libmwemu 0.24.0

x86 32/64bits and system internals emulator, for securely emulating malware and other stuff.
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
NTSTATUS BasepAppContainerEnvironmentExtension(PSID Sid, int a2, PWSTR *a3);
NTSTATUS RtlStringCbCopyW(wchar_t *pszDest, size_t cbDest, const wchar_t *pszSrc);
NTSTATUS RtlStringCopyWorkerW_1_0(wchar_t *pszDest, size_t cchDest, const wchar_t *pszSrc);
NTSTATUS RtlStringLengthWorkerW_0_0(const wchar_t *psz, size_t cchMax, size_t *pcch);
BOOL EnumCalendarInfoExExStub(CALINFO_ENUMPROCEXEX pCalInfoEnumProcExEx, LPCWSTR lpLocaleName, CALID Calendar, LPCWSTR lpReserved, CALTYPE CalType, LPARAM lParam);
BOOL GetFileMUIPathStub(DWORD dwFlags, PCWSTR pcwszFilePath, PWSTR pwszLanguage, PULONG pcchLanguage, PWSTR pwszFileMUIPath, PULONG pcchFileMUIPath, PULONGLONG pululEnumerator);
BOOL BasepIsTestSigningEnabled();
BOOL EnumTimeFormatsExStub(TIMEFMT_ENUMPROCEX lpTimeFmtEnumProcEx, LPCWSTR lpLocaleName, DWORD dwFlags, LPARAM lParam);
BOOL CreatePipeStub(PHANDLE hReadPipe, PHANDLE hWritePipe, LPSECURITY_ATTRIBUTES lpPipeAttributes, DWORD nSize);
DWORD GetDynamicTimeZoneInformationStub(PDYNAMIC_TIME_ZONE_INFORMATION pTimeZoneInformation);
int SortCompareString(int a1, unsigned int a2, _WORD *a3, int a4, _WORD *a5, int a6, int a7, int a8);
NTSTATUS BasepConstructSxsCreateProcessMessage(unsigned __int16 *a1, struct _UNICODE_STRING *a2, void *a3, void *a4, void *a5, void *a6, int a7, char a8, int a9, int a10, int a11, const unsigned __int16 *a12, __int64 a13, int a14, int a15, void *a16, _DWORD *a17, struct _UNICODE_STRING *a18, void **a19);
char BasepReleaseSxsCreateProcessUtilityStruct(PVOID *a1);
PACTIVATION_CONTEXT CreateActCtxWWorker(int a1);
NTSTATUS BasepSxsCreateStreams(_DWORD *a1, int a2, int a3, int a4, int a5, int a6, int a7, PHANDLE FileHandle, _DWORD **a9, PHANDLE a10, int a11, int a12, PHANDLE a13, _DWORD *a14, int a15, int a16);
BOOL IsFusionFullySupported();
ATOM GlobalAddAtomExW(LPCWSTR lpString, DWORD Flags);
ATOM GlobalAddAtomW(LPCWSTR lpString);
ATOM AddAtomW(LPCWSTR lpString);
int QueryActCtxWWorker(int, PVOID Context, PVOID pvSubInstance, ULONG ulInfoClass, PVOID pvBuffer, SIZE_T cbBuffer, SIZE_T *pcbWrittenOrRequired); // idb
UINT GlobalGetAtomNameW(ATOM nAtom, LPWSTR lpBuffer, int nSize);
int QueryActCtxSettingsWWorker(int a1, int a2, PCWSTR SourceString, int a4, int a5, int a6, _DWORD *a7);
ATOM GlobalFindAtomW(LPCWSTR lpString);
ATOM FindAtomW(LPCWSTR lpString);
BOOL FindActCtxSectionGuidWorker(int a1, GUID *extguid, ULONG section_kind, GUID *guid, int *a5);
ULONG BaseSetLastNTError(NTSTATUS Status);
LPVOID GlobalLock(HGLOBAL hMem);
BOOL IsBadReadPtr(const void *lp, UINT_PTR ucb);
int CompareStringWStub(LCID Locale, DWORD dwCmpFlags, PCNZWCH lpString1, int cchCount1, PCNZWCH lpString2, int cchCount2);
int QuirkIsEnabledWorker(unsigned int a1);
int CptpQuirksInitOnce();
LONG _llseek(HFILE hFile, LONG lOffset, int iOrigin);
UINT _lread(HFILE hFile, LPVOID lpBuffer, UINT uBytes);
BOOL GlobalUnlock(HGLOBAL hMem);
DWORD GetShortPathNameW(LPCWSTR lpszLongPath, LPWSTR lpszShortPath, DWORD cchBuffer);
HRESULT StringCchCopyNW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_PCNZWCH pszSrc, size_t cchToCopy);
static HRESULT StringCopyWorkerW_0_0(STRSAFE_LPWSTR pszDest, size_t cchDest, size_t *pcchNewDestLength, STRSAFE_PCNZWCH pszSrc, size_t cchToCopy);
int TermsrvOpenRegEntry(int a1, int a2, int a3);
HRESULT StringCchCopyExW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc, STRSAFE_LPWSTR *ppszDestEnd, size_t *pcchRemaining, DWORD dwFlags);
int OpenSortIdKey();
HRESULT StringCchCatW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc);
static HRESULT StringCopyWorkerW(STRSAFE_LPWSTR pszDest, size_t cchDest, size_t *pcchNewDestLength, STRSAFE_PCNZWCH pszSrc, size_t cchToCopy);
static HRESULT StringLengthWorkerW(STRSAFE_PCNZWCH psz, size_t cchMax, size_t *pcchLength);
HGLOBAL GlobalReAlloc(HGLOBAL hMem, SIZE_T dwBytes, UINT uFlags);
LONG InterlockedExchangeStub(volatile LONG *Target, LONG Value);
int lstrcmpiAStub(LPCSTR lpString1, LPCSTR lpString2);
HANDLE GetCurrentThread();
BOOL GetProcessTimesStub(HANDLE hProcess, LPFILETIME lpCreationTime, LPFILETIME lpExitTime, LPFILETIME lpKernelTime, LPFILETIME lpUserTime);
BOOL FindActCtxSectionGuidStub(DWORD dwFlags, const GUID *lpExtensionGuid, ULONG ulSectionId, const GUID *lpGuidToFind, PACTCTX_SECTION_KEYED_DATA ReturnedData);
BOOL BaseDllInitialize(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved);
struct _RTL_HANDLE_TABLE *BaseDllInitializeMemoryManager2();
ULONG BasepInitializeTermsrvFpns();
BOOL IsTerminalServerCompatible();
struct _RTL_HANDLE_TABLE *BaseDllInitializeMemoryManager();
static HRESULT StringVPrintfWorkerW(STRSAFE_LPWSTR pszDest, size_t cchDest, size_t *pcchNewDestLength, STRSAFE_LPCWSTR pszFormat, va_list argList);
int BasepQueryAppCompat(unsigned __int16 *a1, int a2, __int16 a3, WCHAR *a4, void *a5, wchar_t *a6, int a7, int a8, PVOID *a9, _DWORD *a10, PVOID *a11, size_t *a12, _DWORD *a13, _DWORD *a14, _DWORD *a15, __int16 *a16, int *a17, _DWORD *a18);
HRESULT ULongAdd(ULONG ulAugend, ULONG ulAddend, ULONG *pulResult);
NTSTATUS RtlStringCchCopyW(wchar_t *pszDest, size_t cchDest, const wchar_t *pszSrc);
int lstrcmpiWStub(LPCWSTR lpString1, LPCWSTR lpString2);
UINT GetWriteWatchStub(DWORD dwFlags, PVOID lpBaseAddress, SIZE_T dwRegionSize, PVOID *lpAddresses, ULONG_PTR *lpdwCount, LPDWORD lpdwGranularity);
HLOCAL LocalFreeStub(HLOCAL hMem);
void LoadAppInitDllsImplementation();
SIZE_T LocalSize(HLOCAL hMem);
int DeactivateActCtxWorker(int, ULONG_PTR ulCookie); // idb
int ActivateActCtxWorker(HANDLE Handle, PULONG_PTR Cookie); // idb
UINT ResetWriteWatchStub(LPVOID lpBaseAddress, SIZE_T dwRegionSize);
void GlobalMemoryStatus(LPMEMORYSTATUS lpBuffer);
HGLOBAL GlobalFreeStub(HGLOBAL hMem);
HFILE _lclose(HFILE hFile);
int SortFindString(unsigned int a1, int a2, char *a3, int a4, char *a5, int a6, int *a7, int a8, int a9);
int GetLocaleInfoWStub(LCID Locale, LCTYPE LCType, LPWSTR lpLCData, int cchData);
int CompareStringOrdinalStub(LPCWCH lpString1, int cchCount1, LPCWCH lpString2, int cchCount2, BOOL bIgnoreCase);
SIZE_T GlobalSize(HGLOBAL hMem);
BOOL DeviceIoControlImplementation(HANDLE hDevice, DWORD dwIoControlCode, LPVOID lpInBuffer, DWORD nInBufferSize, LPVOID lpOutBuffer, DWORD nOutBufferSize, LPDWORD lpBytesReturned, LPOVERLAPPED lpOverlapped);
LPVOID LocalLockStub(HLOCAL hMem);
BOOL LocalUnlockStub(HLOCAL hMem);
DWORD GetEnvironmentVariableWStub(LPCWSTR lpName, LPWSTR lpBuffer, DWORD nSize);
HGLOBAL GlobalAllocStub(UINT uFlags, SIZE_T dwBytes);
BOOL SetThreadPriorityStub(HANDLE hThread, int nPriority);
int BasepNotifyLoadStringResource(int a1, int a2, int a3, int a4);
BOOL SbpIsTraceEnabled();
BOOL FlushInstructionCacheStub(HANDLE hProcess, LPCVOID lpBaseAddress, SIZE_T dwSize);
BOOL SetThreadPreferredUILanguagesStub(DWORD dwFlags, PCZZWSTR pwszLanguagesBuffer, PULONG pulNumLanguages);
int GetLocaleInfoExStub(LPCWSTR lpLocaleName, LCTYPE LCType, LPWSTR lpLCData, int cchData);
int GetThreadPriorityStub(HANDLE hThread);
HRESULT WerSetFlags(DWORD dwFlags);
int WerpInitPEBStore(); // idb
int WerpAcquirePebLock(); // idb
struct _PEB *WerpCurrentPeb(); // idb
HRESULT StringCchCopyW(STRSAFE_LPWSTR pszDest, size_t cchDest, STRSAFE_LPCWSTR pszSrc);
BOOL ProcessIdToSessionIdStub(DWORD dwProcessId, DWORD *pSessionId);
NTSTATUS BasepCheckWinSaferRestrictions(HANDLE a1, _WORD *a2, int a3, unsigned __int16 *a4);
DWORD GetProcessIdStub(HANDLE Process);
ATOM GlobalDeleteAtom(ATOM nAtom);
BOOL IsWow64ProcessStub(HANDLE hProcess, PBOOL Wow64Process);
BOOL SystemTimeToFileTimeStub(const SYSTEMTIME *lpSystemTime, LPFILETIME lpFileTime);
int TermsrvDeleteValue(int a1, int a2);
_BYTE *BasepSxsActivationContextNotification(int a1, int a2, PVOID BaseAddress, int a4, int a5, _BYTE *a6);
int LCMapStringExStub(LPCWSTR lpLocaleName, DWORD dwMapFlags, LPCWSTR lpSrcStr, int cchSrc, LPWSTR lpDestStr, int cchDest, LPNLSVERSIONINFO lpVersionInformation, LPVOID lpReserved, LPARAM sortHandle);
int RtlDownlevelGetNtSystemRoot();
int BasepIsProcessAllowed(int a1);
int FindNLSStringExStub(LPCWSTR lpLocaleName, DWORD dwFindNLSStringFlags, LPCWSTR lpStringSource, int cchSource, LPCWSTR lpStringValue, int cchValue, LPINT pcchFound, LPNLSVERSIONINFO lpVersionInformation, LPVOID lpReserved, LPARAM sortHandle);
int RegisterWaitForInputIdle(int a1);
BOOL QueryActCtxWStub(DWORD dwFlags, HANDLE hActCtx, PVOID pvSubInstance, ULONG ulInfoClass, PVOID pvBuffer, SIZE_T cbBuffer, SIZE_T *pcbWrittenOrRequired);
BOOLEAN BasepFreeAppCompatData(PVOID P, PVOID a2, PVOID a3);
DWORD GetActiveProcessorCount(WORD GroupNumber);
BOOL CreateProcessWStub(LPCWSTR lpApplicationName, LPWSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation);
BOOL QueryPerformanceFrequencyStub(LARGE_INTEGER *lpFrequency);
int TermsrvOpenUserClasses(int a1, int a2);
NTSTATUS BasepCheckWebBladeHashes(HANDLE hFile);
BOOL GetThreadTimesStub(HANDLE hThread, LPFILETIME lpCreationTime, LPFILETIME lpExitTime, LPFILETIME lpKernelTime, LPFILETIME lpUserTime);
DWORD FormatMessageWStub(DWORD dwFlags, LPCVOID lpSource, DWORD dwMessageId, DWORD dwLanguageId, LPWSTR lpBuffer, DWORD nSize, va_list *Arguments);
BOOL FreeEnvironmentStringsWStub(LPWCH penv);
LCID LocaleNameToLCIDStub(LPCWSTR lpName, DWORD dwFlags);
BOOL QueryInformationJobObject(HANDLE hJob, JOBOBJECTINFOCLASS JobObjectInformationClass, LPVOID lpJobObjectInformation, DWORD cbJobObjectInformationLength, LPDWORD lpReturnLength);
BOOL GlobalMemoryStatusExStub(LPMEMORYSTATUSEX lpBuffer);
DWORD GetEnvironmentVariableAStub(LPCSTR lpName, LPSTR lpBuffer, DWORD nSize);
int LCIDToLocaleNameStub(LCID Locale, LPWSTR lpName, int cchName, DWORD dwFlags);
HANDLE OpenFileMappingWStub(DWORD dwDesiredAccess, BOOL bInheritHandle, LPCWSTR lpName);
int GetUserDefaultLocaleNameStub(LPWSTR lpLocaleName, int cchLocaleName);
int BaseGenerateAppCompatData(int a1, int a2, int a3, int a4, int a5, int a6);
BOOL SetThreadStackGuaranteeStub(PULONG StackSizeInBytes);
BOOL GetExitCodeThreadStub(HANDLE hThread, LPDWORD lpExitCode);
BOOL GetUserPreferredUILanguagesStub(DWORD dwFlags, PULONG pulNumLanguages, PZZWSTR pwszLanguagesBuffer, PULONG pcchLanguagesBuffer);
BOOL GetComputerNameExWStub(COMPUTER_NAME_FORMAT NameType, LPWSTR lpBuffer, LPDWORD nSize);
HANDLE CreatePrivateNamespaceWStub(LPSECURITY_ATTRIBUTES lpPrivateNamespaceAttributes, LPVOID lpBoundaryDescriptor, LPCWSTR lpAliasPrefix);
HANDLE CreateBoundaryDescriptorWStub(LPCWSTR Name, ULONG Flags);
BOOL IsProcessInJobStub(HANDLE ProcessHandle, HANDLE JobHandle, PBOOL Result);
BOOL AddSIDToBoundaryDescriptorStub(HANDLE *BoundaryDescriptor, PSID RequiredSid);
BOOL GetNumaHighestNodeNumberStub(PULONG HighestNodeNumber);
HANDLE CreateMemoryResourceNotificationStub(MEMORY_RESOURCE_NOTIFICATION_TYPE NotificationType);
int ReturnMem16Data(int a1, int a2, int a3);
INT LZStart();
int BasepAccumulateIoRateControlInformationBufferSize(unsigned __int16 *a1, int a2);
int NonInstallerDefault(int a1, int a2, _DWORD *a3);
BOOL IsBadWritePtr(LPVOID lp, UINT_PTR ucb);
BOOL GetStringTypeExWStub(LCID Locale, DWORD dwInfoType, LPCWCH lpSrcStr, int cchSrc, LPWORD lpCharType);
BOOL GetOverlappedResultStub(HANDLE hFile, LPOVERLAPPED lpOverlapped, LPDWORD lpNumberOfBytesTransferred, BOOL bWait);
unsigned __int16 *SortGetSortKey(_DWORD *a1, int a2, _WORD *a3, int a4, int a5, int a6, int a7, int a8);
GEOID GetUserGeoID(GEOCLASS GeoClass);
int GetDateFormatWWorker(int a1, int a2, WORD *a3, __int16 *a4, int a5, int a6, unsigned int a7);
int GetTimeFormatWWorker(int a1, int a2, WORD *a3, wchar_t *a4, int a5, int a6);
BOOL IsBadStringPtrA(LPCSTR lpsz, UINT_PTR ucchMax);
BOOL IsDBCSLeadByteStub(BYTE TestChar);
ATOM DeleteAtom(ATOM nAtom);
BOOL IsBadStringPtrW(LPCWSTR lpsz, UINT_PTR ucchMax);
LONG InterlockedCompareExchangeStub(volatile LONG *Destination, LONG Exchange, LONG Comperand);
DWORD timeGetTime();
BOOL VerifyVersionInfoA(LPOSVERSIONINFOEXA lpVersionInformation, DWORD dwTypeMask, DWORDLONG dwlConditionMask);
HANDLE OpenMutexA(DWORD dwDesiredAccess, BOOL bInheritHandle, LPCSTR lpName);
BOOL HeapValidateStub(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem);
LONG InterlockedExchangeAddStub(volatile LONG *Addend, LONG Value);
ATOM GlobalFindAtomA(LPCSTR lpString);
HANDLE CreateSemaphoreA(LPSECURITY_ATTRIBUTES lpSemaphoreAttributes, LONG lInitialCount, LONG lMaximumCount, LPCSTR lpName);
HANDLE CreateSemaphoreExA(LPSECURITY_ATTRIBUTES lpSemaphoreAttributes, LONG lInitialCount, LONG lMaximumCount, LPCSTR lpName, DWORD dwFlags, DWORD dwDesiredAccess);
int FindActCtxSectionStringWWorker(int a1, const GUID *a2, int a3, PCWSTR SourceString, int *a5);
DWORD CheckElevation(WCHAR *lpFileName, int a2, int a3, int a4, int a5);
int BaseCheckElevation(HANDLE ProcessHandle, char *a2, unsigned __int16 *a3, int *a4, int a5, char a6, int a7, int a8, char a9, void *a10, _DWORD *a11, _DWORD *a12);
int BasepCheckAppCompat(HANDLE FileHandle, WCHAR *SourceString, int *a3, int *a4);
int CompatCacheLookupExe(int a1, int a2, _DWORD *a3, _DWORD *a4, _DWORD *a5, int a6, wchar_t *a7, WCHAR *a8, int a9, int a10, USHORT a11, int a12);
NTSTATUS BasepGetExeArchType(__int16 *a1, HANDLE FileHandle, PCWSTR SourceString);
int GetTimeFormatWStub(LCID Locale, DWORD dwFlags, const SYSTEMTIME *lpTime, LPCWSTR lpFormat, LPWSTR lpTimeStr, int cchTime);
BOOL IsBadCodePtr(FARPROC lpfn);
BOOL Process32Next(HANDLE hSnapshot, LPPROCESSENTRY32 lppe);
UINT GetAtomNameW(ATOM nAtom, LPWSTR lpBuffer, int nSize);
BOOL SetPriorityClassStub(HANDLE hProcess, DWORD dwPriorityClass);
int SortChangeCase(_DWORD *a1, int a2, _WORD *a3, int a4, int a5, int a6, int a7, int a8);
int CompareStringAStub(LCID Locale, DWORD dwCmpFlags, PCNZCH lpString1, int cchCount1, PCNZCH lpString2, int cchCount2);
HANDLE CreateWaitableTimerA(LPSECURITY_ATTRIBUTES lpTimerAttributes, BOOL bManualReset, LPCSTR lpTimerName);
HANDLE CreateWaitableTimerExA(LPSECURITY_ATTRIBUTES lpTimerAttributes, LPCSTR lpTimerName, DWORD dwFlags, DWORD dwDesiredAccess);
DWORD GetPrivateProfileSectionW(LPCWSTR lpAppName, LPWSTR lpReturnedString, DWORD nSize, LPCWSTR lpFileName);
HGLOBAL GlobalHandle(LPCVOID pMem);
int GetLocaleInfoAStub(LCID Locale, LCTYPE LCType, LPSTR lpLCData, int cchData);
NTSTATUS BasepInitializeApphelpGlobals();
UINT GlobalFlags(HGLOBAL hMem);
HANDLE OpenFileMappingA(DWORD dwDesiredAccess, BOOL bInheritHandle, LPCSTR lpName);
ATOM FindAtomA(LPCSTR lpString);
BOOL Wow64RevertWow64FsRedirectionStub(PVOID OlValue);
BOOL Wow64DisableWow64FsRedirectionStub(PVOID *OldValue);
DWORD GetShortPathNameA(LPCSTR lpszLongPath, LPSTR lpszShortPath, DWORD cchBuffer);
BOOL SetProcessDEPPolicy(DWORD dwFlags);
int GetNumberFormatW(LCID Locale, DWORD dwFlags, LPCWSTR lpValue, const NUMBERFMTW *lpFormat, LPWSTR lpNumberStr, int cchNumber);
BOOL FindActCtxSectionStringWStub(DWORD dwFlags, const GUID *lpExtensionGuid, ULONG ulSectionId, LPCWSTR lpStringToFind, PACTCTX_SECTION_KEYED_DATA ReturnedData);
BOOL TimeInit(PINIT_ONCE InitOnce, PVOID Parameter, PVOID *Context); // idb
DWORD CalibrateTimer();
BOOL UnregisterWait(HANDLE WaitHandle);
BOOL QueueUserWorkItemStub(LPTHREAD_START_ROUTINE Function, PVOID Context, ULONG Flags);
DWORD GetProcessVersionStub(DWORD ProcessId);
HLOCAL LocalReAllocStub(HLOCAL hMem, SIZE_T uBytes, UINT uFlags);
int GetDateFormatWStub(LCID Locale, DWORD dwFlags, const SYSTEMTIME *lpDate, LPCWSTR lpFormat, LPWSTR lpDateStr, int cchDate);
DWORD SearchPathWStub(LPCWSTR lpPath, LPCWSTR lpFileName, LPCWSTR lpExtension, DWORD nBufferLength, LPWSTR lpBuffer, LPWSTR *lpFilePart);
HRESULT RegisterApplicationRecoveryCallback(APPLICATION_RECOVERY_CALLBACK pRecoveyCallback, PVOID pvParameter, DWORD dwPingInterval, DWORD dwFlags);
BOOL WerpCheckOkToRegister();
int FoldStringWStub(DWORD dwMapFlags, LPCWCH lpSrcStr, int cchSrc, LPWSTR lpDestStr, int cchDest);
BOOL SetEnvironmentVariableWStub(LPCWSTR lpName, LPCWSTR lpValue);
DWORD FormatMessageAStub(DWORD dwFlags, LPCVOID lpSource, DWORD dwMessageId, DWORD dwLanguageId, LPSTR lpBuffer, DWORD nSize, va_list *Arguments);
BOOL TzSpecificLocalTimeToSystemTimeStub(const TIME_ZONE_INFORMATION *lpTimeZoneInformation, const SYSTEMTIME *lpLocalTime, LPSYSTEMTIME lpUniversalTime);
BOOL WritePrivateProfileStringA(LPCSTR lpAppName, LPCSTR lpKeyName, LPCSTR lpString, LPCSTR lpFileName);
BOOL CancelIoExStub(HANDLE hFile, LPOVERLAPPED lpOverlapped);
MMRESULT timeEndPeriod(UINT uPeriod);
MMRESULT timeBeginPeriod(UINT uPeriod);
BOOL SetCurrentDirectoryWStub(LPCWSTR lpPathName);
DWORD GetProfileStringA(LPCSTR lpAppName, LPCSTR lpKeyName, LPCSTR lpDefault, LPSTR lpReturnedString, DWORD nSize);
BOOL Process32Next(HANDLE hSnapshot, LPPROCESSENTRY32 lppe);
BOOL EnumCalendarInfoA(CALINFO_ENUMPROCA lpCalInfoEnumProc, LCID Locale, CALID Calendar, CALTYPE CalType);
BOOL SetDllDirectoryA(LPCSTR lpPathName);
BOOL EnumDateFormatsWStub(DATEFMT_ENUMPROCW lpDateFmtEnumProc, LCID Locale, DWORD dwFlags);
BOOL GetExitCodeProcessImplementation(HANDLE hProcess, LPDWORD lpExitCode);
BOOL EnumSystemLocalesExStub(LOCALE_ENUMPROCEX lpLocaleEnumProcEx, DWORD dwFlags, LPARAM lParam, LPVOID lpReserved);
BOOL SetProcessShutdownParametersStub(DWORD dwLevel, DWORD dwFlags);
DWORD SetThreadIdealProcessorStub(HANDLE hThread, DWORD dwIdealProcessor);
ATOM AddAtomA(LPCSTR lpString);
int CompareStringExStub(LPCWSTR lpLocaleName, DWORD dwCmpFlags, LPCWCH lpString1, int cchCount1, LPCWCH lpString2, int cchCount2, LPNLSVERSIONINFO lpVersionInformation, LPVOID lpReserved, LPARAM lParam);
BOOL EnumUILanguagesWStub(UILANGUAGE_ENUMPROCW lpUILanguageEnumProc, DWORD dwFlags, LONG_PTR lParam);
BOOL WritePrivateProfileStringW(LPCWSTR lpAppName, LPCWSTR lpKeyName, LPCWSTR lpString, LPCWSTR lpFileName);
BOOL EnumSystemLocalesWStub(LOCALE_ENUMPROCW lpLocaleEnumProc, DWORD dwFlags);
BOOL EnumTimeFormatsWStub(TIMEFMT_ENUMPROCW lpTimeFmtEnumProc, LCID Locale, DWORD dwFlags);
EXECUTION_STATE SetThreadExecutionState(EXECUTION_STATE esFlags);
BOOL VirtualUnlockStub(LPVOID lpAddress, SIZE_T dwSize);
DWORD QueueUserAPCStub(PAPCFUNC pfnAPC, HANDLE hThread, ULONG_PTR dwData);
BOOLEAN BaseFreeAppCompatDataForProcessWorker(PVOID P);
BOOL GetNLSVersionStub(NLS_FUNCTION Function, LCID Locale, LPNLSVERSIONINFO lpVersionInformation);
DWORD SearchPathAStub(LPCSTR lpPath, LPCSTR lpFileName, LPCSTR lpExtension, DWORD nBufferLength, LPSTR lpBuffer, LPSTR *lpFilePart);
int LCMapStringAStub(LCID Locale, DWORD dwMapFlags, LPCSTR lpSrcStr, int cchSrc, LPSTR lpDestStr, int cchDest);
BOOL GetStringTypeAStub(LCID Locale, DWORD dwInfoType, LPCSTR lpSrcStr, int cchSrc, LPWORD lpCharType);
BOOL SetProcessWorkingSetSize(HANDLE hProcess, SIZE_T dwMinimumWorkingSetSize, SIZE_T dwMaximumWorkingSetSize);
BOOL EnumCalendarInfoExWStub(CALINFO_ENUMPROCEXW lpCalInfoEnumProcEx, LCID Locale, CALID Calendar, CALTYPE CalType);
BOOL MoveFileExWStub(LPCWSTR lpExistingFileName, LPCWSTR lpNewFileName, DWORD dwFlags);
HANDLE OpenPrivateNamespaceWStub(LPVOID lpBoundaryDescriptor, LPCWSTR lpAliasPrefix);
BOOLEAN ClosePrivateNamespaceStub(HANDLE Handle, ULONG Flags);
BOOL UnregisterWaitExStub(HANDLE WaitHandle, HANDLE CompletionEvent);
BOOL FlushViewOfFileStub(LPCVOID lpBaseAddress, SIZE_T dwNumberOfBytesToFlush);
DWORD GetProfileStringW(LPCWSTR lpAppName, LPCWSTR lpKeyName, LPCWSTR lpDefault, LPWSTR lpReturnedString, DWORD nSize);
int TermsrvConvertSysRootToUserDir(int a1, int a2);
int TermsrvSyncUserIniFileExt(int a1);
int TermsrvSyncUserIniFile(int a1);
BOOL IsSystemLUID();
UINT GetPrivateProfileIntW(LPCWSTR lpAppName, LPCWSTR lpKeyName, INT nDefault, LPCWSTR lpFileName);
DWORD GetPrivateProfileSectionNamesW(LPWSTR lpszReturnBuffer, DWORD nSize, LPCWSTR lpFileName);
DWORD GetPrivateProfileStringW(LPCWSTR lpAppName, LPCWSTR lpKeyName, LPCWSTR lpDefault, LPWSTR lpReturnedString, DWORD nSize, LPCWSTR lpFileName);
HRESULT RegisterApplicationRestart(PCWSTR pwzCommandline, DWORD dwFlags);
UINT GetProfileIntA(LPCSTR lpAppName, LPCSTR lpKeyName, INT nDefault);
UINT GetPrivateProfileIntA(LPCSTR lpAppName, LPCSTR lpKeyName, INT nDefault, LPCSTR lpFileName);
DWORD GetPrivateProfileStringA(LPCSTR lpAppName, LPCSTR lpKeyName, LPCSTR lpDefault, LPSTR lpReturnedString, DWORD nSize, LPCSTR lpFileName);
int BaseDllReadWriteIniFile(char a1, char a2, char a3, const char *lpFileName, int a5, int a6, const char *a7, int *a8);
LONG InterlockedDecrementStub(volatile LONG *lpAddend);
BOOL DosDateTimeToFileTime(WORD wFatDate, WORD wFatTime, LPFILETIME lpFileTime);
int Basep8BitStringToDynamicUnicodeString(int, PCSZ SourceString); // idb
int TermsrvGetPreSetValue(int a1, int a2, int a3, int a4);
int TermsrvSetValueKey(int a1, int a2, int a3, int a4, int a5, int a6);
BOOL Process32NextW(HANDLE hSnapshot, LPPROCESSENTRY32W lppe);
BOOL DeactivateActCtxStub(DWORD dwFlags, ULONG_PTR ulCookie);
BOOL ActivateActCtxStub(HANDLE hActCtx, ULONG_PTR *lpCookie);
DWORD BasepGetComputerNameFromNtPath(STRING *String2, void *a2, WCHAR *a3, DWORD *a4);
BOOL GetComputerNameW(LPWSTR lpBuffer, LPDWORD nSize);
int GetCurrentActCtxWorker(PVOID *Context); // idb
int TermsrvCreateRegEntry(int a1, int a2, int a3, int a4, int a5);
int TermsrvDeleteKey(int a1);
BOOL GetProcessIoCounters(HANDLE hProcess, PIO_COUNTERS lpIoCounters);
BOOL GetSystemPowerStatus(LPSYSTEM_POWER_STATUS lpSystemPowerStatus);
int BasepSetFileEncryptionCompression(void *a1, void **a2, struct _OBJECT_ATTRIBUTES *a3, BOOL (__stdcall *a4)(LPCWSTR lpFileName, DWORD dwReserved), int a5, __int16 a6, int a7, char a8);
BOOL Process32FirstW(HANDLE hSnapshot, LPPROCESSENTRY32W lppe);
BOOL QueryThreadCycleTimeStub(HANDLE ThreadHandle, PULONG64 CycleTime);
HRESULT WerRegisterFileStub(PCWSTR pwzFile, WER_REGISTER_FILE_TYPE regFileType, DWORD dwFlags);
HANDLE CreateActCtxWStub(PCACTCTXW pActCtx);
BOOL SetDllDirectoryW(LPCWSTR lpPathName);
DWORD GetProcessIdOfThreadStub(HANDLE Thread);
BOOL FlsFreeStub(DWORD dwFlsIndex);
int BaseIsAppcompatInfrastructureDisabledStub();
BOOL GetProductInfoStub(DWORD dwOSMajorVersion, DWORD dwOSMinorVersion, DWORD dwSpMajorVersion, DWORD dwSpMinorVersion, PDWORD pdwReturnedProductType);
BOOL ReplaceFileWStub(LPCWSTR lpReplacedFileName, LPCWSTR lpReplacementFileName, LPCWSTR lpBackupFileName, DWORD dwReplaceFlags, LPVOID lpExclude, LPVOID lpReserved);
HRESULT StringCbCopyW(STRSAFE_LPWSTR pszDest, size_t cbDest, STRSAFE_LPCWSTR pszSrc);
HANDLE OpenMutexA(DWORD dwDesiredAccess, BOOL bInheritHandle, LPCSTR lpName);
BOOL PostQueuedCompletionStatusStub(HANDLE CompletionPort, DWORD dwNumberOfBytesTransferred, ULONG_PTR dwCompletionKey, LPOVERLAPPED lpOverlapped);
BOOL GetFileInformationByHandleExStub(HANDLE hFile, FILE_INFO_BY_HANDLE_CLASS FileInformationClass, LPVOID lpFileInformation, DWORD dwBufferSize);
BOOL GetQueuedCompletionStatusStub(HANDLE CompletionPort, LPDWORD lpNumberOfBytesTransferred, PULONG_PTR lpCompletionKey, LPOVERLAPPED *lpOverlapped, DWORD dwMilliseconds);
HANDLE CreateIoCompletionPortStub(HANDLE FileHandle, HANDLE ExistingCompletionPort, ULONG_PTR CompletionKey, DWORD NumberOfConcurrentThreads);
int NtWow64CsrBasepRefreshIniFileMapping(int a1);
int NtWow64CsrBasepDefineDosDevice(int a1, int a2, int a3);
int NtWow64CsrBasepCreateProcess(int a1);
int NtWow64CsrBasepSetProcessShutdownParam(int a1, int a2);
int NtWow64CsrBasepGetProcessShutdownParam(int a1, int a2);
int NtWow64CsrBasepSetClientTimeZoneInformation(int a1, int a2, int a3);
int NtWow64CsrBasepCreateActCtx(int a1);
int NtWow64CsrBaseCheckRunApp(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8, int a9, int a10);
int NtWow64CsrBasepNlsUpdateCacheCount();
int NtWow64CsrBasepNlsGetUserInfo(int a1, int a2);
int NtWow64ConsoleLaunchServerProcess(int a1, int a2, int a3, int a4);
int NtWow64CsrBasepSoundSentryNotification(int a1);
int _DllMainCRTStartupForGS2(int a1, int a2, int a3);
void _guard_check_icall_nop();
_DWORD _NLG_Notify(_DWORD); // weak
int _NLG_Dispatch2(int a1);
LONG InterlockedDecrement(volatile LONG *lpAddend);
LONG InterlockedExchange(volatile LONG *Target, LONG Value);
LONG InterlockedCompareExchange(volatile LONG *Destination, LONG Exchange, LONG Comperand);
LONG InterlockedExchangeAdd(volatile LONG *Addend, LONG Value);
int MulDiv(int nNumber, int nNumerator, int nDenominator);
NTSTATUS Wow64TransitionResolve();
int MachinePrefersNumericFirstYear();
__int16 GetCurrentJaEraIndex();
int GetJapaneseEraItems();
__int16 GetKnownJapanEraCount();
__int16 GetMaxJapanEras();
__int16 GetMaxJapanYears();
BOOL IsOOBESupported();
_DWORD Wow64SystemServiceCall(); // idb
BOOL BeepImplementation(DWORD dwFreq, DWORD dwDuration);
LONG CopyLZFile(INT hfSource, INT hfDest);
LONG LZCopy(INT hfSource, INT hfDest);
DWORD GetFullPathNameTransactedA(LPCSTR lpFileName, DWORD nBufferLength, LPSTR lpBuffer, LPSTR *lpFilePart, HANDLE hTransaction);
BOOL SetSystemTimeAdjustment(DWORD dwTimeAdjustment, BOOL bTimeAdjustmentDisabled);
BOOL DebugSetProcessKillOnExit(BOOL KillOnExit);
BOOL Wow64GetThreadSelectorEntry(HANDLE hThread, DWORD dwSelector, PWOW64_LDT_ENTRY lpSelectorEntry);
BOOL CreateDirectoryTransactedA(LPCSTR lpTemplateDirectory, LPCSTR lpNewDirectory, LPSECURITY_ATTRIBUTES lpSecurityAttributes, HANDLE hTransaction);
BOOL GetFileBandwidthReservation(HANDLE hFile, LPDWORD lpPeriodMilliseconds, LPDWORD lpBytesPerPeriod, LPBOOL pDiscardable, LPDWORD lpTransferSize, LPDWORD lpNumOutstandingRequests);
BOOL SetFileBandwidthReservation(HANDLE hFile, DWORD nPeriodMilliseconds, DWORD nBytesPerPeriod, BOOL bDiscardable, LPDWORD lpTransferSize, LPDWORD lpNumOutstandingRequests);
BOOL SetFileShortNameA(HANDLE hFile, LPCSTR lpShortName);
BOOL SetFileShortNameW(HANDLE hFile, LPCWSTR lpShortName);
int BasepCopyEncryption(int a1, int a2, _DWORD *a3);
DWORD DuplicateEncryptionInfoFileExt(int a1, int a2, int a3, int a4, int a5);
DWORD GetEncryptedFileVersionExt(int a1, _DWORD *a2);
UINT EnumSystemFirmwareTablesStub(DWORD FirmwareTableProviderSignature, PVOID pFirmwareTableEnumBuffer, DWORD BufferSize);
UINT GetSystemFirmwareTableStub(DWORD FirmwareTableProviderSignature, DWORD FirmwareTableID, PVOID pFirmwareTableBuffer, DWORD BufferSize);
SIZE_T LocalCompact(UINT uMinFree);
void GlobalFix(HGLOBAL hMem);
BOOL GlobalUnWire(HGLOBAL hMem);
void GlobalUnfix(HGLOBAL hMem);
LPVOID GlobalWire(HGLOBAL hMem);
int (__thiscall *RegisterWowBaseHandlers(int (__thiscall *a1)(_DWORD, _DWORD)))(_DWORD, _DWORD);
BOOL RemoveSecureMemoryCacheCallback(PSECURE_MEMORY_CACHE_CALLBACK pfnCallBack);
HLOCAL LocalHandle(LPCVOID pMem);
SIZE_T LocalShrink(HLOCAL hMem, UINT cbNewSize);
int LoadStringBaseW(int a1, int a2, int a3, int a4);
DWORD GetDllDirectoryA(DWORD nBufferLength, LPSTR lpBuffer);
BOOL GetNamedPipeClientSessionId(HANDLE Pipe, PULONG ClientSessionId);
BOOL GetNamedPipeServerSessionId(HANDLE Pipe, PULONG ServerSessionId);
BOOL SetNamedPipeAttribute(HANDLE FileHandle, int a2, const char *Src, void *a4, size_t Size);
BOOL GetNumaAvailableMemoryNode(UCHAR Node, PULONGLONG AvailableBytes);
BOOL GetNumaNodeNumberFromHandle(HANDLE hFile, PUSHORT NodeNumber);
BOOL GetNumaProcessorNode(UCHAR Processor, PUCHAR NodeNumber);
BOOL GetNumaProximityNode(ULONG ProximityId, PUCHAR NodeNumber);
BOOL CheckNameLegalDOS8Dot3A(LPCSTR lpName, LPSTR lpOemName, DWORD OemNameSize, PBOOL pbNameContainsSpaces, PBOOL pbNameLegal);
BOOL CheckNameLegalDOS8Dot3W(LPCWSTR lpName, LPSTR lpOemName, DWORD OemNameSize, PBOOL pbNameContainsSpaces, PBOOL pbNameLegal);
BOOL RequestWakeupLatency(LATENCY_TIME latency);
BOOL IsSystemResumeAutomatic();
BOOL SetMessageWaitingIndicator(HANDLE hMsgIndicator, ULONG ulMsgCount);
BOOL SetSystemPowerState(BOOL fSuspend, BOOL fForce);
int BasepAppXExtension(int a1, int a2, int a3, int a4, int a5, int a6);
NTSTATUS BasepConfigureAppCertDlls(const WCHAR *a1, int a2, const WCHAR *a3, int a4, int a5, const UNICODE_STRING **a6);
int BasepPostSuccessAppXExtension(int a1, int a2);
int BasepProcessInvalidImage(int a1, void *a2, WCHAR *lpFileName, wchar_t **a4, PWSTR *a5, int a6, int *a7, const WCHAR *a8, WCHAR **a9, _BYTE *a10, int a11, struct _UNICODE_STRING *a12, int a13, _DWORD *a14, struct _UNICODE_STRING *a15, struct _STRING *a16, UNICODE_STRING *a17, const void **a18, void *a19, int a20, int *a21);
void FatalExit(int ExitCode);
BOOL GetProcessDEPPolicy(HANDLE hProcess, LPDWORD lpFlags, PBOOL lpPermanent);
DEP_SYSTEM_POLICY_TYPE GetSystemDEPPolicy();
BOOL GetSystemRegistryQuota(PDWORD pdwQuotaAllowed, PDWORD pdwQuotaUsed);
BOOL IsBadHugeReadPtr(const void *lp, UINT_PTR ucb);
BOOL IsBadHugeWritePtr(LPVOID lp, UINT_PTR ucb);
int NtVdm64CreateProcessInternalW(int a1, const WCHAR *a2, wchar_t *cchDest, int a4, int a5, int a6, int a7, int a8, int a9, int a10, int a11, int a12);
void RaiseInvalid16BitExeError(unsigned __int16 *a1);
BOOL ReplacePartitionUnit(PWSTR TargetPartition, PWSTR SparePartition, ULONG Flags);
int AddResourceAttributeAceStub(int a1, int a2, int a3, int a4, int a5, int a6, int a7);
int AddScopedPolicyIDAceStub(int a1, int a2, int a3, int a4, int a5);
BOOL AllocateUserPhysicalPagesNumaStub(HANDLE hProcess, PULONG_PTR NumberOfPages, PULONG_PTR PageArray, DWORD nndPreferred);
BOOL AllocateUserPhysicalPagesStub(HANDLE hProcess, PULONG_PTR NumberOfPages, PULONG_PTR PageArray);
int BaseCheckAppcompatCacheExStub(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8, int a9);
int BaseCheckAppcompatCacheStub(int a1, int a2, int a3, int a4);
int BaseCleanupAppcompatCacheSupportStub(int a1);
int BaseGetNamedObjectDirectoryStub(int a1);
int BaseUpdateAppcompatCacheStub(int a1, int a2, int a3);
BOOL CallbackMayRunLongStub(PTP_CALLBACK_INSTANCE pci);
BOOL CancelIoStub(HANDLE hFile);
BOOL CancelSynchronousIoStub(HANDLE hThread);
BOOL ChangeTimerQueueTimerStub(HANDLE TimerQueue, HANDLE Timer, ULONG DueTime, ULONG Period);
BOOL CheckRemoteDebuggerPresentStub(HANDLE hProcess, PBOOL pbDebuggerPresent);
int CheckTokenCapabilityStub(int a1, int a2, int a3);
int CheckTokenMembershipExStub(int a1, int a2, int a3, int a4);
BOOL ContinueDebugEventStub(DWORD dwProcessId, DWORD dwThreadId, DWORD dwContinueStatus);
LCID ConvertDefaultLocaleStub(LCID Locale);
HRESULT CopyFile2Stub(PCWSTR pwszExistingFileName, PCWSTR pwszNewFileName, COPYFILE2_EXTENDED_PARAMETERS *pExtendedParameters);
BOOL CopyFileExWStub(LPCWSTR lpExistingFileName, LPCWSTR lpNewFileName, LPPROGRESS_ROUTINE lpProgressRoutine, LPVOID lpData, LPBOOL pbCancel, DWORD dwCopyFlags);
BOOL CreateDirectoryExWStub(LPCWSTR lpTemplateDirectory, LPCWSTR lpNewDirectory, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
HANDLE CreateFileMappingNumaWStub(HANDLE hFile, LPSECURITY_ATTRIBUTES lpFileMappingAttributes, DWORD flProtect, DWORD dwMaximumSizeHigh, DWORD dwMaximumSizeLow, LPCWSTR lpName, DWORD nndPreferred);
BOOL CreateHardLinkAStub(LPCSTR lpFileName, LPCSTR lpExistingFileName, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
BOOL CreateHardLinkWStub(LPCWSTR lpFileName, LPCWSTR lpExistingFileName, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
int CreateProcessInternalAStub(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8, int a9, int a10, int a11, int a12);
int CreateProcessInternalWStub(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8, int a9, int a10, int a11, int a12);
BOOLEAN CreateSymbolicLinkWStub(LPCWSTR lpSymlinkFileName, LPCWSTR lpTargetFileName, DWORD dwFlags);
BOOL CreateTimerQueueTimerStub(PHANDLE phNewTimer, HANDLE TimerQueue, WAITORTIMERCALLBACK Callback, PVOID Parameter, DWORD DueTime, DWORD Period, ULONG Flags);
BOOL DebugActiveProcessStopStub(DWORD dwProcessId);
BOOL DebugActiveProcessStub(DWORD dwProcessId);
int DelayLoadFailureHookStub(int a1, int a2);
BOOL DeleteSynchronizationBarrierStub(LPSYNCHRONIZATION_BARRIER lpBarrier);
BOOL DeleteTimerQueueExStub(HANDLE TimerQueue, HANDLE CompletionEvent);
BOOL DeleteTimerQueueTimerStub(HANDLE TimerQueue, HANDLE Timer, HANDLE CompletionEvent);
BOOL DnsHostnameToComputerNameExWStub(LPCWSTR Hostname, LPWSTR ComputerName, LPDWORD nSize);
BOOL EnterSynchronizationBarrierStub(LPSYNCHRONIZATION_BARRIER lpBarrier, DWORD dwFlags);
BOOL EnumCalendarInfoWStub(CALINFO_ENUMPROCW lpCalInfoEnumProc, LCID Locale, CALID Calendar, CALTYPE CalType);
BOOL EnumDateFormatsExExStub(DATEFMT_ENUMPROCEXEX lpDateFmtEnumProcExEx, LPCWSTR lpLocaleName, DWORD dwFlags, LPARAM lParam);
BOOL EnumDateFormatsExWStub(DATEFMT_ENUMPROCEXW lpDateFmtEnumProcEx, LCID Locale, DWORD dwFlags);
BOOL EnumLanguageGroupLocalesWStub(LANGGROUPLOCALE_ENUMPROCW lpLangGroupLocaleEnumProc, LGRPID LanguageGroup, DWORD dwFlags, LONG_PTR lParam);
BOOL EnumSystemCodePagesWStub(CODEPAGE_ENUMPROCW lpCodePageEnumProc, DWORD dwFlags);
BOOL EnumSystemLanguageGroupsWStub(LANGUAGEGROUP_ENUMPROCW lpLanguageGroupEnumProc, DWORD dwFlags, LONG_PTR lParam);
BOOL EnumSystemLocalesAStub(LOCALE_ENUMPROCA lpLocaleEnumProc, DWORD dwFlags);
int FindNLSStringStub(LCID Locale, DWORD dwFindNLSStringFlags, LPCWSTR lpStringSource, int cchSource, LPCWSTR lpStringValue, int cchValue, LPINT pcchFound);
int FindStringOrdinalStub(DWORD dwFindStringOrdinalFlags, LPCWSTR lpStringSource, int cchSource, LPCWSTR lpStringValue, int cchValue, BOOL bIgnoreCase);
BOOL FreeEnvironmentStringsAStub(LPCH penv);
BOOL FreeUserPhysicalPagesStub(HANDLE hProcess, PULONG_PTR NumberOfPages, PULONG_PTR PageArray);
int GetAppContainerAceStub(int a1, int a2, int a3, int a4);
int GetAppContainerNamedObjectPathStub(int a1, int a2, int a3, int a4, int a5);
HRESULT GetApplicationRecoveryCallbackStub(HANDLE hProcess, APPLICATION_RECOVERY_CALLBACK *pRecoveryCallback, PVOID *ppvParameter, PDWORD pdwPingInterval, PDWORD pdwFlags);
HRESULT GetApplicationRestartSettingsStub(HANDLE hProcess, PWSTR pwzCommandline, PDWORD pcchSize, PDWORD pdwFlags);
int GetCachedSigningLevelStub(int a1, int a2, int a3, int a4, int a5, int a6);
DWORD GetCompressedFileSizeAStub(LPCSTR lpFileName, LPDWORD lpFileSizeHigh);
DWORD GetCompressedFileSizeWStub(LPCWSTR lpFileName, LPDWORD lpFileSizeHigh);
BOOL GetComputerNameExAStub(COMPUTER_NAME_FORMAT NameType, LPSTR lpBuffer, LPDWORD nSize);
int GetCurrencyFormatExStub(LPCWSTR lpLocaleName, DWORD dwFlags, LPCWSTR lpValue, const CURRENCYFMTW *lpFormat, LPWSTR lpCurrencyStr, int cchCurrency);
BOOL GetCurrentActCtxStub(HANDLE *lphActCtx);
int GetDateFormatAStub(LCID Locale, DWORD dwFlags, const SYSTEMTIME *lpDate, LPCSTR lpFormat, LPSTR lpDateStr, int cchDate);
int GetDateFormatExStub(LPCWSTR lpLocaleName, DWORD dwFlags, const SYSTEMTIME *lpDate, LPCWSTR lpFormat, LPWSTR lpDateStr, int cchDate, LPCWSTR lpCalendar);
int GetDurationFormatExStub(LPCWSTR lpLocaleName, DWORD dwFlags, const SYSTEMTIME *lpDuration, ULONGLONG ullDuration, LPCWSTR lpFormat, LPWSTR lpDurationStr, int cchDuration);
int GetEraNameCountedStringStub(int a1, int a2, int a3, int a4);
BOOL GetFileMUIInfoStub(DWORD dwFlags, PCWSTR pcwszFilePath, PFILEMUIINFO pFileMUIInfo, DWORD *pcbFileMUIInfo);
BOOL GetLogicalProcessorInformationStub(PSYSTEM_LOGICAL_PROCESSOR_INFORMATION Buffer, PDWORD ReturnedLength);
int GetMemoryErrorHandlingCapabilitiesStub(int a1);
BOOL GetNLSVersionExStub(NLS_FUNCTION function, LPCWSTR lpLocaleName, LPNLSVERSIONINFOEX lpVersionInformation);
int GetNamedPipeAttributeStub(int a1, int a2, int a3, int a4, int a5);
BOOL GetNamedPipeClientComputerNameWStub(HANDLE Pipe, LPWSTR ClientComputerName, ULONG ClientComputerNameLength);
BOOL GetNamedPipeHandleStateWStub(HANDLE hNamedPipe, LPDWORD lpState, LPDWORD lpCurInstances, LPDWORD lpMaxCollectionCount, LPDWORD lpCollectDataTimeout, LPWSTR lpUserName, DWORD nMaxUserNameSize);
BOOL GetNumaNodeProcessorMaskExStub(USHORT Node, PGROUP_AFFINITY ProcessorMask);
BOOL GetNumaProximityNodeExStub(ULONG ProximityId, PUSHORT NodeNumber);
int GetNumberFormatExStub(LPCWSTR lpLocaleName, DWORD dwFlags, LPCWSTR lpValue, const NUMBERFMTW *lpFormat, LPWSTR lpNumberStr, int cchNumber);
BOOL GetPhysicallyInstalledSystemMemoryStub(PULONGLONG TotalMemoryInKilobytes);
DWORD GetPriorityClassStub(HANDLE hProcess);
BOOL GetProcessGroupAffinityStub(HANDLE hProcess, PUSHORT GroupCount, PUSHORT GroupArray);
BOOL GetProcessHandleCountStub(HANDLE hProcess, PDWORD pdwHandleCount);
BOOL GetProcessPreferredUILanguagesStub(DWORD dwFlags, PULONG pulNumLanguages, PZZWSTR pwszLanguagesBuffer, PULONG pcchLanguagesBuffer);
BOOL GetProcessPriorityBoostStub(HANDLE hProcess, PBOOL pDisablePriorityBoost);
BOOL GetProcessShutdownParametersStub(LPDWORD lpdwLevel, LPDWORD lpdwFlags);
BOOL GetProcessWorkingSetSizeExStub(HANDLE hProcess, PSIZE_T lpMinimumWorkingSetSize, PSIZE_T lpMaximumWorkingSetSize, PDWORD Flags);
BOOL GetQueuedCompletionStatusExStub(HANDLE CompletionPort, LPOVERLAPPED_ENTRY lpCompletionPortEntries, ULONG ulCount, PULONG ulNumEntriesRemoved, DWORD dwMilliseconds, BOOL fAlertable);
int GetStringScriptsStub(DWORD dwFlags, LPCWSTR lpString, int cchString, LPWSTR lpScripts, int cchScripts);
int GetSystemDefaultLocaleNameStub(LPWSTR lpLocaleName, int cchLocaleName);
BOOL GetSystemFileCacheSizeStub(PSIZE_T lpMinimumFileCacheSize, PSIZE_T lpMaximumFileCacheSize, PDWORD lpFlags);
BOOL GetSystemPreferredUILanguagesStub(DWORD dwFlags, PULONG pulNumLanguages, PZZWSTR pwszLanguagesBuffer, PULONG pcchLanguagesBuffer);
BOOL GetThreadGroupAffinityStub(HANDLE hThread, PGROUP_AFFINITY GroupAffinity);
BOOL GetThreadIOPendingFlagStub(HANDLE hThread, PBOOL lpIOIsPending);
DWORD GetThreadIdStub(HANDLE Thread);
BOOL GetThreadIdealProcessorExStub(HANDLE hThread, PPROCESSOR_NUMBER lpIdealProcessor);
BOOL GetThreadPriorityBoostStub(HANDLE hThread, PBOOL pDisablePriorityBoost);
int GetTimeFormatAStub(LCID Locale, DWORD dwFlags, const SYSTEMTIME *lpTime, LPCSTR lpFormat, LPSTR lpTimeStr, int cchTime);
int GetTimeFormatExStub(LPCWSTR lpLocaleName, DWORD dwFlags, const SYSTEMTIME *lpTime, LPCWSTR lpFormat, LPWSTR lpTimeStr, int cchTime);
BOOL GetUILanguageInfoStub(DWORD dwFlags, PCZZWSTR pwmszLanguage, PZZWSTR pwszFallbackLanguages, PDWORD pcchFallbackLanguages, PDWORD pAttributes);
BOOL GetXStateFeaturesMaskStub(PCONTEXT Context, PDWORD64 FeatureMask);
SIZE_T HeapCompactStub(HANDLE hHeap, DWORD dwFlags);
BOOL HeapLockStub(HANDLE hHeap);
BOOL HeapQueryInformationStub(HANDLE HeapHandle, HEAP_INFORMATION_CLASS HeapInformationClass, PVOID HeapInformation, SIZE_T HeapInformationLength, PSIZE_T ReturnLength);
BOOL HeapSummaryStub(HANDLE hHeap, DWORD dwFlags, LPHEAP_SUMMARY lpSummary);
BOOL HeapUnlockStub(HANDLE hHeap);
BOOL HeapWalkStub(HANDLE hHeap, LPPROCESS_HEAP_ENTRY lpEntry);
int IdnToAsciiStub(DWORD dwFlags, LPCWSTR lpUnicodeCharStr, int cchUnicodeChar, LPWSTR lpASCIICharStr, int cchASCIIChar);
int IdnToNameprepUnicodeStub(DWORD dwFlags, LPCWSTR lpUnicodeCharStr, int cchUnicodeChar, LPWSTR lpNameprepCharStr, int cchNameprepChar);
int IdnToUnicodeStub(DWORD dwFlags, LPCWSTR lpASCIICharStr, int cchASCIIChar, LPWSTR lpUnicodeCharStr, int cchUnicodeChar);
int InitializeContext2Stub(int a1, int a2, int a3, int a4, int a5, int a6);
BOOL InitializeContextStub(PVOID Buffer, DWORD ContextFlags, PCONTEXT *Context, PDWORD ContextLength);
BOOL InitializeSynchronizationBarrierStub(LPSYNCHRONIZATION_BARRIER lpBarrier, LONG lTotalThreads, LONG lSpinCount);
BOOL IsDBCSLeadByteExStub(UINT CodePage, BYTE TestChar);
BOOL IsNLSDefinedStringStub(NLS_FUNCTION Function, DWORD dwFlags, LPNLSVERSIONINFO lpVersionInformation, LPCWSTR lpString, INT cchStr);
BOOL IsNormalizedStringStub(NORM_FORM NormForm, LPCWSTR lpString, int cwLength);
BOOL IsThreadAFiber();
BOOL IsValidLanguageGroupStub(LGRPID LanguageGroup, DWORD dwFlags);
int IsValidNLSVersionStub(int a1, int a2, int a3);
BOOL K32EmptyWorkingSetStub(HANDLE hProcess);
BOOL K32EnumDeviceDriversStub(LPVOID *lpImageBase, DWORD cb, LPDWORD lpcbNeeded);
BOOL K32EnumPageFilesAStub(PENUM_PAGE_FILE_CALLBACKA pCallBackRoutine, LPVOID pContext);
BOOL K32EnumPageFilesWStub(PENUM_PAGE_FILE_CALLBACKW pCallBackRoutine, LPVOID pContext);
BOOL K32EnumProcessesStub(DWORD *lpidProcess, DWORD cb, LPDWORD lpcbNeeded);
DWORD K32GetDeviceDriverBaseNameAStub(LPVOID ImageBase, LPSTR lpFilename, DWORD nSize);
DWORD K32GetDeviceDriverBaseNameWStub(LPVOID ImageBase, LPWSTR lpBaseName, DWORD nSize);
DWORD K32GetDeviceDriverFileNameAStub(LPVOID ImageBase, LPSTR lpFilename, DWORD nSize);
DWORD K32GetDeviceDriverFileNameWStub(LPVOID ImageBase, LPWSTR lpFilename, DWORD nSize);
DWORD K32GetMappedFileNameAStub(HANDLE hProcess, LPVOID lpv, LPSTR lpFilename, DWORD nSize);
DWORD K32GetMappedFileNameWStub(HANDLE hProcess, LPVOID lpv, LPWSTR lpFilename, DWORD nSize);
BOOL K32GetPerformanceInfoStub(PPERFORMANCE_INFORMATION pPerformanceInformation, DWORD cb);
DWORD K32GetProcessImageFileNameAStub(HANDLE hProcess, LPSTR lpImageFileName, DWORD nSize);
DWORD K32GetProcessImageFileNameWStub(HANDLE hProcess, LPWSTR lpImageFileName, DWORD nSize);
BOOL K32GetProcessMemoryInfoStub(HANDLE Process, PPROCESS_MEMORY_COUNTERS ppsmemCounters, DWORD cb);
BOOL K32GetWsChangesExStub(HANDLE hProcess, PPSAPI_WS_WATCH_INFORMATION_EX lpWatchInfoEx, PDWORD cb);
BOOL K32GetWsChangesStub(HANDLE hProcess, PPSAPI_WS_WATCH_INFORMATION lpWatchInfo, DWORD cb);
BOOL K32InitializeProcessForWsWatchStub(HANDLE hProcess);
BOOL K32QueryWorkingSetExStub(HANDLE hProcess, PVOID pv, DWORD cb);
BOOL K32QueryWorkingSetStub(HANDLE hProcess, PVOID pv, DWORD cb);
int LoadStringBaseExWStub(int a1, int a2, int a3, int a4, int a5);
PVOID LocateXStateFeatureStub(PCONTEXT Context, DWORD FeatureId, PDWORD Length);
BOOL MapUserPhysicalPagesStub(PVOID VirtualAddress, ULONG_PTR NumberOfPages, PULONG_PTR PageArray);
BOOL NeedCurrentDirectoryForExePathAStub(LPCSTR ExeName);
BOOL NeedCurrentDirectoryForExePathWStub(LPCWSTR ExeName);
int NlsEventDataDescCreateStub(int a1, int a2, int a3, int a4);
int NlsWriteEtwEventStub(int a1, int a2, int a3, int a4, int a5);
int NormalizeStringStub(NORM_FORM NormForm, LPCWSTR lpSrcString, int cwSrcLength, LPWSTR lpDstString, int cwDstLength);
BOOL PeekNamedPipeStub(HANDLE hNamedPipe, LPVOID lpBuffer, DWORD nBufferSize, LPDWORD lpBytesRead, LPDWORD lpTotalBytesAvail, LPDWORD lpBytesLeftThisMessage);
int PrivCopyFileExWStub(int a1, int a2, int a3, int a4, int a5, int a6);
int PssCaptureSnapshotStub(int a1, int a2, int a3, int a4);
int PssDuplicateSnapshotStub(int a1, int a2, int a3, int a4, int a5);
int PssFreeSnapshotStub(int a1, int a2);
int PssQuerySnapshotStub(int a1, int a2, int a3, int a4);
int PssWalkMarkerCreateStub(int a1, int a2);
int PssWalkMarkerFreeStub(int a1);
int PssWalkMarkerGetPositionStub(int a1, int a2);
int PssWalkMarkerSeekToBeginningStub(int a1);
int PssWalkMarkerSetPositionStub(int a1, int a2);
int PssWalkSnapshotStub(int a1, int a2, int a3, int a4, int a5);
BOOL PulseEventStub(HANDLE hEvent);
BOOL QueryActCtxSettingsWStub(DWORD dwFlags, HANDLE hActCtx, PCWSTR settingsNameSpace, PCWSTR settingName, PWSTR pvBuffer, SIZE_T dwBuffer, SIZE_T *pdwWrittenOrRequired);
BOOL QueryFullProcessImageNameAStub(HANDLE hProcess, DWORD dwFlags, LPSTR lpExeName, PDWORD lpdwSize);
BOOL QueryFullProcessImageNameWStub(HANDLE hProcess, DWORD dwFlags, LPWSTR lpExeName, PDWORD lpdwSize);
BOOL QueryIdleProcessorCycleTimeExStub(USHORT Group, PULONG BufferLength, PULONG64 ProcessorIdleCycleTime);
BOOL QueryIdleProcessorCycleTimeStub(PULONG BufferLength, PULONG64 ProcessorIdleCycleTime);
BOOL QueryMemoryResourceNotificationStub(HANDLE ResourceNotificationHandle, PBOOL ResourceState);
BOOL QueryProcessCycleTimeStub(HANDLE ProcessHandle, PULONG64 CycleTime);
BOOL QueryUnbiasedInterruptTimeStub(PULONGLONG UnbiasedTime);
int ReadDirectoryChangesExWStub(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8, int a9);
BOOL ReadDirectoryChangesWStub(HANDLE hDirectory, LPVOID lpBuffer, DWORD nBufferLength, BOOL bWatchSubtree, DWORD dwNotifyFilter, LPDWORD lpBytesReturned, LPOVERLAPPED lpOverlapped, LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);
LSTATUS RegCopyTreeWStub(HKEY hKeySrc, LPCWSTR lpSubKey, HKEY hKeyDest);
LSTATUS RegDeleteKeyExAStub(HKEY hKey, LPCSTR lpSubKey, REGSAM samDesired, DWORD Reserved);
LSTATUS RegDeleteKeyExWStub(HKEY hKey, LPCWSTR lpSubKey, REGSAM samDesired, DWORD Reserved);
LSTATUS RegDeleteTreeAStub(HKEY hKey, LPCSTR lpSubKey);
LSTATUS RegDeleteTreeWStub(HKEY hKey, LPCWSTR lpSubKey);
LSTATUS RegDeleteValueAStub(HKEY hKey, LPCSTR lpValueName);
LSTATUS RegDeleteValueWStub(HKEY hKey, LPCWSTR lpValueName);
LSTATUS RegEnumKeyExAStub(HKEY hKey, DWORD dwIndex, LPSTR lpName, LPDWORD lpcchName, LPDWORD lpReserved, LPSTR lpClass, LPDWORD lpcchClass, PFILETIME lpftLastWriteTime);
LSTATUS RegEnumKeyExWStub(HKEY hKey, DWORD dwIndex, LPWSTR lpName, LPDWORD lpcchName, LPDWORD lpReserved, LPWSTR lpClass, LPDWORD lpcchClass, PFILETIME lpftLastWriteTime);
LSTATUS RegEnumValueAStub(HKEY hKey, DWORD dwIndex, LPSTR lpValueName, LPDWORD lpcchValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData);
LSTATUS RegEnumValueWStub(HKEY hKey, DWORD dwIndex, LPWSTR lpValueName, LPDWORD lpcchValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData);
LSTATUS RegFlushKeyStub(HKEY hKey);
LSTATUS RegGetKeySecurityStub(HKEY hKey, SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor, LPDWORD lpcbSecurityDescriptor);
LSTATUS RegGetValueAStub(HKEY hkey, LPCSTR lpSubKey, LPCSTR lpValue, DWORD dwFlags, LPDWORD pdwType, PVOID pvData, LPDWORD pcbData);
LSTATUS RegGetValueWStub(HKEY hkey, LPCWSTR lpSubKey, LPCWSTR lpValue, DWORD dwFlags, LPDWORD pdwType, PVOID pvData, LPDWORD pcbData);
LSTATUS RegLoadKeyAStub(HKEY hKey, LPCSTR lpSubKey, LPCSTR lpFile);
LSTATUS RegLoadKeyWStub(HKEY hKey, LPCWSTR lpSubKey, LPCWSTR lpFile);
LSTATUS RegLoadMUIStringAStub(HKEY hKey, LPCSTR pszValue, LPSTR pszOutBuf, DWORD cbOutBuf, LPDWORD pcbData, DWORD Flags, LPCSTR pszDirectory);
LSTATUS RegLoadMUIStringWStub(HKEY hKey, LPCWSTR pszValue, LPWSTR pszOutBuf, DWORD cbOutBuf, LPDWORD pcbData, DWORD Flags, LPCWSTR pszDirectory);
LSTATUS RegNotifyChangeKeyValueStub(HKEY hKey, BOOL bWatchSubtree, DWORD dwNotifyFilter, HANDLE hEvent, BOOL fAsynchronous);
LSTATUS RegOpenCurrentUserStub(REGSAM samDesired, PHKEY phkResult);
LSTATUS RegOpenKeyExAStub(HKEY hKey, LPCSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult);
LSTATUS RegOpenUserClassesRootStub(HANDLE hToken, DWORD dwOptions, REGSAM samDesired, PHKEY phkResult);
LSTATUS RegQueryInfoKeyAStub(HKEY hKey, LPSTR lpClass, LPDWORD lpcchClass, LPDWORD lpReserved, LPDWORD lpcSubKeys, LPDWORD lpcbMaxSubKeyLen, LPDWORD lpcbMaxClassLen, LPDWORD lpcValues, LPDWORD lpcbMaxValueNameLen, LPDWORD lpcbMaxValueLen, LPDWORD lpcbSecurityDescriptor, PFILETIME lpftLastWriteTime);
LSTATUS RegQueryInfoKeyWStub(HKEY hKey, LPWSTR lpClass, LPDWORD lpcchClass, LPDWORD lpReserved, LPDWORD lpcSubKeys, LPDWORD lpcbMaxSubKeyLen, LPDWORD lpcbMaxClassLen, LPDWORD lpcValues, LPDWORD lpcbMaxValueNameLen, LPDWORD lpcbMaxValueLen, LPDWORD lpcbSecurityDescriptor, PFILETIME lpftLastWriteTime);
LSTATUS RegQueryValueExAStub(HKEY hKey, LPCSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData);
LSTATUS RegQueryValueExWStub(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData);
LSTATUS RegRestoreKeyAStub(HKEY hKey, LPCSTR lpFile, DWORD dwFlags);
LSTATUS RegRestoreKeyWStub(HKEY hKey, LPCWSTR lpFile, DWORD dwFlags);
LSTATUS RegSaveKeyExAStub(HKEY hKey, LPCSTR lpFile, const LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD Flags);
LSTATUS RegSaveKeyExWStub(HKEY hKey, LPCWSTR lpFile, const LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD Flags);
LSTATUS RegSetKeySecurityStub(HKEY hKey, SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR pSecurityDescriptor);
LSTATUS RegUnLoadKeyAStub(HKEY hKey, LPCSTR lpSubKey);
LSTATUS RegUnLoadKeyWStub(HKEY hKey, LPCWSTR lpSubKey);
int RegisterBadMemoryNotificationStub(int a1);
int ResolveLocaleNameStub(LPCWSTR lpNameToResolve, LPWSTR lpLocaleName, int cchLocaleName);
USHORT RtlCaptureStackBackTraceStub(ULONG FramesToSkip, ULONG FramesToCapture, PVOID *BackTrace, PULONG BackTraceHash);
void *RtlFillMemoryStub(void *a1, size_t Size, int Val);
PVOID RtlPcToFileHeaderStub(PVOID PcValue, PVOID *BaseOfImage);
int SetCachedSigningLevelStub(int a1, int a2, int a3, int a4);
BOOL SetCalendarInfoWStub(LCID Locale, CALID Calendar, CALTYPE CalType, LPCWSTR lpCalData);
BOOL SetComputerNameAStub(LPCSTR lpComputerName);
BOOL SetComputerNameEx2WStub(COMPUTER_NAME_FORMAT NameType, DWORD Flags, LPCWSTR lpBuffer);
BOOL SetComputerNameExAStub(COMPUTER_NAME_FORMAT NameType, LPCSTR lpBuffer);
BOOL SetComputerNameExWStub(COMPUTER_NAME_FORMAT NameType, LPCWSTR lpBuffer);
BOOL SetComputerNameWStub(LPCWSTR lpComputerName);
BOOL SetCurrentDirectoryAStub(LPCSTR lpPathName);
BOOL SetDynamicTimeZoneInformationStub(const DYNAMIC_TIME_ZONE_INFORMATION *lpTimeZoneInformation);
BOOL SetEnvironmentStringsWStub(LPWCH NewEnvironment);
BOOL SetEnvironmentVariableAStub(LPCSTR lpName, LPCSTR lpValue);
BOOL SetFileIoOverlappedRangeStub(HANDLE FileHandle, PUCHAR OverlappedRangeStart, ULONG Length);
BOOL SetLocalTimeStub(const SYSTEMTIME *lpSystemTime);
BOOL SetLocaleInfoWStub(LCID Locale, LCTYPE LCType, LPCWSTR lpLCData);
BOOL SetProcessPreferredUILanguagesStub(DWORD dwFlags, PCZZWSTR pwszLanguagesBuffer, PULONG pulNumLanguages);
BOOL SetProcessPriorityBoostStub(HANDLE hProcess, BOOL bDisablePriorityBoost);
BOOL SetProcessWorkingSetSizeExStub(HANDLE hProcess, SIZE_T dwMinimumWorkingSetSize, SIZE_T dwMaximumWorkingSetSize, DWORD Flags);
BOOL SetStdHandleExStub(DWORD nStdHandle, HANDLE hHandle, PHANDLE phPrevValue);
BOOL SetStdHandleStub(DWORD nStdHandle, HANDLE hHandle);
BOOL SetSystemFileCacheSizeStub(SIZE_T MinimumFileCacheSize, SIZE_T MaximumFileCacheSize, DWORD Flags);
BOOL SetSystemTimeStub(const SYSTEMTIME *lpSystemTime);
BOOL SetThreadGroupAffinityStub(HANDLE hThread, const GROUP_AFFINITY *GroupAffinity, PGROUP_AFFINITY PreviousGroupAffinity);
BOOL SetThreadIdealProcessorExStub(HANDLE hThread, PPROCESSOR_NUMBER lpIdealProcessor, PPROCESSOR_NUMBER lpPreviousIdealProcessor);
BOOL SetThreadPriorityBoostStub(HANDLE hThread, BOOL bDisablePriorityBoost);
LANGID SetThreadUILanguageStub(LANGID LangId);
BOOL SetTimeZoneInformationStub(const TIME_ZONE_INFORMATION *lpTimeZoneInformation);
BOOL SetVolumeMountPointWStub(LPCWSTR lpszVolumeMountPoint, LPCWSTR lpszVolumeName);
BOOL SetXStateFeaturesMaskStub(PCONTEXT Context, DWORD64 FeatureMask);
DWORD SignalObjectAndWaitStub(HANDLE hObjectToSignal, HANDLE hObjectToWaitOn, DWORD dwMilliseconds, BOOL bAlertable);
DWORD SuspendThreadStub(HANDLE hThread);
BOOL TerminateThreadStub(HANDLE hThread, DWORD dwExitCode);
BOOL TransactNamedPipeStub(HANDLE hNamedPipe, LPVOID lpInBuffer, DWORD nInBufferSize, LPVOID lpOutBuffer, DWORD nOutBufferSize, LPDWORD lpBytesRead, LPOVERLAPPED lpOverlapped);
int UnregisterBadMemoryNotificationStub(int a1);
DWORD VerLanguageNameAStub(DWORD wLang, LPSTR szLang, DWORD cchLang);
DWORD VerLanguageNameWStub(DWORD wLang, LPWSTR szLang, DWORD cchLang);
BOOL VerifyScriptsStub(DWORD dwFlags, LPCWSTR lpLocaleScripts, int cchLocaleScripts, LPCWSTR lpTestScripts, int cchTestScripts);
BOOL WaitForDebugEventStub(LPDEBUG_EVENT lpDebugEvent, DWORD dwMilliseconds);
BOOL WaitNamedPipeWStub(LPCWSTR lpNamedPipeName, DWORD nTimeOut);
HRESULT WerRegisterAdditionalProcessStub(DWORD processId, DWORD captureExtraInfoForThreadId);
HRESULT WerRegisterAppLocalDumpStub(PCWSTR localAppDataRelativePath);
HRESULT WerRegisterCustomMetadataStub(PCWSTR key, PCWSTR value);
HRESULT WerRegisterExcludedMemoryBlockStub(const void *address, DWORD size);
HRESULT WerRegisterMemoryBlockStub(PVOID pvAddress, DWORD dwSize);
HRESULT WerUnregisterAdditionalProcessStub(DWORD processId);
HRESULT WerUnregisterCustomMetadataStub(PCWSTR key);
HRESULT WerUnregisterExcludedMemoryBlockStub(const void *address);
HRESULT WerUnregisterFileStub(PCWSTR pwzFilePath);
HRESULT WerUnregisterMemoryBlockStub(PVOID pvAddress);
BOOL ZombifyActCtxStub(HANDLE hActCtx);
int lstrcmpStub(int a1, int a2);
int lstrcmpiStub(int a1, int a2);
BOOL AddIntegrityLabelToBoundaryDescriptor(HANDLE *BoundaryDescriptor, PSID IntegrityLabel);
DWORD Wow64SuspendThread(HANDLE hThread);
INT GetExpandedNameA(LPSTR lpszSource, LPSTR lpszBuffer);
INT GetExpandedNameW(LPWSTR lpszSource, LPWSTR lpszBuffer);
void LZClose(INT hFile);
INT LZInit(INT hfSource);
INT LZOpenFileA(LPSTR lpFileName, LPOFSTRUCT lpReOpenBuf, WORD wStyle);
INT LZOpenFileW(LPWSTR lpFileName, LPOFSTRUCT lpReOpenBuf, WORD wStyle);
INT LZRead(INT hFile, CHAR *lpBuffer, INT cbRead);
LONG LZSeek(INT hFile, LONG lOffset, INT iOrigin);
BOOL CommConfigDialogA(LPCSTR lpszName, HWND hWnd, LPCOMMCONFIG lpCC);
int GetConfigDialogName(int, int, void *Src, SIZE_T Size, PUNICODE_STRING DestinationString, int); // idb
BOOL GetDefaultCommConfigA(LPCSTR lpszName, LPCOMMCONFIG lpCC, LPDWORD lpdwSize);
BOOL GetDefaultCommConfigW(LPCWSTR lpszName, LPCOMMCONFIG lpCC, LPDWORD lpdwSize);
int GetFriendlyMatchComm(int, int, PCWSTR SourceString, int, int, int); // idb
BOOL SetDefaultCommConfigA(LPCSTR lpszName, LPCOMMCONFIG lpCC, DWORD dwSize);
int BaseDestroyVDMEnvironment(PANSI_STRING AnsiString, int); // idb
int BaseUpdateVDMEntry(int a1, int *a2, int a3, int a4);
HRESULT ULongAdd(ULONG ulAugend, ULONG ulAddend, ULONG *pulResult);
int VDMOperationStarted(int a1);
void _TlgCreateWsz(PEVENT_DATA_DESCRIPTOR pDesc, LPCWSTR pwsz);
BOOLEAN _tlgKeywordOn(TraceLoggingHProvider hProvider, ULONGLONG keyword);
TLG_STATUS _tlgWriteTransfer_EventWriteTransfer(TraceLoggingHProvider hProvider, const void *pEventMetadata, LPCGUID pActivityId, LPCGUID pRelatedActivityId, UINT32 cData, EVENT_DATA_DESCRIPTOR *pData);
BOOL BuildCommDCBA(LPCSTR lpDef, LPDCB lpDCB);
BOOL BuildCommDCBAndTimeoutsA(LPCSTR lpDef, LPDCB lpDCB, LPCOMMTIMEOUTS lpCommTimeouts);
BOOL BuildCommDCBAndTimeoutsW(LPCWSTR lpDef, LPDCB lpDCB, LPCOMMTIMEOUTS lpCommTimeouts);
BOOL BuildCommDCBW(LPCWSTR lpDef, LPDCB lpDCB);
int DeviceNameCompare(int a1, int a2, PCWSTR SourceString, int a4, int a5, char **a6);
DWORD CreateTapePartition(HANDLE hDevice, DWORD dwPartitionMethod, DWORD dwCount, DWORD dwSize);
DWORD EraseTape(HANDLE hDevice, DWORD dwEraseType, BOOL bImmediate);
DWORD GetTapePosition(HANDLE hDevice, DWORD dwPositionType, LPDWORD lpdwPartition, LPDWORD lpdwOffsetLow, LPDWORD lpdwOffsetHigh);
DWORD GetTapeStatus(HANDLE hDevice);
DWORD PrepareTape(HANDLE hDevice, DWORD dwOperation, BOOL bImmediate);
DWORD SetTapeParameters(HANDLE hDevice, DWORD dwOperation, LPVOID lpTapeInformation);
DWORD SetTapePosition(HANDLE hDevice, DWORD dwPositionMethod, DWORD dwPartition, DWORD dwOffsetLow, DWORD dwOffsetHigh, BOOL bImmediate);
DWORD WriteTapemark(HANDLE hDevice, DWORD dwTapemarkType, DWORD dwTapemarkCount, BOOL bImmediate);
BOOL CreateHardLinkTransactedA(LPCSTR lpFileName, LPCSTR lpExistingFileName, LPSECURITY_ATTRIBUTES lpSecurityAttributes, HANDLE hTransaction);
int CreateSocketHandle();
int GetHandleContext(int a1);
int RegisterConsoleIME(int a1, int a2);
int BasepRegenerateActCtxWithLanguage(PVOID Context, __int16 a2, _DWORD *a3);
int ZombifyActCtxWorker(PVOID Context); // idb
int GetComPlusPackageInstallStatus();
int SetComPlusPackageInstallStatus(int SystemInformation); // idb
void ApplicationRecoveryFinished(BOOL bSuccess);
HRESULT ApplicationRecoveryInProgress(PBOOL pbCancelled);
int GetApplicationRestartSettingsWorker(void *a1, _WORD *a2, unsigned int *a3, _DWORD *a4);
HRESULT UnregisterApplicationRecoveryCallback();
HRESULT UnregisterApplicationRestart();
int WerGetFlagsWorker(void *a1, _DWORD *a2);
HRESULT WerRegisterFileWorker(unsigned __int16 *a1, int a2, int a3);
int WerUnregisterFileWorker(const wchar_t *a1);
int WerUnregisterMemoryBlockWorker(void *a1);
int WerpInitiateRemoteRecovery(int a1);
int WerpNotifyUseStringResourceWorker(int a1);
BOOL GetProcessWorkingSetSize(HANDLE hProcess, PSIZE_T lpMinimumWorkingSetSize, PSIZE_T lpMaximumWorkingSetSize);
BOOL CancelTimerQueueTimer(HANDLE TimerQueue, HANDLE Timer);
BOOL DeleteTimerQueue(HANDLE TimerQueue);
HANDLE SetTimerQueueTimer(HANDLE TimerQueue, WAITORTIMERCALLBACK Callback, PVOID Parameter, DWORD DueTime, DWORD Period, BOOL PreferIo);
int BasepReportFault(_DWORD **a1, int a2);
DWORD DisableThreadProfiling(HANDLE PerformanceDataHandle);
DWORD EnableThreadProfiling(HANDLE ThreadHandle, DWORD Flags, DWORD64 HardwareCounters, HANDLE *PerformanceDataHandle);
DWORD QueryThreadProfiling(HANDLE ThreadHandle, PBOOLEAN Enabled);
DWORD ReadThreadProfilingData(HANDLE PerformanceDataHandle, DWORD Flags, PPERFORMANCE_DATA PerformanceData);
HANDLE BeginUpdateResourceA(LPCSTR pFileName, BOOL bDeleteExistingResources);
HANDLE BeginUpdateResourceW(LPCWSTR pFileName, BOOL bDeleteExistingResources);
BOOL EndUpdateResourceA(HANDLE hUpdate, BOOL fDiscard);
BOOL EndUpdateResourceW(HANDLE hUpdate, BOOL fDiscard);
HRESULT StringCchLengthW(STRSAFE_PCNZWCH psz, size_t cchMax, size_t *pcchLength);
static HRESULT StringCopyWorkerA(STRSAFE_LPSTR pszDest, size_t cchDest, size_t *pcchNewDestLength, STRSAFE_PCNZCH pszSrc, size_t cchToCopy);
static HRESULT StringLengthWorkerW_0_0_0(STRSAFE_PCNZWCH psz, size_t cchMax, size_t *pcchLength);
BOOL UpdateResourceA(HANDLE hUpdate, LPCSTR lpType, LPCSTR lpName, WORD wLanguage, LPVOID lpData, DWORD cb);
BOOL UpdateResourceW(HANDLE hUpdate, LPCWSTR lpType, LPCWSTR lpName, WORD wLanguage, LPVOID lpData, DWORD cb);
int BaseCheckAppcompatCacheExWorker(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8, int a9);
int BaseCheckAppcompatCacheWorker(int a1, int a2, int a3, int a4);
int BaseCleanupAppcompatCacheSupportWorker(int a1);
BOOL BaseFlushAppcompatCacheWorker();
ULONG BaseReadAppCompatDataForProcessWorker(HANDLE hProcess, _DWORD *a2, int a3);
BOOL BaseUpdateAppcompatCacheWorker(unsigned __int16 *a1, char *a2, int a3);
BOOL BasepInitAppCompatData(int a1, int a2, int a3);
char InternalCoStdMarshalObject(IStream *pStm, struct _GUID *riid, IUnknown *pUnk, int pServerCtx, int dwDestCtx, int pvDestCtx, int mshlflags);
int QuirkGetDataWorker(unsigned int a1, _DWORD *a2);
int QuirkIsEnabled2Worker(unsigned int a1, unsigned __int64 a2);
int QuirkIsEnabledForPackage2Worker(int a1, int a2, int a3, unsigned __int64 a4, _DWORD *a5);
int QuirkIsEnabledForPackage3Worker(PSID userSid, PCWSTR packageFullName, int a3, int a4, _DWORD *a5);
int QuirkIsEnabledForPackage4Worker(PSID userSid, PCWSTR packageFullName, int, int, int); // idb
int QuirkIsEnabledForPackageWorker(PCWSTR packageFullName, int a2, int a3, _DWORD *a4);
int QuirkIsEnabledForProcessWorker(HANDLE hProcess, int a2, int *a3);
int AdjustCalendarDate(struct CALDATETIME *, int, int); // idb
int CompareCalendarDates(struct CALDATETIME *a1, struct CALDATETIME *a2, _DWORD *a3);
int ConvertCalDateTimeToSystemTime(struct CALDATETIME *a1, CSHORT *a2);
int ConvertNLSDayOfWeekToWin32DayOfWeek(unsigned int a1);
int ConvertSystemTimeToCalDateTime(unsigned __int16 *a1, unsigned int a2, unsigned int *a3);
int GetCalendarDateFormat(LCID Locale, int a2, struct CALDATETIME *a3, __int16 *a4, int a5, int a6);
int GetCalendarDateFormatEx(int a1, signed int a2, struct CALDATETIME *a3, __int16 *a4, int a5, int a6);
int GetCalendarDaysInMonth(unsigned int a1, int a2, int a3, int a4);
int GetCalendarDifferenceInDays(struct CALDATETIME *a1, struct CALDATETIME *a2, int *a3);
int GetCalendarMonthsInYear(unsigned int a1, int a2, int a3);
int GetCalendarSupportedDateRange(unsigned int a1, struct CALDATETIME *a2, int a3);
int GetCalendarWeekNumber(struct CALDATETIME *a1, unsigned int a2, unsigned int a3, unsigned int *a4);
int IsCalendarLeapDay(unsigned int a1, int a2, int a3, int a4, int a5);
int IsCalendarLeapMonth(unsigned int a1, int a2, int a3, int a4);
int IsCalendarLeapYear(unsigned int a1, int a2, int a3);
int IsValidCalDateTime(struct CALDATETIME *, int); // idb
int UpdateCalendarDayOfWeek(struct CALDATETIME *); // idb
BOOL EnumCalendarInfoExA(CALINFO_ENUMPROCEXA lpCalInfoEnumProcEx, LCID Locale, CALID Calendar, CALTYPE CalType);
BOOL EnumDateFormatsA(DATEFMT_ENUMPROCA lpDateFmtEnumProc, LCID Locale, DWORD dwFlags);
BOOL EnumDateFormatsExA(DATEFMT_ENUMPROCEXA lpDateFmtEnumProcEx, LCID Locale, DWORD dwFlags);
BOOL EnumLanguageGroupLocalesA(LANGGROUPLOCALE_ENUMPROCA lpLangGroupLocaleEnumProc, LGRPID LanguageGroup, DWORD dwFlags, LONG_PTR lParam);
BOOL EnumSystemCodePagesA(CODEPAGE_ENUMPROCA lpCodePageEnumProc, DWORD dwFlags);
BOOL EnumSystemLanguageGroupsA(LANGUAGEGROUP_ENUMPROCA lpLanguageGroupEnumProc, DWORD dwFlags, LONG_PTR lParam);
BOOL EnumTimeFormatsA(TIMEFMT_ENUMPROCA lpTimeFmtEnumProc, LCID Locale, DWORD dwFlags);
BOOL EnumUILanguagesA(UILANGUAGE_ENUMPROCA lpUILanguageEnumProc, DWORD dwFlags, LONG_PTR lParam);
int FoldStringA(DWORD dwMapFlags, LPCSTR lpSrcStr, int cchSrc, LPSTR lpDestStr, int cchDest);
int GetCalendarInfoA(LCID Locale, CALID Calendar, CALTYPE CalType, LPSTR lpCalData, int cchData, LPDWORD lpValue);
int GetCurrencyFormatA(LCID Locale, DWORD dwFlags, LPCSTR lpValue, const CURRENCYFMTA *lpFormat, LPSTR lpCurrencyStr, int cchCurrency);
int GetDateFormatAWorker(UINT *a1, LCID Locale, DWORD dwFlags, SYSTEMTIME *a4, const char *a5, CHAR *a6, int cbMultiByte);
int GetGeoInfoA(GEOID Location, GEOTYPE GeoType, LPSTR lpGeoData, int cchData, LANGID LangId);
int GetNumberFormatA(LCID Locale, DWORD dwFlags, LPCSTR lpValue, const NUMBERFMTA *lpFormat, LPSTR lpNumberStr, int cchNumber);
int GetDateFormatAWorker(UINT *a1, LCID Locale, DWORD dwFlags, SYSTEMTIME *a4, const char *a5, CHAR *a6, int cbMultiByte);
BOOL SetCalendarInfoA(LCID Locale, CALID Calendar, CALTYPE CalType, LPCSTR lpCalData);
BOOL SetLocaleInfoA(LCID Locale, LCTYPE LCType, LPCSTR lpLCData);
int GetCurrencyFormatW(LCID Locale, DWORD dwFlags, LPCWSTR lpValue, const CURRENCYFMTW *lpFormat, LPWSTR lpCurrencyStr, int cchCurrency);
int GetDurationFormat(LCID Locale, DWORD dwFlags, const SYSTEMTIME *lpDuration, ULONGLONG ullDuration, LPCWSTR lpFormat, LPWSTR lpDurationStr, int cchDuration);
BOOL NotifyUILanguageChange(DWORD dwFlags, PCWSTR pcwstrNewLanguage, PCWSTR pcwstrPreviousLanguage, DWORD dwReserved, PDWORD pdwStatusRtrn);
BOOL EnumSystemGeoID(GEOCLASS GeoClass, GEOID ParentGeoId, GEO_ENUMPROC lpGeoEnumProc);
int EnumSystemGeoNames(int a1, int (__thiscall *a2)(_DWORD, int, int), int a3);
int GetGeoInfoEx(const WCHAR *a1, int a2, int a3, int a4);
int GetGeoInfoW(GEOID Location, GEOTYPE GeoType, LPWSTR lpGeoData, int cchData, LANGID LangId);
int GetUserDefaultGeoName(LPWSTR geoName, int geoNameCount);
BOOL SetUserGeoID(GEOID GeoId);
BOOL SetUserGeoName(const WCHAR *a1);
unsigned int SortGetHashCode(_DWORD *a1, int a2, _WORD *a3, int a4, int a5);
int SortIsDefinedString(int a1, int a2, int a3, unsigned __int16 *a4, int a5);
int BasepTpIoCallback(int a1, _DWORD *a2, int a3, NTSTATUS *a4, int a5);
int BasepTpIoCleanupCallback(int a1, int a2);
BOOLEAN BasepTpIoFinalizationCallback(int a1, _DWORD *P);
HRESULT ULongLongToULong(ULONGLONG ullOperand, ULONG *pulResult);
HRESULT ULongMult(ULONG ulMultiplicand, ULONG ulMultiplier, ULONG *pulResult);
static HRESULT StringVPrintfWorkerW_0(STRSAFE_LPWSTR pszDest, size_t cchDest, size_t *pcchNewDestLength, STRSAFE_LPCWSTR pszFormat, va_list argList);
_DWORD *BaseFormatTimeOut(_DWORD *a1, unsigned int a2);
int BasepAnsiStringToDynamicUnicodeString(PUNICODE_STRING, PCSZ SourceString); // idb
int BaseVerifyUnicodeString(int a1);
int BasepAllocateActivationContextActivationBlock(int a1, int a2, int a3, int a4);
BOOLEAN BasepFreeActivationContextActivationBlock(HANDLE *P);
DWORD GetLongPathNameA(LPCSTR lpszShortPath, LPSTR lpszLongPath, DWORD cchBuffer);
void __noreturn BaseExitThreadPoolThread(NTSTATUS ExitStatus);
UINT GetAtomNameA(ATOM nAtom, LPSTR lpBuffer, int nSize);
ATOM GlobalAddAtomExA(LPCSTR lpString, DWORD Flags);
UINT GlobalGetAtomNameA(ATOM nAtom, LPSTR lpBuffer, int nSize);
BOOL InitAtomTable(DWORD nSize);
ULONG AddLocalAlternateComputerNameW(WCHAR *Hostname, int a2);
BOOL DnsHostnameToComputerNameA(LPCSTR Hostname, LPSTR ComputerName, LPDWORD nSize);
BOOL DnsHostnameToComputerNameW(LPCWSTR Hostname, LPWSTR ComputerName, LPDWORD nSize);
ULONG EnumerateLocalComputerNamesA(unsigned __int64 a1, LPSTR lpMultiByteStr, unsigned int *a3);
ULONG EnumerateLocalComputerNamesW(unsigned __int64 a1, LPWSTR lpBuffer, unsigned int *a3);
ULONG RemoveLocalAlternateComputerNameW(WCHAR *Hostname, int a2);
DWORD SetLocalPrimaryComputerNameW(wchar_t *String, int a2);
HANDLE CreateJobObjectA(LPSECURITY_ATTRIBUTES lpJobAttributes, LPCSTR lpName);
HANDLE CreateJobObjectW(LPSECURITY_ATTRIBUTES lpJobAttributes, LPCWSTR lpName);
void FreeMemoryJobObject(void *Buffer);
HANDLE OpenJobObjectA(DWORD dwDesiredAccess, BOOL bInheritHandle, LPCSTR lpName);
HANDLE OpenJobObjectW(DWORD dwDesiredAccess, BOOL bInheritHandle, LPCWSTR lpName);
DWORD QueryIoRateControlInformationJobObject(HANDLE hJob, PCWSTR VolumeName, JOBOBJECT_IO_RATE_CONTROL_INFORMATION **InfoBlocks, ULONG *InfoBlockCount);
BOOL SetInformationJobObject(HANDLE hJob, JOBOBJECTINFOCLASS JobObjectInformationClass, LPVOID lpJobObjectInformation, DWORD cbJobObjectInformationLength);
DWORD SetIoRateControlInformationJobObject(HANDLE hJob, JOBOBJECT_IO_RATE_CONTROL_INFORMATION *IoRateControlInfo);
TLG_STATUS TraceLoggingRegisterEx_EventRegister_EventSetInformation(TraceLoggingHProvider hProvider, TLG_PENABLECALLBACK pEnableCallback, PVOID pCallbackContext);
void _tlgEnableCallback(LPCGUID pSourceId, ULONG callbackType, UCHAR level, ULONGLONG keywordAny, ULONGLONG keywordAll, PEVENT_FILTER_DESCRIPTOR pFilterData, PVOID pCallbackContext);
BOOL BackupRead(HANDLE hFile, LPBYTE lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, BOOL bAbort, BOOL bProcessSecurity, LPVOID *lpContext);
BOOL BackupSeek(HANDLE hFile, DWORD dwLowBytesToSeek, DWORD dwHighBytesToSeek, LPDWORD lpdwLowByteSeeked, LPDWORD lpdwHighByteSeeked, LPVOID *lpContext);
BOOL BackupWrite(HANDLE hFile, LPBYTE lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, BOOL bAbort, BOOL bProcessSecurity, LPVOID *lpContext);
int BaseWriteErrorElevationRequiredEvent();
DWORD GetPrivateProfileSectionA(LPCSTR lpAppName, LPSTR lpReturnedString, DWORD nSize, LPCSTR lpFileName);
DWORD GetPrivateProfileSectionNamesA(LPSTR lpszReturnBuffer, DWORD nSize, LPCSTR lpFileName);
BOOL GetPrivateProfileStructA(LPCSTR lpszSection, LPCSTR lpszKey, LPVOID lpStruct, UINT uSizeStruct, LPCSTR szFile);
BOOL GetPrivateProfileStructW(LPCWSTR lpszSection, LPCWSTR lpszKey, LPVOID lpStruct, UINT uSizeStruct, LPCWSTR szFile);
UINT GetProfileIntW(LPCWSTR lpAppName, LPCWSTR lpKeyName, INT nDefault);
DWORD GetProfileSectionA(LPCSTR lpAppName, LPSTR lpReturnedString, DWORD nSize);
DWORD GetProfileSectionW(LPCWSTR lpAppName, LPWSTR lpReturnedString, DWORD nSize);
BOOL WritePrivateProfileSectionA(LPCSTR lpAppName, LPCSTR lpString, LPCSTR lpFileName);
BOOL WritePrivateProfileSectionW(LPCWSTR lpAppName, LPCWSTR lpString, LPCWSTR lpFileName);
BOOL WritePrivateProfileStructA(LPCSTR lpszSection, LPCSTR lpszKey, LPVOID lpStruct, UINT uSizeStruct, LPCSTR szFile);
BOOL WritePrivateProfileStructW(LPCWSTR lpszSection, LPCWSTR lpszKey, LPVOID lpStruct, UINT uSizeStruct, LPCWSTR szFile);
BOOL WriteProfileSectionA(LPCSTR lpAppName, LPCSTR lpString);
BOOL WriteProfileSectionW(LPCWSTR lpAppName, LPCWSTR lpString);
BOOL WriteProfileStringA(LPCSTR lpAppName, LPCSTR lpKeyName, LPCSTR lpString);
BOOL WriteProfileStringW(LPCWSTR lpAppName, LPCWSTR lpKeyName, LPCWSTR lpString);
int BaseIsDosApplication(unsigned __int16 *a1, int a2);
BOOL GetBinaryTypeW(LPCWSTR lpApplicationName, LPDWORD lpBinaryType);
BOOL BindIoCompletionCallback(HANDLE FileHandle, LPOVERLAPPED_COMPLETION_ROUTINE Function, ULONG Flags);
BOOL CallNamedPipeA(LPCSTR lpNamedPipeName, LPVOID lpInBuffer, DWORD nInBufferSize, LPVOID lpOutBuffer, DWORD nOutBufferSize, LPDWORD lpBytesRead, DWORD nTimeOut);
BOOL GetNamedPipeClientComputerNameA(HANDLE Pipe, LPSTR ClientComputerName, ULONG ClientComputerNameLength);
BOOL GetNamedPipeClientProcessId(HANDLE Pipe, PULONG ClientProcessId);
BOOL GetNamedPipeHandleStateA(HANDLE hNamedPipe, LPDWORD lpState, LPDWORD lpCurInstances, LPDWORD lpMaxCollectionCount, LPDWORD lpCollectDataTimeout, LPSTR lpUserName, DWORD nMaxUserNameSize);
BOOL GetNamedPipeServerSessionId(HANDLE Pipe, PULONG ServerProcessId);
BOOL WaitNamedPipeA(LPCSTR lpNamedPipeName, DWORD nTimeOut);
int CheckForReadOnlyResource(_DWORD *a1, int a2);
HANDLE CreateBoundaryDescriptorA(LPCSTR Name, ULONG Flags);
HANDLE OpenPrivateNamespaceA(LPVOID lpBoundaryDescriptor, LPCSTR lpAliasPrefix);
BOOL CopyFileExA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName, LPPROGRESS_ROUTINE lpProgressRoutine, LPVOID lpData, LPBOOL pbCancel, DWORD dwCopyFlags);
BOOL CopyFileTransactedA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName, LPPROGRESS_ROUTINE lpProgressRoutine, LPVOID lpData, LPBOOL pbCancel, DWORD dwCopyFlags, HANDLE hTransaction);
BOOL CopyFileTransactedW(LPCWSTR lpExistingFileName, LPCWSTR lpNewFileName, LPPROGRESS_ROUTINE lpProgressRoutine, LPVOID lpData, LPBOOL pbCancel, DWORD dwCopyFlags, HANDLE hTransaction);
HFILE OpenFile(LPCSTR lpFileName, LPOFSTRUCT lpReOpenBuff, UINT uStyle);
BOOL ReplaceFileA(LPCSTR lpReplacedFileName, LPCSTR lpReplacementFileName, LPCSTR lpBackupFileName, DWORD dwReplaceFlags, LPVOID lpExclude, LPVOID lpReserved);
HANDLE CreateActCtxA(PCACTCTXA pActCtx);
BOOL CreateDirectoryExA(LPCSTR lpTemplateDirectory, LPCSTR lpNewDirectory, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
BOOL CreateDirectoryTransactedW(LPCWSTR lpTemplateDirectory, LPCWSTR lpNewDirectory, LPSECURITY_ATTRIBUTES lpSecurityAttributes, HANDLE hTransaction);
BOOL RemoveDirectoryTransactedW(LPCWSTR lpPathName, HANDLE hTransaction);
HANDLE CreateFileMappingNumaA(HANDLE hFile, LPSECURITY_ATTRIBUTES lpFileMappingAttributes, DWORD flProtect, DWORD dwMaximumSizeHigh, DWORD dwMaximumSizeLow, LPCSTR lpName, DWORD nndPreferred);
HANDLE CreateMailslotA(LPCSTR lpName, DWORD nMaxMessageSize, DWORD lReadTimeout, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
HANDLE CreateMailslotW(LPCWSTR lpName, DWORD nMaxMessageSize, DWORD lReadTimeout, LPSECURITY_ATTRIBUTES lpSecurityAttributes);
BOOL GetMailslotInfo(HANDLE hMailslot, LPDWORD lpMaxMessageSize, LPDWORD lpNextSize, LPDWORD lpMessageCount, LPDWORD lpReadTimeout);
BOOL SetMailslotInfo(HANDLE hMailslot, DWORD lReadTimeout);
HANDLE CreateWaitableTimerW(LPSECURITY_ATTRIBUTES lpTimerAttributes, BOOL bManualReset, LPCWSTR lpTimerName);
BOOLEAN CreateSymbolicLinkA(LPCSTR lpSymlinkFileName, LPCSTR lpTargetFileName, DWORD dwFlags);
BOOLEAN CreateSymbolicLinkTransactedA(LPCSTR lpSymlinkFileName, LPCSTR lpTargetFileName, DWORD dwFlags, HANDLE hTransaction);
BOOLEAN CreateSymbolicLinkTransactedW(LPCWSTR lpSymlinkFileName, LPCWSTR lpTargetFileName, DWORD dwFlags, HANDLE hTransaction);
BOOL DeleteFileTransactedW(LPCWSTR lpFileName, HANDLE hTransaction);
DWORD GetCompressedFileSizeTransactedW(LPCWSTR lpFileName, LPDWORD lpFileSizeHigh, HANDLE hTransaction);
BOOL GetFileAttributesTransactedA(LPCSTR lpFileName, GET_FILEEX_INFO_LEVELS fInfoLevelId, LPVOID lpFileInformation, HANDLE hTransaction);
BOOL MoveFileExA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName, DWORD dwFlags);
BOOL MoveFileTransactedA(LPCSTR lpExistingFileName, LPCSTR lpNewFileName, LPPROGRESS_ROUTINE lpProgressRoutine, LPVOID lpData, DWORD dwFlags, HANDLE hTransaction);
BOOL MoveFileTransactedW(LPCWSTR lpExistingFileName, LPCWSTR lpNewFileName, LPPROGRESS_ROUTINE lpProgressRoutine, LPVOID lpData, DWORD dwFlags, HANDLE hTransaction);
BOOL PrivMoveFileIdentityW(int a1, const WCHAR *a2, unsigned __int8 a3);
BOOL SetFileAttributesTransactedW(LPCWSTR lpFileName, DWORD dwFileAttributes, HANDLE hTransaction);
BOOL Heap32First(LPHEAPENTRY32 lphe, DWORD th32ProcessID, ULONG_PTR th32HeapID);
BOOL Heap32ListFirst(HANDLE hSnapshot, LPHEAPLIST32 lphl);
BOOL Heap32ListNext(HANDLE hSnapshot, LPHEAPLIST32 lphl);
BOOL Heap32Next(LPHEAPENTRY32 lphe);
BOOL DefineDosDeviceA(DWORD dwFlags, LPCSTR lpDeviceName, LPCSTR lpTargetPath);
DWORD QueryDosDeviceA(LPCSTR lpDeviceName, LPSTR lpTargetPath, DWORD ucchMax);
BOOL DeleteVolumeMountPointA(LPCSTR lpszVolumeMountPoint);
HANDLE FindFirstVolumeA(LPSTR lpszVolumeName, DWORD cchBufferLength);
HANDLE FindFirstVolumeMountPointA(LPCSTR lpszRootPathName, LPSTR lpszVolumeMountPoint, DWORD cchBufferLength);
HANDLE FindFirstVolumeMountPointW(LPCWSTR lpszRootPathName, LPWSTR lpszVolumeMountPoint, DWORD cchBufferLength);
BOOL FindNextVolumeA(HANDLE hFindVolume, LPSTR lpszVolumeName, DWORD cchBufferLength);
BOOL FindNextVolumeMountPointA(HANDLE hFindVolumeMountPoint, LPSTR lpszVolumeMountPoint, DWORD cchBufferLength);
BOOL FindNextVolumeMountPointW(HANDLE hFindVolumeMountPoint, LPWSTR lpszVolumeMountPoint, DWORD cchBufferLength);
BOOL FindVolumeMountPointClose(HANDLE hFindVolumeMountPoint);
BOOL GetVolumeNameForVolumeMountPointA(LPCSTR lpszVolumeMountPoint, LPSTR lpszVolumeName, DWORD cchBufferLength);
BOOL GetVolumeNameForVolumeMountPointA(LPCSTR lpszFileName, LPSTR lpszVolumePathName, DWORD cchBufferLength);
BOOL GetVolumePathNamesForVolumeNameA(LPCSTR lpszVolumeName, LPCH lpszVolumePathNames, DWORD cchBufferLength, PDWORD lpcchReturnLength);
BOOL SetVolumeMountPointA(LPCSTR lpszVolumeMountPoint, LPCSTR lpszVolumeName);
BOOL SetVolumeMountPointW(LPCWSTR lpszVolumeMountPoint, LPCWSTR lpszVolumeName);
int DosPathToSessionPathA(int a1, const char *lp, char **a3);
int DosPathToSessionPathW(int a1, void *lp, wchar_t **a3);
BOOL FindActCtxSectionStringA(DWORD dwFlags, const GUID *lpExtensionGuid, ULONG ulSectionId, LPCSTR lpStringToFind, PACTCTX_SECTION_KEYED_DATA ReturnedData);
DWORD GetDllDirectoryW(DWORD nBufferLength, LPWSTR lpBuffer);
WORD GetActiveProcessorGroupCount();
DWORD GetMaximumProcessorCount(WORD GroupNumber);
WORD GetMaximumProcessorGroupCount();
BOOL SetProcessAffinityMask(HANDLE hProcess, DWORD_PTR dwProcessAffinityMask);
BOOL GetDevicePowerState(HANDLE hDevice, BOOL *pfOn);
BOOL PowerClearRequest(HANDLE PowerRequest, POWER_REQUEST_TYPE RequestType);
HANDLE PowerCreateRequest(PREASON_CONTEXT Context);
BOOL PowerSetRequest(HANDLE PowerRequest, POWER_REQUEST_TYPE RequestType);
DWORD GetFirmwareEnvironmentVariableA(LPCSTR lpName, LPCSTR lpGuid, PVOID pBuffer, DWORD nSize);
DWORD GetFirmwareEnvironmentVariableW(LPCWSTR lpName, LPCWSTR lpGuid, PVOID pBuffer, DWORD nSize);
BOOL SetFirmwareEnvironmentVariableA(LPCSTR lpName, LPCSTR lpGuid, PVOID pValue, DWORD nSize);
BOOL SetFirmwareEnvironmentVariableW(LPCWSTR lpName, LPCWSTR lpGuid, PVOID pValue, DWORD nSize);
int GetFirmwareType(_DWORD *a1);
DWORD GetFullPathNameTransactedW(LPCWSTR lpFileName, DWORD nBufferLength, LPWSTR lpBuffer, LPWSTR *lpFilePart, HANDLE hTransaction);
BOOL SetVolumeLabelA(LPCSTR lpRootPathName, LPCSTR lpVolumeName);
BOOL SetVolumeLabelW(LPCWSTR lpRootPathName, LPCWSTR lpVolumeName);
BOOL GetNumaAvailableMemoryNodeEx(USHORT Node, PULONGLONG AvailableBytes);
BOOL GetNumaNodeProcessorMask(UCHAR Node, PULONGLONG ProcessorMask);
BOOL GetNumaProcessorNodeEx(PPROCESSOR_NUMBER Processor, PUSHORT NodeNumber);
DWORD GetTapeParameters(HANDLE hDevice, DWORD dwOperation, LPDWORD lpdwSize, LPVOID lpTapeInformation);
BOOL GetThreadSelectorEntry(HANDLE hThread, DWORD dwSelector, LPLDT_ENTRY lpSelectorEntry);
UINT LocalFlags(HLOCAL hMem);
int OOBEComplete(_DWORD *a1);
int OOBECompleteWnfCallback(_DWORD *a1, int *a2, int a3, int a4, int a5, int a6);
int OOBECompleteWnfQueryCallback(int a1, int a2, int a3, int a4, _DWORD *a5, int *a6, int a7);
int OOBECompleteWnfWaitCallback(int a1, int a2, int a3, int a4, _DWORD *a5, int *a6, int a7);
int RegisterWaitUntilOOBECompleted(int a1, int a2, _DWORD *a3);
int UnregisterWaitUntilOOBECompleted(_DWORD *P);
BOOL SetEnvironmentStringsA(LPCH NewEnvironment);
int GetCompatFlags();
int IsCallerAdminOrSystem();
HRESULT StringCbCatExW(STRSAFE_LPWSTR pszDest, size_t cbDest, STRSAFE_LPCWSTR pszSrc, STRSAFE_LPWSTR *ppszDestEnd, size_t *pcbRemaining, DWORD dwFlags);
HRESULT StringCbCopyExW(STRSAFE_LPWSTR pszDest, size_t cbDest, STRSAFE_LPCWSTR pszSrc, STRSAFE_LPWSTR *ppszDestEnd, size_t *pcbRemaining, DWORD dwFlags);
static HRESULT StringCopyWorkerA_0_0(STRSAFE_LPSTR pszDest, size_t cchDest, size_t *pcchNewDestLength, STRSAFE_PCNZCH pszSrc, size_t cchToCopy);
static HRESULT StringCopyWorkerW_2_0(STRSAFE_LPWSTR pszDest, size_t cchDest, size_t *pcchNewDestLength, STRSAFE_PCNZWCH pszSrc, size_t cchToCopy);
static HRESULT StringExValidateDestW(STRSAFE_PCNZWCH pszDest, size_t cchDest, const size_t cchMax, DWORD dwFlags);
static HRESULT StringValidateDestAndLengthW(STRSAFE_LPCWSTR pszDest, size_t cchDest, size_t *pcchDestLength, const size_t cchMax);
int TermsrvRestoreKey(int a1, int a2, int a3);
int TermsrvRestoreKey(int a1, int a2, int a3);
DWORD_PTR SetThreadAffinityMask(HANDLE hThread, DWORD_PTR dwThreadAffinityMask);
BOOLEAN Wow64EnableWow64FsRedirection(BOOLEAN Wow64FsEnableRedirection);
HFILE _lcreat(LPCSTR lpPathName, int iAttribute);
HFILE _lopen(LPCSTR lpPathName, int iReadWrite);
UINT _lwrite(HFILE hFile, LPCCH lpBuffer, UINT uBytes);
int lstrcmpiA(LPCSTR lpString1, LPCSTR lpString2);
MMRESULT timeGetDevCaps(LPTIMECAPS ptc, UINT cbtc);
int BasepGetMiniVersionForCreate();
BOOL CloseConsoleHandle(void *a1);
HANDLE GetConsoleInputWaitHandle();
int VerifyConsoleIoHandle(int a1);
int ConsoleMenuControl(int a1, int a2, int a3);
int GetConsoleHardwareState(int a1, _DWORD *a2, _DWORD *a3);
int RegisterConsoleVDM(int a1, int a2, int a3, int a4, int a5, _DWORD *a6, _DWORD *a7, int a8, _DWORD *a9);
int SetConsoleCursor(int a1, int a2);
int SetConsoleHardwareState(int a1, int a2, int a3);
int SetConsoleKeyShortcuts(int a1, char a2, int a3, int a4);
int SetConsoleMenuClose(int a1);
int SetConsolePalette(int a1, int a2, int a3);
int ShowConsoleCursor(int a1, int a2);
int WriteConsoleInputVDMA(int a1, int a2, int a3, _DWORD *a4);
int WriteConsoleInputVDMW(int a1, int a2, int a3, _DWORD *a4);
int GetConsoleCharType(int a1, int a2, _DWORD *a3);
int RegisterConsoleOS2(int a1);
int SetConsoleLocalEUDC(int a1, __int16 a2, int a3, int a4);
int SetConsoleOS2OemFormat(int a1);
int GetConsoleFontInfo(int a1, char a2, unsigned int a3, int a4);
int GetConsoleKeyboardLayoutNameA(_BYTE *a1);
int GetConsoleKeyboardLayoutNameW(_BYTE *a1);
int GetNumberOfConsoleFonts();
int SetConsoleFont(int a1, int a2);
int SetConsoleIcon(int a1);
int SetConsoleMaximumWindowSize(int a1, int a2);
int InvalidateConsoleDIBits(int a1, _DWORD *a2);
int VDMConsoleOperation(unsigned int a1, int *a2);
int GetCorruptDetectionState();
int Initialize16BitCriticalSection(int a1, int a2, int a3);
int ByteMatch(_DWORD *a1, int a2, _DWORD *a3);
int ResourceDataMatch(_DWORD *a1, int a2, _DWORD *a3);
int SXSManifest(int a1, const wchar_t **a2, _DWORD *lParam);
int StringTable(_DWORD *a1, int a2, _DWORD *a3);
const wchar_t *WerpGetHeapHandle();
int WerpMapProtectionLevel(unsigned __int8 a1);
int WerpGetDebugger(HANDLE ProcessHandle, int *Dst);
int WerpLaunchAeDebug(void *a1, void *a2, char *a3, char *a4, int a5);
int WerpRecoveryInvokedRemotely();
static HRESULT StringLengthWorkerA(STRSAFE_PCNZCH psz, size_t cchMax, size_t *pcchLength);
NTSTATUS RtlStringCopyWorkerW_5(wchar_t *pszDest, size_t cchDest, const wchar_t *pszSrc);
_DWORD *SdbInitDatabaseEx(__int16 a1);
int InitOnceGetStringTableOffset(int a1, int a2, _DWORD *a3);
int SdbpGetPathAppPatch(_WORD *a1, unsigned int a2, wchar_t *a3, int a4);
int SdbpGetPathAppPatchPreRS3(_WORD *a1, unsigned int a2, wchar_t *a3, __int16 *a4);
int SdbpGetPathAppraiser(_WORD *a1, unsigned int a2, wchar_t *a3, __int16 *a4);
int SdbpGetPathCustomSdb(_WORD *a1, unsigned int a2, wchar_t *a3, int a4);
int SdbpGetPathCustomSdbPreRS3(_WORD *a1, unsigned int a2, wchar_t *a3, __int16 *a4);
int SdbpGetPathSystem(_WORD *a1, int a2, wchar_t *a3, __int16 *a4);
int SdbpCheckMatchingDevice(_DWORD *a1, int a2, int a3, int a4, int a5, int a6, int a7);
int SdbpCheckMatchingDir(_DWORD *a1, int a2, int a3, int a4, int a5, _DWORD *a6, int a7);
int SdbpCheckMatchingFiles(_DWORD *a1, int a2, int a3, int a4, int a5, _DWORD *a6, int a7);
int SdbpCheckMatchingRegistry(int *a1, int a2, int a3, int a4, int a5, int a6, int a7);
int SdbpCheckMatchingText(int *a1, int a2, int a3, int a4, int a5, _DWORD *a6, int a7);
int SdbpCheckMatchingWildcardFiles(_DWORD *a1, int a2, int a3, int a4, int a5, _DWORD *a6, int a7);
int SdbpCheckMatchingWildcardRegistry(_DWORD *a1, int a2, int a3, int a4, int a5, int a6, int a7);
int SdbpCheckOSKind(_DWORD *a1, int a2, int a3, int a4, int a5, int a6, int a7);
int SdbpCheckPackageAttributes(BOOL *a1, int a2, int a3, int a4, int a5, int a6, int a7);
int SdbpCheckRuntimePlatform(int *a1, int a2, int a3, int a4, int a5, int a6, int a7);
BOOL SdbpCheckFromVersion(unsigned __int64 a1, unsigned __int64 a2);
BOOL SdbpCheckUptoVersion(unsigned __int64 a1, unsigned __int64 a2);
int SdbpCheckVersion(unsigned __int64 a1, unsigned __int64 a2);