1278.   RtlInstallFunctionTableCallback rva: 0003C690 ord:1276
  1279.   RtlIsEcCode rva: 000AA901 ord:1277  [forwarder RVA : NTDLL.RtlIsEcCode]
  1280.   RtlLookupFunctionEntry rva: 00015540 ord:1278
  1281.   RtlMoveMemory rva: 0001FFC0 ord:1279
  1282.   RtlPcToFileHeader rva: 00019090 ord:1280
  1283.   RtlRaiseException rva: 0003C6B0 ord:1281
  1284.   RtlRestoreContext rva: 00026DD0 ord:1282
  1285.   RtlUnwind rva: 00026DF0 ord:1283
  1286.   RtlUnwindEx rva: 00018150 ord:1284
  1287.   RtlVirtualUnwind rva: 00013BA0 ord:1285
  1288.   RtlVirtualUnwind2 rva: 0003C6D0 ord:1286
  1289.   RtlZeroMemory rva: 000AA9B5 ord:1287  [forwarder RVA : NTDLL.RtlZeroMemory]
  1290.   ScrollConsoleScreenBufferA rva: 00020E50 ord:1288
  1291.   ScrollConsoleScreenBufferW rva: 00020E60 ord:1289
  1292.   SearchPathA rva: 0003C760 ord:1290
  1293.   SearchPathW rva: 00026E10 ord:1291
  1294.   SetCachedSigningLevel rva: 0003C780 ord:1292
  1295.   SetCalendarInfoA rva: 0004D880 ord:1293
  1296.   SetCalendarInfoW rva: 0003C7A0 ord:1294
  1297.   SetComPlusPackageInstallStatus rva: 00043CC0 ord:1295
  1298.   SetCommBreak rva: 00020A70 ord:1296
  1299.   SetCommConfig rva: 00020A80 ord:1297
  1300.   SetCommMask rva: 00020A90 ord:1298
  1301.   SetCommState rva: 00020AA0 ord:1299
  1302.   SetCommTimeouts rva: 00020AB0 ord:1300
  1303.   SetComputerNameA rva: 0003C7C0 ord:1301
  1304.   SetComputerNameEx2W rva: 0003C7E0 ord:1302
  1305.   SetComputerNameExA rva: 0003C800 ord:1303
  1306.   SetComputerNameExW rva: 0003C820 ord:1304
  1307.   SetComputerNameW rva: 0003C840 ord:1305
  1308.   SetConsoleActiveScreenBuffer rva: 00020E70 ord:1306
  1309.   SetConsoleCP rva: 00020E80 ord:1307
  1310.   SetConsoleCtrlHandler rva: 00020CE0 ord:1308
  1311.   SetConsoleCursor rva: 0006B610 ord:1309
  1312.   SetConsoleCursorInfo rva: 00020E90 ord:1310
  1313.   SetConsoleCursorMode rva: 0006BB90 ord:1311
  1314.   SetConsoleCursorPosition rva: 00020EA0 ord:1312
  1315.   SetConsoleDisplayMode rva: 00021140 ord:1313
  1316.   SetConsoleFont rva: 0006BF90 ord:1314
  1317.   SetConsoleHardwareState rva: 0006B670 ord:1315
  1318.   SetConsoleHistoryInfo rva: 00021150 ord:1316
  1319.   SetConsoleIcon rva: 0006BFF0 ord:1317
  1320.   SetConsoleInputExeNameA rva: 000AAC1C ord:1318  [forwarder RVA : kernelbase.SetConsoleInputExeNameA]
  1321.   SetConsoleInputExeNameW rva: 000AAC57 ord:1319  [forwarder RVA : kernelbase.SetConsoleInputExeNameW]
  1322.   SetConsoleKeyShortcuts rva: 0006B6D0 ord:1320
  1323.   SetConsoleLocalEUDC rva: 0006BC00 ord:1321
  1324.   SetConsoleMaximumWindowSize rva: 0006C050 ord:1322
  1325.   SetConsoleMenuClose rva: 0006B770 ord:1323
  1326.   SetConsoleMode rva: 00020CF0 ord:1324
  1327.   SetConsoleNlsMode rva: 0006BCC0 ord:1325
  1328.   SetConsoleNumberOfCommandsA rva: 00021160 ord:1326
  1329.   SetConsoleNumberOfCommandsW rva: 00021170 ord:1327
  1330.   SetConsoleOS2OemFormat rva: 0006BD20 ord:1328
  1331.   SetConsoleOutputCP rva: 00020EB0 ord:1329
  1332.   SetConsolePalette rva: 0006B7D0 ord:1330
  1333.   SetConsoleScreenBufferInfoEx rva: 00020EC0 ord:1331
  1334.   SetConsoleScreenBufferSize rva: 00020ED0 ord:1332
  1335.   SetConsoleTextAttribute rva: 00020EE0 ord:1333
  1336.   SetConsoleTitleA rva: 00020EF0 ord:1334
  1337.   SetConsoleTitleW rva: 00020F00 ord:1335
  1338.   SetConsoleWindowInfo rva: 00020F10 ord:1336
  1339.   SetCriticalSectionSpinCount rva: 000AAE0D ord:1337  [forwarder RVA : NTDLL.RtlSetCriticalSectionSpinCount]
  1340.   SetCurrentConsoleFontEx rva: 00021180 ord:1338
  1341.   SetCurrentDirectoryA rva: 0003C860 ord:1339
  1342.   SetCurrentDirectoryW rva: 00002550 ord:1340
  1343.   SetDefaultCommConfigA rva: 0003E640 ord:1341
  1344.   SetDefaultCommConfigW rva: 0003E6F0 ord:1342
  1345.   SetDefaultDllDirectories rva: 000AAEB9 ord:1343  [forwarder RVA : api-ms-win-core-libraryloader-l1-1-0.SetDefaultDll]
  1346.   SetDllDirectoryA rva: 00067E30 ord:1344
  1347.   SetDllDirectoryW rva: 000194E0 ord:1345
  1348.   SetDynamicTimeZoneInformation rva: 0003C880 ord:1346
  1349.   SetEndOfFile rva: 00020850 ord:1347
  1350.   SetEnvironmentStringsA rva: 00069740 ord:1348
  1351.   SetEnvironmentStringsW rva: 0003C8A0 ord:1349
  1352.   SetEnvironmentVariableA rva: 0003C8C0 ord:1350
  1353.   SetEnvironmentVariableW rva: 00017DC0 ord:1351
  1354.   SetErrorMode rva: 00015B80 ord:1352
  1355.   SetEvent rva: 00020380 ord:1353
  1356.   SetEventWhenCallbackReturns rva: 000AAFD4 ord:1354  [forwarder RVA : NTDLL.TpCallbackSetEventOnCompletion]
  1357.   SetFileApisToANSI rva: 0003C8E0 ord:1355
  1358.   SetFileApisToOEM rva: 0003C900 ord:1356
  1359.   SetFileAttributesA rva: 00020860 ord:1357
  1360.   SetFileAttributesTransactedA rva: 000656D0 ord:1358
  1361.   SetFileAttributesTransactedW rva: 00065730 ord:1359
  1362.   SetFileAttributesW rva: 00020870 ord:1360
  1363.   SetFileBandwidthReservation rva: 00037C00 ord:1361
  1364.   SetFileCompletionNotificationModes rva: 00017D20 ord:1362
  1365.   SetFileInformationByHandle rva: 00020880 ord:1363
  1366.   SetFileIoOverlappedRange rva: 0003C920 ord:1364
  1367.   SetFilePointer rva: 00020890 ord:1365
  1368.   SetFilePointerEx rva: 000208A0 ord:1366
  1369.   SetFileShortNameA rva: 00037D40 ord:1367
  1370.   SetFileShortNameW rva: 00037D90 ord:1368
  1371.   SetFileTime rva: 000208B0 ord:1369
  1372.   SetFileValidData rva: 000208C0 ord:1370
  1373.   SetFirmwareEnvironmentVariableA rva: 00068A20 ord:1371
  1374.   SetFirmwareEnvironmentVariableExA rva: 00068A40 ord:1372
  1375.   SetFirmwareEnvironmentVariableExW rva: 00068B70 ord:1373
  1376.   SetFirmwareEnvironmentVariableW rva: 00068C50 ord:1374
  1377.   SetHandleCount rva: 0001F730 ord:1375
  1378.   SetHandleInformation rva: 00020210 ord:1376
  1379.   SetInformationJobObject rva: 00016CE0 ord:1377
  1380.   SetIoRateControlInformationJobObject rva: 0005D0A0 ord:1378
  1381.   SetIoRingCompletionEvent rva: 000AB24E ord:1379  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.SetIoRingCompletionE]
  1382.   SetLastConsoleEventActive rva: 000AB29F ord:1380  [forwarder RVA : kernelbase.SetLastConsoleEventActive]
  1383.   SetLastError rva: 000110C0 ord:1381
  1384.   SetLocalPrimaryComputerNameA rva: 0005C1E0 ord:1382
  1385.   SetLocalPrimaryComputerNameW rva: 0005C240 ord:1383
  1386.   SetLocalTime rva: 0003C940 ord:1384
  1387.   SetLocaleInfoA rva: 0004D970 ord:1385
  1388.   SetLocaleInfoW rva: 0003C960 ord:1386
  1389.   SetMailslotInfo rva: 00064500 ord:1387
  1390.   SetMessageWaitingIndicator rva: 00039C90 ord:1388
  1391.   SetNamedPipeAttribute rva: 00039760 ord:1389
  1392.   SetNamedPipeHandleState rva: 000025B0 ord:1390
  1393.   SetPriorityClass rva: 000198A0 ord:1391
  1394.   SetProcessAffinityMask rva: 000685B0 ord:1392
  1395.   SetProcessAffinityUpdateMode rva: 0001EE70 ord:1393
  1396.   SetProcessDEPPolicy rva: 0003AB90 ord:1394
  1397.   SetProcessDefaultCpuSetMasks rva: 000AB405 ord:1395  [forwarder RVA : api-ms-win-core-processthreads-l1-1-6.SetProcessDe]
  1398.   SetProcessDefaultCpuSets rva: 000AB461 ord:1396  [forwarder RVA : api-ms-win-core-processthreads-l1-1-3.SetProcessDe]
  1399.   SetProcessDynamicEHContinuationTargets rva: 000AB4C7 ord:1397  [forwarder RVA : api-ms-win-core-processthreads-l1-1-4.SetProcessDy]
  1400.   SetProcessDynamicEnforcedCetCompatibleRanges rva: 000AB541 ord:1398  [forwarder RVA : api-ms-win-core-processthreads-l1-1-6.SetProcessDy]
  1401.   SetProcessInformation rva: 000201A0 ord:1399
  1402.   SetProcessMitigationPolicy rva: 000AB5C5 ord:1400  [forwarder RVA : api-ms-win-core-processthreads-l1-1-1.SetProcessMi]
  1403.   SetProcessPreferredUILanguages rva: 0003C980 ord:1401
  1404.   SetProcessPriorityBoost rva: 0003C9A0 ord:1402
  1405.   SetProcessShutdownParameters rva: 000192E0 ord:1403
  1406.   SetProcessWorkingSetSize rva: 000201D0 ord:1404
  1407.   SetProcessWorkingSetSizeEx rva: 0003C9C0 ord:1405
  1408.   SetProtectedPolicy rva: 000AB6A1 ord:1406  [forwarder RVA : api-ms-win-core-processthreads-l1-1-2.SetProtected]
  1409.   SetSearchPathMode rva: 00039620 ord:1407
  1410.   SetStdHandle rva: 0003CA00 ord:1408
  1411.   SetStdHandleEx rva: 0003C9E0 ord:1409
  1412.   SetSystemFileCacheSize rva: 0003CA20 ord:1410
  1413.   SetSystemPowerState rva: 00068870 ord:1411
  1414.   SetSystemTime rva: 0003CA40 ord:1412
  1415.   SetSystemTimeAdjustment rva: 00037600 ord:1413
  1416.   SetTapeParameters rva: 000435D0 ord:1414
  1417.   SetTapePosition rva: 00043620 ord:1415
  1418.   SetTermsrvAppInstallMode rva: 00069DC0 ord:1416
  1419.   SetThreadAffinityMask rva: 0001FAD0 ord:1417
  1420.   SetThreadContext rva: 00026E30 ord:1418
  1421.   SetThreadDescription rva: 000AB7D0 ord:1419  [forwarder RVA : api-ms-win-core-processthreads-l1-1-3.SetThreadDes]
  1422.   SetThreadErrorMode rva: 00014710 ord:1420
  1423.   SetThreadExecutionState rva: 00019B00 ord:1421
  1424.   SetThreadGroupAffinity rva: 00026E50 ord:1422
  1425.   SetThreadIdealProcessor rva: 0001E710 ord:1423
  1426.   SetThreadIdealProcessorEx rva: 00026E70 ord:1424
  1427.   SetThreadInformation rva: 000201B0 ord:1425
  1428.   SetThreadLocale rva: 000132B0 ord:1426
  1429.   SetThreadPreferredUILanguages rva: 00017F40 ord:1427
  1430.   SetThreadPriority rva: 00014840 ord:1428
  1431.   SetThreadPriorityBoost rva: 00019DE0 ord:1429
  1432.   SetThreadSelectedCpuSetMasks rva: 000AB908 ord:1430  [forwarder RVA : api-ms-win-core-processthreads-l1-1-6.SetThreadSel]
  1433.   SetThreadSelectedCpuSets rva: 000AB964 ord:1431  [forwarder RVA : api-ms-win-core-processthreads-l1-1-3.SetThreadSel]
  1434.   SetThreadStackGuarantee rva: 00017C70 ord:1432
  1435.   SetThreadToken rva: 000AB9CA ord:1433  [forwarder RVA : api-ms-win-core-processthreads-l1-1-0.SetThreadTok]
  1436.   SetThreadUILanguage rva: 00019740 ord:1434
  1437.   SetThreadpoolStackInformation rva: 0003CA60 ord:1435
  1438.   SetThreadpoolThreadMaximum rva: 000ABA4C ord:1436  [forwarder RVA : NTDLL.TpSetPoolMaxThreads]
  1439.   SetThreadpoolThreadMinimum rva: 0001F6F0 ord:1437
  1440.   SetThreadpoolTimer rva: 000ABA94 ord:1438  [forwarder RVA : NTDLL.TpSetTimer]
  1441.   SetThreadpoolTimerEx rva: 000ABABA ord:1439  [forwarder RVA : NTDLL.TpSetTimerEx]
  1442.   SetThreadpoolWait rva: 000ABADF ord:1440  [forwarder RVA : NTDLL.TpSetWait]
  1443.   SetThreadpoolWaitEx rva: 000ABB03 ord:1441  [forwarder RVA : NTDLL.TpSetWaitEx]
  1444.   SetTimeZoneInformation rva: 0003CAA0 ord:1442
  1445.   SetTimerQueueTimer rva: 00043FA0 ord:1443
  1446.   SetUmsThreadInformation rva: 00042480 ord:1444
  1447.   SetUnhandledExceptionFilter rva: 00018B30 ord:1445
  1448.   SetUserGeoID rva: 000557A0 ord:1446
  1449.   SetUserGeoName rva: 000557C0 ord:1447
  1450.   SetVDMCurrentDirectories rva: 00041EA0 ord:1448
  1451.   SetVolumeLabelA rva: 00068EA0 ord:1449
  1452.   SetVolumeLabelW rva: 00068F50 ord:1450
  1453.   SetVolumeMountPointA rva: 00067870 ord:1451
  1454.   SetVolumeMountPointW rva: 0001E0A0 ord:1452
  1455.   SetVolumeMountPointWStub rva: 0003CAC0 ord:1453
  1456.   SetWaitableTimer rva: 00020390 ord:1454
  1457.   SetWaitableTimerEx rva: 000ABC2F ord:1455  [forwarder RVA : api-ms-win-core-synch-l1-1-0.SetWaitableTimerEx]
  1458.   SetXStateFeaturesMask rva: 0003CAD0 ord:1456
  1459.   SetupComm rva: 00020AC0 ord:1457
  1460.   ShowConsoleCursor rva: 0006B840 ord:1458
  1461.   SignalObjectAndWait rva: 00026E90 ord:1459
  1462.   SizeofResource rva: 00013390 ord:1460
  1463.   Sleep rva: 00018650 ord:1461
  1464.   SleepConditionVariableCS rva: 000ABCD3 ord:1462  [forwarder RVA : api-ms-win-core-synch-l1-2-0.SleepConditionVariabl]
  1465.   SleepConditionVariableSRW rva: 000ABD23 ord:1463  [forwarder RVA : api-ms-win-core-synch-l1-2-0.SleepConditionVariabl]
  1466.   SleepEx rva: 000203A0 ord:1464
  1467.   SortCloseHandle rva: 00055A80 ord:1465
  1468.   SortGetHandle rva: 00007EB0 ord:1466
  1469.   StartThreadpoolIo rva: 000ABD92 ord:1467  [forwarder RVA : NTDLL.TpStartAsyncIoOperation]
  1470.   SubmitIoRing rva: 000ABDBD ord:1468  [forwarder RVA : api-ms-win-core-ioring-l1-1-0.SubmitIoRing]
  1471.   SubmitThreadpoolWork rva: 000ABDFD ord:1469  [forwarder RVA : NTDLL.TpPostWork]
  1472.   SuspendThread rva: 00019AE0 ord:1470
  1473.   SwitchToFiber rva: 00020B90 ord:1471
  1474.   SwitchToThread rva: 00015010 ord:1472
  1475.   SystemTimeToFileTime rva: 00018630 ord:1473
  1476.   SystemTimeToTzSpecificLocalTime rva: 00002430 ord:1474
  1477.   SystemTimeToTzSpecificLocalTimeEx rva: 000ABE90 ord:1475  [forwarder RVA : api-ms-win-core-timezone-l1-1-0.SystemTimeToTzSpec]
  1478.   TerminateJobObject rva: 000026A0 ord:1476
  1479.   TerminateProcess rva: 000197C0 ord:1477
  1480.   TerminateThread rva: 00026EB0 ord:1478
  1481.   TermsrvAppInstallMode rva: 0000CC00 ord:1479
  1482.   TermsrvConvertSysRootToUserDir rva: 0006A180 ord:1480
  1483.   TermsrvCreateRegEntry rva: 00015440 ord:1481
  1484.   TermsrvDeleteKey rva: 00016750 ord:1482
  1485.   TermsrvDeleteValue rva: 000173F0 ord:1483
  1486.   TermsrvGetPreSetValue rva: 00013B60 ord:1484
  1487.   TermsrvGetWindowsDirectoryA rva: 000278C0 ord:1485
  1488.   TermsrvGetWindowsDirectoryW rva: 00015BA0 ord:1486
  1489.   TermsrvOpenRegEntry rva: 00011120 ord:1487
  1490.   TermsrvOpenUserClasses rva: 000154F0 ord:1488
  1491.   TermsrvRestoreKey rva: 0006ADE0 ord:1489
  1492.   TermsrvSetKeySecurity rva: 00016F80 ord:1490
  1493.   TermsrvSetValueKey rva: 00013C50 ord:1491
  1494.   TermsrvSyncUserIniFileExt rva: 0006AE10 ord:1492
  1495.   Thread32First rva: 000660D0 ord:1493
  1496.   Thread32Next rva: 00027670 ord:1494
  1497.   TlsAlloc rva: 00016940 ord:1495
  1498.   TlsFree rva: 00017C30 ord:1496
  1499.   TlsGetValue rva: 00010D30 ord:1497
  1500.   TlsSetValue rva: 00010E30 ord:1498
  1501.   Toolhelp32ReadProcessMemory rva: 0003CD90 ord:1499
  1502.   TransactNamedPipe rva: 00002410 ord:1500
  1503.   TransmitCommChar rva: 00020AD0 ord:1501
  1504.   TryAcquireSRWLockExclusive rva: 000AC0E1 ord:1502  [forwarder RVA : NTDLL.RtlTryAcquireSRWLockExclusive]
  1505.   TryAcquireSRWLockShared rva: 000AC11D ord:1503  [forwarder RVA : NTDLL.RtlTryAcquireSRWLockShared]
  1506.   TryEnterCriticalSection rva: 000AC156 ord:1504  [forwarder RVA : NTDLL.RtlTryEnterCriticalSection]
  1507.   TrySubmitThreadpoolCallback rva: 00019160 ord:1505
  1508.   TzSpecificLocalTimeToSystemTime rva: 000024D0 ord:1506
  1509.   TzSpecificLocalTimeToSystemTimeEx rva: 000AC1D5 ord:1507  [forwarder RVA : api-ms-win-core-timezone-l1-1-0.TzSpecificLocalTim]
  1510.   UTRegister rva: 00039660 ord:1508
  1511.   UTUnRegister rva: 000396F0 ord:1509
  1512.   UmsThreadYield rva: 00042360 ord:1510
  1513.   UnhandledExceptionFilter rva: 0003CAF0 ord:1511
  1514.   UnlockFile rva: 000208D0 ord:1512
  1515.   UnlockFileEx rva: 000208E0 ord:1513
  1516.   UnmapViewOfFile rva: 00017C10 ord:1514
  1517.   UnmapViewOfFileEx rva: 000AC291 ord:1515  [forwarder RVA : api-ms-win-core-memory-l1-1-1.UnmapViewOfFileEx]
  1518.   UnregisterApplicationRecoveryCallback rva: 00043E60 ord:1516
  1519.   UnregisterApplicationRestart rva: 00026ED0 ord:1517
  1520.   UnregisterBadMemoryNotification rva: 0003CB10 ord:1518
  1521.   UnregisterConsoleIME rva: 0006BD80 ord:1519
  1522.   UnregisterWait rva: 00003550 ord:1520
  1523.   UnregisterWaitEx rva: 00018900 ord:1521
  1524.   UnregisterWaitUntilOOBECompleted rva: 000696D0 ord:1522
  1525.   UpdateCalendarDayOfWeek rva: 00002B30 ord:1523
  1526.   UpdateProcThreadAttribute rva: 000AC3AC ord:1524  [forwarder RVA : api-ms-win-core-processthreads-l1-1-0.UpdateProcTh]
  1527.   UpdateResourceA rva: 0004A910 ord:1525
  1528.   UpdateResourceW rva: 0004AAC0 ord:1526
  1529.   VDMConsoleOperation rva: 0006C0C0 ord:1527
  1530.   VDMOperationStarted rva: 00042170 ord:1528
  1531.   VerLanguageNameA rva: 0003CB30 ord:1529
  1532.   VerLanguageNameW rva: 0001F530 ord:1530
  1533.   VerSetConditionMask rva: 000AC46A ord:1531  [forwarder RVA : NTDLL.VerSetConditionMask]
  1534.   VerifyConsoleIoHandle rva: 0006B470 ord:1532
  1535.   VerifyScripts rva: 0003CB50 ord:1533
  1536.   VerifyVersionInfoA rva: 00067EF0 ord:1534
  1537.   VerifyVersionInfoW rva: 000147F0 ord:1535
  1538.   VirtualAlloc rva: 00013BF0 ord:1536
  1539.   VirtualAllocEx rva: 000023F0 ord:1537
  1540.   VirtualAllocExNuma rva: 0001E080 ord:1538
  1541.   VirtualFree rva: 000147D0 ord:1539
  1542.   VirtualFreeEx rva: 00026EF0 ord:1540
  1543.   VirtualLock rva: 00019340 ord:1541
  1544.   VirtualProtect rva: 00015470 ord:1542
  1545.   VirtualProtectEx rva: 000011F0 ord:1543
  1546.   VirtualQuery rva: 00015490 ord:1544
  1547.   VirtualQueryEx rva: 00017F60 ord:1545
  1548.   VirtualUnlock rva: 000166F0 ord:1546
  1549.   WTSGetActiveConsoleSessionId rva: 00019690 ord:1547
  1550.   WaitCommEvent rva: 00020AE0 ord:1548
  1551.   WaitForDebugEvent rva: 00026F10 ord:1549
  1552.   WaitForDebugEventEx rva: 000AC5BE ord:1550  [forwarder RVA : api-ms-win-core-debug-l1-1-2.WaitForDebugEventEx]
  1553.   WaitForMultipleObjects rva: 000203B0 ord:1551
  1554.   WaitForMultipleObjectsEx rva: 000203C0 ord:1552
  1555.   WaitForSingleObject rva: 000203D0 ord:1553
  1556.   WaitForSingleObjectEx rva: 000203E0 ord:1554
  1557.   WaitForThreadpoolIoCallbacks rva: 000AC666 ord:1555  [forwarder RVA : NTDLL.TpWaitForIoCompletion]
  1558.   WaitForThreadpoolTimerCallbacks rva: 000AC6A2 ord:1556  [forwarder RVA : NTDLL.TpWaitForTimer]
  1559.   WaitForThreadpoolWaitCallbacks rva: 000AC6D6 ord:1557  [forwarder RVA : NTDLL.TpWaitForWait]
  1560.   WaitForThreadpoolWorkCallbacks rva: 000AC709 ord:1558  [forwarder RVA : NTDLL.TpWaitForWork]
  1561.   WaitNamedPipeA rva: 00062B30 ord:1559
  1562.   WaitNamedPipeW rva: 00002710 ord:1560
  1563.   WakeAllConditionVariable rva: 000AC754 ord:1561  [forwarder RVA : NTDLL.RtlWakeAllConditionVariable]
  1564.   WakeConditionVariable rva: 000AC78C ord:1562  [forwarder RVA : NTDLL.RtlWakeConditionVariable]
  1565.   WerGetFlags rva: 00026FB0 ord:1563
  1566.   WerGetFlagsWorker rva: 00026FB0 ord:1564
  1567.   WerRegisterAdditionalProcess rva: 0003CB70 ord:1565
  1568.   WerRegisterAppLocalDump rva: 0003CB90 ord:1566
  1569.   WerRegisterCustomMetadata rva: 000197E0 ord:1567
  1570.   WerRegisterExcludedMemoryBlock rva: 0003CBB0 ord:1568
  1571.   WerRegisterFile rva: 000189D0 ord:1569
  1572.   WerRegisterFileWorker rva: 00043E80 ord:1570
  1573.   WerRegisterMemoryBlock rva: 00019B40 ord:1571
  1574.   WerRegisterMemoryBlockWorker rva: 00043E90 ord:1572
  1575.   WerRegisterRuntimeExceptionModule rva: 0001F5D0 ord:1573
  1576.   WerRegisterRuntimeExceptionModuleWorker rva: 00043EA0 ord:1574
  1577.   WerSetFlags rva: 00015610 ord:1575
  1578.   WerSetFlagsWorker rva: 00015610 ord:1576
  1579.   WerUnregisterAdditionalProcess rva: 0003CBD0 ord:1577
  1580.   WerUnregisterAppLocalDump rva: 0003CBF0 ord:1578
  1581.   WerUnregisterCustomMetadata rva: 0003CC10 ord:1579
  1582.   WerUnregisterExcludedMemoryBlock rva: 0003CC30 ord:1580
  1583.   WerUnregisterFile rva: 00018A10 ord:1581
  1584.   WerUnregisterFileWorker rva: 00043EB0 ord:1582
  1585.   WerUnregisterMemoryBlock rva: 00026F30 ord:1583
  1586.   WerUnregisterMemoryBlockWorker rva: 00043EC0 ord:1584
  1587.   WerUnregisterRuntimeExceptionModule rva: 0003CC50 ord:1585
  1588.   WerUnregisterRuntimeExceptionModuleWorker rva: 00043ED0 ord:1586
  1589.   WerpGetDebugger rva: 0006EAA0 ord:1587
  1590.   WerpInitiateRemoteRecovery rva: 00043EE0 ord:1588
  1591.   WerpLaunchAeDebug rva: 0006F650 ord:1589
  1592.   WerpNotifyLoadStringResourceWorker rva: 00043F00 ord:1590
  1593.   WerpNotifyUseStringResourceWorker rva: 00043F10 ord:1591
  1594.   WideCharToMultiByte rva: 00010E10 ord:1592
  1595.   WinExec rva: 00068600 ord:1593
  1596.   Wow64DisableWow64FsRedirection rva: 00026F50 ord:1594
  1597.   Wow64EnableWow64FsRedirection rva: 00020B10 ord:1595
  1598.   Wow64GetThreadContext rva: 0003CC70 ord:1596
  1599.   Wow64GetThreadSelectorEntry rva: 00037710 ord:1597
  1600.   Wow64RevertWow64FsRedirection rva: 00026F70 ord:1598
  1601.   Wow64SetThreadContext rva: 0003CC90 ord:1599
  1602.   Wow64SuspendThread rva: 0003CCB0 ord:1600
  1603.   WriteConsoleA rva: 00020D00 ord:1601
  1604.   WriteConsoleInputA rva: 00020F20 ord:1602
  1605.   WriteConsoleInputVDMA rva: 0006B880 ord:1603
  1606.   WriteConsoleInputVDMW rva: 0006B910 ord:1604
  1607.   WriteConsoleInputW rva: 00020F30 ord:1605
  1608.   WriteConsoleOutputA rva: 00020F40 ord:1606
  1609.   WriteConsoleOutputAttribute rva: 00020F50 ord:1607
  1610.   WriteConsoleOutputCharacterA rva: 00020F60 ord:1608
  1611.   WriteConsoleOutputCharacterW rva: 00020F70 ord:1609
  1612.   WriteConsoleOutputW rva: 00020F80 ord:1610
  1613.   WriteConsoleW rva: 00020D10 ord:1611
  1614.   WriteFile rva: 000208F0 ord:1612
  1615.   WriteFileEx rva: 00020900 ord:1613
  1616.   WriteFileGather rva: 00020910 ord:1614
  1617.   WritePrivateProfileSectionA rva: 00061A40 ord:1615
  1618.   WritePrivateProfileSectionW rva: 00061AB0 ord:1616
  1619.   WritePrivateProfileStringA rva: 00061B20 ord:1617
  1620.   WritePrivateProfileStringW rva: 0000CB10 ord:1618
  1621.   WritePrivateProfileStructA rva: 00061B90 ord:1619
  1622.   WritePrivateProfileStructW rva: 00061D00 ord:1620
  1623.   WriteProcessMemory rva: 000011D0 ord:1621
  1624.   WriteProfileSectionA rva: 00061E70 ord:1622
  1625.   WriteProfileSectionW rva: 00061E80 ord:1623
  1626.   WriteProfileStringA rva: 00061E90 ord:1624
  1627.   WriteProfileStringW rva: 00061EA0 ord:1625
  1628.   WriteTapemark rva: 000436A0 ord:1626
  1629.   ZombifyActCtx rva: 0003CCD0 ord:1627
  1630.   ZombifyActCtxWorker rva: 00043C30 ord:1628
  1631.   __C_specific_handler rva: 000ACDD3 ord:1629  [forwarder RVA : NTDLL.__C_specific_handler]
  1632.   __chkstk rva: 000ACDF7 ord:1630  [forwarder RVA : NTDLL.__chkstk]
  1633.   __misaligned_access rva: 000ACE1A ord:1631  [forwarder RVA : NTDLL.__misaligned_access]
  1634.   _hread rva: 00015320 ord:1632
  1635.   _hwrite rva: 0001F750 ord:1633
  1636.   _lclose rva: 00018600 ord:1634
  1637.   _lcreat rva: 0006AE40 ord:1635
  1638.   _llseek rva: 00015360 ord:1636
  1639.   _local_unwind rva: 000ACE69 ord:1637  [forwarder RVA : NTDLL._local_unwind]
  1640.   _lopen rva: 0006AEB0 ord:1638
  1641.   _lread rva: 00015320 ord:1639
  1642.   _lwrite rva: 0001F750 ord:1640
  1643.   lstrcat rva: 0006AF30 ord:1641
  1644.   lstrcatA rva: 0006AF30 ord:1642
  1645.   lstrcatW rva: 000278F0 ord:1643
  1646.   lstrcmp rva: 00017C90 ord:1644
  1647.   lstrcmpA rva: 00017C90 ord:1645
  1648.   lstrcmpW rva: 00014490 ord:1646
  1649.   lstrcmpi rva: 000146A0 ord:1647
  1650.   lstrcmpiA rva: 000146A0 ord:1648
  1651.   lstrcmpiW rva: 00013C30 ord:1649
  1652.   lstrcpy rva: 00027940 ord:1650
  1653.   lstrcpyA rva: 00027940 ord:1651
  1654.   lstrcpyW rva: 00027980 ord:1652
  1655.   lstrcpyn rva: 00026F90 ord:1653
  1656.   lstrcpynA rva: 00026F90 ord:1654
  1657.   lstrcpynW rva: 0001F5B0 ord:1655
  1658.   lstrlen rva: 00013330 ord:1656
  1659.   lstrlenA rva: 00013330 ord:1657
  1660.   lstrlenW rva: 00013270 ord:1658
  1661.   timeBeginPeriod rva: 00016060 ord:1659
  1662.   timeEndPeriod rva: 00015150 ord:1660
  1663.   timeGetDevCaps rva: 0001DA50 ord:1661
  1664.   timeGetSystemTime rva: 000279C0 ord:1662
  1665.   timeGetTime rva: 000180C0 ord:1663
  1666.   uaw_lstrcmpW rva: 00014490 ord:1664
  1667.   uaw_lstrcmpiW rva: 00013C30 ord:1665
  1668.   uaw_lstrlenW rva: 00036E90 ord:1666
  1669.   uaw_wcschr rva: 00036EE0 ord:1667
  1670.   uaw_wcscpy rva: 00036F10 ord:1668
  1671.   uaw_wcsicmp rva: 00036F50 ord:1669
  1672.   uaw_wcslen rva: 00036F70 ord:1670
  1673.   uaw_wcsrchr rva: 00036FA0 ord:1671
复制代码




好奇怪，例如LZDone 和 BaseDumpAppcompatCacheWorker就一样。















作者: cxz7411    时间: 2024-9-8 11:26
可能加载的时候有处理吧
作者: urenai    时间: 2024-9-8 12:32
我分析函数段发现一些函数距离下一个函数段距离为0。
这我就不能理解了。
于是我是用工具去查，是用api去取指针。
解决你猜怎么着？

事实证明，这就是一些函数地址被多个导出名称所指向。
我查不到相关资料说明。
即:apirva值相同，是无错的。没问题。

但是值得注意的是  forwarder
这种类型rva指向的不是函数本体。
而是一个跳转。



欢迎光临 递归火山软件开发平台 (https://bbs.voldp.com/) Powered by Discuz! X3.4